<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="17271">
<package pkgid="39e5514280088eb6c48ffcae2febcb4917aba329f553b5d0220274af07e1372f" name="389-ds" arch="aarch64">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="65c3bc78714ee0c888f8c0b4474d88219ca0f91d221f98831a107d06c37288eb" name="389-ds" arch="ppc64le">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="d84a0d44a29c35a8f7760202400199574529d2005fb6d79fd0254558a0bd4582" name="389-ds" arch="s390x">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="8ddaf45babed9b1081a6add1208ef4e266e6c5b14a313f56bcfa56a92e216a00" name="389-ds" arch="src">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="212a4be3d5235966b00b7c4a1c79adf64214bf38f8d898900604ce473d34903d" name="389-ds" arch="x86_64">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="0368f349fe8e816b17ff6acc7b23d1dc1005654a7b30d0e1d70c8df8b381a614" name="389-ds" arch="aarch64">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="74ab063994a334c92a80c7a9dfbfcc56824a20e07324e72a6a8749b27186ab35" name="389-ds" arch="ppc64le">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="10d9e56cef39561bc571393719dcc20e00dff6816ac281ddaccbf6450813fc90" name="389-ds" arch="s390x">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="438c7f3afee143fced09d054c2e05319ea90dd682d6bb3b3881fd20180eb4784" name="389-ds" arch="src">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="7b8236668af17a24a911b74a12789bacc4ddf32b8fb2abeb481759ef0a4505f9" name="389-ds" arch="x86_64">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="8776fdf4c890bd192f40d1853db3dc2fb3a4520dff8c5d534b40948e4e76e92b" name="389-ds-devel" arch="aarch64">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="1dd16a6b3e2a1223f6b63936d8b93fa15b9ed04daeff18eb4061d58f292f945d" name="389-ds-devel" arch="ppc64le">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="33499cf7788d41d903c025c63295ccc71ef4ed6119977ba01d956cecfe488bc2" name="389-ds-devel" arch="s390x">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="5b09439c26d50c365715b2c9ba7ba2265b53d0cfcb904742739f9f0fb44ee448" name="389-ds-devel" arch="x86_64">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="b036e38d8fef144bfc9d31f87f9e334e100dd3d57cded5c344140857d68dc697" name="389-ds-devel" arch="aarch64">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="7f9d66e0388c5523d9c9a9ad6b94b73d5e2265da179c9fd3182b1f4d1ba3be77" name="389-ds-devel" arch="ppc64le">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="f2fae075c0d6670eca4273f298d64da145f872b3204c85884bb3c76312f21b44" name="389-ds-devel" arch="s390x">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="fadd3fca1038747162f001095b1935d6c0eba834f39248e540f8e99f86d221d0" name="389-ds-devel" arch="x86_64">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="d239408a90ce53f082bbbe21280c375b5158b7e65689b57549490db5d7a1bfd7" name="389-ds-snmp" arch="aarch64">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="833db83b48cc0afd6994e59f83b4689a0a3190a6a3776db45bae88361d083884" name="389-ds-snmp" arch="ppc64le">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="f72998045902fe502325a1d75bdefc6fcc17875aeca31fc11f0422e681d1b51b" name="389-ds-snmp" arch="s390x">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="b56f5c5b32d23ab31e875502304ae0f12f33ebfd179a399a33e14780da73329a" name="389-ds-snmp" arch="x86_64">
  <version epoch="0" ver="2.2.10~git2.345056d3" rel="150600.8.7.2"/>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
  <changelog author="william.brown@suse.com" date="1723464000">- bsc#1225512 - VUL-0: CVE-2024-3657: 389-ds: potential denial of
  service via specially crafted kerberos AS-REQ request
- bsc#1226277 - VUL-0: CVE-2024-5953: 389-ds: malformed userPassword
  hashes may cause a denial of service
- bsc#1228912 - 389ds crash when user does change password using
  iso-8859-1 encoding
- Update to version 2.2.10~git2.345056d3:
  * Issue 2324 - Add a CI test (#6289)
  * Issue 6284 - BUG - freelist ordering causes high wtime
  * Bump version to 2.2.10
  * Issue 5327 - Fix test metadata
  * Security fix for CVE-2024-5953
  * Security fix for CVE-2024-3657
  * Security fix for CVE-2024-2199 (bsc#1225507)
  * Issue 5853 - Update Cargo.lock
  * Issue 5962 - Rearrange includes for 32-bit support logic
  * Issue 5973 - Fix fedora cop RawHide builds (#5974)
  * Bump braces from 3.0.2 to 3.0.3 in /src/cockpit/389-console
  * Issue 6254 - Enabling replication for a sub suffix crashes browser (#6255)
  * Issue 6224 - d2entry - Could not open id2entry err 0 - at startup when having sub-suffixes (#6225)
  * Issue 6183 - Slow ldif2db import on a newly created BDB backend (#6208)
  * Issue 6170 - audit log buffering doesn't handle large updates
  * Issue 6193 - Test failure: test_tls_command_returns_error_text
  * Issue 6189 - CI tests fail with `[Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'`
  * Issue 6172 - RFE: improve the performance of evaluation of filter component when tested against a large valueset (like group members) (#6173)
  * Issue 6092 - passwordHistory is not updated with a pre-hashed password (#6093)
  * Issue 6080 - ns-slapd crash in referint_get_config (#6081)
  * Issue 6117 - Fix the UTC offset print (#6118)
  * Issue 5305 - OpenLDAP version autodetection doesn't work
  * Issue 6112 - RFE - add new operation note for MFA authentications
  * Issue 5842 - Add log buffering to audit log
  * Issue 6103 - New connection timeout error breaks errormap (#6104)
  * Issue 6067 - Improve dsidm CLI No Such Entry handling (#6079)
  * Issue 6096 - Improve connection timeout error logging (#6097)
  * Issue 6067 - Add hidden -v and -j options to each CLI subcommand (#6088)
  * Issue 5487 - Fix various isses with logconv.pl (#6085)
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="dac681f057dd17ebe044ffcd71b89b00d6aae6d0a05f118ec21b430d5717b6f8" name="389-ds-snmp" arch="aarch64">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="619a7b637daba6d951bf78ef4010f62afa54b930860f2b647586268854e9a60b" name="389-ds-snmp" arch="ppc64le">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="afef0c94fc40cacffd96a9d7bacdfe57bd3c36da4b150855dca82fb6d5dc2bfe" name="389-ds-snmp" arch="s390x">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="8a70393192618581a8431af780dff751fa1decc8f9cf8694736b48c64dbe1035" name="389-ds-snmp" arch="x86_64">
  <version epoch="0" ver="2.2.8~git65.347aae6" rel="150600.8.3.1"/>
  <changelog author="william.brown@suse.com" date="1648728000">- Resolve bsc#1197275 - CVE-2022-0918 - Crafted message may cause DoS
- Update to version 2.0.15~git4.f46ab49c9:
  * Issue 5242- Craft message may crash the server (#5243)
  * Issue 5234 - UI - rename Users and Groups tab
  * Issue 5217 - Simplify instance creation and administration by non root user (#5224)
  * Issue 5227 - UI - No way to move back to Get Started step (#5233)
  * Bump version to 2.0.15
  * Issue 5230 - Race condition in RHDS disk monitoring functions
  * Issue 4299 - UI - Add CoS funtionality (#5196)
  * Issue 5225 - UI - impossible to manually set entry cache
  * Issue 5186 - UI - Fix SASL Mapping regex test feature
  * Issue 5221 - User with expired password can still login with full privledges</changelog>
  <changelog author="william.brown@suse.com" date="1651579200">- Resolve bsc#1199008 - An incorrectly backported fix would cause dscontainer not to start
  due to a missing function definition
- Update to version 2.0.15~git17.498ec3e93:
  * Issue 5273 - CLI - add arg completer for instance name
  * Issue 2893 - CLI - dscreate - add options for setting up replication
  * Issue 4866 - CLI - when enabling replication set changelog trimming by default
  * Issue 5241 - UI - Add account locking missing functionality (#5251)
  * Issue 5180 - snmp_collator tries to unlock NULL mutex (#5266)
  * Issue 5098 - Fix cherry-pick error
  * Fix cherry-pick error
  * Issue 4904 - Fix various small issues
  * Issue 5260 - BUG - OpenLDAP allows multiple names of memberof overlay (#5261)
  * Issue 5252 - During DEL, vlv search can erroneously return NULL candidate (#5256)
  * Issue 5210 - Python undefined names in lib389
  * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960)
  * Issue 5249 - dscontainer: ImportError: cannot import name 'get_default_db_lib' from 'lib389.utils'</changelog>
  <changelog author="william.brown@suse.com" date="1653998400">- bsc#1199889 - CVE-2022-1949 - full access control bypass with simple crafted query, resolved
  by Issue 5170.
- Update to version 2.0.15~git26.1ea6a6803:
  * Issue 5302 - Release tarballs don't contain cockpit webapp
  * Issue 5237 - audit-ci: Cannot convert undefined or null to object
  * Issue 5170 - BUG - ldapsubentries were incorrectly returned (#5285)
  * Issue 4970 - Add support for recursively deleting subentries
  * Issue 5284 - Replication broken after password change (#5286)
  * Issue 5291 - Harden ReplicationManager.wait_for_replication (#5292)
  * Issue 5279 - dscontainer: TypeError: unsupported operand type(s) for /: 'str' and 'int'
  * Issue 5170 - RFE - Filter optimiser (#5171)
  * Issue 5276 - CLI - improve task handling
  * Issue 5273 - CLI - add arg completer for instance name</changelog>
  <changelog author="william.brown@suse.com" date="1654689600">- Changelog fix - bsc#1195324 - CVE-2021-4091 - double free in psearch</changelog>
  <changelog author="william.brown@suse.com" date="1659441600">- bsc#1197998 - Update sudoers schema to support UTF-8
- Update to version 2.0.16~git9.e2a858a86:
  * Issue 5386 - BUG - Update sudoers schema to correctly support UTF-8 (#5387)
  * Issue 5383 - UI - Various fixes and RFE's for UI
  * Issue 4656 - Remove problematic language from source code
  * Issue 5380 - Separate cleanAllRUV code into new file
  * Issue 5322 - optime &amp; wtime on rejected connections is not properly set
  * Issue 5375 - CI - disable TLS hostname checking
  * Issue 5373 - dsidm user get_dn fails with search_ext() argument 1 must be str, not function
  * Issue 5371 - Update npm and cargo packages
  * Issue 3069 - Support ECDSA private keys for TLS (#5365)
  * Bump version to 2.0.16</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- bsc#1202470 - CVE-2022-2850 - Resolve sync repl crash during invalid cookie handling
- Update to version 2.0.16~git20.219f047ae:
  * Issue #5423 - Fix missing 'not' in description
  * Issue 5421 - CI - makes replication/acceptance_test.py::test_modify_entry more robust (#5422)
  * Issue 3903 - fix repl keep alive event interval
  * Issue 5418 - Sync_repl may crash while managing invalid cookie (#5420)
  * Issue 5415 - Hostname when set to localhost causing failures in other tests
  * Issue 5412 - lib389 - do not set backend name to lowercase
  * Issue 3903 - keep alive update event starts too soon
  * Issue 5397 - Fix various memory leaks
  * Issue 5399 - UI - LDAP Editor is not updated when we switch instances (#5400)
  * Issue 3903 - Supplier should do periodic updates</changelog>
  <changelog author="william.brown@suse.com" date="1664193600">- bsc#1194119 - CVE-2021-45710 - tokio data race with memory corruption
- Update to version 2.0.16~git37.9a47b3d2:
  * Revert "Issue 5446 - Fix some covscan issues (#5451)"
  * Issue 5254 - dscreate create-template regression due to 5a3bdc336 (#5255)
  * Issue 5271 - Serialization of pam_passthrough causing high etimes (#5272)
  * Issue 5453 - UI/CLI - Changing Root DN breaks UI
  * Issue 5446 - Fix some covscan issues (#5451)
  * Issue 5294: Report Portal 5 is not processing an XML file with (#5358)
  * Issue 4588 - Gost yescrypt may fail to build on some older versions of glibc
  * Issue 4308 - checking if an entry is a referral is expensive
  * Issue 5447 - UI - add NDN max cache size to UI
  * Issue 5443 - UI - disable save button while saving
  * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078)</changelog>
  <changelog author="william.brown@suse.com" date="1666353600">- bsc#1204493 - Improve reliability of migrations from openldap when dynamic directory services
  is configured.
- Update to version 2.0.16~git52.76ecbe1:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 4776 - Fix entryuuid fixup task (#5483)
  * Issue 5356 - Update Cargo.lock and bootstrap PBKDF2-SHA512 (#5480)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 5462 - RFE - add missing default indexes (#5464)
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c</changelog>
  <changelog author="william.brown@suse.com" date="1666353601">- Update to version 2.2.3~git20.b1ed566:
  * Issue 5495 - RFE - skip dds during migration. (#5496)
  * Issue 5491 - UI - Add rework and finish jpegPhoto functionality (#5492)
  * Issue 5368 - Retro Changelog trimming does not work (#5486)
  * Issue 5487 - Fix various issues with logconv.pl
  * Issue 5482 - lib389 - Can not enable replication with a mixed case suffix
  * Issue 5478 - Random crash in connection code during server shutdown (#5479)
  * Issue 3061 - RFE - Add password policy debug log level
  * Issue 4324 - Revert recursive pthread mutex usage in factory.c
  * Issue 5262 - high contention in find_entry_internal_dn on mixed load (#5264)
  * Issue 4324 - Revert recursive pthread mutex change (#5463)</changelog>
  <changelog author="william.brown@suse.com" date="1669204800">- Update to version 2.2.4~git5.d25f9eb:
  * Issue 5541 - Fix typo in `lib389.cli_conf.backend._get_backend` (#5542)
  * Issue 5539 - Make logger's parameter name unified (#5540)
  * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538)
  * Issue 5534 - Fix a rebase typo (#5537)
  * Issue 5534 - Add copyright text to the repository files
  * Bump version to 2.2.4
  * Issue 5532 - Make db compaction TOD day more robust.
  * Issue 3729 - RFE Extend log of operations statistics in access log (#5508)
  * Issue 5529 - UI - Fix npm vulnerability in loader-utils
  * Issue 3555 - UI - fix audit issue with npm loader-utils (#5514)
  * Issue 5162 - Fix dsctl tls ca-certfiicate add-cert arg requirement
  * Issue 5510 - remove twalk_r dependency to build on RHEL8 (#5516)
  * Issue 5162 - RFE - CLI allow adding CA certificate bundles
  * Issue 5440 - memberof is slow on update/fixup if there are several 'groupattr' (#5455)
  * Issue 5512 - BUG - skip pwdPolicyChecker OC in migration (#5513)
  * Issue 5429 - healthcheck - add checks for MemberOf group attrs being indexed
  * Issue 5502 - RFE - Add option to display entry attributes in audit log
  * Issue 5495 - BUG - Minor fix to dds skip, inconsistent attrs caused errors (#5501)
  * Issue 5367 - RFE - store full DN in database record</changelog>
  <changelog author="william.brown@suse.com" date="1670328000">- bsc#1205974 - support pam_saslauthd for authentication pass through
  requirements. See also jsc#PED-2701
- Update to version 2.2.4~git8.8a6e7be:
  * Issue 5521 - RFE - split pass through auth cli
  * Issue 5521 - BUG - Pam PTA multiple issues
  * Issue 5544 - Increase default task TTL</changelog>
  <changelog author="william.brown@suse.com" date="1673006400">- bsc#1206563 - improve pam_saslauthd migration handling from openldap
- Update to version 2.2.4~git20.7eba9b9:
  * Issue 5526 - RFE - Improve saslauthd migration options (#5528)
  * Issue 5588 - Fix CI tests
  * Issue 5585 - lib389 password policy DN handling is incorrect (#5587)
  * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth
  * Bump version to 2.2.5
  * Issue 5236 - UI add specialized group edit modal
  * Issue 5278 - CLI - dsidm asks for the old password on password reset
  * Issue 5531 - CI - use universal_lines in capture_output
  * Issue 5505 - Fix compiler warning (#5506)
  * Issue 3615 - CLI - prevent virtual attribute indexing
  * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters
  * Issue 5561 - Nightly tests are failing</changelog>
  <changelog author="william.brown@suse.com" date="1673438400">- bsc#1205996 - prevent segfault in cl5configtrim
- Update to version 2.2.4~git25.c81ee34:
  * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError
  * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592)
  * Fix latest npm audit failures
  * Issue 5599 - CI - webui tests randomly fail
  * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- bsc#1210462 - OpenLDAP to 389-ds migration - exclude some unsupported attributes.
- Update to version 2.2.6~git40.002a0ca:
  * Issue 5734 - RFE - Exclude pwdFailureTime and ContextCSN (#5735)
  * Issue 5726 - ns-slapd crashing in ldbm_back_upgradednformat (#5727)
  * Issue 5714 - UI - fix typo, db settings, log settings, and LDAP editor paginations
  * Issue 5710 - subtree search statistics for index lookup does not report ancestorid/entryrdn lookups (#5711)
  * Issue 1081 - Stop schema replication from overwriting x-origin
  * Bump webpack from 5.75.0 to 5.76.0 in /src/cockpit/389-console (#5699)
  * Issue 5598 - (3rd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5692)
  * Issue 5598 - (2nd) In 2.x, SRCH throughput drops by 10% because of handling of referral (#5691)
  * Issue 5687 - UI - sensitive information disclosure
  * Issue 4583 - Update specfile to skip checks of ASAN builds
  * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553)
  * Issue 3604 - UI - Add support for Subject Alternative Names in CSR
  * Issue 5600 - buffer overflow when enabling sync repl plugin when dynamic plugins is enabled
  * Fix build break
  * Issue 5640 - Update logconv for new logging format
  * Issue 5545 - A random crash in import over lmdb (#5546)
  * Issue 5490 - tombstone in entryrdn index with lmdb but not with bdb (#5498)
  * Issue 5408: lmdb import is slow (#5481)
  * Issue 5162 - CI - fix error message for invalid pem file
  * Issue 5598 - In 2.x, SRCH throughput drops by 10% because of handling of referral (#5604)
  * Issue 5671 - covscan - clang warning (#5672)
  * Issue 5267 - CI - Fix issues with nsslapd-return-original-entrydn
  * Issue 5666 - CLI - Add timeout parameter for tasks
  * Issue 5567 - CLI - make ldifgen use the same default ldif name for all options
  * Issue 5162 - Lib389 - verify certificate type before adding
  * Issue 5630 - CLI - need to add logging filter for stdout
  * Issue 5646 - CLI/UI - do not hardcode password storage schemes
  * Issue 5640 - Update logconv for new logging format
  * Issue 5652 - Libasan crash in replication/cascading_test (#5659)
  * Issue 5658 - CLI - unable to add attribute with matching rule
  * Issue 5653 - covscan - fix invalid dereference
  * Issue 5648 - Covscan - Compiler warnings (#5651)
  * Issue 5630 - CLI - error messages should goto stderr
  * Issue 2435 - RFE - Raise IDL Scan Limit to INT_MAX (#5639)
  * Issue 5632 - CLI - improve error handling with db2ldif
  * Issue 5578 - dscreate ds-root does not normaile paths (#5613)
  * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579)
  * Issue 5624 - RFE - UI - export certificates, and import text base64 encoded certificates
  * Issue 4293 - RFE - CLI - add dsrc options for setting user and group subtrees
  * Issue 5497 - boolean attributes should be case insensitive
  * Bump version to 2.2.6
  * Issue 5607, 5351, 5611 - UI/CLI - fix various issues
  * Issue 5608 - UI - need to replace some "const" with "let"
  * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584)
  * Issue 5602 - UI - browser crash when trying to modify read-only variable
  * Issue 5581 - UI - Support cockpit dark theme</changelog>
  <changelog author="william.brown@suse.com" date="1685448000">- bsc#1211812 - update for stability patches
- Update to version 2.2.8~git4.1eeaedf:
  * Issue 5642 - Build fails against setuptools 67.0.0
  * Issue 5778 - UI - Remove error message if .dsrc is missing
  * Issue 5751 - Cleanallruv task crashes on consumer (#5775)
  * Issue 5743 - Disabling replica crashes the server (#5746)
  * Bump version to 2.2.8
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5753)
  * Issue 5770 - RFE - Extend Password Adminstrators to allow skipping password info updates
  * Issue 5768 - CLI/UI - cert checks are too strict, and other issues
  * Issue 5765 - Improve installer selinux handling
  * Issue 5643 - Memory leak in entryrdn during delete (#5717)
  * Issue 152 - RFE - Add support for LDAP alias entries
  * Issue 5052 - BUG - Custom filters prevented entry deletion (#5060)
  * Issue 5704 - crash in sync_refresh_initial_content (#5720)
  * Issue 5738 - RFE - UI - Read/write replication monitor info to .dsrc file
  * Issue 5749 - RFE - Allow Account Policy Plugin to handle inactivity and expiration at the same time
  * Bump version to 2.2.7</changelog>
  <changelog author="william.brown@suse.com" date="1689076800">- bsc#1213190 - update for stability patches
- Update to version 2.2.8~git17.48834f1:
  * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807)
  * Issue 5793 - UI - fix suffix selection in export modal
  * Issue 5825 - healthcheck - password storage scheme warning needs more info
  * Issue #5822 - Allow empty export path for db2ldif
  * Issue 5755 - Massive memory leaking on update operations (#5824)
  * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load
  * Issue 5722 - RFE When a filter contains 'nsrole', improve response time by rewriting the filter (#5723)
  * Issue 5755 - The Massive memory leaking on update operations (#5803)
  * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802)
  * Issue 2375 - CLI - Healthcheck - revise and add new checks
  * Issue 5781 - Bug handling return code of pre-extended operation plugin.
  * Issue 5646 - Various memory leaks (#5725)
  * Issue 5789 - Improve ds-replcheck error handling</changelog>
  <changelog author="william.brown@suse.com" date="1689940800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git21.c11e86f:
  * Issue 4551 - Paged search impacts performance (#5838)
  * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837)
  * issue 5833 - dsconf monitor backend fails on lmdb (#5835)
  * Issue 3555 - UI - Fix audit issue with npm - semver and word-wrap</changelog>
  <changelog author="william.brown@suse.com" date="1692100800">- bsc#1212726 - SSSD client performance improvements
- Update to version 2.2.8~git37.fdb3bae:
  * Issue 5082 - slugify: ModuleNotFoundError when running test cases
  * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888)
  * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866)
  * Issue 5872 - part 2 - fix is_dbi regression (#5887)
  * Issue 5804 - dtablesize being set to soft maxfiledescriptor limit (#5806)
  * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849)
  * Issue 5883 - Remove connection mutex contention risk on autobind (#5886)
  * Issue 5872 - `dbscan()` in lib389 can return bytes
  * Bump version to 2.2.9
  * Issue 5729 - Memory leak in factory_create_extension (#5814)
  * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests
  * Issue 5853 - Update Cargo.lock and fix minor warning (#5854)
  * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868)
  * Issue 5864 - Server fails to start after reboot because it's unable to access nsslapd-rundir
  * Issue 5856 - SyntaxWarning: invalid escape sequence '\,'
  * Issue 5859 - dbscan fails with AttributeError: 'list' object has no attribute 'extends'</changelog>
  <changelog author="william.brown@suse.com" date="1701259200">- bsc#1217581 - Replica ID cannot be specified for consumer and hub roles
- Update to version 2.2.8~git51.3688d68:
  * Issue 5984 - Crash when paged result search are abandoned - fix2 (#5987)
  * Issue 5984 - Crash when paged result search are abandoned (#5985)
  * Issue 5971 - CLI - Fix password prompt for repl status (#5972)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-connta…  …blesize (#5963)
  * Issue 3555 - UI - Fix audit issue with npm - babel/traverse (#5959)
  * Issue 5966 - CLI - Custom schema object is removed on a failed edit (#5967)
  * Issue 5956 - After an upgrade the server won't start - nsslapd-conntablesize (#5957)
  * issue 5924 - ASAN server build crash when looping opening/closing connections (#5926)
  * Issue 5848 - Fix condition and add a CI test (#5916)
  * Issue 5909 - Multi listener hang with 20k connections (#5917)
  * Issue 5853 - Revert MSRV check (#5908)
  * Issue 5722 - improve testcase (#5904)
  * Bug Description:
  * Issue 5858 - WebUI monitoring test fails to run</changelog>
  <changelog author="william.brown@suse.com" date="1707825600">- bsc#1219836 - CVE-2024-1062 - #5647 - resolve possible denial of service when audit
  logging is enabled
- Update to version 2.2.8~git65.347aae6:
  * Issue 6052 - Paged results test sets hostname to `localhost` on test collection
  * Issue 6061 - Certificate lifetime displayed as NaN
  * Issue 6043, 6044 - Enhance Rust and JS bundling and add SPDX licenses for both (#6045)
  * Issue 3555 - Remove audit-ci from dependencies (#6056)
  * Issue 5647 - Fix unused variable warning from previous commit (#5670)
  * issue 5647 - covscan: memory leak in audit log when adding entries (#5650)
  * Issue 6047 - Add a check for tagged commits
  * Issue 6041 - dscreate ds-root - accepts relative path (#6042)
  * Issue 6034 - Change replica_id from str to int
  * Issue 5938 - Attribute Names changed to lowercase after adding the Attributes (#5940)
  * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871)
  * Issue 5939 - During an update, if the target entry is reverted in the entry cache, the server should not retry to lock it (#6007)
  * Issue 5944 - Reversion of the entry cache should be limited to BETXN plugin failures (#5994)
  * Issue 5954 - Disable Transparent Huge Pages</changelog>
</package>
<package pkgid="8af5d5640ffcfb0a5a25f6a196a4dfba6bfd96e0f0d5a9bd67a9d7862f100cb4" name="AppStream" arch="aarch64">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="844cd5941c57aa9e02ae80a689b3da3fd819391c325982a875bf259f15b96014" name="AppStream" arch="ppc64le">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="56483be9c92d9a201761067b64a759063ca2cac2795845177210d857d473898f" name="AppStream" arch="s390x">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="c87fba4d4ca1908cafabbe82ca97ff47203db4caa75caeb6f47d3b8048b5081c" name="AppStream" arch="src">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="486c59da5a948c8a04f849c9dcfe1a371dc34eb11286f28c8b7cf17976487e89" name="AppStream" arch="x86_64">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="3ca0f12ec52e3b77d75ff9450e997254ecf12c07591b746b35a6c95a43979338" name="AppStream-compose" arch="aarch64">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="c74e1f67e22cfbfaad06883c435ae809288a22ea481d88b3e3b48465424c861b" name="AppStream-compose" arch="ppc64le">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="1dab7a5c1d8bf8b358868199ea92bd9a3ef0bd3b9bd7135b8498e0754caafb0c" name="AppStream-compose" arch="s390x">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="1eec6c4934925982aac38d300b1928fad8b41ede706d4d60f770848230d9c559" name="AppStream-compose" arch="x86_64">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="a71e291ba9d88334d227200b82d0f3394ca97649990ca9d1bb12cfaa74505733" name="AppStream-compose-devel" arch="aarch64">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="7d347b83f06b1d2878f88b0b0421241b2bb39974ba612980340fc605494818bd" name="AppStream-compose-devel" arch="ppc64le">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="b87a854547a763e0627c5a9b7ca9a0f49b5ee6a18ace8485d6b26ae3d06c1f2a" name="AppStream-compose-devel" arch="s390x">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="a0ca292998fba1953af0262fb1ce988222b3382bf0d3aeaa49bdf7a7a9bd907b" name="AppStream-compose-devel" arch="x86_64">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="a3c54ce3fafe5c84d1ac25c132a5775b086d5e193f844036fbe3564ca3388db9" name="AppStream-devel" arch="aarch64">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="f10d140fbf270939bfec37db2a1ccdfa38e1ca26a84afd97a18e961c84c2b373" name="AppStream-devel" arch="ppc64le">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="ea8fd0f11727d1717a58d8497dba728a033cb3de4d83e03ebd12fc72b0ba4c27" name="AppStream-devel" arch="s390x">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="df10814e4d7d96ec7dbf2abdc2e1ed0ea3889f2759f48734562de556735f905d" name="AppStream-devel" arch="x86_64">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="8716d445b995cf077b200aa9f0248da784d9e243628a26914922e56d327f9708" name="AppStream-doc" arch="noarch">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="7b9d7484c1cb1e4a3923bc6c67bc406ff623ddc7ec4b9f718807221725f14474" name="AppStream-lang" arch="noarch">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="9738e5f190424f915fecc8761c27ecd8a4fbbbd03ab0613698e6fe25c3a9c306" name="AppStream-qt6" arch="src">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="dc9a15c71a90d0666d09766034e3b2fb0ac7ef144ac088f7c2b2b37169eecdd9" name="HANA-Firewall" arch="ppc64le">
  <version epoch="0" ver="2.0.4" rel="150000.3.9.3"/>
  <changelog author="varkoly@suse.com" date="1426161600">- Initial Version of HANA-Firewall</changelog>
  <changelog author="hguo@suse.com" date="1443787200">- Bring HANA-Firewall out of technical preview with feature
  enhancements and major code clean-up.</changelog>
  <changelog author="varkoly@suse.com" date="1444132800">- Fix names in sysconfig file</changelog>
  <changelog author="hguo@suse.com" date="1445428800">- Remove unnecesary defaults from sysconfig.</changelog>
  <changelog author="hguo@suse.com" date="1445601600">- Fully integrate with SUSE firewall.</changelog>
  <changelog author="hguo@suse.com" date="1446724800">- Add missing changelog macro in spec file.</changelog>
  <changelog author="hguo@suse.com" date="1464955200">- Improve prompts in create_new_service.
- Relax file permissions in hana-firewall.d directory.
- Fix result file location for create_new_service.
- fate#320564 fate#320376</changelog>
  <changelog author="hguo@suse.com" date="1470225600">- Fix typo and incorrectly assigned default value in sysconfig file.
  Bump version to 1.1.2. (bsc#991919)</changelog>
  <changelog author="hguo@suse.com" date="1470398400">- Add several more TCP ports that are vital to HA operation into
  firewall service definition file.
  Bump version to 1.1.3 (bsc#992376)</changelog>
  <changelog author="hguo@suse.com" date="1475755200">- Merge HANA firewall rules into an existing "customrules" script
  if it is present.
- Bump version to 1.1.4 (bsc#1002744);</changelog>
  <changelog author="hguo@suse.com" date="1508328000">- Upgrade to upstream version 2.0 to work with firewalld in SLES 15.</changelog>
  <changelog author="rbrown@suse.com" date="1517227200">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="hguo@suse.com" date="1518436800">- Upgrade to upstream version 2.0.1 to improve visibility of HANA
  related firewall services in firewalld configuration tool.
  (bsc#1080597)</changelog>
  <changelog author="abriel@suse.com" date="1648641600">- Adaption to new go compiler behavior regarding test and build
  (bsc#1197697)</changelog>
  <changelog author="varkoly@suse.com" date="1683028800">- Missing SCR Agent for reading and writing /etc/sysconfig/hana-firewall from yast2
  (bsc#1210981)</changelog>
  <changelog author="varkoly@suse.com" date="1715083200">- HANA-Firewall creates insufficient configuration.
  (bsc#1221231)</changelog>
</package>
<package pkgid="8b53ff293f23bcf3fbb1bed0f5435c971b581b964ee571c4ffbeb7fab48d7f4b" name="HANA-Firewall" arch="src">
  <version epoch="0" ver="2.0.4" rel="150000.3.9.3"/>
  <changelog author="varkoly@suse.com" date="1426161600">- Initial Version of HANA-Firewall</changelog>
  <changelog author="hguo@suse.com" date="1443787200">- Bring HANA-Firewall out of technical preview with feature
  enhancements and major code clean-up.</changelog>
  <changelog author="varkoly@suse.com" date="1444132800">- Fix names in sysconfig file</changelog>
  <changelog author="hguo@suse.com" date="1445428800">- Remove unnecesary defaults from sysconfig.</changelog>
  <changelog author="hguo@suse.com" date="1445601600">- Fully integrate with SUSE firewall.</changelog>
  <changelog author="hguo@suse.com" date="1446724800">- Add missing changelog macro in spec file.</changelog>
  <changelog author="hguo@suse.com" date="1464955200">- Improve prompts in create_new_service.
- Relax file permissions in hana-firewall.d directory.
- Fix result file location for create_new_service.
- fate#320564 fate#320376</changelog>
  <changelog author="hguo@suse.com" date="1470225600">- Fix typo and incorrectly assigned default value in sysconfig file.
  Bump version to 1.1.2. (bsc#991919)</changelog>
  <changelog author="hguo@suse.com" date="1470398400">- Add several more TCP ports that are vital to HA operation into
  firewall service definition file.
  Bump version to 1.1.3 (bsc#992376)</changelog>
  <changelog author="hguo@suse.com" date="1475755200">- Merge HANA firewall rules into an existing "customrules" script
  if it is present.
- Bump version to 1.1.4 (bsc#1002744);</changelog>
  <changelog author="hguo@suse.com" date="1508328000">- Upgrade to upstream version 2.0 to work with firewalld in SLES 15.</changelog>
  <changelog author="rbrown@suse.com" date="1517227200">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="hguo@suse.com" date="1518436800">- Upgrade to upstream version 2.0.1 to improve visibility of HANA
  related firewall services in firewalld configuration tool.
  (bsc#1080597)</changelog>
  <changelog author="abriel@suse.com" date="1648641600">- Adaption to new go compiler behavior regarding test and build
  (bsc#1197697)</changelog>
  <changelog author="varkoly@suse.com" date="1683028800">- Missing SCR Agent for reading and writing /etc/sysconfig/hana-firewall from yast2
  (bsc#1210981)</changelog>
  <changelog author="varkoly@suse.com" date="1715083200">- HANA-Firewall creates insufficient configuration.
  (bsc#1221231)</changelog>
</package>
<package pkgid="58763b5397666c5ab986d7c13f57f971e2129d71c08c52ac07580b9e1cc57088" name="HANA-Firewall" arch="x86_64">
  <version epoch="0" ver="2.0.4" rel="150000.3.9.3"/>
  <changelog author="varkoly@suse.com" date="1426161600">- Initial Version of HANA-Firewall</changelog>
  <changelog author="hguo@suse.com" date="1443787200">- Bring HANA-Firewall out of technical preview with feature
  enhancements and major code clean-up.</changelog>
  <changelog author="varkoly@suse.com" date="1444132800">- Fix names in sysconfig file</changelog>
  <changelog author="hguo@suse.com" date="1445428800">- Remove unnecesary defaults from sysconfig.</changelog>
  <changelog author="hguo@suse.com" date="1445601600">- Fully integrate with SUSE firewall.</changelog>
  <changelog author="hguo@suse.com" date="1446724800">- Add missing changelog macro in spec file.</changelog>
  <changelog author="hguo@suse.com" date="1464955200">- Improve prompts in create_new_service.
- Relax file permissions in hana-firewall.d directory.
- Fix result file location for create_new_service.
- fate#320564 fate#320376</changelog>
  <changelog author="hguo@suse.com" date="1470225600">- Fix typo and incorrectly assigned default value in sysconfig file.
  Bump version to 1.1.2. (bsc#991919)</changelog>
  <changelog author="hguo@suse.com" date="1470398400">- Add several more TCP ports that are vital to HA operation into
  firewall service definition file.
  Bump version to 1.1.3 (bsc#992376)</changelog>
  <changelog author="hguo@suse.com" date="1475755200">- Merge HANA firewall rules into an existing "customrules" script
  if it is present.
- Bump version to 1.1.4 (bsc#1002744);</changelog>
  <changelog author="hguo@suse.com" date="1508328000">- Upgrade to upstream version 2.0 to work with firewalld in SLES 15.</changelog>
  <changelog author="rbrown@suse.com" date="1517227200">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="hguo@suse.com" date="1518436800">- Upgrade to upstream version 2.0.1 to improve visibility of HANA
  related firewall services in firewalld configuration tool.
  (bsc#1080597)</changelog>
  <changelog author="abriel@suse.com" date="1648641600">- Adaption to new go compiler behavior regarding test and build
  (bsc#1197697)</changelog>
  <changelog author="varkoly@suse.com" date="1683028800">- Missing SCR Agent for reading and writing /etc/sysconfig/hana-firewall from yast2
  (bsc#1210981)</changelog>
  <changelog author="varkoly@suse.com" date="1715083200">- HANA-Firewall creates insufficient configuration.
  (bsc#1221231)</changelog>
</package>
<package pkgid="1a426f997cc0168ecb250364fa6604b47bcd0564f029c7a96afae394fe72025d" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="10c3b0c8f2f597d6580a54a4adda9bf9ac011410a30476be5929ab8d4453cdc4" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="139d13b84200eaf590a3950ad9c9edb2f585822b6b582f183465546e1820c4c6" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="f76af917fc4c70f5236b36bf156fb77aa60f71407d84ceb877cd21fc0029dc13" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="0647d6b6c26df1d92782e8063ff2efc261af7cb22923d6c7a0a57b709df0ef22" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="0a867cc6fe29af059fd9a019b0a45371226898ca55f7db97d1da4f8d968b4e89" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="775cb5b1262e75054931916e6c500ed37ec763927d3d7637671926564d507974" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="f85ff2fa61a348b098d2004d3253d2df409eef5a0e8d6d9a9cbc49d965ecfee2" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="353ad28e5e90b2dc2ad00684508d64ca2c4dcdffce3c8c9e67b47162aaa9086b" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="aeb0d4d06e328123cfd8d5c218b0791b702393a6abf48b00012cef6b28ef4813" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="7a49daa1e8fc9d658bec6d6007882493f2f84c07ebb9e32e93e49bc17b8c151d" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="7904db243329c0a7ea97887bee3327a4b510187178090eedd78fa95b60ed8a77" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="59201665bcd24dbfa2976f389a070d12990a08e28b25b5f0d326dfe77afd712c" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="a481807ad7984249b399fe269ce6c8e8f74323e0e207cf4339d2c0cacd237888" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="8e01671d967da6c5aa852661ea3b262cc93106425d57477f6d0628cac2805051" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="6aed81613cc268499cfaa2d8eafcf38ce7ede2a30e05ab77be66ef6e6147e8cf" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="edb08833d6b7b3172078b06355e41fcba406482d0ce450669607c98f8a1f08a8" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="ff9576e06fcd06c95ac3eb9c5e9cd8768fc34b6cd57680822026f0d4608170f7" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="8720ee6b012231234a75572ba4d8bc30587fd05b0a070f0b76a78362bcff21db" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="82aa1f2c54e9894493af5c519b9531431f9627c6c20e62dee64b5e3064a792c7" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="b85e361467cadcf523f8951d6f7a2e6e7f306a6c7c939dd46f8c3fb3042fdfe6" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="83f3a7723396ac9a3a1d3408ae8747308db739af93fb87a480b720f043200db4" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="8f9386806342bf0dae48780ad612b72c336ca6eb2f53f9492da6b55400e88d78" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="e8bf775558315696bef3a10d4f3b7ec7a0ab1850dad741ad6d898cc70d1ed2e9" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="da59f9ee39a57e3c5285e6e2d9359adc9e1b023672e15810ac1e41372cd8cdf0" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="7850cce9851c3e620a59b5bd98e07c9d9c72d578f8f1d04f2390ba119619ebf2" name="MozillaFirefox-branding-SLE" arch="aarch64">
  <version epoch="0" ver="128" rel="150200.9.16.1"/>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1657022400">- change version to 102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1688040000">- change version to 115
- Move bookmarks to https</changelog>
  <changelog author="cgrobertson@suse.com" date="1720699200">- change version to 128</changelog>
</package>
<package pkgid="357aa9cddffc634e7d8fbb8b8967a59ce99a1ca37c5340d5ae8889596f7ba1af" name="MozillaFirefox-branding-SLE" arch="ppc64le">
  <version epoch="0" ver="128" rel="150200.9.16.1"/>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1657022400">- change version to 102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1688040000">- change version to 115
- Move bookmarks to https</changelog>
  <changelog author="cgrobertson@suse.com" date="1720699200">- change version to 128</changelog>
</package>
<package pkgid="87d8d88ed77f8ef5dcb6da7eba6b0b329a33888cb2c3caa25b330f3baa266952" name="MozillaFirefox-branding-SLE" arch="s390x">
  <version epoch="0" ver="128" rel="150200.9.16.1"/>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1657022400">- change version to 102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1688040000">- change version to 115
- Move bookmarks to https</changelog>
  <changelog author="cgrobertson@suse.com" date="1720699200">- change version to 128</changelog>
</package>
<package pkgid="0eee3027f7c24e8d8e6201a62a3822a9df250762146b49f6aca5b42c2e4a1e38" name="MozillaFirefox-branding-SLE" arch="src">
  <version epoch="0" ver="128" rel="150200.9.16.1"/>
  <changelog author="pcerny@suse.com" date="1402660800">- marked as compatible with Firefox 31</changelog>
  <changelog author="pcerny@suse.com" date="1406808000">- disable call home features</changelog>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1657022400">- change version to 102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1688040000">- change version to 115
- Move bookmarks to https</changelog>
  <changelog author="cgrobertson@suse.com" date="1720699200">- change version to 128</changelog>
</package>
<package pkgid="4719486ccda5367e999312d9a7577ce329e86d892a296d134f5013072b0c6f66" name="MozillaFirefox-branding-SLE" arch="x86_64">
  <version epoch="0" ver="128" rel="150200.9.16.1"/>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1657022400">- change version to 102</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1688040000">- change version to 115
- Move bookmarks to https</changelog>
  <changelog author="cgrobertson@suse.com" date="1720699200">- change version to 128</changelog>
</package>
<package pkgid="33ea4eb4ab51cc90961ae963eecaa892187ec3eb943cbba95496a29cb3eb8194" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="611d3b156fa58af24da069e971d39665eb79babaae1c3b4e0370817f46f85946" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="91a543f88528f1d35ce378cdc6ce8d23d92958dced46de37bfe9a9c20898a3e7" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="7d54e5f452aad714cff64be8a5b8b7582877467dea14909f1a19a4a11baaeb8a" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="ac98abf438179cc49f7ddb43e9d817bc024f2697b3d8a9355cfdbbea2a6311d0" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="c7735404599a515eb10598b5620230e3d3e02bbd1b2afd3e30d1455705d26984" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="64fbb23b27dd8742e673b32e58d0a57cc6937b2f3efdd9ec94fcf0cc522c2ab1" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="99c67e8d4e5e38b75659a393cf7db1c93bb8332def0b0da48ddb3bbcaee65e42" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="112e86ea6f2d7229f69cc0c044aed8b6565ee2ba64e110b4bf9fc4e355e2b3e5" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="5b298fe1e5133b6142903f1dc5aba903673a41fbb08425cc11631116a89946b4" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="36a2cc8eebfa76daf0711920182b825804b6f79a1353c3c396df585680aab6d8" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="14bb8185439331742af0f8d50fc55c7fac357f5fe8b3a1ea5d57a50e98701237" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="81e4f27f457283202b4686d78b0fa8e3c5e6dfc7adb6204982884cc9db5430f4" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="9480a328dd7fb1c2d3762dcc2fa64843062020206bb578a1c457bd481ff4246d" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="e01b0ecd7aaa609c597dda7ff899d7d34196b68b4f5f69018fdac10f93ac3c08" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="a3e043585684ac6160ca22bde40d162b79510bdc0a1324554b8c012e78bd25fd" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="cc690b7af5446ff6e1f1b15281c17dac2a0f88fb8bbf2286321c74b2c720aa92" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="b4823e6fe75c49ac70dcbef73e53324071ea57f0b5e9de2e36edc0579dc05e24" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="a9b8ca7ebc0bea744a0915b0f2d30ba8b79d9e109113c889f2d230381a2a015e" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="91a24494421318cbef9d2b5edc7f54fa4bde259a53b27c161ce1b0d4ced9cfd2" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="2df986d3c29663c63bd844266742980a304098879109557029c5babd872af10e" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="e5cdf8e54a7b6a05049f8ee16fe02fa1c9e89779fa1a3b19ef77b70c465f0282" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="23500b50d732c37447e3b25de15fb7220ddae1d0d972cffebcd58928912ef19a" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="56b342e7749fc9690b0ce8c09ecab820df20587d3fe67ac3fd1d77baff945c75" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="990dc4861f6d59cddd454069399bc313b20574639ad22e80e6452bde481dd87a" name="MozillaFirefox-devel" arch="noarch">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="b619db515a9f17f66bf0c897a81b3ccd1c3f19f03254f7f8ee754a53c2251b32" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="72e8de1214271dd63914b16455ab6e8fc8a6eee7b449ec230a077114e5ad023c" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="38c9b6cec1929bfa81e25b6d12eeaa6405027a5b92ea1f392a40f4762f7a59c7" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="4c7daf43b9dd430d737a5c2564e8c985a72dfb4c5564f57d40a9f21888768b0a" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="0b4abb2816b124373052d1d6b8370136f6ae87e194162da8bce34c01b136a5aa" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="625fe220d319a75461d51aaf1ccb606910ebc642301ee863a613b8b6929d52f8" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="d239168a9ba82d08e37d384e2937a5f3efd7d4de49301d4d8c3cd493988b1185" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="b6b3147537ff9bac7ad826e834a5f8e88e832d056798e04878329d4adde0168c" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="7be8cfedb8b1891ed42e6e9edc80c94982c0fa3db960939974082b24cfd516fc" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="343103d1ce481d13ada5a84673df6c3e154a1f1fea776f97cdfaa6605a09cae1" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="268f2255b7c2e395e1b25ecbe5bdab4172fb8c3ae1f58caf32db467ad4669e12" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="a221018753aef499f70b3f37547d23bd2e46236038685cd9fc42f5d9640bc23c" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="9710540ae59d3159ac72b55a0a73529b0c2b5bc6cb0b64e171ec2eeb796a24f4" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="40e76ecd4d8bc783882587acd620fc87b7ecc2bd93539035e8836bf6b8d15585" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="bd46767b26ebc0f6dc9275acd67dc3aeedebbf011ecff08d0635a145ccf3a533" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="a5636e2df779e66cdcf6b4d4c925667bc44eed34474c5ce407875627734eea4a" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="d45174be044d84824d20415c773ed8eb06d39c4510b0f9bc6850d1504ffebaeb" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="c1b479cfe8898cf5b0e5cf91df10548ff94f422ec363af1f2adbbf5a833ab969" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="490998741c59b4fedf737d778a9ee316ef61907bd58f8d3e9d7c4846c3f0dcbb" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="49699b1877940916c9b22eeb1f22dd4eadb7eac8748b8a94e19ff603219a00b4" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="4b59cc95780769fb8004993d76d4b853b43058adf680257674f06340823508fd" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="bfb9fea274045ed018f8019213803cc79fca5d309e94dcd31e7cba0ed1afe0dd" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="82df70694865d0df0a215345b32d14bdbd5c036deb02592a79a9be0fc93e503f" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="08c7580f7f4800d5f75ca922eca9e9b480814c47d7c5a7db0c22d1daa91cc349" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="115.11.0" rel="150200.152.137.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685620800">- Firefox Extended Support Release 102.12.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-19 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
- update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  Placeholder changelog-entry (bsc#1224056)</changelog>
</package>
<package pkgid="13a5cf01a896d0af22c397c7978dfefbd6e0b5c47da5ea2fd965ed364b0d9532" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="72967cd2b217d78d02c6305ed0f22a84e80591973cbad7a1662b65fd6e2c4026" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="d64997d19bb0561152de9d518f4a5d38f998f007857e56650aa60cb4661b2593" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="0ac18b62f170b14e4d2d4313d9e6912c0a484955477571000a37f7e27e3e227b" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="115.12.0" rel="150200.152.140.2"/>
  <changelog author="martin.sirringhaus@suse.com" date="1687867200">- Firefox Extended Support Release 115.0 ESR
  * New:
  - Required fields are now highlighted in PDF forms.
  - Improved performance on high-refresh rate monitors
    (120Hz+).
  - Buttons in the Tabs toolbar can now be reached with Tab,
    Shift+Tab, and Arrow keys. View this article for additional
    details.
  - Windows' "Make text bigger" accessibility setting now
    affects all the UI and content pages, rather than only
    applying to system font sizes.
  - Non-breaking spaces are now preserved—preventing automatic
    line breaks—when copying text from a form control.
  - Fixed WebGL performance issues on NVIDIA binary drivers via
    DMA-Buf on Linux.
  - Fixed an issue in which Firefox startup could be
    significantly slowed down by the processing of Web content
    local storage. This had the greatest impact on users with
    platter hard drives and significant local storage.
  - Removed a configuration option to allow SHA-1 signatures in
    certificates: SHA-1 signatures in certificates—long since
    determined to no longer be secure enough—are now not
    supported.
  - Highlight color is preserved correctly after typing `Enter`
    in the mail composer of Yahoo Mail and Outlook.
    After bypassing the https only error page navigating back
    would take you to the error page that was previously
    dismissed. Back now takes you to the previous site that was
    visited.
  - Paste unformatted shortcut (shift+ctrl/cmd+v) now works in
    plain text contexts, such as input and text area.
  - Added an option to print only the current page from the
    print preview dialog.
  - Swipe to navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) on Windows is now
    enabled.
  - Stability on Windows is significantly improved as Firefox
    handles low-memory situations much better.
  - Touchpad scrolling on macOS was made more accessible by
    reducing unintended diagonal scrolling opposite of the
    intended scroll axis.
  - Firefox is less likely to run out of memory on Linux and
    performs more efficiently for the rest of the system when
    memory runs low.
  - It is now possible to edit PDFs: including writing text,
    drawing, and adding signatures.
  - Setting Firefox as your default browser now also makes it
    the default PDF application on Windows systems.
  - Swipe-to-navigate (two fingers on a touchpad swiped left or
    right to perform history back or forward) now works for Linux
    users on Wayland.
  - Text Recognition in images allows users on macOS 10.15 and
    higher to extract text from the selected image (such as a
    meme or screenshot).
  - Firefox View helps you get back to content you previously
    discovered. A pinned tab allows you to find and open recently
    closed tabs on your current device and access tabs from other
    devices (via our “Tab Pickup” feature).
  - Import maps, which allow web pages to control the behavior
    of JavaScript imports, are now enabled by default.
  - Processes used for background tabs now use efficiency mode
    on Windows 11 to limit resource use.
  - The shift+esc keyboard shortcut now opens the Process
    Manager, offering a way to quickly identify processes that
    are using too many resources.
  - Firefox now supports properly color correcting images
    tagged with ICCv4 profiles.
  - Support for non-English characters when saving and printing
    PDF forms.
  - The bookmarks toolbar's default "Only show on New Tab"
    state works correctly for blank new tabs. As before, you can
    change the bookmark toolbar's behavior using the toolbar
    context menu.
  - Manifest Version 3 (MV3) extension support is now enabled
    by default (MV2 remains enabled/supported). This major update
    also ushers an exciting user interface change in the form of
    the new extensions button.
  - The Arbitrary Code Guard exploit protection has been
    enabled in the media playback utility processes, improving
    security for Windows users.
  - The native HTML date picker for date and datetime inputs
    can now be used with a keyboard alone, improving its
    accessibility for screen reader users. Users with limited
    mobility can also now use common keyboard shortcuts to
    navigate the calendar grid and month selection spinners.
  - Firefox builds in the Spanish from Spain (es-ES) and
    Spanish from Argentina (es-AR) locales now come with a built-
    in dictionary for the Firefox spellchecker.
  - On macOS, Ctrl or Cmd + trackpad or mouse wheel now scrolls
    the page instead of zooming. This avoids accidental zooming
    and matches the behavior of other web browsers on macOS.
  - It's now possible to import bookmarks, history and
    passwords not only from Edge, Chrome or Safari but also from
    Opera, Opera GX, and Vivaldi.
  - GPU sandboxing has been enabled on Windows.
  - On Windows, third-party modules can now be blocked from
    injecting themselves into Firefox, which can be helpful if
    they are causing crashes or other undesirable behavior.
  - Date, time, and datetime-local input fields can now be
    cleared with `Cmd+Backspace` and `Cmd+Delete` shortcut on
    macOS and `Ctrl+Backspace` and `Ctrl+Delete` on Windows and
    Linux.
  - GPU-accelerated Canvas2D is enabled by default on macOS and
    Linux.
  - WebGL performance improvement on Windows, MacOS and Linux.
  - Enables overlay of hardware-decoded video with non-Intel
    GPUs on Windows 10/11, improving video playback performance
    and video scaling quality.
  - Windows native notifications are now enabled.
  - Firefox Relay users can now opt-in to create Relay email
    masks directly from the Firefox credential manager. You must
    be signed in with your Firefox Account.
  - We’ve added two new locales: Silhe Friulian (fur) and
    Sardinian (sc).
  - Right-clicking on password fields now shows an option to
    reveal the password.
  - Private windows and ETP set to strict will now include
    email tracking protection. This will make it harder for email
    trackers to learn the browsing habits of Firefox users. You
    can check the Tracking Content in the sub-panel on the shield
    icon panel.
  - The deprecated U2F Javascript API is now disabled by
    default. The U2F protocol remains usable through the WebAuthn
    API. The U2F API can be re-enabled using the
    `security.webauth.u2f` preference.
  - Say hello to enhanced Picture-in-Picture! Rewind, check
    video duration, and effortlessly switch to full-screen mode
    on the web's most popular video websites.
  - Firefox's address bar is already a great place to search
    for what you're looking for. Now you'll always be able to see
    your web search terms and refine them while viewing your
    search's results - no additional scrolling needed! Also, a
    new result menu has been added making it easier to remove
    history results and dismiss sponsored Firefox Suggest
    entries.
  - Private windows now protect users even better by blocking
    third-party cookies and storage of content trackers.
  - Passwords automatically generated by Firefox now include
    special characters, giving users more secure passwords by
    default.
  - Firefox 115 introduces a redesigned accessibility engine
    which significantly improves the speed, responsiveness, and
    stability of Firefox when used with:
  - Screen readers, as well as certain other accessibility
    software;
  - East Asian input methods;
  - Enterprise single sign-on software; and
  - Other applications which use accessibility frameworks to
    access information.
  - Firefox 115 now supports AV1 Image Format files containing
    animations (AVIS), improving support for AVIF images across
    the web.
  - The Windows GPU sandbox first shipped in the Firefox 110
    release has been tightened to enhance the security benefits
    it provides.
  - A 13-year-old feature request was fulfilled and Firefox now
    supports files being drag-and-dropped directly from Microsoft
    Outlook. A special thanks to volunteer contributor Marco
    Spiess for helping to get this across the finish line!
  - Users on macOS can now access the Services sub-menu
    directly from Firefox context menus.
  - On Windows, the elastic overscroll effect has been enabled
    by default. When two-finger scrolling on the touchpad or
    scrolling on the touchscreen, you will now see a bouncing
    animation when scrolling past the edge of a scroll container.
  - Firefox is now available in the Tajik (tg) language.
  - Added UI to manage the DNS over HTTPS exception list.
  - Bookmarks can now be searched from the Bookmarks menu. The
    Bookmarks menu is accessible by adding the Bookmarks menu
    button to the toolbar.
  - Restrict searches to your local browsing history by
    selecting Search history from the History, Library or
    Application menu buttons.
  - Mac users can now capture video from their cameras in all
    supported native resolutions. This enables resolutions higher
    than 1280x720.
  - It is now possible to reorder the extensions listed in the
    extensions panel.
  - Users on macOS, Linux, and Windows 7 can now use FIDO2 /
    WebAuthn authenticators over USB. Some advanced features,
    such as fully passwordless logins, require a PIN to be set on
    the authenticator.
  - Pocket Recommended content can now be seen in France,
    Italy, and Spain.
  - DNS over HTTPS settings are now part of the Privacy &amp;
    Security section of the Settings page and allow the user to
    choose from all the supported modes.
  - Migrating from another browser? Now you can bring over
    payment methods you've saved in Chrome-based browsers to
    Firefox.
  - Hardware video decoding enabled for Intel GPUs on Linux.
  - The Tab Manager dropdown now features close buttons, so you
    can close tabs more quickly.
  - Windows Magnifier now follows the text cursor correctly
    when the Firefox title bar is visible.
  - Undo and redo are now available in Password fields.
    [1]:https://support.mozilla.org/kb/access-toolbar-functions-
    using-keyboard?_gl=1*16it7nj*_ga*MTEzNjg4MjY5NC4xNjQ1MjAxMDU3
  * _ga_MQ7767QQQW*MTY1Njk2MzExMS43LjEuMTY1Njk2MzIzMy4w
    [2]:https://support.mozilla.org/kb/how-set-tab-pickup-
    firefox-view
    [3]:https://support.mozilla.org/kb/task-manager-tabs-or-
    extensions-are-slowing-firefox
    [4]:https://blog.mozilla.org/addons/2022/11/17/manifest-v3-
    signing-available-november-21-on-firefox-nightly/
    [5]:https://blog.mozilla.org/addons/2022/05/18/manifest-v3-
    in-firefox-recap-next-steps/
    [6]:https://support.mozilla.org/kb/unified-extensions
    [7]:https://support.mozilla.org/kb/import-data-another-
    browser
    [8]:https://support.mozilla.org/kb/identify-problems-third-
    party-modules-firefox-windows
    [9]:https://support.mozilla.org/kb/how-generate-secure-
    password-firefox
    [10]:https://blog.mozilla.org/accessibility/firefox-113-
    accessibility-performance/
  * Fixed: Various security fixes.
  MFSA 2023-22 (bsc#1212438)
  * CVE-2023-3482 (bmo#1839464)
    Block all cookies bypass for localstorage
  * CVE-2023-37201 (bmo#1826002)
    Use-after-free in WebRTC certificate generation
  * CVE-2023-37202 (bmo#1834711)
    Potential use-after-free from compartment mismatch in
    SpiderMonkey
  * CVE-2023-37203 (bmo#291640)
    Drag and Drop API may provide access to local system files
  * CVE-2023-37204 (bmo#1832195)
    Fullscreen notification obscured via option element
  * CVE-2023-37205 (bmo#1704420)
    URL spoofing in address bar using RTL characters
  * CVE-2023-37206 (bmo#1813299)
    Insufficient validation of symlinks in the FileSystem API
  * CVE-2023-37207 (bmo#1816287)
    Fullscreen notification obscured
  * CVE-2023-37208 (bmo#1837675)
    Lack of warning when opening Diagcab files
  * CVE-2023-37209 (bmo#1837993)
    Use-after-free in `NotifyOnHistoryReload`
  * CVE-2023-37210 (bmo#1821886)
    Full-screen mode exit prevention
  * CVE-2023-37211 (bmo#1832306, bmo#1834862, bmo#1835886,
    bmo#1836550, bmo#1837450)
    Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13,
    and Thunderbird 102.13
  * CVE-2023-37212 (bmo#1750870, bmo#1825552, bmo#1826206,
    bmo#1827076, bmo#1828690, bmo#1833503, bmo#1835710,
    bmo#1838587)
    Memory safety bugs fixed in Firefox 115
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch
- Add mozilla-bmo1838323.patch to fix potential SIGILL on old CPUs
  (bsc#1212101)</changelog>
  <changelog author="cgrobertson@suse.com" date="1689076800">- Firefox Extended Support Release 115.0.2 ESR
  MFSA 2023-26 (bsc#1213230)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  - 
  * Fixed: Fixed a startup crash experienced by some Windows
    users by blocking instances of a malicious injected DLL
    (bmo#1841751)
  * Fixed: Fixed a bug with displaying a caret in the text editor
    on some websites (bmo#1840804)
  * Fixed: Fixed a bug with broken audio rendering on some
    websites (bmo#1841982)
  * Fixed: Fixed a bug with patternTransform translate using the
    wrong units (bmo#1840746)
  * Fixed: A security fix.
  * Fixed: Fixed a crash affecting Windows 7 users related to the
    DLL blocklist.
- Firefox Extended Support Release 115.0.1 ESR
  * Fixed: Fixed a startup crash for Windows users with Kingsoft
    Antivirus software installed (bmo#1837242)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * MFSA-RESERVE-2024-1193389 (bmo#1193389)
    Use-after-free in networking
  * MFSA-RESERVE-2024-1895086 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * MFSA-RESERVE-2024-1883693 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * MFSA-RESERVE-2024-1888695 (bmo#1888695)
    Sandboxed iframe were able to bypass sandbox restrictions to
    open a new window
  * MFSA-RESERVE-2024-1891234 (bmo#1891234)
    Bypass of file name restrictions during saving
  * MFSA-RESERVE-2024-1891319 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * MFSA-RESERVE-2024-1896555 (bmo#1896555)
    Memory Corruption in Text Fragments
  * MFSA-RESERVE-2024-2 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="a97ac27ff5644473a34e13daa5fb251176b50e14f78bf74d49038fd0147aec68" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="da21f420c8cf8b86cf69eb05229fb25e08ceb1aef97a2390b404c13fcc161ae4" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="a0cae92332a81931afd18a80e68f9a5840e3613b1113abc069998e2f812782e5" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="8b635114da54b446d4693e758a1851d30742703ac8651ee0fc551fe182b7ad83" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="115.13.0" rel="150200.152.143.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690459200">- Firefox Extended Support Release 115.1.0 ESR
  * Fixed: Various security fixes.
  MFSA 2023-30 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
- Remove now upstreamed patch mozilla-bmo1838323.patch and mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  Placeholder changelog-entry (bsc#1226316)</changelog>
</package>
<package pkgid="6944115dcb4b6aaa8a221dd4ff8616c84cf85a7889f7a0d7823148460e7aa8f5" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="fd668505b6057cc86b31dfa3fe7390c6172ca51efefe931ee37070bb44407fd7" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="a60a5cea901cb80645967129d9a7cf2465a339368bbbdd85707eb26a24da58ce" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="415cbd152229a6bcb3ee1dcb529e8f67664b4abd78a44116dba9f4e5d14006ca" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="128.1.0" rel="150200.152.146.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1692964800">- Firefox Extended Support Release 115.2.0 ESR
  * Fixed: Various  security  fixes and other quality
    improvements.
  MFSA 2023-36 (bsc#1214606)
  * CVE-2023-4574: (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575: (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576: (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577: (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051: (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578: (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
  * CVE-2023-4053: (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580: (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581: (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582: (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583: (bmo#1842030)
    Browsing Context potentially not cleared when closing Private Window
  * CVE-2023-4584: (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585: (bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  Placeholder changelog-entry (bsc#1228648)</changelog>
</package>
<package pkgid="0c12aeb9567da70ec4a7cdbb6ca99e01fb4cfb5e124d166f352fee0970e03ac7" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="0cbcffabf801a49665fcad5c0ffc82f176ed5928c169a917d8f1da57f4313ab9" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="e627135f7b7dfdbdde39b152e5b960d8649b5b47cc8d3dbafe56eedf6b18ab2c" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="80b1af2e7b84b2bf9c80b7676e0da031ca594d8d285dda038b939d43981f735f" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="128.2.0" rel="150200.152.149.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1694174400">- Fix i586 build by reducing debug info to -g1. (boo#1210168)</changelog>
  <changelog author="cgrobertson@suse.com" date="1694520000">- Firefox Extended Support Release 115.2.1 ESR
  * Fixed: Security fix
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863 (bmo#1852649)
    Heap buffer overflow in libwebp</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1695297600">- Firefox Extended Support Release 115.3.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-42 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)</changelog>
  <changelog author="meissner@suse.com" date="1695988800">- Firefox Extended Support Release 115.3.1 ESR
  * Fixed: Security fix.
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697544000">- Firefox Extended Support Release 115.4.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-46 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700136000">- Firefox Extended Support Release 115.5.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-50 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1702382400">- Firefox Extended Support Release 115.6.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2023-54 (bsc#1217974)
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6865 (bmo#1864123)
    Potential exposure of uninitialized data in
    EncryptingOutputStream
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6867 (bmo#1863863)
    Clickjacking permission prompts using the popup transition
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1705579200">- Firefox Extended Support Release 115.7.0 ESR
  * Fixed: Various security fixes and other quality improvements.
- Mozilla Firefox ESR 115.7
  MFSA 2024-02 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706616000">- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708344000">- Firefox Extended Support Release 115.8.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-06 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710331200">- Firefox Extended Support Release 115.9.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-13 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1711108800">- Firefox Extended Support Release 115.9.1esr ESR
  * Fixed: Security fix.
  MFSA 2024-16 (bsc#1221850)
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1712664000">- Firefox Extended Support Release 115.10.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-19 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715169600">- Firefox Extended Support Release 115.11.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-22 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1717675200">- Firefox Extended Support Release 115.12.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-26 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719835200">- Fix GNOME search provider (boo#1225278)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720008000">- Firefox Extended Support Release 115.13.0 ESR
  * Changed: The root certificate used to verify add-ons and
    signed content has been renewed to avoid upcoming expiration.
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-30 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1720612800">- Firefox Extended Support Release 128.0esr ESR
  * ### General
  * Windows 7-8.1 and macOS 10.12-10.14 are no longer supported
    operating systems.
  * Firefox now supports automated translation of web content.
    Also, unlike cloud-based alternatives, translation is done
    locally so that the text being translated never leaves the
    machine.
  * The line breaking rules of web content now match the
    Unicode standard, improving cross-browser compatibility.
    Additionally, for East Asian and South East Asian end users,
    Firefox now supports proper language-aware word selection
    when double-clicking on text for languages including Chinese,
    Japanese, Burmese, Lao, Khmer, and Thai.
  * Video effects and background blur are now available to
    Firefox users on Google Meet.
    Firefox now displays images and descriptions for search
    suggestions when provided by the search engine.
  * It is now possible to copy and paste any file from the
    operating system into Firefox.
  * Having any issues with a website on Firefox, yet the site
    seems to be working as expected on another browser? You can
    now let us know via the Web Compatibility Reporting Tool! By
    filing a web compatibility issue, you’re directly helping us
    detect, target, and fix the most impacted sites to make your
    browsing experience on Firefox smoother.
  * Firefox now prompts users in the US and Canada to save
    their addresses upon submitting an address form, allowing
    Firefox to autofill stored address information in the future.
  * Support for credit card autofill has been extended to users
    running Firefox in the IT, ES, AT, BE, and PL locales.
  * Recently closed tabs now persist between sessions that
    don't have automatic session restore enabled. Manually
    restoring a previous session will continue to reopen any
    previously open tabs or windows.
  * When migrating data from Chrome, Firefox now offers the
    ability to import certain extensions as well.
  * The Screenshots feature in Firefox has been updated. It now
    supports taking screenshots of file types like SVG, XML, and
    more as well as various about: pages within Firefox. The
    screenshot tool was also made more accessible to everyone by
    implementing new keyboard shortcuts and adding theme
    compatibility and High Contrast Mode (HCM) support. And
    finally, performance for capturing large screenshots has been
    improved.
  * ### PDF Viewer
  * The Firefox PDF viewer has expanded PDF editing
    capabilities:
  * Text highlighting is now supported.
  * Editing already-existing text annotations is now
    supported.
  * Images and alt text can be added in addition to text
    and drawings.
  * A floating button is now included to simplify deleting
    drawings, text, and images added in PDFs.
  * Caret browsing mode now also works in the PDF viewer.
    (Learn more)
  * ### Firefox View
  * Firefox View includes more content. You can now see all
    open tabs from all windows. If you sync open tabs, you’ll see
    all tabs from other devices. Browsing history is now listed
    and you can sort by date or by site. As before, recently
    closed tabs are also listed on Firefox View.
    To access Firefox View, select the file folder icon at the
    top left of your tab strip.
  * We’ve integrated search into Firefox View. You can now
    search through all of the tabs on each of the section
    subpages - Recent Browsing, Open Tabs, Recently Closed Tabs,
    Tabs from other devices, or History.
  * In Firefox View, open tabs can now be sorted by either
    recent activity or tab order. Recent activity is the default
    setting.
  * Firefox View now displays pinned tabs in the Open tabs
    section. Tab indicators have also been added to Open tabs, so
    users can do things like see which tabs are playing media and
    quickly mute or unmute across windows. Indicators were also
    added for bookmarks, tabs with notifications, and more!
  * It is now possible to close all duplicate tabs in a window
    with the `Close duplicate tabs` command available from the
    `List all tabs` widget in the tab bar or a tab context menu.
  * ### Security &amp; Privacy
  * For added protection on macOS and Windows, a device sign in
    (e.g. operating system password, fingerprint, face or voice
    login if enabled) can be required when accessing and filling
    stored passwords in the Firefox Password Manager about:logins
    page.
  * Firefox now supports creating and using passkeys stored in
    the iCloud Keychain on macOS.
  * Firefox now imports user-added TLS trust anchors (e.g.,
    certificates) from the operating system root store. This will
    be enabled by default on Windows, macOS, and Android, and if
    needed, can be turned off in settings (Settings → Privacy &amp;
    Security → Certificates).
  * The Storage Access API web standard was updated to improve
    security while mitigating website breakages and further
    enabling the phase out of third-party cookies in Firefox.
  * Encrypted Client Hello (ECH) is now available to Firefox
    users, delivering a more private browsing experience. ECH
    extends the encryption used in TLS connections to cover more
    of the handshake and better protect sensitive fields. Read
    more about the launch of ECH on Mozilla Distilled.
  * Firefox supports a new “Copy Link Without Site Tracking”
    feature in the context menu which ensures that copied links
    no longer contain tracking information.
  * Firefox now supports a setting (in Preferences → Privacy &amp;
    Security) to enable Global Privacy Control. With this opt-in
    feature, Firefox informs the websites that the user doesn’t
    want their data to be shared or sold. This feature is enabled
    in private browsing mode by default.
  * Firefox now more proactively blocks downloads from URLs
    that are considered to be potentially untrustworthy.
  * ### Anti-Fingerprinting
  * Web Audio in Firefox now uses the FDLIBM math library on
    all systems to improve anonymity with Fingerprint Protection.
  * As part of Total Cookie Protection, Firefox now supports
    the partitioning of Blob URLs, this mitigates a potential
    tracking vector that third-party agents could use to track an
    individual.
  * To mitigate font fingerprinting, the visibility of fonts to
    websites has been restricted to system fonts and language
    pack fonts when in Private Browsing Mode or with Enhanced
    Tracking Protection set to strict mode.
  * Firefox’s private windows and ETP-Strict privacy
    configuration now enhance the Canvas APIs with Fingerprinting
    Protection.
  * To reduce user fingerprinting information and the risk of
    some website compatibility issues, the CPU architecture for
    32-bit x86 Linux will now be reported as x86_64 in Firefox's
    User-Agent string and `navigator.platform` and
    `navigator.oscpu` Web APIs.
  * ### Windows
  * Firefox can now be set to automatically launch whenever the
    computer starts up. (Learn more)
  * The background updater now updates properly when there are
    multiple user accounts on a system.
  * Firefox now populates the Windows taskbar jump list more
    efficiently, which should allow for a smoother overall
    browsing experience.
  * ### macOS
  * Firefox now supports Voice Control commands on macOS
    systems.
  * Links and other focusable elements are now tab-navigable by
    default on macOS, instead of following macOS' "Keyboard
    navigation" setting. This is a more accessible default and
    matches the default in all other platforms. A checkbox in the
    settings page still allows users to restore the old behavior.
  * Firefox on Mac now uses the macOS fullscreen API for all
    types of fullscreen windows. This should better match the
    expected macOS user experience for fullscreen spaces, menubar
    and the Dock.
  * ### Linux
  * Firefox now defaults to the Wayland compositor when
    available instead of XWayland. This brings support for
    touchpad &amp; touchscreen gestures, swipe-to-nav, per-monitor
    DPI settings, better graphics performance, and more.
  * Firefox now ships with a new .deb package for Linux users
    on Ubuntu, Debian, and Linux Mint.
  * ### Video Playback
  * Enabled AV1 hardware decode acceleration on macOS for M3
    Macs.
  * Firefox now supports the AV1 codec for Encrypted Media
    Extensions (EME), enabling higher-quality playback from video
    streaming providers.
  * NVIDIA RTX Video Super Resolution (“VSR”) is now available
    in Firefox. RTX VSR enhances and sharpens lower resolution
    video when upscaled to higher resolutions and also removes
    blocky artifacts commonly visible on low bitrate streamed
    video. VSR requires at least a 20-series or higher NVIDIA RTX
    GPU, Microsoft Windows 10/11 64-bit, and NVIDIA driver
    version R530 or higher. The feature can be enabled in the
    NVIDIA control panel.
  * NVIDIA RTX Video HDR is now available in Firefox. RTX Video
    HDR automatically converts SDR video to vibrant HDR10 in real
    time, letting you enjoy video with improved clarity on your
    HDR10 panel. It requires at least a 20-series NVIDIA RTX GPU,
    Microsoft Windows 10/11 64-bit, and NVIDIA driver version 550
    or higher. The feature can be enabled in the NVIDIA control
    panel.
  * Developer: * Firefox now supports DNS prefetching for HTTPS
    documents via the `rel="dns-prefetch"` link hint. This
    standard allows web developers to specify domain names for
    important assets that should be resolved preemptively.
  * Firefox will now automatically try to upgrade &lt;img&gt;,
    &lt;audio&gt;, and &lt;video&gt; elements from HTTP to HTTPS
    if they are embedded within an HTTPS page. If these so-called
    mixed content elements do not support HTTPS, they will no
    longer load.
  * Firefox now supports Content-encoding: zstd (zstandard
    compression). This is an alternative to brotli and gzip
    compression for web content, and can provide higher
    compression levels for the same CPU used, or conversely lower
    server CPU use to get the same compression.
    [2]: http://facebook.github.io/zstd/
  * Enterprise: * The FirefoxHome policy has been updated to
    reflect that the Snippets option is now deprecated.
  * The DNSOverHTTPS policy has been updated to support setting
    a `Fallback` value to prevent falling back to your default
    DNS Provider.
  * The AllowFileSelectionDialogs policy has been added for
    controlling file selection dialogs.
  * The TranslateEnabled policy has been added.
  * The DisableEncryptedClientHello policy has been added to
    control Encrypted Client Hello.
  * The PostQuantumKeyAgreementEnabled policy has been added to
    control post-quantum key agreement for TLS.
  * The HttpsOnlyMode policy has been added to control HTTPS-
    Only Mode.
  * The HttpAllowlist policy has been added to add exceptions
    to HTTPS-Only Mode.
  * The Preferences policy has been updated to allow setting
    the preferences
    `security.mixed_content.block_display_content` and
    `security.mixed_content.upgrade_display_content`.
  * The UserMessaging policy has been updated to remove the
    WhatsNew option.
  * The ExtensionSettings policy has been updated to add
    `temporarily_allow_weak_signatures` to allow installing
    extensions signed using deprecated signature algorithms.
  * Fixed: Various security fixes.
  MFSA 2024-29 (bsc#1226316)
  * CVE-2024-6605 (bmo#1836786)
    Firefox Android missed activation delay to prevent tapjacking
  * CVE-2024-6606 (bmo#1902305)
    Out-of-bounds read in clipboard component
  * CVE-2024-6607 (bmo#1694513)
    Leaving pointerlock by pressing the escape key could be
    prevented
  * CVE-2024-6608 (bmo#1743329)
    Cursor could be moved out of the viewport using pointerlock.
  * CVE-2024-6609 (bmo#1839258)
    Memory corruption in NSS
  * CVE-2024-6610 (bmo#1883396)
    Form validation popups could block exiting full-screen mode
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6611 (bmo#1844827)
    Incorrect handling of SameSite cookies
  * CVE-2024-6612 (bmo#1880374)
    CSP violation leakage when using devtools
  * CVE-2024-6613 (bmo#1900523)
    Incorrect listing of stack frames
  * CVE-2024-6614 (bmo#1902983)
    Incorrect listing of stack frames
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    and Thunderbird 115.13
  * CVE-2024-6615 (bmo#1892875, bmo#1894428, bmo#1898364)
    Memory safety bugs fixed in Firefox 128
- remove unneeded patches mozilla-fix-aarch64-libopus.patch
  mozilla-bmo1504834-part3.patch mozilla-bmo1512162.patch
  mozilla-fix-top-level-asm.patch mozilla-bmo531915.patch
  mozilla-partial-revert-1768632.patch
- added patches mozilla-rust-disable-future-incompat.patch
  fix-sle12-build-errors.patch
- added patches mozilla-bmo1898476.patch and mozilla-bmo1907511.patch
  to fix Wayland-crashes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1722427200">- Firefox Extended Support Release 128.1.0 ESR
  * Fixed: Various security fixes and other quality improvements.
  MFSA 2024-35 (bsc#1228648)
  * CVE-2024-7518 (bmo#1875354)
    Fullscreen notification dialog can be obscured by document
    content
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7520 (bmo#1903041)
    Type confusion in WebAssembly
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7524 (bmo#1909241)
    CSP strict-dynamic bypass using web-compatibility shims
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7528 (bmo#1895951)
    Use-after-free in IndexedDB
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts
  * CVE-2024-7531 (bmo#1905691)
    PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel
    Sandy Bridge machines</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1724760000">- Firefox Extended Support Release 128.2.0 ESR
  Placeholder changelog-entry (bsc#1229821)
- Removed upstreamed patches mozilla-bmo1907511.patch mozilla-bmo1898476.patch</changelog>
</package>
<package pkgid="440ab4d47fb8d6b106da36b59ad4c2cf18d39264007bcafa6e170450b35f8049" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="2785706ed159bd4a84889ab37e9879c68b9cb74d392040c9a1c767c725198f5e" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="ac60e564668ea51fb5d84baacd67bab08ff315d1dc707489d05400cd08601937" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="edfaa2767cdae9e9b162e73263517d8dc08317fc6db149703dab25f2de08640c" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="c72d621dda3b060679acc7ffd2858ebfa85d9f5039690432a6658b2139db9431" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="4af78d4e6abb584c16e73d7fc18ef4258d1ee0751e54bbc814ef879d09e0338f" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="232f22c91f9550b3b2d049b1b04367650551c534bd9ffaf66473690162b4b5cf" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="fef1f673a8f92d9e63713d45f6ba3f24f3ae6b0bde967ff4320defebae369c4f" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="be7828a2e17adbf4d8dea4e64edb01d97368814e4b90f9aa74c19889cde42fea" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="5a2ca8f2ea7bece457e36e5052e363111fda2f942e1a1fbc48a062ec4da8e2dc" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="4aba2662d9efa6b8cafd8adfed9c158e733e4fa82bb0f75c80bfe1771973ce94" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="080854a29d57db54c8055151076246ee21f7aaa0a89f1de7f19bce45b723e55d" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="e832999c38909ecf7c7d4e9c005c0b08530b64dda69657c243b3f50416468260" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="166e1557854f6883148a1b23e07d919bc66d6c0e66ca4f29b5a989a4973c7d24" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="d644a0bb8be1de8ff8a175dfa1f20f87ef49912f3022a62b4e48e739d2aa6a0f" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="5d31fda063fce4355835f1a910c1f118bd92fac47cc6900c7d564c5204ff980a" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="21825a5d9b0908059ecfb37722ff11c0c8216ef84eca2405cf369b5554d55d98" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="46b3fffe0d1ae59a4141aea1f380a4b7e6c959971c859ba0663c1dfd9c60de2f" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="1fb033d19af5bd3e7675b16a16017f2d4dc813980ca72dc93e6f85a66cfac1b7" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="c63c404542a7d4967c5f4ffb0ed0a98bc2067afddd719598a5e0e3800722ca50" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="9039191fb4c8d842c321a3d138d6eb8cf74d19fa84e83630cc70d00ce57aca24" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="67a8fcca46fbf7d7e4ebbadafbfd3f9434b7620feb26fdac8af7a1336859e406" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="30eaf460c6701b109f4b59446ebd503f5c8a99b892f3c673d557b182dcb27090" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="6673b5fd73ff6c8e244be8183fc5ea13132f3821c6d968f8d7702d6d1412ec5f" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="eb2823755635b6647febf2d5636880e4ee0648e89b985d360f5aaed5a4ae4faf" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="3f44fe92325e27326e5e5381e9793704c716bfa8f458b79bb0daae3a64c81036" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="c74846b309e7faeca7d7743a7f5ee0ce82732e25595a473db5bf587eca2d0388" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="64076a3397953ca826ab59864999dfff79de447bb7df77f46efaa56c922602ca" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="ad20d9314a9fe71c53998a8c7c5211ac74a4a5c2c13c1f02f2c324d28a114f61" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="94be601d129dc8970ec4b926b83e0e9ee911b2783aab87e43dedde4d6194a9c1" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="523ab9217c8743ff8460286e27dd29ea35be4a651c5102e0474e14335de1a591" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="fea3ba88a40979e4479b90fe92ce6b17307c4439a42a8bc056c7fbfa3ea80559" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="02f4ab1bb8c0e8f81b3914efcc7f65af1478e03377dfe739391728d3d8aa7a0f" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="d49c5ec1fb4764a960a30d2a1e1aef53998de5f08e998344500697639f1ea7b9" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="a2b2a1e0838837b666f0002057f5ca571c4f35a87026320b4932e97575dd8fc8" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="42fe4dad76f7d27d578cc475a9eb196e637ae3536876a11bb4b28ce76ad5c054" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="928c05317251699f5bb2b857baaaff3260cb694eed69dc14fdfc71b439fd8831" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="dcff77240f40a6dfd4571554b96753885c32044ad4c5e671e2bdd240672a8fe8" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="c60c358e1a5cb6b92529cab5458c6b86d418c1f78fdecb812faff0d3b7871cff" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="a464c1157c1102525077dafed508a6bad2b3178456c6719680e126caa3cbed52" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="4ba9235621ccaac76f35971503f88e6607e1fe897dc817d6ddabdc25dc983b2f" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="647873670a57858b2cf7e06a704446854e3ec6d3b8ce617a2ed87225d8ae1c0d" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="78e6a358661d7bd74c5cb40c91d74b26dd100fd9e04a141b3d1584cfb61d7ca3" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="04a835b71a0b92b9f5391a65de143071a01d77645721cf74f748adbfc167d6b4" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="f9ba4cddbd38e31ef4633683f346c2a77545791d47f23e357872a1cd2af11fb8" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="410455ed2f22d520e132a09c5e0f65804672b4ba91db8c56f72dc37158a2ec81" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="3c2d5385fde8267598bfabbfd77c39c9839eb3b9cde31590ea27fedd3b896bbe" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="135596aeb4fc2f8ba38e4b3b088da3491f867bce10179a3f5101eb637800e33b" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="d8fb293e575a312d6ab96fcbca0cfc2c51dd12fe82bbb33c870adc29b98e787c" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="115.11.0" rel="150200.8.160.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1683806400">- Mozilla Thunderbird 102.11
  * fixed: During Account Setup, the "Checking password..."
    message was not removed after a failure (bmo#1826022)
  * fixed: Miscellaneous UI fixes (bmo#1827070)
  * fixed: Security fixes
  MFSA 2023-18 (bsc#1211175)
  * CVE-2023-32205 (bmo#1753339, bmo#1753341)
    Browser prompts could have been obscured by popups
  * CVE-2023-32206 (bmo#1824892)
    Crash in RLBox Expat driver
  * CVE-2023-32207 (bmo#1826116)
    Potential permissions request bypass via clickjacking
  * CVE-2023-32211 (bmo#1823379)
    Content process crash due to invalid wasm code
  * CVE-2023-32212 (bmo#1826622)
    Potential spoof due to obscured address bar
  * CVE-2023-32213 (bmo#1826666)
    Potential memory corruption in FileReader::DoReadData()
  * CVE-2023-32214 (bmo#1828716)
    Potential DoS via exposed protocol handlers
  * CVE-2023-32215 (bmo#1540883, bmo#1751943, bmo#1814856,
    bmo#1820210, bmo#1821480, bmo#1827019, bmo#1827024,
    bmo#1827144, bmo#1827359, bmo#1830186)
    Memory safety bugs fixed in Thunderbird 102.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
</package>
<package pkgid="20a8cf32718ca23103e5f1c6c89465ff01ef430f36fe181ee0268ede5662aa60" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="45fd419bb9d252fc163c9ac1e5bb181bddb4faeec255125a803c185dc72ba28f" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="21c52ccf028c1c2ef5ebe87239f0bfb1b51110582d15b8633357946b2d78f651" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="f4a640fd0acd0fbdfd627e6176a3274b8fbc584ef9a92db5020e61fa54e52530" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="115.12.0" rel="150200.8.163.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1685448000">- Mozilla Thunderbird 102.11.2
  * fixed: Thunderbird 102.11.1 contained POP3 client regressions
    with offline mode and TLS certificate overrides
    (bmo#1801286,bmo#1816596,bmo#1798785)
- Mozilla Thunderbird 102.11.1
  * fixed: POP message retrieval stopped after a network error
    occurred and connectivity was restored (bmo#1798785)
  * fixed: Reused SMTP connections sometimes silently
    disconnected, causing timeouts (bmo#1766382)
  * fixed: Thunderbird could freeze if saving a sent message to
    IMAP failed (bmo#1745130)
  * fixed: Creating OpenPGP keys with no expiration was not
    possible (bmo#1830094)
  * fixed: News reader did not always issue GROUP command after
    authentication with remote server, preventing Thundebird from
    displaying or refreshing news from the server (bmo#1824377)
- Update keyring</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1686571200">- Mozilla Thunderbird 102.12
  * fixed: "Searching the directory for recipients certificates"
    popup could block compose window when "S/MIME reminder" was
    enabled and using an LDAP address book (bmo#1833651)
  * fixed: Some elements still used animations with "prefers-
    reduced-motion" set (bmo#1833353)
  * fixed: Visual and theme improvements
    (bmo#1832943,bmo#1832990)
  * fixed: Security fixes
  MFSA 2023-21 (bsc#1211922)
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Thunderbird 102.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
</package>
<package pkgid="3159158f038d2abbaa90b069b5620630a5fa7baff5b105c1572d3acbfc20b2bf" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="d0f4b7434ffbd84248b2f11e18ceac763cd8d8cc901e4d5bb6a974ac6d54fcc6" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="60daa90f906ee457ee3d2921a256401b34732e575e07a55cdcf82a6654f89934" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="a51a1693b91e2faa114a147908440f69e0fb480968eaffec0a518c932760acc6" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="115.12.2" rel="150200.8.168.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690286400">- Mozilla Thunderbird 115.0.1
  * changed: Added Thunderbird Supernova branding to about:dialog
    (bmo#1842102)
  * fixed: Message list was not updated when message was deleted
    from server outside of Thunderbird (bmo#1837041)
  * fixed: Scrolling behaved unexpectedly when moving to next
    message unread message in another folder (bmo#1841711)
  * fixed: Scrolling animation was unnecessarily used when
    switching or toggling the sort column in message list
    (bmo#1838522)
  * fixed: Attempting to delete a message and then cancelling the
    action still marked the message as read (bmo#793353)
  * fixed: Unified Toolbar could not be customized under certain
    tabs (bmo#1841480)
  * fixed: Selecting a folder with one or more subfolders and
    pressing enter did not expand folder (bmo#1841200)
  * fixed: Tooltips did not appear when hovering over folders
    (bmo#1839780)
  * fixed: Deleting large amounts of messages from Trash folder
    consumed excessive time and memory (bmo#1833665)
  * fixed: Message Summary header buttons were not keyboard
    accessible (bmo#1827199)
  * fixed: "New" button in Message Filters dialog was not
    keyboard accessible (bmo#1841477)
  * fixed: Backing up secret keys from OpenPGP Key Manager dialog
    silently failed (bmo#1839415)
  * fixed: Various visual and UX improvements
    (bmo#1843172,bmo#1831422,bmo#1838360,bmo#1842319)
  * fixed: Security fixes
  MFSA 2023-27 (bsc#1212438)
  * CVE-2023-3600 (bmo#1839703)
    Use-after-free in workers
  * CVE-2023-3417 (bmo#1835582)
    File Extension Spoofing using the Text Direction Override
    Character
- Remove obsolete patches mozilla-bmo1568145.patch, mozilla-bmo1005535.patch,
  mozilla-s390x-skia-gradient.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
</package>
<package pkgid="142cdb4975184c9765a7bc9cc782d9610270c7c48808a1cbc3da0230eb51c6d5" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="9621a1ff7b1b5f4821d3749e121fc98efc6b988502d71f1f5f63d36d77c417c2" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="b53c073ebea7c065b88fba5fedac4a46c67126f58367350a15b3b595dd4719ab" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="15753b06659fc0e2705eabb37f6797d279c31e62d0b5936d99f2b5d3a8d70e50" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="115.13.0" rel="150200.8.171.4"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690372800">- Remove bashisms from startup-script (bsc#1213657)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
</package>
<package pkgid="4638f9901ff553819e75fb62b2d761bd7ab91067356cabe0630079d6fb1f3e41" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="abbe1b40b59c89c1853c2808eb339537b6ade7b1f49b2bb374ea22e4945da315" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="83caf2e16a98cffc22a81c95caef2f7ada3f25628425124f9c160de5c83d3376" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="99986c7e90ceb72eb8f5dff86f9f94d814ceb4cb0370cb8972bd8f46c1333cad" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="115.14.0" rel="150200.8.174.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1690977600">- Mozilla Thunderbird 115.1.0
  * changed: Quick Filter bar is now hidden by default
    (bmo#1835685)
  * changed: Mail tab toolbar and Unified toolbar heights
    adjusted to be more consistent (bmo#1843804,bmo#1845500)
  * fixed: Message-ID header used account domain instead of
    "From" field domain (bmo#1727181)
  * fixed: Zooming did not work in multi-message view
    (bmo#1839006)
  * fixed: "Clear Recent History" dialog did not resize correctly
    to fit content (bmo#1843233)
  * fixed: Tooltip containing full message title did not appear
    when hovering over message in card view (bmo#1843188)
  * fixed: Message List column headers became transparent in
    increased contrast mode (bmo#1842893)
  * fixed: Message List card padding was incorrect in compact
    view (bmo#1843480)
  * fixed: Total message counts and folder sizes were also hidden
    when "Hide Local Folders" was selected in Folder Pane options
    (bmo#1843135)
  * fixed: Messages in deeply nested IMAP folders were
    inaccessible (bmo#1843637)
  * fixed: Thunderbird Flatpak could not be executed from
    terminal using command "thunderbird" (bmo#1843051)
  * fixed: CardDAV address book dialog did not resize properly to
    show all available address books (bmo#1836214)
  * fixed: Various visual and style fixes
    (bmo#1843459,bmo#1844763,bmo#1838519)
  MFSA 2023-33 (bsc#1213746)
  * CVE-2023-4045 (bmo#1833876)
    Offscreen Canvas could have bypassed cross-origin
    restrictions
  * CVE-2023-4046 (bmo#1837686)
    Incorrect value used during WASM compilation
  * CVE-2023-4047 (bmo#1839073)
    Potential permissions request bypass via clickjacking
  * CVE-2023-4048 (bmo#1841368)
    Crash in DOMParser due to out-of-memory conditions
  * CVE-2023-4049 (bmo#1842658)
    Fix potential race conditions when releasing platform objects
  * CVE-2023-4050 (bmo#1843038)
    Stack buffer overflow in StorageManager
  * CVE-2023-4052 (bmo#1824420)
    File deletion and privilege escalation through Firefox
    uninstaller
  * CVE-2023-4054 (bmo#1840777)
    Lack of warning when opening appref-ms files
  * CVE-2023-4055 (bmo#1782561)
    Cookie jar overflow caused unexpected cookie jar state
  * CVE-2023-4056 (bmo#1820587, bmo#1824634, bmo#1839235,
    bmo#1842325, bmo#1843847)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14
  * CVE-2023-4057 (bmo#1841682)
    Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1,
    and Thunderbird 115.1
- Remove now upstreamed patch mozilla-bmo1775202.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1692273600">- Mozilla Thunderbird 115.1.1
  * fixed: Some HTML emails printed headers on first page and
    message on subsequent pages (bmo#1843628)
  * fixed: Deleting messages from message list sometimes scrolled
    list to bottom, selecting bottommost message (bmo#1835173)
  * fixed: Width of icon columns (like Junk or Starred) in
    message list did not adjust when UI density was changed
    (bmo#1843014)
  * fixed: Old OpenPGP secret keys could not be used to decrypt
    messages under certain circumstances (bmo#1835786)
  * fixed: When multiple folder modes were active, tab focus
    navigated through all folder mode options before reaching
    message list (bmo#1842060)
  * fixed: Unread message count badge was not displayed on parent
    folders of subfolder containing unread messages (bmo#1844534)
  * fixed: "Undo archive" (via Ctrl-Z) did not un-archive
    previously archived messages (bmo#1829340)
  * fixed: "New" button dropdown menu in "Message Filters" dialog
    could not be opened via keyboard navigation (bmo#1843511)
  * fixed: "Show New Mail Alert for" input field in "Customize
    New Mail Alert" dialog had zero width when using certain
    language packs (bmo#1845832)
  * fixed: "Account Wizard" dialog was too narrow when adding a
    news server, partially hiding confirmation buttons
    (bmo#1846588)
  * fixed: Link Properties and Image Properties dialogs in the
    composer were too wide (bmo#1816850)
  * fixed: Thunderbird version number and details in "About"
    dialog were not automatically read by screen readers when
    first opening dialog (bmo#1847078)
  * fixed: Flatpak improvements and bug fixes
    (bmo#1825399,bmo#1843094,bmo#1843097)
  * fixed: Various visual and UX improvements (bmo#1846262)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1694606400">- Mozilla Thunderbird 115.2.2
  * fixed: Security fixes
  MFSA 2023-40 (bsc#1215245)
  * CVE-2023-4863
    (https://bugs.chromium.org/p/chromium/issues/detail?id=1479274,
    bmo#1852649)
    Heap buffer overflow in libwebp
- Mozilla Thunderbird 115.2.1
  * new: Column separators are now shown between all columns in
    tree view (bmo#1847441)
  * fixed: Crash reporter did not work in Thunderbird Flatpak
    (bmo#1843102)
  * fixed: New mail notification always opened message in message
    pane, even if pane was disabled (bmo#1840092)
  * fixed: After moving an IMAP message to another folder, the
    incorrect message was selected in the message list
    (bmo#1845376)
  * fixed: Adding a tag to an IMAP message opened in a tab failed
    (bmo#1844452)
  * fixed: Junk/Spam folders were not always shown in Unified
    Folders mode (bmo#1838672)
  * fixed: Middle-clicking a folder or message did not open it in
    a background tab, as in previous versions (bmo#1842482)
  * fixed: Settings tab visual improvements: Advanced Fonts
    dialog, Section headers hidden behind search box
    (bmo#1717382,bmo#1846751)
  * fixed: Various visual and style fixes
    (bmo#1843707,bmo#1849823)
- Mozilla Thunderbird 115.2
  * new: Thunderbird MSIX packages are now published on
    archive.mozilla.org (bmo#1817657)
  * changed: Size, Unread, and Total columns are now right-
    aligned (bmo#1848604)
  * changed: Newsgroup names in message list header are now
    abbreviated (bmo#1833298)
  * fixed: Message compose window did not apply theme colors to
    menus (bmo#1845699)
  * fixed: Reading the second new message in a folder cleared the
    unread indicator of all other new messages (bmo#1839805)
  * fixed: Displayed counts of unread or flagged messages could
    become out-of-sync (bmo#1846860)
  * fixed: Deleting a message from the context menu with messages
    sorted in chronological order and smooth scroll enabled
    caused message list to scroll to top (bmo#1843462)
  * fixed: Repeatedly switching accounts in Subscribe dialog
    caused tree view to stop updating (bmo#1845593)
  * fixed: "Ignore thread" caused message cards to display
    incorrectly in message list (bmo#1847966)
  * fixed: Creating tags from unified toolbar failed
    (bmo#1846336)
  * fixed: Cross-folder navigation using F and N did not work
    (bmo#1845011)
  * fixed: Account Manager did not resize to fit content, causing
    "Close" button to become hidden outside bounds of dialog when
    too many accounts were listed (bmo#1847555)
  * fixed: Remote content exceptions could not be added in
    Settings (bmo#1847576)
  * fixed: Newsgroup list file did not get updated after adding a
    new NNTP server (bmo#1845464)
  * fixed: "Download all headers" option in NNTP "Download
    Headers" dialog was incorrectly selected by default
    (bmo#1845457)
  * fixed: "Convert to event/task" was missing from mail context
    menu (bmo#1817705)
  * fixed: Events and tasks were not shown in some cases despite
    being present on remote server (bmo#1827100)
  * fixed: Various visual and UX improvements
    (bmo#1844244,bmo#1845645)
  * fixed: Security fixes
  MFSA 2023-38 (bsc#1214606)
  * CVE-2023-4573 (bmo#1846687)
    Memory corruption in IPC CanvasTranslator
  * CVE-2023-4574 (bmo#1846688)
    Memory corruption in IPC ColorPickerShownCallback
  * CVE-2023-4575 (bmo#1846689)
    Memory corruption in IPC FilePickerShownCallback
  * CVE-2023-4576 (bmo#1846694)
    Integer Overflow in RecordedSourceSurfaceCreation
  * CVE-2023-4577 (bmo#1847397)
    Memory corruption in JIT UpdateRegExpStatics
  * CVE-2023-4051 (bmo#1821884)
    Full screen notification obscured by file open dialog
  * CVE-2023-4578 (bmo#1839007)
    Error reporting methods in SpiderMonkey could have triggered
    an Out of Memory Exception
  * CVE-2023-4053 (bmo#1839079)
    Full screen notification obscured by external program
  * CVE-2023-4580 (bmo#1843046)
    Push notifications saved to disk unencrypted
  * CVE-2023-4581 (bmo#1843758)
    XLL file extensions were downloadable without warnings
  * CVE-2023-4582 (bmo#1773874)
    Buffer Overflow in WebGL glGetProgramiv
  * CVE-2023-4583 (bmo#1842030)
    Browsing Context potentially not cleared when closing Private
    Window
  * CVE-2023-4584 (bmo#1843968, bmo#1845205, bmo#1846080,
    bmo#1846526, bmo#1847529)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15,
    Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
  * CVE-2023-4585 (bmo#1751583, bmo#1833504, bmo#1841082,
    bmo#1847904, bmo#1848999)
    Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2,
    and Thunderbird 115.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1696248000">- Mozilla Thunderbird 115.3.1
  * fixed: In Unified Folders view, some folders had incorrect
    unified folder parent (bmo#1852525)
  * fixed: "Edit message as new" did not restore encrypted
    subject from selected message (bmo#1788534)
  * fixed: Importing some CalDAV calendars with yearly recurrence
    events caused Thunderbird to freeze (bmo#1850732)
  * fixed: Security fixes
  MFSA 2023-44 (bsc#1215814)
  * CVE-2023-5217 (bmo#1855550)
    Heap buffer overflow in libvpx
- Mozilla Thunderbird 115.3
  * fixed: Thunderbird could not import profiles with hostname
    ending in dot (".") (bmo#1825374)
  * fixed: Message header was occasionally missing in message
    preview (bmo#1840943)
  * fixed: Setting an existing folder's type flag did not add
    descendant folders to the Unified Folders view (bmo#1848904)
  * fixed: Thunderbird did not always delete all temporary mail
    files, sometimes preventing messages from being sent
    (bmo#673703)
  * fixed: Status bar in Message Compose window could not be
    hidden (bmo#1806860)
  * fixed: Message header was intermittently missing from message
    preview (bmo#1840943)
  * fixed: OAuth2 did not work on some profiles created in
    Thunderbird 102.6.1 or earlier (bmo#1814823)
  * fixed: In Vertical View, decrypted subject lines were
    displayed as ellipsis ("...") in message list (bmo#1831764)
  * fixed: Condensed address preference
    (mail.showCondensedAddresses) did not show condensed
    addresses in message list (bmo#1831280)
  * fixed: Spam folder could not be assigned non-ASCII names with
    IMAP UTF-8 enabled (bmo#1816332)
  * fixed: Message header was not displayed until images finished
    loading, causing noticeable delay for messages containing
    large images (bmo#1851871)
  * fixed: Large SVG favicons did not display on RSS feeds
    (bmo#1853895)
  * fixed: Context menu items did not display a hover background
    color (bmo#1852732)
  * fixed: Security fixes
  MFSA 2023-43 (bsc#1215575)
  * CVE-2023-5168 (bmo#1846683)
    Out-of-bounds write in FilterNodeD2D1
  * CVE-2023-5169 (bmo#1846685)
    Out-of-bounds write in PathOps
  * CVE-2023-5171 (bmo#1851599)
    Use-after-free in Ion Compiler
  * CVE-2023-5174 (bmo#1848454)
    Double-free in process spawning on Windows
  * CVE-2023-5176 (bmo#1836353, bmo#1842674, bmo#1843824,
    bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983,
    bmo#1851195)
    Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3,
    and Thunderbird 115.3
- Add patch mozilla-fix-broken-ffmpeg.patch to fix broken build
  with newer binutils (bsc#1215309)
- Fix i586 build by reducing debug info to -g1. (boo#1210168)
- Mozilla Thunderbird 115.2.3
  * changed: Card view and vertical layout are now default for
    new profiles (bmo#1849000)
  * fixed: Go &gt; Folder menu was disabled (bmo#1849919)
  * fixed: "Tools" menu was blank when opened from compose window
    on macOS (bmo#1848155)
  * fixed: Deleting an attachment from a message on an IMAP
    server corrupted the local copy when configured with "mark as
    deleted" (bmo#1135434)
  * fixed: Manually entered passwords were not remembered for
    OAuth-authenticated accounts such as Yahoo mail (bmo#1673446)
  * fixed: Quick Filter's "Keep filters applied" did not persist
    after restarting Thunderbird (bmo#1846880,bmo#1849221)
  * fixed: Top-level Quick Filter settings did not persist after
    restart (bmo#1849249)
  * fixed: Notifications for new messages with non-ASCII
    characters in the subject were garbled (bmo#1842384)
  * fixed: "Mark Thread As Read" did not work when some messages
    in thread were already read (bmo#1850850)
  * fixed: New Groups tab in NNTP subscribe dialog id not work as
    expected (bmo#1848366)
  * fixed: Negative values were allowed in "Share for files
    larger than" field (bmo#1850281)
  * fixed: Thunderbird sometimes crashed when deleting a parent
    folder with subfolders (bmo#1851293)
  * fixed: "Send Message Error" appeared intermittently while
    Thunderbird was idle (bmo#1801668)
  * fixed: Focused but not selected messages were missing visual
    indication of focus in card view (bmo#1844263)
  * fixed: Notification dot did not disappear from taskbar icon
    on Windows after messages had already been read (bmo#1824889)
  * fixed: Multiple selected messages could not be opened
    simultaneously if selection included more than 19 messages
    (bmo#1851563)
  * fixed: Email replies received via BCC incorrectly populated
    From field with default identity (bmo#1851512)
  * fixed: User was not always notified of message send failures
    in outbox (bmo#1851542)
  * fixed: Tag dialog did not close properly after editing tag
    (bmo#1852414)
  * fixed: Newsgroup field in compose window did not autocomplete
    with suggested newsgroup names (bmo#1670457)
  * fixed: Canceling newsgroup messages did not check if sender
    matched user's own identity (bmo#1823274)
  * fixed: Event dialog with several invitees expanded beyond
    screen height (bmo#1848261)
  * fixed: Message check boxes were partially obstructed in
    message list (bmo#1850760)
  * unresolved: Some folders missing from Unified Folders ()</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1697457600">- Mozilla Thunderbird 115.3.2
  * fixed: "Open in conversation" did not open messages in a
    thread view (bmo#1849374)
  * fixed: News messsage with non-ASCII author name were
    incorrectly canceled (bmo#1854023)
  * fixed: Localized "Re: " prefix was not stripped from news
    messages (bmo#1845155)
  * fixed: Thunderbird attempted to load accounts missing server
    hostname, causing blank 3-pane window (bmo#1854064)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Card View displayed incorrect recipient name for mail
    and news accounts, depending on folder (bmo#1851955)
  * fixed: Spell check dictionary dialog sometimes pushed Close
    button out of view (bmo#1856152)
  * fixed: Importing calendars from iCal files did not work under
    certain circumstances (bmo#1854422)
  * fixed: Calendar invitations were not sent to event
    participants, only organizer (bmo#1847658)
  * fixed: Calendar alarm dialogs with lengthy descriptions
    pushed buttons out of view (bmo#1852682)
  * fixed: Various visual fixes (bmo#1854836)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1698235200">- Mozilla Thunderbird 115.4.1
  * new: "Manage Newsgroups Subscription" now displayed on
    Account Central when using newsgroups (bmo#1847428)
  * fixed: Manually configured authentication methods on accounts
    did no always persist (bmo#1855515)
  * fixed: "Send Autocrypt key in header" preference was
    available on accounts with no encryption key (bmo#1857541)
  * fixed: SHA-1 certificates were not accepted in Thunderbird
    115; acceptance of SHA-1 messages can now be enabled via
    optional preference (bmo#1854592)
  * fixed: Various Flatpak enhancements
    (bmo#1843110,bmo#1845495,bmo#1850013)
  * fixed: Opening folder in new tab by clicking scroll
    wheel/middle mouse button did not work in Folder Pane
    (bmo#1836853)
  * fixed: Message list did not automatically scroll to new
    messages when switching folders (bmo#1850190)
  * fixed: "Move/Copy to &lt;folder&gt; again" was sometimes displayed
    in the folder context menu when it should not have been
    (bmo#1855160)
  * fixed: Multiple message drafts or message templates could not
    be opened simultaneously for editing (bmo#1853558)
  * fixed: Tools &gt; Filters dialog did not open in Unified Folder
    view if no messages were selected (bmo#1844341)
  * fixed: Printing dialog could be opened, even with no messages
    selected (bmo#1846190)
  * fixed: "From" address was editable when creating a new
    message from a template if the account identity contained
    Unicode characters (bmo#1850055)
  * fixed: Opening a saved .eml file in compose window did not
    preserve message subject from file (bmo#1856166)
  * fixed: Replying to some plaintext messages with desired quote
    selected in original message did not preserve formatting of
    quote (bmo#1839226)
  * fixed: "Edit as New", "Reply", and "Redirect" could not be
    used on multiple messages simultaneously (bmo#1855065)
  * fixed: "Reply to List" option was always enabled, even with
    no list to reply to (bmo#1851971)
  * fixed: "Archive" button in message pane was enabled on
    messages that could not be archived (bmo#1856315)
  * fixed: "Followup-To" label was incorrectly labeled as
    "Newsgroups" (bmo#1854801)
  * fixed: "Save image as" option did not work for RSS feed items
    displayed as a webpage (bmo#1853498)
  * fixed: OTR verification dialog was blank, preventing
    verification of OTR chat sessions (bmo#1852030)
  * fixed: Calendar ICS parser improvements for more reliable
    event import (bmo#1857196)
  * fixed: Permission description strings were missing from Add-
    Ons Manager (bmo#1842490)
  * fixed: Various visual fixes
    (bmo#1855033,bmo#1855204,bmo#1858942,bmo#1857504)
  * fixed: Security fixes
  MFSA 2023-47 (bsc#1216338)
  * CVE-2023-5721 (bmo#1830820)
    Queued up rendering could have allowed websites to clickjack
  * CVE-2023-5732 (bmo#1690979, bmo#1836962)
    Address bar spoofing via bidirectional characters
  * CVE-2023-5724 (bmo#1836705)
    Large WebGL draw could have led to a crash
  * CVE-2023-5725 (bmo#1845739)
    WebExtensions could open arbitrary URLs
  * CVE-2023-5726 (bmo#1846205)
    Full screen notification obscured by file open dialog on
    macOS
  * CVE-2023-5727 (bmo#1847180)
    Download Protections were bypassed by .msix, .msixbundle,
    .appx, and .appxbundle files on Windows
  * CVE-2023-5728 (bmo#1852729)
    Improper object tracking during GC in the JavaScript engine
    could have led to a crash.
  * CVE-2023-5730 (bmo#1836607, bmo#1840918, bmo#1848694,
    bmo#1848833, bmo#1850191, bmo#1850259, bmo#1852596,
    bmo#1853201, bmo#1854002, bmo#1855306, bmo#1855640,
    bmo#1856695)
    Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4,
    and Thunderbird 115.4.1
- Removed upstreamed patch mozilla-fix-broken-ffmpeg.patch
- Mozilla Thunderbird 115.4.0
  * pulled and replaced by 115.4.1
- Mozilla Thunderbird 115.3.3
  * fixed: Modifier keys did not work as expected when dragging a
    message over the folder tree on macOS (bmo#1847791)
  * fixed: "Folder Location" toolbar button did not work for
    local folders (bmo#1843979)
  * fixed: "Copy to &lt;folder name&gt; again" option disappeared from
    context menu after copying to Gmail folder with non-ASCII
    name (bmo#1856712)
  * fixed: Default reply identity did not use "Delivered-To"
    address when catch-all was active (bmo#1815559)
  * fixed: "View Headers All" did not work when selected in
    standalone message window (bmo#1855316)
  * fixed: Viewing the mail filter log displayed an error if no
    log file was present (bmo#1789244)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1700654400">- Mozilla Thunderbird 115.5.0
  * fixed: Initial message was not automatically selected when
    opened in conversation (bmo#1856266)
  * fixed: Newsgroup users using FQDN identity generated message
    ID headers with incorrect domain name (bmo#1846837)
  * fixed: Link previews had poor legibility in dark mode
    (bmo#1820244)
  * fixed: Plasma's task switcher displayed the default icon when
    running the Thunderbird Flatpak on Wayland (bmo#1863262)
  * fixed: Link to Flatpak manifest was incorrect (bmo#1863594)
  * fixed: Security fixes
  MFSA 2023-52 (bsc#1217230)
  * CVE-2023-6204 (bmo#1841050)
    Out-of-bound memory access in WebGL2 blitFramebuffer
  * CVE-2023-6205 (bmo#1854076)
    Use-after-free in MessagePort::Entangled
  * CVE-2023-6206 (bmo#1857430)
    Clickjacking permission prompts using the fullscreen
    transition
  * CVE-2023-6207 (bmo#1861344)
    Use-after-free in ReadableByteStreamQueueEntry::Buffer
  * CVE-2023-6208 (bmo#1855345)
    Using Selection API would copy contents into X11 primary
    selection.
  * CVE-2023-6209 (bmo#1858570)
    Incorrect parsing of relative URLs starting with "///"
  * CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252,
    bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943,
    bmo#1862782)
    Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5,
    and Thunderbird 115.5.0
- Mozilla Thunderbird 115.4.3
  * fixed: Forwarding multiple messages as attachments failed
    (bmo#1859938)
  * fixed: Message list scrolling fixes (bmo#1827042,bmo#1845391)
  * fixed: Some text remained incorrectly visible in the message
    list when using "Grouped By" sorting (bmo#1839035)
  * fixed: Subject lines were excessively indented in "Grouped
    by" views (bmo#1841256)
  * fixed: "Open Message in Conversation" was incorrectly enabled
    for selections of multiple messages (bmo#1860539)
  * fixed: States of collapsed and expanded threads were not
    maintained when switching folders (bmo#1807063)
  * fixed: Pressing "n" to move to the next unread message on an
    unread, collapsed thread opened the thread and selected the
    second message instead of the first (bmo#1847792)
  * fixed: Search Folders dialog improvements (bmo#1859050)
  * fixed: "Read Messages" button in Account Central did not
    retrieve mail from POP accounts (bmo#1858733)
  * fixed: Events canceled by the organizer were incorrectly sent
    cancelation message (bmo#1861355)
- Mozilla Thunderbird 115.4.2
  * fixed: No messages or calendar items were displayed on
    startup (bmo#1860885)
  * fixed: Toolbar &amp; Folder View widget fixes (bmo#1858750)
  * fixed: Insert image dialog was not properly sized on some
    localized builds (bmo#1860503)
  * fixed: The "unencrypted subject" icon was always briefly
    displayed when replying to a message (bmo#1828591)
  * fixed: RSS feeds with lengthy attachment filenames cut off
    visible content (bmo#1858114)
  * fixed: RSS feeds with no favicon displayed default icon in
    the folder color (bmo#1858178)
  * fixed: NNTP messages that were previously downloaded were not
    displayed if the server went offline (bmo#1859522)
  * fixed: Vcard photos were not imported when using opening the
    file with Thunderbird (bmo#1859114)
  * fixed: Publishing calendars to invalid URLs did not display a
    helpful error (bmo#1841547)
  * fixed: Publishing calendar events via authenticated WebDAV
    failed (bmo#1857033)
  * fixed: Converting a message to an event failed when the
    message pane was not displayed (bmo#1857835)
  * fixed: Redirect dialog displayed for WebDAV calendars was too
    small (bmo#1856340)
  * fixed: Visual and Theme improvements
    (bmo#1844729,bmo#1860218,bmo#1860272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1703073600">- Mozilla Thunderbird 115.6
  * fixed: Message selection misbehaved after selecting a sub-
    message in an expanded thread, collapsing the thread, then
    pressing up/down to move selection (bmo#1865548)
  * fixed: Thunderbird now attempts to reconnect on a new
    connection after SMTP 4xx errors (bmo#1854567)
  * fixed: HTML FileLink attachments used the wrong encoding
    (bmo#1865269)
  * fixed: Security fixes
  MFSA 2023-55 (bsc#1217974)
  * CVE-2023-50762 (bmo#1862625)
    Truncated signed text was shown with a valid OpenPGP
    signature
  * CVE-2023-50761 (bmo#1865647)
    S/MIME signature accepted despite mismatching message date
  * CVE-2023-6856 (bmo#1843782)
    Heap-buffer-overflow affecting WebGL DrawElementsInstanced
    method with Mesa VM driver
  * CVE-2023-6857 (bmo#1796023)
    Symlinks may resolve to smaller than expected buffers
  * CVE-2023-6858 (bmo#1826791)
    Heap buffer overflow in nsTextFragment
  * CVE-2023-6859 (bmo#1840144)
    Use-after-free in PR_GetIdentitiesLayer
  * CVE-2023-6860 (bmo#1854669)
    Potential sandbox escape due to VideoBridge lack of texture
    validation
  * CVE-2023-6861 (bmo#1864118)
    Heap buffer overflow affected nsWindow::PickerOpen(void) in
    headless mode
  * CVE-2023-6862 (bmo#1868042)
    Use-after-free in nsDNSService
  * CVE-2023-6863 (bmo#1868901)
    Undefined behavior in ShutdownObserver()
  * CVE-2023-6864 (bmo#1736385, bmo#1810805, bmo#1846328,
    bmo#1856090, bmo#1858033, bmo#1858509, bmo#1862089,
    bmo#1862777, bmo#1864015)
    Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
    and Thunderbird 115.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1704888000">- Mozilla Thunderbird 115.6.1
  * new: OAuth2 now supported for comcast.net (bmo#1844810)
  * fixed: High CPU usage sometimes occurred with IMAP CONDSTORE
    (conditional STORE) enabled (bmo#1839256)
  * fixed: Replying to a collapsed thread via keyboard shortcut
    (Ctrl+R/Cmd+R) opened a reply for every message in the thread
    (bmo#1866819)
  * fixed: Enabling Grouped By view after reversing sort order of
    column header caused messages to be grouped incorrectly
    (bmo#1868794)
  * fixed: Opening thread pane context menu via keyboard did not
    always scroll view to selection (bmo#1867532)
  * fixed: New mail indicator for POP3 accounts did not indicate
    new messages ready to be downloaded (bmo#1870619)
  * fixed: Messages could not be moved to folders using Message &gt;
    Move To if text or a link in the message had been clicked on
    first (bmo#1868474)
  * fixed: MIME part boundaries were not properly terminated
    (bmo#1805558)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1706097600">- Mozilla Thunderbird 115.7
  * new: Autocrypt Gossip key distribution added (bmo#1853674)
  * fixed: When starting Thunderbird, unread message count did
    not appear on collapsed accounts (bmo#1862774)
  * fixed: Blank window was sometimes displayed when starting
    Thunderbird (bmo#1870817)
  * fixed: Thunderbird "--chrome" flag incorrectly opened extra
    messenger.xhtml (bmo#1866915)
  * fixed: Add-ons did not start correctly when opening
    Thunderbird from other programs (bmo#1800423)
  * fixed: Drag-and-drop installation of add-ons did not work if
    Add-ons Manager was opened from Unified Toolbar (bmo#1862978)
  * fixed: Double-clicking empty space in message pane
    incorrectly opened the currently selected message
    (bmo#1867407)
  * fixed: Canceling SMTP send before progress reached 100% did
    not stop message from sending (bmo#1816540)
  * fixed: PDF attachments open in a separate tab did not always
    restore correctly after restarting Thunderbird (bmo#1846054)
  * fixed: Some OpenPGP dialogs were too small for their contents
    (bmo#1870809)
  * fixed: Account Manager did not work with hostnames entered as
    punycode (bmo#1870720,bmo#1872632)
  * fixed: Downloading complete message from POP3 headers caused
    message tab/window to close when "Close message window/tab on
    move or delete" was enabled (bmo#1861886)
  * fixed: Some ECC GPG keys could not be exported (bmo#1867765)
  * fixed: Contacts deleted from mailing list view still visible
    in Details view (bmo#1799362)
  * fixed: After selecting contacts in Address Book and starting
    a new search, the search results list did not update
    (bmo#1812726)
  * fixed: Various UX and visual improvements (bmo#1866061,bmo#18
    67169,bmo#1867728,bmo#1868079,bmo#1869519,bmo#1832149,bmo#185
    6495,bmo#1861210,bmo#1861286,bmo#1863296,bmo#1864979)
  * fixed: Security fixes
  MFSA 2024-04 (bsc#1218955)
  * CVE-2024-0741 (bmo#1864587)
    Out of bounds write in ANGLE
  * CVE-2024-0742 (bmo#1867152)
    Failure to update user input timestamp
  * CVE-2024-0746 (bmo#1660223)
    Crash when listing printers on Linux
  * CVE-2024-0747 (bmo#1764343)
    Bypass of Content Security Policy when directive unsafe-
    inline was set
  * CVE-2024-0749 (bmo#1813463)
    Phishing site popup could show local origin in address bar
  * CVE-2024-0750 (bmo#1863083)
    Potential permissions request bypass via clickjacking
  * CVE-2024-0751 (bmo#1865689)
    Privilege escalation through devtools
  * CVE-2024-0753 (bmo#1870262)
    HSTS policy on subdomain could bypass policy of upper domain
  * CVE-2024-0755 (bmo#1868456, bmo#1871445, bmo#1873701)
    Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7,
    and Thunderbird 115.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1708516800">- Mozilla Thunderbird 115.8
  * new: Added option to show packet dump when OpenPGP fails to
    decrypt (bmo#1874504)
  * fixed: Thunderbird slowed down significantly when opening
    email files (.eml) (bmo#1863957)
  * fixed: Inbox view intermittently reverted to default view
    after moving or deleting messages (bmo#1725127)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Hovering over folder does not always expand subfolders
    (bmo#1873101)
  * fixed: Switching to thread pane of a folder using keyboard
    navigation did not focus top message (bmo#1869557)
  * fixed: Clicking "Sent unsent messages" in Outbox context menu
    while in offline mode did not prompt user to go online
    (bmo#1873487)
  * fixed: Mail tab-specific Unified Toolbar buttons received
    focus incorrectly (bmo#1872239)
  * fixed: Quick Filter settings did not persist when Quick
    Filter bar was turned off (bmo#1850266)
  * fixed: Quick Filters were unusually slow (bmo#1849650)
  * fixed: OpenPGP Key Manager filtering did not work
    (bmo#1873655)
  * fixed: OpenPGP sometimes attempted to decrypt message with
    incorrect key (bmo#1865620)
  * fixed: Autoconfig failed on servers that did not support
    OAuth2 (bmo#1869122)
  * fixed: Opening different attachments with the same name in
    different messages could cause attachment files to become
    conflated (bmo#1873023)
  * fixed: Overflowed attachment list could not be scrolled
    (bmo#1871343)
  * fixed: Passwords disappeared from password manager list after
    applying and clearing filters (bmo#1874646)
  * fixed: Cookies in cookie manager list disappeared after
    applying and then clearing filters (bmo#1876733)
  * fixed: Security fixes
  MFSA 2024-07 (bsc#1220048)
  * CVE-2024-1546 (bmo#1843752)
    Out-of-bounds memory read in networking channels
  * CVE-2024-1547 (bmo#1877879)
    Alert dialog could have been spoofed on another site
  * CVE-2024-1548 (bmo#1832627)
    Fullscreen Notification could have been hidden by select
    element
  * CVE-2024-1549 (bmo#1833814)
    Custom cursor could obscure the permission dialog
  * CVE-2024-1550 (bmo#1860065)
    Mouse cursor re-positioned unexpectedly could have led to
    unintended permission grants
  * CVE-2024-1551 (bmo#1864385)
    Multipart HTTP Responses would accept the Set-Cookie header
    in response parts
  * CVE-2024-1552 (bmo#1874502)
    Incorrect code generation on 32-bit ARM devices
  * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498,
    bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597,
    bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795,
    bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286)
    Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8,
    and Thunderbird 115.8</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710244800">- Mozilla Thunderbird 115.8.1
  * fixed: Settings: Updating tags failed if Automatic Updates
    were disabled (bmo#1874557)
  * fixed: Size of collapsed folders in folder pane did not
    include size of subfolders (bmo#1870641)
  * fixed: Reversing sort order of Grouped By views in quick
    search did not reverse (bmo#1868816)
  * fixed: Removing threaded messages in a unified folder
    sometimes resulted in an incorrect number of levels in the
    thread (bmo#1871992)
  * fixed: Thread collapsing did not behave correctly when
    copying thread messages in multi-folder view (bmo#1872253)
  * fixed: S/MIME encryption failed to encrypt if unsupported
    certificate type was encountered (bmo#1876931)
  * fixed: Decrypting a copy of an S/MIME encrypted, opaque-
    signed message created an unreadable message (bmo#1878053)
  * fixed: Thunderbird sometimes changed the subject of messages
    selected while simultaneously decrypting a large PGP-
    encrypted message (bmo#1860977)
  * fixed: "Quote message" menu item in compose window did not
    work when replying to message opened in separate tab
    (bmo#1868626)
  * fixed: Toolbar customization window contents overflowed the
    window width (bmo#1852744)
  * fixed: Security fixes
  MFSA 2024-11 (bsc#1221054)
  * CVE-2024-1936 (bmo#1860977)
    Leaking of encrypted email subjects to other conversations</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1710936000">- Mozilla Thunderbird 115.9
  * fixed: Opened ignored messages in a message thread/subthread
    were not marked as read in IMAP folders (bmo#448876)
  * fixed: Multi-language spellcheck sometimes skipped languages
    (bmo#1790746)
  * fixed: Thread tree did not update when live language
    switching (bmo#1842585)
  * fixed: Visual improvements to "Reorder Attachments" popup
    (bmo#1881945)
  * fixed: Sort order was sometimes incorrect in Grouped By views
    (bmo#1866951)
  * fixed: Selecting "Match all messages" in Filter Rules dialog
    did not disable all search criteria (bmo#1879735)
  * fixed: S/MIME-only signed messages sometimes incorrectly
    displayed signature as invalid (bmo#1741362)
  * fixed: OpenPGP keys uploaded to an HKP keyserver were sent
    with the wrong `Content-Type` header (bmo#1879822)
  * fixed: Keyboard navigation within search toolbar did not work
    (bmo#1878543)
  * fixed: Flatpak builds only had the en-US spell check
    dictionary available (bmo#1882352)
  * fixed: Security fixes
  MFSA 2024-14 (bsc#1221327)
  * CVE-2024-0743 (bmo#1867408)
    Crash in NSS TLS method
  * CVE-2024-2605 (bmo#1872920)
    Windows Error Reporter could be used as a Sandbox escape
    vector
  * CVE-2024-2607 (bmo#1879939)
    JIT code failed to save return registers on Armv7-A
  * CVE-2024-2608 (bmo#1880692)
    Integer overflow could have led to out of bounds write
  * CVE-2024-2616 (bmo#1846197)
    Improve handling of out-of-memory conditions in ICU
  * CVE-2023-5388 (bmo#1780432)
    NSS susceptible to timing attack against RSA decryption
  * CVE-2024-2610 (bmo#1871112)
    Improper handling of html and body tags enabled CSP nonce
    leakage
  * CVE-2024-2611 (bmo#1876675)
    Clickjacking vulnerability could have led to a user
    accidentally granting permissions
  * CVE-2024-2612 (bmo#1879444)
    Self referencing object could have potentially led to a use-
    after-free
  * CVE-2024-2614 (bmo#1685358, bmo#1861016, bmo#1880405,
    bmo#1881093)
    Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9,
    and Thunderbird 115.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1713787200">- Mozilla Thunderbird 115.10.1
  * fixed: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  * unresolved: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
- Mozilla Thunderbird 115.10
  * fixed: Creating a tag in General Settings with a number as
    the tag name did not work (bmo#1881124)
  * fixed: Quick Filter button selections did not persist after
    restart (bmo#1847265)
  * fixed: Collapsing and expanding message list headers
    sometimes caused header to scroll out of view (bmo#1862197)
  * fixed: Single message with no children inside a parent thread
    sometimes displayed incorrectly as a thread with a duplicate
    of itself as its child (bmo#1427546)
  * fixed: "Get selected messages" menu items did not work
    (bmo#1867091)
  * fixed: "Download and Sync Messages" dialog was too short when
    using Russian locale, obscuring OK button (bmo#1881795)
  * fixed: After changing password on an IMAP account, the
    account could become locked due to too many failed login
    attempts (bmo#1862111)
  * fixed: Retrieving multiline POP3 message from server failed
    if message chunk ended in newline instead of carriage return
    and newline (bmo#1883760)
  * fixed: IMAP, POP3, and SMTP Exchange autoconfiguration did
    not support encryption configuration (bmo#1876992)
  * fixed: Non-empty address book search bar interfered with
    displaying/editing contacts (bmo#1833031)
  * fixed: Deleting attendees from "Invite Attendees" view
    removed attendees from view, but not from invite
    (bmo#1874450)
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1889562)
  * fixed: Performance improvements and code cleanup
    (bmo#1878257,bmo#1883550)
  * fixed: Security fixes
  * unresolved: Thunderbird processes did not exit cleanly; user
    intervention was required via task manager (bmo#1891889)
  MFSA 2024-20 (bsc#1222535)
  * CVE-2024-3852 (bmo#1883542)
    GetBoundName in the JIT returned the wrong object
  * CVE-2024-3854 (bmo#1884552)
    Out-of-bounds-read after mis-optimized switch statement
  * CVE-2024-3857 (bmo#1886683)
    Incorrect JITting of arguments led to use-after-free during
    garbage collection
  * CVE-2024-2609 (bmo#1866100)
    Permission prompt input delay could expire when not in focus
  * CVE-2024-3859 (bmo#1874489)
    Integer-overflow led to out-of-bounds-read in the OpenType
    sanitizer
  * CVE-2024-3861 (bmo#1883158)
    Potential use-after-free due to AlignedBuffer self-move
  * CVE-2024-3863 (bmo#1885855)
    Download Protections were bypassed by .xrm-ms files on
    Windows
  * CVE-2024-3302 (bmo#1881183, https://kb.cert.org/vuls/id/421644)
    Denial of Service using HTTP/2 CONTINUATION frames
  * CVE-2024-3864 (bmo#1888333)
    Memory safety bug fixed in Firefox 125, Firefox ESR 115.10,
    and Thunderbird 115.10</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1715860800">- Mozilla Thunderbird 115.11
  * fixed: Splitter arrow between task list and task description
    did not behave as expected (bmo#1888879)
  * fixed: Calendar Event Attendees dialog had incorrectly sized
    rows (bmo#1852304)
  * fixed: Security fixes
  MFSA 2024-23 (bsc#1224056)
  * CVE-2024-4367 (bmo#1893645)
    Arbitrary JavaScript execution in PDF.js
  * CVE-2024-4767 (bmo#1878577)
    IndexedDB files retained in private browsing mode
  * CVE-2024-4768 (bmo#1886082)
    Potential permissions request bypass via clickjacking
  * CVE-2024-4769 (bmo#1886108)
    Cross-origin responses could be distinguished between script
    and non-script content-types
  * CVE-2024-4770 (bmo#1893270)
    Use-after-free could occur when printing to PDF
  * CVE-2024-4777 (bmo#1878199, bmo#1893340)
    Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11,
    and Thunderbird 115.11</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718625600">- Mozilla Thunderbird 115.12
  * fixed: POP error messages from server were not displayed
    (bmo#1876431)
  * fixed: Some OpenPGP messages were incorrectly reported as
    being partially signed or encrypted (bmo#1886396)
  * fixed: Autocrypt header was missing from some encrypted
    messages due to case-sensitive email address matching
    (bmo#1896876)
  * fixed: "Convert to Table" dialog content was formatted
    incorrectly (bmo#1896252)
  * fixed: Opening Theme Settings reverted the current theme to
    the startup theme (bmo#1859271)
  * fixed: Security fixes
  MFSA 2024-28 (bsc#1226027)
  * CVE-2024-5702 (bmo#1193389)
    Use-after-free in networking
  * CVE-2024-5688 (bmo#1895086)
    Use-after-free in JavaScript object transplant
  * CVE-2024-5690 (bmo#1883693)
    External protocol handlers leaked by timing attack
  * CVE-2024-5691 (bmo#1888695)
    Sandboxed iframes were able to bypass sandbox restrictions to
    open a new window
  * CVE-2024-5692 (bmo#1891234)
    Bypass of file name restrictions during saving
  * CVE-2024-5693 (bmo#1891319)
    Cross-Origin Image leak via Offscreen Canvas
  * CVE-2024-5696 (bmo#1896555)
    Memory Corruption in Text Fragments
  * CVE-2024-5700 (bmo#1862809, bmo#1889355, bmo#1893388,
    bmo#1895123)
    Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12,
    and Thunderbird 115.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718798400">- Mozilla Thunderbird 115.12.1
  * 115.12.0 got pulled because of upstream automation process errors
    and Windows installer signing changes.
    No code changes, changelog is the same as 115.12.0 (bsc#1226495)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1719921600">- Mozilla Thunderbird 115.12.2
  * fixed: Annual Thunderbird Beta appeal intended for
    Thunderbird 115.12.0 did not open as expected (bmo#1898084)
- Added thunderbird-fix-CVE-2024-34703.patch (bsc#1227239)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1721217600">- Mozilla Thunderbird 115.13
  * fixed: After starting Thunderbird, the message list position
    was sometimes set to an incorrect position (bmo#1896009)
  * fixed: Security fixes
  MFSA 2024-31 (bsc#1226316)
  * CVE-2024-6600 (bmo#1888340)
    Memory corruption in WebGL API
  * CVE-2024-6601 (bmo#1890748)
    Race condition in permission assignment
  * CVE-2024-6602 (bmo#1895032)
    Memory corruption in NSS
  * CVE-2024-6603 (bmo#1895081)
    Memory corruption in thread creation
  * CVE-2024-6604 (bmo#1748105, bmo#1837550, bmo#1884266)
    Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13,
    Thunderbird 128, and Thunderbird 115.13</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1723809600">- Mozilla Thunderbird 115.14
  * fixed: When using an external installation of GnuPG,
    Thunderbird occassionally sent/received corrupted messages
    (bmo#1898832)
  * fixed: Users of external GnuPG were unable to decrypt
    incorrectly encoded messages (bmo#1906903)
  * fixed: Flatpak install of 128.0esr was incorrectly downgraded
    to 115.13.0esr (bmo#1908299)
  * fixed: Security fixes
  MFSA 2024-38 (bsc#1228648)
  * CVE-2024-7519 (bmo#1902307)
    Out of bounds memory access in graphics shared memory
    handling
  * CVE-2024-7521 (bmo#1904644)
    Incomplete WebAssembly exception handing
  * CVE-2024-7522 (bmo#1906727)
    Out of bounds read in editor component
  * CVE-2024-7525 (bmo#1909298)
    Missing permission check when creating a StreamFilter
  * CVE-2024-7526 (bmo#1910306)
    Uninitialized memory used by WebGL
  * CVE-2024-7527 (bmo#1871303)
    Use-after-free in JavaScript garbage collection
  * CVE-2024-7529 (bmo#1903187)
    Document content could partially obscure security prompts</changelog>
</package>
<package pkgid="9d2959909a8336496fe4c4e85c8017decdf6fa662a3485e52a461c78f50549b3" name="NetworkManager" arch="aarch64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="2d5a6e17674afbed0784b8cd91a1b38de65c7e46e56de490433fdfe742a3baaa" name="NetworkManager" arch="ppc64le">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="2434d2111245b044045f77bb20ba44f6a6d5c94558adba178ee8c276852bc330" name="NetworkManager" arch="s390x">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="bf5f91906c807afa7dba30b0c42ca590e5bc112a04054238e3c188b47ceef55a" name="NetworkManager" arch="src">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="58a244f355b892cfaae060bbcb95748e80469ec0c82f7aabc142fb0a47535cf6" name="NetworkManager" arch="x86_64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="b24e48ba95bc28c01ef6bc277a897e6411d724de0d647c76c6912ff9781a5052" name="NetworkManager-bluetooth" arch="aarch64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="1f91aa4cb262e178770def0a546ff9bdb4dbea557c1cc8a287b02cc003dbaf83" name="NetworkManager-bluetooth" arch="ppc64le">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="1678c151c7ff858bd58f1bf8861d3ba2d0941272e3ad356d14db11accac679d2" name="NetworkManager-bluetooth" arch="s390x">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="f676c6315a934f5da997599a4ebe8a7065c83f5c05885ffccc39656ca3a83a6d" name="NetworkManager-bluetooth" arch="x86_64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="a325f57058452704a35e7b0d57fcfad332c31d689502c83c972a83ca19ef1ad3" name="NetworkManager-branding-upstream" arch="noarch">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="cb6dd12beeb93e8ced46ca422890b01d85b1f87e16d7a5d56e6e5d5c9291039a" name="NetworkManager-cloud-setup" arch="aarch64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="78c3b649afaf92f8d263a3fd8e7e7da86140bf1c4fe6ca12ad5fd21cb4545585" name="NetworkManager-cloud-setup" arch="ppc64le">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="e35fe7059fc7b50925656e31deeeb9a1492958d09e16d0420eac6bebe6401a1c" name="NetworkManager-cloud-setup" arch="s390x">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="e61672434148e4e2660e8d8d38281abdd1ed782fcdede0cae32603d6e50ba2e9" name="NetworkManager-cloud-setup" arch="x86_64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="bc1bf0439cb48956be8fab55b4d84c491b4badeb7d3d0e19c35d3559b54657ab" name="NetworkManager-devel" arch="aarch64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="cc00818ff7b976130280080242b6fea205647599e2bf8de04595ffb213445318" name="NetworkManager-devel" arch="ppc64le">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="2c6efe42e2406658b61e4c7de8056b481038e7be9ba0652468be363b45ae2c31" name="NetworkManager-devel" arch="s390x">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="5cca66d1b05df05f577921362ab27b4375ab5bfb578d690d29e5ab11f704b06f" name="NetworkManager-devel" arch="x86_64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="f5940436f1957588697ecd379699ce97fc9d4af4a6c1d957d91ed21ed6fa8ad0" name="NetworkManager-devel-32bit" arch="x86_64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="8a3d957a31e706c127555a87df96e9282e44d05e71ef5680dc865d63051e2c4f" name="NetworkManager-lang" arch="noarch">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="ff1d43362f378c4f004e2ab95467f1d75f9d5ad2bfb31b40e5d90063b7aec4a7" name="NetworkManager-ovs" arch="aarch64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="8fd7d835c2715415175b95b97f21f2d0754c4cc24a9fca2827c99f5544f8c696" name="NetworkManager-ovs" arch="ppc64le">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="fbb855f3518d417848b2d6f38fad73d60eb490200b5ef85d47bc488da4c5c87a" name="NetworkManager-ovs" arch="s390x">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="e6bff24ee0db2972f964a0c298ff61a648e85aaaac5990ecddd2d5191d90f934" name="NetworkManager-ovs" arch="x86_64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="f24728c555a281cc7a7421318bcf6dbb42a2916b71476b0a2b45f4a06605a172" name="NetworkManager-pppoe" arch="aarch64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="91bcb0303ddf11142484dc2850649abee269ddfecf8c3899ec8fe4d8771f8943" name="NetworkManager-pppoe" arch="ppc64le">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="58315657c14e29ae92d3b7b7eec86b65fdd11e3732355df3918a38ffcf4b62a3" name="NetworkManager-pppoe" arch="s390x">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="8364de7a3caa1d44c5b13606186e275203fbad492dd31a0ed7d71e6ad6680bf5" name="NetworkManager-pppoe" arch="x86_64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="e75e4271d1798bbbce4307c9ee38d5c5a226885b99c53403b30b82eb2914cb0b" name="NetworkManager-tui" arch="aarch64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="e6362dfbec2ac0748f5b9822a8d70cd9a5600e82238046f875842eafb93bfab3" name="NetworkManager-tui" arch="ppc64le">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="633701cf772a73d24f48c4f89bc72cfd9ba7ba64b36250f15883cefa96d9db48" name="NetworkManager-tui" arch="s390x">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="8e7a35a106a9202ee7e4b7f592ea4d809edaad86f8d55a5888533a95d17af503" name="NetworkManager-tui" arch="x86_64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="36df225b0b4ba5efd6efa1a66c5a4b80873888d25519de154d02bc13315a8088" name="NetworkManager-wwan" arch="aarch64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="dc38789a135fd180d418a256f779ae329a2334e92ea8eaf9dc385d4d0130a92d" name="NetworkManager-wwan" arch="ppc64le">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="1cf37e03d27bfcc2eb0c7df0164045ba9d90d5ebe53a00d4fe289bbcdd965e04" name="NetworkManager-wwan" arch="s390x">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="ac7bf279a3264b6c47adbaa5a02599eaab5d355739f0d3912be91e027beb1593" name="NetworkManager-wwan" arch="x86_64">
  <version epoch="0" ver="1.44.2" rel="150600.3.2.1"/>
  <changelog author="cfamullaconrad@suse.com" date="1667822400">- Keep netconfig support. The rc-manager auto detection will select
  appropriate manager during runtime.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1669982400">- Update to version 1.40.6:
  + team:
  - Also set empty port configuration so teamd knows about the
    port.
  - Restore port configuration after teamd respawn.
- Changes from version 1.40.4:
  + dhcp: revert restarting DHCP when MAC address changes, for
    example during a bond fail over.
  + Various documentation fixes.
  + Fix non-exported ABI in libnm which was wrongly present in the
    header files but unusable so far.
  + ifcfg-rh: fix writing ethtool pause settings to file.
  + core: set "proto static" for manual routing rules configured by
    NetworkManager.
  + Various minor bugfixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1671537600">- Drop iptables BuildRequires and -Diptables meson parameter:
  iptables is legacy (obsoleted in favor of nft). Additionally.
  meson has proper fallback detection to assume the correct path,
  should it need to use iptables.
- Recommend nftables instead of iptables.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1671537601">- Update to version 1.40.8:
  + Fixed a bug that caused devices (MACsec in particular) to be
    stuck in UNAVAILABLE state and not transition to DISCONNECTED
    if the carrier was ready too early.
  + Improved interoperability of MACsec with some Aruba switches by
    allowing CKN shorter than 64 characters.
  + Fixed an assertion failure when restarting NetworkManager with
    MACsec links configured.
  + Fixed a possible DHCP helper crash when handling failure to
    connect to D-Bus.
  + Corrected calculation of expiration time for items configured
    from IPv6 neighbor discovery messages.
  + Various fixes for platforms that don't allow unaligned memory
    access.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1673438400">- Update to version 1.40.10:
  + Fix the evaluation of the autoconnect retries.
  + nm-cloud-setup now preserves addresses added externally.
  + Ensure that dnsmasq is stopped after changing the dns backend
    and restarting the service.
  + Fix honoring an explicit DHCPv6 DUID with dhclient.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1674820800">- Update to version 1.40.12:
  + Make sure "external-ids" stays up to date in Open vSwitch
    database on a connection reapply.
  + Retry if a netlink sockets runs out of buffer space before
    we're able to read results of a link change.
  + Fix a possible race involving concurrent invocation of iptables
    in IPv4 shared mode.
  + Other various fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676030400">- Update to version 1.42.0:
  + Added support for source load balancing for Ethernet Bonds.
  + Allow specifying vhost name (SNI) for a manually DNS-over-TLS
    server. Only works with systemd-resolved plugin.
  + Connections can now be activated on a loopback interface.
  + Added support of IPv4 ECMP routes. The ECMP routes will get
    merged.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1676289600">- Pass session_tracking=systemd and
  session_tracking_consolekit=false to meson, no longer build
  support for consolekit as session tracker.</changelog>
  <changelog author="dimstar@opensuse.org" date="1676894400">- Add 1539.patch: Fix constructing the IPv4 nameserver variable
  (boo#1208371).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1677153600">- Update to version 1.42.2:
  + Add build option to set the mobile-broadband-provider-info
    database path.
  + Add new "ipv[46].replace-local-rule" setting to control whether
    to remove the local route rule that is automatically generated.
  + Add the DHCPv6 IAID to the lease information exposed in /run
    and on D-Bus.
  + Fix assuming team connections at boot.
  + Fix race condition when setting the MAC address of an OVS
    interface.
  + Fix constructing the IPv4 name servers variable passed to
    dispatcher scripts.
  + Don't use tentative IPv6 address to resolve the system hostname
    via DNS.
  + Deprecate the "Master" property of the NMActiveConnection D-Bus
    object in favor of the new "Controller" property.
- Drop 1539.patch: Fixed upstream.
- Refresh patch with quilt:
  + 0001-Coerce-connectivity-LIMITED-to-NONE-when-device-is-d.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678104000">- Changes from version 1.38.6 (bsc#1208631):
  + Fix honoring DNS priority.
  + Decline DHCPv6 lease when DAD fails.
  + Various bugfixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678363200">- Update to version 1.42.4:
  + Fix a possible crash when [global-dns] is used and improve the
    documentation.
  + Documentation improvements.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681992000">- Update to version 1.42.6:
  + Emit the dhcp-change dispatcher event also after a lease
    renewal.
  + Fix assertion failure on DHCP renewal.
  + Add support for EC2 IMDSv2 in nm-cloud-setup.
  + Allow setting tunnel flags for ip6gre &amp; ip6gretap connection
    profiles.
  + Improve the Wi-Fi hotspot functionality.
  + Fix setting the Wi-Fi roaming policy based on the number of
    seen BSSIDs.
  + Support the "no-aaaa" resolv.conf option.
  + Some oFono fixes.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1683979200">- Add nm-runstatedir.patch: to correct rundir from /var/run to /run
  for systemd FHS compatibility</changelog>
  <changelog author="luc14n0@opensuse.org" date="1685534400">- Update https://www.gnome.org/projects/NetworkManager/ URL tag to
  NM's newest home page: https://networkmanager.dev/, and main
  package summary to: standard Linux network configuration tool
  suite.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1688040000">- Update to version 1.42.8:
  + Add support for ppp 2.5.0.
  + Fix nft rules for balance-slb bonding.
  + Support port priority for bonding.
  + Fix regression handling the PKEY_ID for infiniband profiles in
    ifcfg-rh format.
  + Fix race in nm-cloud-setup that caused partial configuration
    and loss of connectivity with multiple interfaces.
  + Don't touch "net.ipv6.conf.$IFACE.forwarding" unless explicitly
    required for IPv6 sharing.
  + Various bugfixes related to team, Wi-Fi P2P, IPv6LL.
  + Automatically unblock autoconnect of profiles during reapply.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1691582400">- Update to version 1.44.0:
  + Introduce a new "link" setting that holds properties related to
    the kernel link such as "tx-queue-length", "gso-max-size",
    "gso-max-segments", "gro-max-size".
  + Support sending a DHCPv6 prefix delegation hint via the
    "ipv6.dhcp-pd-hint" connection property.
  + Support new bond options: "arp_missed_max", "lacp_active",
    "ns_ip6_target".
  + Add new "initial-eps-bearer-configure" and
    "initial-eps-bearer-apn" properties in the GSM setting.
  + Setting "connection.stable-id=default${CONNECTION}" changed
    behavior to be identical to the built-in default value when the
    stable-id is not set.
  + Add a "[keyfile].rename" option to NetworkManager.conf to force
    renaming profiles on disk when their name changes.
  + The ifcfg-rh plugin is deprecated; it will only receive
    bugfixes and no new features. A warning is emitted the log when
    a connection in ifcfg-rh format is found.
  + To automatically migrate existing ifcfg-rh connections to the
    keyfile format, a new configuration option
    "main.migrate-ifcfg-rh" is provided. Migration is disabled by
    default, but the default value can be changed at build time via
    "--with-config-migrate-ifcfg-rh-default=yes".
  + When configuring hostnames in non-public TLD (like
    "example.local"), use the TLD as default search domain instead
    of the full hostname.
  + Always apply DNS options from the [global-dns] configuration
    section
  + The NetworkManager daemon now acquires the D-Bus name only
    after populating the D-Bus tree. This can add a delay during
    startup but it is required to avoid race conditions with other
    services depending on NM.
  + Add a "version-id" argument to the Update2() D-Bus call to
    guard against concurrent modifications of profiles.
  + Don't use tentative IPv6 addresses to resolve the system
    hostname via DNS.
  + Track the number of autoconnect retries left for each device
    and connection. Previously it was tracked only per connection
    and this lead to unexpected behaviors in case of multiconnect
    profiles.
  + Set VLAN filtering options on bridge via netlink instead of
    sysfs.
  + nm-cloud-setup now supports IMDSv2 on Amazon EC2.
  + nmtui now allows to enable or disable Wi-Fi and WWAN radios.
  + Honor ignore-carrier=no for bond/bridge/team devices.
  + Add version mismatch warning when running nmcli commands.
- Rebase patches with quilt.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1696334400">- Update to version 1.44.2:
  + Better log IPv4 Address Conflict Detection (ACD) conflicts
  + Remove the upper limit of 65535 for PIDs read from the PID file
  + Allow missing default gateway with oFono
  + Honor the CLICOLOR_FORCE environment variable
  + Fix generating connection with IPv6 method disabled vs ignored
  + Fix possible segmentation fault when doing a checkpoint
    rollback
  + Documentation improvements
- Switch to source services, use explicit released tag.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Use %patch -p N instead of deprecated %patchN.</changelog>
  <changelog author="yfjiang@suse.com" date="1701604800">- Add python3.6-in-sle.patch: SLE still takes python 3.6 as primary
  system, the patch allows meson to find python 3.6 in SLE.</changelog>
</package>
<package pkgid="edf10d74afe9a5808353fcd4a700aca72b8fc9574991766c0942c47c7ec872d7" name="PackageKit" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="242a35e782f1c2cf52764cc47c40b35ff9027386edcb75a993cacdd18ea88e05" name="PackageKit" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="61e8cb31f92e27f52e2a8514eb18ef46f997632c80a862a6d3800d57758f22ff" name="PackageKit" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="91558d9c65dabb869a2290172333fd457dd4ba782830cf3f79442c763bcc3ed2" name="PackageKit" arch="src">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="7cda6daa85e46ec139dd7abe310c6cd157c3d29c8adee4600d6a0bd827937935" name="PackageKit" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="1f78ebaf8a198e9411b1a97dd2feb26b676fd122b639cb8126478d4c8993c290" name="PackageKit" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="5f04ee7ce71cd6fe18985f865b8086a1f5798a1c9d8d0f70eb0d45d2a5103478" name="PackageKit" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="b00e5fd218d9b1a50ef946b9afa129824a92f2e11e3ded338925674b4db2f845" name="PackageKit" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="81ae56efda9a56a1828b2459d67dfd5149d98a2f863cb355eeb5f490b1d7e9c7" name="PackageKit" arch="src">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="87b57be163e5f870c5289d08368ac974065e36cdbb38ac31432b60423145a77b" name="PackageKit" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="f8d88ef5fb7c3013da12afe46633b72f0f023a13978fec668fb303c95947e9c6" name="PackageKit-backend-dnf" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="3f7c48731c1e413d112f0f414915fa8ce493414a9b534804c1e805498290d73b" name="PackageKit-backend-dnf" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="e6eb0b2a2a65c7226a5995857f43f45a4d555f4f65f11f408392b620228eb34b" name="PackageKit-backend-dnf" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="34ebac62adc360720ff2a82031a8d24ce7bde64091a30ca8f52c0ce578be5f54" name="PackageKit-backend-dnf" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="15e562ac20e61bab022fa6780f28dd560ddcbbf903af74641df835d57cbea684" name="PackageKit-backend-dnf" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="71bba0f18aece203106bbed861f5b6e307207aceb7f42554980f319872f76581" name="PackageKit-backend-dnf" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="dcd2eec48560422ca7f49b0700368e88e9ab5e557c98ed0d051778017633d647" name="PackageKit-backend-dnf" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="d64ea88b0e84cd5a3303b7a96b0ef86f90e60995d958d9ec84f70928050cb2d5" name="PackageKit-backend-dnf" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="3d96880e305524eab23bf121b65744b2eed11202febddc85482248b831e1ae71" name="PackageKit-backend-zypp" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="7874859d99e0824523e8d58e55574183b924c058591ca584490c2baeb01cc893" name="PackageKit-backend-zypp" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="60456ba93f333cd868a72e31ca65a9ffbc389495bcdf25c7186ad47e08cf2ffd" name="PackageKit-backend-zypp" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="0eae9ae8b0453de6f76d626325938f43da051b58ff236c6570f00f7b8c3fe726" name="PackageKit-backend-zypp" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="24515b0b432820dfd45823de76e46adc3ab8d9897040658ef1a593aece695dcb" name="PackageKit-backend-zypp" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="ae5c1a696ba543f154398177b802e1c94f2e1ee36a17378a380ecd8cbde0b2e7" name="PackageKit-backend-zypp" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="ab8cebb75d5962420dc39eb7f6fa0dee1892b65c192cdcbc15499404e7222c65" name="PackageKit-backend-zypp" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="a99c93738ae033cc52db30662fc190e3b516907a848ee0fb2af25195fa29e00e" name="PackageKit-backend-zypp" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="ec3e8fc5819afec02382e909ab97af5f842ed23d4acff634c2dbe3d6e82b4b87" name="PackageKit-branding-SLE" arch="noarch">
  <version epoch="0" ver="12.0" rel="150600.22.2.4"/>
  <changelog author="coolo@suse.com" date="1358164800">- Update PackageKit-branding-vendor.patch: Disable ScanDesktop
  plugin, it takes forever at least on first startup:
  - ScanDesktopFiles=false</changelog>
  <changelog author="dimstar@opensuse.org" date="1358337600">- Rebase PackageKit-branding-default-config.patch against
  PackageKit 0.8.7.</changelog>
  <changelog author="dimstar@opensuse.org" date="1362398400">- Disable WritePreparedUpdates: we do currently not support offline
  updates.</changelog>
  <changelog author="zaitor@opensuse.org" date="1378728000">- Bump version to 13.1 for next version of openSUSE.</changelog>
  <changelog author="dimstar@opensuse.org" date="1380888000">- Do not package %{_sysconfdir}/PackageKit/CommandNotFound.conf, as
  it unbranded and CNF is currently disabled in PackageKit.</changelog>
  <changelog author="dimstar@opensuse.org" date="1387800000">- Rebase PackageKit-branding-vendor.patch and
  PackageKit-branding-default-config.patch for PackageKit 0.8.14.</changelog>
  <changelog author="sreeves@suse.com" date="1402056000">- Rename to PackageKit-branding-SLE. bnc#881472</changelog>
  <changelog author="fcrozat@suse.com" date="1404475200">- Update PackageKit-branding-vendor.patch to disable codec redirect
  webpage for now (FATE#316921)</changelog>
  <changelog author="dimstar@opensuse.org" date="1413892800">- Rebase PackageKit-branding-default-config.patch for
  PackageKit 1.0.1.</changelog>
  <changelog author="yfjiang@suse.com" date="1705492800">- Rebase PackageKit-branding-vendor.patch for PacakgeKit 1.2.8.</changelog>
</package>
<package pkgid="b049d40bba76bf87f04e17a3a47ec44e52d191c5266812bfc5802ddeb75154cb" name="PackageKit-branding-SLE" arch="src">
  <version epoch="0" ver="12.0" rel="150600.22.2.4"/>
  <changelog author="ro@suse.de" date="1273752000">- rename changes template to changes.in again</changelog>
  <changelog author="vuntz@opensuse.org" date="1286366400">- Update so that we can ignore some files from /etc/PackageKit that
  should not get branded, like /etc/PackageKit/events. This fixes
  the build.</changelog>
  <changelog author="vuntz@opensuse.org" date="1286539200">- Bump version to 11.4.</changelog>
  <changelog author="vuntz@opensuse.org" date="1298030400">- Add PackageKit-branding-ZYpp.conf that gets installed as
  /etc/PackageKit/ZYpp.conf: this can be used to change the
  PackgeKit behavior when handling updates.</changelog>
  <changelog author="vuntz@opensuse.org" date="1304683200">- Package %{_sysconfdir}/PackageKit/CommandNotFound.conf again, as
  we build the command-not-found PackageKit utility again.</changelog>
  <changelog author="vuntz@opensuse.org" date="1309953600">- Bump version to 12.1.
- Add a Requires for PackageKit, since the branding package is
  useless without it.
- Update summary and description.
- Add Url tag.</changelog>
  <changelog author="vuntz@opensuse.org" date="1318507200">- Remove %{release} from the PackageKit versioned Requires, to not
  have to rebuild this package each time PackageKit rebuilds to
  keep it installable.</changelog>
  <changelog author="vuntz@opensuse.org" date="1331726400">- Rebase PackageKit-branding-vendor.patch.</changelog>
  <changelog author="vuntz@opensuse.org" date="1337774400">- Bump version to 12.2, to prepare for next version of openSUSE.</changelog>
  <changelog author="aj@suse.de" date="1357732800">- Bump version to 12.3 for next version of openSUSE</changelog>
  <changelog author="coolo@suse.com" date="1358164800">- Update PackageKit-branding-vendor.patch: Disable ScanDesktop
  plugin, it takes forever at least on first startup:
  - ScanDesktopFiles=false</changelog>
  <changelog author="dimstar@opensuse.org" date="1358337600">- Rebase PackageKit-branding-default-config.patch against
  PackageKit 0.8.7.</changelog>
  <changelog author="dimstar@opensuse.org" date="1362398400">- Disable WritePreparedUpdates: we do currently not support offline
  updates.</changelog>
  <changelog author="zaitor@opensuse.org" date="1378728000">- Bump version to 13.1 for next version of openSUSE.</changelog>
  <changelog author="dimstar@opensuse.org" date="1380888000">- Do not package %{_sysconfdir}/PackageKit/CommandNotFound.conf, as
  it unbranded and CNF is currently disabled in PackageKit.</changelog>
  <changelog author="dimstar@opensuse.org" date="1387800000">- Rebase PackageKit-branding-vendor.patch and
  PackageKit-branding-default-config.patch for PackageKit 0.8.14.</changelog>
  <changelog author="sreeves@suse.com" date="1402056000">- Rename to PackageKit-branding-SLE. bnc#881472</changelog>
  <changelog author="fcrozat@suse.com" date="1404475200">- Update PackageKit-branding-vendor.patch to disable codec redirect
  webpage for now (FATE#316921)</changelog>
  <changelog author="dimstar@opensuse.org" date="1413892800">- Rebase PackageKit-branding-default-config.patch for
  PackageKit 1.0.1.</changelog>
  <changelog author="yfjiang@suse.com" date="1705492800">- Rebase PackageKit-branding-vendor.patch for PacakgeKit 1.2.8.</changelog>
</package>
<package pkgid="16c3eb6b431960e0a8d6359c2c716bc6f3e8c6010653d9ccc1d1cc9f77f0061f" name="PackageKit-branding-SLE" arch="noarch">
  <version epoch="0" ver="12.0" rel="150600.22.5.2"/>
  <changelog author="coolo@suse.com" date="1358164800">- Update PackageKit-branding-vendor.patch: Disable ScanDesktop
  plugin, it takes forever at least on first startup:
  - ScanDesktopFiles=false</changelog>
  <changelog author="dimstar@opensuse.org" date="1358337600">- Rebase PackageKit-branding-default-config.patch against
  PackageKit 0.8.7.</changelog>
  <changelog author="dimstar@opensuse.org" date="1362398400">- Disable WritePreparedUpdates: we do currently not support offline
  updates.</changelog>
  <changelog author="zaitor@opensuse.org" date="1378728000">- Bump version to 13.1 for next version of openSUSE.</changelog>
  <changelog author="dimstar@opensuse.org" date="1380888000">- Do not package %{_sysconfdir}/PackageKit/CommandNotFound.conf, as
  it unbranded and CNF is currently disabled in PackageKit.</changelog>
  <changelog author="dimstar@opensuse.org" date="1387800000">- Rebase PackageKit-branding-vendor.patch and
  PackageKit-branding-default-config.patch for PackageKit 0.8.14.</changelog>
  <changelog author="sreeves@suse.com" date="1402056000">- Rename to PackageKit-branding-SLE. bnc#881472</changelog>
  <changelog author="fcrozat@suse.com" date="1404475200">- Update PackageKit-branding-vendor.patch to disable codec redirect
  webpage for now (FATE#316921)</changelog>
  <changelog author="dimstar@opensuse.org" date="1413892800">- Rebase PackageKit-branding-default-config.patch for
  PackageKit 1.0.1.</changelog>
  <changelog author="yfjiang@suse.com" date="1705492800">- Rebase PackageKit-branding-vendor.patch for PacakgeKit 1.2.8.</changelog>
</package>
<package pkgid="259c40ef5ee577fb650093051bdbfdec63f635c63826f02fee8c25e091deff1b" name="PackageKit-branding-SLE" arch="src">
  <version epoch="0" ver="12.0" rel="150600.22.5.2"/>
  <changelog author="ro@suse.de" date="1273752000">- rename changes template to changes.in again</changelog>
  <changelog author="vuntz@opensuse.org" date="1286366400">- Update so that we can ignore some files from /etc/PackageKit that
  should not get branded, like /etc/PackageKit/events. This fixes
  the build.</changelog>
  <changelog author="vuntz@opensuse.org" date="1286539200">- Bump version to 11.4.</changelog>
  <changelog author="vuntz@opensuse.org" date="1298030400">- Add PackageKit-branding-ZYpp.conf that gets installed as
  /etc/PackageKit/ZYpp.conf: this can be used to change the
  PackgeKit behavior when handling updates.</changelog>
  <changelog author="vuntz@opensuse.org" date="1304683200">- Package %{_sysconfdir}/PackageKit/CommandNotFound.conf again, as
  we build the command-not-found PackageKit utility again.</changelog>
  <changelog author="vuntz@opensuse.org" date="1309953600">- Bump version to 12.1.
- Add a Requires for PackageKit, since the branding package is
  useless without it.
- Update summary and description.
- Add Url tag.</changelog>
  <changelog author="vuntz@opensuse.org" date="1318507200">- Remove %{release} from the PackageKit versioned Requires, to not
  have to rebuild this package each time PackageKit rebuilds to
  keep it installable.</changelog>
  <changelog author="vuntz@opensuse.org" date="1331726400">- Rebase PackageKit-branding-vendor.patch.</changelog>
  <changelog author="vuntz@opensuse.org" date="1337774400">- Bump version to 12.2, to prepare for next version of openSUSE.</changelog>
  <changelog author="aj@suse.de" date="1357732800">- Bump version to 12.3 for next version of openSUSE</changelog>
  <changelog author="coolo@suse.com" date="1358164800">- Update PackageKit-branding-vendor.patch: Disable ScanDesktop
  plugin, it takes forever at least on first startup:
  - ScanDesktopFiles=false</changelog>
  <changelog author="dimstar@opensuse.org" date="1358337600">- Rebase PackageKit-branding-default-config.patch against
  PackageKit 0.8.7.</changelog>
  <changelog author="dimstar@opensuse.org" date="1362398400">- Disable WritePreparedUpdates: we do currently not support offline
  updates.</changelog>
  <changelog author="zaitor@opensuse.org" date="1378728000">- Bump version to 13.1 for next version of openSUSE.</changelog>
  <changelog author="dimstar@opensuse.org" date="1380888000">- Do not package %{_sysconfdir}/PackageKit/CommandNotFound.conf, as
  it unbranded and CNF is currently disabled in PackageKit.</changelog>
  <changelog author="dimstar@opensuse.org" date="1387800000">- Rebase PackageKit-branding-vendor.patch and
  PackageKit-branding-default-config.patch for PackageKit 0.8.14.</changelog>
  <changelog author="sreeves@suse.com" date="1402056000">- Rename to PackageKit-branding-SLE. bnc#881472</changelog>
  <changelog author="fcrozat@suse.com" date="1404475200">- Update PackageKit-branding-vendor.patch to disable codec redirect
  webpage for now (FATE#316921)</changelog>
  <changelog author="dimstar@opensuse.org" date="1413892800">- Rebase PackageKit-branding-default-config.patch for
  PackageKit 1.0.1.</changelog>
  <changelog author="yfjiang@suse.com" date="1705492800">- Rebase PackageKit-branding-vendor.patch for PacakgeKit 1.2.8.</changelog>
</package>
<package pkgid="d15beecd3c85e770feaacd93ce2174b210c61b08fca99f790ad457d7cea407ae" name="PackageKit-branding-upstream" arch="noarch">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="99bf72a04ac2ebda4fa950a20fe8ebae46367a0d31752c4a5b338b0fc95d1bee" name="PackageKit-branding-upstream" arch="noarch">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="93aa5ac1a52e19f24b3ba71b58dd8943c504ca19d5ef5aa447745ee753be5c53" name="PackageKit-devel" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="9654f62636b4f189a23539fa922b4f94e96613d002a9f3b5eda6b41f02555cd0" name="PackageKit-devel" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="c6afa8b6351ea9eaff326e083930d36d37657d4b7482ebfbb45199cc1f5b0631" name="PackageKit-devel" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="2630835d315a24e76c261b2e933bd81b39ed676f891ab12da31c4e4bdfc6494c" name="PackageKit-devel" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="30c09b77e649df871986dbb8cda014b91a0aa46cb93121d90decf8c053a6ec70" name="PackageKit-devel" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="ee2ac00c6ac376d18558d61ee8baf32de7953904ab01325bcd5e41492da848d0" name="PackageKit-devel" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="8f188c7006017d5d08944969185c1e9d2731abe371e4b5d1506d51f658149d89" name="PackageKit-devel" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="b11f1812406af7c636aceab50ad399fa2003db5d395f344bf352d0ceffe78439" name="PackageKit-devel" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="2f6af57ea5d35fc77a8a464678c07f39792a9787851015f0991b660f1ec94470" name="PackageKit-gstreamer-plugin" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="5da541313a499bcacb0fff0b1888376202ba62a5c9618139c02afa4cd2c0a7df" name="PackageKit-gstreamer-plugin" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="010f248eb2b5112b310ad89c198831786c67bec91338b9531e05797e6c931b0d" name="PackageKit-gstreamer-plugin" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="2a20315555e9d17e8f11a27fa89c9fbb34513a103ae1f89a475abbaac0e63714" name="PackageKit-gstreamer-plugin" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="05001c4042ac43d171c329eff6dc1ac0c9b6e89908b55c6c89f1962ae1ce848e" name="PackageKit-gstreamer-plugin" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="5282f9a5470b82897e7af581ea2597b513a16c6d1b1fe362c32f66cfb3cadec0" name="PackageKit-gstreamer-plugin" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="d435ccab2f1751d83cef002c33d54ae7d87e1c97a919ffac27850ae132dd380d" name="PackageKit-gstreamer-plugin" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="5b3844387e2b684c5c8357e85e2b01b7de88a408e996725b92c458ede8f886e0" name="PackageKit-gstreamer-plugin" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="fe8e3d969931a3d3d0d9f503725b744aaaa2b8511b619ef156e56e67125c2330" name="PackageKit-gtk3-module" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="36bda4ed9a819db6fda4ee05843dd9a333f4730f356ba379086528c2cc9d305d" name="PackageKit-gtk3-module" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="89e2a3fbb620953cc14ca8db100589940d17c8e4893adb8b1d9a5bc7791c91cb" name="PackageKit-gtk3-module" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="8da17828bd0a5c20a2e444685305afe476d727fe8201bb115097144854d36164" name="PackageKit-gtk3-module" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="3d2a67b2d0c5b464a33967496287982b4720dd3ceba6c24dde6dbedfd0336867" name="PackageKit-gtk3-module" arch="aarch64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="f6c7f3fab73e092d33d910e70a2ccd32bc3b80f56838639573d40cf27fc7da24" name="PackageKit-gtk3-module" arch="ppc64le">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="28ae7a1fa72acabec603188a5ebe18540dd6ffbad63d7c63dc3284607456bc14" name="PackageKit-gtk3-module" arch="s390x">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="c6abb5b586a234de2fcaa26e04421d68df840923955ca5fd09ebfa8d21158fd1" name="PackageKit-gtk3-module" arch="x86_64">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="b730553ee8bc61cb24b5a94f34233695f5ef0fc1aedd32fdf7caece6e4d2b0cf" name="PackageKit-lang" arch="noarch">
  <version epoch="0" ver="1.2.8" rel="150600.4.2.7"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="2bf77889cf9b27c0bb909373ab57e4982115da1297ada1eb42d0eb63640f9b2c" name="PackageKit-lang" arch="noarch">
  <version epoch="0" ver="1.2.8" rel="150600.4.5.2"/>
  <changelog author="dfaggioli@suse.com" date="1623326400">- Add PackageKit-dnf-ignore-weak-deps.patch
  Backport upstream patch (gh#Conan-Kudo/PackageKit/commit#ecd4a96,
  gh#Conan-Kudo/PackageKit#488) for fixing: dnf backend not honoring
  "install_weak_deps=False" (gh#dfaggioli/Packagekit#486). See also
  https://bugzilla.redhat.com/show_bug.cgi?id=1955484</changelog>
  <changelog author="yfjiang@suse.com" date="1627560000">- Drop upstream merged patches on SLE and Leap 15.4:
  + PackageKit-CVE-2020-16121.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
  <changelog author="sbrabec@suse.com" date="1631793600">- Remove obsolete translation-update-upstream support
  (jsc#SLE-21105).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636113600">- Update to version 1.2.4:
  + Libraries:
  - Add specific error code when user declined interaction
  - Avoid spurious GObject::notify signal emissions
  - Correct 'cancellable' use in pk_client_repair_system_async()
  - Fix a leak on calling set_locale() a second time
  - Fix a possible use-after-free under pk_client_cancel_cb()
  - Improve thread safety on an operation cancellation
  + Backends:
  - dnf:
    . Read update information also when getting list of updates
    . Honor install_weak_deps=False if it is there
    . Use 'hy_query_get_advisory_pkgs', if available
  + New Features:
  - PkDetails: Add 'download-size' property
  - PkPackage: Add update severity property
  + Bugfixes:
  - Let the finish understand the 'cancelled' exit code
  - Make backends that use pk-backend-spawn work (#477)
  - Only set polkit interactive flag if method call has too
- Changes from version 1.2.3:
  + Backends:
  - alpm:
    . Add post transaction hook
    . Rename errno to alpm_err to avoid name clashes
  - aptcc: Auto-remove old kernels, unless configured otherwise
  - dnf: Add support for coercing upgrade to distupgrade
  - zypp:
    . Make sure pool is initialized at the beginning of some
    methods
    . Reset update mode after getting updates
  + Bugfixes:
  - Append to cron log instead of overwriting it
  - Cancel a transaction if calling Cancel fails or the daemon
    disappears
  - Do not crash when calling pk_dbus_get_uid() before D-Bus is
    setup
  - Fix all compiler warnings
  - Fix multilib conflicts in generated pk-enum-types.h
  - Free scheduler array correctly again
  - Remove large transaction size sanity check
- Drop patches fixed upstream:
  + PackageKit-zypp-cleanup-tmp-files.patch
  + PackageKit-zypp-reset-update-mode-after-get-updates.patch
  + PackageKit-dnf-Add-support-for-coercing-upgrade-to-distupgrade.patch
  + PackageKit-zypp-initialize-pool.patch
  + PackageKit-remove-transaction-size-limit.patch
  + PackageKit-cancel-transaction-if-daemon-disappears.patch
  + PackageKit-dnf-ignore-weak-deps.patch
- Add 505.patch: pk-offline: Add flags to D-Bus invoking methods.
  That's currently to be able to set whether the method should be
  interactive or not. The old functions call the methods as
  non-interactive.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1636113601">- Add PackageKit-zypp-c++17.patch: Fix build failure when building
  with libzypp &gt; 17.28.5 and gcc &lt; 11
  (gh#hughsie/PackageKit/commit/1a6bb6ae6, bsc#1192349).</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064000">- Rewrite prep phase to not use autopatch -M: SLE15/Leap15's RPM
  version does not support that syntax yet.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637064001">- Apply all patches unconditonally: PackageKit-zypp-c++17.patch is
  merged in upstream git and thus does not justify to be
  conditionally applied.
- Switching back to autosetup, as this works without conditional
  patches.</changelog>
  <changelog author="dimstar@opensuse.org" date="1653048000">- Update to version 1.2.5:
  + Backends:
  - dnf:
    . Add support for autoremove flag when removing packages.
    . Searches by name and package details should be case
    insensitive.
    . Update appstream xml files if dnf_sack_add_repos() does
    the download.
  - zypp:
    . Add -std=c++1z cpp flags.
    . Fix crash when search string is NULL.
    . Fix package installation using undefined data.
  - Changes to alpm, apttcc, nix, and slack.
  + Bugfixes:
  - Install offline-update enablement symlink if Meson is new
    enough.
  - Move Wants= line for network-online.target.
  - Add flags to D-Bus offline invoking methods.
  - Properly handle allow-reinstall flag for installations.
  - Provide better error message if trying to install an
    installed package.
  - Wait until online to activate systemd service.
- Drop 505.patch, PackageKit-zypp-c++17.patch, and
  PackageKit-zypp-fix-crash-with-empty-search-string.patch: fixed
  upstream.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1653566400">- Add PackageKit-zypp-locked-packages.patch: zypp: ignore locked
  packages(gh#hughsie/PackageKit#543, boo#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1656676800">- Add PackageKit-zypp-add-upgrade-system.patch: implement
  upgrade-system method(gh#hughsie/PackageKit/commit/930dd201b).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201347)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1659528000">- Modified PackageKit.spec: bump libzypp dependency version to
  17.31.0.
- Add PackageKit-zypp-avoid-statuReset.patch: zypp: Avoid
  statuReset() on locked packages
  (gh#PackageKit/PackageKit/commit/dd1964255, bsc#1199895).
- Add PackageKit-zypp-disable-upgrade-system-in-sle.patch: zypp:
  Disable upgrade-system support in SLE
  (gh#PackageKit/PackageKit/commit/0fcd820c2).
- Add PackageKit-zypp-restore-pool-status-after-simulating-update.patch:
  zypp: restore pool status after simulating an update
  (gh#PackageKit/PackageKit/commit/2b61a6649, bsc#1199895).
- Add PackageKit-zypp-fix-is-tumbleweed-check.patch: zypp: build
  the pool before calling is_tumbleweed()
  (gh#PackageKit/PackageKit/commit/146890153).
- Add PackageKit-zypp-update-libzypp-dependency-version.patch:
  zypp: update libzypp dependency version
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1662120000">- Add PackageKit-zypp-dont-refresh-before-searching.patch:
  zypp: Don't refresh repos before searching
  (gh#PackageKit/PackageKit/commit/58c7c0285, bsc#1199895).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1664193600">- Add PackageKit-zypp-dont-remove-locked-packages.patch: zypp:
  Check if packages are locked before removing
  (gh#PackageKit/PackageKit/commit/8649a07bc, bsc#1199895).
- Add PackageKit-zypp-add-repo-in-packageid.patch: zypp: add
  repository data in package id
  (gh#PackageKit/PackageKit/commit/8eb2ef0ae, bsc#1202585).
- Remove PackageKit-zypp-locked-packages.patch: reverted upstream
  (gh#PackageKit/PackageKit/commit/ed3e38043).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1673006400">- Add PackageKit-zypp-fix-ambiguous-filesystem-reference.patch:
  zypp: Fix ambiguous reference to 'filesystem' class
  (gh#PackageKit/PackageKit/commit/bb1409a71, bsc#1206687).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1678708800">- Add PackageKit-fix-pkcon-permission.patch: trivial: Drop
  unnecessary x permission
  (gh#PackageKit/PackageKit/commit/47b7f97bc, bsc#1209138)</changelog>
  <changelog author="dimstar@opensuse.org" date="1689595200">- Add PackageKit-dynamic-export.patch: fix loading of modules when
  built using glib 2.70 (boo#1213309).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699531200">- Update to version 1.2.8:
  + Libraries:
  - offline-updates:
    . Make package update list deduplication more efficient.
    . Add only one entry per package to 'offline-update-competed'
    file.
  - PkClient: Replace the GSimpleAsyncResult with the GTask API.
  - pk-client:
    . Fix use-before-set of PkProgress on cancellation.
    . Move cancellable disconnect to dispose.
    . Rework refcounting for PkClientState.
  + Backends: Changes to apt, dnf, PiSi and BSD backends.
- Changes from version 1.2.7:
  + New Features:
  - pkclient: Add an option to count download size with
    dependencies.
  - pk-transaction: Add support for getting the RemainingTime
    property.
  + Backends:
  - zypp: Fix ambiguous reference to 'filesystem' class.
  - Changes to dnf, apt, alpm backends.
- Changes from version 1.2.6:
  + New Features:
  - Expose transaction sender as read-only property on the bus.
  - pkmon: Display transaction sender binary name in log.
  - pk-transaction: Add Packages signal.
  - pk-transaction: Combine some D-Bus PropertiesChanged signal
    emissions.
  - pk-transaction: Add UpdateDetails signal.
  + Backends:
  - zypp:
    . implement upgrade-system method.
    . Clean up trailing whitespaces.
    . Avoid statuReset() on locked packages.
    . restore pool status after simulating an update.
    . Disable upgrade-system support in SLE.
    . build the pool before calling is_tumbleweed().
    . update libzypp dependency version.
    . Don't refresh repos before searching.
    . Check if packages are locked before removing.
    . add repository data in package id.
    . Remove trailing whitespace.
    + Changes to alpm, aptcc, apt, and nix backends.
- Rebase patches:
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
  + PackageKit-dynamic-export.patch
  + PackageKit-zypp-disable-upgrade-system-in-sle.patch
- Drop upstream fixed patches:
  + PackageKit-zypp-add-repo-in-packageid.patch
  + PackageKit-zypp-add-upgrade-system.patch
  + PackageKit-zypp-avoid-statuReset.patch
  + PackageKit-zypp-dont-refresh-before-searching.patch
  + PackageKit-zypp-dont-remove-locked-packages.patch
  + PackageKit-zypp-fix-ambiguous-filesystem-reference.patch
  + PackageKit-zypp-fix-is-tumbleweed-check.patch
  + PackageKit-zypp-restore-pool-status-after-simulating-update.patch
  + PackageKit-zypp-update-libzypp-dependency-version.patch</changelog>
  <changelog author="alynx.zhou@suse.com" date="1704196800">- Add PackageKit-find-python-3-6.patch: Specify the Python version
  we need to build this package.</changelog>
</package>
<package pkgid="cfde0143f2b5d71dc8a2aa000c2b43107e788a3d475406319517f31839a174c2" name="SAPHanaSR" arch="noarch">
  <version epoch="0" ver="0.162.4" rel="150000.4.44.1"/>
  <changelog author="imanyugin@suse.com" date="1499342400">- Fix bsc#1045606: update man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1508760000">- Fix bsc#1062267: SAPHanaSR wizard sets IPAddr2 agent's NIC to eth0</changelog>
  <changelog author="imanyugin@suse.com" date="1511179200">- FATE#323526: adjust HAWK2 Wizards to run on both Python 2 and 3</changelog>
  <changelog author="ro@suse.de" date="1517400000">- remove duplicate BuildArch line from specfile</changelog>
  <changelog author="imanyugin@suse.com" date="1526644800">- Version bump to 0.152.22
- Fix bsc#1091074:
    + Adjust Perl scripts to Perl 5.26.0
    + Remove show_SAPHanaSR_attributes
    + The user is advised to use SAPHanaSR-showAttr instead
- SAPHanaTopology: stricter match for system replication 'mode' in awk</changelog>
  <changelog author="abriel@suse.com" date="1567166400">- Version bump to 0.153.2
- rescore the master and fix some log string literals
- Fix bsc#1133866:
  Return $OCF_RUNNING_MASTER (8) instead of $OCF_SUCCESS (0) when
  probing a promoted node.
- If the SAP HANA CALL to 'landscapeHostConfiguration.py' is
  running into a timeout, do a retry of the command. If it still
  fails with a timeout, raise an error but do not set attributes
  to prevent unlogged failovers because of empty or unknown
  attributes.
  (bsc#1134106, bsc#1133024, bsc#1101373)
- Fix bsc#1082974:
  set attribute for remoteNode
- Fix bsc#1139715:
  Using crm-attributes written by a SAP HANA SR provider hook does
  improve the data integrity in special error conditions with
  multiple errors coming in a short time frame.
  Stabilized remote-site detection; SAPHana could now use a site
  specific SR cluster attribute which could be set by a SAP HA/DR
  provider call.
  Add a HA/DR provider hook script, config implementation and man
  page.
  Add parameter "HANA_CALL_TIMEOUT" to the RA configuration
  (SAPHanaTopology and SAPHanaSR) to set a timeout for HANA calls
  like landscapeHostConfiguration.py.
  Implemented "reload" method to allow changing parameters like
  "AUTOMATED_REGISTER"
  Set SWAIT during startup, but only if the attribute is already set
  Set PRIM after promote, but only if the attribute is already set
  The promote function has to set the return code according to the
  checks of the takeover result
  New tool SAPHanaSR-replay-archive, SAPHanaSR-filter and
  SAPHanaSR-showAttr to support SITE attributes</changelog>
  <changelog author="abriel@suse.com" date="1568203200">- fix typo in a condition statement (bnc#1149829)</changelog>
  <changelog author="abriel@suse.com" date="1573214400">- Version bump to 0.153.3
- The SAPHana resource agent must not down-score a SAP HANA
  Database site, if the landscape status is still 2, which means
  warning.
  Keep high scoring during recovery of the master name server.
  Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- change the shebang line of the HAWK2 templates to python3
  (bsc#1155423)</changelog>
  <changelog author="abriel@suse.com" date="1573819200">- Version bump to 0.154.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)</changelog>
  <changelog author="abriel@suse.com" date="1574337600">- restart sapstartsrv service on master nameserver node during
  monitor action, if needed. But NOT during probes.
  (bsc#1157453)</changelog>
  <changelog author="abriel@suse.com" date="1593691200">- Version bump to 0.154.1
- log empty site names, but do not generate bad formatted cluster
  attribute name
  (bsc#1173581)
- fix documentation of some parameter defaults
- adjust start/stop/promote/monitor action timeouts to match
  official recommendations</changelog>
  <changelog author="abriel@suse.com" date="1637668800">- Version bump to 0.155.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189530, bsc#1189531)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- change promotion scoring during maintenance procedure to prevent
  that both sides have an equal promotion scoring after refresh
  which might result in a critical promotion of the secondary.
  (bsc#1174557)
- update of man page SAPHanaSR.py.7 - correct the supported HANA
  version.
  (bsc#1182201)
- if the $hdbState command fails to retrieve the current state of
  the System Replication, the resource agent now uses the
  system_replication/actual_mode attribute (if available) from the
  global.ini file as a fallback.
  This should prevent some confusing and misleading log messages
  during a takeover and solves the problem of a not working
  takeover back (after a successful first takeover)
  (bsc#1181765)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)</changelog>
  <changelog author="abriel@suse.com" date="1654084800">- Version bump to 0.160.1
- fix HANA_CALL function to support MCOS environments again
  (bsc#1198780)
- fix SAPHanaSR-replay-archive to handle hb_report archives again
  (bsc#1198897)
- add HANA_CALL_TIMEOUT parameter back to the resource agents and
  read the setting from the cluster configuration, if available.
  Defaults to '60'.
  Related to github issue#36
- add new HA/DR provider hook susTkOver
  (jsc#SLE-16347)
- add new hook script for SAP HANA System Replication Scale-Up Cost
  Optimized Scenario.
  (jsc#SLE-18613)
- add a new instance parameter 'REMOVE_SAP_SOCKETS'.
  It is an optional parameter and defaults to 'true'. Now you can
  control, if the RA should remove the unix domain sockets related
  to sapstartsrv before (re-)start sapstartsrv or if it should try
  to adjust the permissions and ownership of these files instead.</changelog>
  <changelog author="abriel@suse.com" date="1661256000">- Version bump to 0.161.1_BF
- add the required 'xmllint' to the package
  (bsc#1201945)
- changes to the demote_clone function of the resource agent:
  if the role is '1:P' (topology agent run into timeouts) the
  function fail with rc=1, to get the managed resource stopped
  changes to the stop_clone function of the topology agent:
  call landscapeHostConfiguration.py and set the roles as they were
  reported. If the command timed out, set the role to '1:P' and
  return 1 to get the node fenced.
  The used timeout for the landscapeHostConfiguration.py call can
  be configured by the cluster action timeout, if needed. It will
  be 50% of the action timeout or the minimum of 300s.
  (bsc#1198127)
- add new HA/DR provider hook susChkSrv
  (jsc#PED-1241, jsc#PED-1240)
- add new tool SAPHanaSR-manageProvider to show, add and delete
  HA/DR provider sections in the global.ini of SAP HANA.
- update suse icon to new branding</changelog>
  <changelog author="varkoly@suse.com" date="1665057600">- SAPHanaSR-monitor not reporting correctly
  (bsc#1192963)
  add patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1669204800">- Version bump to 0.162.0
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * SAPHanaSRTools.pm: shows terminate node attribute too
- remove patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1674561600">- Version bump to 0.162.1
  * fix for SAPHanaTopology failing with error code 1
    (OCF_ERR_GENERIC) during a normal stop action
    (bsc#1207466)
  * set srhook attribute to PRIM during a probe so that we do not
    need to wait for the first srConnectionChanged() to set the
    attribute
    (bsc#1205535)</changelog>
  <changelog author="abriel@suse.com" date="1698926400">- Version bump to 0.162.2
  * inside SAPHanaSR-hookHelper use the full path for the cibadmin
    command to support non root users in special user environments
    (bsc#1216484)
  * if the SAPHanaSR.py hook has successfully reported a SR event
    to the cluster a still existing fall-back state file will be
    removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * update man pages:
    SAPHanaSR.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaTopology.7
    susCostOpt.py.7
    SAPHanaSR-monitor.8
    SAPHanaSR-showAttr.8
  * add improvements from SAP to the RA scripts, part II
    (jsc#PED-1739, jsc#PED-2608)</changelog>
  <changelog author="abriel@suse.com" date="1706529600">- Version bump to 0.162.3
  * Fix the hexdump log for empty node states
  * catch monitor calls for non-cloned resources and report them as
    unsupported instead of 'command not found'
    (bsc#1218333)
  * fix scope of variable 'site' to be global
    (bsc#1219194)
  * susChkSrv.py - relocate function logTimestamp()
  * update man pages:
    SAPHanaSR.7
    ocf_suse_SAPHana.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR.py.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 0.162.4
  * unify global.ini examples
  * add demo script SAPHanaSR-upgrade-to-angi-demo
  * update man pages:
    SAPHanaSR_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-manageProvider.8
    SAPHanaSR-upgrade-to-angi-demo.8
    SAPHanaSR.py.7</changelog>
</package>
<package pkgid="43eb6fb753bd1990cc1f97c4964928053e1fc1a527de5a44078e979f3f2e6071" name="SAPHanaSR" arch="src">
  <version epoch="0" ver="0.162.4" rel="150000.4.44.1"/>
  <changelog author="imanyugin@suse.com" date="1499342400">- Fix bsc#1045606: update man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1508760000">- Fix bsc#1062267: SAPHanaSR wizard sets IPAddr2 agent's NIC to eth0</changelog>
  <changelog author="imanyugin@suse.com" date="1511179200">- FATE#323526: adjust HAWK2 Wizards to run on both Python 2 and 3</changelog>
  <changelog author="ro@suse.de" date="1517400000">- remove duplicate BuildArch line from specfile</changelog>
  <changelog author="imanyugin@suse.com" date="1526644800">- Version bump to 0.152.22
- Fix bsc#1091074:
    + Adjust Perl scripts to Perl 5.26.0
    + Remove show_SAPHanaSR_attributes
    + The user is advised to use SAPHanaSR-showAttr instead
- SAPHanaTopology: stricter match for system replication 'mode' in awk</changelog>
  <changelog author="abriel@suse.com" date="1567166400">- Version bump to 0.153.2
- rescore the master and fix some log string literals
- Fix bsc#1133866:
  Return $OCF_RUNNING_MASTER (8) instead of $OCF_SUCCESS (0) when
  probing a promoted node.
- If the SAP HANA CALL to 'landscapeHostConfiguration.py' is
  running into a timeout, do a retry of the command. If it still
  fails with a timeout, raise an error but do not set attributes
  to prevent unlogged failovers because of empty or unknown
  attributes.
  (bsc#1134106, bsc#1133024, bsc#1101373)
- Fix bsc#1082974:
  set attribute for remoteNode
- Fix bsc#1139715:
  Using crm-attributes written by a SAP HANA SR provider hook does
  improve the data integrity in special error conditions with
  multiple errors coming in a short time frame.
  Stabilized remote-site detection; SAPHana could now use a site
  specific SR cluster attribute which could be set by a SAP HA/DR
  provider call.
  Add a HA/DR provider hook script, config implementation and man
  page.
  Add parameter "HANA_CALL_TIMEOUT" to the RA configuration
  (SAPHanaTopology and SAPHanaSR) to set a timeout for HANA calls
  like landscapeHostConfiguration.py.
  Implemented "reload" method to allow changing parameters like
  "AUTOMATED_REGISTER"
  Set SWAIT during startup, but only if the attribute is already set
  Set PRIM after promote, but only if the attribute is already set
  The promote function has to set the return code according to the
  checks of the takeover result
  New tool SAPHanaSR-replay-archive, SAPHanaSR-filter and
  SAPHanaSR-showAttr to support SITE attributes</changelog>
  <changelog author="abriel@suse.com" date="1568203200">- fix typo in a condition statement (bnc#1149829)</changelog>
  <changelog author="abriel@suse.com" date="1573214400">- Version bump to 0.153.3
- The SAPHana resource agent must not down-score a SAP HANA
  Database site, if the landscape status is still 2, which means
  warning.
  Keep high scoring during recovery of the master name server.
  Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- change the shebang line of the HAWK2 templates to python3
  (bsc#1155423)</changelog>
  <changelog author="abriel@suse.com" date="1573819200">- Version bump to 0.154.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)</changelog>
  <changelog author="abriel@suse.com" date="1574337600">- restart sapstartsrv service on master nameserver node during
  monitor action, if needed. But NOT during probes.
  (bsc#1157453)</changelog>
  <changelog author="abriel@suse.com" date="1593691200">- Version bump to 0.154.1
- log empty site names, but do not generate bad formatted cluster
  attribute name
  (bsc#1173581)
- fix documentation of some parameter defaults
- adjust start/stop/promote/monitor action timeouts to match
  official recommendations</changelog>
  <changelog author="abriel@suse.com" date="1637668800">- Version bump to 0.155.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189530, bsc#1189531)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- change promotion scoring during maintenance procedure to prevent
  that both sides have an equal promotion scoring after refresh
  which might result in a critical promotion of the secondary.
  (bsc#1174557)
- update of man page SAPHanaSR.py.7 - correct the supported HANA
  version.
  (bsc#1182201)
- if the $hdbState command fails to retrieve the current state of
  the System Replication, the resource agent now uses the
  system_replication/actual_mode attribute (if available) from the
  global.ini file as a fallback.
  This should prevent some confusing and misleading log messages
  during a takeover and solves the problem of a not working
  takeover back (after a successful first takeover)
  (bsc#1181765)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)</changelog>
  <changelog author="abriel@suse.com" date="1654084800">- Version bump to 0.160.1
- fix HANA_CALL function to support MCOS environments again
  (bsc#1198780)
- fix SAPHanaSR-replay-archive to handle hb_report archives again
  (bsc#1198897)
- add HANA_CALL_TIMEOUT parameter back to the resource agents and
  read the setting from the cluster configuration, if available.
  Defaults to '60'.
  Related to github issue#36
- add new HA/DR provider hook susTkOver
  (jsc#SLE-16347)
- add new hook script for SAP HANA System Replication Scale-Up Cost
  Optimized Scenario.
  (jsc#SLE-18613)
- add a new instance parameter 'REMOVE_SAP_SOCKETS'.
  It is an optional parameter and defaults to 'true'. Now you can
  control, if the RA should remove the unix domain sockets related
  to sapstartsrv before (re-)start sapstartsrv or if it should try
  to adjust the permissions and ownership of these files instead.</changelog>
  <changelog author="abriel@suse.com" date="1661256000">- Version bump to 0.161.1_BF
- add the required 'xmllint' to the package
  (bsc#1201945)
- changes to the demote_clone function of the resource agent:
  if the role is '1:P' (topology agent run into timeouts) the
  function fail with rc=1, to get the managed resource stopped
  changes to the stop_clone function of the topology agent:
  call landscapeHostConfiguration.py and set the roles as they were
  reported. If the command timed out, set the role to '1:P' and
  return 1 to get the node fenced.
  The used timeout for the landscapeHostConfiguration.py call can
  be configured by the cluster action timeout, if needed. It will
  be 50% of the action timeout or the minimum of 300s.
  (bsc#1198127)
- add new HA/DR provider hook susChkSrv
  (jsc#PED-1241, jsc#PED-1240)
- add new tool SAPHanaSR-manageProvider to show, add and delete
  HA/DR provider sections in the global.ini of SAP HANA.
- update suse icon to new branding</changelog>
  <changelog author="varkoly@suse.com" date="1665057600">- SAPHanaSR-monitor not reporting correctly
  (bsc#1192963)
  add patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1669204800">- Version bump to 0.162.0
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * SAPHanaSRTools.pm: shows terminate node attribute too
- remove patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1674561600">- Version bump to 0.162.1
  * fix for SAPHanaTopology failing with error code 1
    (OCF_ERR_GENERIC) during a normal stop action
    (bsc#1207466)
  * set srhook attribute to PRIM during a probe so that we do not
    need to wait for the first srConnectionChanged() to set the
    attribute
    (bsc#1205535)</changelog>
  <changelog author="abriel@suse.com" date="1698926400">- Version bump to 0.162.2
  * inside SAPHanaSR-hookHelper use the full path for the cibadmin
    command to support non root users in special user environments
    (bsc#1216484)
  * if the SAPHanaSR.py hook has successfully reported a SR event
    to the cluster a still existing fall-back state file will be
    removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * update man pages:
    SAPHanaSR.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaTopology.7
    susCostOpt.py.7
    SAPHanaSR-monitor.8
    SAPHanaSR-showAttr.8
  * add improvements from SAP to the RA scripts, part II
    (jsc#PED-1739, jsc#PED-2608)</changelog>
  <changelog author="abriel@suse.com" date="1706529600">- Version bump to 0.162.3
  * Fix the hexdump log for empty node states
  * catch monitor calls for non-cloned resources and report them as
    unsupported instead of 'command not found'
    (bsc#1218333)
  * fix scope of variable 'site' to be global
    (bsc#1219194)
  * susChkSrv.py - relocate function logTimestamp()
  * update man pages:
    SAPHanaSR.7
    ocf_suse_SAPHana.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR.py.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 0.162.4
  * unify global.ini examples
  * add demo script SAPHanaSR-upgrade-to-angi-demo
  * update man pages:
    SAPHanaSR_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-manageProvider.8
    SAPHanaSR-upgrade-to-angi-demo.8
    SAPHanaSR.py.7</changelog>
</package>
<package pkgid="ad0a395c14e26b54b0ccd9e372f7c00c24b9c7606a09ce483c27ab2d402eb83c" name="SAPHanaSR-ScaleOut" arch="noarch">
  <version epoch="0" ver="0.185.3" rel="150000.45.1"/>
  <changelog author="imanyugin@suse.com" date="1465819200">- Initial technical preview release. fate#318793</changelog>
  <changelog author="imanyugin@suse.com" date="1468497600">- Version 0.161.1
- Added a package conflict for SAPHanaSR, bsc#989162
- Restructure package and the .spec file</changelog>
  <changelog author="imanyugin@suse.com" date="1522756800">- Version 0.163.0
- Fix bsc#1045603: Update man pages
- Fix bsc#1045536: SAPHanaSR-ScaleOut missing update to use SLES python
- Fix bsc#1086545: minor typos in package description and man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1525780800">- Fix bsc#1092331: SAPHanaSR: SAPHanaSR-showAttr fails to open an archived cib file
- Fix bsc#1091988:SAPHanaSR-ScaleOut SAPHanaSR-monitor depends on package not existing in SLES
- SAPHanaSR-showAttr, SAPHanaSR-monitor moved to /usr/sbin to match the file layout in SAPHanaSR-ScaleUp</changelog>
  <changelog author="imanyugin@suse.com" date="1530014400">- Version 0.163.1</changelog>
  <changelog author="clanig@suse.de" date="1536753600">- Version 0.163.2
- Fix bsc#1098979: SAPHanaSR-ScaleOut SAPHanaTopology and
  SAPHanaController allowing virtual host names</changelog>
  <changelog author="abriel@suse.com" date="1573473600">- change version to 0.164.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)
- Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- clean up package, add checks, correct typos</changelog>
  <changelog author="abriel@suse.com" date="1589457600">- let the SAPHanaSR-ScaleOut-doc package conflict with the
  SAPHanaSR-doc package
  (bsc#1157685)</changelog>
  <changelog author="abriel@suse.com" date="1600689600">- PROMOTED/PROMOTED Fix - The PROMOTED/PROMOTED values happened
  after the main tenance procedure and the refresh of the resource
  did not fixed that
  (bsc#1176330)
- Improved SCORING and logging
  Score of secondary in takeover phase increased from 122 to 145 to
  avoid promotion of former primary masternameserver candidates
  (bsc#1174610)
- Fixed typos and improved descriptions in comments
- Change default timeouts and intervals to match the official
  recommendations</changelog>
  <changelog author="abriel@suse.com" date="1604491200">- change version to 0.164.1
- adapt man page SAPHanaSR-showAttr(8) and the README
  (bsc#1144729)</changelog>
  <changelog author="abriel@suse.com" date="1614859200">- change version to 0.164.2
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- add return codes for saphana_stop and saphana_StopSystem
  (bsc#1182115)
- man page SAPhanaSR-ScaleOut minor mistakes
  (bsc#1144442)</changelog>
  <changelog author="abriel@suse.com" date="1627905600">- change version to 0.180.1
- Multi-target SAP HANA Scale-out replication support.
  Extent the SAP HANA ressource agents from single replication
  automation to multi replication automation, which means
  adding multi-target support (srHook - SAPHanaSrMultiTarget.py)
  /usr/sbin/SAPHanaSR-manageAttr - Add a helper tool to support the
  customer during the update from a single replication automation
  to multi replication automation.
  (jsc#SLE-17452, jsc#SLE-20081)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop' in
  the cluster. We will use 95% of this action timeouts to calculate
  the new resource start and stop timeout for the 'WaitforStarted'
  and 'WaitforStopped' functions. If the new, calculated timeout
  value is less than '3600', it will be set to '3600', so that we
  do not decrease this timeout by accident in currently running
  clusters
  (bsc#1182545)
- improve handling of return codes in saphana_stopSystem and
  saphana_stop function.
  (bsc#1182115)
- If the cluster is down during a SR change event, these events
  need special care. They need to pick-up separately to not get
  lost.
- integrate man pages back to the base package SAPHanaSR-ScaleOut.
  The doc package SAPHanaSR-ScaleOut-doc will still exists, but
  only contain the file 'SAPHanaSR-Setup-Guide.pdf'
- During a SR takeover there may be a small time frame where the
  srHook gets a state change from the API with an empty site name.
  This results in a mis-configuration of the cluster. So log the
  occurrence of an empty site name, but do not generate bad
  formatted cluster attribute name.
  (analog to ScaleUp - bsc#1173581)
- add SAPHanaSR-call-monitor
- handle 'leftover instances'
  if HANA is configured to have only one master name server, but
  no additional master name server candidates, there may be the
  situation, where the master name server died and so the landscape
  has no active name server anymore.
  But there are other instances running with active communication
  channels. To prevent data corruption or operations on outdated
  data, we identify and stop these 'leftover' instances.
- add workaround for 'sapcontrol -function WaitforStopped'
  terminating to early.
  If the master name server dies and does not have a failover
  candidate but there are still running worker nodes the command
  'sapcontrol -function WaitforStopped' terminates to early and
  does not wait till all the remaining worker nodes are down.
  So the resource agent needs to wait during his 'stopSystem'
  function till the last "partial" node is down before returning
  a result to the cluster.
  (bsc#1196650)
- manual page updates:
  SAPHanaSR-ScaleOut.7 (bsc#1144442)
  SAPHanaSR-showAttr.8 (bsc#1144312)
  and others</changelog>
  <changelog author="abriel@suse.com" date="1641816000">- change version to 0.181.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189532, bsc#1189533)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)
- add switch 'cib_access' to the SAPHanaSrMultiTarget hook to give
  control over the hook runtime.
  Default is 'all-on' which means there are 3 cib calls performed
  inside the hook script.
  Changing the value of 'cib_access' inside the global.ini file to
  'site-on' to perform the absolute minimum cib calls (only one)
  (bsc#1189540)</changelog>
  <changelog author="abriel@suse.com" date="1669723200">- Version bump to 0.184.1
  * add new HA/DR provider hook susChkSrv supporting a fast-dying
    indexserver
    (jsc#PED-1241, jsc#PED-1240)
  * add new HA/DR provider hook susTkOver for blocking manual
    takeovers
    (jsc#SLE-16347)
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix SAPHanaSR-replay-archive to handle hb_report archives again
    (bsc#1198897)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * add lost-nameserver-slave handling to SAPHanaTopology, to avoid
    toggeling SAPHanaController resource, if all nameserver-masters
    got lost.
    SAPHanaController keeps started, if WAITING4NODES event needs
    to be processed. This only keeps the resource "started".
    The SAP HANA instance will only be started, if enough nodes are
    available to fulfill the needs of the SAP HANA landscape.
  * add new tool SAPHanaSR-manageProvider to show, add and delete
    HA/DR provider sections in the global.ini of SAP HANA.
  * changes to the demote_clone function of the resource agent:
    if the role is '*:shtdown:shtdown:shtdown' (topology agent run
    into timeouts) the function fail with rc=1, to get the managed
    resource stopped
    changes to the stop_clone function of the topology agent:
    call landscapeHostConfiguration.py and set the roles as they
    were reported. If the command timed out, set the role to
    '*:shtdown:shtdown:shtdown' and return 1 to get the node
    fenced.
    The used timeout for the landscapeHostConfiguration.py call can
    be configured by the cluster action timeout, if needed. It will
    be 50% of the action timeout or the minimum of 300s.
    (bsc#1198127)
  * SAPHanaSRTools.pm: shows terminate node attribute too
  * change SAPHanaSR-manageAttr to support the different behaviour
    of 'crmadmin -qD' in different pacemaker versions
    (bsc#1200969)
  * fix HANA_CALL function to support MCOS environments again
    (bsc#1198780)
  * correct the order constraint in man page
    ocf_suse_SAPHanaTopology.7
    (bsc#1197239)</changelog>
  <changelog author="abriel@suse.com" date="1689249600">- Version bump to 0.185.0
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * fix the path for the HA/DR provider hook in the global.ini
    examples to be useful
    (bsc#1210573)
  * update man pages:
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSrMultiTarget.py.7
    SAPHanaSR.py.7
    SAPHanaSR-monitor.8
    SAPHanaSR-showAttr.8
    SAPHanaSR-manageAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1692964800">- Version bump to 0.185.1
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * modify /tmp full fix
    (bsc#1210728)
  * update man pages:
    SAPHanaSR-ScaleOut.7
  * add improvements from SAP to the RA scripts, part II
    (jsc#PED-1739, jsc#PED-2608)</changelog>
  <changelog author="abriel@suse.com" date="1702468800">- Version bump to 0.185.2
  * fix cluster state in SAPHanaSR-manageAttr by supporting the
    different behaviour of 'crmadmin -q -S' in different pacemaker
    versions
    (bsc#1217830)
  * inside SAPHanaSR-hookHelper use the full path for the cibadmin
    command to support non root users in special user environments
    (bsc#1216484)
  * if the SAPHanaSrMultiTarget hook has successfully reported a
    SR event to the cluster a still existing fall-back state file
    will be removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * update man pages:
    SAPHanaSR-ScaleOut.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHanaTopology.7
    ocf_suse_SAPHanaController.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 0.185.3
  * Fix the hexdump log for empty node states
  * Fix exception handling in function 'logTimestamp' of HA/DR
    provider SAPHanaSrMultiTarget.py (bsc#1218901)
  * update man pages:
    SAPHanaSR-ScaleOut.7
    SAPHanaSR.py.7
    SAPHanaSrMultiTarget.py.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-showAttr.8
    SAPHanaSR-manageProvider.8</changelog>
</package>
<package pkgid="c31b31fa0453ed8c11df97e3b2e756a396ea1878e24029248893af5f37fd6a22" name="SAPHanaSR-ScaleOut" arch="src">
  <version epoch="0" ver="0.185.3" rel="150000.45.1"/>
  <changelog author="imanyugin@suse.com" date="1465819200">- Initial technical preview release. fate#318793</changelog>
  <changelog author="imanyugin@suse.com" date="1468497600">- Version 0.161.1
- Added a package conflict for SAPHanaSR, bsc#989162
- Restructure package and the .spec file</changelog>
  <changelog author="imanyugin@suse.com" date="1522756800">- Version 0.163.0
- Fix bsc#1045603: Update man pages
- Fix bsc#1045536: SAPHanaSR-ScaleOut missing update to use SLES python
- Fix bsc#1086545: minor typos in package description and man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1525780800">- Fix bsc#1092331: SAPHanaSR: SAPHanaSR-showAttr fails to open an archived cib file
- Fix bsc#1091988:SAPHanaSR-ScaleOut SAPHanaSR-monitor depends on package not existing in SLES
- SAPHanaSR-showAttr, SAPHanaSR-monitor moved to /usr/sbin to match the file layout in SAPHanaSR-ScaleUp</changelog>
  <changelog author="imanyugin@suse.com" date="1530014400">- Version 0.163.1</changelog>
  <changelog author="clanig@suse.de" date="1536753600">- Version 0.163.2
- Fix bsc#1098979: SAPHanaSR-ScaleOut SAPHanaTopology and
  SAPHanaController allowing virtual host names</changelog>
  <changelog author="abriel@suse.com" date="1573473600">- change version to 0.164.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)
- Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- clean up package, add checks, correct typos</changelog>
  <changelog author="abriel@suse.com" date="1589457600">- let the SAPHanaSR-ScaleOut-doc package conflict with the
  SAPHanaSR-doc package
  (bsc#1157685)</changelog>
  <changelog author="abriel@suse.com" date="1600689600">- PROMOTED/PROMOTED Fix - The PROMOTED/PROMOTED values happened
  after the main tenance procedure and the refresh of the resource
  did not fixed that
  (bsc#1176330)
- Improved SCORING and logging
  Score of secondary in takeover phase increased from 122 to 145 to
  avoid promotion of former primary masternameserver candidates
  (bsc#1174610)
- Fixed typos and improved descriptions in comments
- Change default timeouts and intervals to match the official
  recommendations</changelog>
  <changelog author="abriel@suse.com" date="1604491200">- change version to 0.164.1
- adapt man page SAPHanaSR-showAttr(8) and the README
  (bsc#1144729)</changelog>
  <changelog author="abriel@suse.com" date="1614859200">- change version to 0.164.2
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- add return codes for saphana_stop and saphana_StopSystem
  (bsc#1182115)
- man page SAPhanaSR-ScaleOut minor mistakes
  (bsc#1144442)</changelog>
  <changelog author="abriel@suse.com" date="1627905600">- change version to 0.180.1
- Multi-target SAP HANA Scale-out replication support.
  Extent the SAP HANA ressource agents from single replication
  automation to multi replication automation, which means
  adding multi-target support (srHook - SAPHanaSrMultiTarget.py)
  /usr/sbin/SAPHanaSR-manageAttr - Add a helper tool to support the
  customer during the update from a single replication automation
  to multi replication automation.
  (jsc#SLE-17452, jsc#SLE-20081)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop' in
  the cluster. We will use 95% of this action timeouts to calculate
  the new resource start and stop timeout for the 'WaitforStarted'
  and 'WaitforStopped' functions. If the new, calculated timeout
  value is less than '3600', it will be set to '3600', so that we
  do not decrease this timeout by accident in currently running
  clusters
  (bsc#1182545)
- improve handling of return codes in saphana_stopSystem and
  saphana_stop function.
  (bsc#1182115)
- If the cluster is down during a SR change event, these events
  need special care. They need to pick-up separately to not get
  lost.
- integrate man pages back to the base package SAPHanaSR-ScaleOut.
  The doc package SAPHanaSR-ScaleOut-doc will still exists, but
  only contain the file 'SAPHanaSR-Setup-Guide.pdf'
- During a SR takeover there may be a small time frame where the
  srHook gets a state change from the API with an empty site name.
  This results in a mis-configuration of the cluster. So log the
  occurrence of an empty site name, but do not generate bad
  formatted cluster attribute name.
  (analog to ScaleUp - bsc#1173581)
- add SAPHanaSR-call-monitor
- handle 'leftover instances'
  if HANA is configured to have only one master name server, but
  no additional master name server candidates, there may be the
  situation, where the master name server died and so the landscape
  has no active name server anymore.
  But there are other instances running with active communication
  channels. To prevent data corruption or operations on outdated
  data, we identify and stop these 'leftover' instances.
- add workaround for 'sapcontrol -function WaitforStopped'
  terminating to early.
  If the master name server dies and does not have a failover
  candidate but there are still running worker nodes the command
  'sapcontrol -function WaitforStopped' terminates to early and
  does not wait till all the remaining worker nodes are down.
  So the resource agent needs to wait during his 'stopSystem'
  function till the last "partial" node is down before returning
  a result to the cluster.
  (bsc#1196650)
- manual page updates:
  SAPHanaSR-ScaleOut.7 (bsc#1144442)
  SAPHanaSR-showAttr.8 (bsc#1144312)
  and others</changelog>
  <changelog author="abriel@suse.com" date="1641816000">- change version to 0.181.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189532, bsc#1189533)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)
- add switch 'cib_access' to the SAPHanaSrMultiTarget hook to give
  control over the hook runtime.
  Default is 'all-on' which means there are 3 cib calls performed
  inside the hook script.
  Changing the value of 'cib_access' inside the global.ini file to
  'site-on' to perform the absolute minimum cib calls (only one)
  (bsc#1189540)</changelog>
  <changelog author="abriel@suse.com" date="1669723200">- Version bump to 0.184.1
  * add new HA/DR provider hook susChkSrv supporting a fast-dying
    indexserver
    (jsc#PED-1241, jsc#PED-1240)
  * add new HA/DR provider hook susTkOver for blocking manual
    takeovers
    (jsc#SLE-16347)
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix SAPHanaSR-replay-archive to handle hb_report archives again
    (bsc#1198897)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * add lost-nameserver-slave handling to SAPHanaTopology, to avoid
    toggeling SAPHanaController resource, if all nameserver-masters
    got lost.
    SAPHanaController keeps started, if WAITING4NODES event needs
    to be processed. This only keeps the resource "started".
    The SAP HANA instance will only be started, if enough nodes are
    available to fulfill the needs of the SAP HANA landscape.
  * add new tool SAPHanaSR-manageProvider to show, add and delete
    HA/DR provider sections in the global.ini of SAP HANA.
  * changes to the demote_clone function of the resource agent:
    if the role is '*:shtdown:shtdown:shtdown' (topology agent run
    into timeouts) the function fail with rc=1, to get the managed
    resource stopped
    changes to the stop_clone function of the topology agent:
    call landscapeHostConfiguration.py and set the roles as they
    were reported. If the command timed out, set the role to
    '*:shtdown:shtdown:shtdown' and return 1 to get the node
    fenced.
    The used timeout for the landscapeHostConfiguration.py call can
    be configured by the cluster action timeout, if needed. It will
    be 50% of the action timeout or the minimum of 300s.
    (bsc#1198127)
  * SAPHanaSRTools.pm: shows terminate node attribute too
  * change SAPHanaSR-manageAttr to support the different behaviour
    of 'crmadmin -qD' in different pacemaker versions
    (bsc#1200969)
  * fix HANA_CALL function to support MCOS environments again
    (bsc#1198780)
  * correct the order constraint in man page
    ocf_suse_SAPHanaTopology.7
    (bsc#1197239)</changelog>
  <changelog author="abriel@suse.com" date="1689249600">- Version bump to 0.185.0
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * fix the path for the HA/DR provider hook in the global.ini
    examples to be useful
    (bsc#1210573)
  * update man pages:
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSrMultiTarget.py.7
    SAPHanaSR.py.7
    SAPHanaSR-monitor.8
    SAPHanaSR-showAttr.8
    SAPHanaSR-manageAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1692964800">- Version bump to 0.185.1
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * modify /tmp full fix
    (bsc#1210728)
  * update man pages:
    SAPHanaSR-ScaleOut.7
  * add improvements from SAP to the RA scripts, part II
    (jsc#PED-1739, jsc#PED-2608)</changelog>
  <changelog author="abriel@suse.com" date="1702468800">- Version bump to 0.185.2
  * fix cluster state in SAPHanaSR-manageAttr by supporting the
    different behaviour of 'crmadmin -q -S' in different pacemaker
    versions
    (bsc#1217830)
  * inside SAPHanaSR-hookHelper use the full path for the cibadmin
    command to support non root users in special user environments
    (bsc#1216484)
  * if the SAPHanaSrMultiTarget hook has successfully reported a
    SR event to the cluster a still existing fall-back state file
    will be removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * update man pages:
    SAPHanaSR-ScaleOut.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHanaTopology.7
    ocf_suse_SAPHanaController.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 0.185.3
  * Fix the hexdump log for empty node states
  * Fix exception handling in function 'logTimestamp' of HA/DR
    provider SAPHanaSrMultiTarget.py (bsc#1218901)
  * update man pages:
    SAPHanaSR-ScaleOut.7
    SAPHanaSR.py.7
    SAPHanaSrMultiTarget.py.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-showAttr.8
    SAPHanaSR-manageProvider.8</changelog>
</package>
<package pkgid="d0f1804ce5c643f5638be76e4be4d3a44e9abce91b5b443d94637d1b8f0fd990" name="SAPHanaSR-ScaleOut-doc" arch="noarch">
  <version epoch="0" ver="0.185.3" rel="150000.45.1"/>
  <changelog author="imanyugin@suse.com" date="1465819200">- Initial technical preview release. fate#318793</changelog>
  <changelog author="imanyugin@suse.com" date="1468497600">- Version 0.161.1
- Added a package conflict for SAPHanaSR, bsc#989162
- Restructure package and the .spec file</changelog>
  <changelog author="imanyugin@suse.com" date="1522756800">- Version 0.163.0
- Fix bsc#1045603: Update man pages
- Fix bsc#1045536: SAPHanaSR-ScaleOut missing update to use SLES python
- Fix bsc#1086545: minor typos in package description and man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1525780800">- Fix bsc#1092331: SAPHanaSR: SAPHanaSR-showAttr fails to open an archived cib file
- Fix bsc#1091988:SAPHanaSR-ScaleOut SAPHanaSR-monitor depends on package not existing in SLES
- SAPHanaSR-showAttr, SAPHanaSR-monitor moved to /usr/sbin to match the file layout in SAPHanaSR-ScaleUp</changelog>
  <changelog author="imanyugin@suse.com" date="1530014400">- Version 0.163.1</changelog>
  <changelog author="clanig@suse.de" date="1536753600">- Version 0.163.2
- Fix bsc#1098979: SAPHanaSR-ScaleOut SAPHanaTopology and
  SAPHanaController allowing virtual host names</changelog>
  <changelog author="abriel@suse.com" date="1573473600">- change version to 0.164.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)
- Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- clean up package, add checks, correct typos</changelog>
  <changelog author="abriel@suse.com" date="1589457600">- let the SAPHanaSR-ScaleOut-doc package conflict with the
  SAPHanaSR-doc package
  (bsc#1157685)</changelog>
  <changelog author="abriel@suse.com" date="1600689600">- PROMOTED/PROMOTED Fix - The PROMOTED/PROMOTED values happened
  after the main tenance procedure and the refresh of the resource
  did not fixed that
  (bsc#1176330)
- Improved SCORING and logging
  Score of secondary in takeover phase increased from 122 to 145 to
  avoid promotion of former primary masternameserver candidates
  (bsc#1174610)
- Fixed typos and improved descriptions in comments
- Change default timeouts and intervals to match the official
  recommendations</changelog>
  <changelog author="abriel@suse.com" date="1604491200">- change version to 0.164.1
- adapt man page SAPHanaSR-showAttr(8) and the README
  (bsc#1144729)</changelog>
  <changelog author="abriel@suse.com" date="1614859200">- change version to 0.164.2
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- add return codes for saphana_stop and saphana_StopSystem
  (bsc#1182115)
- man page SAPhanaSR-ScaleOut minor mistakes
  (bsc#1144442)</changelog>
  <changelog author="abriel@suse.com" date="1627905600">- change version to 0.180.1
- Multi-target SAP HANA Scale-out replication support.
  Extent the SAP HANA ressource agents from single replication
  automation to multi replication automation, which means
  adding multi-target support (srHook - SAPHanaSrMultiTarget.py)
  /usr/sbin/SAPHanaSR-manageAttr - Add a helper tool to support the
  customer during the update from a single replication automation
  to multi replication automation.
  (jsc#SLE-17452, jsc#SLE-20081)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop' in
  the cluster. We will use 95% of this action timeouts to calculate
  the new resource start and stop timeout for the 'WaitforStarted'
  and 'WaitforStopped' functions. If the new, calculated timeout
  value is less than '3600', it will be set to '3600', so that we
  do not decrease this timeout by accident in currently running
  clusters
  (bsc#1182545)
- improve handling of return codes in saphana_stopSystem and
  saphana_stop function.
  (bsc#1182115)
- If the cluster is down during a SR change event, these events
  need special care. They need to pick-up separately to not get
  lost.
- integrate man pages back to the base package SAPHanaSR-ScaleOut.
  The doc package SAPHanaSR-ScaleOut-doc will still exists, but
  only contain the file 'SAPHanaSR-Setup-Guide.pdf'
- During a SR takeover there may be a small time frame where the
  srHook gets a state change from the API with an empty site name.
  This results in a mis-configuration of the cluster. So log the
  occurrence of an empty site name, but do not generate bad
  formatted cluster attribute name.
  (analog to ScaleUp - bsc#1173581)
- add SAPHanaSR-call-monitor
- handle 'leftover instances'
  if HANA is configured to have only one master name server, but
  no additional master name server candidates, there may be the
  situation, where the master name server died and so the landscape
  has no active name server anymore.
  But there are other instances running with active communication
  channels. To prevent data corruption or operations on outdated
  data, we identify and stop these 'leftover' instances.
- add workaround for 'sapcontrol -function WaitforStopped'
  terminating to early.
  If the master name server dies and does not have a failover
  candidate but there are still running worker nodes the command
  'sapcontrol -function WaitforStopped' terminates to early and
  does not wait till all the remaining worker nodes are down.
  So the resource agent needs to wait during his 'stopSystem'
  function till the last "partial" node is down before returning
  a result to the cluster.
  (bsc#1196650)
- manual page updates:
  SAPHanaSR-ScaleOut.7 (bsc#1144442)
  SAPHanaSR-showAttr.8 (bsc#1144312)
  and others</changelog>
  <changelog author="abriel@suse.com" date="1641816000">- change version to 0.181.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189532, bsc#1189533)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)
- add switch 'cib_access' to the SAPHanaSrMultiTarget hook to give
  control over the hook runtime.
  Default is 'all-on' which means there are 3 cib calls performed
  inside the hook script.
  Changing the value of 'cib_access' inside the global.ini file to
  'site-on' to perform the absolute minimum cib calls (only one)
  (bsc#1189540)</changelog>
  <changelog author="abriel@suse.com" date="1669723200">- Version bump to 0.184.1
  * add new HA/DR provider hook susChkSrv supporting a fast-dying
    indexserver
    (jsc#PED-1241, jsc#PED-1240)
  * add new HA/DR provider hook susTkOver for blocking manual
    takeovers
    (jsc#SLE-16347)
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix SAPHanaSR-replay-archive to handle hb_report archives again
    (bsc#1198897)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * add lost-nameserver-slave handling to SAPHanaTopology, to avoid
    toggeling SAPHanaController resource, if all nameserver-masters
    got lost.
    SAPHanaController keeps started, if WAITING4NODES event needs
    to be processed. This only keeps the resource "started".
    The SAP HANA instance will only be started, if enough nodes are
    available to fulfill the needs of the SAP HANA landscape.
  * add new tool SAPHanaSR-manageProvider to show, add and delete
    HA/DR provider sections in the global.ini of SAP HANA.
  * changes to the demote_clone function of the resource agent:
    if the role is '*:shtdown:shtdown:shtdown' (topology agent run
    into timeouts) the function fail with rc=1, to get the managed
    resource stopped
    changes to the stop_clone function of the topology agent:
    call landscapeHostConfiguration.py and set the roles as they
    were reported. If the command timed out, set the role to
    '*:shtdown:shtdown:shtdown' and return 1 to get the node
    fenced.
    The used timeout for the landscapeHostConfiguration.py call can
    be configured by the cluster action timeout, if needed. It will
    be 50% of the action timeout or the minimum of 300s.
    (bsc#1198127)
  * SAPHanaSRTools.pm: shows terminate node attribute too
  * change SAPHanaSR-manageAttr to support the different behaviour
    of 'crmadmin -qD' in different pacemaker versions
    (bsc#1200969)
  * fix HANA_CALL function to support MCOS environments again
    (bsc#1198780)
  * correct the order constraint in man page
    ocf_suse_SAPHanaTopology.7
    (bsc#1197239)</changelog>
  <changelog author="abriel@suse.com" date="1689249600">- Version bump to 0.185.0
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * fix the path for the HA/DR provider hook in the global.ini
    examples to be useful
    (bsc#1210573)
  * update man pages:
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSrMultiTarget.py.7
    SAPHanaSR.py.7
    SAPHanaSR-monitor.8
    SAPHanaSR-showAttr.8
    SAPHanaSR-manageAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1692964800">- Version bump to 0.185.1
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * modify /tmp full fix
    (bsc#1210728)
  * update man pages:
    SAPHanaSR-ScaleOut.7
  * add improvements from SAP to the RA scripts, part II
    (jsc#PED-1739, jsc#PED-2608)</changelog>
  <changelog author="abriel@suse.com" date="1702468800">- Version bump to 0.185.2
  * fix cluster state in SAPHanaSR-manageAttr by supporting the
    different behaviour of 'crmadmin -q -S' in different pacemaker
    versions
    (bsc#1217830)
  * inside SAPHanaSR-hookHelper use the full path for the cibadmin
    command to support non root users in special user environments
    (bsc#1216484)
  * if the SAPHanaSrMultiTarget hook has successfully reported a
    SR event to the cluster a still existing fall-back state file
    will be removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * update man pages:
    SAPHanaSR-ScaleOut.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHanaTopology.7
    ocf_suse_SAPHanaController.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 0.185.3
  * Fix the hexdump log for empty node states
  * Fix exception handling in function 'logTimestamp' of HA/DR
    provider SAPHanaSrMultiTarget.py (bsc#1218901)
  * update man pages:
    SAPHanaSR-ScaleOut.7
    SAPHanaSR.py.7
    SAPHanaSrMultiTarget.py.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-showAttr.8
    SAPHanaSR-manageProvider.8</changelog>
</package>
<package pkgid="43d7e0b632411e6e0bfe04ed9cb80055d4c03d61981f6b66ad27f7fd879c3a6e" name="SAPHanaSR-angi" arch="noarch">
  <version epoch="0" ver="1.2.7" rel="150500.3.9.1"/>
  <changelog author="imanyugin@suse.com" date="1511179200">- FATE#323526: adjust HAWK2 Wizards to run on both Python 2 and 3</changelog>
  <changelog author="ro@suse.de" date="1517400000">- remove duplicate BuildArch line from specfile</changelog>
  <changelog author="imanyugin@suse.com" date="1526644800">- Version bump to 0.152.22
- Fix bsc#1091074:
    + Adjust Perl scripts to Perl 5.26.0
    + Remove show_SAPHanaSR_attributes
    + The user is advised to use SAPHanaSR-showAttr instead
- SAPHanaTopology: stricter match for system replication 'mode' in awk</changelog>
  <changelog author="abriel@suse.com" date="1567166400">- Version bump to 0.153.2
- rescore the master and fix some log string literals
- Fix bsc#1133866:
  Return $OCF_RUNNING_MASTER (8) instead of $OCF_SUCCESS (0) when
  probing a promoted node.
- If the SAP HANA CALL to 'landscapeHostConfiguration.py' is
  running into a timeout, do a retry of the command. If it still
  fails with a timeout, raise an error but do not set attributes
  to prevent unlogged failovers because of empty or unknown
  attributes.
  (bsc#1134106, bsc#1133024, bsc#1101373)
- Fix bsc#1082974:
  set attribute for remoteNode
- Fix bsc#1139715:
  Using crm-attributes written by a SAP HANA SR provider hook does
  improve the data integrity in special error conditions with
  multiple errors coming in a short time frame.
  Stabilized remote-site detection; SAPHana could now use a site
  specific SR cluster attribute which could be set by a SAP HA/DR
  provider call.
  Add a HA/DR provider hook script, config implementation and man
  page.
  Add parameter "HANA_CALL_TIMEOUT" to the RA configuration
  (SAPHanaTopology and SAPHanaSR) to set a timeout for HANA calls
  like landscapeHostConfiguration.py.
  Implemented "reload" method to allow changing parameters like
  "AUTOMATED_REGISTER"
  Set SWAIT during startup, but only if the attribute is already set
  Set PRIM after promote, but only if the attribute is already set
  The promote function has to set the return code according to the
  checks of the takeover result
  New tool SAPHanaSR-replay-archive, SAPHanaSR-filter and
  SAPHanaSR-showAttr to support SITE attributes</changelog>
  <changelog author="abriel@suse.com" date="1568203200">- fix typo in a condition statement (bnc#1149829)</changelog>
  <changelog author="abriel@suse.com" date="1573214400">- Version bump to 0.153.3
- The SAPHana resource agent must not down-score a SAP HANA
  Database site, if the landscape status is still 2, which means
  warning.
  Keep high scoring during recovery of the master name server.
  Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- change the shebang line of the HAWK2 templates to python3
  (bsc#1155423)</changelog>
  <changelog author="abriel@suse.com" date="1573819200">- Version bump to 0.154.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)</changelog>
  <changelog author="abriel@suse.com" date="1574337600">- restart sapstartsrv service on master nameserver node during
  monitor action, if needed. But NOT during probes.
  (bsc#1157453)</changelog>
  <changelog author="abriel@suse.com" date="1593691200">- Version bump to 0.154.1
- log empty site names, but do not generate bad formatted cluster
  attribute name
  (bsc#1173581)
- fix documentation of some parameter defaults
- adjust start/stop/promote/monitor action timeouts to match
  official recommendations</changelog>
  <changelog author="abriel@suse.com" date="1637668800">- Version bump to 0.155.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189530, bsc#1189531)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- change promotion scoring during maintenance procedure to prevent
  that both sides have an equal promotion scoring after refresh
  which might result in a critical promotion of the secondary.
  (bsc#1174557)
- update of man page SAPHanaSR.py.7 - correct the supported HANA
  version.
  (bsc#1182201)
- if the $hdbState command fails to retrieve the current state of
  the System Replication, the resource agent now uses the
  system_replication/actual_mode attribute (if available) from the
  global.ini file as a fallback.
  This should prevent some confusing and misleading log messages
  during a takeover and solves the problem of a not working
  takeover back (after a successful first takeover)
  (bsc#1181765)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)</changelog>
  <changelog author="abriel@suse.com" date="1654084800">- Version bump to 0.160.1
- fix HANA_CALL function to support MCOS environments again
  (bsc#1198780)
- fix SAPHanaSR-replay-archive to handle hb_report archives again
  (bsc#1198897)
- add HANA_CALL_TIMEOUT parameter back to the resource agents and
  read the setting from the cluster configuration, if available.
  Defaults to '60'.
  Related to github issue#36
- add new HA/DR provider hook susTkOver
  (jsc#SLE-16347)
- add new hook script for SAP HANA System Replication Scale-Up Cost
  Optimized Scenario.
  (jsc#SLE-18613)
- add a new instance parameter 'REMOVE_SAP_SOCKETS'.
  It is an optional parameter and defaults to 'true'. Now you can
  control, if the RA should remove the unix domain sockets related
  to sapstartsrv before (re-)start sapstartsrv or if it should try
  to adjust the permissions and ownership of these files instead.</changelog>
  <changelog author="abriel@suse.com" date="1661256000">- Version bump to 0.161.1_BF
- add the required 'xmllint' to the package
  (bsc#1201945)
- changes to the demote_clone function of the resource agent:
  if the role is '1:P' (topology agent run into timeouts) the
  function fail with rc=1, to get the managed resource stopped
  changes to the stop_clone function of the topology agent:
  call landscapeHostConfiguration.py and set the roles as they were
  reported. If the command timed out, set the role to '1:P' and
  return 1 to get the node fenced.
  The used timeout for the landscapeHostConfiguration.py call can
  be configured by the cluster action timeout, if needed. It will
  be 50% of the action timeout or the minimum of 300s.
  (bsc#1198127)
- add new HA/DR provider hook susChkSrv
  (jsc#PED-1241, jsc#PED-1240)
- add new tool SAPHanaSR-manageProvider to show, add and delete
  HA/DR provider sections in the global.ini of SAP HANA.
- update suse icon to new branding</changelog>
  <changelog author="varkoly@suse.com" date="1665057600">- SAPHanaSR-monitor not reporting correctly
  (bsc#1192963)
  add patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1669204800">- Version bump to 0.162.0
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * SAPHanaSRTools.pm: shows terminate node attribute too
- remove patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1674561600">- Version bump to 0.162.1
  * fix for SAPHanaTopology failing with error code 1
    (OCF_ERR_GENERIC) during a normal stop action
    (bsc#1207466)
  * set srhook attribute to PRIM during a probe so that we do not
    need to wait for the first srConnectionChanged() to set the
    attribute
    (bsc#1205535)</changelog>
  <changelog author="abriel@suse.com" date="1681732800">- New package name and new version 1.001.4
  * New package SAPHanaSR-angi
    SAP HANA System Replication - A New Generation Interface
    (jsc#PED-6402)
  * support SAPHana ScaleUp and ScaleOut environments with one
    set of resource agents
- conflicting with the 'old' packages SAPHanaSR and
  SAPHanaSR-ScaleOut
- old changelog entries preserved for history reasons as
  SAPHanaSR-angi is based on all these changes.</changelog>
  <changelog author="abriel@suse.com" date="1688558400">- Version bump to 1.001.5
  * package is still in status 'technical preview'
  * add support for SAPHana ScaleOut environments without standby
    nodes
  * starting to rewrite SAPHanaSR tools from bash to python.
    SAPHanaSR-showAttr and SAPHanaSR-replay-archive
    The name of the tools is not changed by this action, but there
    are some improvements in functionality. See the man pages for
    details.
    The tools SAPHanaSR-monitor and SAPHanaSR-filter are deprecated.
    The classic version of these tools is still shipped in the
    package side-by-side to the rewritten and more powerful
    tools in /usr/bin. Their name is suffixed by '-legacy'.
    The classic version of the tools is deprecated and will be
    removed in a later package update.</changelog>
  <changelog author="fabian.herschel@suse.com" date="1691496000">- Version bump to 1.2.0
  * SAPHanaFilesystem RA added (poc status)</changelog>
  <changelog author="abriel@suse.com" date="1702641600">- Version bump to 1.2.3
  * package is still in status 'technical preview'
  * SAPHanaFilesystem RA has still POC status
  * add parameter 'ON_FAIL_ACTION' to SAPHanaFilesystem RA (POC)
  * improve the usage of SAP virtual hostnames
  * if the susHanaSR.py hook has successfully reported a SR event
    to the cluster a still existing fall-back state file will be
    removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * SAPHanaController: change default stop timeout from 3600 to 600
  * SAPHanaController: change default promote timeout from 3600 to
    900
  * try to make set_ and get_hana_attribute function more reliable
    by monitoring the result of the crm_attribute calls
  * fix typo in example srHook/global.ini_susHanaSR
  * fix missing trace section in example srHook/global.ini_susChkSrv
  * update man pages:
    SAPHanaSR-angi.7
    SAPHanaSR.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaTopology.7
    ocf_suse_SAPHanaFilesystem.7
    susChkSrv.py.7
    susHanaSR.py.7
    susTkOver.py.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 1.2.7
  * package SAPHanaSR-angi and SAPHanaFilesystem RA are now
    in state 'supported'
  * add feature HANA 'FAST-STOP' and parameter 'ON_FAIL_ACTION'
  * new demo script SAPHanaSR-upgrade-to-angi-demo
  * added crm config examples
  * susHanaSR.py adapt syntax
  * Fix the hexdump log for empty node states
  * catch monitor calls for non-cloned resources and report them as
    unsupported instead of 'command not found'
    (bsc#1218333)
  * susChkSrv.py - relocate function logTimestamp()
  * susHanaSR.py - catch possible I/O error
  * security improvements
    (bsc#1218696, bsc#1218698 and bsc#1218699)
  * remove instance parameter "REMOVE_SAP_SOCKETS", no longer
    supported
  * add detailed timing log messages for runtime information
  * add cache/live value optimization
  * new man page:
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-upgrade-to-angi-demo.8
  * update man pages:
    SAPHanaSR.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaFilesystem.7
    susChkSrv.py.7
    susHanaSR.py.7
    susHanaSrMultiTarget.py.7
    SAPHanaSR-manageProvider.8
    SAPHanaSR-showAttr.8
    SAPHanaSR-replay-archive.8</changelog>
</package>
<package pkgid="018c692ad22e0691d93dad0b46e98b28ff901c4059e1f6f8395dc9039dd490e2" name="SAPHanaSR-angi" arch="src">
  <version epoch="0" ver="1.2.7" rel="150500.3.9.1"/>
  <changelog author="imanyugin@suse.com" date="1511179200">- FATE#323526: adjust HAWK2 Wizards to run on both Python 2 and 3</changelog>
  <changelog author="ro@suse.de" date="1517400000">- remove duplicate BuildArch line from specfile</changelog>
  <changelog author="imanyugin@suse.com" date="1526644800">- Version bump to 0.152.22
- Fix bsc#1091074:
    + Adjust Perl scripts to Perl 5.26.0
    + Remove show_SAPHanaSR_attributes
    + The user is advised to use SAPHanaSR-showAttr instead
- SAPHanaTopology: stricter match for system replication 'mode' in awk</changelog>
  <changelog author="abriel@suse.com" date="1567166400">- Version bump to 0.153.2
- rescore the master and fix some log string literals
- Fix bsc#1133866:
  Return $OCF_RUNNING_MASTER (8) instead of $OCF_SUCCESS (0) when
  probing a promoted node.
- If the SAP HANA CALL to 'landscapeHostConfiguration.py' is
  running into a timeout, do a retry of the command. If it still
  fails with a timeout, raise an error but do not set attributes
  to prevent unlogged failovers because of empty or unknown
  attributes.
  (bsc#1134106, bsc#1133024, bsc#1101373)
- Fix bsc#1082974:
  set attribute for remoteNode
- Fix bsc#1139715:
  Using crm-attributes written by a SAP HANA SR provider hook does
  improve the data integrity in special error conditions with
  multiple errors coming in a short time frame.
  Stabilized remote-site detection; SAPHana could now use a site
  specific SR cluster attribute which could be set by a SAP HA/DR
  provider call.
  Add a HA/DR provider hook script, config implementation and man
  page.
  Add parameter "HANA_CALL_TIMEOUT" to the RA configuration
  (SAPHanaTopology and SAPHanaSR) to set a timeout for HANA calls
  like landscapeHostConfiguration.py.
  Implemented "reload" method to allow changing parameters like
  "AUTOMATED_REGISTER"
  Set SWAIT during startup, but only if the attribute is already set
  Set PRIM after promote, but only if the attribute is already set
  The promote function has to set the return code according to the
  checks of the takeover result
  New tool SAPHanaSR-replay-archive, SAPHanaSR-filter and
  SAPHanaSR-showAttr to support SITE attributes</changelog>
  <changelog author="abriel@suse.com" date="1568203200">- fix typo in a condition statement (bnc#1149829)</changelog>
  <changelog author="abriel@suse.com" date="1573214400">- Version bump to 0.153.3
- The SAPHana resource agent must not down-score a SAP HANA
  Database site, if the landscape status is still 2, which means
  warning.
  Keep high scoring during recovery of the master name server.
  Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- change the shebang line of the HAWK2 templates to python3
  (bsc#1155423)</changelog>
  <changelog author="abriel@suse.com" date="1573819200">- Version bump to 0.154.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)</changelog>
  <changelog author="abriel@suse.com" date="1574337600">- restart sapstartsrv service on master nameserver node during
  monitor action, if needed. But NOT during probes.
  (bsc#1157453)</changelog>
  <changelog author="abriel@suse.com" date="1593691200">- Version bump to 0.154.1
- log empty site names, but do not generate bad formatted cluster
  attribute name
  (bsc#1173581)
- fix documentation of some parameter defaults
- adjust start/stop/promote/monitor action timeouts to match
  official recommendations</changelog>
  <changelog author="abriel@suse.com" date="1637668800">- Version bump to 0.155.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189530, bsc#1189531)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- change promotion scoring during maintenance procedure to prevent
  that both sides have an equal promotion scoring after refresh
  which might result in a critical promotion of the secondary.
  (bsc#1174557)
- update of man page SAPHanaSR.py.7 - correct the supported HANA
  version.
  (bsc#1182201)
- if the $hdbState command fails to retrieve the current state of
  the System Replication, the resource agent now uses the
  system_replication/actual_mode attribute (if available) from the
  global.ini file as a fallback.
  This should prevent some confusing and misleading log messages
  during a takeover and solves the problem of a not working
  takeover back (after a successful first takeover)
  (bsc#1181765)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)</changelog>
  <changelog author="abriel@suse.com" date="1654084800">- Version bump to 0.160.1
- fix HANA_CALL function to support MCOS environments again
  (bsc#1198780)
- fix SAPHanaSR-replay-archive to handle hb_report archives again
  (bsc#1198897)
- add HANA_CALL_TIMEOUT parameter back to the resource agents and
  read the setting from the cluster configuration, if available.
  Defaults to '60'.
  Related to github issue#36
- add new HA/DR provider hook susTkOver
  (jsc#SLE-16347)
- add new hook script for SAP HANA System Replication Scale-Up Cost
  Optimized Scenario.
  (jsc#SLE-18613)
- add a new instance parameter 'REMOVE_SAP_SOCKETS'.
  It is an optional parameter and defaults to 'true'. Now you can
  control, if the RA should remove the unix domain sockets related
  to sapstartsrv before (re-)start sapstartsrv or if it should try
  to adjust the permissions and ownership of these files instead.</changelog>
  <changelog author="abriel@suse.com" date="1661256000">- Version bump to 0.161.1_BF
- add the required 'xmllint' to the package
  (bsc#1201945)
- changes to the demote_clone function of the resource agent:
  if the role is '1:P' (topology agent run into timeouts) the
  function fail with rc=1, to get the managed resource stopped
  changes to the stop_clone function of the topology agent:
  call landscapeHostConfiguration.py and set the roles as they were
  reported. If the command timed out, set the role to '1:P' and
  return 1 to get the node fenced.
  The used timeout for the landscapeHostConfiguration.py call can
  be configured by the cluster action timeout, if needed. It will
  be 50% of the action timeout or the minimum of 300s.
  (bsc#1198127)
- add new HA/DR provider hook susChkSrv
  (jsc#PED-1241, jsc#PED-1240)
- add new tool SAPHanaSR-manageProvider to show, add and delete
  HA/DR provider sections in the global.ini of SAP HANA.
- update suse icon to new branding</changelog>
  <changelog author="varkoly@suse.com" date="1665057600">- SAPHanaSR-monitor not reporting correctly
  (bsc#1192963)
  add patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1669204800">- Version bump to 0.162.0
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * SAPHanaSRTools.pm: shows terminate node attribute too
- remove patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1674561600">- Version bump to 0.162.1
  * fix for SAPHanaTopology failing with error code 1
    (OCF_ERR_GENERIC) during a normal stop action
    (bsc#1207466)
  * set srhook attribute to PRIM during a probe so that we do not
    need to wait for the first srConnectionChanged() to set the
    attribute
    (bsc#1205535)</changelog>
  <changelog author="abriel@suse.com" date="1681732800">- New package name and new version 1.001.4
  * New package SAPHanaSR-angi
    SAP HANA System Replication - A New Generation Interface
    (jsc#PED-6402)
  * support SAPHana ScaleUp and ScaleOut environments with one
    set of resource agents
- conflicting with the 'old' packages SAPHanaSR and
  SAPHanaSR-ScaleOut
- old changelog entries preserved for history reasons as
  SAPHanaSR-angi is based on all these changes.</changelog>
  <changelog author="abriel@suse.com" date="1688558400">- Version bump to 1.001.5
  * package is still in status 'technical preview'
  * add support for SAPHana ScaleOut environments without standby
    nodes
  * starting to rewrite SAPHanaSR tools from bash to python.
    SAPHanaSR-showAttr and SAPHanaSR-replay-archive
    The name of the tools is not changed by this action, but there
    are some improvements in functionality. See the man pages for
    details.
    The tools SAPHanaSR-monitor and SAPHanaSR-filter are deprecated.
    The classic version of these tools is still shipped in the
    package side-by-side to the rewritten and more powerful
    tools in /usr/bin. Their name is suffixed by '-legacy'.
    The classic version of the tools is deprecated and will be
    removed in a later package update.</changelog>
  <changelog author="fabian.herschel@suse.com" date="1691496000">- Version bump to 1.2.0
  * SAPHanaFilesystem RA added (poc status)</changelog>
  <changelog author="abriel@suse.com" date="1702641600">- Version bump to 1.2.3
  * package is still in status 'technical preview'
  * SAPHanaFilesystem RA has still POC status
  * add parameter 'ON_FAIL_ACTION' to SAPHanaFilesystem RA (POC)
  * improve the usage of SAP virtual hostnames
  * if the susHanaSR.py hook has successfully reported a SR event
    to the cluster a still existing fall-back state file will be
    removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * SAPHanaController: change default stop timeout from 3600 to 600
  * SAPHanaController: change default promote timeout from 3600 to
    900
  * try to make set_ and get_hana_attribute function more reliable
    by monitoring the result of the crm_attribute calls
  * fix typo in example srHook/global.ini_susHanaSR
  * fix missing trace section in example srHook/global.ini_susChkSrv
  * update man pages:
    SAPHanaSR-angi.7
    SAPHanaSR.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaTopology.7
    ocf_suse_SAPHanaFilesystem.7
    susChkSrv.py.7
    susHanaSR.py.7
    susTkOver.py.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 1.2.7
  * package SAPHanaSR-angi and SAPHanaFilesystem RA are now
    in state 'supported'
  * add feature HANA 'FAST-STOP' and parameter 'ON_FAIL_ACTION'
  * new demo script SAPHanaSR-upgrade-to-angi-demo
  * added crm config examples
  * susHanaSR.py adapt syntax
  * Fix the hexdump log for empty node states
  * catch monitor calls for non-cloned resources and report them as
    unsupported instead of 'command not found'
    (bsc#1218333)
  * susChkSrv.py - relocate function logTimestamp()
  * susHanaSR.py - catch possible I/O error
  * security improvements
    (bsc#1218696, bsc#1218698 and bsc#1218699)
  * remove instance parameter "REMOVE_SAP_SOCKETS", no longer
    supported
  * add detailed timing log messages for runtime information
  * add cache/live value optimization
  * new man page:
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-upgrade-to-angi-demo.8
  * update man pages:
    SAPHanaSR.7
    SAPHanaSR-ScaleOut.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR-ScaleOut_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaController.7
    ocf_suse_SAPHanaFilesystem.7
    susChkSrv.py.7
    susHanaSR.py.7
    susHanaSrMultiTarget.py.7
    SAPHanaSR-manageProvider.8
    SAPHanaSR-showAttr.8
    SAPHanaSR-replay-archive.8</changelog>
</package>
<package pkgid="56796144e77787eaec40627a45b56338fc3f2ede6f97eb98d38683f8cf49d043" name="SAPHanaSR-doc" arch="noarch">
  <version epoch="0" ver="0.162.4" rel="150000.4.44.1"/>
  <changelog author="imanyugin@suse.com" date="1499342400">- Fix bsc#1045606: update man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1508760000">- Fix bsc#1062267: SAPHanaSR wizard sets IPAddr2 agent's NIC to eth0</changelog>
  <changelog author="imanyugin@suse.com" date="1511179200">- FATE#323526: adjust HAWK2 Wizards to run on both Python 2 and 3</changelog>
  <changelog author="ro@suse.de" date="1517400000">- remove duplicate BuildArch line from specfile</changelog>
  <changelog author="imanyugin@suse.com" date="1526644800">- Version bump to 0.152.22
- Fix bsc#1091074:
    + Adjust Perl scripts to Perl 5.26.0
    + Remove show_SAPHanaSR_attributes
    + The user is advised to use SAPHanaSR-showAttr instead
- SAPHanaTopology: stricter match for system replication 'mode' in awk</changelog>
  <changelog author="abriel@suse.com" date="1567166400">- Version bump to 0.153.2
- rescore the master and fix some log string literals
- Fix bsc#1133866:
  Return $OCF_RUNNING_MASTER (8) instead of $OCF_SUCCESS (0) when
  probing a promoted node.
- If the SAP HANA CALL to 'landscapeHostConfiguration.py' is
  running into a timeout, do a retry of the command. If it still
  fails with a timeout, raise an error but do not set attributes
  to prevent unlogged failovers because of empty or unknown
  attributes.
  (bsc#1134106, bsc#1133024, bsc#1101373)
- Fix bsc#1082974:
  set attribute for remoteNode
- Fix bsc#1139715:
  Using crm-attributes written by a SAP HANA SR provider hook does
  improve the data integrity in special error conditions with
  multiple errors coming in a short time frame.
  Stabilized remote-site detection; SAPHana could now use a site
  specific SR cluster attribute which could be set by a SAP HA/DR
  provider call.
  Add a HA/DR provider hook script, config implementation and man
  page.
  Add parameter "HANA_CALL_TIMEOUT" to the RA configuration
  (SAPHanaTopology and SAPHanaSR) to set a timeout for HANA calls
  like landscapeHostConfiguration.py.
  Implemented "reload" method to allow changing parameters like
  "AUTOMATED_REGISTER"
  Set SWAIT during startup, but only if the attribute is already set
  Set PRIM after promote, but only if the attribute is already set
  The promote function has to set the return code according to the
  checks of the takeover result
  New tool SAPHanaSR-replay-archive, SAPHanaSR-filter and
  SAPHanaSR-showAttr to support SITE attributes</changelog>
  <changelog author="abriel@suse.com" date="1568203200">- fix typo in a condition statement (bnc#1149829)</changelog>
  <changelog author="abriel@suse.com" date="1573214400">- Version bump to 0.153.3
- The SAPHana resource agent must not down-score a SAP HANA
  Database site, if the landscape status is still 2, which means
  warning.
  Keep high scoring during recovery of the master name server.
  Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- change the shebang line of the HAWK2 templates to python3
  (bsc#1155423)</changelog>
  <changelog author="abriel@suse.com" date="1573819200">- Version bump to 0.154.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)</changelog>
  <changelog author="abriel@suse.com" date="1574337600">- restart sapstartsrv service on master nameserver node during
  monitor action, if needed. But NOT during probes.
  (bsc#1157453)</changelog>
  <changelog author="abriel@suse.com" date="1593691200">- Version bump to 0.154.1
- log empty site names, but do not generate bad formatted cluster
  attribute name
  (bsc#1173581)
- fix documentation of some parameter defaults
- adjust start/stop/promote/monitor action timeouts to match
  official recommendations</changelog>
  <changelog author="abriel@suse.com" date="1637668800">- Version bump to 0.155.0
- Add systemd support for the resource agent to interact with the
  new SAP unit files for sapstartsrv.
  As the new version of the SAP Startup Framework will use systemd
  unit files to control the sapstartsrv process instead of the
  previous used SysV init script, we need to adapt the handling of
  sapstartsrv inside the resource agents to support both ways.
  (bsc#1189530, bsc#1189531)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- change promotion scoring during maintenance procedure to prevent
  that both sides have an equal promotion scoring after refresh
  which might result in a critical promotion of the secondary.
  (bsc#1174557)
- update of man page SAPHanaSR.py.7 - correct the supported HANA
  version.
  (bsc#1182201)
- if the $hdbState command fails to retrieve the current state of
  the System Replication, the resource agent now uses the
  system_replication/actual_mode attribute (if available) from the
  global.ini file as a fallback.
  This should prevent some confusing and misleading log messages
  during a takeover and solves the problem of a not working
  takeover back (after a successful first takeover)
  (bsc#1181765)
- add dedicated logging of HANA_CALL problems. So it will be now
  possible to identify, if the called hana command or the needed
  su command throws the error and for further hints we log the
  stderr output.
  Additional it is possible to get regular log messages for the
  used commands, their return code and their stderr output by
  enabling the 'debug' mode of the resource agents.
  (bsc#1182774)</changelog>
  <changelog author="abriel@suse.com" date="1654084800">- Version bump to 0.160.1
- fix HANA_CALL function to support MCOS environments again
  (bsc#1198780)
- fix SAPHanaSR-replay-archive to handle hb_report archives again
  (bsc#1198897)
- add HANA_CALL_TIMEOUT parameter back to the resource agents and
  read the setting from the cluster configuration, if available.
  Defaults to '60'.
  Related to github issue#36
- add new HA/DR provider hook susTkOver
  (jsc#SLE-16347)
- add new hook script for SAP HANA System Replication Scale-Up Cost
  Optimized Scenario.
  (jsc#SLE-18613)
- add a new instance parameter 'REMOVE_SAP_SOCKETS'.
  It is an optional parameter and defaults to 'true'. Now you can
  control, if the RA should remove the unix domain sockets related
  to sapstartsrv before (re-)start sapstartsrv or if it should try
  to adjust the permissions and ownership of these files instead.</changelog>
  <changelog author="abriel@suse.com" date="1661256000">- Version bump to 0.161.1_BF
- add the required 'xmllint' to the package
  (bsc#1201945)
- changes to the demote_clone function of the resource agent:
  if the role is '1:P' (topology agent run into timeouts) the
  function fail with rc=1, to get the managed resource stopped
  changes to the stop_clone function of the topology agent:
  call landscapeHostConfiguration.py and set the roles as they were
  reported. If the command timed out, set the role to '1:P' and
  return 1 to get the node fenced.
  The used timeout for the landscapeHostConfiguration.py call can
  be configured by the cluster action timeout, if needed. It will
  be 50% of the action timeout or the minimum of 300s.
  (bsc#1198127)
- add new HA/DR provider hook susChkSrv
  (jsc#PED-1241, jsc#PED-1240)
- add new tool SAPHanaSR-manageProvider to show, add and delete
  HA/DR provider sections in the global.ini of SAP HANA.
- update suse icon to new branding</changelog>
  <changelog author="varkoly@suse.com" date="1665057600">- SAPHanaSR-monitor not reporting correctly
  (bsc#1192963)
  add patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1669204800">- Version bump to 0.162.0
  * add improvements from SAP to the RA scripts regarding the
    handling of the SAP tools 'HDB version', 'HDBSettings.sh' and
    'pycd' and the SAPHana log filter handling
    (jsc#PED-1739, jsc#PED-2608)
  * fix for SAPHanaSR-monitor reporting "LPA status of one node is
    missing"
    (bsc#1192963, bsc#1203973)
  * SAPHanaSRTools.pm: shows terminate node attribute too
- remove patch:
    0001-bsc-1192963.patch</changelog>
  <changelog author="abriel@suse.com" date="1674561600">- Version bump to 0.162.1
  * fix for SAPHanaTopology failing with error code 1
    (OCF_ERR_GENERIC) during a normal stop action
    (bsc#1207466)
  * set srhook attribute to PRIM during a probe so that we do not
    need to wait for the first srConnectionChanged() to set the
    attribute
    (bsc#1205535)</changelog>
  <changelog author="abriel@suse.com" date="1698926400">- Version bump to 0.162.2
  * inside SAPHanaSR-hookHelper use the full path for the cibadmin
    command to support non root users in special user environments
    (bsc#1216484)
  * if the SAPHanaSR.py hook has successfully reported a SR event
    to the cluster a still existing fall-back state file will be
    removed to prevent an override of an already reported
    SR state.
    (bsc#1215693)
  * improve supportability by providing the current process ID of
    the RA, which is logged in the RA outputs, to HANA tracefiles
    too.
    This allows a mapping of the SAP related command invocations
    from the RA and the HANA executions which might have a delay
    in between.
    (bsc#1214613)
  * avoid explicid and implicid usage of /tmp filesystem to keep
    the SAPHanaSR resource agents working even in situations with
    /tmp filesystem full.
    (bsc#1210728)
  * update man pages:
    SAPHanaSR.7
    SAPHanaSR_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    ocf_suse_SAPHana.7
    ocf_suse_SAPHanaTopology.7
    susCostOpt.py.7
    SAPHanaSR-monitor.8
    SAPHanaSR-showAttr.8
  * add improvements from SAP to the RA scripts, part II
    (jsc#PED-1739, jsc#PED-2608)</changelog>
  <changelog author="abriel@suse.com" date="1706529600">- Version bump to 0.162.3
  * Fix the hexdump log for empty node states
  * catch monitor calls for non-cloned resources and report them as
    unsupported instead of 'command not found'
    (bsc#1218333)
  * fix scope of variable 'site' to be global
    (bsc#1219194)
  * susChkSrv.py - relocate function logTimestamp()
  * update man pages:
    SAPHanaSR.7
    ocf_suse_SAPHana.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR.py.7
    SAPHanaSR-showAttr.8</changelog>
  <changelog author="abriel@suse.com" date="1715083200">- Version bump to 0.162.4
  * unify global.ini examples
  * add demo script SAPHanaSR-upgrade-to-angi-demo
  * update man pages:
    SAPHanaSR_basic_cluster.7
    SAPHanaSR_maintenance_examples.7
    SAPHanaSR_upgrade_to_angi.7
    SAPHanaSR-manageProvider.8
    SAPHanaSR-upgrade-to-angi-demo.8
    SAPHanaSR.py.7</changelog>
</package>
<package pkgid="ac74198ca85ea27504297d47ef0cc9076f2ed5b0c70ad26eb330a8e55612fcb0" name="WebKitGTK-4.0-lang" arch="noarch">
  <version epoch="0" ver="2.44.2" rel="150600.12.3.1"/>
  <changelog author="mgorse@suse.com" date="1692619200">- Update to version 2.41.91:
  + Properly handle toplevel window state changes in GTK4.
  + Do not keep processing frames while the view is unrealized
    when using DMA-BUF renderer.
  + Fallback to first render node returned by DRM when failing to
    get using EGLDevice.
  + Fix the build with libjxl &lt; 0.7.0.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1693483200">- Add explicit pkgconfig(epoxy) and pkgconfig(xdamage)
  BuildRequires: meson setup checks for them, so we should list
  them.</changelog>
  <changelog author="luc14n0@opensuse.org" date="1693569600">- Expand lang sub-package in spec file unconditionally to handle
  previous name change from WebKit2GTK-lang to WebKitGTK-lang. This
  change affected the automatic generated Requires tag on
  WebKit2GTK-%{_apiver}, then getting out of sync of what's being
  required and what's being provided. Now, any sub-package that was
  providing WebKit2GTK-%{_apiver} will provide WebKitGTK-%{_apiver}
  instead (boo#1214835, boo#1214640, boo#1214093).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694433600">- Update to version 2.41.92:
  + Fix render updates after cross origin history navigation with
    GTK4.
  + Fix flickering in non accelerated compositing mode.
  + Fix pixelated accelerated blur filter.
  + Fix web process launching when xdg-dbus-proxy is not installed.
  + Pass GBM_BO_USE_RENDERING to gbm_bo_create.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
</package>
<package pkgid="cd65cabda6c6d064e57735912506836619ed033d1c8b0d615281dafda4d0513a" name="WebKitGTK-4.0-lang" arch="noarch">
  <version epoch="0" ver="2.44.2" rel="150600.12.6.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1693483200">- Add explicit pkgconfig(epoxy) and pkgconfig(xdamage)
  BuildRequires: meson setup checks for them, so we should list
  them.</changelog>
  <changelog author="luc14n0@opensuse.org" date="1693569600">- Expand lang sub-package in spec file unconditionally to handle
  previous name change from WebKit2GTK-lang to WebKitGTK-lang. This
  change affected the automatic generated Requires tag on
  WebKit2GTK-%{_apiver}, then getting out of sync of what's being
  required and what's being provided. Now, any sub-package that was
  providing WebKit2GTK-%{_apiver} will provide WebKitGTK-%{_apiver}
  instead (boo#1214835, boo#1214640, boo#1214093).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694433600">- Update to version 2.41.92:
  + Fix render updates after cross origin history navigation with
    GTK4.
  + Fix flickering in non accelerated compositing mode.
  + Fix pixelated accelerated blur filter.
  + Fix web process launching when xdg-dbus-proxy is not installed.
  + Pass GBM_BO_USE_RENDERING to gbm_bo_create.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
</package>
<package pkgid="51bfdd91c4dbe130fcd2abf23a5d91ca58871ecfd7f583b6eea4d2f4eb8ddfd4" name="WebKitGTK-4.0-lang" arch="noarch">
  <version epoch="0" ver="2.44.3" rel="150600.12.9.1"/>
  <changelog author="luc14n0@opensuse.org" date="1693569600">- Expand lang sub-package in spec file unconditionally to handle
  previous name change from WebKit2GTK-lang to WebKitGTK-lang. This
  change affected the automatic generated Requires tag on
  WebKit2GTK-%{_apiver}, then getting out of sync of what's being
  required and what's being provided. Now, any sub-package that was
  providing WebKit2GTK-%{_apiver} will provide WebKitGTK-%{_apiver}
  instead (boo#1214835, boo#1214640, boo#1214093).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694433600">- Update to version 2.41.92:
  + Fix render updates after cross origin history navigation with
    GTK4.
  + Fix flickering in non accelerated compositing mode.
  + Fix pixelated accelerated blur filter.
  + Fix web process launching when xdg-dbus-proxy is not installed.
  + Pass GBM_BO_USE_RENDERING to gbm_bo_create.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228696 boo#1228697 boo#1228698):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2023-40782, CVE-2024-40785, CVE-2024-40789, CVE-2024-40794,
    CVE-2024-4558.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
</package>
<package pkgid="66357789d77c102e20d261f724e311304ee86c8bffd6820b3140d2114debb37f" name="WebKitGTK-4.1-lang" arch="noarch">
  <version epoch="0" ver="2.44.2" rel="150600.12.3.1"/>
  <changelog author="mgorse@suse.com" date="1692619200">- Update to version 2.41.91:
  + Properly handle toplevel window state changes in GTK4.
  + Do not keep processing frames while the view is unrealized
    when using DMA-BUF renderer.
  + Fallback to first render node returned by DRM when failing to
    get using EGLDevice.
  + Fix the build with libjxl &lt; 0.7.0.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1693483200">- Add explicit pkgconfig(epoxy) and pkgconfig(xdamage)
  BuildRequires: meson setup checks for them, so we should list
  them.</changelog>
  <changelog author="luc14n0@opensuse.org" date="1693569600">- Expand lang sub-package in spec file unconditionally to handle
  previous name change from WebKit2GTK-lang to WebKitGTK-lang. This
  change affected the automatic generated Requires tag on
  WebKit2GTK-%{_apiver}, then getting out of sync of what's being
  required and what's being provided. Now, any sub-package that was
  providing WebKit2GTK-%{_apiver} will provide WebKitGTK-%{_apiver}
  instead (boo#1214835, boo#1214640, boo#1214093).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694433600">- Update to version 2.41.92:
  + Fix render updates after cross origin history navigation with
    GTK4.
  + Fix flickering in non accelerated compositing mode.
  + Fix pixelated accelerated blur filter.
  + Fix web process launching when xdg-dbus-proxy is not installed.
  + Pass GBM_BO_USE_RENDERING to gbm_bo_create.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
</package>
<package pkgid="2218e37ef2e90042f169d97d09d1079baed15e059599919c124a57e5c41ba3df" name="WebKitGTK-4.1-lang" arch="noarch">
  <version epoch="0" ver="2.44.2" rel="150600.12.6.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1693483200">- Add explicit pkgconfig(epoxy) and pkgconfig(xdamage)
  BuildRequires: meson setup checks for them, so we should list
  them.</changelog>
  <changelog author="luc14n0@opensuse.org" date="1693569600">- Expand lang sub-package in spec file unconditionally to handle
  previous name change from WebKit2GTK-lang to WebKitGTK-lang. This
  change affected the automatic generated Requires tag on
  WebKit2GTK-%{_apiver}, then getting out of sync of what's being
  required and what's being provided. Now, any sub-package that was
  providing WebKit2GTK-%{_apiver} will provide WebKitGTK-%{_apiver}
  instead (boo#1214835, boo#1214640, boo#1214093).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694433600">- Update to version 2.41.92:
  + Fix render updates after cross origin history navigation with
    GTK4.
  + Fix flickering in non accelerated compositing mode.
  + Fix pixelated accelerated blur filter.
  + Fix web process launching when xdg-dbus-proxy is not installed.
  + Pass GBM_BO_USE_RENDERING to gbm_bo_create.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
</package>
<package pkgid="3ae29990e655778908f431d27d8d0cf897f9ef8d7d400a8f7ad85cb021b137dd" name="WebKitGTK-4.1-lang" arch="noarch">
  <version epoch="0" ver="2.44.3" rel="150600.12.9.1"/>
  <changelog author="luc14n0@opensuse.org" date="1693569600">- Expand lang sub-package in spec file unconditionally to handle
  previous name change from WebKit2GTK-lang to WebKitGTK-lang. This
  change affected the automatic generated Requires tag on
  WebKit2GTK-%{_apiver}, then getting out of sync of what's being
  required and what's being provided. Now, any sub-package that was
  providing WebKit2GTK-%{_apiver} will provide WebKitGTK-%{_apiver}
  instead (boo#1214835, boo#1214640, boo#1214093).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694433600">- Update to version 2.41.92:
  + Fix render updates after cross origin history navigation with
    GTK4.
  + Fix flickering in non accelerated compositing mode.
  + Fix pixelated accelerated blur filter.
  + Fix web process launching when xdg-dbus-proxy is not installed.
  + Pass GBM_BO_USE_RENDERING to gbm_bo_create.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228696 boo#1228697 boo#1228698):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2023-40782, CVE-2024-40785, CVE-2024-40789, CVE-2024-40794,
    CVE-2024-4558.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
</package>
<package pkgid="677bf4943eca1e2577223e6deba0c46ea7051e153a0b3a0d7347d1d2760b2b7e" name="WebKitGTK-6.0-lang" arch="noarch">
  <version epoch="0" ver="2.44.2" rel="150600.12.3.1"/>
  <changelog author="mgorse@suse.com" date="1692619200">- Update to version 2.41.91:
  + Properly handle toplevel window state changes in GTK4.
  + Do not keep processing frames while the view is unrealized
    when using DMA-BUF renderer.
  + Fallback to first render node returned by DRM when failing to
    get using EGLDevice.
  + Fix the build with libjxl &lt; 0.7.0.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1693483200">- Add explicit pkgconfig(epoxy) and pkgconfig(xdamage)
  BuildRequires: meson setup checks for them, so we should list
  them.</changelog>
  <changelog author="luc14n0@opensuse.org" date="1693569600">- Expand lang sub-package in spec file unconditionally to handle
  previous name change from WebKit2GTK-lang to WebKitGTK-lang. This
  change affected the automatic generated Requires tag on
  WebKit2GTK-%{_apiver}, then getting out of sync of what's being
  required and what's being provided. Now, any sub-package that was
  providing WebKit2GTK-%{_apiver} will provide WebKitGTK-%{_apiver}
  instead (boo#1214835, boo#1214640, boo#1214093).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694433600">- Update to version 2.41.92:
  + Fix render updates after cross origin history navigation with
    GTK4.
  + Fix flickering in non accelerated compositing mode.
  + Fix pixelated accelerated blur filter.
  + Fix web process launching when xdg-dbus-proxy is not installed.
  + Pass GBM_BO_USE_RENDERING to gbm_bo_create.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
</package>
<package pkgid="519ac4f28accd5ccf971952f4e91b3074a3efe3a8b6e781ed031a0094c4c1a88" name="WebKitGTK-6.0-lang" arch="noarch">
  <version epoch="0" ver="2.44.2" rel="150600.12.6.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1693483200">- Add explicit pkgconfig(epoxy) and pkgconfig(xdamage)
  BuildRequires: meson setup checks for them, so we should list
  them.</changelog>
  <changelog author="luc14n0@opensuse.org" date="1693569600">- Expand lang sub-package in spec file unconditionally to handle
  previous name change from WebKit2GTK-lang to WebKitGTK-lang. This
  change affected the automatic generated Requires tag on
  WebKit2GTK-%{_apiver}, then getting out of sync of what's being
  required and what's being provided. Now, any sub-package that was
  providing WebKit2GTK-%{_apiver} will provide WebKitGTK-%{_apiver}
  instead (boo#1214835, boo#1214640, boo#1214093).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694433600">- Update to version 2.41.92:
  + Fix render updates after cross origin history navigation with
    GTK4.
  + Fix flickering in non accelerated compositing mode.
  + Fix pixelated accelerated blur filter.
  + Fix web process launching when xdg-dbus-proxy is not installed.
  + Pass GBM_BO_USE_RENDERING to gbm_bo_create.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
</package>
<package pkgid="2ea4c2dffe3ecf4ef13365f4136f83dc0b38749c6bc643298c61c20c7e9b4cc6" name="WebKitGTK-6.0-lang" arch="noarch">
  <version epoch="0" ver="2.44.3" rel="150600.12.9.1"/>
  <changelog author="luc14n0@opensuse.org" date="1693569600">- Expand lang sub-package in spec file unconditionally to handle
  previous name change from WebKit2GTK-lang to WebKitGTK-lang. This
  change affected the automatic generated Requires tag on
  WebKit2GTK-%{_apiver}, then getting out of sync of what's being
  required and what's being provided. Now, any sub-package that was
  providing WebKit2GTK-%{_apiver} will provide WebKitGTK-%{_apiver}
  instead (boo#1214835, boo#1214640, boo#1214093).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694433600">- Update to version 2.41.92:
  + Fix render updates after cross origin history navigation with
    GTK4.
  + Fix flickering in non accelerated compositing mode.
  + Fix pixelated accelerated blur filter.
  + Fix web process launching when xdg-dbus-proxy is not installed.
  + Pass GBM_BO_USE_RENDERING to gbm_bo_create.
  + Fix several crashes and rendering issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1694779200">- Update to version 2.42.0 (boo#1218033):
  + New renderer based on DMA-BUF shared buffers.
  + Add new permission request to handle DOM paste access requests.
  + Add API to configure experimental features at runtime.
  + Add API to set the percentage of volume space that can be used
    for data storage.
  + GBM is no longer required for WebGL implementation.
  + Security fixes: CVE-2023-39928, CVE-2023-41074, CVE-2023-32359,
    CVE-2023-42890, CVE-2014-1745.</changelog>
  <changelog author="meissner@suse.com" date="1695902400">- switch to pkgconfig(icu-i18n) instead of libicu-devel, to allow
  switching to a different libicu*-devel (jsc#PED-6193)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1695988800">- Update to version 2.42.1 (boo#1215661 boo#1215866 boo#1215867
  boo#1215868 boo#1215869 boo#1215870):
  + Fix enable-html5-database setting to properly enable/disable
    IndexedDB API.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41993, CVE-2023-40414.</changelog>
  <changelog author="mgorse@suse.com" date="1698062400">- Add webkit2gtk3-create-destroy-egl-image.patch: fix "No provider
  of EglDestroyImage Found" (boo#1216483).</changelog>
  <changelog author="mgorse@suse.com" date="1698840000">- Add webkit2gtk3-disable-dmabuf-nvidia.patch: disable DMABuf
  renderer for NVIDIA proprietary drivers (boo#1216778).</changelog>
  <changelog author="mgorse@suse.com" date="1700136000">- Update to version 2.42.2 (boo#1217210):
  + Bump Safari version in user agent header.
  + Fix CSP regression that broke Unity WebGL applications.
  + Fix the build with GBM disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-41983, CVE-2023-42852.</changelog>
  <changelog author="dimstar@opensuse.org" date="1700568000">- Ensure max_link_jobs and max_compile_jobs have valid values even
  when %{jobs} is not defined (like when building outside of OBS).</changelog>
  <changelog author="dimstar@opensuse.org" date="1701172800">- Adjust path to (openSUSE renamed) gst-plugin-scanner in the code
  using sed.</changelog>
  <changelog author="mgorse@suse.com" date="1701864000">- Update to version 2.42.3 (boo#1217844):
  + Fix flickering while playing videos with DMA-BUF sink.
  + Fix color picker being triggered in the inspector when typing
    "tan".
  + Do not special case the "sans" font family name.
  + Fix build failure with libxml2 version 2.12.0 due to an API
    change.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42916, CVE-2023-42917.</changelog>
  <changelog author="mgorse@suse.com" date="1702728000">- Update to version 2.42.4 (boo#1218032):
  + Fix incorrect random images incorrectly displayed as
    backgrounds of &lt;div&gt; elements.
  + Fix videos displayed aliased after being resized e.g. in
    YouTube.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2023-42883.</changelog>
  <changelog author="mgorse@suse.com" date="1706097600">- Add webkit2gtk3-CVE-2024-23222.patch: fix a type confusion issue
  (bsc#1219113 CVE-2024-23222).</changelog>
  <changelog author="mgorse@suse.com" date="1707134400">- Update to version 2.42.5 (boo#1219604):
  + Fix webkit_web_context_allow_tls_certificate_for_host to
    handle IPv6 URIs produced by SoupURI.
  + Ignore stops with offset zero before last one when rendering
    gradients with cairo.
  + Write bwrapinfo.json to disk for xdg-desktop-portal.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213.
- Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream.
- Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86
  architectures.</changelog>
  <changelog author="mgorse@suse.com" date="1707912000">- Use gcc 11 on SLE, to match what is currently used on SP4, and
  adjust version check to include SP6. Also, use system malloc
  there; the build currently fails without this (webkit#243535).
- Require gcc &gt;= 10.2 to match the current cmake test.
- Disable jpegxl on SLE; it isn't currently available there.</changelog>
  <changelog author="mgorse@suse.com" date="1707998400">- Fix package names for v6, and obsolete old packages.</changelog>
  <changelog author="mgorse@suse.com" date="1708084800">- Increase mem_per_process again to match what is in SLE. The build
  was sporadically failing there (bsc#1198743).
- Require libwaylandclient0 &gt;= 1.20. 15.4 originally had 1.19.0,
  but webkitgtk uses a function added in 1.20.0, so we need to
  ensure that the wayland update is pulled in (bsc#1215072).</changelog>
  <changelog author="mgorse@suse.com" date="1716552000">- Update to version 2.44.2 (boo#1225071):
  + Make gamepads visible on axis movements, and not only on
    button presses.
  + Disable the gst-libav AAC decoder.
  + Make user scripts and style sheets visible in the Web
    Inspector.
  + Use the geolocation portal where available, with the existing
    geoclue as fallback if the portal is not usable.
  + Use the printing portal when running sandboxed.
  + Use the file transfer portal for drag and drop when running
    sandboxed.
  + Avoid notifying an empty cursor rectangle to input methods.
  + Remove empty bar shown in detached inspector windows.
  + Consider keycode when activating application accelerators.
  + Fix the build with ENABLE_WEBAUDIO disabled.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-27834.
- Changes in version 2.44.1:
  + Fix handling of lifetime of web view child dialogs in GTK4.
  + Do not schedule layer flushes when drawing area size is empty.
  + Fix videos with alpha when using the DMA-BUF sink.
  + Fix the build with USE_GBM=OFF.
  + Fix the build in 32bit platforms
  + Fix several crashes and rendering issues.
- Changes in version 2.44.0 (boo#1222010):
  + Make the DOM accessibility tree reachable from UI process with
    GTK4.
  + Removed the X11 and WPE renderers in favor of DMA-BUF.
  + Improved vblank synchronization when rendering.
  + Removed key event reinjection in GTK4 to make keyboard
    shortcuts work in web sites.
  + Fix gamepads detection by correctly handling focused window in
    GTK4.
  + Security fixes: CVE-2024-23252, CVE-2024-23254, CVE-2024-23263,
  CVE-2024-23280, CVE-2024-23284, CVE-2023-42950, CVE-2023-42956,
  CVE-2023-42843.
- Drop webkit2gtk3-create-destroy-egl-image.patch: fixed upstream.
- Rebase webkit2gtk3-disable-dmabuf-nvidia.patch.
- Use WebAssembly on aarch64. It is the upstream default and no
  longer makes the build fail. Stop passing -DENABLE_C_LOOP=ON,
  and -DENABLE_SAMPLING_PROFILER=OFF for the same reason.
- Drop webkit2gtk3-llint-build-fix.patch: no longer needed.
- Disable libbacktrace: we don't have it in SLE.
- Adjust spec for gtk4 now being enabled by default.
- Update keyring (taken from rawhide).</changelog>
  <changelog author="mgorse@suse.com" date="1723118400">- Add CVE fixes:
  + webkit2gtk3-CVE-2024-40776.patch (boo#1228613 CVE-2024-40776)
  + webkit2gtk3-CVE-2024-40779.patch (boo#1228693 CVE-2024-40779)
  + webkit2gtk3-CVE-2024-40780.patch (boo#1228694 CVE-2024-40780)
  + webkit2gtk3-CVE-2024-40782.patch (boo#1228695 CVE-2024-40782)</changelog>
  <changelog author="mgorse@suse.com" date="1724068800">- Update to version 2.44.3 (boo#1228696 boo#1228697 boo#1228698):
  + Fix web process cache suspend/resume when sandbox is enabled.
  + Fix accelerated images dissapearing after scrolling.
  + Fix video flickering with DMA-BUF sink.
  + Fix pointer lock on X11.
  + Fix movement delta on mouse events in GTK3.
  + Undeprecate console message API and make it available in 2022
    API.
  + Fix several crashes and rendering issues.
  + Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
    CVE-2023-40782, CVE-2024-40785, CVE-2024-40789, CVE-2024-40794,
    CVE-2024-4558.
- Drop patches now upstream:
  webkit2gtk3-CVE-2024-40776.patch
  webkit2gtk3-CVE-2024-40779.patch
  webkit2gtk3-CVE-2024-40780.patch
  webkit2gtk3-CVE-2024-40782.patch</changelog>
</package>
<package pkgid="bd9492cd906dbf1d084580582422926baf8bd3659d4e347b8808635a03439891" name="aaa_base" arch="aarch64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="b0535694a32366f93830f23822c77f7744792780621a2e8bb701ac6e9e770a6c" name="aaa_base" arch="ppc64le">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="9338bc325b60e59b7a48492a7ffd6e7e302ba111ed0ee369bd67e9c4fb6c488f" name="aaa_base" arch="s390x">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="862585b96b291271b7c68f130ab3ab75afc51eac570e5afff94270572a767130" name="aaa_base" arch="src">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="520a1a79da52c509673b5dff77405c93ff366e30912447d842d78c4a46fb3007" name="aaa_base" arch="x86_64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="a02632e83d4aabbbda31919d1eab94df6857a3a1256c23312bbbee119897fa53" name="aaa_base-extras" arch="aarch64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="0db0504c8c2911422db2fbcbfbd5d4958c333e4b2b85d30e315354d3ad425efd" name="aaa_base-extras" arch="ppc64le">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="d817c2abee0c17c40110a0d91731452b21c9191aaadaaeff8228ec14362ef531" name="aaa_base-extras" arch="s390x">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="e0ea28605bac277e348893eb71276b605568a6816e49a46e7ad11e2d9829ee6c" name="aaa_base-extras" arch="x86_64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="ec21a45a7bcb9cf8f1eb14ec5732dde579d52bd1fd22178fe0bd7bc8f15d540b" name="aaa_base-malloccheck" arch="aarch64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="534987043fe1e7f9d970edf0c77d39fe0ca252961ef11db407b5c2389d7cd644" name="aaa_base-malloccheck" arch="ppc64le">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="80a97f41c2c270de1f21bbb60939a4af12524cc25bc006b49fdab7af02a43809" name="aaa_base-malloccheck" arch="s390x">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="4703a2799fe2f72fae2383fb53f566de046649061b60852c8610a2330d91a163" name="aaa_base-malloccheck" arch="x86_64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="45764b49fe8a507fee4731946d4fec905e44f6293ed0b390f7f714d603374e31" name="aaa_base-wsl" arch="aarch64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="11f91458b43459142414113a87e3e313265cdf0ebad4e0685efe536d3f494ef9" name="aaa_base-wsl" arch="ppc64le">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="424150c0321234070da1bf198a144ae983b2f56b63a8230beb1ad8d334a61f07" name="aaa_base-wsl" arch="s390x">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="b2542ad8fff7527a59c661537f3c76983058a0d4b4a564d389df2ae1d2efe188" name="aaa_base-wsl" arch="x86_64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.20.1"/>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
  <changelog author="ro@suse.de" date="1699272000">- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
  * fix the issues from bsc#1107342 and bsc#1215434 and just
    use the settings from update-alternatives to set JAVA_HOME</changelog>
  <changelog author="ro@suse.de" date="1705320000">- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to actually apply</changelog>
  <changelog author="ro@suse.de" date="1706875200">- silence the output in the case of broken symlinks (bsc#1218232)</changelog>
  <changelog author="ro@suse.de" date="1710763200">- add patch git-48-477bc3c05fcdabf9319e84278a1cba2c12c9ed5a.patch
  home and end button not working from ssh client (bsc#1221407)
- use autosetup in prep stage of specfile</changelog>
  <changelog author="ro@suse.de" date="1712923200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  drop the stderr redirection for csh (bsc#1221361)
- add git-49-3f8f26123d91f70c644677a323134fc79318c818.patch
  drop sysctl.d/50-default-s390.conf (bsc#1211721)
- add aaa_base-preinstall.patch
  make sure the script does not exit with 1 if a file
  with content is found (bsc#1222547)</changelog>
  <changelog author="ro@suse.de" date="1714651200">- modify git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  to also fix the typo to set JAVA_BINDIR in the csh variant
  of the alljava profile script (bsc#1221361)</changelog>
</package>
<package pkgid="02cefa13a9c016190a4b2da88da1ea59d5c045fc52e5f2e79190a03fabbf2837" name="aardvark-dns" arch="aarch64">
  <version epoch="0" ver="1.11.0" rel="150500.3.6.1"/>
  <changelog author="danish.prakash@suse.com" date="1676376000">- First version of aardvark-dns</changelog>
  <changelog author="danish.prakash@suse.com" date="1679054400">- Fix libexecdir issue on Leap and SLE</changelog>
  <changelog author="danish.prakash@suse.com" date="1681300800">- Update to version 1.6.0:
  * v1.6.0 release
  * Update release notes for v1.6.0
  * fix(deps): update rust crate tokio to 1.27.0
  * use lower TTL for contianer entries
  * fix(deps): update rust crate syslog to ^6.0.1
  * fix(deps): update rust crate futures-util to 0.3.28
  * chore(deps): update dependency containers/automation_images to v20230330
  * Disable Dependabot in favor of Renovate
  * chore(deps): update dependency containers/automation_images to v20230320
  * build(deps): bump futures-util from 0.3.26 to 0.3.27
  * [CI:BUILD] Packit: trigger builds on commit to main branch
  * build(deps): bump anyhow from 1.0.68 to 1.0.70
  * fix lint issue with new rust version 1.68
  * Cirrus: Update to newer CI VM images
  * build(deps): bump chrono from 0.4.23 to 0.4.24
  * build(deps): bump libc from 0.2.139 to 0.2.140
  * build(deps): bump async-broadcast from 0.5.0 to 0.5.1
  * build(deps): bump signal-hook from 0.3.14 to 0.3.15
  * build(deps): bump futures-util from 0.3.25 to 0.3.26
  * build(deps): bump tokio from 1.25.0 to 1.26.0
  * [CI:DOCS] Clarify packit related comments
  * [CI:BUILD] Packit: initial enablement
  * Allow custom cargo binary path
  * Switch to explicit platform list for `cargo vendor-filterer`
  * bump to v1.6.0-dev
  * Add renovate.json5
  * Cirrus: Groom rust cache before updating</changelog>
  <changelog author="danish.prakash@suse.com" date="1688385600">- Update to version 1.7.0:
  * release v1.7.0
  * Update release notes for v1.7.0
  * fix(deps): update rust crate tokio to 1.29.0
  * fix(deps): update rust crate clap to 4.3.8
  * fix(deps): update rust crate clap to 4.3.5
  * run cargo update
  * [CI:BUILD] Packit: add Fedora downstream tasks
  * fix(deps): update rust crate clap to 4.3.4
  * chore(deps): update dependency containers/automation_images to v20230614
  * fix(deps): update rust crate clap to 4.3.3
  * fix(deps): update rust crate log to 0.4.19
  * fix(deps): update rust crate clap to 4.3.2
  * fix(deps): update rust crate clap to 4.3.1
  * cirrus: remove verify_vendor task
  * chore(deps): update dependency containers/automation_images to v20230601
  * fix(deps): update rust crate trust-dns-server to 0.22.1
  * chore(deps): update rust crate chrono to 0.4.26
  * fix(deps): update rust crate tokio to 1.28.2
  * fix(deps): update rust crate log to 0.4.18
  * chore(deps): update rust crate chrono to 0.4.25
  * fix(deps): update rust crate clap to 4.3.0
  * chore(deps): update dependency containers/automation_images to v20230517
  * fix(deps): update rust crate tokio to 1.28.1
  * chore(deps): update dependency containers/automation_images to v20230426
  * fix(deps): update rust crate clap to 4.2.7
  * fix(deps): update rust crate anyhow to 1.0.71
  * fix typo in makefile
  * fix(deps): update rust crate tokio to 1.28.0
  * fix(deps): update rust crate clap to 4.2.5
  * fix(deps): update rust crate syslog to ^6.1.0
  * fix(deps): update rust crate clap to 4.2.4
  * fix(deps): update rust crate clap to 4.2.3
  * fix(deps): update rust crate clap to v4
  * chore(deps): update dependency containers/automation_images to v20230405
  * bump to v1.7.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1689076800">- Disable restricting builds only for tier1 platforms
  i.e. only for x86_64 and aarch64 and enable for all.</changelog>
  <changelog author="danish.prakash@suse.com" date="1695902400">- Update to version 1.8.0:
  * Release v1.8.0
  * update release notes for v1.8.0
  * run cargo update
  * Packit: switch to @containers/packit-build team for copr failure notification comments
  * [CI:BUILD] Packit: tag @lsm5 on copr build failures
  * chore(deps): update rust crate chrono to 0.4.31
  * cargo: bump chrono to 0.4.30
  * test: IPv6 format is changed in v1.72.0
  * bump nix to 0.27.1
  * vendor: bump trust_dns_proto and trust_dns_client to 0.23.0
  * fix(deps): update rust crate trust-dns-server to 0.23.0
  * [CI:BUILD] rpm: spdx compatible license field
  * fix(deps): update rust crate anyhow to 1.0.75
  * fix(deps): update rust crate tokio to 1.32.0
  * chore(deps): update dependency containers/automation_images to v20230816
  * fix(deps): update rust crate tokio to 1.31.0
  * fix(deps): update rust crate anyhow to 1.0.74
  * fix(deps): update rust crate anyhow to 1.0.73
  * fix(deps): update rust crate log to 0.4.20
  * chore(deps): update dependency containers/automation_images to v20230809
  * fix(deps): update rust crate tokio to 1.30.0
  * fix(deps): update rust crate clap to 4.3.21
  * packit: Build PRs into default packit COPRs
  * chore(deps): update dependency containers/automation_images to v20230807
  * fix(deps): update rust crate anyhow to 1.0.72
  * fix(deps): update rust crate signal-hook to 0.3.17
  * fix(deps): update rust crate clap to 4.3.19
  * fix(deps): update rust crate clap to 4.3.15
  * fix(deps): update rust crate signal-hook to 0.3.16
  * [CI:BUILD] Packit: remove pre-sync action
  * fix(deps): update rust crate clap to 4.3.11
  * fix(deps): update rust crate tokio to 1.29.1
  * fix(deps): update rust crate clap to 4.3.10
  * [CI:BUILD] RPM: cleanup spec and fix eln builds
  * bump to v1.8.0-devel</changelog>
  <changelog author="danish.prakash@suse.com" date="1701345600">- Update to version 1.9.0:
  * Release v1.9.0
  * v1.9.0 Update release notes
  * run cargo update
  * chore(deps): update dependency containers/automation_images to v20231116
  * fix(deps): update rust crate tokio to 1.34.0
  * fix(deps): update rust crate async-broadcast to 0.6.0
  * update trust-dns to hickory
  * fix(deps): update rust crate futures-util to 0.3.29
  * fix(deps): update rust crate trust-dns-server to 0.23.2
  * fix(deps): update rust crate trust-dns-proto to 0.23.2
  * tmt: initial enablement
  * aardvark main: change error reporting
  * chore(deps): update dependency containers/automation_images to v20231004
  * fix(deps): update rust crate trust-dns-proto to 0.23.1
  * fix(deps): update rust crate trust-dns-client to 0.23.1
  * clippy: some format fixes
  * fix(deps): update rust crate tokio to 1.33.0
  * Bump to v1.9.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1706184000">- Update to version 1.10.0:
  * Release 1.10.0
  * Release notes for 1.10.0
  * chore(deps): update rust crate chrono to 0.4.32
  * chore(deps): update dependency containers/automation_images to v20240102
  * fix(deps): update rust crate futures-util to 0.3.30
  * fix(deps): update rust crate anyhow to 1.0.79
  * fix(deps): update rust crate tokio to 1.35.1
  * chore(deps): update dependency containers/automation_images to v20231208
  * fix(deps): update rust crate tokio to 1.35.0
  * fix duplicated IP CI flake
  * server: remove unused kill switch
  * fix(deps): update rust crate clap to ~4.4.10
  * Bump working version to v1.10.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1717416000">- Remove redundant source: cargo_config
- Update to version 1.11.0:
  * Release v1.11.0
  * v1.11.0 release notes
  * run cargo update
  * chore(deps): update dependency containers/automation_images to v20240529
  * Internal networks cannot make external DNS requests
  * fix(deps): update rust crate anyhow to 1.0.86
  * fix(deps): update rust crate nix to 0.29.0
  * [skip-ci] RPM: use default __cargo macro across all envs
  * chore(deps): update dependency containers/automation_images to v20240513
  * fix(deps): update rust crate anyhow to 1.0.83
  * [skip-ci] Packit: separate `packages` key for rhel jobs
  * fix(deps): update rust crate libc to 0.2.154
  * [skip-ci] Packit: enable rhel10, c10s tests and c10s downstream sync
  * [skip-ci] Packit: Remove EL8 jobs
  * fix(deps): update rust crate syslog to ^6.1.1
  * fix reverse ipv6 lookup test flake
  * fix(deps): update hickory-dns monorepo to 0.24.1
  * chore(deps): update rust crate chrono to 0.4.38
  * Don't tear down all server threads on SIGHUP (bsc#1224167)
  * fix(deps): update rust crate anyhow to 1.0.82
  * fix(deps): update rust crate tokio to 1.37.0
  * Update to nix-0.28.0
  * update chrono package
  * chore(deps): update dependency containers/automation_images to v20240320
  * fix(deps): update rust crate anyhow to 1.0.81
  * tests: check queried domain name in reverse lookup tests
  * fix: set name for answers in reverse lookups
  * chore: fix typo in runner script
  * chore: fix log message when doing reverse lookup
  * fix(deps): update rust crate log to 0.4.21
  * fix(deps): update rust crate anyhow to 1.0.80
  * chore(deps): update rust crate chrono to 0.4.34
  * fix(deps): update rust crate async-broadcast to 0.7.0
  * fix(deps): update rust crate tokio to 1.36.0
  * [CI:DOCS] Packit: disable bodhi tasks
  * chore(deps): update rust crate chrono to 0.4.33
  * Bump to 1.11.0-dev</changelog>
</package>
<package pkgid="f88306473701582ef4a5ec91a887f49239797094cb2b804a711733b55779b65f" name="aardvark-dns" arch="ppc64le">
  <version epoch="0" ver="1.11.0" rel="150500.3.6.1"/>
  <changelog author="danish.prakash@suse.com" date="1676376000">- First version of aardvark-dns</changelog>
  <changelog author="danish.prakash@suse.com" date="1679054400">- Fix libexecdir issue on Leap and SLE</changelog>
  <changelog author="danish.prakash@suse.com" date="1681300800">- Update to version 1.6.0:
  * v1.6.0 release
  * Update release notes for v1.6.0
  * fix(deps): update rust crate tokio to 1.27.0
  * use lower TTL for contianer entries
  * fix(deps): update rust crate syslog to ^6.0.1
  * fix(deps): update rust crate futures-util to 0.3.28
  * chore(deps): update dependency containers/automation_images to v20230330
  * Disable Dependabot in favor of Renovate
  * chore(deps): update dependency containers/automation_images to v20230320
  * build(deps): bump futures-util from 0.3.26 to 0.3.27
  * [CI:BUILD] Packit: trigger builds on commit to main branch
  * build(deps): bump anyhow from 1.0.68 to 1.0.70
  * fix lint issue with new rust version 1.68
  * Cirrus: Update to newer CI VM images
  * build(deps): bump chrono from 0.4.23 to 0.4.24
  * build(deps): bump libc from 0.2.139 to 0.2.140
  * build(deps): bump async-broadcast from 0.5.0 to 0.5.1
  * build(deps): bump signal-hook from 0.3.14 to 0.3.15
  * build(deps): bump futures-util from 0.3.25 to 0.3.26
  * build(deps): bump tokio from 1.25.0 to 1.26.0
  * [CI:DOCS] Clarify packit related comments
  * [CI:BUILD] Packit: initial enablement
  * Allow custom cargo binary path
  * Switch to explicit platform list for `cargo vendor-filterer`
  * bump to v1.6.0-dev
  * Add renovate.json5
  * Cirrus: Groom rust cache before updating</changelog>
  <changelog author="danish.prakash@suse.com" date="1688385600">- Update to version 1.7.0:
  * release v1.7.0
  * Update release notes for v1.7.0
  * fix(deps): update rust crate tokio to 1.29.0
  * fix(deps): update rust crate clap to 4.3.8
  * fix(deps): update rust crate clap to 4.3.5
  * run cargo update
  * [CI:BUILD] Packit: add Fedora downstream tasks
  * fix(deps): update rust crate clap to 4.3.4
  * chore(deps): update dependency containers/automation_images to v20230614
  * fix(deps): update rust crate clap to 4.3.3
  * fix(deps): update rust crate log to 0.4.19
  * fix(deps): update rust crate clap to 4.3.2
  * fix(deps): update rust crate clap to 4.3.1
  * cirrus: remove verify_vendor task
  * chore(deps): update dependency containers/automation_images to v20230601
  * fix(deps): update rust crate trust-dns-server to 0.22.1
  * chore(deps): update rust crate chrono to 0.4.26
  * fix(deps): update rust crate tokio to 1.28.2
  * fix(deps): update rust crate log to 0.4.18
  * chore(deps): update rust crate chrono to 0.4.25
  * fix(deps): update rust crate clap to 4.3.0
  * chore(deps): update dependency containers/automation_images to v20230517
  * fix(deps): update rust crate tokio to 1.28.1
  * chore(deps): update dependency containers/automation_images to v20230426
  * fix(deps): update rust crate clap to 4.2.7
  * fix(deps): update rust crate anyhow to 1.0.71
  * fix typo in makefile
  * fix(deps): update rust crate tokio to 1.28.0
  * fix(deps): update rust crate clap to 4.2.5
  * fix(deps): update rust crate syslog to ^6.1.0
  * fix(deps): update rust crate clap to 4.2.4
  * fix(deps): update rust crate clap to 4.2.3
  * fix(deps): update rust crate clap to v4
  * chore(deps): update dependency containers/automation_images to v20230405
  * bump to v1.7.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1689076800">- Disable restricting builds only for tier1 platforms
  i.e. only for x86_64 and aarch64 and enable for all.</changelog>
  <changelog author="danish.prakash@suse.com" date="1695902400">- Update to version 1.8.0:
  * Release v1.8.0
  * update release notes for v1.8.0
  * run cargo update
  * Packit: switch to @containers/packit-build team for copr failure notification comments
  * [CI:BUILD] Packit: tag @lsm5 on copr build failures
  * chore(deps): update rust crate chrono to 0.4.31
  * cargo: bump chrono to 0.4.30
  * test: IPv6 format is changed in v1.72.0
  * bump nix to 0.27.1
  * vendor: bump trust_dns_proto and trust_dns_client to 0.23.0
  * fix(deps): update rust crate trust-dns-server to 0.23.0
  * [CI:BUILD] rpm: spdx compatible license field
  * fix(deps): update rust crate anyhow to 1.0.75
  * fix(deps): update rust crate tokio to 1.32.0
  * chore(deps): update dependency containers/automation_images to v20230816
  * fix(deps): update rust crate tokio to 1.31.0
  * fix(deps): update rust crate anyhow to 1.0.74
  * fix(deps): update rust crate anyhow to 1.0.73
  * fix(deps): update rust crate log to 0.4.20
  * chore(deps): update dependency containers/automation_images to v20230809
  * fix(deps): update rust crate tokio to 1.30.0
  * fix(deps): update rust crate clap to 4.3.21
  * packit: Build PRs into default packit COPRs
  * chore(deps): update dependency containers/automation_images to v20230807
  * fix(deps): update rust crate anyhow to 1.0.72
  * fix(deps): update rust crate signal-hook to 0.3.17
  * fix(deps): update rust crate clap to 4.3.19
  * fix(deps): update rust crate clap to 4.3.15
  * fix(deps): update rust crate signal-hook to 0.3.16
  * [CI:BUILD] Packit: remove pre-sync action
  * fix(deps): update rust crate clap to 4.3.11
  * fix(deps): update rust crate tokio to 1.29.1
  * fix(deps): update rust crate clap to 4.3.10
  * [CI:BUILD] RPM: cleanup spec and fix eln builds
  * bump to v1.8.0-devel</changelog>
  <changelog author="danish.prakash@suse.com" date="1701345600">- Update to version 1.9.0:
  * Release v1.9.0
  * v1.9.0 Update release notes
  * run cargo update
  * chore(deps): update dependency containers/automation_images to v20231116
  * fix(deps): update rust crate tokio to 1.34.0
  * fix(deps): update rust crate async-broadcast to 0.6.0
  * update trust-dns to hickory
  * fix(deps): update rust crate futures-util to 0.3.29
  * fix(deps): update rust crate trust-dns-server to 0.23.2
  * fix(deps): update rust crate trust-dns-proto to 0.23.2
  * tmt: initial enablement
  * aardvark main: change error reporting
  * chore(deps): update dependency containers/automation_images to v20231004
  * fix(deps): update rust crate trust-dns-proto to 0.23.1
  * fix(deps): update rust crate trust-dns-client to 0.23.1
  * clippy: some format fixes
  * fix(deps): update rust crate tokio to 1.33.0
  * Bump to v1.9.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1706184000">- Update to version 1.10.0:
  * Release 1.10.0
  * Release notes for 1.10.0
  * chore(deps): update rust crate chrono to 0.4.32
  * chore(deps): update dependency containers/automation_images to v20240102
  * fix(deps): update rust crate futures-util to 0.3.30
  * fix(deps): update rust crate anyhow to 1.0.79
  * fix(deps): update rust crate tokio to 1.35.1
  * chore(deps): update dependency containers/automation_images to v20231208
  * fix(deps): update rust crate tokio to 1.35.0
  * fix duplicated IP CI flake
  * server: remove unused kill switch
  * fix(deps): update rust crate clap to ~4.4.10
  * Bump working version to v1.10.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1717416000">- Remove redundant source: cargo_config
- Update to version 1.11.0:
  * Release v1.11.0
  * v1.11.0 release notes
  * run cargo update
  * chore(deps): update dependency containers/automation_images to v20240529
  * Internal networks cannot make external DNS requests
  * fix(deps): update rust crate anyhow to 1.0.86
  * fix(deps): update rust crate nix to 0.29.0
  * [skip-ci] RPM: use default __cargo macro across all envs
  * chore(deps): update dependency containers/automation_images to v20240513
  * fix(deps): update rust crate anyhow to 1.0.83
  * [skip-ci] Packit: separate `packages` key for rhel jobs
  * fix(deps): update rust crate libc to 0.2.154
  * [skip-ci] Packit: enable rhel10, c10s tests and c10s downstream sync
  * [skip-ci] Packit: Remove EL8 jobs
  * fix(deps): update rust crate syslog to ^6.1.1
  * fix reverse ipv6 lookup test flake
  * fix(deps): update hickory-dns monorepo to 0.24.1
  * chore(deps): update rust crate chrono to 0.4.38
  * Don't tear down all server threads on SIGHUP (bsc#1224167)
  * fix(deps): update rust crate anyhow to 1.0.82
  * fix(deps): update rust crate tokio to 1.37.0
  * Update to nix-0.28.0
  * update chrono package
  * chore(deps): update dependency containers/automation_images to v20240320
  * fix(deps): update rust crate anyhow to 1.0.81
  * tests: check queried domain name in reverse lookup tests
  * fix: set name for answers in reverse lookups
  * chore: fix typo in runner script
  * chore: fix log message when doing reverse lookup
  * fix(deps): update rust crate log to 0.4.21
  * fix(deps): update rust crate anyhow to 1.0.80
  * chore(deps): update rust crate chrono to 0.4.34
  * fix(deps): update rust crate async-broadcast to 0.7.0
  * fix(deps): update rust crate tokio to 1.36.0
  * [CI:DOCS] Packit: disable bodhi tasks
  * chore(deps): update rust crate chrono to 0.4.33
  * Bump to 1.11.0-dev</changelog>
</package>
<package pkgid="a97d1de58e126323a2070b3231acf54d9cdfc381c5877bc30fd644c1c96fe605" name="aardvark-dns" arch="s390x">
  <version epoch="0" ver="1.11.0" rel="150500.3.6.1"/>
  <changelog author="danish.prakash@suse.com" date="1676376000">- First version of aardvark-dns</changelog>
  <changelog author="danish.prakash@suse.com" date="1679054400">- Fix libexecdir issue on Leap and SLE</changelog>
  <changelog author="danish.prakash@suse.com" date="1681300800">- Update to version 1.6.0:
  * v1.6.0 release
  * Update release notes for v1.6.0
  * fix(deps): update rust crate tokio to 1.27.0
  * use lower TTL for contianer entries
  * fix(deps): update rust crate syslog to ^6.0.1
  * fix(deps): update rust crate futures-util to 0.3.28
  * chore(deps): update dependency containers/automation_images to v20230330
  * Disable Dependabot in favor of Renovate
  * chore(deps): update dependency containers/automation_images to v20230320
  * build(deps): bump futures-util from 0.3.26 to 0.3.27
  * [CI:BUILD] Packit: trigger builds on commit to main branch
  * build(deps): bump anyhow from 1.0.68 to 1.0.70
  * fix lint issue with new rust version 1.68
  * Cirrus: Update to newer CI VM images
  * build(deps): bump chrono from 0.4.23 to 0.4.24
  * build(deps): bump libc from 0.2.139 to 0.2.140
  * build(deps): bump async-broadcast from 0.5.0 to 0.5.1
  * build(deps): bump signal-hook from 0.3.14 to 0.3.15
  * build(deps): bump futures-util from 0.3.25 to 0.3.26
  * build(deps): bump tokio from 1.25.0 to 1.26.0
  * [CI:DOCS] Clarify packit related comments
  * [CI:BUILD] Packit: initial enablement
  * Allow custom cargo binary path
  * Switch to explicit platform list for `cargo vendor-filterer`
  * bump to v1.6.0-dev
  * Add renovate.json5
  * Cirrus: Groom rust cache before updating</changelog>
  <changelog author="danish.prakash@suse.com" date="1688385600">- Update to version 1.7.0:
  * release v1.7.0
  * Update release notes for v1.7.0
  * fix(deps): update rust crate tokio to 1.29.0
  * fix(deps): update rust crate clap to 4.3.8
  * fix(deps): update rust crate clap to 4.3.5
  * run cargo update
  * [CI:BUILD] Packit: add Fedora downstream tasks
  * fix(deps): update rust crate clap to 4.3.4
  * chore(deps): update dependency containers/automation_images to v20230614
  * fix(deps): update rust crate clap to 4.3.3
  * fix(deps): update rust crate log to 0.4.19
  * fix(deps): update rust crate clap to 4.3.2
  * fix(deps): update rust crate clap to 4.3.1
  * cirrus: remove verify_vendor task
  * chore(deps): update dependency containers/automation_images to v20230601
  * fix(deps): update rust crate trust-dns-server to 0.22.1
  * chore(deps): update rust crate chrono to 0.4.26
  * fix(deps): update rust crate tokio to 1.28.2
  * fix(deps): update rust crate log to 0.4.18
  * chore(deps): update rust crate chrono to 0.4.25
  * fix(deps): update rust crate clap to 4.3.0
  * chore(deps): update dependency containers/automation_images to v20230517
  * fix(deps): update rust crate tokio to 1.28.1
  * chore(deps): update dependency containers/automation_images to v20230426
  * fix(deps): update rust crate clap to 4.2.7
  * fix(deps): update rust crate anyhow to 1.0.71
  * fix typo in makefile
  * fix(deps): update rust crate tokio to 1.28.0
  * fix(deps): update rust crate clap to 4.2.5
  * fix(deps): update rust crate syslog to ^6.1.0
  * fix(deps): update rust crate clap to 4.2.4
  * fix(deps): update rust crate clap to 4.2.3
  * fix(deps): update rust crate clap to v4
  * chore(deps): update dependency containers/automation_images to v20230405
  * bump to v1.7.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1689076800">- Disable restricting builds only for tier1 platforms
  i.e. only for x86_64 and aarch64 and enable for all.</changelog>
  <changelog author="danish.prakash@suse.com" date="1695902400">- Update to version 1.8.0:
  * Release v1.8.0
  * update release notes for v1.8.0
  * run cargo update
  * Packit: switch to @containers/packit-build team for copr failure notification comments
  * [CI:BUILD] Packit: tag @lsm5 on copr build failures
  * chore(deps): update rust crate chrono to 0.4.31
  * cargo: bump chrono to 0.4.30
  * test: IPv6 format is changed in v1.72.0
  * bump nix to 0.27.1
  * vendor: bump trust_dns_proto and trust_dns_client to 0.23.0
  * fix(deps): update rust crate trust-dns-server to 0.23.0
  * [CI:BUILD] rpm: spdx compatible license field
  * fix(deps): update rust crate anyhow to 1.0.75
  * fix(deps): update rust crate tokio to 1.32.0
  * chore(deps): update dependency containers/automation_images to v20230816
  * fix(deps): update rust crate tokio to 1.31.0
  * fix(deps): update rust crate anyhow to 1.0.74
  * fix(deps): update rust crate anyhow to 1.0.73
  * fix(deps): update rust crate log to 0.4.20
  * chore(deps): update dependency containers/automation_images to v20230809
  * fix(deps): update rust crate tokio to 1.30.0
  * fix(deps): update rust crate clap to 4.3.21
  * packit: Build PRs into default packit COPRs
  * chore(deps): update dependency containers/automation_images to v20230807
  * fix(deps): update rust crate anyhow to 1.0.72
  * fix(deps): update rust crate signal-hook to 0.3.17
  * fix(deps): update rust crate clap to 4.3.19
  * fix(deps): update rust crate clap to 4.3.15
  * fix(deps): update rust crate signal-hook to 0.3.16
  * [CI:BUILD] Packit: remove pre-sync action
  * fix(deps): update rust crate clap to 4.3.11
  * fix(deps): update rust crate tokio to 1.29.1
  * fix(deps): update rust crate clap to 4.3.10
  * [CI:BUILD] RPM: cleanup spec and fix eln builds
  * bump to v1.8.0-devel</changelog>
  <changelog author="danish.prakash@suse.com" date="1701345600">- Update to version 1.9.0:
  * Release v1.9.0
  * v1.9.0 Update release notes
  * run cargo update
  * chore(deps): update dependency containers/automation_images to v20231116
  * fix(deps): update rust crate tokio to 1.34.0
  * fix(deps): update rust crate async-broadcast to 0.6.0
  * update trust-dns to hickory
  * fix(deps): update rust crate futures-util to 0.3.29
  * fix(deps): update rust crate trust-dns-server to 0.23.2
  * fix(deps): update rust crate trust-dns-proto to 0.23.2
  * tmt: initial enablement
  * aardvark main: change error reporting
  * chore(deps): update dependency containers/automation_images to v20231004
  * fix(deps): update rust crate trust-dns-proto to 0.23.1
  * fix(deps): update rust crate trust-dns-client to 0.23.1
  * clippy: some format fixes
  * fix(deps): update rust crate tokio to 1.33.0
  * Bump to v1.9.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1706184000">- Update to version 1.10.0:
  * Release 1.10.0
  * Release notes for 1.10.0
  * chore(deps): update rust crate chrono to 0.4.32
  * chore(deps): update dependency containers/automation_images to v20240102
  * fix(deps): update rust crate futures-util to 0.3.30
  * fix(deps): update rust crate anyhow to 1.0.79
  * fix(deps): update rust crate tokio to 1.35.1
  * chore(deps): update dependency containers/automation_images to v20231208
  * fix(deps): update rust crate tokio to 1.35.0
  * fix duplicated IP CI flake
  * server: remove unused kill switch
  * fix(deps): update rust crate clap to ~4.4.10
  * Bump working version to v1.10.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1717416000">- Remove redundant source: cargo_config
- Update to version 1.11.0:
  * Release v1.11.0
  * v1.11.0 release notes
  * run cargo update
  * chore(deps): update dependency containers/automation_images to v20240529
  * Internal networks cannot make external DNS requests
  * fix(deps): update rust crate anyhow to 1.0.86
  * fix(deps): update rust crate nix to 0.29.0
  * [skip-ci] RPM: use default __cargo macro across all envs
  * chore(deps): update dependency containers/automation_images to v20240513
  * fix(deps): update rust crate anyhow to 1.0.83
  * [skip-ci] Packit: separate `packages` key for rhel jobs
  * fix(deps): update rust crate libc to 0.2.154
  * [skip-ci] Packit: enable rhel10, c10s tests and c10s downstream sync
  * [skip-ci] Packit: Remove EL8 jobs
  * fix(deps): update rust crate syslog to ^6.1.1
  * fix reverse ipv6 lookup test flake
  * fix(deps): update hickory-dns monorepo to 0.24.1
  * chore(deps): update rust crate chrono to 0.4.38
  * Don't tear down all server threads on SIGHUP (bsc#1224167)
  * fix(deps): update rust crate anyhow to 1.0.82
  * fix(deps): update rust crate tokio to 1.37.0
  * Update to nix-0.28.0
  * update chrono package
  * chore(deps): update dependency containers/automation_images to v20240320
  * fix(deps): update rust crate anyhow to 1.0.81
  * tests: check queried domain name in reverse lookup tests
  * fix: set name for answers in reverse lookups
  * chore: fix typo in runner script
  * chore: fix log message when doing reverse lookup
  * fix(deps): update rust crate log to 0.4.21
  * fix(deps): update rust crate anyhow to 1.0.80
  * chore(deps): update rust crate chrono to 0.4.34
  * fix(deps): update rust crate async-broadcast to 0.7.0
  * fix(deps): update rust crate tokio to 1.36.0
  * [CI:DOCS] Packit: disable bodhi tasks
  * chore(deps): update rust crate chrono to 0.4.33
  * Bump to 1.11.0-dev</changelog>
</package>
<package pkgid="499610eb025fcb432bdd554fad706335c12167a736122dac7ed2e34339e46ba0" name="aardvark-dns" arch="src">
  <version epoch="0" ver="1.11.0" rel="150500.3.6.1"/>
  <changelog author="danish.prakash@suse.com" date="1676376000">- First version of aardvark-dns</changelog>
  <changelog author="danish.prakash@suse.com" date="1679054400">- Fix libexecdir issue on Leap and SLE</changelog>
  <changelog author="danish.prakash@suse.com" date="1681300800">- Update to version 1.6.0:
  * v1.6.0 release
  * Update release notes for v1.6.0
  * fix(deps): update rust crate tokio to 1.27.0
  * use lower TTL for contianer entries
  * fix(deps): update rust crate syslog to ^6.0.1
  * fix(deps): update rust crate futures-util to 0.3.28
  * chore(deps): update dependency containers/automation_images to v20230330
  * Disable Dependabot in favor of Renovate
  * chore(deps): update dependency containers/automation_images to v20230320
  * build(deps): bump futures-util from 0.3.26 to 0.3.27
  * [CI:BUILD] Packit: trigger builds on commit to main branch
  * build(deps): bump anyhow from 1.0.68 to 1.0.70
  * fix lint issue with new rust version 1.68
  * Cirrus: Update to newer CI VM images
  * build(deps): bump chrono from 0.4.23 to 0.4.24
  * build(deps): bump libc from 0.2.139 to 0.2.140
  * build(deps): bump async-broadcast from 0.5.0 to 0.5.1
  * build(deps): bump signal-hook from 0.3.14 to 0.3.15
  * build(deps): bump futures-util from 0.3.25 to 0.3.26
  * build(deps): bump tokio from 1.25.0 to 1.26.0
  * [CI:DOCS] Clarify packit related comments
  * [CI:BUILD] Packit: initial enablement
  * Allow custom cargo binary path
  * Switch to explicit platform list for `cargo vendor-filterer`
  * bump to v1.6.0-dev
  * Add renovate.json5
  * Cirrus: Groom rust cache before updating</changelog>
  <changelog author="danish.prakash@suse.com" date="1688385600">- Update to version 1.7.0:
  * release v1.7.0
  * Update release notes for v1.7.0
  * fix(deps): update rust crate tokio to 1.29.0
  * fix(deps): update rust crate clap to 4.3.8
  * fix(deps): update rust crate clap to 4.3.5
  * run cargo update
  * [CI:BUILD] Packit: add Fedora downstream tasks
  * fix(deps): update rust crate clap to 4.3.4
  * chore(deps): update dependency containers/automation_images to v20230614
  * fix(deps): update rust crate clap to 4.3.3
  * fix(deps): update rust crate log to 0.4.19
  * fix(deps): update rust crate clap to 4.3.2
  * fix(deps): update rust crate clap to 4.3.1
  * cirrus: remove verify_vendor task
  * chore(deps): update dependency containers/automation_images to v20230601
  * fix(deps): update rust crate trust-dns-server to 0.22.1
  * chore(deps): update rust crate chrono to 0.4.26
  * fix(deps): update rust crate tokio to 1.28.2
  * fix(deps): update rust crate log to 0.4.18
  * chore(deps): update rust crate chrono to 0.4.25
  * fix(deps): update rust crate clap to 4.3.0
  * chore(deps): update dependency containers/automation_images to v20230517
  * fix(deps): update rust crate tokio to 1.28.1
  * chore(deps): update dependency containers/automation_images to v20230426
  * fix(deps): update rust crate clap to 4.2.7
  * fix(deps): update rust crate anyhow to 1.0.71
  * fix typo in makefile
  * fix(deps): update rust crate tokio to 1.28.0
  * fix(deps): update rust crate clap to 4.2.5
  * fix(deps): update rust crate syslog to ^6.1.0
  * fix(deps): update rust crate clap to 4.2.4
  * fix(deps): update rust crate clap to 4.2.3
  * fix(deps): update rust crate clap to v4
  * chore(deps): update dependency containers/automation_images to v20230405
  * bump to v1.7.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1689076800">- Disable restricting builds only for tier1 platforms
  i.e. only for x86_64 and aarch64 and enable for all.</changelog>
  <changelog author="danish.prakash@suse.com" date="1695902400">- Update to version 1.8.0:
  * Release v1.8.0
  * update release notes for v1.8.0
  * run cargo update
  * Packit: switch to @containers/packit-build team for copr failure notification comments
  * [CI:BUILD] Packit: tag @lsm5 on copr build failures
  * chore(deps): update rust crate chrono to 0.4.31
  * cargo: bump chrono to 0.4.30
  * test: IPv6 format is changed in v1.72.0
  * bump nix to 0.27.1
  * vendor: bump trust_dns_proto and trust_dns_client to 0.23.0
  * fix(deps): update rust crate trust-dns-server to 0.23.0
  * [CI:BUILD] rpm: spdx compatible license field
  * fix(deps): update rust crate anyhow to 1.0.75
  * fix(deps): update rust crate tokio to 1.32.0
  * chore(deps): update dependency containers/automation_images to v20230816
  * fix(deps): update rust crate tokio to 1.31.0
  * fix(deps): update rust crate anyhow to 1.0.74
  * fix(deps): update rust crate anyhow to 1.0.73
  * fix(deps): update rust crate log to 0.4.20
  * chore(deps): update dependency containers/automation_images to v20230809
  * fix(deps): update rust crate tokio to 1.30.0
  * fix(deps): update rust crate clap to 4.3.21
  * packit: Build PRs into default packit COPRs
  * chore(deps): update dependency containers/automation_images to v20230807
  * fix(deps): update rust crate anyhow to 1.0.72
  * fix(deps): update rust crate signal-hook to 0.3.17
  * fix(deps): update rust crate clap to 4.3.19
  * fix(deps): update rust crate clap to 4.3.15
  * fix(deps): update rust crate signal-hook to 0.3.16
  * [CI:BUILD] Packit: remove pre-sync action
  * fix(deps): update rust crate clap to 4.3.11
  * fix(deps): update rust crate tokio to 1.29.1
  * fix(deps): update rust crate clap to 4.3.10
  * [CI:BUILD] RPM: cleanup spec and fix eln builds
  * bump to v1.8.0-devel</changelog>
  <changelog author="danish.prakash@suse.com" date="1701345600">- Update to version 1.9.0:
  * Release v1.9.0
  * v1.9.0 Update release notes
  * run cargo update
  * chore(deps): update dependency containers/automation_images to v20231116
  * fix(deps): update rust crate tokio to 1.34.0
  * fix(deps): update rust crate async-broadcast to 0.6.0
  * update trust-dns to hickory
  * fix(deps): update rust crate futures-util to 0.3.29
  * fix(deps): update rust crate trust-dns-server to 0.23.2
  * fix(deps): update rust crate trust-dns-proto to 0.23.2
  * tmt: initial enablement
  * aardvark main: change error reporting
  * chore(deps): update dependency containers/automation_images to v20231004
  * fix(deps): update rust crate trust-dns-proto to 0.23.1
  * fix(deps): update rust crate trust-dns-client to 0.23.1
  * clippy: some format fixes
  * fix(deps): update rust crate tokio to 1.33.0
  * Bump to v1.9.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1706184000">- Update to version 1.10.0:
  * Release 1.10.0
  * Release notes for 1.10.0
  * chore(deps): update rust crate chrono to 0.4.32
  * chore(deps): update dependency containers/automation_images to v20240102
  * fix(deps): update rust crate futures-util to 0.3.30
  * fix(deps): update rust crate anyhow to 1.0.79
  * fix(deps): update rust crate tokio to 1.35.1
  * chore(deps): update dependency containers/automation_images to v20231208
  * fix(deps): update rust crate tokio to 1.35.0
  * fix duplicated IP CI flake
  * server: remove unused kill switch
  * fix(deps): update rust crate clap to ~4.4.10
  * Bump working version to v1.10.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1717416000">- Remove redundant source: cargo_config
- Update to version 1.11.0:
  * Release v1.11.0
  * v1.11.0 release notes
  * run cargo update
  * chore(deps): update dependency containers/automation_images to v20240529
  * Internal networks cannot make external DNS requests
  * fix(deps): update rust crate anyhow to 1.0.86
  * fix(deps): update rust crate nix to 0.29.0
  * [skip-ci] RPM: use default __cargo macro across all envs
  * chore(deps): update dependency containers/automation_images to v20240513
  * fix(deps): update rust crate anyhow to 1.0.83
  * [skip-ci] Packit: separate `packages` key for rhel jobs
  * fix(deps): update rust crate libc to 0.2.154
  * [skip-ci] Packit: enable rhel10, c10s tests and c10s downstream sync
  * [skip-ci] Packit: Remove EL8 jobs
  * fix(deps): update rust crate syslog to ^6.1.1
  * fix reverse ipv6 lookup test flake
  * fix(deps): update hickory-dns monorepo to 0.24.1
  * chore(deps): update rust crate chrono to 0.4.38
  * Don't tear down all server threads on SIGHUP (bsc#1224167)
  * fix(deps): update rust crate anyhow to 1.0.82
  * fix(deps): update rust crate tokio to 1.37.0
  * Update to nix-0.28.0
  * update chrono package
  * chore(deps): update dependency containers/automation_images to v20240320
  * fix(deps): update rust crate anyhow to 1.0.81
  * tests: check queried domain name in reverse lookup tests
  * fix: set name for answers in reverse lookups
  * chore: fix typo in runner script
  * chore: fix log message when doing reverse lookup
  * fix(deps): update rust crate log to 0.4.21
  * fix(deps): update rust crate anyhow to 1.0.80
  * chore(deps): update rust crate chrono to 0.4.34
  * fix(deps): update rust crate async-broadcast to 0.7.0
  * fix(deps): update rust crate tokio to 1.36.0
  * [CI:DOCS] Packit: disable bodhi tasks
  * chore(deps): update rust crate chrono to 0.4.33
  * Bump to 1.11.0-dev</changelog>
</package>
<package pkgid="10b88f9f5ec5363ee8d4399db52288a1e432298bb6b121223217bc7ad57fb076" name="aardvark-dns" arch="x86_64">
  <version epoch="0" ver="1.11.0" rel="150500.3.6.1"/>
  <changelog author="danish.prakash@suse.com" date="1676376000">- First version of aardvark-dns</changelog>
  <changelog author="danish.prakash@suse.com" date="1679054400">- Fix libexecdir issue on Leap and SLE</changelog>
  <changelog author="danish.prakash@suse.com" date="1681300800">- Update to version 1.6.0:
  * v1.6.0 release
  * Update release notes for v1.6.0
  * fix(deps): update rust crate tokio to 1.27.0
  * use lower TTL for contianer entries
  * fix(deps): update rust crate syslog to ^6.0.1
  * fix(deps): update rust crate futures-util to 0.3.28
  * chore(deps): update dependency containers/automation_images to v20230330
  * Disable Dependabot in favor of Renovate
  * chore(deps): update dependency containers/automation_images to v20230320
  * build(deps): bump futures-util from 0.3.26 to 0.3.27
  * [CI:BUILD] Packit: trigger builds on commit to main branch
  * build(deps): bump anyhow from 1.0.68 to 1.0.70
  * fix lint issue with new rust version 1.68
  * Cirrus: Update to newer CI VM images
  * build(deps): bump chrono from 0.4.23 to 0.4.24
  * build(deps): bump libc from 0.2.139 to 0.2.140
  * build(deps): bump async-broadcast from 0.5.0 to 0.5.1
  * build(deps): bump signal-hook from 0.3.14 to 0.3.15
  * build(deps): bump futures-util from 0.3.25 to 0.3.26
  * build(deps): bump tokio from 1.25.0 to 1.26.0
  * [CI:DOCS] Clarify packit related comments
  * [CI:BUILD] Packit: initial enablement
  * Allow custom cargo binary path
  * Switch to explicit platform list for `cargo vendor-filterer`
  * bump to v1.6.0-dev
  * Add renovate.json5
  * Cirrus: Groom rust cache before updating</changelog>
  <changelog author="danish.prakash@suse.com" date="1688385600">- Update to version 1.7.0:
  * release v1.7.0
  * Update release notes for v1.7.0
  * fix(deps): update rust crate tokio to 1.29.0
  * fix(deps): update rust crate clap to 4.3.8
  * fix(deps): update rust crate clap to 4.3.5
  * run cargo update
  * [CI:BUILD] Packit: add Fedora downstream tasks
  * fix(deps): update rust crate clap to 4.3.4
  * chore(deps): update dependency containers/automation_images to v20230614
  * fix(deps): update rust crate clap to 4.3.3
  * fix(deps): update rust crate log to 0.4.19
  * fix(deps): update rust crate clap to 4.3.2
  * fix(deps): update rust crate clap to 4.3.1
  * cirrus: remove verify_vendor task
  * chore(deps): update dependency containers/automation_images to v20230601
  * fix(deps): update rust crate trust-dns-server to 0.22.1
  * chore(deps): update rust crate chrono to 0.4.26
  * fix(deps): update rust crate tokio to 1.28.2
  * fix(deps): update rust crate log to 0.4.18
  * chore(deps): update rust crate chrono to 0.4.25
  * fix(deps): update rust crate clap to 4.3.0
  * chore(deps): update dependency containers/automation_images to v20230517
  * fix(deps): update rust crate tokio to 1.28.1
  * chore(deps): update dependency containers/automation_images to v20230426
  * fix(deps): update rust crate clap to 4.2.7
  * fix(deps): update rust crate anyhow to 1.0.71
  * fix typo in makefile
  * fix(deps): update rust crate tokio to 1.28.0
  * fix(deps): update rust crate clap to 4.2.5
  * fix(deps): update rust crate syslog to ^6.1.0
  * fix(deps): update rust crate clap to 4.2.4
  * fix(deps): update rust crate clap to 4.2.3
  * fix(deps): update rust crate clap to v4
  * chore(deps): update dependency containers/automation_images to v20230405
  * bump to v1.7.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1689076800">- Disable restricting builds only for tier1 platforms
  i.e. only for x86_64 and aarch64 and enable for all.</changelog>
  <changelog author="danish.prakash@suse.com" date="1695902400">- Update to version 1.8.0:
  * Release v1.8.0
  * update release notes for v1.8.0
  * run cargo update
  * Packit: switch to @containers/packit-build team for copr failure notification comments
  * [CI:BUILD] Packit: tag @lsm5 on copr build failures
  * chore(deps): update rust crate chrono to 0.4.31
  * cargo: bump chrono to 0.4.30
  * test: IPv6 format is changed in v1.72.0
  * bump nix to 0.27.1
  * vendor: bump trust_dns_proto and trust_dns_client to 0.23.0
  * fix(deps): update rust crate trust-dns-server to 0.23.0
  * [CI:BUILD] rpm: spdx compatible license field
  * fix(deps): update rust crate anyhow to 1.0.75
  * fix(deps): update rust crate tokio to 1.32.0
  * chore(deps): update dependency containers/automation_images to v20230816
  * fix(deps): update rust crate tokio to 1.31.0
  * fix(deps): update rust crate anyhow to 1.0.74
  * fix(deps): update rust crate anyhow to 1.0.73
  * fix(deps): update rust crate log to 0.4.20
  * chore(deps): update dependency containers/automation_images to v20230809
  * fix(deps): update rust crate tokio to 1.30.0
  * fix(deps): update rust crate clap to 4.3.21
  * packit: Build PRs into default packit COPRs
  * chore(deps): update dependency containers/automation_images to v20230807
  * fix(deps): update rust crate anyhow to 1.0.72
  * fix(deps): update rust crate signal-hook to 0.3.17
  * fix(deps): update rust crate clap to 4.3.19
  * fix(deps): update rust crate clap to 4.3.15
  * fix(deps): update rust crate signal-hook to 0.3.16
  * [CI:BUILD] Packit: remove pre-sync action
  * fix(deps): update rust crate clap to 4.3.11
  * fix(deps): update rust crate tokio to 1.29.1
  * fix(deps): update rust crate clap to 4.3.10
  * [CI:BUILD] RPM: cleanup spec and fix eln builds
  * bump to v1.8.0-devel</changelog>
  <changelog author="danish.prakash@suse.com" date="1701345600">- Update to version 1.9.0:
  * Release v1.9.0
  * v1.9.0 Update release notes
  * run cargo update
  * chore(deps): update dependency containers/automation_images to v20231116
  * fix(deps): update rust crate tokio to 1.34.0
  * fix(deps): update rust crate async-broadcast to 0.6.0
  * update trust-dns to hickory
  * fix(deps): update rust crate futures-util to 0.3.29
  * fix(deps): update rust crate trust-dns-server to 0.23.2
  * fix(deps): update rust crate trust-dns-proto to 0.23.2
  * tmt: initial enablement
  * aardvark main: change error reporting
  * chore(deps): update dependency containers/automation_images to v20231004
  * fix(deps): update rust crate trust-dns-proto to 0.23.1
  * fix(deps): update rust crate trust-dns-client to 0.23.1
  * clippy: some format fixes
  * fix(deps): update rust crate tokio to 1.33.0
  * Bump to v1.9.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1706184000">- Update to version 1.10.0:
  * Release 1.10.0
  * Release notes for 1.10.0
  * chore(deps): update rust crate chrono to 0.4.32
  * chore(deps): update dependency containers/automation_images to v20240102
  * fix(deps): update rust crate futures-util to 0.3.30
  * fix(deps): update rust crate anyhow to 1.0.79
  * fix(deps): update rust crate tokio to 1.35.1
  * chore(deps): update dependency containers/automation_images to v20231208
  * fix(deps): update rust crate tokio to 1.35.0
  * fix duplicated IP CI flake
  * server: remove unused kill switch
  * fix(deps): update rust crate clap to ~4.4.10
  * Bump working version to v1.10.0-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1717416000">- Remove redundant source: cargo_config
- Update to version 1.11.0:
  * Release v1.11.0
  * v1.11.0 release notes
  * run cargo update
  * chore(deps): update dependency containers/automation_images to v20240529
  * Internal networks cannot make external DNS requests
  * fix(deps): update rust crate anyhow to 1.0.86
  * fix(deps): update rust crate nix to 0.29.0
  * [skip-ci] RPM: use default __cargo macro across all envs
  * chore(deps): update dependency containers/automation_images to v20240513
  * fix(deps): update rust crate anyhow to 1.0.83
  * [skip-ci] Packit: separate `packages` key for rhel jobs
  * fix(deps): update rust crate libc to 0.2.154
  * [skip-ci] Packit: enable rhel10, c10s tests and c10s downstream sync
  * [skip-ci] Packit: Remove EL8 jobs
  * fix(deps): update rust crate syslog to ^6.1.1
  * fix reverse ipv6 lookup test flake
  * fix(deps): update hickory-dns monorepo to 0.24.1
  * chore(deps): update rust crate chrono to 0.4.38
  * Don't tear down all server threads on SIGHUP (bsc#1224167)
  * fix(deps): update rust crate anyhow to 1.0.82
  * fix(deps): update rust crate tokio to 1.37.0
  * Update to nix-0.28.0
  * update chrono package
  * chore(deps): update dependency containers/automation_images to v20240320
  * fix(deps): update rust crate anyhow to 1.0.81
  * tests: check queried domain name in reverse lookup tests
  * fix: set name for answers in reverse lookups
  * chore: fix typo in runner script
  * chore: fix log message when doing reverse lookup
  * fix(deps): update rust crate log to 0.4.21
  * fix(deps): update rust crate anyhow to 1.0.80
  * chore(deps): update rust crate chrono to 0.4.34
  * fix(deps): update rust crate async-broadcast to 0.7.0
  * fix(deps): update rust crate tokio to 1.36.0
  * [CI:DOCS] Packit: disable bodhi tasks
  * chore(deps): update rust crate chrono to 0.4.33
  * Bump to 1.11.0-dev</changelog>
</package>
<package pkgid="aadfaf231783955907aa0712b8327b209d2fc677185b1fbce21455dc449f2f9b" name="alsa-utils" arch="aarch64">
  <version epoch="0" ver="1.2.10" rel="150600.3.3.6"/>
  <changelog author="tiwai@suse.de" date="1591704000">- Update to alsa-utils 1.2.3:
  including previous fixes, see the detailed changes at:
  https://www.alsa-project.org/wiki/Detailed_changes_v1.2.2_v1.2.3
- Dropped obsoleted patches:
  0001-alsaloop-reduce-cumulative-error-caused-by-non-atomi.patch
  0002-alsactl-don-t-exit-on-EINTR-from-epoll_wait.patch
  0003-alsactl-avoid-needless-wakeups-in-monitor-loop.patch
  0004-alsactl-fix-error-handling-for-sched_setscheduler-ca.patch
  0005-alsa-info.sh-add-ALT-to-DISTRO-list.patch
  0006-alsa-info-initial-rpm-deb-package-info.patch
  0007-alsa-info.sh-increase-version-to-0.4.65.patch</changelog>
  <changelog author="tiwai@suse.de" date="1601380800">- Fix the directory to save asound.state again to /var/lib/alsa,
  which was mistakenly changed to /etc</changelog>
  <changelog author="tiwai@suse.de" date="1601899200">- Conditionally add buildreq alsa-topology-devel to fix build
  errors</changelog>
  <changelog author="tiwai@suse.de" date="1603022400">- Use /run/lock for alsactl lock directory (bsc#1177826)
- Migrate the old asound.state file if the new path isn't present
  yet (bsc#1177826)</changelog>
  <changelog author="tiwai@suse.de" date="1603281600">- Update to alsa-utils 1.2.3:
  alsactl extension for disabling UCM, alsa-info.sh enhancements,
  various fixes and documentation updates.
  See details in
    https://alsa-project.org/wiki/Changes_v1.2.3.2_v1.2.4</changelog>
  <changelog author="tiwai@suse.de" date="1607688000">- Fix alsactl restore behavior during locking (boo#1179904):
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
- Remove unnecessary condition for alsa-restore.service
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
- Fix dependency in sound-extra.service</changelog>
  <changelog author="tiwai@suse.de" date="1611230400">- Backport upstream fixes:
  various fixes in aplay, alsamixer, alsactl and alsaloop, updated
  translations, etc:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="tiwai@suse.de" date="1616068800">- Fix superfluous asound.state migration (bsc#1183672)</changelog>
  <changelog author="tiwai@suse.de" date="1619438400">- Suppress automatic update of alsa-info.sh (bsc#1185280):
  alsa-info-no-update-for-distro-script.patch</changelog>
  <changelog author="tiwai@suse.de" date="1623672000">- Update to alsa-utils 1.2.5:
  a major version up, including previous patches
  https://www.alsa-project.org/wiki/Changes_v1.2.4_v1.2.5
- Update to alsa-utils 1.2.5.1:
  a small bugfix release
  https://www.alsa-project.org/wiki/Changes_v1.2.5_v1.2.5.1
- Drop the obsoleted patches:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1627473600">- Added hardening to systemd service(s). Modified:
  * sound-extra.service</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="tiwai@suse.de" date="1638792000">- Update to alsa-utils 1.2.6:
  various updates / fixes for alsactl, amidi, alsaloop, alsamixer,
  alsatplg, amixer, aplay and aseqnet.  Details are found in
    https://alsa-project.org/wiki/Changes_v1.2.5.1_v1.2.6#alsa-utils
- Update the download URL
- Add *.sig file for the tarball</changelog>
  <changelog author="tiwai@suse.de" date="1642766400">- Fix alsamixer color config regression:
  0001-alsamixer-Fix-regression-in-color-setup.patch</changelog>
  <changelog author="tiwai@suse.de" date="1643371200">- Fix the broken mouse support on alsamixer:
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1654084800">- Update to alsa-utils 1.2.7:
  Enhancement and fixes of alsactl, speaker-test cleanup,
  alsatplg enhancements, arecord ghost data fix, etc.
  For details see:
  https://www.alsa-project.org/wiki/Changes_v1.2.6.3_v1.2.7#alsa-utils
- Drop obsoleted patches:
  0001-alsamixer-Fix-regression-in-color-setup.patch
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1666699200">- Update to alsa-utils 1.2.8 (jsc#PED-850):
  automake update, minor alsactl, amixer and aplay fixes.
  https://www.alsa-project.org/wiki/Changes_v1.2.7.2_v1.2.8
- Add keyring</changelog>
  <changelog author="tiwai@suse.com" date="1683547200">- Update to alsa-utils 1.2.9:
  BSD build fix, and various updates for alsactl, amidi, axfer,
  alsa-info.sh, alsaloop, alsatplg, alsaucm, aplay, abat.
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.8_v1.2.9#alsa-utils</changelog>
  <changelog author="tiwai@suse.com" date="1693828800">- Update to alsa-utils 1.2.10 (jsc#PED-6566):
  * MIDI 2.0 / UMP support for sequencer programs
  * nhlt: add nhlt-dmic-info utility
  * Build fixes and cleanups
  * speaker-test: allow large buffer and period time setup - up to 100 seconds
  * various topology fixes
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.9_v1.2.10#alsa-utils
- Fix the builds with old gcc:
  0001-axfer-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0002-amidi-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0003-alsaloop-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch
  0004-bat-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0005-seq-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0006-alsaucm-use-ATTRIBUTE_UNUSED-instead-remove-argument.patch
  0007-topology-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1717070400">- Require tree which is used by alsa-info.sh (bsc#1225665)</changelog>
</package>
<package pkgid="3f5b5e08f99e34808667930276a6e540149ecb7a30738e6782587a65cab763a0" name="alsa-utils" arch="ppc64le">
  <version epoch="0" ver="1.2.10" rel="150600.3.3.6"/>
  <changelog author="tiwai@suse.de" date="1591704000">- Update to alsa-utils 1.2.3:
  including previous fixes, see the detailed changes at:
  https://www.alsa-project.org/wiki/Detailed_changes_v1.2.2_v1.2.3
- Dropped obsoleted patches:
  0001-alsaloop-reduce-cumulative-error-caused-by-non-atomi.patch
  0002-alsactl-don-t-exit-on-EINTR-from-epoll_wait.patch
  0003-alsactl-avoid-needless-wakeups-in-monitor-loop.patch
  0004-alsactl-fix-error-handling-for-sched_setscheduler-ca.patch
  0005-alsa-info.sh-add-ALT-to-DISTRO-list.patch
  0006-alsa-info-initial-rpm-deb-package-info.patch
  0007-alsa-info.sh-increase-version-to-0.4.65.patch</changelog>
  <changelog author="tiwai@suse.de" date="1601380800">- Fix the directory to save asound.state again to /var/lib/alsa,
  which was mistakenly changed to /etc</changelog>
  <changelog author="tiwai@suse.de" date="1601899200">- Conditionally add buildreq alsa-topology-devel to fix build
  errors</changelog>
  <changelog author="tiwai@suse.de" date="1603022400">- Use /run/lock for alsactl lock directory (bsc#1177826)
- Migrate the old asound.state file if the new path isn't present
  yet (bsc#1177826)</changelog>
  <changelog author="tiwai@suse.de" date="1603281600">- Update to alsa-utils 1.2.3:
  alsactl extension for disabling UCM, alsa-info.sh enhancements,
  various fixes and documentation updates.
  See details in
    https://alsa-project.org/wiki/Changes_v1.2.3.2_v1.2.4</changelog>
  <changelog author="tiwai@suse.de" date="1607688000">- Fix alsactl restore behavior during locking (boo#1179904):
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
- Remove unnecessary condition for alsa-restore.service
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
- Fix dependency in sound-extra.service</changelog>
  <changelog author="tiwai@suse.de" date="1611230400">- Backport upstream fixes:
  various fixes in aplay, alsamixer, alsactl and alsaloop, updated
  translations, etc:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="tiwai@suse.de" date="1616068800">- Fix superfluous asound.state migration (bsc#1183672)</changelog>
  <changelog author="tiwai@suse.de" date="1619438400">- Suppress automatic update of alsa-info.sh (bsc#1185280):
  alsa-info-no-update-for-distro-script.patch</changelog>
  <changelog author="tiwai@suse.de" date="1623672000">- Update to alsa-utils 1.2.5:
  a major version up, including previous patches
  https://www.alsa-project.org/wiki/Changes_v1.2.4_v1.2.5
- Update to alsa-utils 1.2.5.1:
  a small bugfix release
  https://www.alsa-project.org/wiki/Changes_v1.2.5_v1.2.5.1
- Drop the obsoleted patches:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1627473600">- Added hardening to systemd service(s). Modified:
  * sound-extra.service</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="tiwai@suse.de" date="1638792000">- Update to alsa-utils 1.2.6:
  various updates / fixes for alsactl, amidi, alsaloop, alsamixer,
  alsatplg, amixer, aplay and aseqnet.  Details are found in
    https://alsa-project.org/wiki/Changes_v1.2.5.1_v1.2.6#alsa-utils
- Update the download URL
- Add *.sig file for the tarball</changelog>
  <changelog author="tiwai@suse.de" date="1642766400">- Fix alsamixer color config regression:
  0001-alsamixer-Fix-regression-in-color-setup.patch</changelog>
  <changelog author="tiwai@suse.de" date="1643371200">- Fix the broken mouse support on alsamixer:
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1654084800">- Update to alsa-utils 1.2.7:
  Enhancement and fixes of alsactl, speaker-test cleanup,
  alsatplg enhancements, arecord ghost data fix, etc.
  For details see:
  https://www.alsa-project.org/wiki/Changes_v1.2.6.3_v1.2.7#alsa-utils
- Drop obsoleted patches:
  0001-alsamixer-Fix-regression-in-color-setup.patch
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1666699200">- Update to alsa-utils 1.2.8 (jsc#PED-850):
  automake update, minor alsactl, amixer and aplay fixes.
  https://www.alsa-project.org/wiki/Changes_v1.2.7.2_v1.2.8
- Add keyring</changelog>
  <changelog author="tiwai@suse.com" date="1683547200">- Update to alsa-utils 1.2.9:
  BSD build fix, and various updates for alsactl, amidi, axfer,
  alsa-info.sh, alsaloop, alsatplg, alsaucm, aplay, abat.
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.8_v1.2.9#alsa-utils</changelog>
  <changelog author="tiwai@suse.com" date="1693828800">- Update to alsa-utils 1.2.10 (jsc#PED-6566):
  * MIDI 2.0 / UMP support for sequencer programs
  * nhlt: add nhlt-dmic-info utility
  * Build fixes and cleanups
  * speaker-test: allow large buffer and period time setup - up to 100 seconds
  * various topology fixes
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.9_v1.2.10#alsa-utils
- Fix the builds with old gcc:
  0001-axfer-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0002-amidi-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0003-alsaloop-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch
  0004-bat-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0005-seq-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0006-alsaucm-use-ATTRIBUTE_UNUSED-instead-remove-argument.patch
  0007-topology-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1717070400">- Require tree which is used by alsa-info.sh (bsc#1225665)</changelog>
</package>
<package pkgid="6e527990f3414ab6cda072d7f7b8d0ddda3393ac1bf66f2e09d21ddbf4baf930" name="alsa-utils" arch="s390x">
  <version epoch="0" ver="1.2.10" rel="150600.3.3.6"/>
  <changelog author="tiwai@suse.de" date="1591704000">- Update to alsa-utils 1.2.3:
  including previous fixes, see the detailed changes at:
  https://www.alsa-project.org/wiki/Detailed_changes_v1.2.2_v1.2.3
- Dropped obsoleted patches:
  0001-alsaloop-reduce-cumulative-error-caused-by-non-atomi.patch
  0002-alsactl-don-t-exit-on-EINTR-from-epoll_wait.patch
  0003-alsactl-avoid-needless-wakeups-in-monitor-loop.patch
  0004-alsactl-fix-error-handling-for-sched_setscheduler-ca.patch
  0005-alsa-info.sh-add-ALT-to-DISTRO-list.patch
  0006-alsa-info-initial-rpm-deb-package-info.patch
  0007-alsa-info.sh-increase-version-to-0.4.65.patch</changelog>
  <changelog author="tiwai@suse.de" date="1601380800">- Fix the directory to save asound.state again to /var/lib/alsa,
  which was mistakenly changed to /etc</changelog>
  <changelog author="tiwai@suse.de" date="1601899200">- Conditionally add buildreq alsa-topology-devel to fix build
  errors</changelog>
  <changelog author="tiwai@suse.de" date="1603022400">- Use /run/lock for alsactl lock directory (bsc#1177826)
- Migrate the old asound.state file if the new path isn't present
  yet (bsc#1177826)</changelog>
  <changelog author="tiwai@suse.de" date="1603281600">- Update to alsa-utils 1.2.3:
  alsactl extension for disabling UCM, alsa-info.sh enhancements,
  various fixes and documentation updates.
  See details in
    https://alsa-project.org/wiki/Changes_v1.2.3.2_v1.2.4</changelog>
  <changelog author="tiwai@suse.de" date="1607688000">- Fix alsactl restore behavior during locking (boo#1179904):
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
- Remove unnecessary condition for alsa-restore.service
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
- Fix dependency in sound-extra.service</changelog>
  <changelog author="tiwai@suse.de" date="1611230400">- Backport upstream fixes:
  various fixes in aplay, alsamixer, alsactl and alsaloop, updated
  translations, etc:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="tiwai@suse.de" date="1616068800">- Fix superfluous asound.state migration (bsc#1183672)</changelog>
  <changelog author="tiwai@suse.de" date="1619438400">- Suppress automatic update of alsa-info.sh (bsc#1185280):
  alsa-info-no-update-for-distro-script.patch</changelog>
  <changelog author="tiwai@suse.de" date="1623672000">- Update to alsa-utils 1.2.5:
  a major version up, including previous patches
  https://www.alsa-project.org/wiki/Changes_v1.2.4_v1.2.5
- Update to alsa-utils 1.2.5.1:
  a small bugfix release
  https://www.alsa-project.org/wiki/Changes_v1.2.5_v1.2.5.1
- Drop the obsoleted patches:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1627473600">- Added hardening to systemd service(s). Modified:
  * sound-extra.service</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="tiwai@suse.de" date="1638792000">- Update to alsa-utils 1.2.6:
  various updates / fixes for alsactl, amidi, alsaloop, alsamixer,
  alsatplg, amixer, aplay and aseqnet.  Details are found in
    https://alsa-project.org/wiki/Changes_v1.2.5.1_v1.2.6#alsa-utils
- Update the download URL
- Add *.sig file for the tarball</changelog>
  <changelog author="tiwai@suse.de" date="1642766400">- Fix alsamixer color config regression:
  0001-alsamixer-Fix-regression-in-color-setup.patch</changelog>
  <changelog author="tiwai@suse.de" date="1643371200">- Fix the broken mouse support on alsamixer:
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1654084800">- Update to alsa-utils 1.2.7:
  Enhancement and fixes of alsactl, speaker-test cleanup,
  alsatplg enhancements, arecord ghost data fix, etc.
  For details see:
  https://www.alsa-project.org/wiki/Changes_v1.2.6.3_v1.2.7#alsa-utils
- Drop obsoleted patches:
  0001-alsamixer-Fix-regression-in-color-setup.patch
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1666699200">- Update to alsa-utils 1.2.8 (jsc#PED-850):
  automake update, minor alsactl, amixer and aplay fixes.
  https://www.alsa-project.org/wiki/Changes_v1.2.7.2_v1.2.8
- Add keyring</changelog>
  <changelog author="tiwai@suse.com" date="1683547200">- Update to alsa-utils 1.2.9:
  BSD build fix, and various updates for alsactl, amidi, axfer,
  alsa-info.sh, alsaloop, alsatplg, alsaucm, aplay, abat.
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.8_v1.2.9#alsa-utils</changelog>
  <changelog author="tiwai@suse.com" date="1693828800">- Update to alsa-utils 1.2.10 (jsc#PED-6566):
  * MIDI 2.0 / UMP support for sequencer programs
  * nhlt: add nhlt-dmic-info utility
  * Build fixes and cleanups
  * speaker-test: allow large buffer and period time setup - up to 100 seconds
  * various topology fixes
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.9_v1.2.10#alsa-utils
- Fix the builds with old gcc:
  0001-axfer-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0002-amidi-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0003-alsaloop-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch
  0004-bat-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0005-seq-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0006-alsaucm-use-ATTRIBUTE_UNUSED-instead-remove-argument.patch
  0007-topology-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1717070400">- Require tree which is used by alsa-info.sh (bsc#1225665)</changelog>
</package>
<package pkgid="d375e08488dff04267649a9d60967f7ddcb9aec06d4856eb93c60eaae44aac14" name="alsa-utils" arch="src">
  <version epoch="0" ver="1.2.10" rel="150600.3.3.6"/>
  <changelog author="tiwai@suse.de" date="1591704000">- Update to alsa-utils 1.2.3:
  including previous fixes, see the detailed changes at:
  https://www.alsa-project.org/wiki/Detailed_changes_v1.2.2_v1.2.3
- Dropped obsoleted patches:
  0001-alsaloop-reduce-cumulative-error-caused-by-non-atomi.patch
  0002-alsactl-don-t-exit-on-EINTR-from-epoll_wait.patch
  0003-alsactl-avoid-needless-wakeups-in-monitor-loop.patch
  0004-alsactl-fix-error-handling-for-sched_setscheduler-ca.patch
  0005-alsa-info.sh-add-ALT-to-DISTRO-list.patch
  0006-alsa-info-initial-rpm-deb-package-info.patch
  0007-alsa-info.sh-increase-version-to-0.4.65.patch</changelog>
  <changelog author="tiwai@suse.de" date="1601380800">- Fix the directory to save asound.state again to /var/lib/alsa,
  which was mistakenly changed to /etc</changelog>
  <changelog author="tiwai@suse.de" date="1601899200">- Conditionally add buildreq alsa-topology-devel to fix build
  errors</changelog>
  <changelog author="tiwai@suse.de" date="1603022400">- Use /run/lock for alsactl lock directory (bsc#1177826)
- Migrate the old asound.state file if the new path isn't present
  yet (bsc#1177826)</changelog>
  <changelog author="tiwai@suse.de" date="1603281600">- Update to alsa-utils 1.2.3:
  alsactl extension for disabling UCM, alsa-info.sh enhancements,
  various fixes and documentation updates.
  See details in
    https://alsa-project.org/wiki/Changes_v1.2.3.2_v1.2.4</changelog>
  <changelog author="tiwai@suse.de" date="1607688000">- Fix alsactl restore behavior during locking (boo#1179904):
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
- Remove unnecessary condition for alsa-restore.service
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
- Fix dependency in sound-extra.service</changelog>
  <changelog author="tiwai@suse.de" date="1611230400">- Backport upstream fixes:
  various fixes in aplay, alsamixer, alsactl and alsaloop, updated
  translations, etc:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="tiwai@suse.de" date="1616068800">- Fix superfluous asound.state migration (bsc#1183672)</changelog>
  <changelog author="tiwai@suse.de" date="1619438400">- Suppress automatic update of alsa-info.sh (bsc#1185280):
  alsa-info-no-update-for-distro-script.patch</changelog>
  <changelog author="tiwai@suse.de" date="1623672000">- Update to alsa-utils 1.2.5:
  a major version up, including previous patches
  https://www.alsa-project.org/wiki/Changes_v1.2.4_v1.2.5
- Update to alsa-utils 1.2.5.1:
  a small bugfix release
  https://www.alsa-project.org/wiki/Changes_v1.2.5_v1.2.5.1
- Drop the obsoleted patches:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1627473600">- Added hardening to systemd service(s). Modified:
  * sound-extra.service</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="tiwai@suse.de" date="1638792000">- Update to alsa-utils 1.2.6:
  various updates / fixes for alsactl, amidi, alsaloop, alsamixer,
  alsatplg, amixer, aplay and aseqnet.  Details are found in
    https://alsa-project.org/wiki/Changes_v1.2.5.1_v1.2.6#alsa-utils
- Update the download URL
- Add *.sig file for the tarball</changelog>
  <changelog author="tiwai@suse.de" date="1642766400">- Fix alsamixer color config regression:
  0001-alsamixer-Fix-regression-in-color-setup.patch</changelog>
  <changelog author="tiwai@suse.de" date="1643371200">- Fix the broken mouse support on alsamixer:
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1654084800">- Update to alsa-utils 1.2.7:
  Enhancement and fixes of alsactl, speaker-test cleanup,
  alsatplg enhancements, arecord ghost data fix, etc.
  For details see:
  https://www.alsa-project.org/wiki/Changes_v1.2.6.3_v1.2.7#alsa-utils
- Drop obsoleted patches:
  0001-alsamixer-Fix-regression-in-color-setup.patch
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1666699200">- Update to alsa-utils 1.2.8 (jsc#PED-850):
  automake update, minor alsactl, amixer and aplay fixes.
  https://www.alsa-project.org/wiki/Changes_v1.2.7.2_v1.2.8
- Add keyring</changelog>
  <changelog author="tiwai@suse.com" date="1683547200">- Update to alsa-utils 1.2.9:
  BSD build fix, and various updates for alsactl, amidi, axfer,
  alsa-info.sh, alsaloop, alsatplg, alsaucm, aplay, abat.
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.8_v1.2.9#alsa-utils</changelog>
  <changelog author="tiwai@suse.com" date="1693828800">- Update to alsa-utils 1.2.10 (jsc#PED-6566):
  * MIDI 2.0 / UMP support for sequencer programs
  * nhlt: add nhlt-dmic-info utility
  * Build fixes and cleanups
  * speaker-test: allow large buffer and period time setup - up to 100 seconds
  * various topology fixes
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.9_v1.2.10#alsa-utils
- Fix the builds with old gcc:
  0001-axfer-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0002-amidi-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0003-alsaloop-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch
  0004-bat-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0005-seq-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0006-alsaucm-use-ATTRIBUTE_UNUSED-instead-remove-argument.patch
  0007-topology-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1717070400">- Require tree which is used by alsa-info.sh (bsc#1225665)</changelog>
</package>
<package pkgid="b8f325a5003dac4e0eb05e2d48d66f538225d38d6517fc5d90c0ed0df1ada08f" name="alsa-utils" arch="x86_64">
  <version epoch="0" ver="1.2.10" rel="150600.3.3.6"/>
  <changelog author="tiwai@suse.de" date="1591704000">- Update to alsa-utils 1.2.3:
  including previous fixes, see the detailed changes at:
  https://www.alsa-project.org/wiki/Detailed_changes_v1.2.2_v1.2.3
- Dropped obsoleted patches:
  0001-alsaloop-reduce-cumulative-error-caused-by-non-atomi.patch
  0002-alsactl-don-t-exit-on-EINTR-from-epoll_wait.patch
  0003-alsactl-avoid-needless-wakeups-in-monitor-loop.patch
  0004-alsactl-fix-error-handling-for-sched_setscheduler-ca.patch
  0005-alsa-info.sh-add-ALT-to-DISTRO-list.patch
  0006-alsa-info-initial-rpm-deb-package-info.patch
  0007-alsa-info.sh-increase-version-to-0.4.65.patch</changelog>
  <changelog author="tiwai@suse.de" date="1601380800">- Fix the directory to save asound.state again to /var/lib/alsa,
  which was mistakenly changed to /etc</changelog>
  <changelog author="tiwai@suse.de" date="1601899200">- Conditionally add buildreq alsa-topology-devel to fix build
  errors</changelog>
  <changelog author="tiwai@suse.de" date="1603022400">- Use /run/lock for alsactl lock directory (bsc#1177826)
- Migrate the old asound.state file if the new path isn't present
  yet (bsc#1177826)</changelog>
  <changelog author="tiwai@suse.de" date="1603281600">- Update to alsa-utils 1.2.3:
  alsactl extension for disabling UCM, alsa-info.sh enhancements,
  various fixes and documentation updates.
  See details in
    https://alsa-project.org/wiki/Changes_v1.2.3.2_v1.2.4</changelog>
  <changelog author="tiwai@suse.de" date="1607688000">- Fix alsactl restore behavior during locking (boo#1179904):
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
- Remove unnecessary condition for alsa-restore.service
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
- Fix dependency in sound-extra.service</changelog>
  <changelog author="tiwai@suse.de" date="1611230400">- Backport upstream fixes:
  various fixes in aplay, alsamixer, alsactl and alsaloop, updated
  translations, etc:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="tiwai@suse.de" date="1616068800">- Fix superfluous asound.state migration (bsc#1183672)</changelog>
  <changelog author="tiwai@suse.de" date="1619438400">- Suppress automatic update of alsa-info.sh (bsc#1185280):
  alsa-info-no-update-for-distro-script.patch</changelog>
  <changelog author="tiwai@suse.de" date="1623672000">- Update to alsa-utils 1.2.5:
  a major version up, including previous patches
  https://www.alsa-project.org/wiki/Changes_v1.2.4_v1.2.5
- Update to alsa-utils 1.2.5.1:
  a small bugfix release
  https://www.alsa-project.org/wiki/Changes_v1.2.5_v1.2.5.1
- Drop the obsoleted patches:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1627473600">- Added hardening to systemd service(s). Modified:
  * sound-extra.service</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="tiwai@suse.de" date="1638792000">- Update to alsa-utils 1.2.6:
  various updates / fixes for alsactl, amidi, alsaloop, alsamixer,
  alsatplg, amixer, aplay and aseqnet.  Details are found in
    https://alsa-project.org/wiki/Changes_v1.2.5.1_v1.2.6#alsa-utils
- Update the download URL
- Add *.sig file for the tarball</changelog>
  <changelog author="tiwai@suse.de" date="1642766400">- Fix alsamixer color config regression:
  0001-alsamixer-Fix-regression-in-color-setup.patch</changelog>
  <changelog author="tiwai@suse.de" date="1643371200">- Fix the broken mouse support on alsamixer:
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1654084800">- Update to alsa-utils 1.2.7:
  Enhancement and fixes of alsactl, speaker-test cleanup,
  alsatplg enhancements, arecord ghost data fix, etc.
  For details see:
  https://www.alsa-project.org/wiki/Changes_v1.2.6.3_v1.2.7#alsa-utils
- Drop obsoleted patches:
  0001-alsamixer-Fix-regression-in-color-setup.patch
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1666699200">- Update to alsa-utils 1.2.8 (jsc#PED-850):
  automake update, minor alsactl, amixer and aplay fixes.
  https://www.alsa-project.org/wiki/Changes_v1.2.7.2_v1.2.8
- Add keyring</changelog>
  <changelog author="tiwai@suse.com" date="1683547200">- Update to alsa-utils 1.2.9:
  BSD build fix, and various updates for alsactl, amidi, axfer,
  alsa-info.sh, alsaloop, alsatplg, alsaucm, aplay, abat.
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.8_v1.2.9#alsa-utils</changelog>
  <changelog author="tiwai@suse.com" date="1693828800">- Update to alsa-utils 1.2.10 (jsc#PED-6566):
  * MIDI 2.0 / UMP support for sequencer programs
  * nhlt: add nhlt-dmic-info utility
  * Build fixes and cleanups
  * speaker-test: allow large buffer and period time setup - up to 100 seconds
  * various topology fixes
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.9_v1.2.10#alsa-utils
- Fix the builds with old gcc:
  0001-axfer-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0002-amidi-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0003-alsaloop-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch
  0004-bat-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0005-seq-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0006-alsaucm-use-ATTRIBUTE_UNUSED-instead-remove-argument.patch
  0007-topology-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1717070400">- Require tree which is used by alsa-info.sh (bsc#1225665)</changelog>
</package>
<package pkgid="09451b04a6be37da44537ec0468de4db2425180e2b50ed0ac7e04f368e82656d" name="alsabat" arch="aarch64">
  <version epoch="0" ver="1.2.10" rel="150600.3.3.6"/>
  <changelog author="tiwai@suse.de" date="1591704000">- Update to alsa-utils 1.2.3:
  including previous fixes, see the detailed changes at:
  https://www.alsa-project.org/wiki/Detailed_changes_v1.2.2_v1.2.3
- Dropped obsoleted patches:
  0001-alsaloop-reduce-cumulative-error-caused-by-non-atomi.patch
  0002-alsactl-don-t-exit-on-EINTR-from-epoll_wait.patch
  0003-alsactl-avoid-needless-wakeups-in-monitor-loop.patch
  0004-alsactl-fix-error-handling-for-sched_setscheduler-ca.patch
  0005-alsa-info.sh-add-ALT-to-DISTRO-list.patch
  0006-alsa-info-initial-rpm-deb-package-info.patch
  0007-alsa-info.sh-increase-version-to-0.4.65.patch</changelog>
  <changelog author="tiwai@suse.de" date="1601380800">- Fix the directory to save asound.state again to /var/lib/alsa,
  which was mistakenly changed to /etc</changelog>
  <changelog author="tiwai@suse.de" date="1601899200">- Conditionally add buildreq alsa-topology-devel to fix build
  errors</changelog>
  <changelog author="tiwai@suse.de" date="1603022400">- Use /run/lock for alsactl lock directory (bsc#1177826)
- Migrate the old asound.state file if the new path isn't present
  yet (bsc#1177826)</changelog>
  <changelog author="tiwai@suse.de" date="1603281600">- Update to alsa-utils 1.2.3:
  alsactl extension for disabling UCM, alsa-info.sh enhancements,
  various fixes and documentation updates.
  See details in
    https://alsa-project.org/wiki/Changes_v1.2.3.2_v1.2.4</changelog>
  <changelog author="tiwai@suse.de" date="1607688000">- Fix alsactl restore behavior during locking (boo#1179904):
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
- Remove unnecessary condition for alsa-restore.service
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
- Fix dependency in sound-extra.service</changelog>
  <changelog author="tiwai@suse.de" date="1611230400">- Backport upstream fixes:
  various fixes in aplay, alsamixer, alsactl and alsaloop, updated
  translations, etc:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="tiwai@suse.de" date="1616068800">- Fix superfluous asound.state migration (bsc#1183672)</changelog>
  <changelog author="tiwai@suse.de" date="1619438400">- Suppress automatic update of alsa-info.sh (bsc#1185280):
  alsa-info-no-update-for-distro-script.patch</changelog>
  <changelog author="tiwai@suse.de" date="1623672000">- Update to alsa-utils 1.2.5:
  a major version up, including previous patches
  https://www.alsa-project.org/wiki/Changes_v1.2.4_v1.2.5
- Update to alsa-utils 1.2.5.1:
  a small bugfix release
  https://www.alsa-project.org/wiki/Changes_v1.2.5_v1.2.5.1
- Drop the obsoleted patches:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1627473600">- Added hardening to systemd service(s). Modified:
  * sound-extra.service</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="tiwai@suse.de" date="1638792000">- Update to alsa-utils 1.2.6:
  various updates / fixes for alsactl, amidi, alsaloop, alsamixer,
  alsatplg, amixer, aplay and aseqnet.  Details are found in
    https://alsa-project.org/wiki/Changes_v1.2.5.1_v1.2.6#alsa-utils
- Update the download URL
- Add *.sig file for the tarball</changelog>
  <changelog author="tiwai@suse.de" date="1642766400">- Fix alsamixer color config regression:
  0001-alsamixer-Fix-regression-in-color-setup.patch</changelog>
  <changelog author="tiwai@suse.de" date="1643371200">- Fix the broken mouse support on alsamixer:
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1654084800">- Update to alsa-utils 1.2.7:
  Enhancement and fixes of alsactl, speaker-test cleanup,
  alsatplg enhancements, arecord ghost data fix, etc.
  For details see:
  https://www.alsa-project.org/wiki/Changes_v1.2.6.3_v1.2.7#alsa-utils
- Drop obsoleted patches:
  0001-alsamixer-Fix-regression-in-color-setup.patch
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1666699200">- Update to alsa-utils 1.2.8 (jsc#PED-850):
  automake update, minor alsactl, amixer and aplay fixes.
  https://www.alsa-project.org/wiki/Changes_v1.2.7.2_v1.2.8
- Add keyring</changelog>
  <changelog author="tiwai@suse.com" date="1683547200">- Update to alsa-utils 1.2.9:
  BSD build fix, and various updates for alsactl, amidi, axfer,
  alsa-info.sh, alsaloop, alsatplg, alsaucm, aplay, abat.
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.8_v1.2.9#alsa-utils</changelog>
  <changelog author="tiwai@suse.com" date="1693828800">- Update to alsa-utils 1.2.10 (jsc#PED-6566):
  * MIDI 2.0 / UMP support for sequencer programs
  * nhlt: add nhlt-dmic-info utility
  * Build fixes and cleanups
  * speaker-test: allow large buffer and period time setup - up to 100 seconds
  * various topology fixes
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.9_v1.2.10#alsa-utils
- Fix the builds with old gcc:
  0001-axfer-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0002-amidi-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0003-alsaloop-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch
  0004-bat-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0005-seq-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0006-alsaucm-use-ATTRIBUTE_UNUSED-instead-remove-argument.patch
  0007-topology-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1717070400">- Require tree which is used by alsa-info.sh (bsc#1225665)</changelog>
</package>
<package pkgid="30d78502134ce8291cb53f6c99be7f25126036b0dedc31bcefe0322b42e240aa" name="alsabat" arch="ppc64le">
  <version epoch="0" ver="1.2.10" rel="150600.3.3.6"/>
  <changelog author="tiwai@suse.de" date="1591704000">- Update to alsa-utils 1.2.3:
  including previous fixes, see the detailed changes at:
  https://www.alsa-project.org/wiki/Detailed_changes_v1.2.2_v1.2.3
- Dropped obsoleted patches:
  0001-alsaloop-reduce-cumulative-error-caused-by-non-atomi.patch
  0002-alsactl-don-t-exit-on-EINTR-from-epoll_wait.patch
  0003-alsactl-avoid-needless-wakeups-in-monitor-loop.patch
  0004-alsactl-fix-error-handling-for-sched_setscheduler-ca.patch
  0005-alsa-info.sh-add-ALT-to-DISTRO-list.patch
  0006-alsa-info-initial-rpm-deb-package-info.patch
  0007-alsa-info.sh-increase-version-to-0.4.65.patch</changelog>
  <changelog author="tiwai@suse.de" date="1601380800">- Fix the directory to save asound.state again to /var/lib/alsa,
  which was mistakenly changed to /etc</changelog>
  <changelog author="tiwai@suse.de" date="1601899200">- Conditionally add buildreq alsa-topology-devel to fix build
  errors</changelog>
  <changelog author="tiwai@suse.de" date="1603022400">- Use /run/lock for alsactl lock directory (bsc#1177826)
- Migrate the old asound.state file if the new path isn't present
  yet (bsc#1177826)</changelog>
  <changelog author="tiwai@suse.de" date="1603281600">- Update to alsa-utils 1.2.3:
  alsactl extension for disabling UCM, alsa-info.sh enhancements,
  various fixes and documentation updates.
  See details in
    https://alsa-project.org/wiki/Changes_v1.2.3.2_v1.2.4</changelog>
  <changelog author="tiwai@suse.de" date="1607688000">- Fix alsactl restore behavior during locking (boo#1179904):
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
- Remove unnecessary condition for alsa-restore.service
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
- Fix dependency in sound-extra.service</changelog>
  <changelog author="tiwai@suse.de" date="1611230400">- Backport upstream fixes:
  various fixes in aplay, alsamixer, alsactl and alsaloop, updated
  translations, etc:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="tiwai@suse.de" date="1616068800">- Fix superfluous asound.state migration (bsc#1183672)</changelog>
  <changelog author="tiwai@suse.de" date="1619438400">- Suppress automatic update of alsa-info.sh (bsc#1185280):
  alsa-info-no-update-for-distro-script.patch</changelog>
  <changelog author="tiwai@suse.de" date="1623672000">- Update to alsa-utils 1.2.5:
  a major version up, including previous patches
  https://www.alsa-project.org/wiki/Changes_v1.2.4_v1.2.5
- Update to alsa-utils 1.2.5.1:
  a small bugfix release
  https://www.alsa-project.org/wiki/Changes_v1.2.5_v1.2.5.1
- Drop the obsoleted patches:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1627473600">- Added hardening to systemd service(s). Modified:
  * sound-extra.service</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="tiwai@suse.de" date="1638792000">- Update to alsa-utils 1.2.6:
  various updates / fixes for alsactl, amidi, alsaloop, alsamixer,
  alsatplg, amixer, aplay and aseqnet.  Details are found in
    https://alsa-project.org/wiki/Changes_v1.2.5.1_v1.2.6#alsa-utils
- Update the download URL
- Add *.sig file for the tarball</changelog>
  <changelog author="tiwai@suse.de" date="1642766400">- Fix alsamixer color config regression:
  0001-alsamixer-Fix-regression-in-color-setup.patch</changelog>
  <changelog author="tiwai@suse.de" date="1643371200">- Fix the broken mouse support on alsamixer:
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1654084800">- Update to alsa-utils 1.2.7:
  Enhancement and fixes of alsactl, speaker-test cleanup,
  alsatplg enhancements, arecord ghost data fix, etc.
  For details see:
  https://www.alsa-project.org/wiki/Changes_v1.2.6.3_v1.2.7#alsa-utils
- Drop obsoleted patches:
  0001-alsamixer-Fix-regression-in-color-setup.patch
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1666699200">- Update to alsa-utils 1.2.8 (jsc#PED-850):
  automake update, minor alsactl, amixer and aplay fixes.
  https://www.alsa-project.org/wiki/Changes_v1.2.7.2_v1.2.8
- Add keyring</changelog>
  <changelog author="tiwai@suse.com" date="1683547200">- Update to alsa-utils 1.2.9:
  BSD build fix, and various updates for alsactl, amidi, axfer,
  alsa-info.sh, alsaloop, alsatplg, alsaucm, aplay, abat.
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.8_v1.2.9#alsa-utils</changelog>
  <changelog author="tiwai@suse.com" date="1693828800">- Update to alsa-utils 1.2.10 (jsc#PED-6566):
  * MIDI 2.0 / UMP support for sequencer programs
  * nhlt: add nhlt-dmic-info utility
  * Build fixes and cleanups
  * speaker-test: allow large buffer and period time setup - up to 100 seconds
  * various topology fixes
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.9_v1.2.10#alsa-utils
- Fix the builds with old gcc:
  0001-axfer-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0002-amidi-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0003-alsaloop-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch
  0004-bat-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0005-seq-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0006-alsaucm-use-ATTRIBUTE_UNUSED-instead-remove-argument.patch
  0007-topology-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1717070400">- Require tree which is used by alsa-info.sh (bsc#1225665)</changelog>
</package>
<package pkgid="40610a8f5d6e7bcb2386e3b8e819cb2c4372f40b2c32ddf6d9cbf666585536ed" name="alsabat" arch="s390x">
  <version epoch="0" ver="1.2.10" rel="150600.3.3.6"/>
  <changelog author="tiwai@suse.de" date="1591704000">- Update to alsa-utils 1.2.3:
  including previous fixes, see the detailed changes at:
  https://www.alsa-project.org/wiki/Detailed_changes_v1.2.2_v1.2.3
- Dropped obsoleted patches:
  0001-alsaloop-reduce-cumulative-error-caused-by-non-atomi.patch
  0002-alsactl-don-t-exit-on-EINTR-from-epoll_wait.patch
  0003-alsactl-avoid-needless-wakeups-in-monitor-loop.patch
  0004-alsactl-fix-error-handling-for-sched_setscheduler-ca.patch
  0005-alsa-info.sh-add-ALT-to-DISTRO-list.patch
  0006-alsa-info-initial-rpm-deb-package-info.patch
  0007-alsa-info.sh-increase-version-to-0.4.65.patch</changelog>
  <changelog author="tiwai@suse.de" date="1601380800">- Fix the directory to save asound.state again to /var/lib/alsa,
  which was mistakenly changed to /etc</changelog>
  <changelog author="tiwai@suse.de" date="1601899200">- Conditionally add buildreq alsa-topology-devel to fix build
  errors</changelog>
  <changelog author="tiwai@suse.de" date="1603022400">- Use /run/lock for alsactl lock directory (bsc#1177826)
- Migrate the old asound.state file if the new path isn't present
  yet (bsc#1177826)</changelog>
  <changelog author="tiwai@suse.de" date="1603281600">- Update to alsa-utils 1.2.3:
  alsactl extension for disabling UCM, alsa-info.sh enhancements,
  various fixes and documentation updates.
  See details in
    https://alsa-project.org/wiki/Changes_v1.2.3.2_v1.2.4</changelog>
  <changelog author="tiwai@suse.de" date="1607688000">- Fix alsactl restore behavior during locking (boo#1179904):
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
- Remove unnecessary condition for alsa-restore.service
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
- Fix dependency in sound-extra.service</changelog>
  <changelog author="tiwai@suse.de" date="1611230400">- Backport upstream fixes:
  various fixes in aplay, alsamixer, alsactl and alsaloop, updated
  translations, etc:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="tiwai@suse.de" date="1616068800">- Fix superfluous asound.state migration (bsc#1183672)</changelog>
  <changelog author="tiwai@suse.de" date="1619438400">- Suppress automatic update of alsa-info.sh (bsc#1185280):
  alsa-info-no-update-for-distro-script.patch</changelog>
  <changelog author="tiwai@suse.de" date="1623672000">- Update to alsa-utils 1.2.5:
  a major version up, including previous patches
  https://www.alsa-project.org/wiki/Changes_v1.2.4_v1.2.5
- Update to alsa-utils 1.2.5.1:
  a small bugfix release
  https://www.alsa-project.org/wiki/Changes_v1.2.5_v1.2.5.1
- Drop the obsoleted patches:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1627473600">- Added hardening to systemd service(s). Modified:
  * sound-extra.service</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="tiwai@suse.de" date="1638792000">- Update to alsa-utils 1.2.6:
  various updates / fixes for alsactl, amidi, alsaloop, alsamixer,
  alsatplg, amixer, aplay and aseqnet.  Details are found in
    https://alsa-project.org/wiki/Changes_v1.2.5.1_v1.2.6#alsa-utils
- Update the download URL
- Add *.sig file for the tarball</changelog>
  <changelog author="tiwai@suse.de" date="1642766400">- Fix alsamixer color config regression:
  0001-alsamixer-Fix-regression-in-color-setup.patch</changelog>
  <changelog author="tiwai@suse.de" date="1643371200">- Fix the broken mouse support on alsamixer:
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1654084800">- Update to alsa-utils 1.2.7:
  Enhancement and fixes of alsactl, speaker-test cleanup,
  alsatplg enhancements, arecord ghost data fix, etc.
  For details see:
  https://www.alsa-project.org/wiki/Changes_v1.2.6.3_v1.2.7#alsa-utils
- Drop obsoleted patches:
  0001-alsamixer-Fix-regression-in-color-setup.patch
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1666699200">- Update to alsa-utils 1.2.8 (jsc#PED-850):
  automake update, minor alsactl, amixer and aplay fixes.
  https://www.alsa-project.org/wiki/Changes_v1.2.7.2_v1.2.8
- Add keyring</changelog>
  <changelog author="tiwai@suse.com" date="1683547200">- Update to alsa-utils 1.2.9:
  BSD build fix, and various updates for alsactl, amidi, axfer,
  alsa-info.sh, alsaloop, alsatplg, alsaucm, aplay, abat.
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.8_v1.2.9#alsa-utils</changelog>
  <changelog author="tiwai@suse.com" date="1693828800">- Update to alsa-utils 1.2.10 (jsc#PED-6566):
  * MIDI 2.0 / UMP support for sequencer programs
  * nhlt: add nhlt-dmic-info utility
  * Build fixes and cleanups
  * speaker-test: allow large buffer and period time setup - up to 100 seconds
  * various topology fixes
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.9_v1.2.10#alsa-utils
- Fix the builds with old gcc:
  0001-axfer-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0002-amidi-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0003-alsaloop-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch
  0004-bat-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0005-seq-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0006-alsaucm-use-ATTRIBUTE_UNUSED-instead-remove-argument.patch
  0007-topology-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1717070400">- Require tree which is used by alsa-info.sh (bsc#1225665)</changelog>
</package>
<package pkgid="7b8497d7ea0cb3d111ccd080af47652c41e5607794c9eabb037848a7220e2e83" name="alsabat" arch="x86_64">
  <version epoch="0" ver="1.2.10" rel="150600.3.3.6"/>
  <changelog author="tiwai@suse.de" date="1591704000">- Update to alsa-utils 1.2.3:
  including previous fixes, see the detailed changes at:
  https://www.alsa-project.org/wiki/Detailed_changes_v1.2.2_v1.2.3
- Dropped obsoleted patches:
  0001-alsaloop-reduce-cumulative-error-caused-by-non-atomi.patch
  0002-alsactl-don-t-exit-on-EINTR-from-epoll_wait.patch
  0003-alsactl-avoid-needless-wakeups-in-monitor-loop.patch
  0004-alsactl-fix-error-handling-for-sched_setscheduler-ca.patch
  0005-alsa-info.sh-add-ALT-to-DISTRO-list.patch
  0006-alsa-info-initial-rpm-deb-package-info.patch
  0007-alsa-info.sh-increase-version-to-0.4.65.patch</changelog>
  <changelog author="tiwai@suse.de" date="1601380800">- Fix the directory to save asound.state again to /var/lib/alsa,
  which was mistakenly changed to /etc</changelog>
  <changelog author="tiwai@suse.de" date="1601899200">- Conditionally add buildreq alsa-topology-devel to fix build
  errors</changelog>
  <changelog author="tiwai@suse.de" date="1603022400">- Use /run/lock for alsactl lock directory (bsc#1177826)
- Migrate the old asound.state file if the new path isn't present
  yet (bsc#1177826)</changelog>
  <changelog author="tiwai@suse.de" date="1603281600">- Update to alsa-utils 1.2.3:
  alsactl extension for disabling UCM, alsa-info.sh enhancements,
  various fixes and documentation updates.
  See details in
    https://alsa-project.org/wiki/Changes_v1.2.3.2_v1.2.4</changelog>
  <changelog author="tiwai@suse.de" date="1607688000">- Fix alsactl restore behavior during locking (boo#1179904):
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
- Remove unnecessary condition for alsa-restore.service
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
- Fix dependency in sound-extra.service</changelog>
  <changelog author="tiwai@suse.de" date="1611230400">- Backport upstream fixes:
  various fixes in aplay, alsamixer, alsactl and alsaloop, updated
  translations, etc:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="tiwai@suse.de" date="1616068800">- Fix superfluous asound.state migration (bsc#1183672)</changelog>
  <changelog author="tiwai@suse.de" date="1619438400">- Suppress automatic update of alsa-info.sh (bsc#1185280):
  alsa-info-no-update-for-distro-script.patch</changelog>
  <changelog author="tiwai@suse.de" date="1623672000">- Update to alsa-utils 1.2.5:
  a major version up, including previous patches
  https://www.alsa-project.org/wiki/Changes_v1.2.4_v1.2.5
- Update to alsa-utils 1.2.5.1:
  a small bugfix release
  https://www.alsa-project.org/wiki/Changes_v1.2.5_v1.2.5.1
- Drop the obsoleted patches:
  0001-aplay-try-to-use-16-bit-format-to-increase-capture-q.patch
  0002-alsamixer-Fix-the-mixer-views-description-in-man-pag.patch
  0003-Add-Slovak-translation.patch
  0004-Add-Basque-translation.patch
  0006-aplay-cosmetic-code-fix-in-xrun.patch
  0007-aplay-fix-the-CPU-busy-loop-in-the-pause-handler.patch
  0008-alsa-info-Add-lsusb-and-stream-outputs.patch
  0010-alsactl-Fix-double-decrease-of-lock-timeout.patch
  0011-alsactl-Fix-race-at-creating-a-lock-file.patch
  0012-alsactl-Remove-asound.state-file-check-from-alsa-res.patch
  0013-aplay-add-test-code-for-snd_pcm_status-to-test-posit.patch
  0014-ucm-fix-typo-in-docs.patch
  0015-aplay-add-avail-delay-checks-to-test-position.patch
  0016-alsactl-daemon-read_pid_file-fix-the-returned-code-o.patch
  0017-alsactl-init-set_ctl_value-fix-bytes-parsing.patch
  0018-alsactl-init-parse-fix-possible-double-free.patch
  0019-alsaloop-fix-possible-memory-leak-in-create_loopback.patch
  0020-alsaloop-get_queued_playback_samples-simplify-code.patch
  0021-topology-fix-possible-double-free-in-load.patch
  0022-alsamixer-remove-dead-fcn-widget_handle_key-in-widge.patch
  0023-alsamixer-remove-unused-variable-y-in-display_scroll.patch
  0024-alsamixer-fix-shift-in-parse_words.patch
  0025-aplay-fix-the-test-position-test-for-playback-avail-.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1627473600">- Added hardening to systemd service(s). Modified:
  * sound-extra.service</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="tiwai@suse.de" date="1638792000">- Update to alsa-utils 1.2.6:
  various updates / fixes for alsactl, amidi, alsaloop, alsamixer,
  alsatplg, amixer, aplay and aseqnet.  Details are found in
    https://alsa-project.org/wiki/Changes_v1.2.5.1_v1.2.6#alsa-utils
- Update the download URL
- Add *.sig file for the tarball</changelog>
  <changelog author="tiwai@suse.de" date="1642766400">- Fix alsamixer color config regression:
  0001-alsamixer-Fix-regression-in-color-setup.patch</changelog>
  <changelog author="tiwai@suse.de" date="1643371200">- Fix the broken mouse support on alsamixer:
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1654084800">- Update to alsa-utils 1.2.7:
  Enhancement and fixes of alsactl, speaker-test cleanup,
  alsatplg enhancements, arecord ghost data fix, etc.
  For details see:
  https://www.alsa-project.org/wiki/Changes_v1.2.6.3_v1.2.7#alsa-utils
- Drop obsoleted patches:
  0001-alsamixer-Fix-regression-in-color-setup.patch
  0002-alsamixer-Revert-has_mouse-check.patch</changelog>
  <changelog author="tiwai@suse.com" date="1666699200">- Update to alsa-utils 1.2.8 (jsc#PED-850):
  automake update, minor alsactl, amixer and aplay fixes.
  https://www.alsa-project.org/wiki/Changes_v1.2.7.2_v1.2.8
- Add keyring</changelog>
  <changelog author="tiwai@suse.com" date="1683547200">- Update to alsa-utils 1.2.9:
  BSD build fix, and various updates for alsactl, amidi, axfer,
  alsa-info.sh, alsaloop, alsatplg, alsaucm, aplay, abat.
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.8_v1.2.9#alsa-utils</changelog>
  <changelog author="tiwai@suse.com" date="1693828800">- Update to alsa-utils 1.2.10 (jsc#PED-6566):
  * MIDI 2.0 / UMP support for sequencer programs
  * nhlt: add nhlt-dmic-info utility
  * Build fixes and cleanups
  * speaker-test: allow large buffer and period time setup - up to 100 seconds
  * various topology fixes
  For details, see:
  https://www.alsa-project.org/wiki/Changes_v1.2.9_v1.2.10#alsa-utils
- Fix the builds with old gcc:
  0001-axfer-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0002-amidi-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0003-alsaloop-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch
  0004-bat-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0005-seq-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0006-alsaucm-use-ATTRIBUTE_UNUSED-instead-remove-argument.patch
  0007-topology-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1717070400">- Require tree which is used by alsa-info.sh (bsc#1225665)</changelog>
</package>
<package pkgid="f5acb4333f9ba4435a4bf2cbb6b582100947dacf644039f386f96b9329fdea67" name="ant" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="817a720836b054e4e80197e7fd409b929d5586f820e3261ad13965ecad0fb610" name="ant" arch="src">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="b9882032a89398ccc435ea3f2cc5f383f3806e1488d54ed165d5db3e8e96c8c4" name="ant" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="0d40ab369f898d2ac65d3251096b037f1b98b59f4b119999a43e0e09f3c1b789" name="ant" arch="src">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="1a97373c1c9d3facd0b58860a6fa1d173fba2957fcabcb5aa8c5c2f249ea7d9f" name="ant-antlr" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="f66b1883ac47296f7edd4b822d09abb2362a58cc0bca086a9b0d4bec85459976" name="ant-antlr" arch="src">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="388ecc48785ae0549dac96f85df3a31f178b1ae12f8f7d36ec1c7ae80360208c" name="ant-antlr" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="ac8fffaa3fd6850772ec7a4dc2144949972ce6fe39725b24afcc0a8610e0c4d9" name="ant-antlr" arch="src">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="9675fd504ca9496ad7e9ef51f95a51264e621f86761d210e3fbb15ec400b3788" name="ant-apache-bcel" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="680f37ebf9ba30abb395a5231813435c227dd7cdeb1c1e630517c9268c3b6ecb" name="ant-apache-bcel" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="71e3b4f01d8302672600056fac0ff43772696f015ee01e88800bfa5bb4da686f" name="ant-apache-bsf" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="3e6a9f011f07ca50b3416e350c190be0dd1229a9f7fc0a3ccdbd8c388e63d49b" name="ant-apache-bsf" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="368be49745f104d29e59b49c88323c7be2b26d9aa17dc77aa36971c512a9ff14" name="ant-apache-log4j" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="a0a923e2540c0cb9d64987086bdd42fee4565f80cb4cb43986460e99ec9a4df2" name="ant-apache-log4j" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="3c81786fc6c55af109af9f5c839e4efa9f3cee0d2c001fdbbb43230f6a17e921" name="ant-apache-oro" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="9e0b4d0496a46609dacba151e352c100f10e18cb7fdc84f65a7b2df1896abf70" name="ant-apache-oro" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="f85184bd1ca83900e99a0159ae3273580b4598e08dfd16227bd8b39a6dca2869" name="ant-apache-regexp" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="f318cacb16377b368dc6a4c8479b1ab8f7581f1eca7c82301e38a5a529befb9c" name="ant-apache-regexp" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="52309cbbca2e73fcf8744d90e8fc3e9415075f768191804e5cc2aa81e86b7896" name="ant-apache-resolver" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="b3d5ddbdff5372afbd41701a026252cfc19463bfd2f7bbd439048ae5292986ce" name="ant-apache-resolver" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="7da998f26ff5924ba7977be930b7d6a57420c58a771b04dbd0a74f6f4a43f228" name="ant-apache-xalan2" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="02fa94681c51f34d1b90d1e28e2f2a3c718f9b9c54b1899ea26833b2065a2380" name="ant-apache-xalan2" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="35382fd3d9e6ad3b4d30e77f57b032c858fa281d48e3a836841ef9b2b92049df" name="ant-commons-logging" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="899c1c84e5088d42f3f1ce045d0ee2ae3d06bd7d5978c86f65d32d72f7d9bc64" name="ant-commons-logging" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="6a3e5bb99604d1d2549fdfc3fb64a685ffadab5ddb151621733accf52f3ec921" name="ant-commons-net" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="5ba609a561e03a0b1b08028a29432825ff7085eb2e2277b7e35c0f377755aec6" name="ant-commons-net" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="fbc5f9d14a3c79ca97a51ebb4b9a6ab48d1cc9adf811f9de5f96342f0a873988" name="ant-imageio" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="56226ce87d5700d02788ca8d40c448124b02274d766113ae607b6a1d9d2f13ca" name="ant-imageio" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="be421c463f56b84178154364f72725daea51071bafd8cbbf04c3b1feb9c493bc" name="ant-jakartamail" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="734bc8cb91d7d53872c268781bd344ab1a844df4ea6889987a3b3e370c6e2b95" name="ant-jakartamail" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="fbc12591a5ecd2d7eed791a024d6d4542fd07a1b392a937ff577ec99f8699a15" name="ant-javamail" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="bda0a2f2307a920719fbe2ea909fe35b1ae115113ff45c7c1da709a4e5ece9c9" name="ant-javamail" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="6179b5bc9a84f59bb6eebd4bb1c653b57390c2d6e7da0ecd7ca06fbdd3d5ff33" name="ant-jdepend" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="6621f290d1de04c58f9052d9fc11ff44a4a4c45709e00f8e7ac3d3279a083071" name="ant-jdepend" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="8650ca83dac1c6e98b14778f4b1e80da0c68d59dab38b19ed6f2a2625fc18750" name="ant-jmf" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="092bc1cf0a5cb899e517f479f2e754616e3295c2c9ef799f6c01efe42e342eb8" name="ant-jmf" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="120d168cb500b0c10dbd858a5598eca680d6655a7d8ce7eac189a25e9e43c063" name="ant-jsch" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="8fbb1732d45341675fd4e280dc837c6471e6097f75e97755d64611301ac80881" name="ant-jsch" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="de561ed662bbe9a4b0c6c2a0c776a5f609304ddd2815f32d4fe9059fb06a8d99" name="ant-junit" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="be23b6e110d357905214d8c5679a352c3a3405c09ce78b30e68eea4ba21f3493" name="ant-junit" arch="src">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="f5fce8da1c8b1de35aecb37313ec2e76c147fd20935038f1bedcc6aba0517688" name="ant-junit" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="f99e6f074de983ad70babcd752e0ac1bc3153ce65821e375a2f89e3163198c11" name="ant-junit" arch="src">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="0b6feffb53325df3e9b21520964a1c2f0bd96322e893fd44a7c07887ce99512f" name="ant-junit5" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="273c0417a7d5389c8db27a9fe7bb54026788dfe6cd971ddafae0d3f97f144e59" name="ant-junit5" arch="src">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="35454e30dcd36741439151137383f427509bec9fecf061cba6ab281264f7109d" name="ant-junit5" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="6558fa5ce673952c914bd452a04f475780f8cb30885c879a422287d672e3348f" name="ant-junit5" arch="src">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="f610bd3257fc3d48f856d22237487660624e4df6fa53eb2c088830a7320f9a1a" name="ant-manual" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="63b66becbacc143f8c26f85376ba405fc88eac2a67ae56fb39af6af2650bc49a" name="ant-manual" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="3b2195c79c9090ff69f57495ffaae2e7d676e50b1aee3117136478d04f764492" name="ant-scripts" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="c1df7692eca1703c8dce1afe8773e67a0b795b436bc8ee194976fec26e00a2ec" name="ant-scripts" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="5f191773d5849d059b32eb6d338a2729a40bf2c06d63606fe162bb7958eb865f" name="ant-swing" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="439ee0c9ce3e48865f81400ce35e1b467da890d91fd750f83a089737b710b934" name="ant-swing" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="cc8ab96f7397814a3908ee5ff25ae406de7ccb9dd3f9706a94c140d645b06543" name="ant-testutil" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="5582a1c53e2b452ccb77dc1232caadbef1fd47ef6bb5fe60490da51618dfc8d5" name="ant-testutil" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="eb1138642cd6442cdf7436ce80b27151af201676ee27b8e66f65edd5bf419096" name="ant-xz" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.25.1"/>
  <changelog author="fstrba@suse.com" date="1569844800">- Remove references to parent poms from all artifacts and do not
  distribute the ant-parent, since we don't need it</changelog>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
</package>
<package pkgid="8262dff4d80daf4e595ba6875fce058d652cd7b7237de289a118673ce99802eb" name="ant-xz" arch="noarch">
  <version epoch="0" ver="1.10.14" rel="150200.4.28.1"/>
  <changelog author="fstrba@suse.com" date="1569931200">- Build against the new compatibility packages log4j12/log4j12-mini</changelog>
  <changelog author="fstrba@suse.com" date="1573214400">- Upgrade to upstream version 1.10.7
- Modified patches:
  * apache-ant-bootstrap.patch
  * apache-ant-no-test-jar.patch
  * apache-ant-xml-apis.patch
  * reproducible-build-manifest.patch
    + rediff
- Fix ant-xz.jar to be non-empty and split it from the ant-antlr
  package</changelog>
  <changelog author="fstrba@suse.com" date="1579003200">- Use xml-commons-apis-bootstrap as jar in classpath instead of
  the common xml-apis jar, since we are forcing build against
  the bootstrap package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766400">- Remove jakarta-commons-* dependencies [bsc#1133997]
  * Use apache-commons-logging and apache-commons-net in optional tasks</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588766401">- Add rhino to the ant-apache-bsf optional tasks [bsc#1134001]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1589457600">- Update to 1.10.8
  * Security fix: [CVE-2020-1945, bsc#1171696]
  - A new property ant.tmpdir provides improved control over the
    location Ant uses to create temporary files
  * sshexec failed to write output to a file if the file didn't exist
  * Fixes a regression in javac task involving command line argument files.
  * sshexec, sshsession and scp now support a new sshConfig parameter.
  It specified the SSH configuration file (typically ${user.home}/.ssh/config)
  defining the username and keyfile to be used per host.
  * "legacy-xml" formatter of junitlauncher task wasn't writing out
  exceptions that happen in @BeforeAll method of a test.
  * Fixes a potential ConcurrentModificationException in XMLLogger.
  * Fixes a bug in junitlauncher task in forked mode, where if a listener element
  was used as a sibling element for either the test or testclasses element,
  then the forked mode launch would fail.
  * Fixes an issue in AntStructure where an incorrect DTD was being generated.
  * Fixes an incorrect variable name usage in junit-frames-xalan1.xsl.
  * The runant.py script should now work with Python 3.
  * rmic has been removed from Java 15. The task will now throw an
  exception if you try to use it while running Java 15 or newer.
- Remove ant-python3.patch fixed upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1601553600">- Update to 1.10.9
  * Security fix: [bsc#1177180, CVE-2020-11979]
  - Insecure temporary file vulnerability
  * Fixed bugs:
  - The ftp task could throw a NullPointerException if an
    error occured.
  - Propertyset now also sees in-scope local properties.
  - Replaced ReaderInputStream with the version of Apache
    Commons IO due to problems with surrogate pairs.
  - &lt;fixcrlf&gt; will no longer remove the temporary file it
    just created before writing to it.
  - &lt;sshexec&gt; and &lt;scp&gt; didn't deal with wildcard hostnames
    in shs config files properly.
  * Other changes:
  - Ant will no longer log a warning if it doesn't find tools.jar.
  - The &lt;jar&gt; task accepts now a nested &lt;indexjarsmapper&gt;
    element that can be used to perform custom filename
    transformations for the &lt;indexjars&gt; archives.
  - Added a new PropertyEnumerator interface that extensions can
    provide if they are managing properties unknown to the Ant project.
  - Added some special code to support GraalVM JavaScript as
    javax.script scripting engine for JavaScript. In particular we
    relax some security settings of GraalVM so that scripts can access
    Ant objects.
  - Also Ant enables Nashorn compatibility mode by default, you can
    disable that by setting the magic Ant property
    ant.disable.graal.nashorn.compat to true.
  - If the magic property ant.tmpdir hasn't been set and Ant can
    control the permissions of directories it creates it will create an
    owner-owned temporary directory unaccessible to others as default
    tempdir as soon as a temporary file is created for the first time.</changelog>
  <changelog author="pmonreal@suse.com" date="1622721600">- Update to 1.10.10
  * SCP (with sftp=true) task would fail if fetching file located
    in root directory.
  * Fixed: javac task would fail if the arguments file it
    (internally) created didn't quote the # character.
  * Make sure LegacyXmlResultFormatter encodes characters illegal
    in XML the same way JUnit5's built-in formatter would.
  * LegacyXmlResultFormatter no longer double-encodes &lt;&gt;&amp; in
    system-err and system-out.
  * Fixes a bug in junitlauncher task's legacy-xml formatter,
    where the testcase representing a @Parameterized JUnit4 test
    wasn't being reported in the XML.
  * Fixes a bug where the ant-testutil-sources.jar that gets
    published to Maven central repository didn't contain any
    source files.
  * The &lt;http&gt; condition didn't follow redirects from http to https.
  * ZipOutputStream now overrides write(int) in order to make sure
    single byte writes get the same treatment as array writes.
  * Fixes a potential deadlock in junitlauncher task when using
    legacy-xml reporter.
  * javaversion condition now has a new "atmost" attribute. See
    the javaversion manual for more details
  * The "listener" nested element of the "junitlauncher" task now
    has a new "useLegacyReportingName" attribute which can be used
    to control the test identifiers names that get reported by the
    listener. See the junitlauncher manual for more details. Note that
    this change also introduces a new "setUseLegacyReportingName" method
    on the org.apache.tools.ant.taskdefs.optional.junitlauncher.TestResultFormatter
    interface. This will break backward compatibility with any of your custom
    result formatters which implemented this interface and such implementations
    are now expected to implement this new method.
  * A new attribute preserveduplicates allows &lt;resourcelist&gt; to
    return the same resource multiple times when set to true.
  * A new attribute filterbeforeconcat in &lt;concat&gt; can be used to
    decide whether the filterchain should be applied to the
    concatenated content (the default) or each nested resource
    individually before concatenating them.
  * The ssh tasks now share a new nested element additionalConfig that can
    be used to set config values for the jsch Session used by the task.
  * Added new discardOutput and discardError properties to redirector
    and the exec, apply and java tasks which can be used to completely
    discard any (error) output. This is a platform independent
    alternative to directiong output to any kind of null device.
  * junitlauncher now prints a more useful and instantaneous summary of
    tests being run, closely matching the junit task's summary.</changelog>
  <changelog author="david.anes@suse.com" date="1639569600">- Update to 1.10.12:
  * The update includes fixes for the following CVEs:
  CVE-2021-36374, bsc#1188469
    Excessive memory allocation when reading a specially
    crafted ZIP archive or a derived formats.
  CVE-2021-36373, bsc#1188468
    Excessive memory allocation when reading a specially
    crafted TAR archive.
  * The http condition would follow redirects even when "followRedirects" attribute
  was set to "false". This has now been fixed. Bugzilla Report 65489
  * Made sure setting build.compiler to the fully qualified classname
  that corresponds to extJavac or modern has the same effect as using
  the shorter alias names. Bugzilla Report 65539
  * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
  Bugzilla Report 65424
  * The implementation of AntClassLoader#findResources() has been changed to optimize
  it for potential performance issues, as those noted at https://issues.jenkins.io/browse/JENKINS-22310?focusedCommentId=197405&amp;page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-197405
  Github Pull Request #151
  * AntClassLoader now implements the ClassLoader#findResource(String) method.
  Github Pull Request #150
  * Ant tries to avoid file name canonicalization when possible.
  Bugzilla Report 65499
  * javadoc task will now look for warning messages in the STDERR stream too
  when "failonwarning" is set to true to account for changes in JDK 17+
  * The tar task now preserves symlinks of nested tarfilesets.
  Github Pull Request #142
- Changes from 1.10.11:
  * a race condition could lead to NullPointerExceptions when running
  tasks in parallel.
  Bugzilla Report 65316
  * fixed potential OutOfMemory errors when reading broken archives
  using the tar or zip formats or formats derived from zip.
  * org.apache.tools.ant.taskdefs.optional.junitlauncher.confined.JUnitLauncherTask now
  has a new protected createExecuteWatchdog() method for allowing it to be overriden.
  Github Pull Request #147
  * Upgraded AntUnit to 1.4.1.</changelog>
  <changelog author="fstrba@suse.com" date="1645531200">- Do not build against the log4j12 packages, use the new reload4j</changelog>
  <changelog author="fstrba@suse.com" date="1652097600">- Disable a test failing to compile with junit5 5.8.x</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- Update ant keyring with new developer keys.
- Update to 1.10.13:
  * Breaking changes:
  - &lt;get&gt; has a new attribute authenticateOnRedirect that can be
    used to prevent Ant from sending the configured credentials
    when following a redirect. It is false by default, which means
    builds that rely on credentials being used on the redirected
    URI may break.
  * Fixed bugs:
  - the PropertyEnumerator change introduced in 1.10.9 proved to
    be not fully backwards compatible when combined with certain
    custom PropertyHelper implementations - for example when using
    AntXtras.
  - legacy-xml reporter of the junitlauncher task now escapes ]]&gt;
    when writing CDATA.
  - &lt;scp&gt; may leak connections when trying to preserve the last
    modified timestamps of files transferred recursively from a
    server.
  - tstamp task would in certain cases parse the SOURCE_DATE_EPOCH
    environment variable value to an incorrect date. This has now
    been fixed.
  - fetch.xml didn't set up non-default repositories propery and
    thus failed to download JAI.
  - When building and installing Ant distribution from source, the
    build script would change permissions on unrelated files in
    the destination directory. This is now fixed and such
    unrelated files in the destination directory will be left
    untouched.
  - parsing tar entries with multiple NUL bytes in their name
    would include garbage bytes as the name included all bytes up
    to the last NUL rather than the first.
  - loadresource might log warnings even though quiet was set to
    true
  - javac task would add paths constructs containing wildcards to
    the internally created argument file where wildcards are not
    allowed
  * Other changes:
  - added an implementation of the MIME Mail sender based on the
    repackaged Jakarta Mail package rather than javax Mail.
  - The "listener" element in the junitlauncher task now supports
    an "extension" attribute to control the filename extension
    of the generated output file from the listener.
  - &lt;ftp&gt; now supports FTPs.
  - DirectoryScanner avoids listing directory contents when it
    known it will never use the information retrieved. This may
    improve performance in some special cases.
  - &lt;manifest&gt; will now create the parent directory of the
    manifestFile attribute if it doesn't exist.
  - org.apache.tools.ant.BuildLogger now has a new method
    getMessageOutputLevel() which returns the currently set
    message output level.</changelog>
  <changelog author="fstrba@suse.com" date="1674734400">- Package and distribute the new ant-jakartamail</changelog>
  <changelog author="fcrozat@suse.com" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="fstrba@suse.com" date="1693483200">- Update to 1.10.14:
  * Changes that could break older environments:
    + Resource#compareTo now invokes getName rather than toString as
    the later may be costly (for example in the case of a
    StringResource).
    + When using Java 18 or higher, Ant will no longer use Java
    SecurityManager because it has been deprecated for removal and
    by default is disallowed to be set at runtime
    https://openjdk.org/jeps/411.
    This will mean that the "&lt;permissions&gt;" type is no longer
    functional when using Java 18 or higher.
    Furthermore, when using Java 18 or higher, if the build
    executes tasks that call "java.lang.System.exit()" and if
    those tasks aren't running in a forked VM of their own, then
    such tasks will now kill the entire Ant build process. It is
    recommended that such tasks be updated to launch in a forked
    VM so that the System.exit() call will not impact the JVM in
    which Ant process runs.
  * Fixed bugs:
    + log only the stylesheet name in the xslt task.
    + junitlauncher task's "test" and "listener" elements which take
    a "outputDir" property were incorrectly resolving the
    outputDir against the current working directory instead of the
    project's basedir.
    + regexmapper would, in some cases, incorrectly consume
    backslash characters from the "to" attribute, resulting in
    missing backslashes in the output.
    + &lt;fixcrlf&gt;, &lt;replace&gt; and &lt;replaceregexp&gt; now try to preserve
    the file permissions of the files they modify.
    + junitlauncher task would fail if a forked test timed out even
    if haltOnFailure was set to false.
    + fixes a bug in org.apache.tools.zip.ZipOutputStream where,
    even when "zip64Mode" is set to "always", ZipOutputStream may
    not create a CEN extra field data for the entry.
    + legacy-xml listener of junitlauncher task wouldn't report
    certain failures involving junit jupiter dynamic tests.
    + allow.class which was introduced in Ant 1.10.13 release, has
    been removed from this 1.10.14 release. This class was
    introduced in context of the SecurityManager changes in
    Ant 1.10.13, which have now been reverted in Ant 1.10.14,
    since they caused several regressions.
  * Other changes:
    + &lt;fork&gt; element of the junitlauncher task now has a new
    optional "java" attribute which can be used to point to a
    different Java installation for runnning the forked tests.
    + made sure &lt;echoproperties&gt; sorts the echoed properties on
    JDK9+ as well.
    + org.apache.tools.ant.taskdefs.Recorder class now introduces a
    setLogLevel(LogLevel level) method.
    + The &lt;fork&gt; element of junitlaunchertask now allows a
    "forkMode" attribute. forkMode=perTestClass can now be used to
    launch each test class in a separate forked JVM.</changelog>
  <changelog author="fstrba@suse.com" date="1694433600">- Added patch:
  * reproducible-propertyfile-task.patch
    + Debian patch to improve propertyfile task in RPM builds by
    using the date specified by the SOURCE_DATE_EPOCH variable
    in the header of the .properties file generated</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1706270400">- Add forgotten univocity-parsers to
  %{_sysconfdir}/ant.d/junitlauncher (needed to run unit tests
  annotated with @CsvSource and @CsvFileSource)</changelog>
  <changelog author="fstrba@suse.com" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1714219200">- Put hamcrest on the classpath of ant-junit module</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1714824000">- Add forgotten open-test-reporting/events to
  %{_sysconfdir}/ant.d/junitlauncher</changelog>
</package>
<package pkgid="07062ac75e044b6eddc3bbb0cfff3a18a052bd2f6c81d46d6cf95b8b2db1bf66" name="aom-tools" arch="aarch64">
  <version epoch="0" ver="3.7.1" rel="150600.3.3.1"/>
  <changelog author="elimat@opensuse.org" date="1614600000">- Update to version 2.0.2:
  * Prepare for the libaom v2.0.2 release
  * Call av1_setup_frame_size() when dropping a frame
  * Avoid memset in filter_intra_predictor module
  * Fix a typo bug in apply_temporal_filter_planewise
  * Modify the assertion in temporal filter intrinsics
  * Fix unit test ThreadTestLarge.EncoderResultTest/49
  * Add -Wimplicit-function-declaration as C flag only
  * Update CHANGELOG for libaom v2.0.1
  * Set allow_screen_content_tools to 0 in rt mode
  * chroma_check: don't access UV planes if monochrome</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620648000">- Update to version 3.1.0 (bsc#1185843):
  https://aomedia.googlesource.com/aom/+/refs/tags/v3.1.0
  This release adds an "all intra" mode to the encoder, which significantly
  speeds up the encoding of AVIF still images at speed 6.
  - Upgrading:
    All intra mode for encoding AVIF still images and AV1 all intra videos:
    AOM_USAGE_ALL_INTRA (2) can be passed as the 'usage' argument to
    aom_codec_enc_config_default().
    New encoder control IDs added:
  - AV1E_SET_ENABLE_DIAGONAL_INTRA: Enable diagonal (D45 to D203) intra
    prediction modes (0: false, 1: true (default)). Also available as
    "enable-diagonal-intra" for the aom_codec_set_option() function.
    New aom_tune_metric enum value: AOM_TUNE_BUTTERAUGLI. The new aomenc option
  - -tune=butteraugli was added to optimize the encoder’s perceptual quality by
    optimizing the Butteraugli metric. Install libjxl (JPEG XL) and then pass
  - DCONFIG_TUNE_BUTTERAUGLI=1 to the cmake command to enable it.
- Includes 3.0
  https://aomedia.googlesource.com/aom/+/refs/tags/v3.0.0
  This release includes compression efficiency improvement, speed improvement
  for realtime mode, as well as some new APIs.
  - Upgrading:
    Support for PSNR calculation based on stream bit-depth.
    New encoder control IDs added:
  - AV1E_SET_ENABLE_RECT_TX
  - AV1E_SET_VBR_CORPUS_COMPLEXITY_LAP
  - AV1E_GET_BASELINE_GF_INTERVAL
  - AV1E_SET_ENABLE_DNL_DENOISING
    New decoder control IDs added:
  - AOMD_GET_FWD_KF_PRESENT
  - AOMD_GET_FRAME_FLAGS
  - AOMD_GET_ALTREF_PRESENT
  - AOMD_GET_TILE_INFO
  - AOMD_GET_SCREEN_CONTENT_TOOLS_INFO
  - AOMD_GET_STILL_PICTURE
  - AOMD_GET_SB_SIZE
  - AOMD_GET_SHOW_EXISTING_FRAME_FLAG
  - AOMD_GET_S_FRAME_INFO
    New aom_tune_content enum value: AOM_CONTENT_FILM
    New aom_tune_metric enum value: AOM_TUNE_VMAF_NEG_MAX_GAIN
    Coefficient and mode update can be turned off via
    AV1E_SET_{COEFF/MODE}_COST_UPD_FREQ.
    New key &amp; value API added, available with aom_codec_set_option() function.
    Scaling API expanded to include 1/4, 3/4 and 1/8.
  - Enhancements:
    Better multithreading performance with realtime mode.
    New speed 9 setting for faster realtime encoding.
    Smaller binary size with low bitdepth and realtime only build.
    Temporal denoiser and its optimizations on x86 and Neon.
    Optimizations for scaling.
    Faster encoding with speed settings 2 to 6 for good encoding mode.
    Improved documentation throughout the library, with function level
    documentation, tree view and support for the dot tool.
  - Bug fixes:
    Aside from those mentioned in v2.0.1 and v2.0.2, this release includes the
    following bug fixes:
    Issue 2940: Segfault when encoding with --use-16bit-internal and --limit &gt; 1
    Issue 2941: Decoder mismatch with --rt --bit-depth=10 and --cpu-used=8
    Issue 2895: mingw-w64 i686 gcc fails to build
    Issue 2874: Separate ssse3 functions from sse2 file.</changelog>
  <changelog author="rpm@fthiessen.de" date="1625227200">- Update to version 3.1.1
  * Fix vmaf model initialization error when not set to tune=vmaf
  * Fix consistent crash on near-static screen content, keyframe
    related
  * Fix tune=butteraugli mode
- Disable NEON on arm where not available.</changelog>
  <changelog author="pgajdos@suse.com" date="1629892800">- Update to version 3.1.2:
  * Update AUTHORS,CHANGELOG,CMakeLists.txt for v3.1.2
  * Avoid chroma resampling for 420mpeg2 input
  * Check array has two elements before using index 1
  * Fix DecodeScalabilityTest failure in realtime only
  * Store temporal_id and spatial_id of decoded frame
  * exports.cmake: use APPLE and WIN32 and use def for mingw-w64</changelog>
  <changelog author="pgajdos@suse.com" date="1629892801">- security update
- added patches
  fix CVE-2021-30475 [bsc#1189497], Buffer overflow in aom_dsp/noise_model.c
  + libaom-CVE-2021-30475.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1631188800">- security update
- added patches
  fix CVE-2021-30474 [bsc#1186799], aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free.
  + libaom-CVE-2021-30474.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1633694400">- Update to version 3.1.3:
  * Update CHANGELOG for v3.1.3-rc2
  * Detect chroma subsampling more directly
  * Detect chroma subsampling more directly
  * image2yuvconfig() should calculate uv_crop_width
  * aom/aom_encoder.h: remove configure option reference
  * aom_encoder.h: fix rc_overshoot_pct range
  * Update AUTHORS,CHANGELOG,CMakeLists.txt for v3.1.3
  * aom_install: don't exclude msvc from install
  * aom_install: use relpath for install
  * aom_install: Install lib dlls to bindir</changelog>
  <changelog author="gmbr3@opensuse.org" date="1634126400">- fix service data</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1634299200">- Update to version 3.2.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, as well
    as some new features.
  * New Features:
    + Introduced speeds 7, 8, and 9 for all intra mode.
    + Introduced speed 10 for real time mode.
    + Introduced an API that allows external partition decisions.
    + SVC: added support for compound prediction.
    + SVC: added support for fixed SVC modes.
  * Compression Efficiency Improvements:
    + Intra-mode search improvement.
    + Improved real time (RT) mode BDrate savings by ~5% (RT speed
    5) and ~12% (RT speed 6). The improvement was measured on the
    video conference set.
    + Improved real time mode for nonrd path (speed 7, 8, 9):
    BDrate gains of ~3-5%.
    + Rate control and RD adjustments based on ML research in VP9.
    Gains of ~0.5-1.0% for HD.
  * Perceptual Quality Improvements:
    + Added a new mode --deltaq-mode=3 to improve perceptual
    quality based on a differential contrast model for still
    images.
    + Added a new mode –deltaq-mode=4 to improve perceptual quality
    based on user rated cq_level data set for still images.
    + Weighting of some intra mode and partition size choices to
    better manage and retain texture.
  * Speedup and Memory Optimizations:
    + Further improved 2-pass good quality encoder speed:
    . Speed 2 speedup: 18%
    . Speed 3 speedup: 22%
    . Speed 4 speedup: 37%
    . Speed 5 speedup: 30%
    . Speed 6 speedup: 20%
    + Optimized the real time encoder (measured on the video
    conference set):
    . RT speed 5 speedup: 110%
    . RT speed 6 speedup: 77%
  * Bug Fixes
    + Issue 3069: Fix one-pass mode keyframe placement off-by-one
    error.
    + Issue 3156: Fix a bug in av1_quantize_lp AVX2 optimization.
- Drop libaom-CVE-2021-30474.patch: Fixed upstream.
- Drop libaom-CVE-2021-30475.patch: Fixed upstream.
- Remove changesgenerate option from _service file, use data from
  CHANGELOG to fill .changes instead as it it much nicer and human
  readable than just a list of commit messages.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1645185600">- Update to version 3.3.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, some
    new features, and several bug fixes.
  * New Features
  - AV1 RT: Introducing CDEF search level 5
  - Changed real time speed 4 to behave the same as real time
    speed 5
  - Add --deltaq-strength
  - rtc: Allow scene-change and overshoot detection for svc
  - rtc: Intra-only frame for svc
  - AV1 RT: Option 2 for codec control AV1E_SET_ENABLE_CDEF to
    disable CDEF on non-ref frames
  - New codec controls AV1E_SET_LOOPFILTER_CONTROL and
    AOME_GET_LOOPFILTER_LEVEL
  - Improvements to three pass encoding
  * Compression Efficiency Improvements: Overall compression gains:
    0.6%
  * Perceptual Quality Improvements
  - Improves the perceptual quality of high QP encoding for
    delta-q mode 4
  - Auto select noise synthesis level for all intra
  * Speedup and Memory Optimizations
  - Added many SSE2 optimizations.
  - Good quality 2-pass encoder speedups:
    o Speed 2: 9%
    o Speed 3: 12.5%
    o Speed 4: 8%
    o Speed 5: 3%
    o Speed 6: 4%
  - Real time mode encoder speedups:
    o Speed 5: 2.6% BDRate gain, 4% speedup
    o Speed 6: 3.5% BDRate gain, 4% speedup
    o Speed 9: 1% BDRate gain, 3% speedup
    o Speed 10: 3% BDRate gain, neutral speedup
  - All intra encoding speedups (AVIF):
    o Single thread - speed 6: 8%
    o Single thread - speed 9: 15%
    o Multi thread(8) - speed 6: 14%
    o Multi thread(8) - speed 9: 34%
  * Bug Fixes
  - Issue 3163: Segmentation fault when using
  - -enable-keyframe-filtering=2
  - Issue 2436: Integer overflow in av1_warp_affine_c()
  - Issue 3226: armv7 build failure due to gcc-11
  - Issue 3195: Bug report on libaom (AddressSanitizer:
    heap-buffer-overflow)
  - Issue 3191: Bug report on libaom (AddressSanitizer: SEGV on
    unknown address)
- Drop libaom-devel Requires from libaom-devel-doc sub-package: We
  do not need the devel package to be able to read the devel
  documentation.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1662292800">- Update to version 3.4.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, and
    some new features. There are no ABI or API breaking changes in
    this release.
  * New Features:
  - New --dist-metric flag with "qm-psnr" value to use
    quantization matrices in the distortion computation for RD
    search. The default value is "psnr".
  - New command line option "--auto-intra-tools-off=1" to make
    all-intra encoding faster for high bit rate under
    "--deltaq-mode=3" mode.
  - New rate control library aom_av1_rc for real-time hardware
    encoders. Supports CBR for both one spatial layer and SVC.
  - New image format AOM_IMG_FMT_NV12 can be used as input to the
    encoder. The presence of AOM_IMG_FMT_NV12 can be detected at
    compile time by checking if the macro AOM_HAVE_IMG_FMT_NV12
    is defined.
  - New codec controls for the encoder:
    o AV1E_SET_AUTO_INTRA_TOOLS_OFF. Only in effect if
  - -deltaq-mode=3.
    o AV1E_SET_RTC_EXTERNAL_RC
    o AV1E_SET_FP_MT. Only supported if libaom is built with
  - DCONFIG_FRAME_PARALLEL_ENCODE=1.
    o AV1E_GET_TARGET_SEQ_LEVEL_IDX
  - New key-value pairs for the key-value API:
    o --auto-intra-tools-off=0 (default) or 1. Only in effect if
  - -deltaq-mode=3.
    o --strict-level-conformance=0 (default) or 1
    o --fp-mt=0 (default) or 1. Only supported if libaom is built
    with -DCONFIG_FRAME_PARALLEL_ENCODE=1.
  - New aomenc options (not supported by the key-value API):
    o --nv12
  * Compression Efficiency Improvements:
  - Correctly calculate SSE for high bitdepth in skip mode, 0.2%
    to 0.6% coding gain.
  - RTC at speed 9/10: BD-rate gain of ~4/5%
  - RTC screen content coding: many improvements for real-time
    screen at speed 10 (quality, speedup, and rate control), up
    to high resolutions (1080p).
  - RTC-SVC: fixes to make intra-only frames work for spatial
    layers.
  - RTC-SVC: quality improvements for temporal layers.
  - AV1 RT: A new passive rate control strategy for screen
    content, an average of 7.5% coding gain, with some clips of
    20+%. The feature is turned off by default due to higher bit
    rate variation.
  * Perceptual Quality Improvements:
  - RTC: Visual quality improvements for high speeds (9/10)
  - Improvements in coding quality for all intra mode
  * Speedup and Memory Optimizations:
  - ~10% speedup in good quality mode encoding.
  - ~7% heap memory reduction in good quality encoding mode for
    speed 5 and 6.
  - Ongoing improvements to intra-frame encoding performance on
    Arm
  - Faster encoding speed for "--deltaq-mode=3" mode.
  - ~10% speedup for speed 5/6, ~15% speedup for speed 7/8, and
    ~10% speedup for speed 9/10 in real time encoding mode
  - ~20% heap memory reduction in still-picture encoding mode for
    360p-720p resolutions with multiple threads
  - ~13% speedup for speed 6 and ~12% speedup for speed 9 in
    still-picture encoding mode.
  - Optimizations to improve multi-thread efficiency for
    still-picture encoding mode.
  * Bug Fixes:
  - b/204460717: README.md: replace master with main
  - b/210677928: libaom disable_order is surprising for
    max_reference_frames=3
  - b/222461449: -DCONFIG_TUNE_BUTTERAUGLI=1 broken
  - b/227207606: write_greyscale writes incorrect chroma in
    highbd mode
  - b/229955363: Integer-overflow in linsolve_wiener
  - https://crbug.com/aomedia/2032
  - https://crbug.com/aomedia/2397
  - https://crbug.com/aomedia/2563
  - https://crbug.com/aomedia/2815
  - https://crbug.com/aomedia/3009
  - https://crbug.com/aomedia/3018
  - https://crbug.com/aomedia/3045
  - https://crbug.com/aomedia/3101
  - https://crbug.com/aomedia/3130
  - https://crbug.com/aomedia/3173
  - https://crbug.com/aomedia/3184
  - https://crbug.com/aomedia/3187
  - https://crbug.com/aomedia/3190
  - https://crbug.com/aomedia/3195
  - https://crbug.com/aomedia/3197
  - https://crbug.com/aomedia/3201
  - https://crbug.com/aomedia/3202
  - https://crbug.com/aomedia/3204
  - https://crbug.com/aomedia/3205
  - https://crbug.com/aomedia/3207
  - https://crbug.com/aomedia/3208
  - https://crbug.com/aomedia/3209
  - https://crbug.com/aomedia/3213
  - https://crbug.com/aomedia/3214
  - https://crbug.com/aomedia/3219
  - https://crbug.com/aomedia/3222
  - https://crbug.com/aomedia/3223
  - https://crbug.com/aomedia/3225
  - https://crbug.com/aomedia/3226
  - https://crbug.com/aomedia/3228
  - https://crbug.com/aomedia/3232
  - https://crbug.com/aomedia/3236
  - https://crbug.com/aomedia/3237
  - https://crbug.com/aomedia/3238
  - https://crbug.com/aomedia/3240
  - https://crbug.com/aomedia/3243
  - https://crbug.com/aomedia/3244
  - https://crbug.com/aomedia/3246
  - https://crbug.com/aomedia/3248
  - https://crbug.com/aomedia/3250
  - https://crbug.com/aomedia/3251
  - https://crbug.com/aomedia/3252
  - https://crbug.com/aomedia/3255
  - https://crbug.com/aomedia/3257
  - https://crbug.com/aomedia/3259
  - https://crbug.com/aomedia/3260
  - https://crbug.com/aomedia/3267
  - https://crbug.com/aomedia/3268
  - https://crbug.com/aomedia/3269
  - https://crbug.com/aomedia/3276
  - https://crbug.com/aomedia/3278
  - https://crbug.com/chromium/1290068
  - https://crbug.com/chromium/1303237
  - https://crbug.com/chromium/1304990
  - https://crbug.com/chromium/1321141
  - https://crbug.com/chromium/1321388
  - https://crbug.com/oss-fuzz/44846
  - https://crbug.com/oss-fuzz/44856
  - https://crbug.com/oss-fuzz/44862
  - https://crbug.com/oss-fuzz/44904
  - https://crbug.com/oss-fuzz/45056</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1663848000">- Update to version 3.5.0:
  * This release is ABI compatible with the last one, including
    speedup and memory optimizations, and new APIs and features.
  * New Features
  - Support for frame parallel encode for larger number of
    threads. --fp-mt flag is available for all build
    configurations.
  - New codec control AV1E_GET_NUM_OPERATING_POINTS
  * Speedup and Memory Optimizations
  - Speed-up multithreaded encoding for good quality mode for
    larger number of threads through frame parallel encoding:
    . 30-34% encode time reduction for 1080p, 16 threads, 1x1
    tile configuration (tile_rows x tile_columns)
    . 18-28% encode time reduction for 1080p, 16 threads, 2x4
    tile configuration
    . 18-20% encode time reduction for 2160p, 32 threads, 2x4
    tile configuration
  - 16-20% speed-up for speed=6 to 8 in still-picture encoding
    mode
  - 5-6% heap memory reduction for speed=6 to 10 in real-time
    encoding mode
  - Improvements to the speed for speed=7, 8 in real-time
    encoding mode
  - Improvements to the speed for speed=9, 10 in real-time screen
    encoding mode
  - Optimizations to improve multi-thread efficiency in real-time
    encoding mode
  - 10-15% speed up for SVC with temporal layers
  - SIMD optimizations:
    . Improve av1_quantize_fp_32x32_neon() 1.05x to 1.24x faster
    . Add aom_highbd_quantize_b{,_32x32,_64x64}_adaptive_neon()
    3.15x to 5.6x faster than "C"
    . Improve av1_quantize_fp_64x64_neon() 1.17x to 1.66x faster
    . Add aom_quantize_b_avx2() 1.4x to 1.7x faster than
    aom_quantize_b_avx()
    . Add aom_quantize_b_32x32_avx2() 1.4x to 2.3x faster than
    aom_quantize_b_32x32_avx()
    . Add aom_quantize_b_64x64_avx2() 2.0x to 2.4x faster than
    aom_quantize_b_64x64_ssse3()
    . Add aom_highbd_quantize_b_32x32_avx2() 9.0x to 10.5x faster
    than aom_highbd_quantize_b_32x32_c()
    . Add aom_highbd_quantize_b_64x64_avx2() 7.3x to 9.7x faster
    than aom_highbd_quantize_b_64x64_c()
    . Improve aom_highbd_quantize_b_avx2() 1.07x to 1.20x faster
    . Improve av1_quantize_fp_avx2() 1.13x to 1.49x faster
    . Improve av1_quantize_fp_32x32_avx2() 1.07x to 1.54x faster
    . Improve av1_quantize_fp_64x64_avx2()  1.03x to 1.25x faster
    . Improve av1_quantize_lp_avx2() 1.07x to 1.16x faster
  * Bug fixes including but not limited to
  - aomedia:3206 Assert that skip_width &gt; 0 for deconvolve
    function
  - aomedia:3278 row_mt enc: Delay top-right sync when intraBC is
    enabled
  - aomedia:3282 blend_a64_*_neon: fix bus error in armv7
  - aomedia:3283 FRAME_PARALLEL: Propagate border size to all
    cpis
  - aomedia:3283 RESIZE_MODE: Fix incorrect strides being used
    for motion search
  - aomedia:3286 rtc-svc: Fix to dynamic_enable spatial layers
  - aomedia:3289 rtc-screen: Fix to skipping inter-mode test in
    nonrd
  - aomedia:3289 rtc-screen: Fix for skip newmv on flat blocks
  - aomedia:3299 Fix build failure with CONFIG_TUNE_VMAF=1
  - aomedia:3296 Fix the conflict --enable-tx-size-search=0 with
    nonrd mode --enable-tx-size-search will be ignored in non-rd
    pick mode
  - aomedia:3304 Fix off-by-one error of max w/h in
    validate_config
  - aomedia:3306 Do not use pthread_setname_np on GNU/Hurd
  - aomedia:3325 row-multithreading produces invalid bitstream in
    some cases
  - chromium:1346938, chromium:1338114
  - compiler_flags.cmake: fix flag detection w/cmake 3.17-3.18.2
  - tools/*.py: update to python3
  - aom_configure.cmake: detect PIE and set CONFIG_PIC
  - test/simd_cmp_impl: use explicit types w/CompareSimd*
  - rtc: Fix to disable segm for aq-mode=3
  - rtc: Fix to color_sensitivity in variance partition
  - rtc-screen: Fix bsize in model rd computation for intra
    chroma
  - Fixes to ensure the correct behavior of the encoder
    algorithms (like segmentation, computation of statistics,
    etc.)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1675857600">- Update to version 3.6.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, and
    some new features. This release is ABI compatible with the last
    release.
  * New Features:
  - New values 20-27 (corresponding to levels 7.0-7.3 and
    8.0-8.3) for the encoder control
    AV1E_SET_TARGET_SEQ_LEVEL_IDX (note that the proposal to add
    the new levels are still in draft status). The original
    special value 24 (keep level stats only for level monitoring)
    is renumbered as 32.
  - New encoder control AV1E_SET_SKIP_POSTPROC_FILTERING to skip
    the application of post-processing filters on reconstructed
    frame in all intra mode.
  - New encoder option "kf-max-pyr-height": Maximum height of
    pyramid structure used for the GOP starting with a key frame
    (-1 to 5).
  - Make SVC work for screen content.
  - Rate control improvements to reduce frame-size spikes for
    screen content coding.
  - RISC-V architecture support with gcc toolchain.
  * Compression Efficiency Improvements:
  - Peak compression efficiency in VOD setting is improved by 1%.
  - 0.7% - 2.2% RTC encoding BDrate gains for real time speed 8
    to 10.
  - 15% RTC encoding BDrate gains for screen content speed 10.
  * Perceptual Quality Improvements:
  - Resolved a visual quality issue that was reported for high
    resolution clips (2K) for speed 4 and above in VOD use case.
  - Visual quality improvements to screen content coding.
  - Quality improvements to temporal layer RTC coding.
  * Speedup and Memory Optimizations:
  - RTC single-thread encoder speedup:
    . ~6% instruction count reduction for speed 5 and 6.
    . ~15% instruction count reduction for speed 7.
    . ~10% instruction count reduction for speed 8 to 10 (&gt;=360p
    resolutions).
  - RTC multi-thread encoder speedup (beyond single-thread
    speedup):
    . 5-8% encode time reduction for speed 7 to 10.
  - RTC screen-content encoder speedup:
    . 11% instruction count reduction for speed 9 and 10 (&gt;=720p
    resolutions).
  - ~5% reduction in heap memory requirements for RTC, speed 6 to
    10.
  * AVIF:
    . 4-5% speedup for speed 9 in still-picture encoding mode.
    . 3-4% heap memory reduction in still-picture encoding mode
    for 360p-720p resolutions with multiple threads.
  * Bug Fixes:
  - Added a workaround for an AV1 specification bug which makes
    TRANSLATION type global motion models unusable.
  - Fixed AddressSanitizer global-buffer-overflow errors in
    av1/encoder/arm/neon/av1_fwd_txfm2d_neon.c.
  - Fixed AddressSanitizer heap-buffer-overflow error in
    av1_wiener_convolve_add_src_neon().
  - chromium:1393384 Avoid scene detection on spatial resize.
  - aomedia:3308 Remove color artifacts under high motion.
  - aomedia:3310 Avoid out of memory failures with Visual Studio
    2017, 2019, and 2022 for Win32 x86 builds.
  - aomedia:3346 Make SVC work properly for screen content.
  - aomedia:3348 Fix a bug where an uninitialized search_site is
    used.
  - aomedia:3365 Work around what seems like a Visual Studio 2022
    compiler optimization bug.
  - aomedia:3369 Incorrect PSNR values reported by libaom for
    12-bit encode.
- Modernize spec, use cmake_build and ldconfig_scriptlets macros.</changelog>
  <changelog author="fcrozat@suse.com" date="1681992000">- Fix license tag to BSD-2-Clause and AOMPL-1.0.</changelog>
  <changelog author="fcrozat@suse.com" date="1683028800">- Revert to BSD-2-Clause licence tag to only use SPDX valid
  license tag.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1683720000">- Update to version 3.6.1:
  * aomedia:2871: Guard the support of the 7.x and 8.x levels for
    AV1 under the CONFIG_CWG_C013 config flag, and only output the
    7.x and 8.x levels when explicitly requested.
  * aomedia:3382: Choose sb_size by ppi instead of svc.
  * aomedia:3384: Fix fullpel search limits.
  * aomedia:3388: Replace left shift of xq_active by
    multiplication.
  * aomedia:3389: Fix MV clamping in av1_mv_pred.
  * aomedia:3390: set_ld_layer_depth: cap max_layer_depth to
    MAX_ARF_LAYERS.
  * aomedia:3418: Fix MV clamping in av1_int_pro_motion_estimation.
  * aomedia:3429: Move lpf thread data init to
    lpf_pipeline_mt_init().
  * b:266719111: Fix undefined behavior in Arm Neon code.
  * b:269840681: nonrd_opt: align scan tables.
  * rtc: Fix is_key_frame setting in variance partition.
  * Build: Fix build with clang-cl and Visual Studio.</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1693569600">- New upstream release 3.7.0
  - New Features
  * New codec controls:
  * AV1E_SET_QUANTIZER_ONE_PASS: Set quantizer for each frame.
  * AV1E_ENABLE_RATE_GUIDE_DELTAQ: enable the rate distribution guided delta
    quantization in all intra mode. The "enable-rate-guide-deltaq" option is
    added for this control.
  * AV1E_SET_RATE_DISTRIBUTION_INFO: set the input file for rate
    distribution used in all intra mode. The "rate-distribution-info" option
    is added for this control.
  * AV1E_GET_LUMA_CDEF_STRENGTH
  * AV1E_SET_BITRATE_ONE_PASS_CBR
  * AOM_SCALING_MODE is extended to include 2/3 and 1/3 scaling.
  * aom_tune_metric is extended to include AOM_TUNE_VMAF_SALIENCY_MAP.
    The "tune" option is extended to include "vmaf_saliency_map".
  * SVC example encoder svc_encoder_rtc is able to use the rate control
    library.
  * Loopfilter level and CDEF filter level is supported by RTC rate control
    library.
  * New speed (--cpu-used) 11, intended for RTC screen sharing, added for
    faster encoding with ~3% bdrate loss with 16% IC (instruction count)
    speedup compared to speed 10.
  - Compression Efficiency Improvements
  * Improved VoD encoding performance
  * 0.1-0.6% BDrate gains for encoding speeds 2 to 6
  * Rate control accuracy improvement in VBR mode
  * RTC encoding improvements
  * Screen content mode: 10-19% BDrate gains for speeds 6 - 10
  * Temporal layers video mode, for speed 10:
  * 2 temporal layers on low resolutions: 13-15% BDrate gain
  * 3 temporal layers on VGA/HD: 3-4% BDrate gain
  - Perceptual Quality Improvements
  * Fixed multiple block and color artifacts for RTC screen content by
  * Incorporating color into RD cost for IDTX
  * Reducing thresholds for palette mode in non RD mode
  * Allowing more palette mode testing
  * Improved color sensitivity for altref in non-RD mode.
  * Reduced video flickering for temporal layer encoding.
  - Speedup and Memory Optimizations
  * Speed up the VoD encoder
  * 2-5% for encoding speed 2 to 4
  * 9-15% for encoding speed 5 to 6
  * ARM
  * Standard bitdepth
  * speed 5: +31%
  * speed 4: +2%
  * speed 3: +9%
  * speed 2: +157%
  * High bitdepth
  * speed 5: +85%
  * RTC speedups
  * Screen content mode
  * 15% IC speedup for speeds 6-8
  * ARM: 7% for speed 9, 3% for speed 10
  * Temporal layers video mode
  * 7% speedup for 3 temporal layers on VGA/HD, for speed 10
  * Single layer video
  * x86: 2% IC speedup for speeds 7-10
  * ARM: 2-4% speedup across speeds 5-10
  - Bug Fixes
  * aomedia:3261 Assertion failed when encoding av1 with film grain and
    '--monochrome' flag
  * aomedia:3276 ensure all allocations are checked (partial fix)
  * aomedia:3451 The libaom library calls exit()
  * aomedia:3450 enable -Wshadow for C++ sources
  * aomedia:3449 Test Seg Faults After
    b459af3e345be402db052a143fcc5383d4b74cbd
  * aomedia:3416 prune unused symbols / restrict symbol visibility
  * aomedia:3443 Jenkins failure:
    UninstantiatedParameterizedTestSuite&lt;EstimateNoiseTest&gt;
  * aomedia:3434 realtime failures with CONFIG_BITSTREAM_DEBUG=1
  * aomedia:3433 DeltaqModeTest crash w/row_mt=0
  * aomedia:3429 Encoder crash when turn on both ExternalResize and
    g_threads &gt; 2
  * aomedia:3438 Build failure with
    `-DSANITIZE=address -DBUILD_SHARED_LIBS=ON` when using clang.
  * aomedia:3435 Block artifacts when scrolling with AV1 in screen sharing
    scenarios
  * aomedia:3170 vmaf tune presets produce extreme glitches in one scene
  * aomedia:3401 Building shared libaom with MSVC results in a race condition
    with the export library
  * aomedia:3420 Floating point exception in av1_tpl_get_frame_importance()
  * aomedia:3424 heap-buffer-overflow in ScaleFilterCols_16_C() (SIGABRT)
  * aomedia:3417 examples/svc_encoder_rtc.c is using internal macros and
    functions
  * aomedia:3372 SEGV in assign_frame_buffer_p av1_common_int.h
  * aomedia:3130 'cpu-features.h' file not found on Android NDK 22
  * aomedia:3415 Encoder/decoder mismatch for svc_encoder_rtc running
    1 SL 3 TL
  * aomedia:3412 Lossless Mode Fails Loopback Bit Test
  * aomedia:3409 The use of AV1_VAR_OFFS in av1/encoder/var_based_part.c is
    incorrect for high bit depths
  * aomedia:3403 test_libaom fails with error message
    "feenableexcept() failed" on Linux arm
  * aomedia:3370 Random color block at fast motion area
  * aomedia:3393 Assertion failure in av1_convolve_2d_sr_c()
  * aomedia:3392 Strong artifacting for high bit-depth real-time
  * aomedia:3376 aomenc --threads=10 --deltaq-mode=3 crashes after
    "Allintra: multi-threading of calculating differential contrast"
  * aomedia:3380 Crashes and ASan and TSan errors in deltaq-mode=3
    multithreading code
  * chromium:1410766 heap-buffer-overflow in aom_yv12_copy_v_c
  * Cannot set level via AV1E_SET_TARGET_SEQ_LEVEL_IDX
  * Encoding failure due to the use of loop restoration with unintended use of
    lossless mode.
  * Signed integer overflow in scan_past_frames
  * Signed integer overflow in update_a_sep_sym
  * Flickering in AV1 1440p/2160p HDR transcodes
  * Fixed artifacts with screen share at encoder speed 10
  * Fixed prediction setup for IDTX
- Use system libraries instead of vendored ones
  * system-gtest.patch
  * system-yuv.patch
- Enable debuginfo also on modules written in assembly
- Enable building PowerPC-specific optimizations
- Enable Neon optimized code on ARM and fix runtime CPU detection
- Fix missing images in documentation</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1693915200">- Split docs to multibuild to avoid dependency cycle</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701777600">- Update to version 3.7.1:
  * Bug Fixes:
  - aomedia:3349: heap overflow when increasing resolution
  - aomedia:3478: GCC 12.2.0 emits a -Wstringop-overflow warning
    on aom/av1/encoder/motion_search_facade.c
  - aomedia:3489: Detect encoder and image high bit depth
    mismatch
  - aomedia:3491: heap-buffer-overflow on frame size change
  - b/303023614:  Segfault at encoding time for high bit depth
    images
- Switch buildtime compression to zst.</changelog>
  <changelog author="pgajdos@suse.com" date="1718020800">- security update
- added patches
  fix CVE-2024-5171 [bsc#1226020], heap buffer overflow in img_alloc_helper() caused by integer overflow
  + libaom-CVE-2024-5171.patch</changelog>
</package>
<package pkgid="7f481230165fc83a77c68696c9582eb52009f9a0bf7c165becacb71a043b285a" name="aom-tools" arch="ppc64le">
  <version epoch="0" ver="3.7.1" rel="150600.3.3.1"/>
  <changelog author="elimat@opensuse.org" date="1614600000">- Update to version 2.0.2:
  * Prepare for the libaom v2.0.2 release
  * Call av1_setup_frame_size() when dropping a frame
  * Avoid memset in filter_intra_predictor module
  * Fix a typo bug in apply_temporal_filter_planewise
  * Modify the assertion in temporal filter intrinsics
  * Fix unit test ThreadTestLarge.EncoderResultTest/49
  * Add -Wimplicit-function-declaration as C flag only
  * Update CHANGELOG for libaom v2.0.1
  * Set allow_screen_content_tools to 0 in rt mode
  * chroma_check: don't access UV planes if monochrome</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620648000">- Update to version 3.1.0 (bsc#1185843):
  https://aomedia.googlesource.com/aom/+/refs/tags/v3.1.0
  This release adds an "all intra" mode to the encoder, which significantly
  speeds up the encoding of AVIF still images at speed 6.
  - Upgrading:
    All intra mode for encoding AVIF still images and AV1 all intra videos:
    AOM_USAGE_ALL_INTRA (2) can be passed as the 'usage' argument to
    aom_codec_enc_config_default().
    New encoder control IDs added:
  - AV1E_SET_ENABLE_DIAGONAL_INTRA: Enable diagonal (D45 to D203) intra
    prediction modes (0: false, 1: true (default)). Also available as
    "enable-diagonal-intra" for the aom_codec_set_option() function.
    New aom_tune_metric enum value: AOM_TUNE_BUTTERAUGLI. The new aomenc option
  - -tune=butteraugli was added to optimize the encoder’s perceptual quality by
    optimizing the Butteraugli metric. Install libjxl (JPEG XL) and then pass
  - DCONFIG_TUNE_BUTTERAUGLI=1 to the cmake command to enable it.
- Includes 3.0
  https://aomedia.googlesource.com/aom/+/refs/tags/v3.0.0
  This release includes compression efficiency improvement, speed improvement
  for realtime mode, as well as some new APIs.
  - Upgrading:
    Support for PSNR calculation based on stream bit-depth.
    New encoder control IDs added:
  - AV1E_SET_ENABLE_RECT_TX
  - AV1E_SET_VBR_CORPUS_COMPLEXITY_LAP
  - AV1E_GET_BASELINE_GF_INTERVAL
  - AV1E_SET_ENABLE_DNL_DENOISING
    New decoder control IDs added:
  - AOMD_GET_FWD_KF_PRESENT
  - AOMD_GET_FRAME_FLAGS
  - AOMD_GET_ALTREF_PRESENT
  - AOMD_GET_TILE_INFO
  - AOMD_GET_SCREEN_CONTENT_TOOLS_INFO
  - AOMD_GET_STILL_PICTURE
  - AOMD_GET_SB_SIZE
  - AOMD_GET_SHOW_EXISTING_FRAME_FLAG
  - AOMD_GET_S_FRAME_INFO
    New aom_tune_content enum value: AOM_CONTENT_FILM
    New aom_tune_metric enum value: AOM_TUNE_VMAF_NEG_MAX_GAIN
    Coefficient and mode update can be turned off via
    AV1E_SET_{COEFF/MODE}_COST_UPD_FREQ.
    New key &amp; value API added, available with aom_codec_set_option() function.
    Scaling API expanded to include 1/4, 3/4 and 1/8.
  - Enhancements:
    Better multithreading performance with realtime mode.
    New speed 9 setting for faster realtime encoding.
    Smaller binary size with low bitdepth and realtime only build.
    Temporal denoiser and its optimizations on x86 and Neon.
    Optimizations for scaling.
    Faster encoding with speed settings 2 to 6 for good encoding mode.
    Improved documentation throughout the library, with function level
    documentation, tree view and support for the dot tool.
  - Bug fixes:
    Aside from those mentioned in v2.0.1 and v2.0.2, this release includes the
    following bug fixes:
    Issue 2940: Segfault when encoding with --use-16bit-internal and --limit &gt; 1
    Issue 2941: Decoder mismatch with --rt --bit-depth=10 and --cpu-used=8
    Issue 2895: mingw-w64 i686 gcc fails to build
    Issue 2874: Separate ssse3 functions from sse2 file.</changelog>
  <changelog author="rpm@fthiessen.de" date="1625227200">- Update to version 3.1.1
  * Fix vmaf model initialization error when not set to tune=vmaf
  * Fix consistent crash on near-static screen content, keyframe
    related
  * Fix tune=butteraugli mode
- Disable NEON on arm where not available.</changelog>
  <changelog author="pgajdos@suse.com" date="1629892800">- Update to version 3.1.2:
  * Update AUTHORS,CHANGELOG,CMakeLists.txt for v3.1.2
  * Avoid chroma resampling for 420mpeg2 input
  * Check array has two elements before using index 1
  * Fix DecodeScalabilityTest failure in realtime only
  * Store temporal_id and spatial_id of decoded frame
  * exports.cmake: use APPLE and WIN32 and use def for mingw-w64</changelog>
  <changelog author="pgajdos@suse.com" date="1629892801">- security update
- added patches
  fix CVE-2021-30475 [bsc#1189497], Buffer overflow in aom_dsp/noise_model.c
  + libaom-CVE-2021-30475.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1631188800">- security update
- added patches
  fix CVE-2021-30474 [bsc#1186799], aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free.
  + libaom-CVE-2021-30474.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1633694400">- Update to version 3.1.3:
  * Update CHANGELOG for v3.1.3-rc2
  * Detect chroma subsampling more directly
  * Detect chroma subsampling more directly
  * image2yuvconfig() should calculate uv_crop_width
  * aom/aom_encoder.h: remove configure option reference
  * aom_encoder.h: fix rc_overshoot_pct range
  * Update AUTHORS,CHANGELOG,CMakeLists.txt for v3.1.3
  * aom_install: don't exclude msvc from install
  * aom_install: use relpath for install
  * aom_install: Install lib dlls to bindir</changelog>
  <changelog author="gmbr3@opensuse.org" date="1634126400">- fix service data</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1634299200">- Update to version 3.2.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, as well
    as some new features.
  * New Features:
    + Introduced speeds 7, 8, and 9 for all intra mode.
    + Introduced speed 10 for real time mode.
    + Introduced an API that allows external partition decisions.
    + SVC: added support for compound prediction.
    + SVC: added support for fixed SVC modes.
  * Compression Efficiency Improvements:
    + Intra-mode search improvement.
    + Improved real time (RT) mode BDrate savings by ~5% (RT speed
    5) and ~12% (RT speed 6). The improvement was measured on the
    video conference set.
    + Improved real time mode for nonrd path (speed 7, 8, 9):
    BDrate gains of ~3-5%.
    + Rate control and RD adjustments based on ML research in VP9.
    Gains of ~0.5-1.0% for HD.
  * Perceptual Quality Improvements:
    + Added a new mode --deltaq-mode=3 to improve perceptual
    quality based on a differential contrast model for still
    images.
    + Added a new mode –deltaq-mode=4 to improve perceptual quality
    based on user rated cq_level data set for still images.
    + Weighting of some intra mode and partition size choices to
    better manage and retain texture.
  * Speedup and Memory Optimizations:
    + Further improved 2-pass good quality encoder speed:
    . Speed 2 speedup: 18%
    . Speed 3 speedup: 22%
    . Speed 4 speedup: 37%
    . Speed 5 speedup: 30%
    . Speed 6 speedup: 20%
    + Optimized the real time encoder (measured on the video
    conference set):
    . RT speed 5 speedup: 110%
    . RT speed 6 speedup: 77%
  * Bug Fixes
    + Issue 3069: Fix one-pass mode keyframe placement off-by-one
    error.
    + Issue 3156: Fix a bug in av1_quantize_lp AVX2 optimization.
- Drop libaom-CVE-2021-30474.patch: Fixed upstream.
- Drop libaom-CVE-2021-30475.patch: Fixed upstream.
- Remove changesgenerate option from _service file, use data from
  CHANGELOG to fill .changes instead as it it much nicer and human
  readable than just a list of commit messages.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1645185600">- Update to version 3.3.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, some
    new features, and several bug fixes.
  * New Features
  - AV1 RT: Introducing CDEF search level 5
  - Changed real time speed 4 to behave the same as real time
    speed 5
  - Add --deltaq-strength
  - rtc: Allow scene-change and overshoot detection for svc
  - rtc: Intra-only frame for svc
  - AV1 RT: Option 2 for codec control AV1E_SET_ENABLE_CDEF to
    disable CDEF on non-ref frames
  - New codec controls AV1E_SET_LOOPFILTER_CONTROL and
    AOME_GET_LOOPFILTER_LEVEL
  - Improvements to three pass encoding
  * Compression Efficiency Improvements: Overall compression gains:
    0.6%
  * Perceptual Quality Improvements
  - Improves the perceptual quality of high QP encoding for
    delta-q mode 4
  - Auto select noise synthesis level for all intra
  * Speedup and Memory Optimizations
  - Added many SSE2 optimizations.
  - Good quality 2-pass encoder speedups:
    o Speed 2: 9%
    o Speed 3: 12.5%
    o Speed 4: 8%
    o Speed 5: 3%
    o Speed 6: 4%
  - Real time mode encoder speedups:
    o Speed 5: 2.6% BDRate gain, 4% speedup
    o Speed 6: 3.5% BDRate gain, 4% speedup
    o Speed 9: 1% BDRate gain, 3% speedup
    o Speed 10: 3% BDRate gain, neutral speedup
  - All intra encoding speedups (AVIF):
    o Single thread - speed 6: 8%
    o Single thread - speed 9: 15%
    o Multi thread(8) - speed 6: 14%
    o Multi thread(8) - speed 9: 34%
  * Bug Fixes
  - Issue 3163: Segmentation fault when using
  - -enable-keyframe-filtering=2
  - Issue 2436: Integer overflow in av1_warp_affine_c()
  - Issue 3226: armv7 build failure due to gcc-11
  - Issue 3195: Bug report on libaom (AddressSanitizer:
    heap-buffer-overflow)
  - Issue 3191: Bug report on libaom (AddressSanitizer: SEGV on
    unknown address)
- Drop libaom-devel Requires from libaom-devel-doc sub-package: We
  do not need the devel package to be able to read the devel
  documentation.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1662292800">- Update to version 3.4.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, and
    some new features. There are no ABI or API breaking changes in
    this release.
  * New Features:
  - New --dist-metric flag with "qm-psnr" value to use
    quantization matrices in the distortion computation for RD
    search. The default value is "psnr".
  - New command line option "--auto-intra-tools-off=1" to make
    all-intra encoding faster for high bit rate under
    "--deltaq-mode=3" mode.
  - New rate control library aom_av1_rc for real-time hardware
    encoders. Supports CBR for both one spatial layer and SVC.
  - New image format AOM_IMG_FMT_NV12 can be used as input to the
    encoder. The presence of AOM_IMG_FMT_NV12 can be detected at
    compile time by checking if the macro AOM_HAVE_IMG_FMT_NV12
    is defined.
  - New codec controls for the encoder:
    o AV1E_SET_AUTO_INTRA_TOOLS_OFF. Only in effect if
  - -deltaq-mode=3.
    o AV1E_SET_RTC_EXTERNAL_RC
    o AV1E_SET_FP_MT. Only supported if libaom is built with
  - DCONFIG_FRAME_PARALLEL_ENCODE=1.
    o AV1E_GET_TARGET_SEQ_LEVEL_IDX
  - New key-value pairs for the key-value API:
    o --auto-intra-tools-off=0 (default) or 1. Only in effect if
  - -deltaq-mode=3.
    o --strict-level-conformance=0 (default) or 1
    o --fp-mt=0 (default) or 1. Only supported if libaom is built
    with -DCONFIG_FRAME_PARALLEL_ENCODE=1.
  - New aomenc options (not supported by the key-value API):
    o --nv12
  * Compression Efficiency Improvements:
  - Correctly calculate SSE for high bitdepth in skip mode, 0.2%
    to 0.6% coding gain.
  - RTC at speed 9/10: BD-rate gain of ~4/5%
  - RTC screen content coding: many improvements for real-time
    screen at speed 10 (quality, speedup, and rate control), up
    to high resolutions (1080p).
  - RTC-SVC: fixes to make intra-only frames work for spatial
    layers.
  - RTC-SVC: quality improvements for temporal layers.
  - AV1 RT: A new passive rate control strategy for screen
    content, an average of 7.5% coding gain, with some clips of
    20+%. The feature is turned off by default due to higher bit
    rate variation.
  * Perceptual Quality Improvements:
  - RTC: Visual quality improvements for high speeds (9/10)
  - Improvements in coding quality for all intra mode
  * Speedup and Memory Optimizations:
  - ~10% speedup in good quality mode encoding.
  - ~7% heap memory reduction in good quality encoding mode for
    speed 5 and 6.
  - Ongoing improvements to intra-frame encoding performance on
    Arm
  - Faster encoding speed for "--deltaq-mode=3" mode.
  - ~10% speedup for speed 5/6, ~15% speedup for speed 7/8, and
    ~10% speedup for speed 9/10 in real time encoding mode
  - ~20% heap memory reduction in still-picture encoding mode for
    360p-720p resolutions with multiple threads
  - ~13% speedup for speed 6 and ~12% speedup for speed 9 in
    still-picture encoding mode.
  - Optimizations to improve multi-thread efficiency for
    still-picture encoding mode.
  * Bug Fixes:
  - b/204460717: README.md: replace master with main
  - b/210677928: libaom disable_order is surprising for
    max_reference_frames=3
  - b/222461449: -DCONFIG_TUNE_BUTTERAUGLI=1 broken
  - b/227207606: write_greyscale writes incorrect chroma in
    highbd mode
  - b/229955363: Integer-overflow in linsolve_wiener
  - https://crbug.com/aomedia/2032
  - https://crbug.com/aomedia/2397
  - https://crbug.com/aomedia/2563
  - https://crbug.com/aomedia/2815
  - https://crbug.com/aomedia/3009
  - https://crbug.com/aomedia/3018
  - https://crbug.com/aomedia/3045
  - https://crbug.com/aomedia/3101
  - https://crbug.com/aomedia/3130
  - https://crbug.com/aomedia/3173
  - https://crbug.com/aomedia/3184
  - https://crbug.com/aomedia/3187
  - https://crbug.com/aomedia/3190
  - https://crbug.com/aomedia/3195
  - https://crbug.com/aomedia/3197
  - https://crbug.com/aomedia/3201
  - https://crbug.com/aomedia/3202
  - https://crbug.com/aomedia/3204
  - https://crbug.com/aomedia/3205
  - https://crbug.com/aomedia/3207
  - https://crbug.com/aomedia/3208
  - https://crbug.com/aomedia/3209
  - https://crbug.com/aomedia/3213
  - https://crbug.com/aomedia/3214
  - https://crbug.com/aomedia/3219
  - https://crbug.com/aomedia/3222
  - https://crbug.com/aomedia/3223
  - https://crbug.com/aomedia/3225
  - https://crbug.com/aomedia/3226
  - https://crbug.com/aomedia/3228
  - https://crbug.com/aomedia/3232
  - https://crbug.com/aomedia/3236
  - https://crbug.com/aomedia/3237
  - https://crbug.com/aomedia/3238
  - https://crbug.com/aomedia/3240
  - https://crbug.com/aomedia/3243
  - https://crbug.com/aomedia/3244
  - https://crbug.com/aomedia/3246
  - https://crbug.com/aomedia/3248
  - https://crbug.com/aomedia/3250
  - https://crbug.com/aomedia/3251
  - https://crbug.com/aomedia/3252
  - https://crbug.com/aomedia/3255
  - https://crbug.com/aomedia/3257
  - https://crbug.com/aomedia/3259
  - https://crbug.com/aomedia/3260
  - https://crbug.com/aomedia/3267
  - https://crbug.com/aomedia/3268
  - https://crbug.com/aomedia/3269
  - https://crbug.com/aomedia/3276
  - https://crbug.com/aomedia/3278
  - https://crbug.com/chromium/1290068
  - https://crbug.com/chromium/1303237
  - https://crbug.com/chromium/1304990
  - https://crbug.com/chromium/1321141
  - https://crbug.com/chromium/1321388
  - https://crbug.com/oss-fuzz/44846
  - https://crbug.com/oss-fuzz/44856
  - https://crbug.com/oss-fuzz/44862
  - https://crbug.com/oss-fuzz/44904
  - https://crbug.com/oss-fuzz/45056</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1663848000">- Update to version 3.5.0:
  * This release is ABI compatible with the last one, including
    speedup and memory optimizations, and new APIs and features.
  * New Features
  - Support for frame parallel encode for larger number of
    threads. --fp-mt flag is available for all build
    configurations.
  - New codec control AV1E_GET_NUM_OPERATING_POINTS
  * Speedup and Memory Optimizations
  - Speed-up multithreaded encoding for good quality mode for
    larger number of threads through frame parallel encoding:
    . 30-34% encode time reduction for 1080p, 16 threads, 1x1
    tile configuration (tile_rows x tile_columns)
    . 18-28% encode time reduction for 1080p, 16 threads, 2x4
    tile configuration
    . 18-20% encode time reduction for 2160p, 32 threads, 2x4
    tile configuration
  - 16-20% speed-up for speed=6 to 8 in still-picture encoding
    mode
  - 5-6% heap memory reduction for speed=6 to 10 in real-time
    encoding mode
  - Improvements to the speed for speed=7, 8 in real-time
    encoding mode
  - Improvements to the speed for speed=9, 10 in real-time screen
    encoding mode
  - Optimizations to improve multi-thread efficiency in real-time
    encoding mode
  - 10-15% speed up for SVC with temporal layers
  - SIMD optimizations:
    . Improve av1_quantize_fp_32x32_neon() 1.05x to 1.24x faster
    . Add aom_highbd_quantize_b{,_32x32,_64x64}_adaptive_neon()
    3.15x to 5.6x faster than "C"
    . Improve av1_quantize_fp_64x64_neon() 1.17x to 1.66x faster
    . Add aom_quantize_b_avx2() 1.4x to 1.7x faster than
    aom_quantize_b_avx()
    . Add aom_quantize_b_32x32_avx2() 1.4x to 2.3x faster than
    aom_quantize_b_32x32_avx()
    . Add aom_quantize_b_64x64_avx2() 2.0x to 2.4x faster than
    aom_quantize_b_64x64_ssse3()
    . Add aom_highbd_quantize_b_32x32_avx2() 9.0x to 10.5x faster
    than aom_highbd_quantize_b_32x32_c()
    . Add aom_highbd_quantize_b_64x64_avx2() 7.3x to 9.7x faster
    than aom_highbd_quantize_b_64x64_c()
    . Improve aom_highbd_quantize_b_avx2() 1.07x to 1.20x faster
    . Improve av1_quantize_fp_avx2() 1.13x to 1.49x faster
    . Improve av1_quantize_fp_32x32_avx2() 1.07x to 1.54x faster
    . Improve av1_quantize_fp_64x64_avx2()  1.03x to 1.25x faster
    . Improve av1_quantize_lp_avx2() 1.07x to 1.16x faster
  * Bug fixes including but not limited to
  - aomedia:3206 Assert that skip_width &gt; 0 for deconvolve
    function
  - aomedia:3278 row_mt enc: Delay top-right sync when intraBC is
    enabled
  - aomedia:3282 blend_a64_*_neon: fix bus error in armv7
  - aomedia:3283 FRAME_PARALLEL: Propagate border size to all
    cpis
  - aomedia:3283 RESIZE_MODE: Fix incorrect strides being used
    for motion search
  - aomedia:3286 rtc-svc: Fix to dynamic_enable spatial layers
  - aomedia:3289 rtc-screen: Fix to skipping inter-mode test in
    nonrd
  - aomedia:3289 rtc-screen: Fix for skip newmv on flat blocks
  - aomedia:3299 Fix build failure with CONFIG_TUNE_VMAF=1
  - aomedia:3296 Fix the conflict --enable-tx-size-search=0 with
    nonrd mode --enable-tx-size-search will be ignored in non-rd
    pick mode
  - aomedia:3304 Fix off-by-one error of max w/h in
    validate_config
  - aomedia:3306 Do not use pthread_setname_np on GNU/Hurd
  - aomedia:3325 row-multithreading produces invalid bitstream in
    some cases
  - chromium:1346938, chromium:1338114
  - compiler_flags.cmake: fix flag detection w/cmake 3.17-3.18.2
  - tools/*.py: update to python3
  - aom_configure.cmake: detect PIE and set CONFIG_PIC
  - test/simd_cmp_impl: use explicit types w/CompareSimd*
  - rtc: Fix to disable segm for aq-mode=3
  - rtc: Fix to color_sensitivity in variance partition
  - rtc-screen: Fix bsize in model rd computation for intra
    chroma
  - Fixes to ensure the correct behavior of the encoder
    algorithms (like segmentation, computation of statistics,
    etc.)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1675857600">- Update to version 3.6.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, and
    some new features. This release is ABI compatible with the last
    release.
  * New Features:
  - New values 20-27 (corresponding to levels 7.0-7.3 and
    8.0-8.3) for the encoder control
    AV1E_SET_TARGET_SEQ_LEVEL_IDX (note that the proposal to add
    the new levels are still in draft status). The original
    special value 24 (keep level stats only for level monitoring)
    is renumbered as 32.
  - New encoder control AV1E_SET_SKIP_POSTPROC_FILTERING to skip
    the application of post-processing filters on reconstructed
    frame in all intra mode.
  - New encoder option "kf-max-pyr-height": Maximum height of
    pyramid structure used for the GOP starting with a key frame
    (-1 to 5).
  - Make SVC work for screen content.
  - Rate control improvements to reduce frame-size spikes for
    screen content coding.
  - RISC-V architecture support with gcc toolchain.
  * Compression Efficiency Improvements:
  - Peak compression efficiency in VOD setting is improved by 1%.
  - 0.7% - 2.2% RTC encoding BDrate gains for real time speed 8
    to 10.
  - 15% RTC encoding BDrate gains for screen content speed 10.
  * Perceptual Quality Improvements:
  - Resolved a visual quality issue that was reported for high
    resolution clips (2K) for speed 4 and above in VOD use case.
  - Visual quality improvements to screen content coding.
  - Quality improvements to temporal layer RTC coding.
  * Speedup and Memory Optimizations:
  - RTC single-thread encoder speedup:
    . ~6% instruction count reduction for speed 5 and 6.
    . ~15% instruction count reduction for speed 7.
    . ~10% instruction count reduction for speed 8 to 10 (&gt;=360p
    resolutions).
  - RTC multi-thread encoder speedup (beyond single-thread
    speedup):
    . 5-8% encode time reduction for speed 7 to 10.
  - RTC screen-content encoder speedup:
    . 11% instruction count reduction for speed 9 and 10 (&gt;=720p
    resolutions).
  - ~5% reduction in heap memory requirements for RTC, speed 6 to
    10.
  * AVIF:
    . 4-5% speedup for speed 9 in still-picture encoding mode.
    . 3-4% heap memory reduction in still-picture encoding mode
    for 360p-720p resolutions with multiple threads.
  * Bug Fixes:
  - Added a workaround for an AV1 specification bug which makes
    TRANSLATION type global motion models unusable.
  - Fixed AddressSanitizer global-buffer-overflow errors in
    av1/encoder/arm/neon/av1_fwd_txfm2d_neon.c.
  - Fixed AddressSanitizer heap-buffer-overflow error in
    av1_wiener_convolve_add_src_neon().
  - chromium:1393384 Avoid scene detection on spatial resize.
  - aomedia:3308 Remove color artifacts under high motion.
  - aomedia:3310 Avoid out of memory failures with Visual Studio
    2017, 2019, and 2022 for Win32 x86 builds.
  - aomedia:3346 Make SVC work properly for screen content.
  - aomedia:3348 Fix a bug where an uninitialized search_site is
    used.
  - aomedia:3365 Work around what seems like a Visual Studio 2022
    compiler optimization bug.
  - aomedia:3369 Incorrect PSNR values reported by libaom for
    12-bit encode.
- Modernize spec, use cmake_build and ldconfig_scriptlets macros.</changelog>
  <changelog author="fcrozat@suse.com" date="1681992000">- Fix license tag to BSD-2-Clause and AOMPL-1.0.</changelog>
  <changelog author="fcrozat@suse.com" date="1683028800">- Revert to BSD-2-Clause licence tag to only use SPDX valid
  license tag.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1683720000">- Update to version 3.6.1:
  * aomedia:2871: Guard the support of the 7.x and 8.x levels for
    AV1 under the CONFIG_CWG_C013 config flag, and only output the
    7.x and 8.x levels when explicitly requested.
  * aomedia:3382: Choose sb_size by ppi instead of svc.
  * aomedia:3384: Fix fullpel search limits.
  * aomedia:3388: Replace left shift of xq_active by
    multiplication.
  * aomedia:3389: Fix MV clamping in av1_mv_pred.
  * aomedia:3390: set_ld_layer_depth: cap max_layer_depth to
    MAX_ARF_LAYERS.
  * aomedia:3418: Fix MV clamping in av1_int_pro_motion_estimation.
  * aomedia:3429: Move lpf thread data init to
    lpf_pipeline_mt_init().
  * b:266719111: Fix undefined behavior in Arm Neon code.
  * b:269840681: nonrd_opt: align scan tables.
  * rtc: Fix is_key_frame setting in variance partition.
  * Build: Fix build with clang-cl and Visual Studio.</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1693569600">- New upstream release 3.7.0
  - New Features
  * New codec controls:
  * AV1E_SET_QUANTIZER_ONE_PASS: Set quantizer for each frame.
  * AV1E_ENABLE_RATE_GUIDE_DELTAQ: enable the rate distribution guided delta
    quantization in all intra mode. The "enable-rate-guide-deltaq" option is
    added for this control.
  * AV1E_SET_RATE_DISTRIBUTION_INFO: set the input file for rate
    distribution used in all intra mode. The "rate-distribution-info" option
    is added for this control.
  * AV1E_GET_LUMA_CDEF_STRENGTH
  * AV1E_SET_BITRATE_ONE_PASS_CBR
  * AOM_SCALING_MODE is extended to include 2/3 and 1/3 scaling.
  * aom_tune_metric is extended to include AOM_TUNE_VMAF_SALIENCY_MAP.
    The "tune" option is extended to include "vmaf_saliency_map".
  * SVC example encoder svc_encoder_rtc is able to use the rate control
    library.
  * Loopfilter level and CDEF filter level is supported by RTC rate control
    library.
  * New speed (--cpu-used) 11, intended for RTC screen sharing, added for
    faster encoding with ~3% bdrate loss with 16% IC (instruction count)
    speedup compared to speed 10.
  - Compression Efficiency Improvements
  * Improved VoD encoding performance
  * 0.1-0.6% BDrate gains for encoding speeds 2 to 6
  * Rate control accuracy improvement in VBR mode
  * RTC encoding improvements
  * Screen content mode: 10-19% BDrate gains for speeds 6 - 10
  * Temporal layers video mode, for speed 10:
  * 2 temporal layers on low resolutions: 13-15% BDrate gain
  * 3 temporal layers on VGA/HD: 3-4% BDrate gain
  - Perceptual Quality Improvements
  * Fixed multiple block and color artifacts for RTC screen content by
  * Incorporating color into RD cost for IDTX
  * Reducing thresholds for palette mode in non RD mode
  * Allowing more palette mode testing
  * Improved color sensitivity for altref in non-RD mode.
  * Reduced video flickering for temporal layer encoding.
  - Speedup and Memory Optimizations
  * Speed up the VoD encoder
  * 2-5% for encoding speed 2 to 4
  * 9-15% for encoding speed 5 to 6
  * ARM
  * Standard bitdepth
  * speed 5: +31%
  * speed 4: +2%
  * speed 3: +9%
  * speed 2: +157%
  * High bitdepth
  * speed 5: +85%
  * RTC speedups
  * Screen content mode
  * 15% IC speedup for speeds 6-8
  * ARM: 7% for speed 9, 3% for speed 10
  * Temporal layers video mode
  * 7% speedup for 3 temporal layers on VGA/HD, for speed 10
  * Single layer video
  * x86: 2% IC speedup for speeds 7-10
  * ARM: 2-4% speedup across speeds 5-10
  - Bug Fixes
  * aomedia:3261 Assertion failed when encoding av1 with film grain and
    '--monochrome' flag
  * aomedia:3276 ensure all allocations are checked (partial fix)
  * aomedia:3451 The libaom library calls exit()
  * aomedia:3450 enable -Wshadow for C++ sources
  * aomedia:3449 Test Seg Faults After
    b459af3e345be402db052a143fcc5383d4b74cbd
  * aomedia:3416 prune unused symbols / restrict symbol visibility
  * aomedia:3443 Jenkins failure:
    UninstantiatedParameterizedTestSuite&lt;EstimateNoiseTest&gt;
  * aomedia:3434 realtime failures with CONFIG_BITSTREAM_DEBUG=1
  * aomedia:3433 DeltaqModeTest crash w/row_mt=0
  * aomedia:3429 Encoder crash when turn on both ExternalResize and
    g_threads &gt; 2
  * aomedia:3438 Build failure with
    `-DSANITIZE=address -DBUILD_SHARED_LIBS=ON` when using clang.
  * aomedia:3435 Block artifacts when scrolling with AV1 in screen sharing
    scenarios
  * aomedia:3170 vmaf tune presets produce extreme glitches in one scene
  * aomedia:3401 Building shared libaom with MSVC results in a race condition
    with the export library
  * aomedia:3420 Floating point exception in av1_tpl_get_frame_importance()
  * aomedia:3424 heap-buffer-overflow in ScaleFilterCols_16_C() (SIGABRT)
  * aomedia:3417 examples/svc_encoder_rtc.c is using internal macros and
    functions
  * aomedia:3372 SEGV in assign_frame_buffer_p av1_common_int.h
  * aomedia:3130 'cpu-features.h' file not found on Android NDK 22
  * aomedia:3415 Encoder/decoder mismatch for svc_encoder_rtc running
    1 SL 3 TL
  * aomedia:3412 Lossless Mode Fails Loopback Bit Test
  * aomedia:3409 The use of AV1_VAR_OFFS in av1/encoder/var_based_part.c is
    incorrect for high bit depths
  * aomedia:3403 test_libaom fails with error message
    "feenableexcept() failed" on Linux arm
  * aomedia:3370 Random color block at fast motion area
  * aomedia:3393 Assertion failure in av1_convolve_2d_sr_c()
  * aomedia:3392 Strong artifacting for high bit-depth real-time
  * aomedia:3376 aomenc --threads=10 --deltaq-mode=3 crashes after
    "Allintra: multi-threading of calculating differential contrast"
  * aomedia:3380 Crashes and ASan and TSan errors in deltaq-mode=3
    multithreading code
  * chromium:1410766 heap-buffer-overflow in aom_yv12_copy_v_c
  * Cannot set level via AV1E_SET_TARGET_SEQ_LEVEL_IDX
  * Encoding failure due to the use of loop restoration with unintended use of
    lossless mode.
  * Signed integer overflow in scan_past_frames
  * Signed integer overflow in update_a_sep_sym
  * Flickering in AV1 1440p/2160p HDR transcodes
  * Fixed artifacts with screen share at encoder speed 10
  * Fixed prediction setup for IDTX
- Use system libraries instead of vendored ones
  * system-gtest.patch
  * system-yuv.patch
- Enable debuginfo also on modules written in assembly
- Enable building PowerPC-specific optimizations
- Enable Neon optimized code on ARM and fix runtime CPU detection
- Fix missing images in documentation</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1693915200">- Split docs to multibuild to avoid dependency cycle</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701777600">- Update to version 3.7.1:
  * Bug Fixes:
  - aomedia:3349: heap overflow when increasing resolution
  - aomedia:3478: GCC 12.2.0 emits a -Wstringop-overflow warning
    on aom/av1/encoder/motion_search_facade.c
  - aomedia:3489: Detect encoder and image high bit depth
    mismatch
  - aomedia:3491: heap-buffer-overflow on frame size change
  - b/303023614:  Segfault at encoding time for high bit depth
    images
- Switch buildtime compression to zst.</changelog>
  <changelog author="pgajdos@suse.com" date="1718020800">- security update
- added patches
  fix CVE-2024-5171 [bsc#1226020], heap buffer overflow in img_alloc_helper() caused by integer overflow
  + libaom-CVE-2024-5171.patch</changelog>
</package>
<package pkgid="638e4c73fdc5d4980a285accdb89d1d2682e31700e0a01be5fa3223fab971fb9" name="aom-tools" arch="s390x">
  <version epoch="0" ver="3.7.1" rel="150600.3.3.1"/>
  <changelog author="elimat@opensuse.org" date="1614600000">- Update to version 2.0.2:
  * Prepare for the libaom v2.0.2 release
  * Call av1_setup_frame_size() when dropping a frame
  * Avoid memset in filter_intra_predictor module
  * Fix a typo bug in apply_temporal_filter_planewise
  * Modify the assertion in temporal filter intrinsics
  * Fix unit test ThreadTestLarge.EncoderResultTest/49
  * Add -Wimplicit-function-declaration as C flag only
  * Update CHANGELOG for libaom v2.0.1
  * Set allow_screen_content_tools to 0 in rt mode
  * chroma_check: don't access UV planes if monochrome</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620648000">- Update to version 3.1.0 (bsc#1185843):
  https://aomedia.googlesource.com/aom/+/refs/tags/v3.1.0
  This release adds an "all intra" mode to the encoder, which significantly
  speeds up the encoding of AVIF still images at speed 6.
  - Upgrading:
    All intra mode for encoding AVIF still images and AV1 all intra videos:
    AOM_USAGE_ALL_INTRA (2) can be passed as the 'usage' argument to
    aom_codec_enc_config_default().
    New encoder control IDs added:
  - AV1E_SET_ENABLE_DIAGONAL_INTRA: Enable diagonal (D45 to D203) intra
    prediction modes (0: false, 1: true (default)). Also available as
    "enable-diagonal-intra" for the aom_codec_set_option() function.
    New aom_tune_metric enum value: AOM_TUNE_BUTTERAUGLI. The new aomenc option
  - -tune=butteraugli was added to optimize the encoder’s perceptual quality by
    optimizing the Butteraugli metric. Install libjxl (JPEG XL) and then pass
  - DCONFIG_TUNE_BUTTERAUGLI=1 to the cmake command to enable it.
- Includes 3.0
  https://aomedia.googlesource.com/aom/+/refs/tags/v3.0.0
  This release includes compression efficiency improvement, speed improvement
  for realtime mode, as well as some new APIs.
  - Upgrading:
    Support for PSNR calculation based on stream bit-depth.
    New encoder control IDs added:
  - AV1E_SET_ENABLE_RECT_TX
  - AV1E_SET_VBR_CORPUS_COMPLEXITY_LAP
  - AV1E_GET_BASELINE_GF_INTERVAL
  - AV1E_SET_ENABLE_DNL_DENOISING
    New decoder control IDs added:
  - AOMD_GET_FWD_KF_PRESENT
  - AOMD_GET_FRAME_FLAGS
  - AOMD_GET_ALTREF_PRESENT
  - AOMD_GET_TILE_INFO
  - AOMD_GET_SCREEN_CONTENT_TOOLS_INFO
  - AOMD_GET_STILL_PICTURE
  - AOMD_GET_SB_SIZE
  - AOMD_GET_SHOW_EXISTING_FRAME_FLAG
  - AOMD_GET_S_FRAME_INFO
    New aom_tune_content enum value: AOM_CONTENT_FILM
    New aom_tune_metric enum value: AOM_TUNE_VMAF_NEG_MAX_GAIN
    Coefficient and mode update can be turned off via
    AV1E_SET_{COEFF/MODE}_COST_UPD_FREQ.
    New key &amp; value API added, available with aom_codec_set_option() function.
    Scaling API expanded to include 1/4, 3/4 and 1/8.
  - Enhancements:
    Better multithreading performance with realtime mode.
    New speed 9 setting for faster realtime encoding.
    Smaller binary size with low bitdepth and realtime only build.
    Temporal denoiser and its optimizations on x86 and Neon.
    Optimizations for scaling.
    Faster encoding with speed settings 2 to 6 for good encoding mode.
    Improved documentation throughout the library, with function level
    documentation, tree view and support for the dot tool.
  - Bug fixes:
    Aside from those mentioned in v2.0.1 and v2.0.2, this release includes the
    following bug fixes:
    Issue 2940: Segfault when encoding with --use-16bit-internal and --limit &gt; 1
    Issue 2941: Decoder mismatch with --rt --bit-depth=10 and --cpu-used=8
    Issue 2895: mingw-w64 i686 gcc fails to build
    Issue 2874: Separate ssse3 functions from sse2 file.</changelog>
  <changelog author="rpm@fthiessen.de" date="1625227200">- Update to version 3.1.1
  * Fix vmaf model initialization error when not set to tune=vmaf
  * Fix consistent crash on near-static screen content, keyframe
    related
  * Fix tune=butteraugli mode
- Disable NEON on arm where not available.</changelog>
  <changelog author="pgajdos@suse.com" date="1629892800">- Update to version 3.1.2:
  * Update AUTHORS,CHANGELOG,CMakeLists.txt for v3.1.2
  * Avoid chroma resampling for 420mpeg2 input
  * Check array has two elements before using index 1
  * Fix DecodeScalabilityTest failure in realtime only
  * Store temporal_id and spatial_id of decoded frame
  * exports.cmake: use APPLE and WIN32 and use def for mingw-w64</changelog>
  <changelog author="pgajdos@suse.com" date="1629892801">- security update
- added patches
  fix CVE-2021-30475 [bsc#1189497], Buffer overflow in aom_dsp/noise_model.c
  + libaom-CVE-2021-30475.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1631188800">- security update
- added patches
  fix CVE-2021-30474 [bsc#1186799], aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free.
  + libaom-CVE-2021-30474.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1633694400">- Update to version 3.1.3:
  * Update CHANGELOG for v3.1.3-rc2
  * Detect chroma subsampling more directly
  * Detect chroma subsampling more directly
  * image2yuvconfig() should calculate uv_crop_width
  * aom/aom_encoder.h: remove configure option reference
  * aom_encoder.h: fix rc_overshoot_pct range
  * Update AUTHORS,CHANGELOG,CMakeLists.txt for v3.1.3
  * aom_install: don't exclude msvc from install
  * aom_install: use relpath for install
  * aom_install: Install lib dlls to bindir</changelog>
  <changelog author="gmbr3@opensuse.org" date="1634126400">- fix service data</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1634299200">- Update to version 3.2.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, as well
    as some new features.
  * New Features:
    + Introduced speeds 7, 8, and 9 for all intra mode.
    + Introduced speed 10 for real time mode.
    + Introduced an API that allows external partition decisions.
    + SVC: added support for compound prediction.
    + SVC: added support for fixed SVC modes.
  * Compression Efficiency Improvements:
    + Intra-mode search improvement.
    + Improved real time (RT) mode BDrate savings by ~5% (RT speed
    5) and ~12% (RT speed 6). The improvement was measured on the
    video conference set.
    + Improved real time mode for nonrd path (speed 7, 8, 9):
    BDrate gains of ~3-5%.
    + Rate control and RD adjustments based on ML research in VP9.
    Gains of ~0.5-1.0% for HD.
  * Perceptual Quality Improvements:
    + Added a new mode --deltaq-mode=3 to improve perceptual
    quality based on a differential contrast model for still
    images.
    + Added a new mode –deltaq-mode=4 to improve perceptual quality
    based on user rated cq_level data set for still images.
    + Weighting of some intra mode and partition size choices to
    better manage and retain texture.
  * Speedup and Memory Optimizations:
    + Further improved 2-pass good quality encoder speed:
    . Speed 2 speedup: 18%
    . Speed 3 speedup: 22%
    . Speed 4 speedup: 37%
    . Speed 5 speedup: 30%
    . Speed 6 speedup: 20%
    + Optimized the real time encoder (measured on the video
    conference set):
    . RT speed 5 speedup: 110%
    . RT speed 6 speedup: 77%
  * Bug Fixes
    + Issue 3069: Fix one-pass mode keyframe placement off-by-one
    error.
    + Issue 3156: Fix a bug in av1_quantize_lp AVX2 optimization.
- Drop libaom-CVE-2021-30474.patch: Fixed upstream.
- Drop libaom-CVE-2021-30475.patch: Fixed upstream.
- Remove changesgenerate option from _service file, use data from
  CHANGELOG to fill .changes instead as it it much nicer and human
  readable than just a list of commit messages.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1645185600">- Update to version 3.3.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, some
    new features, and several bug fixes.
  * New Features
  - AV1 RT: Introducing CDEF search level 5
  - Changed real time speed 4 to behave the same as real time
    speed 5
  - Add --deltaq-strength
  - rtc: Allow scene-change and overshoot detection for svc
  - rtc: Intra-only frame for svc
  - AV1 RT: Option 2 for codec control AV1E_SET_ENABLE_CDEF to
    disable CDEF on non-ref frames
  - New codec controls AV1E_SET_LOOPFILTER_CONTROL and
    AOME_GET_LOOPFILTER_LEVEL
  - Improvements to three pass encoding
  * Compression Efficiency Improvements: Overall compression gains:
    0.6%
  * Perceptual Quality Improvements
  - Improves the perceptual quality of high QP encoding for
    delta-q mode 4
  - Auto select noise synthesis level for all intra
  * Speedup and Memory Optimizations
  - Added many SSE2 optimizations.
  - Good quality 2-pass encoder speedups:
    o Speed 2: 9%
    o Speed 3: 12.5%
    o Speed 4: 8%
    o Speed 5: 3%
    o Speed 6: 4%
  - Real time mode encoder speedups:
    o Speed 5: 2.6% BDRate gain, 4% speedup
    o Speed 6: 3.5% BDRate gain, 4% speedup
    o Speed 9: 1% BDRate gain, 3% speedup
    o Speed 10: 3% BDRate gain, neutral speedup
  - All intra encoding speedups (AVIF):
    o Single thread - speed 6: 8%
    o Single thread - speed 9: 15%
    o Multi thread(8) - speed 6: 14%
    o Multi thread(8) - speed 9: 34%
  * Bug Fixes
  - Issue 3163: Segmentation fault when using
  - -enable-keyframe-filtering=2
  - Issue 2436: Integer overflow in av1_warp_affine_c()
  - Issue 3226: armv7 build failure due to gcc-11
  - Issue 3195: Bug report on libaom (AddressSanitizer:
    heap-buffer-overflow)
  - Issue 3191: Bug report on libaom (AddressSanitizer: SEGV on
    unknown address)
- Drop libaom-devel Requires from libaom-devel-doc sub-package: We
  do not need the devel package to be able to read the devel
  documentation.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1662292800">- Update to version 3.4.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, and
    some new features. There are no ABI or API breaking changes in
    this release.
  * New Features:
  - New --dist-metric flag with "qm-psnr" value to use
    quantization matrices in the distortion computation for RD
    search. The default value is "psnr".
  - New command line option "--auto-intra-tools-off=1" to make
    all-intra encoding faster for high bit rate under
    "--deltaq-mode=3" mode.
  - New rate control library aom_av1_rc for real-time hardware
    encoders. Supports CBR for both one spatial layer and SVC.
  - New image format AOM_IMG_FMT_NV12 can be used as input to the
    encoder. The presence of AOM_IMG_FMT_NV12 can be detected at
    compile time by checking if the macro AOM_HAVE_IMG_FMT_NV12
    is defined.
  - New codec controls for the encoder:
    o AV1E_SET_AUTO_INTRA_TOOLS_OFF. Only in effect if
  - -deltaq-mode=3.
    o AV1E_SET_RTC_EXTERNAL_RC
    o AV1E_SET_FP_MT. Only supported if libaom is built with
  - DCONFIG_FRAME_PARALLEL_ENCODE=1.
    o AV1E_GET_TARGET_SEQ_LEVEL_IDX
  - New key-value pairs for the key-value API:
    o --auto-intra-tools-off=0 (default) or 1. Only in effect if
  - -deltaq-mode=3.
    o --strict-level-conformance=0 (default) or 1
    o --fp-mt=0 (default) or 1. Only supported if libaom is built
    with -DCONFIG_FRAME_PARALLEL_ENCODE=1.
  - New aomenc options (not supported by the key-value API):
    o --nv12
  * Compression Efficiency Improvements:
  - Correctly calculate SSE for high bitdepth in skip mode, 0.2%
    to 0.6% coding gain.
  - RTC at speed 9/10: BD-rate gain of ~4/5%
  - RTC screen content coding: many improvements for real-time
    screen at speed 10 (quality, speedup, and rate control), up
    to high resolutions (1080p).
  - RTC-SVC: fixes to make intra-only frames work for spatial
    layers.
  - RTC-SVC: quality improvements for temporal layers.
  - AV1 RT: A new passive rate control strategy for screen
    content, an average of 7.5% coding gain, with some clips of
    20+%. The feature is turned off by default due to higher bit
    rate variation.
  * Perceptual Quality Improvements:
  - RTC: Visual quality improvements for high speeds (9/10)
  - Improvements in coding quality for all intra mode
  * Speedup and Memory Optimizations:
  - ~10% speedup in good quality mode encoding.
  - ~7% heap memory reduction in good quality encoding mode for
    speed 5 and 6.
  - Ongoing improvements to intra-frame encoding performance on
    Arm
  - Faster encoding speed for "--deltaq-mode=3" mode.
  - ~10% speedup for speed 5/6, ~15% speedup for speed 7/8, and
    ~10% speedup for speed 9/10 in real time encoding mode
  - ~20% heap memory reduction in still-picture encoding mode for
    360p-720p resolutions with multiple threads
  - ~13% speedup for speed 6 and ~12% speedup for speed 9 in
    still-picture encoding mode.
  - Optimizations to improve multi-thread efficiency for
    still-picture encoding mode.
  * Bug Fixes:
  - b/204460717: README.md: replace master with main
  - b/210677928: libaom disable_order is surprising for
    max_reference_frames=3
  - b/222461449: -DCONFIG_TUNE_BUTTERAUGLI=1 broken
  - b/227207606: write_greyscale writes incorrect chroma in
    highbd mode
  - b/229955363: Integer-overflow in linsolve_wiener
  - https://crbug.com/aomedia/2032
  - https://crbug.com/aomedia/2397
  - https://crbug.com/aomedia/2563
  - https://crbug.com/aomedia/2815
  - https://crbug.com/aomedia/3009
  - https://crbug.com/aomedia/3018
  - https://crbug.com/aomedia/3045
  - https://crbug.com/aomedia/3101
  - https://crbug.com/aomedia/3130
  - https://crbug.com/aomedia/3173
  - https://crbug.com/aomedia/3184
  - https://crbug.com/aomedia/3187
  - https://crbug.com/aomedia/3190
  - https://crbug.com/aomedia/3195
  - https://crbug.com/aomedia/3197
  - https://crbug.com/aomedia/3201
  - https://crbug.com/aomedia/3202
  - https://crbug.com/aomedia/3204
  - https://crbug.com/aomedia/3205
  - https://crbug.com/aomedia/3207
  - https://crbug.com/aomedia/3208
  - https://crbug.com/aomedia/3209
  - https://crbug.com/aomedia/3213
  - https://crbug.com/aomedia/3214
  - https://crbug.com/aomedia/3219
  - https://crbug.com/aomedia/3222
  - https://crbug.com/aomedia/3223
  - https://crbug.com/aomedia/3225
  - https://crbug.com/aomedia/3226
  - https://crbug.com/aomedia/3228
  - https://crbug.com/aomedia/3232
  - https://crbug.com/aomedia/3236
  - https://crbug.com/aomedia/3237
  - https://crbug.com/aomedia/3238
  - https://crbug.com/aomedia/3240
  - https://crbug.com/aomedia/3243
  - https://crbug.com/aomedia/3244
  - https://crbug.com/aomedia/3246
  - https://crbug.com/aomedia/3248
  - https://crbug.com/aomedia/3250
  - https://crbug.com/aomedia/3251
  - https://crbug.com/aomedia/3252
  - https://crbug.com/aomedia/3255
  - https://crbug.com/aomedia/3257
  - https://crbug.com/aomedia/3259
  - https://crbug.com/aomedia/3260
  - https://crbug.com/aomedia/3267
  - https://crbug.com/aomedia/3268
  - https://crbug.com/aomedia/3269
  - https://crbug.com/aomedia/3276
  - https://crbug.com/aomedia/3278
  - https://crbug.com/chromium/1290068
  - https://crbug.com/chromium/1303237
  - https://crbug.com/chromium/1304990
  - https://crbug.com/chromium/1321141
  - https://crbug.com/chromium/1321388
  - https://crbug.com/oss-fuzz/44846
  - https://crbug.com/oss-fuzz/44856
  - https://crbug.com/oss-fuzz/44862
  - https://crbug.com/oss-fuzz/44904
  - https://crbug.com/oss-fuzz/45056</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1663848000">- Update to version 3.5.0:
  * This release is ABI compatible with the last one, including
    speedup and memory optimizations, and new APIs and features.
  * New Features
  - Support for frame parallel encode for larger number of
    threads. --fp-mt flag is available for all build
    configurations.
  - New codec control AV1E_GET_NUM_OPERATING_POINTS
  * Speedup and Memory Optimizations
  - Speed-up multithreaded encoding for good quality mode for
    larger number of threads through frame parallel encoding:
    . 30-34% encode time reduction for 1080p, 16 threads, 1x1
    tile configuration (tile_rows x tile_columns)
    . 18-28% encode time reduction for 1080p, 16 threads, 2x4
    tile configuration
    . 18-20% encode time reduction for 2160p, 32 threads, 2x4
    tile configuration
  - 16-20% speed-up for speed=6 to 8 in still-picture encoding
    mode
  - 5-6% heap memory reduction for speed=6 to 10 in real-time
    encoding mode
  - Improvements to the speed for speed=7, 8 in real-time
    encoding mode
  - Improvements to the speed for speed=9, 10 in real-time screen
    encoding mode
  - Optimizations to improve multi-thread efficiency in real-time
    encoding mode
  - 10-15% speed up for SVC with temporal layers
  - SIMD optimizations:
    . Improve av1_quantize_fp_32x32_neon() 1.05x to 1.24x faster
    . Add aom_highbd_quantize_b{,_32x32,_64x64}_adaptive_neon()
    3.15x to 5.6x faster than "C"
    . Improve av1_quantize_fp_64x64_neon() 1.17x to 1.66x faster
    . Add aom_quantize_b_avx2() 1.4x to 1.7x faster than
    aom_quantize_b_avx()
    . Add aom_quantize_b_32x32_avx2() 1.4x to 2.3x faster than
    aom_quantize_b_32x32_avx()
    . Add aom_quantize_b_64x64_avx2() 2.0x to 2.4x faster than
    aom_quantize_b_64x64_ssse3()
    . Add aom_highbd_quantize_b_32x32_avx2() 9.0x to 10.5x faster
    than aom_highbd_quantize_b_32x32_c()
    . Add aom_highbd_quantize_b_64x64_avx2() 7.3x to 9.7x faster
    than aom_highbd_quantize_b_64x64_c()
    . Improve aom_highbd_quantize_b_avx2() 1.07x to 1.20x faster
    . Improve av1_quantize_fp_avx2() 1.13x to 1.49x faster
    . Improve av1_quantize_fp_32x32_avx2() 1.07x to 1.54x faster
    . Improve av1_quantize_fp_64x64_avx2()  1.03x to 1.25x faster
    . Improve av1_quantize_lp_avx2() 1.07x to 1.16x faster
  * Bug fixes including but not limited to
  - aomedia:3206 Assert that skip_width &gt; 0 for deconvolve
    function
  - aomedia:3278 row_mt enc: Delay top-right sync when intraBC is
    enabled
  - aomedia:3282 blend_a64_*_neon: fix bus error in armv7
  - aomedia:3283 FRAME_PARALLEL: Propagate border size to all
    cpis
  - aomedia:3283 RESIZE_MODE: Fix incorrect strides being used
    for motion search
  - aomedia:3286 rtc-svc: Fix to dynamic_enable spatial layers
  - aomedia:3289 rtc-screen: Fix to skipping inter-mode test in
    nonrd
  - aomedia:3289 rtc-screen: Fix for skip newmv on flat blocks
  - aomedia:3299 Fix build failure with CONFIG_TUNE_VMAF=1
  - aomedia:3296 Fix the conflict --enable-tx-size-search=0 with
    nonrd mode --enable-tx-size-search will be ignored in non-rd
    pick mode
  - aomedia:3304 Fix off-by-one error of max w/h in
    validate_config
  - aomedia:3306 Do not use pthread_setname_np on GNU/Hurd
  - aomedia:3325 row-multithreading produces invalid bitstream in
    some cases
  - chromium:1346938, chromium:1338114
  - compiler_flags.cmake: fix flag detection w/cmake 3.17-3.18.2
  - tools/*.py: update to python3
  - aom_configure.cmake: detect PIE and set CONFIG_PIC
  - test/simd_cmp_impl: use explicit types w/CompareSimd*
  - rtc: Fix to disable segm for aq-mode=3
  - rtc: Fix to color_sensitivity in variance partition
  - rtc-screen: Fix bsize in model rd computation for intra
    chroma
  - Fixes to ensure the correct behavior of the encoder
    algorithms (like segmentation, computation of statistics,
    etc.)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1675857600">- Update to version 3.6.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, and
    some new features. This release is ABI compatible with the last
    release.
  * New Features:
  - New values 20-27 (corresponding to levels 7.0-7.3 and
    8.0-8.3) for the encoder control
    AV1E_SET_TARGET_SEQ_LEVEL_IDX (note that the proposal to add
    the new levels are still in draft status). The original
    special value 24 (keep level stats only for level monitoring)
    is renumbered as 32.
  - New encoder control AV1E_SET_SKIP_POSTPROC_FILTERING to skip
    the application of post-processing filters on reconstructed
    frame in all intra mode.
  - New encoder option "kf-max-pyr-height": Maximum height of
    pyramid structure used for the GOP starting with a key frame
    (-1 to 5).
  - Make SVC work for screen content.
  - Rate control improvements to reduce frame-size spikes for
    screen content coding.
  - RISC-V architecture support with gcc toolchain.
  * Compression Efficiency Improvements:
  - Peak compression efficiency in VOD setting is improved by 1%.
  - 0.7% - 2.2% RTC encoding BDrate gains for real time speed 8
    to 10.
  - 15% RTC encoding BDrate gains for screen content speed 10.
  * Perceptual Quality Improvements:
  - Resolved a visual quality issue that was reported for high
    resolution clips (2K) for speed 4 and above in VOD use case.
  - Visual quality improvements to screen content coding.
  - Quality improvements to temporal layer RTC coding.
  * Speedup and Memory Optimizations:
  - RTC single-thread encoder speedup:
    . ~6% instruction count reduction for speed 5 and 6.
    . ~15% instruction count reduction for speed 7.
    . ~10% instruction count reduction for speed 8 to 10 (&gt;=360p
    resolutions).
  - RTC multi-thread encoder speedup (beyond single-thread
    speedup):
    . 5-8% encode time reduction for speed 7 to 10.
  - RTC screen-content encoder speedup:
    . 11% instruction count reduction for speed 9 and 10 (&gt;=720p
    resolutions).
  - ~5% reduction in heap memory requirements for RTC, speed 6 to
    10.
  * AVIF:
    . 4-5% speedup for speed 9 in still-picture encoding mode.
    . 3-4% heap memory reduction in still-picture encoding mode
    for 360p-720p resolutions with multiple threads.
  * Bug Fixes:
  - Added a workaround for an AV1 specification bug which makes
    TRANSLATION type global motion models unusable.
  - Fixed AddressSanitizer global-buffer-overflow errors in
    av1/encoder/arm/neon/av1_fwd_txfm2d_neon.c.
  - Fixed AddressSanitizer heap-buffer-overflow error in
    av1_wiener_convolve_add_src_neon().
  - chromium:1393384 Avoid scene detection on spatial resize.
  - aomedia:3308 Remove color artifacts under high motion.
  - aomedia:3310 Avoid out of memory failures with Visual Studio
    2017, 2019, and 2022 for Win32 x86 builds.
  - aomedia:3346 Make SVC work properly for screen content.
  - aomedia:3348 Fix a bug where an uninitialized search_site is
    used.
  - aomedia:3365 Work around what seems like a Visual Studio 2022
    compiler optimization bug.
  - aomedia:3369 Incorrect PSNR values reported by libaom for
    12-bit encode.
- Modernize spec, use cmake_build and ldconfig_scriptlets macros.</changelog>
  <changelog author="fcrozat@suse.com" date="1681992000">- Fix license tag to BSD-2-Clause and AOMPL-1.0.</changelog>
  <changelog author="fcrozat@suse.com" date="1683028800">- Revert to BSD-2-Clause licence tag to only use SPDX valid
  license tag.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1683720000">- Update to version 3.6.1:
  * aomedia:2871: Guard the support of the 7.x and 8.x levels for
    AV1 under the CONFIG_CWG_C013 config flag, and only output the
    7.x and 8.x levels when explicitly requested.
  * aomedia:3382: Choose sb_size by ppi instead of svc.
  * aomedia:3384: Fix fullpel search limits.
  * aomedia:3388: Replace left shift of xq_active by
    multiplication.
  * aomedia:3389: Fix MV clamping in av1_mv_pred.
  * aomedia:3390: set_ld_layer_depth: cap max_layer_depth to
    MAX_ARF_LAYERS.
  * aomedia:3418: Fix MV clamping in av1_int_pro_motion_estimation.
  * aomedia:3429: Move lpf thread data init to
    lpf_pipeline_mt_init().
  * b:266719111: Fix undefined behavior in Arm Neon code.
  * b:269840681: nonrd_opt: align scan tables.
  * rtc: Fix is_key_frame setting in variance partition.
  * Build: Fix build with clang-cl and Visual Studio.</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1693569600">- New upstream release 3.7.0
  - New Features
  * New codec controls:
  * AV1E_SET_QUANTIZER_ONE_PASS: Set quantizer for each frame.
  * AV1E_ENABLE_RATE_GUIDE_DELTAQ: enable the rate distribution guided delta
    quantization in all intra mode. The "enable-rate-guide-deltaq" option is
    added for this control.
  * AV1E_SET_RATE_DISTRIBUTION_INFO: set the input file for rate
    distribution used in all intra mode. The "rate-distribution-info" option
    is added for this control.
  * AV1E_GET_LUMA_CDEF_STRENGTH
  * AV1E_SET_BITRATE_ONE_PASS_CBR
  * AOM_SCALING_MODE is extended to include 2/3 and 1/3 scaling.
  * aom_tune_metric is extended to include AOM_TUNE_VMAF_SALIENCY_MAP.
    The "tune" option is extended to include "vmaf_saliency_map".
  * SVC example encoder svc_encoder_rtc is able to use the rate control
    library.
  * Loopfilter level and CDEF filter level is supported by RTC rate control
    library.
  * New speed (--cpu-used) 11, intended for RTC screen sharing, added for
    faster encoding with ~3% bdrate loss with 16% IC (instruction count)
    speedup compared to speed 10.
  - Compression Efficiency Improvements
  * Improved VoD encoding performance
  * 0.1-0.6% BDrate gains for encoding speeds 2 to 6
  * Rate control accuracy improvement in VBR mode
  * RTC encoding improvements
  * Screen content mode: 10-19% BDrate gains for speeds 6 - 10
  * Temporal layers video mode, for speed 10:
  * 2 temporal layers on low resolutions: 13-15% BDrate gain
  * 3 temporal layers on VGA/HD: 3-4% BDrate gain
  - Perceptual Quality Improvements
  * Fixed multiple block and color artifacts for RTC screen content by
  * Incorporating color into RD cost for IDTX
  * Reducing thresholds for palette mode in non RD mode
  * Allowing more palette mode testing
  * Improved color sensitivity for altref in non-RD mode.
  * Reduced video flickering for temporal layer encoding.
  - Speedup and Memory Optimizations
  * Speed up the VoD encoder
  * 2-5% for encoding speed 2 to 4
  * 9-15% for encoding speed 5 to 6
  * ARM
  * Standard bitdepth
  * speed 5: +31%
  * speed 4: +2%
  * speed 3: +9%
  * speed 2: +157%
  * High bitdepth
  * speed 5: +85%
  * RTC speedups
  * Screen content mode
  * 15% IC speedup for speeds 6-8
  * ARM: 7% for speed 9, 3% for speed 10
  * Temporal layers video mode
  * 7% speedup for 3 temporal layers on VGA/HD, for speed 10
  * Single layer video
  * x86: 2% IC speedup for speeds 7-10
  * ARM: 2-4% speedup across speeds 5-10
  - Bug Fixes
  * aomedia:3261 Assertion failed when encoding av1 with film grain and
    '--monochrome' flag
  * aomedia:3276 ensure all allocations are checked (partial fix)
  * aomedia:3451 The libaom library calls exit()
  * aomedia:3450 enable -Wshadow for C++ sources
  * aomedia:3449 Test Seg Faults After
    b459af3e345be402db052a143fcc5383d4b74cbd
  * aomedia:3416 prune unused symbols / restrict symbol visibility
  * aomedia:3443 Jenkins failure:
    UninstantiatedParameterizedTestSuite&lt;EstimateNoiseTest&gt;
  * aomedia:3434 realtime failures with CONFIG_BITSTREAM_DEBUG=1
  * aomedia:3433 DeltaqModeTest crash w/row_mt=0
  * aomedia:3429 Encoder crash when turn on both ExternalResize and
    g_threads &gt; 2
  * aomedia:3438 Build failure with
    `-DSANITIZE=address -DBUILD_SHARED_LIBS=ON` when using clang.
  * aomedia:3435 Block artifacts when scrolling with AV1 in screen sharing
    scenarios
  * aomedia:3170 vmaf tune presets produce extreme glitches in one scene
  * aomedia:3401 Building shared libaom with MSVC results in a race condition
    with the export library
  * aomedia:3420 Floating point exception in av1_tpl_get_frame_importance()
  * aomedia:3424 heap-buffer-overflow in ScaleFilterCols_16_C() (SIGABRT)
  * aomedia:3417 examples/svc_encoder_rtc.c is using internal macros and
    functions
  * aomedia:3372 SEGV in assign_frame_buffer_p av1_common_int.h
  * aomedia:3130 'cpu-features.h' file not found on Android NDK 22
  * aomedia:3415 Encoder/decoder mismatch for svc_encoder_rtc running
    1 SL 3 TL
  * aomedia:3412 Lossless Mode Fails Loopback Bit Test
  * aomedia:3409 The use of AV1_VAR_OFFS in av1/encoder/var_based_part.c is
    incorrect for high bit depths
  * aomedia:3403 test_libaom fails with error message
    "feenableexcept() failed" on Linux arm
  * aomedia:3370 Random color block at fast motion area
  * aomedia:3393 Assertion failure in av1_convolve_2d_sr_c()
  * aomedia:3392 Strong artifacting for high bit-depth real-time
  * aomedia:3376 aomenc --threads=10 --deltaq-mode=3 crashes after
    "Allintra: multi-threading of calculating differential contrast"
  * aomedia:3380 Crashes and ASan and TSan errors in deltaq-mode=3
    multithreading code
  * chromium:1410766 heap-buffer-overflow in aom_yv12_copy_v_c
  * Cannot set level via AV1E_SET_TARGET_SEQ_LEVEL_IDX
  * Encoding failure due to the use of loop restoration with unintended use of
    lossless mode.
  * Signed integer overflow in scan_past_frames
  * Signed integer overflow in update_a_sep_sym
  * Flickering in AV1 1440p/2160p HDR transcodes
  * Fixed artifacts with screen share at encoder speed 10
  * Fixed prediction setup for IDTX
- Use system libraries instead of vendored ones
  * system-gtest.patch
  * system-yuv.patch
- Enable debuginfo also on modules written in assembly
- Enable building PowerPC-specific optimizations
- Enable Neon optimized code on ARM and fix runtime CPU detection
- Fix missing images in documentation</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1693915200">- Split docs to multibuild to avoid dependency cycle</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701777600">- Update to version 3.7.1:
  * Bug Fixes:
  - aomedia:3349: heap overflow when increasing resolution
  - aomedia:3478: GCC 12.2.0 emits a -Wstringop-overflow warning
    on aom/av1/encoder/motion_search_facade.c
  - aomedia:3489: Detect encoder and image high bit depth
    mismatch
  - aomedia:3491: heap-buffer-overflow on frame size change
  - b/303023614:  Segfault at encoding time for high bit depth
    images
- Switch buildtime compression to zst.</changelog>
  <changelog author="pgajdos@suse.com" date="1718020800">- security update
- added patches
  fix CVE-2024-5171 [bsc#1226020], heap buffer overflow in img_alloc_helper() caused by integer overflow
  + libaom-CVE-2024-5171.patch</changelog>
</package>
<package pkgid="3df6b07cf2a833fdcdac2fe0c4bf3953e2c9bdc2b2933a9300882758d6bec87b" name="aom-tools" arch="x86_64">
  <version epoch="0" ver="3.7.1" rel="150600.3.3.1"/>
  <changelog author="elimat@opensuse.org" date="1614600000">- Update to version 2.0.2:
  * Prepare for the libaom v2.0.2 release
  * Call av1_setup_frame_size() when dropping a frame
  * Avoid memset in filter_intra_predictor module
  * Fix a typo bug in apply_temporal_filter_planewise
  * Modify the assertion in temporal filter intrinsics
  * Fix unit test ThreadTestLarge.EncoderResultTest/49
  * Add -Wimplicit-function-declaration as C flag only
  * Update CHANGELOG for libaom v2.0.1
  * Set allow_screen_content_tools to 0 in rt mode
  * chroma_check: don't access UV planes if monochrome</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620648000">- Update to version 3.1.0 (bsc#1185843):
  https://aomedia.googlesource.com/aom/+/refs/tags/v3.1.0
  This release adds an "all intra" mode to the encoder, which significantly
  speeds up the encoding of AVIF still images at speed 6.
  - Upgrading:
    All intra mode for encoding AVIF still images and AV1 all intra videos:
    AOM_USAGE_ALL_INTRA (2) can be passed as the 'usage' argument to
    aom_codec_enc_config_default().
    New encoder control IDs added:
  - AV1E_SET_ENABLE_DIAGONAL_INTRA: Enable diagonal (D45 to D203) intra
    prediction modes (0: false, 1: true (default)). Also available as
    "enable-diagonal-intra" for the aom_codec_set_option() function.
    New aom_tune_metric enum value: AOM_TUNE_BUTTERAUGLI. The new aomenc option
  - -tune=butteraugli was added to optimize the encoder’s perceptual quality by
    optimizing the Butteraugli metric. Install libjxl (JPEG XL) and then pass
  - DCONFIG_TUNE_BUTTERAUGLI=1 to the cmake command to enable it.
- Includes 3.0
  https://aomedia.googlesource.com/aom/+/refs/tags/v3.0.0
  This release includes compression efficiency improvement, speed improvement
  for realtime mode, as well as some new APIs.
  - Upgrading:
    Support for PSNR calculation based on stream bit-depth.
    New encoder control IDs added:
  - AV1E_SET_ENABLE_RECT_TX
  - AV1E_SET_VBR_CORPUS_COMPLEXITY_LAP
  - AV1E_GET_BASELINE_GF_INTERVAL
  - AV1E_SET_ENABLE_DNL_DENOISING
    New decoder control IDs added:
  - AOMD_GET_FWD_KF_PRESENT
  - AOMD_GET_FRAME_FLAGS
  - AOMD_GET_ALTREF_PRESENT
  - AOMD_GET_TILE_INFO
  - AOMD_GET_SCREEN_CONTENT_TOOLS_INFO
  - AOMD_GET_STILL_PICTURE
  - AOMD_GET_SB_SIZE
  - AOMD_GET_SHOW_EXISTING_FRAME_FLAG
  - AOMD_GET_S_FRAME_INFO
    New aom_tune_content enum value: AOM_CONTENT_FILM
    New aom_tune_metric enum value: AOM_TUNE_VMAF_NEG_MAX_GAIN
    Coefficient and mode update can be turned off via
    AV1E_SET_{COEFF/MODE}_COST_UPD_FREQ.
    New key &amp; value API added, available with aom_codec_set_option() function.
    Scaling API expanded to include 1/4, 3/4 and 1/8.
  - Enhancements:
    Better multithreading performance with realtime mode.
    New speed 9 setting for faster realtime encoding.
    Smaller binary size with low bitdepth and realtime only build.
    Temporal denoiser and its optimizations on x86 and Neon.
    Optimizations for scaling.
    Faster encoding with speed settings 2 to 6 for good encoding mode.
    Improved documentation throughout the library, with function level
    documentation, tree view and support for the dot tool.
  - Bug fixes:
    Aside from those mentioned in v2.0.1 and v2.0.2, this release includes the
    following bug fixes:
    Issue 2940: Segfault when encoding with --use-16bit-internal and --limit &gt; 1
    Issue 2941: Decoder mismatch with --rt --bit-depth=10 and --cpu-used=8
    Issue 2895: mingw-w64 i686 gcc fails to build
    Issue 2874: Separate ssse3 functions from sse2 file.</changelog>
  <changelog author="rpm@fthiessen.de" date="1625227200">- Update to version 3.1.1
  * Fix vmaf model initialization error when not set to tune=vmaf
  * Fix consistent crash on near-static screen content, keyframe
    related
  * Fix tune=butteraugli mode
- Disable NEON on arm where not available.</changelog>
  <changelog author="pgajdos@suse.com" date="1629892800">- Update to version 3.1.2:
  * Update AUTHORS,CHANGELOG,CMakeLists.txt for v3.1.2
  * Avoid chroma resampling for 420mpeg2 input
  * Check array has two elements before using index 1
  * Fix DecodeScalabilityTest failure in realtime only
  * Store temporal_id and spatial_id of decoded frame
  * exports.cmake: use APPLE and WIN32 and use def for mingw-w64</changelog>
  <changelog author="pgajdos@suse.com" date="1629892801">- security update
- added patches
  fix CVE-2021-30475 [bsc#1189497], Buffer overflow in aom_dsp/noise_model.c
  + libaom-CVE-2021-30475.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1631188800">- security update
- added patches
  fix CVE-2021-30474 [bsc#1186799], aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free.
  + libaom-CVE-2021-30474.patch</changelog>
  <changelog author="gmbr3@opensuse.org" date="1633694400">- Update to version 3.1.3:
  * Update CHANGELOG for v3.1.3-rc2
  * Detect chroma subsampling more directly
  * Detect chroma subsampling more directly
  * image2yuvconfig() should calculate uv_crop_width
  * aom/aom_encoder.h: remove configure option reference
  * aom_encoder.h: fix rc_overshoot_pct range
  * Update AUTHORS,CHANGELOG,CMakeLists.txt for v3.1.3
  * aom_install: don't exclude msvc from install
  * aom_install: use relpath for install
  * aom_install: Install lib dlls to bindir</changelog>
  <changelog author="gmbr3@opensuse.org" date="1634126400">- fix service data</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1634299200">- Update to version 3.2.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, as well
    as some new features.
  * New Features:
    + Introduced speeds 7, 8, and 9 for all intra mode.
    + Introduced speed 10 for real time mode.
    + Introduced an API that allows external partition decisions.
    + SVC: added support for compound prediction.
    + SVC: added support for fixed SVC modes.
  * Compression Efficiency Improvements:
    + Intra-mode search improvement.
    + Improved real time (RT) mode BDrate savings by ~5% (RT speed
    5) and ~12% (RT speed 6). The improvement was measured on the
    video conference set.
    + Improved real time mode for nonrd path (speed 7, 8, 9):
    BDrate gains of ~3-5%.
    + Rate control and RD adjustments based on ML research in VP9.
    Gains of ~0.5-1.0% for HD.
  * Perceptual Quality Improvements:
    + Added a new mode --deltaq-mode=3 to improve perceptual
    quality based on a differential contrast model for still
    images.
    + Added a new mode –deltaq-mode=4 to improve perceptual quality
    based on user rated cq_level data set for still images.
    + Weighting of some intra mode and partition size choices to
    better manage and retain texture.
  * Speedup and Memory Optimizations:
    + Further improved 2-pass good quality encoder speed:
    . Speed 2 speedup: 18%
    . Speed 3 speedup: 22%
    . Speed 4 speedup: 37%
    . Speed 5 speedup: 30%
    . Speed 6 speedup: 20%
    + Optimized the real time encoder (measured on the video
    conference set):
    . RT speed 5 speedup: 110%
    . RT speed 6 speedup: 77%
  * Bug Fixes
    + Issue 3069: Fix one-pass mode keyframe placement off-by-one
    error.
    + Issue 3156: Fix a bug in av1_quantize_lp AVX2 optimization.
- Drop libaom-CVE-2021-30474.patch: Fixed upstream.
- Drop libaom-CVE-2021-30475.patch: Fixed upstream.
- Remove changesgenerate option from _service file, use data from
  CHANGELOG to fill .changes instead as it it much nicer and human
  readable than just a list of commit messages.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1645185600">- Update to version 3.3.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, some
    new features, and several bug fixes.
  * New Features
  - AV1 RT: Introducing CDEF search level 5
  - Changed real time speed 4 to behave the same as real time
    speed 5
  - Add --deltaq-strength
  - rtc: Allow scene-change and overshoot detection for svc
  - rtc: Intra-only frame for svc
  - AV1 RT: Option 2 for codec control AV1E_SET_ENABLE_CDEF to
    disable CDEF on non-ref frames
  - New codec controls AV1E_SET_LOOPFILTER_CONTROL and
    AOME_GET_LOOPFILTER_LEVEL
  - Improvements to three pass encoding
  * Compression Efficiency Improvements: Overall compression gains:
    0.6%
  * Perceptual Quality Improvements
  - Improves the perceptual quality of high QP encoding for
    delta-q mode 4
  - Auto select noise synthesis level for all intra
  * Speedup and Memory Optimizations
  - Added many SSE2 optimizations.
  - Good quality 2-pass encoder speedups:
    o Speed 2: 9%
    o Speed 3: 12.5%
    o Speed 4: 8%
    o Speed 5: 3%
    o Speed 6: 4%
  - Real time mode encoder speedups:
    o Speed 5: 2.6% BDRate gain, 4% speedup
    o Speed 6: 3.5% BDRate gain, 4% speedup
    o Speed 9: 1% BDRate gain, 3% speedup
    o Speed 10: 3% BDRate gain, neutral speedup
  - All intra encoding speedups (AVIF):
    o Single thread - speed 6: 8%
    o Single thread - speed 9: 15%
    o Multi thread(8) - speed 6: 14%
    o Multi thread(8) - speed 9: 34%
  * Bug Fixes
  - Issue 3163: Segmentation fault when using
  - -enable-keyframe-filtering=2
  - Issue 2436: Integer overflow in av1_warp_affine_c()
  - Issue 3226: armv7 build failure due to gcc-11
  - Issue 3195: Bug report on libaom (AddressSanitizer:
    heap-buffer-overflow)
  - Issue 3191: Bug report on libaom (AddressSanitizer: SEGV on
    unknown address)
- Drop libaom-devel Requires from libaom-devel-doc sub-package: We
  do not need the devel package to be able to read the devel
  documentation.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1662292800">- Update to version 3.4.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, and
    some new features. There are no ABI or API breaking changes in
    this release.
  * New Features:
  - New --dist-metric flag with "qm-psnr" value to use
    quantization matrices in the distortion computation for RD
    search. The default value is "psnr".
  - New command line option "--auto-intra-tools-off=1" to make
    all-intra encoding faster for high bit rate under
    "--deltaq-mode=3" mode.
  - New rate control library aom_av1_rc for real-time hardware
    encoders. Supports CBR for both one spatial layer and SVC.
  - New image format AOM_IMG_FMT_NV12 can be used as input to the
    encoder. The presence of AOM_IMG_FMT_NV12 can be detected at
    compile time by checking if the macro AOM_HAVE_IMG_FMT_NV12
    is defined.
  - New codec controls for the encoder:
    o AV1E_SET_AUTO_INTRA_TOOLS_OFF. Only in effect if
  - -deltaq-mode=3.
    o AV1E_SET_RTC_EXTERNAL_RC
    o AV1E_SET_FP_MT. Only supported if libaom is built with
  - DCONFIG_FRAME_PARALLEL_ENCODE=1.
    o AV1E_GET_TARGET_SEQ_LEVEL_IDX
  - New key-value pairs for the key-value API:
    o --auto-intra-tools-off=0 (default) or 1. Only in effect if
  - -deltaq-mode=3.
    o --strict-level-conformance=0 (default) or 1
    o --fp-mt=0 (default) or 1. Only supported if libaom is built
    with -DCONFIG_FRAME_PARALLEL_ENCODE=1.
  - New aomenc options (not supported by the key-value API):
    o --nv12
  * Compression Efficiency Improvements:
  - Correctly calculate SSE for high bitdepth in skip mode, 0.2%
    to 0.6% coding gain.
  - RTC at speed 9/10: BD-rate gain of ~4/5%
  - RTC screen content coding: many improvements for real-time
    screen at speed 10 (quality, speedup, and rate control), up
    to high resolutions (1080p).
  - RTC-SVC: fixes to make intra-only frames work for spatial
    layers.
  - RTC-SVC: quality improvements for temporal layers.
  - AV1 RT: A new passive rate control strategy for screen
    content, an average of 7.5% coding gain, with some clips of
    20+%. The feature is turned off by default due to higher bit
    rate variation.
  * Perceptual Quality Improvements:
  - RTC: Visual quality improvements for high speeds (9/10)
  - Improvements in coding quality for all intra mode
  * Speedup and Memory Optimizations:
  - ~10% speedup in good quality mode encoding.
  - ~7% heap memory reduction in good quality encoding mode for
    speed 5 and 6.
  - Ongoing improvements to intra-frame encoding performance on
    Arm
  - Faster encoding speed for "--deltaq-mode=3" mode.
  - ~10% speedup for speed 5/6, ~15% speedup for speed 7/8, and
    ~10% speedup for speed 9/10 in real time encoding mode
  - ~20% heap memory reduction in still-picture encoding mode for
    360p-720p resolutions with multiple threads
  - ~13% speedup for speed 6 and ~12% speedup for speed 9 in
    still-picture encoding mode.
  - Optimizations to improve multi-thread efficiency for
    still-picture encoding mode.
  * Bug Fixes:
  - b/204460717: README.md: replace master with main
  - b/210677928: libaom disable_order is surprising for
    max_reference_frames=3
  - b/222461449: -DCONFIG_TUNE_BUTTERAUGLI=1 broken
  - b/227207606: write_greyscale writes incorrect chroma in
    highbd mode
  - b/229955363: Integer-overflow in linsolve_wiener
  - https://crbug.com/aomedia/2032
  - https://crbug.com/aomedia/2397
  - https://crbug.com/aomedia/2563
  - https://crbug.com/aomedia/2815
  - https://crbug.com/aomedia/3009
  - https://crbug.com/aomedia/3018
  - https://crbug.com/aomedia/3045
  - https://crbug.com/aomedia/3101
  - https://crbug.com/aomedia/3130
  - https://crbug.com/aomedia/3173
  - https://crbug.com/aomedia/3184
  - https://crbug.com/aomedia/3187
  - https://crbug.com/aomedia/3190
  - https://crbug.com/aomedia/3195
  - https://crbug.com/aomedia/3197
  - https://crbug.com/aomedia/3201
  - https://crbug.com/aomedia/3202
  - https://crbug.com/aomedia/3204
  - https://crbug.com/aomedia/3205
  - https://crbug.com/aomedia/3207
  - https://crbug.com/aomedia/3208
  - https://crbug.com/aomedia/3209
  - https://crbug.com/aomedia/3213
  - https://crbug.com/aomedia/3214
  - https://crbug.com/aomedia/3219
  - https://crbug.com/aomedia/3222
  - https://crbug.com/aomedia/3223
  - https://crbug.com/aomedia/3225
  - https://crbug.com/aomedia/3226
  - https://crbug.com/aomedia/3228
  - https://crbug.com/aomedia/3232
  - https://crbug.com/aomedia/3236
  - https://crbug.com/aomedia/3237
  - https://crbug.com/aomedia/3238
  - https://crbug.com/aomedia/3240
  - https://crbug.com/aomedia/3243
  - https://crbug.com/aomedia/3244
  - https://crbug.com/aomedia/3246
  - https://crbug.com/aomedia/3248
  - https://crbug.com/aomedia/3250
  - https://crbug.com/aomedia/3251
  - https://crbug.com/aomedia/3252
  - https://crbug.com/aomedia/3255
  - https://crbug.com/aomedia/3257
  - https://crbug.com/aomedia/3259
  - https://crbug.com/aomedia/3260
  - https://crbug.com/aomedia/3267
  - https://crbug.com/aomedia/3268
  - https://crbug.com/aomedia/3269
  - https://crbug.com/aomedia/3276
  - https://crbug.com/aomedia/3278
  - https://crbug.com/chromium/1290068
  - https://crbug.com/chromium/1303237
  - https://crbug.com/chromium/1304990
  - https://crbug.com/chromium/1321141
  - https://crbug.com/chromium/1321388
  - https://crbug.com/oss-fuzz/44846
  - https://crbug.com/oss-fuzz/44856
  - https://crbug.com/oss-fuzz/44862
  - https://crbug.com/oss-fuzz/44904
  - https://crbug.com/oss-fuzz/45056</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1663848000">- Update to version 3.5.0:
  * This release is ABI compatible with the last one, including
    speedup and memory optimizations, and new APIs and features.
  * New Features
  - Support for frame parallel encode for larger number of
    threads. --fp-mt flag is available for all build
    configurations.
  - New codec control AV1E_GET_NUM_OPERATING_POINTS
  * Speedup and Memory Optimizations
  - Speed-up multithreaded encoding for good quality mode for
    larger number of threads through frame parallel encoding:
    . 30-34% encode time reduction for 1080p, 16 threads, 1x1
    tile configuration (tile_rows x tile_columns)
    . 18-28% encode time reduction for 1080p, 16 threads, 2x4
    tile configuration
    . 18-20% encode time reduction for 2160p, 32 threads, 2x4
    tile configuration
  - 16-20% speed-up for speed=6 to 8 in still-picture encoding
    mode
  - 5-6% heap memory reduction for speed=6 to 10 in real-time
    encoding mode
  - Improvements to the speed for speed=7, 8 in real-time
    encoding mode
  - Improvements to the speed for speed=9, 10 in real-time screen
    encoding mode
  - Optimizations to improve multi-thread efficiency in real-time
    encoding mode
  - 10-15% speed up for SVC with temporal layers
  - SIMD optimizations:
    . Improve av1_quantize_fp_32x32_neon() 1.05x to 1.24x faster
    . Add aom_highbd_quantize_b{,_32x32,_64x64}_adaptive_neon()
    3.15x to 5.6x faster than "C"
    . Improve av1_quantize_fp_64x64_neon() 1.17x to 1.66x faster
    . Add aom_quantize_b_avx2() 1.4x to 1.7x faster than
    aom_quantize_b_avx()
    . Add aom_quantize_b_32x32_avx2() 1.4x to 2.3x faster than
    aom_quantize_b_32x32_avx()
    . Add aom_quantize_b_64x64_avx2() 2.0x to 2.4x faster than
    aom_quantize_b_64x64_ssse3()
    . Add aom_highbd_quantize_b_32x32_avx2() 9.0x to 10.5x faster
    than aom_highbd_quantize_b_32x32_c()
    . Add aom_highbd_quantize_b_64x64_avx2() 7.3x to 9.7x faster
    than aom_highbd_quantize_b_64x64_c()
    . Improve aom_highbd_quantize_b_avx2() 1.07x to 1.20x faster
    . Improve av1_quantize_fp_avx2() 1.13x to 1.49x faster
    . Improve av1_quantize_fp_32x32_avx2() 1.07x to 1.54x faster
    . Improve av1_quantize_fp_64x64_avx2()  1.03x to 1.25x faster
    . Improve av1_quantize_lp_avx2() 1.07x to 1.16x faster
  * Bug fixes including but not limited to
  - aomedia:3206 Assert that skip_width &gt; 0 for deconvolve
    function
  - aomedia:3278 row_mt enc: Delay top-right sync when intraBC is
    enabled
  - aomedia:3282 blend_a64_*_neon: fix bus error in armv7
  - aomedia:3283 FRAME_PARALLEL: Propagate border size to all
    cpis
  - aomedia:3283 RESIZE_MODE: Fix incorrect strides being used
    for motion search
  - aomedia:3286 rtc-svc: Fix to dynamic_enable spatial layers
  - aomedia:3289 rtc-screen: Fix to skipping inter-mode test in
    nonrd
  - aomedia:3289 rtc-screen: Fix for skip newmv on flat blocks
  - aomedia:3299 Fix build failure with CONFIG_TUNE_VMAF=1
  - aomedia:3296 Fix the conflict --enable-tx-size-search=0 with
    nonrd mode --enable-tx-size-search will be ignored in non-rd
    pick mode
  - aomedia:3304 Fix off-by-one error of max w/h in
    validate_config
  - aomedia:3306 Do not use pthread_setname_np on GNU/Hurd
  - aomedia:3325 row-multithreading produces invalid bitstream in
    some cases
  - chromium:1346938, chromium:1338114
  - compiler_flags.cmake: fix flag detection w/cmake 3.17-3.18.2
  - tools/*.py: update to python3
  - aom_configure.cmake: detect PIE and set CONFIG_PIC
  - test/simd_cmp_impl: use explicit types w/CompareSimd*
  - rtc: Fix to disable segm for aq-mode=3
  - rtc: Fix to color_sensitivity in variance partition
  - rtc-screen: Fix bsize in model rd computation for intra
    chroma
  - Fixes to ensure the correct behavior of the encoder
    algorithms (like segmentation, computation of statistics,
    etc.)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1675857600">- Update to version 3.6.0:
  * This release includes compression efficiency and perceptual
    quality improvements, speedup and memory optimizations, and
    some new features. This release is ABI compatible with the last
    release.
  * New Features:
  - New values 20-27 (corresponding to levels 7.0-7.3 and
    8.0-8.3) for the encoder control
    AV1E_SET_TARGET_SEQ_LEVEL_IDX (note that the proposal to add
    the new levels are still in draft status). The original
    special value 24 (keep level stats only for level monitoring)
    is renumbered as 32.
  - New encoder control AV1E_SET_SKIP_POSTPROC_FILTERING to skip
    the application of post-processing filters on reconstructed
    frame in all intra mode.
  - New encoder option "kf-max-pyr-height": Maximum height of
    pyramid structure used for the GOP starting with a key frame
    (-1 to 5).
  - Make SVC work for screen content.
  - Rate control improvements to reduce frame-size spikes for
    screen content coding.
  - RISC-V architecture support with gcc toolchain.
  * Compression Efficiency Improvements:
  - Peak compression efficiency in VOD setting is improved by 1%.
  - 0.7% - 2.2% RTC encoding BDrate gains for real time speed 8
    to 10.
  - 15% RTC encoding BDrate gains for screen content speed 10.
  * Perceptual Quality Improvements:
  - Resolved a visual quality issue that was reported for high
    resolution clips (2K) for speed 4 and above in VOD use case.
  - Visual quality improvements to screen content coding.
  - Quality improvements to temporal layer RTC coding.
  * Speedup and Memory Optimizations:
  - RTC single-thread encoder speedup:
    . ~6% instruction count reduction for speed 5 and 6.
    . ~15% instruction count reduction for speed 7.
    . ~10% instruction count reduction for speed 8 to 10 (&gt;=360p
    resolutions).
  - RTC multi-thread encoder speedup (beyond single-thread
    speedup):
    . 5-8% encode time reduction for speed 7 to 10.
  - RTC screen-content encoder speedup:
    . 11% instruction count reduction for speed 9 and 10 (&gt;=720p
    resolutions).
  - ~5% reduction in heap memory requirements for RTC, speed 6 to
    10.
  * AVIF:
    . 4-5% speedup for speed 9 in still-picture encoding mode.
    . 3-4% heap memory reduction in still-picture encoding mode
    for 360p-720p resolutions with multiple threads.
  * Bug Fixes:
  - Added a workaround for an AV1 specification bug which makes
    TRANSLATION type global motion models unusable.
  - Fixed AddressSanitizer global-buffer-overflow errors in
    av1/encoder/arm/neon/av1_fwd_txfm2d_neon.c.
  - Fixed AddressSanitizer heap-buffer-overflow error in
    av1_wiener_convolve_add_src_neon().
  - chromium:1393384 Avoid scene detection on spatial resize.
  - aomedia:3308 Remove color artifacts under high motion.
  - aomedia:3310 Avoid out of memory failures with Visual Studio
    2017, 2019, and 2022 for Win32 x86 builds.
  - aomedia:3346 Make SVC work properly for screen content.
  - aomedia:3348 Fix a bug where an uninitialized search_site is
    used.
  - aomedia:3365 Work around what seems like a Visual Studio 2022
    compiler optimization bug.
  - aomedia:3369 Incorrect PSNR values reported by libaom for
    12-bit encode.
- Modernize spec, use cmake_build and ldconfig_scriptlets macros.</changelog>
  <changelog author="fcrozat@suse.com" date="1681992000">- Fix license tag to BSD-2-Clause and AOMPL-1.0.</changelog>
  <changelog author="fcrozat@suse.com" date="1683028800">- Revert to BSD-2-Clause licence tag to only use SPDX valid
  license tag.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1683720000">- Update to version 3.6.1:
  * aomedia:2871: Guard the support of the 7.x and 8.x levels for
    AV1 under the CONFIG_CWG_C013 config flag, and only output the
    7.x and 8.x levels when explicitly requested.
  * aomedia:3382: Choose sb_size by ppi instead of svc.
  * aomedia:3384: Fix fullpel search limits.
  * aomedia:3388: Replace left shift of xq_active by
    multiplication.
  * aomedia:3389: Fix MV clamping in av1_mv_pred.
  * aomedia:3390: set_ld_layer_depth: cap max_layer_depth to
    MAX_ARF_LAYERS.
  * aomedia:3418: Fix MV clamping in av1_int_pro_motion_estimation.
  * aomedia:3429: Move lpf thread data init to
    lpf_pipeline_mt_init().
  * b:266719111: Fix undefined behavior in Arm Neon code.
  * b:269840681: nonrd_opt: align scan tables.
  * rtc: Fix is_key_frame setting in variance partition.
  * Build: Fix build with clang-cl and Visual Studio.</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1693569600">- New upstream release 3.7.0
  - New Features
  * New codec controls:
  * AV1E_SET_QUANTIZER_ONE_PASS: Set quantizer for each frame.
  * AV1E_ENABLE_RATE_GUIDE_DELTAQ: enable the rate distribution guided delta
    quantization in all intra mode. The "enable-rate-guide-deltaq" option is
    added for this control.
  * AV1E_SET_RATE_DISTRIBUTION_INFO: set the input file for rate
    distribution used in all intra mode. The "rate-distribution-info" option
    is added for this control.
  * AV1E_GET_LUMA_CDEF_STRENGTH
  * AV1E_SET_BITRATE_ONE_PASS_CBR
  * AOM_SCALING_MODE is extended to include 2/3 and 1/3 scaling.
  * aom_tune_metric is extended to include AOM_TUNE_VMAF_SALIENCY_MAP.
    The "tune" option is extended to include "vmaf_saliency_map".
  * SVC example encoder svc_encoder_rtc is able to use the rate control
    library.
  * Loopfilter level and CDEF filter level is supported by RTC rate control
    library.
  * New speed (--cpu-used) 11, intended for RTC screen sharing, added for
    faster encoding with ~3% bdrate loss with 16% IC (instruction count)
    speedup compared to speed 10.
  - Compression Efficiency Improvements
  * Improved VoD encoding performance
  * 0.1-0.6% BDrate gains for encoding speeds 2 to 6
  * Rate control accuracy improvement in VBR mode
  * RTC encoding improvements
  * Screen content mode: 10-19% BDrate gains for speeds 6 - 10
  * Temporal layers video mode, for speed 10:
  * 2 temporal layers on low resolutions: 13-15% BDrate gain
  * 3 temporal layers on VGA/HD: 3-4% BDrate gain
  - Perceptual Quality Improvements
  * Fixed multiple block and color artifacts for RTC screen content by
  * Incorporating color into RD cost for IDTX
  * Reducing thresholds for palette mode in non RD mode
  * Allowing more palette mode testing
  * Improved color sensitivity for altref in non-RD mode.
  * Reduced video flickering for temporal layer encoding.
  - Speedup and Memory Optimizations
  * Speed up the VoD encoder
  * 2-5% for encoding speed 2 to 4
  * 9-15% for encoding speed 5 to 6
  * ARM
  * Standard bitdepth
  * speed 5: +31%
  * speed 4: +2%
  * speed 3: +9%
  * speed 2: +157%
  * High bitdepth
  * speed 5: +85%
  * RTC speedups
  * Screen content mode
  * 15% IC speedup for speeds 6-8
  * ARM: 7% for speed 9, 3% for speed 10
  * Temporal layers video mode
  * 7% speedup for 3 temporal layers on VGA/HD, for speed 10
  * Single layer video
  * x86: 2% IC speedup for speeds 7-10
  * ARM: 2-4% speedup across speeds 5-10
  - Bug Fixes
  * aomedia:3261 Assertion failed when encoding av1 with film grain and
    '--monochrome' flag
  * aomedia:3276 ensure all allocations are checked (partial fix)
  * aomedia:3451 The libaom library calls exit()
  * aomedia:3450 enable -Wshadow for C++ sources
  * aomedia:3449 Test Seg Faults After
    b459af3e345be402db052a143fcc5383d4b74cbd
  * aomedia:3416 prune unused symbols / restrict symbol visibility
  * aomedia:3443 Jenkins failure:
    UninstantiatedParameterizedTestSuite&lt;EstimateNoiseTest&gt;
  * aomedia:3434 realtime failures with CONFIG_BITSTREAM_DEBUG=1
  * aomedia:3433 DeltaqModeTest crash w/row_mt=0
  * aomedia:3429 Encoder crash when turn on both ExternalResize and
    g_threads &gt; 2
  * aomedia:3438 Build failure with
    `-DSANITIZE=address -DBUILD_SHARED_LIBS=ON` when using clang.
  * aomedia:3435 Block artifacts when scrolling with AV1 in screen sharing
    scenarios
  * aomedia:3170 vmaf tune presets produce extreme glitches in one scene
  * aomedia:3401 Building shared libaom with MSVC results in a race condition
    with the export library
  * aomedia:3420 Floating point exception in av1_tpl_get_frame_importance()
  * aomedia:3424 heap-buffer-overflow in ScaleFilterCols_16_C() (SIGABRT)
  * aomedia:3417 examples/svc_encoder_rtc.c is using internal macros and
    functions
  * aomedia:3372 SEGV in assign_frame_buffer_p av1_common_int.h
  * aomedia:3130 'cpu-features.h' file not found on Android NDK 22
  * aomedia:3415 Encoder/decoder mismatch for svc_encoder_rtc running
    1 SL 3 TL
  * aomedia:3412 Lossless Mode Fails Loopback Bit Test
  * aomedia:3409 The use of AV1_VAR_OFFS in av1/encoder/var_based_part.c is
    incorrect for high bit depths
  * aomedia:3403 test_libaom fails with error message
    "feenableexcept() failed" on Linux arm
  * aomedia:3370 Random color block at fast motion area
  * aomedia:3393 Assertion failure in av1_convolve_2d_sr_c()
  * aomedia:3392 Strong artifacting for high bit-depth real-time
  * aomedia:3376 aomenc --threads=10 --deltaq-mode=3 crashes after
    "Allintra: multi-threading of calculating differential contrast"
  * aomedia:3380 Crashes and ASan and TSan errors in deltaq-mode=3
    multithreading code
  * chromium:1410766 heap-buffer-overflow in aom_yv12_copy_v_c
  * Cannot set level via AV1E_SET_TARGET_SEQ_LEVEL_IDX
  * Encoding failure due to the use of loop restoration with unintended use of
    lossless mode.
  * Signed integer overflow in scan_past_frames
  * Signed integer overflow in update_a_sep_sym
  * Flickering in AV1 1440p/2160p HDR transcodes
  * Fixed artifacts with screen share at encoder speed 10
  * Fixed prediction setup for IDTX
- Use system libraries instead of vendored ones
  * system-gtest.patch
  * system-yuv.patch
- Enable debuginfo also on modules written in assembly
- Enable building PowerPC-specific optimizations
- Enable Neon optimized code on ARM and fix runtime CPU detection
- Fix missing images in documentation</changelog>
  <changelog author="brunopitrus@hotmail.com" date="1693915200">- Split docs to multibuild to avoid dependency cycle</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1701777600">- Update to version 3.7.1:
  * Bug Fixes:
  - aomedia:3349: heap overflow when increasing resolution
  - aomedia:3478: GCC 12.2.0 emits a -Wstringop-overflow warning
    on aom/av1/encoder/motion_search_facade.c
  - aomedia:3489: Detect encoder and image high bit depth
    mismatch
  - aomedia:3491: heap-buffer-overflow on frame size change
  - b/303023614:  Segfault at encoding time for high bit depth
    images
- Switch buildtime compression to zst.</changelog>
  <changelog author="pgajdos@suse.com" date="1718020800">- security update
- added patches
  fix CVE-2024-5171 [bsc#1226020], heap buffer overflow in img_alloc_helper() caused by integer overflow
  + libaom-CVE-2024-5171.patch</changelog>
</package>
<package pkgid="1377b208c1805864516cf236f88fb9d8ba0650dfa63e88818465e935a8815d13" name="apache2" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="e367c4f3e0908b65eacbe2dd34484b340e5c8749adc745421a503db8011a071b" name="apache2" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="6810567cc9e19a888eadc152e0070f47a83b9abae7ebd8c94e44fc23a06e4a1e" name="apache2" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="06c5e81f4d4a6a03b22cf864293f063b8c0ea7e792db86a5a0458dfc7f198906" name="apache2" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="e9df642b4b857f38aee120996fda71c251e49d0b1a5246e52e1bbccbea8d1c78" name="apache2" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="393f2b100c4cd0e5e688cf3ad185701a876e4efb7194de95280360378dc51374" name="apache2" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="27feb29002eda4d9ade288e76ab90e97bc6165a1d53974d741c0fed82b178f9d" name="apache2" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="2b43dfb47ca16c7e2e2100d41035b3469a36be6333f0a2617d2d01d70d362a5b" name="apache2" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="71278026010f998bca2e5311836a518e03e84f66915248c012d62e7e64666a54" name="apache2" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="2f5b35ba68fa8a57a8a5354ce14dba2a09e2551d98dab365654273e39fc7d7f4" name="apache2" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="76b8b9ed7c05e25c47956f83f2e5161c27cb6ef32ce4b6c6d53d976cc4b1d6b1" name="apache2" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="684b589b4d9914c3d503bb169dc2c2d0f7cbfe76c87213dfd4226986ec3f8c27" name="apache2" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="565ad6f240581ca8a635c2b8d6a816d8a184e4223f43808982f5a3d8d68edd42" name="apache2" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="2a6e2fd1dc775831efb1eeee6cb4fb82e42aa3347fce2fd8f4fc25f9e9535539" name="apache2" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="54fc0f838e770caf9cfebd07e12b19b37b4cb8dd3e0c2e5166e4ee7d313628a1" name="apache2" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="b8fb31b86163a064d2587158238baad627e2d233bcf6a930fdb51c6fbcbc63bd" name="apache2" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="abfafc15d76d4943d22f4f67184af6a6a58cbfd843c405b9bd3dd74a2c063af7" name="apache2" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="73a3b8cffccea06e42dabe088c6c847e50c88d44a3e1c40f28b8915f4cc96c3a" name="apache2" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="d99f2a49729c4ba96dd4687aa474c3d970a5e6edde15f9c2fa146fa1d74af99b" name="apache2" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="88b05bf122ed2f78ad583cf461d4143698d518f0edaa823c4f2e5e275492601e" name="apache2" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="4fdf0296c82346f25cc5a6a5b03d28026f271ea9211a3832984be5d3eae12258" name="apache2" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="18084dfbc5fcb95f0de6951a35bbf60de8bc0c7051053a029faff255effbf8a1" name="apache2" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="85f4629c63da695f334913f84fee79ce65b695777a52ee80b9dd5c1ab7649df9" name="apache2" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="5112a9fc80889cb436938b0c2860f0e4468770846d01a9d04abf011ebe5b5981" name="apache2" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="babd7c5a4622a821310a527cf280593ceadcd815a1f49c41c27feee7c943a748" name="apache2" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="2a7b4c5e3e0699033e7dcec4248f061c42416bfe3e6301bfa5cbb6621bec5d6a" name="apache2-devel" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="35adfcb62cff86ce426d9cee850aa5174dfa091d18253a26e805a4071405bcdf" name="apache2-devel" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="42575ac51737aee60a87e98ab35311a8afb11f2c0a10492085c46b003c8a8f50" name="apache2-devel" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="aa22978d231fd5c32a6cf20142f8fde613723527bdc57afb122a9581adc2118b" name="apache2-devel" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="3109c24e47f4c00258133c4a733d54e04d24e87e8e070f0199b921a84a81530c" name="apache2-devel" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="9670fd4c785719068905d1ed7db5c00cba655f0893a24e480512e121c35295d4" name="apache2-devel" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="4ed2076f50e4908a8f8910a1fb8230eeaa82b0bf38c2c50e2d6e5da5aca469a4" name="apache2-devel" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="990f8646bbb3a9fb159addc06caadce0dbbf19642547b85d278176dfdb1248e7" name="apache2-devel" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="d8d50a7fb53484b097a700e93c0e2fbf135ea6080dfdb304eb8346eadb5924f0" name="apache2-devel" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="279e8ae4c01e88627ef199b110049a809e6cccb33ce77c808ff67f2a854382f2" name="apache2-devel" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="76b08e9b03b0df49d22bbd2751d43e9735058f085ad4dfec0626e1a6a9cbd685" name="apache2-devel" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="b3b4c781c316bf78dffe59aa6be3285cdecae5a4d085311b25341c95fd85585b" name="apache2-devel" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="625c32b25c22ca7fc17e58c8fc3037ce97d027dd814f575caba891ceb8a6765e" name="apache2-devel" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="34a301794e3f5b1a68f4874fc8477dce617b3f6ab536b7664fb08aadcdcb66dd" name="apache2-devel" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="26a025d732b45dc3ed911c44fa49e47a6697c144b24452ecb08ceb6820f60d40" name="apache2-devel" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="b782b7532ef9180fdf3e062be12000894452a8a8255932bf4db84f9f9e7be368" name="apache2-devel" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="508faa8566b388ef82fcc838bf82f28371d5b651cae82c235ee29e41b3f7f017" name="apache2-devel" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="a45649fb1f8a227eebf5419a883e6930f51fa0b4a1b149e2020f20df943cca4d" name="apache2-devel" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="3a0e6cfe3c471db0a40960cae81e3dc571dbbdbdcb151e91f67ca1d9278b4a85" name="apache2-devel" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="8420b5db6035ee48efd0ff500f3e7ab1cd31b326f3a6d99de02e6f83343c3566" name="apache2-devel" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="7952ae9b75e6a85d953cb1f311cbecfae26caf0db27a21d0a7cf6373015bec24" name="apache2-devel" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="5520b492e78e21037e4885d4ff727bcfc018fc5e24de6bb9bd1940e44db916d0" name="apache2-devel" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="208a20170c9144452edd53d70141bb3e1bbb7b509525ab41410f09a6142313d6" name="apache2-devel" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="c49017a3f61f0d1305e186d06f969ab39ef54387b0a72dce35f3bd8cc465c38d" name="apache2-devel" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="3ef4dcb48592bade6fd35b2f9e2c6dd455b96fde039fe147fac4cc823b57803a" name="apache2-devel" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="bf3b84081d54000b910ecd404964da6e6497215392cd655a42dc9e1c162aab78" name="apache2-event" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="613b5292e8cf78c2384718170d6c704ecff0c52c0435726cc21dcc75223e18ef" name="apache2-event" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="bb542a59d35e37b8983c2a501a8c4181a0a7a0f841fb69a029031bd4de8736dd" name="apache2-event" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="404a80acbb15289c3d7e4c814833fffb8bd0aa88bf8147eb2eef93ee07f151a3" name="apache2-event" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="44de2eedea687d22381d853a7ec3951b416c89b430d8c07b16283a19731fadfd" name="apache2-event" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="0e788045f6a15f2496a4980f0c80e0a2befe94e9f6681b5913b3b6b46ac2238f" name="apache2-event" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="4c982fb399ef5a3011cc71d7e8998ef4cf9ebd144662e1e5e827ea98b93e8b6d" name="apache2-event" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="256683ccb370606acef4fd2606840de6f7f8d2538185c40910b774e9f6fae196" name="apache2-event" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="e189fa93506a659bc24939cc1ad26e5df5a52e9478de40be89208fe8877e82fd" name="apache2-event" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="bbf32e2e0c2bff37f267f62e1af78311e350d5c53ccc7e10bbf86199efd9828b" name="apache2-event" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="f8f9410a102a3436234db3a2cde68f0e8eef626b98074bf643d3ab678f25e78c" name="apache2-event" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="a9d55930568d446301c0d2fa8f088ed8248ccfa90d08995f43bf1f67ae333b32" name="apache2-event" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="8e5b76c8bbb44979350a8fedec636fa0c5032421420c7d240b7cecf83e8d45e9" name="apache2-event" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="0898675a2cec1b50dfcd7e2e0c9d86f79f874e8330bcfe7158f852cb4ba0998c" name="apache2-event" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="850c0b616256a0232b45d1773e3589f253a4bf4d336f9d51ca4c4a5497c6f09e" name="apache2-event" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="e2361a92430288d3c9eabba32520b88b87b194b19ea3d18e151d32084c4302a7" name="apache2-event" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="b3aa93d997ea1856937266b1a3534a07c97bd2fe7886efb3d487b952c5ac1e4c" name="apache2-event" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="8db4caa550d65636b5451e1afdf6713c6487f7bb60ebec975c001357cbbe816b" name="apache2-event" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="1dd35e8f1af5b06c3b57209d7bc63c727d9f0c248afc7bd0c60072a063800eb7" name="apache2-event" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="c5fb607039e7f0d1c9922e610140d06ecfd80f72a9c9ec6204ab78e332017c1e" name="apache2-event" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="52baf9704f56676478a17777a5a5c2f3d1d8f1a30cea7674e06946415e480872" name="apache2-event" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="a1cf89495e8fa725e5e5040ba2e2ebfa20eb3036888acd7c86d879c63a759c78" name="apache2-event" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="8c5ec9290a03b4f3c83a23afb92bb8dccc6df94b42fcabaa7e1d49fc29671814" name="apache2-event" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="b8adfdb9582357f3f61eeaeccc2daffc8ab6d4c48bcb0e614d3c321f8b9dc3f9" name="apache2-event" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="b231805468c224848b1cb242d70a28e7072c535abeff58769fc505d4b47388f8" name="apache2-event" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="49402c8b59919790b8764bef174411be9e400f22a8fd1edc60e3f57090ed47bb" name="apache2-manual" arch="noarch">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="bcac2c2ffab6789cc35dace888fb5c70ffe86ab7f682fafa19f66599a567f8e4" name="apache2-manual" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="0353727a5d0470944e38f4068e0950413a2b55f6d7ebf0943b3df391cfe91468" name="apache2-manual" arch="noarch">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="64a59c770e6d923ca5239518deebc0d754045b2eed9b3d59828fb107e529599e" name="apache2-manual" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="935f1d6e18eb5d828edc3bf408e88c62bd6817b9838240f47c87729552b4b68f" name="apache2-manual" arch="noarch">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="a2ca544daa5f1dfaca33e736f90cc1cc86cf6539d3fd2255f94fa6f5aa2ea966" name="apache2-manual" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="5360c09fa41d6da08450ad63c18fe99015f71c0b54b49276e62ff9b7a7e69c93" name="apache2-manual" arch="noarch">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="24ea6c0ed18663b2e28ad9c240776b281c290fa6af1155820590ebc22d18d7fb" name="apache2-manual" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="4020b40059993e453d2bdf31a5de60892c7a2f4e9f4dd3763456aeb125715c5e" name="apache2-manual" arch="noarch">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="32213fb4de4ab58a99dd80cde7d480465088d2e20d45d5fdc12f3609ecd3d52c" name="apache2-manual" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="cebc165efd05e370fbf522c411a939251a941f8607879ee8e167954a4be60054" name="apache2-mod_auth_openidc" arch="aarch64">
  <version epoch="0" ver="2.3.8" rel="150600.16.5.1"/>
  <changelog author="christof.hanke@mpcdf.mpg.de" date="1513166400">- initial packaging</changelog>
  <changelog author="vcizek@suse.com" date="1524830400">- update to 2.3.4
- requested in fate#323817</changelog>
  <changelog author="kstreitova@suse.com" date="1540900800">- update to 2.3.8
- changes in 2.3.8
  * fix return result FALSE when JWT payload parsing fails
  * add LGTM code quality badges
  * fix 3 LGTM alerts
  * improve auto-detection of XMLHttpRequests via Accept header
  * initialize test_proto_authorization_request properly
  * add sanity check on provider-&gt;auth_request_method
  * allow usage with LibreSSL
  * don't return content with 503 since it will turn the HTTP
    status code into a 200
  * add option to set an upper limit to the number of concurrent
    state cookies via OIDCStateMaxNumberOfCookies
  * make the default maximum number of parallel state cookies
    7 instead of unlimited
  * fix using access token as endpoint auth method in
    introspection calls
  * fix reading access_token form POST parameters when combined
    with `AuthType auth-openidc`
- changes in 2.3.7
  * abort when string length for remote user name substitution
    is larger than 255 characters
  * fix Redis concurrency issue when used with multiple vhosts
  * add support for authorization server metadata with
    OIDCOAuthServerMetadataURL as in RFC 8414
  * refactor session object creation
  * clear session cookie and contents if cache corruption is detected
  * use apr_pstrdup when setting r-&gt;user
  * reserve 255 characters in remote username substition instead of 50
- changes in 2.3.6
  * add check to detect session cache corruption for server-based
    caches and cached static metadata
  * avoid using pipelining for Redis
  * send Basic header in OAuth www-authenticate response if that's
    the only accepted method; thanks @puiterwijk
  * refactor Redis cache backend to solve issues on AUTH errors:
    a) memory leak and b) redisGetReply lagging behind
  * adjust copyright year/org
  * fix buffer overflow in shm cache key set strcpy
  * turn missing session_state from warning into a debug statement
  * fix missing "return" on error return from the OP
  * explicitly set encryption kid so we're compatible with
    cjose &gt;= 0.6.0
- changes in 2.3.5
  * fix encoding of preserved POST data
  * avoid buffer overflow in shm cache key construction
  * compile with with Libressl</changelog>
  <changelog author="kstreitova@suse.com" date="1541764800">- submission to SLE15SP1 because of fate#324447
- build with hiredis only for openSUSE where hiredis is available
- add a version for jansson BuildRequires</changelog>
  <changelog author="kstreitova@suse.com" date="1572436800">- add apache2-mod_auth_openidc-2.3.8-CVE-2019-14857.patch to fix
  open redirect issue that exists in URLs with trailing slashes
  [bsc#1153666], [CVE-2019-14857]</changelog>
  <changelog author="kstreitova@suse.com" date="1583323200">- add apache2-mod_auth_openidc-2.3.8-CVE-2019-20479.patch to fix
  open redirect issue that exists in URLs with a slash and
  backslash at the beginning [bsc#1164459], [CVE-2019-20479]</changelog>
  <changelog author="pgajdos@suse.com" date="1617278400">- require hiredis only for newer distros than SLE-15 [jsc#SLE-11726]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627041600">- Fix CVE-2021-32785 format string bug via hiredis
  (CVE-2021-32785, bsc#1188638)
  * fix-CVE-2021-32785.patch
- Fix CVE-2021-32786 open redirect in logout functionality
  (CVE-2021-32786, bsc#1188639)
  * fix-CVE-2021-32786.patch
- Refresh apache2-mod_auth_openidc-2.3.8-CVE-2019-20479.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627473600">- Fix CVE-2021-32791 Hardcoded static IV and AAD with a reused key in AES GCM encryption
  (CVE-2021-32791, bsc#1188849)
  * fix-CVE-2021-32791.patch
- Fix CVE-2021-32792 XSS when using OIDCPreservePost On
  (CVE-2021-32792, bsc#1188848)
  * fix-CVE-2021-32792-1.patch
  * fix-CVE-2021-32792-2.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1649851200">- Fix CVE-2021-39191 open redirect issue in target_link_uri parameter
  (CVE-2021-39191, bsc#1190223)
  * fix-CVE-2021-39191.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1671796800">- Fix CVE-2022-23527, Open Redirect in oidc_validate_redirect_url() using tab character
  (CVE-2022-23527, bsc#1206441)
  * fix-CVE-2022-23527-0.patch
  * fix-CVE-2022-23527-1.patch
  * fix-CVE-2022-23527-3.patch
  * fix-CVE-2022-23527-2.patch
- Harden oidc_handle_refresh_token_request function
  * harden-refresh-token-request.patch
- Fixes bsc#1199868, mod_auth_openidc not loading</changelog>
  <changelog author="danilo.spinella@suse.com" date="1680609600">- Fix CVE-2023-28625, NULL pointer dereference when OIDCStripCookies is
  set and a crafted Cookie header is supplied, bsc#1210073
  * fix-CVE-2023-28625.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1719489600">- Fix CVE-2024-24814, DoS when `OIDCSessionType client-cookie` is set
  and a crafted Cookie header is supplied, bsc#1219911
  * fix-CVE-2024-24814.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1720008000">- Fix apxs2 binary location, which made the library file be installed in root folder,
  bsc#1227261</changelog>
</package>
<package pkgid="c343a3bcf2ef53087cdde7b8dabf4f789dd6a630025f9d63661f7f534e1df151" name="apache2-mod_auth_openidc" arch="ppc64le">
  <version epoch="0" ver="2.3.8" rel="150600.16.5.1"/>
  <changelog author="christof.hanke@mpcdf.mpg.de" date="1513166400">- initial packaging</changelog>
  <changelog author="vcizek@suse.com" date="1524830400">- update to 2.3.4
- requested in fate#323817</changelog>
  <changelog author="kstreitova@suse.com" date="1540900800">- update to 2.3.8
- changes in 2.3.8
  * fix return result FALSE when JWT payload parsing fails
  * add LGTM code quality badges
  * fix 3 LGTM alerts
  * improve auto-detection of XMLHttpRequests via Accept header
  * initialize test_proto_authorization_request properly
  * add sanity check on provider-&gt;auth_request_method
  * allow usage with LibreSSL
  * don't return content with 503 since it will turn the HTTP
    status code into a 200
  * add option to set an upper limit to the number of concurrent
    state cookies via OIDCStateMaxNumberOfCookies
  * make the default maximum number of parallel state cookies
    7 instead of unlimited
  * fix using access token as endpoint auth method in
    introspection calls
  * fix reading access_token form POST parameters when combined
    with `AuthType auth-openidc`
- changes in 2.3.7
  * abort when string length for remote user name substitution
    is larger than 255 characters
  * fix Redis concurrency issue when used with multiple vhosts
  * add support for authorization server metadata with
    OIDCOAuthServerMetadataURL as in RFC 8414
  * refactor session object creation
  * clear session cookie and contents if cache corruption is detected
  * use apr_pstrdup when setting r-&gt;user
  * reserve 255 characters in remote username substition instead of 50
- changes in 2.3.6
  * add check to detect session cache corruption for server-based
    caches and cached static metadata
  * avoid using pipelining for Redis
  * send Basic header in OAuth www-authenticate response if that's
    the only accepted method; thanks @puiterwijk
  * refactor Redis cache backend to solve issues on AUTH errors:
    a) memory leak and b) redisGetReply lagging behind
  * adjust copyright year/org
  * fix buffer overflow in shm cache key set strcpy
  * turn missing session_state from warning into a debug statement
  * fix missing "return" on error return from the OP
  * explicitly set encryption kid so we're compatible with
    cjose &gt;= 0.6.0
- changes in 2.3.5
  * fix encoding of preserved POST data
  * avoid buffer overflow in shm cache key construction
  * compile with with Libressl</changelog>
  <changelog author="kstreitova@suse.com" date="1541764800">- submission to SLE15SP1 because of fate#324447
- build with hiredis only for openSUSE where hiredis is available
- add a version for jansson BuildRequires</changelog>
  <changelog author="kstreitova@suse.com" date="1572436800">- add apache2-mod_auth_openidc-2.3.8-CVE-2019-14857.patch to fix
  open redirect issue that exists in URLs with trailing slashes
  [bsc#1153666], [CVE-2019-14857]</changelog>
  <changelog author="kstreitova@suse.com" date="1583323200">- add apache2-mod_auth_openidc-2.3.8-CVE-2019-20479.patch to fix
  open redirect issue that exists in URLs with a slash and
  backslash at the beginning [bsc#1164459], [CVE-2019-20479]</changelog>
  <changelog author="pgajdos@suse.com" date="1617278400">- require hiredis only for newer distros than SLE-15 [jsc#SLE-11726]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627041600">- Fix CVE-2021-32785 format string bug via hiredis
  (CVE-2021-32785, bsc#1188638)
  * fix-CVE-2021-32785.patch
- Fix CVE-2021-32786 open redirect in logout functionality
  (CVE-2021-32786, bsc#1188639)
  * fix-CVE-2021-32786.patch
- Refresh apache2-mod_auth_openidc-2.3.8-CVE-2019-20479.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627473600">- Fix CVE-2021-32791 Hardcoded static IV and AAD with a reused key in AES GCM encryption
  (CVE-2021-32791, bsc#1188849)
  * fix-CVE-2021-32791.patch
- Fix CVE-2021-32792 XSS when using OIDCPreservePost On
  (CVE-2021-32792, bsc#1188848)
  * fix-CVE-2021-32792-1.patch
  * fix-CVE-2021-32792-2.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1649851200">- Fix CVE-2021-39191 open redirect issue in target_link_uri parameter
  (CVE-2021-39191, bsc#1190223)
  * fix-CVE-2021-39191.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1671796800">- Fix CVE-2022-23527, Open Redirect in oidc_validate_redirect_url() using tab character
  (CVE-2022-23527, bsc#1206441)
  * fix-CVE-2022-23527-0.patch
  * fix-CVE-2022-23527-1.patch
  * fix-CVE-2022-23527-3.patch
  * fix-CVE-2022-23527-2.patch
- Harden oidc_handle_refresh_token_request function
  * harden-refresh-token-request.patch
- Fixes bsc#1199868, mod_auth_openidc not loading</changelog>
  <changelog author="danilo.spinella@suse.com" date="1680609600">- Fix CVE-2023-28625, NULL pointer dereference when OIDCStripCookies is
  set and a crafted Cookie header is supplied, bsc#1210073
  * fix-CVE-2023-28625.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1719489600">- Fix CVE-2024-24814, DoS when `OIDCSessionType client-cookie` is set
  and a crafted Cookie header is supplied, bsc#1219911
  * fix-CVE-2024-24814.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1720008000">- Fix apxs2 binary location, which made the library file be installed in root folder,
  bsc#1227261</changelog>
</package>
<package pkgid="81557ac071e3ab97ed8a0e399c507f47ac56ee482acd7cd5871b373f332a9359" name="apache2-mod_auth_openidc" arch="s390x">
  <version epoch="0" ver="2.3.8" rel="150600.16.5.1"/>
  <changelog author="christof.hanke@mpcdf.mpg.de" date="1513166400">- initial packaging</changelog>
  <changelog author="vcizek@suse.com" date="1524830400">- update to 2.3.4
- requested in fate#323817</changelog>
  <changelog author="kstreitova@suse.com" date="1540900800">- update to 2.3.8
- changes in 2.3.8
  * fix return result FALSE when JWT payload parsing fails
  * add LGTM code quality badges
  * fix 3 LGTM alerts
  * improve auto-detection of XMLHttpRequests via Accept header
  * initialize test_proto_authorization_request properly
  * add sanity check on provider-&gt;auth_request_method
  * allow usage with LibreSSL
  * don't return content with 503 since it will turn the HTTP
    status code into a 200
  * add option to set an upper limit to the number of concurrent
    state cookies via OIDCStateMaxNumberOfCookies
  * make the default maximum number of parallel state cookies
    7 instead of unlimited
  * fix using access token as endpoint auth method in
    introspection calls
  * fix reading access_token form POST parameters when combined
    with `AuthType auth-openidc`
- changes in 2.3.7
  * abort when string length for remote user name substitution
    is larger than 255 characters
  * fix Redis concurrency issue when used with multiple vhosts
  * add support for authorization server metadata with
    OIDCOAuthServerMetadataURL as in RFC 8414
  * refactor session object creation
  * clear session cookie and contents if cache corruption is detected
  * use apr_pstrdup when setting r-&gt;user
  * reserve 255 characters in remote username substition instead of 50
- changes in 2.3.6
  * add check to detect session cache corruption for server-based
    caches and cached static metadata
  * avoid using pipelining for Redis
  * send Basic header in OAuth www-authenticate response if that's
    the only accepted method; thanks @puiterwijk
  * refactor Redis cache backend to solve issues on AUTH errors:
    a) memory leak and b) redisGetReply lagging behind
  * adjust copyright year/org
  * fix buffer overflow in shm cache key set strcpy
  * turn missing session_state from warning into a debug statement
  * fix missing "return" on error return from the OP
  * explicitly set encryption kid so we're compatible with
    cjose &gt;= 0.6.0
- changes in 2.3.5
  * fix encoding of preserved POST data
  * avoid buffer overflow in shm cache key construction
  * compile with with Libressl</changelog>
  <changelog author="kstreitova@suse.com" date="1541764800">- submission to SLE15SP1 because of fate#324447
- build with hiredis only for openSUSE where hiredis is available
- add a version for jansson BuildRequires</changelog>
  <changelog author="kstreitova@suse.com" date="1572436800">- add apache2-mod_auth_openidc-2.3.8-CVE-2019-14857.patch to fix
  open redirect issue that exists in URLs with trailing slashes
  [bsc#1153666], [CVE-2019-14857]</changelog>
  <changelog author="kstreitova@suse.com" date="1583323200">- add apache2-mod_auth_openidc-2.3.8-CVE-2019-20479.patch to fix
  open redirect issue that exists in URLs with a slash and
  backslash at the beginning [bsc#1164459], [CVE-2019-20479]</changelog>
  <changelog author="pgajdos@suse.com" date="1617278400">- require hiredis only for newer distros than SLE-15 [jsc#SLE-11726]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627041600">- Fix CVE-2021-32785 format string bug via hiredis
  (CVE-2021-32785, bsc#1188638)
  * fix-CVE-2021-32785.patch
- Fix CVE-2021-32786 open redirect in logout functionality
  (CVE-2021-32786, bsc#1188639)
  * fix-CVE-2021-32786.patch
- Refresh apache2-mod_auth_openidc-2.3.8-CVE-2019-20479.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627473600">- Fix CVE-2021-32791 Hardcoded static IV and AAD with a reused key in AES GCM encryption
  (CVE-2021-32791, bsc#1188849)
  * fix-CVE-2021-32791.patch
- Fix CVE-2021-32792 XSS when using OIDCPreservePost On
  (CVE-2021-32792, bsc#1188848)
  * fix-CVE-2021-32792-1.patch
  * fix-CVE-2021-32792-2.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1649851200">- Fix CVE-2021-39191 open redirect issue in target_link_uri parameter
  (CVE-2021-39191, bsc#1190223)
  * fix-CVE-2021-39191.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1671796800">- Fix CVE-2022-23527, Open Redirect in oidc_validate_redirect_url() using tab character
  (CVE-2022-23527, bsc#1206441)
  * fix-CVE-2022-23527-0.patch
  * fix-CVE-2022-23527-1.patch
  * fix-CVE-2022-23527-3.patch
  * fix-CVE-2022-23527-2.patch
- Harden oidc_handle_refresh_token_request function
  * harden-refresh-token-request.patch
- Fixes bsc#1199868, mod_auth_openidc not loading</changelog>
  <changelog author="danilo.spinella@suse.com" date="1680609600">- Fix CVE-2023-28625, NULL pointer dereference when OIDCStripCookies is
  set and a crafted Cookie header is supplied, bsc#1210073
  * fix-CVE-2023-28625.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1719489600">- Fix CVE-2024-24814, DoS when `OIDCSessionType client-cookie` is set
  and a crafted Cookie header is supplied, bsc#1219911
  * fix-CVE-2024-24814.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1720008000">- Fix apxs2 binary location, which made the library file be installed in root folder,
  bsc#1227261</changelog>
</package>
<package pkgid="5b2cb567fc5bc622578c91fdae5d2c1511d054e51dcdc65795364c5bf2e1b498" name="apache2-mod_auth_openidc" arch="src">
  <version epoch="0" ver="2.3.8" rel="150600.16.5.1"/>
  <changelog author="christof.hanke@mpcdf.mpg.de" date="1513166400">- initial packaging</changelog>
  <changelog author="vcizek@suse.com" date="1524830400">- update to 2.3.4
- requested in fate#323817</changelog>
  <changelog author="kstreitova@suse.com" date="1540900800">- update to 2.3.8
- changes in 2.3.8
  * fix return result FALSE when JWT payload parsing fails
  * add LGTM code quality badges
  * fix 3 LGTM alerts
  * improve auto-detection of XMLHttpRequests via Accept header
  * initialize test_proto_authorization_request properly
  * add sanity check on provider-&gt;auth_request_method
  * allow usage with LibreSSL
  * don't return content with 503 since it will turn the HTTP
    status code into a 200
  * add option to set an upper limit to the number of concurrent
    state cookies via OIDCStateMaxNumberOfCookies
  * make the default maximum number of parallel state cookies
    7 instead of unlimited
  * fix using access token as endpoint auth method in
    introspection calls
  * fix reading access_token form POST parameters when combined
    with `AuthType auth-openidc`
- changes in 2.3.7
  * abort when string length for remote user name substitution
    is larger than 255 characters
  * fix Redis concurrency issue when used with multiple vhosts
  * add support for authorization server metadata with
    OIDCOAuthServerMetadataURL as in RFC 8414
  * refactor session object creation
  * clear session cookie and contents if cache corruption is detected
  * use apr_pstrdup when setting r-&gt;user
  * reserve 255 characters in remote username substition instead of 50
- changes in 2.3.6
  * add check to detect session cache corruption for server-based
    caches and cached static metadata
  * avoid using pipelining for Redis
  * send Basic header in OAuth www-authenticate response if that's
    the only accepted method; thanks @puiterwijk
  * refactor Redis cache backend to solve issues on AUTH errors:
    a) memory leak and b) redisGetReply lagging behind
  * adjust copyright year/org
  * fix buffer overflow in shm cache key set strcpy
  * turn missing session_state from warning into a debug statement
  * fix missing "return" on error return from the OP
  * explicitly set encryption kid so we're compatible with
    cjose &gt;= 0.6.0
- changes in 2.3.5
  * fix encoding of preserved POST data
  * avoid buffer overflow in shm cache key construction
  * compile with with Libressl</changelog>
  <changelog author="kstreitova@suse.com" date="1541764800">- submission to SLE15SP1 because of fate#324447
- build with hiredis only for openSUSE where hiredis is available
- add a version for jansson BuildRequires</changelog>
  <changelog author="kstreitova@suse.com" date="1572436800">- add apache2-mod_auth_openidc-2.3.8-CVE-2019-14857.patch to fix
  open redirect issue that exists in URLs with trailing slashes
  [bsc#1153666], [CVE-2019-14857]</changelog>
  <changelog author="kstreitova@suse.com" date="1583323200">- add apache2-mod_auth_openidc-2.3.8-CVE-2019-20479.patch to fix
  open redirect issue that exists in URLs with a slash and
  backslash at the beginning [bsc#1164459], [CVE-2019-20479]</changelog>
  <changelog author="pgajdos@suse.com" date="1617278400">- require hiredis only for newer distros than SLE-15 [jsc#SLE-11726]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627041600">- Fix CVE-2021-32785 format string bug via hiredis
  (CVE-2021-32785, bsc#1188638)
  * fix-CVE-2021-32785.patch
- Fix CVE-2021-32786 open redirect in logout functionality
  (CVE-2021-32786, bsc#1188639)
  * fix-CVE-2021-32786.patch
- Refresh apache2-mod_auth_openidc-2.3.8-CVE-2019-20479.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627473600">- Fix CVE-2021-32791 Hardcoded static IV and AAD with a reused key in AES GCM encryption
  (CVE-2021-32791, bsc#1188849)
  * fix-CVE-2021-32791.patch
- Fix CVE-2021-32792 XSS when using OIDCPreservePost On
  (CVE-2021-32792, bsc#1188848)
  * fix-CVE-2021-32792-1.patch
  * fix-CVE-2021-32792-2.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1649851200">- Fix CVE-2021-39191 open redirect issue in target_link_uri parameter
  (CVE-2021-39191, bsc#1190223)
  * fix-CVE-2021-39191.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1671796800">- Fix CVE-2022-23527, Open Redirect in oidc_validate_redirect_url() using tab character
  (CVE-2022-23527, bsc#1206441)
  * fix-CVE-2022-23527-0.patch
  * fix-CVE-2022-23527-1.patch
  * fix-CVE-2022-23527-3.patch
  * fix-CVE-2022-23527-2.patch
- Harden oidc_handle_refresh_token_request function
  * harden-refresh-token-request.patch
- Fixes bsc#1199868, mod_auth_openidc not loading</changelog>
  <changelog author="danilo.spinella@suse.com" date="1680609600">- Fix CVE-2023-28625, NULL pointer dereference when OIDCStripCookies is
  set and a crafted Cookie header is supplied, bsc#1210073
  * fix-CVE-2023-28625.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1719489600">- Fix CVE-2024-24814, DoS when `OIDCSessionType client-cookie` is set
  and a crafted Cookie header is supplied, bsc#1219911
  * fix-CVE-2024-24814.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1720008000">- Fix apxs2 binary location, which made the library file be installed in root folder,
  bsc#1227261</changelog>
</package>
<package pkgid="18d1e0d08d4b775e7ba19360b3c12a9058c93d14a982c376986a0d95e236e3e2" name="apache2-mod_auth_openidc" arch="x86_64">
  <version epoch="0" ver="2.3.8" rel="150600.16.5.1"/>
  <changelog author="christof.hanke@mpcdf.mpg.de" date="1513166400">- initial packaging</changelog>
  <changelog author="vcizek@suse.com" date="1524830400">- update to 2.3.4
- requested in fate#323817</changelog>
  <changelog author="kstreitova@suse.com" date="1540900800">- update to 2.3.8
- changes in 2.3.8
  * fix return result FALSE when JWT payload parsing fails
  * add LGTM code quality badges
  * fix 3 LGTM alerts
  * improve auto-detection of XMLHttpRequests via Accept header
  * initialize test_proto_authorization_request properly
  * add sanity check on provider-&gt;auth_request_method
  * allow usage with LibreSSL
  * don't return content with 503 since it will turn the HTTP
    status code into a 200
  * add option to set an upper limit to the number of concurrent
    state cookies via OIDCStateMaxNumberOfCookies
  * make the default maximum number of parallel state cookies
    7 instead of unlimited
  * fix using access token as endpoint auth method in
    introspection calls
  * fix reading access_token form POST parameters when combined
    with `AuthType auth-openidc`
- changes in 2.3.7
  * abort when string length for remote user name substitution
    is larger than 255 characters
  * fix Redis concurrency issue when used with multiple vhosts
  * add support for authorization server metadata with
    OIDCOAuthServerMetadataURL as in RFC 8414
  * refactor session object creation
  * clear session cookie and contents if cache corruption is detected
  * use apr_pstrdup when setting r-&gt;user
  * reserve 255 characters in remote username substition instead of 50
- changes in 2.3.6
  * add check to detect session cache corruption for server-based
    caches and cached static metadata
  * avoid using pipelining for Redis
  * send Basic header in OAuth www-authenticate response if that's
    the only accepted method; thanks @puiterwijk
  * refactor Redis cache backend to solve issues on AUTH errors:
    a) memory leak and b) redisGetReply lagging behind
  * adjust copyright year/org
  * fix buffer overflow in shm cache key set strcpy
  * turn missing session_state from warning into a debug statement
  * fix missing "return" on error return from the OP
  * explicitly set encryption kid so we're compatible with
    cjose &gt;= 0.6.0
- changes in 2.3.5
  * fix encoding of preserved POST data
  * avoid buffer overflow in shm cache key construction
  * compile with with Libressl</changelog>
  <changelog author="kstreitova@suse.com" date="1541764800">- submission to SLE15SP1 because of fate#324447
- build with hiredis only for openSUSE where hiredis is available
- add a version for jansson BuildRequires</changelog>
  <changelog author="kstreitova@suse.com" date="1572436800">- add apache2-mod_auth_openidc-2.3.8-CVE-2019-14857.patch to fix
  open redirect issue that exists in URLs with trailing slashes
  [bsc#1153666], [CVE-2019-14857]</changelog>
  <changelog author="kstreitova@suse.com" date="1583323200">- add apache2-mod_auth_openidc-2.3.8-CVE-2019-20479.patch to fix
  open redirect issue that exists in URLs with a slash and
  backslash at the beginning [bsc#1164459], [CVE-2019-20479]</changelog>
  <changelog author="pgajdos@suse.com" date="1617278400">- require hiredis only for newer distros than SLE-15 [jsc#SLE-11726]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627041600">- Fix CVE-2021-32785 format string bug via hiredis
  (CVE-2021-32785, bsc#1188638)
  * fix-CVE-2021-32785.patch
- Fix CVE-2021-32786 open redirect in logout functionality
  (CVE-2021-32786, bsc#1188639)
  * fix-CVE-2021-32786.patch
- Refresh apache2-mod_auth_openidc-2.3.8-CVE-2019-20479.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627473600">- Fix CVE-2021-32791 Hardcoded static IV and AAD with a reused key in AES GCM encryption
  (CVE-2021-32791, bsc#1188849)
  * fix-CVE-2021-32791.patch
- Fix CVE-2021-32792 XSS when using OIDCPreservePost On
  (CVE-2021-32792, bsc#1188848)
  * fix-CVE-2021-32792-1.patch
  * fix-CVE-2021-32792-2.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1649851200">- Fix CVE-2021-39191 open redirect issue in target_link_uri parameter
  (CVE-2021-39191, bsc#1190223)
  * fix-CVE-2021-39191.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1671796800">- Fix CVE-2022-23527, Open Redirect in oidc_validate_redirect_url() using tab character
  (CVE-2022-23527, bsc#1206441)
  * fix-CVE-2022-23527-0.patch
  * fix-CVE-2022-23527-1.patch
  * fix-CVE-2022-23527-3.patch
  * fix-CVE-2022-23527-2.patch
- Harden oidc_handle_refresh_token_request function
  * harden-refresh-token-request.patch
- Fixes bsc#1199868, mod_auth_openidc not loading</changelog>
  <changelog author="danilo.spinella@suse.com" date="1680609600">- Fix CVE-2023-28625, NULL pointer dereference when OIDCStripCookies is
  set and a crafted Cookie header is supplied, bsc#1210073
  * fix-CVE-2023-28625.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1719489600">- Fix CVE-2024-24814, DoS when `OIDCSessionType client-cookie` is set
  and a crafted Cookie header is supplied, bsc#1219911
  * fix-CVE-2024-24814.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1720008000">- Fix apxs2 binary location, which made the library file be installed in root folder,
  bsc#1227261</changelog>
</package>
<package pkgid="ee3e2bf39272f0d119fb9384fa7c047d5a09f9b7e064df516801a19db8abdc5d" name="apache2-mod_php7" arch="aarch64">
  <version epoch="0" ver="7.4.33" rel="150400.4.37.1"/>
  <changelog author="suse+build@de-korte.org" date="1632398400">- updated to 7.4.24: This is a security release (CVE-2021-21706)
  which also contains several bug fixes.
  See https://www.php.net/ChangeLog-7.php#7.4.24</changelog>
  <changelog author="pgajdos@suse.com" date="1632744000">- previous version updates fixes also:
  CVE-2020-7068,CVE-2020-7069,CVE-2020-7070,CVE-2020-7071,
  CVE-2021-21702,CVE-2021-21704,CVE-2021-21705
  bsc#1175223,bsc#1177351,bsc#1177352,bsc#1180706,
  bsc#1182049,bsc#1188035,bsc#1188037</changelog>
  <changelog author="suse+build@de-korte.org" date="1634904000">- updated to 7.4.25: This is a security release (CVE-2021-21703)
  which also contains several bug fixes.
  See https://www.php.net/ChangeLog-7.php#7.4.25</changelog>
  <changelog author="pgajdos@suse.com" date="1645531200">- security update
- added patches
  fix CVE-2021-21708 [bsc#1196252], Use after free due to php_filter_float() failing for ints
  + php7-CVE-2021-21708.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651838400">- security update [bsc#1197644]
- added patches
  fix https://github.com/php/php-src/commit/771dbdb319fa7f90584f6b2cc2c54ccff570492d
  + php7-signedness-php_filter_validate_domain.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1654862400">- security update
- added patches
  fix CVE-2021-21707 [bsc#1193041], special character breaks path in xml parsing
  + php7-CVE-2021-21707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655467200">- security update
- added patches
  fix CVE-2022-31626 [bsc#1200628], buffer overflow via user-supplied password when using pdo_mysql extension with mysqlnd driver
  + php7-CVE-2022-31626.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655726400">- security update
- added patches
  fix CVE-2022-31625 [bsc#1200645], uninitialized pointers free in Postgres extension
  + php7-CVE-2022-31625.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664798400">- version update to 7.4.32 [jsc#SLE-23639]
  Version 7.4.32
  29 Sep 2022
    Core:
    Fixed bug #81726: phar wrapper: DOS when using quine gzip file. (CVE-2022-31628)
    Fixed bug #81727: Don't mangle HTTP variable names that clash with ones that have a specific semantic meaning. (CVE-2022-31629)
  Version 7.4.30
  09 Jun 2022
    mysqlnd:
    Fixed bug #81719: mysqlnd/pdo password buffer overflow. (CVE-2022-31626)
    pgsql:
    Fixed bug #81720: Uninitialized array in pg_query_params(). (CVE-2022-31625)
  Version 7.4.29
  14 Apr 2022
    Core:
    No source changes to this release. This update allows for re-building the Windows binaries against upgraded dependencies which have received security updates.
    Date:
    Updated to latest IANA timezone database (2022a).
  Version 7.4.28
  17 Feb 2022
    Filter:
    Fix #81708: UAF due to php_filter_float() failing for ints (CVE-2021-21708)
  Version 7.4.27
  16 Dec 2021
    Core:
    Fixed bug #81626 (Error on use static:: in __сallStatic() wrapped to Closure::fromCallable()).
    FPM:
    Fixed bug #81513 (Future possibility for heap overflow in FPM zlog).
    GD:
    Fixed bug #71316 (libpng warning from imagecreatefromstring).
    OpenSSL:
    Fixed bug #75725 (./configure: detecting RAND_egd).
    PCRE:
    Fixed bug #74604 (Out of bounds in php_pcre_replace_impl).
    Standard:
    Fixed bug #81618 (dns_get_record fails on FreeBSD for missing type).
    Fixed bug #81659 (stream_get_contents() may unnecessarily overallocate).
  Version 7.4.26
  18 Nov 2021
    Core:
    Fixed bug #81518 (Header injection via default_mimetype / default_charset).
    Date:
    Fixed bug #81500 (Interval serialization regression since 7.3.14 / 7.4.2).
    MBString:
    Fixed bug #76167 (mbstring may use pointer from some previous request).
    MySQLi:
    Fixed bug #81494 (Stopped unbuffered query does not throw error).
    PCRE:
    Fixed bug #81424 (PCRE2 10.35 JIT performance regression).
    Streams:
    Fixed bug #54340 (Memory corruption with user_filter).
    XML:
    Fixed bug #79971 (special character is breaking the path in xml function). (CVE-2021-21707)
- fixes [bsc#1203867] and [bsc#1203870]
- deleted patches
  - php7-CVE-2021-21707.patch (upstreamed)
  - php7-CVE-2021-21708.patch (upstreamed)
  - php7-CVE-2022-31625.patch (upstreamed)
  - php7-CVE-2022-31626.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1667476800">- version update to 7.4.33 [bsc#1204577][bsc#1204979]
    03 Nov 2022
    GD:
    Fixed bug #81739: OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)
    Hash:
    Fixed bug #81738: buffer overflow in hash_update() on long parameter. (CVE-2022-37454)</changelog>
  <changelog author="pgajdos@suse.com" date="1673265600">- security update
- added patches
  fix CVE-2022-31631 [bsc#1206958], Due to an integer overflow PDO:quote() may return unquoted string
  + php7-CVE-2022-31631.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1676635200">- security update
- added patches
  fix CVE-2023-0568 [bsc#1208366], NULL byte off-by-one in php_check_specific_open_basedir
  + php7-CVE-2023-0568.patch
  fix CVE-2023-0662 [bsc#1208367], DoS vulnerability when parsing multipart request body
  + php7-CVE-2023-0662.patch
  https://github.com/php/php-src/commit/a92acbad873a05470af1a47cb785a18eadd827b5, relates to CVE-2023-0567 [bsc#1208388]
  + php7-crypt-possible-buffer-overread.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678104000">- ensure extension=mysqlnd will be called before extension=mysqli
  [bsc#1205162]</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- fix potential buffer overflow [bsc#1208199]
- modified patches
  % php-systzdata-v19.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1679400000">- security update
- added patches
  fix CVE-2022-4900 [bsc#1209537], potential buffer overflow via PHP_CLI_SERVER_WORKERS environment variable
  + php7-CVE-2022-4900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1686830400">- security update
- added patches
  fix CVE-2023-3247 [bsc#1212349], Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP
  + php7-CVE-2023-3247.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692792000">- security update
- added patches
  fix CVE-2023-3823 [bsc#1214106], XML loading external entity without being enabled
  + php7-CVE-2023-3823.patch
  fix CVE-2023-3824 [bsc#1214103], buffer overflows in phar_dir_read()
  + php7-CVE-2023-3824.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1705406400">- ensure we are building against openssl-1_1</changelog>
  <changelog author="pgajdos@suse.com" date="1713528000">- security update
- added patches
  fix CVE-2024-2756 [bsc#1222857], host/secure cookie bypass due to partial fix
  + php7-CVE-2024-2756.patch
  fix CVE-2024-3096 [bsc#1222858], password_verify can erroneously return true, opening ATO risk
  + php7-CVE-2024-3096.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718107200">- security update
- added patches
  fix CVE-2024-5458 [bsc#1226073], filter bypass in filter_var FILTER_VALIDATE_URL
  + php7-CVE-2024-5458.patch</changelog>
</package>
<package pkgid="367b3194f3bf2ffe5119f4a1179d10c85b7d91e8d477937add0b8f9bb5ca299f" name="apache2-mod_php7" arch="ppc64le">
  <version epoch="0" ver="7.4.33" rel="150400.4.37.1"/>
  <changelog author="suse+build@de-korte.org" date="1632398400">- updated to 7.4.24: This is a security release (CVE-2021-21706)
  which also contains several bug fixes.
  See https://www.php.net/ChangeLog-7.php#7.4.24</changelog>
  <changelog author="pgajdos@suse.com" date="1632744000">- previous version updates fixes also:
  CVE-2020-7068,CVE-2020-7069,CVE-2020-7070,CVE-2020-7071,
  CVE-2021-21702,CVE-2021-21704,CVE-2021-21705
  bsc#1175223,bsc#1177351,bsc#1177352,bsc#1180706,
  bsc#1182049,bsc#1188035,bsc#1188037</changelog>
  <changelog author="suse+build@de-korte.org" date="1634904000">- updated to 7.4.25: This is a security release (CVE-2021-21703)
  which also contains several bug fixes.
  See https://www.php.net/ChangeLog-7.php#7.4.25</changelog>
  <changelog author="pgajdos@suse.com" date="1645531200">- security update
- added patches
  fix CVE-2021-21708 [bsc#1196252], Use after free due to php_filter_float() failing for ints
  + php7-CVE-2021-21708.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651838400">- security update [bsc#1197644]
- added patches
  fix https://github.com/php/php-src/commit/771dbdb319fa7f90584f6b2cc2c54ccff570492d
  + php7-signedness-php_filter_validate_domain.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1654862400">- security update
- added patches
  fix CVE-2021-21707 [bsc#1193041], special character breaks path in xml parsing
  + php7-CVE-2021-21707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655467200">- security update
- added patches
  fix CVE-2022-31626 [bsc#1200628], buffer overflow via user-supplied password when using pdo_mysql extension with mysqlnd driver
  + php7-CVE-2022-31626.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655726400">- security update
- added patches
  fix CVE-2022-31625 [bsc#1200645], uninitialized pointers free in Postgres extension
  + php7-CVE-2022-31625.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664798400">- version update to 7.4.32 [jsc#SLE-23639]
  Version 7.4.32
  29 Sep 2022
    Core:
    Fixed bug #81726: phar wrapper: DOS when using quine gzip file. (CVE-2022-31628)
    Fixed bug #81727: Don't mangle HTTP variable names that clash with ones that have a specific semantic meaning. (CVE-2022-31629)
  Version 7.4.30
  09 Jun 2022
    mysqlnd:
    Fixed bug #81719: mysqlnd/pdo password buffer overflow. (CVE-2022-31626)
    pgsql:
    Fixed bug #81720: Uninitialized array in pg_query_params(). (CVE-2022-31625)
  Version 7.4.29
  14 Apr 2022
    Core:
    No source changes to this release. This update allows for re-building the Windows binaries against upgraded dependencies which have received security updates.
    Date:
    Updated to latest IANA timezone database (2022a).
  Version 7.4.28
  17 Feb 2022
    Filter:
    Fix #81708: UAF due to php_filter_float() failing for ints (CVE-2021-21708)
  Version 7.4.27
  16 Dec 2021
    Core:
    Fixed bug #81626 (Error on use static:: in __сallStatic() wrapped to Closure::fromCallable()).
    FPM:
    Fixed bug #81513 (Future possibility for heap overflow in FPM zlog).
    GD:
    Fixed bug #71316 (libpng warning from imagecreatefromstring).
    OpenSSL:
    Fixed bug #75725 (./configure: detecting RAND_egd).
    PCRE:
    Fixed bug #74604 (Out of bounds in php_pcre_replace_impl).
    Standard:
    Fixed bug #81618 (dns_get_record fails on FreeBSD for missing type).
    Fixed bug #81659 (stream_get_contents() may unnecessarily overallocate).
  Version 7.4.26
  18 Nov 2021
    Core:
    Fixed bug #81518 (Header injection via default_mimetype / default_charset).
    Date:
    Fixed bug #81500 (Interval serialization regression since 7.3.14 / 7.4.2).
    MBString:
    Fixed bug #76167 (mbstring may use pointer from some previous request).
    MySQLi:
    Fixed bug #81494 (Stopped unbuffered query does not throw error).
    PCRE:
    Fixed bug #81424 (PCRE2 10.35 JIT performance regression).
    Streams:
    Fixed bug #54340 (Memory corruption with user_filter).
    XML:
    Fixed bug #79971 (special character is breaking the path in xml function). (CVE-2021-21707)
- fixes [bsc#1203867] and [bsc#1203870]
- deleted patches
  - php7-CVE-2021-21707.patch (upstreamed)
  - php7-CVE-2021-21708.patch (upstreamed)
  - php7-CVE-2022-31625.patch (upstreamed)
  - php7-CVE-2022-31626.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1667476800">- version update to 7.4.33 [bsc#1204577][bsc#1204979]
    03 Nov 2022
    GD:
    Fixed bug #81739: OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)
    Hash:
    Fixed bug #81738: buffer overflow in hash_update() on long parameter. (CVE-2022-37454)</changelog>
  <changelog author="pgajdos@suse.com" date="1673265600">- security update
- added patches
  fix CVE-2022-31631 [bsc#1206958], Due to an integer overflow PDO:quote() may return unquoted string
  + php7-CVE-2022-31631.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1676635200">- security update
- added patches
  fix CVE-2023-0568 [bsc#1208366], NULL byte off-by-one in php_check_specific_open_basedir
  + php7-CVE-2023-0568.patch
  fix CVE-2023-0662 [bsc#1208367], DoS vulnerability when parsing multipart request body
  + php7-CVE-2023-0662.patch
  https://github.com/php/php-src/commit/a92acbad873a05470af1a47cb785a18eadd827b5, relates to CVE-2023-0567 [bsc#1208388]
  + php7-crypt-possible-buffer-overread.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678104000">- ensure extension=mysqlnd will be called before extension=mysqli
  [bsc#1205162]</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- fix potential buffer overflow [bsc#1208199]
- modified patches
  % php-systzdata-v19.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1679400000">- security update
- added patches
  fix CVE-2022-4900 [bsc#1209537], potential buffer overflow via PHP_CLI_SERVER_WORKERS environment variable
  + php7-CVE-2022-4900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1686830400">- security update
- added patches
  fix CVE-2023-3247 [bsc#1212349], Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP
  + php7-CVE-2023-3247.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692792000">- security update
- added patches
  fix CVE-2023-3823 [bsc#1214106], XML loading external entity without being enabled
  + php7-CVE-2023-3823.patch
  fix CVE-2023-3824 [bsc#1214103], buffer overflows in phar_dir_read()
  + php7-CVE-2023-3824.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1705406400">- ensure we are building against openssl-1_1</changelog>
  <changelog author="pgajdos@suse.com" date="1713528000">- security update
- added patches
  fix CVE-2024-2756 [bsc#1222857], host/secure cookie bypass due to partial fix
  + php7-CVE-2024-2756.patch
  fix CVE-2024-3096 [bsc#1222858], password_verify can erroneously return true, opening ATO risk
  + php7-CVE-2024-3096.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718107200">- security update
- added patches
  fix CVE-2024-5458 [bsc#1226073], filter bypass in filter_var FILTER_VALIDATE_URL
  + php7-CVE-2024-5458.patch</changelog>
</package>
<package pkgid="7e88a7cb6a4beb588f0feb27767608aae1eb8e3e973b72ebda5962f32ddc919a" name="apache2-mod_php7" arch="s390x">
  <version epoch="0" ver="7.4.33" rel="150400.4.37.1"/>
  <changelog author="suse+build@de-korte.org" date="1632398400">- updated to 7.4.24: This is a security release (CVE-2021-21706)
  which also contains several bug fixes.
  See https://www.php.net/ChangeLog-7.php#7.4.24</changelog>
  <changelog author="pgajdos@suse.com" date="1632744000">- previous version updates fixes also:
  CVE-2020-7068,CVE-2020-7069,CVE-2020-7070,CVE-2020-7071,
  CVE-2021-21702,CVE-2021-21704,CVE-2021-21705
  bsc#1175223,bsc#1177351,bsc#1177352,bsc#1180706,
  bsc#1182049,bsc#1188035,bsc#1188037</changelog>
  <changelog author="suse+build@de-korte.org" date="1634904000">- updated to 7.4.25: This is a security release (CVE-2021-21703)
  which also contains several bug fixes.
  See https://www.php.net/ChangeLog-7.php#7.4.25</changelog>
  <changelog author="pgajdos@suse.com" date="1645531200">- security update
- added patches
  fix CVE-2021-21708 [bsc#1196252], Use after free due to php_filter_float() failing for ints
  + php7-CVE-2021-21708.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651838400">- security update [bsc#1197644]
- added patches
  fix https://github.com/php/php-src/commit/771dbdb319fa7f90584f6b2cc2c54ccff570492d
  + php7-signedness-php_filter_validate_domain.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1654862400">- security update
- added patches
  fix CVE-2021-21707 [bsc#1193041], special character breaks path in xml parsing
  + php7-CVE-2021-21707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655467200">- security update
- added patches
  fix CVE-2022-31626 [bsc#1200628], buffer overflow via user-supplied password when using pdo_mysql extension with mysqlnd driver
  + php7-CVE-2022-31626.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655726400">- security update
- added patches
  fix CVE-2022-31625 [bsc#1200645], uninitialized pointers free in Postgres extension
  + php7-CVE-2022-31625.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664798400">- version update to 7.4.32 [jsc#SLE-23639]
  Version 7.4.32
  29 Sep 2022
    Core:
    Fixed bug #81726: phar wrapper: DOS when using quine gzip file. (CVE-2022-31628)
    Fixed bug #81727: Don't mangle HTTP variable names that clash with ones that have a specific semantic meaning. (CVE-2022-31629)
  Version 7.4.30
  09 Jun 2022
    mysqlnd:
    Fixed bug #81719: mysqlnd/pdo password buffer overflow. (CVE-2022-31626)
    pgsql:
    Fixed bug #81720: Uninitialized array in pg_query_params(). (CVE-2022-31625)
  Version 7.4.29
  14 Apr 2022
    Core:
    No source changes to this release. This update allows for re-building the Windows binaries against upgraded dependencies which have received security updates.
    Date:
    Updated to latest IANA timezone database (2022a).
  Version 7.4.28
  17 Feb 2022
    Filter:
    Fix #81708: UAF due to php_filter_float() failing for ints (CVE-2021-21708)
  Version 7.4.27
  16 Dec 2021
    Core:
    Fixed bug #81626 (Error on use static:: in __сallStatic() wrapped to Closure::fromCallable()).
    FPM:
    Fixed bug #81513 (Future possibility for heap overflow in FPM zlog).
    GD:
    Fixed bug #71316 (libpng warning from imagecreatefromstring).
    OpenSSL:
    Fixed bug #75725 (./configure: detecting RAND_egd).
    PCRE:
    Fixed bug #74604 (Out of bounds in php_pcre_replace_impl).
    Standard:
    Fixed bug #81618 (dns_get_record fails on FreeBSD for missing type).
    Fixed bug #81659 (stream_get_contents() may unnecessarily overallocate).
  Version 7.4.26
  18 Nov 2021
    Core:
    Fixed bug #81518 (Header injection via default_mimetype / default_charset).
    Date:
    Fixed bug #81500 (Interval serialization regression since 7.3.14 / 7.4.2).
    MBString:
    Fixed bug #76167 (mbstring may use pointer from some previous request).
    MySQLi:
    Fixed bug #81494 (Stopped unbuffered query does not throw error).
    PCRE:
    Fixed bug #81424 (PCRE2 10.35 JIT performance regression).
    Streams:
    Fixed bug #54340 (Memory corruption with user_filter).
    XML:
    Fixed bug #79971 (special character is breaking the path in xml function). (CVE-2021-21707)
- fixes [bsc#1203867] and [bsc#1203870]
- deleted patches
  - php7-CVE-2021-21707.patch (upstreamed)
  - php7-CVE-2021-21708.patch (upstreamed)
  - php7-CVE-2022-31625.patch (upstreamed)
  - php7-CVE-2022-31626.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1667476800">- version update to 7.4.33 [bsc#1204577][bsc#1204979]
    03 Nov 2022
    GD:
    Fixed bug #81739: OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)
    Hash:
    Fixed bug #81738: buffer overflow in hash_update() on long parameter. (CVE-2022-37454)</changelog>
  <changelog author="pgajdos@suse.com" date="1673265600">- security update
- added patches
  fix CVE-2022-31631 [bsc#1206958], Due to an integer overflow PDO:quote() may return unquoted string
  + php7-CVE-2022-31631.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1676635200">- security update
- added patches
  fix CVE-2023-0568 [bsc#1208366], NULL byte off-by-one in php_check_specific_open_basedir
  + php7-CVE-2023-0568.patch
  fix CVE-2023-0662 [bsc#1208367], DoS vulnerability when parsing multipart request body
  + php7-CVE-2023-0662.patch
  https://github.com/php/php-src/commit/a92acbad873a05470af1a47cb785a18eadd827b5, relates to CVE-2023-0567 [bsc#1208388]
  + php7-crypt-possible-buffer-overread.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678104000">- ensure extension=mysqlnd will be called before extension=mysqli
  [bsc#1205162]</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- fix potential buffer overflow [bsc#1208199]
- modified patches
  % php-systzdata-v19.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1679400000">- security update
- added patches
  fix CVE-2022-4900 [bsc#1209537], potential buffer overflow via PHP_CLI_SERVER_WORKERS environment variable
  + php7-CVE-2022-4900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1686830400">- security update
- added patches
  fix CVE-2023-3247 [bsc#1212349], Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP
  + php7-CVE-2023-3247.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692792000">- security update
- added patches
  fix CVE-2023-3823 [bsc#1214106], XML loading external entity without being enabled
  + php7-CVE-2023-3823.patch
  fix CVE-2023-3824 [bsc#1214103], buffer overflows in phar_dir_read()
  + php7-CVE-2023-3824.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1705406400">- ensure we are building against openssl-1_1</changelog>
  <changelog author="pgajdos@suse.com" date="1713528000">- security update
- added patches
  fix CVE-2024-2756 [bsc#1222857], host/secure cookie bypass due to partial fix
  + php7-CVE-2024-2756.patch
  fix CVE-2024-3096 [bsc#1222858], password_verify can erroneously return true, opening ATO risk
  + php7-CVE-2024-3096.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718107200">- security update
- added patches
  fix CVE-2024-5458 [bsc#1226073], filter bypass in filter_var FILTER_VALIDATE_URL
  + php7-CVE-2024-5458.patch</changelog>
</package>
<package pkgid="5901e548fe0d51be18bed8a40885d5a856a846274b01cdd29a55f5804f0ead5f" name="apache2-mod_php7" arch="src">
  <version epoch="0" ver="7.4.33" rel="150400.4.37.1"/>
  <changelog author="suse+build@de-korte.org" date="1632398400">- updated to 7.4.24: This is a security release (CVE-2021-21706)
  which also contains several bug fixes.
  See https://www.php.net/ChangeLog-7.php#7.4.24</changelog>
  <changelog author="pgajdos@suse.com" date="1632744000">- previous version updates fixes also:
  CVE-2020-7068,CVE-2020-7069,CVE-2020-7070,CVE-2020-7071,
  CVE-2021-21702,CVE-2021-21704,CVE-2021-21705
  bsc#1175223,bsc#1177351,bsc#1177352,bsc#1180706,
  bsc#1182049,bsc#1188035,bsc#1188037</changelog>
  <changelog author="suse+build@de-korte.org" date="1634904000">- updated to 7.4.25: This is a security release (CVE-2021-21703)
  which also contains several bug fixes.
  See https://www.php.net/ChangeLog-7.php#7.4.25</changelog>
  <changelog author="pgajdos@suse.com" date="1645531200">- security update
- added patches
  fix CVE-2021-21708 [bsc#1196252], Use after free due to php_filter_float() failing for ints
  + php7-CVE-2021-21708.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651838400">- security update [bsc#1197644]
- added patches
  fix https://github.com/php/php-src/commit/771dbdb319fa7f90584f6b2cc2c54ccff570492d
  + php7-signedness-php_filter_validate_domain.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1654862400">- security update
- added patches
  fix CVE-2021-21707 [bsc#1193041], special character breaks path in xml parsing
  + php7-CVE-2021-21707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655467200">- security update
- added patches
  fix CVE-2022-31626 [bsc#1200628], buffer overflow via user-supplied password when using pdo_mysql extension with mysqlnd driver
  + php7-CVE-2022-31626.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655726400">- security update
- added patches
  fix CVE-2022-31625 [bsc#1200645], uninitialized pointers free in Postgres extension
  + php7-CVE-2022-31625.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664798400">- version update to 7.4.32 [jsc#SLE-23639]
  Version 7.4.32
  29 Sep 2022
    Core:
    Fixed bug #81726: phar wrapper: DOS when using quine gzip file. (CVE-2022-31628)
    Fixed bug #81727: Don't mangle HTTP variable names that clash with ones that have a specific semantic meaning. (CVE-2022-31629)
  Version 7.4.30
  09 Jun 2022
    mysqlnd:
    Fixed bug #81719: mysqlnd/pdo password buffer overflow. (CVE-2022-31626)
    pgsql:
    Fixed bug #81720: Uninitialized array in pg_query_params(). (CVE-2022-31625)
  Version 7.4.29
  14 Apr 2022
    Core:
    No source changes to this release. This update allows for re-building the Windows binaries against upgraded dependencies which have received security updates.
    Date:
    Updated to latest IANA timezone database (2022a).
  Version 7.4.28
  17 Feb 2022
    Filter:
    Fix #81708: UAF due to php_filter_float() failing for ints (CVE-2021-21708)
  Version 7.4.27
  16 Dec 2021
    Core:
    Fixed bug #81626 (Error on use static:: in __сallStatic() wrapped to Closure::fromCallable()).
    FPM:
    Fixed bug #81513 (Future possibility for heap overflow in FPM zlog).
    GD:
    Fixed bug #71316 (libpng warning from imagecreatefromstring).
    OpenSSL:
    Fixed bug #75725 (./configure: detecting RAND_egd).
    PCRE:
    Fixed bug #74604 (Out of bounds in php_pcre_replace_impl).
    Standard:
    Fixed bug #81618 (dns_get_record fails on FreeBSD for missing type).
    Fixed bug #81659 (stream_get_contents() may unnecessarily overallocate).
  Version 7.4.26
  18 Nov 2021
    Core:
    Fixed bug #81518 (Header injection via default_mimetype / default_charset).
    Date:
    Fixed bug #81500 (Interval serialization regression since 7.3.14 / 7.4.2).
    MBString:
    Fixed bug #76167 (mbstring may use pointer from some previous request).
    MySQLi:
    Fixed bug #81494 (Stopped unbuffered query does not throw error).
    PCRE:
    Fixed bug #81424 (PCRE2 10.35 JIT performance regression).
    Streams:
    Fixed bug #54340 (Memory corruption with user_filter).
    XML:
    Fixed bug #79971 (special character is breaking the path in xml function). (CVE-2021-21707)
- fixes [bsc#1203867] and [bsc#1203870]
- deleted patches
  - php7-CVE-2021-21707.patch (upstreamed)
  - php7-CVE-2021-21708.patch (upstreamed)
  - php7-CVE-2022-31625.patch (upstreamed)
  - php7-CVE-2022-31626.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1667476800">- version update to 7.4.33 [bsc#1204577][bsc#1204979]
    03 Nov 2022
    GD:
    Fixed bug #81739: OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)
    Hash:
    Fixed bug #81738: buffer overflow in hash_update() on long parameter. (CVE-2022-37454)</changelog>
  <changelog author="pgajdos@suse.com" date="1673265600">- security update
- added patches
  fix CVE-2022-31631 [bsc#1206958], Due to an integer overflow PDO:quote() may return unquoted string
  + php7-CVE-2022-31631.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1676635200">- security update
- added patches
  fix CVE-2023-0568 [bsc#1208366], NULL byte off-by-one in php_check_specific_open_basedir
  + php7-CVE-2023-0568.patch
  fix CVE-2023-0662 [bsc#1208367], DoS vulnerability when parsing multipart request body
  + php7-CVE-2023-0662.patch
  https://github.com/php/php-src/commit/a92acbad873a05470af1a47cb785a18eadd827b5, relates to CVE-2023-0567 [bsc#1208388]
  + php7-crypt-possible-buffer-overread.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678104000">- ensure extension=mysqlnd will be called before extension=mysqli
  [bsc#1205162]</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- fix potential buffer overflow [bsc#1208199]
- modified patches
  % php-systzdata-v19.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1679400000">- security update
- added patches
  fix CVE-2022-4900 [bsc#1209537], potential buffer overflow via PHP_CLI_SERVER_WORKERS environment variable
  + php7-CVE-2022-4900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1686830400">- security update
- added patches
  fix CVE-2023-3247 [bsc#1212349], Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP
  + php7-CVE-2023-3247.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692792000">- security update
- added patches
  fix CVE-2023-3823 [bsc#1214106], XML loading external entity without being enabled
  + php7-CVE-2023-3823.patch
  fix CVE-2023-3824 [bsc#1214103], buffer overflows in phar_dir_read()
  + php7-CVE-2023-3824.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1705406400">- ensure we are building against openssl-1_1</changelog>
  <changelog author="pgajdos@suse.com" date="1713528000">- security update
- added patches
  fix CVE-2024-2756 [bsc#1222857], host/secure cookie bypass due to partial fix
  + php7-CVE-2024-2756.patch
  fix CVE-2024-3096 [bsc#1222858], password_verify can erroneously return true, opening ATO risk
  + php7-CVE-2024-3096.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718107200">- security update
- added patches
  fix CVE-2024-5458 [bsc#1226073], filter bypass in filter_var FILTER_VALIDATE_URL
  + php7-CVE-2024-5458.patch</changelog>
</package>
<package pkgid="f3dfdeba494c4bdcded4008d9a17e58e4f34d71c552bdd70d99769bbbe597286" name="apache2-mod_php7" arch="x86_64">
  <version epoch="0" ver="7.4.33" rel="150400.4.37.1"/>
  <changelog author="suse+build@de-korte.org" date="1632398400">- updated to 7.4.24: This is a security release (CVE-2021-21706)
  which also contains several bug fixes.
  See https://www.php.net/ChangeLog-7.php#7.4.24</changelog>
  <changelog author="pgajdos@suse.com" date="1632744000">- previous version updates fixes also:
  CVE-2020-7068,CVE-2020-7069,CVE-2020-7070,CVE-2020-7071,
  CVE-2021-21702,CVE-2021-21704,CVE-2021-21705
  bsc#1175223,bsc#1177351,bsc#1177352,bsc#1180706,
  bsc#1182049,bsc#1188035,bsc#1188037</changelog>
  <changelog author="suse+build@de-korte.org" date="1634904000">- updated to 7.4.25: This is a security release (CVE-2021-21703)
  which also contains several bug fixes.
  See https://www.php.net/ChangeLog-7.php#7.4.25</changelog>
  <changelog author="pgajdos@suse.com" date="1645531200">- security update
- added patches
  fix CVE-2021-21708 [bsc#1196252], Use after free due to php_filter_float() failing for ints
  + php7-CVE-2021-21708.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651838400">- security update [bsc#1197644]
- added patches
  fix https://github.com/php/php-src/commit/771dbdb319fa7f90584f6b2cc2c54ccff570492d
  + php7-signedness-php_filter_validate_domain.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1654862400">- security update
- added patches
  fix CVE-2021-21707 [bsc#1193041], special character breaks path in xml parsing
  + php7-CVE-2021-21707.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655467200">- security update
- added patches
  fix CVE-2022-31626 [bsc#1200628], buffer overflow via user-supplied password when using pdo_mysql extension with mysqlnd driver
  + php7-CVE-2022-31626.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1655726400">- security update
- added patches
  fix CVE-2022-31625 [bsc#1200645], uninitialized pointers free in Postgres extension
  + php7-CVE-2022-31625.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664798400">- version update to 7.4.32 [jsc#SLE-23639]
  Version 7.4.32
  29 Sep 2022
    Core:
    Fixed bug #81726: phar wrapper: DOS when using quine gzip file. (CVE-2022-31628)
    Fixed bug #81727: Don't mangle HTTP variable names that clash with ones that have a specific semantic meaning. (CVE-2022-31629)
  Version 7.4.30
  09 Jun 2022
    mysqlnd:
    Fixed bug #81719: mysqlnd/pdo password buffer overflow. (CVE-2022-31626)
    pgsql:
    Fixed bug #81720: Uninitialized array in pg_query_params(). (CVE-2022-31625)
  Version 7.4.29
  14 Apr 2022
    Core:
    No source changes to this release. This update allows for re-building the Windows binaries against upgraded dependencies which have received security updates.
    Date:
    Updated to latest IANA timezone database (2022a).
  Version 7.4.28
  17 Feb 2022
    Filter:
    Fix #81708: UAF due to php_filter_float() failing for ints (CVE-2021-21708)
  Version 7.4.27
  16 Dec 2021
    Core:
    Fixed bug #81626 (Error on use static:: in __сallStatic() wrapped to Closure::fromCallable()).
    FPM:
    Fixed bug #81513 (Future possibility for heap overflow in FPM zlog).
    GD:
    Fixed bug #71316 (libpng warning from imagecreatefromstring).
    OpenSSL:
    Fixed bug #75725 (./configure: detecting RAND_egd).
    PCRE:
    Fixed bug #74604 (Out of bounds in php_pcre_replace_impl).
    Standard:
    Fixed bug #81618 (dns_get_record fails on FreeBSD for missing type).
    Fixed bug #81659 (stream_get_contents() may unnecessarily overallocate).
  Version 7.4.26
  18 Nov 2021
    Core:
    Fixed bug #81518 (Header injection via default_mimetype / default_charset).
    Date:
    Fixed bug #81500 (Interval serialization regression since 7.3.14 / 7.4.2).
    MBString:
    Fixed bug #76167 (mbstring may use pointer from some previous request).
    MySQLi:
    Fixed bug #81494 (Stopped unbuffered query does not throw error).
    PCRE:
    Fixed bug #81424 (PCRE2 10.35 JIT performance regression).
    Streams:
    Fixed bug #54340 (Memory corruption with user_filter).
    XML:
    Fixed bug #79971 (special character is breaking the path in xml function). (CVE-2021-21707)
- fixes [bsc#1203867] and [bsc#1203870]
- deleted patches
  - php7-CVE-2021-21707.patch (upstreamed)
  - php7-CVE-2021-21708.patch (upstreamed)
  - php7-CVE-2022-31625.patch (upstreamed)
  - php7-CVE-2022-31626.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1667476800">- version update to 7.4.33 [bsc#1204577][bsc#1204979]
    03 Nov 2022
    GD:
    Fixed bug #81739: OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)
    Hash:
    Fixed bug #81738: buffer overflow in hash_update() on long parameter. (CVE-2022-37454)</changelog>
  <changelog author="pgajdos@suse.com" date="1673265600">- security update
- added patches
  fix CVE-2022-31631 [bsc#1206958], Due to an integer overflow PDO:quote() may return unquoted string
  + php7-CVE-2022-31631.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1676635200">- security update
- added patches
  fix CVE-2023-0568 [bsc#1208366], NULL byte off-by-one in php_check_specific_open_basedir
  + php7-CVE-2023-0568.patch
  fix CVE-2023-0662 [bsc#1208367], DoS vulnerability when parsing multipart request body
  + php7-CVE-2023-0662.patch
  https://github.com/php/php-src/commit/a92acbad873a05470af1a47cb785a18eadd827b5, relates to CVE-2023-0567 [bsc#1208388]
  + php7-crypt-possible-buffer-overread.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1678104000">- ensure extension=mysqlnd will be called before extension=mysqli
  [bsc#1205162]</changelog>
  <changelog author="pgajdos@suse.com" date="1678795200">- fix potential buffer overflow [bsc#1208199]
- modified patches
  % php-systzdata-v19.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1679400000">- security update
- added patches
  fix CVE-2022-4900 [bsc#1209537], potential buffer overflow via PHP_CLI_SERVER_WORKERS environment variable
  + php7-CVE-2022-4900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1686830400">- security update
- added patches
  fix CVE-2023-3247 [bsc#1212349], Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP
  + php7-CVE-2023-3247.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1692792000">- security update
- added patches
  fix CVE-2023-3823 [bsc#1214106], XML loading external entity without being enabled
  + php7-CVE-2023-3823.patch
  fix CVE-2023-3824 [bsc#1214103], buffer overflows in phar_dir_read()
  + php7-CVE-2023-3824.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1705406400">- ensure we are building against openssl-1_1</changelog>
  <changelog author="pgajdos@suse.com" date="1713528000">- security update
- added patches
  fix CVE-2024-2756 [bsc#1222857], host/secure cookie bypass due to partial fix
  + php7-CVE-2024-2756.patch
  fix CVE-2024-3096 [bsc#1222858], password_verify can erroneously return true, opening ATO risk
  + php7-CVE-2024-3096.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718107200">- security update
- added patches
  fix CVE-2024-5458 [bsc#1226073], filter bypass in filter_var FILTER_VALIDATE_URL
  + php7-CVE-2024-5458.patch</changelog>
</package>
<package pkgid="5ba1eff14a74cb12f3fdf58ef097b53258e7b0e00390835e3777e4e9c0b6ca81" name="apache2-mod_php8" arch="aarch64">
  <version epoch="0" ver="8.2.20" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1684843200">- also MIT license (systzdata patch, ext/date/lib/parse_posix.c)
  [https://build.suse.de/request/show/298230]</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- repack the tarball temporarily [bsc#1211648]</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 8.1.20
  * This is a security release.
  * https://www.php.net/ChangeLog-8.php#8.1.20
- force to repack tarball after update
  https://github.com/php/php-src/issues/11300
- session.save_path set to /var/lib/php8/sessions in mod_php8.conf
  and www.conf php-fpm pool example
- modified sources
  % mod_php8.conf
- added sources
  + repack.sh
  + php-unicode-allow-redistribution.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1687435200">- version update to 8.2.7
  * Readonly classes
  * Disjunctive Normal Form (DNF) Types
  * Allow null, false, and true as stand-alone types
  * New "Random" extension
  * Constants in traits
  * Deprecate dynamic properties
  * for details, see
    https://www.php.net/releases/8.2/en.php
    https://www.php.net/manual/en/migration82.php
- modified patches
  % php-ar-flags.patch (refreshed)
  % php-build-reproducible-phar.patch (refreshed)
  % php-date-regenerate-lexers.patch (refreshed)
  % php-ini.patch (refreshed)
  % php-systzdata-v23.patch (refreshed)
- CVE-2023-3247 [bsc#1212349]</changelog>
  <changelog author="pgajdos@suse.com" date="1689595200">- version update to 8.2.8
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.8
- modified patches
  % php-sort-filelist-phar.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 8.2.9
  * This is a security release.
  * Fixes CVE-2023-3824 [bsc#1214103] and CVE-2023-3823 [bsc#1214106]
  * https://www.php.net/ChangeLog-8.php#8.2.9
- deleted patches
  - php-unicode-allow-redistribution.patch (upstreamed)
- deleted sources
  - repack.sh (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- version update to 8.2.10
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.10</changelog>
  <changelog author="bwiedemann@suse.com" date="1693569601">- Use %make_build macro</changelog>
  <changelog author="pgajdos@suse.com" date="1695729600">- add missing references to rpm changelog
- 15sp4 only:
  [bsc#1200772], [jsc#SLE-24723] add pecl, pear
  [jsc#SLE-23639] version update</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 8.2.11
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.11</changelog>
  <changelog author="pgajdos@suse.com" date="1698321600">- version update to 8.2.12
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.12</changelog>
  <changelog author="pgajdos@suse.com" date="1700827200">- version update to 8.2.13
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.13</changelog>
  <changelog author="pgajdos@suse.com" date="1704196800">- version update to 8.2.14
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.14</changelog>
  <changelog author="pgajdos@suse.com" date="1705579200">- version update to 8.2.15
  * This is a bug fix release.
- modified patches
  % php-ar-flags.patch (refreshed)
  % php-build-reproducible-phar.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1708084800">- version update to 8.2.16
  * This is a bug fix release.
- modified patches
  % php-build-reproducible-phar.patch (refreshed)</changelog>
  <changelog author="pmonreal@suse.com" date="1709726400">- Use the system default cipher list instead of hardcoded values
  by using crypto-policies. [bsc#1211301]
  * Use the --with-system-ciphers configure option.</changelog>
  <changelog author="pgajdos@suse.com" date="1710849600">- version update to 8.2.17
  * This is a bug fix release.</changelog>
  <changelog author="pgajdos@suse.com" date="1712923200">- version update to 8.2.18
  * This is a security release.</changelog>
  <changelog author="pgajdos@suse.com" date="1715256000">- version update to 8.2.19
  * This is a bug fix release.</changelog>
  <changelog author="pgajdos@suse.com" date="1717761600">- version update to 8.2.20
  * This is a security release.</changelog>
</package>
<package pkgid="73b14a08542b8529a0ac94694b6d30b478ccd5e51c3a49478db650b68d3873a6" name="apache2-mod_php8" arch="ppc64le">
  <version epoch="0" ver="8.2.20" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1684843200">- also MIT license (systzdata patch, ext/date/lib/parse_posix.c)
  [https://build.suse.de/request/show/298230]</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- repack the tarball temporarily [bsc#1211648]</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 8.1.20
  * This is a security release.
  * https://www.php.net/ChangeLog-8.php#8.1.20
- force to repack tarball after update
  https://github.com/php/php-src/issues/11300
- session.save_path set to /var/lib/php8/sessions in mod_php8.conf
  and www.conf php-fpm pool example
- modified sources
  % mod_php8.conf
- added sources
  + repack.sh
  + php-unicode-allow-redistribution.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1687435200">- version update to 8.2.7
  * Readonly classes
  * Disjunctive Normal Form (DNF) Types
  * Allow null, false, and true as stand-alone types
  * New "Random" extension
  * Constants in traits
  * Deprecate dynamic properties
  * for details, see
    https://www.php.net/releases/8.2/en.php
    https://www.php.net/manual/en/migration82.php
- modified patches
  % php-ar-flags.patch (refreshed)
  % php-build-reproducible-phar.patch (refreshed)
  % php-date-regenerate-lexers.patch (refreshed)
  % php-ini.patch (refreshed)
  % php-systzdata-v23.patch (refreshed)
- CVE-2023-3247 [bsc#1212349]</changelog>
  <changelog author="pgajdos@suse.com" date="1689595200">- version update to 8.2.8
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.8
- modified patches
  % php-sort-filelist-phar.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 8.2.9
  * This is a security release.
  * Fixes CVE-2023-3824 [bsc#1214103] and CVE-2023-3823 [bsc#1214106]
  * https://www.php.net/ChangeLog-8.php#8.2.9
- deleted patches
  - php-unicode-allow-redistribution.patch (upstreamed)
- deleted sources
  - repack.sh (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- version update to 8.2.10
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.10</changelog>
  <changelog author="bwiedemann@suse.com" date="1693569601">- Use %make_build macro</changelog>
  <changelog author="pgajdos@suse.com" date="1695729600">- add missing references to rpm changelog
- 15sp4 only:
  [bsc#1200772], [jsc#SLE-24723] add pecl, pear
  [jsc#SLE-23639] version update</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 8.2.11
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.11</changelog>
  <changelog author="pgajdos@suse.com" date="1698321600">- version update to 8.2.12
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.12</changelog>
  <changelog author="pgajdos@suse.com" date="1700827200">- version update to 8.2.13
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.13</changelog>
  <changelog author="pgajdos@suse.com" date="1704196800">- version update to 8.2.14
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.14</changelog>
  <changelog author="pgajdos@suse.com" date="1705579200">- version update to 8.2.15
  * This is a bug fix release.
- modified patches
  % php-ar-flags.patch (refreshed)
  % php-build-reproducible-phar.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1708084800">- version update to 8.2.16
  * This is a bug fix release.
- modified patches
  % php-build-reproducible-phar.patch (refreshed)</changelog>
  <changelog author="pmonreal@suse.com" date="1709726400">- Use the system default cipher list instead of hardcoded values
  by using crypto-policies. [bsc#1211301]
  * Use the --with-system-ciphers configure option.</changelog>
  <changelog author="pgajdos@suse.com" date="1710849600">- version update to 8.2.17
  * This is a bug fix release.</changelog>
  <changelog author="pgajdos@suse.com" date="1712923200">- version update to 8.2.18
  * This is a security release.</changelog>
  <changelog author="pgajdos@suse.com" date="1715256000">- version update to 8.2.19
  * This is a bug fix release.</changelog>
  <changelog author="pgajdos@suse.com" date="1717761600">- version update to 8.2.20
  * This is a security release.</changelog>
</package>
<package pkgid="d228c687953c059724e9bdde294f87b18d3ce5efe81e938265791c963d20c268" name="apache2-mod_php8" arch="s390x">
  <version epoch="0" ver="8.2.20" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1684843200">- also MIT license (systzdata patch, ext/date/lib/parse_posix.c)
  [https://build.suse.de/request/show/298230]</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- repack the tarball temporarily [bsc#1211648]</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 8.1.20
  * This is a security release.
  * https://www.php.net/ChangeLog-8.php#8.1.20
- force to repack tarball after update
  https://github.com/php/php-src/issues/11300
- session.save_path set to /var/lib/php8/sessions in mod_php8.conf
  and www.conf php-fpm pool example
- modified sources
  % mod_php8.conf
- added sources
  + repack.sh
  + php-unicode-allow-redistribution.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1687435200">- version update to 8.2.7
  * Readonly classes
  * Disjunctive Normal Form (DNF) Types
  * Allow null, false, and true as stand-alone types
  * New "Random" extension
  * Constants in traits
  * Deprecate dynamic properties
  * for details, see
    https://www.php.net/releases/8.2/en.php
    https://www.php.net/manual/en/migration82.php
- modified patches
  % php-ar-flags.patch (refreshed)
  % php-build-reproducible-phar.patch (refreshed)
  % php-date-regenerate-lexers.patch (refreshed)
  % php-ini.patch (refreshed)
  % php-systzdata-v23.patch (refreshed)
- CVE-2023-3247 [bsc#1212349]</changelog>
  <changelog author="pgajdos@suse.com" date="1689595200">- version update to 8.2.8
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.8
- modified patches
  % php-sort-filelist-phar.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 8.2.9
  * This is a security release.
  * Fixes CVE-2023-3824 [bsc#1214103] and CVE-2023-3823 [bsc#1214106]
  * https://www.php.net/ChangeLog-8.php#8.2.9
- deleted patches
  - php-unicode-allow-redistribution.patch (upstreamed)
- deleted sources
  - repack.sh (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- version update to 8.2.10
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.10</changelog>
  <changelog author="bwiedemann@suse.com" date="1693569601">- Use %make_build macro</changelog>
  <changelog author="pgajdos@suse.com" date="1695729600">- add missing references to rpm changelog
- 15sp4 only:
  [bsc#1200772], [jsc#SLE-24723] add pecl, pear
  [jsc#SLE-23639] version update</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 8.2.11
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.11</changelog>
  <changelog author="pgajdos@suse.com" date="1698321600">- version update to 8.2.12
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.12</changelog>
  <changelog author="pgajdos@suse.com" date="1700827200">- version update to 8.2.13
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.13</changelog>
  <changelog author="pgajdos@suse.com" date="1704196800">- version update to 8.2.14
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.14</changelog>
  <changelog author="pgajdos@suse.com" date="1705579200">- version update to 8.2.15
  * This is a bug fix release.
- modified patches
  % php-ar-flags.patch (refreshed)
  % php-build-reproducible-phar.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1708084800">- version update to 8.2.16
  * This is a bug fix release.
- modified patches
  % php-build-reproducible-phar.patch (refreshed)</changelog>
  <changelog author="pmonreal@suse.com" date="1709726400">- Use the system default cipher list instead of hardcoded values
  by using crypto-policies. [bsc#1211301]
  * Use the --with-system-ciphers configure option.</changelog>
  <changelog author="pgajdos@suse.com" date="1710849600">- version update to 8.2.17
  * This is a bug fix release.</changelog>
  <changelog author="pgajdos@suse.com" date="1712923200">- version update to 8.2.18
  * This is a security release.</changelog>
  <changelog author="pgajdos@suse.com" date="1715256000">- version update to 8.2.19
  * This is a bug fix release.</changelog>
  <changelog author="pgajdos@suse.com" date="1717761600">- version update to 8.2.20
  * This is a security release.</changelog>
</package>
<package pkgid="15d8ce51c9c37fe3e6dc2923e1c1c3b11118278816694003bb727b9cd8036f06" name="apache2-mod_php8" arch="src">
  <version epoch="0" ver="8.2.20" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1684843200">- also MIT license (systzdata patch, ext/date/lib/parse_posix.c)
  [https://build.suse.de/request/show/298230]</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- repack the tarball temporarily [bsc#1211648]</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 8.1.20
  * This is a security release.
  * https://www.php.net/ChangeLog-8.php#8.1.20
- force to repack tarball after update
  https://github.com/php/php-src/issues/11300
- session.save_path set to /var/lib/php8/sessions in mod_php8.conf
  and www.conf php-fpm pool example
- modified sources
  % mod_php8.conf
- added sources
  + repack.sh
  + php-unicode-allow-redistribution.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1687435200">- version update to 8.2.7
  * Readonly classes
  * Disjunctive Normal Form (DNF) Types
  * Allow null, false, and true as stand-alone types
  * New "Random" extension
  * Constants in traits
  * Deprecate dynamic properties
  * for details, see
    https://www.php.net/releases/8.2/en.php
    https://www.php.net/manual/en/migration82.php
- modified patches
  % php-ar-flags.patch (refreshed)
  % php-build-reproducible-phar.patch (refreshed)
  % php-date-regenerate-lexers.patch (refreshed)
  % php-ini.patch (refreshed)
  % php-systzdata-v23.patch (refreshed)
- CVE-2023-3247 [bsc#1212349]</changelog>
  <changelog author="pgajdos@suse.com" date="1689595200">- version update to 8.2.8
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.8
- modified patches
  % php-sort-filelist-phar.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 8.2.9
  * This is a security release.
  * Fixes CVE-2023-3824 [bsc#1214103] and CVE-2023-3823 [bsc#1214106]
  * https://www.php.net/ChangeLog-8.php#8.2.9
- deleted patches
  - php-unicode-allow-redistribution.patch (upstreamed)
- deleted sources
  - repack.sh (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- version update to 8.2.10
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.10</changelog>
  <changelog author="bwiedemann@suse.com" date="1693569601">- Use %make_build macro</changelog>
  <changelog author="pgajdos@suse.com" date="1695729600">- add missing references to rpm changelog
- 15sp4 only:
  [bsc#1200772], [jsc#SLE-24723] add pecl, pear
  [jsc#SLE-23639] version update</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 8.2.11
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.11</changelog>
  <changelog author="pgajdos@suse.com" date="1698321600">- version update to 8.2.12
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.12</changelog>
  <changelog author="pgajdos@suse.com" date="1700827200">- version update to 8.2.13
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.13</changelog>
  <changelog author="pgajdos@suse.com" date="1704196800">- version update to 8.2.14
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.14</changelog>
  <changelog author="pgajdos@suse.com" date="1705579200">- version update to 8.2.15
  * This is a bug fix release.
- modified patches
  % php-ar-flags.patch (refreshed)
  % php-build-reproducible-phar.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1708084800">- version update to 8.2.16
  * This is a bug fix release.
- modified patches
  % php-build-reproducible-phar.patch (refreshed)</changelog>
  <changelog author="pmonreal@suse.com" date="1709726400">- Use the system default cipher list instead of hardcoded values
  by using crypto-policies. [bsc#1211301]
  * Use the --with-system-ciphers configure option.</changelog>
  <changelog author="pgajdos@suse.com" date="1710849600">- version update to 8.2.17
  * This is a bug fix release.</changelog>
  <changelog author="pgajdos@suse.com" date="1712923200">- version update to 8.2.18
  * This is a security release.</changelog>
  <changelog author="pgajdos@suse.com" date="1715256000">- version update to 8.2.19
  * This is a bug fix release.</changelog>
  <changelog author="pgajdos@suse.com" date="1717761600">- version update to 8.2.20
  * This is a security release.</changelog>
</package>
<package pkgid="3cb2f46bbc1e0f9e9889e38318f271a36f1b0df07cece7177253dc5c54db6324" name="apache2-mod_php8" arch="x86_64">
  <version epoch="0" ver="8.2.20" rel="150600.3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1684843200">- also MIT license (systzdata patch, ext/date/lib/parse_posix.c)
  [https://build.suse.de/request/show/298230]</changelog>
  <changelog author="pgajdos@suse.com" date="1685016000">- repack the tarball temporarily [bsc#1211648]</changelog>
  <changelog author="pgajdos@suse.com" date="1685448000">- version update to 8.1.20
  * This is a security release.
  * https://www.php.net/ChangeLog-8.php#8.1.20
- force to repack tarball after update
  https://github.com/php/php-src/issues/11300
- session.save_path set to /var/lib/php8/sessions in mod_php8.conf
  and www.conf php-fpm pool example
- modified sources
  % mod_php8.conf
- added sources
  + repack.sh
  + php-unicode-allow-redistribution.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1687435200">- version update to 8.2.7
  * Readonly classes
  * Disjunctive Normal Form (DNF) Types
  * Allow null, false, and true as stand-alone types
  * New "Random" extension
  * Constants in traits
  * Deprecate dynamic properties
  * for details, see
    https://www.php.net/releases/8.2/en.php
    https://www.php.net/manual/en/migration82.php
- modified patches
  % php-ar-flags.patch (refreshed)
  % php-build-reproducible-phar.patch (refreshed)
  % php-date-regenerate-lexers.patch (refreshed)
  % php-ini.patch (refreshed)
  % php-systzdata-v23.patch (refreshed)
- CVE-2023-3247 [bsc#1212349]</changelog>
  <changelog author="pgajdos@suse.com" date="1689595200">- version update to 8.2.8
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.8
- modified patches
  % php-sort-filelist-phar.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1692705600">- version update to 8.2.9
  * This is a security release.
  * Fixes CVE-2023-3824 [bsc#1214103] and CVE-2023-3823 [bsc#1214106]
  * https://www.php.net/ChangeLog-8.php#8.2.9
- deleted patches
  - php-unicode-allow-redistribution.patch (upstreamed)
- deleted sources
  - repack.sh (not needed)</changelog>
  <changelog author="pgajdos@suse.com" date="1693569600">- version update to 8.2.10
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.10</changelog>
  <changelog author="bwiedemann@suse.com" date="1693569601">- Use %make_build macro</changelog>
  <changelog author="pgajdos@suse.com" date="1695729600">- add missing references to rpm changelog
- 15sp4 only:
  [bsc#1200772], [jsc#SLE-24723] add pecl, pear
  [jsc#SLE-23639] version update</changelog>
  <changelog author="pgajdos@suse.com" date="1695988800">- version update to 8.2.11
  * This is a bug fix release.
  * https://www.php.net/ChangeLog-8.php#8.2.11</changelog>
  <changelog author="pgajdos@suse.com" date="1698321600">- version update to 8.2.12
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.12</changelog>
  <changelog author="pgajdos@suse.com" date="1700827200">- version update to 8.2.13
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.13</changelog>
  <changelog author="pgajdos@suse.com" date="1704196800">- version update to 8.2.14
  * This is a bug fix release.
    https://www.php.net/ChangeLog-8.php#8.2.14</changelog>
  <changelog author="pgajdos@suse.com" date="1705579200">- version update to 8.2.15
  * This is a bug fix release.
- modified patches
  % php-ar-flags.patch (refreshed)
  % php-build-reproducible-phar.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1708084800">- version update to 8.2.16
  * This is a bug fix release.
- modified patches
  % php-build-reproducible-phar.patch (refreshed)</changelog>
  <changelog author="pmonreal@suse.com" date="1709726400">- Use the system default cipher list instead of hardcoded values
  by using crypto-policies. [bsc#1211301]
  * Use the --with-system-ciphers configure option.</changelog>
  <changelog author="pgajdos@suse.com" date="1710849600">- version update to 8.2.17
  * This is a bug fix release.</changelog>
  <changelog author="pgajdos@suse.com" date="1712923200">- version update to 8.2.18
  * This is a security release.</changelog>
  <changelog author="pgajdos@suse.com" date="1715256000">- version update to 8.2.19
  * This is a bug fix release.</changelog>
  <changelog author="pgajdos@suse.com" date="1717761600">- version update to 8.2.20
  * This is a security release.</changelog>
</package>
<package pkgid="6e25bf738b38e53b20a1a7387236a57303328cf6ab6e80bd9dd804f0ccebac08" name="apache2-prefork" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="d2f7a4324cf0ff564a253ce91edc9408bf08ef782c02449b7d6c8532f051af30" name="apache2-prefork" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="7a2414e55a8bebfe4bc736b770381fe8712c7e53d2f98e7b9cd405c33afc6e61" name="apache2-prefork" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="6a34ef30dba324734ea427d327dd3f0710fa2e300f3c6cc08d31dbc439cc748a" name="apache2-prefork" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="5032d2b1b10eb7263d2cfb456986f6a4091f9143b1e367c4f01a12cb58e1fd1f" name="apache2-prefork" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="b85636e6a09996b99f7e7dbe059aafdbd144fc71d3d8eab659f9e1dd96fb9355" name="apache2-prefork" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="0f35ea8c22fe40a7dfd015d6ed5d444da1248155ecc7c8ae252cac9d394759d6" name="apache2-prefork" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="00c11c2bc71f759330642465ce0fba84d6d332f56f5e929ccba31b532276a2f5" name="apache2-prefork" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="91ce02e4d983ff563c4a6c67c6f86bc9f8fe26f41452d77c972cc0baaa01d35b" name="apache2-prefork" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="dd733512bca30fbf80764f997d03c64527cf9712678aa91359fd2c2eeba3e7fd" name="apache2-prefork" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="fe9051e2840ac1fbb49b5eb6d14a5861cc0b883fab63cdc224b6c34188e3cc8f" name="apache2-prefork" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="961496a57bff7a3e6193ee089bd8e56191e7a9d929660c08c69f3115d470eba0" name="apache2-prefork" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="547b2c1738d11d9b8d1af0c77511b03e180f02361c619ad409fbfb8970bf6377" name="apache2-prefork" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="8e0d10659f1d155a4a1c4eb8de6eb444784945b676930cd782898f42ab8d4713" name="apache2-prefork" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="df6c116da89c23ca854349e4fe8e86b3ad5a9197b9669b8c2d33329582d062e6" name="apache2-prefork" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="7c0bd73eff38078e9ebe517417ad5ffc74b04e9a37c4e2575bb9f6a498dc9f54" name="apache2-prefork" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="81a16f77bbdaa0ab9ec37a0fedef5453e2ec4d75a7bf25208819efb2cd9d2da3" name="apache2-prefork" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="cd78c6b4ff51a64591d00e964683ba5092c679a3849504bdc8d3e15a279b83e0" name="apache2-prefork" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="68bb0d8cd8e45293cfcd6cf1281b3a118ed3c6981e95bfe609365de6065cfdb4" name="apache2-prefork" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="ec22b75e50852b2a307de1c6fd0595237abe83b8d674ee20890e2568c5f9cab1" name="apache2-prefork" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="8545bbdf1abe13de15d108aa93282ae0cf16ce442837916df24b1a6e64a26204" name="apache2-prefork" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="4f1b08be218d12b5810272c608636353df165818a3e0967713c3770651a0b70b" name="apache2-prefork" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="40dbb9dff0e317489c38f1487173aa0e7a2b543587be18a62888d73e8136b870" name="apache2-prefork" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="54f207aaacc185b2de481016468ee1803226b17822a99da476c446ee53d5d3e6" name="apache2-prefork" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="d88e39711cbe67e6648bf2e81ac30ba76d68ca0833a8ede79792cf89d2fe160f" name="apache2-prefork" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="5c04e3700eac46695a8fc1221f74caf62b42b9b7cca6df8f304edd02bddec3ca" name="apache2-utils" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="04a8d12875979c7b6718428aa3fb09365dd6bf3752fadebbbf419045ab9b6598" name="apache2-utils" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="44d594709e2351d7d4ec7cb9cdf8e6e42950f91377585559a135995d9534f0db" name="apache2-utils" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="224cf38f7d5359cf0d1549bde2dd70af4c07f135afd2be058fe96d00010db238" name="apache2-utils" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="dfea0b38ec45adfc766b2446e1578289764dd590575ef03d96403cb53eedc423" name="apache2-utils" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="964fbba0c70ac65026a010cff1ceb214cab67a3bdea975258e33c55ba846da32" name="apache2-utils" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="2c7793cf792fcbf1e9c46dca8aa5d5e743c1dd73f247aa5865eedb2372ebed52" name="apache2-utils" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="61458cd8676e14c65953a7faca9528c077bae85248dfaaa160ffa7e7e4eac9cf" name="apache2-utils" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="90f4ba98371e8f1ad39502a6abf3fd33b074152e1711abe8090e4471357cc36b" name="apache2-utils" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="1603e046e45cdf52c413493bbb272c87d2e3a4d5ded15239355e31f8ca4c61a0" name="apache2-utils" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="0d7a2aec0fdb275581845b893302d7a5ee63f1aa437e983510868f88520ea6be" name="apache2-utils" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="48bfcdd0f9ed1860e29f2655397b727c8efe92b86a4b37e648ab4e7e4effdd83" name="apache2-utils" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="ce1c28331a234e0207098878f13f8226adc7cf83964044c5aa692b82deb79316" name="apache2-utils" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="a1af6af59ff36685f4d2c29ee548c30ec00491df26a3a3a540988157c26e8ba5" name="apache2-utils" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="631cb909174aa18e85a20b8a78c84879f0417d57d3cda1872aeb4ccfde3b98f6" name="apache2-utils" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="fbedcf3c24ed930ca224932812bc143d934568ae6a407aa9eaf34bf3ea334b27" name="apache2-utils" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="1e0d00a25ddacc263f6dfbf1c29ddd11353897d8ce62f20d496a0d6dbec418df" name="apache2-utils" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="9fedeff7299705ca16bb250136f2073670c5b3d250b173c721f1358a786766ba" name="apache2-utils" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="28ae75d83b4decfeeb68a6886167cb0eee7aebba8a33f027363841562089a4e7" name="apache2-utils" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="feb27f065f37dc1a607bd2333c2b29f81b2ab3cf8f78d9c8d279b8f86ebd69a1" name="apache2-utils" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="aab3fb1f5cf97de499c27bb61382d7547aba780bf7644d25237383c7df2034f4" name="apache2-utils" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="63068febfc25e1c162aedfb8faf3d1854f0efd9648a4235056728df021fae4f0" name="apache2-utils" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="740e3b92b6fe6daaaca7f0992323ec8b0ff293b6ea366f4ff00de0f085ffe82e" name="apache2-utils" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="9b7c2c4cb2214eb8d35639da88a682a154c9420615b3772c6334a9b0c27a11d4" name="apache2-utils" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="91dc0b9bd759df2c3ca6b61cfa5a10d89a63e7b7cc07bbe475c58e983243b838" name="apache2-utils" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="44935b0644efd1d4b3c12573054ea0e5389ec556dccf79079c94e646c3d0a6dd" name="apache2-worker" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="d7c67bfcf1032e63dd2bbccae358ba5829c6c8d423e2130d45e03e293eded569" name="apache2-worker" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="4b85dc672bce07349c4ceb285fccaa8692a855aade0d2144326fa4d6b19e5843" name="apache2-worker" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="7b5936f6f4e6e87773e4b7a257005e3697dccdfeef74f29e790085a6870b3a43" name="apache2-worker" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="a213bb89087f6ad7a33083ddab40903f9b3889e876b270e0ff2deeadfdc9c86c" name="apache2-worker" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.11.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch</changelog>
</package>
<package pkgid="1aeed45aa3e63fbb675a939cac5ad12fc09d94ce519dc25d22cae365cb5523e7" name="apache2-worker" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="55c6a60e867395e038c3cfe50d35c4238197011836afb6e7d2b7cc92ca14cb35" name="apache2-worker" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="aba8939de85b70c396421af174793c047c6065ed33f6be913d8e631eb232c1ac" name="apache2-worker" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="4c512c6d38bd0a64fec4d91fad90fa8d6318f441473cbeb8412bc69e0b75592f" name="apache2-worker" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="df2cb9c37adc1e0f850a47451cb6e10e39fc9dad756f1dc5706262810f098bf2" name="apache2-worker" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.18.1"/>
  <changelog author="pgajdos@suse.com" date="1654689600">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
</package>
<package pkgid="a3d99b5d822ac834fc9c787c11301454793b1ba3fa592cb0f3b78ca3749fad27" name="apache2-worker" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="3e27dc8e301ca6773f995517f298da845fff3beae19f64785d5824f4adb2e4f3" name="apache2-worker" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="ff601e7a981c7156be8b7c4e7eb6c52cadd3811e5f9b791edb3efe6626add93b" name="apache2-worker" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="4d547be5141f18ca976f59f2ab6961191720373843ea55df719147fed3121240" name="apache2-worker" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="89caeaa159677f59a51497a1ac178ce76fe9042a8cb3bc4a3dda749742ccc070" name="apache2-worker" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.23.1"/>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
  <changelog author="david.anes@suse.com" date="1720440000">- Security fix:
  - CVE-2024-39573, bsc#1227271: potential SSRF in mod_rewrite
  * Added apache2-CVE-2024-39573.patch
  - CVE-2024-38477, bsc#1227270: null pointer dereference in mod_proxy
  * Added apache2-CVE-2024-38477.patch
  - CVE-2024-38475, bsc#1227268: Improper escaping of output in mod_rewrite
  * Added apache2-CVE-2024-38475-1.patch
  * Added apache2-CVE-2024-38475-2.patch
  * Added apache2-CVE-2024-38475-3.patch
  - CVE-2024-38476, bsc#1227269: Server may use exploitable/malicious
  backend application output to run local handlers via internal
  redirect
  * Added apache2-CVE-2024-38476-1.patch
  * Added apache2-CVE-2024-38476-2.patch
  * Added apache2-CVE-2024-38476-3.patch
  * Added apache2-CVE-2024-38476-4.patch
  * Added apache2-CVE-2024-38476-5.patch
  * Added apache2-CVE-2024-38476-6.patch
  * Added apache2-CVE-2024-38476-7.patch
  * Added apache2-CVE-2024-38476-8.patch
  * Added apache2-CVE-2024-38476-9.patch
  * Added apache2-CVE-2024-38476-10.patch
  * Added apache2-CVE-2024-38476-11.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1721217600">- Security fix:
  - CVE-2024-36387, bsc#1227272: DoS by null pointer in websocket over HTTP/2
  * Added apache2-CVE-2024-36387.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1723636800">- Apply fix for CVE-2024-38474, bsc#1227278.
  Patch file added:
  * apache2-CVE-2024-38474.patch
- Apply fix for CVE-2024-38473, bsc#1227276.
  Patch files added:
  * apache2-CVE-2024-38473-1.patch
  * apache2-CVE-2024-38473-2.patch
  * apache2-CVE-2024-38473-3.patch
  * apache2-CVE-2024-38473-4.patch</changelog>
  <changelog author="martin.schreiner@suse.com" date="1724328000">- Apply fix for CVE-2024-39884, bsc#1227353.
  Patch file added:
  * apache2-CVE-2024-39884.patch</changelog>
</package>
<package pkgid="f94099fe6963011f966b7ac44fc46b7d3f1466325cdbcae504616b915c052baa" name="apache2-worker" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="b22d0ef518c74436179935bbccd0aaee109fa51251d71a1eeb48c78fa208c998" name="apache2-worker" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="16ba9c6aacb1f0548c851c96795d0c97b3f6822ee090a92a567776e97fe47ee8" name="apache2-worker" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="483677221d7482734693fa90f4446342e35ad49ae9b6675202a3c7725d6cb6e1" name="apache2-worker" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="d0bff62eb8cbc819354ea996bc05929e6f3e1c4872c07abc22239c890925bf7a" name="apache2-worker" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.3.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- version update to 2.4.53
  * ) SECURITY: CVE-2022-23943: mod_sed: Read/write beyond bounds
    (cve.mitre.org)
    Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
    Server allows an attacker to overwrite heap memory with possibly
    attacker provided data.
    This issue affects Apache HTTP Server 2.4 version 2.4.52 and
    prior versions.
    Credits: Ronald Crane (Zippenhop LLC)
  * ) SECURITY: CVE-2022-22721: core: Possible buffer overflow with
    very large or unlimited LimitXMLRequestBody (cve.mitre.org)
    If LimitXMLRequestBody is set to allow request bodies larger
    than 350MB (defaults to 1M) on 32 bit systems an integer
    overflow happens which later causes out of bounds writes.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Anonymous working with Trend Micro Zero Day Initiative
  * ) SECURITY: CVE-2022-22720: HTTP request smuggling vulnerability
    in Apache HTTP Server 2.4.52 and earlier (cve.mitre.org)
    Apache HTTP Server 2.4.52 and earlier fails to close inbound
    connection when errors are encountered discarding the request
    body, exposing the server to HTTP Request Smuggling
    Credits: James Kettle &lt;james.kettle portswigger.net&gt;
  * ) SECURITY: CVE-2022-22719: mod_lua Use of uninitialized value of
    in r:parsebody (cve.mitre.org)
    A carefully crafted request body can cause a read to a random
    memory area which could cause the process to crash.
    This issue affects Apache HTTP Server 2.4.52 and earlier.
    Credits: Chamal De Silva
  * ) core: Make sure and check that LimitXMLRequestBody fits in system memory.
    [Ruediger Pluem, Yann Ylavic]
  * ) core: Simpler connection close logic if discarding the request body fails.
    [Yann Ylavic, Ruediger Pluem]
  * ) mod_http2: preserve the port number given in a HTTP/1.1
    request that was Upgraded to HTTP/2. Fixes PR65881.
    [Stefan Eissing]
  * ) mod_proxy: Allow for larger worker name.  PR 53218.  [Yann Ylavic]
  * ) dbm: Split the loading of a dbm driver from the opening of a dbm file. When
    an attempt to load a dbm driver fails, log clearly which driver triggered
    the error (not "default"), and what the error was. [Graham Leggett]
  * ) mod_proxy: Use the maxium of front end and backend timeouts instead of the
    minimum when tunneling requests (websockets, CONNECT requests).
    Backend timeouts can be configured more selectively (per worker if needed)
    as front end timeouts and typically the backend timeouts reflect the
    application requirements better.  PR 65886 [Ruediger Pluem]
  * ) ap_regex: Use Thread Local Storage (TLS) to recycle ap_regexec() buffers
    when an efficient TLS implementation is available. [Yann Ylavic]
  * ) core, mod_info: Add compiled and loaded PCRE versions to version
    number display.  [Rainer Jung]
  * ) mod_md: do not interfere with requests to /.well-known/acme-challenge/
    resources if challenge type 'http-01' is not configured for a domain.
    Fixes &lt;https://github.com/icing/mod_md/issues/279&gt;.
    [Stefan Eissing]
  * ) mod_dav: Fix regression when gathering properties which could lead to huge
    memory consumption proportional to the number of resources.
    [Evgeny Kotkov, Ruediger Pluem]
  * ) Support pcre2 (10.x) library in place of the now end-of-life pcre (8.x)
    for regular expression evaluation. This depends on locating pcre2-config.
    [William Rowe, Petr Pisar &lt;ppisar redhat.com&gt;, Rainer Jung]
  * ) Add the ldap function to the expression API, allowing LDAP filters and
    distinguished names based on expressions to be escaped correctly to
    guard against LDAP injection. [Graham Leggett]
  * ) mod_md: the status description in MDomain's JSON, exposed in the
    md-status handler (if configured) did sometimes not carry the correct
    message when certificates needed renew.
    [Stefan Eissing]
  * ) mpm_event: Fix a possible listener deadlock on heavy load when restarting
    and/or reaching MaxConnectionsPerChild.  PR 65769.  [Yann Ylavic]</changelog>
  <changelog author="pgajdos@suse.com" date="1647259201">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
</package>
<package pkgid="c7f57b2674f172891fe2d72f6de2699dbc4bab50ed23220c1cdf64c1e04c2cf5" name="apache2-worker" arch="aarch64">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="a24e08c3e85334d25ddb78ed9e55a659b2a3c596406fca348e9dd8da18a191fe" name="apache2-worker" arch="ppc64le">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="4aef1ef2f7759fb97590af4a21d41e7a1b531867d019bb8180c3c9428a013cf7" name="apache2-worker" arch="s390x">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="f18f1214e2a7ca3d2a39ba681e9418c45e546f4db0a205e0e7e8718ba80bd28c" name="apache2-worker" arch="src">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="8beaac6c86baeea4ea8fca0bcb24efb7307405c0ceee7461f41b88b6c0544ecc" name="apache2-worker" arch="x86_64">
  <version epoch="0" ver="2.4.58" rel="150600.5.6.1"/>
  <changelog author="pgajdos@suse.com" date="1647259200">- httpd-framework updated to svn1898917
- deleted patches
  - apache-test-DirectorySlash-NotFound-logic.patch (upstreamed)
  - apache2-perl-io-socket.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689600">- version update to 2.4.54
  Changes with Apache 2.4.54
  * ) SECURITY: CVE-2022-31813: mod_proxy X-Forwarded-For dropped by
    hop-by-hop mechanism (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may not send the
    X-Forwarded-* headers to the origin server based on client side
    Connection header hop-by-hop mechanism.
    This may be used to bypass IP based authentication on the origin
    server/application.
    Credits: The Apache HTTP Server project would like to thank
    Gaetan Ferry (Synacktiv) for reporting this issue
  * ) SECURITY: CVE-2022-30556: Information Disclosure in mod_lua with
    websockets (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may return lengths to
    applications calling r:wsread() that point past the end of the
    storage allocated for the buffer.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-30522: mod_sed denial of service
    (cve.mitre.org)
    If Apache HTTP Server 2.4.53 is configured to do transformations
    with mod_sed in contexts where the input to mod_sed may be very
    large, mod_sed may make excessively large memory allocations and
    trigger an abort.
    Credits: This issue was found by Brian Moussalli from the JFrog
    Security Research team
  * ) SECURITY: CVE-2022-29404: Denial of service in mod_lua
    r:parsebody (cve.mitre.org)
    In Apache HTTP Server 2.4.53 and earlier, a malicious request to
    a lua script that calls r:parsebody(0) may cause a denial of
    service due to no default limit on possible input size.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28615: Read beyond bounds in
    ap_strcmp_match() (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier may crash or disclose
    information due to a read beyond bounds in ap_strcmp_match()
    when provided with an extremely large input buffer.  While no
    code distributed with the server can be coerced into such a
    call, third-party modules or lua scripts that use
    ap_strcmp_match() may hypothetically be affected.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28614: read beyond bounds via ap_rwrite()
    (cve.mitre.org)
    The ap_rwrite() function in Apache HTTP Server 2.4.53 and
    earlier may read unintended memory if an attacker can cause the
    server to reflect very large input using ap_rwrite() or
    ap_rputs(), such as with mod_luas r:puts() function.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-28330: read beyond bounds in mod_isapi
    (cve.mitre.org)
    Apache HTTP Server 2.4.53 and earlier on Windows may read beyond
    bounds when configured to process requests with the mod_isapi
    module.
    Credits: The Apache HTTP Server project would like to thank
    Ronald Crane (Zippenhop LLC) for reporting this issue
  * ) SECURITY: CVE-2022-26377: mod_proxy_ajp: Possible request
    smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    Credits: Ricter Z @ 360 Noah Lab
  * ) mod_ssl: SSLFIPS compatible with OpenSSL 3.0.  PR 66063.
    [Petr Sumbera &lt;petr.sumbera oracle.com&gt;, Yann Ylavic]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) mod_md:  a bug was fixed that caused very large MDomains
    with the combined DNS names exceeding ~7k to fail, as
    request bodies would contain partially wrong data from
    uninitialized memory. This would have appeared as failure
    in signing-up/renewing such configurations.
    [Stefan Eissing, Ronald Crane (Zippenhop LLC)]
  * ) mod_proxy_http: Avoid 417 responses for non forwardable 100-continue.
    PR 65666.  [Yann Ylavic]
  * ) MPM event: Restart children processes killed before idle maintenance.
    PR 65769.  [Yann Ylavic, Ruediger Pluem]
  * ) ab: Allow for TLSv1.3 when the SSL library supports it.
    [abhilash1232 gmail.com, xiaolongx.jiang intel.com, Yann Ylavic]
  * ) core: Disable TCP_NOPUSH optimization on OSX since it might introduce
    transmission delays.  PR 66019.  [Yann Ylavic]
  * ) MPM event: Fix accounting of active/total processes on ungraceful restart,
    PR 66004 (follow up to PR 65626 from 2.4.52).  [Yann Ylavic]
  * ) core: make ap_escape_quotes() work correctly on strings
    with more than MAX_INT/2 characters, counting quotes double.
    Credit to &lt;generalbugs@zippenhop.com&gt; for finding this.
    [Stefan Eissing]
  * ) mod_md: the `MDCertificateAuthority` directive can take more than one URL/name of
    an ACME CA. This gives a failover for renewals when several consecutive attempts
    to get a certificate failed.
    A new directive was added: `MDRetryDelay` sets the delay of retries.
    A new directive was added: `MDRetryFailover` sets the number of errored
    attempts before an alternate CA is selected for certificate renewals.
    [Stefan Eissing]
  * ) mod_http2: remove unused and insecure code. Fixes PR66037.
    Thanks to Ronald Crane (Zippenhop LLC) for reporting this.
    [Stefan Eissing]
  * ) mod_proxy: Add backend port to log messages to
    ease identification of involved service.  [Rainer Jung]
  * ) mod_http2: removing unscheduling of ongoing tasks when
    connection shows potential abuse by a client. This proved
    counter-productive and the abuse detection can false flag
    requests using server-side-events.
    Fixes &lt;https://github.com/icing/mod_h2/issues/231&gt;.
    [Stefan Eissing]
  * ) mod_md: Implement full auto status ("key: value" type status output).
    Especially not only status summary counts for certificates and
    OCSP stapling but also lists. Auto status format is similar to
    what was used for mod_proxy_balancer.
    [Rainer Jung]
  * ) mod_md: fixed a bug leading to failed transfers for OCSP
    stapling information when more than 6 certificates needed
    updates in the same run.  [Stefan Eissing]
  * ) mod_proxy: Set a status code of 502 in case the backend just closed the
    connection in reply to our forwarded request.  [Ruediger Pluem]
  * ) mod_md: a possible NULL pointer deref was fixed in
    the JSON code for persisting time periods (start+end).
    Fixes #282 on mod_md's github.
    Thanks to @marcstern for finding this.  [Stefan Eissing]
  * ) mod_heartmonitor: Set the documented default value
    "10" for HeartbeatMaxServers instead of "0". With "0"
    no shared memory slotmem was initialized.  [Rainer Jung]
  * ) mod_md: added support for managing certificates via a
    local tailscale daemon for users of that secure networking.
    This gives trusted certificates for tailscale assigned
    domain names in the *.ts.net space.
    [Stefan Eissing]
- modified patches
  % apache-test-application-xml-type.patch (refreshed)
  % apache-test-turn-off-variables-in-ssl-var-lookup.patch (refreshed)
  % apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1654689601">- update httpd-framework to svn revision 1898917</changelog>
  <changelog author="schubi@intern" date="1656417600">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="david.anes@suse.com" date="1663675200">- Remove references to README.QUICKSTART and point them to
  https://en.opensuse.org/SDB:Apache_installation (bsc#1203573)</changelog>
  <changelog author="coolo@suse.com" date="1663934400">- The 2.4.54 release brought support for PCRE2, but for that we also
  need to change buildrequires to pcre2-devel</changelog>
  <changelog author="dmueller@suse.com" date="1670846400">- switch to pkgconfig(zlib) so that alternative providers can be
  used</changelog>
  <changelog author="david.anes@suse.com" date="1674043200">- This update fixes the following security issues:
  * CVE-2022-37436 [bsc#1207251], mod_proxy backend HTTP response splitting
  * CVE-2022-36760 [bsc#1207250], mod_proxy_ajp Possible request smuggling
  * CVE-2006-20001 [bsc#1207247], mod_dav out of bounds read, or write of zero byte
- Update to 2.4.55:
  * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to
    2.4.55 allows a backend to trigger HTTP response splitting
    (cve.mitre.org)
    Prior to Apache HTTP Server 2.4.55, a malicious backend can
    cause the response headers to be truncated early, resulting in
    some headers being incorporated into the response body. If the
    later headers have any security purpose, they will not be
    interpreted by the client.
    Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer)
  * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp
    Possible request smuggling (cve.mitre.org)
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server
    allows an attacker to smuggle requests to the AJP server it
    forwards requests to.  This issue affects Apache HTTP Server
    Apache HTTP Server 2.4 version 2.4.54 and prior versions.
    Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec
    at Qi'anxin Group
  * ) SECURITY: CVE-2006-20001: mod_dav out of  bounds read, or write
    of zero byte (cve.mitre.org)
    A carefully crafted If: request header can cause a memory read,
    or write of a single zero byte, in a pool (heap) memory location
    beyond the header value sent. This could cause the process to
    crash.
    This issue affects Apache HTTP Server 2.4.54 and earlier.
  * ) mod_dav: Open the lock database read-only when possible.
    PR 36636 [Wilson Felipe &lt;wfelipe gmail.com&gt;, manu]
  * ) mod_proxy_http2: apply the standard httpd content type handling
    to responses from the backend, as other proxy modules do. Fixes PR 66391.
    Thanks to Jérôme Billiras for providing the patch.
    [Stefan Eissing]
  * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981
    [Basant Kumar Kukreja &lt;basant.kukreja sun.com&gt;, Alejandro Alvarez
    &lt;alejandro.alvarez.ayllon cern.ch&gt;]
  * ) mod_proxy_hcheck: Honor worker timeout settings.  [Yann Ylavic]
  * ) mod_http2: version 2.0.10 of the module, synchronizing changes
    with the gitgub version. This is a partial rewrite of how connections
    and streams are handled.
  - an APR pollset and pipes (where supported) are used to monitor
    the main connection and react to IO for request/response handling.
    This replaces the stuttered timed waits of earlier versions.
  - H2SerializeHeaders directive still exists, but has no longer an effect.
  - Clients that seemingly misbehave still get less resources allocated,
    but ongoing requests are no longer disrupted.
  - Fixed an issue since 1.15.24 that "Server" headers in proxied requests
    were overwritten instead of preserved. [PR by @daum3ns]
  - A regression in v1.15.24 was fixed that could lead to httpd child
    processes not being terminated on a graceful reload or when reaching
    MaxConnectionsPerChild. When unprocessed h2 requests were queued at
    the time, these could stall. See #212.
  - Improved information displayed in 'server-status' for H2 connections when
    Extended Status is enabled. Now one can see the last request that IO
    operations happened on and transferred IO stats are updated as well.
  - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection
    send a GOAWAY frame much too early on new connections, leading to invalid
    protocol state and a client failing the request. See PR65731 at
    &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=65731&gt;.
    The module now initializes the HTTP/2 protocol correctly and allows the
    client to submit one request before the shutdown via a GOAWAY frame
    is being announced.
  - :scheme pseudo-header values, not matching the
    connection scheme, are forwarded via absolute uris to the
    http protocol processing to preserve semantics of the request.
    Checks on combinations of pseudo-headers values/absence
    have been added as described in RFC 7540. Fixes #230.
  - A bug that prevented trailers (e.g. HEADER frame at the end) to be
    generated in certain cases was fixed. See #233 where it prevented
    gRPC responses to be properly generated.
  - Request and response header values are automatically stripped of leading
    and trialing space/tab characters. This is equivalent behaviour to what
    Apache httpd's http/1.1 parser does.
    The checks for this in nghttp2 v1.50.0+ are disabled.
  - Extensive testing in production done by Alessandro Bianchi (@alexskynet)
    on the v2.0.x versions for stability. Many thanks!
  * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when
    request ':authority' is known. Improved test case that did not catch that
    the previous 'fix' was incorrect.
  * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests
    using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski]
  * ) mod_proxy: The AH03408 warning for a forcibly closed backend
    connection is now logged at INFO level.  [Yann Ylavic]
  * ) mod_ssl: When dumping the configuration, the existence of
    certificate/key files is no longer tested.  [Joe Orton]
  * ) mod_authn_core: Add expression support to AuthName and AuthType.
    [Graham Leggett]
  * ) mod_ssl: when a proxy connection had handled a request using SSL, an
    error was logged when "SSLProxyEngine" was only configured in the
    location/proxy section and not the overall server. The connection
    continued to work, the error log was in error. Fixed PR66190.
    [Stefan Eissing]
  * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300.
    [Alessandro Cavaliere &lt;alessandro.cavalier7 unibo.it&gt;]
  * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
  * ) mod_md: a new directive `MDStoreLocks` can be used on cluster
    setups with a shared file system for `MDStoreDir` to order
    activation of renewed certificates when several cluster nodes are
    restarted at the same time. Store locks are not enabled by default.
    Restored curl_easy cleanup behaviour from v2.4.14 and refactored
    the use of curl_multi for OCSP requests to work with that.
    Fixes &lt;https://github.com/icing/mod_md/issues/293&gt;.
  * ) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
    [Ruediger Pluem]
  * ) mod_heartmonitor: Allow "HeartbeatMaxServers 0" to use file based
    storage instead of slotmem. Needed after setting
    HeartbeatMaxServers default to the documented value 10 in 2.4.54.
    PR 66131.  [Jérôme Billiras]
  * ) mod_dav: DAVlockDiscovery option to disable WebDAV lock discovery
    This is a game changer for performances if client use PROPFIND a lot,
    PR 66313. [Emmanuel Dreyfus]</changelog>
  <changelog author="david.anes@suse.com" date="1678276800">- This update fixes the following security issues:
  * CVE-2023-27522 [bsc#1209049]: mod_proxy_uwsgi HTTP response splitting
  * CVE-2023-25690 [bsc#1209047]: HTTP request splitting with mod_rewrite and mod_proxy
- Update to 2.4.56:
  * ) rotatelogs: Add -T flag to allow subsequent rotated logfiles to be
    truncated without the initial logfile being truncated.  [Eric Covener]
  * ) mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to
    allow connections of any age to be reused. Up to now, a negative value
    was handled as an error when parsing the configuration file.  PR 66421.
    [nailyk &lt;bzapache nailyk.fr&gt;, Christophe Jaillet]
  * ) mod_proxy_ajp: Report an error if the AJP backend sends an invalid number
    of headers. [Ruediger Pluem]
  * ) mod_md:
  - Enabling ED25519 support and certificate transparency information when
    building with libressl v3.5.0 and newer. Thanks to Giovanni Bechis.
  - MDChallengeDns01 can now be configured for individual domains.
    Thanks to Jérôme Billiras (@bilhackmac) for the initial PR.
  - Fixed a bug found by Jérôme Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
    [Stefan Eissing]
  * ) mod_http2: client resets of HTTP/2 streams led to unwanted 500 errors
    reported in access logs and error documents. The processing of the
    reset was correct, only unneccesary reporting was caused.
    [Stefan Eissing]
  * ) mod_proxy_uwsgi: Stricter backend HTTP response parsing/validation.
    [Yann Ylavic]</changelog>
  <changelog author="suse+build@de-korte.org" date="1680868800">- Update to 2.4.57:
  * ) mod_proxy: Check before forwarding that a nocanon path has not been
    rewritten with spaces during processing.  [Yann Ylavic]
  * ) mod_proxy: In case that AllowEncodedSlashes is set to NoDecode do not
    double encode encoded slashes in the URL sent by the reverse proxy to the
    backend. [Ruediger Pluem]
  * ) mod_http2: fixed a crash during connection termination. See PR 66539.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a 2.4.56 regression for substitutions ending
    in a question mark. PR66547. [Eric Covener]
  * ) mod_rewrite: Add "BCTLS" and "BNE" RewriteRule flags. Re-allow encoded
    characters on redirections without the "NE" flag.
    [Yann Ylavic, Eric Covener]
  * ) mod_proxy: Fix double encoding of the uri-path of the request forwarded
    to the origin server, when using mapping=encoded|servlet.  [Yann Ylavic]
  * ) mod_mime: Do not match the extention against possible query string
    parameters in case ProxyPass was used with the nocanon option.
    [Ruediger Pluem]</changelog>
  <changelog author="opensuse@dstoecker.de" date="1691236800">- Enable building of mod_md</changelog>
  <changelog author="david.anes@suse.com" date="1697716800">- Update to 2.4.58:
  * ) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
    memory not reclaimed right away on RST (cve.mitre.org)
    When a HTTP/2 stream was reset (RST frame) by a client, there
    was a time window were the request's memory resources were not
    reclaimed immediately. Instead, de-allocation was deferred to
    connection close. A client could send new requests and resets,
    keeping the connection busy and open and causing the memory
    footprint to keep on growing. On connection close, all resources
    were reclaimed, but the process might run out of memory before
    that.
    This was found by the reporter during testing of CVE-2023-44487
    (HTTP/2 Rapid Reset Exploit) with their own test client. During
    "normal" HTTP/2 use, the probability to hit this bug is very
    low. The kept memory would not become noticeable before the
    connection closes or times out.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Will Dormann of Vul Labs
  * ) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
    initial windows size 0 (cve.mitre.org)
    An attacker, opening a HTTP/2 connection with an initial window
    size of 0, was able to block handling of that connection
    indefinitely in Apache HTTP Server. This could be used to
    exhaust worker resources in the server, similar to the well
    known "slow loris" attack pattern.
    This has been fixed in version 2.4.58, so that such connection
    are terminated properly after the configured connection timeout.
    This issue affects Apache HTTP Server: from 2.4.55 through
    2.4.57.
    Users are recommended to upgrade to version 2.4.58, which fixes
    the issue.
    Credits: Prof. Sven Dietrich (City University of New York)
  * ) SECURITY: CVE-2023-31122: mod_macro buffer over-read
    (cve.mitre.org)
    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
    Server.This issue affects Apache HTTP Server: through 2.4.57.
    Credits: David Shoon (github/davidshoon)
  * ) mod_ssl: Silence info log message "SSL Library Error: error:0A000126:
    SSL routines::unexpected eof while reading" when using
    OpenSSL 3 by setting SSL_OP_IGNORE_UNEXPECTED_EOF if
    available. [Rainer Jung]
  * ) mod_http2: improved early cleanup of streams.
    [Stefan Eissing]
  * ) mod_proxy_http2: improved error handling on connection errors while
    response is already underway.
    [Stefan Eissing]
  * ) mod_http2: fixed a bug that could lead to a crash in main connection
    output handling. This occured only when the last request on a HTTP/2
    connection had been processed and the session decided to shut down.
    This could lead to an attempt to send a final GOAWAY while the previous
    write was still in progress. See PR 66646.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix `X-Forward-Host` header to carry the correct value.
    Fixes PR66752.
    [Stefan Eissing]
  * ) mod_http2: added support for bootstrapping WebSockets via HTTP/2, as
    described in RFC 8441. A new directive 'H2WebSockets on|off' has been
    added. The feature is by default not enabled.
    As also discussed in the manual, this feature should work for setups
    using "ProxyPass backend-url upgrade=websocket" without further changes.
    Special server modules for WebSockets will have to be adapted,
    most likely, as the handling if IO events is different with HTTP/2.
    HTTP/2 WebSockets are supported on platforms with native pipes. This
    excludes Windows.
    [Stefan Eissing]
  * ) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
    in OCSP stapling. PR 66672. [Frank Meier &lt;frank.meier ergon.ch&gt;, covener]
  * ) mod_http2: fixed a bug in flushing pending data on an already closed
    connection that could lead to a busy loop, preventing the HTTP/2 session
    to close down successfully. Fixed PR 66624.
    [Stefan Eissing]
  * ) mod_http2: v2.0.15 with the following fixes and improvements
  - New directive 'H2EarlyHint name value' to add headers to a response,
    picked up already when a "103 Early Hints" response is sent. 'name' and
    'value' must comply to the HTTP field restrictions.
    This directive can be repeated several times and header fields of the
    same names add. Sending a 'Link' header with 'preload' relation will
    also cause a HTTP/2 PUSH if enabled and supported by the client.
  - Fixed an issue where requests were not logged and accounted in a timely
    fashion when the connection returns to "keepalive" handling, e.g. when
    the request served was the last outstanding one.
    This led to late appearance in access logs with wrong duration times
    reported.
  - Accurately report the bytes sent for a request in the '%O' Log format.
    This addresses #203, a long outstanding issue where mod_h2 has reported
    numbers over-eagerly from internal buffering and not what has actually
    been placed on the connection.
    The numbers are now the same with and without H2CopyFiles enabled.
    [Stefan Eissing]
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
    [Stefan Eissing]
  * ) mod_rewrite: Add server directory to include path as mod_rewrite requires
    test_char.h. PR 66571 [Valeria Petrov &lt;valeria.petrov@spinetix.com&gt;]
  * ) mod_http2: new directive `H2ProxyRequests on|off` to enable handling
    of HTTP/2 requests in a forward proxy configuration.
    General forward proxying is enabled via `ProxyRequests`. If the
    HTTP/2 protocol is also enabled for such a server/host, this new
    directive is needed in addition.
    [Stefan Eissing]
  * ) core: Updated conf/mime.types:
  - .js moved from 'application/javascript' to 'text/javascript'
  - .mjs was added as 'text/javascript'
  - add .opus ('audio/ogg')
  - add 'application/vnd.geogebra.slides'
  - add WebAssembly MIME types and extension
    [Mathias Bynens &lt;@mathiasbynens&gt; via PR 318,
    Richard de Boer &lt;richard tubul.net&gt;, Dave Hodder &lt;dmh dmh.org.uk&gt;,
    Zbynek Konecny &lt;zbynek1729 gmail.com&gt;]
  * ) mod_proxy_http2: fixed using the wrong "bucket_alloc" from the backend
    connection when sending data on the frontend one. This caused crashes
    or infinite loops in rare situations.
  * ) mod_proxy_http2: fixed a bug in retry/response handling that could lead
    to wrong status codes or HTTP messages send at the end of response bodies
    exceeding the announced content-length.
  * ) mod_proxy_http2: fix retry handling to not leak temporary errors.
    On detecting that that an existing connection was shutdown by the other
    side, a 503 response leaked even though the request was retried on a
    fresh connection.
  * ) mod_http2: fixed a bug that did cleanup of consumed and pending buckets in
    the wrong order when a bucket_beam was destroyed.
    [Stefan Eissing]
  * ) mod_http2: avoid double chunked-encoding on internal redirects.
    PR 66597 [Yann Ylavic, Stefan Eissing]
  * ) mod_http2: Fix reporting of `Total Accesses` in server-status to not count
    HTTP/2 requests twice. Fixes PR 66801.
    [Stefan Eissing]
  * ) mod_ssl: Fix handling of Certificate Revoked messages
    in OCSP stapling. PR 66626. [&lt;gmoniker gmail.com&gt;]
  * ) mod_http2: fixed a bug in handling of stream timeouts.
    [Stefan Eissing]
  * ) mod_tls: updating to rustls-ffi version 0.9.2 or higher.
    Checking in configure for proper version installed. Code
    fixes for changed clienthello member name.
    [Stefan Eissing]
  * ) mod_md:
  - New directive `MDMatchNames all|servernames` to allow more control over how
    MDomains are matched to VirtualHosts.
  - New directive `MDChallengeDns01Version`. Setting this to `2` will provide
    the command also with the challenge value on `teardown` invocation. In version
    1, the default, only the `setup` invocation gets this parameter.
    Refs #312. Thanks to @domrim for the idea.
  - For Managed Domain in "manual" mode, the checks if all used ServerName and
    ServerAlias are part of the MDomain now reports a warning instead of an error
    (AH10040) when not all names are present.
  - MDChallengeDns01 can now be configured for individual domains.
    Using PR from JÃ©rÃ´me Billiras (@bilhackmac) and adding test case and fixing proper working
  - Fixed a bug found by JÃ©rÃ´me Billiras (@bilhackmac) that caused the challenge
    teardown not being invoked as it should.
  * ) mod_ldap: Avoid performance overhead of APR-util rebind cache for
    OpenLDAP 2.2+.  PR 64414.  [Joe Orton]
  * ) mod_http2: new directive 'H2MaxDataFrameLen n' to limit the maximum
    amount of response body bytes put into a single HTTP/2 DATA frame.
    Setting this to 0 places no limit (but the max size allowed by the
    protocol is observed).
    The module, by default, tries to use the maximum size possible, which is
    somewhat around 16KB. This sets the maximum. When less response data is
    available, smaller frames will be sent.
  * ) mod_md: fixed passing of the server environment variables to programs
    started via MDMessageCmd and MDChallengeDns01 on *nix system.
    See &lt;https://github.com/icing/mod_md/issues/319&gt;.
    [Stefan Eissing]
  * ) mod_dav: Add DavBasePath directive to configure the repository root
    path.  PR 35077.  [Joe Orton]
  * ) mod_alias: Add AliasPreservePath directive to map the full
    path after the alias in a location. [Graham Leggett]
  * ) mod_alias: Add RedirectRelative to allow relative redirect targets to be
    issued as-is. [Eric Covener, Graham Leggett]
  * ) core: Add formats %{z} and %{strftime-format} to ErrorLogFormat, and make
    sure that if the format is configured early enough it applies to every log
    line.  PR 62161.  [Yann Ylavic]
  * ) mod_deflate: Add DeflateAlterETag to control how the ETag
    is modified. The 'NoChange' parameter mimics 2.2.x behavior.
    PR 45023, PR 39727. [Eric Covener]
  * ) core: Optimize send_brigade_nonblocking(). [Yann Ylavic, Christophe Jaillet]
  * ) mod_status: Remove duplicate keys "BusyWorkers" and "IdleWorkers".
    Resolve inconsistency between the previous two occurrences by
    counting workers in state SERVER_GRACEFUL no longer as busy,
    but instead in a new counter "GracefulWorkers" (or on HTML
    view as "workers gracefully restarting"). Also add the graceful
    counter as a new column to the existing HTML per process table
    for async MPMs. PR 63300. [Rainer Jung]</changelog>
  <changelog author="dmueller@suse.com" date="1706529600">- use grep -E for egrep</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1710763200">- SLE-only: forward-port gensslcert change to generate dhparams certificate
  using a valid FIPS method (bsc#1198913)</changelog>
  <changelog author="eugenio.paolantonio@suse.com" date="1711108800">- SLE-only: forward-port compatibility symlinks (e.g. httpd2-prefork,
  apache2ctl, htpasswd2) change, including the relative
  manpages (bsc#1221880)</changelog>
  <changelog author="david.anes@suse.com" date="1711627200">- Add patches to improve FIPS compatibility (bsc#1220681):
  * apache2-fips-compatibility-01.patch
  * apache2-fips-compatibility-02.patch
  * apache2-fips-compatibility-03.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1716897600">- security update
- added patches
  fix CVE-2023-38709 [bsc#1222330], HTTP response splitting
  + apache2-CVE-2023-38709.patch
  fix CVE-2024-24795 [bsc#1222332], HTTP Response Splitting in multiple modules
  + apache2-CVE-2024-24795.patch
  fix CVE-2024-27316 [bsc#1221401], HTTP/2 CONTINUATION frames can be utilized for DoS attacks
  + apache2-CVE-2024-27316.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718280000">- added patches [bsc#1226217]
  https://github.com/apache/httpd/pull/444/commits/c2fffd29b0f58bdc9caaaff4fec68e17a676f182
  + apache2-issue-444.patch</changelog>
</package>
<package pkgid="fc9b9fc24bb3c8fff08cf7b52ddaa492c061a502399ae3b20d999e5d62ff687a" name="apiguardian" arch="noarch">
  <version epoch="0" ver="1.1.2" rel="150200.3.10.2"/>
  <changelog author="fstrba@suse.com" date="1549022400">- Initial package of apiguardian 1.0.0
- Add apiguardian-build.xml file to be able to build with ant</changelog>
  <changelog author="fstrba@suse.com" date="1648036800">- Build with java source and target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1714392000">- Upgrade to upstream version 1.1.2
  * Fixes:
    + Javadoc 1.8 cannot link to the published 1.1.0 API
    documentation
    + Add LICENSE/NOTICE to the generated jar
    + Allow @API to be declared at the package level
    + Explain usage of Status.DEPRECATED
    + Include OSGi metadata in manifest</changelog>
</package>
<package pkgid="283dd182aa308409de99fccc4d51b4988349ecd4c488a43a99ce7c43cb9207d8" name="apiguardian" arch="src">
  <version epoch="0" ver="1.1.2" rel="150200.3.10.2"/>
  <changelog author="fstrba@suse.com" date="1549022400">- Initial package of apiguardian 1.0.0
- Add apiguardian-build.xml file to be able to build with ant</changelog>
  <changelog author="fstrba@suse.com" date="1648036800">- Build with java source and target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1714392000">- Upgrade to upstream version 1.1.2
  * Fixes:
    + Javadoc 1.8 cannot link to the published 1.1.0 API
    documentation
    + Add LICENSE/NOTICE to the generated jar
    + Allow @API to be declared at the package level
    + Explain usage of Status.DEPRECATED
    + Include OSGi metadata in manifest</changelog>
</package>
<package pkgid="44935e5b916c34db94ad9fa5722477964718e7f97a1c4c800d4ef65bcce70b14" name="apiguardian-javadoc" arch="noarch">
  <version epoch="0" ver="1.1.2" rel="150200.3.10.2"/>
  <changelog author="fstrba@suse.com" date="1549022400">- Initial package of apiguardian 1.0.0
- Add apiguardian-build.xml file to be able to build with ant</changelog>
  <changelog author="fstrba@suse.com" date="1648036800">- Build with java source and target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1714392000">- Upgrade to upstream version 1.1.2
  * Fixes:
    + Javadoc 1.8 cannot link to the published 1.1.0 API
    documentation
    + Add LICENSE/NOTICE to the generated jar
    + Allow @API to be declared at the package level
    + Explain usage of Status.DEPRECATED
    + Include OSGi metadata in manifest</changelog>
</package>
<package pkgid="6b0f25843e6cae3ebb1bda35f21097aac26506b2b5c5a83584b418ac1e49d8a1" name="appstream-qt5-devel" arch="aarch64">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="e5eef23dcd1f4e94054faa06d39ec0b003e574c2923717655c8836136f7693c0" name="appstream-qt5-devel" arch="ppc64le">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="fc4c5f6165eafc37ec6ca27f582237da496c4108024ef9b7b47073ff690f956f" name="appstream-qt5-devel" arch="s390x">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="009c48ce15bf1fc2374bb6f9362cf074e3cbb4873cad54f63607bc9226027d4b" name="appstream-qt5-devel" arch="x86_64">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="1f7799cc1f15a8af7a3f3dc592da2fc988b84537a5ccdb197a7e2c82e83ec538" name="appstream-qt6-devel" arch="aarch64">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="5f94174d857d56db7c4d03ce41eb91e8712b78e17cf57e845b56e78469b0d94c" name="appstream-qt6-devel" arch="ppc64le">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="3aeba54c2c206d73e575598b3710e1632c7ef3633b4c41ba3d77ca5a62f9a995" name="appstream-qt6-devel" arch="s390x">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="a67f3e67205a21957ce0b0cf5007c8d2729d9b5b3d7b654edf3dcab485dcac2c" name="appstream-qt6-devel" arch="x86_64">
  <version epoch="0" ver="1.0.2" rel="150600.3.2.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1673611200">- Use %ldconfig_scriptlets. Leap 15.3 is out of maintenance.</changelog>
  <changelog author="luna.dragon@suse.com" date="1675512000">- Update to version 0.16.0:
  * Features:
    + pool: Offer API to look up components by bundles
    + Bump format version to 0.16
    + Add new AsSystemInfo to read information about the current OS and device
    + Add helper to get device names from a modalias
    + Implement support for external release metadata
    + Add validation support for external release metadata
    + compose: Validate external release metadata used for the catalog as well
    + its: Add rule for standalone release metadata
    + Add function to test if an AsRelation is satisfied on the current system
    + cli: Add command to list category contents
    + cli: Display colored checkmarks if possible
    + cli: Add new is-satisfied check to test relations from the command-line
    + cli: Add Markdown export support for metainfo-to-news
    + qt: Add support for SystemInfo &amp; relation satisfication checks
  * Specification:
    + spec: Specify a metadata format for external release descriptions
  * Bugfixes:
    + Fix build with Clang 15
    + Give a better error message if trying to list too many categories
    + Adjust documentation of AsPool.get_components_by_categories to reflect reality
    + validator: Validate merge component catalog data properly again
  * Miscellaneous:
    + Consistently name catalog metadata as such everywhere
- Update support-meson0.59.patch for latest version of AppStream
- Build AppStream with compose support as a separate package.</changelog>
  <changelog author="fvogt@suse.com" date="1677585600">- Update to version 0.16.1:
  Specification:
  * docs: Clarify the locations where catalog icons should be placed
  * spec: Expand documentation for &lt;issue&gt; elements
  * spec: Mention that &lt;issues&gt; is not part of the description
  * spec: Give some guidance about tone in release descriptions
  Bugfixes:
  * Fix binding helper macro to behave correctly if a function is passed directly
  * Override-merge icons and provided items correctly
  * tests: Ensure locale is C.UTF-8 in pool tests
  Miscellaneous:
  * release: Add sanity checks at beginning of each function
- Add ldconfig_scriptlets for libappstream-compose</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1678708800">- Add upstream fix for new glib-2.76:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch</changelog>
  <changelog author="jsrain@suse.com" date="1684756800">- refresh patch for new glib-2.76 from upstream</changelog>
  <changelog author="christophe@krop.fr" date="1685707200">- Update to 0.16.2:
  Features:
  * Add API for asking whether the pool is empty
  * Add DDE to known desktop-environment list
  * validator: Check if Release Description is inside description tag
  * Make AppStream use BCP47 for locale in XML data
  Bugfixes:
  * Add missing standard::is-hidden attribute to file search enumerator
  * spdx: Accept brackets in spdx license expression check
  * introspection: Bring back AS_FORMAT_STYLE_COLLECTION into its enum
  * compose: Fix crash in asc_l10n_search_translations_qt()
  * compose: Set lower-cased CID for synthesized components again
  * Don't crash when non-YAML documents are read as YAML
  Miscellaneous:
  * sanitizers: Allow null-dereference check again
- Drop patch, merged upstream:
  * bfa8fa6ac4ef645368a93384a6c16ac551a40922.patch
- Add upstream change:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="christophe@krop.fr" date="1693051200">- Update to 0.16.3:
  Features:
  * compose: Allow creating metadata with complete URLs and no base URL
  Bugfixes:
  * Fix tweaking of appstream.pc when building as subproject
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  Miscellaneous:
  * Work around invalid null-dereference warning in GCC 13
- Drop patch, merged upstream:
  * 0001-Do-not-override-default-priority-when-parsing-multip.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1696334400">- Enable vala support when building in SLE-15 SP6
- Fix condition in files section for the case where vala support
  is disabled, where some files are being generated but were not
  included</changelog>
  <changelog author="alarrosa@suse.com" date="1697457600">- Fix the documentation being put in the devel subpackage while
  the doc subpackage was empty. I think the doc %files section was
  probably removed inadvertently since it wasn't mentioned in the
  changelog and the doc subpackage declaration was left around.
- Moved the appstreamcli-compose man page to the same package
  as the binary.
- Make AppStream-compose-devel explicitly require
  libappstream-compose0 to stop rpmlint from reporting an error.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1700049600">- Update to version 0.16.4:
  * Features:
  - Allow hyphens in the last segment of a component-ID
  - Implement the developer element for unique developer IDs
  - Add meson overrides
  * Bugfixes:
  - meson: Prevent building attempts with MSVC
  - meson: Avoid potentially bad sed backup filename when fixing
    .pc file
  * Miscellaneous: Make sed invocation more portable
- Rebase patch with quilt.</changelog>
  <changelog author="christophe@krop.fr" date="1700654400">- Update to 1.0.0. Note that this release has some breaking API
  changes.
  Features:
  * Autoformat C and C++ sources
  * Remove all deprecated symbols
  * Drop support for many deprecated AppStream XML features
  * Use GPtrArray to expose keywords list
  * Add length argument to raw metadata parsing functions
  * Add component array container class
  * Remove named values for display_length relations
  * Make AsPool only accept/return component boxes
  * Port all API away from per-entity locale overrides
  * Reduce appstream.conf to its essentials, make it work on stateless systems
  * Hide search engine details from public API
  * Wrap release entries in AsReleaseList container class
  * Make AsMetadata handle AsReleaseList objects
  * Refactor is_satisfied result into new RelationCheckResult class
  * Add a method to check all relations of a component and get the result
  * Add algorithm to score compatibility with a system, add chassis templates
  * ascli: Add new check-syscompat command to check chassis compatibility
  * Implement environment property for component screenshots
  * Autogenerate translatable DE and gui-environment-style C arrays
  * Expose more advanced markup conversion function, update function names
  * Allow BLAKE3 and SHA512 checksums for release artifacts
  * Stop supporting mailto: URLs in &lt;url/&gt; tags
  * validator: Improve API and simplify it
  * validator: Parse XML in pedantic mode when validating
  * validator: Check screenshot environment property
  * validator: Only apply summary-has-dot-suffix check to untranslated strings
  * compose: Allow creating metadata with complete URLs and no base URL
  * spdx: Add API to retrieve a translated license name from an SPDX ID
  * qt: Switch to building with Qt6
  * qt: Make it possible to iterate ComponentBox
  * qt: Implement AppStream::ComponentBox::erase
  * qt: Allow concatenating two ComponentBoxes
  * qt: Allow loading Pool asynchronously
  * qt: Use ComponentBox/Releases in Qt bindings as well
  * qt: Add support for the new API to check relation satisfaction
  * qt: Maintenance and namespace fixes, use cPtr() to get C pointers everywhere
  * bundle: Add linglong as a new type of bundle
  * Add GUI environment IDs for macOS and Microsoft Windows
  * validator: Check if Release Description is inside description tag
  * validator: Add validation for content_rating
  * Add support for building on Win32
  * win32: change some file/path-related code for portability
  * Implement the developer element for unique developer IDs
  * Implement scaling factor for screenshots
  * component-box: Allow removal of components by-index
  * Implement support for external references and citations
  * Implement usertags for release data as well
  * Move ValueFlags to the context, instead of tieing them to components
  * pool: search: Add additional weight for exact substring matches on names
  * sysinfo: Add memory size detection support for macOS
  * Add support for Zstd for on-disk data compression
  * utils: Make tar unpacker independent of zstd binary presence
  * Drop Python2 provided tag support
  * data: Add ‘Endless’ to the list of desktops
  * Add NetBSD support
  Specification:
  * Drop (most) deprecated information
  * docs: Clarify environment-based screenshot ordering
  * Add new  'snapshot' release kind
  * docs: Build all API documentation with gi-docgen
  * spec: Document the new "developer" element
  * spec: Document the "reference" tag for registry references
  * docs: Add example of YAML for references elements
  * Allow hyphens in the last segment of a component-ID
  * docs: Drop outdated information from l10n quickstart guide
  Bugfixes:
  * meson: check for docbook xsl stylesheets
  * Fix tweaking of appstream.pc when building as subproject
  * Fix crash in asc_l10n_search_translations_qt()
  * qt: Make Qt6 dependency a system dependency.
  * meson: do not rely on an exe wrapper
  * meson: do not -I/usr/include when !stemmer
  * meson: Prevent building attempts with MSVC
  * meson: Use an SPDX license indentifier in project(license:)
  * Add meson overrides
  * compose: Set lower-cased CID for synthesized components again
  * compose: Set lower-cased CID in desktop-entry parse function
  * compose: Honor prefix in font search
  * compose: Select the correct default icon glyphs for fonts
  * Don't crash when non-YAML documents are read as YAML
  * Do not override default-priority when parsing multiple metadata files
  * Ensure stemmer always has the right locale and token-search works
  * Require a more recent libxmlb to avoid crashes
  * Rename component get_releases to indicate that releases may not be loaded from the web
  * Prevent string-id validation functions from matching source comments
  * Don't define _POSIX_C_SOURCE when building for NetBSD
  Miscellaneous:
  * Explain metainfo-ancient error in more detail
  * Make sed invocation more portable
  * Add FreeBSD CI
  * Allow variable shadowing in C++ code
  * Drop the catchall as-enums unit
  * vapi: Drop unneeded metadata
  * Make AsMetadata return a component box for multiple components
  * apt: Make item descriptions more human-friendly
  * Streamline README</changelog>
  <changelog author="alarrosa@suse.com" date="1701777600">- Make AppStream-compose-devel require the same version
  of libappstream-compose0.</changelog>
  <changelog author="fcrozat@suse.com" date="1702296000">- Bump BuildRequires on pkgconfig(xmlb) to 0.3.14.</changelog>
  <changelog author="christophe@krop.fr" date="1702468800">- Add upstream change to fix a couple test issues (related to boo#1217047)
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
- Add more changes:
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Add a Qt6 multibuild flavor</changelog>
  <changelog author="christophe@krop.fr" date="1702641600">- Use GCC 12 for building on Leap</changelog>
  <changelog author="christophe@krop.fr" date="1706702400">- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler</changelog>
  <changelog author="christophe@krop.fr" date="1706788800">- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch</changelog>
  <changelog author="christophe@krop.fr" date="1708257600">- Add upstream change to fix potential URL validity check errors:
  * 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="christophe@krop.fr" date="1709294400">- Update to 1.0.2
  Features:
  * qt: Allow building for multiple Qt major versions at once
  * Improve low-quality category check and extend its blacklist
  * validator: Add some limited developer-ID validation
  * validator: Emit an overridable warning if homepage URL was omitted
  * compose: Allow rendering vector graphics to HiDPI bitmaps unconditionally
  * compose: Allow setting a custom icon-policy on the command-line
  Specification:
  * docs: Mention that &lt;summary/&gt; tag can be translated
  * docs: Generate validation issue tag documentation from code
  * docs: Add information on how to exclude elements from translation
  * spec: Recommend using rDNS strings or Fediverse handles as developer-ID
  * spec: Make launchable requirement for desktop-apps more strict
  Bugfixes:
  * qt: Component::customValue should be const
  * validator: Remove mention of shorthands from relation-display-length-value-invalid
  * sysinfo: Swap arguments of g_pattern_match_simple
  * qt: Add missing screenshot sorting function
  * qt: pool: Add missing Q_EMIT keyword
  * validator: Improve error message if no valid categories were found
  * validator: Make some length limitations more strict
  * validator: Only emit developer-name-tag-deprecated once
  * validator: Ensure filename is properly included in location info again
  * validator: Improve error reporting on images with missing/bad locales
  * compose: Don't accidentally set icon scale to 0 in some cases
  * compose: Add heuristics to show out-of-scope errors if filters were set
  * Don't prematurely abort URL validity check during semi-large redirects
  * docs: Update supported hashsums to reflect reality
  * docs: Describe version comparison letters special case
  * docs: Clarify release descriptions *must not* contain embedded URL
  * docs: Explicitly mention /var/cache/swcatalog is a valid
    catalog data location
  * tests: Fix tests with old &amp; new FontConfig
  * its: Allow untranslatable developer/name and agreement sections
  Miscellaneous:
  * compose: Clarify that "no valid category" can mean bad ones
    were ignored
  * news-convert: Don't strip out the last text in brackets
- Drop patch, merged upstream:
  * # 0001-Don-t-prematurely-abort-URL-validity-check-during-se.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1710244800">- Add conflict in appstream-qt6-devel with
  libAppStreamQt-devel &lt; 1.0. This is required to fix a file
  conflict in SLE with the old libAppStreamQt-devel package.</changelog>
</package>
<package pkgid="ea22388d430de3a6ac6bfc6649e24318918591c00f326ee54676a07092b281d6" name="assertj-core" arch="noarch">
  <version epoch="0" ver="3.25.3" rel="150200.5.4.3"/>
  <changelog author="fstrba@suse.com" date="1556625600">- Initial packaging of assertj-core 3.8.0</changelog>
  <changelog author="jengelh@inai.de" date="1556712000">- Ensure neutrality of descriptions.</changelog>
  <changelog author="fstrba@suse.com" date="1714478400">- Upgrade to version 3.25.3
  * Deprecations:
    + Deprecate the following date/time related assertions in favor
    of isCloseTo:
  - isEqualToIgnoringHours
  - isEqualToIgnoringMinutes
  - isEqualToIgnoringSeconds
  - isEqualToIgnoringMillis
  - isEqualToIgnoringNanos
  - isInSameHourAs
  - isInSameMinuteAs
  - isInSameSecondAs
    + Deprecate asList in favor of asInstanceOf
  * New Features:
    + Add Descriptable#describedAs(Supplier&lt;String&gt;)
    + Add isInThePast and isInTheFuture to LocalDate assertions
    + Add isInThePast and isInTheFuture to the missing Java 8
    date/time types
    + Add isRecord and isNotRecord to Class assertions
    + Add hasNullValue and doesNotHaveNullValue to
    AtomicReferenceAssert
    + Add asBoolean|Byte|Short|Int|Long|Float|Double to String
    assertions
    + Add hasRecordComponents to Class assertions
    + Add getters for field path in ComparisonDifference
    + Allow to compare enum and string fields in the recursive
    comparison
    + Provide value when assertThatThrownBy / thenThrownBy fail
    + Add isSealed and isNotSealed to Class assertions
    + Add assertThatCharSequence to disambiguate Groovy's GString
    + Change the way the properties are collected using the
    Class.getMethods() API instead of iterating the class
    hierarchy using Class.declaredMethods()
    + Add default constructor for RecursiveComparator
    + Add isPrimitive and isNotPrimitive to Class assertions
    + Add anyOf(ThrowingConsumer...) and allOf(ThrowingConsumer...)
    + Show the array/iterable under test in the assertion error
    message when it is not empty but should have been
  * Bug Fixes:
    + Compare Java types from javax and com.sun by their equals
    method in recursive comparison
    + The recursive comparison comparingOnlyFields did not treat
    array/iterable elements as root objects
    + Fixes a bug when failing assertions on DirectoryStream types
    + Fix handling of null containers in the recursive assertion
    + Handle null values in map entry sets when formatting
    + Fix NPE when expected and actual field values are null
    + Fix NPE on anyMatch when actual contains null and
    Objects::isNull is used as predicate
    + Fix misleading subsequence failure messages in string
    assertions
    + Do not ignore nested fields of types specified in
    comparingOnlyFieldsOfTypes
    + containsExactly does not work properly with maps not using
    equals to compare keys
    + Escape percentage in shouldContainExactly error message
    + Fix recursive comparison of ignored types in unordered
    collection
    + Revert "Provide value when assertThatThrownBy/thenThrownBy
    fail"
    + Revert "fix: containsExactly does not work properly with maps
    not using equals to compare keys"
    + Fix unresolvable Javadoc stylesheet URLs, simplify
    configuration
    + Fix missing configuration for MatcherAssert soft assertions
    + Make deprecation notice visible in AbstractAssert#asList
    + Recursive comparison uses equals on root object when
    useOverriddenEquals is enabled
    + satisfiesExactlyInAnyOrder fails if actual overrides equals
    + Avoid calling actual.hashCode() and expected.hashCode() in
    DualValue
    + Recursive comparison checks for existence of fields in types
    that parameterize nested unordered iterables
    + Lock maven-clean-plugin version for all modules
    + Fix a performance regression in the recursive comparison
    related to FieldLocation
    + Don't fail when the recursive comparison checks compared
    fields in collection elements
  * Improvements
    + Add Spotless
    + Use Bnd feature to write resolved bndrun files to output
    folder
    + Add Throwable stack trace to ShouldHaveClause
    + Avoid copy of any Collection instance in
    Iterables::assertContains
    + Add Throwable stack trace to ShouldHaveRootCauseInstance and
    ShouldHaveRootCauseExactlyInstance
    + Add missing description to nested condition
    + Make nestable condition factory accept conditions on super
    types
    + Add varargs overload to Assert::hasString and
    Assert::doesNotHaveString
    + Improve recursive comparison performance by caching field and
    field names result
    + Document performance cost of ignoring collection order
    + Track visited values and their comparison differences so that
    they can be reused
    + Use hash code for compareUnorderedIterables to improve
    performance in some common cases
    + Improve recursive comparison error message regarding equals
    methods used for JDK types
    + Format large arrays as strings
    + Remove null check as isArray already performs it
    + Fix PrimitiveArralList/TransformlingList test file names
    + Add exception for usages of isEqualTo and isNotEqualTo on
    assertions
    + Add check for missing fields in recursive comparison where
    specific fields are requested for comparison
    + Improve efficiency of iterable string conversion
    + Add more tests for usingRecursiveComparison
    + Checks that compared fields exist before running the recursive
    comparison
    + Remove maven-surefire-plugin duplicate version
    + Remove Maven default goal
    + Add dependency graph workflow
    + Normalize non-breaking spaces like regular white spaces
    + AbstractOffsetDateTimeAssert::isBetween parameter names should
    use inclusive, not exclusive
    + Invoke isNotNull in returns and doesNotReturn
    + Cache node names in ComparingFields, ComparingProperties
    + Cache node names in ComparingNormalizedFields
    + Use simpler syntax in
    DefaultRecursiveComparisonIntrospectionStrategy
    .getChildrenNodeNamesOf
    + Update to Contributor Covenant Code of Conduct v2.1
    + Correct contains assertion Javadoc to reflect method behavior
    in case actual is not empty and the group of values to look
    for is
    + Fix Javadoc typos
    + Improving null-safety of isEqualToNormalizingNewlines
    + Speed up for BinaryDiff performance
    + Upgrade workflows to Java 21
    + Apply flatten-maven-plugin to assertj-core and assertj-guava</changelog>
  <changelog author="fstrba@suse.com" date="1716552000">- Require in OBS junit5-minimal to avoid provider choice</changelog>
</package>
<package pkgid="36d14b0b961124536a93f90d3f1f1befd2c3abfb76934bb3987edf49548a23db" name="assertj-core" arch="src">
  <version epoch="0" ver="3.25.3" rel="150200.5.4.3"/>
  <changelog author="fstrba@suse.com" date="1556625600">- Initial packaging of assertj-core 3.8.0</changelog>
  <changelog author="jengelh@inai.de" date="1556712000">- Ensure neutrality of descriptions.</changelog>
  <changelog author="fstrba@suse.com" date="1714478400">- Upgrade to version 3.25.3
  * Deprecations:
    + Deprecate the following date/time related assertions in favor
    of isCloseTo:
  - isEqualToIgnoringHours
  - isEqualToIgnoringMinutes
  - isEqualToIgnoringSeconds
  - isEqualToIgnoringMillis
  - isEqualToIgnoringNanos
  - isInSameHourAs
  - isInSameMinuteAs
  - isInSameSecondAs
    + Deprecate asList in favor of asInstanceOf
  * New Features:
    + Add Descriptable#describedAs(Supplier&lt;String&gt;)
    + Add isInThePast and isInTheFuture to LocalDate assertions
    + Add isInThePast and isInTheFuture to the missing Java 8
    date/time types
    + Add isRecord and isNotRecord to Class assertions
    + Add hasNullValue and doesNotHaveNullValue to
    AtomicReferenceAssert
    + Add asBoolean|Byte|Short|Int|Long|Float|Double to String
    assertions
    + Add hasRecordComponents to Class assertions
    + Add getters for field path in ComparisonDifference
    + Allow to compare enum and string fields in the recursive
    comparison
    + Provide value when assertThatThrownBy / thenThrownBy fail
    + Add isSealed and isNotSealed to Class assertions
    + Add assertThatCharSequence to disambiguate Groovy's GString
    + Change the way the properties are collected using the
    Class.getMethods() API instead of iterating the class
    hierarchy using Class.declaredMethods()
    + Add default constructor for RecursiveComparator
    + Add isPrimitive and isNotPrimitive to Class assertions
    + Add anyOf(ThrowingConsumer...) and allOf(ThrowingConsumer...)
    + Show the array/iterable under test in the assertion error
    message when it is not empty but should have been
  * Bug Fixes:
    + Compare Java types from javax and com.sun by their equals
    method in recursive comparison
    + The recursive comparison comparingOnlyFields did not treat
    array/iterable elements as root objects
    + Fixes a bug when failing assertions on DirectoryStream types
    + Fix handling of null containers in the recursive assertion
    + Handle null values in map entry sets when formatting
    + Fix NPE when expected and actual field values are null
    + Fix NPE on anyMatch when actual contains null and
    Objects::isNull is used as predicate
    + Fix misleading subsequence failure messages in string
    assertions
    + Do not ignore nested fields of types specified in
    comparingOnlyFieldsOfTypes
    + containsExactly does not work properly with maps not using
    equals to compare keys
    + Escape percentage in shouldContainExactly error message
    + Fix recursive comparison of ignored types in unordered
    collection
    + Revert "Provide value when assertThatThrownBy/thenThrownBy
    fail"
    + Revert "fix: containsExactly does not work properly with maps
    not using equals to compare keys"
    + Fix unresolvable Javadoc stylesheet URLs, simplify
    configuration
    + Fix missing configuration for MatcherAssert soft assertions
    + Make deprecation notice visible in AbstractAssert#asList
    + Recursive comparison uses equals on root object when
    useOverriddenEquals is enabled
    + satisfiesExactlyInAnyOrder fails if actual overrides equals
    + Avoid calling actual.hashCode() and expected.hashCode() in
    DualValue
    + Recursive comparison checks for existence of fields in types
    that parameterize nested unordered iterables
    + Lock maven-clean-plugin version for all modules
    + Fix a performance regression in the recursive comparison
    related to FieldLocation
    + Don't fail when the recursive comparison checks compared
    fields in collection elements
  * Improvements
    + Add Spotless
    + Use Bnd feature to write resolved bndrun files to output
    folder
    + Add Throwable stack trace to ShouldHaveClause
    + Avoid copy of any Collection instance in
    Iterables::assertContains
    + Add Throwable stack trace to ShouldHaveRootCauseInstance and
    ShouldHaveRootCauseExactlyInstance
    + Add missing description to nested condition
    + Make nestable condition factory accept conditions on super
    types
    + Add varargs overload to Assert::hasString and
    Assert::doesNotHaveString
    + Improve recursive comparison performance by caching field and
    field names result
    + Document performance cost of ignoring collection order
    + Track visited values and their comparison differences so that
    they can be reused
    + Use hash code for compareUnorderedIterables to improve
    performance in some common cases
    + Improve recursive comparison error message regarding equals
    methods used for JDK types
    + Format large arrays as strings
    + Remove null check as isArray already performs it
    + Fix PrimitiveArralList/TransformlingList test file names
    + Add exception for usages of isEqualTo and isNotEqualTo on
    assertions
    + Add check for missing fields in recursive comparison where
    specific fields are requested for comparison
    + Improve efficiency of iterable string conversion
    + Add more tests for usingRecursiveComparison
    + Checks that compared fields exist before running the recursive
    comparison
    + Remove maven-surefire-plugin duplicate version
    + Remove Maven default goal
    + Add dependency graph workflow
    + Normalize non-breaking spaces like regular white spaces
    + AbstractOffsetDateTimeAssert::isBetween parameter names should
    use inclusive, not exclusive
    + Invoke isNotNull in returns and doesNotReturn
    + Cache node names in ComparingFields, ComparingProperties
    + Cache node names in ComparingNormalizedFields
    + Use simpler syntax in
    DefaultRecursiveComparisonIntrospectionStrategy
    .getChildrenNodeNamesOf
    + Update to Contributor Covenant Code of Conduct v2.1
    + Correct contains assertion Javadoc to reflect method behavior
    in case actual is not empty and the group of values to look
    for is
    + Fix Javadoc typos
    + Improving null-safety of isEqualToNormalizingNewlines
    + Speed up for BinaryDiff performance
    + Upgrade workflows to Java 21
    + Apply flatten-maven-plugin to assertj-core and assertj-guava</changelog>
  <changelog author="fstrba@suse.com" date="1716552000">- Require in OBS junit5-minimal to avoid provider choice</changelog>
</package>
<package pkgid="2b182714d5b9e83774e3690f921d4a9865ee7b0823a5381ed79cefdac7a9ef92" name="atinject" arch="noarch">
  <version epoch="0" ver="1+20211017gitd06ce18" rel="150200.3.13.1"/>
  <changelog author="fstrba@suse.com" date="1540382400">- Initial packaging of atinject adapted from Fedora rpm</changelog>
  <changelog author="fstrba@suse.com" date="1647691200">- Build with source/target levels 8
- Added patch:
  * atinject-javadoc.patch
    + fix build with javadoc 17</changelog>
  <changelog author="fstrba@suse.com" date="1648123200">- Fetch the sources using a source service
- Do not use the upstream build.sh, but use it to write a
  necessary part directly to the spec file</changelog>
  <changelog author="fstrba@suse.com" date="1648900800">- Alias to the new jakarta name</changelog>
  <changelog author="fstrba@suse.com" date="1712750400">- Upgrade to version 1.0.5 and switch to sources in
  https://github.com/jakartaee/inject/
  * Changes of 1.0.5:
    + This switches the module name back to the java.inject that was
    used by the 1.0.3 release with automatic module. This is a
    multi-release jar
  * Changes of 1.0.4:
    + This is a 1.0.4 service release with a multi-release jar that
    adds the module-info class to
    META-INF/versions/9/module-info.class using the
    https://github.com/moditect/moditect plugin for the
    javax.inject module.
  * Changes of 1.0.3:
    + This release corrects the 1.0.2 release which was incorrectly
    done from the master branch with the jakarta.* packages.
    + It adds the Automatic-Module-Name=java.inject to the api jar
    manifest.
  * Changes of 1.0.2:
    + A service release that addresses:
  - #14, set Automatic-Module-Name to java.inject
  - #15, add OSGi bundle headers
  * Changes of 1.0.1:
    + Add Automatic-Module-Name of jakarta.inject
  * Changes of 1.0:
    + First Injection API release for Jakarta EE
- Remove unused sub-package tck
- Removed patch:
  * atinject-javadoc.patch
    + not needed with this version</changelog>
  <changelog author="fstrba@suse.com" date="1717761600">- Don't distribute as jakarta.inject:jakarta-inject-api artifact
  to prevent conflicts with the version 2.x that actually has
  classes in jakarta.inject namespace and thus is incompatible</changelog>
  <changelog author="fstrba@suse.com" date="1720526400">- Revert to versioning 1+&lt;date&gt;git&lt;git short hash&gt; to avoid upgrade
  problems in SLE</changelog>
</package>
<package pkgid="8889fc3ef99485f1682edb2fbd1310aa3b3700bf4f9f8066e7445c3773fb54c1" name="atinject" arch="src">
  <version epoch="0" ver="1+20211017gitd06ce18" rel="150200.3.13.1"/>
  <changelog author="fstrba@suse.com" date="1540382400">- Initial packaging of atinject adapted from Fedora rpm</changelog>
  <changelog author="fstrba@suse.com" date="1647691200">- Build with source/target levels 8
- Added patch:
  * atinject-javadoc.patch
    + fix build with javadoc 17</changelog>
  <changelog author="fstrba@suse.com" date="1648123200">- Fetch the sources using a source service
- Do not use the upstream build.sh, but use it to write a
  necessary part directly to the spec file</changelog>
  <changelog author="fstrba@suse.com" date="1648900800">- Alias to the new jakarta name</changelog>
  <changelog author="fstrba@suse.com" date="1712750400">- Upgrade to version 1.0.5 and switch to sources in
  https://github.com/jakartaee/inject/
  * Changes of 1.0.5:
    + This switches the module name back to the java.inject that was
    used by the 1.0.3 release with automatic module. This is a
    multi-release jar
  * Changes of 1.0.4:
    + This is a 1.0.4 service release with a multi-release jar that
    adds the module-info class to
    META-INF/versions/9/module-info.class using the
    https://github.com/moditect/moditect plugin for the
    javax.inject module.
  * Changes of 1.0.3:
    + This release corrects the 1.0.2 release which was incorrectly
    done from the master branch with the jakarta.* packages.
    + It adds the Automatic-Module-Name=java.inject to the api jar
    manifest.
  * Changes of 1.0.2:
    + A service release that addresses:
  - #14, set Automatic-Module-Name to java.inject
  - #15, add OSGi bundle headers
  * Changes of 1.0.1:
    + Add Automatic-Module-Name of jakarta.inject
  * Changes of 1.0:
    + First Injection API release for Jakarta EE
- Remove unused sub-package tck
- Removed patch:
  * atinject-javadoc.patch
    + not needed with this version</changelog>
  <changelog author="fstrba@suse.com" date="1717761600">- Don't distribute as jakarta.inject:jakarta-inject-api artifact
  to prevent conflicts with the version 2.x that actually has
  classes in jakarta.inject namespace and thus is incompatible</changelog>
  <changelog author="fstrba@suse.com" date="1720526400">- Revert to versioning 1+&lt;date&gt;git&lt;git short hash&gt; to avoid upgrade
  problems in SLE</changelog>
</package>
<package pkgid="82b385b8bf94e36cd1f25c23683ff5360b2ab0d17588b61fd93e4d2b36d231c2" name="atinject-javadoc" arch="noarch">
  <version epoch="0" ver="1+20211017gitd06ce18" rel="150200.3.13.1"/>
  <changelog author="fstrba@suse.com" date="1540382400">- Initial packaging of atinject adapted from Fedora rpm</changelog>
  <changelog author="fstrba@suse.com" date="1647691200">- Build with source/target levels 8
- Added patch:
  * atinject-javadoc.patch
    + fix build with javadoc 17</changelog>
  <changelog author="fstrba@suse.com" date="1648123200">- Fetch the sources using a source service
- Do not use the upstream build.sh, but use it to write a
  necessary part directly to the spec file</changelog>
  <changelog author="fstrba@suse.com" date="1648900800">- Alias to the new jakarta name</changelog>
  <changelog author="fstrba@suse.com" date="1712750400">- Upgrade to version 1.0.5 and switch to sources in
  https://github.com/jakartaee/inject/
  * Changes of 1.0.5:
    + This switches the module name back to the java.inject that was
    used by the 1.0.3 release with automatic module. This is a
    multi-release jar
  * Changes of 1.0.4:
    + This is a 1.0.4 service release with a multi-release jar that
    adds the module-info class to
    META-INF/versions/9/module-info.class using the
    https://github.com/moditect/moditect plugin for the
    javax.inject module.
  * Changes of 1.0.3:
    + This release corrects the 1.0.2 release which was incorrectly
    done from the master branch with the jakarta.* packages.
    + It adds the Automatic-Module-Name=java.inject to the api jar
    manifest.
  * Changes of 1.0.2:
    + A service release that addresses:
  - #14, set Automatic-Module-Name to java.inject
  - #15, add OSGi bundle headers
  * Changes of 1.0.1:
    + Add Automatic-Module-Name of jakarta.inject
  * Changes of 1.0:
    + First Injection API release for Jakarta EE
- Remove unused sub-package tck
- Removed patch:
  * atinject-javadoc.patch
    + not needed with this version</changelog>
  <changelog author="fstrba@suse.com" date="1717761600">- Don't distribute as jakarta.inject:jakarta-inject-api artifact
  to prevent conflicts with the version 2.x that actually has
  classes in jakarta.inject namespace and thus is incompatible</changelog>
  <changelog author="fstrba@suse.com" date="1720526400">- Revert to versioning 1+&lt;date&gt;git&lt;git short hash&gt; to avoid upgrade
  problems in SLE</changelog>
</package>
<package pkgid="b85e528ec532c0004f39b9831fabced4c80d13f0c0bde489f73c4475ec2d539c" name="avahi" arch="aarch64">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="33e75041d1bb37f5f1b78dbc07636747d358f0ca4f7599b5adba1aaa2061384f" name="avahi" arch="ppc64le">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="211010baf3903bbc4359efc6b82685f07c811be5b31906f7f8325745045e51c1" name="avahi" arch="s390x">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="50f60742818d2464e16d3b42b162a4632202f05e197f59bbb679314e4289af1e" name="avahi" arch="src">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="b712d4f5be5f7759e0a912900353e6cdb567303a5239ef38f887ea7a1b090543" name="avahi" arch="x86_64">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="4d38b7c5e5eee3f2df075f28eba8953cc7885508f9deab79e5316af272e21dca" name="avahi-autoipd" arch="aarch64">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="a55e953fca8e033e6aa3ac98d550bd15ed41e334c98983dffa75496aa3de9f22" name="avahi-autoipd" arch="ppc64le">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="d610a3aeabad4a1787590993fb924af76a9c61af3c74cc400beca7772a56bfc2" name="avahi-autoipd" arch="s390x">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="300e46f44f928957ef74da83bdfdf5aaf79712dbfc9f1b5d325f211ff97ee542" name="avahi-autoipd" arch="x86_64">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="aebab81b20e6b7872a3bd1c5d7a2eeb014fbef792583c52c91826d9cc4b171f3" name="avahi-compat-howl-devel" arch="aarch64">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="689a338f5584fee7616055b1a64a9f40179df56f9838cc68a0be04421dd7c18f" name="avahi-compat-howl-devel" arch="ppc64le">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="3ce11a7dc833e3b17abba5b3faee81b4e618101573e72153d93830df8a45883f" name="avahi-compat-howl-devel" arch="s390x">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="d3b6fff46b52bb0fdbe4a3cfade0ff69a3fd39a3b2744edb2395bd5bfb85c85e" name="avahi-compat-howl-devel" arch="x86_64">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="75ff46f435dd1b2dfbd0566ceccd2b6bb6040e0b50a117593e44fcd475115ae6" name="avahi-compat-mDNSResponder-devel" arch="aarch64">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="d5122647e4ab054c35cd4fa3fbac1eb8b833924b44900f720a86cb9d7bdc9fc6" name="avahi-compat-mDNSResponder-devel" arch="ppc64le">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="d402eb1f145fc21aa4249f2d8afd44cdd700bec2a333682762aab1a1853291a4" name="avahi-compat-mDNSResponder-devel" arch="s390x">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="3ec18a8982f79351f49d1b1c8edc4821d165551b9d6bdffaf9c7b8440b4a9955" name="avahi-compat-mDNSResponder-devel" arch="x86_64">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="f73854bd4606002e4d6d69148ce00ac8da0faacfee9fa6e54c88a5578568c817" name="avahi-glib2" arch="src">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="81a6a3ad78953768e141c6936d74427520d6396c1c3f5f3da036274550e45e1b" name="avahi-lang" arch="noarch">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="efdfc703ad408819d551e42bc6c04d762857d0a6666edf842e9a4e1b87e0fbc5" name="avahi-qt5" arch="src">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="5b0c0e0ac660de72fecb9165ae999752c69171eef7d6c0e24c03a34d152e2e2f" name="avahi-utils" arch="aarch64">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="03de9d25f3eaaf47e80758b686fb1581f006daad94ff408a5dec02e32613795c" name="avahi-utils" arch="ppc64le">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="c82144f96abe67bc521a3692be9c9acd37833172fc3c8737b1525daf65340af1" name="avahi-utils" arch="s390x">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="7687e0f021b5a4417b8a5ae6041e193a75f29990fecaf8f4e1d15fc90353b140" name="avahi-utils" arch="x86_64">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="99bcf6f4a184cd248977ff07f99a0fe1b0c8b3801749e69b09c5d9be74cff5ff" name="avahi-utils-gtk" arch="aarch64">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="d033bb66469fd5ce364a8c441275bc145f5bb97cd99b35b14a962f67d437aad3" name="avahi-utils-gtk" arch="ppc64le">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="129acf0a4a7cb1f309d2302c9f25b75edafa77ac917fccc3a7a29dcceb751005" name="avahi-utils-gtk" arch="s390x">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="8f01193e8d536215aaa0966dde039ac30d89b95752f4b6964412e7075145a2e1" name="avahi-utils-gtk" arch="x86_64">
  <version epoch="0" ver="0.8" rel="150600.15.3.1"/>
  <changelog author="mgorse@suse.com" date="1645012800">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="dmueller@suse.com" date="1645099200">- remove avahi-mono* subspecfiles, they are no longer required
  by anything. this makes the spec file slightly more readable.</changelog>
  <changelog author="dmueller@suse.com" date="1645617600">- switch to use _multibuild
- delete _avahi_spec-prepare.sh, pre_checkin.sh: obsolete
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1650024000">- Stop requiring "avahi" from "libavahi-devel". The devel package
  ought to facilitate building programs with avahi, not run the
  whole deamon.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1657368000">- Move the dbus-1 system.d file to /usr (bsc#1201345)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1662292800">- avahi-daemon-check-dns.sh: convert obsolete egrep call to grep -E
  (boo#1203092)</changelog>
  <changelog author="jsegitz@suse.com" date="1670241600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_avahi-daemon.service.patch
  * harden_avahi-dnsconfd.service.patch</changelog>
  <changelog author="kukuk@suse.com" date="1670500800">- Remove avahi-daemon-check-dns.sh, avahi-daemon-check-dns-suse.patch
  and avahi-daemon.if-up
  Doesn't work since about 9 years and will not be executed on a
  fresh default installation anymore</changelog>
  <changelog author="dimstar@opensuse.org" date="1671451200">- Drop %{_sysconfdir}/sysconfig/network/if-{up,down}.d scripts:
  they are not used, or supported, in a while already.</changelog>
  <changelog author="mgorse@suse.com" date="1681214400">- Add avahi-CVE-2023-1981.patch: emit error if requested service
  is not found (boo#1210328 CVE-2023-1981).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1681214401">- Use ldconfig_scriptlets macro.</changelog>
  <changelog author="lnussel@suse.com" date="1695211200">- Don't require sudo. There is no indication it's actually used for
  anything.</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1698321600">- Add avahi-CVE-2023-38473.patch: derive alternative host name from
  its unescaped version (bsc#1216419 CVE-2023-38473).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1698840000">- Add avahi-CVE-2023-38470.patch: Ensure each label is at least one
  byte long (bsc#1215947, CVE-2023-38470).</changelog>
  <changelog author="dimstar@opensuse.org" date="1699876800">- avahi-autoipd: only migrate files owned by avahi user if said
  user exists: if the user does not exist (fresh installs), then
  there is no chance any file is owned by the user (boo#1216730).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700654400">- avahi-autoipd: guard %post chown with -h, to not follow symlinks
  (boo#1217398).</changelog>
  <changelog author="dimstar@opensuse.org" date="1700740800">- avahi-autoipd: drop the post script part migrating the user
  owning files in /var/lib/avahi-autoipd: the code was aiding
  migrations from SLE&lt;=11/openSUSE&lt;=12.3, which are no longer in
  scope for upgrades nowadays.</changelog>
  <changelog author="dimstar@opensuse.org" date="1701086400">- Reformat avahi-gacdir.patch to apply as patch -p1.
- Use %autopatch instead of deprecated %patchN format.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1701345600">- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
  avahi_rdata_parse (bsc#1216853, CVE-2023-38472).</changelog>
  <changelog author="mgorse@suse.com" date="1718884800">- Add avahi-CVE-2023-38471.patch: Extract host name using
  avahi_unescape_label (bsc#1216594, CVE-2023-38471).
- Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
  records (bsc#1216598, CVE-2023-38469).
- Add avahi-filter-bogus-services.patch: no longer supply bogus
  services to callbacks (bsc#1226586).</changelog>
</package>
<package pkgid="f7a425deef0528802584c6641a885860fd5920aa70732b1d3a768cca798da563" name="aws-cli" arch="noarch">
  <version epoch="0" ver="1.32.31" rel="150400.35.3.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1674820800">- Update to version 1.27.58
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.27.58/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1675425600">- Update to version 1.27.60
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.27.60/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1675857600">- Update to version 1.27.66
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.27.66/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1676462400">- Update to version 1.27.71
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.27.71/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1677240000">- Update to version 1.27.78
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.27.78/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1678708800">- Update to version 1.27.89
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.27.89/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1680696000">- Update in SLE-15 (bsc#1209255, jsc#PED-3780)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1681905600">- Update to version 1.27.115
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.27.115/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1683633600">- Update to version 1.27.130
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.27.130/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1686744000">- Update to version 1.27.153
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.27.153/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1688040000">- Update to version 1.27.163
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.27.163/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1689076800">- Update to version 1.29.2
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.29.2/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1692273600">- Update to version 1.29.27
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.29.27/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1693396800">- Update to version 1.29.36
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.29.27/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1696593600">- Update to version 1.29.61
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.29.61/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1700827200">- Update to version 1.30.6
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.30.6/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1702296000">- Update to version 1.31.11
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.31.11/CHANGELOG.rst
- Add patch to update docutils dependency (bsc#1217336)
  + ac_update-docutils.patch
- Update Requires in spec file from setup.py</changelog>
  <changelog author="rjschwei@suse.com" date="1706702400">- Switch to Python 3.11 build in SLE 15 SP4 and openSUSE Leap 15.4 and
  later (jsc#PCT-371)
- Switch to wheel build
- Update to version 1.32.31
  * Forward port ac_update-docutils.patch
  * api-change:``datazone``: Add new skipDeletionCheck to DeleteDomain. Add
    new skipDeletionCheck to DeleteProject which also automatically deletes
    dependent objects
  * api-change:``route53``: Update the SDKs for text changes in the APIs.
- From 1.32.30
  * api-change:``autoscaling``: EC2 Auto Scaling customers who use attribute
    based instance-type selection can now intuitively define their Spot
    instances price protection limit as a percentage of the lowest priced
    On-Demand instance type.
  * api-change:``comprehend``: Comprehend PII analysis now supports Spanish
    input documents.
  * api-change:``ec2``: EC2 Fleet customers who use attribute based
    instance-type selection can now intuitively define their Spot instances
    price protection limit as a percentage of the lowest priced On-Demand
    instance type.
  * api-change:``mwaa``: This release adds MAINTENANCE environment status for
    Amazon MWAA environments.
  * api-change:``rds``: Introduced support for the
    InsufficientDBInstanceCapacityFault error in the RDS
    RestoreDBClusterFromSnapshot and RestoreDBClusterToPointInTime API methods.
    This provides enhanced error handling, ensuring a more robust experience.
  * api-change:``snowball``: Modified description of createaddress to include
    direction to add path when providing a JSON file.
- From 1.32.29
  * api-change:``connect``: Update list and string length limits for predefined
    attributes.
  * api-change:``inspector2``: This release adds ECR container image scanning
    based on their lastRecordedPullTime.
  * api-change:``sagemaker``: Amazon SageMaker Automatic Model Tuning now
    provides an API to programmatically delete tuning jobs.
- From 1.32.28
  * api-change:``acm-pca``: AWS Private CA now supports an option to omit the
    CDP extension from issued certificates, when CRL revocation is enabled.
  * api-change:``lightsail``: This release adds support for IPv6-only instance
    plans.
- From 1.32.27
  * api-change:``ec2``: Introduced a new clientToken request parameter on
    CreateNetworkAcl and CreateRouteTable APIs. The clientToken parameter
    allows idempotent operations on the APIs.
  * api-change:``ecs``: Documentation updates for Amazon ECS.
  * api-change:``outposts``: DeviceSerialNumber parameter is now optional in
    StartConnection API
  * api-change:``rds``: This release adds support for Aurora Limitless Database.
  * api-change:``storagegateway``: Add DeprecationDate and SoftwareVersion to
    response of ListGateways.
- From 1.32.26
  * api-change:``inspector2``: This release adds support for CIS scans on EC2
    instances.
- From 1.32.25
  * bugfix:``s3 sync``: Disable S3 Express support for s3 sync command
- From 1.32.24
  * api-change:``appconfigdata``: Fix FIPS Endpoints in aws-us-gov.
  * api-change:``cloud9``: Doc-only update around removing AL1 from list of
    available AMIs for Cloud9
  * api-change:``cloudfront-keyvaluestore``: This release improves upon the
    DescribeKeyValueStore API by returning two additional fields, Status of the
    KeyValueStore and the FailureReason in case of failures during creation of
    KeyValueStore.
  * api-change:``connectcases``: This release adds the ability to view audit
    history on a case and introduces a new parameter, performedBy, for
    CreateCase and UpdateCase API's.
  * api-change:``ec2``: Documentation updates for Amazon EC2.
  * api-change:``ecs``: This release adds support for Transport Layer Security
    (TLS) and Configurable Timeout to ECS Service Connect. TLS facilitates
    privacy and data security for inter-service communications, while
    Configurable Timeout allows customized per-request timeout and idle timeout
    for Service Connect services.
  * api-change:``finspace``: Allow customer to set zip default through command
    line arguments.
  * api-change:``organizations``: Doc only update for quota increase change
  * api-change:``rds``: Introduced support for the
    InsufficientDBInstanceCapacityFault error in the RDS CreateDBCluster API
    method. This provides enhanced error handling, ensuring a more robust
    experience when creating database clusters with insufficient instance
    capacity.
  * api-change:``endpoint-rules``: Update endpoint-rules command to latest
    version
- From 1.32.23
  * api-change:``athena``: Introducing new NotebookS3LocationUri parameter to
    Athena ImportNotebook API. Payload is no longer required and either Payload
    or NotebookS3LocationUri needs to be provided (not both) for a successful
    ImportNotebook API call. If both are provided, an InvalidRequestException
    will be thrown.
  * api-change:``codebuild``: Release CodeBuild Reserved Capacity feature
  * api-change:``dynamodb``: This release adds support for including
    ApproximateCreationDateTimePrecision configurations in
    EnableKinesisStreamingDestination API, adds the same as an optional field
    in the response of DescribeKinesisStreamingDestination, and adds support
    for a new UpdateKinesisStreamingDestination API.
  * api-change:``qconnect``: Increased Quick Response name max length to 100
- From 1.32.22
  * api-change:``b2bi``: Increasing TestMapping inputFileContent file size
    limit to 5MB and adding file size limit 250KB for TestParsing input file.
    This release also includes exposing InternalServerException for Tag APIs.
  * api-change:``cloudtrail``: This release adds a new API
    ListInsightsMetricData to retrieve metric data from CloudTrail Insights.
  * api-change:``connect``: GetMetricDataV2 now supports 3 groupings
  * api-change:``drs``: Removed invalid and unnecessary default values.
  * api-change:``firehose``: Allow support for Snowflake as a Kinesis Data
    Firehose delivery destination.
  * api-change:``sagemaker-featurestore-runtime``: Increase BatchGetRecord
    limits from 10 items to 100 items
- From 1.32.21
  * api-change:``dynamodb``: Updating note for enabling streams for UpdateTable.
  * api-change:``keyspaces``: This release adds support for Multi-Region
    Replication with provisioned tables, and Keyspaces auto scaling APIs
- From 1.32.20
  * api-change:``iot``: Revert release of LogTargetTypes
  * api-change:``iotfleetwise``: Updated APIs: SignalNodeType query parameter
    has been added to ListSignalCatalogNodesRequest and ListVehiclesResponse
    has been extended with attributes field.
  * api-change:``macie2``: This release adds support for analyzing Amazon S3
    objects that are encrypted using dual-layer server-side encryption with
    AWS KMS keys (DSSE-KMS). It also adds support for reporting DSSE-KMS
    details in statistics and metadata about encryption settings for S3 buckets
    and objects.
  * api-change:``payment-cryptography``: Provide an additional option for key
    exchange using RSA wrap/unwrap in addition to tr-34/tr-31 in ImportKey and
    ExportKey operations. Added new key usage (type)
    TR31_M1_ISO_9797_1_MAC_KEY, for use with Generate/VerifyMac dataplane
    operations  with ISO9797 Algorithm 1 MAC calculations.
  * api-change:``personalize-runtime``: Documentation updates for Amazon
    Personalize
  * api-change:``personalize``: Documentation updates for Amazon Personalize.
  * api-change:``rekognition``: This release adds ContentType and TaxonomyLevel
    attributes to DetectModerationLabels and GetMediaAnalysisJob API responses.
  * api-change:``securityhub``: Documentation updates for AWS Security Hub
- From 1.32.19
  * api-change:``sagemaker``: This release will have ValidationException thrown
    if certain invalid app types are provided. The release will also throw
    ValidationException if more than 10 account ids are provided in
    VpcOnlyTrustedAccounts.
- From 1.32.18
  * api-change:``connect``: Supervisor Barge for Chat is now supported through
    the MonitorContact API.
  * api-change:``connectparticipant``: Introduce new Supervisor participant
    role
  * api-change:``location``: Location SDK documentation update. Added missing
    fonts to the MapConfiguration data type. Updated note for the
    SubMunicipality property in the place data type.
  * api-change:``mwaa``: This Amazon MWAA feature release includes new fields
    in CreateWebLoginToken response model. The new fields IamIdentity and
    AirflowIdentity will let you match identifications, as the Airflow identity
    length is currently hashed to 64 characters.
  * api-change:``s3control``: S3 On Outposts team adds dualstack endpoints
    support for S3Control and S3Outposts API calls.
  * api-change:``supplychain``: This release includes APIs
    CreateBillOfMaterialsImportJob and GetBillOfMaterialsImportJob.
  * api-change:``transfer``: AWS Transfer Family now supports static IP
    addresses for SFTP &amp; AS2 connectors and for async MDNs on AS2 servers.
  * api-change:``endpoint-rules``: Update endpoint-rules command to latest
    version
- From 1.32.17
  * api-change:``ec2``: This release adds support for adding an
    ElasticBlockStorage volume configurations in ECS
    RunTask/StartTask/CreateService/UpdateService APIs. The configuration
    allows for attaching EBS volumes to ECS Tasks.
  * api-change:``ecs``: This release adds support for adding an
    ElasticBlockStorage volume configurations in ECS
    RunTask/StartTask/CreateService/UpdateService APIs. The configuration
    allows for attaching EBS volumes to ECS Tasks.
  * api-change:``events``: Update events command to latest version
  * api-change:``iot``: Add ConflictException to Update APIs of AWS IoT
    Software Package Catalog
  * api-change:``iotfleetwise``: The following dataTypes have been removed:
    CUSTOMER_DECODED_INTERFACE in NetworkInterfaceType;
    CUSTOMER_DECODED_SIGNAL_INFO_IS_NULL in SignalDecoderFailureReason;
    CUSTOMER_DECODED_SIGNAL_NETWORK_INTERFACE_INFO_IS_NULL in
    NetworkInterfaceFailureReason; CUSTOMER_DECODED_SIGNAL in SignalDecoderType
  * api-change:``secretsmanager``: Doc only update for Secrets Manager
  * api-change:``workspaces``: Added AWS Workspaces RebootWorkspaces
    API - Extended Reboot documentation update
- From 1.32.16
  * api-change:``connectcampaigns``: Minor pattern updates for Campaign and
    Dial Request API fields.
  * api-change:``location``: This release adds API support for custom layers
    for the maps service APIs: CreateMap, UpdateMap, DescribeMap.
  * api-change:``logs``: Add support for account level subscription filter
    policies to PutAccountPolicy, DescribeAccountPolicies, and
    DeleteAccountPolicy APIs. Additionally, PutAccountPolicy has been modified
    with new optional "selectionCriteria" parameter for resource selection.
  * api-change:``qconnect``: QueryAssistant and GetRecommendations will be
    discontinued starting June 1, 2024. To receive generative responses after
    March 1, 2024 you will need to create a new Assistant in the Connect
    console and integrate the Amazon Q in Connect JavaScript library
    (amazon-q-connectjs) into your applications.
  * api-change:``redshift-serverless``: Updates to ConfigParameter for RSS
    workgroup, removal of use_fips_ssl
  * api-change:``route53``: Route53 now supports geoproximity routing in AWS
    regions
  * api-change:``wisdom``: QueryAssistant and GetRecommendations will be
    discontinued starting June 1, 2024. To receive generative responses after
    March 1, 2024 you will need to create a new Assistant in the Connect
    console and integrate the Amazon Q in Connect JavaScript library
    (amazon-q-connectjs) into your applications.
- From 1.32.15
  * api-change:``codebuild``: Aws CodeBuild now supports new compute type
    BUILD_GENERAL1_XLARGE
  * api-change:``ec2``: Amazon EC2 R7iz bare metal instances are powered by
    custom 4th generation Intel Xeon Scalable processors.
  * api-change:``route53resolver``: This release adds support for query type
    configuration on firewall rules that enables customers for granular action
    (ALLOW, ALERT, BLOCK) by DNS query type.
- From 1.32.14
  * api-change:``connect``: Minor trait updates for User APIs
  * api-change:``kms``: Documentation updates for AWS Key Management Service
    (KMS).
  * api-change:``redshift-serverless``: use_fips_ssl and require_ssl parameter
    support for Workgroup, UpdateWorkgroup, and CreateWorkgroup
- From 1.32.13
  * api-change:``config``: Updated ResourceType enum with new resource types onboarded by AWS Config in November and December 2023.
  * api-change:``docdb``: Adding PerformanceInsightsEnabled and
    PerformanceInsightsKMSKeyId fields to DescribeDBInstances Response.
  * api-change:``ecs``: This release adds support for managed instance
    draining which facilitates graceful termination of Amazon ECS instances.
  * api-change:``es``: This release adds support for new or existing Amazon
    OpenSearch domains to enable TLS 1.3 or TLS 1.2 with perfect forward
    secrecy cipher suites for domain endpoints.
  * api-change:``lightsail``: This release adds support to set up an HTTPS
    endpoint on an instance.
  * api-change:``opensearch``: This release adds support for new or existing
    Amazon OpenSearch domains to enable TLS 1.3 or TLS 1.2 with perfect forward
    secrecy cipher suites for domain endpoints.
  * api-change:``sagemaker``: Adding support for provisioned throughput mode
    for SageMaker Feature Groups
  * api-change:``servicecatalog``: Added Idempotency token support to Service
    Catalog  AssociateServiceActionWithProvisioningArtifact,
    DisassociateServiceActionFromProvisioningArtifact, DeleteServiceAction API
  * api-change:``endpoint-rules``: Update endpoint-rules command to latest
    version
- From 1.32.12
  * api-change:``connect``: Amazon Connect, Contact Lens Evaluation API
    increase evaluation notes max length to 3072.
  * api-change:``mediaconvert``: This release includes video engine updates
    including HEVC improvements, support for ingesting VP9 encoded video in
    MP4 containers, and support for user-specified 3D LUTs.
- From 1.32.11
  * api-change:``apprunner``: AWS App Runner adds Python 3.11 and Node.js 18
    runtimes.
  * api-change:``location``: This release introduces a new parameter to
    bypasses an API key's expiry conditions and delete the key.
  * api-change:``quicksight``: Add LinkEntityArn support for different
    partitions; Add UnsupportedUserEditionException in UpdateDashboardLinks
    API; Add support for New Reader Experience Topics
- From 1.32.10
  * api-change:``codestar-connections``: New integration with the GitLab
    self-managed provider type.
  * api-change:``kinesis-video-archived-media``: NoDataRetentionException
    thrown when GetImages requested for a Stream that does not retain data
    (that is, has a DataRetentionInHours of 0).
  * api-change:``sagemaker``: Amazon SageMaker Studio now supports Docker
    access from within app container
- From 1.32.9
  * api-change:``emr``: Update emr command to latest version
- From 1.32.8
  * api-change:``iam``: Documentation updates for AWS Identity and Access
    Management (IAM).
  * api-change:``endpoint-rules``: Update endpoint-rules command to latest
    version
- From 1.32.7
  * api-change:``bedrock-agent``: Adding Claude 2.1 support to Bedrock Agents
  * api-change:``endpoint-rules``: Update endpoint-rules command to latest
    version
  * api-change:``glue``: This release adds additional configurations for Query
    Session Context on the following APIs: GetUnfilteredTableMetadata,
    GetUnfilteredPartitionMetadata, GetUnfilteredPartitionsMetadata.
  * api-change:``lakeformation``: This release adds additional configurations
    on GetTemporaryGlueTableCredentials for Query Session Context.
  * api-change:``mediaconnect``: This release adds the DescribeSourceMetadata
    API. This API can be used to view the stream information of the flow's
    source.
  * api-change:``networkmonitor``: CloudWatch Network Monitor is a new service
    within CloudWatch that will help network administrators and operators
    continuously monitor network performance metrics such as round-trip-time
    and packet loss between their AWS-hosted applications and their on-premises
    locations.
  * api-change:``omics``: Provides minor corrections and an updated description
    of APIs.
  * api-change:``secretsmanager``: Update endpoint rules and examples.
- From 1.32.6
  * api-change:``amp``: This release updates Amazon Managed Service for
    Prometheus APIs to support customer managed KMS keys.
  * api-change:``appintegrations``: The Amazon AppIntegrations service adds
    DeleteApplication API for deleting applications, and updates APIs to
    support third party applications reacting to workspace events and make
    data requests to Amazon Connect for agent and contact events.
  * api-change:``bedrock-agent``: This release introduces Amazon Aurora as a
    vector store on Knowledge Bases for Amazon Bedrock
  * api-change:``codecommit``: AWS CodeCommit now supports customer managed
    keys from AWS Key Management Service. UpdateRepositoryEncryptionKey is
    added for updating the key configuration. CreateRepository, GetRepository,
    BatchGetRepositories are updated with new input or output parameters.
  * api-change:``connect``: Adds APIs to manage User Proficiencies and
    Predefined Attributes. Enhances StartOutboundVoiceContact API input.
    Introduces SearchContacts API. Enhances DescribeContact API. Adds an API to
    update Routing Attributes in QueuePriority and QueueTimeAdjustmentSeconds.
  * api-change:``medialive``: MediaLive now supports the ability to configure
    the audio that an AWS Elemental Link UHD device produces, when the device
    is configured as the source for a flow in AWS Elemental MediaConnect.
  * api-change:``neptune-graph``: Adds Waiters for successful creation and
    deletion of Graph, Graph Snapshot, Import Task and Private Endpoints for
    Neptune Analytics
  * api-change:``rds-data``: This release adds support for using RDS Data API
    with Aurora PostgreSQL Serverless v2 and provisioned DB clusters.
  * api-change:``rds``: This release adds support for using RDS Data API with
    Aurora PostgreSQL Serverless v2 and provisioned DB clusters.
  * api-change:``sagemaker``: Amazon SageMaker Training now provides model
    training container access for debugging purposes. Amazon SageMaker Search
    now provides the ability to use visibility conditions to limit resource
    access to a single domain or multiple domains.
- From 1.32.5
  * api-change:``appstream``: This release introduces configurable clipboard,
    allowing admins to specify the maximum length of text that can be copied by
    the users from their device to the remote session and vice-versa.
  * api-change:``eks``: Add support for cluster insights, new EKS capability
    that surfaces potentially upgrade impacting issues.
  * api-change:``guardduty``: This release 1) introduces a new API:
    GetOrganizationStatistics , and 2) adds a new UsageStatisticType
    TOP_ACCOUNTS_BY_FEATURE for GetUsageStatistics API
  * api-change:``managedblockchain-query``: Adding Confirmation Status and
    Execution Status to GetTransaction Response.
  * api-change:``mediatailor``: Adds the ability to configure time shifting on
    MediaTailor channels using the TimeShiftConfiguration field
  * api-change:``route53``: Amazon Route 53 now supports the Canada West
    (Calgary) Region (ca-west-1) for latency records, geoproximity records,
    and private DNS for Amazon VPCs in that region.
  * api-change:``endpoint-rules``: Update endpoint-rules command to latest
    version
- From 1.32.4
  * api-change:``appsync``: This release adds additional configurations on
    GraphQL APIs for limits on query depth, resolver count, and introspection
  * api-change:``chime-sdk-meetings``: Add meeting features to specify a
    maximum camera resolution, a maximum content sharing resolution, and a
    maximum number of attendees for a given meeting.
  * api-change:``ec2``: Provision BYOIPv4 address ranges and advertise them by
    specifying the network border groups option in Los Angeles, Phoenix and
    Dallas AWS Local Zones.
  * api-change:``fsx``: Added support for FSx for OpenZFS on-demand data
    replication across AWS accounts and/or regions.Added the IncludeShared
    attribute for DescribeSnapshots.Added the CopyStrategy attribute for
    OpenZFSVolumeConfiguration.
  * api-change:``marketplace-catalog``: AWS Marketplace now supports a new API,
    BatchDescribeEntities, which returns metadata and content for multiple
    entities.
  * api-change:``rds``: RDS - The release adds two new APIs:
    DescribeDBRecommendations and ModifyDBRecommendation
- From 1.32.3
  * api-change:``cognito-idp``: Amazon Cognito now supports trigger versions
    that define the fields in the request sent to pre token generation Lambda
    triggers.
  * api-change:``eks``: Add support for EKS Cluster Access Management.
  * api-change:``quicksight``: A docs-only release to add missing entities to
    the API reference.
  * api-change:``route53resolver``: Add DOH protocols in resolver endpoints.
- From 1.32.2
  * enhancement:``cloudformation package``: Add support for intrinsic
    Fn:ForEach (fixes `#8075 &lt;https://github.com/aws/aws-cli/issues/8075&gt;`__)
  * api-change:``cloud9``: Updated Cloud9 API documentation for AL2023 release
  * api-change:``connect``: Adds relatedContactId field to
    StartOutboundVoiceContact API input. Introduces PauseContact API and
    ResumeContact API for Task contacts. Adds pause duration, number of pauses,
    timestamps for last paused and resumed events to DescribeContact API
    response. Adds new Rule type and new Rule action.
  * api-change:``connectcases``: Increase number of fields that can be included
    in CaseEventIncludedData from 50 to 200
  * api-change:``kms``: Documentation updates for AWS Key Management Service
  * api-change:``rds``: Updates Amazon RDS documentation by adding code examples
  * api-change:``sagemaker``: This release 1) introduces a new API:
    DeleteCompilationJob , and 2) adds InfraCheckConfig for Create/Describe
    training job API
- From 1.32.1
  * api-change:``appstream``: This release includes support for images of
    Windows Server 2022 platform.
  * api-change:``b2bi``: Documentation updates for AWS B2B Data Interchange
  * api-change:``billingconductor``: Billing Conductor is releasing a new API,
    GetBillingGroupCostReport, which provides the ability to retrieve/view the
    Billing Group Cost Report broken down by attributes for a specific billing
    group.
  * api-change:``connect``: This release adds support for more granular
    billing using tags (key:value pairs)
  * api-change:``controltower``: Documentation updates for AWS Control Tower.
  * api-change:``firehose``: This release, 1) adds configurable buffering hints
    for the Splunk destination, and 2) reduces the minimum configurable
    buffering interval for supported destinations
  * api-change:``gamelift``: Amazon GameLift adds the ability to add and update
    the game properties of active game sessions.
  * api-change:``iot``: This release adds the ability to self-manage
    certificate signing in AWS IoT Core fleet provisioning using the new
    certificate provider resource.
  * api-change:``neptune-graph``: This is the initial SDK release for Amazon
    Neptune Analytics
  * api-change:``opensearch``: Updating documentation for Amazon OpenSearch
    Service support for new zero-ETL integration with Amazon S3.
  * api-change:``quicksight``: Update Dashboard Links support;
    SingleAxisOptions support; Scatterplot Query limit support.
  * api-change:``workspaces``: Updated note to ensure customers understand
    running modes.
  * api-change:``endpoint-rules``: Update endpoint-rules command to latest
    version
- From 1.32.0
  * feature:Python: End of support for Python 3.7
  * api-change:``drs``: Adding AgentVersion to SourceServer and
    RecoveryInstance structures
  * feature:Python: End of support for Python 3.7
- From 1.31.13
  * api-change:``imagebuilder``: This release adds the Image Workflows feature
    to give more flexibility and control over the image building and testing
    process.
  * api-change:``location``: This release 1)  adds sub-municipality field in
    Places API for searching and getting places information, and 2) allows
    optimizing route calculation based on expected arrival time.
  * api-change:``logs``: This release introduces the StartLiveTail API to tail
    ingested logs in near real time.
- From 1.31.12
  * api-change:``neptune``: This release adds a new parameter configuration
    setting to the Neptune cluster related APIs that can be leveraged to
    switch between the underlying supported storage modes.
  * api-change:``pinpoint``: This release includes Amazon Pinpoint API
    documentation updates pertaining to campaign message sending rate limits.
  * api-change:``securityhub``: Added new resource detail objects to ASFF,
    including resources for AwsDynamoDbTable, AwsEc2ClientVpnEndpoint,
    AwsMskCluster, AwsS3AccessPoint, AwsS3Bucket
  * api-change:``endpoint-rules``: Update endpoint-rules command to latest
    version</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="rjschwei@suse.com" date="1710331200">- Reconfigure the spec file support builds better in Factory and SLE
  supporting different Python interpreter versions</changelog>
</package>
<package pkgid="203ca79e4fb2f1b587df7263c9df1408e545431363515103b1151f7ab5e53bc9" name="aws-cli" arch="src">
  <version epoch="0" ver="1.32.31" rel="150400.35.3.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1674820800">- Update to version 1.27.58
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.27.58/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1675425600">- Update to version 1.27.60
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.27.60/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1675857600">- Update to version 1.27.66
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.27.66/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1676462400">- Update to version 1.27.71
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.27.71/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1677240000">- Update to version 1.27.78
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.27.78/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1678708800">- Update to version 1.27.89
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.27.89/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1680696000">- Update in SLE-15 (bsc#1209255, jsc#PED-3780)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1681905600">- Update to version 1.27.115
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.27.115/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1683633600">- Update to version 1.27.130
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.27.130/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1686744000">- Update to version 1.27.153
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.27.153/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1688040000">- Update to version 1.27.163
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.27.163/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1689076800">- Update to version 1.29.2
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.29.2/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1692273600">- Update to version 1.29.27
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.29.27/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1693396800">- Update to version 1.29.36
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.29.27/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1696593600">- Update to version 1.29.61
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.29.61/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1700827200">- Update to version 1.30.6
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.30.6/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1702296000">- Update to version 1.31.11
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.31.11/CHANGELOG.rst
- Add patch to update docutils dependency (bsc#1217336)
  + ac_update-docutils.patch
- Update Requires in spec file from setup.py</changelog>
  <changelog author="rjschwei@suse.com" date="1706702400">- Switch to Python 3.11 build in SLE 15 SP4 and openSUSE Leap 15.4 and
  later (jsc#PCT-371)
- Switch to wheel build
- Update to version 1.32.31
  * Forward port ac_update-docutils.patch
  * api-change:``datazone``: Add new skipDeletionCheck to DeleteDomain. Add
    new skipDeletionCheck to DeleteProject which also automatically deletes
    dependent objects
  * api-change:``route53``: Update the SDKs for text changes in the APIs.
- From 1.32.30
  * api-change:``autoscaling``: EC2 Auto Scaling customers who use attribute
    based instance-type selection can now intuitively define their Spot
    instances price protection limit as a percentage of the lowest priced
    On-Demand instance type.
  * api-change:``comprehend``: Comprehend PII analysis now supports Spanish
    input documents.
  * api-change:``ec2``: EC2 Fleet customers who use attribute based
    instance-type selection can now intuitively define their Spot instances
    price protection limit as a percentage of the lowest priced On-Demand
    instance type.
  * api-change:``mwaa``: This release adds MAINTENANCE environment status for
    Amazon MWAA environments.
  * api-change:``rds``: Introduced support for the
    InsufficientDBInstanceCapacityFault error in the RDS
    RestoreDBClusterFromSnapshot and RestoreDBClusterToPointInTime API methods.
    This provides enhanced error handling, ensuring a more robust experience.
  * api-change:``snowball``: Modified description of createaddress to include
    direction to add path when providing a JSON file.
- From 1.32.29
  * api-change:``connect``: Update list and string length limits for predefined
    attributes.
  * api-change:``inspector2``: This release adds ECR container image scanning
    based on their lastRecordedPullTime.
  * api-change:``sagemaker``: Amazon SageMaker Automatic Model Tuning now
    provides an API to programmatically delete tuning jobs.
- From 1.32.28
  * api-change:``acm-pca``: AWS Private CA now supports an option to omit the
    CDP extension from issued certificates, when CRL revocation is enabled.
  * api-change:``lightsail``: This release adds support for IPv6-only instance
    plans.
- From 1.32.27
  * api-change:``ec2``: Introduced a new clientToken request parameter on
    CreateNetworkAcl and CreateRouteTable APIs. The clientToken parameter
    allows idempotent operations on the APIs.
  * api-change:``ecs``: Documentation updates for Amazon ECS.
  * api-change:``outposts``: DeviceSerialNumber parameter is now optional in
    StartConnection API
  * api-change:``rds``: This release adds support for Aurora Limitless Database.
  * api-change:``storagegateway``: Add DeprecationDate and SoftwareVersion to
    response of ListGateways.
- From 1.32.26
  * api-change:``inspector2``: This release adds support for CIS scans on EC2
    instances.
- From 1.32.25
  * bugfix:``s3 sync``: Disable S3 Express support for s3 sync command
- From 1.32.24
  * api-change:``appconfigdata``: Fix FIPS Endpoints in aws-us-gov.
  * api-change:``cloud9``: Doc-only update around removing AL1 from list of
    available AMIs for Cloud9
  * api-change:``cloudfront-keyvaluestore``: This release improves upon the
    DescribeKeyValueStore API by returning two additional fields, Status of the
    KeyValueStore and the FailureReason in case of failures during creation of
    KeyValueStore.
  * api-change:``connectcases``: This release adds the ability to view audit
    history on a case and introduces a new parameter, performedBy, for
    CreateCase and UpdateCase API's.
  * api-change:``ec2``: Documentation updates for Amazon EC2.
  * api-change:``ecs``: This release adds support for Transport Layer Security
    (TLS) and Configurable Timeout to ECS Service Connect. TLS facilitates
    privacy and data security for inter-service communications, while
    Configurable Timeout allows customized per-request timeout and idle timeout
    for Service Connect services.
  * api-change:``finspace``: Allow customer to set zip default through command
    line arguments.
  * api-change:``organizations``: Doc only update for quota increase change
  * api-change:``rds``: Introduced support for the
    InsufficientDBInstanceCapacityFault error in the RDS CreateDBCluster API
    method. This provides enhanced error handling, ensuring a more robust
    experience when creating database clusters with insufficient instance
    capacity.
  * api-change:``endpoint-rules``: Update endpoint-rules command to latest
    version
- From 1.32.23
  * api-change:``athena``: Introducing new NotebookS3LocationUri parameter to
    Athena ImportNotebook API. Payload is no longer required and either Payload
    or NotebookS3LocationUri needs to be provided (not both) for a successful
    ImportNotebook API call. If both are provided, an InvalidRequestException
    will be thrown.
  * api-change:``codebuild``: Release CodeBuild Reserved Capacity feature
  * api-change:``dynamodb``: This release adds support for including
    ApproximateCreationDateTimePrecision configurations in
    EnableKinesisStreamingDestination API, adds the same as an optional field
    in the response of DescribeKinesisStreamingDestination, and adds support
    for a new UpdateKinesisStreamingDestination API.
  * api-change:``qconnect``: Increased Quick Response name max length to 100
- From 1.32.22
  * api-change:``b2bi``: Increasing TestMapping inputFileContent file size
    limit to 5MB and adding file size limit 250KB for TestParsing input file.
    This release also includes exposing InternalServerException for Tag APIs.
  * api-change:``cloudtrail``: This release adds a new API
    ListInsightsMetricData to retrieve metric data from CloudTrail Insights.
  * api-change:``connect``: GetMetricDataV2 now supports 3 groupings
  * api-change:``drs``: Removed invalid and unnecessary default values.
  * api-change:``firehose``: Allow support for Snowflake as a Kinesis Data
    Firehose delivery destination.
  * api-change:``sagemaker-featurestore-runtime``: Increase BatchGetRecord
    limits from 10 items to 100 items
- From 1.32.21
  * api-change:``dynamodb``: Updating note for enabling streams for UpdateTable.
  * api-change:``keyspaces``: This release adds support for Multi-Region
    Replication with provisioned tables, and Keyspaces auto scaling APIs
- From 1.32.20
  * api-change:``iot``: Revert release of LogTargetTypes
  * api-change:``iotfleetwise``: Updated APIs: SignalNodeType query parameter
    has been added to ListSignalCatalogNodesRequest and ListVehiclesResponse
    has been extended with attributes field.
  * api-change:``macie2``: This release adds support for analyzing Amazon S3
    objects that are encrypted using dual-layer server-side encryption with
    AWS KMS keys (DSSE-KMS). It also adds support for reporting DSSE-KMS
    details in statistics and metadata about encryption settings for S3 buckets
    and objects.
  * api-change:``payment-cryptography``: Provide an additional option for key
    exchange using RSA wrap/unwrap in addition to tr-34/tr-31 in ImportKey and
    ExportKey operations. Added new key usage (type)
    TR31_M1_ISO_9797_1_MAC_KEY, for use with Generate/VerifyMac dataplane
    operations  with ISO9797 Algorithm 1 MAC calculations.
  * api-change:``personalize-runtime``: Documentation updates for Amazon
    Personalize
  * api-change:``personalize``: Documentation updates for Amazon Personalize.
  * api-change:``rekognition``: This release adds ContentType and TaxonomyLevel
    attributes to DetectModerationLabels and GetMediaAnalysisJob API responses.
  * api-change:``securityhub``: Documentation updates for AWS Security Hub
- From 1.32.19
  * api-change:``sagemaker``: This release will have ValidationException thrown
    if certain invalid app types are provided. The release will also throw
    ValidationException if more than 10 account ids are provided in
    VpcOnlyTrustedAccounts.
- From 1.32.18
  * api-change:``connect``: Supervisor Barge for Chat is now supported through
    the MonitorContact API.
  * api-change:``connectparticipant``: Introduce new Supervisor participant
    role
  * api-change:``location``: Location SDK documentation update. Added missing
    fonts to the MapConfiguration data type. Updated note for the
    SubMunicipality property in the place data type.
  * api-change:``mwaa``: This Amazon MWAA feature release includes new fields
    in CreateWebLoginToken response model. The new fields IamIdentity and
    AirflowIdentity will let you match identifications, as the Airflow identity
    length is currently hashed to 64 characters.
  * api-change:``s3control``: S3 On Outposts team adds dualstack endpoints
    support for S3Control and S3Outposts API calls.
  * api-change:``supplychain``: This release includes APIs
    CreateBillOfMaterialsImportJob and GetBillOfMaterialsImportJob.
  * api-change:``transfer``: AWS Transfer Family now supports static IP
    addresses for SFTP &amp; AS2 connectors and for async MDNs on AS2 servers.
  * api-change:``endpoint-rules``: Update endpoint-rules command to latest
    version
- From 1.32.17
  * api-change:``ec2``: This release adds support for adding an
    ElasticBlockStorage volume configurations in ECS
    RunTask/StartTask/CreateService/UpdateService APIs. The configuration
    allows for attaching EBS volumes to ECS Tasks.
  * api-change:``ecs``: This release adds support for adding an
    ElasticBlockStorage volume configurations in ECS
    RunTask/StartTask/CreateService/UpdateService APIs. The configuration
    allows for attaching EBS volumes to ECS Tasks.
  * api-change:``events``: Update events command to latest version
  * api-change:``iot``: Add ConflictException to Update APIs of AWS IoT
    Software Package Catalog
  * api-change:``iotfleetwise``: The following dataTypes have been removed:
    CUSTOMER_DECODED_INTERFACE in NetworkInterfaceType;
    CUSTOMER_DECODED_SIGNAL_INFO_IS_NULL in SignalDecoderFailureReason;
    CUSTOMER_DECODED_SIGNAL_NETWORK_INTERFACE_INFO_IS_NULL in
    NetworkInterfaceFailureReason; CUSTOMER_DECODED_SIGNAL in SignalDecoderType
  * api-change:``secretsmanager``: Doc only update for Secrets Manager
  * api-change:``workspaces``: Added AWS Workspaces RebootWorkspaces
    API - Extended Reboot documentation update
- From 1.32.16
  * api-change:``connectcampaigns``: Minor pattern updates for Campaign and
    Dial Request API fields.
  * api-change:``location``: This release adds API support for custom layers
    for the maps service APIs: CreateMap, UpdateMap, DescribeMap.
  * api-change:``logs``: Add support for account level subscription filter
    policies to PutAccountPolicy, DescribeAccountPolicies, and
    DeleteAccountPolicy APIs. Additionally, PutAccountPolicy has been modified
    with new optional "selectionCriteria" parameter for resource selection.
  * api-change:``qconnect``: QueryAssistant and GetRecommendations will be
    discontinued starting June 1, 2024. To receive generative responses after
    March 1, 2024 you will need to create a new Assistant in the Connect
    console and integrate the Amazon Q in Connect JavaScript library
    (amazon-q-connectjs) into your applications.
  * api-change:``redshift-serverless``: Updates to ConfigParameter for RSS
    workgroup, removal of use_fips_ssl
  * api-change:``route53``: Route53 now supports geoproximity routing in AWS
    regions
  * api-change:``wisdom``: QueryAssistant and GetRecommendations will be
    discontinued starting June 1, 2024. To receive generative responses after
    March 1, 2024 you will need to create a new Assistant in the Connect
    console and integrate the Amazon Q in Connect JavaScript library
    (amazon-q-connectjs) into your applications.
- From 1.32.15
  * api-change:``codebuild``: Aws CodeBuild now supports new compute type
    BUILD_GENERAL1_XLARGE
  * api-change:``ec2``: Amazon EC2 R7iz bare metal instances are powered by
    custom 4th generation Intel Xeon Scalable processors.
  * api-change:``route53resolver``: This release adds support for query type
    configuration on firewall rules that enables customers for granular action
    (ALLOW, ALERT, BLOCK) by DNS query type.
- From 1.32.14
  * api-change:``connect``: Minor trait updates for User APIs
  * api-change:``kms``: Documentation updates for AWS Key Management Service
    (KMS).
  * api-change:``redshift-serverless``: use_fips_ssl and require_ssl parameter
    support for Workgroup, UpdateWorkgroup, and CreateWorkgroup
- From 1.32.13
  * api-change:``config``: Updated ResourceType enum with new resource types onboarded by AWS Config in November and December 2023.
  * api-change:``docdb``: Adding PerformanceInsightsEnabled and
    PerformanceInsightsKMSKeyId fields to DescribeDBInstances Response.
  * api-change:``ecs``: This release adds support for managed instance
    draining which facilitates graceful termination of Amazon ECS instances.
  * api-change:``es``: This release adds support for new or existing Amazon
    OpenSearch domains to enable TLS 1.3 or TLS 1.2 with perfect forward
    secrecy cipher suites for domain endpoints.
  * api-change:``lightsail``: This release adds support to set up an HTTPS
    endpoint on an instance.
  * api-change:``opensearch``: This release adds support for new or existing
    Amazon OpenSearch domains to enable TLS 1.3 or TLS 1.2 with perfect forward
    secrecy cipher suites for domain endpoints.
  * api-change:``sagemaker``: Adding support for provisioned throughput mode
    for SageMaker Feature Groups
  * api-change:``servicecatalog``: Added Idempotency token support to Service
    Catalog  AssociateServiceActionWithProvisioningArtifact,
    DisassociateServiceActionFromProvisioningArtifact, DeleteServiceAction API
  * api-change:``endpoint-rules``: Update endpoint-rules command to latest
    version
- From 1.32.12
  * api-change:``connect``: Amazon Connect, Contact Lens Evaluation API
    increase evaluation notes max length to 3072.
  * api-change:``mediaconvert``: This release includes video engine updates
    including HEVC improvements, support for ingesting VP9 encoded video in
    MP4 containers, and support for user-specified 3D LUTs.
- From 1.32.11
  * api-change:``apprunner``: AWS App Runner adds Python 3.11 and Node.js 18
    runtimes.
  * api-change:``location``: This release introduces a new parameter to
    bypasses an API key's expiry conditions and delete the key.
  * api-change:``quicksight``: Add LinkEntityArn support for different
    partitions; Add UnsupportedUserEditionException in UpdateDashboardLinks
    API; Add support for New Reader Experience Topics
- From 1.32.10
  * api-change:``codestar-connections``: New integration with the GitLab
    self-managed provider type.
  * api-change:``kinesis-video-archived-media``: NoDataRetentionException
    thrown when GetImages requested for a Stream that does not retain data
    (that is, has a DataRetentionInHours of 0).
  * api-change:``sagemaker``: Amazon SageMaker Studio now supports Docker
    access from within app container
- From 1.32.9
  * api-change:``emr``: Update emr command to latest version
- From 1.32.8
  * api-change:``iam``: Documentation updates for AWS Identity and Access
    Management (IAM).
  * api-change:``endpoint-rules``: Update endpoint-rules command to latest
    version
- From 1.32.7
  * api-change:``bedrock-agent``: Adding Claude 2.1 support to Bedrock Agents
  * api-change:``endpoint-rules``: Update endpoint-rules command to latest
    version
  * api-change:``glue``: This release adds additional configurations for Query
    Session Context on the following APIs: GetUnfilteredTableMetadata,
    GetUnfilteredPartitionMetadata, GetUnfilteredPartitionsMetadata.
  * api-change:``lakeformation``: This release adds additional configurations
    on GetTemporaryGlueTableCredentials for Query Session Context.
  * api-change:``mediaconnect``: This release adds the DescribeSourceMetadata
    API. This API can be used to view the stream information of the flow's
    source.
  * api-change:``networkmonitor``: CloudWatch Network Monitor is a new service
    within CloudWatch that will help network administrators and operators
    continuously monitor network performance metrics such as round-trip-time
    and packet loss between their AWS-hosted applications and their on-premises
    locations.
  * api-change:``omics``: Provides minor corrections and an updated description
    of APIs.
  * api-change:``secretsmanager``: Update endpoint rules and examples.
- From 1.32.6
  * api-change:``amp``: This release updates Amazon Managed Service for
    Prometheus APIs to support customer managed KMS keys.
  * api-change:``appintegrations``: The Amazon AppIntegrations service adds
    DeleteApplication API for deleting applications, and updates APIs to
    support third party applications reacting to workspace events and make
    data requests to Amazon Connect for agent and contact events.
  * api-change:``bedrock-agent``: This release introduces Amazon Aurora as a
    vector store on Knowledge Bases for Amazon Bedrock
  * api-change:``codecommit``: AWS CodeCommit now supports customer managed
    keys from AWS Key Management Service. UpdateRepositoryEncryptionKey is
    added for updating the key configuration. CreateRepository, GetRepository,
    BatchGetRepositories are updated with new input or output parameters.
  * api-change:``connect``: Adds APIs to manage User Proficiencies and
    Predefined Attributes. Enhances StartOutboundVoiceContact API input.
    Introduces SearchContacts API. Enhances DescribeContact API. Adds an API to
    update Routing Attributes in QueuePriority and QueueTimeAdjustmentSeconds.
  * api-change:``medialive``: MediaLive now supports the ability to configure
    the audio that an AWS Elemental Link UHD device produces, when the device
    is configured as the source for a flow in AWS Elemental MediaConnect.
  * api-change:``neptune-graph``: Adds Waiters for successful creation and
    deletion of Graph, Graph Snapshot, Import Task and Private Endpoints for
    Neptune Analytics
  * api-change:``rds-data``: This release adds support for using RDS Data API
    with Aurora PostgreSQL Serverless v2 and provisioned DB clusters.
  * api-change:``rds``: This release adds support for using RDS Data API with
    Aurora PostgreSQL Serverless v2 and provisioned DB clusters.
  * api-change:``sagemaker``: Amazon SageMaker Training now provides model
    training container access for debugging purposes. Amazon SageMaker Search
    now provides the ability to use visibility conditions to limit resource
    access to a single domain or multiple domains.
- From 1.32.5
  * api-change:``appstream``: This release introduces configurable clipboard,
    allowing admins to specify the maximum length of text that can be copied by
    the users from their device to the remote session and vice-versa.
  * api-change:``eks``: Add support for cluster insights, new EKS capability
    that surfaces potentially upgrade impacting issues.
  * api-change:``guardduty``: This release 1) introduces a new API:
    GetOrganizationStatistics , and 2) adds a new UsageStatisticType
    TOP_ACCOUNTS_BY_FEATURE for GetUsageStatistics API
  * api-change:``managedblockchain-query``: Adding Confirmation Status and
    Execution Status to GetTransaction Response.
  * api-change:``mediatailor``: Adds the ability to configure time shifting on
    MediaTailor channels using the TimeShiftConfiguration field
  * api-change:``route53``: Amazon Route 53 now supports the Canada West
    (Calgary) Region (ca-west-1) for latency records, geoproximity records,
    and private DNS for Amazon VPCs in that region.
  * api-change:``endpoint-rules``: Update endpoint-rules command to latest
    version
- From 1.32.4
  * api-change:``appsync``: This release adds additional configurations on
    GraphQL APIs for limits on query depth, resolver count, and introspection
  * api-change:``chime-sdk-meetings``: Add meeting features to specify a
    maximum camera resolution, a maximum content sharing resolution, and a
    maximum number of attendees for a given meeting.
  * api-change:``ec2``: Provision BYOIPv4 address ranges and advertise them by
    specifying the network border groups option in Los Angeles, Phoenix and
    Dallas AWS Local Zones.
  * api-change:``fsx``: Added support for FSx for OpenZFS on-demand data
    replication across AWS accounts and/or regions.Added the IncludeShared
    attribute for DescribeSnapshots.Added the CopyStrategy attribute for
    OpenZFSVolumeConfiguration.
  * api-change:``marketplace-catalog``: AWS Marketplace now supports a new API,
    BatchDescribeEntities, which returns metadata and content for multiple
    entities.
  * api-change:``rds``: RDS - The release adds two new APIs:
    DescribeDBRecommendations and ModifyDBRecommendation
- From 1.32.3
  * api-change:``cognito-idp``: Amazon Cognito now supports trigger versions
    that define the fields in the request sent to pre token generation Lambda
    triggers.
  * api-change:``eks``: Add support for EKS Cluster Access Management.
  * api-change:``quicksight``: A docs-only release to add missing entities to
    the API reference.
  * api-change:``route53resolver``: Add DOH protocols in resolver endpoints.
- From 1.32.2
  * enhancement:``cloudformation package``: Add support for intrinsic
    Fn:ForEach (fixes `#8075 &lt;https://github.com/aws/aws-cli/issues/8075&gt;`__)
  * api-change:``cloud9``: Updated Cloud9 API documentation for AL2023 release
  * api-change:``connect``: Adds relatedContactId field to
    StartOutboundVoiceContact API input. Introduces PauseContact API and
    ResumeContact API for Task contacts. Adds pause duration, number of pauses,
    timestamps for last paused and resumed events to DescribeContact API
    response. Adds new Rule type and new Rule action.
  * api-change:``connectcases``: Increase number of fields that can be included
    in CaseEventIncludedData from 50 to 200
  * api-change:``kms``: Documentation updates for AWS Key Management Service
  * api-change:``rds``: Updates Amazon RDS documentation by adding code examples
  * api-change:``sagemaker``: This release 1) introduces a new API:
    DeleteCompilationJob , and 2) adds InfraCheckConfig for Create/Describe
    training job API
- From 1.32.1
  * api-change:``appstream``: This release includes support for images of
    Windows Server 2022 platform.
  * api-change:``b2bi``: Documentation updates for AWS B2B Data Interchange
  * api-change:``billingconductor``: Billing Conductor is releasing a new API,
    GetBillingGroupCostReport, which provides the ability to retrieve/view the
    Billing Group Cost Report broken down by attributes for a specific billing
    group.
  * api-change:``connect``: This release adds support for more granular
    billing using tags (key:value pairs)
  * api-change:``controltower``: Documentation updates for AWS Control Tower.
  * api-change:``firehose``: This release, 1) adds configurable buffering hints
    for the Splunk destination, and 2) reduces the minimum configurable
    buffering interval for supported destinations
  * api-change:``gamelift``: Amazon GameLift adds the ability to add and update
    the game properties of active game sessions.
  * api-change:``iot``: This release adds the ability to self-manage
    certificate signing in AWS IoT Core fleet provisioning using the new
    certificate provider resource.
  * api-change:``neptune-graph``: This is the initial SDK release for Amazon
    Neptune Analytics
  * api-change:``opensearch``: Updating documentation for Amazon OpenSearch
    Service support for new zero-ETL integration with Amazon S3.
  * api-change:``quicksight``: Update Dashboard Links support;
    SingleAxisOptions support; Scatterplot Query limit support.
  * api-change:``workspaces``: Updated note to ensure customers understand
    running modes.
  * api-change:``endpoint-rules``: Update endpoint-rules command to latest
    version
- From 1.32.0
  * feature:Python: End of support for Python 3.7
  * api-change:``drs``: Adding AgentVersion to SourceServer and
    RecoveryInstance structures
  * feature:Python: End of support for Python 3.7
- From 1.31.13
  * api-change:``imagebuilder``: This release adds the Image Workflows feature
    to give more flexibility and control over the image building and testing
    process.
  * api-change:``location``: This release 1)  adds sub-municipality field in
    Places API for searching and getting places information, and 2) allows
    optimizing route calculation based on expected arrival time.
  * api-change:``logs``: This release introduces the StartLiveTail API to tail
    ingested logs in near real time.
- From 1.31.12
  * api-change:``neptune``: This release adds a new parameter configuration
    setting to the Neptune cluster related APIs that can be leveraged to
    switch between the underlying supported storage modes.
  * api-change:``pinpoint``: This release includes Amazon Pinpoint API
    documentation updates pertaining to campaign message sending rate limits.
  * api-change:``securityhub``: Added new resource detail objects to ASFF,
    including resources for AwsDynamoDbTable, AwsEc2ClientVpnEndpoint,
    AwsMskCluster, AwsS3AccessPoint, AwsS3Bucket
  * api-change:``endpoint-rules``: Update endpoint-rules command to latest
    version</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="rjschwei@suse.com" date="1710331200">- Reconfigure the spec file support builds better in Factory and SLE
  supporting different Python interpreter versions</changelog>
</package>
<package pkgid="a4dcc3b3d0ccf84f536848f87dcf1cc944c5a5cb45776b474f7120a1d9213f6f" name="aws-nitro-enclaves-binaryblobs-upstream" arch="aarch64">
  <version epoch="0" ver="1.3.0~git1.db34c02" rel="150600.10.3.1"/>
  <changelog author="olaf@aepfle.de" date="1637582400">- Initial version 1.1.0~git8.a46465e (bsc#1179544, jsc#SLE-22954)</changelog>
  <changelog author="olaf@aepfle.de" date="1639483200">- Update to version 1.1.0~git16.860cfe4 to get all the precious cargo
  (bsc#1195053)</changelog>
  <changelog author="olaf@aepfle.de" date="1643025600">- Update to version 1.1.0~git32.8f6ed74 to get all the precious cargo
- init.c is maintained in aws-nitro-enclaves-sdk-bootstrap.git</changelog>
  <changelog author="olaf@aepfle.de" date="1647518400">- Update to version 1.2.0~git2.841ef94 to get all the precious cargo
  (bsc#1196972, CVE-2022-24713)</changelog>
  <changelog author="olaf@aepfle.de" date="1677844800">- Update to version 1.2.2~git0.4ccc639 to get all the precious cargo
  (bsc#1208555, CVE-2022-31394)</changelog>
  <changelog author="olaf@aepfle.de" date="1712232000">- Update to version 1.2.3~git11.d3d77e0 to get all the precious cargo
  (bsc#1218501, CVE-2023-50711)</changelog>
  <changelog author="olaf@aepfle.de" date="1714478400">- Update to version 1.3.0~git0.be13960</changelog>
  <changelog author="olaf@aepfle.de" date="1716379200">- Update to version 1.3.0~git1.db34c02
- Update aws-nitro-enclaves-sdk-bootstrap to version v1.0.0 (203242d5)</changelog>
</package>
<package pkgid="7cfc2ebc5d95a7e714920729aae6acf830f418d19c745507b7c2198f47992734" name="aws-nitro-enclaves-binaryblobs-upstream" arch="x86_64">
  <version epoch="0" ver="1.3.0~git1.db34c02" rel="150600.10.3.1"/>
  <changelog author="olaf@aepfle.de" date="1637582400">- Initial version 1.1.0~git8.a46465e (bsc#1179544, jsc#SLE-22954)</changelog>
  <changelog author="olaf@aepfle.de" date="1639483200">- Update to version 1.1.0~git16.860cfe4 to get all the precious cargo
  (bsc#1195053)</changelog>
  <changelog author="olaf@aepfle.de" date="1643025600">- Update to version 1.1.0~git32.8f6ed74 to get all the precious cargo
- init.c is maintained in aws-nitro-enclaves-sdk-bootstrap.git</changelog>
  <changelog author="olaf@aepfle.de" date="1647518400">- Update to version 1.2.0~git2.841ef94 to get all the precious cargo
  (bsc#1196972, CVE-2022-24713)</changelog>
  <changelog author="olaf@aepfle.de" date="1677844800">- Update to version 1.2.2~git0.4ccc639 to get all the precious cargo
  (bsc#1208555, CVE-2022-31394)</changelog>
  <changelog author="olaf@aepfle.de" date="1712232000">- Update to version 1.2.3~git11.d3d77e0 to get all the precious cargo
  (bsc#1218501, CVE-2023-50711)</changelog>
  <changelog author="olaf@aepfle.de" date="1714478400">- Update to version 1.3.0~git0.be13960</changelog>
  <changelog author="olaf@aepfle.de" date="1716379200">- Update to version 1.3.0~git1.db34c02
- Update aws-nitro-enclaves-sdk-bootstrap to version v1.0.0 (203242d5)</changelog>
</package>
<package pkgid="854ecd3e41c450a97aeafe1bd9d17365a711efd9603b0a17de97a81574ed13cd" name="aws-nitro-enclaves-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~git1.db34c02" rel="150600.10.3.1"/>
  <changelog author="olaf@aepfle.de" date="1637582400">- Initial version 1.1.0~git8.a46465e (bsc#1179544, jsc#SLE-22954)</changelog>
  <changelog author="olaf@aepfle.de" date="1639483200">- Update to version 1.1.0~git16.860cfe4 to get all the precious cargo
  (bsc#1195053)</changelog>
  <changelog author="olaf@aepfle.de" date="1643025600">- Update to version 1.1.0~git32.8f6ed74 to get all the precious cargo
- init.c is maintained in aws-nitro-enclaves-sdk-bootstrap.git</changelog>
  <changelog author="olaf@aepfle.de" date="1647518400">- Update to version 1.2.0~git2.841ef94 to get all the precious cargo
  (bsc#1196972, CVE-2022-24713)</changelog>
  <changelog author="olaf@aepfle.de" date="1677844800">- Update to version 1.2.2~git0.4ccc639 to get all the precious cargo
  (bsc#1208555, CVE-2022-31394)</changelog>
  <changelog author="olaf@aepfle.de" date="1712232000">- Update to version 1.2.3~git11.d3d77e0 to get all the precious cargo
  (bsc#1218501, CVE-2023-50711)</changelog>
  <changelog author="olaf@aepfle.de" date="1714478400">- Update to version 1.3.0~git0.be13960</changelog>
  <changelog author="olaf@aepfle.de" date="1716379200">- Update to version 1.3.0~git1.db34c02
- Update aws-nitro-enclaves-sdk-bootstrap to version v1.0.0 (203242d5)</changelog>
</package>
<package pkgid="7d324ee70ea4fb2ef8993fd408403734b4de995d8a2acd76a496092256daa63c" name="aws-nitro-enclaves-cli" arch="src">
  <version epoch="0" ver="1.3.0~git1.db34c02" rel="150600.10.3.1"/>
  <changelog author="olaf@aepfle.de" date="1637582400">- Initial version 1.1.0~git8.a46465e (bsc#1179544, jsc#SLE-22954)</changelog>
  <changelog author="olaf@aepfle.de" date="1639483200">- Update to version 1.1.0~git16.860cfe4 to get all the precious cargo
  (bsc#1195053)</changelog>
  <changelog author="olaf@aepfle.de" date="1643025600">- Update to version 1.1.0~git32.8f6ed74 to get all the precious cargo
- init.c is maintained in aws-nitro-enclaves-sdk-bootstrap.git</changelog>
  <changelog author="olaf@aepfle.de" date="1647518400">- Update to version 1.2.0~git2.841ef94 to get all the precious cargo
  (bsc#1196972, CVE-2022-24713)</changelog>
  <changelog author="olaf@aepfle.de" date="1677844800">- Update to version 1.2.2~git0.4ccc639 to get all the precious cargo
  (bsc#1208555, CVE-2022-31394)</changelog>
  <changelog author="olaf@aepfle.de" date="1712232000">- Update to version 1.2.3~git11.d3d77e0 to get all the precious cargo
  (bsc#1218501, CVE-2023-50711)</changelog>
  <changelog author="olaf@aepfle.de" date="1714478400">- Update to version 1.3.0~git0.be13960</changelog>
  <changelog author="olaf@aepfle.de" date="1716379200">- Update to version 1.3.0~git1.db34c02
- Update aws-nitro-enclaves-sdk-bootstrap to version v1.0.0 (203242d5)</changelog>
</package>
<package pkgid="e643f5644ab298513732c28bad6f7099eb30df2e91fc68238ef24de43e3027b4" name="aws-nitro-enclaves-cli" arch="x86_64">
  <version epoch="0" ver="1.3.0~git1.db34c02" rel="150600.10.3.1"/>
  <changelog author="olaf@aepfle.de" date="1637582400">- Initial version 1.1.0~git8.a46465e (bsc#1179544, jsc#SLE-22954)</changelog>
  <changelog author="olaf@aepfle.de" date="1639483200">- Update to version 1.1.0~git16.860cfe4 to get all the precious cargo
  (bsc#1195053)</changelog>
  <changelog author="olaf@aepfle.de" date="1643025600">- Update to version 1.1.0~git32.8f6ed74 to get all the precious cargo
- init.c is maintained in aws-nitro-enclaves-sdk-bootstrap.git</changelog>
  <changelog author="olaf@aepfle.de" date="1647518400">- Update to version 1.2.0~git2.841ef94 to get all the precious cargo
  (bsc#1196972, CVE-2022-24713)</changelog>
  <changelog author="olaf@aepfle.de" date="1677844800">- Update to version 1.2.2~git0.4ccc639 to get all the precious cargo
  (bsc#1208555, CVE-2022-31394)</changelog>
  <changelog author="olaf@aepfle.de" date="1712232000">- Update to version 1.2.3~git11.d3d77e0 to get all the precious cargo
  (bsc#1218501, CVE-2023-50711)</changelog>
  <changelog author="olaf@aepfle.de" date="1714478400">- Update to version 1.3.0~git0.be13960</changelog>
  <changelog author="olaf@aepfle.de" date="1716379200">- Update to version 1.3.0~git1.db34c02
- Update aws-nitro-enclaves-sdk-bootstrap to version v1.0.0 (203242d5)</changelog>
</package>
<package pkgid="9788e9c7cdea596d7aacde59f12e8f8dd55ba545547ac7b720eb7a0e2b41c5ea" name="azure-cli" arch="noarch">
  <version epoch="0" ver="2.58.0" rel="150400.14.6.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1673352000">- New upstream release
  + Version 2.44.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1674043200">- New upstream release
  + Version 2.44.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1675944000">- New upstream release
  + Version 2.45.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1678190400">- New upstream release (bsc#1199592)
  + Version 2.46.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1680609600">- New upstream release
  + Version 2.47.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1683115200">- New upstream release
  + Version 2.48.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1684929600">- New upstream release
  + Version 2.49.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1688644800">- New upstream release
  + Version 2.50.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1692014400">- New upstream release
  + Version 2.51.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1694088000">- New upstream release
  + Version 2.52.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1696420800">- New upstream release
  + Version 2.53.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1698667200">- New upstream release
  + Version 2.53.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1700049600">- New upstream release
  + Version 2.54.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1704283200">- New upstream release
  + Version 2.55.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1705579200">- New upstream release
  + Version 2.56.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1707307200">- New upstream release
  + Version 2.57.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1709726400">- New upstream release
  + Version 2.58.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1712232000">- Switch package to modern Python Stack on SLE-15
  + Use Python 3.11 on SLE-15 by default
  + Use primary Python version on Tumbleweed
- Switch build system from setuptools to pyproject.toml
  + Add python-pip and python-wheel to BuildRequires
  + Replace %python_build with %pyproject_wheel
  + Replace %python_install with %pyproject_install
  + Update name for dist directory in %files section</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1715083200">- Add Obsoletes for python3-azure-functions-devops-build package on SLE-15
- Remove azure-cli-command-modules-nspkg from BuildRequires and Requires</changelog>
</package>
<package pkgid="6d4687b8958fa80bba11f72daee171a0d9a89c2a0d9f940c4bbbbadae106b71b" name="azure-cli" arch="src">
  <version epoch="0" ver="2.58.0" rel="150400.14.6.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1673352000">- New upstream release
  + Version 2.44.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1674043200">- New upstream release
  + Version 2.44.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1675944000">- New upstream release
  + Version 2.45.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1678190400">- New upstream release (bsc#1199592)
  + Version 2.46.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1680609600">- New upstream release
  + Version 2.47.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1683115200">- New upstream release
  + Version 2.48.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1684929600">- New upstream release
  + Version 2.49.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1688644800">- New upstream release
  + Version 2.50.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1692014400">- New upstream release
  + Version 2.51.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1694088000">- New upstream release
  + Version 2.52.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1696420800">- New upstream release
  + Version 2.53.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1698667200">- New upstream release
  + Version 2.53.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1700049600">- New upstream release
  + Version 2.54.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1704283200">- New upstream release
  + Version 2.55.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1705579200">- New upstream release
  + Version 2.56.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1707307200">- New upstream release
  + Version 2.57.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1709726400">- New upstream release
  + Version 2.58.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1712232000">- Switch package to modern Python Stack on SLE-15
  + Use Python 3.11 on SLE-15 by default
  + Use primary Python version on Tumbleweed
- Switch build system from setuptools to pyproject.toml
  + Add python-pip and python-wheel to BuildRequires
  + Replace %python_build with %pyproject_wheel
  + Replace %python_install with %pyproject_install
  + Update name for dist directory in %files section</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1715083200">- Add Obsoletes for python3-azure-functions-devops-build package on SLE-15
- Remove azure-cli-command-modules-nspkg from BuildRequires and Requires</changelog>
</package>
<package pkgid="df74fc7e62af29cb427cb4d548d832eb4e2eed29f845d4893988ea6df820330b" name="azure-cli-core" arch="noarch">
  <version epoch="0" ver="2.58.0" rel="150400.14.3.2"/>
  <changelog author="adrian.glaubitz@suse.com" date="1670328000">- New upstream release
  + Version 2.43.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1673352000">- New upstream release
  + Version 2.44.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Drop patches for issues fixed upstream
  + acc_update-argcomplete.patch
- Relax version dependency for python-packaging
  in BuildRequires (bsc#1206869)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1674043200">- New upstream release
  + Version 2.44.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1675944000">- New upstream release
  + Version 2.45.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1678190400">- New upstream release (bsc#1199592)
  + Version 2.46.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1680609600">- New upstream release
  + Version 2.47.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1683115200">- New upstream release
  + Version 2.48.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1684929600">- New upstream release
  + Version 2.49.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Add patch to update argcomplete dependency (bsc#1206869)
  + acc_update-argcomplete.patch
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1688644800">- New upstream release
  + Version 2.50.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Drop patches for issues fixed upstream
  + acc_update-argcomplete.patch
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1692014400">- New upstream release
  + Version 2.51.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1694088000">- New upstream release
  + Version 2.52.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1696420800">- New upstream release
  + Version 2.53.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1698667200">- New upstream release
  + Version 2.53.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1700049600">- New upstream release
  + Version 2.54.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1704283200">- New upstream release
  + Version 2.55.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1705579200">- New upstream release
  + Version 2.56.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1707307200">- New upstream release
  + Version 2.57.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1709726400">- New upstream release
  + Version 2.58.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1712232000">- Switch package to modern Python Stack on SLE-15
  + Use Python 3.11 on SLE-15 by default
  + Use primary Python version on Tumbleweed
  + Drop support for older Python versions
- Switch build system from setuptools to pyproject.toml
  + Add python-pip and python-wheel to BuildRequires
  + Replace %python_build with %pyproject_wheel
  + Replace %python_install with %pyproject_install
  + Update name for dist directory in %files section</changelog>
</package>
<package pkgid="74a51eecab7ac953ddbc1afc31693dd01c6b57b11037509d0f79c97a744acab2" name="azure-cli-core" arch="src">
  <version epoch="0" ver="2.58.0" rel="150400.14.3.2"/>
  <changelog author="adrian.glaubitz@suse.com" date="1670328000">- New upstream release
  + Version 2.43.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1673352000">- New upstream release
  + Version 2.44.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Drop patches for issues fixed upstream
  + acc_update-argcomplete.patch
- Relax version dependency for python-packaging
  in BuildRequires (bsc#1206869)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1674043200">- New upstream release
  + Version 2.44.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1675944000">- New upstream release
  + Version 2.45.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1678190400">- New upstream release (bsc#1199592)
  + Version 2.46.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1680609600">- New upstream release
  + Version 2.47.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1683115200">- New upstream release
  + Version 2.48.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1684929600">- New upstream release
  + Version 2.49.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Add patch to update argcomplete dependency (bsc#1206869)
  + acc_update-argcomplete.patch
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1688644800">- New upstream release
  + Version 2.50.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Drop patches for issues fixed upstream
  + acc_update-argcomplete.patch
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1692014400">- New upstream release
  + Version 2.51.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1694088000">- New upstream release
  + Version 2.52.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1696420800">- New upstream release
  + Version 2.53.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1698667200">- New upstream release
  + Version 2.53.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1700049600">- New upstream release
  + Version 2.54.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1704283200">- New upstream release
  + Version 2.55.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1705579200">- New upstream release
  + Version 2.56.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1707307200">- New upstream release
  + Version 2.57.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1709726400">- New upstream release
  + Version 2.58.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1712232000">- Switch package to modern Python Stack on SLE-15
  + Use Python 3.11 on SLE-15 by default
  + Use primary Python version on Tumbleweed
  + Drop support for older Python versions
- Switch build system from setuptools to pyproject.toml
  + Add python-pip and python-wheel to BuildRequires
  + Replace %python_build with %pyproject_wheel
  + Replace %python_install with %pyproject_install
  + Update name for dist directory in %files section</changelog>
</package>
<package pkgid="dc201b3475a62fa7841a68e2af39542d5ea5702fc83f26b45f8ed7605f94c22c" name="azure-cli-nspkg" arch="noarch">
  <version epoch="0" ver="3.0.4" rel="150400.13.3.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1506513600">- Initial build
  + Version 3.0.1</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1524225600">- New upstream release
  + Version 3.0.2
- Move LICENSE.txt from %doc to %license section</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1555416000">- New upstream release
  + Version 3.0.3
  + For detailed information about changes see the
    HISTORY.txt file provided with this package
- Bump minimum version for Python Azure SDK namespace
  packages to 3.0.0 in BuildRequires and Requires
- Remove python3-devel package from BuildRequires
- Remove unzip package from BuildRequires
- Run fdupes to hardlink duplicate files
  + Add fdupes to BuildRequires
  + Add %fdupes invocation to %install</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1559649600">- Remove unneccesary %python_expand prefix from %fdupes call</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1571918400">- New upstream release
  + Version 3.0.4
  + For detailed information about changes see the
    HISTORY.txt file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1657800000">- Add missing python-rpm-macros package to BuildRequires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1712232000">- Switch package to modern Python Stack on SLE-15
  + Use Python 3.11 on SLE-15 by default
  + Use primary Python version on Tumbleweed
- Switch build system from setuptools to pyproject.toml
  + Add python-pip and python-wheel to BuildRequires
  + Replace %python_build with %pyproject_wheel
  + Replace %python_install with %pyproject_install
  + Update name for dist directory in %files section</changelog>
</package>
<package pkgid="1355596dbee0abfdaee59f67fc139033a7a54b215183cac8cc8515d78e561e81" name="azure-cli-nspkg" arch="src">
  <version epoch="0" ver="3.0.4" rel="150400.13.3.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1506513600">- Initial build
  + Version 3.0.1</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1524225600">- New upstream release
  + Version 3.0.2
- Move LICENSE.txt from %doc to %license section</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1555416000">- New upstream release
  + Version 3.0.3
  + For detailed information about changes see the
    HISTORY.txt file provided with this package
- Bump minimum version for Python Azure SDK namespace
  packages to 3.0.0 in BuildRequires and Requires
- Remove python3-devel package from BuildRequires
- Remove unzip package from BuildRequires
- Run fdupes to hardlink duplicate files
  + Add fdupes to BuildRequires
  + Add %fdupes invocation to %install</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1559649600">- Remove unneccesary %python_expand prefix from %fdupes call</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1571918400">- New upstream release
  + Version 3.0.4
  + For detailed information about changes see the
    HISTORY.txt file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1657800000">- Add missing python-rpm-macros package to BuildRequires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1712232000">- Switch package to modern Python Stack on SLE-15
  + Use Python 3.11 on SLE-15 by default
  + Use primary Python version on Tumbleweed
- Switch build system from setuptools to pyproject.toml
  + Add python-pip and python-wheel to BuildRequires
  + Replace %python_build with %pyproject_wheel
  + Replace %python_install with %pyproject_install
  + Update name for dist directory in %files section</changelog>
</package>
<package pkgid="70609d345e66b197dc318ff66e47d3153d82541fece41929e2486e7f95c6c37f" name="azure-cli-telemetry" arch="noarch">
  <version epoch="0" ver="1.1.0" rel="150400.10.3.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1538395200">- Initial build
  + Version 1.0.0
- Add patch to relax version numbers in install_requires
  + act_relax-requires-versions.patch</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1555416000">- New upstream release
  + Version 1.0.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Bump minimum version for Python Azure SDK namespace
  packages to 3.0.0 in BuildRequires and Requires
- Remove python3-devel package from BuildRequires
- Remove unzip package from BuildRequires
- Run fdupes to hardlink duplicate files
  + Add fdupes to BuildRequires
  + Add %fdupes invocation to %install</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1559649600">- Remove unneccesary %python_expand prefix from %fdupes call</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1571918400">- New upstream release
  + Version 1.0.4
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Drop patch to relax version requires in setup.py, it's
  not required as the dependencies are managed by RPM
  + act_relax-requires-versions.patch
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1599048000">- New upstream release
  + Version 1.0.6
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1656331200">- Add missing python-rpm-macros package to BuildRequires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1659614400">- New upstream release
  + Version 1.0.7
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1663329600">- New upstream release
  + Version 1.0.8
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1692014400">- New upstream release
  + Version 1.1.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1712232000">- Switch package to modern Python Stack on SLE-15
  + Use Python 3.11 on SLE-15 by default
  + Use primary Python version on Tumbleweed
- Switch build system from setuptools to pyproject.toml
  + Add python-pip and python-wheel to BuildRequires
  + Replace %python_build with %pyproject_wheel
  + Replace %python_install with %pyproject_install
  + Update name for dist directory in %files section</changelog>
</package>
<package pkgid="d4659eef712edb03d6051cbd72b9fbb2e9ed7bc797e38041bd1501a2569bbe59" name="azure-cli-telemetry" arch="src">
  <version epoch="0" ver="1.1.0" rel="150400.10.3.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1538395200">- Initial build
  + Version 1.0.0
- Add patch to relax version numbers in install_requires
  + act_relax-requires-versions.patch</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1555416000">- New upstream release
  + Version 1.0.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Bump minimum version for Python Azure SDK namespace
  packages to 3.0.0 in BuildRequires and Requires
- Remove python3-devel package from BuildRequires
- Remove unzip package from BuildRequires
- Run fdupes to hardlink duplicate files
  + Add fdupes to BuildRequires
  + Add %fdupes invocation to %install</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1559649600">- Remove unneccesary %python_expand prefix from %fdupes call</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1571918400">- New upstream release
  + Version 1.0.4
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Drop patch to relax version requires in setup.py, it's
  not required as the dependencies are managed by RPM
  + act_relax-requires-versions.patch
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1599048000">- New upstream release
  + Version 1.0.6
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1656331200">- Add missing python-rpm-macros package to BuildRequires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1659614400">- New upstream release
  + Version 1.0.7
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1663329600">- New upstream release
  + Version 1.0.8
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1692014400">- New upstream release
  + Version 1.1.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1712232000">- Switch package to modern Python Stack on SLE-15
  + Use Python 3.11 on SLE-15 by default
  + Use primary Python version on Tumbleweed
- Switch build system from setuptools to pyproject.toml
  + Add python-pip and python-wheel to BuildRequires
  + Replace %python_build with %pyproject_wheel
  + Replace %python_install with %pyproject_install
  + Update name for dist directory in %files section</changelog>
</package>
<package pkgid="83d42750210e74912919e22636c7d1c4d7fc24c9dbca78f923bdace73013f0e0" name="azure-cli-test" arch="aarch64">
  <version epoch="0" ver="2.58.0" rel="150400.14.6.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1673352000">- New upstream release
  + Version 2.44.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1674043200">- New upstream release
  + Version 2.44.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1675944000">- New upstream release
  + Version 2.45.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1678190400">- New upstream release (bsc#1199592)
  + Version 2.46.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1680609600">- New upstream release
  + Version 2.47.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1683115200">- New upstream release
  + Version 2.48.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1684929600">- New upstream release
  + Version 2.49.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1688644800">- New upstream release
  + Version 2.50.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1692014400">- New upstream release
  + Version 2.51.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1694088000">- New upstream release
  + Version 2.52.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1696420800">- New upstream release
  + Version 2.53.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1698667200">- New upstream release
  + Version 2.53.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1700049600">- New upstream release
  + Version 2.54.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1704283200">- New upstream release
  + Version 2.55.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1705579200">- New upstream release
  + Version 2.56.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1707307200">- New upstream release
  + Version 2.57.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1709726400">- New upstream release
  + Version 2.58.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1712232000">- Switch package to modern Python Stack on SLE-15
  + Use Python 3.11 on SLE-15 by default
  + Use primary Python version on Tumbleweed
- Switch build system from setuptools to pyproject.toml
  + Add python-pip and python-wheel to BuildRequires
  + Replace %python_build with %pyproject_wheel
  + Replace %python_install with %pyproject_install
  + Update name for dist directory in %files section</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1715083200">- Add Obsoletes for python3-azure-functions-devops-build package on SLE-15
- Remove azure-cli-command-modules-nspkg from BuildRequires and Requires</changelog>
</package>
<package pkgid="0093308776b2266e55d10d5f98bfb3abd414a204e89f06891650eb66cb47f71b" name="azure-cli-test" arch="ppc64le">
  <version epoch="0" ver="2.58.0" rel="150400.14.6.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1673352000">- New upstream release
  + Version 2.44.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1674043200">- New upstream release
  + Version 2.44.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1675944000">- New upstream release
  + Version 2.45.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1678190400">- New upstream release (bsc#1199592)
  + Version 2.46.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1680609600">- New upstream release
  + Version 2.47.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1683115200">- New upstream release
  + Version 2.48.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1684929600">- New upstream release
  + Version 2.49.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1688644800">- New upstream release
  + Version 2.50.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1692014400">- New upstream release
  + Version 2.51.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1694088000">- New upstream release
  + Version 2.52.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1696420800">- New upstream release
  + Version 2.53.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1698667200">- New upstream release
  + Version 2.53.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1700049600">- New upstream release
  + Version 2.54.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1704283200">- New upstream release
  + Version 2.55.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1705579200">- New upstream release
  + Version 2.56.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1707307200">- New upstream release
  + Version 2.57.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1709726400">- New upstream release
  + Version 2.58.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1712232000">- Switch package to modern Python Stack on SLE-15
  + Use Python 3.11 on SLE-15 by default
  + Use primary Python version on Tumbleweed
- Switch build system from setuptools to pyproject.toml
  + Add python-pip and python-wheel to BuildRequires
  + Replace %python_build with %pyproject_wheel
  + Replace %python_install with %pyproject_install
  + Update name for dist directory in %files section</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1715083200">- Add Obsoletes for python3-azure-functions-devops-build package on SLE-15
- Remove azure-cli-command-modules-nspkg from BuildRequires and Requires</changelog>
</package>
<package pkgid="d156fb3a2804787c6f92d180ee5ba79e21216e971de1f6a699349c2bd9d3fc83" name="azure-cli-test" arch="s390x">
  <version epoch="0" ver="2.58.0" rel="150400.14.6.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1673352000">- New upstream release
  + Version 2.44.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1674043200">- New upstream release
  + Version 2.44.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1675944000">- New upstream release
  + Version 2.45.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1678190400">- New upstream release (bsc#1199592)
  + Version 2.46.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1680609600">- New upstream release
  + Version 2.47.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1683115200">- New upstream release
  + Version 2.48.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1684929600">- New upstream release
  + Version 2.49.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1688644800">- New upstream release
  + Version 2.50.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1692014400">- New upstream release
  + Version 2.51.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1694088000">- New upstream release
  + Version 2.52.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1696420800">- New upstream release
  + Version 2.53.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1698667200">- New upstream release
  + Version 2.53.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1700049600">- New upstream release
  + Version 2.54.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1704283200">- New upstream release
  + Version 2.55.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1705579200">- New upstream release
  + Version 2.56.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1707307200">- New upstream release
  + Version 2.57.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1709726400">- New upstream release
  + Version 2.58.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1712232000">- Switch package to modern Python Stack on SLE-15
  + Use Python 3.11 on SLE-15 by default
  + Use primary Python version on Tumbleweed
- Switch build system from setuptools to pyproject.toml
  + Add python-pip and python-wheel to BuildRequires
  + Replace %python_build with %pyproject_wheel
  + Replace %python_install with %pyproject_install
  + Update name for dist directory in %files section</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1715083200">- Add Obsoletes for python3-azure-functions-devops-build package on SLE-15
- Remove azure-cli-command-modules-nspkg from BuildRequires and Requires</changelog>
</package>
<package pkgid="1aec528ef180169bfcf4438f0ac92ae562edd220dadfc2fdc4d8f0dd6a9e9584" name="azure-cli-test" arch="src">
  <version epoch="0" ver="2.58.0" rel="150400.14.6.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1673352000">- New upstream release
  + Version 2.44.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1674043200">- New upstream release
  + Version 2.44.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1675944000">- New upstream release
  + Version 2.45.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1678190400">- New upstream release (bsc#1199592)
  + Version 2.46.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1680609600">- New upstream release
  + Version 2.47.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1683115200">- New upstream release
  + Version 2.48.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1684929600">- New upstream release
  + Version 2.49.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1688644800">- New upstream release
  + Version 2.50.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1692014400">- New upstream release
  + Version 2.51.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1694088000">- New upstream release
  + Version 2.52.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1696420800">- New upstream release
  + Version 2.53.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1698667200">- New upstream release
  + Version 2.53.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1700049600">- New upstream release
  + Version 2.54.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1704283200">- New upstream release
  + Version 2.55.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1705579200">- New upstream release
  + Version 2.56.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1707307200">- New upstream release
  + Version 2.57.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1709726400">- New upstream release
  + Version 2.58.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1712232000">- Switch package to modern Python Stack on SLE-15
  + Use Python 3.11 on SLE-15 by default
  + Use primary Python version on Tumbleweed
- Switch build system from setuptools to pyproject.toml
  + Add python-pip and python-wheel to BuildRequires
  + Replace %python_build with %pyproject_wheel
  + Replace %python_install with %pyproject_install
  + Update name for dist directory in %files section</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1715083200">- Add Obsoletes for python3-azure-functions-devops-build package on SLE-15
- Remove azure-cli-command-modules-nspkg from BuildRequires and Requires</changelog>
</package>
<package pkgid="753b76c0975922a77452624347372f742c96d9a2715231fc5fea53a0fa6f9945" name="azure-cli-test" arch="x86_64">
  <version epoch="0" ver="2.58.0" rel="150400.14.6.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1673352000">- New upstream release
  + Version 2.44.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1674043200">- New upstream release
  + Version 2.44.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1675944000">- New upstream release
  + Version 2.45.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1678190400">- New upstream release (bsc#1199592)
  + Version 2.46.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1680609600">- New upstream release
  + Version 2.47.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1683115200">- New upstream release
  + Version 2.48.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1684929600">- New upstream release
  + Version 2.49.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1688644800">- New upstream release
  + Version 2.50.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1692014400">- New upstream release
  + Version 2.51.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1694088000">- New upstream release
  + Version 2.52.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1696420800">- New upstream release
  + Version 2.53.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1698667200">- New upstream release
  + Version 2.53.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1700049600">- New upstream release
  + Version 2.54.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1704283200">- New upstream release
  + Version 2.55.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1705579200">- New upstream release
  + Version 2.56.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1707307200">- New upstream release
  + Version 2.57.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="dimstar@opensuse.org" date="1708430400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1709726400">- New upstream release
  + Version 2.58.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1712232000">- Switch package to modern Python Stack on SLE-15
  + Use Python 3.11 on SLE-15 by default
  + Use primary Python version on Tumbleweed
- Switch build system from setuptools to pyproject.toml
  + Add python-pip and python-wheel to BuildRequires
  + Replace %python_build with %pyproject_wheel
  + Replace %python_install with %pyproject_install
  + Update name for dist directory in %files section</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1715083200">- Add Obsoletes for python3-azure-functions-devops-build package on SLE-15
- Remove azure-cli-command-modules-nspkg from BuildRequires and Requires</changelog>
</package>
<package pkgid="285b7971012b9a71fd74da8c6daf80eb1029f6e1d31d9417c31b1cb9b0d27172" name="bcc" arch="src">
  <version epoch="0" ver="0.29.1" rel="150600.5.3.2"/>
  <changelog author="shung-hsi.yu@suse.com" date="1627387200">- Update source URL for bcc and libbpf</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1631880000">- Update to 0.21.0
  + Support for kernel up to 5.13
  + support for debug information from libdebuginfod
  + finished support for map elements items_*_batch() APIs
  + add atomic_increment() API
  + support attach_func() and detach_func() in python
  + fix displaying PID instead of TID for many tools
  + new tools: kvmexit.py
  + new libbpf-tools: gethostlatency, statsnoop, fsdist and solisten
  + fix tools ttysnoop/readahead for newer kernels
  + doc update and bug fixes
- Update libbpf to 0.5
  + libbpf_set_strict_mode() allowing to opt-in into backwards incompatible libbpf-1.0 changes. See "Libbpf: the road to 1.0" and "Libbpf 1.0 migration guide" for more details.
  + streamlined error reporting for low-level APIs, high-level error-returning APIs, and pointer-returning APIs (as a libbpf-1.0 opt-in);
  + "Light" BPF skeleton support;
  + BPF_PROG_TYPE_SYSCALL support;
  + BPF perf link support for kprobe, uprobe, tracepoint, and perf_event BPF programs;
  + BPF cookie support for kprobe, uprobe, tracepoint, and perf_event BPF programs through bpf_program__attach_[ku]probe_opts() APIs;
  + allow to specify ref_ctr_off for USDT semaphores through bpf_program__attach_uprobe_opts() API;
  + btf_custom_path support in bpf_object_open_opts, allowing to specify custom BTF for CO-RE relocations;
  + sk_reuseport/migrate program type support;
  + btf_dump__dump_type_data() API, allowing to dump binary data according to BTF type description;
  + btf__load_into_kernel() and btf__load_from_kernel_by_id(), and split BTF variants of them;
  + btf__load_vmlinux_btf() and btf__load_module_btf() APIs;
  + bpf_map__initial_value() API to get initial value of mmap-ed BPF maps;
  + bpf_map_lookup_and_delete_elem_flags() API.
  + support for weak typed __ksym externs;
  + BPF timer helpers: bpf_timer_init(), bpf_timer_set_callback(), bpf_timer_start(), bpf_timer_cancel();
  + bpf_get_attach_cookie() helper to get BPF cookie from BPF program side;
  + bpf_get_func_ip() helper;
  + bpf_sys_bpf() helper;
  + bpf_task_pt_regs() helper;
  + bpf_btf_find_by_name_kind() helper;
  + usability improvements for bpf_tracing.h when target architecture is missing.
  + improve BPF support detection on old Red Hat kernels with backported BPF patches;
  + improvements for LTO builds with GCC 10+;
  + pass NLM_F_EXCL when creating TC qdisc;
  + better support of BPF map reuse on old kernels;
  + fix the bug resulting in sometimes closing FD 0, which wasn't created and owned by libbpf itself.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1631880001">- Update to 0.22.0
  + Support for kernel up to 5.14
  + add ipv4/ipv6 filter support for tcp trace tools
  + add python interface to attach raw perf events
  + fix tcpstates for incorrect display of dport
  + new options for bcc tools runqslower, argdist
  + new libbpf-tools: filetop, exitsnoop, tcprtt
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1633089600">- Use shared libbpf library instead of building it along with bcc
    + Delete libbpf-0.5.tar.gz
- Fix build on i586 due to use of shared libbpf library
    + Do-not-export-USDT-function-when-ENABLE_USDT-is-OFF.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1645012800">- Move kernel{,-devel} requirements to libbcc0 for deduplication.
- Require additionally kernel-$variant-devel for libbcc0.
- Declare python3-bcc, bcc-examples and bcc-docs as noarch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1650628800">- Update to version 0.24.0:
  + Support for kernel up to 5.16
  + bcc tools: update for trace.py, sslsniff.py, tcptop.py, hardirqs.py, etc.
  + new libbpf tools: bashreadline
  + allow specify wakeup_events for perf buffer
  + support BPF_MAP_TYPE_{INODE, TASK}_STORAGE maps
  + remove all deprecated libbpf function usage
  + remove P4/B language support
  + major test infra change, using github actions now
  + doc update, bug fixes and other tools improvement
- Changes from version 0.23.0:
  + Support for kernel up to 5.15
  + bcc tools: update for kvmexit.py, tcpv4connect.py, cachetop.py, cachestat.py, etc.
  + libbpf tools: update for update for mountsnoop, ksnoop, gethostlatency, etc.
  + fix renaming of task_struct-&gt;state
  + get pid namespace properly for a number of tools
  + initial work for more libbpf utilization (less section names)
  + doc update, bug fixes and other tools improvement
- Drop Do-not-export-USDT-function-when-ENABLE_USDT-is-OFF.patch:
  fixed upstream.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1660219200">- Update to version 0.25.0:
  + Support for kernel up to 5.19
  + bcc tool updates for oomkill.py, biolatpcts.py, sslsniff.py, tcpaccept.py, etc.
  + libbpf tool updates for klockstat, opensnoop, tcpconnect, etc.
  + new bcc tools: tcpcong
  + new libbpf tools: tcpsynbl, mdflush, oomkill, sigsnoop
  + usdt: support xmm registers as args for x64
  + bpftool as a submodule now
  + remove uses of libbpf deprecated APIs
  + use new llvm pass manager
  + support cgroup filtering libbpf tools
  + fix shared lib module offset &lt;-&gt; global addr conversion
  + riscv support
  + LoongArch support
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1672315200">- Update to version 0.26.0:
  + Support for kernel up to 6.1
  + bcc tool updates for biosnoop, opensnoop, biopattern, killsnoop, runqslower, offcputime, wakeuptime, etc.
  + libbpf-tools updates for klockstat, sigsnoop, hardirqs, softirqs, opensnoop, statsnoop, offcputime, tcplife, cpufreq, cpudist, etc.
  + new libbpf-tools: tcptop, tcpstates, biotop, capable
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1673438400">- Force specific versioning of LLVM in preparation of Leap 15.5/SLES 15-SP5
  + Remove now duplicate dependency llvm-clang-devel, having clang-devel is enough</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695297600">- Disable bcc-lua until luajit issue is resolved
- Explicitly add python3-setuptools and zip as a build requirement
- Update to version 0.28.0
  + Support for kernel up to 6.3.
  + new libbpf tool: tcppktlat.
  + bcc tool updates: funcslower, wakeuptime, profile, offcputime, deadlock,
    funccount, argdist, kvmexit, runqlen and cpuunclaimed.
  + libbpf tool update: memleak, tcprtt, tcpconnlat, funclatency, syscount,
    cpufreq, biosnoop.
  + support ringbuf_query for bcc tools.
  + handle '[uprobes]' memory mapped file properly during stack tracing.
  + Fix maximum allowed index for print_linear_hist for bcc tools.
  + add module kfunc/kretfunc support.
  + clang rewriter: initialize only the requested parameters
  + filter with available_filter_functions to make multi-functions kprobes more
    robust for both bcc and libbpf tools.
  + doc update, other bug fixes and tools improvement
- Update to version 0.27.0
  + Support for kernel up to 6.2
  + bcc tool updates for ttysnoop, slabratetop, readahead, nfsslower, cpudist,
    cachetop, cachestat, etc.
  + libbpf-tools updates for mdflush, drsnoop, statsnoop, ttysnoop, softirqs,
    wakeuptime, cachestat, numamove, etc.
  + fix for incomplete static libraries
  + implement zip archive support
  + upgrade to use c++14 standard
  + new libbpf-tools: memleak
  + add loongarch support in libbpft-tools
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695384000">- Mention boo#1215592 in spec file, which tracks the problem with luajit
  that require temporarily disabling bcc-lua</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695643200">- Disable building of tests file
  + Remove zip from build requirements as it is no longer needed</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1697457600">- Re-enable bcc-lua now that boo#1215592 is resolved</changelog>
  <changelog author="steven.kowalik@suse.com" date="1701777600">- Remove unneeded Requires on python3-future.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1706270400">- Switch to LLVM 17
- Change LLVM version macro to the cleaner alternative suggested in
  SR#1134405
- Update to version 0.29.1
  * support for kernel up to 6.6.
  * new bcc tools: rdmaucma
  * bcc tool update: tcpstates, statsnoop, runqlat, bio tools,
    tcptop, slabratetop, tcprtt, etc.
  * doc update, other bug fixes and tools improvement, and some new
    enhancement for powerpc and riscv.</changelog>
  <changelog author="dimstar@opensuse.org" date="1709035200">- Have the -devel package require llvm%{llvm_major_version}-devel:
  /usr/include/bcc/bpf_module.h:25:10 includes
  llvm/Config/llvm-config.h.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1710244800">- Update LLVM version macro to support SLE (bsc#1220746)</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1711454400">- Update bcc-devel requirement to depend on specific version of llvm-devel</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1714737600">- Fix incorrect offset calculation when consecutive bitfields are
  present (bsc#1219096)
  * add fix-alignment-issue-on-x86_64-due-to-consecutive-bit.patch</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717502400">- Remove bcc-devel's requirement on llvm-devel
  * add build-remove-llvm-dev-dependency-from-libbcc.patch</changelog>
</package>
<package pkgid="35376adf7d3c3c6f399b81223996cf83722908c8a180cd4e331685c276602963" name="bcc-devel" arch="aarch64">
  <version epoch="0" ver="0.29.1" rel="150600.5.3.2"/>
  <changelog author="shung-hsi.yu@suse.com" date="1627387200">- Update source URL for bcc and libbpf</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1631880000">- Update to 0.21.0
  + Support for kernel up to 5.13
  + support for debug information from libdebuginfod
  + finished support for map elements items_*_batch() APIs
  + add atomic_increment() API
  + support attach_func() and detach_func() in python
  + fix displaying PID instead of TID for many tools
  + new tools: kvmexit.py
  + new libbpf-tools: gethostlatency, statsnoop, fsdist and solisten
  + fix tools ttysnoop/readahead for newer kernels
  + doc update and bug fixes
- Update libbpf to 0.5
  + libbpf_set_strict_mode() allowing to opt-in into backwards incompatible libbpf-1.0 changes. See "Libbpf: the road to 1.0" and "Libbpf 1.0 migration guide" for more details.
  + streamlined error reporting for low-level APIs, high-level error-returning APIs, and pointer-returning APIs (as a libbpf-1.0 opt-in);
  + "Light" BPF skeleton support;
  + BPF_PROG_TYPE_SYSCALL support;
  + BPF perf link support for kprobe, uprobe, tracepoint, and perf_event BPF programs;
  + BPF cookie support for kprobe, uprobe, tracepoint, and perf_event BPF programs through bpf_program__attach_[ku]probe_opts() APIs;
  + allow to specify ref_ctr_off for USDT semaphores through bpf_program__attach_uprobe_opts() API;
  + btf_custom_path support in bpf_object_open_opts, allowing to specify custom BTF for CO-RE relocations;
  + sk_reuseport/migrate program type support;
  + btf_dump__dump_type_data() API, allowing to dump binary data according to BTF type description;
  + btf__load_into_kernel() and btf__load_from_kernel_by_id(), and split BTF variants of them;
  + btf__load_vmlinux_btf() and btf__load_module_btf() APIs;
  + bpf_map__initial_value() API to get initial value of mmap-ed BPF maps;
  + bpf_map_lookup_and_delete_elem_flags() API.
  + support for weak typed __ksym externs;
  + BPF timer helpers: bpf_timer_init(), bpf_timer_set_callback(), bpf_timer_start(), bpf_timer_cancel();
  + bpf_get_attach_cookie() helper to get BPF cookie from BPF program side;
  + bpf_get_func_ip() helper;
  + bpf_sys_bpf() helper;
  + bpf_task_pt_regs() helper;
  + bpf_btf_find_by_name_kind() helper;
  + usability improvements for bpf_tracing.h when target architecture is missing.
  + improve BPF support detection on old Red Hat kernels with backported BPF patches;
  + improvements for LTO builds with GCC 10+;
  + pass NLM_F_EXCL when creating TC qdisc;
  + better support of BPF map reuse on old kernels;
  + fix the bug resulting in sometimes closing FD 0, which wasn't created and owned by libbpf itself.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1631880001">- Update to 0.22.0
  + Support for kernel up to 5.14
  + add ipv4/ipv6 filter support for tcp trace tools
  + add python interface to attach raw perf events
  + fix tcpstates for incorrect display of dport
  + new options for bcc tools runqslower, argdist
  + new libbpf-tools: filetop, exitsnoop, tcprtt
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1633089600">- Use shared libbpf library instead of building it along with bcc
    + Delete libbpf-0.5.tar.gz
- Fix build on i586 due to use of shared libbpf library
    + Do-not-export-USDT-function-when-ENABLE_USDT-is-OFF.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1645012800">- Move kernel{,-devel} requirements to libbcc0 for deduplication.
- Require additionally kernel-$variant-devel for libbcc0.
- Declare python3-bcc, bcc-examples and bcc-docs as noarch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1650628800">- Update to version 0.24.0:
  + Support for kernel up to 5.16
  + bcc tools: update for trace.py, sslsniff.py, tcptop.py, hardirqs.py, etc.
  + new libbpf tools: bashreadline
  + allow specify wakeup_events for perf buffer
  + support BPF_MAP_TYPE_{INODE, TASK}_STORAGE maps
  + remove all deprecated libbpf function usage
  + remove P4/B language support
  + major test infra change, using github actions now
  + doc update, bug fixes and other tools improvement
- Changes from version 0.23.0:
  + Support for kernel up to 5.15
  + bcc tools: update for kvmexit.py, tcpv4connect.py, cachetop.py, cachestat.py, etc.
  + libbpf tools: update for update for mountsnoop, ksnoop, gethostlatency, etc.
  + fix renaming of task_struct-&gt;state
  + get pid namespace properly for a number of tools
  + initial work for more libbpf utilization (less section names)
  + doc update, bug fixes and other tools improvement
- Drop Do-not-export-USDT-function-when-ENABLE_USDT-is-OFF.patch:
  fixed upstream.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1660219200">- Update to version 0.25.0:
  + Support for kernel up to 5.19
  + bcc tool updates for oomkill.py, biolatpcts.py, sslsniff.py, tcpaccept.py, etc.
  + libbpf tool updates for klockstat, opensnoop, tcpconnect, etc.
  + new bcc tools: tcpcong
  + new libbpf tools: tcpsynbl, mdflush, oomkill, sigsnoop
  + usdt: support xmm registers as args for x64
  + bpftool as a submodule now
  + remove uses of libbpf deprecated APIs
  + use new llvm pass manager
  + support cgroup filtering libbpf tools
  + fix shared lib module offset &lt;-&gt; global addr conversion
  + riscv support
  + LoongArch support
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1672315200">- Update to version 0.26.0:
  + Support for kernel up to 6.1
  + bcc tool updates for biosnoop, opensnoop, biopattern, killsnoop, runqslower, offcputime, wakeuptime, etc.
  + libbpf-tools updates for klockstat, sigsnoop, hardirqs, softirqs, opensnoop, statsnoop, offcputime, tcplife, cpufreq, cpudist, etc.
  + new libbpf-tools: tcptop, tcpstates, biotop, capable
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1673438400">- Force specific versioning of LLVM in preparation of Leap 15.5/SLES 15-SP5
  + Remove now duplicate dependency llvm-clang-devel, having clang-devel is enough</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695297600">- Disable bcc-lua until luajit issue is resolved
- Explicitly add python3-setuptools and zip as a build requirement
- Update to version 0.28.0
  + Support for kernel up to 6.3.
  + new libbpf tool: tcppktlat.
  + bcc tool updates: funcslower, wakeuptime, profile, offcputime, deadlock,
    funccount, argdist, kvmexit, runqlen and cpuunclaimed.
  + libbpf tool update: memleak, tcprtt, tcpconnlat, funclatency, syscount,
    cpufreq, biosnoop.
  + support ringbuf_query for bcc tools.
  + handle '[uprobes]' memory mapped file properly during stack tracing.
  + Fix maximum allowed index for print_linear_hist for bcc tools.
  + add module kfunc/kretfunc support.
  + clang rewriter: initialize only the requested parameters
  + filter with available_filter_functions to make multi-functions kprobes more
    robust for both bcc and libbpf tools.
  + doc update, other bug fixes and tools improvement
- Update to version 0.27.0
  + Support for kernel up to 6.2
  + bcc tool updates for ttysnoop, slabratetop, readahead, nfsslower, cpudist,
    cachetop, cachestat, etc.
  + libbpf-tools updates for mdflush, drsnoop, statsnoop, ttysnoop, softirqs,
    wakeuptime, cachestat, numamove, etc.
  + fix for incomplete static libraries
  + implement zip archive support
  + upgrade to use c++14 standard
  + new libbpf-tools: memleak
  + add loongarch support in libbpft-tools
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695384000">- Mention boo#1215592 in spec file, which tracks the problem with luajit
  that require temporarily disabling bcc-lua</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695643200">- Disable building of tests file
  + Remove zip from build requirements as it is no longer needed</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1697457600">- Re-enable bcc-lua now that boo#1215592 is resolved</changelog>
  <changelog author="steven.kowalik@suse.com" date="1701777600">- Remove unneeded Requires on python3-future.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1706270400">- Switch to LLVM 17
- Change LLVM version macro to the cleaner alternative suggested in
  SR#1134405
- Update to version 0.29.1
  * support for kernel up to 6.6.
  * new bcc tools: rdmaucma
  * bcc tool update: tcpstates, statsnoop, runqlat, bio tools,
    tcptop, slabratetop, tcprtt, etc.
  * doc update, other bug fixes and tools improvement, and some new
    enhancement for powerpc and riscv.</changelog>
  <changelog author="dimstar@opensuse.org" date="1709035200">- Have the -devel package require llvm%{llvm_major_version}-devel:
  /usr/include/bcc/bpf_module.h:25:10 includes
  llvm/Config/llvm-config.h.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1710244800">- Update LLVM version macro to support SLE (bsc#1220746)</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1711454400">- Update bcc-devel requirement to depend on specific version of llvm-devel</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1714737600">- Fix incorrect offset calculation when consecutive bitfields are
  present (bsc#1219096)
  * add fix-alignment-issue-on-x86_64-due-to-consecutive-bit.patch</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717502400">- Remove bcc-devel's requirement on llvm-devel
  * add build-remove-llvm-dev-dependency-from-libbcc.patch</changelog>
</package>
<package pkgid="201112de433198c4c56c97e3cb551677452b89844c665668b3b26a0acdb8e95f" name="bcc-devel" arch="ppc64le">
  <version epoch="0" ver="0.29.1" rel="150600.5.3.2"/>
  <changelog author="shung-hsi.yu@suse.com" date="1627387200">- Update source URL for bcc and libbpf</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1631880000">- Update to 0.21.0
  + Support for kernel up to 5.13
  + support for debug information from libdebuginfod
  + finished support for map elements items_*_batch() APIs
  + add atomic_increment() API
  + support attach_func() and detach_func() in python
  + fix displaying PID instead of TID for many tools
  + new tools: kvmexit.py
  + new libbpf-tools: gethostlatency, statsnoop, fsdist and solisten
  + fix tools ttysnoop/readahead for newer kernels
  + doc update and bug fixes
- Update libbpf to 0.5
  + libbpf_set_strict_mode() allowing to opt-in into backwards incompatible libbpf-1.0 changes. See "Libbpf: the road to 1.0" and "Libbpf 1.0 migration guide" for more details.
  + streamlined error reporting for low-level APIs, high-level error-returning APIs, and pointer-returning APIs (as a libbpf-1.0 opt-in);
  + "Light" BPF skeleton support;
  + BPF_PROG_TYPE_SYSCALL support;
  + BPF perf link support for kprobe, uprobe, tracepoint, and perf_event BPF programs;
  + BPF cookie support for kprobe, uprobe, tracepoint, and perf_event BPF programs through bpf_program__attach_[ku]probe_opts() APIs;
  + allow to specify ref_ctr_off for USDT semaphores through bpf_program__attach_uprobe_opts() API;
  + btf_custom_path support in bpf_object_open_opts, allowing to specify custom BTF for CO-RE relocations;
  + sk_reuseport/migrate program type support;
  + btf_dump__dump_type_data() API, allowing to dump binary data according to BTF type description;
  + btf__load_into_kernel() and btf__load_from_kernel_by_id(), and split BTF variants of them;
  + btf__load_vmlinux_btf() and btf__load_module_btf() APIs;
  + bpf_map__initial_value() API to get initial value of mmap-ed BPF maps;
  + bpf_map_lookup_and_delete_elem_flags() API.
  + support for weak typed __ksym externs;
  + BPF timer helpers: bpf_timer_init(), bpf_timer_set_callback(), bpf_timer_start(), bpf_timer_cancel();
  + bpf_get_attach_cookie() helper to get BPF cookie from BPF program side;
  + bpf_get_func_ip() helper;
  + bpf_sys_bpf() helper;
  + bpf_task_pt_regs() helper;
  + bpf_btf_find_by_name_kind() helper;
  + usability improvements for bpf_tracing.h when target architecture is missing.
  + improve BPF support detection on old Red Hat kernels with backported BPF patches;
  + improvements for LTO builds with GCC 10+;
  + pass NLM_F_EXCL when creating TC qdisc;
  + better support of BPF map reuse on old kernels;
  + fix the bug resulting in sometimes closing FD 0, which wasn't created and owned by libbpf itself.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1631880001">- Update to 0.22.0
  + Support for kernel up to 5.14
  + add ipv4/ipv6 filter support for tcp trace tools
  + add python interface to attach raw perf events
  + fix tcpstates for incorrect display of dport
  + new options for bcc tools runqslower, argdist
  + new libbpf-tools: filetop, exitsnoop, tcprtt
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1633089600">- Use shared libbpf library instead of building it along with bcc
    + Delete libbpf-0.5.tar.gz
- Fix build on i586 due to use of shared libbpf library
    + Do-not-export-USDT-function-when-ENABLE_USDT-is-OFF.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1645012800">- Move kernel{,-devel} requirements to libbcc0 for deduplication.
- Require additionally kernel-$variant-devel for libbcc0.
- Declare python3-bcc, bcc-examples and bcc-docs as noarch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1650628800">- Update to version 0.24.0:
  + Support for kernel up to 5.16
  + bcc tools: update for trace.py, sslsniff.py, tcptop.py, hardirqs.py, etc.
  + new libbpf tools: bashreadline
  + allow specify wakeup_events for perf buffer
  + support BPF_MAP_TYPE_{INODE, TASK}_STORAGE maps
  + remove all deprecated libbpf function usage
  + remove P4/B language support
  + major test infra change, using github actions now
  + doc update, bug fixes and other tools improvement
- Changes from version 0.23.0:
  + Support for kernel up to 5.15
  + bcc tools: update for kvmexit.py, tcpv4connect.py, cachetop.py, cachestat.py, etc.
  + libbpf tools: update for update for mountsnoop, ksnoop, gethostlatency, etc.
  + fix renaming of task_struct-&gt;state
  + get pid namespace properly for a number of tools
  + initial work for more libbpf utilization (less section names)
  + doc update, bug fixes and other tools improvement
- Drop Do-not-export-USDT-function-when-ENABLE_USDT-is-OFF.patch:
  fixed upstream.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1660219200">- Update to version 0.25.0:
  + Support for kernel up to 5.19
  + bcc tool updates for oomkill.py, biolatpcts.py, sslsniff.py, tcpaccept.py, etc.
  + libbpf tool updates for klockstat, opensnoop, tcpconnect, etc.
  + new bcc tools: tcpcong
  + new libbpf tools: tcpsynbl, mdflush, oomkill, sigsnoop
  + usdt: support xmm registers as args for x64
  + bpftool as a submodule now
  + remove uses of libbpf deprecated APIs
  + use new llvm pass manager
  + support cgroup filtering libbpf tools
  + fix shared lib module offset &lt;-&gt; global addr conversion
  + riscv support
  + LoongArch support
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1672315200">- Update to version 0.26.0:
  + Support for kernel up to 6.1
  + bcc tool updates for biosnoop, opensnoop, biopattern, killsnoop, runqslower, offcputime, wakeuptime, etc.
  + libbpf-tools updates for klockstat, sigsnoop, hardirqs, softirqs, opensnoop, statsnoop, offcputime, tcplife, cpufreq, cpudist, etc.
  + new libbpf-tools: tcptop, tcpstates, biotop, capable
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1673438400">- Force specific versioning of LLVM in preparation of Leap 15.5/SLES 15-SP5
  + Remove now duplicate dependency llvm-clang-devel, having clang-devel is enough</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695297600">- Disable bcc-lua until luajit issue is resolved
- Explicitly add python3-setuptools and zip as a build requirement
- Update to version 0.28.0
  + Support for kernel up to 6.3.
  + new libbpf tool: tcppktlat.
  + bcc tool updates: funcslower, wakeuptime, profile, offcputime, deadlock,
    funccount, argdist, kvmexit, runqlen and cpuunclaimed.
  + libbpf tool update: memleak, tcprtt, tcpconnlat, funclatency, syscount,
    cpufreq, biosnoop.
  + support ringbuf_query for bcc tools.
  + handle '[uprobes]' memory mapped file properly during stack tracing.
  + Fix maximum allowed index for print_linear_hist for bcc tools.
  + add module kfunc/kretfunc support.
  + clang rewriter: initialize only the requested parameters
  + filter with available_filter_functions to make multi-functions kprobes more
    robust for both bcc and libbpf tools.
  + doc update, other bug fixes and tools improvement
- Update to version 0.27.0
  + Support for kernel up to 6.2
  + bcc tool updates for ttysnoop, slabratetop, readahead, nfsslower, cpudist,
    cachetop, cachestat, etc.
  + libbpf-tools updates for mdflush, drsnoop, statsnoop, ttysnoop, softirqs,
    wakeuptime, cachestat, numamove, etc.
  + fix for incomplete static libraries
  + implement zip archive support
  + upgrade to use c++14 standard
  + new libbpf-tools: memleak
  + add loongarch support in libbpft-tools
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695384000">- Mention boo#1215592 in spec file, which tracks the problem with luajit
  that require temporarily disabling bcc-lua</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695643200">- Disable building of tests file
  + Remove zip from build requirements as it is no longer needed</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1697457600">- Re-enable bcc-lua now that boo#1215592 is resolved</changelog>
  <changelog author="steven.kowalik@suse.com" date="1701777600">- Remove unneeded Requires on python3-future.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1706270400">- Switch to LLVM 17
- Change LLVM version macro to the cleaner alternative suggested in
  SR#1134405
- Update to version 0.29.1
  * support for kernel up to 6.6.
  * new bcc tools: rdmaucma
  * bcc tool update: tcpstates, statsnoop, runqlat, bio tools,
    tcptop, slabratetop, tcprtt, etc.
  * doc update, other bug fixes and tools improvement, and some new
    enhancement for powerpc and riscv.</changelog>
  <changelog author="dimstar@opensuse.org" date="1709035200">- Have the -devel package require llvm%{llvm_major_version}-devel:
  /usr/include/bcc/bpf_module.h:25:10 includes
  llvm/Config/llvm-config.h.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1710244800">- Update LLVM version macro to support SLE (bsc#1220746)</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1711454400">- Update bcc-devel requirement to depend on specific version of llvm-devel</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1714737600">- Fix incorrect offset calculation when consecutive bitfields are
  present (bsc#1219096)
  * add fix-alignment-issue-on-x86_64-due-to-consecutive-bit.patch</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717502400">- Remove bcc-devel's requirement on llvm-devel
  * add build-remove-llvm-dev-dependency-from-libbcc.patch</changelog>
</package>
<package pkgid="c891f341dfefda774d0f29933a569e995b9d6fe63d0d05445b4855ccc882baae" name="bcc-devel" arch="s390x">
  <version epoch="0" ver="0.29.1" rel="150600.5.3.2"/>
  <changelog author="shung-hsi.yu@suse.com" date="1627387200">- Update source URL for bcc and libbpf</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1631880000">- Update to 0.21.0
  + Support for kernel up to 5.13
  + support for debug information from libdebuginfod
  + finished support for map elements items_*_batch() APIs
  + add atomic_increment() API
  + support attach_func() and detach_func() in python
  + fix displaying PID instead of TID for many tools
  + new tools: kvmexit.py
  + new libbpf-tools: gethostlatency, statsnoop, fsdist and solisten
  + fix tools ttysnoop/readahead for newer kernels
  + doc update and bug fixes
- Update libbpf to 0.5
  + libbpf_set_strict_mode() allowing to opt-in into backwards incompatible libbpf-1.0 changes. See "Libbpf: the road to 1.0" and "Libbpf 1.0 migration guide" for more details.
  + streamlined error reporting for low-level APIs, high-level error-returning APIs, and pointer-returning APIs (as a libbpf-1.0 opt-in);
  + "Light" BPF skeleton support;
  + BPF_PROG_TYPE_SYSCALL support;
  + BPF perf link support for kprobe, uprobe, tracepoint, and perf_event BPF programs;
  + BPF cookie support for kprobe, uprobe, tracepoint, and perf_event BPF programs through bpf_program__attach_[ku]probe_opts() APIs;
  + allow to specify ref_ctr_off for USDT semaphores through bpf_program__attach_uprobe_opts() API;
  + btf_custom_path support in bpf_object_open_opts, allowing to specify custom BTF for CO-RE relocations;
  + sk_reuseport/migrate program type support;
  + btf_dump__dump_type_data() API, allowing to dump binary data according to BTF type description;
  + btf__load_into_kernel() and btf__load_from_kernel_by_id(), and split BTF variants of them;
  + btf__load_vmlinux_btf() and btf__load_module_btf() APIs;
  + bpf_map__initial_value() API to get initial value of mmap-ed BPF maps;
  + bpf_map_lookup_and_delete_elem_flags() API.
  + support for weak typed __ksym externs;
  + BPF timer helpers: bpf_timer_init(), bpf_timer_set_callback(), bpf_timer_start(), bpf_timer_cancel();
  + bpf_get_attach_cookie() helper to get BPF cookie from BPF program side;
  + bpf_get_func_ip() helper;
  + bpf_sys_bpf() helper;
  + bpf_task_pt_regs() helper;
  + bpf_btf_find_by_name_kind() helper;
  + usability improvements for bpf_tracing.h when target architecture is missing.
  + improve BPF support detection on old Red Hat kernels with backported BPF patches;
  + improvements for LTO builds with GCC 10+;
  + pass NLM_F_EXCL when creating TC qdisc;
  + better support of BPF map reuse on old kernels;
  + fix the bug resulting in sometimes closing FD 0, which wasn't created and owned by libbpf itself.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1631880001">- Update to 0.22.0
  + Support for kernel up to 5.14
  + add ipv4/ipv6 filter support for tcp trace tools
  + add python interface to attach raw perf events
  + fix tcpstates for incorrect display of dport
  + new options for bcc tools runqslower, argdist
  + new libbpf-tools: filetop, exitsnoop, tcprtt
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1633089600">- Use shared libbpf library instead of building it along with bcc
    + Delete libbpf-0.5.tar.gz
- Fix build on i586 due to use of shared libbpf library
    + Do-not-export-USDT-function-when-ENABLE_USDT-is-OFF.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1645012800">- Move kernel{,-devel} requirements to libbcc0 for deduplication.
- Require additionally kernel-$variant-devel for libbcc0.
- Declare python3-bcc, bcc-examples and bcc-docs as noarch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1650628800">- Update to version 0.24.0:
  + Support for kernel up to 5.16
  + bcc tools: update for trace.py, sslsniff.py, tcptop.py, hardirqs.py, etc.
  + new libbpf tools: bashreadline
  + allow specify wakeup_events for perf buffer
  + support BPF_MAP_TYPE_{INODE, TASK}_STORAGE maps
  + remove all deprecated libbpf function usage
  + remove P4/B language support
  + major test infra change, using github actions now
  + doc update, bug fixes and other tools improvement
- Changes from version 0.23.0:
  + Support for kernel up to 5.15
  + bcc tools: update for kvmexit.py, tcpv4connect.py, cachetop.py, cachestat.py, etc.
  + libbpf tools: update for update for mountsnoop, ksnoop, gethostlatency, etc.
  + fix renaming of task_struct-&gt;state
  + get pid namespace properly for a number of tools
  + initial work for more libbpf utilization (less section names)
  + doc update, bug fixes and other tools improvement
- Drop Do-not-export-USDT-function-when-ENABLE_USDT-is-OFF.patch:
  fixed upstream.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1660219200">- Update to version 0.25.0:
  + Support for kernel up to 5.19
  + bcc tool updates for oomkill.py, biolatpcts.py, sslsniff.py, tcpaccept.py, etc.
  + libbpf tool updates for klockstat, opensnoop, tcpconnect, etc.
  + new bcc tools: tcpcong
  + new libbpf tools: tcpsynbl, mdflush, oomkill, sigsnoop
  + usdt: support xmm registers as args for x64
  + bpftool as a submodule now
  + remove uses of libbpf deprecated APIs
  + use new llvm pass manager
  + support cgroup filtering libbpf tools
  + fix shared lib module offset &lt;-&gt; global addr conversion
  + riscv support
  + LoongArch support
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1672315200">- Update to version 0.26.0:
  + Support for kernel up to 6.1
  + bcc tool updates for biosnoop, opensnoop, biopattern, killsnoop, runqslower, offcputime, wakeuptime, etc.
  + libbpf-tools updates for klockstat, sigsnoop, hardirqs, softirqs, opensnoop, statsnoop, offcputime, tcplife, cpufreq, cpudist, etc.
  + new libbpf-tools: tcptop, tcpstates, biotop, capable
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1673438400">- Force specific versioning of LLVM in preparation of Leap 15.5/SLES 15-SP5
  + Remove now duplicate dependency llvm-clang-devel, having clang-devel is enough</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695297600">- Disable bcc-lua until luajit issue is resolved
- Explicitly add python3-setuptools and zip as a build requirement
- Update to version 0.28.0
  + Support for kernel up to 6.3.
  + new libbpf tool: tcppktlat.
  + bcc tool updates: funcslower, wakeuptime, profile, offcputime, deadlock,
    funccount, argdist, kvmexit, runqlen and cpuunclaimed.
  + libbpf tool update: memleak, tcprtt, tcpconnlat, funclatency, syscount,
    cpufreq, biosnoop.
  + support ringbuf_query for bcc tools.
  + handle '[uprobes]' memory mapped file properly during stack tracing.
  + Fix maximum allowed index for print_linear_hist for bcc tools.
  + add module kfunc/kretfunc support.
  + clang rewriter: initialize only the requested parameters
  + filter with available_filter_functions to make multi-functions kprobes more
    robust for both bcc and libbpf tools.
  + doc update, other bug fixes and tools improvement
- Update to version 0.27.0
  + Support for kernel up to 6.2
  + bcc tool updates for ttysnoop, slabratetop, readahead, nfsslower, cpudist,
    cachetop, cachestat, etc.
  + libbpf-tools updates for mdflush, drsnoop, statsnoop, ttysnoop, softirqs,
    wakeuptime, cachestat, numamove, etc.
  + fix for incomplete static libraries
  + implement zip archive support
  + upgrade to use c++14 standard
  + new libbpf-tools: memleak
  + add loongarch support in libbpft-tools
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695384000">- Mention boo#1215592 in spec file, which tracks the problem with luajit
  that require temporarily disabling bcc-lua</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695643200">- Disable building of tests file
  + Remove zip from build requirements as it is no longer needed</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1697457600">- Re-enable bcc-lua now that boo#1215592 is resolved</changelog>
  <changelog author="steven.kowalik@suse.com" date="1701777600">- Remove unneeded Requires on python3-future.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1706270400">- Switch to LLVM 17
- Change LLVM version macro to the cleaner alternative suggested in
  SR#1134405
- Update to version 0.29.1
  * support for kernel up to 6.6.
  * new bcc tools: rdmaucma
  * bcc tool update: tcpstates, statsnoop, runqlat, bio tools,
    tcptop, slabratetop, tcprtt, etc.
  * doc update, other bug fixes and tools improvement, and some new
    enhancement for powerpc and riscv.</changelog>
  <changelog author="dimstar@opensuse.org" date="1709035200">- Have the -devel package require llvm%{llvm_major_version}-devel:
  /usr/include/bcc/bpf_module.h:25:10 includes
  llvm/Config/llvm-config.h.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1710244800">- Update LLVM version macro to support SLE (bsc#1220746)</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1711454400">- Update bcc-devel requirement to depend on specific version of llvm-devel</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1714737600">- Fix incorrect offset calculation when consecutive bitfields are
  present (bsc#1219096)
  * add fix-alignment-issue-on-x86_64-due-to-consecutive-bit.patch</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717502400">- Remove bcc-devel's requirement on llvm-devel
  * add build-remove-llvm-dev-dependency-from-libbcc.patch</changelog>
</package>
<package pkgid="d43310472a7b1d6d789256f0d7db827d8950e64a4b30e68e171a28b40fa97154" name="bcc-devel" arch="x86_64">
  <version epoch="0" ver="0.29.1" rel="150600.5.3.2"/>
  <changelog author="shung-hsi.yu@suse.com" date="1627387200">- Update source URL for bcc and libbpf</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1631880000">- Update to 0.21.0
  + Support for kernel up to 5.13
  + support for debug information from libdebuginfod
  + finished support for map elements items_*_batch() APIs
  + add atomic_increment() API
  + support attach_func() and detach_func() in python
  + fix displaying PID instead of TID for many tools
  + new tools: kvmexit.py
  + new libbpf-tools: gethostlatency, statsnoop, fsdist and solisten
  + fix tools ttysnoop/readahead for newer kernels
  + doc update and bug fixes
- Update libbpf to 0.5
  + libbpf_set_strict_mode() allowing to opt-in into backwards incompatible libbpf-1.0 changes. See "Libbpf: the road to 1.0" and "Libbpf 1.0 migration guide" for more details.
  + streamlined error reporting for low-level APIs, high-level error-returning APIs, and pointer-returning APIs (as a libbpf-1.0 opt-in);
  + "Light" BPF skeleton support;
  + BPF_PROG_TYPE_SYSCALL support;
  + BPF perf link support for kprobe, uprobe, tracepoint, and perf_event BPF programs;
  + BPF cookie support for kprobe, uprobe, tracepoint, and perf_event BPF programs through bpf_program__attach_[ku]probe_opts() APIs;
  + allow to specify ref_ctr_off for USDT semaphores through bpf_program__attach_uprobe_opts() API;
  + btf_custom_path support in bpf_object_open_opts, allowing to specify custom BTF for CO-RE relocations;
  + sk_reuseport/migrate program type support;
  + btf_dump__dump_type_data() API, allowing to dump binary data according to BTF type description;
  + btf__load_into_kernel() and btf__load_from_kernel_by_id(), and split BTF variants of them;
  + btf__load_vmlinux_btf() and btf__load_module_btf() APIs;
  + bpf_map__initial_value() API to get initial value of mmap-ed BPF maps;
  + bpf_map_lookup_and_delete_elem_flags() API.
  + support for weak typed __ksym externs;
  + BPF timer helpers: bpf_timer_init(), bpf_timer_set_callback(), bpf_timer_start(), bpf_timer_cancel();
  + bpf_get_attach_cookie() helper to get BPF cookie from BPF program side;
  + bpf_get_func_ip() helper;
  + bpf_sys_bpf() helper;
  + bpf_task_pt_regs() helper;
  + bpf_btf_find_by_name_kind() helper;
  + usability improvements for bpf_tracing.h when target architecture is missing.
  + improve BPF support detection on old Red Hat kernels with backported BPF patches;
  + improvements for LTO builds with GCC 10+;
  + pass NLM_F_EXCL when creating TC qdisc;
  + better support of BPF map reuse on old kernels;
  + fix the bug resulting in sometimes closing FD 0, which wasn't created and owned by libbpf itself.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1631880001">- Update to 0.22.0
  + Support for kernel up to 5.14
  + add ipv4/ipv6 filter support for tcp trace tools
  + add python interface to attach raw perf events
  + fix tcpstates for incorrect display of dport
  + new options for bcc tools runqslower, argdist
  + new libbpf-tools: filetop, exitsnoop, tcprtt
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1633089600">- Use shared libbpf library instead of building it along with bcc
    + Delete libbpf-0.5.tar.gz
- Fix build on i586 due to use of shared libbpf library
    + Do-not-export-USDT-function-when-ENABLE_USDT-is-OFF.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1645012800">- Move kernel{,-devel} requirements to libbcc0 for deduplication.
- Require additionally kernel-$variant-devel for libbcc0.
- Declare python3-bcc, bcc-examples and bcc-docs as noarch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1650628800">- Update to version 0.24.0:
  + Support for kernel up to 5.16
  + bcc tools: update for trace.py, sslsniff.py, tcptop.py, hardirqs.py, etc.
  + new libbpf tools: bashreadline
  + allow specify wakeup_events for perf buffer
  + support BPF_MAP_TYPE_{INODE, TASK}_STORAGE maps
  + remove all deprecated libbpf function usage
  + remove P4/B language support
  + major test infra change, using github actions now
  + doc update, bug fixes and other tools improvement
- Changes from version 0.23.0:
  + Support for kernel up to 5.15
  + bcc tools: update for kvmexit.py, tcpv4connect.py, cachetop.py, cachestat.py, etc.
  + libbpf tools: update for update for mountsnoop, ksnoop, gethostlatency, etc.
  + fix renaming of task_struct-&gt;state
  + get pid namespace properly for a number of tools
  + initial work for more libbpf utilization (less section names)
  + doc update, bug fixes and other tools improvement
- Drop Do-not-export-USDT-function-when-ENABLE_USDT-is-OFF.patch:
  fixed upstream.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1660219200">- Update to version 0.25.0:
  + Support for kernel up to 5.19
  + bcc tool updates for oomkill.py, biolatpcts.py, sslsniff.py, tcpaccept.py, etc.
  + libbpf tool updates for klockstat, opensnoop, tcpconnect, etc.
  + new bcc tools: tcpcong
  + new libbpf tools: tcpsynbl, mdflush, oomkill, sigsnoop
  + usdt: support xmm registers as args for x64
  + bpftool as a submodule now
  + remove uses of libbpf deprecated APIs
  + use new llvm pass manager
  + support cgroup filtering libbpf tools
  + fix shared lib module offset &lt;-&gt; global addr conversion
  + riscv support
  + LoongArch support
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1672315200">- Update to version 0.26.0:
  + Support for kernel up to 6.1
  + bcc tool updates for biosnoop, opensnoop, biopattern, killsnoop, runqslower, offcputime, wakeuptime, etc.
  + libbpf-tools updates for klockstat, sigsnoop, hardirqs, softirqs, opensnoop, statsnoop, offcputime, tcplife, cpufreq, cpudist, etc.
  + new libbpf-tools: tcptop, tcpstates, biotop, capable
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1673438400">- Force specific versioning of LLVM in preparation of Leap 15.5/SLES 15-SP5
  + Remove now duplicate dependency llvm-clang-devel, having clang-devel is enough</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695297600">- Disable bcc-lua until luajit issue is resolved
- Explicitly add python3-setuptools and zip as a build requirement
- Update to version 0.28.0
  + Support for kernel up to 6.3.
  + new libbpf tool: tcppktlat.
  + bcc tool updates: funcslower, wakeuptime, profile, offcputime, deadlock,
    funccount, argdist, kvmexit, runqlen and cpuunclaimed.
  + libbpf tool update: memleak, tcprtt, tcpconnlat, funclatency, syscount,
    cpufreq, biosnoop.
  + support ringbuf_query for bcc tools.
  + handle '[uprobes]' memory mapped file properly during stack tracing.
  + Fix maximum allowed index for print_linear_hist for bcc tools.
  + add module kfunc/kretfunc support.
  + clang rewriter: initialize only the requested parameters
  + filter with available_filter_functions to make multi-functions kprobes more
    robust for both bcc and libbpf tools.
  + doc update, other bug fixes and tools improvement
- Update to version 0.27.0
  + Support for kernel up to 6.2
  + bcc tool updates for ttysnoop, slabratetop, readahead, nfsslower, cpudist,
    cachetop, cachestat, etc.
  + libbpf-tools updates for mdflush, drsnoop, statsnoop, ttysnoop, softirqs,
    wakeuptime, cachestat, numamove, etc.
  + fix for incomplete static libraries
  + implement zip archive support
  + upgrade to use c++14 standard
  + new libbpf-tools: memleak
  + add loongarch support in libbpft-tools
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695384000">- Mention boo#1215592 in spec file, which tracks the problem with luajit
  that require temporarily disabling bcc-lua</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695643200">- Disable building of tests file
  + Remove zip from build requirements as it is no longer needed</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1697457600">- Re-enable bcc-lua now that boo#1215592 is resolved</changelog>
  <changelog author="steven.kowalik@suse.com" date="1701777600">- Remove unneeded Requires on python3-future.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1706270400">- Switch to LLVM 17
- Change LLVM version macro to the cleaner alternative suggested in
  SR#1134405
- Update to version 0.29.1
  * support for kernel up to 6.6.
  * new bcc tools: rdmaucma
  * bcc tool update: tcpstates, statsnoop, runqlat, bio tools,
    tcptop, slabratetop, tcprtt, etc.
  * doc update, other bug fixes and tools improvement, and some new
    enhancement for powerpc and riscv.</changelog>
  <changelog author="dimstar@opensuse.org" date="1709035200">- Have the -devel package require llvm%{llvm_major_version}-devel:
  /usr/include/bcc/bpf_module.h:25:10 includes
  llvm/Config/llvm-config.h.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1710244800">- Update LLVM version macro to support SLE (bsc#1220746)</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1711454400">- Update bcc-devel requirement to depend on specific version of llvm-devel</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1714737600">- Fix incorrect offset calculation when consecutive bitfields are
  present (bsc#1219096)
  * add fix-alignment-issue-on-x86_64-due-to-consecutive-bit.patch</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717502400">- Remove bcc-devel's requirement on llvm-devel
  * add build-remove-llvm-dev-dependency-from-libbcc.patch</changelog>
</package>
<package pkgid="416da9d3331f1bce3fe17a23f760968ff39fd51246f4e8ec8445ff2fefc8d6e4" name="bcc-docs" arch="noarch">
  <version epoch="0" ver="0.29.1" rel="150600.5.3.2"/>
  <changelog author="shung-hsi.yu@suse.com" date="1627387200">- Update source URL for bcc and libbpf</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1631880000">- Update to 0.21.0
  + Support for kernel up to 5.13
  + support for debug information from libdebuginfod
  + finished support for map elements items_*_batch() APIs
  + add atomic_increment() API
  + support attach_func() and detach_func() in python
  + fix displaying PID instead of TID for many tools
  + new tools: kvmexit.py
  + new libbpf-tools: gethostlatency, statsnoop, fsdist and solisten
  + fix tools ttysnoop/readahead for newer kernels
  + doc update and bug fixes
- Update libbpf to 0.5
  + libbpf_set_strict_mode() allowing to opt-in into backwards incompatible libbpf-1.0 changes. See "Libbpf: the road to 1.0" and "Libbpf 1.0 migration guide" for more details.
  + streamlined error reporting for low-level APIs, high-level error-returning APIs, and pointer-returning APIs (as a libbpf-1.0 opt-in);
  + "Light" BPF skeleton support;
  + BPF_PROG_TYPE_SYSCALL support;
  + BPF perf link support for kprobe, uprobe, tracepoint, and perf_event BPF programs;
  + BPF cookie support for kprobe, uprobe, tracepoint, and perf_event BPF programs through bpf_program__attach_[ku]probe_opts() APIs;
  + allow to specify ref_ctr_off for USDT semaphores through bpf_program__attach_uprobe_opts() API;
  + btf_custom_path support in bpf_object_open_opts, allowing to specify custom BTF for CO-RE relocations;
  + sk_reuseport/migrate program type support;
  + btf_dump__dump_type_data() API, allowing to dump binary data according to BTF type description;
  + btf__load_into_kernel() and btf__load_from_kernel_by_id(), and split BTF variants of them;
  + btf__load_vmlinux_btf() and btf__load_module_btf() APIs;
  + bpf_map__initial_value() API to get initial value of mmap-ed BPF maps;
  + bpf_map_lookup_and_delete_elem_flags() API.
  + support for weak typed __ksym externs;
  + BPF timer helpers: bpf_timer_init(), bpf_timer_set_callback(), bpf_timer_start(), bpf_timer_cancel();
  + bpf_get_attach_cookie() helper to get BPF cookie from BPF program side;
  + bpf_get_func_ip() helper;
  + bpf_sys_bpf() helper;
  + bpf_task_pt_regs() helper;
  + bpf_btf_find_by_name_kind() helper;
  + usability improvements for bpf_tracing.h when target architecture is missing.
  + improve BPF support detection on old Red Hat kernels with backported BPF patches;
  + improvements for LTO builds with GCC 10+;
  + pass NLM_F_EXCL when creating TC qdisc;
  + better support of BPF map reuse on old kernels;
  + fix the bug resulting in sometimes closing FD 0, which wasn't created and owned by libbpf itself.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1631880001">- Update to 0.22.0
  + Support for kernel up to 5.14
  + add ipv4/ipv6 filter support for tcp trace tools
  + add python interface to attach raw perf events
  + fix tcpstates for incorrect display of dport
  + new options for bcc tools runqslower, argdist
  + new libbpf-tools: filetop, exitsnoop, tcprtt
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1633089600">- Use shared libbpf library instead of building it along with bcc
    + Delete libbpf-0.5.tar.gz
- Fix build on i586 due to use of shared libbpf library
    + Do-not-export-USDT-function-when-ENABLE_USDT-is-OFF.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1645012800">- Move kernel{,-devel} requirements to libbcc0 for deduplication.
- Require additionally kernel-$variant-devel for libbcc0.
- Declare python3-bcc, bcc-examples and bcc-docs as noarch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1650628800">- Update to version 0.24.0:
  + Support for kernel up to 5.16
  + bcc tools: update for trace.py, sslsniff.py, tcptop.py, hardirqs.py, etc.
  + new libbpf tools: bashreadline
  + allow specify wakeup_events for perf buffer
  + support BPF_MAP_TYPE_{INODE, TASK}_STORAGE maps
  + remove all deprecated libbpf function usage
  + remove P4/B language support
  + major test infra change, using github actions now
  + doc update, bug fixes and other tools improvement
- Changes from version 0.23.0:
  + Support for kernel up to 5.15
  + bcc tools: update for kvmexit.py, tcpv4connect.py, cachetop.py, cachestat.py, etc.
  + libbpf tools: update for update for mountsnoop, ksnoop, gethostlatency, etc.
  + fix renaming of task_struct-&gt;state
  + get pid namespace properly for a number of tools
  + initial work for more libbpf utilization (less section names)
  + doc update, bug fixes and other tools improvement
- Drop Do-not-export-USDT-function-when-ENABLE_USDT-is-OFF.patch:
  fixed upstream.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1660219200">- Update to version 0.25.0:
  + Support for kernel up to 5.19
  + bcc tool updates for oomkill.py, biolatpcts.py, sslsniff.py, tcpaccept.py, etc.
  + libbpf tool updates for klockstat, opensnoop, tcpconnect, etc.
  + new bcc tools: tcpcong
  + new libbpf tools: tcpsynbl, mdflush, oomkill, sigsnoop
  + usdt: support xmm registers as args for x64
  + bpftool as a submodule now
  + remove uses of libbpf deprecated APIs
  + use new llvm pass manager
  + support cgroup filtering libbpf tools
  + fix shared lib module offset &lt;-&gt; global addr conversion
  + riscv support
  + LoongArch support
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1672315200">- Update to version 0.26.0:
  + Support for kernel up to 6.1
  + bcc tool updates for biosnoop, opensnoop, biopattern, killsnoop, runqslower, offcputime, wakeuptime, etc.
  + libbpf-tools updates for klockstat, sigsnoop, hardirqs, softirqs, opensnoop, statsnoop, offcputime, tcplife, cpufreq, cpudist, etc.
  + new libbpf-tools: tcptop, tcpstates, biotop, capable
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1673438400">- Force specific versioning of LLVM in preparation of Leap 15.5/SLES 15-SP5
  + Remove now duplicate dependency llvm-clang-devel, having clang-devel is enough</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695297600">- Disable bcc-lua until luajit issue is resolved
- Explicitly add python3-setuptools and zip as a build requirement
- Update to version 0.28.0
  + Support for kernel up to 6.3.
  + new libbpf tool: tcppktlat.
  + bcc tool updates: funcslower, wakeuptime, profile, offcputime, deadlock,
    funccount, argdist, kvmexit, runqlen and cpuunclaimed.
  + libbpf tool update: memleak, tcprtt, tcpconnlat, funclatency, syscount,
    cpufreq, biosnoop.
  + support ringbuf_query for bcc tools.
  + handle '[uprobes]' memory mapped file properly during stack tracing.
  + Fix maximum allowed index for print_linear_hist for bcc tools.
  + add module kfunc/kretfunc support.
  + clang rewriter: initialize only the requested parameters
  + filter with available_filter_functions to make multi-functions kprobes more
    robust for both bcc and libbpf tools.
  + doc update, other bug fixes and tools improvement
- Update to version 0.27.0
  + Support for kernel up to 6.2
  + bcc tool updates for ttysnoop, slabratetop, readahead, nfsslower, cpudist,
    cachetop, cachestat, etc.
  + libbpf-tools updates for mdflush, drsnoop, statsnoop, ttysnoop, softirqs,
    wakeuptime, cachestat, numamove, etc.
  + fix for incomplete static libraries
  + implement zip archive support
  + upgrade to use c++14 standard
  + new libbpf-tools: memleak
  + add loongarch support in libbpft-tools
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695384000">- Mention boo#1215592 in spec file, which tracks the problem with luajit
  that require temporarily disabling bcc-lua</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695643200">- Disable building of tests file
  + Remove zip from build requirements as it is no longer needed</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1697457600">- Re-enable bcc-lua now that boo#1215592 is resolved</changelog>
  <changelog author="steven.kowalik@suse.com" date="1701777600">- Remove unneeded Requires on python3-future.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1706270400">- Switch to LLVM 17
- Change LLVM version macro to the cleaner alternative suggested in
  SR#1134405
- Update to version 0.29.1
  * support for kernel up to 6.6.
  * new bcc tools: rdmaucma
  * bcc tool update: tcpstates, statsnoop, runqlat, bio tools,
    tcptop, slabratetop, tcprtt, etc.
  * doc update, other bug fixes and tools improvement, and some new
    enhancement for powerpc and riscv.</changelog>
  <changelog author="dimstar@opensuse.org" date="1709035200">- Have the -devel package require llvm%{llvm_major_version}-devel:
  /usr/include/bcc/bpf_module.h:25:10 includes
  llvm/Config/llvm-config.h.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1710244800">- Update LLVM version macro to support SLE (bsc#1220746)</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1711454400">- Update bcc-devel requirement to depend on specific version of llvm-devel</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1714737600">- Fix incorrect offset calculation when consecutive bitfields are
  present (bsc#1219096)
  * add fix-alignment-issue-on-x86_64-due-to-consecutive-bit.patch</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717502400">- Remove bcc-devel's requirement on llvm-devel
  * add build-remove-llvm-dev-dependency-from-libbcc.patch</changelog>
</package>
<package pkgid="5653f8b348015b3882dade8f4674b9d9a9718ee1375e103d5bf18c3131e34488" name="bcc-examples" arch="noarch">
  <version epoch="0" ver="0.29.1" rel="150600.5.3.2"/>
  <changelog author="shung-hsi.yu@suse.com" date="1627387200">- Update source URL for bcc and libbpf</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1631880000">- Update to 0.21.0
  + Support for kernel up to 5.13
  + support for debug information from libdebuginfod
  + finished support for map elements items_*_batch() APIs
  + add atomic_increment() API
  + support attach_func() and detach_func() in python
  + fix displaying PID instead of TID for many tools
  + new tools: kvmexit.py
  + new libbpf-tools: gethostlatency, statsnoop, fsdist and solisten
  + fix tools ttysnoop/readahead for newer kernels
  + doc update and bug fixes
- Update libbpf to 0.5
  + libbpf_set_strict_mode() allowing to opt-in into backwards incompatible libbpf-1.0 changes. See "Libbpf: the road to 1.0" and "Libbpf 1.0 migration guide" for more details.
  + streamlined error reporting for low-level APIs, high-level error-returning APIs, and pointer-returning APIs (as a libbpf-1.0 opt-in);
  + "Light" BPF skeleton support;
  + BPF_PROG_TYPE_SYSCALL support;
  + BPF perf link support for kprobe, uprobe, tracepoint, and perf_event BPF programs;
  + BPF cookie support for kprobe, uprobe, tracepoint, and perf_event BPF programs through bpf_program__attach_[ku]probe_opts() APIs;
  + allow to specify ref_ctr_off for USDT semaphores through bpf_program__attach_uprobe_opts() API;
  + btf_custom_path support in bpf_object_open_opts, allowing to specify custom BTF for CO-RE relocations;
  + sk_reuseport/migrate program type support;
  + btf_dump__dump_type_data() API, allowing to dump binary data according to BTF type description;
  + btf__load_into_kernel() and btf__load_from_kernel_by_id(), and split BTF variants of them;
  + btf__load_vmlinux_btf() and btf__load_module_btf() APIs;
  + bpf_map__initial_value() API to get initial value of mmap-ed BPF maps;
  + bpf_map_lookup_and_delete_elem_flags() API.
  + support for weak typed __ksym externs;
  + BPF timer helpers: bpf_timer_init(), bpf_timer_set_callback(), bpf_timer_start(), bpf_timer_cancel();
  + bpf_get_attach_cookie() helper to get BPF cookie from BPF program side;
  + bpf_get_func_ip() helper;
  + bpf_sys_bpf() helper;
  + bpf_task_pt_regs() helper;
  + bpf_btf_find_by_name_kind() helper;
  + usability improvements for bpf_tracing.h when target architecture is missing.
  + improve BPF support detection on old Red Hat kernels with backported BPF patches;
  + improvements for LTO builds with GCC 10+;
  + pass NLM_F_EXCL when creating TC qdisc;
  + better support of BPF map reuse on old kernels;
  + fix the bug resulting in sometimes closing FD 0, which wasn't created and owned by libbpf itself.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1631880001">- Update to 0.22.0
  + Support for kernel up to 5.14
  + add ipv4/ipv6 filter support for tcp trace tools
  + add python interface to attach raw perf events
  + fix tcpstates for incorrect display of dport
  + new options for bcc tools runqslower, argdist
  + new libbpf-tools: filetop, exitsnoop, tcprtt
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1633089600">- Use shared libbpf library instead of building it along with bcc
    + Delete libbpf-0.5.tar.gz
- Fix build on i586 due to use of shared libbpf library
    + Do-not-export-USDT-function-when-ENABLE_USDT-is-OFF.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1645012800">- Move kernel{,-devel} requirements to libbcc0 for deduplication.
- Require additionally kernel-$variant-devel for libbcc0.
- Declare python3-bcc, bcc-examples and bcc-docs as noarch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1650628800">- Update to version 0.24.0:
  + Support for kernel up to 5.16
  + bcc tools: update for trace.py, sslsniff.py, tcptop.py, hardirqs.py, etc.
  + new libbpf tools: bashreadline
  + allow specify wakeup_events for perf buffer
  + support BPF_MAP_TYPE_{INODE, TASK}_STORAGE maps
  + remove all deprecated libbpf function usage
  + remove P4/B language support
  + major test infra change, using github actions now
  + doc update, bug fixes and other tools improvement
- Changes from version 0.23.0:
  + Support for kernel up to 5.15
  + bcc tools: update for kvmexit.py, tcpv4connect.py, cachetop.py, cachestat.py, etc.
  + libbpf tools: update for update for mountsnoop, ksnoop, gethostlatency, etc.
  + fix renaming of task_struct-&gt;state
  + get pid namespace properly for a number of tools
  + initial work for more libbpf utilization (less section names)
  + doc update, bug fixes and other tools improvement
- Drop Do-not-export-USDT-function-when-ENABLE_USDT-is-OFF.patch:
  fixed upstream.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1660219200">- Update to version 0.25.0:
  + Support for kernel up to 5.19
  + bcc tool updates for oomkill.py, biolatpcts.py, sslsniff.py, tcpaccept.py, etc.
  + libbpf tool updates for klockstat, opensnoop, tcpconnect, etc.
  + new bcc tools: tcpcong
  + new libbpf tools: tcpsynbl, mdflush, oomkill, sigsnoop
  + usdt: support xmm registers as args for x64
  + bpftool as a submodule now
  + remove uses of libbpf deprecated APIs
  + use new llvm pass manager
  + support cgroup filtering libbpf tools
  + fix shared lib module offset &lt;-&gt; global addr conversion
  + riscv support
  + LoongArch support
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1672315200">- Update to version 0.26.0:
  + Support for kernel up to 6.1
  + bcc tool updates for biosnoop, opensnoop, biopattern, killsnoop, runqslower, offcputime, wakeuptime, etc.
  + libbpf-tools updates for klockstat, sigsnoop, hardirqs, softirqs, opensnoop, statsnoop, offcputime, tcplife, cpufreq, cpudist, etc.
  + new libbpf-tools: tcptop, tcpstates, biotop, capable
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1673438400">- Force specific versioning of LLVM in preparation of Leap 15.5/SLES 15-SP5
  + Remove now duplicate dependency llvm-clang-devel, having clang-devel is enough</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695297600">- Disable bcc-lua until luajit issue is resolved
- Explicitly add python3-setuptools and zip as a build requirement
- Update to version 0.28.0
  + Support for kernel up to 6.3.
  + new libbpf tool: tcppktlat.
  + bcc tool updates: funcslower, wakeuptime, profile, offcputime, deadlock,
    funccount, argdist, kvmexit, runqlen and cpuunclaimed.
  + libbpf tool update: memleak, tcprtt, tcpconnlat, funclatency, syscount,
    cpufreq, biosnoop.
  + support ringbuf_query for bcc tools.
  + handle '[uprobes]' memory mapped file properly during stack tracing.
  + Fix maximum allowed index for print_linear_hist for bcc tools.
  + add module kfunc/kretfunc support.
  + clang rewriter: initialize only the requested parameters
  + filter with available_filter_functions to make multi-functions kprobes more
    robust for both bcc and libbpf tools.
  + doc update, other bug fixes and tools improvement
- Update to version 0.27.0
  + Support for kernel up to 6.2
  + bcc tool updates for ttysnoop, slabratetop, readahead, nfsslower, cpudist,
    cachetop, cachestat, etc.
  + libbpf-tools updates for mdflush, drsnoop, statsnoop, ttysnoop, softirqs,
    wakeuptime, cachestat, numamove, etc.
  + fix for incomplete static libraries
  + implement zip archive support
  + upgrade to use c++14 standard
  + new libbpf-tools: memleak
  + add loongarch support in libbpft-tools
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695384000">- Mention boo#1215592 in spec file, which tracks the problem with luajit
  that require temporarily disabling bcc-lua</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695643200">- Disable building of tests file
  + Remove zip from build requirements as it is no longer needed</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1697457600">- Re-enable bcc-lua now that boo#1215592 is resolved</changelog>
  <changelog author="steven.kowalik@suse.com" date="1701777600">- Remove unneeded Requires on python3-future.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1706270400">- Switch to LLVM 17
- Change LLVM version macro to the cleaner alternative suggested in
  SR#1134405
- Update to version 0.29.1
  * support for kernel up to 6.6.
  * new bcc tools: rdmaucma
  * bcc tool update: tcpstates, statsnoop, runqlat, bio tools,
    tcptop, slabratetop, tcprtt, etc.
  * doc update, other bug fixes and tools improvement, and some new
    enhancement for powerpc and riscv.</changelog>
  <changelog author="dimstar@opensuse.org" date="1709035200">- Have the -devel package require llvm%{llvm_major_version}-devel:
  /usr/include/bcc/bpf_module.h:25:10 includes
  llvm/Config/llvm-config.h.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1710244800">- Update LLVM version macro to support SLE (bsc#1220746)</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1711454400">- Update bcc-devel requirement to depend on specific version of llvm-devel</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1714737600">- Fix incorrect offset calculation when consecutive bitfields are
  present (bsc#1219096)
  * add fix-alignment-issue-on-x86_64-due-to-consecutive-bit.patch</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717502400">- Remove bcc-devel's requirement on llvm-devel
  * add build-remove-llvm-dev-dependency-from-libbcc.patch</changelog>
</package>
<package pkgid="1ce2ff96d7b1fa4149de45239dbcefceb893ab97a6695d10e6407fdc9226de2f" name="bcc-tools" arch="aarch64">
  <version epoch="0" ver="0.29.1" rel="150600.5.3.2"/>
  <changelog author="shung-hsi.yu@suse.com" date="1627387200">- Update source URL for bcc and libbpf</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1631880000">- Update to 0.21.0
  + Support for kernel up to 5.13
  + support for debug information from libdebuginfod
  + finished support for map elements items_*_batch() APIs
  + add atomic_increment() API
  + support attach_func() and detach_func() in python
  + fix displaying PID instead of TID for many tools
  + new tools: kvmexit.py
  + new libbpf-tools: gethostlatency, statsnoop, fsdist and solisten
  + fix tools ttysnoop/readahead for newer kernels
  + doc update and bug fixes
- Update libbpf to 0.5
  + libbpf_set_strict_mode() allowing to opt-in into backwards incompatible libbpf-1.0 changes. See "Libbpf: the road to 1.0" and "Libbpf 1.0 migration guide" for more details.
  + streamlined error reporting for low-level APIs, high-level error-returning APIs, and pointer-returning APIs (as a libbpf-1.0 opt-in);
  + "Light" BPF skeleton support;
  + BPF_PROG_TYPE_SYSCALL support;
  + BPF perf link support for kprobe, uprobe, tracepoint, and perf_event BPF programs;
  + BPF cookie support for kprobe, uprobe, tracepoint, and perf_event BPF programs through bpf_program__attach_[ku]probe_opts() APIs;
  + allow to specify ref_ctr_off for USDT semaphores through bpf_program__attach_uprobe_opts() API;
  + btf_custom_path support in bpf_object_open_opts, allowing to specify custom BTF for CO-RE relocations;
  + sk_reuseport/migrate program type support;
  + btf_dump__dump_type_data() API, allowing to dump binary data according to BTF type description;
  + btf__load_into_kernel() and btf__load_from_kernel_by_id(), and split BTF variants of them;
  + btf__load_vmlinux_btf() and btf__load_module_btf() APIs;
  + bpf_map__initial_value() API to get initial value of mmap-ed BPF maps;
  + bpf_map_lookup_and_delete_elem_flags() API.
  + support for weak typed __ksym externs;
  + BPF timer helpers: bpf_timer_init(), bpf_timer_set_callback(), bpf_timer_start(), bpf_timer_cancel();
  + bpf_get_attach_cookie() helper to get BPF cookie from BPF program side;
  + bpf_get_func_ip() helper;
  + bpf_sys_bpf() helper;
  + bpf_task_pt_regs() helper;
  + bpf_btf_find_by_name_kind() helper;
  + usability improvements for bpf_tracing.h when target architecture is missing.
  + improve BPF support detection on old Red Hat kernels with backported BPF patches;
  + improvements for LTO builds with GCC 10+;
  + pass NLM_F_EXCL when creating TC qdisc;
  + better support of BPF map reuse on old kernels;
  + fix the bug resulting in sometimes closing FD 0, which wasn't created and owned by libbpf itself.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1631880001">- Update to 0.22.0
  + Support for kernel up to 5.14
  + add ipv4/ipv6 filter support for tcp trace tools
  + add python interface to attach raw perf events
  + fix tcpstates for incorrect display of dport
  + new options for bcc tools runqslower, argdist
  + new libbpf-tools: filetop, exitsnoop, tcprtt
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1633089600">- Use shared libbpf library instead of building it along with bcc
    + Delete libbpf-0.5.tar.gz
- Fix build on i586 due to use of shared libbpf library
    + Do-not-export-USDT-function-when-ENABLE_USDT-is-OFF.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1645012800">- Move kernel{,-devel} requirements to libbcc0 for deduplication.
- Require additionally kernel-$variant-devel for libbcc0.
- Declare python3-bcc, bcc-examples and bcc-docs as noarch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1650628800">- Update to version 0.24.0:
  + Support for kernel up to 5.16
  + bcc tools: update for trace.py, sslsniff.py, tcptop.py, hardirqs.py, etc.
  + new libbpf tools: bashreadline
  + allow specify wakeup_events for perf buffer
  + support BPF_MAP_TYPE_{INODE, TASK}_STORAGE maps
  + remove all deprecated libbpf function usage
  + remove P4/B language support
  + major test infra change, using github actions now
  + doc update, bug fixes and other tools improvement
- Changes from version 0.23.0:
  + Support for kernel up to 5.15
  + bcc tools: update for kvmexit.py, tcpv4connect.py, cachetop.py, cachestat.py, etc.
  + libbpf tools: update for update for mountsnoop, ksnoop, gethostlatency, etc.
  + fix renaming of task_struct-&gt;state
  + get pid namespace properly for a number of tools
  + initial work for more libbpf utilization (less section names)
  + doc update, bug fixes and other tools improvement
- Drop Do-not-export-USDT-function-when-ENABLE_USDT-is-OFF.patch:
  fixed upstream.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1660219200">- Update to version 0.25.0:
  + Support for kernel up to 5.19
  + bcc tool updates for oomkill.py, biolatpcts.py, sslsniff.py, tcpaccept.py, etc.
  + libbpf tool updates for klockstat, opensnoop, tcpconnect, etc.
  + new bcc tools: tcpcong
  + new libbpf tools: tcpsynbl, mdflush, oomkill, sigsnoop
  + usdt: support xmm registers as args for x64
  + bpftool as a submodule now
  + remove uses of libbpf deprecated APIs
  + use new llvm pass manager
  + support cgroup filtering libbpf tools
  + fix shared lib module offset &lt;-&gt; global addr conversion
  + riscv support
  + LoongArch support
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1672315200">- Update to version 0.26.0:
  + Support for kernel up to 6.1
  + bcc tool updates for biosnoop, opensnoop, biopattern, killsnoop, runqslower, offcputime, wakeuptime, etc.
  + libbpf-tools updates for klockstat, sigsnoop, hardirqs, softirqs, opensnoop, statsnoop, offcputime, tcplife, cpufreq, cpudist, etc.
  + new libbpf-tools: tcptop, tcpstates, biotop, capable
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1673438400">- Force specific versioning of LLVM in preparation of Leap 15.5/SLES 15-SP5
  + Remove now duplicate dependency llvm-clang-devel, having clang-devel is enough</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695297600">- Disable bcc-lua until luajit issue is resolved
- Explicitly add python3-setuptools and zip as a build requirement
- Update to version 0.28.0
  + Support for kernel up to 6.3.
  + new libbpf tool: tcppktlat.
  + bcc tool updates: funcslower, wakeuptime, profile, offcputime, deadlock,
    funccount, argdist, kvmexit, runqlen and cpuunclaimed.
  + libbpf tool update: memleak, tcprtt, tcpconnlat, funclatency, syscount,
    cpufreq, biosnoop.
  + support ringbuf_query for bcc tools.
  + handle '[uprobes]' memory mapped file properly during stack tracing.
  + Fix maximum allowed index for print_linear_hist for bcc tools.
  + add module kfunc/kretfunc support.
  + clang rewriter: initialize only the requested parameters
  + filter with available_filter_functions to make multi-functions kprobes more
    robust for both bcc and libbpf tools.
  + doc update, other bug fixes and tools improvement
- Update to version 0.27.0
  + Support for kernel up to 6.2
  + bcc tool updates for ttysnoop, slabratetop, readahead, nfsslower, cpudist,
    cachetop, cachestat, etc.
  + libbpf-tools updates for mdflush, drsnoop, statsnoop, ttysnoop, softirqs,
    wakeuptime, cachestat, numamove, etc.
  + fix for incomplete static libraries
  + implement zip archive support
  + upgrade to use c++14 standard
  + new libbpf-tools: memleak
  + add loongarch support in libbpft-tools
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695384000">- Mention boo#1215592 in spec file, which tracks the problem with luajit
  that require temporarily disabling bcc-lua</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695643200">- Disable building of tests file
  + Remove zip from build requirements as it is no longer needed</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1697457600">- Re-enable bcc-lua now that boo#1215592 is resolved</changelog>
  <changelog author="steven.kowalik@suse.com" date="1701777600">- Remove unneeded Requires on python3-future.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1706270400">- Switch to LLVM 17
- Change LLVM version macro to the cleaner alternative suggested in
  SR#1134405
- Update to version 0.29.1
  * support for kernel up to 6.6.
  * new bcc tools: rdmaucma
  * bcc tool update: tcpstates, statsnoop, runqlat, bio tools,
    tcptop, slabratetop, tcprtt, etc.
  * doc update, other bug fixes and tools improvement, and some new
    enhancement for powerpc and riscv.</changelog>
  <changelog author="dimstar@opensuse.org" date="1709035200">- Have the -devel package require llvm%{llvm_major_version}-devel:
  /usr/include/bcc/bpf_module.h:25:10 includes
  llvm/Config/llvm-config.h.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1710244800">- Update LLVM version macro to support SLE (bsc#1220746)</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1711454400">- Update bcc-devel requirement to depend on specific version of llvm-devel</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1714737600">- Fix incorrect offset calculation when consecutive bitfields are
  present (bsc#1219096)
  * add fix-alignment-issue-on-x86_64-due-to-consecutive-bit.patch</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717502400">- Remove bcc-devel's requirement on llvm-devel
  * add build-remove-llvm-dev-dependency-from-libbcc.patch</changelog>
</package>
<package pkgid="ba0d570de8c80ada527a16b23a9bc55c3183de46c84547d846f332234767dddb" name="bcc-tools" arch="ppc64le">
  <version epoch="0" ver="0.29.1" rel="150600.5.3.2"/>
  <changelog author="shung-hsi.yu@suse.com" date="1627387200">- Update source URL for bcc and libbpf</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1631880000">- Update to 0.21.0
  + Support for kernel up to 5.13
  + support for debug information from libdebuginfod
  + finished support for map elements items_*_batch() APIs
  + add atomic_increment() API
  + support attach_func() and detach_func() in python
  + fix displaying PID instead of TID for many tools
  + new tools: kvmexit.py
  + new libbpf-tools: gethostlatency, statsnoop, fsdist and solisten
  + fix tools ttysnoop/readahead for newer kernels
  + doc update and bug fixes
- Update libbpf to 0.5
  + libbpf_set_strict_mode() allowing to opt-in into backwards incompatible libbpf-1.0 changes. See "Libbpf: the road to 1.0" and "Libbpf 1.0 migration guide" for more details.
  + streamlined error reporting for low-level APIs, high-level error-returning APIs, and pointer-returning APIs (as a libbpf-1.0 opt-in);
  + "Light" BPF skeleton support;
  + BPF_PROG_TYPE_SYSCALL support;
  + BPF perf link support for kprobe, uprobe, tracepoint, and perf_event BPF programs;
  + BPF cookie support for kprobe, uprobe, tracepoint, and perf_event BPF programs through bpf_program__attach_[ku]probe_opts() APIs;
  + allow to specify ref_ctr_off for USDT semaphores through bpf_program__attach_uprobe_opts() API;
  + btf_custom_path support in bpf_object_open_opts, allowing to specify custom BTF for CO-RE relocations;
  + sk_reuseport/migrate program type support;
  + btf_dump__dump_type_data() API, allowing to dump binary data according to BTF type description;
  + btf__load_into_kernel() and btf__load_from_kernel_by_id(), and split BTF variants of them;
  + btf__load_vmlinux_btf() and btf__load_module_btf() APIs;
  + bpf_map__initial_value() API to get initial value of mmap-ed BPF maps;
  + bpf_map_lookup_and_delete_elem_flags() API.
  + support for weak typed __ksym externs;
  + BPF timer helpers: bpf_timer_init(), bpf_timer_set_callback(), bpf_timer_start(), bpf_timer_cancel();
  + bpf_get_attach_cookie() helper to get BPF cookie from BPF program side;
  + bpf_get_func_ip() helper;
  + bpf_sys_bpf() helper;
  + bpf_task_pt_regs() helper;
  + bpf_btf_find_by_name_kind() helper;
  + usability improvements for bpf_tracing.h when target architecture is missing.
  + improve BPF support detection on old Red Hat kernels with backported BPF patches;
  + improvements for LTO builds with GCC 10+;
  + pass NLM_F_EXCL when creating TC qdisc;
  + better support of BPF map reuse on old kernels;
  + fix the bug resulting in sometimes closing FD 0, which wasn't created and owned by libbpf itself.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1631880001">- Update to 0.22.0
  + Support for kernel up to 5.14
  + add ipv4/ipv6 filter support for tcp trace tools
  + add python interface to attach raw perf events
  + fix tcpstates for incorrect display of dport
  + new options for bcc tools runqslower, argdist
  + new libbpf-tools: filetop, exitsnoop, tcprtt
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1633089600">- Use shared libbpf library instead of building it along with bcc
    + Delete libbpf-0.5.tar.gz
- Fix build on i586 due to use of shared libbpf library
    + Do-not-export-USDT-function-when-ENABLE_USDT-is-OFF.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1645012800">- Move kernel{,-devel} requirements to libbcc0 for deduplication.
- Require additionally kernel-$variant-devel for libbcc0.
- Declare python3-bcc, bcc-examples and bcc-docs as noarch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1650628800">- Update to version 0.24.0:
  + Support for kernel up to 5.16
  + bcc tools: update for trace.py, sslsniff.py, tcptop.py, hardirqs.py, etc.
  + new libbpf tools: bashreadline
  + allow specify wakeup_events for perf buffer
  + support BPF_MAP_TYPE_{INODE, TASK}_STORAGE maps
  + remove all deprecated libbpf function usage
  + remove P4/B language support
  + major test infra change, using github actions now
  + doc update, bug fixes and other tools improvement
- Changes from version 0.23.0:
  + Support for kernel up to 5.15
  + bcc tools: update for kvmexit.py, tcpv4connect.py, cachetop.py, cachestat.py, etc.
  + libbpf tools: update for update for mountsnoop, ksnoop, gethostlatency, etc.
  + fix renaming of task_struct-&gt;state
  + get pid namespace properly for a number of tools
  + initial work for more libbpf utilization (less section names)
  + doc update, bug fixes and other tools improvement
- Drop Do-not-export-USDT-function-when-ENABLE_USDT-is-OFF.patch:
  fixed upstream.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1660219200">- Update to version 0.25.0:
  + Support for kernel up to 5.19
  + bcc tool updates for oomkill.py, biolatpcts.py, sslsniff.py, tcpaccept.py, etc.
  + libbpf tool updates for klockstat, opensnoop, tcpconnect, etc.
  + new bcc tools: tcpcong
  + new libbpf tools: tcpsynbl, mdflush, oomkill, sigsnoop
  + usdt: support xmm registers as args for x64
  + bpftool as a submodule now
  + remove uses of libbpf deprecated APIs
  + use new llvm pass manager
  + support cgroup filtering libbpf tools
  + fix shared lib module offset &lt;-&gt; global addr conversion
  + riscv support
  + LoongArch support
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1672315200">- Update to version 0.26.0:
  + Support for kernel up to 6.1
  + bcc tool updates for biosnoop, opensnoop, biopattern, killsnoop, runqslower, offcputime, wakeuptime, etc.
  + libbpf-tools updates for klockstat, sigsnoop, hardirqs, softirqs, opensnoop, statsnoop, offcputime, tcplife, cpufreq, cpudist, etc.
  + new libbpf-tools: tcptop, tcpstates, biotop, capable
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1673438400">- Force specific versioning of LLVM in preparation of Leap 15.5/SLES 15-SP5
  + Remove now duplicate dependency llvm-clang-devel, having clang-devel is enough</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695297600">- Disable bcc-lua until luajit issue is resolved
- Explicitly add python3-setuptools and zip as a build requirement
- Update to version 0.28.0
  + Support for kernel up to 6.3.
  + new libbpf tool: tcppktlat.
  + bcc tool updates: funcslower, wakeuptime, profile, offcputime, deadlock,
    funccount, argdist, kvmexit, runqlen and cpuunclaimed.
  + libbpf tool update: memleak, tcprtt, tcpconnlat, funclatency, syscount,
    cpufreq, biosnoop.
  + support ringbuf_query for bcc tools.
  + handle '[uprobes]' memory mapped file properly during stack tracing.
  + Fix maximum allowed index for print_linear_hist for bcc tools.
  + add module kfunc/kretfunc support.
  + clang rewriter: initialize only the requested parameters
  + filter with available_filter_functions to make multi-functions kprobes more
    robust for both bcc and libbpf tools.
  + doc update, other bug fixes and tools improvement
- Update to version 0.27.0
  + Support for kernel up to 6.2
  + bcc tool updates for ttysnoop, slabratetop, readahead, nfsslower, cpudist,
    cachetop, cachestat, etc.
  + libbpf-tools updates for mdflush, drsnoop, statsnoop, ttysnoop, softirqs,
    wakeuptime, cachestat, numamove, etc.
  + fix for incomplete static libraries
  + implement zip archive support
  + upgrade to use c++14 standard
  + new libbpf-tools: memleak
  + add loongarch support in libbpft-tools
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695384000">- Mention boo#1215592 in spec file, which tracks the problem with luajit
  that require temporarily disabling bcc-lua</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695643200">- Disable building of tests file
  + Remove zip from build requirements as it is no longer needed</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1697457600">- Re-enable bcc-lua now that boo#1215592 is resolved</changelog>
  <changelog author="steven.kowalik@suse.com" date="1701777600">- Remove unneeded Requires on python3-future.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1706270400">- Switch to LLVM 17
- Change LLVM version macro to the cleaner alternative suggested in
  SR#1134405
- Update to version 0.29.1
  * support for kernel up to 6.6.
  * new bcc tools: rdmaucma
  * bcc tool update: tcpstates, statsnoop, runqlat, bio tools,
    tcptop, slabratetop, tcprtt, etc.
  * doc update, other bug fixes and tools improvement, and some new
    enhancement for powerpc and riscv.</changelog>
  <changelog author="dimstar@opensuse.org" date="1709035200">- Have the -devel package require llvm%{llvm_major_version}-devel:
  /usr/include/bcc/bpf_module.h:25:10 includes
  llvm/Config/llvm-config.h.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1710244800">- Update LLVM version macro to support SLE (bsc#1220746)</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1711454400">- Update bcc-devel requirement to depend on specific version of llvm-devel</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1714737600">- Fix incorrect offset calculation when consecutive bitfields are
  present (bsc#1219096)
  * add fix-alignment-issue-on-x86_64-due-to-consecutive-bit.patch</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717502400">- Remove bcc-devel's requirement on llvm-devel
  * add build-remove-llvm-dev-dependency-from-libbcc.patch</changelog>
</package>
<package pkgid="1e0b8ee257a6d55c9154a54b2ff7d7df07f0539cd10e8d49862082b548656a66" name="bcc-tools" arch="s390x">
  <version epoch="0" ver="0.29.1" rel="150600.5.3.2"/>
  <changelog author="shung-hsi.yu@suse.com" date="1627387200">- Update source URL for bcc and libbpf</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1631880000">- Update to 0.21.0
  + Support for kernel up to 5.13
  + support for debug information from libdebuginfod
  + finished support for map elements items_*_batch() APIs
  + add atomic_increment() API
  + support attach_func() and detach_func() in python
  + fix displaying PID instead of TID for many tools
  + new tools: kvmexit.py
  + new libbpf-tools: gethostlatency, statsnoop, fsdist and solisten
  + fix tools ttysnoop/readahead for newer kernels
  + doc update and bug fixes
- Update libbpf to 0.5
  + libbpf_set_strict_mode() allowing to opt-in into backwards incompatible libbpf-1.0 changes. See "Libbpf: the road to 1.0" and "Libbpf 1.0 migration guide" for more details.
  + streamlined error reporting for low-level APIs, high-level error-returning APIs, and pointer-returning APIs (as a libbpf-1.0 opt-in);
  + "Light" BPF skeleton support;
  + BPF_PROG_TYPE_SYSCALL support;
  + BPF perf link support for kprobe, uprobe, tracepoint, and perf_event BPF programs;
  + BPF cookie support for kprobe, uprobe, tracepoint, and perf_event BPF programs through bpf_program__attach_[ku]probe_opts() APIs;
  + allow to specify ref_ctr_off for USDT semaphores through bpf_program__attach_uprobe_opts() API;
  + btf_custom_path support in bpf_object_open_opts, allowing to specify custom BTF for CO-RE relocations;
  + sk_reuseport/migrate program type support;
  + btf_dump__dump_type_data() API, allowing to dump binary data according to BTF type description;
  + btf__load_into_kernel() and btf__load_from_kernel_by_id(), and split BTF variants of them;
  + btf__load_vmlinux_btf() and btf__load_module_btf() APIs;
  + bpf_map__initial_value() API to get initial value of mmap-ed BPF maps;
  + bpf_map_lookup_and_delete_elem_flags() API.
  + support for weak typed __ksym externs;
  + BPF timer helpers: bpf_timer_init(), bpf_timer_set_callback(), bpf_timer_start(), bpf_timer_cancel();
  + bpf_get_attach_cookie() helper to get BPF cookie from BPF program side;
  + bpf_get_func_ip() helper;
  + bpf_sys_bpf() helper;
  + bpf_task_pt_regs() helper;
  + bpf_btf_find_by_name_kind() helper;
  + usability improvements for bpf_tracing.h when target architecture is missing.
  + improve BPF support detection on old Red Hat kernels with backported BPF patches;
  + improvements for LTO builds with GCC 10+;
  + pass NLM_F_EXCL when creating TC qdisc;
  + better support of BPF map reuse on old kernels;
  + fix the bug resulting in sometimes closing FD 0, which wasn't created and owned by libbpf itself.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1631880001">- Update to 0.22.0
  + Support for kernel up to 5.14
  + add ipv4/ipv6 filter support for tcp trace tools
  + add python interface to attach raw perf events
  + fix tcpstates for incorrect display of dport
  + new options for bcc tools runqslower, argdist
  + new libbpf-tools: filetop, exitsnoop, tcprtt
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1633089600">- Use shared libbpf library instead of building it along with bcc
    + Delete libbpf-0.5.tar.gz
- Fix build on i586 due to use of shared libbpf library
    + Do-not-export-USDT-function-when-ENABLE_USDT-is-OFF.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1645012800">- Move kernel{,-devel} requirements to libbcc0 for deduplication.
- Require additionally kernel-$variant-devel for libbcc0.
- Declare python3-bcc, bcc-examples and bcc-docs as noarch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1650628800">- Update to version 0.24.0:
  + Support for kernel up to 5.16
  + bcc tools: update for trace.py, sslsniff.py, tcptop.py, hardirqs.py, etc.
  + new libbpf tools: bashreadline
  + allow specify wakeup_events for perf buffer
  + support BPF_MAP_TYPE_{INODE, TASK}_STORAGE maps
  + remove all deprecated libbpf function usage
  + remove P4/B language support
  + major test infra change, using github actions now
  + doc update, bug fixes and other tools improvement
- Changes from version 0.23.0:
  + Support for kernel up to 5.15
  + bcc tools: update for kvmexit.py, tcpv4connect.py, cachetop.py, cachestat.py, etc.
  + libbpf tools: update for update for mountsnoop, ksnoop, gethostlatency, etc.
  + fix renaming of task_struct-&gt;state
  + get pid namespace properly for a number of tools
  + initial work for more libbpf utilization (less section names)
  + doc update, bug fixes and other tools improvement
- Drop Do-not-export-USDT-function-when-ENABLE_USDT-is-OFF.patch:
  fixed upstream.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1660219200">- Update to version 0.25.0:
  + Support for kernel up to 5.19
  + bcc tool updates for oomkill.py, biolatpcts.py, sslsniff.py, tcpaccept.py, etc.
  + libbpf tool updates for klockstat, opensnoop, tcpconnect, etc.
  + new bcc tools: tcpcong
  + new libbpf tools: tcpsynbl, mdflush, oomkill, sigsnoop
  + usdt: support xmm registers as args for x64
  + bpftool as a submodule now
  + remove uses of libbpf deprecated APIs
  + use new llvm pass manager
  + support cgroup filtering libbpf tools
  + fix shared lib module offset &lt;-&gt; global addr conversion
  + riscv support
  + LoongArch support
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1672315200">- Update to version 0.26.0:
  + Support for kernel up to 6.1
  + bcc tool updates for biosnoop, opensnoop, biopattern, killsnoop, runqslower, offcputime, wakeuptime, etc.
  + libbpf-tools updates for klockstat, sigsnoop, hardirqs, softirqs, opensnoop, statsnoop, offcputime, tcplife, cpufreq, cpudist, etc.
  + new libbpf-tools: tcptop, tcpstates, biotop, capable
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1673438400">- Force specific versioning of LLVM in preparation of Leap 15.5/SLES 15-SP5
  + Remove now duplicate dependency llvm-clang-devel, having clang-devel is enough</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695297600">- Disable bcc-lua until luajit issue is resolved
- Explicitly add python3-setuptools and zip as a build requirement
- Update to version 0.28.0
  + Support for kernel up to 6.3.
  + new libbpf tool: tcppktlat.
  + bcc tool updates: funcslower, wakeuptime, profile, offcputime, deadlock,
    funccount, argdist, kvmexit, runqlen and cpuunclaimed.
  + libbpf tool update: memleak, tcprtt, tcpconnlat, funclatency, syscount,
    cpufreq, biosnoop.
  + support ringbuf_query for bcc tools.
  + handle '[uprobes]' memory mapped file properly during stack tracing.
  + Fix maximum allowed index for print_linear_hist for bcc tools.
  + add module kfunc/kretfunc support.
  + clang rewriter: initialize only the requested parameters
  + filter with available_filter_functions to make multi-functions kprobes more
    robust for both bcc and libbpf tools.
  + doc update, other bug fixes and tools improvement
- Update to version 0.27.0
  + Support for kernel up to 6.2
  + bcc tool updates for ttysnoop, slabratetop, readahead, nfsslower, cpudist,
    cachetop, cachestat, etc.
  + libbpf-tools updates for mdflush, drsnoop, statsnoop, ttysnoop, softirqs,
    wakeuptime, cachestat, numamove, etc.
  + fix for incomplete static libraries
  + implement zip archive support
  + upgrade to use c++14 standard
  + new libbpf-tools: memleak
  + add loongarch support in libbpft-tools
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695384000">- Mention boo#1215592 in spec file, which tracks the problem with luajit
  that require temporarily disabling bcc-lua</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695643200">- Disable building of tests file
  + Remove zip from build requirements as it is no longer needed</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1697457600">- Re-enable bcc-lua now that boo#1215592 is resolved</changelog>
  <changelog author="steven.kowalik@suse.com" date="1701777600">- Remove unneeded Requires on python3-future.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1706270400">- Switch to LLVM 17
- Change LLVM version macro to the cleaner alternative suggested in
  SR#1134405
- Update to version 0.29.1
  * support for kernel up to 6.6.
  * new bcc tools: rdmaucma
  * bcc tool update: tcpstates, statsnoop, runqlat, bio tools,
    tcptop, slabratetop, tcprtt, etc.
  * doc update, other bug fixes and tools improvement, and some new
    enhancement for powerpc and riscv.</changelog>
  <changelog author="dimstar@opensuse.org" date="1709035200">- Have the -devel package require llvm%{llvm_major_version}-devel:
  /usr/include/bcc/bpf_module.h:25:10 includes
  llvm/Config/llvm-config.h.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1710244800">- Update LLVM version macro to support SLE (bsc#1220746)</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1711454400">- Update bcc-devel requirement to depend on specific version of llvm-devel</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1714737600">- Fix incorrect offset calculation when consecutive bitfields are
  present (bsc#1219096)
  * add fix-alignment-issue-on-x86_64-due-to-consecutive-bit.patch</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717502400">- Remove bcc-devel's requirement on llvm-devel
  * add build-remove-llvm-dev-dependency-from-libbcc.patch</changelog>
</package>
<package pkgid="b7ad8c15f51d31427d3f1f9b0c81663f9b155d9c7b71eabbe35cb85b9a7d0e4c" name="bcc-tools" arch="x86_64">
  <version epoch="0" ver="0.29.1" rel="150600.5.3.2"/>
  <changelog author="shung-hsi.yu@suse.com" date="1627387200">- Update source URL for bcc and libbpf</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1631880000">- Update to 0.21.0
  + Support for kernel up to 5.13
  + support for debug information from libdebuginfod
  + finished support for map elements items_*_batch() APIs
  + add atomic_increment() API
  + support attach_func() and detach_func() in python
  + fix displaying PID instead of TID for many tools
  + new tools: kvmexit.py
  + new libbpf-tools: gethostlatency, statsnoop, fsdist and solisten
  + fix tools ttysnoop/readahead for newer kernels
  + doc update and bug fixes
- Update libbpf to 0.5
  + libbpf_set_strict_mode() allowing to opt-in into backwards incompatible libbpf-1.0 changes. See "Libbpf: the road to 1.0" and "Libbpf 1.0 migration guide" for more details.
  + streamlined error reporting for low-level APIs, high-level error-returning APIs, and pointer-returning APIs (as a libbpf-1.0 opt-in);
  + "Light" BPF skeleton support;
  + BPF_PROG_TYPE_SYSCALL support;
  + BPF perf link support for kprobe, uprobe, tracepoint, and perf_event BPF programs;
  + BPF cookie support for kprobe, uprobe, tracepoint, and perf_event BPF programs through bpf_program__attach_[ku]probe_opts() APIs;
  + allow to specify ref_ctr_off for USDT semaphores through bpf_program__attach_uprobe_opts() API;
  + btf_custom_path support in bpf_object_open_opts, allowing to specify custom BTF for CO-RE relocations;
  + sk_reuseport/migrate program type support;
  + btf_dump__dump_type_data() API, allowing to dump binary data according to BTF type description;
  + btf__load_into_kernel() and btf__load_from_kernel_by_id(), and split BTF variants of them;
  + btf__load_vmlinux_btf() and btf__load_module_btf() APIs;
  + bpf_map__initial_value() API to get initial value of mmap-ed BPF maps;
  + bpf_map_lookup_and_delete_elem_flags() API.
  + support for weak typed __ksym externs;
  + BPF timer helpers: bpf_timer_init(), bpf_timer_set_callback(), bpf_timer_start(), bpf_timer_cancel();
  + bpf_get_attach_cookie() helper to get BPF cookie from BPF program side;
  + bpf_get_func_ip() helper;
  + bpf_sys_bpf() helper;
  + bpf_task_pt_regs() helper;
  + bpf_btf_find_by_name_kind() helper;
  + usability improvements for bpf_tracing.h when target architecture is missing.
  + improve BPF support detection on old Red Hat kernels with backported BPF patches;
  + improvements for LTO builds with GCC 10+;
  + pass NLM_F_EXCL when creating TC qdisc;
  + better support of BPF map reuse on old kernels;
  + fix the bug resulting in sometimes closing FD 0, which wasn't created and owned by libbpf itself.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1631880001">- Update to 0.22.0
  + Support for kernel up to 5.14
  + add ipv4/ipv6 filter support for tcp trace tools
  + add python interface to attach raw perf events
  + fix tcpstates for incorrect display of dport
  + new options for bcc tools runqslower, argdist
  + new libbpf-tools: filetop, exitsnoop, tcprtt
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1633089600">- Use shared libbpf library instead of building it along with bcc
    + Delete libbpf-0.5.tar.gz
- Fix build on i586 due to use of shared libbpf library
    + Do-not-export-USDT-function-when-ENABLE_USDT-is-OFF.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1645012800">- Move kernel{,-devel} requirements to libbcc0 for deduplication.
- Require additionally kernel-$variant-devel for libbcc0.
- Declare python3-bcc, bcc-examples and bcc-docs as noarch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1650628800">- Update to version 0.24.0:
  + Support for kernel up to 5.16
  + bcc tools: update for trace.py, sslsniff.py, tcptop.py, hardirqs.py, etc.
  + new libbpf tools: bashreadline
  + allow specify wakeup_events for perf buffer
  + support BPF_MAP_TYPE_{INODE, TASK}_STORAGE maps
  + remove all deprecated libbpf function usage
  + remove P4/B language support
  + major test infra change, using github actions now
  + doc update, bug fixes and other tools improvement
- Changes from version 0.23.0:
  + Support for kernel up to 5.15
  + bcc tools: update for kvmexit.py, tcpv4connect.py, cachetop.py, cachestat.py, etc.
  + libbpf tools: update for update for mountsnoop, ksnoop, gethostlatency, etc.
  + fix renaming of task_struct-&gt;state
  + get pid namespace properly for a number of tools
  + initial work for more libbpf utilization (less section names)
  + doc update, bug fixes and other tools improvement
- Drop Do-not-export-USDT-function-when-ENABLE_USDT-is-OFF.patch:
  fixed upstream.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1660219200">- Update to version 0.25.0:
  + Support for kernel up to 5.19
  + bcc tool updates for oomkill.py, biolatpcts.py, sslsniff.py, tcpaccept.py, etc.
  + libbpf tool updates for klockstat, opensnoop, tcpconnect, etc.
  + new bcc tools: tcpcong
  + new libbpf tools: tcpsynbl, mdflush, oomkill, sigsnoop
  + usdt: support xmm registers as args for x64
  + bpftool as a submodule now
  + remove uses of libbpf deprecated APIs
  + use new llvm pass manager
  + support cgroup filtering libbpf tools
  + fix shared lib module offset &lt;-&gt; global addr conversion
  + riscv support
  + LoongArch support
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1672315200">- Update to version 0.26.0:
  + Support for kernel up to 6.1
  + bcc tool updates for biosnoop, opensnoop, biopattern, killsnoop, runqslower, offcputime, wakeuptime, etc.
  + libbpf-tools updates for klockstat, sigsnoop, hardirqs, softirqs, opensnoop, statsnoop, offcputime, tcplife, cpufreq, cpudist, etc.
  + new libbpf-tools: tcptop, tcpstates, biotop, capable
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1673438400">- Force specific versioning of LLVM in preparation of Leap 15.5/SLES 15-SP5
  + Remove now duplicate dependency llvm-clang-devel, having clang-devel is enough</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695297600">- Disable bcc-lua until luajit issue is resolved
- Explicitly add python3-setuptools and zip as a build requirement
- Update to version 0.28.0
  + Support for kernel up to 6.3.
  + new libbpf tool: tcppktlat.
  + bcc tool updates: funcslower, wakeuptime, profile, offcputime, deadlock,
    funccount, argdist, kvmexit, runqlen and cpuunclaimed.
  + libbpf tool update: memleak, tcprtt, tcpconnlat, funclatency, syscount,
    cpufreq, biosnoop.
  + support ringbuf_query for bcc tools.
  + handle '[uprobes]' memory mapped file properly during stack tracing.
  + Fix maximum allowed index for print_linear_hist for bcc tools.
  + add module kfunc/kretfunc support.
  + clang rewriter: initialize only the requested parameters
  + filter with available_filter_functions to make multi-functions kprobes more
    robust for both bcc and libbpf tools.
  + doc update, other bug fixes and tools improvement
- Update to version 0.27.0
  + Support for kernel up to 6.2
  + bcc tool updates for ttysnoop, slabratetop, readahead, nfsslower, cpudist,
    cachetop, cachestat, etc.
  + libbpf-tools updates for mdflush, drsnoop, statsnoop, ttysnoop, softirqs,
    wakeuptime, cachestat, numamove, etc.
  + fix for incomplete static libraries
  + implement zip archive support
  + upgrade to use c++14 standard
  + new libbpf-tools: memleak
  + add loongarch support in libbpft-tools
  + doc update, bug fixes and other tools improvement</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695384000">- Mention boo#1215592 in spec file, which tracks the problem with luajit
  that require temporarily disabling bcc-lua</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1695643200">- Disable building of tests file
  + Remove zip from build requirements as it is no longer needed</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1697457600">- Re-enable bcc-lua now that boo#1215592 is resolved</changelog>
  <changelog author="steven.kowalik@suse.com" date="1701777600">- Remove unneeded Requires on python3-future.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1706270400">- Switch to LLVM 17
- Change LLVM version macro to the cleaner alternative suggested in
  SR#1134405
- Update to version 0.29.1
  * support for kernel up to 6.6.
  * new bcc tools: rdmaucma
  * bcc tool update: tcpstates, statsnoop, runqlat, bio tools,
    tcptop, slabratetop, tcprtt, etc.
  * doc update, other bug fixes and tools improvement, and some new
    enhancement for powerpc and riscv.</changelog>
  <changelog author="dimstar@opensuse.org" date="1709035200">- Have the -devel package require llvm%{llvm_major_version}-devel:
  /usr/include/bcc/bpf_module.h:25:10 includes
  llvm/Config/llvm-config.h.</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1710244800">- Update LLVM version macro to support SLE (bsc#1220746)</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1711454400">- Update bcc-devel requirement to depend on specific version of llvm-devel</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1714737600">- Fix incorrect offset calculation when consecutive bitfields are
  present (bsc#1219096)
  * add fix-alignment-issue-on-x86_64-due-to-consecutive-bit.patch</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717502400">- Remove bcc-devel's requirement on llvm-devel
  * add build-remove-llvm-dev-dependency-from-libbcc.patch</changelog>
</package>
<package pkgid="06c1bc118f0312f64ada243f1558187c0835ab438033ba8726f155000676377d" name="beust-jcommander" arch="noarch">
  <version epoch="0" ver="1.83" rel="150200.3.13.1"/>
  <changelog author="fstrba@suse.com" date="1540382400">- Initial packaging built without maven, adapted from Fedora rpm</changelog>
  <changelog author="fstrba@suse.com" date="1540468800">- Build with java source/target levels 8 since the code uses
  String.join() which does not exist before java 8</changelog>
  <changelog author="fstrba@suse.com" date="1544097600">- Fix javadoc build with older JDK versions</changelog>
  <changelog author="jengelh@inai.de" date="1549540800">- Avoid double shipping of documentation.
- Ensure neutrality of descriptions.</changelog>
  <changelog author="fstrba@suse.com" date="1554724800">- Remove reference to pom parent from pom.xml file, since we are
  not building with maven.</changelog>
  <changelog author="fstrba@suse.com" date="1683115200">- Update to version 1.82
  * Fixes:
    + #392: fixed bug when parsing arguments is ignoring case
    sensitivity option
    + Add a test for Parameter order usage
    + add a test for Path converter
    + Add automatic module name to manifest
    + Add check if Boolean parameter is default null, then do not
    flip value
    + Added testing modules
    + Add format tests for DefaultUsageFormatter,
    UnixStyleUsageFormatter
    + add Path converter change #414 to changelog
    + Add test case for issue 367
    + Add testing for UnixStyleUsageFormatter
    + Add unix-style formatter, allow DefaultUsageFormatter to be
    extended easier
    + Allow generics of type &lt;? extends X&gt; and &lt;? super Y&gt; in
    parameters
    + Allow main parameters to be a single field.
    + allow System.out to be replaced by something else (f.e.
    System.err)
    + Allow UsageFormatter to be set in JCommander Builder
    + Change UsageFormatter into an interface
    + Clean up DefaultUsageFormatter
    + Create MyDelegate.java
    + Create UsageFormatter (preliminary)
    + Enable usage() ordering for DynamicParameter
    + Encapsulate MainParameter.
    + encode user input to massage error message
    + Expose more of the UsageFormatter implementations
    + Fields annotated with @ParametersDelegate are now allowed to
    be final.
    + FIX #380 Main parameter doesn't support Converter
    + Fix error message when failing to convert a Path
    + Fixing: squid:ModifiersOrderCheck and squid:S2444
    + Fix locale-related issues in usage formatter tests
    + Get boolean/Boolean getter with "is" prefix
    + GH-477 Environment Variable Default Provider
    + make console configurable by JCommander.Builder
    + Make UsageFormatter abstract, Create DefaultUsageFormatter
    + Only one DefaultConverterFactory
    + Remove String.join usage - resolves #381
    + Remove the generic in IStringConverterFactory
    + Restrict access to JCommander.Options again
    + Support arity for main parameters.
    + Update DefaultParameterizedParser.java
    + Update IParameterizedParser.java
    + Update JCommander.java
    + usage() hides 'Comments:' header when only hidden commands
    exist
    + Use Builder API as constructor is deprecated
    + Use get&lt;fieldname&gt; default getter approach if is&lt;fieldname&gt;
    method is not found
  * Upgrade needed by new code in xmvn 4.2.0
- Fetch sources using source service and clean the tarball of
  unnecessary binary files</changelog>
  <changelog author="fstrba@suse.com" date="1708516800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1716206400">- Update to version 1.83
  * Fixes:
    + Fixed Docs Timestamp
    + Fixed: #563 - JCommander does not recognize command by alias.
    + fixed: missing null check
    + renamed IRule to IParametersValidator
    + `@Parameters(rules = &lt;? extends IRule&gt;)`
    + Unit Test for #532
    + Fixed #532: @-syntax not working with command objects
    + enable testng tests
    + Fix regression with removed usage methods
    + Add OSGi entries in MANIFEST.MF during jar creation</changelog>
</package>
<package pkgid="d03ee7e5606f0315f16c745d13136f2ac34d7322c96273ca990f587661dd7e9e" name="beust-jcommander" arch="src">
  <version epoch="0" ver="1.83" rel="150200.3.13.1"/>
  <changelog author="fstrba@suse.com" date="1540382400">- Initial packaging built without maven, adapted from Fedora rpm</changelog>
  <changelog author="fstrba@suse.com" date="1540468800">- Build with java source/target levels 8 since the code uses
  String.join() which does not exist before java 8</changelog>
  <changelog author="fstrba@suse.com" date="1544097600">- Fix javadoc build with older JDK versions</changelog>
  <changelog author="jengelh@inai.de" date="1549540800">- Avoid double shipping of documentation.
- Ensure neutrality of descriptions.</changelog>
  <changelog author="fstrba@suse.com" date="1554724800">- Remove reference to pom parent from pom.xml file, since we are
  not building with maven.</changelog>
  <changelog author="fstrba@suse.com" date="1683115200">- Update to version 1.82
  * Fixes:
    + #392: fixed bug when parsing arguments is ignoring case
    sensitivity option
    + Add a test for Parameter order usage
    + add a test for Path converter
    + Add automatic module name to manifest
    + Add check if Boolean parameter is default null, then do not
    flip value
    + Added testing modules
    + Add format tests for DefaultUsageFormatter,
    UnixStyleUsageFormatter
    + add Path converter change #414 to changelog
    + Add test case for issue 367
    + Add testing for UnixStyleUsageFormatter
    + Add unix-style formatter, allow DefaultUsageFormatter to be
    extended easier
    + Allow generics of type &lt;? extends X&gt; and &lt;? super Y&gt; in
    parameters
    + Allow main parameters to be a single field.
    + allow System.out to be replaced by something else (f.e.
    System.err)
    + Allow UsageFormatter to be set in JCommander Builder
    + Change UsageFormatter into an interface
    + Clean up DefaultUsageFormatter
    + Create MyDelegate.java
    + Create UsageFormatter (preliminary)
    + Enable usage() ordering for DynamicParameter
    + Encapsulate MainParameter.
    + encode user input to massage error message
    + Expose more of the UsageFormatter implementations
    + Fields annotated with @ParametersDelegate are now allowed to
    be final.
    + FIX #380 Main parameter doesn't support Converter
    + Fix error message when failing to convert a Path
    + Fixing: squid:ModifiersOrderCheck and squid:S2444
    + Fix locale-related issues in usage formatter tests
    + Get boolean/Boolean getter with "is" prefix
    + GH-477 Environment Variable Default Provider
    + make console configurable by JCommander.Builder
    + Make UsageFormatter abstract, Create DefaultUsageFormatter
    + Only one DefaultConverterFactory
    + Remove String.join usage - resolves #381
    + Remove the generic in IStringConverterFactory
    + Restrict access to JCommander.Options again
    + Support arity for main parameters.
    + Update DefaultParameterizedParser.java
    + Update IParameterizedParser.java
    + Update JCommander.java
    + usage() hides 'Comments:' header when only hidden commands
    exist
    + Use Builder API as constructor is deprecated
    + Use get&lt;fieldname&gt; default getter approach if is&lt;fieldname&gt;
    method is not found
  * Upgrade needed by new code in xmvn 4.2.0
- Fetch sources using source service and clean the tarball of
  unnecessary binary files</changelog>
  <changelog author="fstrba@suse.com" date="1708516800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1716206400">- Update to version 1.83
  * Fixes:
    + Fixed Docs Timestamp
    + Fixed: #563 - JCommander does not recognize command by alias.
    + fixed: missing null check
    + renamed IRule to IParametersValidator
    + `@Parameters(rules = &lt;? extends IRule&gt;)`
    + Unit Test for #532
    + Fixed #532: @-syntax not working with command objects
    + enable testng tests
    + Fix regression with removed usage methods
    + Add OSGi entries in MANIFEST.MF during jar creation</changelog>
</package>
<package pkgid="607a2e2d1da36cc12460846f0392dd2fd82bab5baaed37e47a4815ee0dc619b4" name="beust-jcommander-javadoc" arch="noarch">
  <version epoch="0" ver="1.83" rel="150200.3.13.1"/>
  <changelog author="fstrba@suse.com" date="1540382400">- Initial packaging built without maven, adapted from Fedora rpm</changelog>
  <changelog author="fstrba@suse.com" date="1540468800">- Build with java source/target levels 8 since the code uses
  String.join() which does not exist before java 8</changelog>
  <changelog author="fstrba@suse.com" date="1544097600">- Fix javadoc build with older JDK versions</changelog>
  <changelog author="jengelh@inai.de" date="1549540800">- Avoid double shipping of documentation.
- Ensure neutrality of descriptions.</changelog>
  <changelog author="fstrba@suse.com" date="1554724800">- Remove reference to pom parent from pom.xml file, since we are
  not building with maven.</changelog>
  <changelog author="fstrba@suse.com" date="1683115200">- Update to version 1.82
  * Fixes:
    + #392: fixed bug when parsing arguments is ignoring case
    sensitivity option
    + Add a test for Parameter order usage
    + add a test for Path converter
    + Add automatic module name to manifest
    + Add check if Boolean parameter is default null, then do not
    flip value
    + Added testing modules
    + Add format tests for DefaultUsageFormatter,
    UnixStyleUsageFormatter
    + add Path converter change #414 to changelog
    + Add test case for issue 367
    + Add testing for UnixStyleUsageFormatter
    + Add unix-style formatter, allow DefaultUsageFormatter to be
    extended easier
    + Allow generics of type &lt;? extends X&gt; and &lt;? super Y&gt; in
    parameters
    + Allow main parameters to be a single field.
    + allow System.out to be replaced by something else (f.e.
    System.err)
    + Allow UsageFormatter to be set in JCommander Builder
    + Change UsageFormatter into an interface
    + Clean up DefaultUsageFormatter
    + Create MyDelegate.java
    + Create UsageFormatter (preliminary)
    + Enable usage() ordering for DynamicParameter
    + Encapsulate MainParameter.
    + encode user input to massage error message
    + Expose more of the UsageFormatter implementations
    + Fields annotated with @ParametersDelegate are now allowed to
    be final.
    + FIX #380 Main parameter doesn't support Converter
    + Fix error message when failing to convert a Path
    + Fixing: squid:ModifiersOrderCheck and squid:S2444
    + Fix locale-related issues in usage formatter tests
    + Get boolean/Boolean getter with "is" prefix
    + GH-477 Environment Variable Default Provider
    + make console configurable by JCommander.Builder
    + Make UsageFormatter abstract, Create DefaultUsageFormatter
    + Only one DefaultConverterFactory
    + Remove String.join usage - resolves #381
    + Remove the generic in IStringConverterFactory
    + Restrict access to JCommander.Options again
    + Support arity for main parameters.
    + Update DefaultParameterizedParser.java
    + Update IParameterizedParser.java
    + Update JCommander.java
    + usage() hides 'Comments:' header when only hidden commands
    exist
    + Use Builder API as constructor is deprecated
    + Use get&lt;fieldname&gt; default getter approach if is&lt;fieldname&gt;
    method is not found
  * Upgrade needed by new code in xmvn 4.2.0
- Fetch sources using source service and clean the tarball of
  unnecessary binary files</changelog>
  <changelog author="fstrba@suse.com" date="1708516800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1716206400">- Update to version 1.83
  * Fixes:
    + Fixed Docs Timestamp
    + Fixed: #563 - JCommander does not recognize command by alias.
    + fixed: missing null check
    + renamed IRule to IParametersValidator
    + `@Parameters(rules = &lt;? extends IRule&gt;)`
    + Unit Test for #532
    + Fixed #532: @-syntax not working with command objects
    + enable testng tests
    + Fix regression with removed usage methods
    + Add OSGi entries in MANIFEST.MF during jar creation</changelog>
</package>
<package pkgid="ff3dae60d019cb0757e8f4fbf3155d67e4e3388a1d973d2cb6190762a6037e16" name="bind" arch="aarch64">
  <version epoch="0" ver="9.18.28" rel="150600.3.3.1"/>
  <changelog author="josef.moellers@suse.com" date="1657800000">- Update to release 9.16.31
  This is the first of monthly updates of "bind". It is planned
  to update bind when a new upstream maintennace release becomes
  available, which is usually towards the end of a month, see
  https://www.isc.org/blogs/2021-bind-release-model/
  Compared to the previous SUSE release, in this release,
  53 (minor) bugs were fixed
  13 (minor) functional enhancements were made
  3 security issues are now fixed upstream:
    CVE-2022-0396, CVE-2021-25220, CVE-2021-25219
  plus a few minor changes.
  For a full list of changes, please refer to the
  CHANGES file in the source rpm.
  This update obsoletes the following patches:
  * bind-fix-build-with-older-sphinx.patch
  * bind-CVE-2021-25219.patch
  * bind-9.16.27-0001-CVE-2021-25220.patch
  * bind-9.16.27-0002-CVE-2022-0396.patch
  [bind-9.16.31.tar.xz, bind-9.16.31.tar.xz.sha512.asc,
  bind-9.16.20.tar.xz, bind-9.16.20.tar.xz.sha512.asc,
  bind-fix-build-with-older-sphinx.patch, bind-CVE-2021-25219.patch,
  bind-9.16.27-0001-CVE-2021-25220.patch,
  bind-9.16.27-0002-CVE-2022-0396.patch,
  jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1661256000">- Update to release 9.16.32
  Feature Changes:
  * The DNSSEC algorithms RSASHA1 and NSEC3RSASHA1 are now automatically
  disabled on systems where they are disallowed by the security policy
  (e.g. Red Hat Enterprise Linux 9). Primary zones using those algorithms
  need to be migrated to new algorithms prior to running on these systems,
  as graceful migration to different DNSSEC algorithms is not possible when
  RSASHA1 is disallowed by the operating system.
  * Log messages related to fetch limiting have been improved to provide
  more complete information. Specifically, the final counts of allowed
  and spilled fetches are now logged before the counter object is destroyed.
  Bug Fixes:
  * Non-dynamic zones that inherit dnssec-policy from the view or options
  blocks were not marked as inline-signed and therefore never scheduled
  to be re-signed. This has been fixed.
  * The old max-zone-ttl zone option was meant to be superseded by
  the max-zone-ttl option in dnssec-policy; however, the latter option
  was not fully effective. This has been corrected: zones no longer load
  if they contain TTLs greater than the limit configured in dnssec-policy.
  For zones with both the old max-zone-ttl option and dnssec-policy
  configured, the old option is ignored, and a warning is generated.
  * rndc dumpdb -expired was fixed to include expired RRsets,
  even if stale-cache-enable is set to no and
  the cache-cleaning time window has passed.
  [bind-9.16.32.tar.xz, bind-9.16.32.tar.xz.sha512.asc,
  bind-9.16.31.tar.xz, bind-9.16.31.tar.xz.sha512.asc,
  bind.spec, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1662724800">- Include a modified createNamedConfInclude script again, as this
  broke compatability with existing configurations.
  A symlink for named.conf.include to /var/lib/named is created to
  allow for a read-only /etc directory.
  However it is still advised to change the existing configuration.
  See README-bind.chrootenv for a guide how to do this.
  [bsc#1203250, vendor-files/tools/createNamedConfInclude,
  vendor-files/docu/README-bind.chrootenv, bind.spec]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1662724801">- Add systemd drop-in directory for named service
  [bsc#1201689, bind.spec]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1663761600">- Update to release 9.16.33
  Security Fixes:
  * Previously, there was no limit to the number of database lookups
    performed while processing large delegations, which could be
    abused to severely impact the performance of named running as a
    recursive resolver. This has been fixed. (CVE-2022-2795)
  * named running as a resolver with the stale-answer-client-timeout
    option set to 0 could crash with an assertion failure, when
    there was a stale CNAME in the cache for the incoming query.
    This has been fixed. (CVE-2022-3080)
  * A memory leak was fixed that could be externally triggered in the
    DNSSEC verification code for the ECDSA algorithm. (CVE-2022-38177)
  * Memory leaks were fixed that could be externally triggered in the
    DNSSEC verification code for the EdDSA algorithm. (CVE-2022-38178)
  Feature Changes:
  * Response Rate Limiting (RRL) code now treats all QNAMEs that are
    subject to wildcard processing within a given zone as the same
    name, to prevent circumventing the limits enforced by RRL.
  * Zones using dnssec-policy now require dynamic DNS or
    inline-signing to be configured explicitly.
  * A backward-compatible approach was implemented for encoding
    internationalized domain names (IDN) in dig and converting the
    domain to IDNA2008 form; if that fails,
    BIND tries an IDNA2003 conversion.
  Bug Fixes:
  * A serve-stale bug was fixed, where BIND would try to return stale
    data from cache for lookups that received duplicate queries or
    queries that would be dropped. This bug resulted in premature
    SERVFAIL responses, and has now been resolved.
  [bsc#1203614, bsc#1203618, bsc#1203619, bsc#1203620, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1668168000">- Update to release 9.16.34
  New Features:
  * Support for parsing and validating the dohpath service
    parameter in SVCB records was added.
  * named now logs the supported cryptographic algorithms during
    startup and in the output of named -V.
  Bug Fixes:
  * Changing just the TSIG key names for primaries in catalog
    zones’ member zones was not effective. This has been fixed.
  Known Issues:
  * Upgrading from BIND 9.16.32 or any older version may require a
    manual configuration change. The following configurations are
    affected:
  - type primary zones configured with dnssec-policy but without
    either allow-update or update-policy,
  - type secondary zones configured with dnssec-policy.
    In these cases please add inline-signing yes; to the individual
    zone configuration(s). Without applying this change, named will
    fail to start. For more details, see
    https://kb.isc.org/docs/dnssec-policy-requires-dynamic-dns-or-inline-signing
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1669291200">- Update to release 9.16.35
  Bug Fixes:
  * A crash was fixed that happened when a dnssec-policy zone that
    used NSEC3 was reconfigured to enable inline-signing.
  * In certain resolution scenarios, quotas could be erroneously
    reached for servers, including any configured forwarders,
    resulting in SERVFAIL answers being sent to clients.
  * rpz-ip rules in response-policy zones could be ineffective in
    some cases if a query had the CD (Checking Disabled) bit set to
    1.
  * Previously, if Internet connectivity issues were experienced
    during the initial startup of named, a BIND resolver with
    dnssec-validation set to auto could enter into a state where it
    would not recover without stopping named, manually deleting the
    managed-keys.bind and managed-keys.bind.jnl files, and starting
    named again.
  * The statistics counter representing the current number of
    clients awaiting recursive resolution results (RecursClients)
    could overflow in certain resolution scenarios.
  * Previously, BIND failed to start on Solaris-based systems with
    hundreds of CPUs.
  * When a DNS resource record’s TTL value was equal to the
    resolver’s configured prefetch “eligibility” value, the record
    was erroneously not treated as eligible for prefetching.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1671710400">- Update to release 9.16.36
  Feature Changes:
  * The auto-dnssec option has been deprecated and will be removed
    in a future BIND 9.19.x release. Please migrate to
    dnssec-policy.
  Bug Fixes:
  * When a catalog zone was removed from the configuration, in some
    cases a dangling pointer could cause the named process to
    crash.
  * When a zone was deleted from a server, a key management object
    related to that zone was inadvertently kept in memory and only
    released upon shutdown. This could lead to constantly
    increasing memory use on servers with a high rate of changes
    affecting the set of zones being served.
  * In certain cases, named waited for the resolution of
    outstanding recursive queries to finish before shutting down.
  * The zone &lt;name&gt;/&lt;class&gt;: final reference detached log message
    was moved from the INFO log level to the DEBUG(1) log level to
    prevent the named-checkzone tool from superfluously logging
    this message in non-debug mode.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1674561600">- Update to release 9.16.37
  Security Fixes:
  * An UPDATE message flood could cause named to exhaust all
    available memory. This flaw was addressed by adding a new
    update-quota option that controls the maximum number of
    outstanding DNS UPDATE messages that named can hold in a queue
    at any given time (default: 100). (CVE-2022-3094)
  * named could crash with an assertion failure when an RRSIG query
    was received and stale-answer-client-timeout was set to a
    non-zero value. This has been fixed. (CVE-2022-3736)
  * named running as a resolver with the
    stale-answer-client-timeout option set to any value greater
    than 0 could crash with an assertion failure, when the
    recursive-clients soft quota was reached. This has been fixed.
    (CVE-2022-3924)
  New Features:
  * The new update-quota option can be used to control the number
    of simultaneous DNS UPDATE messages that can be processed to
    update an authoritative zone on a primary server, or forwarded
    to the primary server by a secondary server. The default is
    100. A new statistics counter has also been added to record
    events when this quota is exceeded, and the version numbers for
    the XML and JSON statistics schemas have been updated.
  Feature Changes:
  * The Differentiated Services Code Point (DSCP) feature in BIND
    has been deprecated. Configuring DSCP values in named.conf now
    causes a warning to be logged. Note that this feature has only
    been partly operational since the new Network Manager was
    introduced in BIND 9.16.0.
  * The catalog zone implementation has been optimized to work with
    hundreds of thousands of member zones.
  Bug Fixes:
  * In certain query resolution scenarios (e.g. when following
    CNAME records), named configured to answer from stale cache
    could return a SERVFAIL response despite a usable, non-stale
    answer being present in the cache. This has been fixed.
  [bsc#1207471, bsc#1207473, bsc#1207475, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1676548800">- Update to release 9.16.38
  Bug Fixes:
  * A constant stream of zone additions and deletions via rndc
    reconfig could cause increased memory consumption due to
    delayed cleaning of view memory. This has been fixed.
  * The speed of the message digest algorithms (MD5, SHA-1, SHA-2),
    and of NSEC3 hashing, has been improved.
  * Building BIND 9 failed when the --enable-dnsrps switch for
    ./configure was used. This has been fixed.
  [jsc#SLE-24600]
- Updated keyring and signature</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1678881600">- Update to release 9.16.39
  Feature Changes:
  * libuv support for receiving multiple UDP messages in a single
    recvmmsg() system call has been tweaked several times between
    libuv versions 1.35.0 and 1.40.0; the current recommended libuv
    version is 1.40.0 or higher. New rules are now in effect for
    running with a different version of libuv than the one used at
    compilation time. These rules may trigger a fatal error at
    startup:
  - Building against or running with libuv versions 1.35.0 and
    1.36.0 is now a fatal error.
  - Running with libuv version higher than 1.34.2 is now a
    fatal error when named is built against libuv version
    1.34.2 or lower.
  - Running with libuv version higher than 1.39.0 is now a
    fatal error when named is built against libuv version
    1.37.0, 1.38.0, 1.38.1, or 1.39.0.
  * This prevents the use of libuv versions that may trigger an
    assertion failure when receiving multiple UDP messages in a
    single system call.
  Bug Fixes:
  * named could crash with an assertion failure when adding a new
    zone into the configuration file for a name which was already
    configured as a member zone for a catalog zone. This has been
    fixed.
  * When named starts up, it sends a query for the DNSSEC key for
    each configured trust anchor to determine whether the key has
    changed. In some unusual cases, the query might depend on a
    zone for which the server is itself authoritative, and would
    have failed if it were sent before the zone was fully loaded.
    This has now been fixed by delaying the key queries until all
    zones have finished loading.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1682424000">- Update to release 9.16.40
  Bug Fixes:
  * Logfiles using timestamp-style suffixes were not always
    correctly removed when the number of files exceeded the limit
    set by versions. This has been fixed for configurations which
    do not explicitly specify a directory path as part of the file
    argument in the channel specification.
  * Performance of DNSSEC validation in zones with many DNSKEY
    records has been improved.</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1684324800">- Update to release 9.16.41
  Bug Fixes:
  * When removing delegations from an opt-out range,
    empty-non-terminal NSEC3 records generated by those delegations
    were not cleaned up. This has been fixed.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1687348800">- Update to release 9.16.42
  Security Fixes:
  * The overmem cleaning process has been improved, to prevent the
    cache from significantly exceeding the configured
    max-cache-size limit. (CVE-2023-2828)
  * A query that prioritizes stale data over lookup triggers a
    fetch to refresh the stale data in cache. If the fetch is
    aborted for exceeding the recursion quota, it was possible for
    named to enter an infinite callback loop and crash due to stack
    overflow. This has been fixed. (CVE-2023-2911)
  Bug Fixes:
  * Previously, it was possible for a delegation from cache to be
    returned to the client after the stale-answer-client-timeout
    duration. This has been fixed.
  [bsc#1212544, bsc#1212567, jsc#SLE-24600]</changelog>
  <changelog author="dmueller@suse.com" date="1688644800">- rebuild bind-utils on libuv updates (bsc#1212090)</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1688990400">- Log named-checkconf output [bsc#1213049]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1689076800">- Add dnstap support
  [jsc#PED-4852]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1695124800">- Update to release 9.16.44
  Bug Fixes:
  * Processing already-queued queries received over TCP could cause
    an assertion failure, when the server was reconfigured at the
    same time or the cache was being flushed. This has been fixed.
  Security Fixes:
  * Previously, sending a specially crafted message over the
    control channel could cause the packet-parsing code to run out
    of available stack memory, causing named to terminate
    unexpectedly. This has been fixed. (CVE-2023-3341)
  [bsc#1215472]
- Switch to pkgconfig(libprotobuf-c) since this now contains the
  required protobuf-c binary</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1708084800">- Update to new Major Version 9.18.24.
  This has many enhancements, bug fixes and changes.
  Breaking Changes:
  * Some options have been removed and some have been deprecated
    and will be removed in the future.
    For a complete list, see:
    https://kb.isc.org/docs/changes-to-be-aware-of-when-moving-from-bind-916-to-918
  Major Changes:
  * Support for securing DNS traffic using Transport Layer Security
    (TLS). TLS is used by both DNS-over-TLS (DoT) and
    DNS-over-HTTPS (DoH).
  * Support for zone transfers over TLS (XFR-over-TLS, XoT) for
    both incoming and outgoing zone transfers.
  * The dig tool is now able to send DoT queries (+tls option).
  * Support for OpenSSL 3.0 APIs was added.
  * dnssec-checkds, dnssec-coverage, dnssec-keymgr, which have been
    removed in favor of the dnssec-policy feature
  * python3-bind is deprecated and the subpackage has been removed
  * A number of utilities have been moved from /usr/sbin to
    /usr/bin:
    named-checkconf named-checkzone named-compilezone
    dnssec-dsfromkey dnssec-importkey dnssec-keyfromlabel
    dnssec-keygen dnssec-revoke dnssec-settime dnssec-signzone
    dnssec-verify dnssec-cds named-journalprint nsec3hash
  * The lib directory was renamed from 'named' to 'bind'
  For a complete list of changes, see:
  * Bind Release Notes
    https://bind9.readthedocs.io/en/v9.18.24/notes.html
  * The CHANGES file in the source RPM
  Security Fixes:
  * Validating DNS messages containing a lot of DNSSEC signatures
    could cause excessive CPU load, leading to a denial-of-service
    condition. This has been fixed. (CVE-2023-50387)
    [bsc#1219823]
  * Preparing an NSEC3 closest encloser proof could cause excessive
    CPU load, leading to a denial-of-service condition. This has
    been fixed. (CVE-2023-50868)
    [bsc#1219826]
  * Parsing DNS messages with many different names could cause
    excessive CPU load. This has been fixed. (CVE-2023-4408)
    [bsc#1219851]
  * Specific queries could cause named to crash with an assertion
    failure when nxdomain-redirect was enabled. This has been
    fixed. (CVE-2023-5517)
    [bsc#1219852]
  * A bad interaction between DNS64 and serve-stale could cause
    named to crash with an assertion failure, when both of these
    features were enabled. This has been fixed. (CVE-2023-5679)
    [bsc#1219853]
  * Query patterns that continuously triggered cache database
    maintenance could cause an excessive amount of memory to be
    allocated, exceeding max-cache-size and potentially leading to
    all available memory on the host running named being exhausted.
    This has been fixed. (CVE-2023-6516)
    [bsc#1219854]
  Packaging notes:
  * libnghttps2 added as BuildRequires for tls support
  * named-bootconf.diff patch is obsolete and has been removed
  [jsc#PED-7932]
- Update KillMode to 'control-group' in named.service to handle
  forked processes better.
  [bsc#1215755]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1721908800">- Update to release 9.18.28
  Bug Fixes:
  * Command-line options for IPv4-only (named -4) and IPv6-only
    (named -6) modes are now respected for zone primaries,
    also-notify, and parental-agents.
  * An RPZ response’s SOA record TTL was set to 1 instead of the
    SOA TTL, if add-soa was used. This has been fixed.
  * When a query related to zone maintenance (NOTIFY, SOA) timed
    out close to a view shutdown (triggered e.g. by rndc reload),
    named could crash with an assertion failure. This has been
    fixed.
  * The statistics channel counters that indicated the number of
    currently connected TCP IPv4/IPv6 clients were not properly
    adjusted in certain failure scenarios. This has been fixed.
  * Some servers that could not be reached due to EHOSTDOWN or
    ENETDOWN conditions were incorrectly prioritized during server
    selection. These are now properly handled as unreachable.
  * On some systems the libuv call may return an error code when
    sending a TCP reset for a connection, which triggers an
    assertion failure in named. This error condition is now dealt
    with in a more graceful manner, by logging the incident and
    shutting down the connection.
  * Changes to listen-on statements were ignored on reconfiguration
    unless the port or interface address was changed, making it
    impossible to change a related listener transport type. That
    issue has been fixed.
  * A bug in the keymgr code unintentionally slowed down some
    DNSSEC key rollovers. This has been fixed.
  * Some ISO 8601 durations were accepted erroneously, leading to
    shorter durations than expected. This has been fixed
  * A regression in cache-cleaning code enabled memory use to grow
    significantly more quickly than before, until the configured
    max-cache-size limit was reached. This has been fixed.
  * Using rndc flush inadvertently caused cache cleaning to become
    less effective. This could ultimately lead to the configured
    max-cache-size limit being exceeded and has now been fixed.
  * The logic for cleaning up expired cached DNS records was
    tweaked to be more aggressive. This change helps with enforcing
    max-cache-ttl and max-ncache-ttl in a timely manner.
  * It was possible to trigger a use-after-free assertion when the
    overmem cache cleaning was initiated. This has been fixed.
  New Features:
  * A new option signatures-jitter has been added to dnssec-policy
    to allow signature expirations to be spread out over a period
    of time.
  * The statistics channel now includes counters that indicate the
    number of currently connected TCP IPv4/IPv6 clients.
  * Added RESOLVER.ARPA to the built in empty zones.
  Feature Changes:
  * DNSSEC signatures that are not valid because the current time
    falls outside the signature inception and expiration dates are
    skipped instead of causing an immediate validation failure.
  Security Fixes:
  * A malicious DNS client that sent many queries over TCP but
    never read the responses could cause a server to respond slowly
    or not at all for other clients. This has been fixed.
    (CVE-2024-0760)
    [bsc#1228255]
  * It is possible to craft excessively large resource records
    sets, which have the effect of slowing down database
    processing. This has been addressed by adding a configurable
    limit to the number of records that can be stored per name and
    type in a cache or zone database. The default is 100, which can
    be tuned with the new max-records-per-type option.
  * It is possible to craft excessively large numbers of resource
    record types for a given owner name, which has the effect of
    slowing down database processing. This has been addressed by
    adding a configurable limit to the number of records that can
    be stored per name and type in a cache or zone database. The
    default is 100, which can be tuned with the new
    max-types-per-name option. (CVE-2024-1737)
    [bsc#1228256]
  * Validating DNS messages signed using the SIG(0) protocol (RFC
    2931) could cause excessive CPU load, leading to a
    denial-of-service condition. Support for SIG(0) message
    validation was removed from this version of named.
    (CVE-2024-1975)
    [bsc#1228257]
  * Due to a logic error, lookups that triggered serving stale data
    and required lookups in local authoritative zone data could
    have resulted in an assertion failure. This has been fixed.
  * Potential data races were found in our DoH implementation,
    related to HTTP/2 session object management and endpoints set
    object management after reconfiguration. These issues have been
    fixed.
  * When looking up the NS records of parent zones as part of
    looking up DS records, it was possible for named to trigger an
    assertion failure if serve-stale was enabled. This has been
    fixed. (CVE-2024-4076)
    [bsc#1228258]</changelog>
</package>
<package pkgid="09901a71511bbd5cd61814813f5c5477914750535ae952ce1c22d48be5fa0318" name="bind" arch="ppc64le">
  <version epoch="0" ver="9.18.28" rel="150600.3.3.1"/>
  <changelog author="josef.moellers@suse.com" date="1657800000">- Update to release 9.16.31
  This is the first of monthly updates of "bind". It is planned
  to update bind when a new upstream maintennace release becomes
  available, which is usually towards the end of a month, see
  https://www.isc.org/blogs/2021-bind-release-model/
  Compared to the previous SUSE release, in this release,
  53 (minor) bugs were fixed
  13 (minor) functional enhancements were made
  3 security issues are now fixed upstream:
    CVE-2022-0396, CVE-2021-25220, CVE-2021-25219
  plus a few minor changes.
  For a full list of changes, please refer to the
  CHANGES file in the source rpm.
  This update obsoletes the following patches:
  * bind-fix-build-with-older-sphinx.patch
  * bind-CVE-2021-25219.patch
  * bind-9.16.27-0001-CVE-2021-25220.patch
  * bind-9.16.27-0002-CVE-2022-0396.patch
  [bind-9.16.31.tar.xz, bind-9.16.31.tar.xz.sha512.asc,
  bind-9.16.20.tar.xz, bind-9.16.20.tar.xz.sha512.asc,
  bind-fix-build-with-older-sphinx.patch, bind-CVE-2021-25219.patch,
  bind-9.16.27-0001-CVE-2021-25220.patch,
  bind-9.16.27-0002-CVE-2022-0396.patch,
  jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1661256000">- Update to release 9.16.32
  Feature Changes:
  * The DNSSEC algorithms RSASHA1 and NSEC3RSASHA1 are now automatically
  disabled on systems where they are disallowed by the security policy
  (e.g. Red Hat Enterprise Linux 9). Primary zones using those algorithms
  need to be migrated to new algorithms prior to running on these systems,
  as graceful migration to different DNSSEC algorithms is not possible when
  RSASHA1 is disallowed by the operating system.
  * Log messages related to fetch limiting have been improved to provide
  more complete information. Specifically, the final counts of allowed
  and spilled fetches are now logged before the counter object is destroyed.
  Bug Fixes:
  * Non-dynamic zones that inherit dnssec-policy from the view or options
  blocks were not marked as inline-signed and therefore never scheduled
  to be re-signed. This has been fixed.
  * The old max-zone-ttl zone option was meant to be superseded by
  the max-zone-ttl option in dnssec-policy; however, the latter option
  was not fully effective. This has been corrected: zones no longer load
  if they contain TTLs greater than the limit configured in dnssec-policy.
  For zones with both the old max-zone-ttl option and dnssec-policy
  configured, the old option is ignored, and a warning is generated.
  * rndc dumpdb -expired was fixed to include expired RRsets,
  even if stale-cache-enable is set to no and
  the cache-cleaning time window has passed.
  [bind-9.16.32.tar.xz, bind-9.16.32.tar.xz.sha512.asc,
  bind-9.16.31.tar.xz, bind-9.16.31.tar.xz.sha512.asc,
  bind.spec, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1662724800">- Include a modified createNamedConfInclude script again, as this
  broke compatability with existing configurations.
  A symlink for named.conf.include to /var/lib/named is created to
  allow for a read-only /etc directory.
  However it is still advised to change the existing configuration.
  See README-bind.chrootenv for a guide how to do this.
  [bsc#1203250, vendor-files/tools/createNamedConfInclude,
  vendor-files/docu/README-bind.chrootenv, bind.spec]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1662724801">- Add systemd drop-in directory for named service
  [bsc#1201689, bind.spec]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1663761600">- Update to release 9.16.33
  Security Fixes:
  * Previously, there was no limit to the number of database lookups
    performed while processing large delegations, which could be
    abused to severely impact the performance of named running as a
    recursive resolver. This has been fixed. (CVE-2022-2795)
  * named running as a resolver with the stale-answer-client-timeout
    option set to 0 could crash with an assertion failure, when
    there was a stale CNAME in the cache for the incoming query.
    This has been fixed. (CVE-2022-3080)
  * A memory leak was fixed that could be externally triggered in the
    DNSSEC verification code for the ECDSA algorithm. (CVE-2022-38177)
  * Memory leaks were fixed that could be externally triggered in the
    DNSSEC verification code for the EdDSA algorithm. (CVE-2022-38178)
  Feature Changes:
  * Response Rate Limiting (RRL) code now treats all QNAMEs that are
    subject to wildcard processing within a given zone as the same
    name, to prevent circumventing the limits enforced by RRL.
  * Zones using dnssec-policy now require dynamic DNS or
    inline-signing to be configured explicitly.
  * A backward-compatible approach was implemented for encoding
    internationalized domain names (IDN) in dig and converting the
    domain to IDNA2008 form; if that fails,
    BIND tries an IDNA2003 conversion.
  Bug Fixes:
  * A serve-stale bug was fixed, where BIND would try to return stale
    data from cache for lookups that received duplicate queries or
    queries that would be dropped. This bug resulted in premature
    SERVFAIL responses, and has now been resolved.
  [bsc#1203614, bsc#1203618, bsc#1203619, bsc#1203620, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1668168000">- Update to release 9.16.34
  New Features:
  * Support for parsing and validating the dohpath service
    parameter in SVCB records was added.
  * named now logs the supported cryptographic algorithms during
    startup and in the output of named -V.
  Bug Fixes:
  * Changing just the TSIG key names for primaries in catalog
    zones’ member zones was not effective. This has been fixed.
  Known Issues:
  * Upgrading from BIND 9.16.32 or any older version may require a
    manual configuration change. The following configurations are
    affected:
  - type primary zones configured with dnssec-policy but without
    either allow-update or update-policy,
  - type secondary zones configured with dnssec-policy.
    In these cases please add inline-signing yes; to the individual
    zone configuration(s). Without applying this change, named will
    fail to start. For more details, see
    https://kb.isc.org/docs/dnssec-policy-requires-dynamic-dns-or-inline-signing
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1669291200">- Update to release 9.16.35
  Bug Fixes:
  * A crash was fixed that happened when a dnssec-policy zone that
    used NSEC3 was reconfigured to enable inline-signing.
  * In certain resolution scenarios, quotas could be erroneously
    reached for servers, including any configured forwarders,
    resulting in SERVFAIL answers being sent to clients.
  * rpz-ip rules in response-policy zones could be ineffective in
    some cases if a query had the CD (Checking Disabled) bit set to
    1.
  * Previously, if Internet connectivity issues were experienced
    during the initial startup of named, a BIND resolver with
    dnssec-validation set to auto could enter into a state where it
    would not recover without stopping named, manually deleting the
    managed-keys.bind and managed-keys.bind.jnl files, and starting
    named again.
  * The statistics counter representing the current number of
    clients awaiting recursive resolution results (RecursClients)
    could overflow in certain resolution scenarios.
  * Previously, BIND failed to start on Solaris-based systems with
    hundreds of CPUs.
  * When a DNS resource record’s TTL value was equal to the
    resolver’s configured prefetch “eligibility” value, the record
    was erroneously not treated as eligible for prefetching.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1671710400">- Update to release 9.16.36
  Feature Changes:
  * The auto-dnssec option has been deprecated and will be removed
    in a future BIND 9.19.x release. Please migrate to
    dnssec-policy.
  Bug Fixes:
  * When a catalog zone was removed from the configuration, in some
    cases a dangling pointer could cause the named process to
    crash.
  * When a zone was deleted from a server, a key management object
    related to that zone was inadvertently kept in memory and only
    released upon shutdown. This could lead to constantly
    increasing memory use on servers with a high rate of changes
    affecting the set of zones being served.
  * In certain cases, named waited for the resolution of
    outstanding recursive queries to finish before shutting down.
  * The zone &lt;name&gt;/&lt;class&gt;: final reference detached log message
    was moved from the INFO log level to the DEBUG(1) log level to
    prevent the named-checkzone tool from superfluously logging
    this message in non-debug mode.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1674561600">- Update to release 9.16.37
  Security Fixes:
  * An UPDATE message flood could cause named to exhaust all
    available memory. This flaw was addressed by adding a new
    update-quota option that controls the maximum number of
    outstanding DNS UPDATE messages that named can hold in a queue
    at any given time (default: 100). (CVE-2022-3094)
  * named could crash with an assertion failure when an RRSIG query
    was received and stale-answer-client-timeout was set to a
    non-zero value. This has been fixed. (CVE-2022-3736)
  * named running as a resolver with the
    stale-answer-client-timeout option set to any value greater
    than 0 could crash with an assertion failure, when the
    recursive-clients soft quota was reached. This has been fixed.
    (CVE-2022-3924)
  New Features:
  * The new update-quota option can be used to control the number
    of simultaneous DNS UPDATE messages that can be processed to
    update an authoritative zone on a primary server, or forwarded
    to the primary server by a secondary server. The default is
    100. A new statistics counter has also been added to record
    events when this quota is exceeded, and the version numbers for
    the XML and JSON statistics schemas have been updated.
  Feature Changes:
  * The Differentiated Services Code Point (DSCP) feature in BIND
    has been deprecated. Configuring DSCP values in named.conf now
    causes a warning to be logged. Note that this feature has only
    been partly operational since the new Network Manager was
    introduced in BIND 9.16.0.
  * The catalog zone implementation has been optimized to work with
    hundreds of thousands of member zones.
  Bug Fixes:
  * In certain query resolution scenarios (e.g. when following
    CNAME records), named configured to answer from stale cache
    could return a SERVFAIL response despite a usable, non-stale
    answer being present in the cache. This has been fixed.
  [bsc#1207471, bsc#1207473, bsc#1207475, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1676548800">- Update to release 9.16.38
  Bug Fixes:
  * A constant stream of zone additions and deletions via rndc
    reconfig could cause increased memory consumption due to
    delayed cleaning of view memory. This has been fixed.
  * The speed of the message digest algorithms (MD5, SHA-1, SHA-2),
    and of NSEC3 hashing, has been improved.
  * Building BIND 9 failed when the --enable-dnsrps switch for
    ./configure was used. This has been fixed.
  [jsc#SLE-24600]
- Updated keyring and signature</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1678881600">- Update to release 9.16.39
  Feature Changes:
  * libuv support for receiving multiple UDP messages in a single
    recvmmsg() system call has been tweaked several times between
    libuv versions 1.35.0 and 1.40.0; the current recommended libuv
    version is 1.40.0 or higher. New rules are now in effect for
    running with a different version of libuv than the one used at
    compilation time. These rules may trigger a fatal error at
    startup:
  - Building against or running with libuv versions 1.35.0 and
    1.36.0 is now a fatal error.
  - Running with libuv version higher than 1.34.2 is now a
    fatal error when named is built against libuv version
    1.34.2 or lower.
  - Running with libuv version higher than 1.39.0 is now a
    fatal error when named is built against libuv version
    1.37.0, 1.38.0, 1.38.1, or 1.39.0.
  * This prevents the use of libuv versions that may trigger an
    assertion failure when receiving multiple UDP messages in a
    single system call.
  Bug Fixes:
  * named could crash with an assertion failure when adding a new
    zone into the configuration file for a name which was already
    configured as a member zone for a catalog zone. This has been
    fixed.
  * When named starts up, it sends a query for the DNSSEC key for
    each configured trust anchor to determine whether the key has
    changed. In some unusual cases, the query might depend on a
    zone for which the server is itself authoritative, and would
    have failed if it were sent before the zone was fully loaded.
    This has now been fixed by delaying the key queries until all
    zones have finished loading.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1682424000">- Update to release 9.16.40
  Bug Fixes:
  * Logfiles using timestamp-style suffixes were not always
    correctly removed when the number of files exceeded the limit
    set by versions. This has been fixed for configurations which
    do not explicitly specify a directory path as part of the file
    argument in the channel specification.
  * Performance of DNSSEC validation in zones with many DNSKEY
    records has been improved.</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1684324800">- Update to release 9.16.41
  Bug Fixes:
  * When removing delegations from an opt-out range,
    empty-non-terminal NSEC3 records generated by those delegations
    were not cleaned up. This has been fixed.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1687348800">- Update to release 9.16.42
  Security Fixes:
  * The overmem cleaning process has been improved, to prevent the
    cache from significantly exceeding the configured
    max-cache-size limit. (CVE-2023-2828)
  * A query that prioritizes stale data over lookup triggers a
    fetch to refresh the stale data in cache. If the fetch is
    aborted for exceeding the recursion quota, it was possible for
    named to enter an infinite callback loop and crash due to stack
    overflow. This has been fixed. (CVE-2023-2911)
  Bug Fixes:
  * Previously, it was possible for a delegation from cache to be
    returned to the client after the stale-answer-client-timeout
    duration. This has been fixed.
  [bsc#1212544, bsc#1212567, jsc#SLE-24600]</changelog>
  <changelog author="dmueller@suse.com" date="1688644800">- rebuild bind-utils on libuv updates (bsc#1212090)</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1688990400">- Log named-checkconf output [bsc#1213049]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1689076800">- Add dnstap support
  [jsc#PED-4852]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1695124800">- Update to release 9.16.44
  Bug Fixes:
  * Processing already-queued queries received over TCP could cause
    an assertion failure, when the server was reconfigured at the
    same time or the cache was being flushed. This has been fixed.
  Security Fixes:
  * Previously, sending a specially crafted message over the
    control channel could cause the packet-parsing code to run out
    of available stack memory, causing named to terminate
    unexpectedly. This has been fixed. (CVE-2023-3341)
  [bsc#1215472]
- Switch to pkgconfig(libprotobuf-c) since this now contains the
  required protobuf-c binary</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1708084800">- Update to new Major Version 9.18.24.
  This has many enhancements, bug fixes and changes.
  Breaking Changes:
  * Some options have been removed and some have been deprecated
    and will be removed in the future.
    For a complete list, see:
    https://kb.isc.org/docs/changes-to-be-aware-of-when-moving-from-bind-916-to-918
  Major Changes:
  * Support for securing DNS traffic using Transport Layer Security
    (TLS). TLS is used by both DNS-over-TLS (DoT) and
    DNS-over-HTTPS (DoH).
  * Support for zone transfers over TLS (XFR-over-TLS, XoT) for
    both incoming and outgoing zone transfers.
  * The dig tool is now able to send DoT queries (+tls option).
  * Support for OpenSSL 3.0 APIs was added.
  * dnssec-checkds, dnssec-coverage, dnssec-keymgr, which have been
    removed in favor of the dnssec-policy feature
  * python3-bind is deprecated and the subpackage has been removed
  * A number of utilities have been moved from /usr/sbin to
    /usr/bin:
    named-checkconf named-checkzone named-compilezone
    dnssec-dsfromkey dnssec-importkey dnssec-keyfromlabel
    dnssec-keygen dnssec-revoke dnssec-settime dnssec-signzone
    dnssec-verify dnssec-cds named-journalprint nsec3hash
  * The lib directory was renamed from 'named' to 'bind'
  For a complete list of changes, see:
  * Bind Release Notes
    https://bind9.readthedocs.io/en/v9.18.24/notes.html
  * The CHANGES file in the source RPM
  Security Fixes:
  * Validating DNS messages containing a lot of DNSSEC signatures
    could cause excessive CPU load, leading to a denial-of-service
    condition. This has been fixed. (CVE-2023-50387)
    [bsc#1219823]
  * Preparing an NSEC3 closest encloser proof could cause excessive
    CPU load, leading to a denial-of-service condition. This has
    been fixed. (CVE-2023-50868)
    [bsc#1219826]
  * Parsing DNS messages with many different names could cause
    excessive CPU load. This has been fixed. (CVE-2023-4408)
    [bsc#1219851]
  * Specific queries could cause named to crash with an assertion
    failure when nxdomain-redirect was enabled. This has been
    fixed. (CVE-2023-5517)
    [bsc#1219852]
  * A bad interaction between DNS64 and serve-stale could cause
    named to crash with an assertion failure, when both of these
    features were enabled. This has been fixed. (CVE-2023-5679)
    [bsc#1219853]
  * Query patterns that continuously triggered cache database
    maintenance could cause an excessive amount of memory to be
    allocated, exceeding max-cache-size and potentially leading to
    all available memory on the host running named being exhausted.
    This has been fixed. (CVE-2023-6516)
    [bsc#1219854]
  Packaging notes:
  * libnghttps2 added as BuildRequires for tls support
  * named-bootconf.diff patch is obsolete and has been removed
  [jsc#PED-7932]
- Update KillMode to 'control-group' in named.service to handle
  forked processes better.
  [bsc#1215755]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1721908800">- Update to release 9.18.28
  Bug Fixes:
  * Command-line options for IPv4-only (named -4) and IPv6-only
    (named -6) modes are now respected for zone primaries,
    also-notify, and parental-agents.
  * An RPZ response’s SOA record TTL was set to 1 instead of the
    SOA TTL, if add-soa was used. This has been fixed.
  * When a query related to zone maintenance (NOTIFY, SOA) timed
    out close to a view shutdown (triggered e.g. by rndc reload),
    named could crash with an assertion failure. This has been
    fixed.
  * The statistics channel counters that indicated the number of
    currently connected TCP IPv4/IPv6 clients were not properly
    adjusted in certain failure scenarios. This has been fixed.
  * Some servers that could not be reached due to EHOSTDOWN or
    ENETDOWN conditions were incorrectly prioritized during server
    selection. These are now properly handled as unreachable.
  * On some systems the libuv call may return an error code when
    sending a TCP reset for a connection, which triggers an
    assertion failure in named. This error condition is now dealt
    with in a more graceful manner, by logging the incident and
    shutting down the connection.
  * Changes to listen-on statements were ignored on reconfiguration
    unless the port or interface address was changed, making it
    impossible to change a related listener transport type. That
    issue has been fixed.
  * A bug in the keymgr code unintentionally slowed down some
    DNSSEC key rollovers. This has been fixed.
  * Some ISO 8601 durations were accepted erroneously, leading to
    shorter durations than expected. This has been fixed
  * A regression in cache-cleaning code enabled memory use to grow
    significantly more quickly than before, until the configured
    max-cache-size limit was reached. This has been fixed.
  * Using rndc flush inadvertently caused cache cleaning to become
    less effective. This could ultimately lead to the configured
    max-cache-size limit being exceeded and has now been fixed.
  * The logic for cleaning up expired cached DNS records was
    tweaked to be more aggressive. This change helps with enforcing
    max-cache-ttl and max-ncache-ttl in a timely manner.
  * It was possible to trigger a use-after-free assertion when the
    overmem cache cleaning was initiated. This has been fixed.
  New Features:
  * A new option signatures-jitter has been added to dnssec-policy
    to allow signature expirations to be spread out over a period
    of time.
  * The statistics channel now includes counters that indicate the
    number of currently connected TCP IPv4/IPv6 clients.
  * Added RESOLVER.ARPA to the built in empty zones.
  Feature Changes:
  * DNSSEC signatures that are not valid because the current time
    falls outside the signature inception and expiration dates are
    skipped instead of causing an immediate validation failure.
  Security Fixes:
  * A malicious DNS client that sent many queries over TCP but
    never read the responses could cause a server to respond slowly
    or not at all for other clients. This has been fixed.
    (CVE-2024-0760)
    [bsc#1228255]
  * It is possible to craft excessively large resource records
    sets, which have the effect of slowing down database
    processing. This has been addressed by adding a configurable
    limit to the number of records that can be stored per name and
    type in a cache or zone database. The default is 100, which can
    be tuned with the new max-records-per-type option.
  * It is possible to craft excessively large numbers of resource
    record types for a given owner name, which has the effect of
    slowing down database processing. This has been addressed by
    adding a configurable limit to the number of records that can
    be stored per name and type in a cache or zone database. The
    default is 100, which can be tuned with the new
    max-types-per-name option. (CVE-2024-1737)
    [bsc#1228256]
  * Validating DNS messages signed using the SIG(0) protocol (RFC
    2931) could cause excessive CPU load, leading to a
    denial-of-service condition. Support for SIG(0) message
    validation was removed from this version of named.
    (CVE-2024-1975)
    [bsc#1228257]
  * Due to a logic error, lookups that triggered serving stale data
    and required lookups in local authoritative zone data could
    have resulted in an assertion failure. This has been fixed.
  * Potential data races were found in our DoH implementation,
    related to HTTP/2 session object management and endpoints set
    object management after reconfiguration. These issues have been
    fixed.
  * When looking up the NS records of parent zones as part of
    looking up DS records, it was possible for named to trigger an
    assertion failure if serve-stale was enabled. This has been
    fixed. (CVE-2024-4076)
    [bsc#1228258]</changelog>
</package>
<package pkgid="a96ae6bcf7dc79b7e5b9f56ae83442d3f0f73491a3e64869f09467bd38eea543" name="bind" arch="s390x">
  <version epoch="0" ver="9.18.28" rel="150600.3.3.1"/>
  <changelog author="josef.moellers@suse.com" date="1657800000">- Update to release 9.16.31
  This is the first of monthly updates of "bind". It is planned
  to update bind when a new upstream maintennace release becomes
  available, which is usually towards the end of a month, see
  https://www.isc.org/blogs/2021-bind-release-model/
  Compared to the previous SUSE release, in this release,
  53 (minor) bugs were fixed
  13 (minor) functional enhancements were made
  3 security issues are now fixed upstream:
    CVE-2022-0396, CVE-2021-25220, CVE-2021-25219
  plus a few minor changes.
  For a full list of changes, please refer to the
  CHANGES file in the source rpm.
  This update obsoletes the following patches:
  * bind-fix-build-with-older-sphinx.patch
  * bind-CVE-2021-25219.patch
  * bind-9.16.27-0001-CVE-2021-25220.patch
  * bind-9.16.27-0002-CVE-2022-0396.patch
  [bind-9.16.31.tar.xz, bind-9.16.31.tar.xz.sha512.asc,
  bind-9.16.20.tar.xz, bind-9.16.20.tar.xz.sha512.asc,
  bind-fix-build-with-older-sphinx.patch, bind-CVE-2021-25219.patch,
  bind-9.16.27-0001-CVE-2021-25220.patch,
  bind-9.16.27-0002-CVE-2022-0396.patch,
  jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1661256000">- Update to release 9.16.32
  Feature Changes:
  * The DNSSEC algorithms RSASHA1 and NSEC3RSASHA1 are now automatically
  disabled on systems where they are disallowed by the security policy
  (e.g. Red Hat Enterprise Linux 9). Primary zones using those algorithms
  need to be migrated to new algorithms prior to running on these systems,
  as graceful migration to different DNSSEC algorithms is not possible when
  RSASHA1 is disallowed by the operating system.
  * Log messages related to fetch limiting have been improved to provide
  more complete information. Specifically, the final counts of allowed
  and spilled fetches are now logged before the counter object is destroyed.
  Bug Fixes:
  * Non-dynamic zones that inherit dnssec-policy from the view or options
  blocks were not marked as inline-signed and therefore never scheduled
  to be re-signed. This has been fixed.
  * The old max-zone-ttl zone option was meant to be superseded by
  the max-zone-ttl option in dnssec-policy; however, the latter option
  was not fully effective. This has been corrected: zones no longer load
  if they contain TTLs greater than the limit configured in dnssec-policy.
  For zones with both the old max-zone-ttl option and dnssec-policy
  configured, the old option is ignored, and a warning is generated.
  * rndc dumpdb -expired was fixed to include expired RRsets,
  even if stale-cache-enable is set to no and
  the cache-cleaning time window has passed.
  [bind-9.16.32.tar.xz, bind-9.16.32.tar.xz.sha512.asc,
  bind-9.16.31.tar.xz, bind-9.16.31.tar.xz.sha512.asc,
  bind.spec, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1662724800">- Include a modified createNamedConfInclude script again, as this
  broke compatability with existing configurations.
  A symlink for named.conf.include to /var/lib/named is created to
  allow for a read-only /etc directory.
  However it is still advised to change the existing configuration.
  See README-bind.chrootenv for a guide how to do this.
  [bsc#1203250, vendor-files/tools/createNamedConfInclude,
  vendor-files/docu/README-bind.chrootenv, bind.spec]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1662724801">- Add systemd drop-in directory for named service
  [bsc#1201689, bind.spec]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1663761600">- Update to release 9.16.33
  Security Fixes:
  * Previously, there was no limit to the number of database lookups
    performed while processing large delegations, which could be
    abused to severely impact the performance of named running as a
    recursive resolver. This has been fixed. (CVE-2022-2795)
  * named running as a resolver with the stale-answer-client-timeout
    option set to 0 could crash with an assertion failure, when
    there was a stale CNAME in the cache for the incoming query.
    This has been fixed. (CVE-2022-3080)
  * A memory leak was fixed that could be externally triggered in the
    DNSSEC verification code for the ECDSA algorithm. (CVE-2022-38177)
  * Memory leaks were fixed that could be externally triggered in the
    DNSSEC verification code for the EdDSA algorithm. (CVE-2022-38178)
  Feature Changes:
  * Response Rate Limiting (RRL) code now treats all QNAMEs that are
    subject to wildcard processing within a given zone as the same
    name, to prevent circumventing the limits enforced by RRL.
  * Zones using dnssec-policy now require dynamic DNS or
    inline-signing to be configured explicitly.
  * A backward-compatible approach was implemented for encoding
    internationalized domain names (IDN) in dig and converting the
    domain to IDNA2008 form; if that fails,
    BIND tries an IDNA2003 conversion.
  Bug Fixes:
  * A serve-stale bug was fixed, where BIND would try to return stale
    data from cache for lookups that received duplicate queries or
    queries that would be dropped. This bug resulted in premature
    SERVFAIL responses, and has now been resolved.
  [bsc#1203614, bsc#1203618, bsc#1203619, bsc#1203620, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1668168000">- Update to release 9.16.34
  New Features:
  * Support for parsing and validating the dohpath service
    parameter in SVCB records was added.
  * named now logs the supported cryptographic algorithms during
    startup and in the output of named -V.
  Bug Fixes:
  * Changing just the TSIG key names for primaries in catalog
    zones’ member zones was not effective. This has been fixed.
  Known Issues:
  * Upgrading from BIND 9.16.32 or any older version may require a
    manual configuration change. The following configurations are
    affected:
  - type primary zones configured with dnssec-policy but without
    either allow-update or update-policy,
  - type secondary zones configured with dnssec-policy.
    In these cases please add inline-signing yes; to the individual
    zone configuration(s). Without applying this change, named will
    fail to start. For more details, see
    https://kb.isc.org/docs/dnssec-policy-requires-dynamic-dns-or-inline-signing
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1669291200">- Update to release 9.16.35
  Bug Fixes:
  * A crash was fixed that happened when a dnssec-policy zone that
    used NSEC3 was reconfigured to enable inline-signing.
  * In certain resolution scenarios, quotas could be erroneously
    reached for servers, including any configured forwarders,
    resulting in SERVFAIL answers being sent to clients.
  * rpz-ip rules in response-policy zones could be ineffective in
    some cases if a query had the CD (Checking Disabled) bit set to
    1.
  * Previously, if Internet connectivity issues were experienced
    during the initial startup of named, a BIND resolver with
    dnssec-validation set to auto could enter into a state where it
    would not recover without stopping named, manually deleting the
    managed-keys.bind and managed-keys.bind.jnl files, and starting
    named again.
  * The statistics counter representing the current number of
    clients awaiting recursive resolution results (RecursClients)
    could overflow in certain resolution scenarios.
  * Previously, BIND failed to start on Solaris-based systems with
    hundreds of CPUs.
  * When a DNS resource record’s TTL value was equal to the
    resolver’s configured prefetch “eligibility” value, the record
    was erroneously not treated as eligible for prefetching.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1671710400">- Update to release 9.16.36
  Feature Changes:
  * The auto-dnssec option has been deprecated and will be removed
    in a future BIND 9.19.x release. Please migrate to
    dnssec-policy.
  Bug Fixes:
  * When a catalog zone was removed from the configuration, in some
    cases a dangling pointer could cause the named process to
    crash.
  * When a zone was deleted from a server, a key management object
    related to that zone was inadvertently kept in memory and only
    released upon shutdown. This could lead to constantly
    increasing memory use on servers with a high rate of changes
    affecting the set of zones being served.
  * In certain cases, named waited for the resolution of
    outstanding recursive queries to finish before shutting down.
  * The zone &lt;name&gt;/&lt;class&gt;: final reference detached log message
    was moved from the INFO log level to the DEBUG(1) log level to
    prevent the named-checkzone tool from superfluously logging
    this message in non-debug mode.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1674561600">- Update to release 9.16.37
  Security Fixes:
  * An UPDATE message flood could cause named to exhaust all
    available memory. This flaw was addressed by adding a new
    update-quota option that controls the maximum number of
    outstanding DNS UPDATE messages that named can hold in a queue
    at any given time (default: 100). (CVE-2022-3094)
  * named could crash with an assertion failure when an RRSIG query
    was received and stale-answer-client-timeout was set to a
    non-zero value. This has been fixed. (CVE-2022-3736)
  * named running as a resolver with the
    stale-answer-client-timeout option set to any value greater
    than 0 could crash with an assertion failure, when the
    recursive-clients soft quota was reached. This has been fixed.
    (CVE-2022-3924)
  New Features:
  * The new update-quota option can be used to control the number
    of simultaneous DNS UPDATE messages that can be processed to
    update an authoritative zone on a primary server, or forwarded
    to the primary server by a secondary server. The default is
    100. A new statistics counter has also been added to record
    events when this quota is exceeded, and the version numbers for
    the XML and JSON statistics schemas have been updated.
  Feature Changes:
  * The Differentiated Services Code Point (DSCP) feature in BIND
    has been deprecated. Configuring DSCP values in named.conf now
    causes a warning to be logged. Note that this feature has only
    been partly operational since the new Network Manager was
    introduced in BIND 9.16.0.
  * The catalog zone implementation has been optimized to work with
    hundreds of thousands of member zones.
  Bug Fixes:
  * In certain query resolution scenarios (e.g. when following
    CNAME records), named configured to answer from stale cache
    could return a SERVFAIL response despite a usable, non-stale
    answer being present in the cache. This has been fixed.
  [bsc#1207471, bsc#1207473, bsc#1207475, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1676548800">- Update to release 9.16.38
  Bug Fixes:
  * A constant stream of zone additions and deletions via rndc
    reconfig could cause increased memory consumption due to
    delayed cleaning of view memory. This has been fixed.
  * The speed of the message digest algorithms (MD5, SHA-1, SHA-2),
    and of NSEC3 hashing, has been improved.
  * Building BIND 9 failed when the --enable-dnsrps switch for
    ./configure was used. This has been fixed.
  [jsc#SLE-24600]
- Updated keyring and signature</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1678881600">- Update to release 9.16.39
  Feature Changes:
  * libuv support for receiving multiple UDP messages in a single
    recvmmsg() system call has been tweaked several times between
    libuv versions 1.35.0 and 1.40.0; the current recommended libuv
    version is 1.40.0 or higher. New rules are now in effect for
    running with a different version of libuv than the one used at
    compilation time. These rules may trigger a fatal error at
    startup:
  - Building against or running with libuv versions 1.35.0 and
    1.36.0 is now a fatal error.
  - Running with libuv version higher than 1.34.2 is now a
    fatal error when named is built against libuv version
    1.34.2 or lower.
  - Running with libuv version higher than 1.39.0 is now a
    fatal error when named is built against libuv version
    1.37.0, 1.38.0, 1.38.1, or 1.39.0.
  * This prevents the use of libuv versions that may trigger an
    assertion failure when receiving multiple UDP messages in a
    single system call.
  Bug Fixes:
  * named could crash with an assertion failure when adding a new
    zone into the configuration file for a name which was already
    configured as a member zone for a catalog zone. This has been
    fixed.
  * When named starts up, it sends a query for the DNSSEC key for
    each configured trust anchor to determine whether the key has
    changed. In some unusual cases, the query might depend on a
    zone for which the server is itself authoritative, and would
    have failed if it were sent before the zone was fully loaded.
    This has now been fixed by delaying the key queries until all
    zones have finished loading.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1682424000">- Update to release 9.16.40
  Bug Fixes:
  * Logfiles using timestamp-style suffixes were not always
    correctly removed when the number of files exceeded the limit
    set by versions. This has been fixed for configurations which
    do not explicitly specify a directory path as part of the file
    argument in the channel specification.
  * Performance of DNSSEC validation in zones with many DNSKEY
    records has been improved.</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1684324800">- Update to release 9.16.41
  Bug Fixes:
  * When removing delegations from an opt-out range,
    empty-non-terminal NSEC3 records generated by those delegations
    were not cleaned up. This has been fixed.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1687348800">- Update to release 9.16.42
  Security Fixes:
  * The overmem cleaning process has been improved, to prevent the
    cache from significantly exceeding the configured
    max-cache-size limit. (CVE-2023-2828)
  * A query that prioritizes stale data over lookup triggers a
    fetch to refresh the stale data in cache. If the fetch is
    aborted for exceeding the recursion quota, it was possible for
    named to enter an infinite callback loop and crash due to stack
    overflow. This has been fixed. (CVE-2023-2911)
  Bug Fixes:
  * Previously, it was possible for a delegation from cache to be
    returned to the client after the stale-answer-client-timeout
    duration. This has been fixed.
  [bsc#1212544, bsc#1212567, jsc#SLE-24600]</changelog>
  <changelog author="dmueller@suse.com" date="1688644800">- rebuild bind-utils on libuv updates (bsc#1212090)</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1688990400">- Log named-checkconf output [bsc#1213049]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1689076800">- Add dnstap support
  [jsc#PED-4852]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1695124800">- Update to release 9.16.44
  Bug Fixes:
  * Processing already-queued queries received over TCP could cause
    an assertion failure, when the server was reconfigured at the
    same time or the cache was being flushed. This has been fixed.
  Security Fixes:
  * Previously, sending a specially crafted message over the
    control channel could cause the packet-parsing code to run out
    of available stack memory, causing named to terminate
    unexpectedly. This has been fixed. (CVE-2023-3341)
  [bsc#1215472]
- Switch to pkgconfig(libprotobuf-c) since this now contains the
  required protobuf-c binary</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1708084800">- Update to new Major Version 9.18.24.
  This has many enhancements, bug fixes and changes.
  Breaking Changes:
  * Some options have been removed and some have been deprecated
    and will be removed in the future.
    For a complete list, see:
    https://kb.isc.org/docs/changes-to-be-aware-of-when-moving-from-bind-916-to-918
  Major Changes:
  * Support for securing DNS traffic using Transport Layer Security
    (TLS). TLS is used by both DNS-over-TLS (DoT) and
    DNS-over-HTTPS (DoH).
  * Support for zone transfers over TLS (XFR-over-TLS, XoT) for
    both incoming and outgoing zone transfers.
  * The dig tool is now able to send DoT queries (+tls option).
  * Support for OpenSSL 3.0 APIs was added.
  * dnssec-checkds, dnssec-coverage, dnssec-keymgr, which have been
    removed in favor of the dnssec-policy feature
  * python3-bind is deprecated and the subpackage has been removed
  * A number of utilities have been moved from /usr/sbin to
    /usr/bin:
    named-checkconf named-checkzone named-compilezone
    dnssec-dsfromkey dnssec-importkey dnssec-keyfromlabel
    dnssec-keygen dnssec-revoke dnssec-settime dnssec-signzone
    dnssec-verify dnssec-cds named-journalprint nsec3hash
  * The lib directory was renamed from 'named' to 'bind'
  For a complete list of changes, see:
  * Bind Release Notes
    https://bind9.readthedocs.io/en/v9.18.24/notes.html
  * The CHANGES file in the source RPM
  Security Fixes:
  * Validating DNS messages containing a lot of DNSSEC signatures
    could cause excessive CPU load, leading to a denial-of-service
    condition. This has been fixed. (CVE-2023-50387)
    [bsc#1219823]
  * Preparing an NSEC3 closest encloser proof could cause excessive
    CPU load, leading to a denial-of-service condition. This has
    been fixed. (CVE-2023-50868)
    [bsc#1219826]
  * Parsing DNS messages with many different names could cause
    excessive CPU load. This has been fixed. (CVE-2023-4408)
    [bsc#1219851]
  * Specific queries could cause named to crash with an assertion
    failure when nxdomain-redirect was enabled. This has been
    fixed. (CVE-2023-5517)
    [bsc#1219852]
  * A bad interaction between DNS64 and serve-stale could cause
    named to crash with an assertion failure, when both of these
    features were enabled. This has been fixed. (CVE-2023-5679)
    [bsc#1219853]
  * Query patterns that continuously triggered cache database
    maintenance could cause an excessive amount of memory to be
    allocated, exceeding max-cache-size and potentially leading to
    all available memory on the host running named being exhausted.
    This has been fixed. (CVE-2023-6516)
    [bsc#1219854]
  Packaging notes:
  * libnghttps2 added as BuildRequires for tls support
  * named-bootconf.diff patch is obsolete and has been removed
  [jsc#PED-7932]
- Update KillMode to 'control-group' in named.service to handle
  forked processes better.
  [bsc#1215755]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1721908800">- Update to release 9.18.28
  Bug Fixes:
  * Command-line options for IPv4-only (named -4) and IPv6-only
    (named -6) modes are now respected for zone primaries,
    also-notify, and parental-agents.
  * An RPZ response’s SOA record TTL was set to 1 instead of the
    SOA TTL, if add-soa was used. This has been fixed.
  * When a query related to zone maintenance (NOTIFY, SOA) timed
    out close to a view shutdown (triggered e.g. by rndc reload),
    named could crash with an assertion failure. This has been
    fixed.
  * The statistics channel counters that indicated the number of
    currently connected TCP IPv4/IPv6 clients were not properly
    adjusted in certain failure scenarios. This has been fixed.
  * Some servers that could not be reached due to EHOSTDOWN or
    ENETDOWN conditions were incorrectly prioritized during server
    selection. These are now properly handled as unreachable.
  * On some systems the libuv call may return an error code when
    sending a TCP reset for a connection, which triggers an
    assertion failure in named. This error condition is now dealt
    with in a more graceful manner, by logging the incident and
    shutting down the connection.
  * Changes to listen-on statements were ignored on reconfiguration
    unless the port or interface address was changed, making it
    impossible to change a related listener transport type. That
    issue has been fixed.
  * A bug in the keymgr code unintentionally slowed down some
    DNSSEC key rollovers. This has been fixed.
  * Some ISO 8601 durations were accepted erroneously, leading to
    shorter durations than expected. This has been fixed
  * A regression in cache-cleaning code enabled memory use to grow
    significantly more quickly than before, until the configured
    max-cache-size limit was reached. This has been fixed.
  * Using rndc flush inadvertently caused cache cleaning to become
    less effective. This could ultimately lead to the configured
    max-cache-size limit being exceeded and has now been fixed.
  * The logic for cleaning up expired cached DNS records was
    tweaked to be more aggressive. This change helps with enforcing
    max-cache-ttl and max-ncache-ttl in a timely manner.
  * It was possible to trigger a use-after-free assertion when the
    overmem cache cleaning was initiated. This has been fixed.
  New Features:
  * A new option signatures-jitter has been added to dnssec-policy
    to allow signature expirations to be spread out over a period
    of time.
  * The statistics channel now includes counters that indicate the
    number of currently connected TCP IPv4/IPv6 clients.
  * Added RESOLVER.ARPA to the built in empty zones.
  Feature Changes:
  * DNSSEC signatures that are not valid because the current time
    falls outside the signature inception and expiration dates are
    skipped instead of causing an immediate validation failure.
  Security Fixes:
  * A malicious DNS client that sent many queries over TCP but
    never read the responses could cause a server to respond slowly
    or not at all for other clients. This has been fixed.
    (CVE-2024-0760)
    [bsc#1228255]
  * It is possible to craft excessively large resource records
    sets, which have the effect of slowing down database
    processing. This has been addressed by adding a configurable
    limit to the number of records that can be stored per name and
    type in a cache or zone database. The default is 100, which can
    be tuned with the new max-records-per-type option.
  * It is possible to craft excessively large numbers of resource
    record types for a given owner name, which has the effect of
    slowing down database processing. This has been addressed by
    adding a configurable limit to the number of records that can
    be stored per name and type in a cache or zone database. The
    default is 100, which can be tuned with the new
    max-types-per-name option. (CVE-2024-1737)
    [bsc#1228256]
  * Validating DNS messages signed using the SIG(0) protocol (RFC
    2931) could cause excessive CPU load, leading to a
    denial-of-service condition. Support for SIG(0) message
    validation was removed from this version of named.
    (CVE-2024-1975)
    [bsc#1228257]
  * Due to a logic error, lookups that triggered serving stale data
    and required lookups in local authoritative zone data could
    have resulted in an assertion failure. This has been fixed.
  * Potential data races were found in our DoH implementation,
    related to HTTP/2 session object management and endpoints set
    object management after reconfiguration. These issues have been
    fixed.
  * When looking up the NS records of parent zones as part of
    looking up DS records, it was possible for named to trigger an
    assertion failure if serve-stale was enabled. This has been
    fixed. (CVE-2024-4076)
    [bsc#1228258]</changelog>
</package>
<package pkgid="550908d69c1d05938cc7bd417278a8601b013d45cf3005effbb55e9ad1993d04" name="bind" arch="src">
  <version epoch="0" ver="9.18.28" rel="150600.3.3.1"/>
  <changelog author="josef.moellers@suse.com" date="1657800000">- Update to release 9.16.31
  This is the first of monthly updates of "bind". It is planned
  to update bind when a new upstream maintennace release becomes
  available, which is usually towards the end of a month, see
  https://www.isc.org/blogs/2021-bind-release-model/
  Compared to the previous SUSE release, in this release,
  53 (minor) bugs were fixed
  13 (minor) functional enhancements were made
  3 security issues are now fixed upstream:
    CVE-2022-0396, CVE-2021-25220, CVE-2021-25219
  plus a few minor changes.
  For a full list of changes, please refer to the
  CHANGES file in the source rpm.
  This update obsoletes the following patches:
  * bind-fix-build-with-older-sphinx.patch
  * bind-CVE-2021-25219.patch
  * bind-9.16.27-0001-CVE-2021-25220.patch
  * bind-9.16.27-0002-CVE-2022-0396.patch
  [bind-9.16.31.tar.xz, bind-9.16.31.tar.xz.sha512.asc,
  bind-9.16.20.tar.xz, bind-9.16.20.tar.xz.sha512.asc,
  bind-fix-build-with-older-sphinx.patch, bind-CVE-2021-25219.patch,
  bind-9.16.27-0001-CVE-2021-25220.patch,
  bind-9.16.27-0002-CVE-2022-0396.patch,
  jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1661256000">- Update to release 9.16.32
  Feature Changes:
  * The DNSSEC algorithms RSASHA1 and NSEC3RSASHA1 are now automatically
  disabled on systems where they are disallowed by the security policy
  (e.g. Red Hat Enterprise Linux 9). Primary zones using those algorithms
  need to be migrated to new algorithms prior to running on these systems,
  as graceful migration to different DNSSEC algorithms is not possible when
  RSASHA1 is disallowed by the operating system.
  * Log messages related to fetch limiting have been improved to provide
  more complete information. Specifically, the final counts of allowed
  and spilled fetches are now logged before the counter object is destroyed.
  Bug Fixes:
  * Non-dynamic zones that inherit dnssec-policy from the view or options
  blocks were not marked as inline-signed and therefore never scheduled
  to be re-signed. This has been fixed.
  * The old max-zone-ttl zone option was meant to be superseded by
  the max-zone-ttl option in dnssec-policy; however, the latter option
  was not fully effective. This has been corrected: zones no longer load
  if they contain TTLs greater than the limit configured in dnssec-policy.
  For zones with both the old max-zone-ttl option and dnssec-policy
  configured, the old option is ignored, and a warning is generated.
  * rndc dumpdb -expired was fixed to include expired RRsets,
  even if stale-cache-enable is set to no and
  the cache-cleaning time window has passed.
  [bind-9.16.32.tar.xz, bind-9.16.32.tar.xz.sha512.asc,
  bind-9.16.31.tar.xz, bind-9.16.31.tar.xz.sha512.asc,
  bind.spec, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1662724800">- Include a modified createNamedConfInclude script again, as this
  broke compatability with existing configurations.
  A symlink for named.conf.include to /var/lib/named is created to
  allow for a read-only /etc directory.
  However it is still advised to change the existing configuration.
  See README-bind.chrootenv for a guide how to do this.
  [bsc#1203250, vendor-files/tools/createNamedConfInclude,
  vendor-files/docu/README-bind.chrootenv, bind.spec]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1662724801">- Add systemd drop-in directory for named service
  [bsc#1201689, bind.spec]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1663761600">- Update to release 9.16.33
  Security Fixes:
  * Previously, there was no limit to the number of database lookups
    performed while processing large delegations, which could be
    abused to severely impact the performance of named running as a
    recursive resolver. This has been fixed. (CVE-2022-2795)
  * named running as a resolver with the stale-answer-client-timeout
    option set to 0 could crash with an assertion failure, when
    there was a stale CNAME in the cache for the incoming query.
    This has been fixed. (CVE-2022-3080)
  * A memory leak was fixed that could be externally triggered in the
    DNSSEC verification code for the ECDSA algorithm. (CVE-2022-38177)
  * Memory leaks were fixed that could be externally triggered in the
    DNSSEC verification code for the EdDSA algorithm. (CVE-2022-38178)
  Feature Changes:
  * Response Rate Limiting (RRL) code now treats all QNAMEs that are
    subject to wildcard processing within a given zone as the same
    name, to prevent circumventing the limits enforced by RRL.
  * Zones using dnssec-policy now require dynamic DNS or
    inline-signing to be configured explicitly.
  * A backward-compatible approach was implemented for encoding
    internationalized domain names (IDN) in dig and converting the
    domain to IDNA2008 form; if that fails,
    BIND tries an IDNA2003 conversion.
  Bug Fixes:
  * A serve-stale bug was fixed, where BIND would try to return stale
    data from cache for lookups that received duplicate queries or
    queries that would be dropped. This bug resulted in premature
    SERVFAIL responses, and has now been resolved.
  [bsc#1203614, bsc#1203618, bsc#1203619, bsc#1203620, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1668168000">- Update to release 9.16.34
  New Features:
  * Support for parsing and validating the dohpath service
    parameter in SVCB records was added.
  * named now logs the supported cryptographic algorithms during
    startup and in the output of named -V.
  Bug Fixes:
  * Changing just the TSIG key names for primaries in catalog
    zones’ member zones was not effective. This has been fixed.
  Known Issues:
  * Upgrading from BIND 9.16.32 or any older version may require a
    manual configuration change. The following configurations are
    affected:
  - type primary zones configured with dnssec-policy but without
    either allow-update or update-policy,
  - type secondary zones configured with dnssec-policy.
    In these cases please add inline-signing yes; to the individual
    zone configuration(s). Without applying this change, named will
    fail to start. For more details, see
    https://kb.isc.org/docs/dnssec-policy-requires-dynamic-dns-or-inline-signing
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1669291200">- Update to release 9.16.35
  Bug Fixes:
  * A crash was fixed that happened when a dnssec-policy zone that
    used NSEC3 was reconfigured to enable inline-signing.
  * In certain resolution scenarios, quotas could be erroneously
    reached for servers, including any configured forwarders,
    resulting in SERVFAIL answers being sent to clients.
  * rpz-ip rules in response-policy zones could be ineffective in
    some cases if a query had the CD (Checking Disabled) bit set to
    1.
  * Previously, if Internet connectivity issues were experienced
    during the initial startup of named, a BIND resolver with
    dnssec-validation set to auto could enter into a state where it
    would not recover without stopping named, manually deleting the
    managed-keys.bind and managed-keys.bind.jnl files, and starting
    named again.
  * The statistics counter representing the current number of
    clients awaiting recursive resolution results (RecursClients)
    could overflow in certain resolution scenarios.
  * Previously, BIND failed to start on Solaris-based systems with
    hundreds of CPUs.
  * When a DNS resource record’s TTL value was equal to the
    resolver’s configured prefetch “eligibility” value, the record
    was erroneously not treated as eligible for prefetching.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1671710400">- Update to release 9.16.36
  Feature Changes:
  * The auto-dnssec option has been deprecated and will be removed
    in a future BIND 9.19.x release. Please migrate to
    dnssec-policy.
  Bug Fixes:
  * When a catalog zone was removed from the configuration, in some
    cases a dangling pointer could cause the named process to
    crash.
  * When a zone was deleted from a server, a key management object
    related to that zone was inadvertently kept in memory and only
    released upon shutdown. This could lead to constantly
    increasing memory use on servers with a high rate of changes
    affecting the set of zones being served.
  * In certain cases, named waited for the resolution of
    outstanding recursive queries to finish before shutting down.
  * The zone &lt;name&gt;/&lt;class&gt;: final reference detached log message
    was moved from the INFO log level to the DEBUG(1) log level to
    prevent the named-checkzone tool from superfluously logging
    this message in non-debug mode.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1674561600">- Update to release 9.16.37
  Security Fixes:
  * An UPDATE message flood could cause named to exhaust all
    available memory. This flaw was addressed by adding a new
    update-quota option that controls the maximum number of
    outstanding DNS UPDATE messages that named can hold in a queue
    at any given time (default: 100). (CVE-2022-3094)
  * named could crash with an assertion failure when an RRSIG query
    was received and stale-answer-client-timeout was set to a
    non-zero value. This has been fixed. (CVE-2022-3736)
  * named running as a resolver with the
    stale-answer-client-timeout option set to any value greater
    than 0 could crash with an assertion failure, when the
    recursive-clients soft quota was reached. This has been fixed.
    (CVE-2022-3924)
  New Features:
  * The new update-quota option can be used to control the number
    of simultaneous DNS UPDATE messages that can be processed to
    update an authoritative zone on a primary server, or forwarded
    to the primary server by a secondary server. The default is
    100. A new statistics counter has also been added to record
    events when this quota is exceeded, and the version numbers for
    the XML and JSON statistics schemas have been updated.
  Feature Changes:
  * The Differentiated Services Code Point (DSCP) feature in BIND
    has been deprecated. Configuring DSCP values in named.conf now
    causes a warning to be logged. Note that this feature has only
    been partly operational since the new Network Manager was
    introduced in BIND 9.16.0.
  * The catalog zone implementation has been optimized to work with
    hundreds of thousands of member zones.
  Bug Fixes:
  * In certain query resolution scenarios (e.g. when following
    CNAME records), named configured to answer from stale cache
    could return a SERVFAIL response despite a usable, non-stale
    answer being present in the cache. This has been fixed.
  [bsc#1207471, bsc#1207473, bsc#1207475, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1676548800">- Update to release 9.16.38
  Bug Fixes:
  * A constant stream of zone additions and deletions via rndc
    reconfig could cause increased memory consumption due to
    delayed cleaning of view memory. This has been fixed.
  * The speed of the message digest algorithms (MD5, SHA-1, SHA-2),
    and of NSEC3 hashing, has been improved.
  * Building BIND 9 failed when the --enable-dnsrps switch for
    ./configure was used. This has been fixed.
  [jsc#SLE-24600]
- Updated keyring and signature</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1678881600">- Update to release 9.16.39
  Feature Changes:
  * libuv support for receiving multiple UDP messages in a single
    recvmmsg() system call has been tweaked several times between
    libuv versions 1.35.0 and 1.40.0; the current recommended libuv
    version is 1.40.0 or higher. New rules are now in effect for
    running with a different version of libuv than the one used at
    compilation time. These rules may trigger a fatal error at
    startup:
  - Building against or running with libuv versions 1.35.0 and
    1.36.0 is now a fatal error.
  - Running with libuv version higher than 1.34.2 is now a
    fatal error when named is built against libuv version
    1.34.2 or lower.
  - Running with libuv version higher than 1.39.0 is now a
    fatal error when named is built against libuv version
    1.37.0, 1.38.0, 1.38.1, or 1.39.0.
  * This prevents the use of libuv versions that may trigger an
    assertion failure when receiving multiple UDP messages in a
    single system call.
  Bug Fixes:
  * named could crash with an assertion failure when adding a new
    zone into the configuration file for a name which was already
    configured as a member zone for a catalog zone. This has been
    fixed.
  * When named starts up, it sends a query for the DNSSEC key for
    each configured trust anchor to determine whether the key has
    changed. In some unusual cases, the query might depend on a
    zone for which the server is itself authoritative, and would
    have failed if it were sent before the zone was fully loaded.
    This has now been fixed by delaying the key queries until all
    zones have finished loading.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1682424000">- Update to release 9.16.40
  Bug Fixes:
  * Logfiles using timestamp-style suffixes were not always
    correctly removed when the number of files exceeded the limit
    set by versions. This has been fixed for configurations which
    do not explicitly specify a directory path as part of the file
    argument in the channel specification.
  * Performance of DNSSEC validation in zones with many DNSKEY
    records has been improved.</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1684324800">- Update to release 9.16.41
  Bug Fixes:
  * When removing delegations from an opt-out range,
    empty-non-terminal NSEC3 records generated by those delegations
    were not cleaned up. This has been fixed.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1687348800">- Update to release 9.16.42
  Security Fixes:
  * The overmem cleaning process has been improved, to prevent the
    cache from significantly exceeding the configured
    max-cache-size limit. (CVE-2023-2828)
  * A query that prioritizes stale data over lookup triggers a
    fetch to refresh the stale data in cache. If the fetch is
    aborted for exceeding the recursion quota, it was possible for
    named to enter an infinite callback loop and crash due to stack
    overflow. This has been fixed. (CVE-2023-2911)
  Bug Fixes:
  * Previously, it was possible for a delegation from cache to be
    returned to the client after the stale-answer-client-timeout
    duration. This has been fixed.
  [bsc#1212544, bsc#1212567, jsc#SLE-24600]</changelog>
  <changelog author="dmueller@suse.com" date="1688644800">- rebuild bind-utils on libuv updates (bsc#1212090)</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1688990400">- Log named-checkconf output [bsc#1213049]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1689076800">- Add dnstap support
  [jsc#PED-4852]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1695124800">- Update to release 9.16.44
  Bug Fixes:
  * Processing already-queued queries received over TCP could cause
    an assertion failure, when the server was reconfigured at the
    same time or the cache was being flushed. This has been fixed.
  Security Fixes:
  * Previously, sending a specially crafted message over the
    control channel could cause the packet-parsing code to run out
    of available stack memory, causing named to terminate
    unexpectedly. This has been fixed. (CVE-2023-3341)
  [bsc#1215472]
- Switch to pkgconfig(libprotobuf-c) since this now contains the
  required protobuf-c binary</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1708084800">- Update to new Major Version 9.18.24.
  This has many enhancements, bug fixes and changes.
  Breaking Changes:
  * Some options have been removed and some have been deprecated
    and will be removed in the future.
    For a complete list, see:
    https://kb.isc.org/docs/changes-to-be-aware-of-when-moving-from-bind-916-to-918
  Major Changes:
  * Support for securing DNS traffic using Transport Layer Security
    (TLS). TLS is used by both DNS-over-TLS (DoT) and
    DNS-over-HTTPS (DoH).
  * Support for zone transfers over TLS (XFR-over-TLS, XoT) for
    both incoming and outgoing zone transfers.
  * The dig tool is now able to send DoT queries (+tls option).
  * Support for OpenSSL 3.0 APIs was added.
  * dnssec-checkds, dnssec-coverage, dnssec-keymgr, which have been
    removed in favor of the dnssec-policy feature
  * python3-bind is deprecated and the subpackage has been removed
  * A number of utilities have been moved from /usr/sbin to
    /usr/bin:
    named-checkconf named-checkzone named-compilezone
    dnssec-dsfromkey dnssec-importkey dnssec-keyfromlabel
    dnssec-keygen dnssec-revoke dnssec-settime dnssec-signzone
    dnssec-verify dnssec-cds named-journalprint nsec3hash
  * The lib directory was renamed from 'named' to 'bind'
  For a complete list of changes, see:
  * Bind Release Notes
    https://bind9.readthedocs.io/en/v9.18.24/notes.html
  * The CHANGES file in the source RPM
  Security Fixes:
  * Validating DNS messages containing a lot of DNSSEC signatures
    could cause excessive CPU load, leading to a denial-of-service
    condition. This has been fixed. (CVE-2023-50387)
    [bsc#1219823]
  * Preparing an NSEC3 closest encloser proof could cause excessive
    CPU load, leading to a denial-of-service condition. This has
    been fixed. (CVE-2023-50868)
    [bsc#1219826]
  * Parsing DNS messages with many different names could cause
    excessive CPU load. This has been fixed. (CVE-2023-4408)
    [bsc#1219851]
  * Specific queries could cause named to crash with an assertion
    failure when nxdomain-redirect was enabled. This has been
    fixed. (CVE-2023-5517)
    [bsc#1219852]
  * A bad interaction between DNS64 and serve-stale could cause
    named to crash with an assertion failure, when both of these
    features were enabled. This has been fixed. (CVE-2023-5679)
    [bsc#1219853]
  * Query patterns that continuously triggered cache database
    maintenance could cause an excessive amount of memory to be
    allocated, exceeding max-cache-size and potentially leading to
    all available memory on the host running named being exhausted.
    This has been fixed. (CVE-2023-6516)
    [bsc#1219854]
  Packaging notes:
  * libnghttps2 added as BuildRequires for tls support
  * named-bootconf.diff patch is obsolete and has been removed
  [jsc#PED-7932]
- Update KillMode to 'control-group' in named.service to handle
  forked processes better.
  [bsc#1215755]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1721908800">- Update to release 9.18.28
  Bug Fixes:
  * Command-line options for IPv4-only (named -4) and IPv6-only
    (named -6) modes are now respected for zone primaries,
    also-notify, and parental-agents.
  * An RPZ response’s SOA record TTL was set to 1 instead of the
    SOA TTL, if add-soa was used. This has been fixed.
  * When a query related to zone maintenance (NOTIFY, SOA) timed
    out close to a view shutdown (triggered e.g. by rndc reload),
    named could crash with an assertion failure. This has been
    fixed.
  * The statistics channel counters that indicated the number of
    currently connected TCP IPv4/IPv6 clients were not properly
    adjusted in certain failure scenarios. This has been fixed.
  * Some servers that could not be reached due to EHOSTDOWN or
    ENETDOWN conditions were incorrectly prioritized during server
    selection. These are now properly handled as unreachable.
  * On some systems the libuv call may return an error code when
    sending a TCP reset for a connection, which triggers an
    assertion failure in named. This error condition is now dealt
    with in a more graceful manner, by logging the incident and
    shutting down the connection.
  * Changes to listen-on statements were ignored on reconfiguration
    unless the port or interface address was changed, making it
    impossible to change a related listener transport type. That
    issue has been fixed.
  * A bug in the keymgr code unintentionally slowed down some
    DNSSEC key rollovers. This has been fixed.
  * Some ISO 8601 durations were accepted erroneously, leading to
    shorter durations than expected. This has been fixed
  * A regression in cache-cleaning code enabled memory use to grow
    significantly more quickly than before, until the configured
    max-cache-size limit was reached. This has been fixed.
  * Using rndc flush inadvertently caused cache cleaning to become
    less effective. This could ultimately lead to the configured
    max-cache-size limit being exceeded and has now been fixed.
  * The logic for cleaning up expired cached DNS records was
    tweaked to be more aggressive. This change helps with enforcing
    max-cache-ttl and max-ncache-ttl in a timely manner.
  * It was possible to trigger a use-after-free assertion when the
    overmem cache cleaning was initiated. This has been fixed.
  New Features:
  * A new option signatures-jitter has been added to dnssec-policy
    to allow signature expirations to be spread out over a period
    of time.
  * The statistics channel now includes counters that indicate the
    number of currently connected TCP IPv4/IPv6 clients.
  * Added RESOLVER.ARPA to the built in empty zones.
  Feature Changes:
  * DNSSEC signatures that are not valid because the current time
    falls outside the signature inception and expiration dates are
    skipped instead of causing an immediate validation failure.
  Security Fixes:
  * A malicious DNS client that sent many queries over TCP but
    never read the responses could cause a server to respond slowly
    or not at all for other clients. This has been fixed.
    (CVE-2024-0760)
    [bsc#1228255]
  * It is possible to craft excessively large resource records
    sets, which have the effect of slowing down database
    processing. This has been addressed by adding a configurable
    limit to the number of records that can be stored per name and
    type in a cache or zone database. The default is 100, which can
    be tuned with the new max-records-per-type option.
  * It is possible to craft excessively large numbers of resource
    record types for a given owner name, which has the effect of
    slowing down database processing. This has been addressed by
    adding a configurable limit to the number of records that can
    be stored per name and type in a cache or zone database. The
    default is 100, which can be tuned with the new
    max-types-per-name option. (CVE-2024-1737)
    [bsc#1228256]
  * Validating DNS messages signed using the SIG(0) protocol (RFC
    2931) could cause excessive CPU load, leading to a
    denial-of-service condition. Support for SIG(0) message
    validation was removed from this version of named.
    (CVE-2024-1975)
    [bsc#1228257]
  * Due to a logic error, lookups that triggered serving stale data
    and required lookups in local authoritative zone data could
    have resulted in an assertion failure. This has been fixed.
  * Potential data races were found in our DoH implementation,
    related to HTTP/2 session object management and endpoints set
    object management after reconfiguration. These issues have been
    fixed.
  * When looking up the NS records of parent zones as part of
    looking up DS records, it was possible for named to trigger an
    assertion failure if serve-stale was enabled. This has been
    fixed. (CVE-2024-4076)
    [bsc#1228258]</changelog>
</package>
<package pkgid="b88dda90f02191af188963ac2a9ddd9bfc4d706519104e67bd09e0c10f871d61" name="bind" arch="x86_64">
  <version epoch="0" ver="9.18.28" rel="150600.3.3.1"/>
  <changelog author="josef.moellers@suse.com" date="1657800000">- Update to release 9.16.31
  This is the first of monthly updates of "bind". It is planned
  to update bind when a new upstream maintennace release becomes
  available, which is usually towards the end of a month, see
  https://www.isc.org/blogs/2021-bind-release-model/
  Compared to the previous SUSE release, in this release,
  53 (minor) bugs were fixed
  13 (minor) functional enhancements were made
  3 security issues are now fixed upstream:
    CVE-2022-0396, CVE-2021-25220, CVE-2021-25219
  plus a few minor changes.
  For a full list of changes, please refer to the
  CHANGES file in the source rpm.
  This update obsoletes the following patches:
  * bind-fix-build-with-older-sphinx.patch
  * bind-CVE-2021-25219.patch
  * bind-9.16.27-0001-CVE-2021-25220.patch
  * bind-9.16.27-0002-CVE-2022-0396.patch
  [bind-9.16.31.tar.xz, bind-9.16.31.tar.xz.sha512.asc,
  bind-9.16.20.tar.xz, bind-9.16.20.tar.xz.sha512.asc,
  bind-fix-build-with-older-sphinx.patch, bind-CVE-2021-25219.patch,
  bind-9.16.27-0001-CVE-2021-25220.patch,
  bind-9.16.27-0002-CVE-2022-0396.patch,
  jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1661256000">- Update to release 9.16.32
  Feature Changes:
  * The DNSSEC algorithms RSASHA1 and NSEC3RSASHA1 are now automatically
  disabled on systems where they are disallowed by the security policy
  (e.g. Red Hat Enterprise Linux 9). Primary zones using those algorithms
  need to be migrated to new algorithms prior to running on these systems,
  as graceful migration to different DNSSEC algorithms is not possible when
  RSASHA1 is disallowed by the operating system.
  * Log messages related to fetch limiting have been improved to provide
  more complete information. Specifically, the final counts of allowed
  and spilled fetches are now logged before the counter object is destroyed.
  Bug Fixes:
  * Non-dynamic zones that inherit dnssec-policy from the view or options
  blocks were not marked as inline-signed and therefore never scheduled
  to be re-signed. This has been fixed.
  * The old max-zone-ttl zone option was meant to be superseded by
  the max-zone-ttl option in dnssec-policy; however, the latter option
  was not fully effective. This has been corrected: zones no longer load
  if they contain TTLs greater than the limit configured in dnssec-policy.
  For zones with both the old max-zone-ttl option and dnssec-policy
  configured, the old option is ignored, and a warning is generated.
  * rndc dumpdb -expired was fixed to include expired RRsets,
  even if stale-cache-enable is set to no and
  the cache-cleaning time window has passed.
  [bind-9.16.32.tar.xz, bind-9.16.32.tar.xz.sha512.asc,
  bind-9.16.31.tar.xz, bind-9.16.31.tar.xz.sha512.asc,
  bind.spec, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1662724800">- Include a modified createNamedConfInclude script again, as this
  broke compatability with existing configurations.
  A symlink for named.conf.include to /var/lib/named is created to
  allow for a read-only /etc directory.
  However it is still advised to change the existing configuration.
  See README-bind.chrootenv for a guide how to do this.
  [bsc#1203250, vendor-files/tools/createNamedConfInclude,
  vendor-files/docu/README-bind.chrootenv, bind.spec]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1662724801">- Add systemd drop-in directory for named service
  [bsc#1201689, bind.spec]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1663761600">- Update to release 9.16.33
  Security Fixes:
  * Previously, there was no limit to the number of database lookups
    performed while processing large delegations, which could be
    abused to severely impact the performance of named running as a
    recursive resolver. This has been fixed. (CVE-2022-2795)
  * named running as a resolver with the stale-answer-client-timeout
    option set to 0 could crash with an assertion failure, when
    there was a stale CNAME in the cache for the incoming query.
    This has been fixed. (CVE-2022-3080)
  * A memory leak was fixed that could be externally triggered in the
    DNSSEC verification code for the ECDSA algorithm. (CVE-2022-38177)
  * Memory leaks were fixed that could be externally triggered in the
    DNSSEC verification code for the EdDSA algorithm. (CVE-2022-38178)
  Feature Changes:
  * Response Rate Limiting (RRL) code now treats all QNAMEs that are
    subject to wildcard processing within a given zone as the same
    name, to prevent circumventing the limits enforced by RRL.
  * Zones using dnssec-policy now require dynamic DNS or
    inline-signing to be configured explicitly.
  * A backward-compatible approach was implemented for encoding
    internationalized domain names (IDN) in dig and converting the
    domain to IDNA2008 form; if that fails,
    BIND tries an IDNA2003 conversion.
  Bug Fixes:
  * A serve-stale bug was fixed, where BIND would try to return stale
    data from cache for lookups that received duplicate queries or
    queries that would be dropped. This bug resulted in premature
    SERVFAIL responses, and has now been resolved.
  [bsc#1203614, bsc#1203618, bsc#1203619, bsc#1203620, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1668168000">- Update to release 9.16.34
  New Features:
  * Support for parsing and validating the dohpath service
    parameter in SVCB records was added.
  * named now logs the supported cryptographic algorithms during
    startup and in the output of named -V.
  Bug Fixes:
  * Changing just the TSIG key names for primaries in catalog
    zones’ member zones was not effective. This has been fixed.
  Known Issues:
  * Upgrading from BIND 9.16.32 or any older version may require a
    manual configuration change. The following configurations are
    affected:
  - type primary zones configured with dnssec-policy but without
    either allow-update or update-policy,
  - type secondary zones configured with dnssec-policy.
    In these cases please add inline-signing yes; to the individual
    zone configuration(s). Without applying this change, named will
    fail to start. For more details, see
    https://kb.isc.org/docs/dnssec-policy-requires-dynamic-dns-or-inline-signing
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1669291200">- Update to release 9.16.35
  Bug Fixes:
  * A crash was fixed that happened when a dnssec-policy zone that
    used NSEC3 was reconfigured to enable inline-signing.
  * In certain resolution scenarios, quotas could be erroneously
    reached for servers, including any configured forwarders,
    resulting in SERVFAIL answers being sent to clients.
  * rpz-ip rules in response-policy zones could be ineffective in
    some cases if a query had the CD (Checking Disabled) bit set to
    1.
  * Previously, if Internet connectivity issues were experienced
    during the initial startup of named, a BIND resolver with
    dnssec-validation set to auto could enter into a state where it
    would not recover without stopping named, manually deleting the
    managed-keys.bind and managed-keys.bind.jnl files, and starting
    named again.
  * The statistics counter representing the current number of
    clients awaiting recursive resolution results (RecursClients)
    could overflow in certain resolution scenarios.
  * Previously, BIND failed to start on Solaris-based systems with
    hundreds of CPUs.
  * When a DNS resource record’s TTL value was equal to the
    resolver’s configured prefetch “eligibility” value, the record
    was erroneously not treated as eligible for prefetching.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1671710400">- Update to release 9.16.36
  Feature Changes:
  * The auto-dnssec option has been deprecated and will be removed
    in a future BIND 9.19.x release. Please migrate to
    dnssec-policy.
  Bug Fixes:
  * When a catalog zone was removed from the configuration, in some
    cases a dangling pointer could cause the named process to
    crash.
  * When a zone was deleted from a server, a key management object
    related to that zone was inadvertently kept in memory and only
    released upon shutdown. This could lead to constantly
    increasing memory use on servers with a high rate of changes
    affecting the set of zones being served.
  * In certain cases, named waited for the resolution of
    outstanding recursive queries to finish before shutting down.
  * The zone &lt;name&gt;/&lt;class&gt;: final reference detached log message
    was moved from the INFO log level to the DEBUG(1) log level to
    prevent the named-checkzone tool from superfluously logging
    this message in non-debug mode.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1674561600">- Update to release 9.16.37
  Security Fixes:
  * An UPDATE message flood could cause named to exhaust all
    available memory. This flaw was addressed by adding a new
    update-quota option that controls the maximum number of
    outstanding DNS UPDATE messages that named can hold in a queue
    at any given time (default: 100). (CVE-2022-3094)
  * named could crash with an assertion failure when an RRSIG query
    was received and stale-answer-client-timeout was set to a
    non-zero value. This has been fixed. (CVE-2022-3736)
  * named running as a resolver with the
    stale-answer-client-timeout option set to any value greater
    than 0 could crash with an assertion failure, when the
    recursive-clients soft quota was reached. This has been fixed.
    (CVE-2022-3924)
  New Features:
  * The new update-quota option can be used to control the number
    of simultaneous DNS UPDATE messages that can be processed to
    update an authoritative zone on a primary server, or forwarded
    to the primary server by a secondary server. The default is
    100. A new statistics counter has also been added to record
    events when this quota is exceeded, and the version numbers for
    the XML and JSON statistics schemas have been updated.
  Feature Changes:
  * The Differentiated Services Code Point (DSCP) feature in BIND
    has been deprecated. Configuring DSCP values in named.conf now
    causes a warning to be logged. Note that this feature has only
    been partly operational since the new Network Manager was
    introduced in BIND 9.16.0.
  * The catalog zone implementation has been optimized to work with
    hundreds of thousands of member zones.
  Bug Fixes:
  * In certain query resolution scenarios (e.g. when following
    CNAME records), named configured to answer from stale cache
    could return a SERVFAIL response despite a usable, non-stale
    answer being present in the cache. This has been fixed.
  [bsc#1207471, bsc#1207473, bsc#1207475, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1676548800">- Update to release 9.16.38
  Bug Fixes:
  * A constant stream of zone additions and deletions via rndc
    reconfig could cause increased memory consumption due to
    delayed cleaning of view memory. This has been fixed.
  * The speed of the message digest algorithms (MD5, SHA-1, SHA-2),
    and of NSEC3 hashing, has been improved.
  * Building BIND 9 failed when the --enable-dnsrps switch for
    ./configure was used. This has been fixed.
  [jsc#SLE-24600]
- Updated keyring and signature</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1678881600">- Update to release 9.16.39
  Feature Changes:
  * libuv support for receiving multiple UDP messages in a single
    recvmmsg() system call has been tweaked several times between
    libuv versions 1.35.0 and 1.40.0; the current recommended libuv
    version is 1.40.0 or higher. New rules are now in effect for
    running with a different version of libuv than the one used at
    compilation time. These rules may trigger a fatal error at
    startup:
  - Building against or running with libuv versions 1.35.0 and
    1.36.0 is now a fatal error.
  - Running with libuv version higher than 1.34.2 is now a
    fatal error when named is built against libuv version
    1.34.2 or lower.
  - Running with libuv version higher than 1.39.0 is now a
    fatal error when named is built against libuv version
    1.37.0, 1.38.0, 1.38.1, or 1.39.0.
  * This prevents the use of libuv versions that may trigger an
    assertion failure when receiving multiple UDP messages in a
    single system call.
  Bug Fixes:
  * named could crash with an assertion failure when adding a new
    zone into the configuration file for a name which was already
    configured as a member zone for a catalog zone. This has been
    fixed.
  * When named starts up, it sends a query for the DNSSEC key for
    each configured trust anchor to determine whether the key has
    changed. In some unusual cases, the query might depend on a
    zone for which the server is itself authoritative, and would
    have failed if it were sent before the zone was fully loaded.
    This has now been fixed by delaying the key queries until all
    zones have finished loading.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1682424000">- Update to release 9.16.40
  Bug Fixes:
  * Logfiles using timestamp-style suffixes were not always
    correctly removed when the number of files exceeded the limit
    set by versions. This has been fixed for configurations which
    do not explicitly specify a directory path as part of the file
    argument in the channel specification.
  * Performance of DNSSEC validation in zones with many DNSKEY
    records has been improved.</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1684324800">- Update to release 9.16.41
  Bug Fixes:
  * When removing delegations from an opt-out range,
    empty-non-terminal NSEC3 records generated by those delegations
    were not cleaned up. This has been fixed.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1687348800">- Update to release 9.16.42
  Security Fixes:
  * The overmem cleaning process has been improved, to prevent the
    cache from significantly exceeding the configured
    max-cache-size limit. (CVE-2023-2828)
  * A query that prioritizes stale data over lookup triggers a
    fetch to refresh the stale data in cache. If the fetch is
    aborted for exceeding the recursion quota, it was possible for
    named to enter an infinite callback loop and crash due to stack
    overflow. This has been fixed. (CVE-2023-2911)
  Bug Fixes:
  * Previously, it was possible for a delegation from cache to be
    returned to the client after the stale-answer-client-timeout
    duration. This has been fixed.
  [bsc#1212544, bsc#1212567, jsc#SLE-24600]</changelog>
  <changelog author="dmueller@suse.com" date="1688644800">- rebuild bind-utils on libuv updates (bsc#1212090)</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1688990400">- Log named-checkconf output [bsc#1213049]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1689076800">- Add dnstap support
  [jsc#PED-4852]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1695124800">- Update to release 9.16.44
  Bug Fixes:
  * Processing already-queued queries received over TCP could cause
    an assertion failure, when the server was reconfigured at the
    same time or the cache was being flushed. This has been fixed.
  Security Fixes:
  * Previously, sending a specially crafted message over the
    control channel could cause the packet-parsing code to run out
    of available stack memory, causing named to terminate
    unexpectedly. This has been fixed. (CVE-2023-3341)
  [bsc#1215472]
- Switch to pkgconfig(libprotobuf-c) since this now contains the
  required protobuf-c binary</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1708084800">- Update to new Major Version 9.18.24.
  This has many enhancements, bug fixes and changes.
  Breaking Changes:
  * Some options have been removed and some have been deprecated
    and will be removed in the future.
    For a complete list, see:
    https://kb.isc.org/docs/changes-to-be-aware-of-when-moving-from-bind-916-to-918
  Major Changes:
  * Support for securing DNS traffic using Transport Layer Security
    (TLS). TLS is used by both DNS-over-TLS (DoT) and
    DNS-over-HTTPS (DoH).
  * Support for zone transfers over TLS (XFR-over-TLS, XoT) for
    both incoming and outgoing zone transfers.
  * The dig tool is now able to send DoT queries (+tls option).
  * Support for OpenSSL 3.0 APIs was added.
  * dnssec-checkds, dnssec-coverage, dnssec-keymgr, which have been
    removed in favor of the dnssec-policy feature
  * python3-bind is deprecated and the subpackage has been removed
  * A number of utilities have been moved from /usr/sbin to
    /usr/bin:
    named-checkconf named-checkzone named-compilezone
    dnssec-dsfromkey dnssec-importkey dnssec-keyfromlabel
    dnssec-keygen dnssec-revoke dnssec-settime dnssec-signzone
    dnssec-verify dnssec-cds named-journalprint nsec3hash
  * The lib directory was renamed from 'named' to 'bind'
  For a complete list of changes, see:
  * Bind Release Notes
    https://bind9.readthedocs.io/en/v9.18.24/notes.html
  * The CHANGES file in the source RPM
  Security Fixes:
  * Validating DNS messages containing a lot of DNSSEC signatures
    could cause excessive CPU load, leading to a denial-of-service
    condition. This has been fixed. (CVE-2023-50387)
    [bsc#1219823]
  * Preparing an NSEC3 closest encloser proof could cause excessive
    CPU load, leading to a denial-of-service condition. This has
    been fixed. (CVE-2023-50868)
    [bsc#1219826]
  * Parsing DNS messages with many different names could cause
    excessive CPU load. This has been fixed. (CVE-2023-4408)
    [bsc#1219851]
  * Specific queries could cause named to crash with an assertion
    failure when nxdomain-redirect was enabled. This has been
    fixed. (CVE-2023-5517)
    [bsc#1219852]
  * A bad interaction between DNS64 and serve-stale could cause
    named to crash with an assertion failure, when both of these
    features were enabled. This has been fixed. (CVE-2023-5679)
    [bsc#1219853]
  * Query patterns that continuously triggered cache database
    maintenance could cause an excessive amount of memory to be
    allocated, exceeding max-cache-size and potentially leading to
    all available memory on the host running named being exhausted.
    This has been fixed. (CVE-2023-6516)
    [bsc#1219854]
  Packaging notes:
  * libnghttps2 added as BuildRequires for tls support
  * named-bootconf.diff patch is obsolete and has been removed
  [jsc#PED-7932]
- Update KillMode to 'control-group' in named.service to handle
  forked processes better.
  [bsc#1215755]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1721908800">- Update to release 9.18.28
  Bug Fixes:
  * Command-line options for IPv4-only (named -4) and IPv6-only
    (named -6) modes are now respected for zone primaries,
    also-notify, and parental-agents.
  * An RPZ response’s SOA record TTL was set to 1 instead of the
    SOA TTL, if add-soa was used. This has been fixed.
  * When a query related to zone maintenance (NOTIFY, SOA) timed
    out close to a view shutdown (triggered e.g. by rndc reload),
    named could crash with an assertion failure. This has been
    fixed.
  * The statistics channel counters that indicated the number of
    currently connected TCP IPv4/IPv6 clients were not properly
    adjusted in certain failure scenarios. This has been fixed.
  * Some servers that could not be reached due to EHOSTDOWN or
    ENETDOWN conditions were incorrectly prioritized during server
    selection. These are now properly handled as unreachable.
  * On some systems the libuv call may return an error code when
    sending a TCP reset for a connection, which triggers an
    assertion failure in named. This error condition is now dealt
    with in a more graceful manner, by logging the incident and
    shutting down the connection.
  * Changes to listen-on statements were ignored on reconfiguration
    unless the port or interface address was changed, making it
    impossible to change a related listener transport type. That
    issue has been fixed.
  * A bug in the keymgr code unintentionally slowed down some
    DNSSEC key rollovers. This has been fixed.
  * Some ISO 8601 durations were accepted erroneously, leading to
    shorter durations than expected. This has been fixed
  * A regression in cache-cleaning code enabled memory use to grow
    significantly more quickly than before, until the configured
    max-cache-size limit was reached. This has been fixed.
  * Using rndc flush inadvertently caused cache cleaning to become
    less effective. This could ultimately lead to the configured
    max-cache-size limit being exceeded and has now been fixed.
  * The logic for cleaning up expired cached DNS records was
    tweaked to be more aggressive. This change helps with enforcing
    max-cache-ttl and max-ncache-ttl in a timely manner.
  * It was possible to trigger a use-after-free assertion when the
    overmem cache cleaning was initiated. This has been fixed.
  New Features:
  * A new option signatures-jitter has been added to dnssec-policy
    to allow signature expirations to be spread out over a period
    of time.
  * The statistics channel now includes counters that indicate the
    number of currently connected TCP IPv4/IPv6 clients.
  * Added RESOLVER.ARPA to the built in empty zones.
  Feature Changes:
  * DNSSEC signatures that are not valid because the current time
    falls outside the signature inception and expiration dates are
    skipped instead of causing an immediate validation failure.
  Security Fixes:
  * A malicious DNS client that sent many queries over TCP but
    never read the responses could cause a server to respond slowly
    or not at all for other clients. This has been fixed.
    (CVE-2024-0760)
    [bsc#1228255]
  * It is possible to craft excessively large resource records
    sets, which have the effect of slowing down database
    processing. This has been addressed by adding a configurable
    limit to the number of records that can be stored per name and
    type in a cache or zone database. The default is 100, which can
    be tuned with the new max-records-per-type option.
  * It is possible to craft excessively large numbers of resource
    record types for a given owner name, which has the effect of
    slowing down database processing. This has been addressed by
    adding a configurable limit to the number of records that can
    be stored per name and type in a cache or zone database. The
    default is 100, which can be tuned with the new
    max-types-per-name option. (CVE-2024-1737)
    [bsc#1228256]
  * Validating DNS messages signed using the SIG(0) protocol (RFC
    2931) could cause excessive CPU load, leading to a
    denial-of-service condition. Support for SIG(0) message
    validation was removed from this version of named.
    (CVE-2024-1975)
    [bsc#1228257]
  * Due to a logic error, lookups that triggered serving stale data
    and required lookups in local authoritative zone data could
    have resulted in an assertion failure. This has been fixed.
  * Potential data races were found in our DoH implementation,
    related to HTTP/2 session object management and endpoints set
    object management after reconfiguration. These issues have been
    fixed.
  * When looking up the NS records of parent zones as part of
    looking up DS records, it was possible for named to trigger an
    assertion failure if serve-stale was enabled. This has been
    fixed. (CVE-2024-4076)
    [bsc#1228258]</changelog>
</package>
<package pkgid="c3a529a0bc2dd011a614b64092fa0b5b242ee3eeedf0f24dfab3582e0ba5e494" name="bind-doc" arch="noarch">
  <version epoch="0" ver="9.18.28" rel="150600.3.3.1"/>
  <changelog author="josef.moellers@suse.com" date="1657800000">- Update to release 9.16.31
  This is the first of monthly updates of "bind". It is planned
  to update bind when a new upstream maintennace release becomes
  available, which is usually towards the end of a month, see
  https://www.isc.org/blogs/2021-bind-release-model/
  Compared to the previous SUSE release, in this release,
  53 (minor) bugs were fixed
  13 (minor) functional enhancements were made
  3 security issues are now fixed upstream:
    CVE-2022-0396, CVE-2021-25220, CVE-2021-25219
  plus a few minor changes.
  For a full list of changes, please refer to the
  CHANGES file in the source rpm.
  This update obsoletes the following patches:
  * bind-fix-build-with-older-sphinx.patch
  * bind-CVE-2021-25219.patch
  * bind-9.16.27-0001-CVE-2021-25220.patch
  * bind-9.16.27-0002-CVE-2022-0396.patch
  [bind-9.16.31.tar.xz, bind-9.16.31.tar.xz.sha512.asc,
  bind-9.16.20.tar.xz, bind-9.16.20.tar.xz.sha512.asc,
  bind-fix-build-with-older-sphinx.patch, bind-CVE-2021-25219.patch,
  bind-9.16.27-0001-CVE-2021-25220.patch,
  bind-9.16.27-0002-CVE-2022-0396.patch,
  jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1661256000">- Update to release 9.16.32
  Feature Changes:
  * The DNSSEC algorithms RSASHA1 and NSEC3RSASHA1 are now automatically
  disabled on systems where they are disallowed by the security policy
  (e.g. Red Hat Enterprise Linux 9). Primary zones using those algorithms
  need to be migrated to new algorithms prior to running on these systems,
  as graceful migration to different DNSSEC algorithms is not possible when
  RSASHA1 is disallowed by the operating system.
  * Log messages related to fetch limiting have been improved to provide
  more complete information. Specifically, the final counts of allowed
  and spilled fetches are now logged before the counter object is destroyed.
  Bug Fixes:
  * Non-dynamic zones that inherit dnssec-policy from the view or options
  blocks were not marked as inline-signed and therefore never scheduled
  to be re-signed. This has been fixed.
  * The old max-zone-ttl zone option was meant to be superseded by
  the max-zone-ttl option in dnssec-policy; however, the latter option
  was not fully effective. This has been corrected: zones no longer load
  if they contain TTLs greater than the limit configured in dnssec-policy.
  For zones with both the old max-zone-ttl option and dnssec-policy
  configured, the old option is ignored, and a warning is generated.
  * rndc dumpdb -expired was fixed to include expired RRsets,
  even if stale-cache-enable is set to no and
  the cache-cleaning time window has passed.
  [bind-9.16.32.tar.xz, bind-9.16.32.tar.xz.sha512.asc,
  bind-9.16.31.tar.xz, bind-9.16.31.tar.xz.sha512.asc,
  bind.spec, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1662724800">- Include a modified createNamedConfInclude script again, as this
  broke compatability with existing configurations.
  A symlink for named.conf.include to /var/lib/named is created to
  allow for a read-only /etc directory.
  However it is still advised to change the existing configuration.
  See README-bind.chrootenv for a guide how to do this.
  [bsc#1203250, vendor-files/tools/createNamedConfInclude,
  vendor-files/docu/README-bind.chrootenv, bind.spec]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1662724801">- Add systemd drop-in directory for named service
  [bsc#1201689, bind.spec]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1663761600">- Update to release 9.16.33
  Security Fixes:
  * Previously, there was no limit to the number of database lookups
    performed while processing large delegations, which could be
    abused to severely impact the performance of named running as a
    recursive resolver. This has been fixed. (CVE-2022-2795)
  * named running as a resolver with the stale-answer-client-timeout
    option set to 0 could crash with an assertion failure, when
    there was a stale CNAME in the cache for the incoming query.
    This has been fixed. (CVE-2022-3080)
  * A memory leak was fixed that could be externally triggered in the
    DNSSEC verification code for the ECDSA algorithm. (CVE-2022-38177)
  * Memory leaks were fixed that could be externally triggered in the
    DNSSEC verification code for the EdDSA algorithm. (CVE-2022-38178)
  Feature Changes:
  * Response Rate Limiting (RRL) code now treats all QNAMEs that are
    subject to wildcard processing within a given zone as the same
    name, to prevent circumventing the limits enforced by RRL.
  * Zones using dnssec-policy now require dynamic DNS or
    inline-signing to be configured explicitly.
  * A backward-compatible approach was implemented for encoding
    internationalized domain names (IDN) in dig and converting the
    domain to IDNA2008 form; if that fails,
    BIND tries an IDNA2003 conversion.
  Bug Fixes:
  * A serve-stale bug was fixed, where BIND would try to return stale
    data from cache for lookups that received duplicate queries or
    queries that would be dropped. This bug resulted in premature
    SERVFAIL responses, and has now been resolved.
  [bsc#1203614, bsc#1203618, bsc#1203619, bsc#1203620, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1668168000">- Update to release 9.16.34
  New Features:
  * Support for parsing and validating the dohpath service
    parameter in SVCB records was added.
  * named now logs the supported cryptographic algorithms during
    startup and in the output of named -V.
  Bug Fixes:
  * Changing just the TSIG key names for primaries in catalog
    zones’ member zones was not effective. This has been fixed.
  Known Issues:
  * Upgrading from BIND 9.16.32 or any older version may require a
    manual configuration change. The following configurations are
    affected:
  - type primary zones configured with dnssec-policy but without
    either allow-update or update-policy,
  - type secondary zones configured with dnssec-policy.
    In these cases please add inline-signing yes; to the individual
    zone configuration(s). Without applying this change, named will
    fail to start. For more details, see
    https://kb.isc.org/docs/dnssec-policy-requires-dynamic-dns-or-inline-signing
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1669291200">- Update to release 9.16.35
  Bug Fixes:
  * A crash was fixed that happened when a dnssec-policy zone that
    used NSEC3 was reconfigured to enable inline-signing.
  * In certain resolution scenarios, quotas could be erroneously
    reached for servers, including any configured forwarders,
    resulting in SERVFAIL answers being sent to clients.
  * rpz-ip rules in response-policy zones could be ineffective in
    some cases if a query had the CD (Checking Disabled) bit set to
    1.
  * Previously, if Internet connectivity issues were experienced
    during the initial startup of named, a BIND resolver with
    dnssec-validation set to auto could enter into a state where it
    would not recover without stopping named, manually deleting the
    managed-keys.bind and managed-keys.bind.jnl files, and starting
    named again.
  * The statistics counter representing the current number of
    clients awaiting recursive resolution results (RecursClients)
    could overflow in certain resolution scenarios.
  * Previously, BIND failed to start on Solaris-based systems with
    hundreds of CPUs.
  * When a DNS resource record’s TTL value was equal to the
    resolver’s configured prefetch “eligibility” value, the record
    was erroneously not treated as eligible for prefetching.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1671710400">- Update to release 9.16.36
  Feature Changes:
  * The auto-dnssec option has been deprecated and will be removed
    in a future BIND 9.19.x release. Please migrate to
    dnssec-policy.
  Bug Fixes:
  * When a catalog zone was removed from the configuration, in some
    cases a dangling pointer could cause the named process to
    crash.
  * When a zone was deleted from a server, a key management object
    related to that zone was inadvertently kept in memory and only
    released upon shutdown. This could lead to constantly
    increasing memory use on servers with a high rate of changes
    affecting the set of zones being served.
  * In certain cases, named waited for the resolution of
    outstanding recursive queries to finish before shutting down.
  * The zone &lt;name&gt;/&lt;class&gt;: final reference detached log message
    was moved from the INFO log level to the DEBUG(1) log level to
    prevent the named-checkzone tool from superfluously logging
    this message in non-debug mode.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1674561600">- Update to release 9.16.37
  Security Fixes:
  * An UPDATE message flood could cause named to exhaust all
    available memory. This flaw was addressed by adding a new
    update-quota option that controls the maximum number of
    outstanding DNS UPDATE messages that named can hold in a queue
    at any given time (default: 100). (CVE-2022-3094)
  * named could crash with an assertion failure when an RRSIG query
    was received and stale-answer-client-timeout was set to a
    non-zero value. This has been fixed. (CVE-2022-3736)
  * named running as a resolver with the
    stale-answer-client-timeout option set to any value greater
    than 0 could crash with an assertion failure, when the
    recursive-clients soft quota was reached. This has been fixed.
    (CVE-2022-3924)
  New Features:
  * The new update-quota option can be used to control the number
    of simultaneous DNS UPDATE messages that can be processed to
    update an authoritative zone on a primary server, or forwarded
    to the primary server by a secondary server. The default is
    100. A new statistics counter has also been added to record
    events when this quota is exceeded, and the version numbers for
    the XML and JSON statistics schemas have been updated.
  Feature Changes:
  * The Differentiated Services Code Point (DSCP) feature in BIND
    has been deprecated. Configuring DSCP values in named.conf now
    causes a warning to be logged. Note that this feature has only
    been partly operational since the new Network Manager was
    introduced in BIND 9.16.0.
  * The catalog zone implementation has been optimized to work with
    hundreds of thousands of member zones.
  Bug Fixes:
  * In certain query resolution scenarios (e.g. when following
    CNAME records), named configured to answer from stale cache
    could return a SERVFAIL response despite a usable, non-stale
    answer being present in the cache. This has been fixed.
  [bsc#1207471, bsc#1207473, bsc#1207475, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1676548800">- Update to release 9.16.38
  Bug Fixes:
  * A constant stream of zone additions and deletions via rndc
    reconfig could cause increased memory consumption due to
    delayed cleaning of view memory. This has been fixed.
  * The speed of the message digest algorithms (MD5, SHA-1, SHA-2),
    and of NSEC3 hashing, has been improved.
  * Building BIND 9 failed when the --enable-dnsrps switch for
    ./configure was used. This has been fixed.
  [jsc#SLE-24600]
- Updated keyring and signature</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1678881600">- Update to release 9.16.39
  Feature Changes:
  * libuv support for receiving multiple UDP messages in a single
    recvmmsg() system call has been tweaked several times between
    libuv versions 1.35.0 and 1.40.0; the current recommended libuv
    version is 1.40.0 or higher. New rules are now in effect for
    running with a different version of libuv than the one used at
    compilation time. These rules may trigger a fatal error at
    startup:
  - Building against or running with libuv versions 1.35.0 and
    1.36.0 is now a fatal error.
  - Running with libuv version higher than 1.34.2 is now a
    fatal error when named is built against libuv version
    1.34.2 or lower.
  - Running with libuv version higher than 1.39.0 is now a
    fatal error when named is built against libuv version
    1.37.0, 1.38.0, 1.38.1, or 1.39.0.
  * This prevents the use of libuv versions that may trigger an
    assertion failure when receiving multiple UDP messages in a
    single system call.
  Bug Fixes:
  * named could crash with an assertion failure when adding a new
    zone into the configuration file for a name which was already
    configured as a member zone for a catalog zone. This has been
    fixed.
  * When named starts up, it sends a query for the DNSSEC key for
    each configured trust anchor to determine whether the key has
    changed. In some unusual cases, the query might depend on a
    zone for which the server is itself authoritative, and would
    have failed if it were sent before the zone was fully loaded.
    This has now been fixed by delaying the key queries until all
    zones have finished loading.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1682424000">- Update to release 9.16.40
  Bug Fixes:
  * Logfiles using timestamp-style suffixes were not always
    correctly removed when the number of files exceeded the limit
    set by versions. This has been fixed for configurations which
    do not explicitly specify a directory path as part of the file
    argument in the channel specification.
  * Performance of DNSSEC validation in zones with many DNSKEY
    records has been improved.</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1684324800">- Update to release 9.16.41
  Bug Fixes:
  * When removing delegations from an opt-out range,
    empty-non-terminal NSEC3 records generated by those delegations
    were not cleaned up. This has been fixed.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1687348800">- Update to release 9.16.42
  Security Fixes:
  * The overmem cleaning process has been improved, to prevent the
    cache from significantly exceeding the configured
    max-cache-size limit. (CVE-2023-2828)
  * A query that prioritizes stale data over lookup triggers a
    fetch to refresh the stale data in cache. If the fetch is
    aborted for exceeding the recursion quota, it was possible for
    named to enter an infinite callback loop and crash due to stack
    overflow. This has been fixed. (CVE-2023-2911)
  Bug Fixes:
  * Previously, it was possible for a delegation from cache to be
    returned to the client after the stale-answer-client-timeout
    duration. This has been fixed.
  [bsc#1212544, bsc#1212567, jsc#SLE-24600]</changelog>
  <changelog author="dmueller@suse.com" date="1688644800">- rebuild bind-utils on libuv updates (bsc#1212090)</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1688990400">- Log named-checkconf output [bsc#1213049]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1689076800">- Add dnstap support
  [jsc#PED-4852]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1695124800">- Update to release 9.16.44
  Bug Fixes:
  * Processing already-queued queries received over TCP could cause
    an assertion failure, when the server was reconfigured at the
    same time or the cache was being flushed. This has been fixed.
  Security Fixes:
  * Previously, sending a specially crafted message over the
    control channel could cause the packet-parsing code to run out
    of available stack memory, causing named to terminate
    unexpectedly. This has been fixed. (CVE-2023-3341)
  [bsc#1215472]
- Switch to pkgconfig(libprotobuf-c) since this now contains the
  required protobuf-c binary</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1708084800">- Update to new Major Version 9.18.24.
  This has many enhancements, bug fixes and changes.
  Breaking Changes:
  * Some options have been removed and some have been deprecated
    and will be removed in the future.
    For a complete list, see:
    https://kb.isc.org/docs/changes-to-be-aware-of-when-moving-from-bind-916-to-918
  Major Changes:
  * Support for securing DNS traffic using Transport Layer Security
    (TLS). TLS is used by both DNS-over-TLS (DoT) and
    DNS-over-HTTPS (DoH).
  * Support for zone transfers over TLS (XFR-over-TLS, XoT) for
    both incoming and outgoing zone transfers.
  * The dig tool is now able to send DoT queries (+tls option).
  * Support for OpenSSL 3.0 APIs was added.
  * dnssec-checkds, dnssec-coverage, dnssec-keymgr, which have been
    removed in favor of the dnssec-policy feature
  * python3-bind is deprecated and the subpackage has been removed
  * A number of utilities have been moved from /usr/sbin to
    /usr/bin:
    named-checkconf named-checkzone named-compilezone
    dnssec-dsfromkey dnssec-importkey dnssec-keyfromlabel
    dnssec-keygen dnssec-revoke dnssec-settime dnssec-signzone
    dnssec-verify dnssec-cds named-journalprint nsec3hash
  * The lib directory was renamed from 'named' to 'bind'
  For a complete list of changes, see:
  * Bind Release Notes
    https://bind9.readthedocs.io/en/v9.18.24/notes.html
  * The CHANGES file in the source RPM
  Security Fixes:
  * Validating DNS messages containing a lot of DNSSEC signatures
    could cause excessive CPU load, leading to a denial-of-service
    condition. This has been fixed. (CVE-2023-50387)
    [bsc#1219823]
  * Preparing an NSEC3 closest encloser proof could cause excessive
    CPU load, leading to a denial-of-service condition. This has
    been fixed. (CVE-2023-50868)
    [bsc#1219826]
  * Parsing DNS messages with many different names could cause
    excessive CPU load. This has been fixed. (CVE-2023-4408)
    [bsc#1219851]
  * Specific queries could cause named to crash with an assertion
    failure when nxdomain-redirect was enabled. This has been
    fixed. (CVE-2023-5517)
    [bsc#1219852]
  * A bad interaction between DNS64 and serve-stale could cause
    named to crash with an assertion failure, when both of these
    features were enabled. This has been fixed. (CVE-2023-5679)
    [bsc#1219853]
  * Query patterns that continuously triggered cache database
    maintenance could cause an excessive amount of memory to be
    allocated, exceeding max-cache-size and potentially leading to
    all available memory on the host running named being exhausted.
    This has been fixed. (CVE-2023-6516)
    [bsc#1219854]
  Packaging notes:
  * libnghttps2 added as BuildRequires for tls support
  * named-bootconf.diff patch is obsolete and has been removed
  [jsc#PED-7932]
- Update KillMode to 'control-group' in named.service to handle
  forked processes better.
  [bsc#1215755]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1721908800">- Update to release 9.18.28
  Bug Fixes:
  * Command-line options for IPv4-only (named -4) and IPv6-only
    (named -6) modes are now respected for zone primaries,
    also-notify, and parental-agents.
  * An RPZ response’s SOA record TTL was set to 1 instead of the
    SOA TTL, if add-soa was used. This has been fixed.
  * When a query related to zone maintenance (NOTIFY, SOA) timed
    out close to a view shutdown (triggered e.g. by rndc reload),
    named could crash with an assertion failure. This has been
    fixed.
  * The statistics channel counters that indicated the number of
    currently connected TCP IPv4/IPv6 clients were not properly
    adjusted in certain failure scenarios. This has been fixed.
  * Some servers that could not be reached due to EHOSTDOWN or
    ENETDOWN conditions were incorrectly prioritized during server
    selection. These are now properly handled as unreachable.
  * On some systems the libuv call may return an error code when
    sending a TCP reset for a connection, which triggers an
    assertion failure in named. This error condition is now dealt
    with in a more graceful manner, by logging the incident and
    shutting down the connection.
  * Changes to listen-on statements were ignored on reconfiguration
    unless the port or interface address was changed, making it
    impossible to change a related listener transport type. That
    issue has been fixed.
  * A bug in the keymgr code unintentionally slowed down some
    DNSSEC key rollovers. This has been fixed.
  * Some ISO 8601 durations were accepted erroneously, leading to
    shorter durations than expected. This has been fixed
  * A regression in cache-cleaning code enabled memory use to grow
    significantly more quickly than before, until the configured
    max-cache-size limit was reached. This has been fixed.
  * Using rndc flush inadvertently caused cache cleaning to become
    less effective. This could ultimately lead to the configured
    max-cache-size limit being exceeded and has now been fixed.
  * The logic for cleaning up expired cached DNS records was
    tweaked to be more aggressive. This change helps with enforcing
    max-cache-ttl and max-ncache-ttl in a timely manner.
  * It was possible to trigger a use-after-free assertion when the
    overmem cache cleaning was initiated. This has been fixed.
  New Features:
  * A new option signatures-jitter has been added to dnssec-policy
    to allow signature expirations to be spread out over a period
    of time.
  * The statistics channel now includes counters that indicate the
    number of currently connected TCP IPv4/IPv6 clients.
  * Added RESOLVER.ARPA to the built in empty zones.
  Feature Changes:
  * DNSSEC signatures that are not valid because the current time
    falls outside the signature inception and expiration dates are
    skipped instead of causing an immediate validation failure.
  Security Fixes:
  * A malicious DNS client that sent many queries over TCP but
    never read the responses could cause a server to respond slowly
    or not at all for other clients. This has been fixed.
    (CVE-2024-0760)
    [bsc#1228255]
  * It is possible to craft excessively large resource records
    sets, which have the effect of slowing down database
    processing. This has been addressed by adding a configurable
    limit to the number of records that can be stored per name and
    type in a cache or zone database. The default is 100, which can
    be tuned with the new max-records-per-type option.
  * It is possible to craft excessively large numbers of resource
    record types for a given owner name, which has the effect of
    slowing down database processing. This has been addressed by
    adding a configurable limit to the number of records that can
    be stored per name and type in a cache or zone database. The
    default is 100, which can be tuned with the new
    max-types-per-name option. (CVE-2024-1737)
    [bsc#1228256]
  * Validating DNS messages signed using the SIG(0) protocol (RFC
    2931) could cause excessive CPU load, leading to a
    denial-of-service condition. Support for SIG(0) message
    validation was removed from this version of named.
    (CVE-2024-1975)
    [bsc#1228257]
  * Due to a logic error, lookups that triggered serving stale data
    and required lookups in local authoritative zone data could
    have resulted in an assertion failure. This has been fixed.
  * Potential data races were found in our DoH implementation,
    related to HTTP/2 session object management and endpoints set
    object management after reconfiguration. These issues have been
    fixed.
  * When looking up the NS records of parent zones as part of
    looking up DS records, it was possible for named to trigger an
    assertion failure if serve-stale was enabled. This has been
    fixed. (CVE-2024-4076)
    [bsc#1228258]</changelog>
</package>
<package pkgid="827a3100d9b924ce63065cecf0b3a5f171956b74a40b2dee323e912d7ed48ed8" name="bind-utils" arch="aarch64">
  <version epoch="0" ver="9.18.28" rel="150600.3.3.1"/>
  <changelog author="josef.moellers@suse.com" date="1657800000">- Update to release 9.16.31
  This is the first of monthly updates of "bind". It is planned
  to update bind when a new upstream maintennace release becomes
  available, which is usually towards the end of a month, see
  https://www.isc.org/blogs/2021-bind-release-model/
  Compared to the previous SUSE release, in this release,
  53 (minor) bugs were fixed
  13 (minor) functional enhancements were made
  3 security issues are now fixed upstream:
    CVE-2022-0396, CVE-2021-25220, CVE-2021-25219
  plus a few minor changes.
  For a full list of changes, please refer to the
  CHANGES file in the source rpm.
  This update obsoletes the following patches:
  * bind-fix-build-with-older-sphinx.patch
  * bind-CVE-2021-25219.patch
  * bind-9.16.27-0001-CVE-2021-25220.patch
  * bind-9.16.27-0002-CVE-2022-0396.patch
  [bind-9.16.31.tar.xz, bind-9.16.31.tar.xz.sha512.asc,
  bind-9.16.20.tar.xz, bind-9.16.20.tar.xz.sha512.asc,
  bind-fix-build-with-older-sphinx.patch, bind-CVE-2021-25219.patch,
  bind-9.16.27-0001-CVE-2021-25220.patch,
  bind-9.16.27-0002-CVE-2022-0396.patch,
  jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1661256000">- Update to release 9.16.32
  Feature Changes:
  * The DNSSEC algorithms RSASHA1 and NSEC3RSASHA1 are now automatically
  disabled on systems where they are disallowed by the security policy
  (e.g. Red Hat Enterprise Linux 9). Primary zones using those algorithms
  need to be migrated to new algorithms prior to running on these systems,
  as graceful migration to different DNSSEC algorithms is not possible when
  RSASHA1 is disallowed by the operating system.
  * Log messages related to fetch limiting have been improved to provide
  more complete information. Specifically, the final counts of allowed
  and spilled fetches are now logged before the counter object is destroyed.
  Bug Fixes:
  * Non-dynamic zones that inherit dnssec-policy from the view or options
  blocks were not marked as inline-signed and therefore never scheduled
  to be re-signed. This has been fixed.
  * The old max-zone-ttl zone option was meant to be superseded by
  the max-zone-ttl option in dnssec-policy; however, the latter option
  was not fully effective. This has been corrected: zones no longer load
  if they contain TTLs greater than the limit configured in dnssec-policy.
  For zones with both the old max-zone-ttl option and dnssec-policy
  configured, the old option is ignored, and a warning is generated.
  * rndc dumpdb -expired was fixed to include expired RRsets,
  even if stale-cache-enable is set to no and
  the cache-cleaning time window has passed.
  [bind-9.16.32.tar.xz, bind-9.16.32.tar.xz.sha512.asc,
  bind-9.16.31.tar.xz, bind-9.16.31.tar.xz.sha512.asc,
  bind.spec, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1662724800">- Include a modified createNamedConfInclude script again, as this
  broke compatability with existing configurations.
  A symlink for named.conf.include to /var/lib/named is created to
  allow for a read-only /etc directory.
  However it is still advised to change the existing configuration.
  See README-bind.chrootenv for a guide how to do this.
  [bsc#1203250, vendor-files/tools/createNamedConfInclude,
  vendor-files/docu/README-bind.chrootenv, bind.spec]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1662724801">- Add systemd drop-in directory for named service
  [bsc#1201689, bind.spec]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1663761600">- Update to release 9.16.33
  Security Fixes:
  * Previously, there was no limit to the number of database lookups
    performed while processing large delegations, which could be
    abused to severely impact the performance of named running as a
    recursive resolver. This has been fixed. (CVE-2022-2795)
  * named running as a resolver with the stale-answer-client-timeout
    option set to 0 could crash with an assertion failure, when
    there was a stale CNAME in the cache for the incoming query.
    This has been fixed. (CVE-2022-3080)
  * A memory leak was fixed that could be externally triggered in the
    DNSSEC verification code for the ECDSA algorithm. (CVE-2022-38177)
  * Memory leaks were fixed that could be externally triggered in the
    DNSSEC verification code for the EdDSA algorithm. (CVE-2022-38178)
  Feature Changes:
  * Response Rate Limiting (RRL) code now treats all QNAMEs that are
    subject to wildcard processing within a given zone as the same
    name, to prevent circumventing the limits enforced by RRL.
  * Zones using dnssec-policy now require dynamic DNS or
    inline-signing to be configured explicitly.
  * A backward-compatible approach was implemented for encoding
    internationalized domain names (IDN) in dig and converting the
    domain to IDNA2008 form; if that fails,
    BIND tries an IDNA2003 conversion.
  Bug Fixes:
  * A serve-stale bug was fixed, where BIND would try to return stale
    data from cache for lookups that received duplicate queries or
    queries that would be dropped. This bug resulted in premature
    SERVFAIL responses, and has now been resolved.
  [bsc#1203614, bsc#1203618, bsc#1203619, bsc#1203620, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1668168000">- Update to release 9.16.34
  New Features:
  * Support for parsing and validating the dohpath service
    parameter in SVCB records was added.
  * named now logs the supported cryptographic algorithms during
    startup and in the output of named -V.
  Bug Fixes:
  * Changing just the TSIG key names for primaries in catalog
    zones’ member zones was not effective. This has been fixed.
  Known Issues:
  * Upgrading from BIND 9.16.32 or any older version may require a
    manual configuration change. The following configurations are
    affected:
  - type primary zones configured with dnssec-policy but without
    either allow-update or update-policy,
  - type secondary zones configured with dnssec-policy.
    In these cases please add inline-signing yes; to the individual
    zone configuration(s). Without applying this change, named will
    fail to start. For more details, see
    https://kb.isc.org/docs/dnssec-policy-requires-dynamic-dns-or-inline-signing
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1669291200">- Update to release 9.16.35
  Bug Fixes:
  * A crash was fixed that happened when a dnssec-policy zone that
    used NSEC3 was reconfigured to enable inline-signing.
  * In certain resolution scenarios, quotas could be erroneously
    reached for servers, including any configured forwarders,
    resulting in SERVFAIL answers being sent to clients.
  * rpz-ip rules in response-policy zones could be ineffective in
    some cases if a query had the CD (Checking Disabled) bit set to
    1.
  * Previously, if Internet connectivity issues were experienced
    during the initial startup of named, a BIND resolver with
    dnssec-validation set to auto could enter into a state where it
    would not recover without stopping named, manually deleting the
    managed-keys.bind and managed-keys.bind.jnl files, and starting
    named again.
  * The statistics counter representing the current number of
    clients awaiting recursive resolution results (RecursClients)
    could overflow in certain resolution scenarios.
  * Previously, BIND failed to start on Solaris-based systems with
    hundreds of CPUs.
  * When a DNS resource record’s TTL value was equal to the
    resolver’s configured prefetch “eligibility” value, the record
    was erroneously not treated as eligible for prefetching.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1671710400">- Update to release 9.16.36
  Feature Changes:
  * The auto-dnssec option has been deprecated and will be removed
    in a future BIND 9.19.x release. Please migrate to
    dnssec-policy.
  Bug Fixes:
  * When a catalog zone was removed from the configuration, in some
    cases a dangling pointer could cause the named process to
    crash.
  * When a zone was deleted from a server, a key management object
    related to that zone was inadvertently kept in memory and only
    released upon shutdown. This could lead to constantly
    increasing memory use on servers with a high rate of changes
    affecting the set of zones being served.
  * In certain cases, named waited for the resolution of
    outstanding recursive queries to finish before shutting down.
  * The zone &lt;name&gt;/&lt;class&gt;: final reference detached log message
    was moved from the INFO log level to the DEBUG(1) log level to
    prevent the named-checkzone tool from superfluously logging
    this message in non-debug mode.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1674561600">- Update to release 9.16.37
  Security Fixes:
  * An UPDATE message flood could cause named to exhaust all
    available memory. This flaw was addressed by adding a new
    update-quota option that controls the maximum number of
    outstanding DNS UPDATE messages that named can hold in a queue
    at any given time (default: 100). (CVE-2022-3094)
  * named could crash with an assertion failure when an RRSIG query
    was received and stale-answer-client-timeout was set to a
    non-zero value. This has been fixed. (CVE-2022-3736)
  * named running as a resolver with the
    stale-answer-client-timeout option set to any value greater
    than 0 could crash with an assertion failure, when the
    recursive-clients soft quota was reached. This has been fixed.
    (CVE-2022-3924)
  New Features:
  * The new update-quota option can be used to control the number
    of simultaneous DNS UPDATE messages that can be processed to
    update an authoritative zone on a primary server, or forwarded
    to the primary server by a secondary server. The default is
    100. A new statistics counter has also been added to record
    events when this quota is exceeded, and the version numbers for
    the XML and JSON statistics schemas have been updated.
  Feature Changes:
  * The Differentiated Services Code Point (DSCP) feature in BIND
    has been deprecated. Configuring DSCP values in named.conf now
    causes a warning to be logged. Note that this feature has only
    been partly operational since the new Network Manager was
    introduced in BIND 9.16.0.
  * The catalog zone implementation has been optimized to work with
    hundreds of thousands of member zones.
  Bug Fixes:
  * In certain query resolution scenarios (e.g. when following
    CNAME records), named configured to answer from stale cache
    could return a SERVFAIL response despite a usable, non-stale
    answer being present in the cache. This has been fixed.
  [bsc#1207471, bsc#1207473, bsc#1207475, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1676548800">- Update to release 9.16.38
  Bug Fixes:
  * A constant stream of zone additions and deletions via rndc
    reconfig could cause increased memory consumption due to
    delayed cleaning of view memory. This has been fixed.
  * The speed of the message digest algorithms (MD5, SHA-1, SHA-2),
    and of NSEC3 hashing, has been improved.
  * Building BIND 9 failed when the --enable-dnsrps switch for
    ./configure was used. This has been fixed.
  [jsc#SLE-24600]
- Updated keyring and signature</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1678881600">- Update to release 9.16.39
  Feature Changes:
  * libuv support for receiving multiple UDP messages in a single
    recvmmsg() system call has been tweaked several times between
    libuv versions 1.35.0 and 1.40.0; the current recommended libuv
    version is 1.40.0 or higher. New rules are now in effect for
    running with a different version of libuv than the one used at
    compilation time. These rules may trigger a fatal error at
    startup:
  - Building against or running with libuv versions 1.35.0 and
    1.36.0 is now a fatal error.
  - Running with libuv version higher than 1.34.2 is now a
    fatal error when named is built against libuv version
    1.34.2 or lower.
  - Running with libuv version higher than 1.39.0 is now a
    fatal error when named is built against libuv version
    1.37.0, 1.38.0, 1.38.1, or 1.39.0.
  * This prevents the use of libuv versions that may trigger an
    assertion failure when receiving multiple UDP messages in a
    single system call.
  Bug Fixes:
  * named could crash with an assertion failure when adding a new
    zone into the configuration file for a name which was already
    configured as a member zone for a catalog zone. This has been
    fixed.
  * When named starts up, it sends a query for the DNSSEC key for
    each configured trust anchor to determine whether the key has
    changed. In some unusual cases, the query might depend on a
    zone for which the server is itself authoritative, and would
    have failed if it were sent before the zone was fully loaded.
    This has now been fixed by delaying the key queries until all
    zones have finished loading.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1682424000">- Update to release 9.16.40
  Bug Fixes:
  * Logfiles using timestamp-style suffixes were not always
    correctly removed when the number of files exceeded the limit
    set by versions. This has been fixed for configurations which
    do not explicitly specify a directory path as part of the file
    argument in the channel specification.
  * Performance of DNSSEC validation in zones with many DNSKEY
    records has been improved.</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1684324800">- Update to release 9.16.41
  Bug Fixes:
  * When removing delegations from an opt-out range,
    empty-non-terminal NSEC3 records generated by those delegations
    were not cleaned up. This has been fixed.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1687348800">- Update to release 9.16.42
  Security Fixes:
  * The overmem cleaning process has been improved, to prevent the
    cache from significantly exceeding the configured
    max-cache-size limit. (CVE-2023-2828)
  * A query that prioritizes stale data over lookup triggers a
    fetch to refresh the stale data in cache. If the fetch is
    aborted for exceeding the recursion quota, it was possible for
    named to enter an infinite callback loop and crash due to stack
    overflow. This has been fixed. (CVE-2023-2911)
  Bug Fixes:
  * Previously, it was possible for a delegation from cache to be
    returned to the client after the stale-answer-client-timeout
    duration. This has been fixed.
  [bsc#1212544, bsc#1212567, jsc#SLE-24600]</changelog>
  <changelog author="dmueller@suse.com" date="1688644800">- rebuild bind-utils on libuv updates (bsc#1212090)</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1688990400">- Log named-checkconf output [bsc#1213049]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1689076800">- Add dnstap support
  [jsc#PED-4852]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1695124800">- Update to release 9.16.44
  Bug Fixes:
  * Processing already-queued queries received over TCP could cause
    an assertion failure, when the server was reconfigured at the
    same time or the cache was being flushed. This has been fixed.
  Security Fixes:
  * Previously, sending a specially crafted message over the
    control channel could cause the packet-parsing code to run out
    of available stack memory, causing named to terminate
    unexpectedly. This has been fixed. (CVE-2023-3341)
  [bsc#1215472]
- Switch to pkgconfig(libprotobuf-c) since this now contains the
  required protobuf-c binary</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1708084800">- Update to new Major Version 9.18.24.
  This has many enhancements, bug fixes and changes.
  Breaking Changes:
  * Some options have been removed and some have been deprecated
    and will be removed in the future.
    For a complete list, see:
    https://kb.isc.org/docs/changes-to-be-aware-of-when-moving-from-bind-916-to-918
  Major Changes:
  * Support for securing DNS traffic using Transport Layer Security
    (TLS). TLS is used by both DNS-over-TLS (DoT) and
    DNS-over-HTTPS (DoH).
  * Support for zone transfers over TLS (XFR-over-TLS, XoT) for
    both incoming and outgoing zone transfers.
  * The dig tool is now able to send DoT queries (+tls option).
  * Support for OpenSSL 3.0 APIs was added.
  * dnssec-checkds, dnssec-coverage, dnssec-keymgr, which have been
    removed in favor of the dnssec-policy feature
  * python3-bind is deprecated and the subpackage has been removed
  * A number of utilities have been moved from /usr/sbin to
    /usr/bin:
    named-checkconf named-checkzone named-compilezone
    dnssec-dsfromkey dnssec-importkey dnssec-keyfromlabel
    dnssec-keygen dnssec-revoke dnssec-settime dnssec-signzone
    dnssec-verify dnssec-cds named-journalprint nsec3hash
  * The lib directory was renamed from 'named' to 'bind'
  For a complete list of changes, see:
  * Bind Release Notes
    https://bind9.readthedocs.io/en/v9.18.24/notes.html
  * The CHANGES file in the source RPM
  Security Fixes:
  * Validating DNS messages containing a lot of DNSSEC signatures
    could cause excessive CPU load, leading to a denial-of-service
    condition. This has been fixed. (CVE-2023-50387)
    [bsc#1219823]
  * Preparing an NSEC3 closest encloser proof could cause excessive
    CPU load, leading to a denial-of-service condition. This has
    been fixed. (CVE-2023-50868)
    [bsc#1219826]
  * Parsing DNS messages with many different names could cause
    excessive CPU load. This has been fixed. (CVE-2023-4408)
    [bsc#1219851]
  * Specific queries could cause named to crash with an assertion
    failure when nxdomain-redirect was enabled. This has been
    fixed. (CVE-2023-5517)
    [bsc#1219852]
  * A bad interaction between DNS64 and serve-stale could cause
    named to crash with an assertion failure, when both of these
    features were enabled. This has been fixed. (CVE-2023-5679)
    [bsc#1219853]
  * Query patterns that continuously triggered cache database
    maintenance could cause an excessive amount of memory to be
    allocated, exceeding max-cache-size and potentially leading to
    all available memory on the host running named being exhausted.
    This has been fixed. (CVE-2023-6516)
    [bsc#1219854]
  Packaging notes:
  * libnghttps2 added as BuildRequires for tls support
  * named-bootconf.diff patch is obsolete and has been removed
  [jsc#PED-7932]
- Update KillMode to 'control-group' in named.service to handle
  forked processes better.
  [bsc#1215755]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1721908800">- Update to release 9.18.28
  Bug Fixes:
  * Command-line options for IPv4-only (named -4) and IPv6-only
    (named -6) modes are now respected for zone primaries,
    also-notify, and parental-agents.
  * An RPZ response’s SOA record TTL was set to 1 instead of the
    SOA TTL, if add-soa was used. This has been fixed.
  * When a query related to zone maintenance (NOTIFY, SOA) timed
    out close to a view shutdown (triggered e.g. by rndc reload),
    named could crash with an assertion failure. This has been
    fixed.
  * The statistics channel counters that indicated the number of
    currently connected TCP IPv4/IPv6 clients were not properly
    adjusted in certain failure scenarios. This has been fixed.
  * Some servers that could not be reached due to EHOSTDOWN or
    ENETDOWN conditions were incorrectly prioritized during server
    selection. These are now properly handled as unreachable.
  * On some systems the libuv call may return an error code when
    sending a TCP reset for a connection, which triggers an
    assertion failure in named. This error condition is now dealt
    with in a more graceful manner, by logging the incident and
    shutting down the connection.
  * Changes to listen-on statements were ignored on reconfiguration
    unless the port or interface address was changed, making it
    impossible to change a related listener transport type. That
    issue has been fixed.
  * A bug in the keymgr code unintentionally slowed down some
    DNSSEC key rollovers. This has been fixed.
  * Some ISO 8601 durations were accepted erroneously, leading to
    shorter durations than expected. This has been fixed
  * A regression in cache-cleaning code enabled memory use to grow
    significantly more quickly than before, until the configured
    max-cache-size limit was reached. This has been fixed.
  * Using rndc flush inadvertently caused cache cleaning to become
    less effective. This could ultimately lead to the configured
    max-cache-size limit being exceeded and has now been fixed.
  * The logic for cleaning up expired cached DNS records was
    tweaked to be more aggressive. This change helps with enforcing
    max-cache-ttl and max-ncache-ttl in a timely manner.
  * It was possible to trigger a use-after-free assertion when the
    overmem cache cleaning was initiated. This has been fixed.
  New Features:
  * A new option signatures-jitter has been added to dnssec-policy
    to allow signature expirations to be spread out over a period
    of time.
  * The statistics channel now includes counters that indicate the
    number of currently connected TCP IPv4/IPv6 clients.
  * Added RESOLVER.ARPA to the built in empty zones.
  Feature Changes:
  * DNSSEC signatures that are not valid because the current time
    falls outside the signature inception and expiration dates are
    skipped instead of causing an immediate validation failure.
  Security Fixes:
  * A malicious DNS client that sent many queries over TCP but
    never read the responses could cause a server to respond slowly
    or not at all for other clients. This has been fixed.
    (CVE-2024-0760)
    [bsc#1228255]
  * It is possible to craft excessively large resource records
    sets, which have the effect of slowing down database
    processing. This has been addressed by adding a configurable
    limit to the number of records that can be stored per name and
    type in a cache or zone database. The default is 100, which can
    be tuned with the new max-records-per-type option.
  * It is possible to craft excessively large numbers of resource
    record types for a given owner name, which has the effect of
    slowing down database processing. This has been addressed by
    adding a configurable limit to the number of records that can
    be stored per name and type in a cache or zone database. The
    default is 100, which can be tuned with the new
    max-types-per-name option. (CVE-2024-1737)
    [bsc#1228256]
  * Validating DNS messages signed using the SIG(0) protocol (RFC
    2931) could cause excessive CPU load, leading to a
    denial-of-service condition. Support for SIG(0) message
    validation was removed from this version of named.
    (CVE-2024-1975)
    [bsc#1228257]
  * Due to a logic error, lookups that triggered serving stale data
    and required lookups in local authoritative zone data could
    have resulted in an assertion failure. This has been fixed.
  * Potential data races were found in our DoH implementation,
    related to HTTP/2 session object management and endpoints set
    object management after reconfiguration. These issues have been
    fixed.
  * When looking up the NS records of parent zones as part of
    looking up DS records, it was possible for named to trigger an
    assertion failure if serve-stale was enabled. This has been
    fixed. (CVE-2024-4076)
    [bsc#1228258]</changelog>
</package>
<package pkgid="e60874fe527fbefa4c5bb8cd218b131b70ae7c1345f1c202bcd81d9950ce7187" name="bind-utils" arch="ppc64le">
  <version epoch="0" ver="9.18.28" rel="150600.3.3.1"/>
  <changelog author="josef.moellers@suse.com" date="1657800000">- Update to release 9.16.31
  This is the first of monthly updates of "bind". It is planned
  to update bind when a new upstream maintennace release becomes
  available, which is usually towards the end of a month, see
  https://www.isc.org/blogs/2021-bind-release-model/
  Compared to the previous SUSE release, in this release,
  53 (minor) bugs were fixed
  13 (minor) functional enhancements were made
  3 security issues are now fixed upstream:
    CVE-2022-0396, CVE-2021-25220, CVE-2021-25219
  plus a few minor changes.
  For a full list of changes, please refer to the
  CHANGES file in the source rpm.
  This update obsoletes the following patches:
  * bind-fix-build-with-older-sphinx.patch
  * bind-CVE-2021-25219.patch
  * bind-9.16.27-0001-CVE-2021-25220.patch
  * bind-9.16.27-0002-CVE-2022-0396.patch
  [bind-9.16.31.tar.xz, bind-9.16.31.tar.xz.sha512.asc,
  bind-9.16.20.tar.xz, bind-9.16.20.tar.xz.sha512.asc,
  bind-fix-build-with-older-sphinx.patch, bind-CVE-2021-25219.patch,
  bind-9.16.27-0001-CVE-2021-25220.patch,
  bind-9.16.27-0002-CVE-2022-0396.patch,
  jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1661256000">- Update to release 9.16.32
  Feature Changes:
  * The DNSSEC algorithms RSASHA1 and NSEC3RSASHA1 are now automatically
  disabled on systems where they are disallowed by the security policy
  (e.g. Red Hat Enterprise Linux 9). Primary zones using those algorithms
  need to be migrated to new algorithms prior to running on these systems,
  as graceful migration to different DNSSEC algorithms is not possible when
  RSASHA1 is disallowed by the operating system.
  * Log messages related to fetch limiting have been improved to provide
  more complete information. Specifically, the final counts of allowed
  and spilled fetches are now logged before the counter object is destroyed.
  Bug Fixes:
  * Non-dynamic zones that inherit dnssec-policy from the view or options
  blocks were not marked as inline-signed and therefore never scheduled
  to be re-signed. This has been fixed.
  * The old max-zone-ttl zone option was meant to be superseded by
  the max-zone-ttl option in dnssec-policy; however, the latter option
  was not fully effective. This has been corrected: zones no longer load
  if they contain TTLs greater than the limit configured in dnssec-policy.
  For zones with both the old max-zone-ttl option and dnssec-policy
  configured, the old option is ignored, and a warning is generated.
  * rndc dumpdb -expired was fixed to include expired RRsets,
  even if stale-cache-enable is set to no and
  the cache-cleaning time window has passed.
  [bind-9.16.32.tar.xz, bind-9.16.32.tar.xz.sha512.asc,
  bind-9.16.31.tar.xz, bind-9.16.31.tar.xz.sha512.asc,
  bind.spec, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1662724800">- Include a modified createNamedConfInclude script again, as this
  broke compatability with existing configurations.
  A symlink for named.conf.include to /var/lib/named is created to
  allow for a read-only /etc directory.
  However it is still advised to change the existing configuration.
  See README-bind.chrootenv for a guide how to do this.
  [bsc#1203250, vendor-files/tools/createNamedConfInclude,
  vendor-files/docu/README-bind.chrootenv, bind.spec]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1662724801">- Add systemd drop-in directory for named service
  [bsc#1201689, bind.spec]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1663761600">- Update to release 9.16.33
  Security Fixes:
  * Previously, there was no limit to the number of database lookups
    performed while processing large delegations, which could be
    abused to severely impact the performance of named running as a
    recursive resolver. This has been fixed. (CVE-2022-2795)
  * named running as a resolver with the stale-answer-client-timeout
    option set to 0 could crash with an assertion failure, when
    there was a stale CNAME in the cache for the incoming query.
    This has been fixed. (CVE-2022-3080)
  * A memory leak was fixed that could be externally triggered in the
    DNSSEC verification code for the ECDSA algorithm. (CVE-2022-38177)
  * Memory leaks were fixed that could be externally triggered in the
    DNSSEC verification code for the EdDSA algorithm. (CVE-2022-38178)
  Feature Changes:
  * Response Rate Limiting (RRL) code now treats all QNAMEs that are
    subject to wildcard processing within a given zone as the same
    name, to prevent circumventing the limits enforced by RRL.
  * Zones using dnssec-policy now require dynamic DNS or
    inline-signing to be configured explicitly.
  * A backward-compatible approach was implemented for encoding
    internationalized domain names (IDN) in dig and converting the
    domain to IDNA2008 form; if that fails,
    BIND tries an IDNA2003 conversion.
  Bug Fixes:
  * A serve-stale bug was fixed, where BIND would try to return stale
    data from cache for lookups that received duplicate queries or
    queries that would be dropped. This bug resulted in premature
    SERVFAIL responses, and has now been resolved.
  [bsc#1203614, bsc#1203618, bsc#1203619, bsc#1203620, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1668168000">- Update to release 9.16.34
  New Features:
  * Support for parsing and validating the dohpath service
    parameter in SVCB records was added.
  * named now logs the supported cryptographic algorithms during
    startup and in the output of named -V.
  Bug Fixes:
  * Changing just the TSIG key names for primaries in catalog
    zones’ member zones was not effective. This has been fixed.
  Known Issues:
  * Upgrading from BIND 9.16.32 or any older version may require a
    manual configuration change. The following configurations are
    affected:
  - type primary zones configured with dnssec-policy but without
    either allow-update or update-policy,
  - type secondary zones configured with dnssec-policy.
    In these cases please add inline-signing yes; to the individual
    zone configuration(s). Without applying this change, named will
    fail to start. For more details, see
    https://kb.isc.org/docs/dnssec-policy-requires-dynamic-dns-or-inline-signing
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1669291200">- Update to release 9.16.35
  Bug Fixes:
  * A crash was fixed that happened when a dnssec-policy zone that
    used NSEC3 was reconfigured to enable inline-signing.
  * In certain resolution scenarios, quotas could be erroneously
    reached for servers, including any configured forwarders,
    resulting in SERVFAIL answers being sent to clients.
  * rpz-ip rules in response-policy zones could be ineffective in
    some cases if a query had the CD (Checking Disabled) bit set to
    1.
  * Previously, if Internet connectivity issues were experienced
    during the initial startup of named, a BIND resolver with
    dnssec-validation set to auto could enter into a state where it
    would not recover without stopping named, manually deleting the
    managed-keys.bind and managed-keys.bind.jnl files, and starting
    named again.
  * The statistics counter representing the current number of
    clients awaiting recursive resolution results (RecursClients)
    could overflow in certain resolution scenarios.
  * Previously, BIND failed to start on Solaris-based systems with
    hundreds of CPUs.
  * When a DNS resource record’s TTL value was equal to the
    resolver’s configured prefetch “eligibility” value, the record
    was erroneously not treated as eligible for prefetching.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1671710400">- Update to release 9.16.36
  Feature Changes:
  * The auto-dnssec option has been deprecated and will be removed
    in a future BIND 9.19.x release. Please migrate to
    dnssec-policy.
  Bug Fixes:
  * When a catalog zone was removed from the configuration, in some
    cases a dangling pointer could cause the named process to
    crash.
  * When a zone was deleted from a server, a key management object
    related to that zone was inadvertently kept in memory and only
    released upon shutdown. This could lead to constantly
    increasing memory use on servers with a high rate of changes
    affecting the set of zones being served.
  * In certain cases, named waited for the resolution of
    outstanding recursive queries to finish before shutting down.
  * The zone &lt;name&gt;/&lt;class&gt;: final reference detached log message
    was moved from the INFO log level to the DEBUG(1) log level to
    prevent the named-checkzone tool from superfluously logging
    this message in non-debug mode.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1674561600">- Update to release 9.16.37
  Security Fixes:
  * An UPDATE message flood could cause named to exhaust all
    available memory. This flaw was addressed by adding a new
    update-quota option that controls the maximum number of
    outstanding DNS UPDATE messages that named can hold in a queue
    at any given time (default: 100). (CVE-2022-3094)
  * named could crash with an assertion failure when an RRSIG query
    was received and stale-answer-client-timeout was set to a
    non-zero value. This has been fixed. (CVE-2022-3736)
  * named running as a resolver with the
    stale-answer-client-timeout option set to any value greater
    than 0 could crash with an assertion failure, when the
    recursive-clients soft quota was reached. This has been fixed.
    (CVE-2022-3924)
  New Features:
  * The new update-quota option can be used to control the number
    of simultaneous DNS UPDATE messages that can be processed to
    update an authoritative zone on a primary server, or forwarded
    to the primary server by a secondary server. The default is
    100. A new statistics counter has also been added to record
    events when this quota is exceeded, and the version numbers for
    the XML and JSON statistics schemas have been updated.
  Feature Changes:
  * The Differentiated Services Code Point (DSCP) feature in BIND
    has been deprecated. Configuring DSCP values in named.conf now
    causes a warning to be logged. Note that this feature has only
    been partly operational since the new Network Manager was
    introduced in BIND 9.16.0.
  * The catalog zone implementation has been optimized to work with
    hundreds of thousands of member zones.
  Bug Fixes:
  * In certain query resolution scenarios (e.g. when following
    CNAME records), named configured to answer from stale cache
    could return a SERVFAIL response despite a usable, non-stale
    answer being present in the cache. This has been fixed.
  [bsc#1207471, bsc#1207473, bsc#1207475, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1676548800">- Update to release 9.16.38
  Bug Fixes:
  * A constant stream of zone additions and deletions via rndc
    reconfig could cause increased memory consumption due to
    delayed cleaning of view memory. This has been fixed.
  * The speed of the message digest algorithms (MD5, SHA-1, SHA-2),
    and of NSEC3 hashing, has been improved.
  * Building BIND 9 failed when the --enable-dnsrps switch for
    ./configure was used. This has been fixed.
  [jsc#SLE-24600]
- Updated keyring and signature</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1678881600">- Update to release 9.16.39
  Feature Changes:
  * libuv support for receiving multiple UDP messages in a single
    recvmmsg() system call has been tweaked several times between
    libuv versions 1.35.0 and 1.40.0; the current recommended libuv
    version is 1.40.0 or higher. New rules are now in effect for
    running with a different version of libuv than the one used at
    compilation time. These rules may trigger a fatal error at
    startup:
  - Building against or running with libuv versions 1.35.0 and
    1.36.0 is now a fatal error.
  - Running with libuv version higher than 1.34.2 is now a
    fatal error when named is built against libuv version
    1.34.2 or lower.
  - Running with libuv version higher than 1.39.0 is now a
    fatal error when named is built against libuv version
    1.37.0, 1.38.0, 1.38.1, or 1.39.0.
  * This prevents the use of libuv versions that may trigger an
    assertion failure when receiving multiple UDP messages in a
    single system call.
  Bug Fixes:
  * named could crash with an assertion failure when adding a new
    zone into the configuration file for a name which was already
    configured as a member zone for a catalog zone. This has been
    fixed.
  * When named starts up, it sends a query for the DNSSEC key for
    each configured trust anchor to determine whether the key has
    changed. In some unusual cases, the query might depend on a
    zone for which the server is itself authoritative, and would
    have failed if it were sent before the zone was fully loaded.
    This has now been fixed by delaying the key queries until all
    zones have finished loading.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1682424000">- Update to release 9.16.40
  Bug Fixes:
  * Logfiles using timestamp-style suffixes were not always
    correctly removed when the number of files exceeded the limit
    set by versions. This has been fixed for configurations which
    do not explicitly specify a directory path as part of the file
    argument in the channel specification.
  * Performance of DNSSEC validation in zones with many DNSKEY
    records has been improved.</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1684324800">- Update to release 9.16.41
  Bug Fixes:
  * When removing delegations from an opt-out range,
    empty-non-terminal NSEC3 records generated by those delegations
    were not cleaned up. This has been fixed.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1687348800">- Update to release 9.16.42
  Security Fixes:
  * The overmem cleaning process has been improved, to prevent the
    cache from significantly exceeding the configured
    max-cache-size limit. (CVE-2023-2828)
  * A query that prioritizes stale data over lookup triggers a
    fetch to refresh the stale data in cache. If the fetch is
    aborted for exceeding the recursion quota, it was possible for
    named to enter an infinite callback loop and crash due to stack
    overflow. This has been fixed. (CVE-2023-2911)
  Bug Fixes:
  * Previously, it was possible for a delegation from cache to be
    returned to the client after the stale-answer-client-timeout
    duration. This has been fixed.
  [bsc#1212544, bsc#1212567, jsc#SLE-24600]</changelog>
  <changelog author="dmueller@suse.com" date="1688644800">- rebuild bind-utils on libuv updates (bsc#1212090)</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1688990400">- Log named-checkconf output [bsc#1213049]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1689076800">- Add dnstap support
  [jsc#PED-4852]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1695124800">- Update to release 9.16.44
  Bug Fixes:
  * Processing already-queued queries received over TCP could cause
    an assertion failure, when the server was reconfigured at the
    same time or the cache was being flushed. This has been fixed.
  Security Fixes:
  * Previously, sending a specially crafted message over the
    control channel could cause the packet-parsing code to run out
    of available stack memory, causing named to terminate
    unexpectedly. This has been fixed. (CVE-2023-3341)
  [bsc#1215472]
- Switch to pkgconfig(libprotobuf-c) since this now contains the
  required protobuf-c binary</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1708084800">- Update to new Major Version 9.18.24.
  This has many enhancements, bug fixes and changes.
  Breaking Changes:
  * Some options have been removed and some have been deprecated
    and will be removed in the future.
    For a complete list, see:
    https://kb.isc.org/docs/changes-to-be-aware-of-when-moving-from-bind-916-to-918
  Major Changes:
  * Support for securing DNS traffic using Transport Layer Security
    (TLS). TLS is used by both DNS-over-TLS (DoT) and
    DNS-over-HTTPS (DoH).
  * Support for zone transfers over TLS (XFR-over-TLS, XoT) for
    both incoming and outgoing zone transfers.
  * The dig tool is now able to send DoT queries (+tls option).
  * Support for OpenSSL 3.0 APIs was added.
  * dnssec-checkds, dnssec-coverage, dnssec-keymgr, which have been
    removed in favor of the dnssec-policy feature
  * python3-bind is deprecated and the subpackage has been removed
  * A number of utilities have been moved from /usr/sbin to
    /usr/bin:
    named-checkconf named-checkzone named-compilezone
    dnssec-dsfromkey dnssec-importkey dnssec-keyfromlabel
    dnssec-keygen dnssec-revoke dnssec-settime dnssec-signzone
    dnssec-verify dnssec-cds named-journalprint nsec3hash
  * The lib directory was renamed from 'named' to 'bind'
  For a complete list of changes, see:
  * Bind Release Notes
    https://bind9.readthedocs.io/en/v9.18.24/notes.html
  * The CHANGES file in the source RPM
  Security Fixes:
  * Validating DNS messages containing a lot of DNSSEC signatures
    could cause excessive CPU load, leading to a denial-of-service
    condition. This has been fixed. (CVE-2023-50387)
    [bsc#1219823]
  * Preparing an NSEC3 closest encloser proof could cause excessive
    CPU load, leading to a denial-of-service condition. This has
    been fixed. (CVE-2023-50868)
    [bsc#1219826]
  * Parsing DNS messages with many different names could cause
    excessive CPU load. This has been fixed. (CVE-2023-4408)
    [bsc#1219851]
  * Specific queries could cause named to crash with an assertion
    failure when nxdomain-redirect was enabled. This has been
    fixed. (CVE-2023-5517)
    [bsc#1219852]
  * A bad interaction between DNS64 and serve-stale could cause
    named to crash with an assertion failure, when both of these
    features were enabled. This has been fixed. (CVE-2023-5679)
    [bsc#1219853]
  * Query patterns that continuously triggered cache database
    maintenance could cause an excessive amount of memory to be
    allocated, exceeding max-cache-size and potentially leading to
    all available memory on the host running named being exhausted.
    This has been fixed. (CVE-2023-6516)
    [bsc#1219854]
  Packaging notes:
  * libnghttps2 added as BuildRequires for tls support
  * named-bootconf.diff patch is obsolete and has been removed
  [jsc#PED-7932]
- Update KillMode to 'control-group' in named.service to handle
  forked processes better.
  [bsc#1215755]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1721908800">- Update to release 9.18.28
  Bug Fixes:
  * Command-line options for IPv4-only (named -4) and IPv6-only
    (named -6) modes are now respected for zone primaries,
    also-notify, and parental-agents.
  * An RPZ response’s SOA record TTL was set to 1 instead of the
    SOA TTL, if add-soa was used. This has been fixed.
  * When a query related to zone maintenance (NOTIFY, SOA) timed
    out close to a view shutdown (triggered e.g. by rndc reload),
    named could crash with an assertion failure. This has been
    fixed.
  * The statistics channel counters that indicated the number of
    currently connected TCP IPv4/IPv6 clients were not properly
    adjusted in certain failure scenarios. This has been fixed.
  * Some servers that could not be reached due to EHOSTDOWN or
    ENETDOWN conditions were incorrectly prioritized during server
    selection. These are now properly handled as unreachable.
  * On some systems the libuv call may return an error code when
    sending a TCP reset for a connection, which triggers an
    assertion failure in named. This error condition is now dealt
    with in a more graceful manner, by logging the incident and
    shutting down the connection.
  * Changes to listen-on statements were ignored on reconfiguration
    unless the port or interface address was changed, making it
    impossible to change a related listener transport type. That
    issue has been fixed.
  * A bug in the keymgr code unintentionally slowed down some
    DNSSEC key rollovers. This has been fixed.
  * Some ISO 8601 durations were accepted erroneously, leading to
    shorter durations than expected. This has been fixed
  * A regression in cache-cleaning code enabled memory use to grow
    significantly more quickly than before, until the configured
    max-cache-size limit was reached. This has been fixed.
  * Using rndc flush inadvertently caused cache cleaning to become
    less effective. This could ultimately lead to the configured
    max-cache-size limit being exceeded and has now been fixed.
  * The logic for cleaning up expired cached DNS records was
    tweaked to be more aggressive. This change helps with enforcing
    max-cache-ttl and max-ncache-ttl in a timely manner.
  * It was possible to trigger a use-after-free assertion when the
    overmem cache cleaning was initiated. This has been fixed.
  New Features:
  * A new option signatures-jitter has been added to dnssec-policy
    to allow signature expirations to be spread out over a period
    of time.
  * The statistics channel now includes counters that indicate the
    number of currently connected TCP IPv4/IPv6 clients.
  * Added RESOLVER.ARPA to the built in empty zones.
  Feature Changes:
  * DNSSEC signatures that are not valid because the current time
    falls outside the signature inception and expiration dates are
    skipped instead of causing an immediate validation failure.
  Security Fixes:
  * A malicious DNS client that sent many queries over TCP but
    never read the responses could cause a server to respond slowly
    or not at all for other clients. This has been fixed.
    (CVE-2024-0760)
    [bsc#1228255]
  * It is possible to craft excessively large resource records
    sets, which have the effect of slowing down database
    processing. This has been addressed by adding a configurable
    limit to the number of records that can be stored per name and
    type in a cache or zone database. The default is 100, which can
    be tuned with the new max-records-per-type option.
  * It is possible to craft excessively large numbers of resource
    record types for a given owner name, which has the effect of
    slowing down database processing. This has been addressed by
    adding a configurable limit to the number of records that can
    be stored per name and type in a cache or zone database. The
    default is 100, which can be tuned with the new
    max-types-per-name option. (CVE-2024-1737)
    [bsc#1228256]
  * Validating DNS messages signed using the SIG(0) protocol (RFC
    2931) could cause excessive CPU load, leading to a
    denial-of-service condition. Support for SIG(0) message
    validation was removed from this version of named.
    (CVE-2024-1975)
    [bsc#1228257]
  * Due to a logic error, lookups that triggered serving stale data
    and required lookups in local authoritative zone data could
    have resulted in an assertion failure. This has been fixed.
  * Potential data races were found in our DoH implementation,
    related to HTTP/2 session object management and endpoints set
    object management after reconfiguration. These issues have been
    fixed.
  * When looking up the NS records of parent zones as part of
    looking up DS records, it was possible for named to trigger an
    assertion failure if serve-stale was enabled. This has been
    fixed. (CVE-2024-4076)
    [bsc#1228258]</changelog>
</package>
<package pkgid="f118ab13c6e07720cd434d8526aa277bbc315fad57dbce080b9567494a91a2a4" name="bind-utils" arch="s390x">
  <version epoch="0" ver="9.18.28" rel="150600.3.3.1"/>
  <changelog author="josef.moellers@suse.com" date="1657800000">- Update to release 9.16.31
  This is the first of monthly updates of "bind". It is planned
  to update bind when a new upstream maintennace release becomes
  available, which is usually towards the end of a month, see
  https://www.isc.org/blogs/2021-bind-release-model/
  Compared to the previous SUSE release, in this release,
  53 (minor) bugs were fixed
  13 (minor) functional enhancements were made
  3 security issues are now fixed upstream:
    CVE-2022-0396, CVE-2021-25220, CVE-2021-25219
  plus a few minor changes.
  For a full list of changes, please refer to the
  CHANGES file in the source rpm.
  This update obsoletes the following patches:
  * bind-fix-build-with-older-sphinx.patch
  * bind-CVE-2021-25219.patch
  * bind-9.16.27-0001-CVE-2021-25220.patch
  * bind-9.16.27-0002-CVE-2022-0396.patch
  [bind-9.16.31.tar.xz, bind-9.16.31.tar.xz.sha512.asc,
  bind-9.16.20.tar.xz, bind-9.16.20.tar.xz.sha512.asc,
  bind-fix-build-with-older-sphinx.patch, bind-CVE-2021-25219.patch,
  bind-9.16.27-0001-CVE-2021-25220.patch,
  bind-9.16.27-0002-CVE-2022-0396.patch,
  jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1661256000">- Update to release 9.16.32
  Feature Changes:
  * The DNSSEC algorithms RSASHA1 and NSEC3RSASHA1 are now automatically
  disabled on systems where they are disallowed by the security policy
  (e.g. Red Hat Enterprise Linux 9). Primary zones using those algorithms
  need to be migrated to new algorithms prior to running on these systems,
  as graceful migration to different DNSSEC algorithms is not possible when
  RSASHA1 is disallowed by the operating system.
  * Log messages related to fetch limiting have been improved to provide
  more complete information. Specifically, the final counts of allowed
  and spilled fetches are now logged before the counter object is destroyed.
  Bug Fixes:
  * Non-dynamic zones that inherit dnssec-policy from the view or options
  blocks were not marked as inline-signed and therefore never scheduled
  to be re-signed. This has been fixed.
  * The old max-zone-ttl zone option was meant to be superseded by
  the max-zone-ttl option in dnssec-policy; however, the latter option
  was not fully effective. This has been corrected: zones no longer load
  if they contain TTLs greater than the limit configured in dnssec-policy.
  For zones with both the old max-zone-ttl option and dnssec-policy
  configured, the old option is ignored, and a warning is generated.
  * rndc dumpdb -expired was fixed to include expired RRsets,
  even if stale-cache-enable is set to no and
  the cache-cleaning time window has passed.
  [bind-9.16.32.tar.xz, bind-9.16.32.tar.xz.sha512.asc,
  bind-9.16.31.tar.xz, bind-9.16.31.tar.xz.sha512.asc,
  bind.spec, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1662724800">- Include a modified createNamedConfInclude script again, as this
  broke compatability with existing configurations.
  A symlink for named.conf.include to /var/lib/named is created to
  allow for a read-only /etc directory.
  However it is still advised to change the existing configuration.
  See README-bind.chrootenv for a guide how to do this.
  [bsc#1203250, vendor-files/tools/createNamedConfInclude,
  vendor-files/docu/README-bind.chrootenv, bind.spec]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1662724801">- Add systemd drop-in directory for named service
  [bsc#1201689, bind.spec]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1663761600">- Update to release 9.16.33
  Security Fixes:
  * Previously, there was no limit to the number of database lookups
    performed while processing large delegations, which could be
    abused to severely impact the performance of named running as a
    recursive resolver. This has been fixed. (CVE-2022-2795)
  * named running as a resolver with the stale-answer-client-timeout
    option set to 0 could crash with an assertion failure, when
    there was a stale CNAME in the cache for the incoming query.
    This has been fixed. (CVE-2022-3080)
  * A memory leak was fixed that could be externally triggered in the
    DNSSEC verification code for the ECDSA algorithm. (CVE-2022-38177)
  * Memory leaks were fixed that could be externally triggered in the
    DNSSEC verification code for the EdDSA algorithm. (CVE-2022-38178)
  Feature Changes:
  * Response Rate Limiting (RRL) code now treats all QNAMEs that are
    subject to wildcard processing within a given zone as the same
    name, to prevent circumventing the limits enforced by RRL.
  * Zones using dnssec-policy now require dynamic DNS or
    inline-signing to be configured explicitly.
  * A backward-compatible approach was implemented for encoding
    internationalized domain names (IDN) in dig and converting the
    domain to IDNA2008 form; if that fails,
    BIND tries an IDNA2003 conversion.
  Bug Fixes:
  * A serve-stale bug was fixed, where BIND would try to return stale
    data from cache for lookups that received duplicate queries or
    queries that would be dropped. This bug resulted in premature
    SERVFAIL responses, and has now been resolved.
  [bsc#1203614, bsc#1203618, bsc#1203619, bsc#1203620, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1668168000">- Update to release 9.16.34
  New Features:
  * Support for parsing and validating the dohpath service
    parameter in SVCB records was added.
  * named now logs the supported cryptographic algorithms during
    startup and in the output of named -V.
  Bug Fixes:
  * Changing just the TSIG key names for primaries in catalog
    zones’ member zones was not effective. This has been fixed.
  Known Issues:
  * Upgrading from BIND 9.16.32 or any older version may require a
    manual configuration change. The following configurations are
    affected:
  - type primary zones configured with dnssec-policy but without
    either allow-update or update-policy,
  - type secondary zones configured with dnssec-policy.
    In these cases please add inline-signing yes; to the individual
    zone configuration(s). Without applying this change, named will
    fail to start. For more details, see
    https://kb.isc.org/docs/dnssec-policy-requires-dynamic-dns-or-inline-signing
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1669291200">- Update to release 9.16.35
  Bug Fixes:
  * A crash was fixed that happened when a dnssec-policy zone that
    used NSEC3 was reconfigured to enable inline-signing.
  * In certain resolution scenarios, quotas could be erroneously
    reached for servers, including any configured forwarders,
    resulting in SERVFAIL answers being sent to clients.
  * rpz-ip rules in response-policy zones could be ineffective in
    some cases if a query had the CD (Checking Disabled) bit set to
    1.
  * Previously, if Internet connectivity issues were experienced
    during the initial startup of named, a BIND resolver with
    dnssec-validation set to auto could enter into a state where it
    would not recover without stopping named, manually deleting the
    managed-keys.bind and managed-keys.bind.jnl files, and starting
    named again.
  * The statistics counter representing the current number of
    clients awaiting recursive resolution results (RecursClients)
    could overflow in certain resolution scenarios.
  * Previously, BIND failed to start on Solaris-based systems with
    hundreds of CPUs.
  * When a DNS resource record’s TTL value was equal to the
    resolver’s configured prefetch “eligibility” value, the record
    was erroneously not treated as eligible for prefetching.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1671710400">- Update to release 9.16.36
  Feature Changes:
  * The auto-dnssec option has been deprecated and will be removed
    in a future BIND 9.19.x release. Please migrate to
    dnssec-policy.
  Bug Fixes:
  * When a catalog zone was removed from the configuration, in some
    cases a dangling pointer could cause the named process to
    crash.
  * When a zone was deleted from a server, a key management object
    related to that zone was inadvertently kept in memory and only
    released upon shutdown. This could lead to constantly
    increasing memory use on servers with a high rate of changes
    affecting the set of zones being served.
  * In certain cases, named waited for the resolution of
    outstanding recursive queries to finish before shutting down.
  * The zone &lt;name&gt;/&lt;class&gt;: final reference detached log message
    was moved from the INFO log level to the DEBUG(1) log level to
    prevent the named-checkzone tool from superfluously logging
    this message in non-debug mode.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1674561600">- Update to release 9.16.37
  Security Fixes:
  * An UPDATE message flood could cause named to exhaust all
    available memory. This flaw was addressed by adding a new
    update-quota option that controls the maximum number of
    outstanding DNS UPDATE messages that named can hold in a queue
    at any given time (default: 100). (CVE-2022-3094)
  * named could crash with an assertion failure when an RRSIG query
    was received and stale-answer-client-timeout was set to a
    non-zero value. This has been fixed. (CVE-2022-3736)
  * named running as a resolver with the
    stale-answer-client-timeout option set to any value greater
    than 0 could crash with an assertion failure, when the
    recursive-clients soft quota was reached. This has been fixed.
    (CVE-2022-3924)
  New Features:
  * The new update-quota option can be used to control the number
    of simultaneous DNS UPDATE messages that can be processed to
    update an authoritative zone on a primary server, or forwarded
    to the primary server by a secondary server. The default is
    100. A new statistics counter has also been added to record
    events when this quota is exceeded, and the version numbers for
    the XML and JSON statistics schemas have been updated.
  Feature Changes:
  * The Differentiated Services Code Point (DSCP) feature in BIND
    has been deprecated. Configuring DSCP values in named.conf now
    causes a warning to be logged. Note that this feature has only
    been partly operational since the new Network Manager was
    introduced in BIND 9.16.0.
  * The catalog zone implementation has been optimized to work with
    hundreds of thousands of member zones.
  Bug Fixes:
  * In certain query resolution scenarios (e.g. when following
    CNAME records), named configured to answer from stale cache
    could return a SERVFAIL response despite a usable, non-stale
    answer being present in the cache. This has been fixed.
  [bsc#1207471, bsc#1207473, bsc#1207475, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1676548800">- Update to release 9.16.38
  Bug Fixes:
  * A constant stream of zone additions and deletions via rndc
    reconfig could cause increased memory consumption due to
    delayed cleaning of view memory. This has been fixed.
  * The speed of the message digest algorithms (MD5, SHA-1, SHA-2),
    and of NSEC3 hashing, has been improved.
  * Building BIND 9 failed when the --enable-dnsrps switch for
    ./configure was used. This has been fixed.
  [jsc#SLE-24600]
- Updated keyring and signature</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1678881600">- Update to release 9.16.39
  Feature Changes:
  * libuv support for receiving multiple UDP messages in a single
    recvmmsg() system call has been tweaked several times between
    libuv versions 1.35.0 and 1.40.0; the current recommended libuv
    version is 1.40.0 or higher. New rules are now in effect for
    running with a different version of libuv than the one used at
    compilation time. These rules may trigger a fatal error at
    startup:
  - Building against or running with libuv versions 1.35.0 and
    1.36.0 is now a fatal error.
  - Running with libuv version higher than 1.34.2 is now a
    fatal error when named is built against libuv version
    1.34.2 or lower.
  - Running with libuv version higher than 1.39.0 is now a
    fatal error when named is built against libuv version
    1.37.0, 1.38.0, 1.38.1, or 1.39.0.
  * This prevents the use of libuv versions that may trigger an
    assertion failure when receiving multiple UDP messages in a
    single system call.
  Bug Fixes:
  * named could crash with an assertion failure when adding a new
    zone into the configuration file for a name which was already
    configured as a member zone for a catalog zone. This has been
    fixed.
  * When named starts up, it sends a query for the DNSSEC key for
    each configured trust anchor to determine whether the key has
    changed. In some unusual cases, the query might depend on a
    zone for which the server is itself authoritative, and would
    have failed if it were sent before the zone was fully loaded.
    This has now been fixed by delaying the key queries until all
    zones have finished loading.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1682424000">- Update to release 9.16.40
  Bug Fixes:
  * Logfiles using timestamp-style suffixes were not always
    correctly removed when the number of files exceeded the limit
    set by versions. This has been fixed for configurations which
    do not explicitly specify a directory path as part of the file
    argument in the channel specification.
  * Performance of DNSSEC validation in zones with many DNSKEY
    records has been improved.</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1684324800">- Update to release 9.16.41
  Bug Fixes:
  * When removing delegations from an opt-out range,
    empty-non-terminal NSEC3 records generated by those delegations
    were not cleaned up. This has been fixed.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1687348800">- Update to release 9.16.42
  Security Fixes:
  * The overmem cleaning process has been improved, to prevent the
    cache from significantly exceeding the configured
    max-cache-size limit. (CVE-2023-2828)
  * A query that prioritizes stale data over lookup triggers a
    fetch to refresh the stale data in cache. If the fetch is
    aborted for exceeding the recursion quota, it was possible for
    named to enter an infinite callback loop and crash due to stack
    overflow. This has been fixed. (CVE-2023-2911)
  Bug Fixes:
  * Previously, it was possible for a delegation from cache to be
    returned to the client after the stale-answer-client-timeout
    duration. This has been fixed.
  [bsc#1212544, bsc#1212567, jsc#SLE-24600]</changelog>
  <changelog author="dmueller@suse.com" date="1688644800">- rebuild bind-utils on libuv updates (bsc#1212090)</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1688990400">- Log named-checkconf output [bsc#1213049]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1689076800">- Add dnstap support
  [jsc#PED-4852]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1695124800">- Update to release 9.16.44
  Bug Fixes:
  * Processing already-queued queries received over TCP could cause
    an assertion failure, when the server was reconfigured at the
    same time or the cache was being flushed. This has been fixed.
  Security Fixes:
  * Previously, sending a specially crafted message over the
    control channel could cause the packet-parsing code to run out
    of available stack memory, causing named to terminate
    unexpectedly. This has been fixed. (CVE-2023-3341)
  [bsc#1215472]
- Switch to pkgconfig(libprotobuf-c) since this now contains the
  required protobuf-c binary</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1708084800">- Update to new Major Version 9.18.24.
  This has many enhancements, bug fixes and changes.
  Breaking Changes:
  * Some options have been removed and some have been deprecated
    and will be removed in the future.
    For a complete list, see:
    https://kb.isc.org/docs/changes-to-be-aware-of-when-moving-from-bind-916-to-918
  Major Changes:
  * Support for securing DNS traffic using Transport Layer Security
    (TLS). TLS is used by both DNS-over-TLS (DoT) and
    DNS-over-HTTPS (DoH).
  * Support for zone transfers over TLS (XFR-over-TLS, XoT) for
    both incoming and outgoing zone transfers.
  * The dig tool is now able to send DoT queries (+tls option).
  * Support for OpenSSL 3.0 APIs was added.
  * dnssec-checkds, dnssec-coverage, dnssec-keymgr, which have been
    removed in favor of the dnssec-policy feature
  * python3-bind is deprecated and the subpackage has been removed
  * A number of utilities have been moved from /usr/sbin to
    /usr/bin:
    named-checkconf named-checkzone named-compilezone
    dnssec-dsfromkey dnssec-importkey dnssec-keyfromlabel
    dnssec-keygen dnssec-revoke dnssec-settime dnssec-signzone
    dnssec-verify dnssec-cds named-journalprint nsec3hash
  * The lib directory was renamed from 'named' to 'bind'
  For a complete list of changes, see:
  * Bind Release Notes
    https://bind9.readthedocs.io/en/v9.18.24/notes.html
  * The CHANGES file in the source RPM
  Security Fixes:
  * Validating DNS messages containing a lot of DNSSEC signatures
    could cause excessive CPU load, leading to a denial-of-service
    condition. This has been fixed. (CVE-2023-50387)
    [bsc#1219823]
  * Preparing an NSEC3 closest encloser proof could cause excessive
    CPU load, leading to a denial-of-service condition. This has
    been fixed. (CVE-2023-50868)
    [bsc#1219826]
  * Parsing DNS messages with many different names could cause
    excessive CPU load. This has been fixed. (CVE-2023-4408)
    [bsc#1219851]
  * Specific queries could cause named to crash with an assertion
    failure when nxdomain-redirect was enabled. This has been
    fixed. (CVE-2023-5517)
    [bsc#1219852]
  * A bad interaction between DNS64 and serve-stale could cause
    named to crash with an assertion failure, when both of these
    features were enabled. This has been fixed. (CVE-2023-5679)
    [bsc#1219853]
  * Query patterns that continuously triggered cache database
    maintenance could cause an excessive amount of memory to be
    allocated, exceeding max-cache-size and potentially leading to
    all available memory on the host running named being exhausted.
    This has been fixed. (CVE-2023-6516)
    [bsc#1219854]
  Packaging notes:
  * libnghttps2 added as BuildRequires for tls support
  * named-bootconf.diff patch is obsolete and has been removed
  [jsc#PED-7932]
- Update KillMode to 'control-group' in named.service to handle
  forked processes better.
  [bsc#1215755]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1721908800">- Update to release 9.18.28
  Bug Fixes:
  * Command-line options for IPv4-only (named -4) and IPv6-only
    (named -6) modes are now respected for zone primaries,
    also-notify, and parental-agents.
  * An RPZ response’s SOA record TTL was set to 1 instead of the
    SOA TTL, if add-soa was used. This has been fixed.
  * When a query related to zone maintenance (NOTIFY, SOA) timed
    out close to a view shutdown (triggered e.g. by rndc reload),
    named could crash with an assertion failure. This has been
    fixed.
  * The statistics channel counters that indicated the number of
    currently connected TCP IPv4/IPv6 clients were not properly
    adjusted in certain failure scenarios. This has been fixed.
  * Some servers that could not be reached due to EHOSTDOWN or
    ENETDOWN conditions were incorrectly prioritized during server
    selection. These are now properly handled as unreachable.
  * On some systems the libuv call may return an error code when
    sending a TCP reset for a connection, which triggers an
    assertion failure in named. This error condition is now dealt
    with in a more graceful manner, by logging the incident and
    shutting down the connection.
  * Changes to listen-on statements were ignored on reconfiguration
    unless the port or interface address was changed, making it
    impossible to change a related listener transport type. That
    issue has been fixed.
  * A bug in the keymgr code unintentionally slowed down some
    DNSSEC key rollovers. This has been fixed.
  * Some ISO 8601 durations were accepted erroneously, leading to
    shorter durations than expected. This has been fixed
  * A regression in cache-cleaning code enabled memory use to grow
    significantly more quickly than before, until the configured
    max-cache-size limit was reached. This has been fixed.
  * Using rndc flush inadvertently caused cache cleaning to become
    less effective. This could ultimately lead to the configured
    max-cache-size limit being exceeded and has now been fixed.
  * The logic for cleaning up expired cached DNS records was
    tweaked to be more aggressive. This change helps with enforcing
    max-cache-ttl and max-ncache-ttl in a timely manner.
  * It was possible to trigger a use-after-free assertion when the
    overmem cache cleaning was initiated. This has been fixed.
  New Features:
  * A new option signatures-jitter has been added to dnssec-policy
    to allow signature expirations to be spread out over a period
    of time.
  * The statistics channel now includes counters that indicate the
    number of currently connected TCP IPv4/IPv6 clients.
  * Added RESOLVER.ARPA to the built in empty zones.
  Feature Changes:
  * DNSSEC signatures that are not valid because the current time
    falls outside the signature inception and expiration dates are
    skipped instead of causing an immediate validation failure.
  Security Fixes:
  * A malicious DNS client that sent many queries over TCP but
    never read the responses could cause a server to respond slowly
    or not at all for other clients. This has been fixed.
    (CVE-2024-0760)
    [bsc#1228255]
  * It is possible to craft excessively large resource records
    sets, which have the effect of slowing down database
    processing. This has been addressed by adding a configurable
    limit to the number of records that can be stored per name and
    type in a cache or zone database. The default is 100, which can
    be tuned with the new max-records-per-type option.
  * It is possible to craft excessively large numbers of resource
    record types for a given owner name, which has the effect of
    slowing down database processing. This has been addressed by
    adding a configurable limit to the number of records that can
    be stored per name and type in a cache or zone database. The
    default is 100, which can be tuned with the new
    max-types-per-name option. (CVE-2024-1737)
    [bsc#1228256]
  * Validating DNS messages signed using the SIG(0) protocol (RFC
    2931) could cause excessive CPU load, leading to a
    denial-of-service condition. Support for SIG(0) message
    validation was removed from this version of named.
    (CVE-2024-1975)
    [bsc#1228257]
  * Due to a logic error, lookups that triggered serving stale data
    and required lookups in local authoritative zone data could
    have resulted in an assertion failure. This has been fixed.
  * Potential data races were found in our DoH implementation,
    related to HTTP/2 session object management and endpoints set
    object management after reconfiguration. These issues have been
    fixed.
  * When looking up the NS records of parent zones as part of
    looking up DS records, it was possible for named to trigger an
    assertion failure if serve-stale was enabled. This has been
    fixed. (CVE-2024-4076)
    [bsc#1228258]</changelog>
</package>
<package pkgid="2607da02f6a201e6b069d4ba1789baee0e4b2dbc92591fd98b7ae60a3babb8de" name="bind-utils" arch="x86_64">
  <version epoch="0" ver="9.18.28" rel="150600.3.3.1"/>
  <changelog author="josef.moellers@suse.com" date="1657800000">- Update to release 9.16.31
  This is the first of monthly updates of "bind". It is planned
  to update bind when a new upstream maintennace release becomes
  available, which is usually towards the end of a month, see
  https://www.isc.org/blogs/2021-bind-release-model/
  Compared to the previous SUSE release, in this release,
  53 (minor) bugs were fixed
  13 (minor) functional enhancements were made
  3 security issues are now fixed upstream:
    CVE-2022-0396, CVE-2021-25220, CVE-2021-25219
  plus a few minor changes.
  For a full list of changes, please refer to the
  CHANGES file in the source rpm.
  This update obsoletes the following patches:
  * bind-fix-build-with-older-sphinx.patch
  * bind-CVE-2021-25219.patch
  * bind-9.16.27-0001-CVE-2021-25220.patch
  * bind-9.16.27-0002-CVE-2022-0396.patch
  [bind-9.16.31.tar.xz, bind-9.16.31.tar.xz.sha512.asc,
  bind-9.16.20.tar.xz, bind-9.16.20.tar.xz.sha512.asc,
  bind-fix-build-with-older-sphinx.patch, bind-CVE-2021-25219.patch,
  bind-9.16.27-0001-CVE-2021-25220.patch,
  bind-9.16.27-0002-CVE-2022-0396.patch,
  jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1661256000">- Update to release 9.16.32
  Feature Changes:
  * The DNSSEC algorithms RSASHA1 and NSEC3RSASHA1 are now automatically
  disabled on systems where they are disallowed by the security policy
  (e.g. Red Hat Enterprise Linux 9). Primary zones using those algorithms
  need to be migrated to new algorithms prior to running on these systems,
  as graceful migration to different DNSSEC algorithms is not possible when
  RSASHA1 is disallowed by the operating system.
  * Log messages related to fetch limiting have been improved to provide
  more complete information. Specifically, the final counts of allowed
  and spilled fetches are now logged before the counter object is destroyed.
  Bug Fixes:
  * Non-dynamic zones that inherit dnssec-policy from the view or options
  blocks were not marked as inline-signed and therefore never scheduled
  to be re-signed. This has been fixed.
  * The old max-zone-ttl zone option was meant to be superseded by
  the max-zone-ttl option in dnssec-policy; however, the latter option
  was not fully effective. This has been corrected: zones no longer load
  if they contain TTLs greater than the limit configured in dnssec-policy.
  For zones with both the old max-zone-ttl option and dnssec-policy
  configured, the old option is ignored, and a warning is generated.
  * rndc dumpdb -expired was fixed to include expired RRsets,
  even if stale-cache-enable is set to no and
  the cache-cleaning time window has passed.
  [bind-9.16.32.tar.xz, bind-9.16.32.tar.xz.sha512.asc,
  bind-9.16.31.tar.xz, bind-9.16.31.tar.xz.sha512.asc,
  bind.spec, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1662724800">- Include a modified createNamedConfInclude script again, as this
  broke compatability with existing configurations.
  A symlink for named.conf.include to /var/lib/named is created to
  allow for a read-only /etc directory.
  However it is still advised to change the existing configuration.
  See README-bind.chrootenv for a guide how to do this.
  [bsc#1203250, vendor-files/tools/createNamedConfInclude,
  vendor-files/docu/README-bind.chrootenv, bind.spec]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1662724801">- Add systemd drop-in directory for named service
  [bsc#1201689, bind.spec]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1663761600">- Update to release 9.16.33
  Security Fixes:
  * Previously, there was no limit to the number of database lookups
    performed while processing large delegations, which could be
    abused to severely impact the performance of named running as a
    recursive resolver. This has been fixed. (CVE-2022-2795)
  * named running as a resolver with the stale-answer-client-timeout
    option set to 0 could crash with an assertion failure, when
    there was a stale CNAME in the cache for the incoming query.
    This has been fixed. (CVE-2022-3080)
  * A memory leak was fixed that could be externally triggered in the
    DNSSEC verification code for the ECDSA algorithm. (CVE-2022-38177)
  * Memory leaks were fixed that could be externally triggered in the
    DNSSEC verification code for the EdDSA algorithm. (CVE-2022-38178)
  Feature Changes:
  * Response Rate Limiting (RRL) code now treats all QNAMEs that are
    subject to wildcard processing within a given zone as the same
    name, to prevent circumventing the limits enforced by RRL.
  * Zones using dnssec-policy now require dynamic DNS or
    inline-signing to be configured explicitly.
  * A backward-compatible approach was implemented for encoding
    internationalized domain names (IDN) in dig and converting the
    domain to IDNA2008 form; if that fails,
    BIND tries an IDNA2003 conversion.
  Bug Fixes:
  * A serve-stale bug was fixed, where BIND would try to return stale
    data from cache for lookups that received duplicate queries or
    queries that would be dropped. This bug resulted in premature
    SERVFAIL responses, and has now been resolved.
  [bsc#1203614, bsc#1203618, bsc#1203619, bsc#1203620, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1668168000">- Update to release 9.16.34
  New Features:
  * Support for parsing and validating the dohpath service
    parameter in SVCB records was added.
  * named now logs the supported cryptographic algorithms during
    startup and in the output of named -V.
  Bug Fixes:
  * Changing just the TSIG key names for primaries in catalog
    zones’ member zones was not effective. This has been fixed.
  Known Issues:
  * Upgrading from BIND 9.16.32 or any older version may require a
    manual configuration change. The following configurations are
    affected:
  - type primary zones configured with dnssec-policy but without
    either allow-update or update-policy,
  - type secondary zones configured with dnssec-policy.
    In these cases please add inline-signing yes; to the individual
    zone configuration(s). Without applying this change, named will
    fail to start. For more details, see
    https://kb.isc.org/docs/dnssec-policy-requires-dynamic-dns-or-inline-signing
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1669291200">- Update to release 9.16.35
  Bug Fixes:
  * A crash was fixed that happened when a dnssec-policy zone that
    used NSEC3 was reconfigured to enable inline-signing.
  * In certain resolution scenarios, quotas could be erroneously
    reached for servers, including any configured forwarders,
    resulting in SERVFAIL answers being sent to clients.
  * rpz-ip rules in response-policy zones could be ineffective in
    some cases if a query had the CD (Checking Disabled) bit set to
    1.
  * Previously, if Internet connectivity issues were experienced
    during the initial startup of named, a BIND resolver with
    dnssec-validation set to auto could enter into a state where it
    would not recover without stopping named, manually deleting the
    managed-keys.bind and managed-keys.bind.jnl files, and starting
    named again.
  * The statistics counter representing the current number of
    clients awaiting recursive resolution results (RecursClients)
    could overflow in certain resolution scenarios.
  * Previously, BIND failed to start on Solaris-based systems with
    hundreds of CPUs.
  * When a DNS resource record’s TTL value was equal to the
    resolver’s configured prefetch “eligibility” value, the record
    was erroneously not treated as eligible for prefetching.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1671710400">- Update to release 9.16.36
  Feature Changes:
  * The auto-dnssec option has been deprecated and will be removed
    in a future BIND 9.19.x release. Please migrate to
    dnssec-policy.
  Bug Fixes:
  * When a catalog zone was removed from the configuration, in some
    cases a dangling pointer could cause the named process to
    crash.
  * When a zone was deleted from a server, a key management object
    related to that zone was inadvertently kept in memory and only
    released upon shutdown. This could lead to constantly
    increasing memory use on servers with a high rate of changes
    affecting the set of zones being served.
  * In certain cases, named waited for the resolution of
    outstanding recursive queries to finish before shutting down.
  * The zone &lt;name&gt;/&lt;class&gt;: final reference detached log message
    was moved from the INFO log level to the DEBUG(1) log level to
    prevent the named-checkzone tool from superfluously logging
    this message in non-debug mode.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1674561600">- Update to release 9.16.37
  Security Fixes:
  * An UPDATE message flood could cause named to exhaust all
    available memory. This flaw was addressed by adding a new
    update-quota option that controls the maximum number of
    outstanding DNS UPDATE messages that named can hold in a queue
    at any given time (default: 100). (CVE-2022-3094)
  * named could crash with an assertion failure when an RRSIG query
    was received and stale-answer-client-timeout was set to a
    non-zero value. This has been fixed. (CVE-2022-3736)
  * named running as a resolver with the
    stale-answer-client-timeout option set to any value greater
    than 0 could crash with an assertion failure, when the
    recursive-clients soft quota was reached. This has been fixed.
    (CVE-2022-3924)
  New Features:
  * The new update-quota option can be used to control the number
    of simultaneous DNS UPDATE messages that can be processed to
    update an authoritative zone on a primary server, or forwarded
    to the primary server by a secondary server. The default is
    100. A new statistics counter has also been added to record
    events when this quota is exceeded, and the version numbers for
    the XML and JSON statistics schemas have been updated.
  Feature Changes:
  * The Differentiated Services Code Point (DSCP) feature in BIND
    has been deprecated. Configuring DSCP values in named.conf now
    causes a warning to be logged. Note that this feature has only
    been partly operational since the new Network Manager was
    introduced in BIND 9.16.0.
  * The catalog zone implementation has been optimized to work with
    hundreds of thousands of member zones.
  Bug Fixes:
  * In certain query resolution scenarios (e.g. when following
    CNAME records), named configured to answer from stale cache
    could return a SERVFAIL response despite a usable, non-stale
    answer being present in the cache. This has been fixed.
  [bsc#1207471, bsc#1207473, bsc#1207475, jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1676548800">- Update to release 9.16.38
  Bug Fixes:
  * A constant stream of zone additions and deletions via rndc
    reconfig could cause increased memory consumption due to
    delayed cleaning of view memory. This has been fixed.
  * The speed of the message digest algorithms (MD5, SHA-1, SHA-2),
    and of NSEC3 hashing, has been improved.
  * Building BIND 9 failed when the --enable-dnsrps switch for
    ./configure was used. This has been fixed.
  [jsc#SLE-24600]
- Updated keyring and signature</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1678881600">- Update to release 9.16.39
  Feature Changes:
  * libuv support for receiving multiple UDP messages in a single
    recvmmsg() system call has been tweaked several times between
    libuv versions 1.35.0 and 1.40.0; the current recommended libuv
    version is 1.40.0 or higher. New rules are now in effect for
    running with a different version of libuv than the one used at
    compilation time. These rules may trigger a fatal error at
    startup:
  - Building against or running with libuv versions 1.35.0 and
    1.36.0 is now a fatal error.
  - Running with libuv version higher than 1.34.2 is now a
    fatal error when named is built against libuv version
    1.34.2 or lower.
  - Running with libuv version higher than 1.39.0 is now a
    fatal error when named is built against libuv version
    1.37.0, 1.38.0, 1.38.1, or 1.39.0.
  * This prevents the use of libuv versions that may trigger an
    assertion failure when receiving multiple UDP messages in a
    single system call.
  Bug Fixes:
  * named could crash with an assertion failure when adding a new
    zone into the configuration file for a name which was already
    configured as a member zone for a catalog zone. This has been
    fixed.
  * When named starts up, it sends a query for the DNSSEC key for
    each configured trust anchor to determine whether the key has
    changed. In some unusual cases, the query might depend on a
    zone for which the server is itself authoritative, and would
    have failed if it were sent before the zone was fully loaded.
    This has now been fixed by delaying the key queries until all
    zones have finished loading.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1682424000">- Update to release 9.16.40
  Bug Fixes:
  * Logfiles using timestamp-style suffixes were not always
    correctly removed when the number of files exceeded the limit
    set by versions. This has been fixed for configurations which
    do not explicitly specify a directory path as part of the file
    argument in the channel specification.
  * Performance of DNSSEC validation in zones with many DNSKEY
    records has been improved.</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1684324800">- Update to release 9.16.41
  Bug Fixes:
  * When removing delegations from an opt-out range,
    empty-non-terminal NSEC3 records generated by those delegations
    were not cleaned up. This has been fixed.
  [jsc#SLE-24600]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1687348800">- Update to release 9.16.42
  Security Fixes:
  * The overmem cleaning process has been improved, to prevent the
    cache from significantly exceeding the configured
    max-cache-size limit. (CVE-2023-2828)
  * A query that prioritizes stale data over lookup triggers a
    fetch to refresh the stale data in cache. If the fetch is
    aborted for exceeding the recursion quota, it was possible for
    named to enter an infinite callback loop and crash due to stack
    overflow. This has been fixed. (CVE-2023-2911)
  Bug Fixes:
  * Previously, it was possible for a delegation from cache to be
    returned to the client after the stale-answer-client-timeout
    duration. This has been fixed.
  [bsc#1212544, bsc#1212567, jsc#SLE-24600]</changelog>
  <changelog author="dmueller@suse.com" date="1688644800">- rebuild bind-utils on libuv updates (bsc#1212090)</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1688990400">- Log named-checkconf output [bsc#1213049]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1689076800">- Add dnstap support
  [jsc#PED-4852]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1695124800">- Update to release 9.16.44
  Bug Fixes:
  * Processing already-queued queries received over TCP could cause
    an assertion failure, when the server was reconfigured at the
    same time or the cache was being flushed. This has been fixed.
  Security Fixes:
  * Previously, sending a specially crafted message over the
    control channel could cause the packet-parsing code to run out
    of available stack memory, causing named to terminate
    unexpectedly. This has been fixed. (CVE-2023-3341)
  [bsc#1215472]
- Switch to pkgconfig(libprotobuf-c) since this now contains the
  required protobuf-c binary</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1708084800">- Update to new Major Version 9.18.24.
  This has many enhancements, bug fixes and changes.
  Breaking Changes:
  * Some options have been removed and some have been deprecated
    and will be removed in the future.
    For a complete list, see:
    https://kb.isc.org/docs/changes-to-be-aware-of-when-moving-from-bind-916-to-918
  Major Changes:
  * Support for securing DNS traffic using Transport Layer Security
    (TLS). TLS is used by both DNS-over-TLS (DoT) and
    DNS-over-HTTPS (DoH).
  * Support for zone transfers over TLS (XFR-over-TLS, XoT) for
    both incoming and outgoing zone transfers.
  * The dig tool is now able to send DoT queries (+tls option).
  * Support for OpenSSL 3.0 APIs was added.
  * dnssec-checkds, dnssec-coverage, dnssec-keymgr, which have been
    removed in favor of the dnssec-policy feature
  * python3-bind is deprecated and the subpackage has been removed
  * A number of utilities have been moved from /usr/sbin to
    /usr/bin:
    named-checkconf named-checkzone named-compilezone
    dnssec-dsfromkey dnssec-importkey dnssec-keyfromlabel
    dnssec-keygen dnssec-revoke dnssec-settime dnssec-signzone
    dnssec-verify dnssec-cds named-journalprint nsec3hash
  * The lib directory was renamed from 'named' to 'bind'
  For a complete list of changes, see:
  * Bind Release Notes
    https://bind9.readthedocs.io/en/v9.18.24/notes.html
  * The CHANGES file in the source RPM
  Security Fixes:
  * Validating DNS messages containing a lot of DNSSEC signatures
    could cause excessive CPU load, leading to a denial-of-service
    condition. This has been fixed. (CVE-2023-50387)
    [bsc#1219823]
  * Preparing an NSEC3 closest encloser proof could cause excessive
    CPU load, leading to a denial-of-service condition. This has
    been fixed. (CVE-2023-50868)
    [bsc#1219826]
  * Parsing DNS messages with many different names could cause
    excessive CPU load. This has been fixed. (CVE-2023-4408)
    [bsc#1219851]
  * Specific queries could cause named to crash with an assertion
    failure when nxdomain-redirect was enabled. This has been
    fixed. (CVE-2023-5517)
    [bsc#1219852]
  * A bad interaction between DNS64 and serve-stale could cause
    named to crash with an assertion failure, when both of these
    features were enabled. This has been fixed. (CVE-2023-5679)
    [bsc#1219853]
  * Query patterns that continuously triggered cache database
    maintenance could cause an excessive amount of memory to be
    allocated, exceeding max-cache-size and potentially leading to
    all available memory on the host running named being exhausted.
    This has been fixed. (CVE-2023-6516)
    [bsc#1219854]
  Packaging notes:
  * libnghttps2 added as BuildRequires for tls support
  * named-bootconf.diff patch is obsolete and has been removed
  [jsc#PED-7932]
- Update KillMode to 'control-group' in named.service to handle
  forked processes better.
  [bsc#1215755]</changelog>
  <changelog author="jorik.cronenberg@suse.com" date="1721908800">- Update to release 9.18.28
  Bug Fixes:
  * Command-line options for IPv4-only (named -4) and IPv6-only
    (named -6) modes are now respected for zone primaries,
    also-notify, and parental-agents.
  * An RPZ response’s SOA record TTL was set to 1 instead of the
    SOA TTL, if add-soa was used. This has been fixed.
  * When a query related to zone maintenance (NOTIFY, SOA) timed
    out close to a view shutdown (triggered e.g. by rndc reload),
    named could crash with an assertion failure. This has been
    fixed.
  * The statistics channel counters that indicated the number of
    currently connected TCP IPv4/IPv6 clients were not properly
    adjusted in certain failure scenarios. This has been fixed.
  * Some servers that could not be reached due to EHOSTDOWN or
    ENETDOWN conditions were incorrectly prioritized during server
    selection. These are now properly handled as unreachable.
  * On some systems the libuv call may return an error code when
    sending a TCP reset for a connection, which triggers an
    assertion failure in named. This error condition is now dealt
    with in a more graceful manner, by logging the incident and
    shutting down the connection.
  * Changes to listen-on statements were ignored on reconfiguration
    unless the port or interface address was changed, making it
    impossible to change a related listener transport type. That
    issue has been fixed.
  * A bug in the keymgr code unintentionally slowed down some
    DNSSEC key rollovers. This has been fixed.
  * Some ISO 8601 durations were accepted erroneously, leading to
    shorter durations than expected. This has been fixed
  * A regression in cache-cleaning code enabled memory use to grow
    significantly more quickly than before, until the configured
    max-cache-size limit was reached. This has been fixed.
  * Using rndc flush inadvertently caused cache cleaning to become
    less effective. This could ultimately lead to the configured
    max-cache-size limit being exceeded and has now been fixed.
  * The logic for cleaning up expired cached DNS records was
    tweaked to be more aggressive. This change helps with enforcing
    max-cache-ttl and max-ncache-ttl in a timely manner.
  * It was possible to trigger a use-after-free assertion when the
    overmem cache cleaning was initiated. This has been fixed.
  New Features:
  * A new option signatures-jitter has been added to dnssec-policy
    to allow signature expirations to be spread out over a period
    of time.
  * The statistics channel now includes counters that indicate the
    number of currently connected TCP IPv4/IPv6 clients.
  * Added RESOLVER.ARPA to the built in empty zones.
  Feature Changes:
  * DNSSEC signatures that are not valid because the current time
    falls outside the signature inception and expiration dates are
    skipped instead of causing an immediate validation failure.
  Security Fixes:
  * A malicious DNS client that sent many queries over TCP but
    never read the responses could cause a server to respond slowly
    or not at all for other clients. This has been fixed.
    (CVE-2024-0760)
    [bsc#1228255]
  * It is possible to craft excessively large resource records
    sets, which have the effect of slowing down database
    processing. This has been addressed by adding a configurable
    limit to the number of records that can be stored per name and
    type in a cache or zone database. The default is 100, which can
    be tuned with the new max-records-per-type option.
  * It is possible to craft excessively large numbers of resource
    record types for a given owner name, which has the effect of
    slowing down database processing. This has been addressed by
    adding a configurable limit to the number of records that can
    be stored per name and type in a cache or zone database. The
    default is 100, which can be tuned with the new
    max-types-per-name option. (CVE-2024-1737)
    [bsc#1228256]
  * Validating DNS messages signed using the SIG(0) protocol (RFC
    2931) could cause excessive CPU load, leading to a
    denial-of-service condition. Support for SIG(0) message
    validation was removed from this version of named.
    (CVE-2024-1975)
    [bsc#1228257]
  * Due to a logic error, lookups that triggered serving stale data
    and required lookups in local authoritative zone data could
    have resulted in an assertion failure. This has been fixed.
  * Potential data races were found in our DoH implementation,
    related to HTTP/2 session object management and endpoints set
    object management after reconfiguration. These issues have been
    fixed.
  * When looking up the NS records of parent zones as part of
    looking up DS records, it was possible for named to trigger an
    assertion failure if serve-stale was enabled. This has been
    fixed. (CVE-2024-4076)
    [bsc#1228258]</changelog>
</package>
<package pkgid="a3e9a5f7e1c6512aceb46cc2c2b098b6685e97ae3eb84bb10567ec618c05d4a2" name="binutils" arch="aarch64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="2be95041c4b4db2a5df8ab7bb00f356f0d037b6110d71a93a70b38e3fd862e7b" name="binutils" arch="ppc64le">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="5eeaebd6268a6ca926fb5bab5b80556a81834fb3d65be374164a07712fea8232" name="binutils" arch="s390x">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="7863d7996e4148318c1040b069c34e1e6d7ddccc0bf98c07dc4e49fa74e84336" name="binutils" arch="src">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="fbefeed9cade6075b3b46007ce6e8034a4d9e12e74ce46d47e5dc742b1c086b9" name="binutils" arch="x86_64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="ef21f9fe36126f99924e84be9d918f0c27d423dcee4960990a03cc5510f7827f" name="binutils-devel" arch="aarch64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="b853ddd409b792aa623def8b6f3de68090b15f18e42b6b47ff6dec7bf40c3a1a" name="binutils-devel" arch="ppc64le">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="f11958931452755c70c42a927ec50957182f8d74f26683f08971e4652b2cb890" name="binutils-devel" arch="s390x">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="7491cecfc3e3f95852d0fed6976e06ca375bb3a4de32117d97173e5cbb9f1cde" name="binutils-devel" arch="x86_64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="547cdab8009290324540ba3ed4ec990725ef56dae800b4a9029ee95ec5613511" name="binutils-devel-32bit" arch="x86_64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="334952286c6def7a1c8a9b1d3374913b6a4e603935f27e2fdb5d0eeacd8a75c4" name="binutils-gold" arch="aarch64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="b2824ceab6ddd0833e75be7e346a3036b00af3ded372794b89077cff82c02149" name="binutils-gold" arch="ppc64le">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="9178f31cd676f3d255f1ab15c7cf91a9427add4421d031599ee53352802435a6" name="binutils-gold" arch="s390x">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="fea3bfa45b99dc1ea0bb50c1f29dd54805965c10e87b6ff7842375a83fea7eb8" name="binutils-gold" arch="x86_64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="cb3ac58c75439eff9c032c24013720d9681fba7c231b47db8818519bb455a7bf" name="booth" arch="aarch64">
  <version epoch="0" ver="1.1+git0.09b0074" rel="150600.3.3.1"/>
  <changelog author="dmuhamedagic@suse.com" date="1460116800">- Update to version v1.0_14_g4d35ac7:
  + main: fix address matching procedure (bsc#994999)</changelog>
  <changelog author="tchvatal@suse.com" date="1467288000">- Reduce conditionals to only keep the default values
- Run systemd macros in proper phases
- Convert to pkgconfig dependencies</changelog>
  <changelog author="ygao@suse.com" date="1468411200">- spec: Set the owner of /etc/booth and booth.conf.example to hacluster:haclient (bsc#968865)</changelog>
  <changelog author="ygao@suse.com" date="1487160000">- spec: fix booth-test containing undesired build sources
- make log contain source address of unknown site
- main: initialize Libcrypt properly before the first use (bsc#1025463)
- extprog: fix race condition on ticket loss (bsc#1025463)
- attr: fix wrong order for hash free functions (bsc#1025463)
- attr: set time string to "" when time is not set
- extprog: fix pid test
- ticket: reset next state on ticket reset
- alternative logger (in service-runnable script)
- allow skipping "coredump nursing" phase
- alternative "nametag" provider: libsystemd
- alternative range2random provider: glib
- alternative logging provider: libqb
- offer alternatives to libraries from (cluster-)glue
- setup_tcp_listener: close socket when no longer needed
- read_client: sizeof(*struct_ptr) instead of sizeof(struct_ptr) (bsc#1025463)
- get_local_id: denoopize dependent condition (signedness issue) (bsc#1025463)
- list_ticket: fix a memleak in case of buffer too small (bsc#1025463)
- do_status: close lock file when no longer needed
- format_peers: fix a memleak in case of buffer too small (bsc#1025463)
- read_config: close config file when no longer needed
- make foreach_* macros use variable refs passed as arguments (bsc#1025463)
- prevent possible truncation w/ invalid geoattrs in CIB (bsc#1025463)
- build: add proper zlib build-time check + link flag + spec's BR
- build: allow requesting no HTML man + use in spec
- fixup: sanitize true-false logic for "daemonize"
- Upstream version cs: b270a78130f40e648844671b3652919d86e1aef4</changelog>
  <changelog author="ckowalczyk@suse.com" date="1496404800">- Build: create and set working directory (bsc#1039727)
  * bug-1039727_booth-build.patch
- Configuration: handle hostnames in booth.conf file (bsc#1037422)
- Upstream version cs: bbddf969550969784b76b743baecdcf72796bdf7</changelog>
  <changelog author="ckowalczyk@suse.com" date="1498132800">- Clinet commands: fixed local IP addresses for booth grant, list, and peers
  commands (bsc#1045067)
  * bug-1045067_booth-fix-booth-grant-cmd.patch
- Patch bug-1039727_booth-build.patch merged to upstream:
  * Build: create and set working directory (bsc#1039727)
- Upstream version cs: 766d61881b2cb576645821322edda0edea04828d</changelog>
  <changelog author="ckowalczyk@suse.com" date="1512129600">- Tickets: added manual tickets, which allow handling 2-site setup
  (fate#322100)
- Debug mode: fixed the interaction with resource agents (bsc#1046790)
- Patch file bug-1045067_booth-fix-booth-grant-cmd.patch has been removed
  after the code being merged to upstream:
  * Clinet commands: fixed local IP addresses for booth grant, list,
    and peers commands (bsc#1045067)
- Upstream version cs: d4cb8cbdaf87e46f636c3d06730b902b79bdcb9c</changelog>
  <changelog author="ckowalczyk@suse.com" date="1519300800">- Build: replace SuSEFirewall2 by firewalld (fate#320794) in booth.spec
- Upstream version cs: 80199f9477fb4fbf8809f31986139efe3f4ef790</changelog>
  <changelog author="ckowalczyk@suse.com" date="1525089600">- Doc: fix the documentation build with asciidoctor (bsc#1075764):
  * fix_asciidoc_build.patch
- Service: restart arbitrator on failure
- Upstream version cs: c2389e3020e8a3780b679cf0c9857bd608e99fa1</changelog>
  <changelog author="aburlakov@suse.com" date="1547726400">- Update to version 1.0+20190112.497c0b9:
  * fix_asciidoc_build.patch is removed, because the tarball already contains the changes.
  * Low: handler: fix spurious warning on alleged "fall-through" in switch (bsc#1123312)
  * Low: main: fix hypothetical file path double traversal discrepancy (bsc#1123310)
  * Med: attr: fix derefence of unspecified value pointer (bsc#1123308)
  * maint: ocf + script: eliminate some false positives with ShellCheck (bsc#1123303)
  * test: unit-test.py: daemon will not stay in foreground with -D anymore (bsc#1123302)
  * test: avoid dangerous mutable/sticky default value (bsc#1123301)
  * test: drop/comment out superfluous imports (bsc#1123300)
  * test: drop underqualified identifier in unittest's 2.6 compat "polyfill" (bsc#1123299)
  * test: remove superfluous shebangs for import-only modules (bsc#1123297)
  * maint: fix typos introduced in 4bb484a (bsc#1123296)
  * maint: fix thinko in .gitignore introduced in 5a457ee (bsc#1123294)
  * Fix malformed man title (bsc#1123290)
  * Handle multi-leader situation for manual tickets. Added manual tickets to Life Tests framework (bsc#1123289)
  * Feature: add manual mode to booth tickets (bsc#1123287)
  * Fix GCC-7 warning on buffer size (bsc#1123285)</changelog>
  <changelog author="aburlakov@suse.com" date="1548676800">- test: fix read -a &lt;&lt;&lt; issue (bsc#1123313)
  * test-fix-read-a-issue.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1597838400">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="aburlakov@suse.com" date="1600257600">- Update to version 1.0+20200702.2f043da:
  * transport: Check fcntl return value
  * transport: setsockopt failures are not critical
  * pacemaker: Change rv handling of pcmk_get_attr
  * pacemaker: Express intention about logical or
  * main: mkdir failure is not critical
  * pacemaker: Handle updated exit code of crm_ticket
  * main: Delete lockfile when signal arrive too early
  * main: Accept longer config and lock file names
  * Fix gcc-10 warnings for multiple definition of pcmk_handler
  * Fix gcc-10 warnings for packed struct members
  * Use pkg-config to configure libxml-2.0</changelog>
  <changelog author="varkoly@suse.com" date="1622116800">- Update to version 1.0+20210519.bfb2f92:
  * config: Remove deprecated net functions
  * configure: drop unnecessary check and define
  * configure: move exec_prefix sanitizer closer to prefix
  * configure: drop dead code
  * configure: drop unnecessary macro
  * configure: use PKG_CONFIG to detect pacemaker user/group
  * configure: use resource-agents pkg-config info to determine ocfdir
  * configure: add BOOTH_PKG_CHECK_VAR macro to wrap PKG_CHECK_VAR
  * configure: detect and init pkg-config with proper macro
  * configure: Simplify libqb detection when libqb is not installed in standard paths
  * [build] ship booth.pc with basic booth build information for downstream packages to use
  * booth.spec: Change naming scheme for upgrades
  * boot.spec.in: Package html files when generated
  * build: Fix building of html docs with asciidoc
  * git-version-gen: Use fallback for git-archive
  * configure: Make sure without-html_man works
  * test: Add compatibility with iproute ss command
  * test: fix the delimiter in the here-string
  * build: Remove bashisms
  * booth.spec: Add fedora compatibility provides
  * build: Add option to enable tests during rpmbuild
  * build: Substitute hauser and haclient in RPM
  * build: Substitute python dependency in RPM
  * build: Substitute glue dependency in RPM
  * build: Substitute asciidoc or asciidoctor for RPM
  * build: Rework build of RPM
  * build: Use git-version-gen
  * configure: Always let automake set python vars
  * build: Delete cov directory on clean
  * build: Make sure tarball contains all needed files
  * build: Remove unneeded OS detection section
  * build: Make generating of HTML man work
- remove applied patch
  test-fix-read-a-issue.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632830400">- Use Python 3 for -test subpackage.</changelog>
  <changelog author="pgajdos@suse.com" date="1659009600">- Update to version 1.0+20220724.dce51f9:
  * ticket: Fix compiler warning
  * rpm: use new package name for pacemaker devel on opensuse
  * Revert "Refactor: main: substitute is_auth_req macro"
  * doc: Describe debug config file option
  * handler: Use only signal-safe functions
  * main: Use only signal-safe functions
  * fix bashisms (use printf instead of echo)
- fixes CVE-2022-2553 [bsc#1201946]</changelog>
  <changelog author="ygao@suse.com" date="1663070400">- Update to version 1.0+20220815.f40c2d5:
  * configure: Modernize configure.ac a bit
- spec: BuildRequires firewall-macros (bsc#1202959)
- spec: optionally BuildRequires cluster-glue-devel instead of libglue-devel</changelog>
  <changelog author="varkoly@suse.com" date="1678968000">- Update to version 1.0+20221117.9d4029a:
  * man: Add generated html files into gitignore
  * man: remove literal paragraph format from boothd.8
  * man: Remove italic bold formatting
  * man: Do not format __defaults__
  * man: Indent peers counters
  * man: Move debug description to better place
  * test: Add test for unknown/unexpected keyword
  * config: Include protocol in error message
  * config: Include keyword in error message
  * unit file: Remove Alias directive</changelog>
  <changelog author="varkoly@suse.com" date="1699963200">- Update to version 1.1+git0.09b0074:
  * build: Prepare version 1.1 release
  * build: Make distcheck work for non-root user
  * build: Include icons in release tarballs
  * build: Add release.mk
  * build: Add gitlog-to-changelog
  * tests: Fix Python 3.12 warning
  * attr: Fix glib hash_table != NULL assert
  * attr: Fix memory leak for list and get operation
  * main: Fix exit code on grant/revoke command error
  * spec: Migrate to SPDX license
- Added hardening to systemd service(s). Added patch(es):
  * harden_booth-arbitrator.service.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718107200">- security update
- added patches
  fix CVE-2024-3049 [bsc#1226032], specially crafted hash can lead to invalid HMAC being accepted by Booth server
  + booth-CVE-2024-3049.patch</changelog>
</package>
<package pkgid="83c14aa964baff6155eb47a4282bc37d6ed3f6208572fbc33f1130821e201cbf" name="booth" arch="ppc64le">
  <version epoch="0" ver="1.1+git0.09b0074" rel="150600.3.3.1"/>
  <changelog author="dmuhamedagic@suse.com" date="1460116800">- Update to version v1.0_14_g4d35ac7:
  + main: fix address matching procedure (bsc#994999)</changelog>
  <changelog author="tchvatal@suse.com" date="1467288000">- Reduce conditionals to only keep the default values
- Run systemd macros in proper phases
- Convert to pkgconfig dependencies</changelog>
  <changelog author="ygao@suse.com" date="1468411200">- spec: Set the owner of /etc/booth and booth.conf.example to hacluster:haclient (bsc#968865)</changelog>
  <changelog author="ygao@suse.com" date="1487160000">- spec: fix booth-test containing undesired build sources
- make log contain source address of unknown site
- main: initialize Libcrypt properly before the first use (bsc#1025463)
- extprog: fix race condition on ticket loss (bsc#1025463)
- attr: fix wrong order for hash free functions (bsc#1025463)
- attr: set time string to "" when time is not set
- extprog: fix pid test
- ticket: reset next state on ticket reset
- alternative logger (in service-runnable script)
- allow skipping "coredump nursing" phase
- alternative "nametag" provider: libsystemd
- alternative range2random provider: glib
- alternative logging provider: libqb
- offer alternatives to libraries from (cluster-)glue
- setup_tcp_listener: close socket when no longer needed
- read_client: sizeof(*struct_ptr) instead of sizeof(struct_ptr) (bsc#1025463)
- get_local_id: denoopize dependent condition (signedness issue) (bsc#1025463)
- list_ticket: fix a memleak in case of buffer too small (bsc#1025463)
- do_status: close lock file when no longer needed
- format_peers: fix a memleak in case of buffer too small (bsc#1025463)
- read_config: close config file when no longer needed
- make foreach_* macros use variable refs passed as arguments (bsc#1025463)
- prevent possible truncation w/ invalid geoattrs in CIB (bsc#1025463)
- build: add proper zlib build-time check + link flag + spec's BR
- build: allow requesting no HTML man + use in spec
- fixup: sanitize true-false logic for "daemonize"
- Upstream version cs: b270a78130f40e648844671b3652919d86e1aef4</changelog>
  <changelog author="ckowalczyk@suse.com" date="1496404800">- Build: create and set working directory (bsc#1039727)
  * bug-1039727_booth-build.patch
- Configuration: handle hostnames in booth.conf file (bsc#1037422)
- Upstream version cs: bbddf969550969784b76b743baecdcf72796bdf7</changelog>
  <changelog author="ckowalczyk@suse.com" date="1498132800">- Clinet commands: fixed local IP addresses for booth grant, list, and peers
  commands (bsc#1045067)
  * bug-1045067_booth-fix-booth-grant-cmd.patch
- Patch bug-1039727_booth-build.patch merged to upstream:
  * Build: create and set working directory (bsc#1039727)
- Upstream version cs: 766d61881b2cb576645821322edda0edea04828d</changelog>
  <changelog author="ckowalczyk@suse.com" date="1512129600">- Tickets: added manual tickets, which allow handling 2-site setup
  (fate#322100)
- Debug mode: fixed the interaction with resource agents (bsc#1046790)
- Patch file bug-1045067_booth-fix-booth-grant-cmd.patch has been removed
  after the code being merged to upstream:
  * Clinet commands: fixed local IP addresses for booth grant, list,
    and peers commands (bsc#1045067)
- Upstream version cs: d4cb8cbdaf87e46f636c3d06730b902b79bdcb9c</changelog>
  <changelog author="ckowalczyk@suse.com" date="1519300800">- Build: replace SuSEFirewall2 by firewalld (fate#320794) in booth.spec
- Upstream version cs: 80199f9477fb4fbf8809f31986139efe3f4ef790</changelog>
  <changelog author="ckowalczyk@suse.com" date="1525089600">- Doc: fix the documentation build with asciidoctor (bsc#1075764):
  * fix_asciidoc_build.patch
- Service: restart arbitrator on failure
- Upstream version cs: c2389e3020e8a3780b679cf0c9857bd608e99fa1</changelog>
  <changelog author="aburlakov@suse.com" date="1547726400">- Update to version 1.0+20190112.497c0b9:
  * fix_asciidoc_build.patch is removed, because the tarball already contains the changes.
  * Low: handler: fix spurious warning on alleged "fall-through" in switch (bsc#1123312)
  * Low: main: fix hypothetical file path double traversal discrepancy (bsc#1123310)
  * Med: attr: fix derefence of unspecified value pointer (bsc#1123308)
  * maint: ocf + script: eliminate some false positives with ShellCheck (bsc#1123303)
  * test: unit-test.py: daemon will not stay in foreground with -D anymore (bsc#1123302)
  * test: avoid dangerous mutable/sticky default value (bsc#1123301)
  * test: drop/comment out superfluous imports (bsc#1123300)
  * test: drop underqualified identifier in unittest's 2.6 compat "polyfill" (bsc#1123299)
  * test: remove superfluous shebangs for import-only modules (bsc#1123297)
  * maint: fix typos introduced in 4bb484a (bsc#1123296)
  * maint: fix thinko in .gitignore introduced in 5a457ee (bsc#1123294)
  * Fix malformed man title (bsc#1123290)
  * Handle multi-leader situation for manual tickets. Added manual tickets to Life Tests framework (bsc#1123289)
  * Feature: add manual mode to booth tickets (bsc#1123287)
  * Fix GCC-7 warning on buffer size (bsc#1123285)</changelog>
  <changelog author="aburlakov@suse.com" date="1548676800">- test: fix read -a &lt;&lt;&lt; issue (bsc#1123313)
  * test-fix-read-a-issue.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1597838400">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="aburlakov@suse.com" date="1600257600">- Update to version 1.0+20200702.2f043da:
  * transport: Check fcntl return value
  * transport: setsockopt failures are not critical
  * pacemaker: Change rv handling of pcmk_get_attr
  * pacemaker: Express intention about logical or
  * main: mkdir failure is not critical
  * pacemaker: Handle updated exit code of crm_ticket
  * main: Delete lockfile when signal arrive too early
  * main: Accept longer config and lock file names
  * Fix gcc-10 warnings for multiple definition of pcmk_handler
  * Fix gcc-10 warnings for packed struct members
  * Use pkg-config to configure libxml-2.0</changelog>
  <changelog author="varkoly@suse.com" date="1622116800">- Update to version 1.0+20210519.bfb2f92:
  * config: Remove deprecated net functions
  * configure: drop unnecessary check and define
  * configure: move exec_prefix sanitizer closer to prefix
  * configure: drop dead code
  * configure: drop unnecessary macro
  * configure: use PKG_CONFIG to detect pacemaker user/group
  * configure: use resource-agents pkg-config info to determine ocfdir
  * configure: add BOOTH_PKG_CHECK_VAR macro to wrap PKG_CHECK_VAR
  * configure: detect and init pkg-config with proper macro
  * configure: Simplify libqb detection when libqb is not installed in standard paths
  * [build] ship booth.pc with basic booth build information for downstream packages to use
  * booth.spec: Change naming scheme for upgrades
  * boot.spec.in: Package html files when generated
  * build: Fix building of html docs with asciidoc
  * git-version-gen: Use fallback for git-archive
  * configure: Make sure without-html_man works
  * test: Add compatibility with iproute ss command
  * test: fix the delimiter in the here-string
  * build: Remove bashisms
  * booth.spec: Add fedora compatibility provides
  * build: Add option to enable tests during rpmbuild
  * build: Substitute hauser and haclient in RPM
  * build: Substitute python dependency in RPM
  * build: Substitute glue dependency in RPM
  * build: Substitute asciidoc or asciidoctor for RPM
  * build: Rework build of RPM
  * build: Use git-version-gen
  * configure: Always let automake set python vars
  * build: Delete cov directory on clean
  * build: Make sure tarball contains all needed files
  * build: Remove unneeded OS detection section
  * build: Make generating of HTML man work
- remove applied patch
  test-fix-read-a-issue.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632830400">- Use Python 3 for -test subpackage.</changelog>
  <changelog author="pgajdos@suse.com" date="1659009600">- Update to version 1.0+20220724.dce51f9:
  * ticket: Fix compiler warning
  * rpm: use new package name for pacemaker devel on opensuse
  * Revert "Refactor: main: substitute is_auth_req macro"
  * doc: Describe debug config file option
  * handler: Use only signal-safe functions
  * main: Use only signal-safe functions
  * fix bashisms (use printf instead of echo)
- fixes CVE-2022-2553 [bsc#1201946]</changelog>
  <changelog author="ygao@suse.com" date="1663070400">- Update to version 1.0+20220815.f40c2d5:
  * configure: Modernize configure.ac a bit
- spec: BuildRequires firewall-macros (bsc#1202959)
- spec: optionally BuildRequires cluster-glue-devel instead of libglue-devel</changelog>
  <changelog author="varkoly@suse.com" date="1678968000">- Update to version 1.0+20221117.9d4029a:
  * man: Add generated html files into gitignore
  * man: remove literal paragraph format from boothd.8
  * man: Remove italic bold formatting
  * man: Do not format __defaults__
  * man: Indent peers counters
  * man: Move debug description to better place
  * test: Add test for unknown/unexpected keyword
  * config: Include protocol in error message
  * config: Include keyword in error message
  * unit file: Remove Alias directive</changelog>
  <changelog author="varkoly@suse.com" date="1699963200">- Update to version 1.1+git0.09b0074:
  * build: Prepare version 1.1 release
  * build: Make distcheck work for non-root user
  * build: Include icons in release tarballs
  * build: Add release.mk
  * build: Add gitlog-to-changelog
  * tests: Fix Python 3.12 warning
  * attr: Fix glib hash_table != NULL assert
  * attr: Fix memory leak for list and get operation
  * main: Fix exit code on grant/revoke command error
  * spec: Migrate to SPDX license
- Added hardening to systemd service(s). Added patch(es):
  * harden_booth-arbitrator.service.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718107200">- security update
- added patches
  fix CVE-2024-3049 [bsc#1226032], specially crafted hash can lead to invalid HMAC being accepted by Booth server
  + booth-CVE-2024-3049.patch</changelog>
</package>
<package pkgid="60a39fc6cf8ce9ec5ae11a70563c4922af4c084cd0775857c8dbec84f297ccd3" name="booth" arch="s390x">
  <version epoch="0" ver="1.1+git0.09b0074" rel="150600.3.3.1"/>
  <changelog author="dmuhamedagic@suse.com" date="1460116800">- Update to version v1.0_14_g4d35ac7:
  + main: fix address matching procedure (bsc#994999)</changelog>
  <changelog author="tchvatal@suse.com" date="1467288000">- Reduce conditionals to only keep the default values
- Run systemd macros in proper phases
- Convert to pkgconfig dependencies</changelog>
  <changelog author="ygao@suse.com" date="1468411200">- spec: Set the owner of /etc/booth and booth.conf.example to hacluster:haclient (bsc#968865)</changelog>
  <changelog author="ygao@suse.com" date="1487160000">- spec: fix booth-test containing undesired build sources
- make log contain source address of unknown site
- main: initialize Libcrypt properly before the first use (bsc#1025463)
- extprog: fix race condition on ticket loss (bsc#1025463)
- attr: fix wrong order for hash free functions (bsc#1025463)
- attr: set time string to "" when time is not set
- extprog: fix pid test
- ticket: reset next state on ticket reset
- alternative logger (in service-runnable script)
- allow skipping "coredump nursing" phase
- alternative "nametag" provider: libsystemd
- alternative range2random provider: glib
- alternative logging provider: libqb
- offer alternatives to libraries from (cluster-)glue
- setup_tcp_listener: close socket when no longer needed
- read_client: sizeof(*struct_ptr) instead of sizeof(struct_ptr) (bsc#1025463)
- get_local_id: denoopize dependent condition (signedness issue) (bsc#1025463)
- list_ticket: fix a memleak in case of buffer too small (bsc#1025463)
- do_status: close lock file when no longer needed
- format_peers: fix a memleak in case of buffer too small (bsc#1025463)
- read_config: close config file when no longer needed
- make foreach_* macros use variable refs passed as arguments (bsc#1025463)
- prevent possible truncation w/ invalid geoattrs in CIB (bsc#1025463)
- build: add proper zlib build-time check + link flag + spec's BR
- build: allow requesting no HTML man + use in spec
- fixup: sanitize true-false logic for "daemonize"
- Upstream version cs: b270a78130f40e648844671b3652919d86e1aef4</changelog>
  <changelog author="ckowalczyk@suse.com" date="1496404800">- Build: create and set working directory (bsc#1039727)
  * bug-1039727_booth-build.patch
- Configuration: handle hostnames in booth.conf file (bsc#1037422)
- Upstream version cs: bbddf969550969784b76b743baecdcf72796bdf7</changelog>
  <changelog author="ckowalczyk@suse.com" date="1498132800">- Clinet commands: fixed local IP addresses for booth grant, list, and peers
  commands (bsc#1045067)
  * bug-1045067_booth-fix-booth-grant-cmd.patch
- Patch bug-1039727_booth-build.patch merged to upstream:
  * Build: create and set working directory (bsc#1039727)
- Upstream version cs: 766d61881b2cb576645821322edda0edea04828d</changelog>
  <changelog author="ckowalczyk@suse.com" date="1512129600">- Tickets: added manual tickets, which allow handling 2-site setup
  (fate#322100)
- Debug mode: fixed the interaction with resource agents (bsc#1046790)
- Patch file bug-1045067_booth-fix-booth-grant-cmd.patch has been removed
  after the code being merged to upstream:
  * Clinet commands: fixed local IP addresses for booth grant, list,
    and peers commands (bsc#1045067)
- Upstream version cs: d4cb8cbdaf87e46f636c3d06730b902b79bdcb9c</changelog>
  <changelog author="ckowalczyk@suse.com" date="1519300800">- Build: replace SuSEFirewall2 by firewalld (fate#320794) in booth.spec
- Upstream version cs: 80199f9477fb4fbf8809f31986139efe3f4ef790</changelog>
  <changelog author="ckowalczyk@suse.com" date="1525089600">- Doc: fix the documentation build with asciidoctor (bsc#1075764):
  * fix_asciidoc_build.patch
- Service: restart arbitrator on failure
- Upstream version cs: c2389e3020e8a3780b679cf0c9857bd608e99fa1</changelog>
  <changelog author="aburlakov@suse.com" date="1547726400">- Update to version 1.0+20190112.497c0b9:
  * fix_asciidoc_build.patch is removed, because the tarball already contains the changes.
  * Low: handler: fix spurious warning on alleged "fall-through" in switch (bsc#1123312)
  * Low: main: fix hypothetical file path double traversal discrepancy (bsc#1123310)
  * Med: attr: fix derefence of unspecified value pointer (bsc#1123308)
  * maint: ocf + script: eliminate some false positives with ShellCheck (bsc#1123303)
  * test: unit-test.py: daemon will not stay in foreground with -D anymore (bsc#1123302)
  * test: avoid dangerous mutable/sticky default value (bsc#1123301)
  * test: drop/comment out superfluous imports (bsc#1123300)
  * test: drop underqualified identifier in unittest's 2.6 compat "polyfill" (bsc#1123299)
  * test: remove superfluous shebangs for import-only modules (bsc#1123297)
  * maint: fix typos introduced in 4bb484a (bsc#1123296)
  * maint: fix thinko in .gitignore introduced in 5a457ee (bsc#1123294)
  * Fix malformed man title (bsc#1123290)
  * Handle multi-leader situation for manual tickets. Added manual tickets to Life Tests framework (bsc#1123289)
  * Feature: add manual mode to booth tickets (bsc#1123287)
  * Fix GCC-7 warning on buffer size (bsc#1123285)</changelog>
  <changelog author="aburlakov@suse.com" date="1548676800">- test: fix read -a &lt;&lt;&lt; issue (bsc#1123313)
  * test-fix-read-a-issue.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1597838400">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="aburlakov@suse.com" date="1600257600">- Update to version 1.0+20200702.2f043da:
  * transport: Check fcntl return value
  * transport: setsockopt failures are not critical
  * pacemaker: Change rv handling of pcmk_get_attr
  * pacemaker: Express intention about logical or
  * main: mkdir failure is not critical
  * pacemaker: Handle updated exit code of crm_ticket
  * main: Delete lockfile when signal arrive too early
  * main: Accept longer config and lock file names
  * Fix gcc-10 warnings for multiple definition of pcmk_handler
  * Fix gcc-10 warnings for packed struct members
  * Use pkg-config to configure libxml-2.0</changelog>
  <changelog author="varkoly@suse.com" date="1622116800">- Update to version 1.0+20210519.bfb2f92:
  * config: Remove deprecated net functions
  * configure: drop unnecessary check and define
  * configure: move exec_prefix sanitizer closer to prefix
  * configure: drop dead code
  * configure: drop unnecessary macro
  * configure: use PKG_CONFIG to detect pacemaker user/group
  * configure: use resource-agents pkg-config info to determine ocfdir
  * configure: add BOOTH_PKG_CHECK_VAR macro to wrap PKG_CHECK_VAR
  * configure: detect and init pkg-config with proper macro
  * configure: Simplify libqb detection when libqb is not installed in standard paths
  * [build] ship booth.pc with basic booth build information for downstream packages to use
  * booth.spec: Change naming scheme for upgrades
  * boot.spec.in: Package html files when generated
  * build: Fix building of html docs with asciidoc
  * git-version-gen: Use fallback for git-archive
  * configure: Make sure without-html_man works
  * test: Add compatibility with iproute ss command
  * test: fix the delimiter in the here-string
  * build: Remove bashisms
  * booth.spec: Add fedora compatibility provides
  * build: Add option to enable tests during rpmbuild
  * build: Substitute hauser and haclient in RPM
  * build: Substitute python dependency in RPM
  * build: Substitute glue dependency in RPM
  * build: Substitute asciidoc or asciidoctor for RPM
  * build: Rework build of RPM
  * build: Use git-version-gen
  * configure: Always let automake set python vars
  * build: Delete cov directory on clean
  * build: Make sure tarball contains all needed files
  * build: Remove unneeded OS detection section
  * build: Make generating of HTML man work
- remove applied patch
  test-fix-read-a-issue.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632830400">- Use Python 3 for -test subpackage.</changelog>
  <changelog author="pgajdos@suse.com" date="1659009600">- Update to version 1.0+20220724.dce51f9:
  * ticket: Fix compiler warning
  * rpm: use new package name for pacemaker devel on opensuse
  * Revert "Refactor: main: substitute is_auth_req macro"
  * doc: Describe debug config file option
  * handler: Use only signal-safe functions
  * main: Use only signal-safe functions
  * fix bashisms (use printf instead of echo)
- fixes CVE-2022-2553 [bsc#1201946]</changelog>
  <changelog author="ygao@suse.com" date="1663070400">- Update to version 1.0+20220815.f40c2d5:
  * configure: Modernize configure.ac a bit
- spec: BuildRequires firewall-macros (bsc#1202959)
- spec: optionally BuildRequires cluster-glue-devel instead of libglue-devel</changelog>
  <changelog author="varkoly@suse.com" date="1678968000">- Update to version 1.0+20221117.9d4029a:
  * man: Add generated html files into gitignore
  * man: remove literal paragraph format from boothd.8
  * man: Remove italic bold formatting
  * man: Do not format __defaults__
  * man: Indent peers counters
  * man: Move debug description to better place
  * test: Add test for unknown/unexpected keyword
  * config: Include protocol in error message
  * config: Include keyword in error message
  * unit file: Remove Alias directive</changelog>
  <changelog author="varkoly@suse.com" date="1699963200">- Update to version 1.1+git0.09b0074:
  * build: Prepare version 1.1 release
  * build: Make distcheck work for non-root user
  * build: Include icons in release tarballs
  * build: Add release.mk
  * build: Add gitlog-to-changelog
  * tests: Fix Python 3.12 warning
  * attr: Fix glib hash_table != NULL assert
  * attr: Fix memory leak for list and get operation
  * main: Fix exit code on grant/revoke command error
  * spec: Migrate to SPDX license
- Added hardening to systemd service(s). Added patch(es):
  * harden_booth-arbitrator.service.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718107200">- security update
- added patches
  fix CVE-2024-3049 [bsc#1226032], specially crafted hash can lead to invalid HMAC being accepted by Booth server
  + booth-CVE-2024-3049.patch</changelog>
</package>
<package pkgid="00f84af362c159c9ff62cb43de23608f414a2a0e49b68e8849cbbab965e33837" name="booth" arch="src">
  <version epoch="0" ver="1.1+git0.09b0074" rel="150600.3.3.1"/>
  <changelog author="dmuhamedagic@suse.com" date="1460116800">- Update to version v1.0_14_g4d35ac7:
  + main: fix address matching procedure (bsc#994999)</changelog>
  <changelog author="tchvatal@suse.com" date="1467288000">- Reduce conditionals to only keep the default values
- Run systemd macros in proper phases
- Convert to pkgconfig dependencies</changelog>
  <changelog author="ygao@suse.com" date="1468411200">- spec: Set the owner of /etc/booth and booth.conf.example to hacluster:haclient (bsc#968865)</changelog>
  <changelog author="ygao@suse.com" date="1487160000">- spec: fix booth-test containing undesired build sources
- make log contain source address of unknown site
- main: initialize Libcrypt properly before the first use (bsc#1025463)
- extprog: fix race condition on ticket loss (bsc#1025463)
- attr: fix wrong order for hash free functions (bsc#1025463)
- attr: set time string to "" when time is not set
- extprog: fix pid test
- ticket: reset next state on ticket reset
- alternative logger (in service-runnable script)
- allow skipping "coredump nursing" phase
- alternative "nametag" provider: libsystemd
- alternative range2random provider: glib
- alternative logging provider: libqb
- offer alternatives to libraries from (cluster-)glue
- setup_tcp_listener: close socket when no longer needed
- read_client: sizeof(*struct_ptr) instead of sizeof(struct_ptr) (bsc#1025463)
- get_local_id: denoopize dependent condition (signedness issue) (bsc#1025463)
- list_ticket: fix a memleak in case of buffer too small (bsc#1025463)
- do_status: close lock file when no longer needed
- format_peers: fix a memleak in case of buffer too small (bsc#1025463)
- read_config: close config file when no longer needed
- make foreach_* macros use variable refs passed as arguments (bsc#1025463)
- prevent possible truncation w/ invalid geoattrs in CIB (bsc#1025463)
- build: add proper zlib build-time check + link flag + spec's BR
- build: allow requesting no HTML man + use in spec
- fixup: sanitize true-false logic for "daemonize"
- Upstream version cs: b270a78130f40e648844671b3652919d86e1aef4</changelog>
  <changelog author="ckowalczyk@suse.com" date="1496404800">- Build: create and set working directory (bsc#1039727)
  * bug-1039727_booth-build.patch
- Configuration: handle hostnames in booth.conf file (bsc#1037422)
- Upstream version cs: bbddf969550969784b76b743baecdcf72796bdf7</changelog>
  <changelog author="ckowalczyk@suse.com" date="1498132800">- Clinet commands: fixed local IP addresses for booth grant, list, and peers
  commands (bsc#1045067)
  * bug-1045067_booth-fix-booth-grant-cmd.patch
- Patch bug-1039727_booth-build.patch merged to upstream:
  * Build: create and set working directory (bsc#1039727)
- Upstream version cs: 766d61881b2cb576645821322edda0edea04828d</changelog>
  <changelog author="ckowalczyk@suse.com" date="1512129600">- Tickets: added manual tickets, which allow handling 2-site setup
  (fate#322100)
- Debug mode: fixed the interaction with resource agents (bsc#1046790)
- Patch file bug-1045067_booth-fix-booth-grant-cmd.patch has been removed
  after the code being merged to upstream:
  * Clinet commands: fixed local IP addresses for booth grant, list,
    and peers commands (bsc#1045067)
- Upstream version cs: d4cb8cbdaf87e46f636c3d06730b902b79bdcb9c</changelog>
  <changelog author="ckowalczyk@suse.com" date="1519300800">- Build: replace SuSEFirewall2 by firewalld (fate#320794) in booth.spec
- Upstream version cs: 80199f9477fb4fbf8809f31986139efe3f4ef790</changelog>
  <changelog author="ckowalczyk@suse.com" date="1525089600">- Doc: fix the documentation build with asciidoctor (bsc#1075764):
  * fix_asciidoc_build.patch
- Service: restart arbitrator on failure
- Upstream version cs: c2389e3020e8a3780b679cf0c9857bd608e99fa1</changelog>
  <changelog author="aburlakov@suse.com" date="1547726400">- Update to version 1.0+20190112.497c0b9:
  * fix_asciidoc_build.patch is removed, because the tarball already contains the changes.
  * Low: handler: fix spurious warning on alleged "fall-through" in switch (bsc#1123312)
  * Low: main: fix hypothetical file path double traversal discrepancy (bsc#1123310)
  * Med: attr: fix derefence of unspecified value pointer (bsc#1123308)
  * maint: ocf + script: eliminate some false positives with ShellCheck (bsc#1123303)
  * test: unit-test.py: daemon will not stay in foreground with -D anymore (bsc#1123302)
  * test: avoid dangerous mutable/sticky default value (bsc#1123301)
  * test: drop/comment out superfluous imports (bsc#1123300)
  * test: drop underqualified identifier in unittest's 2.6 compat "polyfill" (bsc#1123299)
  * test: remove superfluous shebangs for import-only modules (bsc#1123297)
  * maint: fix typos introduced in 4bb484a (bsc#1123296)
  * maint: fix thinko in .gitignore introduced in 5a457ee (bsc#1123294)
  * Fix malformed man title (bsc#1123290)
  * Handle multi-leader situation for manual tickets. Added manual tickets to Life Tests framework (bsc#1123289)
  * Feature: add manual mode to booth tickets (bsc#1123287)
  * Fix GCC-7 warning on buffer size (bsc#1123285)</changelog>
  <changelog author="aburlakov@suse.com" date="1548676800">- test: fix read -a &lt;&lt;&lt; issue (bsc#1123313)
  * test-fix-read-a-issue.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1597838400">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="aburlakov@suse.com" date="1600257600">- Update to version 1.0+20200702.2f043da:
  * transport: Check fcntl return value
  * transport: setsockopt failures are not critical
  * pacemaker: Change rv handling of pcmk_get_attr
  * pacemaker: Express intention about logical or
  * main: mkdir failure is not critical
  * pacemaker: Handle updated exit code of crm_ticket
  * main: Delete lockfile when signal arrive too early
  * main: Accept longer config and lock file names
  * Fix gcc-10 warnings for multiple definition of pcmk_handler
  * Fix gcc-10 warnings for packed struct members
  * Use pkg-config to configure libxml-2.0</changelog>
  <changelog author="varkoly@suse.com" date="1622116800">- Update to version 1.0+20210519.bfb2f92:
  * config: Remove deprecated net functions
  * configure: drop unnecessary check and define
  * configure: move exec_prefix sanitizer closer to prefix
  * configure: drop dead code
  * configure: drop unnecessary macro
  * configure: use PKG_CONFIG to detect pacemaker user/group
  * configure: use resource-agents pkg-config info to determine ocfdir
  * configure: add BOOTH_PKG_CHECK_VAR macro to wrap PKG_CHECK_VAR
  * configure: detect and init pkg-config with proper macro
  * configure: Simplify libqb detection when libqb is not installed in standard paths
  * [build] ship booth.pc with basic booth build information for downstream packages to use
  * booth.spec: Change naming scheme for upgrades
  * boot.spec.in: Package html files when generated
  * build: Fix building of html docs with asciidoc
  * git-version-gen: Use fallback for git-archive
  * configure: Make sure without-html_man works
  * test: Add compatibility with iproute ss command
  * test: fix the delimiter in the here-string
  * build: Remove bashisms
  * booth.spec: Add fedora compatibility provides
  * build: Add option to enable tests during rpmbuild
  * build: Substitute hauser and haclient in RPM
  * build: Substitute python dependency in RPM
  * build: Substitute glue dependency in RPM
  * build: Substitute asciidoc or asciidoctor for RPM
  * build: Rework build of RPM
  * build: Use git-version-gen
  * configure: Always let automake set python vars
  * build: Delete cov directory on clean
  * build: Make sure tarball contains all needed files
  * build: Remove unneeded OS detection section
  * build: Make generating of HTML man work
- remove applied patch
  test-fix-read-a-issue.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632830400">- Use Python 3 for -test subpackage.</changelog>
  <changelog author="pgajdos@suse.com" date="1659009600">- Update to version 1.0+20220724.dce51f9:
  * ticket: Fix compiler warning
  * rpm: use new package name for pacemaker devel on opensuse
  * Revert "Refactor: main: substitute is_auth_req macro"
  * doc: Describe debug config file option
  * handler: Use only signal-safe functions
  * main: Use only signal-safe functions
  * fix bashisms (use printf instead of echo)
- fixes CVE-2022-2553 [bsc#1201946]</changelog>
  <changelog author="ygao@suse.com" date="1663070400">- Update to version 1.0+20220815.f40c2d5:
  * configure: Modernize configure.ac a bit
- spec: BuildRequires firewall-macros (bsc#1202959)
- spec: optionally BuildRequires cluster-glue-devel instead of libglue-devel</changelog>
  <changelog author="varkoly@suse.com" date="1678968000">- Update to version 1.0+20221117.9d4029a:
  * man: Add generated html files into gitignore
  * man: remove literal paragraph format from boothd.8
  * man: Remove italic bold formatting
  * man: Do not format __defaults__
  * man: Indent peers counters
  * man: Move debug description to better place
  * test: Add test for unknown/unexpected keyword
  * config: Include protocol in error message
  * config: Include keyword in error message
  * unit file: Remove Alias directive</changelog>
  <changelog author="varkoly@suse.com" date="1699963200">- Update to version 1.1+git0.09b0074:
  * build: Prepare version 1.1 release
  * build: Make distcheck work for non-root user
  * build: Include icons in release tarballs
  * build: Add release.mk
  * build: Add gitlog-to-changelog
  * tests: Fix Python 3.12 warning
  * attr: Fix glib hash_table != NULL assert
  * attr: Fix memory leak for list and get operation
  * main: Fix exit code on grant/revoke command error
  * spec: Migrate to SPDX license
- Added hardening to systemd service(s). Added patch(es):
  * harden_booth-arbitrator.service.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718107200">- security update
- added patches
  fix CVE-2024-3049 [bsc#1226032], specially crafted hash can lead to invalid HMAC being accepted by Booth server
  + booth-CVE-2024-3049.patch</changelog>
</package>
<package pkgid="067fd53c6c051d57e0ae17fa72d1ddd27ff2f6456ca4036007219928460ed6e1" name="booth" arch="x86_64">
  <version epoch="0" ver="1.1+git0.09b0074" rel="150600.3.3.1"/>
  <changelog author="dmuhamedagic@suse.com" date="1460116800">- Update to version v1.0_14_g4d35ac7:
  + main: fix address matching procedure (bsc#994999)</changelog>
  <changelog author="tchvatal@suse.com" date="1467288000">- Reduce conditionals to only keep the default values
- Run systemd macros in proper phases
- Convert to pkgconfig dependencies</changelog>
  <changelog author="ygao@suse.com" date="1468411200">- spec: Set the owner of /etc/booth and booth.conf.example to hacluster:haclient (bsc#968865)</changelog>
  <changelog author="ygao@suse.com" date="1487160000">- spec: fix booth-test containing undesired build sources
- make log contain source address of unknown site
- main: initialize Libcrypt properly before the first use (bsc#1025463)
- extprog: fix race condition on ticket loss (bsc#1025463)
- attr: fix wrong order for hash free functions (bsc#1025463)
- attr: set time string to "" when time is not set
- extprog: fix pid test
- ticket: reset next state on ticket reset
- alternative logger (in service-runnable script)
- allow skipping "coredump nursing" phase
- alternative "nametag" provider: libsystemd
- alternative range2random provider: glib
- alternative logging provider: libqb
- offer alternatives to libraries from (cluster-)glue
- setup_tcp_listener: close socket when no longer needed
- read_client: sizeof(*struct_ptr) instead of sizeof(struct_ptr) (bsc#1025463)
- get_local_id: denoopize dependent condition (signedness issue) (bsc#1025463)
- list_ticket: fix a memleak in case of buffer too small (bsc#1025463)
- do_status: close lock file when no longer needed
- format_peers: fix a memleak in case of buffer too small (bsc#1025463)
- read_config: close config file when no longer needed
- make foreach_* macros use variable refs passed as arguments (bsc#1025463)
- prevent possible truncation w/ invalid geoattrs in CIB (bsc#1025463)
- build: add proper zlib build-time check + link flag + spec's BR
- build: allow requesting no HTML man + use in spec
- fixup: sanitize true-false logic for "daemonize"
- Upstream version cs: b270a78130f40e648844671b3652919d86e1aef4</changelog>
  <changelog author="ckowalczyk@suse.com" date="1496404800">- Build: create and set working directory (bsc#1039727)
  * bug-1039727_booth-build.patch
- Configuration: handle hostnames in booth.conf file (bsc#1037422)
- Upstream version cs: bbddf969550969784b76b743baecdcf72796bdf7</changelog>
  <changelog author="ckowalczyk@suse.com" date="1498132800">- Clinet commands: fixed local IP addresses for booth grant, list, and peers
  commands (bsc#1045067)
  * bug-1045067_booth-fix-booth-grant-cmd.patch
- Patch bug-1039727_booth-build.patch merged to upstream:
  * Build: create and set working directory (bsc#1039727)
- Upstream version cs: 766d61881b2cb576645821322edda0edea04828d</changelog>
  <changelog author="ckowalczyk@suse.com" date="1512129600">- Tickets: added manual tickets, which allow handling 2-site setup
  (fate#322100)
- Debug mode: fixed the interaction with resource agents (bsc#1046790)
- Patch file bug-1045067_booth-fix-booth-grant-cmd.patch has been removed
  after the code being merged to upstream:
  * Clinet commands: fixed local IP addresses for booth grant, list,
    and peers commands (bsc#1045067)
- Upstream version cs: d4cb8cbdaf87e46f636c3d06730b902b79bdcb9c</changelog>
  <changelog author="ckowalczyk@suse.com" date="1519300800">- Build: replace SuSEFirewall2 by firewalld (fate#320794) in booth.spec
- Upstream version cs: 80199f9477fb4fbf8809f31986139efe3f4ef790</changelog>
  <changelog author="ckowalczyk@suse.com" date="1525089600">- Doc: fix the documentation build with asciidoctor (bsc#1075764):
  * fix_asciidoc_build.patch
- Service: restart arbitrator on failure
- Upstream version cs: c2389e3020e8a3780b679cf0c9857bd608e99fa1</changelog>
  <changelog author="aburlakov@suse.com" date="1547726400">- Update to version 1.0+20190112.497c0b9:
  * fix_asciidoc_build.patch is removed, because the tarball already contains the changes.
  * Low: handler: fix spurious warning on alleged "fall-through" in switch (bsc#1123312)
  * Low: main: fix hypothetical file path double traversal discrepancy (bsc#1123310)
  * Med: attr: fix derefence of unspecified value pointer (bsc#1123308)
  * maint: ocf + script: eliminate some false positives with ShellCheck (bsc#1123303)
  * test: unit-test.py: daemon will not stay in foreground with -D anymore (bsc#1123302)
  * test: avoid dangerous mutable/sticky default value (bsc#1123301)
  * test: drop/comment out superfluous imports (bsc#1123300)
  * test: drop underqualified identifier in unittest's 2.6 compat "polyfill" (bsc#1123299)
  * test: remove superfluous shebangs for import-only modules (bsc#1123297)
  * maint: fix typos introduced in 4bb484a (bsc#1123296)
  * maint: fix thinko in .gitignore introduced in 5a457ee (bsc#1123294)
  * Fix malformed man title (bsc#1123290)
  * Handle multi-leader situation for manual tickets. Added manual tickets to Life Tests framework (bsc#1123289)
  * Feature: add manual mode to booth tickets (bsc#1123287)
  * Fix GCC-7 warning on buffer size (bsc#1123285)</changelog>
  <changelog author="aburlakov@suse.com" date="1548676800">- test: fix read -a &lt;&lt;&lt; issue (bsc#1123313)
  * test-fix-read-a-issue.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1597838400">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="aburlakov@suse.com" date="1600257600">- Update to version 1.0+20200702.2f043da:
  * transport: Check fcntl return value
  * transport: setsockopt failures are not critical
  * pacemaker: Change rv handling of pcmk_get_attr
  * pacemaker: Express intention about logical or
  * main: mkdir failure is not critical
  * pacemaker: Handle updated exit code of crm_ticket
  * main: Delete lockfile when signal arrive too early
  * main: Accept longer config and lock file names
  * Fix gcc-10 warnings for multiple definition of pcmk_handler
  * Fix gcc-10 warnings for packed struct members
  * Use pkg-config to configure libxml-2.0</changelog>
  <changelog author="varkoly@suse.com" date="1622116800">- Update to version 1.0+20210519.bfb2f92:
  * config: Remove deprecated net functions
  * configure: drop unnecessary check and define
  * configure: move exec_prefix sanitizer closer to prefix
  * configure: drop dead code
  * configure: drop unnecessary macro
  * configure: use PKG_CONFIG to detect pacemaker user/group
  * configure: use resource-agents pkg-config info to determine ocfdir
  * configure: add BOOTH_PKG_CHECK_VAR macro to wrap PKG_CHECK_VAR
  * configure: detect and init pkg-config with proper macro
  * configure: Simplify libqb detection when libqb is not installed in standard paths
  * [build] ship booth.pc with basic booth build information for downstream packages to use
  * booth.spec: Change naming scheme for upgrades
  * boot.spec.in: Package html files when generated
  * build: Fix building of html docs with asciidoc
  * git-version-gen: Use fallback for git-archive
  * configure: Make sure without-html_man works
  * test: Add compatibility with iproute ss command
  * test: fix the delimiter in the here-string
  * build: Remove bashisms
  * booth.spec: Add fedora compatibility provides
  * build: Add option to enable tests during rpmbuild
  * build: Substitute hauser and haclient in RPM
  * build: Substitute python dependency in RPM
  * build: Substitute glue dependency in RPM
  * build: Substitute asciidoc or asciidoctor for RPM
  * build: Rework build of RPM
  * build: Use git-version-gen
  * configure: Always let automake set python vars
  * build: Delete cov directory on clean
  * build: Make sure tarball contains all needed files
  * build: Remove unneeded OS detection section
  * build: Make generating of HTML man work
- remove applied patch
  test-fix-read-a-issue.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632830400">- Use Python 3 for -test subpackage.</changelog>
  <changelog author="pgajdos@suse.com" date="1659009600">- Update to version 1.0+20220724.dce51f9:
  * ticket: Fix compiler warning
  * rpm: use new package name for pacemaker devel on opensuse
  * Revert "Refactor: main: substitute is_auth_req macro"
  * doc: Describe debug config file option
  * handler: Use only signal-safe functions
  * main: Use only signal-safe functions
  * fix bashisms (use printf instead of echo)
- fixes CVE-2022-2553 [bsc#1201946]</changelog>
  <changelog author="ygao@suse.com" date="1663070400">- Update to version 1.0+20220815.f40c2d5:
  * configure: Modernize configure.ac a bit
- spec: BuildRequires firewall-macros (bsc#1202959)
- spec: optionally BuildRequires cluster-glue-devel instead of libglue-devel</changelog>
  <changelog author="varkoly@suse.com" date="1678968000">- Update to version 1.0+20221117.9d4029a:
  * man: Add generated html files into gitignore
  * man: remove literal paragraph format from boothd.8
  * man: Remove italic bold formatting
  * man: Do not format __defaults__
  * man: Indent peers counters
  * man: Move debug description to better place
  * test: Add test for unknown/unexpected keyword
  * config: Include protocol in error message
  * config: Include keyword in error message
  * unit file: Remove Alias directive</changelog>
  <changelog author="varkoly@suse.com" date="1699963200">- Update to version 1.1+git0.09b0074:
  * build: Prepare version 1.1 release
  * build: Make distcheck work for non-root user
  * build: Include icons in release tarballs
  * build: Add release.mk
  * build: Add gitlog-to-changelog
  * tests: Fix Python 3.12 warning
  * attr: Fix glib hash_table != NULL assert
  * attr: Fix memory leak for list and get operation
  * main: Fix exit code on grant/revoke command error
  * spec: Migrate to SPDX license
- Added hardening to systemd service(s). Added patch(es):
  * harden_booth-arbitrator.service.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718107200">- security update
- added patches
  fix CVE-2024-3049 [bsc#1226032], specially crafted hash can lead to invalid HMAC being accepted by Booth server
  + booth-CVE-2024-3049.patch</changelog>
</package>
<package pkgid="6531ce9fae07a394dc30fb64529b1c0bd5de6c49a5b497735e4eba40c3a1a523" name="booth-test" arch="aarch64">
  <version epoch="0" ver="1.1+git0.09b0074" rel="150600.3.3.1"/>
  <changelog author="dmuhamedagic@suse.com" date="1460116800">- Update to version v1.0_14_g4d35ac7:
  + main: fix address matching procedure (bsc#994999)</changelog>
  <changelog author="tchvatal@suse.com" date="1467288000">- Reduce conditionals to only keep the default values
- Run systemd macros in proper phases
- Convert to pkgconfig dependencies</changelog>
  <changelog author="ygao@suse.com" date="1468411200">- spec: Set the owner of /etc/booth and booth.conf.example to hacluster:haclient (bsc#968865)</changelog>
  <changelog author="ygao@suse.com" date="1487160000">- spec: fix booth-test containing undesired build sources
- make log contain source address of unknown site
- main: initialize Libcrypt properly before the first use (bsc#1025463)
- extprog: fix race condition on ticket loss (bsc#1025463)
- attr: fix wrong order for hash free functions (bsc#1025463)
- attr: set time string to "" when time is not set
- extprog: fix pid test
- ticket: reset next state on ticket reset
- alternative logger (in service-runnable script)
- allow skipping "coredump nursing" phase
- alternative "nametag" provider: libsystemd
- alternative range2random provider: glib
- alternative logging provider: libqb
- offer alternatives to libraries from (cluster-)glue
- setup_tcp_listener: close socket when no longer needed
- read_client: sizeof(*struct_ptr) instead of sizeof(struct_ptr) (bsc#1025463)
- get_local_id: denoopize dependent condition (signedness issue) (bsc#1025463)
- list_ticket: fix a memleak in case of buffer too small (bsc#1025463)
- do_status: close lock file when no longer needed
- format_peers: fix a memleak in case of buffer too small (bsc#1025463)
- read_config: close config file when no longer needed
- make foreach_* macros use variable refs passed as arguments (bsc#1025463)
- prevent possible truncation w/ invalid geoattrs in CIB (bsc#1025463)
- build: add proper zlib build-time check + link flag + spec's BR
- build: allow requesting no HTML man + use in spec
- fixup: sanitize true-false logic for "daemonize"
- Upstream version cs: b270a78130f40e648844671b3652919d86e1aef4</changelog>
  <changelog author="ckowalczyk@suse.com" date="1496404800">- Build: create and set working directory (bsc#1039727)
  * bug-1039727_booth-build.patch
- Configuration: handle hostnames in booth.conf file (bsc#1037422)
- Upstream version cs: bbddf969550969784b76b743baecdcf72796bdf7</changelog>
  <changelog author="ckowalczyk@suse.com" date="1498132800">- Clinet commands: fixed local IP addresses for booth grant, list, and peers
  commands (bsc#1045067)
  * bug-1045067_booth-fix-booth-grant-cmd.patch
- Patch bug-1039727_booth-build.patch merged to upstream:
  * Build: create and set working directory (bsc#1039727)
- Upstream version cs: 766d61881b2cb576645821322edda0edea04828d</changelog>
  <changelog author="ckowalczyk@suse.com" date="1512129600">- Tickets: added manual tickets, which allow handling 2-site setup
  (fate#322100)
- Debug mode: fixed the interaction with resource agents (bsc#1046790)
- Patch file bug-1045067_booth-fix-booth-grant-cmd.patch has been removed
  after the code being merged to upstream:
  * Clinet commands: fixed local IP addresses for booth grant, list,
    and peers commands (bsc#1045067)
- Upstream version cs: d4cb8cbdaf87e46f636c3d06730b902b79bdcb9c</changelog>
  <changelog author="ckowalczyk@suse.com" date="1519300800">- Build: replace SuSEFirewall2 by firewalld (fate#320794) in booth.spec
- Upstream version cs: 80199f9477fb4fbf8809f31986139efe3f4ef790</changelog>
  <changelog author="ckowalczyk@suse.com" date="1525089600">- Doc: fix the documentation build with asciidoctor (bsc#1075764):
  * fix_asciidoc_build.patch
- Service: restart arbitrator on failure
- Upstream version cs: c2389e3020e8a3780b679cf0c9857bd608e99fa1</changelog>
  <changelog author="aburlakov@suse.com" date="1547726400">- Update to version 1.0+20190112.497c0b9:
  * fix_asciidoc_build.patch is removed, because the tarball already contains the changes.
  * Low: handler: fix spurious warning on alleged "fall-through" in switch (bsc#1123312)
  * Low: main: fix hypothetical file path double traversal discrepancy (bsc#1123310)
  * Med: attr: fix derefence of unspecified value pointer (bsc#1123308)
  * maint: ocf + script: eliminate some false positives with ShellCheck (bsc#1123303)
  * test: unit-test.py: daemon will not stay in foreground with -D anymore (bsc#1123302)
  * test: avoid dangerous mutable/sticky default value (bsc#1123301)
  * test: drop/comment out superfluous imports (bsc#1123300)
  * test: drop underqualified identifier in unittest's 2.6 compat "polyfill" (bsc#1123299)
  * test: remove superfluous shebangs for import-only modules (bsc#1123297)
  * maint: fix typos introduced in 4bb484a (bsc#1123296)
  * maint: fix thinko in .gitignore introduced in 5a457ee (bsc#1123294)
  * Fix malformed man title (bsc#1123290)
  * Handle multi-leader situation for manual tickets. Added manual tickets to Life Tests framework (bsc#1123289)
  * Feature: add manual mode to booth tickets (bsc#1123287)
  * Fix GCC-7 warning on buffer size (bsc#1123285)</changelog>
  <changelog author="aburlakov@suse.com" date="1548676800">- test: fix read -a &lt;&lt;&lt; issue (bsc#1123313)
  * test-fix-read-a-issue.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1597838400">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="aburlakov@suse.com" date="1600257600">- Update to version 1.0+20200702.2f043da:
  * transport: Check fcntl return value
  * transport: setsockopt failures are not critical
  * pacemaker: Change rv handling of pcmk_get_attr
  * pacemaker: Express intention about logical or
  * main: mkdir failure is not critical
  * pacemaker: Handle updated exit code of crm_ticket
  * main: Delete lockfile when signal arrive too early
  * main: Accept longer config and lock file names
  * Fix gcc-10 warnings for multiple definition of pcmk_handler
  * Fix gcc-10 warnings for packed struct members
  * Use pkg-config to configure libxml-2.0</changelog>
  <changelog author="varkoly@suse.com" date="1622116800">- Update to version 1.0+20210519.bfb2f92:
  * config: Remove deprecated net functions
  * configure: drop unnecessary check and define
  * configure: move exec_prefix sanitizer closer to prefix
  * configure: drop dead code
  * configure: drop unnecessary macro
  * configure: use PKG_CONFIG to detect pacemaker user/group
  * configure: use resource-agents pkg-config info to determine ocfdir
  * configure: add BOOTH_PKG_CHECK_VAR macro to wrap PKG_CHECK_VAR
  * configure: detect and init pkg-config with proper macro
  * configure: Simplify libqb detection when libqb is not installed in standard paths
  * [build] ship booth.pc with basic booth build information for downstream packages to use
  * booth.spec: Change naming scheme for upgrades
  * boot.spec.in: Package html files when generated
  * build: Fix building of html docs with asciidoc
  * git-version-gen: Use fallback for git-archive
  * configure: Make sure without-html_man works
  * test: Add compatibility with iproute ss command
  * test: fix the delimiter in the here-string
  * build: Remove bashisms
  * booth.spec: Add fedora compatibility provides
  * build: Add option to enable tests during rpmbuild
  * build: Substitute hauser and haclient in RPM
  * build: Substitute python dependency in RPM
  * build: Substitute glue dependency in RPM
  * build: Substitute asciidoc or asciidoctor for RPM
  * build: Rework build of RPM
  * build: Use git-version-gen
  * configure: Always let automake set python vars
  * build: Delete cov directory on clean
  * build: Make sure tarball contains all needed files
  * build: Remove unneeded OS detection section
  * build: Make generating of HTML man work
- remove applied patch
  test-fix-read-a-issue.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632830400">- Use Python 3 for -test subpackage.</changelog>
  <changelog author="pgajdos@suse.com" date="1659009600">- Update to version 1.0+20220724.dce51f9:
  * ticket: Fix compiler warning
  * rpm: use new package name for pacemaker devel on opensuse
  * Revert "Refactor: main: substitute is_auth_req macro"
  * doc: Describe debug config file option
  * handler: Use only signal-safe functions
  * main: Use only signal-safe functions
  * fix bashisms (use printf instead of echo)
- fixes CVE-2022-2553 [bsc#1201946]</changelog>
  <changelog author="ygao@suse.com" date="1663070400">- Update to version 1.0+20220815.f40c2d5:
  * configure: Modernize configure.ac a bit
- spec: BuildRequires firewall-macros (bsc#1202959)
- spec: optionally BuildRequires cluster-glue-devel instead of libglue-devel</changelog>
  <changelog author="varkoly@suse.com" date="1678968000">- Update to version 1.0+20221117.9d4029a:
  * man: Add generated html files into gitignore
  * man: remove literal paragraph format from boothd.8
  * man: Remove italic bold formatting
  * man: Do not format __defaults__
  * man: Indent peers counters
  * man: Move debug description to better place
  * test: Add test for unknown/unexpected keyword
  * config: Include protocol in error message
  * config: Include keyword in error message
  * unit file: Remove Alias directive</changelog>
  <changelog author="varkoly@suse.com" date="1699963200">- Update to version 1.1+git0.09b0074:
  * build: Prepare version 1.1 release
  * build: Make distcheck work for non-root user
  * build: Include icons in release tarballs
  * build: Add release.mk
  * build: Add gitlog-to-changelog
  * tests: Fix Python 3.12 warning
  * attr: Fix glib hash_table != NULL assert
  * attr: Fix memory leak for list and get operation
  * main: Fix exit code on grant/revoke command error
  * spec: Migrate to SPDX license
- Added hardening to systemd service(s). Added patch(es):
  * harden_booth-arbitrator.service.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718107200">- security update
- added patches
  fix CVE-2024-3049 [bsc#1226032], specially crafted hash can lead to invalid HMAC being accepted by Booth server
  + booth-CVE-2024-3049.patch</changelog>
</package>
<package pkgid="5f0f2de9e454d6b462e5bc9d55b5f78bf084f4712ac7bae1d92a73764c188ad8" name="booth-test" arch="ppc64le">
  <version epoch="0" ver="1.1+git0.09b0074" rel="150600.3.3.1"/>
  <changelog author="dmuhamedagic@suse.com" date="1460116800">- Update to version v1.0_14_g4d35ac7:
  + main: fix address matching procedure (bsc#994999)</changelog>
  <changelog author="tchvatal@suse.com" date="1467288000">- Reduce conditionals to only keep the default values
- Run systemd macros in proper phases
- Convert to pkgconfig dependencies</changelog>
  <changelog author="ygao@suse.com" date="1468411200">- spec: Set the owner of /etc/booth and booth.conf.example to hacluster:haclient (bsc#968865)</changelog>
  <changelog author="ygao@suse.com" date="1487160000">- spec: fix booth-test containing undesired build sources
- make log contain source address of unknown site
- main: initialize Libcrypt properly before the first use (bsc#1025463)
- extprog: fix race condition on ticket loss (bsc#1025463)
- attr: fix wrong order for hash free functions (bsc#1025463)
- attr: set time string to "" when time is not set
- extprog: fix pid test
- ticket: reset next state on ticket reset
- alternative logger (in service-runnable script)
- allow skipping "coredump nursing" phase
- alternative "nametag" provider: libsystemd
- alternative range2random provider: glib
- alternative logging provider: libqb
- offer alternatives to libraries from (cluster-)glue
- setup_tcp_listener: close socket when no longer needed
- read_client: sizeof(*struct_ptr) instead of sizeof(struct_ptr) (bsc#1025463)
- get_local_id: denoopize dependent condition (signedness issue) (bsc#1025463)
- list_ticket: fix a memleak in case of buffer too small (bsc#1025463)
- do_status: close lock file when no longer needed
- format_peers: fix a memleak in case of buffer too small (bsc#1025463)
- read_config: close config file when no longer needed
- make foreach_* macros use variable refs passed as arguments (bsc#1025463)
- prevent possible truncation w/ invalid geoattrs in CIB (bsc#1025463)
- build: add proper zlib build-time check + link flag + spec's BR
- build: allow requesting no HTML man + use in spec
- fixup: sanitize true-false logic for "daemonize"
- Upstream version cs: b270a78130f40e648844671b3652919d86e1aef4</changelog>
  <changelog author="ckowalczyk@suse.com" date="1496404800">- Build: create and set working directory (bsc#1039727)
  * bug-1039727_booth-build.patch
- Configuration: handle hostnames in booth.conf file (bsc#1037422)
- Upstream version cs: bbddf969550969784b76b743baecdcf72796bdf7</changelog>
  <changelog author="ckowalczyk@suse.com" date="1498132800">- Clinet commands: fixed local IP addresses for booth grant, list, and peers
  commands (bsc#1045067)
  * bug-1045067_booth-fix-booth-grant-cmd.patch
- Patch bug-1039727_booth-build.patch merged to upstream:
  * Build: create and set working directory (bsc#1039727)
- Upstream version cs: 766d61881b2cb576645821322edda0edea04828d</changelog>
  <changelog author="ckowalczyk@suse.com" date="1512129600">- Tickets: added manual tickets, which allow handling 2-site setup
  (fate#322100)
- Debug mode: fixed the interaction with resource agents (bsc#1046790)
- Patch file bug-1045067_booth-fix-booth-grant-cmd.patch has been removed
  after the code being merged to upstream:
  * Clinet commands: fixed local IP addresses for booth grant, list,
    and peers commands (bsc#1045067)
- Upstream version cs: d4cb8cbdaf87e46f636c3d06730b902b79bdcb9c</changelog>
  <changelog author="ckowalczyk@suse.com" date="1519300800">- Build: replace SuSEFirewall2 by firewalld (fate#320794) in booth.spec
- Upstream version cs: 80199f9477fb4fbf8809f31986139efe3f4ef790</changelog>
  <changelog author="ckowalczyk@suse.com" date="1525089600">- Doc: fix the documentation build with asciidoctor (bsc#1075764):
  * fix_asciidoc_build.patch
- Service: restart arbitrator on failure
- Upstream version cs: c2389e3020e8a3780b679cf0c9857bd608e99fa1</changelog>
  <changelog author="aburlakov@suse.com" date="1547726400">- Update to version 1.0+20190112.497c0b9:
  * fix_asciidoc_build.patch is removed, because the tarball already contains the changes.
  * Low: handler: fix spurious warning on alleged "fall-through" in switch (bsc#1123312)
  * Low: main: fix hypothetical file path double traversal discrepancy (bsc#1123310)
  * Med: attr: fix derefence of unspecified value pointer (bsc#1123308)
  * maint: ocf + script: eliminate some false positives with ShellCheck (bsc#1123303)
  * test: unit-test.py: daemon will not stay in foreground with -D anymore (bsc#1123302)
  * test: avoid dangerous mutable/sticky default value (bsc#1123301)
  * test: drop/comment out superfluous imports (bsc#1123300)
  * test: drop underqualified identifier in unittest's 2.6 compat "polyfill" (bsc#1123299)
  * test: remove superfluous shebangs for import-only modules (bsc#1123297)
  * maint: fix typos introduced in 4bb484a (bsc#1123296)
  * maint: fix thinko in .gitignore introduced in 5a457ee (bsc#1123294)
  * Fix malformed man title (bsc#1123290)
  * Handle multi-leader situation for manual tickets. Added manual tickets to Life Tests framework (bsc#1123289)
  * Feature: add manual mode to booth tickets (bsc#1123287)
  * Fix GCC-7 warning on buffer size (bsc#1123285)</changelog>
  <changelog author="aburlakov@suse.com" date="1548676800">- test: fix read -a &lt;&lt;&lt; issue (bsc#1123313)
  * test-fix-read-a-issue.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1597838400">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="aburlakov@suse.com" date="1600257600">- Update to version 1.0+20200702.2f043da:
  * transport: Check fcntl return value
  * transport: setsockopt failures are not critical
  * pacemaker: Change rv handling of pcmk_get_attr
  * pacemaker: Express intention about logical or
  * main: mkdir failure is not critical
  * pacemaker: Handle updated exit code of crm_ticket
  * main: Delete lockfile when signal arrive too early
  * main: Accept longer config and lock file names
  * Fix gcc-10 warnings for multiple definition of pcmk_handler
  * Fix gcc-10 warnings for packed struct members
  * Use pkg-config to configure libxml-2.0</changelog>
  <changelog author="varkoly@suse.com" date="1622116800">- Update to version 1.0+20210519.bfb2f92:
  * config: Remove deprecated net functions
  * configure: drop unnecessary check and define
  * configure: move exec_prefix sanitizer closer to prefix
  * configure: drop dead code
  * configure: drop unnecessary macro
  * configure: use PKG_CONFIG to detect pacemaker user/group
  * configure: use resource-agents pkg-config info to determine ocfdir
  * configure: add BOOTH_PKG_CHECK_VAR macro to wrap PKG_CHECK_VAR
  * configure: detect and init pkg-config with proper macro
  * configure: Simplify libqb detection when libqb is not installed in standard paths
  * [build] ship booth.pc with basic booth build information for downstream packages to use
  * booth.spec: Change naming scheme for upgrades
  * boot.spec.in: Package html files when generated
  * build: Fix building of html docs with asciidoc
  * git-version-gen: Use fallback for git-archive
  * configure: Make sure without-html_man works
  * test: Add compatibility with iproute ss command
  * test: fix the delimiter in the here-string
  * build: Remove bashisms
  * booth.spec: Add fedora compatibility provides
  * build: Add option to enable tests during rpmbuild
  * build: Substitute hauser and haclient in RPM
  * build: Substitute python dependency in RPM
  * build: Substitute glue dependency in RPM
  * build: Substitute asciidoc or asciidoctor for RPM
  * build: Rework build of RPM
  * build: Use git-version-gen
  * configure: Always let automake set python vars
  * build: Delete cov directory on clean
  * build: Make sure tarball contains all needed files
  * build: Remove unneeded OS detection section
  * build: Make generating of HTML man work
- remove applied patch
  test-fix-read-a-issue.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632830400">- Use Python 3 for -test subpackage.</changelog>
  <changelog author="pgajdos@suse.com" date="1659009600">- Update to version 1.0+20220724.dce51f9:
  * ticket: Fix compiler warning
  * rpm: use new package name for pacemaker devel on opensuse
  * Revert "Refactor: main: substitute is_auth_req macro"
  * doc: Describe debug config file option
  * handler: Use only signal-safe functions
  * main: Use only signal-safe functions
  * fix bashisms (use printf instead of echo)
- fixes CVE-2022-2553 [bsc#1201946]</changelog>
  <changelog author="ygao@suse.com" date="1663070400">- Update to version 1.0+20220815.f40c2d5:
  * configure: Modernize configure.ac a bit
- spec: BuildRequires firewall-macros (bsc#1202959)
- spec: optionally BuildRequires cluster-glue-devel instead of libglue-devel</changelog>
  <changelog author="varkoly@suse.com" date="1678968000">- Update to version 1.0+20221117.9d4029a:
  * man: Add generated html files into gitignore
  * man: remove literal paragraph format from boothd.8
  * man: Remove italic bold formatting
  * man: Do not format __defaults__
  * man: Indent peers counters
  * man: Move debug description to better place
  * test: Add test for unknown/unexpected keyword
  * config: Include protocol in error message
  * config: Include keyword in error message
  * unit file: Remove Alias directive</changelog>
  <changelog author="varkoly@suse.com" date="1699963200">- Update to version 1.1+git0.09b0074:
  * build: Prepare version 1.1 release
  * build: Make distcheck work for non-root user
  * build: Include icons in release tarballs
  * build: Add release.mk
  * build: Add gitlog-to-changelog
  * tests: Fix Python 3.12 warning
  * attr: Fix glib hash_table != NULL assert
  * attr: Fix memory leak for list and get operation
  * main: Fix exit code on grant/revoke command error
  * spec: Migrate to SPDX license
- Added hardening to systemd service(s). Added patch(es):
  * harden_booth-arbitrator.service.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718107200">- security update
- added patches
  fix CVE-2024-3049 [bsc#1226032], specially crafted hash can lead to invalid HMAC being accepted by Booth server
  + booth-CVE-2024-3049.patch</changelog>
</package>
<package pkgid="0d4268f9fdf245aa195414c67d07d6b001e63daf897a4c034106f7c855fd3862" name="booth-test" arch="s390x">
  <version epoch="0" ver="1.1+git0.09b0074" rel="150600.3.3.1"/>
  <changelog author="dmuhamedagic@suse.com" date="1460116800">- Update to version v1.0_14_g4d35ac7:
  + main: fix address matching procedure (bsc#994999)</changelog>
  <changelog author="tchvatal@suse.com" date="1467288000">- Reduce conditionals to only keep the default values
- Run systemd macros in proper phases
- Convert to pkgconfig dependencies</changelog>
  <changelog author="ygao@suse.com" date="1468411200">- spec: Set the owner of /etc/booth and booth.conf.example to hacluster:haclient (bsc#968865)</changelog>
  <changelog author="ygao@suse.com" date="1487160000">- spec: fix booth-test containing undesired build sources
- make log contain source address of unknown site
- main: initialize Libcrypt properly before the first use (bsc#1025463)
- extprog: fix race condition on ticket loss (bsc#1025463)
- attr: fix wrong order for hash free functions (bsc#1025463)
- attr: set time string to "" when time is not set
- extprog: fix pid test
- ticket: reset next state on ticket reset
- alternative logger (in service-runnable script)
- allow skipping "coredump nursing" phase
- alternative "nametag" provider: libsystemd
- alternative range2random provider: glib
- alternative logging provider: libqb
- offer alternatives to libraries from (cluster-)glue
- setup_tcp_listener: close socket when no longer needed
- read_client: sizeof(*struct_ptr) instead of sizeof(struct_ptr) (bsc#1025463)
- get_local_id: denoopize dependent condition (signedness issue) (bsc#1025463)
- list_ticket: fix a memleak in case of buffer too small (bsc#1025463)
- do_status: close lock file when no longer needed
- format_peers: fix a memleak in case of buffer too small (bsc#1025463)
- read_config: close config file when no longer needed
- make foreach_* macros use variable refs passed as arguments (bsc#1025463)
- prevent possible truncation w/ invalid geoattrs in CIB (bsc#1025463)
- build: add proper zlib build-time check + link flag + spec's BR
- build: allow requesting no HTML man + use in spec
- fixup: sanitize true-false logic for "daemonize"
- Upstream version cs: b270a78130f40e648844671b3652919d86e1aef4</changelog>
  <changelog author="ckowalczyk@suse.com" date="1496404800">- Build: create and set working directory (bsc#1039727)
  * bug-1039727_booth-build.patch
- Configuration: handle hostnames in booth.conf file (bsc#1037422)
- Upstream version cs: bbddf969550969784b76b743baecdcf72796bdf7</changelog>
  <changelog author="ckowalczyk@suse.com" date="1498132800">- Clinet commands: fixed local IP addresses for booth grant, list, and peers
  commands (bsc#1045067)
  * bug-1045067_booth-fix-booth-grant-cmd.patch
- Patch bug-1039727_booth-build.patch merged to upstream:
  * Build: create and set working directory (bsc#1039727)
- Upstream version cs: 766d61881b2cb576645821322edda0edea04828d</changelog>
  <changelog author="ckowalczyk@suse.com" date="1512129600">- Tickets: added manual tickets, which allow handling 2-site setup
  (fate#322100)
- Debug mode: fixed the interaction with resource agents (bsc#1046790)
- Patch file bug-1045067_booth-fix-booth-grant-cmd.patch has been removed
  after the code being merged to upstream:
  * Clinet commands: fixed local IP addresses for booth grant, list,
    and peers commands (bsc#1045067)
- Upstream version cs: d4cb8cbdaf87e46f636c3d06730b902b79bdcb9c</changelog>
  <changelog author="ckowalczyk@suse.com" date="1519300800">- Build: replace SuSEFirewall2 by firewalld (fate#320794) in booth.spec
- Upstream version cs: 80199f9477fb4fbf8809f31986139efe3f4ef790</changelog>
  <changelog author="ckowalczyk@suse.com" date="1525089600">- Doc: fix the documentation build with asciidoctor (bsc#1075764):
  * fix_asciidoc_build.patch
- Service: restart arbitrator on failure
- Upstream version cs: c2389e3020e8a3780b679cf0c9857bd608e99fa1</changelog>
  <changelog author="aburlakov@suse.com" date="1547726400">- Update to version 1.0+20190112.497c0b9:
  * fix_asciidoc_build.patch is removed, because the tarball already contains the changes.
  * Low: handler: fix spurious warning on alleged "fall-through" in switch (bsc#1123312)
  * Low: main: fix hypothetical file path double traversal discrepancy (bsc#1123310)
  * Med: attr: fix derefence of unspecified value pointer (bsc#1123308)
  * maint: ocf + script: eliminate some false positives with ShellCheck (bsc#1123303)
  * test: unit-test.py: daemon will not stay in foreground with -D anymore (bsc#1123302)
  * test: avoid dangerous mutable/sticky default value (bsc#1123301)
  * test: drop/comment out superfluous imports (bsc#1123300)
  * test: drop underqualified identifier in unittest's 2.6 compat "polyfill" (bsc#1123299)
  * test: remove superfluous shebangs for import-only modules (bsc#1123297)
  * maint: fix typos introduced in 4bb484a (bsc#1123296)
  * maint: fix thinko in .gitignore introduced in 5a457ee (bsc#1123294)
  * Fix malformed man title (bsc#1123290)
  * Handle multi-leader situation for manual tickets. Added manual tickets to Life Tests framework (bsc#1123289)
  * Feature: add manual mode to booth tickets (bsc#1123287)
  * Fix GCC-7 warning on buffer size (bsc#1123285)</changelog>
  <changelog author="aburlakov@suse.com" date="1548676800">- test: fix read -a &lt;&lt;&lt; issue (bsc#1123313)
  * test-fix-read-a-issue.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1597838400">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="aburlakov@suse.com" date="1600257600">- Update to version 1.0+20200702.2f043da:
  * transport: Check fcntl return value
  * transport: setsockopt failures are not critical
  * pacemaker: Change rv handling of pcmk_get_attr
  * pacemaker: Express intention about logical or
  * main: mkdir failure is not critical
  * pacemaker: Handle updated exit code of crm_ticket
  * main: Delete lockfile when signal arrive too early
  * main: Accept longer config and lock file names
  * Fix gcc-10 warnings for multiple definition of pcmk_handler
  * Fix gcc-10 warnings for packed struct members
  * Use pkg-config to configure libxml-2.0</changelog>
  <changelog author="varkoly@suse.com" date="1622116800">- Update to version 1.0+20210519.bfb2f92:
  * config: Remove deprecated net functions
  * configure: drop unnecessary check and define
  * configure: move exec_prefix sanitizer closer to prefix
  * configure: drop dead code
  * configure: drop unnecessary macro
  * configure: use PKG_CONFIG to detect pacemaker user/group
  * configure: use resource-agents pkg-config info to determine ocfdir
  * configure: add BOOTH_PKG_CHECK_VAR macro to wrap PKG_CHECK_VAR
  * configure: detect and init pkg-config with proper macro
  * configure: Simplify libqb detection when libqb is not installed in standard paths
  * [build] ship booth.pc with basic booth build information for downstream packages to use
  * booth.spec: Change naming scheme for upgrades
  * boot.spec.in: Package html files when generated
  * build: Fix building of html docs with asciidoc
  * git-version-gen: Use fallback for git-archive
  * configure: Make sure without-html_man works
  * test: Add compatibility with iproute ss command
  * test: fix the delimiter in the here-string
  * build: Remove bashisms
  * booth.spec: Add fedora compatibility provides
  * build: Add option to enable tests during rpmbuild
  * build: Substitute hauser and haclient in RPM
  * build: Substitute python dependency in RPM
  * build: Substitute glue dependency in RPM
  * build: Substitute asciidoc or asciidoctor for RPM
  * build: Rework build of RPM
  * build: Use git-version-gen
  * configure: Always let automake set python vars
  * build: Delete cov directory on clean
  * build: Make sure tarball contains all needed files
  * build: Remove unneeded OS detection section
  * build: Make generating of HTML man work
- remove applied patch
  test-fix-read-a-issue.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632830400">- Use Python 3 for -test subpackage.</changelog>
  <changelog author="pgajdos@suse.com" date="1659009600">- Update to version 1.0+20220724.dce51f9:
  * ticket: Fix compiler warning
  * rpm: use new package name for pacemaker devel on opensuse
  * Revert "Refactor: main: substitute is_auth_req macro"
  * doc: Describe debug config file option
  * handler: Use only signal-safe functions
  * main: Use only signal-safe functions
  * fix bashisms (use printf instead of echo)
- fixes CVE-2022-2553 [bsc#1201946]</changelog>
  <changelog author="ygao@suse.com" date="1663070400">- Update to version 1.0+20220815.f40c2d5:
  * configure: Modernize configure.ac a bit
- spec: BuildRequires firewall-macros (bsc#1202959)
- spec: optionally BuildRequires cluster-glue-devel instead of libglue-devel</changelog>
  <changelog author="varkoly@suse.com" date="1678968000">- Update to version 1.0+20221117.9d4029a:
  * man: Add generated html files into gitignore
  * man: remove literal paragraph format from boothd.8
  * man: Remove italic bold formatting
  * man: Do not format __defaults__
  * man: Indent peers counters
  * man: Move debug description to better place
  * test: Add test for unknown/unexpected keyword
  * config: Include protocol in error message
  * config: Include keyword in error message
  * unit file: Remove Alias directive</changelog>
  <changelog author="varkoly@suse.com" date="1699963200">- Update to version 1.1+git0.09b0074:
  * build: Prepare version 1.1 release
  * build: Make distcheck work for non-root user
  * build: Include icons in release tarballs
  * build: Add release.mk
  * build: Add gitlog-to-changelog
  * tests: Fix Python 3.12 warning
  * attr: Fix glib hash_table != NULL assert
  * attr: Fix memory leak for list and get operation
  * main: Fix exit code on grant/revoke command error
  * spec: Migrate to SPDX license
- Added hardening to systemd service(s). Added patch(es):
  * harden_booth-arbitrator.service.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718107200">- security update
- added patches
  fix CVE-2024-3049 [bsc#1226032], specially crafted hash can lead to invalid HMAC being accepted by Booth server
  + booth-CVE-2024-3049.patch</changelog>
</package>
<package pkgid="df975a7ba76ba3351a19b1f3d3464426a5ae1968ada2d2aace6900fb56c4ced0" name="booth-test" arch="x86_64">
  <version epoch="0" ver="1.1+git0.09b0074" rel="150600.3.3.1"/>
  <changelog author="dmuhamedagic@suse.com" date="1460116800">- Update to version v1.0_14_g4d35ac7:
  + main: fix address matching procedure (bsc#994999)</changelog>
  <changelog author="tchvatal@suse.com" date="1467288000">- Reduce conditionals to only keep the default values
- Run systemd macros in proper phases
- Convert to pkgconfig dependencies</changelog>
  <changelog author="ygao@suse.com" date="1468411200">- spec: Set the owner of /etc/booth and booth.conf.example to hacluster:haclient (bsc#968865)</changelog>
  <changelog author="ygao@suse.com" date="1487160000">- spec: fix booth-test containing undesired build sources
- make log contain source address of unknown site
- main: initialize Libcrypt properly before the first use (bsc#1025463)
- extprog: fix race condition on ticket loss (bsc#1025463)
- attr: fix wrong order for hash free functions (bsc#1025463)
- attr: set time string to "" when time is not set
- extprog: fix pid test
- ticket: reset next state on ticket reset
- alternative logger (in service-runnable script)
- allow skipping "coredump nursing" phase
- alternative "nametag" provider: libsystemd
- alternative range2random provider: glib
- alternative logging provider: libqb
- offer alternatives to libraries from (cluster-)glue
- setup_tcp_listener: close socket when no longer needed
- read_client: sizeof(*struct_ptr) instead of sizeof(struct_ptr) (bsc#1025463)
- get_local_id: denoopize dependent condition (signedness issue) (bsc#1025463)
- list_ticket: fix a memleak in case of buffer too small (bsc#1025463)
- do_status: close lock file when no longer needed
- format_peers: fix a memleak in case of buffer too small (bsc#1025463)
- read_config: close config file when no longer needed
- make foreach_* macros use variable refs passed as arguments (bsc#1025463)
- prevent possible truncation w/ invalid geoattrs in CIB (bsc#1025463)
- build: add proper zlib build-time check + link flag + spec's BR
- build: allow requesting no HTML man + use in spec
- fixup: sanitize true-false logic for "daemonize"
- Upstream version cs: b270a78130f40e648844671b3652919d86e1aef4</changelog>
  <changelog author="ckowalczyk@suse.com" date="1496404800">- Build: create and set working directory (bsc#1039727)
  * bug-1039727_booth-build.patch
- Configuration: handle hostnames in booth.conf file (bsc#1037422)
- Upstream version cs: bbddf969550969784b76b743baecdcf72796bdf7</changelog>
  <changelog author="ckowalczyk@suse.com" date="1498132800">- Clinet commands: fixed local IP addresses for booth grant, list, and peers
  commands (bsc#1045067)
  * bug-1045067_booth-fix-booth-grant-cmd.patch
- Patch bug-1039727_booth-build.patch merged to upstream:
  * Build: create and set working directory (bsc#1039727)
- Upstream version cs: 766d61881b2cb576645821322edda0edea04828d</changelog>
  <changelog author="ckowalczyk@suse.com" date="1512129600">- Tickets: added manual tickets, which allow handling 2-site setup
  (fate#322100)
- Debug mode: fixed the interaction with resource agents (bsc#1046790)
- Patch file bug-1045067_booth-fix-booth-grant-cmd.patch has been removed
  after the code being merged to upstream:
  * Clinet commands: fixed local IP addresses for booth grant, list,
    and peers commands (bsc#1045067)
- Upstream version cs: d4cb8cbdaf87e46f636c3d06730b902b79bdcb9c</changelog>
  <changelog author="ckowalczyk@suse.com" date="1519300800">- Build: replace SuSEFirewall2 by firewalld (fate#320794) in booth.spec
- Upstream version cs: 80199f9477fb4fbf8809f31986139efe3f4ef790</changelog>
  <changelog author="ckowalczyk@suse.com" date="1525089600">- Doc: fix the documentation build with asciidoctor (bsc#1075764):
  * fix_asciidoc_build.patch
- Service: restart arbitrator on failure
- Upstream version cs: c2389e3020e8a3780b679cf0c9857bd608e99fa1</changelog>
  <changelog author="aburlakov@suse.com" date="1547726400">- Update to version 1.0+20190112.497c0b9:
  * fix_asciidoc_build.patch is removed, because the tarball already contains the changes.
  * Low: handler: fix spurious warning on alleged "fall-through" in switch (bsc#1123312)
  * Low: main: fix hypothetical file path double traversal discrepancy (bsc#1123310)
  * Med: attr: fix derefence of unspecified value pointer (bsc#1123308)
  * maint: ocf + script: eliminate some false positives with ShellCheck (bsc#1123303)
  * test: unit-test.py: daemon will not stay in foreground with -D anymore (bsc#1123302)
  * test: avoid dangerous mutable/sticky default value (bsc#1123301)
  * test: drop/comment out superfluous imports (bsc#1123300)
  * test: drop underqualified identifier in unittest's 2.6 compat "polyfill" (bsc#1123299)
  * test: remove superfluous shebangs for import-only modules (bsc#1123297)
  * maint: fix typos introduced in 4bb484a (bsc#1123296)
  * maint: fix thinko in .gitignore introduced in 5a457ee (bsc#1123294)
  * Fix malformed man title (bsc#1123290)
  * Handle multi-leader situation for manual tickets. Added manual tickets to Life Tests framework (bsc#1123289)
  * Feature: add manual mode to booth tickets (bsc#1123287)
  * Fix GCC-7 warning on buffer size (bsc#1123285)</changelog>
  <changelog author="aburlakov@suse.com" date="1548676800">- test: fix read -a &lt;&lt;&lt; issue (bsc#1123313)
  * test-fix-read-a-issue.patch</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1597838400">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="aburlakov@suse.com" date="1600257600">- Update to version 1.0+20200702.2f043da:
  * transport: Check fcntl return value
  * transport: setsockopt failures are not critical
  * pacemaker: Change rv handling of pcmk_get_attr
  * pacemaker: Express intention about logical or
  * main: mkdir failure is not critical
  * pacemaker: Handle updated exit code of crm_ticket
  * main: Delete lockfile when signal arrive too early
  * main: Accept longer config and lock file names
  * Fix gcc-10 warnings for multiple definition of pcmk_handler
  * Fix gcc-10 warnings for packed struct members
  * Use pkg-config to configure libxml-2.0</changelog>
  <changelog author="varkoly@suse.com" date="1622116800">- Update to version 1.0+20210519.bfb2f92:
  * config: Remove deprecated net functions
  * configure: drop unnecessary check and define
  * configure: move exec_prefix sanitizer closer to prefix
  * configure: drop dead code
  * configure: drop unnecessary macro
  * configure: use PKG_CONFIG to detect pacemaker user/group
  * configure: use resource-agents pkg-config info to determine ocfdir
  * configure: add BOOTH_PKG_CHECK_VAR macro to wrap PKG_CHECK_VAR
  * configure: detect and init pkg-config with proper macro
  * configure: Simplify libqb detection when libqb is not installed in standard paths
  * [build] ship booth.pc with basic booth build information for downstream packages to use
  * booth.spec: Change naming scheme for upgrades
  * boot.spec.in: Package html files when generated
  * build: Fix building of html docs with asciidoc
  * git-version-gen: Use fallback for git-archive
  * configure: Make sure without-html_man works
  * test: Add compatibility with iproute ss command
  * test: fix the delimiter in the here-string
  * build: Remove bashisms
  * booth.spec: Add fedora compatibility provides
  * build: Add option to enable tests during rpmbuild
  * build: Substitute hauser and haclient in RPM
  * build: Substitute python dependency in RPM
  * build: Substitute glue dependency in RPM
  * build: Substitute asciidoc or asciidoctor for RPM
  * build: Rework build of RPM
  * build: Use git-version-gen
  * configure: Always let automake set python vars
  * build: Delete cov directory on clean
  * build: Make sure tarball contains all needed files
  * build: Remove unneeded OS detection section
  * build: Make generating of HTML man work
- remove applied patch
  test-fix-read-a-issue.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632830400">- Use Python 3 for -test subpackage.</changelog>
  <changelog author="pgajdos@suse.com" date="1659009600">- Update to version 1.0+20220724.dce51f9:
  * ticket: Fix compiler warning
  * rpm: use new package name for pacemaker devel on opensuse
  * Revert "Refactor: main: substitute is_auth_req macro"
  * doc: Describe debug config file option
  * handler: Use only signal-safe functions
  * main: Use only signal-safe functions
  * fix bashisms (use printf instead of echo)
- fixes CVE-2022-2553 [bsc#1201946]</changelog>
  <changelog author="ygao@suse.com" date="1663070400">- Update to version 1.0+20220815.f40c2d5:
  * configure: Modernize configure.ac a bit
- spec: BuildRequires firewall-macros (bsc#1202959)
- spec: optionally BuildRequires cluster-glue-devel instead of libglue-devel</changelog>
  <changelog author="varkoly@suse.com" date="1678968000">- Update to version 1.0+20221117.9d4029a:
  * man: Add generated html files into gitignore
  * man: remove literal paragraph format from boothd.8
  * man: Remove italic bold formatting
  * man: Do not format __defaults__
  * man: Indent peers counters
  * man: Move debug description to better place
  * test: Add test for unknown/unexpected keyword
  * config: Include protocol in error message
  * config: Include keyword in error message
  * unit file: Remove Alias directive</changelog>
  <changelog author="varkoly@suse.com" date="1699963200">- Update to version 1.1+git0.09b0074:
  * build: Prepare version 1.1 release
  * build: Make distcheck work for non-root user
  * build: Include icons in release tarballs
  * build: Add release.mk
  * build: Add gitlog-to-changelog
  * tests: Fix Python 3.12 warning
  * attr: Fix glib hash_table != NULL assert
  * attr: Fix memory leak for list and get operation
  * main: Fix exit code on grant/revoke command error
  * spec: Migrate to SPDX license
- Added hardening to systemd service(s). Added patch(es):
  * harden_booth-arbitrator.service.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1718107200">- security update
- added patches
  fix CVE-2024-3049 [bsc#1226032], specially crafted hash can lead to invalid HMAC being accepted by Booth server
  + booth-CVE-2024-3049.patch</changelog>
</package>
<package pkgid="06494b09810c5ea49a713ef8670bb2149ba573be342c7ee3fda98df84e71227f" name="bouncycastle" arch="noarch">
  <version epoch="0" ver="1.78.1" rel="150200.3.29.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1570881600">- Update pom files with those from Maven repository.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573041600">- Fix arch dependent macros in noarch package [bsc#1109539]</changelog>
  <changelog author="fstrba@suse.com" date="1585137600">- Added patch:
  * bouncycastle-osgi.patch
    + Add OSGi manifests to the distributed jars so that they can
    be used from eclipse</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588161600">- Version update to 1.65
  * Defects Fixed:
  - DLExternal would encode using DER encoding for tagged SETs.
  - ChaCha20Poly1305 could fail for large (&gt;~2GB) files.
  - ChaCha20Poly1305 could fail for small updates when used via the provider.
  - Properties.getPropertyValue could ignore system property when other
    local overrides set.
  - The entropy gathering thread was not running in daemon mode, meaning there
    could be a delay in an application shutting down due to it.
  - A recent change in Java 11 could cause an exception with the BC Provider's
    implementation of PSS.
  - BCJSSE: TrustManager now tolerates having no trusted certificates.
  - BCJSSE: Choice of credentials and signing algorithm now respect the peer's
    signature_algorithms extension properly.
  - BCJSSE: KeyManager for KeyStoreBuilderParameters no longer leaks memory.
  * Additional Features and Functionality:
  - LMS and HSS (RFC 8554) support has been added to the low level library and
    the PQC provider.
  - SipHash128 support has been added to the low level library and the JCE provider.
  - BCJSSE: BC API now supports explicitly specifying the session to resume.
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: Added support for extended_master_secret system properties:
    jdk.tls.allowLegacyMasterSecret, jdk.tls.allowLegacyResumption,
    jdk.tls.useExtendedMasterSecret .
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: KeyManager and TrustManager now check algorithm constraints for
    keys and certificate chains.
  - BCJSSE: KeyManager selection of server credentials now prefers matching
    SNI hostname (if any).
  - BCJSSE: KeyManager may now fallback to imperfect credentials (expired,
    SNI mismatch).
  - BCJSSE: Client-side OCSP stapling support (beta version: via status_request
    extension only, provides jdk.tls.client.enableStatusRequestExtension, and
    requires CertPathBuilder support).
  - TLS: DSA in JcaTlsCrypto now falls back to stream signing to work around
    NoneWithDSA limitations in default provider.</changelog>
  <changelog author="pmonreal@suse.com" date="1595937600">- Version update to 1.66 [bsc#1186328, CVE-2020-15522]
  * Defects Fixed:
  - EdDSA verifiers now reset correctly after rejecting overly long signatures.
  - BCJSSE: SSLSession.getPeerCertificateChain could throw NullPointerException.
  - qTESLA-I verifier would reject some valid signatures.
  - qTESLA verifiers now reject overly long signatures.
  - PGP regression caused failure to preserve existing version header when
    headers were reset.
  - PKIXNameConstraintValidator had a bad cast preventing use of multiple
    OtherName constraints.
  - Serialisation of the non-CRT RSA Private Key could cause a NullPointerException.
  - An extra 4 bytes was included in the start of HSS public key encodings.
  - CMS with Ed448 using a direct signature was using id-shake256-len
    rather than id-shake256.
  - Use of GCMParameterSpec could cause an AccessControlException under
    some circumstances.
  - DTLS: Fixed high-latency HelloVerifyRequest handshakes.
  - An encoding bug for rightEncoded() in KMAC has been fixed.
  - For a few values the cSHAKE implementation would add unnecessary pad bytes
    where the N and S strings produced encoded data that was block aligned.
  - There were a few circumstances where Argon2BytesGenerator might hit an
    unexpected null. These have been removed.
  * Additional Features and Functionality
  - The qTESLA signature algorithm has been updated to v2.8 (20191108).
  - BCJSSE: Client-side OCSP stapling now supports status_request_v2 extension.
  - Support has been added for "ocsp.enable", "ocsp.responderURL" and
    PKIXRevocationChecker for users of Java 8 and later.
  - Support has been added for "org.bouncycastle.x509.enableCRLDP" to the PKIX validator.
  - BCJSSE: Now supports system property 'jsse.enableFFDHE'
  - BCJSSE: Now supports system properties 'jdk.tls.client.SignatureSchemes'
    and 'jdk.tls.server.SignatureSchemes'.
  - Multi-release support has been added for Java 11 XECKeys.
  - Multi-release support has been added for Java 15 EdECKeys.
  - The MiscPEMGenerator will now output general PrivateKeyInfo structures.
  - A new property "org.bouncycastle.pkcs8.v1_info_only" has been added to
    make the provider only produce version 1 PKCS8 PrivateKeyInfo structures.
  - The PKIX CertPathBuilder will now take the target certificate from the target
    constraints if a specific certificate is given to the selector.
  - BCJSSE: A range of ARIA and CAMELLIA cipher suites added to supported list.
  - BCJSSE: Now supports the PSS signature schemes from RFC 8446 (TLS 1.2 onwards).
  - Performance of the Base64 encoder has been improved.
  - The PGPPublicKey class will now include direct key signatures when checking
    for key expiry times.
  * NOTES:
  - The qTESLA update breaks compatibility with previous versions.
    Private keys now include a hash of the public key at the end,
    and signatures are no longer interoperable with previous versions.</changelog>
  <changelog author="pmonreal@suse.com" date="1608552000">- Version update to 1.67 [bsc#1180215, CVE-2020-28052]
  * CVE-2020-28052: OpenBSDBCrypt.checkPassword utility method
    compared incorrect data when checking the password
  * Defects Fixed:
  - BCJSSE: SunJSSE compatibility fix - override of getChannel()
    removed and 'urgent data' behaviour should now conform to
    what the SunJSSE expects
  - Nested BER data could sometimes cause issues in octet strings
  - Certificates/CRLs with short signatures could cause an exception
    in toString() in the BC X509 Certificate implmentation
  - In line with latest changes in the JVM, SignatureSpis which
    don't require parameters now return null on engineGetParameters()
  - The RSA KeyFactory now always preferentially produces RSAPrivateCrtKey
    where it can on requests for a KeySpec based on an RSAPrivateKey
  - CMSTypedStream$FullReaderStream now handles zero length reads correctly
  - Unecessary padding was added on KMAC when the key string was block aligned
  - Zero length data would cause an unexpected exception from RFC5649WrapEngine
  - OpenBSDBcrypt was failing to handle some valid prefixes
  * Additional Features and Functionality
  - Performance improvement of Argon2 and Noekeon
  - A setSessionKeyObfuscation() method has been added to
    PublicKeyKeyEncryptionMethodGenerator to allow turning off of session key
    obfuscation (default is on, method primarily to get around early version
    GPG issues with AES-128 keys)
  - Implemented 'safegcd' constant-time modular inversion (as well as a
    variable-time variant). It has replaced Fermat inversion in all our EC
    code, and BigInteger.modInverse in several other places, particularly
    signers. This improves side-channel protection, and also gives a
    significant performance boost
  - Performance of custom binary ECC curves and Edwards Curves has been improved
  - BCJSSE: New boolean system property 'org.bouncycastle.jsse.keyManager.checkEKU'
    allows to disable ExtendedKeyUsage restrictions when selecting credentials
    (although the peer may still complain)
  - Initial support has been added for "Composite Keys and Signatures For Use
    In Internet PKI" using the test OID. Please note there will be further
    refinements to this as the draft is standardised
  - The BC EdDSA signature API now supports keys implementing all methods on
    the EdECKey and XECKey interfaces directly
  - Work has begun on classes to support the ETSI TS 103 097, Intelligent
    Transport Systems (ITS) in the bcpkix package
  - Further optimization work has been done on GCM
  - A NewHope based processor, similar to the one for Key Agreement has been
    added for trying to "quantum hard" KEM algorithms
  - PGP clear signed signatures now support SHA-224
  - Treating absent vs NULL as equivalent can now be configured by a system
    property. By default this is not enabled
  - Mode name checks in Cipher strings should now make sure an improper mode
    name always results in a NoSuchAlgorithmException
  - In line with changes in OpenSSL, the OpenSSLPBKDF now uses UTF8 encoding</changelog>
  <changelog author="fstrba@suse.com" date="1610539200">- Version update to 1.68
  * Defects Fixed:
  - Some BigIntegers utility methods would fail for
    BigInteger.ZERO. This has been fixed.
  - PGPUtil.isKeyRing() was not detecting secret sub-keys in its
    input. This has been fixed.
  - The ASN.1 class, ArchiveTimeStamp was insisting on a value
    for the optional reducedHashTree field. This has been fixed.
  - BCJSSE: Lock against multiple writers - a possible
    synchronization issue has been removed.
  * Additional Features and Functionality
  - BCJSSE: Added support for system property
    com.sun.net.ssl.requireCloseNotify. Note that we are using a
    default value of 'true'.
  - BCJSSE: 'TLSv1.3' is now a supported protocol for both client
    and server. For this release it is only enabled by default for
    the 'TLSv1.3' SSLContext, but can be explicitly enabled using
    'setEnabledProtocols' on an SSLSocket or SSLEngine, or via
    SSLParameters.
  - BCJSSE: Session resumption is now also supported for servers
    in TLS 1.2 and earlier. For this release it is disabled by
    default, and can be enabled by setting the boolean system
    property org.bouncycastle.jsse.server.enableSessionResumption
    to 'true'.
  - The provider RSA-PSS signature names that follow the JCA
    naming convention.
  - FIPS mode for the BCJSSE now enforces namedCurves for any
    presented certificates.
  - PGPSignatureSubpacketGenerator now supports editing of a
    pre-existing sub-packet list.</changelog>
  <changelog author="pmonreal@suse.com" date="1621944000">- Add bouncycastle_getpoms.sh to get pom files from Maven repos</changelog>
  <changelog author="fstrba@suse.com" date="1627387200">- Directory core/docs does not exist</changelog>
  <changelog author="fstrba@suse.com" date="1647518400">- Add glassfish-activation-api dependency so that we can build with
  JDK that does not contain the JavaEE modules</changelog>
  <changelog author="fstrba@suse.com" date="1647604800">- Build with source/target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1648641600">- Build against the standalone JavaEE modules unconditionally</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1650628800">- Version update to 1.71
  * Defects Fixed
  - In line with GPG the PGP API now attempts to preserve
    comments containing non-ascii UTF8 characters.
  - An accidental partial dependency on Java 1.7 has been removed
    from the TLS API.
  - JcaPKIXIdentityBuilder would fail to process File objects
    correctly. This is now fixed.
  - Some byte[] parameters to the CMP API were not being
    defensively cloned to prevent accidental changes. Extra
    defensive cloning has been added.
  - CMS primitives would sometimes convert ASN.1 definite-length
    encodings into indefinite-length encodings. The primitives
    will now try and preserve the original encoding where possible.
  - CMSSignedData.getAttributeCertificates() now properly
    restricts the tag values checked to just 1 (the obsolete
    v1 tag) and 2 (for the more current v2 certificates).
  - BCJSSE now tries to validate a custom KeyManager selection
    in order to catch errors around a key manager ignoring
    key type early.
  - Compressed streams in PGP ending with zero length partial
    packets could cause failure on parsing the OpenPGP API.
    This has been fixed.
  - The fallback mode for JceAsymmetricKeyWrapper/Unwrapper
    would lose track of any algorithm parameters generated
    in the initial attempt. The algorithm parameters are now
    propagated.
  - An accidental regression introduced by a fix for another
    issue in PKIXCertPathReviewer around use of the
    AuthorityKeyIdentifier extension and it failing to match
    a certificate uniquely when the serial number field
    is missing has been fixed.
  - An error was found in the creation of TLS 1.3 Export Keying
    Material which could cause compatibility issues. This has
    been fixed.
  * Additional Features and Functionality
  - Support has been added for OpenPGP regular expression
    signature packets.
  - Support has been added for OpenPGP PolicyURI signature
    packets.
  - A utility method has been added to PGPSecretKeyRing to allow
    for inserting or replacing a PGPPublicKey.
  - The NIST PQC Finalist, Classic McEliece has been added to the
    low level API and the BCPQC provider.
  - The NIST PQC Alternate Candidate, SPHINCS+ has been added to
    the BCPQC provider.
  - The NIST PQC Alternate Candidate, FrodoKEM has been added to
    the low level API and the BCPQC provider.
  - The NIST PQC Finalist, SABER has been added to the low level
    API and the BCPQC provider.
  - KMAC128, KMAC256 has been added to the BC provider (empty
    customization string).
  - TupleHash128, TupleHash256 has been added to the BC provider
    (empty customization string).
  - ParallelHash128, ParallelHash256 has been added to the BC
    provider (empty customization string, block size 1024 bits).
  - Two new properties: "org.bouncycastle.rsa.max_size" (default
    15360) and "org.bouncycastle.ec.fp_max_size" (default 1042)
    have been added to cap the maximum size of RSA and EC keys.
  - RSA modulus are now checked to be provably composite using
    the enhanced MR probable prime test.
  - Imported EC Fp basis values are now validated against the MR
    prime number test before use. The certainty level of the
    prime test can be determined by
    "org.bouncycastle.ec.fp_certainty" (default 100).
  - The BC entropy thread now has a specific name:
    "BC-ENTROPY-GATHERER".
  - Utility methods have been added for joining/merging PGP
    public keys and signatures.
  - Blake3-256 has been added to the BC provider.
  - DTLS: optimisation to delayed handshake hash.
  - Further additions to the ETSI 102 941 support in the ETSI/ITS
    package: certification request, signed message generation and
    verification now supported.
  - CMSSignedDataGenerator now supports the direct generation of
    definite-length data.
  - The NetscapeCertType class now has a hasUsages() method on it
    for querying usage settings on its bit string.
  - Support for additional input has been added for deterministic
    (EC)DSA.
  - The OpenPGP API provides better support for subkey
    generation.
  - BCJSSE: Added boolean system properties
    "org.bouncycastle.jsse.client.dh.disableDefaultSuites" and
    "org.bouncycastle.jsse.server.dh.disableDefaultSuites".
    Default "false". Set to "true" to disable inclusion of DH
    cipher suites in the default cipher suites for client/server
    respectively.
  * Notes
  - The deprecated QTESLA implementation has been removed from
    the BCPQC provider.
  - The submission update to SPHINCS+ has been added. This
    changes the generation of signatures - particularly
    deterministic ones.
- Version update to 1.70
  * Defects Fixed
  - Blake 3 output limit is enforced.
  - The PKCS12 KeyStore was relying on default precedence for its
    key Cipher implementation so was sometimes failing if used
    from the keytool. The KeyStore class now makes sure it uses
    the correct Cipher implementation.
  - Fixed bzip2 compression for empty contents (GH #993).
  - ASN.1: More robust handling of high tag numbers and
    definite-length forms.
  - BCJSSE: Fix a concurrent modification issue in session
    contexts (GH#968).
  - BCJSSE: Don't log sensitive system property values (GH#976).
  - BCJSSE: Fixed a priority issue amongst imperfect-match
    credentials in KeyManager classes.
  - The IES AlgorithmParameters object has been re-written to
    properly support all the variations of IESParameterSpec.
  - getOutputSize() for ECIES has been corrected to avoid
    occassional underestimates.
  - The lack of close() in the ASN.1 Dump command line utility
    was triggering false positives in some code analysis tools. A
    close() call has been added.
  - PGPPublicKey.getBitStrength() now properly recognises EdDSA
    keys.
  * Additional Features and Functionality
  - Missing PGP CRC checksums can now be optionally ignored using
    setDetectMissingCRC() (default false) on ArmoredInputStream.
  - PGPSecretKey.copyWithNewPassword() now has a variant which
    uses USAGE_SHA1 for key protection if a PGPDigestCalculator
    is passed in.
  - PGP ASCII armored data now skips "\t", "\v", and "\f".
  - PKCS12 files with duplicate localKeyId attributes on
    certificates will now have the incorrect attributes filtered
    out, rather than the duplicate causing an exception.
  - PGPObjectFactory will now ignore packets representing
    unrecognised signature versions in the input stream.
  - The X.509 extension generator will now accumulate some
    duplicate X.509 extensions into a single extension where it
    is possible to do so.
  - Removed support for maxXofLen in Kangaroo digest.
  - Ignore marker packets in PGP Public and Secret key ring
    collection.
  - An implementation of LEA has been added to the low-level API.
  - Access, recovery, and direct use for PGP session keys has
    been added to the OpenPGP API for processing encrypted data.
  - A PGPCanonicalizedDataGenerator has been added which converts
    input into canonicalized literal data for text and UTF-8
    mode.
  - A getUserKeyingMaterial() method has been added to the
    KeyAgreeRecipientInformation class.
  - ASN.1: Tagged objects (and parsers) now support all tag
    classes. Special code for ApplicationSpecific has been
    deprecated and re-implemented in terms of TaggedObject.
  - ASN.1: Improved support for nested tagging.
  - ASN.1: Added support for GraphicString, ObjectDescriptor,
    RelativeOID.
  - ASN.1: Added support for constructed BitString encodings,
    including efficient parsing for large values.
  - TLS: Added support for external PSK handshakes.
  - TLS: Check policy restrictions on key size when determining
    cipher suite support.
  - A performance issue in KeccakDigest due to left over debug
    code has been identified and dealt with.
  - BKS key stores can now be used for collecting protected keys
    (note: any attempt to store such a store will cause an
    exception).
  - A method for recovering user keying material has been added
    to KeyAgreeRecipientInformation.
  - Support has been added to the CMS API for SHA-3 based
    PLAIN-ECDSA.
  - The low level BcDefaultDigestProvider now supports the SHAKE
    family of algorithms and the SM3 alogirthm.
  - PGPKeyRingGenerator now supports creation of key-rings with
    direct-key identified keys.
  - The PQC NIST candidate, signature algorithm SPHINCS+ has been
    added to the low-level API.
  - ArmoredInputStream now explicitly checks for a '\n' if in
    crLF mode.
  - Direct support for NotationDataOccurances, Exportable,
    Revocable, IntendedRecipientFingerPrints, and AEAD algorithm
    preferences has been added to PGPSignatureSubpacketVector.
  - Further support has been added for keys described using
    S-Expressions in GPG 2.2.X.
  - Support for OpenPGP Session Keys from the (draft) Stateless
    OpenPGP CLI has been added.
  - Additional checks have been added for PGP marker packets in
    the parsing of PGP objects.
  - A CMSSignedData.addDigestAlgorithm() has been added to allow
    for adding additional digest algorithm identifiers to CMS
    SignedData structures when required.
  - Support has been added to CMS for the LMS/HSS signature
    algorithm.
  - The system property
    "org.bouncycastle.jsse.client.assumeOriginalHostName"
    (default false) has been added for dealing with SNI problems
    related to the host name not being propagate by the JVM.
  - The JcePKCSPBEOutputEncryptorBuilder now supports SCRYPT with
    ciphers that do not have algorithm parameters (e.g. AESKWP).
  - Support is now added for certificates using ETSI TS 103 097,
    "Intelligent Transport Systems (ITS)" in the bcpkix package.
  * Notes.
  - While this release should maintain source code compatibility,
    developers making use of some parts of the ASN.1 library will
    find that some classes need recompiling. Apologies for the
    inconvenience.
- Version update to 1.69
  * Defects Fixed
  - Lightweight and JCA conversion of Ed25519 keys in the PGP API
    could drop the leading byte as it was zero. This has been
    fixed.
  - Marker packets appearing at the start of PGP public key rings
    could cause parsing failure. This has been fixed.
  - ESTService could fail for some valid Content-Type headers.
    This has been fixed.
  - Originator key algorithm parameters were being passed as NULL
    in key agreement recipients. The parameters now reflect the
    value of the parameters in the key's SubjectPublicKeyInfo.
  - ContentType on encapsulated data was not been passed through
    correctly for authenticated and enveloped data. This has been
    fixed.
  - NTRUEncryptionParameters and
    NTRUEncryptionKeyGenerationParameters were not correctly
    cloning the contained message digest. This has been fixed.
  - CertificateFactory.generateCertificates()/generateCRLs()
    would throw an exception if extra data was found at the end
    of a PEM file even if valid objects had been found. Extra
    data is now ignored providing at least one object found.
  - Internal class PKIXCRLUtil could throw a NullPointerException
    for CRLs with an absent nextUpdate field. This has been
    fixed.
  - PGP ArmoredInputStream now fails earlier on malformed
    headers.
  - The McElieceKobaraImaiCipher was randomly throwing "Bad
    Padding: invalid ciphertext" exception while decrypting due
    to leading zeroes been missed during processing of the cipher
    text. This has been fixed.
  - Ed25519 keys being passed in via OpenSSH key spec are now
    validated in the KeyFactory.
  - Blowfish keys are now range checked on cipher construction.
  - In some cases PGPSecretKeyRing was failing to search its
    extraPubKeys list when searching for public keys.
  - The BasicConstraintsValidation class in the BC cert path
    validation tools has improved conformance to RFC 5280.
  - AlgorithmIdentifiers involving message digests now attempt to
    follow the latest conventions for the parameters field
    (basically DER NULL appears less).
  - Fix various conversions and interoperability for XDH and
    EdDSA between BC and SunEC providers.
  - TLS: Prevent attempts to use KeyUpdate mechanism in versions
    before TLS 1.3.
  * Additional Features and Functionality
  - GCM-SIV has been added to the lightweight API and the
    provider.
  - Blake3 has been added to the lightweight API.
  - The OpenSSL PEMParser can now be extended to add specialised
    parsers.
  - Base32 encoding has now been added, the default alphabet is
    from RFC 4648.
  - The KangarooTwelve message digest has been added to the
    lightweight API.
  - An implementation of the two FPE algorithms, FF1 and FF3-1 in
    SP 800-38G has been added to the lightweight API and the JCE
    provider.
  - An implementation of ParallelHash has been added to the
    lightweight API.
  - An implementation of TupleHash has been added to the
    lightweight API.
  - RSA-PSS now supports the use of SHAKE128 and SHAKE256 as the
    mask generation function and digest.
  - ECDSA now supports the use of SHAKE128 and SHAKE256.
  - PGPPBEEncryptedData will now reset the stream if the initial
    checksum fails so another password can be tried.
  - Iterators on public and secret key ring collections in PGP
    now reflect the original order of the public/secret key rings
    they contain.
  - KeyAgreeRecipientInformation now has a getOriginator() method
    for retrieving the underlying orginator information.
  - PGPSignature now has a getDigestPrefix() method for people
    wanting exposure to the signature finger print details.
  - The old BKS-V1 format keystore is now disabled by default. If
    you need to use BKS-V1 for legacy reasons, it can be
    re-enabled by adding: org.bouncycastle.bks.enable_v1=true to
    the java.security file. We would be interested in hearing
    from anyone that needs to do this.
  - PLAIN-ECDSA now supports the SHA3 digests.
  - Some highlevel support for RFC 4998 ERS has been added for
    ArchiveTimeStamp and EvidenceRecord. The new classes are in
    the org.bouncycastle.tsp.ers package.
  - ECIES has now also support SHA256, SHA384, and SHA512.
  - digestAlgorithms filed in CMS SignedData now includes counter
    signature digest algorithms where possible.
  - A new property "org.bouncycastle.jsse.config" has been added
    which can be used to configure the BCJSSE provider when it is
    created using the no-args constructor.
  - In line with changes in OpenSSL 1.1.0,
    OpenSSLPBEParametersGenerator can now be configured with a
    digest.
  - PGPKeyRingGenerator now includes a method for adding a subkey
    with a primary key binding signature.
  - Support for ASN.1 PRIVATE tags has been added.
  - Performance enhancements to Nokeon, AES, GCM, and
    SICBlockCipher.
  - Support for ecoding/decoding McElieceCCA2 keys has been added
    to the PQC API
  - BCJSSE: Added support for jdk.tls.maxCertificateChainLength
    system property (default is 10).
  - BCJSSE: Added support for jdk.tls.maxHandshakeMessageSize
    system property (default is 32768).
  - BCJSSE: Added support for jdk.tls.client.enableCAExtension
    (default is 'false').
  - BCJSSE: Added support for jdk.tls.client.cipherSuites system
    property.
  - BCJSSE: Added support for jdk.tls.server.cipherSuites system
    property.
  - BCJSSE: Extended ALPN support via standard JSSE API to JDK 8
    versions after u251/u252.
  - BCJSSE: Key managers now support EC credentials for use with
    TLS 1.3 ECDSA signature schemes (including brainpool).
  - TLS: Add TLS 1.3 support for brainpool curves per RFC 8734.
  * Notes
  - There is a small API change in the PKIX package to the
    DigestAlgorithmIdentifierFinder interface as a find() method
    that takes an ASN1ObjectIdentifier has been added to it. For
    people wishing to extend their own implementations, see
    DefaultDigestAlgorithmIdentifierFinder for a sample
    implementation.
  - A version of the bcmail API supporting Jakarta Mail has now
    been added (see bcjmail jar).
  - Some work has been done on moving out code that does not need
    to be in the provider jar. This has reduced the size of the
    provider jar and should also make it easier for developers to
    patch the classes involved as they no longer need to be
    signed. bcpkix and bctls are both dependent on the new bcutil
    jar.
- Add build dependencies on
  mvn(jakarta.activation:jakarta.activation-api) and
  mvn(jakarta.mail:jakarta.mail-api)
- Remove unneeded script bouncycastle_getpoms.sh from sources</changelog>
  <changelog author="pmonreal@suse.com" date="1666180800">- Update to version 1.72:
  * Defects Fixed:
  - There were parameter errors in XMSS^MT OIDs for
    XMSSMT_SHA2_40/4_256 and XMSSMT_SHA2_60/3_256. These have
    been fixed.
  - There was an error in Merkle tree construction for the
    Evidence Records (ERS) implementation which could result in
    invalid roots been timestamped. ERS now produces an
    ArchiveTimeStamp for each data object/group with an associated
    reduced hash tree. The reduced hash tree is now calculated as
    a simple path to the root of the tree for each record.
  - OpenPGP will now ignore signatures marked as non-exportable
    on encoding.
  - A tagging calculation error in GCMSIV which could result in
    incorrect tags has been fixed.
  - Issues around Java 17 which could result in failing tests
    have been addressed.
  * Additional Features and Functionality:
  - BCJSSE: TLS 1.3 is now enabled by default where no explicit
    protocols are supplied (e.g. "TLS" or "Default" SSLContext
    algorithms, or SSLContext.getDefault() method).
  - BCJSSE: Rewrite SSLEngine implementation to improve compatibility
    with SunJSSE.
  - BCJSSE: Support export of keying material via extension API.
  - (D)TLS: Add support for 'tls-exporter' channel binding per RFC 9266.
  - (D)TLS (low-level API): By default, only (D)TLS 1.2 and TLS 1.3 are
    offered now. Earlier versions are still supported if explicitly
    enabled. Users may need to check they are offering suitable
    cipher suites for TLS 1.3.
  - (D)TLS (low-level API): Add support for raw public keys per RFC 7250.
  - CryptoServicesRegistrar now has a setServicesConstraints() method
    on it which can be used to selectively turn off algorithms.
  - The NIST PQC Alternate Candidate, Picnic, has been added to the low
    level API and the BCPQC provider.
  - SPHINCS+ has been upgraded to the latest submission, SPHINCS+ 3.1
    and support for Haraka has been added.
  - Evidence records now support timestamp renewal and hash renewal.
  - The SIKE Alternative Candidate NIST Post Quantum Algorithm has
    been added to the low-level PQC API.
  - The NTRU Round 3 Finalist Candidate NIST Post Quantum Algorithm
    has been added to the low-level API and the BCPQC provider.
  - The Falcon Finalist NIST Post Quantum Algorithm has been added to
    the low-level API and the BCPQC provider.
  - The CRYSTALS-Kyber Finalist NIST Post Quantum Algorithm has been
    added to the low-level API and the BCPQC provider.
  - Argon2 Support has been added to the OpenPGP API.
  - XDH IES has now been added to the BC provider.
  - The OpenPGP API now supports AEAD encryption and decryption.
  - The NTRU Prime Alternative Candidate NIST Post Quantum Algorithms
    have been added to the low-level API and the BCPQC provider.
  - The CRYSTALS-Dilithium Finalist NIST Post Quantum Algorithm has
    been added to the low-level API and the BCPQC provider.
  - The BIKE NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - The HQC NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - Grain128AEAD has been added to the lightweight API.
  - A fast version of CRC24 has been added for use with the PGP API.
  - Some additional methods and fields have been exposed in the
    PGPOnePassSignature class to (hopefully) make it easier to
    deal with nested signatures.
  - CMP support classes have been updated to reflect the latest
    editions to the the draft RFC "Lightweight Certificate Management
    Protocol (CMP) Profile".
  - Support has been added to the PKCS#12 implementation for the
    Oracle trusted certificate attribute.
  - Performance of our BZIP2 classes has been improved.
  * Notes:
  - Keep in mind the PQC algorithms are still under development and
    we are still at least a year and a half away from published standards.
    This means the algorithms may still change so by all means experiment,
    but do not use the PQC algoritms for anything long term.
  - The legacy "Rainbow" and "McEliece" implementations have been
    removed from the BCPQC provider. The underlying classes are
    still present if required. Other legacy algorithm implementations
    can be found under the org.bouncycastle.pqc.legacy package.
  * Security Notes:
  - The PQC SIKE algorithm is provided for research purposes only.
    It should now be regarded as broken. The SIKE implementation
    will be withdrawn in BC 1.73.
  * Rebase bouncycastle-javadoc.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1682424000">- Update to version 1.73: [jsc#PED-3756]
  * Defects Fixed:
  - BCJSSE: Instantiating a JSSE provider in some contexts could
    cause an AccessControl exception.
  - The EC key pair generator can generate out of range private
    keys when used with SM2. A specific SM2KeyPairGenerator has
    been added to the low-level API and is used by
    KeyPairGenerator.getInstance("SM2", "BC"). The SM2 signer has
    been updated to check for out of range keys as well..
  - The attached signature type byte was still present in Falcon
    signatures as well as the detached signature byte.
  - There was an off-by-one error in engineGetOutputSize() for ECIES.
  - The method for invoking read() internally in BCPGInputStream
    could result in inconsistent behaviour if the class was extended.
  - Fixed a rounding issue with FF1 Format Preserving Encryption
    algorithm for certain radices.
  - Fixed RFC3394WrapEngine handling of 64 bit keys.
  - Internal buffer for blake2sp was too small and could result in
    an ArrayIndexOutOfBoundsException.
  - JCA PSS Signatures using SHAKE128 and SHAKE256 now support
    encoding of algorithm parameters.
  - PKCS10CertificationRequest now checks for empty extension
    parameters.
  - Parsing errors in the processing of PGP Armored Data now throw
    an explicit exception ArmoredInputException.
  - PGP AEAD streams could occassionally be truncated.
  - The ESTService class now supports processing of chunked HTTP data.
  - A constructed ASN.1 OCTET STRING with a single member would
    sometimes be re-encoded as a definite-length OCTET STRING. The
    encoding has been adjusted to preserve the BER status of the object.
  - PKIXCertPathReviewer could fail if the trust anchor was also
    included in the certificate store being used for path analysis.
  - UTF-8 parsing of an array range ignored the provided length.
  - IPAddress has been written to provide stricter checking and
    avoid the use of Integer.parseInt().
  - A Java 7 class snuck into the Java 5 to Java 8 build.
  * Additional Features and Functionality:
  - The Rainbow NIST Post Quantum Round-3 Candidate has been added to
    the low-level API and the BCPQC provider (level 3 and level 5
    parameter sets only).
  - The GeMSS NIST Post Quantum Round-3 Candidate has been added to
    the low-level API.
  - The org.bouncycastle.rsa.max_mr_tests property check has been
    added to allow capping of MR tests done on RSA moduli.
  - Significant performance improvements in PQC algorithms,
    especially BIKE, CMCE, Frodo, HQC, Picnic.
  - EdDSA verification now conforms to the recommendations of Taming
    the many EdDSAs, in particular cofactored verification. As a side
    benefit, Pornin's basis reduction is now used for EdDSA
    verification, giving a significant performance boost.
  - Major performance improvements for Anomalous Binary (Koblitz) Curves.
  - The lightweight Cryptography finalists Ascon, ISAP, Elephant,
    PhotonBeetle, Sparkle, and Xoodyak have been added to the
    light-weight cryptography API.
  - BLAKE2bp and BLAKE2sp have been added to the light-weight
    cryptography API.
  - Support has been added for X.509, Section 9.8, hybrid certificates
    and CRLs using alternate public keys and alternate signatures.
  - The property "org.bouncycastle.emulate.oracle" has been added to
    signal the provider should return algorithm names on some algorithms
    in the same manner as the Oracle JCE provider.
  - An extra replaceSigners method has been added to CMSSignedData
    which allows for specifying the digest algorithm IDs to be used
    in the new CMSSignedData object.
  - Parsing and re-encoding of ASN.1 PEM data has been further
    optimized to prevent unecessary conversions between basic encoding,
    definite length, and DER.
  - Support has been added for KEM ciphers in CMS in accordance with
    draft-ietf-lamps-cms-kemri
  - Support has been added for certEncr in CRMF to allow issuing of
    certificates for KEM public keys.
  - Further speedups have been made to CRC24.
  - GCMParameterSpec constructor caching has been added to improve
    performance for JVMs that have the class available.
  - The PGPEncrytedDataGenerator now supports injecting the session
    key to be used for PGP PBE encrypted data.
  - The CRMF CertificateRequestMessageBuilder now supports optional
    attributes.
  - Improvements to the s calculation in JPAKE.
  - A general purpose PQCOtherInfoGenerator has been added which
    supports all Kyber and NTRU.
  - An implementation of HPKE (RFC 9180 - Hybrid Public Key
    Encryption) has been added to the light-weight cryptography API.
  * Security Advisories:
  - The PQC implementations have now been subject to formal review for
    secret leakage and side channels, there were issues in BIKE, Falcon,
    Frodo, HQC which have now been fixed. Some weak positives also
    showed up in Rainbow, Picnic, SIKE, and GeMSS - for now this last
    set has been ignored as the algorithms will either be updated if
    they reappear in the Signature Round, or deleted, as is already the
    case for SIKE (it is now in the legacy package). Details on the
    group responsible for the testing can be found in the CONTRIBUTORS
    file.
  - For at least some ECIES variants (e.g. when using CBC) there is
    an issue with potential malleability of a nonce (implying silent
    malleability of the plaintext) that must be sent alongside the
    ciphertext but is outside the IES integrity check. For this reason
    the automatic generation of nonces with IED is now disabled and
    they have to be passed in using an IESParameterSpec. The current
    advice is to agree on a nonce between parties and then rely on the
    use of the ephemeral key component to allow the nonce (rather the
    so called nonce) usage to be extended.</changelog>
  <changelog author="pmonreal@suse.com" date="1687176000">- Update to version 1.74: [bsc#1212508, CVE-2023-33201]
  * Defects Fixed:
  - AsconEngine: Fixed a buffering bug when decrypting across
    multiple processBytes calls (ascon128a unaffected).
  - Context based sanity checking on PGP signatures has been added.
  - The ParallelHash clone constructor was not copying all fields.
  - The maximimum number of blocks for CTR/SIC modes was 1 block
    less than it should have been.
  * Additional Features and Functionality:
  - The PGP API now supports wildcard key IDs for public key
    based data encryption.
  - LMS now supports SHA256/192, SHAKE256/192, and SHAKE256/256
    (the additional SP 8000-208 parameter sets).
  - The PGP API now supports V5 and V6 AEAD encryption for
    encrypted data packets.
  - The PGP examples have been updated to reflect key size and algorithm
    changes that have occurred since they were first written (10+ years...).
  - (D)TLS: A new callback 'TlsPeer.notifyConnectionClosed' will be called
    when the connection is closed (including by failure).
  - BCJSSE: Improved logging of connection events and include unique IDs
    in connection-specific log messages.
  - BCJSSE: Server now logs the offered cipher suites when it fails to
    select one.
  - BCJSSE: Added support for SSLParameters namedGroups and
    signatureSchemes properties (can also be used via BCJSSE
    extension API in earlier Java versions).
  - DTLS: The initial handshake re-send time is now configurable by
    overriding 'TlsPeer.getHandshakeResendTimeMillis'.
  - DTLS: Added support for connection IDs per RFC 9146.
  - DTLS: Performance of DTLSVerifier has been improved so that it can
    reasonably be used for all incoming packets.
  - Initial support has been added for A Mechanism for Encoding
    Differences in Paired Certificates.
  - The PGP API now supports parsing, encoding, and fingerprinting
    of V6 EC/EdEC keys.
  - A thread safe verifier API has been added to the PGP API to support
    multi-threaded verification of certifications on keys and user IDs.
  - The number of keys/sub-keys in a PGPKeyRing can now be found by
    calling PGPKeyRing.size().
  - The PQC algorithms LMS/HSS, SPHINCS+, Dilithium, Falcon, and NTRU
    are now supported directly by the BC provider.
  * Notes:
  - The now defunct PQC SIKE algorithm has been removed, this has also
    meant the removal of its resource files so the provider is now quite
    a bit smaller.
  - As a precaution, HC128 now enforces a 128 bit IV, previous behaviour
    for shorter IVs can be supported where required by padding the IV to
    the 128 bits with zero.
  - PGP encrypted data generation now uses integrity protection by default.
    Previous behaviour for encrypted data can be supported where required
    by calling PGPDataEncryptorBuilder.setWithIntegrityPacket(false) when
    data encryption is set up.
  - There are now additional sanity checks in place to prevent accidental
    mis-use of PGPSignature objects. If this change causes any issues, you
    might want to check what your code is up to as there is probably a bug.
  * Security Advisories:
  - CVE-2023-33201: this release fixes an issue with the X509LDAPCertStoreSpi
    where a specially crafted certificate subject could be used to try and
    extract extra information out of an LDAP server with wild-card matthing
    enabled.
  * Rebase bouncycastle-javadoc.patch
  * Add bouncycastle-notests.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1697630400">- Update to version 1.76:
  * Defects Fixed:
  - Service allocation in the provider could fail due to the lack
    of a permission block. This has been fixed.
  - JceKeyFingerPrintCalculator has been generalised for different
    providers by using "SHA-256" for the algorithm string.
  - BCJSSE: Fixed a regression in 1.74 (NullPointerException) that
    prevents a BCJSSE server from negotiating TLSv1.1 or earlier.
  - DTLS: Fixed server support for client_certificate_type extension.
  - Cipher.unwrap() for HQC could fail due to a miscalculation of
    the length of the KEM packet. This has been fixed.
  - There was exposure to a Java 7 method in the Java 5 to Java 8
    BCTLS jar which could cause issues with some TLS 1.2 cipher
    suites running on older JVMs. This is now fixed.
  * Additional Features and Functionality:
  - BCJSSE: Following OpenJDK, finalizers have been removed from
    SSLSocket subclasses. Applications should close sockets and
    not rely on garbage collection.
  - BCJSSE: Added support for boolean system property
    "jdk.tls.client.useCompatibilityMode" (default "true").
  - DTLS: Added server support for session resumption.
  - JcaPKCS10CertificationRequest will now work with EC on the
    OpenJDK provider.
  - TimeStamp generation now supports the SHA3 algorithm set.
  - The SPHINCS+ simple parameters are now fully supported in the
    BCPQC provider.
  - Kyber, Classic McEliece, HQC, and Bike now supported by the
    CRMF/CMS/CMP APIs.
  - Builder classes have been add for PGP ASCII Armored streams
    allowing CRCs and versions to now be optional.
  - An UnknownPacket type has been added to the PGP APIs to allow
    for forwards compatibility with upcoming revisions to the standard.
  * Rebase patch bouncycastle-notests.patch
- Update to version 1.75:
  * Defects Fixed:
  - Several Java 8 method calls were accidentally introduced in
    the Java 5 to Java 8 build. The affected classes have been
    refactored to remove this.
  - (D)TLS: renegotiation after resumption now fixed to avoid
    breaking connection.
  * Notes:
  - The ASN.1 core package has had some dead and retired methods
    cleaned up and removed.</changelog>
  <changelog author="pmonreal@suse.com" date="1701691200">- Update to version 1.77:
  * Defects Fixed:
  - Using an unescaped '=' in an X.500 RDN would result in the
    RDN being truncated silently. The issue is now detected and
    an exception is thrown.
  - asn1.eac.CertificateBody was returning certificateEffectiveDate
    from getCertificateExpirationDate(). This has been fixed to
    return certificateExpirationDate.
  - DTLS: Fixed retransmission in response to re-receipt of an
    aggregated ChangeCipherSpec.
  - (D)TLS: Fixed compliance for supported_groups extension.
    Server will no longer negotiate an EC cipher suite using a
    default curve when the ClientHello includes the supported_groups
    extension but it contains no curves in common with the server.
    Similarly, a DH cipher suite will not be negotiated when the
    ClientHello includes supported_groups, containing at least one
    FFDHE group, but none in common with the server.
  - IllegalStateException was being thrown by Ed25519/Ed448 SignatureSpi.
  - TLS: class annotation issues that could occur between the BC
    provider and the TLS API for the GCMParameterSpec class when
    the jars were loaded on the boot class path have been addressed.
  - Attempt to create an ASN.1 OID from a zero length byte array
    is now caught at construction time.
  - Attempt to create an X.509 extension block which is empty will
    now be blocked cause an exception.
  - IES implementation will now accept a null ParameterSpec if no
    nonce is needed.
  - An internal method in Arrays was failing to construct its
    failure message correctly on an error.
  - HSSKeyPublicParameters.generateLMSContext() would fail for a
    unit depth key.
  * Additional Features and Functionality:
  - BCJSSE: Added org.bouncycastle.jsse.client.omitSigAlgsCertExtension
    and org.bouncycastle.jsse.server.omitSigAlgsCertExtension boolean
    system properties to control (for client and server resp.) whether
    the signature_algorithms_cert extension should be omitted if it
    would be identical to signature_algorithms. Defaults to true, the
    historical behaviour.
  - The low-level HPKE API now allows the sender to specify an
    ephemeral key pair.
  - Support has been added for the delta-certificate requests in line
    with the current Chameleon Cert draft from the IETF.
  - Some accommodation has been added for historical systems to
    accommodate variations in the SHA-1 digest OID for CMS SignedData.
  - TLS: the TLS API will now try "RSAwithDigestAndMFG1" as well as
    the newer RSAPSS algorithm names when used with the JCA.
  - TLS: RSA key exchange cipher suites are now disabled by default.
  - Support has been added for PKCS#10 requests to allow certificates
    using the altSignature/altPublicKey extensions.
  * Notes:
  - Kyber and Dilithium have been updated according to the latest
    draft of the standard. Dilithium-AES and Kyber-AES have now been
    removed. Kyber now produces 256 bit secrets for all parameter sets
    (in line with the draft standard).
  - NTRU has been updated to produce 256 bit secrets in line with Kyber.
  - SPHINCS+ can now be used to generate certificates in line with
    those used by (Open Quantum Safe) OQS.
  - Falcon object idenitifiers are now in line with OQS as well.
  - PQC CMS SignedData now defaults to SHA-256 for signed attributes
    rather than SHAKE-256. This is also a compatibility change, but may
    change further again as the IETF standard for CMS is updated.</changelog>
  <changelog author="pmonreal@suse.com" date="1714392000">- Update to version 1.78: [bsc#1223252, CVE-2024-30171]
  * Security Advisories.
  - CVE-2024-29857: Importing an EC certificate with specially crafted
    F2m parameters can cause high CPU usage during parameter evaluation.
  - CVE-2024-30171: Possible timing based leakage in RSA based handshakes
    due to exception processing eliminated.
  - CVE-2024-30172: Crafted signature and public key can be used to
    trigger an infinite loop in the Ed25519 verification code.
  - CVE-2024-301XX: When endpoint identification is enabled in the BCJSSE
    and an SSL socket is not created with an explicit hostname (as happens
    with HttpsURLConnection), hostname verification could be performed
    against a DNS-resolved IP address. This has been fixed.
  * Defects Fixed:
  - Issues with a dangling weak reference causing intermittent
    NullPointerExceptions in the OcspCache have been fixed.
  - Issues with non-constant time RSA operations in TLS handshakes.
  - Issue with Ed25519, Ed448 signature verification causing intermittent
    infinite loop have been fixed.
  - Issues with non-constant time ML-KEM implementation ("Kyber Slash").
  - Align ML-KEM input validation with FIPS 203 IPD requirements.
  - Make PEM parsing more forgiving of whitespace to align with RFC 7468.
  - Fix CCM length checks with large nonce sizes (n=12, n=13).
  - EAC: Fixed the CertificateBody ASN.1 type to support an optional
    Certification Authority Reference in a Certificate Request.
  - ASN.1: ObjectIdentifier (also Relative OID) parsing has been optimized
    and the contents octets for both types are now limited to 4096 bytes.
  - BCJSSE: Fixed a missing null check on the result of PrivateKey.getEncoded(),
    which could cause issues for HSM RSA keys.
  - BCJSSE: When endpoint identification is enabled and an SSL socket is not
    created with an explicit hostname (as happens with HttpsURLConnection),
    hostname verification could be performed against a DNS-resolved IP address.
  - The missing module import of java.logging to the provider module has been added.
  - GOST ASN.1 public key alg parameters are now compliant with RFC 9215.
  - An off-by-one error in the encoding for EccP256CurvePoint for ITS.
  - PEM Parser now enforces PEM headers to start at the beginning of the line
    to be meaningful.
  * Additional Features and Functionality.
  - An implementation of MLS (RFC 9420 - The Messaging Layer Security Protocol)
    has been added as a new module.
  - NTRU now supports NTRU-HPS4096-1229 and NTRU-HRSS-1373.
  - Improvements to PGP support, including Camellia key wrapping and Curve25519,
    Curve448 key types (including XDH with HKDF).
  - Added initial support for ML-KEM in TLS.
  - Added XWing hybrid KEM construction (X25519 + ML-KEM-768).
  - Introduced initial KEMSpi support (NTRU, SNTRU Prime) for JDK 21+.
  - Introduced initial composite signature support for X509 Certificates.
  - PKCS#12 now supports PKCS12-AES256-AES128, PKCS12-AES256-AES128-GCM,
    PKCS12-DEF-AES256-AES128, and PKCS12-DEF-AES256-AES128-GCM.
  - The default type for the KeyStore.getInstance("PKCS12", "BC") can now be set
    using the org.bouncycastle.pkcs12.default system/security property.
  - The PGP SExpParser will now handle Ed25519 and Ed448 keys.
  - Dilithium and Kyber key encoding updated to latest Draft RFCs
    (draft-ietf-lamps-dilithium-certificates and draft-ietf-lamps-kyber-certificates)
  - Support has been added for encryption key derivation using HKDF in CMS, see
    draft-housley-lamps-cms-cek-hkdf-sha256.
  - X500Name now recognises jurisdiction{C,ST,L} DNs.
  - CertPathValidationContext and CertificatePoliciesValidation now include
    implementations of Memoable.
  - The Composite post-quantum signatures implementation has been updated to the
    latest draft draft-ounsworth-pq-composite-sigs.
  * Full release notes: bouncycastle.org/releasenotes.html#r1rv78
  * Rebase bouncycastle-notests.patch</changelog>
  <changelog author="fstrba@suse.com" date="1714392001">- Update to version 1.78.1
  * Defects Fixed:
  - The new dependency of the the PGP API on the bcutil jar was
    missing from the module jar, the OSGi manifest, and the Maven
    POM. This has been fixed.
  - Missing exports and duplicate imports have been added/removed
    from the OSGi manifests.
  - The OSGi manifests now have the same bundle IDs as 1.77 and
    lock down dependencies to the equivalent variations
  - A check in the X.509 Extensions class preventing the parsing
    of empty extensions has been removed.</changelog>
</package>
<package pkgid="d8d44c522264af035e7bc9668ff97e4b51d8e6c03e81886fd9d59c6a56b8e610" name="bouncycastle" arch="src">
  <version epoch="0" ver="1.78.1" rel="150200.3.29.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1570881600">- Update pom files with those from Maven repository.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573041600">- Fix arch dependent macros in noarch package [bsc#1109539]</changelog>
  <changelog author="fstrba@suse.com" date="1585137600">- Added patch:
  * bouncycastle-osgi.patch
    + Add OSGi manifests to the distributed jars so that they can
    be used from eclipse</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588161600">- Version update to 1.65
  * Defects Fixed:
  - DLExternal would encode using DER encoding for tagged SETs.
  - ChaCha20Poly1305 could fail for large (&gt;~2GB) files.
  - ChaCha20Poly1305 could fail for small updates when used via the provider.
  - Properties.getPropertyValue could ignore system property when other
    local overrides set.
  - The entropy gathering thread was not running in daemon mode, meaning there
    could be a delay in an application shutting down due to it.
  - A recent change in Java 11 could cause an exception with the BC Provider's
    implementation of PSS.
  - BCJSSE: TrustManager now tolerates having no trusted certificates.
  - BCJSSE: Choice of credentials and signing algorithm now respect the peer's
    signature_algorithms extension properly.
  - BCJSSE: KeyManager for KeyStoreBuilderParameters no longer leaks memory.
  * Additional Features and Functionality:
  - LMS and HSS (RFC 8554) support has been added to the low level library and
    the PQC provider.
  - SipHash128 support has been added to the low level library and the JCE provider.
  - BCJSSE: BC API now supports explicitly specifying the session to resume.
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: Added support for extended_master_secret system properties:
    jdk.tls.allowLegacyMasterSecret, jdk.tls.allowLegacyResumption,
    jdk.tls.useExtendedMasterSecret .
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: KeyManager and TrustManager now check algorithm constraints for
    keys and certificate chains.
  - BCJSSE: KeyManager selection of server credentials now prefers matching
    SNI hostname (if any).
  - BCJSSE: KeyManager may now fallback to imperfect credentials (expired,
    SNI mismatch).
  - BCJSSE: Client-side OCSP stapling support (beta version: via status_request
    extension only, provides jdk.tls.client.enableStatusRequestExtension, and
    requires CertPathBuilder support).
  - TLS: DSA in JcaTlsCrypto now falls back to stream signing to work around
    NoneWithDSA limitations in default provider.</changelog>
  <changelog author="pmonreal@suse.com" date="1595937600">- Version update to 1.66 [bsc#1186328, CVE-2020-15522]
  * Defects Fixed:
  - EdDSA verifiers now reset correctly after rejecting overly long signatures.
  - BCJSSE: SSLSession.getPeerCertificateChain could throw NullPointerException.
  - qTESLA-I verifier would reject some valid signatures.
  - qTESLA verifiers now reject overly long signatures.
  - PGP regression caused failure to preserve existing version header when
    headers were reset.
  - PKIXNameConstraintValidator had a bad cast preventing use of multiple
    OtherName constraints.
  - Serialisation of the non-CRT RSA Private Key could cause a NullPointerException.
  - An extra 4 bytes was included in the start of HSS public key encodings.
  - CMS with Ed448 using a direct signature was using id-shake256-len
    rather than id-shake256.
  - Use of GCMParameterSpec could cause an AccessControlException under
    some circumstances.
  - DTLS: Fixed high-latency HelloVerifyRequest handshakes.
  - An encoding bug for rightEncoded() in KMAC has been fixed.
  - For a few values the cSHAKE implementation would add unnecessary pad bytes
    where the N and S strings produced encoded data that was block aligned.
  - There were a few circumstances where Argon2BytesGenerator might hit an
    unexpected null. These have been removed.
  * Additional Features and Functionality
  - The qTESLA signature algorithm has been updated to v2.8 (20191108).
  - BCJSSE: Client-side OCSP stapling now supports status_request_v2 extension.
  - Support has been added for "ocsp.enable", "ocsp.responderURL" and
    PKIXRevocationChecker for users of Java 8 and later.
  - Support has been added for "org.bouncycastle.x509.enableCRLDP" to the PKIX validator.
  - BCJSSE: Now supports system property 'jsse.enableFFDHE'
  - BCJSSE: Now supports system properties 'jdk.tls.client.SignatureSchemes'
    and 'jdk.tls.server.SignatureSchemes'.
  - Multi-release support has been added for Java 11 XECKeys.
  - Multi-release support has been added for Java 15 EdECKeys.
  - The MiscPEMGenerator will now output general PrivateKeyInfo structures.
  - A new property "org.bouncycastle.pkcs8.v1_info_only" has been added to
    make the provider only produce version 1 PKCS8 PrivateKeyInfo structures.
  - The PKIX CertPathBuilder will now take the target certificate from the target
    constraints if a specific certificate is given to the selector.
  - BCJSSE: A range of ARIA and CAMELLIA cipher suites added to supported list.
  - BCJSSE: Now supports the PSS signature schemes from RFC 8446 (TLS 1.2 onwards).
  - Performance of the Base64 encoder has been improved.
  - The PGPPublicKey class will now include direct key signatures when checking
    for key expiry times.
  * NOTES:
  - The qTESLA update breaks compatibility with previous versions.
    Private keys now include a hash of the public key at the end,
    and signatures are no longer interoperable with previous versions.</changelog>
  <changelog author="pmonreal@suse.com" date="1608552000">- Version update to 1.67 [bsc#1180215, CVE-2020-28052]
  * CVE-2020-28052: OpenBSDBCrypt.checkPassword utility method
    compared incorrect data when checking the password
  * Defects Fixed:
  - BCJSSE: SunJSSE compatibility fix - override of getChannel()
    removed and 'urgent data' behaviour should now conform to
    what the SunJSSE expects
  - Nested BER data could sometimes cause issues in octet strings
  - Certificates/CRLs with short signatures could cause an exception
    in toString() in the BC X509 Certificate implmentation
  - In line with latest changes in the JVM, SignatureSpis which
    don't require parameters now return null on engineGetParameters()
  - The RSA KeyFactory now always preferentially produces RSAPrivateCrtKey
    where it can on requests for a KeySpec based on an RSAPrivateKey
  - CMSTypedStream$FullReaderStream now handles zero length reads correctly
  - Unecessary padding was added on KMAC when the key string was block aligned
  - Zero length data would cause an unexpected exception from RFC5649WrapEngine
  - OpenBSDBcrypt was failing to handle some valid prefixes
  * Additional Features and Functionality
  - Performance improvement of Argon2 and Noekeon
  - A setSessionKeyObfuscation() method has been added to
    PublicKeyKeyEncryptionMethodGenerator to allow turning off of session key
    obfuscation (default is on, method primarily to get around early version
    GPG issues with AES-128 keys)
  - Implemented 'safegcd' constant-time modular inversion (as well as a
    variable-time variant). It has replaced Fermat inversion in all our EC
    code, and BigInteger.modInverse in several other places, particularly
    signers. This improves side-channel protection, and also gives a
    significant performance boost
  - Performance of custom binary ECC curves and Edwards Curves has been improved
  - BCJSSE: New boolean system property 'org.bouncycastle.jsse.keyManager.checkEKU'
    allows to disable ExtendedKeyUsage restrictions when selecting credentials
    (although the peer may still complain)
  - Initial support has been added for "Composite Keys and Signatures For Use
    In Internet PKI" using the test OID. Please note there will be further
    refinements to this as the draft is standardised
  - The BC EdDSA signature API now supports keys implementing all methods on
    the EdECKey and XECKey interfaces directly
  - Work has begun on classes to support the ETSI TS 103 097, Intelligent
    Transport Systems (ITS) in the bcpkix package
  - Further optimization work has been done on GCM
  - A NewHope based processor, similar to the one for Key Agreement has been
    added for trying to "quantum hard" KEM algorithms
  - PGP clear signed signatures now support SHA-224
  - Treating absent vs NULL as equivalent can now be configured by a system
    property. By default this is not enabled
  - Mode name checks in Cipher strings should now make sure an improper mode
    name always results in a NoSuchAlgorithmException
  - In line with changes in OpenSSL, the OpenSSLPBKDF now uses UTF8 encoding</changelog>
  <changelog author="fstrba@suse.com" date="1610539200">- Version update to 1.68
  * Defects Fixed:
  - Some BigIntegers utility methods would fail for
    BigInteger.ZERO. This has been fixed.
  - PGPUtil.isKeyRing() was not detecting secret sub-keys in its
    input. This has been fixed.
  - The ASN.1 class, ArchiveTimeStamp was insisting on a value
    for the optional reducedHashTree field. This has been fixed.
  - BCJSSE: Lock against multiple writers - a possible
    synchronization issue has been removed.
  * Additional Features and Functionality
  - BCJSSE: Added support for system property
    com.sun.net.ssl.requireCloseNotify. Note that we are using a
    default value of 'true'.
  - BCJSSE: 'TLSv1.3' is now a supported protocol for both client
    and server. For this release it is only enabled by default for
    the 'TLSv1.3' SSLContext, but can be explicitly enabled using
    'setEnabledProtocols' on an SSLSocket or SSLEngine, or via
    SSLParameters.
  - BCJSSE: Session resumption is now also supported for servers
    in TLS 1.2 and earlier. For this release it is disabled by
    default, and can be enabled by setting the boolean system
    property org.bouncycastle.jsse.server.enableSessionResumption
    to 'true'.
  - The provider RSA-PSS signature names that follow the JCA
    naming convention.
  - FIPS mode for the BCJSSE now enforces namedCurves for any
    presented certificates.
  - PGPSignatureSubpacketGenerator now supports editing of a
    pre-existing sub-packet list.</changelog>
  <changelog author="pmonreal@suse.com" date="1621944000">- Add bouncycastle_getpoms.sh to get pom files from Maven repos</changelog>
  <changelog author="fstrba@suse.com" date="1627387200">- Directory core/docs does not exist</changelog>
  <changelog author="fstrba@suse.com" date="1647518400">- Add glassfish-activation-api dependency so that we can build with
  JDK that does not contain the JavaEE modules</changelog>
  <changelog author="fstrba@suse.com" date="1647604800">- Build with source/target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1648641600">- Build against the standalone JavaEE modules unconditionally</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1650628800">- Version update to 1.71
  * Defects Fixed
  - In line with GPG the PGP API now attempts to preserve
    comments containing non-ascii UTF8 characters.
  - An accidental partial dependency on Java 1.7 has been removed
    from the TLS API.
  - JcaPKIXIdentityBuilder would fail to process File objects
    correctly. This is now fixed.
  - Some byte[] parameters to the CMP API were not being
    defensively cloned to prevent accidental changes. Extra
    defensive cloning has been added.
  - CMS primitives would sometimes convert ASN.1 definite-length
    encodings into indefinite-length encodings. The primitives
    will now try and preserve the original encoding where possible.
  - CMSSignedData.getAttributeCertificates() now properly
    restricts the tag values checked to just 1 (the obsolete
    v1 tag) and 2 (for the more current v2 certificates).
  - BCJSSE now tries to validate a custom KeyManager selection
    in order to catch errors around a key manager ignoring
    key type early.
  - Compressed streams in PGP ending with zero length partial
    packets could cause failure on parsing the OpenPGP API.
    This has been fixed.
  - The fallback mode for JceAsymmetricKeyWrapper/Unwrapper
    would lose track of any algorithm parameters generated
    in the initial attempt. The algorithm parameters are now
    propagated.
  - An accidental regression introduced by a fix for another
    issue in PKIXCertPathReviewer around use of the
    AuthorityKeyIdentifier extension and it failing to match
    a certificate uniquely when the serial number field
    is missing has been fixed.
  - An error was found in the creation of TLS 1.3 Export Keying
    Material which could cause compatibility issues. This has
    been fixed.
  * Additional Features and Functionality
  - Support has been added for OpenPGP regular expression
    signature packets.
  - Support has been added for OpenPGP PolicyURI signature
    packets.
  - A utility method has been added to PGPSecretKeyRing to allow
    for inserting or replacing a PGPPublicKey.
  - The NIST PQC Finalist, Classic McEliece has been added to the
    low level API and the BCPQC provider.
  - The NIST PQC Alternate Candidate, SPHINCS+ has been added to
    the BCPQC provider.
  - The NIST PQC Alternate Candidate, FrodoKEM has been added to
    the low level API and the BCPQC provider.
  - The NIST PQC Finalist, SABER has been added to the low level
    API and the BCPQC provider.
  - KMAC128, KMAC256 has been added to the BC provider (empty
    customization string).
  - TupleHash128, TupleHash256 has been added to the BC provider
    (empty customization string).
  - ParallelHash128, ParallelHash256 has been added to the BC
    provider (empty customization string, block size 1024 bits).
  - Two new properties: "org.bouncycastle.rsa.max_size" (default
    15360) and "org.bouncycastle.ec.fp_max_size" (default 1042)
    have been added to cap the maximum size of RSA and EC keys.
  - RSA modulus are now checked to be provably composite using
    the enhanced MR probable prime test.
  - Imported EC Fp basis values are now validated against the MR
    prime number test before use. The certainty level of the
    prime test can be determined by
    "org.bouncycastle.ec.fp_certainty" (default 100).
  - The BC entropy thread now has a specific name:
    "BC-ENTROPY-GATHERER".
  - Utility methods have been added for joining/merging PGP
    public keys and signatures.
  - Blake3-256 has been added to the BC provider.
  - DTLS: optimisation to delayed handshake hash.
  - Further additions to the ETSI 102 941 support in the ETSI/ITS
    package: certification request, signed message generation and
    verification now supported.
  - CMSSignedDataGenerator now supports the direct generation of
    definite-length data.
  - The NetscapeCertType class now has a hasUsages() method on it
    for querying usage settings on its bit string.
  - Support for additional input has been added for deterministic
    (EC)DSA.
  - The OpenPGP API provides better support for subkey
    generation.
  - BCJSSE: Added boolean system properties
    "org.bouncycastle.jsse.client.dh.disableDefaultSuites" and
    "org.bouncycastle.jsse.server.dh.disableDefaultSuites".
    Default "false". Set to "true" to disable inclusion of DH
    cipher suites in the default cipher suites for client/server
    respectively.
  * Notes
  - The deprecated QTESLA implementation has been removed from
    the BCPQC provider.
  - The submission update to SPHINCS+ has been added. This
    changes the generation of signatures - particularly
    deterministic ones.
- Version update to 1.70
  * Defects Fixed
  - Blake 3 output limit is enforced.
  - The PKCS12 KeyStore was relying on default precedence for its
    key Cipher implementation so was sometimes failing if used
    from the keytool. The KeyStore class now makes sure it uses
    the correct Cipher implementation.
  - Fixed bzip2 compression for empty contents (GH #993).
  - ASN.1: More robust handling of high tag numbers and
    definite-length forms.
  - BCJSSE: Fix a concurrent modification issue in session
    contexts (GH#968).
  - BCJSSE: Don't log sensitive system property values (GH#976).
  - BCJSSE: Fixed a priority issue amongst imperfect-match
    credentials in KeyManager classes.
  - The IES AlgorithmParameters object has been re-written to
    properly support all the variations of IESParameterSpec.
  - getOutputSize() for ECIES has been corrected to avoid
    occassional underestimates.
  - The lack of close() in the ASN.1 Dump command line utility
    was triggering false positives in some code analysis tools. A
    close() call has been added.
  - PGPPublicKey.getBitStrength() now properly recognises EdDSA
    keys.
  * Additional Features and Functionality
  - Missing PGP CRC checksums can now be optionally ignored using
    setDetectMissingCRC() (default false) on ArmoredInputStream.
  - PGPSecretKey.copyWithNewPassword() now has a variant which
    uses USAGE_SHA1 for key protection if a PGPDigestCalculator
    is passed in.
  - PGP ASCII armored data now skips "\t", "\v", and "\f".
  - PKCS12 files with duplicate localKeyId attributes on
    certificates will now have the incorrect attributes filtered
    out, rather than the duplicate causing an exception.
  - PGPObjectFactory will now ignore packets representing
    unrecognised signature versions in the input stream.
  - The X.509 extension generator will now accumulate some
    duplicate X.509 extensions into a single extension where it
    is possible to do so.
  - Removed support for maxXofLen in Kangaroo digest.
  - Ignore marker packets in PGP Public and Secret key ring
    collection.
  - An implementation of LEA has been added to the low-level API.
  - Access, recovery, and direct use for PGP session keys has
    been added to the OpenPGP API for processing encrypted data.
  - A PGPCanonicalizedDataGenerator has been added which converts
    input into canonicalized literal data for text and UTF-8
    mode.
  - A getUserKeyingMaterial() method has been added to the
    KeyAgreeRecipientInformation class.
  - ASN.1: Tagged objects (and parsers) now support all tag
    classes. Special code for ApplicationSpecific has been
    deprecated and re-implemented in terms of TaggedObject.
  - ASN.1: Improved support for nested tagging.
  - ASN.1: Added support for GraphicString, ObjectDescriptor,
    RelativeOID.
  - ASN.1: Added support for constructed BitString encodings,
    including efficient parsing for large values.
  - TLS: Added support for external PSK handshakes.
  - TLS: Check policy restrictions on key size when determining
    cipher suite support.
  - A performance issue in KeccakDigest due to left over debug
    code has been identified and dealt with.
  - BKS key stores can now be used for collecting protected keys
    (note: any attempt to store such a store will cause an
    exception).
  - A method for recovering user keying material has been added
    to KeyAgreeRecipientInformation.
  - Support has been added to the CMS API for SHA-3 based
    PLAIN-ECDSA.
  - The low level BcDefaultDigestProvider now supports the SHAKE
    family of algorithms and the SM3 alogirthm.
  - PGPKeyRingGenerator now supports creation of key-rings with
    direct-key identified keys.
  - The PQC NIST candidate, signature algorithm SPHINCS+ has been
    added to the low-level API.
  - ArmoredInputStream now explicitly checks for a '\n' if in
    crLF mode.
  - Direct support for NotationDataOccurances, Exportable,
    Revocable, IntendedRecipientFingerPrints, and AEAD algorithm
    preferences has been added to PGPSignatureSubpacketVector.
  - Further support has been added for keys described using
    S-Expressions in GPG 2.2.X.
  - Support for OpenPGP Session Keys from the (draft) Stateless
    OpenPGP CLI has been added.
  - Additional checks have been added for PGP marker packets in
    the parsing of PGP objects.
  - A CMSSignedData.addDigestAlgorithm() has been added to allow
    for adding additional digest algorithm identifiers to CMS
    SignedData structures when required.
  - Support has been added to CMS for the LMS/HSS signature
    algorithm.
  - The system property
    "org.bouncycastle.jsse.client.assumeOriginalHostName"
    (default false) has been added for dealing with SNI problems
    related to the host name not being propagate by the JVM.
  - The JcePKCSPBEOutputEncryptorBuilder now supports SCRYPT with
    ciphers that do not have algorithm parameters (e.g. AESKWP).
  - Support is now added for certificates using ETSI TS 103 097,
    "Intelligent Transport Systems (ITS)" in the bcpkix package.
  * Notes.
  - While this release should maintain source code compatibility,
    developers making use of some parts of the ASN.1 library will
    find that some classes need recompiling. Apologies for the
    inconvenience.
- Version update to 1.69
  * Defects Fixed
  - Lightweight and JCA conversion of Ed25519 keys in the PGP API
    could drop the leading byte as it was zero. This has been
    fixed.
  - Marker packets appearing at the start of PGP public key rings
    could cause parsing failure. This has been fixed.
  - ESTService could fail for some valid Content-Type headers.
    This has been fixed.
  - Originator key algorithm parameters were being passed as NULL
    in key agreement recipients. The parameters now reflect the
    value of the parameters in the key's SubjectPublicKeyInfo.
  - ContentType on encapsulated data was not been passed through
    correctly for authenticated and enveloped data. This has been
    fixed.
  - NTRUEncryptionParameters and
    NTRUEncryptionKeyGenerationParameters were not correctly
    cloning the contained message digest. This has been fixed.
  - CertificateFactory.generateCertificates()/generateCRLs()
    would throw an exception if extra data was found at the end
    of a PEM file even if valid objects had been found. Extra
    data is now ignored providing at least one object found.
  - Internal class PKIXCRLUtil could throw a NullPointerException
    for CRLs with an absent nextUpdate field. This has been
    fixed.
  - PGP ArmoredInputStream now fails earlier on malformed
    headers.
  - The McElieceKobaraImaiCipher was randomly throwing "Bad
    Padding: invalid ciphertext" exception while decrypting due
    to leading zeroes been missed during processing of the cipher
    text. This has been fixed.
  - Ed25519 keys being passed in via OpenSSH key spec are now
    validated in the KeyFactory.
  - Blowfish keys are now range checked on cipher construction.
  - In some cases PGPSecretKeyRing was failing to search its
    extraPubKeys list when searching for public keys.
  - The BasicConstraintsValidation class in the BC cert path
    validation tools has improved conformance to RFC 5280.
  - AlgorithmIdentifiers involving message digests now attempt to
    follow the latest conventions for the parameters field
    (basically DER NULL appears less).
  - Fix various conversions and interoperability for XDH and
    EdDSA between BC and SunEC providers.
  - TLS: Prevent attempts to use KeyUpdate mechanism in versions
    before TLS 1.3.
  * Additional Features and Functionality
  - GCM-SIV has been added to the lightweight API and the
    provider.
  - Blake3 has been added to the lightweight API.
  - The OpenSSL PEMParser can now be extended to add specialised
    parsers.
  - Base32 encoding has now been added, the default alphabet is
    from RFC 4648.
  - The KangarooTwelve message digest has been added to the
    lightweight API.
  - An implementation of the two FPE algorithms, FF1 and FF3-1 in
    SP 800-38G has been added to the lightweight API and the JCE
    provider.
  - An implementation of ParallelHash has been added to the
    lightweight API.
  - An implementation of TupleHash has been added to the
    lightweight API.
  - RSA-PSS now supports the use of SHAKE128 and SHAKE256 as the
    mask generation function and digest.
  - ECDSA now supports the use of SHAKE128 and SHAKE256.
  - PGPPBEEncryptedData will now reset the stream if the initial
    checksum fails so another password can be tried.
  - Iterators on public and secret key ring collections in PGP
    now reflect the original order of the public/secret key rings
    they contain.
  - KeyAgreeRecipientInformation now has a getOriginator() method
    for retrieving the underlying orginator information.
  - PGPSignature now has a getDigestPrefix() method for people
    wanting exposure to the signature finger print details.
  - The old BKS-V1 format keystore is now disabled by default. If
    you need to use BKS-V1 for legacy reasons, it can be
    re-enabled by adding: org.bouncycastle.bks.enable_v1=true to
    the java.security file. We would be interested in hearing
    from anyone that needs to do this.
  - PLAIN-ECDSA now supports the SHA3 digests.
  - Some highlevel support for RFC 4998 ERS has been added for
    ArchiveTimeStamp and EvidenceRecord. The new classes are in
    the org.bouncycastle.tsp.ers package.
  - ECIES has now also support SHA256, SHA384, and SHA512.
  - digestAlgorithms filed in CMS SignedData now includes counter
    signature digest algorithms where possible.
  - A new property "org.bouncycastle.jsse.config" has been added
    which can be used to configure the BCJSSE provider when it is
    created using the no-args constructor.
  - In line with changes in OpenSSL 1.1.0,
    OpenSSLPBEParametersGenerator can now be configured with a
    digest.
  - PGPKeyRingGenerator now includes a method for adding a subkey
    with a primary key binding signature.
  - Support for ASN.1 PRIVATE tags has been added.
  - Performance enhancements to Nokeon, AES, GCM, and
    SICBlockCipher.
  - Support for ecoding/decoding McElieceCCA2 keys has been added
    to the PQC API
  - BCJSSE: Added support for jdk.tls.maxCertificateChainLength
    system property (default is 10).
  - BCJSSE: Added support for jdk.tls.maxHandshakeMessageSize
    system property (default is 32768).
  - BCJSSE: Added support for jdk.tls.client.enableCAExtension
    (default is 'false').
  - BCJSSE: Added support for jdk.tls.client.cipherSuites system
    property.
  - BCJSSE: Added support for jdk.tls.server.cipherSuites system
    property.
  - BCJSSE: Extended ALPN support via standard JSSE API to JDK 8
    versions after u251/u252.
  - BCJSSE: Key managers now support EC credentials for use with
    TLS 1.3 ECDSA signature schemes (including brainpool).
  - TLS: Add TLS 1.3 support for brainpool curves per RFC 8734.
  * Notes
  - There is a small API change in the PKIX package to the
    DigestAlgorithmIdentifierFinder interface as a find() method
    that takes an ASN1ObjectIdentifier has been added to it. For
    people wishing to extend their own implementations, see
    DefaultDigestAlgorithmIdentifierFinder for a sample
    implementation.
  - A version of the bcmail API supporting Jakarta Mail has now
    been added (see bcjmail jar).
  - Some work has been done on moving out code that does not need
    to be in the provider jar. This has reduced the size of the
    provider jar and should also make it easier for developers to
    patch the classes involved as they no longer need to be
    signed. bcpkix and bctls are both dependent on the new bcutil
    jar.
- Add build dependencies on
  mvn(jakarta.activation:jakarta.activation-api) and
  mvn(jakarta.mail:jakarta.mail-api)
- Remove unneeded script bouncycastle_getpoms.sh from sources</changelog>
  <changelog author="pmonreal@suse.com" date="1666180800">- Update to version 1.72:
  * Defects Fixed:
  - There were parameter errors in XMSS^MT OIDs for
    XMSSMT_SHA2_40/4_256 and XMSSMT_SHA2_60/3_256. These have
    been fixed.
  - There was an error in Merkle tree construction for the
    Evidence Records (ERS) implementation which could result in
    invalid roots been timestamped. ERS now produces an
    ArchiveTimeStamp for each data object/group with an associated
    reduced hash tree. The reduced hash tree is now calculated as
    a simple path to the root of the tree for each record.
  - OpenPGP will now ignore signatures marked as non-exportable
    on encoding.
  - A tagging calculation error in GCMSIV which could result in
    incorrect tags has been fixed.
  - Issues around Java 17 which could result in failing tests
    have been addressed.
  * Additional Features and Functionality:
  - BCJSSE: TLS 1.3 is now enabled by default where no explicit
    protocols are supplied (e.g. "TLS" or "Default" SSLContext
    algorithms, or SSLContext.getDefault() method).
  - BCJSSE: Rewrite SSLEngine implementation to improve compatibility
    with SunJSSE.
  - BCJSSE: Support export of keying material via extension API.
  - (D)TLS: Add support for 'tls-exporter' channel binding per RFC 9266.
  - (D)TLS (low-level API): By default, only (D)TLS 1.2 and TLS 1.3 are
    offered now. Earlier versions are still supported if explicitly
    enabled. Users may need to check they are offering suitable
    cipher suites for TLS 1.3.
  - (D)TLS (low-level API): Add support for raw public keys per RFC 7250.
  - CryptoServicesRegistrar now has a setServicesConstraints() method
    on it which can be used to selectively turn off algorithms.
  - The NIST PQC Alternate Candidate, Picnic, has been added to the low
    level API and the BCPQC provider.
  - SPHINCS+ has been upgraded to the latest submission, SPHINCS+ 3.1
    and support for Haraka has been added.
  - Evidence records now support timestamp renewal and hash renewal.
  - The SIKE Alternative Candidate NIST Post Quantum Algorithm has
    been added to the low-level PQC API.
  - The NTRU Round 3 Finalist Candidate NIST Post Quantum Algorithm
    has been added to the low-level API and the BCPQC provider.
  - The Falcon Finalist NIST Post Quantum Algorithm has been added to
    the low-level API and the BCPQC provider.
  - The CRYSTALS-Kyber Finalist NIST Post Quantum Algorithm has been
    added to the low-level API and the BCPQC provider.
  - Argon2 Support has been added to the OpenPGP API.
  - XDH IES has now been added to the BC provider.
  - The OpenPGP API now supports AEAD encryption and decryption.
  - The NTRU Prime Alternative Candidate NIST Post Quantum Algorithms
    have been added to the low-level API and the BCPQC provider.
  - The CRYSTALS-Dilithium Finalist NIST Post Quantum Algorithm has
    been added to the low-level API and the BCPQC provider.
  - The BIKE NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - The HQC NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - Grain128AEAD has been added to the lightweight API.
  - A fast version of CRC24 has been added for use with the PGP API.
  - Some additional methods and fields have been exposed in the
    PGPOnePassSignature class to (hopefully) make it easier to
    deal with nested signatures.
  - CMP support classes have been updated to reflect the latest
    editions to the the draft RFC "Lightweight Certificate Management
    Protocol (CMP) Profile".
  - Support has been added to the PKCS#12 implementation for the
    Oracle trusted certificate attribute.
  - Performance of our BZIP2 classes has been improved.
  * Notes:
  - Keep in mind the PQC algorithms are still under development and
    we are still at least a year and a half away from published standards.
    This means the algorithms may still change so by all means experiment,
    but do not use the PQC algoritms for anything long term.
  - The legacy "Rainbow" and "McEliece" implementations have been
    removed from the BCPQC provider. The underlying classes are
    still present if required. Other legacy algorithm implementations
    can be found under the org.bouncycastle.pqc.legacy package.
  * Security Notes:
  - The PQC SIKE algorithm is provided for research purposes only.
    It should now be regarded as broken. The SIKE implementation
    will be withdrawn in BC 1.73.
  * Rebase bouncycastle-javadoc.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1682424000">- Update to version 1.73: [jsc#PED-3756]
  * Defects Fixed:
  - BCJSSE: Instantiating a JSSE provider in some contexts could
    cause an AccessControl exception.
  - The EC key pair generator can generate out of range private
    keys when used with SM2. A specific SM2KeyPairGenerator has
    been added to the low-level API and is used by
    KeyPairGenerator.getInstance("SM2", "BC"). The SM2 signer has
    been updated to check for out of range keys as well..
  - The attached signature type byte was still present in Falcon
    signatures as well as the detached signature byte.
  - There was an off-by-one error in engineGetOutputSize() for ECIES.
  - The method for invoking read() internally in BCPGInputStream
    could result in inconsistent behaviour if the class was extended.
  - Fixed a rounding issue with FF1 Format Preserving Encryption
    algorithm for certain radices.
  - Fixed RFC3394WrapEngine handling of 64 bit keys.
  - Internal buffer for blake2sp was too small and could result in
    an ArrayIndexOutOfBoundsException.
  - JCA PSS Signatures using SHAKE128 and SHAKE256 now support
    encoding of algorithm parameters.
  - PKCS10CertificationRequest now checks for empty extension
    parameters.
  - Parsing errors in the processing of PGP Armored Data now throw
    an explicit exception ArmoredInputException.
  - PGP AEAD streams could occassionally be truncated.
  - The ESTService class now supports processing of chunked HTTP data.
  - A constructed ASN.1 OCTET STRING with a single member would
    sometimes be re-encoded as a definite-length OCTET STRING. The
    encoding has been adjusted to preserve the BER status of the object.
  - PKIXCertPathReviewer could fail if the trust anchor was also
    included in the certificate store being used for path analysis.
  - UTF-8 parsing of an array range ignored the provided length.
  - IPAddress has been written to provide stricter checking and
    avoid the use of Integer.parseInt().
  - A Java 7 class snuck into the Java 5 to Java 8 build.
  * Additional Features and Functionality:
  - The Rainbow NIST Post Quantum Round-3 Candidate has been added to
    the low-level API and the BCPQC provider (level 3 and level 5
    parameter sets only).
  - The GeMSS NIST Post Quantum Round-3 Candidate has been added to
    the low-level API.
  - The org.bouncycastle.rsa.max_mr_tests property check has been
    added to allow capping of MR tests done on RSA moduli.
  - Significant performance improvements in PQC algorithms,
    especially BIKE, CMCE, Frodo, HQC, Picnic.
  - EdDSA verification now conforms to the recommendations of Taming
    the many EdDSAs, in particular cofactored verification. As a side
    benefit, Pornin's basis reduction is now used for EdDSA
    verification, giving a significant performance boost.
  - Major performance improvements for Anomalous Binary (Koblitz) Curves.
  - The lightweight Cryptography finalists Ascon, ISAP, Elephant,
    PhotonBeetle, Sparkle, and Xoodyak have been added to the
    light-weight cryptography API.
  - BLAKE2bp and BLAKE2sp have been added to the light-weight
    cryptography API.
  - Support has been added for X.509, Section 9.8, hybrid certificates
    and CRLs using alternate public keys and alternate signatures.
  - The property "org.bouncycastle.emulate.oracle" has been added to
    signal the provider should return algorithm names on some algorithms
    in the same manner as the Oracle JCE provider.
  - An extra replaceSigners method has been added to CMSSignedData
    which allows for specifying the digest algorithm IDs to be used
    in the new CMSSignedData object.
  - Parsing and re-encoding of ASN.1 PEM data has been further
    optimized to prevent unecessary conversions between basic encoding,
    definite length, and DER.
  - Support has been added for KEM ciphers in CMS in accordance with
    draft-ietf-lamps-cms-kemri
  - Support has been added for certEncr in CRMF to allow issuing of
    certificates for KEM public keys.
  - Further speedups have been made to CRC24.
  - GCMParameterSpec constructor caching has been added to improve
    performance for JVMs that have the class available.
  - The PGPEncrytedDataGenerator now supports injecting the session
    key to be used for PGP PBE encrypted data.
  - The CRMF CertificateRequestMessageBuilder now supports optional
    attributes.
  - Improvements to the s calculation in JPAKE.
  - A general purpose PQCOtherInfoGenerator has been added which
    supports all Kyber and NTRU.
  - An implementation of HPKE (RFC 9180 - Hybrid Public Key
    Encryption) has been added to the light-weight cryptography API.
  * Security Advisories:
  - The PQC implementations have now been subject to formal review for
    secret leakage and side channels, there were issues in BIKE, Falcon,
    Frodo, HQC which have now been fixed. Some weak positives also
    showed up in Rainbow, Picnic, SIKE, and GeMSS - for now this last
    set has been ignored as the algorithms will either be updated if
    they reappear in the Signature Round, or deleted, as is already the
    case for SIKE (it is now in the legacy package). Details on the
    group responsible for the testing can be found in the CONTRIBUTORS
    file.
  - For at least some ECIES variants (e.g. when using CBC) there is
    an issue with potential malleability of a nonce (implying silent
    malleability of the plaintext) that must be sent alongside the
    ciphertext but is outside the IES integrity check. For this reason
    the automatic generation of nonces with IED is now disabled and
    they have to be passed in using an IESParameterSpec. The current
    advice is to agree on a nonce between parties and then rely on the
    use of the ephemeral key component to allow the nonce (rather the
    so called nonce) usage to be extended.</changelog>
  <changelog author="pmonreal@suse.com" date="1687176000">- Update to version 1.74: [bsc#1212508, CVE-2023-33201]
  * Defects Fixed:
  - AsconEngine: Fixed a buffering bug when decrypting across
    multiple processBytes calls (ascon128a unaffected).
  - Context based sanity checking on PGP signatures has been added.
  - The ParallelHash clone constructor was not copying all fields.
  - The maximimum number of blocks for CTR/SIC modes was 1 block
    less than it should have been.
  * Additional Features and Functionality:
  - The PGP API now supports wildcard key IDs for public key
    based data encryption.
  - LMS now supports SHA256/192, SHAKE256/192, and SHAKE256/256
    (the additional SP 8000-208 parameter sets).
  - The PGP API now supports V5 and V6 AEAD encryption for
    encrypted data packets.
  - The PGP examples have been updated to reflect key size and algorithm
    changes that have occurred since they were first written (10+ years...).
  - (D)TLS: A new callback 'TlsPeer.notifyConnectionClosed' will be called
    when the connection is closed (including by failure).
  - BCJSSE: Improved logging of connection events and include unique IDs
    in connection-specific log messages.
  - BCJSSE: Server now logs the offered cipher suites when it fails to
    select one.
  - BCJSSE: Added support for SSLParameters namedGroups and
    signatureSchemes properties (can also be used via BCJSSE
    extension API in earlier Java versions).
  - DTLS: The initial handshake re-send time is now configurable by
    overriding 'TlsPeer.getHandshakeResendTimeMillis'.
  - DTLS: Added support for connection IDs per RFC 9146.
  - DTLS: Performance of DTLSVerifier has been improved so that it can
    reasonably be used for all incoming packets.
  - Initial support has been added for A Mechanism for Encoding
    Differences in Paired Certificates.
  - The PGP API now supports parsing, encoding, and fingerprinting
    of V6 EC/EdEC keys.
  - A thread safe verifier API has been added to the PGP API to support
    multi-threaded verification of certifications on keys and user IDs.
  - The number of keys/sub-keys in a PGPKeyRing can now be found by
    calling PGPKeyRing.size().
  - The PQC algorithms LMS/HSS, SPHINCS+, Dilithium, Falcon, and NTRU
    are now supported directly by the BC provider.
  * Notes:
  - The now defunct PQC SIKE algorithm has been removed, this has also
    meant the removal of its resource files so the provider is now quite
    a bit smaller.
  - As a precaution, HC128 now enforces a 128 bit IV, previous behaviour
    for shorter IVs can be supported where required by padding the IV to
    the 128 bits with zero.
  - PGP encrypted data generation now uses integrity protection by default.
    Previous behaviour for encrypted data can be supported where required
    by calling PGPDataEncryptorBuilder.setWithIntegrityPacket(false) when
    data encryption is set up.
  - There are now additional sanity checks in place to prevent accidental
    mis-use of PGPSignature objects. If this change causes any issues, you
    might want to check what your code is up to as there is probably a bug.
  * Security Advisories:
  - CVE-2023-33201: this release fixes an issue with the X509LDAPCertStoreSpi
    where a specially crafted certificate subject could be used to try and
    extract extra information out of an LDAP server with wild-card matthing
    enabled.
  * Rebase bouncycastle-javadoc.patch
  * Add bouncycastle-notests.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1697630400">- Update to version 1.76:
  * Defects Fixed:
  - Service allocation in the provider could fail due to the lack
    of a permission block. This has been fixed.
  - JceKeyFingerPrintCalculator has been generalised for different
    providers by using "SHA-256" for the algorithm string.
  - BCJSSE: Fixed a regression in 1.74 (NullPointerException) that
    prevents a BCJSSE server from negotiating TLSv1.1 or earlier.
  - DTLS: Fixed server support for client_certificate_type extension.
  - Cipher.unwrap() for HQC could fail due to a miscalculation of
    the length of the KEM packet. This has been fixed.
  - There was exposure to a Java 7 method in the Java 5 to Java 8
    BCTLS jar which could cause issues with some TLS 1.2 cipher
    suites running on older JVMs. This is now fixed.
  * Additional Features and Functionality:
  - BCJSSE: Following OpenJDK, finalizers have been removed from
    SSLSocket subclasses. Applications should close sockets and
    not rely on garbage collection.
  - BCJSSE: Added support for boolean system property
    "jdk.tls.client.useCompatibilityMode" (default "true").
  - DTLS: Added server support for session resumption.
  - JcaPKCS10CertificationRequest will now work with EC on the
    OpenJDK provider.
  - TimeStamp generation now supports the SHA3 algorithm set.
  - The SPHINCS+ simple parameters are now fully supported in the
    BCPQC provider.
  - Kyber, Classic McEliece, HQC, and Bike now supported by the
    CRMF/CMS/CMP APIs.
  - Builder classes have been add for PGP ASCII Armored streams
    allowing CRCs and versions to now be optional.
  - An UnknownPacket type has been added to the PGP APIs to allow
    for forwards compatibility with upcoming revisions to the standard.
  * Rebase patch bouncycastle-notests.patch
- Update to version 1.75:
  * Defects Fixed:
  - Several Java 8 method calls were accidentally introduced in
    the Java 5 to Java 8 build. The affected classes have been
    refactored to remove this.
  - (D)TLS: renegotiation after resumption now fixed to avoid
    breaking connection.
  * Notes:
  - The ASN.1 core package has had some dead and retired methods
    cleaned up and removed.</changelog>
  <changelog author="pmonreal@suse.com" date="1701691200">- Update to version 1.77:
  * Defects Fixed:
  - Using an unescaped '=' in an X.500 RDN would result in the
    RDN being truncated silently. The issue is now detected and
    an exception is thrown.
  - asn1.eac.CertificateBody was returning certificateEffectiveDate
    from getCertificateExpirationDate(). This has been fixed to
    return certificateExpirationDate.
  - DTLS: Fixed retransmission in response to re-receipt of an
    aggregated ChangeCipherSpec.
  - (D)TLS: Fixed compliance for supported_groups extension.
    Server will no longer negotiate an EC cipher suite using a
    default curve when the ClientHello includes the supported_groups
    extension but it contains no curves in common with the server.
    Similarly, a DH cipher suite will not be negotiated when the
    ClientHello includes supported_groups, containing at least one
    FFDHE group, but none in common with the server.
  - IllegalStateException was being thrown by Ed25519/Ed448 SignatureSpi.
  - TLS: class annotation issues that could occur between the BC
    provider and the TLS API for the GCMParameterSpec class when
    the jars were loaded on the boot class path have been addressed.
  - Attempt to create an ASN.1 OID from a zero length byte array
    is now caught at construction time.
  - Attempt to create an X.509 extension block which is empty will
    now be blocked cause an exception.
  - IES implementation will now accept a null ParameterSpec if no
    nonce is needed.
  - An internal method in Arrays was failing to construct its
    failure message correctly on an error.
  - HSSKeyPublicParameters.generateLMSContext() would fail for a
    unit depth key.
  * Additional Features and Functionality:
  - BCJSSE: Added org.bouncycastle.jsse.client.omitSigAlgsCertExtension
    and org.bouncycastle.jsse.server.omitSigAlgsCertExtension boolean
    system properties to control (for client and server resp.) whether
    the signature_algorithms_cert extension should be omitted if it
    would be identical to signature_algorithms. Defaults to true, the
    historical behaviour.
  - The low-level HPKE API now allows the sender to specify an
    ephemeral key pair.
  - Support has been added for the delta-certificate requests in line
    with the current Chameleon Cert draft from the IETF.
  - Some accommodation has been added for historical systems to
    accommodate variations in the SHA-1 digest OID for CMS SignedData.
  - TLS: the TLS API will now try "RSAwithDigestAndMFG1" as well as
    the newer RSAPSS algorithm names when used with the JCA.
  - TLS: RSA key exchange cipher suites are now disabled by default.
  - Support has been added for PKCS#10 requests to allow certificates
    using the altSignature/altPublicKey extensions.
  * Notes:
  - Kyber and Dilithium have been updated according to the latest
    draft of the standard. Dilithium-AES and Kyber-AES have now been
    removed. Kyber now produces 256 bit secrets for all parameter sets
    (in line with the draft standard).
  - NTRU has been updated to produce 256 bit secrets in line with Kyber.
  - SPHINCS+ can now be used to generate certificates in line with
    those used by (Open Quantum Safe) OQS.
  - Falcon object idenitifiers are now in line with OQS as well.
  - PQC CMS SignedData now defaults to SHA-256 for signed attributes
    rather than SHAKE-256. This is also a compatibility change, but may
    change further again as the IETF standard for CMS is updated.</changelog>
  <changelog author="pmonreal@suse.com" date="1714392000">- Update to version 1.78: [bsc#1223252, CVE-2024-30171]
  * Security Advisories.
  - CVE-2024-29857: Importing an EC certificate with specially crafted
    F2m parameters can cause high CPU usage during parameter evaluation.
  - CVE-2024-30171: Possible timing based leakage in RSA based handshakes
    due to exception processing eliminated.
  - CVE-2024-30172: Crafted signature and public key can be used to
    trigger an infinite loop in the Ed25519 verification code.
  - CVE-2024-301XX: When endpoint identification is enabled in the BCJSSE
    and an SSL socket is not created with an explicit hostname (as happens
    with HttpsURLConnection), hostname verification could be performed
    against a DNS-resolved IP address. This has been fixed.
  * Defects Fixed:
  - Issues with a dangling weak reference causing intermittent
    NullPointerExceptions in the OcspCache have been fixed.
  - Issues with non-constant time RSA operations in TLS handshakes.
  - Issue with Ed25519, Ed448 signature verification causing intermittent
    infinite loop have been fixed.
  - Issues with non-constant time ML-KEM implementation ("Kyber Slash").
  - Align ML-KEM input validation with FIPS 203 IPD requirements.
  - Make PEM parsing more forgiving of whitespace to align with RFC 7468.
  - Fix CCM length checks with large nonce sizes (n=12, n=13).
  - EAC: Fixed the CertificateBody ASN.1 type to support an optional
    Certification Authority Reference in a Certificate Request.
  - ASN.1: ObjectIdentifier (also Relative OID) parsing has been optimized
    and the contents octets for both types are now limited to 4096 bytes.
  - BCJSSE: Fixed a missing null check on the result of PrivateKey.getEncoded(),
    which could cause issues for HSM RSA keys.
  - BCJSSE: When endpoint identification is enabled and an SSL socket is not
    created with an explicit hostname (as happens with HttpsURLConnection),
    hostname verification could be performed against a DNS-resolved IP address.
  - The missing module import of java.logging to the provider module has been added.
  - GOST ASN.1 public key alg parameters are now compliant with RFC 9215.
  - An off-by-one error in the encoding for EccP256CurvePoint for ITS.
  - PEM Parser now enforces PEM headers to start at the beginning of the line
    to be meaningful.
  * Additional Features and Functionality.
  - An implementation of MLS (RFC 9420 - The Messaging Layer Security Protocol)
    has been added as a new module.
  - NTRU now supports NTRU-HPS4096-1229 and NTRU-HRSS-1373.
  - Improvements to PGP support, including Camellia key wrapping and Curve25519,
    Curve448 key types (including XDH with HKDF).
  - Added initial support for ML-KEM in TLS.
  - Added XWing hybrid KEM construction (X25519 + ML-KEM-768).
  - Introduced initial KEMSpi support (NTRU, SNTRU Prime) for JDK 21+.
  - Introduced initial composite signature support for X509 Certificates.
  - PKCS#12 now supports PKCS12-AES256-AES128, PKCS12-AES256-AES128-GCM,
    PKCS12-DEF-AES256-AES128, and PKCS12-DEF-AES256-AES128-GCM.
  - The default type for the KeyStore.getInstance("PKCS12", "BC") can now be set
    using the org.bouncycastle.pkcs12.default system/security property.
  - The PGP SExpParser will now handle Ed25519 and Ed448 keys.
  - Dilithium and Kyber key encoding updated to latest Draft RFCs
    (draft-ietf-lamps-dilithium-certificates and draft-ietf-lamps-kyber-certificates)
  - Support has been added for encryption key derivation using HKDF in CMS, see
    draft-housley-lamps-cms-cek-hkdf-sha256.
  - X500Name now recognises jurisdiction{C,ST,L} DNs.
  - CertPathValidationContext and CertificatePoliciesValidation now include
    implementations of Memoable.
  - The Composite post-quantum signatures implementation has been updated to the
    latest draft draft-ounsworth-pq-composite-sigs.
  * Full release notes: bouncycastle.org/releasenotes.html#r1rv78
  * Rebase bouncycastle-notests.patch</changelog>
  <changelog author="fstrba@suse.com" date="1714392001">- Update to version 1.78.1
  * Defects Fixed:
  - The new dependency of the the PGP API on the bcutil jar was
    missing from the module jar, the OSGi manifest, and the Maven
    POM. This has been fixed.
  - Missing exports and duplicate imports have been added/removed
    from the OSGi manifests.
  - The OSGi manifests now have the same bundle IDs as 1.77 and
    lock down dependencies to the equivalent variations
  - A check in the X.509 Extensions class preventing the parsing
    of empty extensions has been removed.</changelog>
</package>
<package pkgid="f10c2c33174e8abadb9c558905010413123a647ab2f059e2245fb701c74347cc" name="bouncycastle-javadoc" arch="noarch">
  <version epoch="0" ver="1.78.1" rel="150200.3.29.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1570881600">- Update pom files with those from Maven repository.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573041600">- Fix arch dependent macros in noarch package [bsc#1109539]</changelog>
  <changelog author="fstrba@suse.com" date="1585137600">- Added patch:
  * bouncycastle-osgi.patch
    + Add OSGi manifests to the distributed jars so that they can
    be used from eclipse</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588161600">- Version update to 1.65
  * Defects Fixed:
  - DLExternal would encode using DER encoding for tagged SETs.
  - ChaCha20Poly1305 could fail for large (&gt;~2GB) files.
  - ChaCha20Poly1305 could fail for small updates when used via the provider.
  - Properties.getPropertyValue could ignore system property when other
    local overrides set.
  - The entropy gathering thread was not running in daemon mode, meaning there
    could be a delay in an application shutting down due to it.
  - A recent change in Java 11 could cause an exception with the BC Provider's
    implementation of PSS.
  - BCJSSE: TrustManager now tolerates having no trusted certificates.
  - BCJSSE: Choice of credentials and signing algorithm now respect the peer's
    signature_algorithms extension properly.
  - BCJSSE: KeyManager for KeyStoreBuilderParameters no longer leaks memory.
  * Additional Features and Functionality:
  - LMS and HSS (RFC 8554) support has been added to the low level library and
    the PQC provider.
  - SipHash128 support has been added to the low level library and the JCE provider.
  - BCJSSE: BC API now supports explicitly specifying the session to resume.
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: Added support for extended_master_secret system properties:
    jdk.tls.allowLegacyMasterSecret, jdk.tls.allowLegacyResumption,
    jdk.tls.useExtendedMasterSecret .
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: KeyManager and TrustManager now check algorithm constraints for
    keys and certificate chains.
  - BCJSSE: KeyManager selection of server credentials now prefers matching
    SNI hostname (if any).
  - BCJSSE: KeyManager may now fallback to imperfect credentials (expired,
    SNI mismatch).
  - BCJSSE: Client-side OCSP stapling support (beta version: via status_request
    extension only, provides jdk.tls.client.enableStatusRequestExtension, and
    requires CertPathBuilder support).
  - TLS: DSA in JcaTlsCrypto now falls back to stream signing to work around
    NoneWithDSA limitations in default provider.</changelog>
  <changelog author="pmonreal@suse.com" date="1595937600">- Version update to 1.66 [bsc#1186328, CVE-2020-15522]
  * Defects Fixed:
  - EdDSA verifiers now reset correctly after rejecting overly long signatures.
  - BCJSSE: SSLSession.getPeerCertificateChain could throw NullPointerException.
  - qTESLA-I verifier would reject some valid signatures.
  - qTESLA verifiers now reject overly long signatures.
  - PGP regression caused failure to preserve existing version header when
    headers were reset.
  - PKIXNameConstraintValidator had a bad cast preventing use of multiple
    OtherName constraints.
  - Serialisation of the non-CRT RSA Private Key could cause a NullPointerException.
  - An extra 4 bytes was included in the start of HSS public key encodings.
  - CMS with Ed448 using a direct signature was using id-shake256-len
    rather than id-shake256.
  - Use of GCMParameterSpec could cause an AccessControlException under
    some circumstances.
  - DTLS: Fixed high-latency HelloVerifyRequest handshakes.
  - An encoding bug for rightEncoded() in KMAC has been fixed.
  - For a few values the cSHAKE implementation would add unnecessary pad bytes
    where the N and S strings produced encoded data that was block aligned.
  - There were a few circumstances where Argon2BytesGenerator might hit an
    unexpected null. These have been removed.
  * Additional Features and Functionality
  - The qTESLA signature algorithm has been updated to v2.8 (20191108).
  - BCJSSE: Client-side OCSP stapling now supports status_request_v2 extension.
  - Support has been added for "ocsp.enable", "ocsp.responderURL" and
    PKIXRevocationChecker for users of Java 8 and later.
  - Support has been added for "org.bouncycastle.x509.enableCRLDP" to the PKIX validator.
  - BCJSSE: Now supports system property 'jsse.enableFFDHE'
  - BCJSSE: Now supports system properties 'jdk.tls.client.SignatureSchemes'
    and 'jdk.tls.server.SignatureSchemes'.
  - Multi-release support has been added for Java 11 XECKeys.
  - Multi-release support has been added for Java 15 EdECKeys.
  - The MiscPEMGenerator will now output general PrivateKeyInfo structures.
  - A new property "org.bouncycastle.pkcs8.v1_info_only" has been added to
    make the provider only produce version 1 PKCS8 PrivateKeyInfo structures.
  - The PKIX CertPathBuilder will now take the target certificate from the target
    constraints if a specific certificate is given to the selector.
  - BCJSSE: A range of ARIA and CAMELLIA cipher suites added to supported list.
  - BCJSSE: Now supports the PSS signature schemes from RFC 8446 (TLS 1.2 onwards).
  - Performance of the Base64 encoder has been improved.
  - The PGPPublicKey class will now include direct key signatures when checking
    for key expiry times.
  * NOTES:
  - The qTESLA update breaks compatibility with previous versions.
    Private keys now include a hash of the public key at the end,
    and signatures are no longer interoperable with previous versions.</changelog>
  <changelog author="pmonreal@suse.com" date="1608552000">- Version update to 1.67 [bsc#1180215, CVE-2020-28052]
  * CVE-2020-28052: OpenBSDBCrypt.checkPassword utility method
    compared incorrect data when checking the password
  * Defects Fixed:
  - BCJSSE: SunJSSE compatibility fix - override of getChannel()
    removed and 'urgent data' behaviour should now conform to
    what the SunJSSE expects
  - Nested BER data could sometimes cause issues in octet strings
  - Certificates/CRLs with short signatures could cause an exception
    in toString() in the BC X509 Certificate implmentation
  - In line with latest changes in the JVM, SignatureSpis which
    don't require parameters now return null on engineGetParameters()
  - The RSA KeyFactory now always preferentially produces RSAPrivateCrtKey
    where it can on requests for a KeySpec based on an RSAPrivateKey
  - CMSTypedStream$FullReaderStream now handles zero length reads correctly
  - Unecessary padding was added on KMAC when the key string was block aligned
  - Zero length data would cause an unexpected exception from RFC5649WrapEngine
  - OpenBSDBcrypt was failing to handle some valid prefixes
  * Additional Features and Functionality
  - Performance improvement of Argon2 and Noekeon
  - A setSessionKeyObfuscation() method has been added to
    PublicKeyKeyEncryptionMethodGenerator to allow turning off of session key
    obfuscation (default is on, method primarily to get around early version
    GPG issues with AES-128 keys)
  - Implemented 'safegcd' constant-time modular inversion (as well as a
    variable-time variant). It has replaced Fermat inversion in all our EC
    code, and BigInteger.modInverse in several other places, particularly
    signers. This improves side-channel protection, and also gives a
    significant performance boost
  - Performance of custom binary ECC curves and Edwards Curves has been improved
  - BCJSSE: New boolean system property 'org.bouncycastle.jsse.keyManager.checkEKU'
    allows to disable ExtendedKeyUsage restrictions when selecting credentials
    (although the peer may still complain)
  - Initial support has been added for "Composite Keys and Signatures For Use
    In Internet PKI" using the test OID. Please note there will be further
    refinements to this as the draft is standardised
  - The BC EdDSA signature API now supports keys implementing all methods on
    the EdECKey and XECKey interfaces directly
  - Work has begun on classes to support the ETSI TS 103 097, Intelligent
    Transport Systems (ITS) in the bcpkix package
  - Further optimization work has been done on GCM
  - A NewHope based processor, similar to the one for Key Agreement has been
    added for trying to "quantum hard" KEM algorithms
  - PGP clear signed signatures now support SHA-224
  - Treating absent vs NULL as equivalent can now be configured by a system
    property. By default this is not enabled
  - Mode name checks in Cipher strings should now make sure an improper mode
    name always results in a NoSuchAlgorithmException
  - In line with changes in OpenSSL, the OpenSSLPBKDF now uses UTF8 encoding</changelog>
  <changelog author="fstrba@suse.com" date="1610539200">- Version update to 1.68
  * Defects Fixed:
  - Some BigIntegers utility methods would fail for
    BigInteger.ZERO. This has been fixed.
  - PGPUtil.isKeyRing() was not detecting secret sub-keys in its
    input. This has been fixed.
  - The ASN.1 class, ArchiveTimeStamp was insisting on a value
    for the optional reducedHashTree field. This has been fixed.
  - BCJSSE: Lock against multiple writers - a possible
    synchronization issue has been removed.
  * Additional Features and Functionality
  - BCJSSE: Added support for system property
    com.sun.net.ssl.requireCloseNotify. Note that we are using a
    default value of 'true'.
  - BCJSSE: 'TLSv1.3' is now a supported protocol for both client
    and server. For this release it is only enabled by default for
    the 'TLSv1.3' SSLContext, but can be explicitly enabled using
    'setEnabledProtocols' on an SSLSocket or SSLEngine, or via
    SSLParameters.
  - BCJSSE: Session resumption is now also supported for servers
    in TLS 1.2 and earlier. For this release it is disabled by
    default, and can be enabled by setting the boolean system
    property org.bouncycastle.jsse.server.enableSessionResumption
    to 'true'.
  - The provider RSA-PSS signature names that follow the JCA
    naming convention.
  - FIPS mode for the BCJSSE now enforces namedCurves for any
    presented certificates.
  - PGPSignatureSubpacketGenerator now supports editing of a
    pre-existing sub-packet list.</changelog>
  <changelog author="pmonreal@suse.com" date="1621944000">- Add bouncycastle_getpoms.sh to get pom files from Maven repos</changelog>
  <changelog author="fstrba@suse.com" date="1627387200">- Directory core/docs does not exist</changelog>
  <changelog author="fstrba@suse.com" date="1647518400">- Add glassfish-activation-api dependency so that we can build with
  JDK that does not contain the JavaEE modules</changelog>
  <changelog author="fstrba@suse.com" date="1647604800">- Build with source/target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1648641600">- Build against the standalone JavaEE modules unconditionally</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1650628800">- Version update to 1.71
  * Defects Fixed
  - In line with GPG the PGP API now attempts to preserve
    comments containing non-ascii UTF8 characters.
  - An accidental partial dependency on Java 1.7 has been removed
    from the TLS API.
  - JcaPKIXIdentityBuilder would fail to process File objects
    correctly. This is now fixed.
  - Some byte[] parameters to the CMP API were not being
    defensively cloned to prevent accidental changes. Extra
    defensive cloning has been added.
  - CMS primitives would sometimes convert ASN.1 definite-length
    encodings into indefinite-length encodings. The primitives
    will now try and preserve the original encoding where possible.
  - CMSSignedData.getAttributeCertificates() now properly
    restricts the tag values checked to just 1 (the obsolete
    v1 tag) and 2 (for the more current v2 certificates).
  - BCJSSE now tries to validate a custom KeyManager selection
    in order to catch errors around a key manager ignoring
    key type early.
  - Compressed streams in PGP ending with zero length partial
    packets could cause failure on parsing the OpenPGP API.
    This has been fixed.
  - The fallback mode for JceAsymmetricKeyWrapper/Unwrapper
    would lose track of any algorithm parameters generated
    in the initial attempt. The algorithm parameters are now
    propagated.
  - An accidental regression introduced by a fix for another
    issue in PKIXCertPathReviewer around use of the
    AuthorityKeyIdentifier extension and it failing to match
    a certificate uniquely when the serial number field
    is missing has been fixed.
  - An error was found in the creation of TLS 1.3 Export Keying
    Material which could cause compatibility issues. This has
    been fixed.
  * Additional Features and Functionality
  - Support has been added for OpenPGP regular expression
    signature packets.
  - Support has been added for OpenPGP PolicyURI signature
    packets.
  - A utility method has been added to PGPSecretKeyRing to allow
    for inserting or replacing a PGPPublicKey.
  - The NIST PQC Finalist, Classic McEliece has been added to the
    low level API and the BCPQC provider.
  - The NIST PQC Alternate Candidate, SPHINCS+ has been added to
    the BCPQC provider.
  - The NIST PQC Alternate Candidate, FrodoKEM has been added to
    the low level API and the BCPQC provider.
  - The NIST PQC Finalist, SABER has been added to the low level
    API and the BCPQC provider.
  - KMAC128, KMAC256 has been added to the BC provider (empty
    customization string).
  - TupleHash128, TupleHash256 has been added to the BC provider
    (empty customization string).
  - ParallelHash128, ParallelHash256 has been added to the BC
    provider (empty customization string, block size 1024 bits).
  - Two new properties: "org.bouncycastle.rsa.max_size" (default
    15360) and "org.bouncycastle.ec.fp_max_size" (default 1042)
    have been added to cap the maximum size of RSA and EC keys.
  - RSA modulus are now checked to be provably composite using
    the enhanced MR probable prime test.
  - Imported EC Fp basis values are now validated against the MR
    prime number test before use. The certainty level of the
    prime test can be determined by
    "org.bouncycastle.ec.fp_certainty" (default 100).
  - The BC entropy thread now has a specific name:
    "BC-ENTROPY-GATHERER".
  - Utility methods have been added for joining/merging PGP
    public keys and signatures.
  - Blake3-256 has been added to the BC provider.
  - DTLS: optimisation to delayed handshake hash.
  - Further additions to the ETSI 102 941 support in the ETSI/ITS
    package: certification request, signed message generation and
    verification now supported.
  - CMSSignedDataGenerator now supports the direct generation of
    definite-length data.
  - The NetscapeCertType class now has a hasUsages() method on it
    for querying usage settings on its bit string.
  - Support for additional input has been added for deterministic
    (EC)DSA.
  - The OpenPGP API provides better support for subkey
    generation.
  - BCJSSE: Added boolean system properties
    "org.bouncycastle.jsse.client.dh.disableDefaultSuites" and
    "org.bouncycastle.jsse.server.dh.disableDefaultSuites".
    Default "false". Set to "true" to disable inclusion of DH
    cipher suites in the default cipher suites for client/server
    respectively.
  * Notes
  - The deprecated QTESLA implementation has been removed from
    the BCPQC provider.
  - The submission update to SPHINCS+ has been added. This
    changes the generation of signatures - particularly
    deterministic ones.
- Version update to 1.70
  * Defects Fixed
  - Blake 3 output limit is enforced.
  - The PKCS12 KeyStore was relying on default precedence for its
    key Cipher implementation so was sometimes failing if used
    from the keytool. The KeyStore class now makes sure it uses
    the correct Cipher implementation.
  - Fixed bzip2 compression for empty contents (GH #993).
  - ASN.1: More robust handling of high tag numbers and
    definite-length forms.
  - BCJSSE: Fix a concurrent modification issue in session
    contexts (GH#968).
  - BCJSSE: Don't log sensitive system property values (GH#976).
  - BCJSSE: Fixed a priority issue amongst imperfect-match
    credentials in KeyManager classes.
  - The IES AlgorithmParameters object has been re-written to
    properly support all the variations of IESParameterSpec.
  - getOutputSize() for ECIES has been corrected to avoid
    occassional underestimates.
  - The lack of close() in the ASN.1 Dump command line utility
    was triggering false positives in some code analysis tools. A
    close() call has been added.
  - PGPPublicKey.getBitStrength() now properly recognises EdDSA
    keys.
  * Additional Features and Functionality
  - Missing PGP CRC checksums can now be optionally ignored using
    setDetectMissingCRC() (default false) on ArmoredInputStream.
  - PGPSecretKey.copyWithNewPassword() now has a variant which
    uses USAGE_SHA1 for key protection if a PGPDigestCalculator
    is passed in.
  - PGP ASCII armored data now skips "\t", "\v", and "\f".
  - PKCS12 files with duplicate localKeyId attributes on
    certificates will now have the incorrect attributes filtered
    out, rather than the duplicate causing an exception.
  - PGPObjectFactory will now ignore packets representing
    unrecognised signature versions in the input stream.
  - The X.509 extension generator will now accumulate some
    duplicate X.509 extensions into a single extension where it
    is possible to do so.
  - Removed support for maxXofLen in Kangaroo digest.
  - Ignore marker packets in PGP Public and Secret key ring
    collection.
  - An implementation of LEA has been added to the low-level API.
  - Access, recovery, and direct use for PGP session keys has
    been added to the OpenPGP API for processing encrypted data.
  - A PGPCanonicalizedDataGenerator has been added which converts
    input into canonicalized literal data for text and UTF-8
    mode.
  - A getUserKeyingMaterial() method has been added to the
    KeyAgreeRecipientInformation class.
  - ASN.1: Tagged objects (and parsers) now support all tag
    classes. Special code for ApplicationSpecific has been
    deprecated and re-implemented in terms of TaggedObject.
  - ASN.1: Improved support for nested tagging.
  - ASN.1: Added support for GraphicString, ObjectDescriptor,
    RelativeOID.
  - ASN.1: Added support for constructed BitString encodings,
    including efficient parsing for large values.
  - TLS: Added support for external PSK handshakes.
  - TLS: Check policy restrictions on key size when determining
    cipher suite support.
  - A performance issue in KeccakDigest due to left over debug
    code has been identified and dealt with.
  - BKS key stores can now be used for collecting protected keys
    (note: any attempt to store such a store will cause an
    exception).
  - A method for recovering user keying material has been added
    to KeyAgreeRecipientInformation.
  - Support has been added to the CMS API for SHA-3 based
    PLAIN-ECDSA.
  - The low level BcDefaultDigestProvider now supports the SHAKE
    family of algorithms and the SM3 alogirthm.
  - PGPKeyRingGenerator now supports creation of key-rings with
    direct-key identified keys.
  - The PQC NIST candidate, signature algorithm SPHINCS+ has been
    added to the low-level API.
  - ArmoredInputStream now explicitly checks for a '\n' if in
    crLF mode.
  - Direct support for NotationDataOccurances, Exportable,
    Revocable, IntendedRecipientFingerPrints, and AEAD algorithm
    preferences has been added to PGPSignatureSubpacketVector.
  - Further support has been added for keys described using
    S-Expressions in GPG 2.2.X.
  - Support for OpenPGP Session Keys from the (draft) Stateless
    OpenPGP CLI has been added.
  - Additional checks have been added for PGP marker packets in
    the parsing of PGP objects.
  - A CMSSignedData.addDigestAlgorithm() has been added to allow
    for adding additional digest algorithm identifiers to CMS
    SignedData structures when required.
  - Support has been added to CMS for the LMS/HSS signature
    algorithm.
  - The system property
    "org.bouncycastle.jsse.client.assumeOriginalHostName"
    (default false) has been added for dealing with SNI problems
    related to the host name not being propagate by the JVM.
  - The JcePKCSPBEOutputEncryptorBuilder now supports SCRYPT with
    ciphers that do not have algorithm parameters (e.g. AESKWP).
  - Support is now added for certificates using ETSI TS 103 097,
    "Intelligent Transport Systems (ITS)" in the bcpkix package.
  * Notes.
  - While this release should maintain source code compatibility,
    developers making use of some parts of the ASN.1 library will
    find that some classes need recompiling. Apologies for the
    inconvenience.
- Version update to 1.69
  * Defects Fixed
  - Lightweight and JCA conversion of Ed25519 keys in the PGP API
    could drop the leading byte as it was zero. This has been
    fixed.
  - Marker packets appearing at the start of PGP public key rings
    could cause parsing failure. This has been fixed.
  - ESTService could fail for some valid Content-Type headers.
    This has been fixed.
  - Originator key algorithm parameters were being passed as NULL
    in key agreement recipients. The parameters now reflect the
    value of the parameters in the key's SubjectPublicKeyInfo.
  - ContentType on encapsulated data was not been passed through
    correctly for authenticated and enveloped data. This has been
    fixed.
  - NTRUEncryptionParameters and
    NTRUEncryptionKeyGenerationParameters were not correctly
    cloning the contained message digest. This has been fixed.
  - CertificateFactory.generateCertificates()/generateCRLs()
    would throw an exception if extra data was found at the end
    of a PEM file even if valid objects had been found. Extra
    data is now ignored providing at least one object found.
  - Internal class PKIXCRLUtil could throw a NullPointerException
    for CRLs with an absent nextUpdate field. This has been
    fixed.
  - PGP ArmoredInputStream now fails earlier on malformed
    headers.
  - The McElieceKobaraImaiCipher was randomly throwing "Bad
    Padding: invalid ciphertext" exception while decrypting due
    to leading zeroes been missed during processing of the cipher
    text. This has been fixed.
  - Ed25519 keys being passed in via OpenSSH key spec are now
    validated in the KeyFactory.
  - Blowfish keys are now range checked on cipher construction.
  - In some cases PGPSecretKeyRing was failing to search its
    extraPubKeys list when searching for public keys.
  - The BasicConstraintsValidation class in the BC cert path
    validation tools has improved conformance to RFC 5280.
  - AlgorithmIdentifiers involving message digests now attempt to
    follow the latest conventions for the parameters field
    (basically DER NULL appears less).
  - Fix various conversions and interoperability for XDH and
    EdDSA between BC and SunEC providers.
  - TLS: Prevent attempts to use KeyUpdate mechanism in versions
    before TLS 1.3.
  * Additional Features and Functionality
  - GCM-SIV has been added to the lightweight API and the
    provider.
  - Blake3 has been added to the lightweight API.
  - The OpenSSL PEMParser can now be extended to add specialised
    parsers.
  - Base32 encoding has now been added, the default alphabet is
    from RFC 4648.
  - The KangarooTwelve message digest has been added to the
    lightweight API.
  - An implementation of the two FPE algorithms, FF1 and FF3-1 in
    SP 800-38G has been added to the lightweight API and the JCE
    provider.
  - An implementation of ParallelHash has been added to the
    lightweight API.
  - An implementation of TupleHash has been added to the
    lightweight API.
  - RSA-PSS now supports the use of SHAKE128 and SHAKE256 as the
    mask generation function and digest.
  - ECDSA now supports the use of SHAKE128 and SHAKE256.
  - PGPPBEEncryptedData will now reset the stream if the initial
    checksum fails so another password can be tried.
  - Iterators on public and secret key ring collections in PGP
    now reflect the original order of the public/secret key rings
    they contain.
  - KeyAgreeRecipientInformation now has a getOriginator() method
    for retrieving the underlying orginator information.
  - PGPSignature now has a getDigestPrefix() method for people
    wanting exposure to the signature finger print details.
  - The old BKS-V1 format keystore is now disabled by default. If
    you need to use BKS-V1 for legacy reasons, it can be
    re-enabled by adding: org.bouncycastle.bks.enable_v1=true to
    the java.security file. We would be interested in hearing
    from anyone that needs to do this.
  - PLAIN-ECDSA now supports the SHA3 digests.
  - Some highlevel support for RFC 4998 ERS has been added for
    ArchiveTimeStamp and EvidenceRecord. The new classes are in
    the org.bouncycastle.tsp.ers package.
  - ECIES has now also support SHA256, SHA384, and SHA512.
  - digestAlgorithms filed in CMS SignedData now includes counter
    signature digest algorithms where possible.
  - A new property "org.bouncycastle.jsse.config" has been added
    which can be used to configure the BCJSSE provider when it is
    created using the no-args constructor.
  - In line with changes in OpenSSL 1.1.0,
    OpenSSLPBEParametersGenerator can now be configured with a
    digest.
  - PGPKeyRingGenerator now includes a method for adding a subkey
    with a primary key binding signature.
  - Support for ASN.1 PRIVATE tags has been added.
  - Performance enhancements to Nokeon, AES, GCM, and
    SICBlockCipher.
  - Support for ecoding/decoding McElieceCCA2 keys has been added
    to the PQC API
  - BCJSSE: Added support for jdk.tls.maxCertificateChainLength
    system property (default is 10).
  - BCJSSE: Added support for jdk.tls.maxHandshakeMessageSize
    system property (default is 32768).
  - BCJSSE: Added support for jdk.tls.client.enableCAExtension
    (default is 'false').
  - BCJSSE: Added support for jdk.tls.client.cipherSuites system
    property.
  - BCJSSE: Added support for jdk.tls.server.cipherSuites system
    property.
  - BCJSSE: Extended ALPN support via standard JSSE API to JDK 8
    versions after u251/u252.
  - BCJSSE: Key managers now support EC credentials for use with
    TLS 1.3 ECDSA signature schemes (including brainpool).
  - TLS: Add TLS 1.3 support for brainpool curves per RFC 8734.
  * Notes
  - There is a small API change in the PKIX package to the
    DigestAlgorithmIdentifierFinder interface as a find() method
    that takes an ASN1ObjectIdentifier has been added to it. For
    people wishing to extend their own implementations, see
    DefaultDigestAlgorithmIdentifierFinder for a sample
    implementation.
  - A version of the bcmail API supporting Jakarta Mail has now
    been added (see bcjmail jar).
  - Some work has been done on moving out code that does not need
    to be in the provider jar. This has reduced the size of the
    provider jar and should also make it easier for developers to
    patch the classes involved as they no longer need to be
    signed. bcpkix and bctls are both dependent on the new bcutil
    jar.
- Add build dependencies on
  mvn(jakarta.activation:jakarta.activation-api) and
  mvn(jakarta.mail:jakarta.mail-api)
- Remove unneeded script bouncycastle_getpoms.sh from sources</changelog>
  <changelog author="pmonreal@suse.com" date="1666180800">- Update to version 1.72:
  * Defects Fixed:
  - There were parameter errors in XMSS^MT OIDs for
    XMSSMT_SHA2_40/4_256 and XMSSMT_SHA2_60/3_256. These have
    been fixed.
  - There was an error in Merkle tree construction for the
    Evidence Records (ERS) implementation which could result in
    invalid roots been timestamped. ERS now produces an
    ArchiveTimeStamp for each data object/group with an associated
    reduced hash tree. The reduced hash tree is now calculated as
    a simple path to the root of the tree for each record.
  - OpenPGP will now ignore signatures marked as non-exportable
    on encoding.
  - A tagging calculation error in GCMSIV which could result in
    incorrect tags has been fixed.
  - Issues around Java 17 which could result in failing tests
    have been addressed.
  * Additional Features and Functionality:
  - BCJSSE: TLS 1.3 is now enabled by default where no explicit
    protocols are supplied (e.g. "TLS" or "Default" SSLContext
    algorithms, or SSLContext.getDefault() method).
  - BCJSSE: Rewrite SSLEngine implementation to improve compatibility
    with SunJSSE.
  - BCJSSE: Support export of keying material via extension API.
  - (D)TLS: Add support for 'tls-exporter' channel binding per RFC 9266.
  - (D)TLS (low-level API): By default, only (D)TLS 1.2 and TLS 1.3 are
    offered now. Earlier versions are still supported if explicitly
    enabled. Users may need to check they are offering suitable
    cipher suites for TLS 1.3.
  - (D)TLS (low-level API): Add support for raw public keys per RFC 7250.
  - CryptoServicesRegistrar now has a setServicesConstraints() method
    on it which can be used to selectively turn off algorithms.
  - The NIST PQC Alternate Candidate, Picnic, has been added to the low
    level API and the BCPQC provider.
  - SPHINCS+ has been upgraded to the latest submission, SPHINCS+ 3.1
    and support for Haraka has been added.
  - Evidence records now support timestamp renewal and hash renewal.
  - The SIKE Alternative Candidate NIST Post Quantum Algorithm has
    been added to the low-level PQC API.
  - The NTRU Round 3 Finalist Candidate NIST Post Quantum Algorithm
    has been added to the low-level API and the BCPQC provider.
  - The Falcon Finalist NIST Post Quantum Algorithm has been added to
    the low-level API and the BCPQC provider.
  - The CRYSTALS-Kyber Finalist NIST Post Quantum Algorithm has been
    added to the low-level API and the BCPQC provider.
  - Argon2 Support has been added to the OpenPGP API.
  - XDH IES has now been added to the BC provider.
  - The OpenPGP API now supports AEAD encryption and decryption.
  - The NTRU Prime Alternative Candidate NIST Post Quantum Algorithms
    have been added to the low-level API and the BCPQC provider.
  - The CRYSTALS-Dilithium Finalist NIST Post Quantum Algorithm has
    been added to the low-level API and the BCPQC provider.
  - The BIKE NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - The HQC NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - Grain128AEAD has been added to the lightweight API.
  - A fast version of CRC24 has been added for use with the PGP API.
  - Some additional methods and fields have been exposed in the
    PGPOnePassSignature class to (hopefully) make it easier to
    deal with nested signatures.
  - CMP support classes have been updated to reflect the latest
    editions to the the draft RFC "Lightweight Certificate Management
    Protocol (CMP) Profile".
  - Support has been added to the PKCS#12 implementation for the
    Oracle trusted certificate attribute.
  - Performance of our BZIP2 classes has been improved.
  * Notes:
  - Keep in mind the PQC algorithms are still under development and
    we are still at least a year and a half away from published standards.
    This means the algorithms may still change so by all means experiment,
    but do not use the PQC algoritms for anything long term.
  - The legacy "Rainbow" and "McEliece" implementations have been
    removed from the BCPQC provider. The underlying classes are
    still present if required. Other legacy algorithm implementations
    can be found under the org.bouncycastle.pqc.legacy package.
  * Security Notes:
  - The PQC SIKE algorithm is provided for research purposes only.
    It should now be regarded as broken. The SIKE implementation
    will be withdrawn in BC 1.73.
  * Rebase bouncycastle-javadoc.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1682424000">- Update to version 1.73: [jsc#PED-3756]
  * Defects Fixed:
  - BCJSSE: Instantiating a JSSE provider in some contexts could
    cause an AccessControl exception.
  - The EC key pair generator can generate out of range private
    keys when used with SM2. A specific SM2KeyPairGenerator has
    been added to the low-level API and is used by
    KeyPairGenerator.getInstance("SM2", "BC"). The SM2 signer has
    been updated to check for out of range keys as well..
  - The attached signature type byte was still present in Falcon
    signatures as well as the detached signature byte.
  - There was an off-by-one error in engineGetOutputSize() for ECIES.
  - The method for invoking read() internally in BCPGInputStream
    could result in inconsistent behaviour if the class was extended.
  - Fixed a rounding issue with FF1 Format Preserving Encryption
    algorithm for certain radices.
  - Fixed RFC3394WrapEngine handling of 64 bit keys.
  - Internal buffer for blake2sp was too small and could result in
    an ArrayIndexOutOfBoundsException.
  - JCA PSS Signatures using SHAKE128 and SHAKE256 now support
    encoding of algorithm parameters.
  - PKCS10CertificationRequest now checks for empty extension
    parameters.
  - Parsing errors in the processing of PGP Armored Data now throw
    an explicit exception ArmoredInputException.
  - PGP AEAD streams could occassionally be truncated.
  - The ESTService class now supports processing of chunked HTTP data.
  - A constructed ASN.1 OCTET STRING with a single member would
    sometimes be re-encoded as a definite-length OCTET STRING. The
    encoding has been adjusted to preserve the BER status of the object.
  - PKIXCertPathReviewer could fail if the trust anchor was also
    included in the certificate store being used for path analysis.
  - UTF-8 parsing of an array range ignored the provided length.
  - IPAddress has been written to provide stricter checking and
    avoid the use of Integer.parseInt().
  - A Java 7 class snuck into the Java 5 to Java 8 build.
  * Additional Features and Functionality:
  - The Rainbow NIST Post Quantum Round-3 Candidate has been added to
    the low-level API and the BCPQC provider (level 3 and level 5
    parameter sets only).
  - The GeMSS NIST Post Quantum Round-3 Candidate has been added to
    the low-level API.
  - The org.bouncycastle.rsa.max_mr_tests property check has been
    added to allow capping of MR tests done on RSA moduli.
  - Significant performance improvements in PQC algorithms,
    especially BIKE, CMCE, Frodo, HQC, Picnic.
  - EdDSA verification now conforms to the recommendations of Taming
    the many EdDSAs, in particular cofactored verification. As a side
    benefit, Pornin's basis reduction is now used for EdDSA
    verification, giving a significant performance boost.
  - Major performance improvements for Anomalous Binary (Koblitz) Curves.
  - The lightweight Cryptography finalists Ascon, ISAP, Elephant,
    PhotonBeetle, Sparkle, and Xoodyak have been added to the
    light-weight cryptography API.
  - BLAKE2bp and BLAKE2sp have been added to the light-weight
    cryptography API.
  - Support has been added for X.509, Section 9.8, hybrid certificates
    and CRLs using alternate public keys and alternate signatures.
  - The property "org.bouncycastle.emulate.oracle" has been added to
    signal the provider should return algorithm names on some algorithms
    in the same manner as the Oracle JCE provider.
  - An extra replaceSigners method has been added to CMSSignedData
    which allows for specifying the digest algorithm IDs to be used
    in the new CMSSignedData object.
  - Parsing and re-encoding of ASN.1 PEM data has been further
    optimized to prevent unecessary conversions between basic encoding,
    definite length, and DER.
  - Support has been added for KEM ciphers in CMS in accordance with
    draft-ietf-lamps-cms-kemri
  - Support has been added for certEncr in CRMF to allow issuing of
    certificates for KEM public keys.
  - Further speedups have been made to CRC24.
  - GCMParameterSpec constructor caching has been added to improve
    performance for JVMs that have the class available.
  - The PGPEncrytedDataGenerator now supports injecting the session
    key to be used for PGP PBE encrypted data.
  - The CRMF CertificateRequestMessageBuilder now supports optional
    attributes.
  - Improvements to the s calculation in JPAKE.
  - A general purpose PQCOtherInfoGenerator has been added which
    supports all Kyber and NTRU.
  - An implementation of HPKE (RFC 9180 - Hybrid Public Key
    Encryption) has been added to the light-weight cryptography API.
  * Security Advisories:
  - The PQC implementations have now been subject to formal review for
    secret leakage and side channels, there were issues in BIKE, Falcon,
    Frodo, HQC which have now been fixed. Some weak positives also
    showed up in Rainbow, Picnic, SIKE, and GeMSS - for now this last
    set has been ignored as the algorithms will either be updated if
    they reappear in the Signature Round, or deleted, as is already the
    case for SIKE (it is now in the legacy package). Details on the
    group responsible for the testing can be found in the CONTRIBUTORS
    file.
  - For at least some ECIES variants (e.g. when using CBC) there is
    an issue with potential malleability of a nonce (implying silent
    malleability of the plaintext) that must be sent alongside the
    ciphertext but is outside the IES integrity check. For this reason
    the automatic generation of nonces with IED is now disabled and
    they have to be passed in using an IESParameterSpec. The current
    advice is to agree on a nonce between parties and then rely on the
    use of the ephemeral key component to allow the nonce (rather the
    so called nonce) usage to be extended.</changelog>
  <changelog author="pmonreal@suse.com" date="1687176000">- Update to version 1.74: [bsc#1212508, CVE-2023-33201]
  * Defects Fixed:
  - AsconEngine: Fixed a buffering bug when decrypting across
    multiple processBytes calls (ascon128a unaffected).
  - Context based sanity checking on PGP signatures has been added.
  - The ParallelHash clone constructor was not copying all fields.
  - The maximimum number of blocks for CTR/SIC modes was 1 block
    less than it should have been.
  * Additional Features and Functionality:
  - The PGP API now supports wildcard key IDs for public key
    based data encryption.
  - LMS now supports SHA256/192, SHAKE256/192, and SHAKE256/256
    (the additional SP 8000-208 parameter sets).
  - The PGP API now supports V5 and V6 AEAD encryption for
    encrypted data packets.
  - The PGP examples have been updated to reflect key size and algorithm
    changes that have occurred since they were first written (10+ years...).
  - (D)TLS: A new callback 'TlsPeer.notifyConnectionClosed' will be called
    when the connection is closed (including by failure).
  - BCJSSE: Improved logging of connection events and include unique IDs
    in connection-specific log messages.
  - BCJSSE: Server now logs the offered cipher suites when it fails to
    select one.
  - BCJSSE: Added support for SSLParameters namedGroups and
    signatureSchemes properties (can also be used via BCJSSE
    extension API in earlier Java versions).
  - DTLS: The initial handshake re-send time is now configurable by
    overriding 'TlsPeer.getHandshakeResendTimeMillis'.
  - DTLS: Added support for connection IDs per RFC 9146.
  - DTLS: Performance of DTLSVerifier has been improved so that it can
    reasonably be used for all incoming packets.
  - Initial support has been added for A Mechanism for Encoding
    Differences in Paired Certificates.
  - The PGP API now supports parsing, encoding, and fingerprinting
    of V6 EC/EdEC keys.
  - A thread safe verifier API has been added to the PGP API to support
    multi-threaded verification of certifications on keys and user IDs.
  - The number of keys/sub-keys in a PGPKeyRing can now be found by
    calling PGPKeyRing.size().
  - The PQC algorithms LMS/HSS, SPHINCS+, Dilithium, Falcon, and NTRU
    are now supported directly by the BC provider.
  * Notes:
  - The now defunct PQC SIKE algorithm has been removed, this has also
    meant the removal of its resource files so the provider is now quite
    a bit smaller.
  - As a precaution, HC128 now enforces a 128 bit IV, previous behaviour
    for shorter IVs can be supported where required by padding the IV to
    the 128 bits with zero.
  - PGP encrypted data generation now uses integrity protection by default.
    Previous behaviour for encrypted data can be supported where required
    by calling PGPDataEncryptorBuilder.setWithIntegrityPacket(false) when
    data encryption is set up.
  - There are now additional sanity checks in place to prevent accidental
    mis-use of PGPSignature objects. If this change causes any issues, you
    might want to check what your code is up to as there is probably a bug.
  * Security Advisories:
  - CVE-2023-33201: this release fixes an issue with the X509LDAPCertStoreSpi
    where a specially crafted certificate subject could be used to try and
    extract extra information out of an LDAP server with wild-card matthing
    enabled.
  * Rebase bouncycastle-javadoc.patch
  * Add bouncycastle-notests.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1697630400">- Update to version 1.76:
  * Defects Fixed:
  - Service allocation in the provider could fail due to the lack
    of a permission block. This has been fixed.
  - JceKeyFingerPrintCalculator has been generalised for different
    providers by using "SHA-256" for the algorithm string.
  - BCJSSE: Fixed a regression in 1.74 (NullPointerException) that
    prevents a BCJSSE server from negotiating TLSv1.1 or earlier.
  - DTLS: Fixed server support for client_certificate_type extension.
  - Cipher.unwrap() for HQC could fail due to a miscalculation of
    the length of the KEM packet. This has been fixed.
  - There was exposure to a Java 7 method in the Java 5 to Java 8
    BCTLS jar which could cause issues with some TLS 1.2 cipher
    suites running on older JVMs. This is now fixed.
  * Additional Features and Functionality:
  - BCJSSE: Following OpenJDK, finalizers have been removed from
    SSLSocket subclasses. Applications should close sockets and
    not rely on garbage collection.
  - BCJSSE: Added support for boolean system property
    "jdk.tls.client.useCompatibilityMode" (default "true").
  - DTLS: Added server support for session resumption.
  - JcaPKCS10CertificationRequest will now work with EC on the
    OpenJDK provider.
  - TimeStamp generation now supports the SHA3 algorithm set.
  - The SPHINCS+ simple parameters are now fully supported in the
    BCPQC provider.
  - Kyber, Classic McEliece, HQC, and Bike now supported by the
    CRMF/CMS/CMP APIs.
  - Builder classes have been add for PGP ASCII Armored streams
    allowing CRCs and versions to now be optional.
  - An UnknownPacket type has been added to the PGP APIs to allow
    for forwards compatibility with upcoming revisions to the standard.
  * Rebase patch bouncycastle-notests.patch
- Update to version 1.75:
  * Defects Fixed:
  - Several Java 8 method calls were accidentally introduced in
    the Java 5 to Java 8 build. The affected classes have been
    refactored to remove this.
  - (D)TLS: renegotiation after resumption now fixed to avoid
    breaking connection.
  * Notes:
  - The ASN.1 core package has had some dead and retired methods
    cleaned up and removed.</changelog>
  <changelog author="pmonreal@suse.com" date="1701691200">- Update to version 1.77:
  * Defects Fixed:
  - Using an unescaped '=' in an X.500 RDN would result in the
    RDN being truncated silently. The issue is now detected and
    an exception is thrown.
  - asn1.eac.CertificateBody was returning certificateEffectiveDate
    from getCertificateExpirationDate(). This has been fixed to
    return certificateExpirationDate.
  - DTLS: Fixed retransmission in response to re-receipt of an
    aggregated ChangeCipherSpec.
  - (D)TLS: Fixed compliance for supported_groups extension.
    Server will no longer negotiate an EC cipher suite using a
    default curve when the ClientHello includes the supported_groups
    extension but it contains no curves in common with the server.
    Similarly, a DH cipher suite will not be negotiated when the
    ClientHello includes supported_groups, containing at least one
    FFDHE group, but none in common with the server.
  - IllegalStateException was being thrown by Ed25519/Ed448 SignatureSpi.
  - TLS: class annotation issues that could occur between the BC
    provider and the TLS API for the GCMParameterSpec class when
    the jars were loaded on the boot class path have been addressed.
  - Attempt to create an ASN.1 OID from a zero length byte array
    is now caught at construction time.
  - Attempt to create an X.509 extension block which is empty will
    now be blocked cause an exception.
  - IES implementation will now accept a null ParameterSpec if no
    nonce is needed.
  - An internal method in Arrays was failing to construct its
    failure message correctly on an error.
  - HSSKeyPublicParameters.generateLMSContext() would fail for a
    unit depth key.
  * Additional Features and Functionality:
  - BCJSSE: Added org.bouncycastle.jsse.client.omitSigAlgsCertExtension
    and org.bouncycastle.jsse.server.omitSigAlgsCertExtension boolean
    system properties to control (for client and server resp.) whether
    the signature_algorithms_cert extension should be omitted if it
    would be identical to signature_algorithms. Defaults to true, the
    historical behaviour.
  - The low-level HPKE API now allows the sender to specify an
    ephemeral key pair.
  - Support has been added for the delta-certificate requests in line
    with the current Chameleon Cert draft from the IETF.
  - Some accommodation has been added for historical systems to
    accommodate variations in the SHA-1 digest OID for CMS SignedData.
  - TLS: the TLS API will now try "RSAwithDigestAndMFG1" as well as
    the newer RSAPSS algorithm names when used with the JCA.
  - TLS: RSA key exchange cipher suites are now disabled by default.
  - Support has been added for PKCS#10 requests to allow certificates
    using the altSignature/altPublicKey extensions.
  * Notes:
  - Kyber and Dilithium have been updated according to the latest
    draft of the standard. Dilithium-AES and Kyber-AES have now been
    removed. Kyber now produces 256 bit secrets for all parameter sets
    (in line with the draft standard).
  - NTRU has been updated to produce 256 bit secrets in line with Kyber.
  - SPHINCS+ can now be used to generate certificates in line with
    those used by (Open Quantum Safe) OQS.
  - Falcon object idenitifiers are now in line with OQS as well.
  - PQC CMS SignedData now defaults to SHA-256 for signed attributes
    rather than SHAKE-256. This is also a compatibility change, but may
    change further again as the IETF standard for CMS is updated.</changelog>
  <changelog author="pmonreal@suse.com" date="1714392000">- Update to version 1.78: [bsc#1223252, CVE-2024-30171]
  * Security Advisories.
  - CVE-2024-29857: Importing an EC certificate with specially crafted
    F2m parameters can cause high CPU usage during parameter evaluation.
  - CVE-2024-30171: Possible timing based leakage in RSA based handshakes
    due to exception processing eliminated.
  - CVE-2024-30172: Crafted signature and public key can be used to
    trigger an infinite loop in the Ed25519 verification code.
  - CVE-2024-301XX: When endpoint identification is enabled in the BCJSSE
    and an SSL socket is not created with an explicit hostname (as happens
    with HttpsURLConnection), hostname verification could be performed
    against a DNS-resolved IP address. This has been fixed.
  * Defects Fixed:
  - Issues with a dangling weak reference causing intermittent
    NullPointerExceptions in the OcspCache have been fixed.
  - Issues with non-constant time RSA operations in TLS handshakes.
  - Issue with Ed25519, Ed448 signature verification causing intermittent
    infinite loop have been fixed.
  - Issues with non-constant time ML-KEM implementation ("Kyber Slash").
  - Align ML-KEM input validation with FIPS 203 IPD requirements.
  - Make PEM parsing more forgiving of whitespace to align with RFC 7468.
  - Fix CCM length checks with large nonce sizes (n=12, n=13).
  - EAC: Fixed the CertificateBody ASN.1 type to support an optional
    Certification Authority Reference in a Certificate Request.
  - ASN.1: ObjectIdentifier (also Relative OID) parsing has been optimized
    and the contents octets for both types are now limited to 4096 bytes.
  - BCJSSE: Fixed a missing null check on the result of PrivateKey.getEncoded(),
    which could cause issues for HSM RSA keys.
  - BCJSSE: When endpoint identification is enabled and an SSL socket is not
    created with an explicit hostname (as happens with HttpsURLConnection),
    hostname verification could be performed against a DNS-resolved IP address.
  - The missing module import of java.logging to the provider module has been added.
  - GOST ASN.1 public key alg parameters are now compliant with RFC 9215.
  - An off-by-one error in the encoding for EccP256CurvePoint for ITS.
  - PEM Parser now enforces PEM headers to start at the beginning of the line
    to be meaningful.
  * Additional Features and Functionality.
  - An implementation of MLS (RFC 9420 - The Messaging Layer Security Protocol)
    has been added as a new module.
  - NTRU now supports NTRU-HPS4096-1229 and NTRU-HRSS-1373.
  - Improvements to PGP support, including Camellia key wrapping and Curve25519,
    Curve448 key types (including XDH with HKDF).
  - Added initial support for ML-KEM in TLS.
  - Added XWing hybrid KEM construction (X25519 + ML-KEM-768).
  - Introduced initial KEMSpi support (NTRU, SNTRU Prime) for JDK 21+.
  - Introduced initial composite signature support for X509 Certificates.
  - PKCS#12 now supports PKCS12-AES256-AES128, PKCS12-AES256-AES128-GCM,
    PKCS12-DEF-AES256-AES128, and PKCS12-DEF-AES256-AES128-GCM.
  - The default type for the KeyStore.getInstance("PKCS12", "BC") can now be set
    using the org.bouncycastle.pkcs12.default system/security property.
  - The PGP SExpParser will now handle Ed25519 and Ed448 keys.
  - Dilithium and Kyber key encoding updated to latest Draft RFCs
    (draft-ietf-lamps-dilithium-certificates and draft-ietf-lamps-kyber-certificates)
  - Support has been added for encryption key derivation using HKDF in CMS, see
    draft-housley-lamps-cms-cek-hkdf-sha256.
  - X500Name now recognises jurisdiction{C,ST,L} DNs.
  - CertPathValidationContext and CertificatePoliciesValidation now include
    implementations of Memoable.
  - The Composite post-quantum signatures implementation has been updated to the
    latest draft draft-ounsworth-pq-composite-sigs.
  * Full release notes: bouncycastle.org/releasenotes.html#r1rv78
  * Rebase bouncycastle-notests.patch</changelog>
  <changelog author="fstrba@suse.com" date="1714392001">- Update to version 1.78.1
  * Defects Fixed:
  - The new dependency of the the PGP API on the bcutil jar was
    missing from the module jar, the OSGi manifest, and the Maven
    POM. This has been fixed.
  - Missing exports and duplicate imports have been added/removed
    from the OSGi manifests.
  - The OSGi manifests now have the same bundle IDs as 1.77 and
    lock down dependencies to the equivalent variations
  - A check in the X.509 Extensions class preventing the parsing
    of empty extensions has been removed.</changelog>
</package>
<package pkgid="7bf041e3e9b2eea43aaa94160781b974a331c9446285311cc138d694fd4c0e94" name="bouncycastle-jmail" arch="noarch">
  <version epoch="0" ver="1.78.1" rel="150200.3.29.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1570881600">- Update pom files with those from Maven repository.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573041600">- Fix arch dependent macros in noarch package [bsc#1109539]</changelog>
  <changelog author="fstrba@suse.com" date="1585137600">- Added patch:
  * bouncycastle-osgi.patch
    + Add OSGi manifests to the distributed jars so that they can
    be used from eclipse</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588161600">- Version update to 1.65
  * Defects Fixed:
  - DLExternal would encode using DER encoding for tagged SETs.
  - ChaCha20Poly1305 could fail for large (&gt;~2GB) files.
  - ChaCha20Poly1305 could fail for small updates when used via the provider.
  - Properties.getPropertyValue could ignore system property when other
    local overrides set.
  - The entropy gathering thread was not running in daemon mode, meaning there
    could be a delay in an application shutting down due to it.
  - A recent change in Java 11 could cause an exception with the BC Provider's
    implementation of PSS.
  - BCJSSE: TrustManager now tolerates having no trusted certificates.
  - BCJSSE: Choice of credentials and signing algorithm now respect the peer's
    signature_algorithms extension properly.
  - BCJSSE: KeyManager for KeyStoreBuilderParameters no longer leaks memory.
  * Additional Features and Functionality:
  - LMS and HSS (RFC 8554) support has been added to the low level library and
    the PQC provider.
  - SipHash128 support has been added to the low level library and the JCE provider.
  - BCJSSE: BC API now supports explicitly specifying the session to resume.
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: Added support for extended_master_secret system properties:
    jdk.tls.allowLegacyMasterSecret, jdk.tls.allowLegacyResumption,
    jdk.tls.useExtendedMasterSecret .
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: KeyManager and TrustManager now check algorithm constraints for
    keys and certificate chains.
  - BCJSSE: KeyManager selection of server credentials now prefers matching
    SNI hostname (if any).
  - BCJSSE: KeyManager may now fallback to imperfect credentials (expired,
    SNI mismatch).
  - BCJSSE: Client-side OCSP stapling support (beta version: via status_request
    extension only, provides jdk.tls.client.enableStatusRequestExtension, and
    requires CertPathBuilder support).
  - TLS: DSA in JcaTlsCrypto now falls back to stream signing to work around
    NoneWithDSA limitations in default provider.</changelog>
  <changelog author="pmonreal@suse.com" date="1595937600">- Version update to 1.66 [bsc#1186328, CVE-2020-15522]
  * Defects Fixed:
  - EdDSA verifiers now reset correctly after rejecting overly long signatures.
  - BCJSSE: SSLSession.getPeerCertificateChain could throw NullPointerException.
  - qTESLA-I verifier would reject some valid signatures.
  - qTESLA verifiers now reject overly long signatures.
  - PGP regression caused failure to preserve existing version header when
    headers were reset.
  - PKIXNameConstraintValidator had a bad cast preventing use of multiple
    OtherName constraints.
  - Serialisation of the non-CRT RSA Private Key could cause a NullPointerException.
  - An extra 4 bytes was included in the start of HSS public key encodings.
  - CMS with Ed448 using a direct signature was using id-shake256-len
    rather than id-shake256.
  - Use of GCMParameterSpec could cause an AccessControlException under
    some circumstances.
  - DTLS: Fixed high-latency HelloVerifyRequest handshakes.
  - An encoding bug for rightEncoded() in KMAC has been fixed.
  - For a few values the cSHAKE implementation would add unnecessary pad bytes
    where the N and S strings produced encoded data that was block aligned.
  - There were a few circumstances where Argon2BytesGenerator might hit an
    unexpected null. These have been removed.
  * Additional Features and Functionality
  - The qTESLA signature algorithm has been updated to v2.8 (20191108).
  - BCJSSE: Client-side OCSP stapling now supports status_request_v2 extension.
  - Support has been added for "ocsp.enable", "ocsp.responderURL" and
    PKIXRevocationChecker for users of Java 8 and later.
  - Support has been added for "org.bouncycastle.x509.enableCRLDP" to the PKIX validator.
  - BCJSSE: Now supports system property 'jsse.enableFFDHE'
  - BCJSSE: Now supports system properties 'jdk.tls.client.SignatureSchemes'
    and 'jdk.tls.server.SignatureSchemes'.
  - Multi-release support has been added for Java 11 XECKeys.
  - Multi-release support has been added for Java 15 EdECKeys.
  - The MiscPEMGenerator will now output general PrivateKeyInfo structures.
  - A new property "org.bouncycastle.pkcs8.v1_info_only" has been added to
    make the provider only produce version 1 PKCS8 PrivateKeyInfo structures.
  - The PKIX CertPathBuilder will now take the target certificate from the target
    constraints if a specific certificate is given to the selector.
  - BCJSSE: A range of ARIA and CAMELLIA cipher suites added to supported list.
  - BCJSSE: Now supports the PSS signature schemes from RFC 8446 (TLS 1.2 onwards).
  - Performance of the Base64 encoder has been improved.
  - The PGPPublicKey class will now include direct key signatures when checking
    for key expiry times.
  * NOTES:
  - The qTESLA update breaks compatibility with previous versions.
    Private keys now include a hash of the public key at the end,
    and signatures are no longer interoperable with previous versions.</changelog>
  <changelog author="pmonreal@suse.com" date="1608552000">- Version update to 1.67 [bsc#1180215, CVE-2020-28052]
  * CVE-2020-28052: OpenBSDBCrypt.checkPassword utility method
    compared incorrect data when checking the password
  * Defects Fixed:
  - BCJSSE: SunJSSE compatibility fix - override of getChannel()
    removed and 'urgent data' behaviour should now conform to
    what the SunJSSE expects
  - Nested BER data could sometimes cause issues in octet strings
  - Certificates/CRLs with short signatures could cause an exception
    in toString() in the BC X509 Certificate implmentation
  - In line with latest changes in the JVM, SignatureSpis which
    don't require parameters now return null on engineGetParameters()
  - The RSA KeyFactory now always preferentially produces RSAPrivateCrtKey
    where it can on requests for a KeySpec based on an RSAPrivateKey
  - CMSTypedStream$FullReaderStream now handles zero length reads correctly
  - Unecessary padding was added on KMAC when the key string was block aligned
  - Zero length data would cause an unexpected exception from RFC5649WrapEngine
  - OpenBSDBcrypt was failing to handle some valid prefixes
  * Additional Features and Functionality
  - Performance improvement of Argon2 and Noekeon
  - A setSessionKeyObfuscation() method has been added to
    PublicKeyKeyEncryptionMethodGenerator to allow turning off of session key
    obfuscation (default is on, method primarily to get around early version
    GPG issues with AES-128 keys)
  - Implemented 'safegcd' constant-time modular inversion (as well as a
    variable-time variant). It has replaced Fermat inversion in all our EC
    code, and BigInteger.modInverse in several other places, particularly
    signers. This improves side-channel protection, and also gives a
    significant performance boost
  - Performance of custom binary ECC curves and Edwards Curves has been improved
  - BCJSSE: New boolean system property 'org.bouncycastle.jsse.keyManager.checkEKU'
    allows to disable ExtendedKeyUsage restrictions when selecting credentials
    (although the peer may still complain)
  - Initial support has been added for "Composite Keys and Signatures For Use
    In Internet PKI" using the test OID. Please note there will be further
    refinements to this as the draft is standardised
  - The BC EdDSA signature API now supports keys implementing all methods on
    the EdECKey and XECKey interfaces directly
  - Work has begun on classes to support the ETSI TS 103 097, Intelligent
    Transport Systems (ITS) in the bcpkix package
  - Further optimization work has been done on GCM
  - A NewHope based processor, similar to the one for Key Agreement has been
    added for trying to "quantum hard" KEM algorithms
  - PGP clear signed signatures now support SHA-224
  - Treating absent vs NULL as equivalent can now be configured by a system
    property. By default this is not enabled
  - Mode name checks in Cipher strings should now make sure an improper mode
    name always results in a NoSuchAlgorithmException
  - In line with changes in OpenSSL, the OpenSSLPBKDF now uses UTF8 encoding</changelog>
  <changelog author="fstrba@suse.com" date="1610539200">- Version update to 1.68
  * Defects Fixed:
  - Some BigIntegers utility methods would fail for
    BigInteger.ZERO. This has been fixed.
  - PGPUtil.isKeyRing() was not detecting secret sub-keys in its
    input. This has been fixed.
  - The ASN.1 class, ArchiveTimeStamp was insisting on a value
    for the optional reducedHashTree field. This has been fixed.
  - BCJSSE: Lock against multiple writers - a possible
    synchronization issue has been removed.
  * Additional Features and Functionality
  - BCJSSE: Added support for system property
    com.sun.net.ssl.requireCloseNotify. Note that we are using a
    default value of 'true'.
  - BCJSSE: 'TLSv1.3' is now a supported protocol for both client
    and server. For this release it is only enabled by default for
    the 'TLSv1.3' SSLContext, but can be explicitly enabled using
    'setEnabledProtocols' on an SSLSocket or SSLEngine, or via
    SSLParameters.
  - BCJSSE: Session resumption is now also supported for servers
    in TLS 1.2 and earlier. For this release it is disabled by
    default, and can be enabled by setting the boolean system
    property org.bouncycastle.jsse.server.enableSessionResumption
    to 'true'.
  - The provider RSA-PSS signature names that follow the JCA
    naming convention.
  - FIPS mode for the BCJSSE now enforces namedCurves for any
    presented certificates.
  - PGPSignatureSubpacketGenerator now supports editing of a
    pre-existing sub-packet list.</changelog>
  <changelog author="pmonreal@suse.com" date="1621944000">- Add bouncycastle_getpoms.sh to get pom files from Maven repos</changelog>
  <changelog author="fstrba@suse.com" date="1627387200">- Directory core/docs does not exist</changelog>
  <changelog author="fstrba@suse.com" date="1647518400">- Add glassfish-activation-api dependency so that we can build with
  JDK that does not contain the JavaEE modules</changelog>
  <changelog author="fstrba@suse.com" date="1647604800">- Build with source/target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1648641600">- Build against the standalone JavaEE modules unconditionally</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1650628800">- Version update to 1.71
  * Defects Fixed
  - In line with GPG the PGP API now attempts to preserve
    comments containing non-ascii UTF8 characters.
  - An accidental partial dependency on Java 1.7 has been removed
    from the TLS API.
  - JcaPKIXIdentityBuilder would fail to process File objects
    correctly. This is now fixed.
  - Some byte[] parameters to the CMP API were not being
    defensively cloned to prevent accidental changes. Extra
    defensive cloning has been added.
  - CMS primitives would sometimes convert ASN.1 definite-length
    encodings into indefinite-length encodings. The primitives
    will now try and preserve the original encoding where possible.
  - CMSSignedData.getAttributeCertificates() now properly
    restricts the tag values checked to just 1 (the obsolete
    v1 tag) and 2 (for the more current v2 certificates).
  - BCJSSE now tries to validate a custom KeyManager selection
    in order to catch errors around a key manager ignoring
    key type early.
  - Compressed streams in PGP ending with zero length partial
    packets could cause failure on parsing the OpenPGP API.
    This has been fixed.
  - The fallback mode for JceAsymmetricKeyWrapper/Unwrapper
    would lose track of any algorithm parameters generated
    in the initial attempt. The algorithm parameters are now
    propagated.
  - An accidental regression introduced by a fix for another
    issue in PKIXCertPathReviewer around use of the
    AuthorityKeyIdentifier extension and it failing to match
    a certificate uniquely when the serial number field
    is missing has been fixed.
  - An error was found in the creation of TLS 1.3 Export Keying
    Material which could cause compatibility issues. This has
    been fixed.
  * Additional Features and Functionality
  - Support has been added for OpenPGP regular expression
    signature packets.
  - Support has been added for OpenPGP PolicyURI signature
    packets.
  - A utility method has been added to PGPSecretKeyRing to allow
    for inserting or replacing a PGPPublicKey.
  - The NIST PQC Finalist, Classic McEliece has been added to the
    low level API and the BCPQC provider.
  - The NIST PQC Alternate Candidate, SPHINCS+ has been added to
    the BCPQC provider.
  - The NIST PQC Alternate Candidate, FrodoKEM has been added to
    the low level API and the BCPQC provider.
  - The NIST PQC Finalist, SABER has been added to the low level
    API and the BCPQC provider.
  - KMAC128, KMAC256 has been added to the BC provider (empty
    customization string).
  - TupleHash128, TupleHash256 has been added to the BC provider
    (empty customization string).
  - ParallelHash128, ParallelHash256 has been added to the BC
    provider (empty customization string, block size 1024 bits).
  - Two new properties: "org.bouncycastle.rsa.max_size" (default
    15360) and "org.bouncycastle.ec.fp_max_size" (default 1042)
    have been added to cap the maximum size of RSA and EC keys.
  - RSA modulus are now checked to be provably composite using
    the enhanced MR probable prime test.
  - Imported EC Fp basis values are now validated against the MR
    prime number test before use. The certainty level of the
    prime test can be determined by
    "org.bouncycastle.ec.fp_certainty" (default 100).
  - The BC entropy thread now has a specific name:
    "BC-ENTROPY-GATHERER".
  - Utility methods have been added for joining/merging PGP
    public keys and signatures.
  - Blake3-256 has been added to the BC provider.
  - DTLS: optimisation to delayed handshake hash.
  - Further additions to the ETSI 102 941 support in the ETSI/ITS
    package: certification request, signed message generation and
    verification now supported.
  - CMSSignedDataGenerator now supports the direct generation of
    definite-length data.
  - The NetscapeCertType class now has a hasUsages() method on it
    for querying usage settings on its bit string.
  - Support for additional input has been added for deterministic
    (EC)DSA.
  - The OpenPGP API provides better support for subkey
    generation.
  - BCJSSE: Added boolean system properties
    "org.bouncycastle.jsse.client.dh.disableDefaultSuites" and
    "org.bouncycastle.jsse.server.dh.disableDefaultSuites".
    Default "false". Set to "true" to disable inclusion of DH
    cipher suites in the default cipher suites for client/server
    respectively.
  * Notes
  - The deprecated QTESLA implementation has been removed from
    the BCPQC provider.
  - The submission update to SPHINCS+ has been added. This
    changes the generation of signatures - particularly
    deterministic ones.
- Version update to 1.70
  * Defects Fixed
  - Blake 3 output limit is enforced.
  - The PKCS12 KeyStore was relying on default precedence for its
    key Cipher implementation so was sometimes failing if used
    from the keytool. The KeyStore class now makes sure it uses
    the correct Cipher implementation.
  - Fixed bzip2 compression for empty contents (GH #993).
  - ASN.1: More robust handling of high tag numbers and
    definite-length forms.
  - BCJSSE: Fix a concurrent modification issue in session
    contexts (GH#968).
  - BCJSSE: Don't log sensitive system property values (GH#976).
  - BCJSSE: Fixed a priority issue amongst imperfect-match
    credentials in KeyManager classes.
  - The IES AlgorithmParameters object has been re-written to
    properly support all the variations of IESParameterSpec.
  - getOutputSize() for ECIES has been corrected to avoid
    occassional underestimates.
  - The lack of close() in the ASN.1 Dump command line utility
    was triggering false positives in some code analysis tools. A
    close() call has been added.
  - PGPPublicKey.getBitStrength() now properly recognises EdDSA
    keys.
  * Additional Features and Functionality
  - Missing PGP CRC checksums can now be optionally ignored using
    setDetectMissingCRC() (default false) on ArmoredInputStream.
  - PGPSecretKey.copyWithNewPassword() now has a variant which
    uses USAGE_SHA1 for key protection if a PGPDigestCalculator
    is passed in.
  - PGP ASCII armored data now skips "\t", "\v", and "\f".
  - PKCS12 files with duplicate localKeyId attributes on
    certificates will now have the incorrect attributes filtered
    out, rather than the duplicate causing an exception.
  - PGPObjectFactory will now ignore packets representing
    unrecognised signature versions in the input stream.
  - The X.509 extension generator will now accumulate some
    duplicate X.509 extensions into a single extension where it
    is possible to do so.
  - Removed support for maxXofLen in Kangaroo digest.
  - Ignore marker packets in PGP Public and Secret key ring
    collection.
  - An implementation of LEA has been added to the low-level API.
  - Access, recovery, and direct use for PGP session keys has
    been added to the OpenPGP API for processing encrypted data.
  - A PGPCanonicalizedDataGenerator has been added which converts
    input into canonicalized literal data for text and UTF-8
    mode.
  - A getUserKeyingMaterial() method has been added to the
    KeyAgreeRecipientInformation class.
  - ASN.1: Tagged objects (and parsers) now support all tag
    classes. Special code for ApplicationSpecific has been
    deprecated and re-implemented in terms of TaggedObject.
  - ASN.1: Improved support for nested tagging.
  - ASN.1: Added support for GraphicString, ObjectDescriptor,
    RelativeOID.
  - ASN.1: Added support for constructed BitString encodings,
    including efficient parsing for large values.
  - TLS: Added support for external PSK handshakes.
  - TLS: Check policy restrictions on key size when determining
    cipher suite support.
  - A performance issue in KeccakDigest due to left over debug
    code has been identified and dealt with.
  - BKS key stores can now be used for collecting protected keys
    (note: any attempt to store such a store will cause an
    exception).
  - A method for recovering user keying material has been added
    to KeyAgreeRecipientInformation.
  - Support has been added to the CMS API for SHA-3 based
    PLAIN-ECDSA.
  - The low level BcDefaultDigestProvider now supports the SHAKE
    family of algorithms and the SM3 alogirthm.
  - PGPKeyRingGenerator now supports creation of key-rings with
    direct-key identified keys.
  - The PQC NIST candidate, signature algorithm SPHINCS+ has been
    added to the low-level API.
  - ArmoredInputStream now explicitly checks for a '\n' if in
    crLF mode.
  - Direct support for NotationDataOccurances, Exportable,
    Revocable, IntendedRecipientFingerPrints, and AEAD algorithm
    preferences has been added to PGPSignatureSubpacketVector.
  - Further support has been added for keys described using
    S-Expressions in GPG 2.2.X.
  - Support for OpenPGP Session Keys from the (draft) Stateless
    OpenPGP CLI has been added.
  - Additional checks have been added for PGP marker packets in
    the parsing of PGP objects.
  - A CMSSignedData.addDigestAlgorithm() has been added to allow
    for adding additional digest algorithm identifiers to CMS
    SignedData structures when required.
  - Support has been added to CMS for the LMS/HSS signature
    algorithm.
  - The system property
    "org.bouncycastle.jsse.client.assumeOriginalHostName"
    (default false) has been added for dealing with SNI problems
    related to the host name not being propagate by the JVM.
  - The JcePKCSPBEOutputEncryptorBuilder now supports SCRYPT with
    ciphers that do not have algorithm parameters (e.g. AESKWP).
  - Support is now added for certificates using ETSI TS 103 097,
    "Intelligent Transport Systems (ITS)" in the bcpkix package.
  * Notes.
  - While this release should maintain source code compatibility,
    developers making use of some parts of the ASN.1 library will
    find that some classes need recompiling. Apologies for the
    inconvenience.
- Version update to 1.69
  * Defects Fixed
  - Lightweight and JCA conversion of Ed25519 keys in the PGP API
    could drop the leading byte as it was zero. This has been
    fixed.
  - Marker packets appearing at the start of PGP public key rings
    could cause parsing failure. This has been fixed.
  - ESTService could fail for some valid Content-Type headers.
    This has been fixed.
  - Originator key algorithm parameters were being passed as NULL
    in key agreement recipients. The parameters now reflect the
    value of the parameters in the key's SubjectPublicKeyInfo.
  - ContentType on encapsulated data was not been passed through
    correctly for authenticated and enveloped data. This has been
    fixed.
  - NTRUEncryptionParameters and
    NTRUEncryptionKeyGenerationParameters were not correctly
    cloning the contained message digest. This has been fixed.
  - CertificateFactory.generateCertificates()/generateCRLs()
    would throw an exception if extra data was found at the end
    of a PEM file even if valid objects had been found. Extra
    data is now ignored providing at least one object found.
  - Internal class PKIXCRLUtil could throw a NullPointerException
    for CRLs with an absent nextUpdate field. This has been
    fixed.
  - PGP ArmoredInputStream now fails earlier on malformed
    headers.
  - The McElieceKobaraImaiCipher was randomly throwing "Bad
    Padding: invalid ciphertext" exception while decrypting due
    to leading zeroes been missed during processing of the cipher
    text. This has been fixed.
  - Ed25519 keys being passed in via OpenSSH key spec are now
    validated in the KeyFactory.
  - Blowfish keys are now range checked on cipher construction.
  - In some cases PGPSecretKeyRing was failing to search its
    extraPubKeys list when searching for public keys.
  - The BasicConstraintsValidation class in the BC cert path
    validation tools has improved conformance to RFC 5280.
  - AlgorithmIdentifiers involving message digests now attempt to
    follow the latest conventions for the parameters field
    (basically DER NULL appears less).
  - Fix various conversions and interoperability for XDH and
    EdDSA between BC and SunEC providers.
  - TLS: Prevent attempts to use KeyUpdate mechanism in versions
    before TLS 1.3.
  * Additional Features and Functionality
  - GCM-SIV has been added to the lightweight API and the
    provider.
  - Blake3 has been added to the lightweight API.
  - The OpenSSL PEMParser can now be extended to add specialised
    parsers.
  - Base32 encoding has now been added, the default alphabet is
    from RFC 4648.
  - The KangarooTwelve message digest has been added to the
    lightweight API.
  - An implementation of the two FPE algorithms, FF1 and FF3-1 in
    SP 800-38G has been added to the lightweight API and the JCE
    provider.
  - An implementation of ParallelHash has been added to the
    lightweight API.
  - An implementation of TupleHash has been added to the
    lightweight API.
  - RSA-PSS now supports the use of SHAKE128 and SHAKE256 as the
    mask generation function and digest.
  - ECDSA now supports the use of SHAKE128 and SHAKE256.
  - PGPPBEEncryptedData will now reset the stream if the initial
    checksum fails so another password can be tried.
  - Iterators on public and secret key ring collections in PGP
    now reflect the original order of the public/secret key rings
    they contain.
  - KeyAgreeRecipientInformation now has a getOriginator() method
    for retrieving the underlying orginator information.
  - PGPSignature now has a getDigestPrefix() method for people
    wanting exposure to the signature finger print details.
  - The old BKS-V1 format keystore is now disabled by default. If
    you need to use BKS-V1 for legacy reasons, it can be
    re-enabled by adding: org.bouncycastle.bks.enable_v1=true to
    the java.security file. We would be interested in hearing
    from anyone that needs to do this.
  - PLAIN-ECDSA now supports the SHA3 digests.
  - Some highlevel support for RFC 4998 ERS has been added for
    ArchiveTimeStamp and EvidenceRecord. The new classes are in
    the org.bouncycastle.tsp.ers package.
  - ECIES has now also support SHA256, SHA384, and SHA512.
  - digestAlgorithms filed in CMS SignedData now includes counter
    signature digest algorithms where possible.
  - A new property "org.bouncycastle.jsse.config" has been added
    which can be used to configure the BCJSSE provider when it is
    created using the no-args constructor.
  - In line with changes in OpenSSL 1.1.0,
    OpenSSLPBEParametersGenerator can now be configured with a
    digest.
  - PGPKeyRingGenerator now includes a method for adding a subkey
    with a primary key binding signature.
  - Support for ASN.1 PRIVATE tags has been added.
  - Performance enhancements to Nokeon, AES, GCM, and
    SICBlockCipher.
  - Support for ecoding/decoding McElieceCCA2 keys has been added
    to the PQC API
  - BCJSSE: Added support for jdk.tls.maxCertificateChainLength
    system property (default is 10).
  - BCJSSE: Added support for jdk.tls.maxHandshakeMessageSize
    system property (default is 32768).
  - BCJSSE: Added support for jdk.tls.client.enableCAExtension
    (default is 'false').
  - BCJSSE: Added support for jdk.tls.client.cipherSuites system
    property.
  - BCJSSE: Added support for jdk.tls.server.cipherSuites system
    property.
  - BCJSSE: Extended ALPN support via standard JSSE API to JDK 8
    versions after u251/u252.
  - BCJSSE: Key managers now support EC credentials for use with
    TLS 1.3 ECDSA signature schemes (including brainpool).
  - TLS: Add TLS 1.3 support for brainpool curves per RFC 8734.
  * Notes
  - There is a small API change in the PKIX package to the
    DigestAlgorithmIdentifierFinder interface as a find() method
    that takes an ASN1ObjectIdentifier has been added to it. For
    people wishing to extend their own implementations, see
    DefaultDigestAlgorithmIdentifierFinder for a sample
    implementation.
  - A version of the bcmail API supporting Jakarta Mail has now
    been added (see bcjmail jar).
  - Some work has been done on moving out code that does not need
    to be in the provider jar. This has reduced the size of the
    provider jar and should also make it easier for developers to
    patch the classes involved as they no longer need to be
    signed. bcpkix and bctls are both dependent on the new bcutil
    jar.
- Add build dependencies on
  mvn(jakarta.activation:jakarta.activation-api) and
  mvn(jakarta.mail:jakarta.mail-api)
- Remove unneeded script bouncycastle_getpoms.sh from sources</changelog>
  <changelog author="pmonreal@suse.com" date="1666180800">- Update to version 1.72:
  * Defects Fixed:
  - There were parameter errors in XMSS^MT OIDs for
    XMSSMT_SHA2_40/4_256 and XMSSMT_SHA2_60/3_256. These have
    been fixed.
  - There was an error in Merkle tree construction for the
    Evidence Records (ERS) implementation which could result in
    invalid roots been timestamped. ERS now produces an
    ArchiveTimeStamp for each data object/group with an associated
    reduced hash tree. The reduced hash tree is now calculated as
    a simple path to the root of the tree for each record.
  - OpenPGP will now ignore signatures marked as non-exportable
    on encoding.
  - A tagging calculation error in GCMSIV which could result in
    incorrect tags has been fixed.
  - Issues around Java 17 which could result in failing tests
    have been addressed.
  * Additional Features and Functionality:
  - BCJSSE: TLS 1.3 is now enabled by default where no explicit
    protocols are supplied (e.g. "TLS" or "Default" SSLContext
    algorithms, or SSLContext.getDefault() method).
  - BCJSSE: Rewrite SSLEngine implementation to improve compatibility
    with SunJSSE.
  - BCJSSE: Support export of keying material via extension API.
  - (D)TLS: Add support for 'tls-exporter' channel binding per RFC 9266.
  - (D)TLS (low-level API): By default, only (D)TLS 1.2 and TLS 1.3 are
    offered now. Earlier versions are still supported if explicitly
    enabled. Users may need to check they are offering suitable
    cipher suites for TLS 1.3.
  - (D)TLS (low-level API): Add support for raw public keys per RFC 7250.
  - CryptoServicesRegistrar now has a setServicesConstraints() method
    on it which can be used to selectively turn off algorithms.
  - The NIST PQC Alternate Candidate, Picnic, has been added to the low
    level API and the BCPQC provider.
  - SPHINCS+ has been upgraded to the latest submission, SPHINCS+ 3.1
    and support for Haraka has been added.
  - Evidence records now support timestamp renewal and hash renewal.
  - The SIKE Alternative Candidate NIST Post Quantum Algorithm has
    been added to the low-level PQC API.
  - The NTRU Round 3 Finalist Candidate NIST Post Quantum Algorithm
    has been added to the low-level API and the BCPQC provider.
  - The Falcon Finalist NIST Post Quantum Algorithm has been added to
    the low-level API and the BCPQC provider.
  - The CRYSTALS-Kyber Finalist NIST Post Quantum Algorithm has been
    added to the low-level API and the BCPQC provider.
  - Argon2 Support has been added to the OpenPGP API.
  - XDH IES has now been added to the BC provider.
  - The OpenPGP API now supports AEAD encryption and decryption.
  - The NTRU Prime Alternative Candidate NIST Post Quantum Algorithms
    have been added to the low-level API and the BCPQC provider.
  - The CRYSTALS-Dilithium Finalist NIST Post Quantum Algorithm has
    been added to the low-level API and the BCPQC provider.
  - The BIKE NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - The HQC NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - Grain128AEAD has been added to the lightweight API.
  - A fast version of CRC24 has been added for use with the PGP API.
  - Some additional methods and fields have been exposed in the
    PGPOnePassSignature class to (hopefully) make it easier to
    deal with nested signatures.
  - CMP support classes have been updated to reflect the latest
    editions to the the draft RFC "Lightweight Certificate Management
    Protocol (CMP) Profile".
  - Support has been added to the PKCS#12 implementation for the
    Oracle trusted certificate attribute.
  - Performance of our BZIP2 classes has been improved.
  * Notes:
  - Keep in mind the PQC algorithms are still under development and
    we are still at least a year and a half away from published standards.
    This means the algorithms may still change so by all means experiment,
    but do not use the PQC algoritms for anything long term.
  - The legacy "Rainbow" and "McEliece" implementations have been
    removed from the BCPQC provider. The underlying classes are
    still present if required. Other legacy algorithm implementations
    can be found under the org.bouncycastle.pqc.legacy package.
  * Security Notes:
  - The PQC SIKE algorithm is provided for research purposes only.
    It should now be regarded as broken. The SIKE implementation
    will be withdrawn in BC 1.73.
  * Rebase bouncycastle-javadoc.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1682424000">- Update to version 1.73: [jsc#PED-3756]
  * Defects Fixed:
  - BCJSSE: Instantiating a JSSE provider in some contexts could
    cause an AccessControl exception.
  - The EC key pair generator can generate out of range private
    keys when used with SM2. A specific SM2KeyPairGenerator has
    been added to the low-level API and is used by
    KeyPairGenerator.getInstance("SM2", "BC"). The SM2 signer has
    been updated to check for out of range keys as well..
  - The attached signature type byte was still present in Falcon
    signatures as well as the detached signature byte.
  - There was an off-by-one error in engineGetOutputSize() for ECIES.
  - The method for invoking read() internally in BCPGInputStream
    could result in inconsistent behaviour if the class was extended.
  - Fixed a rounding issue with FF1 Format Preserving Encryption
    algorithm for certain radices.
  - Fixed RFC3394WrapEngine handling of 64 bit keys.
  - Internal buffer for blake2sp was too small and could result in
    an ArrayIndexOutOfBoundsException.
  - JCA PSS Signatures using SHAKE128 and SHAKE256 now support
    encoding of algorithm parameters.
  - PKCS10CertificationRequest now checks for empty extension
    parameters.
  - Parsing errors in the processing of PGP Armored Data now throw
    an explicit exception ArmoredInputException.
  - PGP AEAD streams could occassionally be truncated.
  - The ESTService class now supports processing of chunked HTTP data.
  - A constructed ASN.1 OCTET STRING with a single member would
    sometimes be re-encoded as a definite-length OCTET STRING. The
    encoding has been adjusted to preserve the BER status of the object.
  - PKIXCertPathReviewer could fail if the trust anchor was also
    included in the certificate store being used for path analysis.
  - UTF-8 parsing of an array range ignored the provided length.
  - IPAddress has been written to provide stricter checking and
    avoid the use of Integer.parseInt().
  - A Java 7 class snuck into the Java 5 to Java 8 build.
  * Additional Features and Functionality:
  - The Rainbow NIST Post Quantum Round-3 Candidate has been added to
    the low-level API and the BCPQC provider (level 3 and level 5
    parameter sets only).
  - The GeMSS NIST Post Quantum Round-3 Candidate has been added to
    the low-level API.
  - The org.bouncycastle.rsa.max_mr_tests property check has been
    added to allow capping of MR tests done on RSA moduli.
  - Significant performance improvements in PQC algorithms,
    especially BIKE, CMCE, Frodo, HQC, Picnic.
  - EdDSA verification now conforms to the recommendations of Taming
    the many EdDSAs, in particular cofactored verification. As a side
    benefit, Pornin's basis reduction is now used for EdDSA
    verification, giving a significant performance boost.
  - Major performance improvements for Anomalous Binary (Koblitz) Curves.
  - The lightweight Cryptography finalists Ascon, ISAP, Elephant,
    PhotonBeetle, Sparkle, and Xoodyak have been added to the
    light-weight cryptography API.
  - BLAKE2bp and BLAKE2sp have been added to the light-weight
    cryptography API.
  - Support has been added for X.509, Section 9.8, hybrid certificates
    and CRLs using alternate public keys and alternate signatures.
  - The property "org.bouncycastle.emulate.oracle" has been added to
    signal the provider should return algorithm names on some algorithms
    in the same manner as the Oracle JCE provider.
  - An extra replaceSigners method has been added to CMSSignedData
    which allows for specifying the digest algorithm IDs to be used
    in the new CMSSignedData object.
  - Parsing and re-encoding of ASN.1 PEM data has been further
    optimized to prevent unecessary conversions between basic encoding,
    definite length, and DER.
  - Support has been added for KEM ciphers in CMS in accordance with
    draft-ietf-lamps-cms-kemri
  - Support has been added for certEncr in CRMF to allow issuing of
    certificates for KEM public keys.
  - Further speedups have been made to CRC24.
  - GCMParameterSpec constructor caching has been added to improve
    performance for JVMs that have the class available.
  - The PGPEncrytedDataGenerator now supports injecting the session
    key to be used for PGP PBE encrypted data.
  - The CRMF CertificateRequestMessageBuilder now supports optional
    attributes.
  - Improvements to the s calculation in JPAKE.
  - A general purpose PQCOtherInfoGenerator has been added which
    supports all Kyber and NTRU.
  - An implementation of HPKE (RFC 9180 - Hybrid Public Key
    Encryption) has been added to the light-weight cryptography API.
  * Security Advisories:
  - The PQC implementations have now been subject to formal review for
    secret leakage and side channels, there were issues in BIKE, Falcon,
    Frodo, HQC which have now been fixed. Some weak positives also
    showed up in Rainbow, Picnic, SIKE, and GeMSS - for now this last
    set has been ignored as the algorithms will either be updated if
    they reappear in the Signature Round, or deleted, as is already the
    case for SIKE (it is now in the legacy package). Details on the
    group responsible for the testing can be found in the CONTRIBUTORS
    file.
  - For at least some ECIES variants (e.g. when using CBC) there is
    an issue with potential malleability of a nonce (implying silent
    malleability of the plaintext) that must be sent alongside the
    ciphertext but is outside the IES integrity check. For this reason
    the automatic generation of nonces with IED is now disabled and
    they have to be passed in using an IESParameterSpec. The current
    advice is to agree on a nonce between parties and then rely on the
    use of the ephemeral key component to allow the nonce (rather the
    so called nonce) usage to be extended.</changelog>
  <changelog author="pmonreal@suse.com" date="1687176000">- Update to version 1.74: [bsc#1212508, CVE-2023-33201]
  * Defects Fixed:
  - AsconEngine: Fixed a buffering bug when decrypting across
    multiple processBytes calls (ascon128a unaffected).
  - Context based sanity checking on PGP signatures has been added.
  - The ParallelHash clone constructor was not copying all fields.
  - The maximimum number of blocks for CTR/SIC modes was 1 block
    less than it should have been.
  * Additional Features and Functionality:
  - The PGP API now supports wildcard key IDs for public key
    based data encryption.
  - LMS now supports SHA256/192, SHAKE256/192, and SHAKE256/256
    (the additional SP 8000-208 parameter sets).
  - The PGP API now supports V5 and V6 AEAD encryption for
    encrypted data packets.
  - The PGP examples have been updated to reflect key size and algorithm
    changes that have occurred since they were first written (10+ years...).
  - (D)TLS: A new callback 'TlsPeer.notifyConnectionClosed' will be called
    when the connection is closed (including by failure).
  - BCJSSE: Improved logging of connection events and include unique IDs
    in connection-specific log messages.
  - BCJSSE: Server now logs the offered cipher suites when it fails to
    select one.
  - BCJSSE: Added support for SSLParameters namedGroups and
    signatureSchemes properties (can also be used via BCJSSE
    extension API in earlier Java versions).
  - DTLS: The initial handshake re-send time is now configurable by
    overriding 'TlsPeer.getHandshakeResendTimeMillis'.
  - DTLS: Added support for connection IDs per RFC 9146.
  - DTLS: Performance of DTLSVerifier has been improved so that it can
    reasonably be used for all incoming packets.
  - Initial support has been added for A Mechanism for Encoding
    Differences in Paired Certificates.
  - The PGP API now supports parsing, encoding, and fingerprinting
    of V6 EC/EdEC keys.
  - A thread safe verifier API has been added to the PGP API to support
    multi-threaded verification of certifications on keys and user IDs.
  - The number of keys/sub-keys in a PGPKeyRing can now be found by
    calling PGPKeyRing.size().
  - The PQC algorithms LMS/HSS, SPHINCS+, Dilithium, Falcon, and NTRU
    are now supported directly by the BC provider.
  * Notes:
  - The now defunct PQC SIKE algorithm has been removed, this has also
    meant the removal of its resource files so the provider is now quite
    a bit smaller.
  - As a precaution, HC128 now enforces a 128 bit IV, previous behaviour
    for shorter IVs can be supported where required by padding the IV to
    the 128 bits with zero.
  - PGP encrypted data generation now uses integrity protection by default.
    Previous behaviour for encrypted data can be supported where required
    by calling PGPDataEncryptorBuilder.setWithIntegrityPacket(false) when
    data encryption is set up.
  - There are now additional sanity checks in place to prevent accidental
    mis-use of PGPSignature objects. If this change causes any issues, you
    might want to check what your code is up to as there is probably a bug.
  * Security Advisories:
  - CVE-2023-33201: this release fixes an issue with the X509LDAPCertStoreSpi
    where a specially crafted certificate subject could be used to try and
    extract extra information out of an LDAP server with wild-card matthing
    enabled.
  * Rebase bouncycastle-javadoc.patch
  * Add bouncycastle-notests.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1697630400">- Update to version 1.76:
  * Defects Fixed:
  - Service allocation in the provider could fail due to the lack
    of a permission block. This has been fixed.
  - JceKeyFingerPrintCalculator has been generalised for different
    providers by using "SHA-256" for the algorithm string.
  - BCJSSE: Fixed a regression in 1.74 (NullPointerException) that
    prevents a BCJSSE server from negotiating TLSv1.1 or earlier.
  - DTLS: Fixed server support for client_certificate_type extension.
  - Cipher.unwrap() for HQC could fail due to a miscalculation of
    the length of the KEM packet. This has been fixed.
  - There was exposure to a Java 7 method in the Java 5 to Java 8
    BCTLS jar which could cause issues with some TLS 1.2 cipher
    suites running on older JVMs. This is now fixed.
  * Additional Features and Functionality:
  - BCJSSE: Following OpenJDK, finalizers have been removed from
    SSLSocket subclasses. Applications should close sockets and
    not rely on garbage collection.
  - BCJSSE: Added support for boolean system property
    "jdk.tls.client.useCompatibilityMode" (default "true").
  - DTLS: Added server support for session resumption.
  - JcaPKCS10CertificationRequest will now work with EC on the
    OpenJDK provider.
  - TimeStamp generation now supports the SHA3 algorithm set.
  - The SPHINCS+ simple parameters are now fully supported in the
    BCPQC provider.
  - Kyber, Classic McEliece, HQC, and Bike now supported by the
    CRMF/CMS/CMP APIs.
  - Builder classes have been add for PGP ASCII Armored streams
    allowing CRCs and versions to now be optional.
  - An UnknownPacket type has been added to the PGP APIs to allow
    for forwards compatibility with upcoming revisions to the standard.
  * Rebase patch bouncycastle-notests.patch
- Update to version 1.75:
  * Defects Fixed:
  - Several Java 8 method calls were accidentally introduced in
    the Java 5 to Java 8 build. The affected classes have been
    refactored to remove this.
  - (D)TLS: renegotiation after resumption now fixed to avoid
    breaking connection.
  * Notes:
  - The ASN.1 core package has had some dead and retired methods
    cleaned up and removed.</changelog>
  <changelog author="pmonreal@suse.com" date="1701691200">- Update to version 1.77:
  * Defects Fixed:
  - Using an unescaped '=' in an X.500 RDN would result in the
    RDN being truncated silently. The issue is now detected and
    an exception is thrown.
  - asn1.eac.CertificateBody was returning certificateEffectiveDate
    from getCertificateExpirationDate(). This has been fixed to
    return certificateExpirationDate.
  - DTLS: Fixed retransmission in response to re-receipt of an
    aggregated ChangeCipherSpec.
  - (D)TLS: Fixed compliance for supported_groups extension.
    Server will no longer negotiate an EC cipher suite using a
    default curve when the ClientHello includes the supported_groups
    extension but it contains no curves in common with the server.
    Similarly, a DH cipher suite will not be negotiated when the
    ClientHello includes supported_groups, containing at least one
    FFDHE group, but none in common with the server.
  - IllegalStateException was being thrown by Ed25519/Ed448 SignatureSpi.
  - TLS: class annotation issues that could occur between the BC
    provider and the TLS API for the GCMParameterSpec class when
    the jars were loaded on the boot class path have been addressed.
  - Attempt to create an ASN.1 OID from a zero length byte array
    is now caught at construction time.
  - Attempt to create an X.509 extension block which is empty will
    now be blocked cause an exception.
  - IES implementation will now accept a null ParameterSpec if no
    nonce is needed.
  - An internal method in Arrays was failing to construct its
    failure message correctly on an error.
  - HSSKeyPublicParameters.generateLMSContext() would fail for a
    unit depth key.
  * Additional Features and Functionality:
  - BCJSSE: Added org.bouncycastle.jsse.client.omitSigAlgsCertExtension
    and org.bouncycastle.jsse.server.omitSigAlgsCertExtension boolean
    system properties to control (for client and server resp.) whether
    the signature_algorithms_cert extension should be omitted if it
    would be identical to signature_algorithms. Defaults to true, the
    historical behaviour.
  - The low-level HPKE API now allows the sender to specify an
    ephemeral key pair.
  - Support has been added for the delta-certificate requests in line
    with the current Chameleon Cert draft from the IETF.
  - Some accommodation has been added for historical systems to
    accommodate variations in the SHA-1 digest OID for CMS SignedData.
  - TLS: the TLS API will now try "RSAwithDigestAndMFG1" as well as
    the newer RSAPSS algorithm names when used with the JCA.
  - TLS: RSA key exchange cipher suites are now disabled by default.
  - Support has been added for PKCS#10 requests to allow certificates
    using the altSignature/altPublicKey extensions.
  * Notes:
  - Kyber and Dilithium have been updated according to the latest
    draft of the standard. Dilithium-AES and Kyber-AES have now been
    removed. Kyber now produces 256 bit secrets for all parameter sets
    (in line with the draft standard).
  - NTRU has been updated to produce 256 bit secrets in line with Kyber.
  - SPHINCS+ can now be used to generate certificates in line with
    those used by (Open Quantum Safe) OQS.
  - Falcon object idenitifiers are now in line with OQS as well.
  - PQC CMS SignedData now defaults to SHA-256 for signed attributes
    rather than SHAKE-256. This is also a compatibility change, but may
    change further again as the IETF standard for CMS is updated.</changelog>
  <changelog author="pmonreal@suse.com" date="1714392000">- Update to version 1.78: [bsc#1223252, CVE-2024-30171]
  * Security Advisories.
  - CVE-2024-29857: Importing an EC certificate with specially crafted
    F2m parameters can cause high CPU usage during parameter evaluation.
  - CVE-2024-30171: Possible timing based leakage in RSA based handshakes
    due to exception processing eliminated.
  - CVE-2024-30172: Crafted signature and public key can be used to
    trigger an infinite loop in the Ed25519 verification code.
  - CVE-2024-301XX: When endpoint identification is enabled in the BCJSSE
    and an SSL socket is not created with an explicit hostname (as happens
    with HttpsURLConnection), hostname verification could be performed
    against a DNS-resolved IP address. This has been fixed.
  * Defects Fixed:
  - Issues with a dangling weak reference causing intermittent
    NullPointerExceptions in the OcspCache have been fixed.
  - Issues with non-constant time RSA operations in TLS handshakes.
  - Issue with Ed25519, Ed448 signature verification causing intermittent
    infinite loop have been fixed.
  - Issues with non-constant time ML-KEM implementation ("Kyber Slash").
  - Align ML-KEM input validation with FIPS 203 IPD requirements.
  - Make PEM parsing more forgiving of whitespace to align with RFC 7468.
  - Fix CCM length checks with large nonce sizes (n=12, n=13).
  - EAC: Fixed the CertificateBody ASN.1 type to support an optional
    Certification Authority Reference in a Certificate Request.
  - ASN.1: ObjectIdentifier (also Relative OID) parsing has been optimized
    and the contents octets for both types are now limited to 4096 bytes.
  - BCJSSE: Fixed a missing null check on the result of PrivateKey.getEncoded(),
    which could cause issues for HSM RSA keys.
  - BCJSSE: When endpoint identification is enabled and an SSL socket is not
    created with an explicit hostname (as happens with HttpsURLConnection),
    hostname verification could be performed against a DNS-resolved IP address.
  - The missing module import of java.logging to the provider module has been added.
  - GOST ASN.1 public key alg parameters are now compliant with RFC 9215.
  - An off-by-one error in the encoding for EccP256CurvePoint for ITS.
  - PEM Parser now enforces PEM headers to start at the beginning of the line
    to be meaningful.
  * Additional Features and Functionality.
  - An implementation of MLS (RFC 9420 - The Messaging Layer Security Protocol)
    has been added as a new module.
  - NTRU now supports NTRU-HPS4096-1229 and NTRU-HRSS-1373.
  - Improvements to PGP support, including Camellia key wrapping and Curve25519,
    Curve448 key types (including XDH with HKDF).
  - Added initial support for ML-KEM in TLS.
  - Added XWing hybrid KEM construction (X25519 + ML-KEM-768).
  - Introduced initial KEMSpi support (NTRU, SNTRU Prime) for JDK 21+.
  - Introduced initial composite signature support for X509 Certificates.
  - PKCS#12 now supports PKCS12-AES256-AES128, PKCS12-AES256-AES128-GCM,
    PKCS12-DEF-AES256-AES128, and PKCS12-DEF-AES256-AES128-GCM.
  - The default type for the KeyStore.getInstance("PKCS12", "BC") can now be set
    using the org.bouncycastle.pkcs12.default system/security property.
  - The PGP SExpParser will now handle Ed25519 and Ed448 keys.
  - Dilithium and Kyber key encoding updated to latest Draft RFCs
    (draft-ietf-lamps-dilithium-certificates and draft-ietf-lamps-kyber-certificates)
  - Support has been added for encryption key derivation using HKDF in CMS, see
    draft-housley-lamps-cms-cek-hkdf-sha256.
  - X500Name now recognises jurisdiction{C,ST,L} DNs.
  - CertPathValidationContext and CertificatePoliciesValidation now include
    implementations of Memoable.
  - The Composite post-quantum signatures implementation has been updated to the
    latest draft draft-ounsworth-pq-composite-sigs.
  * Full release notes: bouncycastle.org/releasenotes.html#r1rv78
  * Rebase bouncycastle-notests.patch</changelog>
  <changelog author="fstrba@suse.com" date="1714392001">- Update to version 1.78.1
  * Defects Fixed:
  - The new dependency of the the PGP API on the bcutil jar was
    missing from the module jar, the OSGi manifest, and the Maven
    POM. This has been fixed.
  - Missing exports and duplicate imports have been added/removed
    from the OSGi manifests.
  - The OSGi manifests now have the same bundle IDs as 1.77 and
    lock down dependencies to the equivalent variations
  - A check in the X.509 Extensions class preventing the parsing
    of empty extensions has been removed.</changelog>
</package>
<package pkgid="69c22953cc92d32ae9e462a50d444d1cfbbe41610663d9b3bfbad0dbf133e1c9" name="bouncycastle-mail" arch="noarch">
  <version epoch="0" ver="1.78.1" rel="150200.3.29.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1570881600">- Update pom files with those from Maven repository.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573041600">- Fix arch dependent macros in noarch package [bsc#1109539]</changelog>
  <changelog author="fstrba@suse.com" date="1585137600">- Added patch:
  * bouncycastle-osgi.patch
    + Add OSGi manifests to the distributed jars so that they can
    be used from eclipse</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588161600">- Version update to 1.65
  * Defects Fixed:
  - DLExternal would encode using DER encoding for tagged SETs.
  - ChaCha20Poly1305 could fail for large (&gt;~2GB) files.
  - ChaCha20Poly1305 could fail for small updates when used via the provider.
  - Properties.getPropertyValue could ignore system property when other
    local overrides set.
  - The entropy gathering thread was not running in daemon mode, meaning there
    could be a delay in an application shutting down due to it.
  - A recent change in Java 11 could cause an exception with the BC Provider's
    implementation of PSS.
  - BCJSSE: TrustManager now tolerates having no trusted certificates.
  - BCJSSE: Choice of credentials and signing algorithm now respect the peer's
    signature_algorithms extension properly.
  - BCJSSE: KeyManager for KeyStoreBuilderParameters no longer leaks memory.
  * Additional Features and Functionality:
  - LMS and HSS (RFC 8554) support has been added to the low level library and
    the PQC provider.
  - SipHash128 support has been added to the low level library and the JCE provider.
  - BCJSSE: BC API now supports explicitly specifying the session to resume.
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: Added support for extended_master_secret system properties:
    jdk.tls.allowLegacyMasterSecret, jdk.tls.allowLegacyResumption,
    jdk.tls.useExtendedMasterSecret .
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: KeyManager and TrustManager now check algorithm constraints for
    keys and certificate chains.
  - BCJSSE: KeyManager selection of server credentials now prefers matching
    SNI hostname (if any).
  - BCJSSE: KeyManager may now fallback to imperfect credentials (expired,
    SNI mismatch).
  - BCJSSE: Client-side OCSP stapling support (beta version: via status_request
    extension only, provides jdk.tls.client.enableStatusRequestExtension, and
    requires CertPathBuilder support).
  - TLS: DSA in JcaTlsCrypto now falls back to stream signing to work around
    NoneWithDSA limitations in default provider.</changelog>
  <changelog author="pmonreal@suse.com" date="1595937600">- Version update to 1.66 [bsc#1186328, CVE-2020-15522]
  * Defects Fixed:
  - EdDSA verifiers now reset correctly after rejecting overly long signatures.
  - BCJSSE: SSLSession.getPeerCertificateChain could throw NullPointerException.
  - qTESLA-I verifier would reject some valid signatures.
  - qTESLA verifiers now reject overly long signatures.
  - PGP regression caused failure to preserve existing version header when
    headers were reset.
  - PKIXNameConstraintValidator had a bad cast preventing use of multiple
    OtherName constraints.
  - Serialisation of the non-CRT RSA Private Key could cause a NullPointerException.
  - An extra 4 bytes was included in the start of HSS public key encodings.
  - CMS with Ed448 using a direct signature was using id-shake256-len
    rather than id-shake256.
  - Use of GCMParameterSpec could cause an AccessControlException under
    some circumstances.
  - DTLS: Fixed high-latency HelloVerifyRequest handshakes.
  - An encoding bug for rightEncoded() in KMAC has been fixed.
  - For a few values the cSHAKE implementation would add unnecessary pad bytes
    where the N and S strings produced encoded data that was block aligned.
  - There were a few circumstances where Argon2BytesGenerator might hit an
    unexpected null. These have been removed.
  * Additional Features and Functionality
  - The qTESLA signature algorithm has been updated to v2.8 (20191108).
  - BCJSSE: Client-side OCSP stapling now supports status_request_v2 extension.
  - Support has been added for "ocsp.enable", "ocsp.responderURL" and
    PKIXRevocationChecker for users of Java 8 and later.
  - Support has been added for "org.bouncycastle.x509.enableCRLDP" to the PKIX validator.
  - BCJSSE: Now supports system property 'jsse.enableFFDHE'
  - BCJSSE: Now supports system properties 'jdk.tls.client.SignatureSchemes'
    and 'jdk.tls.server.SignatureSchemes'.
  - Multi-release support has been added for Java 11 XECKeys.
  - Multi-release support has been added for Java 15 EdECKeys.
  - The MiscPEMGenerator will now output general PrivateKeyInfo structures.
  - A new property "org.bouncycastle.pkcs8.v1_info_only" has been added to
    make the provider only produce version 1 PKCS8 PrivateKeyInfo structures.
  - The PKIX CertPathBuilder will now take the target certificate from the target
    constraints if a specific certificate is given to the selector.
  - BCJSSE: A range of ARIA and CAMELLIA cipher suites added to supported list.
  - BCJSSE: Now supports the PSS signature schemes from RFC 8446 (TLS 1.2 onwards).
  - Performance of the Base64 encoder has been improved.
  - The PGPPublicKey class will now include direct key signatures when checking
    for key expiry times.
  * NOTES:
  - The qTESLA update breaks compatibility with previous versions.
    Private keys now include a hash of the public key at the end,
    and signatures are no longer interoperable with previous versions.</changelog>
  <changelog author="pmonreal@suse.com" date="1608552000">- Version update to 1.67 [bsc#1180215, CVE-2020-28052]
  * CVE-2020-28052: OpenBSDBCrypt.checkPassword utility method
    compared incorrect data when checking the password
  * Defects Fixed:
  - BCJSSE: SunJSSE compatibility fix - override of getChannel()
    removed and 'urgent data' behaviour should now conform to
    what the SunJSSE expects
  - Nested BER data could sometimes cause issues in octet strings
  - Certificates/CRLs with short signatures could cause an exception
    in toString() in the BC X509 Certificate implmentation
  - In line with latest changes in the JVM, SignatureSpis which
    don't require parameters now return null on engineGetParameters()
  - The RSA KeyFactory now always preferentially produces RSAPrivateCrtKey
    where it can on requests for a KeySpec based on an RSAPrivateKey
  - CMSTypedStream$FullReaderStream now handles zero length reads correctly
  - Unecessary padding was added on KMAC when the key string was block aligned
  - Zero length data would cause an unexpected exception from RFC5649WrapEngine
  - OpenBSDBcrypt was failing to handle some valid prefixes
  * Additional Features and Functionality
  - Performance improvement of Argon2 and Noekeon
  - A setSessionKeyObfuscation() method has been added to
    PublicKeyKeyEncryptionMethodGenerator to allow turning off of session key
    obfuscation (default is on, method primarily to get around early version
    GPG issues with AES-128 keys)
  - Implemented 'safegcd' constant-time modular inversion (as well as a
    variable-time variant). It has replaced Fermat inversion in all our EC
    code, and BigInteger.modInverse in several other places, particularly
    signers. This improves side-channel protection, and also gives a
    significant performance boost
  - Performance of custom binary ECC curves and Edwards Curves has been improved
  - BCJSSE: New boolean system property 'org.bouncycastle.jsse.keyManager.checkEKU'
    allows to disable ExtendedKeyUsage restrictions when selecting credentials
    (although the peer may still complain)
  - Initial support has been added for "Composite Keys and Signatures For Use
    In Internet PKI" using the test OID. Please note there will be further
    refinements to this as the draft is standardised
  - The BC EdDSA signature API now supports keys implementing all methods on
    the EdECKey and XECKey interfaces directly
  - Work has begun on classes to support the ETSI TS 103 097, Intelligent
    Transport Systems (ITS) in the bcpkix package
  - Further optimization work has been done on GCM
  - A NewHope based processor, similar to the one for Key Agreement has been
    added for trying to "quantum hard" KEM algorithms
  - PGP clear signed signatures now support SHA-224
  - Treating absent vs NULL as equivalent can now be configured by a system
    property. By default this is not enabled
  - Mode name checks in Cipher strings should now make sure an improper mode
    name always results in a NoSuchAlgorithmException
  - In line with changes in OpenSSL, the OpenSSLPBKDF now uses UTF8 encoding</changelog>
  <changelog author="fstrba@suse.com" date="1610539200">- Version update to 1.68
  * Defects Fixed:
  - Some BigIntegers utility methods would fail for
    BigInteger.ZERO. This has been fixed.
  - PGPUtil.isKeyRing() was not detecting secret sub-keys in its
    input. This has been fixed.
  - The ASN.1 class, ArchiveTimeStamp was insisting on a value
    for the optional reducedHashTree field. This has been fixed.
  - BCJSSE: Lock against multiple writers - a possible
    synchronization issue has been removed.
  * Additional Features and Functionality
  - BCJSSE: Added support for system property
    com.sun.net.ssl.requireCloseNotify. Note that we are using a
    default value of 'true'.
  - BCJSSE: 'TLSv1.3' is now a supported protocol for both client
    and server. For this release it is only enabled by default for
    the 'TLSv1.3' SSLContext, but can be explicitly enabled using
    'setEnabledProtocols' on an SSLSocket or SSLEngine, or via
    SSLParameters.
  - BCJSSE: Session resumption is now also supported for servers
    in TLS 1.2 and earlier. For this release it is disabled by
    default, and can be enabled by setting the boolean system
    property org.bouncycastle.jsse.server.enableSessionResumption
    to 'true'.
  - The provider RSA-PSS signature names that follow the JCA
    naming convention.
  - FIPS mode for the BCJSSE now enforces namedCurves for any
    presented certificates.
  - PGPSignatureSubpacketGenerator now supports editing of a
    pre-existing sub-packet list.</changelog>
  <changelog author="pmonreal@suse.com" date="1621944000">- Add bouncycastle_getpoms.sh to get pom files from Maven repos</changelog>
  <changelog author="fstrba@suse.com" date="1627387200">- Directory core/docs does not exist</changelog>
  <changelog author="fstrba@suse.com" date="1647518400">- Add glassfish-activation-api dependency so that we can build with
  JDK that does not contain the JavaEE modules</changelog>
  <changelog author="fstrba@suse.com" date="1647604800">- Build with source/target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1648641600">- Build against the standalone JavaEE modules unconditionally</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1650628800">- Version update to 1.71
  * Defects Fixed
  - In line with GPG the PGP API now attempts to preserve
    comments containing non-ascii UTF8 characters.
  - An accidental partial dependency on Java 1.7 has been removed
    from the TLS API.
  - JcaPKIXIdentityBuilder would fail to process File objects
    correctly. This is now fixed.
  - Some byte[] parameters to the CMP API were not being
    defensively cloned to prevent accidental changes. Extra
    defensive cloning has been added.
  - CMS primitives would sometimes convert ASN.1 definite-length
    encodings into indefinite-length encodings. The primitives
    will now try and preserve the original encoding where possible.
  - CMSSignedData.getAttributeCertificates() now properly
    restricts the tag values checked to just 1 (the obsolete
    v1 tag) and 2 (for the more current v2 certificates).
  - BCJSSE now tries to validate a custom KeyManager selection
    in order to catch errors around a key manager ignoring
    key type early.
  - Compressed streams in PGP ending with zero length partial
    packets could cause failure on parsing the OpenPGP API.
    This has been fixed.
  - The fallback mode for JceAsymmetricKeyWrapper/Unwrapper
    would lose track of any algorithm parameters generated
    in the initial attempt. The algorithm parameters are now
    propagated.
  - An accidental regression introduced by a fix for another
    issue in PKIXCertPathReviewer around use of the
    AuthorityKeyIdentifier extension and it failing to match
    a certificate uniquely when the serial number field
    is missing has been fixed.
  - An error was found in the creation of TLS 1.3 Export Keying
    Material which could cause compatibility issues. This has
    been fixed.
  * Additional Features and Functionality
  - Support has been added for OpenPGP regular expression
    signature packets.
  - Support has been added for OpenPGP PolicyURI signature
    packets.
  - A utility method has been added to PGPSecretKeyRing to allow
    for inserting or replacing a PGPPublicKey.
  - The NIST PQC Finalist, Classic McEliece has been added to the
    low level API and the BCPQC provider.
  - The NIST PQC Alternate Candidate, SPHINCS+ has been added to
    the BCPQC provider.
  - The NIST PQC Alternate Candidate, FrodoKEM has been added to
    the low level API and the BCPQC provider.
  - The NIST PQC Finalist, SABER has been added to the low level
    API and the BCPQC provider.
  - KMAC128, KMAC256 has been added to the BC provider (empty
    customization string).
  - TupleHash128, TupleHash256 has been added to the BC provider
    (empty customization string).
  - ParallelHash128, ParallelHash256 has been added to the BC
    provider (empty customization string, block size 1024 bits).
  - Two new properties: "org.bouncycastle.rsa.max_size" (default
    15360) and "org.bouncycastle.ec.fp_max_size" (default 1042)
    have been added to cap the maximum size of RSA and EC keys.
  - RSA modulus are now checked to be provably composite using
    the enhanced MR probable prime test.
  - Imported EC Fp basis values are now validated against the MR
    prime number test before use. The certainty level of the
    prime test can be determined by
    "org.bouncycastle.ec.fp_certainty" (default 100).
  - The BC entropy thread now has a specific name:
    "BC-ENTROPY-GATHERER".
  - Utility methods have been added for joining/merging PGP
    public keys and signatures.
  - Blake3-256 has been added to the BC provider.
  - DTLS: optimisation to delayed handshake hash.
  - Further additions to the ETSI 102 941 support in the ETSI/ITS
    package: certification request, signed message generation and
    verification now supported.
  - CMSSignedDataGenerator now supports the direct generation of
    definite-length data.
  - The NetscapeCertType class now has a hasUsages() method on it
    for querying usage settings on its bit string.
  - Support for additional input has been added for deterministic
    (EC)DSA.
  - The OpenPGP API provides better support for subkey
    generation.
  - BCJSSE: Added boolean system properties
    "org.bouncycastle.jsse.client.dh.disableDefaultSuites" and
    "org.bouncycastle.jsse.server.dh.disableDefaultSuites".
    Default "false". Set to "true" to disable inclusion of DH
    cipher suites in the default cipher suites for client/server
    respectively.
  * Notes
  - The deprecated QTESLA implementation has been removed from
    the BCPQC provider.
  - The submission update to SPHINCS+ has been added. This
    changes the generation of signatures - particularly
    deterministic ones.
- Version update to 1.70
  * Defects Fixed
  - Blake 3 output limit is enforced.
  - The PKCS12 KeyStore was relying on default precedence for its
    key Cipher implementation so was sometimes failing if used
    from the keytool. The KeyStore class now makes sure it uses
    the correct Cipher implementation.
  - Fixed bzip2 compression for empty contents (GH #993).
  - ASN.1: More robust handling of high tag numbers and
    definite-length forms.
  - BCJSSE: Fix a concurrent modification issue in session
    contexts (GH#968).
  - BCJSSE: Don't log sensitive system property values (GH#976).
  - BCJSSE: Fixed a priority issue amongst imperfect-match
    credentials in KeyManager classes.
  - The IES AlgorithmParameters object has been re-written to
    properly support all the variations of IESParameterSpec.
  - getOutputSize() for ECIES has been corrected to avoid
    occassional underestimates.
  - The lack of close() in the ASN.1 Dump command line utility
    was triggering false positives in some code analysis tools. A
    close() call has been added.
  - PGPPublicKey.getBitStrength() now properly recognises EdDSA
    keys.
  * Additional Features and Functionality
  - Missing PGP CRC checksums can now be optionally ignored using
    setDetectMissingCRC() (default false) on ArmoredInputStream.
  - PGPSecretKey.copyWithNewPassword() now has a variant which
    uses USAGE_SHA1 for key protection if a PGPDigestCalculator
    is passed in.
  - PGP ASCII armored data now skips "\t", "\v", and "\f".
  - PKCS12 files with duplicate localKeyId attributes on
    certificates will now have the incorrect attributes filtered
    out, rather than the duplicate causing an exception.
  - PGPObjectFactory will now ignore packets representing
    unrecognised signature versions in the input stream.
  - The X.509 extension generator will now accumulate some
    duplicate X.509 extensions into a single extension where it
    is possible to do so.
  - Removed support for maxXofLen in Kangaroo digest.
  - Ignore marker packets in PGP Public and Secret key ring
    collection.
  - An implementation of LEA has been added to the low-level API.
  - Access, recovery, and direct use for PGP session keys has
    been added to the OpenPGP API for processing encrypted data.
  - A PGPCanonicalizedDataGenerator has been added which converts
    input into canonicalized literal data for text and UTF-8
    mode.
  - A getUserKeyingMaterial() method has been added to the
    KeyAgreeRecipientInformation class.
  - ASN.1: Tagged objects (and parsers) now support all tag
    classes. Special code for ApplicationSpecific has been
    deprecated and re-implemented in terms of TaggedObject.
  - ASN.1: Improved support for nested tagging.
  - ASN.1: Added support for GraphicString, ObjectDescriptor,
    RelativeOID.
  - ASN.1: Added support for constructed BitString encodings,
    including efficient parsing for large values.
  - TLS: Added support for external PSK handshakes.
  - TLS: Check policy restrictions on key size when determining
    cipher suite support.
  - A performance issue in KeccakDigest due to left over debug
    code has been identified and dealt with.
  - BKS key stores can now be used for collecting protected keys
    (note: any attempt to store such a store will cause an
    exception).
  - A method for recovering user keying material has been added
    to KeyAgreeRecipientInformation.
  - Support has been added to the CMS API for SHA-3 based
    PLAIN-ECDSA.
  - The low level BcDefaultDigestProvider now supports the SHAKE
    family of algorithms and the SM3 alogirthm.
  - PGPKeyRingGenerator now supports creation of key-rings with
    direct-key identified keys.
  - The PQC NIST candidate, signature algorithm SPHINCS+ has been
    added to the low-level API.
  - ArmoredInputStream now explicitly checks for a '\n' if in
    crLF mode.
  - Direct support for NotationDataOccurances, Exportable,
    Revocable, IntendedRecipientFingerPrints, and AEAD algorithm
    preferences has been added to PGPSignatureSubpacketVector.
  - Further support has been added for keys described using
    S-Expressions in GPG 2.2.X.
  - Support for OpenPGP Session Keys from the (draft) Stateless
    OpenPGP CLI has been added.
  - Additional checks have been added for PGP marker packets in
    the parsing of PGP objects.
  - A CMSSignedData.addDigestAlgorithm() has been added to allow
    for adding additional digest algorithm identifiers to CMS
    SignedData structures when required.
  - Support has been added to CMS for the LMS/HSS signature
    algorithm.
  - The system property
    "org.bouncycastle.jsse.client.assumeOriginalHostName"
    (default false) has been added for dealing with SNI problems
    related to the host name not being propagate by the JVM.
  - The JcePKCSPBEOutputEncryptorBuilder now supports SCRYPT with
    ciphers that do not have algorithm parameters (e.g. AESKWP).
  - Support is now added for certificates using ETSI TS 103 097,
    "Intelligent Transport Systems (ITS)" in the bcpkix package.
  * Notes.
  - While this release should maintain source code compatibility,
    developers making use of some parts of the ASN.1 library will
    find that some classes need recompiling. Apologies for the
    inconvenience.
- Version update to 1.69
  * Defects Fixed
  - Lightweight and JCA conversion of Ed25519 keys in the PGP API
    could drop the leading byte as it was zero. This has been
    fixed.
  - Marker packets appearing at the start of PGP public key rings
    could cause parsing failure. This has been fixed.
  - ESTService could fail for some valid Content-Type headers.
    This has been fixed.
  - Originator key algorithm parameters were being passed as NULL
    in key agreement recipients. The parameters now reflect the
    value of the parameters in the key's SubjectPublicKeyInfo.
  - ContentType on encapsulated data was not been passed through
    correctly for authenticated and enveloped data. This has been
    fixed.
  - NTRUEncryptionParameters and
    NTRUEncryptionKeyGenerationParameters were not correctly
    cloning the contained message digest. This has been fixed.
  - CertificateFactory.generateCertificates()/generateCRLs()
    would throw an exception if extra data was found at the end
    of a PEM file even if valid objects had been found. Extra
    data is now ignored providing at least one object found.
  - Internal class PKIXCRLUtil could throw a NullPointerException
    for CRLs with an absent nextUpdate field. This has been
    fixed.
  - PGP ArmoredInputStream now fails earlier on malformed
    headers.
  - The McElieceKobaraImaiCipher was randomly throwing "Bad
    Padding: invalid ciphertext" exception while decrypting due
    to leading zeroes been missed during processing of the cipher
    text. This has been fixed.
  - Ed25519 keys being passed in via OpenSSH key spec are now
    validated in the KeyFactory.
  - Blowfish keys are now range checked on cipher construction.
  - In some cases PGPSecretKeyRing was failing to search its
    extraPubKeys list when searching for public keys.
  - The BasicConstraintsValidation class in the BC cert path
    validation tools has improved conformance to RFC 5280.
  - AlgorithmIdentifiers involving message digests now attempt to
    follow the latest conventions for the parameters field
    (basically DER NULL appears less).
  - Fix various conversions and interoperability for XDH and
    EdDSA between BC and SunEC providers.
  - TLS: Prevent attempts to use KeyUpdate mechanism in versions
    before TLS 1.3.
  * Additional Features and Functionality
  - GCM-SIV has been added to the lightweight API and the
    provider.
  - Blake3 has been added to the lightweight API.
  - The OpenSSL PEMParser can now be extended to add specialised
    parsers.
  - Base32 encoding has now been added, the default alphabet is
    from RFC 4648.
  - The KangarooTwelve message digest has been added to the
    lightweight API.
  - An implementation of the two FPE algorithms, FF1 and FF3-1 in
    SP 800-38G has been added to the lightweight API and the JCE
    provider.
  - An implementation of ParallelHash has been added to the
    lightweight API.
  - An implementation of TupleHash has been added to the
    lightweight API.
  - RSA-PSS now supports the use of SHAKE128 and SHAKE256 as the
    mask generation function and digest.
  - ECDSA now supports the use of SHAKE128 and SHAKE256.
  - PGPPBEEncryptedData will now reset the stream if the initial
    checksum fails so another password can be tried.
  - Iterators on public and secret key ring collections in PGP
    now reflect the original order of the public/secret key rings
    they contain.
  - KeyAgreeRecipientInformation now has a getOriginator() method
    for retrieving the underlying orginator information.
  - PGPSignature now has a getDigestPrefix() method for people
    wanting exposure to the signature finger print details.
  - The old BKS-V1 format keystore is now disabled by default. If
    you need to use BKS-V1 for legacy reasons, it can be
    re-enabled by adding: org.bouncycastle.bks.enable_v1=true to
    the java.security file. We would be interested in hearing
    from anyone that needs to do this.
  - PLAIN-ECDSA now supports the SHA3 digests.
  - Some highlevel support for RFC 4998 ERS has been added for
    ArchiveTimeStamp and EvidenceRecord. The new classes are in
    the org.bouncycastle.tsp.ers package.
  - ECIES has now also support SHA256, SHA384, and SHA512.
  - digestAlgorithms filed in CMS SignedData now includes counter
    signature digest algorithms where possible.
  - A new property "org.bouncycastle.jsse.config" has been added
    which can be used to configure the BCJSSE provider when it is
    created using the no-args constructor.
  - In line with changes in OpenSSL 1.1.0,
    OpenSSLPBEParametersGenerator can now be configured with a
    digest.
  - PGPKeyRingGenerator now includes a method for adding a subkey
    with a primary key binding signature.
  - Support for ASN.1 PRIVATE tags has been added.
  - Performance enhancements to Nokeon, AES, GCM, and
    SICBlockCipher.
  - Support for ecoding/decoding McElieceCCA2 keys has been added
    to the PQC API
  - BCJSSE: Added support for jdk.tls.maxCertificateChainLength
    system property (default is 10).
  - BCJSSE: Added support for jdk.tls.maxHandshakeMessageSize
    system property (default is 32768).
  - BCJSSE: Added support for jdk.tls.client.enableCAExtension
    (default is 'false').
  - BCJSSE: Added support for jdk.tls.client.cipherSuites system
    property.
  - BCJSSE: Added support for jdk.tls.server.cipherSuites system
    property.
  - BCJSSE: Extended ALPN support via standard JSSE API to JDK 8
    versions after u251/u252.
  - BCJSSE: Key managers now support EC credentials for use with
    TLS 1.3 ECDSA signature schemes (including brainpool).
  - TLS: Add TLS 1.3 support for brainpool curves per RFC 8734.
  * Notes
  - There is a small API change in the PKIX package to the
    DigestAlgorithmIdentifierFinder interface as a find() method
    that takes an ASN1ObjectIdentifier has been added to it. For
    people wishing to extend their own implementations, see
    DefaultDigestAlgorithmIdentifierFinder for a sample
    implementation.
  - A version of the bcmail API supporting Jakarta Mail has now
    been added (see bcjmail jar).
  - Some work has been done on moving out code that does not need
    to be in the provider jar. This has reduced the size of the
    provider jar and should also make it easier for developers to
    patch the classes involved as they no longer need to be
    signed. bcpkix and bctls are both dependent on the new bcutil
    jar.
- Add build dependencies on
  mvn(jakarta.activation:jakarta.activation-api) and
  mvn(jakarta.mail:jakarta.mail-api)
- Remove unneeded script bouncycastle_getpoms.sh from sources</changelog>
  <changelog author="pmonreal@suse.com" date="1666180800">- Update to version 1.72:
  * Defects Fixed:
  - There were parameter errors in XMSS^MT OIDs for
    XMSSMT_SHA2_40/4_256 and XMSSMT_SHA2_60/3_256. These have
    been fixed.
  - There was an error in Merkle tree construction for the
    Evidence Records (ERS) implementation which could result in
    invalid roots been timestamped. ERS now produces an
    ArchiveTimeStamp for each data object/group with an associated
    reduced hash tree. The reduced hash tree is now calculated as
    a simple path to the root of the tree for each record.
  - OpenPGP will now ignore signatures marked as non-exportable
    on encoding.
  - A tagging calculation error in GCMSIV which could result in
    incorrect tags has been fixed.
  - Issues around Java 17 which could result in failing tests
    have been addressed.
  * Additional Features and Functionality:
  - BCJSSE: TLS 1.3 is now enabled by default where no explicit
    protocols are supplied (e.g. "TLS" or "Default" SSLContext
    algorithms, or SSLContext.getDefault() method).
  - BCJSSE: Rewrite SSLEngine implementation to improve compatibility
    with SunJSSE.
  - BCJSSE: Support export of keying material via extension API.
  - (D)TLS: Add support for 'tls-exporter' channel binding per RFC 9266.
  - (D)TLS (low-level API): By default, only (D)TLS 1.2 and TLS 1.3 are
    offered now. Earlier versions are still supported if explicitly
    enabled. Users may need to check they are offering suitable
    cipher suites for TLS 1.3.
  - (D)TLS (low-level API): Add support for raw public keys per RFC 7250.
  - CryptoServicesRegistrar now has a setServicesConstraints() method
    on it which can be used to selectively turn off algorithms.
  - The NIST PQC Alternate Candidate, Picnic, has been added to the low
    level API and the BCPQC provider.
  - SPHINCS+ has been upgraded to the latest submission, SPHINCS+ 3.1
    and support for Haraka has been added.
  - Evidence records now support timestamp renewal and hash renewal.
  - The SIKE Alternative Candidate NIST Post Quantum Algorithm has
    been added to the low-level PQC API.
  - The NTRU Round 3 Finalist Candidate NIST Post Quantum Algorithm
    has been added to the low-level API and the BCPQC provider.
  - The Falcon Finalist NIST Post Quantum Algorithm has been added to
    the low-level API and the BCPQC provider.
  - The CRYSTALS-Kyber Finalist NIST Post Quantum Algorithm has been
    added to the low-level API and the BCPQC provider.
  - Argon2 Support has been added to the OpenPGP API.
  - XDH IES has now been added to the BC provider.
  - The OpenPGP API now supports AEAD encryption and decryption.
  - The NTRU Prime Alternative Candidate NIST Post Quantum Algorithms
    have been added to the low-level API and the BCPQC provider.
  - The CRYSTALS-Dilithium Finalist NIST Post Quantum Algorithm has
    been added to the low-level API and the BCPQC provider.
  - The BIKE NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - The HQC NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - Grain128AEAD has been added to the lightweight API.
  - A fast version of CRC24 has been added for use with the PGP API.
  - Some additional methods and fields have been exposed in the
    PGPOnePassSignature class to (hopefully) make it easier to
    deal with nested signatures.
  - CMP support classes have been updated to reflect the latest
    editions to the the draft RFC "Lightweight Certificate Management
    Protocol (CMP) Profile".
  - Support has been added to the PKCS#12 implementation for the
    Oracle trusted certificate attribute.
  - Performance of our BZIP2 classes has been improved.
  * Notes:
  - Keep in mind the PQC algorithms are still under development and
    we are still at least a year and a half away from published standards.
    This means the algorithms may still change so by all means experiment,
    but do not use the PQC algoritms for anything long term.
  - The legacy "Rainbow" and "McEliece" implementations have been
    removed from the BCPQC provider. The underlying classes are
    still present if required. Other legacy algorithm implementations
    can be found under the org.bouncycastle.pqc.legacy package.
  * Security Notes:
  - The PQC SIKE algorithm is provided for research purposes only.
    It should now be regarded as broken. The SIKE implementation
    will be withdrawn in BC 1.73.
  * Rebase bouncycastle-javadoc.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1682424000">- Update to version 1.73: [jsc#PED-3756]
  * Defects Fixed:
  - BCJSSE: Instantiating a JSSE provider in some contexts could
    cause an AccessControl exception.
  - The EC key pair generator can generate out of range private
    keys when used with SM2. A specific SM2KeyPairGenerator has
    been added to the low-level API and is used by
    KeyPairGenerator.getInstance("SM2", "BC"). The SM2 signer has
    been updated to check for out of range keys as well..
  - The attached signature type byte was still present in Falcon
    signatures as well as the detached signature byte.
  - There was an off-by-one error in engineGetOutputSize() for ECIES.
  - The method for invoking read() internally in BCPGInputStream
    could result in inconsistent behaviour if the class was extended.
  - Fixed a rounding issue with FF1 Format Preserving Encryption
    algorithm for certain radices.
  - Fixed RFC3394WrapEngine handling of 64 bit keys.
  - Internal buffer for blake2sp was too small and could result in
    an ArrayIndexOutOfBoundsException.
  - JCA PSS Signatures using SHAKE128 and SHAKE256 now support
    encoding of algorithm parameters.
  - PKCS10CertificationRequest now checks for empty extension
    parameters.
  - Parsing errors in the processing of PGP Armored Data now throw
    an explicit exception ArmoredInputException.
  - PGP AEAD streams could occassionally be truncated.
  - The ESTService class now supports processing of chunked HTTP data.
  - A constructed ASN.1 OCTET STRING with a single member would
    sometimes be re-encoded as a definite-length OCTET STRING. The
    encoding has been adjusted to preserve the BER status of the object.
  - PKIXCertPathReviewer could fail if the trust anchor was also
    included in the certificate store being used for path analysis.
  - UTF-8 parsing of an array range ignored the provided length.
  - IPAddress has been written to provide stricter checking and
    avoid the use of Integer.parseInt().
  - A Java 7 class snuck into the Java 5 to Java 8 build.
  * Additional Features and Functionality:
  - The Rainbow NIST Post Quantum Round-3 Candidate has been added to
    the low-level API and the BCPQC provider (level 3 and level 5
    parameter sets only).
  - The GeMSS NIST Post Quantum Round-3 Candidate has been added to
    the low-level API.
  - The org.bouncycastle.rsa.max_mr_tests property check has been
    added to allow capping of MR tests done on RSA moduli.
  - Significant performance improvements in PQC algorithms,
    especially BIKE, CMCE, Frodo, HQC, Picnic.
  - EdDSA verification now conforms to the recommendations of Taming
    the many EdDSAs, in particular cofactored verification. As a side
    benefit, Pornin's basis reduction is now used for EdDSA
    verification, giving a significant performance boost.
  - Major performance improvements for Anomalous Binary (Koblitz) Curves.
  - The lightweight Cryptography finalists Ascon, ISAP, Elephant,
    PhotonBeetle, Sparkle, and Xoodyak have been added to the
    light-weight cryptography API.
  - BLAKE2bp and BLAKE2sp have been added to the light-weight
    cryptography API.
  - Support has been added for X.509, Section 9.8, hybrid certificates
    and CRLs using alternate public keys and alternate signatures.
  - The property "org.bouncycastle.emulate.oracle" has been added to
    signal the provider should return algorithm names on some algorithms
    in the same manner as the Oracle JCE provider.
  - An extra replaceSigners method has been added to CMSSignedData
    which allows for specifying the digest algorithm IDs to be used
    in the new CMSSignedData object.
  - Parsing and re-encoding of ASN.1 PEM data has been further
    optimized to prevent unecessary conversions between basic encoding,
    definite length, and DER.
  - Support has been added for KEM ciphers in CMS in accordance with
    draft-ietf-lamps-cms-kemri
  - Support has been added for certEncr in CRMF to allow issuing of
    certificates for KEM public keys.
  - Further speedups have been made to CRC24.
  - GCMParameterSpec constructor caching has been added to improve
    performance for JVMs that have the class available.
  - The PGPEncrytedDataGenerator now supports injecting the session
    key to be used for PGP PBE encrypted data.
  - The CRMF CertificateRequestMessageBuilder now supports optional
    attributes.
  - Improvements to the s calculation in JPAKE.
  - A general purpose PQCOtherInfoGenerator has been added which
    supports all Kyber and NTRU.
  - An implementation of HPKE (RFC 9180 - Hybrid Public Key
    Encryption) has been added to the light-weight cryptography API.
  * Security Advisories:
  - The PQC implementations have now been subject to formal review for
    secret leakage and side channels, there were issues in BIKE, Falcon,
    Frodo, HQC which have now been fixed. Some weak positives also
    showed up in Rainbow, Picnic, SIKE, and GeMSS - for now this last
    set has been ignored as the algorithms will either be updated if
    they reappear in the Signature Round, or deleted, as is already the
    case for SIKE (it is now in the legacy package). Details on the
    group responsible for the testing can be found in the CONTRIBUTORS
    file.
  - For at least some ECIES variants (e.g. when using CBC) there is
    an issue with potential malleability of a nonce (implying silent
    malleability of the plaintext) that must be sent alongside the
    ciphertext but is outside the IES integrity check. For this reason
    the automatic generation of nonces with IED is now disabled and
    they have to be passed in using an IESParameterSpec. The current
    advice is to agree on a nonce between parties and then rely on the
    use of the ephemeral key component to allow the nonce (rather the
    so called nonce) usage to be extended.</changelog>
  <changelog author="pmonreal@suse.com" date="1687176000">- Update to version 1.74: [bsc#1212508, CVE-2023-33201]
  * Defects Fixed:
  - AsconEngine: Fixed a buffering bug when decrypting across
    multiple processBytes calls (ascon128a unaffected).
  - Context based sanity checking on PGP signatures has been added.
  - The ParallelHash clone constructor was not copying all fields.
  - The maximimum number of blocks for CTR/SIC modes was 1 block
    less than it should have been.
  * Additional Features and Functionality:
  - The PGP API now supports wildcard key IDs for public key
    based data encryption.
  - LMS now supports SHA256/192, SHAKE256/192, and SHAKE256/256
    (the additional SP 8000-208 parameter sets).
  - The PGP API now supports V5 and V6 AEAD encryption for
    encrypted data packets.
  - The PGP examples have been updated to reflect key size and algorithm
    changes that have occurred since they were first written (10+ years...).
  - (D)TLS: A new callback 'TlsPeer.notifyConnectionClosed' will be called
    when the connection is closed (including by failure).
  - BCJSSE: Improved logging of connection events and include unique IDs
    in connection-specific log messages.
  - BCJSSE: Server now logs the offered cipher suites when it fails to
    select one.
  - BCJSSE: Added support for SSLParameters namedGroups and
    signatureSchemes properties (can also be used via BCJSSE
    extension API in earlier Java versions).
  - DTLS: The initial handshake re-send time is now configurable by
    overriding 'TlsPeer.getHandshakeResendTimeMillis'.
  - DTLS: Added support for connection IDs per RFC 9146.
  - DTLS: Performance of DTLSVerifier has been improved so that it can
    reasonably be used for all incoming packets.
  - Initial support has been added for A Mechanism for Encoding
    Differences in Paired Certificates.
  - The PGP API now supports parsing, encoding, and fingerprinting
    of V6 EC/EdEC keys.
  - A thread safe verifier API has been added to the PGP API to support
    multi-threaded verification of certifications on keys and user IDs.
  - The number of keys/sub-keys in a PGPKeyRing can now be found by
    calling PGPKeyRing.size().
  - The PQC algorithms LMS/HSS, SPHINCS+, Dilithium, Falcon, and NTRU
    are now supported directly by the BC provider.
  * Notes:
  - The now defunct PQC SIKE algorithm has been removed, this has also
    meant the removal of its resource files so the provider is now quite
    a bit smaller.
  - As a precaution, HC128 now enforces a 128 bit IV, previous behaviour
    for shorter IVs can be supported where required by padding the IV to
    the 128 bits with zero.
  - PGP encrypted data generation now uses integrity protection by default.
    Previous behaviour for encrypted data can be supported where required
    by calling PGPDataEncryptorBuilder.setWithIntegrityPacket(false) when
    data encryption is set up.
  - There are now additional sanity checks in place to prevent accidental
    mis-use of PGPSignature objects. If this change causes any issues, you
    might want to check what your code is up to as there is probably a bug.
  * Security Advisories:
  - CVE-2023-33201: this release fixes an issue with the X509LDAPCertStoreSpi
    where a specially crafted certificate subject could be used to try and
    extract extra information out of an LDAP server with wild-card matthing
    enabled.
  * Rebase bouncycastle-javadoc.patch
  * Add bouncycastle-notests.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1697630400">- Update to version 1.76:
  * Defects Fixed:
  - Service allocation in the provider could fail due to the lack
    of a permission block. This has been fixed.
  - JceKeyFingerPrintCalculator has been generalised for different
    providers by using "SHA-256" for the algorithm string.
  - BCJSSE: Fixed a regression in 1.74 (NullPointerException) that
    prevents a BCJSSE server from negotiating TLSv1.1 or earlier.
  - DTLS: Fixed server support for client_certificate_type extension.
  - Cipher.unwrap() for HQC could fail due to a miscalculation of
    the length of the KEM packet. This has been fixed.
  - There was exposure to a Java 7 method in the Java 5 to Java 8
    BCTLS jar which could cause issues with some TLS 1.2 cipher
    suites running on older JVMs. This is now fixed.
  * Additional Features and Functionality:
  - BCJSSE: Following OpenJDK, finalizers have been removed from
    SSLSocket subclasses. Applications should close sockets and
    not rely on garbage collection.
  - BCJSSE: Added support for boolean system property
    "jdk.tls.client.useCompatibilityMode" (default "true").
  - DTLS: Added server support for session resumption.
  - JcaPKCS10CertificationRequest will now work with EC on the
    OpenJDK provider.
  - TimeStamp generation now supports the SHA3 algorithm set.
  - The SPHINCS+ simple parameters are now fully supported in the
    BCPQC provider.
  - Kyber, Classic McEliece, HQC, and Bike now supported by the
    CRMF/CMS/CMP APIs.
  - Builder classes have been add for PGP ASCII Armored streams
    allowing CRCs and versions to now be optional.
  - An UnknownPacket type has been added to the PGP APIs to allow
    for forwards compatibility with upcoming revisions to the standard.
  * Rebase patch bouncycastle-notests.patch
- Update to version 1.75:
  * Defects Fixed:
  - Several Java 8 method calls were accidentally introduced in
    the Java 5 to Java 8 build. The affected classes have been
    refactored to remove this.
  - (D)TLS: renegotiation after resumption now fixed to avoid
    breaking connection.
  * Notes:
  - The ASN.1 core package has had some dead and retired methods
    cleaned up and removed.</changelog>
  <changelog author="pmonreal@suse.com" date="1701691200">- Update to version 1.77:
  * Defects Fixed:
  - Using an unescaped '=' in an X.500 RDN would result in the
    RDN being truncated silently. The issue is now detected and
    an exception is thrown.
  - asn1.eac.CertificateBody was returning certificateEffectiveDate
    from getCertificateExpirationDate(). This has been fixed to
    return certificateExpirationDate.
  - DTLS: Fixed retransmission in response to re-receipt of an
    aggregated ChangeCipherSpec.
  - (D)TLS: Fixed compliance for supported_groups extension.
    Server will no longer negotiate an EC cipher suite using a
    default curve when the ClientHello includes the supported_groups
    extension but it contains no curves in common with the server.
    Similarly, a DH cipher suite will not be negotiated when the
    ClientHello includes supported_groups, containing at least one
    FFDHE group, but none in common with the server.
  - IllegalStateException was being thrown by Ed25519/Ed448 SignatureSpi.
  - TLS: class annotation issues that could occur between the BC
    provider and the TLS API for the GCMParameterSpec class when
    the jars were loaded on the boot class path have been addressed.
  - Attempt to create an ASN.1 OID from a zero length byte array
    is now caught at construction time.
  - Attempt to create an X.509 extension block which is empty will
    now be blocked cause an exception.
  - IES implementation will now accept a null ParameterSpec if no
    nonce is needed.
  - An internal method in Arrays was failing to construct its
    failure message correctly on an error.
  - HSSKeyPublicParameters.generateLMSContext() would fail for a
    unit depth key.
  * Additional Features and Functionality:
  - BCJSSE: Added org.bouncycastle.jsse.client.omitSigAlgsCertExtension
    and org.bouncycastle.jsse.server.omitSigAlgsCertExtension boolean
    system properties to control (for client and server resp.) whether
    the signature_algorithms_cert extension should be omitted if it
    would be identical to signature_algorithms. Defaults to true, the
    historical behaviour.
  - The low-level HPKE API now allows the sender to specify an
    ephemeral key pair.
  - Support has been added for the delta-certificate requests in line
    with the current Chameleon Cert draft from the IETF.
  - Some accommodation has been added for historical systems to
    accommodate variations in the SHA-1 digest OID for CMS SignedData.
  - TLS: the TLS API will now try "RSAwithDigestAndMFG1" as well as
    the newer RSAPSS algorithm names when used with the JCA.
  - TLS: RSA key exchange cipher suites are now disabled by default.
  - Support has been added for PKCS#10 requests to allow certificates
    using the altSignature/altPublicKey extensions.
  * Notes:
  - Kyber and Dilithium have been updated according to the latest
    draft of the standard. Dilithium-AES and Kyber-AES have now been
    removed. Kyber now produces 256 bit secrets for all parameter sets
    (in line with the draft standard).
  - NTRU has been updated to produce 256 bit secrets in line with Kyber.
  - SPHINCS+ can now be used to generate certificates in line with
    those used by (Open Quantum Safe) OQS.
  - Falcon object idenitifiers are now in line with OQS as well.
  - PQC CMS SignedData now defaults to SHA-256 for signed attributes
    rather than SHAKE-256. This is also a compatibility change, but may
    change further again as the IETF standard for CMS is updated.</changelog>
  <changelog author="pmonreal@suse.com" date="1714392000">- Update to version 1.78: [bsc#1223252, CVE-2024-30171]
  * Security Advisories.
  - CVE-2024-29857: Importing an EC certificate with specially crafted
    F2m parameters can cause high CPU usage during parameter evaluation.
  - CVE-2024-30171: Possible timing based leakage in RSA based handshakes
    due to exception processing eliminated.
  - CVE-2024-30172: Crafted signature and public key can be used to
    trigger an infinite loop in the Ed25519 verification code.
  - CVE-2024-301XX: When endpoint identification is enabled in the BCJSSE
    and an SSL socket is not created with an explicit hostname (as happens
    with HttpsURLConnection), hostname verification could be performed
    against a DNS-resolved IP address. This has been fixed.
  * Defects Fixed:
  - Issues with a dangling weak reference causing intermittent
    NullPointerExceptions in the OcspCache have been fixed.
  - Issues with non-constant time RSA operations in TLS handshakes.
  - Issue with Ed25519, Ed448 signature verification causing intermittent
    infinite loop have been fixed.
  - Issues with non-constant time ML-KEM implementation ("Kyber Slash").
  - Align ML-KEM input validation with FIPS 203 IPD requirements.
  - Make PEM parsing more forgiving of whitespace to align with RFC 7468.
  - Fix CCM length checks with large nonce sizes (n=12, n=13).
  - EAC: Fixed the CertificateBody ASN.1 type to support an optional
    Certification Authority Reference in a Certificate Request.
  - ASN.1: ObjectIdentifier (also Relative OID) parsing has been optimized
    and the contents octets for both types are now limited to 4096 bytes.
  - BCJSSE: Fixed a missing null check on the result of PrivateKey.getEncoded(),
    which could cause issues for HSM RSA keys.
  - BCJSSE: When endpoint identification is enabled and an SSL socket is not
    created with an explicit hostname (as happens with HttpsURLConnection),
    hostname verification could be performed against a DNS-resolved IP address.
  - The missing module import of java.logging to the provider module has been added.
  - GOST ASN.1 public key alg parameters are now compliant with RFC 9215.
  - An off-by-one error in the encoding for EccP256CurvePoint for ITS.
  - PEM Parser now enforces PEM headers to start at the beginning of the line
    to be meaningful.
  * Additional Features and Functionality.
  - An implementation of MLS (RFC 9420 - The Messaging Layer Security Protocol)
    has been added as a new module.
  - NTRU now supports NTRU-HPS4096-1229 and NTRU-HRSS-1373.
  - Improvements to PGP support, including Camellia key wrapping and Curve25519,
    Curve448 key types (including XDH with HKDF).
  - Added initial support for ML-KEM in TLS.
  - Added XWing hybrid KEM construction (X25519 + ML-KEM-768).
  - Introduced initial KEMSpi support (NTRU, SNTRU Prime) for JDK 21+.
  - Introduced initial composite signature support for X509 Certificates.
  - PKCS#12 now supports PKCS12-AES256-AES128, PKCS12-AES256-AES128-GCM,
    PKCS12-DEF-AES256-AES128, and PKCS12-DEF-AES256-AES128-GCM.
  - The default type for the KeyStore.getInstance("PKCS12", "BC") can now be set
    using the org.bouncycastle.pkcs12.default system/security property.
  - The PGP SExpParser will now handle Ed25519 and Ed448 keys.
  - Dilithium and Kyber key encoding updated to latest Draft RFCs
    (draft-ietf-lamps-dilithium-certificates and draft-ietf-lamps-kyber-certificates)
  - Support has been added for encryption key derivation using HKDF in CMS, see
    draft-housley-lamps-cms-cek-hkdf-sha256.
  - X500Name now recognises jurisdiction{C,ST,L} DNs.
  - CertPathValidationContext and CertificatePoliciesValidation now include
    implementations of Memoable.
  - The Composite post-quantum signatures implementation has been updated to the
    latest draft draft-ounsworth-pq-composite-sigs.
  * Full release notes: bouncycastle.org/releasenotes.html#r1rv78
  * Rebase bouncycastle-notests.patch</changelog>
  <changelog author="fstrba@suse.com" date="1714392001">- Update to version 1.78.1
  * Defects Fixed:
  - The new dependency of the the PGP API on the bcutil jar was
    missing from the module jar, the OSGi manifest, and the Maven
    POM. This has been fixed.
  - Missing exports and duplicate imports have been added/removed
    from the OSGi manifests.
  - The OSGi manifests now have the same bundle IDs as 1.77 and
    lock down dependencies to the equivalent variations
  - A check in the X.509 Extensions class preventing the parsing
    of empty extensions has been removed.</changelog>
</package>
<package pkgid="022af6e723dea1adc758454d0d9f2f6892602c0b7b725acaadbf4e6b8a80f574" name="bouncycastle-pg" arch="noarch">
  <version epoch="0" ver="1.78.1" rel="150200.3.29.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1570881600">- Update pom files with those from Maven repository.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573041600">- Fix arch dependent macros in noarch package [bsc#1109539]</changelog>
  <changelog author="fstrba@suse.com" date="1585137600">- Added patch:
  * bouncycastle-osgi.patch
    + Add OSGi manifests to the distributed jars so that they can
    be used from eclipse</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588161600">- Version update to 1.65
  * Defects Fixed:
  - DLExternal would encode using DER encoding for tagged SETs.
  - ChaCha20Poly1305 could fail for large (&gt;~2GB) files.
  - ChaCha20Poly1305 could fail for small updates when used via the provider.
  - Properties.getPropertyValue could ignore system property when other
    local overrides set.
  - The entropy gathering thread was not running in daemon mode, meaning there
    could be a delay in an application shutting down due to it.
  - A recent change in Java 11 could cause an exception with the BC Provider's
    implementation of PSS.
  - BCJSSE: TrustManager now tolerates having no trusted certificates.
  - BCJSSE: Choice of credentials and signing algorithm now respect the peer's
    signature_algorithms extension properly.
  - BCJSSE: KeyManager for KeyStoreBuilderParameters no longer leaks memory.
  * Additional Features and Functionality:
  - LMS and HSS (RFC 8554) support has been added to the low level library and
    the PQC provider.
  - SipHash128 support has been added to the low level library and the JCE provider.
  - BCJSSE: BC API now supports explicitly specifying the session to resume.
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: Added support for extended_master_secret system properties:
    jdk.tls.allowLegacyMasterSecret, jdk.tls.allowLegacyResumption,
    jdk.tls.useExtendedMasterSecret .
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: KeyManager and TrustManager now check algorithm constraints for
    keys and certificate chains.
  - BCJSSE: KeyManager selection of server credentials now prefers matching
    SNI hostname (if any).
  - BCJSSE: KeyManager may now fallback to imperfect credentials (expired,
    SNI mismatch).
  - BCJSSE: Client-side OCSP stapling support (beta version: via status_request
    extension only, provides jdk.tls.client.enableStatusRequestExtension, and
    requires CertPathBuilder support).
  - TLS: DSA in JcaTlsCrypto now falls back to stream signing to work around
    NoneWithDSA limitations in default provider.</changelog>
  <changelog author="pmonreal@suse.com" date="1595937600">- Version update to 1.66 [bsc#1186328, CVE-2020-15522]
  * Defects Fixed:
  - EdDSA verifiers now reset correctly after rejecting overly long signatures.
  - BCJSSE: SSLSession.getPeerCertificateChain could throw NullPointerException.
  - qTESLA-I verifier would reject some valid signatures.
  - qTESLA verifiers now reject overly long signatures.
  - PGP regression caused failure to preserve existing version header when
    headers were reset.
  - PKIXNameConstraintValidator had a bad cast preventing use of multiple
    OtherName constraints.
  - Serialisation of the non-CRT RSA Private Key could cause a NullPointerException.
  - An extra 4 bytes was included in the start of HSS public key encodings.
  - CMS with Ed448 using a direct signature was using id-shake256-len
    rather than id-shake256.
  - Use of GCMParameterSpec could cause an AccessControlException under
    some circumstances.
  - DTLS: Fixed high-latency HelloVerifyRequest handshakes.
  - An encoding bug for rightEncoded() in KMAC has been fixed.
  - For a few values the cSHAKE implementation would add unnecessary pad bytes
    where the N and S strings produced encoded data that was block aligned.
  - There were a few circumstances where Argon2BytesGenerator might hit an
    unexpected null. These have been removed.
  * Additional Features and Functionality
  - The qTESLA signature algorithm has been updated to v2.8 (20191108).
  - BCJSSE: Client-side OCSP stapling now supports status_request_v2 extension.
  - Support has been added for "ocsp.enable", "ocsp.responderURL" and
    PKIXRevocationChecker for users of Java 8 and later.
  - Support has been added for "org.bouncycastle.x509.enableCRLDP" to the PKIX validator.
  - BCJSSE: Now supports system property 'jsse.enableFFDHE'
  - BCJSSE: Now supports system properties 'jdk.tls.client.SignatureSchemes'
    and 'jdk.tls.server.SignatureSchemes'.
  - Multi-release support has been added for Java 11 XECKeys.
  - Multi-release support has been added for Java 15 EdECKeys.
  - The MiscPEMGenerator will now output general PrivateKeyInfo structures.
  - A new property "org.bouncycastle.pkcs8.v1_info_only" has been added to
    make the provider only produce version 1 PKCS8 PrivateKeyInfo structures.
  - The PKIX CertPathBuilder will now take the target certificate from the target
    constraints if a specific certificate is given to the selector.
  - BCJSSE: A range of ARIA and CAMELLIA cipher suites added to supported list.
  - BCJSSE: Now supports the PSS signature schemes from RFC 8446 (TLS 1.2 onwards).
  - Performance of the Base64 encoder has been improved.
  - The PGPPublicKey class will now include direct key signatures when checking
    for key expiry times.
  * NOTES:
  - The qTESLA update breaks compatibility with previous versions.
    Private keys now include a hash of the public key at the end,
    and signatures are no longer interoperable with previous versions.</changelog>
  <changelog author="pmonreal@suse.com" date="1608552000">- Version update to 1.67 [bsc#1180215, CVE-2020-28052]
  * CVE-2020-28052: OpenBSDBCrypt.checkPassword utility method
    compared incorrect data when checking the password
  * Defects Fixed:
  - BCJSSE: SunJSSE compatibility fix - override of getChannel()
    removed and 'urgent data' behaviour should now conform to
    what the SunJSSE expects
  - Nested BER data could sometimes cause issues in octet strings
  - Certificates/CRLs with short signatures could cause an exception
    in toString() in the BC X509 Certificate implmentation
  - In line with latest changes in the JVM, SignatureSpis which
    don't require parameters now return null on engineGetParameters()
  - The RSA KeyFactory now always preferentially produces RSAPrivateCrtKey
    where it can on requests for a KeySpec based on an RSAPrivateKey
  - CMSTypedStream$FullReaderStream now handles zero length reads correctly
  - Unecessary padding was added on KMAC when the key string was block aligned
  - Zero length data would cause an unexpected exception from RFC5649WrapEngine
  - OpenBSDBcrypt was failing to handle some valid prefixes
  * Additional Features and Functionality
  - Performance improvement of Argon2 and Noekeon
  - A setSessionKeyObfuscation() method has been added to
    PublicKeyKeyEncryptionMethodGenerator to allow turning off of session key
    obfuscation (default is on, method primarily to get around early version
    GPG issues with AES-128 keys)
  - Implemented 'safegcd' constant-time modular inversion (as well as a
    variable-time variant). It has replaced Fermat inversion in all our EC
    code, and BigInteger.modInverse in several other places, particularly
    signers. This improves side-channel protection, and also gives a
    significant performance boost
  - Performance of custom binary ECC curves and Edwards Curves has been improved
  - BCJSSE: New boolean system property 'org.bouncycastle.jsse.keyManager.checkEKU'
    allows to disable ExtendedKeyUsage restrictions when selecting credentials
    (although the peer may still complain)
  - Initial support has been added for "Composite Keys and Signatures For Use
    In Internet PKI" using the test OID. Please note there will be further
    refinements to this as the draft is standardised
  - The BC EdDSA signature API now supports keys implementing all methods on
    the EdECKey and XECKey interfaces directly
  - Work has begun on classes to support the ETSI TS 103 097, Intelligent
    Transport Systems (ITS) in the bcpkix package
  - Further optimization work has been done on GCM
  - A NewHope based processor, similar to the one for Key Agreement has been
    added for trying to "quantum hard" KEM algorithms
  - PGP clear signed signatures now support SHA-224
  - Treating absent vs NULL as equivalent can now be configured by a system
    property. By default this is not enabled
  - Mode name checks in Cipher strings should now make sure an improper mode
    name always results in a NoSuchAlgorithmException
  - In line with changes in OpenSSL, the OpenSSLPBKDF now uses UTF8 encoding</changelog>
  <changelog author="fstrba@suse.com" date="1610539200">- Version update to 1.68
  * Defects Fixed:
  - Some BigIntegers utility methods would fail for
    BigInteger.ZERO. This has been fixed.
  - PGPUtil.isKeyRing() was not detecting secret sub-keys in its
    input. This has been fixed.
  - The ASN.1 class, ArchiveTimeStamp was insisting on a value
    for the optional reducedHashTree field. This has been fixed.
  - BCJSSE: Lock against multiple writers - a possible
    synchronization issue has been removed.
  * Additional Features and Functionality
  - BCJSSE: Added support for system property
    com.sun.net.ssl.requireCloseNotify. Note that we are using a
    default value of 'true'.
  - BCJSSE: 'TLSv1.3' is now a supported protocol for both client
    and server. For this release it is only enabled by default for
    the 'TLSv1.3' SSLContext, but can be explicitly enabled using
    'setEnabledProtocols' on an SSLSocket or SSLEngine, or via
    SSLParameters.
  - BCJSSE: Session resumption is now also supported for servers
    in TLS 1.2 and earlier. For this release it is disabled by
    default, and can be enabled by setting the boolean system
    property org.bouncycastle.jsse.server.enableSessionResumption
    to 'true'.
  - The provider RSA-PSS signature names that follow the JCA
    naming convention.
  - FIPS mode for the BCJSSE now enforces namedCurves for any
    presented certificates.
  - PGPSignatureSubpacketGenerator now supports editing of a
    pre-existing sub-packet list.</changelog>
  <changelog author="pmonreal@suse.com" date="1621944000">- Add bouncycastle_getpoms.sh to get pom files from Maven repos</changelog>
  <changelog author="fstrba@suse.com" date="1627387200">- Directory core/docs does not exist</changelog>
  <changelog author="fstrba@suse.com" date="1647518400">- Add glassfish-activation-api dependency so that we can build with
  JDK that does not contain the JavaEE modules</changelog>
  <changelog author="fstrba@suse.com" date="1647604800">- Build with source/target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1648641600">- Build against the standalone JavaEE modules unconditionally</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1650628800">- Version update to 1.71
  * Defects Fixed
  - In line with GPG the PGP API now attempts to preserve
    comments containing non-ascii UTF8 characters.
  - An accidental partial dependency on Java 1.7 has been removed
    from the TLS API.
  - JcaPKIXIdentityBuilder would fail to process File objects
    correctly. This is now fixed.
  - Some byte[] parameters to the CMP API were not being
    defensively cloned to prevent accidental changes. Extra
    defensive cloning has been added.
  - CMS primitives would sometimes convert ASN.1 definite-length
    encodings into indefinite-length encodings. The primitives
    will now try and preserve the original encoding where possible.
  - CMSSignedData.getAttributeCertificates() now properly
    restricts the tag values checked to just 1 (the obsolete
    v1 tag) and 2 (for the more current v2 certificates).
  - BCJSSE now tries to validate a custom KeyManager selection
    in order to catch errors around a key manager ignoring
    key type early.
  - Compressed streams in PGP ending with zero length partial
    packets could cause failure on parsing the OpenPGP API.
    This has been fixed.
  - The fallback mode for JceAsymmetricKeyWrapper/Unwrapper
    would lose track of any algorithm parameters generated
    in the initial attempt. The algorithm parameters are now
    propagated.
  - An accidental regression introduced by a fix for another
    issue in PKIXCertPathReviewer around use of the
    AuthorityKeyIdentifier extension and it failing to match
    a certificate uniquely when the serial number field
    is missing has been fixed.
  - An error was found in the creation of TLS 1.3 Export Keying
    Material which could cause compatibility issues. This has
    been fixed.
  * Additional Features and Functionality
  - Support has been added for OpenPGP regular expression
    signature packets.
  - Support has been added for OpenPGP PolicyURI signature
    packets.
  - A utility method has been added to PGPSecretKeyRing to allow
    for inserting or replacing a PGPPublicKey.
  - The NIST PQC Finalist, Classic McEliece has been added to the
    low level API and the BCPQC provider.
  - The NIST PQC Alternate Candidate, SPHINCS+ has been added to
    the BCPQC provider.
  - The NIST PQC Alternate Candidate, FrodoKEM has been added to
    the low level API and the BCPQC provider.
  - The NIST PQC Finalist, SABER has been added to the low level
    API and the BCPQC provider.
  - KMAC128, KMAC256 has been added to the BC provider (empty
    customization string).
  - TupleHash128, TupleHash256 has been added to the BC provider
    (empty customization string).
  - ParallelHash128, ParallelHash256 has been added to the BC
    provider (empty customization string, block size 1024 bits).
  - Two new properties: "org.bouncycastle.rsa.max_size" (default
    15360) and "org.bouncycastle.ec.fp_max_size" (default 1042)
    have been added to cap the maximum size of RSA and EC keys.
  - RSA modulus are now checked to be provably composite using
    the enhanced MR probable prime test.
  - Imported EC Fp basis values are now validated against the MR
    prime number test before use. The certainty level of the
    prime test can be determined by
    "org.bouncycastle.ec.fp_certainty" (default 100).
  - The BC entropy thread now has a specific name:
    "BC-ENTROPY-GATHERER".
  - Utility methods have been added for joining/merging PGP
    public keys and signatures.
  - Blake3-256 has been added to the BC provider.
  - DTLS: optimisation to delayed handshake hash.
  - Further additions to the ETSI 102 941 support in the ETSI/ITS
    package: certification request, signed message generation and
    verification now supported.
  - CMSSignedDataGenerator now supports the direct generation of
    definite-length data.
  - The NetscapeCertType class now has a hasUsages() method on it
    for querying usage settings on its bit string.
  - Support for additional input has been added for deterministic
    (EC)DSA.
  - The OpenPGP API provides better support for subkey
    generation.
  - BCJSSE: Added boolean system properties
    "org.bouncycastle.jsse.client.dh.disableDefaultSuites" and
    "org.bouncycastle.jsse.server.dh.disableDefaultSuites".
    Default "false". Set to "true" to disable inclusion of DH
    cipher suites in the default cipher suites for client/server
    respectively.
  * Notes
  - The deprecated QTESLA implementation has been removed from
    the BCPQC provider.
  - The submission update to SPHINCS+ has been added. This
    changes the generation of signatures - particularly
    deterministic ones.
- Version update to 1.70
  * Defects Fixed
  - Blake 3 output limit is enforced.
  - The PKCS12 KeyStore was relying on default precedence for its
    key Cipher implementation so was sometimes failing if used
    from the keytool. The KeyStore class now makes sure it uses
    the correct Cipher implementation.
  - Fixed bzip2 compression for empty contents (GH #993).
  - ASN.1: More robust handling of high tag numbers and
    definite-length forms.
  - BCJSSE: Fix a concurrent modification issue in session
    contexts (GH#968).
  - BCJSSE: Don't log sensitive system property values (GH#976).
  - BCJSSE: Fixed a priority issue amongst imperfect-match
    credentials in KeyManager classes.
  - The IES AlgorithmParameters object has been re-written to
    properly support all the variations of IESParameterSpec.
  - getOutputSize() for ECIES has been corrected to avoid
    occassional underestimates.
  - The lack of close() in the ASN.1 Dump command line utility
    was triggering false positives in some code analysis tools. A
    close() call has been added.
  - PGPPublicKey.getBitStrength() now properly recognises EdDSA
    keys.
  * Additional Features and Functionality
  - Missing PGP CRC checksums can now be optionally ignored using
    setDetectMissingCRC() (default false) on ArmoredInputStream.
  - PGPSecretKey.copyWithNewPassword() now has a variant which
    uses USAGE_SHA1 for key protection if a PGPDigestCalculator
    is passed in.
  - PGP ASCII armored data now skips "\t", "\v", and "\f".
  - PKCS12 files with duplicate localKeyId attributes on
    certificates will now have the incorrect attributes filtered
    out, rather than the duplicate causing an exception.
  - PGPObjectFactory will now ignore packets representing
    unrecognised signature versions in the input stream.
  - The X.509 extension generator will now accumulate some
    duplicate X.509 extensions into a single extension where it
    is possible to do so.
  - Removed support for maxXofLen in Kangaroo digest.
  - Ignore marker packets in PGP Public and Secret key ring
    collection.
  - An implementation of LEA has been added to the low-level API.
  - Access, recovery, and direct use for PGP session keys has
    been added to the OpenPGP API for processing encrypted data.
  - A PGPCanonicalizedDataGenerator has been added which converts
    input into canonicalized literal data for text and UTF-8
    mode.
  - A getUserKeyingMaterial() method has been added to the
    KeyAgreeRecipientInformation class.
  - ASN.1: Tagged objects (and parsers) now support all tag
    classes. Special code for ApplicationSpecific has been
    deprecated and re-implemented in terms of TaggedObject.
  - ASN.1: Improved support for nested tagging.
  - ASN.1: Added support for GraphicString, ObjectDescriptor,
    RelativeOID.
  - ASN.1: Added support for constructed BitString encodings,
    including efficient parsing for large values.
  - TLS: Added support for external PSK handshakes.
  - TLS: Check policy restrictions on key size when determining
    cipher suite support.
  - A performance issue in KeccakDigest due to left over debug
    code has been identified and dealt with.
  - BKS key stores can now be used for collecting protected keys
    (note: any attempt to store such a store will cause an
    exception).
  - A method for recovering user keying material has been added
    to KeyAgreeRecipientInformation.
  - Support has been added to the CMS API for SHA-3 based
    PLAIN-ECDSA.
  - The low level BcDefaultDigestProvider now supports the SHAKE
    family of algorithms and the SM3 alogirthm.
  - PGPKeyRingGenerator now supports creation of key-rings with
    direct-key identified keys.
  - The PQC NIST candidate, signature algorithm SPHINCS+ has been
    added to the low-level API.
  - ArmoredInputStream now explicitly checks for a '\n' if in
    crLF mode.
  - Direct support for NotationDataOccurances, Exportable,
    Revocable, IntendedRecipientFingerPrints, and AEAD algorithm
    preferences has been added to PGPSignatureSubpacketVector.
  - Further support has been added for keys described using
    S-Expressions in GPG 2.2.X.
  - Support for OpenPGP Session Keys from the (draft) Stateless
    OpenPGP CLI has been added.
  - Additional checks have been added for PGP marker packets in
    the parsing of PGP objects.
  - A CMSSignedData.addDigestAlgorithm() has been added to allow
    for adding additional digest algorithm identifiers to CMS
    SignedData structures when required.
  - Support has been added to CMS for the LMS/HSS signature
    algorithm.
  - The system property
    "org.bouncycastle.jsse.client.assumeOriginalHostName"
    (default false) has been added for dealing with SNI problems
    related to the host name not being propagate by the JVM.
  - The JcePKCSPBEOutputEncryptorBuilder now supports SCRYPT with
    ciphers that do not have algorithm parameters (e.g. AESKWP).
  - Support is now added for certificates using ETSI TS 103 097,
    "Intelligent Transport Systems (ITS)" in the bcpkix package.
  * Notes.
  - While this release should maintain source code compatibility,
    developers making use of some parts of the ASN.1 library will
    find that some classes need recompiling. Apologies for the
    inconvenience.
- Version update to 1.69
  * Defects Fixed
  - Lightweight and JCA conversion of Ed25519 keys in the PGP API
    could drop the leading byte as it was zero. This has been
    fixed.
  - Marker packets appearing at the start of PGP public key rings
    could cause parsing failure. This has been fixed.
  - ESTService could fail for some valid Content-Type headers.
    This has been fixed.
  - Originator key algorithm parameters were being passed as NULL
    in key agreement recipients. The parameters now reflect the
    value of the parameters in the key's SubjectPublicKeyInfo.
  - ContentType on encapsulated data was not been passed through
    correctly for authenticated and enveloped data. This has been
    fixed.
  - NTRUEncryptionParameters and
    NTRUEncryptionKeyGenerationParameters were not correctly
    cloning the contained message digest. This has been fixed.
  - CertificateFactory.generateCertificates()/generateCRLs()
    would throw an exception if extra data was found at the end
    of a PEM file even if valid objects had been found. Extra
    data is now ignored providing at least one object found.
  - Internal class PKIXCRLUtil could throw a NullPointerException
    for CRLs with an absent nextUpdate field. This has been
    fixed.
  - PGP ArmoredInputStream now fails earlier on malformed
    headers.
  - The McElieceKobaraImaiCipher was randomly throwing "Bad
    Padding: invalid ciphertext" exception while decrypting due
    to leading zeroes been missed during processing of the cipher
    text. This has been fixed.
  - Ed25519 keys being passed in via OpenSSH key spec are now
    validated in the KeyFactory.
  - Blowfish keys are now range checked on cipher construction.
  - In some cases PGPSecretKeyRing was failing to search its
    extraPubKeys list when searching for public keys.
  - The BasicConstraintsValidation class in the BC cert path
    validation tools has improved conformance to RFC 5280.
  - AlgorithmIdentifiers involving message digests now attempt to
    follow the latest conventions for the parameters field
    (basically DER NULL appears less).
  - Fix various conversions and interoperability for XDH and
    EdDSA between BC and SunEC providers.
  - TLS: Prevent attempts to use KeyUpdate mechanism in versions
    before TLS 1.3.
  * Additional Features and Functionality
  - GCM-SIV has been added to the lightweight API and the
    provider.
  - Blake3 has been added to the lightweight API.
  - The OpenSSL PEMParser can now be extended to add specialised
    parsers.
  - Base32 encoding has now been added, the default alphabet is
    from RFC 4648.
  - The KangarooTwelve message digest has been added to the
    lightweight API.
  - An implementation of the two FPE algorithms, FF1 and FF3-1 in
    SP 800-38G has been added to the lightweight API and the JCE
    provider.
  - An implementation of ParallelHash has been added to the
    lightweight API.
  - An implementation of TupleHash has been added to the
    lightweight API.
  - RSA-PSS now supports the use of SHAKE128 and SHAKE256 as the
    mask generation function and digest.
  - ECDSA now supports the use of SHAKE128 and SHAKE256.
  - PGPPBEEncryptedData will now reset the stream if the initial
    checksum fails so another password can be tried.
  - Iterators on public and secret key ring collections in PGP
    now reflect the original order of the public/secret key rings
    they contain.
  - KeyAgreeRecipientInformation now has a getOriginator() method
    for retrieving the underlying orginator information.
  - PGPSignature now has a getDigestPrefix() method for people
    wanting exposure to the signature finger print details.
  - The old BKS-V1 format keystore is now disabled by default. If
    you need to use BKS-V1 for legacy reasons, it can be
    re-enabled by adding: org.bouncycastle.bks.enable_v1=true to
    the java.security file. We would be interested in hearing
    from anyone that needs to do this.
  - PLAIN-ECDSA now supports the SHA3 digests.
  - Some highlevel support for RFC 4998 ERS has been added for
    ArchiveTimeStamp and EvidenceRecord. The new classes are in
    the org.bouncycastle.tsp.ers package.
  - ECIES has now also support SHA256, SHA384, and SHA512.
  - digestAlgorithms filed in CMS SignedData now includes counter
    signature digest algorithms where possible.
  - A new property "org.bouncycastle.jsse.config" has been added
    which can be used to configure the BCJSSE provider when it is
    created using the no-args constructor.
  - In line with changes in OpenSSL 1.1.0,
    OpenSSLPBEParametersGenerator can now be configured with a
    digest.
  - PGPKeyRingGenerator now includes a method for adding a subkey
    with a primary key binding signature.
  - Support for ASN.1 PRIVATE tags has been added.
  - Performance enhancements to Nokeon, AES, GCM, and
    SICBlockCipher.
  - Support for ecoding/decoding McElieceCCA2 keys has been added
    to the PQC API
  - BCJSSE: Added support for jdk.tls.maxCertificateChainLength
    system property (default is 10).
  - BCJSSE: Added support for jdk.tls.maxHandshakeMessageSize
    system property (default is 32768).
  - BCJSSE: Added support for jdk.tls.client.enableCAExtension
    (default is 'false').
  - BCJSSE: Added support for jdk.tls.client.cipherSuites system
    property.
  - BCJSSE: Added support for jdk.tls.server.cipherSuites system
    property.
  - BCJSSE: Extended ALPN support via standard JSSE API to JDK 8
    versions after u251/u252.
  - BCJSSE: Key managers now support EC credentials for use with
    TLS 1.3 ECDSA signature schemes (including brainpool).
  - TLS: Add TLS 1.3 support for brainpool curves per RFC 8734.
  * Notes
  - There is a small API change in the PKIX package to the
    DigestAlgorithmIdentifierFinder interface as a find() method
    that takes an ASN1ObjectIdentifier has been added to it. For
    people wishing to extend their own implementations, see
    DefaultDigestAlgorithmIdentifierFinder for a sample
    implementation.
  - A version of the bcmail API supporting Jakarta Mail has now
    been added (see bcjmail jar).
  - Some work has been done on moving out code that does not need
    to be in the provider jar. This has reduced the size of the
    provider jar and should also make it easier for developers to
    patch the classes involved as they no longer need to be
    signed. bcpkix and bctls are both dependent on the new bcutil
    jar.
- Add build dependencies on
  mvn(jakarta.activation:jakarta.activation-api) and
  mvn(jakarta.mail:jakarta.mail-api)
- Remove unneeded script bouncycastle_getpoms.sh from sources</changelog>
  <changelog author="pmonreal@suse.com" date="1666180800">- Update to version 1.72:
  * Defects Fixed:
  - There were parameter errors in XMSS^MT OIDs for
    XMSSMT_SHA2_40/4_256 and XMSSMT_SHA2_60/3_256. These have
    been fixed.
  - There was an error in Merkle tree construction for the
    Evidence Records (ERS) implementation which could result in
    invalid roots been timestamped. ERS now produces an
    ArchiveTimeStamp for each data object/group with an associated
    reduced hash tree. The reduced hash tree is now calculated as
    a simple path to the root of the tree for each record.
  - OpenPGP will now ignore signatures marked as non-exportable
    on encoding.
  - A tagging calculation error in GCMSIV which could result in
    incorrect tags has been fixed.
  - Issues around Java 17 which could result in failing tests
    have been addressed.
  * Additional Features and Functionality:
  - BCJSSE: TLS 1.3 is now enabled by default where no explicit
    protocols are supplied (e.g. "TLS" or "Default" SSLContext
    algorithms, or SSLContext.getDefault() method).
  - BCJSSE: Rewrite SSLEngine implementation to improve compatibility
    with SunJSSE.
  - BCJSSE: Support export of keying material via extension API.
  - (D)TLS: Add support for 'tls-exporter' channel binding per RFC 9266.
  - (D)TLS (low-level API): By default, only (D)TLS 1.2 and TLS 1.3 are
    offered now. Earlier versions are still supported if explicitly
    enabled. Users may need to check they are offering suitable
    cipher suites for TLS 1.3.
  - (D)TLS (low-level API): Add support for raw public keys per RFC 7250.
  - CryptoServicesRegistrar now has a setServicesConstraints() method
    on it which can be used to selectively turn off algorithms.
  - The NIST PQC Alternate Candidate, Picnic, has been added to the low
    level API and the BCPQC provider.
  - SPHINCS+ has been upgraded to the latest submission, SPHINCS+ 3.1
    and support for Haraka has been added.
  - Evidence records now support timestamp renewal and hash renewal.
  - The SIKE Alternative Candidate NIST Post Quantum Algorithm has
    been added to the low-level PQC API.
  - The NTRU Round 3 Finalist Candidate NIST Post Quantum Algorithm
    has been added to the low-level API and the BCPQC provider.
  - The Falcon Finalist NIST Post Quantum Algorithm has been added to
    the low-level API and the BCPQC provider.
  - The CRYSTALS-Kyber Finalist NIST Post Quantum Algorithm has been
    added to the low-level API and the BCPQC provider.
  - Argon2 Support has been added to the OpenPGP API.
  - XDH IES has now been added to the BC provider.
  - The OpenPGP API now supports AEAD encryption and decryption.
  - The NTRU Prime Alternative Candidate NIST Post Quantum Algorithms
    have been added to the low-level API and the BCPQC provider.
  - The CRYSTALS-Dilithium Finalist NIST Post Quantum Algorithm has
    been added to the low-level API and the BCPQC provider.
  - The BIKE NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - The HQC NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - Grain128AEAD has been added to the lightweight API.
  - A fast version of CRC24 has been added for use with the PGP API.
  - Some additional methods and fields have been exposed in the
    PGPOnePassSignature class to (hopefully) make it easier to
    deal with nested signatures.
  - CMP support classes have been updated to reflect the latest
    editions to the the draft RFC "Lightweight Certificate Management
    Protocol (CMP) Profile".
  - Support has been added to the PKCS#12 implementation for the
    Oracle trusted certificate attribute.
  - Performance of our BZIP2 classes has been improved.
  * Notes:
  - Keep in mind the PQC algorithms are still under development and
    we are still at least a year and a half away from published standards.
    This means the algorithms may still change so by all means experiment,
    but do not use the PQC algoritms for anything long term.
  - The legacy "Rainbow" and "McEliece" implementations have been
    removed from the BCPQC provider. The underlying classes are
    still present if required. Other legacy algorithm implementations
    can be found under the org.bouncycastle.pqc.legacy package.
  * Security Notes:
  - The PQC SIKE algorithm is provided for research purposes only.
    It should now be regarded as broken. The SIKE implementation
    will be withdrawn in BC 1.73.
  * Rebase bouncycastle-javadoc.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1682424000">- Update to version 1.73: [jsc#PED-3756]
  * Defects Fixed:
  - BCJSSE: Instantiating a JSSE provider in some contexts could
    cause an AccessControl exception.
  - The EC key pair generator can generate out of range private
    keys when used with SM2. A specific SM2KeyPairGenerator has
    been added to the low-level API and is used by
    KeyPairGenerator.getInstance("SM2", "BC"). The SM2 signer has
    been updated to check for out of range keys as well..
  - The attached signature type byte was still present in Falcon
    signatures as well as the detached signature byte.
  - There was an off-by-one error in engineGetOutputSize() for ECIES.
  - The method for invoking read() internally in BCPGInputStream
    could result in inconsistent behaviour if the class was extended.
  - Fixed a rounding issue with FF1 Format Preserving Encryption
    algorithm for certain radices.
  - Fixed RFC3394WrapEngine handling of 64 bit keys.
  - Internal buffer for blake2sp was too small and could result in
    an ArrayIndexOutOfBoundsException.
  - JCA PSS Signatures using SHAKE128 and SHAKE256 now support
    encoding of algorithm parameters.
  - PKCS10CertificationRequest now checks for empty extension
    parameters.
  - Parsing errors in the processing of PGP Armored Data now throw
    an explicit exception ArmoredInputException.
  - PGP AEAD streams could occassionally be truncated.
  - The ESTService class now supports processing of chunked HTTP data.
  - A constructed ASN.1 OCTET STRING with a single member would
    sometimes be re-encoded as a definite-length OCTET STRING. The
    encoding has been adjusted to preserve the BER status of the object.
  - PKIXCertPathReviewer could fail if the trust anchor was also
    included in the certificate store being used for path analysis.
  - UTF-8 parsing of an array range ignored the provided length.
  - IPAddress has been written to provide stricter checking and
    avoid the use of Integer.parseInt().
  - A Java 7 class snuck into the Java 5 to Java 8 build.
  * Additional Features and Functionality:
  - The Rainbow NIST Post Quantum Round-3 Candidate has been added to
    the low-level API and the BCPQC provider (level 3 and level 5
    parameter sets only).
  - The GeMSS NIST Post Quantum Round-3 Candidate has been added to
    the low-level API.
  - The org.bouncycastle.rsa.max_mr_tests property check has been
    added to allow capping of MR tests done on RSA moduli.
  - Significant performance improvements in PQC algorithms,
    especially BIKE, CMCE, Frodo, HQC, Picnic.
  - EdDSA verification now conforms to the recommendations of Taming
    the many EdDSAs, in particular cofactored verification. As a side
    benefit, Pornin's basis reduction is now used for EdDSA
    verification, giving a significant performance boost.
  - Major performance improvements for Anomalous Binary (Koblitz) Curves.
  - The lightweight Cryptography finalists Ascon, ISAP, Elephant,
    PhotonBeetle, Sparkle, and Xoodyak have been added to the
    light-weight cryptography API.
  - BLAKE2bp and BLAKE2sp have been added to the light-weight
    cryptography API.
  - Support has been added for X.509, Section 9.8, hybrid certificates
    and CRLs using alternate public keys and alternate signatures.
  - The property "org.bouncycastle.emulate.oracle" has been added to
    signal the provider should return algorithm names on some algorithms
    in the same manner as the Oracle JCE provider.
  - An extra replaceSigners method has been added to CMSSignedData
    which allows for specifying the digest algorithm IDs to be used
    in the new CMSSignedData object.
  - Parsing and re-encoding of ASN.1 PEM data has been further
    optimized to prevent unecessary conversions between basic encoding,
    definite length, and DER.
  - Support has been added for KEM ciphers in CMS in accordance with
    draft-ietf-lamps-cms-kemri
  - Support has been added for certEncr in CRMF to allow issuing of
    certificates for KEM public keys.
  - Further speedups have been made to CRC24.
  - GCMParameterSpec constructor caching has been added to improve
    performance for JVMs that have the class available.
  - The PGPEncrytedDataGenerator now supports injecting the session
    key to be used for PGP PBE encrypted data.
  - The CRMF CertificateRequestMessageBuilder now supports optional
    attributes.
  - Improvements to the s calculation in JPAKE.
  - A general purpose PQCOtherInfoGenerator has been added which
    supports all Kyber and NTRU.
  - An implementation of HPKE (RFC 9180 - Hybrid Public Key
    Encryption) has been added to the light-weight cryptography API.
  * Security Advisories:
  - The PQC implementations have now been subject to formal review for
    secret leakage and side channels, there were issues in BIKE, Falcon,
    Frodo, HQC which have now been fixed. Some weak positives also
    showed up in Rainbow, Picnic, SIKE, and GeMSS - for now this last
    set has been ignored as the algorithms will either be updated if
    they reappear in the Signature Round, or deleted, as is already the
    case for SIKE (it is now in the legacy package). Details on the
    group responsible for the testing can be found in the CONTRIBUTORS
    file.
  - For at least some ECIES variants (e.g. when using CBC) there is
    an issue with potential malleability of a nonce (implying silent
    malleability of the plaintext) that must be sent alongside the
    ciphertext but is outside the IES integrity check. For this reason
    the automatic generation of nonces with IED is now disabled and
    they have to be passed in using an IESParameterSpec. The current
    advice is to agree on a nonce between parties and then rely on the
    use of the ephemeral key component to allow the nonce (rather the
    so called nonce) usage to be extended.</changelog>
  <changelog author="pmonreal@suse.com" date="1687176000">- Update to version 1.74: [bsc#1212508, CVE-2023-33201]
  * Defects Fixed:
  - AsconEngine: Fixed a buffering bug when decrypting across
    multiple processBytes calls (ascon128a unaffected).
  - Context based sanity checking on PGP signatures has been added.
  - The ParallelHash clone constructor was not copying all fields.
  - The maximimum number of blocks for CTR/SIC modes was 1 block
    less than it should have been.
  * Additional Features and Functionality:
  - The PGP API now supports wildcard key IDs for public key
    based data encryption.
  - LMS now supports SHA256/192, SHAKE256/192, and SHAKE256/256
    (the additional SP 8000-208 parameter sets).
  - The PGP API now supports V5 and V6 AEAD encryption for
    encrypted data packets.
  - The PGP examples have been updated to reflect key size and algorithm
    changes that have occurred since they were first written (10+ years...).
  - (D)TLS: A new callback 'TlsPeer.notifyConnectionClosed' will be called
    when the connection is closed (including by failure).
  - BCJSSE: Improved logging of connection events and include unique IDs
    in connection-specific log messages.
  - BCJSSE: Server now logs the offered cipher suites when it fails to
    select one.
  - BCJSSE: Added support for SSLParameters namedGroups and
    signatureSchemes properties (can also be used via BCJSSE
    extension API in earlier Java versions).
  - DTLS: The initial handshake re-send time is now configurable by
    overriding 'TlsPeer.getHandshakeResendTimeMillis'.
  - DTLS: Added support for connection IDs per RFC 9146.
  - DTLS: Performance of DTLSVerifier has been improved so that it can
    reasonably be used for all incoming packets.
  - Initial support has been added for A Mechanism for Encoding
    Differences in Paired Certificates.
  - The PGP API now supports parsing, encoding, and fingerprinting
    of V6 EC/EdEC keys.
  - A thread safe verifier API has been added to the PGP API to support
    multi-threaded verification of certifications on keys and user IDs.
  - The number of keys/sub-keys in a PGPKeyRing can now be found by
    calling PGPKeyRing.size().
  - The PQC algorithms LMS/HSS, SPHINCS+, Dilithium, Falcon, and NTRU
    are now supported directly by the BC provider.
  * Notes:
  - The now defunct PQC SIKE algorithm has been removed, this has also
    meant the removal of its resource files so the provider is now quite
    a bit smaller.
  - As a precaution, HC128 now enforces a 128 bit IV, previous behaviour
    for shorter IVs can be supported where required by padding the IV to
    the 128 bits with zero.
  - PGP encrypted data generation now uses integrity protection by default.
    Previous behaviour for encrypted data can be supported where required
    by calling PGPDataEncryptorBuilder.setWithIntegrityPacket(false) when
    data encryption is set up.
  - There are now additional sanity checks in place to prevent accidental
    mis-use of PGPSignature objects. If this change causes any issues, you
    might want to check what your code is up to as there is probably a bug.
  * Security Advisories:
  - CVE-2023-33201: this release fixes an issue with the X509LDAPCertStoreSpi
    where a specially crafted certificate subject could be used to try and
    extract extra information out of an LDAP server with wild-card matthing
    enabled.
  * Rebase bouncycastle-javadoc.patch
  * Add bouncycastle-notests.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1697630400">- Update to version 1.76:
  * Defects Fixed:
  - Service allocation in the provider could fail due to the lack
    of a permission block. This has been fixed.
  - JceKeyFingerPrintCalculator has been generalised for different
    providers by using "SHA-256" for the algorithm string.
  - BCJSSE: Fixed a regression in 1.74 (NullPointerException) that
    prevents a BCJSSE server from negotiating TLSv1.1 or earlier.
  - DTLS: Fixed server support for client_certificate_type extension.
  - Cipher.unwrap() for HQC could fail due to a miscalculation of
    the length of the KEM packet. This has been fixed.
  - There was exposure to a Java 7 method in the Java 5 to Java 8
    BCTLS jar which could cause issues with some TLS 1.2 cipher
    suites running on older JVMs. This is now fixed.
  * Additional Features and Functionality:
  - BCJSSE: Following OpenJDK, finalizers have been removed from
    SSLSocket subclasses. Applications should close sockets and
    not rely on garbage collection.
  - BCJSSE: Added support for boolean system property
    "jdk.tls.client.useCompatibilityMode" (default "true").
  - DTLS: Added server support for session resumption.
  - JcaPKCS10CertificationRequest will now work with EC on the
    OpenJDK provider.
  - TimeStamp generation now supports the SHA3 algorithm set.
  - The SPHINCS+ simple parameters are now fully supported in the
    BCPQC provider.
  - Kyber, Classic McEliece, HQC, and Bike now supported by the
    CRMF/CMS/CMP APIs.
  - Builder classes have been add for PGP ASCII Armored streams
    allowing CRCs and versions to now be optional.
  - An UnknownPacket type has been added to the PGP APIs to allow
    for forwards compatibility with upcoming revisions to the standard.
  * Rebase patch bouncycastle-notests.patch
- Update to version 1.75:
  * Defects Fixed:
  - Several Java 8 method calls were accidentally introduced in
    the Java 5 to Java 8 build. The affected classes have been
    refactored to remove this.
  - (D)TLS: renegotiation after resumption now fixed to avoid
    breaking connection.
  * Notes:
  - The ASN.1 core package has had some dead and retired methods
    cleaned up and removed.</changelog>
  <changelog author="pmonreal@suse.com" date="1701691200">- Update to version 1.77:
  * Defects Fixed:
  - Using an unescaped '=' in an X.500 RDN would result in the
    RDN being truncated silently. The issue is now detected and
    an exception is thrown.
  - asn1.eac.CertificateBody was returning certificateEffectiveDate
    from getCertificateExpirationDate(). This has been fixed to
    return certificateExpirationDate.
  - DTLS: Fixed retransmission in response to re-receipt of an
    aggregated ChangeCipherSpec.
  - (D)TLS: Fixed compliance for supported_groups extension.
    Server will no longer negotiate an EC cipher suite using a
    default curve when the ClientHello includes the supported_groups
    extension but it contains no curves in common with the server.
    Similarly, a DH cipher suite will not be negotiated when the
    ClientHello includes supported_groups, containing at least one
    FFDHE group, but none in common with the server.
  - IllegalStateException was being thrown by Ed25519/Ed448 SignatureSpi.
  - TLS: class annotation issues that could occur between the BC
    provider and the TLS API for the GCMParameterSpec class when
    the jars were loaded on the boot class path have been addressed.
  - Attempt to create an ASN.1 OID from a zero length byte array
    is now caught at construction time.
  - Attempt to create an X.509 extension block which is empty will
    now be blocked cause an exception.
  - IES implementation will now accept a null ParameterSpec if no
    nonce is needed.
  - An internal method in Arrays was failing to construct its
    failure message correctly on an error.
  - HSSKeyPublicParameters.generateLMSContext() would fail for a
    unit depth key.
  * Additional Features and Functionality:
  - BCJSSE: Added org.bouncycastle.jsse.client.omitSigAlgsCertExtension
    and org.bouncycastle.jsse.server.omitSigAlgsCertExtension boolean
    system properties to control (for client and server resp.) whether
    the signature_algorithms_cert extension should be omitted if it
    would be identical to signature_algorithms. Defaults to true, the
    historical behaviour.
  - The low-level HPKE API now allows the sender to specify an
    ephemeral key pair.
  - Support has been added for the delta-certificate requests in line
    with the current Chameleon Cert draft from the IETF.
  - Some accommodation has been added for historical systems to
    accommodate variations in the SHA-1 digest OID for CMS SignedData.
  - TLS: the TLS API will now try "RSAwithDigestAndMFG1" as well as
    the newer RSAPSS algorithm names when used with the JCA.
  - TLS: RSA key exchange cipher suites are now disabled by default.
  - Support has been added for PKCS#10 requests to allow certificates
    using the altSignature/altPublicKey extensions.
  * Notes:
  - Kyber and Dilithium have been updated according to the latest
    draft of the standard. Dilithium-AES and Kyber-AES have now been
    removed. Kyber now produces 256 bit secrets for all parameter sets
    (in line with the draft standard).
  - NTRU has been updated to produce 256 bit secrets in line with Kyber.
  - SPHINCS+ can now be used to generate certificates in line with
    those used by (Open Quantum Safe) OQS.
  - Falcon object idenitifiers are now in line with OQS as well.
  - PQC CMS SignedData now defaults to SHA-256 for signed attributes
    rather than SHAKE-256. This is also a compatibility change, but may
    change further again as the IETF standard for CMS is updated.</changelog>
  <changelog author="pmonreal@suse.com" date="1714392000">- Update to version 1.78: [bsc#1223252, CVE-2024-30171]
  * Security Advisories.
  - CVE-2024-29857: Importing an EC certificate with specially crafted
    F2m parameters can cause high CPU usage during parameter evaluation.
  - CVE-2024-30171: Possible timing based leakage in RSA based handshakes
    due to exception processing eliminated.
  - CVE-2024-30172: Crafted signature and public key can be used to
    trigger an infinite loop in the Ed25519 verification code.
  - CVE-2024-301XX: When endpoint identification is enabled in the BCJSSE
    and an SSL socket is not created with an explicit hostname (as happens
    with HttpsURLConnection), hostname verification could be performed
    against a DNS-resolved IP address. This has been fixed.
  * Defects Fixed:
  - Issues with a dangling weak reference causing intermittent
    NullPointerExceptions in the OcspCache have been fixed.
  - Issues with non-constant time RSA operations in TLS handshakes.
  - Issue with Ed25519, Ed448 signature verification causing intermittent
    infinite loop have been fixed.
  - Issues with non-constant time ML-KEM implementation ("Kyber Slash").
  - Align ML-KEM input validation with FIPS 203 IPD requirements.
  - Make PEM parsing more forgiving of whitespace to align with RFC 7468.
  - Fix CCM length checks with large nonce sizes (n=12, n=13).
  - EAC: Fixed the CertificateBody ASN.1 type to support an optional
    Certification Authority Reference in a Certificate Request.
  - ASN.1: ObjectIdentifier (also Relative OID) parsing has been optimized
    and the contents octets for both types are now limited to 4096 bytes.
  - BCJSSE: Fixed a missing null check on the result of PrivateKey.getEncoded(),
    which could cause issues for HSM RSA keys.
  - BCJSSE: When endpoint identification is enabled and an SSL socket is not
    created with an explicit hostname (as happens with HttpsURLConnection),
    hostname verification could be performed against a DNS-resolved IP address.
  - The missing module import of java.logging to the provider module has been added.
  - GOST ASN.1 public key alg parameters are now compliant with RFC 9215.
  - An off-by-one error in the encoding for EccP256CurvePoint for ITS.
  - PEM Parser now enforces PEM headers to start at the beginning of the line
    to be meaningful.
  * Additional Features and Functionality.
  - An implementation of MLS (RFC 9420 - The Messaging Layer Security Protocol)
    has been added as a new module.
  - NTRU now supports NTRU-HPS4096-1229 and NTRU-HRSS-1373.
  - Improvements to PGP support, including Camellia key wrapping and Curve25519,
    Curve448 key types (including XDH with HKDF).
  - Added initial support for ML-KEM in TLS.
  - Added XWing hybrid KEM construction (X25519 + ML-KEM-768).
  - Introduced initial KEMSpi support (NTRU, SNTRU Prime) for JDK 21+.
  - Introduced initial composite signature support for X509 Certificates.
  - PKCS#12 now supports PKCS12-AES256-AES128, PKCS12-AES256-AES128-GCM,
    PKCS12-DEF-AES256-AES128, and PKCS12-DEF-AES256-AES128-GCM.
  - The default type for the KeyStore.getInstance("PKCS12", "BC") can now be set
    using the org.bouncycastle.pkcs12.default system/security property.
  - The PGP SExpParser will now handle Ed25519 and Ed448 keys.
  - Dilithium and Kyber key encoding updated to latest Draft RFCs
    (draft-ietf-lamps-dilithium-certificates and draft-ietf-lamps-kyber-certificates)
  - Support has been added for encryption key derivation using HKDF in CMS, see
    draft-housley-lamps-cms-cek-hkdf-sha256.
  - X500Name now recognises jurisdiction{C,ST,L} DNs.
  - CertPathValidationContext and CertificatePoliciesValidation now include
    implementations of Memoable.
  - The Composite post-quantum signatures implementation has been updated to the
    latest draft draft-ounsworth-pq-composite-sigs.
  * Full release notes: bouncycastle.org/releasenotes.html#r1rv78
  * Rebase bouncycastle-notests.patch</changelog>
  <changelog author="fstrba@suse.com" date="1714392001">- Update to version 1.78.1
  * Defects Fixed:
  - The new dependency of the the PGP API on the bcutil jar was
    missing from the module jar, the OSGi manifest, and the Maven
    POM. This has been fixed.
  - Missing exports and duplicate imports have been added/removed
    from the OSGi manifests.
  - The OSGi manifests now have the same bundle IDs as 1.77 and
    lock down dependencies to the equivalent variations
  - A check in the X.509 Extensions class preventing the parsing
    of empty extensions has been removed.</changelog>
</package>
<package pkgid="5697e56ba427e320c8133d05c41027af5eda6c545fc88105774650e5772aef73" name="bouncycastle-pkix" arch="noarch">
  <version epoch="0" ver="1.78.1" rel="150200.3.29.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1570881600">- Update pom files with those from Maven repository.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573041600">- Fix arch dependent macros in noarch package [bsc#1109539]</changelog>
  <changelog author="fstrba@suse.com" date="1585137600">- Added patch:
  * bouncycastle-osgi.patch
    + Add OSGi manifests to the distributed jars so that they can
    be used from eclipse</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588161600">- Version update to 1.65
  * Defects Fixed:
  - DLExternal would encode using DER encoding for tagged SETs.
  - ChaCha20Poly1305 could fail for large (&gt;~2GB) files.
  - ChaCha20Poly1305 could fail for small updates when used via the provider.
  - Properties.getPropertyValue could ignore system property when other
    local overrides set.
  - The entropy gathering thread was not running in daemon mode, meaning there
    could be a delay in an application shutting down due to it.
  - A recent change in Java 11 could cause an exception with the BC Provider's
    implementation of PSS.
  - BCJSSE: TrustManager now tolerates having no trusted certificates.
  - BCJSSE: Choice of credentials and signing algorithm now respect the peer's
    signature_algorithms extension properly.
  - BCJSSE: KeyManager for KeyStoreBuilderParameters no longer leaks memory.
  * Additional Features and Functionality:
  - LMS and HSS (RFC 8554) support has been added to the low level library and
    the PQC provider.
  - SipHash128 support has been added to the low level library and the JCE provider.
  - BCJSSE: BC API now supports explicitly specifying the session to resume.
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: Added support for extended_master_secret system properties:
    jdk.tls.allowLegacyMasterSecret, jdk.tls.allowLegacyResumption,
    jdk.tls.useExtendedMasterSecret .
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: KeyManager and TrustManager now check algorithm constraints for
    keys and certificate chains.
  - BCJSSE: KeyManager selection of server credentials now prefers matching
    SNI hostname (if any).
  - BCJSSE: KeyManager may now fallback to imperfect credentials (expired,
    SNI mismatch).
  - BCJSSE: Client-side OCSP stapling support (beta version: via status_request
    extension only, provides jdk.tls.client.enableStatusRequestExtension, and
    requires CertPathBuilder support).
  - TLS: DSA in JcaTlsCrypto now falls back to stream signing to work around
    NoneWithDSA limitations in default provider.</changelog>
  <changelog author="pmonreal@suse.com" date="1595937600">- Version update to 1.66 [bsc#1186328, CVE-2020-15522]
  * Defects Fixed:
  - EdDSA verifiers now reset correctly after rejecting overly long signatures.
  - BCJSSE: SSLSession.getPeerCertificateChain could throw NullPointerException.
  - qTESLA-I verifier would reject some valid signatures.
  - qTESLA verifiers now reject overly long signatures.
  - PGP regression caused failure to preserve existing version header when
    headers were reset.
  - PKIXNameConstraintValidator had a bad cast preventing use of multiple
    OtherName constraints.
  - Serialisation of the non-CRT RSA Private Key could cause a NullPointerException.
  - An extra 4 bytes was included in the start of HSS public key encodings.
  - CMS with Ed448 using a direct signature was using id-shake256-len
    rather than id-shake256.
  - Use of GCMParameterSpec could cause an AccessControlException under
    some circumstances.
  - DTLS: Fixed high-latency HelloVerifyRequest handshakes.
  - An encoding bug for rightEncoded() in KMAC has been fixed.
  - For a few values the cSHAKE implementation would add unnecessary pad bytes
    where the N and S strings produced encoded data that was block aligned.
  - There were a few circumstances where Argon2BytesGenerator might hit an
    unexpected null. These have been removed.
  * Additional Features and Functionality
  - The qTESLA signature algorithm has been updated to v2.8 (20191108).
  - BCJSSE: Client-side OCSP stapling now supports status_request_v2 extension.
  - Support has been added for "ocsp.enable", "ocsp.responderURL" and
    PKIXRevocationChecker for users of Java 8 and later.
  - Support has been added for "org.bouncycastle.x509.enableCRLDP" to the PKIX validator.
  - BCJSSE: Now supports system property 'jsse.enableFFDHE'
  - BCJSSE: Now supports system properties 'jdk.tls.client.SignatureSchemes'
    and 'jdk.tls.server.SignatureSchemes'.
  - Multi-release support has been added for Java 11 XECKeys.
  - Multi-release support has been added for Java 15 EdECKeys.
  - The MiscPEMGenerator will now output general PrivateKeyInfo structures.
  - A new property "org.bouncycastle.pkcs8.v1_info_only" has been added to
    make the provider only produce version 1 PKCS8 PrivateKeyInfo structures.
  - The PKIX CertPathBuilder will now take the target certificate from the target
    constraints if a specific certificate is given to the selector.
  - BCJSSE: A range of ARIA and CAMELLIA cipher suites added to supported list.
  - BCJSSE: Now supports the PSS signature schemes from RFC 8446 (TLS 1.2 onwards).
  - Performance of the Base64 encoder has been improved.
  - The PGPPublicKey class will now include direct key signatures when checking
    for key expiry times.
  * NOTES:
  - The qTESLA update breaks compatibility with previous versions.
    Private keys now include a hash of the public key at the end,
    and signatures are no longer interoperable with previous versions.</changelog>
  <changelog author="pmonreal@suse.com" date="1608552000">- Version update to 1.67 [bsc#1180215, CVE-2020-28052]
  * CVE-2020-28052: OpenBSDBCrypt.checkPassword utility method
    compared incorrect data when checking the password
  * Defects Fixed:
  - BCJSSE: SunJSSE compatibility fix - override of getChannel()
    removed and 'urgent data' behaviour should now conform to
    what the SunJSSE expects
  - Nested BER data could sometimes cause issues in octet strings
  - Certificates/CRLs with short signatures could cause an exception
    in toString() in the BC X509 Certificate implmentation
  - In line with latest changes in the JVM, SignatureSpis which
    don't require parameters now return null on engineGetParameters()
  - The RSA KeyFactory now always preferentially produces RSAPrivateCrtKey
    where it can on requests for a KeySpec based on an RSAPrivateKey
  - CMSTypedStream$FullReaderStream now handles zero length reads correctly
  - Unecessary padding was added on KMAC when the key string was block aligned
  - Zero length data would cause an unexpected exception from RFC5649WrapEngine
  - OpenBSDBcrypt was failing to handle some valid prefixes
  * Additional Features and Functionality
  - Performance improvement of Argon2 and Noekeon
  - A setSessionKeyObfuscation() method has been added to
    PublicKeyKeyEncryptionMethodGenerator to allow turning off of session key
    obfuscation (default is on, method primarily to get around early version
    GPG issues with AES-128 keys)
  - Implemented 'safegcd' constant-time modular inversion (as well as a
    variable-time variant). It has replaced Fermat inversion in all our EC
    code, and BigInteger.modInverse in several other places, particularly
    signers. This improves side-channel protection, and also gives a
    significant performance boost
  - Performance of custom binary ECC curves and Edwards Curves has been improved
  - BCJSSE: New boolean system property 'org.bouncycastle.jsse.keyManager.checkEKU'
    allows to disable ExtendedKeyUsage restrictions when selecting credentials
    (although the peer may still complain)
  - Initial support has been added for "Composite Keys and Signatures For Use
    In Internet PKI" using the test OID. Please note there will be further
    refinements to this as the draft is standardised
  - The BC EdDSA signature API now supports keys implementing all methods on
    the EdECKey and XECKey interfaces directly
  - Work has begun on classes to support the ETSI TS 103 097, Intelligent
    Transport Systems (ITS) in the bcpkix package
  - Further optimization work has been done on GCM
  - A NewHope based processor, similar to the one for Key Agreement has been
    added for trying to "quantum hard" KEM algorithms
  - PGP clear signed signatures now support SHA-224
  - Treating absent vs NULL as equivalent can now be configured by a system
    property. By default this is not enabled
  - Mode name checks in Cipher strings should now make sure an improper mode
    name always results in a NoSuchAlgorithmException
  - In line with changes in OpenSSL, the OpenSSLPBKDF now uses UTF8 encoding</changelog>
  <changelog author="fstrba@suse.com" date="1610539200">- Version update to 1.68
  * Defects Fixed:
  - Some BigIntegers utility methods would fail for
    BigInteger.ZERO. This has been fixed.
  - PGPUtil.isKeyRing() was not detecting secret sub-keys in its
    input. This has been fixed.
  - The ASN.1 class, ArchiveTimeStamp was insisting on a value
    for the optional reducedHashTree field. This has been fixed.
  - BCJSSE: Lock against multiple writers - a possible
    synchronization issue has been removed.
  * Additional Features and Functionality
  - BCJSSE: Added support for system property
    com.sun.net.ssl.requireCloseNotify. Note that we are using a
    default value of 'true'.
  - BCJSSE: 'TLSv1.3' is now a supported protocol for both client
    and server. For this release it is only enabled by default for
    the 'TLSv1.3' SSLContext, but can be explicitly enabled using
    'setEnabledProtocols' on an SSLSocket or SSLEngine, or via
    SSLParameters.
  - BCJSSE: Session resumption is now also supported for servers
    in TLS 1.2 and earlier. For this release it is disabled by
    default, and can be enabled by setting the boolean system
    property org.bouncycastle.jsse.server.enableSessionResumption
    to 'true'.
  - The provider RSA-PSS signature names that follow the JCA
    naming convention.
  - FIPS mode for the BCJSSE now enforces namedCurves for any
    presented certificates.
  - PGPSignatureSubpacketGenerator now supports editing of a
    pre-existing sub-packet list.</changelog>
  <changelog author="pmonreal@suse.com" date="1621944000">- Add bouncycastle_getpoms.sh to get pom files from Maven repos</changelog>
  <changelog author="fstrba@suse.com" date="1627387200">- Directory core/docs does not exist</changelog>
  <changelog author="fstrba@suse.com" date="1647518400">- Add glassfish-activation-api dependency so that we can build with
  JDK that does not contain the JavaEE modules</changelog>
  <changelog author="fstrba@suse.com" date="1647604800">- Build with source/target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1648641600">- Build against the standalone JavaEE modules unconditionally</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1650628800">- Version update to 1.71
  * Defects Fixed
  - In line with GPG the PGP API now attempts to preserve
    comments containing non-ascii UTF8 characters.
  - An accidental partial dependency on Java 1.7 has been removed
    from the TLS API.
  - JcaPKIXIdentityBuilder would fail to process File objects
    correctly. This is now fixed.
  - Some byte[] parameters to the CMP API were not being
    defensively cloned to prevent accidental changes. Extra
    defensive cloning has been added.
  - CMS primitives would sometimes convert ASN.1 definite-length
    encodings into indefinite-length encodings. The primitives
    will now try and preserve the original encoding where possible.
  - CMSSignedData.getAttributeCertificates() now properly
    restricts the tag values checked to just 1 (the obsolete
    v1 tag) and 2 (for the more current v2 certificates).
  - BCJSSE now tries to validate a custom KeyManager selection
    in order to catch errors around a key manager ignoring
    key type early.
  - Compressed streams in PGP ending with zero length partial
    packets could cause failure on parsing the OpenPGP API.
    This has been fixed.
  - The fallback mode for JceAsymmetricKeyWrapper/Unwrapper
    would lose track of any algorithm parameters generated
    in the initial attempt. The algorithm parameters are now
    propagated.
  - An accidental regression introduced by a fix for another
    issue in PKIXCertPathReviewer around use of the
    AuthorityKeyIdentifier extension and it failing to match
    a certificate uniquely when the serial number field
    is missing has been fixed.
  - An error was found in the creation of TLS 1.3 Export Keying
    Material which could cause compatibility issues. This has
    been fixed.
  * Additional Features and Functionality
  - Support has been added for OpenPGP regular expression
    signature packets.
  - Support has been added for OpenPGP PolicyURI signature
    packets.
  - A utility method has been added to PGPSecretKeyRing to allow
    for inserting or replacing a PGPPublicKey.
  - The NIST PQC Finalist, Classic McEliece has been added to the
    low level API and the BCPQC provider.
  - The NIST PQC Alternate Candidate, SPHINCS+ has been added to
    the BCPQC provider.
  - The NIST PQC Alternate Candidate, FrodoKEM has been added to
    the low level API and the BCPQC provider.
  - The NIST PQC Finalist, SABER has been added to the low level
    API and the BCPQC provider.
  - KMAC128, KMAC256 has been added to the BC provider (empty
    customization string).
  - TupleHash128, TupleHash256 has been added to the BC provider
    (empty customization string).
  - ParallelHash128, ParallelHash256 has been added to the BC
    provider (empty customization string, block size 1024 bits).
  - Two new properties: "org.bouncycastle.rsa.max_size" (default
    15360) and "org.bouncycastle.ec.fp_max_size" (default 1042)
    have been added to cap the maximum size of RSA and EC keys.
  - RSA modulus are now checked to be provably composite using
    the enhanced MR probable prime test.
  - Imported EC Fp basis values are now validated against the MR
    prime number test before use. The certainty level of the
    prime test can be determined by
    "org.bouncycastle.ec.fp_certainty" (default 100).
  - The BC entropy thread now has a specific name:
    "BC-ENTROPY-GATHERER".
  - Utility methods have been added for joining/merging PGP
    public keys and signatures.
  - Blake3-256 has been added to the BC provider.
  - DTLS: optimisation to delayed handshake hash.
  - Further additions to the ETSI 102 941 support in the ETSI/ITS
    package: certification request, signed message generation and
    verification now supported.
  - CMSSignedDataGenerator now supports the direct generation of
    definite-length data.
  - The NetscapeCertType class now has a hasUsages() method on it
    for querying usage settings on its bit string.
  - Support for additional input has been added for deterministic
    (EC)DSA.
  - The OpenPGP API provides better support for subkey
    generation.
  - BCJSSE: Added boolean system properties
    "org.bouncycastle.jsse.client.dh.disableDefaultSuites" and
    "org.bouncycastle.jsse.server.dh.disableDefaultSuites".
    Default "false". Set to "true" to disable inclusion of DH
    cipher suites in the default cipher suites for client/server
    respectively.
  * Notes
  - The deprecated QTESLA implementation has been removed from
    the BCPQC provider.
  - The submission update to SPHINCS+ has been added. This
    changes the generation of signatures - particularly
    deterministic ones.
- Version update to 1.70
  * Defects Fixed
  - Blake 3 output limit is enforced.
  - The PKCS12 KeyStore was relying on default precedence for its
    key Cipher implementation so was sometimes failing if used
    from the keytool. The KeyStore class now makes sure it uses
    the correct Cipher implementation.
  - Fixed bzip2 compression for empty contents (GH #993).
  - ASN.1: More robust handling of high tag numbers and
    definite-length forms.
  - BCJSSE: Fix a concurrent modification issue in session
    contexts (GH#968).
  - BCJSSE: Don't log sensitive system property values (GH#976).
  - BCJSSE: Fixed a priority issue amongst imperfect-match
    credentials in KeyManager classes.
  - The IES AlgorithmParameters object has been re-written to
    properly support all the variations of IESParameterSpec.
  - getOutputSize() for ECIES has been corrected to avoid
    occassional underestimates.
  - The lack of close() in the ASN.1 Dump command line utility
    was triggering false positives in some code analysis tools. A
    close() call has been added.
  - PGPPublicKey.getBitStrength() now properly recognises EdDSA
    keys.
  * Additional Features and Functionality
  - Missing PGP CRC checksums can now be optionally ignored using
    setDetectMissingCRC() (default false) on ArmoredInputStream.
  - PGPSecretKey.copyWithNewPassword() now has a variant which
    uses USAGE_SHA1 for key protection if a PGPDigestCalculator
    is passed in.
  - PGP ASCII armored data now skips "\t", "\v", and "\f".
  - PKCS12 files with duplicate localKeyId attributes on
    certificates will now have the incorrect attributes filtered
    out, rather than the duplicate causing an exception.
  - PGPObjectFactory will now ignore packets representing
    unrecognised signature versions in the input stream.
  - The X.509 extension generator will now accumulate some
    duplicate X.509 extensions into a single extension where it
    is possible to do so.
  - Removed support for maxXofLen in Kangaroo digest.
  - Ignore marker packets in PGP Public and Secret key ring
    collection.
  - An implementation of LEA has been added to the low-level API.
  - Access, recovery, and direct use for PGP session keys has
    been added to the OpenPGP API for processing encrypted data.
  - A PGPCanonicalizedDataGenerator has been added which converts
    input into canonicalized literal data for text and UTF-8
    mode.
  - A getUserKeyingMaterial() method has been added to the
    KeyAgreeRecipientInformation class.
  - ASN.1: Tagged objects (and parsers) now support all tag
    classes. Special code for ApplicationSpecific has been
    deprecated and re-implemented in terms of TaggedObject.
  - ASN.1: Improved support for nested tagging.
  - ASN.1: Added support for GraphicString, ObjectDescriptor,
    RelativeOID.
  - ASN.1: Added support for constructed BitString encodings,
    including efficient parsing for large values.
  - TLS: Added support for external PSK handshakes.
  - TLS: Check policy restrictions on key size when determining
    cipher suite support.
  - A performance issue in KeccakDigest due to left over debug
    code has been identified and dealt with.
  - BKS key stores can now be used for collecting protected keys
    (note: any attempt to store such a store will cause an
    exception).
  - A method for recovering user keying material has been added
    to KeyAgreeRecipientInformation.
  - Support has been added to the CMS API for SHA-3 based
    PLAIN-ECDSA.
  - The low level BcDefaultDigestProvider now supports the SHAKE
    family of algorithms and the SM3 alogirthm.
  - PGPKeyRingGenerator now supports creation of key-rings with
    direct-key identified keys.
  - The PQC NIST candidate, signature algorithm SPHINCS+ has been
    added to the low-level API.
  - ArmoredInputStream now explicitly checks for a '\n' if in
    crLF mode.
  - Direct support for NotationDataOccurances, Exportable,
    Revocable, IntendedRecipientFingerPrints, and AEAD algorithm
    preferences has been added to PGPSignatureSubpacketVector.
  - Further support has been added for keys described using
    S-Expressions in GPG 2.2.X.
  - Support for OpenPGP Session Keys from the (draft) Stateless
    OpenPGP CLI has been added.
  - Additional checks have been added for PGP marker packets in
    the parsing of PGP objects.
  - A CMSSignedData.addDigestAlgorithm() has been added to allow
    for adding additional digest algorithm identifiers to CMS
    SignedData structures when required.
  - Support has been added to CMS for the LMS/HSS signature
    algorithm.
  - The system property
    "org.bouncycastle.jsse.client.assumeOriginalHostName"
    (default false) has been added for dealing with SNI problems
    related to the host name not being propagate by the JVM.
  - The JcePKCSPBEOutputEncryptorBuilder now supports SCRYPT with
    ciphers that do not have algorithm parameters (e.g. AESKWP).
  - Support is now added for certificates using ETSI TS 103 097,
    "Intelligent Transport Systems (ITS)" in the bcpkix package.
  * Notes.
  - While this release should maintain source code compatibility,
    developers making use of some parts of the ASN.1 library will
    find that some classes need recompiling. Apologies for the
    inconvenience.
- Version update to 1.69
  * Defects Fixed
  - Lightweight and JCA conversion of Ed25519 keys in the PGP API
    could drop the leading byte as it was zero. This has been
    fixed.
  - Marker packets appearing at the start of PGP public key rings
    could cause parsing failure. This has been fixed.
  - ESTService could fail for some valid Content-Type headers.
    This has been fixed.
  - Originator key algorithm parameters were being passed as NULL
    in key agreement recipients. The parameters now reflect the
    value of the parameters in the key's SubjectPublicKeyInfo.
  - ContentType on encapsulated data was not been passed through
    correctly for authenticated and enveloped data. This has been
    fixed.
  - NTRUEncryptionParameters and
    NTRUEncryptionKeyGenerationParameters were not correctly
    cloning the contained message digest. This has been fixed.
  - CertificateFactory.generateCertificates()/generateCRLs()
    would throw an exception if extra data was found at the end
    of a PEM file even if valid objects had been found. Extra
    data is now ignored providing at least one object found.
  - Internal class PKIXCRLUtil could throw a NullPointerException
    for CRLs with an absent nextUpdate field. This has been
    fixed.
  - PGP ArmoredInputStream now fails earlier on malformed
    headers.
  - The McElieceKobaraImaiCipher was randomly throwing "Bad
    Padding: invalid ciphertext" exception while decrypting due
    to leading zeroes been missed during processing of the cipher
    text. This has been fixed.
  - Ed25519 keys being passed in via OpenSSH key spec are now
    validated in the KeyFactory.
  - Blowfish keys are now range checked on cipher construction.
  - In some cases PGPSecretKeyRing was failing to search its
    extraPubKeys list when searching for public keys.
  - The BasicConstraintsValidation class in the BC cert path
    validation tools has improved conformance to RFC 5280.
  - AlgorithmIdentifiers involving message digests now attempt to
    follow the latest conventions for the parameters field
    (basically DER NULL appears less).
  - Fix various conversions and interoperability for XDH and
    EdDSA between BC and SunEC providers.
  - TLS: Prevent attempts to use KeyUpdate mechanism in versions
    before TLS 1.3.
  * Additional Features and Functionality
  - GCM-SIV has been added to the lightweight API and the
    provider.
  - Blake3 has been added to the lightweight API.
  - The OpenSSL PEMParser can now be extended to add specialised
    parsers.
  - Base32 encoding has now been added, the default alphabet is
    from RFC 4648.
  - The KangarooTwelve message digest has been added to the
    lightweight API.
  - An implementation of the two FPE algorithms, FF1 and FF3-1 in
    SP 800-38G has been added to the lightweight API and the JCE
    provider.
  - An implementation of ParallelHash has been added to the
    lightweight API.
  - An implementation of TupleHash has been added to the
    lightweight API.
  - RSA-PSS now supports the use of SHAKE128 and SHAKE256 as the
    mask generation function and digest.
  - ECDSA now supports the use of SHAKE128 and SHAKE256.
  - PGPPBEEncryptedData will now reset the stream if the initial
    checksum fails so another password can be tried.
  - Iterators on public and secret key ring collections in PGP
    now reflect the original order of the public/secret key rings
    they contain.
  - KeyAgreeRecipientInformation now has a getOriginator() method
    for retrieving the underlying orginator information.
  - PGPSignature now has a getDigestPrefix() method for people
    wanting exposure to the signature finger print details.
  - The old BKS-V1 format keystore is now disabled by default. If
    you need to use BKS-V1 for legacy reasons, it can be
    re-enabled by adding: org.bouncycastle.bks.enable_v1=true to
    the java.security file. We would be interested in hearing
    from anyone that needs to do this.
  - PLAIN-ECDSA now supports the SHA3 digests.
  - Some highlevel support for RFC 4998 ERS has been added for
    ArchiveTimeStamp and EvidenceRecord. The new classes are in
    the org.bouncycastle.tsp.ers package.
  - ECIES has now also support SHA256, SHA384, and SHA512.
  - digestAlgorithms filed in CMS SignedData now includes counter
    signature digest algorithms where possible.
  - A new property "org.bouncycastle.jsse.config" has been added
    which can be used to configure the BCJSSE provider when it is
    created using the no-args constructor.
  - In line with changes in OpenSSL 1.1.0,
    OpenSSLPBEParametersGenerator can now be configured with a
    digest.
  - PGPKeyRingGenerator now includes a method for adding a subkey
    with a primary key binding signature.
  - Support for ASN.1 PRIVATE tags has been added.
  - Performance enhancements to Nokeon, AES, GCM, and
    SICBlockCipher.
  - Support for ecoding/decoding McElieceCCA2 keys has been added
    to the PQC API
  - BCJSSE: Added support for jdk.tls.maxCertificateChainLength
    system property (default is 10).
  - BCJSSE: Added support for jdk.tls.maxHandshakeMessageSize
    system property (default is 32768).
  - BCJSSE: Added support for jdk.tls.client.enableCAExtension
    (default is 'false').
  - BCJSSE: Added support for jdk.tls.client.cipherSuites system
    property.
  - BCJSSE: Added support for jdk.tls.server.cipherSuites system
    property.
  - BCJSSE: Extended ALPN support via standard JSSE API to JDK 8
    versions after u251/u252.
  - BCJSSE: Key managers now support EC credentials for use with
    TLS 1.3 ECDSA signature schemes (including brainpool).
  - TLS: Add TLS 1.3 support for brainpool curves per RFC 8734.
  * Notes
  - There is a small API change in the PKIX package to the
    DigestAlgorithmIdentifierFinder interface as a find() method
    that takes an ASN1ObjectIdentifier has been added to it. For
    people wishing to extend their own implementations, see
    DefaultDigestAlgorithmIdentifierFinder for a sample
    implementation.
  - A version of the bcmail API supporting Jakarta Mail has now
    been added (see bcjmail jar).
  - Some work has been done on moving out code that does not need
    to be in the provider jar. This has reduced the size of the
    provider jar and should also make it easier for developers to
    patch the classes involved as they no longer need to be
    signed. bcpkix and bctls are both dependent on the new bcutil
    jar.
- Add build dependencies on
  mvn(jakarta.activation:jakarta.activation-api) and
  mvn(jakarta.mail:jakarta.mail-api)
- Remove unneeded script bouncycastle_getpoms.sh from sources</changelog>
  <changelog author="pmonreal@suse.com" date="1666180800">- Update to version 1.72:
  * Defects Fixed:
  - There were parameter errors in XMSS^MT OIDs for
    XMSSMT_SHA2_40/4_256 and XMSSMT_SHA2_60/3_256. These have
    been fixed.
  - There was an error in Merkle tree construction for the
    Evidence Records (ERS) implementation which could result in
    invalid roots been timestamped. ERS now produces an
    ArchiveTimeStamp for each data object/group with an associated
    reduced hash tree. The reduced hash tree is now calculated as
    a simple path to the root of the tree for each record.
  - OpenPGP will now ignore signatures marked as non-exportable
    on encoding.
  - A tagging calculation error in GCMSIV which could result in
    incorrect tags has been fixed.
  - Issues around Java 17 which could result in failing tests
    have been addressed.
  * Additional Features and Functionality:
  - BCJSSE: TLS 1.3 is now enabled by default where no explicit
    protocols are supplied (e.g. "TLS" or "Default" SSLContext
    algorithms, or SSLContext.getDefault() method).
  - BCJSSE: Rewrite SSLEngine implementation to improve compatibility
    with SunJSSE.
  - BCJSSE: Support export of keying material via extension API.
  - (D)TLS: Add support for 'tls-exporter' channel binding per RFC 9266.
  - (D)TLS (low-level API): By default, only (D)TLS 1.2 and TLS 1.3 are
    offered now. Earlier versions are still supported if explicitly
    enabled. Users may need to check they are offering suitable
    cipher suites for TLS 1.3.
  - (D)TLS (low-level API): Add support for raw public keys per RFC 7250.
  - CryptoServicesRegistrar now has a setServicesConstraints() method
    on it which can be used to selectively turn off algorithms.
  - The NIST PQC Alternate Candidate, Picnic, has been added to the low
    level API and the BCPQC provider.
  - SPHINCS+ has been upgraded to the latest submission, SPHINCS+ 3.1
    and support for Haraka has been added.
  - Evidence records now support timestamp renewal and hash renewal.
  - The SIKE Alternative Candidate NIST Post Quantum Algorithm has
    been added to the low-level PQC API.
  - The NTRU Round 3 Finalist Candidate NIST Post Quantum Algorithm
    has been added to the low-level API and the BCPQC provider.
  - The Falcon Finalist NIST Post Quantum Algorithm has been added to
    the low-level API and the BCPQC provider.
  - The CRYSTALS-Kyber Finalist NIST Post Quantum Algorithm has been
    added to the low-level API and the BCPQC provider.
  - Argon2 Support has been added to the OpenPGP API.
  - XDH IES has now been added to the BC provider.
  - The OpenPGP API now supports AEAD encryption and decryption.
  - The NTRU Prime Alternative Candidate NIST Post Quantum Algorithms
    have been added to the low-level API and the BCPQC provider.
  - The CRYSTALS-Dilithium Finalist NIST Post Quantum Algorithm has
    been added to the low-level API and the BCPQC provider.
  - The BIKE NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - The HQC NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - Grain128AEAD has been added to the lightweight API.
  - A fast version of CRC24 has been added for use with the PGP API.
  - Some additional methods and fields have been exposed in the
    PGPOnePassSignature class to (hopefully) make it easier to
    deal with nested signatures.
  - CMP support classes have been updated to reflect the latest
    editions to the the draft RFC "Lightweight Certificate Management
    Protocol (CMP) Profile".
  - Support has been added to the PKCS#12 implementation for the
    Oracle trusted certificate attribute.
  - Performance of our BZIP2 classes has been improved.
  * Notes:
  - Keep in mind the PQC algorithms are still under development and
    we are still at least a year and a half away from published standards.
    This means the algorithms may still change so by all means experiment,
    but do not use the PQC algoritms for anything long term.
  - The legacy "Rainbow" and "McEliece" implementations have been
    removed from the BCPQC provider. The underlying classes are
    still present if required. Other legacy algorithm implementations
    can be found under the org.bouncycastle.pqc.legacy package.
  * Security Notes:
  - The PQC SIKE algorithm is provided for research purposes only.
    It should now be regarded as broken. The SIKE implementation
    will be withdrawn in BC 1.73.
  * Rebase bouncycastle-javadoc.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1682424000">- Update to version 1.73: [jsc#PED-3756]
  * Defects Fixed:
  - BCJSSE: Instantiating a JSSE provider in some contexts could
    cause an AccessControl exception.
  - The EC key pair generator can generate out of range private
    keys when used with SM2. A specific SM2KeyPairGenerator has
    been added to the low-level API and is used by
    KeyPairGenerator.getInstance("SM2", "BC"). The SM2 signer has
    been updated to check for out of range keys as well..
  - The attached signature type byte was still present in Falcon
    signatures as well as the detached signature byte.
  - There was an off-by-one error in engineGetOutputSize() for ECIES.
  - The method for invoking read() internally in BCPGInputStream
    could result in inconsistent behaviour if the class was extended.
  - Fixed a rounding issue with FF1 Format Preserving Encryption
    algorithm for certain radices.
  - Fixed RFC3394WrapEngine handling of 64 bit keys.
  - Internal buffer for blake2sp was too small and could result in
    an ArrayIndexOutOfBoundsException.
  - JCA PSS Signatures using SHAKE128 and SHAKE256 now support
    encoding of algorithm parameters.
  - PKCS10CertificationRequest now checks for empty extension
    parameters.
  - Parsing errors in the processing of PGP Armored Data now throw
    an explicit exception ArmoredInputException.
  - PGP AEAD streams could occassionally be truncated.
  - The ESTService class now supports processing of chunked HTTP data.
  - A constructed ASN.1 OCTET STRING with a single member would
    sometimes be re-encoded as a definite-length OCTET STRING. The
    encoding has been adjusted to preserve the BER status of the object.
  - PKIXCertPathReviewer could fail if the trust anchor was also
    included in the certificate store being used for path analysis.
  - UTF-8 parsing of an array range ignored the provided length.
  - IPAddress has been written to provide stricter checking and
    avoid the use of Integer.parseInt().
  - A Java 7 class snuck into the Java 5 to Java 8 build.
  * Additional Features and Functionality:
  - The Rainbow NIST Post Quantum Round-3 Candidate has been added to
    the low-level API and the BCPQC provider (level 3 and level 5
    parameter sets only).
  - The GeMSS NIST Post Quantum Round-3 Candidate has been added to
    the low-level API.
  - The org.bouncycastle.rsa.max_mr_tests property check has been
    added to allow capping of MR tests done on RSA moduli.
  - Significant performance improvements in PQC algorithms,
    especially BIKE, CMCE, Frodo, HQC, Picnic.
  - EdDSA verification now conforms to the recommendations of Taming
    the many EdDSAs, in particular cofactored verification. As a side
    benefit, Pornin's basis reduction is now used for EdDSA
    verification, giving a significant performance boost.
  - Major performance improvements for Anomalous Binary (Koblitz) Curves.
  - The lightweight Cryptography finalists Ascon, ISAP, Elephant,
    PhotonBeetle, Sparkle, and Xoodyak have been added to the
    light-weight cryptography API.
  - BLAKE2bp and BLAKE2sp have been added to the light-weight
    cryptography API.
  - Support has been added for X.509, Section 9.8, hybrid certificates
    and CRLs using alternate public keys and alternate signatures.
  - The property "org.bouncycastle.emulate.oracle" has been added to
    signal the provider should return algorithm names on some algorithms
    in the same manner as the Oracle JCE provider.
  - An extra replaceSigners method has been added to CMSSignedData
    which allows for specifying the digest algorithm IDs to be used
    in the new CMSSignedData object.
  - Parsing and re-encoding of ASN.1 PEM data has been further
    optimized to prevent unecessary conversions between basic encoding,
    definite length, and DER.
  - Support has been added for KEM ciphers in CMS in accordance with
    draft-ietf-lamps-cms-kemri
  - Support has been added for certEncr in CRMF to allow issuing of
    certificates for KEM public keys.
  - Further speedups have been made to CRC24.
  - GCMParameterSpec constructor caching has been added to improve
    performance for JVMs that have the class available.
  - The PGPEncrytedDataGenerator now supports injecting the session
    key to be used for PGP PBE encrypted data.
  - The CRMF CertificateRequestMessageBuilder now supports optional
    attributes.
  - Improvements to the s calculation in JPAKE.
  - A general purpose PQCOtherInfoGenerator has been added which
    supports all Kyber and NTRU.
  - An implementation of HPKE (RFC 9180 - Hybrid Public Key
    Encryption) has been added to the light-weight cryptography API.
  * Security Advisories:
  - The PQC implementations have now been subject to formal review for
    secret leakage and side channels, there were issues in BIKE, Falcon,
    Frodo, HQC which have now been fixed. Some weak positives also
    showed up in Rainbow, Picnic, SIKE, and GeMSS - for now this last
    set has been ignored as the algorithms will either be updated if
    they reappear in the Signature Round, or deleted, as is already the
    case for SIKE (it is now in the legacy package). Details on the
    group responsible for the testing can be found in the CONTRIBUTORS
    file.
  - For at least some ECIES variants (e.g. when using CBC) there is
    an issue with potential malleability of a nonce (implying silent
    malleability of the plaintext) that must be sent alongside the
    ciphertext but is outside the IES integrity check. For this reason
    the automatic generation of nonces with IED is now disabled and
    they have to be passed in using an IESParameterSpec. The current
    advice is to agree on a nonce between parties and then rely on the
    use of the ephemeral key component to allow the nonce (rather the
    so called nonce) usage to be extended.</changelog>
  <changelog author="pmonreal@suse.com" date="1687176000">- Update to version 1.74: [bsc#1212508, CVE-2023-33201]
  * Defects Fixed:
  - AsconEngine: Fixed a buffering bug when decrypting across
    multiple processBytes calls (ascon128a unaffected).
  - Context based sanity checking on PGP signatures has been added.
  - The ParallelHash clone constructor was not copying all fields.
  - The maximimum number of blocks for CTR/SIC modes was 1 block
    less than it should have been.
  * Additional Features and Functionality:
  - The PGP API now supports wildcard key IDs for public key
    based data encryption.
  - LMS now supports SHA256/192, SHAKE256/192, and SHAKE256/256
    (the additional SP 8000-208 parameter sets).
  - The PGP API now supports V5 and V6 AEAD encryption for
    encrypted data packets.
  - The PGP examples have been updated to reflect key size and algorithm
    changes that have occurred since they were first written (10+ years...).
  - (D)TLS: A new callback 'TlsPeer.notifyConnectionClosed' will be called
    when the connection is closed (including by failure).
  - BCJSSE: Improved logging of connection events and include unique IDs
    in connection-specific log messages.
  - BCJSSE: Server now logs the offered cipher suites when it fails to
    select one.
  - BCJSSE: Added support for SSLParameters namedGroups and
    signatureSchemes properties (can also be used via BCJSSE
    extension API in earlier Java versions).
  - DTLS: The initial handshake re-send time is now configurable by
    overriding 'TlsPeer.getHandshakeResendTimeMillis'.
  - DTLS: Added support for connection IDs per RFC 9146.
  - DTLS: Performance of DTLSVerifier has been improved so that it can
    reasonably be used for all incoming packets.
  - Initial support has been added for A Mechanism for Encoding
    Differences in Paired Certificates.
  - The PGP API now supports parsing, encoding, and fingerprinting
    of V6 EC/EdEC keys.
  - A thread safe verifier API has been added to the PGP API to support
    multi-threaded verification of certifications on keys and user IDs.
  - The number of keys/sub-keys in a PGPKeyRing can now be found by
    calling PGPKeyRing.size().
  - The PQC algorithms LMS/HSS, SPHINCS+, Dilithium, Falcon, and NTRU
    are now supported directly by the BC provider.
  * Notes:
  - The now defunct PQC SIKE algorithm has been removed, this has also
    meant the removal of its resource files so the provider is now quite
    a bit smaller.
  - As a precaution, HC128 now enforces a 128 bit IV, previous behaviour
    for shorter IVs can be supported where required by padding the IV to
    the 128 bits with zero.
  - PGP encrypted data generation now uses integrity protection by default.
    Previous behaviour for encrypted data can be supported where required
    by calling PGPDataEncryptorBuilder.setWithIntegrityPacket(false) when
    data encryption is set up.
  - There are now additional sanity checks in place to prevent accidental
    mis-use of PGPSignature objects. If this change causes any issues, you
    might want to check what your code is up to as there is probably a bug.
  * Security Advisories:
  - CVE-2023-33201: this release fixes an issue with the X509LDAPCertStoreSpi
    where a specially crafted certificate subject could be used to try and
    extract extra information out of an LDAP server with wild-card matthing
    enabled.
  * Rebase bouncycastle-javadoc.patch
  * Add bouncycastle-notests.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1697630400">- Update to version 1.76:
  * Defects Fixed:
  - Service allocation in the provider could fail due to the lack
    of a permission block. This has been fixed.
  - JceKeyFingerPrintCalculator has been generalised for different
    providers by using "SHA-256" for the algorithm string.
  - BCJSSE: Fixed a regression in 1.74 (NullPointerException) that
    prevents a BCJSSE server from negotiating TLSv1.1 or earlier.
  - DTLS: Fixed server support for client_certificate_type extension.
  - Cipher.unwrap() for HQC could fail due to a miscalculation of
    the length of the KEM packet. This has been fixed.
  - There was exposure to a Java 7 method in the Java 5 to Java 8
    BCTLS jar which could cause issues with some TLS 1.2 cipher
    suites running on older JVMs. This is now fixed.
  * Additional Features and Functionality:
  - BCJSSE: Following OpenJDK, finalizers have been removed from
    SSLSocket subclasses. Applications should close sockets and
    not rely on garbage collection.
  - BCJSSE: Added support for boolean system property
    "jdk.tls.client.useCompatibilityMode" (default "true").
  - DTLS: Added server support for session resumption.
  - JcaPKCS10CertificationRequest will now work with EC on the
    OpenJDK provider.
  - TimeStamp generation now supports the SHA3 algorithm set.
  - The SPHINCS+ simple parameters are now fully supported in the
    BCPQC provider.
  - Kyber, Classic McEliece, HQC, and Bike now supported by the
    CRMF/CMS/CMP APIs.
  - Builder classes have been add for PGP ASCII Armored streams
    allowing CRCs and versions to now be optional.
  - An UnknownPacket type has been added to the PGP APIs to allow
    for forwards compatibility with upcoming revisions to the standard.
  * Rebase patch bouncycastle-notests.patch
- Update to version 1.75:
  * Defects Fixed:
  - Several Java 8 method calls were accidentally introduced in
    the Java 5 to Java 8 build. The affected classes have been
    refactored to remove this.
  - (D)TLS: renegotiation after resumption now fixed to avoid
    breaking connection.
  * Notes:
  - The ASN.1 core package has had some dead and retired methods
    cleaned up and removed.</changelog>
  <changelog author="pmonreal@suse.com" date="1701691200">- Update to version 1.77:
  * Defects Fixed:
  - Using an unescaped '=' in an X.500 RDN would result in the
    RDN being truncated silently. The issue is now detected and
    an exception is thrown.
  - asn1.eac.CertificateBody was returning certificateEffectiveDate
    from getCertificateExpirationDate(). This has been fixed to
    return certificateExpirationDate.
  - DTLS: Fixed retransmission in response to re-receipt of an
    aggregated ChangeCipherSpec.
  - (D)TLS: Fixed compliance for supported_groups extension.
    Server will no longer negotiate an EC cipher suite using a
    default curve when the ClientHello includes the supported_groups
    extension but it contains no curves in common with the server.
    Similarly, a DH cipher suite will not be negotiated when the
    ClientHello includes supported_groups, containing at least one
    FFDHE group, but none in common with the server.
  - IllegalStateException was being thrown by Ed25519/Ed448 SignatureSpi.
  - TLS: class annotation issues that could occur between the BC
    provider and the TLS API for the GCMParameterSpec class when
    the jars were loaded on the boot class path have been addressed.
  - Attempt to create an ASN.1 OID from a zero length byte array
    is now caught at construction time.
  - Attempt to create an X.509 extension block which is empty will
    now be blocked cause an exception.
  - IES implementation will now accept a null ParameterSpec if no
    nonce is needed.
  - An internal method in Arrays was failing to construct its
    failure message correctly on an error.
  - HSSKeyPublicParameters.generateLMSContext() would fail for a
    unit depth key.
  * Additional Features and Functionality:
  - BCJSSE: Added org.bouncycastle.jsse.client.omitSigAlgsCertExtension
    and org.bouncycastle.jsse.server.omitSigAlgsCertExtension boolean
    system properties to control (for client and server resp.) whether
    the signature_algorithms_cert extension should be omitted if it
    would be identical to signature_algorithms. Defaults to true, the
    historical behaviour.
  - The low-level HPKE API now allows the sender to specify an
    ephemeral key pair.
  - Support has been added for the delta-certificate requests in line
    with the current Chameleon Cert draft from the IETF.
  - Some accommodation has been added for historical systems to
    accommodate variations in the SHA-1 digest OID for CMS SignedData.
  - TLS: the TLS API will now try "RSAwithDigestAndMFG1" as well as
    the newer RSAPSS algorithm names when used with the JCA.
  - TLS: RSA key exchange cipher suites are now disabled by default.
  - Support has been added for PKCS#10 requests to allow certificates
    using the altSignature/altPublicKey extensions.
  * Notes:
  - Kyber and Dilithium have been updated according to the latest
    draft of the standard. Dilithium-AES and Kyber-AES have now been
    removed. Kyber now produces 256 bit secrets for all parameter sets
    (in line with the draft standard).
  - NTRU has been updated to produce 256 bit secrets in line with Kyber.
  - SPHINCS+ can now be used to generate certificates in line with
    those used by (Open Quantum Safe) OQS.
  - Falcon object idenitifiers are now in line with OQS as well.
  - PQC CMS SignedData now defaults to SHA-256 for signed attributes
    rather than SHAKE-256. This is also a compatibility change, but may
    change further again as the IETF standard for CMS is updated.</changelog>
  <changelog author="pmonreal@suse.com" date="1714392000">- Update to version 1.78: [bsc#1223252, CVE-2024-30171]
  * Security Advisories.
  - CVE-2024-29857: Importing an EC certificate with specially crafted
    F2m parameters can cause high CPU usage during parameter evaluation.
  - CVE-2024-30171: Possible timing based leakage in RSA based handshakes
    due to exception processing eliminated.
  - CVE-2024-30172: Crafted signature and public key can be used to
    trigger an infinite loop in the Ed25519 verification code.
  - CVE-2024-301XX: When endpoint identification is enabled in the BCJSSE
    and an SSL socket is not created with an explicit hostname (as happens
    with HttpsURLConnection), hostname verification could be performed
    against a DNS-resolved IP address. This has been fixed.
  * Defects Fixed:
  - Issues with a dangling weak reference causing intermittent
    NullPointerExceptions in the OcspCache have been fixed.
  - Issues with non-constant time RSA operations in TLS handshakes.
  - Issue with Ed25519, Ed448 signature verification causing intermittent
    infinite loop have been fixed.
  - Issues with non-constant time ML-KEM implementation ("Kyber Slash").
  - Align ML-KEM input validation with FIPS 203 IPD requirements.
  - Make PEM parsing more forgiving of whitespace to align with RFC 7468.
  - Fix CCM length checks with large nonce sizes (n=12, n=13).
  - EAC: Fixed the CertificateBody ASN.1 type to support an optional
    Certification Authority Reference in a Certificate Request.
  - ASN.1: ObjectIdentifier (also Relative OID) parsing has been optimized
    and the contents octets for both types are now limited to 4096 bytes.
  - BCJSSE: Fixed a missing null check on the result of PrivateKey.getEncoded(),
    which could cause issues for HSM RSA keys.
  - BCJSSE: When endpoint identification is enabled and an SSL socket is not
    created with an explicit hostname (as happens with HttpsURLConnection),
    hostname verification could be performed against a DNS-resolved IP address.
  - The missing module import of java.logging to the provider module has been added.
  - GOST ASN.1 public key alg parameters are now compliant with RFC 9215.
  - An off-by-one error in the encoding for EccP256CurvePoint for ITS.
  - PEM Parser now enforces PEM headers to start at the beginning of the line
    to be meaningful.
  * Additional Features and Functionality.
  - An implementation of MLS (RFC 9420 - The Messaging Layer Security Protocol)
    has been added as a new module.
  - NTRU now supports NTRU-HPS4096-1229 and NTRU-HRSS-1373.
  - Improvements to PGP support, including Camellia key wrapping and Curve25519,
    Curve448 key types (including XDH with HKDF).
  - Added initial support for ML-KEM in TLS.
  - Added XWing hybrid KEM construction (X25519 + ML-KEM-768).
  - Introduced initial KEMSpi support (NTRU, SNTRU Prime) for JDK 21+.
  - Introduced initial composite signature support for X509 Certificates.
  - PKCS#12 now supports PKCS12-AES256-AES128, PKCS12-AES256-AES128-GCM,
    PKCS12-DEF-AES256-AES128, and PKCS12-DEF-AES256-AES128-GCM.
  - The default type for the KeyStore.getInstance("PKCS12", "BC") can now be set
    using the org.bouncycastle.pkcs12.default system/security property.
  - The PGP SExpParser will now handle Ed25519 and Ed448 keys.
  - Dilithium and Kyber key encoding updated to latest Draft RFCs
    (draft-ietf-lamps-dilithium-certificates and draft-ietf-lamps-kyber-certificates)
  - Support has been added for encryption key derivation using HKDF in CMS, see
    draft-housley-lamps-cms-cek-hkdf-sha256.
  - X500Name now recognises jurisdiction{C,ST,L} DNs.
  - CertPathValidationContext and CertificatePoliciesValidation now include
    implementations of Memoable.
  - The Composite post-quantum signatures implementation has been updated to the
    latest draft draft-ounsworth-pq-composite-sigs.
  * Full release notes: bouncycastle.org/releasenotes.html#r1rv78
  * Rebase bouncycastle-notests.patch</changelog>
  <changelog author="fstrba@suse.com" date="1714392001">- Update to version 1.78.1
  * Defects Fixed:
  - The new dependency of the the PGP API on the bcutil jar was
    missing from the module jar, the OSGi manifest, and the Maven
    POM. This has been fixed.
  - Missing exports and duplicate imports have been added/removed
    from the OSGi manifests.
  - The OSGi manifests now have the same bundle IDs as 1.77 and
    lock down dependencies to the equivalent variations
  - A check in the X.509 Extensions class preventing the parsing
    of empty extensions has been removed.</changelog>
</package>
<package pkgid="64e34b14cc01f32e4edd4198ccd5dafcc40ff61f622523a2ac85005ae95b85d2" name="bouncycastle-tls" arch="noarch">
  <version epoch="0" ver="1.78.1" rel="150200.3.29.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1570881600">- Update pom files with those from Maven repository.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573041600">- Fix arch dependent macros in noarch package [bsc#1109539]</changelog>
  <changelog author="fstrba@suse.com" date="1585137600">- Added patch:
  * bouncycastle-osgi.patch
    + Add OSGi manifests to the distributed jars so that they can
    be used from eclipse</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588161600">- Version update to 1.65
  * Defects Fixed:
  - DLExternal would encode using DER encoding for tagged SETs.
  - ChaCha20Poly1305 could fail for large (&gt;~2GB) files.
  - ChaCha20Poly1305 could fail for small updates when used via the provider.
  - Properties.getPropertyValue could ignore system property when other
    local overrides set.
  - The entropy gathering thread was not running in daemon mode, meaning there
    could be a delay in an application shutting down due to it.
  - A recent change in Java 11 could cause an exception with the BC Provider's
    implementation of PSS.
  - BCJSSE: TrustManager now tolerates having no trusted certificates.
  - BCJSSE: Choice of credentials and signing algorithm now respect the peer's
    signature_algorithms extension properly.
  - BCJSSE: KeyManager for KeyStoreBuilderParameters no longer leaks memory.
  * Additional Features and Functionality:
  - LMS and HSS (RFC 8554) support has been added to the low level library and
    the PQC provider.
  - SipHash128 support has been added to the low level library and the JCE provider.
  - BCJSSE: BC API now supports explicitly specifying the session to resume.
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: Added support for extended_master_secret system properties:
    jdk.tls.allowLegacyMasterSecret, jdk.tls.allowLegacyResumption,
    jdk.tls.useExtendedMasterSecret .
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: KeyManager and TrustManager now check algorithm constraints for
    keys and certificate chains.
  - BCJSSE: KeyManager selection of server credentials now prefers matching
    SNI hostname (if any).
  - BCJSSE: KeyManager may now fallback to imperfect credentials (expired,
    SNI mismatch).
  - BCJSSE: Client-side OCSP stapling support (beta version: via status_request
    extension only, provides jdk.tls.client.enableStatusRequestExtension, and
    requires CertPathBuilder support).
  - TLS: DSA in JcaTlsCrypto now falls back to stream signing to work around
    NoneWithDSA limitations in default provider.</changelog>
  <changelog author="pmonreal@suse.com" date="1595937600">- Version update to 1.66 [bsc#1186328, CVE-2020-15522]
  * Defects Fixed:
  - EdDSA verifiers now reset correctly after rejecting overly long signatures.
  - BCJSSE: SSLSession.getPeerCertificateChain could throw NullPointerException.
  - qTESLA-I verifier would reject some valid signatures.
  - qTESLA verifiers now reject overly long signatures.
  - PGP regression caused failure to preserve existing version header when
    headers were reset.
  - PKIXNameConstraintValidator had a bad cast preventing use of multiple
    OtherName constraints.
  - Serialisation of the non-CRT RSA Private Key could cause a NullPointerException.
  - An extra 4 bytes was included in the start of HSS public key encodings.
  - CMS with Ed448 using a direct signature was using id-shake256-len
    rather than id-shake256.
  - Use of GCMParameterSpec could cause an AccessControlException under
    some circumstances.
  - DTLS: Fixed high-latency HelloVerifyRequest handshakes.
  - An encoding bug for rightEncoded() in KMAC has been fixed.
  - For a few values the cSHAKE implementation would add unnecessary pad bytes
    where the N and S strings produced encoded data that was block aligned.
  - There were a few circumstances where Argon2BytesGenerator might hit an
    unexpected null. These have been removed.
  * Additional Features and Functionality
  - The qTESLA signature algorithm has been updated to v2.8 (20191108).
  - BCJSSE: Client-side OCSP stapling now supports status_request_v2 extension.
  - Support has been added for "ocsp.enable", "ocsp.responderURL" and
    PKIXRevocationChecker for users of Java 8 and later.
  - Support has been added for "org.bouncycastle.x509.enableCRLDP" to the PKIX validator.
  - BCJSSE: Now supports system property 'jsse.enableFFDHE'
  - BCJSSE: Now supports system properties 'jdk.tls.client.SignatureSchemes'
    and 'jdk.tls.server.SignatureSchemes'.
  - Multi-release support has been added for Java 11 XECKeys.
  - Multi-release support has been added for Java 15 EdECKeys.
  - The MiscPEMGenerator will now output general PrivateKeyInfo structures.
  - A new property "org.bouncycastle.pkcs8.v1_info_only" has been added to
    make the provider only produce version 1 PKCS8 PrivateKeyInfo structures.
  - The PKIX CertPathBuilder will now take the target certificate from the target
    constraints if a specific certificate is given to the selector.
  - BCJSSE: A range of ARIA and CAMELLIA cipher suites added to supported list.
  - BCJSSE: Now supports the PSS signature schemes from RFC 8446 (TLS 1.2 onwards).
  - Performance of the Base64 encoder has been improved.
  - The PGPPublicKey class will now include direct key signatures when checking
    for key expiry times.
  * NOTES:
  - The qTESLA update breaks compatibility with previous versions.
    Private keys now include a hash of the public key at the end,
    and signatures are no longer interoperable with previous versions.</changelog>
  <changelog author="pmonreal@suse.com" date="1608552000">- Version update to 1.67 [bsc#1180215, CVE-2020-28052]
  * CVE-2020-28052: OpenBSDBCrypt.checkPassword utility method
    compared incorrect data when checking the password
  * Defects Fixed:
  - BCJSSE: SunJSSE compatibility fix - override of getChannel()
    removed and 'urgent data' behaviour should now conform to
    what the SunJSSE expects
  - Nested BER data could sometimes cause issues in octet strings
  - Certificates/CRLs with short signatures could cause an exception
    in toString() in the BC X509 Certificate implmentation
  - In line with latest changes in the JVM, SignatureSpis which
    don't require parameters now return null on engineGetParameters()
  - The RSA KeyFactory now always preferentially produces RSAPrivateCrtKey
    where it can on requests for a KeySpec based on an RSAPrivateKey
  - CMSTypedStream$FullReaderStream now handles zero length reads correctly
  - Unecessary padding was added on KMAC when the key string was block aligned
  - Zero length data would cause an unexpected exception from RFC5649WrapEngine
  - OpenBSDBcrypt was failing to handle some valid prefixes
  * Additional Features and Functionality
  - Performance improvement of Argon2 and Noekeon
  - A setSessionKeyObfuscation() method has been added to
    PublicKeyKeyEncryptionMethodGenerator to allow turning off of session key
    obfuscation (default is on, method primarily to get around early version
    GPG issues with AES-128 keys)
  - Implemented 'safegcd' constant-time modular inversion (as well as a
    variable-time variant). It has replaced Fermat inversion in all our EC
    code, and BigInteger.modInverse in several other places, particularly
    signers. This improves side-channel protection, and also gives a
    significant performance boost
  - Performance of custom binary ECC curves and Edwards Curves has been improved
  - BCJSSE: New boolean system property 'org.bouncycastle.jsse.keyManager.checkEKU'
    allows to disable ExtendedKeyUsage restrictions when selecting credentials
    (although the peer may still complain)
  - Initial support has been added for "Composite Keys and Signatures For Use
    In Internet PKI" using the test OID. Please note there will be further
    refinements to this as the draft is standardised
  - The BC EdDSA signature API now supports keys implementing all methods on
    the EdECKey and XECKey interfaces directly
  - Work has begun on classes to support the ETSI TS 103 097, Intelligent
    Transport Systems (ITS) in the bcpkix package
  - Further optimization work has been done on GCM
  - A NewHope based processor, similar to the one for Key Agreement has been
    added for trying to "quantum hard" KEM algorithms
  - PGP clear signed signatures now support SHA-224
  - Treating absent vs NULL as equivalent can now be configured by a system
    property. By default this is not enabled
  - Mode name checks in Cipher strings should now make sure an improper mode
    name always results in a NoSuchAlgorithmException
  - In line with changes in OpenSSL, the OpenSSLPBKDF now uses UTF8 encoding</changelog>
  <changelog author="fstrba@suse.com" date="1610539200">- Version update to 1.68
  * Defects Fixed:
  - Some BigIntegers utility methods would fail for
    BigInteger.ZERO. This has been fixed.
  - PGPUtil.isKeyRing() was not detecting secret sub-keys in its
    input. This has been fixed.
  - The ASN.1 class, ArchiveTimeStamp was insisting on a value
    for the optional reducedHashTree field. This has been fixed.
  - BCJSSE: Lock against multiple writers - a possible
    synchronization issue has been removed.
  * Additional Features and Functionality
  - BCJSSE: Added support for system property
    com.sun.net.ssl.requireCloseNotify. Note that we are using a
    default value of 'true'.
  - BCJSSE: 'TLSv1.3' is now a supported protocol for both client
    and server. For this release it is only enabled by default for
    the 'TLSv1.3' SSLContext, but can be explicitly enabled using
    'setEnabledProtocols' on an SSLSocket or SSLEngine, or via
    SSLParameters.
  - BCJSSE: Session resumption is now also supported for servers
    in TLS 1.2 and earlier. For this release it is disabled by
    default, and can be enabled by setting the boolean system
    property org.bouncycastle.jsse.server.enableSessionResumption
    to 'true'.
  - The provider RSA-PSS signature names that follow the JCA
    naming convention.
  - FIPS mode for the BCJSSE now enforces namedCurves for any
    presented certificates.
  - PGPSignatureSubpacketGenerator now supports editing of a
    pre-existing sub-packet list.</changelog>
  <changelog author="pmonreal@suse.com" date="1621944000">- Add bouncycastle_getpoms.sh to get pom files from Maven repos</changelog>
  <changelog author="fstrba@suse.com" date="1627387200">- Directory core/docs does not exist</changelog>
  <changelog author="fstrba@suse.com" date="1647518400">- Add glassfish-activation-api dependency so that we can build with
  JDK that does not contain the JavaEE modules</changelog>
  <changelog author="fstrba@suse.com" date="1647604800">- Build with source/target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1648641600">- Build against the standalone JavaEE modules unconditionally</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1650628800">- Version update to 1.71
  * Defects Fixed
  - In line with GPG the PGP API now attempts to preserve
    comments containing non-ascii UTF8 characters.
  - An accidental partial dependency on Java 1.7 has been removed
    from the TLS API.
  - JcaPKIXIdentityBuilder would fail to process File objects
    correctly. This is now fixed.
  - Some byte[] parameters to the CMP API were not being
    defensively cloned to prevent accidental changes. Extra
    defensive cloning has been added.
  - CMS primitives would sometimes convert ASN.1 definite-length
    encodings into indefinite-length encodings. The primitives
    will now try and preserve the original encoding where possible.
  - CMSSignedData.getAttributeCertificates() now properly
    restricts the tag values checked to just 1 (the obsolete
    v1 tag) and 2 (for the more current v2 certificates).
  - BCJSSE now tries to validate a custom KeyManager selection
    in order to catch errors around a key manager ignoring
    key type early.
  - Compressed streams in PGP ending with zero length partial
    packets could cause failure on parsing the OpenPGP API.
    This has been fixed.
  - The fallback mode for JceAsymmetricKeyWrapper/Unwrapper
    would lose track of any algorithm parameters generated
    in the initial attempt. The algorithm parameters are now
    propagated.
  - An accidental regression introduced by a fix for another
    issue in PKIXCertPathReviewer around use of the
    AuthorityKeyIdentifier extension and it failing to match
    a certificate uniquely when the serial number field
    is missing has been fixed.
  - An error was found in the creation of TLS 1.3 Export Keying
    Material which could cause compatibility issues. This has
    been fixed.
  * Additional Features and Functionality
  - Support has been added for OpenPGP regular expression
    signature packets.
  - Support has been added for OpenPGP PolicyURI signature
    packets.
  - A utility method has been added to PGPSecretKeyRing to allow
    for inserting or replacing a PGPPublicKey.
  - The NIST PQC Finalist, Classic McEliece has been added to the
    low level API and the BCPQC provider.
  - The NIST PQC Alternate Candidate, SPHINCS+ has been added to
    the BCPQC provider.
  - The NIST PQC Alternate Candidate, FrodoKEM has been added to
    the low level API and the BCPQC provider.
  - The NIST PQC Finalist, SABER has been added to the low level
    API and the BCPQC provider.
  - KMAC128, KMAC256 has been added to the BC provider (empty
    customization string).
  - TupleHash128, TupleHash256 has been added to the BC provider
    (empty customization string).
  - ParallelHash128, ParallelHash256 has been added to the BC
    provider (empty customization string, block size 1024 bits).
  - Two new properties: "org.bouncycastle.rsa.max_size" (default
    15360) and "org.bouncycastle.ec.fp_max_size" (default 1042)
    have been added to cap the maximum size of RSA and EC keys.
  - RSA modulus are now checked to be provably composite using
    the enhanced MR probable prime test.
  - Imported EC Fp basis values are now validated against the MR
    prime number test before use. The certainty level of the
    prime test can be determined by
    "org.bouncycastle.ec.fp_certainty" (default 100).
  - The BC entropy thread now has a specific name:
    "BC-ENTROPY-GATHERER".
  - Utility methods have been added for joining/merging PGP
    public keys and signatures.
  - Blake3-256 has been added to the BC provider.
  - DTLS: optimisation to delayed handshake hash.
  - Further additions to the ETSI 102 941 support in the ETSI/ITS
    package: certification request, signed message generation and
    verification now supported.
  - CMSSignedDataGenerator now supports the direct generation of
    definite-length data.
  - The NetscapeCertType class now has a hasUsages() method on it
    for querying usage settings on its bit string.
  - Support for additional input has been added for deterministic
    (EC)DSA.
  - The OpenPGP API provides better support for subkey
    generation.
  - BCJSSE: Added boolean system properties
    "org.bouncycastle.jsse.client.dh.disableDefaultSuites" and
    "org.bouncycastle.jsse.server.dh.disableDefaultSuites".
    Default "false". Set to "true" to disable inclusion of DH
    cipher suites in the default cipher suites for client/server
    respectively.
  * Notes
  - The deprecated QTESLA implementation has been removed from
    the BCPQC provider.
  - The submission update to SPHINCS+ has been added. This
    changes the generation of signatures - particularly
    deterministic ones.
- Version update to 1.70
  * Defects Fixed
  - Blake 3 output limit is enforced.
  - The PKCS12 KeyStore was relying on default precedence for its
    key Cipher implementation so was sometimes failing if used
    from the keytool. The KeyStore class now makes sure it uses
    the correct Cipher implementation.
  - Fixed bzip2 compression for empty contents (GH #993).
  - ASN.1: More robust handling of high tag numbers and
    definite-length forms.
  - BCJSSE: Fix a concurrent modification issue in session
    contexts (GH#968).
  - BCJSSE: Don't log sensitive system property values (GH#976).
  - BCJSSE: Fixed a priority issue amongst imperfect-match
    credentials in KeyManager classes.
  - The IES AlgorithmParameters object has been re-written to
    properly support all the variations of IESParameterSpec.
  - getOutputSize() for ECIES has been corrected to avoid
    occassional underestimates.
  - The lack of close() in the ASN.1 Dump command line utility
    was triggering false positives in some code analysis tools. A
    close() call has been added.
  - PGPPublicKey.getBitStrength() now properly recognises EdDSA
    keys.
  * Additional Features and Functionality
  - Missing PGP CRC checksums can now be optionally ignored using
    setDetectMissingCRC() (default false) on ArmoredInputStream.
  - PGPSecretKey.copyWithNewPassword() now has a variant which
    uses USAGE_SHA1 for key protection if a PGPDigestCalculator
    is passed in.
  - PGP ASCII armored data now skips "\t", "\v", and "\f".
  - PKCS12 files with duplicate localKeyId attributes on
    certificates will now have the incorrect attributes filtered
    out, rather than the duplicate causing an exception.
  - PGPObjectFactory will now ignore packets representing
    unrecognised signature versions in the input stream.
  - The X.509 extension generator will now accumulate some
    duplicate X.509 extensions into a single extension where it
    is possible to do so.
  - Removed support for maxXofLen in Kangaroo digest.
  - Ignore marker packets in PGP Public and Secret key ring
    collection.
  - An implementation of LEA has been added to the low-level API.
  - Access, recovery, and direct use for PGP session keys has
    been added to the OpenPGP API for processing encrypted data.
  - A PGPCanonicalizedDataGenerator has been added which converts
    input into canonicalized literal data for text and UTF-8
    mode.
  - A getUserKeyingMaterial() method has been added to the
    KeyAgreeRecipientInformation class.
  - ASN.1: Tagged objects (and parsers) now support all tag
    classes. Special code for ApplicationSpecific has been
    deprecated and re-implemented in terms of TaggedObject.
  - ASN.1: Improved support for nested tagging.
  - ASN.1: Added support for GraphicString, ObjectDescriptor,
    RelativeOID.
  - ASN.1: Added support for constructed BitString encodings,
    including efficient parsing for large values.
  - TLS: Added support for external PSK handshakes.
  - TLS: Check policy restrictions on key size when determining
    cipher suite support.
  - A performance issue in KeccakDigest due to left over debug
    code has been identified and dealt with.
  - BKS key stores can now be used for collecting protected keys
    (note: any attempt to store such a store will cause an
    exception).
  - A method for recovering user keying material has been added
    to KeyAgreeRecipientInformation.
  - Support has been added to the CMS API for SHA-3 based
    PLAIN-ECDSA.
  - The low level BcDefaultDigestProvider now supports the SHAKE
    family of algorithms and the SM3 alogirthm.
  - PGPKeyRingGenerator now supports creation of key-rings with
    direct-key identified keys.
  - The PQC NIST candidate, signature algorithm SPHINCS+ has been
    added to the low-level API.
  - ArmoredInputStream now explicitly checks for a '\n' if in
    crLF mode.
  - Direct support for NotationDataOccurances, Exportable,
    Revocable, IntendedRecipientFingerPrints, and AEAD algorithm
    preferences has been added to PGPSignatureSubpacketVector.
  - Further support has been added for keys described using
    S-Expressions in GPG 2.2.X.
  - Support for OpenPGP Session Keys from the (draft) Stateless
    OpenPGP CLI has been added.
  - Additional checks have been added for PGP marker packets in
    the parsing of PGP objects.
  - A CMSSignedData.addDigestAlgorithm() has been added to allow
    for adding additional digest algorithm identifiers to CMS
    SignedData structures when required.
  - Support has been added to CMS for the LMS/HSS signature
    algorithm.
  - The system property
    "org.bouncycastle.jsse.client.assumeOriginalHostName"
    (default false) has been added for dealing with SNI problems
    related to the host name not being propagate by the JVM.
  - The JcePKCSPBEOutputEncryptorBuilder now supports SCRYPT with
    ciphers that do not have algorithm parameters (e.g. AESKWP).
  - Support is now added for certificates using ETSI TS 103 097,
    "Intelligent Transport Systems (ITS)" in the bcpkix package.
  * Notes.
  - While this release should maintain source code compatibility,
    developers making use of some parts of the ASN.1 library will
    find that some classes need recompiling. Apologies for the
    inconvenience.
- Version update to 1.69
  * Defects Fixed
  - Lightweight and JCA conversion of Ed25519 keys in the PGP API
    could drop the leading byte as it was zero. This has been
    fixed.
  - Marker packets appearing at the start of PGP public key rings
    could cause parsing failure. This has been fixed.
  - ESTService could fail for some valid Content-Type headers.
    This has been fixed.
  - Originator key algorithm parameters were being passed as NULL
    in key agreement recipients. The parameters now reflect the
    value of the parameters in the key's SubjectPublicKeyInfo.
  - ContentType on encapsulated data was not been passed through
    correctly for authenticated and enveloped data. This has been
    fixed.
  - NTRUEncryptionParameters and
    NTRUEncryptionKeyGenerationParameters were not correctly
    cloning the contained message digest. This has been fixed.
  - CertificateFactory.generateCertificates()/generateCRLs()
    would throw an exception if extra data was found at the end
    of a PEM file even if valid objects had been found. Extra
    data is now ignored providing at least one object found.
  - Internal class PKIXCRLUtil could throw a NullPointerException
    for CRLs with an absent nextUpdate field. This has been
    fixed.
  - PGP ArmoredInputStream now fails earlier on malformed
    headers.
  - The McElieceKobaraImaiCipher was randomly throwing "Bad
    Padding: invalid ciphertext" exception while decrypting due
    to leading zeroes been missed during processing of the cipher
    text. This has been fixed.
  - Ed25519 keys being passed in via OpenSSH key spec are now
    validated in the KeyFactory.
  - Blowfish keys are now range checked on cipher construction.
  - In some cases PGPSecretKeyRing was failing to search its
    extraPubKeys list when searching for public keys.
  - The BasicConstraintsValidation class in the BC cert path
    validation tools has improved conformance to RFC 5280.
  - AlgorithmIdentifiers involving message digests now attempt to
    follow the latest conventions for the parameters field
    (basically DER NULL appears less).
  - Fix various conversions and interoperability for XDH and
    EdDSA between BC and SunEC providers.
  - TLS: Prevent attempts to use KeyUpdate mechanism in versions
    before TLS 1.3.
  * Additional Features and Functionality
  - GCM-SIV has been added to the lightweight API and the
    provider.
  - Blake3 has been added to the lightweight API.
  - The OpenSSL PEMParser can now be extended to add specialised
    parsers.
  - Base32 encoding has now been added, the default alphabet is
    from RFC 4648.
  - The KangarooTwelve message digest has been added to the
    lightweight API.
  - An implementation of the two FPE algorithms, FF1 and FF3-1 in
    SP 800-38G has been added to the lightweight API and the JCE
    provider.
  - An implementation of ParallelHash has been added to the
    lightweight API.
  - An implementation of TupleHash has been added to the
    lightweight API.
  - RSA-PSS now supports the use of SHAKE128 and SHAKE256 as the
    mask generation function and digest.
  - ECDSA now supports the use of SHAKE128 and SHAKE256.
  - PGPPBEEncryptedData will now reset the stream if the initial
    checksum fails so another password can be tried.
  - Iterators on public and secret key ring collections in PGP
    now reflect the original order of the public/secret key rings
    they contain.
  - KeyAgreeRecipientInformation now has a getOriginator() method
    for retrieving the underlying orginator information.
  - PGPSignature now has a getDigestPrefix() method for people
    wanting exposure to the signature finger print details.
  - The old BKS-V1 format keystore is now disabled by default. If
    you need to use BKS-V1 for legacy reasons, it can be
    re-enabled by adding: org.bouncycastle.bks.enable_v1=true to
    the java.security file. We would be interested in hearing
    from anyone that needs to do this.
  - PLAIN-ECDSA now supports the SHA3 digests.
  - Some highlevel support for RFC 4998 ERS has been added for
    ArchiveTimeStamp and EvidenceRecord. The new classes are in
    the org.bouncycastle.tsp.ers package.
  - ECIES has now also support SHA256, SHA384, and SHA512.
  - digestAlgorithms filed in CMS SignedData now includes counter
    signature digest algorithms where possible.
  - A new property "org.bouncycastle.jsse.config" has been added
    which can be used to configure the BCJSSE provider when it is
    created using the no-args constructor.
  - In line with changes in OpenSSL 1.1.0,
    OpenSSLPBEParametersGenerator can now be configured with a
    digest.
  - PGPKeyRingGenerator now includes a method for adding a subkey
    with a primary key binding signature.
  - Support for ASN.1 PRIVATE tags has been added.
  - Performance enhancements to Nokeon, AES, GCM, and
    SICBlockCipher.
  - Support for ecoding/decoding McElieceCCA2 keys has been added
    to the PQC API
  - BCJSSE: Added support for jdk.tls.maxCertificateChainLength
    system property (default is 10).
  - BCJSSE: Added support for jdk.tls.maxHandshakeMessageSize
    system property (default is 32768).
  - BCJSSE: Added support for jdk.tls.client.enableCAExtension
    (default is 'false').
  - BCJSSE: Added support for jdk.tls.client.cipherSuites system
    property.
  - BCJSSE: Added support for jdk.tls.server.cipherSuites system
    property.
  - BCJSSE: Extended ALPN support via standard JSSE API to JDK 8
    versions after u251/u252.
  - BCJSSE: Key managers now support EC credentials for use with
    TLS 1.3 ECDSA signature schemes (including brainpool).
  - TLS: Add TLS 1.3 support for brainpool curves per RFC 8734.
  * Notes
  - There is a small API change in the PKIX package to the
    DigestAlgorithmIdentifierFinder interface as a find() method
    that takes an ASN1ObjectIdentifier has been added to it. For
    people wishing to extend their own implementations, see
    DefaultDigestAlgorithmIdentifierFinder for a sample
    implementation.
  - A version of the bcmail API supporting Jakarta Mail has now
    been added (see bcjmail jar).
  - Some work has been done on moving out code that does not need
    to be in the provider jar. This has reduced the size of the
    provider jar and should also make it easier for developers to
    patch the classes involved as they no longer need to be
    signed. bcpkix and bctls are both dependent on the new bcutil
    jar.
- Add build dependencies on
  mvn(jakarta.activation:jakarta.activation-api) and
  mvn(jakarta.mail:jakarta.mail-api)
- Remove unneeded script bouncycastle_getpoms.sh from sources</changelog>
  <changelog author="pmonreal@suse.com" date="1666180800">- Update to version 1.72:
  * Defects Fixed:
  - There were parameter errors in XMSS^MT OIDs for
    XMSSMT_SHA2_40/4_256 and XMSSMT_SHA2_60/3_256. These have
    been fixed.
  - There was an error in Merkle tree construction for the
    Evidence Records (ERS) implementation which could result in
    invalid roots been timestamped. ERS now produces an
    ArchiveTimeStamp for each data object/group with an associated
    reduced hash tree. The reduced hash tree is now calculated as
    a simple path to the root of the tree for each record.
  - OpenPGP will now ignore signatures marked as non-exportable
    on encoding.
  - A tagging calculation error in GCMSIV which could result in
    incorrect tags has been fixed.
  - Issues around Java 17 which could result in failing tests
    have been addressed.
  * Additional Features and Functionality:
  - BCJSSE: TLS 1.3 is now enabled by default where no explicit
    protocols are supplied (e.g. "TLS" or "Default" SSLContext
    algorithms, or SSLContext.getDefault() method).
  - BCJSSE: Rewrite SSLEngine implementation to improve compatibility
    with SunJSSE.
  - BCJSSE: Support export of keying material via extension API.
  - (D)TLS: Add support for 'tls-exporter' channel binding per RFC 9266.
  - (D)TLS (low-level API): By default, only (D)TLS 1.2 and TLS 1.3 are
    offered now. Earlier versions are still supported if explicitly
    enabled. Users may need to check they are offering suitable
    cipher suites for TLS 1.3.
  - (D)TLS (low-level API): Add support for raw public keys per RFC 7250.
  - CryptoServicesRegistrar now has a setServicesConstraints() method
    on it which can be used to selectively turn off algorithms.
  - The NIST PQC Alternate Candidate, Picnic, has been added to the low
    level API and the BCPQC provider.
  - SPHINCS+ has been upgraded to the latest submission, SPHINCS+ 3.1
    and support for Haraka has been added.
  - Evidence records now support timestamp renewal and hash renewal.
  - The SIKE Alternative Candidate NIST Post Quantum Algorithm has
    been added to the low-level PQC API.
  - The NTRU Round 3 Finalist Candidate NIST Post Quantum Algorithm
    has been added to the low-level API and the BCPQC provider.
  - The Falcon Finalist NIST Post Quantum Algorithm has been added to
    the low-level API and the BCPQC provider.
  - The CRYSTALS-Kyber Finalist NIST Post Quantum Algorithm has been
    added to the low-level API and the BCPQC provider.
  - Argon2 Support has been added to the OpenPGP API.
  - XDH IES has now been added to the BC provider.
  - The OpenPGP API now supports AEAD encryption and decryption.
  - The NTRU Prime Alternative Candidate NIST Post Quantum Algorithms
    have been added to the low-level API and the BCPQC provider.
  - The CRYSTALS-Dilithium Finalist NIST Post Quantum Algorithm has
    been added to the low-level API and the BCPQC provider.
  - The BIKE NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - The HQC NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - Grain128AEAD has been added to the lightweight API.
  - A fast version of CRC24 has been added for use with the PGP API.
  - Some additional methods and fields have been exposed in the
    PGPOnePassSignature class to (hopefully) make it easier to
    deal with nested signatures.
  - CMP support classes have been updated to reflect the latest
    editions to the the draft RFC "Lightweight Certificate Management
    Protocol (CMP) Profile".
  - Support has been added to the PKCS#12 implementation for the
    Oracle trusted certificate attribute.
  - Performance of our BZIP2 classes has been improved.
  * Notes:
  - Keep in mind the PQC algorithms are still under development and
    we are still at least a year and a half away from published standards.
    This means the algorithms may still change so by all means experiment,
    but do not use the PQC algoritms for anything long term.
  - The legacy "Rainbow" and "McEliece" implementations have been
    removed from the BCPQC provider. The underlying classes are
    still present if required. Other legacy algorithm implementations
    can be found under the org.bouncycastle.pqc.legacy package.
  * Security Notes:
  - The PQC SIKE algorithm is provided for research purposes only.
    It should now be regarded as broken. The SIKE implementation
    will be withdrawn in BC 1.73.
  * Rebase bouncycastle-javadoc.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1682424000">- Update to version 1.73: [jsc#PED-3756]
  * Defects Fixed:
  - BCJSSE: Instantiating a JSSE provider in some contexts could
    cause an AccessControl exception.
  - The EC key pair generator can generate out of range private
    keys when used with SM2. A specific SM2KeyPairGenerator has
    been added to the low-level API and is used by
    KeyPairGenerator.getInstance("SM2", "BC"). The SM2 signer has
    been updated to check for out of range keys as well..
  - The attached signature type byte was still present in Falcon
    signatures as well as the detached signature byte.
  - There was an off-by-one error in engineGetOutputSize() for ECIES.
  - The method for invoking read() internally in BCPGInputStream
    could result in inconsistent behaviour if the class was extended.
  - Fixed a rounding issue with FF1 Format Preserving Encryption
    algorithm for certain radices.
  - Fixed RFC3394WrapEngine handling of 64 bit keys.
  - Internal buffer for blake2sp was too small and could result in
    an ArrayIndexOutOfBoundsException.
  - JCA PSS Signatures using SHAKE128 and SHAKE256 now support
    encoding of algorithm parameters.
  - PKCS10CertificationRequest now checks for empty extension
    parameters.
  - Parsing errors in the processing of PGP Armored Data now throw
    an explicit exception ArmoredInputException.
  - PGP AEAD streams could occassionally be truncated.
  - The ESTService class now supports processing of chunked HTTP data.
  - A constructed ASN.1 OCTET STRING with a single member would
    sometimes be re-encoded as a definite-length OCTET STRING. The
    encoding has been adjusted to preserve the BER status of the object.
  - PKIXCertPathReviewer could fail if the trust anchor was also
    included in the certificate store being used for path analysis.
  - UTF-8 parsing of an array range ignored the provided length.
  - IPAddress has been written to provide stricter checking and
    avoid the use of Integer.parseInt().
  - A Java 7 class snuck into the Java 5 to Java 8 build.
  * Additional Features and Functionality:
  - The Rainbow NIST Post Quantum Round-3 Candidate has been added to
    the low-level API and the BCPQC provider (level 3 and level 5
    parameter sets only).
  - The GeMSS NIST Post Quantum Round-3 Candidate has been added to
    the low-level API.
  - The org.bouncycastle.rsa.max_mr_tests property check has been
    added to allow capping of MR tests done on RSA moduli.
  - Significant performance improvements in PQC algorithms,
    especially BIKE, CMCE, Frodo, HQC, Picnic.
  - EdDSA verification now conforms to the recommendations of Taming
    the many EdDSAs, in particular cofactored verification. As a side
    benefit, Pornin's basis reduction is now used for EdDSA
    verification, giving a significant performance boost.
  - Major performance improvements for Anomalous Binary (Koblitz) Curves.
  - The lightweight Cryptography finalists Ascon, ISAP, Elephant,
    PhotonBeetle, Sparkle, and Xoodyak have been added to the
    light-weight cryptography API.
  - BLAKE2bp and BLAKE2sp have been added to the light-weight
    cryptography API.
  - Support has been added for X.509, Section 9.8, hybrid certificates
    and CRLs using alternate public keys and alternate signatures.
  - The property "org.bouncycastle.emulate.oracle" has been added to
    signal the provider should return algorithm names on some algorithms
    in the same manner as the Oracle JCE provider.
  - An extra replaceSigners method has been added to CMSSignedData
    which allows for specifying the digest algorithm IDs to be used
    in the new CMSSignedData object.
  - Parsing and re-encoding of ASN.1 PEM data has been further
    optimized to prevent unecessary conversions between basic encoding,
    definite length, and DER.
  - Support has been added for KEM ciphers in CMS in accordance with
    draft-ietf-lamps-cms-kemri
  - Support has been added for certEncr in CRMF to allow issuing of
    certificates for KEM public keys.
  - Further speedups have been made to CRC24.
  - GCMParameterSpec constructor caching has been added to improve
    performance for JVMs that have the class available.
  - The PGPEncrytedDataGenerator now supports injecting the session
    key to be used for PGP PBE encrypted data.
  - The CRMF CertificateRequestMessageBuilder now supports optional
    attributes.
  - Improvements to the s calculation in JPAKE.
  - A general purpose PQCOtherInfoGenerator has been added which
    supports all Kyber and NTRU.
  - An implementation of HPKE (RFC 9180 - Hybrid Public Key
    Encryption) has been added to the light-weight cryptography API.
  * Security Advisories:
  - The PQC implementations have now been subject to formal review for
    secret leakage and side channels, there were issues in BIKE, Falcon,
    Frodo, HQC which have now been fixed. Some weak positives also
    showed up in Rainbow, Picnic, SIKE, and GeMSS - for now this last
    set has been ignored as the algorithms will either be updated if
    they reappear in the Signature Round, or deleted, as is already the
    case for SIKE (it is now in the legacy package). Details on the
    group responsible for the testing can be found in the CONTRIBUTORS
    file.
  - For at least some ECIES variants (e.g. when using CBC) there is
    an issue with potential malleability of a nonce (implying silent
    malleability of the plaintext) that must be sent alongside the
    ciphertext but is outside the IES integrity check. For this reason
    the automatic generation of nonces with IED is now disabled and
    they have to be passed in using an IESParameterSpec. The current
    advice is to agree on a nonce between parties and then rely on the
    use of the ephemeral key component to allow the nonce (rather the
    so called nonce) usage to be extended.</changelog>
  <changelog author="pmonreal@suse.com" date="1687176000">- Update to version 1.74: [bsc#1212508, CVE-2023-33201]
  * Defects Fixed:
  - AsconEngine: Fixed a buffering bug when decrypting across
    multiple processBytes calls (ascon128a unaffected).
  - Context based sanity checking on PGP signatures has been added.
  - The ParallelHash clone constructor was not copying all fields.
  - The maximimum number of blocks for CTR/SIC modes was 1 block
    less than it should have been.
  * Additional Features and Functionality:
  - The PGP API now supports wildcard key IDs for public key
    based data encryption.
  - LMS now supports SHA256/192, SHAKE256/192, and SHAKE256/256
    (the additional SP 8000-208 parameter sets).
  - The PGP API now supports V5 and V6 AEAD encryption for
    encrypted data packets.
  - The PGP examples have been updated to reflect key size and algorithm
    changes that have occurred since they were first written (10+ years...).
  - (D)TLS: A new callback 'TlsPeer.notifyConnectionClosed' will be called
    when the connection is closed (including by failure).
  - BCJSSE: Improved logging of connection events and include unique IDs
    in connection-specific log messages.
  - BCJSSE: Server now logs the offered cipher suites when it fails to
    select one.
  - BCJSSE: Added support for SSLParameters namedGroups and
    signatureSchemes properties (can also be used via BCJSSE
    extension API in earlier Java versions).
  - DTLS: The initial handshake re-send time is now configurable by
    overriding 'TlsPeer.getHandshakeResendTimeMillis'.
  - DTLS: Added support for connection IDs per RFC 9146.
  - DTLS: Performance of DTLSVerifier has been improved so that it can
    reasonably be used for all incoming packets.
  - Initial support has been added for A Mechanism for Encoding
    Differences in Paired Certificates.
  - The PGP API now supports parsing, encoding, and fingerprinting
    of V6 EC/EdEC keys.
  - A thread safe verifier API has been added to the PGP API to support
    multi-threaded verification of certifications on keys and user IDs.
  - The number of keys/sub-keys in a PGPKeyRing can now be found by
    calling PGPKeyRing.size().
  - The PQC algorithms LMS/HSS, SPHINCS+, Dilithium, Falcon, and NTRU
    are now supported directly by the BC provider.
  * Notes:
  - The now defunct PQC SIKE algorithm has been removed, this has also
    meant the removal of its resource files so the provider is now quite
    a bit smaller.
  - As a precaution, HC128 now enforces a 128 bit IV, previous behaviour
    for shorter IVs can be supported where required by padding the IV to
    the 128 bits with zero.
  - PGP encrypted data generation now uses integrity protection by default.
    Previous behaviour for encrypted data can be supported where required
    by calling PGPDataEncryptorBuilder.setWithIntegrityPacket(false) when
    data encryption is set up.
  - There are now additional sanity checks in place to prevent accidental
    mis-use of PGPSignature objects. If this change causes any issues, you
    might want to check what your code is up to as there is probably a bug.
  * Security Advisories:
  - CVE-2023-33201: this release fixes an issue with the X509LDAPCertStoreSpi
    where a specially crafted certificate subject could be used to try and
    extract extra information out of an LDAP server with wild-card matthing
    enabled.
  * Rebase bouncycastle-javadoc.patch
  * Add bouncycastle-notests.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1697630400">- Update to version 1.76:
  * Defects Fixed:
  - Service allocation in the provider could fail due to the lack
    of a permission block. This has been fixed.
  - JceKeyFingerPrintCalculator has been generalised for different
    providers by using "SHA-256" for the algorithm string.
  - BCJSSE: Fixed a regression in 1.74 (NullPointerException) that
    prevents a BCJSSE server from negotiating TLSv1.1 or earlier.
  - DTLS: Fixed server support for client_certificate_type extension.
  - Cipher.unwrap() for HQC could fail due to a miscalculation of
    the length of the KEM packet. This has been fixed.
  - There was exposure to a Java 7 method in the Java 5 to Java 8
    BCTLS jar which could cause issues with some TLS 1.2 cipher
    suites running on older JVMs. This is now fixed.
  * Additional Features and Functionality:
  - BCJSSE: Following OpenJDK, finalizers have been removed from
    SSLSocket subclasses. Applications should close sockets and
    not rely on garbage collection.
  - BCJSSE: Added support for boolean system property
    "jdk.tls.client.useCompatibilityMode" (default "true").
  - DTLS: Added server support for session resumption.
  - JcaPKCS10CertificationRequest will now work with EC on the
    OpenJDK provider.
  - TimeStamp generation now supports the SHA3 algorithm set.
  - The SPHINCS+ simple parameters are now fully supported in the
    BCPQC provider.
  - Kyber, Classic McEliece, HQC, and Bike now supported by the
    CRMF/CMS/CMP APIs.
  - Builder classes have been add for PGP ASCII Armored streams
    allowing CRCs and versions to now be optional.
  - An UnknownPacket type has been added to the PGP APIs to allow
    for forwards compatibility with upcoming revisions to the standard.
  * Rebase patch bouncycastle-notests.patch
- Update to version 1.75:
  * Defects Fixed:
  - Several Java 8 method calls were accidentally introduced in
    the Java 5 to Java 8 build. The affected classes have been
    refactored to remove this.
  - (D)TLS: renegotiation after resumption now fixed to avoid
    breaking connection.
  * Notes:
  - The ASN.1 core package has had some dead and retired methods
    cleaned up and removed.</changelog>
  <changelog author="pmonreal@suse.com" date="1701691200">- Update to version 1.77:
  * Defects Fixed:
  - Using an unescaped '=' in an X.500 RDN would result in the
    RDN being truncated silently. The issue is now detected and
    an exception is thrown.
  - asn1.eac.CertificateBody was returning certificateEffectiveDate
    from getCertificateExpirationDate(). This has been fixed to
    return certificateExpirationDate.
  - DTLS: Fixed retransmission in response to re-receipt of an
    aggregated ChangeCipherSpec.
  - (D)TLS: Fixed compliance for supported_groups extension.
    Server will no longer negotiate an EC cipher suite using a
    default curve when the ClientHello includes the supported_groups
    extension but it contains no curves in common with the server.
    Similarly, a DH cipher suite will not be negotiated when the
    ClientHello includes supported_groups, containing at least one
    FFDHE group, but none in common with the server.
  - IllegalStateException was being thrown by Ed25519/Ed448 SignatureSpi.
  - TLS: class annotation issues that could occur between the BC
    provider and the TLS API for the GCMParameterSpec class when
    the jars were loaded on the boot class path have been addressed.
  - Attempt to create an ASN.1 OID from a zero length byte array
    is now caught at construction time.
  - Attempt to create an X.509 extension block which is empty will
    now be blocked cause an exception.
  - IES implementation will now accept a null ParameterSpec if no
    nonce is needed.
  - An internal method in Arrays was failing to construct its
    failure message correctly on an error.
  - HSSKeyPublicParameters.generateLMSContext() would fail for a
    unit depth key.
  * Additional Features and Functionality:
  - BCJSSE: Added org.bouncycastle.jsse.client.omitSigAlgsCertExtension
    and org.bouncycastle.jsse.server.omitSigAlgsCertExtension boolean
    system properties to control (for client and server resp.) whether
    the signature_algorithms_cert extension should be omitted if it
    would be identical to signature_algorithms. Defaults to true, the
    historical behaviour.
  - The low-level HPKE API now allows the sender to specify an
    ephemeral key pair.
  - Support has been added for the delta-certificate requests in line
    with the current Chameleon Cert draft from the IETF.
  - Some accommodation has been added for historical systems to
    accommodate variations in the SHA-1 digest OID for CMS SignedData.
  - TLS: the TLS API will now try "RSAwithDigestAndMFG1" as well as
    the newer RSAPSS algorithm names when used with the JCA.
  - TLS: RSA key exchange cipher suites are now disabled by default.
  - Support has been added for PKCS#10 requests to allow certificates
    using the altSignature/altPublicKey extensions.
  * Notes:
  - Kyber and Dilithium have been updated according to the latest
    draft of the standard. Dilithium-AES and Kyber-AES have now been
    removed. Kyber now produces 256 bit secrets for all parameter sets
    (in line with the draft standard).
  - NTRU has been updated to produce 256 bit secrets in line with Kyber.
  - SPHINCS+ can now be used to generate certificates in line with
    those used by (Open Quantum Safe) OQS.
  - Falcon object idenitifiers are now in line with OQS as well.
  - PQC CMS SignedData now defaults to SHA-256 for signed attributes
    rather than SHAKE-256. This is also a compatibility change, but may
    change further again as the IETF standard for CMS is updated.</changelog>
  <changelog author="pmonreal@suse.com" date="1714392000">- Update to version 1.78: [bsc#1223252, CVE-2024-30171]
  * Security Advisories.
  - CVE-2024-29857: Importing an EC certificate with specially crafted
    F2m parameters can cause high CPU usage during parameter evaluation.
  - CVE-2024-30171: Possible timing based leakage in RSA based handshakes
    due to exception processing eliminated.
  - CVE-2024-30172: Crafted signature and public key can be used to
    trigger an infinite loop in the Ed25519 verification code.
  - CVE-2024-301XX: When endpoint identification is enabled in the BCJSSE
    and an SSL socket is not created with an explicit hostname (as happens
    with HttpsURLConnection), hostname verification could be performed
    against a DNS-resolved IP address. This has been fixed.
  * Defects Fixed:
  - Issues with a dangling weak reference causing intermittent
    NullPointerExceptions in the OcspCache have been fixed.
  - Issues with non-constant time RSA operations in TLS handshakes.
  - Issue with Ed25519, Ed448 signature verification causing intermittent
    infinite loop have been fixed.
  - Issues with non-constant time ML-KEM implementation ("Kyber Slash").
  - Align ML-KEM input validation with FIPS 203 IPD requirements.
  - Make PEM parsing more forgiving of whitespace to align with RFC 7468.
  - Fix CCM length checks with large nonce sizes (n=12, n=13).
  - EAC: Fixed the CertificateBody ASN.1 type to support an optional
    Certification Authority Reference in a Certificate Request.
  - ASN.1: ObjectIdentifier (also Relative OID) parsing has been optimized
    and the contents octets for both types are now limited to 4096 bytes.
  - BCJSSE: Fixed a missing null check on the result of PrivateKey.getEncoded(),
    which could cause issues for HSM RSA keys.
  - BCJSSE: When endpoint identification is enabled and an SSL socket is not
    created with an explicit hostname (as happens with HttpsURLConnection),
    hostname verification could be performed against a DNS-resolved IP address.
  - The missing module import of java.logging to the provider module has been added.
  - GOST ASN.1 public key alg parameters are now compliant with RFC 9215.
  - An off-by-one error in the encoding for EccP256CurvePoint for ITS.
  - PEM Parser now enforces PEM headers to start at the beginning of the line
    to be meaningful.
  * Additional Features and Functionality.
  - An implementation of MLS (RFC 9420 - The Messaging Layer Security Protocol)
    has been added as a new module.
  - NTRU now supports NTRU-HPS4096-1229 and NTRU-HRSS-1373.
  - Improvements to PGP support, including Camellia key wrapping and Curve25519,
    Curve448 key types (including XDH with HKDF).
  - Added initial support for ML-KEM in TLS.
  - Added XWing hybrid KEM construction (X25519 + ML-KEM-768).
  - Introduced initial KEMSpi support (NTRU, SNTRU Prime) for JDK 21+.
  - Introduced initial composite signature support for X509 Certificates.
  - PKCS#12 now supports PKCS12-AES256-AES128, PKCS12-AES256-AES128-GCM,
    PKCS12-DEF-AES256-AES128, and PKCS12-DEF-AES256-AES128-GCM.
  - The default type for the KeyStore.getInstance("PKCS12", "BC") can now be set
    using the org.bouncycastle.pkcs12.default system/security property.
  - The PGP SExpParser will now handle Ed25519 and Ed448 keys.
  - Dilithium and Kyber key encoding updated to latest Draft RFCs
    (draft-ietf-lamps-dilithium-certificates and draft-ietf-lamps-kyber-certificates)
  - Support has been added for encryption key derivation using HKDF in CMS, see
    draft-housley-lamps-cms-cek-hkdf-sha256.
  - X500Name now recognises jurisdiction{C,ST,L} DNs.
  - CertPathValidationContext and CertificatePoliciesValidation now include
    implementations of Memoable.
  - The Composite post-quantum signatures implementation has been updated to the
    latest draft draft-ounsworth-pq-composite-sigs.
  * Full release notes: bouncycastle.org/releasenotes.html#r1rv78
  * Rebase bouncycastle-notests.patch</changelog>
  <changelog author="fstrba@suse.com" date="1714392001">- Update to version 1.78.1
  * Defects Fixed:
  - The new dependency of the the PGP API on the bcutil jar was
    missing from the module jar, the OSGi manifest, and the Maven
    POM. This has been fixed.
  - Missing exports and duplicate imports have been added/removed
    from the OSGi manifests.
  - The OSGi manifests now have the same bundle IDs as 1.77 and
    lock down dependencies to the equivalent variations
  - A check in the X.509 Extensions class preventing the parsing
    of empty extensions has been removed.</changelog>
</package>
<package pkgid="c60762827fd44ce3a079a5da31f70890ba1f3670c3549add2e7dfbb669895679" name="bouncycastle-util" arch="noarch">
  <version epoch="0" ver="1.78.1" rel="150200.3.29.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1570881600">- Update pom files with those from Maven repository.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573041600">- Fix arch dependent macros in noarch package [bsc#1109539]</changelog>
  <changelog author="fstrba@suse.com" date="1585137600">- Added patch:
  * bouncycastle-osgi.patch
    + Add OSGi manifests to the distributed jars so that they can
    be used from eclipse</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588161600">- Version update to 1.65
  * Defects Fixed:
  - DLExternal would encode using DER encoding for tagged SETs.
  - ChaCha20Poly1305 could fail for large (&gt;~2GB) files.
  - ChaCha20Poly1305 could fail for small updates when used via the provider.
  - Properties.getPropertyValue could ignore system property when other
    local overrides set.
  - The entropy gathering thread was not running in daemon mode, meaning there
    could be a delay in an application shutting down due to it.
  - A recent change in Java 11 could cause an exception with the BC Provider's
    implementation of PSS.
  - BCJSSE: TrustManager now tolerates having no trusted certificates.
  - BCJSSE: Choice of credentials and signing algorithm now respect the peer's
    signature_algorithms extension properly.
  - BCJSSE: KeyManager for KeyStoreBuilderParameters no longer leaks memory.
  * Additional Features and Functionality:
  - LMS and HSS (RFC 8554) support has been added to the low level library and
    the PQC provider.
  - SipHash128 support has been added to the low level library and the JCE provider.
  - BCJSSE: BC API now supports explicitly specifying the session to resume.
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: Added support for extended_master_secret system properties:
    jdk.tls.allowLegacyMasterSecret, jdk.tls.allowLegacyResumption,
    jdk.tls.useExtendedMasterSecret .
  - BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is
    negotiated (except in FIPS mode).
  - BCJSSE: KeyManager and TrustManager now check algorithm constraints for
    keys and certificate chains.
  - BCJSSE: KeyManager selection of server credentials now prefers matching
    SNI hostname (if any).
  - BCJSSE: KeyManager may now fallback to imperfect credentials (expired,
    SNI mismatch).
  - BCJSSE: Client-side OCSP stapling support (beta version: via status_request
    extension only, provides jdk.tls.client.enableStatusRequestExtension, and
    requires CertPathBuilder support).
  - TLS: DSA in JcaTlsCrypto now falls back to stream signing to work around
    NoneWithDSA limitations in default provider.</changelog>
  <changelog author="pmonreal@suse.com" date="1595937600">- Version update to 1.66 [bsc#1186328, CVE-2020-15522]
  * Defects Fixed:
  - EdDSA verifiers now reset correctly after rejecting overly long signatures.
  - BCJSSE: SSLSession.getPeerCertificateChain could throw NullPointerException.
  - qTESLA-I verifier would reject some valid signatures.
  - qTESLA verifiers now reject overly long signatures.
  - PGP regression caused failure to preserve existing version header when
    headers were reset.
  - PKIXNameConstraintValidator had a bad cast preventing use of multiple
    OtherName constraints.
  - Serialisation of the non-CRT RSA Private Key could cause a NullPointerException.
  - An extra 4 bytes was included in the start of HSS public key encodings.
  - CMS with Ed448 using a direct signature was using id-shake256-len
    rather than id-shake256.
  - Use of GCMParameterSpec could cause an AccessControlException under
    some circumstances.
  - DTLS: Fixed high-latency HelloVerifyRequest handshakes.
  - An encoding bug for rightEncoded() in KMAC has been fixed.
  - For a few values the cSHAKE implementation would add unnecessary pad bytes
    where the N and S strings produced encoded data that was block aligned.
  - There were a few circumstances where Argon2BytesGenerator might hit an
    unexpected null. These have been removed.
  * Additional Features and Functionality
  - The qTESLA signature algorithm has been updated to v2.8 (20191108).
  - BCJSSE: Client-side OCSP stapling now supports status_request_v2 extension.
  - Support has been added for "ocsp.enable", "ocsp.responderURL" and
    PKIXRevocationChecker for users of Java 8 and later.
  - Support has been added for "org.bouncycastle.x509.enableCRLDP" to the PKIX validator.
  - BCJSSE: Now supports system property 'jsse.enableFFDHE'
  - BCJSSE: Now supports system properties 'jdk.tls.client.SignatureSchemes'
    and 'jdk.tls.server.SignatureSchemes'.
  - Multi-release support has been added for Java 11 XECKeys.
  - Multi-release support has been added for Java 15 EdECKeys.
  - The MiscPEMGenerator will now output general PrivateKeyInfo structures.
  - A new property "org.bouncycastle.pkcs8.v1_info_only" has been added to
    make the provider only produce version 1 PKCS8 PrivateKeyInfo structures.
  - The PKIX CertPathBuilder will now take the target certificate from the target
    constraints if a specific certificate is given to the selector.
  - BCJSSE: A range of ARIA and CAMELLIA cipher suites added to supported list.
  - BCJSSE: Now supports the PSS signature schemes from RFC 8446 (TLS 1.2 onwards).
  - Performance of the Base64 encoder has been improved.
  - The PGPPublicKey class will now include direct key signatures when checking
    for key expiry times.
  * NOTES:
  - The qTESLA update breaks compatibility with previous versions.
    Private keys now include a hash of the public key at the end,
    and signatures are no longer interoperable with previous versions.</changelog>
  <changelog author="pmonreal@suse.com" date="1608552000">- Version update to 1.67 [bsc#1180215, CVE-2020-28052]
  * CVE-2020-28052: OpenBSDBCrypt.checkPassword utility method
    compared incorrect data when checking the password
  * Defects Fixed:
  - BCJSSE: SunJSSE compatibility fix - override of getChannel()
    removed and 'urgent data' behaviour should now conform to
    what the SunJSSE expects
  - Nested BER data could sometimes cause issues in octet strings
  - Certificates/CRLs with short signatures could cause an exception
    in toString() in the BC X509 Certificate implmentation
  - In line with latest changes in the JVM, SignatureSpis which
    don't require parameters now return null on engineGetParameters()
  - The RSA KeyFactory now always preferentially produces RSAPrivateCrtKey
    where it can on requests for a KeySpec based on an RSAPrivateKey
  - CMSTypedStream$FullReaderStream now handles zero length reads correctly
  - Unecessary padding was added on KMAC when the key string was block aligned
  - Zero length data would cause an unexpected exception from RFC5649WrapEngine
  - OpenBSDBcrypt was failing to handle some valid prefixes
  * Additional Features and Functionality
  - Performance improvement of Argon2 and Noekeon
  - A setSessionKeyObfuscation() method has been added to
    PublicKeyKeyEncryptionMethodGenerator to allow turning off of session key
    obfuscation (default is on, method primarily to get around early version
    GPG issues with AES-128 keys)
  - Implemented 'safegcd' constant-time modular inversion (as well as a
    variable-time variant). It has replaced Fermat inversion in all our EC
    code, and BigInteger.modInverse in several other places, particularly
    signers. This improves side-channel protection, and also gives a
    significant performance boost
  - Performance of custom binary ECC curves and Edwards Curves has been improved
  - BCJSSE: New boolean system property 'org.bouncycastle.jsse.keyManager.checkEKU'
    allows to disable ExtendedKeyUsage restrictions when selecting credentials
    (although the peer may still complain)
  - Initial support has been added for "Composite Keys and Signatures For Use
    In Internet PKI" using the test OID. Please note there will be further
    refinements to this as the draft is standardised
  - The BC EdDSA signature API now supports keys implementing all methods on
    the EdECKey and XECKey interfaces directly
  - Work has begun on classes to support the ETSI TS 103 097, Intelligent
    Transport Systems (ITS) in the bcpkix package
  - Further optimization work has been done on GCM
  - A NewHope based processor, similar to the one for Key Agreement has been
    added for trying to "quantum hard" KEM algorithms
  - PGP clear signed signatures now support SHA-224
  - Treating absent vs NULL as equivalent can now be configured by a system
    property. By default this is not enabled
  - Mode name checks in Cipher strings should now make sure an improper mode
    name always results in a NoSuchAlgorithmException
  - In line with changes in OpenSSL, the OpenSSLPBKDF now uses UTF8 encoding</changelog>
  <changelog author="fstrba@suse.com" date="1610539200">- Version update to 1.68
  * Defects Fixed:
  - Some BigIntegers utility methods would fail for
    BigInteger.ZERO. This has been fixed.
  - PGPUtil.isKeyRing() was not detecting secret sub-keys in its
    input. This has been fixed.
  - The ASN.1 class, ArchiveTimeStamp was insisting on a value
    for the optional reducedHashTree field. This has been fixed.
  - BCJSSE: Lock against multiple writers - a possible
    synchronization issue has been removed.
  * Additional Features and Functionality
  - BCJSSE: Added support for system property
    com.sun.net.ssl.requireCloseNotify. Note that we are using a
    default value of 'true'.
  - BCJSSE: 'TLSv1.3' is now a supported protocol for both client
    and server. For this release it is only enabled by default for
    the 'TLSv1.3' SSLContext, but can be explicitly enabled using
    'setEnabledProtocols' on an SSLSocket or SSLEngine, or via
    SSLParameters.
  - BCJSSE: Session resumption is now also supported for servers
    in TLS 1.2 and earlier. For this release it is disabled by
    default, and can be enabled by setting the boolean system
    property org.bouncycastle.jsse.server.enableSessionResumption
    to 'true'.
  - The provider RSA-PSS signature names that follow the JCA
    naming convention.
  - FIPS mode for the BCJSSE now enforces namedCurves for any
    presented certificates.
  - PGPSignatureSubpacketGenerator now supports editing of a
    pre-existing sub-packet list.</changelog>
  <changelog author="pmonreal@suse.com" date="1621944000">- Add bouncycastle_getpoms.sh to get pom files from Maven repos</changelog>
  <changelog author="fstrba@suse.com" date="1627387200">- Directory core/docs does not exist</changelog>
  <changelog author="fstrba@suse.com" date="1647518400">- Add glassfish-activation-api dependency so that we can build with
  JDK that does not contain the JavaEE modules</changelog>
  <changelog author="fstrba@suse.com" date="1647604800">- Build with source/target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1648641600">- Build against the standalone JavaEE modules unconditionally</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1650628800">- Version update to 1.71
  * Defects Fixed
  - In line with GPG the PGP API now attempts to preserve
    comments containing non-ascii UTF8 characters.
  - An accidental partial dependency on Java 1.7 has been removed
    from the TLS API.
  - JcaPKIXIdentityBuilder would fail to process File objects
    correctly. This is now fixed.
  - Some byte[] parameters to the CMP API were not being
    defensively cloned to prevent accidental changes. Extra
    defensive cloning has been added.
  - CMS primitives would sometimes convert ASN.1 definite-length
    encodings into indefinite-length encodings. The primitives
    will now try and preserve the original encoding where possible.
  - CMSSignedData.getAttributeCertificates() now properly
    restricts the tag values checked to just 1 (the obsolete
    v1 tag) and 2 (for the more current v2 certificates).
  - BCJSSE now tries to validate a custom KeyManager selection
    in order to catch errors around a key manager ignoring
    key type early.
  - Compressed streams in PGP ending with zero length partial
    packets could cause failure on parsing the OpenPGP API.
    This has been fixed.
  - The fallback mode for JceAsymmetricKeyWrapper/Unwrapper
    would lose track of any algorithm parameters generated
    in the initial attempt. The algorithm parameters are now
    propagated.
  - An accidental regression introduced by a fix for another
    issue in PKIXCertPathReviewer around use of the
    AuthorityKeyIdentifier extension and it failing to match
    a certificate uniquely when the serial number field
    is missing has been fixed.
  - An error was found in the creation of TLS 1.3 Export Keying
    Material which could cause compatibility issues. This has
    been fixed.
  * Additional Features and Functionality
  - Support has been added for OpenPGP regular expression
    signature packets.
  - Support has been added for OpenPGP PolicyURI signature
    packets.
  - A utility method has been added to PGPSecretKeyRing to allow
    for inserting or replacing a PGPPublicKey.
  - The NIST PQC Finalist, Classic McEliece has been added to the
    low level API and the BCPQC provider.
  - The NIST PQC Alternate Candidate, SPHINCS+ has been added to
    the BCPQC provider.
  - The NIST PQC Alternate Candidate, FrodoKEM has been added to
    the low level API and the BCPQC provider.
  - The NIST PQC Finalist, SABER has been added to the low level
    API and the BCPQC provider.
  - KMAC128, KMAC256 has been added to the BC provider (empty
    customization string).
  - TupleHash128, TupleHash256 has been added to the BC provider
    (empty customization string).
  - ParallelHash128, ParallelHash256 has been added to the BC
    provider (empty customization string, block size 1024 bits).
  - Two new properties: "org.bouncycastle.rsa.max_size" (default
    15360) and "org.bouncycastle.ec.fp_max_size" (default 1042)
    have been added to cap the maximum size of RSA and EC keys.
  - RSA modulus are now checked to be provably composite using
    the enhanced MR probable prime test.
  - Imported EC Fp basis values are now validated against the MR
    prime number test before use. The certainty level of the
    prime test can be determined by
    "org.bouncycastle.ec.fp_certainty" (default 100).
  - The BC entropy thread now has a specific name:
    "BC-ENTROPY-GATHERER".
  - Utility methods have been added for joining/merging PGP
    public keys and signatures.
  - Blake3-256 has been added to the BC provider.
  - DTLS: optimisation to delayed handshake hash.
  - Further additions to the ETSI 102 941 support in the ETSI/ITS
    package: certification request, signed message generation and
    verification now supported.
  - CMSSignedDataGenerator now supports the direct generation of
    definite-length data.
  - The NetscapeCertType class now has a hasUsages() method on it
    for querying usage settings on its bit string.
  - Support for additional input has been added for deterministic
    (EC)DSA.
  - The OpenPGP API provides better support for subkey
    generation.
  - BCJSSE: Added boolean system properties
    "org.bouncycastle.jsse.client.dh.disableDefaultSuites" and
    "org.bouncycastle.jsse.server.dh.disableDefaultSuites".
    Default "false". Set to "true" to disable inclusion of DH
    cipher suites in the default cipher suites for client/server
    respectively.
  * Notes
  - The deprecated QTESLA implementation has been removed from
    the BCPQC provider.
  - The submission update to SPHINCS+ has been added. This
    changes the generation of signatures - particularly
    deterministic ones.
- Version update to 1.70
  * Defects Fixed
  - Blake 3 output limit is enforced.
  - The PKCS12 KeyStore was relying on default precedence for its
    key Cipher implementation so was sometimes failing if used
    from the keytool. The KeyStore class now makes sure it uses
    the correct Cipher implementation.
  - Fixed bzip2 compression for empty contents (GH #993).
  - ASN.1: More robust handling of high tag numbers and
    definite-length forms.
  - BCJSSE: Fix a concurrent modification issue in session
    contexts (GH#968).
  - BCJSSE: Don't log sensitive system property values (GH#976).
  - BCJSSE: Fixed a priority issue amongst imperfect-match
    credentials in KeyManager classes.
  - The IES AlgorithmParameters object has been re-written to
    properly support all the variations of IESParameterSpec.
  - getOutputSize() for ECIES has been corrected to avoid
    occassional underestimates.
  - The lack of close() in the ASN.1 Dump command line utility
    was triggering false positives in some code analysis tools. A
    close() call has been added.
  - PGPPublicKey.getBitStrength() now properly recognises EdDSA
    keys.
  * Additional Features and Functionality
  - Missing PGP CRC checksums can now be optionally ignored using
    setDetectMissingCRC() (default false) on ArmoredInputStream.
  - PGPSecretKey.copyWithNewPassword() now has a variant which
    uses USAGE_SHA1 for key protection if a PGPDigestCalculator
    is passed in.
  - PGP ASCII armored data now skips "\t", "\v", and "\f".
  - PKCS12 files with duplicate localKeyId attributes on
    certificates will now have the incorrect attributes filtered
    out, rather than the duplicate causing an exception.
  - PGPObjectFactory will now ignore packets representing
    unrecognised signature versions in the input stream.
  - The X.509 extension generator will now accumulate some
    duplicate X.509 extensions into a single extension where it
    is possible to do so.
  - Removed support for maxXofLen in Kangaroo digest.
  - Ignore marker packets in PGP Public and Secret key ring
    collection.
  - An implementation of LEA has been added to the low-level API.
  - Access, recovery, and direct use for PGP session keys has
    been added to the OpenPGP API for processing encrypted data.
  - A PGPCanonicalizedDataGenerator has been added which converts
    input into canonicalized literal data for text and UTF-8
    mode.
  - A getUserKeyingMaterial() method has been added to the
    KeyAgreeRecipientInformation class.
  - ASN.1: Tagged objects (and parsers) now support all tag
    classes. Special code for ApplicationSpecific has been
    deprecated and re-implemented in terms of TaggedObject.
  - ASN.1: Improved support for nested tagging.
  - ASN.1: Added support for GraphicString, ObjectDescriptor,
    RelativeOID.
  - ASN.1: Added support for constructed BitString encodings,
    including efficient parsing for large values.
  - TLS: Added support for external PSK handshakes.
  - TLS: Check policy restrictions on key size when determining
    cipher suite support.
  - A performance issue in KeccakDigest due to left over debug
    code has been identified and dealt with.
  - BKS key stores can now be used for collecting protected keys
    (note: any attempt to store such a store will cause an
    exception).
  - A method for recovering user keying material has been added
    to KeyAgreeRecipientInformation.
  - Support has been added to the CMS API for SHA-3 based
    PLAIN-ECDSA.
  - The low level BcDefaultDigestProvider now supports the SHAKE
    family of algorithms and the SM3 alogirthm.
  - PGPKeyRingGenerator now supports creation of key-rings with
    direct-key identified keys.
  - The PQC NIST candidate, signature algorithm SPHINCS+ has been
    added to the low-level API.
  - ArmoredInputStream now explicitly checks for a '\n' if in
    crLF mode.
  - Direct support for NotationDataOccurances, Exportable,
    Revocable, IntendedRecipientFingerPrints, and AEAD algorithm
    preferences has been added to PGPSignatureSubpacketVector.
  - Further support has been added for keys described using
    S-Expressions in GPG 2.2.X.
  - Support for OpenPGP Session Keys from the (draft) Stateless
    OpenPGP CLI has been added.
  - Additional checks have been added for PGP marker packets in
    the parsing of PGP objects.
  - A CMSSignedData.addDigestAlgorithm() has been added to allow
    for adding additional digest algorithm identifiers to CMS
    SignedData structures when required.
  - Support has been added to CMS for the LMS/HSS signature
    algorithm.
  - The system property
    "org.bouncycastle.jsse.client.assumeOriginalHostName"
    (default false) has been added for dealing with SNI problems
    related to the host name not being propagate by the JVM.
  - The JcePKCSPBEOutputEncryptorBuilder now supports SCRYPT with
    ciphers that do not have algorithm parameters (e.g. AESKWP).
  - Support is now added for certificates using ETSI TS 103 097,
    "Intelligent Transport Systems (ITS)" in the bcpkix package.
  * Notes.
  - While this release should maintain source code compatibility,
    developers making use of some parts of the ASN.1 library will
    find that some classes need recompiling. Apologies for the
    inconvenience.
- Version update to 1.69
  * Defects Fixed
  - Lightweight and JCA conversion of Ed25519 keys in the PGP API
    could drop the leading byte as it was zero. This has been
    fixed.
  - Marker packets appearing at the start of PGP public key rings
    could cause parsing failure. This has been fixed.
  - ESTService could fail for some valid Content-Type headers.
    This has been fixed.
  - Originator key algorithm parameters were being passed as NULL
    in key agreement recipients. The parameters now reflect the
    value of the parameters in the key's SubjectPublicKeyInfo.
  - ContentType on encapsulated data was not been passed through
    correctly for authenticated and enveloped data. This has been
    fixed.
  - NTRUEncryptionParameters and
    NTRUEncryptionKeyGenerationParameters were not correctly
    cloning the contained message digest. This has been fixed.
  - CertificateFactory.generateCertificates()/generateCRLs()
    would throw an exception if extra data was found at the end
    of a PEM file even if valid objects had been found. Extra
    data is now ignored providing at least one object found.
  - Internal class PKIXCRLUtil could throw a NullPointerException
    for CRLs with an absent nextUpdate field. This has been
    fixed.
  - PGP ArmoredInputStream now fails earlier on malformed
    headers.
  - The McElieceKobaraImaiCipher was randomly throwing "Bad
    Padding: invalid ciphertext" exception while decrypting due
    to leading zeroes been missed during processing of the cipher
    text. This has been fixed.
  - Ed25519 keys being passed in via OpenSSH key spec are now
    validated in the KeyFactory.
  - Blowfish keys are now range checked on cipher construction.
  - In some cases PGPSecretKeyRing was failing to search its
    extraPubKeys list when searching for public keys.
  - The BasicConstraintsValidation class in the BC cert path
    validation tools has improved conformance to RFC 5280.
  - AlgorithmIdentifiers involving message digests now attempt to
    follow the latest conventions for the parameters field
    (basically DER NULL appears less).
  - Fix various conversions and interoperability for XDH and
    EdDSA between BC and SunEC providers.
  - TLS: Prevent attempts to use KeyUpdate mechanism in versions
    before TLS 1.3.
  * Additional Features and Functionality
  - GCM-SIV has been added to the lightweight API and the
    provider.
  - Blake3 has been added to the lightweight API.
  - The OpenSSL PEMParser can now be extended to add specialised
    parsers.
  - Base32 encoding has now been added, the default alphabet is
    from RFC 4648.
  - The KangarooTwelve message digest has been added to the
    lightweight API.
  - An implementation of the two FPE algorithms, FF1 and FF3-1 in
    SP 800-38G has been added to the lightweight API and the JCE
    provider.
  - An implementation of ParallelHash has been added to the
    lightweight API.
  - An implementation of TupleHash has been added to the
    lightweight API.
  - RSA-PSS now supports the use of SHAKE128 and SHAKE256 as the
    mask generation function and digest.
  - ECDSA now supports the use of SHAKE128 and SHAKE256.
  - PGPPBEEncryptedData will now reset the stream if the initial
    checksum fails so another password can be tried.
  - Iterators on public and secret key ring collections in PGP
    now reflect the original order of the public/secret key rings
    they contain.
  - KeyAgreeRecipientInformation now has a getOriginator() method
    for retrieving the underlying orginator information.
  - PGPSignature now has a getDigestPrefix() method for people
    wanting exposure to the signature finger print details.
  - The old BKS-V1 format keystore is now disabled by default. If
    you need to use BKS-V1 for legacy reasons, it can be
    re-enabled by adding: org.bouncycastle.bks.enable_v1=true to
    the java.security file. We would be interested in hearing
    from anyone that needs to do this.
  - PLAIN-ECDSA now supports the SHA3 digests.
  - Some highlevel support for RFC 4998 ERS has been added for
    ArchiveTimeStamp and EvidenceRecord. The new classes are in
    the org.bouncycastle.tsp.ers package.
  - ECIES has now also support SHA256, SHA384, and SHA512.
  - digestAlgorithms filed in CMS SignedData now includes counter
    signature digest algorithms where possible.
  - A new property "org.bouncycastle.jsse.config" has been added
    which can be used to configure the BCJSSE provider when it is
    created using the no-args constructor.
  - In line with changes in OpenSSL 1.1.0,
    OpenSSLPBEParametersGenerator can now be configured with a
    digest.
  - PGPKeyRingGenerator now includes a method for adding a subkey
    with a primary key binding signature.
  - Support for ASN.1 PRIVATE tags has been added.
  - Performance enhancements to Nokeon, AES, GCM, and
    SICBlockCipher.
  - Support for ecoding/decoding McElieceCCA2 keys has been added
    to the PQC API
  - BCJSSE: Added support for jdk.tls.maxCertificateChainLength
    system property (default is 10).
  - BCJSSE: Added support for jdk.tls.maxHandshakeMessageSize
    system property (default is 32768).
  - BCJSSE: Added support for jdk.tls.client.enableCAExtension
    (default is 'false').
  - BCJSSE: Added support for jdk.tls.client.cipherSuites system
    property.
  - BCJSSE: Added support for jdk.tls.server.cipherSuites system
    property.
  - BCJSSE: Extended ALPN support via standard JSSE API to JDK 8
    versions after u251/u252.
  - BCJSSE: Key managers now support EC credentials for use with
    TLS 1.3 ECDSA signature schemes (including brainpool).
  - TLS: Add TLS 1.3 support for brainpool curves per RFC 8734.
  * Notes
  - There is a small API change in the PKIX package to the
    DigestAlgorithmIdentifierFinder interface as a find() method
    that takes an ASN1ObjectIdentifier has been added to it. For
    people wishing to extend their own implementations, see
    DefaultDigestAlgorithmIdentifierFinder for a sample
    implementation.
  - A version of the bcmail API supporting Jakarta Mail has now
    been added (see bcjmail jar).
  - Some work has been done on moving out code that does not need
    to be in the provider jar. This has reduced the size of the
    provider jar and should also make it easier for developers to
    patch the classes involved as they no longer need to be
    signed. bcpkix and bctls are both dependent on the new bcutil
    jar.
- Add build dependencies on
  mvn(jakarta.activation:jakarta.activation-api) and
  mvn(jakarta.mail:jakarta.mail-api)
- Remove unneeded script bouncycastle_getpoms.sh from sources</changelog>
  <changelog author="pmonreal@suse.com" date="1666180800">- Update to version 1.72:
  * Defects Fixed:
  - There were parameter errors in XMSS^MT OIDs for
    XMSSMT_SHA2_40/4_256 and XMSSMT_SHA2_60/3_256. These have
    been fixed.
  - There was an error in Merkle tree construction for the
    Evidence Records (ERS) implementation which could result in
    invalid roots been timestamped. ERS now produces an
    ArchiveTimeStamp for each data object/group with an associated
    reduced hash tree. The reduced hash tree is now calculated as
    a simple path to the root of the tree for each record.
  - OpenPGP will now ignore signatures marked as non-exportable
    on encoding.
  - A tagging calculation error in GCMSIV which could result in
    incorrect tags has been fixed.
  - Issues around Java 17 which could result in failing tests
    have been addressed.
  * Additional Features and Functionality:
  - BCJSSE: TLS 1.3 is now enabled by default where no explicit
    protocols are supplied (e.g. "TLS" or "Default" SSLContext
    algorithms, or SSLContext.getDefault() method).
  - BCJSSE: Rewrite SSLEngine implementation to improve compatibility
    with SunJSSE.
  - BCJSSE: Support export of keying material via extension API.
  - (D)TLS: Add support for 'tls-exporter' channel binding per RFC 9266.
  - (D)TLS (low-level API): By default, only (D)TLS 1.2 and TLS 1.3 are
    offered now. Earlier versions are still supported if explicitly
    enabled. Users may need to check they are offering suitable
    cipher suites for TLS 1.3.
  - (D)TLS (low-level API): Add support for raw public keys per RFC 7250.
  - CryptoServicesRegistrar now has a setServicesConstraints() method
    on it which can be used to selectively turn off algorithms.
  - The NIST PQC Alternate Candidate, Picnic, has been added to the low
    level API and the BCPQC provider.
  - SPHINCS+ has been upgraded to the latest submission, SPHINCS+ 3.1
    and support for Haraka has been added.
  - Evidence records now support timestamp renewal and hash renewal.
  - The SIKE Alternative Candidate NIST Post Quantum Algorithm has
    been added to the low-level PQC API.
  - The NTRU Round 3 Finalist Candidate NIST Post Quantum Algorithm
    has been added to the low-level API and the BCPQC provider.
  - The Falcon Finalist NIST Post Quantum Algorithm has been added to
    the low-level API and the BCPQC provider.
  - The CRYSTALS-Kyber Finalist NIST Post Quantum Algorithm has been
    added to the low-level API and the BCPQC provider.
  - Argon2 Support has been added to the OpenPGP API.
  - XDH IES has now been added to the BC provider.
  - The OpenPGP API now supports AEAD encryption and decryption.
  - The NTRU Prime Alternative Candidate NIST Post Quantum Algorithms
    have been added to the low-level API and the BCPQC provider.
  - The CRYSTALS-Dilithium Finalist NIST Post Quantum Algorithm has
    been added to the low-level API and the BCPQC provider.
  - The BIKE NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - The HQC NIST Post Quantum Alternative/Round-4 Candidate has been
    added to the low-level API and the BCPQC provider.
  - Grain128AEAD has been added to the lightweight API.
  - A fast version of CRC24 has been added for use with the PGP API.
  - Some additional methods and fields have been exposed in the
    PGPOnePassSignature class to (hopefully) make it easier to
    deal with nested signatures.
  - CMP support classes have been updated to reflect the latest
    editions to the the draft RFC "Lightweight Certificate Management
    Protocol (CMP) Profile".
  - Support has been added to the PKCS#12 implementation for the
    Oracle trusted certificate attribute.
  - Performance of our BZIP2 classes has been improved.
  * Notes:
  - Keep in mind the PQC algorithms are still under development and
    we are still at least a year and a half away from published standards.
    This means the algorithms may still change so by all means experiment,
    but do not use the PQC algoritms for anything long term.
  - The legacy "Rainbow" and "McEliece" implementations have been
    removed from the BCPQC provider. The underlying classes are
    still present if required. Other legacy algorithm implementations
    can be found under the org.bouncycastle.pqc.legacy package.
  * Security Notes:
  - The PQC SIKE algorithm is provided for research purposes only.
    It should now be regarded as broken. The SIKE implementation
    will be withdrawn in BC 1.73.
  * Rebase bouncycastle-javadoc.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1682424000">- Update to version 1.73: [jsc#PED-3756]
  * Defects Fixed:
  - BCJSSE: Instantiating a JSSE provider in some contexts could
    cause an AccessControl exception.
  - The EC key pair generator can generate out of range private
    keys when used with SM2. A specific SM2KeyPairGenerator has
    been added to the low-level API and is used by
    KeyPairGenerator.getInstance("SM2", "BC"). The SM2 signer has
    been updated to check for out of range keys as well..
  - The attached signature type byte was still present in Falcon
    signatures as well as the detached signature byte.
  - There was an off-by-one error in engineGetOutputSize() for ECIES.
  - The method for invoking read() internally in BCPGInputStream
    could result in inconsistent behaviour if the class was extended.
  - Fixed a rounding issue with FF1 Format Preserving Encryption
    algorithm for certain radices.
  - Fixed RFC3394WrapEngine handling of 64 bit keys.
  - Internal buffer for blake2sp was too small and could result in
    an ArrayIndexOutOfBoundsException.
  - JCA PSS Signatures using SHAKE128 and SHAKE256 now support
    encoding of algorithm parameters.
  - PKCS10CertificationRequest now checks for empty extension
    parameters.
  - Parsing errors in the processing of PGP Armored Data now throw
    an explicit exception ArmoredInputException.
  - PGP AEAD streams could occassionally be truncated.
  - The ESTService class now supports processing of chunked HTTP data.
  - A constructed ASN.1 OCTET STRING with a single member would
    sometimes be re-encoded as a definite-length OCTET STRING. The
    encoding has been adjusted to preserve the BER status of the object.
  - PKIXCertPathReviewer could fail if the trust anchor was also
    included in the certificate store being used for path analysis.
  - UTF-8 parsing of an array range ignored the provided length.
  - IPAddress has been written to provide stricter checking and
    avoid the use of Integer.parseInt().
  - A Java 7 class snuck into the Java 5 to Java 8 build.
  * Additional Features and Functionality:
  - The Rainbow NIST Post Quantum Round-3 Candidate has been added to
    the low-level API and the BCPQC provider (level 3 and level 5
    parameter sets only).
  - The GeMSS NIST Post Quantum Round-3 Candidate has been added to
    the low-level API.
  - The org.bouncycastle.rsa.max_mr_tests property check has been
    added to allow capping of MR tests done on RSA moduli.
  - Significant performance improvements in PQC algorithms,
    especially BIKE, CMCE, Frodo, HQC, Picnic.
  - EdDSA verification now conforms to the recommendations of Taming
    the many EdDSAs, in particular cofactored verification. As a side
    benefit, Pornin's basis reduction is now used for EdDSA
    verification, giving a significant performance boost.
  - Major performance improvements for Anomalous Binary (Koblitz) Curves.
  - The lightweight Cryptography finalists Ascon, ISAP, Elephant,
    PhotonBeetle, Sparkle, and Xoodyak have been added to the
    light-weight cryptography API.
  - BLAKE2bp and BLAKE2sp have been added to the light-weight
    cryptography API.
  - Support has been added for X.509, Section 9.8, hybrid certificates
    and CRLs using alternate public keys and alternate signatures.
  - The property "org.bouncycastle.emulate.oracle" has been added to
    signal the provider should return algorithm names on some algorithms
    in the same manner as the Oracle JCE provider.
  - An extra replaceSigners method has been added to CMSSignedData
    which allows for specifying the digest algorithm IDs to be used
    in the new CMSSignedData object.
  - Parsing and re-encoding of ASN.1 PEM data has been further
    optimized to prevent unecessary conversions between basic encoding,
    definite length, and DER.
  - Support has been added for KEM ciphers in CMS in accordance with
    draft-ietf-lamps-cms-kemri
  - Support has been added for certEncr in CRMF to allow issuing of
    certificates for KEM public keys.
  - Further speedups have been made to CRC24.
  - GCMParameterSpec constructor caching has been added to improve
    performance for JVMs that have the class available.
  - The PGPEncrytedDataGenerator now supports injecting the session
    key to be used for PGP PBE encrypted data.
  - The CRMF CertificateRequestMessageBuilder now supports optional
    attributes.
  - Improvements to the s calculation in JPAKE.
  - A general purpose PQCOtherInfoGenerator has been added which
    supports all Kyber and NTRU.
  - An implementation of HPKE (RFC 9180 - Hybrid Public Key
    Encryption) has been added to the light-weight cryptography API.
  * Security Advisories:
  - The PQC implementations have now been subject to formal review for
    secret leakage and side channels, there were issues in BIKE, Falcon,
    Frodo, HQC which have now been fixed. Some weak positives also
    showed up in Rainbow, Picnic, SIKE, and GeMSS - for now this last
    set has been ignored as the algorithms will either be updated if
    they reappear in the Signature Round, or deleted, as is already the
    case for SIKE (it is now in the legacy package). Details on the
    group responsible for the testing can be found in the CONTRIBUTORS
    file.
  - For at least some ECIES variants (e.g. when using CBC) there is
    an issue with potential malleability of a nonce (implying silent
    malleability of the plaintext) that must be sent alongside the
    ciphertext but is outside the IES integrity check. For this reason
    the automatic generation of nonces with IED is now disabled and
    they have to be passed in using an IESParameterSpec. The current
    advice is to agree on a nonce between parties and then rely on the
    use of the ephemeral key component to allow the nonce (rather the
    so called nonce) usage to be extended.</changelog>
  <changelog author="pmonreal@suse.com" date="1687176000">- Update to version 1.74: [bsc#1212508, CVE-2023-33201]
  * Defects Fixed:
  - AsconEngine: Fixed a buffering bug when decrypting across
    multiple processBytes calls (ascon128a unaffected).
  - Context based sanity checking on PGP signatures has been added.
  - The ParallelHash clone constructor was not copying all fields.
  - The maximimum number of blocks for CTR/SIC modes was 1 block
    less than it should have been.
  * Additional Features and Functionality:
  - The PGP API now supports wildcard key IDs for public key
    based data encryption.
  - LMS now supports SHA256/192, SHAKE256/192, and SHAKE256/256
    (the additional SP 8000-208 parameter sets).
  - The PGP API now supports V5 and V6 AEAD encryption for
    encrypted data packets.
  - The PGP examples have been updated to reflect key size and algorithm
    changes that have occurred since they were first written (10+ years...).
  - (D)TLS: A new callback 'TlsPeer.notifyConnectionClosed' will be called
    when the connection is closed (including by failure).
  - BCJSSE: Improved logging of connection events and include unique IDs
    in connection-specific log messages.
  - BCJSSE: Server now logs the offered cipher suites when it fails to
    select one.
  - BCJSSE: Added support for SSLParameters namedGroups and
    signatureSchemes properties (can also be used via BCJSSE
    extension API in earlier Java versions).
  - DTLS: The initial handshake re-send time is now configurable by
    overriding 'TlsPeer.getHandshakeResendTimeMillis'.
  - DTLS: Added support for connection IDs per RFC 9146.
  - DTLS: Performance of DTLSVerifier has been improved so that it can
    reasonably be used for all incoming packets.
  - Initial support has been added for A Mechanism for Encoding
    Differences in Paired Certificates.
  - The PGP API now supports parsing, encoding, and fingerprinting
    of V6 EC/EdEC keys.
  - A thread safe verifier API has been added to the PGP API to support
    multi-threaded verification of certifications on keys and user IDs.
  - The number of keys/sub-keys in a PGPKeyRing can now be found by
    calling PGPKeyRing.size().
  - The PQC algorithms LMS/HSS, SPHINCS+, Dilithium, Falcon, and NTRU
    are now supported directly by the BC provider.
  * Notes:
  - The now defunct PQC SIKE algorithm has been removed, this has also
    meant the removal of its resource files so the provider is now quite
    a bit smaller.
  - As a precaution, HC128 now enforces a 128 bit IV, previous behaviour
    for shorter IVs can be supported where required by padding the IV to
    the 128 bits with zero.
  - PGP encrypted data generation now uses integrity protection by default.
    Previous behaviour for encrypted data can be supported where required
    by calling PGPDataEncryptorBuilder.setWithIntegrityPacket(false) when
    data encryption is set up.
  - There are now additional sanity checks in place to prevent accidental
    mis-use of PGPSignature objects. If this change causes any issues, you
    might want to check what your code is up to as there is probably a bug.
  * Security Advisories:
  - CVE-2023-33201: this release fixes an issue with the X509LDAPCertStoreSpi
    where a specially crafted certificate subject could be used to try and
    extract extra information out of an LDAP server with wild-card matthing
    enabled.
  * Rebase bouncycastle-javadoc.patch
  * Add bouncycastle-notests.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1697630400">- Update to version 1.76:
  * Defects Fixed:
  - Service allocation in the provider could fail due to the lack
    of a permission block. This has been fixed.
  - JceKeyFingerPrintCalculator has been generalised for different
    providers by using "SHA-256" for the algorithm string.
  - BCJSSE: Fixed a regression in 1.74 (NullPointerException) that
    prevents a BCJSSE server from negotiating TLSv1.1 or earlier.
  - DTLS: Fixed server support for client_certificate_type extension.
  - Cipher.unwrap() for HQC could fail due to a miscalculation of
    the length of the KEM packet. This has been fixed.
  - There was exposure to a Java 7 method in the Java 5 to Java 8
    BCTLS jar which could cause issues with some TLS 1.2 cipher
    suites running on older JVMs. This is now fixed.
  * Additional Features and Functionality:
  - BCJSSE: Following OpenJDK, finalizers have been removed from
    SSLSocket subclasses. Applications should close sockets and
    not rely on garbage collection.
  - BCJSSE: Added support for boolean system property
    "jdk.tls.client.useCompatibilityMode" (default "true").
  - DTLS: Added server support for session resumption.
  - JcaPKCS10CertificationRequest will now work with EC on the
    OpenJDK provider.
  - TimeStamp generation now supports the SHA3 algorithm set.
  - The SPHINCS+ simple parameters are now fully supported in the
    BCPQC provider.
  - Kyber, Classic McEliece, HQC, and Bike now supported by the
    CRMF/CMS/CMP APIs.
  - Builder classes have been add for PGP ASCII Armored streams
    allowing CRCs and versions to now be optional.
  - An UnknownPacket type has been added to the PGP APIs to allow
    for forwards compatibility with upcoming revisions to the standard.
  * Rebase patch bouncycastle-notests.patch
- Update to version 1.75:
  * Defects Fixed:
  - Several Java 8 method calls were accidentally introduced in
    the Java 5 to Java 8 build. The affected classes have been
    refactored to remove this.
  - (D)TLS: renegotiation after resumption now fixed to avoid
    breaking connection.
  * Notes:
  - The ASN.1 core package has had some dead and retired methods
    cleaned up and removed.</changelog>
  <changelog author="pmonreal@suse.com" date="1701691200">- Update to version 1.77:
  * Defects Fixed:
  - Using an unescaped '=' in an X.500 RDN would result in the
    RDN being truncated silently. The issue is now detected and
    an exception is thrown.
  - asn1.eac.CertificateBody was returning certificateEffectiveDate
    from getCertificateExpirationDate(). This has been fixed to
    return certificateExpirationDate.
  - DTLS: Fixed retransmission in response to re-receipt of an
    aggregated ChangeCipherSpec.
  - (D)TLS: Fixed compliance for supported_groups extension.
    Server will no longer negotiate an EC cipher suite using a
    default curve when the ClientHello includes the supported_groups
    extension but it contains no curves in common with the server.
    Similarly, a DH cipher suite will not be negotiated when the
    ClientHello includes supported_groups, containing at least one
    FFDHE group, but none in common with the server.
  - IllegalStateException was being thrown by Ed25519/Ed448 SignatureSpi.
  - TLS: class annotation issues that could occur between the BC
    provider and the TLS API for the GCMParameterSpec class when
    the jars were loaded on the boot class path have been addressed.
  - Attempt to create an ASN.1 OID from a zero length byte array
    is now caught at construction time.
  - Attempt to create an X.509 extension block which is empty will
    now be blocked cause an exception.
  - IES implementation will now accept a null ParameterSpec if no
    nonce is needed.
  - An internal method in Arrays was failing to construct its
    failure message correctly on an error.
  - HSSKeyPublicParameters.generateLMSContext() would fail for a
    unit depth key.
  * Additional Features and Functionality:
  - BCJSSE: Added org.bouncycastle.jsse.client.omitSigAlgsCertExtension
    and org.bouncycastle.jsse.server.omitSigAlgsCertExtension boolean
    system properties to control (for client and server resp.) whether
    the signature_algorithms_cert extension should be omitted if it
    would be identical to signature_algorithms. Defaults to true, the
    historical behaviour.
  - The low-level HPKE API now allows the sender to specify an
    ephemeral key pair.
  - Support has been added for the delta-certificate requests in line
    with the current Chameleon Cert draft from the IETF.
  - Some accommodation has been added for historical systems to
    accommodate variations in the SHA-1 digest OID for CMS SignedData.
  - TLS: the TLS API will now try "RSAwithDigestAndMFG1" as well as
    the newer RSAPSS algorithm names when used with the JCA.
  - TLS: RSA key exchange cipher suites are now disabled by default.
  - Support has been added for PKCS#10 requests to allow certificates
    using the altSignature/altPublicKey extensions.
  * Notes:
  - Kyber and Dilithium have been updated according to the latest
    draft of the standard. Dilithium-AES and Kyber-AES have now been
    removed. Kyber now produces 256 bit secrets for all parameter sets
    (in line with the draft standard).
  - NTRU has been updated to produce 256 bit secrets in line with Kyber.
  - SPHINCS+ can now be used to generate certificates in line with
    those used by (Open Quantum Safe) OQS.
  - Falcon object idenitifiers are now in line with OQS as well.
  - PQC CMS SignedData now defaults to SHA-256 for signed attributes
    rather than SHAKE-256. This is also a compatibility change, but may
    change further again as the IETF standard for CMS is updated.</changelog>
  <changelog author="pmonreal@suse.com" date="1714392000">- Update to version 1.78: [bsc#1223252, CVE-2024-30171]
  * Security Advisories.
  - CVE-2024-29857: Importing an EC certificate with specially crafted
    F2m parameters can cause high CPU usage during parameter evaluation.
  - CVE-2024-30171: Possible timing based leakage in RSA based handshakes
    due to exception processing eliminated.
  - CVE-2024-30172: Crafted signature and public key can be used to
    trigger an infinite loop in the Ed25519 verification code.
  - CVE-2024-301XX: When endpoint identification is enabled in the BCJSSE
    and an SSL socket is not created with an explicit hostname (as happens
    with HttpsURLConnection), hostname verification could be performed
    against a DNS-resolved IP address. This has been fixed.
  * Defects Fixed:
  - Issues with a dangling weak reference causing intermittent
    NullPointerExceptions in the OcspCache have been fixed.
  - Issues with non-constant time RSA operations in TLS handshakes.
  - Issue with Ed25519, Ed448 signature verification causing intermittent
    infinite loop have been fixed.
  - Issues with non-constant time ML-KEM implementation ("Kyber Slash").
  - Align ML-KEM input validation with FIPS 203 IPD requirements.
  - Make PEM parsing more forgiving of whitespace to align with RFC 7468.
  - Fix CCM length checks with large nonce sizes (n=12, n=13).
  - EAC: Fixed the CertificateBody ASN.1 type to support an optional
    Certification Authority Reference in a Certificate Request.
  - ASN.1: ObjectIdentifier (also Relative OID) parsing has been optimized
    and the contents octets for both types are now limited to 4096 bytes.
  - BCJSSE: Fixed a missing null check on the result of PrivateKey.getEncoded(),
    which could cause issues for HSM RSA keys.
  - BCJSSE: When endpoint identification is enabled and an SSL socket is not
    created with an explicit hostname (as happens with HttpsURLConnection),
    hostname verification could be performed against a DNS-resolved IP address.
  - The missing module import of java.logging to the provider module has been added.
  - GOST ASN.1 public key alg parameters are now compliant with RFC 9215.
  - An off-by-one error in the encoding for EccP256CurvePoint for ITS.
  - PEM Parser now enforces PEM headers to start at the beginning of the line
    to be meaningful.
  * Additional Features and Functionality.
  - An implementation of MLS (RFC 9420 - The Messaging Layer Security Protocol)
    has been added as a new module.
  - NTRU now supports NTRU-HPS4096-1229 and NTRU-HRSS-1373.
  - Improvements to PGP support, including Camellia key wrapping and Curve25519,
    Curve448 key types (including XDH with HKDF).
  - Added initial support for ML-KEM in TLS.
  - Added XWing hybrid KEM construction (X25519 + ML-KEM-768).
  - Introduced initial KEMSpi support (NTRU, SNTRU Prime) for JDK 21+.
  - Introduced initial composite signature support for X509 Certificates.
  - PKCS#12 now supports PKCS12-AES256-AES128, PKCS12-AES256-AES128-GCM,
    PKCS12-DEF-AES256-AES128, and PKCS12-DEF-AES256-AES128-GCM.
  - The default type for the KeyStore.getInstance("PKCS12", "BC") can now be set
    using the org.bouncycastle.pkcs12.default system/security property.
  - The PGP SExpParser will now handle Ed25519 and Ed448 keys.
  - Dilithium and Kyber key encoding updated to latest Draft RFCs
    (draft-ietf-lamps-dilithium-certificates and draft-ietf-lamps-kyber-certificates)
  - Support has been added for encryption key derivation using HKDF in CMS, see
    draft-housley-lamps-cms-cek-hkdf-sha256.
  - X500Name now recognises jurisdiction{C,ST,L} DNs.
  - CertPathValidationContext and CertificatePoliciesValidation now include
    implementations of Memoable.
  - The Composite post-quantum signatures implementation has been updated to the
    latest draft draft-ounsworth-pq-composite-sigs.
  * Full release notes: bouncycastle.org/releasenotes.html#r1rv78
  * Rebase bouncycastle-notests.patch</changelog>
  <changelog author="fstrba@suse.com" date="1714392001">- Update to version 1.78.1
  * Defects Fixed:
  - The new dependency of the the PGP API on the bcutil jar was
    missing from the module jar, the OSGi manifest, and the Maven
    POM. This has been fixed.
  - Missing exports and duplicate imports have been added/removed
    from the OSGi manifests.
  - The OSGi manifests now have the same bundle IDs as 1.77 and
    lock down dependencies to the equivalent variations
  - A check in the X.509 Extensions class preventing the parsing
    of empty extensions has been removed.</changelog>
</package>
<package pkgid="dcf0a94d3e6b2fbf11ae2cfc588545d19c12bbb56f11a3ea3af1ed669bb91c5b" name="bpftool" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.19.3.3"/>
  <changelog author="mrostecki@opensuse.org" date="1557403200">- Initial release</changelog>
  <changelog author="lnussel@suse.de" date="1578484800">- use optflags for building
- build and install man pages</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1683115200">- Add dwarves as build dependency as pahole is called during build
- Fix BTF-to-C converter's padding logic (jsc#PED-3924)
  New patch: libbpf-Fix-BTF-to-C-converter-s-padding-logic.patch</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1693569600">- Update bpftool align with v5.19-based kernel
  + Implement BTFGen (i.e gen min_core_btf command)
  + Support for new btf kind BTF_KIND_DECL_TAG and BTF_KIND_TYPE_TAG
  + Support multiple .rodata/.data internal maps in skeleton
  + Probes for bounded loops, instruction set extensions, and offload-enabled
  + Generate Light skeleton for the kernel
  + Enable libbpf's strict mode by default
  + Show program &amp; link type names
  + Support showing program names declared in BTF
  + Add BPF_TRACE_KPROBE_MULTI to attach type names table
  + Check unprivileged_bpf_disabled against value of 2
  + Use sysfs vmlinux when dumping BTF by ID
- Drop libbpf-Fix-BTF-to-C-converter-s-padding-logic.patch as the fix is now
  included</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1697803200">- Update bpftool align with v6.4-based kernel
  + Support for KIND_RESTRICT in gen min_core_btf command
  + Support BPF_MAP_TYPE_USER_RINGBUF map type
  + Support new cgroup local storage
  + Support printing opcodes and source file references in CFG
  + Probe for memcg-based accounting and bump rlimit only if needed
  + Allow toggling autoattach for bpf prog load|loadall
  + Remove support of --legacy option for bpftool
  + Remove BPF_OBJ_NAME_LEN restriction when looking up bpf program by name</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1705924800">- Update bpftool to align with v6.5-based kernel
  * show map IDs along with struct_ops links
  * show map IDs instead of raw value for map_of_maps types
  * show target_{obj,btf}_id in tracing link info</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1716379200">- Enable showing info for processes holding BPF map/prog/link/btf FDs
  (jsc#PED-8375)</changelog>
</package>
<package pkgid="d07d3641f9832715cf93a9cc898fa22556a1761804e80dc94ca4fe51c457a977" name="bpftool" arch="ppc64le">
  <version epoch="0" ver="6.4.0" rel="150600.19.3.3"/>
  <changelog author="mrostecki@opensuse.org" date="1557403200">- Initial release</changelog>
  <changelog author="lnussel@suse.de" date="1578484800">- use optflags for building
- build and install man pages</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1683115200">- Add dwarves as build dependency as pahole is called during build
- Fix BTF-to-C converter's padding logic (jsc#PED-3924)
  New patch: libbpf-Fix-BTF-to-C-converter-s-padding-logic.patch</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1693569600">- Update bpftool align with v5.19-based kernel
  + Implement BTFGen (i.e gen min_core_btf command)
  + Support for new btf kind BTF_KIND_DECL_TAG and BTF_KIND_TYPE_TAG
  + Support multiple .rodata/.data internal maps in skeleton
  + Probes for bounded loops, instruction set extensions, and offload-enabled
  + Generate Light skeleton for the kernel
  + Enable libbpf's strict mode by default
  + Show program &amp; link type names
  + Support showing program names declared in BTF
  + Add BPF_TRACE_KPROBE_MULTI to attach type names table
  + Check unprivileged_bpf_disabled against value of 2
  + Use sysfs vmlinux when dumping BTF by ID
- Drop libbpf-Fix-BTF-to-C-converter-s-padding-logic.patch as the fix is now
  included</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1697803200">- Update bpftool align with v6.4-based kernel
  + Support for KIND_RESTRICT in gen min_core_btf command
  + Support BPF_MAP_TYPE_USER_RINGBUF map type
  + Support new cgroup local storage
  + Support printing opcodes and source file references in CFG
  + Probe for memcg-based accounting and bump rlimit only if needed
  + Allow toggling autoattach for bpf prog load|loadall
  + Remove support of --legacy option for bpftool
  + Remove BPF_OBJ_NAME_LEN restriction when looking up bpf program by name</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1705924800">- Update bpftool to align with v6.5-based kernel
  * show map IDs along with struct_ops links
  * show map IDs instead of raw value for map_of_maps types
  * show target_{obj,btf}_id in tracing link info</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1716379200">- Enable showing info for processes holding BPF map/prog/link/btf FDs
  (jsc#PED-8375)</changelog>
</package>
<package pkgid="7ccb46bad37466e1d69178a78a300512a743416974650fefd875fd5b1cf80e39" name="bpftool" arch="s390x">
  <version epoch="0" ver="6.4.0" rel="150600.19.3.3"/>
  <changelog author="mrostecki@opensuse.org" date="1557403200">- Initial release</changelog>
  <changelog author="lnussel@suse.de" date="1578484800">- use optflags for building
- build and install man pages</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1683115200">- Add dwarves as build dependency as pahole is called during build
- Fix BTF-to-C converter's padding logic (jsc#PED-3924)
  New patch: libbpf-Fix-BTF-to-C-converter-s-padding-logic.patch</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1693569600">- Update bpftool align with v5.19-based kernel
  + Implement BTFGen (i.e gen min_core_btf command)
  + Support for new btf kind BTF_KIND_DECL_TAG and BTF_KIND_TYPE_TAG
  + Support multiple .rodata/.data internal maps in skeleton
  + Probes for bounded loops, instruction set extensions, and offload-enabled
  + Generate Light skeleton for the kernel
  + Enable libbpf's strict mode by default
  + Show program &amp; link type names
  + Support showing program names declared in BTF
  + Add BPF_TRACE_KPROBE_MULTI to attach type names table
  + Check unprivileged_bpf_disabled against value of 2
  + Use sysfs vmlinux when dumping BTF by ID
- Drop libbpf-Fix-BTF-to-C-converter-s-padding-logic.patch as the fix is now
  included</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1697803200">- Update bpftool align with v6.4-based kernel
  + Support for KIND_RESTRICT in gen min_core_btf command
  + Support BPF_MAP_TYPE_USER_RINGBUF map type
  + Support new cgroup local storage
  + Support printing opcodes and source file references in CFG
  + Probe for memcg-based accounting and bump rlimit only if needed
  + Allow toggling autoattach for bpf prog load|loadall
  + Remove support of --legacy option for bpftool
  + Remove BPF_OBJ_NAME_LEN restriction when looking up bpf program by name</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1705924800">- Update bpftool to align with v6.5-based kernel
  * show map IDs along with struct_ops links
  * show map IDs instead of raw value for map_of_maps types
  * show target_{obj,btf}_id in tracing link info</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1716379200">- Enable showing info for processes holding BPF map/prog/link/btf FDs
  (jsc#PED-8375)</changelog>
</package>
<package pkgid="4fe9a244459f281c3abd13b21602e2aa62ff15418a2257f77d3d491c81f7b56d" name="bpftool" arch="src">
  <version epoch="0" ver="6.4.0" rel="150600.19.3.3"/>
  <changelog author="mrostecki@opensuse.org" date="1557403200">- Initial release</changelog>
  <changelog author="lnussel@suse.de" date="1578484800">- use optflags for building
- build and install man pages</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1683115200">- Add dwarves as build dependency as pahole is called during build
- Fix BTF-to-C converter's padding logic (jsc#PED-3924)
  New patch: libbpf-Fix-BTF-to-C-converter-s-padding-logic.patch</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1693569600">- Update bpftool align with v5.19-based kernel
  + Implement BTFGen (i.e gen min_core_btf command)
  + Support for new btf kind BTF_KIND_DECL_TAG and BTF_KIND_TYPE_TAG
  + Support multiple .rodata/.data internal maps in skeleton
  + Probes for bounded loops, instruction set extensions, and offload-enabled
  + Generate Light skeleton for the kernel
  + Enable libbpf's strict mode by default
  + Show program &amp; link type names
  + Support showing program names declared in BTF
  + Add BPF_TRACE_KPROBE_MULTI to attach type names table
  + Check unprivileged_bpf_disabled against value of 2
  + Use sysfs vmlinux when dumping BTF by ID
- Drop libbpf-Fix-BTF-to-C-converter-s-padding-logic.patch as the fix is now
  included</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1697803200">- Update bpftool align with v6.4-based kernel
  + Support for KIND_RESTRICT in gen min_core_btf command
  + Support BPF_MAP_TYPE_USER_RINGBUF map type
  + Support new cgroup local storage
  + Support printing opcodes and source file references in CFG
  + Probe for memcg-based accounting and bump rlimit only if needed
  + Allow toggling autoattach for bpf prog load|loadall
  + Remove support of --legacy option for bpftool
  + Remove BPF_OBJ_NAME_LEN restriction when looking up bpf program by name</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1705924800">- Update bpftool to align with v6.5-based kernel
  * show map IDs along with struct_ops links
  * show map IDs instead of raw value for map_of_maps types
  * show target_{obj,btf}_id in tracing link info</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1716379200">- Enable showing info for processes holding BPF map/prog/link/btf FDs
  (jsc#PED-8375)</changelog>
</package>
<package pkgid="c4da7c84826b7addba3974cf3dd18142391cf1f7c9222c29f1f63c035174e61d" name="bpftool" arch="x86_64">
  <version epoch="0" ver="6.4.0" rel="150600.19.3.3"/>
  <changelog author="mrostecki@opensuse.org" date="1557403200">- Initial release</changelog>
  <changelog author="lnussel@suse.de" date="1578484800">- use optflags for building
- build and install man pages</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1683115200">- Add dwarves as build dependency as pahole is called during build
- Fix BTF-to-C converter's padding logic (jsc#PED-3924)
  New patch: libbpf-Fix-BTF-to-C-converter-s-padding-logic.patch</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1693569600">- Update bpftool align with v5.19-based kernel
  + Implement BTFGen (i.e gen min_core_btf command)
  + Support for new btf kind BTF_KIND_DECL_TAG and BTF_KIND_TYPE_TAG
  + Support multiple .rodata/.data internal maps in skeleton
  + Probes for bounded loops, instruction set extensions, and offload-enabled
  + Generate Light skeleton for the kernel
  + Enable libbpf's strict mode by default
  + Show program &amp; link type names
  + Support showing program names declared in BTF
  + Add BPF_TRACE_KPROBE_MULTI to attach type names table
  + Check unprivileged_bpf_disabled against value of 2
  + Use sysfs vmlinux when dumping BTF by ID
- Drop libbpf-Fix-BTF-to-C-converter-s-padding-logic.patch as the fix is now
  included</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1697803200">- Update bpftool align with v6.4-based kernel
  + Support for KIND_RESTRICT in gen min_core_btf command
  + Support BPF_MAP_TYPE_USER_RINGBUF map type
  + Support new cgroup local storage
  + Support printing opcodes and source file references in CFG
  + Probe for memcg-based accounting and bump rlimit only if needed
  + Allow toggling autoattach for bpf prog load|loadall
  + Remove support of --legacy option for bpftool
  + Remove BPF_OBJ_NAME_LEN restriction when looking up bpf program by name</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1705924800">- Update bpftool to align with v6.5-based kernel
  * show map IDs along with struct_ops links
  * show map IDs instead of raw value for map_of_maps types
  * show target_{obj,btf}_id in tracing link info</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1716379200">- Enable showing info for processes holding BPF map/prog/link/btf FDs
  (jsc#PED-8375)</changelog>
</package>
<package pkgid="8a03473b243e062804c962a7f4ed05f2f8c2cb5642cb27de9fc7080caedb3fe0" name="bsdtar" arch="aarch64">
  <version epoch="0" ver="3.7.2" rel="150600.3.3.1"/>
  <changelog author="idonmez@suse.com" date="1581508800">- Update to version 3.4.2
  New features:
  * support for atomic file extraction (bsdtar -x --safe-writes) (#1289)
  * support for mbed TLS (PolarSSL) (#1301)
  Important bugfixes:
  * security fixes in RAR5 reader (#1280 #1326)
  * compression buffer fix in XAR writer (#1317)
  * fix uname and gname longer than 32 characters in PAX writer (#1319)
  * fix segfault when archiving hard links in ISO9660 and XAR writers (#1325)
  * fix support for extracting 7z archive entries with Delta filter (#987)</changelog>
  <changelog author="idonmez@suse.com" date="1582027200">- Switch back to cmake build now that cmake-mini exists, this will
  no longer create a build-cycle.</changelog>
  <changelog author="idonmez@suse.com" date="1589976000">- Update to version 3.4.3
  * support for pzstd compressed files (#1357)
  * support for RHT.security.selinux tar extended attribute (#1348)
  * various zstd fixes and improvements (#1342 #1352 #1359)
  * child process handling fixes (#1372)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1599480000">- fix build with binutils submitted to Factory, adding upstream
  libarchive-3.4.3-fix_test_write_disk_secure.patch</changelog>
  <changelog author="idonmez@suse.com" date="1606824000">- Update to version 3.5.0
  New features:
  * mtree digest reader support (#1347)
  * completed support for UTF-8 encoding conversion (#1389)
  * minor API enhancements (#1258, #1405)
  * support for system extended attributes (#1409)
  * support for decompression of symbolic links in zipx archives (#1435)
  Important bugfixes
  * fixed extraction of archives with hard links pointing to itself (#1381)
  * cpio fixes (#1387, #1388)
  * fixed uninitialized size in rar5_read_data (#1408)
  * fixed memory leaks in error case of archive_write_open() functions (#1456)
- Drop libarchive-3.4.3-fix_test_write_disk_secure.patch, fixed upstream.</changelog>
  <changelog author="dmueller@suse.com" date="1609934400">- update to 3.5.1:
  * various compilation fixes (#1461, #1462, #1463, #1464)
  * fixed undefined behavior in a function in warc reader (#1465)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1631448000">- Fix CVE-2021-23177, extracting a symlink with ACLs modifies ACLs of target
  (CVE-2021-23177, bsc#1192425)
  * CVE-2021-23177.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1634817600">- Fix CVE-2021-31566, modifies file flags of symlink target
  (CVE-2021-31566, bsc#1192426.patch)
  CVE-2021-31566.patch
- Fix bsc#1192427, processing fixup entries may follow symbolic links
  bsc1192427.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1636286400">- update to 3.5.2:
  * CPIO: Support for PWB and v7 binary cpio formats
  * ZIP reader: Support of deflate algorithm in symbolic link decompression
  * security: fix handling of symbolic link ACLs on Linux (boo#1192425)
  * security: never follow symlinks when setting file flags on Linux (boo#1192426)
  * security: do not follow symlinks when processing the fixup list (boo#1192427)
  * fix extraction of hardlinks to symlinks
  * 7zip reader and writer fixes
  * RAR reader fixes
  * ZIP reader: fix excessive read for padded zip
  * CAB reader: fix double free
  * handle short writes from archive_write_callback
- Drop upstream mereged:
  * CVE-2021-23177.patch
  * CVE-2021-31566.patch
  * bsc1192427.patch</changelog>
  <changelog author="adrian@suse.de" date="1638187200">- fix permission settings on following symlinks (fix-following-symlinks.patch)
  this fixes also wrong permissions of /var/tmp in factory systems
  CVE-2021-31566</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645617600">- Fix CVE-2021-36976 use-after-free in copy_string
  (CVE-2021-36976, bsc#1188572)
  * fix-CVE-2021-36976.patch
- The following issues have already been fixed in this package but
  weren't previously mentioned in the changes file:
  CVE-2017-5601, bsc#1022528, bsc#1189528</changelog>
  <changelog author="rpm@fthiessen.de" date="1645704000">- Update to 3.6.0
  * Fix use-after-free bug (CVE-2021-36976)
  * tar: new option "--no-read-sparse"
  * tar: threads support for zstd
  * RAR reader: filter support
  * RAR5 reader: self-extracting archive support
  * ZIP reader: zstd decompression support
  * tar: respect "--ignore-zeros" in c, r and u modes
  * reduced size of application binaries
  * internal code optimizations
- Drop upstream merged:
  * fix-following-symlinks.patch
  * fix-CVE-2021-36976.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1649332800">- Fix CVE-2022-26280 out-of-bounds read via the component zipx_lzma_alone_init
  (CVE-2022-26280, bsc#1197634)
  * fix-CVE-2022-26280.patch</changelog>
  <changelog author="dmueller@suse.com" date="1649419200">- update to 3.6.1:
  * 7zip reader: fix PPMD read beyond boundary (#1671)
  * ZIP reader: fix possible out of bounds read (OSS-Fuzz 38766 #1672)
  * ISO reader: fix possible heap buffer overflow in read_children() (OSS-Fuzz 38764, #1685)
  * RARv4 redaer: fix multiple issues in RARv4 filter code (introduced in libarchive 3.6.0)
  * fix heap use after free in archive_read_format_rar_read_data() (OSS-Fuzz 44547, 52efa50)
  * fix null dereference in read_data_compressed() (OSS-Fuzz 44843, 1271f77)
  * fix heap user after free in run_filters() (OSS-Fuzz 46279, #1715)
- Drop upstream merged fix-CVE-2022-26280.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1669118400">- Fix CVE-2022-36227, Handle a calloc returning NULL
  (CVE-2022-36227, bsc#1205629)
  * CVE-2022-36227.patch</changelog>
  <changelog author="dmueller@suse.com" date="1671796800">- update to 3.6.2 (bsc#1205629, CVE-2022-36227)
  * NULL pointer dereference vulnerability in archive_write.c
  * include ZSTD in Windows builds (#1688)
  * SSL fixes on Windows (#1714, #1723, #1724)
  * rar5 reader: fix possible garbled output with bsdtar -O (#1745)
  * mtree reader: support reading mtree files with tabs (#1783)
  * various small fixes for issues found by CodeQL
- Drop upstream merged CVE-2022-36227.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1690200000">- update to 3.7.0
  * bsdunzip port from FreeBSD
  * fix 2 year 2038 issues</changelog>
  <changelog author="dmueller@suse.com" date="1694952000">- update to 3.7.2:
  * Multiple vulnerabilities have been fixed in the PAX writer
  * bsdunzip(1) now correctly handles arguments following an
  - x after the zipfile
  * zstd filter now supports the "long" write option
  * SEGV and stack buffer overflow in verbose mode of cpio
  * bsdunzip updated to match latest upstream code
  * miscellaneous functional bugfixes</changelog>
  <changelog author="dmueller@suse.com" date="1703851200">- skip write tests on 32bit, they OOM</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1718193600">- Fix CVE-2024-20696, heap based out-of-bounds write
  (CVE-2024-20696, bsc#1225971)
  * CVE-2024-20696.patch
- Fix CVE-2024-20697, Out of bounds Remote Code Execution Vulnerability
  (CVE-2024-20697, bsc#1225972)
  * CVE-2024-20697.patch</changelog>
</package>
<package pkgid="f5ee32f1eea6fa390041562f89cc2f5ec1d7d91649ed315cb2c8b11469a7042d" name="bsdtar" arch="ppc64le">
  <version epoch="0" ver="3.7.2" rel="150600.3.3.1"/>
  <changelog author="idonmez@suse.com" date="1581508800">- Update to version 3.4.2
  New features:
  * support for atomic file extraction (bsdtar -x --safe-writes) (#1289)
  * support for mbed TLS (PolarSSL) (#1301)
  Important bugfixes:
  * security fixes in RAR5 reader (#1280 #1326)
  * compression buffer fix in XAR writer (#1317)
  * fix uname and gname longer than 32 characters in PAX writer (#1319)
  * fix segfault when archiving hard links in ISO9660 and XAR writers (#1325)
  * fix support for extracting 7z archive entries with Delta filter (#987)</changelog>
  <changelog author="idonmez@suse.com" date="1582027200">- Switch back to cmake build now that cmake-mini exists, this will
  no longer create a build-cycle.</changelog>
  <changelog author="idonmez@suse.com" date="1589976000">- Update to version 3.4.3
  * support for pzstd compressed files (#1357)
  * support for RHT.security.selinux tar extended attribute (#1348)
  * various zstd fixes and improvements (#1342 #1352 #1359)
  * child process handling fixes (#1372)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1599480000">- fix build with binutils submitted to Factory, adding upstream
  libarchive-3.4.3-fix_test_write_disk_secure.patch</changelog>
  <changelog author="idonmez@suse.com" date="1606824000">- Update to version 3.5.0
  New features:
  * mtree digest reader support (#1347)
  * completed support for UTF-8 encoding conversion (#1389)
  * minor API enhancements (#1258, #1405)
  * support for system extended attributes (#1409)
  * support for decompression of symbolic links in zipx archives (#1435)
  Important bugfixes
  * fixed extraction of archives with hard links pointing to itself (#1381)
  * cpio fixes (#1387, #1388)
  * fixed uninitialized size in rar5_read_data (#1408)
  * fixed memory leaks in error case of archive_write_open() functions (#1456)
- Drop libarchive-3.4.3-fix_test_write_disk_secure.patch, fixed upstream.</changelog>
  <changelog author="dmueller@suse.com" date="1609934400">- update to 3.5.1:
  * various compilation fixes (#1461, #1462, #1463, #1464)
  * fixed undefined behavior in a function in warc reader (#1465)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1631448000">- Fix CVE-2021-23177, extracting a symlink with ACLs modifies ACLs of target
  (CVE-2021-23177, bsc#1192425)
  * CVE-2021-23177.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1634817600">- Fix CVE-2021-31566, modifies file flags of symlink target
  (CVE-2021-31566, bsc#1192426.patch)
  CVE-2021-31566.patch
- Fix bsc#1192427, processing fixup entries may follow symbolic links
  bsc1192427.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1636286400">- update to 3.5.2:
  * CPIO: Support for PWB and v7 binary cpio formats
  * ZIP reader: Support of deflate algorithm in symbolic link decompression
  * security: fix handling of symbolic link ACLs on Linux (boo#1192425)
  * security: never follow symlinks when setting file flags on Linux (boo#1192426)
  * security: do not follow symlinks when processing the fixup list (boo#1192427)
  * fix extraction of hardlinks to symlinks
  * 7zip reader and writer fixes
  * RAR reader fixes
  * ZIP reader: fix excessive read for padded zip
  * CAB reader: fix double free
  * handle short writes from archive_write_callback
- Drop upstream mereged:
  * CVE-2021-23177.patch
  * CVE-2021-31566.patch
  * bsc1192427.patch</changelog>
  <changelog author="adrian@suse.de" date="1638187200">- fix permission settings on following symlinks (fix-following-symlinks.patch)
  this fixes also wrong permissions of /var/tmp in factory systems
  CVE-2021-31566</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645617600">- Fix CVE-2021-36976 use-after-free in copy_string
  (CVE-2021-36976, bsc#1188572)
  * fix-CVE-2021-36976.patch
- The following issues have already been fixed in this package but
  weren't previously mentioned in the changes file:
  CVE-2017-5601, bsc#1022528, bsc#1189528</changelog>
  <changelog author="rpm@fthiessen.de" date="1645704000">- Update to 3.6.0
  * Fix use-after-free bug (CVE-2021-36976)
  * tar: new option "--no-read-sparse"
  * tar: threads support for zstd
  * RAR reader: filter support
  * RAR5 reader: self-extracting archive support
  * ZIP reader: zstd decompression support
  * tar: respect "--ignore-zeros" in c, r and u modes
  * reduced size of application binaries
  * internal code optimizations
- Drop upstream merged:
  * fix-following-symlinks.patch
  * fix-CVE-2021-36976.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1649332800">- Fix CVE-2022-26280 out-of-bounds read via the component zipx_lzma_alone_init
  (CVE-2022-26280, bsc#1197634)
  * fix-CVE-2022-26280.patch</changelog>
  <changelog author="dmueller@suse.com" date="1649419200">- update to 3.6.1:
  * 7zip reader: fix PPMD read beyond boundary (#1671)
  * ZIP reader: fix possible out of bounds read (OSS-Fuzz 38766 #1672)
  * ISO reader: fix possible heap buffer overflow in read_children() (OSS-Fuzz 38764, #1685)
  * RARv4 redaer: fix multiple issues in RARv4 filter code (introduced in libarchive 3.6.0)
  * fix heap use after free in archive_read_format_rar_read_data() (OSS-Fuzz 44547, 52efa50)
  * fix null dereference in read_data_compressed() (OSS-Fuzz 44843, 1271f77)
  * fix heap user after free in run_filters() (OSS-Fuzz 46279, #1715)
- Drop upstream merged fix-CVE-2022-26280.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1669118400">- Fix CVE-2022-36227, Handle a calloc returning NULL
  (CVE-2022-36227, bsc#1205629)
  * CVE-2022-36227.patch</changelog>
  <changelog author="dmueller@suse.com" date="1671796800">- update to 3.6.2 (bsc#1205629, CVE-2022-36227)
  * NULL pointer dereference vulnerability in archive_write.c
  * include ZSTD in Windows builds (#1688)
  * SSL fixes on Windows (#1714, #1723, #1724)
  * rar5 reader: fix possible garbled output with bsdtar -O (#1745)
  * mtree reader: support reading mtree files with tabs (#1783)
  * various small fixes for issues found by CodeQL
- Drop upstream merged CVE-2022-36227.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1690200000">- update to 3.7.0
  * bsdunzip port from FreeBSD
  * fix 2 year 2038 issues</changelog>
  <changelog author="dmueller@suse.com" date="1694952000">- update to 3.7.2:
  * Multiple vulnerabilities have been fixed in the PAX writer
  * bsdunzip(1) now correctly handles arguments following an
  - x after the zipfile
  * zstd filter now supports the "long" write option
  * SEGV and stack buffer overflow in verbose mode of cpio
  * bsdunzip updated to match latest upstream code
  * miscellaneous functional bugfixes</changelog>
  <changelog author="dmueller@suse.com" date="1703851200">- skip write tests on 32bit, they OOM</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1718193600">- Fix CVE-2024-20696, heap based out-of-bounds write
  (CVE-2024-20696, bsc#1225971)
  * CVE-2024-20696.patch
- Fix CVE-2024-20697, Out of bounds Remote Code Execution Vulnerability
  (CVE-2024-20697, bsc#1225972)
  * CVE-2024-20697.patch</changelog>
</package>
<package pkgid="c95117259e254e986622834d0f12a627b8676d5bbcb39b1d5ac7f39f1c8fa16b" name="bsdtar" arch="s390x">
  <version epoch="0" ver="3.7.2" rel="150600.3.3.1"/>
  <changelog author="idonmez@suse.com" date="1581508800">- Update to version 3.4.2
  New features:
  * support for atomic file extraction (bsdtar -x --safe-writes) (#1289)
  * support for mbed TLS (PolarSSL) (#1301)
  Important bugfixes:
  * security fixes in RAR5 reader (#1280 #1326)
  * compression buffer fix in XAR writer (#1317)
  * fix uname and gname longer than 32 characters in PAX writer (#1319)
  * fix segfault when archiving hard links in ISO9660 and XAR writers (#1325)
  * fix support for extracting 7z archive entries with Delta filter (#987)</changelog>
  <changelog author="idonmez@suse.com" date="1582027200">- Switch back to cmake build now that cmake-mini exists, this will
  no longer create a build-cycle.</changelog>
  <changelog author="idonmez@suse.com" date="1589976000">- Update to version 3.4.3
  * support for pzstd compressed files (#1357)
  * support for RHT.security.selinux tar extended attribute (#1348)
  * various zstd fixes and improvements (#1342 #1352 #1359)
  * child process handling fixes (#1372)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1599480000">- fix build with binutils submitted to Factory, adding upstream
  libarchive-3.4.3-fix_test_write_disk_secure.patch</changelog>
  <changelog author="idonmez@suse.com" date="1606824000">- Update to version 3.5.0
  New features:
  * mtree digest reader support (#1347)
  * completed support for UTF-8 encoding conversion (#1389)
  * minor API enhancements (#1258, #1405)
  * support for system extended attributes (#1409)
  * support for decompression of symbolic links in zipx archives (#1435)
  Important bugfixes
  * fixed extraction of archives with hard links pointing to itself (#1381)
  * cpio fixes (#1387, #1388)
  * fixed uninitialized size in rar5_read_data (#1408)
  * fixed memory leaks in error case of archive_write_open() functions (#1456)
- Drop libarchive-3.4.3-fix_test_write_disk_secure.patch, fixed upstream.</changelog>
  <changelog author="dmueller@suse.com" date="1609934400">- update to 3.5.1:
  * various compilation fixes (#1461, #1462, #1463, #1464)
  * fixed undefined behavior in a function in warc reader (#1465)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1631448000">- Fix CVE-2021-23177, extracting a symlink with ACLs modifies ACLs of target
  (CVE-2021-23177, bsc#1192425)
  * CVE-2021-23177.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1634817600">- Fix CVE-2021-31566, modifies file flags of symlink target
  (CVE-2021-31566, bsc#1192426.patch)
  CVE-2021-31566.patch
- Fix bsc#1192427, processing fixup entries may follow symbolic links
  bsc1192427.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1636286400">- update to 3.5.2:
  * CPIO: Support for PWB and v7 binary cpio formats
  * ZIP reader: Support of deflate algorithm in symbolic link decompression
  * security: fix handling of symbolic link ACLs on Linux (boo#1192425)
  * security: never follow symlinks when setting file flags on Linux (boo#1192426)
  * security: do not follow symlinks when processing the fixup list (boo#1192427)
  * fix extraction of hardlinks to symlinks
  * 7zip reader and writer fixes
  * RAR reader fixes
  * ZIP reader: fix excessive read for padded zip
  * CAB reader: fix double free
  * handle short writes from archive_write_callback
- Drop upstream mereged:
  * CVE-2021-23177.patch
  * CVE-2021-31566.patch
  * bsc1192427.patch</changelog>
  <changelog author="adrian@suse.de" date="1638187200">- fix permission settings on following symlinks (fix-following-symlinks.patch)
  this fixes also wrong permissions of /var/tmp in factory systems
  CVE-2021-31566</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645617600">- Fix CVE-2021-36976 use-after-free in copy_string
  (CVE-2021-36976, bsc#1188572)
  * fix-CVE-2021-36976.patch
- The following issues have already been fixed in this package but
  weren't previously mentioned in the changes file:
  CVE-2017-5601, bsc#1022528, bsc#1189528</changelog>
  <changelog author="rpm@fthiessen.de" date="1645704000">- Update to 3.6.0
  * Fix use-after-free bug (CVE-2021-36976)
  * tar: new option "--no-read-sparse"
  * tar: threads support for zstd
  * RAR reader: filter support
  * RAR5 reader: self-extracting archive support
  * ZIP reader: zstd decompression support
  * tar: respect "--ignore-zeros" in c, r and u modes
  * reduced size of application binaries
  * internal code optimizations
- Drop upstream merged:
  * fix-following-symlinks.patch
  * fix-CVE-2021-36976.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1649332800">- Fix CVE-2022-26280 out-of-bounds read via the component zipx_lzma_alone_init
  (CVE-2022-26280, bsc#1197634)
  * fix-CVE-2022-26280.patch</changelog>
  <changelog author="dmueller@suse.com" date="1649419200">- update to 3.6.1:
  * 7zip reader: fix PPMD read beyond boundary (#1671)
  * ZIP reader: fix possible out of bounds read (OSS-Fuzz 38766 #1672)
  * ISO reader: fix possible heap buffer overflow in read_children() (OSS-Fuzz 38764, #1685)
  * RARv4 redaer: fix multiple issues in RARv4 filter code (introduced in libarchive 3.6.0)
  * fix heap use after free in archive_read_format_rar_read_data() (OSS-Fuzz 44547, 52efa50)
  * fix null dereference in read_data_compressed() (OSS-Fuzz 44843, 1271f77)
  * fix heap user after free in run_filters() (OSS-Fuzz 46279, #1715)
- Drop upstream merged fix-CVE-2022-26280.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1669118400">- Fix CVE-2022-36227, Handle a calloc returning NULL
  (CVE-2022-36227, bsc#1205629)
  * CVE-2022-36227.patch</changelog>
  <changelog author="dmueller@suse.com" date="1671796800">- update to 3.6.2 (bsc#1205629, CVE-2022-36227)
  * NULL pointer dereference vulnerability in archive_write.c
  * include ZSTD in Windows builds (#1688)
  * SSL fixes on Windows (#1714, #1723, #1724)
  * rar5 reader: fix possible garbled output with bsdtar -O (#1745)
  * mtree reader: support reading mtree files with tabs (#1783)
  * various small fixes for issues found by CodeQL
- Drop upstream merged CVE-2022-36227.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1690200000">- update to 3.7.0
  * bsdunzip port from FreeBSD
  * fix 2 year 2038 issues</changelog>
  <changelog author="dmueller@suse.com" date="1694952000">- update to 3.7.2:
  * Multiple vulnerabilities have been fixed in the PAX writer
  * bsdunzip(1) now correctly handles arguments following an
  - x after the zipfile
  * zstd filter now supports the "long" write option
  * SEGV and stack buffer overflow in verbose mode of cpio
  * bsdunzip updated to match latest upstream code
  * miscellaneous functional bugfixes</changelog>
  <changelog author="dmueller@suse.com" date="1703851200">- skip write tests on 32bit, they OOM</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1718193600">- Fix CVE-2024-20696, heap based out-of-bounds write
  (CVE-2024-20696, bsc#1225971)
  * CVE-2024-20696.patch
- Fix CVE-2024-20697, Out of bounds Remote Code Execution Vulnerability
  (CVE-2024-20697, bsc#1225972)
  * CVE-2024-20697.patch</changelog>
</package>
<package pkgid="8b600888f960721ddbcee096bc9e3783eee1f2954b96bc1de93ae7f8792d2e0d" name="bsdtar" arch="x86_64">
  <version epoch="0" ver="3.7.2" rel="150600.3.3.1"/>
  <changelog author="idonmez@suse.com" date="1581508800">- Update to version 3.4.2
  New features:
  * support for atomic file extraction (bsdtar -x --safe-writes) (#1289)
  * support for mbed TLS (PolarSSL) (#1301)
  Important bugfixes:
  * security fixes in RAR5 reader (#1280 #1326)
  * compression buffer fix in XAR writer (#1317)
  * fix uname and gname longer than 32 characters in PAX writer (#1319)
  * fix segfault when archiving hard links in ISO9660 and XAR writers (#1325)
  * fix support for extracting 7z archive entries with Delta filter (#987)</changelog>
  <changelog author="idonmez@suse.com" date="1582027200">- Switch back to cmake build now that cmake-mini exists, this will
  no longer create a build-cycle.</changelog>
  <changelog author="idonmez@suse.com" date="1589976000">- Update to version 3.4.3
  * support for pzstd compressed files (#1357)
  * support for RHT.security.selinux tar extended attribute (#1348)
  * various zstd fixes and improvements (#1342 #1352 #1359)
  * child process handling fixes (#1372)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1599480000">- fix build with binutils submitted to Factory, adding upstream
  libarchive-3.4.3-fix_test_write_disk_secure.patch</changelog>
  <changelog author="idonmez@suse.com" date="1606824000">- Update to version 3.5.0
  New features:
  * mtree digest reader support (#1347)
  * completed support for UTF-8 encoding conversion (#1389)
  * minor API enhancements (#1258, #1405)
  * support for system extended attributes (#1409)
  * support for decompression of symbolic links in zipx archives (#1435)
  Important bugfixes
  * fixed extraction of archives with hard links pointing to itself (#1381)
  * cpio fixes (#1387, #1388)
  * fixed uninitialized size in rar5_read_data (#1408)
  * fixed memory leaks in error case of archive_write_open() functions (#1456)
- Drop libarchive-3.4.3-fix_test_write_disk_secure.patch, fixed upstream.</changelog>
  <changelog author="dmueller@suse.com" date="1609934400">- update to 3.5.1:
  * various compilation fixes (#1461, #1462, #1463, #1464)
  * fixed undefined behavior in a function in warc reader (#1465)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1631448000">- Fix CVE-2021-23177, extracting a symlink with ACLs modifies ACLs of target
  (CVE-2021-23177, bsc#1192425)
  * CVE-2021-23177.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1634817600">- Fix CVE-2021-31566, modifies file flags of symlink target
  (CVE-2021-31566, bsc#1192426.patch)
  CVE-2021-31566.patch
- Fix bsc#1192427, processing fixup entries may follow symbolic links
  bsc1192427.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1636286400">- update to 3.5.2:
  * CPIO: Support for PWB and v7 binary cpio formats
  * ZIP reader: Support of deflate algorithm in symbolic link decompression
  * security: fix handling of symbolic link ACLs on Linux (boo#1192425)
  * security: never follow symlinks when setting file flags on Linux (boo#1192426)
  * security: do not follow symlinks when processing the fixup list (boo#1192427)
  * fix extraction of hardlinks to symlinks
  * 7zip reader and writer fixes
  * RAR reader fixes
  * ZIP reader: fix excessive read for padded zip
  * CAB reader: fix double free
  * handle short writes from archive_write_callback
- Drop upstream mereged:
  * CVE-2021-23177.patch
  * CVE-2021-31566.patch
  * bsc1192427.patch</changelog>
  <changelog author="adrian@suse.de" date="1638187200">- fix permission settings on following symlinks (fix-following-symlinks.patch)
  this fixes also wrong permissions of /var/tmp in factory systems
  CVE-2021-31566</changelog>
  <changelog author="danilo.spinella@suse.com" date="1645617600">- Fix CVE-2021-36976 use-after-free in copy_string
  (CVE-2021-36976, bsc#1188572)
  * fix-CVE-2021-36976.patch
- The following issues have already been fixed in this package but
  weren't previously mentioned in the changes file:
  CVE-2017-5601, bsc#1022528, bsc#1189528</changelog>
  <changelog author="rpm@fthiessen.de" date="1645704000">- Update to 3.6.0
  * Fix use-after-free bug (CVE-2021-36976)
  * tar: new option "--no-read-sparse"
  * tar: threads support for zstd
  * RAR reader: filter support
  * RAR5 reader: self-extracting archive support
  * ZIP reader: zstd decompression support
  * tar: respect "--ignore-zeros" in c, r and u modes
  * reduced size of application binaries
  * internal code optimizations
- Drop upstream merged:
  * fix-following-symlinks.patch
  * fix-CVE-2021-36976.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1649332800">- Fix CVE-2022-26280 out-of-bounds read via the component zipx_lzma_alone_init
  (CVE-2022-26280, bsc#1197634)
  * fix-CVE-2022-26280.patch</changelog>
  <changelog author="dmueller@suse.com" date="1649419200">- update to 3.6.1:
  * 7zip reader: fix PPMD read beyond boundary (#1671)
  * ZIP reader: fix possible out of bounds read (OSS-Fuzz 38766 #1672)
  * ISO reader: fix possible heap buffer overflow in read_children() (OSS-Fuzz 38764, #1685)
  * RARv4 redaer: fix multiple issues in RARv4 filter code (introduced in libarchive 3.6.0)
  * fix heap use after free in archive_read_format_rar_read_data() (OSS-Fuzz 44547, 52efa50)
  * fix null dereference in read_data_compressed() (OSS-Fuzz 44843, 1271f77)
  * fix heap user after free in run_filters() (OSS-Fuzz 46279, #1715)
- Drop upstream merged fix-CVE-2022-26280.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1669118400">- Fix CVE-2022-36227, Handle a calloc returning NULL
  (CVE-2022-36227, bsc#1205629)
  * CVE-2022-36227.patch</changelog>
  <changelog author="dmueller@suse.com" date="1671796800">- update to 3.6.2 (bsc#1205629, CVE-2022-36227)
  * NULL pointer dereference vulnerability in archive_write.c
  * include ZSTD in Windows builds (#1688)
  * SSL fixes on Windows (#1714, #1723, #1724)
  * rar5 reader: fix possible garbled output with bsdtar -O (#1745)
  * mtree reader: support reading mtree files with tabs (#1783)
  * various small fixes for issues found by CodeQL
- Drop upstream merged CVE-2022-36227.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1690200000">- update to 3.7.0
  * bsdunzip port from FreeBSD
  * fix 2 year 2038 issues</changelog>
  <changelog author="dmueller@suse.com" date="1694952000">- update to 3.7.2:
  * Multiple vulnerabilities have been fixed in the PAX writer
  * bsdunzip(1) now correctly handles arguments following an
  - x after the zipfile
  * zstd filter now supports the "long" write option
  * SEGV and stack buffer overflow in verbose mode of cpio
  * bsdunzip updated to match latest upstream code
  * miscellaneous functional bugfixes</changelog>
  <changelog author="dmueller@suse.com" date="1703851200">- skip write tests on 32bit, they OOM</changelog>
  <changelog author="antonio.teixeira@suse.com" date="1718193600">- Fix CVE-2024-20696, heap based out-of-bounds write
  (CVE-2024-20696, bsc#1225971)
  * CVE-2024-20696.patch
- Fix CVE-2024-20697, Out of bounds Remote Code Execution Vulnerability
  (CVE-2024-20697, bsc#1225972)
  * CVE-2024-20697.patch</changelog>
</package>
<package pkgid="5276f5731a26485c4f5c45f9f4786ce0c965e365f5c6a204b6442771700d26e8" name="bubblewrap" arch="aarch64">
  <version epoch="0" ver="0.8.0" rel="150500.3.3.1"/>
  <changelog author="klember@redhat.com" date="1473681600">- Update to 0.1.2</changelog>
  <changelog author="walters@verbum.org" date="1476446400">- New upstream version</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1481889600">- upgrade to upstream version 0.1.4
- Build also for Leap 42.2</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1488456000">- upgrade to upstream version 0.1.7
- note that this package was *never* affected by CVE-2017-5226
  as it was introduced in version 0.1.6
- upstream changelog of version 0.1.7:
    This release backs out the change in 0.1.6 which unconditionally
    called setsid() in order to fix a security issue with TIOCSTI, aka
    CVE-2017-522. That change caused some behavioural issues that are
    hard to work with in some cases. For instance, it makes shell job
    control not work for the bwrap command.
    Instead there is now a new option --new-session which works like
    0.1.6. It is recommended that you use this if possible, but if not we
    recommended that you neutralize this some other way, for instance
    using SECCOMP, which is what flatpak does:
    https://github.com/flatpak/flatpak/commit/902fb713990a8f968ea4350c7c2a27ff46f1a6c4
    In order to make it easy to create maximally safe sandboxes we have
    also added a new commandline switch called --unshare-all. It unshares
    all possible namespaces and is currently equivalent with:
  - -unshare-user-try --unshare-ipc --unshare-pid --unshare-net
  - -unshare-uts --unshare-cgroup-try
    However, the intent is that as new namespaces are added to the kernel they will
    be added to this list. Additionally, if --share-net is specified the network
    namespace is not unshared.
    This release also has some bugfixes:
    bwrap reaps (unexpected) children that are inherited from the
    parent, something which can happen if bwrap is part of a shell
    pipeline.
    bwrap clears the capability bounding set. The permitted
    capabilities was already empty, and use of PR_NO_NEW_PRIVS should
    make it impossible to increase the capabilities, but more
    layers of protection is better.
    The seccomp filter is now installed at the very end of bwrap, which
    means the requirement of the filter is minimal. Any bwrap seccomp
    filter must at least allow: execve, waitpid and write
    Alexander Larsson (7):
    Handle inherited children dying
    Clear capability bounding set
    Make the call to setsid() optional, with --new-session
    demos/bubblewrap-shell.sh: Unshare all namespaces
    Call setsid() and setexeccon() befor forking the init monitor
    Install seccomp filter at the very end
    Bump version to 0.1.7
    Colin Walters (6):
    Release 0.1.6
    man: Correct namespace user -&gt; mount
    demo/shell: Add /var/tmp compat symlink, tweak PS1, add more docs
    Release 0.1.6
    ci: Combine ASAN and UBSAN
    Add --unshare-all and --share-net
- upstream changelog for 0.1.6:
    This fixes a security issue with TIOCSTI, aka CVE-2017-522. Note bubblewrap is
    far from the only program that has this issue, and I think the best fix is
    probably in the kernel to support disabling this ioctl.
    Programs can also work around this by calling setsid() on their own in an exec
    handler before doing an exevp("bwrap").
- upstream changelog for 0.1.5:
    This is a bugfix release, here are the major changes:
    Running bubblewrap as root now works again
    Various fixes for the testsuite
    Use same default compiler warnings as ostree
    Handle errors resolving symlinks during bind mounts
    Alexander Larsson (2):
    bind-mount: Check for errors in realpath()
    Bump version to 0.1.5
    Colin Walters (6):
    Don't call capset() unless we need to
    Only --unshare-user automatically if we're not root
    ci: Modernize a bit, add f25-ubsan
    README.md: Update with better one liner and more information
    utils: Add __attribute__((printf)) to die()
    build: Sync default warning -&gt; error set from ostree
    Simon McVittie (4):
    test-run: be a bash script
    test-run: don't assume we are uid 1000
    Adapt tests so they can be run against installed binaries
    Fix incorrect nesting of backticks when finding a FUSE mount</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1495713600">- update to version 0.1.8
- New --die-with-parent which is based on the Linux prctl(PR_SET_PDEATHSIG) API.
- smaller bugfixes</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1499428800">- fix build macro with rpm &lt; 4.12 (non-Factory currently)</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1505736000">- add group</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1507550400">- update to version 0.2.0
  - bwrap now automatically detects the new
  user namespace restrictions in Red Hat Enterprise Linux 7.4:
  bubblewrap: check for max_user_namespaces == 0.
  - The most notable features are new arguments --as-pid1, and
  - -cap-add/--cap-drop. These were added for running systemd (or in general a
  "full" init system) inside bubblewrap. But the capability options are also
  useful for unprivileged callers to potentially retain capbilities inside the
  sandbox (for example CAP_NET_ADMIN), when user namespaces are enabled.
  Conversely, privileged callers (uid 0) can conversely drop capabilities (without
  user namespaces). Contributed by Giuseppe Scrivano.
  - With --dev, add /dev/fd and /dev/core symlinks
  which should improve compatibility with older software.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1525176000">- update to version 0.2.1:
  * All the demos are included
  * bugfixes for the demo files
  * There was an issue with mkdir when running bubblewrap on an NFS
  filesystem that has been fixed, so flatpak now works on NFS shares.
  * Some leaks have been fixed, including a file descriptor leak.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1531569600">- update to version 0.3.0:
  * The biggest feature from this release is that bwrap
    now supports being invoked recursively (from other container
    runtimes such as Docker/podman/runc as well as bwrap itself)
    when user namespaces are enabled, and the outer container manager
    allows it (Docker's default seccomp policy doesn't).
  * This is useful for testing scenarios; for example a project
    uses Kubernetes for its CI, but inside build the project wants to run
    each unit test in their own pid namespace, without going out
    and creating a new pod for every single unit test.
  * Similarly, rpm-ostree compose tree uses bwrap internally for scripts,
    and we want to support running rpm-ostree inside a container as well.
  * Another feature is bwrap now supports -- to terminate argument
    parsing. To detect availablity of this, you could parse bwrap --version.</changelog>
  <changelog author="alarrosa@suse.com" date="1539259200">- update to version 0.3.1:
  * New feature in this release is --bind-try (as well as --dev-bind-try
    and --ro-bind-try) which works like the regular versions if the source
    exists, but does nothing if it doesn't exist.
  * The mount type for the root tmpfs was also changed to "tmpfs" instead
    of being empty, as the later could cause problems with some programs
    when parsing the mountinfo files in /proc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1559390400">- Update to version 0.3.3:
  - This release is the same as 0.3.2 but the version number in configure.ac
  was accidentally still set to 0.3.1
- Update to version 0.3.2:
  - fixes boo#1136958 / CVE-2019-12439
  This release fixes a mostly theoretical security issue in unusual/broken
  setups where `$XDG_RUNTIME_DIR` is unset.
  There are some other smaller fixes, as well as an addition to the JSON
  API that allows reading the inner process exit code, separately from
  the `bwrap` exit code.
  - Print "Out of memory" on stderr, not stdout
  - bwrap: add option json-status-fd to show child exit code
  - bwrap: Report COMMAND exit code in json-status-fd
  - man page: Describe --chdir, not nonexistent --cwd
  - Don't create our own temporary mount point for pivot_root
  - Make lockdata long enough on 32-bit with 64-bit file pointers.</changelog>
  <changelog author="alarrosa@suse.com" date="1559908800">- Use /bin/bash instead of /usr/bin/bash in SLE12</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576843200">- Update to version 0.4.0:
  + The biggest feature in this release is the support for joining
    existing user and pid namespaces. This doesn't work in the
    setuid mode (at the moment).
  + Other changes:
  - Stores namespace info in status json.
  - In setuid mode pid 1 is now marked dumpable.
  - Now builds with musl libc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1585742400">- Update to version 0.4.1:
  * retcode: fix return code with syncfd and no event_fd
  * Ensure we're always clearing the cap bounding set
  * tests: Update output patterns for libcap &gt;= 2.29
  * Don't rely on geteuid() to know when to switch back from setuid root
  * Don't support --userns2 in setuid mode
  * fixes CVE-2020-5291
  * fixes bsc#1168291</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632139200">- Update to version 0.5.0:
  + New features:
  - --chmod changes permissions
  - --clearenv unsets every environment variable (except PWD)
  - --perms sets permissions for one subsequent --bind-data,
  - -dir, --file, --ro-bind-data or --tmpfs
  + Other enhancements:
  - Better diagnostics when a --bind or other bind-mount fails
  - zsh tab-completion
  - Better test coverage
  + Bug fixes:
  - Use Python 3 for tests and examples
  - Mount points for non-directories are created with permissions
  - r--r--r-- instead of -rw-rw-rw-
  - Don't remount items in /proc read-only if already EROFS,
    required to run under Docker
  - Allow mounting an non-directory over an existing
    non-directory, e.g. --bind "$XDG_RUNTIME_DIR/my-log-socket"
    /dev/log
  - Silence kernel messages for our bind-mounts
  - Make sure pkg-config is checked for, regardless of build
    options
  - Improve ability to bind-mount directories on case-insensitive
    filesystems
  - Fix -Wshadow warnings
  - Fix deprecation warnings with newer SELinux
- Add new subpackage bubblewrap-zsh-completion</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1646395200">- Update to 0.6.1:
  - Add a release checklist
  - completions: Make zsh completion non-executable
  The Autotools build system installed it with 0644 permissions because
  it's listed as DATA, but the Meson build system installs executable
  files as executable by default.
  zsh completions don't need to be executable to work, and this one doesn't
  have the `#!` marker that should start an executable script.
- update to 0.6.0:
  - meson: Improve compatibility with Meson 0.49
  That version doesn't allow more than two arguments for define_variable.
  - Disable test-specifying-pidns.sh under 'meson dist' while I investigate
  This test is hanging when run under 'meson dist' for some reason, but
  not when run under 'meson test', and not locally, only in the Github
  Workflow-based CI. Disable it for now.
  - meson: Actually build and run the tests
  - tests: Fix compiler warnings for unused arguments
  - meson: Run test scripts from $srcdir
  - meson: Make G_TEST_SRCDIR, G_TEST_BUILDDIR match Autotools
  - meson: Run the Python test script with Python, not bash
  The python build option can be used to swap to a different interpreter,
  for environments like the Steam Runtime where the python3 executable in
  the PATH is extremely old but there is a better interpreter available.
  This is treated as non-optional, because Meson is written in Python,
  so the situation where there is no Python interpreter at build-time
  shouldn't arise.
  - meson: Build the try-syscall helper
  - meson: Build tests with equivalent of -I$(top_srcdir) -I$(top_builddir)
  - meson.build: Remove unnecessary check for sh
  - Add a Meson build system
  This allows bwrap to be built as a subproject in larger Meson projects.
  When built as a subproject, we install into the --libexecdir and
  require a program prefix to be specified: for example, Flatpak would use
  program_prefix=flatpak- to get /usr/libexec/flatpak-bwrap. Verified to
  be backwards-compatible as far as Meson 0.49.0 (Debian 9 backports).
  Loosely based on previous work by Jussi Pakkanen (see #133).
  Differences between the Autotools and Meson builds:
  The Meson build requires a version of libcap that has pkg-config
  metadata (introduced in libcap 2.23, in 2013).
  The Meson build has no equivalent of --with-priv-mode=setuid. On
  distributions like Debian &lt;= 10 and RHEL &lt;= 7 that require a setuid bwrap
  executable, the sysadmin or distribution packaging will need to set the
  correct permissions on the bwrap executable; Debian already did this via
  packaging rather than the upstream build system.
  The Meson build supports being used as a subproject, and there is CI
  for this. It automatically disables shell completions and man pages,
  moves the bubblewrap executable to ${libexecdir}, and renames the
  bubblewrap executable according to a program_prefix option that the
  caller must specify (for example, Flatpak would use
  - Dprogram_prefix=flatpak- to get /usr/libexec/flatpak-bwrap). See the
  tests/use-as-subproject/ directory for an example.
  - Use HEAD to refer to other projects' default branches in documentation
  This makes the URL independent of the name they have chosen for their
  default branches.
  - workflows: Update for rename of default branch to main
  - tests: Exercise seccomp filters
  - Allow loading more than one seccomp program
  This will allow Flatpak to combine an allow-list (default-deny) of
  known system calls with a deny-list (default-allow) of system calls
  that are undesired.
  Resolves: https://github.com/containers/bubblewrap/issues/453
  - Generalize linked lists of LockFile and SetupOp
  I'm about to add a third linked list, for seccomp programs, which would
  seem like too much duplication.
  - Handle argc == 0 better
  Unfortunately it's possible for argc to be 0, so error out pretty early
  on in that case. I don't think this is a security issue in this case.
  - Fix typo
  - Remove trailing whitespace
  - Fix spelling
  - bash: Fix shellcheck warnings
  - bash: Invoke bash using /usr/bin/env
  - bubblewrap: Avoid a -Wjump-misses-init false-positive
  When building with -Wjump-misses-init as part of a larger project, gcc
  reports that we jump past initialization of cover_proc_dirs. This is
  technically true, but we only use this variable in the case where it's
  initialized, so that's harmless.
  However, we can avoid this altogether by making the array static and
  constant, which allows it to be moved from initialized data to read-only
  data.
  - bind-mount: Be more const-correct
  When compiled with -Wwrite-strings as part of a larger project, gcc and
  clang both warn that we're assigning a string constant to a mutable
  struct member. There's actually no reason why it should be mutable, so
  make it const.
  - die_with_error: Save errno sooner
  We need to save errno immediately, otherwise it could be overwritten
  by a failing library call somewhere in the implementation of fprintf.
  - main: Warn when non-repeatable options are repeated
  A user might reasonably expect that `bwrap --seccomp 3 --seccomp 4 ...`
  would load seccomp programs from both fds 3 and 4, but in fact it only
  loads the program from fd 4.
  Helps: https://github.com/containers/bubblewrap/issues/453
  Resolves: https://github.com/containers/bubblewrap/issues/454
  - utils: Add warn()
  - Add SPDX-License-Identifier for files that already specify license
  This is a step towards REUSE compliance. Third-party files that we do
  not otherwise edit (git.mk, m4/attributes.m4) are excluded here.
  - tests: Use preferred spelling for SPDX license identifiers
  - Remove obsolete .travis.yml
  We no longer use Travis-CI.
  - Remove obsolete papr CI
  We no longer use this.</changelog>
  <changelog author="dimstar@opensuse.org" date="1652875200">- Update to version 0.6.2:
  + New features in Meson build:
  - Auto-detect whether the man page can be generated.
  - -Dbwrapdir=... changes the installation directory (useful
    when being used as a subproject).
  - -Dtests=false disables unit tests.
  + Bug fixes:
  - Add --add-seccomp-fd to shell completions
  - Document --add-seccomp-fd, --json-status-fd and --share-net
    in the man page
  - Add attributes to silence various compiler warnings
  - Allow compilation of tests with musl on mips architectures
  - Allow compilation with older glibc
  - Disable sanitizers for a test helper whose seccomp profile
    breaks the instrumentation
  - Disable AddressSanitizer leak detection where it interferes
    with unit testing</changelog>
  <changelog author="dmueller@suse.com" date="1670414400">- update to v0.7.0:
  * --size option controls the size of a subsequent --tmpfs (#509)
  * Better error messages if a mount operation fails (#472)
  * Better error message if creating the new user namespace fails with
    ENOSPC (#487)
  * When building as a Meson subproject, a RUNPATH can be set on the
    executable to make it easier to bundle its libcap dependency
  * Fix test failures when running as uid 0 but with limited capabilities
    (#510)
  * Use POSIX command -v in preference to non-standard which (#527)
  * Fix a copy/paste error in --help (#531)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1679918400">- update to v0.8.0:
  * Add --disable-userns option to prevent the sandbox from
    creating its own nested user namespace
  * Add --assert-userns-disabled option to check that an existing
    userns was created with --disable-userns
  * Give a clearer error message if the kernel doesn't have
    CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER</changelog>
</package>
<package pkgid="2f7daf41a36f9293c3db8a4d3c912ce5900ef9ca14076fa4c5aee1e87de733bc" name="bubblewrap" arch="ppc64le">
  <version epoch="0" ver="0.8.0" rel="150500.3.3.1"/>
  <changelog author="klember@redhat.com" date="1473681600">- Update to 0.1.2</changelog>
  <changelog author="walters@verbum.org" date="1476446400">- New upstream version</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1481889600">- upgrade to upstream version 0.1.4
- Build also for Leap 42.2</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1488456000">- upgrade to upstream version 0.1.7
- note that this package was *never* affected by CVE-2017-5226
  as it was introduced in version 0.1.6
- upstream changelog of version 0.1.7:
    This release backs out the change in 0.1.6 which unconditionally
    called setsid() in order to fix a security issue with TIOCSTI, aka
    CVE-2017-522. That change caused some behavioural issues that are
    hard to work with in some cases. For instance, it makes shell job
    control not work for the bwrap command.
    Instead there is now a new option --new-session which works like
    0.1.6. It is recommended that you use this if possible, but if not we
    recommended that you neutralize this some other way, for instance
    using SECCOMP, which is what flatpak does:
    https://github.com/flatpak/flatpak/commit/902fb713990a8f968ea4350c7c2a27ff46f1a6c4
    In order to make it easy to create maximally safe sandboxes we have
    also added a new commandline switch called --unshare-all. It unshares
    all possible namespaces and is currently equivalent with:
  - -unshare-user-try --unshare-ipc --unshare-pid --unshare-net
  - -unshare-uts --unshare-cgroup-try
    However, the intent is that as new namespaces are added to the kernel they will
    be added to this list. Additionally, if --share-net is specified the network
    namespace is not unshared.
    This release also has some bugfixes:
    bwrap reaps (unexpected) children that are inherited from the
    parent, something which can happen if bwrap is part of a shell
    pipeline.
    bwrap clears the capability bounding set. The permitted
    capabilities was already empty, and use of PR_NO_NEW_PRIVS should
    make it impossible to increase the capabilities, but more
    layers of protection is better.
    The seccomp filter is now installed at the very end of bwrap, which
    means the requirement of the filter is minimal. Any bwrap seccomp
    filter must at least allow: execve, waitpid and write
    Alexander Larsson (7):
    Handle inherited children dying
    Clear capability bounding set
    Make the call to setsid() optional, with --new-session
    demos/bubblewrap-shell.sh: Unshare all namespaces
    Call setsid() and setexeccon() befor forking the init monitor
    Install seccomp filter at the very end
    Bump version to 0.1.7
    Colin Walters (6):
    Release 0.1.6
    man: Correct namespace user -&gt; mount
    demo/shell: Add /var/tmp compat symlink, tweak PS1, add more docs
    Release 0.1.6
    ci: Combine ASAN and UBSAN
    Add --unshare-all and --share-net
- upstream changelog for 0.1.6:
    This fixes a security issue with TIOCSTI, aka CVE-2017-522. Note bubblewrap is
    far from the only program that has this issue, and I think the best fix is
    probably in the kernel to support disabling this ioctl.
    Programs can also work around this by calling setsid() on their own in an exec
    handler before doing an exevp("bwrap").
- upstream changelog for 0.1.5:
    This is a bugfix release, here are the major changes:
    Running bubblewrap as root now works again
    Various fixes for the testsuite
    Use same default compiler warnings as ostree
    Handle errors resolving symlinks during bind mounts
    Alexander Larsson (2):
    bind-mount: Check for errors in realpath()
    Bump version to 0.1.5
    Colin Walters (6):
    Don't call capset() unless we need to
    Only --unshare-user automatically if we're not root
    ci: Modernize a bit, add f25-ubsan
    README.md: Update with better one liner and more information
    utils: Add __attribute__((printf)) to die()
    build: Sync default warning -&gt; error set from ostree
    Simon McVittie (4):
    test-run: be a bash script
    test-run: don't assume we are uid 1000
    Adapt tests so they can be run against installed binaries
    Fix incorrect nesting of backticks when finding a FUSE mount</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1495713600">- update to version 0.1.8
- New --die-with-parent which is based on the Linux prctl(PR_SET_PDEATHSIG) API.
- smaller bugfixes</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1499428800">- fix build macro with rpm &lt; 4.12 (non-Factory currently)</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1505736000">- add group</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1507550400">- update to version 0.2.0
  - bwrap now automatically detects the new
  user namespace restrictions in Red Hat Enterprise Linux 7.4:
  bubblewrap: check for max_user_namespaces == 0.
  - The most notable features are new arguments --as-pid1, and
  - -cap-add/--cap-drop. These were added for running systemd (or in general a
  "full" init system) inside bubblewrap. But the capability options are also
  useful for unprivileged callers to potentially retain capbilities inside the
  sandbox (for example CAP_NET_ADMIN), when user namespaces are enabled.
  Conversely, privileged callers (uid 0) can conversely drop capabilities (without
  user namespaces). Contributed by Giuseppe Scrivano.
  - With --dev, add /dev/fd and /dev/core symlinks
  which should improve compatibility with older software.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1525176000">- update to version 0.2.1:
  * All the demos are included
  * bugfixes for the demo files
  * There was an issue with mkdir when running bubblewrap on an NFS
  filesystem that has been fixed, so flatpak now works on NFS shares.
  * Some leaks have been fixed, including a file descriptor leak.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1531569600">- update to version 0.3.0:
  * The biggest feature from this release is that bwrap
    now supports being invoked recursively (from other container
    runtimes such as Docker/podman/runc as well as bwrap itself)
    when user namespaces are enabled, and the outer container manager
    allows it (Docker's default seccomp policy doesn't).
  * This is useful for testing scenarios; for example a project
    uses Kubernetes for its CI, but inside build the project wants to run
    each unit test in their own pid namespace, without going out
    and creating a new pod for every single unit test.
  * Similarly, rpm-ostree compose tree uses bwrap internally for scripts,
    and we want to support running rpm-ostree inside a container as well.
  * Another feature is bwrap now supports -- to terminate argument
    parsing. To detect availablity of this, you could parse bwrap --version.</changelog>
  <changelog author="alarrosa@suse.com" date="1539259200">- update to version 0.3.1:
  * New feature in this release is --bind-try (as well as --dev-bind-try
    and --ro-bind-try) which works like the regular versions if the source
    exists, but does nothing if it doesn't exist.
  * The mount type for the root tmpfs was also changed to "tmpfs" instead
    of being empty, as the later could cause problems with some programs
    when parsing the mountinfo files in /proc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1559390400">- Update to version 0.3.3:
  - This release is the same as 0.3.2 but the version number in configure.ac
  was accidentally still set to 0.3.1
- Update to version 0.3.2:
  - fixes boo#1136958 / CVE-2019-12439
  This release fixes a mostly theoretical security issue in unusual/broken
  setups where `$XDG_RUNTIME_DIR` is unset.
  There are some other smaller fixes, as well as an addition to the JSON
  API that allows reading the inner process exit code, separately from
  the `bwrap` exit code.
  - Print "Out of memory" on stderr, not stdout
  - bwrap: add option json-status-fd to show child exit code
  - bwrap: Report COMMAND exit code in json-status-fd
  - man page: Describe --chdir, not nonexistent --cwd
  - Don't create our own temporary mount point for pivot_root
  - Make lockdata long enough on 32-bit with 64-bit file pointers.</changelog>
  <changelog author="alarrosa@suse.com" date="1559908800">- Use /bin/bash instead of /usr/bin/bash in SLE12</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576843200">- Update to version 0.4.0:
  + The biggest feature in this release is the support for joining
    existing user and pid namespaces. This doesn't work in the
    setuid mode (at the moment).
  + Other changes:
  - Stores namespace info in status json.
  - In setuid mode pid 1 is now marked dumpable.
  - Now builds with musl libc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1585742400">- Update to version 0.4.1:
  * retcode: fix return code with syncfd and no event_fd
  * Ensure we're always clearing the cap bounding set
  * tests: Update output patterns for libcap &gt;= 2.29
  * Don't rely on geteuid() to know when to switch back from setuid root
  * Don't support --userns2 in setuid mode
  * fixes CVE-2020-5291
  * fixes bsc#1168291</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632139200">- Update to version 0.5.0:
  + New features:
  - --chmod changes permissions
  - --clearenv unsets every environment variable (except PWD)
  - --perms sets permissions for one subsequent --bind-data,
  - -dir, --file, --ro-bind-data or --tmpfs
  + Other enhancements:
  - Better diagnostics when a --bind or other bind-mount fails
  - zsh tab-completion
  - Better test coverage
  + Bug fixes:
  - Use Python 3 for tests and examples
  - Mount points for non-directories are created with permissions
  - r--r--r-- instead of -rw-rw-rw-
  - Don't remount items in /proc read-only if already EROFS,
    required to run under Docker
  - Allow mounting an non-directory over an existing
    non-directory, e.g. --bind "$XDG_RUNTIME_DIR/my-log-socket"
    /dev/log
  - Silence kernel messages for our bind-mounts
  - Make sure pkg-config is checked for, regardless of build
    options
  - Improve ability to bind-mount directories on case-insensitive
    filesystems
  - Fix -Wshadow warnings
  - Fix deprecation warnings with newer SELinux
- Add new subpackage bubblewrap-zsh-completion</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1646395200">- Update to 0.6.1:
  - Add a release checklist
  - completions: Make zsh completion non-executable
  The Autotools build system installed it with 0644 permissions because
  it's listed as DATA, but the Meson build system installs executable
  files as executable by default.
  zsh completions don't need to be executable to work, and this one doesn't
  have the `#!` marker that should start an executable script.
- update to 0.6.0:
  - meson: Improve compatibility with Meson 0.49
  That version doesn't allow more than two arguments for define_variable.
  - Disable test-specifying-pidns.sh under 'meson dist' while I investigate
  This test is hanging when run under 'meson dist' for some reason, but
  not when run under 'meson test', and not locally, only in the Github
  Workflow-based CI. Disable it for now.
  - meson: Actually build and run the tests
  - tests: Fix compiler warnings for unused arguments
  - meson: Run test scripts from $srcdir
  - meson: Make G_TEST_SRCDIR, G_TEST_BUILDDIR match Autotools
  - meson: Run the Python test script with Python, not bash
  The python build option can be used to swap to a different interpreter,
  for environments like the Steam Runtime where the python3 executable in
  the PATH is extremely old but there is a better interpreter available.
  This is treated as non-optional, because Meson is written in Python,
  so the situation where there is no Python interpreter at build-time
  shouldn't arise.
  - meson: Build the try-syscall helper
  - meson: Build tests with equivalent of -I$(top_srcdir) -I$(top_builddir)
  - meson.build: Remove unnecessary check for sh
  - Add a Meson build system
  This allows bwrap to be built as a subproject in larger Meson projects.
  When built as a subproject, we install into the --libexecdir and
  require a program prefix to be specified: for example, Flatpak would use
  program_prefix=flatpak- to get /usr/libexec/flatpak-bwrap. Verified to
  be backwards-compatible as far as Meson 0.49.0 (Debian 9 backports).
  Loosely based on previous work by Jussi Pakkanen (see #133).
  Differences between the Autotools and Meson builds:
  The Meson build requires a version of libcap that has pkg-config
  metadata (introduced in libcap 2.23, in 2013).
  The Meson build has no equivalent of --with-priv-mode=setuid. On
  distributions like Debian &lt;= 10 and RHEL &lt;= 7 that require a setuid bwrap
  executable, the sysadmin or distribution packaging will need to set the
  correct permissions on the bwrap executable; Debian already did this via
  packaging rather than the upstream build system.
  The Meson build supports being used as a subproject, and there is CI
  for this. It automatically disables shell completions and man pages,
  moves the bubblewrap executable to ${libexecdir}, and renames the
  bubblewrap executable according to a program_prefix option that the
  caller must specify (for example, Flatpak would use
  - Dprogram_prefix=flatpak- to get /usr/libexec/flatpak-bwrap). See the
  tests/use-as-subproject/ directory for an example.
  - Use HEAD to refer to other projects' default branches in documentation
  This makes the URL independent of the name they have chosen for their
  default branches.
  - workflows: Update for rename of default branch to main
  - tests: Exercise seccomp filters
  - Allow loading more than one seccomp program
  This will allow Flatpak to combine an allow-list (default-deny) of
  known system calls with a deny-list (default-allow) of system calls
  that are undesired.
  Resolves: https://github.com/containers/bubblewrap/issues/453
  - Generalize linked lists of LockFile and SetupOp
  I'm about to add a third linked list, for seccomp programs, which would
  seem like too much duplication.
  - Handle argc == 0 better
  Unfortunately it's possible for argc to be 0, so error out pretty early
  on in that case. I don't think this is a security issue in this case.
  - Fix typo
  - Remove trailing whitespace
  - Fix spelling
  - bash: Fix shellcheck warnings
  - bash: Invoke bash using /usr/bin/env
  - bubblewrap: Avoid a -Wjump-misses-init false-positive
  When building with -Wjump-misses-init as part of a larger project, gcc
  reports that we jump past initialization of cover_proc_dirs. This is
  technically true, but we only use this variable in the case where it's
  initialized, so that's harmless.
  However, we can avoid this altogether by making the array static and
  constant, which allows it to be moved from initialized data to read-only
  data.
  - bind-mount: Be more const-correct
  When compiled with -Wwrite-strings as part of a larger project, gcc and
  clang both warn that we're assigning a string constant to a mutable
  struct member. There's actually no reason why it should be mutable, so
  make it const.
  - die_with_error: Save errno sooner
  We need to save errno immediately, otherwise it could be overwritten
  by a failing library call somewhere in the implementation of fprintf.
  - main: Warn when non-repeatable options are repeated
  A user might reasonably expect that `bwrap --seccomp 3 --seccomp 4 ...`
  would load seccomp programs from both fds 3 and 4, but in fact it only
  loads the program from fd 4.
  Helps: https://github.com/containers/bubblewrap/issues/453
  Resolves: https://github.com/containers/bubblewrap/issues/454
  - utils: Add warn()
  - Add SPDX-License-Identifier for files that already specify license
  This is a step towards REUSE compliance. Third-party files that we do
  not otherwise edit (git.mk, m4/attributes.m4) are excluded here.
  - tests: Use preferred spelling for SPDX license identifiers
  - Remove obsolete .travis.yml
  We no longer use Travis-CI.
  - Remove obsolete papr CI
  We no longer use this.</changelog>
  <changelog author="dimstar@opensuse.org" date="1652875200">- Update to version 0.6.2:
  + New features in Meson build:
  - Auto-detect whether the man page can be generated.
  - -Dbwrapdir=... changes the installation directory (useful
    when being used as a subproject).
  - -Dtests=false disables unit tests.
  + Bug fixes:
  - Add --add-seccomp-fd to shell completions
  - Document --add-seccomp-fd, --json-status-fd and --share-net
    in the man page
  - Add attributes to silence various compiler warnings
  - Allow compilation of tests with musl on mips architectures
  - Allow compilation with older glibc
  - Disable sanitizers for a test helper whose seccomp profile
    breaks the instrumentation
  - Disable AddressSanitizer leak detection where it interferes
    with unit testing</changelog>
  <changelog author="dmueller@suse.com" date="1670414400">- update to v0.7.0:
  * --size option controls the size of a subsequent --tmpfs (#509)
  * Better error messages if a mount operation fails (#472)
  * Better error message if creating the new user namespace fails with
    ENOSPC (#487)
  * When building as a Meson subproject, a RUNPATH can be set on the
    executable to make it easier to bundle its libcap dependency
  * Fix test failures when running as uid 0 but with limited capabilities
    (#510)
  * Use POSIX command -v in preference to non-standard which (#527)
  * Fix a copy/paste error in --help (#531)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1679918400">- update to v0.8.0:
  * Add --disable-userns option to prevent the sandbox from
    creating its own nested user namespace
  * Add --assert-userns-disabled option to check that an existing
    userns was created with --disable-userns
  * Give a clearer error message if the kernel doesn't have
    CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER</changelog>
</package>
<package pkgid="0b9fe124d48c0273b9eb2efeec8dd08784ce7f42f4b4a44e6de97aef2487b181" name="bubblewrap" arch="s390x">
  <version epoch="0" ver="0.8.0" rel="150500.3.3.1"/>
  <changelog author="klember@redhat.com" date="1473681600">- Update to 0.1.2</changelog>
  <changelog author="walters@verbum.org" date="1476446400">- New upstream version</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1481889600">- upgrade to upstream version 0.1.4
- Build also for Leap 42.2</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1488456000">- upgrade to upstream version 0.1.7
- note that this package was *never* affected by CVE-2017-5226
  as it was introduced in version 0.1.6
- upstream changelog of version 0.1.7:
    This release backs out the change in 0.1.6 which unconditionally
    called setsid() in order to fix a security issue with TIOCSTI, aka
    CVE-2017-522. That change caused some behavioural issues that are
    hard to work with in some cases. For instance, it makes shell job
    control not work for the bwrap command.
    Instead there is now a new option --new-session which works like
    0.1.6. It is recommended that you use this if possible, but if not we
    recommended that you neutralize this some other way, for instance
    using SECCOMP, which is what flatpak does:
    https://github.com/flatpak/flatpak/commit/902fb713990a8f968ea4350c7c2a27ff46f1a6c4
    In order to make it easy to create maximally safe sandboxes we have
    also added a new commandline switch called --unshare-all. It unshares
    all possible namespaces and is currently equivalent with:
  - -unshare-user-try --unshare-ipc --unshare-pid --unshare-net
  - -unshare-uts --unshare-cgroup-try
    However, the intent is that as new namespaces are added to the kernel they will
    be added to this list. Additionally, if --share-net is specified the network
    namespace is not unshared.
    This release also has some bugfixes:
    bwrap reaps (unexpected) children that are inherited from the
    parent, something which can happen if bwrap is part of a shell
    pipeline.
    bwrap clears the capability bounding set. The permitted
    capabilities was already empty, and use of PR_NO_NEW_PRIVS should
    make it impossible to increase the capabilities, but more
    layers of protection is better.
    The seccomp filter is now installed at the very end of bwrap, which
    means the requirement of the filter is minimal. Any bwrap seccomp
    filter must at least allow: execve, waitpid and write
    Alexander Larsson (7):
    Handle inherited children dying
    Clear capability bounding set
    Make the call to setsid() optional, with --new-session
    demos/bubblewrap-shell.sh: Unshare all namespaces
    Call setsid() and setexeccon() befor forking the init monitor
    Install seccomp filter at the very end
    Bump version to 0.1.7
    Colin Walters (6):
    Release 0.1.6
    man: Correct namespace user -&gt; mount
    demo/shell: Add /var/tmp compat symlink, tweak PS1, add more docs
    Release 0.1.6
    ci: Combine ASAN and UBSAN
    Add --unshare-all and --share-net
- upstream changelog for 0.1.6:
    This fixes a security issue with TIOCSTI, aka CVE-2017-522. Note bubblewrap is
    far from the only program that has this issue, and I think the best fix is
    probably in the kernel to support disabling this ioctl.
    Programs can also work around this by calling setsid() on their own in an exec
    handler before doing an exevp("bwrap").
- upstream changelog for 0.1.5:
    This is a bugfix release, here are the major changes:
    Running bubblewrap as root now works again
    Various fixes for the testsuite
    Use same default compiler warnings as ostree
    Handle errors resolving symlinks during bind mounts
    Alexander Larsson (2):
    bind-mount: Check for errors in realpath()
    Bump version to 0.1.5
    Colin Walters (6):
    Don't call capset() unless we need to
    Only --unshare-user automatically if we're not root
    ci: Modernize a bit, add f25-ubsan
    README.md: Update with better one liner and more information
    utils: Add __attribute__((printf)) to die()
    build: Sync default warning -&gt; error set from ostree
    Simon McVittie (4):
    test-run: be a bash script
    test-run: don't assume we are uid 1000
    Adapt tests so they can be run against installed binaries
    Fix incorrect nesting of backticks when finding a FUSE mount</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1495713600">- update to version 0.1.8
- New --die-with-parent which is based on the Linux prctl(PR_SET_PDEATHSIG) API.
- smaller bugfixes</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1499428800">- fix build macro with rpm &lt; 4.12 (non-Factory currently)</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1505736000">- add group</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1507550400">- update to version 0.2.0
  - bwrap now automatically detects the new
  user namespace restrictions in Red Hat Enterprise Linux 7.4:
  bubblewrap: check for max_user_namespaces == 0.
  - The most notable features are new arguments --as-pid1, and
  - -cap-add/--cap-drop. These were added for running systemd (or in general a
  "full" init system) inside bubblewrap. But the capability options are also
  useful for unprivileged callers to potentially retain capbilities inside the
  sandbox (for example CAP_NET_ADMIN), when user namespaces are enabled.
  Conversely, privileged callers (uid 0) can conversely drop capabilities (without
  user namespaces). Contributed by Giuseppe Scrivano.
  - With --dev, add /dev/fd and /dev/core symlinks
  which should improve compatibility with older software.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1525176000">- update to version 0.2.1:
  * All the demos are included
  * bugfixes for the demo files
  * There was an issue with mkdir when running bubblewrap on an NFS
  filesystem that has been fixed, so flatpak now works on NFS shares.
  * Some leaks have been fixed, including a file descriptor leak.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1531569600">- update to version 0.3.0:
  * The biggest feature from this release is that bwrap
    now supports being invoked recursively (from other container
    runtimes such as Docker/podman/runc as well as bwrap itself)
    when user namespaces are enabled, and the outer container manager
    allows it (Docker's default seccomp policy doesn't).
  * This is useful for testing scenarios; for example a project
    uses Kubernetes for its CI, but inside build the project wants to run
    each unit test in their own pid namespace, without going out
    and creating a new pod for every single unit test.
  * Similarly, rpm-ostree compose tree uses bwrap internally for scripts,
    and we want to support running rpm-ostree inside a container as well.
  * Another feature is bwrap now supports -- to terminate argument
    parsing. To detect availablity of this, you could parse bwrap --version.</changelog>
  <changelog author="alarrosa@suse.com" date="1539259200">- update to version 0.3.1:
  * New feature in this release is --bind-try (as well as --dev-bind-try
    and --ro-bind-try) which works like the regular versions if the source
    exists, but does nothing if it doesn't exist.
  * The mount type for the root tmpfs was also changed to "tmpfs" instead
    of being empty, as the later could cause problems with some programs
    when parsing the mountinfo files in /proc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1559390400">- Update to version 0.3.3:
  - This release is the same as 0.3.2 but the version number in configure.ac
  was accidentally still set to 0.3.1
- Update to version 0.3.2:
  - fixes boo#1136958 / CVE-2019-12439
  This release fixes a mostly theoretical security issue in unusual/broken
  setups where `$XDG_RUNTIME_DIR` is unset.
  There are some other smaller fixes, as well as an addition to the JSON
  API that allows reading the inner process exit code, separately from
  the `bwrap` exit code.
  - Print "Out of memory" on stderr, not stdout
  - bwrap: add option json-status-fd to show child exit code
  - bwrap: Report COMMAND exit code in json-status-fd
  - man page: Describe --chdir, not nonexistent --cwd
  - Don't create our own temporary mount point for pivot_root
  - Make lockdata long enough on 32-bit with 64-bit file pointers.</changelog>
  <changelog author="alarrosa@suse.com" date="1559908800">- Use /bin/bash instead of /usr/bin/bash in SLE12</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576843200">- Update to version 0.4.0:
  + The biggest feature in this release is the support for joining
    existing user and pid namespaces. This doesn't work in the
    setuid mode (at the moment).
  + Other changes:
  - Stores namespace info in status json.
  - In setuid mode pid 1 is now marked dumpable.
  - Now builds with musl libc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1585742400">- Update to version 0.4.1:
  * retcode: fix return code with syncfd and no event_fd
  * Ensure we're always clearing the cap bounding set
  * tests: Update output patterns for libcap &gt;= 2.29
  * Don't rely on geteuid() to know when to switch back from setuid root
  * Don't support --userns2 in setuid mode
  * fixes CVE-2020-5291
  * fixes bsc#1168291</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632139200">- Update to version 0.5.0:
  + New features:
  - --chmod changes permissions
  - --clearenv unsets every environment variable (except PWD)
  - --perms sets permissions for one subsequent --bind-data,
  - -dir, --file, --ro-bind-data or --tmpfs
  + Other enhancements:
  - Better diagnostics when a --bind or other bind-mount fails
  - zsh tab-completion
  - Better test coverage
  + Bug fixes:
  - Use Python 3 for tests and examples
  - Mount points for non-directories are created with permissions
  - r--r--r-- instead of -rw-rw-rw-
  - Don't remount items in /proc read-only if already EROFS,
    required to run under Docker
  - Allow mounting an non-directory over an existing
    non-directory, e.g. --bind "$XDG_RUNTIME_DIR/my-log-socket"
    /dev/log
  - Silence kernel messages for our bind-mounts
  - Make sure pkg-config is checked for, regardless of build
    options
  - Improve ability to bind-mount directories on case-insensitive
    filesystems
  - Fix -Wshadow warnings
  - Fix deprecation warnings with newer SELinux
- Add new subpackage bubblewrap-zsh-completion</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1646395200">- Update to 0.6.1:
  - Add a release checklist
  - completions: Make zsh completion non-executable
  The Autotools build system installed it with 0644 permissions because
  it's listed as DATA, but the Meson build system installs executable
  files as executable by default.
  zsh completions don't need to be executable to work, and this one doesn't
  have the `#!` marker that should start an executable script.
- update to 0.6.0:
  - meson: Improve compatibility with Meson 0.49
  That version doesn't allow more than two arguments for define_variable.
  - Disable test-specifying-pidns.sh under 'meson dist' while I investigate
  This test is hanging when run under 'meson dist' for some reason, but
  not when run under 'meson test', and not locally, only in the Github
  Workflow-based CI. Disable it for now.
  - meson: Actually build and run the tests
  - tests: Fix compiler warnings for unused arguments
  - meson: Run test scripts from $srcdir
  - meson: Make G_TEST_SRCDIR, G_TEST_BUILDDIR match Autotools
  - meson: Run the Python test script with Python, not bash
  The python build option can be used to swap to a different interpreter,
  for environments like the Steam Runtime where the python3 executable in
  the PATH is extremely old but there is a better interpreter available.
  This is treated as non-optional, because Meson is written in Python,
  so the situation where there is no Python interpreter at build-time
  shouldn't arise.
  - meson: Build the try-syscall helper
  - meson: Build tests with equivalent of -I$(top_srcdir) -I$(top_builddir)
  - meson.build: Remove unnecessary check for sh
  - Add a Meson build system
  This allows bwrap to be built as a subproject in larger Meson projects.
  When built as a subproject, we install into the --libexecdir and
  require a program prefix to be specified: for example, Flatpak would use
  program_prefix=flatpak- to get /usr/libexec/flatpak-bwrap. Verified to
  be backwards-compatible as far as Meson 0.49.0 (Debian 9 backports).
  Loosely based on previous work by Jussi Pakkanen (see #133).
  Differences between the Autotools and Meson builds:
  The Meson build requires a version of libcap that has pkg-config
  metadata (introduced in libcap 2.23, in 2013).
  The Meson build has no equivalent of --with-priv-mode=setuid. On
  distributions like Debian &lt;= 10 and RHEL &lt;= 7 that require a setuid bwrap
  executable, the sysadmin or distribution packaging will need to set the
  correct permissions on the bwrap executable; Debian already did this via
  packaging rather than the upstream build system.
  The Meson build supports being used as a subproject, and there is CI
  for this. It automatically disables shell completions and man pages,
  moves the bubblewrap executable to ${libexecdir}, and renames the
  bubblewrap executable according to a program_prefix option that the
  caller must specify (for example, Flatpak would use
  - Dprogram_prefix=flatpak- to get /usr/libexec/flatpak-bwrap). See the
  tests/use-as-subproject/ directory for an example.
  - Use HEAD to refer to other projects' default branches in documentation
  This makes the URL independent of the name they have chosen for their
  default branches.
  - workflows: Update for rename of default branch to main
  - tests: Exercise seccomp filters
  - Allow loading more than one seccomp program
  This will allow Flatpak to combine an allow-list (default-deny) of
  known system calls with a deny-list (default-allow) of system calls
  that are undesired.
  Resolves: https://github.com/containers/bubblewrap/issues/453
  - Generalize linked lists of LockFile and SetupOp
  I'm about to add a third linked list, for seccomp programs, which would
  seem like too much duplication.
  - Handle argc == 0 better
  Unfortunately it's possible for argc to be 0, so error out pretty early
  on in that case. I don't think this is a security issue in this case.
  - Fix typo
  - Remove trailing whitespace
  - Fix spelling
  - bash: Fix shellcheck warnings
  - bash: Invoke bash using /usr/bin/env
  - bubblewrap: Avoid a -Wjump-misses-init false-positive
  When building with -Wjump-misses-init as part of a larger project, gcc
  reports that we jump past initialization of cover_proc_dirs. This is
  technically true, but we only use this variable in the case where it's
  initialized, so that's harmless.
  However, we can avoid this altogether by making the array static and
  constant, which allows it to be moved from initialized data to read-only
  data.
  - bind-mount: Be more const-correct
  When compiled with -Wwrite-strings as part of a larger project, gcc and
  clang both warn that we're assigning a string constant to a mutable
  struct member. There's actually no reason why it should be mutable, so
  make it const.
  - die_with_error: Save errno sooner
  We need to save errno immediately, otherwise it could be overwritten
  by a failing library call somewhere in the implementation of fprintf.
  - main: Warn when non-repeatable options are repeated
  A user might reasonably expect that `bwrap --seccomp 3 --seccomp 4 ...`
  would load seccomp programs from both fds 3 and 4, but in fact it only
  loads the program from fd 4.
  Helps: https://github.com/containers/bubblewrap/issues/453
  Resolves: https://github.com/containers/bubblewrap/issues/454
  - utils: Add warn()
  - Add SPDX-License-Identifier for files that already specify license
  This is a step towards REUSE compliance. Third-party files that we do
  not otherwise edit (git.mk, m4/attributes.m4) are excluded here.
  - tests: Use preferred spelling for SPDX license identifiers
  - Remove obsolete .travis.yml
  We no longer use Travis-CI.
  - Remove obsolete papr CI
  We no longer use this.</changelog>
  <changelog author="dimstar@opensuse.org" date="1652875200">- Update to version 0.6.2:
  + New features in Meson build:
  - Auto-detect whether the man page can be generated.
  - -Dbwrapdir=... changes the installation directory (useful
    when being used as a subproject).
  - -Dtests=false disables unit tests.
  + Bug fixes:
  - Add --add-seccomp-fd to shell completions
  - Document --add-seccomp-fd, --json-status-fd and --share-net
    in the man page
  - Add attributes to silence various compiler warnings
  - Allow compilation of tests with musl on mips architectures
  - Allow compilation with older glibc
  - Disable sanitizers for a test helper whose seccomp profile
    breaks the instrumentation
  - Disable AddressSanitizer leak detection where it interferes
    with unit testing</changelog>
  <changelog author="dmueller@suse.com" date="1670414400">- update to v0.7.0:
  * --size option controls the size of a subsequent --tmpfs (#509)
  * Better error messages if a mount operation fails (#472)
  * Better error message if creating the new user namespace fails with
    ENOSPC (#487)
  * When building as a Meson subproject, a RUNPATH can be set on the
    executable to make it easier to bundle its libcap dependency
  * Fix test failures when running as uid 0 but with limited capabilities
    (#510)
  * Use POSIX command -v in preference to non-standard which (#527)
  * Fix a copy/paste error in --help (#531)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1679918400">- update to v0.8.0:
  * Add --disable-userns option to prevent the sandbox from
    creating its own nested user namespace
  * Add --assert-userns-disabled option to check that an existing
    userns was created with --disable-userns
  * Give a clearer error message if the kernel doesn't have
    CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER</changelog>
</package>
<package pkgid="0b969800f641af58d86e8ebd1bac6e19ea0cd0af538fe5dd150a13ae0cc010fc" name="bubblewrap" arch="src">
  <version epoch="0" ver="0.8.0" rel="150500.3.3.1"/>
  <changelog author="klember@redhat.com" date="1473681600">- Update to 0.1.2</changelog>
  <changelog author="walters@verbum.org" date="1476446400">- New upstream version</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1481889600">- upgrade to upstream version 0.1.4
- Build also for Leap 42.2</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1488456000">- upgrade to upstream version 0.1.7
- note that this package was *never* affected by CVE-2017-5226
  as it was introduced in version 0.1.6
- upstream changelog of version 0.1.7:
    This release backs out the change in 0.1.6 which unconditionally
    called setsid() in order to fix a security issue with TIOCSTI, aka
    CVE-2017-522. That change caused some behavioural issues that are
    hard to work with in some cases. For instance, it makes shell job
    control not work for the bwrap command.
    Instead there is now a new option --new-session which works like
    0.1.6. It is recommended that you use this if possible, but if not we
    recommended that you neutralize this some other way, for instance
    using SECCOMP, which is what flatpak does:
    https://github.com/flatpak/flatpak/commit/902fb713990a8f968ea4350c7c2a27ff46f1a6c4
    In order to make it easy to create maximally safe sandboxes we have
    also added a new commandline switch called --unshare-all. It unshares
    all possible namespaces and is currently equivalent with:
  - -unshare-user-try --unshare-ipc --unshare-pid --unshare-net
  - -unshare-uts --unshare-cgroup-try
    However, the intent is that as new namespaces are added to the kernel they will
    be added to this list. Additionally, if --share-net is specified the network
    namespace is not unshared.
    This release also has some bugfixes:
    bwrap reaps (unexpected) children that are inherited from the
    parent, something which can happen if bwrap is part of a shell
    pipeline.
    bwrap clears the capability bounding set. The permitted
    capabilities was already empty, and use of PR_NO_NEW_PRIVS should
    make it impossible to increase the capabilities, but more
    layers of protection is better.
    The seccomp filter is now installed at the very end of bwrap, which
    means the requirement of the filter is minimal. Any bwrap seccomp
    filter must at least allow: execve, waitpid and write
    Alexander Larsson (7):
    Handle inherited children dying
    Clear capability bounding set
    Make the call to setsid() optional, with --new-session
    demos/bubblewrap-shell.sh: Unshare all namespaces
    Call setsid() and setexeccon() befor forking the init monitor
    Install seccomp filter at the very end
    Bump version to 0.1.7
    Colin Walters (6):
    Release 0.1.6
    man: Correct namespace user -&gt; mount
    demo/shell: Add /var/tmp compat symlink, tweak PS1, add more docs
    Release 0.1.6
    ci: Combine ASAN and UBSAN
    Add --unshare-all and --share-net
- upstream changelog for 0.1.6:
    This fixes a security issue with TIOCSTI, aka CVE-2017-522. Note bubblewrap is
    far from the only program that has this issue, and I think the best fix is
    probably in the kernel to support disabling this ioctl.
    Programs can also work around this by calling setsid() on their own in an exec
    handler before doing an exevp("bwrap").
- upstream changelog for 0.1.5:
    This is a bugfix release, here are the major changes:
    Running bubblewrap as root now works again
    Various fixes for the testsuite
    Use same default compiler warnings as ostree
    Handle errors resolving symlinks during bind mounts
    Alexander Larsson (2):
    bind-mount: Check for errors in realpath()
    Bump version to 0.1.5
    Colin Walters (6):
    Don't call capset() unless we need to
    Only --unshare-user automatically if we're not root
    ci: Modernize a bit, add f25-ubsan
    README.md: Update with better one liner and more information
    utils: Add __attribute__((printf)) to die()
    build: Sync default warning -&gt; error set from ostree
    Simon McVittie (4):
    test-run: be a bash script
    test-run: don't assume we are uid 1000
    Adapt tests so they can be run against installed binaries
    Fix incorrect nesting of backticks when finding a FUSE mount</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1495713600">- update to version 0.1.8
- New --die-with-parent which is based on the Linux prctl(PR_SET_PDEATHSIG) API.
- smaller bugfixes</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1499428800">- fix build macro with rpm &lt; 4.12 (non-Factory currently)</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1505736000">- add group</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1507550400">- update to version 0.2.0
  - bwrap now automatically detects the new
  user namespace restrictions in Red Hat Enterprise Linux 7.4:
  bubblewrap: check for max_user_namespaces == 0.
  - The most notable features are new arguments --as-pid1, and
  - -cap-add/--cap-drop. These were added for running systemd (or in general a
  "full" init system) inside bubblewrap. But the capability options are also
  useful for unprivileged callers to potentially retain capbilities inside the
  sandbox (for example CAP_NET_ADMIN), when user namespaces are enabled.
  Conversely, privileged callers (uid 0) can conversely drop capabilities (without
  user namespaces). Contributed by Giuseppe Scrivano.
  - With --dev, add /dev/fd and /dev/core symlinks
  which should improve compatibility with older software.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1525176000">- update to version 0.2.1:
  * All the demos are included
  * bugfixes for the demo files
  * There was an issue with mkdir when running bubblewrap on an NFS
  filesystem that has been fixed, so flatpak now works on NFS shares.
  * Some leaks have been fixed, including a file descriptor leak.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1531569600">- update to version 0.3.0:
  * The biggest feature from this release is that bwrap
    now supports being invoked recursively (from other container
    runtimes such as Docker/podman/runc as well as bwrap itself)
    when user namespaces are enabled, and the outer container manager
    allows it (Docker's default seccomp policy doesn't).
  * This is useful for testing scenarios; for example a project
    uses Kubernetes for its CI, but inside build the project wants to run
    each unit test in their own pid namespace, without going out
    and creating a new pod for every single unit test.
  * Similarly, rpm-ostree compose tree uses bwrap internally for scripts,
    and we want to support running rpm-ostree inside a container as well.
  * Another feature is bwrap now supports -- to terminate argument
    parsing. To detect availablity of this, you could parse bwrap --version.</changelog>
  <changelog author="alarrosa@suse.com" date="1539259200">- update to version 0.3.1:
  * New feature in this release is --bind-try (as well as --dev-bind-try
    and --ro-bind-try) which works like the regular versions if the source
    exists, but does nothing if it doesn't exist.
  * The mount type for the root tmpfs was also changed to "tmpfs" instead
    of being empty, as the later could cause problems with some programs
    when parsing the mountinfo files in /proc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1559390400">- Update to version 0.3.3:
  - This release is the same as 0.3.2 but the version number in configure.ac
  was accidentally still set to 0.3.1
- Update to version 0.3.2:
  - fixes boo#1136958 / CVE-2019-12439
  This release fixes a mostly theoretical security issue in unusual/broken
  setups where `$XDG_RUNTIME_DIR` is unset.
  There are some other smaller fixes, as well as an addition to the JSON
  API that allows reading the inner process exit code, separately from
  the `bwrap` exit code.
  - Print "Out of memory" on stderr, not stdout
  - bwrap: add option json-status-fd to show child exit code
  - bwrap: Report COMMAND exit code in json-status-fd
  - man page: Describe --chdir, not nonexistent --cwd
  - Don't create our own temporary mount point for pivot_root
  - Make lockdata long enough on 32-bit with 64-bit file pointers.</changelog>
  <changelog author="alarrosa@suse.com" date="1559908800">- Use /bin/bash instead of /usr/bin/bash in SLE12</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576843200">- Update to version 0.4.0:
  + The biggest feature in this release is the support for joining
    existing user and pid namespaces. This doesn't work in the
    setuid mode (at the moment).
  + Other changes:
  - Stores namespace info in status json.
  - In setuid mode pid 1 is now marked dumpable.
  - Now builds with musl libc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1585742400">- Update to version 0.4.1:
  * retcode: fix return code with syncfd and no event_fd
  * Ensure we're always clearing the cap bounding set
  * tests: Update output patterns for libcap &gt;= 2.29
  * Don't rely on geteuid() to know when to switch back from setuid root
  * Don't support --userns2 in setuid mode
  * fixes CVE-2020-5291
  * fixes bsc#1168291</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632139200">- Update to version 0.5.0:
  + New features:
  - --chmod changes permissions
  - --clearenv unsets every environment variable (except PWD)
  - --perms sets permissions for one subsequent --bind-data,
  - -dir, --file, --ro-bind-data or --tmpfs
  + Other enhancements:
  - Better diagnostics when a --bind or other bind-mount fails
  - zsh tab-completion
  - Better test coverage
  + Bug fixes:
  - Use Python 3 for tests and examples
  - Mount points for non-directories are created with permissions
  - r--r--r-- instead of -rw-rw-rw-
  - Don't remount items in /proc read-only if already EROFS,
    required to run under Docker
  - Allow mounting an non-directory over an existing
    non-directory, e.g. --bind "$XDG_RUNTIME_DIR/my-log-socket"
    /dev/log
  - Silence kernel messages for our bind-mounts
  - Make sure pkg-config is checked for, regardless of build
    options
  - Improve ability to bind-mount directories on case-insensitive
    filesystems
  - Fix -Wshadow warnings
  - Fix deprecation warnings with newer SELinux
- Add new subpackage bubblewrap-zsh-completion</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1646395200">- Update to 0.6.1:
  - Add a release checklist
  - completions: Make zsh completion non-executable
  The Autotools build system installed it with 0644 permissions because
  it's listed as DATA, but the Meson build system installs executable
  files as executable by default.
  zsh completions don't need to be executable to work, and this one doesn't
  have the `#!` marker that should start an executable script.
- update to 0.6.0:
  - meson: Improve compatibility with Meson 0.49
  That version doesn't allow more than two arguments for define_variable.
  - Disable test-specifying-pidns.sh under 'meson dist' while I investigate
  This test is hanging when run under 'meson dist' for some reason, but
  not when run under 'meson test', and not locally, only in the Github
  Workflow-based CI. Disable it for now.
  - meson: Actually build and run the tests
  - tests: Fix compiler warnings for unused arguments
  - meson: Run test scripts from $srcdir
  - meson: Make G_TEST_SRCDIR, G_TEST_BUILDDIR match Autotools
  - meson: Run the Python test script with Python, not bash
  The python build option can be used to swap to a different interpreter,
  for environments like the Steam Runtime where the python3 executable in
  the PATH is extremely old but there is a better interpreter available.
  This is treated as non-optional, because Meson is written in Python,
  so the situation where there is no Python interpreter at build-time
  shouldn't arise.
  - meson: Build the try-syscall helper
  - meson: Build tests with equivalent of -I$(top_srcdir) -I$(top_builddir)
  - meson.build: Remove unnecessary check for sh
  - Add a Meson build system
  This allows bwrap to be built as a subproject in larger Meson projects.
  When built as a subproject, we install into the --libexecdir and
  require a program prefix to be specified: for example, Flatpak would use
  program_prefix=flatpak- to get /usr/libexec/flatpak-bwrap. Verified to
  be backwards-compatible as far as Meson 0.49.0 (Debian 9 backports).
  Loosely based on previous work by Jussi Pakkanen (see #133).
  Differences between the Autotools and Meson builds:
  The Meson build requires a version of libcap that has pkg-config
  metadata (introduced in libcap 2.23, in 2013).
  The Meson build has no equivalent of --with-priv-mode=setuid. On
  distributions like Debian &lt;= 10 and RHEL &lt;= 7 that require a setuid bwrap
  executable, the sysadmin or distribution packaging will need to set the
  correct permissions on the bwrap executable; Debian already did this via
  packaging rather than the upstream build system.
  The Meson build supports being used as a subproject, and there is CI
  for this. It automatically disables shell completions and man pages,
  moves the bubblewrap executable to ${libexecdir}, and renames the
  bubblewrap executable according to a program_prefix option that the
  caller must specify (for example, Flatpak would use
  - Dprogram_prefix=flatpak- to get /usr/libexec/flatpak-bwrap). See the
  tests/use-as-subproject/ directory for an example.
  - Use HEAD to refer to other projects' default branches in documentation
  This makes the URL independent of the name they have chosen for their
  default branches.
  - workflows: Update for rename of default branch to main
  - tests: Exercise seccomp filters
  - Allow loading more than one seccomp program
  This will allow Flatpak to combine an allow-list (default-deny) of
  known system calls with a deny-list (default-allow) of system calls
  that are undesired.
  Resolves: https://github.com/containers/bubblewrap/issues/453
  - Generalize linked lists of LockFile and SetupOp
  I'm about to add a third linked list, for seccomp programs, which would
  seem like too much duplication.
  - Handle argc == 0 better
  Unfortunately it's possible for argc to be 0, so error out pretty early
  on in that case. I don't think this is a security issue in this case.
  - Fix typo
  - Remove trailing whitespace
  - Fix spelling
  - bash: Fix shellcheck warnings
  - bash: Invoke bash using /usr/bin/env
  - bubblewrap: Avoid a -Wjump-misses-init false-positive
  When building with -Wjump-misses-init as part of a larger project, gcc
  reports that we jump past initialization of cover_proc_dirs. This is
  technically true, but we only use this variable in the case where it's
  initialized, so that's harmless.
  However, we can avoid this altogether by making the array static and
  constant, which allows it to be moved from initialized data to read-only
  data.
  - bind-mount: Be more const-correct
  When compiled with -Wwrite-strings as part of a larger project, gcc and
  clang both warn that we're assigning a string constant to a mutable
  struct member. There's actually no reason why it should be mutable, so
  make it const.
  - die_with_error: Save errno sooner
  We need to save errno immediately, otherwise it could be overwritten
  by a failing library call somewhere in the implementation of fprintf.
  - main: Warn when non-repeatable options are repeated
  A user might reasonably expect that `bwrap --seccomp 3 --seccomp 4 ...`
  would load seccomp programs from both fds 3 and 4, but in fact it only
  loads the program from fd 4.
  Helps: https://github.com/containers/bubblewrap/issues/453
  Resolves: https://github.com/containers/bubblewrap/issues/454
  - utils: Add warn()
  - Add SPDX-License-Identifier for files that already specify license
  This is a step towards REUSE compliance. Third-party files that we do
  not otherwise edit (git.mk, m4/attributes.m4) are excluded here.
  - tests: Use preferred spelling for SPDX license identifiers
  - Remove obsolete .travis.yml
  We no longer use Travis-CI.
  - Remove obsolete papr CI
  We no longer use this.</changelog>
  <changelog author="dimstar@opensuse.org" date="1652875200">- Update to version 0.6.2:
  + New features in Meson build:
  - Auto-detect whether the man page can be generated.
  - -Dbwrapdir=... changes the installation directory (useful
    when being used as a subproject).
  - -Dtests=false disables unit tests.
  + Bug fixes:
  - Add --add-seccomp-fd to shell completions
  - Document --add-seccomp-fd, --json-status-fd and --share-net
    in the man page
  - Add attributes to silence various compiler warnings
  - Allow compilation of tests with musl on mips architectures
  - Allow compilation with older glibc
  - Disable sanitizers for a test helper whose seccomp profile
    breaks the instrumentation
  - Disable AddressSanitizer leak detection where it interferes
    with unit testing</changelog>
  <changelog author="dmueller@suse.com" date="1670414400">- update to v0.7.0:
  * --size option controls the size of a subsequent --tmpfs (#509)
  * Better error messages if a mount operation fails (#472)
  * Better error message if creating the new user namespace fails with
    ENOSPC (#487)
  * When building as a Meson subproject, a RUNPATH can be set on the
    executable to make it easier to bundle its libcap dependency
  * Fix test failures when running as uid 0 but with limited capabilities
    (#510)
  * Use POSIX command -v in preference to non-standard which (#527)
  * Fix a copy/paste error in --help (#531)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1679918400">- update to v0.8.0:
  * Add --disable-userns option to prevent the sandbox from
    creating its own nested user namespace
  * Add --assert-userns-disabled option to check that an existing
    userns was created with --disable-userns
  * Give a clearer error message if the kernel doesn't have
    CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER</changelog>
</package>
<package pkgid="956c5d8498abc4c077421b5e4ad541e14673b103d12fe42da4c7bab0314ad278" name="bubblewrap" arch="x86_64">
  <version epoch="0" ver="0.8.0" rel="150500.3.3.1"/>
  <changelog author="klember@redhat.com" date="1473681600">- Update to 0.1.2</changelog>
  <changelog author="walters@verbum.org" date="1476446400">- New upstream version</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1481889600">- upgrade to upstream version 0.1.4
- Build also for Leap 42.2</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1488456000">- upgrade to upstream version 0.1.7
- note that this package was *never* affected by CVE-2017-5226
  as it was introduced in version 0.1.6
- upstream changelog of version 0.1.7:
    This release backs out the change in 0.1.6 which unconditionally
    called setsid() in order to fix a security issue with TIOCSTI, aka
    CVE-2017-522. That change caused some behavioural issues that are
    hard to work with in some cases. For instance, it makes shell job
    control not work for the bwrap command.
    Instead there is now a new option --new-session which works like
    0.1.6. It is recommended that you use this if possible, but if not we
    recommended that you neutralize this some other way, for instance
    using SECCOMP, which is what flatpak does:
    https://github.com/flatpak/flatpak/commit/902fb713990a8f968ea4350c7c2a27ff46f1a6c4
    In order to make it easy to create maximally safe sandboxes we have
    also added a new commandline switch called --unshare-all. It unshares
    all possible namespaces and is currently equivalent with:
  - -unshare-user-try --unshare-ipc --unshare-pid --unshare-net
  - -unshare-uts --unshare-cgroup-try
    However, the intent is that as new namespaces are added to the kernel they will
    be added to this list. Additionally, if --share-net is specified the network
    namespace is not unshared.
    This release also has some bugfixes:
    bwrap reaps (unexpected) children that are inherited from the
    parent, something which can happen if bwrap is part of a shell
    pipeline.
    bwrap clears the capability bounding set. The permitted
    capabilities was already empty, and use of PR_NO_NEW_PRIVS should
    make it impossible to increase the capabilities, but more
    layers of protection is better.
    The seccomp filter is now installed at the very end of bwrap, which
    means the requirement of the filter is minimal. Any bwrap seccomp
    filter must at least allow: execve, waitpid and write
    Alexander Larsson (7):
    Handle inherited children dying
    Clear capability bounding set
    Make the call to setsid() optional, with --new-session
    demos/bubblewrap-shell.sh: Unshare all namespaces
    Call setsid() and setexeccon() befor forking the init monitor
    Install seccomp filter at the very end
    Bump version to 0.1.7
    Colin Walters (6):
    Release 0.1.6
    man: Correct namespace user -&gt; mount
    demo/shell: Add /var/tmp compat symlink, tweak PS1, add more docs
    Release 0.1.6
    ci: Combine ASAN and UBSAN
    Add --unshare-all and --share-net
- upstream changelog for 0.1.6:
    This fixes a security issue with TIOCSTI, aka CVE-2017-522. Note bubblewrap is
    far from the only program that has this issue, and I think the best fix is
    probably in the kernel to support disabling this ioctl.
    Programs can also work around this by calling setsid() on their own in an exec
    handler before doing an exevp("bwrap").
- upstream changelog for 0.1.5:
    This is a bugfix release, here are the major changes:
    Running bubblewrap as root now works again
    Various fixes for the testsuite
    Use same default compiler warnings as ostree
    Handle errors resolving symlinks during bind mounts
    Alexander Larsson (2):
    bind-mount: Check for errors in realpath()
    Bump version to 0.1.5
    Colin Walters (6):
    Don't call capset() unless we need to
    Only --unshare-user automatically if we're not root
    ci: Modernize a bit, add f25-ubsan
    README.md: Update with better one liner and more information
    utils: Add __attribute__((printf)) to die()
    build: Sync default warning -&gt; error set from ostree
    Simon McVittie (4):
    test-run: be a bash script
    test-run: don't assume we are uid 1000
    Adapt tests so they can be run against installed binaries
    Fix incorrect nesting of backticks when finding a FUSE mount</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1495713600">- update to version 0.1.8
- New --die-with-parent which is based on the Linux prctl(PR_SET_PDEATHSIG) API.
- smaller bugfixes</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1499428800">- fix build macro with rpm &lt; 4.12 (non-Factory currently)</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1505736000">- add group</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1507550400">- update to version 0.2.0
  - bwrap now automatically detects the new
  user namespace restrictions in Red Hat Enterprise Linux 7.4:
  bubblewrap: check for max_user_namespaces == 0.
  - The most notable features are new arguments --as-pid1, and
  - -cap-add/--cap-drop. These were added for running systemd (or in general a
  "full" init system) inside bubblewrap. But the capability options are also
  useful for unprivileged callers to potentially retain capbilities inside the
  sandbox (for example CAP_NET_ADMIN), when user namespaces are enabled.
  Conversely, privileged callers (uid 0) can conversely drop capabilities (without
  user namespaces). Contributed by Giuseppe Scrivano.
  - With --dev, add /dev/fd and /dev/core symlinks
  which should improve compatibility with older software.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1525176000">- update to version 0.2.1:
  * All the demos are included
  * bugfixes for the demo files
  * There was an issue with mkdir when running bubblewrap on an NFS
  filesystem that has been fixed, so flatpak now works on NFS shares.
  * Some leaks have been fixed, including a file descriptor leak.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1531569600">- update to version 0.3.0:
  * The biggest feature from this release is that bwrap
    now supports being invoked recursively (from other container
    runtimes such as Docker/podman/runc as well as bwrap itself)
    when user namespaces are enabled, and the outer container manager
    allows it (Docker's default seccomp policy doesn't).
  * This is useful for testing scenarios; for example a project
    uses Kubernetes for its CI, but inside build the project wants to run
    each unit test in their own pid namespace, without going out
    and creating a new pod for every single unit test.
  * Similarly, rpm-ostree compose tree uses bwrap internally for scripts,
    and we want to support running rpm-ostree inside a container as well.
  * Another feature is bwrap now supports -- to terminate argument
    parsing. To detect availablity of this, you could parse bwrap --version.</changelog>
  <changelog author="alarrosa@suse.com" date="1539259200">- update to version 0.3.1:
  * New feature in this release is --bind-try (as well as --dev-bind-try
    and --ro-bind-try) which works like the regular versions if the source
    exists, but does nothing if it doesn't exist.
  * The mount type for the root tmpfs was also changed to "tmpfs" instead
    of being empty, as the later could cause problems with some programs
    when parsing the mountinfo files in /proc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1559390400">- Update to version 0.3.3:
  - This release is the same as 0.3.2 but the version number in configure.ac
  was accidentally still set to 0.3.1
- Update to version 0.3.2:
  - fixes boo#1136958 / CVE-2019-12439
  This release fixes a mostly theoretical security issue in unusual/broken
  setups where `$XDG_RUNTIME_DIR` is unset.
  There are some other smaller fixes, as well as an addition to the JSON
  API that allows reading the inner process exit code, separately from
  the `bwrap` exit code.
  - Print "Out of memory" on stderr, not stdout
  - bwrap: add option json-status-fd to show child exit code
  - bwrap: Report COMMAND exit code in json-status-fd
  - man page: Describe --chdir, not nonexistent --cwd
  - Don't create our own temporary mount point for pivot_root
  - Make lockdata long enough on 32-bit with 64-bit file pointers.</changelog>
  <changelog author="alarrosa@suse.com" date="1559908800">- Use /bin/bash instead of /usr/bin/bash in SLE12</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576843200">- Update to version 0.4.0:
  + The biggest feature in this release is the support for joining
    existing user and pid namespaces. This doesn't work in the
    setuid mode (at the moment).
  + Other changes:
  - Stores namespace info in status json.
  - In setuid mode pid 1 is now marked dumpable.
  - Now builds with musl libc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1585742400">- Update to version 0.4.1:
  * retcode: fix return code with syncfd and no event_fd
  * Ensure we're always clearing the cap bounding set
  * tests: Update output patterns for libcap &gt;= 2.29
  * Don't rely on geteuid() to know when to switch back from setuid root
  * Don't support --userns2 in setuid mode
  * fixes CVE-2020-5291
  * fixes bsc#1168291</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632139200">- Update to version 0.5.0:
  + New features:
  - --chmod changes permissions
  - --clearenv unsets every environment variable (except PWD)
  - --perms sets permissions for one subsequent --bind-data,
  - -dir, --file, --ro-bind-data or --tmpfs
  + Other enhancements:
  - Better diagnostics when a --bind or other bind-mount fails
  - zsh tab-completion
  - Better test coverage
  + Bug fixes:
  - Use Python 3 for tests and examples
  - Mount points for non-directories are created with permissions
  - r--r--r-- instead of -rw-rw-rw-
  - Don't remount items in /proc read-only if already EROFS,
    required to run under Docker
  - Allow mounting an non-directory over an existing
    non-directory, e.g. --bind "$XDG_RUNTIME_DIR/my-log-socket"
    /dev/log
  - Silence kernel messages for our bind-mounts
  - Make sure pkg-config is checked for, regardless of build
    options
  - Improve ability to bind-mount directories on case-insensitive
    filesystems
  - Fix -Wshadow warnings
  - Fix deprecation warnings with newer SELinux
- Add new subpackage bubblewrap-zsh-completion</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1646395200">- Update to 0.6.1:
  - Add a release checklist
  - completions: Make zsh completion non-executable
  The Autotools build system installed it with 0644 permissions because
  it's listed as DATA, but the Meson build system installs executable
  files as executable by default.
  zsh completions don't need to be executable to work, and this one doesn't
  have the `#!` marker that should start an executable script.
- update to 0.6.0:
  - meson: Improve compatibility with Meson 0.49
  That version doesn't allow more than two arguments for define_variable.
  - Disable test-specifying-pidns.sh under 'meson dist' while I investigate
  This test is hanging when run under 'meson dist' for some reason, but
  not when run under 'meson test', and not locally, only in the Github
  Workflow-based CI. Disable it for now.
  - meson: Actually build and run the tests
  - tests: Fix compiler warnings for unused arguments
  - meson: Run test scripts from $srcdir
  - meson: Make G_TEST_SRCDIR, G_TEST_BUILDDIR match Autotools
  - meson: Run the Python test script with Python, not bash
  The python build option can be used to swap to a different interpreter,
  for environments like the Steam Runtime where the python3 executable in
  the PATH is extremely old but there is a better interpreter available.
  This is treated as non-optional, because Meson is written in Python,
  so the situation where there is no Python interpreter at build-time
  shouldn't arise.
  - meson: Build the try-syscall helper
  - meson: Build tests with equivalent of -I$(top_srcdir) -I$(top_builddir)
  - meson.build: Remove unnecessary check for sh
  - Add a Meson build system
  This allows bwrap to be built as a subproject in larger Meson projects.
  When built as a subproject, we install into the --libexecdir and
  require a program prefix to be specified: for example, Flatpak would use
  program_prefix=flatpak- to get /usr/libexec/flatpak-bwrap. Verified to
  be backwards-compatible as far as Meson 0.49.0 (Debian 9 backports).
  Loosely based on previous work by Jussi Pakkanen (see #133).
  Differences between the Autotools and Meson builds:
  The Meson build requires a version of libcap that has pkg-config
  metadata (introduced in libcap 2.23, in 2013).
  The Meson build has no equivalent of --with-priv-mode=setuid. On
  distributions like Debian &lt;= 10 and RHEL &lt;= 7 that require a setuid bwrap
  executable, the sysadmin or distribution packaging will need to set the
  correct permissions on the bwrap executable; Debian already did this via
  packaging rather than the upstream build system.
  The Meson build supports being used as a subproject, and there is CI
  for this. It automatically disables shell completions and man pages,
  moves the bubblewrap executable to ${libexecdir}, and renames the
  bubblewrap executable according to a program_prefix option that the
  caller must specify (for example, Flatpak would use
  - Dprogram_prefix=flatpak- to get /usr/libexec/flatpak-bwrap). See the
  tests/use-as-subproject/ directory for an example.
  - Use HEAD to refer to other projects' default branches in documentation
  This makes the URL independent of the name they have chosen for their
  default branches.
  - workflows: Update for rename of default branch to main
  - tests: Exercise seccomp filters
  - Allow loading more than one seccomp program
  This will allow Flatpak to combine an allow-list (default-deny) of
  known system calls with a deny-list (default-allow) of system calls
  that are undesired.
  Resolves: https://github.com/containers/bubblewrap/issues/453
  - Generalize linked lists of LockFile and SetupOp
  I'm about to add a third linked list, for seccomp programs, which would
  seem like too much duplication.
  - Handle argc == 0 better
  Unfortunately it's possible for argc to be 0, so error out pretty early
  on in that case. I don't think this is a security issue in this case.
  - Fix typo
  - Remove trailing whitespace
  - Fix spelling
  - bash: Fix shellcheck warnings
  - bash: Invoke bash using /usr/bin/env
  - bubblewrap: Avoid a -Wjump-misses-init false-positive
  When building with -Wjump-misses-init as part of a larger project, gcc
  reports that we jump past initialization of cover_proc_dirs. This is
  technically true, but we only use this variable in the case where it's
  initialized, so that's harmless.
  However, we can avoid this altogether by making the array static and
  constant, which allows it to be moved from initialized data to read-only
  data.
  - bind-mount: Be more const-correct
  When compiled with -Wwrite-strings as part of a larger project, gcc and
  clang both warn that we're assigning a string constant to a mutable
  struct member. There's actually no reason why it should be mutable, so
  make it const.
  - die_with_error: Save errno sooner
  We need to save errno immediately, otherwise it could be overwritten
  by a failing library call somewhere in the implementation of fprintf.
  - main: Warn when non-repeatable options are repeated
  A user might reasonably expect that `bwrap --seccomp 3 --seccomp 4 ...`
  would load seccomp programs from both fds 3 and 4, but in fact it only
  loads the program from fd 4.
  Helps: https://github.com/containers/bubblewrap/issues/453
  Resolves: https://github.com/containers/bubblewrap/issues/454
  - utils: Add warn()
  - Add SPDX-License-Identifier for files that already specify license
  This is a step towards REUSE compliance. Third-party files that we do
  not otherwise edit (git.mk, m4/attributes.m4) are excluded here.
  - tests: Use preferred spelling for SPDX license identifiers
  - Remove obsolete .travis.yml
  We no longer use Travis-CI.
  - Remove obsolete papr CI
  We no longer use this.</changelog>
  <changelog author="dimstar@opensuse.org" date="1652875200">- Update to version 0.6.2:
  + New features in Meson build:
  - Auto-detect whether the man page can be generated.
  - -Dbwrapdir=... changes the installation directory (useful
    when being used as a subproject).
  - -Dtests=false disables unit tests.
  + Bug fixes:
  - Add --add-seccomp-fd to shell completions
  - Document --add-seccomp-fd, --json-status-fd and --share-net
    in the man page
  - Add attributes to silence various compiler warnings
  - Allow compilation of tests with musl on mips architectures
  - Allow compilation with older glibc
  - Disable sanitizers for a test helper whose seccomp profile
    breaks the instrumentation
  - Disable AddressSanitizer leak detection where it interferes
    with unit testing</changelog>
  <changelog author="dmueller@suse.com" date="1670414400">- update to v0.7.0:
  * --size option controls the size of a subsequent --tmpfs (#509)
  * Better error messages if a mount operation fails (#472)
  * Better error message if creating the new user namespace fails with
    ENOSPC (#487)
  * When building as a Meson subproject, a RUNPATH can be set on the
    executable to make it easier to bundle its libcap dependency
  * Fix test failures when running as uid 0 but with limited capabilities
    (#510)
  * Use POSIX command -v in preference to non-standard which (#527)
  * Fix a copy/paste error in --help (#531)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1679918400">- update to v0.8.0:
  * Add --disable-userns option to prevent the sandbox from
    creating its own nested user namespace
  * Add --assert-userns-disabled option to check that an existing
    userns was created with --disable-userns
  * Give a clearer error message if the kernel doesn't have
    CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER</changelog>
</package>
<package pkgid="2f878bc1f5178f1901dd414eb3921f0da4c18b67104f9ba30ecfbcc7e4cf87ed" name="bubblewrap" arch="aarch64">
  <version epoch="0" ver="0.8.0" rel="150500.3.6.1"/>
  <changelog author="walters@verbum.org" date="1476446400">- New upstream version</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1481889600">- upgrade to upstream version 0.1.4
- Build also for Leap 42.2</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1488456000">- upgrade to upstream version 0.1.7
- note that this package was *never* affected by CVE-2017-5226
  as it was introduced in version 0.1.6
- upstream changelog of version 0.1.7:
    This release backs out the change in 0.1.6 which unconditionally
    called setsid() in order to fix a security issue with TIOCSTI, aka
    CVE-2017-522. That change caused some behavioural issues that are
    hard to work with in some cases. For instance, it makes shell job
    control not work for the bwrap command.
    Instead there is now a new option --new-session which works like
    0.1.6. It is recommended that you use this if possible, but if not we
    recommended that you neutralize this some other way, for instance
    using SECCOMP, which is what flatpak does:
    https://github.com/flatpak/flatpak/commit/902fb713990a8f968ea4350c7c2a27ff46f1a6c4
    In order to make it easy to create maximally safe sandboxes we have
    also added a new commandline switch called --unshare-all. It unshares
    all possible namespaces and is currently equivalent with:
  - -unshare-user-try --unshare-ipc --unshare-pid --unshare-net
  - -unshare-uts --unshare-cgroup-try
    However, the intent is that as new namespaces are added to the kernel they will
    be added to this list. Additionally, if --share-net is specified the network
    namespace is not unshared.
    This release also has some bugfixes:
    bwrap reaps (unexpected) children that are inherited from the
    parent, something which can happen if bwrap is part of a shell
    pipeline.
    bwrap clears the capability bounding set. The permitted
    capabilities was already empty, and use of PR_NO_NEW_PRIVS should
    make it impossible to increase the capabilities, but more
    layers of protection is better.
    The seccomp filter is now installed at the very end of bwrap, which
    means the requirement of the filter is minimal. Any bwrap seccomp
    filter must at least allow: execve, waitpid and write
    Alexander Larsson (7):
    Handle inherited children dying
    Clear capability bounding set
    Make the call to setsid() optional, with --new-session
    demos/bubblewrap-shell.sh: Unshare all namespaces
    Call setsid() and setexeccon() befor forking the init monitor
    Install seccomp filter at the very end
    Bump version to 0.1.7
    Colin Walters (6):
    Release 0.1.6
    man: Correct namespace user -&gt; mount
    demo/shell: Add /var/tmp compat symlink, tweak PS1, add more docs
    Release 0.1.6
    ci: Combine ASAN and UBSAN
    Add --unshare-all and --share-net
- upstream changelog for 0.1.6:
    This fixes a security issue with TIOCSTI, aka CVE-2017-522. Note bubblewrap is
    far from the only program that has this issue, and I think the best fix is
    probably in the kernel to support disabling this ioctl.
    Programs can also work around this by calling setsid() on their own in an exec
    handler before doing an exevp("bwrap").
- upstream changelog for 0.1.5:
    This is a bugfix release, here are the major changes:
    Running bubblewrap as root now works again
    Various fixes for the testsuite
    Use same default compiler warnings as ostree
    Handle errors resolving symlinks during bind mounts
    Alexander Larsson (2):
    bind-mount: Check for errors in realpath()
    Bump version to 0.1.5
    Colin Walters (6):
    Don't call capset() unless we need to
    Only --unshare-user automatically if we're not root
    ci: Modernize a bit, add f25-ubsan
    README.md: Update with better one liner and more information
    utils: Add __attribute__((printf)) to die()
    build: Sync default warning -&gt; error set from ostree
    Simon McVittie (4):
    test-run: be a bash script
    test-run: don't assume we are uid 1000
    Adapt tests so they can be run against installed binaries
    Fix incorrect nesting of backticks when finding a FUSE mount</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1495713600">- update to version 0.1.8
- New --die-with-parent which is based on the Linux prctl(PR_SET_PDEATHSIG) API.
- smaller bugfixes</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1499428800">- fix build macro with rpm &lt; 4.12 (non-Factory currently)</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1505736000">- add group</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1507550400">- update to version 0.2.0
  - bwrap now automatically detects the new
  user namespace restrictions in Red Hat Enterprise Linux 7.4:
  bubblewrap: check for max_user_namespaces == 0.
  - The most notable features are new arguments --as-pid1, and
  - -cap-add/--cap-drop. These were added for running systemd (or in general a
  "full" init system) inside bubblewrap. But the capability options are also
  useful for unprivileged callers to potentially retain capbilities inside the
  sandbox (for example CAP_NET_ADMIN), when user namespaces are enabled.
  Conversely, privileged callers (uid 0) can conversely drop capabilities (without
  user namespaces). Contributed by Giuseppe Scrivano.
  - With --dev, add /dev/fd and /dev/core symlinks
  which should improve compatibility with older software.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1525176000">- update to version 0.2.1:
  * All the demos are included
  * bugfixes for the demo files
  * There was an issue with mkdir when running bubblewrap on an NFS
  filesystem that has been fixed, so flatpak now works on NFS shares.
  * Some leaks have been fixed, including a file descriptor leak.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1531569600">- update to version 0.3.0:
  * The biggest feature from this release is that bwrap
    now supports being invoked recursively (from other container
    runtimes such as Docker/podman/runc as well as bwrap itself)
    when user namespaces are enabled, and the outer container manager
    allows it (Docker's default seccomp policy doesn't).
  * This is useful for testing scenarios; for example a project
    uses Kubernetes for its CI, but inside build the project wants to run
    each unit test in their own pid namespace, without going out
    and creating a new pod for every single unit test.
  * Similarly, rpm-ostree compose tree uses bwrap internally for scripts,
    and we want to support running rpm-ostree inside a container as well.
  * Another feature is bwrap now supports -- to terminate argument
    parsing. To detect availablity of this, you could parse bwrap --version.</changelog>
  <changelog author="alarrosa@suse.com" date="1539259200">- update to version 0.3.1:
  * New feature in this release is --bind-try (as well as --dev-bind-try
    and --ro-bind-try) which works like the regular versions if the source
    exists, but does nothing if it doesn't exist.
  * The mount type for the root tmpfs was also changed to "tmpfs" instead
    of being empty, as the later could cause problems with some programs
    when parsing the mountinfo files in /proc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1559390400">- Update to version 0.3.3:
  - This release is the same as 0.3.2 but the version number in configure.ac
  was accidentally still set to 0.3.1
- Update to version 0.3.2:
  - fixes boo#1136958 / CVE-2019-12439
  This release fixes a mostly theoretical security issue in unusual/broken
  setups where `$XDG_RUNTIME_DIR` is unset.
  There are some other smaller fixes, as well as an addition to the JSON
  API that allows reading the inner process exit code, separately from
  the `bwrap` exit code.
  - Print "Out of memory" on stderr, not stdout
  - bwrap: add option json-status-fd to show child exit code
  - bwrap: Report COMMAND exit code in json-status-fd
  - man page: Describe --chdir, not nonexistent --cwd
  - Don't create our own temporary mount point for pivot_root
  - Make lockdata long enough on 32-bit with 64-bit file pointers.</changelog>
  <changelog author="alarrosa@suse.com" date="1559908800">- Use /bin/bash instead of /usr/bin/bash in SLE12</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576843200">- Update to version 0.4.0:
  + The biggest feature in this release is the support for joining
    existing user and pid namespaces. This doesn't work in the
    setuid mode (at the moment).
  + Other changes:
  - Stores namespace info in status json.
  - In setuid mode pid 1 is now marked dumpable.
  - Now builds with musl libc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1585742400">- Update to version 0.4.1:
  * retcode: fix return code with syncfd and no event_fd
  * Ensure we're always clearing the cap bounding set
  * tests: Update output patterns for libcap &gt;= 2.29
  * Don't rely on geteuid() to know when to switch back from setuid root
  * Don't support --userns2 in setuid mode
  * fixes CVE-2020-5291
  * fixes bsc#1168291</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632139200">- Update to version 0.5.0:
  + New features:
  - --chmod changes permissions
  - --clearenv unsets every environment variable (except PWD)
  - --perms sets permissions for one subsequent --bind-data,
  - -dir, --file, --ro-bind-data or --tmpfs
  + Other enhancements:
  - Better diagnostics when a --bind or other bind-mount fails
  - zsh tab-completion
  - Better test coverage
  + Bug fixes:
  - Use Python 3 for tests and examples
  - Mount points for non-directories are created with permissions
  - r--r--r-- instead of -rw-rw-rw-
  - Don't remount items in /proc read-only if already EROFS,
    required to run under Docker
  - Allow mounting an non-directory over an existing
    non-directory, e.g. --bind "$XDG_RUNTIME_DIR/my-log-socket"
    /dev/log
  - Silence kernel messages for our bind-mounts
  - Make sure pkg-config is checked for, regardless of build
    options
  - Improve ability to bind-mount directories on case-insensitive
    filesystems
  - Fix -Wshadow warnings
  - Fix deprecation warnings with newer SELinux
- Add new subpackage bubblewrap-zsh-completion</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1646395200">- Update to 0.6.1:
  - Add a release checklist
  - completions: Make zsh completion non-executable
  The Autotools build system installed it with 0644 permissions because
  it's listed as DATA, but the Meson build system installs executable
  files as executable by default.
  zsh completions don't need to be executable to work, and this one doesn't
  have the `#!` marker that should start an executable script.
- update to 0.6.0:
  - meson: Improve compatibility with Meson 0.49
  That version doesn't allow more than two arguments for define_variable.
  - Disable test-specifying-pidns.sh under 'meson dist' while I investigate
  This test is hanging when run under 'meson dist' for some reason, but
  not when run under 'meson test', and not locally, only in the Github
  Workflow-based CI. Disable it for now.
  - meson: Actually build and run the tests
  - tests: Fix compiler warnings for unused arguments
  - meson: Run test scripts from $srcdir
  - meson: Make G_TEST_SRCDIR, G_TEST_BUILDDIR match Autotools
  - meson: Run the Python test script with Python, not bash
  The python build option can be used to swap to a different interpreter,
  for environments like the Steam Runtime where the python3 executable in
  the PATH is extremely old but there is a better interpreter available.
  This is treated as non-optional, because Meson is written in Python,
  so the situation where there is no Python interpreter at build-time
  shouldn't arise.
  - meson: Build the try-syscall helper
  - meson: Build tests with equivalent of -I$(top_srcdir) -I$(top_builddir)
  - meson.build: Remove unnecessary check for sh
  - Add a Meson build system
  This allows bwrap to be built as a subproject in larger Meson projects.
  When built as a subproject, we install into the --libexecdir and
  require a program prefix to be specified: for example, Flatpak would use
  program_prefix=flatpak- to get /usr/libexec/flatpak-bwrap. Verified to
  be backwards-compatible as far as Meson 0.49.0 (Debian 9 backports).
  Loosely based on previous work by Jussi Pakkanen (see #133).
  Differences between the Autotools and Meson builds:
  The Meson build requires a version of libcap that has pkg-config
  metadata (introduced in libcap 2.23, in 2013).
  The Meson build has no equivalent of --with-priv-mode=setuid. On
  distributions like Debian &lt;= 10 and RHEL &lt;= 7 that require a setuid bwrap
  executable, the sysadmin or distribution packaging will need to set the
  correct permissions on the bwrap executable; Debian already did this via
  packaging rather than the upstream build system.
  The Meson build supports being used as a subproject, and there is CI
  for this. It automatically disables shell completions and man pages,
  moves the bubblewrap executable to ${libexecdir}, and renames the
  bubblewrap executable according to a program_prefix option that the
  caller must specify (for example, Flatpak would use
  - Dprogram_prefix=flatpak- to get /usr/libexec/flatpak-bwrap). See the
  tests/use-as-subproject/ directory for an example.
  - Use HEAD to refer to other projects' default branches in documentation
  This makes the URL independent of the name they have chosen for their
  default branches.
  - workflows: Update for rename of default branch to main
  - tests: Exercise seccomp filters
  - Allow loading more than one seccomp program
  This will allow Flatpak to combine an allow-list (default-deny) of
  known system calls with a deny-list (default-allow) of system calls
  that are undesired.
  Resolves: https://github.com/containers/bubblewrap/issues/453
  - Generalize linked lists of LockFile and SetupOp
  I'm about to add a third linked list, for seccomp programs, which would
  seem like too much duplication.
  - Handle argc == 0 better
  Unfortunately it's possible for argc to be 0, so error out pretty early
  on in that case. I don't think this is a security issue in this case.
  - Fix typo
  - Remove trailing whitespace
  - Fix spelling
  - bash: Fix shellcheck warnings
  - bash: Invoke bash using /usr/bin/env
  - bubblewrap: Avoid a -Wjump-misses-init false-positive
  When building with -Wjump-misses-init as part of a larger project, gcc
  reports that we jump past initialization of cover_proc_dirs. This is
  technically true, but we only use this variable in the case where it's
  initialized, so that's harmless.
  However, we can avoid this altogether by making the array static and
  constant, which allows it to be moved from initialized data to read-only
  data.
  - bind-mount: Be more const-correct
  When compiled with -Wwrite-strings as part of a larger project, gcc and
  clang both warn that we're assigning a string constant to a mutable
  struct member. There's actually no reason why it should be mutable, so
  make it const.
  - die_with_error: Save errno sooner
  We need to save errno immediately, otherwise it could be overwritten
  by a failing library call somewhere in the implementation of fprintf.
  - main: Warn when non-repeatable options are repeated
  A user might reasonably expect that `bwrap --seccomp 3 --seccomp 4 ...`
  would load seccomp programs from both fds 3 and 4, but in fact it only
  loads the program from fd 4.
  Helps: https://github.com/containers/bubblewrap/issues/453
  Resolves: https://github.com/containers/bubblewrap/issues/454
  - utils: Add warn()
  - Add SPDX-License-Identifier for files that already specify license
  This is a step towards REUSE compliance. Third-party files that we do
  not otherwise edit (git.mk, m4/attributes.m4) are excluded here.
  - tests: Use preferred spelling for SPDX license identifiers
  - Remove obsolete .travis.yml
  We no longer use Travis-CI.
  - Remove obsolete papr CI
  We no longer use this.</changelog>
  <changelog author="dimstar@opensuse.org" date="1652875200">- Update to version 0.6.2:
  + New features in Meson build:
  - Auto-detect whether the man page can be generated.
  - -Dbwrapdir=... changes the installation directory (useful
    when being used as a subproject).
  - -Dtests=false disables unit tests.
  + Bug fixes:
  - Add --add-seccomp-fd to shell completions
  - Document --add-seccomp-fd, --json-status-fd and --share-net
    in the man page
  - Add attributes to silence various compiler warnings
  - Allow compilation of tests with musl on mips architectures
  - Allow compilation with older glibc
  - Disable sanitizers for a test helper whose seccomp profile
    breaks the instrumentation
  - Disable AddressSanitizer leak detection where it interferes
    with unit testing</changelog>
  <changelog author="dmueller@suse.com" date="1670414400">- update to v0.7.0:
  * --size option controls the size of a subsequent --tmpfs (#509)
  * Better error messages if a mount operation fails (#472)
  * Better error message if creating the new user namespace fails with
    ENOSPC (#487)
  * When building as a Meson subproject, a RUNPATH can be set on the
    executable to make it easier to bundle its libcap dependency
  * Fix test failures when running as uid 0 but with limited capabilities
    (#510)
  * Use POSIX command -v in preference to non-standard which (#527)
  * Fix a copy/paste error in --help (#531)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1679918400">- update to v0.8.0:
  * Add --disable-userns option to prevent the sandbox from
    creating its own nested user namespace
  * Add --assert-userns-disabled option to check that an existing
    userns was created with --disable-userns
  * Give a clearer error message if the kernel doesn't have
    CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER</changelog>
  <changelog author="qzhao@suse.com" date="1724241600">- Add bubblewrap-CVE-2024-42472.patch:
  Backporting a253257c from upstream, Add --bind-fd and --ro-bind-fd
  to let you bind a O_PATH fd.
  (CVE-2024-42472, bsc#1229157)</changelog>
</package>
<package pkgid="60498e01c6e3ace4c16b2b92f9c3a47acc7240ea8f3c621de77cc6d667d3a961" name="bubblewrap" arch="ppc64le">
  <version epoch="0" ver="0.8.0" rel="150500.3.6.1"/>
  <changelog author="walters@verbum.org" date="1476446400">- New upstream version</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1481889600">- upgrade to upstream version 0.1.4
- Build also for Leap 42.2</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1488456000">- upgrade to upstream version 0.1.7
- note that this package was *never* affected by CVE-2017-5226
  as it was introduced in version 0.1.6
- upstream changelog of version 0.1.7:
    This release backs out the change in 0.1.6 which unconditionally
    called setsid() in order to fix a security issue with TIOCSTI, aka
    CVE-2017-522. That change caused some behavioural issues that are
    hard to work with in some cases. For instance, it makes shell job
    control not work for the bwrap command.
    Instead there is now a new option --new-session which works like
    0.1.6. It is recommended that you use this if possible, but if not we
    recommended that you neutralize this some other way, for instance
    using SECCOMP, which is what flatpak does:
    https://github.com/flatpak/flatpak/commit/902fb713990a8f968ea4350c7c2a27ff46f1a6c4
    In order to make it easy to create maximally safe sandboxes we have
    also added a new commandline switch called --unshare-all. It unshares
    all possible namespaces and is currently equivalent with:
  - -unshare-user-try --unshare-ipc --unshare-pid --unshare-net
  - -unshare-uts --unshare-cgroup-try
    However, the intent is that as new namespaces are added to the kernel they will
    be added to this list. Additionally, if --share-net is specified the network
    namespace is not unshared.
    This release also has some bugfixes:
    bwrap reaps (unexpected) children that are inherited from the
    parent, something which can happen if bwrap is part of a shell
    pipeline.
    bwrap clears the capability bounding set. The permitted
    capabilities was already empty, and use of PR_NO_NEW_PRIVS should
    make it impossible to increase the capabilities, but more
    layers of protection is better.
    The seccomp filter is now installed at the very end of bwrap, which
    means the requirement of the filter is minimal. Any bwrap seccomp
    filter must at least allow: execve, waitpid and write
    Alexander Larsson (7):
    Handle inherited children dying
    Clear capability bounding set
    Make the call to setsid() optional, with --new-session
    demos/bubblewrap-shell.sh: Unshare all namespaces
    Call setsid() and setexeccon() befor forking the init monitor
    Install seccomp filter at the very end
    Bump version to 0.1.7
    Colin Walters (6):
    Release 0.1.6
    man: Correct namespace user -&gt; mount
    demo/shell: Add /var/tmp compat symlink, tweak PS1, add more docs
    Release 0.1.6
    ci: Combine ASAN and UBSAN
    Add --unshare-all and --share-net
- upstream changelog for 0.1.6:
    This fixes a security issue with TIOCSTI, aka CVE-2017-522. Note bubblewrap is
    far from the only program that has this issue, and I think the best fix is
    probably in the kernel to support disabling this ioctl.
    Programs can also work around this by calling setsid() on their own in an exec
    handler before doing an exevp("bwrap").
- upstream changelog for 0.1.5:
    This is a bugfix release, here are the major changes:
    Running bubblewrap as root now works again
    Various fixes for the testsuite
    Use same default compiler warnings as ostree
    Handle errors resolving symlinks during bind mounts
    Alexander Larsson (2):
    bind-mount: Check for errors in realpath()
    Bump version to 0.1.5
    Colin Walters (6):
    Don't call capset() unless we need to
    Only --unshare-user automatically if we're not root
    ci: Modernize a bit, add f25-ubsan
    README.md: Update with better one liner and more information
    utils: Add __attribute__((printf)) to die()
    build: Sync default warning -&gt; error set from ostree
    Simon McVittie (4):
    test-run: be a bash script
    test-run: don't assume we are uid 1000
    Adapt tests so they can be run against installed binaries
    Fix incorrect nesting of backticks when finding a FUSE mount</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1495713600">- update to version 0.1.8
- New --die-with-parent which is based on the Linux prctl(PR_SET_PDEATHSIG) API.
- smaller bugfixes</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1499428800">- fix build macro with rpm &lt; 4.12 (non-Factory currently)</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1505736000">- add group</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1507550400">- update to version 0.2.0
  - bwrap now automatically detects the new
  user namespace restrictions in Red Hat Enterprise Linux 7.4:
  bubblewrap: check for max_user_namespaces == 0.
  - The most notable features are new arguments --as-pid1, and
  - -cap-add/--cap-drop. These were added for running systemd (or in general a
  "full" init system) inside bubblewrap. But the capability options are also
  useful for unprivileged callers to potentially retain capbilities inside the
  sandbox (for example CAP_NET_ADMIN), when user namespaces are enabled.
  Conversely, privileged callers (uid 0) can conversely drop capabilities (without
  user namespaces). Contributed by Giuseppe Scrivano.
  - With --dev, add /dev/fd and /dev/core symlinks
  which should improve compatibility with older software.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1525176000">- update to version 0.2.1:
  * All the demos are included
  * bugfixes for the demo files
  * There was an issue with mkdir when running bubblewrap on an NFS
  filesystem that has been fixed, so flatpak now works on NFS shares.
  * Some leaks have been fixed, including a file descriptor leak.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1531569600">- update to version 0.3.0:
  * The biggest feature from this release is that bwrap
    now supports being invoked recursively (from other container
    runtimes such as Docker/podman/runc as well as bwrap itself)
    when user namespaces are enabled, and the outer container manager
    allows it (Docker's default seccomp policy doesn't).
  * This is useful for testing scenarios; for example a project
    uses Kubernetes for its CI, but inside build the project wants to run
    each unit test in their own pid namespace, without going out
    and creating a new pod for every single unit test.
  * Similarly, rpm-ostree compose tree uses bwrap internally for scripts,
    and we want to support running rpm-ostree inside a container as well.
  * Another feature is bwrap now supports -- to terminate argument
    parsing. To detect availablity of this, you could parse bwrap --version.</changelog>
  <changelog author="alarrosa@suse.com" date="1539259200">- update to version 0.3.1:
  * New feature in this release is --bind-try (as well as --dev-bind-try
    and --ro-bind-try) which works like the regular versions if the source
    exists, but does nothing if it doesn't exist.
  * The mount type for the root tmpfs was also changed to "tmpfs" instead
    of being empty, as the later could cause problems with some programs
    when parsing the mountinfo files in /proc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1559390400">- Update to version 0.3.3:
  - This release is the same as 0.3.2 but the version number in configure.ac
  was accidentally still set to 0.3.1
- Update to version 0.3.2:
  - fixes boo#1136958 / CVE-2019-12439
  This release fixes a mostly theoretical security issue in unusual/broken
  setups where `$XDG_RUNTIME_DIR` is unset.
  There are some other smaller fixes, as well as an addition to the JSON
  API that allows reading the inner process exit code, separately from
  the `bwrap` exit code.
  - Print "Out of memory" on stderr, not stdout
  - bwrap: add option json-status-fd to show child exit code
  - bwrap: Report COMMAND exit code in json-status-fd
  - man page: Describe --chdir, not nonexistent --cwd
  - Don't create our own temporary mount point for pivot_root
  - Make lockdata long enough on 32-bit with 64-bit file pointers.</changelog>
  <changelog author="alarrosa@suse.com" date="1559908800">- Use /bin/bash instead of /usr/bin/bash in SLE12</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576843200">- Update to version 0.4.0:
  + The biggest feature in this release is the support for joining
    existing user and pid namespaces. This doesn't work in the
    setuid mode (at the moment).
  + Other changes:
  - Stores namespace info in status json.
  - In setuid mode pid 1 is now marked dumpable.
  - Now builds with musl libc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1585742400">- Update to version 0.4.1:
  * retcode: fix return code with syncfd and no event_fd
  * Ensure we're always clearing the cap bounding set
  * tests: Update output patterns for libcap &gt;= 2.29
  * Don't rely on geteuid() to know when to switch back from setuid root
  * Don't support --userns2 in setuid mode
  * fixes CVE-2020-5291
  * fixes bsc#1168291</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632139200">- Update to version 0.5.0:
  + New features:
  - --chmod changes permissions
  - --clearenv unsets every environment variable (except PWD)
  - --perms sets permissions for one subsequent --bind-data,
  - -dir, --file, --ro-bind-data or --tmpfs
  + Other enhancements:
  - Better diagnostics when a --bind or other bind-mount fails
  - zsh tab-completion
  - Better test coverage
  + Bug fixes:
  - Use Python 3 for tests and examples
  - Mount points for non-directories are created with permissions
  - r--r--r-- instead of -rw-rw-rw-
  - Don't remount items in /proc read-only if already EROFS,
    required to run under Docker
  - Allow mounting an non-directory over an existing
    non-directory, e.g. --bind "$XDG_RUNTIME_DIR/my-log-socket"
    /dev/log
  - Silence kernel messages for our bind-mounts
  - Make sure pkg-config is checked for, regardless of build
    options
  - Improve ability to bind-mount directories on case-insensitive
    filesystems
  - Fix -Wshadow warnings
  - Fix deprecation warnings with newer SELinux
- Add new subpackage bubblewrap-zsh-completion</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1646395200">- Update to 0.6.1:
  - Add a release checklist
  - completions: Make zsh completion non-executable
  The Autotools build system installed it with 0644 permissions because
  it's listed as DATA, but the Meson build system installs executable
  files as executable by default.
  zsh completions don't need to be executable to work, and this one doesn't
  have the `#!` marker that should start an executable script.
- update to 0.6.0:
  - meson: Improve compatibility with Meson 0.49
  That version doesn't allow more than two arguments for define_variable.
  - Disable test-specifying-pidns.sh under 'meson dist' while I investigate
  This test is hanging when run under 'meson dist' for some reason, but
  not when run under 'meson test', and not locally, only in the Github
  Workflow-based CI. Disable it for now.
  - meson: Actually build and run the tests
  - tests: Fix compiler warnings for unused arguments
  - meson: Run test scripts from $srcdir
  - meson: Make G_TEST_SRCDIR, G_TEST_BUILDDIR match Autotools
  - meson: Run the Python test script with Python, not bash
  The python build option can be used to swap to a different interpreter,
  for environments like the Steam Runtime where the python3 executable in
  the PATH is extremely old but there is a better interpreter available.
  This is treated as non-optional, because Meson is written in Python,
  so the situation where there is no Python interpreter at build-time
  shouldn't arise.
  - meson: Build the try-syscall helper
  - meson: Build tests with equivalent of -I$(top_srcdir) -I$(top_builddir)
  - meson.build: Remove unnecessary check for sh
  - Add a Meson build system
  This allows bwrap to be built as a subproject in larger Meson projects.
  When built as a subproject, we install into the --libexecdir and
  require a program prefix to be specified: for example, Flatpak would use
  program_prefix=flatpak- to get /usr/libexec/flatpak-bwrap. Verified to
  be backwards-compatible as far as Meson 0.49.0 (Debian 9 backports).
  Loosely based on previous work by Jussi Pakkanen (see #133).
  Differences between the Autotools and Meson builds:
  The Meson build requires a version of libcap that has pkg-config
  metadata (introduced in libcap 2.23, in 2013).
  The Meson build has no equivalent of --with-priv-mode=setuid. On
  distributions like Debian &lt;= 10 and RHEL &lt;= 7 that require a setuid bwrap
  executable, the sysadmin or distribution packaging will need to set the
  correct permissions on the bwrap executable; Debian already did this via
  packaging rather than the upstream build system.
  The Meson build supports being used as a subproject, and there is CI
  for this. It automatically disables shell completions and man pages,
  moves the bubblewrap executable to ${libexecdir}, and renames the
  bubblewrap executable according to a program_prefix option that the
  caller must specify (for example, Flatpak would use
  - Dprogram_prefix=flatpak- to get /usr/libexec/flatpak-bwrap). See the
  tests/use-as-subproject/ directory for an example.
  - Use HEAD to refer to other projects' default branches in documentation
  This makes the URL independent of the name they have chosen for their
  default branches.
  - workflows: Update for rename of default branch to main
  - tests: Exercise seccomp filters
  - Allow loading more than one seccomp program
  This will allow Flatpak to combine an allow-list (default-deny) of
  known system calls with a deny-list (default-allow) of system calls
  that are undesired.
  Resolves: https://github.com/containers/bubblewrap/issues/453
  - Generalize linked lists of LockFile and SetupOp
  I'm about to add a third linked list, for seccomp programs, which would
  seem like too much duplication.
  - Handle argc == 0 better
  Unfortunately it's possible for argc to be 0, so error out pretty early
  on in that case. I don't think this is a security issue in this case.
  - Fix typo
  - Remove trailing whitespace
  - Fix spelling
  - bash: Fix shellcheck warnings
  - bash: Invoke bash using /usr/bin/env
  - bubblewrap: Avoid a -Wjump-misses-init false-positive
  When building with -Wjump-misses-init as part of a larger project, gcc
  reports that we jump past initialization of cover_proc_dirs. This is
  technically true, but we only use this variable in the case where it's
  initialized, so that's harmless.
  However, we can avoid this altogether by making the array static and
  constant, which allows it to be moved from initialized data to read-only
  data.
  - bind-mount: Be more const-correct
  When compiled with -Wwrite-strings as part of a larger project, gcc and
  clang both warn that we're assigning a string constant to a mutable
  struct member. There's actually no reason why it should be mutable, so
  make it const.
  - die_with_error: Save errno sooner
  We need to save errno immediately, otherwise it could be overwritten
  by a failing library call somewhere in the implementation of fprintf.
  - main: Warn when non-repeatable options are repeated
  A user might reasonably expect that `bwrap --seccomp 3 --seccomp 4 ...`
  would load seccomp programs from both fds 3 and 4, but in fact it only
  loads the program from fd 4.
  Helps: https://github.com/containers/bubblewrap/issues/453
  Resolves: https://github.com/containers/bubblewrap/issues/454
  - utils: Add warn()
  - Add SPDX-License-Identifier for files that already specify license
  This is a step towards REUSE compliance. Third-party files that we do
  not otherwise edit (git.mk, m4/attributes.m4) are excluded here.
  - tests: Use preferred spelling for SPDX license identifiers
  - Remove obsolete .travis.yml
  We no longer use Travis-CI.
  - Remove obsolete papr CI
  We no longer use this.</changelog>
  <changelog author="dimstar@opensuse.org" date="1652875200">- Update to version 0.6.2:
  + New features in Meson build:
  - Auto-detect whether the man page can be generated.
  - -Dbwrapdir=... changes the installation directory (useful
    when being used as a subproject).
  - -Dtests=false disables unit tests.
  + Bug fixes:
  - Add --add-seccomp-fd to shell completions
  - Document --add-seccomp-fd, --json-status-fd and --share-net
    in the man page
  - Add attributes to silence various compiler warnings
  - Allow compilation of tests with musl on mips architectures
  - Allow compilation with older glibc
  - Disable sanitizers for a test helper whose seccomp profile
    breaks the instrumentation
  - Disable AddressSanitizer leak detection where it interferes
    with unit testing</changelog>
  <changelog author="dmueller@suse.com" date="1670414400">- update to v0.7.0:
  * --size option controls the size of a subsequent --tmpfs (#509)
  * Better error messages if a mount operation fails (#472)
  * Better error message if creating the new user namespace fails with
    ENOSPC (#487)
  * When building as a Meson subproject, a RUNPATH can be set on the
    executable to make it easier to bundle its libcap dependency
  * Fix test failures when running as uid 0 but with limited capabilities
    (#510)
  * Use POSIX command -v in preference to non-standard which (#527)
  * Fix a copy/paste error in --help (#531)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1679918400">- update to v0.8.0:
  * Add --disable-userns option to prevent the sandbox from
    creating its own nested user namespace
  * Add --assert-userns-disabled option to check that an existing
    userns was created with --disable-userns
  * Give a clearer error message if the kernel doesn't have
    CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER</changelog>
  <changelog author="qzhao@suse.com" date="1724241600">- Add bubblewrap-CVE-2024-42472.patch:
  Backporting a253257c from upstream, Add --bind-fd and --ro-bind-fd
  to let you bind a O_PATH fd.
  (CVE-2024-42472, bsc#1229157)</changelog>
</package>
<package pkgid="1cea970bb32a96b3c048d7536542e89d69365aef608baba4a7ab11028ef989b0" name="bubblewrap" arch="s390x">
  <version epoch="0" ver="0.8.0" rel="150500.3.6.1"/>
  <changelog author="walters@verbum.org" date="1476446400">- New upstream version</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1481889600">- upgrade to upstream version 0.1.4
- Build also for Leap 42.2</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1488456000">- upgrade to upstream version 0.1.7
- note that this package was *never* affected by CVE-2017-5226
  as it was introduced in version 0.1.6
- upstream changelog of version 0.1.7:
    This release backs out the change in 0.1.6 which unconditionally
    called setsid() in order to fix a security issue with TIOCSTI, aka
    CVE-2017-522. That change caused some behavioural issues that are
    hard to work with in some cases. For instance, it makes shell job
    control not work for the bwrap command.
    Instead there is now a new option --new-session which works like
    0.1.6. It is recommended that you use this if possible, but if not we
    recommended that you neutralize this some other way, for instance
    using SECCOMP, which is what flatpak does:
    https://github.com/flatpak/flatpak/commit/902fb713990a8f968ea4350c7c2a27ff46f1a6c4
    In order to make it easy to create maximally safe sandboxes we have
    also added a new commandline switch called --unshare-all. It unshares
    all possible namespaces and is currently equivalent with:
  - -unshare-user-try --unshare-ipc --unshare-pid --unshare-net
  - -unshare-uts --unshare-cgroup-try
    However, the intent is that as new namespaces are added to the kernel they will
    be added to this list. Additionally, if --share-net is specified the network
    namespace is not unshared.
    This release also has some bugfixes:
    bwrap reaps (unexpected) children that are inherited from the
    parent, something which can happen if bwrap is part of a shell
    pipeline.
    bwrap clears the capability bounding set. The permitted
    capabilities was already empty, and use of PR_NO_NEW_PRIVS should
    make it impossible to increase the capabilities, but more
    layers of protection is better.
    The seccomp filter is now installed at the very end of bwrap, which
    means the requirement of the filter is minimal. Any bwrap seccomp
    filter must at least allow: execve, waitpid and write
    Alexander Larsson (7):
    Handle inherited children dying
    Clear capability bounding set
    Make the call to setsid() optional, with --new-session
    demos/bubblewrap-shell.sh: Unshare all namespaces
    Call setsid() and setexeccon() befor forking the init monitor
    Install seccomp filter at the very end
    Bump version to 0.1.7
    Colin Walters (6):
    Release 0.1.6
    man: Correct namespace user -&gt; mount
    demo/shell: Add /var/tmp compat symlink, tweak PS1, add more docs
    Release 0.1.6
    ci: Combine ASAN and UBSAN
    Add --unshare-all and --share-net
- upstream changelog for 0.1.6:
    This fixes a security issue with TIOCSTI, aka CVE-2017-522. Note bubblewrap is
    far from the only program that has this issue, and I think the best fix is
    probably in the kernel to support disabling this ioctl.
    Programs can also work around this by calling setsid() on their own in an exec
    handler before doing an exevp("bwrap").
- upstream changelog for 0.1.5:
    This is a bugfix release, here are the major changes:
    Running bubblewrap as root now works again
    Various fixes for the testsuite
    Use same default compiler warnings as ostree
    Handle errors resolving symlinks during bind mounts
    Alexander Larsson (2):
    bind-mount: Check for errors in realpath()
    Bump version to 0.1.5
    Colin Walters (6):
    Don't call capset() unless we need to
    Only --unshare-user automatically if we're not root
    ci: Modernize a bit, add f25-ubsan
    README.md: Update with better one liner and more information
    utils: Add __attribute__((printf)) to die()
    build: Sync default warning -&gt; error set from ostree
    Simon McVittie (4):
    test-run: be a bash script
    test-run: don't assume we are uid 1000
    Adapt tests so they can be run against installed binaries
    Fix incorrect nesting of backticks when finding a FUSE mount</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1495713600">- update to version 0.1.8
- New --die-with-parent which is based on the Linux prctl(PR_SET_PDEATHSIG) API.
- smaller bugfixes</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1499428800">- fix build macro with rpm &lt; 4.12 (non-Factory currently)</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1505736000">- add group</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1507550400">- update to version 0.2.0
  - bwrap now automatically detects the new
  user namespace restrictions in Red Hat Enterprise Linux 7.4:
  bubblewrap: check for max_user_namespaces == 0.
  - The most notable features are new arguments --as-pid1, and
  - -cap-add/--cap-drop. These were added for running systemd (or in general a
  "full" init system) inside bubblewrap. But the capability options are also
  useful for unprivileged callers to potentially retain capbilities inside the
  sandbox (for example CAP_NET_ADMIN), when user namespaces are enabled.
  Conversely, privileged callers (uid 0) can conversely drop capabilities (without
  user namespaces). Contributed by Giuseppe Scrivano.
  - With --dev, add /dev/fd and /dev/core symlinks
  which should improve compatibility with older software.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1525176000">- update to version 0.2.1:
  * All the demos are included
  * bugfixes for the demo files
  * There was an issue with mkdir when running bubblewrap on an NFS
  filesystem that has been fixed, so flatpak now works on NFS shares.
  * Some leaks have been fixed, including a file descriptor leak.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1531569600">- update to version 0.3.0:
  * The biggest feature from this release is that bwrap
    now supports being invoked recursively (from other container
    runtimes such as Docker/podman/runc as well as bwrap itself)
    when user namespaces are enabled, and the outer container manager
    allows it (Docker's default seccomp policy doesn't).
  * This is useful for testing scenarios; for example a project
    uses Kubernetes for its CI, but inside build the project wants to run
    each unit test in their own pid namespace, without going out
    and creating a new pod for every single unit test.
  * Similarly, rpm-ostree compose tree uses bwrap internally for scripts,
    and we want to support running rpm-ostree inside a container as well.
  * Another feature is bwrap now supports -- to terminate argument
    parsing. To detect availablity of this, you could parse bwrap --version.</changelog>
  <changelog author="alarrosa@suse.com" date="1539259200">- update to version 0.3.1:
  * New feature in this release is --bind-try (as well as --dev-bind-try
    and --ro-bind-try) which works like the regular versions if the source
    exists, but does nothing if it doesn't exist.
  * The mount type for the root tmpfs was also changed to "tmpfs" instead
    of being empty, as the later could cause problems with some programs
    when parsing the mountinfo files in /proc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1559390400">- Update to version 0.3.3:
  - This release is the same as 0.3.2 but the version number in configure.ac
  was accidentally still set to 0.3.1
- Update to version 0.3.2:
  - fixes boo#1136958 / CVE-2019-12439
  This release fixes a mostly theoretical security issue in unusual/broken
  setups where `$XDG_RUNTIME_DIR` is unset.
  There are some other smaller fixes, as well as an addition to the JSON
  API that allows reading the inner process exit code, separately from
  the `bwrap` exit code.
  - Print "Out of memory" on stderr, not stdout
  - bwrap: add option json-status-fd to show child exit code
  - bwrap: Report COMMAND exit code in json-status-fd
  - man page: Describe --chdir, not nonexistent --cwd
  - Don't create our own temporary mount point for pivot_root
  - Make lockdata long enough on 32-bit with 64-bit file pointers.</changelog>
  <changelog author="alarrosa@suse.com" date="1559908800">- Use /bin/bash instead of /usr/bin/bash in SLE12</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576843200">- Update to version 0.4.0:
  + The biggest feature in this release is the support for joining
    existing user and pid namespaces. This doesn't work in the
    setuid mode (at the moment).
  + Other changes:
  - Stores namespace info in status json.
  - In setuid mode pid 1 is now marked dumpable.
  - Now builds with musl libc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1585742400">- Update to version 0.4.1:
  * retcode: fix return code with syncfd and no event_fd
  * Ensure we're always clearing the cap bounding set
  * tests: Update output patterns for libcap &gt;= 2.29
  * Don't rely on geteuid() to know when to switch back from setuid root
  * Don't support --userns2 in setuid mode
  * fixes CVE-2020-5291
  * fixes bsc#1168291</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632139200">- Update to version 0.5.0:
  + New features:
  - --chmod changes permissions
  - --clearenv unsets every environment variable (except PWD)
  - --perms sets permissions for one subsequent --bind-data,
  - -dir, --file, --ro-bind-data or --tmpfs
  + Other enhancements:
  - Better diagnostics when a --bind or other bind-mount fails
  - zsh tab-completion
  - Better test coverage
  + Bug fixes:
  - Use Python 3 for tests and examples
  - Mount points for non-directories are created with permissions
  - r--r--r-- instead of -rw-rw-rw-
  - Don't remount items in /proc read-only if already EROFS,
    required to run under Docker
  - Allow mounting an non-directory over an existing
    non-directory, e.g. --bind "$XDG_RUNTIME_DIR/my-log-socket"
    /dev/log
  - Silence kernel messages for our bind-mounts
  - Make sure pkg-config is checked for, regardless of build
    options
  - Improve ability to bind-mount directories on case-insensitive
    filesystems
  - Fix -Wshadow warnings
  - Fix deprecation warnings with newer SELinux
- Add new subpackage bubblewrap-zsh-completion</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1646395200">- Update to 0.6.1:
  - Add a release checklist
  - completions: Make zsh completion non-executable
  The Autotools build system installed it with 0644 permissions because
  it's listed as DATA, but the Meson build system installs executable
  files as executable by default.
  zsh completions don't need to be executable to work, and this one doesn't
  have the `#!` marker that should start an executable script.
- update to 0.6.0:
  - meson: Improve compatibility with Meson 0.49
  That version doesn't allow more than two arguments for define_variable.
  - Disable test-specifying-pidns.sh under 'meson dist' while I investigate
  This test is hanging when run under 'meson dist' for some reason, but
  not when run under 'meson test', and not locally, only in the Github
  Workflow-based CI. Disable it for now.
  - meson: Actually build and run the tests
  - tests: Fix compiler warnings for unused arguments
  - meson: Run test scripts from $srcdir
  - meson: Make G_TEST_SRCDIR, G_TEST_BUILDDIR match Autotools
  - meson: Run the Python test script with Python, not bash
  The python build option can be used to swap to a different interpreter,
  for environments like the Steam Runtime where the python3 executable in
  the PATH is extremely old but there is a better interpreter available.
  This is treated as non-optional, because Meson is written in Python,
  so the situation where there is no Python interpreter at build-time
  shouldn't arise.
  - meson: Build the try-syscall helper
  - meson: Build tests with equivalent of -I$(top_srcdir) -I$(top_builddir)
  - meson.build: Remove unnecessary check for sh
  - Add a Meson build system
  This allows bwrap to be built as a subproject in larger Meson projects.
  When built as a subproject, we install into the --libexecdir and
  require a program prefix to be specified: for example, Flatpak would use
  program_prefix=flatpak- to get /usr/libexec/flatpak-bwrap. Verified to
  be backwards-compatible as far as Meson 0.49.0 (Debian 9 backports).
  Loosely based on previous work by Jussi Pakkanen (see #133).
  Differences between the Autotools and Meson builds:
  The Meson build requires a version of libcap that has pkg-config
  metadata (introduced in libcap 2.23, in 2013).
  The Meson build has no equivalent of --with-priv-mode=setuid. On
  distributions like Debian &lt;= 10 and RHEL &lt;= 7 that require a setuid bwrap
  executable, the sysadmin or distribution packaging will need to set the
  correct permissions on the bwrap executable; Debian already did this via
  packaging rather than the upstream build system.
  The Meson build supports being used as a subproject, and there is CI
  for this. It automatically disables shell completions and man pages,
  moves the bubblewrap executable to ${libexecdir}, and renames the
  bubblewrap executable according to a program_prefix option that the
  caller must specify (for example, Flatpak would use
  - Dprogram_prefix=flatpak- to get /usr/libexec/flatpak-bwrap). See the
  tests/use-as-subproject/ directory for an example.
  - Use HEAD to refer to other projects' default branches in documentation
  This makes the URL independent of the name they have chosen for their
  default branches.
  - workflows: Update for rename of default branch to main
  - tests: Exercise seccomp filters
  - Allow loading more than one seccomp program
  This will allow Flatpak to combine an allow-list (default-deny) of
  known system calls with a deny-list (default-allow) of system calls
  that are undesired.
  Resolves: https://github.com/containers/bubblewrap/issues/453
  - Generalize linked lists of LockFile and SetupOp
  I'm about to add a third linked list, for seccomp programs, which would
  seem like too much duplication.
  - Handle argc == 0 better
  Unfortunately it's possible for argc to be 0, so error out pretty early
  on in that case. I don't think this is a security issue in this case.
  - Fix typo
  - Remove trailing whitespace
  - Fix spelling
  - bash: Fix shellcheck warnings
  - bash: Invoke bash using /usr/bin/env
  - bubblewrap: Avoid a -Wjump-misses-init false-positive
  When building with -Wjump-misses-init as part of a larger project, gcc
  reports that we jump past initialization of cover_proc_dirs. This is
  technically true, but we only use this variable in the case where it's
  initialized, so that's harmless.
  However, we can avoid this altogether by making the array static and
  constant, which allows it to be moved from initialized data to read-only
  data.
  - bind-mount: Be more const-correct
  When compiled with -Wwrite-strings as part of a larger project, gcc and
  clang both warn that we're assigning a string constant to a mutable
  struct member. There's actually no reason why it should be mutable, so
  make it const.
  - die_with_error: Save errno sooner
  We need to save errno immediately, otherwise it could be overwritten
  by a failing library call somewhere in the implementation of fprintf.
  - main: Warn when non-repeatable options are repeated
  A user might reasonably expect that `bwrap --seccomp 3 --seccomp 4 ...`
  would load seccomp programs from both fds 3 and 4, but in fact it only
  loads the program from fd 4.
  Helps: https://github.com/containers/bubblewrap/issues/453
  Resolves: https://github.com/containers/bubblewrap/issues/454
  - utils: Add warn()
  - Add SPDX-License-Identifier for files that already specify license
  This is a step towards REUSE compliance. Third-party files that we do
  not otherwise edit (git.mk, m4/attributes.m4) are excluded here.
  - tests: Use preferred spelling for SPDX license identifiers
  - Remove obsolete .travis.yml
  We no longer use Travis-CI.
  - Remove obsolete papr CI
  We no longer use this.</changelog>
  <changelog author="dimstar@opensuse.org" date="1652875200">- Update to version 0.6.2:
  + New features in Meson build:
  - Auto-detect whether the man page can be generated.
  - -Dbwrapdir=... changes the installation directory (useful
    when being used as a subproject).
  - -Dtests=false disables unit tests.
  + Bug fixes:
  - Add --add-seccomp-fd to shell completions
  - Document --add-seccomp-fd, --json-status-fd and --share-net
    in the man page
  - Add attributes to silence various compiler warnings
  - Allow compilation of tests with musl on mips architectures
  - Allow compilation with older glibc
  - Disable sanitizers for a test helper whose seccomp profile
    breaks the instrumentation
  - Disable AddressSanitizer leak detection where it interferes
    with unit testing</changelog>
  <changelog author="dmueller@suse.com" date="1670414400">- update to v0.7.0:
  * --size option controls the size of a subsequent --tmpfs (#509)
  * Better error messages if a mount operation fails (#472)
  * Better error message if creating the new user namespace fails with
    ENOSPC (#487)
  * When building as a Meson subproject, a RUNPATH can be set on the
    executable to make it easier to bundle its libcap dependency
  * Fix test failures when running as uid 0 but with limited capabilities
    (#510)
  * Use POSIX command -v in preference to non-standard which (#527)
  * Fix a copy/paste error in --help (#531)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1679918400">- update to v0.8.0:
  * Add --disable-userns option to prevent the sandbox from
    creating its own nested user namespace
  * Add --assert-userns-disabled option to check that an existing
    userns was created with --disable-userns
  * Give a clearer error message if the kernel doesn't have
    CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER</changelog>
  <changelog author="qzhao@suse.com" date="1724241600">- Add bubblewrap-CVE-2024-42472.patch:
  Backporting a253257c from upstream, Add --bind-fd and --ro-bind-fd
  to let you bind a O_PATH fd.
  (CVE-2024-42472, bsc#1229157)</changelog>
</package>
<package pkgid="80e27f069b01c9b36b442f72cdcc604ed5f6223cebd851647ec419f384f807bd" name="bubblewrap" arch="src">
  <version epoch="0" ver="0.8.0" rel="150500.3.6.1"/>
  <changelog author="walters@verbum.org" date="1476446400">- New upstream version</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1481889600">- upgrade to upstream version 0.1.4
- Build also for Leap 42.2</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1488456000">- upgrade to upstream version 0.1.7
- note that this package was *never* affected by CVE-2017-5226
  as it was introduced in version 0.1.6
- upstream changelog of version 0.1.7:
    This release backs out the change in 0.1.6 which unconditionally
    called setsid() in order to fix a security issue with TIOCSTI, aka
    CVE-2017-522. That change caused some behavioural issues that are
    hard to work with in some cases. For instance, it makes shell job
    control not work for the bwrap command.
    Instead there is now a new option --new-session which works like
    0.1.6. It is recommended that you use this if possible, but if not we
    recommended that you neutralize this some other way, for instance
    using SECCOMP, which is what flatpak does:
    https://github.com/flatpak/flatpak/commit/902fb713990a8f968ea4350c7c2a27ff46f1a6c4
    In order to make it easy to create maximally safe sandboxes we have
    also added a new commandline switch called --unshare-all. It unshares
    all possible namespaces and is currently equivalent with:
  - -unshare-user-try --unshare-ipc --unshare-pid --unshare-net
  - -unshare-uts --unshare-cgroup-try
    However, the intent is that as new namespaces are added to the kernel they will
    be added to this list. Additionally, if --share-net is specified the network
    namespace is not unshared.
    This release also has some bugfixes:
    bwrap reaps (unexpected) children that are inherited from the
    parent, something which can happen if bwrap is part of a shell
    pipeline.
    bwrap clears the capability bounding set. The permitted
    capabilities was already empty, and use of PR_NO_NEW_PRIVS should
    make it impossible to increase the capabilities, but more
    layers of protection is better.
    The seccomp filter is now installed at the very end of bwrap, which
    means the requirement of the filter is minimal. Any bwrap seccomp
    filter must at least allow: execve, waitpid and write
    Alexander Larsson (7):
    Handle inherited children dying
    Clear capability bounding set
    Make the call to setsid() optional, with --new-session
    demos/bubblewrap-shell.sh: Unshare all namespaces
    Call setsid() and setexeccon() befor forking the init monitor
    Install seccomp filter at the very end
    Bump version to 0.1.7
    Colin Walters (6):
    Release 0.1.6
    man: Correct namespace user -&gt; mount
    demo/shell: Add /var/tmp compat symlink, tweak PS1, add more docs
    Release 0.1.6
    ci: Combine ASAN and UBSAN
    Add --unshare-all and --share-net
- upstream changelog for 0.1.6:
    This fixes a security issue with TIOCSTI, aka CVE-2017-522. Note bubblewrap is
    far from the only program that has this issue, and I think the best fix is
    probably in the kernel to support disabling this ioctl.
    Programs can also work around this by calling setsid() on their own in an exec
    handler before doing an exevp("bwrap").
- upstream changelog for 0.1.5:
    This is a bugfix release, here are the major changes:
    Running bubblewrap as root now works again
    Various fixes for the testsuite
    Use same default compiler warnings as ostree
    Handle errors resolving symlinks during bind mounts
    Alexander Larsson (2):
    bind-mount: Check for errors in realpath()
    Bump version to 0.1.5
    Colin Walters (6):
    Don't call capset() unless we need to
    Only --unshare-user automatically if we're not root
    ci: Modernize a bit, add f25-ubsan
    README.md: Update with better one liner and more information
    utils: Add __attribute__((printf)) to die()
    build: Sync default warning -&gt; error set from ostree
    Simon McVittie (4):
    test-run: be a bash script
    test-run: don't assume we are uid 1000
    Adapt tests so they can be run against installed binaries
    Fix incorrect nesting of backticks when finding a FUSE mount</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1495713600">- update to version 0.1.8
- New --die-with-parent which is based on the Linux prctl(PR_SET_PDEATHSIG) API.
- smaller bugfixes</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1499428800">- fix build macro with rpm &lt; 4.12 (non-Factory currently)</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1505736000">- add group</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1507550400">- update to version 0.2.0
  - bwrap now automatically detects the new
  user namespace restrictions in Red Hat Enterprise Linux 7.4:
  bubblewrap: check for max_user_namespaces == 0.
  - The most notable features are new arguments --as-pid1, and
  - -cap-add/--cap-drop. These were added for running systemd (or in general a
  "full" init system) inside bubblewrap. But the capability options are also
  useful for unprivileged callers to potentially retain capbilities inside the
  sandbox (for example CAP_NET_ADMIN), when user namespaces are enabled.
  Conversely, privileged callers (uid 0) can conversely drop capabilities (without
  user namespaces). Contributed by Giuseppe Scrivano.
  - With --dev, add /dev/fd and /dev/core symlinks
  which should improve compatibility with older software.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1525176000">- update to version 0.2.1:
  * All the demos are included
  * bugfixes for the demo files
  * There was an issue with mkdir when running bubblewrap on an NFS
  filesystem that has been fixed, so flatpak now works on NFS shares.
  * Some leaks have been fixed, including a file descriptor leak.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1531569600">- update to version 0.3.0:
  * The biggest feature from this release is that bwrap
    now supports being invoked recursively (from other container
    runtimes such as Docker/podman/runc as well as bwrap itself)
    when user namespaces are enabled, and the outer container manager
    allows it (Docker's default seccomp policy doesn't).
  * This is useful for testing scenarios; for example a project
    uses Kubernetes for its CI, but inside build the project wants to run
    each unit test in their own pid namespace, without going out
    and creating a new pod for every single unit test.
  * Similarly, rpm-ostree compose tree uses bwrap internally for scripts,
    and we want to support running rpm-ostree inside a container as well.
  * Another feature is bwrap now supports -- to terminate argument
    parsing. To detect availablity of this, you could parse bwrap --version.</changelog>
  <changelog author="alarrosa@suse.com" date="1539259200">- update to version 0.3.1:
  * New feature in this release is --bind-try (as well as --dev-bind-try
    and --ro-bind-try) which works like the regular versions if the source
    exists, but does nothing if it doesn't exist.
  * The mount type for the root tmpfs was also changed to "tmpfs" instead
    of being empty, as the later could cause problems with some programs
    when parsing the mountinfo files in /proc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1559390400">- Update to version 0.3.3:
  - This release is the same as 0.3.2 but the version number in configure.ac
  was accidentally still set to 0.3.1
- Update to version 0.3.2:
  - fixes boo#1136958 / CVE-2019-12439
  This release fixes a mostly theoretical security issue in unusual/broken
  setups where `$XDG_RUNTIME_DIR` is unset.
  There are some other smaller fixes, as well as an addition to the JSON
  API that allows reading the inner process exit code, separately from
  the `bwrap` exit code.
  - Print "Out of memory" on stderr, not stdout
  - bwrap: add option json-status-fd to show child exit code
  - bwrap: Report COMMAND exit code in json-status-fd
  - man page: Describe --chdir, not nonexistent --cwd
  - Don't create our own temporary mount point for pivot_root
  - Make lockdata long enough on 32-bit with 64-bit file pointers.</changelog>
  <changelog author="alarrosa@suse.com" date="1559908800">- Use /bin/bash instead of /usr/bin/bash in SLE12</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576843200">- Update to version 0.4.0:
  + The biggest feature in this release is the support for joining
    existing user and pid namespaces. This doesn't work in the
    setuid mode (at the moment).
  + Other changes:
  - Stores namespace info in status json.
  - In setuid mode pid 1 is now marked dumpable.
  - Now builds with musl libc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1585742400">- Update to version 0.4.1:
  * retcode: fix return code with syncfd and no event_fd
  * Ensure we're always clearing the cap bounding set
  * tests: Update output patterns for libcap &gt;= 2.29
  * Don't rely on geteuid() to know when to switch back from setuid root
  * Don't support --userns2 in setuid mode
  * fixes CVE-2020-5291
  * fixes bsc#1168291</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632139200">- Update to version 0.5.0:
  + New features:
  - --chmod changes permissions
  - --clearenv unsets every environment variable (except PWD)
  - --perms sets permissions for one subsequent --bind-data,
  - -dir, --file, --ro-bind-data or --tmpfs
  + Other enhancements:
  - Better diagnostics when a --bind or other bind-mount fails
  - zsh tab-completion
  - Better test coverage
  + Bug fixes:
  - Use Python 3 for tests and examples
  - Mount points for non-directories are created with permissions
  - r--r--r-- instead of -rw-rw-rw-
  - Don't remount items in /proc read-only if already EROFS,
    required to run under Docker
  - Allow mounting an non-directory over an existing
    non-directory, e.g. --bind "$XDG_RUNTIME_DIR/my-log-socket"
    /dev/log
  - Silence kernel messages for our bind-mounts
  - Make sure pkg-config is checked for, regardless of build
    options
  - Improve ability to bind-mount directories on case-insensitive
    filesystems
  - Fix -Wshadow warnings
  - Fix deprecation warnings with newer SELinux
- Add new subpackage bubblewrap-zsh-completion</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1646395200">- Update to 0.6.1:
  - Add a release checklist
  - completions: Make zsh completion non-executable
  The Autotools build system installed it with 0644 permissions because
  it's listed as DATA, but the Meson build system installs executable
  files as executable by default.
  zsh completions don't need to be executable to work, and this one doesn't
  have the `#!` marker that should start an executable script.
- update to 0.6.0:
  - meson: Improve compatibility with Meson 0.49
  That version doesn't allow more than two arguments for define_variable.
  - Disable test-specifying-pidns.sh under 'meson dist' while I investigate
  This test is hanging when run under 'meson dist' for some reason, but
  not when run under 'meson test', and not locally, only in the Github
  Workflow-based CI. Disable it for now.
  - meson: Actually build and run the tests
  - tests: Fix compiler warnings for unused arguments
  - meson: Run test scripts from $srcdir
  - meson: Make G_TEST_SRCDIR, G_TEST_BUILDDIR match Autotools
  - meson: Run the Python test script with Python, not bash
  The python build option can be used to swap to a different interpreter,
  for environments like the Steam Runtime where the python3 executable in
  the PATH is extremely old but there is a better interpreter available.
  This is treated as non-optional, because Meson is written in Python,
  so the situation where there is no Python interpreter at build-time
  shouldn't arise.
  - meson: Build the try-syscall helper
  - meson: Build tests with equivalent of -I$(top_srcdir) -I$(top_builddir)
  - meson.build: Remove unnecessary check for sh
  - Add a Meson build system
  This allows bwrap to be built as a subproject in larger Meson projects.
  When built as a subproject, we install into the --libexecdir and
  require a program prefix to be specified: for example, Flatpak would use
  program_prefix=flatpak- to get /usr/libexec/flatpak-bwrap. Verified to
  be backwards-compatible as far as Meson 0.49.0 (Debian 9 backports).
  Loosely based on previous work by Jussi Pakkanen (see #133).
  Differences between the Autotools and Meson builds:
  The Meson build requires a version of libcap that has pkg-config
  metadata (introduced in libcap 2.23, in 2013).
  The Meson build has no equivalent of --with-priv-mode=setuid. On
  distributions like Debian &lt;= 10 and RHEL &lt;= 7 that require a setuid bwrap
  executable, the sysadmin or distribution packaging will need to set the
  correct permissions on the bwrap executable; Debian already did this via
  packaging rather than the upstream build system.
  The Meson build supports being used as a subproject, and there is CI
  for this. It automatically disables shell completions and man pages,
  moves the bubblewrap executable to ${libexecdir}, and renames the
  bubblewrap executable according to a program_prefix option that the
  caller must specify (for example, Flatpak would use
  - Dprogram_prefix=flatpak- to get /usr/libexec/flatpak-bwrap). See the
  tests/use-as-subproject/ directory for an example.
  - Use HEAD to refer to other projects' default branches in documentation
  This makes the URL independent of the name they have chosen for their
  default branches.
  - workflows: Update for rename of default branch to main
  - tests: Exercise seccomp filters
  - Allow loading more than one seccomp program
  This will allow Flatpak to combine an allow-list (default-deny) of
  known system calls with a deny-list (default-allow) of system calls
  that are undesired.
  Resolves: https://github.com/containers/bubblewrap/issues/453
  - Generalize linked lists of LockFile and SetupOp
  I'm about to add a third linked list, for seccomp programs, which would
  seem like too much duplication.
  - Handle argc == 0 better
  Unfortunately it's possible for argc to be 0, so error out pretty early
  on in that case. I don't think this is a security issue in this case.
  - Fix typo
  - Remove trailing whitespace
  - Fix spelling
  - bash: Fix shellcheck warnings
  - bash: Invoke bash using /usr/bin/env
  - bubblewrap: Avoid a -Wjump-misses-init false-positive
  When building with -Wjump-misses-init as part of a larger project, gcc
  reports that we jump past initialization of cover_proc_dirs. This is
  technically true, but we only use this variable in the case where it's
  initialized, so that's harmless.
  However, we can avoid this altogether by making the array static and
  constant, which allows it to be moved from initialized data to read-only
  data.
  - bind-mount: Be more const-correct
  When compiled with -Wwrite-strings as part of a larger project, gcc and
  clang both warn that we're assigning a string constant to a mutable
  struct member. There's actually no reason why it should be mutable, so
  make it const.
  - die_with_error: Save errno sooner
  We need to save errno immediately, otherwise it could be overwritten
  by a failing library call somewhere in the implementation of fprintf.
  - main: Warn when non-repeatable options are repeated
  A user might reasonably expect that `bwrap --seccomp 3 --seccomp 4 ...`
  would load seccomp programs from both fds 3 and 4, but in fact it only
  loads the program from fd 4.
  Helps: https://github.com/containers/bubblewrap/issues/453
  Resolves: https://github.com/containers/bubblewrap/issues/454
  - utils: Add warn()
  - Add SPDX-License-Identifier for files that already specify license
  This is a step towards REUSE compliance. Third-party files that we do
  not otherwise edit (git.mk, m4/attributes.m4) are excluded here.
  - tests: Use preferred spelling for SPDX license identifiers
  - Remove obsolete .travis.yml
  We no longer use Travis-CI.
  - Remove obsolete papr CI
  We no longer use this.</changelog>
  <changelog author="dimstar@opensuse.org" date="1652875200">- Update to version 0.6.2:
  + New features in Meson build:
  - Auto-detect whether the man page can be generated.
  - -Dbwrapdir=... changes the installation directory (useful
    when being used as a subproject).
  - -Dtests=false disables unit tests.
  + Bug fixes:
  - Add --add-seccomp-fd to shell completions
  - Document --add-seccomp-fd, --json-status-fd and --share-net
    in the man page
  - Add attributes to silence various compiler warnings
  - Allow compilation of tests with musl on mips architectures
  - Allow compilation with older glibc
  - Disable sanitizers for a test helper whose seccomp profile
    breaks the instrumentation
  - Disable AddressSanitizer leak detection where it interferes
    with unit testing</changelog>
  <changelog author="dmueller@suse.com" date="1670414400">- update to v0.7.0:
  * --size option controls the size of a subsequent --tmpfs (#509)
  * Better error messages if a mount operation fails (#472)
  * Better error message if creating the new user namespace fails with
    ENOSPC (#487)
  * When building as a Meson subproject, a RUNPATH can be set on the
    executable to make it easier to bundle its libcap dependency
  * Fix test failures when running as uid 0 but with limited capabilities
    (#510)
  * Use POSIX command -v in preference to non-standard which (#527)
  * Fix a copy/paste error in --help (#531)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1679918400">- update to v0.8.0:
  * Add --disable-userns option to prevent the sandbox from
    creating its own nested user namespace
  * Add --assert-userns-disabled option to check that an existing
    userns was created with --disable-userns
  * Give a clearer error message if the kernel doesn't have
    CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER</changelog>
  <changelog author="qzhao@suse.com" date="1724241600">- Add bubblewrap-CVE-2024-42472.patch:
  Backporting a253257c from upstream, Add --bind-fd and --ro-bind-fd
  to let you bind a O_PATH fd.
  (CVE-2024-42472, bsc#1229157)</changelog>
</package>
<package pkgid="c7d92fe8edd2a0fb0790bfc9f54c16ef29367c65ec598a040d8b2e3af299e973" name="bubblewrap" arch="x86_64">
  <version epoch="0" ver="0.8.0" rel="150500.3.6.1"/>
  <changelog author="walters@verbum.org" date="1476446400">- New upstream version</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1481889600">- upgrade to upstream version 0.1.4
- Build also for Leap 42.2</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1488456000">- upgrade to upstream version 0.1.7
- note that this package was *never* affected by CVE-2017-5226
  as it was introduced in version 0.1.6
- upstream changelog of version 0.1.7:
    This release backs out the change in 0.1.6 which unconditionally
    called setsid() in order to fix a security issue with TIOCSTI, aka
    CVE-2017-522. That change caused some behavioural issues that are
    hard to work with in some cases. For instance, it makes shell job
    control not work for the bwrap command.
    Instead there is now a new option --new-session which works like
    0.1.6. It is recommended that you use this if possible, but if not we
    recommended that you neutralize this some other way, for instance
    using SECCOMP, which is what flatpak does:
    https://github.com/flatpak/flatpak/commit/902fb713990a8f968ea4350c7c2a27ff46f1a6c4
    In order to make it easy to create maximally safe sandboxes we have
    also added a new commandline switch called --unshare-all. It unshares
    all possible namespaces and is currently equivalent with:
  - -unshare-user-try --unshare-ipc --unshare-pid --unshare-net
  - -unshare-uts --unshare-cgroup-try
    However, the intent is that as new namespaces are added to the kernel they will
    be added to this list. Additionally, if --share-net is specified the network
    namespace is not unshared.
    This release also has some bugfixes:
    bwrap reaps (unexpected) children that are inherited from the
    parent, something which can happen if bwrap is part of a shell
    pipeline.
    bwrap clears the capability bounding set. The permitted
    capabilities was already empty, and use of PR_NO_NEW_PRIVS should
    make it impossible to increase the capabilities, but more
    layers of protection is better.
    The seccomp filter is now installed at the very end of bwrap, which
    means the requirement of the filter is minimal. Any bwrap seccomp
    filter must at least allow: execve, waitpid and write
    Alexander Larsson (7):
    Handle inherited children dying
    Clear capability bounding set
    Make the call to setsid() optional, with --new-session
    demos/bubblewrap-shell.sh: Unshare all namespaces
    Call setsid() and setexeccon() befor forking the init monitor
    Install seccomp filter at the very end
    Bump version to 0.1.7
    Colin Walters (6):
    Release 0.1.6
    man: Correct namespace user -&gt; mount
    demo/shell: Add /var/tmp compat symlink, tweak PS1, add more docs
    Release 0.1.6
    ci: Combine ASAN and UBSAN
    Add --unshare-all and --share-net
- upstream changelog for 0.1.6:
    This fixes a security issue with TIOCSTI, aka CVE-2017-522. Note bubblewrap is
    far from the only program that has this issue, and I think the best fix is
    probably in the kernel to support disabling this ioctl.
    Programs can also work around this by calling setsid() on their own in an exec
    handler before doing an exevp("bwrap").
- upstream changelog for 0.1.5:
    This is a bugfix release, here are the major changes:
    Running bubblewrap as root now works again
    Various fixes for the testsuite
    Use same default compiler warnings as ostree
    Handle errors resolving symlinks during bind mounts
    Alexander Larsson (2):
    bind-mount: Check for errors in realpath()
    Bump version to 0.1.5
    Colin Walters (6):
    Don't call capset() unless we need to
    Only --unshare-user automatically if we're not root
    ci: Modernize a bit, add f25-ubsan
    README.md: Update with better one liner and more information
    utils: Add __attribute__((printf)) to die()
    build: Sync default warning -&gt; error set from ostree
    Simon McVittie (4):
    test-run: be a bash script
    test-run: don't assume we are uid 1000
    Adapt tests so they can be run against installed binaries
    Fix incorrect nesting of backticks when finding a FUSE mount</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1495713600">- update to version 0.1.8
- New --die-with-parent which is based on the Linux prctl(PR_SET_PDEATHSIG) API.
- smaller bugfixes</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1499428800">- fix build macro with rpm &lt; 4.12 (non-Factory currently)</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1505736000">- add group</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1507550400">- update to version 0.2.0
  - bwrap now automatically detects the new
  user namespace restrictions in Red Hat Enterprise Linux 7.4:
  bubblewrap: check for max_user_namespaces == 0.
  - The most notable features are new arguments --as-pid1, and
  - -cap-add/--cap-drop. These were added for running systemd (or in general a
  "full" init system) inside bubblewrap. But the capability options are also
  useful for unprivileged callers to potentially retain capbilities inside the
  sandbox (for example CAP_NET_ADMIN), when user namespaces are enabled.
  Conversely, privileged callers (uid 0) can conversely drop capabilities (without
  user namespaces). Contributed by Giuseppe Scrivano.
  - With --dev, add /dev/fd and /dev/core symlinks
  which should improve compatibility with older software.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1525176000">- update to version 0.2.1:
  * All the demos are included
  * bugfixes for the demo files
  * There was an issue with mkdir when running bubblewrap on an NFS
  filesystem that has been fixed, so flatpak now works on NFS shares.
  * Some leaks have been fixed, including a file descriptor leak.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1531569600">- update to version 0.3.0:
  * The biggest feature from this release is that bwrap
    now supports being invoked recursively (from other container
    runtimes such as Docker/podman/runc as well as bwrap itself)
    when user namespaces are enabled, and the outer container manager
    allows it (Docker's default seccomp policy doesn't).
  * This is useful for testing scenarios; for example a project
    uses Kubernetes for its CI, but inside build the project wants to run
    each unit test in their own pid namespace, without going out
    and creating a new pod for every single unit test.
  * Similarly, rpm-ostree compose tree uses bwrap internally for scripts,
    and we want to support running rpm-ostree inside a container as well.
  * Another feature is bwrap now supports -- to terminate argument
    parsing. To detect availablity of this, you could parse bwrap --version.</changelog>
  <changelog author="alarrosa@suse.com" date="1539259200">- update to version 0.3.1:
  * New feature in this release is --bind-try (as well as --dev-bind-try
    and --ro-bind-try) which works like the regular versions if the source
    exists, but does nothing if it doesn't exist.
  * The mount type for the root tmpfs was also changed to "tmpfs" instead
    of being empty, as the later could cause problems with some programs
    when parsing the mountinfo files in /proc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1559390400">- Update to version 0.3.3:
  - This release is the same as 0.3.2 but the version number in configure.ac
  was accidentally still set to 0.3.1
- Update to version 0.3.2:
  - fixes boo#1136958 / CVE-2019-12439
  This release fixes a mostly theoretical security issue in unusual/broken
  setups where `$XDG_RUNTIME_DIR` is unset.
  There are some other smaller fixes, as well as an addition to the JSON
  API that allows reading the inner process exit code, separately from
  the `bwrap` exit code.
  - Print "Out of memory" on stderr, not stdout
  - bwrap: add option json-status-fd to show child exit code
  - bwrap: Report COMMAND exit code in json-status-fd
  - man page: Describe --chdir, not nonexistent --cwd
  - Don't create our own temporary mount point for pivot_root
  - Make lockdata long enough on 32-bit with 64-bit file pointers.</changelog>
  <changelog author="alarrosa@suse.com" date="1559908800">- Use /bin/bash instead of /usr/bin/bash in SLE12</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576843200">- Update to version 0.4.0:
  + The biggest feature in this release is the support for joining
    existing user and pid namespaces. This doesn't work in the
    setuid mode (at the moment).
  + Other changes:
  - Stores namespace info in status json.
  - In setuid mode pid 1 is now marked dumpable.
  - Now builds with musl libc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1585742400">- Update to version 0.4.1:
  * retcode: fix return code with syncfd and no event_fd
  * Ensure we're always clearing the cap bounding set
  * tests: Update output patterns for libcap &gt;= 2.29
  * Don't rely on geteuid() to know when to switch back from setuid root
  * Don't support --userns2 in setuid mode
  * fixes CVE-2020-5291
  * fixes bsc#1168291</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632139200">- Update to version 0.5.0:
  + New features:
  - --chmod changes permissions
  - --clearenv unsets every environment variable (except PWD)
  - --perms sets permissions for one subsequent --bind-data,
  - -dir, --file, --ro-bind-data or --tmpfs
  + Other enhancements:
  - Better diagnostics when a --bind or other bind-mount fails
  - zsh tab-completion
  - Better test coverage
  + Bug fixes:
  - Use Python 3 for tests and examples
  - Mount points for non-directories are created with permissions
  - r--r--r-- instead of -rw-rw-rw-
  - Don't remount items in /proc read-only if already EROFS,
    required to run under Docker
  - Allow mounting an non-directory over an existing
    non-directory, e.g. --bind "$XDG_RUNTIME_DIR/my-log-socket"
    /dev/log
  - Silence kernel messages for our bind-mounts
  - Make sure pkg-config is checked for, regardless of build
    options
  - Improve ability to bind-mount directories on case-insensitive
    filesystems
  - Fix -Wshadow warnings
  - Fix deprecation warnings with newer SELinux
- Add new subpackage bubblewrap-zsh-completion</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1646395200">- Update to 0.6.1:
  - Add a release checklist
  - completions: Make zsh completion non-executable
  The Autotools build system installed it with 0644 permissions because
  it's listed as DATA, but the Meson build system installs executable
  files as executable by default.
  zsh completions don't need to be executable to work, and this one doesn't
  have the `#!` marker that should start an executable script.
- update to 0.6.0:
  - meson: Improve compatibility with Meson 0.49
  That version doesn't allow more than two arguments for define_variable.
  - Disable test-specifying-pidns.sh under 'meson dist' while I investigate
  This test is hanging when run under 'meson dist' for some reason, but
  not when run under 'meson test', and not locally, only in the Github
  Workflow-based CI. Disable it for now.
  - meson: Actually build and run the tests
  - tests: Fix compiler warnings for unused arguments
  - meson: Run test scripts from $srcdir
  - meson: Make G_TEST_SRCDIR, G_TEST_BUILDDIR match Autotools
  - meson: Run the Python test script with Python, not bash
  The python build option can be used to swap to a different interpreter,
  for environments like the Steam Runtime where the python3 executable in
  the PATH is extremely old but there is a better interpreter available.
  This is treated as non-optional, because Meson is written in Python,
  so the situation where there is no Python interpreter at build-time
  shouldn't arise.
  - meson: Build the try-syscall helper
  - meson: Build tests with equivalent of -I$(top_srcdir) -I$(top_builddir)
  - meson.build: Remove unnecessary check for sh
  - Add a Meson build system
  This allows bwrap to be built as a subproject in larger Meson projects.
  When built as a subproject, we install into the --libexecdir and
  require a program prefix to be specified: for example, Flatpak would use
  program_prefix=flatpak- to get /usr/libexec/flatpak-bwrap. Verified to
  be backwards-compatible as far as Meson 0.49.0 (Debian 9 backports).
  Loosely based on previous work by Jussi Pakkanen (see #133).
  Differences between the Autotools and Meson builds:
  The Meson build requires a version of libcap that has pkg-config
  metadata (introduced in libcap 2.23, in 2013).
  The Meson build has no equivalent of --with-priv-mode=setuid. On
  distributions like Debian &lt;= 10 and RHEL &lt;= 7 that require a setuid bwrap
  executable, the sysadmin or distribution packaging will need to set the
  correct permissions on the bwrap executable; Debian already did this via
  packaging rather than the upstream build system.
  The Meson build supports being used as a subproject, and there is CI
  for this. It automatically disables shell completions and man pages,
  moves the bubblewrap executable to ${libexecdir}, and renames the
  bubblewrap executable according to a program_prefix option that the
  caller must specify (for example, Flatpak would use
  - Dprogram_prefix=flatpak- to get /usr/libexec/flatpak-bwrap). See the
  tests/use-as-subproject/ directory for an example.
  - Use HEAD to refer to other projects' default branches in documentation
  This makes the URL independent of the name they have chosen for their
  default branches.
  - workflows: Update for rename of default branch to main
  - tests: Exercise seccomp filters
  - Allow loading more than one seccomp program
  This will allow Flatpak to combine an allow-list (default-deny) of
  known system calls with a deny-list (default-allow) of system calls
  that are undesired.
  Resolves: https://github.com/containers/bubblewrap/issues/453
  - Generalize linked lists of LockFile and SetupOp
  I'm about to add a third linked list, for seccomp programs, which would
  seem like too much duplication.
  - Handle argc == 0 better
  Unfortunately it's possible for argc to be 0, so error out pretty early
  on in that case. I don't think this is a security issue in this case.
  - Fix typo
  - Remove trailing whitespace
  - Fix spelling
  - bash: Fix shellcheck warnings
  - bash: Invoke bash using /usr/bin/env
  - bubblewrap: Avoid a -Wjump-misses-init false-positive
  When building with -Wjump-misses-init as part of a larger project, gcc
  reports that we jump past initialization of cover_proc_dirs. This is
  technically true, but we only use this variable in the case where it's
  initialized, so that's harmless.
  However, we can avoid this altogether by making the array static and
  constant, which allows it to be moved from initialized data to read-only
  data.
  - bind-mount: Be more const-correct
  When compiled with -Wwrite-strings as part of a larger project, gcc and
  clang both warn that we're assigning a string constant to a mutable
  struct member. There's actually no reason why it should be mutable, so
  make it const.
  - die_with_error: Save errno sooner
  We need to save errno immediately, otherwise it could be overwritten
  by a failing library call somewhere in the implementation of fprintf.
  - main: Warn when non-repeatable options are repeated
  A user might reasonably expect that `bwrap --seccomp 3 --seccomp 4 ...`
  would load seccomp programs from both fds 3 and 4, but in fact it only
  loads the program from fd 4.
  Helps: https://github.com/containers/bubblewrap/issues/453
  Resolves: https://github.com/containers/bubblewrap/issues/454
  - utils: Add warn()
  - Add SPDX-License-Identifier for files that already specify license
  This is a step towards REUSE compliance. Third-party files that we do
  not otherwise edit (git.mk, m4/attributes.m4) are excluded here.
  - tests: Use preferred spelling for SPDX license identifiers
  - Remove obsolete .travis.yml
  We no longer use Travis-CI.
  - Remove obsolete papr CI
  We no longer use this.</changelog>
  <changelog author="dimstar@opensuse.org" date="1652875200">- Update to version 0.6.2:
  + New features in Meson build:
  - Auto-detect whether the man page can be generated.
  - -Dbwrapdir=... changes the installation directory (useful
    when being used as a subproject).
  - -Dtests=false disables unit tests.
  + Bug fixes:
  - Add --add-seccomp-fd to shell completions
  - Document --add-seccomp-fd, --json-status-fd and --share-net
    in the man page
  - Add attributes to silence various compiler warnings
  - Allow compilation of tests with musl on mips architectures
  - Allow compilation with older glibc
  - Disable sanitizers for a test helper whose seccomp profile
    breaks the instrumentation
  - Disable AddressSanitizer leak detection where it interferes
    with unit testing</changelog>
  <changelog author="dmueller@suse.com" date="1670414400">- update to v0.7.0:
  * --size option controls the size of a subsequent --tmpfs (#509)
  * Better error messages if a mount operation fails (#472)
  * Better error message if creating the new user namespace fails with
    ENOSPC (#487)
  * When building as a Meson subproject, a RUNPATH can be set on the
    executable to make it easier to bundle its libcap dependency
  * Fix test failures when running as uid 0 but with limited capabilities
    (#510)
  * Use POSIX command -v in preference to non-standard which (#527)
  * Fix a copy/paste error in --help (#531)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1679918400">- update to v0.8.0:
  * Add --disable-userns option to prevent the sandbox from
    creating its own nested user namespace
  * Add --assert-userns-disabled option to check that an existing
    userns was created with --disable-userns
  * Give a clearer error message if the kernel doesn't have
    CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER</changelog>
  <changelog author="qzhao@suse.com" date="1724241600">- Add bubblewrap-CVE-2024-42472.patch:
  Backporting a253257c from upstream, Add --bind-fd and --ro-bind-fd
  to let you bind a O_PATH fd.
  (CVE-2024-42472, bsc#1229157)</changelog>
</package>
<package pkgid="c8de47ef307e255edd150260d2c6c252a07a4d80b26eed95eb81330e9ff4fe1a" name="bubblewrap-zsh-completion" arch="aarch64">
  <version epoch="0" ver="0.8.0" rel="150500.3.3.1"/>
  <changelog author="klember@redhat.com" date="1473681600">- Update to 0.1.2</changelog>
  <changelog author="walters@verbum.org" date="1476446400">- New upstream version</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1481889600">- upgrade to upstream version 0.1.4
- Build also for Leap 42.2</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1488456000">- upgrade to upstream version 0.1.7
- note that this package was *never* affected by CVE-2017-5226
  as it was introduced in version 0.1.6
- upstream changelog of version 0.1.7:
    This release backs out the change in 0.1.6 which unconditionally
    called setsid() in order to fix a security issue with TIOCSTI, aka
    CVE-2017-522. That change caused some behavioural issues that are
    hard to work with in some cases. For instance, it makes shell job
    control not work for the bwrap command.
    Instead there is now a new option --new-session which works like
    0.1.6. It is recommended that you use this if possible, but if not we
    recommended that you neutralize this some other way, for instance
    using SECCOMP, which is what flatpak does:
    https://github.com/flatpak/flatpak/commit/902fb713990a8f968ea4350c7c2a27ff46f1a6c4
    In order to make it easy to create maximally safe sandboxes we have
    also added a new commandline switch called --unshare-all. It unshares
    all possible namespaces and is currently equivalent with:
  - -unshare-user-try --unshare-ipc --unshare-pid --unshare-net
  - -unshare-uts --unshare-cgroup-try
    However, the intent is that as new namespaces are added to the kernel they will
    be added to this list. Additionally, if --share-net is specified the network
    namespace is not unshared.
    This release also has some bugfixes:
    bwrap reaps (unexpected) children that are inherited from the
    parent, something which can happen if bwrap is part of a shell
    pipeline.
    bwrap clears the capability bounding set. The permitted
    capabilities was already empty, and use of PR_NO_NEW_PRIVS should
    make it impossible to increase the capabilities, but more
    layers of protection is better.
    The seccomp filter is now installed at the very end of bwrap, which
    means the requirement of the filter is minimal. Any bwrap seccomp
    filter must at least allow: execve, waitpid and write
    Alexander Larsson (7):
    Handle inherited children dying
    Clear capability bounding set
    Make the call to setsid() optional, with --new-session
    demos/bubblewrap-shell.sh: Unshare all namespaces
    Call setsid() and setexeccon() befor forking the init monitor
    Install seccomp filter at the very end
    Bump version to 0.1.7
    Colin Walters (6):
    Release 0.1.6
    man: Correct namespace user -&gt; mount
    demo/shell: Add /var/tmp compat symlink, tweak PS1, add more docs
    Release 0.1.6
    ci: Combine ASAN and UBSAN
    Add --unshare-all and --share-net
- upstream changelog for 0.1.6:
    This fixes a security issue with TIOCSTI, aka CVE-2017-522. Note bubblewrap is
    far from the only program that has this issue, and I think the best fix is
    probably in the kernel to support disabling this ioctl.
    Programs can also work around this by calling setsid() on their own in an exec
    handler before doing an exevp("bwrap").
- upstream changelog for 0.1.5:
    This is a bugfix release, here are the major changes:
    Running bubblewrap as root now works again
    Various fixes for the testsuite
    Use same default compiler warnings as ostree
    Handle errors resolving symlinks during bind mounts
    Alexander Larsson (2):
    bind-mount: Check for errors in realpath()
    Bump version to 0.1.5
    Colin Walters (6):
    Don't call capset() unless we need to
    Only --unshare-user automatically if we're not root
    ci: Modernize a bit, add f25-ubsan
    README.md: Update with better one liner and more information
    utils: Add __attribute__((printf)) to die()
    build: Sync default warning -&gt; error set from ostree
    Simon McVittie (4):
    test-run: be a bash script
    test-run: don't assume we are uid 1000
    Adapt tests so they can be run against installed binaries
    Fix incorrect nesting of backticks when finding a FUSE mount</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1495713600">- update to version 0.1.8
- New --die-with-parent which is based on the Linux prctl(PR_SET_PDEATHSIG) API.
- smaller bugfixes</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1499428800">- fix build macro with rpm &lt; 4.12 (non-Factory currently)</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1505736000">- add group</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1507550400">- update to version 0.2.0
  - bwrap now automatically detects the new
  user namespace restrictions in Red Hat Enterprise Linux 7.4:
  bubblewrap: check for max_user_namespaces == 0.
  - The most notable features are new arguments --as-pid1, and
  - -cap-add/--cap-drop. These were added for running systemd (or in general a
  "full" init system) inside bubblewrap. But the capability options are also
  useful for unprivileged callers to potentially retain capbilities inside the
  sandbox (for example CAP_NET_ADMIN), when user namespaces are enabled.
  Conversely, privileged callers (uid 0) can conversely drop capabilities (without
  user namespaces). Contributed by Giuseppe Scrivano.
  - With --dev, add /dev/fd and /dev/core symlinks
  which should improve compatibility with older software.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1525176000">- update to version 0.2.1:
  * All the demos are included
  * bugfixes for the demo files
  * There was an issue with mkdir when running bubblewrap on an NFS
  filesystem that has been fixed, so flatpak now works on NFS shares.
  * Some leaks have been fixed, including a file descriptor leak.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1531569600">- update to version 0.3.0:
  * The biggest feature from this release is that bwrap
    now supports being invoked recursively (from other container
    runtimes such as Docker/podman/runc as well as bwrap itself)
    when user namespaces are enabled, and the outer container manager
    allows it (Docker's default seccomp policy doesn't).
  * This is useful for testing scenarios; for example a project
    uses Kubernetes for its CI, but inside build the project wants to run
    each unit test in their own pid namespace, without going out
    and creating a new pod for every single unit test.
  * Similarly, rpm-ostree compose tree uses bwrap internally for scripts,
    and we want to support running rpm-ostree inside a container as well.
  * Another feature is bwrap now supports -- to terminate argument
    parsing. To detect availablity of this, you could parse bwrap --version.</changelog>
  <changelog author="alarrosa@suse.com" date="1539259200">- update to version 0.3.1:
  * New feature in this release is --bind-try (as well as --dev-bind-try
    and --ro-bind-try) which works like the regular versions if the source
    exists, but does nothing if it doesn't exist.
  * The mount type for the root tmpfs was also changed to "tmpfs" instead
    of being empty, as the later could cause problems with some programs
    when parsing the mountinfo files in /proc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1559390400">- Update to version 0.3.3:
  - This release is the same as 0.3.2 but the version number in configure.ac
  was accidentally still set to 0.3.1
- Update to version 0.3.2:
  - fixes boo#1136958 / CVE-2019-12439
  This release fixes a mostly theoretical security issue in unusual/broken
  setups where `$XDG_RUNTIME_DIR` is unset.
  There are some other smaller fixes, as well as an addition to the JSON
  API that allows reading the inner process exit code, separately from
  the `bwrap` exit code.
  - Print "Out of memory" on stderr, not stdout
  - bwrap: add option json-status-fd to show child exit code
  - bwrap: Report COMMAND exit code in json-status-fd
  - man page: Describe --chdir, not nonexistent --cwd
  - Don't create our own temporary mount point for pivot_root
  - Make lockdata long enough on 32-bit with 64-bit file pointers.</changelog>
  <changelog author="alarrosa@suse.com" date="1559908800">- Use /bin/bash instead of /usr/bin/bash in SLE12</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576843200">- Update to version 0.4.0:
  + The biggest feature in this release is the support for joining
    existing user and pid namespaces. This doesn't work in the
    setuid mode (at the moment).
  + Other changes:
  - Stores namespace info in status json.
  - In setuid mode pid 1 is now marked dumpable.
  - Now builds with musl libc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1585742400">- Update to version 0.4.1:
  * retcode: fix return code with syncfd and no event_fd
  * Ensure we're always clearing the cap bounding set
  * tests: Update output patterns for libcap &gt;= 2.29
  * Don't rely on geteuid() to know when to switch back from setuid root
  * Don't support --userns2 in setuid mode
  * fixes CVE-2020-5291
  * fixes bsc#1168291</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632139200">- Update to version 0.5.0:
  + New features:
  - --chmod changes permissions
  - --clearenv unsets every environment variable (except PWD)
  - --perms sets permissions for one subsequent --bind-data,
  - -dir, --file, --ro-bind-data or --tmpfs
  + Other enhancements:
  - Better diagnostics when a --bind or other bind-mount fails
  - zsh tab-completion
  - Better test coverage
  + Bug fixes:
  - Use Python 3 for tests and examples
  - Mount points for non-directories are created with permissions
  - r--r--r-- instead of -rw-rw-rw-
  - Don't remount items in /proc read-only if already EROFS,
    required to run under Docker
  - Allow mounting an non-directory over an existing
    non-directory, e.g. --bind "$XDG_RUNTIME_DIR/my-log-socket"
    /dev/log
  - Silence kernel messages for our bind-mounts
  - Make sure pkg-config is checked for, regardless of build
    options
  - Improve ability to bind-mount directories on case-insensitive
    filesystems
  - Fix -Wshadow warnings
  - Fix deprecation warnings with newer SELinux
- Add new subpackage bubblewrap-zsh-completion</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1646395200">- Update to 0.6.1:
  - Add a release checklist
  - completions: Make zsh completion non-executable
  The Autotools build system installed it with 0644 permissions because
  it's listed as DATA, but the Meson build system installs executable
  files as executable by default.
  zsh completions don't need to be executable to work, and this one doesn't
  have the `#!` marker that should start an executable script.
- update to 0.6.0:
  - meson: Improve compatibility with Meson 0.49
  That version doesn't allow more than two arguments for define_variable.
  - Disable test-specifying-pidns.sh under 'meson dist' while I investigate
  This test is hanging when run under 'meson dist' for some reason, but
  not when run under 'meson test', and not locally, only in the Github
  Workflow-based CI. Disable it for now.
  - meson: Actually build and run the tests
  - tests: Fix compiler warnings for unused arguments
  - meson: Run test scripts from $srcdir
  - meson: Make G_TEST_SRCDIR, G_TEST_BUILDDIR match Autotools
  - meson: Run the Python test script with Python, not bash
  The python build option can be used to swap to a different interpreter,
  for environments like the Steam Runtime where the python3 executable in
  the PATH is extremely old but there is a better interpreter available.
  This is treated as non-optional, because Meson is written in Python,
  so the situation where there is no Python interpreter at build-time
  shouldn't arise.
  - meson: Build the try-syscall helper
  - meson: Build tests with equivalent of -I$(top_srcdir) -I$(top_builddir)
  - meson.build: Remove unnecessary check for sh
  - Add a Meson build system
  This allows bwrap to be built as a subproject in larger Meson projects.
  When built as a subproject, we install into the --libexecdir and
  require a program prefix to be specified: for example, Flatpak would use
  program_prefix=flatpak- to get /usr/libexec/flatpak-bwrap. Verified to
  be backwards-compatible as far as Meson 0.49.0 (Debian 9 backports).
  Loosely based on previous work by Jussi Pakkanen (see #133).
  Differences between the Autotools and Meson builds:
  The Meson build requires a version of libcap that has pkg-config
  metadata (introduced in libcap 2.23, in 2013).
  The Meson build has no equivalent of --with-priv-mode=setuid. On
  distributions like Debian &lt;= 10 and RHEL &lt;= 7 that require a setuid bwrap
  executable, the sysadmin or distribution packaging will need to set the
  correct permissions on the bwrap executable; Debian already did this via
  packaging rather than the upstream build system.
  The Meson build supports being used as a subproject, and there is CI
  for this. It automatically disables shell completions and man pages,
  moves the bubblewrap executable to ${libexecdir}, and renames the
  bubblewrap executable according to a program_prefix option that the
  caller must specify (for example, Flatpak would use
  - Dprogram_prefix=flatpak- to get /usr/libexec/flatpak-bwrap). See the
  tests/use-as-subproject/ directory for an example.
  - Use HEAD to refer to other projects' default branches in documentation
  This makes the URL independent of the name they have chosen for their
  default branches.
  - workflows: Update for rename of default branch to main
  - tests: Exercise seccomp filters
  - Allow loading more than one seccomp program
  This will allow Flatpak to combine an allow-list (default-deny) of
  known system calls with a deny-list (default-allow) of system calls
  that are undesired.
  Resolves: https://github.com/containers/bubblewrap/issues/453
  - Generalize linked lists of LockFile and SetupOp
  I'm about to add a third linked list, for seccomp programs, which would
  seem like too much duplication.
  - Handle argc == 0 better
  Unfortunately it's possible for argc to be 0, so error out pretty early
  on in that case. I don't think this is a security issue in this case.
  - Fix typo
  - Remove trailing whitespace
  - Fix spelling
  - bash: Fix shellcheck warnings
  - bash: Invoke bash using /usr/bin/env
  - bubblewrap: Avoid a -Wjump-misses-init false-positive
  When building with -Wjump-misses-init as part of a larger project, gcc
  reports that we jump past initialization of cover_proc_dirs. This is
  technically true, but we only use this variable in the case where it's
  initialized, so that's harmless.
  However, we can avoid this altogether by making the array static and
  constant, which allows it to be moved from initialized data to read-only
  data.
  - bind-mount: Be more const-correct
  When compiled with -Wwrite-strings as part of a larger project, gcc and
  clang both warn that we're assigning a string constant to a mutable
  struct member. There's actually no reason why it should be mutable, so
  make it const.
  - die_with_error: Save errno sooner
  We need to save errno immediately, otherwise it could be overwritten
  by a failing library call somewhere in the implementation of fprintf.
  - main: Warn when non-repeatable options are repeated
  A user might reasonably expect that `bwrap --seccomp 3 --seccomp 4 ...`
  would load seccomp programs from both fds 3 and 4, but in fact it only
  loads the program from fd 4.
  Helps: https://github.com/containers/bubblewrap/issues/453
  Resolves: https://github.com/containers/bubblewrap/issues/454
  - utils: Add warn()
  - Add SPDX-License-Identifier for files that already specify license
  This is a step towards REUSE compliance. Third-party files that we do
  not otherwise edit (git.mk, m4/attributes.m4) are excluded here.
  - tests: Use preferred spelling for SPDX license identifiers
  - Remove obsolete .travis.yml
  We no longer use Travis-CI.
  - Remove obsolete papr CI
  We no longer use this.</changelog>
  <changelog author="dimstar@opensuse.org" date="1652875200">- Update to version 0.6.2:
  + New features in Meson build:
  - Auto-detect whether the man page can be generated.
  - -Dbwrapdir=... changes the installation directory (useful
    when being used as a subproject).
  - -Dtests=false disables unit tests.
  + Bug fixes:
  - Add --add-seccomp-fd to shell completions
  - Document --add-seccomp-fd, --json-status-fd and --share-net
    in the man page
  - Add attributes to silence various compiler warnings
  - Allow compilation of tests with musl on mips architectures
  - Allow compilation with older glibc
  - Disable sanitizers for a test helper whose seccomp profile
    breaks the instrumentation
  - Disable AddressSanitizer leak detection where it interferes
    with unit testing</changelog>
  <changelog author="dmueller@suse.com" date="1670414400">- update to v0.7.0:
  * --size option controls the size of a subsequent --tmpfs (#509)
  * Better error messages if a mount operation fails (#472)
  * Better error message if creating the new user namespace fails with
    ENOSPC (#487)
  * When building as a Meson subproject, a RUNPATH can be set on the
    executable to make it easier to bundle its libcap dependency
  * Fix test failures when running as uid 0 but with limited capabilities
    (#510)
  * Use POSIX command -v in preference to non-standard which (#527)
  * Fix a copy/paste error in --help (#531)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1679918400">- update to v0.8.0:
  * Add --disable-userns option to prevent the sandbox from
    creating its own nested user namespace
  * Add --assert-userns-disabled option to check that an existing
    userns was created with --disable-userns
  * Give a clearer error message if the kernel doesn't have
    CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER</changelog>
</package>
<package pkgid="5f46c7f13eec0d403f29c1863ee48572d3d00890c14e6d32f05f84f75187a00d" name="bubblewrap-zsh-completion" arch="ppc64le">
  <version epoch="0" ver="0.8.0" rel="150500.3.3.1"/>
  <changelog author="klember@redhat.com" date="1473681600">- Update to 0.1.2</changelog>
  <changelog author="walters@verbum.org" date="1476446400">- New upstream version</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1481889600">- upgrade to upstream version 0.1.4
- Build also for Leap 42.2</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1488456000">- upgrade to upstream version 0.1.7
- note that this package was *never* affected by CVE-2017-5226
  as it was introduced in version 0.1.6
- upstream changelog of version 0.1.7:
    This release backs out the change in 0.1.6 which unconditionally
    called setsid() in order to fix a security issue with TIOCSTI, aka
    CVE-2017-522. That change caused some behavioural issues that are
    hard to work with in some cases. For instance, it makes shell job
    control not work for the bwrap command.
    Instead there is now a new option --new-session which works like
    0.1.6. It is recommended that you use this if possible, but if not we
    recommended that you neutralize this some other way, for instance
    using SECCOMP, which is what flatpak does:
    https://github.com/flatpak/flatpak/commit/902fb713990a8f968ea4350c7c2a27ff46f1a6c4
    In order to make it easy to create maximally safe sandboxes we have
    also added a new commandline switch called --unshare-all. It unshares
    all possible namespaces and is currently equivalent with:
  - -unshare-user-try --unshare-ipc --unshare-pid --unshare-net
  - -unshare-uts --unshare-cgroup-try
    However, the intent is that as new namespaces are added to the kernel they will
    be added to this list. Additionally, if --share-net is specified the network
    namespace is not unshared.
    This release also has some bugfixes:
    bwrap reaps (unexpected) children that are inherited from the
    parent, something which can happen if bwrap is part of a shell
    pipeline.
    bwrap clears the capability bounding set. The permitted
    capabilities was already empty, and use of PR_NO_NEW_PRIVS should
    make it impossible to increase the capabilities, but more
    layers of protection is better.
    The seccomp filter is now installed at the very end of bwrap, which
    means the requirement of the filter is minimal. Any bwrap seccomp
    filter must at least allow: execve, waitpid and write
    Alexander Larsson (7):
    Handle inherited children dying
    Clear capability bounding set
    Make the call to setsid() optional, with --new-session
    demos/bubblewrap-shell.sh: Unshare all namespaces
    Call setsid() and setexeccon() befor forking the init monitor
    Install seccomp filter at the very end
    Bump version to 0.1.7
    Colin Walters (6):
    Release 0.1.6
    man: Correct namespace user -&gt; mount
    demo/shell: Add /var/tmp compat symlink, tweak PS1, add more docs
    Release 0.1.6
    ci: Combine ASAN and UBSAN
    Add --unshare-all and --share-net
- upstream changelog for 0.1.6:
    This fixes a security issue with TIOCSTI, aka CVE-2017-522. Note bubblewrap is
    far from the only program that has this issue, and I think the best fix is
    probably in the kernel to support disabling this ioctl.
    Programs can also work around this by calling setsid() on their own in an exec
    handler before doing an exevp("bwrap").
- upstream changelog for 0.1.5:
    This is a bugfix release, here are the major changes:
    Running bubblewrap as root now works again
    Various fixes for the testsuite
    Use same default compiler warnings as ostree
    Handle errors resolving symlinks during bind mounts
    Alexander Larsson (2):
    bind-mount: Check for errors in realpath()
    Bump version to 0.1.5
    Colin Walters (6):
    Don't call capset() unless we need to
    Only --unshare-user automatically if we're not root
    ci: Modernize a bit, add f25-ubsan
    README.md: Update with better one liner and more information
    utils: Add __attribute__((printf)) to die()
    build: Sync default warning -&gt; error set from ostree
    Simon McVittie (4):
    test-run: be a bash script
    test-run: don't assume we are uid 1000
    Adapt tests so they can be run against installed binaries
    Fix incorrect nesting of backticks when finding a FUSE mount</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1495713600">- update to version 0.1.8
- New --die-with-parent which is based on the Linux prctl(PR_SET_PDEATHSIG) API.
- smaller bugfixes</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1499428800">- fix build macro with rpm &lt; 4.12 (non-Factory currently)</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1505736000">- add group</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1507550400">- update to version 0.2.0
  - bwrap now automatically detects the new
  user namespace restrictions in Red Hat Enterprise Linux 7.4:
  bubblewrap: check for max_user_namespaces == 0.
  - The most notable features are new arguments --as-pid1, and
  - -cap-add/--cap-drop. These were added for running systemd (or in general a
  "full" init system) inside bubblewrap. But the capability options are also
  useful for unprivileged callers to potentially retain capbilities inside the
  sandbox (for example CAP_NET_ADMIN), when user namespaces are enabled.
  Conversely, privileged callers (uid 0) can conversely drop capabilities (without
  user namespaces). Contributed by Giuseppe Scrivano.
  - With --dev, add /dev/fd and /dev/core symlinks
  which should improve compatibility with older software.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1525176000">- update to version 0.2.1:
  * All the demos are included
  * bugfixes for the demo files
  * There was an issue with mkdir when running bubblewrap on an NFS
  filesystem that has been fixed, so flatpak now works on NFS shares.
  * Some leaks have been fixed, including a file descriptor leak.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1531569600">- update to version 0.3.0:
  * The biggest feature from this release is that bwrap
    now supports being invoked recursively (from other container
    runtimes such as Docker/podman/runc as well as bwrap itself)
    when user namespaces are enabled, and the outer container manager
    allows it (Docker's default seccomp policy doesn't).
  * This is useful for testing scenarios; for example a project
    uses Kubernetes for its CI, but inside build the project wants to run
    each unit test in their own pid namespace, without going out
    and creating a new pod for every single unit test.
  * Similarly, rpm-ostree compose tree uses bwrap internally for scripts,
    and we want to support running rpm-ostree inside a container as well.
  * Another feature is bwrap now supports -- to terminate argument
    parsing. To detect availablity of this, you could parse bwrap --version.</changelog>
  <changelog author="alarrosa@suse.com" date="1539259200">- update to version 0.3.1:
  * New feature in this release is --bind-try (as well as --dev-bind-try
    and --ro-bind-try) which works like the regular versions if the source
    exists, but does nothing if it doesn't exist.
  * The mount type for the root tmpfs was also changed to "tmpfs" instead
    of being empty, as the later could cause problems with some programs
    when parsing the mountinfo files in /proc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1559390400">- Update to version 0.3.3:
  - This release is the same as 0.3.2 but the version number in configure.ac
  was accidentally still set to 0.3.1
- Update to version 0.3.2:
  - fixes boo#1136958 / CVE-2019-12439
  This release fixes a mostly theoretical security issue in unusual/broken
  setups where `$XDG_RUNTIME_DIR` is unset.
  There are some other smaller fixes, as well as an addition to the JSON
  API that allows reading the inner process exit code, separately from
  the `bwrap` exit code.
  - Print "Out of memory" on stderr, not stdout
  - bwrap: add option json-status-fd to show child exit code
  - bwrap: Report COMMAND exit code in json-status-fd
  - man page: Describe --chdir, not nonexistent --cwd
  - Don't create our own temporary mount point for pivot_root
  - Make lockdata long enough on 32-bit with 64-bit file pointers.</changelog>
  <changelog author="alarrosa@suse.com" date="1559908800">- Use /bin/bash instead of /usr/bin/bash in SLE12</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576843200">- Update to version 0.4.0:
  + The biggest feature in this release is the support for joining
    existing user and pid namespaces. This doesn't work in the
    setuid mode (at the moment).
  + Other changes:
  - Stores namespace info in status json.
  - In setuid mode pid 1 is now marked dumpable.
  - Now builds with musl libc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1585742400">- Update to version 0.4.1:
  * retcode: fix return code with syncfd and no event_fd
  * Ensure we're always clearing the cap bounding set
  * tests: Update output patterns for libcap &gt;= 2.29
  * Don't rely on geteuid() to know when to switch back from setuid root
  * Don't support --userns2 in setuid mode
  * fixes CVE-2020-5291
  * fixes bsc#1168291</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632139200">- Update to version 0.5.0:
  + New features:
  - --chmod changes permissions
  - --clearenv unsets every environment variable (except PWD)
  - --perms sets permissions for one subsequent --bind-data,
  - -dir, --file, --ro-bind-data or --tmpfs
  + Other enhancements:
  - Better diagnostics when a --bind or other bind-mount fails
  - zsh tab-completion
  - Better test coverage
  + Bug fixes:
  - Use Python 3 for tests and examples
  - Mount points for non-directories are created with permissions
  - r--r--r-- instead of -rw-rw-rw-
  - Don't remount items in /proc read-only if already EROFS,
    required to run under Docker
  - Allow mounting an non-directory over an existing
    non-directory, e.g. --bind "$XDG_RUNTIME_DIR/my-log-socket"
    /dev/log
  - Silence kernel messages for our bind-mounts
  - Make sure pkg-config is checked for, regardless of build
    options
  - Improve ability to bind-mount directories on case-insensitive
    filesystems
  - Fix -Wshadow warnings
  - Fix deprecation warnings with newer SELinux
- Add new subpackage bubblewrap-zsh-completion</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1646395200">- Update to 0.6.1:
  - Add a release checklist
  - completions: Make zsh completion non-executable
  The Autotools build system installed it with 0644 permissions because
  it's listed as DATA, but the Meson build system installs executable
  files as executable by default.
  zsh completions don't need to be executable to work, and this one doesn't
  have the `#!` marker that should start an executable script.
- update to 0.6.0:
  - meson: Improve compatibility with Meson 0.49
  That version doesn't allow more than two arguments for define_variable.
  - Disable test-specifying-pidns.sh under 'meson dist' while I investigate
  This test is hanging when run under 'meson dist' for some reason, but
  not when run under 'meson test', and not locally, only in the Github
  Workflow-based CI. Disable it for now.
  - meson: Actually build and run the tests
  - tests: Fix compiler warnings for unused arguments
  - meson: Run test scripts from $srcdir
  - meson: Make G_TEST_SRCDIR, G_TEST_BUILDDIR match Autotools
  - meson: Run the Python test script with Python, not bash
  The python build option can be used to swap to a different interpreter,
  for environments like the Steam Runtime where the python3 executable in
  the PATH is extremely old but there is a better interpreter available.
  This is treated as non-optional, because Meson is written in Python,
  so the situation where there is no Python interpreter at build-time
  shouldn't arise.
  - meson: Build the try-syscall helper
  - meson: Build tests with equivalent of -I$(top_srcdir) -I$(top_builddir)
  - meson.build: Remove unnecessary check for sh
  - Add a Meson build system
  This allows bwrap to be built as a subproject in larger Meson projects.
  When built as a subproject, we install into the --libexecdir and
  require a program prefix to be specified: for example, Flatpak would use
  program_prefix=flatpak- to get /usr/libexec/flatpak-bwrap. Verified to
  be backwards-compatible as far as Meson 0.49.0 (Debian 9 backports).
  Loosely based on previous work by Jussi Pakkanen (see #133).
  Differences between the Autotools and Meson builds:
  The Meson build requires a version of libcap that has pkg-config
  metadata (introduced in libcap 2.23, in 2013).
  The Meson build has no equivalent of --with-priv-mode=setuid. On
  distributions like Debian &lt;= 10 and RHEL &lt;= 7 that require a setuid bwrap
  executable, the sysadmin or distribution packaging will need to set the
  correct permissions on the bwrap executable; Debian already did this via
  packaging rather than the upstream build system.
  The Meson build supports being used as a subproject, and there is CI
  for this. It automatically disables shell completions and man pages,
  moves the bubblewrap executable to ${libexecdir}, and renames the
  bubblewrap executable according to a program_prefix option that the
  caller must specify (for example, Flatpak would use
  - Dprogram_prefix=flatpak- to get /usr/libexec/flatpak-bwrap). See the
  tests/use-as-subproject/ directory for an example.
  - Use HEAD to refer to other projects' default branches in documentation
  This makes the URL independent of the name they have chosen for their
  default branches.
  - workflows: Update for rename of default branch to main
  - tests: Exercise seccomp filters
  - Allow loading more than one seccomp program
  This will allow Flatpak to combine an allow-list (default-deny) of
  known system calls with a deny-list (default-allow) of system calls
  that are undesired.
  Resolves: https://github.com/containers/bubblewrap/issues/453
  - Generalize linked lists of LockFile and SetupOp
  I'm about to add a third linked list, for seccomp programs, which would
  seem like too much duplication.
  - Handle argc == 0 better
  Unfortunately it's possible for argc to be 0, so error out pretty early
  on in that case. I don't think this is a security issue in this case.
  - Fix typo
  - Remove trailing whitespace
  - Fix spelling
  - bash: Fix shellcheck warnings
  - bash: Invoke bash using /usr/bin/env
  - bubblewrap: Avoid a -Wjump-misses-init false-positive
  When building with -Wjump-misses-init as part of a larger project, gcc
  reports that we jump past initialization of cover_proc_dirs. This is
  technically true, but we only use this variable in the case where it's
  initialized, so that's harmless.
  However, we can avoid this altogether by making the array static and
  constant, which allows it to be moved from initialized data to read-only
  data.
  - bind-mount: Be more const-correct
  When compiled with -Wwrite-strings as part of a larger project, gcc and
  clang both warn that we're assigning a string constant to a mutable
  struct member. There's actually no reason why it should be mutable, so
  make it const.
  - die_with_error: Save errno sooner
  We need to save errno immediately, otherwise it could be overwritten
  by a failing library call somewhere in the implementation of fprintf.
  - main: Warn when non-repeatable options are repeated
  A user might reasonably expect that `bwrap --seccomp 3 --seccomp 4 ...`
  would load seccomp programs from both fds 3 and 4, but in fact it only
  loads the program from fd 4.
  Helps: https://github.com/containers/bubblewrap/issues/453
  Resolves: https://github.com/containers/bubblewrap/issues/454
  - utils: Add warn()
  - Add SPDX-License-Identifier for files that already specify license
  This is a step towards REUSE compliance. Third-party files that we do
  not otherwise edit (git.mk, m4/attributes.m4) are excluded here.
  - tests: Use preferred spelling for SPDX license identifiers
  - Remove obsolete .travis.yml
  We no longer use Travis-CI.
  - Remove obsolete papr CI
  We no longer use this.</changelog>
  <changelog author="dimstar@opensuse.org" date="1652875200">- Update to version 0.6.2:
  + New features in Meson build:
  - Auto-detect whether the man page can be generated.
  - -Dbwrapdir=... changes the installation directory (useful
    when being used as a subproject).
  - -Dtests=false disables unit tests.
  + Bug fixes:
  - Add --add-seccomp-fd to shell completions
  - Document --add-seccomp-fd, --json-status-fd and --share-net
    in the man page
  - Add attributes to silence various compiler warnings
  - Allow compilation of tests with musl on mips architectures
  - Allow compilation with older glibc
  - Disable sanitizers for a test helper whose seccomp profile
    breaks the instrumentation
  - Disable AddressSanitizer leak detection where it interferes
    with unit testing</changelog>
  <changelog author="dmueller@suse.com" date="1670414400">- update to v0.7.0:
  * --size option controls the size of a subsequent --tmpfs (#509)
  * Better error messages if a mount operation fails (#472)
  * Better error message if creating the new user namespace fails with
    ENOSPC (#487)
  * When building as a Meson subproject, a RUNPATH can be set on the
    executable to make it easier to bundle its libcap dependency
  * Fix test failures when running as uid 0 but with limited capabilities
    (#510)
  * Use POSIX command -v in preference to non-standard which (#527)
  * Fix a copy/paste error in --help (#531)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1679918400">- update to v0.8.0:
  * Add --disable-userns option to prevent the sandbox from
    creating its own nested user namespace
  * Add --assert-userns-disabled option to check that an existing
    userns was created with --disable-userns
  * Give a clearer error message if the kernel doesn't have
    CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER</changelog>
</package>
<package pkgid="b9ef684a283e5942ccccc6a73b99fd88982ad07042fab71ab52595dcbd196bbe" name="bubblewrap-zsh-completion" arch="s390x">
  <version epoch="0" ver="0.8.0" rel="150500.3.3.1"/>
  <changelog author="klember@redhat.com" date="1473681600">- Update to 0.1.2</changelog>
  <changelog author="walters@verbum.org" date="1476446400">- New upstream version</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1481889600">- upgrade to upstream version 0.1.4
- Build also for Leap 42.2</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1488456000">- upgrade to upstream version 0.1.7
- note that this package was *never* affected by CVE-2017-5226
  as it was introduced in version 0.1.6
- upstream changelog of version 0.1.7:
    This release backs out the change in 0.1.6 which unconditionally
    called setsid() in order to fix a security issue with TIOCSTI, aka
    CVE-2017-522. That change caused some behavioural issues that are
    hard to work with in some cases. For instance, it makes shell job
    control not work for the bwrap command.
    Instead there is now a new option --new-session which works like
    0.1.6. It is recommended that you use this if possible, but if not we
    recommended that you neutralize this some other way, for instance
    using SECCOMP, which is what flatpak does:
    https://github.com/flatpak/flatpak/commit/902fb713990a8f968ea4350c7c2a27ff46f1a6c4
    In order to make it easy to create maximally safe sandboxes we have
    also added a new commandline switch called --unshare-all. It unshares
    all possible namespaces and is currently equivalent with:
  - -unshare-user-try --unshare-ipc --unshare-pid --unshare-net
  - -unshare-uts --unshare-cgroup-try
    However, the intent is that as new namespaces are added to the kernel they will
    be added to this list. Additionally, if --share-net is specified the network
    namespace is not unshared.
    This release also has some bugfixes:
    bwrap reaps (unexpected) children that are inherited from the
    parent, something which can happen if bwrap is part of a shell
    pipeline.
    bwrap clears the capability bounding set. The permitted
    capabilities was already empty, and use of PR_NO_NEW_PRIVS should
    make it impossible to increase the capabilities, but more
    layers of protection is better.
    The seccomp filter is now installed at the very end of bwrap, which
    means the requirement of the filter is minimal. Any bwrap seccomp
    filter must at least allow: execve, waitpid and write
    Alexander Larsson (7):
    Handle inherited children dying
    Clear capability bounding set
    Make the call to setsid() optional, with --new-session
    demos/bubblewrap-shell.sh: Unshare all namespaces
    Call setsid() and setexeccon() befor forking the init monitor
    Install seccomp filter at the very end
    Bump version to 0.1.7
    Colin Walters (6):
    Release 0.1.6
    man: Correct namespace user -&gt; mount
    demo/shell: Add /var/tmp compat symlink, tweak PS1, add more docs
    Release 0.1.6
    ci: Combine ASAN and UBSAN
    Add --unshare-all and --share-net
- upstream changelog for 0.1.6:
    This fixes a security issue with TIOCSTI, aka CVE-2017-522. Note bubblewrap is
    far from the only program that has this issue, and I think the best fix is
    probably in the kernel to support disabling this ioctl.
    Programs can also work around this by calling setsid() on their own in an exec
    handler before doing an exevp("bwrap").
- upstream changelog for 0.1.5:
    This is a bugfix release, here are the major changes:
    Running bubblewrap as root now works again
    Various fixes for the testsuite
    Use same default compiler warnings as ostree
    Handle errors resolving symlinks during bind mounts
    Alexander Larsson (2):
    bind-mount: Check for errors in realpath()
    Bump version to 0.1.5
    Colin Walters (6):
    Don't call capset() unless we need to
    Only --unshare-user automatically if we're not root
    ci: Modernize a bit, add f25-ubsan
    README.md: Update with better one liner and more information
    utils: Add __attribute__((printf)) to die()
    build: Sync default warning -&gt; error set from ostree
    Simon McVittie (4):
    test-run: be a bash script
    test-run: don't assume we are uid 1000
    Adapt tests so they can be run against installed binaries
    Fix incorrect nesting of backticks when finding a FUSE mount</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1495713600">- update to version 0.1.8
- New --die-with-parent which is based on the Linux prctl(PR_SET_PDEATHSIG) API.
- smaller bugfixes</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1499428800">- fix build macro with rpm &lt; 4.12 (non-Factory currently)</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1505736000">- add group</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1507550400">- update to version 0.2.0
  - bwrap now automatically detects the new
  user namespace restrictions in Red Hat Enterprise Linux 7.4:
  bubblewrap: check for max_user_namespaces == 0.
  - The most notable features are new arguments --as-pid1, and
  - -cap-add/--cap-drop. These were added for running systemd (or in general a
  "full" init system) inside bubblewrap. But the capability options are also
  useful for unprivileged callers to potentially retain capbilities inside the
  sandbox (for example CAP_NET_ADMIN), when user namespaces are enabled.
  Conversely, privileged callers (uid 0) can conversely drop capabilities (without
  user namespaces). Contributed by Giuseppe Scrivano.
  - With --dev, add /dev/fd and /dev/core symlinks
  which should improve compatibility with older software.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1525176000">- update to version 0.2.1:
  * All the demos are included
  * bugfixes for the demo files
  * There was an issue with mkdir when running bubblewrap on an NFS
  filesystem that has been fixed, so flatpak now works on NFS shares.
  * Some leaks have been fixed, including a file descriptor leak.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1531569600">- update to version 0.3.0:
  * The biggest feature from this release is that bwrap
    now supports being invoked recursively (from other container
    runtimes such as Docker/podman/runc as well as bwrap itself)
    when user namespaces are enabled, and the outer container manager
    allows it (Docker's default seccomp policy doesn't).
  * This is useful for testing scenarios; for example a project
    uses Kubernetes for its CI, but inside build the project wants to run
    each unit test in their own pid namespace, without going out
    and creating a new pod for every single unit test.
  * Similarly, rpm-ostree compose tree uses bwrap internally for scripts,
    and we want to support running rpm-ostree inside a container as well.
  * Another feature is bwrap now supports -- to terminate argument
    parsing. To detect availablity of this, you could parse bwrap --version.</changelog>
  <changelog author="alarrosa@suse.com" date="1539259200">- update to version 0.3.1:
  * New feature in this release is --bind-try (as well as --dev-bind-try
    and --ro-bind-try) which works like the regular versions if the source
    exists, but does nothing if it doesn't exist.
  * The mount type for the root tmpfs was also changed to "tmpfs" instead
    of being empty, as the later could cause problems with some programs
    when parsing the mountinfo files in /proc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1559390400">- Update to version 0.3.3:
  - This release is the same as 0.3.2 but the version number in configure.ac
  was accidentally still set to 0.3.1
- Update to version 0.3.2:
  - fixes boo#1136958 / CVE-2019-12439
  This release fixes a mostly theoretical security issue in unusual/broken
  setups where `$XDG_RUNTIME_DIR` is unset.
  There are some other smaller fixes, as well as an addition to the JSON
  API that allows reading the inner process exit code, separately from
  the `bwrap` exit code.
  - Print "Out of memory" on stderr, not stdout
  - bwrap: add option json-status-fd to show child exit code
  - bwrap: Report COMMAND exit code in json-status-fd
  - man page: Describe --chdir, not nonexistent --cwd
  - Don't create our own temporary mount point for pivot_root
  - Make lockdata long enough on 32-bit with 64-bit file pointers.</changelog>
  <changelog author="alarrosa@suse.com" date="1559908800">- Use /bin/bash instead of /usr/bin/bash in SLE12</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576843200">- Update to version 0.4.0:
  + The biggest feature in this release is the support for joining
    existing user and pid namespaces. This doesn't work in the
    setuid mode (at the moment).
  + Other changes:
  - Stores namespace info in status json.
  - In setuid mode pid 1 is now marked dumpable.
  - Now builds with musl libc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1585742400">- Update to version 0.4.1:
  * retcode: fix return code with syncfd and no event_fd
  * Ensure we're always clearing the cap bounding set
  * tests: Update output patterns for libcap &gt;= 2.29
  * Don't rely on geteuid() to know when to switch back from setuid root
  * Don't support --userns2 in setuid mode
  * fixes CVE-2020-5291
  * fixes bsc#1168291</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632139200">- Update to version 0.5.0:
  + New features:
  - --chmod changes permissions
  - --clearenv unsets every environment variable (except PWD)
  - --perms sets permissions for one subsequent --bind-data,
  - -dir, --file, --ro-bind-data or --tmpfs
  + Other enhancements:
  - Better diagnostics when a --bind or other bind-mount fails
  - zsh tab-completion
  - Better test coverage
  + Bug fixes:
  - Use Python 3 for tests and examples
  - Mount points for non-directories are created with permissions
  - r--r--r-- instead of -rw-rw-rw-
  - Don't remount items in /proc read-only if already EROFS,
    required to run under Docker
  - Allow mounting an non-directory over an existing
    non-directory, e.g. --bind "$XDG_RUNTIME_DIR/my-log-socket"
    /dev/log
  - Silence kernel messages for our bind-mounts
  - Make sure pkg-config is checked for, regardless of build
    options
  - Improve ability to bind-mount directories on case-insensitive
    filesystems
  - Fix -Wshadow warnings
  - Fix deprecation warnings with newer SELinux
- Add new subpackage bubblewrap-zsh-completion</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1646395200">- Update to 0.6.1:
  - Add a release checklist
  - completions: Make zsh completion non-executable
  The Autotools build system installed it with 0644 permissions because
  it's listed as DATA, but the Meson build system installs executable
  files as executable by default.
  zsh completions don't need to be executable to work, and this one doesn't
  have the `#!` marker that should start an executable script.
- update to 0.6.0:
  - meson: Improve compatibility with Meson 0.49
  That version doesn't allow more than two arguments for define_variable.
  - Disable test-specifying-pidns.sh under 'meson dist' while I investigate
  This test is hanging when run under 'meson dist' for some reason, but
  not when run under 'meson test', and not locally, only in the Github
  Workflow-based CI. Disable it for now.
  - meson: Actually build and run the tests
  - tests: Fix compiler warnings for unused arguments
  - meson: Run test scripts from $srcdir
  - meson: Make G_TEST_SRCDIR, G_TEST_BUILDDIR match Autotools
  - meson: Run the Python test script with Python, not bash
  The python build option can be used to swap to a different interpreter,
  for environments like the Steam Runtime where the python3 executable in
  the PATH is extremely old but there is a better interpreter available.
  This is treated as non-optional, because Meson is written in Python,
  so the situation where there is no Python interpreter at build-time
  shouldn't arise.
  - meson: Build the try-syscall helper
  - meson: Build tests with equivalent of -I$(top_srcdir) -I$(top_builddir)
  - meson.build: Remove unnecessary check for sh
  - Add a Meson build system
  This allows bwrap to be built as a subproject in larger Meson projects.
  When built as a subproject, we install into the --libexecdir and
  require a program prefix to be specified: for example, Flatpak would use
  program_prefix=flatpak- to get /usr/libexec/flatpak-bwrap. Verified to
  be backwards-compatible as far as Meson 0.49.0 (Debian 9 backports).
  Loosely based on previous work by Jussi Pakkanen (see #133).
  Differences between the Autotools and Meson builds:
  The Meson build requires a version of libcap that has pkg-config
  metadata (introduced in libcap 2.23, in 2013).
  The Meson build has no equivalent of --with-priv-mode=setuid. On
  distributions like Debian &lt;= 10 and RHEL &lt;= 7 that require a setuid bwrap
  executable, the sysadmin or distribution packaging will need to set the
  correct permissions on the bwrap executable; Debian already did this via
  packaging rather than the upstream build system.
  The Meson build supports being used as a subproject, and there is CI
  for this. It automatically disables shell completions and man pages,
  moves the bubblewrap executable to ${libexecdir}, and renames the
  bubblewrap executable according to a program_prefix option that the
  caller must specify (for example, Flatpak would use
  - Dprogram_prefix=flatpak- to get /usr/libexec/flatpak-bwrap). See the
  tests/use-as-subproject/ directory for an example.
  - Use HEAD to refer to other projects' default branches in documentation
  This makes the URL independent of the name they have chosen for their
  default branches.
  - workflows: Update for rename of default branch to main
  - tests: Exercise seccomp filters
  - Allow loading more than one seccomp program
  This will allow Flatpak to combine an allow-list (default-deny) of
  known system calls with a deny-list (default-allow) of system calls
  that are undesired.
  Resolves: https://github.com/containers/bubblewrap/issues/453
  - Generalize linked lists of LockFile and SetupOp
  I'm about to add a third linked list, for seccomp programs, which would
  seem like too much duplication.
  - Handle argc == 0 better
  Unfortunately it's possible for argc to be 0, so error out pretty early
  on in that case. I don't think this is a security issue in this case.
  - Fix typo
  - Remove trailing whitespace
  - Fix spelling
  - bash: Fix shellcheck warnings
  - bash: Invoke bash using /usr/bin/env
  - bubblewrap: Avoid a -Wjump-misses-init false-positive
  When building with -Wjump-misses-init as part of a larger project, gcc
  reports that we jump past initialization of cover_proc_dirs. This is
  technically true, but we only use this variable in the case where it's
  initialized, so that's harmless.
  However, we can avoid this altogether by making the array static and
  constant, which allows it to be moved from initialized data to read-only
  data.
  - bind-mount: Be more const-correct
  When compiled with -Wwrite-strings as part of a larger project, gcc and
  clang both warn that we're assigning a string constant to a mutable
  struct member. There's actually no reason why it should be mutable, so
  make it const.
  - die_with_error: Save errno sooner
  We need to save errno immediately, otherwise it could be overwritten
  by a failing library call somewhere in the implementation of fprintf.
  - main: Warn when non-repeatable options are repeated
  A user might reasonably expect that `bwrap --seccomp 3 --seccomp 4 ...`
  would load seccomp programs from both fds 3 and 4, but in fact it only
  loads the program from fd 4.
  Helps: https://github.com/containers/bubblewrap/issues/453
  Resolves: https://github.com/containers/bubblewrap/issues/454
  - utils: Add warn()
  - Add SPDX-License-Identifier for files that already specify license
  This is a step towards REUSE compliance. Third-party files that we do
  not otherwise edit (git.mk, m4/attributes.m4) are excluded here.
  - tests: Use preferred spelling for SPDX license identifiers
  - Remove obsolete .travis.yml
  We no longer use Travis-CI.
  - Remove obsolete papr CI
  We no longer use this.</changelog>
  <changelog author="dimstar@opensuse.org" date="1652875200">- Update to version 0.6.2:
  + New features in Meson build:
  - Auto-detect whether the man page can be generated.
  - -Dbwrapdir=... changes the installation directory (useful
    when being used as a subproject).
  - -Dtests=false disables unit tests.
  + Bug fixes:
  - Add --add-seccomp-fd to shell completions
  - Document --add-seccomp-fd, --json-status-fd and --share-net
    in the man page
  - Add attributes to silence various compiler warnings
  - Allow compilation of tests with musl on mips architectures
  - Allow compilation with older glibc
  - Disable sanitizers for a test helper whose seccomp profile
    breaks the instrumentation
  - Disable AddressSanitizer leak detection where it interferes
    with unit testing</changelog>
  <changelog author="dmueller@suse.com" date="1670414400">- update to v0.7.0:
  * --size option controls the size of a subsequent --tmpfs (#509)
  * Better error messages if a mount operation fails (#472)
  * Better error message if creating the new user namespace fails with
    ENOSPC (#487)
  * When building as a Meson subproject, a RUNPATH can be set on the
    executable to make it easier to bundle its libcap dependency
  * Fix test failures when running as uid 0 but with limited capabilities
    (#510)
  * Use POSIX command -v in preference to non-standard which (#527)
  * Fix a copy/paste error in --help (#531)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1679918400">- update to v0.8.0:
  * Add --disable-userns option to prevent the sandbox from
    creating its own nested user namespace
  * Add --assert-userns-disabled option to check that an existing
    userns was created with --disable-userns
  * Give a clearer error message if the kernel doesn't have
    CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER</changelog>
</package>
<package pkgid="555f6e2eb276407c59429f08ad8dc2f125a89081e5a26e92768671c90aa7e2e7" name="bubblewrap-zsh-completion" arch="x86_64">
  <version epoch="0" ver="0.8.0" rel="150500.3.3.1"/>
  <changelog author="klember@redhat.com" date="1473681600">- Update to 0.1.2</changelog>
  <changelog author="walters@verbum.org" date="1476446400">- New upstream version</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1481889600">- upgrade to upstream version 0.1.4
- Build also for Leap 42.2</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1488456000">- upgrade to upstream version 0.1.7
- note that this package was *never* affected by CVE-2017-5226
  as it was introduced in version 0.1.6
- upstream changelog of version 0.1.7:
    This release backs out the change in 0.1.6 which unconditionally
    called setsid() in order to fix a security issue with TIOCSTI, aka
    CVE-2017-522. That change caused some behavioural issues that are
    hard to work with in some cases. For instance, it makes shell job
    control not work for the bwrap command.
    Instead there is now a new option --new-session which works like
    0.1.6. It is recommended that you use this if possible, but if not we
    recommended that you neutralize this some other way, for instance
    using SECCOMP, which is what flatpak does:
    https://github.com/flatpak/flatpak/commit/902fb713990a8f968ea4350c7c2a27ff46f1a6c4
    In order to make it easy to create maximally safe sandboxes we have
    also added a new commandline switch called --unshare-all. It unshares
    all possible namespaces and is currently equivalent with:
  - -unshare-user-try --unshare-ipc --unshare-pid --unshare-net
  - -unshare-uts --unshare-cgroup-try
    However, the intent is that as new namespaces are added to the kernel they will
    be added to this list. Additionally, if --share-net is specified the network
    namespace is not unshared.
    This release also has some bugfixes:
    bwrap reaps (unexpected) children that are inherited from the
    parent, something which can happen if bwrap is part of a shell
    pipeline.
    bwrap clears the capability bounding set. The permitted
    capabilities was already empty, and use of PR_NO_NEW_PRIVS should
    make it impossible to increase the capabilities, but more
    layers of protection is better.
    The seccomp filter is now installed at the very end of bwrap, which
    means the requirement of the filter is minimal. Any bwrap seccomp
    filter must at least allow: execve, waitpid and write
    Alexander Larsson (7):
    Handle inherited children dying
    Clear capability bounding set
    Make the call to setsid() optional, with --new-session
    demos/bubblewrap-shell.sh: Unshare all namespaces
    Call setsid() and setexeccon() befor forking the init monitor
    Install seccomp filter at the very end
    Bump version to 0.1.7
    Colin Walters (6):
    Release 0.1.6
    man: Correct namespace user -&gt; mount
    demo/shell: Add /var/tmp compat symlink, tweak PS1, add more docs
    Release 0.1.6
    ci: Combine ASAN and UBSAN
    Add --unshare-all and --share-net
- upstream changelog for 0.1.6:
    This fixes a security issue with TIOCSTI, aka CVE-2017-522. Note bubblewrap is
    far from the only program that has this issue, and I think the best fix is
    probably in the kernel to support disabling this ioctl.
    Programs can also work around this by calling setsid() on their own in an exec
    handler before doing an exevp("bwrap").
- upstream changelog for 0.1.5:
    This is a bugfix release, here are the major changes:
    Running bubblewrap as root now works again
    Various fixes for the testsuite
    Use same default compiler warnings as ostree
    Handle errors resolving symlinks during bind mounts
    Alexander Larsson (2):
    bind-mount: Check for errors in realpath()
    Bump version to 0.1.5
    Colin Walters (6):
    Don't call capset() unless we need to
    Only --unshare-user automatically if we're not root
    ci: Modernize a bit, add f25-ubsan
    README.md: Update with better one liner and more information
    utils: Add __attribute__((printf)) to die()
    build: Sync default warning -&gt; error set from ostree
    Simon McVittie (4):
    test-run: be a bash script
    test-run: don't assume we are uid 1000
    Adapt tests so they can be run against installed binaries
    Fix incorrect nesting of backticks when finding a FUSE mount</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1495713600">- update to version 0.1.8
- New --die-with-parent which is based on the Linux prctl(PR_SET_PDEATHSIG) API.
- smaller bugfixes</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1499428800">- fix build macro with rpm &lt; 4.12 (non-Factory currently)</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1505736000">- add group</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1507550400">- update to version 0.2.0
  - bwrap now automatically detects the new
  user namespace restrictions in Red Hat Enterprise Linux 7.4:
  bubblewrap: check for max_user_namespaces == 0.
  - The most notable features are new arguments --as-pid1, and
  - -cap-add/--cap-drop. These were added for running systemd (or in general a
  "full" init system) inside bubblewrap. But the capability options are also
  useful for unprivileged callers to potentially retain capbilities inside the
  sandbox (for example CAP_NET_ADMIN), when user namespaces are enabled.
  Conversely, privileged callers (uid 0) can conversely drop capabilities (without
  user namespaces). Contributed by Giuseppe Scrivano.
  - With --dev, add /dev/fd and /dev/core symlinks
  which should improve compatibility with older software.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1525176000">- update to version 0.2.1:
  * All the demos are included
  * bugfixes for the demo files
  * There was an issue with mkdir when running bubblewrap on an NFS
  filesystem that has been fixed, so flatpak now works on NFS shares.
  * Some leaks have been fixed, including a file descriptor leak.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1531569600">- update to version 0.3.0:
  * The biggest feature from this release is that bwrap
    now supports being invoked recursively (from other container
    runtimes such as Docker/podman/runc as well as bwrap itself)
    when user namespaces are enabled, and the outer container manager
    allows it (Docker's default seccomp policy doesn't).
  * This is useful for testing scenarios; for example a project
    uses Kubernetes for its CI, but inside build the project wants to run
    each unit test in their own pid namespace, without going out
    and creating a new pod for every single unit test.
  * Similarly, rpm-ostree compose tree uses bwrap internally for scripts,
    and we want to support running rpm-ostree inside a container as well.
  * Another feature is bwrap now supports -- to terminate argument
    parsing. To detect availablity of this, you could parse bwrap --version.</changelog>
  <changelog author="alarrosa@suse.com" date="1539259200">- update to version 0.3.1:
  * New feature in this release is --bind-try (as well as --dev-bind-try
    and --ro-bind-try) which works like the regular versions if the source
    exists, but does nothing if it doesn't exist.
  * The mount type for the root tmpfs was also changed to "tmpfs" instead
    of being empty, as the later could cause problems with some programs
    when parsing the mountinfo files in /proc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1559390400">- Update to version 0.3.3:
  - This release is the same as 0.3.2 but the version number in configure.ac
  was accidentally still set to 0.3.1
- Update to version 0.3.2:
  - fixes boo#1136958 / CVE-2019-12439
  This release fixes a mostly theoretical security issue in unusual/broken
  setups where `$XDG_RUNTIME_DIR` is unset.
  There are some other smaller fixes, as well as an addition to the JSON
  API that allows reading the inner process exit code, separately from
  the `bwrap` exit code.
  - Print "Out of memory" on stderr, not stdout
  - bwrap: add option json-status-fd to show child exit code
  - bwrap: Report COMMAND exit code in json-status-fd
  - man page: Describe --chdir, not nonexistent --cwd
  - Don't create our own temporary mount point for pivot_root
  - Make lockdata long enough on 32-bit with 64-bit file pointers.</changelog>
  <changelog author="alarrosa@suse.com" date="1559908800">- Use /bin/bash instead of /usr/bin/bash in SLE12</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576843200">- Update to version 0.4.0:
  + The biggest feature in this release is the support for joining
    existing user and pid namespaces. This doesn't work in the
    setuid mode (at the moment).
  + Other changes:
  - Stores namespace info in status json.
  - In setuid mode pid 1 is now marked dumpable.
  - Now builds with musl libc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1585742400">- Update to version 0.4.1:
  * retcode: fix return code with syncfd and no event_fd
  * Ensure we're always clearing the cap bounding set
  * tests: Update output patterns for libcap &gt;= 2.29
  * Don't rely on geteuid() to know when to switch back from setuid root
  * Don't support --userns2 in setuid mode
  * fixes CVE-2020-5291
  * fixes bsc#1168291</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632139200">- Update to version 0.5.0:
  + New features:
  - --chmod changes permissions
  - --clearenv unsets every environment variable (except PWD)
  - --perms sets permissions for one subsequent --bind-data,
  - -dir, --file, --ro-bind-data or --tmpfs
  + Other enhancements:
  - Better diagnostics when a --bind or other bind-mount fails
  - zsh tab-completion
  - Better test coverage
  + Bug fixes:
  - Use Python 3 for tests and examples
  - Mount points for non-directories are created with permissions
  - r--r--r-- instead of -rw-rw-rw-
  - Don't remount items in /proc read-only if already EROFS,
    required to run under Docker
  - Allow mounting an non-directory over an existing
    non-directory, e.g. --bind "$XDG_RUNTIME_DIR/my-log-socket"
    /dev/log
  - Silence kernel messages for our bind-mounts
  - Make sure pkg-config is checked for, regardless of build
    options
  - Improve ability to bind-mount directories on case-insensitive
    filesystems
  - Fix -Wshadow warnings
  - Fix deprecation warnings with newer SELinux
- Add new subpackage bubblewrap-zsh-completion</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1646395200">- Update to 0.6.1:
  - Add a release checklist
  - completions: Make zsh completion non-executable
  The Autotools build system installed it with 0644 permissions because
  it's listed as DATA, but the Meson build system installs executable
  files as executable by default.
  zsh completions don't need to be executable to work, and this one doesn't
  have the `#!` marker that should start an executable script.
- update to 0.6.0:
  - meson: Improve compatibility with Meson 0.49
  That version doesn't allow more than two arguments for define_variable.
  - Disable test-specifying-pidns.sh under 'meson dist' while I investigate
  This test is hanging when run under 'meson dist' for some reason, but
  not when run under 'meson test', and not locally, only in the Github
  Workflow-based CI. Disable it for now.
  - meson: Actually build and run the tests
  - tests: Fix compiler warnings for unused arguments
  - meson: Run test scripts from $srcdir
  - meson: Make G_TEST_SRCDIR, G_TEST_BUILDDIR match Autotools
  - meson: Run the Python test script with Python, not bash
  The python build option can be used to swap to a different interpreter,
  for environments like the Steam Runtime where the python3 executable in
  the PATH is extremely old but there is a better interpreter available.
  This is treated as non-optional, because Meson is written in Python,
  so the situation where there is no Python interpreter at build-time
  shouldn't arise.
  - meson: Build the try-syscall helper
  - meson: Build tests with equivalent of -I$(top_srcdir) -I$(top_builddir)
  - meson.build: Remove unnecessary check for sh
  - Add a Meson build system
  This allows bwrap to be built as a subproject in larger Meson projects.
  When built as a subproject, we install into the --libexecdir and
  require a program prefix to be specified: for example, Flatpak would use
  program_prefix=flatpak- to get /usr/libexec/flatpak-bwrap. Verified to
  be backwards-compatible as far as Meson 0.49.0 (Debian 9 backports).
  Loosely based on previous work by Jussi Pakkanen (see #133).
  Differences between the Autotools and Meson builds:
  The Meson build requires a version of libcap that has pkg-config
  metadata (introduced in libcap 2.23, in 2013).
  The Meson build has no equivalent of --with-priv-mode=setuid. On
  distributions like Debian &lt;= 10 and RHEL &lt;= 7 that require a setuid bwrap
  executable, the sysadmin or distribution packaging will need to set the
  correct permissions on the bwrap executable; Debian already did this via
  packaging rather than the upstream build system.
  The Meson build supports being used as a subproject, and there is CI
  for this. It automatically disables shell completions and man pages,
  moves the bubblewrap executable to ${libexecdir}, and renames the
  bubblewrap executable according to a program_prefix option that the
  caller must specify (for example, Flatpak would use
  - Dprogram_prefix=flatpak- to get /usr/libexec/flatpak-bwrap). See the
  tests/use-as-subproject/ directory for an example.
  - Use HEAD to refer to other projects' default branches in documentation
  This makes the URL independent of the name they have chosen for their
  default branches.
  - workflows: Update for rename of default branch to main
  - tests: Exercise seccomp filters
  - Allow loading more than one seccomp program
  This will allow Flatpak to combine an allow-list (default-deny) of
  known system calls with a deny-list (default-allow) of system calls
  that are undesired.
  Resolves: https://github.com/containers/bubblewrap/issues/453
  - Generalize linked lists of LockFile and SetupOp
  I'm about to add a third linked list, for seccomp programs, which would
  seem like too much duplication.
  - Handle argc == 0 better
  Unfortunately it's possible for argc to be 0, so error out pretty early
  on in that case. I don't think this is a security issue in this case.
  - Fix typo
  - Remove trailing whitespace
  - Fix spelling
  - bash: Fix shellcheck warnings
  - bash: Invoke bash using /usr/bin/env
  - bubblewrap: Avoid a -Wjump-misses-init false-positive
  When building with -Wjump-misses-init as part of a larger project, gcc
  reports that we jump past initialization of cover_proc_dirs. This is
  technically true, but we only use this variable in the case where it's
  initialized, so that's harmless.
  However, we can avoid this altogether by making the array static and
  constant, which allows it to be moved from initialized data to read-only
  data.
  - bind-mount: Be more const-correct
  When compiled with -Wwrite-strings as part of a larger project, gcc and
  clang both warn that we're assigning a string constant to a mutable
  struct member. There's actually no reason why it should be mutable, so
  make it const.
  - die_with_error: Save errno sooner
  We need to save errno immediately, otherwise it could be overwritten
  by a failing library call somewhere in the implementation of fprintf.
  - main: Warn when non-repeatable options are repeated
  A user might reasonably expect that `bwrap --seccomp 3 --seccomp 4 ...`
  would load seccomp programs from both fds 3 and 4, but in fact it only
  loads the program from fd 4.
  Helps: https://github.com/containers/bubblewrap/issues/453
  Resolves: https://github.com/containers/bubblewrap/issues/454
  - utils: Add warn()
  - Add SPDX-License-Identifier for files that already specify license
  This is a step towards REUSE compliance. Third-party files that we do
  not otherwise edit (git.mk, m4/attributes.m4) are excluded here.
  - tests: Use preferred spelling for SPDX license identifiers
  - Remove obsolete .travis.yml
  We no longer use Travis-CI.
  - Remove obsolete papr CI
  We no longer use this.</changelog>
  <changelog author="dimstar@opensuse.org" date="1652875200">- Update to version 0.6.2:
  + New features in Meson build:
  - Auto-detect whether the man page can be generated.
  - -Dbwrapdir=... changes the installation directory (useful
    when being used as a subproject).
  - -Dtests=false disables unit tests.
  + Bug fixes:
  - Add --add-seccomp-fd to shell completions
  - Document --add-seccomp-fd, --json-status-fd and --share-net
    in the man page
  - Add attributes to silence various compiler warnings
  - Allow compilation of tests with musl on mips architectures
  - Allow compilation with older glibc
  - Disable sanitizers for a test helper whose seccomp profile
    breaks the instrumentation
  - Disable AddressSanitizer leak detection where it interferes
    with unit testing</changelog>
  <changelog author="dmueller@suse.com" date="1670414400">- update to v0.7.0:
  * --size option controls the size of a subsequent --tmpfs (#509)
  * Better error messages if a mount operation fails (#472)
  * Better error message if creating the new user namespace fails with
    ENOSPC (#487)
  * When building as a Meson subproject, a RUNPATH can be set on the
    executable to make it easier to bundle its libcap dependency
  * Fix test failures when running as uid 0 but with limited capabilities
    (#510)
  * Use POSIX command -v in preference to non-standard which (#527)
  * Fix a copy/paste error in --help (#531)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1679918400">- update to v0.8.0:
  * Add --disable-userns option to prevent the sandbox from
    creating its own nested user namespace
  * Add --assert-userns-disabled option to check that an existing
    userns was created with --disable-userns
  * Give a clearer error message if the kernel doesn't have
    CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER</changelog>
</package>
<package pkgid="245d205402a6c11f4ed054a56cac09276636f539bb9fe0b52c5e0d96692c5ad9" name="bubblewrap-zsh-completion" arch="aarch64">
  <version epoch="0" ver="0.8.0" rel="150500.3.6.1"/>
  <changelog author="walters@verbum.org" date="1476446400">- New upstream version</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1481889600">- upgrade to upstream version 0.1.4
- Build also for Leap 42.2</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1488456000">- upgrade to upstream version 0.1.7
- note that this package was *never* affected by CVE-2017-5226
  as it was introduced in version 0.1.6
- upstream changelog of version 0.1.7:
    This release backs out the change in 0.1.6 which unconditionally
    called setsid() in order to fix a security issue with TIOCSTI, aka
    CVE-2017-522. That change caused some behavioural issues that are
    hard to work with in some cases. For instance, it makes shell job
    control not work for the bwrap command.
    Instead there is now a new option --new-session which works like
    0.1.6. It is recommended that you use this if possible, but if not we
    recommended that you neutralize this some other way, for instance
    using SECCOMP, which is what flatpak does:
    https://github.com/flatpak/flatpak/commit/902fb713990a8f968ea4350c7c2a27ff46f1a6c4
    In order to make it easy to create maximally safe sandboxes we have
    also added a new commandline switch called --unshare-all. It unshares
    all possible namespaces and is currently equivalent with:
  - -unshare-user-try --unshare-ipc --unshare-pid --unshare-net
  - -unshare-uts --unshare-cgroup-try
    However, the intent is that as new namespaces are added to the kernel they will
    be added to this list. Additionally, if --share-net is specified the network
    namespace is not unshared.
    This release also has some bugfixes:
    bwrap reaps (unexpected) children that are inherited from the
    parent, something which can happen if bwrap is part of a shell
    pipeline.
    bwrap clears the capability bounding set. The permitted
    capabilities was already empty, and use of PR_NO_NEW_PRIVS should
    make it impossible to increase the capabilities, but more
    layers of protection is better.
    The seccomp filter is now installed at the very end of bwrap, which
    means the requirement of the filter is minimal. Any bwrap seccomp
    filter must at least allow: execve, waitpid and write
    Alexander Larsson (7):
    Handle inherited children dying
    Clear capability bounding set
    Make the call to setsid() optional, with --new-session
    demos/bubblewrap-shell.sh: Unshare all namespaces
    Call setsid() and setexeccon() befor forking the init monitor
    Install seccomp filter at the very end
    Bump version to 0.1.7
    Colin Walters (6):
    Release 0.1.6
    man: Correct namespace user -&gt; mount
    demo/shell: Add /var/tmp compat symlink, tweak PS1, add more docs
    Release 0.1.6
    ci: Combine ASAN and UBSAN
    Add --unshare-all and --share-net
- upstream changelog for 0.1.6:
    This fixes a security issue with TIOCSTI, aka CVE-2017-522. Note bubblewrap is
    far from the only program that has this issue, and I think the best fix is
    probably in the kernel to support disabling this ioctl.
    Programs can also work around this by calling setsid() on their own in an exec
    handler before doing an exevp("bwrap").
- upstream changelog for 0.1.5:
    This is a bugfix release, here are the major changes:
    Running bubblewrap as root now works again
    Various fixes for the testsuite
    Use same default compiler warnings as ostree
    Handle errors resolving symlinks during bind mounts
    Alexander Larsson (2):
    bind-mount: Check for errors in realpath()
    Bump version to 0.1.5
    Colin Walters (6):
    Don't call capset() unless we need to
    Only --unshare-user automatically if we're not root
    ci: Modernize a bit, add f25-ubsan
    README.md: Update with better one liner and more information
    utils: Add __attribute__((printf)) to die()
    build: Sync default warning -&gt; error set from ostree
    Simon McVittie (4):
    test-run: be a bash script
    test-run: don't assume we are uid 1000
    Adapt tests so they can be run against installed binaries
    Fix incorrect nesting of backticks when finding a FUSE mount</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1495713600">- update to version 0.1.8
- New --die-with-parent which is based on the Linux prctl(PR_SET_PDEATHSIG) API.
- smaller bugfixes</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1499428800">- fix build macro with rpm &lt; 4.12 (non-Factory currently)</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1505736000">- add group</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1507550400">- update to version 0.2.0
  - bwrap now automatically detects the new
  user namespace restrictions in Red Hat Enterprise Linux 7.4:
  bubblewrap: check for max_user_namespaces == 0.
  - The most notable features are new arguments --as-pid1, and
  - -cap-add/--cap-drop. These were added for running systemd (or in general a
  "full" init system) inside bubblewrap. But the capability options are also
  useful for unprivileged callers to potentially retain capbilities inside the
  sandbox (for example CAP_NET_ADMIN), when user namespaces are enabled.
  Conversely, privileged callers (uid 0) can conversely drop capabilities (without
  user namespaces). Contributed by Giuseppe Scrivano.
  - With --dev, add /dev/fd and /dev/core symlinks
  which should improve compatibility with older software.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1525176000">- update to version 0.2.1:
  * All the demos are included
  * bugfixes for the demo files
  * There was an issue with mkdir when running bubblewrap on an NFS
  filesystem that has been fixed, so flatpak now works on NFS shares.
  * Some leaks have been fixed, including a file descriptor leak.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1531569600">- update to version 0.3.0:
  * The biggest feature from this release is that bwrap
    now supports being invoked recursively (from other container
    runtimes such as Docker/podman/runc as well as bwrap itself)
    when user namespaces are enabled, and the outer container manager
    allows it (Docker's default seccomp policy doesn't).
  * This is useful for testing scenarios; for example a project
    uses Kubernetes for its CI, but inside build the project wants to run
    each unit test in their own pid namespace, without going out
    and creating a new pod for every single unit test.
  * Similarly, rpm-ostree compose tree uses bwrap internally for scripts,
    and we want to support running rpm-ostree inside a container as well.
  * Another feature is bwrap now supports -- to terminate argument
    parsing. To detect availablity of this, you could parse bwrap --version.</changelog>
  <changelog author="alarrosa@suse.com" date="1539259200">- update to version 0.3.1:
  * New feature in this release is --bind-try (as well as --dev-bind-try
    and --ro-bind-try) which works like the regular versions if the source
    exists, but does nothing if it doesn't exist.
  * The mount type for the root tmpfs was also changed to "tmpfs" instead
    of being empty, as the later could cause problems with some programs
    when parsing the mountinfo files in /proc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1559390400">- Update to version 0.3.3:
  - This release is the same as 0.3.2 but the version number in configure.ac
  was accidentally still set to 0.3.1
- Update to version 0.3.2:
  - fixes boo#1136958 / CVE-2019-12439
  This release fixes a mostly theoretical security issue in unusual/broken
  setups where `$XDG_RUNTIME_DIR` is unset.
  There are some other smaller fixes, as well as an addition to the JSON
  API that allows reading the inner process exit code, separately from
  the `bwrap` exit code.
  - Print "Out of memory" on stderr, not stdout
  - bwrap: add option json-status-fd to show child exit code
  - bwrap: Report COMMAND exit code in json-status-fd
  - man page: Describe --chdir, not nonexistent --cwd
  - Don't create our own temporary mount point for pivot_root
  - Make lockdata long enough on 32-bit with 64-bit file pointers.</changelog>
  <changelog author="alarrosa@suse.com" date="1559908800">- Use /bin/bash instead of /usr/bin/bash in SLE12</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576843200">- Update to version 0.4.0:
  + The biggest feature in this release is the support for joining
    existing user and pid namespaces. This doesn't work in the
    setuid mode (at the moment).
  + Other changes:
  - Stores namespace info in status json.
  - In setuid mode pid 1 is now marked dumpable.
  - Now builds with musl libc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1585742400">- Update to version 0.4.1:
  * retcode: fix return code with syncfd and no event_fd
  * Ensure we're always clearing the cap bounding set
  * tests: Update output patterns for libcap &gt;= 2.29
  * Don't rely on geteuid() to know when to switch back from setuid root
  * Don't support --userns2 in setuid mode
  * fixes CVE-2020-5291
  * fixes bsc#1168291</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632139200">- Update to version 0.5.0:
  + New features:
  - --chmod changes permissions
  - --clearenv unsets every environment variable (except PWD)
  - --perms sets permissions for one subsequent --bind-data,
  - -dir, --file, --ro-bind-data or --tmpfs
  + Other enhancements:
  - Better diagnostics when a --bind or other bind-mount fails
  - zsh tab-completion
  - Better test coverage
  + Bug fixes:
  - Use Python 3 for tests and examples
  - Mount points for non-directories are created with permissions
  - r--r--r-- instead of -rw-rw-rw-
  - Don't remount items in /proc read-only if already EROFS,
    required to run under Docker
  - Allow mounting an non-directory over an existing
    non-directory, e.g. --bind "$XDG_RUNTIME_DIR/my-log-socket"
    /dev/log
  - Silence kernel messages for our bind-mounts
  - Make sure pkg-config is checked for, regardless of build
    options
  - Improve ability to bind-mount directories on case-insensitive
    filesystems
  - Fix -Wshadow warnings
  - Fix deprecation warnings with newer SELinux
- Add new subpackage bubblewrap-zsh-completion</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1646395200">- Update to 0.6.1:
  - Add a release checklist
  - completions: Make zsh completion non-executable
  The Autotools build system installed it with 0644 permissions because
  it's listed as DATA, but the Meson build system installs executable
  files as executable by default.
  zsh completions don't need to be executable to work, and this one doesn't
  have the `#!` marker that should start an executable script.
- update to 0.6.0:
  - meson: Improve compatibility with Meson 0.49
  That version doesn't allow more than two arguments for define_variable.
  - Disable test-specifying-pidns.sh under 'meson dist' while I investigate
  This test is hanging when run under 'meson dist' for some reason, but
  not when run under 'meson test', and not locally, only in the Github
  Workflow-based CI. Disable it for now.
  - meson: Actually build and run the tests
  - tests: Fix compiler warnings for unused arguments
  - meson: Run test scripts from $srcdir
  - meson: Make G_TEST_SRCDIR, G_TEST_BUILDDIR match Autotools
  - meson: Run the Python test script with Python, not bash
  The python build option can be used to swap to a different interpreter,
  for environments like the Steam Runtime where the python3 executable in
  the PATH is extremely old but there is a better interpreter available.
  This is treated as non-optional, because Meson is written in Python,
  so the situation where there is no Python interpreter at build-time
  shouldn't arise.
  - meson: Build the try-syscall helper
  - meson: Build tests with equivalent of -I$(top_srcdir) -I$(top_builddir)
  - meson.build: Remove unnecessary check for sh
  - Add a Meson build system
  This allows bwrap to be built as a subproject in larger Meson projects.
  When built as a subproject, we install into the --libexecdir and
  require a program prefix to be specified: for example, Flatpak would use
  program_prefix=flatpak- to get /usr/libexec/flatpak-bwrap. Verified to
  be backwards-compatible as far as Meson 0.49.0 (Debian 9 backports).
  Loosely based on previous work by Jussi Pakkanen (see #133).
  Differences between the Autotools and Meson builds:
  The Meson build requires a version of libcap that has pkg-config
  metadata (introduced in libcap 2.23, in 2013).
  The Meson build has no equivalent of --with-priv-mode=setuid. On
  distributions like Debian &lt;= 10 and RHEL &lt;= 7 that require a setuid bwrap
  executable, the sysadmin or distribution packaging will need to set the
  correct permissions on the bwrap executable; Debian already did this via
  packaging rather than the upstream build system.
  The Meson build supports being used as a subproject, and there is CI
  for this. It automatically disables shell completions and man pages,
  moves the bubblewrap executable to ${libexecdir}, and renames the
  bubblewrap executable according to a program_prefix option that the
  caller must specify (for example, Flatpak would use
  - Dprogram_prefix=flatpak- to get /usr/libexec/flatpak-bwrap). See the
  tests/use-as-subproject/ directory for an example.
  - Use HEAD to refer to other projects' default branches in documentation
  This makes the URL independent of the name they have chosen for their
  default branches.
  - workflows: Update for rename of default branch to main
  - tests: Exercise seccomp filters
  - Allow loading more than one seccomp program
  This will allow Flatpak to combine an allow-list (default-deny) of
  known system calls with a deny-list (default-allow) of system calls
  that are undesired.
  Resolves: https://github.com/containers/bubblewrap/issues/453
  - Generalize linked lists of LockFile and SetupOp
  I'm about to add a third linked list, for seccomp programs, which would
  seem like too much duplication.
  - Handle argc == 0 better
  Unfortunately it's possible for argc to be 0, so error out pretty early
  on in that case. I don't think this is a security issue in this case.
  - Fix typo
  - Remove trailing whitespace
  - Fix spelling
  - bash: Fix shellcheck warnings
  - bash: Invoke bash using /usr/bin/env
  - bubblewrap: Avoid a -Wjump-misses-init false-positive
  When building with -Wjump-misses-init as part of a larger project, gcc
  reports that we jump past initialization of cover_proc_dirs. This is
  technically true, but we only use this variable in the case where it's
  initialized, so that's harmless.
  However, we can avoid this altogether by making the array static and
  constant, which allows it to be moved from initialized data to read-only
  data.
  - bind-mount: Be more const-correct
  When compiled with -Wwrite-strings as part of a larger project, gcc and
  clang both warn that we're assigning a string constant to a mutable
  struct member. There's actually no reason why it should be mutable, so
  make it const.
  - die_with_error: Save errno sooner
  We need to save errno immediately, otherwise it could be overwritten
  by a failing library call somewhere in the implementation of fprintf.
  - main: Warn when non-repeatable options are repeated
  A user might reasonably expect that `bwrap --seccomp 3 --seccomp 4 ...`
  would load seccomp programs from both fds 3 and 4, but in fact it only
  loads the program from fd 4.
  Helps: https://github.com/containers/bubblewrap/issues/453
  Resolves: https://github.com/containers/bubblewrap/issues/454
  - utils: Add warn()
  - Add SPDX-License-Identifier for files that already specify license
  This is a step towards REUSE compliance. Third-party files that we do
  not otherwise edit (git.mk, m4/attributes.m4) are excluded here.
  - tests: Use preferred spelling for SPDX license identifiers
  - Remove obsolete .travis.yml
  We no longer use Travis-CI.
  - Remove obsolete papr CI
  We no longer use this.</changelog>
  <changelog author="dimstar@opensuse.org" date="1652875200">- Update to version 0.6.2:
  + New features in Meson build:
  - Auto-detect whether the man page can be generated.
  - -Dbwrapdir=... changes the installation directory (useful
    when being used as a subproject).
  - -Dtests=false disables unit tests.
  + Bug fixes:
  - Add --add-seccomp-fd to shell completions
  - Document --add-seccomp-fd, --json-status-fd and --share-net
    in the man page
  - Add attributes to silence various compiler warnings
  - Allow compilation of tests with musl on mips architectures
  - Allow compilation with older glibc
  - Disable sanitizers for a test helper whose seccomp profile
    breaks the instrumentation
  - Disable AddressSanitizer leak detection where it interferes
    with unit testing</changelog>
  <changelog author="dmueller@suse.com" date="1670414400">- update to v0.7.0:
  * --size option controls the size of a subsequent --tmpfs (#509)
  * Better error messages if a mount operation fails (#472)
  * Better error message if creating the new user namespace fails with
    ENOSPC (#487)
  * When building as a Meson subproject, a RUNPATH can be set on the
    executable to make it easier to bundle its libcap dependency
  * Fix test failures when running as uid 0 but with limited capabilities
    (#510)
  * Use POSIX command -v in preference to non-standard which (#527)
  * Fix a copy/paste error in --help (#531)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1679918400">- update to v0.8.0:
  * Add --disable-userns option to prevent the sandbox from
    creating its own nested user namespace
  * Add --assert-userns-disabled option to check that an existing
    userns was created with --disable-userns
  * Give a clearer error message if the kernel doesn't have
    CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER</changelog>
  <changelog author="qzhao@suse.com" date="1724241600">- Add bubblewrap-CVE-2024-42472.patch:
  Backporting a253257c from upstream, Add --bind-fd and --ro-bind-fd
  to let you bind a O_PATH fd.
  (CVE-2024-42472, bsc#1229157)</changelog>
</package>
<package pkgid="196518003681b01ec9675d68ba9cc8a1bcdd26ebe49b9f59804a0fd81f182b2f" name="bubblewrap-zsh-completion" arch="ppc64le">
  <version epoch="0" ver="0.8.0" rel="150500.3.6.1"/>
  <changelog author="walters@verbum.org" date="1476446400">- New upstream version</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1481889600">- upgrade to upstream version 0.1.4
- Build also for Leap 42.2</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1488456000">- upgrade to upstream version 0.1.7
- note that this package was *never* affected by CVE-2017-5226
  as it was introduced in version 0.1.6
- upstream changelog of version 0.1.7:
    This release backs out the change in 0.1.6 which unconditionally
    called setsid() in order to fix a security issue with TIOCSTI, aka
    CVE-2017-522. That change caused some behavioural issues that are
    hard to work with in some cases. For instance, it makes shell job
    control not work for the bwrap command.
    Instead there is now a new option --new-session which works like
    0.1.6. It is recommended that you use this if possible, but if not we
    recommended that you neutralize this some other way, for instance
    using SECCOMP, which is what flatpak does:
    https://github.com/flatpak/flatpak/commit/902fb713990a8f968ea4350c7c2a27ff46f1a6c4
    In order to make it easy to create maximally safe sandboxes we have
    also added a new commandline switch called --unshare-all. It unshares
    all possible namespaces and is currently equivalent with:
  - -unshare-user-try --unshare-ipc --unshare-pid --unshare-net
  - -unshare-uts --unshare-cgroup-try
    However, the intent is that as new namespaces are added to the kernel they will
    be added to this list. Additionally, if --share-net is specified the network
    namespace is not unshared.
    This release also has some bugfixes:
    bwrap reaps (unexpected) children that are inherited from the
    parent, something which can happen if bwrap is part of a shell
    pipeline.
    bwrap clears the capability bounding set. The permitted
    capabilities was already empty, and use of PR_NO_NEW_PRIVS should
    make it impossible to increase the capabilities, but more
    layers of protection is better.
    The seccomp filter is now installed at the very end of bwrap, which
    means the requirement of the filter is minimal. Any bwrap seccomp
    filter must at least allow: execve, waitpid and write
    Alexander Larsson (7):
    Handle inherited children dying
    Clear capability bounding set
    Make the call to setsid() optional, with --new-session
    demos/bubblewrap-shell.sh: Unshare all namespaces
    Call setsid() and setexeccon() befor forking the init monitor
    Install seccomp filter at the very end
    Bump version to 0.1.7
    Colin Walters (6):
    Release 0.1.6
    man: Correct namespace user -&gt; mount
    demo/shell: Add /var/tmp compat symlink, tweak PS1, add more docs
    Release 0.1.6
    ci: Combine ASAN and UBSAN
    Add --unshare-all and --share-net
- upstream changelog for 0.1.6:
    This fixes a security issue with TIOCSTI, aka CVE-2017-522. Note bubblewrap is
    far from the only program that has this issue, and I think the best fix is
    probably in the kernel to support disabling this ioctl.
    Programs can also work around this by calling setsid() on their own in an exec
    handler before doing an exevp("bwrap").
- upstream changelog for 0.1.5:
    This is a bugfix release, here are the major changes:
    Running bubblewrap as root now works again
    Various fixes for the testsuite
    Use same default compiler warnings as ostree
    Handle errors resolving symlinks during bind mounts
    Alexander Larsson (2):
    bind-mount: Check for errors in realpath()
    Bump version to 0.1.5
    Colin Walters (6):
    Don't call capset() unless we need to
    Only --unshare-user automatically if we're not root
    ci: Modernize a bit, add f25-ubsan
    README.md: Update with better one liner and more information
    utils: Add __attribute__((printf)) to die()
    build: Sync default warning -&gt; error set from ostree
    Simon McVittie (4):
    test-run: be a bash script
    test-run: don't assume we are uid 1000
    Adapt tests so they can be run against installed binaries
    Fix incorrect nesting of backticks when finding a FUSE mount</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1495713600">- update to version 0.1.8
- New --die-with-parent which is based on the Linux prctl(PR_SET_PDEATHSIG) API.
- smaller bugfixes</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1499428800">- fix build macro with rpm &lt; 4.12 (non-Factory currently)</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1505736000">- add group</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1507550400">- update to version 0.2.0
  - bwrap now automatically detects the new
  user namespace restrictions in Red Hat Enterprise Linux 7.4:
  bubblewrap: check for max_user_namespaces == 0.
  - The most notable features are new arguments --as-pid1, and
  - -cap-add/--cap-drop. These were added for running systemd (or in general a
  "full" init system) inside bubblewrap. But the capability options are also
  useful for unprivileged callers to potentially retain capbilities inside the
  sandbox (for example CAP_NET_ADMIN), when user namespaces are enabled.
  Conversely, privileged callers (uid 0) can conversely drop capabilities (without
  user namespaces). Contributed by Giuseppe Scrivano.
  - With --dev, add /dev/fd and /dev/core symlinks
  which should improve compatibility with older software.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1525176000">- update to version 0.2.1:
  * All the demos are included
  * bugfixes for the demo files
  * There was an issue with mkdir when running bubblewrap on an NFS
  filesystem that has been fixed, so flatpak now works on NFS shares.
  * Some leaks have been fixed, including a file descriptor leak.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1531569600">- update to version 0.3.0:
  * The biggest feature from this release is that bwrap
    now supports being invoked recursively (from other container
    runtimes such as Docker/podman/runc as well as bwrap itself)
    when user namespaces are enabled, and the outer container manager
    allows it (Docker's default seccomp policy doesn't).
  * This is useful for testing scenarios; for example a project
    uses Kubernetes for its CI, but inside build the project wants to run
    each unit test in their own pid namespace, without going out
    and creating a new pod for every single unit test.
  * Similarly, rpm-ostree compose tree uses bwrap internally for scripts,
    and we want to support running rpm-ostree inside a container as well.
  * Another feature is bwrap now supports -- to terminate argument
    parsing. To detect availablity of this, you could parse bwrap --version.</changelog>
  <changelog author="alarrosa@suse.com" date="1539259200">- update to version 0.3.1:
  * New feature in this release is --bind-try (as well as --dev-bind-try
    and --ro-bind-try) which works like the regular versions if the source
    exists, but does nothing if it doesn't exist.
  * The mount type for the root tmpfs was also changed to "tmpfs" instead
    of being empty, as the later could cause problems with some programs
    when parsing the mountinfo files in /proc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1559390400">- Update to version 0.3.3:
  - This release is the same as 0.3.2 but the version number in configure.ac
  was accidentally still set to 0.3.1
- Update to version 0.3.2:
  - fixes boo#1136958 / CVE-2019-12439
  This release fixes a mostly theoretical security issue in unusual/broken
  setups where `$XDG_RUNTIME_DIR` is unset.
  There are some other smaller fixes, as well as an addition to the JSON
  API that allows reading the inner process exit code, separately from
  the `bwrap` exit code.
  - Print "Out of memory" on stderr, not stdout
  - bwrap: add option json-status-fd to show child exit code
  - bwrap: Report COMMAND exit code in json-status-fd
  - man page: Describe --chdir, not nonexistent --cwd
  - Don't create our own temporary mount point for pivot_root
  - Make lockdata long enough on 32-bit with 64-bit file pointers.</changelog>
  <changelog author="alarrosa@suse.com" date="1559908800">- Use /bin/bash instead of /usr/bin/bash in SLE12</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576843200">- Update to version 0.4.0:
  + The biggest feature in this release is the support for joining
    existing user and pid namespaces. This doesn't work in the
    setuid mode (at the moment).
  + Other changes:
  - Stores namespace info in status json.
  - In setuid mode pid 1 is now marked dumpable.
  - Now builds with musl libc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1585742400">- Update to version 0.4.1:
  * retcode: fix return code with syncfd and no event_fd
  * Ensure we're always clearing the cap bounding set
  * tests: Update output patterns for libcap &gt;= 2.29
  * Don't rely on geteuid() to know when to switch back from setuid root
  * Don't support --userns2 in setuid mode
  * fixes CVE-2020-5291
  * fixes bsc#1168291</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632139200">- Update to version 0.5.0:
  + New features:
  - --chmod changes permissions
  - --clearenv unsets every environment variable (except PWD)
  - --perms sets permissions for one subsequent --bind-data,
  - -dir, --file, --ro-bind-data or --tmpfs
  + Other enhancements:
  - Better diagnostics when a --bind or other bind-mount fails
  - zsh tab-completion
  - Better test coverage
  + Bug fixes:
  - Use Python 3 for tests and examples
  - Mount points for non-directories are created with permissions
  - r--r--r-- instead of -rw-rw-rw-
  - Don't remount items in /proc read-only if already EROFS,
    required to run under Docker
  - Allow mounting an non-directory over an existing
    non-directory, e.g. --bind "$XDG_RUNTIME_DIR/my-log-socket"
    /dev/log
  - Silence kernel messages for our bind-mounts
  - Make sure pkg-config is checked for, regardless of build
    options
  - Improve ability to bind-mount directories on case-insensitive
    filesystems
  - Fix -Wshadow warnings
  - Fix deprecation warnings with newer SELinux
- Add new subpackage bubblewrap-zsh-completion</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1646395200">- Update to 0.6.1:
  - Add a release checklist
  - completions: Make zsh completion non-executable
  The Autotools build system installed it with 0644 permissions because
  it's listed as DATA, but the Meson build system installs executable
  files as executable by default.
  zsh completions don't need to be executable to work, and this one doesn't
  have the `#!` marker that should start an executable script.
- update to 0.6.0:
  - meson: Improve compatibility with Meson 0.49
  That version doesn't allow more than two arguments for define_variable.
  - Disable test-specifying-pidns.sh under 'meson dist' while I investigate
  This test is hanging when run under 'meson dist' for some reason, but
  not when run under 'meson test', and not locally, only in the Github
  Workflow-based CI. Disable it for now.
  - meson: Actually build and run the tests
  - tests: Fix compiler warnings for unused arguments
  - meson: Run test scripts from $srcdir
  - meson: Make G_TEST_SRCDIR, G_TEST_BUILDDIR match Autotools
  - meson: Run the Python test script with Python, not bash
  The python build option can be used to swap to a different interpreter,
  for environments like the Steam Runtime where the python3 executable in
  the PATH is extremely old but there is a better interpreter available.
  This is treated as non-optional, because Meson is written in Python,
  so the situation where there is no Python interpreter at build-time
  shouldn't arise.
  - meson: Build the try-syscall helper
  - meson: Build tests with equivalent of -I$(top_srcdir) -I$(top_builddir)
  - meson.build: Remove unnecessary check for sh
  - Add a Meson build system
  This allows bwrap to be built as a subproject in larger Meson projects.
  When built as a subproject, we install into the --libexecdir and
  require a program prefix to be specified: for example, Flatpak would use
  program_prefix=flatpak- to get /usr/libexec/flatpak-bwrap. Verified to
  be backwards-compatible as far as Meson 0.49.0 (Debian 9 backports).
  Loosely based on previous work by Jussi Pakkanen (see #133).
  Differences between the Autotools and Meson builds:
  The Meson build requires a version of libcap that has pkg-config
  metadata (introduced in libcap 2.23, in 2013).
  The Meson build has no equivalent of --with-priv-mode=setuid. On
  distributions like Debian &lt;= 10 and RHEL &lt;= 7 that require a setuid bwrap
  executable, the sysadmin or distribution packaging will need to set the
  correct permissions on the bwrap executable; Debian already did this via
  packaging rather than the upstream build system.
  The Meson build supports being used as a subproject, and there is CI
  for this. It automatically disables shell completions and man pages,
  moves the bubblewrap executable to ${libexecdir}, and renames the
  bubblewrap executable according to a program_prefix option that the
  caller must specify (for example, Flatpak would use
  - Dprogram_prefix=flatpak- to get /usr/libexec/flatpak-bwrap). See the
  tests/use-as-subproject/ directory for an example.
  - Use HEAD to refer to other projects' default branches in documentation
  This makes the URL independent of the name they have chosen for their
  default branches.
  - workflows: Update for rename of default branch to main
  - tests: Exercise seccomp filters
  - Allow loading more than one seccomp program
  This will allow Flatpak to combine an allow-list (default-deny) of
  known system calls with a deny-list (default-allow) of system calls
  that are undesired.
  Resolves: https://github.com/containers/bubblewrap/issues/453
  - Generalize linked lists of LockFile and SetupOp
  I'm about to add a third linked list, for seccomp programs, which would
  seem like too much duplication.
  - Handle argc == 0 better
  Unfortunately it's possible for argc to be 0, so error out pretty early
  on in that case. I don't think this is a security issue in this case.
  - Fix typo
  - Remove trailing whitespace
  - Fix spelling
  - bash: Fix shellcheck warnings
  - bash: Invoke bash using /usr/bin/env
  - bubblewrap: Avoid a -Wjump-misses-init false-positive
  When building with -Wjump-misses-init as part of a larger project, gcc
  reports that we jump past initialization of cover_proc_dirs. This is
  technically true, but we only use this variable in the case where it's
  initialized, so that's harmless.
  However, we can avoid this altogether by making the array static and
  constant, which allows it to be moved from initialized data to read-only
  data.
  - bind-mount: Be more const-correct
  When compiled with -Wwrite-strings as part of a larger project, gcc and
  clang both warn that we're assigning a string constant to a mutable
  struct member. There's actually no reason why it should be mutable, so
  make it const.
  - die_with_error: Save errno sooner
  We need to save errno immediately, otherwise it could be overwritten
  by a failing library call somewhere in the implementation of fprintf.
  - main: Warn when non-repeatable options are repeated
  A user might reasonably expect that `bwrap --seccomp 3 --seccomp 4 ...`
  would load seccomp programs from both fds 3 and 4, but in fact it only
  loads the program from fd 4.
  Helps: https://github.com/containers/bubblewrap/issues/453
  Resolves: https://github.com/containers/bubblewrap/issues/454
  - utils: Add warn()
  - Add SPDX-License-Identifier for files that already specify license
  This is a step towards REUSE compliance. Third-party files that we do
  not otherwise edit (git.mk, m4/attributes.m4) are excluded here.
  - tests: Use preferred spelling for SPDX license identifiers
  - Remove obsolete .travis.yml
  We no longer use Travis-CI.
  - Remove obsolete papr CI
  We no longer use this.</changelog>
  <changelog author="dimstar@opensuse.org" date="1652875200">- Update to version 0.6.2:
  + New features in Meson build:
  - Auto-detect whether the man page can be generated.
  - -Dbwrapdir=... changes the installation directory (useful
    when being used as a subproject).
  - -Dtests=false disables unit tests.
  + Bug fixes:
  - Add --add-seccomp-fd to shell completions
  - Document --add-seccomp-fd, --json-status-fd and --share-net
    in the man page
  - Add attributes to silence various compiler warnings
  - Allow compilation of tests with musl on mips architectures
  - Allow compilation with older glibc
  - Disable sanitizers for a test helper whose seccomp profile
    breaks the instrumentation
  - Disable AddressSanitizer leak detection where it interferes
    with unit testing</changelog>
  <changelog author="dmueller@suse.com" date="1670414400">- update to v0.7.0:
  * --size option controls the size of a subsequent --tmpfs (#509)
  * Better error messages if a mount operation fails (#472)
  * Better error message if creating the new user namespace fails with
    ENOSPC (#487)
  * When building as a Meson subproject, a RUNPATH can be set on the
    executable to make it easier to bundle its libcap dependency
  * Fix test failures when running as uid 0 but with limited capabilities
    (#510)
  * Use POSIX command -v in preference to non-standard which (#527)
  * Fix a copy/paste error in --help (#531)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1679918400">- update to v0.8.0:
  * Add --disable-userns option to prevent the sandbox from
    creating its own nested user namespace
  * Add --assert-userns-disabled option to check that an existing
    userns was created with --disable-userns
  * Give a clearer error message if the kernel doesn't have
    CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER</changelog>
  <changelog author="qzhao@suse.com" date="1724241600">- Add bubblewrap-CVE-2024-42472.patch:
  Backporting a253257c from upstream, Add --bind-fd and --ro-bind-fd
  to let you bind a O_PATH fd.
  (CVE-2024-42472, bsc#1229157)</changelog>
</package>
<package pkgid="2f06fa91c19e337a64170d85b45c6fc953f5bb83d8a01cc044f9c0b720c59196" name="bubblewrap-zsh-completion" arch="s390x">
  <version epoch="0" ver="0.8.0" rel="150500.3.6.1"/>
  <changelog author="walters@verbum.org" date="1476446400">- New upstream version</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1481889600">- upgrade to upstream version 0.1.4
- Build also for Leap 42.2</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1488456000">- upgrade to upstream version 0.1.7
- note that this package was *never* affected by CVE-2017-5226
  as it was introduced in version 0.1.6
- upstream changelog of version 0.1.7:
    This release backs out the change in 0.1.6 which unconditionally
    called setsid() in order to fix a security issue with TIOCSTI, aka
    CVE-2017-522. That change caused some behavioural issues that are
    hard to work with in some cases. For instance, it makes shell job
    control not work for the bwrap command.
    Instead there is now a new option --new-session which works like
    0.1.6. It is recommended that you use this if possible, but if not we
    recommended that you neutralize this some other way, for instance
    using SECCOMP, which is what flatpak does:
    https://github.com/flatpak/flatpak/commit/902fb713990a8f968ea4350c7c2a27ff46f1a6c4
    In order to make it easy to create maximally safe sandboxes we have
    also added a new commandline switch called --unshare-all. It unshares
    all possible namespaces and is currently equivalent with:
  - -unshare-user-try --unshare-ipc --unshare-pid --unshare-net
  - -unshare-uts --unshare-cgroup-try
    However, the intent is that as new namespaces are added to the kernel they will
    be added to this list. Additionally, if --share-net is specified the network
    namespace is not unshared.
    This release also has some bugfixes:
    bwrap reaps (unexpected) children that are inherited from the
    parent, something which can happen if bwrap is part of a shell
    pipeline.
    bwrap clears the capability bounding set. The permitted
    capabilities was already empty, and use of PR_NO_NEW_PRIVS should
    make it impossible to increase the capabilities, but more
    layers of protection is better.
    The seccomp filter is now installed at the very end of bwrap, which
    means the requirement of the filter is minimal. Any bwrap seccomp
    filter must at least allow: execve, waitpid and write
    Alexander Larsson (7):
    Handle inherited children dying
    Clear capability bounding set
    Make the call to setsid() optional, with --new-session
    demos/bubblewrap-shell.sh: Unshare all namespaces
    Call setsid() and setexeccon() befor forking the init monitor
    Install seccomp filter at the very end
    Bump version to 0.1.7
    Colin Walters (6):
    Release 0.1.6
    man: Correct namespace user -&gt; mount
    demo/shell: Add /var/tmp compat symlink, tweak PS1, add more docs
    Release 0.1.6
    ci: Combine ASAN and UBSAN
    Add --unshare-all and --share-net
- upstream changelog for 0.1.6:
    This fixes a security issue with TIOCSTI, aka CVE-2017-522. Note bubblewrap is
    far from the only program that has this issue, and I think the best fix is
    probably in the kernel to support disabling this ioctl.
    Programs can also work around this by calling setsid() on their own in an exec
    handler before doing an exevp("bwrap").
- upstream changelog for 0.1.5:
    This is a bugfix release, here are the major changes:
    Running bubblewrap as root now works again
    Various fixes for the testsuite
    Use same default compiler warnings as ostree
    Handle errors resolving symlinks during bind mounts
    Alexander Larsson (2):
    bind-mount: Check for errors in realpath()
    Bump version to 0.1.5
    Colin Walters (6):
    Don't call capset() unless we need to
    Only --unshare-user automatically if we're not root
    ci: Modernize a bit, add f25-ubsan
    README.md: Update with better one liner and more information
    utils: Add __attribute__((printf)) to die()
    build: Sync default warning -&gt; error set from ostree
    Simon McVittie (4):
    test-run: be a bash script
    test-run: don't assume we are uid 1000
    Adapt tests so they can be run against installed binaries
    Fix incorrect nesting of backticks when finding a FUSE mount</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1495713600">- update to version 0.1.8
- New --die-with-parent which is based on the Linux prctl(PR_SET_PDEATHSIG) API.
- smaller bugfixes</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1499428800">- fix build macro with rpm &lt; 4.12 (non-Factory currently)</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1505736000">- add group</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1507550400">- update to version 0.2.0
  - bwrap now automatically detects the new
  user namespace restrictions in Red Hat Enterprise Linux 7.4:
  bubblewrap: check for max_user_namespaces == 0.
  - The most notable features are new arguments --as-pid1, and
  - -cap-add/--cap-drop. These were added for running systemd (or in general a
  "full" init system) inside bubblewrap. But the capability options are also
  useful for unprivileged callers to potentially retain capbilities inside the
  sandbox (for example CAP_NET_ADMIN), when user namespaces are enabled.
  Conversely, privileged callers (uid 0) can conversely drop capabilities (without
  user namespaces). Contributed by Giuseppe Scrivano.
  - With --dev, add /dev/fd and /dev/core symlinks
  which should improve compatibility with older software.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1525176000">- update to version 0.2.1:
  * All the demos are included
  * bugfixes for the demo files
  * There was an issue with mkdir when running bubblewrap on an NFS
  filesystem that has been fixed, so flatpak now works on NFS shares.
  * Some leaks have been fixed, including a file descriptor leak.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1531569600">- update to version 0.3.0:
  * The biggest feature from this release is that bwrap
    now supports being invoked recursively (from other container
    runtimes such as Docker/podman/runc as well as bwrap itself)
    when user namespaces are enabled, and the outer container manager
    allows it (Docker's default seccomp policy doesn't).
  * This is useful for testing scenarios; for example a project
    uses Kubernetes for its CI, but inside build the project wants to run
    each unit test in their own pid namespace, without going out
    and creating a new pod for every single unit test.
  * Similarly, rpm-ostree compose tree uses bwrap internally for scripts,
    and we want to support running rpm-ostree inside a container as well.
  * Another feature is bwrap now supports -- to terminate argument
    parsing. To detect availablity of this, you could parse bwrap --version.</changelog>
  <changelog author="alarrosa@suse.com" date="1539259200">- update to version 0.3.1:
  * New feature in this release is --bind-try (as well as --dev-bind-try
    and --ro-bind-try) which works like the regular versions if the source
    exists, but does nothing if it doesn't exist.
  * The mount type for the root tmpfs was also changed to "tmpfs" instead
    of being empty, as the later could cause problems with some programs
    when parsing the mountinfo files in /proc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1559390400">- Update to version 0.3.3:
  - This release is the same as 0.3.2 but the version number in configure.ac
  was accidentally still set to 0.3.1
- Update to version 0.3.2:
  - fixes boo#1136958 / CVE-2019-12439
  This release fixes a mostly theoretical security issue in unusual/broken
  setups where `$XDG_RUNTIME_DIR` is unset.
  There are some other smaller fixes, as well as an addition to the JSON
  API that allows reading the inner process exit code, separately from
  the `bwrap` exit code.
  - Print "Out of memory" on stderr, not stdout
  - bwrap: add option json-status-fd to show child exit code
  - bwrap: Report COMMAND exit code in json-status-fd
  - man page: Describe --chdir, not nonexistent --cwd
  - Don't create our own temporary mount point for pivot_root
  - Make lockdata long enough on 32-bit with 64-bit file pointers.</changelog>
  <changelog author="alarrosa@suse.com" date="1559908800">- Use /bin/bash instead of /usr/bin/bash in SLE12</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576843200">- Update to version 0.4.0:
  + The biggest feature in this release is the support for joining
    existing user and pid namespaces. This doesn't work in the
    setuid mode (at the moment).
  + Other changes:
  - Stores namespace info in status json.
  - In setuid mode pid 1 is now marked dumpable.
  - Now builds with musl libc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1585742400">- Update to version 0.4.1:
  * retcode: fix return code with syncfd and no event_fd
  * Ensure we're always clearing the cap bounding set
  * tests: Update output patterns for libcap &gt;= 2.29
  * Don't rely on geteuid() to know when to switch back from setuid root
  * Don't support --userns2 in setuid mode
  * fixes CVE-2020-5291
  * fixes bsc#1168291</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632139200">- Update to version 0.5.0:
  + New features:
  - --chmod changes permissions
  - --clearenv unsets every environment variable (except PWD)
  - --perms sets permissions for one subsequent --bind-data,
  - -dir, --file, --ro-bind-data or --tmpfs
  + Other enhancements:
  - Better diagnostics when a --bind or other bind-mount fails
  - zsh tab-completion
  - Better test coverage
  + Bug fixes:
  - Use Python 3 for tests and examples
  - Mount points for non-directories are created with permissions
  - r--r--r-- instead of -rw-rw-rw-
  - Don't remount items in /proc read-only if already EROFS,
    required to run under Docker
  - Allow mounting an non-directory over an existing
    non-directory, e.g. --bind "$XDG_RUNTIME_DIR/my-log-socket"
    /dev/log
  - Silence kernel messages for our bind-mounts
  - Make sure pkg-config is checked for, regardless of build
    options
  - Improve ability to bind-mount directories on case-insensitive
    filesystems
  - Fix -Wshadow warnings
  - Fix deprecation warnings with newer SELinux
- Add new subpackage bubblewrap-zsh-completion</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1646395200">- Update to 0.6.1:
  - Add a release checklist
  - completions: Make zsh completion non-executable
  The Autotools build system installed it with 0644 permissions because
  it's listed as DATA, but the Meson build system installs executable
  files as executable by default.
  zsh completions don't need to be executable to work, and this one doesn't
  have the `#!` marker that should start an executable script.
- update to 0.6.0:
  - meson: Improve compatibility with Meson 0.49
  That version doesn't allow more than two arguments for define_variable.
  - Disable test-specifying-pidns.sh under 'meson dist' while I investigate
  This test is hanging when run under 'meson dist' for some reason, but
  not when run under 'meson test', and not locally, only in the Github
  Workflow-based CI. Disable it for now.
  - meson: Actually build and run the tests
  - tests: Fix compiler warnings for unused arguments
  - meson: Run test scripts from $srcdir
  - meson: Make G_TEST_SRCDIR, G_TEST_BUILDDIR match Autotools
  - meson: Run the Python test script with Python, not bash
  The python build option can be used to swap to a different interpreter,
  for environments like the Steam Runtime where the python3 executable in
  the PATH is extremely old but there is a better interpreter available.
  This is treated as non-optional, because Meson is written in Python,
  so the situation where there is no Python interpreter at build-time
  shouldn't arise.
  - meson: Build the try-syscall helper
  - meson: Build tests with equivalent of -I$(top_srcdir) -I$(top_builddir)
  - meson.build: Remove unnecessary check for sh
  - Add a Meson build system
  This allows bwrap to be built as a subproject in larger Meson projects.
  When built as a subproject, we install into the --libexecdir and
  require a program prefix to be specified: for example, Flatpak would use
  program_prefix=flatpak- to get /usr/libexec/flatpak-bwrap. Verified to
  be backwards-compatible as far as Meson 0.49.0 (Debian 9 backports).
  Loosely based on previous work by Jussi Pakkanen (see #133).
  Differences between the Autotools and Meson builds:
  The Meson build requires a version of libcap that has pkg-config
  metadata (introduced in libcap 2.23, in 2013).
  The Meson build has no equivalent of --with-priv-mode=setuid. On
  distributions like Debian &lt;= 10 and RHEL &lt;= 7 that require a setuid bwrap
  executable, the sysadmin or distribution packaging will need to set the
  correct permissions on the bwrap executable; Debian already did this via
  packaging rather than the upstream build system.
  The Meson build supports being used as a subproject, and there is CI
  for this. It automatically disables shell completions and man pages,
  moves the bubblewrap executable to ${libexecdir}, and renames the
  bubblewrap executable according to a program_prefix option that the
  caller must specify (for example, Flatpak would use
  - Dprogram_prefix=flatpak- to get /usr/libexec/flatpak-bwrap). See the
  tests/use-as-subproject/ directory for an example.
  - Use HEAD to refer to other projects' default branches in documentation
  This makes the URL independent of the name they have chosen for their
  default branches.
  - workflows: Update for rename of default branch to main
  - tests: Exercise seccomp filters
  - Allow loading more than one seccomp program
  This will allow Flatpak to combine an allow-list (default-deny) of
  known system calls with a deny-list (default-allow) of system calls
  that are undesired.
  Resolves: https://github.com/containers/bubblewrap/issues/453
  - Generalize linked lists of LockFile and SetupOp
  I'm about to add a third linked list, for seccomp programs, which would
  seem like too much duplication.
  - Handle argc == 0 better
  Unfortunately it's possible for argc to be 0, so error out pretty early
  on in that case. I don't think this is a security issue in this case.
  - Fix typo
  - Remove trailing whitespace
  - Fix spelling
  - bash: Fix shellcheck warnings
  - bash: Invoke bash using /usr/bin/env
  - bubblewrap: Avoid a -Wjump-misses-init false-positive
  When building with -Wjump-misses-init as part of a larger project, gcc
  reports that we jump past initialization of cover_proc_dirs. This is
  technically true, but we only use this variable in the case where it's
  initialized, so that's harmless.
  However, we can avoid this altogether by making the array static and
  constant, which allows it to be moved from initialized data to read-only
  data.
  - bind-mount: Be more const-correct
  When compiled with -Wwrite-strings as part of a larger project, gcc and
  clang both warn that we're assigning a string constant to a mutable
  struct member. There's actually no reason why it should be mutable, so
  make it const.
  - die_with_error: Save errno sooner
  We need to save errno immediately, otherwise it could be overwritten
  by a failing library call somewhere in the implementation of fprintf.
  - main: Warn when non-repeatable options are repeated
  A user might reasonably expect that `bwrap --seccomp 3 --seccomp 4 ...`
  would load seccomp programs from both fds 3 and 4, but in fact it only
  loads the program from fd 4.
  Helps: https://github.com/containers/bubblewrap/issues/453
  Resolves: https://github.com/containers/bubblewrap/issues/454
  - utils: Add warn()
  - Add SPDX-License-Identifier for files that already specify license
  This is a step towards REUSE compliance. Third-party files that we do
  not otherwise edit (git.mk, m4/attributes.m4) are excluded here.
  - tests: Use preferred spelling for SPDX license identifiers
  - Remove obsolete .travis.yml
  We no longer use Travis-CI.
  - Remove obsolete papr CI
  We no longer use this.</changelog>
  <changelog author="dimstar@opensuse.org" date="1652875200">- Update to version 0.6.2:
  + New features in Meson build:
  - Auto-detect whether the man page can be generated.
  - -Dbwrapdir=... changes the installation directory (useful
    when being used as a subproject).
  - -Dtests=false disables unit tests.
  + Bug fixes:
  - Add --add-seccomp-fd to shell completions
  - Document --add-seccomp-fd, --json-status-fd and --share-net
    in the man page
  - Add attributes to silence various compiler warnings
  - Allow compilation of tests with musl on mips architectures
  - Allow compilation with older glibc
  - Disable sanitizers for a test helper whose seccomp profile
    breaks the instrumentation
  - Disable AddressSanitizer leak detection where it interferes
    with unit testing</changelog>
  <changelog author="dmueller@suse.com" date="1670414400">- update to v0.7.0:
  * --size option controls the size of a subsequent --tmpfs (#509)
  * Better error messages if a mount operation fails (#472)
  * Better error message if creating the new user namespace fails with
    ENOSPC (#487)
  * When building as a Meson subproject, a RUNPATH can be set on the
    executable to make it easier to bundle its libcap dependency
  * Fix test failures when running as uid 0 but with limited capabilities
    (#510)
  * Use POSIX command -v in preference to non-standard which (#527)
  * Fix a copy/paste error in --help (#531)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1679918400">- update to v0.8.0:
  * Add --disable-userns option to prevent the sandbox from
    creating its own nested user namespace
  * Add --assert-userns-disabled option to check that an existing
    userns was created with --disable-userns
  * Give a clearer error message if the kernel doesn't have
    CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER</changelog>
  <changelog author="qzhao@suse.com" date="1724241600">- Add bubblewrap-CVE-2024-42472.patch:
  Backporting a253257c from upstream, Add --bind-fd and --ro-bind-fd
  to let you bind a O_PATH fd.
  (CVE-2024-42472, bsc#1229157)</changelog>
</package>
<package pkgid="6eaa36f66830210ba2f83416435fca22a399ed1d7bb57e04b3c86f746e01acb4" name="bubblewrap-zsh-completion" arch="x86_64">
  <version epoch="0" ver="0.8.0" rel="150500.3.6.1"/>
  <changelog author="walters@verbum.org" date="1476446400">- New upstream version</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1481889600">- upgrade to upstream version 0.1.4
- Build also for Leap 42.2</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1488456000">- upgrade to upstream version 0.1.7
- note that this package was *never* affected by CVE-2017-5226
  as it was introduced in version 0.1.6
- upstream changelog of version 0.1.7:
    This release backs out the change in 0.1.6 which unconditionally
    called setsid() in order to fix a security issue with TIOCSTI, aka
    CVE-2017-522. That change caused some behavioural issues that are
    hard to work with in some cases. For instance, it makes shell job
    control not work for the bwrap command.
    Instead there is now a new option --new-session which works like
    0.1.6. It is recommended that you use this if possible, but if not we
    recommended that you neutralize this some other way, for instance
    using SECCOMP, which is what flatpak does:
    https://github.com/flatpak/flatpak/commit/902fb713990a8f968ea4350c7c2a27ff46f1a6c4
    In order to make it easy to create maximally safe sandboxes we have
    also added a new commandline switch called --unshare-all. It unshares
    all possible namespaces and is currently equivalent with:
  - -unshare-user-try --unshare-ipc --unshare-pid --unshare-net
  - -unshare-uts --unshare-cgroup-try
    However, the intent is that as new namespaces are added to the kernel they will
    be added to this list. Additionally, if --share-net is specified the network
    namespace is not unshared.
    This release also has some bugfixes:
    bwrap reaps (unexpected) children that are inherited from the
    parent, something which can happen if bwrap is part of a shell
    pipeline.
    bwrap clears the capability bounding set. The permitted
    capabilities was already empty, and use of PR_NO_NEW_PRIVS should
    make it impossible to increase the capabilities, but more
    layers of protection is better.
    The seccomp filter is now installed at the very end of bwrap, which
    means the requirement of the filter is minimal. Any bwrap seccomp
    filter must at least allow: execve, waitpid and write
    Alexander Larsson (7):
    Handle inherited children dying
    Clear capability bounding set
    Make the call to setsid() optional, with --new-session
    demos/bubblewrap-shell.sh: Unshare all namespaces
    Call setsid() and setexeccon() befor forking the init monitor
    Install seccomp filter at the very end
    Bump version to 0.1.7
    Colin Walters (6):
    Release 0.1.6
    man: Correct namespace user -&gt; mount
    demo/shell: Add /var/tmp compat symlink, tweak PS1, add more docs
    Release 0.1.6
    ci: Combine ASAN and UBSAN
    Add --unshare-all and --share-net
- upstream changelog for 0.1.6:
    This fixes a security issue with TIOCSTI, aka CVE-2017-522. Note bubblewrap is
    far from the only program that has this issue, and I think the best fix is
    probably in the kernel to support disabling this ioctl.
    Programs can also work around this by calling setsid() on their own in an exec
    handler before doing an exevp("bwrap").
- upstream changelog for 0.1.5:
    This is a bugfix release, here are the major changes:
    Running bubblewrap as root now works again
    Various fixes for the testsuite
    Use same default compiler warnings as ostree
    Handle errors resolving symlinks during bind mounts
    Alexander Larsson (2):
    bind-mount: Check for errors in realpath()
    Bump version to 0.1.5
    Colin Walters (6):
    Don't call capset() unless we need to
    Only --unshare-user automatically if we're not root
    ci: Modernize a bit, add f25-ubsan
    README.md: Update with better one liner and more information
    utils: Add __attribute__((printf)) to die()
    build: Sync default warning -&gt; error set from ostree
    Simon McVittie (4):
    test-run: be a bash script
    test-run: don't assume we are uid 1000
    Adapt tests so they can be run against installed binaries
    Fix incorrect nesting of backticks when finding a FUSE mount</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1495713600">- update to version 0.1.8
- New --die-with-parent which is based on the Linux prctl(PR_SET_PDEATHSIG) API.
- smaller bugfixes</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1499428800">- fix build macro with rpm &lt; 4.12 (non-Factory currently)</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1505736000">- add group</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1507550400">- update to version 0.2.0
  - bwrap now automatically detects the new
  user namespace restrictions in Red Hat Enterprise Linux 7.4:
  bubblewrap: check for max_user_namespaces == 0.
  - The most notable features are new arguments --as-pid1, and
  - -cap-add/--cap-drop. These were added for running systemd (or in general a
  "full" init system) inside bubblewrap. But the capability options are also
  useful for unprivileged callers to potentially retain capbilities inside the
  sandbox (for example CAP_NET_ADMIN), when user namespaces are enabled.
  Conversely, privileged callers (uid 0) can conversely drop capabilities (without
  user namespaces). Contributed by Giuseppe Scrivano.
  - With --dev, add /dev/fd and /dev/core symlinks
  which should improve compatibility with older software.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1525176000">- update to version 0.2.1:
  * All the demos are included
  * bugfixes for the demo files
  * There was an issue with mkdir when running bubblewrap on an NFS
  filesystem that has been fixed, so flatpak now works on NFS shares.
  * Some leaks have been fixed, including a file descriptor leak.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1531569600">- update to version 0.3.0:
  * The biggest feature from this release is that bwrap
    now supports being invoked recursively (from other container
    runtimes such as Docker/podman/runc as well as bwrap itself)
    when user namespaces are enabled, and the outer container manager
    allows it (Docker's default seccomp policy doesn't).
  * This is useful for testing scenarios; for example a project
    uses Kubernetes for its CI, but inside build the project wants to run
    each unit test in their own pid namespace, without going out
    and creating a new pod for every single unit test.
  * Similarly, rpm-ostree compose tree uses bwrap internally for scripts,
    and we want to support running rpm-ostree inside a container as well.
  * Another feature is bwrap now supports -- to terminate argument
    parsing. To detect availablity of this, you could parse bwrap --version.</changelog>
  <changelog author="alarrosa@suse.com" date="1539259200">- update to version 0.3.1:
  * New feature in this release is --bind-try (as well as --dev-bind-try
    and --ro-bind-try) which works like the regular versions if the source
    exists, but does nothing if it doesn't exist.
  * The mount type for the root tmpfs was also changed to "tmpfs" instead
    of being empty, as the later could cause problems with some programs
    when parsing the mountinfo files in /proc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1559390400">- Update to version 0.3.3:
  - This release is the same as 0.3.2 but the version number in configure.ac
  was accidentally still set to 0.3.1
- Update to version 0.3.2:
  - fixes boo#1136958 / CVE-2019-12439
  This release fixes a mostly theoretical security issue in unusual/broken
  setups where `$XDG_RUNTIME_DIR` is unset.
  There are some other smaller fixes, as well as an addition to the JSON
  API that allows reading the inner process exit code, separately from
  the `bwrap` exit code.
  - Print "Out of memory" on stderr, not stdout
  - bwrap: add option json-status-fd to show child exit code
  - bwrap: Report COMMAND exit code in json-status-fd
  - man page: Describe --chdir, not nonexistent --cwd
  - Don't create our own temporary mount point for pivot_root
  - Make lockdata long enough on 32-bit with 64-bit file pointers.</changelog>
  <changelog author="alarrosa@suse.com" date="1559908800">- Use /bin/bash instead of /usr/bin/bash in SLE12</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576843200">- Update to version 0.4.0:
  + The biggest feature in this release is the support for joining
    existing user and pid namespaces. This doesn't work in the
    setuid mode (at the moment).
  + Other changes:
  - Stores namespace info in status json.
  - In setuid mode pid 1 is now marked dumpable.
  - Now builds with musl libc.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1585742400">- Update to version 0.4.1:
  * retcode: fix return code with syncfd and no event_fd
  * Ensure we're always clearing the cap bounding set
  * tests: Update output patterns for libcap &gt;= 2.29
  * Don't rely on geteuid() to know when to switch back from setuid root
  * Don't support --userns2 in setuid mode
  * fixes CVE-2020-5291
  * fixes bsc#1168291</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1632139200">- Update to version 0.5.0:
  + New features:
  - --chmod changes permissions
  - --clearenv unsets every environment variable (except PWD)
  - --perms sets permissions for one subsequent --bind-data,
  - -dir, --file, --ro-bind-data or --tmpfs
  + Other enhancements:
  - Better diagnostics when a --bind or other bind-mount fails
  - zsh tab-completion
  - Better test coverage
  + Bug fixes:
  - Use Python 3 for tests and examples
  - Mount points for non-directories are created with permissions
  - r--r--r-- instead of -rw-rw-rw-
  - Don't remount items in /proc read-only if already EROFS,
    required to run under Docker
  - Allow mounting an non-directory over an existing
    non-directory, e.g. --bind "$XDG_RUNTIME_DIR/my-log-socket"
    /dev/log
  - Silence kernel messages for our bind-mounts
  - Make sure pkg-config is checked for, regardless of build
    options
  - Improve ability to bind-mount directories on case-insensitive
    filesystems
  - Fix -Wshadow warnings
  - Fix deprecation warnings with newer SELinux
- Add new subpackage bubblewrap-zsh-completion</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1646395200">- Update to 0.6.1:
  - Add a release checklist
  - completions: Make zsh completion non-executable
  The Autotools build system installed it with 0644 permissions because
  it's listed as DATA, but the Meson build system installs executable
  files as executable by default.
  zsh completions don't need to be executable to work, and this one doesn't
  have the `#!` marker that should start an executable script.
- update to 0.6.0:
  - meson: Improve compatibility with Meson 0.49
  That version doesn't allow more than two arguments for define_variable.
  - Disable test-specifying-pidns.sh under 'meson dist' while I investigate
  This test is hanging when run under 'meson dist' for some reason, but
  not when run under 'meson test', and not locally, only in the Github
  Workflow-based CI. Disable it for now.
  - meson: Actually build and run the tests
  - tests: Fix compiler warnings for unused arguments
  - meson: Run test scripts from $srcdir
  - meson: Make G_TEST_SRCDIR, G_TEST_BUILDDIR match Autotools
  - meson: Run the Python test script with Python, not bash
  The python build option can be used to swap to a different interpreter,
  for environments like the Steam Runtime where the python3 executable in
  the PATH is extremely old but there is a better interpreter available.
  This is treated as non-optional, because Meson is written in Python,
  so the situation where there is no Python interpreter at build-time
  shouldn't arise.
  - meson: Build the try-syscall helper
  - meson: Build tests with equivalent of -I$(top_srcdir) -I$(top_builddir)
  - meson.build: Remove unnecessary check for sh
  - Add a Meson build system
  This allows bwrap to be built as a subproject in larger Meson projects.
  When built as a subproject, we install into the --libexecdir and
  require a program prefix to be specified: for example, Flatpak would use
  program_prefix=flatpak- to get /usr/libexec/flatpak-bwrap. Verified to
  be backwards-compatible as far as Meson 0.49.0 (Debian 9 backports).
  Loosely based on previous work by Jussi Pakkanen (see #133).
  Differences between the Autotools and Meson builds:
  The Meson build requires a version of libcap that has pkg-config
  metadata (introduced in libcap 2.23, in 2013).
  The Meson build has no equivalent of --with-priv-mode=setuid. On
  distributions like Debian &lt;= 10 and RHEL &lt;= 7 that require a setuid bwrap
  executable, the sysadmin or distribution packaging will need to set the
  correct permissions on the bwrap executable; Debian already did this via
  packaging rather than the upstream build system.
  The Meson build supports being used as a subproject, and there is CI
  for this. It automatically disables shell completions and man pages,
  moves the bubblewrap executable to ${libexecdir}, and renames the
  bubblewrap executable according to a program_prefix option that the
  caller must specify (for example, Flatpak would use
  - Dprogram_prefix=flatpak- to get /usr/libexec/flatpak-bwrap). See the
  tests/use-as-subproject/ directory for an example.
  - Use HEAD to refer to other projects' default branches in documentation
  This makes the URL independent of the name they have chosen for their
  default branches.
  - workflows: Update for rename of default branch to main
  - tests: Exercise seccomp filters
  - Allow loading more than one seccomp program
  This will allow Flatpak to combine an allow-list (default-deny) of
  known system calls with a deny-list (default-allow) of system calls
  that are undesired.
  Resolves: https://github.com/containers/bubblewrap/issues/453
  - Generalize linked lists of LockFile and SetupOp
  I'm about to add a third linked list, for seccomp programs, which would
  seem like too much duplication.
  - Handle argc == 0 better
  Unfortunately it's possible for argc to be 0, so error out pretty early
  on in that case. I don't think this is a security issue in this case.
  - Fix typo
  - Remove trailing whitespace
  - Fix spelling
  - bash: Fix shellcheck warnings
  - bash: Invoke bash using /usr/bin/env
  - bubblewrap: Avoid a -Wjump-misses-init false-positive
  When building with -Wjump-misses-init as part of a larger project, gcc
  reports that we jump past initialization of cover_proc_dirs. This is
  technically true, but we only use this variable in the case where it's
  initialized, so that's harmless.
  However, we can avoid this altogether by making the array static and
  constant, which allows it to be moved from initialized data to read-only
  data.
  - bind-mount: Be more const-correct
  When compiled with -Wwrite-strings as part of a larger project, gcc and
  clang both warn that we're assigning a string constant to a mutable
  struct member. There's actually no reason why it should be mutable, so
  make it const.
  - die_with_error: Save errno sooner
  We need to save errno immediately, otherwise it could be overwritten
  by a failing library call somewhere in the implementation of fprintf.
  - main: Warn when non-repeatable options are repeated
  A user might reasonably expect that `bwrap --seccomp 3 --seccomp 4 ...`
  would load seccomp programs from both fds 3 and 4, but in fact it only
  loads the program from fd 4.
  Helps: https://github.com/containers/bubblewrap/issues/453
  Resolves: https://github.com/containers/bubblewrap/issues/454
  - utils: Add warn()
  - Add SPDX-License-Identifier for files that already specify license
  This is a step towards REUSE compliance. Third-party files that we do
  not otherwise edit (git.mk, m4/attributes.m4) are excluded here.
  - tests: Use preferred spelling for SPDX license identifiers
  - Remove obsolete .travis.yml
  We no longer use Travis-CI.
  - Remove obsolete papr CI
  We no longer use this.</changelog>
  <changelog author="dimstar@opensuse.org" date="1652875200">- Update to version 0.6.2:
  + New features in Meson build:
  - Auto-detect whether the man page can be generated.
  - -Dbwrapdir=... changes the installation directory (useful
    when being used as a subproject).
  - -Dtests=false disables unit tests.
  + Bug fixes:
  - Add --add-seccomp-fd to shell completions
  - Document --add-seccomp-fd, --json-status-fd and --share-net
    in the man page
  - Add attributes to silence various compiler warnings
  - Allow compilation of tests with musl on mips architectures
  - Allow compilation with older glibc
  - Disable sanitizers for a test helper whose seccomp profile
    breaks the instrumentation
  - Disable AddressSanitizer leak detection where it interferes
    with unit testing</changelog>
  <changelog author="dmueller@suse.com" date="1670414400">- update to v0.7.0:
  * --size option controls the size of a subsequent --tmpfs (#509)
  * Better error messages if a mount operation fails (#472)
  * Better error message if creating the new user namespace fails with
    ENOSPC (#487)
  * When building as a Meson subproject, a RUNPATH can be set on the
    executable to make it easier to bundle its libcap dependency
  * Fix test failures when running as uid 0 but with limited capabilities
    (#510)
  * Use POSIX command -v in preference to non-standard which (#527)
  * Fix a copy/paste error in --help (#531)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1679918400">- update to v0.8.0:
  * Add --disable-userns option to prevent the sandbox from
    creating its own nested user namespace
  * Add --assert-userns-disabled option to check that an existing
    userns was created with --disable-userns
  * Give a clearer error message if the kernel doesn't have
    CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER</changelog>
  <changelog author="qzhao@suse.com" date="1724241600">- Add bubblewrap-CVE-2024-42472.patch:
  Backporting a253257c from upstream, Add --bind-fd and --ro-bind-fd
  to let you bind a O_PATH fd.
  (CVE-2024-42472, bsc#1229157)</changelog>
</package>
<package pkgid="0dab325bdcde7c4c4d3a3bb5f0fed521a9ef1744bff7cbac117f822e5b3e2f92" name="buildah" arch="aarch64">
  <version epoch="0" ver="1.35.4" rel="150500.3.10.1"/>
  <changelog author="danish.prakash@suse.com" date="1691755200">- Update to version 1.31.2:
  * [release-1.31] Bump to v1.31.2
  * [release-1.31] Bump to v1.31.2-dev
  * [release-1.31] Bump to v1.31.1
  * [release-1.31] Remove zstd:chunked from man, bump c/common to v0.55.3
  * [CI:BUILD] Packit: add fedora-eln targets
  * [CI:BUILD] RPM: build docs with vendored go-md2man
  * packit: Build PRs into default packit COPRs
  * [CI:BUILD] Packit: remove pre-sync action
  * CI:BUILD] RPM: define gobuild macro for rhel/centos stream</changelog>
  <changelog author="danish.prakash@suse.com" date="1694606400">- Update to version 1.31.3:
  * [release-1.31] Bump to v1.31.3
  * [release-1.31] Bump c/common 0.55.4, c/image 5.26.2, c/storage 1.48.1
  * rpm: spdx compatible license field
  * RPM: fix buildtags
  * [release-1.31] Bump to v1.31.3-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1695816000">- Update to version 1.32.0:
  * Tag v1.32.0
  * GetTmpDir is not using ImageCopyTmpdir correctly
  * Run codespell on code
  * Bump vendor containers/(common, storage, image)
  * Cirrus: Remove multi-arch buildah image builds
  * fix(deps): update module github.com/containerd/containerd to v1.7.6
  * Split GetTempDir from internal/util
  * Move most of internal/parse to internal/volumes
  * copier: remove libimage dependency via util package
  * Add some docs for `build --cw`, `commit --cw`, and `mkcw`
  * Add `buildah mkcw`, add `--cw` to `buildah commit` and `buildah build`
  * Make sure that pathnames picked up from the environment are absolute
  * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4
  * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible
  * Don't try to look up names when committing images
  * fix(deps): update module golang.org/x/crypto to v0.13.0
  * docs: use valid github repo
  * fix(deps): update module golang.org/x/sys to v0.12.0
  * vendor containers/common@12405381ff45
  * push: --force-compression should be true with --compression-format
  * Update module github.com/containerd/containerd to v1.7.5
  * [skip-ci] Update tim-actions/commit-message-checker-with-regex action to v0.3.2
  * docs: add reference to oci-hooks
  * Support passing of ULimits as -1 to mean max
  * GHA: Attempt to fix discussion_lock workflow
  * Fixing the owner of the storage.conf.
  * pkg/chrootuser: Ignore comments when parsing /etc/group on FreeBSD
  * Use buildah repo rather then podman repo
  * GHA: Closed issue/PR comment-lock test
  * fix(deps): update module github.com/containers/storage to v1.49.0
  * chore(deps): update dependency containers/automation_images to v20230816
  * Replace troff code with markdown in buildah-{copy,add}.1.md
  * [CI:BUILD] rpm: spdx compatible license field
  * executor: build-arg warnings must honor global args
  * fix(deps): update module github.com/containers/ocicrypt to v1.1.8
  * chroot: `setSeccomp` add support for `ArchPARISC(64)` and `ArchRISCV64`
  * make,cross: restore loong64
  * Clear CommonBuildOpts when loading Builder status
  * buildah/push/manifest-push: add support for --force-compression
  * vendor: bump c/common to v0.55.1-0.20230811093040-524b4d5c12f9
  * chore(deps): update dependency containers/automation_images to v20230809
  * [CI:BUILD] RPM: fix buildtags
  * fix(deps): update module github.com/opencontainers/runc to v1.1.9
  * chore(deps): update dependency ubuntu to v22
  * chore(deps): update dependency containers/automation_images to v20230807
  * [CI:BUILD] Packit: add fedora-eln targets
  * [CI:BUILD] RPM: build docs with vendored go-md2man
  * packit: Build PRs into default packit COPRs
  * Update install.md
  * Update install.md changes current Debian stable version name
  * fix(deps): update module golang.org/x/term to v0.11.0
  * fix(deps): update module golang.org/x/crypto to v0.12.0
  * tests: fix layer-label tests
  * buildah: add --layer-label for setting labels on layers
  * Cirrus: container/rootless env. var. passthrough
  * Cirrus: Remove duplicate env. var. definitions
  * fix(deps): update github.com/containers/storage digest to c3da76f
  * Add a missing .Close() call on an ImageSource
  * Create only a reference when that's all we need
  * Add a missing .Close() call on an ImageDestination
  * CI:BUILD] RPM: define gobuild macro for rhel/centos stream
  * manifest/push: add support for --add-compression
  * manifest/inspect: add support for tls-verify and authfile
  * vendor: bump c/common to v0.55.1-0.20230727095721-647ed1d4d79a
  * vendor: bump c/image to v5.26.1-0.20230726142307-8c387a14f4ac
  * fix(deps): update module github.com/containerd/containerd to v1.7.3
  * fix(deps): update module github.com/onsi/gomega to v1.27.10
  * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible
  * fix(deps): update module github.com/containers/image/v5 to v5.26.1
  * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0
  * Update vendor of containers/(storage,image,common)
  * fix(deps): update module github.com/opencontainers/runc to v1.1.8
  * [CI:BUILD] Packit: remove pre-sync action
  * fix(deps): update module github.com/containers/common to v0.55.2
  * [CI:BUILD] Packit: downstream task script needs GOPATH
  * Vendor in containers/(common, image, storage)
  * fix(deps): update module golang.org/x/term to v0.10.0
  * [CI:BUILD] Packit: fix pre-sync action for downstream tasks
  * contrib/buildahimage: set config correctly for rootless build user
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4
  * Bump to v1.32.0-dev
  * Update debian install instructions
  * pkg/overlay: add limited support for FreeBSD</changelog>
  <changelog author="dcermak@suse.com" date="1696593600">- Bump BuildRequired golang version to &gt;= 1.21, fixes bsc#1216005</changelog>
  <changelog author="dcermak@suse.com" date="1698148800">- Update to version 1.32.1:
  * tag v1.32.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * .cirrus.yml: run tests relative to the release-1.32 branch</changelog>
  <changelog author="dcermak@suse.com" date="1698840000">- Update to version 1.32.2:
  * Mask /sys/devices/virtual/powercap by default
  * tag v1.32.2</changelog>
  <changelog author="dcermak@suse.com" date="1700481600">- Add patch:
  * 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch (fixes
    builds on non x86_64)
- Update to version 1.33.1:
  * Bump to v1.33.1
  * Bump to v1.31.2-dev
  * Bump to v1.31.1
  * fix(deps): update module github.com/moby/buildkit to v0.11.4 [security]
  * test,heredoc: use fedora instead of docker.io/library/python:latest
  * Bump to v1.33.1-dev
  * Bump to v1.33.0
  * Never omit layers for emptyLayer instructions when squashing/cwing
  * Add OverrideChanges and OverrideConfig to CommitOptions
  * buildah: add heredoc support for RUN, COPY and ADD
  * vendor: bump imagebuilder to v1.2.6-0.20231110114814-35a50d57f722
  * conformance tests: archive the context directory as 0:0 (#5171)
  * blobcacheinfo,test: blobs must be resued when pushing across registry
  * Bump c/storage v1.51.0, c/image v5.29.0, c/common v0.57.0
  * pkg/util.MirrorToTempFileIfPathIsDescriptor(): don't leak an fd
  * StageExecutor.Execute: force a commit for --unsetenv, too
  * Increase a copier+chroot test timeout
  * Add support for --compat-auth-file in login/logout
  * Update existing tests for error message change
  * Update c/image and c/common to latest
  * fix(deps): update module github.com/containerd/containerd to v1.7.9
  * build: downgrade to go 1.20
  * Add godoc for pkg/parse.GetTempDir
  * conformance tests: use go-dockerclient for BuildKit builds
  * Make TEE types case-insensitive
  * fix(deps): update module golang.org/x/crypto to v0.15.0
  * Tweak some help descriptions
  * Stop using DefaultNetworkSysctl and use containers.conf only
  * Implement ADD checksum flag #5135
  * vendor of openshift/imagebuilder #5135
  * Pass secrets from the host down to internal podman containers
  * Update cirrus and version of golang
  * image: replace GetStoreImage with ResolveReference
  * vendor: bump c/image to 373c52a9466f
  * pkg/parse.Platform(): minor simplification
  * createConfigsAndManifests: clear history before cw-specific logic
  * Use a constant definition instead of "scratch"
  * conformance: use require.NoErrorf() more
  * fix(deps): update module golang.org/x/term to v0.14.0
  * fix(deps): update module golang.org/x/sync to v0.5.0
  * fix(deps): update module github.com/spf13/cobra to v1.8.0
  * fix(deps): update module golang.org/x/sys to v0.14.0
  * fix(deps): update github.com/containers/common digest to 8354404
  * fix(deps): update module github.com/opencontainers/runc to v1.1.10
  * fix(deps): update github.com/containers/luksy digest to b5a7f79
  * Log the platform for build errors during multi-platform builds
  * Use mask definitions from containers/common
  * Vendor in latest containers/common
  * fix(deps): update module github.com/containerd/containerd to v1.7.8
  * fix(deps): update module go.etcd.io/bbolt to v1.3.8
  * container.conf: support attributed string slices
  * fix(deps): update module sigs.k8s.io/yaml to v1.4.0
  * Use cutil.StringInSlice rather then contains
  * Add --no-hostname option to buildah containers
  * vendor c/common: appendable containers.conf strings, Part 1
  * fix(deps): update module github.com/onsi/gomega to v1.28.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * chore(deps): update dependency containers/automation_images to v20231004
  * Vendor containers/common
  * chore(deps): update module golang.org/x/net to v0.17.0 [security]
  * run: use internal.GetTempDir with os.MkdirTemp
  * fix(deps): update module github.com/containerd/containerd to v1.7.7
  * imagebuildah,multi-stage: do not remove base images
  * gitignore: add mkcw binary
  * mkcw: remove entrypoint binaries
  * fix(deps): update module golang.org/x/crypto to v0.14.0
  * fix(deps): update module golang.org/x/sys to v0.13.0
  * fix(deps): update module golang.org/x/sync to v0.4.0
  * Update some comments related to confidential workload
  * Use the parent's image ID in the config that we pass to imagebuilder
  * fix(deps): update github.com/containers/common digest to 8892536
  * fix(deps): update github.com/containers/luksy digest to 6df88cb
  * bug: Ensure the mount type is always BindMount by default
  * Protocol can be specified with --port. Ex. --port 514/udp
  * fix(deps): update module github.com/onsi/gomega to v1.28.0
  * build,config: add support for --unsetlabel
  * tests/bud: add tests
  * [CI:BUILD] Packit: tag @containers/packit-build on copr build failures
  * stage_executor: allow images without layers
  * vendor of containers/common
  * Removing selinux_tag.sh as no longer needed after 580356f [NO NEW TESTS NEEDED]
  * add/copy: make sure we handle relative path names correctly
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5
  * Bump to v1.33.0-dev
  * imagebuildah: consider ignorefile with --build-context</changelog>
  <changelog author="dcermak@suse.com" date="1701086400">- Update to version 1.33.2:
  * [release-1.33.2] Bump to v1.33.2
  * Update minimum to golang 1.20
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.0
  * fix(deps): update module github.com/moby/buildkit to v0.12.3
  * Bump to v1.33.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1702555200">- Drop 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch
  (merged upstream; https://github.com/containers/buildah/pull/5183)
- Update to version 1.34.0:
  * Bump to v1.34.0
  * fix(deps): update module github.com/containerd/containerd to v1.7.11
  * fix(deps): update github.com/containers/storage digest to 15c3cb7
  * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.2
  * fix(deps): update github.com/containers/common digest to 630c929
  * fix(deps): update module github.com/moby/buildkit to v0.12.4
  * fix(deps): update github.com/openshift/imagebuilder digest to ef2a5fe
  * [CI:DOCS] man pages: underscores, too-wide lines
  * fix(deps): update module github.com/containerd/containerd to v1.7.10
  * run.bats: use --quiet --pull=false when using a prefetched image
  * internal/mkcw/embed/entrypoint.gz: rename to include the arch
  * internal/mkcw/embed/entrypoint.gz: compress with -n9
  * fix(deps): update module golang.org/x/crypto to v0.16.0
  * Integration tests: make skip_if_no_unshare check --map-users
  * fix(deps): update module golang.org/x/term to v0.15.0
  * fix(deps): update module golang.org/x/sys to v0.15.0
  * fix(deps): update module github.com/onsi/ginkgo to v2
  * vendor: update c/{common,image,storage}
  * run: Allow using just one jail per container on FreeBSD
  * Remove makefile targets entrypoint{,.gz} for non x86_64</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1708689600">- Update to version 1.34.1:
  * [release-1.34] Bump to v1.34.1
  * [release-1.34] Vendor bumps (fixes bsc#1219563)
  * manifest: addCompression use default from containers.conf
  * Build with CNI support on FreeBSD
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * docs: correct default authfile path
  * Make buildah match podman for handling of ulimits
  * imagebuildah: fix crash with empty RUN
  * docs: move footnotes to where they're applicable
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Allow users to specify no-dereference
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * Replace strings.SplitN with strings.Cut
  * Document use of containers-transports values in buildah
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * Ignore errors if label.Relabel returns ENOSUP
  * manifest: addCompression use default from containers.conf</changelog>
  <changelog author="danish.prakash@suse.com" date="1709121600">- Require cni-plugins (bsc#1220568)</changelog>
  <changelog author="dcermak@suse.com" date="1709812800">- Update to version 1.35.0:
  * Bump v1.35.0
  * Bump c/common v0.58.0, c/image v5.30.0, c/storage v1.53.0
  * conformance tests: don't break on trailing zeroes in layer blobs
  * Add a conformance test for copying to a mounted prior stage
  * fix(deps): update module github.com/stretchr/testify to v1.9.0
  * cgroups: reuse version check from c/common
  * Update vendor of containers/(common,image)
  * fix(deps): update github.com/containers/storage digest to eadc620
  * fix(deps): update github.com/containers/luksy digest to ceb12d4
  * fix(deps): update github.com/containers/image/v5 digest to cdc6802
  * manifest add: complain if we get artifact flags without --artifact
  * Use retry logic from containers/common
  * Vendor in containers/(storage,image,common)
  * Update module golang.org/x/crypto to v0.20.0
  * Add comment re: Total Success task name
  * tests: skip_if_no_unshare(): check for --setuid
  * Properly handle build --pull=false
  * [skip-ci] Update tim-actions/get-pr-commits action to v1.3.1
  * Update module go.etcd.io/bbolt to v1.3.9
  * Revert "Reduce official image size"
  * Update module github.com/opencontainers/image-spec to v1.1.0
  * Reduce official image size
  * Build with CNI support on FreeBSD
  * build --all-platforms: skip some base "image" platforms
  * Bump main to v1.35.0-dev
  * Vendor in latest containers/(storage,image,common)
  * Split up error messages for missing --sbom related flags
  * `buildah manifest`: add artifact-related options
  * cmd/buildah/manifest.go: lock lists before adding/annotating/pushing
  * cmd/buildah/manifest.go: don't make struct declarations aliases
  * Use golang.org/x/exp/slices.Contains
  * Disable loong64 again
  * Fix a couple of typos in one-line comments
  * egrep is obsolescent; use grep -E
  * Try Cirrus with a newer VM version
  * Set CONTAINERS_CONF in the chroot-mount-flags integration test
  * Update to match dependency API update
  * Update github.com/openshift/imagebuilder and containers/common
  * docs: correct default authfile path
  * fix(deps): update module github.com/containerd/containerd to v1.7.13
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * manifest, push: add support for --retry and --retry-delay
  * fix(deps): update github.com/openshift/imagebuilder digest to b767bc3
  * imagebuildah: fix crash with empty RUN
  * fix(deps): update github.com/containers/luksy digest to b62d551
  * fix(deps): update module github.com/opencontainers/runc to v1.1.12 [security]
  * fix(deps): update module github.com/moby/buildkit to v0.12.5 [security]
  * Make buildah match podman for handling of ulimits
  * docs: move footnotes to where they're applicable
  * Allow users to specify no-dereference
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * fix(deps): update module github.com/onsi/gomega to v1.31.1
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc6
  * docs: use reversed logo for dark theme in README
  * build,commit: add --sbom to scan and produce SBOMs when committing
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * internal/mkcw.Archive(): handle extra image content
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * fix(deps): update module golang.org/x/crypto to v0.18.0
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * fix(deps): update module golang.org/x/sync to v0.6.0
  * fix(deps): update module golang.org/x/term to v0.16.0
  * Bump CI VMs
  * Replace strings.SplitN with strings.Cut
  * fix(deps): update github.com/containers/storage digest to ef81e9b
  * fix(deps): update github.com/containers/image/v5 digest to 1b221d4
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.1
  * Document use of containers-transports values in buildah
  * fix(deps): update module golang.org/x/crypto to v0.17.0 [security]
  * chore(deps): update dependency containers/automation_images to v20231208
  * manifest: addCompression use default from containers.conf
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * chore(deps): update dependency containers/automation_images to v20230517
  * [skip-ci] Update actions/stale action to v9
  * fix(deps): update module github.com/containernetworking/plugins to v1.4.0
  * fix(deps): update github.com/containers/image/v5 digest to 7a40fee
  * Bump to v1.34.1-dev
  * Ignore errors if label.Relabel returns ENOSUP</changelog>
  <changelog author="danish.prakash@suse.com" date="1710417600">- Require passt for rootless networking (poo#156955)
  Buildah moved to passt/pasta for rootless networking from slirp4netns
  (https://github.com/containers/common/pull/1846)</changelog>
  <changelog author="dcermak@suse.com" date="1710417601">- Remove obsolete requires libcontainers-image &amp; libcontainers-storage</changelog>
  <changelog author="dcermak@suse.com" date="1710763200">- Buildah dropped cni support, require netavark instead (boo#1221243)</changelog>
  <changelog author="dcermak@suse.com" date="1710849600">- Update to version 1.35.1:
  * [release-1.35] Bump to v1.35.1
  * [release-1.35] CVE-2024-1753 container escape fix (bsc#1221677)
- Remove upstreamed patches:
  - 0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1710849601">- Add patch for CVE-2024-1753 / bsc#1221677:
  0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1712059200">- Update to version 1.35.3:
  * [release-1.35] Bump to Buildah v1.35.3
  * [release-1.35] correctly configure /etc/hosts and resolv.conf
  * [release-1.35] buildah: refactor resolv/hosts setup.
  * [release-1.35] rename the hostFile var to reflect
  * [release-1.35] Bump c/common to v0.58.1
  * [release-1.35] Bump Buildah to v1.35.2
  * [release-1.35] CVE-2024-24786 protobuf to 1.33
  * [release-1.35] Bump to v1.35.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1715342400">- Update to version 1.35.4:
  * [release-1.35] Bump to Buildah v1.35.4
  * [release-1.35] CVE-2024-3727 updates (bsc#1224117)
  * integration test: handle new labels in "bud and test --unsetlabel"
  * [release-1.35] Bump go-jose CVE-2024-28180
  * [release-1.35] Bump ocicrypt and go-jose CVE-2024-28180</changelog>
</package>
<package pkgid="edef3df84574c782e0a1c8bd0ede6302b24238ed6584ff199cb2a377c08f6a92" name="buildah" arch="ppc64le">
  <version epoch="0" ver="1.35.4" rel="150500.3.10.1"/>
  <changelog author="danish.prakash@suse.com" date="1691755200">- Update to version 1.31.2:
  * [release-1.31] Bump to v1.31.2
  * [release-1.31] Bump to v1.31.2-dev
  * [release-1.31] Bump to v1.31.1
  * [release-1.31] Remove zstd:chunked from man, bump c/common to v0.55.3
  * [CI:BUILD] Packit: add fedora-eln targets
  * [CI:BUILD] RPM: build docs with vendored go-md2man
  * packit: Build PRs into default packit COPRs
  * [CI:BUILD] Packit: remove pre-sync action
  * CI:BUILD] RPM: define gobuild macro for rhel/centos stream</changelog>
  <changelog author="danish.prakash@suse.com" date="1694606400">- Update to version 1.31.3:
  * [release-1.31] Bump to v1.31.3
  * [release-1.31] Bump c/common 0.55.4, c/image 5.26.2, c/storage 1.48.1
  * rpm: spdx compatible license field
  * RPM: fix buildtags
  * [release-1.31] Bump to v1.31.3-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1695816000">- Update to version 1.32.0:
  * Tag v1.32.0
  * GetTmpDir is not using ImageCopyTmpdir correctly
  * Run codespell on code
  * Bump vendor containers/(common, storage, image)
  * Cirrus: Remove multi-arch buildah image builds
  * fix(deps): update module github.com/containerd/containerd to v1.7.6
  * Split GetTempDir from internal/util
  * Move most of internal/parse to internal/volumes
  * copier: remove libimage dependency via util package
  * Add some docs for `build --cw`, `commit --cw`, and `mkcw`
  * Add `buildah mkcw`, add `--cw` to `buildah commit` and `buildah build`
  * Make sure that pathnames picked up from the environment are absolute
  * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4
  * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible
  * Don't try to look up names when committing images
  * fix(deps): update module golang.org/x/crypto to v0.13.0
  * docs: use valid github repo
  * fix(deps): update module golang.org/x/sys to v0.12.0
  * vendor containers/common@12405381ff45
  * push: --force-compression should be true with --compression-format
  * Update module github.com/containerd/containerd to v1.7.5
  * [skip-ci] Update tim-actions/commit-message-checker-with-regex action to v0.3.2
  * docs: add reference to oci-hooks
  * Support passing of ULimits as -1 to mean max
  * GHA: Attempt to fix discussion_lock workflow
  * Fixing the owner of the storage.conf.
  * pkg/chrootuser: Ignore comments when parsing /etc/group on FreeBSD
  * Use buildah repo rather then podman repo
  * GHA: Closed issue/PR comment-lock test
  * fix(deps): update module github.com/containers/storage to v1.49.0
  * chore(deps): update dependency containers/automation_images to v20230816
  * Replace troff code with markdown in buildah-{copy,add}.1.md
  * [CI:BUILD] rpm: spdx compatible license field
  * executor: build-arg warnings must honor global args
  * fix(deps): update module github.com/containers/ocicrypt to v1.1.8
  * chroot: `setSeccomp` add support for `ArchPARISC(64)` and `ArchRISCV64`
  * make,cross: restore loong64
  * Clear CommonBuildOpts when loading Builder status
  * buildah/push/manifest-push: add support for --force-compression
  * vendor: bump c/common to v0.55.1-0.20230811093040-524b4d5c12f9
  * chore(deps): update dependency containers/automation_images to v20230809
  * [CI:BUILD] RPM: fix buildtags
  * fix(deps): update module github.com/opencontainers/runc to v1.1.9
  * chore(deps): update dependency ubuntu to v22
  * chore(deps): update dependency containers/automation_images to v20230807
  * [CI:BUILD] Packit: add fedora-eln targets
  * [CI:BUILD] RPM: build docs with vendored go-md2man
  * packit: Build PRs into default packit COPRs
  * Update install.md
  * Update install.md changes current Debian stable version name
  * fix(deps): update module golang.org/x/term to v0.11.0
  * fix(deps): update module golang.org/x/crypto to v0.12.0
  * tests: fix layer-label tests
  * buildah: add --layer-label for setting labels on layers
  * Cirrus: container/rootless env. var. passthrough
  * Cirrus: Remove duplicate env. var. definitions
  * fix(deps): update github.com/containers/storage digest to c3da76f
  * Add a missing .Close() call on an ImageSource
  * Create only a reference when that's all we need
  * Add a missing .Close() call on an ImageDestination
  * CI:BUILD] RPM: define gobuild macro for rhel/centos stream
  * manifest/push: add support for --add-compression
  * manifest/inspect: add support for tls-verify and authfile
  * vendor: bump c/common to v0.55.1-0.20230727095721-647ed1d4d79a
  * vendor: bump c/image to v5.26.1-0.20230726142307-8c387a14f4ac
  * fix(deps): update module github.com/containerd/containerd to v1.7.3
  * fix(deps): update module github.com/onsi/gomega to v1.27.10
  * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible
  * fix(deps): update module github.com/containers/image/v5 to v5.26.1
  * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0
  * Update vendor of containers/(storage,image,common)
  * fix(deps): update module github.com/opencontainers/runc to v1.1.8
  * [CI:BUILD] Packit: remove pre-sync action
  * fix(deps): update module github.com/containers/common to v0.55.2
  * [CI:BUILD] Packit: downstream task script needs GOPATH
  * Vendor in containers/(common, image, storage)
  * fix(deps): update module golang.org/x/term to v0.10.0
  * [CI:BUILD] Packit: fix pre-sync action for downstream tasks
  * contrib/buildahimage: set config correctly for rootless build user
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4
  * Bump to v1.32.0-dev
  * Update debian install instructions
  * pkg/overlay: add limited support for FreeBSD</changelog>
  <changelog author="dcermak@suse.com" date="1696593600">- Bump BuildRequired golang version to &gt;= 1.21, fixes bsc#1216005</changelog>
  <changelog author="dcermak@suse.com" date="1698148800">- Update to version 1.32.1:
  * tag v1.32.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * .cirrus.yml: run tests relative to the release-1.32 branch</changelog>
  <changelog author="dcermak@suse.com" date="1698840000">- Update to version 1.32.2:
  * Mask /sys/devices/virtual/powercap by default
  * tag v1.32.2</changelog>
  <changelog author="dcermak@suse.com" date="1700481600">- Add patch:
  * 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch (fixes
    builds on non x86_64)
- Update to version 1.33.1:
  * Bump to v1.33.1
  * Bump to v1.31.2-dev
  * Bump to v1.31.1
  * fix(deps): update module github.com/moby/buildkit to v0.11.4 [security]
  * test,heredoc: use fedora instead of docker.io/library/python:latest
  * Bump to v1.33.1-dev
  * Bump to v1.33.0
  * Never omit layers for emptyLayer instructions when squashing/cwing
  * Add OverrideChanges and OverrideConfig to CommitOptions
  * buildah: add heredoc support for RUN, COPY and ADD
  * vendor: bump imagebuilder to v1.2.6-0.20231110114814-35a50d57f722
  * conformance tests: archive the context directory as 0:0 (#5171)
  * blobcacheinfo,test: blobs must be resued when pushing across registry
  * Bump c/storage v1.51.0, c/image v5.29.0, c/common v0.57.0
  * pkg/util.MirrorToTempFileIfPathIsDescriptor(): don't leak an fd
  * StageExecutor.Execute: force a commit for --unsetenv, too
  * Increase a copier+chroot test timeout
  * Add support for --compat-auth-file in login/logout
  * Update existing tests for error message change
  * Update c/image and c/common to latest
  * fix(deps): update module github.com/containerd/containerd to v1.7.9
  * build: downgrade to go 1.20
  * Add godoc for pkg/parse.GetTempDir
  * conformance tests: use go-dockerclient for BuildKit builds
  * Make TEE types case-insensitive
  * fix(deps): update module golang.org/x/crypto to v0.15.0
  * Tweak some help descriptions
  * Stop using DefaultNetworkSysctl and use containers.conf only
  * Implement ADD checksum flag #5135
  * vendor of openshift/imagebuilder #5135
  * Pass secrets from the host down to internal podman containers
  * Update cirrus and version of golang
  * image: replace GetStoreImage with ResolveReference
  * vendor: bump c/image to 373c52a9466f
  * pkg/parse.Platform(): minor simplification
  * createConfigsAndManifests: clear history before cw-specific logic
  * Use a constant definition instead of "scratch"
  * conformance: use require.NoErrorf() more
  * fix(deps): update module golang.org/x/term to v0.14.0
  * fix(deps): update module golang.org/x/sync to v0.5.0
  * fix(deps): update module github.com/spf13/cobra to v1.8.0
  * fix(deps): update module golang.org/x/sys to v0.14.0
  * fix(deps): update github.com/containers/common digest to 8354404
  * fix(deps): update module github.com/opencontainers/runc to v1.1.10
  * fix(deps): update github.com/containers/luksy digest to b5a7f79
  * Log the platform for build errors during multi-platform builds
  * Use mask definitions from containers/common
  * Vendor in latest containers/common
  * fix(deps): update module github.com/containerd/containerd to v1.7.8
  * fix(deps): update module go.etcd.io/bbolt to v1.3.8
  * container.conf: support attributed string slices
  * fix(deps): update module sigs.k8s.io/yaml to v1.4.0
  * Use cutil.StringInSlice rather then contains
  * Add --no-hostname option to buildah containers
  * vendor c/common: appendable containers.conf strings, Part 1
  * fix(deps): update module github.com/onsi/gomega to v1.28.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * chore(deps): update dependency containers/automation_images to v20231004
  * Vendor containers/common
  * chore(deps): update module golang.org/x/net to v0.17.0 [security]
  * run: use internal.GetTempDir with os.MkdirTemp
  * fix(deps): update module github.com/containerd/containerd to v1.7.7
  * imagebuildah,multi-stage: do not remove base images
  * gitignore: add mkcw binary
  * mkcw: remove entrypoint binaries
  * fix(deps): update module golang.org/x/crypto to v0.14.0
  * fix(deps): update module golang.org/x/sys to v0.13.0
  * fix(deps): update module golang.org/x/sync to v0.4.0
  * Update some comments related to confidential workload
  * Use the parent's image ID in the config that we pass to imagebuilder
  * fix(deps): update github.com/containers/common digest to 8892536
  * fix(deps): update github.com/containers/luksy digest to 6df88cb
  * bug: Ensure the mount type is always BindMount by default
  * Protocol can be specified with --port. Ex. --port 514/udp
  * fix(deps): update module github.com/onsi/gomega to v1.28.0
  * build,config: add support for --unsetlabel
  * tests/bud: add tests
  * [CI:BUILD] Packit: tag @containers/packit-build on copr build failures
  * stage_executor: allow images without layers
  * vendor of containers/common
  * Removing selinux_tag.sh as no longer needed after 580356f [NO NEW TESTS NEEDED]
  * add/copy: make sure we handle relative path names correctly
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5
  * Bump to v1.33.0-dev
  * imagebuildah: consider ignorefile with --build-context</changelog>
  <changelog author="dcermak@suse.com" date="1701086400">- Update to version 1.33.2:
  * [release-1.33.2] Bump to v1.33.2
  * Update minimum to golang 1.20
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.0
  * fix(deps): update module github.com/moby/buildkit to v0.12.3
  * Bump to v1.33.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1702555200">- Drop 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch
  (merged upstream; https://github.com/containers/buildah/pull/5183)
- Update to version 1.34.0:
  * Bump to v1.34.0
  * fix(deps): update module github.com/containerd/containerd to v1.7.11
  * fix(deps): update github.com/containers/storage digest to 15c3cb7
  * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.2
  * fix(deps): update github.com/containers/common digest to 630c929
  * fix(deps): update module github.com/moby/buildkit to v0.12.4
  * fix(deps): update github.com/openshift/imagebuilder digest to ef2a5fe
  * [CI:DOCS] man pages: underscores, too-wide lines
  * fix(deps): update module github.com/containerd/containerd to v1.7.10
  * run.bats: use --quiet --pull=false when using a prefetched image
  * internal/mkcw/embed/entrypoint.gz: rename to include the arch
  * internal/mkcw/embed/entrypoint.gz: compress with -n9
  * fix(deps): update module golang.org/x/crypto to v0.16.0
  * Integration tests: make skip_if_no_unshare check --map-users
  * fix(deps): update module golang.org/x/term to v0.15.0
  * fix(deps): update module golang.org/x/sys to v0.15.0
  * fix(deps): update module github.com/onsi/ginkgo to v2
  * vendor: update c/{common,image,storage}
  * run: Allow using just one jail per container on FreeBSD
  * Remove makefile targets entrypoint{,.gz} for non x86_64</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1708689600">- Update to version 1.34.1:
  * [release-1.34] Bump to v1.34.1
  * [release-1.34] Vendor bumps (fixes bsc#1219563)
  * manifest: addCompression use default from containers.conf
  * Build with CNI support on FreeBSD
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * docs: correct default authfile path
  * Make buildah match podman for handling of ulimits
  * imagebuildah: fix crash with empty RUN
  * docs: move footnotes to where they're applicable
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Allow users to specify no-dereference
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * Replace strings.SplitN with strings.Cut
  * Document use of containers-transports values in buildah
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * Ignore errors if label.Relabel returns ENOSUP
  * manifest: addCompression use default from containers.conf</changelog>
  <changelog author="danish.prakash@suse.com" date="1709121600">- Require cni-plugins (bsc#1220568)</changelog>
  <changelog author="dcermak@suse.com" date="1709812800">- Update to version 1.35.0:
  * Bump v1.35.0
  * Bump c/common v0.58.0, c/image v5.30.0, c/storage v1.53.0
  * conformance tests: don't break on trailing zeroes in layer blobs
  * Add a conformance test for copying to a mounted prior stage
  * fix(deps): update module github.com/stretchr/testify to v1.9.0
  * cgroups: reuse version check from c/common
  * Update vendor of containers/(common,image)
  * fix(deps): update github.com/containers/storage digest to eadc620
  * fix(deps): update github.com/containers/luksy digest to ceb12d4
  * fix(deps): update github.com/containers/image/v5 digest to cdc6802
  * manifest add: complain if we get artifact flags without --artifact
  * Use retry logic from containers/common
  * Vendor in containers/(storage,image,common)
  * Update module golang.org/x/crypto to v0.20.0
  * Add comment re: Total Success task name
  * tests: skip_if_no_unshare(): check for --setuid
  * Properly handle build --pull=false
  * [skip-ci] Update tim-actions/get-pr-commits action to v1.3.1
  * Update module go.etcd.io/bbolt to v1.3.9
  * Revert "Reduce official image size"
  * Update module github.com/opencontainers/image-spec to v1.1.0
  * Reduce official image size
  * Build with CNI support on FreeBSD
  * build --all-platforms: skip some base "image" platforms
  * Bump main to v1.35.0-dev
  * Vendor in latest containers/(storage,image,common)
  * Split up error messages for missing --sbom related flags
  * `buildah manifest`: add artifact-related options
  * cmd/buildah/manifest.go: lock lists before adding/annotating/pushing
  * cmd/buildah/manifest.go: don't make struct declarations aliases
  * Use golang.org/x/exp/slices.Contains
  * Disable loong64 again
  * Fix a couple of typos in one-line comments
  * egrep is obsolescent; use grep -E
  * Try Cirrus with a newer VM version
  * Set CONTAINERS_CONF in the chroot-mount-flags integration test
  * Update to match dependency API update
  * Update github.com/openshift/imagebuilder and containers/common
  * docs: correct default authfile path
  * fix(deps): update module github.com/containerd/containerd to v1.7.13
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * manifest, push: add support for --retry and --retry-delay
  * fix(deps): update github.com/openshift/imagebuilder digest to b767bc3
  * imagebuildah: fix crash with empty RUN
  * fix(deps): update github.com/containers/luksy digest to b62d551
  * fix(deps): update module github.com/opencontainers/runc to v1.1.12 [security]
  * fix(deps): update module github.com/moby/buildkit to v0.12.5 [security]
  * Make buildah match podman for handling of ulimits
  * docs: move footnotes to where they're applicable
  * Allow users to specify no-dereference
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * fix(deps): update module github.com/onsi/gomega to v1.31.1
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc6
  * docs: use reversed logo for dark theme in README
  * build,commit: add --sbom to scan and produce SBOMs when committing
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * internal/mkcw.Archive(): handle extra image content
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * fix(deps): update module golang.org/x/crypto to v0.18.0
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * fix(deps): update module golang.org/x/sync to v0.6.0
  * fix(deps): update module golang.org/x/term to v0.16.0
  * Bump CI VMs
  * Replace strings.SplitN with strings.Cut
  * fix(deps): update github.com/containers/storage digest to ef81e9b
  * fix(deps): update github.com/containers/image/v5 digest to 1b221d4
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.1
  * Document use of containers-transports values in buildah
  * fix(deps): update module golang.org/x/crypto to v0.17.0 [security]
  * chore(deps): update dependency containers/automation_images to v20231208
  * manifest: addCompression use default from containers.conf
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * chore(deps): update dependency containers/automation_images to v20230517
  * [skip-ci] Update actions/stale action to v9
  * fix(deps): update module github.com/containernetworking/plugins to v1.4.0
  * fix(deps): update github.com/containers/image/v5 digest to 7a40fee
  * Bump to v1.34.1-dev
  * Ignore errors if label.Relabel returns ENOSUP</changelog>
  <changelog author="danish.prakash@suse.com" date="1710417600">- Require passt for rootless networking (poo#156955)
  Buildah moved to passt/pasta for rootless networking from slirp4netns
  (https://github.com/containers/common/pull/1846)</changelog>
  <changelog author="dcermak@suse.com" date="1710417601">- Remove obsolete requires libcontainers-image &amp; libcontainers-storage</changelog>
  <changelog author="dcermak@suse.com" date="1710763200">- Buildah dropped cni support, require netavark instead (boo#1221243)</changelog>
  <changelog author="dcermak@suse.com" date="1710849600">- Update to version 1.35.1:
  * [release-1.35] Bump to v1.35.1
  * [release-1.35] CVE-2024-1753 container escape fix (bsc#1221677)
- Remove upstreamed patches:
  - 0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1710849601">- Add patch for CVE-2024-1753 / bsc#1221677:
  0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1712059200">- Update to version 1.35.3:
  * [release-1.35] Bump to Buildah v1.35.3
  * [release-1.35] correctly configure /etc/hosts and resolv.conf
  * [release-1.35] buildah: refactor resolv/hosts setup.
  * [release-1.35] rename the hostFile var to reflect
  * [release-1.35] Bump c/common to v0.58.1
  * [release-1.35] Bump Buildah to v1.35.2
  * [release-1.35] CVE-2024-24786 protobuf to 1.33
  * [release-1.35] Bump to v1.35.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1715342400">- Update to version 1.35.4:
  * [release-1.35] Bump to Buildah v1.35.4
  * [release-1.35] CVE-2024-3727 updates (bsc#1224117)
  * integration test: handle new labels in "bud and test --unsetlabel"
  * [release-1.35] Bump go-jose CVE-2024-28180
  * [release-1.35] Bump ocicrypt and go-jose CVE-2024-28180</changelog>
</package>
<package pkgid="83208ed2ffee7c39b4e614f0ed5d76512a015f5db7b2b1fea566bfaad862a118" name="buildah" arch="s390x">
  <version epoch="0" ver="1.35.4" rel="150500.3.10.1"/>
  <changelog author="danish.prakash@suse.com" date="1691755200">- Update to version 1.31.2:
  * [release-1.31] Bump to v1.31.2
  * [release-1.31] Bump to v1.31.2-dev
  * [release-1.31] Bump to v1.31.1
  * [release-1.31] Remove zstd:chunked from man, bump c/common to v0.55.3
  * [CI:BUILD] Packit: add fedora-eln targets
  * [CI:BUILD] RPM: build docs with vendored go-md2man
  * packit: Build PRs into default packit COPRs
  * [CI:BUILD] Packit: remove pre-sync action
  * CI:BUILD] RPM: define gobuild macro for rhel/centos stream</changelog>
  <changelog author="danish.prakash@suse.com" date="1694606400">- Update to version 1.31.3:
  * [release-1.31] Bump to v1.31.3
  * [release-1.31] Bump c/common 0.55.4, c/image 5.26.2, c/storage 1.48.1
  * rpm: spdx compatible license field
  * RPM: fix buildtags
  * [release-1.31] Bump to v1.31.3-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1695816000">- Update to version 1.32.0:
  * Tag v1.32.0
  * GetTmpDir is not using ImageCopyTmpdir correctly
  * Run codespell on code
  * Bump vendor containers/(common, storage, image)
  * Cirrus: Remove multi-arch buildah image builds
  * fix(deps): update module github.com/containerd/containerd to v1.7.6
  * Split GetTempDir from internal/util
  * Move most of internal/parse to internal/volumes
  * copier: remove libimage dependency via util package
  * Add some docs for `build --cw`, `commit --cw`, and `mkcw`
  * Add `buildah mkcw`, add `--cw` to `buildah commit` and `buildah build`
  * Make sure that pathnames picked up from the environment are absolute
  * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4
  * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible
  * Don't try to look up names when committing images
  * fix(deps): update module golang.org/x/crypto to v0.13.0
  * docs: use valid github repo
  * fix(deps): update module golang.org/x/sys to v0.12.0
  * vendor containers/common@12405381ff45
  * push: --force-compression should be true with --compression-format
  * Update module github.com/containerd/containerd to v1.7.5
  * [skip-ci] Update tim-actions/commit-message-checker-with-regex action to v0.3.2
  * docs: add reference to oci-hooks
  * Support passing of ULimits as -1 to mean max
  * GHA: Attempt to fix discussion_lock workflow
  * Fixing the owner of the storage.conf.
  * pkg/chrootuser: Ignore comments when parsing /etc/group on FreeBSD
  * Use buildah repo rather then podman repo
  * GHA: Closed issue/PR comment-lock test
  * fix(deps): update module github.com/containers/storage to v1.49.0
  * chore(deps): update dependency containers/automation_images to v20230816
  * Replace troff code with markdown in buildah-{copy,add}.1.md
  * [CI:BUILD] rpm: spdx compatible license field
  * executor: build-arg warnings must honor global args
  * fix(deps): update module github.com/containers/ocicrypt to v1.1.8
  * chroot: `setSeccomp` add support for `ArchPARISC(64)` and `ArchRISCV64`
  * make,cross: restore loong64
  * Clear CommonBuildOpts when loading Builder status
  * buildah/push/manifest-push: add support for --force-compression
  * vendor: bump c/common to v0.55.1-0.20230811093040-524b4d5c12f9
  * chore(deps): update dependency containers/automation_images to v20230809
  * [CI:BUILD] RPM: fix buildtags
  * fix(deps): update module github.com/opencontainers/runc to v1.1.9
  * chore(deps): update dependency ubuntu to v22
  * chore(deps): update dependency containers/automation_images to v20230807
  * [CI:BUILD] Packit: add fedora-eln targets
  * [CI:BUILD] RPM: build docs with vendored go-md2man
  * packit: Build PRs into default packit COPRs
  * Update install.md
  * Update install.md changes current Debian stable version name
  * fix(deps): update module golang.org/x/term to v0.11.0
  * fix(deps): update module golang.org/x/crypto to v0.12.0
  * tests: fix layer-label tests
  * buildah: add --layer-label for setting labels on layers
  * Cirrus: container/rootless env. var. passthrough
  * Cirrus: Remove duplicate env. var. definitions
  * fix(deps): update github.com/containers/storage digest to c3da76f
  * Add a missing .Close() call on an ImageSource
  * Create only a reference when that's all we need
  * Add a missing .Close() call on an ImageDestination
  * CI:BUILD] RPM: define gobuild macro for rhel/centos stream
  * manifest/push: add support for --add-compression
  * manifest/inspect: add support for tls-verify and authfile
  * vendor: bump c/common to v0.55.1-0.20230727095721-647ed1d4d79a
  * vendor: bump c/image to v5.26.1-0.20230726142307-8c387a14f4ac
  * fix(deps): update module github.com/containerd/containerd to v1.7.3
  * fix(deps): update module github.com/onsi/gomega to v1.27.10
  * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible
  * fix(deps): update module github.com/containers/image/v5 to v5.26.1
  * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0
  * Update vendor of containers/(storage,image,common)
  * fix(deps): update module github.com/opencontainers/runc to v1.1.8
  * [CI:BUILD] Packit: remove pre-sync action
  * fix(deps): update module github.com/containers/common to v0.55.2
  * [CI:BUILD] Packit: downstream task script needs GOPATH
  * Vendor in containers/(common, image, storage)
  * fix(deps): update module golang.org/x/term to v0.10.0
  * [CI:BUILD] Packit: fix pre-sync action for downstream tasks
  * contrib/buildahimage: set config correctly for rootless build user
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4
  * Bump to v1.32.0-dev
  * Update debian install instructions
  * pkg/overlay: add limited support for FreeBSD</changelog>
  <changelog author="dcermak@suse.com" date="1696593600">- Bump BuildRequired golang version to &gt;= 1.21, fixes bsc#1216005</changelog>
  <changelog author="dcermak@suse.com" date="1698148800">- Update to version 1.32.1:
  * tag v1.32.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * .cirrus.yml: run tests relative to the release-1.32 branch</changelog>
  <changelog author="dcermak@suse.com" date="1698840000">- Update to version 1.32.2:
  * Mask /sys/devices/virtual/powercap by default
  * tag v1.32.2</changelog>
  <changelog author="dcermak@suse.com" date="1700481600">- Add patch:
  * 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch (fixes
    builds on non x86_64)
- Update to version 1.33.1:
  * Bump to v1.33.1
  * Bump to v1.31.2-dev
  * Bump to v1.31.1
  * fix(deps): update module github.com/moby/buildkit to v0.11.4 [security]
  * test,heredoc: use fedora instead of docker.io/library/python:latest
  * Bump to v1.33.1-dev
  * Bump to v1.33.0
  * Never omit layers for emptyLayer instructions when squashing/cwing
  * Add OverrideChanges and OverrideConfig to CommitOptions
  * buildah: add heredoc support for RUN, COPY and ADD
  * vendor: bump imagebuilder to v1.2.6-0.20231110114814-35a50d57f722
  * conformance tests: archive the context directory as 0:0 (#5171)
  * blobcacheinfo,test: blobs must be resued when pushing across registry
  * Bump c/storage v1.51.0, c/image v5.29.0, c/common v0.57.0
  * pkg/util.MirrorToTempFileIfPathIsDescriptor(): don't leak an fd
  * StageExecutor.Execute: force a commit for --unsetenv, too
  * Increase a copier+chroot test timeout
  * Add support for --compat-auth-file in login/logout
  * Update existing tests for error message change
  * Update c/image and c/common to latest
  * fix(deps): update module github.com/containerd/containerd to v1.7.9
  * build: downgrade to go 1.20
  * Add godoc for pkg/parse.GetTempDir
  * conformance tests: use go-dockerclient for BuildKit builds
  * Make TEE types case-insensitive
  * fix(deps): update module golang.org/x/crypto to v0.15.0
  * Tweak some help descriptions
  * Stop using DefaultNetworkSysctl and use containers.conf only
  * Implement ADD checksum flag #5135
  * vendor of openshift/imagebuilder #5135
  * Pass secrets from the host down to internal podman containers
  * Update cirrus and version of golang
  * image: replace GetStoreImage with ResolveReference
  * vendor: bump c/image to 373c52a9466f
  * pkg/parse.Platform(): minor simplification
  * createConfigsAndManifests: clear history before cw-specific logic
  * Use a constant definition instead of "scratch"
  * conformance: use require.NoErrorf() more
  * fix(deps): update module golang.org/x/term to v0.14.0
  * fix(deps): update module golang.org/x/sync to v0.5.0
  * fix(deps): update module github.com/spf13/cobra to v1.8.0
  * fix(deps): update module golang.org/x/sys to v0.14.0
  * fix(deps): update github.com/containers/common digest to 8354404
  * fix(deps): update module github.com/opencontainers/runc to v1.1.10
  * fix(deps): update github.com/containers/luksy digest to b5a7f79
  * Log the platform for build errors during multi-platform builds
  * Use mask definitions from containers/common
  * Vendor in latest containers/common
  * fix(deps): update module github.com/containerd/containerd to v1.7.8
  * fix(deps): update module go.etcd.io/bbolt to v1.3.8
  * container.conf: support attributed string slices
  * fix(deps): update module sigs.k8s.io/yaml to v1.4.0
  * Use cutil.StringInSlice rather then contains
  * Add --no-hostname option to buildah containers
  * vendor c/common: appendable containers.conf strings, Part 1
  * fix(deps): update module github.com/onsi/gomega to v1.28.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * chore(deps): update dependency containers/automation_images to v20231004
  * Vendor containers/common
  * chore(deps): update module golang.org/x/net to v0.17.0 [security]
  * run: use internal.GetTempDir with os.MkdirTemp
  * fix(deps): update module github.com/containerd/containerd to v1.7.7
  * imagebuildah,multi-stage: do not remove base images
  * gitignore: add mkcw binary
  * mkcw: remove entrypoint binaries
  * fix(deps): update module golang.org/x/crypto to v0.14.0
  * fix(deps): update module golang.org/x/sys to v0.13.0
  * fix(deps): update module golang.org/x/sync to v0.4.0
  * Update some comments related to confidential workload
  * Use the parent's image ID in the config that we pass to imagebuilder
  * fix(deps): update github.com/containers/common digest to 8892536
  * fix(deps): update github.com/containers/luksy digest to 6df88cb
  * bug: Ensure the mount type is always BindMount by default
  * Protocol can be specified with --port. Ex. --port 514/udp
  * fix(deps): update module github.com/onsi/gomega to v1.28.0
  * build,config: add support for --unsetlabel
  * tests/bud: add tests
  * [CI:BUILD] Packit: tag @containers/packit-build on copr build failures
  * stage_executor: allow images without layers
  * vendor of containers/common
  * Removing selinux_tag.sh as no longer needed after 580356f [NO NEW TESTS NEEDED]
  * add/copy: make sure we handle relative path names correctly
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5
  * Bump to v1.33.0-dev
  * imagebuildah: consider ignorefile with --build-context</changelog>
  <changelog author="dcermak@suse.com" date="1701086400">- Update to version 1.33.2:
  * [release-1.33.2] Bump to v1.33.2
  * Update minimum to golang 1.20
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.0
  * fix(deps): update module github.com/moby/buildkit to v0.12.3
  * Bump to v1.33.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1702555200">- Drop 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch
  (merged upstream; https://github.com/containers/buildah/pull/5183)
- Update to version 1.34.0:
  * Bump to v1.34.0
  * fix(deps): update module github.com/containerd/containerd to v1.7.11
  * fix(deps): update github.com/containers/storage digest to 15c3cb7
  * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.2
  * fix(deps): update github.com/containers/common digest to 630c929
  * fix(deps): update module github.com/moby/buildkit to v0.12.4
  * fix(deps): update github.com/openshift/imagebuilder digest to ef2a5fe
  * [CI:DOCS] man pages: underscores, too-wide lines
  * fix(deps): update module github.com/containerd/containerd to v1.7.10
  * run.bats: use --quiet --pull=false when using a prefetched image
  * internal/mkcw/embed/entrypoint.gz: rename to include the arch
  * internal/mkcw/embed/entrypoint.gz: compress with -n9
  * fix(deps): update module golang.org/x/crypto to v0.16.0
  * Integration tests: make skip_if_no_unshare check --map-users
  * fix(deps): update module golang.org/x/term to v0.15.0
  * fix(deps): update module golang.org/x/sys to v0.15.0
  * fix(deps): update module github.com/onsi/ginkgo to v2
  * vendor: update c/{common,image,storage}
  * run: Allow using just one jail per container on FreeBSD
  * Remove makefile targets entrypoint{,.gz} for non x86_64</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1708689600">- Update to version 1.34.1:
  * [release-1.34] Bump to v1.34.1
  * [release-1.34] Vendor bumps (fixes bsc#1219563)
  * manifest: addCompression use default from containers.conf
  * Build with CNI support on FreeBSD
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * docs: correct default authfile path
  * Make buildah match podman for handling of ulimits
  * imagebuildah: fix crash with empty RUN
  * docs: move footnotes to where they're applicable
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Allow users to specify no-dereference
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * Replace strings.SplitN with strings.Cut
  * Document use of containers-transports values in buildah
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * Ignore errors if label.Relabel returns ENOSUP
  * manifest: addCompression use default from containers.conf</changelog>
  <changelog author="danish.prakash@suse.com" date="1709121600">- Require cni-plugins (bsc#1220568)</changelog>
  <changelog author="dcermak@suse.com" date="1709812800">- Update to version 1.35.0:
  * Bump v1.35.0
  * Bump c/common v0.58.0, c/image v5.30.0, c/storage v1.53.0
  * conformance tests: don't break on trailing zeroes in layer blobs
  * Add a conformance test for copying to a mounted prior stage
  * fix(deps): update module github.com/stretchr/testify to v1.9.0
  * cgroups: reuse version check from c/common
  * Update vendor of containers/(common,image)
  * fix(deps): update github.com/containers/storage digest to eadc620
  * fix(deps): update github.com/containers/luksy digest to ceb12d4
  * fix(deps): update github.com/containers/image/v5 digest to cdc6802
  * manifest add: complain if we get artifact flags without --artifact
  * Use retry logic from containers/common
  * Vendor in containers/(storage,image,common)
  * Update module golang.org/x/crypto to v0.20.0
  * Add comment re: Total Success task name
  * tests: skip_if_no_unshare(): check for --setuid
  * Properly handle build --pull=false
  * [skip-ci] Update tim-actions/get-pr-commits action to v1.3.1
  * Update module go.etcd.io/bbolt to v1.3.9
  * Revert "Reduce official image size"
  * Update module github.com/opencontainers/image-spec to v1.1.0
  * Reduce official image size
  * Build with CNI support on FreeBSD
  * build --all-platforms: skip some base "image" platforms
  * Bump main to v1.35.0-dev
  * Vendor in latest containers/(storage,image,common)
  * Split up error messages for missing --sbom related flags
  * `buildah manifest`: add artifact-related options
  * cmd/buildah/manifest.go: lock lists before adding/annotating/pushing
  * cmd/buildah/manifest.go: don't make struct declarations aliases
  * Use golang.org/x/exp/slices.Contains
  * Disable loong64 again
  * Fix a couple of typos in one-line comments
  * egrep is obsolescent; use grep -E
  * Try Cirrus with a newer VM version
  * Set CONTAINERS_CONF in the chroot-mount-flags integration test
  * Update to match dependency API update
  * Update github.com/openshift/imagebuilder and containers/common
  * docs: correct default authfile path
  * fix(deps): update module github.com/containerd/containerd to v1.7.13
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * manifest, push: add support for --retry and --retry-delay
  * fix(deps): update github.com/openshift/imagebuilder digest to b767bc3
  * imagebuildah: fix crash with empty RUN
  * fix(deps): update github.com/containers/luksy digest to b62d551
  * fix(deps): update module github.com/opencontainers/runc to v1.1.12 [security]
  * fix(deps): update module github.com/moby/buildkit to v0.12.5 [security]
  * Make buildah match podman for handling of ulimits
  * docs: move footnotes to where they're applicable
  * Allow users to specify no-dereference
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * fix(deps): update module github.com/onsi/gomega to v1.31.1
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc6
  * docs: use reversed logo for dark theme in README
  * build,commit: add --sbom to scan and produce SBOMs when committing
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * internal/mkcw.Archive(): handle extra image content
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * fix(deps): update module golang.org/x/crypto to v0.18.0
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * fix(deps): update module golang.org/x/sync to v0.6.0
  * fix(deps): update module golang.org/x/term to v0.16.0
  * Bump CI VMs
  * Replace strings.SplitN with strings.Cut
  * fix(deps): update github.com/containers/storage digest to ef81e9b
  * fix(deps): update github.com/containers/image/v5 digest to 1b221d4
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.1
  * Document use of containers-transports values in buildah
  * fix(deps): update module golang.org/x/crypto to v0.17.0 [security]
  * chore(deps): update dependency containers/automation_images to v20231208
  * manifest: addCompression use default from containers.conf
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * chore(deps): update dependency containers/automation_images to v20230517
  * [skip-ci] Update actions/stale action to v9
  * fix(deps): update module github.com/containernetworking/plugins to v1.4.0
  * fix(deps): update github.com/containers/image/v5 digest to 7a40fee
  * Bump to v1.34.1-dev
  * Ignore errors if label.Relabel returns ENOSUP</changelog>
  <changelog author="danish.prakash@suse.com" date="1710417600">- Require passt for rootless networking (poo#156955)
  Buildah moved to passt/pasta for rootless networking from slirp4netns
  (https://github.com/containers/common/pull/1846)</changelog>
  <changelog author="dcermak@suse.com" date="1710417601">- Remove obsolete requires libcontainers-image &amp; libcontainers-storage</changelog>
  <changelog author="dcermak@suse.com" date="1710763200">- Buildah dropped cni support, require netavark instead (boo#1221243)</changelog>
  <changelog author="dcermak@suse.com" date="1710849600">- Update to version 1.35.1:
  * [release-1.35] Bump to v1.35.1
  * [release-1.35] CVE-2024-1753 container escape fix (bsc#1221677)
- Remove upstreamed patches:
  - 0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1710849601">- Add patch for CVE-2024-1753 / bsc#1221677:
  0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1712059200">- Update to version 1.35.3:
  * [release-1.35] Bump to Buildah v1.35.3
  * [release-1.35] correctly configure /etc/hosts and resolv.conf
  * [release-1.35] buildah: refactor resolv/hosts setup.
  * [release-1.35] rename the hostFile var to reflect
  * [release-1.35] Bump c/common to v0.58.1
  * [release-1.35] Bump Buildah to v1.35.2
  * [release-1.35] CVE-2024-24786 protobuf to 1.33
  * [release-1.35] Bump to v1.35.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1715342400">- Update to version 1.35.4:
  * [release-1.35] Bump to Buildah v1.35.4
  * [release-1.35] CVE-2024-3727 updates (bsc#1224117)
  * integration test: handle new labels in "bud and test --unsetlabel"
  * [release-1.35] Bump go-jose CVE-2024-28180
  * [release-1.35] Bump ocicrypt and go-jose CVE-2024-28180</changelog>
</package>
<package pkgid="0731f7656a6bad43c53ed87974f06ad12bbdaac7a7bf620aa393fee865151ae0" name="buildah" arch="src">
  <version epoch="0" ver="1.35.4" rel="150500.3.10.1"/>
  <changelog author="danish.prakash@suse.com" date="1691755200">- Update to version 1.31.2:
  * [release-1.31] Bump to v1.31.2
  * [release-1.31] Bump to v1.31.2-dev
  * [release-1.31] Bump to v1.31.1
  * [release-1.31] Remove zstd:chunked from man, bump c/common to v0.55.3
  * [CI:BUILD] Packit: add fedora-eln targets
  * [CI:BUILD] RPM: build docs with vendored go-md2man
  * packit: Build PRs into default packit COPRs
  * [CI:BUILD] Packit: remove pre-sync action
  * CI:BUILD] RPM: define gobuild macro for rhel/centos stream</changelog>
  <changelog author="danish.prakash@suse.com" date="1694606400">- Update to version 1.31.3:
  * [release-1.31] Bump to v1.31.3
  * [release-1.31] Bump c/common 0.55.4, c/image 5.26.2, c/storage 1.48.1
  * rpm: spdx compatible license field
  * RPM: fix buildtags
  * [release-1.31] Bump to v1.31.3-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1695816000">- Update to version 1.32.0:
  * Tag v1.32.0
  * GetTmpDir is not using ImageCopyTmpdir correctly
  * Run codespell on code
  * Bump vendor containers/(common, storage, image)
  * Cirrus: Remove multi-arch buildah image builds
  * fix(deps): update module github.com/containerd/containerd to v1.7.6
  * Split GetTempDir from internal/util
  * Move most of internal/parse to internal/volumes
  * copier: remove libimage dependency via util package
  * Add some docs for `build --cw`, `commit --cw`, and `mkcw`
  * Add `buildah mkcw`, add `--cw` to `buildah commit` and `buildah build`
  * Make sure that pathnames picked up from the environment are absolute
  * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4
  * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible
  * Don't try to look up names when committing images
  * fix(deps): update module golang.org/x/crypto to v0.13.0
  * docs: use valid github repo
  * fix(deps): update module golang.org/x/sys to v0.12.0
  * vendor containers/common@12405381ff45
  * push: --force-compression should be true with --compression-format
  * Update module github.com/containerd/containerd to v1.7.5
  * [skip-ci] Update tim-actions/commit-message-checker-with-regex action to v0.3.2
  * docs: add reference to oci-hooks
  * Support passing of ULimits as -1 to mean max
  * GHA: Attempt to fix discussion_lock workflow
  * Fixing the owner of the storage.conf.
  * pkg/chrootuser: Ignore comments when parsing /etc/group on FreeBSD
  * Use buildah repo rather then podman repo
  * GHA: Closed issue/PR comment-lock test
  * fix(deps): update module github.com/containers/storage to v1.49.0
  * chore(deps): update dependency containers/automation_images to v20230816
  * Replace troff code with markdown in buildah-{copy,add}.1.md
  * [CI:BUILD] rpm: spdx compatible license field
  * executor: build-arg warnings must honor global args
  * fix(deps): update module github.com/containers/ocicrypt to v1.1.8
  * chroot: `setSeccomp` add support for `ArchPARISC(64)` and `ArchRISCV64`
  * make,cross: restore loong64
  * Clear CommonBuildOpts when loading Builder status
  * buildah/push/manifest-push: add support for --force-compression
  * vendor: bump c/common to v0.55.1-0.20230811093040-524b4d5c12f9
  * chore(deps): update dependency containers/automation_images to v20230809
  * [CI:BUILD] RPM: fix buildtags
  * fix(deps): update module github.com/opencontainers/runc to v1.1.9
  * chore(deps): update dependency ubuntu to v22
  * chore(deps): update dependency containers/automation_images to v20230807
  * [CI:BUILD] Packit: add fedora-eln targets
  * [CI:BUILD] RPM: build docs with vendored go-md2man
  * packit: Build PRs into default packit COPRs
  * Update install.md
  * Update install.md changes current Debian stable version name
  * fix(deps): update module golang.org/x/term to v0.11.0
  * fix(deps): update module golang.org/x/crypto to v0.12.0
  * tests: fix layer-label tests
  * buildah: add --layer-label for setting labels on layers
  * Cirrus: container/rootless env. var. passthrough
  * Cirrus: Remove duplicate env. var. definitions
  * fix(deps): update github.com/containers/storage digest to c3da76f
  * Add a missing .Close() call on an ImageSource
  * Create only a reference when that's all we need
  * Add a missing .Close() call on an ImageDestination
  * CI:BUILD] RPM: define gobuild macro for rhel/centos stream
  * manifest/push: add support for --add-compression
  * manifest/inspect: add support for tls-verify and authfile
  * vendor: bump c/common to v0.55.1-0.20230727095721-647ed1d4d79a
  * vendor: bump c/image to v5.26.1-0.20230726142307-8c387a14f4ac
  * fix(deps): update module github.com/containerd/containerd to v1.7.3
  * fix(deps): update module github.com/onsi/gomega to v1.27.10
  * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible
  * fix(deps): update module github.com/containers/image/v5 to v5.26.1
  * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0
  * Update vendor of containers/(storage,image,common)
  * fix(deps): update module github.com/opencontainers/runc to v1.1.8
  * [CI:BUILD] Packit: remove pre-sync action
  * fix(deps): update module github.com/containers/common to v0.55.2
  * [CI:BUILD] Packit: downstream task script needs GOPATH
  * Vendor in containers/(common, image, storage)
  * fix(deps): update module golang.org/x/term to v0.10.0
  * [CI:BUILD] Packit: fix pre-sync action for downstream tasks
  * contrib/buildahimage: set config correctly for rootless build user
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4
  * Bump to v1.32.0-dev
  * Update debian install instructions
  * pkg/overlay: add limited support for FreeBSD</changelog>
  <changelog author="dcermak@suse.com" date="1696593600">- Bump BuildRequired golang version to &gt;= 1.21, fixes bsc#1216005</changelog>
  <changelog author="dcermak@suse.com" date="1698148800">- Update to version 1.32.1:
  * tag v1.32.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * .cirrus.yml: run tests relative to the release-1.32 branch</changelog>
  <changelog author="dcermak@suse.com" date="1698840000">- Update to version 1.32.2:
  * Mask /sys/devices/virtual/powercap by default
  * tag v1.32.2</changelog>
  <changelog author="dcermak@suse.com" date="1700481600">- Add patch:
  * 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch (fixes
    builds on non x86_64)
- Update to version 1.33.1:
  * Bump to v1.33.1
  * Bump to v1.31.2-dev
  * Bump to v1.31.1
  * fix(deps): update module github.com/moby/buildkit to v0.11.4 [security]
  * test,heredoc: use fedora instead of docker.io/library/python:latest
  * Bump to v1.33.1-dev
  * Bump to v1.33.0
  * Never omit layers for emptyLayer instructions when squashing/cwing
  * Add OverrideChanges and OverrideConfig to CommitOptions
  * buildah: add heredoc support for RUN, COPY and ADD
  * vendor: bump imagebuilder to v1.2.6-0.20231110114814-35a50d57f722
  * conformance tests: archive the context directory as 0:0 (#5171)
  * blobcacheinfo,test: blobs must be resued when pushing across registry
  * Bump c/storage v1.51.0, c/image v5.29.0, c/common v0.57.0
  * pkg/util.MirrorToTempFileIfPathIsDescriptor(): don't leak an fd
  * StageExecutor.Execute: force a commit for --unsetenv, too
  * Increase a copier+chroot test timeout
  * Add support for --compat-auth-file in login/logout
  * Update existing tests for error message change
  * Update c/image and c/common to latest
  * fix(deps): update module github.com/containerd/containerd to v1.7.9
  * build: downgrade to go 1.20
  * Add godoc for pkg/parse.GetTempDir
  * conformance tests: use go-dockerclient for BuildKit builds
  * Make TEE types case-insensitive
  * fix(deps): update module golang.org/x/crypto to v0.15.0
  * Tweak some help descriptions
  * Stop using DefaultNetworkSysctl and use containers.conf only
  * Implement ADD checksum flag #5135
  * vendor of openshift/imagebuilder #5135
  * Pass secrets from the host down to internal podman containers
  * Update cirrus and version of golang
  * image: replace GetStoreImage with ResolveReference
  * vendor: bump c/image to 373c52a9466f
  * pkg/parse.Platform(): minor simplification
  * createConfigsAndManifests: clear history before cw-specific logic
  * Use a constant definition instead of "scratch"
  * conformance: use require.NoErrorf() more
  * fix(deps): update module golang.org/x/term to v0.14.0
  * fix(deps): update module golang.org/x/sync to v0.5.0
  * fix(deps): update module github.com/spf13/cobra to v1.8.0
  * fix(deps): update module golang.org/x/sys to v0.14.0
  * fix(deps): update github.com/containers/common digest to 8354404
  * fix(deps): update module github.com/opencontainers/runc to v1.1.10
  * fix(deps): update github.com/containers/luksy digest to b5a7f79
  * Log the platform for build errors during multi-platform builds
  * Use mask definitions from containers/common
  * Vendor in latest containers/common
  * fix(deps): update module github.com/containerd/containerd to v1.7.8
  * fix(deps): update module go.etcd.io/bbolt to v1.3.8
  * container.conf: support attributed string slices
  * fix(deps): update module sigs.k8s.io/yaml to v1.4.0
  * Use cutil.StringInSlice rather then contains
  * Add --no-hostname option to buildah containers
  * vendor c/common: appendable containers.conf strings, Part 1
  * fix(deps): update module github.com/onsi/gomega to v1.28.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * chore(deps): update dependency containers/automation_images to v20231004
  * Vendor containers/common
  * chore(deps): update module golang.org/x/net to v0.17.0 [security]
  * run: use internal.GetTempDir with os.MkdirTemp
  * fix(deps): update module github.com/containerd/containerd to v1.7.7
  * imagebuildah,multi-stage: do not remove base images
  * gitignore: add mkcw binary
  * mkcw: remove entrypoint binaries
  * fix(deps): update module golang.org/x/crypto to v0.14.0
  * fix(deps): update module golang.org/x/sys to v0.13.0
  * fix(deps): update module golang.org/x/sync to v0.4.0
  * Update some comments related to confidential workload
  * Use the parent's image ID in the config that we pass to imagebuilder
  * fix(deps): update github.com/containers/common digest to 8892536
  * fix(deps): update github.com/containers/luksy digest to 6df88cb
  * bug: Ensure the mount type is always BindMount by default
  * Protocol can be specified with --port. Ex. --port 514/udp
  * fix(deps): update module github.com/onsi/gomega to v1.28.0
  * build,config: add support for --unsetlabel
  * tests/bud: add tests
  * [CI:BUILD] Packit: tag @containers/packit-build on copr build failures
  * stage_executor: allow images without layers
  * vendor of containers/common
  * Removing selinux_tag.sh as no longer needed after 580356f [NO NEW TESTS NEEDED]
  * add/copy: make sure we handle relative path names correctly
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5
  * Bump to v1.33.0-dev
  * imagebuildah: consider ignorefile with --build-context</changelog>
  <changelog author="dcermak@suse.com" date="1701086400">- Update to version 1.33.2:
  * [release-1.33.2] Bump to v1.33.2
  * Update minimum to golang 1.20
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.0
  * fix(deps): update module github.com/moby/buildkit to v0.12.3
  * Bump to v1.33.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1702555200">- Drop 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch
  (merged upstream; https://github.com/containers/buildah/pull/5183)
- Update to version 1.34.0:
  * Bump to v1.34.0
  * fix(deps): update module github.com/containerd/containerd to v1.7.11
  * fix(deps): update github.com/containers/storage digest to 15c3cb7
  * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.2
  * fix(deps): update github.com/containers/common digest to 630c929
  * fix(deps): update module github.com/moby/buildkit to v0.12.4
  * fix(deps): update github.com/openshift/imagebuilder digest to ef2a5fe
  * [CI:DOCS] man pages: underscores, too-wide lines
  * fix(deps): update module github.com/containerd/containerd to v1.7.10
  * run.bats: use --quiet --pull=false when using a prefetched image
  * internal/mkcw/embed/entrypoint.gz: rename to include the arch
  * internal/mkcw/embed/entrypoint.gz: compress with -n9
  * fix(deps): update module golang.org/x/crypto to v0.16.0
  * Integration tests: make skip_if_no_unshare check --map-users
  * fix(deps): update module golang.org/x/term to v0.15.0
  * fix(deps): update module golang.org/x/sys to v0.15.0
  * fix(deps): update module github.com/onsi/ginkgo to v2
  * vendor: update c/{common,image,storage}
  * run: Allow using just one jail per container on FreeBSD
  * Remove makefile targets entrypoint{,.gz} for non x86_64</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1708689600">- Update to version 1.34.1:
  * [release-1.34] Bump to v1.34.1
  * [release-1.34] Vendor bumps (fixes bsc#1219563)
  * manifest: addCompression use default from containers.conf
  * Build with CNI support on FreeBSD
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * docs: correct default authfile path
  * Make buildah match podman for handling of ulimits
  * imagebuildah: fix crash with empty RUN
  * docs: move footnotes to where they're applicable
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Allow users to specify no-dereference
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * Replace strings.SplitN with strings.Cut
  * Document use of containers-transports values in buildah
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * Ignore errors if label.Relabel returns ENOSUP
  * manifest: addCompression use default from containers.conf</changelog>
  <changelog author="danish.prakash@suse.com" date="1709121600">- Require cni-plugins (bsc#1220568)</changelog>
  <changelog author="dcermak@suse.com" date="1709812800">- Update to version 1.35.0:
  * Bump v1.35.0
  * Bump c/common v0.58.0, c/image v5.30.0, c/storage v1.53.0
  * conformance tests: don't break on trailing zeroes in layer blobs
  * Add a conformance test for copying to a mounted prior stage
  * fix(deps): update module github.com/stretchr/testify to v1.9.0
  * cgroups: reuse version check from c/common
  * Update vendor of containers/(common,image)
  * fix(deps): update github.com/containers/storage digest to eadc620
  * fix(deps): update github.com/containers/luksy digest to ceb12d4
  * fix(deps): update github.com/containers/image/v5 digest to cdc6802
  * manifest add: complain if we get artifact flags without --artifact
  * Use retry logic from containers/common
  * Vendor in containers/(storage,image,common)
  * Update module golang.org/x/crypto to v0.20.0
  * Add comment re: Total Success task name
  * tests: skip_if_no_unshare(): check for --setuid
  * Properly handle build --pull=false
  * [skip-ci] Update tim-actions/get-pr-commits action to v1.3.1
  * Update module go.etcd.io/bbolt to v1.3.9
  * Revert "Reduce official image size"
  * Update module github.com/opencontainers/image-spec to v1.1.0
  * Reduce official image size
  * Build with CNI support on FreeBSD
  * build --all-platforms: skip some base "image" platforms
  * Bump main to v1.35.0-dev
  * Vendor in latest containers/(storage,image,common)
  * Split up error messages for missing --sbom related flags
  * `buildah manifest`: add artifact-related options
  * cmd/buildah/manifest.go: lock lists before adding/annotating/pushing
  * cmd/buildah/manifest.go: don't make struct declarations aliases
  * Use golang.org/x/exp/slices.Contains
  * Disable loong64 again
  * Fix a couple of typos in one-line comments
  * egrep is obsolescent; use grep -E
  * Try Cirrus with a newer VM version
  * Set CONTAINERS_CONF in the chroot-mount-flags integration test
  * Update to match dependency API update
  * Update github.com/openshift/imagebuilder and containers/common
  * docs: correct default authfile path
  * fix(deps): update module github.com/containerd/containerd to v1.7.13
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * manifest, push: add support for --retry and --retry-delay
  * fix(deps): update github.com/openshift/imagebuilder digest to b767bc3
  * imagebuildah: fix crash with empty RUN
  * fix(deps): update github.com/containers/luksy digest to b62d551
  * fix(deps): update module github.com/opencontainers/runc to v1.1.12 [security]
  * fix(deps): update module github.com/moby/buildkit to v0.12.5 [security]
  * Make buildah match podman for handling of ulimits
  * docs: move footnotes to where they're applicable
  * Allow users to specify no-dereference
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * fix(deps): update module github.com/onsi/gomega to v1.31.1
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc6
  * docs: use reversed logo for dark theme in README
  * build,commit: add --sbom to scan and produce SBOMs when committing
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * internal/mkcw.Archive(): handle extra image content
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * fix(deps): update module golang.org/x/crypto to v0.18.0
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * fix(deps): update module golang.org/x/sync to v0.6.0
  * fix(deps): update module golang.org/x/term to v0.16.0
  * Bump CI VMs
  * Replace strings.SplitN with strings.Cut
  * fix(deps): update github.com/containers/storage digest to ef81e9b
  * fix(deps): update github.com/containers/image/v5 digest to 1b221d4
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.1
  * Document use of containers-transports values in buildah
  * fix(deps): update module golang.org/x/crypto to v0.17.0 [security]
  * chore(deps): update dependency containers/automation_images to v20231208
  * manifest: addCompression use default from containers.conf
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * chore(deps): update dependency containers/automation_images to v20230517
  * [skip-ci] Update actions/stale action to v9
  * fix(deps): update module github.com/containernetworking/plugins to v1.4.0
  * fix(deps): update github.com/containers/image/v5 digest to 7a40fee
  * Bump to v1.34.1-dev
  * Ignore errors if label.Relabel returns ENOSUP</changelog>
  <changelog author="danish.prakash@suse.com" date="1710417600">- Require passt for rootless networking (poo#156955)
  Buildah moved to passt/pasta for rootless networking from slirp4netns
  (https://github.com/containers/common/pull/1846)</changelog>
  <changelog author="dcermak@suse.com" date="1710417601">- Remove obsolete requires libcontainers-image &amp; libcontainers-storage</changelog>
  <changelog author="dcermak@suse.com" date="1710763200">- Buildah dropped cni support, require netavark instead (boo#1221243)</changelog>
  <changelog author="dcermak@suse.com" date="1710849600">- Update to version 1.35.1:
  * [release-1.35] Bump to v1.35.1
  * [release-1.35] CVE-2024-1753 container escape fix (bsc#1221677)
- Remove upstreamed patches:
  - 0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1710849601">- Add patch for CVE-2024-1753 / bsc#1221677:
  0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1712059200">- Update to version 1.35.3:
  * [release-1.35] Bump to Buildah v1.35.3
  * [release-1.35] correctly configure /etc/hosts and resolv.conf
  * [release-1.35] buildah: refactor resolv/hosts setup.
  * [release-1.35] rename the hostFile var to reflect
  * [release-1.35] Bump c/common to v0.58.1
  * [release-1.35] Bump Buildah to v1.35.2
  * [release-1.35] CVE-2024-24786 protobuf to 1.33
  * [release-1.35] Bump to v1.35.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1715342400">- Update to version 1.35.4:
  * [release-1.35] Bump to Buildah v1.35.4
  * [release-1.35] CVE-2024-3727 updates (bsc#1224117)
  * integration test: handle new labels in "bud and test --unsetlabel"
  * [release-1.35] Bump go-jose CVE-2024-28180
  * [release-1.35] Bump ocicrypt and go-jose CVE-2024-28180</changelog>
</package>
<package pkgid="4e3131a78244c771bab165885542708af7e509a4652ce153187f5d2eeb3bc0af" name="buildah" arch="x86_64">
  <version epoch="0" ver="1.35.4" rel="150500.3.10.1"/>
  <changelog author="danish.prakash@suse.com" date="1691755200">- Update to version 1.31.2:
  * [release-1.31] Bump to v1.31.2
  * [release-1.31] Bump to v1.31.2-dev
  * [release-1.31] Bump to v1.31.1
  * [release-1.31] Remove zstd:chunked from man, bump c/common to v0.55.3
  * [CI:BUILD] Packit: add fedora-eln targets
  * [CI:BUILD] RPM: build docs with vendored go-md2man
  * packit: Build PRs into default packit COPRs
  * [CI:BUILD] Packit: remove pre-sync action
  * CI:BUILD] RPM: define gobuild macro for rhel/centos stream</changelog>
  <changelog author="danish.prakash@suse.com" date="1694606400">- Update to version 1.31.3:
  * [release-1.31] Bump to v1.31.3
  * [release-1.31] Bump c/common 0.55.4, c/image 5.26.2, c/storage 1.48.1
  * rpm: spdx compatible license field
  * RPM: fix buildtags
  * [release-1.31] Bump to v1.31.3-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1695816000">- Update to version 1.32.0:
  * Tag v1.32.0
  * GetTmpDir is not using ImageCopyTmpdir correctly
  * Run codespell on code
  * Bump vendor containers/(common, storage, image)
  * Cirrus: Remove multi-arch buildah image builds
  * fix(deps): update module github.com/containerd/containerd to v1.7.6
  * Split GetTempDir from internal/util
  * Move most of internal/parse to internal/volumes
  * copier: remove libimage dependency via util package
  * Add some docs for `build --cw`, `commit --cw`, and `mkcw`
  * Add `buildah mkcw`, add `--cw` to `buildah commit` and `buildah build`
  * Make sure that pathnames picked up from the environment are absolute
  * fix(deps): update module github.com/cyphar/filepath-securejoin to v0.2.4
  * fix(deps): update module github.com/docker/docker to v24.0.6+incompatible
  * Don't try to look up names when committing images
  * fix(deps): update module golang.org/x/crypto to v0.13.0
  * docs: use valid github repo
  * fix(deps): update module golang.org/x/sys to v0.12.0
  * vendor containers/common@12405381ff45
  * push: --force-compression should be true with --compression-format
  * Update module github.com/containerd/containerd to v1.7.5
  * [skip-ci] Update tim-actions/commit-message-checker-with-regex action to v0.3.2
  * docs: add reference to oci-hooks
  * Support passing of ULimits as -1 to mean max
  * GHA: Attempt to fix discussion_lock workflow
  * Fixing the owner of the storage.conf.
  * pkg/chrootuser: Ignore comments when parsing /etc/group on FreeBSD
  * Use buildah repo rather then podman repo
  * GHA: Closed issue/PR comment-lock test
  * fix(deps): update module github.com/containers/storage to v1.49.0
  * chore(deps): update dependency containers/automation_images to v20230816
  * Replace troff code with markdown in buildah-{copy,add}.1.md
  * [CI:BUILD] rpm: spdx compatible license field
  * executor: build-arg warnings must honor global args
  * fix(deps): update module github.com/containers/ocicrypt to v1.1.8
  * chroot: `setSeccomp` add support for `ArchPARISC(64)` and `ArchRISCV64`
  * make,cross: restore loong64
  * Clear CommonBuildOpts when loading Builder status
  * buildah/push/manifest-push: add support for --force-compression
  * vendor: bump c/common to v0.55.1-0.20230811093040-524b4d5c12f9
  * chore(deps): update dependency containers/automation_images to v20230809
  * [CI:BUILD] RPM: fix buildtags
  * fix(deps): update module github.com/opencontainers/runc to v1.1.9
  * chore(deps): update dependency ubuntu to v22
  * chore(deps): update dependency containers/automation_images to v20230807
  * [CI:BUILD] Packit: add fedora-eln targets
  * [CI:BUILD] RPM: build docs with vendored go-md2man
  * packit: Build PRs into default packit COPRs
  * Update install.md
  * Update install.md changes current Debian stable version name
  * fix(deps): update module golang.org/x/term to v0.11.0
  * fix(deps): update module golang.org/x/crypto to v0.12.0
  * tests: fix layer-label tests
  * buildah: add --layer-label for setting labels on layers
  * Cirrus: container/rootless env. var. passthrough
  * Cirrus: Remove duplicate env. var. definitions
  * fix(deps): update github.com/containers/storage digest to c3da76f
  * Add a missing .Close() call on an ImageSource
  * Create only a reference when that's all we need
  * Add a missing .Close() call on an ImageDestination
  * CI:BUILD] RPM: define gobuild macro for rhel/centos stream
  * manifest/push: add support for --add-compression
  * manifest/inspect: add support for tls-verify and authfile
  * vendor: bump c/common to v0.55.1-0.20230727095721-647ed1d4d79a
  * vendor: bump c/image to v5.26.1-0.20230726142307-8c387a14f4ac
  * fix(deps): update module github.com/containerd/containerd to v1.7.3
  * fix(deps): update module github.com/onsi/gomega to v1.27.10
  * fix(deps): update module github.com/docker/docker to v24.0.5+incompatible
  * fix(deps): update module github.com/containers/image/v5 to v5.26.1
  * fix(deps): update module github.com/opencontainers/runtime-spec to v1.1.0
  * Update vendor of containers/(storage,image,common)
  * fix(deps): update module github.com/opencontainers/runc to v1.1.8
  * [CI:BUILD] Packit: remove pre-sync action
  * fix(deps): update module github.com/containers/common to v0.55.2
  * [CI:BUILD] Packit: downstream task script needs GOPATH
  * Vendor in containers/(common, image, storage)
  * fix(deps): update module golang.org/x/term to v0.10.0
  * [CI:BUILD] Packit: fix pre-sync action for downstream tasks
  * contrib/buildahimage: set config correctly for rootless build user
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc4
  * Bump to v1.32.0-dev
  * Update debian install instructions
  * pkg/overlay: add limited support for FreeBSD</changelog>
  <changelog author="dcermak@suse.com" date="1696593600">- Bump BuildRequired golang version to &gt;= 1.21, fixes bsc#1216005</changelog>
  <changelog author="dcermak@suse.com" date="1698148800">- Update to version 1.32.1:
  * tag v1.32.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * .cirrus.yml: run tests relative to the release-1.32 branch</changelog>
  <changelog author="dcermak@suse.com" date="1698840000">- Update to version 1.32.2:
  * Mask /sys/devices/virtual/powercap by default
  * tag v1.32.2</changelog>
  <changelog author="dcermak@suse.com" date="1700481600">- Add patch:
  * 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch (fixes
    builds on non x86_64)
- Update to version 1.33.1:
  * Bump to v1.33.1
  * Bump to v1.31.2-dev
  * Bump to v1.31.1
  * fix(deps): update module github.com/moby/buildkit to v0.11.4 [security]
  * test,heredoc: use fedora instead of docker.io/library/python:latest
  * Bump to v1.33.1-dev
  * Bump to v1.33.0
  * Never omit layers for emptyLayer instructions when squashing/cwing
  * Add OverrideChanges and OverrideConfig to CommitOptions
  * buildah: add heredoc support for RUN, COPY and ADD
  * vendor: bump imagebuilder to v1.2.6-0.20231110114814-35a50d57f722
  * conformance tests: archive the context directory as 0:0 (#5171)
  * blobcacheinfo,test: blobs must be resued when pushing across registry
  * Bump c/storage v1.51.0, c/image v5.29.0, c/common v0.57.0
  * pkg/util.MirrorToTempFileIfPathIsDescriptor(): don't leak an fd
  * StageExecutor.Execute: force a commit for --unsetenv, too
  * Increase a copier+chroot test timeout
  * Add support for --compat-auth-file in login/logout
  * Update existing tests for error message change
  * Update c/image and c/common to latest
  * fix(deps): update module github.com/containerd/containerd to v1.7.9
  * build: downgrade to go 1.20
  * Add godoc for pkg/parse.GetTempDir
  * conformance tests: use go-dockerclient for BuildKit builds
  * Make TEE types case-insensitive
  * fix(deps): update module golang.org/x/crypto to v0.15.0
  * Tweak some help descriptions
  * Stop using DefaultNetworkSysctl and use containers.conf only
  * Implement ADD checksum flag #5135
  * vendor of openshift/imagebuilder #5135
  * Pass secrets from the host down to internal podman containers
  * Update cirrus and version of golang
  * image: replace GetStoreImage with ResolveReference
  * vendor: bump c/image to 373c52a9466f
  * pkg/parse.Platform(): minor simplification
  * createConfigsAndManifests: clear history before cw-specific logic
  * Use a constant definition instead of "scratch"
  * conformance: use require.NoErrorf() more
  * fix(deps): update module golang.org/x/term to v0.14.0
  * fix(deps): update module golang.org/x/sync to v0.5.0
  * fix(deps): update module github.com/spf13/cobra to v1.8.0
  * fix(deps): update module golang.org/x/sys to v0.14.0
  * fix(deps): update github.com/containers/common digest to 8354404
  * fix(deps): update module github.com/opencontainers/runc to v1.1.10
  * fix(deps): update github.com/containers/luksy digest to b5a7f79
  * Log the platform for build errors during multi-platform builds
  * Use mask definitions from containers/common
  * Vendor in latest containers/common
  * fix(deps): update module github.com/containerd/containerd to v1.7.8
  * fix(deps): update module go.etcd.io/bbolt to v1.3.8
  * container.conf: support attributed string slices
  * fix(deps): update module sigs.k8s.io/yaml to v1.4.0
  * Use cutil.StringInSlice rather then contains
  * Add --no-hostname option to buildah containers
  * vendor c/common: appendable containers.conf strings, Part 1
  * fix(deps): update module github.com/onsi/gomega to v1.28.1
  * chroot.setupChrootBindMounts: pay more attention to flags
  * chore(deps): update dependency containers/automation_images to v20231004
  * Vendor containers/common
  * chore(deps): update module golang.org/x/net to v0.17.0 [security]
  * run: use internal.GetTempDir with os.MkdirTemp
  * fix(deps): update module github.com/containerd/containerd to v1.7.7
  * imagebuildah,multi-stage: do not remove base images
  * gitignore: add mkcw binary
  * mkcw: remove entrypoint binaries
  * fix(deps): update module golang.org/x/crypto to v0.14.0
  * fix(deps): update module golang.org/x/sys to v0.13.0
  * fix(deps): update module golang.org/x/sync to v0.4.0
  * Update some comments related to confidential workload
  * Use the parent's image ID in the config that we pass to imagebuilder
  * fix(deps): update github.com/containers/common digest to 8892536
  * fix(deps): update github.com/containers/luksy digest to 6df88cb
  * bug: Ensure the mount type is always BindMount by default
  * Protocol can be specified with --port. Ex. --port 514/udp
  * fix(deps): update module github.com/onsi/gomega to v1.28.0
  * build,config: add support for --unsetlabel
  * tests/bud: add tests
  * [CI:BUILD] Packit: tag @containers/packit-build on copr build failures
  * stage_executor: allow images without layers
  * vendor of containers/common
  * Removing selinux_tag.sh as no longer needed after 580356f [NO NEW TESTS NEEDED]
  * add/copy: make sure we handle relative path names correctly
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5
  * Bump to v1.33.0-dev
  * imagebuildah: consider ignorefile with --build-context</changelog>
  <changelog author="dcermak@suse.com" date="1701086400">- Update to version 1.33.2:
  * [release-1.33.2] Bump to v1.33.2
  * Update minimum to golang 1.20
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.0
  * fix(deps): update module github.com/moby/buildkit to v0.12.3
  * Bump to v1.33.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1702555200">- Drop 0001-set-makefile-target-entrypoint.gz-as-.PHONY-on-non-x.patch
  (merged upstream; https://github.com/containers/buildah/pull/5183)
- Update to version 1.34.0:
  * Bump to v1.34.0
  * fix(deps): update module github.com/containerd/containerd to v1.7.11
  * fix(deps): update github.com/containers/storage digest to 15c3cb7
  * fix(deps): update module github.com/onsi/ginkgo/v2 to v2.13.2
  * fix(deps): update github.com/containers/common digest to 630c929
  * fix(deps): update module github.com/moby/buildkit to v0.12.4
  * fix(deps): update github.com/openshift/imagebuilder digest to ef2a5fe
  * [CI:DOCS] man pages: underscores, too-wide lines
  * fix(deps): update module github.com/containerd/containerd to v1.7.10
  * run.bats: use --quiet --pull=false when using a prefetched image
  * internal/mkcw/embed/entrypoint.gz: rename to include the arch
  * internal/mkcw/embed/entrypoint.gz: compress with -n9
  * fix(deps): update module golang.org/x/crypto to v0.16.0
  * Integration tests: make skip_if_no_unshare check --map-users
  * fix(deps): update module golang.org/x/term to v0.15.0
  * fix(deps): update module golang.org/x/sys to v0.15.0
  * fix(deps): update module github.com/onsi/ginkgo to v2
  * vendor: update c/{common,image,storage}
  * run: Allow using just one jail per container on FreeBSD
  * Remove makefile targets entrypoint{,.gz} for non x86_64</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1708689600">- Update to version 1.34.1:
  * [release-1.34] Bump to v1.34.1
  * [release-1.34] Vendor bumps (fixes bsc#1219563)
  * manifest: addCompression use default from containers.conf
  * Build with CNI support on FreeBSD
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * docs: correct default authfile path
  * Make buildah match podman for handling of ulimits
  * imagebuildah: fix crash with empty RUN
  * docs: move footnotes to where they're applicable
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Allow users to specify no-dereference
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * Replace strings.SplitN with strings.Cut
  * Document use of containers-transports values in buildah
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * Ignore errors if label.Relabel returns ENOSUP
  * manifest: addCompression use default from containers.conf</changelog>
  <changelog author="danish.prakash@suse.com" date="1709121600">- Require cni-plugins (bsc#1220568)</changelog>
  <changelog author="dcermak@suse.com" date="1709812800">- Update to version 1.35.0:
  * Bump v1.35.0
  * Bump c/common v0.58.0, c/image v5.30.0, c/storage v1.53.0
  * conformance tests: don't break on trailing zeroes in layer blobs
  * Add a conformance test for copying to a mounted prior stage
  * fix(deps): update module github.com/stretchr/testify to v1.9.0
  * cgroups: reuse version check from c/common
  * Update vendor of containers/(common,image)
  * fix(deps): update github.com/containers/storage digest to eadc620
  * fix(deps): update github.com/containers/luksy digest to ceb12d4
  * fix(deps): update github.com/containers/image/v5 digest to cdc6802
  * manifest add: complain if we get artifact flags without --artifact
  * Use retry logic from containers/common
  * Vendor in containers/(storage,image,common)
  * Update module golang.org/x/crypto to v0.20.0
  * Add comment re: Total Success task name
  * tests: skip_if_no_unshare(): check for --setuid
  * Properly handle build --pull=false
  * [skip-ci] Update tim-actions/get-pr-commits action to v1.3.1
  * Update module go.etcd.io/bbolt to v1.3.9
  * Revert "Reduce official image size"
  * Update module github.com/opencontainers/image-spec to v1.1.0
  * Reduce official image size
  * Build with CNI support on FreeBSD
  * build --all-platforms: skip some base "image" platforms
  * Bump main to v1.35.0-dev
  * Vendor in latest containers/(storage,image,common)
  * Split up error messages for missing --sbom related flags
  * `buildah manifest`: add artifact-related options
  * cmd/buildah/manifest.go: lock lists before adding/annotating/pushing
  * cmd/buildah/manifest.go: don't make struct declarations aliases
  * Use golang.org/x/exp/slices.Contains
  * Disable loong64 again
  * Fix a couple of typos in one-line comments
  * egrep is obsolescent; use grep -E
  * Try Cirrus with a newer VM version
  * Set CONTAINERS_CONF in the chroot-mount-flags integration test
  * Update to match dependency API update
  * Update github.com/openshift/imagebuilder and containers/common
  * docs: correct default authfile path
  * fix(deps): update module github.com/containerd/containerd to v1.7.13
  * tests: retrofit test for heredoc summary
  * build, heredoc: show heredoc summary in build output
  * manifest, push: add support for --retry and --retry-delay
  * fix(deps): update github.com/openshift/imagebuilder digest to b767bc3
  * imagebuildah: fix crash with empty RUN
  * fix(deps): update github.com/containers/luksy digest to b62d551
  * fix(deps): update module github.com/opencontainers/runc to v1.1.12 [security]
  * fix(deps): update module github.com/moby/buildkit to v0.12.5 [security]
  * Make buildah match podman for handling of ulimits
  * docs: move footnotes to where they're applicable
  * Allow users to specify no-dereference
  * Run codespell on code
  * Fix FreeBSD version parsing
  * Fix a build break on FreeBSD
  * Remove a bad FROM line
  * fix(deps): update module github.com/onsi/gomega to v1.31.1
  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc6
  * docs: use reversed logo for dark theme in README
  * build,commit: add --sbom to scan and produce SBOMs when committing
  * commit: force omitHistory if the parent has layers but no history
  * docs: fix a couple of typos
  * internal/mkcw.Archive(): handle extra image content
  * stage_executor,heredoc: honor interpreter in heredoc
  * stage_executor,layers: burst cache if heredoc content is changed
  * fix(deps): update module golang.org/x/crypto to v0.18.0
  * Replace map[K]bool with map[K]struct{} where it makes sense
  * fix(deps): update module golang.org/x/sync to v0.6.0
  * fix(deps): update module golang.org/x/term to v0.16.0
  * Bump CI VMs
  * Replace strings.SplitN with strings.Cut
  * fix(deps): update github.com/containers/storage digest to ef81e9b
  * fix(deps): update github.com/containers/image/v5 digest to 1b221d4
  * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.1
  * Document use of containers-transports values in buildah
  * fix(deps): update module golang.org/x/crypto to v0.17.0 [security]
  * chore(deps): update dependency containers/automation_images to v20231208
  * manifest: addCompression use default from containers.conf
  * commit: add a --add-file flag
  * mkcw: populate the rootfs using an overlay
  * chore(deps): update dependency containers/automation_images to v20230517
  * [skip-ci] Update actions/stale action to v9
  * fix(deps): update module github.com/containernetworking/plugins to v1.4.0
  * fix(deps): update github.com/containers/image/v5 digest to 7a40fee
  * Bump to v1.34.1-dev
  * Ignore errors if label.Relabel returns ENOSUP</changelog>
  <changelog author="danish.prakash@suse.com" date="1710417600">- Require passt for rootless networking (poo#156955)
  Buildah moved to passt/pasta for rootless networking from slirp4netns
  (https://github.com/containers/common/pull/1846)</changelog>
  <changelog author="dcermak@suse.com" date="1710417601">- Remove obsolete requires libcontainers-image &amp; libcontainers-storage</changelog>
  <changelog author="dcermak@suse.com" date="1710763200">- Buildah dropped cni support, require netavark instead (boo#1221243)</changelog>
  <changelog author="dcermak@suse.com" date="1710849600">- Update to version 1.35.1:
  * [release-1.35] Bump to v1.35.1
  * [release-1.35] CVE-2024-1753 container escape fix (bsc#1221677)
- Remove upstreamed patches:
  - 0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1710849601">- Add patch for CVE-2024-1753 / bsc#1221677:
  0001-CVE-2024-1753-container-escape-fix.patch</changelog>
  <changelog author="dcermak@suse.com" date="1712059200">- Update to version 1.35.3:
  * [release-1.35] Bump to Buildah v1.35.3
  * [release-1.35] correctly configure /etc/hosts and resolv.conf
  * [release-1.35] buildah: refactor resolv/hosts setup.
  * [release-1.35] rename the hostFile var to reflect
  * [release-1.35] Bump c/common to v0.58.1
  * [release-1.35] Bump Buildah to v1.35.2
  * [release-1.35] CVE-2024-24786 protobuf to 1.33
  * [release-1.35] Bump to v1.35.2-dev</changelog>
  <changelog author="danish.prakash@suse.com" date="1715342400">- Update to version 1.35.4:
  * [release-1.35] Bump to Buildah v1.35.4
  * [release-1.35] CVE-2024-3727 updates (bsc#1224117)
  * integration test: handle new labels in "bud and test --unsetlabel"
  * [release-1.35] Bump go-jose CVE-2024-28180
  * [release-1.35] Bump ocicrypt and go-jose CVE-2024-28180</changelog>
</package>
<package pkgid="20fe22671c5376cef3be4895fb1889e455ebfcec49e4b7228c183f178c3a2a22" name="byte-buddy" arch="noarch">
  <version epoch="0" ver="1.14.16" rel="150200.5.7.1"/>
  <changelog author="shvetz.anton@gmail.com" date="1678276800">- Initial packaging with v1.14.0
- Add patch:
  * 00-asm5.patch
    ~ asm5 does not support the Opcodes.V20 constant</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1679313600">- Update to v1.14.2
  * Changes of v1.14.2
    + Fix offset mapping for local variable array remapping in
    Advice.
    + Add possibility to specify an index for skipOn and repeatOn
    which resolves the checked value from a returned array.
  * Changes of 1.14.1
    + Add extended scope for Maven Byte Buddy plugin to include all
    non-test-dependencies.</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1680436800">- Update to v1.14.3
  * Changes of v1.14.3
    + Make MethodGraph.Compiler failsafe when processing incomplete
    methods.
    + Update ASM.</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1680523200">- Remove patch:
  * 00-asm5.patch - not needed due to update of objectweb-asm</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1681387200">- Update to v1.14.4
  * Changes of v1.14.4
    + Include instrumented type and auxiliary types in TypePool
    that is passed to TypeWriter.</changelog>
  <changelog author="fstrba@suse.com" date="1683288000">- Do not bootstrap using downloaded binaries, but build the
  minimal bootstrap package from sources</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1686398400">- Update to v1.14.5
  * Changes of v1.14.5
    + Avoid use of location if agent argument separator is
    contained.
    + Allow failure of member substitution if no element is
    separated.
    + Allow retry in case of parallel class injection.</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1692100800">- Update to v1.14.6
  * Changes of v1.14.6
    + Add PatchMode.SUBSTITUTE and
    ResettableClassFileTransformer.Substitutable for in-order
    patching.
    + Allow for explicit specification og differential matcher when
    patching an AgentBuilder.
    + Add platform loader to locator for build plugins.
    + Correctly resolve accessors for fields with capitalized first
    letter.
    + Make jars for Android read-only as newer versions require it.</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1693483200">- Update to v1.14.7
  * Changes of v1.14.7
    + Correctly read minor version from class file.
    + Catch type resolution errors when applying Plugin.Engine.</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1694692800">- Update to v1.14.8
  * Changes of v1.14.8
    + Correctly read versions from class file that would use both
    bytes.
    + Fix Byte Buddy Gradle plugin for Gradle 8.3+.
    + Correct field and static method access on subtypes in
    MemberSubstitution.
    + Support APK 7.4+ versions in Byte Buddy Gradle for Android
    plugin.
- Reproducible builds: use SOURCE_DATE_EPOCH for timestamp</changelog>
  <changelog author="fstrba@suse.com" date="1695816000">- Remove dependency on findbugs
- Do not produce bootstrap package</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1697544000">- Update to v1.14.9
  * Changes of v1.14.9
    + Update ASM to version 9.6
    + Support Android plugin to support APG version 7.4</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1703073600">- Update to v1.14.10
  * Changes of v1.14.10
    + Add lazy facade to default TypePool in AgentBuilder to avoid
    parsing of types ignored by name.
    + Avoid module info classes in Android plugin.</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1703160000">- Update to v1.14.11
  * Changes of v1.14.11
    + Adjusts Gradle plugin to support Gradle 8.4 without warnings.
    + Avoid blurry exception on build plugin for fail fast.</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1708171200">- Update to v1.14.12
  * Changes of v1.14.12
    + Pin proxy class file version to avoid implicit changes when
    using Graal native image.
    + Add support for Java 23.
    + Add missing @MaybeNull annotation.</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1711627200">- Update to v1.14.13
  * Changes of v1.14.13
    + Avoid resolving type variables when generic type processing
    is disabled.
    + Improve error message for Byte Buddy agent external attach.
    + Fix build for modular jars when using later version than Java
    8.</changelog>
  <changelog author="fstrba@suse.com" date="1713441600">- Split the whole package into sub-packages
- Added patch:
  * 0001-Avoid-bundling-asm.patch
    + Do not bundle asm, but use external artifact
  * 0002-Remove-dependencies.patch
    + Remove optional dependency on jna</changelog>
  <changelog author="fstrba@suse.com" date="1716292800">- Upgrade to v1.14.15
  * Changes of v1.14.15
    + Allow attaching from root on J9.
  * Changes of v1.14.14
    + Adjust type validation to accept additional names that are
    legal in the class file format.
    + Fix dynamic attach on Windows when a service user is active.
    + Avoid failure when using Android's strict mode.
- Removed patch:
  * 0002-Remove-dependencies.patch
    + not needed since we have jna packaged</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1716465600">- Update to v1.14.16
  * Changes of v1.14.16
    + Update ASM and introduce support for Java 23.</changelog>
</package>
<package pkgid="9eb5a8b2307fbcff380790e6af19453458c223d6ab266adfd6582d9d5fb13f61" name="byte-buddy" arch="src">
  <version epoch="0" ver="1.14.16" rel="150200.5.7.1"/>
  <changelog author="shvetz.anton@gmail.com" date="1678276800">- Initial packaging with v1.14.0
- Add patch:
  * 00-asm5.patch
    ~ asm5 does not support the Opcodes.V20 constant</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1679313600">- Update to v1.14.2
  * Changes of v1.14.2
    + Fix offset mapping for local variable array remapping in
    Advice.
    + Add possibility to specify an index for skipOn and repeatOn
    which resolves the checked value from a returned array.
  * Changes of 1.14.1
    + Add extended scope for Maven Byte Buddy plugin to include all
    non-test-dependencies.</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1680436800">- Update to v1.14.3
  * Changes of v1.14.3
    + Make MethodGraph.Compiler failsafe when processing incomplete
    methods.
    + Update ASM.</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1680523200">- Remove patch:
  * 00-asm5.patch - not needed due to update of objectweb-asm</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1681387200">- Update to v1.14.4
  * Changes of v1.14.4
    + Include instrumented type and auxiliary types in TypePool
    that is passed to TypeWriter.</changelog>
  <changelog author="fstrba@suse.com" date="1683288000">- Do not bootstrap using downloaded binaries, but build the
  minimal bootstrap package from sources</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1686398400">- Update to v1.14.5
  * Changes of v1.14.5
    + Avoid use of location if agent argument separator is
    contained.
    + Allow failure of member substitution if no element is
    separated.
    + Allow retry in case of parallel class injection.</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1692100800">- Update to v1.14.6
  * Changes of v1.14.6
    + Add PatchMode.SUBSTITUTE and
    ResettableClassFileTransformer.Substitutable for in-order
    patching.
    + Allow for explicit specification og differential matcher when
    patching an AgentBuilder.
    + Add platform loader to locator for build plugins.
    + Correctly resolve accessors for fields with capitalized first
    letter.
    + Make jars for Android read-only as newer versions require it.</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1693483200">- Update to v1.14.7
  * Changes of v1.14.7
    + Correctly read minor version from class file.
    + Catch type resolution errors when applying Plugin.Engine.</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1694692800">- Update to v1.14.8
  * Changes of v1.14.8
    + Correctly read versions from class file that would use both
    bytes.
    + Fix Byte Buddy Gradle plugin for Gradle 8.3+.
    + Correct field and static method access on subtypes in
    MemberSubstitution.
    + Support APK 7.4+ versions in Byte Buddy Gradle for Android
    plugin.
- Reproducible builds: use SOURCE_DATE_EPOCH for timestamp</changelog>
  <changelog author="fstrba@suse.com" date="1695816000">- Remove dependency on findbugs
- Do not produce bootstrap package</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1697544000">- Update to v1.14.9
  * Changes of v1.14.9
    + Update ASM to version 9.6
    + Support Android plugin to support APG version 7.4</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1703073600">- Update to v1.14.10
  * Changes of v1.14.10
    + Add lazy facade to default TypePool in AgentBuilder to avoid
    parsing of types ignored by name.
    + Avoid module info classes in Android plugin.</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1703160000">- Update to v1.14.11
  * Changes of v1.14.11
    + Adjusts Gradle plugin to support Gradle 8.4 without warnings.
    + Avoid blurry exception on build plugin for fail fast.</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1708171200">- Update to v1.14.12
  * Changes of v1.14.12
    + Pin proxy class file version to avoid implicit changes when
    using Graal native image.
    + Add support for Java 23.
    + Add missing @MaybeNull annotation.</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1711627200">- Update to v1.14.13
  * Changes of v1.14.13
    + Avoid resolving type variables when generic type processing
    is disabled.
    + Improve error message for Byte Buddy agent external attach.
    + Fix build for modular jars when using later version than Java
    8.</changelog>
  <changelog author="fstrba@suse.com" date="1713441600">- Split the whole package into sub-packages
- Added patch:
  * 0001-Avoid-bundling-asm.patch
    + Do not bundle asm, but use external artifact
  * 0002-Remove-dependencies.patch
    + Remove optional dependency on jna</changelog>
  <changelog author="fstrba@suse.com" date="1716292800">- Upgrade to v1.14.15
  * Changes of v1.14.15
    + Allow attaching from root on J9.
  * Changes of v1.14.14
    + Adjust type validation to accept additional names that are
    legal in the class file format.
    + Fix dynamic attach on Windows when a service user is active.
    + Avoid failure when using Android's strict mode.
- Removed patch:
  * 0002-Remove-dependencies.patch
    + not needed since we have jna packaged</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1716465600">- Update to v1.14.16
  * Changes of v1.14.16
    + Update ASM and introduce support for Java 23.</changelog>
</package>
<package pkgid="0fb3621efd78440cf1c03ae58e92810a0060ea3177daa54f0f67c74984a71e99" name="ca-certificates-mozilla" arch="noarch">
  <version epoch="0" ver="2.68" rel="150200.33.1"/>
  <changelog author="kukuk@suse.de" date="1521547200">-  Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="meissner@suse.com" date="1530878400">- Updated to 2.24 state of the Mozilla NSS Certificate store. (bsc#1100415)
- Removed CAs:
  * S-TRUST_Universal_Root_CA:2.16.96.86.197.75.35.64.91.100.212.237.37.218.217.214.30.30.crt
  * TC_TrustCenter_Class_3_CA_II:2.14.74.71.0.1.0.2.229.160.93.214.63.0.81.191.crt
  * TÜRKTRUST_Elektronik_Sertifika_Hizmet_Sağlayıcısı_H5:2.7.0.142.23.254.36.32.129.crt</changelog>
  <changelog author="meissner@suse.com" date="1534420800">- updated to 2.26 state of the Mozilla NSS Certificate store. (bsc#1104780)
  - removed server auth
  - Certplus Root CA G1
  - Certplus Root CA G2
  - OpenTrust Root CA G1
  - OpenTrust Root CA G2
  - OpenTrust Root CA G3
  - remove CA
  - ComSign CA
  - added new CA
  - GlobalSign</changelog>
  <changelog author="meissner@suse.com" date="1547726400">- updated to 2.30 state of the Mozilla NSS Certificate store. (bsc#1121446)
- Removed CAs:
  - AC Raiz Certicamara S.A.
  - Certplus Root CA G1
  - Certplus Root CA G2
  - OpenTrust Root CA G1
  - OpenTrust Root CA G2
  - OpenTrust Root CA G3
  - Visa eCommerce Root
- Added Root CAs:
  - Certigna Root CA (email and server auth)
  - GTS Root R1 (server auth)
  - GTS Root R2 (server auth)
  - GTS Root R3 (server auth)
  - GTS Root R4 (server auth)
  - OISTE WISeKey Global Root GC CA (email and server auth)
  - UCA Extended Validation Root (server auth)
  - UCA Global G2 Root (email and server auth)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1564920000">- update to 2.34 state of the Mozilla NSS Certificate store (bsc#1144169)
- Removed CAs:
  - Certinomis - Root CA
- includes added root CAs from the 2.32 version:
  - emSign ECC Root CA - C3 (email and server auth)
  - emSign ECC Root CA - G3 (email and server auth)
  - emSign Root CA - C1 (email and server auth)
  - emSign Root CA - G1 (email and server auth)
  - Hongkong Post Root CA 3 (server auth)</changelog>
  <changelog author="lnussel@suse.de" date="1573560000">- export correct p11kit trust attributes so Firefox detects built in
  certificates (boo#1154871). Courtesy of Fedora.</changelog>
  <changelog author="lnussel@suse.de" date="1576670400">- make sure p11-kit with patches is installed on SLE (boo#1154871)</changelog>
  <changelog author="meissner@suse.com" date="1579003200">- update to 2.40 state of the Mozilla NSS Certificate store (bsc#1160160)
- removed:
  - Certplus Class 2 Primary CA
  - Deutsche Telekom Root CA 2
  - CN=Swisscom Root CA 2
  - UTN-USERFirst-Client Authentication and Email
- added:
  - Entrust Root Certification Authority - G4</changelog>
  <changelog author="meissner@suse.com" date="1585224000">- also run update-ca-certificates in %posttrans</changelog>
  <changelog author="meissner@suse.com" date="1596024000">- update to 2.42 state of the Mozilla NSS Certificate store (bsc#1174673)
  Removed CAs:
  - AddTrust External CA Root
  - AddTrust Class 1 CA Root
  - LuxTrust Global Root 2
  - Staat der Nederlanden Root CA - G2
  - Symantec Class 1 Public Primary Certification Authority - G4
  - Symantec Class 2 Public Primary Certification Authority - G4
  - VeriSign Class 3 Public Primary Certification Authority - G3
  Added CAs:
  - certSIGN Root CA G2
  - e-Szigno Root CA 2017
  - Microsoft ECC Root Certificate Authority 2017
  - Microsoft RSA Root Certificate Authority 2017</changelog>
  <changelog author="meissner@suse.com" date="1603108800">- Updated to 2.44 state of the Mozilla NSS Certificate store (bsc#1177864)
- Removed CAs:
  - EE Certification Centre Root CA
  - Taiwan GRCA
- Added CAs:
  - Trustwave Global Certification Authority
  - Trustwave Global ECC P256 Certification Authority
  - Trustwave Global ECC P384 Certification Authority</changelog>
  <changelog author="meissner@suse.com" date="1612872000">- Updated to 2.46 state of the Mozilla NSS Certificate store (bsc#1181994)
- Added new root CAs:
  - NAVER Global Root Certification Authority
- Removed old root CA:
  - GeoTrust Global CA
  - GeoTrust Primary Certification Authority
  - GeoTrust Primary Certification Authority - G3
  - GeoTrust Universal CA
  - GeoTrust Universal CA 2
  - thawte Primary Root CA
  - thawte Primary Root CA - G2
  - thawte Primary Root CA - G3
  - VeriSign Class 3 Public Primary Certification Authority - G4
  - VeriSign Class 3 Public Primary Certification Authority - G5</changelog>
  <changelog author="meissner@suse.com" date="1632484800">- remove the DST_Root_CA_X3.pem trust, as it expires september 30th 2021.
  (bsc#1190858)</changelog>
  <changelog author="meissner@suse.com" date="1633176000">- updated to 2.50 state of the Mozilla NSS Certificate store (bsc#1188006)
- Added CAs:
  + HARICA Client ECC Root CA 2021
  + HARICA Client RSA Root CA 2021
  + HARICA TLS ECC Root CA 2021
  + HARICA TLS RSA Root CA 2021
  + TunTrust Root CA</changelog>
  <changelog author="meissner@suse.com" date="1651492800">- Updated to 2.54 state of Mozilla SSL root CAs (bsc#1199079)
  Added:
  - Autoridad de Certificacion Firmaprofesional CIF A62634068
  - D-TRUST BR Root CA 1 2020
  - D-TRUST EV Root CA 1 2020
  - GlobalSign ECC Root CA R4
  - GTS Root R1
  - GTS Root R2
  - GTS Root R3
  - GTS Root R4
  - HiPKI Root CA - G1
  - ISRG Root X2
  - Telia Root CA v2
  - vTrus ECC Root CA
  - vTrus Root CA
  Removed:
  - Cybertrust Global Root
  - DST Root CA X3
  - DigiNotar PKIoverheid CA Organisatie - G2
  - GlobalSign ECC Root CA R4
  - GlobalSign Root CA R2
  - GTS Root R1
  - GTS Root R2
  - GTS Root R3
  - GTS Root R4</changelog>
  <changelog author="meissner@suse.com" date="1661774400">- Updated to 2.56 state of Mozilla SSL root CAs (bsc#1202868)
  Added:
  - Certainly Root E1
  - Certainly Root R1
  - DigiCert SMIME ECC P384 Root G5
  - DigiCert SMIME RSA4096 Root G5
  - DigiCert TLS ECC P384 Root G5
  - DigiCert TLS RSA4096 Root G5
  - E-Tugra Global Root CA ECC v3
  - E-Tugra Global Root CA RSA v3
  Removed:
  - Hellenic Academic and Research Institutions RootCA 2011</changelog>
  <changelog author="meissner@suse.com" date="1671710400">- Updated to 2.60 state of Mozilla SSL root CAs (bsc#1206622)
  Removed CAs:
  - Global Chambersign Root
  - EC-ACC
  - Network Solutions Certificate Authority
  - Staat der Nederlanden EV Root CA
  - SwissSign Platinum CA - G2
  Added CAs:
  - DIGITALSIGN GLOBAL ROOT ECDSA CA
  - DIGITALSIGN GLOBAL ROOT RSA CA
  - Security Communication ECC RootCA1
  - Security Communication RootCA3
  Changed trust:
  - TrustCor certificates only trusted up to Nov 30 (bsc#1206212)
- Removed CAs (bsc#1206212) as most code does not handle "valid before nov 30 2022"
  and it is not clear how many certs were issued for SSL middleware by TrustCor:
  - TrustCor RootCert CA-1
  - TrustCor RootCert CA-2
  - TrustCor ECA-1
  Patch: remove-trustcor.patch</changelog>
  <changelog author="meissner@suse.com" date="1692014400">- Updated to 2.62 state of Mozilla SSL root CAs (bsc#1214248)
  Added:
  - Atos TrustedRoot Root CA ECC G2 2020
  - Atos TrustedRoot Root CA ECC TLS 2021
  - Atos TrustedRoot Root CA RSA G2 2020
  - Atos TrustedRoot Root CA RSA TLS 2021
  - BJCA Global Root CA1
  - BJCA Global Root CA2
  - LAWtrust Root CA2 (4096)
  - Sectigo Public Email Protection Root E46
  - Sectigo Public Email Protection Root R46
  - Sectigo Public Server Authentication Root E46
  - Sectigo Public Server Authentication Root R46
  - SSL.com Client ECC Root CA 2022
  - SSL.com Client RSA Root CA 2022
  - SSL.com TLS ECC Root CA 2022
  - SSL.com TLS RSA Root CA 2022
  Removed CAs:
  - Chambers of Commerce Root
  - E-Tugra Certification Authority
  - E-Tugra Global Root CA ECC v3
  - E-Tugra Global Root CA RSA v3
  - Hongkong Post Root CA 1</changelog>
  <changelog author="meissner@suse.com" date="1708948800">- Updated to 2.66 state of Mozilla SSL root CAs (bsc#1220356)
  Added:
  - CommScope Public Trust ECC Root-01
  - CommScope Public Trust ECC Root-02
  - CommScope Public Trust RSA Root-01
  - CommScope Public Trust RSA Root-02
  - D-Trust SBR Root CA 1 2022
  - D-Trust SBR Root CA 2 2022
  - Telekom Security SMIME ECC Root 2021
  - Telekom Security SMIME RSA Root 2023
  - Telekom Security TLS ECC Root 2020
  - Telekom Security TLS RSA Root 2023
  - TrustAsia Global Root CA G3
  - TrustAsia Global Root CA G4
  Removed:
  - Autoridad de Certificacion Firmaprofesional CIF A62634068
  - Chambers of Commerce Root - 2008
  - Global Chambersign Root - 2008
  - Security Communication Root CA
  - Symantec Class 1 Public Primary Certification Authority - G6
  - Symantec Class 2 Public Primary Certification Authority - G6
  - TrustCor ECA-1
  - TrustCor RootCert CA-1
  - TrustCor RootCert CA-2
  - VeriSign Class 1 Public Primary Certification Authority - G3
  - VeriSign Class 2 Public Primary Certification Authority - G3
- remove-trustcor.patch: removed, now upstream
- do a versioned obsoletes of "openssl-certs".</changelog>
  <changelog author="meissner@suse.com" date="1720440000">- Updated to 2.68 state of Mozilla SSL root CAs (bsc#1227525)
  - Added: FIRMAPROFESIONAL CA ROOT-A WEB
  - Distrust: GLOBALTRUST 2020</changelog>
</package>
<package pkgid="8a132b673f0e7590cb1fe65521f13822c9ccefc8ef3b0b9878f67280670d21af" name="ca-certificates-mozilla" arch="src">
  <version epoch="0" ver="2.68" rel="150200.33.1"/>
  <changelog author="kukuk@suse.de" date="1521547200">-  Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="meissner@suse.com" date="1530878400">- Updated to 2.24 state of the Mozilla NSS Certificate store. (bsc#1100415)
- Removed CAs:
  * S-TRUST_Universal_Root_CA:2.16.96.86.197.75.35.64.91.100.212.237.37.218.217.214.30.30.crt
  * TC_TrustCenter_Class_3_CA_II:2.14.74.71.0.1.0.2.229.160.93.214.63.0.81.191.crt
  * TÜRKTRUST_Elektronik_Sertifika_Hizmet_Sağlayıcısı_H5:2.7.0.142.23.254.36.32.129.crt</changelog>
  <changelog author="meissner@suse.com" date="1534420800">- updated to 2.26 state of the Mozilla NSS Certificate store. (bsc#1104780)
  - removed server auth
  - Certplus Root CA G1
  - Certplus Root CA G2
  - OpenTrust Root CA G1
  - OpenTrust Root CA G2
  - OpenTrust Root CA G3
  - remove CA
  - ComSign CA
  - added new CA
  - GlobalSign</changelog>
  <changelog author="meissner@suse.com" date="1547726400">- updated to 2.30 state of the Mozilla NSS Certificate store. (bsc#1121446)
- Removed CAs:
  - AC Raiz Certicamara S.A.
  - Certplus Root CA G1
  - Certplus Root CA G2
  - OpenTrust Root CA G1
  - OpenTrust Root CA G2
  - OpenTrust Root CA G3
  - Visa eCommerce Root
- Added Root CAs:
  - Certigna Root CA (email and server auth)
  - GTS Root R1 (server auth)
  - GTS Root R2 (server auth)
  - GTS Root R3 (server auth)
  - GTS Root R4 (server auth)
  - OISTE WISeKey Global Root GC CA (email and server auth)
  - UCA Extended Validation Root (server auth)
  - UCA Global G2 Root (email and server auth)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1564920000">- update to 2.34 state of the Mozilla NSS Certificate store (bsc#1144169)
- Removed CAs:
  - Certinomis - Root CA
- includes added root CAs from the 2.32 version:
  - emSign ECC Root CA - C3 (email and server auth)
  - emSign ECC Root CA - G3 (email and server auth)
  - emSign Root CA - C1 (email and server auth)
  - emSign Root CA - G1 (email and server auth)
  - Hongkong Post Root CA 3 (server auth)</changelog>
  <changelog author="lnussel@suse.de" date="1573560000">- export correct p11kit trust attributes so Firefox detects built in
  certificates (boo#1154871). Courtesy of Fedora.</changelog>
  <changelog author="lnussel@suse.de" date="1576670400">- make sure p11-kit with patches is installed on SLE (boo#1154871)</changelog>
  <changelog author="meissner@suse.com" date="1579003200">- update to 2.40 state of the Mozilla NSS Certificate store (bsc#1160160)
- removed:
  - Certplus Class 2 Primary CA
  - Deutsche Telekom Root CA 2
  - CN=Swisscom Root CA 2
  - UTN-USERFirst-Client Authentication and Email
- added:
  - Entrust Root Certification Authority - G4</changelog>
  <changelog author="meissner@suse.com" date="1585224000">- also run update-ca-certificates in %posttrans</changelog>
  <changelog author="meissner@suse.com" date="1596024000">- update to 2.42 state of the Mozilla NSS Certificate store (bsc#1174673)
  Removed CAs:
  - AddTrust External CA Root
  - AddTrust Class 1 CA Root
  - LuxTrust Global Root 2
  - Staat der Nederlanden Root CA - G2
  - Symantec Class 1 Public Primary Certification Authority - G4
  - Symantec Class 2 Public Primary Certification Authority - G4
  - VeriSign Class 3 Public Primary Certification Authority - G3
  Added CAs:
  - certSIGN Root CA G2
  - e-Szigno Root CA 2017
  - Microsoft ECC Root Certificate Authority 2017
  - Microsoft RSA Root Certificate Authority 2017</changelog>
  <changelog author="meissner@suse.com" date="1603108800">- Updated to 2.44 state of the Mozilla NSS Certificate store (bsc#1177864)
- Removed CAs:
  - EE Certification Centre Root CA
  - Taiwan GRCA
- Added CAs:
  - Trustwave Global Certification Authority
  - Trustwave Global ECC P256 Certification Authority
  - Trustwave Global ECC P384 Certification Authority</changelog>
  <changelog author="meissner@suse.com" date="1612872000">- Updated to 2.46 state of the Mozilla NSS Certificate store (bsc#1181994)
- Added new root CAs:
  - NAVER Global Root Certification Authority
- Removed old root CA:
  - GeoTrust Global CA
  - GeoTrust Primary Certification Authority
  - GeoTrust Primary Certification Authority - G3
  - GeoTrust Universal CA
  - GeoTrust Universal CA 2
  - thawte Primary Root CA
  - thawte Primary Root CA - G2
  - thawte Primary Root CA - G3
  - VeriSign Class 3 Public Primary Certification Authority - G4
  - VeriSign Class 3 Public Primary Certification Authority - G5</changelog>
  <changelog author="meissner@suse.com" date="1632484800">- remove the DST_Root_CA_X3.pem trust, as it expires september 30th 2021.
  (bsc#1190858)</changelog>
  <changelog author="meissner@suse.com" date="1633176000">- updated to 2.50 state of the Mozilla NSS Certificate store (bsc#1188006)
- Added CAs:
  + HARICA Client ECC Root CA 2021
  + HARICA Client RSA Root CA 2021
  + HARICA TLS ECC Root CA 2021
  + HARICA TLS RSA Root CA 2021
  + TunTrust Root CA</changelog>
  <changelog author="meissner@suse.com" date="1651492800">- Updated to 2.54 state of Mozilla SSL root CAs (bsc#1199079)
  Added:
  - Autoridad de Certificacion Firmaprofesional CIF A62634068
  - D-TRUST BR Root CA 1 2020
  - D-TRUST EV Root CA 1 2020
  - GlobalSign ECC Root CA R4
  - GTS Root R1
  - GTS Root R2
  - GTS Root R3
  - GTS Root R4
  - HiPKI Root CA - G1
  - ISRG Root X2
  - Telia Root CA v2
  - vTrus ECC Root CA
  - vTrus Root CA
  Removed:
  - Cybertrust Global Root
  - DST Root CA X3
  - DigiNotar PKIoverheid CA Organisatie - G2
  - GlobalSign ECC Root CA R4
  - GlobalSign Root CA R2
  - GTS Root R1
  - GTS Root R2
  - GTS Root R3
  - GTS Root R4</changelog>
  <changelog author="meissner@suse.com" date="1661774400">- Updated to 2.56 state of Mozilla SSL root CAs (bsc#1202868)
  Added:
  - Certainly Root E1
  - Certainly Root R1
  - DigiCert SMIME ECC P384 Root G5
  - DigiCert SMIME RSA4096 Root G5
  - DigiCert TLS ECC P384 Root G5
  - DigiCert TLS RSA4096 Root G5
  - E-Tugra Global Root CA ECC v3
  - E-Tugra Global Root CA RSA v3
  Removed:
  - Hellenic Academic and Research Institutions RootCA 2011</changelog>
  <changelog author="meissner@suse.com" date="1671710400">- Updated to 2.60 state of Mozilla SSL root CAs (bsc#1206622)
  Removed CAs:
  - Global Chambersign Root
  - EC-ACC
  - Network Solutions Certificate Authority
  - Staat der Nederlanden EV Root CA
  - SwissSign Platinum CA - G2
  Added CAs:
  - DIGITALSIGN GLOBAL ROOT ECDSA CA
  - DIGITALSIGN GLOBAL ROOT RSA CA
  - Security Communication ECC RootCA1
  - Security Communication RootCA3
  Changed trust:
  - TrustCor certificates only trusted up to Nov 30 (bsc#1206212)
- Removed CAs (bsc#1206212) as most code does not handle "valid before nov 30 2022"
  and it is not clear how many certs were issued for SSL middleware by TrustCor:
  - TrustCor RootCert CA-1
  - TrustCor RootCert CA-2
  - TrustCor ECA-1
  Patch: remove-trustcor.patch</changelog>
  <changelog author="meissner@suse.com" date="1692014400">- Updated to 2.62 state of Mozilla SSL root CAs (bsc#1214248)
  Added:
  - Atos TrustedRoot Root CA ECC G2 2020
  - Atos TrustedRoot Root CA ECC TLS 2021
  - Atos TrustedRoot Root CA RSA G2 2020
  - Atos TrustedRoot Root CA RSA TLS 2021
  - BJCA Global Root CA1
  - BJCA Global Root CA2
  - LAWtrust Root CA2 (4096)
  - Sectigo Public Email Protection Root E46
  - Sectigo Public Email Protection Root R46
  - Sectigo Public Server Authentication Root E46
  - Sectigo Public Server Authentication Root R46
  - SSL.com Client ECC Root CA 2022
  - SSL.com Client RSA Root CA 2022
  - SSL.com TLS ECC Root CA 2022
  - SSL.com TLS RSA Root CA 2022
  Removed CAs:
  - Chambers of Commerce Root
  - E-Tugra Certification Authority
  - E-Tugra Global Root CA ECC v3
  - E-Tugra Global Root CA RSA v3
  - Hongkong Post Root CA 1</changelog>
  <changelog author="meissner@suse.com" date="1708948800">- Updated to 2.66 state of Mozilla SSL root CAs (bsc#1220356)
  Added:
  - CommScope Public Trust ECC Root-01
  - CommScope Public Trust ECC Root-02
  - CommScope Public Trust RSA Root-01
  - CommScope Public Trust RSA Root-02
  - D-Trust SBR Root CA 1 2022
  - D-Trust SBR Root CA 2 2022
  - Telekom Security SMIME ECC Root 2021
  - Telekom Security SMIME RSA Root 2023
  - Telekom Security TLS ECC Root 2020
  - Telekom Security TLS RSA Root 2023
  - TrustAsia Global Root CA G3
  - TrustAsia Global Root CA G4
  Removed:
  - Autoridad de Certificacion Firmaprofesional CIF A62634068
  - Chambers of Commerce Root - 2008
  - Global Chambersign Root - 2008
  - Security Communication Root CA
  - Symantec Class 1 Public Primary Certification Authority - G6
  - Symantec Class 2 Public Primary Certification Authority - G6
  - TrustCor ECA-1
  - TrustCor RootCert CA-1
  - TrustCor RootCert CA-2
  - VeriSign Class 1 Public Primary Certification Authority - G3
  - VeriSign Class 2 Public Primary Certification Authority - G3
- remove-trustcor.patch: removed, now upstream
- do a versioned obsoletes of "openssl-certs".</changelog>
  <changelog author="meissner@suse.com" date="1720440000">- Updated to 2.68 state of Mozilla SSL root CAs (bsc#1227525)
  - Added: FIRMAPROFESIONAL CA ROOT-A WEB
  - Distrust: GLOBALTRUST 2020</changelog>
</package>
<package pkgid="ce3720749be8068c55eb1943cafd08362d975cad54060a5d610f5f29cbce2e75" name="ca-certificates-mozilla-prebuilt" arch="noarch">
  <version epoch="0" ver="2.68" rel="150200.33.1"/>
  <changelog author="lnussel@suse.de" date="1633348800">- new package for minimal base containers (jsc#SLE-22162)</changelog>
</package>
<package pkgid="17dbcfa7b246afad6d8fe5514c41998d3df30dbe3fbcfa6088822e40e5db6cb2" name="ca-certificates-mozilla-prebuilt" arch="src">
  <version epoch="0" ver="2.68" rel="150200.33.1"/>
  <changelog author="lnussel@suse.de" date="1633348800">- new package for minimal base containers (jsc#SLE-22162)</changelog>
</package>
<package pkgid="f8b513e54e4436f50e79eefd7aacf5e4be476049ca857aff811e5485ad8088e8" name="cargo" arch="aarch64">
  <version epoch="0" ver="1.78.0" rel="150500.27.12.1"/>
  <changelog author="william.brown@suse.com" date="1653048000">- Update to version 1.61.0 - for details see the rust1.61 package</changelog>
  <changelog author="william.brown@suse.com" date="1656936000">- Update to version 1.62.0 - for details see the rust1.62 package</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- Update to version 1.63.0 - for details see the rust1.63 package</changelog>
  <changelog author="william.brown@suse.com" date="1664107200">- Update to version 1.64.0 - for details see the rust1.64 package</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1664366400">- Enable armv6 again - boo#1196328</changelog>
  <changelog author="william.brown@suse.com" date="1667563200">- Update to version 1.65.0 - for details see the rust1.65 package</changelog>
  <changelog author="william.brown@suse.com" date="1671192000">- Update to version 1.66.0 - for details see the rust1.66 package</changelog>
  <changelog author="william.brown@suse.com" date="1675166400">- Update to version 1.67.0 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1676376000">- Update to version 1.67.1 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1678449600">- Update to version 1.68.0 - for details see the rust1.68 package</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- Update to version 1.69.0 - for details see the rust1.69 package</changelog>
  <changelog author="william.brown@suse.com" date="1685793600">- Update to version 1.70.0 - for details see the rust1.70 package</changelog>
  <changelog author="william.brown@suse.com" date="1689595200">- Update to version 1.71.0 - for details see the rust1.71 package</changelog>
  <changelog author="william.brown@suse.com" date="1693137600">- Update to version 1.72.0 - for details see the rust1.72 package</changelog>
  <changelog author="william.brown@suse.com" date="1696593600">- Update to version 1.73.0 - for details see the rust1.73 package</changelog>
  <changelog author="william.brown@suse.com" date="1700222400">- Update to version 1.74.0 - for details see the rust1.74 package</changelog>
  <changelog author="william.brown@suse.com" date="1704110400">- Update to version 1.75.0 - for details see the rust1.75 package</changelog>
  <changelog author="william.brown@suse.com" date="1707480000">- Update to version 1.76.0 - for details see the rust1.76 package</changelog>
  <changelog author="william.brown@suse.com" date="1711454400">- Update to version 1.77.0 - for details see the rust1.77 package</changelog>
  <changelog author="william.brown@suse.com" date="1715688000">- Update to version 1.78.0 - for details see the rust1.78 package</changelog>
</package>
<package pkgid="7bb204c9964d0932be24d1c0b734023e403ed22dce4a3396e73a5c2f721d9638" name="cargo" arch="ppc64le">
  <version epoch="0" ver="1.78.0" rel="150500.27.12.1"/>
  <changelog author="william.brown@suse.com" date="1653048000">- Update to version 1.61.0 - for details see the rust1.61 package</changelog>
  <changelog author="william.brown@suse.com" date="1656936000">- Update to version 1.62.0 - for details see the rust1.62 package</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- Update to version 1.63.0 - for details see the rust1.63 package</changelog>
  <changelog author="william.brown@suse.com" date="1664107200">- Update to version 1.64.0 - for details see the rust1.64 package</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1664366400">- Enable armv6 again - boo#1196328</changelog>
  <changelog author="william.brown@suse.com" date="1667563200">- Update to version 1.65.0 - for details see the rust1.65 package</changelog>
  <changelog author="william.brown@suse.com" date="1671192000">- Update to version 1.66.0 - for details see the rust1.66 package</changelog>
  <changelog author="william.brown@suse.com" date="1675166400">- Update to version 1.67.0 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1676376000">- Update to version 1.67.1 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1678449600">- Update to version 1.68.0 - for details see the rust1.68 package</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- Update to version 1.69.0 - for details see the rust1.69 package</changelog>
  <changelog author="william.brown@suse.com" date="1685793600">- Update to version 1.70.0 - for details see the rust1.70 package</changelog>
  <changelog author="william.brown@suse.com" date="1689595200">- Update to version 1.71.0 - for details see the rust1.71 package</changelog>
  <changelog author="william.brown@suse.com" date="1693137600">- Update to version 1.72.0 - for details see the rust1.72 package</changelog>
  <changelog author="william.brown@suse.com" date="1696593600">- Update to version 1.73.0 - for details see the rust1.73 package</changelog>
  <changelog author="william.brown@suse.com" date="1700222400">- Update to version 1.74.0 - for details see the rust1.74 package</changelog>
  <changelog author="william.brown@suse.com" date="1704110400">- Update to version 1.75.0 - for details see the rust1.75 package</changelog>
  <changelog author="william.brown@suse.com" date="1707480000">- Update to version 1.76.0 - for details see the rust1.76 package</changelog>
  <changelog author="william.brown@suse.com" date="1711454400">- Update to version 1.77.0 - for details see the rust1.77 package</changelog>
  <changelog author="william.brown@suse.com" date="1715688000">- Update to version 1.78.0 - for details see the rust1.78 package</changelog>
</package>
<package pkgid="bf71a7ba837ae745728821957915cbde45ae7c3ef410da4e27e9e17d976c0c52" name="cargo" arch="s390x">
  <version epoch="0" ver="1.78.0" rel="150500.27.12.1"/>
  <changelog author="william.brown@suse.com" date="1653048000">- Update to version 1.61.0 - for details see the rust1.61 package</changelog>
  <changelog author="william.brown@suse.com" date="1656936000">- Update to version 1.62.0 - for details see the rust1.62 package</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- Update to version 1.63.0 - for details see the rust1.63 package</changelog>
  <changelog author="william.brown@suse.com" date="1664107200">- Update to version 1.64.0 - for details see the rust1.64 package</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1664366400">- Enable armv6 again - boo#1196328</changelog>
  <changelog author="william.brown@suse.com" date="1667563200">- Update to version 1.65.0 - for details see the rust1.65 package</changelog>
  <changelog author="william.brown@suse.com" date="1671192000">- Update to version 1.66.0 - for details see the rust1.66 package</changelog>
  <changelog author="william.brown@suse.com" date="1675166400">- Update to version 1.67.0 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1676376000">- Update to version 1.67.1 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1678449600">- Update to version 1.68.0 - for details see the rust1.68 package</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- Update to version 1.69.0 - for details see the rust1.69 package</changelog>
  <changelog author="william.brown@suse.com" date="1685793600">- Update to version 1.70.0 - for details see the rust1.70 package</changelog>
  <changelog author="william.brown@suse.com" date="1689595200">- Update to version 1.71.0 - for details see the rust1.71 package</changelog>
  <changelog author="william.brown@suse.com" date="1693137600">- Update to version 1.72.0 - for details see the rust1.72 package</changelog>
  <changelog author="william.brown@suse.com" date="1696593600">- Update to version 1.73.0 - for details see the rust1.73 package</changelog>
  <changelog author="william.brown@suse.com" date="1700222400">- Update to version 1.74.0 - for details see the rust1.74 package</changelog>
  <changelog author="william.brown@suse.com" date="1704110400">- Update to version 1.75.0 - for details see the rust1.75 package</changelog>
  <changelog author="william.brown@suse.com" date="1707480000">- Update to version 1.76.0 - for details see the rust1.76 package</changelog>
  <changelog author="william.brown@suse.com" date="1711454400">- Update to version 1.77.0 - for details see the rust1.77 package</changelog>
  <changelog author="william.brown@suse.com" date="1715688000">- Update to version 1.78.0 - for details see the rust1.78 package</changelog>
</package>
<package pkgid="9bc1ed8d92dde938c344cae9101eda90f4c7ed7b6874b6237287c96ed3f27234" name="cargo" arch="x86_64">
  <version epoch="0" ver="1.78.0" rel="150500.27.12.1"/>
  <changelog author="william.brown@suse.com" date="1653048000">- Update to version 1.61.0 - for details see the rust1.61 package</changelog>
  <changelog author="william.brown@suse.com" date="1656936000">- Update to version 1.62.0 - for details see the rust1.62 package</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- Update to version 1.63.0 - for details see the rust1.63 package</changelog>
  <changelog author="william.brown@suse.com" date="1664107200">- Update to version 1.64.0 - for details see the rust1.64 package</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1664366400">- Enable armv6 again - boo#1196328</changelog>
  <changelog author="william.brown@suse.com" date="1667563200">- Update to version 1.65.0 - for details see the rust1.65 package</changelog>
  <changelog author="william.brown@suse.com" date="1671192000">- Update to version 1.66.0 - for details see the rust1.66 package</changelog>
  <changelog author="william.brown@suse.com" date="1675166400">- Update to version 1.67.0 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1676376000">- Update to version 1.67.1 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1678449600">- Update to version 1.68.0 - for details see the rust1.68 package</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- Update to version 1.69.0 - for details see the rust1.69 package</changelog>
  <changelog author="william.brown@suse.com" date="1685793600">- Update to version 1.70.0 - for details see the rust1.70 package</changelog>
  <changelog author="william.brown@suse.com" date="1689595200">- Update to version 1.71.0 - for details see the rust1.71 package</changelog>
  <changelog author="william.brown@suse.com" date="1693137600">- Update to version 1.72.0 - for details see the rust1.72 package</changelog>
  <changelog author="william.brown@suse.com" date="1696593600">- Update to version 1.73.0 - for details see the rust1.73 package</changelog>
  <changelog author="william.brown@suse.com" date="1700222400">- Update to version 1.74.0 - for details see the rust1.74 package</changelog>
  <changelog author="william.brown@suse.com" date="1704110400">- Update to version 1.75.0 - for details see the rust1.75 package</changelog>
  <changelog author="william.brown@suse.com" date="1707480000">- Update to version 1.76.0 - for details see the rust1.76 package</changelog>
  <changelog author="william.brown@suse.com" date="1711454400">- Update to version 1.77.0 - for details see the rust1.77 package</changelog>
  <changelog author="william.brown@suse.com" date="1715688000">- Update to version 1.78.0 - for details see the rust1.78 package</changelog>
</package>
<package pkgid="ed457baf46e3c3cb05cef2075c290f544b5b752f5f9ad14f2ba8314714b014e3" name="cargo" arch="aarch64">
  <version epoch="0" ver="1.79.0" rel="150500.27.15.1"/>
  <changelog author="william.brown@suse.com" date="1656936000">- Update to version 1.62.0 - for details see the rust1.62 package</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- Update to version 1.63.0 - for details see the rust1.63 package</changelog>
  <changelog author="william.brown@suse.com" date="1664107200">- Update to version 1.64.0 - for details see the rust1.64 package</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1664366400">- Enable armv6 again - boo#1196328</changelog>
  <changelog author="william.brown@suse.com" date="1667563200">- Update to version 1.65.0 - for details see the rust1.65 package</changelog>
  <changelog author="william.brown@suse.com" date="1671192000">- Update to version 1.66.0 - for details see the rust1.66 package</changelog>
  <changelog author="william.brown@suse.com" date="1675166400">- Update to version 1.67.0 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1676376000">- Update to version 1.67.1 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1678449600">- Update to version 1.68.0 - for details see the rust1.68 package</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- Update to version 1.69.0 - for details see the rust1.69 package</changelog>
  <changelog author="william.brown@suse.com" date="1685793600">- Update to version 1.70.0 - for details see the rust1.70 package</changelog>
  <changelog author="william.brown@suse.com" date="1689595200">- Update to version 1.71.0 - for details see the rust1.71 package</changelog>
  <changelog author="william.brown@suse.com" date="1693137600">- Update to version 1.72.0 - for details see the rust1.72 package</changelog>
  <changelog author="william.brown@suse.com" date="1696593600">- Update to version 1.73.0 - for details see the rust1.73 package</changelog>
  <changelog author="william.brown@suse.com" date="1700222400">- Update to version 1.74.0 - for details see the rust1.74 package</changelog>
  <changelog author="william.brown@suse.com" date="1704110400">- Update to version 1.75.0 - for details see the rust1.75 package</changelog>
  <changelog author="william.brown@suse.com" date="1707480000">- Update to version 1.76.0 - for details see the rust1.76 package</changelog>
  <changelog author="william.brown@suse.com" date="1711454400">- Update to version 1.77.0 - for details see the rust1.77 package</changelog>
  <changelog author="william.brown@suse.com" date="1715688000">- Update to version 1.78.0 - for details see the rust1.78 package</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1718366400">- Update to version 1.79.0 - for details see the rust1.79 package</changelog>
</package>
<package pkgid="bab8b7c5d7bf93459d87b27826ba2d39d56ca665e8b4fb0808b32c4bce62fe74" name="cargo" arch="ppc64le">
  <version epoch="0" ver="1.79.0" rel="150500.27.15.1"/>
  <changelog author="william.brown@suse.com" date="1656936000">- Update to version 1.62.0 - for details see the rust1.62 package</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- Update to version 1.63.0 - for details see the rust1.63 package</changelog>
  <changelog author="william.brown@suse.com" date="1664107200">- Update to version 1.64.0 - for details see the rust1.64 package</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1664366400">- Enable armv6 again - boo#1196328</changelog>
  <changelog author="william.brown@suse.com" date="1667563200">- Update to version 1.65.0 - for details see the rust1.65 package</changelog>
  <changelog author="william.brown@suse.com" date="1671192000">- Update to version 1.66.0 - for details see the rust1.66 package</changelog>
  <changelog author="william.brown@suse.com" date="1675166400">- Update to version 1.67.0 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1676376000">- Update to version 1.67.1 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1678449600">- Update to version 1.68.0 - for details see the rust1.68 package</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- Update to version 1.69.0 - for details see the rust1.69 package</changelog>
  <changelog author="william.brown@suse.com" date="1685793600">- Update to version 1.70.0 - for details see the rust1.70 package</changelog>
  <changelog author="william.brown@suse.com" date="1689595200">- Update to version 1.71.0 - for details see the rust1.71 package</changelog>
  <changelog author="william.brown@suse.com" date="1693137600">- Update to version 1.72.0 - for details see the rust1.72 package</changelog>
  <changelog author="william.brown@suse.com" date="1696593600">- Update to version 1.73.0 - for details see the rust1.73 package</changelog>
  <changelog author="william.brown@suse.com" date="1700222400">- Update to version 1.74.0 - for details see the rust1.74 package</changelog>
  <changelog author="william.brown@suse.com" date="1704110400">- Update to version 1.75.0 - for details see the rust1.75 package</changelog>
  <changelog author="william.brown@suse.com" date="1707480000">- Update to version 1.76.0 - for details see the rust1.76 package</changelog>
  <changelog author="william.brown@suse.com" date="1711454400">- Update to version 1.77.0 - for details see the rust1.77 package</changelog>
  <changelog author="william.brown@suse.com" date="1715688000">- Update to version 1.78.0 - for details see the rust1.78 package</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1718366400">- Update to version 1.79.0 - for details see the rust1.79 package</changelog>
</package>
<package pkgid="75e318859e4ef1f27d12f882209c6b8462068092b08a797fef945f529e7afa4a" name="cargo" arch="s390x">
  <version epoch="0" ver="1.79.0" rel="150500.27.15.1"/>
  <changelog author="william.brown@suse.com" date="1656936000">- Update to version 1.62.0 - for details see the rust1.62 package</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- Update to version 1.63.0 - for details see the rust1.63 package</changelog>
  <changelog author="william.brown@suse.com" date="1664107200">- Update to version 1.64.0 - for details see the rust1.64 package</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1664366400">- Enable armv6 again - boo#1196328</changelog>
  <changelog author="william.brown@suse.com" date="1667563200">- Update to version 1.65.0 - for details see the rust1.65 package</changelog>
  <changelog author="william.brown@suse.com" date="1671192000">- Update to version 1.66.0 - for details see the rust1.66 package</changelog>
  <changelog author="william.brown@suse.com" date="1675166400">- Update to version 1.67.0 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1676376000">- Update to version 1.67.1 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1678449600">- Update to version 1.68.0 - for details see the rust1.68 package</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- Update to version 1.69.0 - for details see the rust1.69 package</changelog>
  <changelog author="william.brown@suse.com" date="1685793600">- Update to version 1.70.0 - for details see the rust1.70 package</changelog>
  <changelog author="william.brown@suse.com" date="1689595200">- Update to version 1.71.0 - for details see the rust1.71 package</changelog>
  <changelog author="william.brown@suse.com" date="1693137600">- Update to version 1.72.0 - for details see the rust1.72 package</changelog>
  <changelog author="william.brown@suse.com" date="1696593600">- Update to version 1.73.0 - for details see the rust1.73 package</changelog>
  <changelog author="william.brown@suse.com" date="1700222400">- Update to version 1.74.0 - for details see the rust1.74 package</changelog>
  <changelog author="william.brown@suse.com" date="1704110400">- Update to version 1.75.0 - for details see the rust1.75 package</changelog>
  <changelog author="william.brown@suse.com" date="1707480000">- Update to version 1.76.0 - for details see the rust1.76 package</changelog>
  <changelog author="william.brown@suse.com" date="1711454400">- Update to version 1.77.0 - for details see the rust1.77 package</changelog>
  <changelog author="william.brown@suse.com" date="1715688000">- Update to version 1.78.0 - for details see the rust1.78 package</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1718366400">- Update to version 1.79.0 - for details see the rust1.79 package</changelog>
</package>
<package pkgid="e8e36573b3c65b5705a351c234a0c8ddd3e3c86955f34c6a074a62b596276e19" name="cargo" arch="x86_64">
  <version epoch="0" ver="1.79.0" rel="150500.27.15.1"/>
  <changelog author="william.brown@suse.com" date="1656936000">- Update to version 1.62.0 - for details see the rust1.62 package</changelog>
  <changelog author="william.brown@suse.com" date="1661256000">- Update to version 1.63.0 - for details see the rust1.63 package</changelog>
  <changelog author="william.brown@suse.com" date="1664107200">- Update to version 1.64.0 - for details see the rust1.64 package</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1664366400">- Enable armv6 again - boo#1196328</changelog>
  <changelog author="william.brown@suse.com" date="1667563200">- Update to version 1.65.0 - for details see the rust1.65 package</changelog>
  <changelog author="william.brown@suse.com" date="1671192000">- Update to version 1.66.0 - for details see the rust1.66 package</changelog>
  <changelog author="william.brown@suse.com" date="1675166400">- Update to version 1.67.0 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1676376000">- Update to version 1.67.1 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1678449600">- Update to version 1.68.0 - for details see the rust1.68 package</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- Update to version 1.69.0 - for details see the rust1.69 package</changelog>
  <changelog author="william.brown@suse.com" date="1685793600">- Update to version 1.70.0 - for details see the rust1.70 package</changelog>
  <changelog author="william.brown@suse.com" date="1689595200">- Update to version 1.71.0 - for details see the rust1.71 package</changelog>
  <changelog author="william.brown@suse.com" date="1693137600">- Update to version 1.72.0 - for details see the rust1.72 package</changelog>
  <changelog author="william.brown@suse.com" date="1696593600">- Update to version 1.73.0 - for details see the rust1.73 package</changelog>
  <changelog author="william.brown@suse.com" date="1700222400">- Update to version 1.74.0 - for details see the rust1.74 package</changelog>
  <changelog author="william.brown@suse.com" date="1704110400">- Update to version 1.75.0 - for details see the rust1.75 package</changelog>
  <changelog author="william.brown@suse.com" date="1707480000">- Update to version 1.76.0 - for details see the rust1.76 package</changelog>
  <changelog author="william.brown@suse.com" date="1711454400">- Update to version 1.77.0 - for details see the rust1.77 package</changelog>
  <changelog author="william.brown@suse.com" date="1715688000">- Update to version 1.78.0 - for details see the rust1.78 package</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1718366400">- Update to version 1.79.0 - for details see the rust1.79 package</changelog>
</package>
<package pkgid="1e5177d6731b6e3cc7c19f29b6f069cd8cc837787e95efd92deeede69fcfef3c" name="cargo" arch="aarch64">
  <version epoch="0" ver="1.80.0" rel="150500.27.18.1"/>
  <changelog author="william.brown@suse.com" date="1661256000">- Update to version 1.63.0 - for details see the rust1.63 package</changelog>
  <changelog author="william.brown@suse.com" date="1664107200">- Update to version 1.64.0 - for details see the rust1.64 package</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1664366400">- Enable armv6 again - boo#1196328</changelog>
  <changelog author="william.brown@suse.com" date="1667563200">- Update to version 1.65.0 - for details see the rust1.65 package</changelog>
  <changelog author="william.brown@suse.com" date="1671192000">- Update to version 1.66.0 - for details see the rust1.66 package</changelog>
  <changelog author="william.brown@suse.com" date="1675166400">- Update to version 1.67.0 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1676376000">- Update to version 1.67.1 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1678449600">- Update to version 1.68.0 - for details see the rust1.68 package</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- Update to version 1.69.0 - for details see the rust1.69 package</changelog>
  <changelog author="william.brown@suse.com" date="1685793600">- Update to version 1.70.0 - for details see the rust1.70 package</changelog>
  <changelog author="william.brown@suse.com" date="1689595200">- Update to version 1.71.0 - for details see the rust1.71 package</changelog>
  <changelog author="william.brown@suse.com" date="1693137600">- Update to version 1.72.0 - for details see the rust1.72 package</changelog>
  <changelog author="william.brown@suse.com" date="1696593600">- Update to version 1.73.0 - for details see the rust1.73 package</changelog>
  <changelog author="william.brown@suse.com" date="1700222400">- Update to version 1.74.0 - for details see the rust1.74 package</changelog>
  <changelog author="william.brown@suse.com" date="1704110400">- Update to version 1.75.0 - for details see the rust1.75 package</changelog>
  <changelog author="william.brown@suse.com" date="1707480000">- Update to version 1.76.0 - for details see the rust1.76 package</changelog>
  <changelog author="william.brown@suse.com" date="1711454400">- Update to version 1.77.0 - for details see the rust1.77 package</changelog>
  <changelog author="william.brown@suse.com" date="1715688000">- Update to version 1.78.0 - for details see the rust1.78 package</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1718366400">- Update to version 1.79.0 - for details see the rust1.79 package</changelog>
  <changelog author="william.brown@suse.com" date="1721995200">- Update to version 1.80.0 - for details see the rust1.80 package</changelog>
</package>
<package pkgid="489a4bba1179c177826108f44b29905733be01ea6aad268ce5a7d27f32721c38" name="cargo" arch="ppc64le">
  <version epoch="0" ver="1.80.0" rel="150500.27.18.1"/>
  <changelog author="william.brown@suse.com" date="1661256000">- Update to version 1.63.0 - for details see the rust1.63 package</changelog>
  <changelog author="william.brown@suse.com" date="1664107200">- Update to version 1.64.0 - for details see the rust1.64 package</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1664366400">- Enable armv6 again - boo#1196328</changelog>
  <changelog author="william.brown@suse.com" date="1667563200">- Update to version 1.65.0 - for details see the rust1.65 package</changelog>
  <changelog author="william.brown@suse.com" date="1671192000">- Update to version 1.66.0 - for details see the rust1.66 package</changelog>
  <changelog author="william.brown@suse.com" date="1675166400">- Update to version 1.67.0 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1676376000">- Update to version 1.67.1 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1678449600">- Update to version 1.68.0 - for details see the rust1.68 package</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- Update to version 1.69.0 - for details see the rust1.69 package</changelog>
  <changelog author="william.brown@suse.com" date="1685793600">- Update to version 1.70.0 - for details see the rust1.70 package</changelog>
  <changelog author="william.brown@suse.com" date="1689595200">- Update to version 1.71.0 - for details see the rust1.71 package</changelog>
  <changelog author="william.brown@suse.com" date="1693137600">- Update to version 1.72.0 - for details see the rust1.72 package</changelog>
  <changelog author="william.brown@suse.com" date="1696593600">- Update to version 1.73.0 - for details see the rust1.73 package</changelog>
  <changelog author="william.brown@suse.com" date="1700222400">- Update to version 1.74.0 - for details see the rust1.74 package</changelog>
  <changelog author="william.brown@suse.com" date="1704110400">- Update to version 1.75.0 - for details see the rust1.75 package</changelog>
  <changelog author="william.brown@suse.com" date="1707480000">- Update to version 1.76.0 - for details see the rust1.76 package</changelog>
  <changelog author="william.brown@suse.com" date="1711454400">- Update to version 1.77.0 - for details see the rust1.77 package</changelog>
  <changelog author="william.brown@suse.com" date="1715688000">- Update to version 1.78.0 - for details see the rust1.78 package</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1718366400">- Update to version 1.79.0 - for details see the rust1.79 package</changelog>
  <changelog author="william.brown@suse.com" date="1721995200">- Update to version 1.80.0 - for details see the rust1.80 package</changelog>
</package>
<package pkgid="ed0975bb8228d08ae76750deae58f7bc14b8b2f94169a6a9f51dba58fc78db56" name="cargo" arch="s390x">
  <version epoch="0" ver="1.80.0" rel="150500.27.18.1"/>
  <changelog author="william.brown@suse.com" date="1661256000">- Update to version 1.63.0 - for details see the rust1.63 package</changelog>
  <changelog author="william.brown@suse.com" date="1664107200">- Update to version 1.64.0 - for details see the rust1.64 package</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1664366400">- Enable armv6 again - boo#1196328</changelog>
  <changelog author="william.brown@suse.com" date="1667563200">- Update to version 1.65.0 - for details see the rust1.65 package</changelog>
  <changelog author="william.brown@suse.com" date="1671192000">- Update to version 1.66.0 - for details see the rust1.66 package</changelog>
  <changelog author="william.brown@suse.com" date="1675166400">- Update to version 1.67.0 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1676376000">- Update to version 1.67.1 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1678449600">- Update to version 1.68.0 - for details see the rust1.68 package</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- Update to version 1.69.0 - for details see the rust1.69 package</changelog>
  <changelog author="william.brown@suse.com" date="1685793600">- Update to version 1.70.0 - for details see the rust1.70 package</changelog>
  <changelog author="william.brown@suse.com" date="1689595200">- Update to version 1.71.0 - for details see the rust1.71 package</changelog>
  <changelog author="william.brown@suse.com" date="1693137600">- Update to version 1.72.0 - for details see the rust1.72 package</changelog>
  <changelog author="william.brown@suse.com" date="1696593600">- Update to version 1.73.0 - for details see the rust1.73 package</changelog>
  <changelog author="william.brown@suse.com" date="1700222400">- Update to version 1.74.0 - for details see the rust1.74 package</changelog>
  <changelog author="william.brown@suse.com" date="1704110400">- Update to version 1.75.0 - for details see the rust1.75 package</changelog>
  <changelog author="william.brown@suse.com" date="1707480000">- Update to version 1.76.0 - for details see the rust1.76 package</changelog>
  <changelog author="william.brown@suse.com" date="1711454400">- Update to version 1.77.0 - for details see the rust1.77 package</changelog>
  <changelog author="william.brown@suse.com" date="1715688000">- Update to version 1.78.0 - for details see the rust1.78 package</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1718366400">- Update to version 1.79.0 - for details see the rust1.79 package</changelog>
  <changelog author="william.brown@suse.com" date="1721995200">- Update to version 1.80.0 - for details see the rust1.80 package</changelog>
</package>
<package pkgid="8c6ffd62932df989c4ea421d799f7a4b71c8856d0faa88d320fdd7e6a213d39d" name="cargo" arch="x86_64">
  <version epoch="0" ver="1.80.0" rel="150500.27.18.1"/>
  <changelog author="william.brown@suse.com" date="1661256000">- Update to version 1.63.0 - for details see the rust1.63 package</changelog>
  <changelog author="william.brown@suse.com" date="1664107200">- Update to version 1.64.0 - for details see the rust1.64 package</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1664366400">- Enable armv6 again - boo#1196328</changelog>
  <changelog author="william.brown@suse.com" date="1667563200">- Update to version 1.65.0 - for details see the rust1.65 package</changelog>
  <changelog author="william.brown@suse.com" date="1671192000">- Update to version 1.66.0 - for details see the rust1.66 package</changelog>
  <changelog author="william.brown@suse.com" date="1675166400">- Update to version 1.67.0 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1676376000">- Update to version 1.67.1 - for details see the rust1.67 package</changelog>
  <changelog author="william.brown@suse.com" date="1678449600">- Update to version 1.68.0 - for details see the rust1.68 package</changelog>
  <changelog author="william.brown@suse.com" date="1682078400">- Update to version 1.69.0 - for details see the rust1.69 package</changelog>
  <changelog author="william.brown@suse.com" date="1685793600">- Update to version 1.70.0 - for details see the rust1.70 package</changelog>
  <changelog author="william.brown@suse.com" date="1689595200">- Update to version 1.71.0 - for details see the rust1.71 package</changelog>
  <changelog author="william.brown@suse.com" date="1693137600">- Update to version 1.72.0 - for details see the rust1.72 package</changelog>
  <changelog author="william.brown@suse.com" date="1696593600">- Update to version 1.73.0 - for details see the rust1.73 package</changelog>
  <changelog author="william.brown@suse.com" date="1700222400">- Update to version 1.74.0 - for details see the rust1.74 package</changelog>
  <changelog author="william.brown@suse.com" date="1704110400">- Update to version 1.75.0 - for details see the rust1.75 package</changelog>
  <changelog author="william.brown@suse.com" date="1707480000">- Update to version 1.76.0 - for details see the rust1.76 package</changelog>
  <changelog author="william.brown@suse.com" date="1711454400">- Update to version 1.77.0 - for details see the rust1.77 package</changelog>
  <changelog author="william.brown@suse.com" date="1715688000">- Update to version 1.78.0 - for details see the rust1.78 package</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1718366400">- Update to version 1.79.0 - for details see the rust1.79 package</changelog>
  <changelog author="william.brown@suse.com" date="1721995200">- Update to version 1.80.0 - for details see the rust1.80 package</changelog>
</package>
<package pkgid="9075209bf919e83254e8e005ec430db695c8e09c4922baa8b1b12bc817e0c26f" name="cargo-auditable" arch="aarch64">
  <version epoch="0" ver="0.6.4~0" rel="150500.12.3.1"/>
  <changelog author="william.brown@suse.com" date="1667476800">- Initial commit</changelog>
  <changelog author="andrea.manzini@suse.com" date="1677153600">- Update to version 0.6.0~0:
  * README and documentation improvements
  * Read the rustc path passed by Cargo; fixes #90
  * Read location of Cargo from the environment variable Cargo sets for third-party subcommands
  * Add a note on sccache version compatibility to CHANGELOG.md
  * Panic on compilation commands where we fail to parse the arguments instead of silently ignoring the error
  * Specifying the binary-scanning feature is no longer needed
  * Pass options such as --offline to `cargo metadata`
  * Pass on arguments from `cargo auditable` invocation to the rustc wrapper; prep work towards fixing #83
  * Bump rust-audit-info to 0.5.2
  * Bump auditable-serde version to 0.5.2
  * Correctly fill in the source even in dependency entries when converting to cargo-lock data format
  * Drop the roundtrip through &amp;str in semver::Version; now that semver 1.0 has shipped the versions are API-compatible and this is no longer necessary
  * Release auditable-info 0.6.1
  * Bump all the version requirements for things depending on auditable-info
  * Fix audit_info_from_slice function signature</changelog>
  <changelog author="uncomfy+openbuildservice@uncomfyhalomacro.pl" date="1709640000">- Update specfile:
  * remove cargo_config file
- Update service file:
  * replace obsoleted "disabled" mode with "manual"
- Update to version 0.6.2~0:
  * Update the lockfile
  * New releases of cargo-auditable and auditable-serde
  * Use a separate project for the custom rustc path tests. Fixes intermittent test failures due to race conditions
  * Revert "add commit hashes to git sources"
  * Fix cyclic dependency graph being encoded
  * Revert "An unsuccessful attempt to fix cycles caused by dev-dependencies"
  * An unsuccessful attempt to fix cycles caused by dev-dependencies
  * Fix typo
  * Add comment
  * Add a test for an issue with cyclic dependencies reported at https://github.com/rustsec/rustsec/issues/1043
  * Fix auditable-serde example not building
  * upgrade dependency miniz_oxide to 0.6.0
  * fix formatting errors
  * apply clippy lints for --all-features
  * improve the internal docs and comments
  * apply clippy lints
  * add missing sources for one of test fixtures
  * add commit hashes to git sources
  * Run all tests on CI
  * cargo fmt
  * Run `cargo clean` in tests to get rid of stale binaries
  * Fix date in changelog
  * Populate changelog
  * Bump auditable-info version in rust-audit-info
  * Add auditable-info changelog
  * Bump versions following cargo-lock bump
  * auditable-serde: bump `cargo-lock` to v9
  * switch to UNRELEASED
  * Update CHANGELOG.md
  * Print a better error if calling rustc fails
  * Drop unused import
  * placate Clippy
  * Don't inject audit info if --print argument is passed to rustc
  * Reflect the version change in Cargo.lock
  * Remove space from keywords
  * bump version to 0.6.1
  * Fix date in changelog
  * Update CHANGELOG.md
  * Add publish=false
  * Commit the generated manpage
  * Add the code for generating a manpage; rather rudimentary so far, but it's a starting point
  * Explain relation to supply chain attacks
  * Add keywords to the Cargo manifest
  * Revert "generate a man page for cargo auditable"
  * fix formatting
  * fix review feedback, relocate file to under OUT_DIR, don't use anyhow and also commit the lock file
  * generate a man page for cargo auditable
  * Add Clippy suppression
  * placate clippy
  * commit Cargo.lock
  * Sync to latest object file writing code from rustc
  * Fix examples in docs
  * Allow redundant field names
  * Apply clippy suggestion: match -&gt; if let
  * Check for clippy and format in CI
  * Apply clippy suggestions
  * Run CI with --locked</changelog>
  <changelog author="william.brown@suse.com" date="1716897600">- Update to version 0.6.4~0:
  * Release cargo-auditable v0.6.4
  * Correctly attribute changelog file addition in changelog
  * Add changelog for auditable-extract
  * Verify various feature combinations in CI
  * Upgrade wasmparser to remove dependencies with `unsafe`
  * Add LoongArch support
  * cargo fmt
  * Move doc headers to README.md and point rustdoc to them, so that we have nice crates.io pages
  * Expand on the note about WebAssembly parsing
  * Populate changelogs
  * Resume bragging about all dependencies being safe, now that there is a caveat below
  * drop fuzz Cargo.lock to always fuzz against latest versions
  * Bump `cargo auditable` version
  * Mention WASM support in README
  * Revert "Be super duper extra sure both MinGW and MSVC are tested on CI"
  * Be super duper extra sure both MinGW and MSVC are tested on CI
  * Add wasm32 targets to CI for more platforms
  * Don't pass --target twice in tests
  * Install WASM toolchain in CI
  * cargo fmt
  * Add WASM end-to-end test
  * cargo fmt
  * Update documentation to mention the WASM feature
  * cargo fmt
  * Plumb WASM parsing feature through the whole stack
  * Make WASM parsing an optional, non-default feature
  * Add a fuzzing harness for WASM parsing
  * Rewritten WASM parsing to avoid heap allocations
  * Initial WASM extraction support
  * Nicer assertion
  * Drop obsolete comment
  * Clarify that embedding the compiler version has shipped.
  * Fixed section name for WASM
  * Unified and more robust platform detection. Fixed wasm build process
  * Initial WASM support
  * More robust platform detection for picking the binary format
  * Fix Windows CI to run both -msvc and -gnu
  * Use the correct link.exe flag for preserving the specified symbol even if it is unused
  * Fix Windows
  * Fix tests on Rust 1.77
  * Placate clippy
  * Oopps, I meant components field
  * Also remove the dependencies field if empty
  * Use serde_json with order preservation feature to get a more compressible JSON after workarounds
  * Work around cyclonedx-bom limitations to produce minified JSON
  * Also record the dependency kind
  * cyclonedx-bom: also record PURL
  * Also write the dependency tree
  * Clear the serial number in the minimal CycloneDX variant
  * Prototype impl of auditable2cdx
  * Fill in auditable2cdx dependencies
  * Initial auditable2cdx boilerplace
  * add #![forbid(unsafe_code)]
  * Initial implementation of auditable-to-cyclonedx conversion
  * Add the necessary dependencies to auditable-cyclonedx
  * Initial dummy package for auditable-cyclonedx</changelog>
  <changelog author="william.brown@suse.com" date="1721390400">- Depend on provides of rust to allow older compiler version usage</changelog>
  <changelog author="william.brown@suse.com" date="1721390401">- Resolve build failure when backported to 15-SP3</changelog>
</package>
<package pkgid="da5d9e38ed35e2d35286b1b30b5b2c28055237d85bbdc0956f97247953590bc3" name="cargo-auditable" arch="ppc64le">
  <version epoch="0" ver="0.6.4~0" rel="150500.12.3.1"/>
  <changelog author="william.brown@suse.com" date="1667476800">- Initial commit</changelog>
  <changelog author="andrea.manzini@suse.com" date="1677153600">- Update to version 0.6.0~0:
  * README and documentation improvements
  * Read the rustc path passed by Cargo; fixes #90
  * Read location of Cargo from the environment variable Cargo sets for third-party subcommands
  * Add a note on sccache version compatibility to CHANGELOG.md
  * Panic on compilation commands where we fail to parse the arguments instead of silently ignoring the error
  * Specifying the binary-scanning feature is no longer needed
  * Pass options such as --offline to `cargo metadata`
  * Pass on arguments from `cargo auditable` invocation to the rustc wrapper; prep work towards fixing #83
  * Bump rust-audit-info to 0.5.2
  * Bump auditable-serde version to 0.5.2
  * Correctly fill in the source even in dependency entries when converting to cargo-lock data format
  * Drop the roundtrip through &amp;str in semver::Version; now that semver 1.0 has shipped the versions are API-compatible and this is no longer necessary
  * Release auditable-info 0.6.1
  * Bump all the version requirements for things depending on auditable-info
  * Fix audit_info_from_slice function signature</changelog>
  <changelog author="uncomfy+openbuildservice@uncomfyhalomacro.pl" date="1709640000">- Update specfile:
  * remove cargo_config file
- Update service file:
  * replace obsoleted "disabled" mode with "manual"
- Update to version 0.6.2~0:
  * Update the lockfile
  * New releases of cargo-auditable and auditable-serde
  * Use a separate project for the custom rustc path tests. Fixes intermittent test failures due to race conditions
  * Revert "add commit hashes to git sources"
  * Fix cyclic dependency graph being encoded
  * Revert "An unsuccessful attempt to fix cycles caused by dev-dependencies"
  * An unsuccessful attempt to fix cycles caused by dev-dependencies
  * Fix typo
  * Add comment
  * Add a test for an issue with cyclic dependencies reported at https://github.com/rustsec/rustsec/issues/1043
  * Fix auditable-serde example not building
  * upgrade dependency miniz_oxide to 0.6.0
  * fix formatting errors
  * apply clippy lints for --all-features
  * improve the internal docs and comments
  * apply clippy lints
  * add missing sources for one of test fixtures
  * add commit hashes to git sources
  * Run all tests on CI
  * cargo fmt
  * Run `cargo clean` in tests to get rid of stale binaries
  * Fix date in changelog
  * Populate changelog
  * Bump auditable-info version in rust-audit-info
  * Add auditable-info changelog
  * Bump versions following cargo-lock bump
  * auditable-serde: bump `cargo-lock` to v9
  * switch to UNRELEASED
  * Update CHANGELOG.md
  * Print a better error if calling rustc fails
  * Drop unused import
  * placate Clippy
  * Don't inject audit info if --print argument is passed to rustc
  * Reflect the version change in Cargo.lock
  * Remove space from keywords
  * bump version to 0.6.1
  * Fix date in changelog
  * Update CHANGELOG.md
  * Add publish=false
  * Commit the generated manpage
  * Add the code for generating a manpage; rather rudimentary so far, but it's a starting point
  * Explain relation to supply chain attacks
  * Add keywords to the Cargo manifest
  * Revert "generate a man page for cargo auditable"
  * fix formatting
  * fix review feedback, relocate file to under OUT_DIR, don't use anyhow and also commit the lock file
  * generate a man page for cargo auditable
  * Add Clippy suppression
  * placate clippy
  * commit Cargo.lock
  * Sync to latest object file writing code from rustc
  * Fix examples in docs
  * Allow redundant field names
  * Apply clippy suggestion: match -&gt; if let
  * Check for clippy and format in CI
  * Apply clippy suggestions
  * Run CI with --locked</changelog>
  <changelog author="william.brown@suse.com" date="1716897600">- Update to version 0.6.4~0:
  * Release cargo-auditable v0.6.4
  * Correctly attribute changelog file addition in changelog
  * Add changelog for auditable-extract
  * Verify various feature combinations in CI
  * Upgrade wasmparser to remove dependencies with `unsafe`
  * Add LoongArch support
  * cargo fmt
  * Move doc headers to README.md and point rustdoc to them, so that we have nice crates.io pages
  * Expand on the note about WebAssembly parsing
  * Populate changelogs
  * Resume bragging about all dependencies being safe, now that there is a caveat below
  * drop fuzz Cargo.lock to always fuzz against latest versions
  * Bump `cargo auditable` version
  * Mention WASM support in README
  * Revert "Be super duper extra sure both MinGW and MSVC are tested on CI"
  * Be super duper extra sure both MinGW and MSVC are tested on CI
  * Add wasm32 targets to CI for more platforms
  * Don't pass --target twice in tests
  * Install WASM toolchain in CI
  * cargo fmt
  * Add WASM end-to-end test
  * cargo fmt
  * Update documentation to mention the WASM feature
  * cargo fmt
  * Plumb WASM parsing feature through the whole stack
  * Make WASM parsing an optional, non-default feature
  * Add a fuzzing harness for WASM parsing
  * Rewritten WASM parsing to avoid heap allocations
  * Initial WASM extraction support
  * Nicer assertion
  * Drop obsolete comment
  * Clarify that embedding the compiler version has shipped.
  * Fixed section name for WASM
  * Unified and more robust platform detection. Fixed wasm build process
  * Initial WASM support
  * More robust platform detection for picking the binary format
  * Fix Windows CI to run both -msvc and -gnu
  * Use the correct link.exe flag for preserving the specified symbol even if it is unused
  * Fix Windows
  * Fix tests on Rust 1.77
  * Placate clippy
  * Oopps, I meant components field
  * Also remove the dependencies field if empty
  * Use serde_json with order preservation feature to get a more compressible JSON after workarounds
  * Work around cyclonedx-bom limitations to produce minified JSON
  * Also record the dependency kind
  * cyclonedx-bom: also record PURL
  * Also write the dependency tree
  * Clear the serial number in the minimal CycloneDX variant
  * Prototype impl of auditable2cdx
  * Fill in auditable2cdx dependencies
  * Initial auditable2cdx boilerplace
  * add #![forbid(unsafe_code)]
  * Initial implementation of auditable-to-cyclonedx conversion
  * Add the necessary dependencies to auditable-cyclonedx
  * Initial dummy package for auditable-cyclonedx</changelog>
  <changelog author="william.brown@suse.com" date="1721390400">- Depend on provides of rust to allow older compiler version usage</changelog>
  <changelog author="william.brown@suse.com" date="1721390401">- Resolve build failure when backported to 15-SP3</changelog>
</package>
<package pkgid="e2241ad7dd50bf6ac65e1b0db22ec554177c692033a7e1bbcc478ee7a20e87c2" name="cargo-auditable" arch="s390x">
  <version epoch="0" ver="0.6.4~0" rel="150500.12.3.1"/>
  <changelog author="william.brown@suse.com" date="1667476800">- Initial commit</changelog>
  <changelog author="andrea.manzini@suse.com" date="1677153600">- Update to version 0.6.0~0:
  * README and documentation improvements
  * Read the rustc path passed by Cargo; fixes #90
  * Read location of Cargo from the environment variable Cargo sets for third-party subcommands
  * Add a note on sccache version compatibility to CHANGELOG.md
  * Panic on compilation commands where we fail to parse the arguments instead of silently ignoring the error
  * Specifying the binary-scanning feature is no longer needed
  * Pass options such as --offline to `cargo metadata`
  * Pass on arguments from `cargo auditable` invocation to the rustc wrapper; prep work towards fixing #83
  * Bump rust-audit-info to 0.5.2
  * Bump auditable-serde version to 0.5.2
  * Correctly fill in the source even in dependency entries when converting to cargo-lock data format
  * Drop the roundtrip through &amp;str in semver::Version; now that semver 1.0 has shipped the versions are API-compatible and this is no longer necessary
  * Release auditable-info 0.6.1
  * Bump all the version requirements for things depending on auditable-info
  * Fix audit_info_from_slice function signature</changelog>
  <changelog author="uncomfy+openbuildservice@uncomfyhalomacro.pl" date="1709640000">- Update specfile:
  * remove cargo_config file
- Update service file:
  * replace obsoleted "disabled" mode with "manual"
- Update to version 0.6.2~0:
  * Update the lockfile
  * New releases of cargo-auditable and auditable-serde
  * Use a separate project for the custom rustc path tests. Fixes intermittent test failures due to race conditions
  * Revert "add commit hashes to git sources"
  * Fix cyclic dependency graph being encoded
  * Revert "An unsuccessful attempt to fix cycles caused by dev-dependencies"
  * An unsuccessful attempt to fix cycles caused by dev-dependencies
  * Fix typo
  * Add comment
  * Add a test for an issue with cyclic dependencies reported at https://github.com/rustsec/rustsec/issues/1043
  * Fix auditable-serde example not building
  * upgrade dependency miniz_oxide to 0.6.0
  * fix formatting errors
  * apply clippy lints for --all-features
  * improve the internal docs and comments
  * apply clippy lints
  * add missing sources for one of test fixtures
  * add commit hashes to git sources
  * Run all tests on CI
  * cargo fmt
  * Run `cargo clean` in tests to get rid of stale binaries
  * Fix date in changelog
  * Populate changelog
  * Bump auditable-info version in rust-audit-info
  * Add auditable-info changelog
  * Bump versions following cargo-lock bump
  * auditable-serde: bump `cargo-lock` to v9
  * switch to UNRELEASED
  * Update CHANGELOG.md
  * Print a better error if calling rustc fails
  * Drop unused import
  * placate Clippy
  * Don't inject audit info if --print argument is passed to rustc
  * Reflect the version change in Cargo.lock
  * Remove space from keywords
  * bump version to 0.6.1
  * Fix date in changelog
  * Update CHANGELOG.md
  * Add publish=false
  * Commit the generated manpage
  * Add the code for generating a manpage; rather rudimentary so far, but it's a starting point
  * Explain relation to supply chain attacks
  * Add keywords to the Cargo manifest
  * Revert "generate a man page for cargo auditable"
  * fix formatting
  * fix review feedback, relocate file to under OUT_DIR, don't use anyhow and also commit the lock file
  * generate a man page for cargo auditable
  * Add Clippy suppression
  * placate clippy
  * commit Cargo.lock
  * Sync to latest object file writing code from rustc
  * Fix examples in docs
  * Allow redundant field names
  * Apply clippy suggestion: match -&gt; if let
  * Check for clippy and format in CI
  * Apply clippy suggestions
  * Run CI with --locked</changelog>
  <changelog author="william.brown@suse.com" date="1716897600">- Update to version 0.6.4~0:
  * Release cargo-auditable v0.6.4
  * Correctly attribute changelog file addition in changelog
  * Add changelog for auditable-extract
  * Verify various feature combinations in CI
  * Upgrade wasmparser to remove dependencies with `unsafe`
  * Add LoongArch support
  * cargo fmt
  * Move doc headers to README.md and point rustdoc to them, so that we have nice crates.io pages
  * Expand on the note about WebAssembly parsing
  * Populate changelogs
  * Resume bragging about all dependencies being safe, now that there is a caveat below
  * drop fuzz Cargo.lock to always fuzz against latest versions
  * Bump `cargo auditable` version
  * Mention WASM support in README
  * Revert "Be super duper extra sure both MinGW and MSVC are tested on CI"
  * Be super duper extra sure both MinGW and MSVC are tested on CI
  * Add wasm32 targets to CI for more platforms
  * Don't pass --target twice in tests
  * Install WASM toolchain in CI
  * cargo fmt
  * Add WASM end-to-end test
  * cargo fmt
  * Update documentation to mention the WASM feature
  * cargo fmt
  * Plumb WASM parsing feature through the whole stack
  * Make WASM parsing an optional, non-default feature
  * Add a fuzzing harness for WASM parsing
  * Rewritten WASM parsing to avoid heap allocations
  * Initial WASM extraction support
  * Nicer assertion
  * Drop obsolete comment
  * Clarify that embedding the compiler version has shipped.
  * Fixed section name for WASM
  * Unified and more robust platform detection. Fixed wasm build process
  * Initial WASM support
  * More robust platform detection for picking the binary format
  * Fix Windows CI to run both -msvc and -gnu
  * Use the correct link.exe flag for preserving the specified symbol even if it is unused
  * Fix Windows
  * Fix tests on Rust 1.77
  * Placate clippy
  * Oopps, I meant components field
  * Also remove the dependencies field if empty
  * Use serde_json with order preservation feature to get a more compressible JSON after workarounds
  * Work around cyclonedx-bom limitations to produce minified JSON
  * Also record the dependency kind
  * cyclonedx-bom: also record PURL
  * Also write the dependency tree
  * Clear the serial number in the minimal CycloneDX variant
  * Prototype impl of auditable2cdx
  * Fill in auditable2cdx dependencies
  * Initial auditable2cdx boilerplace
  * add #![forbid(unsafe_code)]
  * Initial implementation of auditable-to-cyclonedx conversion
  * Add the necessary dependencies to auditable-cyclonedx
  * Initial dummy package for auditable-cyclonedx</changelog>
  <changelog author="william.brown@suse.com" date="1721390400">- Depend on provides of rust to allow older compiler version usage</changelog>
  <changelog author="william.brown@suse.com" date="1721390401">- Resolve build failure when backported to 15-SP3</changelog>
</package>
<package pkgid="fcbf4bdd6d1c3f3888e9dba4bedae72513937ef15ab2e79b4f2e580dd55d539e" name="cargo-auditable" arch="src">
  <version epoch="0" ver="0.6.4~0" rel="150500.12.3.1"/>
  <changelog author="william.brown@suse.com" date="1667476800">- Initial commit</changelog>
  <changelog author="andrea.manzini@suse.com" date="1677153600">- Update to version 0.6.0~0:
  * README and documentation improvements
  * Read the rustc path passed by Cargo; fixes #90
  * Read location of Cargo from the environment variable Cargo sets for third-party subcommands
  * Add a note on sccache version compatibility to CHANGELOG.md
  * Panic on compilation commands where we fail to parse the arguments instead of silently ignoring the error
  * Specifying the binary-scanning feature is no longer needed
  * Pass options such as --offline to `cargo metadata`
  * Pass on arguments from `cargo auditable` invocation to the rustc wrapper; prep work towards fixing #83
  * Bump rust-audit-info to 0.5.2
  * Bump auditable-serde version to 0.5.2
  * Correctly fill in the source even in dependency entries when converting to cargo-lock data format
  * Drop the roundtrip through &amp;str in semver::Version; now that semver 1.0 has shipped the versions are API-compatible and this is no longer necessary
  * Release auditable-info 0.6.1
  * Bump all the version requirements for things depending on auditable-info
  * Fix audit_info_from_slice function signature</changelog>
  <changelog author="uncomfy+openbuildservice@uncomfyhalomacro.pl" date="1709640000">- Update specfile:
  * remove cargo_config file
- Update service file:
  * replace obsoleted "disabled" mode with "manual"
- Update to version 0.6.2~0:
  * Update the lockfile
  * New releases of cargo-auditable and auditable-serde
  * Use a separate project for the custom rustc path tests. Fixes intermittent test failures due to race conditions
  * Revert "add commit hashes to git sources"
  * Fix cyclic dependency graph being encoded
  * Revert "An unsuccessful attempt to fix cycles caused by dev-dependencies"
  * An unsuccessful attempt to fix cycles caused by dev-dependencies
  * Fix typo
  * Add comment
  * Add a test for an issue with cyclic dependencies reported at https://github.com/rustsec/rustsec/issues/1043
  * Fix auditable-serde example not building
  * upgrade dependency miniz_oxide to 0.6.0
  * fix formatting errors
  * apply clippy lints for --all-features
  * improve the internal docs and comments
  * apply clippy lints
  * add missing sources for one of test fixtures
  * add commit hashes to git sources
  * Run all tests on CI
  * cargo fmt
  * Run `cargo clean` in tests to get rid of stale binaries
  * Fix date in changelog
  * Populate changelog
  * Bump auditable-info version in rust-audit-info
  * Add auditable-info changelog
  * Bump versions following cargo-lock bump
  * auditable-serde: bump `cargo-lock` to v9
  * switch to UNRELEASED
  * Update CHANGELOG.md
  * Print a better error if calling rustc fails
  * Drop unused import
  * placate Clippy
  * Don't inject audit info if --print argument is passed to rustc
  * Reflect the version change in Cargo.lock
  * Remove space from keywords
  * bump version to 0.6.1
  * Fix date in changelog
  * Update CHANGELOG.md
  * Add publish=false
  * Commit the generated manpage
  * Add the code for generating a manpage; rather rudimentary so far, but it's a starting point
  * Explain relation to supply chain attacks
  * Add keywords to the Cargo manifest
  * Revert "generate a man page for cargo auditable"
  * fix formatting
  * fix review feedback, relocate file to under OUT_DIR, don't use anyhow and also commit the lock file
  * generate a man page for cargo auditable
  * Add Clippy suppression
  * placate clippy
  * commit Cargo.lock
  * Sync to latest object file writing code from rustc
  * Fix examples in docs
  * Allow redundant field names
  * Apply clippy suggestion: match -&gt; if let
  * Check for clippy and format in CI
  * Apply clippy suggestions
  * Run CI with --locked</changelog>
  <changelog author="william.brown@suse.com" date="1716897600">- Update to version 0.6.4~0:
  * Release cargo-auditable v0.6.4
  * Correctly attribute changelog file addition in changelog
  * Add changelog for auditable-extract
  * Verify various feature combinations in CI
  * Upgrade wasmparser to remove dependencies with `unsafe`
  * Add LoongArch support
  * cargo fmt
  * Move doc headers to README.md and point rustdoc to them, so that we have nice crates.io pages
  * Expand on the note about WebAssembly parsing
  * Populate changelogs
  * Resume bragging about all dependencies being safe, now that there is a caveat below
  * drop fuzz Cargo.lock to always fuzz against latest versions
  * Bump `cargo auditable` version
  * Mention WASM support in README
  * Revert "Be super duper extra sure both MinGW and MSVC are tested on CI"
  * Be super duper extra sure both MinGW and MSVC are tested on CI
  * Add wasm32 targets to CI for more platforms
  * Don't pass --target twice in tests
  * Install WASM toolchain in CI
  * cargo fmt
  * Add WASM end-to-end test
  * cargo fmt
  * Update documentation to mention the WASM feature
  * cargo fmt
  * Plumb WASM parsing feature through the whole stack
  * Make WASM parsing an optional, non-default feature
  * Add a fuzzing harness for WASM parsing
  * Rewritten WASM parsing to avoid heap allocations
  * Initial WASM extraction support
  * Nicer assertion
  * Drop obsolete comment
  * Clarify that embedding the compiler version has shipped.
  * Fixed section name for WASM
  * Unified and more robust platform detection. Fixed wasm build process
  * Initial WASM support
  * More robust platform detection for picking the binary format
  * Fix Windows CI to run both -msvc and -gnu
  * Use the correct link.exe flag for preserving the specified symbol even if it is unused
  * Fix Windows
  * Fix tests on Rust 1.77
  * Placate clippy
  * Oopps, I meant components field
  * Also remove the dependencies field if empty
  * Use serde_json with order preservation feature to get a more compressible JSON after workarounds
  * Work around cyclonedx-bom limitations to produce minified JSON
  * Also record the dependency kind
  * cyclonedx-bom: also record PURL
  * Also write the dependency tree
  * Clear the serial number in the minimal CycloneDX variant
  * Prototype impl of auditable2cdx
  * Fill in auditable2cdx dependencies
  * Initial auditable2cdx boilerplace
  * add #![forbid(unsafe_code)]
  * Initial implementation of auditable-to-cyclonedx conversion
  * Add the necessary dependencies to auditable-cyclonedx
  * Initial dummy package for auditable-cyclonedx</changelog>
  <changelog author="william.brown@suse.com" date="1721390400">- Depend on provides of rust to allow older compiler version usage</changelog>
  <changelog author="william.brown@suse.com" date="1721390401">- Resolve build failure when backported to 15-SP3</changelog>
</package>
<package pkgid="1cc7ee0568260f4148fcd2d57461d439c09e34dc8068f07cdc5806af0df6c913" name="cargo-auditable" arch="x86_64">
  <version epoch="0" ver="0.6.4~0" rel="150500.12.3.1"/>
  <changelog author="william.brown@suse.com" date="1667476800">- Initial commit</changelog>
  <changelog author="andrea.manzini@suse.com" date="1677153600">- Update to version 0.6.0~0:
  * README and documentation improvements
  * Read the rustc path passed by Cargo; fixes #90
  * Read location of Cargo from the environment variable Cargo sets for third-party subcommands
  * Add a note on sccache version compatibility to CHANGELOG.md
  * Panic on compilation commands where we fail to parse the arguments instead of silently ignoring the error
  * Specifying the binary-scanning feature is no longer needed
  * Pass options such as --offline to `cargo metadata`
  * Pass on arguments from `cargo auditable` invocation to the rustc wrapper; prep work towards fixing #83
  * Bump rust-audit-info to 0.5.2
  * Bump auditable-serde version to 0.5.2
  * Correctly fill in the source even in dependency entries when converting to cargo-lock data format
  * Drop the roundtrip through &amp;str in semver::Version; now that semver 1.0 has shipped the versions are API-compatible and this is no longer necessary
  * Release auditable-info 0.6.1
  * Bump all the version requirements for things depending on auditable-info
  * Fix audit_info_from_slice function signature</changelog>
  <changelog author="uncomfy+openbuildservice@uncomfyhalomacro.pl" date="1709640000">- Update specfile:
  * remove cargo_config file
- Update service file:
  * replace obsoleted "disabled" mode with "manual"
- Update to version 0.6.2~0:
  * Update the lockfile
  * New releases of cargo-auditable and auditable-serde
  * Use a separate project for the custom rustc path tests. Fixes intermittent test failures due to race conditions
  * Revert "add commit hashes to git sources"
  * Fix cyclic dependency graph being encoded
  * Revert "An unsuccessful attempt to fix cycles caused by dev-dependencies"
  * An unsuccessful attempt to fix cycles caused by dev-dependencies
  * Fix typo
  * Add comment
  * Add a test for an issue with cyclic dependencies reported at https://github.com/rustsec/rustsec/issues/1043
  * Fix auditable-serde example not building
  * upgrade dependency miniz_oxide to 0.6.0
  * fix formatting errors
  * apply clippy lints for --all-features
  * improve the internal docs and comments
  * apply clippy lints
  * add missing sources for one of test fixtures
  * add commit hashes to git sources
  * Run all tests on CI
  * cargo fmt
  * Run `cargo clean` in tests to get rid of stale binaries
  * Fix date in changelog
  * Populate changelog
  * Bump auditable-info version in rust-audit-info
  * Add auditable-info changelog
  * Bump versions following cargo-lock bump
  * auditable-serde: bump `cargo-lock` to v9
  * switch to UNRELEASED
  * Update CHANGELOG.md
  * Print a better error if calling rustc fails
  * Drop unused import
  * placate Clippy
  * Don't inject audit info if --print argument is passed to rustc
  * Reflect the version change in Cargo.lock
  * Remove space from keywords
  * bump version to 0.6.1
  * Fix date in changelog
  * Update CHANGELOG.md
  * Add publish=false
  * Commit the generated manpage
  * Add the code for generating a manpage; rather rudimentary so far, but it's a starting point
  * Explain relation to supply chain attacks
  * Add keywords to the Cargo manifest
  * Revert "generate a man page for cargo auditable"
  * fix formatting
  * fix review feedback, relocate file to under OUT_DIR, don't use anyhow and also commit the lock file
  * generate a man page for cargo auditable
  * Add Clippy suppression
  * placate clippy
  * commit Cargo.lock
  * Sync to latest object file writing code from rustc
  * Fix examples in docs
  * Allow redundant field names
  * Apply clippy suggestion: match -&gt; if let
  * Check for clippy and format in CI
  * Apply clippy suggestions
  * Run CI with --locked</changelog>
  <changelog author="william.brown@suse.com" date="1716897600">- Update to version 0.6.4~0:
  * Release cargo-auditable v0.6.4
  * Correctly attribute changelog file addition in changelog
  * Add changelog for auditable-extract
  * Verify various feature combinations in CI
  * Upgrade wasmparser to remove dependencies with `unsafe`
  * Add LoongArch support
  * cargo fmt
  * Move doc headers to README.md and point rustdoc to them, so that we have nice crates.io pages
  * Expand on the note about WebAssembly parsing
  * Populate changelogs
  * Resume bragging about all dependencies being safe, now that there is a caveat below
  * drop fuzz Cargo.lock to always fuzz against latest versions
  * Bump `cargo auditable` version
  * Mention WASM support in README
  * Revert "Be super duper extra sure both MinGW and MSVC are tested on CI"
  * Be super duper extra sure both MinGW and MSVC are tested on CI
  * Add wasm32 targets to CI for more platforms
  * Don't pass --target twice in tests
  * Install WASM toolchain in CI
  * cargo fmt
  * Add WASM end-to-end test
  * cargo fmt
  * Update documentation to mention the WASM feature
  * cargo fmt
  * Plumb WASM parsing feature through the whole stack
  * Make WASM parsing an optional, non-default feature
  * Add a fuzzing harness for WASM parsing
  * Rewritten WASM parsing to avoid heap allocations
  * Initial WASM extraction support
  * Nicer assertion
  * Drop obsolete comment
  * Clarify that embedding the compiler version has shipped.
  * Fixed section name for WASM
  * Unified and more robust platform detection. Fixed wasm build process
  * Initial WASM support
  * More robust platform detection for picking the binary format
  * Fix Windows CI to run both -msvc and -gnu
  * Use the correct link.exe flag for preserving the specified symbol even if it is unused
  * Fix Windows
  * Fix tests on Rust 1.77
  * Placate clippy
  * Oopps, I meant components field
  * Also remove the dependencies field if empty
  * Use serde_json with order preservation feature to get a more compressible JSON after workarounds
  * Work around cyclonedx-bom limitations to produce minified JSON
  * Also record the dependency kind
  * cyclonedx-bom: also record PURL
  * Also write the dependency tree
  * Clear the serial number in the minimal CycloneDX variant
  * Prototype impl of auditable2cdx
  * Fill in auditable2cdx dependencies
  * Initial auditable2cdx boilerplace
  * add #![forbid(unsafe_code)]
  * Initial implementation of auditable-to-cyclonedx conversion
  * Add the necessary dependencies to auditable-cyclonedx
  * Initial dummy package for auditable-cyclonedx</changelog>
  <changelog author="william.brown@suse.com" date="1721390400">- Depend on provides of rust to allow older compiler version usage</changelog>
  <changelog author="william.brown@suse.com" date="1721390401">- Resolve build failure when backported to 15-SP3</changelog>
</package>
<package pkgid="efde600d2ddc052d7e6fb056eca524c8a1f40070d7d2a32bf305eab11aeb5be8" name="cargo1.78" arch="aarch64">
  <version epoch="0" ver="1.78.0" rel="150500.11.3.1"/>
  <changelog author="william.brown@suse.com" date="1715688000">Version 1.78.0 (2024-05-02)
  Language
--------
- [Stabilize `#[cfg(target_abi = ...)]`](https://github.com/rust-lang/rust/pull/119590/)
- [Stabilize the `#[diagnostic]` namespace and `#[diagnostic::on_unimplemented]` attribute](https://github.com/rust-lang/rust/pull/119888/)
- [Make async-fn-in-trait implementable with concrete signatures](https://github.com/rust-lang/rust/pull/120103/)
- [Make matching on NaN a hard error, and remove the rest of `illegal_floating_point_literal_pattern`](https://github.com/rust-lang/rust/pull/116284/)
- [static mut: allow mutable reference to arbitrary types, not just slices and arrays](https://github.com/rust-lang/rust/pull/117614/)
- [Extend `invalid_reference_casting` to include references casting to bigger memory layout](https://github.com/rust-lang/rust/pull/118983/)
- [Add `non_contiguous_range_endpoints` lint for singleton gaps after exclusive ranges](https://github.com/rust-lang/rust/pull/118879/)
- [Add `wasm_c_abi` lint for use of older wasm-bindgen versions](https://github.com/rust-lang/rust/pull/117918/)
  This lint currently only works when using Cargo.
- [Update `indirect_structural_match` and `pointer_structural_match` lints to match RFC](https://github.com/rust-lang/rust/pull/120423/)
- [Make non-`PartialEq`-typed consts as patterns a hard error](https://github.com/rust-lang/rust/pull/120805/)
- [Split `refining_impl_trait` lint into `_reachable`, `_internal` variants](https://github.com/rust-lang/rust/pull/121720/)
- [Remove unnecessary type inference when using associated types inside of higher ranked `where`-bounds](https://github.com/rust-lang/rust/pull/119849)
- [Weaken eager detection of cyclic types during type inference](https://github.com/rust-lang/rust/pull/119989)
- [`trait Trait: Auto {}`: allow upcasting from `dyn Trait` to `dyn Auto`](https://github.com/rust-lang/rust/pull/119338)
  Compiler
--------
- [Made `INVALID_DOC_ATTRIBUTES` lint deny by default](https://github.com/rust-lang/rust/pull/111505/)
- [Increase accuracy of redundant `use` checking](https://github.com/rust-lang/rust/pull/117772/)
- [Suggest moving definition if non-found macro_rules! is defined later](https://github.com/rust-lang/rust/pull/121130/)
- [Lower transmutes from int to pointer type as gep on null](https://github.com/rust-lang/rust/pull/121282/)
  Target changes:
- [Windows tier 1 targets now require at least Windows 10](https://github.com/rust-lang/rust/pull/115141/)
  - [Enable CMPXCHG16B, SSE3, SAHF/LAHF and 128-bit Atomics in tier 1 Windows](https://github.com/rust-lang/rust/pull/120820/)
- [Add `wasm32-wasip1` tier 2 (without host tools) target](https://github.com/rust-lang/rust/pull/120468/)
- [Add `wasm32-wasip2` tier 3 target](https://github.com/rust-lang/rust/pull/119616/)
- [Rename `wasm32-wasi-preview1-threads` to `wasm32-wasip1-threads`](https://github.com/rust-lang/rust/pull/122170/)
- [Add `arm64ec-pc-windows-msvc` tier 3 target](https://github.com/rust-lang/rust/pull/119199/)
- [Add `armv8r-none-eabihf` tier 3 target for the Cortex-R52](https://github.com/rust-lang/rust/pull/110482/)
- [Add `loongarch64-unknown-linux-musl` tier 3 target](https://github.com/rust-lang/rust/pull/121832/)
  Refer to Rust's [platform support page][platform-support-doc]
  for more information on Rust's tiered platform support.
  Libraries
---------
- [Bump Unicode to version 15.1.0, regenerate tables](https://github.com/rust-lang/rust/pull/120777/)
- [Make align_offset, align_to well-behaved in all cases](https://github.com/rust-lang/rust/pull/121201/)
- [PartialEq, PartialOrd: document expectations for transitive chains](https://github.com/rust-lang/rust/pull/115386/)
- [Optimize away poison guards when std is built with panic=abort](https://github.com/rust-lang/rust/pull/100603/)
- [Replace pthread `RwLock` with custom implementation](https://github.com/rust-lang/rust/pull/110211/)
- [Implement unwind safety for Condvar on all platforms](https://github.com/rust-lang/rust/pull/121768/)
- [Add ASCII fast-path for `char::is_grapheme_extended`](https://github.com/rust-lang/rust/pull/121138/)
  Stabilized APIs
- [`impl Read for &amp;Stdin`](https://doc.rust-lang.org/stable/std/io/struct.Stdin.html#impl-Read-for-%26Stdin)
- [Accept non `'static` lifetimes for several `std::error::Error` related implementations](https://github.com/rust-lang/rust/pull/113833/)
- [Make `impl&lt;Fd: AsFd&gt;` impl take `?Sized`](https://github.com/rust-lang/rust/pull/114655/)
- [`impl From&lt;TryReserveError&gt; for io::Error`](https://doc.rust-lang.org/stable/std/io/struct.Error.html#impl-From%3CTryReserveError%3E-for-Error)
  These APIs are now stable in const contexts:
- [`Barrier::new()`](https://doc.rust-lang.org/stable/std/sync/struct.Barrier.html#method.new)
  Cargo
-----
- [Stabilize lockfile v4](https://github.com/rust-lang/cargo/pull/12852/)
- [Respect `rust-version` when generating lockfile](https://github.com/rust-lang/cargo/pull/12861/)
- [Control `--charset` via auto-detecting config value](https://github.com/rust-lang/cargo/pull/13337/)
- [Support `target.&lt;triple&gt;.rustdocflags` officially](https://github.com/rust-lang/cargo/pull/13197/)
- [Stabilize global cache data tracking](https://github.com/rust-lang/cargo/pull/13492/)
  Misc
----
- [rustdoc: add `--test-builder-wrapper` arg to support wrappers such as RUSTC_WRAPPER when building doctests](https://github.com/rust-lang/rust/pull/114651/)
  Compatibility Notes
- [Many unsafe precondition checks now run for user code with debug assertions enabled](https://github.com/rust-lang/rust/pull/120594/)
  This change helps users catch undefined behavior in their code, though the details of how much is checked are generally not stable.
- [riscv only supports split_debuginfo=off for now](https://github.com/rust-lang/rust/pull/120518/)
- [Consistently check bounds on hidden types of `impl Trait`](https://github.com/rust-lang/rust/pull/121679)
- [Change equality of higher ranked types to not rely on subtyping](https://github.com/rust-lang/rust/pull/118247)
- [When called, additionally check bounds on normalized function return type](https://github.com/rust-lang/rust/pull/118882)
- [Expand coverage for `arithmetic_overflow` lint](https://github.com/rust-lang/rust/pull/119432/)
- [Fix detection of potential interior mutability in `const` initializers](https://github.com/rust-lang/rust/issues/121250)
  This code was accidentally accepted. The fix can break generic code that borrows a value of unknown type,
  as there is currently no way to declare "this type has no interior mutability". In the future, stabilizing
  the [`Freeze` trait](https://github.com/rust-lang/rust/issues/121675) will allow proper support for such code.</changelog>
</package>
<package pkgid="d67b7313415e650b76fa09e4b6b5cef00af669db544b9bc937dcae4fc01147df" name="cargo1.78" arch="ppc64le">
  <version epoch="0" ver="1.78.0" rel="150500.11.3.1"/>
  <changelog author="william.brown@suse.com" date="1715688000">Version 1.78.0 (2024-05-02)
  Language
--------
- [Stabilize `#[cfg(target_abi = ...)]`](https://github.com/rust-lang/rust/pull/119590/)
- [Stabilize the `#[diagnostic]` namespace and `#[diagnostic::on_unimplemented]` attribute](https://github.com/rust-lang/rust/pull/119888/)
- [Make async-fn-in-trait implementable with concrete signatures](https://github.com/rust-lang/rust/pull/120103/)
- [Make matching on NaN a hard error, and remove the rest of `illegal_floating_point_literal_pattern`](https://github.com/rust-lang/rust/pull/116284/)
- [static mut: allow mutable reference to arbitrary types, not just slices and arrays](https://github.com/rust-lang/rust/pull/117614/)
- [Extend `invalid_reference_casting` to include references casting to bigger memory layout](https://github.com/rust-lang/rust/pull/118983/)
- [Add `non_contiguous_range_endpoints` lint for singleton gaps after exclusive ranges](https://github.com/rust-lang/rust/pull/118879/)
- [Add `wasm_c_abi` lint for use of older wasm-bindgen versions](https://github.com/rust-lang/rust/pull/117918/)
  This lint currently only works when using Cargo.
- [Update `indirect_structural_match` and `pointer_structural_match` lints to match RFC](https://github.com/rust-lang/rust/pull/120423/)
- [Make non-`PartialEq`-typed consts as patterns a hard error](https://github.com/rust-lang/rust/pull/120805/)
- [Split `refining_impl_trait` lint into `_reachable`, `_internal` variants](https://github.com/rust-lang/rust/pull/121720/)
- [Remove unnecessary type inference when using associated types inside of higher ranked `where`-bounds](https://github.com/rust-lang/rust/pull/119849)
- [Weaken eager detection of cyclic types during type inference](https://github.com/rust-lang/rust/pull/119989)
- [`trait Trait: Auto {}`: allow upcasting from `dyn Trait` to `dyn Auto`](https://github.com/rust-lang/rust/pull/119338)
  Compiler
--------
- [Made `INVALID_DOC_ATTRIBUTES` lint deny by default](https://github.com/rust-lang/rust/pull/111505/)
- [Increase accuracy of redundant `use` checking](https://github.com/rust-lang/rust/pull/117772/)
- [Suggest moving definition if non-found macro_rules! is defined later](https://github.com/rust-lang/rust/pull/121130/)
- [Lower transmutes from int to pointer type as gep on null](https://github.com/rust-lang/rust/pull/121282/)
  Target changes:
- [Windows tier 1 targets now require at least Windows 10](https://github.com/rust-lang/rust/pull/115141/)
  - [Enable CMPXCHG16B, SSE3, SAHF/LAHF and 128-bit Atomics in tier 1 Windows](https://github.com/rust-lang/rust/pull/120820/)
- [Add `wasm32-wasip1` tier 2 (without host tools) target](https://github.com/rust-lang/rust/pull/120468/)
- [Add `wasm32-wasip2` tier 3 target](https://github.com/rust-lang/rust/pull/119616/)
- [Rename `wasm32-wasi-preview1-threads` to `wasm32-wasip1-threads`](https://github.com/rust-lang/rust/pull/122170/)
- [Add `arm64ec-pc-windows-msvc` tier 3 target](https://github.com/rust-lang/rust/pull/119199/)
- [Add `armv8r-none-eabihf` tier 3 target for the Cortex-R52](https://github.com/rust-lang/rust/pull/110482/)
- [Add `loongarch64-unknown-linux-musl` tier 3 target](https://github.com/rust-lang/rust/pull/121832/)
  Refer to Rust's [platform support page][platform-support-doc]
  for more information on Rust's tiered platform support.
  Libraries
---------
- [Bump Unicode to version 15.1.0, regenerate tables](https://github.com/rust-lang/rust/pull/120777/)
- [Make align_offset, align_to well-behaved in all cases](https://github.com/rust-lang/rust/pull/121201/)
- [PartialEq, PartialOrd: document expectations for transitive chains](https://github.com/rust-lang/rust/pull/115386/)
- [Optimize away poison guards when std is built with panic=abort](https://github.com/rust-lang/rust/pull/100603/)
- [Replace pthread `RwLock` with custom implementation](https://github.com/rust-lang/rust/pull/110211/)
- [Implement unwind safety for Condvar on all platforms](https://github.com/rust-lang/rust/pull/121768/)
- [Add ASCII fast-path for `char::is_grapheme_extended`](https://github.com/rust-lang/rust/pull/121138/)
  Stabilized APIs
- [`impl Read for &amp;Stdin`](https://doc.rust-lang.org/stable/std/io/struct.Stdin.html#impl-Read-for-%26Stdin)
- [Accept non `'static` lifetimes for several `std::error::Error` related implementations](https://github.com/rust-lang/rust/pull/113833/)
- [Make `impl&lt;Fd: AsFd&gt;` impl take `?Sized`](https://github.com/rust-lang/rust/pull/114655/)
- [`impl From&lt;TryReserveError&gt; for io::Error`](https://doc.rust-lang.org/stable/std/io/struct.Error.html#impl-From%3CTryReserveError%3E-for-Error)
  These APIs are now stable in const contexts:
- [`Barrier::new()`](https://doc.rust-lang.org/stable/std/sync/struct.Barrier.html#method.new)
  Cargo
-----
- [Stabilize lockfile v4](https://github.com/rust-lang/cargo/pull/12852/)
- [Respect `rust-version` when generating lockfile](https://github.com/rust-lang/cargo/pull/12861/)
- [Control `--charset` via auto-detecting config value](https://github.com/rust-lang/cargo/pull/13337/)
- [Support `target.&lt;triple&gt;.rustdocflags` officially](https://github.com/rust-lang/cargo/pull/13197/)
- [Stabilize global cache data tracking](https://github.com/rust-lang/cargo/pull/13492/)
  Misc
----
- [rustdoc: add `--test-builder-wrapper` arg to support wrappers such as RUSTC_WRAPPER when building doctests](https://github.com/rust-lang/rust/pull/114651/)
  Compatibility Notes
- [Many unsafe precondition checks now run for user code with debug assertions enabled](https://github.com/rust-lang/rust/pull/120594/)
  This change helps users catch undefined behavior in their code, though the details of how much is checked are generally not stable.
- [riscv only supports split_debuginfo=off for now](https://github.com/rust-lang/rust/pull/120518/)
- [Consistently check bounds on hidden types of `impl Trait`](https://github.com/rust-lang/rust/pull/121679)
- [Change equality of higher ranked types to not rely on subtyping](https://github.com/rust-lang/rust/pull/118247)
- [When called, additionally check bounds on normalized function return type](https://github.com/rust-lang/rust/pull/118882)
- [Expand coverage for `arithmetic_overflow` lint](https://github.com/rust-lang/rust/pull/119432/)
- [Fix detection of potential interior mutability in `const` initializers](https://github.com/rust-lang/rust/issues/121250)
  This code was accidentally accepted. The fix can break generic code that borrows a value of unknown type,
  as there is currently no way to declare "this type has no interior mutability". In the future, stabilizing
  the [`Freeze` trait](https://github.com/rust-lang/rust/issues/121675) will allow proper support for such code.</changelog>
</package>
<package pkgid="36600d35db9e9a2e5efd1206ebcfe6e58bff23dbf3bae2fa4dc1645dfe1688b8" name="cargo1.78" arch="s390x">
  <version epoch="0" ver="1.78.0" rel="150500.11.3.1"/>
  <changelog author="william.brown@suse.com" date="1715688000">Version 1.78.0 (2024-05-02)
  Language
--------
- [Stabilize `#[cfg(target_abi = ...)]`](https://github.com/rust-lang/rust/pull/119590/)
- [Stabilize the `#[diagnostic]` namespace and `#[diagnostic::on_unimplemented]` attribute](https://github.com/rust-lang/rust/pull/119888/)
- [Make async-fn-in-trait implementable with concrete signatures](https://github.com/rust-lang/rust/pull/120103/)
- [Make matching on NaN a hard error, and remove the rest of `illegal_floating_point_literal_pattern`](https://github.com/rust-lang/rust/pull/116284/)
- [static mut: allow mutable reference to arbitrary types, not just slices and arrays](https://github.com/rust-lang/rust/pull/117614/)
- [Extend `invalid_reference_casting` to include references casting to bigger memory layout](https://github.com/rust-lang/rust/pull/118983/)
- [Add `non_contiguous_range_endpoints` lint for singleton gaps after exclusive ranges](https://github.com/rust-lang/rust/pull/118879/)
- [Add `wasm_c_abi` lint for use of older wasm-bindgen versions](https://github.com/rust-lang/rust/pull/117918/)
  This lint currently only works when using Cargo.
- [Update `indirect_structural_match` and `pointer_structural_match` lints to match RFC](https://github.com/rust-lang/rust/pull/120423/)
- [Make non-`PartialEq`-typed consts as patterns a hard error](https://github.com/rust-lang/rust/pull/120805/)
- [Split `refining_impl_trait` lint into `_reachable`, `_internal` variants](https://github.com/rust-lang/rust/pull/121720/)
- [Remove unnecessary type inference when using associated types inside of higher ranked `where`-bounds](https://github.com/rust-lang/rust/pull/119849)
- [Weaken eager detection of cyclic types during type inference](https://github.com/rust-lang/rust/pull/119989)
- [`trait Trait: Auto {}`: allow upcasting from `dyn Trait` to `dyn Auto`](https://github.com/rust-lang/rust/pull/119338)
  Compiler
--------
- [Made `INVALID_DOC_ATTRIBUTES` lint deny by default](https://github.com/rust-lang/rust/pull/111505/)
- [Increase accuracy of redundant `use` checking](https://github.com/rust-lang/rust/pull/117772/)
- [Suggest moving definition if non-found macro_rules! is defined later](https://github.com/rust-lang/rust/pull/121130/)
- [Lower transmutes from int to pointer type as gep on null](https://github.com/rust-lang/rust/pull/121282/)
  Target changes:
- [Windows tier 1 targets now require at least Windows 10](https://github.com/rust-lang/rust/pull/115141/)
  - [Enable CMPXCHG16B, SSE3, SAHF/LAHF and 128-bit Atomics in tier 1 Windows](https://github.com/rust-lang/rust/pull/120820/)
- [Add `wasm32-wasip1` tier 2 (without host tools) target](https://github.com/rust-lang/rust/pull/120468/)
- [Add `wasm32-wasip2` tier 3 target](https://github.com/rust-lang/rust/pull/119616/)
- [Rename `wasm32-wasi-preview1-threads` to `wasm32-wasip1-threads`](https://github.com/rust-lang/rust/pull/122170/)
- [Add `arm64ec-pc-windows-msvc` tier 3 target](https://github.com/rust-lang/rust/pull/119199/)
- [Add `armv8r-none-eabihf` tier 3 target for the Cortex-R52](https://github.com/rust-lang/rust/pull/110482/)
- [Add `loongarch64-unknown-linux-musl` tier 3 target](https://github.com/rust-lang/rust/pull/121832/)
  Refer to Rust's [platform support page][platform-support-doc]
  for more information on Rust's tiered platform support.
  Libraries
---------
- [Bump Unicode to version 15.1.0, regenerate tables](https://github.com/rust-lang/rust/pull/120777/)
- [Make align_offset, align_to well-behaved in all cases](https://github.com/rust-lang/rust/pull/121201/)
- [PartialEq, PartialOrd: document expectations for transitive chains](https://github.com/rust-lang/rust/pull/115386/)
- [Optimize away poison guards when std is built with panic=abort](https://github.com/rust-lang/rust/pull/100603/)
- [Replace pthread `RwLock` with custom implementation](https://github.com/rust-lang/rust/pull/110211/)
- [Implement unwind safety for Condvar on all platforms](https://github.com/rust-lang/rust/pull/121768/)
- [Add ASCII fast-path for `char::is_grapheme_extended`](https://github.com/rust-lang/rust/pull/121138/)
  Stabilized APIs
- [`impl Read for &amp;Stdin`](https://doc.rust-lang.org/stable/std/io/struct.Stdin.html#impl-Read-for-%26Stdin)
- [Accept non `'static` lifetimes for several `std::error::Error` related implementations](https://github.com/rust-lang/rust/pull/113833/)
- [Make `impl&lt;Fd: AsFd&gt;` impl take `?Sized`](https://github.com/rust-lang/rust/pull/114655/)
- [`impl From&lt;TryReserveError&gt; for io::Error`](https://doc.rust-lang.org/stable/std/io/struct.Error.html#impl-From%3CTryReserveError%3E-for-Error)
  These APIs are now stable in const contexts:
- [`Barrier::new()`](https://doc.rust-lang.org/stable/std/sync/struct.Barrier.html#method.new)
  Cargo
-----
- [Stabilize lockfile v4](https://github.com/rust-lang/cargo/pull/12852/)
- [Respect `rust-version` when generating lockfile](https://github.com/rust-lang/cargo/pull/12861/)
- [Control `--charset` via auto-detecting config value](https://github.com/rust-lang/cargo/pull/13337/)
- [Support `target.&lt;triple&gt;.rustdocflags` officially](https://github.com/rust-lang/cargo/pull/13197/)
- [Stabilize global cache data tracking](https://github.com/rust-lang/cargo/pull/13492/)
  Misc
----
- [rustdoc: add `--test-builder-wrapper` arg to support wrappers such as RUSTC_WRAPPER when building doctests](https://github.com/rust-lang/rust/pull/114651/)
  Compatibility Notes
- [Many unsafe precondition checks now run for user code with debug assertions enabled](https://github.com/rust-lang/rust/pull/120594/)
  This change helps users catch undefined behavior in their code, though the details of how much is checked are generally not stable.
- [riscv only supports split_debuginfo=off for now](https://github.com/rust-lang/rust/pull/120518/)
- [Consistently check bounds on hidden types of `impl Trait`](https://github.com/rust-lang/rust/pull/121679)
- [Change equality of higher ranked types to not rely on subtyping](https://github.com/rust-lang/rust/pull/118247)
- [When called, additionally check bounds on normalized function return type](https://github.com/rust-lang/rust/pull/118882)
- [Expand coverage for `arithmetic_overflow` lint](https://github.com/rust-lang/rust/pull/119432/)
- [Fix detection of potential interior mutability in `const` initializers](https://github.com/rust-lang/rust/issues/121250)
  This code was accidentally accepted. The fix can break generic code that borrows a value of unknown type,
  as there is currently no way to declare "this type has no interior mutability". In the future, stabilizing
  the [`Freeze` trait](https://github.com/rust-lang/rust/issues/121675) will allow proper support for such code.</changelog>
</package>
<package pkgid="723efe343407d00c043abdc7214cd479d2e2f163e20478f31a6c47e7a8db099b" name="cargo1.78" arch="x86_64">
  <version epoch="0" ver="1.78.0" rel="150500.11.3.1"/>
  <changelog author="william.brown@suse.com" date="1715688000">Version 1.78.0 (2024-05-02)
  Language
--------
- [Stabilize `#[cfg(target_abi = ...)]`](https://github.com/rust-lang/rust/pull/119590/)
- [Stabilize the `#[diagnostic]` namespace and `#[diagnostic::on_unimplemented]` attribute](https://github.com/rust-lang/rust/pull/119888/)
- [Make async-fn-in-trait implementable with concrete signatures](https://github.com/rust-lang/rust/pull/120103/)
- [Make matching on NaN a hard error, and remove the rest of `illegal_floating_point_literal_pattern`](https://github.com/rust-lang/rust/pull/116284/)
- [static mut: allow mutable reference to arbitrary types, not just slices and arrays](https://github.com/rust-lang/rust/pull/117614/)
- [Extend `invalid_reference_casting` to include references casting to bigger memory layout](https://github.com/rust-lang/rust/pull/118983/)
- [Add `non_contiguous_range_endpoints` lint for singleton gaps after exclusive ranges](https://github.com/rust-lang/rust/pull/118879/)
- [Add `wasm_c_abi` lint for use of older wasm-bindgen versions](https://github.com/rust-lang/rust/pull/117918/)
  This lint currently only works when using Cargo.
- [Update `indirect_structural_match` and `pointer_structural_match` lints to match RFC](https://github.com/rust-lang/rust/pull/120423/)
- [Make non-`PartialEq`-typed consts as patterns a hard error](https://github.com/rust-lang/rust/pull/120805/)
- [Split `refining_impl_trait` lint into `_reachable`, `_internal` variants](https://github.com/rust-lang/rust/pull/121720/)
- [Remove unnecessary type inference when using associated types inside of higher ranked `where`-bounds](https://github.com/rust-lang/rust/pull/119849)
- [Weaken eager detection of cyclic types during type inference](https://github.com/rust-lang/rust/pull/119989)
- [`trait Trait: Auto {}`: allow upcasting from `dyn Trait` to `dyn Auto`](https://github.com/rust-lang/rust/pull/119338)
  Compiler
--------
- [Made `INVALID_DOC_ATTRIBUTES` lint deny by default](https://github.com/rust-lang/rust/pull/111505/)
- [Increase accuracy of redundant `use` checking](https://github.com/rust-lang/rust/pull/117772/)
- [Suggest moving definition if non-found macro_rules! is defined later](https://github.com/rust-lang/rust/pull/121130/)
- [Lower transmutes from int to pointer type as gep on null](https://github.com/rust-lang/rust/pull/121282/)
  Target changes:
- [Windows tier 1 targets now require at least Windows 10](https://github.com/rust-lang/rust/pull/115141/)
  - [Enable CMPXCHG16B, SSE3, SAHF/LAHF and 128-bit Atomics in tier 1 Windows](https://github.com/rust-lang/rust/pull/120820/)
- [Add `wasm32-wasip1` tier 2 (without host tools) target](https://github.com/rust-lang/rust/pull/120468/)
- [Add `wasm32-wasip2` tier 3 target](https://github.com/rust-lang/rust/pull/119616/)
- [Rename `wasm32-wasi-preview1-threads` to `wasm32-wasip1-threads`](https://github.com/rust-lang/rust/pull/122170/)
- [Add `arm64ec-pc-windows-msvc` tier 3 target](https://github.com/rust-lang/rust/pull/119199/)
- [Add `armv8r-none-eabihf` tier 3 target for the Cortex-R52](https://github.com/rust-lang/rust/pull/110482/)
- [Add `loongarch64-unknown-linux-musl` tier 3 target](https://github.com/rust-lang/rust/pull/121832/)
  Refer to Rust's [platform support page][platform-support-doc]
  for more information on Rust's tiered platform support.
  Libraries
---------
- [Bump Unicode to version 15.1.0, regenerate tables](https://github.com/rust-lang/rust/pull/120777/)
- [Make align_offset, align_to well-behaved in all cases](https://github.com/rust-lang/rust/pull/121201/)
- [PartialEq, PartialOrd: document expectations for transitive chains](https://github.com/rust-lang/rust/pull/115386/)
- [Optimize away poison guards when std is built with panic=abort](https://github.com/rust-lang/rust/pull/100603/)
- [Replace pthread `RwLock` with custom implementation](https://github.com/rust-lang/rust/pull/110211/)
- [Implement unwind safety for Condvar on all platforms](https://github.com/rust-lang/rust/pull/121768/)
- [Add ASCII fast-path for `char::is_grapheme_extended`](https://github.com/rust-lang/rust/pull/121138/)
  Stabilized APIs
- [`impl Read for &amp;Stdin`](https://doc.rust-lang.org/stable/std/io/struct.Stdin.html#impl-Read-for-%26Stdin)
- [Accept non `'static` lifetimes for several `std::error::Error` related implementations](https://github.com/rust-lang/rust/pull/113833/)
- [Make `impl&lt;Fd: AsFd&gt;` impl take `?Sized`](https://github.com/rust-lang/rust/pull/114655/)
- [`impl From&lt;TryReserveError&gt; for io::Error`](https://doc.rust-lang.org/stable/std/io/struct.Error.html#impl-From%3CTryReserveError%3E-for-Error)
  These APIs are now stable in const contexts:
- [`Barrier::new()`](https://doc.rust-lang.org/stable/std/sync/struct.Barrier.html#method.new)
  Cargo
-----
- [Stabilize lockfile v4](https://github.com/rust-lang/cargo/pull/12852/)
- [Respect `rust-version` when generating lockfile](https://github.com/rust-lang/cargo/pull/12861/)
- [Control `--charset` via auto-detecting config value](https://github.com/rust-lang/cargo/pull/13337/)
- [Support `target.&lt;triple&gt;.rustdocflags` officially](https://github.com/rust-lang/cargo/pull/13197/)
- [Stabilize global cache data tracking](https://github.com/rust-lang/cargo/pull/13492/)
  Misc
----
- [rustdoc: add `--test-builder-wrapper` arg to support wrappers such as RUSTC_WRAPPER when building doctests](https://github.com/rust-lang/rust/pull/114651/)
  Compatibility Notes
- [Many unsafe precondition checks now run for user code with debug assertions enabled](https://github.com/rust-lang/rust/pull/120594/)
  This change helps users catch undefined behavior in their code, though the details of how much is checked are generally not stable.
- [riscv only supports split_debuginfo=off for now](https://github.com/rust-lang/rust/pull/120518/)
- [Consistently check bounds on hidden types of `impl Trait`](https://github.com/rust-lang/rust/pull/121679)
- [Change equality of higher ranked types to not rely on subtyping](https://github.com/rust-lang/rust/pull/118247)
- [When called, additionally check bounds on normalized function return type](https://github.com/rust-lang/rust/pull/118882)
- [Expand coverage for `arithmetic_overflow` lint](https://github.com/rust-lang/rust/pull/119432/)
- [Fix detection of potential interior mutability in `const` initializers](https://github.com/rust-lang/rust/issues/121250)
  This code was accidentally accepted. The fix can break generic code that borrows a value of unknown type,
  as there is currently no way to declare "this type has no interior mutability". In the future, stabilizing
  the [`Freeze` trait](https://github.com/rust-lang/rust/issues/121675) will allow proper support for such code.</changelog>
</package>
<package pkgid="3a151083ace8a5a101824157227d030ae5b192f1e098fc95941ad1d113c4201e" name="cargo1.79" arch="aarch64">
  <version epoch="0" ver="1.79.0" rel="150500.11.3.1"/>
  <changelog author="xiaoguang.wang@suse.com" date="1718366400">Version 1.79.0 (2024-06-13)
  Language
--------
- [Stabilize inline `const {}` expressions.](https://github.com/rust-lang/rust/pull/104087/)
- [Prevent opaque types being instantiated twice with different regions within the same function.](https://github.com/rust-lang/rust/pull/116935/)
- [Stabilize WebAssembly target features that are in phase 4 and 5.](https://github.com/rust-lang/rust/pull/117457/)
- [Add the `redundant_lifetimes` lint to detect lifetimes which are semantically redundant.](https://github.com/rust-lang/rust/pull/118391/)
- [Stabilize the `unnameable_types` lint for public types that can't be named.](https://github.com/rust-lang/rust/pull/120144/)
- [Enable debuginfo in macros, and stabilize `-C collapse-macro-debuginfo` and `#[collapse_debuginfo]`.](https://github.com/rust-lang/rust/pull/120845/)
- [Propagate temporary lifetime extension into `if` and `match` expressions.](https://github.com/rust-lang/rust/pull/121346/)
- [Restrict promotion of `const fn` calls.](https://github.com/rust-lang/rust/pull/121557/)
- [Warn against refining impls of crate-private traits with `refining_impl_trait` lint.](https://github.com/rust-lang/rust/pull/121720/)
- [Stabilize associated type bounds (RFC 2289).](https://github.com/rust-lang/rust/pull/122055/)
- [Stabilize importing `main` from other modules or crates.](https://github.com/rust-lang/rust/pull/122060/)
- [Check return types of function types for well-formedness](https://github.com/rust-lang/rust/pull/115538)
- [Rework `impl Trait` lifetime inference](https://github.com/rust-lang/rust/pull/116891/)
- [Change inductive trait solver cycles to be ambiguous](https://github.com/rust-lang/rust/pull/122791)
  Compiler
--------
- [Define `-C strip` to only affect binaries, not artifacts like `.pdb`.](https://github.com/rust-lang/rust/pull/115120/)
- [Stabilize `-Crelro-level` for controlling runtime link hardening.](https://github.com/rust-lang/rust/pull/121694/)
- [Stabilize checking of `cfg` names and values at compile-time with `--check-cfg`.](https://github.com/rust-lang/rust/pull/123501/)
  * Note that this only stabilizes the compiler part, the Cargo part is still unstable in this release.*
- [Add `aarch64-apple-visionos` and `aarch64-apple-visionos-sim` tier 3 targets.](https://github.com/rust-lang/rust/pull/121419/)
- [Add `riscv32ima-unknown-none-elf` tier 3 target.](https://github.com/rust-lang/rust/pull/122696/)
- [Promote several Windows targets to tier 2](https://github.com/rust-lang/rust/pull/121712): `aarch64-pc-windows-gnullvm`, `i686-pc-windows-gnullvm`, and `x86_64-pc-windows-gnullvm`.
  Refer to Rust's [platform support page][platform-support-doc]
  for more information on Rust's tiered platform support.
  Libraries
---------
- [Implement `FromIterator` for `(impl Default + Extend, impl Default + Extend)`.](https://github.com/rust-lang/rust/pull/107462/)
- [Implement `{Div,Rem}Assign&lt;NonZero&lt;X&gt;&gt;` on `X`.](https://github.com/rust-lang/rust/pull/121952/)
- [Document overrides of `clone_from()` in core/std.](https://github.com/rust-lang/rust/pull/122201/)
- [Link MSVC default lib in core.](https://github.com/rust-lang/rust/pull/122268/)
- [Caution against using `transmute` between pointers and integers.](https://github.com/rust-lang/rust/pull/122379/)
- [Enable frame pointers for the standard library.](https://github.com/rust-lang/rust/pull/122646/)
  Stabilized APIs
- [`{integer}::unchecked_add`](https://doc.rust-lang.org/stable/core/primitive.i32.html#method.unchecked_add)
- [`{integer}::unchecked_mul`](https://doc.rust-lang.org/stable/core/primitive.i32.html#method.unchecked_mul)
- [`{integer}::unchecked_sub`](https://doc.rust-lang.org/stable/core/primitive.i32.html#method.unchecked_sub)
- [`&lt;[T]&gt;::split_at_unchecked`](https://doc.rust-lang.org/stable/core/primitive.slice.html#method.split_at_unchecked)
- [`&lt;[T]&gt;::split_at_mut_unchecked`](https://doc.rust-lang.org/stable/core/primitive.slice.html#method.split_at_mut_unchecked)
- [`&lt;[u8]&gt;::utf8_chunks`](https://doc.rust-lang.org/stable/core/primitive.slice.html#method.utf8_chunks)
- [`str::Utf8Chunks`](https://doc.rust-lang.org/stable/core/str/struct.Utf8Chunks.html)
- [`str::Utf8Chunk`](https://doc.rust-lang.org/stable/core/str/struct.Utf8Chunk.html)
- [`&lt;*const T&gt;::is_aligned`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.is_aligned)
- [`&lt;*mut T&gt;::is_aligned`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.is_aligned-1)
- [`NonNull::is_aligned`](https://doc.rust-lang.org/stable/core/ptr/struct.NonNull.html#method.is_aligned)
- [`&lt;*const [T]&gt;::len`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.len)
- [`&lt;*mut [T]&gt;::len`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.len-1)
- [`&lt;*const [T]&gt;::is_empty`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.is_empty)
- [`&lt;*mut [T]&gt;::is_empty`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.is_empty-1)
- [`NonNull::&lt;[T]&gt;::is_empty`](https://doc.rust-lang.org/stable/core/ptr/struct.NonNull.html#method.is_empty)
- [`CStr::count_bytes`](https://doc.rust-lang.org/stable/core/ffi/c_str/struct.CStr.html#method.count_bytes)
- [`io::Error::downcast`](https://doc.rust-lang.org/stable/std/io/struct.Error.html#method.downcast)
- [`num::NonZero&lt;T&gt;`](https://doc.rust-lang.org/stable/core/num/struct.NonZero.html)
- [`path::absolute`](https://doc.rust-lang.org/stable/std/path/fn.absolute.html)
- [`proc_macro::Literal::byte_character`](https://doc.rust-lang.org/stable/proc_macro/struct.Literal.html#method.byte_character)
- [`proc_macro::Literal::c_string`](https://doc.rust-lang.org/stable/proc_macro/struct.Literal.html#method.c_string)
  These APIs are now stable in const contexts:
- [`Atomic*::into_inner`](https://doc.rust-lang.org/stable/core/sync/atomic/struct.AtomicUsize.html#method.into_inner)
- [`io::Cursor::new`](https://doc.rust-lang.org/stable/std/io/struct.Cursor.html#method.new)
- [`io::Cursor::get_ref`](https://doc.rust-lang.org/stable/std/io/struct.Cursor.html#method.get_ref)
- [`io::Cursor::position`](https://doc.rust-lang.org/stable/std/io/struct.Cursor.html#method.position)
- [`io::empty`](https://doc.rust-lang.org/stable/std/io/fn.empty.html)
- [`io::repeat`](https://doc.rust-lang.org/stable/std/io/fn.repeat.html)
- [`io::sink`](https://doc.rust-lang.org/stable/std/io/fn.sink.html)
- [`panic::Location::caller`](https://doc.rust-lang.org/stable/std/panic/struct.Location.html#method.caller)
- [`panic::Location::file`](https://doc.rust-lang.org/stable/std/panic/struct.Location.html#method.file)
- [`panic::Location::line`](https://doc.rust-lang.org/stable/std/panic/struct.Location.html#method.line)
- [`panic::Location::column`](https://doc.rust-lang.org/stable/std/panic/struct.Location.html#method.column)
  Cargo
-----
- [Prevent dashes in `lib.name`, always normalizing to `_`.](https://github.com/rust-lang/cargo/pull/12783/)
- [Stabilize MSRV-aware version requirement selection in `cargo add`.](https://github.com/rust-lang/cargo/pull/13608/)
- [Switch to using `gitoxide` by default for listing files.](https://github.com/rust-lang/cargo/pull/13696/)
- [Error on `[project]` in Edition 2024; `cargo fix --edition` will change it to `[package]`.](https://github.com/rust-lang/cargo/pull/13747/)
  Rustdoc
-----
- [Always display stability version even if it's the same as the containing item.](https://github.com/rust-lang/rust/pull/118441/)
- [Show a single search result for items with multiple paths.](https://github.com/rust-lang/rust/pull/119912/)
- [Support typing `/` in docs to begin a search.](https://github.com/rust-lang/rust/pull/123355/)
  Misc
----
  Compatibility Notes
- [Update the minimum external LLVM to 17.](https://github.com/rust-lang/rust/pull/122649/)
- [`RustcEncodable` and `RustcDecodable` are soft-destabilized, to be removed
  from the prelude in next edition.](https://github.com/rust-lang/rust/pull/116016/)
- [The `wasm_c_abi` future-incompatibility lint will warn about use of the
  non-spec-compliant C ABI.](https://github.com/rust-lang/rust/pull/117918/)
  Use `wasm-bindgen v0.2.88` to generate forward-compatible bindings.
- [Check return types of function types for well-formedness](https://github.com/rust-lang/rust/pull/115538)</changelog>
</package>
<package pkgid="01575d3bf378fad5c2f7a58e3dc733a666bfe6622c2779bded1b8136a4276fb3" name="cargo1.79" arch="ppc64le">
  <version epoch="0" ver="1.79.0" rel="150500.11.3.1"/>
  <changelog author="xiaoguang.wang@suse.com" date="1718366400">Version 1.79.0 (2024-06-13)
  Language
--------
- [Stabilize inline `const {}` expressions.](https://github.com/rust-lang/rust/pull/104087/)
- [Prevent opaque types being instantiated twice with different regions within the same function.](https://github.com/rust-lang/rust/pull/116935/)
- [Stabilize WebAssembly target features that are in phase 4 and 5.](https://github.com/rust-lang/rust/pull/117457/)
- [Add the `redundant_lifetimes` lint to detect lifetimes which are semantically redundant.](https://github.com/rust-lang/rust/pull/118391/)
- [Stabilize the `unnameable_types` lint for public types that can't be named.](https://github.com/rust-lang/rust/pull/120144/)
- [Enable debuginfo in macros, and stabilize `-C collapse-macro-debuginfo` and `#[collapse_debuginfo]`.](https://github.com/rust-lang/rust/pull/120845/)
- [Propagate temporary lifetime extension into `if` and `match` expressions.](https://github.com/rust-lang/rust/pull/121346/)
- [Restrict promotion of `const fn` calls.](https://github.com/rust-lang/rust/pull/121557/)
- [Warn against refining impls of crate-private traits with `refining_impl_trait` lint.](https://github.com/rust-lang/rust/pull/121720/)
- [Stabilize associated type bounds (RFC 2289).](https://github.com/rust-lang/rust/pull/122055/)
- [Stabilize importing `main` from other modules or crates.](https://github.com/rust-lang/rust/pull/122060/)
- [Check return types of function types for well-formedness](https://github.com/rust-lang/rust/pull/115538)
- [Rework `impl Trait` lifetime inference](https://github.com/rust-lang/rust/pull/116891/)
- [Change inductive trait solver cycles to be ambiguous](https://github.com/rust-lang/rust/pull/122791)
  Compiler
--------
- [Define `-C strip` to only affect binaries, not artifacts like `.pdb`.](https://github.com/rust-lang/rust/pull/115120/)
- [Stabilize `-Crelro-level` for controlling runtime link hardening.](https://github.com/rust-lang/rust/pull/121694/)
- [Stabilize checking of `cfg` names and values at compile-time with `--check-cfg`.](https://github.com/rust-lang/rust/pull/123501/)
  * Note that this only stabilizes the compiler part, the Cargo part is still unstable in this release.*
- [Add `aarch64-apple-visionos` and `aarch64-apple-visionos-sim` tier 3 targets.](https://github.com/rust-lang/rust/pull/121419/)
- [Add `riscv32ima-unknown-none-elf` tier 3 target.](https://github.com/rust-lang/rust/pull/122696/)
- [Promote several Windows targets to tier 2](https://github.com/rust-lang/rust/pull/121712): `aarch64-pc-windows-gnullvm`, `i686-pc-windows-gnullvm`, and `x86_64-pc-windows-gnullvm`.
  Refer to Rust's [platform support page][platform-support-doc]
  for more information on Rust's tiered platform support.
  Libraries
---------
- [Implement `FromIterator` for `(impl Default + Extend, impl Default + Extend)`.](https://github.com/rust-lang/rust/pull/107462/)
- [Implement `{Div,Rem}Assign&lt;NonZero&lt;X&gt;&gt;` on `X`.](https://github.com/rust-lang/rust/pull/121952/)
- [Document overrides of `clone_from()` in core/std.](https://github.com/rust-lang/rust/pull/122201/)
- [Link MSVC default lib in core.](https://github.com/rust-lang/rust/pull/122268/)
- [Caution against using `transmute` between pointers and integers.](https://github.com/rust-lang/rust/pull/122379/)
- [Enable frame pointers for the standard library.](https://github.com/rust-lang/rust/pull/122646/)
  Stabilized APIs
- [`{integer}::unchecked_add`](https://doc.rust-lang.org/stable/core/primitive.i32.html#method.unchecked_add)
- [`{integer}::unchecked_mul`](https://doc.rust-lang.org/stable/core/primitive.i32.html#method.unchecked_mul)
- [`{integer}::unchecked_sub`](https://doc.rust-lang.org/stable/core/primitive.i32.html#method.unchecked_sub)
- [`&lt;[T]&gt;::split_at_unchecked`](https://doc.rust-lang.org/stable/core/primitive.slice.html#method.split_at_unchecked)
- [`&lt;[T]&gt;::split_at_mut_unchecked`](https://doc.rust-lang.org/stable/core/primitive.slice.html#method.split_at_mut_unchecked)
- [`&lt;[u8]&gt;::utf8_chunks`](https://doc.rust-lang.org/stable/core/primitive.slice.html#method.utf8_chunks)
- [`str::Utf8Chunks`](https://doc.rust-lang.org/stable/core/str/struct.Utf8Chunks.html)
- [`str::Utf8Chunk`](https://doc.rust-lang.org/stable/core/str/struct.Utf8Chunk.html)
- [`&lt;*const T&gt;::is_aligned`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.is_aligned)
- [`&lt;*mut T&gt;::is_aligned`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.is_aligned-1)
- [`NonNull::is_aligned`](https://doc.rust-lang.org/stable/core/ptr/struct.NonNull.html#method.is_aligned)
- [`&lt;*const [T]&gt;::len`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.len)
- [`&lt;*mut [T]&gt;::len`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.len-1)
- [`&lt;*const [T]&gt;::is_empty`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.is_empty)
- [`&lt;*mut [T]&gt;::is_empty`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.is_empty-1)
- [`NonNull::&lt;[T]&gt;::is_empty`](https://doc.rust-lang.org/stable/core/ptr/struct.NonNull.html#method.is_empty)
- [`CStr::count_bytes`](https://doc.rust-lang.org/stable/core/ffi/c_str/struct.CStr.html#method.count_bytes)
- [`io::Error::downcast`](https://doc.rust-lang.org/stable/std/io/struct.Error.html#method.downcast)
- [`num::NonZero&lt;T&gt;`](https://doc.rust-lang.org/stable/core/num/struct.NonZero.html)
- [`path::absolute`](https://doc.rust-lang.org/stable/std/path/fn.absolute.html)
- [`proc_macro::Literal::byte_character`](https://doc.rust-lang.org/stable/proc_macro/struct.Literal.html#method.byte_character)
- [`proc_macro::Literal::c_string`](https://doc.rust-lang.org/stable/proc_macro/struct.Literal.html#method.c_string)
  These APIs are now stable in const contexts:
- [`Atomic*::into_inner`](https://doc.rust-lang.org/stable/core/sync/atomic/struct.AtomicUsize.html#method.into_inner)
- [`io::Cursor::new`](https://doc.rust-lang.org/stable/std/io/struct.Cursor.html#method.new)
- [`io::Cursor::get_ref`](https://doc.rust-lang.org/stable/std/io/struct.Cursor.html#method.get_ref)
- [`io::Cursor::position`](https://doc.rust-lang.org/stable/std/io/struct.Cursor.html#method.position)
- [`io::empty`](https://doc.rust-lang.org/stable/std/io/fn.empty.html)
- [`io::repeat`](https://doc.rust-lang.org/stable/std/io/fn.repeat.html)
- [`io::sink`](https://doc.rust-lang.org/stable/std/io/fn.sink.html)
- [`panic::Location::caller`](https://doc.rust-lang.org/stable/std/panic/struct.Location.html#method.caller)
- [`panic::Location::file`](https://doc.rust-lang.org/stable/std/panic/struct.Location.html#method.file)
- [`panic::Location::line`](https://doc.rust-lang.org/stable/std/panic/struct.Location.html#method.line)
- [`panic::Location::column`](https://doc.rust-lang.org/stable/std/panic/struct.Location.html#method.column)
  Cargo
-----
- [Prevent dashes in `lib.name`, always normalizing to `_`.](https://github.com/rust-lang/cargo/pull/12783/)
- [Stabilize MSRV-aware version requirement selection in `cargo add`.](https://github.com/rust-lang/cargo/pull/13608/)
- [Switch to using `gitoxide` by default for listing files.](https://github.com/rust-lang/cargo/pull/13696/)
- [Error on `[project]` in Edition 2024; `cargo fix --edition` will change it to `[package]`.](https://github.com/rust-lang/cargo/pull/13747/)
  Rustdoc
-----
- [Always display stability version even if it's the same as the containing item.](https://github.com/rust-lang/rust/pull/118441/)
- [Show a single search result for items with multiple paths.](https://github.com/rust-lang/rust/pull/119912/)
- [Support typing `/` in docs to begin a search.](https://github.com/rust-lang/rust/pull/123355/)
  Misc
----
  Compatibility Notes
- [Update the minimum external LLVM to 17.](https://github.com/rust-lang/rust/pull/122649/)
- [`RustcEncodable` and `RustcDecodable` are soft-destabilized, to be removed
  from the prelude in next edition.](https://github.com/rust-lang/rust/pull/116016/)
- [The `wasm_c_abi` future-incompatibility lint will warn about use of the
  non-spec-compliant C ABI.](https://github.com/rust-lang/rust/pull/117918/)
  Use `wasm-bindgen v0.2.88` to generate forward-compatible bindings.
- [Check return types of function types for well-formedness](https://github.com/rust-lang/rust/pull/115538)</changelog>
</package>
<package pkgid="06c209d2e6509198a897d824604a9f54283568453328c5bb337db0b1ccdc3972" name="cargo1.79" arch="s390x">
  <version epoch="0" ver="1.79.0" rel="150500.11.3.1"/>
  <changelog author="xiaoguang.wang@suse.com" date="1718366400">Version 1.79.0 (2024-06-13)
  Language
--------
- [Stabilize inline `const {}` expressions.](https://github.com/rust-lang/rust/pull/104087/)
- [Prevent opaque types being instantiated twice with different regions within the same function.](https://github.com/rust-lang/rust/pull/116935/)
- [Stabilize WebAssembly target features that are in phase 4 and 5.](https://github.com/rust-lang/rust/pull/117457/)
- [Add the `redundant_lifetimes` lint to detect lifetimes which are semantically redundant.](https://github.com/rust-lang/rust/pull/118391/)
- [Stabilize the `unnameable_types` lint for public types that can't be named.](https://github.com/rust-lang/rust/pull/120144/)
- [Enable debuginfo in macros, and stabilize `-C collapse-macro-debuginfo` and `#[collapse_debuginfo]`.](https://github.com/rust-lang/rust/pull/120845/)
- [Propagate temporary lifetime extension into `if` and `match` expressions.](https://github.com/rust-lang/rust/pull/121346/)
- [Restrict promotion of `const fn` calls.](https://github.com/rust-lang/rust/pull/121557/)
- [Warn against refining impls of crate-private traits with `refining_impl_trait` lint.](https://github.com/rust-lang/rust/pull/121720/)
- [Stabilize associated type bounds (RFC 2289).](https://github.com/rust-lang/rust/pull/122055/)
- [Stabilize importing `main` from other modules or crates.](https://github.com/rust-lang/rust/pull/122060/)
- [Check return types of function types for well-formedness](https://github.com/rust-lang/rust/pull/115538)
- [Rework `impl Trait` lifetime inference](https://github.com/rust-lang/rust/pull/116891/)
- [Change inductive trait solver cycles to be ambiguous](https://github.com/rust-lang/rust/pull/122791)
  Compiler
--------
- [Define `-C strip` to only affect binaries, not artifacts like `.pdb`.](https://github.com/rust-lang/rust/pull/115120/)
- [Stabilize `-Crelro-level` for controlling runtime link hardening.](https://github.com/rust-lang/rust/pull/121694/)
- [Stabilize checking of `cfg` names and values at compile-time with `--check-cfg`.](https://github.com/rust-lang/rust/pull/123501/)
  * Note that this only stabilizes the compiler part, the Cargo part is still unstable in this release.*
- [Add `aarch64-apple-visionos` and `aarch64-apple-visionos-sim` tier 3 targets.](https://github.com/rust-lang/rust/pull/121419/)
- [Add `riscv32ima-unknown-none-elf` tier 3 target.](https://github.com/rust-lang/rust/pull/122696/)
- [Promote several Windows targets to tier 2](https://github.com/rust-lang/rust/pull/121712): `aarch64-pc-windows-gnullvm`, `i686-pc-windows-gnullvm`, and `x86_64-pc-windows-gnullvm`.
  Refer to Rust's [platform support page][platform-support-doc]
  for more information on Rust's tiered platform support.
  Libraries
---------
- [Implement `FromIterator` for `(impl Default + Extend, impl Default + Extend)`.](https://github.com/rust-lang/rust/pull/107462/)
- [Implement `{Div,Rem}Assign&lt;NonZero&lt;X&gt;&gt;` on `X`.](https://github.com/rust-lang/rust/pull/121952/)
- [Document overrides of `clone_from()` in core/std.](https://github.com/rust-lang/rust/pull/122201/)
- [Link MSVC default lib in core.](https://github.com/rust-lang/rust/pull/122268/)
- [Caution against using `transmute` between pointers and integers.](https://github.com/rust-lang/rust/pull/122379/)
- [Enable frame pointers for the standard library.](https://github.com/rust-lang/rust/pull/122646/)
  Stabilized APIs
- [`{integer}::unchecked_add`](https://doc.rust-lang.org/stable/core/primitive.i32.html#method.unchecked_add)
- [`{integer}::unchecked_mul`](https://doc.rust-lang.org/stable/core/primitive.i32.html#method.unchecked_mul)
- [`{integer}::unchecked_sub`](https://doc.rust-lang.org/stable/core/primitive.i32.html#method.unchecked_sub)
- [`&lt;[T]&gt;::split_at_unchecked`](https://doc.rust-lang.org/stable/core/primitive.slice.html#method.split_at_unchecked)
- [`&lt;[T]&gt;::split_at_mut_unchecked`](https://doc.rust-lang.org/stable/core/primitive.slice.html#method.split_at_mut_unchecked)
- [`&lt;[u8]&gt;::utf8_chunks`](https://doc.rust-lang.org/stable/core/primitive.slice.html#method.utf8_chunks)
- [`str::Utf8Chunks`](https://doc.rust-lang.org/stable/core/str/struct.Utf8Chunks.html)
- [`str::Utf8Chunk`](https://doc.rust-lang.org/stable/core/str/struct.Utf8Chunk.html)
- [`&lt;*const T&gt;::is_aligned`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.is_aligned)
- [`&lt;*mut T&gt;::is_aligned`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.is_aligned-1)
- [`NonNull::is_aligned`](https://doc.rust-lang.org/stable/core/ptr/struct.NonNull.html#method.is_aligned)
- [`&lt;*const [T]&gt;::len`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.len)
- [`&lt;*mut [T]&gt;::len`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.len-1)
- [`&lt;*const [T]&gt;::is_empty`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.is_empty)
- [`&lt;*mut [T]&gt;::is_empty`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.is_empty-1)
- [`NonNull::&lt;[T]&gt;::is_empty`](https://doc.rust-lang.org/stable/core/ptr/struct.NonNull.html#method.is_empty)
- [`CStr::count_bytes`](https://doc.rust-lang.org/stable/core/ffi/c_str/struct.CStr.html#method.count_bytes)
- [`io::Error::downcast`](https://doc.rust-lang.org/stable/std/io/struct.Error.html#method.downcast)
- [`num::NonZero&lt;T&gt;`](https://doc.rust-lang.org/stable/core/num/struct.NonZero.html)
- [`path::absolute`](https://doc.rust-lang.org/stable/std/path/fn.absolute.html)
- [`proc_macro::Literal::byte_character`](https://doc.rust-lang.org/stable/proc_macro/struct.Literal.html#method.byte_character)
- [`proc_macro::Literal::c_string`](https://doc.rust-lang.org/stable/proc_macro/struct.Literal.html#method.c_string)
  These APIs are now stable in const contexts:
- [`Atomic*::into_inner`](https://doc.rust-lang.org/stable/core/sync/atomic/struct.AtomicUsize.html#method.into_inner)
- [`io::Cursor::new`](https://doc.rust-lang.org/stable/std/io/struct.Cursor.html#method.new)
- [`io::Cursor::get_ref`](https://doc.rust-lang.org/stable/std/io/struct.Cursor.html#method.get_ref)
- [`io::Cursor::position`](https://doc.rust-lang.org/stable/std/io/struct.Cursor.html#method.position)
- [`io::empty`](https://doc.rust-lang.org/stable/std/io/fn.empty.html)
- [`io::repeat`](https://doc.rust-lang.org/stable/std/io/fn.repeat.html)
- [`io::sink`](https://doc.rust-lang.org/stable/std/io/fn.sink.html)
- [`panic::Location::caller`](https://doc.rust-lang.org/stable/std/panic/struct.Location.html#method.caller)
- [`panic::Location::file`](https://doc.rust-lang.org/stable/std/panic/struct.Location.html#method.file)
- [`panic::Location::line`](https://doc.rust-lang.org/stable/std/panic/struct.Location.html#method.line)
- [`panic::Location::column`](https://doc.rust-lang.org/stable/std/panic/struct.Location.html#method.column)
  Cargo
-----
- [Prevent dashes in `lib.name`, always normalizing to `_`.](https://github.com/rust-lang/cargo/pull/12783/)
- [Stabilize MSRV-aware version requirement selection in `cargo add`.](https://github.com/rust-lang/cargo/pull/13608/)
- [Switch to using `gitoxide` by default for listing files.](https://github.com/rust-lang/cargo/pull/13696/)
- [Error on `[project]` in Edition 2024; `cargo fix --edition` will change it to `[package]`.](https://github.com/rust-lang/cargo/pull/13747/)
  Rustdoc
-----
- [Always display stability version even if it's the same as the containing item.](https://github.com/rust-lang/rust/pull/118441/)
- [Show a single search result for items with multiple paths.](https://github.com/rust-lang/rust/pull/119912/)
- [Support typing `/` in docs to begin a search.](https://github.com/rust-lang/rust/pull/123355/)
  Misc
----
  Compatibility Notes
- [Update the minimum external LLVM to 17.](https://github.com/rust-lang/rust/pull/122649/)
- [`RustcEncodable` and `RustcDecodable` are soft-destabilized, to be removed
  from the prelude in next edition.](https://github.com/rust-lang/rust/pull/116016/)
- [The `wasm_c_abi` future-incompatibility lint will warn about use of the
  non-spec-compliant C ABI.](https://github.com/rust-lang/rust/pull/117918/)
  Use `wasm-bindgen v0.2.88` to generate forward-compatible bindings.
- [Check return types of function types for well-formedness](https://github.com/rust-lang/rust/pull/115538)</changelog>
</package>
<package pkgid="afc42b0f3c22c0578ca7e4dc87135729458741c82d7b96e6171b990579a70377" name="cargo1.79" arch="x86_64">
  <version epoch="0" ver="1.79.0" rel="150500.11.3.1"/>
  <changelog author="xiaoguang.wang@suse.com" date="1718366400">Version 1.79.0 (2024-06-13)
  Language
--------
- [Stabilize inline `const {}` expressions.](https://github.com/rust-lang/rust/pull/104087/)
- [Prevent opaque types being instantiated twice with different regions within the same function.](https://github.com/rust-lang/rust/pull/116935/)
- [Stabilize WebAssembly target features that are in phase 4 and 5.](https://github.com/rust-lang/rust/pull/117457/)
- [Add the `redundant_lifetimes` lint to detect lifetimes which are semantically redundant.](https://github.com/rust-lang/rust/pull/118391/)
- [Stabilize the `unnameable_types` lint for public types that can't be named.](https://github.com/rust-lang/rust/pull/120144/)
- [Enable debuginfo in macros, and stabilize `-C collapse-macro-debuginfo` and `#[collapse_debuginfo]`.](https://github.com/rust-lang/rust/pull/120845/)
- [Propagate temporary lifetime extension into `if` and `match` expressions.](https://github.com/rust-lang/rust/pull/121346/)
- [Restrict promotion of `const fn` calls.](https://github.com/rust-lang/rust/pull/121557/)
- [Warn against refining impls of crate-private traits with `refining_impl_trait` lint.](https://github.com/rust-lang/rust/pull/121720/)
- [Stabilize associated type bounds (RFC 2289).](https://github.com/rust-lang/rust/pull/122055/)
- [Stabilize importing `main` from other modules or crates.](https://github.com/rust-lang/rust/pull/122060/)
- [Check return types of function types for well-formedness](https://github.com/rust-lang/rust/pull/115538)
- [Rework `impl Trait` lifetime inference](https://github.com/rust-lang/rust/pull/116891/)
- [Change inductive trait solver cycles to be ambiguous](https://github.com/rust-lang/rust/pull/122791)
  Compiler
--------
- [Define `-C strip` to only affect binaries, not artifacts like `.pdb`.](https://github.com/rust-lang/rust/pull/115120/)
- [Stabilize `-Crelro-level` for controlling runtime link hardening.](https://github.com/rust-lang/rust/pull/121694/)
- [Stabilize checking of `cfg` names and values at compile-time with `--check-cfg`.](https://github.com/rust-lang/rust/pull/123501/)
  * Note that this only stabilizes the compiler part, the Cargo part is still unstable in this release.*
- [Add `aarch64-apple-visionos` and `aarch64-apple-visionos-sim` tier 3 targets.](https://github.com/rust-lang/rust/pull/121419/)
- [Add `riscv32ima-unknown-none-elf` tier 3 target.](https://github.com/rust-lang/rust/pull/122696/)
- [Promote several Windows targets to tier 2](https://github.com/rust-lang/rust/pull/121712): `aarch64-pc-windows-gnullvm`, `i686-pc-windows-gnullvm`, and `x86_64-pc-windows-gnullvm`.
  Refer to Rust's [platform support page][platform-support-doc]
  for more information on Rust's tiered platform support.
  Libraries
---------
- [Implement `FromIterator` for `(impl Default + Extend, impl Default + Extend)`.](https://github.com/rust-lang/rust/pull/107462/)
- [Implement `{Div,Rem}Assign&lt;NonZero&lt;X&gt;&gt;` on `X`.](https://github.com/rust-lang/rust/pull/121952/)
- [Document overrides of `clone_from()` in core/std.](https://github.com/rust-lang/rust/pull/122201/)
- [Link MSVC default lib in core.](https://github.com/rust-lang/rust/pull/122268/)
- [Caution against using `transmute` between pointers and integers.](https://github.com/rust-lang/rust/pull/122379/)
- [Enable frame pointers for the standard library.](https://github.com/rust-lang/rust/pull/122646/)
  Stabilized APIs
- [`{integer}::unchecked_add`](https://doc.rust-lang.org/stable/core/primitive.i32.html#method.unchecked_add)
- [`{integer}::unchecked_mul`](https://doc.rust-lang.org/stable/core/primitive.i32.html#method.unchecked_mul)
- [`{integer}::unchecked_sub`](https://doc.rust-lang.org/stable/core/primitive.i32.html#method.unchecked_sub)
- [`&lt;[T]&gt;::split_at_unchecked`](https://doc.rust-lang.org/stable/core/primitive.slice.html#method.split_at_unchecked)
- [`&lt;[T]&gt;::split_at_mut_unchecked`](https://doc.rust-lang.org/stable/core/primitive.slice.html#method.split_at_mut_unchecked)
- [`&lt;[u8]&gt;::utf8_chunks`](https://doc.rust-lang.org/stable/core/primitive.slice.html#method.utf8_chunks)
- [`str::Utf8Chunks`](https://doc.rust-lang.org/stable/core/str/struct.Utf8Chunks.html)
- [`str::Utf8Chunk`](https://doc.rust-lang.org/stable/core/str/struct.Utf8Chunk.html)
- [`&lt;*const T&gt;::is_aligned`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.is_aligned)
- [`&lt;*mut T&gt;::is_aligned`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.is_aligned-1)
- [`NonNull::is_aligned`](https://doc.rust-lang.org/stable/core/ptr/struct.NonNull.html#method.is_aligned)
- [`&lt;*const [T]&gt;::len`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.len)
- [`&lt;*mut [T]&gt;::len`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.len-1)
- [`&lt;*const [T]&gt;::is_empty`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.is_empty)
- [`&lt;*mut [T]&gt;::is_empty`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.is_empty-1)
- [`NonNull::&lt;[T]&gt;::is_empty`](https://doc.rust-lang.org/stable/core/ptr/struct.NonNull.html#method.is_empty)
- [`CStr::count_bytes`](https://doc.rust-lang.org/stable/core/ffi/c_str/struct.CStr.html#method.count_bytes)
- [`io::Error::downcast`](https://doc.rust-lang.org/stable/std/io/struct.Error.html#method.downcast)
- [`num::NonZero&lt;T&gt;`](https://doc.rust-lang.org/stable/core/num/struct.NonZero.html)
- [`path::absolute`](https://doc.rust-lang.org/stable/std/path/fn.absolute.html)
- [`proc_macro::Literal::byte_character`](https://doc.rust-lang.org/stable/proc_macro/struct.Literal.html#method.byte_character)
- [`proc_macro::Literal::c_string`](https://doc.rust-lang.org/stable/proc_macro/struct.Literal.html#method.c_string)
  These APIs are now stable in const contexts:
- [`Atomic*::into_inner`](https://doc.rust-lang.org/stable/core/sync/atomic/struct.AtomicUsize.html#method.into_inner)
- [`io::Cursor::new`](https://doc.rust-lang.org/stable/std/io/struct.Cursor.html#method.new)
- [`io::Cursor::get_ref`](https://doc.rust-lang.org/stable/std/io/struct.Cursor.html#method.get_ref)
- [`io::Cursor::position`](https://doc.rust-lang.org/stable/std/io/struct.Cursor.html#method.position)
- [`io::empty`](https://doc.rust-lang.org/stable/std/io/fn.empty.html)
- [`io::repeat`](https://doc.rust-lang.org/stable/std/io/fn.repeat.html)
- [`io::sink`](https://doc.rust-lang.org/stable/std/io/fn.sink.html)
- [`panic::Location::caller`](https://doc.rust-lang.org/stable/std/panic/struct.Location.html#method.caller)
- [`panic::Location::file`](https://doc.rust-lang.org/stable/std/panic/struct.Location.html#method.file)
- [`panic::Location::line`](https://doc.rust-lang.org/stable/std/panic/struct.Location.html#method.line)
- [`panic::Location::column`](https://doc.rust-lang.org/stable/std/panic/struct.Location.html#method.column)
  Cargo
-----
- [Prevent dashes in `lib.name`, always normalizing to `_`.](https://github.com/rust-lang/cargo/pull/12783/)
- [Stabilize MSRV-aware version requirement selection in `cargo add`.](https://github.com/rust-lang/cargo/pull/13608/)
- [Switch to using `gitoxide` by default for listing files.](https://github.com/rust-lang/cargo/pull/13696/)
- [Error on `[project]` in Edition 2024; `cargo fix --edition` will change it to `[package]`.](https://github.com/rust-lang/cargo/pull/13747/)
  Rustdoc
-----
- [Always display stability version even if it's the same as the containing item.](https://github.com/rust-lang/rust/pull/118441/)
- [Show a single search result for items with multiple paths.](https://github.com/rust-lang/rust/pull/119912/)
- [Support typing `/` in docs to begin a search.](https://github.com/rust-lang/rust/pull/123355/)
  Misc
----
  Compatibility Notes
- [Update the minimum external LLVM to 17.](https://github.com/rust-lang/rust/pull/122649/)
- [`RustcEncodable` and `RustcDecodable` are soft-destabilized, to be removed
  from the prelude in next edition.](https://github.com/rust-lang/rust/pull/116016/)
- [The `wasm_c_abi` future-incompatibility lint will warn about use of the
  non-spec-compliant C ABI.](https://github.com/rust-lang/rust/pull/117918/)
  Use `wasm-bindgen v0.2.88` to generate forward-compatible bindings.
- [Check return types of function types for well-formedness](https://github.com/rust-lang/rust/pull/115538)</changelog>
</package>
<package pkgid="a6df5a5bc81f36f3618a9616b75c8a156ac1cf3385690c779d91be318ee4b1db" name="cargo1.80" arch="aarch64">
  <version epoch="0" ver="1.80.0" rel="150500.11.3.1"/>
  <changelog author="william.brown@suse.com" date="1721995200">Version 1.80.0 (2024-07-25)
  Language
--------
- [Document maximum allocation size](https://github.com/rust-lang/rust/pull/116675/)
- [Allow zero-byte offsets and ZST read/writes on arbitrary pointers](https://github.com/rust-lang/rust/pull/117329/)
- [Support C23's variadics without a named parameter](https://github.com/rust-lang/rust/pull/124048/)
- [Stabilize `exclusive_range_pattern` feature](https://github.com/rust-lang/rust/pull/124459/)
- [Guarantee layout and ABI of `Result` in some scenarios](https://github.com/rust-lang/rust/pull/124870)
  Compiler
--------
- [Update cc crate to v1.0.97 allowing additional spectre mitigations on MSVC targets](https://github.com/rust-lang/rust/pull/124892/)
- [Allow field reordering on types marked `repr(packed(1))`](https://github.com/rust-lang/rust/pull/125360/)
- [Add a lint against never type fallback affecting unsafe code](https://github.com/rust-lang/rust/pull/123939/)
- [Disallow cast with trailing braced macro in let-else](https://github.com/rust-lang/rust/pull/125049/)
- [Expand `for_loops_over_fallibles` lint to lint on fallibles behind references.](https://github.com/rust-lang/rust/pull/125156/)
- [self-contained linker: retry linking without `-fuse-ld=lld` on CCs that don't support it](https://github.com/rust-lang/rust/pull/125417/)
- [Do not parse CVarArgs (`...`) as a type in trait bounds](https://github.com/rust-lang/rust/pull/125863/)
- Improvements to LLDB formatting [#124458](https://github.com/rust-lang/rust/pull/124458) [#124500](https://github.com/rust-lang/rust/pull/124500)
- [For the wasm32-wasip2 target default to PIC and do not use `-fuse-ld=lld`](https://github.com/rust-lang/rust/pull/124858/)
- [Add x86_64-unknown-linux-none as a tier 3 target](https://github.com/rust-lang/rust/pull/125023/)
- [Lint on `foo.into_iter()` resolving to `&amp;Box&lt;[T]&gt;: IntoIterator`](https://github.com/rust-lang/rust/pull/124097/)
  Libraries
---------
- [Add `size_of` and `size_of_val` and `align_of` and `align_of_val` to the prelude](https://github.com/rust-lang/rust/pull/123168/)
- [Abort a process when FD ownership is violated](https://github.com/rust-lang/rust/pull/124210/)
- [io::Write::write_fmt: panic if the formatter fails when the stream does not fail](https://github.com/rust-lang/rust/pull/125012/)
- [Panic if `PathBuf::set_extension` would add a path separator](https://github.com/rust-lang/rust/pull/125070/)
- [Add assert_unsafe_precondition to unchecked_{add,sub,neg,mul,shl,shr} methods](https://github.com/rust-lang/rust/pull/121571/)
- [Update `c_char` on AIX to use the correct type](https://github.com/rust-lang/rust/pull/122986/)
- [`offset_of!` no longer returns a temporary](https://github.com/rust-lang/rust/pull/124484/)
- [Handle sigma in `str.to_lowercase` correctly](https://github.com/rust-lang/rust/pull/124773/)
- [Raise `DEFAULT_MIN_STACK_SIZE` to at least 64KiB](https://github.com/rust-lang/rust/pull/126059/)
  Stabilized APIs
- [`impl Default for Rc&lt;CStr&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3CCStr%3E)
- [`impl Default for Rc&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3Cstr%3E)
- [`impl Default for Rc&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3C%5BT%5D%3E)
- [`impl Default for Arc&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3Cstr%3E)
- [`impl Default for Arc&lt;CStr&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3CCStr%3E)
- [`impl Default for Arc&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3C%5BT%5D%3E)
- [`impl IntoIterator for Box&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-IntoIterator-for-Box%3C%5BI%5D,+A%3E)
- [`impl FromIterator&lt;String&gt; for Box&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-FromIterator%3CString%3E-for-Box%3Cstr%3E)
- [`impl FromIterator&lt;char&gt; for Box&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-FromIterator%3Cchar%3E-for-Box%3Cstr%3E)
- [`LazyCell`](https://doc.rust-lang.org/beta/core/cell/struct.LazyCell.html)
- [`LazyLock`](https://doc.rust-lang.org/beta/std/sync/struct.LazyLock.html)
- [`Duration::div_duration_f32`](https://doc.rust-lang.org/beta/std/time/struct.Duration.html#method.div_duration_f32)
- [`Duration::div_duration_f64`](https://doc.rust-lang.org/beta/std/time/struct.Duration.html#method.div_duration_f64)
- [`Option::take_if`](https://doc.rust-lang.org/beta/std/option/enum.Option.html#method.take_if)
- [`Seek::seek_relative`](https://doc.rust-lang.org/beta/std/io/trait.Seek.html#method.seek_relative)
- [`BinaryHeap::as_slice`](https://doc.rust-lang.org/beta/std/collections/struct.BinaryHeap.html#method.as_slice)
- [`NonNull::offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.offset)
- [`NonNull::byte_offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_offset)
- [`NonNull::add`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.add)
- [`NonNull::byte_add`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_add)
- [`NonNull::sub`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.sub)
- [`NonNull::byte_sub`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_sub)
- [`NonNull::offset_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.offset_from)
- [`NonNull::byte_offset_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_offset_from)
- [`NonNull::read`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read)
- [`NonNull::read_volatile`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read_volatile)
- [`NonNull::read_unaligned`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read_unaligned)
- [`NonNull::write`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write)
- [`NonNull::write_volatile`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_volatile)
- [`NonNull::write_unaligned`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_unaligned)
- [`NonNull::write_bytes`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_bytes)
- [`NonNull::copy_to`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_to)
- [`NonNull::copy_to_nonoverlapping`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_to_nonoverlapping)
- [`NonNull::copy_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_from)
- [`NonNull::copy_from_nonoverlapping`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_from_nonoverlapping)
- [`NonNull::replace`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.replace)
- [`NonNull::swap`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.swap)
- [`NonNull::drop_in_place`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.drop_in_place)
- [`NonNull::align_offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.align_offset)
- [`&lt;[T]&gt;::split_at_checked`](https://doc.rust-lang.org/beta/std/primitive.slice.html#method.split_at_checked)
- [`&lt;[T]&gt;::split_at_mut_checked`](https://doc.rust-lang.org/beta/std/primitive.slice.html#method.split_at_mut_checked)
- [`str::split_at_checked`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.split_at_checked)
- [`str::split_at_mut_checked`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.split_at_mut_checked)
- [`str::trim_ascii`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii)
- [`str::trim_ascii_start`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii_start)
- [`str::trim_ascii_end`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii_end)
- [`&lt;[u8]&gt;::trim_ascii`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii)
- [`&lt;[u8]&gt;::trim_ascii_start`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii_start)
- [`&lt;[u8]&gt;::trim_ascii_end`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii_end)
- [`Ipv4Addr::BITS`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#associatedconstant.BITS)
- [`Ipv4Addr::to_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#method.to_bits)
- [`Ipv4Addr::from_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#method.from_bits)
- [`Ipv6Addr::BITS`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#associatedconstant.BITS)
- [`Ipv6Addr::to_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#method.to_bits)
- [`Ipv6Addr::from_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#method.from_bits)
- [`Vec::&lt;[T; N]&gt;::into_flattened`](https://doc.rust-lang.org/beta/alloc/vec/struct.Vec.html#method.into_flattened)
- [`&lt;[[T; N]]&gt;::as_flattened`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.as_flattened)
- [`&lt;[[T; N]]&gt;::as_flattened_mut`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.as_flattened_mut)
  These APIs are now stable in const contexts:
- [`&lt;[T]&gt;::last_chunk`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.last_chunk)
- [`BinaryHeap::new`](https://doc.rust-lang.org/beta/std/collections/struct.BinaryHeap.html#method.new)
  Cargo
-----
- [Stabilize `-Zcheck-cfg` as always enabled](https://github.com/rust-lang/cargo/pull/13571/)
- [Warn, rather than fail publish, if a target is excluded](https://github.com/rust-lang/cargo/pull/13713/)
- [Add special `check-cfg` lint config for the `unexpected_cfgs` lint](https://github.com/rust-lang/cargo/pull/13913/)
- [Stabilize `cargo update --precise &lt;yanked&gt;`](https://github.com/rust-lang/cargo/pull/13974/)
- [Don't change file permissions on `Cargo.toml` when using `cargo add`](https://github.com/rust-lang/cargo/pull/13898/)
- [Support using `cargo fix` on IPv6-only networks](https://github.com/rust-lang/cargo/pull/13907/)
  Rustdoc
-----
- [Allow searching for references](https://github.com/rust-lang/rust/pull/124148/)
- [Stabilize `custom_code_classes_in_docs` feature](https://github.com/rust-lang/rust/pull/124577/)
- [fix: In cross-crate scenarios show enum variants on type aliases of enums](https://github.com/rust-lang/rust/pull/125300/)
  Compatibility Notes
- [rustfmt estimates line lengths differently when using non-ascii characters](https://github.com/rust-lang/rustfmt/issues/6203)
- [Type aliases are now handled correctly in orphan check](https://github.com/rust-lang/rust/pull/117164/)
- [Allow instructing rustdoc to read from stdin via `-`](https://github.com/rust-lang/rust/pull/124611/)
- [`std::env::{set_var, remove_var}` can no longer be converted to safe function pointers and no longer implement the `Fn` family of traits](https://github.com/rust-lang/rust/pull/124636)
- [Warn (or error) when `Self` constructor from outer item is referenced in inner nested item](https://github.com/rust-lang/rust/pull/124187/)
- [Turn `indirect_structural_match` and `pointer_structural_match` lints into hard errors](https://github.com/rust-lang/rust/pull/124661/)
- [Make `where_clause_object_safety` lint a regular object safety violation](https://github.com/rust-lang/rust/pull/125380/)
- [Turn `proc_macro_back_compat` lint into a hard error.](https://github.com/rust-lang/rust/pull/125596/)
- [Detect unused structs even when implementing private traits](https://github.com/rust-lang/rust/pull/122382/)
- [`std::sync::ReentrantLockGuard&lt;T&gt;` is no longer `Sync` if `T: !Sync`](https://github.com/rust-lang/rust/pull/125527) which means [`std::io::StdoutLock` and `std::io::StderrLock` are no longer Sync](https://github.com/rust-lang/rust/issues/127340)
  Internal Changes
  These changes do not affect any public interfaces of Rust, but they represent
  significant improvements to the performance or internals of rustc and related
  tools.
- Misc improvements to size of generated html by rustdoc e.g. [#124738](https://github.com/rust-lang/rust/pull/124738/) and [#123734](https://github.com/rust-lang/rust/pull/123734/)
- [MSVC targets no longer depend on libc](https://github.com/rust-lang/rust/pull/124050/)</changelog>
</package>
<package pkgid="c43d211e865afb930235bbd03597f7ff0d338c48b2a93d06a19a2012b280706c" name="cargo1.80" arch="ppc64le">
  <version epoch="0" ver="1.80.0" rel="150500.11.3.1"/>
  <changelog author="william.brown@suse.com" date="1721995200">Version 1.80.0 (2024-07-25)
  Language
--------
- [Document maximum allocation size](https://github.com/rust-lang/rust/pull/116675/)
- [Allow zero-byte offsets and ZST read/writes on arbitrary pointers](https://github.com/rust-lang/rust/pull/117329/)
- [Support C23's variadics without a named parameter](https://github.com/rust-lang/rust/pull/124048/)
- [Stabilize `exclusive_range_pattern` feature](https://github.com/rust-lang/rust/pull/124459/)
- [Guarantee layout and ABI of `Result` in some scenarios](https://github.com/rust-lang/rust/pull/124870)
  Compiler
--------
- [Update cc crate to v1.0.97 allowing additional spectre mitigations on MSVC targets](https://github.com/rust-lang/rust/pull/124892/)
- [Allow field reordering on types marked `repr(packed(1))`](https://github.com/rust-lang/rust/pull/125360/)
- [Add a lint against never type fallback affecting unsafe code](https://github.com/rust-lang/rust/pull/123939/)
- [Disallow cast with trailing braced macro in let-else](https://github.com/rust-lang/rust/pull/125049/)
- [Expand `for_loops_over_fallibles` lint to lint on fallibles behind references.](https://github.com/rust-lang/rust/pull/125156/)
- [self-contained linker: retry linking without `-fuse-ld=lld` on CCs that don't support it](https://github.com/rust-lang/rust/pull/125417/)
- [Do not parse CVarArgs (`...`) as a type in trait bounds](https://github.com/rust-lang/rust/pull/125863/)
- Improvements to LLDB formatting [#124458](https://github.com/rust-lang/rust/pull/124458) [#124500](https://github.com/rust-lang/rust/pull/124500)
- [For the wasm32-wasip2 target default to PIC and do not use `-fuse-ld=lld`](https://github.com/rust-lang/rust/pull/124858/)
- [Add x86_64-unknown-linux-none as a tier 3 target](https://github.com/rust-lang/rust/pull/125023/)
- [Lint on `foo.into_iter()` resolving to `&amp;Box&lt;[T]&gt;: IntoIterator`](https://github.com/rust-lang/rust/pull/124097/)
  Libraries
---------
- [Add `size_of` and `size_of_val` and `align_of` and `align_of_val` to the prelude](https://github.com/rust-lang/rust/pull/123168/)
- [Abort a process when FD ownership is violated](https://github.com/rust-lang/rust/pull/124210/)
- [io::Write::write_fmt: panic if the formatter fails when the stream does not fail](https://github.com/rust-lang/rust/pull/125012/)
- [Panic if `PathBuf::set_extension` would add a path separator](https://github.com/rust-lang/rust/pull/125070/)
- [Add assert_unsafe_precondition to unchecked_{add,sub,neg,mul,shl,shr} methods](https://github.com/rust-lang/rust/pull/121571/)
- [Update `c_char` on AIX to use the correct type](https://github.com/rust-lang/rust/pull/122986/)
- [`offset_of!` no longer returns a temporary](https://github.com/rust-lang/rust/pull/124484/)
- [Handle sigma in `str.to_lowercase` correctly](https://github.com/rust-lang/rust/pull/124773/)
- [Raise `DEFAULT_MIN_STACK_SIZE` to at least 64KiB](https://github.com/rust-lang/rust/pull/126059/)
  Stabilized APIs
- [`impl Default for Rc&lt;CStr&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3CCStr%3E)
- [`impl Default for Rc&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3Cstr%3E)
- [`impl Default for Rc&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3C%5BT%5D%3E)
- [`impl Default for Arc&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3Cstr%3E)
- [`impl Default for Arc&lt;CStr&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3CCStr%3E)
- [`impl Default for Arc&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3C%5BT%5D%3E)
- [`impl IntoIterator for Box&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-IntoIterator-for-Box%3C%5BI%5D,+A%3E)
- [`impl FromIterator&lt;String&gt; for Box&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-FromIterator%3CString%3E-for-Box%3Cstr%3E)
- [`impl FromIterator&lt;char&gt; for Box&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-FromIterator%3Cchar%3E-for-Box%3Cstr%3E)
- [`LazyCell`](https://doc.rust-lang.org/beta/core/cell/struct.LazyCell.html)
- [`LazyLock`](https://doc.rust-lang.org/beta/std/sync/struct.LazyLock.html)
- [`Duration::div_duration_f32`](https://doc.rust-lang.org/beta/std/time/struct.Duration.html#method.div_duration_f32)
- [`Duration::div_duration_f64`](https://doc.rust-lang.org/beta/std/time/struct.Duration.html#method.div_duration_f64)
- [`Option::take_if`](https://doc.rust-lang.org/beta/std/option/enum.Option.html#method.take_if)
- [`Seek::seek_relative`](https://doc.rust-lang.org/beta/std/io/trait.Seek.html#method.seek_relative)
- [`BinaryHeap::as_slice`](https://doc.rust-lang.org/beta/std/collections/struct.BinaryHeap.html#method.as_slice)
- [`NonNull::offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.offset)
- [`NonNull::byte_offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_offset)
- [`NonNull::add`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.add)
- [`NonNull::byte_add`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_add)
- [`NonNull::sub`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.sub)
- [`NonNull::byte_sub`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_sub)
- [`NonNull::offset_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.offset_from)
- [`NonNull::byte_offset_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_offset_from)
- [`NonNull::read`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read)
- [`NonNull::read_volatile`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read_volatile)
- [`NonNull::read_unaligned`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read_unaligned)
- [`NonNull::write`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write)
- [`NonNull::write_volatile`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_volatile)
- [`NonNull::write_unaligned`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_unaligned)
- [`NonNull::write_bytes`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_bytes)
- [`NonNull::copy_to`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_to)
- [`NonNull::copy_to_nonoverlapping`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_to_nonoverlapping)
- [`NonNull::copy_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_from)
- [`NonNull::copy_from_nonoverlapping`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_from_nonoverlapping)
- [`NonNull::replace`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.replace)
- [`NonNull::swap`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.swap)
- [`NonNull::drop_in_place`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.drop_in_place)
- [`NonNull::align_offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.align_offset)
- [`&lt;[T]&gt;::split_at_checked`](https://doc.rust-lang.org/beta/std/primitive.slice.html#method.split_at_checked)
- [`&lt;[T]&gt;::split_at_mut_checked`](https://doc.rust-lang.org/beta/std/primitive.slice.html#method.split_at_mut_checked)
- [`str::split_at_checked`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.split_at_checked)
- [`str::split_at_mut_checked`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.split_at_mut_checked)
- [`str::trim_ascii`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii)
- [`str::trim_ascii_start`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii_start)
- [`str::trim_ascii_end`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii_end)
- [`&lt;[u8]&gt;::trim_ascii`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii)
- [`&lt;[u8]&gt;::trim_ascii_start`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii_start)
- [`&lt;[u8]&gt;::trim_ascii_end`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii_end)
- [`Ipv4Addr::BITS`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#associatedconstant.BITS)
- [`Ipv4Addr::to_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#method.to_bits)
- [`Ipv4Addr::from_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#method.from_bits)
- [`Ipv6Addr::BITS`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#associatedconstant.BITS)
- [`Ipv6Addr::to_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#method.to_bits)
- [`Ipv6Addr::from_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#method.from_bits)
- [`Vec::&lt;[T; N]&gt;::into_flattened`](https://doc.rust-lang.org/beta/alloc/vec/struct.Vec.html#method.into_flattened)
- [`&lt;[[T; N]]&gt;::as_flattened`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.as_flattened)
- [`&lt;[[T; N]]&gt;::as_flattened_mut`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.as_flattened_mut)
  These APIs are now stable in const contexts:
- [`&lt;[T]&gt;::last_chunk`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.last_chunk)
- [`BinaryHeap::new`](https://doc.rust-lang.org/beta/std/collections/struct.BinaryHeap.html#method.new)
  Cargo
-----
- [Stabilize `-Zcheck-cfg` as always enabled](https://github.com/rust-lang/cargo/pull/13571/)
- [Warn, rather than fail publish, if a target is excluded](https://github.com/rust-lang/cargo/pull/13713/)
- [Add special `check-cfg` lint config for the `unexpected_cfgs` lint](https://github.com/rust-lang/cargo/pull/13913/)
- [Stabilize `cargo update --precise &lt;yanked&gt;`](https://github.com/rust-lang/cargo/pull/13974/)
- [Don't change file permissions on `Cargo.toml` when using `cargo add`](https://github.com/rust-lang/cargo/pull/13898/)
- [Support using `cargo fix` on IPv6-only networks](https://github.com/rust-lang/cargo/pull/13907/)
  Rustdoc
-----
- [Allow searching for references](https://github.com/rust-lang/rust/pull/124148/)
- [Stabilize `custom_code_classes_in_docs` feature](https://github.com/rust-lang/rust/pull/124577/)
- [fix: In cross-crate scenarios show enum variants on type aliases of enums](https://github.com/rust-lang/rust/pull/125300/)
  Compatibility Notes
- [rustfmt estimates line lengths differently when using non-ascii characters](https://github.com/rust-lang/rustfmt/issues/6203)
- [Type aliases are now handled correctly in orphan check](https://github.com/rust-lang/rust/pull/117164/)
- [Allow instructing rustdoc to read from stdin via `-`](https://github.com/rust-lang/rust/pull/124611/)
- [`std::env::{set_var, remove_var}` can no longer be converted to safe function pointers and no longer implement the `Fn` family of traits](https://github.com/rust-lang/rust/pull/124636)
- [Warn (or error) when `Self` constructor from outer item is referenced in inner nested item](https://github.com/rust-lang/rust/pull/124187/)
- [Turn `indirect_structural_match` and `pointer_structural_match` lints into hard errors](https://github.com/rust-lang/rust/pull/124661/)
- [Make `where_clause_object_safety` lint a regular object safety violation](https://github.com/rust-lang/rust/pull/125380/)
- [Turn `proc_macro_back_compat` lint into a hard error.](https://github.com/rust-lang/rust/pull/125596/)
- [Detect unused structs even when implementing private traits](https://github.com/rust-lang/rust/pull/122382/)
- [`std::sync::ReentrantLockGuard&lt;T&gt;` is no longer `Sync` if `T: !Sync`](https://github.com/rust-lang/rust/pull/125527) which means [`std::io::StdoutLock` and `std::io::StderrLock` are no longer Sync](https://github.com/rust-lang/rust/issues/127340)
  Internal Changes
  These changes do not affect any public interfaces of Rust, but they represent
  significant improvements to the performance or internals of rustc and related
  tools.
- Misc improvements to size of generated html by rustdoc e.g. [#124738](https://github.com/rust-lang/rust/pull/124738/) and [#123734](https://github.com/rust-lang/rust/pull/123734/)
- [MSVC targets no longer depend on libc](https://github.com/rust-lang/rust/pull/124050/)</changelog>
</package>
<package pkgid="131abeb7de6b338f2488723be1fca584014f39b393ac0f1e41bc8c431de7a4c0" name="cargo1.80" arch="s390x">
  <version epoch="0" ver="1.80.0" rel="150500.11.3.1"/>
  <changelog author="william.brown@suse.com" date="1721995200">Version 1.80.0 (2024-07-25)
  Language
--------
- [Document maximum allocation size](https://github.com/rust-lang/rust/pull/116675/)
- [Allow zero-byte offsets and ZST read/writes on arbitrary pointers](https://github.com/rust-lang/rust/pull/117329/)
- [Support C23's variadics without a named parameter](https://github.com/rust-lang/rust/pull/124048/)
- [Stabilize `exclusive_range_pattern` feature](https://github.com/rust-lang/rust/pull/124459/)
- [Guarantee layout and ABI of `Result` in some scenarios](https://github.com/rust-lang/rust/pull/124870)
  Compiler
--------
- [Update cc crate to v1.0.97 allowing additional spectre mitigations on MSVC targets](https://github.com/rust-lang/rust/pull/124892/)
- [Allow field reordering on types marked `repr(packed(1))`](https://github.com/rust-lang/rust/pull/125360/)
- [Add a lint against never type fallback affecting unsafe code](https://github.com/rust-lang/rust/pull/123939/)
- [Disallow cast with trailing braced macro in let-else](https://github.com/rust-lang/rust/pull/125049/)
- [Expand `for_loops_over_fallibles` lint to lint on fallibles behind references.](https://github.com/rust-lang/rust/pull/125156/)
- [self-contained linker: retry linking without `-fuse-ld=lld` on CCs that don't support it](https://github.com/rust-lang/rust/pull/125417/)
- [Do not parse CVarArgs (`...`) as a type in trait bounds](https://github.com/rust-lang/rust/pull/125863/)
- Improvements to LLDB formatting [#124458](https://github.com/rust-lang/rust/pull/124458) [#124500](https://github.com/rust-lang/rust/pull/124500)
- [For the wasm32-wasip2 target default to PIC and do not use `-fuse-ld=lld`](https://github.com/rust-lang/rust/pull/124858/)
- [Add x86_64-unknown-linux-none as a tier 3 target](https://github.com/rust-lang/rust/pull/125023/)
- [Lint on `foo.into_iter()` resolving to `&amp;Box&lt;[T]&gt;: IntoIterator`](https://github.com/rust-lang/rust/pull/124097/)
  Libraries
---------
- [Add `size_of` and `size_of_val` and `align_of` and `align_of_val` to the prelude](https://github.com/rust-lang/rust/pull/123168/)
- [Abort a process when FD ownership is violated](https://github.com/rust-lang/rust/pull/124210/)
- [io::Write::write_fmt: panic if the formatter fails when the stream does not fail](https://github.com/rust-lang/rust/pull/125012/)
- [Panic if `PathBuf::set_extension` would add a path separator](https://github.com/rust-lang/rust/pull/125070/)
- [Add assert_unsafe_precondition to unchecked_{add,sub,neg,mul,shl,shr} methods](https://github.com/rust-lang/rust/pull/121571/)
- [Update `c_char` on AIX to use the correct type](https://github.com/rust-lang/rust/pull/122986/)
- [`offset_of!` no longer returns a temporary](https://github.com/rust-lang/rust/pull/124484/)
- [Handle sigma in `str.to_lowercase` correctly](https://github.com/rust-lang/rust/pull/124773/)
- [Raise `DEFAULT_MIN_STACK_SIZE` to at least 64KiB](https://github.com/rust-lang/rust/pull/126059/)
  Stabilized APIs
- [`impl Default for Rc&lt;CStr&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3CCStr%3E)
- [`impl Default for Rc&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3Cstr%3E)
- [`impl Default for Rc&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3C%5BT%5D%3E)
- [`impl Default for Arc&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3Cstr%3E)
- [`impl Default for Arc&lt;CStr&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3CCStr%3E)
- [`impl Default for Arc&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3C%5BT%5D%3E)
- [`impl IntoIterator for Box&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-IntoIterator-for-Box%3C%5BI%5D,+A%3E)
- [`impl FromIterator&lt;String&gt; for Box&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-FromIterator%3CString%3E-for-Box%3Cstr%3E)
- [`impl FromIterator&lt;char&gt; for Box&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-FromIterator%3Cchar%3E-for-Box%3Cstr%3E)
- [`LazyCell`](https://doc.rust-lang.org/beta/core/cell/struct.LazyCell.html)
- [`LazyLock`](https://doc.rust-lang.org/beta/std/sync/struct.LazyLock.html)
- [`Duration::div_duration_f32`](https://doc.rust-lang.org/beta/std/time/struct.Duration.html#method.div_duration_f32)
- [`Duration::div_duration_f64`](https://doc.rust-lang.org/beta/std/time/struct.Duration.html#method.div_duration_f64)
- [`Option::take_if`](https://doc.rust-lang.org/beta/std/option/enum.Option.html#method.take_if)
- [`Seek::seek_relative`](https://doc.rust-lang.org/beta/std/io/trait.Seek.html#method.seek_relative)
- [`BinaryHeap::as_slice`](https://doc.rust-lang.org/beta/std/collections/struct.BinaryHeap.html#method.as_slice)
- [`NonNull::offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.offset)
- [`NonNull::byte_offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_offset)
- [`NonNull::add`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.add)
- [`NonNull::byte_add`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_add)
- [`NonNull::sub`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.sub)
- [`NonNull::byte_sub`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_sub)
- [`NonNull::offset_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.offset_from)
- [`NonNull::byte_offset_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_offset_from)
- [`NonNull::read`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read)
- [`NonNull::read_volatile`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read_volatile)
- [`NonNull::read_unaligned`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read_unaligned)
- [`NonNull::write`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write)
- [`NonNull::write_volatile`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_volatile)
- [`NonNull::write_unaligned`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_unaligned)
- [`NonNull::write_bytes`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_bytes)
- [`NonNull::copy_to`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_to)
- [`NonNull::copy_to_nonoverlapping`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_to_nonoverlapping)
- [`NonNull::copy_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_from)
- [`NonNull::copy_from_nonoverlapping`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_from_nonoverlapping)
- [`NonNull::replace`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.replace)
- [`NonNull::swap`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.swap)
- [`NonNull::drop_in_place`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.drop_in_place)
- [`NonNull::align_offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.align_offset)
- [`&lt;[T]&gt;::split_at_checked`](https://doc.rust-lang.org/beta/std/primitive.slice.html#method.split_at_checked)
- [`&lt;[T]&gt;::split_at_mut_checked`](https://doc.rust-lang.org/beta/std/primitive.slice.html#method.split_at_mut_checked)
- [`str::split_at_checked`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.split_at_checked)
- [`str::split_at_mut_checked`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.split_at_mut_checked)
- [`str::trim_ascii`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii)
- [`str::trim_ascii_start`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii_start)
- [`str::trim_ascii_end`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii_end)
- [`&lt;[u8]&gt;::trim_ascii`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii)
- [`&lt;[u8]&gt;::trim_ascii_start`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii_start)
- [`&lt;[u8]&gt;::trim_ascii_end`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii_end)
- [`Ipv4Addr::BITS`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#associatedconstant.BITS)
- [`Ipv4Addr::to_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#method.to_bits)
- [`Ipv4Addr::from_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#method.from_bits)
- [`Ipv6Addr::BITS`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#associatedconstant.BITS)
- [`Ipv6Addr::to_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#method.to_bits)
- [`Ipv6Addr::from_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#method.from_bits)
- [`Vec::&lt;[T; N]&gt;::into_flattened`](https://doc.rust-lang.org/beta/alloc/vec/struct.Vec.html#method.into_flattened)
- [`&lt;[[T; N]]&gt;::as_flattened`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.as_flattened)
- [`&lt;[[T; N]]&gt;::as_flattened_mut`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.as_flattened_mut)
  These APIs are now stable in const contexts:
- [`&lt;[T]&gt;::last_chunk`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.last_chunk)
- [`BinaryHeap::new`](https://doc.rust-lang.org/beta/std/collections/struct.BinaryHeap.html#method.new)
  Cargo
-----
- [Stabilize `-Zcheck-cfg` as always enabled](https://github.com/rust-lang/cargo/pull/13571/)
- [Warn, rather than fail publish, if a target is excluded](https://github.com/rust-lang/cargo/pull/13713/)
- [Add special `check-cfg` lint config for the `unexpected_cfgs` lint](https://github.com/rust-lang/cargo/pull/13913/)
- [Stabilize `cargo update --precise &lt;yanked&gt;`](https://github.com/rust-lang/cargo/pull/13974/)
- [Don't change file permissions on `Cargo.toml` when using `cargo add`](https://github.com/rust-lang/cargo/pull/13898/)
- [Support using `cargo fix` on IPv6-only networks](https://github.com/rust-lang/cargo/pull/13907/)
  Rustdoc
-----
- [Allow searching for references](https://github.com/rust-lang/rust/pull/124148/)
- [Stabilize `custom_code_classes_in_docs` feature](https://github.com/rust-lang/rust/pull/124577/)
- [fix: In cross-crate scenarios show enum variants on type aliases of enums](https://github.com/rust-lang/rust/pull/125300/)
  Compatibility Notes
- [rustfmt estimates line lengths differently when using non-ascii characters](https://github.com/rust-lang/rustfmt/issues/6203)
- [Type aliases are now handled correctly in orphan check](https://github.com/rust-lang/rust/pull/117164/)
- [Allow instructing rustdoc to read from stdin via `-`](https://github.com/rust-lang/rust/pull/124611/)
- [`std::env::{set_var, remove_var}` can no longer be converted to safe function pointers and no longer implement the `Fn` family of traits](https://github.com/rust-lang/rust/pull/124636)
- [Warn (or error) when `Self` constructor from outer item is referenced in inner nested item](https://github.com/rust-lang/rust/pull/124187/)
- [Turn `indirect_structural_match` and `pointer_structural_match` lints into hard errors](https://github.com/rust-lang/rust/pull/124661/)
- [Make `where_clause_object_safety` lint a regular object safety violation](https://github.com/rust-lang/rust/pull/125380/)
- [Turn `proc_macro_back_compat` lint into a hard error.](https://github.com/rust-lang/rust/pull/125596/)
- [Detect unused structs even when implementing private traits](https://github.com/rust-lang/rust/pull/122382/)
- [`std::sync::ReentrantLockGuard&lt;T&gt;` is no longer `Sync` if `T: !Sync`](https://github.com/rust-lang/rust/pull/125527) which means [`std::io::StdoutLock` and `std::io::StderrLock` are no longer Sync](https://github.com/rust-lang/rust/issues/127340)
  Internal Changes
  These changes do not affect any public interfaces of Rust, but they represent
  significant improvements to the performance or internals of rustc and related
  tools.
- Misc improvements to size of generated html by rustdoc e.g. [#124738](https://github.com/rust-lang/rust/pull/124738/) and [#123734](https://github.com/rust-lang/rust/pull/123734/)
- [MSVC targets no longer depend on libc](https://github.com/rust-lang/rust/pull/124050/)</changelog>
</package>
<package pkgid="cf747767ff62d519e8ff16c384e7d0658caf94d966a121e3079305ef07fb0881" name="cargo1.80" arch="x86_64">
  <version epoch="0" ver="1.80.0" rel="150500.11.3.1"/>
  <changelog author="william.brown@suse.com" date="1721995200">Version 1.80.0 (2024-07-25)
  Language
--------
- [Document maximum allocation size](https://github.com/rust-lang/rust/pull/116675/)
- [Allow zero-byte offsets and ZST read/writes on arbitrary pointers](https://github.com/rust-lang/rust/pull/117329/)
- [Support C23's variadics without a named parameter](https://github.com/rust-lang/rust/pull/124048/)
- [Stabilize `exclusive_range_pattern` feature](https://github.com/rust-lang/rust/pull/124459/)
- [Guarantee layout and ABI of `Result` in some scenarios](https://github.com/rust-lang/rust/pull/124870)
  Compiler
--------
- [Update cc crate to v1.0.97 allowing additional spectre mitigations on MSVC targets](https://github.com/rust-lang/rust/pull/124892/)
- [Allow field reordering on types marked `repr(packed(1))`](https://github.com/rust-lang/rust/pull/125360/)
- [Add a lint against never type fallback affecting unsafe code](https://github.com/rust-lang/rust/pull/123939/)
- [Disallow cast with trailing braced macro in let-else](https://github.com/rust-lang/rust/pull/125049/)
- [Expand `for_loops_over_fallibles` lint to lint on fallibles behind references.](https://github.com/rust-lang/rust/pull/125156/)
- [self-contained linker: retry linking without `-fuse-ld=lld` on CCs that don't support it](https://github.com/rust-lang/rust/pull/125417/)
- [Do not parse CVarArgs (`...`) as a type in trait bounds](https://github.com/rust-lang/rust/pull/125863/)
- Improvements to LLDB formatting [#124458](https://github.com/rust-lang/rust/pull/124458) [#124500](https://github.com/rust-lang/rust/pull/124500)
- [For the wasm32-wasip2 target default to PIC and do not use `-fuse-ld=lld`](https://github.com/rust-lang/rust/pull/124858/)
- [Add x86_64-unknown-linux-none as a tier 3 target](https://github.com/rust-lang/rust/pull/125023/)
- [Lint on `foo.into_iter()` resolving to `&amp;Box&lt;[T]&gt;: IntoIterator`](https://github.com/rust-lang/rust/pull/124097/)
  Libraries
---------
- [Add `size_of` and `size_of_val` and `align_of` and `align_of_val` to the prelude](https://github.com/rust-lang/rust/pull/123168/)
- [Abort a process when FD ownership is violated](https://github.com/rust-lang/rust/pull/124210/)
- [io::Write::write_fmt: panic if the formatter fails when the stream does not fail](https://github.com/rust-lang/rust/pull/125012/)
- [Panic if `PathBuf::set_extension` would add a path separator](https://github.com/rust-lang/rust/pull/125070/)
- [Add assert_unsafe_precondition to unchecked_{add,sub,neg,mul,shl,shr} methods](https://github.com/rust-lang/rust/pull/121571/)
- [Update `c_char` on AIX to use the correct type](https://github.com/rust-lang/rust/pull/122986/)
- [`offset_of!` no longer returns a temporary](https://github.com/rust-lang/rust/pull/124484/)
- [Handle sigma in `str.to_lowercase` correctly](https://github.com/rust-lang/rust/pull/124773/)
- [Raise `DEFAULT_MIN_STACK_SIZE` to at least 64KiB](https://github.com/rust-lang/rust/pull/126059/)
  Stabilized APIs
- [`impl Default for Rc&lt;CStr&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3CCStr%3E)
- [`impl Default for Rc&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3Cstr%3E)
- [`impl Default for Rc&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3C%5BT%5D%3E)
- [`impl Default for Arc&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3Cstr%3E)
- [`impl Default for Arc&lt;CStr&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3CCStr%3E)
- [`impl Default for Arc&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3C%5BT%5D%3E)
- [`impl IntoIterator for Box&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-IntoIterator-for-Box%3C%5BI%5D,+A%3E)
- [`impl FromIterator&lt;String&gt; for Box&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-FromIterator%3CString%3E-for-Box%3Cstr%3E)
- [`impl FromIterator&lt;char&gt; for Box&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-FromIterator%3Cchar%3E-for-Box%3Cstr%3E)
- [`LazyCell`](https://doc.rust-lang.org/beta/core/cell/struct.LazyCell.html)
- [`LazyLock`](https://doc.rust-lang.org/beta/std/sync/struct.LazyLock.html)
- [`Duration::div_duration_f32`](https://doc.rust-lang.org/beta/std/time/struct.Duration.html#method.div_duration_f32)
- [`Duration::div_duration_f64`](https://doc.rust-lang.org/beta/std/time/struct.Duration.html#method.div_duration_f64)
- [`Option::take_if`](https://doc.rust-lang.org/beta/std/option/enum.Option.html#method.take_if)
- [`Seek::seek_relative`](https://doc.rust-lang.org/beta/std/io/trait.Seek.html#method.seek_relative)
- [`BinaryHeap::as_slice`](https://doc.rust-lang.org/beta/std/collections/struct.BinaryHeap.html#method.as_slice)
- [`NonNull::offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.offset)
- [`NonNull::byte_offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_offset)
- [`NonNull::add`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.add)
- [`NonNull::byte_add`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_add)
- [`NonNull::sub`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.sub)
- [`NonNull::byte_sub`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_sub)
- [`NonNull::offset_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.offset_from)
- [`NonNull::byte_offset_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_offset_from)
- [`NonNull::read`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read)
- [`NonNull::read_volatile`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read_volatile)
- [`NonNull::read_unaligned`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read_unaligned)
- [`NonNull::write`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write)
- [`NonNull::write_volatile`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_volatile)
- [`NonNull::write_unaligned`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_unaligned)
- [`NonNull::write_bytes`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_bytes)
- [`NonNull::copy_to`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_to)
- [`NonNull::copy_to_nonoverlapping`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_to_nonoverlapping)
- [`NonNull::copy_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_from)
- [`NonNull::copy_from_nonoverlapping`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_from_nonoverlapping)
- [`NonNull::replace`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.replace)
- [`NonNull::swap`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.swap)
- [`NonNull::drop_in_place`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.drop_in_place)
- [`NonNull::align_offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.align_offset)
- [`&lt;[T]&gt;::split_at_checked`](https://doc.rust-lang.org/beta/std/primitive.slice.html#method.split_at_checked)
- [`&lt;[T]&gt;::split_at_mut_checked`](https://doc.rust-lang.org/beta/std/primitive.slice.html#method.split_at_mut_checked)
- [`str::split_at_checked`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.split_at_checked)
- [`str::split_at_mut_checked`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.split_at_mut_checked)
- [`str::trim_ascii`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii)
- [`str::trim_ascii_start`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii_start)
- [`str::trim_ascii_end`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii_end)
- [`&lt;[u8]&gt;::trim_ascii`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii)
- [`&lt;[u8]&gt;::trim_ascii_start`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii_start)
- [`&lt;[u8]&gt;::trim_ascii_end`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii_end)
- [`Ipv4Addr::BITS`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#associatedconstant.BITS)
- [`Ipv4Addr::to_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#method.to_bits)
- [`Ipv4Addr::from_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#method.from_bits)
- [`Ipv6Addr::BITS`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#associatedconstant.BITS)
- [`Ipv6Addr::to_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#method.to_bits)
- [`Ipv6Addr::from_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#method.from_bits)
- [`Vec::&lt;[T; N]&gt;::into_flattened`](https://doc.rust-lang.org/beta/alloc/vec/struct.Vec.html#method.into_flattened)
- [`&lt;[[T; N]]&gt;::as_flattened`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.as_flattened)
- [`&lt;[[T; N]]&gt;::as_flattened_mut`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.as_flattened_mut)
  These APIs are now stable in const contexts:
- [`&lt;[T]&gt;::last_chunk`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.last_chunk)
- [`BinaryHeap::new`](https://doc.rust-lang.org/beta/std/collections/struct.BinaryHeap.html#method.new)
  Cargo
-----
- [Stabilize `-Zcheck-cfg` as always enabled](https://github.com/rust-lang/cargo/pull/13571/)
- [Warn, rather than fail publish, if a target is excluded](https://github.com/rust-lang/cargo/pull/13713/)
- [Add special `check-cfg` lint config for the `unexpected_cfgs` lint](https://github.com/rust-lang/cargo/pull/13913/)
- [Stabilize `cargo update --precise &lt;yanked&gt;`](https://github.com/rust-lang/cargo/pull/13974/)
- [Don't change file permissions on `Cargo.toml` when using `cargo add`](https://github.com/rust-lang/cargo/pull/13898/)
- [Support using `cargo fix` on IPv6-only networks](https://github.com/rust-lang/cargo/pull/13907/)
  Rustdoc
-----
- [Allow searching for references](https://github.com/rust-lang/rust/pull/124148/)
- [Stabilize `custom_code_classes_in_docs` feature](https://github.com/rust-lang/rust/pull/124577/)
- [fix: In cross-crate scenarios show enum variants on type aliases of enums](https://github.com/rust-lang/rust/pull/125300/)
  Compatibility Notes
- [rustfmt estimates line lengths differently when using non-ascii characters](https://github.com/rust-lang/rustfmt/issues/6203)
- [Type aliases are now handled correctly in orphan check](https://github.com/rust-lang/rust/pull/117164/)
- [Allow instructing rustdoc to read from stdin via `-`](https://github.com/rust-lang/rust/pull/124611/)
- [`std::env::{set_var, remove_var}` can no longer be converted to safe function pointers and no longer implement the `Fn` family of traits](https://github.com/rust-lang/rust/pull/124636)
- [Warn (or error) when `Self` constructor from outer item is referenced in inner nested item](https://github.com/rust-lang/rust/pull/124187/)
- [Turn `indirect_structural_match` and `pointer_structural_match` lints into hard errors](https://github.com/rust-lang/rust/pull/124661/)
- [Make `where_clause_object_safety` lint a regular object safety violation](https://github.com/rust-lang/rust/pull/125380/)
- [Turn `proc_macro_back_compat` lint into a hard error.](https://github.com/rust-lang/rust/pull/125596/)
- [Detect unused structs even when implementing private traits](https://github.com/rust-lang/rust/pull/122382/)
- [`std::sync::ReentrantLockGuard&lt;T&gt;` is no longer `Sync` if `T: !Sync`](https://github.com/rust-lang/rust/pull/125527) which means [`std::io::StdoutLock` and `std::io::StderrLock` are no longer Sync](https://github.com/rust-lang/rust/issues/127340)
  Internal Changes
  These changes do not affect any public interfaces of Rust, but they represent
  significant improvements to the performance or internals of rustc and related
  tools.
- Misc improvements to size of generated html by rustdoc e.g. [#124738](https://github.com/rust-lang/rust/pull/124738/) and [#123734](https://github.com/rust-lang/rust/pull/123734/)
- [MSVC targets no longer depend on libc](https://github.com/rust-lang/rust/pull/124050/)</changelog>
</package>
<package pkgid="5d12cd4ba0de8f94202a015d953c2d7697233c0bbd4d827591e48853c74a2626" name="cargo1.80" arch="aarch64">
  <version epoch="0" ver="1.80.1" rel="150500.11.6.1"/>
  <changelog author="william.brown@suse.com" date="1721995200">Version 1.80.0 (2024-07-25)
  Language
--------
- [Document maximum allocation size](https://github.com/rust-lang/rust/pull/116675/)
- [Allow zero-byte offsets and ZST read/writes on arbitrary pointers](https://github.com/rust-lang/rust/pull/117329/)
- [Support C23's variadics without a named parameter](https://github.com/rust-lang/rust/pull/124048/)
- [Stabilize `exclusive_range_pattern` feature](https://github.com/rust-lang/rust/pull/124459/)
- [Guarantee layout and ABI of `Result` in some scenarios](https://github.com/rust-lang/rust/pull/124870)
  Compiler
--------
- [Update cc crate to v1.0.97 allowing additional spectre mitigations on MSVC targets](https://github.com/rust-lang/rust/pull/124892/)
- [Allow field reordering on types marked `repr(packed(1))`](https://github.com/rust-lang/rust/pull/125360/)
- [Add a lint against never type fallback affecting unsafe code](https://github.com/rust-lang/rust/pull/123939/)
- [Disallow cast with trailing braced macro in let-else](https://github.com/rust-lang/rust/pull/125049/)
- [Expand `for_loops_over_fallibles` lint to lint on fallibles behind references.](https://github.com/rust-lang/rust/pull/125156/)
- [self-contained linker: retry linking without `-fuse-ld=lld` on CCs that don't support it](https://github.com/rust-lang/rust/pull/125417/)
- [Do not parse CVarArgs (`...`) as a type in trait bounds](https://github.com/rust-lang/rust/pull/125863/)
- Improvements to LLDB formatting [#124458](https://github.com/rust-lang/rust/pull/124458) [#124500](https://github.com/rust-lang/rust/pull/124500)
- [For the wasm32-wasip2 target default to PIC and do not use `-fuse-ld=lld`](https://github.com/rust-lang/rust/pull/124858/)
- [Add x86_64-unknown-linux-none as a tier 3 target](https://github.com/rust-lang/rust/pull/125023/)
- [Lint on `foo.into_iter()` resolving to `&amp;Box&lt;[T]&gt;: IntoIterator`](https://github.com/rust-lang/rust/pull/124097/)
  Libraries
---------
- [Add `size_of` and `size_of_val` and `align_of` and `align_of_val` to the prelude](https://github.com/rust-lang/rust/pull/123168/)
- [Abort a process when FD ownership is violated](https://github.com/rust-lang/rust/pull/124210/)
- [io::Write::write_fmt: panic if the formatter fails when the stream does not fail](https://github.com/rust-lang/rust/pull/125012/)
- [Panic if `PathBuf::set_extension` would add a path separator](https://github.com/rust-lang/rust/pull/125070/)
- [Add assert_unsafe_precondition to unchecked_{add,sub,neg,mul,shl,shr} methods](https://github.com/rust-lang/rust/pull/121571/)
- [Update `c_char` on AIX to use the correct type](https://github.com/rust-lang/rust/pull/122986/)
- [`offset_of!` no longer returns a temporary](https://github.com/rust-lang/rust/pull/124484/)
- [Handle sigma in `str.to_lowercase` correctly](https://github.com/rust-lang/rust/pull/124773/)
- [Raise `DEFAULT_MIN_STACK_SIZE` to at least 64KiB](https://github.com/rust-lang/rust/pull/126059/)
  Stabilized APIs
- [`impl Default for Rc&lt;CStr&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3CCStr%3E)
- [`impl Default for Rc&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3Cstr%3E)
- [`impl Default for Rc&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3C%5BT%5D%3E)
- [`impl Default for Arc&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3Cstr%3E)
- [`impl Default for Arc&lt;CStr&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3CCStr%3E)
- [`impl Default for Arc&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3C%5BT%5D%3E)
- [`impl IntoIterator for Box&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-IntoIterator-for-Box%3C%5BI%5D,+A%3E)
- [`impl FromIterator&lt;String&gt; for Box&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-FromIterator%3CString%3E-for-Box%3Cstr%3E)
- [`impl FromIterator&lt;char&gt; for Box&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-FromIterator%3Cchar%3E-for-Box%3Cstr%3E)
- [`LazyCell`](https://doc.rust-lang.org/beta/core/cell/struct.LazyCell.html)
- [`LazyLock`](https://doc.rust-lang.org/beta/std/sync/struct.LazyLock.html)
- [`Duration::div_duration_f32`](https://doc.rust-lang.org/beta/std/time/struct.Duration.html#method.div_duration_f32)
- [`Duration::div_duration_f64`](https://doc.rust-lang.org/beta/std/time/struct.Duration.html#method.div_duration_f64)
- [`Option::take_if`](https://doc.rust-lang.org/beta/std/option/enum.Option.html#method.take_if)
- [`Seek::seek_relative`](https://doc.rust-lang.org/beta/std/io/trait.Seek.html#method.seek_relative)
- [`BinaryHeap::as_slice`](https://doc.rust-lang.org/beta/std/collections/struct.BinaryHeap.html#method.as_slice)
- [`NonNull::offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.offset)
- [`NonNull::byte_offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_offset)
- [`NonNull::add`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.add)
- [`NonNull::byte_add`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_add)
- [`NonNull::sub`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.sub)
- [`NonNull::byte_sub`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_sub)
- [`NonNull::offset_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.offset_from)
- [`NonNull::byte_offset_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_offset_from)
- [`NonNull::read`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read)
- [`NonNull::read_volatile`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read_volatile)
- [`NonNull::read_unaligned`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read_unaligned)
- [`NonNull::write`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write)
- [`NonNull::write_volatile`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_volatile)
- [`NonNull::write_unaligned`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_unaligned)
- [`NonNull::write_bytes`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_bytes)
- [`NonNull::copy_to`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_to)
- [`NonNull::copy_to_nonoverlapping`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_to_nonoverlapping)
- [`NonNull::copy_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_from)
- [`NonNull::copy_from_nonoverlapping`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_from_nonoverlapping)
- [`NonNull::replace`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.replace)
- [`NonNull::swap`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.swap)
- [`NonNull::drop_in_place`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.drop_in_place)
- [`NonNull::align_offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.align_offset)
- [`&lt;[T]&gt;::split_at_checked`](https://doc.rust-lang.org/beta/std/primitive.slice.html#method.split_at_checked)
- [`&lt;[T]&gt;::split_at_mut_checked`](https://doc.rust-lang.org/beta/std/primitive.slice.html#method.split_at_mut_checked)
- [`str::split_at_checked`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.split_at_checked)
- [`str::split_at_mut_checked`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.split_at_mut_checked)
- [`str::trim_ascii`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii)
- [`str::trim_ascii_start`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii_start)
- [`str::trim_ascii_end`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii_end)
- [`&lt;[u8]&gt;::trim_ascii`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii)
- [`&lt;[u8]&gt;::trim_ascii_start`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii_start)
- [`&lt;[u8]&gt;::trim_ascii_end`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii_end)
- [`Ipv4Addr::BITS`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#associatedconstant.BITS)
- [`Ipv4Addr::to_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#method.to_bits)
- [`Ipv4Addr::from_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#method.from_bits)
- [`Ipv6Addr::BITS`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#associatedconstant.BITS)
- [`Ipv6Addr::to_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#method.to_bits)
- [`Ipv6Addr::from_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#method.from_bits)
- [`Vec::&lt;[T; N]&gt;::into_flattened`](https://doc.rust-lang.org/beta/alloc/vec/struct.Vec.html#method.into_flattened)
- [`&lt;[[T; N]]&gt;::as_flattened`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.as_flattened)
- [`&lt;[[T; N]]&gt;::as_flattened_mut`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.as_flattened_mut)
  These APIs are now stable in const contexts:
- [`&lt;[T]&gt;::last_chunk`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.last_chunk)
- [`BinaryHeap::new`](https://doc.rust-lang.org/beta/std/collections/struct.BinaryHeap.html#method.new)
  Cargo
-----
- [Stabilize `-Zcheck-cfg` as always enabled](https://github.com/rust-lang/cargo/pull/13571/)
- [Warn, rather than fail publish, if a target is excluded](https://github.com/rust-lang/cargo/pull/13713/)
- [Add special `check-cfg` lint config for the `unexpected_cfgs` lint](https://github.com/rust-lang/cargo/pull/13913/)
- [Stabilize `cargo update --precise &lt;yanked&gt;`](https://github.com/rust-lang/cargo/pull/13974/)
- [Don't change file permissions on `Cargo.toml` when using `cargo add`](https://github.com/rust-lang/cargo/pull/13898/)
- [Support using `cargo fix` on IPv6-only networks](https://github.com/rust-lang/cargo/pull/13907/)
  Rustdoc
-----
- [Allow searching for references](https://github.com/rust-lang/rust/pull/124148/)
- [Stabilize `custom_code_classes_in_docs` feature](https://github.com/rust-lang/rust/pull/124577/)
- [fix: In cross-crate scenarios show enum variants on type aliases of enums](https://github.com/rust-lang/rust/pull/125300/)
  Compatibility Notes
- [rustfmt estimates line lengths differently when using non-ascii characters](https://github.com/rust-lang/rustfmt/issues/6203)
- [Type aliases are now handled correctly in orphan check](https://github.com/rust-lang/rust/pull/117164/)
- [Allow instructing rustdoc to read from stdin via `-`](https://github.com/rust-lang/rust/pull/124611/)
- [`std::env::{set_var, remove_var}` can no longer be converted to safe function pointers and no longer implement the `Fn` family of traits](https://github.com/rust-lang/rust/pull/124636)
- [Warn (or error) when `Self` constructor from outer item is referenced in inner nested item](https://github.com/rust-lang/rust/pull/124187/)
- [Turn `indirect_structural_match` and `pointer_structural_match` lints into hard errors](https://github.com/rust-lang/rust/pull/124661/)
- [Make `where_clause_object_safety` lint a regular object safety violation](https://github.com/rust-lang/rust/pull/125380/)
- [Turn `proc_macro_back_compat` lint into a hard error.](https://github.com/rust-lang/rust/pull/125596/)
- [Detect unused structs even when implementing private traits](https://github.com/rust-lang/rust/pull/122382/)
- [`std::sync::ReentrantLockGuard&lt;T&gt;` is no longer `Sync` if `T: !Sync`](https://github.com/rust-lang/rust/pull/125527) which means [`std::io::StdoutLock` and `std::io::StderrLock` are no longer Sync](https://github.com/rust-lang/rust/issues/127340)
  Internal Changes
  These changes do not affect any public interfaces of Rust, but they represent
  significant improvements to the performance or internals of rustc and related
  tools.
- Misc improvements to size of generated html by rustdoc e.g. [#124738](https://github.com/rust-lang/rust/pull/124738/) and [#123734](https://github.com/rust-lang/rust/pull/123734/)
- [MSVC targets no longer depend on libc](https://github.com/rust-lang/rust/pull/124050/)</changelog>
  <changelog author="william.brown@suse.com" date="1723204800">Version 1.80.1 (2024-08-08)
- [Fix miscompilation in the jump threading MIR optimization when comparing floats](https://github.com/rust-lang/rust/pull/128271)
- [Revert changes to the `dead_code` lint from 1.80.0](https://github.com/rust-lang/rust/pull/128618)</changelog>
</package>
<package pkgid="ddd4a568924a3408c242b5795854c08b20ff854bfff30e2c20f088151b74dbd3" name="cargo1.80" arch="ppc64le">
  <version epoch="0" ver="1.80.1" rel="150500.11.6.1"/>
  <changelog author="william.brown@suse.com" date="1721995200">Version 1.80.0 (2024-07-25)
  Language
--------
- [Document maximum allocation size](https://github.com/rust-lang/rust/pull/116675/)
- [Allow zero-byte offsets and ZST read/writes on arbitrary pointers](https://github.com/rust-lang/rust/pull/117329/)
- [Support C23's variadics without a named parameter](https://github.com/rust-lang/rust/pull/124048/)
- [Stabilize `exclusive_range_pattern` feature](https://github.com/rust-lang/rust/pull/124459/)
- [Guarantee layout and ABI of `Result` in some scenarios](https://github.com/rust-lang/rust/pull/124870)
  Compiler
--------
- [Update cc crate to v1.0.97 allowing additional spectre mitigations on MSVC targets](https://github.com/rust-lang/rust/pull/124892/)
- [Allow field reordering on types marked `repr(packed(1))`](https://github.com/rust-lang/rust/pull/125360/)
- [Add a lint against never type fallback affecting unsafe code](https://github.com/rust-lang/rust/pull/123939/)
- [Disallow cast with trailing braced macro in let-else](https://github.com/rust-lang/rust/pull/125049/)
- [Expand `for_loops_over_fallibles` lint to lint on fallibles behind references.](https://github.com/rust-lang/rust/pull/125156/)
- [self-contained linker: retry linking without `-fuse-ld=lld` on CCs that don't support it](https://github.com/rust-lang/rust/pull/125417/)
- [Do not parse CVarArgs (`...`) as a type in trait bounds](https://github.com/rust-lang/rust/pull/125863/)
- Improvements to LLDB formatting [#124458](https://github.com/rust-lang/rust/pull/124458) [#124500](https://github.com/rust-lang/rust/pull/124500)
- [For the wasm32-wasip2 target default to PIC and do not use `-fuse-ld=lld`](https://github.com/rust-lang/rust/pull/124858/)
- [Add x86_64-unknown-linux-none as a tier 3 target](https://github.com/rust-lang/rust/pull/125023/)
- [Lint on `foo.into_iter()` resolving to `&amp;Box&lt;[T]&gt;: IntoIterator`](https://github.com/rust-lang/rust/pull/124097/)
  Libraries
---------
- [Add `size_of` and `size_of_val` and `align_of` and `align_of_val` to the prelude](https://github.com/rust-lang/rust/pull/123168/)
- [Abort a process when FD ownership is violated](https://github.com/rust-lang/rust/pull/124210/)
- [io::Write::write_fmt: panic if the formatter fails when the stream does not fail](https://github.com/rust-lang/rust/pull/125012/)
- [Panic if `PathBuf::set_extension` would add a path separator](https://github.com/rust-lang/rust/pull/125070/)
- [Add assert_unsafe_precondition to unchecked_{add,sub,neg,mul,shl,shr} methods](https://github.com/rust-lang/rust/pull/121571/)
- [Update `c_char` on AIX to use the correct type](https://github.com/rust-lang/rust/pull/122986/)
- [`offset_of!` no longer returns a temporary](https://github.com/rust-lang/rust/pull/124484/)
- [Handle sigma in `str.to_lowercase` correctly](https://github.com/rust-lang/rust/pull/124773/)
- [Raise `DEFAULT_MIN_STACK_SIZE` to at least 64KiB](https://github.com/rust-lang/rust/pull/126059/)
  Stabilized APIs
- [`impl Default for Rc&lt;CStr&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3CCStr%3E)
- [`impl Default for Rc&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3Cstr%3E)
- [`impl Default for Rc&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3C%5BT%5D%3E)
- [`impl Default for Arc&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3Cstr%3E)
- [`impl Default for Arc&lt;CStr&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3CCStr%3E)
- [`impl Default for Arc&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3C%5BT%5D%3E)
- [`impl IntoIterator for Box&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-IntoIterator-for-Box%3C%5BI%5D,+A%3E)
- [`impl FromIterator&lt;String&gt; for Box&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-FromIterator%3CString%3E-for-Box%3Cstr%3E)
- [`impl FromIterator&lt;char&gt; for Box&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-FromIterator%3Cchar%3E-for-Box%3Cstr%3E)
- [`LazyCell`](https://doc.rust-lang.org/beta/core/cell/struct.LazyCell.html)
- [`LazyLock`](https://doc.rust-lang.org/beta/std/sync/struct.LazyLock.html)
- [`Duration::div_duration_f32`](https://doc.rust-lang.org/beta/std/time/struct.Duration.html#method.div_duration_f32)
- [`Duration::div_duration_f64`](https://doc.rust-lang.org/beta/std/time/struct.Duration.html#method.div_duration_f64)
- [`Option::take_if`](https://doc.rust-lang.org/beta/std/option/enum.Option.html#method.take_if)
- [`Seek::seek_relative`](https://doc.rust-lang.org/beta/std/io/trait.Seek.html#method.seek_relative)
- [`BinaryHeap::as_slice`](https://doc.rust-lang.org/beta/std/collections/struct.BinaryHeap.html#method.as_slice)
- [`NonNull::offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.offset)
- [`NonNull::byte_offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_offset)
- [`NonNull::add`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.add)
- [`NonNull::byte_add`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_add)
- [`NonNull::sub`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.sub)
- [`NonNull::byte_sub`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_sub)
- [`NonNull::offset_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.offset_from)
- [`NonNull::byte_offset_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_offset_from)
- [`NonNull::read`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read)
- [`NonNull::read_volatile`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read_volatile)
- [`NonNull::read_unaligned`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read_unaligned)
- [`NonNull::write`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write)
- [`NonNull::write_volatile`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_volatile)
- [`NonNull::write_unaligned`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_unaligned)
- [`NonNull::write_bytes`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_bytes)
- [`NonNull::copy_to`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_to)
- [`NonNull::copy_to_nonoverlapping`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_to_nonoverlapping)
- [`NonNull::copy_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_from)
- [`NonNull::copy_from_nonoverlapping`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_from_nonoverlapping)
- [`NonNull::replace`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.replace)
- [`NonNull::swap`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.swap)
- [`NonNull::drop_in_place`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.drop_in_place)
- [`NonNull::align_offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.align_offset)
- [`&lt;[T]&gt;::split_at_checked`](https://doc.rust-lang.org/beta/std/primitive.slice.html#method.split_at_checked)
- [`&lt;[T]&gt;::split_at_mut_checked`](https://doc.rust-lang.org/beta/std/primitive.slice.html#method.split_at_mut_checked)
- [`str::split_at_checked`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.split_at_checked)
- [`str::split_at_mut_checked`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.split_at_mut_checked)
- [`str::trim_ascii`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii)
- [`str::trim_ascii_start`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii_start)
- [`str::trim_ascii_end`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii_end)
- [`&lt;[u8]&gt;::trim_ascii`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii)
- [`&lt;[u8]&gt;::trim_ascii_start`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii_start)
- [`&lt;[u8]&gt;::trim_ascii_end`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii_end)
- [`Ipv4Addr::BITS`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#associatedconstant.BITS)
- [`Ipv4Addr::to_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#method.to_bits)
- [`Ipv4Addr::from_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#method.from_bits)
- [`Ipv6Addr::BITS`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#associatedconstant.BITS)
- [`Ipv6Addr::to_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#method.to_bits)
- [`Ipv6Addr::from_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#method.from_bits)
- [`Vec::&lt;[T; N]&gt;::into_flattened`](https://doc.rust-lang.org/beta/alloc/vec/struct.Vec.html#method.into_flattened)
- [`&lt;[[T; N]]&gt;::as_flattened`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.as_flattened)
- [`&lt;[[T; N]]&gt;::as_flattened_mut`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.as_flattened_mut)
  These APIs are now stable in const contexts:
- [`&lt;[T]&gt;::last_chunk`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.last_chunk)
- [`BinaryHeap::new`](https://doc.rust-lang.org/beta/std/collections/struct.BinaryHeap.html#method.new)
  Cargo
-----
- [Stabilize `-Zcheck-cfg` as always enabled](https://github.com/rust-lang/cargo/pull/13571/)
- [Warn, rather than fail publish, if a target is excluded](https://github.com/rust-lang/cargo/pull/13713/)
- [Add special `check-cfg` lint config for the `unexpected_cfgs` lint](https://github.com/rust-lang/cargo/pull/13913/)
- [Stabilize `cargo update --precise &lt;yanked&gt;`](https://github.com/rust-lang/cargo/pull/13974/)
- [Don't change file permissions on `Cargo.toml` when using `cargo add`](https://github.com/rust-lang/cargo/pull/13898/)
- [Support using `cargo fix` on IPv6-only networks](https://github.com/rust-lang/cargo/pull/13907/)
  Rustdoc
-----
- [Allow searching for references](https://github.com/rust-lang/rust/pull/124148/)
- [Stabilize `custom_code_classes_in_docs` feature](https://github.com/rust-lang/rust/pull/124577/)
- [fix: In cross-crate scenarios show enum variants on type aliases of enums](https://github.com/rust-lang/rust/pull/125300/)
  Compatibility Notes
- [rustfmt estimates line lengths differently when using non-ascii characters](https://github.com/rust-lang/rustfmt/issues/6203)
- [Type aliases are now handled correctly in orphan check](https://github.com/rust-lang/rust/pull/117164/)
- [Allow instructing rustdoc to read from stdin via `-`](https://github.com/rust-lang/rust/pull/124611/)
- [`std::env::{set_var, remove_var}` can no longer be converted to safe function pointers and no longer implement the `Fn` family of traits](https://github.com/rust-lang/rust/pull/124636)
- [Warn (or error) when `Self` constructor from outer item is referenced in inner nested item](https://github.com/rust-lang/rust/pull/124187/)
- [Turn `indirect_structural_match` and `pointer_structural_match` lints into hard errors](https://github.com/rust-lang/rust/pull/124661/)
- [Make `where_clause_object_safety` lint a regular object safety violation](https://github.com/rust-lang/rust/pull/125380/)
- [Turn `proc_macro_back_compat` lint into a hard error.](https://github.com/rust-lang/rust/pull/125596/)
- [Detect unused structs even when implementing private traits](https://github.com/rust-lang/rust/pull/122382/)
- [`std::sync::ReentrantLockGuard&lt;T&gt;` is no longer `Sync` if `T: !Sync`](https://github.com/rust-lang/rust/pull/125527) which means [`std::io::StdoutLock` and `std::io::StderrLock` are no longer Sync](https://github.com/rust-lang/rust/issues/127340)
  Internal Changes
  These changes do not affect any public interfaces of Rust, but they represent
  significant improvements to the performance or internals of rustc and related
  tools.
- Misc improvements to size of generated html by rustdoc e.g. [#124738](https://github.com/rust-lang/rust/pull/124738/) and [#123734](https://github.com/rust-lang/rust/pull/123734/)
- [MSVC targets no longer depend on libc](https://github.com/rust-lang/rust/pull/124050/)</changelog>
  <changelog author="william.brown@suse.com" date="1723204800">Version 1.80.1 (2024-08-08)
- [Fix miscompilation in the jump threading MIR optimization when comparing floats](https://github.com/rust-lang/rust/pull/128271)
- [Revert changes to the `dead_code` lint from 1.80.0](https://github.com/rust-lang/rust/pull/128618)</changelog>
</package>
<package pkgid="b732ba930ddcf891c737135b31de0573dbad3bceebbc1c001e727724bf66ac36" name="cargo1.80" arch="s390x">
  <version epoch="0" ver="1.80.1" rel="150500.11.6.1"/>
  <changelog author="william.brown@suse.com" date="1721995200">Version 1.80.0 (2024-07-25)
  Language
--------
- [Document maximum allocation size](https://github.com/rust-lang/rust/pull/116675/)
- [Allow zero-byte offsets and ZST read/writes on arbitrary pointers](https://github.com/rust-lang/rust/pull/117329/)
- [Support C23's variadics without a named parameter](https://github.com/rust-lang/rust/pull/124048/)
- [Stabilize `exclusive_range_pattern` feature](https://github.com/rust-lang/rust/pull/124459/)
- [Guarantee layout and ABI of `Result` in some scenarios](https://github.com/rust-lang/rust/pull/124870)
  Compiler
--------
- [Update cc crate to v1.0.97 allowing additional spectre mitigations on MSVC targets](https://github.com/rust-lang/rust/pull/124892/)
- [Allow field reordering on types marked `repr(packed(1))`](https://github.com/rust-lang/rust/pull/125360/)
- [Add a lint against never type fallback affecting unsafe code](https://github.com/rust-lang/rust/pull/123939/)
- [Disallow cast with trailing braced macro in let-else](https://github.com/rust-lang/rust/pull/125049/)
- [Expand `for_loops_over_fallibles` lint to lint on fallibles behind references.](https://github.com/rust-lang/rust/pull/125156/)
- [self-contained linker: retry linking without `-fuse-ld=lld` on CCs that don't support it](https://github.com/rust-lang/rust/pull/125417/)
- [Do not parse CVarArgs (`...`) as a type in trait bounds](https://github.com/rust-lang/rust/pull/125863/)
- Improvements to LLDB formatting [#124458](https://github.com/rust-lang/rust/pull/124458) [#124500](https://github.com/rust-lang/rust/pull/124500)
- [For the wasm32-wasip2 target default to PIC and do not use `-fuse-ld=lld`](https://github.com/rust-lang/rust/pull/124858/)
- [Add x86_64-unknown-linux-none as a tier 3 target](https://github.com/rust-lang/rust/pull/125023/)
- [Lint on `foo.into_iter()` resolving to `&amp;Box&lt;[T]&gt;: IntoIterator`](https://github.com/rust-lang/rust/pull/124097/)
  Libraries
---------
- [Add `size_of` and `size_of_val` and `align_of` and `align_of_val` to the prelude](https://github.com/rust-lang/rust/pull/123168/)
- [Abort a process when FD ownership is violated](https://github.com/rust-lang/rust/pull/124210/)
- [io::Write::write_fmt: panic if the formatter fails when the stream does not fail](https://github.com/rust-lang/rust/pull/125012/)
- [Panic if `PathBuf::set_extension` would add a path separator](https://github.com/rust-lang/rust/pull/125070/)
- [Add assert_unsafe_precondition to unchecked_{add,sub,neg,mul,shl,shr} methods](https://github.com/rust-lang/rust/pull/121571/)
- [Update `c_char` on AIX to use the correct type](https://github.com/rust-lang/rust/pull/122986/)
- [`offset_of!` no longer returns a temporary](https://github.com/rust-lang/rust/pull/124484/)
- [Handle sigma in `str.to_lowercase` correctly](https://github.com/rust-lang/rust/pull/124773/)
- [Raise `DEFAULT_MIN_STACK_SIZE` to at least 64KiB](https://github.com/rust-lang/rust/pull/126059/)
  Stabilized APIs
- [`impl Default for Rc&lt;CStr&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3CCStr%3E)
- [`impl Default for Rc&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3Cstr%3E)
- [`impl Default for Rc&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3C%5BT%5D%3E)
- [`impl Default for Arc&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3Cstr%3E)
- [`impl Default for Arc&lt;CStr&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3CCStr%3E)
- [`impl Default for Arc&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3C%5BT%5D%3E)
- [`impl IntoIterator for Box&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-IntoIterator-for-Box%3C%5BI%5D,+A%3E)
- [`impl FromIterator&lt;String&gt; for Box&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-FromIterator%3CString%3E-for-Box%3Cstr%3E)
- [`impl FromIterator&lt;char&gt; for Box&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-FromIterator%3Cchar%3E-for-Box%3Cstr%3E)
- [`LazyCell`](https://doc.rust-lang.org/beta/core/cell/struct.LazyCell.html)
- [`LazyLock`](https://doc.rust-lang.org/beta/std/sync/struct.LazyLock.html)
- [`Duration::div_duration_f32`](https://doc.rust-lang.org/beta/std/time/struct.Duration.html#method.div_duration_f32)
- [`Duration::div_duration_f64`](https://doc.rust-lang.org/beta/std/time/struct.Duration.html#method.div_duration_f64)
- [`Option::take_if`](https://doc.rust-lang.org/beta/std/option/enum.Option.html#method.take_if)
- [`Seek::seek_relative`](https://doc.rust-lang.org/beta/std/io/trait.Seek.html#method.seek_relative)
- [`BinaryHeap::as_slice`](https://doc.rust-lang.org/beta/std/collections/struct.BinaryHeap.html#method.as_slice)
- [`NonNull::offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.offset)
- [`NonNull::byte_offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_offset)
- [`NonNull::add`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.add)
- [`NonNull::byte_add`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_add)
- [`NonNull::sub`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.sub)
- [`NonNull::byte_sub`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_sub)
- [`NonNull::offset_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.offset_from)
- [`NonNull::byte_offset_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_offset_from)
- [`NonNull::read`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read)
- [`NonNull::read_volatile`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read_volatile)
- [`NonNull::read_unaligned`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read_unaligned)
- [`NonNull::write`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write)
- [`NonNull::write_volatile`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_volatile)
- [`NonNull::write_unaligned`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_unaligned)
- [`NonNull::write_bytes`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_bytes)
- [`NonNull::copy_to`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_to)
- [`NonNull::copy_to_nonoverlapping`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_to_nonoverlapping)
- [`NonNull::copy_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_from)
- [`NonNull::copy_from_nonoverlapping`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_from_nonoverlapping)
- [`NonNull::replace`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.replace)
- [`NonNull::swap`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.swap)
- [`NonNull::drop_in_place`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.drop_in_place)
- [`NonNull::align_offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.align_offset)
- [`&lt;[T]&gt;::split_at_checked`](https://doc.rust-lang.org/beta/std/primitive.slice.html#method.split_at_checked)
- [`&lt;[T]&gt;::split_at_mut_checked`](https://doc.rust-lang.org/beta/std/primitive.slice.html#method.split_at_mut_checked)
- [`str::split_at_checked`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.split_at_checked)
- [`str::split_at_mut_checked`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.split_at_mut_checked)
- [`str::trim_ascii`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii)
- [`str::trim_ascii_start`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii_start)
- [`str::trim_ascii_end`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii_end)
- [`&lt;[u8]&gt;::trim_ascii`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii)
- [`&lt;[u8]&gt;::trim_ascii_start`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii_start)
- [`&lt;[u8]&gt;::trim_ascii_end`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii_end)
- [`Ipv4Addr::BITS`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#associatedconstant.BITS)
- [`Ipv4Addr::to_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#method.to_bits)
- [`Ipv4Addr::from_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#method.from_bits)
- [`Ipv6Addr::BITS`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#associatedconstant.BITS)
- [`Ipv6Addr::to_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#method.to_bits)
- [`Ipv6Addr::from_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#method.from_bits)
- [`Vec::&lt;[T; N]&gt;::into_flattened`](https://doc.rust-lang.org/beta/alloc/vec/struct.Vec.html#method.into_flattened)
- [`&lt;[[T; N]]&gt;::as_flattened`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.as_flattened)
- [`&lt;[[T; N]]&gt;::as_flattened_mut`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.as_flattened_mut)
  These APIs are now stable in const contexts:
- [`&lt;[T]&gt;::last_chunk`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.last_chunk)
- [`BinaryHeap::new`](https://doc.rust-lang.org/beta/std/collections/struct.BinaryHeap.html#method.new)
  Cargo
-----
- [Stabilize `-Zcheck-cfg` as always enabled](https://github.com/rust-lang/cargo/pull/13571/)
- [Warn, rather than fail publish, if a target is excluded](https://github.com/rust-lang/cargo/pull/13713/)
- [Add special `check-cfg` lint config for the `unexpected_cfgs` lint](https://github.com/rust-lang/cargo/pull/13913/)
- [Stabilize `cargo update --precise &lt;yanked&gt;`](https://github.com/rust-lang/cargo/pull/13974/)
- [Don't change file permissions on `Cargo.toml` when using `cargo add`](https://github.com/rust-lang/cargo/pull/13898/)
- [Support using `cargo fix` on IPv6-only networks](https://github.com/rust-lang/cargo/pull/13907/)
  Rustdoc
-----
- [Allow searching for references](https://github.com/rust-lang/rust/pull/124148/)
- [Stabilize `custom_code_classes_in_docs` feature](https://github.com/rust-lang/rust/pull/124577/)
- [fix: In cross-crate scenarios show enum variants on type aliases of enums](https://github.com/rust-lang/rust/pull/125300/)
  Compatibility Notes
- [rustfmt estimates line lengths differently when using non-ascii characters](https://github.com/rust-lang/rustfmt/issues/6203)
- [Type aliases are now handled correctly in orphan check](https://github.com/rust-lang/rust/pull/117164/)
- [Allow instructing rustdoc to read from stdin via `-`](https://github.com/rust-lang/rust/pull/124611/)
- [`std::env::{set_var, remove_var}` can no longer be converted to safe function pointers and no longer implement the `Fn` family of traits](https://github.com/rust-lang/rust/pull/124636)
- [Warn (or error) when `Self` constructor from outer item is referenced in inner nested item](https://github.com/rust-lang/rust/pull/124187/)
- [Turn `indirect_structural_match` and `pointer_structural_match` lints into hard errors](https://github.com/rust-lang/rust/pull/124661/)
- [Make `where_clause_object_safety` lint a regular object safety violation](https://github.com/rust-lang/rust/pull/125380/)
- [Turn `proc_macro_back_compat` lint into a hard error.](https://github.com/rust-lang/rust/pull/125596/)
- [Detect unused structs even when implementing private traits](https://github.com/rust-lang/rust/pull/122382/)
- [`std::sync::ReentrantLockGuard&lt;T&gt;` is no longer `Sync` if `T: !Sync`](https://github.com/rust-lang/rust/pull/125527) which means [`std::io::StdoutLock` and `std::io::StderrLock` are no longer Sync](https://github.com/rust-lang/rust/issues/127340)
  Internal Changes
  These changes do not affect any public interfaces of Rust, but they represent
  significant improvements to the performance or internals of rustc and related
  tools.
- Misc improvements to size of generated html by rustdoc e.g. [#124738](https://github.com/rust-lang/rust/pull/124738/) and [#123734](https://github.com/rust-lang/rust/pull/123734/)
- [MSVC targets no longer depend on libc](https://github.com/rust-lang/rust/pull/124050/)</changelog>
  <changelog author="william.brown@suse.com" date="1723204800">Version 1.80.1 (2024-08-08)
- [Fix miscompilation in the jump threading MIR optimization when comparing floats](https://github.com/rust-lang/rust/pull/128271)
- [Revert changes to the `dead_code` lint from 1.80.0](https://github.com/rust-lang/rust/pull/128618)</changelog>
</package>
<package pkgid="20f09a179965502a6b75d3418f8d48c1fa9edd8292fca31dac2dadf4fa72a4a1" name="cargo1.80" arch="x86_64">
  <version epoch="0" ver="1.80.1" rel="150500.11.6.1"/>
  <changelog author="william.brown@suse.com" date="1721995200">Version 1.80.0 (2024-07-25)
  Language
--------
- [Document maximum allocation size](https://github.com/rust-lang/rust/pull/116675/)
- [Allow zero-byte offsets and ZST read/writes on arbitrary pointers](https://github.com/rust-lang/rust/pull/117329/)
- [Support C23's variadics without a named parameter](https://github.com/rust-lang/rust/pull/124048/)
- [Stabilize `exclusive_range_pattern` feature](https://github.com/rust-lang/rust/pull/124459/)
- [Guarantee layout and ABI of `Result` in some scenarios](https://github.com/rust-lang/rust/pull/124870)
  Compiler
--------
- [Update cc crate to v1.0.97 allowing additional spectre mitigations on MSVC targets](https://github.com/rust-lang/rust/pull/124892/)
- [Allow field reordering on types marked `repr(packed(1))`](https://github.com/rust-lang/rust/pull/125360/)
- [Add a lint against never type fallback affecting unsafe code](https://github.com/rust-lang/rust/pull/123939/)
- [Disallow cast with trailing braced macro in let-else](https://github.com/rust-lang/rust/pull/125049/)
- [Expand `for_loops_over_fallibles` lint to lint on fallibles behind references.](https://github.com/rust-lang/rust/pull/125156/)
- [self-contained linker: retry linking without `-fuse-ld=lld` on CCs that don't support it](https://github.com/rust-lang/rust/pull/125417/)
- [Do not parse CVarArgs (`...`) as a type in trait bounds](https://github.com/rust-lang/rust/pull/125863/)
- Improvements to LLDB formatting [#124458](https://github.com/rust-lang/rust/pull/124458) [#124500](https://github.com/rust-lang/rust/pull/124500)
- [For the wasm32-wasip2 target default to PIC and do not use `-fuse-ld=lld`](https://github.com/rust-lang/rust/pull/124858/)
- [Add x86_64-unknown-linux-none as a tier 3 target](https://github.com/rust-lang/rust/pull/125023/)
- [Lint on `foo.into_iter()` resolving to `&amp;Box&lt;[T]&gt;: IntoIterator`](https://github.com/rust-lang/rust/pull/124097/)
  Libraries
---------
- [Add `size_of` and `size_of_val` and `align_of` and `align_of_val` to the prelude](https://github.com/rust-lang/rust/pull/123168/)
- [Abort a process when FD ownership is violated](https://github.com/rust-lang/rust/pull/124210/)
- [io::Write::write_fmt: panic if the formatter fails when the stream does not fail](https://github.com/rust-lang/rust/pull/125012/)
- [Panic if `PathBuf::set_extension` would add a path separator](https://github.com/rust-lang/rust/pull/125070/)
- [Add assert_unsafe_precondition to unchecked_{add,sub,neg,mul,shl,shr} methods](https://github.com/rust-lang/rust/pull/121571/)
- [Update `c_char` on AIX to use the correct type](https://github.com/rust-lang/rust/pull/122986/)
- [`offset_of!` no longer returns a temporary](https://github.com/rust-lang/rust/pull/124484/)
- [Handle sigma in `str.to_lowercase` correctly](https://github.com/rust-lang/rust/pull/124773/)
- [Raise `DEFAULT_MIN_STACK_SIZE` to at least 64KiB](https://github.com/rust-lang/rust/pull/126059/)
  Stabilized APIs
- [`impl Default for Rc&lt;CStr&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3CCStr%3E)
- [`impl Default for Rc&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3Cstr%3E)
- [`impl Default for Rc&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/rc/struct.Rc.html#impl-Default-for-Rc%3C%5BT%5D%3E)
- [`impl Default for Arc&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3Cstr%3E)
- [`impl Default for Arc&lt;CStr&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3CCStr%3E)
- [`impl Default for Arc&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/sync/struct.Arc.html#impl-Default-for-Arc%3C%5BT%5D%3E)
- [`impl IntoIterator for Box&lt;[T]&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-IntoIterator-for-Box%3C%5BI%5D,+A%3E)
- [`impl FromIterator&lt;String&gt; for Box&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-FromIterator%3CString%3E-for-Box%3Cstr%3E)
- [`impl FromIterator&lt;char&gt; for Box&lt;str&gt;`](https://doc.rust-lang.org/beta/alloc/boxed/struct.Box.html#impl-FromIterator%3Cchar%3E-for-Box%3Cstr%3E)
- [`LazyCell`](https://doc.rust-lang.org/beta/core/cell/struct.LazyCell.html)
- [`LazyLock`](https://doc.rust-lang.org/beta/std/sync/struct.LazyLock.html)
- [`Duration::div_duration_f32`](https://doc.rust-lang.org/beta/std/time/struct.Duration.html#method.div_duration_f32)
- [`Duration::div_duration_f64`](https://doc.rust-lang.org/beta/std/time/struct.Duration.html#method.div_duration_f64)
- [`Option::take_if`](https://doc.rust-lang.org/beta/std/option/enum.Option.html#method.take_if)
- [`Seek::seek_relative`](https://doc.rust-lang.org/beta/std/io/trait.Seek.html#method.seek_relative)
- [`BinaryHeap::as_slice`](https://doc.rust-lang.org/beta/std/collections/struct.BinaryHeap.html#method.as_slice)
- [`NonNull::offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.offset)
- [`NonNull::byte_offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_offset)
- [`NonNull::add`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.add)
- [`NonNull::byte_add`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_add)
- [`NonNull::sub`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.sub)
- [`NonNull::byte_sub`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_sub)
- [`NonNull::offset_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.offset_from)
- [`NonNull::byte_offset_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.byte_offset_from)
- [`NonNull::read`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read)
- [`NonNull::read_volatile`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read_volatile)
- [`NonNull::read_unaligned`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.read_unaligned)
- [`NonNull::write`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write)
- [`NonNull::write_volatile`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_volatile)
- [`NonNull::write_unaligned`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_unaligned)
- [`NonNull::write_bytes`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.write_bytes)
- [`NonNull::copy_to`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_to)
- [`NonNull::copy_to_nonoverlapping`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_to_nonoverlapping)
- [`NonNull::copy_from`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_from)
- [`NonNull::copy_from_nonoverlapping`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.copy_from_nonoverlapping)
- [`NonNull::replace`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.replace)
- [`NonNull::swap`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.swap)
- [`NonNull::drop_in_place`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.drop_in_place)
- [`NonNull::align_offset`](https://doc.rust-lang.org/beta/std/ptr/struct.NonNull.html#method.align_offset)
- [`&lt;[T]&gt;::split_at_checked`](https://doc.rust-lang.org/beta/std/primitive.slice.html#method.split_at_checked)
- [`&lt;[T]&gt;::split_at_mut_checked`](https://doc.rust-lang.org/beta/std/primitive.slice.html#method.split_at_mut_checked)
- [`str::split_at_checked`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.split_at_checked)
- [`str::split_at_mut_checked`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.split_at_mut_checked)
- [`str::trim_ascii`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii)
- [`str::trim_ascii_start`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii_start)
- [`str::trim_ascii_end`](https://doc.rust-lang.org/beta/std/primitive.str.html#method.trim_ascii_end)
- [`&lt;[u8]&gt;::trim_ascii`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii)
- [`&lt;[u8]&gt;::trim_ascii_start`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii_start)
- [`&lt;[u8]&gt;::trim_ascii_end`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.trim_ascii_end)
- [`Ipv4Addr::BITS`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#associatedconstant.BITS)
- [`Ipv4Addr::to_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#method.to_bits)
- [`Ipv4Addr::from_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv4Addr.html#method.from_bits)
- [`Ipv6Addr::BITS`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#associatedconstant.BITS)
- [`Ipv6Addr::to_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#method.to_bits)
- [`Ipv6Addr::from_bits`](https://doc.rust-lang.org/beta/core/net/struct.Ipv6Addr.html#method.from_bits)
- [`Vec::&lt;[T; N]&gt;::into_flattened`](https://doc.rust-lang.org/beta/alloc/vec/struct.Vec.html#method.into_flattened)
- [`&lt;[[T; N]]&gt;::as_flattened`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.as_flattened)
- [`&lt;[[T; N]]&gt;::as_flattened_mut`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.as_flattened_mut)
  These APIs are now stable in const contexts:
- [`&lt;[T]&gt;::last_chunk`](https://doc.rust-lang.org/beta/core/primitive.slice.html#method.last_chunk)
- [`BinaryHeap::new`](https://doc.rust-lang.org/beta/std/collections/struct.BinaryHeap.html#method.new)
  Cargo
-----
- [Stabilize `-Zcheck-cfg` as always enabled](https://github.com/rust-lang/cargo/pull/13571/)
- [Warn, rather than fail publish, if a target is excluded](https://github.com/rust-lang/cargo/pull/13713/)
- [Add special `check-cfg` lint config for the `unexpected_cfgs` lint](https://github.com/rust-lang/cargo/pull/13913/)
- [Stabilize `cargo update --precise &lt;yanked&gt;`](https://github.com/rust-lang/cargo/pull/13974/)
- [Don't change file permissions on `Cargo.toml` when using `cargo add`](https://github.com/rust-lang/cargo/pull/13898/)
- [Support using `cargo fix` on IPv6-only networks](https://github.com/rust-lang/cargo/pull/13907/)
  Rustdoc
-----
- [Allow searching for references](https://github.com/rust-lang/rust/pull/124148/)
- [Stabilize `custom_code_classes_in_docs` feature](https://github.com/rust-lang/rust/pull/124577/)
- [fix: In cross-crate scenarios show enum variants on type aliases of enums](https://github.com/rust-lang/rust/pull/125300/)
  Compatibility Notes
- [rustfmt estimates line lengths differently when using non-ascii characters](https://github.com/rust-lang/rustfmt/issues/6203)
- [Type aliases are now handled correctly in orphan check](https://github.com/rust-lang/rust/pull/117164/)
- [Allow instructing rustdoc to read from stdin via `-`](https://github.com/rust-lang/rust/pull/124611/)
- [`std::env::{set_var, remove_var}` can no longer be converted to safe function pointers and no longer implement the `Fn` family of traits](https://github.com/rust-lang/rust/pull/124636)
- [Warn (or error) when `Self` constructor from outer item is referenced in inner nested item](https://github.com/rust-lang/rust/pull/124187/)
- [Turn `indirect_structural_match` and `pointer_structural_match` lints into hard errors](https://github.com/rust-lang/rust/pull/124661/)
- [Make `where_clause_object_safety` lint a regular object safety violation](https://github.com/rust-lang/rust/pull/125380/)
- [Turn `proc_macro_back_compat` lint into a hard error.](https://github.com/rust-lang/rust/pull/125596/)
- [Detect unused structs even when implementing private traits](https://github.com/rust-lang/rust/pull/122382/)
- [`std::sync::ReentrantLockGuard&lt;T&gt;` is no longer `Sync` if `T: !Sync`](https://github.com/rust-lang/rust/pull/125527) which means [`std::io::StdoutLock` and `std::io::StderrLock` are no longer Sync](https://github.com/rust-lang/rust/issues/127340)
  Internal Changes
  These changes do not affect any public interfaces of Rust, but they represent
  significant improvements to the performance or internals of rustc and related
  tools.
- Misc improvements to size of generated html by rustdoc e.g. [#124738](https://github.com/rust-lang/rust/pull/124738/) and [#123734](https://github.com/rust-lang/rust/pull/123734/)
- [MSVC targets no longer depend on libc](https://github.com/rust-lang/rust/pull/124050/)</changelog>
  <changelog author="william.brown@suse.com" date="1723204800">Version 1.80.1 (2024-08-08)
- [Fix miscompilation in the jump threading MIR optimization when comparing floats](https://github.com/rust-lang/rust/pull/128271)
- [Revert changes to the `dead_code` lint from 1.80.0](https://github.com/rust-lang/rust/pull/128618)</changelog>
</package>
<package pkgid="0c918716dd3133b0c9a42b6c6ad16229652af8e8f6d16bf151a11fc07449fe59" name="catatonit" arch="aarch64">
  <version epoch="0" ver="0.2.0" rel="150500.3.3.1"/>
  <changelog author="asarai@suse.com" date="1522152000">- Initial import of catatonit v0.1.0.</changelog>
  <changelog author="asarai@suse.com" date="1522152001">- Update to catatonit v0.1.1, which includes a fix for the libtool requirement.
  This lets us build on much older distributions.</changelog>
  <changelog author="asarai@suse.com" date="1522324800">- Update to catatonit v0.1.2 and update links to point to openSUSE repo.</changelog>
  <changelog author="jengelh@inai.de" date="1522756800">- Update package descriptions.</changelog>
  <changelog author="asarai@suse.com" date="1523016000">- Fix build to correctly build a static binary (which will allow it to work in
  all containers). This was caused by forgetting to include
  'glibc-devel-static'. I've added a check to ensure it doesn't happen by
  accident again.
- Add catatonit-rpmlintrc to include filters for "static binary" warnings,
  since this is intentional.</changelog>
  <changelog author="asarai@suse.com" date="1524052800">- Update to catatonit v0.1.3, which includes a fix for docker compatiblity so
  that dockerd doesn't give spurrious warnings.</changelog>
  <changelog author="asarai@suse.com" date="1548763200">- Update to catatonit v0.1.4, which includes support for "-g".</changelog>
  <changelog author="asarai@suse.com" date="1583150400">- Update to catatonit v0.1.5, which fixes two bugs where catatonit would hang
  endlessly when pid1 died in very specific ways. bsc#1176155</changelog>
  <changelog author="asarai@suse.com" date="1631793600">- Update to catatonit v0.1.6, which fixes a few bugs -- mainly ones related to
  socket activation or features somewhat adjacent to socket activation (such as
  passing file descriptors).
- Update catatonit-rpmlintrc in order to cover that static binaries are now an
  error not a warning.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637841600">- Add 99bb9048f.patch: configure.ac: call AM_INIT_AUTOMAKE only
  once. Fix build with autocnf 2.71 / automake 1.16.5.</changelog>
  <changelog author="rbrown@suse.com" date="1649678400">- Update to catatont v0.1.7
- This release adds the ability for catatonit to be used as the only
  process in a pause container, by passing the -P flag (in this mode no
  subprocess is spawned and thus no signal forwarding is done).</changelog>
  <changelog author="asarai@suse.com" date="1696248000">- Update to catatonit v0.2.0.
  * Change license to GPL-2.0-or-later.
- Remove upstreamed patches:
  - 99bb9048f.patch</changelog>
</package>
<package pkgid="c2188074196a8465a35210167a5d8a302da22b01afc7949a053ad95c480a6a8c" name="catatonit" arch="ppc64le">
  <version epoch="0" ver="0.2.0" rel="150500.3.3.1"/>
  <changelog author="asarai@suse.com" date="1522152000">- Initial import of catatonit v0.1.0.</changelog>
  <changelog author="asarai@suse.com" date="1522152001">- Update to catatonit v0.1.1, which includes a fix for the libtool requirement.
  This lets us build on much older distributions.</changelog>
  <changelog author="asarai@suse.com" date="1522324800">- Update to catatonit v0.1.2 and update links to point to openSUSE repo.</changelog>
  <changelog author="jengelh@inai.de" date="1522756800">- Update package descriptions.</changelog>
  <changelog author="asarai@suse.com" date="1523016000">- Fix build to correctly build a static binary (which will allow it to work in
  all containers). This was caused by forgetting to include
  'glibc-devel-static'. I've added a check to ensure it doesn't happen by
  accident again.
- Add catatonit-rpmlintrc to include filters for "static binary" warnings,
  since this is intentional.</changelog>
  <changelog author="asarai@suse.com" date="1524052800">- Update to catatonit v0.1.3, which includes a fix for docker compatiblity so
  that dockerd doesn't give spurrious warnings.</changelog>
  <changelog author="asarai@suse.com" date="1548763200">- Update to catatonit v0.1.4, which includes support for "-g".</changelog>
  <changelog author="asarai@suse.com" date="1583150400">- Update to catatonit v0.1.5, which fixes two bugs where catatonit would hang
  endlessly when pid1 died in very specific ways. bsc#1176155</changelog>
  <changelog author="asarai@suse.com" date="1631793600">- Update to catatonit v0.1.6, which fixes a few bugs -- mainly ones related to
  socket activation or features somewhat adjacent to socket activation (such as
  passing file descriptors).
- Update catatonit-rpmlintrc in order to cover that static binaries are now an
  error not a warning.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637841600">- Add 99bb9048f.patch: configure.ac: call AM_INIT_AUTOMAKE only
  once. Fix build with autocnf 2.71 / automake 1.16.5.</changelog>
  <changelog author="rbrown@suse.com" date="1649678400">- Update to catatont v0.1.7
- This release adds the ability for catatonit to be used as the only
  process in a pause container, by passing the -P flag (in this mode no
  subprocess is spawned and thus no signal forwarding is done).</changelog>
  <changelog author="asarai@suse.com" date="1696248000">- Update to catatonit v0.2.0.
  * Change license to GPL-2.0-or-later.
- Remove upstreamed patches:
  - 99bb9048f.patch</changelog>
</package>
<package pkgid="55d041394501c44e7fbbbe51106167887d8ff69ea672bdba48527e9ad9c26640" name="catatonit" arch="s390x">
  <version epoch="0" ver="0.2.0" rel="150500.3.3.1"/>
  <changelog author="asarai@suse.com" date="1522152000">- Initial import of catatonit v0.1.0.</changelog>
  <changelog author="asarai@suse.com" date="1522152001">- Update to catatonit v0.1.1, which includes a fix for the libtool requirement.
  This lets us build on much older distributions.</changelog>
  <changelog author="asarai@suse.com" date="1522324800">- Update to catatonit v0.1.2 and update links to point to openSUSE repo.</changelog>
  <changelog author="jengelh@inai.de" date="1522756800">- Update package descriptions.</changelog>
  <changelog author="asarai@suse.com" date="1523016000">- Fix build to correctly build a static binary (which will allow it to work in
  all containers). This was caused by forgetting to include
  'glibc-devel-static'. I've added a check to ensure it doesn't happen by
  accident again.
- Add catatonit-rpmlintrc to include filters for "static binary" warnings,
  since this is intentional.</changelog>
  <changelog author="asarai@suse.com" date="1524052800">- Update to catatonit v0.1.3, which includes a fix for docker compatiblity so
  that dockerd doesn't give spurrious warnings.</changelog>
  <changelog author="asarai@suse.com" date="1548763200">- Update to catatonit v0.1.4, which includes support for "-g".</changelog>
  <changelog author="asarai@suse.com" date="1583150400">- Update to catatonit v0.1.5, which fixes two bugs where catatonit would hang
  endlessly when pid1 died in very specific ways. bsc#1176155</changelog>
  <changelog author="asarai@suse.com" date="1631793600">- Update to catatonit v0.1.6, which fixes a few bugs -- mainly ones related to
  socket activation or features somewhat adjacent to socket activation (such as
  passing file descriptors).
- Update catatonit-rpmlintrc in order to cover that static binaries are now an
  error not a warning.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637841600">- Add 99bb9048f.patch: configure.ac: call AM_INIT_AUTOMAKE only
  once. Fix build with autocnf 2.71 / automake 1.16.5.</changelog>
  <changelog author="rbrown@suse.com" date="1649678400">- Update to catatont v0.1.7
- This release adds the ability for catatonit to be used as the only
  process in a pause container, by passing the -P flag (in this mode no
  subprocess is spawned and thus no signal forwarding is done).</changelog>
  <changelog author="asarai@suse.com" date="1696248000">- Update to catatonit v0.2.0.
  * Change license to GPL-2.0-or-later.
- Remove upstreamed patches:
  - 99bb9048f.patch</changelog>
</package>
<package pkgid="d920b241cc0190598a79d71c42adc1996e25a16167a5807bf35603ba874b8ebb" name="catatonit" arch="src">
  <version epoch="0" ver="0.2.0" rel="150500.3.3.1"/>
  <changelog author="asarai@suse.com" date="1522152000">- Initial import of catatonit v0.1.0.</changelog>
  <changelog author="asarai@suse.com" date="1522152001">- Update to catatonit v0.1.1, which includes a fix for the libtool requirement.
  This lets us build on much older distributions.</changelog>
  <changelog author="asarai@suse.com" date="1522324800">- Update to catatonit v0.1.2 and update links to point to openSUSE repo.</changelog>
  <changelog author="jengelh@inai.de" date="1522756800">- Update package descriptions.</changelog>
  <changelog author="asarai@suse.com" date="1523016000">- Fix build to correctly build a static binary (which will allow it to work in
  all containers). This was caused by forgetting to include
  'glibc-devel-static'. I've added a check to ensure it doesn't happen by
  accident again.
- Add catatonit-rpmlintrc to include filters for "static binary" warnings,
  since this is intentional.</changelog>
  <changelog author="asarai@suse.com" date="1524052800">- Update to catatonit v0.1.3, which includes a fix for docker compatiblity so
  that dockerd doesn't give spurrious warnings.</changelog>
  <changelog author="asarai@suse.com" date="1548763200">- Update to catatonit v0.1.4, which includes support for "-g".</changelog>
  <changelog author="asarai@suse.com" date="1583150400">- Update to catatonit v0.1.5, which fixes two bugs where catatonit would hang
  endlessly when pid1 died in very specific ways. bsc#1176155</changelog>
  <changelog author="asarai@suse.com" date="1631793600">- Update to catatonit v0.1.6, which fixes a few bugs -- mainly ones related to
  socket activation or features somewhat adjacent to socket activation (such as
  passing file descriptors).
- Update catatonit-rpmlintrc in order to cover that static binaries are now an
  error not a warning.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637841600">- Add 99bb9048f.patch: configure.ac: call AM_INIT_AUTOMAKE only
  once. Fix build with autocnf 2.71 / automake 1.16.5.</changelog>
  <changelog author="rbrown@suse.com" date="1649678400">- Update to catatont v0.1.7
- This release adds the ability for catatonit to be used as the only
  process in a pause container, by passing the -P flag (in this mode no
  subprocess is spawned and thus no signal forwarding is done).</changelog>
  <changelog author="asarai@suse.com" date="1696248000">- Update to catatonit v0.2.0.
  * Change license to GPL-2.0-or-later.
- Remove upstreamed patches:
  - 99bb9048f.patch</changelog>
</package>
<package pkgid="0825a0191a963f7b04cd740fc07e1f0420dcff4e24bf9d5bb97b53ac97adaeaf" name="catatonit" arch="x86_64">
  <version epoch="0" ver="0.2.0" rel="150500.3.3.1"/>
  <changelog author="asarai@suse.com" date="1522152000">- Initial import of catatonit v0.1.0.</changelog>
  <changelog author="asarai@suse.com" date="1522152001">- Update to catatonit v0.1.1, which includes a fix for the libtool requirement.
  This lets us build on much older distributions.</changelog>
  <changelog author="asarai@suse.com" date="1522324800">- Update to catatonit v0.1.2 and update links to point to openSUSE repo.</changelog>
  <changelog author="jengelh@inai.de" date="1522756800">- Update package descriptions.</changelog>
  <changelog author="asarai@suse.com" date="1523016000">- Fix build to correctly build a static binary (which will allow it to work in
  all containers). This was caused by forgetting to include
  'glibc-devel-static'. I've added a check to ensure it doesn't happen by
  accident again.
- Add catatonit-rpmlintrc to include filters for "static binary" warnings,
  since this is intentional.</changelog>
  <changelog author="asarai@suse.com" date="1524052800">- Update to catatonit v0.1.3, which includes a fix for docker compatiblity so
  that dockerd doesn't give spurrious warnings.</changelog>
  <changelog author="asarai@suse.com" date="1548763200">- Update to catatonit v0.1.4, which includes support for "-g".</changelog>
  <changelog author="asarai@suse.com" date="1583150400">- Update to catatonit v0.1.5, which fixes two bugs where catatonit would hang
  endlessly when pid1 died in very specific ways. bsc#1176155</changelog>
  <changelog author="asarai@suse.com" date="1631793600">- Update to catatonit v0.1.6, which fixes a few bugs -- mainly ones related to
  socket activation or features somewhat adjacent to socket activation (such as
  passing file descriptors).
- Update catatonit-rpmlintrc in order to cover that static binaries are now an
  error not a warning.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637841600">- Add 99bb9048f.patch: configure.ac: call AM_INIT_AUTOMAKE only
  once. Fix build with autocnf 2.71 / automake 1.16.5.</changelog>
  <changelog author="rbrown@suse.com" date="1649678400">- Update to catatont v0.1.7
- This release adds the ability for catatonit to be used as the only
  process in a pause container, by passing the -P flag (in this mode no
  subprocess is spawned and thus no signal forwarding is done).</changelog>
  <changelog author="asarai@suse.com" date="1696248000">- Update to catatonit v0.2.0.
  * Change license to GPL-2.0-or-later.
- Remove upstreamed patches:
  - 99bb9048f.patch</changelog>
</package>
<package pkgid="7c95b10c5af2d20a5bc59fbb4d8f51b6b9edf682ed28cb130f36493de677b2cf" name="cdi-api" arch="noarch">
  <version epoch="0" ver="2.0.2" rel="150200.3.11.2"/>
  <changelog author="fstrba@suse.com" date="1553688000">- Initial packaging of cdi-api 1.2
- Generate and customize the ant build.xml file</changelog>
  <changelog author="jengelh@inai.de" date="1553688001">- Replace summary by something that speaks more than two
  acronyms.</changelog>
  <changelog author="fstrba@suse.com" date="1554292800">- Generate the tarball and pack only the api part, to avoid
  distributing non-distribuable content</changelog>
  <changelog author="jengelh@inai.de" date="1554552000">- Use _service instead of custom create-tarball.sh.
- Avoid double-shipping license file.</changelog>
  <changelog author="fstrba@suse.com" date="1647777600">- Build with java source and target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1649073600">- Update to upsteam release 2.0.2
  * No changelog was made available.
- Added patch:
  * 0001-Remove-dependency-on-glassfish-el.patch
    + patch out the two el wrapper functions that are unused</changelog>
  <changelog author="fstrba@suse.com" date="1708516800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1717761600">- Use the javax.inject artifact</changelog>
</package>
<package pkgid="1cdc5b8e3363e8600cc03f2105298b218506b79f13cdbae317c8e75d32b703b8" name="cdi-api" arch="src">
  <version epoch="0" ver="2.0.2" rel="150200.3.11.2"/>
  <changelog author="fstrba@suse.com" date="1553688000">- Initial packaging of cdi-api 1.2
- Generate and customize the ant build.xml file</changelog>
  <changelog author="jengelh@inai.de" date="1553688001">- Replace summary by something that speaks more than two
  acronyms.</changelog>
  <changelog author="fstrba@suse.com" date="1554292800">- Generate the tarball and pack only the api part, to avoid
  distributing non-distribuable content</changelog>
  <changelog author="jengelh@inai.de" date="1554552000">- Use _service instead of custom create-tarball.sh.
- Avoid double-shipping license file.</changelog>
  <changelog author="fstrba@suse.com" date="1647777600">- Build with java source and target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1649073600">- Update to upsteam release 2.0.2
  * No changelog was made available.
- Added patch:
  * 0001-Remove-dependency-on-glassfish-el.patch
    + patch out the two el wrapper functions that are unused</changelog>
  <changelog author="fstrba@suse.com" date="1708516800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1717761600">- Use the javax.inject artifact</changelog>
</package>
<package pkgid="ae0fa3979fc33f8f3ec5794325ee7194d191d72ff306b7c163532f4477c54edd" name="cdi-api-javadoc" arch="noarch">
  <version epoch="0" ver="2.0.2" rel="150200.3.11.2"/>
  <changelog author="fstrba@suse.com" date="1553688000">- Initial packaging of cdi-api 1.2
- Generate and customize the ant build.xml file</changelog>
  <changelog author="jengelh@inai.de" date="1553688001">- Replace summary by something that speaks more than two
  acronyms.</changelog>
  <changelog author="fstrba@suse.com" date="1554292800">- Generate the tarball and pack only the api part, to avoid
  distributing non-distribuable content</changelog>
  <changelog author="jengelh@inai.de" date="1554552000">- Use _service instead of custom create-tarball.sh.
- Avoid double-shipping license file.</changelog>
  <changelog author="fstrba@suse.com" date="1647777600">- Build with java source and target levels 8</changelog>
  <changelog author="fstrba@suse.com" date="1649073600">- Update to upsteam release 2.0.2
  * No changelog was made available.
- Added patch:
  * 0001-Remove-dependency-on-glassfish-el.patch
    + patch out the two el wrapper functions that are unused</changelog>
  <changelog author="fstrba@suse.com" date="1708516800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="fstrba@suse.com" date="1717761600">- Use the javax.inject artifact</changelog>
</package>
<package pkgid="5f4f242f831de1a4a28f418826636e5d1d2522e73d6628ce4afc5b424c043074" name="chrony" arch="aarch64">
  <version epoch="0" ver="4.1" rel="150400.21.5.7"/>
  <changelog author="max@suse.com" date="1591272000">- Add chrony-pool-suse and chrony-pool-openSUSE subpackages that
  preconfigure chrony to use NTP servers from the  respective
  pools for SUSE and openSUSE (bsc#1156884, SLE-11424).
- Add chrony-pool-empty to still allow installing chrony without
  preconfigured servers.
- Use iburst in the default pool statements to speed up initial
  synchronisation (bsc#1172113).</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596369600">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="elimat@opensuse.org" date="1599998400">- Update to 3.5.1:
  * Create new file when writing pidfile (CVE-2020-14367, bsc#1174911)</changelog>
  <changelog author="max@suse.com" date="1600084800">- Adjust and rename the sysconfig file, so that it matches the
  expectations of chronyd.service (bsc#1173277).</changelog>
  <changelog author="kukuk@suse.com" date="1603886400">- By default we don't write log files but log to journald, so
  only recommend logrotate.</changelog>
  <changelog author="mrueckert@suse.de" date="1604232000">- Update to 4.0
  - Enhancements
  - Add support for Network Time Security (NTS) authentication
  - Add support for AES-CMAC keys (AES128, AES256) with Nettle
  - Add authselectmode directive to control selection of
    unauthenticated sources
  - Add binddevice, bindacqdevice, bindcmddevice directives
  - Add confdir directive to better support fragmented
    configuration
  - Add sourcedir directive and "reload sources" command to
    support dynamic NTP sources specified in files
  - Add clockprecision directive
  - Add dscp directive to set Differentiated Services Code Point
    (DSCP)
  - Add -L option to limit log messages by severity
  - Add -p option to print whole configuration with included
    files
  - Add -U option to allow start under non-root user
  - Allow maxsamples to be set to 1 for faster update with -q/-Q
    option
  - Avoid replacing NTP sources with sources that have
    unreachable address
  - Improve pools to repeat name resolution to get "maxsources"
    sources
  - Improve source selection with trusted sources
  - Improve NTP loop test to prevent synchronisation to itself
  - Repeat iburst when NTP source is switched from offline state
    to online
  - Update clock synchronisation status and leap status more
    frequently
  - Update seccomp filter
  - Add "add pool" command
  - Add "reset sources" command to drop all measurements
  - Add authdata command to print details about NTP
    authentication
  - Add selectdata command to print details about source
    selection
  - Add -N option and sourcename command to print original names
    of sources
  - Add -a option to some commands to print also unresolved
    sources
  - Add -k, -p, -r options to clients command to select, limit,
    reset data
  - Bug fixes
  - Don’t set interface for NTP responses to allow asymmetric
    routing
  - Handle RTCs that don’t support interrupts
  - Respond to command requests with correct address on
    multihomed hosts
  - Removed features
  - Drop support for RIPEMD keys (RMD128, RMD160, RMD256, RMD320)
  - Drop support for long (non-standard) MACs in NTPv4 packets
    (chrony 2.x clients using non-MD5/SHA1 keys need to use
    option "version 3")
  - Drop support for line editing with GNU Readline
- add BuildRequires for gnutls-devel (which also pulls nettle to
  enable the new features)
- drop patches which are included in the update:
  chrony-test-update-processing-of-packet-log.patch
  chrony-test-fix-util-unit-test-for-NTP-era-split.patch
- refreshed chrony-config.patch
- track series file for easier quilt setup
- added option to turn off testsuite with
  osc build --without=testsuite
  testsuite still runs by default</changelog>
  <changelog author="mrueckert@suse.de" date="1607342400">- drop buildrequires on NSS. We need gnutls for NTS anyway and we
  can do all the other required crypto via nettle+gnutls. no need
  for another crypto library.</changelog>
  <changelog author="max@suse.com" date="1612526400">- Enable syscallfilter unconditionally [boo#1181826].</changelog>
  <changelog author="max@suse.com" date="1622548800">- Update to 4.1
  * Add support for NTS servers specified by IP address (matching
    Subject Alternative Name in server certificate)
  * Add source-specific configuration of trusted certificates
  * Allow multiple files and directories with trusted certificates
  * Allow multiple pairs of server keys and certificates
  * Add copy option to server/pool directive
  * Increase PPS lock limit to 40% of pulse interval
  * Perform source selection immediately after loading dump files
  * Reload dump files for addresses negotiated by NTS-KE server
  * Update seccomp filter and add less restrictive level
  * Restart ongoing name resolution on online command
  * Fix dump files to not include uncorrected offset
  * Fix initstepslew to accept time from own NTP clients
  * Reset NTP address and port when no longer negotiated by NTS-KE
    server
- Update clknetsim to snapshot f89702d.
- Refresh chrony.keyring from
  https://chrony.tuxfamily.org/gpgkey-8F375C7E8D0EE125A3D3BD51537E2B76F7680DAC.asc
- Ensure the correct pool packages are installed for openSUSE
  and SLE (bsc#1180689).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1622635200">- Change to using systemd-sysusers
- Remove otherproviders, not needed anymore</changelog>
  <changelog author="gmbr3@opensuse.org" date="1623585600">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="max@suse.com" date="1625140800">- boo#1187906: Consolidate all references to the helper script.
- bsc#1173760: MD5 is not available from mozilla-nss in FIPS mode,
  but needed for calculating refids from IPv6 addresses as part of
  the NTP protocol (rfc5905). As this is a non-cryptographic use of
  MD5 we can use our own implementation without violating FIPS
  rules: chrony-refid-internal-md5.patch .</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_chrony-wait.service.patch
  * harden_chronyd.service.patch</changelog>
  <changelog author="max@suse.com" date="1633694400">- boo#1190926: PrivateDevices is too strict, we might need to
  access the rtc and ptp devices.
- Add back support to build chrony on SLE12.
- Drop dependency on asciidoctor. It is only needed for building
  the HTML documentation which we don't package anyway.</changelog>
  <changelog author="max@suse.com" date="1637323200">- SLE bugs that have been fixed in openSUSE up to this point
  without explicit references: bsc#1183783, bsc#1184400,
  bsc#1171806, bsc#1161119, bsc#1159840.
- Obsoleted SLE patches:
  * chrony-fix-open.patch
  * chrony-gettimeofday.patch
  * chrony-ntp-era-split.patch
  * chrony-pidfile.patch
  * chrony-select-timeout.patch
  * chrony-urandom.patch
  * chrony.sysconfig
  * clknetsim-glibc-2.31.patch</changelog>
  <changelog author="max@suse.com" date="1638878400">- Add chrony-htonl.patch to work around undocumented behaviour of
  htonl() in older glibc versions (SLE-12) on 64 bit big endian
  architectures (s390x).</changelog>
  <changelog author="max@suse.com" date="1641816000">- bsc#1194229: Fix pool package dependencies, so that SLE actually
  prefers chrony-pool-suse over chrony-pool-empty.</changelog>
  <changelog author="max@suse.com" date="1648123200">- Fix config file handling in the spec file and remove "ntsdumpdir"
  from default config, because augeas-lenses cannot parse it during
  installation of SLE Micro on SLE-15-SP3 (bsc#1194220).</changelog>
  <changelog author="max@suse.com" date="1710504000">- Use shorter NTS-KE retry interval when network is down
  (bsc#1213551, chrony-burst_total_samples_to_go.patch,
  chrony-retry_interval_ke_start.patch).</changelog>
  <changelog author="max@suse.com" date="1712750400">- Use make quickcheck instead of make check to avoid &gt;1h build
  times and failures due to timeouts. This was the default before
  3.2 but it changed to make tests more reliable. Here a seed is
  already set to get deterministic execution.</changelog>
</package>
<package pkgid="a19cc25ff1fb6bd15e0bfd85904f7c738f99c76df2902b50fea916f02f82b38b" name="chrony" arch="ppc64le">
  <version epoch="0" ver="4.1" rel="150400.21.5.7"/>
  <changelog author="max@suse.com" date="1591272000">- Add chrony-pool-suse and chrony-pool-openSUSE subpackages that
  preconfigure chrony to use NTP servers from the  respective
  pools for SUSE and openSUSE (bsc#1156884, SLE-11424).
- Add chrony-pool-empty to still allow installing chrony without
  preconfigured servers.
- Use iburst in the default pool statements to speed up initial
  synchronisation (bsc#1172113).</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596369600">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="elimat@opensuse.org" date="1599998400">- Update to 3.5.1:
  * Create new file when writing pidfile (CVE-2020-14367, bsc#1174911)</changelog>
  <changelog author="max@suse.com" date="1600084800">- Adjust and rename the sysconfig file, so that it matches the
  expectations of chronyd.service (bsc#1173277).</changelog>
  <changelog author="kukuk@suse.com" date="1603886400">- By default we don't write log files but log to journald, so
  only recommend logrotate.</changelog>
  <changelog author="mrueckert@suse.de" date="1604232000">- Update to 4.0
  - Enhancements
  - Add support for Network Time Security (NTS) authentication
  - Add support for AES-CMAC keys (AES128, AES256) with Nettle
  - Add authselectmode directive to control selection of
    unauthenticated sources
  - Add binddevice, bindacqdevice, bindcmddevice directives
  - Add confdir directive to better support fragmented
    configuration
  - Add sourcedir directive and "reload sources" command to
    support dynamic NTP sources specified in files
  - Add clockprecision directive
  - Add dscp directive to set Differentiated Services Code Point
    (DSCP)
  - Add -L option to limit log messages by severity
  - Add -p option to print whole configuration with included
    files
  - Add -U option to allow start under non-root user
  - Allow maxsamples to be set to 1 for faster update with -q/-Q
    option
  - Avoid replacing NTP sources with sources that have
    unreachable address
  - Improve pools to repeat name resolution to get "maxsources"
    sources
  - Improve source selection with trusted sources
  - Improve NTP loop test to prevent synchronisation to itself
  - Repeat iburst when NTP source is switched from offline state
    to online
  - Update clock synchronisation status and leap status more
    frequently
  - Update seccomp filter
  - Add "add pool" command
  - Add "reset sources" command to drop all measurements
  - Add authdata command to print details about NTP
    authentication
  - Add selectdata command to print details about source
    selection
  - Add -N option and sourcename command to print original names
    of sources
  - Add -a option to some commands to print also unresolved
    sources
  - Add -k, -p, -r options to clients command to select, limit,
    reset data
  - Bug fixes
  - Don’t set interface for NTP responses to allow asymmetric
    routing
  - Handle RTCs that don’t support interrupts
  - Respond to command requests with correct address on
    multihomed hosts
  - Removed features
  - Drop support for RIPEMD keys (RMD128, RMD160, RMD256, RMD320)
  - Drop support for long (non-standard) MACs in NTPv4 packets
    (chrony 2.x clients using non-MD5/SHA1 keys need to use
    option "version 3")
  - Drop support for line editing with GNU Readline
- add BuildRequires for gnutls-devel (which also pulls nettle to
  enable the new features)
- drop patches which are included in the update:
  chrony-test-update-processing-of-packet-log.patch
  chrony-test-fix-util-unit-test-for-NTP-era-split.patch
- refreshed chrony-config.patch
- track series file for easier quilt setup
- added option to turn off testsuite with
  osc build --without=testsuite
  testsuite still runs by default</changelog>
  <changelog author="mrueckert@suse.de" date="1607342400">- drop buildrequires on NSS. We need gnutls for NTS anyway and we
  can do all the other required crypto via nettle+gnutls. no need
  for another crypto library.</changelog>
  <changelog author="max@suse.com" date="1612526400">- Enable syscallfilter unconditionally [boo#1181826].</changelog>
  <changelog author="max@suse.com" date="1622548800">- Update to 4.1
  * Add support for NTS servers specified by IP address (matching
    Subject Alternative Name in server certificate)
  * Add source-specific configuration of trusted certificates
  * Allow multiple files and directories with trusted certificates
  * Allow multiple pairs of server keys and certificates
  * Add copy option to server/pool directive
  * Increase PPS lock limit to 40% of pulse interval
  * Perform source selection immediately after loading dump files
  * Reload dump files for addresses negotiated by NTS-KE server
  * Update seccomp filter and add less restrictive level
  * Restart ongoing name resolution on online command
  * Fix dump files to not include uncorrected offset
  * Fix initstepslew to accept time from own NTP clients
  * Reset NTP address and port when no longer negotiated by NTS-KE
    server
- Update clknetsim to snapshot f89702d.
- Refresh chrony.keyring from
  https://chrony.tuxfamily.org/gpgkey-8F375C7E8D0EE125A3D3BD51537E2B76F7680DAC.asc
- Ensure the correct pool packages are installed for openSUSE
  and SLE (bsc#1180689).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1622635200">- Change to using systemd-sysusers
- Remove otherproviders, not needed anymore</changelog>
  <changelog author="gmbr3@opensuse.org" date="1623585600">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="max@suse.com" date="1625140800">- boo#1187906: Consolidate all references to the helper script.
- bsc#1173760: MD5 is not available from mozilla-nss in FIPS mode,
  but needed for calculating refids from IPv6 addresses as part of
  the NTP protocol (rfc5905). As this is a non-cryptographic use of
  MD5 we can use our own implementation without violating FIPS
  rules: chrony-refid-internal-md5.patch .</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_chrony-wait.service.patch
  * harden_chronyd.service.patch</changelog>
  <changelog author="max@suse.com" date="1633694400">- boo#1190926: PrivateDevices is too strict, we might need to
  access the rtc and ptp devices.
- Add back support to build chrony on SLE12.
- Drop dependency on asciidoctor. It is only needed for building
  the HTML documentation which we don't package anyway.</changelog>
  <changelog author="max@suse.com" date="1637323200">- SLE bugs that have been fixed in openSUSE up to this point
  without explicit references: bsc#1183783, bsc#1184400,
  bsc#1171806, bsc#1161119, bsc#1159840.
- Obsoleted SLE patches:
  * chrony-fix-open.patch
  * chrony-gettimeofday.patch
  * chrony-ntp-era-split.patch
  * chrony-pidfile.patch
  * chrony-select-timeout.patch
  * chrony-urandom.patch
  * chrony.sysconfig
  * clknetsim-glibc-2.31.patch</changelog>
  <changelog author="max@suse.com" date="1638878400">- Add chrony-htonl.patch to work around undocumented behaviour of
  htonl() in older glibc versions (SLE-12) on 64 bit big endian
  architectures (s390x).</changelog>
  <changelog author="max@suse.com" date="1641816000">- bsc#1194229: Fix pool package dependencies, so that SLE actually
  prefers chrony-pool-suse over chrony-pool-empty.</changelog>
  <changelog author="max@suse.com" date="1648123200">- Fix config file handling in the spec file and remove "ntsdumpdir"
  from default config, because augeas-lenses cannot parse it during
  installation of SLE Micro on SLE-15-SP3 (bsc#1194220).</changelog>
  <changelog author="max@suse.com" date="1710504000">- Use shorter NTS-KE retry interval when network is down
  (bsc#1213551, chrony-burst_total_samples_to_go.patch,
  chrony-retry_interval_ke_start.patch).</changelog>
  <changelog author="max@suse.com" date="1712750400">- Use make quickcheck instead of make check to avoid &gt;1h build
  times and failures due to timeouts. This was the default before
  3.2 but it changed to make tests more reliable. Here a seed is
  already set to get deterministic execution.</changelog>
</package>
<package pkgid="e1190640d771df1780ab16895cb25c90e161976f795cf64926c7d8309881e7b9" name="chrony" arch="s390x">
  <version epoch="0" ver="4.1" rel="150400.21.5.7"/>
  <changelog author="max@suse.com" date="1591272000">- Add chrony-pool-suse and chrony-pool-openSUSE subpackages that
  preconfigure chrony to use NTP servers from the  respective
  pools for SUSE and openSUSE (bsc#1156884, SLE-11424).
- Add chrony-pool-empty to still allow installing chrony without
  preconfigured servers.
- Use iburst in the default pool statements to speed up initial
  synchronisation (bsc#1172113).</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596369600">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="elimat@opensuse.org" date="1599998400">- Update to 3.5.1:
  * Create new file when writing pidfile (CVE-2020-14367, bsc#1174911)</changelog>
  <changelog author="max@suse.com" date="1600084800">- Adjust and rename the sysconfig file, so that it matches the
  expectations of chronyd.service (bsc#1173277).</changelog>
  <changelog author="kukuk@suse.com" date="1603886400">- By default we don't write log files but log to journald, so
  only recommend logrotate.</changelog>
  <changelog author="mrueckert@suse.de" date="1604232000">- Update to 4.0
  - Enhancements
  - Add support for Network Time Security (NTS) authentication
  - Add support for AES-CMAC keys (AES128, AES256) with Nettle
  - Add authselectmode directive to control selection of
    unauthenticated sources
  - Add binddevice, bindacqdevice, bindcmddevice directives
  - Add confdir directive to better support fragmented
    configuration
  - Add sourcedir directive and "reload sources" command to
    support dynamic NTP sources specified in files
  - Add clockprecision directive
  - Add dscp directive to set Differentiated Services Code Point
    (DSCP)
  - Add -L option to limit log messages by severity
  - Add -p option to print whole configuration with included
    files
  - Add -U option to allow start under non-root user
  - Allow maxsamples to be set to 1 for faster update with -q/-Q
    option
  - Avoid replacing NTP sources with sources that have
    unreachable address
  - Improve pools to repeat name resolution to get "maxsources"
    sources
  - Improve source selection with trusted sources
  - Improve NTP loop test to prevent synchronisation to itself
  - Repeat iburst when NTP source is switched from offline state
    to online
  - Update clock synchronisation status and leap status more
    frequently
  - Update seccomp filter
  - Add "add pool" command
  - Add "reset sources" command to drop all measurements
  - Add authdata command to print details about NTP
    authentication
  - Add selectdata command to print details about source
    selection
  - Add -N option and sourcename command to print original names
    of sources
  - Add -a option to some commands to print also unresolved
    sources
  - Add -k, -p, -r options to clients command to select, limit,
    reset data
  - Bug fixes
  - Don’t set interface for NTP responses to allow asymmetric
    routing
  - Handle RTCs that don’t support interrupts
  - Respond to command requests with correct address on
    multihomed hosts
  - Removed features
  - Drop support for RIPEMD keys (RMD128, RMD160, RMD256, RMD320)
  - Drop support for long (non-standard) MACs in NTPv4 packets
    (chrony 2.x clients using non-MD5/SHA1 keys need to use
    option "version 3")
  - Drop support for line editing with GNU Readline
- add BuildRequires for gnutls-devel (which also pulls nettle to
  enable the new features)
- drop patches which are included in the update:
  chrony-test-update-processing-of-packet-log.patch
  chrony-test-fix-util-unit-test-for-NTP-era-split.patch
- refreshed chrony-config.patch
- track series file for easier quilt setup
- added option to turn off testsuite with
  osc build --without=testsuite
  testsuite still runs by default</changelog>
  <changelog author="mrueckert@suse.de" date="1607342400">- drop buildrequires on NSS. We need gnutls for NTS anyway and we
  can do all the other required crypto via nettle+gnutls. no need
  for another crypto library.</changelog>
  <changelog author="max@suse.com" date="1612526400">- Enable syscallfilter unconditionally [boo#1181826].</changelog>
  <changelog author="max@suse.com" date="1622548800">- Update to 4.1
  * Add support for NTS servers specified by IP address (matching
    Subject Alternative Name in server certificate)
  * Add source-specific configuration of trusted certificates
  * Allow multiple files and directories with trusted certificates
  * Allow multiple pairs of server keys and certificates
  * Add copy option to server/pool directive
  * Increase PPS lock limit to 40% of pulse interval
  * Perform source selection immediately after loading dump files
  * Reload dump files for addresses negotiated by NTS-KE server
  * Update seccomp filter and add less restrictive level
  * Restart ongoing name resolution on online command
  * Fix dump files to not include uncorrected offset
  * Fix initstepslew to accept time from own NTP clients
  * Reset NTP address and port when no longer negotiated by NTS-KE
    server
- Update clknetsim to snapshot f89702d.
- Refresh chrony.keyring from
  https://chrony.tuxfamily.org/gpgkey-8F375C7E8D0EE125A3D3BD51537E2B76F7680DAC.asc
- Ensure the correct pool packages are installed for openSUSE
  and SLE (bsc#1180689).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1622635200">- Change to using systemd-sysusers
- Remove otherproviders, not needed anymore</changelog>
  <changelog author="gmbr3@opensuse.org" date="1623585600">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="max@suse.com" date="1625140800">- boo#1187906: Consolidate all references to the helper script.
- bsc#1173760: MD5 is not available from mozilla-nss in FIPS mode,
  but needed for calculating refids from IPv6 addresses as part of
  the NTP protocol (rfc5905). As this is a non-cryptographic use of
  MD5 we can use our own implementation without violating FIPS
  rules: chrony-refid-internal-md5.patch .</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_chrony-wait.service.patch
  * harden_chronyd.service.patch</changelog>
  <changelog author="max@suse.com" date="1633694400">- boo#1190926: PrivateDevices is too strict, we might need to
  access the rtc and ptp devices.
- Add back support to build chrony on SLE12.
- Drop dependency on asciidoctor. It is only needed for building
  the HTML documentation which we don't package anyway.</changelog>
  <changelog author="max@suse.com" date="1637323200">- SLE bugs that have been fixed in openSUSE up to this point
  without explicit references: bsc#1183783, bsc#1184400,
  bsc#1171806, bsc#1161119, bsc#1159840.
- Obsoleted SLE patches:
  * chrony-fix-open.patch
  * chrony-gettimeofday.patch
  * chrony-ntp-era-split.patch
  * chrony-pidfile.patch
  * chrony-select-timeout.patch
  * chrony-urandom.patch
  * chrony.sysconfig
  * clknetsim-glibc-2.31.patch</changelog>
  <changelog author="max@suse.com" date="1638878400">- Add chrony-htonl.patch to work around undocumented behaviour of
  htonl() in older glibc versions (SLE-12) on 64 bit big endian
  architectures (s390x).</changelog>
  <changelog author="max@suse.com" date="1641816000">- bsc#1194229: Fix pool package dependencies, so that SLE actually
  prefers chrony-pool-suse over chrony-pool-empty.</changelog>
  <changelog author="max@suse.com" date="1648123200">- Fix config file handling in the spec file and remove "ntsdumpdir"
  from default config, because augeas-lenses cannot parse it during
  installation of SLE Micro on SLE-15-SP3 (bsc#1194220).</changelog>
  <changelog author="max@suse.com" date="1710504000">- Use shorter NTS-KE retry interval when network is down
  (bsc#1213551, chrony-burst_total_samples_to_go.patch,
  chrony-retry_interval_ke_start.patch).</changelog>
  <changelog author="max@suse.com" date="1712750400">- Use make quickcheck instead of make check to avoid &gt;1h build
  times and failures due to timeouts. This was the default before
  3.2 but it changed to make tests more reliable. Here a seed is
  already set to get deterministic execution.</changelog>
</package>
<package pkgid="f7238acd01282105926a1157baa94bcd5bd58f29e0b554dbaa21a26e0817b92f" name="chrony" arch="src">
  <version epoch="0" ver="4.1" rel="150400.21.5.7"/>
  <changelog author="max@suse.com" date="1591272000">- Add chrony-pool-suse and chrony-pool-openSUSE subpackages that
  preconfigure chrony to use NTP servers from the  respective
  pools for SUSE and openSUSE (bsc#1156884, SLE-11424).
- Add chrony-pool-empty to still allow installing chrony without
  preconfigured servers.
- Use iburst in the default pool statements to speed up initial
  synchronisation (bsc#1172113).</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596369600">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="elimat@opensuse.org" date="1599998400">- Update to 3.5.1:
  * Create new file when writing pidfile (CVE-2020-14367, bsc#1174911)</changelog>
  <changelog author="max@suse.com" date="1600084800">- Adjust and rename the sysconfig file, so that it matches the
  expectations of chronyd.service (bsc#1173277).</changelog>
  <changelog author="kukuk@suse.com" date="1603886400">- By default we don't write log files but log to journald, so
  only recommend logrotate.</changelog>
  <changelog author="mrueckert@suse.de" date="1604232000">- Update to 4.0
  - Enhancements
  - Add support for Network Time Security (NTS) authentication
  - Add support for AES-CMAC keys (AES128, AES256) with Nettle
  - Add authselectmode directive to control selection of
    unauthenticated sources
  - Add binddevice, bindacqdevice, bindcmddevice directives
  - Add confdir directive to better support fragmented
    configuration
  - Add sourcedir directive and "reload sources" command to
    support dynamic NTP sources specified in files
  - Add clockprecision directive
  - Add dscp directive to set Differentiated Services Code Point
    (DSCP)
  - Add -L option to limit log messages by severity
  - Add -p option to print whole configuration with included
    files
  - Add -U option to allow start under non-root user
  - Allow maxsamples to be set to 1 for faster update with -q/-Q
    option
  - Avoid replacing NTP sources with sources that have
    unreachable address
  - Improve pools to repeat name resolution to get "maxsources"
    sources
  - Improve source selection with trusted sources
  - Improve NTP loop test to prevent synchronisation to itself
  - Repeat iburst when NTP source is switched from offline state
    to online
  - Update clock synchronisation status and leap status more
    frequently
  - Update seccomp filter
  - Add "add pool" command
  - Add "reset sources" command to drop all measurements
  - Add authdata command to print details about NTP
    authentication
  - Add selectdata command to print details about source
    selection
  - Add -N option and sourcename command to print original names
    of sources
  - Add -a option to some commands to print also unresolved
    sources
  - Add -k, -p, -r options to clients command to select, limit,
    reset data
  - Bug fixes
  - Don’t set interface for NTP responses to allow asymmetric
    routing
  - Handle RTCs that don’t support interrupts
  - Respond to command requests with correct address on
    multihomed hosts
  - Removed features
  - Drop support for RIPEMD keys (RMD128, RMD160, RMD256, RMD320)
  - Drop support for long (non-standard) MACs in NTPv4 packets
    (chrony 2.x clients using non-MD5/SHA1 keys need to use
    option "version 3")
  - Drop support for line editing with GNU Readline
- add BuildRequires for gnutls-devel (which also pulls nettle to
  enable the new features)
- drop patches which are included in the update:
  chrony-test-update-processing-of-packet-log.patch
  chrony-test-fix-util-unit-test-for-NTP-era-split.patch
- refreshed chrony-config.patch
- track series file for easier quilt setup
- added option to turn off testsuite with
  osc build --without=testsuite
  testsuite still runs by default</changelog>
  <changelog author="mrueckert@suse.de" date="1607342400">- drop buildrequires on NSS. We need gnutls for NTS anyway and we
  can do all the other required crypto via nettle+gnutls. no need
  for another crypto library.</changelog>
  <changelog author="max@suse.com" date="1612526400">- Enable syscallfilter unconditionally [boo#1181826].</changelog>
  <changelog author="max@suse.com" date="1622548800">- Update to 4.1
  * Add support for NTS servers specified by IP address (matching
    Subject Alternative Name in server certificate)
  * Add source-specific configuration of trusted certificates
  * Allow multiple files and directories with trusted certificates
  * Allow multiple pairs of server keys and certificates
  * Add copy option to server/pool directive
  * Increase PPS lock limit to 40% of pulse interval
  * Perform source selection immediately after loading dump files
  * Reload dump files for addresses negotiated by NTS-KE server
  * Update seccomp filter and add less restrictive level
  * Restart ongoing name resolution on online command
  * Fix dump files to not include uncorrected offset
  * Fix initstepslew to accept time from own NTP clients
  * Reset NTP address and port when no longer negotiated by NTS-KE
    server
- Update clknetsim to snapshot f89702d.
- Refresh chrony.keyring from
  https://chrony.tuxfamily.org/gpgkey-8F375C7E8D0EE125A3D3BD51537E2B76F7680DAC.asc
- Ensure the correct pool packages are installed for openSUSE
  and SLE (bsc#1180689).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1622635200">- Change to using systemd-sysusers
- Remove otherproviders, not needed anymore</changelog>
  <changelog author="gmbr3@opensuse.org" date="1623585600">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="max@suse.com" date="1625140800">- boo#1187906: Consolidate all references to the helper script.
- bsc#1173760: MD5 is not available from mozilla-nss in FIPS mode,
  but needed for calculating refids from IPv6 addresses as part of
  the NTP protocol (rfc5905). As this is a non-cryptographic use of
  MD5 we can use our own implementation without violating FIPS
  rules: chrony-refid-internal-md5.patch .</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_chrony-wait.service.patch
  * harden_chronyd.service.patch</changelog>
  <changelog author="max@suse.com" date="1633694400">- boo#1190926: PrivateDevices is too strict, we might need to
  access the rtc and ptp devices.
- Add back support to build chrony on SLE12.
- Drop dependency on asciidoctor. It is only needed for building
  the HTML documentation which we don't package anyway.</changelog>
  <changelog author="max@suse.com" date="1637323200">- SLE bugs that have been fixed in openSUSE up to this point
  without explicit references: bsc#1183783, bsc#1184400,
  bsc#1171806, bsc#1161119, bsc#1159840.
- Obsoleted SLE patches:
  * chrony-fix-open.patch
  * chrony-gettimeofday.patch
  * chrony-ntp-era-split.patch
  * chrony-pidfile.patch
  * chrony-select-timeout.patch
  * chrony-urandom.patch
  * chrony.sysconfig
  * clknetsim-glibc-2.31.patch</changelog>
  <changelog author="max@suse.com" date="1638878400">- Add chrony-htonl.patch to work around undocumented behaviour of
  htonl() in older glibc versions (SLE-12) on 64 bit big endian
  architectures (s390x).</changelog>
  <changelog author="max@suse.com" date="1641816000">- bsc#1194229: Fix pool package dependencies, so that SLE actually
  prefers chrony-pool-suse over chrony-pool-empty.</changelog>
  <changelog author="max@suse.com" date="1648123200">- Fix config file handling in the spec file and remove "ntsdumpdir"
  from default config, because augeas-lenses cannot parse it during
  installation of SLE Micro on SLE-15-SP3 (bsc#1194220).</changelog>
  <changelog author="max@suse.com" date="1710504000">- Use shorter NTS-KE retry interval when network is down
  (bsc#1213551, chrony-burst_total_samples_to_go.patch,
  chrony-retry_interval_ke_start.patch).</changelog>
  <changelog author="max@suse.com" date="1712750400">- Use make quickcheck instead of make check to avoid &gt;1h build
  times and failures due to timeouts. This was the default before
  3.2 but it changed to make tests more reliable. Here a seed is
  already set to get deterministic execution.</changelog>
</package>
<package pkgid="dfc68e6d7c7310636b10ca2d9265c499b9615e7825a76093df2f387af4816e78" name="chrony" arch="x86_64">
  <version epoch="0" ver="4.1" rel="150400.21.5.7"/>
  <changelog author="max@suse.com" date="1591272000">- Add chrony-pool-suse and chrony-pool-openSUSE subpackages that
  preconfigure chrony to use NTP servers from the  respective
  pools for SUSE and openSUSE (bsc#1156884, SLE-11424).
- Add chrony-pool-empty to still allow installing chrony without
  preconfigured servers.
- Use iburst in the default pool statements to speed up initial
  synchronisation (bsc#1172113).</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596369600">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="elimat@opensuse.org" date="1599998400">- Update to 3.5.1:
  * Create new file when writing pidfile (CVE-2020-14367, bsc#1174911)</changelog>
  <changelog author="max@suse.com" date="1600084800">- Adjust and rename the sysconfig file, so that it matches the
  expectations of chronyd.service (bsc#1173277).</changelog>
  <changelog author="kukuk@suse.com" date="1603886400">- By default we don't write log files but log to journald, so
  only recommend logrotate.</changelog>
  <changelog author="mrueckert@suse.de" date="1604232000">- Update to 4.0
  - Enhancements
  - Add support for Network Time Security (NTS) authentication
  - Add support for AES-CMAC keys (AES128, AES256) with Nettle
  - Add authselectmode directive to control selection of
    unauthenticated sources
  - Add binddevice, bindacqdevice, bindcmddevice directives
  - Add confdir directive to better support fragmented
    configuration
  - Add sourcedir directive and "reload sources" command to
    support dynamic NTP sources specified in files
  - Add clockprecision directive
  - Add dscp directive to set Differentiated Services Code Point
    (DSCP)
  - Add -L option to limit log messages by severity
  - Add -p option to print whole configuration with included
    files
  - Add -U option to allow start under non-root user
  - Allow maxsamples to be set to 1 for faster update with -q/-Q
    option
  - Avoid replacing NTP sources with sources that have
    unreachable address
  - Improve pools to repeat name resolution to get "maxsources"
    sources
  - Improve source selection with trusted sources
  - Improve NTP loop test to prevent synchronisation to itself
  - Repeat iburst when NTP source is switched from offline state
    to online
  - Update clock synchronisation status and leap status more
    frequently
  - Update seccomp filter
  - Add "add pool" command
  - Add "reset sources" command to drop all measurements
  - Add authdata command to print details about NTP
    authentication
  - Add selectdata command to print details about source
    selection
  - Add -N option and sourcename command to print original names
    of sources
  - Add -a option to some commands to print also unresolved
    sources
  - Add -k, -p, -r options to clients command to select, limit,
    reset data
  - Bug fixes
  - Don’t set interface for NTP responses to allow asymmetric
    routing
  - Handle RTCs that don’t support interrupts
  - Respond to command requests with correct address on
    multihomed hosts
  - Removed features
  - Drop support for RIPEMD keys (RMD128, RMD160, RMD256, RMD320)
  - Drop support for long (non-standard) MACs in NTPv4 packets
    (chrony 2.x clients using non-MD5/SHA1 keys need to use
    option "version 3")
  - Drop support for line editing with GNU Readline
- add BuildRequires for gnutls-devel (which also pulls nettle to
  enable the new features)
- drop patches which are included in the update:
  chrony-test-update-processing-of-packet-log.patch
  chrony-test-fix-util-unit-test-for-NTP-era-split.patch
- refreshed chrony-config.patch
- track series file for easier quilt setup
- added option to turn off testsuite with
  osc build --without=testsuite
  testsuite still runs by default</changelog>
  <changelog author="mrueckert@suse.de" date="1607342400">- drop buildrequires on NSS. We need gnutls for NTS anyway and we
  can do all the other required crypto via nettle+gnutls. no need
  for another crypto library.</changelog>
  <changelog author="max@suse.com" date="1612526400">- Enable syscallfilter unconditionally [boo#1181826].</changelog>
  <changelog author="max@suse.com" date="1622548800">- Update to 4.1
  * Add support for NTS servers specified by IP address (matching
    Subject Alternative Name in server certificate)
  * Add source-specific configuration of trusted certificates
  * Allow multiple files and directories with trusted certificates
  * Allow multiple pairs of server keys and certificates
  * Add copy option to server/pool directive
  * Increase PPS lock limit to 40% of pulse interval
  * Perform source selection immediately after loading dump files
  * Reload dump files for addresses negotiated by NTS-KE server
  * Update seccomp filter and add less restrictive level
  * Restart ongoing name resolution on online command
  * Fix dump files to not include uncorrected offset
  * Fix initstepslew to accept time from own NTP clients
  * Reset NTP address and port when no longer negotiated by NTS-KE
    server
- Update clknetsim to snapshot f89702d.
- Refresh chrony.keyring from
  https://chrony.tuxfamily.org/gpgkey-8F375C7E8D0EE125A3D3BD51537E2B76F7680DAC.asc
- Ensure the correct pool packages are installed for openSUSE
  and SLE (bsc#1180689).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1622635200">- Change to using systemd-sysusers
- Remove otherproviders, not needed anymore</changelog>
  <changelog author="gmbr3@opensuse.org" date="1623585600">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="max@suse.com" date="1625140800">- boo#1187906: Consolidate all references to the helper script.
- bsc#1173760: MD5 is not available from mozilla-nss in FIPS mode,
  but needed for calculating refids from IPv6 addresses as part of
  the NTP protocol (rfc5905). As this is a non-cryptographic use of
  MD5 we can use our own implementation without violating FIPS
  rules: chrony-refid-internal-md5.patch .</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_chrony-wait.service.patch
  * harden_chronyd.service.patch</changelog>
  <changelog author="max@suse.com" date="1633694400">- boo#1190926: PrivateDevices is too strict, we might need to
  access the rtc and ptp devices.
- Add back support to build chrony on SLE12.
- Drop dependency on asciidoctor. It is only needed for building
  the HTML documentation which we don't package anyway.</changelog>
  <changelog author="max@suse.com" date="1637323200">- SLE bugs that have been fixed in openSUSE up to this point
  without explicit references: bsc#1183783, bsc#1184400,
  bsc#1171806, bsc#1161119, bsc#1159840.
- Obsoleted SLE patches:
  * chrony-fix-open.patch
  * chrony-gettimeofday.patch
  * chrony-ntp-era-split.patch
  * chrony-pidfile.patch
  * chrony-select-timeout.patch
  * chrony-urandom.patch
  * chrony.sysconfig
  * clknetsim-glibc-2.31.patch</changelog>
  <changelog author="max@suse.com" date="1638878400">- Add chrony-htonl.patch to work around undocumented behaviour of
  htonl() in older glibc versions (SLE-12) on 64 bit big endian
  architectures (s390x).</changelog>
  <changelog author="max@suse.com" date="1641816000">- bsc#1194229: Fix pool package dependencies, so that SLE actually
  prefers chrony-pool-suse over chrony-pool-empty.</changelog>
  <changelog author="max@suse.com" date="1648123200">- Fix config file handling in the spec file and remove "ntsdumpdir"
  from default config, because augeas-lenses cannot parse it during
  installation of SLE Micro on SLE-15-SP3 (bsc#1194220).</changelog>
  <changelog author="max@suse.com" date="1710504000">- Use shorter NTS-KE retry interval when network is down
  (bsc#1213551, chrony-burst_total_samples_to_go.patch,
  chrony-retry_interval_ke_start.patch).</changelog>
  <changelog author="max@suse.com" date="1712750400">- Use make quickcheck instead of make check to avoid &gt;1h build
  times and failures due to timeouts. This was the default before
  3.2 but it changed to make tests more reliable. Here a seed is
  already set to get deterministic execution.</changelog>
</package>
<package pkgid="ab728c0c71a7bf427d1778d83792fb31601f3dae0374cc705be770030157e41e" name="chrony-pool-empty" arch="noarch">
  <version epoch="0" ver="4.1" rel="150400.21.5.7"/>
  <changelog author="max@suse.com" date="1591272000">- Add chrony-pool-suse and chrony-pool-openSUSE subpackages that
  preconfigure chrony to use NTP servers from the  respective
  pools for SUSE and openSUSE (bsc#1156884, SLE-11424).
- Add chrony-pool-empty to still allow installing chrony without
  preconfigured servers.
- Use iburst in the default pool statements to speed up initial
  synchronisation (bsc#1172113).</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596369600">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="elimat@opensuse.org" date="1599998400">- Update to 3.5.1:
  * Create new file when writing pidfile (CVE-2020-14367, bsc#1174911)</changelog>
  <changelog author="max@suse.com" date="1600084800">- Adjust and rename the sysconfig file, so that it matches the
  expectations of chronyd.service (bsc#1173277).</changelog>
  <changelog author="kukuk@suse.com" date="1603886400">- By default we don't write log files but log to journald, so
  only recommend logrotate.</changelog>
  <changelog author="mrueckert@suse.de" date="1604232000">- Update to 4.0
  - Enhancements
  - Add support for Network Time Security (NTS) authentication
  - Add support for AES-CMAC keys (AES128, AES256) with Nettle
  - Add authselectmode directive to control selection of
    unauthenticated sources
  - Add binddevice, bindacqdevice, bindcmddevice directives
  - Add confdir directive to better support fragmented
    configuration
  - Add sourcedir directive and "reload sources" command to
    support dynamic NTP sources specified in files
  - Add clockprecision directive
  - Add dscp directive to set Differentiated Services Code Point
    (DSCP)
  - Add -L option to limit log messages by severity
  - Add -p option to print whole configuration with included
    files
  - Add -U option to allow start under non-root user
  - Allow maxsamples to be set to 1 for faster update with -q/-Q
    option
  - Avoid replacing NTP sources with sources that have
    unreachable address
  - Improve pools to repeat name resolution to get "maxsources"
    sources
  - Improve source selection with trusted sources
  - Improve NTP loop test to prevent synchronisation to itself
  - Repeat iburst when NTP source is switched from offline state
    to online
  - Update clock synchronisation status and leap status more
    frequently
  - Update seccomp filter
  - Add "add pool" command
  - Add "reset sources" command to drop all measurements
  - Add authdata command to print details about NTP
    authentication
  - Add selectdata command to print details about source
    selection
  - Add -N option and sourcename command to print original names
    of sources
  - Add -a option to some commands to print also unresolved
    sources
  - Add -k, -p, -r options to clients command to select, limit,
    reset data
  - Bug fixes
  - Don’t set interface for NTP responses to allow asymmetric
    routing
  - Handle RTCs that don’t support interrupts
  - Respond to command requests with correct address on
    multihomed hosts
  - Removed features
  - Drop support for RIPEMD keys (RMD128, RMD160, RMD256, RMD320)
  - Drop support for long (non-standard) MACs in NTPv4 packets
    (chrony 2.x clients using non-MD5/SHA1 keys need to use
    option "version 3")
  - Drop support for line editing with GNU Readline
- add BuildRequires for gnutls-devel (which also pulls nettle to
  enable the new features)
- drop patches which are included in the update:
  chrony-test-update-processing-of-packet-log.patch
  chrony-test-fix-util-unit-test-for-NTP-era-split.patch
- refreshed chrony-config.patch
- track series file for easier quilt setup
- added option to turn off testsuite with
  osc build --without=testsuite
  testsuite still runs by default</changelog>
  <changelog author="mrueckert@suse.de" date="1607342400">- drop buildrequires on NSS. We need gnutls for NTS anyway and we
  can do all the other required crypto via nettle+gnutls. no need
  for another crypto library.</changelog>
  <changelog author="max@suse.com" date="1612526400">- Enable syscallfilter unconditionally [boo#1181826].</changelog>
  <changelog author="max@suse.com" date="1622548800">- Update to 4.1
  * Add support for NTS servers specified by IP address (matching
    Subject Alternative Name in server certificate)
  * Add source-specific configuration of trusted certificates
  * Allow multiple files and directories with trusted certificates
  * Allow multiple pairs of server keys and certificates
  * Add copy option to server/pool directive
  * Increase PPS lock limit to 40% of pulse interval
  * Perform source selection immediately after loading dump files
  * Reload dump files for addresses negotiated by NTS-KE server
  * Update seccomp filter and add less restrictive level
  * Restart ongoing name resolution on online command
  * Fix dump files to not include uncorrected offset
  * Fix initstepslew to accept time from own NTP clients
  * Reset NTP address and port when no longer negotiated by NTS-KE
    server
- Update clknetsim to snapshot f89702d.
- Refresh chrony.keyring from
  https://chrony.tuxfamily.org/gpgkey-8F375C7E8D0EE125A3D3BD51537E2B76F7680DAC.asc
- Ensure the correct pool packages are installed for openSUSE
  and SLE (bsc#1180689).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1622635200">- Change to using systemd-sysusers
- Remove otherproviders, not needed anymore</changelog>
  <changelog author="gmbr3@opensuse.org" date="1623585600">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="max@suse.com" date="1625140800">- boo#1187906: Consolidate all references to the helper script.
- bsc#1173760: MD5 is not available from mozilla-nss in FIPS mode,
  but needed for calculating refids from IPv6 addresses as part of
  the NTP protocol (rfc5905). As this is a non-cryptographic use of
  MD5 we can use our own implementation without violating FIPS
  rules: chrony-refid-internal-md5.patch .</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_chrony-wait.service.patch
  * harden_chronyd.service.patch</changelog>
  <changelog author="max@suse.com" date="1633694400">- boo#1190926: PrivateDevices is too strict, we might need to
  access the rtc and ptp devices.
- Add back support to build chrony on SLE12.
- Drop dependency on asciidoctor. It is only needed for building
  the HTML documentation which we don't package anyway.</changelog>
  <changelog author="max@suse.com" date="1637323200">- SLE bugs that have been fixed in openSUSE up to this point
  without explicit references: bsc#1183783, bsc#1184400,
  bsc#1171806, bsc#1161119, bsc#1159840.
- Obsoleted SLE patches:
  * chrony-fix-open.patch
  * chrony-gettimeofday.patch
  * chrony-ntp-era-split.patch
  * chrony-pidfile.patch
  * chrony-select-timeout.patch
  * chrony-urandom.patch
  * chrony.sysconfig
  * clknetsim-glibc-2.31.patch</changelog>
  <changelog author="max@suse.com" date="1638878400">- Add chrony-htonl.patch to work around undocumented behaviour of
  htonl() in older glibc versions (SLE-12) on 64 bit big endian
  architectures (s390x).</changelog>
  <changelog author="max@suse.com" date="1641816000">- bsc#1194229: Fix pool package dependencies, so that SLE actually
  prefers chrony-pool-suse over chrony-pool-empty.</changelog>
  <changelog author="max@suse.com" date="1648123200">- Fix config file handling in the spec file and remove "ntsdumpdir"
  from default config, because augeas-lenses cannot parse it during
  installation of SLE Micro on SLE-15-SP3 (bsc#1194220).</changelog>
  <changelog author="max@suse.com" date="1710504000">- Use shorter NTS-KE retry interval when network is down
  (bsc#1213551, chrony-burst_total_samples_to_go.patch,
  chrony-retry_interval_ke_start.patch).</changelog>
  <changelog author="max@suse.com" date="1712750400">- Use make quickcheck instead of make check to avoid &gt;1h build
  times and failures due to timeouts. This was the default before
  3.2 but it changed to make tests more reliable. Here a seed is
  already set to get deterministic execution.</changelog>
</package>
<package pkgid="adb59fb891cb117c115b21872ba34a0f939183802c71b019c6da7f3551d351a5" name="chrony-pool-openSUSE" arch="noarch">
  <version epoch="0" ver="4.1" rel="150400.21.5.7"/>
  <changelog author="max@suse.com" date="1591272000">- Add chrony-pool-suse and chrony-pool-openSUSE subpackages that
  preconfigure chrony to use NTP servers from the  respective
  pools for SUSE and openSUSE (bsc#1156884, SLE-11424).
- Add chrony-pool-empty to still allow installing chrony without
  preconfigured servers.
- Use iburst in the default pool statements to speed up initial
  synchronisation (bsc#1172113).</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596369600">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="elimat@opensuse.org" date="1599998400">- Update to 3.5.1:
  * Create new file when writing pidfile (CVE-2020-14367, bsc#1174911)</changelog>
  <changelog author="max@suse.com" date="1600084800">- Adjust and rename the sysconfig file, so that it matches the
  expectations of chronyd.service (bsc#1173277).</changelog>
  <changelog author="kukuk@suse.com" date="1603886400">- By default we don't write log files but log to journald, so
  only recommend logrotate.</changelog>
  <changelog author="mrueckert@suse.de" date="1604232000">- Update to 4.0
  - Enhancements
  - Add support for Network Time Security (NTS) authentication
  - Add support for AES-CMAC keys (AES128, AES256) with Nettle
  - Add authselectmode directive to control selection of
    unauthenticated sources
  - Add binddevice, bindacqdevice, bindcmddevice directives
  - Add confdir directive to better support fragmented
    configuration
  - Add sourcedir directive and "reload sources" command to
    support dynamic NTP sources specified in files
  - Add clockprecision directive
  - Add dscp directive to set Differentiated Services Code Point
    (DSCP)
  - Add -L option to limit log messages by severity
  - Add -p option to print whole configuration with included
    files
  - Add -U option to allow start under non-root user
  - Allow maxsamples to be set to 1 for faster update with -q/-Q
    option
  - Avoid replacing NTP sources with sources that have
    unreachable address
  - Improve pools to repeat name resolution to get "maxsources"
    sources
  - Improve source selection with trusted sources
  - Improve NTP loop test to prevent synchronisation to itself
  - Repeat iburst when NTP source is switched from offline state
    to online
  - Update clock synchronisation status and leap status more
    frequently
  - Update seccomp filter
  - Add "add pool" command
  - Add "reset sources" command to drop all measurements
  - Add authdata command to print details about NTP
    authentication
  - Add selectdata command to print details about source
    selection
  - Add -N option and sourcename command to print original names
    of sources
  - Add -a option to some commands to print also unresolved
    sources
  - Add -k, -p, -r options to clients command to select, limit,
    reset data
  - Bug fixes
  - Don’t set interface for NTP responses to allow asymmetric
    routing
  - Handle RTCs that don’t support interrupts
  - Respond to command requests with correct address on
    multihomed hosts
  - Removed features
  - Drop support for RIPEMD keys (RMD128, RMD160, RMD256, RMD320)
  - Drop support for long (non-standard) MACs in NTPv4 packets
    (chrony 2.x clients using non-MD5/SHA1 keys need to use
    option "version 3")
  - Drop support for line editing with GNU Readline
- add BuildRequires for gnutls-devel (which also pulls nettle to
  enable the new features)
- drop patches which are included in the update:
  chrony-test-update-processing-of-packet-log.patch
  chrony-test-fix-util-unit-test-for-NTP-era-split.patch
- refreshed chrony-config.patch
- track series file for easier quilt setup
- added option to turn off testsuite with
  osc build --without=testsuite
  testsuite still runs by default</changelog>
  <changelog author="mrueckert@suse.de" date="1607342400">- drop buildrequires on NSS. We need gnutls for NTS anyway and we
  can do all the other required crypto via nettle+gnutls. no need
  for another crypto library.</changelog>
  <changelog author="max@suse.com" date="1612526400">- Enable syscallfilter unconditionally [boo#1181826].</changelog>
  <changelog author="max@suse.com" date="1622548800">- Update to 4.1
  * Add support for NTS servers specified by IP address (matching
    Subject Alternative Name in server certificate)
  * Add source-specific configuration of trusted certificates
  * Allow multiple files and directories with trusted certificates
  * Allow multiple pairs of server keys and certificates
  * Add copy option to server/pool directive
  * Increase PPS lock limit to 40% of pulse interval
  * Perform source selection immediately after loading dump files
  * Reload dump files for addresses negotiated by NTS-KE server
  * Update seccomp filter and add less restrictive level
  * Restart ongoing name resolution on online command
  * Fix dump files to not include uncorrected offset
  * Fix initstepslew to accept time from own NTP clients
  * Reset NTP address and port when no longer negotiated by NTS-KE
    server
- Update clknetsim to snapshot f89702d.
- Refresh chrony.keyring from
  https://chrony.tuxfamily.org/gpgkey-8F375C7E8D0EE125A3D3BD51537E2B76F7680DAC.asc
- Ensure the correct pool packages are installed for openSUSE
  and SLE (bsc#1180689).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1622635200">- Change to using systemd-sysusers
- Remove otherproviders, not needed anymore</changelog>
  <changelog author="gmbr3@opensuse.org" date="1623585600">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="max@suse.com" date="1625140800">- boo#1187906: Consolidate all references to the helper script.
- bsc#1173760: MD5 is not available from mozilla-nss in FIPS mode,
  but needed for calculating refids from IPv6 addresses as part of
  the NTP protocol (rfc5905). As this is a non-cryptographic use of
  MD5 we can use our own implementation without violating FIPS
  rules: chrony-refid-internal-md5.patch .</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_chrony-wait.service.patch
  * harden_chronyd.service.patch</changelog>
  <changelog author="max@suse.com" date="1633694400">- boo#1190926: PrivateDevices is too strict, we might need to
  access the rtc and ptp devices.
- Add back support to build chrony on SLE12.
- Drop dependency on asciidoctor. It is only needed for building
  the HTML documentation which we don't package anyway.</changelog>
  <changelog author="max@suse.com" date="1637323200">- SLE bugs that have been fixed in openSUSE up to this point
  without explicit references: bsc#1183783, bsc#1184400,
  bsc#1171806, bsc#1161119, bsc#1159840.
- Obsoleted SLE patches:
  * chrony-fix-open.patch
  * chrony-gettimeofday.patch
  * chrony-ntp-era-split.patch
  * chrony-pidfile.patch
  * chrony-select-timeout.patch
  * chrony-urandom.patch
  * chrony.sysconfig
  * clknetsim-glibc-2.31.patch</changelog>
  <changelog author="max@suse.com" date="1638878400">- Add chrony-htonl.patch to work around undocumented behaviour of
  htonl() in older glibc versions (SLE-12) on 64 bit big endian
  architectures (s390x).</changelog>
  <changelog author="max@suse.com" date="1641816000">- bsc#1194229: Fix pool package dependencies, so that SLE actually
  prefers chrony-pool-suse over chrony-pool-empty.</changelog>
  <changelog author="max@suse.com" date="1648123200">- Fix config file handling in the spec file and remove "ntsdumpdir"
  from default config, because augeas-lenses cannot parse it during
  installation of SLE Micro on SLE-15-SP3 (bsc#1194220).</changelog>
  <changelog author="max@suse.com" date="1710504000">- Use shorter NTS-KE retry interval when network is down
  (bsc#1213551, chrony-burst_total_samples_to_go.patch,
  chrony-retry_interval_ke_start.patch).</changelog>
  <changelog author="max@suse.com" date="1712750400">- Use make quickcheck instead of make check to avoid &gt;1h build
  times and failures due to timeouts. This was the default before
  3.2 but it changed to make tests more reliable. Here a seed is
  already set to get deterministic execution.</changelog>
</package>
<package pkgid="9a9a0cfdf95dc3158e57d034caf6edf746afb91816f3582795a13718e66e62f0" name="chrony-pool-suse" arch="noarch">
  <version epoch="0" ver="4.1" rel="150400.21.5.7"/>
  <changelog author="max@suse.com" date="1591272000">- Add chrony-pool-suse and chrony-pool-openSUSE subpackages that
  preconfigure chrony to use NTP servers from the  respective
  pools for SUSE and openSUSE (bsc#1156884, SLE-11424).
- Add chrony-pool-empty to still allow installing chrony without
  preconfigured servers.
- Use iburst in the default pool statements to speed up initial
  synchronisation (bsc#1172113).</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596369600">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="elimat@opensuse.org" date="1599998400">- Update to 3.5.1:
  * Create new file when writing pidfile (CVE-2020-14367, bsc#1174911)</changelog>
  <changelog author="max@suse.com" date="1600084800">- Adjust and rename the sysconfig file, so that it matches the
  expectations of chronyd.service (bsc#1173277).</changelog>
  <changelog author="kukuk@suse.com" date="1603886400">- By default we don't write log files but log to journald, so
  only recommend logrotate.</changelog>
  <changelog author="mrueckert@suse.de" date="1604232000">- Update to 4.0
  - Enhancements
  - Add support for Network Time Security (NTS) authentication
  - Add support for AES-CMAC keys (AES128, AES256) with Nettle
  - Add authselectmode directive to control selection of
    unauthenticated sources
  - Add binddevice, bindacqdevice, bindcmddevice directives
  - Add confdir directive to better support fragmented
    configuration
  - Add sourcedir directive and "reload sources" command to
    support dynamic NTP sources specified in files
  - Add clockprecision directive
  - Add dscp directive to set Differentiated Services Code Point
    (DSCP)
  - Add -L option to limit log messages by severity
  - Add -p option to print whole configuration with included
    files
  - Add -U option to allow start under non-root user
  - Allow maxsamples to be set to 1 for faster update with -q/-Q
    option
  - Avoid replacing NTP sources with sources that have
    unreachable address
  - Improve pools to repeat name resolution to get "maxsources"
    sources
  - Improve source selection with trusted sources
  - Improve NTP loop test to prevent synchronisation to itself
  - Repeat iburst when NTP source is switched from offline state
    to online
  - Update clock synchronisation status and leap status more
    frequently
  - Update seccomp filter
  - Add "add pool" command
  - Add "reset sources" command to drop all measurements
  - Add authdata command to print details about NTP
    authentication
  - Add selectdata command to print details about source
    selection
  - Add -N option and sourcename command to print original names
    of sources
  - Add -a option to some commands to print also unresolved
    sources
  - Add -k, -p, -r options to clients command to select, limit,
    reset data
  - Bug fixes
  - Don’t set interface for NTP responses to allow asymmetric
    routing
  - Handle RTCs that don’t support interrupts
  - Respond to command requests with correct address on
    multihomed hosts
  - Removed features
  - Drop support for RIPEMD keys (RMD128, RMD160, RMD256, RMD320)
  - Drop support for long (non-standard) MACs in NTPv4 packets
    (chrony 2.x clients using non-MD5/SHA1 keys need to use
    option "version 3")
  - Drop support for line editing with GNU Readline
- add BuildRequires for gnutls-devel (which also pulls nettle to
  enable the new features)
- drop patches which are included in the update:
  chrony-test-update-processing-of-packet-log.patch
  chrony-test-fix-util-unit-test-for-NTP-era-split.patch
- refreshed chrony-config.patch
- track series file for easier quilt setup
- added option to turn off testsuite with
  osc build --without=testsuite
  testsuite still runs by default</changelog>
  <changelog author="mrueckert@suse.de" date="1607342400">- drop buildrequires on NSS. We need gnutls for NTS anyway and we
  can do all the other required crypto via nettle+gnutls. no need
  for another crypto library.</changelog>
  <changelog author="max@suse.com" date="1612526400">- Enable syscallfilter unconditionally [boo#1181826].</changelog>
  <changelog author="max@suse.com" date="1622548800">- Update to 4.1
  * Add support for NTS servers specified by IP address (matching
    Subject Alternative Name in server certificate)
  * Add source-specific configuration of trusted certificates
  * Allow multiple files and directories with trusted certificates
  * Allow multiple pairs of server keys and certificates
  * Add copy option to server/pool directive
  * Increase PPS lock limit to 40% of pulse interval
  * Perform source selection immediately after loading dump files
  * Reload dump files for addresses negotiated by NTS-KE server
  * Update seccomp filter and add less restrictive level
  * Restart ongoing name resolution on online command
  * Fix dump files to not include uncorrected offset
  * Fix initstepslew to accept time from own NTP clients
  * Reset NTP address and port when no longer negotiated by NTS-KE
    server
- Update clknetsim to snapshot f89702d.
- Refresh chrony.keyring from
  https://chrony.tuxfamily.org/gpgkey-8F375C7E8D0EE125A3D3BD51537E2B76F7680DAC.asc
- Ensure the correct pool packages are installed for openSUSE
  and SLE (bsc#1180689).</changelog>
  <changelog author="gmbr3@opensuse.org" date="1622635200">- Change to using systemd-sysusers
- Remove otherproviders, not needed anymore</changelog>
  <changelog author="gmbr3@opensuse.org" date="1623585600">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="max@suse.com" date="1625140800">- boo#1187906: Consolidate all references to the helper script.
- bsc#1173760: MD5 is not available from mozilla-nss in FIPS mode,
  but needed for calculating refids from IPv6 addresses as part of
  the NTP protocol (rfc5905). As this is a non-cryptographic use of
  MD5 we can use our own implementation without violating FIPS
  rules: chrony-refid-internal-md5.patch .</changelog>
  <changelog author="jsegitz@suse.com" date="1630324800">- Added hardening to systemd service(s). Added patch(es):
  * harden_chrony-wait.service.patch
  * harden_chronyd.service.patch</changelog>
  <changelog author="max@suse.com" date="1633694400">- boo#1190926: PrivateDevices is too strict, we might need to
  access the rtc and ptp devices.
- Add back support to build chrony on SLE12.
- Drop dependency on asciidoctor. It is only needed for building
  the HTML documentation which we don't package anyway.</changelog>
  <changelog author="max@suse.com" date="1637323200">- SLE bugs that have been fixed in openSUSE up to this point
  without explicit references: bsc#1183783, bsc#1184400,
  bsc#1171806, bsc#1161119, bsc#1159840.
- Obsoleted SLE patches:
  * chrony-fix-open.patch
  * chrony-gettimeofday.patch
  * chrony-ntp-era-split.patch
  * chrony-pidfile.patch
  * chrony-select-timeout.patch
  * chrony-urandom.patch
  * chrony.sysconfig
  * clknetsim-glibc-2.31.patch</changelog>
  <changelog author="max@suse.com" date="1638878400">- Add chrony-htonl.patch to work around undocumented behaviour of
  htonl() in older glibc versions (SLE-12) on 64 bit big endian
  architectures (s390x).</changelog>
  <changelog author="max@suse.com" date="1641816000">- bsc#1194229: Fix pool package dependencies, so that SLE actually
  prefers chrony-pool-suse over chrony-pool-empty.</changelog>
  <changelog author="max@suse.com" date="1648123200">- Fix config file handling in the spec file and remove "ntsdumpdir"
  from default config, because augeas-lenses cannot parse it during
  installation of SLE Micro on SLE-15-SP3 (bsc#1194220).</changelog>
  <changelog author="max@suse.com" date="1710504000">- Use shorter NTS-KE retry interval when network is down
  (bsc#1213551, chrony-burst_total_samples_to_go.patch,
  chrony-retry_interval_ke_start.patch).</changelog>
  <changelog author="max@suse.com" date="1712750400">- Use make quickcheck instead of make check to avoid &gt;1h build
  times and failures due to timeouts. This was the default before
  3.2 but it changed to make tests more reliable. Here a seed is
  already set to get deterministic execution.</changelog>
</package>
<package pkgid="4efe67e52782774fc6b7906451c239b2d67b9c0e2c5c96232147c61f1da7344b" name="clamav" arch="aarch64">
  <version epoch="0" ver="0.103.12" rel="150600.18.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577188800">- The freshclam.service should not be started before the network is
  online (it checks for updates immediately upon service start)</changelog>
  <changelog author="suse+build@de-korte.org" date="1580904000">- update to 0.102.2
  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when
    using the optional credit card data-loss-prevention (DLP) feature.
    Improper bounds checking of an unsigned variable resulted in an
    out-of-bounds read, which causes a crash.
  * Significantly improved the scan speed of PDF files on Windows.
  * Re-applied a fix to alleviate file access issues when scanning RAR
    files in downstream projects that use libclamav where the scanning
    engine is operating in a low-privilege process. This bug was originally
    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
  * Fixed an issue where freshclam failed to update if the database version
    downloaded is one version older than advertised. This situation may
    occur after a new database version is published. The issue affected
    users downloading the whole CVD database file.
  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
    The ReceiveTimeout had caused needless database update failures for
    users with slower internet connections.
  * Correctly display the number of kilobytes (KiB) in progress bar and
    reduced the size of the progress bar to accommodate 80-character width
    terminals.
  * Fixed an issue where running freshclam manually causes a daemonized
    freshclam process to fail when it updates because the manual instance
    deletes the temporary download directory. The freshclam temporary files
    will now download to a unique directory created at the time of an update
    instead of using a hardcoded directory created/destroyed at the program
    start/exit.
  * Fix for freshclam's OnOutdatedExecute config option.
  * Fixes a memory leak in the error condition handling for the email
    parser.
  * Improved bound checking and error handling in ARJ archive parser.
  * Improved error handling in PDF parser.
  * Fix for memory leak in byte-compare signature handler.</changelog>
  <changelog author="mpluskal@suse.com" date="1585742400">- Drop python build dependency as it is not needed</changelog>
  <changelog author="suse+build@de-korte.org" date="1589284800">- Update to 0.102.3
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper bounds checking of an unsigned variable results
    in an out-of-bounds read which causes a crash.
  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in
    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper size checking of a buffer used to initialize AES
    decryption routines results in an out-of-bounds read which may cause
    a crash.
  * Fix "Attempt to allocate 0 bytes" error when parsing some PDF
    documents.
  * Fix a couple of minor memory leaks.
  * Updated libclamunrar to UnRAR 5.9.2.</changelog>
  <changelog author="suse+build@de-korte.org" date="1594900800">- Update to 0.102.4
  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could
    replace a scan target's directory with a symlink to another path
    to trick clamscan, clamdscan, or clamonacc into removing or moving
    a different file (eg. a critical system file). The issue would
    affect users that use the --move or --remove options for clamscan,
    clamdscan, and clamonacc.
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.3 that could cause a Denial-of-Service
    (DoS) condition. Improper bounds checking results in an
    out-of-bounds read which could cause a crash. The previous fix for
    this CVE in 0.102.3 was incomplete. This fix correctly resolves
    the issue.
  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in
    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)
    condition. Improper error handling may result in a crash due to a
    NULL pointer dereference. This vulnerability is mitigated for
    those using the official ClamAV signature databases because the
    file type signatures in daily.cvd will not enable the EGG archive
    parser in versions affected by the vulnerability.</changelog>
  <changelog author="suse+build@de-korte.org" date="1600084800">- Update to 0.103.0
  * clamd can now reload the signature database without blocking
    scanning. This multi-threaded database reload improvement was made
    possible thanks to a community effort.
  - Non-blocking database reloads are now the default behavior. Some
    systems that are more constrained on RAM may need to disable
    non-blocking reloads as it will temporarily consume two times as
    much memory. We added a new clamd config option
    ConcurrentDatabaseReload, which may be set to no.
  * Dropped clamav-str-h.patch (no longer needed)
  * Fix clamav-milter.service (requires clamd.service to run)</changelog>
  <changelog author="max@suse.com" date="1605009600">- Sync Factory to SLE-15 to implement jsc#ECO-3010 and bsc#1118459.
- bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
- Keep OBS from installing an existing clamav instance to scan the
  sources, because this makes "make check" use the old library
  instead of the just built one. This is only a workaround until
  we found a way to keep libtool from adding libdir to rpath and
  LD_LIBRARY_PATH of the binaries in the testsuite.</changelog>
  <changelog author="dimstar@opensuse.org" date="1605182400">- Do not hard-depend on systemd: use systemd_ordering instead of
  systemd_requires.</changelog>
  <changelog author="max@suse.com" date="1617969600">- Update clamav.keyring
- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
  * obsoletes clamav-disable-timestamps.patch
- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="suse+build@de-korte.org" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="max@suse.com" date="1636372800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.
- Fix unit test
  + clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1642420800">- Update to 0.103.5
  * bsc#1194731, CVE-2022-20698:
    Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
  <changelog author="max@suse.com" date="1651838400">- Update to 0.103.6
  * CVE-2022-20770: Fixed a possible infinite loop vulnerability in the CHM
    file parser. Issue affects versions 0.104.0 through 0.104.2 and LTS
    version 0.103.5 and prior versions. (boo#1199242)
  * CVE-2022-20796: Fixed a possible NULL-pointer dereference crash in the
    scan verdict cache check. Issue affects versions 0.103.4, 0.103.5,
    0.104.1, and 0.104.2. (boo#1199246)
  * CVE-2022-20771: Fixed a possible infinite loop vulnerability in the
    TIFF file parser. Issue affects versions 0.104.0 through 0.104.2 and
    LTS version 0.103.5 and prior versions. The issue only occurs if the
    "--alert-broken-media" ClamScan option is enabled. For ClamD, the
    affected option is "AlertBrokenMedia yes", and for libclamav it is the
    "CL_SCAN_HEURISTIC_BROKEN_MEDIA" scan option. (boo#1199244)
  * CVE-2022-20785: Fixed a possible memory leak in the HTML file parser /
    Javascript normalizer. Issue affects versions 0.104.0 through 0.104.2
    and LTS version 0.103.5 and prior versions. (boo#1199245)
  * CVE-2022-20792: Fixed a possible multi-byte heap buffer overflow write
    vulnerability in the signature database load module. The fix was to
    update the vendored regex library to the latest version. Issue affects
    versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior
    versions. (boo#1199274)
  * ClamOnAcc: Fixed a number of assorted stability issues and added
    niceties for debugging ClamOnAcc.
  * Fixed an issue causing byte-compare subsignatures to cause an alert
    when they match even if other conditions of the given logical
    signatures were not met.
  * Fix memleak when using multiple byte-compare subsignatures. This fix
    was backported from 0.104.0.
  * Assorted bug fixes and improvements.
- Remove upstreamed clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1661947200">- bsc#1202986: Update to 0.103.7:
  * Upgrade the vendored UnRAR library to version 6.1.7.
  * Fix logical signature "Intermediates" feature.
  * Relax constraints on slightly malformed zip archives that
    contain overlapping file entries.</changelog>
  <changelog author="max@suse.com" date="1676548800">- Update to 0.103.8
  * CVE-2023-20032: Fixed a possible remote code execution vulnerability
    in the HFS+ file parser. Issue affects versions 1.0.0 and earlier,
    0.105.1 and earlier, and 0.103.7 and earlier. (bsc#1208363)
  * CVE-2023-20052: Fixed a possible remote information leak
    vulnerability in the DMG file parser. Issue affects versions 1.0.0
    and earlier, 0.105.1 and earlier, and 0.103.7 and earlier.
    (bsc#1208365)
  * Update vendored libmspack library to version 0.11alpha.</changelog>
  <changelog author="max@suse.com" date="1692273600">- Update to 0.103.9
  * CVE-2023-20197, bsc#1214342: Fixed a possible denial of service
    vulnerability in the HFS+ file parser.
  * Fixed compiler warnings that may turn into errors in Clang 16.
- Renew clamav.keyring .</changelog>
  <changelog author="max@suse.com" date="1698321600">- Update to 0.103.11
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.12.
  * Windows: libjson-c 0.17 compatibility fix. with ssize_t type definition.
  * Windows: Update build system to use OpenSSL 3 and PThreads-Win32 v3.
- Update to 0.103.10
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.10.
    (bsc#1216625, CVE-2023-40477)</changelog>
  <changelog author="max@suse.com" date="1725883200">- Update to 0.103.12
  * [CVE-2024-20506, bsc#1230162]: Changed the logging module to
    disable following symlinks on Linux and Unix systems so as to
    prevent an attacker with existing access to the 'clamd' or
    'freshclam' services from using a symlink to corrupt system
    files.
  * [CVE-2024-20505, bsc#1230161]: Fixed a possible out-of-bounds
    read bug in the PDF file parser that could cause a
    denial-of-service (DoS) condition.
  * ClamOnAcc: Fixed an infinite loop when a watched directory
    does not exist.
  * Fixed a bug causing CVDs downloaded by the `DatabaseCustomURL`
    Freshclam config option to be pruned and then re-downloaded
    with every update.
  * Fixed an unaligned pointer dereference issue on select
    architectures.</changelog>
</package>
<package pkgid="5fc3b1b8912408045bb638d5c061da10c161ec8602946cf5278e5704bebb80ef" name="clamav" arch="ppc64le">
  <version epoch="0" ver="0.103.12" rel="150600.18.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577188800">- The freshclam.service should not be started before the network is
  online (it checks for updates immediately upon service start)</changelog>
  <changelog author="suse+build@de-korte.org" date="1580904000">- update to 0.102.2
  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when
    using the optional credit card data-loss-prevention (DLP) feature.
    Improper bounds checking of an unsigned variable resulted in an
    out-of-bounds read, which causes a crash.
  * Significantly improved the scan speed of PDF files on Windows.
  * Re-applied a fix to alleviate file access issues when scanning RAR
    files in downstream projects that use libclamav where the scanning
    engine is operating in a low-privilege process. This bug was originally
    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
  * Fixed an issue where freshclam failed to update if the database version
    downloaded is one version older than advertised. This situation may
    occur after a new database version is published. The issue affected
    users downloading the whole CVD database file.
  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
    The ReceiveTimeout had caused needless database update failures for
    users with slower internet connections.
  * Correctly display the number of kilobytes (KiB) in progress bar and
    reduced the size of the progress bar to accommodate 80-character width
    terminals.
  * Fixed an issue where running freshclam manually causes a daemonized
    freshclam process to fail when it updates because the manual instance
    deletes the temporary download directory. The freshclam temporary files
    will now download to a unique directory created at the time of an update
    instead of using a hardcoded directory created/destroyed at the program
    start/exit.
  * Fix for freshclam's OnOutdatedExecute config option.
  * Fixes a memory leak in the error condition handling for the email
    parser.
  * Improved bound checking and error handling in ARJ archive parser.
  * Improved error handling in PDF parser.
  * Fix for memory leak in byte-compare signature handler.</changelog>
  <changelog author="mpluskal@suse.com" date="1585742400">- Drop python build dependency as it is not needed</changelog>
  <changelog author="suse+build@de-korte.org" date="1589284800">- Update to 0.102.3
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper bounds checking of an unsigned variable results
    in an out-of-bounds read which causes a crash.
  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in
    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper size checking of a buffer used to initialize AES
    decryption routines results in an out-of-bounds read which may cause
    a crash.
  * Fix "Attempt to allocate 0 bytes" error when parsing some PDF
    documents.
  * Fix a couple of minor memory leaks.
  * Updated libclamunrar to UnRAR 5.9.2.</changelog>
  <changelog author="suse+build@de-korte.org" date="1594900800">- Update to 0.102.4
  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could
    replace a scan target's directory with a symlink to another path
    to trick clamscan, clamdscan, or clamonacc into removing or moving
    a different file (eg. a critical system file). The issue would
    affect users that use the --move or --remove options for clamscan,
    clamdscan, and clamonacc.
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.3 that could cause a Denial-of-Service
    (DoS) condition. Improper bounds checking results in an
    out-of-bounds read which could cause a crash. The previous fix for
    this CVE in 0.102.3 was incomplete. This fix correctly resolves
    the issue.
  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in
    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)
    condition. Improper error handling may result in a crash due to a
    NULL pointer dereference. This vulnerability is mitigated for
    those using the official ClamAV signature databases because the
    file type signatures in daily.cvd will not enable the EGG archive
    parser in versions affected by the vulnerability.</changelog>
  <changelog author="suse+build@de-korte.org" date="1600084800">- Update to 0.103.0
  * clamd can now reload the signature database without blocking
    scanning. This multi-threaded database reload improvement was made
    possible thanks to a community effort.
  - Non-blocking database reloads are now the default behavior. Some
    systems that are more constrained on RAM may need to disable
    non-blocking reloads as it will temporarily consume two times as
    much memory. We added a new clamd config option
    ConcurrentDatabaseReload, which may be set to no.
  * Dropped clamav-str-h.patch (no longer needed)
  * Fix clamav-milter.service (requires clamd.service to run)</changelog>
  <changelog author="max@suse.com" date="1605009600">- Sync Factory to SLE-15 to implement jsc#ECO-3010 and bsc#1118459.
- bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
- Keep OBS from installing an existing clamav instance to scan the
  sources, because this makes "make check" use the old library
  instead of the just built one. This is only a workaround until
  we found a way to keep libtool from adding libdir to rpath and
  LD_LIBRARY_PATH of the binaries in the testsuite.</changelog>
  <changelog author="dimstar@opensuse.org" date="1605182400">- Do not hard-depend on systemd: use systemd_ordering instead of
  systemd_requires.</changelog>
  <changelog author="max@suse.com" date="1617969600">- Update clamav.keyring
- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
  * obsoletes clamav-disable-timestamps.patch
- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="suse+build@de-korte.org" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="max@suse.com" date="1636372800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.
- Fix unit test
  + clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1642420800">- Update to 0.103.5
  * bsc#1194731, CVE-2022-20698:
    Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
  <changelog author="max@suse.com" date="1651838400">- Update to 0.103.6
  * CVE-2022-20770: Fixed a possible infinite loop vulnerability in the CHM
    file parser. Issue affects versions 0.104.0 through 0.104.2 and LTS
    version 0.103.5 and prior versions. (boo#1199242)
  * CVE-2022-20796: Fixed a possible NULL-pointer dereference crash in the
    scan verdict cache check. Issue affects versions 0.103.4, 0.103.5,
    0.104.1, and 0.104.2. (boo#1199246)
  * CVE-2022-20771: Fixed a possible infinite loop vulnerability in the
    TIFF file parser. Issue affects versions 0.104.0 through 0.104.2 and
    LTS version 0.103.5 and prior versions. The issue only occurs if the
    "--alert-broken-media" ClamScan option is enabled. For ClamD, the
    affected option is "AlertBrokenMedia yes", and for libclamav it is the
    "CL_SCAN_HEURISTIC_BROKEN_MEDIA" scan option. (boo#1199244)
  * CVE-2022-20785: Fixed a possible memory leak in the HTML file parser /
    Javascript normalizer. Issue affects versions 0.104.0 through 0.104.2
    and LTS version 0.103.5 and prior versions. (boo#1199245)
  * CVE-2022-20792: Fixed a possible multi-byte heap buffer overflow write
    vulnerability in the signature database load module. The fix was to
    update the vendored regex library to the latest version. Issue affects
    versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior
    versions. (boo#1199274)
  * ClamOnAcc: Fixed a number of assorted stability issues and added
    niceties for debugging ClamOnAcc.
  * Fixed an issue causing byte-compare subsignatures to cause an alert
    when they match even if other conditions of the given logical
    signatures were not met.
  * Fix memleak when using multiple byte-compare subsignatures. This fix
    was backported from 0.104.0.
  * Assorted bug fixes and improvements.
- Remove upstreamed clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1661947200">- bsc#1202986: Update to 0.103.7:
  * Upgrade the vendored UnRAR library to version 6.1.7.
  * Fix logical signature "Intermediates" feature.
  * Relax constraints on slightly malformed zip archives that
    contain overlapping file entries.</changelog>
  <changelog author="max@suse.com" date="1676548800">- Update to 0.103.8
  * CVE-2023-20032: Fixed a possible remote code execution vulnerability
    in the HFS+ file parser. Issue affects versions 1.0.0 and earlier,
    0.105.1 and earlier, and 0.103.7 and earlier. (bsc#1208363)
  * CVE-2023-20052: Fixed a possible remote information leak
    vulnerability in the DMG file parser. Issue affects versions 1.0.0
    and earlier, 0.105.1 and earlier, and 0.103.7 and earlier.
    (bsc#1208365)
  * Update vendored libmspack library to version 0.11alpha.</changelog>
  <changelog author="max@suse.com" date="1692273600">- Update to 0.103.9
  * CVE-2023-20197, bsc#1214342: Fixed a possible denial of service
    vulnerability in the HFS+ file parser.
  * Fixed compiler warnings that may turn into errors in Clang 16.
- Renew clamav.keyring .</changelog>
  <changelog author="max@suse.com" date="1698321600">- Update to 0.103.11
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.12.
  * Windows: libjson-c 0.17 compatibility fix. with ssize_t type definition.
  * Windows: Update build system to use OpenSSL 3 and PThreads-Win32 v3.
- Update to 0.103.10
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.10.
    (bsc#1216625, CVE-2023-40477)</changelog>
  <changelog author="max@suse.com" date="1725883200">- Update to 0.103.12
  * [CVE-2024-20506, bsc#1230162]: Changed the logging module to
    disable following symlinks on Linux and Unix systems so as to
    prevent an attacker with existing access to the 'clamd' or
    'freshclam' services from using a symlink to corrupt system
    files.
  * [CVE-2024-20505, bsc#1230161]: Fixed a possible out-of-bounds
    read bug in the PDF file parser that could cause a
    denial-of-service (DoS) condition.
  * ClamOnAcc: Fixed an infinite loop when a watched directory
    does not exist.
  * Fixed a bug causing CVDs downloaded by the `DatabaseCustomURL`
    Freshclam config option to be pruned and then re-downloaded
    with every update.
  * Fixed an unaligned pointer dereference issue on select
    architectures.</changelog>
</package>
<package pkgid="8564be4f7abe987c81587754b2b4cfb719df8f85ff77cd47ed79aac685aaf440" name="clamav" arch="s390x">
  <version epoch="0" ver="0.103.12" rel="150600.18.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577188800">- The freshclam.service should not be started before the network is
  online (it checks for updates immediately upon service start)</changelog>
  <changelog author="suse+build@de-korte.org" date="1580904000">- update to 0.102.2
  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when
    using the optional credit card data-loss-prevention (DLP) feature.
    Improper bounds checking of an unsigned variable resulted in an
    out-of-bounds read, which causes a crash.
  * Significantly improved the scan speed of PDF files on Windows.
  * Re-applied a fix to alleviate file access issues when scanning RAR
    files in downstream projects that use libclamav where the scanning
    engine is operating in a low-privilege process. This bug was originally
    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
  * Fixed an issue where freshclam failed to update if the database version
    downloaded is one version older than advertised. This situation may
    occur after a new database version is published. The issue affected
    users downloading the whole CVD database file.
  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
    The ReceiveTimeout had caused needless database update failures for
    users with slower internet connections.
  * Correctly display the number of kilobytes (KiB) in progress bar and
    reduced the size of the progress bar to accommodate 80-character width
    terminals.
  * Fixed an issue where running freshclam manually causes a daemonized
    freshclam process to fail when it updates because the manual instance
    deletes the temporary download directory. The freshclam temporary files
    will now download to a unique directory created at the time of an update
    instead of using a hardcoded directory created/destroyed at the program
    start/exit.
  * Fix for freshclam's OnOutdatedExecute config option.
  * Fixes a memory leak in the error condition handling for the email
    parser.
  * Improved bound checking and error handling in ARJ archive parser.
  * Improved error handling in PDF parser.
  * Fix for memory leak in byte-compare signature handler.</changelog>
  <changelog author="mpluskal@suse.com" date="1585742400">- Drop python build dependency as it is not needed</changelog>
  <changelog author="suse+build@de-korte.org" date="1589284800">- Update to 0.102.3
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper bounds checking of an unsigned variable results
    in an out-of-bounds read which causes a crash.
  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in
    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper size checking of a buffer used to initialize AES
    decryption routines results in an out-of-bounds read which may cause
    a crash.
  * Fix "Attempt to allocate 0 bytes" error when parsing some PDF
    documents.
  * Fix a couple of minor memory leaks.
  * Updated libclamunrar to UnRAR 5.9.2.</changelog>
  <changelog author="suse+build@de-korte.org" date="1594900800">- Update to 0.102.4
  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could
    replace a scan target's directory with a symlink to another path
    to trick clamscan, clamdscan, or clamonacc into removing or moving
    a different file (eg. a critical system file). The issue would
    affect users that use the --move or --remove options for clamscan,
    clamdscan, and clamonacc.
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.3 that could cause a Denial-of-Service
    (DoS) condition. Improper bounds checking results in an
    out-of-bounds read which could cause a crash. The previous fix for
    this CVE in 0.102.3 was incomplete. This fix correctly resolves
    the issue.
  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in
    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)
    condition. Improper error handling may result in a crash due to a
    NULL pointer dereference. This vulnerability is mitigated for
    those using the official ClamAV signature databases because the
    file type signatures in daily.cvd will not enable the EGG archive
    parser in versions affected by the vulnerability.</changelog>
  <changelog author="suse+build@de-korte.org" date="1600084800">- Update to 0.103.0
  * clamd can now reload the signature database without blocking
    scanning. This multi-threaded database reload improvement was made
    possible thanks to a community effort.
  - Non-blocking database reloads are now the default behavior. Some
    systems that are more constrained on RAM may need to disable
    non-blocking reloads as it will temporarily consume two times as
    much memory. We added a new clamd config option
    ConcurrentDatabaseReload, which may be set to no.
  * Dropped clamav-str-h.patch (no longer needed)
  * Fix clamav-milter.service (requires clamd.service to run)</changelog>
  <changelog author="max@suse.com" date="1605009600">- Sync Factory to SLE-15 to implement jsc#ECO-3010 and bsc#1118459.
- bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
- Keep OBS from installing an existing clamav instance to scan the
  sources, because this makes "make check" use the old library
  instead of the just built one. This is only a workaround until
  we found a way to keep libtool from adding libdir to rpath and
  LD_LIBRARY_PATH of the binaries in the testsuite.</changelog>
  <changelog author="dimstar@opensuse.org" date="1605182400">- Do not hard-depend on systemd: use systemd_ordering instead of
  systemd_requires.</changelog>
  <changelog author="max@suse.com" date="1617969600">- Update clamav.keyring
- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
  * obsoletes clamav-disable-timestamps.patch
- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="suse+build@de-korte.org" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="max@suse.com" date="1636372800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.
- Fix unit test
  + clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1642420800">- Update to 0.103.5
  * bsc#1194731, CVE-2022-20698:
    Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
  <changelog author="max@suse.com" date="1651838400">- Update to 0.103.6
  * CVE-2022-20770: Fixed a possible infinite loop vulnerability in the CHM
    file parser. Issue affects versions 0.104.0 through 0.104.2 and LTS
    version 0.103.5 and prior versions. (boo#1199242)
  * CVE-2022-20796: Fixed a possible NULL-pointer dereference crash in the
    scan verdict cache check. Issue affects versions 0.103.4, 0.103.5,
    0.104.1, and 0.104.2. (boo#1199246)
  * CVE-2022-20771: Fixed a possible infinite loop vulnerability in the
    TIFF file parser. Issue affects versions 0.104.0 through 0.104.2 and
    LTS version 0.103.5 and prior versions. The issue only occurs if the
    "--alert-broken-media" ClamScan option is enabled. For ClamD, the
    affected option is "AlertBrokenMedia yes", and for libclamav it is the
    "CL_SCAN_HEURISTIC_BROKEN_MEDIA" scan option. (boo#1199244)
  * CVE-2022-20785: Fixed a possible memory leak in the HTML file parser /
    Javascript normalizer. Issue affects versions 0.104.0 through 0.104.2
    and LTS version 0.103.5 and prior versions. (boo#1199245)
  * CVE-2022-20792: Fixed a possible multi-byte heap buffer overflow write
    vulnerability in the signature database load module. The fix was to
    update the vendored regex library to the latest version. Issue affects
    versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior
    versions. (boo#1199274)
  * ClamOnAcc: Fixed a number of assorted stability issues and added
    niceties for debugging ClamOnAcc.
  * Fixed an issue causing byte-compare subsignatures to cause an alert
    when they match even if other conditions of the given logical
    signatures were not met.
  * Fix memleak when using multiple byte-compare subsignatures. This fix
    was backported from 0.104.0.
  * Assorted bug fixes and improvements.
- Remove upstreamed clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1661947200">- bsc#1202986: Update to 0.103.7:
  * Upgrade the vendored UnRAR library to version 6.1.7.
  * Fix logical signature "Intermediates" feature.
  * Relax constraints on slightly malformed zip archives that
    contain overlapping file entries.</changelog>
  <changelog author="max@suse.com" date="1676548800">- Update to 0.103.8
  * CVE-2023-20032: Fixed a possible remote code execution vulnerability
    in the HFS+ file parser. Issue affects versions 1.0.0 and earlier,
    0.105.1 and earlier, and 0.103.7 and earlier. (bsc#1208363)
  * CVE-2023-20052: Fixed a possible remote information leak
    vulnerability in the DMG file parser. Issue affects versions 1.0.0
    and earlier, 0.105.1 and earlier, and 0.103.7 and earlier.
    (bsc#1208365)
  * Update vendored libmspack library to version 0.11alpha.</changelog>
  <changelog author="max@suse.com" date="1692273600">- Update to 0.103.9
  * CVE-2023-20197, bsc#1214342: Fixed a possible denial of service
    vulnerability in the HFS+ file parser.
  * Fixed compiler warnings that may turn into errors in Clang 16.
- Renew clamav.keyring .</changelog>
  <changelog author="max@suse.com" date="1698321600">- Update to 0.103.11
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.12.
  * Windows: libjson-c 0.17 compatibility fix. with ssize_t type definition.
  * Windows: Update build system to use OpenSSL 3 and PThreads-Win32 v3.
- Update to 0.103.10
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.10.
    (bsc#1216625, CVE-2023-40477)</changelog>
  <changelog author="max@suse.com" date="1725883200">- Update to 0.103.12
  * [CVE-2024-20506, bsc#1230162]: Changed the logging module to
    disable following symlinks on Linux and Unix systems so as to
    prevent an attacker with existing access to the 'clamd' or
    'freshclam' services from using a symlink to corrupt system
    files.
  * [CVE-2024-20505, bsc#1230161]: Fixed a possible out-of-bounds
    read bug in the PDF file parser that could cause a
    denial-of-service (DoS) condition.
  * ClamOnAcc: Fixed an infinite loop when a watched directory
    does not exist.
  * Fixed a bug causing CVDs downloaded by the `DatabaseCustomURL`
    Freshclam config option to be pruned and then re-downloaded
    with every update.
  * Fixed an unaligned pointer dereference issue on select
    architectures.</changelog>
</package>
<package pkgid="92db3c2805365c68717fbbac9d7fc65aa5ed5f800cb775533a7b130b17c32d49" name="clamav" arch="src">
  <version epoch="0" ver="0.103.12" rel="150600.18.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577188800">- The freshclam.service should not be started before the network is
  online (it checks for updates immediately upon service start)</changelog>
  <changelog author="suse+build@de-korte.org" date="1580904000">- update to 0.102.2
  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when
    using the optional credit card data-loss-prevention (DLP) feature.
    Improper bounds checking of an unsigned variable resulted in an
    out-of-bounds read, which causes a crash.
  * Significantly improved the scan speed of PDF files on Windows.
  * Re-applied a fix to alleviate file access issues when scanning RAR
    files in downstream projects that use libclamav where the scanning
    engine is operating in a low-privilege process. This bug was originally
    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
  * Fixed an issue where freshclam failed to update if the database version
    downloaded is one version older than advertised. This situation may
    occur after a new database version is published. The issue affected
    users downloading the whole CVD database file.
  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
    The ReceiveTimeout had caused needless database update failures for
    users with slower internet connections.
  * Correctly display the number of kilobytes (KiB) in progress bar and
    reduced the size of the progress bar to accommodate 80-character width
    terminals.
  * Fixed an issue where running freshclam manually causes a daemonized
    freshclam process to fail when it updates because the manual instance
    deletes the temporary download directory. The freshclam temporary files
    will now download to a unique directory created at the time of an update
    instead of using a hardcoded directory created/destroyed at the program
    start/exit.
  * Fix for freshclam's OnOutdatedExecute config option.
  * Fixes a memory leak in the error condition handling for the email
    parser.
  * Improved bound checking and error handling in ARJ archive parser.
  * Improved error handling in PDF parser.
  * Fix for memory leak in byte-compare signature handler.</changelog>
  <changelog author="mpluskal@suse.com" date="1585742400">- Drop python build dependency as it is not needed</changelog>
  <changelog author="suse+build@de-korte.org" date="1589284800">- Update to 0.102.3
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper bounds checking of an unsigned variable results
    in an out-of-bounds read which causes a crash.
  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in
    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper size checking of a buffer used to initialize AES
    decryption routines results in an out-of-bounds read which may cause
    a crash.
  * Fix "Attempt to allocate 0 bytes" error when parsing some PDF
    documents.
  * Fix a couple of minor memory leaks.
  * Updated libclamunrar to UnRAR 5.9.2.</changelog>
  <changelog author="suse+build@de-korte.org" date="1594900800">- Update to 0.102.4
  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could
    replace a scan target's directory with a symlink to another path
    to trick clamscan, clamdscan, or clamonacc into removing or moving
    a different file (eg. a critical system file). The issue would
    affect users that use the --move or --remove options for clamscan,
    clamdscan, and clamonacc.
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.3 that could cause a Denial-of-Service
    (DoS) condition. Improper bounds checking results in an
    out-of-bounds read which could cause a crash. The previous fix for
    this CVE in 0.102.3 was incomplete. This fix correctly resolves
    the issue.
  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in
    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)
    condition. Improper error handling may result in a crash due to a
    NULL pointer dereference. This vulnerability is mitigated for
    those using the official ClamAV signature databases because the
    file type signatures in daily.cvd will not enable the EGG archive
    parser in versions affected by the vulnerability.</changelog>
  <changelog author="suse+build@de-korte.org" date="1600084800">- Update to 0.103.0
  * clamd can now reload the signature database without blocking
    scanning. This multi-threaded database reload improvement was made
    possible thanks to a community effort.
  - Non-blocking database reloads are now the default behavior. Some
    systems that are more constrained on RAM may need to disable
    non-blocking reloads as it will temporarily consume two times as
    much memory. We added a new clamd config option
    ConcurrentDatabaseReload, which may be set to no.
  * Dropped clamav-str-h.patch (no longer needed)
  * Fix clamav-milter.service (requires clamd.service to run)</changelog>
  <changelog author="max@suse.com" date="1605009600">- Sync Factory to SLE-15 to implement jsc#ECO-3010 and bsc#1118459.
- bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
- Keep OBS from installing an existing clamav instance to scan the
  sources, because this makes "make check" use the old library
  instead of the just built one. This is only a workaround until
  we found a way to keep libtool from adding libdir to rpath and
  LD_LIBRARY_PATH of the binaries in the testsuite.</changelog>
  <changelog author="dimstar@opensuse.org" date="1605182400">- Do not hard-depend on systemd: use systemd_ordering instead of
  systemd_requires.</changelog>
  <changelog author="max@suse.com" date="1617969600">- Update clamav.keyring
- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
  * obsoletes clamav-disable-timestamps.patch
- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="suse+build@de-korte.org" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="max@suse.com" date="1636372800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.
- Fix unit test
  + clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1642420800">- Update to 0.103.5
  * bsc#1194731, CVE-2022-20698:
    Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
  <changelog author="max@suse.com" date="1651838400">- Update to 0.103.6
  * CVE-2022-20770: Fixed a possible infinite loop vulnerability in the CHM
    file parser. Issue affects versions 0.104.0 through 0.104.2 and LTS
    version 0.103.5 and prior versions. (boo#1199242)
  * CVE-2022-20796: Fixed a possible NULL-pointer dereference crash in the
    scan verdict cache check. Issue affects versions 0.103.4, 0.103.5,
    0.104.1, and 0.104.2. (boo#1199246)
  * CVE-2022-20771: Fixed a possible infinite loop vulnerability in the
    TIFF file parser. Issue affects versions 0.104.0 through 0.104.2 and
    LTS version 0.103.5 and prior versions. The issue only occurs if the
    "--alert-broken-media" ClamScan option is enabled. For ClamD, the
    affected option is "AlertBrokenMedia yes", and for libclamav it is the
    "CL_SCAN_HEURISTIC_BROKEN_MEDIA" scan option. (boo#1199244)
  * CVE-2022-20785: Fixed a possible memory leak in the HTML file parser /
    Javascript normalizer. Issue affects versions 0.104.0 through 0.104.2
    and LTS version 0.103.5 and prior versions. (boo#1199245)
  * CVE-2022-20792: Fixed a possible multi-byte heap buffer overflow write
    vulnerability in the signature database load module. The fix was to
    update the vendored regex library to the latest version. Issue affects
    versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior
    versions. (boo#1199274)
  * ClamOnAcc: Fixed a number of assorted stability issues and added
    niceties for debugging ClamOnAcc.
  * Fixed an issue causing byte-compare subsignatures to cause an alert
    when they match even if other conditions of the given logical
    signatures were not met.
  * Fix memleak when using multiple byte-compare subsignatures. This fix
    was backported from 0.104.0.
  * Assorted bug fixes and improvements.
- Remove upstreamed clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1661947200">- bsc#1202986: Update to 0.103.7:
  * Upgrade the vendored UnRAR library to version 6.1.7.
  * Fix logical signature "Intermediates" feature.
  * Relax constraints on slightly malformed zip archives that
    contain overlapping file entries.</changelog>
  <changelog author="max@suse.com" date="1676548800">- Update to 0.103.8
  * CVE-2023-20032: Fixed a possible remote code execution vulnerability
    in the HFS+ file parser. Issue affects versions 1.0.0 and earlier,
    0.105.1 and earlier, and 0.103.7 and earlier. (bsc#1208363)
  * CVE-2023-20052: Fixed a possible remote information leak
    vulnerability in the DMG file parser. Issue affects versions 1.0.0
    and earlier, 0.105.1 and earlier, and 0.103.7 and earlier.
    (bsc#1208365)
  * Update vendored libmspack library to version 0.11alpha.</changelog>
  <changelog author="max@suse.com" date="1692273600">- Update to 0.103.9
  * CVE-2023-20197, bsc#1214342: Fixed a possible denial of service
    vulnerability in the HFS+ file parser.
  * Fixed compiler warnings that may turn into errors in Clang 16.
- Renew clamav.keyring .</changelog>
  <changelog author="max@suse.com" date="1698321600">- Update to 0.103.11
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.12.
  * Windows: libjson-c 0.17 compatibility fix. with ssize_t type definition.
  * Windows: Update build system to use OpenSSL 3 and PThreads-Win32 v3.
- Update to 0.103.10
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.10.
    (bsc#1216625, CVE-2023-40477)</changelog>
  <changelog author="max@suse.com" date="1725883200">- Update to 0.103.12
  * [CVE-2024-20506, bsc#1230162]: Changed the logging module to
    disable following symlinks on Linux and Unix systems so as to
    prevent an attacker with existing access to the 'clamd' or
    'freshclam' services from using a symlink to corrupt system
    files.
  * [CVE-2024-20505, bsc#1230161]: Fixed a possible out-of-bounds
    read bug in the PDF file parser that could cause a
    denial-of-service (DoS) condition.
  * ClamOnAcc: Fixed an infinite loop when a watched directory
    does not exist.
  * Fixed a bug causing CVDs downloaded by the `DatabaseCustomURL`
    Freshclam config option to be pruned and then re-downloaded
    with every update.
  * Fixed an unaligned pointer dereference issue on select
    architectures.</changelog>
</package>
<package pkgid="1147c8d663a1bcd998a40f479acbb0c620829c271685845c83a56bd1c6118769" name="clamav" arch="x86_64">
  <version epoch="0" ver="0.103.12" rel="150600.18.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577188800">- The freshclam.service should not be started before the network is
  online (it checks for updates immediately upon service start)</changelog>
  <changelog author="suse+build@de-korte.org" date="1580904000">- update to 0.102.2
  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when
    using the optional credit card data-loss-prevention (DLP) feature.
    Improper bounds checking of an unsigned variable resulted in an
    out-of-bounds read, which causes a crash.
  * Significantly improved the scan speed of PDF files on Windows.
  * Re-applied a fix to alleviate file access issues when scanning RAR
    files in downstream projects that use libclamav where the scanning
    engine is operating in a low-privilege process. This bug was originally
    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
  * Fixed an issue where freshclam failed to update if the database version
    downloaded is one version older than advertised. This situation may
    occur after a new database version is published. The issue affected
    users downloading the whole CVD database file.
  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
    The ReceiveTimeout had caused needless database update failures for
    users with slower internet connections.
  * Correctly display the number of kilobytes (KiB) in progress bar and
    reduced the size of the progress bar to accommodate 80-character width
    terminals.
  * Fixed an issue where running freshclam manually causes a daemonized
    freshclam process to fail when it updates because the manual instance
    deletes the temporary download directory. The freshclam temporary files
    will now download to a unique directory created at the time of an update
    instead of using a hardcoded directory created/destroyed at the program
    start/exit.
  * Fix for freshclam's OnOutdatedExecute config option.
  * Fixes a memory leak in the error condition handling for the email
    parser.
  * Improved bound checking and error handling in ARJ archive parser.
  * Improved error handling in PDF parser.
  * Fix for memory leak in byte-compare signature handler.</changelog>
  <changelog author="mpluskal@suse.com" date="1585742400">- Drop python build dependency as it is not needed</changelog>
  <changelog author="suse+build@de-korte.org" date="1589284800">- Update to 0.102.3
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper bounds checking of an unsigned variable results
    in an out-of-bounds read which causes a crash.
  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in
    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper size checking of a buffer used to initialize AES
    decryption routines results in an out-of-bounds read which may cause
    a crash.
  * Fix "Attempt to allocate 0 bytes" error when parsing some PDF
    documents.
  * Fix a couple of minor memory leaks.
  * Updated libclamunrar to UnRAR 5.9.2.</changelog>
  <changelog author="suse+build@de-korte.org" date="1594900800">- Update to 0.102.4
  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could
    replace a scan target's directory with a symlink to another path
    to trick clamscan, clamdscan, or clamonacc into removing or moving
    a different file (eg. a critical system file). The issue would
    affect users that use the --move or --remove options for clamscan,
    clamdscan, and clamonacc.
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.3 that could cause a Denial-of-Service
    (DoS) condition. Improper bounds checking results in an
    out-of-bounds read which could cause a crash. The previous fix for
    this CVE in 0.102.3 was incomplete. This fix correctly resolves
    the issue.
  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in
    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)
    condition. Improper error handling may result in a crash due to a
    NULL pointer dereference. This vulnerability is mitigated for
    those using the official ClamAV signature databases because the
    file type signatures in daily.cvd will not enable the EGG archive
    parser in versions affected by the vulnerability.</changelog>
  <changelog author="suse+build@de-korte.org" date="1600084800">- Update to 0.103.0
  * clamd can now reload the signature database without blocking
    scanning. This multi-threaded database reload improvement was made
    possible thanks to a community effort.
  - Non-blocking database reloads are now the default behavior. Some
    systems that are more constrained on RAM may need to disable
    non-blocking reloads as it will temporarily consume two times as
    much memory. We added a new clamd config option
    ConcurrentDatabaseReload, which may be set to no.
  * Dropped clamav-str-h.patch (no longer needed)
  * Fix clamav-milter.service (requires clamd.service to run)</changelog>
  <changelog author="max@suse.com" date="1605009600">- Sync Factory to SLE-15 to implement jsc#ECO-3010 and bsc#1118459.
- bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
- Keep OBS from installing an existing clamav instance to scan the
  sources, because this makes "make check" use the old library
  instead of the just built one. This is only a workaround until
  we found a way to keep libtool from adding libdir to rpath and
  LD_LIBRARY_PATH of the binaries in the testsuite.</changelog>
  <changelog author="dimstar@opensuse.org" date="1605182400">- Do not hard-depend on systemd: use systemd_ordering instead of
  systemd_requires.</changelog>
  <changelog author="max@suse.com" date="1617969600">- Update clamav.keyring
- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
  * obsoletes clamav-disable-timestamps.patch
- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="suse+build@de-korte.org" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="max@suse.com" date="1636372800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.
- Fix unit test
  + clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1642420800">- Update to 0.103.5
  * bsc#1194731, CVE-2022-20698:
    Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
  <changelog author="max@suse.com" date="1651838400">- Update to 0.103.6
  * CVE-2022-20770: Fixed a possible infinite loop vulnerability in the CHM
    file parser. Issue affects versions 0.104.0 through 0.104.2 and LTS
    version 0.103.5 and prior versions. (boo#1199242)
  * CVE-2022-20796: Fixed a possible NULL-pointer dereference crash in the
    scan verdict cache check. Issue affects versions 0.103.4, 0.103.5,
    0.104.1, and 0.104.2. (boo#1199246)
  * CVE-2022-20771: Fixed a possible infinite loop vulnerability in the
    TIFF file parser. Issue affects versions 0.104.0 through 0.104.2 and
    LTS version 0.103.5 and prior versions. The issue only occurs if the
    "--alert-broken-media" ClamScan option is enabled. For ClamD, the
    affected option is "AlertBrokenMedia yes", and for libclamav it is the
    "CL_SCAN_HEURISTIC_BROKEN_MEDIA" scan option. (boo#1199244)
  * CVE-2022-20785: Fixed a possible memory leak in the HTML file parser /
    Javascript normalizer. Issue affects versions 0.104.0 through 0.104.2
    and LTS version 0.103.5 and prior versions. (boo#1199245)
  * CVE-2022-20792: Fixed a possible multi-byte heap buffer overflow write
    vulnerability in the signature database load module. The fix was to
    update the vendored regex library to the latest version. Issue affects
    versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior
    versions. (boo#1199274)
  * ClamOnAcc: Fixed a number of assorted stability issues and added
    niceties for debugging ClamOnAcc.
  * Fixed an issue causing byte-compare subsignatures to cause an alert
    when they match even if other conditions of the given logical
    signatures were not met.
  * Fix memleak when using multiple byte-compare subsignatures. This fix
    was backported from 0.104.0.
  * Assorted bug fixes and improvements.
- Remove upstreamed clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1661947200">- bsc#1202986: Update to 0.103.7:
  * Upgrade the vendored UnRAR library to version 6.1.7.
  * Fix logical signature "Intermediates" feature.
  * Relax constraints on slightly malformed zip archives that
    contain overlapping file entries.</changelog>
  <changelog author="max@suse.com" date="1676548800">- Update to 0.103.8
  * CVE-2023-20032: Fixed a possible remote code execution vulnerability
    in the HFS+ file parser. Issue affects versions 1.0.0 and earlier,
    0.105.1 and earlier, and 0.103.7 and earlier. (bsc#1208363)
  * CVE-2023-20052: Fixed a possible remote information leak
    vulnerability in the DMG file parser. Issue affects versions 1.0.0
    and earlier, 0.105.1 and earlier, and 0.103.7 and earlier.
    (bsc#1208365)
  * Update vendored libmspack library to version 0.11alpha.</changelog>
  <changelog author="max@suse.com" date="1692273600">- Update to 0.103.9
  * CVE-2023-20197, bsc#1214342: Fixed a possible denial of service
    vulnerability in the HFS+ file parser.
  * Fixed compiler warnings that may turn into errors in Clang 16.
- Renew clamav.keyring .</changelog>
  <changelog author="max@suse.com" date="1698321600">- Update to 0.103.11
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.12.
  * Windows: libjson-c 0.17 compatibility fix. with ssize_t type definition.
  * Windows: Update build system to use OpenSSL 3 and PThreads-Win32 v3.
- Update to 0.103.10
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.10.
    (bsc#1216625, CVE-2023-40477)</changelog>
  <changelog author="max@suse.com" date="1725883200">- Update to 0.103.12
  * [CVE-2024-20506, bsc#1230162]: Changed the logging module to
    disable following symlinks on Linux and Unix systems so as to
    prevent an attacker with existing access to the 'clamd' or
    'freshclam' services from using a symlink to corrupt system
    files.
  * [CVE-2024-20505, bsc#1230161]: Fixed a possible out-of-bounds
    read bug in the PDF file parser that could cause a
    denial-of-service (DoS) condition.
  * ClamOnAcc: Fixed an infinite loop when a watched directory
    does not exist.
  * Fixed a bug causing CVDs downloaded by the `DatabaseCustomURL`
    Freshclam config option to be pruned and then re-downloaded
    with every update.
  * Fixed an unaligned pointer dereference issue on select
    architectures.</changelog>
</package>
<package pkgid="6267237284e7df376cf361dc13f3fc7f58c1dcacba1758f1b60dff1cd1be8763" name="clamav-devel" arch="aarch64">
  <version epoch="0" ver="0.103.12" rel="150600.18.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577188800">- The freshclam.service should not be started before the network is
  online (it checks for updates immediately upon service start)</changelog>
  <changelog author="suse+build@de-korte.org" date="1580904000">- update to 0.102.2
  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when
    using the optional credit card data-loss-prevention (DLP) feature.
    Improper bounds checking of an unsigned variable resulted in an
    out-of-bounds read, which causes a crash.
  * Significantly improved the scan speed of PDF files on Windows.
  * Re-applied a fix to alleviate file access issues when scanning RAR
    files in downstream projects that use libclamav where the scanning
    engine is operating in a low-privilege process. This bug was originally
    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
  * Fixed an issue where freshclam failed to update if the database version
    downloaded is one version older than advertised. This situation may
    occur after a new database version is published. The issue affected
    users downloading the whole CVD database file.
  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
    The ReceiveTimeout had caused needless database update failures for
    users with slower internet connections.
  * Correctly display the number of kilobytes (KiB) in progress bar and
    reduced the size of the progress bar to accommodate 80-character width
    terminals.
  * Fixed an issue where running freshclam manually causes a daemonized
    freshclam process to fail when it updates because the manual instance
    deletes the temporary download directory. The freshclam temporary files
    will now download to a unique directory created at the time of an update
    instead of using a hardcoded directory created/destroyed at the program
    start/exit.
  * Fix for freshclam's OnOutdatedExecute config option.
  * Fixes a memory leak in the error condition handling for the email
    parser.
  * Improved bound checking and error handling in ARJ archive parser.
  * Improved error handling in PDF parser.
  * Fix for memory leak in byte-compare signature handler.</changelog>
  <changelog author="mpluskal@suse.com" date="1585742400">- Drop python build dependency as it is not needed</changelog>
  <changelog author="suse+build@de-korte.org" date="1589284800">- Update to 0.102.3
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper bounds checking of an unsigned variable results
    in an out-of-bounds read which causes a crash.
  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in
    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper size checking of a buffer used to initialize AES
    decryption routines results in an out-of-bounds read which may cause
    a crash.
  * Fix "Attempt to allocate 0 bytes" error when parsing some PDF
    documents.
  * Fix a couple of minor memory leaks.
  * Updated libclamunrar to UnRAR 5.9.2.</changelog>
  <changelog author="suse+build@de-korte.org" date="1594900800">- Update to 0.102.4
  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could
    replace a scan target's directory with a symlink to another path
    to trick clamscan, clamdscan, or clamonacc into removing or moving
    a different file (eg. a critical system file). The issue would
    affect users that use the --move or --remove options for clamscan,
    clamdscan, and clamonacc.
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.3 that could cause a Denial-of-Service
    (DoS) condition. Improper bounds checking results in an
    out-of-bounds read which could cause a crash. The previous fix for
    this CVE in 0.102.3 was incomplete. This fix correctly resolves
    the issue.
  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in
    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)
    condition. Improper error handling may result in a crash due to a
    NULL pointer dereference. This vulnerability is mitigated for
    those using the official ClamAV signature databases because the
    file type signatures in daily.cvd will not enable the EGG archive
    parser in versions affected by the vulnerability.</changelog>
  <changelog author="suse+build@de-korte.org" date="1600084800">- Update to 0.103.0
  * clamd can now reload the signature database without blocking
    scanning. This multi-threaded database reload improvement was made
    possible thanks to a community effort.
  - Non-blocking database reloads are now the default behavior. Some
    systems that are more constrained on RAM may need to disable
    non-blocking reloads as it will temporarily consume two times as
    much memory. We added a new clamd config option
    ConcurrentDatabaseReload, which may be set to no.
  * Dropped clamav-str-h.patch (no longer needed)
  * Fix clamav-milter.service (requires clamd.service to run)</changelog>
  <changelog author="max@suse.com" date="1605009600">- Sync Factory to SLE-15 to implement jsc#ECO-3010 and bsc#1118459.
- bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
- Keep OBS from installing an existing clamav instance to scan the
  sources, because this makes "make check" use the old library
  instead of the just built one. This is only a workaround until
  we found a way to keep libtool from adding libdir to rpath and
  LD_LIBRARY_PATH of the binaries in the testsuite.</changelog>
  <changelog author="dimstar@opensuse.org" date="1605182400">- Do not hard-depend on systemd: use systemd_ordering instead of
  systemd_requires.</changelog>
  <changelog author="max@suse.com" date="1617969600">- Update clamav.keyring
- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
  * obsoletes clamav-disable-timestamps.patch
- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="suse+build@de-korte.org" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="max@suse.com" date="1636372800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.
- Fix unit test
  + clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1642420800">- Update to 0.103.5
  * bsc#1194731, CVE-2022-20698:
    Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
  <changelog author="max@suse.com" date="1651838400">- Update to 0.103.6
  * CVE-2022-20770: Fixed a possible infinite loop vulnerability in the CHM
    file parser. Issue affects versions 0.104.0 through 0.104.2 and LTS
    version 0.103.5 and prior versions. (boo#1199242)
  * CVE-2022-20796: Fixed a possible NULL-pointer dereference crash in the
    scan verdict cache check. Issue affects versions 0.103.4, 0.103.5,
    0.104.1, and 0.104.2. (boo#1199246)
  * CVE-2022-20771: Fixed a possible infinite loop vulnerability in the
    TIFF file parser. Issue affects versions 0.104.0 through 0.104.2 and
    LTS version 0.103.5 and prior versions. The issue only occurs if the
    "--alert-broken-media" ClamScan option is enabled. For ClamD, the
    affected option is "AlertBrokenMedia yes", and for libclamav it is the
    "CL_SCAN_HEURISTIC_BROKEN_MEDIA" scan option. (boo#1199244)
  * CVE-2022-20785: Fixed a possible memory leak in the HTML file parser /
    Javascript normalizer. Issue affects versions 0.104.0 through 0.104.2
    and LTS version 0.103.5 and prior versions. (boo#1199245)
  * CVE-2022-20792: Fixed a possible multi-byte heap buffer overflow write
    vulnerability in the signature database load module. The fix was to
    update the vendored regex library to the latest version. Issue affects
    versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior
    versions. (boo#1199274)
  * ClamOnAcc: Fixed a number of assorted stability issues and added
    niceties for debugging ClamOnAcc.
  * Fixed an issue causing byte-compare subsignatures to cause an alert
    when they match even if other conditions of the given logical
    signatures were not met.
  * Fix memleak when using multiple byte-compare subsignatures. This fix
    was backported from 0.104.0.
  * Assorted bug fixes and improvements.
- Remove upstreamed clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1661947200">- bsc#1202986: Update to 0.103.7:
  * Upgrade the vendored UnRAR library to version 6.1.7.
  * Fix logical signature "Intermediates" feature.
  * Relax constraints on slightly malformed zip archives that
    contain overlapping file entries.</changelog>
  <changelog author="max@suse.com" date="1676548800">- Update to 0.103.8
  * CVE-2023-20032: Fixed a possible remote code execution vulnerability
    in the HFS+ file parser. Issue affects versions 1.0.0 and earlier,
    0.105.1 and earlier, and 0.103.7 and earlier. (bsc#1208363)
  * CVE-2023-20052: Fixed a possible remote information leak
    vulnerability in the DMG file parser. Issue affects versions 1.0.0
    and earlier, 0.105.1 and earlier, and 0.103.7 and earlier.
    (bsc#1208365)
  * Update vendored libmspack library to version 0.11alpha.</changelog>
  <changelog author="max@suse.com" date="1692273600">- Update to 0.103.9
  * CVE-2023-20197, bsc#1214342: Fixed a possible denial of service
    vulnerability in the HFS+ file parser.
  * Fixed compiler warnings that may turn into errors in Clang 16.
- Renew clamav.keyring .</changelog>
  <changelog author="max@suse.com" date="1698321600">- Update to 0.103.11
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.12.
  * Windows: libjson-c 0.17 compatibility fix. with ssize_t type definition.
  * Windows: Update build system to use OpenSSL 3 and PThreads-Win32 v3.
- Update to 0.103.10
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.10.
    (bsc#1216625, CVE-2023-40477)</changelog>
  <changelog author="max@suse.com" date="1725883200">- Update to 0.103.12
  * [CVE-2024-20506, bsc#1230162]: Changed the logging module to
    disable following symlinks on Linux and Unix systems so as to
    prevent an attacker with existing access to the 'clamd' or
    'freshclam' services from using a symlink to corrupt system
    files.
  * [CVE-2024-20505, bsc#1230161]: Fixed a possible out-of-bounds
    read bug in the PDF file parser that could cause a
    denial-of-service (DoS) condition.
  * ClamOnAcc: Fixed an infinite loop when a watched directory
    does not exist.
  * Fixed a bug causing CVDs downloaded by the `DatabaseCustomURL`
    Freshclam config option to be pruned and then re-downloaded
    with every update.
  * Fixed an unaligned pointer dereference issue on select
    architectures.</changelog>
</package>
<package pkgid="dcf3e07f3c2028a1eb2a80efce2a9416338d0d97e2ee83a0d244bd05e9d914bc" name="clamav-devel" arch="ppc64le">
  <version epoch="0" ver="0.103.12" rel="150600.18.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577188800">- The freshclam.service should not be started before the network is
  online (it checks for updates immediately upon service start)</changelog>
  <changelog author="suse+build@de-korte.org" date="1580904000">- update to 0.102.2
  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when
    using the optional credit card data-loss-prevention (DLP) feature.
    Improper bounds checking of an unsigned variable resulted in an
    out-of-bounds read, which causes a crash.
  * Significantly improved the scan speed of PDF files on Windows.
  * Re-applied a fix to alleviate file access issues when scanning RAR
    files in downstream projects that use libclamav where the scanning
    engine is operating in a low-privilege process. This bug was originally
    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
  * Fixed an issue where freshclam failed to update if the database version
    downloaded is one version older than advertised. This situation may
    occur after a new database version is published. The issue affected
    users downloading the whole CVD database file.
  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
    The ReceiveTimeout had caused needless database update failures for
    users with slower internet connections.
  * Correctly display the number of kilobytes (KiB) in progress bar and
    reduced the size of the progress bar to accommodate 80-character width
    terminals.
  * Fixed an issue where running freshclam manually causes a daemonized
    freshclam process to fail when it updates because the manual instance
    deletes the temporary download directory. The freshclam temporary files
    will now download to a unique directory created at the time of an update
    instead of using a hardcoded directory created/destroyed at the program
    start/exit.
  * Fix for freshclam's OnOutdatedExecute config option.
  * Fixes a memory leak in the error condition handling for the email
    parser.
  * Improved bound checking and error handling in ARJ archive parser.
  * Improved error handling in PDF parser.
  * Fix for memory leak in byte-compare signature handler.</changelog>
  <changelog author="mpluskal@suse.com" date="1585742400">- Drop python build dependency as it is not needed</changelog>
  <changelog author="suse+build@de-korte.org" date="1589284800">- Update to 0.102.3
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper bounds checking of an unsigned variable results
    in an out-of-bounds read which causes a crash.
  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in
    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper size checking of a buffer used to initialize AES
    decryption routines results in an out-of-bounds read which may cause
    a crash.
  * Fix "Attempt to allocate 0 bytes" error when parsing some PDF
    documents.
  * Fix a couple of minor memory leaks.
  * Updated libclamunrar to UnRAR 5.9.2.</changelog>
  <changelog author="suse+build@de-korte.org" date="1594900800">- Update to 0.102.4
  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could
    replace a scan target's directory with a symlink to another path
    to trick clamscan, clamdscan, or clamonacc into removing or moving
    a different file (eg. a critical system file). The issue would
    affect users that use the --move or --remove options for clamscan,
    clamdscan, and clamonacc.
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.3 that could cause a Denial-of-Service
    (DoS) condition. Improper bounds checking results in an
    out-of-bounds read which could cause a crash. The previous fix for
    this CVE in 0.102.3 was incomplete. This fix correctly resolves
    the issue.
  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in
    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)
    condition. Improper error handling may result in a crash due to a
    NULL pointer dereference. This vulnerability is mitigated for
    those using the official ClamAV signature databases because the
    file type signatures in daily.cvd will not enable the EGG archive
    parser in versions affected by the vulnerability.</changelog>
  <changelog author="suse+build@de-korte.org" date="1600084800">- Update to 0.103.0
  * clamd can now reload the signature database without blocking
    scanning. This multi-threaded database reload improvement was made
    possible thanks to a community effort.
  - Non-blocking database reloads are now the default behavior. Some
    systems that are more constrained on RAM may need to disable
    non-blocking reloads as it will temporarily consume two times as
    much memory. We added a new clamd config option
    ConcurrentDatabaseReload, which may be set to no.
  * Dropped clamav-str-h.patch (no longer needed)
  * Fix clamav-milter.service (requires clamd.service to run)</changelog>
  <changelog author="max@suse.com" date="1605009600">- Sync Factory to SLE-15 to implement jsc#ECO-3010 and bsc#1118459.
- bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
- Keep OBS from installing an existing clamav instance to scan the
  sources, because this makes "make check" use the old library
  instead of the just built one. This is only a workaround until
  we found a way to keep libtool from adding libdir to rpath and
  LD_LIBRARY_PATH of the binaries in the testsuite.</changelog>
  <changelog author="dimstar@opensuse.org" date="1605182400">- Do not hard-depend on systemd: use systemd_ordering instead of
  systemd_requires.</changelog>
  <changelog author="max@suse.com" date="1617969600">- Update clamav.keyring
- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
  * obsoletes clamav-disable-timestamps.patch
- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="suse+build@de-korte.org" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="max@suse.com" date="1636372800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.
- Fix unit test
  + clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1642420800">- Update to 0.103.5
  * bsc#1194731, CVE-2022-20698:
    Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
  <changelog author="max@suse.com" date="1651838400">- Update to 0.103.6
  * CVE-2022-20770: Fixed a possible infinite loop vulnerability in the CHM
    file parser. Issue affects versions 0.104.0 through 0.104.2 and LTS
    version 0.103.5 and prior versions. (boo#1199242)
  * CVE-2022-20796: Fixed a possible NULL-pointer dereference crash in the
    scan verdict cache check. Issue affects versions 0.103.4, 0.103.5,
    0.104.1, and 0.104.2. (boo#1199246)
  * CVE-2022-20771: Fixed a possible infinite loop vulnerability in the
    TIFF file parser. Issue affects versions 0.104.0 through 0.104.2 and
    LTS version 0.103.5 and prior versions. The issue only occurs if the
    "--alert-broken-media" ClamScan option is enabled. For ClamD, the
    affected option is "AlertBrokenMedia yes", and for libclamav it is the
    "CL_SCAN_HEURISTIC_BROKEN_MEDIA" scan option. (boo#1199244)
  * CVE-2022-20785: Fixed a possible memory leak in the HTML file parser /
    Javascript normalizer. Issue affects versions 0.104.0 through 0.104.2
    and LTS version 0.103.5 and prior versions. (boo#1199245)
  * CVE-2022-20792: Fixed a possible multi-byte heap buffer overflow write
    vulnerability in the signature database load module. The fix was to
    update the vendored regex library to the latest version. Issue affects
    versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior
    versions. (boo#1199274)
  * ClamOnAcc: Fixed a number of assorted stability issues and added
    niceties for debugging ClamOnAcc.
  * Fixed an issue causing byte-compare subsignatures to cause an alert
    when they match even if other conditions of the given logical
    signatures were not met.
  * Fix memleak when using multiple byte-compare subsignatures. This fix
    was backported from 0.104.0.
  * Assorted bug fixes and improvements.
- Remove upstreamed clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1661947200">- bsc#1202986: Update to 0.103.7:
  * Upgrade the vendored UnRAR library to version 6.1.7.
  * Fix logical signature "Intermediates" feature.
  * Relax constraints on slightly malformed zip archives that
    contain overlapping file entries.</changelog>
  <changelog author="max@suse.com" date="1676548800">- Update to 0.103.8
  * CVE-2023-20032: Fixed a possible remote code execution vulnerability
    in the HFS+ file parser. Issue affects versions 1.0.0 and earlier,
    0.105.1 and earlier, and 0.103.7 and earlier. (bsc#1208363)
  * CVE-2023-20052: Fixed a possible remote information leak
    vulnerability in the DMG file parser. Issue affects versions 1.0.0
    and earlier, 0.105.1 and earlier, and 0.103.7 and earlier.
    (bsc#1208365)
  * Update vendored libmspack library to version 0.11alpha.</changelog>
  <changelog author="max@suse.com" date="1692273600">- Update to 0.103.9
  * CVE-2023-20197, bsc#1214342: Fixed a possible denial of service
    vulnerability in the HFS+ file parser.
  * Fixed compiler warnings that may turn into errors in Clang 16.
- Renew clamav.keyring .</changelog>
  <changelog author="max@suse.com" date="1698321600">- Update to 0.103.11
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.12.
  * Windows: libjson-c 0.17 compatibility fix. with ssize_t type definition.
  * Windows: Update build system to use OpenSSL 3 and PThreads-Win32 v3.
- Update to 0.103.10
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.10.
    (bsc#1216625, CVE-2023-40477)</changelog>
  <changelog author="max@suse.com" date="1725883200">- Update to 0.103.12
  * [CVE-2024-20506, bsc#1230162]: Changed the logging module to
    disable following symlinks on Linux and Unix systems so as to
    prevent an attacker with existing access to the 'clamd' or
    'freshclam' services from using a symlink to corrupt system
    files.
  * [CVE-2024-20505, bsc#1230161]: Fixed a possible out-of-bounds
    read bug in the PDF file parser that could cause a
    denial-of-service (DoS) condition.
  * ClamOnAcc: Fixed an infinite loop when a watched directory
    does not exist.
  * Fixed a bug causing CVDs downloaded by the `DatabaseCustomURL`
    Freshclam config option to be pruned and then re-downloaded
    with every update.
  * Fixed an unaligned pointer dereference issue on select
    architectures.</changelog>
</package>
<package pkgid="51a963a7089990b12c90406e18fc78bb0b5edf9a3e8e20833cff211e6fce09d2" name="clamav-devel" arch="s390x">
  <version epoch="0" ver="0.103.12" rel="150600.18.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577188800">- The freshclam.service should not be started before the network is
  online (it checks for updates immediately upon service start)</changelog>
  <changelog author="suse+build@de-korte.org" date="1580904000">- update to 0.102.2
  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when
    using the optional credit card data-loss-prevention (DLP) feature.
    Improper bounds checking of an unsigned variable resulted in an
    out-of-bounds read, which causes a crash.
  * Significantly improved the scan speed of PDF files on Windows.
  * Re-applied a fix to alleviate file access issues when scanning RAR
    files in downstream projects that use libclamav where the scanning
    engine is operating in a low-privilege process. This bug was originally
    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
  * Fixed an issue where freshclam failed to update if the database version
    downloaded is one version older than advertised. This situation may
    occur after a new database version is published. The issue affected
    users downloading the whole CVD database file.
  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
    The ReceiveTimeout had caused needless database update failures for
    users with slower internet connections.
  * Correctly display the number of kilobytes (KiB) in progress bar and
    reduced the size of the progress bar to accommodate 80-character width
    terminals.
  * Fixed an issue where running freshclam manually causes a daemonized
    freshclam process to fail when it updates because the manual instance
    deletes the temporary download directory. The freshclam temporary files
    will now download to a unique directory created at the time of an update
    instead of using a hardcoded directory created/destroyed at the program
    start/exit.
  * Fix for freshclam's OnOutdatedExecute config option.
  * Fixes a memory leak in the error condition handling for the email
    parser.
  * Improved bound checking and error handling in ARJ archive parser.
  * Improved error handling in PDF parser.
  * Fix for memory leak in byte-compare signature handler.</changelog>
  <changelog author="mpluskal@suse.com" date="1585742400">- Drop python build dependency as it is not needed</changelog>
  <changelog author="suse+build@de-korte.org" date="1589284800">- Update to 0.102.3
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper bounds checking of an unsigned variable results
    in an out-of-bounds read which causes a crash.
  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in
    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper size checking of a buffer used to initialize AES
    decryption routines results in an out-of-bounds read which may cause
    a crash.
  * Fix "Attempt to allocate 0 bytes" error when parsing some PDF
    documents.
  * Fix a couple of minor memory leaks.
  * Updated libclamunrar to UnRAR 5.9.2.</changelog>
  <changelog author="suse+build@de-korte.org" date="1594900800">- Update to 0.102.4
  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could
    replace a scan target's directory with a symlink to another path
    to trick clamscan, clamdscan, or clamonacc into removing or moving
    a different file (eg. a critical system file). The issue would
    affect users that use the --move or --remove options for clamscan,
    clamdscan, and clamonacc.
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.3 that could cause a Denial-of-Service
    (DoS) condition. Improper bounds checking results in an
    out-of-bounds read which could cause a crash. The previous fix for
    this CVE in 0.102.3 was incomplete. This fix correctly resolves
    the issue.
  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in
    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)
    condition. Improper error handling may result in a crash due to a
    NULL pointer dereference. This vulnerability is mitigated for
    those using the official ClamAV signature databases because the
    file type signatures in daily.cvd will not enable the EGG archive
    parser in versions affected by the vulnerability.</changelog>
  <changelog author="suse+build@de-korte.org" date="1600084800">- Update to 0.103.0
  * clamd can now reload the signature database without blocking
    scanning. This multi-threaded database reload improvement was made
    possible thanks to a community effort.
  - Non-blocking database reloads are now the default behavior. Some
    systems that are more constrained on RAM may need to disable
    non-blocking reloads as it will temporarily consume two times as
    much memory. We added a new clamd config option
    ConcurrentDatabaseReload, which may be set to no.
  * Dropped clamav-str-h.patch (no longer needed)
  * Fix clamav-milter.service (requires clamd.service to run)</changelog>
  <changelog author="max@suse.com" date="1605009600">- Sync Factory to SLE-15 to implement jsc#ECO-3010 and bsc#1118459.
- bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
- Keep OBS from installing an existing clamav instance to scan the
  sources, because this makes "make check" use the old library
  instead of the just built one. This is only a workaround until
  we found a way to keep libtool from adding libdir to rpath and
  LD_LIBRARY_PATH of the binaries in the testsuite.</changelog>
  <changelog author="dimstar@opensuse.org" date="1605182400">- Do not hard-depend on systemd: use systemd_ordering instead of
  systemd_requires.</changelog>
  <changelog author="max@suse.com" date="1617969600">- Update clamav.keyring
- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
  * obsoletes clamav-disable-timestamps.patch
- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="suse+build@de-korte.org" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="max@suse.com" date="1636372800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.
- Fix unit test
  + clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1642420800">- Update to 0.103.5
  * bsc#1194731, CVE-2022-20698:
    Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
  <changelog author="max@suse.com" date="1651838400">- Update to 0.103.6
  * CVE-2022-20770: Fixed a possible infinite loop vulnerability in the CHM
    file parser. Issue affects versions 0.104.0 through 0.104.2 and LTS
    version 0.103.5 and prior versions. (boo#1199242)
  * CVE-2022-20796: Fixed a possible NULL-pointer dereference crash in the
    scan verdict cache check. Issue affects versions 0.103.4, 0.103.5,
    0.104.1, and 0.104.2. (boo#1199246)
  * CVE-2022-20771: Fixed a possible infinite loop vulnerability in the
    TIFF file parser. Issue affects versions 0.104.0 through 0.104.2 and
    LTS version 0.103.5 and prior versions. The issue only occurs if the
    "--alert-broken-media" ClamScan option is enabled. For ClamD, the
    affected option is "AlertBrokenMedia yes", and for libclamav it is the
    "CL_SCAN_HEURISTIC_BROKEN_MEDIA" scan option. (boo#1199244)
  * CVE-2022-20785: Fixed a possible memory leak in the HTML file parser /
    Javascript normalizer. Issue affects versions 0.104.0 through 0.104.2
    and LTS version 0.103.5 and prior versions. (boo#1199245)
  * CVE-2022-20792: Fixed a possible multi-byte heap buffer overflow write
    vulnerability in the signature database load module. The fix was to
    update the vendored regex library to the latest version. Issue affects
    versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior
    versions. (boo#1199274)
  * ClamOnAcc: Fixed a number of assorted stability issues and added
    niceties for debugging ClamOnAcc.
  * Fixed an issue causing byte-compare subsignatures to cause an alert
    when they match even if other conditions of the given logical
    signatures were not met.
  * Fix memleak when using multiple byte-compare subsignatures. This fix
    was backported from 0.104.0.
  * Assorted bug fixes and improvements.
- Remove upstreamed clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1661947200">- bsc#1202986: Update to 0.103.7:
  * Upgrade the vendored UnRAR library to version 6.1.7.
  * Fix logical signature "Intermediates" feature.
  * Relax constraints on slightly malformed zip archives that
    contain overlapping file entries.</changelog>
  <changelog author="max@suse.com" date="1676548800">- Update to 0.103.8
  * CVE-2023-20032: Fixed a possible remote code execution vulnerability
    in the HFS+ file parser. Issue affects versions 1.0.0 and earlier,
    0.105.1 and earlier, and 0.103.7 and earlier. (bsc#1208363)
  * CVE-2023-20052: Fixed a possible remote information leak
    vulnerability in the DMG file parser. Issue affects versions 1.0.0
    and earlier, 0.105.1 and earlier, and 0.103.7 and earlier.
    (bsc#1208365)
  * Update vendored libmspack library to version 0.11alpha.</changelog>
  <changelog author="max@suse.com" date="1692273600">- Update to 0.103.9
  * CVE-2023-20197, bsc#1214342: Fixed a possible denial of service
    vulnerability in the HFS+ file parser.
  * Fixed compiler warnings that may turn into errors in Clang 16.
- Renew clamav.keyring .</changelog>
  <changelog author="max@suse.com" date="1698321600">- Update to 0.103.11
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.12.
  * Windows: libjson-c 0.17 compatibility fix. with ssize_t type definition.
  * Windows: Update build system to use OpenSSL 3 and PThreads-Win32 v3.
- Update to 0.103.10
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.10.
    (bsc#1216625, CVE-2023-40477)</changelog>
  <changelog author="max@suse.com" date="1725883200">- Update to 0.103.12
  * [CVE-2024-20506, bsc#1230162]: Changed the logging module to
    disable following symlinks on Linux and Unix systems so as to
    prevent an attacker with existing access to the 'clamd' or
    'freshclam' services from using a symlink to corrupt system
    files.
  * [CVE-2024-20505, bsc#1230161]: Fixed a possible out-of-bounds
    read bug in the PDF file parser that could cause a
    denial-of-service (DoS) condition.
  * ClamOnAcc: Fixed an infinite loop when a watched directory
    does not exist.
  * Fixed a bug causing CVDs downloaded by the `DatabaseCustomURL`
    Freshclam config option to be pruned and then re-downloaded
    with every update.
  * Fixed an unaligned pointer dereference issue on select
    architectures.</changelog>
</package>
<package pkgid="ef1ee526a892355a6870b7c69ef0ecc47460ad898e4f5123b08d411657c9b2fb" name="clamav-devel" arch="x86_64">
  <version epoch="0" ver="0.103.12" rel="150600.18.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577188800">- The freshclam.service should not be started before the network is
  online (it checks for updates immediately upon service start)</changelog>
  <changelog author="suse+build@de-korte.org" date="1580904000">- update to 0.102.2
  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when
    using the optional credit card data-loss-prevention (DLP) feature.
    Improper bounds checking of an unsigned variable resulted in an
    out-of-bounds read, which causes a crash.
  * Significantly improved the scan speed of PDF files on Windows.
  * Re-applied a fix to alleviate file access issues when scanning RAR
    files in downstream projects that use libclamav where the scanning
    engine is operating in a low-privilege process. This bug was originally
    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
  * Fixed an issue where freshclam failed to update if the database version
    downloaded is one version older than advertised. This situation may
    occur after a new database version is published. The issue affected
    users downloading the whole CVD database file.
  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
    The ReceiveTimeout had caused needless database update failures for
    users with slower internet connections.
  * Correctly display the number of kilobytes (KiB) in progress bar and
    reduced the size of the progress bar to accommodate 80-character width
    terminals.
  * Fixed an issue where running freshclam manually causes a daemonized
    freshclam process to fail when it updates because the manual instance
    deletes the temporary download directory. The freshclam temporary files
    will now download to a unique directory created at the time of an update
    instead of using a hardcoded directory created/destroyed at the program
    start/exit.
  * Fix for freshclam's OnOutdatedExecute config option.
  * Fixes a memory leak in the error condition handling for the email
    parser.
  * Improved bound checking and error handling in ARJ archive parser.
  * Improved error handling in PDF parser.
  * Fix for memory leak in byte-compare signature handler.</changelog>
  <changelog author="mpluskal@suse.com" date="1585742400">- Drop python build dependency as it is not needed</changelog>
  <changelog author="suse+build@de-korte.org" date="1589284800">- Update to 0.102.3
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper bounds checking of an unsigned variable results
    in an out-of-bounds read which causes a crash.
  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in
    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper size checking of a buffer used to initialize AES
    decryption routines results in an out-of-bounds read which may cause
    a crash.
  * Fix "Attempt to allocate 0 bytes" error when parsing some PDF
    documents.
  * Fix a couple of minor memory leaks.
  * Updated libclamunrar to UnRAR 5.9.2.</changelog>
  <changelog author="suse+build@de-korte.org" date="1594900800">- Update to 0.102.4
  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could
    replace a scan target's directory with a symlink to another path
    to trick clamscan, clamdscan, or clamonacc into removing or moving
    a different file (eg. a critical system file). The issue would
    affect users that use the --move or --remove options for clamscan,
    clamdscan, and clamonacc.
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.3 that could cause a Denial-of-Service
    (DoS) condition. Improper bounds checking results in an
    out-of-bounds read which could cause a crash. The previous fix for
    this CVE in 0.102.3 was incomplete. This fix correctly resolves
    the issue.
  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in
    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)
    condition. Improper error handling may result in a crash due to a
    NULL pointer dereference. This vulnerability is mitigated for
    those using the official ClamAV signature databases because the
    file type signatures in daily.cvd will not enable the EGG archive
    parser in versions affected by the vulnerability.</changelog>
  <changelog author="suse+build@de-korte.org" date="1600084800">- Update to 0.103.0
  * clamd can now reload the signature database without blocking
    scanning. This multi-threaded database reload improvement was made
    possible thanks to a community effort.
  - Non-blocking database reloads are now the default behavior. Some
    systems that are more constrained on RAM may need to disable
    non-blocking reloads as it will temporarily consume two times as
    much memory. We added a new clamd config option
    ConcurrentDatabaseReload, which may be set to no.
  * Dropped clamav-str-h.patch (no longer needed)
  * Fix clamav-milter.service (requires clamd.service to run)</changelog>
  <changelog author="max@suse.com" date="1605009600">- Sync Factory to SLE-15 to implement jsc#ECO-3010 and bsc#1118459.
- bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
- Keep OBS from installing an existing clamav instance to scan the
  sources, because this makes "make check" use the old library
  instead of the just built one. This is only a workaround until
  we found a way to keep libtool from adding libdir to rpath and
  LD_LIBRARY_PATH of the binaries in the testsuite.</changelog>
  <changelog author="dimstar@opensuse.org" date="1605182400">- Do not hard-depend on systemd: use systemd_ordering instead of
  systemd_requires.</changelog>
  <changelog author="max@suse.com" date="1617969600">- Update clamav.keyring
- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
  * obsoletes clamav-disable-timestamps.patch
- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="suse+build@de-korte.org" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="max@suse.com" date="1636372800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.
- Fix unit test
  + clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1642420800">- Update to 0.103.5
  * bsc#1194731, CVE-2022-20698:
    Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
  <changelog author="max@suse.com" date="1651838400">- Update to 0.103.6
  * CVE-2022-20770: Fixed a possible infinite loop vulnerability in the CHM
    file parser. Issue affects versions 0.104.0 through 0.104.2 and LTS
    version 0.103.5 and prior versions. (boo#1199242)
  * CVE-2022-20796: Fixed a possible NULL-pointer dereference crash in the
    scan verdict cache check. Issue affects versions 0.103.4, 0.103.5,
    0.104.1, and 0.104.2. (boo#1199246)
  * CVE-2022-20771: Fixed a possible infinite loop vulnerability in the
    TIFF file parser. Issue affects versions 0.104.0 through 0.104.2 and
    LTS version 0.103.5 and prior versions. The issue only occurs if the
    "--alert-broken-media" ClamScan option is enabled. For ClamD, the
    affected option is "AlertBrokenMedia yes", and for libclamav it is the
    "CL_SCAN_HEURISTIC_BROKEN_MEDIA" scan option. (boo#1199244)
  * CVE-2022-20785: Fixed a possible memory leak in the HTML file parser /
    Javascript normalizer. Issue affects versions 0.104.0 through 0.104.2
    and LTS version 0.103.5 and prior versions. (boo#1199245)
  * CVE-2022-20792: Fixed a possible multi-byte heap buffer overflow write
    vulnerability in the signature database load module. The fix was to
    update the vendored regex library to the latest version. Issue affects
    versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior
    versions. (boo#1199274)
  * ClamOnAcc: Fixed a number of assorted stability issues and added
    niceties for debugging ClamOnAcc.
  * Fixed an issue causing byte-compare subsignatures to cause an alert
    when they match even if other conditions of the given logical
    signatures were not met.
  * Fix memleak when using multiple byte-compare subsignatures. This fix
    was backported from 0.104.0.
  * Assorted bug fixes and improvements.
- Remove upstreamed clamav-ck_assert_msg.patch</changelog>
  <changelog author="max@suse.com" date="1661947200">- bsc#1202986: Update to 0.103.7:
  * Upgrade the vendored UnRAR library to version 6.1.7.
  * Fix logical signature "Intermediates" feature.
  * Relax constraints on slightly malformed zip archives that
    contain overlapping file entries.</changelog>
  <changelog author="max@suse.com" date="1676548800">- Update to 0.103.8
  * CVE-2023-20032: Fixed a possible remote code execution vulnerability
    in the HFS+ file parser. Issue affects versions 1.0.0 and earlier,
    0.105.1 and earlier, and 0.103.7 and earlier. (bsc#1208363)
  * CVE-2023-20052: Fixed a possible remote information leak
    vulnerability in the DMG file parser. Issue affects versions 1.0.0
    and earlier, 0.105.1 and earlier, and 0.103.7 and earlier.
    (bsc#1208365)
  * Update vendored libmspack library to version 0.11alpha.</changelog>
  <changelog author="max@suse.com" date="1692273600">- Update to 0.103.9
  * CVE-2023-20197, bsc#1214342: Fixed a possible denial of service
    vulnerability in the HFS+ file parser.
  * Fixed compiler warnings that may turn into errors in Clang 16.
- Renew clamav.keyring .</changelog>
  <changelog author="max@suse.com" date="1698321600">- Update to 0.103.11
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.12.
  * Windows: libjson-c 0.17 compatibility fix. with ssize_t type definition.
  * Windows: Update build system to use OpenSSL 3 and PThreads-Win32 v3.
- Update to 0.103.10
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.10.
    (bsc#1216625, CVE-2023-40477)</changelog>
  <changelog author="max@suse.com" date="1725883200">- Update to 0.103.12
  * [CVE-2024-20506, bsc#1230162]: Changed the logging module to
    disable following symlinks on Linux and Unix systems so as to
    prevent an attacker with existing access to the 'clamd' or
    'freshclam' services from using a symlink to corrupt system
    files.
  * [CVE-2024-20505, bsc#1230161]: Fixed a possible out-of-bounds
    read bug in the PDF file parser that could cause a
    denial-of-service (DoS) condition.
  * ClamOnAcc: Fixed an infinite loop when a watched directory
    does not exist.
  * Fixed a bug causing CVDs downloaded by the `DatabaseCustomURL`
    Freshclam config option to be pruned and then re-downloaded
    with every update.
  * Fixed an unaligned pointer dereference issue on select
    architectures.</changelog>
</package>
<package pkgid="7ea27aaf269cc65dc1ce70152d2f4f5eb22ef0a11007430f03bbfddb6bb2c2a0" name="clang-tools" arch="aarch64">
  <version epoch="0" ver="17.0.6" rel="150600.3.2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1678536000">- Add llvm-suse-implicit-gnu.patch to recognize &lt;arch&gt;-suse-linux
  as implicitly GNU. Without this we would get library calls for
  fused-multiply-add even if it's available in hardware.
- Add openmp-drop-rpath.patch: backport revert of adding RUNPATH
  to openmp executables. (boo#1206837)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1679140800">- Update to version 16.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/16.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfo-analyzer: Print a logical representation of
    low-level debug information.
  - llvm-remarkutil: Remark file utilities.
  * The test tool split-file is no longer installed.
  * New Clang tools:
  - amdgpu-arch and nvptx-arch: Tools used to detect locally
    available GPUs by the Clang OpenMP driver.
  - clang-include-cleaner: Standalone tool to determine which
    headers are used, using existing functionality in clangd.
  - clang-tblgen: Table Generation for Clang.
  * Removed Clang tools: clang-{nvlink,offload}-wrapper.
- Rebase patches:
  * assume-opensuse.patch
  * check-no-llvm-exegesis.patch
  * link-clang-shared.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-suse-implicit-gnu.patch
  * llvm-workaround-superfluous-branches.patch
  * openmp-drop-rpath.patch
- Drop patches that have landed upstream:
  * clang-test-xfail-gnuless-triple.patch
  * CMake-Look-up-target-subcomponents-in-LLVM_AVAILABLE_LIBS.patch
  * libcxxabi-fix-armv7-test.patch
  * llvm-armv7-fix-vector-compare-with-zero-lowering.patch
  * llvm-link-atomic.patch
- Remove llvm-better-detect-64bit-atomics-support.patch that should
  not be required anymore.
- Add PGP signatures and keyring for source verification.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1680782400">- Update to version 16.0.1.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="william.brown@suse.com" date="1681387200">- bsc#1210383 - Add aarch64 to lldb platforms</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1681819200">- Relax requirements for clang-tools to allow installation of older
  versions of libclang13 with the -devel package. (boo#1210176)
- Enable ThinLTO for ARM 6/7/8 again. (boo#1178070)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1682078400">- Update to version 16.0.2.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase check-no-llvm-exegesis.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1683460800">- Update to version 16.0.3.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1684324800">- Update to version 16.0.4.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1685793600">- Update to version 16.0.5.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch
- Enable ThinLTO on riscv64.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1686830400">- Update to version 16.0.6.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Make python3-clang noarch again and fix conflicts/provides to
  point to %python3_sitelib instead of %python3_sitearch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695124800">- Update to version 17.0.1.
  * For details, see the release notes:
  - https://releases.llvm.org/17.0.1/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/lld/docs/ReleaseNotes.html
- Rebase patches:
  * libcxx-test-library-path.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
  * llvm-remove-clang-only-flags.patch
  * opt-viewer-Find-style-css-in-usr-share.patch
- Simplify check-no-llvm-exegesis.patch by removing test directory.
- Drop patches that have landed upstream:
  * openmp-drop-rpath.patch
- Add openmp-dont-run-gpu-arch.patch: the binaries are not
  available in our build, and neither are the toolchains they test
  for (NV CUDA and AMD HSA).</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1696680000">- Update to version 17.0.2.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1697716800">- Update to version 17.0.3.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Disable zstd support for now regardless of whether libzstd-devel
  is installed. (boo#1216121)
- Limit number of LTO threads on 32-bit architectures to prevent
  out-of-memory during linking.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1699185600">- Update to version 17.0.4.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Include libomptarget.devicertl.a in libomp*-devel, which is
  required for (GPU) offloading.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1700308800">- Update to version 17.0.5.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Also test clang-tools-extra (at least most parts) and lld.
- Adapt test in lld-default-sha1.patch.
- Don't disable testing if qemu_user_space_build has been set to 0.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Update to version 17.0.6.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
- Use major version only instead of full (patch-level) version for
  versioned executables: we don't support parallel installation of
  multiple versions of the same LLVM major version. (boo#1217450)
  Also drop the clang-X.Y symlink that was introduced for
  boo#1012260, because Y is always 0.
- Manage clang-cpp with update-alternatives like other binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1703160000">- Revert conflicts/provides for python3-clang to %python3_sitearch
  to retain compatibility with older llvm versions in SLE.</changelog>
</package>
<package pkgid="e8042b62da69af8176e6b890db9ea6e5ff91ea77f7d51a1d6f06c1fb941c176c" name="clang-tools" arch="ppc64le">
  <version epoch="0" ver="17.0.6" rel="150600.3.2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1678536000">- Add llvm-suse-implicit-gnu.patch to recognize &lt;arch&gt;-suse-linux
  as implicitly GNU. Without this we would get library calls for
  fused-multiply-add even if it's available in hardware.
- Add openmp-drop-rpath.patch: backport revert of adding RUNPATH
  to openmp executables. (boo#1206837)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1679140800">- Update to version 16.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/16.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfo-analyzer: Print a logical representation of
    low-level debug information.
  - llvm-remarkutil: Remark file utilities.
  * The test tool split-file is no longer installed.
  * New Clang tools:
  - amdgpu-arch and nvptx-arch: Tools used to detect locally
    available GPUs by the Clang OpenMP driver.
  - clang-include-cleaner: Standalone tool to determine which
    headers are used, using existing functionality in clangd.
  - clang-tblgen: Table Generation for Clang.
  * Removed Clang tools: clang-{nvlink,offload}-wrapper.
- Rebase patches:
  * assume-opensuse.patch
  * check-no-llvm-exegesis.patch
  * link-clang-shared.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-suse-implicit-gnu.patch
  * llvm-workaround-superfluous-branches.patch
  * openmp-drop-rpath.patch
- Drop patches that have landed upstream:
  * clang-test-xfail-gnuless-triple.patch
  * CMake-Look-up-target-subcomponents-in-LLVM_AVAILABLE_LIBS.patch
  * libcxxabi-fix-armv7-test.patch
  * llvm-armv7-fix-vector-compare-with-zero-lowering.patch
  * llvm-link-atomic.patch
- Remove llvm-better-detect-64bit-atomics-support.patch that should
  not be required anymore.
- Add PGP signatures and keyring for source verification.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1680782400">- Update to version 16.0.1.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="william.brown@suse.com" date="1681387200">- bsc#1210383 - Add aarch64 to lldb platforms</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1681819200">- Relax requirements for clang-tools to allow installation of older
  versions of libclang13 with the -devel package. (boo#1210176)
- Enable ThinLTO for ARM 6/7/8 again. (boo#1178070)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1682078400">- Update to version 16.0.2.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase check-no-llvm-exegesis.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1683460800">- Update to version 16.0.3.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1684324800">- Update to version 16.0.4.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1685793600">- Update to version 16.0.5.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch
- Enable ThinLTO on riscv64.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1686830400">- Update to version 16.0.6.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Make python3-clang noarch again and fix conflicts/provides to
  point to %python3_sitelib instead of %python3_sitearch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695124800">- Update to version 17.0.1.
  * For details, see the release notes:
  - https://releases.llvm.org/17.0.1/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/lld/docs/ReleaseNotes.html
- Rebase patches:
  * libcxx-test-library-path.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
  * llvm-remove-clang-only-flags.patch
  * opt-viewer-Find-style-css-in-usr-share.patch
- Simplify check-no-llvm-exegesis.patch by removing test directory.
- Drop patches that have landed upstream:
  * openmp-drop-rpath.patch
- Add openmp-dont-run-gpu-arch.patch: the binaries are not
  available in our build, and neither are the toolchains they test
  for (NV CUDA and AMD HSA).</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1696680000">- Update to version 17.0.2.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1697716800">- Update to version 17.0.3.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Disable zstd support for now regardless of whether libzstd-devel
  is installed. (boo#1216121)
- Limit number of LTO threads on 32-bit architectures to prevent
  out-of-memory during linking.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1699185600">- Update to version 17.0.4.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Include libomptarget.devicertl.a in libomp*-devel, which is
  required for (GPU) offloading.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1700308800">- Update to version 17.0.5.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Also test clang-tools-extra (at least most parts) and lld.
- Adapt test in lld-default-sha1.patch.
- Don't disable testing if qemu_user_space_build has been set to 0.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Update to version 17.0.6.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
- Use major version only instead of full (patch-level) version for
  versioned executables: we don't support parallel installation of
  multiple versions of the same LLVM major version. (boo#1217450)
  Also drop the clang-X.Y symlink that was introduced for
  boo#1012260, because Y is always 0.
- Manage clang-cpp with update-alternatives like other binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1703160000">- Revert conflicts/provides for python3-clang to %python3_sitearch
  to retain compatibility with older llvm versions in SLE.</changelog>
</package>
<package pkgid="3b6f38cf0a2640c87a02a1ce715d3b572fca39572d3c9971f2835aca1d480090" name="clang-tools" arch="s390x">
  <version epoch="0" ver="17.0.6" rel="150600.3.2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1678536000">- Add llvm-suse-implicit-gnu.patch to recognize &lt;arch&gt;-suse-linux
  as implicitly GNU. Without this we would get library calls for
  fused-multiply-add even if it's available in hardware.
- Add openmp-drop-rpath.patch: backport revert of adding RUNPATH
  to openmp executables. (boo#1206837)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1679140800">- Update to version 16.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/16.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfo-analyzer: Print a logical representation of
    low-level debug information.
  - llvm-remarkutil: Remark file utilities.
  * The test tool split-file is no longer installed.
  * New Clang tools:
  - amdgpu-arch and nvptx-arch: Tools used to detect locally
    available GPUs by the Clang OpenMP driver.
  - clang-include-cleaner: Standalone tool to determine which
    headers are used, using existing functionality in clangd.
  - clang-tblgen: Table Generation for Clang.
  * Removed Clang tools: clang-{nvlink,offload}-wrapper.
- Rebase patches:
  * assume-opensuse.patch
  * check-no-llvm-exegesis.patch
  * link-clang-shared.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-suse-implicit-gnu.patch
  * llvm-workaround-superfluous-branches.patch
  * openmp-drop-rpath.patch
- Drop patches that have landed upstream:
  * clang-test-xfail-gnuless-triple.patch
  * CMake-Look-up-target-subcomponents-in-LLVM_AVAILABLE_LIBS.patch
  * libcxxabi-fix-armv7-test.patch
  * llvm-armv7-fix-vector-compare-with-zero-lowering.patch
  * llvm-link-atomic.patch
- Remove llvm-better-detect-64bit-atomics-support.patch that should
  not be required anymore.
- Add PGP signatures and keyring for source verification.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1680782400">- Update to version 16.0.1.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="william.brown@suse.com" date="1681387200">- bsc#1210383 - Add aarch64 to lldb platforms</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1681819200">- Relax requirements for clang-tools to allow installation of older
  versions of libclang13 with the -devel package. (boo#1210176)
- Enable ThinLTO for ARM 6/7/8 again. (boo#1178070)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1682078400">- Update to version 16.0.2.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase check-no-llvm-exegesis.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1683460800">- Update to version 16.0.3.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1684324800">- Update to version 16.0.4.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1685793600">- Update to version 16.0.5.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch
- Enable ThinLTO on riscv64.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1686830400">- Update to version 16.0.6.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Make python3-clang noarch again and fix conflicts/provides to
  point to %python3_sitelib instead of %python3_sitearch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695124800">- Update to version 17.0.1.
  * For details, see the release notes:
  - https://releases.llvm.org/17.0.1/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/lld/docs/ReleaseNotes.html
- Rebase patches:
  * libcxx-test-library-path.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
  * llvm-remove-clang-only-flags.patch
  * opt-viewer-Find-style-css-in-usr-share.patch
- Simplify check-no-llvm-exegesis.patch by removing test directory.
- Drop patches that have landed upstream:
  * openmp-drop-rpath.patch
- Add openmp-dont-run-gpu-arch.patch: the binaries are not
  available in our build, and neither are the toolchains they test
  for (NV CUDA and AMD HSA).</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1696680000">- Update to version 17.0.2.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1697716800">- Update to version 17.0.3.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Disable zstd support for now regardless of whether libzstd-devel
  is installed. (boo#1216121)
- Limit number of LTO threads on 32-bit architectures to prevent
  out-of-memory during linking.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1699185600">- Update to version 17.0.4.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Include libomptarget.devicertl.a in libomp*-devel, which is
  required for (GPU) offloading.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1700308800">- Update to version 17.0.5.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Also test clang-tools-extra (at least most parts) and lld.
- Adapt test in lld-default-sha1.patch.
- Don't disable testing if qemu_user_space_build has been set to 0.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Update to version 17.0.6.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
- Use major version only instead of full (patch-level) version for
  versioned executables: we don't support parallel installation of
  multiple versions of the same LLVM major version. (boo#1217450)
  Also drop the clang-X.Y symlink that was introduced for
  boo#1012260, because Y is always 0.
- Manage clang-cpp with update-alternatives like other binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1703160000">- Revert conflicts/provides for python3-clang to %python3_sitearch
  to retain compatibility with older llvm versions in SLE.</changelog>
</package>
<package pkgid="414e6a57b889f59f5f2e908fc3ffe17259e7189ba7e8103e9f80d29a4519e4b3" name="clang-tools" arch="x86_64">
  <version epoch="0" ver="17.0.6" rel="150600.3.2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1678536000">- Add llvm-suse-implicit-gnu.patch to recognize &lt;arch&gt;-suse-linux
  as implicitly GNU. Without this we would get library calls for
  fused-multiply-add even if it's available in hardware.
- Add openmp-drop-rpath.patch: backport revert of adding RUNPATH
  to openmp executables. (boo#1206837)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1679140800">- Update to version 16.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/16.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfo-analyzer: Print a logical representation of
    low-level debug information.
  - llvm-remarkutil: Remark file utilities.
  * The test tool split-file is no longer installed.
  * New Clang tools:
  - amdgpu-arch and nvptx-arch: Tools used to detect locally
    available GPUs by the Clang OpenMP driver.
  - clang-include-cleaner: Standalone tool to determine which
    headers are used, using existing functionality in clangd.
  - clang-tblgen: Table Generation for Clang.
  * Removed Clang tools: clang-{nvlink,offload}-wrapper.
- Rebase patches:
  * assume-opensuse.patch
  * check-no-llvm-exegesis.patch
  * link-clang-shared.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-suse-implicit-gnu.patch
  * llvm-workaround-superfluous-branches.patch
  * openmp-drop-rpath.patch
- Drop patches that have landed upstream:
  * clang-test-xfail-gnuless-triple.patch
  * CMake-Look-up-target-subcomponents-in-LLVM_AVAILABLE_LIBS.patch
  * libcxxabi-fix-armv7-test.patch
  * llvm-armv7-fix-vector-compare-with-zero-lowering.patch
  * llvm-link-atomic.patch
- Remove llvm-better-detect-64bit-atomics-support.patch that should
  not be required anymore.
- Add PGP signatures and keyring for source verification.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1680782400">- Update to version 16.0.1.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="william.brown@suse.com" date="1681387200">- bsc#1210383 - Add aarch64 to lldb platforms</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1681819200">- Relax requirements for clang-tools to allow installation of older
  versions of libclang13 with the -devel package. (boo#1210176)
- Enable ThinLTO for ARM 6/7/8 again. (boo#1178070)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1682078400">- Update to version 16.0.2.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase check-no-llvm-exegesis.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1683460800">- Update to version 16.0.3.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1684324800">- Update to version 16.0.4.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1685793600">- Update to version 16.0.5.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch
- Enable ThinLTO on riscv64.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1686830400">- Update to version 16.0.6.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Make python3-clang noarch again and fix conflicts/provides to
  point to %python3_sitelib instead of %python3_sitearch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695124800">- Update to version 17.0.1.
  * For details, see the release notes:
  - https://releases.llvm.org/17.0.1/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/lld/docs/ReleaseNotes.html
- Rebase patches:
  * libcxx-test-library-path.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
  * llvm-remove-clang-only-flags.patch
  * opt-viewer-Find-style-css-in-usr-share.patch
- Simplify check-no-llvm-exegesis.patch by removing test directory.
- Drop patches that have landed upstream:
  * openmp-drop-rpath.patch
- Add openmp-dont-run-gpu-arch.patch: the binaries are not
  available in our build, and neither are the toolchains they test
  for (NV CUDA and AMD HSA).</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1696680000">- Update to version 17.0.2.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1697716800">- Update to version 17.0.3.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Disable zstd support for now regardless of whether libzstd-devel
  is installed. (boo#1216121)
- Limit number of LTO threads on 32-bit architectures to prevent
  out-of-memory during linking.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1699185600">- Update to version 17.0.4.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Include libomptarget.devicertl.a in libomp*-devel, which is
  required for (GPU) offloading.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1700308800">- Update to version 17.0.5.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Also test clang-tools-extra (at least most parts) and lld.
- Adapt test in lld-default-sha1.patch.
- Don't disable testing if qemu_user_space_build has been set to 0.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Update to version 17.0.6.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
- Use major version only instead of full (patch-level) version for
  versioned executables: we don't support parallel installation of
  multiple versions of the same LLVM major version. (boo#1217450)
  Also drop the clang-X.Y symlink that was introduced for
  boo#1012260, because Y is always 0.
- Manage clang-cpp with update-alternatives like other binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1703160000">- Revert conflicts/provides for python3-clang to %python3_sitearch
  to retain compatibility with older llvm versions in SLE.</changelog>
</package>
<package pkgid="7fe5d4fe51ad6b359024d9bb83ff84a6dd1553185d7547a78c68b72c5cb78b13" name="clang11" arch="aarch64">
  <version epoch="0" ver="11.0.1" rel="150300.3.8.1"/>
  <changelog author="rguenther@suse.com" date="1580990400">- Add back emacs-llvm Provides and Conflicts to clang subpackage
  originally in llvm-emacs-plugins to properly conflict with
  llvm-emacs-plugins from older llvm releases.</changelog>
  <changelog author="rguenther@suse.com" date="1581076800">- Add vim-plugin-llvm Conflicts to clang subpackage which now
  contains files formerly in llvmN-vim-plugins, conflicting with
  packages from older llvm releases.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1583582400">- Move all clang-related scripts (including those originally in
  clangX-checker), hmaptool and clang-doc into a common
  unversioned subpackage clang-tools, like python3-clang.
  The scripts reference the unversioned executables, so allowing
  multiple versions via update-alternatives would be misleading.
  The clang-doc executable will come with assets in Clang 10, so
  we have to take it out of update-alternatives as well.
  This should be the proper solution to boo#1161873.
- Include run-find-all-symbols script in clang-tools.
- Remove metadata for clangX-include-fixer subpackage that never
  had any files and thus wasn't released as rpm. There are so many
  clang binaries that packaging them separately doesn't scale.
- Fix lldb version string, adapt lldb-cmake.patch (boo#1165517).
- Remove unneccesary libtool dependency.
- Don't let clang depend on libc++, we link it with libstdc++.
- Recommend gold plugin if clang and gold are installed.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1583928000">- Require clang-tools for clangX-devel.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1584964800">- Remove conflicts of clang-tools with {clang,llvm}{7,8}: the
  relevant binaries have been removed from those packages. This
  allows having clang-tools together with older versions of llvm.
  For a smooth installation we add OrderWithRequires dependencies.
- Fix typos in (still inactive) !%{with clang_scripts} part.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1585051200">- Update to version 10.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/10.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools: llvm-ifs, llvm-install-name-tool, llvm-reduce.
  * New Clang tools: clang-move, clang-offload-wrapper, pp-trace.
  * lldb-mi moved to a separate project and is no longer available.
- Dropped obsolete patches:
  * clang-fix-powerpc-triplet.patch
  * clang-riscv64-rv64gc.diff
  * compiler-rt-move-fdp.patch
  * compiler-rt-sanitizer-ipc-perm.patch
  * D60657-riscv-pcrel_lo.diff
  * gwp-asan-lto.patch
  * libcxx-tests-linux-distribution.patch
  * link-lldb-shared.patch
  * llvm-riscv64-fix-cffi.diff
  * openmp-export-fini.patch
  * riscv-eh-frame-fixup.patch
  * riscv64-suse-linux.patch
- Rebased patches:
  * assume-opensuse.patch
  * link-clang-tools-extra-shared.patch
  * lldb-cmake.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch
  * lto-disable-cache.patch
  * polly-pthread.patch
  * tests-use-python3.patch
- Add tablegen-test-link-static.patch: fix TableGenTests.
- Add ValueLattice-Add-new-state-for-undef-constants.patch: fix
  miscompilation on ppc64/s390x that was leading to test crashes.
- Enable ThinLTO on aarch64.
- Disable ThinLTO on ppc64le due to internal error in gold.
- Delete object files and static libraries from build tree in
  %install already, because debuginfo extraction happens after
  that. If we do it after %check, we run out of disk space.
- Run tests "manually", because we've already removed many targets.
- Don't build unit tests, because some of them are now statically
  linked, which is very expensive with LTO. Also unit tests are
  probably not very interesting on the distribution level, we don't
  expect them to perform different than in upstream. The relevant
  upstream change for this is https://reviews.llvm.org/D54439.
- Drop %if for openSUSE 13.2.</changelog>
  <changelog author="idonmez@suse.com" date="1592913600">- Add lld-default-sha1.patch to make lld generate SHA1 build-ids by
  default, otherwise our tools cannot process the debuginfo.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1594555200">- Factor out computation of the number of jobs into a macro.
- Choose mem_per_compile_job dependent on build stage, let stage 1
  on x86_64 use more memory.
- More generous memory allocation on riscv64.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1595419200">- Update to version 10.0.1.
  * This release contains bug-fixes for the LLVM 10.0.0 release.
    This release is API and ABI compatible with 10.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Replace ValueLattice-Add-new-state-for-undef-constants.patch,
  which landed upstream in a modified version, by
  restore-llvm10-abi.patch that resets the ABI to our 10.0.0.
- Rewrite lld-default-sha1.patch to be version-independent.
- Set flags consistently, so that we don't lose -DNDEBUG on 32-bit
  architectures. Also we don't need the opt flags twice. This leads
  to a significant reduction in binary sizes on 32-bit arches.
- Make it easier to package release candidates.
- Enable most tests on 32-bit ARM, but not for libcxx.
- Add fix-atomics-test.patch for architectures where native atomics
  are not available.
- Lower build constraints for riscv64 a bit to allow building on
  more workers.
- Allow more compile jobs in stage 2.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1596110400">- Add ld.lld as an alternative for ld. (boo#1174656)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1603108800">- Update to version 11.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/11.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools: llvm-gsymutil, llvm-ml.
  * clang-import-test was removed.
- Drop obsolete patches:
  * clang-ignore-stack-clash-protector.patch
  * fix-atomics-test.patch
  * restore-llvm10-abi.patch
- Rebase patches:
  * clang-resourcedirs.patch
  * default-to-i586.patch
  * link-clang-shared.patch
  * link-clang-tools-extra-shared.patch
  * lldb-cmake.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Add llvm-exegesis-link-dylib.patch: link llvm-exegesis with
  libLLVM.so, the advanced functionality is not available anyway.
- Remove -fstack-clash-protection on architectures where it isn't
  actually supported, because that prevents feature detection.
- Make sure we also build AttributeReference for the documentation.
  This requires building via CMake. Also shorten the paths.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1603540800">- Disable ThinLTO on aarch64 because of hangs. (boo#1178070)
- Enable ThinLTO on ppc64 and ppc64le, the internal error is gone.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1605355200">- Let CMake files in {llvm,clang}X-devel refer to the versioned
  binaries that come with the package instead of the symlink
  managed by update-alternatives. (boo#1178513)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1606132800">- Add compiler-rt-dont-compile-assembly-files-as-c.patch to fix
  build failure with newer CMake versions.</changelog>
  <changelog author="schwab@suse.de" date="1607947200">- polly-pthread.patch: Remove, std::call_once no longer needs libpthread</changelog>
  <changelog author="gmbr3@opensuse.org" date="1609502400">- Move BFD plugins to %{_libdir}</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1609934400">- Increase required RAM for aarch64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1610193600">- Update to version 11.0.1.
  * This release contains bug-fixes for the LLVM 11.0.0 release.
    This release is API and ABI compatible with 11.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Drop obsolete compiler-rt-dont-compile-assembly-files-as-c.patch.
- Make documentation tarballs more reproducible.</changelog>
  <changelog author="rguenther@suse.com" date="1664280000">- Add llvm-testsuite-keep-DFLTCC.patch to keep DFLTCC environment
  during testing so we can disable the compression facility on
  s390x which causes testsuite issues.  [bsc#1189602]</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1669809600">- Drop RUNPATH from packaged binaries, instead set LD_LIBRARY_PATH
  for building and testing to simulate behavior of actual package.
  [bsc#1197773 , backported from OBS devel revision 25]
- Propagate the complete host environment to the tests run. This
  ensures that all envvars needed e.g. for the compiler to work
  correctly are present. This run libc++ tests successfully getting the env
  LD_LIBRARY_PATH, otherwise, library were not found.
  [llvm-propagate-host-env-to-libc++-test-suite.patch]</changelog>
</package>
<package pkgid="9ce1458459f76efc0488eff1757bfad6cbb563fb1aa39e2dacb23a26d8d7a249" name="clang11" arch="ppc64le">
  <version epoch="0" ver="11.0.1" rel="150300.3.8.1"/>
  <changelog author="rguenther@suse.com" date="1580990400">- Add back emacs-llvm Provides and Conflicts to clang subpackage
  originally in llvm-emacs-plugins to properly conflict with
  llvm-emacs-plugins from older llvm releases.</changelog>
  <changelog author="rguenther@suse.com" date="1581076800">- Add vim-plugin-llvm Conflicts to clang subpackage which now
  contains files formerly in llvmN-vim-plugins, conflicting with
  packages from older llvm releases.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1583582400">- Move all clang-related scripts (including those originally in
  clangX-checker), hmaptool and clang-doc into a common
  unversioned subpackage clang-tools, like python3-clang.
  The scripts reference the unversioned executables, so allowing
  multiple versions via update-alternatives would be misleading.
  The clang-doc executable will come with assets in Clang 10, so
  we have to take it out of update-alternatives as well.
  This should be the proper solution to boo#1161873.
- Include run-find-all-symbols script in clang-tools.
- Remove metadata for clangX-include-fixer subpackage that never
  had any files and thus wasn't released as rpm. There are so many
  clang binaries that packaging them separately doesn't scale.
- Fix lldb version string, adapt lldb-cmake.patch (boo#1165517).
- Remove unneccesary libtool dependency.
- Don't let clang depend on libc++, we link it with libstdc++.
- Recommend gold plugin if clang and gold are installed.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1583928000">- Require clang-tools for clangX-devel.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1584964800">- Remove conflicts of clang-tools with {clang,llvm}{7,8}: the
  relevant binaries have been removed from those packages. This
  allows having clang-tools together with older versions of llvm.
  For a smooth installation we add OrderWithRequires dependencies.
- Fix typos in (still inactive) !%{with clang_scripts} part.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1585051200">- Update to version 10.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/10.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools: llvm-ifs, llvm-install-name-tool, llvm-reduce.
  * New Clang tools: clang-move, clang-offload-wrapper, pp-trace.
  * lldb-mi moved to a separate project and is no longer available.
- Dropped obsolete patches:
  * clang-fix-powerpc-triplet.patch
  * clang-riscv64-rv64gc.diff
  * compiler-rt-move-fdp.patch
  * compiler-rt-sanitizer-ipc-perm.patch
  * D60657-riscv-pcrel_lo.diff
  * gwp-asan-lto.patch
  * libcxx-tests-linux-distribution.patch
  * link-lldb-shared.patch
  * llvm-riscv64-fix-cffi.diff
  * openmp-export-fini.patch
  * riscv-eh-frame-fixup.patch
  * riscv64-suse-linux.patch
- Rebased patches:
  * assume-opensuse.patch
  * link-clang-tools-extra-shared.patch
  * lldb-cmake.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch
  * lto-disable-cache.patch
  * polly-pthread.patch
  * tests-use-python3.patch
- Add tablegen-test-link-static.patch: fix TableGenTests.
- Add ValueLattice-Add-new-state-for-undef-constants.patch: fix
  miscompilation on ppc64/s390x that was leading to test crashes.
- Enable ThinLTO on aarch64.
- Disable ThinLTO on ppc64le due to internal error in gold.
- Delete object files and static libraries from build tree in
  %install already, because debuginfo extraction happens after
  that. If we do it after %check, we run out of disk space.
- Run tests "manually", because we've already removed many targets.
- Don't build unit tests, because some of them are now statically
  linked, which is very expensive with LTO. Also unit tests are
  probably not very interesting on the distribution level, we don't
  expect them to perform different than in upstream. The relevant
  upstream change for this is https://reviews.llvm.org/D54439.
- Drop %if for openSUSE 13.2.</changelog>
  <changelog author="idonmez@suse.com" date="1592913600">- Add lld-default-sha1.patch to make lld generate SHA1 build-ids by
  default, otherwise our tools cannot process the debuginfo.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1594555200">- Factor out computation of the number of jobs into a macro.
- Choose mem_per_compile_job dependent on build stage, let stage 1
  on x86_64 use more memory.
- More generous memory allocation on riscv64.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1595419200">- Update to version 10.0.1.
  * This release contains bug-fixes for the LLVM 10.0.0 release.
    This release is API and ABI compatible with 10.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Replace ValueLattice-Add-new-state-for-undef-constants.patch,
  which landed upstream in a modified version, by
  restore-llvm10-abi.patch that resets the ABI to our 10.0.0.
- Rewrite lld-default-sha1.patch to be version-independent.
- Set flags consistently, so that we don't lose -DNDEBUG on 32-bit
  architectures. Also we don't need the opt flags twice. This leads
  to a significant reduction in binary sizes on 32-bit arches.
- Make it easier to package release candidates.
- Enable most tests on 32-bit ARM, but not for libcxx.
- Add fix-atomics-test.patch for architectures where native atomics
  are not available.
- Lower build constraints for riscv64 a bit to allow building on
  more workers.
- Allow more compile jobs in stage 2.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1596110400">- Add ld.lld as an alternative for ld. (boo#1174656)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1603108800">- Update to version 11.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/11.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools: llvm-gsymutil, llvm-ml.
  * clang-import-test was removed.
- Drop obsolete patches:
  * clang-ignore-stack-clash-protector.patch
  * fix-atomics-test.patch
  * restore-llvm10-abi.patch
- Rebase patches:
  * clang-resourcedirs.patch
  * default-to-i586.patch
  * link-clang-shared.patch
  * link-clang-tools-extra-shared.patch
  * lldb-cmake.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Add llvm-exegesis-link-dylib.patch: link llvm-exegesis with
  libLLVM.so, the advanced functionality is not available anyway.
- Remove -fstack-clash-protection on architectures where it isn't
  actually supported, because that prevents feature detection.
- Make sure we also build AttributeReference for the documentation.
  This requires building via CMake. Also shorten the paths.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1603540800">- Disable ThinLTO on aarch64 because of hangs. (boo#1178070)
- Enable ThinLTO on ppc64 and ppc64le, the internal error is gone.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1605355200">- Let CMake files in {llvm,clang}X-devel refer to the versioned
  binaries that come with the package instead of the symlink
  managed by update-alternatives. (boo#1178513)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1606132800">- Add compiler-rt-dont-compile-assembly-files-as-c.patch to fix
  build failure with newer CMake versions.</changelog>
  <changelog author="schwab@suse.de" date="1607947200">- polly-pthread.patch: Remove, std::call_once no longer needs libpthread</changelog>
  <changelog author="gmbr3@opensuse.org" date="1609502400">- Move BFD plugins to %{_libdir}</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1609934400">- Increase required RAM for aarch64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1610193600">- Update to version 11.0.1.
  * This release contains bug-fixes for the LLVM 11.0.0 release.
    This release is API and ABI compatible with 11.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Drop obsolete compiler-rt-dont-compile-assembly-files-as-c.patch.
- Make documentation tarballs more reproducible.</changelog>
  <changelog author="rguenther@suse.com" date="1664280000">- Add llvm-testsuite-keep-DFLTCC.patch to keep DFLTCC environment
  during testing so we can disable the compression facility on
  s390x which causes testsuite issues.  [bsc#1189602]</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1669809600">- Drop RUNPATH from packaged binaries, instead set LD_LIBRARY_PATH
  for building and testing to simulate behavior of actual package.
  [bsc#1197773 , backported from OBS devel revision 25]
- Propagate the complete host environment to the tests run. This
  ensures that all envvars needed e.g. for the compiler to work
  correctly are present. This run libc++ tests successfully getting the env
  LD_LIBRARY_PATH, otherwise, library were not found.
  [llvm-propagate-host-env-to-libc++-test-suite.patch]</changelog>
</package>
<package pkgid="e1c15e7868d084b7cae3ae7534ba39e6dfe1092091426e769fb8fb2e871512e6" name="clang11" arch="s390x">
  <version epoch="0" ver="11.0.1" rel="150300.3.8.1"/>
  <changelog author="rguenther@suse.com" date="1580990400">- Add back emacs-llvm Provides and Conflicts to clang subpackage
  originally in llvm-emacs-plugins to properly conflict with
  llvm-emacs-plugins from older llvm releases.</changelog>
  <changelog author="rguenther@suse.com" date="1581076800">- Add vim-plugin-llvm Conflicts to clang subpackage which now
  contains files formerly in llvmN-vim-plugins, conflicting with
  packages from older llvm releases.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1583582400">- Move all clang-related scripts (including those originally in
  clangX-checker), hmaptool and clang-doc into a common
  unversioned subpackage clang-tools, like python3-clang.
  The scripts reference the unversioned executables, so allowing
  multiple versions via update-alternatives would be misleading.
  The clang-doc executable will come with assets in Clang 10, so
  we have to take it out of update-alternatives as well.
  This should be the proper solution to boo#1161873.
- Include run-find-all-symbols script in clang-tools.
- Remove metadata for clangX-include-fixer subpackage that never
  had any files and thus wasn't released as rpm. There are so many
  clang binaries that packaging them separately doesn't scale.
- Fix lldb version string, adapt lldb-cmake.patch (boo#1165517).
- Remove unneccesary libtool dependency.
- Don't let clang depend on libc++, we link it with libstdc++.
- Recommend gold plugin if clang and gold are installed.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1583928000">- Require clang-tools for clangX-devel.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1584964800">- Remove conflicts of clang-tools with {clang,llvm}{7,8}: the
  relevant binaries have been removed from those packages. This
  allows having clang-tools together with older versions of llvm.
  For a smooth installation we add OrderWithRequires dependencies.
- Fix typos in (still inactive) !%{with clang_scripts} part.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1585051200">- Update to version 10.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/10.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools: llvm-ifs, llvm-install-name-tool, llvm-reduce.
  * New Clang tools: clang-move, clang-offload-wrapper, pp-trace.
  * lldb-mi moved to a separate project and is no longer available.
- Dropped obsolete patches:
  * clang-fix-powerpc-triplet.patch
  * clang-riscv64-rv64gc.diff
  * compiler-rt-move-fdp.patch
  * compiler-rt-sanitizer-ipc-perm.patch
  * D60657-riscv-pcrel_lo.diff
  * gwp-asan-lto.patch
  * libcxx-tests-linux-distribution.patch
  * link-lldb-shared.patch
  * llvm-riscv64-fix-cffi.diff
  * openmp-export-fini.patch
  * riscv-eh-frame-fixup.patch
  * riscv64-suse-linux.patch
- Rebased patches:
  * assume-opensuse.patch
  * link-clang-tools-extra-shared.patch
  * lldb-cmake.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch
  * lto-disable-cache.patch
  * polly-pthread.patch
  * tests-use-python3.patch
- Add tablegen-test-link-static.patch: fix TableGenTests.
- Add ValueLattice-Add-new-state-for-undef-constants.patch: fix
  miscompilation on ppc64/s390x that was leading to test crashes.
- Enable ThinLTO on aarch64.
- Disable ThinLTO on ppc64le due to internal error in gold.
- Delete object files and static libraries from build tree in
  %install already, because debuginfo extraction happens after
  that. If we do it after %check, we run out of disk space.
- Run tests "manually", because we've already removed many targets.
- Don't build unit tests, because some of them are now statically
  linked, which is very expensive with LTO. Also unit tests are
  probably not very interesting on the distribution level, we don't
  expect them to perform different than in upstream. The relevant
  upstream change for this is https://reviews.llvm.org/D54439.
- Drop %if for openSUSE 13.2.</changelog>
  <changelog author="idonmez@suse.com" date="1592913600">- Add lld-default-sha1.patch to make lld generate SHA1 build-ids by
  default, otherwise our tools cannot process the debuginfo.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1594555200">- Factor out computation of the number of jobs into a macro.
- Choose mem_per_compile_job dependent on build stage, let stage 1
  on x86_64 use more memory.
- More generous memory allocation on riscv64.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1595419200">- Update to version 10.0.1.
  * This release contains bug-fixes for the LLVM 10.0.0 release.
    This release is API and ABI compatible with 10.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Replace ValueLattice-Add-new-state-for-undef-constants.patch,
  which landed upstream in a modified version, by
  restore-llvm10-abi.patch that resets the ABI to our 10.0.0.
- Rewrite lld-default-sha1.patch to be version-independent.
- Set flags consistently, so that we don't lose -DNDEBUG on 32-bit
  architectures. Also we don't need the opt flags twice. This leads
  to a significant reduction in binary sizes on 32-bit arches.
- Make it easier to package release candidates.
- Enable most tests on 32-bit ARM, but not for libcxx.
- Add fix-atomics-test.patch for architectures where native atomics
  are not available.
- Lower build constraints for riscv64 a bit to allow building on
  more workers.
- Allow more compile jobs in stage 2.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1596110400">- Add ld.lld as an alternative for ld. (boo#1174656)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1603108800">- Update to version 11.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/11.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools: llvm-gsymutil, llvm-ml.
  * clang-import-test was removed.
- Drop obsolete patches:
  * clang-ignore-stack-clash-protector.patch
  * fix-atomics-test.patch
  * restore-llvm10-abi.patch
- Rebase patches:
  * clang-resourcedirs.patch
  * default-to-i586.patch
  * link-clang-shared.patch
  * link-clang-tools-extra-shared.patch
  * lldb-cmake.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Add llvm-exegesis-link-dylib.patch: link llvm-exegesis with
  libLLVM.so, the advanced functionality is not available anyway.
- Remove -fstack-clash-protection on architectures where it isn't
  actually supported, because that prevents feature detection.
- Make sure we also build AttributeReference for the documentation.
  This requires building via CMake. Also shorten the paths.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1603540800">- Disable ThinLTO on aarch64 because of hangs. (boo#1178070)
- Enable ThinLTO on ppc64 and ppc64le, the internal error is gone.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1605355200">- Let CMake files in {llvm,clang}X-devel refer to the versioned
  binaries that come with the package instead of the symlink
  managed by update-alternatives. (boo#1178513)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1606132800">- Add compiler-rt-dont-compile-assembly-files-as-c.patch to fix
  build failure with newer CMake versions.</changelog>
  <changelog author="schwab@suse.de" date="1607947200">- polly-pthread.patch: Remove, std::call_once no longer needs libpthread</changelog>
  <changelog author="gmbr3@opensuse.org" date="1609502400">- Move BFD plugins to %{_libdir}</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1609934400">- Increase required RAM for aarch64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1610193600">- Update to version 11.0.1.
  * This release contains bug-fixes for the LLVM 11.0.0 release.
    This release is API and ABI compatible with 11.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Drop obsolete compiler-rt-dont-compile-assembly-files-as-c.patch.
- Make documentation tarballs more reproducible.</changelog>
  <changelog author="rguenther@suse.com" date="1664280000">- Add llvm-testsuite-keep-DFLTCC.patch to keep DFLTCC environment
  during testing so we can disable the compression facility on
  s390x which causes testsuite issues.  [bsc#1189602]</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1669809600">- Drop RUNPATH from packaged binaries, instead set LD_LIBRARY_PATH
  for building and testing to simulate behavior of actual package.
  [bsc#1197773 , backported from OBS devel revision 25]
- Propagate the complete host environment to the tests run. This
  ensures that all envvars needed e.g. for the compiler to work
  correctly are present. This run libc++ tests successfully getting the env
  LD_LIBRARY_PATH, otherwise, library were not found.
  [llvm-propagate-host-env-to-libc++-test-suite.patch]</changelog>
</package>
<package pkgid="c971661f170206cf5662936dd8f61380db4b41b6f2deb962d2e656a48fd7de81" name="clang11" arch="x86_64">
  <version epoch="0" ver="11.0.1" rel="150300.3.8.1"/>
  <changelog author="rguenther@suse.com" date="1580990400">- Add back emacs-llvm Provides and Conflicts to clang subpackage
  originally in llvm-emacs-plugins to properly conflict with
  llvm-emacs-plugins from older llvm releases.</changelog>
  <changelog author="rguenther@suse.com" date="1581076800">- Add vim-plugin-llvm Conflicts to clang subpackage which now
  contains files formerly in llvmN-vim-plugins, conflicting with
  packages from older llvm releases.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1583582400">- Move all clang-related scripts (including those originally in
  clangX-checker), hmaptool and clang-doc into a common
  unversioned subpackage clang-tools, like python3-clang.
  The scripts reference the unversioned executables, so allowing
  multiple versions via update-alternatives would be misleading.
  The clang-doc executable will come with assets in Clang 10, so
  we have to take it out of update-alternatives as well.
  This should be the proper solution to boo#1161873.
- Include run-find-all-symbols script in clang-tools.
- Remove metadata for clangX-include-fixer subpackage that never
  had any files and thus wasn't released as rpm. There are so many
  clang binaries that packaging them separately doesn't scale.
- Fix lldb version string, adapt lldb-cmake.patch (boo#1165517).
- Remove unneccesary libtool dependency.
- Don't let clang depend on libc++, we link it with libstdc++.
- Recommend gold plugin if clang and gold are installed.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1583928000">- Require clang-tools for clangX-devel.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1584964800">- Remove conflicts of clang-tools with {clang,llvm}{7,8}: the
  relevant binaries have been removed from those packages. This
  allows having clang-tools together with older versions of llvm.
  For a smooth installation we add OrderWithRequires dependencies.
- Fix typos in (still inactive) !%{with clang_scripts} part.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1585051200">- Update to version 10.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/10.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools: llvm-ifs, llvm-install-name-tool, llvm-reduce.
  * New Clang tools: clang-move, clang-offload-wrapper, pp-trace.
  * lldb-mi moved to a separate project and is no longer available.
- Dropped obsolete patches:
  * clang-fix-powerpc-triplet.patch
  * clang-riscv64-rv64gc.diff
  * compiler-rt-move-fdp.patch
  * compiler-rt-sanitizer-ipc-perm.patch
  * D60657-riscv-pcrel_lo.diff
  * gwp-asan-lto.patch
  * libcxx-tests-linux-distribution.patch
  * link-lldb-shared.patch
  * llvm-riscv64-fix-cffi.diff
  * openmp-export-fini.patch
  * riscv-eh-frame-fixup.patch
  * riscv64-suse-linux.patch
- Rebased patches:
  * assume-opensuse.patch
  * link-clang-tools-extra-shared.patch
  * lldb-cmake.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch
  * lto-disable-cache.patch
  * polly-pthread.patch
  * tests-use-python3.patch
- Add tablegen-test-link-static.patch: fix TableGenTests.
- Add ValueLattice-Add-new-state-for-undef-constants.patch: fix
  miscompilation on ppc64/s390x that was leading to test crashes.
- Enable ThinLTO on aarch64.
- Disable ThinLTO on ppc64le due to internal error in gold.
- Delete object files and static libraries from build tree in
  %install already, because debuginfo extraction happens after
  that. If we do it after %check, we run out of disk space.
- Run tests "manually", because we've already removed many targets.
- Don't build unit tests, because some of them are now statically
  linked, which is very expensive with LTO. Also unit tests are
  probably not very interesting on the distribution level, we don't
  expect them to perform different than in upstream. The relevant
  upstream change for this is https://reviews.llvm.org/D54439.
- Drop %if for openSUSE 13.2.</changelog>
  <changelog author="idonmez@suse.com" date="1592913600">- Add lld-default-sha1.patch to make lld generate SHA1 build-ids by
  default, otherwise our tools cannot process the debuginfo.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1594555200">- Factor out computation of the number of jobs into a macro.
- Choose mem_per_compile_job dependent on build stage, let stage 1
  on x86_64 use more memory.
- More generous memory allocation on riscv64.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1595419200">- Update to version 10.0.1.
  * This release contains bug-fixes for the LLVM 10.0.0 release.
    This release is API and ABI compatible with 10.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Replace ValueLattice-Add-new-state-for-undef-constants.patch,
  which landed upstream in a modified version, by
  restore-llvm10-abi.patch that resets the ABI to our 10.0.0.
- Rewrite lld-default-sha1.patch to be version-independent.
- Set flags consistently, so that we don't lose -DNDEBUG on 32-bit
  architectures. Also we don't need the opt flags twice. This leads
  to a significant reduction in binary sizes on 32-bit arches.
- Make it easier to package release candidates.
- Enable most tests on 32-bit ARM, but not for libcxx.
- Add fix-atomics-test.patch for architectures where native atomics
  are not available.
- Lower build constraints for riscv64 a bit to allow building on
  more workers.
- Allow more compile jobs in stage 2.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1596110400">- Add ld.lld as an alternative for ld. (boo#1174656)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1603108800">- Update to version 11.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/11.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools: llvm-gsymutil, llvm-ml.
  * clang-import-test was removed.
- Drop obsolete patches:
  * clang-ignore-stack-clash-protector.patch
  * fix-atomics-test.patch
  * restore-llvm10-abi.patch
- Rebase patches:
  * clang-resourcedirs.patch
  * default-to-i586.patch
  * link-clang-shared.patch
  * link-clang-tools-extra-shared.patch
  * lldb-cmake.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Add llvm-exegesis-link-dylib.patch: link llvm-exegesis with
  libLLVM.so, the advanced functionality is not available anyway.
- Remove -fstack-clash-protection on architectures where it isn't
  actually supported, because that prevents feature detection.
- Make sure we also build AttributeReference for the documentation.
  This requires building via CMake. Also shorten the paths.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1603540800">- Disable ThinLTO on aarch64 because of hangs. (boo#1178070)
- Enable ThinLTO on ppc64 and ppc64le, the internal error is gone.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1605355200">- Let CMake files in {llvm,clang}X-devel refer to the versioned
  binaries that come with the package instead of the symlink
  managed by update-alternatives. (boo#1178513)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1606132800">- Add compiler-rt-dont-compile-assembly-files-as-c.patch to fix
  build failure with newer CMake versions.</changelog>
  <changelog author="schwab@suse.de" date="1607947200">- polly-pthread.patch: Remove, std::call_once no longer needs libpthread</changelog>
  <changelog author="gmbr3@opensuse.org" date="1609502400">- Move BFD plugins to %{_libdir}</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1609934400">- Increase required RAM for aarch64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1610193600">- Update to version 11.0.1.
  * This release contains bug-fixes for the LLVM 11.0.0 release.
    This release is API and ABI compatible with 11.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Drop obsolete compiler-rt-dont-compile-assembly-files-as-c.patch.
- Make documentation tarballs more reproducible.</changelog>
  <changelog author="rguenther@suse.com" date="1664280000">- Add llvm-testsuite-keep-DFLTCC.patch to keep DFLTCC environment
  during testing so we can disable the compression facility on
  s390x which causes testsuite issues.  [bsc#1189602]</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1669809600">- Drop RUNPATH from packaged binaries, instead set LD_LIBRARY_PATH
  for building and testing to simulate behavior of actual package.
  [bsc#1197773 , backported from OBS devel revision 25]
- Propagate the complete host environment to the tests run. This
  ensures that all envvars needed e.g. for the compiler to work
  correctly are present. This run libc++ tests successfully getting the env
  LD_LIBRARY_PATH, otherwise, library were not found.
  [llvm-propagate-host-env-to-libc++-test-suite.patch]</changelog>
</package>
<package pkgid="c45bf328bd38e5ce64f23a9a97ff3243d1ac4a804482391eec227e0a72e7cd59" name="clang11-devel" arch="aarch64">
  <version epoch="0" ver="11.0.1" rel="150300.3.8.1"/>
  <changelog author="rguenther@suse.com" date="1580990400">- Add back emacs-llvm Provides and Conflicts to clang subpackage
  originally in llvm-emacs-plugins to properly conflict with
  llvm-emacs-plugins from older llvm releases.</changelog>
  <changelog author="rguenther@suse.com" date="1581076800">- Add vim-plugin-llvm Conflicts to clang subpackage which now
  contains files formerly in llvmN-vim-plugins, conflicting with
  packages from older llvm releases.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1583582400">- Move all clang-related scripts (including those originally in
  clangX-checker), hmaptool and clang-doc into a common
  unversioned subpackage clang-tools, like python3-clang.
  The scripts reference the unversioned executables, so allowing
  multiple versions via update-alternatives would be misleading.
  The clang-doc executable will come with assets in Clang 10, so
  we have to take it out of update-alternatives as well.
  This should be the proper solution to boo#1161873.
- Include run-find-all-symbols script in clang-tools.
- Remove metadata for clangX-include-fixer subpackage that never
  had any files and thus wasn't released as rpm. There are so many
  clang binaries that packaging them separately doesn't scale.
- Fix lldb version string, adapt lldb-cmake.patch (boo#1165517).
- Remove unneccesary libtool dependency.
- Don't let clang depend on libc++, we link it with libstdc++.
- Recommend gold plugin if clang and gold are installed.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1583928000">- Require clang-tools for clangX-devel.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1584964800">- Remove conflicts of clang-tools with {clang,llvm}{7,8}: the
  relevant binaries have been removed from those packages. This
  allows having clang-tools together with older versions of llvm.
  For a smooth installation we add OrderWithRequires dependencies.
- Fix typos in (still inactive) !%{with clang_scripts} part.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1585051200">- Update to version 10.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/10.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools: llvm-ifs, llvm-install-name-tool, llvm-reduce.
  * New Clang tools: clang-move, clang-offload-wrapper, pp-trace.
  * lldb-mi moved to a separate project and is no longer available.
- Dropped obsolete patches:
  * clang-fix-powerpc-triplet.patch
  * clang-riscv64-rv64gc.diff
  * compiler-rt-move-fdp.patch
  * compiler-rt-sanitizer-ipc-perm.patch
  * D60657-riscv-pcrel_lo.diff
  * gwp-asan-lto.patch
  * libcxx-tests-linux-distribution.patch
  * link-lldb-shared.patch
  * llvm-riscv64-fix-cffi.diff
  * openmp-export-fini.patch
  * riscv-eh-frame-fixup.patch
  * riscv64-suse-linux.patch
- Rebased patches:
  * assume-opensuse.patch
  * link-clang-tools-extra-shared.patch
  * lldb-cmake.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch
  * lto-disable-cache.patch
  * polly-pthread.patch
  * tests-use-python3.patch
- Add tablegen-test-link-static.patch: fix TableGenTests.
- Add ValueLattice-Add-new-state-for-undef-constants.patch: fix
  miscompilation on ppc64/s390x that was leading to test crashes.
- Enable ThinLTO on aarch64.
- Disable ThinLTO on ppc64le due to internal error in gold.
- Delete object files and static libraries from build tree in
  %install already, because debuginfo extraction happens after
  that. If we do it after %check, we run out of disk space.
- Run tests "manually", because we've already removed many targets.
- Don't build unit tests, because some of them are now statically
  linked, which is very expensive with LTO. Also unit tests are
  probably not very interesting on the distribution level, we don't
  expect them to perform different than in upstream. The relevant
  upstream change for this is https://reviews.llvm.org/D54439.
- Drop %if for openSUSE 13.2.</changelog>
  <changelog author="idonmez@suse.com" date="1592913600">- Add lld-default-sha1.patch to make lld generate SHA1 build-ids by
  default, otherwise our tools cannot process the debuginfo.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1594555200">- Factor out computation of the number of jobs into a macro.
- Choose mem_per_compile_job dependent on build stage, let stage 1
  on x86_64 use more memory.
- More generous memory allocation on riscv64.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1595419200">- Update to version 10.0.1.
  * This release contains bug-fixes for the LLVM 10.0.0 release.
    This release is API and ABI compatible with 10.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Replace ValueLattice-Add-new-state-for-undef-constants.patch,
  which landed upstream in a modified version, by
  restore-llvm10-abi.patch that resets the ABI to our 10.0.0.
- Rewrite lld-default-sha1.patch to be version-independent.
- Set flags consistently, so that we don't lose -DNDEBUG on 32-bit
  architectures. Also we don't need the opt flags twice. This leads
  to a significant reduction in binary sizes on 32-bit arches.
- Make it easier to package release candidates.
- Enable most tests on 32-bit ARM, but not for libcxx.
- Add fix-atomics-test.patch for architectures where native atomics
  are not available.
- Lower build constraints for riscv64 a bit to allow building on
  more workers.
- Allow more compile jobs in stage 2.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1596110400">- Add ld.lld as an alternative for ld. (boo#1174656)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1603108800">- Update to version 11.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/11.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools: llvm-gsymutil, llvm-ml.
  * clang-import-test was removed.
- Drop obsolete patches:
  * clang-ignore-stack-clash-protector.patch
  * fix-atomics-test.patch
  * restore-llvm10-abi.patch
- Rebase patches:
  * clang-resourcedirs.patch
  * default-to-i586.patch
  * link-clang-shared.patch
  * link-clang-tools-extra-shared.patch
  * lldb-cmake.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Add llvm-exegesis-link-dylib.patch: link llvm-exegesis with
  libLLVM.so, the advanced functionality is not available anyway.
- Remove -fstack-clash-protection on architectures where it isn't
  actually supported, because that prevents feature detection.
- Make sure we also build AttributeReference for the documentation.
  This requires building via CMake. Also shorten the paths.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1603540800">- Disable ThinLTO on aarch64 because of hangs. (boo#1178070)
- Enable ThinLTO on ppc64 and ppc64le, the internal error is gone.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1605355200">- Let CMake files in {llvm,clang}X-devel refer to the versioned
  binaries that come with the package instead of the symlink
  managed by update-alternatives. (boo#1178513)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1606132800">- Add compiler-rt-dont-compile-assembly-files-as-c.patch to fix
  build failure with newer CMake versions.</changelog>
  <changelog author="schwab@suse.de" date="1607947200">- polly-pthread.patch: Remove, std::call_once no longer needs libpthread</changelog>
  <changelog author="gmbr3@opensuse.org" date="1609502400">- Move BFD plugins to %{_libdir}</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1609934400">- Increase required RAM for aarch64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1610193600">- Update to version 11.0.1.
  * This release contains bug-fixes for the LLVM 11.0.0 release.
    This release is API and ABI compatible with 11.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Drop obsolete compiler-rt-dont-compile-assembly-files-as-c.patch.
- Make documentation tarballs more reproducible.</changelog>
  <changelog author="rguenther@suse.com" date="1664280000">- Add llvm-testsuite-keep-DFLTCC.patch to keep DFLTCC environment
  during testing so we can disable the compression facility on
  s390x which causes testsuite issues.  [bsc#1189602]</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1669809600">- Drop RUNPATH from packaged binaries, instead set LD_LIBRARY_PATH
  for building and testing to simulate behavior of actual package.
  [bsc#1197773 , backported from OBS devel revision 25]
- Propagate the complete host environment to the tests run. This
  ensures that all envvars needed e.g. for the compiler to work
  correctly are present. This run libc++ tests successfully getting the env
  LD_LIBRARY_PATH, otherwise, library were not found.
  [llvm-propagate-host-env-to-libc++-test-suite.patch]</changelog>
</package>
<package pkgid="62552548e161680dcaadf7a73d60e20de8ed7f5037a65fa146af8ab283e1aaf0" name="clang11-devel" arch="ppc64le">
  <version epoch="0" ver="11.0.1" rel="150300.3.8.1"/>
  <changelog author="rguenther@suse.com" date="1580990400">- Add back emacs-llvm Provides and Conflicts to clang subpackage
  originally in llvm-emacs-plugins to properly conflict with
  llvm-emacs-plugins from older llvm releases.</changelog>
  <changelog author="rguenther@suse.com" date="1581076800">- Add vim-plugin-llvm Conflicts to clang subpackage which now
  contains files formerly in llvmN-vim-plugins, conflicting with
  packages from older llvm releases.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1583582400">- Move all clang-related scripts (including those originally in
  clangX-checker), hmaptool and clang-doc into a common
  unversioned subpackage clang-tools, like python3-clang.
  The scripts reference the unversioned executables, so allowing
  multiple versions via update-alternatives would be misleading.
  The clang-doc executable will come with assets in Clang 10, so
  we have to take it out of update-alternatives as well.
  This should be the proper solution to boo#1161873.
- Include run-find-all-symbols script in clang-tools.
- Remove metadata for clangX-include-fixer subpackage that never
  had any files and thus wasn't released as rpm. There are so many
  clang binaries that packaging them separately doesn't scale.
- Fix lldb version string, adapt lldb-cmake.patch (boo#1165517).
- Remove unneccesary libtool dependency.
- Don't let clang depend on libc++, we link it with libstdc++.
- Recommend gold plugin if clang and gold are installed.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1583928000">- Require clang-tools for clangX-devel.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1584964800">- Remove conflicts of clang-tools with {clang,llvm}{7,8}: the
  relevant binaries have been removed from those packages. This
  allows having clang-tools together with older versions of llvm.
  For a smooth installation we add OrderWithRequires dependencies.
- Fix typos in (still inactive) !%{with clang_scripts} part.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1585051200">- Update to version 10.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/10.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools: llvm-ifs, llvm-install-name-tool, llvm-reduce.
  * New Clang tools: clang-move, clang-offload-wrapper, pp-trace.
  * lldb-mi moved to a separate project and is no longer available.
- Dropped obsolete patches:
  * clang-fix-powerpc-triplet.patch
  * clang-riscv64-rv64gc.diff
  * compiler-rt-move-fdp.patch
  * compiler-rt-sanitizer-ipc-perm.patch
  * D60657-riscv-pcrel_lo.diff
  * gwp-asan-lto.patch
  * libcxx-tests-linux-distribution.patch
  * link-lldb-shared.patch
  * llvm-riscv64-fix-cffi.diff
  * openmp-export-fini.patch
  * riscv-eh-frame-fixup.patch
  * riscv64-suse-linux.patch
- Rebased patches:
  * assume-opensuse.patch
  * link-clang-tools-extra-shared.patch
  * lldb-cmake.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch
  * lto-disable-cache.patch
  * polly-pthread.patch
  * tests-use-python3.patch
- Add tablegen-test-link-static.patch: fix TableGenTests.
- Add ValueLattice-Add-new-state-for-undef-constants.patch: fix
  miscompilation on ppc64/s390x that was leading to test crashes.
- Enable ThinLTO on aarch64.
- Disable ThinLTO on ppc64le due to internal error in gold.
- Delete object files and static libraries from build tree in
  %install already, because debuginfo extraction happens after
  that. If we do it after %check, we run out of disk space.
- Run tests "manually", because we've already removed many targets.
- Don't build unit tests, because some of them are now statically
  linked, which is very expensive with LTO. Also unit tests are
  probably not very interesting on the distribution level, we don't
  expect them to perform different than in upstream. The relevant
  upstream change for this is https://reviews.llvm.org/D54439.
- Drop %if for openSUSE 13.2.</changelog>
  <changelog author="idonmez@suse.com" date="1592913600">- Add lld-default-sha1.patch to make lld generate SHA1 build-ids by
  default, otherwise our tools cannot process the debuginfo.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1594555200">- Factor out computation of the number of jobs into a macro.
- Choose mem_per_compile_job dependent on build stage, let stage 1
  on x86_64 use more memory.
- More generous memory allocation on riscv64.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1595419200">- Update to version 10.0.1.
  * This release contains bug-fixes for the LLVM 10.0.0 release.
    This release is API and ABI compatible with 10.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Replace ValueLattice-Add-new-state-for-undef-constants.patch,
  which landed upstream in a modified version, by
  restore-llvm10-abi.patch that resets the ABI to our 10.0.0.
- Rewrite lld-default-sha1.patch to be version-independent.
- Set flags consistently, so that we don't lose -DNDEBUG on 32-bit
  architectures. Also we don't need the opt flags twice. This leads
  to a significant reduction in binary sizes on 32-bit arches.
- Make it easier to package release candidates.
- Enable most tests on 32-bit ARM, but not for libcxx.
- Add fix-atomics-test.patch for architectures where native atomics
  are not available.
- Lower build constraints for riscv64 a bit to allow building on
  more workers.
- Allow more compile jobs in stage 2.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1596110400">- Add ld.lld as an alternative for ld. (boo#1174656)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1603108800">- Update to version 11.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/11.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools: llvm-gsymutil, llvm-ml.
  * clang-import-test was removed.
- Drop obsolete patches:
  * clang-ignore-stack-clash-protector.patch
  * fix-atomics-test.patch
  * restore-llvm10-abi.patch
- Rebase patches:
  * clang-resourcedirs.patch
  * default-to-i586.patch
  * link-clang-shared.patch
  * link-clang-tools-extra-shared.patch
  * lldb-cmake.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Add llvm-exegesis-link-dylib.patch: link llvm-exegesis with
  libLLVM.so, the advanced functionality is not available anyway.
- Remove -fstack-clash-protection on architectures where it isn't
  actually supported, because that prevents feature detection.
- Make sure we also build AttributeReference for the documentation.
  This requires building via CMake. Also shorten the paths.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1603540800">- Disable ThinLTO on aarch64 because of hangs. (boo#1178070)
- Enable ThinLTO on ppc64 and ppc64le, the internal error is gone.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1605355200">- Let CMake files in {llvm,clang}X-devel refer to the versioned
  binaries that come with the package instead of the symlink
  managed by update-alternatives. (boo#1178513)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1606132800">- Add compiler-rt-dont-compile-assembly-files-as-c.patch to fix
  build failure with newer CMake versions.</changelog>
  <changelog author="schwab@suse.de" date="1607947200">- polly-pthread.patch: Remove, std::call_once no longer needs libpthread</changelog>
  <changelog author="gmbr3@opensuse.org" date="1609502400">- Move BFD plugins to %{_libdir}</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1609934400">- Increase required RAM for aarch64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1610193600">- Update to version 11.0.1.
  * This release contains bug-fixes for the LLVM 11.0.0 release.
    This release is API and ABI compatible with 11.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Drop obsolete compiler-rt-dont-compile-assembly-files-as-c.patch.
- Make documentation tarballs more reproducible.</changelog>
  <changelog author="rguenther@suse.com" date="1664280000">- Add llvm-testsuite-keep-DFLTCC.patch to keep DFLTCC environment
  during testing so we can disable the compression facility on
  s390x which causes testsuite issues.  [bsc#1189602]</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1669809600">- Drop RUNPATH from packaged binaries, instead set LD_LIBRARY_PATH
  for building and testing to simulate behavior of actual package.
  [bsc#1197773 , backported from OBS devel revision 25]
- Propagate the complete host environment to the tests run. This
  ensures that all envvars needed e.g. for the compiler to work
  correctly are present. This run libc++ tests successfully getting the env
  LD_LIBRARY_PATH, otherwise, library were not found.
  [llvm-propagate-host-env-to-libc++-test-suite.patch]</changelog>
</package>
<package pkgid="fbacffa00b0926aafcc5121dbeaf873eec3b199139fc49cf6f2a6a36f40636b1" name="clang11-devel" arch="s390x">
  <version epoch="0" ver="11.0.1" rel="150300.3.8.1"/>
  <changelog author="rguenther@suse.com" date="1580990400">- Add back emacs-llvm Provides and Conflicts to clang subpackage
  originally in llvm-emacs-plugins to properly conflict with
  llvm-emacs-plugins from older llvm releases.</changelog>
  <changelog author="rguenther@suse.com" date="1581076800">- Add vim-plugin-llvm Conflicts to clang subpackage which now
  contains files formerly in llvmN-vim-plugins, conflicting with
  packages from older llvm releases.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1583582400">- Move all clang-related scripts (including those originally in
  clangX-checker), hmaptool and clang-doc into a common
  unversioned subpackage clang-tools, like python3-clang.
  The scripts reference the unversioned executables, so allowing
  multiple versions via update-alternatives would be misleading.
  The clang-doc executable will come with assets in Clang 10, so
  we have to take it out of update-alternatives as well.
  This should be the proper solution to boo#1161873.
- Include run-find-all-symbols script in clang-tools.
- Remove metadata for clangX-include-fixer subpackage that never
  had any files and thus wasn't released as rpm. There are so many
  clang binaries that packaging them separately doesn't scale.
- Fix lldb version string, adapt lldb-cmake.patch (boo#1165517).
- Remove unneccesary libtool dependency.
- Don't let clang depend on libc++, we link it with libstdc++.
- Recommend gold plugin if clang and gold are installed.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1583928000">- Require clang-tools for clangX-devel.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1584964800">- Remove conflicts of clang-tools with {clang,llvm}{7,8}: the
  relevant binaries have been removed from those packages. This
  allows having clang-tools together with older versions of llvm.
  For a smooth installation we add OrderWithRequires dependencies.
- Fix typos in (still inactive) !%{with clang_scripts} part.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1585051200">- Update to version 10.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/10.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools: llvm-ifs, llvm-install-name-tool, llvm-reduce.
  * New Clang tools: clang-move, clang-offload-wrapper, pp-trace.
  * lldb-mi moved to a separate project and is no longer available.
- Dropped obsolete patches:
  * clang-fix-powerpc-triplet.patch
  * clang-riscv64-rv64gc.diff
  * compiler-rt-move-fdp.patch
  * compiler-rt-sanitizer-ipc-perm.patch
  * D60657-riscv-pcrel_lo.diff
  * gwp-asan-lto.patch
  * libcxx-tests-linux-distribution.patch
  * link-lldb-shared.patch
  * llvm-riscv64-fix-cffi.diff
  * openmp-export-fini.patch
  * riscv-eh-frame-fixup.patch
  * riscv64-suse-linux.patch
- Rebased patches:
  * assume-opensuse.patch
  * link-clang-tools-extra-shared.patch
  * lldb-cmake.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch
  * lto-disable-cache.patch
  * polly-pthread.patch
  * tests-use-python3.patch
- Add tablegen-test-link-static.patch: fix TableGenTests.
- Add ValueLattice-Add-new-state-for-undef-constants.patch: fix
  miscompilation on ppc64/s390x that was leading to test crashes.
- Enable ThinLTO on aarch64.
- Disable ThinLTO on ppc64le due to internal error in gold.
- Delete object files and static libraries from build tree in
  %install already, because debuginfo extraction happens after
  that. If we do it after %check, we run out of disk space.
- Run tests "manually", because we've already removed many targets.
- Don't build unit tests, because some of them are now statically
  linked, which is very expensive with LTO. Also unit tests are
  probably not very interesting on the distribution level, we don't
  expect them to perform different than in upstream. The relevant
  upstream change for this is https://reviews.llvm.org/D54439.
- Drop %if for openSUSE 13.2.</changelog>
  <changelog author="idonmez@suse.com" date="1592913600">- Add lld-default-sha1.patch to make lld generate SHA1 build-ids by
  default, otherwise our tools cannot process the debuginfo.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1594555200">- Factor out computation of the number of jobs into a macro.
- Choose mem_per_compile_job dependent on build stage, let stage 1
  on x86_64 use more memory.
- More generous memory allocation on riscv64.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1595419200">- Update to version 10.0.1.
  * This release contains bug-fixes for the LLVM 10.0.0 release.
    This release is API and ABI compatible with 10.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Replace ValueLattice-Add-new-state-for-undef-constants.patch,
  which landed upstream in a modified version, by
  restore-llvm10-abi.patch that resets the ABI to our 10.0.0.
- Rewrite lld-default-sha1.patch to be version-independent.
- Set flags consistently, so that we don't lose -DNDEBUG on 32-bit
  architectures. Also we don't need the opt flags twice. This leads
  to a significant reduction in binary sizes on 32-bit arches.
- Make it easier to package release candidates.
- Enable most tests on 32-bit ARM, but not for libcxx.
- Add fix-atomics-test.patch for architectures where native atomics
  are not available.
- Lower build constraints for riscv64 a bit to allow building on
  more workers.
- Allow more compile jobs in stage 2.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1596110400">- Add ld.lld as an alternative for ld. (boo#1174656)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1603108800">- Update to version 11.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/11.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools: llvm-gsymutil, llvm-ml.
  * clang-import-test was removed.
- Drop obsolete patches:
  * clang-ignore-stack-clash-protector.patch
  * fix-atomics-test.patch
  * restore-llvm10-abi.patch
- Rebase patches:
  * clang-resourcedirs.patch
  * default-to-i586.patch
  * link-clang-shared.patch
  * link-clang-tools-extra-shared.patch
  * lldb-cmake.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Add llvm-exegesis-link-dylib.patch: link llvm-exegesis with
  libLLVM.so, the advanced functionality is not available anyway.
- Remove -fstack-clash-protection on architectures where it isn't
  actually supported, because that prevents feature detection.
- Make sure we also build AttributeReference for the documentation.
  This requires building via CMake. Also shorten the paths.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1603540800">- Disable ThinLTO on aarch64 because of hangs. (boo#1178070)
- Enable ThinLTO on ppc64 and ppc64le, the internal error is gone.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1605355200">- Let CMake files in {llvm,clang}X-devel refer to the versioned
  binaries that come with the package instead of the symlink
  managed by update-alternatives. (boo#1178513)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1606132800">- Add compiler-rt-dont-compile-assembly-files-as-c.patch to fix
  build failure with newer CMake versions.</changelog>
  <changelog author="schwab@suse.de" date="1607947200">- polly-pthread.patch: Remove, std::call_once no longer needs libpthread</changelog>
  <changelog author="gmbr3@opensuse.org" date="1609502400">- Move BFD plugins to %{_libdir}</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1609934400">- Increase required RAM for aarch64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1610193600">- Update to version 11.0.1.
  * This release contains bug-fixes for the LLVM 11.0.0 release.
    This release is API and ABI compatible with 11.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Drop obsolete compiler-rt-dont-compile-assembly-files-as-c.patch.
- Make documentation tarballs more reproducible.</changelog>
  <changelog author="rguenther@suse.com" date="1664280000">- Add llvm-testsuite-keep-DFLTCC.patch to keep DFLTCC environment
  during testing so we can disable the compression facility on
  s390x which causes testsuite issues.  [bsc#1189602]</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1669809600">- Drop RUNPATH from packaged binaries, instead set LD_LIBRARY_PATH
  for building and testing to simulate behavior of actual package.
  [bsc#1197773 , backported from OBS devel revision 25]
- Propagate the complete host environment to the tests run. This
  ensures that all envvars needed e.g. for the compiler to work
  correctly are present. This run libc++ tests successfully getting the env
  LD_LIBRARY_PATH, otherwise, library were not found.
  [llvm-propagate-host-env-to-libc++-test-suite.patch]</changelog>
</package>
<package pkgid="2172378613ecefa39c522b9597d81ab0a83f566941964ec142440e49ea53e171" name="clang11-devel" arch="x86_64">
  <version epoch="0" ver="11.0.1" rel="150300.3.8.1"/>
  <changelog author="rguenther@suse.com" date="1580990400">- Add back emacs-llvm Provides and Conflicts to clang subpackage
  originally in llvm-emacs-plugins to properly conflict with
  llvm-emacs-plugins from older llvm releases.</changelog>
  <changelog author="rguenther@suse.com" date="1581076800">- Add vim-plugin-llvm Conflicts to clang subpackage which now
  contains files formerly in llvmN-vim-plugins, conflicting with
  packages from older llvm releases.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1583582400">- Move all clang-related scripts (including those originally in
  clangX-checker), hmaptool and clang-doc into a common
  unversioned subpackage clang-tools, like python3-clang.
  The scripts reference the unversioned executables, so allowing
  multiple versions via update-alternatives would be misleading.
  The clang-doc executable will come with assets in Clang 10, so
  we have to take it out of update-alternatives as well.
  This should be the proper solution to boo#1161873.
- Include run-find-all-symbols script in clang-tools.
- Remove metadata for clangX-include-fixer subpackage that never
  had any files and thus wasn't released as rpm. There are so many
  clang binaries that packaging them separately doesn't scale.
- Fix lldb version string, adapt lldb-cmake.patch (boo#1165517).
- Remove unneccesary libtool dependency.
- Don't let clang depend on libc++, we link it with libstdc++.
- Recommend gold plugin if clang and gold are installed.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1583928000">- Require clang-tools for clangX-devel.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1584964800">- Remove conflicts of clang-tools with {clang,llvm}{7,8}: the
  relevant binaries have been removed from those packages. This
  allows having clang-tools together with older versions of llvm.
  For a smooth installation we add OrderWithRequires dependencies.
- Fix typos in (still inactive) !%{with clang_scripts} part.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1585051200">- Update to version 10.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/10.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools: llvm-ifs, llvm-install-name-tool, llvm-reduce.
  * New Clang tools: clang-move, clang-offload-wrapper, pp-trace.
  * lldb-mi moved to a separate project and is no longer available.
- Dropped obsolete patches:
  * clang-fix-powerpc-triplet.patch
  * clang-riscv64-rv64gc.diff
  * compiler-rt-move-fdp.patch
  * compiler-rt-sanitizer-ipc-perm.patch
  * D60657-riscv-pcrel_lo.diff
  * gwp-asan-lto.patch
  * libcxx-tests-linux-distribution.patch
  * link-lldb-shared.patch
  * llvm-riscv64-fix-cffi.diff
  * openmp-export-fini.patch
  * riscv-eh-frame-fixup.patch
  * riscv64-suse-linux.patch
- Rebased patches:
  * assume-opensuse.patch
  * link-clang-tools-extra-shared.patch
  * lldb-cmake.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch
  * lto-disable-cache.patch
  * polly-pthread.patch
  * tests-use-python3.patch
- Add tablegen-test-link-static.patch: fix TableGenTests.
- Add ValueLattice-Add-new-state-for-undef-constants.patch: fix
  miscompilation on ppc64/s390x that was leading to test crashes.
- Enable ThinLTO on aarch64.
- Disable ThinLTO on ppc64le due to internal error in gold.
- Delete object files and static libraries from build tree in
  %install already, because debuginfo extraction happens after
  that. If we do it after %check, we run out of disk space.
- Run tests "manually", because we've already removed many targets.
- Don't build unit tests, because some of them are now statically
  linked, which is very expensive with LTO. Also unit tests are
  probably not very interesting on the distribution level, we don't
  expect them to perform different than in upstream. The relevant
  upstream change for this is https://reviews.llvm.org/D54439.
- Drop %if for openSUSE 13.2.</changelog>
  <changelog author="idonmez@suse.com" date="1592913600">- Add lld-default-sha1.patch to make lld generate SHA1 build-ids by
  default, otherwise our tools cannot process the debuginfo.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1594555200">- Factor out computation of the number of jobs into a macro.
- Choose mem_per_compile_job dependent on build stage, let stage 1
  on x86_64 use more memory.
- More generous memory allocation on riscv64.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1595419200">- Update to version 10.0.1.
  * This release contains bug-fixes for the LLVM 10.0.0 release.
    This release is API and ABI compatible with 10.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Replace ValueLattice-Add-new-state-for-undef-constants.patch,
  which landed upstream in a modified version, by
  restore-llvm10-abi.patch that resets the ABI to our 10.0.0.
- Rewrite lld-default-sha1.patch to be version-independent.
- Set flags consistently, so that we don't lose -DNDEBUG on 32-bit
  architectures. Also we don't need the opt flags twice. This leads
  to a significant reduction in binary sizes on 32-bit arches.
- Make it easier to package release candidates.
- Enable most tests on 32-bit ARM, but not for libcxx.
- Add fix-atomics-test.patch for architectures where native atomics
  are not available.
- Lower build constraints for riscv64 a bit to allow building on
  more workers.
- Allow more compile jobs in stage 2.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1596110400">- Add ld.lld as an alternative for ld. (boo#1174656)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1603108800">- Update to version 11.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/11.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools: llvm-gsymutil, llvm-ml.
  * clang-import-test was removed.
- Drop obsolete patches:
  * clang-ignore-stack-clash-protector.patch
  * fix-atomics-test.patch
  * restore-llvm10-abi.patch
- Rebase patches:
  * clang-resourcedirs.patch
  * default-to-i586.patch
  * link-clang-shared.patch
  * link-clang-tools-extra-shared.patch
  * lldb-cmake.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Add llvm-exegesis-link-dylib.patch: link llvm-exegesis with
  libLLVM.so, the advanced functionality is not available anyway.
- Remove -fstack-clash-protection on architectures where it isn't
  actually supported, because that prevents feature detection.
- Make sure we also build AttributeReference for the documentation.
  This requires building via CMake. Also shorten the paths.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1603540800">- Disable ThinLTO on aarch64 because of hangs. (boo#1178070)
- Enable ThinLTO on ppc64 and ppc64le, the internal error is gone.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1605355200">- Let CMake files in {llvm,clang}X-devel refer to the versioned
  binaries that come with the package instead of the symlink
  managed by update-alternatives. (boo#1178513)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1606132800">- Add compiler-rt-dont-compile-assembly-files-as-c.patch to fix
  build failure with newer CMake versions.</changelog>
  <changelog author="schwab@suse.de" date="1607947200">- polly-pthread.patch: Remove, std::call_once no longer needs libpthread</changelog>
  <changelog author="gmbr3@opensuse.org" date="1609502400">- Move BFD plugins to %{_libdir}</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1609934400">- Increase required RAM for aarch64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1610193600">- Update to version 11.0.1.
  * This release contains bug-fixes for the LLVM 11.0.0 release.
    This release is API and ABI compatible with 11.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Drop obsolete compiler-rt-dont-compile-assembly-files-as-c.patch.
- Make documentation tarballs more reproducible.</changelog>
  <changelog author="rguenther@suse.com" date="1664280000">- Add llvm-testsuite-keep-DFLTCC.patch to keep DFLTCC environment
  during testing so we can disable the compression facility on
  s390x which causes testsuite issues.  [bsc#1189602]</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1669809600">- Drop RUNPATH from packaged binaries, instead set LD_LIBRARY_PATH
  for building and testing to simulate behavior of actual package.
  [bsc#1197773 , backported from OBS devel revision 25]
- Propagate the complete host environment to the tests run. This
  ensures that all envvars needed e.g. for the compiler to work
  correctly are present. This run libc++ tests successfully getting the env
  LD_LIBRARY_PATH, otherwise, library were not found.
  [llvm-propagate-host-env-to-libc++-test-suite.patch]</changelog>
</package>
<package pkgid="a373958aa7a1aad4de538a2419e1454833a59945fc339071b272216a6a2af6d5" name="clang11-devel-32bit" arch="x86_64">
  <version epoch="0" ver="11.0.1" rel="150300.3.8.1"/>
  <changelog author="rguenther@suse.com" date="1580990400">- Add back emacs-llvm Provides and Conflicts to clang subpackage
  originally in llvm-emacs-plugins to properly conflict with
  llvm-emacs-plugins from older llvm releases.</changelog>
  <changelog author="rguenther@suse.com" date="1581076800">- Add vim-plugin-llvm Conflicts to clang subpackage which now
  contains files formerly in llvmN-vim-plugins, conflicting with
  packages from older llvm releases.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1583582400">- Move all clang-related scripts (including those originally in
  clangX-checker), hmaptool and clang-doc into a common
  unversioned subpackage clang-tools, like python3-clang.
  The scripts reference the unversioned executables, so allowing
  multiple versions via update-alternatives would be misleading.
  The clang-doc executable will come with assets in Clang 10, so
  we have to take it out of update-alternatives as well.
  This should be the proper solution to boo#1161873.
- Include run-find-all-symbols script in clang-tools.
- Remove metadata for clangX-include-fixer subpackage that never
  had any files and thus wasn't released as rpm. There are so many
  clang binaries that packaging them separately doesn't scale.
- Fix lldb version string, adapt lldb-cmake.patch (boo#1165517).
- Remove unneccesary libtool dependency.
- Don't let clang depend on libc++, we link it with libstdc++.
- Recommend gold plugin if clang and gold are installed.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1583928000">- Require clang-tools for clangX-devel.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1584964800">- Remove conflicts of clang-tools with {clang,llvm}{7,8}: the
  relevant binaries have been removed from those packages. This
  allows having clang-tools together with older versions of llvm.
  For a smooth installation we add OrderWithRequires dependencies.
- Fix typos in (still inactive) !%{with clang_scripts} part.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1585051200">- Update to version 10.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/10.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools: llvm-ifs, llvm-install-name-tool, llvm-reduce.
  * New Clang tools: clang-move, clang-offload-wrapper, pp-trace.
  * lldb-mi moved to a separate project and is no longer available.
- Dropped obsolete patches:
  * clang-fix-powerpc-triplet.patch
  * clang-riscv64-rv64gc.diff
  * compiler-rt-move-fdp.patch
  * compiler-rt-sanitizer-ipc-perm.patch
  * D60657-riscv-pcrel_lo.diff
  * gwp-asan-lto.patch
  * libcxx-tests-linux-distribution.patch
  * link-lldb-shared.patch
  * llvm-riscv64-fix-cffi.diff
  * openmp-export-fini.patch
  * riscv-eh-frame-fixup.patch
  * riscv64-suse-linux.patch
- Rebased patches:
  * assume-opensuse.patch
  * link-clang-tools-extra-shared.patch
  * lldb-cmake.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch
  * lto-disable-cache.patch
  * polly-pthread.patch
  * tests-use-python3.patch
- Add tablegen-test-link-static.patch: fix TableGenTests.
- Add ValueLattice-Add-new-state-for-undef-constants.patch: fix
  miscompilation on ppc64/s390x that was leading to test crashes.
- Enable ThinLTO on aarch64.
- Disable ThinLTO on ppc64le due to internal error in gold.
- Delete object files and static libraries from build tree in
  %install already, because debuginfo extraction happens after
  that. If we do it after %check, we run out of disk space.
- Run tests "manually", because we've already removed many targets.
- Don't build unit tests, because some of them are now statically
  linked, which is very expensive with LTO. Also unit tests are
  probably not very interesting on the distribution level, we don't
  expect them to perform different than in upstream. The relevant
  upstream change for this is https://reviews.llvm.org/D54439.
- Drop %if for openSUSE 13.2.</changelog>
  <changelog author="idonmez@suse.com" date="1592913600">- Add lld-default-sha1.patch to make lld generate SHA1 build-ids by
  default, otherwise our tools cannot process the debuginfo.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1594555200">- Factor out computation of the number of jobs into a macro.
- Choose mem_per_compile_job dependent on build stage, let stage 1
  on x86_64 use more memory.
- More generous memory allocation on riscv64.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1595419200">- Update to version 10.0.1.
  * This release contains bug-fixes for the LLVM 10.0.0 release.
    This release is API and ABI compatible with 10.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Replace ValueLattice-Add-new-state-for-undef-constants.patch,
  which landed upstream in a modified version, by
  restore-llvm10-abi.patch that resets the ABI to our 10.0.0.
- Rewrite lld-default-sha1.patch to be version-independent.
- Set flags consistently, so that we don't lose -DNDEBUG on 32-bit
  architectures. Also we don't need the opt flags twice. This leads
  to a significant reduction in binary sizes on 32-bit arches.
- Make it easier to package release candidates.
- Enable most tests on 32-bit ARM, but not for libcxx.
- Add fix-atomics-test.patch for architectures where native atomics
  are not available.
- Lower build constraints for riscv64 a bit to allow building on
  more workers.
- Allow more compile jobs in stage 2.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1596110400">- Add ld.lld as an alternative for ld. (boo#1174656)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1603108800">- Update to version 11.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/11.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools: llvm-gsymutil, llvm-ml.
  * clang-import-test was removed.
- Drop obsolete patches:
  * clang-ignore-stack-clash-protector.patch
  * fix-atomics-test.patch
  * restore-llvm10-abi.patch
- Rebase patches:
  * clang-resourcedirs.patch
  * default-to-i586.patch
  * link-clang-shared.patch
  * link-clang-tools-extra-shared.patch
  * lldb-cmake.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Add llvm-exegesis-link-dylib.patch: link llvm-exegesis with
  libLLVM.so, the advanced functionality is not available anyway.
- Remove -fstack-clash-protection on architectures where it isn't
  actually supported, because that prevents feature detection.
- Make sure we also build AttributeReference for the documentation.
  This requires building via CMake. Also shorten the paths.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1603540800">- Disable ThinLTO on aarch64 because of hangs. (boo#1178070)
- Enable ThinLTO on ppc64 and ppc64le, the internal error is gone.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1605355200">- Let CMake files in {llvm,clang}X-devel refer to the versioned
  binaries that come with the package instead of the symlink
  managed by update-alternatives. (boo#1178513)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1606132800">- Add compiler-rt-dont-compile-assembly-files-as-c.patch to fix
  build failure with newer CMake versions.</changelog>
  <changelog author="schwab@suse.de" date="1607947200">- polly-pthread.patch: Remove, std::call_once no longer needs libpthread</changelog>
  <changelog author="gmbr3@opensuse.org" date="1609502400">- Move BFD plugins to %{_libdir}</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1609934400">- Increase required RAM for aarch64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1610193600">- Update to version 11.0.1.
  * This release contains bug-fixes for the LLVM 11.0.0 release.
    This release is API and ABI compatible with 11.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Drop obsolete compiler-rt-dont-compile-assembly-files-as-c.patch.
- Make documentation tarballs more reproducible.</changelog>
  <changelog author="rguenther@suse.com" date="1664280000">- Add llvm-testsuite-keep-DFLTCC.patch to keep DFLTCC environment
  during testing so we can disable the compression facility on
  s390x which causes testsuite issues.  [bsc#1189602]</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1669809600">- Drop RUNPATH from packaged binaries, instead set LD_LIBRARY_PATH
  for building and testing to simulate behavior of actual package.
  [bsc#1197773 , backported from OBS devel revision 25]
- Propagate the complete host environment to the tests run. This
  ensures that all envvars needed e.g. for the compiler to work
  correctly are present. This run libc++ tests successfully getting the env
  LD_LIBRARY_PATH, otherwise, library were not found.
  [llvm-propagate-host-env-to-libc++-test-suite.patch]</changelog>
</package>
<package pkgid="ab4605c036b4fa7dc4a111af9fb14a6706351a073cf6baccdb64e1160efa28bd" name="clang11-doc" arch="noarch">
  <version epoch="0" ver="11.0.1" rel="150300.3.8.1"/>
  <changelog author="rguenther@suse.com" date="1580990400">- Add back emacs-llvm Provides and Conflicts to clang subpackage
  originally in llvm-emacs-plugins to properly conflict with
  llvm-emacs-plugins from older llvm releases.</changelog>
  <changelog author="rguenther@suse.com" date="1581076800">- Add vim-plugin-llvm Conflicts to clang subpackage which now
  contains files formerly in llvmN-vim-plugins, conflicting with
  packages from older llvm releases.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1583582400">- Move all clang-related scripts (including those originally in
  clangX-checker), hmaptool and clang-doc into a common
  unversioned subpackage clang-tools, like python3-clang.
  The scripts reference the unversioned executables, so allowing
  multiple versions via update-alternatives would be misleading.
  The clang-doc executable will come with assets in Clang 10, so
  we have to take it out of update-alternatives as well.
  This should be the proper solution to boo#1161873.
- Include run-find-all-symbols script in clang-tools.
- Remove metadata for clangX-include-fixer subpackage that never
  had any files and thus wasn't released as rpm. There are so many
  clang binaries that packaging them separately doesn't scale.
- Fix lldb version string, adapt lldb-cmake.patch (boo#1165517).
- Remove unneccesary libtool dependency.
- Don't let clang depend on libc++, we link it with libstdc++.
- Recommend gold plugin if clang and gold are installed.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1583928000">- Require clang-tools for clangX-devel.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1584964800">- Remove conflicts of clang-tools with {clang,llvm}{7,8}: the
  relevant binaries have been removed from those packages. This
  allows having clang-tools together with older versions of llvm.
  For a smooth installation we add OrderWithRequires dependencies.
- Fix typos in (still inactive) !%{with clang_scripts} part.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1585051200">- Update to version 10.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/10.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/10.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools: llvm-ifs, llvm-install-name-tool, llvm-reduce.
  * New Clang tools: clang-move, clang-offload-wrapper, pp-trace.
  * lldb-mi moved to a separate project and is no longer available.
- Dropped obsolete patches:
  * clang-fix-powerpc-triplet.patch
  * clang-riscv64-rv64gc.diff
  * compiler-rt-move-fdp.patch
  * compiler-rt-sanitizer-ipc-perm.patch
  * D60657-riscv-pcrel_lo.diff
  * gwp-asan-lto.patch
  * libcxx-tests-linux-distribution.patch
  * link-lldb-shared.patch
  * llvm-riscv64-fix-cffi.diff
  * openmp-export-fini.patch
  * riscv-eh-frame-fixup.patch
  * riscv64-suse-linux.patch
- Rebased patches:
  * assume-opensuse.patch
  * link-clang-tools-extra-shared.patch
  * lldb-cmake.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch
  * lto-disable-cache.patch
  * polly-pthread.patch
  * tests-use-python3.patch
- Add tablegen-test-link-static.patch: fix TableGenTests.
- Add ValueLattice-Add-new-state-for-undef-constants.patch: fix
  miscompilation on ppc64/s390x that was leading to test crashes.
- Enable ThinLTO on aarch64.
- Disable ThinLTO on ppc64le due to internal error in gold.
- Delete object files and static libraries from build tree in
  %install already, because debuginfo extraction happens after
  that. If we do it after %check, we run out of disk space.
- Run tests "manually", because we've already removed many targets.
- Don't build unit tests, because some of them are now statically
  linked, which is very expensive with LTO. Also unit tests are
  probably not very interesting on the distribution level, we don't
  expect them to perform different than in upstream. The relevant
  upstream change for this is https://reviews.llvm.org/D54439.
- Drop %if for openSUSE 13.2.</changelog>
  <changelog author="idonmez@suse.com" date="1592913600">- Add lld-default-sha1.patch to make lld generate SHA1 build-ids by
  default, otherwise our tools cannot process the debuginfo.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1594555200">- Factor out computation of the number of jobs into a macro.
- Choose mem_per_compile_job dependent on build stage, let stage 1
  on x86_64 use more memory.
- More generous memory allocation on riscv64.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1595419200">- Update to version 10.0.1.
  * This release contains bug-fixes for the LLVM 10.0.0 release.
    This release is API and ABI compatible with 10.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Replace ValueLattice-Add-new-state-for-undef-constants.patch,
  which landed upstream in a modified version, by
  restore-llvm10-abi.patch that resets the ABI to our 10.0.0.
- Rewrite lld-default-sha1.patch to be version-independent.
- Set flags consistently, so that we don't lose -DNDEBUG on 32-bit
  architectures. Also we don't need the opt flags twice. This leads
  to a significant reduction in binary sizes on 32-bit arches.
- Make it easier to package release candidates.
- Enable most tests on 32-bit ARM, but not for libcxx.
- Add fix-atomics-test.patch for architectures where native atomics
  are not available.
- Lower build constraints for riscv64 a bit to allow building on
  more workers.
- Allow more compile jobs in stage 2.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1596110400">- Add ld.lld as an alternative for ld. (boo#1174656)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1603108800">- Update to version 11.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/11.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/11.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools: llvm-gsymutil, llvm-ml.
  * clang-import-test was removed.
- Drop obsolete patches:
  * clang-ignore-stack-clash-protector.patch
  * fix-atomics-test.patch
  * restore-llvm10-abi.patch
- Rebase patches:
  * clang-resourcedirs.patch
  * default-to-i586.patch
  * link-clang-shared.patch
  * link-clang-tools-extra-shared.patch
  * lldb-cmake.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Add llvm-exegesis-link-dylib.patch: link llvm-exegesis with
  libLLVM.so, the advanced functionality is not available anyway.
- Remove -fstack-clash-protection on architectures where it isn't
  actually supported, because that prevents feature detection.
- Make sure we also build AttributeReference for the documentation.
  This requires building via CMake. Also shorten the paths.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1603540800">- Disable ThinLTO on aarch64 because of hangs. (boo#1178070)
- Enable ThinLTO on ppc64 and ppc64le, the internal error is gone.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1605355200">- Let CMake files in {llvm,clang}X-devel refer to the versioned
  binaries that come with the package instead of the symlink
  managed by update-alternatives. (boo#1178513)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1606132800">- Add compiler-rt-dont-compile-assembly-files-as-c.patch to fix
  build failure with newer CMake versions.</changelog>
  <changelog author="schwab@suse.de" date="1607947200">- polly-pthread.patch: Remove, std::call_once no longer needs libpthread</changelog>
  <changelog author="gmbr3@opensuse.org" date="1609502400">- Move BFD plugins to %{_libdir}</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1609934400">- Increase required RAM for aarch64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1610193600">- Update to version 11.0.1.
  * This release contains bug-fixes for the LLVM 11.0.0 release.
    This release is API and ABI compatible with 11.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Drop obsolete compiler-rt-dont-compile-assembly-files-as-c.patch.
- Make documentation tarballs more reproducible.</changelog>
  <changelog author="rguenther@suse.com" date="1664280000">- Add llvm-testsuite-keep-DFLTCC.patch to keep DFLTCC environment
  during testing so we can disable the compression facility on
  s390x which causes testsuite issues.  [bsc#1189602]</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1669809600">- Drop RUNPATH from packaged binaries, instead set LD_LIBRARY_PATH
  for building and testing to simulate behavior of actual package.
  [bsc#1197773 , backported from OBS devel revision 25]
- Propagate the complete host environment to the tests run. This
  ensures that all envvars needed e.g. for the compiler to work
  correctly are present. This run libc++ tests successfully getting the env
  LD_LIBRARY_PATH, otherwise, library were not found.
  [llvm-propagate-host-env-to-libc++-test-suite.patch]</changelog>
</package>
<package pkgid="6df836477158681db66de192b3d59ae8528c0ac72416722a5239dfd56c886cab" name="clang15" arch="aarch64">
  <version epoch="0" ver="15.0.7" rel="150500.4.11.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1655380800">- Update to version 14.0.5.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1656936000">- Update to version 14.0.6.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1660046400">- Add llvm-glibc-2-36.patch in order to address boo#1202215.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660132800">- Add WebAssembly support for all architectures.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660392000">- Use black RPM macro magic to deduplicate binary lists. This
  should have no effect on the generated RPM but shaves ~400 lines
  off the specfile and hopefully makes future maintenance easier.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661256000">- Don't declare python3-clang as noarch: Python packages are
  installed into %{_libdir}.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661515200">- Add llvm-lifetime-for-rust.patch to have Rust memory management
  functions considered as lifetime markers. This should aid dead
  store elimination to dynamically allocated memory in Rust code.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662206400">- Make sure we keep -DNDEBUG. At some point %{optflags} must have
  lost it, perhaps because CMake usually adds it on top. So when
  overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to
  take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF,
  because that's the default anyway and hasn't helped here.
- Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation
  caused by mixing up values of the current and previous iteration.
  (See gh#llvm/llvm-project#56242.)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662465600">- Update to version 15.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfod: Provides debug info to remote hosts.
  - llvm-dwarfutil: Can copy and manipulate debug info.
  - llvm-remark-size-diff: Compute diff between remark files.
  * New Clang tools:
  - clang-offload-packager: Bundle multiple objects into single
    fat binaries including offload code.
  - clang-pseudo: Approximate heuristic parser for C++.
- Rebase patches:
  * check-no-llvm-exegesis.patch
  * link-clang-tools-extra-shared.patch
  * lld-default-sha1.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Drop patches that have landed upstream:
  * clang-repl-private-deps.patch
  * llvm-glibc-2-36.patch
  * llvm-scev-fix-isImpliedViaMerge.patch
- Drop llvm-lifetime-for-rust.patch: this is now solved via
  attributes and LLVM doesn't need a hardcoded list of allocation
  functions anymore.
- Add llvm-link-atomic.patch to fix build on ppc.
- Add libcxx-test-library-path.patch to fix libc++ tests failing
  without RUNPATH on libc++.so.
- Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l.
- Thanks to Andreas Schwab for most of the rebasing!</changelog>
  <changelog author="schwab@suse.de" date="1662984000">- Use correct LLVM_HOST_TRIPLE for riscv64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663761600">- Always drop -gnu from triple for consistency. Patch a test that
  was looking for -linux- in clang-test-xfail-gnuless-triple.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663848000">- Update to version 15.0.1.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1664884800">- Update to version 15.0.2.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1666872000">- Update to version 15.0.3.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix
  lowering of non-canonical vector comparison with zero on armv7,
  preventing a crash (boo#1204267, gh#llvm/llvm-project#58514).
- Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1667736000">- Update to version 15.0.4.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1668600000">- Update to version 15.0.5.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Remove obsolete lldb-swig-4.1.0-build-fix.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Manage clang-cpp with update-alternatives like other binaries.
  Solves upgrade issues from Leap 15.5 to 15.6.  [boo#1221183]</changelog>
</package>
<package pkgid="f8df1e5dc3236e70a9c5c74210221db9396300a91d7c042afd6d75634bfdbe51" name="clang15" arch="ppc64le">
  <version epoch="0" ver="15.0.7" rel="150500.4.11.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1655380800">- Update to version 14.0.5.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1656936000">- Update to version 14.0.6.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1660046400">- Add llvm-glibc-2-36.patch in order to address boo#1202215.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660132800">- Add WebAssembly support for all architectures.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660392000">- Use black RPM macro magic to deduplicate binary lists. This
  should have no effect on the generated RPM but shaves ~400 lines
  off the specfile and hopefully makes future maintenance easier.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661256000">- Don't declare python3-clang as noarch: Python packages are
  installed into %{_libdir}.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661515200">- Add llvm-lifetime-for-rust.patch to have Rust memory management
  functions considered as lifetime markers. This should aid dead
  store elimination to dynamically allocated memory in Rust code.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662206400">- Make sure we keep -DNDEBUG. At some point %{optflags} must have
  lost it, perhaps because CMake usually adds it on top. So when
  overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to
  take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF,
  because that's the default anyway and hasn't helped here.
- Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation
  caused by mixing up values of the current and previous iteration.
  (See gh#llvm/llvm-project#56242.)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662465600">- Update to version 15.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfod: Provides debug info to remote hosts.
  - llvm-dwarfutil: Can copy and manipulate debug info.
  - llvm-remark-size-diff: Compute diff between remark files.
  * New Clang tools:
  - clang-offload-packager: Bundle multiple objects into single
    fat binaries including offload code.
  - clang-pseudo: Approximate heuristic parser for C++.
- Rebase patches:
  * check-no-llvm-exegesis.patch
  * link-clang-tools-extra-shared.patch
  * lld-default-sha1.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Drop patches that have landed upstream:
  * clang-repl-private-deps.patch
  * llvm-glibc-2-36.patch
  * llvm-scev-fix-isImpliedViaMerge.patch
- Drop llvm-lifetime-for-rust.patch: this is now solved via
  attributes and LLVM doesn't need a hardcoded list of allocation
  functions anymore.
- Add llvm-link-atomic.patch to fix build on ppc.
- Add libcxx-test-library-path.patch to fix libc++ tests failing
  without RUNPATH on libc++.so.
- Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l.
- Thanks to Andreas Schwab for most of the rebasing!</changelog>
  <changelog author="schwab@suse.de" date="1662984000">- Use correct LLVM_HOST_TRIPLE for riscv64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663761600">- Always drop -gnu from triple for consistency. Patch a test that
  was looking for -linux- in clang-test-xfail-gnuless-triple.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663848000">- Update to version 15.0.1.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1664884800">- Update to version 15.0.2.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1666872000">- Update to version 15.0.3.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix
  lowering of non-canonical vector comparison with zero on armv7,
  preventing a crash (boo#1204267, gh#llvm/llvm-project#58514).
- Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1667736000">- Update to version 15.0.4.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1668600000">- Update to version 15.0.5.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Remove obsolete lldb-swig-4.1.0-build-fix.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Manage clang-cpp with update-alternatives like other binaries.
  Solves upgrade issues from Leap 15.5 to 15.6.  [boo#1221183]</changelog>
</package>
<package pkgid="cff8951e2121b02ae7071fe4e277986415525cd6b5bf40a28f73df2a36496d56" name="clang15" arch="s390x">
  <version epoch="0" ver="15.0.7" rel="150500.4.11.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1655380800">- Update to version 14.0.5.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1656936000">- Update to version 14.0.6.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1660046400">- Add llvm-glibc-2-36.patch in order to address boo#1202215.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660132800">- Add WebAssembly support for all architectures.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660392000">- Use black RPM macro magic to deduplicate binary lists. This
  should have no effect on the generated RPM but shaves ~400 lines
  off the specfile and hopefully makes future maintenance easier.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661256000">- Don't declare python3-clang as noarch: Python packages are
  installed into %{_libdir}.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661515200">- Add llvm-lifetime-for-rust.patch to have Rust memory management
  functions considered as lifetime markers. This should aid dead
  store elimination to dynamically allocated memory in Rust code.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662206400">- Make sure we keep -DNDEBUG. At some point %{optflags} must have
  lost it, perhaps because CMake usually adds it on top. So when
  overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to
  take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF,
  because that's the default anyway and hasn't helped here.
- Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation
  caused by mixing up values of the current and previous iteration.
  (See gh#llvm/llvm-project#56242.)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662465600">- Update to version 15.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfod: Provides debug info to remote hosts.
  - llvm-dwarfutil: Can copy and manipulate debug info.
  - llvm-remark-size-diff: Compute diff between remark files.
  * New Clang tools:
  - clang-offload-packager: Bundle multiple objects into single
    fat binaries including offload code.
  - clang-pseudo: Approximate heuristic parser for C++.
- Rebase patches:
  * check-no-llvm-exegesis.patch
  * link-clang-tools-extra-shared.patch
  * lld-default-sha1.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Drop patches that have landed upstream:
  * clang-repl-private-deps.patch
  * llvm-glibc-2-36.patch
  * llvm-scev-fix-isImpliedViaMerge.patch
- Drop llvm-lifetime-for-rust.patch: this is now solved via
  attributes and LLVM doesn't need a hardcoded list of allocation
  functions anymore.
- Add llvm-link-atomic.patch to fix build on ppc.
- Add libcxx-test-library-path.patch to fix libc++ tests failing
  without RUNPATH on libc++.so.
- Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l.
- Thanks to Andreas Schwab for most of the rebasing!</changelog>
  <changelog author="schwab@suse.de" date="1662984000">- Use correct LLVM_HOST_TRIPLE for riscv64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663761600">- Always drop -gnu from triple for consistency. Patch a test that
  was looking for -linux- in clang-test-xfail-gnuless-triple.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663848000">- Update to version 15.0.1.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1664884800">- Update to version 15.0.2.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1666872000">- Update to version 15.0.3.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix
  lowering of non-canonical vector comparison with zero on armv7,
  preventing a crash (boo#1204267, gh#llvm/llvm-project#58514).
- Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1667736000">- Update to version 15.0.4.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1668600000">- Update to version 15.0.5.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Remove obsolete lldb-swig-4.1.0-build-fix.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Manage clang-cpp with update-alternatives like other binaries.
  Solves upgrade issues from Leap 15.5 to 15.6.  [boo#1221183]</changelog>
</package>
<package pkgid="b3d029fd87969c8a092c362eb7c3dc922c7cb2a8ddf17528a164511d48fa060c" name="clang15" arch="x86_64">
  <version epoch="0" ver="15.0.7" rel="150500.4.11.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1655380800">- Update to version 14.0.5.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1656936000">- Update to version 14.0.6.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1660046400">- Add llvm-glibc-2-36.patch in order to address boo#1202215.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660132800">- Add WebAssembly support for all architectures.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660392000">- Use black RPM macro magic to deduplicate binary lists. This
  should have no effect on the generated RPM but shaves ~400 lines
  off the specfile and hopefully makes future maintenance easier.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661256000">- Don't declare python3-clang as noarch: Python packages are
  installed into %{_libdir}.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661515200">- Add llvm-lifetime-for-rust.patch to have Rust memory management
  functions considered as lifetime markers. This should aid dead
  store elimination to dynamically allocated memory in Rust code.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662206400">- Make sure we keep -DNDEBUG. At some point %{optflags} must have
  lost it, perhaps because CMake usually adds it on top. So when
  overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to
  take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF,
  because that's the default anyway and hasn't helped here.
- Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation
  caused by mixing up values of the current and previous iteration.
  (See gh#llvm/llvm-project#56242.)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662465600">- Update to version 15.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfod: Provides debug info to remote hosts.
  - llvm-dwarfutil: Can copy and manipulate debug info.
  - llvm-remark-size-diff: Compute diff between remark files.
  * New Clang tools:
  - clang-offload-packager: Bundle multiple objects into single
    fat binaries including offload code.
  - clang-pseudo: Approximate heuristic parser for C++.
- Rebase patches:
  * check-no-llvm-exegesis.patch
  * link-clang-tools-extra-shared.patch
  * lld-default-sha1.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Drop patches that have landed upstream:
  * clang-repl-private-deps.patch
  * llvm-glibc-2-36.patch
  * llvm-scev-fix-isImpliedViaMerge.patch
- Drop llvm-lifetime-for-rust.patch: this is now solved via
  attributes and LLVM doesn't need a hardcoded list of allocation
  functions anymore.
- Add llvm-link-atomic.patch to fix build on ppc.
- Add libcxx-test-library-path.patch to fix libc++ tests failing
  without RUNPATH on libc++.so.
- Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l.
- Thanks to Andreas Schwab for most of the rebasing!</changelog>
  <changelog author="schwab@suse.de" date="1662984000">- Use correct LLVM_HOST_TRIPLE for riscv64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663761600">- Always drop -gnu from triple for consistency. Patch a test that
  was looking for -linux- in clang-test-xfail-gnuless-triple.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663848000">- Update to version 15.0.1.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1664884800">- Update to version 15.0.2.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1666872000">- Update to version 15.0.3.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix
  lowering of non-canonical vector comparison with zero on armv7,
  preventing a crash (boo#1204267, gh#llvm/llvm-project#58514).
- Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1667736000">- Update to version 15.0.4.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1668600000">- Update to version 15.0.5.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Remove obsolete lldb-swig-4.1.0-build-fix.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Manage clang-cpp with update-alternatives like other binaries.
  Solves upgrade issues from Leap 15.5 to 15.6.  [boo#1221183]</changelog>
</package>
<package pkgid="13d028f199e66cd4479c1c03e8eaa14c4c759770be224882a63ca4b0fa0133ed" name="clang15" arch="aarch64">
  <version epoch="0" ver="15.0.7" rel="150500.4.9.6"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1655380800">- Update to version 14.0.5.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1656936000">- Update to version 14.0.6.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1660046400">- Add llvm-glibc-2-36.patch in order to address boo#1202215.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660132800">- Add WebAssembly support for all architectures.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660392000">- Use black RPM macro magic to deduplicate binary lists. This
  should have no effect on the generated RPM but shaves ~400 lines
  off the specfile and hopefully makes future maintenance easier.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661256000">- Don't declare python3-clang as noarch: Python packages are
  installed into %{_libdir}.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661515200">- Add llvm-lifetime-for-rust.patch to have Rust memory management
  functions considered as lifetime markers. This should aid dead
  store elimination to dynamically allocated memory in Rust code.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662206400">- Make sure we keep -DNDEBUG. At some point %{optflags} must have
  lost it, perhaps because CMake usually adds it on top. So when
  overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to
  take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF,
  because that's the default anyway and hasn't helped here.
- Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation
  caused by mixing up values of the current and previous iteration.
  (See gh#llvm/llvm-project#56242.)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662465600">- Update to version 15.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfod: Provides debug info to remote hosts.
  - llvm-dwarfutil: Can copy and manipulate debug info.
  - llvm-remark-size-diff: Compute diff between remark files.
  * New Clang tools:
  - clang-offload-packager: Bundle multiple objects into single
    fat binaries including offload code.
  - clang-pseudo: Approximate heuristic parser for C++.
- Rebase patches:
  * check-no-llvm-exegesis.patch
  * link-clang-tools-extra-shared.patch
  * lld-default-sha1.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Drop patches that have landed upstream:
  * clang-repl-private-deps.patch
  * llvm-glibc-2-36.patch
  * llvm-scev-fix-isImpliedViaMerge.patch
- Drop llvm-lifetime-for-rust.patch: this is now solved via
  attributes and LLVM doesn't need a hardcoded list of allocation
  functions anymore.
- Add llvm-link-atomic.patch to fix build on ppc.
- Add libcxx-test-library-path.patch to fix libc++ tests failing
  without RUNPATH on libc++.so.
- Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l.
- Thanks to Andreas Schwab for most of the rebasing!</changelog>
  <changelog author="schwab@suse.de" date="1662984000">- Use correct LLVM_HOST_TRIPLE for riscv64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663761600">- Always drop -gnu from triple for consistency. Patch a test that
  was looking for -linux- in clang-test-xfail-gnuless-triple.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663848000">- Update to version 15.0.1.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1664884800">- Update to version 15.0.2.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1666872000">- Update to version 15.0.3.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix
  lowering of non-canonical vector comparison with zero on armv7,
  preventing a crash (boo#1204267, gh#llvm/llvm-project#58514).
- Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1667736000">- Update to version 15.0.4.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1668600000">- Update to version 15.0.5.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Remove obsolete lldb-swig-4.1.0-build-fix.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Manage clang-cpp with update-alternatives like other binaries.
  Solves upgrade issues from Leap 15.5 to 15.6.  [boo#1221183]</changelog>
</package>
<package pkgid="53dd147fed63d200eb705a104a9fa71e56b3d8f24d1c51786fc7fe9fedd65b22" name="clang15" arch="ppc64le">
  <version epoch="0" ver="15.0.7" rel="150500.4.9.6"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1655380800">- Update to version 14.0.5.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1656936000">- Update to version 14.0.6.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1660046400">- Add llvm-glibc-2-36.patch in order to address boo#1202215.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660132800">- Add WebAssembly support for all architectures.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660392000">- Use black RPM macro magic to deduplicate binary lists. This
  should have no effect on the generated RPM but shaves ~400 lines
  off the specfile and hopefully makes future maintenance easier.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661256000">- Don't declare python3-clang as noarch: Python packages are
  installed into %{_libdir}.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661515200">- Add llvm-lifetime-for-rust.patch to have Rust memory management
  functions considered as lifetime markers. This should aid dead
  store elimination to dynamically allocated memory in Rust code.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662206400">- Make sure we keep -DNDEBUG. At some point %{optflags} must have
  lost it, perhaps because CMake usually adds it on top. So when
  overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to
  take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF,
  because that's the default anyway and hasn't helped here.
- Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation
  caused by mixing up values of the current and previous iteration.
  (See gh#llvm/llvm-project#56242.)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662465600">- Update to version 15.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfod: Provides debug info to remote hosts.
  - llvm-dwarfutil: Can copy and manipulate debug info.
  - llvm-remark-size-diff: Compute diff between remark files.
  * New Clang tools:
  - clang-offload-packager: Bundle multiple objects into single
    fat binaries including offload code.
  - clang-pseudo: Approximate heuristic parser for C++.
- Rebase patches:
  * check-no-llvm-exegesis.patch
  * link-clang-tools-extra-shared.patch
  * lld-default-sha1.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Drop patches that have landed upstream:
  * clang-repl-private-deps.patch
  * llvm-glibc-2-36.patch
  * llvm-scev-fix-isImpliedViaMerge.patch
- Drop llvm-lifetime-for-rust.patch: this is now solved via
  attributes and LLVM doesn't need a hardcoded list of allocation
  functions anymore.
- Add llvm-link-atomic.patch to fix build on ppc.
- Add libcxx-test-library-path.patch to fix libc++ tests failing
  without RUNPATH on libc++.so.
- Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l.
- Thanks to Andreas Schwab for most of the rebasing!</changelog>
  <changelog author="schwab@suse.de" date="1662984000">- Use correct LLVM_HOST_TRIPLE for riscv64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663761600">- Always drop -gnu from triple for consistency. Patch a test that
  was looking for -linux- in clang-test-xfail-gnuless-triple.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663848000">- Update to version 15.0.1.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1664884800">- Update to version 15.0.2.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1666872000">- Update to version 15.0.3.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix
  lowering of non-canonical vector comparison with zero on armv7,
  preventing a crash (boo#1204267, gh#llvm/llvm-project#58514).
- Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1667736000">- Update to version 15.0.4.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1668600000">- Update to version 15.0.5.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Remove obsolete lldb-swig-4.1.0-build-fix.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Manage clang-cpp with update-alternatives like other binaries.
  Solves upgrade issues from Leap 15.5 to 15.6.  [boo#1221183]</changelog>
</package>
<package pkgid="becfa213bab11b0249ba6f06cae84bbd106225e5ef9e722d3e20614c98d302df" name="clang15" arch="s390x">
  <version epoch="0" ver="15.0.7" rel="150500.4.9.6"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1655380800">- Update to version 14.0.5.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1656936000">- Update to version 14.0.6.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1660046400">- Add llvm-glibc-2-36.patch in order to address boo#1202215.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660132800">- Add WebAssembly support for all architectures.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660392000">- Use black RPM macro magic to deduplicate binary lists. This
  should have no effect on the generated RPM but shaves ~400 lines
  off the specfile and hopefully makes future maintenance easier.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661256000">- Don't declare python3-clang as noarch: Python packages are
  installed into %{_libdir}.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661515200">- Add llvm-lifetime-for-rust.patch to have Rust memory management
  functions considered as lifetime markers. This should aid dead
  store elimination to dynamically allocated memory in Rust code.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662206400">- Make sure we keep -DNDEBUG. At some point %{optflags} must have
  lost it, perhaps because CMake usually adds it on top. So when
  overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to
  take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF,
  because that's the default anyway and hasn't helped here.
- Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation
  caused by mixing up values of the current and previous iteration.
  (See gh#llvm/llvm-project#56242.)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662465600">- Update to version 15.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfod: Provides debug info to remote hosts.
  - llvm-dwarfutil: Can copy and manipulate debug info.
  - llvm-remark-size-diff: Compute diff between remark files.
  * New Clang tools:
  - clang-offload-packager: Bundle multiple objects into single
    fat binaries including offload code.
  - clang-pseudo: Approximate heuristic parser for C++.
- Rebase patches:
  * check-no-llvm-exegesis.patch
  * link-clang-tools-extra-shared.patch
  * lld-default-sha1.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Drop patches that have landed upstream:
  * clang-repl-private-deps.patch
  * llvm-glibc-2-36.patch
  * llvm-scev-fix-isImpliedViaMerge.patch
- Drop llvm-lifetime-for-rust.patch: this is now solved via
  attributes and LLVM doesn't need a hardcoded list of allocation
  functions anymore.
- Add llvm-link-atomic.patch to fix build on ppc.
- Add libcxx-test-library-path.patch to fix libc++ tests failing
  without RUNPATH on libc++.so.
- Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l.
- Thanks to Andreas Schwab for most of the rebasing!</changelog>
  <changelog author="schwab@suse.de" date="1662984000">- Use correct LLVM_HOST_TRIPLE for riscv64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663761600">- Always drop -gnu from triple for consistency. Patch a test that
  was looking for -linux- in clang-test-xfail-gnuless-triple.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663848000">- Update to version 15.0.1.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1664884800">- Update to version 15.0.2.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1666872000">- Update to version 15.0.3.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix
  lowering of non-canonical vector comparison with zero on armv7,
  preventing a crash (boo#1204267, gh#llvm/llvm-project#58514).
- Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1667736000">- Update to version 15.0.4.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1668600000">- Update to version 15.0.5.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Remove obsolete lldb-swig-4.1.0-build-fix.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Manage clang-cpp with update-alternatives like other binaries.
  Solves upgrade issues from Leap 15.5 to 15.6.  [boo#1221183]</changelog>
</package>
<package pkgid="d7c4aa9d711d700394b538e050212523df0ca8ae2043cbc4ebf94c15fcbf3555" name="clang15" arch="x86_64">
  <version epoch="0" ver="15.0.7" rel="150500.4.9.6"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1655380800">- Update to version 14.0.5.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1656936000">- Update to version 14.0.6.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1660046400">- Add llvm-glibc-2-36.patch in order to address boo#1202215.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660132800">- Add WebAssembly support for all architectures.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660392000">- Use black RPM macro magic to deduplicate binary lists. This
  should have no effect on the generated RPM but shaves ~400 lines
  off the specfile and hopefully makes future maintenance easier.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661256000">- Don't declare python3-clang as noarch: Python packages are
  installed into %{_libdir}.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661515200">- Add llvm-lifetime-for-rust.patch to have Rust memory management
  functions considered as lifetime markers. This should aid dead
  store elimination to dynamically allocated memory in Rust code.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662206400">- Make sure we keep -DNDEBUG. At some point %{optflags} must have
  lost it, perhaps because CMake usually adds it on top. So when
  overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to
  take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF,
  because that's the default anyway and hasn't helped here.
- Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation
  caused by mixing up values of the current and previous iteration.
  (See gh#llvm/llvm-project#56242.)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662465600">- Update to version 15.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfod: Provides debug info to remote hosts.
  - llvm-dwarfutil: Can copy and manipulate debug info.
  - llvm-remark-size-diff: Compute diff between remark files.
  * New Clang tools:
  - clang-offload-packager: Bundle multiple objects into single
    fat binaries including offload code.
  - clang-pseudo: Approximate heuristic parser for C++.
- Rebase patches:
  * check-no-llvm-exegesis.patch
  * link-clang-tools-extra-shared.patch
  * lld-default-sha1.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Drop patches that have landed upstream:
  * clang-repl-private-deps.patch
  * llvm-glibc-2-36.patch
  * llvm-scev-fix-isImpliedViaMerge.patch
- Drop llvm-lifetime-for-rust.patch: this is now solved via
  attributes and LLVM doesn't need a hardcoded list of allocation
  functions anymore.
- Add llvm-link-atomic.patch to fix build on ppc.
- Add libcxx-test-library-path.patch to fix libc++ tests failing
  without RUNPATH on libc++.so.
- Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l.
- Thanks to Andreas Schwab for most of the rebasing!</changelog>
  <changelog author="schwab@suse.de" date="1662984000">- Use correct LLVM_HOST_TRIPLE for riscv64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663761600">- Always drop -gnu from triple for consistency. Patch a test that
  was looking for -linux- in clang-test-xfail-gnuless-triple.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663848000">- Update to version 15.0.1.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1664884800">- Update to version 15.0.2.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1666872000">- Update to version 15.0.3.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix
  lowering of non-canonical vector comparison with zero on armv7,
  preventing a crash (boo#1204267, gh#llvm/llvm-project#58514).
- Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1667736000">- Update to version 15.0.4.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1668600000">- Update to version 15.0.5.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Remove obsolete lldb-swig-4.1.0-build-fix.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Manage clang-cpp with update-alternatives like other binaries.
  Solves upgrade issues from Leap 15.5 to 15.6.  [boo#1221183]</changelog>
</package>
<package pkgid="b2366276e5c1eb0e95d8ec358dfd5652c69fa7d633facf8233055cdc51930934" name="clang15-devel" arch="aarch64">
  <version epoch="0" ver="15.0.7" rel="150500.4.11.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1655380800">- Update to version 14.0.5.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1656936000">- Update to version 14.0.6.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1660046400">- Add llvm-glibc-2-36.patch in order to address boo#1202215.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660132800">- Add WebAssembly support for all architectures.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660392000">- Use black RPM macro magic to deduplicate binary lists. This
  should have no effect on the generated RPM but shaves ~400 lines
  off the specfile and hopefully makes future maintenance easier.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661256000">- Don't declare python3-clang as noarch: Python packages are
  installed into %{_libdir}.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661515200">- Add llvm-lifetime-for-rust.patch to have Rust memory management
  functions considered as lifetime markers. This should aid dead
  store elimination to dynamically allocated memory in Rust code.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662206400">- Make sure we keep -DNDEBUG. At some point %{optflags} must have
  lost it, perhaps because CMake usually adds it on top. So when
  overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to
  take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF,
  because that's the default anyway and hasn't helped here.
- Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation
  caused by mixing up values of the current and previous iteration.
  (See gh#llvm/llvm-project#56242.)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662465600">- Update to version 15.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfod: Provides debug info to remote hosts.
  - llvm-dwarfutil: Can copy and manipulate debug info.
  - llvm-remark-size-diff: Compute diff between remark files.
  * New Clang tools:
  - clang-offload-packager: Bundle multiple objects into single
    fat binaries including offload code.
  - clang-pseudo: Approximate heuristic parser for C++.
- Rebase patches:
  * check-no-llvm-exegesis.patch
  * link-clang-tools-extra-shared.patch
  * lld-default-sha1.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Drop patches that have landed upstream:
  * clang-repl-private-deps.patch
  * llvm-glibc-2-36.patch
  * llvm-scev-fix-isImpliedViaMerge.patch
- Drop llvm-lifetime-for-rust.patch: this is now solved via
  attributes and LLVM doesn't need a hardcoded list of allocation
  functions anymore.
- Add llvm-link-atomic.patch to fix build on ppc.
- Add libcxx-test-library-path.patch to fix libc++ tests failing
  without RUNPATH on libc++.so.
- Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l.
- Thanks to Andreas Schwab for most of the rebasing!</changelog>
  <changelog author="schwab@suse.de" date="1662984000">- Use correct LLVM_HOST_TRIPLE for riscv64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663761600">- Always drop -gnu from triple for consistency. Patch a test that
  was looking for -linux- in clang-test-xfail-gnuless-triple.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663848000">- Update to version 15.0.1.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1664884800">- Update to version 15.0.2.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1666872000">- Update to version 15.0.3.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix
  lowering of non-canonical vector comparison with zero on armv7,
  preventing a crash (boo#1204267, gh#llvm/llvm-project#58514).
- Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1667736000">- Update to version 15.0.4.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1668600000">- Update to version 15.0.5.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Remove obsolete lldb-swig-4.1.0-build-fix.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Manage clang-cpp with update-alternatives like other binaries.
  Solves upgrade issues from Leap 15.5 to 15.6.  [boo#1221183]</changelog>
</package>
<package pkgid="6b1291aa8f288ec521656893ea02816bb739f89ca752b781fb3464753be099b7" name="clang15-devel" arch="ppc64le">
  <version epoch="0" ver="15.0.7" rel="150500.4.11.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1655380800">- Update to version 14.0.5.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1656936000">- Update to version 14.0.6.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1660046400">- Add llvm-glibc-2-36.patch in order to address boo#1202215.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660132800">- Add WebAssembly support for all architectures.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660392000">- Use black RPM macro magic to deduplicate binary lists. This
  should have no effect on the generated RPM but shaves ~400 lines
  off the specfile and hopefully makes future maintenance easier.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661256000">- Don't declare python3-clang as noarch: Python packages are
  installed into %{_libdir}.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661515200">- Add llvm-lifetime-for-rust.patch to have Rust memory management
  functions considered as lifetime markers. This should aid dead
  store elimination to dynamically allocated memory in Rust code.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662206400">- Make sure we keep -DNDEBUG. At some point %{optflags} must have
  lost it, perhaps because CMake usually adds it on top. So when
  overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to
  take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF,
  because that's the default anyway and hasn't helped here.
- Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation
  caused by mixing up values of the current and previous iteration.
  (See gh#llvm/llvm-project#56242.)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662465600">- Update to version 15.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfod: Provides debug info to remote hosts.
  - llvm-dwarfutil: Can copy and manipulate debug info.
  - llvm-remark-size-diff: Compute diff between remark files.
  * New Clang tools:
  - clang-offload-packager: Bundle multiple objects into single
    fat binaries including offload code.
  - clang-pseudo: Approximate heuristic parser for C++.
- Rebase patches:
  * check-no-llvm-exegesis.patch
  * link-clang-tools-extra-shared.patch
  * lld-default-sha1.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Drop patches that have landed upstream:
  * clang-repl-private-deps.patch
  * llvm-glibc-2-36.patch
  * llvm-scev-fix-isImpliedViaMerge.patch
- Drop llvm-lifetime-for-rust.patch: this is now solved via
  attributes and LLVM doesn't need a hardcoded list of allocation
  functions anymore.
- Add llvm-link-atomic.patch to fix build on ppc.
- Add libcxx-test-library-path.patch to fix libc++ tests failing
  without RUNPATH on libc++.so.
- Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l.
- Thanks to Andreas Schwab for most of the rebasing!</changelog>
  <changelog author="schwab@suse.de" date="1662984000">- Use correct LLVM_HOST_TRIPLE for riscv64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663761600">- Always drop -gnu from triple for consistency. Patch a test that
  was looking for -linux- in clang-test-xfail-gnuless-triple.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663848000">- Update to version 15.0.1.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1664884800">- Update to version 15.0.2.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1666872000">- Update to version 15.0.3.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix
  lowering of non-canonical vector comparison with zero on armv7,
  preventing a crash (boo#1204267, gh#llvm/llvm-project#58514).
- Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1667736000">- Update to version 15.0.4.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1668600000">- Update to version 15.0.5.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Remove obsolete lldb-swig-4.1.0-build-fix.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Manage clang-cpp with update-alternatives like other binaries.
  Solves upgrade issues from Leap 15.5 to 15.6.  [boo#1221183]</changelog>
</package>
<package pkgid="9b3bd060b1c15d1ddf552c7994c2b1c01b491ecfda0413fd59636e5d52786231" name="clang15-devel" arch="s390x">
  <version epoch="0" ver="15.0.7" rel="150500.4.11.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1655380800">- Update to version 14.0.5.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1656936000">- Update to version 14.0.6.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1660046400">- Add llvm-glibc-2-36.patch in order to address boo#1202215.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660132800">- Add WebAssembly support for all architectures.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660392000">- Use black RPM macro magic to deduplicate binary lists. This
  should have no effect on the generated RPM but shaves ~400 lines
  off the specfile and hopefully makes future maintenance easier.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661256000">- Don't declare python3-clang as noarch: Python packages are
  installed into %{_libdir}.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661515200">- Add llvm-lifetime-for-rust.patch to have Rust memory management
  functions considered as lifetime markers. This should aid dead
  store elimination to dynamically allocated memory in Rust code.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662206400">- Make sure we keep -DNDEBUG. At some point %{optflags} must have
  lost it, perhaps because CMake usually adds it on top. So when
  overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to
  take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF,
  because that's the default anyway and hasn't helped here.
- Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation
  caused by mixing up values of the current and previous iteration.
  (See gh#llvm/llvm-project#56242.)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662465600">- Update to version 15.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfod: Provides debug info to remote hosts.
  - llvm-dwarfutil: Can copy and manipulate debug info.
  - llvm-remark-size-diff: Compute diff between remark files.
  * New Clang tools:
  - clang-offload-packager: Bundle multiple objects into single
    fat binaries including offload code.
  - clang-pseudo: Approximate heuristic parser for C++.
- Rebase patches:
  * check-no-llvm-exegesis.patch
  * link-clang-tools-extra-shared.patch
  * lld-default-sha1.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Drop patches that have landed upstream:
  * clang-repl-private-deps.patch
  * llvm-glibc-2-36.patch
  * llvm-scev-fix-isImpliedViaMerge.patch
- Drop llvm-lifetime-for-rust.patch: this is now solved via
  attributes and LLVM doesn't need a hardcoded list of allocation
  functions anymore.
- Add llvm-link-atomic.patch to fix build on ppc.
- Add libcxx-test-library-path.patch to fix libc++ tests failing
  without RUNPATH on libc++.so.
- Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l.
- Thanks to Andreas Schwab for most of the rebasing!</changelog>
  <changelog author="schwab@suse.de" date="1662984000">- Use correct LLVM_HOST_TRIPLE for riscv64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663761600">- Always drop -gnu from triple for consistency. Patch a test that
  was looking for -linux- in clang-test-xfail-gnuless-triple.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663848000">- Update to version 15.0.1.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1664884800">- Update to version 15.0.2.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1666872000">- Update to version 15.0.3.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix
  lowering of non-canonical vector comparison with zero on armv7,
  preventing a crash (boo#1204267, gh#llvm/llvm-project#58514).
- Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1667736000">- Update to version 15.0.4.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1668600000">- Update to version 15.0.5.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Remove obsolete lldb-swig-4.1.0-build-fix.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Manage clang-cpp with update-alternatives like other binaries.
  Solves upgrade issues from Leap 15.5 to 15.6.  [boo#1221183]</changelog>
</package>
<package pkgid="3fd6bee5afee807e6f6d6c0686f8c6168a55e11ebfc2e2024be36e2d7f34bd45" name="clang15-devel" arch="x86_64">
  <version epoch="0" ver="15.0.7" rel="150500.4.11.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1655380800">- Update to version 14.0.5.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1656936000">- Update to version 14.0.6.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1660046400">- Add llvm-glibc-2-36.patch in order to address boo#1202215.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660132800">- Add WebAssembly support for all architectures.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660392000">- Use black RPM macro magic to deduplicate binary lists. This
  should have no effect on the generated RPM but shaves ~400 lines
  off the specfile and hopefully makes future maintenance easier.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661256000">- Don't declare python3-clang as noarch: Python packages are
  installed into %{_libdir}.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661515200">- Add llvm-lifetime-for-rust.patch to have Rust memory management
  functions considered as lifetime markers. This should aid dead
  store elimination to dynamically allocated memory in Rust code.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662206400">- Make sure we keep -DNDEBUG. At some point %{optflags} must have
  lost it, perhaps because CMake usually adds it on top. So when
  overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to
  take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF,
  because that's the default anyway and hasn't helped here.
- Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation
  caused by mixing up values of the current and previous iteration.
  (See gh#llvm/llvm-project#56242.)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662465600">- Update to version 15.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfod: Provides debug info to remote hosts.
  - llvm-dwarfutil: Can copy and manipulate debug info.
  - llvm-remark-size-diff: Compute diff between remark files.
  * New Clang tools:
  - clang-offload-packager: Bundle multiple objects into single
    fat binaries including offload code.
  - clang-pseudo: Approximate heuristic parser for C++.
- Rebase patches:
  * check-no-llvm-exegesis.patch
  * link-clang-tools-extra-shared.patch
  * lld-default-sha1.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Drop patches that have landed upstream:
  * clang-repl-private-deps.patch
  * llvm-glibc-2-36.patch
  * llvm-scev-fix-isImpliedViaMerge.patch
- Drop llvm-lifetime-for-rust.patch: this is now solved via
  attributes and LLVM doesn't need a hardcoded list of allocation
  functions anymore.
- Add llvm-link-atomic.patch to fix build on ppc.
- Add libcxx-test-library-path.patch to fix libc++ tests failing
  without RUNPATH on libc++.so.
- Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l.
- Thanks to Andreas Schwab for most of the rebasing!</changelog>
  <changelog author="schwab@suse.de" date="1662984000">- Use correct LLVM_HOST_TRIPLE for riscv64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663761600">- Always drop -gnu from triple for consistency. Patch a test that
  was looking for -linux- in clang-test-xfail-gnuless-triple.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663848000">- Update to version 15.0.1.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1664884800">- Update to version 15.0.2.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1666872000">- Update to version 15.0.3.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix
  lowering of non-canonical vector comparison with zero on armv7,
  preventing a crash (boo#1204267, gh#llvm/llvm-project#58514).
- Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1667736000">- Update to version 15.0.4.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1668600000">- Update to version 15.0.5.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Remove obsolete lldb-swig-4.1.0-build-fix.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Manage clang-cpp with update-alternatives like other binaries.
  Solves upgrade issues from Leap 15.5 to 15.6.  [boo#1221183]</changelog>
</package>
<package pkgid="8d6d5ed7cbd1be7443630c2cff06214e60fae715c2eedf1d094a37f9df5cf2f2" name="clang15-devel" arch="aarch64">
  <version epoch="0" ver="15.0.7" rel="150500.4.9.6"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1655380800">- Update to version 14.0.5.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1656936000">- Update to version 14.0.6.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1660046400">- Add llvm-glibc-2-36.patch in order to address boo#1202215.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660132800">- Add WebAssembly support for all architectures.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660392000">- Use black RPM macro magic to deduplicate binary lists. This
  should have no effect on the generated RPM but shaves ~400 lines
  off the specfile and hopefully makes future maintenance easier.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661256000">- Don't declare python3-clang as noarch: Python packages are
  installed into %{_libdir}.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661515200">- Add llvm-lifetime-for-rust.patch to have Rust memory management
  functions considered as lifetime markers. This should aid dead
  store elimination to dynamically allocated memory in Rust code.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662206400">- Make sure we keep -DNDEBUG. At some point %{optflags} must have
  lost it, perhaps because CMake usually adds it on top. So when
  overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to
  take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF,
  because that's the default anyway and hasn't helped here.
- Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation
  caused by mixing up values of the current and previous iteration.
  (See gh#llvm/llvm-project#56242.)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662465600">- Update to version 15.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfod: Provides debug info to remote hosts.
  - llvm-dwarfutil: Can copy and manipulate debug info.
  - llvm-remark-size-diff: Compute diff between remark files.
  * New Clang tools:
  - clang-offload-packager: Bundle multiple objects into single
    fat binaries including offload code.
  - clang-pseudo: Approximate heuristic parser for C++.
- Rebase patches:
  * check-no-llvm-exegesis.patch
  * link-clang-tools-extra-shared.patch
  * lld-default-sha1.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Drop patches that have landed upstream:
  * clang-repl-private-deps.patch
  * llvm-glibc-2-36.patch
  * llvm-scev-fix-isImpliedViaMerge.patch
- Drop llvm-lifetime-for-rust.patch: this is now solved via
  attributes and LLVM doesn't need a hardcoded list of allocation
  functions anymore.
- Add llvm-link-atomic.patch to fix build on ppc.
- Add libcxx-test-library-path.patch to fix libc++ tests failing
  without RUNPATH on libc++.so.
- Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l.
- Thanks to Andreas Schwab for most of the rebasing!</changelog>
  <changelog author="schwab@suse.de" date="1662984000">- Use correct LLVM_HOST_TRIPLE for riscv64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663761600">- Always drop -gnu from triple for consistency. Patch a test that
  was looking for -linux- in clang-test-xfail-gnuless-triple.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663848000">- Update to version 15.0.1.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1664884800">- Update to version 15.0.2.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1666872000">- Update to version 15.0.3.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix
  lowering of non-canonical vector comparison with zero on armv7,
  preventing a crash (boo#1204267, gh#llvm/llvm-project#58514).
- Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1667736000">- Update to version 15.0.4.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1668600000">- Update to version 15.0.5.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Remove obsolete lldb-swig-4.1.0-build-fix.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Manage clang-cpp with update-alternatives like other binaries.
  Solves upgrade issues from Leap 15.5 to 15.6.  [boo#1221183]</changelog>
</package>
<package pkgid="d01c311e94ba2a62676dcad13216d936df5f3c9200db90101085f153acaa8433" name="clang15-devel" arch="ppc64le">
  <version epoch="0" ver="15.0.7" rel="150500.4.9.6"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1655380800">- Update to version 14.0.5.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1656936000">- Update to version 14.0.6.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1660046400">- Add llvm-glibc-2-36.patch in order to address boo#1202215.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660132800">- Add WebAssembly support for all architectures.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660392000">- Use black RPM macro magic to deduplicate binary lists. This
  should have no effect on the generated RPM but shaves ~400 lines
  off the specfile and hopefully makes future maintenance easier.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661256000">- Don't declare python3-clang as noarch: Python packages are
  installed into %{_libdir}.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661515200">- Add llvm-lifetime-for-rust.patch to have Rust memory management
  functions considered as lifetime markers. This should aid dead
  store elimination to dynamically allocated memory in Rust code.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662206400">- Make sure we keep -DNDEBUG. At some point %{optflags} must have
  lost it, perhaps because CMake usually adds it on top. So when
  overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to
  take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF,
  because that's the default anyway and hasn't helped here.
- Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation
  caused by mixing up values of the current and previous iteration.
  (See gh#llvm/llvm-project#56242.)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662465600">- Update to version 15.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfod: Provides debug info to remote hosts.
  - llvm-dwarfutil: Can copy and manipulate debug info.
  - llvm-remark-size-diff: Compute diff between remark files.
  * New Clang tools:
  - clang-offload-packager: Bundle multiple objects into single
    fat binaries including offload code.
  - clang-pseudo: Approximate heuristic parser for C++.
- Rebase patches:
  * check-no-llvm-exegesis.patch
  * link-clang-tools-extra-shared.patch
  * lld-default-sha1.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Drop patches that have landed upstream:
  * clang-repl-private-deps.patch
  * llvm-glibc-2-36.patch
  * llvm-scev-fix-isImpliedViaMerge.patch
- Drop llvm-lifetime-for-rust.patch: this is now solved via
  attributes and LLVM doesn't need a hardcoded list of allocation
  functions anymore.
- Add llvm-link-atomic.patch to fix build on ppc.
- Add libcxx-test-library-path.patch to fix libc++ tests failing
  without RUNPATH on libc++.so.
- Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l.
- Thanks to Andreas Schwab for most of the rebasing!</changelog>
  <changelog author="schwab@suse.de" date="1662984000">- Use correct LLVM_HOST_TRIPLE for riscv64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663761600">- Always drop -gnu from triple for consistency. Patch a test that
  was looking for -linux- in clang-test-xfail-gnuless-triple.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663848000">- Update to version 15.0.1.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1664884800">- Update to version 15.0.2.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1666872000">- Update to version 15.0.3.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix
  lowering of non-canonical vector comparison with zero on armv7,
  preventing a crash (boo#1204267, gh#llvm/llvm-project#58514).
- Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1667736000">- Update to version 15.0.4.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1668600000">- Update to version 15.0.5.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Remove obsolete lldb-swig-4.1.0-build-fix.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Manage clang-cpp with update-alternatives like other binaries.
  Solves upgrade issues from Leap 15.5 to 15.6.  [boo#1221183]</changelog>
</package>
<package pkgid="79167cf16a7a3ae878c588302df24b237818cd214fb2c598a271ef92b0739a44" name="clang15-devel" arch="s390x">
  <version epoch="0" ver="15.0.7" rel="150500.4.9.6"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1655380800">- Update to version 14.0.5.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1656936000">- Update to version 14.0.6.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1660046400">- Add llvm-glibc-2-36.patch in order to address boo#1202215.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660132800">- Add WebAssembly support for all architectures.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660392000">- Use black RPM macro magic to deduplicate binary lists. This
  should have no effect on the generated RPM but shaves ~400 lines
  off the specfile and hopefully makes future maintenance easier.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661256000">- Don't declare python3-clang as noarch: Python packages are
  installed into %{_libdir}.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661515200">- Add llvm-lifetime-for-rust.patch to have Rust memory management
  functions considered as lifetime markers. This should aid dead
  store elimination to dynamically allocated memory in Rust code.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662206400">- Make sure we keep -DNDEBUG. At some point %{optflags} must have
  lost it, perhaps because CMake usually adds it on top. So when
  overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to
  take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF,
  because that's the default anyway and hasn't helped here.
- Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation
  caused by mixing up values of the current and previous iteration.
  (See gh#llvm/llvm-project#56242.)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662465600">- Update to version 15.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfod: Provides debug info to remote hosts.
  - llvm-dwarfutil: Can copy and manipulate debug info.
  - llvm-remark-size-diff: Compute diff between remark files.
  * New Clang tools:
  - clang-offload-packager: Bundle multiple objects into single
    fat binaries including offload code.
  - clang-pseudo: Approximate heuristic parser for C++.
- Rebase patches:
  * check-no-llvm-exegesis.patch
  * link-clang-tools-extra-shared.patch
  * lld-default-sha1.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Drop patches that have landed upstream:
  * clang-repl-private-deps.patch
  * llvm-glibc-2-36.patch
  * llvm-scev-fix-isImpliedViaMerge.patch
- Drop llvm-lifetime-for-rust.patch: this is now solved via
  attributes and LLVM doesn't need a hardcoded list of allocation
  functions anymore.
- Add llvm-link-atomic.patch to fix build on ppc.
- Add libcxx-test-library-path.patch to fix libc++ tests failing
  without RUNPATH on libc++.so.
- Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l.
- Thanks to Andreas Schwab for most of the rebasing!</changelog>
  <changelog author="schwab@suse.de" date="1662984000">- Use correct LLVM_HOST_TRIPLE for riscv64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663761600">- Always drop -gnu from triple for consistency. Patch a test that
  was looking for -linux- in clang-test-xfail-gnuless-triple.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663848000">- Update to version 15.0.1.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1664884800">- Update to version 15.0.2.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1666872000">- Update to version 15.0.3.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix
  lowering of non-canonical vector comparison with zero on armv7,
  preventing a crash (boo#1204267, gh#llvm/llvm-project#58514).
- Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1667736000">- Update to version 15.0.4.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1668600000">- Update to version 15.0.5.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Remove obsolete lldb-swig-4.1.0-build-fix.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Manage clang-cpp with update-alternatives like other binaries.
  Solves upgrade issues from Leap 15.5 to 15.6.  [boo#1221183]</changelog>
</package>
<package pkgid="503011da7bc6824191cc35ce6aa5336aae7e09138e8b778b1e2868fd12fe7310" name="clang15-devel" arch="x86_64">
  <version epoch="0" ver="15.0.7" rel="150500.4.9.6"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1655380800">- Update to version 14.0.5.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1656936000">- Update to version 14.0.6.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1660046400">- Add llvm-glibc-2-36.patch in order to address boo#1202215.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660132800">- Add WebAssembly support for all architectures.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660392000">- Use black RPM macro magic to deduplicate binary lists. This
  should have no effect on the generated RPM but shaves ~400 lines
  off the specfile and hopefully makes future maintenance easier.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661256000">- Don't declare python3-clang as noarch: Python packages are
  installed into %{_libdir}.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661515200">- Add llvm-lifetime-for-rust.patch to have Rust memory management
  functions considered as lifetime markers. This should aid dead
  store elimination to dynamically allocated memory in Rust code.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662206400">- Make sure we keep -DNDEBUG. At some point %{optflags} must have
  lost it, perhaps because CMake usually adds it on top. So when
  overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to
  take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF,
  because that's the default anyway and hasn't helped here.
- Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation
  caused by mixing up values of the current and previous iteration.
  (See gh#llvm/llvm-project#56242.)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662465600">- Update to version 15.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfod: Provides debug info to remote hosts.
  - llvm-dwarfutil: Can copy and manipulate debug info.
  - llvm-remark-size-diff: Compute diff between remark files.
  * New Clang tools:
  - clang-offload-packager: Bundle multiple objects into single
    fat binaries including offload code.
  - clang-pseudo: Approximate heuristic parser for C++.
- Rebase patches:
  * check-no-llvm-exegesis.patch
  * link-clang-tools-extra-shared.patch
  * lld-default-sha1.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Drop patches that have landed upstream:
  * clang-repl-private-deps.patch
  * llvm-glibc-2-36.patch
  * llvm-scev-fix-isImpliedViaMerge.patch
- Drop llvm-lifetime-for-rust.patch: this is now solved via
  attributes and LLVM doesn't need a hardcoded list of allocation
  functions anymore.
- Add llvm-link-atomic.patch to fix build on ppc.
- Add libcxx-test-library-path.patch to fix libc++ tests failing
  without RUNPATH on libc++.so.
- Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l.
- Thanks to Andreas Schwab for most of the rebasing!</changelog>
  <changelog author="schwab@suse.de" date="1662984000">- Use correct LLVM_HOST_TRIPLE for riscv64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663761600">- Always drop -gnu from triple for consistency. Patch a test that
  was looking for -linux- in clang-test-xfail-gnuless-triple.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663848000">- Update to version 15.0.1.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1664884800">- Update to version 15.0.2.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1666872000">- Update to version 15.0.3.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix
  lowering of non-canonical vector comparison with zero on armv7,
  preventing a crash (boo#1204267, gh#llvm/llvm-project#58514).
- Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1667736000">- Update to version 15.0.4.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1668600000">- Update to version 15.0.5.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Remove obsolete lldb-swig-4.1.0-build-fix.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Manage clang-cpp with update-alternatives like other binaries.
  Solves upgrade issues from Leap 15.5 to 15.6.  [boo#1221183]</changelog>
</package>
<package pkgid="82d05de3fe6efde7881bbc5956ce78f04c4e15b479f6e93511577c02bcad5589" name="clang15-doc" arch="noarch">
  <version epoch="0" ver="15.0.7" rel="150500.4.11.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1655380800">- Update to version 14.0.5.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1656936000">- Update to version 14.0.6.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1660046400">- Add llvm-glibc-2-36.patch in order to address boo#1202215.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660132800">- Add WebAssembly support for all architectures.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660392000">- Use black RPM macro magic to deduplicate binary lists. This
  should have no effect on the generated RPM but shaves ~400 lines
  off the specfile and hopefully makes future maintenance easier.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661256000">- Don't declare python3-clang as noarch: Python packages are
  installed into %{_libdir}.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661515200">- Add llvm-lifetime-for-rust.patch to have Rust memory management
  functions considered as lifetime markers. This should aid dead
  store elimination to dynamically allocated memory in Rust code.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662206400">- Make sure we keep -DNDEBUG. At some point %{optflags} must have
  lost it, perhaps because CMake usually adds it on top. So when
  overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to
  take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF,
  because that's the default anyway and hasn't helped here.
- Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation
  caused by mixing up values of the current and previous iteration.
  (See gh#llvm/llvm-project#56242.)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662465600">- Update to version 15.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfod: Provides debug info to remote hosts.
  - llvm-dwarfutil: Can copy and manipulate debug info.
  - llvm-remark-size-diff: Compute diff between remark files.
  * New Clang tools:
  - clang-offload-packager: Bundle multiple objects into single
    fat binaries including offload code.
  - clang-pseudo: Approximate heuristic parser for C++.
- Rebase patches:
  * check-no-llvm-exegesis.patch
  * link-clang-tools-extra-shared.patch
  * lld-default-sha1.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Drop patches that have landed upstream:
  * clang-repl-private-deps.patch
  * llvm-glibc-2-36.patch
  * llvm-scev-fix-isImpliedViaMerge.patch
- Drop llvm-lifetime-for-rust.patch: this is now solved via
  attributes and LLVM doesn't need a hardcoded list of allocation
  functions anymore.
- Add llvm-link-atomic.patch to fix build on ppc.
- Add libcxx-test-library-path.patch to fix libc++ tests failing
  without RUNPATH on libc++.so.
- Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l.
- Thanks to Andreas Schwab for most of the rebasing!</changelog>
  <changelog author="schwab@suse.de" date="1662984000">- Use correct LLVM_HOST_TRIPLE for riscv64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663761600">- Always drop -gnu from triple for consistency. Patch a test that
  was looking for -linux- in clang-test-xfail-gnuless-triple.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663848000">- Update to version 15.0.1.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1664884800">- Update to version 15.0.2.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1666872000">- Update to version 15.0.3.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix
  lowering of non-canonical vector comparison with zero on armv7,
  preventing a crash (boo#1204267, gh#llvm/llvm-project#58514).
- Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1667736000">- Update to version 15.0.4.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1668600000">- Update to version 15.0.5.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Remove obsolete lldb-swig-4.1.0-build-fix.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Manage clang-cpp with update-alternatives like other binaries.
  Solves upgrade issues from Leap 15.5 to 15.6.  [boo#1221183]</changelog>
</package>
<package pkgid="bcca49a7b442f8f085be402c0c6116b00004d89cbd153cd31e6b6a506de4b755" name="clang15-doc" arch="noarch">
  <version epoch="0" ver="15.0.7" rel="150500.4.9.6"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1655380800">- Update to version 14.0.5.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1656936000">- Update to version 14.0.6.
  * This release contains bug-fixes for the LLVM 14.0.0 release.
    This release is API and ABI compatible with 14.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1660046400">- Add llvm-glibc-2-36.patch in order to address boo#1202215.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660132800">- Add WebAssembly support for all architectures.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1660392000">- Use black RPM macro magic to deduplicate binary lists. This
  should have no effect on the generated RPM but shaves ~400 lines
  off the specfile and hopefully makes future maintenance easier.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661256000">- Don't declare python3-clang as noarch: Python packages are
  installed into %{_libdir}.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1661515200">- Add llvm-lifetime-for-rust.patch to have Rust memory management
  functions considered as lifetime markers. This should aid dead
  store elimination to dynamically allocated memory in Rust code.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662206400">- Make sure we keep -DNDEBUG. At some point %{optflags} must have
  lost it, perhaps because CMake usually adds it on top. So when
  overriding CMAKE_{C,CXX}_FLAGS_RELWITHDEBINFO, we make sure to
  take over the other flags. We drop LLVM_ENABLE_ASSERTIONS=OFF,
  because that's the default anyway and hasn't helped here.
- Add llvm-scev-fix-isImpliedViaMerge.patch: fixes a miscompilation
  caused by mixing up values of the current and previous iteration.
  (See gh#llvm/llvm-project#56242.)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1662465600">- Update to version 15.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/15.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/15.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfod: Provides debug info to remote hosts.
  - llvm-dwarfutil: Can copy and manipulate debug info.
  - llvm-remark-size-diff: Compute diff between remark files.
  * New Clang tools:
  - clang-offload-packager: Bundle multiple objects into single
    fat binaries including offload code.
  - clang-pseudo: Approximate heuristic parser for C++.
- Rebase patches:
  * check-no-llvm-exegesis.patch
  * link-clang-tools-extra-shared.patch
  * lld-default-sha1.patch
  * llvm-do-not-install-static-libraries.patch
  * lto-disable-cache.patch
- Drop patches that have landed upstream:
  * clang-repl-private-deps.patch
  * llvm-glibc-2-36.patch
  * llvm-scev-fix-isImpliedViaMerge.patch
- Drop llvm-lifetime-for-rust.patch: this is now solved via
  attributes and LLVM doesn't need a hardcoded list of allocation
  functions anymore.
- Add llvm-link-atomic.patch to fix build on ppc.
- Add libcxx-test-library-path.patch to fix libc++ tests failing
  without RUNPATH on libc++.so.
- Add libcxxabi-fix-armv7-test.patch to fix tests on armv7l.
- Thanks to Andreas Schwab for most of the rebasing!</changelog>
  <changelog author="schwab@suse.de" date="1662984000">- Use correct LLVM_HOST_TRIPLE for riscv64</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663761600">- Always drop -gnu from triple for consistency. Patch a test that
  was looking for -linux- in clang-test-xfail-gnuless-triple.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1663848000">- Update to version 15.0.1.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1664884800">- Update to version 15.0.2.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1666872000">- Update to version 15.0.3.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Add llvm-armv7-fix-vector-compare-with-zero-lowering.patch: Fix
  lowering of non-canonical vector comparison with zero on armv7,
  preventing a crash (boo#1204267, gh#llvm/llvm-project#58514).
- Add lldb-swig-4.1.0-build-fix.patch: Fix build with Swig 4.1.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1667736000">- Update to version 15.0.4.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1668600000">- Update to version 15.0.5.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Remove obsolete lldb-swig-4.1.0-build-fix.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Manage clang-cpp with update-alternatives like other binaries.
  Solves upgrade issues from Leap 15.5 to 15.6.  [boo#1221183]</changelog>
</package>
<package pkgid="9b41f9d7af152d86ab735e3059713aaaf1b462e0e69184271bf031da1a5f14fb" name="clang17" arch="aarch64">
  <version epoch="0" ver="17.0.6" rel="150600.3.2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1678536000">- Add llvm-suse-implicit-gnu.patch to recognize &lt;arch&gt;-suse-linux
  as implicitly GNU. Without this we would get library calls for
  fused-multiply-add even if it's available in hardware.
- Add openmp-drop-rpath.patch: backport revert of adding RUNPATH
  to openmp executables. (boo#1206837)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1679140800">- Update to version 16.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/16.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfo-analyzer: Print a logical representation of
    low-level debug information.
  - llvm-remarkutil: Remark file utilities.
  * The test tool split-file is no longer installed.
  * New Clang tools:
  - amdgpu-arch and nvptx-arch: Tools used to detect locally
    available GPUs by the Clang OpenMP driver.
  - clang-include-cleaner: Standalone tool to determine which
    headers are used, using existing functionality in clangd.
  - clang-tblgen: Table Generation for Clang.
  * Removed Clang tools: clang-{nvlink,offload}-wrapper.
- Rebase patches:
  * assume-opensuse.patch
  * check-no-llvm-exegesis.patch
  * link-clang-shared.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-suse-implicit-gnu.patch
  * llvm-workaround-superfluous-branches.patch
  * openmp-drop-rpath.patch
- Drop patches that have landed upstream:
  * clang-test-xfail-gnuless-triple.patch
  * CMake-Look-up-target-subcomponents-in-LLVM_AVAILABLE_LIBS.patch
  * libcxxabi-fix-armv7-test.patch
  * llvm-armv7-fix-vector-compare-with-zero-lowering.patch
  * llvm-link-atomic.patch
- Remove llvm-better-detect-64bit-atomics-support.patch that should
  not be required anymore.
- Add PGP signatures and keyring for source verification.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1680782400">- Update to version 16.0.1.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="william.brown@suse.com" date="1681387200">- bsc#1210383 - Add aarch64 to lldb platforms</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1681819200">- Relax requirements for clang-tools to allow installation of older
  versions of libclang13 with the -devel package. (boo#1210176)
- Enable ThinLTO for ARM 6/7/8 again. (boo#1178070)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1682078400">- Update to version 16.0.2.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase check-no-llvm-exegesis.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1683460800">- Update to version 16.0.3.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1684324800">- Update to version 16.0.4.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1685793600">- Update to version 16.0.5.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch
- Enable ThinLTO on riscv64.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1686830400">- Update to version 16.0.6.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Make python3-clang noarch again and fix conflicts/provides to
  point to %python3_sitelib instead of %python3_sitearch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695124800">- Update to version 17.0.1.
  * For details, see the release notes:
  - https://releases.llvm.org/17.0.1/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/lld/docs/ReleaseNotes.html
- Rebase patches:
  * libcxx-test-library-path.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
  * llvm-remove-clang-only-flags.patch
  * opt-viewer-Find-style-css-in-usr-share.patch
- Simplify check-no-llvm-exegesis.patch by removing test directory.
- Drop patches that have landed upstream:
  * openmp-drop-rpath.patch
- Add openmp-dont-run-gpu-arch.patch: the binaries are not
  available in our build, and neither are the toolchains they test
  for (NV CUDA and AMD HSA).</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1696680000">- Update to version 17.0.2.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1697716800">- Update to version 17.0.3.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Disable zstd support for now regardless of whether libzstd-devel
  is installed. (boo#1216121)
- Limit number of LTO threads on 32-bit architectures to prevent
  out-of-memory during linking.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1699185600">- Update to version 17.0.4.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Include libomptarget.devicertl.a in libomp*-devel, which is
  required for (GPU) offloading.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1700308800">- Update to version 17.0.5.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Also test clang-tools-extra (at least most parts) and lld.
- Adapt test in lld-default-sha1.patch.
- Don't disable testing if qemu_user_space_build has been set to 0.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Update to version 17.0.6.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
- Use major version only instead of full (patch-level) version for
  versioned executables: we don't support parallel installation of
  multiple versions of the same LLVM major version. (boo#1217450)
  Also drop the clang-X.Y symlink that was introduced for
  boo#1012260, because Y is always 0.
- Manage clang-cpp with update-alternatives like other binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1703160000">- Revert conflicts/provides for python3-clang to %python3_sitearch
  to retain compatibility with older llvm versions in SLE.</changelog>
</package>
<package pkgid="aa0e9b5659cb8b6b0a11c3b43a92df4db71d4b594cbece87d5a8243bec1aae39" name="clang17" arch="ppc64le">
  <version epoch="0" ver="17.0.6" rel="150600.3.2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1678536000">- Add llvm-suse-implicit-gnu.patch to recognize &lt;arch&gt;-suse-linux
  as implicitly GNU. Without this we would get library calls for
  fused-multiply-add even if it's available in hardware.
- Add openmp-drop-rpath.patch: backport revert of adding RUNPATH
  to openmp executables. (boo#1206837)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1679140800">- Update to version 16.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/16.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfo-analyzer: Print a logical representation of
    low-level debug information.
  - llvm-remarkutil: Remark file utilities.
  * The test tool split-file is no longer installed.
  * New Clang tools:
  - amdgpu-arch and nvptx-arch: Tools used to detect locally
    available GPUs by the Clang OpenMP driver.
  - clang-include-cleaner: Standalone tool to determine which
    headers are used, using existing functionality in clangd.
  - clang-tblgen: Table Generation for Clang.
  * Removed Clang tools: clang-{nvlink,offload}-wrapper.
- Rebase patches:
  * assume-opensuse.patch
  * check-no-llvm-exegesis.patch
  * link-clang-shared.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-suse-implicit-gnu.patch
  * llvm-workaround-superfluous-branches.patch
  * openmp-drop-rpath.patch
- Drop patches that have landed upstream:
  * clang-test-xfail-gnuless-triple.patch
  * CMake-Look-up-target-subcomponents-in-LLVM_AVAILABLE_LIBS.patch
  * libcxxabi-fix-armv7-test.patch
  * llvm-armv7-fix-vector-compare-with-zero-lowering.patch
  * llvm-link-atomic.patch
- Remove llvm-better-detect-64bit-atomics-support.patch that should
  not be required anymore.
- Add PGP signatures and keyring for source verification.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1680782400">- Update to version 16.0.1.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="william.brown@suse.com" date="1681387200">- bsc#1210383 - Add aarch64 to lldb platforms</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1681819200">- Relax requirements for clang-tools to allow installation of older
  versions of libclang13 with the -devel package. (boo#1210176)
- Enable ThinLTO for ARM 6/7/8 again. (boo#1178070)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1682078400">- Update to version 16.0.2.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase check-no-llvm-exegesis.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1683460800">- Update to version 16.0.3.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1684324800">- Update to version 16.0.4.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1685793600">- Update to version 16.0.5.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch
- Enable ThinLTO on riscv64.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1686830400">- Update to version 16.0.6.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Make python3-clang noarch again and fix conflicts/provides to
  point to %python3_sitelib instead of %python3_sitearch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695124800">- Update to version 17.0.1.
  * For details, see the release notes:
  - https://releases.llvm.org/17.0.1/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/lld/docs/ReleaseNotes.html
- Rebase patches:
  * libcxx-test-library-path.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
  * llvm-remove-clang-only-flags.patch
  * opt-viewer-Find-style-css-in-usr-share.patch
- Simplify check-no-llvm-exegesis.patch by removing test directory.
- Drop patches that have landed upstream:
  * openmp-drop-rpath.patch
- Add openmp-dont-run-gpu-arch.patch: the binaries are not
  available in our build, and neither are the toolchains they test
  for (NV CUDA and AMD HSA).</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1696680000">- Update to version 17.0.2.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1697716800">- Update to version 17.0.3.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Disable zstd support for now regardless of whether libzstd-devel
  is installed. (boo#1216121)
- Limit number of LTO threads on 32-bit architectures to prevent
  out-of-memory during linking.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1699185600">- Update to version 17.0.4.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Include libomptarget.devicertl.a in libomp*-devel, which is
  required for (GPU) offloading.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1700308800">- Update to version 17.0.5.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Also test clang-tools-extra (at least most parts) and lld.
- Adapt test in lld-default-sha1.patch.
- Don't disable testing if qemu_user_space_build has been set to 0.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Update to version 17.0.6.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
- Use major version only instead of full (patch-level) version for
  versioned executables: we don't support parallel installation of
  multiple versions of the same LLVM major version. (boo#1217450)
  Also drop the clang-X.Y symlink that was introduced for
  boo#1012260, because Y is always 0.
- Manage clang-cpp with update-alternatives like other binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1703160000">- Revert conflicts/provides for python3-clang to %python3_sitearch
  to retain compatibility with older llvm versions in SLE.</changelog>
</package>
<package pkgid="9d6dc9b63aa0a4f19c3f4ed5b347df3df40aef720ea6f00e6469736de68332bd" name="clang17" arch="s390x">
  <version epoch="0" ver="17.0.6" rel="150600.3.2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1678536000">- Add llvm-suse-implicit-gnu.patch to recognize &lt;arch&gt;-suse-linux
  as implicitly GNU. Without this we would get library calls for
  fused-multiply-add even if it's available in hardware.
- Add openmp-drop-rpath.patch: backport revert of adding RUNPATH
  to openmp executables. (boo#1206837)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1679140800">- Update to version 16.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/16.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfo-analyzer: Print a logical representation of
    low-level debug information.
  - llvm-remarkutil: Remark file utilities.
  * The test tool split-file is no longer installed.
  * New Clang tools:
  - amdgpu-arch and nvptx-arch: Tools used to detect locally
    available GPUs by the Clang OpenMP driver.
  - clang-include-cleaner: Standalone tool to determine which
    headers are used, using existing functionality in clangd.
  - clang-tblgen: Table Generation for Clang.
  * Removed Clang tools: clang-{nvlink,offload}-wrapper.
- Rebase patches:
  * assume-opensuse.patch
  * check-no-llvm-exegesis.patch
  * link-clang-shared.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-suse-implicit-gnu.patch
  * llvm-workaround-superfluous-branches.patch
  * openmp-drop-rpath.patch
- Drop patches that have landed upstream:
  * clang-test-xfail-gnuless-triple.patch
  * CMake-Look-up-target-subcomponents-in-LLVM_AVAILABLE_LIBS.patch
  * libcxxabi-fix-armv7-test.patch
  * llvm-armv7-fix-vector-compare-with-zero-lowering.patch
  * llvm-link-atomic.patch
- Remove llvm-better-detect-64bit-atomics-support.patch that should
  not be required anymore.
- Add PGP signatures and keyring for source verification.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1680782400">- Update to version 16.0.1.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="william.brown@suse.com" date="1681387200">- bsc#1210383 - Add aarch64 to lldb platforms</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1681819200">- Relax requirements for clang-tools to allow installation of older
  versions of libclang13 with the -devel package. (boo#1210176)
- Enable ThinLTO for ARM 6/7/8 again. (boo#1178070)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1682078400">- Update to version 16.0.2.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase check-no-llvm-exegesis.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1683460800">- Update to version 16.0.3.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1684324800">- Update to version 16.0.4.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1685793600">- Update to version 16.0.5.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch
- Enable ThinLTO on riscv64.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1686830400">- Update to version 16.0.6.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Make python3-clang noarch again and fix conflicts/provides to
  point to %python3_sitelib instead of %python3_sitearch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695124800">- Update to version 17.0.1.
  * For details, see the release notes:
  - https://releases.llvm.org/17.0.1/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/lld/docs/ReleaseNotes.html
- Rebase patches:
  * libcxx-test-library-path.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
  * llvm-remove-clang-only-flags.patch
  * opt-viewer-Find-style-css-in-usr-share.patch
- Simplify check-no-llvm-exegesis.patch by removing test directory.
- Drop patches that have landed upstream:
  * openmp-drop-rpath.patch
- Add openmp-dont-run-gpu-arch.patch: the binaries are not
  available in our build, and neither are the toolchains they test
  for (NV CUDA and AMD HSA).</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1696680000">- Update to version 17.0.2.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1697716800">- Update to version 17.0.3.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Disable zstd support for now regardless of whether libzstd-devel
  is installed. (boo#1216121)
- Limit number of LTO threads on 32-bit architectures to prevent
  out-of-memory during linking.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1699185600">- Update to version 17.0.4.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Include libomptarget.devicertl.a in libomp*-devel, which is
  required for (GPU) offloading.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1700308800">- Update to version 17.0.5.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Also test clang-tools-extra (at least most parts) and lld.
- Adapt test in lld-default-sha1.patch.
- Don't disable testing if qemu_user_space_build has been set to 0.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Update to version 17.0.6.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
- Use major version only instead of full (patch-level) version for
  versioned executables: we don't support parallel installation of
  multiple versions of the same LLVM major version. (boo#1217450)
  Also drop the clang-X.Y symlink that was introduced for
  boo#1012260, because Y is always 0.
- Manage clang-cpp with update-alternatives like other binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1703160000">- Revert conflicts/provides for python3-clang to %python3_sitearch
  to retain compatibility with older llvm versions in SLE.</changelog>
</package>
<package pkgid="f21d9ac4173ca52dee193db75958435506091528a8eb6eb147defddf056565fc" name="clang17" arch="x86_64">
  <version epoch="0" ver="17.0.6" rel="150600.3.2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1678536000">- Add llvm-suse-implicit-gnu.patch to recognize &lt;arch&gt;-suse-linux
  as implicitly GNU. Without this we would get library calls for
  fused-multiply-add even if it's available in hardware.
- Add openmp-drop-rpath.patch: backport revert of adding RUNPATH
  to openmp executables. (boo#1206837)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1679140800">- Update to version 16.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/16.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfo-analyzer: Print a logical representation of
    low-level debug information.
  - llvm-remarkutil: Remark file utilities.
  * The test tool split-file is no longer installed.
  * New Clang tools:
  - amdgpu-arch and nvptx-arch: Tools used to detect locally
    available GPUs by the Clang OpenMP driver.
  - clang-include-cleaner: Standalone tool to determine which
    headers are used, using existing functionality in clangd.
  - clang-tblgen: Table Generation for Clang.
  * Removed Clang tools: clang-{nvlink,offload}-wrapper.
- Rebase patches:
  * assume-opensuse.patch
  * check-no-llvm-exegesis.patch
  * link-clang-shared.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-suse-implicit-gnu.patch
  * llvm-workaround-superfluous-branches.patch
  * openmp-drop-rpath.patch
- Drop patches that have landed upstream:
  * clang-test-xfail-gnuless-triple.patch
  * CMake-Look-up-target-subcomponents-in-LLVM_AVAILABLE_LIBS.patch
  * libcxxabi-fix-armv7-test.patch
  * llvm-armv7-fix-vector-compare-with-zero-lowering.patch
  * llvm-link-atomic.patch
- Remove llvm-better-detect-64bit-atomics-support.patch that should
  not be required anymore.
- Add PGP signatures and keyring for source verification.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1680782400">- Update to version 16.0.1.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="william.brown@suse.com" date="1681387200">- bsc#1210383 - Add aarch64 to lldb platforms</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1681819200">- Relax requirements for clang-tools to allow installation of older
  versions of libclang13 with the -devel package. (boo#1210176)
- Enable ThinLTO for ARM 6/7/8 again. (boo#1178070)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1682078400">- Update to version 16.0.2.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase check-no-llvm-exegesis.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1683460800">- Update to version 16.0.3.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1684324800">- Update to version 16.0.4.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1685793600">- Update to version 16.0.5.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch
- Enable ThinLTO on riscv64.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1686830400">- Update to version 16.0.6.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Make python3-clang noarch again and fix conflicts/provides to
  point to %python3_sitelib instead of %python3_sitearch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695124800">- Update to version 17.0.1.
  * For details, see the release notes:
  - https://releases.llvm.org/17.0.1/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/lld/docs/ReleaseNotes.html
- Rebase patches:
  * libcxx-test-library-path.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
  * llvm-remove-clang-only-flags.patch
  * opt-viewer-Find-style-css-in-usr-share.patch
- Simplify check-no-llvm-exegesis.patch by removing test directory.
- Drop patches that have landed upstream:
  * openmp-drop-rpath.patch
- Add openmp-dont-run-gpu-arch.patch: the binaries are not
  available in our build, and neither are the toolchains they test
  for (NV CUDA and AMD HSA).</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1696680000">- Update to version 17.0.2.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1697716800">- Update to version 17.0.3.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Disable zstd support for now regardless of whether libzstd-devel
  is installed. (boo#1216121)
- Limit number of LTO threads on 32-bit architectures to prevent
  out-of-memory during linking.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1699185600">- Update to version 17.0.4.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Include libomptarget.devicertl.a in libomp*-devel, which is
  required for (GPU) offloading.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1700308800">- Update to version 17.0.5.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Also test clang-tools-extra (at least most parts) and lld.
- Adapt test in lld-default-sha1.patch.
- Don't disable testing if qemu_user_space_build has been set to 0.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Update to version 17.0.6.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
- Use major version only instead of full (patch-level) version for
  versioned executables: we don't support parallel installation of
  multiple versions of the same LLVM major version. (boo#1217450)
  Also drop the clang-X.Y symlink that was introduced for
  boo#1012260, because Y is always 0.
- Manage clang-cpp with update-alternatives like other binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1703160000">- Revert conflicts/provides for python3-clang to %python3_sitearch
  to retain compatibility with older llvm versions in SLE.</changelog>
</package>
<package pkgid="cc1f370a23a539da2e14f1840cd2eebe2e9af716bbe9729719aa2c6d5f35d305" name="clang17-devel" arch="aarch64">
  <version epoch="0" ver="17.0.6" rel="150600.3.2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1678536000">- Add llvm-suse-implicit-gnu.patch to recognize &lt;arch&gt;-suse-linux
  as implicitly GNU. Without this we would get library calls for
  fused-multiply-add even if it's available in hardware.
- Add openmp-drop-rpath.patch: backport revert of adding RUNPATH
  to openmp executables. (boo#1206837)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1679140800">- Update to version 16.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/16.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfo-analyzer: Print a logical representation of
    low-level debug information.
  - llvm-remarkutil: Remark file utilities.
  * The test tool split-file is no longer installed.
  * New Clang tools:
  - amdgpu-arch and nvptx-arch: Tools used to detect locally
    available GPUs by the Clang OpenMP driver.
  - clang-include-cleaner: Standalone tool to determine which
    headers are used, using existing functionality in clangd.
  - clang-tblgen: Table Generation for Clang.
  * Removed Clang tools: clang-{nvlink,offload}-wrapper.
- Rebase patches:
  * assume-opensuse.patch
  * check-no-llvm-exegesis.patch
  * link-clang-shared.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-suse-implicit-gnu.patch
  * llvm-workaround-superfluous-branches.patch
  * openmp-drop-rpath.patch
- Drop patches that have landed upstream:
  * clang-test-xfail-gnuless-triple.patch
  * CMake-Look-up-target-subcomponents-in-LLVM_AVAILABLE_LIBS.patch
  * libcxxabi-fix-armv7-test.patch
  * llvm-armv7-fix-vector-compare-with-zero-lowering.patch
  * llvm-link-atomic.patch
- Remove llvm-better-detect-64bit-atomics-support.patch that should
  not be required anymore.
- Add PGP signatures and keyring for source verification.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1680782400">- Update to version 16.0.1.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="william.brown@suse.com" date="1681387200">- bsc#1210383 - Add aarch64 to lldb platforms</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1681819200">- Relax requirements for clang-tools to allow installation of older
  versions of libclang13 with the -devel package. (boo#1210176)
- Enable ThinLTO for ARM 6/7/8 again. (boo#1178070)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1682078400">- Update to version 16.0.2.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase check-no-llvm-exegesis.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1683460800">- Update to version 16.0.3.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1684324800">- Update to version 16.0.4.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1685793600">- Update to version 16.0.5.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch
- Enable ThinLTO on riscv64.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1686830400">- Update to version 16.0.6.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Make python3-clang noarch again and fix conflicts/provides to
  point to %python3_sitelib instead of %python3_sitearch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695124800">- Update to version 17.0.1.
  * For details, see the release notes:
  - https://releases.llvm.org/17.0.1/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/lld/docs/ReleaseNotes.html
- Rebase patches:
  * libcxx-test-library-path.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
  * llvm-remove-clang-only-flags.patch
  * opt-viewer-Find-style-css-in-usr-share.patch
- Simplify check-no-llvm-exegesis.patch by removing test directory.
- Drop patches that have landed upstream:
  * openmp-drop-rpath.patch
- Add openmp-dont-run-gpu-arch.patch: the binaries are not
  available in our build, and neither are the toolchains they test
  for (NV CUDA and AMD HSA).</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1696680000">- Update to version 17.0.2.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1697716800">- Update to version 17.0.3.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Disable zstd support for now regardless of whether libzstd-devel
  is installed. (boo#1216121)
- Limit number of LTO threads on 32-bit architectures to prevent
  out-of-memory during linking.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1699185600">- Update to version 17.0.4.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Include libomptarget.devicertl.a in libomp*-devel, which is
  required for (GPU) offloading.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1700308800">- Update to version 17.0.5.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Also test clang-tools-extra (at least most parts) and lld.
- Adapt test in lld-default-sha1.patch.
- Don't disable testing if qemu_user_space_build has been set to 0.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Update to version 17.0.6.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
- Use major version only instead of full (patch-level) version for
  versioned executables: we don't support parallel installation of
  multiple versions of the same LLVM major version. (boo#1217450)
  Also drop the clang-X.Y symlink that was introduced for
  boo#1012260, because Y is always 0.
- Manage clang-cpp with update-alternatives like other binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1703160000">- Revert conflicts/provides for python3-clang to %python3_sitearch
  to retain compatibility with older llvm versions in SLE.</changelog>
</package>
<package pkgid="5aa180cfb3a4272a22b5327fc7202614787a32abdc619a97f4b261cc01604fdb" name="clang17-devel" arch="ppc64le">
  <version epoch="0" ver="17.0.6" rel="150600.3.2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1678536000">- Add llvm-suse-implicit-gnu.patch to recognize &lt;arch&gt;-suse-linux
  as implicitly GNU. Without this we would get library calls for
  fused-multiply-add even if it's available in hardware.
- Add openmp-drop-rpath.patch: backport revert of adding RUNPATH
  to openmp executables. (boo#1206837)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1679140800">- Update to version 16.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/16.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfo-analyzer: Print a logical representation of
    low-level debug information.
  - llvm-remarkutil: Remark file utilities.
  * The test tool split-file is no longer installed.
  * New Clang tools:
  - amdgpu-arch and nvptx-arch: Tools used to detect locally
    available GPUs by the Clang OpenMP driver.
  - clang-include-cleaner: Standalone tool to determine which
    headers are used, using existing functionality in clangd.
  - clang-tblgen: Table Generation for Clang.
  * Removed Clang tools: clang-{nvlink,offload}-wrapper.
- Rebase patches:
  * assume-opensuse.patch
  * check-no-llvm-exegesis.patch
  * link-clang-shared.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-suse-implicit-gnu.patch
  * llvm-workaround-superfluous-branches.patch
  * openmp-drop-rpath.patch
- Drop patches that have landed upstream:
  * clang-test-xfail-gnuless-triple.patch
  * CMake-Look-up-target-subcomponents-in-LLVM_AVAILABLE_LIBS.patch
  * libcxxabi-fix-armv7-test.patch
  * llvm-armv7-fix-vector-compare-with-zero-lowering.patch
  * llvm-link-atomic.patch
- Remove llvm-better-detect-64bit-atomics-support.patch that should
  not be required anymore.
- Add PGP signatures and keyring for source verification.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1680782400">- Update to version 16.0.1.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="william.brown@suse.com" date="1681387200">- bsc#1210383 - Add aarch64 to lldb platforms</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1681819200">- Relax requirements for clang-tools to allow installation of older
  versions of libclang13 with the -devel package. (boo#1210176)
- Enable ThinLTO for ARM 6/7/8 again. (boo#1178070)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1682078400">- Update to version 16.0.2.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase check-no-llvm-exegesis.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1683460800">- Update to version 16.0.3.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1684324800">- Update to version 16.0.4.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1685793600">- Update to version 16.0.5.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch
- Enable ThinLTO on riscv64.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1686830400">- Update to version 16.0.6.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Make python3-clang noarch again and fix conflicts/provides to
  point to %python3_sitelib instead of %python3_sitearch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695124800">- Update to version 17.0.1.
  * For details, see the release notes:
  - https://releases.llvm.org/17.0.1/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/lld/docs/ReleaseNotes.html
- Rebase patches:
  * libcxx-test-library-path.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
  * llvm-remove-clang-only-flags.patch
  * opt-viewer-Find-style-css-in-usr-share.patch
- Simplify check-no-llvm-exegesis.patch by removing test directory.
- Drop patches that have landed upstream:
  * openmp-drop-rpath.patch
- Add openmp-dont-run-gpu-arch.patch: the binaries are not
  available in our build, and neither are the toolchains they test
  for (NV CUDA and AMD HSA).</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1696680000">- Update to version 17.0.2.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1697716800">- Update to version 17.0.3.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Disable zstd support for now regardless of whether libzstd-devel
  is installed. (boo#1216121)
- Limit number of LTO threads on 32-bit architectures to prevent
  out-of-memory during linking.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1699185600">- Update to version 17.0.4.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Include libomptarget.devicertl.a in libomp*-devel, which is
  required for (GPU) offloading.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1700308800">- Update to version 17.0.5.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Also test clang-tools-extra (at least most parts) and lld.
- Adapt test in lld-default-sha1.patch.
- Don't disable testing if qemu_user_space_build has been set to 0.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Update to version 17.0.6.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
- Use major version only instead of full (patch-level) version for
  versioned executables: we don't support parallel installation of
  multiple versions of the same LLVM major version. (boo#1217450)
  Also drop the clang-X.Y symlink that was introduced for
  boo#1012260, because Y is always 0.
- Manage clang-cpp with update-alternatives like other binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1703160000">- Revert conflicts/provides for python3-clang to %python3_sitearch
  to retain compatibility with older llvm versions in SLE.</changelog>
</package>
<package pkgid="edad84247933dc6d8022ba62027966e8a69ad9b498adba5801ab84ac2f124004" name="clang17-devel" arch="s390x">
  <version epoch="0" ver="17.0.6" rel="150600.3.2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1678536000">- Add llvm-suse-implicit-gnu.patch to recognize &lt;arch&gt;-suse-linux
  as implicitly GNU. Without this we would get library calls for
  fused-multiply-add even if it's available in hardware.
- Add openmp-drop-rpath.patch: backport revert of adding RUNPATH
  to openmp executables. (boo#1206837)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1679140800">- Update to version 16.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/16.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfo-analyzer: Print a logical representation of
    low-level debug information.
  - llvm-remarkutil: Remark file utilities.
  * The test tool split-file is no longer installed.
  * New Clang tools:
  - amdgpu-arch and nvptx-arch: Tools used to detect locally
    available GPUs by the Clang OpenMP driver.
  - clang-include-cleaner: Standalone tool to determine which
    headers are used, using existing functionality in clangd.
  - clang-tblgen: Table Generation for Clang.
  * Removed Clang tools: clang-{nvlink,offload}-wrapper.
- Rebase patches:
  * assume-opensuse.patch
  * check-no-llvm-exegesis.patch
  * link-clang-shared.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-suse-implicit-gnu.patch
  * llvm-workaround-superfluous-branches.patch
  * openmp-drop-rpath.patch
- Drop patches that have landed upstream:
  * clang-test-xfail-gnuless-triple.patch
  * CMake-Look-up-target-subcomponents-in-LLVM_AVAILABLE_LIBS.patch
  * libcxxabi-fix-armv7-test.patch
  * llvm-armv7-fix-vector-compare-with-zero-lowering.patch
  * llvm-link-atomic.patch
- Remove llvm-better-detect-64bit-atomics-support.patch that should
  not be required anymore.
- Add PGP signatures and keyring for source verification.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1680782400">- Update to version 16.0.1.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="william.brown@suse.com" date="1681387200">- bsc#1210383 - Add aarch64 to lldb platforms</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1681819200">- Relax requirements for clang-tools to allow installation of older
  versions of libclang13 with the -devel package. (boo#1210176)
- Enable ThinLTO for ARM 6/7/8 again. (boo#1178070)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1682078400">- Update to version 16.0.2.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase check-no-llvm-exegesis.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1683460800">- Update to version 16.0.3.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1684324800">- Update to version 16.0.4.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1685793600">- Update to version 16.0.5.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch
- Enable ThinLTO on riscv64.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1686830400">- Update to version 16.0.6.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Make python3-clang noarch again and fix conflicts/provides to
  point to %python3_sitelib instead of %python3_sitearch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695124800">- Update to version 17.0.1.
  * For details, see the release notes:
  - https://releases.llvm.org/17.0.1/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/lld/docs/ReleaseNotes.html
- Rebase patches:
  * libcxx-test-library-path.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
  * llvm-remove-clang-only-flags.patch
  * opt-viewer-Find-style-css-in-usr-share.patch
- Simplify check-no-llvm-exegesis.patch by removing test directory.
- Drop patches that have landed upstream:
  * openmp-drop-rpath.patch
- Add openmp-dont-run-gpu-arch.patch: the binaries are not
  available in our build, and neither are the toolchains they test
  for (NV CUDA and AMD HSA).</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1696680000">- Update to version 17.0.2.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1697716800">- Update to version 17.0.3.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Disable zstd support for now regardless of whether libzstd-devel
  is installed. (boo#1216121)
- Limit number of LTO threads on 32-bit architectures to prevent
  out-of-memory during linking.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1699185600">- Update to version 17.0.4.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Include libomptarget.devicertl.a in libomp*-devel, which is
  required for (GPU) offloading.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1700308800">- Update to version 17.0.5.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Also test clang-tools-extra (at least most parts) and lld.
- Adapt test in lld-default-sha1.patch.
- Don't disable testing if qemu_user_space_build has been set to 0.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Update to version 17.0.6.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
- Use major version only instead of full (patch-level) version for
  versioned executables: we don't support parallel installation of
  multiple versions of the same LLVM major version. (boo#1217450)
  Also drop the clang-X.Y symlink that was introduced for
  boo#1012260, because Y is always 0.
- Manage clang-cpp with update-alternatives like other binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1703160000">- Revert conflicts/provides for python3-clang to %python3_sitearch
  to retain compatibility with older llvm versions in SLE.</changelog>
</package>
<package pkgid="02437eddc5a2d8436ab297f67567a2d442acb475696cf17034e436e98cd05053" name="clang17-devel" arch="x86_64">
  <version epoch="0" ver="17.0.6" rel="150600.3.2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1678536000">- Add llvm-suse-implicit-gnu.patch to recognize &lt;arch&gt;-suse-linux
  as implicitly GNU. Without this we would get library calls for
  fused-multiply-add even if it's available in hardware.
- Add openmp-drop-rpath.patch: backport revert of adding RUNPATH
  to openmp executables. (boo#1206837)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1679140800">- Update to version 16.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/16.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfo-analyzer: Print a logical representation of
    low-level debug information.
  - llvm-remarkutil: Remark file utilities.
  * The test tool split-file is no longer installed.
  * New Clang tools:
  - amdgpu-arch and nvptx-arch: Tools used to detect locally
    available GPUs by the Clang OpenMP driver.
  - clang-include-cleaner: Standalone tool to determine which
    headers are used, using existing functionality in clangd.
  - clang-tblgen: Table Generation for Clang.
  * Removed Clang tools: clang-{nvlink,offload}-wrapper.
- Rebase patches:
  * assume-opensuse.patch
  * check-no-llvm-exegesis.patch
  * link-clang-shared.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-suse-implicit-gnu.patch
  * llvm-workaround-superfluous-branches.patch
  * openmp-drop-rpath.patch
- Drop patches that have landed upstream:
  * clang-test-xfail-gnuless-triple.patch
  * CMake-Look-up-target-subcomponents-in-LLVM_AVAILABLE_LIBS.patch
  * libcxxabi-fix-armv7-test.patch
  * llvm-armv7-fix-vector-compare-with-zero-lowering.patch
  * llvm-link-atomic.patch
- Remove llvm-better-detect-64bit-atomics-support.patch that should
  not be required anymore.
- Add PGP signatures and keyring for source verification.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1680782400">- Update to version 16.0.1.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="william.brown@suse.com" date="1681387200">- bsc#1210383 - Add aarch64 to lldb platforms</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1681819200">- Relax requirements for clang-tools to allow installation of older
  versions of libclang13 with the -devel package. (boo#1210176)
- Enable ThinLTO for ARM 6/7/8 again. (boo#1178070)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1682078400">- Update to version 16.0.2.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase check-no-llvm-exegesis.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1683460800">- Update to version 16.0.3.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1684324800">- Update to version 16.0.4.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1685793600">- Update to version 16.0.5.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch
- Enable ThinLTO on riscv64.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1686830400">- Update to version 16.0.6.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Make python3-clang noarch again and fix conflicts/provides to
  point to %python3_sitelib instead of %python3_sitearch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695124800">- Update to version 17.0.1.
  * For details, see the release notes:
  - https://releases.llvm.org/17.0.1/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/lld/docs/ReleaseNotes.html
- Rebase patches:
  * libcxx-test-library-path.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
  * llvm-remove-clang-only-flags.patch
  * opt-viewer-Find-style-css-in-usr-share.patch
- Simplify check-no-llvm-exegesis.patch by removing test directory.
- Drop patches that have landed upstream:
  * openmp-drop-rpath.patch
- Add openmp-dont-run-gpu-arch.patch: the binaries are not
  available in our build, and neither are the toolchains they test
  for (NV CUDA and AMD HSA).</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1696680000">- Update to version 17.0.2.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1697716800">- Update to version 17.0.3.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Disable zstd support for now regardless of whether libzstd-devel
  is installed. (boo#1216121)
- Limit number of LTO threads on 32-bit architectures to prevent
  out-of-memory during linking.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1699185600">- Update to version 17.0.4.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Include libomptarget.devicertl.a in libomp*-devel, which is
  required for (GPU) offloading.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1700308800">- Update to version 17.0.5.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Also test clang-tools-extra (at least most parts) and lld.
- Adapt test in lld-default-sha1.patch.
- Don't disable testing if qemu_user_space_build has been set to 0.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Update to version 17.0.6.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
- Use major version only instead of full (patch-level) version for
  versioned executables: we don't support parallel installation of
  multiple versions of the same LLVM major version. (boo#1217450)
  Also drop the clang-X.Y symlink that was introduced for
  boo#1012260, because Y is always 0.
- Manage clang-cpp with update-alternatives like other binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1703160000">- Revert conflicts/provides for python3-clang to %python3_sitearch
  to retain compatibility with older llvm versions in SLE.</changelog>
</package>
<package pkgid="7f03eccda98bb6e245adc5c05d3b67c36510ff78432d97bc7c6a1b4f321051ed" name="clang17-doc" arch="noarch">
  <version epoch="0" ver="17.0.6" rel="150600.3.2.1"/>
  <changelog author="aaronpuchert@alice-dsl.net" date="1670155200">- Update to version 15.0.6.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1673697600">- Update to version 15.0.7.
  * This release contains bug-fixes for the LLVM 15.0.0 release.
    This release is API and ABI compatible with 15.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Build stage 2 with -fno-plt on x86_64: since building with
  - Wl,-z,now the PLT stubs are basically dead code, so eliminating
  the indirection reduces the number of branches and improves code
  locality for the quite frequent cross-DSO calls.
- Add llvm-workaround-superfluous-branches.patch: hints LLVM to
  eliminate branches until gh#llvm/llvm-project#28804 is solved.</changelog>
  <changelog author="dmueller@suse.com" date="1678363200">- update constraints to exclude workers with very slow CPU</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1678536000">- Add llvm-suse-implicit-gnu.patch to recognize &lt;arch&gt;-suse-linux
  as implicitly GNU. Without this we would get library calls for
  fused-multiply-add even if it's available in hardware.
- Add openmp-drop-rpath.patch: backport revert of adding RUNPATH
  to openmp executables. (boo#1206837)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1679140800">- Update to version 16.0.0.
  * For details, see the release notes:
  - https://releases.llvm.org/16.0.0/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/16.0.0/tools/lld/docs/ReleaseNotes.html
  * New LLVM tools:
  - llvm-debuginfo-analyzer: Print a logical representation of
    low-level debug information.
  - llvm-remarkutil: Remark file utilities.
  * The test tool split-file is no longer installed.
  * New Clang tools:
  - amdgpu-arch and nvptx-arch: Tools used to detect locally
    available GPUs by the Clang OpenMP driver.
  - clang-include-cleaner: Standalone tool to determine which
    headers are used, using existing functionality in clangd.
  - clang-tblgen: Table Generation for Clang.
  * Removed Clang tools: clang-{nvlink,offload}-wrapper.
- Rebase patches:
  * assume-opensuse.patch
  * check-no-llvm-exegesis.patch
  * link-clang-shared.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-suse-implicit-gnu.patch
  * llvm-workaround-superfluous-branches.patch
  * openmp-drop-rpath.patch
- Drop patches that have landed upstream:
  * clang-test-xfail-gnuless-triple.patch
  * CMake-Look-up-target-subcomponents-in-LLVM_AVAILABLE_LIBS.patch
  * libcxxabi-fix-armv7-test.patch
  * llvm-armv7-fix-vector-compare-with-zero-lowering.patch
  * llvm-link-atomic.patch
- Remove llvm-better-detect-64bit-atomics-support.patch that should
  not be required anymore.
- Add PGP signatures and keyring for source verification.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1680782400">- Update to version 16.0.1.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="william.brown@suse.com" date="1681387200">- bsc#1210383 - Add aarch64 to lldb platforms</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1681819200">- Relax requirements for clang-tools to allow installation of older
  versions of libclang13 with the -devel package. (boo#1210176)
- Enable ThinLTO for ARM 6/7/8 again. (boo#1178070)</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1682078400">- Update to version 16.0.2.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase check-no-llvm-exegesis.patch.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1683460800">- Update to version 16.0.3.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1684324800">- Update to version 16.0.4.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1685793600">- Update to version 16.0.5.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-remove-clang-only-flags.patch
- Enable ThinLTO on riscv64.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1686830400">- Update to version 16.0.6.
  * This release contains bug-fixes for the LLVM 16.0.0 release.
    This release is API and ABI compatible with 16.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Make python3-clang noarch again and fix conflicts/provides to
  point to %python3_sitelib instead of %python3_sitearch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1695124800">- Update to version 17.0.1.
  * For details, see the release notes:
  - https://releases.llvm.org/17.0.1/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/clang/tools/extra/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/projects/libcxx/docs/ReleaseNotes.html
  - https://releases.llvm.org/17.0.1/tools/lld/docs/ReleaseNotes.html
- Rebase patches:
  * libcxx-test-library-path.patch
  * llvm_build_tablegen_component_as_shared_library.patch
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
  * llvm-remove-clang-only-flags.patch
  * opt-viewer-Find-style-css-in-usr-share.patch
- Simplify check-no-llvm-exegesis.patch by removing test directory.
- Drop patches that have landed upstream:
  * openmp-drop-rpath.patch
- Add openmp-dont-run-gpu-arch.patch: the binaries are not
  available in our build, and neither are the toolchains they test
  for (NV CUDA and AMD HSA).</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1696680000">- Update to version 17.0.2.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1697716800">- Update to version 17.0.3.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Disable zstd support for now regardless of whether libzstd-devel
  is installed. (boo#1216121)
- Limit number of LTO threads on 32-bit architectures to prevent
  out-of-memory during linking.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1699185600">- Update to version 17.0.4.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Include libomptarget.devicertl.a in libomp*-devel, which is
  required for (GPU) offloading.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1700308800">- Update to version 17.0.5.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase llvm-do-not-install-static-libraries.patch.
- Also test clang-tools-extra (at least most parts) and lld.
- Adapt test in lld-default-sha1.patch.
- Don't disable testing if qemu_user_space_build has been set to 0.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1701345600">- Update to version 17.0.6.
  * This release contains bug-fixes for the LLVM 17.0.0 release.
    This release is API and ABI compatible with 17.0.0.
- Rebase patches:
  * llvm-do-not-install-static-libraries.patch
  * llvm-normally-versioned-libllvm.patch
- Use major version only instead of full (patch-level) version for
  versioned executables: we don't support parallel installation of
  multiple versions of the same LLVM major version. (boo#1217450)
  Also drop the clang-X.Y symlink that was introduced for
  boo#1012260, because Y is always 0.
- Manage clang-cpp with update-alternatives like other binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1703160000">- Revert conflicts/provides for python3-clang to %python3_sitearch
  to retain compatibility with older llvm versions in SLE.</changelog>
</package>
<package pkgid="e02f448e3b4f41f09e822e4c0db496708790da8318f3a34d8a117c6cbd27e960" name="cloud-init" arch="aarch64">
  <version epoch="0" ver="23.3" rel="150100.8.82.3"/>
  <changelog author="rjschwei@suse.com" date="1675425600">- Add cloud-init-transact-up.patch to support transactional-updates</changelog>
  <changelog author="rjschwei@suse.com" date="1677153600">- Update to version 23.1
  + Remove patches included upstream:
  - cloud-init-btrfs-queue-resize.patch
  - cloud-init-micro-is-suse.patch
  - cloud-init-suse-afternm.patch
  - cloud-init-prefer-nm.patch
  - cloud-init-transact-up.patch
  + Forward port
  - cloud-init-write-routes.patch
  + Added
  - cloud-init-fix-ca-test.patch
  + Support transactional-updates for SUSE based distros (#1997)
    [Robert Schweikert]
  + Set ownership for new folders in Write Files Module (#1980)
    [Jack] (LP: #1990513)
  + add OpenCloudOS and TencentOS support (#1964) [wynnfeng]
  + lxd: Retry if the server isn't ready (#2025)
  + test: switch pycloudlib source to pypi (#2024)
  + test: Fix integration test deprecation message (#2023)
  + Recognize opensuse-microos, dev tooling fixes [Robert Schweikert]
  + sources/azure: refactor imds handler into own module (#1977)
    [Chris Patterson]
  + docs: deprecation generation support [1/2] (#2013)
  + add function is_virtual to distro/FreeBSD (#1957) [Mina Galić]
  + cc_ssh: support multiple hostcertificates (#2018) (LP: #1999164)
  + Fix minor schema validation regression and fixup typing (#2017)
  + doc: Reword user data debug section (#2019)
  + Overhaul/rewrite of certificate handling as follows: (#1962)
    [dermotbradley] (LP: #1931174)
  + disk_setup: use byte string when purging the partition table (#2012)
    [Stefan Prietl]
  + cli: schema also validate vendordata*.
  + ci: sort and add checks for cla signers file [Stefan Prietl]
  + Add "ederst" as contributor (#2010) [Stefan Prietl]
  + readme: add reference to packages dir (#2001)
  + docs: update downstream package list (#2002)
  + docs: add google search verification (#2000) [s-makin]
  + docs: fix 404 render use default notfound_urls_prefix in RTD conf (#2004)
  + Fix OpenStack datasource detection on bare metal (#1923)
    [Alexander Birkner] (LP: #1815990)
  + docs: add themed RTD 404 page and pointer to readthedocs-hosted (#1993)
  + schema: fix gpt labels, use type string for GUID (#1995)
  + cc_disk_setup: code cleanup (#1996)
  + netplan: keep custom strict perms when 50-cloud-init.yaml exists
  + cloud-id: better handling of change in datasource files
    [d1r3ct0r] (LP: #1998998)
  + tests: Remove restart check from test
  + Ignore duplicate macs from mscc_felix and fsl_enetc (LP: #1997922)
  + Warn on empty network key (#1990)
  + Fix Vultr cloud_interfaces usage (#1986) [eb3095]
  + cc_puppet: Update puppet service name (#1970) [d1r3ct0r] (LP: #2002969)
  + docs: Clarify networking docs (#1987)
  + lint: remove httpretty (#1985) [sxt1001]
  + cc_set_passwords: Prevent traceback when restarting ssh (#1981)
  + tests: fix lp1912844 (#1978)
  + tests: Skip ansible test on bionic (#1984)
  + Wait for NetworkManager (#1983) [Robert Schweikert]
  + docs: minor polishing (#1979) [s-makin]
  + CI: migrate integration-test to GH actions (#1969)
  + Fix permission of SSH host keys (#1971) [Ron Gebauer]
  + Fix default route rendering on v2 ipv6 (#1973) (LP: #2003562)
  + doc: fix path in net_convert command (#1975)
  + docs: update net_convert docs (#1974)
  + doc: fix dead link
  + cc_set_hostname: ignore /var/lib/cloud/data/set-hostname if it's empty
    (#1967) [Emanuele Giuseppe Esposito]
  + distros/rhel.py: _read_hostname() missing strip on "hostname" (#1941)
    [Mark Mielke]
  + integration tests: add  IBM VPC support (SC-1352) (#1915)
  + machine-id: set to uninitialized to trigger regeneration on clones
    (LP: #1999680)
  + sources/azure: retry on connection error when fetching metdata (#1968)
    [Chris Patterson]
  + Ensure ssh state accurately obtained (#1966)
  + bddeb: drop dh-systemd dependency on newer deb-based releases [d1r3ct0r]
  + doc: fix `config formats` link in cloudsigma.rst (#1960)
  + Fix wrong subp syntax in cc_set_passwords.py (#1961)
  + docs: update the PR template link to readthedocs (#1958) [d1r3ct0r]
  + ci: switch unittests to gh actions (#1956)
  + Add mount_default_fields for PhotonOS. (#1952) [Shreenidhi Shedi]
  + sources/azure: minor refactor for metadata source detection logic
    (#1936) [Chris Patterson]
  + add "CalvoM" as contributor (#1955) [d1r3ct0r]
  + ci: doc to gh actions (#1951)
  + lxd: handle 404 from missing devices route for LXD 4.0 (LP: #2001737)
  + docs: Diataxis overhaul (#1933) [s-makin]
  + vultr: Fix issue regarding cache and region codes (#1938) [eb3095]
  + cc_set_passwords: Move ssh status checking later (SC-1368) (#1909)
    (LP: #1998526)
  + Improve Wireguard module idempotency (#1940) [Fabian Lichtenegger-Lukas]
  + network/netplan: add gateways as on-link when necessary (#1931)
    [Louis Sautier] (LP: #2000596)
  + tests: test_lxd assert features.networks.zones when present (#1939)
  + Use btrfs enquque when available (#1926) [Robert Schweikert]
  + sources/azure: drop description for report_failure_to_fabric() (#1934)
    [Chris Patterson]
  + cc_disk_setup.py: fix MBR single partition creation (#1932)
    [dermotbradley] (LP: #1851438)
  + Fix typo with package_update/package_upgrade (#1927) [eb3095]
  + sources/azure: fix device driver matching for net config (#1914)
    [Chris Patterson]
  + BSD: fix duplicate macs in Ifconfig parser (#1917) [Mina Galić]
  + test: mock dns calls (#1922)
  + pycloudlib: add lunar support for integration tests (#1928)
  + nocloud: add support for dmi variable expansion for seedfrom URL
    (LP: #1994980)
  + tools: read-version drop extra call to git describe --long
  + doc: improve cc_write_files doc (#1916)
  + read-version: When insufficient tags, use cloudinit.version.get_version
  + mounts: document weird prefix in schema (#1913)
  + add utility function test cases (#1910) [sxt1001]
  + test: mock file deletion in dhcp tests (#1911)
  + Ensure network ready before cloud-init service runs on RHEL (#1893)
    (LP: #1998655)
  + docs: add copy button to code blocks (#1890) [s-makin]
  + netplan: define features.NETPLAN_CONFIG_ROOT_READ_ONLY flag
  + azure: fix support for systems without az command installed (#1908)
  + Networking Clarification (#1892)
  + Fix the distro.osfamily output problem in the openEuler system. (#1895)
    [sxt1001] (LP: #1999042)
  + pycloudlib: bump commit dropping azure api smoke test
  + net: netplan config root read-only as wifi config can contain creds
  + autoinstall: clarify docs for users
  + sources/azure: encode health report as utf-8 (#1897) [Chris Patterson]
  + Add back gateway4/6 deprecation to docs (#1898)
  + networkd: Add support for multiple [Route] sections (#1868)
    [Nigel Kukard]
  + doc: add qemu tutorial (#1863)
  + lint: fix tip-flake8 and tip-mypy (#1896)
  + Add support for setting uid when creating users on FreeBSD (#1888)
    [einsibjarni]
  + Fix exception in BSD networking code-path (#1894) [Mina Galić]
  + Append derivatives to is_rhel list in cloud.cfg.tmpl (#1887) [Louis Abel]
  + FreeBSD init: use cloudinit_enable as only rcvar (#1875) [Mina Galić]
  + feat: add support aliyun metadata security harden mode (#1865)
    [Manasseh Zhou]
  + docs: uprate analyze to performance page [s-makin]
  + test: fix lxd preseed managed network config (#1881)
  + Add support for static IPv6 addresses for FreeBSD (#1839) [einsibjarni]
  + Make 3.12 failures not fail the build (#1873)
  + Docs: adding relative links [s-makin]
  + Update read-version
  + Fix setup.py to align with PEP 440 versioning replacing trailing
  + travis: promote 3.11-dev to 3.11 (#1866)
  + test_cloud_sigma: delete useless test (#1828) [sxt1001]
  + Add "nkukard" as contributor (#1864) [Nigel Kukard]
  + tests: ds-id mocks for vmware-rpctool as utility may not exist in env
  + doc: add how to render new module doc (#1855)
  + doc: improve module creation explanation (#1851)
  + Add Support for IPv6 metadata to OpenStack (#1805)
    [Marvin Vogt] (LP: #1906849)
  + add xiaoge1001 to .github-cla-signers (#1854) [sxt1001]
  + network: Deprecate gateway{4,6} keys in network config v2 (#1794)
    (LP: #1992512)
  + VMware: Move Guest Customization transport from OVF to VMware (#1573)
    [PengpengSun]
  + doc: home page links added (#1852) [s-makin]
  From 22.4.2
  + status: handle ds not defined in status.json (#1876) (LP: #1997559)
  From 22.4.1
  + net: skip duplicate mac check for netvsc nic and its VF (#1853)
    [Anh Vo] (LP: #1844191)
  + ChangeLog: whitespace cleanup (#1850)
  + changelog: capture 22.3.1-4 releases</changelog>
  <changelog author="rjschwei@suse.com" date="1681214400">- Sensitive data exposure (bsc#1210277, CVE-2023-1786)
  + Add hidesensitivedata
  + Add cloud-init-cve-2023-1786-redact-inst-data.patch
  + Do not expose sensitive data gathered from the CSP</changelog>
  <changelog author="rjschwei@suse.com" date="1682596800">- Add cloud-init-power-rhel-only.patch (bsc#1210273)
  + Config module cc_refresh_rmc_and_interface is implemented such that
    it will only work on RH distros. Set the module availability accordingly.</changelog>
  <changelog author="rjschwei@suse.com" date="1688644800">- Update cloud-init-write-routes.patch (bsc#1212879)
  + Add necessary import statement
- Enable flake8 linting, fix up patches
  + cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  + cloud-init-power-rhel-only.patch
  + cloud-init-write-routes.patch
  + datasourceLocalDisk.patch</changelog>
  <changelog author="dmueller@suse.com" date="1691928000">- update to 23.1.2:
  * Make user/vendor data sensitive and remove log permissions
  * source: Force OpenStack when it is only option (#2045)
  * sources/azure: fix regressions in IMDS behavior
- drop
  cloud-init-cve-2023-1786-redact-instance-data-json-main.patch (upstream)
- spec-file cleanups, including dropping flake8 (as build fails
  with newer flake8 versions)</changelog>
  <changelog author="rjschwei@suse.com" date="1692014400">- Add cloud-init-flake8-fixes.patch
- Revert chnages from previous commit
  + Disabling checks the primary maintainer enabled for specific reasons
    is not a fix.</changelog>
  <changelog author="rjschwei@suse.com" date="1696852800">- Update to version 23.3 (bsc#1216011, bsc#1215794, bsc#1215740)
  + Remove patches included upstream:
  - cloud-init-fix-ca-test.patch
  - cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  - cloud-init-power-rhel-only.patch
  - cloud-init-flake8-fixes.patch
  + Add
  - cloud-init-keep-flake.patch
  - cloud-init-lint-fixes.patch
  + Update
  - cloud-init-write-routes.patch (bsc#1216007)
  + Bump pycloudlib to 1!5.1.0 for ec2 mantic daily image support (#4390)
  + Fix cc_keyboard in mantic (LP: #2030788)
  + ec2: initialize get_instance_userdata return value to bytes (#4387)
    [Noah Meyerhans]
  + cc_users_groups: Add doas/opendoas support (#4363) [dermotbradley]
  + Fix pip-managed ansible
  + status: treat SubState=running and MainPID=0 as service exited
  + azure/imds: increase read-timeout to 30s (#4372) [Chris Patterson]
  + collect-logs fix memory usage (SC-1590) (#4289)
    [Alec Warren] (LP: #1980150)
  + cc_mounts: Use fallocate to create swapfile on btrfs (#4369) [王煎饼]
  + Undocument nocloud-net (#4318)
  + feat(akamai): add akamai to settings.py and apport.py (#4370)
  + read-version: fallback to get_version when git describe fails (#4366)
  + apt: fix cloud-init status --wait blocking on systemd v 253 (#4364)
  + integration tests: Pass username to pycloudlib (#4324)
  + Bump pycloudlib to 1!5.1.0 (#4353)
  + cloud.cfg.tmpl: reorganise, minimise/reduce duplication (#4272)
    [dermotbradley]
  + analyze: fix (unexpected) timestamp parsing (#4347) [Mina Galić]
  + cc_growpart: fix tests to run on FreeBSD (#4351) [Mina Galić]
  + subp: Fix spurious test failure on FreeBSD (#4355) [Mina Galić]
  + cmd/clean: fix tests on non-Linux platforms (#4352) [Mina Galić]
  + util: Fix get_proc_ppid() on non-Linux systems (#4348) [Mina Galić]
  + cc_wireguard: make tests pass on FreeBSD (#4346) [Mina Galić]
  + unittests: fix breakage in test_read_cfg_paths_fetches_cached_datasource
    (#4328) [Ani Sinha]
  + Fix test_tools.py collection (#4315)
  + cc_keyboard: add Alpine support (#4278) [dermotbradley]
  + Flake8 fixes (#4340) [Robert Schweikert]
  + cc_mounts: Fix swapfile not working on btrfs (#4319) [王煎饼] (LP: #1884127)
  + ds-identify/CloudStack: $DS_MAYBE if vm running on vmware/xen (#4281)
    [Wei Zhou]
  + ec2: Support double encoded userdata (#4276) [Noah Meyerhans]
  + cc_mounts: xfs is a Linux only FS (#4334) [Mina Galić]
  + tests/net: fix TestGetInterfaces' mock coverage for get_master (#4336)
    [Chris Patterson]
  + change openEuler to openeuler and fix some bugs in openEuler (#4317)
    [sxt1001]
  + Replace flake8 with ruff (#4314)
  + NM renderer: set default IPv6 addr-gen-mode for all interfaces to eui64
    (#4291) [Ani Sinha]
  + cc_ssh_import_id: add Alpine support and add doas support (#4277)
    [dermotbradley]
  + sudoers not idempotent (SC-1589)  (#4296) [Alec Warren] (LP: #1998539)
  + Added support for Akamai Connected Cloud (formerly Linode) (#4167)
    [Will Smith]
  + Fix reference before assignment (#4292)
  + Overhaul module reference page (#4237) [Sally]
  + replaced spaces with commas for setting passenv (#4269) [Alec Warren]
  + DS VMware: modify a few log level (#4284) [PengpengSun]
  + tools/read-version refactors and unit tests (#4268)
  + Ensure get_features() grabs all features (#4285)
  + Don't always require passlib dependency (#4274)
  + tests: avoid leaks into host system checking of ovs-vsctl cmd (#4275)
  + Fix NoCloud kernel commandline key parsing (#4273)
  + testing: Clear all LRU caches after each test (#4249)
  + Remove the crypt dependency (#2139) [Gonéri Le Bouder]
  + logging: keep current file mode of log file if its stricter than the
    new mode (#4250) [Ani Sinha]
  + Remove default membership in redundant groups (#4258)
    [Dave Jones] (LP: #1923363)
  + doc: improve datasource_creation.rst (#4262)
  + Remove duplicate Integration testing button (#4261) [Rishita Shaw]
  + tools/read-version: fix the tool so that it can handle version parsing
    errors (#4234) [Ani Sinha]
  + net/dhcp: add udhcpc support (#4190) [Jean-François Roche]
  + DS VMware: add i386 arch dir to deployPkg plugin search path
    [PengpengSun]
  + LXD moved from linuxcontainers.org to Canonical [Simon Deziel]
  + cc_mounts.py: Add note about issue with creating mounts inside mounts
    (#4232) [dermotbradley]
  + lxd: install lxd from snap, not deb if absent in image
  + landscape: use landscape-config to write configuration
  + Add deprecation log during init of DataSourceDigitalOcean (#4194)
    [tyb-truth]
  + doc: fix typo on apt.primary.arches (#4238) [Dan Bungert]
  + Inspect systemd state for cloud-init status (#4230)
  + instance-data: add system-info and features to combined-cloud-config
    (#4224)
  + systemd: Block login until config stage completes (#2111) (LP: #2013403)
  + tests: proposed should invoke apt-get install -t=&lt;release&gt;-proposed
    (#4235)
  + cloud.cfg.tmpl: reinstate ca_certs entry (#4236) [dermotbradley]
  + Remove feature flag override ability (#4228)
  + tests: drop stray unrelated file presence test (#4227)
  + Update LXD URL (#4223) [Sally]
  + schema: add network v1 schema definition and validation functions
  + tests: daily PPA for devel series is version 99.daily update tests to
    match (#4225)
  + instance-data: write /run/cloud-init/combined-cloud-config.json
  + mount parse: Fix matching non-existent directories (#4222) [Mina Galić]
  + Specify build-system for pep517 (#4218)
  + Fix network v2 metric rendering (#4220)
  + Migrate content out of FAQ page (SD-1187) (#4205) [Sally]
  + setup: fix generation of init templates (#4209) [Mina Galić]
  + docs: Correct some bootcmd example wording
  + fix changelog
  + tests: reboot client to assert x-shellscript-per-boot is triggered
  + nocloud: parse_cmdline no longer detects nocloud-net datasource (#4204)
    (LP: 4203, #2025180)
  + Add docstring and typing to mergemanydict (#4200)
  + BSD: add dsidentify to early startup scripts (#4182) [Mina Galić]
  + handler: report errors on skipped merged cloud-config.txt parts
    (LP: #1999952)
  + Add cloud-init summit writeups (#4179) [Sally]
  + tests: Update test_clean_log for oci (#4187)
  + gce: improve ephemeral fallback NIC selection (CPC-2578) (#4163)
  + tests: pin pytest 7.3.1 to avoid adverse testpaths behavior (#4184)
  + Ephemeral Networking for FreeBSD (#2165) [Mina Galić]
  + Clarify directory syntax for nocloud local filesystem. (#4178)
  + Set default renderer as sysconfig for centos/rhel (#4165) [Ani Sinha]
  + Test static routes and netplan 0.106
  + FreeBSD fix parsing of mount and mount options (#2146) [Mina Galić]
  + test: add tracking bug id (#4164)
  + tests: can't match MAC for LXD container veth due to netplan 0.106
    (#4162)
  + Add kaiwalyakoparkar as a contributor (#4156) [Kaiwalya Koparkar]
  + BSD: remove datasource_list from cloud.cfg template (#4159) [Mina Galić]
  + launching salt-minion in masterless mode (#4110) [Denis Halturin]
  + tools: fix run-container builds for rockylinux/8 git hash mismatch
    (#4161)
  + fix doc lint: spellchecker tripped up (#4160) [Mina Galić]
  + Support Ephemeral Networking for BSD (#2127)
  + Added / fixed support for static routes on OpenBSD and FreeBSD (#2157)
    [Kadir Mueller]
  + cc_rsyslog: Refactor for better multi-platform support (#4119)
    [Mina Galić] (LP: #1798055)
  + tests: fix test_lp1835584 (#4154)
  + cloud.cfg mod names: docs and rename salt_minion and set_password (#4153)
  + tests: apt support for deb822 format .sources files on mantic
  + vultr: remove check_route check (#2151) [Jonas Chevalier]
  + Update SECURITY.md (#4150) [Indrranil Pawar]
  + Update CONTRIBUTING.rst (#4149) [Indrranil Pawar]
  + Update .github-cla-signers (#4151) [Indrranil Pawar]
  + Standardise module names in cloud.cfg.tmpl to only use underscore
    (#4128) [dermotbradley]
  + tests: update test_webhook_reporting
  + Modify PR template so autoclose works
  + doc: add missing semi-colon to nocloud cmdline docs (#4120)
  + .gitignore: extend coverage pattern (#4143) [Mina Galić]
  From 23.2.2
  + Fix NoCloud kernel commandline key parsing (#4273) (Fixes: #4271)
    (LP: #2028562)
  + Fix reference before assignment (#4292) (Fixes: #4288) (LP: #2028784)
  From 23.2.1
  + nocloud: Fix parse_cmdline detection of nocloud-net datasource (#4204)
    (Fixes: 4203) (LP: #2025180)
  From 23.2
  + BSD: simplify finding MBR partitions by removing duplicate code
  [Mina Galić]
  + tests: bump pycloudlib version for mantic builds
  + network-manager: Set higher autoconnect priority for nm keyfiles (#3671)
    [Ani Sinha]
  + alpine.py: change the locale file used (#4139) [dermotbradley]
  + cc_ntp: Sync up with current FreeBSD ntp.conf (#4122) [Mina Galić]
  + config: drop refresh_rmc_and_interface as RHEL 7 no longer supported
    [Robert Schweikert]
  + docs: Add feedback button to docs
  + net/sysconfig: enable sysconfig renderer if network manager has ifcfg-rh
    plugin (#4132) [Ani Sinha]
  + For Alpine use os-release PRETTY_NAME (#4138) [dermotbradley]
  + network_manager: add a method for ipv6 static IP configuration (#4127)
    [Ani Sinha]
  + correct misnamed template file host.mariner.tmpl (#4124) [dermotbradley]
  + nm: generate ipv6 stateful dhcp config at par with sysconfig (#4115)
    [Ani Sinha]
  + Add templates for GitHub Issues
  + Add 'peers' and 'allow' directives in cc_ntp (#3124) [Jacob Salmela]
  + FreeBSD: Fix user account locking (#4114) [Mina Galić] (GH: #1854594)
  + FreeBSD: add ResizeGrowFS class to cc_growpart (#2334) [Mina Galić]
  + Update tests in Azure TestCanDevBeReformatted class (#2771)
    [Ksenija Stanojevic]
  + Replace Launchpad references with GitHub Issues
  + Fix KeyError in iproute pformat (#3287) [Dmitry Zykov]
  + schema: read_cfg_paths call init.fetch to lookup /v/l/c/instance
  + azure/errors: introduce reportable errors for imds (#3647)
    [Chris Patterson]
  + FreeBSD (and friends): better identify MBR slices (#2168)
    [Mina Galić] (LP: #2016350)
  + azure/errors: add host reporting for dhcp errors (#2167)
    [Chris Patterson]
  + net: purge blacklist_drivers across net and azure (#2160)
    [Chris Patterson]
  + net: refactor hyper-v VF filtering and apply to get_interfaces() (#2153)
    [Chris Patterson]
  + tests: avoid leaks to underlying filesystem for /etc/cloud/clean.d
    (#2251)
  + net: refactor find_candidate_nics_on_linux() to use get_interfaces()
    (#2159) [Chris Patterson]
  + resolv_conf: Allow &gt; 3 nameservers (#2152) [Major Hayden]
  + Remove mount NTFS error message (#2134) [Ksenija Stanojevic]
  + integration tests: fix image specification parsing (#2166)
  + ci: add hypothesis scheduled GH check (#2149)
  + Move supported distros list to docs (#2162)
  + Fix logger, use instance rather than module function (#2163)
  + README: Point to Github Actions build status (#2158)
  + Revert "fix linux-specific code on bsd (#2143)" (#2161)
  + Do not generate dsa and ed25519 key types when crypto FIPS mode is
    enabled (#2142) [Ani Sinha] (LP: 2017761)
  + Add documentation label automatically (#2156)
  + sources/azure: report success to host and introduce kvp module (#2141)
    [Chris Patterson]
  + setup.py: use pkg-config for udev/rules path (#2137) [dankm]
  + openstack/static: honor the DNS servers associated with a network
    (#2138) [Gonéri Le Bouder]
  + fix linux-specific code on bsd (#2143)
  + cli: schema validation of jinja template user-data (SC-1385) (#2132)
    (LP: #1881925)
  + gce: activate network discovery on every boot (#2128)
  + tests: update integration test to assert 640 across reboots (#2145)
  + Make user/vendor data sensitive and remove log permissions (#2144)
    (LP: #2013967)
  + Update kernel command line docs (SC-1457) (#2133)
  + docs: update network configuration path links (#2140) [d1r3ct0r]
  + sources/azure: report failures to host via kvp (#2136) [Chris Patterson]
  + net: Document use of `ip route append` to add routes (#2130)
  + dhcp: Add missing mocks (#2135)
  + azure/imds: retry fetching metadata up to 300 seconds (#2121)
    [Chris Patterson]
  + [1/2] DHCP: Refactor dhcp client code  (#2122)
  + azure/errors: treat traceback_base64 as string (#2131) [Chris Patterson]
  + azure/errors: introduce reportable errors (#2129) [Chris Patterson]
  + users: schema permit empty list to indicate create no users
  + azure: introduce identity module (#2116) [Chris Patterson]
  + Standardize disabling cloud-init on non-systemd (#2112)
  + Update .github-cla-signers (#2126) [Rob Tongue]
  + NoCloud: Use seedfrom protocol to determine mode (#2107)
  + rhel: Remove sysvinit files. (#2114)
  + tox.ini: set -vvvv --showlocals for pytest (#2104) [Chris Patterson]
  + Fix NoCloud kernel commandline semi-colon args
  + run-container: make the container/VM timeout configurable (#2118)
    [Paride Legovini]
  + suse: Remove sysvinit files. (#2115)
  + test: Backport assert_call_count for old requests (#2119)
  + Add "licebmi" as contributor (#2113) [Mark Martinez]
  + Adapt DataSourceScaleway to upcoming IPv6 support (#2033)
    [Louis Bouchard]
  + rhel: make sure previous-hostname file ends with a new line (#2108)
    [Ani Sinha]
  + Adding contributors for DataSourceAkamai (#2110) [acourdavAkamai]
  + Cleanup ephemeral IP routes on exception (#2100) [sxt1001]
  + commit 09a64badfb3f51b1b391fa29be19962381a4bbeb [sxt1001] (LP: #2011291)
  + Standardize kernel commandline user interface (#2093)
  + config/cc_resizefs: fix do_resize arguments (#2106) [Chris Patterson]
  + Fix test_dhclient_exits_with_error (#2105)
  + net/dhcp: catch dhclient failures and raise NoDHCPLeaseError (#2083)
    [Chris Patterson]
  + sources/azure: move pps handling out of _poll_imds() (#2075)
    [Chris Patterson]
  + tests: bump pycloudlib version (#2102)
  + schema: do not manipulate draft4 metaschema for jsonschema 2.6.0 (#2098)
  + sources/azure/imds: don't count timeout errors as connection errors
    (#2074) [Chris Patterson]
  + Fix Python 3.12 unit test failures (#2099)
  + integration tests: Refactor instance checking (#1989)
  + ci: migrate remaining jobs from travis to gh (#2085)
  + missing ending quote in instancedata docs(#2094) [Hong L]
  + refactor: stop passing log instances to cc_* handlers (#2016) [d1r3ct0r]
  + tests/vmware: fix test_no_data_access_method failure (#2092)
    [Chris Patterson]
  + Don't change permissions of netrules target (#2076) (LP: #2011783)
  + tests/sources: patch util.get_cmdline() for datasource tests (#2091)
    [Chris Patterson]
  + macs: ignore duplicate MAC for devs with driver driver qmi_wwan (#2090)
    (LP: #2008888)
  + Fedora: Enable CA handling (#2086) [František Zatloukal]
  + Send dhcp-client-identifier for InfiniBand ports (#2043) [Waleed Mousa]
  + cc_ansible: complete the examples and doc (#2082) [Yves]
  + bddeb: for dev package, derive debhelper-compat from host system
  + apport: only prompt for cloud_name when instance-data.json is absent
  + datasource: Optimize datasource detection, fix bugs (#2060)
  + Handle non existent ca-cert-config situation (#2073) [Shreenidhi Shedi]
  + sources/azure: add networking check for all source PPS (#2061)
    [Chris Patterson]
  + do not attempt dns resolution on ip addresses (#2040)
  + chore: fix style tip (#2071)
  + Fix metadata IP in instancedata.rst (#2063) [Brian Haley]
  + util: Pass deprecation schedule in deprecate_call() (#2064)
  + config: Update grub-dpkg docs (#2058)
  + docs: Cosmetic improvements and styling (#2057) [s-makin]
  + cc_grub_dpkg: Added UEFI support (#2029) [Alexander Birkner]
  + tests: Write to /var/spool/rsyslog to adhere to apparmor profile (#2059)
  + oracle-ds: prefer system_cfg over ds network config source (#1998)
    (LP: #1956788)
  + Remove dead code (#2038)
  + source: Force OpenStack when it is only option (#2045) (LP: #2008727)
  + cc_ubuntu_advantage: improve UA logs discovery
  + sources/azure: fix regressions in IMDS behavior (#2041) [Chris Patterson]
  + tests: fix test_schema (#2042)
  + dhcp: Cleanup unused kwarg (#2037)
  + sources/vmware/imc: fix-missing-catch-few-negtive-scenarios (#2027)
    [PengpengSun]
  + dhclient_hook: remove vestigal dhclient_hook command (#2015)
  + log: Add standardized deprecation tooling (SC-1312) (#2026)
  + Enable SUSE based distros for ca handling (#2036) [Robert Schweikert]
  From 23.1.2
  + Make user/vendor data sensitive and remove log permissions
    (LP: #2013967) (CVE-2023-1786)
  From 23.1.1
  + source: Force OpenStack when it is only option (#2045)
  + sources/azure: fix regressions in IMDS behavior (#2041)
    [Chris Patterson]</changelog>
  <changelog author="michal.vyskocil@gmail.com" date="1701432000">- Move fdupes call back to %install (boo#1214169)</changelog>
  <changelog author="rjschwei@suse.com" date="1702641600">- Switch build dependency to the generic distribution-release package</changelog>
  <changelog author="rjschwei@suse.com" date="1705665600">- Add cloud-init-pckg-reboot.patch (boo#1198533, bsc#1218952,  jsc#SMO-326)
  + Support reboot on package update/upgrade via the cloud-init config</changelog>
  <changelog author="rjschwei@suse.com" date="1705752000">- Add cloud-init-skip-empty-conf.patch
  + Skip tests with empty config</changelog>
  <changelog author="rjschwei@suse.com" date="1708430400">- Prepare for RPM 4.20 switch patch syntax</changelog>
  <changelog author="fcrozat@suse.com" date="1709726400">- Hardcode distribution to suse for proper cloud.cfg generation
  (bsc#1220132).</changelog>
  <changelog author="rjschwei@suse.com" date="1711627200">- Add  cloud-init-ds-deterministic.patch (bsc#1221132)
  + Do not guess a data source when checking for a CloudStack
    environment</changelog>
  <changelog author="rjschwei@suse.com" date="1712318400">- Add cloud-init-no-openstack-guess.patch (bsc#1222113)
  + Do not guess if we are running on OpenStack or not. Only recognize
    the known markers and enable cloud-init if we know for sure.</changelog>
  <changelog author="rjschwei@suse.com" date="1712318401">- Add cloud-init-no-nmcfg-needed.patch (bsc#1221726)
  + Do not require a NetworkManager config file in order to detect
    NetworkManager as the renderer</changelog>
  <changelog author="rjschwei@suse.com" date="1712664000">- Update cloud-init-no-openstack-guess.patch
  + Do not enable cloud-init on systems where there is no DMI just
    because no data source has been found. No data source means
    cloud-init will not run.</changelog>
  <changelog author="rjschwei@suse.com" date="1714392000">- Add cloud-init-usr-sudoers.patch (bsc#1223469)
  + Handle the existence of /usr/etc/sudoers to search for the expected
    include location</changelog>
  <changelog author="rjschwei@suse.com" date="1717416000">- Add cloud-init-skip-rename.patch (bsc#1219680)
  + Brute force appraoch to skip renames if the device is already present</changelog>
</package>
<package pkgid="0d9f83e60841f3d5248a4fe2731be2369bfd9517c28ceafb80af8c71b402f91e" name="cloud-init" arch="ppc64le">
  <version epoch="0" ver="23.3" rel="150100.8.82.3"/>
  <changelog author="rjschwei@suse.com" date="1675425600">- Add cloud-init-transact-up.patch to support transactional-updates</changelog>
  <changelog author="rjschwei@suse.com" date="1677153600">- Update to version 23.1
  + Remove patches included upstream:
  - cloud-init-btrfs-queue-resize.patch
  - cloud-init-micro-is-suse.patch
  - cloud-init-suse-afternm.patch
  - cloud-init-prefer-nm.patch
  - cloud-init-transact-up.patch
  + Forward port
  - cloud-init-write-routes.patch
  + Added
  - cloud-init-fix-ca-test.patch
  + Support transactional-updates for SUSE based distros (#1997)
    [Robert Schweikert]
  + Set ownership for new folders in Write Files Module (#1980)
    [Jack] (LP: #1990513)
  + add OpenCloudOS and TencentOS support (#1964) [wynnfeng]
  + lxd: Retry if the server isn't ready (#2025)
  + test: switch pycloudlib source to pypi (#2024)
  + test: Fix integration test deprecation message (#2023)
  + Recognize opensuse-microos, dev tooling fixes [Robert Schweikert]
  + sources/azure: refactor imds handler into own module (#1977)
    [Chris Patterson]
  + docs: deprecation generation support [1/2] (#2013)
  + add function is_virtual to distro/FreeBSD (#1957) [Mina Galić]
  + cc_ssh: support multiple hostcertificates (#2018) (LP: #1999164)
  + Fix minor schema validation regression and fixup typing (#2017)
  + doc: Reword user data debug section (#2019)
  + Overhaul/rewrite of certificate handling as follows: (#1962)
    [dermotbradley] (LP: #1931174)
  + disk_setup: use byte string when purging the partition table (#2012)
    [Stefan Prietl]
  + cli: schema also validate vendordata*.
  + ci: sort and add checks for cla signers file [Stefan Prietl]
  + Add "ederst" as contributor (#2010) [Stefan Prietl]
  + readme: add reference to packages dir (#2001)
  + docs: update downstream package list (#2002)
  + docs: add google search verification (#2000) [s-makin]
  + docs: fix 404 render use default notfound_urls_prefix in RTD conf (#2004)
  + Fix OpenStack datasource detection on bare metal (#1923)
    [Alexander Birkner] (LP: #1815990)
  + docs: add themed RTD 404 page and pointer to readthedocs-hosted (#1993)
  + schema: fix gpt labels, use type string for GUID (#1995)
  + cc_disk_setup: code cleanup (#1996)
  + netplan: keep custom strict perms when 50-cloud-init.yaml exists
  + cloud-id: better handling of change in datasource files
    [d1r3ct0r] (LP: #1998998)
  + tests: Remove restart check from test
  + Ignore duplicate macs from mscc_felix and fsl_enetc (LP: #1997922)
  + Warn on empty network key (#1990)
  + Fix Vultr cloud_interfaces usage (#1986) [eb3095]
  + cc_puppet: Update puppet service name (#1970) [d1r3ct0r] (LP: #2002969)
  + docs: Clarify networking docs (#1987)
  + lint: remove httpretty (#1985) [sxt1001]
  + cc_set_passwords: Prevent traceback when restarting ssh (#1981)
  + tests: fix lp1912844 (#1978)
  + tests: Skip ansible test on bionic (#1984)
  + Wait for NetworkManager (#1983) [Robert Schweikert]
  + docs: minor polishing (#1979) [s-makin]
  + CI: migrate integration-test to GH actions (#1969)
  + Fix permission of SSH host keys (#1971) [Ron Gebauer]
  + Fix default route rendering on v2 ipv6 (#1973) (LP: #2003562)
  + doc: fix path in net_convert command (#1975)
  + docs: update net_convert docs (#1974)
  + doc: fix dead link
  + cc_set_hostname: ignore /var/lib/cloud/data/set-hostname if it's empty
    (#1967) [Emanuele Giuseppe Esposito]
  + distros/rhel.py: _read_hostname() missing strip on "hostname" (#1941)
    [Mark Mielke]
  + integration tests: add  IBM VPC support (SC-1352) (#1915)
  + machine-id: set to uninitialized to trigger regeneration on clones
    (LP: #1999680)
  + sources/azure: retry on connection error when fetching metdata (#1968)
    [Chris Patterson]
  + Ensure ssh state accurately obtained (#1966)
  + bddeb: drop dh-systemd dependency on newer deb-based releases [d1r3ct0r]
  + doc: fix `config formats` link in cloudsigma.rst (#1960)
  + Fix wrong subp syntax in cc_set_passwords.py (#1961)
  + docs: update the PR template link to readthedocs (#1958) [d1r3ct0r]
  + ci: switch unittests to gh actions (#1956)
  + Add mount_default_fields for PhotonOS. (#1952) [Shreenidhi Shedi]
  + sources/azure: minor refactor for metadata source detection logic
    (#1936) [Chris Patterson]
  + add "CalvoM" as contributor (#1955) [d1r3ct0r]
  + ci: doc to gh actions (#1951)
  + lxd: handle 404 from missing devices route for LXD 4.0 (LP: #2001737)
  + docs: Diataxis overhaul (#1933) [s-makin]
  + vultr: Fix issue regarding cache and region codes (#1938) [eb3095]
  + cc_set_passwords: Move ssh status checking later (SC-1368) (#1909)
    (LP: #1998526)
  + Improve Wireguard module idempotency (#1940) [Fabian Lichtenegger-Lukas]
  + network/netplan: add gateways as on-link when necessary (#1931)
    [Louis Sautier] (LP: #2000596)
  + tests: test_lxd assert features.networks.zones when present (#1939)
  + Use btrfs enquque when available (#1926) [Robert Schweikert]
  + sources/azure: drop description for report_failure_to_fabric() (#1934)
    [Chris Patterson]
  + cc_disk_setup.py: fix MBR single partition creation (#1932)
    [dermotbradley] (LP: #1851438)
  + Fix typo with package_update/package_upgrade (#1927) [eb3095]
  + sources/azure: fix device driver matching for net config (#1914)
    [Chris Patterson]
  + BSD: fix duplicate macs in Ifconfig parser (#1917) [Mina Galić]
  + test: mock dns calls (#1922)
  + pycloudlib: add lunar support for integration tests (#1928)
  + nocloud: add support for dmi variable expansion for seedfrom URL
    (LP: #1994980)
  + tools: read-version drop extra call to git describe --long
  + doc: improve cc_write_files doc (#1916)
  + read-version: When insufficient tags, use cloudinit.version.get_version
  + mounts: document weird prefix in schema (#1913)
  + add utility function test cases (#1910) [sxt1001]
  + test: mock file deletion in dhcp tests (#1911)
  + Ensure network ready before cloud-init service runs on RHEL (#1893)
    (LP: #1998655)
  + docs: add copy button to code blocks (#1890) [s-makin]
  + netplan: define features.NETPLAN_CONFIG_ROOT_READ_ONLY flag
  + azure: fix support for systems without az command installed (#1908)
  + Networking Clarification (#1892)
  + Fix the distro.osfamily output problem in the openEuler system. (#1895)
    [sxt1001] (LP: #1999042)
  + pycloudlib: bump commit dropping azure api smoke test
  + net: netplan config root read-only as wifi config can contain creds
  + autoinstall: clarify docs for users
  + sources/azure: encode health report as utf-8 (#1897) [Chris Patterson]
  + Add back gateway4/6 deprecation to docs (#1898)
  + networkd: Add support for multiple [Route] sections (#1868)
    [Nigel Kukard]
  + doc: add qemu tutorial (#1863)
  + lint: fix tip-flake8 and tip-mypy (#1896)
  + Add support for setting uid when creating users on FreeBSD (#1888)
    [einsibjarni]
  + Fix exception in BSD networking code-path (#1894) [Mina Galić]
  + Append derivatives to is_rhel list in cloud.cfg.tmpl (#1887) [Louis Abel]
  + FreeBSD init: use cloudinit_enable as only rcvar (#1875) [Mina Galić]
  + feat: add support aliyun metadata security harden mode (#1865)
    [Manasseh Zhou]
  + docs: uprate analyze to performance page [s-makin]
  + test: fix lxd preseed managed network config (#1881)
  + Add support for static IPv6 addresses for FreeBSD (#1839) [einsibjarni]
  + Make 3.12 failures not fail the build (#1873)
  + Docs: adding relative links [s-makin]
  + Update read-version
  + Fix setup.py to align with PEP 440 versioning replacing trailing
  + travis: promote 3.11-dev to 3.11 (#1866)
  + test_cloud_sigma: delete useless test (#1828) [sxt1001]
  + Add "nkukard" as contributor (#1864) [Nigel Kukard]
  + tests: ds-id mocks for vmware-rpctool as utility may not exist in env
  + doc: add how to render new module doc (#1855)
  + doc: improve module creation explanation (#1851)
  + Add Support for IPv6 metadata to OpenStack (#1805)
    [Marvin Vogt] (LP: #1906849)
  + add xiaoge1001 to .github-cla-signers (#1854) [sxt1001]
  + network: Deprecate gateway{4,6} keys in network config v2 (#1794)
    (LP: #1992512)
  + VMware: Move Guest Customization transport from OVF to VMware (#1573)
    [PengpengSun]
  + doc: home page links added (#1852) [s-makin]
  From 22.4.2
  + status: handle ds not defined in status.json (#1876) (LP: #1997559)
  From 22.4.1
  + net: skip duplicate mac check for netvsc nic and its VF (#1853)
    [Anh Vo] (LP: #1844191)
  + ChangeLog: whitespace cleanup (#1850)
  + changelog: capture 22.3.1-4 releases</changelog>
  <changelog author="rjschwei@suse.com" date="1681214400">- Sensitive data exposure (bsc#1210277, CVE-2023-1786)
  + Add hidesensitivedata
  + Add cloud-init-cve-2023-1786-redact-inst-data.patch
  + Do not expose sensitive data gathered from the CSP</changelog>
  <changelog author="rjschwei@suse.com" date="1682596800">- Add cloud-init-power-rhel-only.patch (bsc#1210273)
  + Config module cc_refresh_rmc_and_interface is implemented such that
    it will only work on RH distros. Set the module availability accordingly.</changelog>
  <changelog author="rjschwei@suse.com" date="1688644800">- Update cloud-init-write-routes.patch (bsc#1212879)
  + Add necessary import statement
- Enable flake8 linting, fix up patches
  + cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  + cloud-init-power-rhel-only.patch
  + cloud-init-write-routes.patch
  + datasourceLocalDisk.patch</changelog>
  <changelog author="dmueller@suse.com" date="1691928000">- update to 23.1.2:
  * Make user/vendor data sensitive and remove log permissions
  * source: Force OpenStack when it is only option (#2045)
  * sources/azure: fix regressions in IMDS behavior
- drop
  cloud-init-cve-2023-1786-redact-instance-data-json-main.patch (upstream)
- spec-file cleanups, including dropping flake8 (as build fails
  with newer flake8 versions)</changelog>
  <changelog author="rjschwei@suse.com" date="1692014400">- Add cloud-init-flake8-fixes.patch
- Revert chnages from previous commit
  + Disabling checks the primary maintainer enabled for specific reasons
    is not a fix.</changelog>
  <changelog author="rjschwei@suse.com" date="1696852800">- Update to version 23.3 (bsc#1216011, bsc#1215794, bsc#1215740)
  + Remove patches included upstream:
  - cloud-init-fix-ca-test.patch
  - cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  - cloud-init-power-rhel-only.patch
  - cloud-init-flake8-fixes.patch
  + Add
  - cloud-init-keep-flake.patch
  - cloud-init-lint-fixes.patch
  + Update
  - cloud-init-write-routes.patch (bsc#1216007)
  + Bump pycloudlib to 1!5.1.0 for ec2 mantic daily image support (#4390)
  + Fix cc_keyboard in mantic (LP: #2030788)
  + ec2: initialize get_instance_userdata return value to bytes (#4387)
    [Noah Meyerhans]
  + cc_users_groups: Add doas/opendoas support (#4363) [dermotbradley]
  + Fix pip-managed ansible
  + status: treat SubState=running and MainPID=0 as service exited
  + azure/imds: increase read-timeout to 30s (#4372) [Chris Patterson]
  + collect-logs fix memory usage (SC-1590) (#4289)
    [Alec Warren] (LP: #1980150)
  + cc_mounts: Use fallocate to create swapfile on btrfs (#4369) [王煎饼]
  + Undocument nocloud-net (#4318)
  + feat(akamai): add akamai to settings.py and apport.py (#4370)
  + read-version: fallback to get_version when git describe fails (#4366)
  + apt: fix cloud-init status --wait blocking on systemd v 253 (#4364)
  + integration tests: Pass username to pycloudlib (#4324)
  + Bump pycloudlib to 1!5.1.0 (#4353)
  + cloud.cfg.tmpl: reorganise, minimise/reduce duplication (#4272)
    [dermotbradley]
  + analyze: fix (unexpected) timestamp parsing (#4347) [Mina Galić]
  + cc_growpart: fix tests to run on FreeBSD (#4351) [Mina Galić]
  + subp: Fix spurious test failure on FreeBSD (#4355) [Mina Galić]
  + cmd/clean: fix tests on non-Linux platforms (#4352) [Mina Galić]
  + util: Fix get_proc_ppid() on non-Linux systems (#4348) [Mina Galić]
  + cc_wireguard: make tests pass on FreeBSD (#4346) [Mina Galić]
  + unittests: fix breakage in test_read_cfg_paths_fetches_cached_datasource
    (#4328) [Ani Sinha]
  + Fix test_tools.py collection (#4315)
  + cc_keyboard: add Alpine support (#4278) [dermotbradley]
  + Flake8 fixes (#4340) [Robert Schweikert]
  + cc_mounts: Fix swapfile not working on btrfs (#4319) [王煎饼] (LP: #1884127)
  + ds-identify/CloudStack: $DS_MAYBE if vm running on vmware/xen (#4281)
    [Wei Zhou]
  + ec2: Support double encoded userdata (#4276) [Noah Meyerhans]
  + cc_mounts: xfs is a Linux only FS (#4334) [Mina Galić]
  + tests/net: fix TestGetInterfaces' mock coverage for get_master (#4336)
    [Chris Patterson]
  + change openEuler to openeuler and fix some bugs in openEuler (#4317)
    [sxt1001]
  + Replace flake8 with ruff (#4314)
  + NM renderer: set default IPv6 addr-gen-mode for all interfaces to eui64
    (#4291) [Ani Sinha]
  + cc_ssh_import_id: add Alpine support and add doas support (#4277)
    [dermotbradley]
  + sudoers not idempotent (SC-1589)  (#4296) [Alec Warren] (LP: #1998539)
  + Added support for Akamai Connected Cloud (formerly Linode) (#4167)
    [Will Smith]
  + Fix reference before assignment (#4292)
  + Overhaul module reference page (#4237) [Sally]
  + replaced spaces with commas for setting passenv (#4269) [Alec Warren]
  + DS VMware: modify a few log level (#4284) [PengpengSun]
  + tools/read-version refactors and unit tests (#4268)
  + Ensure get_features() grabs all features (#4285)
  + Don't always require passlib dependency (#4274)
  + tests: avoid leaks into host system checking of ovs-vsctl cmd (#4275)
  + Fix NoCloud kernel commandline key parsing (#4273)
  + testing: Clear all LRU caches after each test (#4249)
  + Remove the crypt dependency (#2139) [Gonéri Le Bouder]
  + logging: keep current file mode of log file if its stricter than the
    new mode (#4250) [Ani Sinha]
  + Remove default membership in redundant groups (#4258)
    [Dave Jones] (LP: #1923363)
  + doc: improve datasource_creation.rst (#4262)
  + Remove duplicate Integration testing button (#4261) [Rishita Shaw]
  + tools/read-version: fix the tool so that it can handle version parsing
    errors (#4234) [Ani Sinha]
  + net/dhcp: add udhcpc support (#4190) [Jean-François Roche]
  + DS VMware: add i386 arch dir to deployPkg plugin search path
    [PengpengSun]
  + LXD moved from linuxcontainers.org to Canonical [Simon Deziel]
  + cc_mounts.py: Add note about issue with creating mounts inside mounts
    (#4232) [dermotbradley]
  + lxd: install lxd from snap, not deb if absent in image
  + landscape: use landscape-config to write configuration
  + Add deprecation log during init of DataSourceDigitalOcean (#4194)
    [tyb-truth]
  + doc: fix typo on apt.primary.arches (#4238) [Dan Bungert]
  + Inspect systemd state for cloud-init status (#4230)
  + instance-data: add system-info and features to combined-cloud-config
    (#4224)
  + systemd: Block login until config stage completes (#2111) (LP: #2013403)
  + tests: proposed should invoke apt-get install -t=&lt;release&gt;-proposed
    (#4235)
  + cloud.cfg.tmpl: reinstate ca_certs entry (#4236) [dermotbradley]
  + Remove feature flag override ability (#4228)
  + tests: drop stray unrelated file presence test (#4227)
  + Update LXD URL (#4223) [Sally]
  + schema: add network v1 schema definition and validation functions
  + tests: daily PPA for devel series is version 99.daily update tests to
    match (#4225)
  + instance-data: write /run/cloud-init/combined-cloud-config.json
  + mount parse: Fix matching non-existent directories (#4222) [Mina Galić]
  + Specify build-system for pep517 (#4218)
  + Fix network v2 metric rendering (#4220)
  + Migrate content out of FAQ page (SD-1187) (#4205) [Sally]
  + setup: fix generation of init templates (#4209) [Mina Galić]
  + docs: Correct some bootcmd example wording
  + fix changelog
  + tests: reboot client to assert x-shellscript-per-boot is triggered
  + nocloud: parse_cmdline no longer detects nocloud-net datasource (#4204)
    (LP: 4203, #2025180)
  + Add docstring and typing to mergemanydict (#4200)
  + BSD: add dsidentify to early startup scripts (#4182) [Mina Galić]
  + handler: report errors on skipped merged cloud-config.txt parts
    (LP: #1999952)
  + Add cloud-init summit writeups (#4179) [Sally]
  + tests: Update test_clean_log for oci (#4187)
  + gce: improve ephemeral fallback NIC selection (CPC-2578) (#4163)
  + tests: pin pytest 7.3.1 to avoid adverse testpaths behavior (#4184)
  + Ephemeral Networking for FreeBSD (#2165) [Mina Galić]
  + Clarify directory syntax for nocloud local filesystem. (#4178)
  + Set default renderer as sysconfig for centos/rhel (#4165) [Ani Sinha]
  + Test static routes and netplan 0.106
  + FreeBSD fix parsing of mount and mount options (#2146) [Mina Galić]
  + test: add tracking bug id (#4164)
  + tests: can't match MAC for LXD container veth due to netplan 0.106
    (#4162)
  + Add kaiwalyakoparkar as a contributor (#4156) [Kaiwalya Koparkar]
  + BSD: remove datasource_list from cloud.cfg template (#4159) [Mina Galić]
  + launching salt-minion in masterless mode (#4110) [Denis Halturin]
  + tools: fix run-container builds for rockylinux/8 git hash mismatch
    (#4161)
  + fix doc lint: spellchecker tripped up (#4160) [Mina Galić]
  + Support Ephemeral Networking for BSD (#2127)
  + Added / fixed support for static routes on OpenBSD and FreeBSD (#2157)
    [Kadir Mueller]
  + cc_rsyslog: Refactor for better multi-platform support (#4119)
    [Mina Galić] (LP: #1798055)
  + tests: fix test_lp1835584 (#4154)
  + cloud.cfg mod names: docs and rename salt_minion and set_password (#4153)
  + tests: apt support for deb822 format .sources files on mantic
  + vultr: remove check_route check (#2151) [Jonas Chevalier]
  + Update SECURITY.md (#4150) [Indrranil Pawar]
  + Update CONTRIBUTING.rst (#4149) [Indrranil Pawar]
  + Update .github-cla-signers (#4151) [Indrranil Pawar]
  + Standardise module names in cloud.cfg.tmpl to only use underscore
    (#4128) [dermotbradley]
  + tests: update test_webhook_reporting
  + Modify PR template so autoclose works
  + doc: add missing semi-colon to nocloud cmdline docs (#4120)
  + .gitignore: extend coverage pattern (#4143) [Mina Galić]
  From 23.2.2
  + Fix NoCloud kernel commandline key parsing (#4273) (Fixes: #4271)
    (LP: #2028562)
  + Fix reference before assignment (#4292) (Fixes: #4288) (LP: #2028784)
  From 23.2.1
  + nocloud: Fix parse_cmdline detection of nocloud-net datasource (#4204)
    (Fixes: 4203) (LP: #2025180)
  From 23.2
  + BSD: simplify finding MBR partitions by removing duplicate code
  [Mina Galić]
  + tests: bump pycloudlib version for mantic builds
  + network-manager: Set higher autoconnect priority for nm keyfiles (#3671)
    [Ani Sinha]
  + alpine.py: change the locale file used (#4139) [dermotbradley]
  + cc_ntp: Sync up with current FreeBSD ntp.conf (#4122) [Mina Galić]
  + config: drop refresh_rmc_and_interface as RHEL 7 no longer supported
    [Robert Schweikert]
  + docs: Add feedback button to docs
  + net/sysconfig: enable sysconfig renderer if network manager has ifcfg-rh
    plugin (#4132) [Ani Sinha]
  + For Alpine use os-release PRETTY_NAME (#4138) [dermotbradley]
  + network_manager: add a method for ipv6 static IP configuration (#4127)
    [Ani Sinha]
  + correct misnamed template file host.mariner.tmpl (#4124) [dermotbradley]
  + nm: generate ipv6 stateful dhcp config at par with sysconfig (#4115)
    [Ani Sinha]
  + Add templates for GitHub Issues
  + Add 'peers' and 'allow' directives in cc_ntp (#3124) [Jacob Salmela]
  + FreeBSD: Fix user account locking (#4114) [Mina Galić] (GH: #1854594)
  + FreeBSD: add ResizeGrowFS class to cc_growpart (#2334) [Mina Galić]
  + Update tests in Azure TestCanDevBeReformatted class (#2771)
    [Ksenija Stanojevic]
  + Replace Launchpad references with GitHub Issues
  + Fix KeyError in iproute pformat (#3287) [Dmitry Zykov]
  + schema: read_cfg_paths call init.fetch to lookup /v/l/c/instance
  + azure/errors: introduce reportable errors for imds (#3647)
    [Chris Patterson]
  + FreeBSD (and friends): better identify MBR slices (#2168)
    [Mina Galić] (LP: #2016350)
  + azure/errors: add host reporting for dhcp errors (#2167)
    [Chris Patterson]
  + net: purge blacklist_drivers across net and azure (#2160)
    [Chris Patterson]
  + net: refactor hyper-v VF filtering and apply to get_interfaces() (#2153)
    [Chris Patterson]
  + tests: avoid leaks to underlying filesystem for /etc/cloud/clean.d
    (#2251)
  + net: refactor find_candidate_nics_on_linux() to use get_interfaces()
    (#2159) [Chris Patterson]
  + resolv_conf: Allow &gt; 3 nameservers (#2152) [Major Hayden]
  + Remove mount NTFS error message (#2134) [Ksenija Stanojevic]
  + integration tests: fix image specification parsing (#2166)
  + ci: add hypothesis scheduled GH check (#2149)
  + Move supported distros list to docs (#2162)
  + Fix logger, use instance rather than module function (#2163)
  + README: Point to Github Actions build status (#2158)
  + Revert "fix linux-specific code on bsd (#2143)" (#2161)
  + Do not generate dsa and ed25519 key types when crypto FIPS mode is
    enabled (#2142) [Ani Sinha] (LP: 2017761)
  + Add documentation label automatically (#2156)
  + sources/azure: report success to host and introduce kvp module (#2141)
    [Chris Patterson]
  + setup.py: use pkg-config for udev/rules path (#2137) [dankm]
  + openstack/static: honor the DNS servers associated with a network
    (#2138) [Gonéri Le Bouder]
  + fix linux-specific code on bsd (#2143)
  + cli: schema validation of jinja template user-data (SC-1385) (#2132)
    (LP: #1881925)
  + gce: activate network discovery on every boot (#2128)
  + tests: update integration test to assert 640 across reboots (#2145)
  + Make user/vendor data sensitive and remove log permissions (#2144)
    (LP: #2013967)
  + Update kernel command line docs (SC-1457) (#2133)
  + docs: update network configuration path links (#2140) [d1r3ct0r]
  + sources/azure: report failures to host via kvp (#2136) [Chris Patterson]
  + net: Document use of `ip route append` to add routes (#2130)
  + dhcp: Add missing mocks (#2135)
  + azure/imds: retry fetching metadata up to 300 seconds (#2121)
    [Chris Patterson]
  + [1/2] DHCP: Refactor dhcp client code  (#2122)
  + azure/errors: treat traceback_base64 as string (#2131) [Chris Patterson]
  + azure/errors: introduce reportable errors (#2129) [Chris Patterson]
  + users: schema permit empty list to indicate create no users
  + azure: introduce identity module (#2116) [Chris Patterson]
  + Standardize disabling cloud-init on non-systemd (#2112)
  + Update .github-cla-signers (#2126) [Rob Tongue]
  + NoCloud: Use seedfrom protocol to determine mode (#2107)
  + rhel: Remove sysvinit files. (#2114)
  + tox.ini: set -vvvv --showlocals for pytest (#2104) [Chris Patterson]
  + Fix NoCloud kernel commandline semi-colon args
  + run-container: make the container/VM timeout configurable (#2118)
    [Paride Legovini]
  + suse: Remove sysvinit files. (#2115)
  + test: Backport assert_call_count for old requests (#2119)
  + Add "licebmi" as contributor (#2113) [Mark Martinez]
  + Adapt DataSourceScaleway to upcoming IPv6 support (#2033)
    [Louis Bouchard]
  + rhel: make sure previous-hostname file ends with a new line (#2108)
    [Ani Sinha]
  + Adding contributors for DataSourceAkamai (#2110) [acourdavAkamai]
  + Cleanup ephemeral IP routes on exception (#2100) [sxt1001]
  + commit 09a64badfb3f51b1b391fa29be19962381a4bbeb [sxt1001] (LP: #2011291)
  + Standardize kernel commandline user interface (#2093)
  + config/cc_resizefs: fix do_resize arguments (#2106) [Chris Patterson]
  + Fix test_dhclient_exits_with_error (#2105)
  + net/dhcp: catch dhclient failures and raise NoDHCPLeaseError (#2083)
    [Chris Patterson]
  + sources/azure: move pps handling out of _poll_imds() (#2075)
    [Chris Patterson]
  + tests: bump pycloudlib version (#2102)
  + schema: do not manipulate draft4 metaschema for jsonschema 2.6.0 (#2098)
  + sources/azure/imds: don't count timeout errors as connection errors
    (#2074) [Chris Patterson]
  + Fix Python 3.12 unit test failures (#2099)
  + integration tests: Refactor instance checking (#1989)
  + ci: migrate remaining jobs from travis to gh (#2085)
  + missing ending quote in instancedata docs(#2094) [Hong L]
  + refactor: stop passing log instances to cc_* handlers (#2016) [d1r3ct0r]
  + tests/vmware: fix test_no_data_access_method failure (#2092)
    [Chris Patterson]
  + Don't change permissions of netrules target (#2076) (LP: #2011783)
  + tests/sources: patch util.get_cmdline() for datasource tests (#2091)
    [Chris Patterson]
  + macs: ignore duplicate MAC for devs with driver driver qmi_wwan (#2090)
    (LP: #2008888)
  + Fedora: Enable CA handling (#2086) [František Zatloukal]
  + Send dhcp-client-identifier for InfiniBand ports (#2043) [Waleed Mousa]
  + cc_ansible: complete the examples and doc (#2082) [Yves]
  + bddeb: for dev package, derive debhelper-compat from host system
  + apport: only prompt for cloud_name when instance-data.json is absent
  + datasource: Optimize datasource detection, fix bugs (#2060)
  + Handle non existent ca-cert-config situation (#2073) [Shreenidhi Shedi]
  + sources/azure: add networking check for all source PPS (#2061)
    [Chris Patterson]
  + do not attempt dns resolution on ip addresses (#2040)
  + chore: fix style tip (#2071)
  + Fix metadata IP in instancedata.rst (#2063) [Brian Haley]
  + util: Pass deprecation schedule in deprecate_call() (#2064)
  + config: Update grub-dpkg docs (#2058)
  + docs: Cosmetic improvements and styling (#2057) [s-makin]
  + cc_grub_dpkg: Added UEFI support (#2029) [Alexander Birkner]
  + tests: Write to /var/spool/rsyslog to adhere to apparmor profile (#2059)
  + oracle-ds: prefer system_cfg over ds network config source (#1998)
    (LP: #1956788)
  + Remove dead code (#2038)
  + source: Force OpenStack when it is only option (#2045) (LP: #2008727)
  + cc_ubuntu_advantage: improve UA logs discovery
  + sources/azure: fix regressions in IMDS behavior (#2041) [Chris Patterson]
  + tests: fix test_schema (#2042)
  + dhcp: Cleanup unused kwarg (#2037)
  + sources/vmware/imc: fix-missing-catch-few-negtive-scenarios (#2027)
    [PengpengSun]
  + dhclient_hook: remove vestigal dhclient_hook command (#2015)
  + log: Add standardized deprecation tooling (SC-1312) (#2026)
  + Enable SUSE based distros for ca handling (#2036) [Robert Schweikert]
  From 23.1.2
  + Make user/vendor data sensitive and remove log permissions
    (LP: #2013967) (CVE-2023-1786)
  From 23.1.1
  + source: Force OpenStack when it is only option (#2045)
  + sources/azure: fix regressions in IMDS behavior (#2041)
    [Chris Patterson]</changelog>
  <changelog author="michal.vyskocil@gmail.com" date="1701432000">- Move fdupes call back to %install (boo#1214169)</changelog>
  <changelog author="rjschwei@suse.com" date="1702641600">- Switch build dependency to the generic distribution-release package</changelog>
  <changelog author="rjschwei@suse.com" date="1705665600">- Add cloud-init-pckg-reboot.patch (boo#1198533, bsc#1218952,  jsc#SMO-326)
  + Support reboot on package update/upgrade via the cloud-init config</changelog>
  <changelog author="rjschwei@suse.com" date="1705752000">- Add cloud-init-skip-empty-conf.patch
  + Skip tests with empty config</changelog>
  <changelog author="rjschwei@suse.com" date="1708430400">- Prepare for RPM 4.20 switch patch syntax</changelog>
  <changelog author="fcrozat@suse.com" date="1709726400">- Hardcode distribution to suse for proper cloud.cfg generation
  (bsc#1220132).</changelog>
  <changelog author="rjschwei@suse.com" date="1711627200">- Add  cloud-init-ds-deterministic.patch (bsc#1221132)
  + Do not guess a data source when checking for a CloudStack
    environment</changelog>
  <changelog author="rjschwei@suse.com" date="1712318400">- Add cloud-init-no-openstack-guess.patch (bsc#1222113)
  + Do not guess if we are running on OpenStack or not. Only recognize
    the known markers and enable cloud-init if we know for sure.</changelog>
  <changelog author="rjschwei@suse.com" date="1712318401">- Add cloud-init-no-nmcfg-needed.patch (bsc#1221726)
  + Do not require a NetworkManager config file in order to detect
    NetworkManager as the renderer</changelog>
  <changelog author="rjschwei@suse.com" date="1712664000">- Update cloud-init-no-openstack-guess.patch
  + Do not enable cloud-init on systems where there is no DMI just
    because no data source has been found. No data source means
    cloud-init will not run.</changelog>
  <changelog author="rjschwei@suse.com" date="1714392000">- Add cloud-init-usr-sudoers.patch (bsc#1223469)
  + Handle the existence of /usr/etc/sudoers to search for the expected
    include location</changelog>
  <changelog author="rjschwei@suse.com" date="1717416000">- Add cloud-init-skip-rename.patch (bsc#1219680)
  + Brute force appraoch to skip renames if the device is already present</changelog>
</package>
<package pkgid="eecac19142f7ee2d795d3ac33ed4574c06d97f52060c44fb9e116c1f31bd69b1" name="cloud-init" arch="s390x">
  <version epoch="0" ver="23.3" rel="150100.8.82.3"/>
  <changelog author="rjschwei@suse.com" date="1675425600">- Add cloud-init-transact-up.patch to support transactional-updates</changelog>
  <changelog author="rjschwei@suse.com" date="1677153600">- Update to version 23.1
  + Remove patches included upstream:
  - cloud-init-btrfs-queue-resize.patch
  - cloud-init-micro-is-suse.patch
  - cloud-init-suse-afternm.patch
  - cloud-init-prefer-nm.patch
  - cloud-init-transact-up.patch
  + Forward port
  - cloud-init-write-routes.patch
  + Added
  - cloud-init-fix-ca-test.patch
  + Support transactional-updates for SUSE based distros (#1997)
    [Robert Schweikert]
  + Set ownership for new folders in Write Files Module (#1980)
    [Jack] (LP: #1990513)
  + add OpenCloudOS and TencentOS support (#1964) [wynnfeng]
  + lxd: Retry if the server isn't ready (#2025)
  + test: switch pycloudlib source to pypi (#2024)
  + test: Fix integration test deprecation message (#2023)
  + Recognize opensuse-microos, dev tooling fixes [Robert Schweikert]
  + sources/azure: refactor imds handler into own module (#1977)
    [Chris Patterson]
  + docs: deprecation generation support [1/2] (#2013)
  + add function is_virtual to distro/FreeBSD (#1957) [Mina Galić]
  + cc_ssh: support multiple hostcertificates (#2018) (LP: #1999164)
  + Fix minor schema validation regression and fixup typing (#2017)
  + doc: Reword user data debug section (#2019)
  + Overhaul/rewrite of certificate handling as follows: (#1962)
    [dermotbradley] (LP: #1931174)
  + disk_setup: use byte string when purging the partition table (#2012)
    [Stefan Prietl]
  + cli: schema also validate vendordata*.
  + ci: sort and add checks for cla signers file [Stefan Prietl]
  + Add "ederst" as contributor (#2010) [Stefan Prietl]
  + readme: add reference to packages dir (#2001)
  + docs: update downstream package list (#2002)
  + docs: add google search verification (#2000) [s-makin]
  + docs: fix 404 render use default notfound_urls_prefix in RTD conf (#2004)
  + Fix OpenStack datasource detection on bare metal (#1923)
    [Alexander Birkner] (LP: #1815990)
  + docs: add themed RTD 404 page and pointer to readthedocs-hosted (#1993)
  + schema: fix gpt labels, use type string for GUID (#1995)
  + cc_disk_setup: code cleanup (#1996)
  + netplan: keep custom strict perms when 50-cloud-init.yaml exists
  + cloud-id: better handling of change in datasource files
    [d1r3ct0r] (LP: #1998998)
  + tests: Remove restart check from test
  + Ignore duplicate macs from mscc_felix and fsl_enetc (LP: #1997922)
  + Warn on empty network key (#1990)
  + Fix Vultr cloud_interfaces usage (#1986) [eb3095]
  + cc_puppet: Update puppet service name (#1970) [d1r3ct0r] (LP: #2002969)
  + docs: Clarify networking docs (#1987)
  + lint: remove httpretty (#1985) [sxt1001]
  + cc_set_passwords: Prevent traceback when restarting ssh (#1981)
  + tests: fix lp1912844 (#1978)
  + tests: Skip ansible test on bionic (#1984)
  + Wait for NetworkManager (#1983) [Robert Schweikert]
  + docs: minor polishing (#1979) [s-makin]
  + CI: migrate integration-test to GH actions (#1969)
  + Fix permission of SSH host keys (#1971) [Ron Gebauer]
  + Fix default route rendering on v2 ipv6 (#1973) (LP: #2003562)
  + doc: fix path in net_convert command (#1975)
  + docs: update net_convert docs (#1974)
  + doc: fix dead link
  + cc_set_hostname: ignore /var/lib/cloud/data/set-hostname if it's empty
    (#1967) [Emanuele Giuseppe Esposito]
  + distros/rhel.py: _read_hostname() missing strip on "hostname" (#1941)
    [Mark Mielke]
  + integration tests: add  IBM VPC support (SC-1352) (#1915)
  + machine-id: set to uninitialized to trigger regeneration on clones
    (LP: #1999680)
  + sources/azure: retry on connection error when fetching metdata (#1968)
    [Chris Patterson]
  + Ensure ssh state accurately obtained (#1966)
  + bddeb: drop dh-systemd dependency on newer deb-based releases [d1r3ct0r]
  + doc: fix `config formats` link in cloudsigma.rst (#1960)
  + Fix wrong subp syntax in cc_set_passwords.py (#1961)
  + docs: update the PR template link to readthedocs (#1958) [d1r3ct0r]
  + ci: switch unittests to gh actions (#1956)
  + Add mount_default_fields for PhotonOS. (#1952) [Shreenidhi Shedi]
  + sources/azure: minor refactor for metadata source detection logic
    (#1936) [Chris Patterson]
  + add "CalvoM" as contributor (#1955) [d1r3ct0r]
  + ci: doc to gh actions (#1951)
  + lxd: handle 404 from missing devices route for LXD 4.0 (LP: #2001737)
  + docs: Diataxis overhaul (#1933) [s-makin]
  + vultr: Fix issue regarding cache and region codes (#1938) [eb3095]
  + cc_set_passwords: Move ssh status checking later (SC-1368) (#1909)
    (LP: #1998526)
  + Improve Wireguard module idempotency (#1940) [Fabian Lichtenegger-Lukas]
  + network/netplan: add gateways as on-link when necessary (#1931)
    [Louis Sautier] (LP: #2000596)
  + tests: test_lxd assert features.networks.zones when present (#1939)
  + Use btrfs enquque when available (#1926) [Robert Schweikert]
  + sources/azure: drop description for report_failure_to_fabric() (#1934)
    [Chris Patterson]
  + cc_disk_setup.py: fix MBR single partition creation (#1932)
    [dermotbradley] (LP: #1851438)
  + Fix typo with package_update/package_upgrade (#1927) [eb3095]
  + sources/azure: fix device driver matching for net config (#1914)
    [Chris Patterson]
  + BSD: fix duplicate macs in Ifconfig parser (#1917) [Mina Galić]
  + test: mock dns calls (#1922)
  + pycloudlib: add lunar support for integration tests (#1928)
  + nocloud: add support for dmi variable expansion for seedfrom URL
    (LP: #1994980)
  + tools: read-version drop extra call to git describe --long
  + doc: improve cc_write_files doc (#1916)
  + read-version: When insufficient tags, use cloudinit.version.get_version
  + mounts: document weird prefix in schema (#1913)
  + add utility function test cases (#1910) [sxt1001]
  + test: mock file deletion in dhcp tests (#1911)
  + Ensure network ready before cloud-init service runs on RHEL (#1893)
    (LP: #1998655)
  + docs: add copy button to code blocks (#1890) [s-makin]
  + netplan: define features.NETPLAN_CONFIG_ROOT_READ_ONLY flag
  + azure: fix support for systems without az command installed (#1908)
  + Networking Clarification (#1892)
  + Fix the distro.osfamily output problem in the openEuler system. (#1895)
    [sxt1001] (LP: #1999042)
  + pycloudlib: bump commit dropping azure api smoke test
  + net: netplan config root read-only as wifi config can contain creds
  + autoinstall: clarify docs for users
  + sources/azure: encode health report as utf-8 (#1897) [Chris Patterson]
  + Add back gateway4/6 deprecation to docs (#1898)
  + networkd: Add support for multiple [Route] sections (#1868)
    [Nigel Kukard]
  + doc: add qemu tutorial (#1863)
  + lint: fix tip-flake8 and tip-mypy (#1896)
  + Add support for setting uid when creating users on FreeBSD (#1888)
    [einsibjarni]
  + Fix exception in BSD networking code-path (#1894) [Mina Galić]
  + Append derivatives to is_rhel list in cloud.cfg.tmpl (#1887) [Louis Abel]
  + FreeBSD init: use cloudinit_enable as only rcvar (#1875) [Mina Galić]
  + feat: add support aliyun metadata security harden mode (#1865)
    [Manasseh Zhou]
  + docs: uprate analyze to performance page [s-makin]
  + test: fix lxd preseed managed network config (#1881)
  + Add support for static IPv6 addresses for FreeBSD (#1839) [einsibjarni]
  + Make 3.12 failures not fail the build (#1873)
  + Docs: adding relative links [s-makin]
  + Update read-version
  + Fix setup.py to align with PEP 440 versioning replacing trailing
  + travis: promote 3.11-dev to 3.11 (#1866)
  + test_cloud_sigma: delete useless test (#1828) [sxt1001]
  + Add "nkukard" as contributor (#1864) [Nigel Kukard]
  + tests: ds-id mocks for vmware-rpctool as utility may not exist in env
  + doc: add how to render new module doc (#1855)
  + doc: improve module creation explanation (#1851)
  + Add Support for IPv6 metadata to OpenStack (#1805)
    [Marvin Vogt] (LP: #1906849)
  + add xiaoge1001 to .github-cla-signers (#1854) [sxt1001]
  + network: Deprecate gateway{4,6} keys in network config v2 (#1794)
    (LP: #1992512)
  + VMware: Move Guest Customization transport from OVF to VMware (#1573)
    [PengpengSun]
  + doc: home page links added (#1852) [s-makin]
  From 22.4.2
  + status: handle ds not defined in status.json (#1876) (LP: #1997559)
  From 22.4.1
  + net: skip duplicate mac check for netvsc nic and its VF (#1853)
    [Anh Vo] (LP: #1844191)
  + ChangeLog: whitespace cleanup (#1850)
  + changelog: capture 22.3.1-4 releases</changelog>
  <changelog author="rjschwei@suse.com" date="1681214400">- Sensitive data exposure (bsc#1210277, CVE-2023-1786)
  + Add hidesensitivedata
  + Add cloud-init-cve-2023-1786-redact-inst-data.patch
  + Do not expose sensitive data gathered from the CSP</changelog>
  <changelog author="rjschwei@suse.com" date="1682596800">- Add cloud-init-power-rhel-only.patch (bsc#1210273)
  + Config module cc_refresh_rmc_and_interface is implemented such that
    it will only work on RH distros. Set the module availability accordingly.</changelog>
  <changelog author="rjschwei@suse.com" date="1688644800">- Update cloud-init-write-routes.patch (bsc#1212879)
  + Add necessary import statement
- Enable flake8 linting, fix up patches
  + cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  + cloud-init-power-rhel-only.patch
  + cloud-init-write-routes.patch
  + datasourceLocalDisk.patch</changelog>
  <changelog author="dmueller@suse.com" date="1691928000">- update to 23.1.2:
  * Make user/vendor data sensitive and remove log permissions
  * source: Force OpenStack when it is only option (#2045)
  * sources/azure: fix regressions in IMDS behavior
- drop
  cloud-init-cve-2023-1786-redact-instance-data-json-main.patch (upstream)
- spec-file cleanups, including dropping flake8 (as build fails
  with newer flake8 versions)</changelog>
  <changelog author="rjschwei@suse.com" date="1692014400">- Add cloud-init-flake8-fixes.patch
- Revert chnages from previous commit
  + Disabling checks the primary maintainer enabled for specific reasons
    is not a fix.</changelog>
  <changelog author="rjschwei@suse.com" date="1696852800">- Update to version 23.3 (bsc#1216011, bsc#1215794, bsc#1215740)
  + Remove patches included upstream:
  - cloud-init-fix-ca-test.patch
  - cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  - cloud-init-power-rhel-only.patch
  - cloud-init-flake8-fixes.patch
  + Add
  - cloud-init-keep-flake.patch
  - cloud-init-lint-fixes.patch
  + Update
  - cloud-init-write-routes.patch (bsc#1216007)
  + Bump pycloudlib to 1!5.1.0 for ec2 mantic daily image support (#4390)
  + Fix cc_keyboard in mantic (LP: #2030788)
  + ec2: initialize get_instance_userdata return value to bytes (#4387)
    [Noah Meyerhans]
  + cc_users_groups: Add doas/opendoas support (#4363) [dermotbradley]
  + Fix pip-managed ansible
  + status: treat SubState=running and MainPID=0 as service exited
  + azure/imds: increase read-timeout to 30s (#4372) [Chris Patterson]
  + collect-logs fix memory usage (SC-1590) (#4289)
    [Alec Warren] (LP: #1980150)
  + cc_mounts: Use fallocate to create swapfile on btrfs (#4369) [王煎饼]
  + Undocument nocloud-net (#4318)
  + feat(akamai): add akamai to settings.py and apport.py (#4370)
  + read-version: fallback to get_version when git describe fails (#4366)
  + apt: fix cloud-init status --wait blocking on systemd v 253 (#4364)
  + integration tests: Pass username to pycloudlib (#4324)
  + Bump pycloudlib to 1!5.1.0 (#4353)
  + cloud.cfg.tmpl: reorganise, minimise/reduce duplication (#4272)
    [dermotbradley]
  + analyze: fix (unexpected) timestamp parsing (#4347) [Mina Galić]
  + cc_growpart: fix tests to run on FreeBSD (#4351) [Mina Galić]
  + subp: Fix spurious test failure on FreeBSD (#4355) [Mina Galić]
  + cmd/clean: fix tests on non-Linux platforms (#4352) [Mina Galić]
  + util: Fix get_proc_ppid() on non-Linux systems (#4348) [Mina Galić]
  + cc_wireguard: make tests pass on FreeBSD (#4346) [Mina Galić]
  + unittests: fix breakage in test_read_cfg_paths_fetches_cached_datasource
    (#4328) [Ani Sinha]
  + Fix test_tools.py collection (#4315)
  + cc_keyboard: add Alpine support (#4278) [dermotbradley]
  + Flake8 fixes (#4340) [Robert Schweikert]
  + cc_mounts: Fix swapfile not working on btrfs (#4319) [王煎饼] (LP: #1884127)
  + ds-identify/CloudStack: $DS_MAYBE if vm running on vmware/xen (#4281)
    [Wei Zhou]
  + ec2: Support double encoded userdata (#4276) [Noah Meyerhans]
  + cc_mounts: xfs is a Linux only FS (#4334) [Mina Galić]
  + tests/net: fix TestGetInterfaces' mock coverage for get_master (#4336)
    [Chris Patterson]
  + change openEuler to openeuler and fix some bugs in openEuler (#4317)
    [sxt1001]
  + Replace flake8 with ruff (#4314)
  + NM renderer: set default IPv6 addr-gen-mode for all interfaces to eui64
    (#4291) [Ani Sinha]
  + cc_ssh_import_id: add Alpine support and add doas support (#4277)
    [dermotbradley]
  + sudoers not idempotent (SC-1589)  (#4296) [Alec Warren] (LP: #1998539)
  + Added support for Akamai Connected Cloud (formerly Linode) (#4167)
    [Will Smith]
  + Fix reference before assignment (#4292)
  + Overhaul module reference page (#4237) [Sally]
  + replaced spaces with commas for setting passenv (#4269) [Alec Warren]
  + DS VMware: modify a few log level (#4284) [PengpengSun]
  + tools/read-version refactors and unit tests (#4268)
  + Ensure get_features() grabs all features (#4285)
  + Don't always require passlib dependency (#4274)
  + tests: avoid leaks into host system checking of ovs-vsctl cmd (#4275)
  + Fix NoCloud kernel commandline key parsing (#4273)
  + testing: Clear all LRU caches after each test (#4249)
  + Remove the crypt dependency (#2139) [Gonéri Le Bouder]
  + logging: keep current file mode of log file if its stricter than the
    new mode (#4250) [Ani Sinha]
  + Remove default membership in redundant groups (#4258)
    [Dave Jones] (LP: #1923363)
  + doc: improve datasource_creation.rst (#4262)
  + Remove duplicate Integration testing button (#4261) [Rishita Shaw]
  + tools/read-version: fix the tool so that it can handle version parsing
    errors (#4234) [Ani Sinha]
  + net/dhcp: add udhcpc support (#4190) [Jean-François Roche]
  + DS VMware: add i386 arch dir to deployPkg plugin search path
    [PengpengSun]
  + LXD moved from linuxcontainers.org to Canonical [Simon Deziel]
  + cc_mounts.py: Add note about issue with creating mounts inside mounts
    (#4232) [dermotbradley]
  + lxd: install lxd from snap, not deb if absent in image
  + landscape: use landscape-config to write configuration
  + Add deprecation log during init of DataSourceDigitalOcean (#4194)
    [tyb-truth]
  + doc: fix typo on apt.primary.arches (#4238) [Dan Bungert]
  + Inspect systemd state for cloud-init status (#4230)
  + instance-data: add system-info and features to combined-cloud-config
    (#4224)
  + systemd: Block login until config stage completes (#2111) (LP: #2013403)
  + tests: proposed should invoke apt-get install -t=&lt;release&gt;-proposed
    (#4235)
  + cloud.cfg.tmpl: reinstate ca_certs entry (#4236) [dermotbradley]
  + Remove feature flag override ability (#4228)
  + tests: drop stray unrelated file presence test (#4227)
  + Update LXD URL (#4223) [Sally]
  + schema: add network v1 schema definition and validation functions
  + tests: daily PPA for devel series is version 99.daily update tests to
    match (#4225)
  + instance-data: write /run/cloud-init/combined-cloud-config.json
  + mount parse: Fix matching non-existent directories (#4222) [Mina Galić]
  + Specify build-system for pep517 (#4218)
  + Fix network v2 metric rendering (#4220)
  + Migrate content out of FAQ page (SD-1187) (#4205) [Sally]
  + setup: fix generation of init templates (#4209) [Mina Galić]
  + docs: Correct some bootcmd example wording
  + fix changelog
  + tests: reboot client to assert x-shellscript-per-boot is triggered
  + nocloud: parse_cmdline no longer detects nocloud-net datasource (#4204)
    (LP: 4203, #2025180)
  + Add docstring and typing to mergemanydict (#4200)
  + BSD: add dsidentify to early startup scripts (#4182) [Mina Galić]
  + handler: report errors on skipped merged cloud-config.txt parts
    (LP: #1999952)
  + Add cloud-init summit writeups (#4179) [Sally]
  + tests: Update test_clean_log for oci (#4187)
  + gce: improve ephemeral fallback NIC selection (CPC-2578) (#4163)
  + tests: pin pytest 7.3.1 to avoid adverse testpaths behavior (#4184)
  + Ephemeral Networking for FreeBSD (#2165) [Mina Galić]
  + Clarify directory syntax for nocloud local filesystem. (#4178)
  + Set default renderer as sysconfig for centos/rhel (#4165) [Ani Sinha]
  + Test static routes and netplan 0.106
  + FreeBSD fix parsing of mount and mount options (#2146) [Mina Galić]
  + test: add tracking bug id (#4164)
  + tests: can't match MAC for LXD container veth due to netplan 0.106
    (#4162)
  + Add kaiwalyakoparkar as a contributor (#4156) [Kaiwalya Koparkar]
  + BSD: remove datasource_list from cloud.cfg template (#4159) [Mina Galić]
  + launching salt-minion in masterless mode (#4110) [Denis Halturin]
  + tools: fix run-container builds for rockylinux/8 git hash mismatch
    (#4161)
  + fix doc lint: spellchecker tripped up (#4160) [Mina Galić]
  + Support Ephemeral Networking for BSD (#2127)
  + Added / fixed support for static routes on OpenBSD and FreeBSD (#2157)
    [Kadir Mueller]
  + cc_rsyslog: Refactor for better multi-platform support (#4119)
    [Mina Galić] (LP: #1798055)
  + tests: fix test_lp1835584 (#4154)
  + cloud.cfg mod names: docs and rename salt_minion and set_password (#4153)
  + tests: apt support for deb822 format .sources files on mantic
  + vultr: remove check_route check (#2151) [Jonas Chevalier]
  + Update SECURITY.md (#4150) [Indrranil Pawar]
  + Update CONTRIBUTING.rst (#4149) [Indrranil Pawar]
  + Update .github-cla-signers (#4151) [Indrranil Pawar]
  + Standardise module names in cloud.cfg.tmpl to only use underscore
    (#4128) [dermotbradley]
  + tests: update test_webhook_reporting
  + Modify PR template so autoclose works
  + doc: add missing semi-colon to nocloud cmdline docs (#4120)
  + .gitignore: extend coverage pattern (#4143) [Mina Galić]
  From 23.2.2
  + Fix NoCloud kernel commandline key parsing (#4273) (Fixes: #4271)
    (LP: #2028562)
  + Fix reference before assignment (#4292) (Fixes: #4288) (LP: #2028784)
  From 23.2.1
  + nocloud: Fix parse_cmdline detection of nocloud-net datasource (#4204)
    (Fixes: 4203) (LP: #2025180)
  From 23.2
  + BSD: simplify finding MBR partitions by removing duplicate code
  [Mina Galić]
  + tests: bump pycloudlib version for mantic builds
  + network-manager: Set higher autoconnect priority for nm keyfiles (#3671)
    [Ani Sinha]
  + alpine.py: change the locale file used (#4139) [dermotbradley]
  + cc_ntp: Sync up with current FreeBSD ntp.conf (#4122) [Mina Galić]
  + config: drop refresh_rmc_and_interface as RHEL 7 no longer supported
    [Robert Schweikert]
  + docs: Add feedback button to docs
  + net/sysconfig: enable sysconfig renderer if network manager has ifcfg-rh
    plugin (#4132) [Ani Sinha]
  + For Alpine use os-release PRETTY_NAME (#4138) [dermotbradley]
  + network_manager: add a method for ipv6 static IP configuration (#4127)
    [Ani Sinha]
  + correct misnamed template file host.mariner.tmpl (#4124) [dermotbradley]
  + nm: generate ipv6 stateful dhcp config at par with sysconfig (#4115)
    [Ani Sinha]
  + Add templates for GitHub Issues
  + Add 'peers' and 'allow' directives in cc_ntp (#3124) [Jacob Salmela]
  + FreeBSD: Fix user account locking (#4114) [Mina Galić] (GH: #1854594)
  + FreeBSD: add ResizeGrowFS class to cc_growpart (#2334) [Mina Galić]
  + Update tests in Azure TestCanDevBeReformatted class (#2771)
    [Ksenija Stanojevic]
  + Replace Launchpad references with GitHub Issues
  + Fix KeyError in iproute pformat (#3287) [Dmitry Zykov]
  + schema: read_cfg_paths call init.fetch to lookup /v/l/c/instance
  + azure/errors: introduce reportable errors for imds (#3647)
    [Chris Patterson]
  + FreeBSD (and friends): better identify MBR slices (#2168)
    [Mina Galić] (LP: #2016350)
  + azure/errors: add host reporting for dhcp errors (#2167)
    [Chris Patterson]
  + net: purge blacklist_drivers across net and azure (#2160)
    [Chris Patterson]
  + net: refactor hyper-v VF filtering and apply to get_interfaces() (#2153)
    [Chris Patterson]
  + tests: avoid leaks to underlying filesystem for /etc/cloud/clean.d
    (#2251)
  + net: refactor find_candidate_nics_on_linux() to use get_interfaces()
    (#2159) [Chris Patterson]
  + resolv_conf: Allow &gt; 3 nameservers (#2152) [Major Hayden]
  + Remove mount NTFS error message (#2134) [Ksenija Stanojevic]
  + integration tests: fix image specification parsing (#2166)
  + ci: add hypothesis scheduled GH check (#2149)
  + Move supported distros list to docs (#2162)
  + Fix logger, use instance rather than module function (#2163)
  + README: Point to Github Actions build status (#2158)
  + Revert "fix linux-specific code on bsd (#2143)" (#2161)
  + Do not generate dsa and ed25519 key types when crypto FIPS mode is
    enabled (#2142) [Ani Sinha] (LP: 2017761)
  + Add documentation label automatically (#2156)
  + sources/azure: report success to host and introduce kvp module (#2141)
    [Chris Patterson]
  + setup.py: use pkg-config for udev/rules path (#2137) [dankm]
  + openstack/static: honor the DNS servers associated with a network
    (#2138) [Gonéri Le Bouder]
  + fix linux-specific code on bsd (#2143)
  + cli: schema validation of jinja template user-data (SC-1385) (#2132)
    (LP: #1881925)
  + gce: activate network discovery on every boot (#2128)
  + tests: update integration test to assert 640 across reboots (#2145)
  + Make user/vendor data sensitive and remove log permissions (#2144)
    (LP: #2013967)
  + Update kernel command line docs (SC-1457) (#2133)
  + docs: update network configuration path links (#2140) [d1r3ct0r]
  + sources/azure: report failures to host via kvp (#2136) [Chris Patterson]
  + net: Document use of `ip route append` to add routes (#2130)
  + dhcp: Add missing mocks (#2135)
  + azure/imds: retry fetching metadata up to 300 seconds (#2121)
    [Chris Patterson]
  + [1/2] DHCP: Refactor dhcp client code  (#2122)
  + azure/errors: treat traceback_base64 as string (#2131) [Chris Patterson]
  + azure/errors: introduce reportable errors (#2129) [Chris Patterson]
  + users: schema permit empty list to indicate create no users
  + azure: introduce identity module (#2116) [Chris Patterson]
  + Standardize disabling cloud-init on non-systemd (#2112)
  + Update .github-cla-signers (#2126) [Rob Tongue]
  + NoCloud: Use seedfrom protocol to determine mode (#2107)
  + rhel: Remove sysvinit files. (#2114)
  + tox.ini: set -vvvv --showlocals for pytest (#2104) [Chris Patterson]
  + Fix NoCloud kernel commandline semi-colon args
  + run-container: make the container/VM timeout configurable (#2118)
    [Paride Legovini]
  + suse: Remove sysvinit files. (#2115)
  + test: Backport assert_call_count for old requests (#2119)
  + Add "licebmi" as contributor (#2113) [Mark Martinez]
  + Adapt DataSourceScaleway to upcoming IPv6 support (#2033)
    [Louis Bouchard]
  + rhel: make sure previous-hostname file ends with a new line (#2108)
    [Ani Sinha]
  + Adding contributors for DataSourceAkamai (#2110) [acourdavAkamai]
  + Cleanup ephemeral IP routes on exception (#2100) [sxt1001]
  + commit 09a64badfb3f51b1b391fa29be19962381a4bbeb [sxt1001] (LP: #2011291)
  + Standardize kernel commandline user interface (#2093)
  + config/cc_resizefs: fix do_resize arguments (#2106) [Chris Patterson]
  + Fix test_dhclient_exits_with_error (#2105)
  + net/dhcp: catch dhclient failures and raise NoDHCPLeaseError (#2083)
    [Chris Patterson]
  + sources/azure: move pps handling out of _poll_imds() (#2075)
    [Chris Patterson]
  + tests: bump pycloudlib version (#2102)
  + schema: do not manipulate draft4 metaschema for jsonschema 2.6.0 (#2098)
  + sources/azure/imds: don't count timeout errors as connection errors
    (#2074) [Chris Patterson]
  + Fix Python 3.12 unit test failures (#2099)
  + integration tests: Refactor instance checking (#1989)
  + ci: migrate remaining jobs from travis to gh (#2085)
  + missing ending quote in instancedata docs(#2094) [Hong L]
  + refactor: stop passing log instances to cc_* handlers (#2016) [d1r3ct0r]
  + tests/vmware: fix test_no_data_access_method failure (#2092)
    [Chris Patterson]
  + Don't change permissions of netrules target (#2076) (LP: #2011783)
  + tests/sources: patch util.get_cmdline() for datasource tests (#2091)
    [Chris Patterson]
  + macs: ignore duplicate MAC for devs with driver driver qmi_wwan (#2090)
    (LP: #2008888)
  + Fedora: Enable CA handling (#2086) [František Zatloukal]
  + Send dhcp-client-identifier for InfiniBand ports (#2043) [Waleed Mousa]
  + cc_ansible: complete the examples and doc (#2082) [Yves]
  + bddeb: for dev package, derive debhelper-compat from host system
  + apport: only prompt for cloud_name when instance-data.json is absent
  + datasource: Optimize datasource detection, fix bugs (#2060)
  + Handle non existent ca-cert-config situation (#2073) [Shreenidhi Shedi]
  + sources/azure: add networking check for all source PPS (#2061)
    [Chris Patterson]
  + do not attempt dns resolution on ip addresses (#2040)
  + chore: fix style tip (#2071)
  + Fix metadata IP in instancedata.rst (#2063) [Brian Haley]
  + util: Pass deprecation schedule in deprecate_call() (#2064)
  + config: Update grub-dpkg docs (#2058)
  + docs: Cosmetic improvements and styling (#2057) [s-makin]
  + cc_grub_dpkg: Added UEFI support (#2029) [Alexander Birkner]
  + tests: Write to /var/spool/rsyslog to adhere to apparmor profile (#2059)
  + oracle-ds: prefer system_cfg over ds network config source (#1998)
    (LP: #1956788)
  + Remove dead code (#2038)
  + source: Force OpenStack when it is only option (#2045) (LP: #2008727)
  + cc_ubuntu_advantage: improve UA logs discovery
  + sources/azure: fix regressions in IMDS behavior (#2041) [Chris Patterson]
  + tests: fix test_schema (#2042)
  + dhcp: Cleanup unused kwarg (#2037)
  + sources/vmware/imc: fix-missing-catch-few-negtive-scenarios (#2027)
    [PengpengSun]
  + dhclient_hook: remove vestigal dhclient_hook command (#2015)
  + log: Add standardized deprecation tooling (SC-1312) (#2026)
  + Enable SUSE based distros for ca handling (#2036) [Robert Schweikert]
  From 23.1.2
  + Make user/vendor data sensitive and remove log permissions
    (LP: #2013967) (CVE-2023-1786)
  From 23.1.1
  + source: Force OpenStack when it is only option (#2045)
  + sources/azure: fix regressions in IMDS behavior (#2041)
    [Chris Patterson]</changelog>
  <changelog author="michal.vyskocil@gmail.com" date="1701432000">- Move fdupes call back to %install (boo#1214169)</changelog>
  <changelog author="rjschwei@suse.com" date="1702641600">- Switch build dependency to the generic distribution-release package</changelog>
  <changelog author="rjschwei@suse.com" date="1705665600">- Add cloud-init-pckg-reboot.patch (boo#1198533, bsc#1218952,  jsc#SMO-326)
  + Support reboot on package update/upgrade via the cloud-init config</changelog>
  <changelog author="rjschwei@suse.com" date="1705752000">- Add cloud-init-skip-empty-conf.patch
  + Skip tests with empty config</changelog>
  <changelog author="rjschwei@suse.com" date="1708430400">- Prepare for RPM 4.20 switch patch syntax</changelog>
  <changelog author="fcrozat@suse.com" date="1709726400">- Hardcode distribution to suse for proper cloud.cfg generation
  (bsc#1220132).</changelog>
  <changelog author="rjschwei@suse.com" date="1711627200">- Add  cloud-init-ds-deterministic.patch (bsc#1221132)
  + Do not guess a data source when checking for a CloudStack
    environment</changelog>
  <changelog author="rjschwei@suse.com" date="1712318400">- Add cloud-init-no-openstack-guess.patch (bsc#1222113)
  + Do not guess if we are running on OpenStack or not. Only recognize
    the known markers and enable cloud-init if we know for sure.</changelog>
  <changelog author="rjschwei@suse.com" date="1712318401">- Add cloud-init-no-nmcfg-needed.patch (bsc#1221726)
  + Do not require a NetworkManager config file in order to detect
    NetworkManager as the renderer</changelog>
  <changelog author="rjschwei@suse.com" date="1712664000">- Update cloud-init-no-openstack-guess.patch
  + Do not enable cloud-init on systems where there is no DMI just
    because no data source has been found. No data source means
    cloud-init will not run.</changelog>
  <changelog author="rjschwei@suse.com" date="1714392000">- Add cloud-init-usr-sudoers.patch (bsc#1223469)
  + Handle the existence of /usr/etc/sudoers to search for the expected
    include location</changelog>
  <changelog author="rjschwei@suse.com" date="1717416000">- Add cloud-init-skip-rename.patch (bsc#1219680)
  + Brute force appraoch to skip renames if the device is already present</changelog>
</package>
<package pkgid="96b4fcf70d3a2e40bf86acac080d9617189cc65a465d57ef8fea3d4e1e2def1b" name="cloud-init" arch="src">
  <version epoch="0" ver="23.3" rel="150100.8.82.3"/>
  <changelog author="rjschwei@suse.com" date="1675425600">- Add cloud-init-transact-up.patch to support transactional-updates</changelog>
  <changelog author="rjschwei@suse.com" date="1677153600">- Update to version 23.1
  + Remove patches included upstream:
  - cloud-init-btrfs-queue-resize.patch
  - cloud-init-micro-is-suse.patch
  - cloud-init-suse-afternm.patch
  - cloud-init-prefer-nm.patch
  - cloud-init-transact-up.patch
  + Forward port
  - cloud-init-write-routes.patch
  + Added
  - cloud-init-fix-ca-test.patch
  + Support transactional-updates for SUSE based distros (#1997)
    [Robert Schweikert]
  + Set ownership for new folders in Write Files Module (#1980)
    [Jack] (LP: #1990513)
  + add OpenCloudOS and TencentOS support (#1964) [wynnfeng]
  + lxd: Retry if the server isn't ready (#2025)
  + test: switch pycloudlib source to pypi (#2024)
  + test: Fix integration test deprecation message (#2023)
  + Recognize opensuse-microos, dev tooling fixes [Robert Schweikert]
  + sources/azure: refactor imds handler into own module (#1977)
    [Chris Patterson]
  + docs: deprecation generation support [1/2] (#2013)
  + add function is_virtual to distro/FreeBSD (#1957) [Mina Galić]
  + cc_ssh: support multiple hostcertificates (#2018) (LP: #1999164)
  + Fix minor schema validation regression and fixup typing (#2017)
  + doc: Reword user data debug section (#2019)
  + Overhaul/rewrite of certificate handling as follows: (#1962)
    [dermotbradley] (LP: #1931174)
  + disk_setup: use byte string when purging the partition table (#2012)
    [Stefan Prietl]
  + cli: schema also validate vendordata*.
  + ci: sort and add checks for cla signers file [Stefan Prietl]
  + Add "ederst" as contributor (#2010) [Stefan Prietl]
  + readme: add reference to packages dir (#2001)
  + docs: update downstream package list (#2002)
  + docs: add google search verification (#2000) [s-makin]
  + docs: fix 404 render use default notfound_urls_prefix in RTD conf (#2004)
  + Fix OpenStack datasource detection on bare metal (#1923)
    [Alexander Birkner] (LP: #1815990)
  + docs: add themed RTD 404 page and pointer to readthedocs-hosted (#1993)
  + schema: fix gpt labels, use type string for GUID (#1995)
  + cc_disk_setup: code cleanup (#1996)
  + netplan: keep custom strict perms when 50-cloud-init.yaml exists
  + cloud-id: better handling of change in datasource files
    [d1r3ct0r] (LP: #1998998)
  + tests: Remove restart check from test
  + Ignore duplicate macs from mscc_felix and fsl_enetc (LP: #1997922)
  + Warn on empty network key (#1990)
  + Fix Vultr cloud_interfaces usage (#1986) [eb3095]
  + cc_puppet: Update puppet service name (#1970) [d1r3ct0r] (LP: #2002969)
  + docs: Clarify networking docs (#1987)
  + lint: remove httpretty (#1985) [sxt1001]
  + cc_set_passwords: Prevent traceback when restarting ssh (#1981)
  + tests: fix lp1912844 (#1978)
  + tests: Skip ansible test on bionic (#1984)
  + Wait for NetworkManager (#1983) [Robert Schweikert]
  + docs: minor polishing (#1979) [s-makin]
  + CI: migrate integration-test to GH actions (#1969)
  + Fix permission of SSH host keys (#1971) [Ron Gebauer]
  + Fix default route rendering on v2 ipv6 (#1973) (LP: #2003562)
  + doc: fix path in net_convert command (#1975)
  + docs: update net_convert docs (#1974)
  + doc: fix dead link
  + cc_set_hostname: ignore /var/lib/cloud/data/set-hostname if it's empty
    (#1967) [Emanuele Giuseppe Esposito]
  + distros/rhel.py: _read_hostname() missing strip on "hostname" (#1941)
    [Mark Mielke]
  + integration tests: add  IBM VPC support (SC-1352) (#1915)
  + machine-id: set to uninitialized to trigger regeneration on clones
    (LP: #1999680)
  + sources/azure: retry on connection error when fetching metdata (#1968)
    [Chris Patterson]
  + Ensure ssh state accurately obtained (#1966)
  + bddeb: drop dh-systemd dependency on newer deb-based releases [d1r3ct0r]
  + doc: fix `config formats` link in cloudsigma.rst (#1960)
  + Fix wrong subp syntax in cc_set_passwords.py (#1961)
  + docs: update the PR template link to readthedocs (#1958) [d1r3ct0r]
  + ci: switch unittests to gh actions (#1956)
  + Add mount_default_fields for PhotonOS. (#1952) [Shreenidhi Shedi]
  + sources/azure: minor refactor for metadata source detection logic
    (#1936) [Chris Patterson]
  + add "CalvoM" as contributor (#1955) [d1r3ct0r]
  + ci: doc to gh actions (#1951)
  + lxd: handle 404 from missing devices route for LXD 4.0 (LP: #2001737)
  + docs: Diataxis overhaul (#1933) [s-makin]
  + vultr: Fix issue regarding cache and region codes (#1938) [eb3095]
  + cc_set_passwords: Move ssh status checking later (SC-1368) (#1909)
    (LP: #1998526)
  + Improve Wireguard module idempotency (#1940) [Fabian Lichtenegger-Lukas]
  + network/netplan: add gateways as on-link when necessary (#1931)
    [Louis Sautier] (LP: #2000596)
  + tests: test_lxd assert features.networks.zones when present (#1939)
  + Use btrfs enquque when available (#1926) [Robert Schweikert]
  + sources/azure: drop description for report_failure_to_fabric() (#1934)
    [Chris Patterson]
  + cc_disk_setup.py: fix MBR single partition creation (#1932)
    [dermotbradley] (LP: #1851438)
  + Fix typo with package_update/package_upgrade (#1927) [eb3095]
  + sources/azure: fix device driver matching for net config (#1914)
    [Chris Patterson]
  + BSD: fix duplicate macs in Ifconfig parser (#1917) [Mina Galić]
  + test: mock dns calls (#1922)
  + pycloudlib: add lunar support for integration tests (#1928)
  + nocloud: add support for dmi variable expansion for seedfrom URL
    (LP: #1994980)
  + tools: read-version drop extra call to git describe --long
  + doc: improve cc_write_files doc (#1916)
  + read-version: When insufficient tags, use cloudinit.version.get_version
  + mounts: document weird prefix in schema (#1913)
  + add utility function test cases (#1910) [sxt1001]
  + test: mock file deletion in dhcp tests (#1911)
  + Ensure network ready before cloud-init service runs on RHEL (#1893)
    (LP: #1998655)
  + docs: add copy button to code blocks (#1890) [s-makin]
  + netplan: define features.NETPLAN_CONFIG_ROOT_READ_ONLY flag
  + azure: fix support for systems without az command installed (#1908)
  + Networking Clarification (#1892)
  + Fix the distro.osfamily output problem in the openEuler system. (#1895)
    [sxt1001] (LP: #1999042)
  + pycloudlib: bump commit dropping azure api smoke test
  + net: netplan config root read-only as wifi config can contain creds
  + autoinstall: clarify docs for users
  + sources/azure: encode health report as utf-8 (#1897) [Chris Patterson]
  + Add back gateway4/6 deprecation to docs (#1898)
  + networkd: Add support for multiple [Route] sections (#1868)
    [Nigel Kukard]
  + doc: add qemu tutorial (#1863)
  + lint: fix tip-flake8 and tip-mypy (#1896)
  + Add support for setting uid when creating users on FreeBSD (#1888)
    [einsibjarni]
  + Fix exception in BSD networking code-path (#1894) [Mina Galić]
  + Append derivatives to is_rhel list in cloud.cfg.tmpl (#1887) [Louis Abel]
  + FreeBSD init: use cloudinit_enable as only rcvar (#1875) [Mina Galić]
  + feat: add support aliyun metadata security harden mode (#1865)
    [Manasseh Zhou]
  + docs: uprate analyze to performance page [s-makin]
  + test: fix lxd preseed managed network config (#1881)
  + Add support for static IPv6 addresses for FreeBSD (#1839) [einsibjarni]
  + Make 3.12 failures not fail the build (#1873)
  + Docs: adding relative links [s-makin]
  + Update read-version
  + Fix setup.py to align with PEP 440 versioning replacing trailing
  + travis: promote 3.11-dev to 3.11 (#1866)
  + test_cloud_sigma: delete useless test (#1828) [sxt1001]
  + Add "nkukard" as contributor (#1864) [Nigel Kukard]
  + tests: ds-id mocks for vmware-rpctool as utility may not exist in env
  + doc: add how to render new module doc (#1855)
  + doc: improve module creation explanation (#1851)
  + Add Support for IPv6 metadata to OpenStack (#1805)
    [Marvin Vogt] (LP: #1906849)
  + add xiaoge1001 to .github-cla-signers (#1854) [sxt1001]
  + network: Deprecate gateway{4,6} keys in network config v2 (#1794)
    (LP: #1992512)
  + VMware: Move Guest Customization transport from OVF to VMware (#1573)
    [PengpengSun]
  + doc: home page links added (#1852) [s-makin]
  From 22.4.2
  + status: handle ds not defined in status.json (#1876) (LP: #1997559)
  From 22.4.1
  + net: skip duplicate mac check for netvsc nic and its VF (#1853)
    [Anh Vo] (LP: #1844191)
  + ChangeLog: whitespace cleanup (#1850)
  + changelog: capture 22.3.1-4 releases</changelog>
  <changelog author="rjschwei@suse.com" date="1681214400">- Sensitive data exposure (bsc#1210277, CVE-2023-1786)
  + Add hidesensitivedata
  + Add cloud-init-cve-2023-1786-redact-inst-data.patch
  + Do not expose sensitive data gathered from the CSP</changelog>
  <changelog author="rjschwei@suse.com" date="1682596800">- Add cloud-init-power-rhel-only.patch (bsc#1210273)
  + Config module cc_refresh_rmc_and_interface is implemented such that
    it will only work on RH distros. Set the module availability accordingly.</changelog>
  <changelog author="rjschwei@suse.com" date="1688644800">- Update cloud-init-write-routes.patch (bsc#1212879)
  + Add necessary import statement
- Enable flake8 linting, fix up patches
  + cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  + cloud-init-power-rhel-only.patch
  + cloud-init-write-routes.patch
  + datasourceLocalDisk.patch</changelog>
  <changelog author="dmueller@suse.com" date="1691928000">- update to 23.1.2:
  * Make user/vendor data sensitive and remove log permissions
  * source: Force OpenStack when it is only option (#2045)
  * sources/azure: fix regressions in IMDS behavior
- drop
  cloud-init-cve-2023-1786-redact-instance-data-json-main.patch (upstream)
- spec-file cleanups, including dropping flake8 (as build fails
  with newer flake8 versions)</changelog>
  <changelog author="rjschwei@suse.com" date="1692014400">- Add cloud-init-flake8-fixes.patch
- Revert chnages from previous commit
  + Disabling checks the primary maintainer enabled for specific reasons
    is not a fix.</changelog>
  <changelog author="rjschwei@suse.com" date="1696852800">- Update to version 23.3 (bsc#1216011, bsc#1215794, bsc#1215740)
  + Remove patches included upstream:
  - cloud-init-fix-ca-test.patch
  - cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  - cloud-init-power-rhel-only.patch
  - cloud-init-flake8-fixes.patch
  + Add
  - cloud-init-keep-flake.patch
  - cloud-init-lint-fixes.patch
  + Update
  - cloud-init-write-routes.patch (bsc#1216007)
  + Bump pycloudlib to 1!5.1.0 for ec2 mantic daily image support (#4390)
  + Fix cc_keyboard in mantic (LP: #2030788)
  + ec2: initialize get_instance_userdata return value to bytes (#4387)
    [Noah Meyerhans]
  + cc_users_groups: Add doas/opendoas support (#4363) [dermotbradley]
  + Fix pip-managed ansible
  + status: treat SubState=running and MainPID=0 as service exited
  + azure/imds: increase read-timeout to 30s (#4372) [Chris Patterson]
  + collect-logs fix memory usage (SC-1590) (#4289)
    [Alec Warren] (LP: #1980150)
  + cc_mounts: Use fallocate to create swapfile on btrfs (#4369) [王煎饼]
  + Undocument nocloud-net (#4318)
  + feat(akamai): add akamai to settings.py and apport.py (#4370)
  + read-version: fallback to get_version when git describe fails (#4366)
  + apt: fix cloud-init status --wait blocking on systemd v 253 (#4364)
  + integration tests: Pass username to pycloudlib (#4324)
  + Bump pycloudlib to 1!5.1.0 (#4353)
  + cloud.cfg.tmpl: reorganise, minimise/reduce duplication (#4272)
    [dermotbradley]
  + analyze: fix (unexpected) timestamp parsing (#4347) [Mina Galić]
  + cc_growpart: fix tests to run on FreeBSD (#4351) [Mina Galić]
  + subp: Fix spurious test failure on FreeBSD (#4355) [Mina Galić]
  + cmd/clean: fix tests on non-Linux platforms (#4352) [Mina Galić]
  + util: Fix get_proc_ppid() on non-Linux systems (#4348) [Mina Galić]
  + cc_wireguard: make tests pass on FreeBSD (#4346) [Mina Galić]
  + unittests: fix breakage in test_read_cfg_paths_fetches_cached_datasource
    (#4328) [Ani Sinha]
  + Fix test_tools.py collection (#4315)
  + cc_keyboard: add Alpine support (#4278) [dermotbradley]
  + Flake8 fixes (#4340) [Robert Schweikert]
  + cc_mounts: Fix swapfile not working on btrfs (#4319) [王煎饼] (LP: #1884127)
  + ds-identify/CloudStack: $DS_MAYBE if vm running on vmware/xen (#4281)
    [Wei Zhou]
  + ec2: Support double encoded userdata (#4276) [Noah Meyerhans]
  + cc_mounts: xfs is a Linux only FS (#4334) [Mina Galić]
  + tests/net: fix TestGetInterfaces' mock coverage for get_master (#4336)
    [Chris Patterson]
  + change openEuler to openeuler and fix some bugs in openEuler (#4317)
    [sxt1001]
  + Replace flake8 with ruff (#4314)
  + NM renderer: set default IPv6 addr-gen-mode for all interfaces to eui64
    (#4291) [Ani Sinha]
  + cc_ssh_import_id: add Alpine support and add doas support (#4277)
    [dermotbradley]
  + sudoers not idempotent (SC-1589)  (#4296) [Alec Warren] (LP: #1998539)
  + Added support for Akamai Connected Cloud (formerly Linode) (#4167)
    [Will Smith]
  + Fix reference before assignment (#4292)
  + Overhaul module reference page (#4237) [Sally]
  + replaced spaces with commas for setting passenv (#4269) [Alec Warren]
  + DS VMware: modify a few log level (#4284) [PengpengSun]
  + tools/read-version refactors and unit tests (#4268)
  + Ensure get_features() grabs all features (#4285)
  + Don't always require passlib dependency (#4274)
  + tests: avoid leaks into host system checking of ovs-vsctl cmd (#4275)
  + Fix NoCloud kernel commandline key parsing (#4273)
  + testing: Clear all LRU caches after each test (#4249)
  + Remove the crypt dependency (#2139) [Gonéri Le Bouder]
  + logging: keep current file mode of log file if its stricter than the
    new mode (#4250) [Ani Sinha]
  + Remove default membership in redundant groups (#4258)
    [Dave Jones] (LP: #1923363)
  + doc: improve datasource_creation.rst (#4262)
  + Remove duplicate Integration testing button (#4261) [Rishita Shaw]
  + tools/read-version: fix the tool so that it can handle version parsing
    errors (#4234) [Ani Sinha]
  + net/dhcp: add udhcpc support (#4190) [Jean-François Roche]
  + DS VMware: add i386 arch dir to deployPkg plugin search path
    [PengpengSun]
  + LXD moved from linuxcontainers.org to Canonical [Simon Deziel]
  + cc_mounts.py: Add note about issue with creating mounts inside mounts
    (#4232) [dermotbradley]
  + lxd: install lxd from snap, not deb if absent in image
  + landscape: use landscape-config to write configuration
  + Add deprecation log during init of DataSourceDigitalOcean (#4194)
    [tyb-truth]
  + doc: fix typo on apt.primary.arches (#4238) [Dan Bungert]
  + Inspect systemd state for cloud-init status (#4230)
  + instance-data: add system-info and features to combined-cloud-config
    (#4224)
  + systemd: Block login until config stage completes (#2111) (LP: #2013403)
  + tests: proposed should invoke apt-get install -t=&lt;release&gt;-proposed
    (#4235)
  + cloud.cfg.tmpl: reinstate ca_certs entry (#4236) [dermotbradley]
  + Remove feature flag override ability (#4228)
  + tests: drop stray unrelated file presence test (#4227)
  + Update LXD URL (#4223) [Sally]
  + schema: add network v1 schema definition and validation functions
  + tests: daily PPA for devel series is version 99.daily update tests to
    match (#4225)
  + instance-data: write /run/cloud-init/combined-cloud-config.json
  + mount parse: Fix matching non-existent directories (#4222) [Mina Galić]
  + Specify build-system for pep517 (#4218)
  + Fix network v2 metric rendering (#4220)
  + Migrate content out of FAQ page (SD-1187) (#4205) [Sally]
  + setup: fix generation of init templates (#4209) [Mina Galić]
  + docs: Correct some bootcmd example wording
  + fix changelog
  + tests: reboot client to assert x-shellscript-per-boot is triggered
  + nocloud: parse_cmdline no longer detects nocloud-net datasource (#4204)
    (LP: 4203, #2025180)
  + Add docstring and typing to mergemanydict (#4200)
  + BSD: add dsidentify to early startup scripts (#4182) [Mina Galić]
  + handler: report errors on skipped merged cloud-config.txt parts
    (LP: #1999952)
  + Add cloud-init summit writeups (#4179) [Sally]
  + tests: Update test_clean_log for oci (#4187)
  + gce: improve ephemeral fallback NIC selection (CPC-2578) (#4163)
  + tests: pin pytest 7.3.1 to avoid adverse testpaths behavior (#4184)
  + Ephemeral Networking for FreeBSD (#2165) [Mina Galić]
  + Clarify directory syntax for nocloud local filesystem. (#4178)
  + Set default renderer as sysconfig for centos/rhel (#4165) [Ani Sinha]
  + Test static routes and netplan 0.106
  + FreeBSD fix parsing of mount and mount options (#2146) [Mina Galić]
  + test: add tracking bug id (#4164)
  + tests: can't match MAC for LXD container veth due to netplan 0.106
    (#4162)
  + Add kaiwalyakoparkar as a contributor (#4156) [Kaiwalya Koparkar]
  + BSD: remove datasource_list from cloud.cfg template (#4159) [Mina Galić]
  + launching salt-minion in masterless mode (#4110) [Denis Halturin]
  + tools: fix run-container builds for rockylinux/8 git hash mismatch
    (#4161)
  + fix doc lint: spellchecker tripped up (#4160) [Mina Galić]
  + Support Ephemeral Networking for BSD (#2127)
  + Added / fixed support for static routes on OpenBSD and FreeBSD (#2157)
    [Kadir Mueller]
  + cc_rsyslog: Refactor for better multi-platform support (#4119)
    [Mina Galić] (LP: #1798055)
  + tests: fix test_lp1835584 (#4154)
  + cloud.cfg mod names: docs and rename salt_minion and set_password (#4153)
  + tests: apt support for deb822 format .sources files on mantic
  + vultr: remove check_route check (#2151) [Jonas Chevalier]
  + Update SECURITY.md (#4150) [Indrranil Pawar]
  + Update CONTRIBUTING.rst (#4149) [Indrranil Pawar]
  + Update .github-cla-signers (#4151) [Indrranil Pawar]
  + Standardise module names in cloud.cfg.tmpl to only use underscore
    (#4128) [dermotbradley]
  + tests: update test_webhook_reporting
  + Modify PR template so autoclose works
  + doc: add missing semi-colon to nocloud cmdline docs (#4120)
  + .gitignore: extend coverage pattern (#4143) [Mina Galić]
  From 23.2.2
  + Fix NoCloud kernel commandline key parsing (#4273) (Fixes: #4271)
    (LP: #2028562)
  + Fix reference before assignment (#4292) (Fixes: #4288) (LP: #2028784)
  From 23.2.1
  + nocloud: Fix parse_cmdline detection of nocloud-net datasource (#4204)
    (Fixes: 4203) (LP: #2025180)
  From 23.2
  + BSD: simplify finding MBR partitions by removing duplicate code
  [Mina Galić]
  + tests: bump pycloudlib version for mantic builds
  + network-manager: Set higher autoconnect priority for nm keyfiles (#3671)
    [Ani Sinha]
  + alpine.py: change the locale file used (#4139) [dermotbradley]
  + cc_ntp: Sync up with current FreeBSD ntp.conf (#4122) [Mina Galić]
  + config: drop refresh_rmc_and_interface as RHEL 7 no longer supported
    [Robert Schweikert]
  + docs: Add feedback button to docs
  + net/sysconfig: enable sysconfig renderer if network manager has ifcfg-rh
    plugin (#4132) [Ani Sinha]
  + For Alpine use os-release PRETTY_NAME (#4138) [dermotbradley]
  + network_manager: add a method for ipv6 static IP configuration (#4127)
    [Ani Sinha]
  + correct misnamed template file host.mariner.tmpl (#4124) [dermotbradley]
  + nm: generate ipv6 stateful dhcp config at par with sysconfig (#4115)
    [Ani Sinha]
  + Add templates for GitHub Issues
  + Add 'peers' and 'allow' directives in cc_ntp (#3124) [Jacob Salmela]
  + FreeBSD: Fix user account locking (#4114) [Mina Galić] (GH: #1854594)
  + FreeBSD: add ResizeGrowFS class to cc_growpart (#2334) [Mina Galić]
  + Update tests in Azure TestCanDevBeReformatted class (#2771)
    [Ksenija Stanojevic]
  + Replace Launchpad references with GitHub Issues
  + Fix KeyError in iproute pformat (#3287) [Dmitry Zykov]
  + schema: read_cfg_paths call init.fetch to lookup /v/l/c/instance
  + azure/errors: introduce reportable errors for imds (#3647)
    [Chris Patterson]
  + FreeBSD (and friends): better identify MBR slices (#2168)
    [Mina Galić] (LP: #2016350)
  + azure/errors: add host reporting for dhcp errors (#2167)
    [Chris Patterson]
  + net: purge blacklist_drivers across net and azure (#2160)
    [Chris Patterson]
  + net: refactor hyper-v VF filtering and apply to get_interfaces() (#2153)
    [Chris Patterson]
  + tests: avoid leaks to underlying filesystem for /etc/cloud/clean.d
    (#2251)
  + net: refactor find_candidate_nics_on_linux() to use get_interfaces()
    (#2159) [Chris Patterson]
  + resolv_conf: Allow &gt; 3 nameservers (#2152) [Major Hayden]
  + Remove mount NTFS error message (#2134) [Ksenija Stanojevic]
  + integration tests: fix image specification parsing (#2166)
  + ci: add hypothesis scheduled GH check (#2149)
  + Move supported distros list to docs (#2162)
  + Fix logger, use instance rather than module function (#2163)
  + README: Point to Github Actions build status (#2158)
  + Revert "fix linux-specific code on bsd (#2143)" (#2161)
  + Do not generate dsa and ed25519 key types when crypto FIPS mode is
    enabled (#2142) [Ani Sinha] (LP: 2017761)
  + Add documentation label automatically (#2156)
  + sources/azure: report success to host and introduce kvp module (#2141)
    [Chris Patterson]
  + setup.py: use pkg-config for udev/rules path (#2137) [dankm]
  + openstack/static: honor the DNS servers associated with a network
    (#2138) [Gonéri Le Bouder]
  + fix linux-specific code on bsd (#2143)
  + cli: schema validation of jinja template user-data (SC-1385) (#2132)
    (LP: #1881925)
  + gce: activate network discovery on every boot (#2128)
  + tests: update integration test to assert 640 across reboots (#2145)
  + Make user/vendor data sensitive and remove log permissions (#2144)
    (LP: #2013967)
  + Update kernel command line docs (SC-1457) (#2133)
  + docs: update network configuration path links (#2140) [d1r3ct0r]
  + sources/azure: report failures to host via kvp (#2136) [Chris Patterson]
  + net: Document use of `ip route append` to add routes (#2130)
  + dhcp: Add missing mocks (#2135)
  + azure/imds: retry fetching metadata up to 300 seconds (#2121)
    [Chris Patterson]
  + [1/2] DHCP: Refactor dhcp client code  (#2122)
  + azure/errors: treat traceback_base64 as string (#2131) [Chris Patterson]
  + azure/errors: introduce reportable errors (#2129) [Chris Patterson]
  + users: schema permit empty list to indicate create no users
  + azure: introduce identity module (#2116) [Chris Patterson]
  + Standardize disabling cloud-init on non-systemd (#2112)
  + Update .github-cla-signers (#2126) [Rob Tongue]
  + NoCloud: Use seedfrom protocol to determine mode (#2107)
  + rhel: Remove sysvinit files. (#2114)
  + tox.ini: set -vvvv --showlocals for pytest (#2104) [Chris Patterson]
  + Fix NoCloud kernel commandline semi-colon args
  + run-container: make the container/VM timeout configurable (#2118)
    [Paride Legovini]
  + suse: Remove sysvinit files. (#2115)
  + test: Backport assert_call_count for old requests (#2119)
  + Add "licebmi" as contributor (#2113) [Mark Martinez]
  + Adapt DataSourceScaleway to upcoming IPv6 support (#2033)
    [Louis Bouchard]
  + rhel: make sure previous-hostname file ends with a new line (#2108)
    [Ani Sinha]
  + Adding contributors for DataSourceAkamai (#2110) [acourdavAkamai]
  + Cleanup ephemeral IP routes on exception (#2100) [sxt1001]
  + commit 09a64badfb3f51b1b391fa29be19962381a4bbeb [sxt1001] (LP: #2011291)
  + Standardize kernel commandline user interface (#2093)
  + config/cc_resizefs: fix do_resize arguments (#2106) [Chris Patterson]
  + Fix test_dhclient_exits_with_error (#2105)
  + net/dhcp: catch dhclient failures and raise NoDHCPLeaseError (#2083)
    [Chris Patterson]
  + sources/azure: move pps handling out of _poll_imds() (#2075)
    [Chris Patterson]
  + tests: bump pycloudlib version (#2102)
  + schema: do not manipulate draft4 metaschema for jsonschema 2.6.0 (#2098)
  + sources/azure/imds: don't count timeout errors as connection errors
    (#2074) [Chris Patterson]
  + Fix Python 3.12 unit test failures (#2099)
  + integration tests: Refactor instance checking (#1989)
  + ci: migrate remaining jobs from travis to gh (#2085)
  + missing ending quote in instancedata docs(#2094) [Hong L]
  + refactor: stop passing log instances to cc_* handlers (#2016) [d1r3ct0r]
  + tests/vmware: fix test_no_data_access_method failure (#2092)
    [Chris Patterson]
  + Don't change permissions of netrules target (#2076) (LP: #2011783)
  + tests/sources: patch util.get_cmdline() for datasource tests (#2091)
    [Chris Patterson]
  + macs: ignore duplicate MAC for devs with driver driver qmi_wwan (#2090)
    (LP: #2008888)
  + Fedora: Enable CA handling (#2086) [František Zatloukal]
  + Send dhcp-client-identifier for InfiniBand ports (#2043) [Waleed Mousa]
  + cc_ansible: complete the examples and doc (#2082) [Yves]
  + bddeb: for dev package, derive debhelper-compat from host system
  + apport: only prompt for cloud_name when instance-data.json is absent
  + datasource: Optimize datasource detection, fix bugs (#2060)
  + Handle non existent ca-cert-config situation (#2073) [Shreenidhi Shedi]
  + sources/azure: add networking check for all source PPS (#2061)
    [Chris Patterson]
  + do not attempt dns resolution on ip addresses (#2040)
  + chore: fix style tip (#2071)
  + Fix metadata IP in instancedata.rst (#2063) [Brian Haley]
  + util: Pass deprecation schedule in deprecate_call() (#2064)
  + config: Update grub-dpkg docs (#2058)
  + docs: Cosmetic improvements and styling (#2057) [s-makin]
  + cc_grub_dpkg: Added UEFI support (#2029) [Alexander Birkner]
  + tests: Write to /var/spool/rsyslog to adhere to apparmor profile (#2059)
  + oracle-ds: prefer system_cfg over ds network config source (#1998)
    (LP: #1956788)
  + Remove dead code (#2038)
  + source: Force OpenStack when it is only option (#2045) (LP: #2008727)
  + cc_ubuntu_advantage: improve UA logs discovery
  + sources/azure: fix regressions in IMDS behavior (#2041) [Chris Patterson]
  + tests: fix test_schema (#2042)
  + dhcp: Cleanup unused kwarg (#2037)
  + sources/vmware/imc: fix-missing-catch-few-negtive-scenarios (#2027)
    [PengpengSun]
  + dhclient_hook: remove vestigal dhclient_hook command (#2015)
  + log: Add standardized deprecation tooling (SC-1312) (#2026)
  + Enable SUSE based distros for ca handling (#2036) [Robert Schweikert]
  From 23.1.2
  + Make user/vendor data sensitive and remove log permissions
    (LP: #2013967) (CVE-2023-1786)
  From 23.1.1
  + source: Force OpenStack when it is only option (#2045)
  + sources/azure: fix regressions in IMDS behavior (#2041)
    [Chris Patterson]</changelog>
  <changelog author="michal.vyskocil@gmail.com" date="1701432000">- Move fdupes call back to %install (boo#1214169)</changelog>
  <changelog author="rjschwei@suse.com" date="1702641600">- Switch build dependency to the generic distribution-release package</changelog>
  <changelog author="rjschwei@suse.com" date="1705665600">- Add cloud-init-pckg-reboot.patch (boo#1198533, bsc#1218952,  jsc#SMO-326)
  + Support reboot on package update/upgrade via the cloud-init config</changelog>
  <changelog author="rjschwei@suse.com" date="1705752000">- Add cloud-init-skip-empty-conf.patch
  + Skip tests with empty config</changelog>
  <changelog author="rjschwei@suse.com" date="1708430400">- Prepare for RPM 4.20 switch patch syntax</changelog>
  <changelog author="fcrozat@suse.com" date="1709726400">- Hardcode distribution to suse for proper cloud.cfg generation
  (bsc#1220132).</changelog>
  <changelog author="rjschwei@suse.com" date="1711627200">- Add  cloud-init-ds-deterministic.patch (bsc#1221132)
  + Do not guess a data source when checking for a CloudStack
    environment</changelog>
  <changelog author="rjschwei@suse.com" date="1712318400">- Add cloud-init-no-openstack-guess.patch (bsc#1222113)
  + Do not guess if we are running on OpenStack or not. Only recognize
    the known markers and enable cloud-init if we know for sure.</changelog>
  <changelog author="rjschwei@suse.com" date="1712318401">- Add cloud-init-no-nmcfg-needed.patch (bsc#1221726)
  + Do not require a NetworkManager config file in order to detect
    NetworkManager as the renderer</changelog>
  <changelog author="rjschwei@suse.com" date="1712664000">- Update cloud-init-no-openstack-guess.patch
  + Do not enable cloud-init on systems where there is no DMI just
    because no data source has been found. No data source means
    cloud-init will not run.</changelog>
  <changelog author="rjschwei@suse.com" date="1714392000">- Add cloud-init-usr-sudoers.patch (bsc#1223469)
  + Handle the existence of /usr/etc/sudoers to search for the expected
    include location</changelog>
  <changelog author="rjschwei@suse.com" date="1717416000">- Add cloud-init-skip-rename.patch (bsc#1219680)
  + Brute force appraoch to skip renames if the device is already present</changelog>
</package>
<package pkgid="2fe568170cdc70faad398d07a75830df7ea0eb4cc6ee2feb9d72fdb700713a80" name="cloud-init" arch="x86_64">
  <version epoch="0" ver="23.3" rel="150100.8.82.3"/>
  <changelog author="rjschwei@suse.com" date="1675425600">- Add cloud-init-transact-up.patch to support transactional-updates</changelog>
  <changelog author="rjschwei@suse.com" date="1677153600">- Update to version 23.1
  + Remove patches included upstream:
  - cloud-init-btrfs-queue-resize.patch
  - cloud-init-micro-is-suse.patch
  - cloud-init-suse-afternm.patch
  - cloud-init-prefer-nm.patch
  - cloud-init-transact-up.patch
  + Forward port
  - cloud-init-write-routes.patch
  + Added
  - cloud-init-fix-ca-test.patch
  + Support transactional-updates for SUSE based distros (#1997)
    [Robert Schweikert]
  + Set ownership for new folders in Write Files Module (#1980)
    [Jack] (LP: #1990513)
  + add OpenCloudOS and TencentOS support (#1964) [wynnfeng]
  + lxd: Retry if the server isn't ready (#2025)
  + test: switch pycloudlib source to pypi (#2024)
  + test: Fix integration test deprecation message (#2023)
  + Recognize opensuse-microos, dev tooling fixes [Robert Schweikert]
  + sources/azure: refactor imds handler into own module (#1977)
    [Chris Patterson]
  + docs: deprecation generation support [1/2] (#2013)
  + add function is_virtual to distro/FreeBSD (#1957) [Mina Galić]
  + cc_ssh: support multiple hostcertificates (#2018) (LP: #1999164)
  + Fix minor schema validation regression and fixup typing (#2017)
  + doc: Reword user data debug section (#2019)
  + Overhaul/rewrite of certificate handling as follows: (#1962)
    [dermotbradley] (LP: #1931174)
  + disk_setup: use byte string when purging the partition table (#2012)
    [Stefan Prietl]
  + cli: schema also validate vendordata*.
  + ci: sort and add checks for cla signers file [Stefan Prietl]
  + Add "ederst" as contributor (#2010) [Stefan Prietl]
  + readme: add reference to packages dir (#2001)
  + docs: update downstream package list (#2002)
  + docs: add google search verification (#2000) [s-makin]
  + docs: fix 404 render use default notfound_urls_prefix in RTD conf (#2004)
  + Fix OpenStack datasource detection on bare metal (#1923)
    [Alexander Birkner] (LP: #1815990)
  + docs: add themed RTD 404 page and pointer to readthedocs-hosted (#1993)
  + schema: fix gpt labels, use type string for GUID (#1995)
  + cc_disk_setup: code cleanup (#1996)
  + netplan: keep custom strict perms when 50-cloud-init.yaml exists
  + cloud-id: better handling of change in datasource files
    [d1r3ct0r] (LP: #1998998)
  + tests: Remove restart check from test
  + Ignore duplicate macs from mscc_felix and fsl_enetc (LP: #1997922)
  + Warn on empty network key (#1990)
  + Fix Vultr cloud_interfaces usage (#1986) [eb3095]
  + cc_puppet: Update puppet service name (#1970) [d1r3ct0r] (LP: #2002969)
  + docs: Clarify networking docs (#1987)
  + lint: remove httpretty (#1985) [sxt1001]
  + cc_set_passwords: Prevent traceback when restarting ssh (#1981)
  + tests: fix lp1912844 (#1978)
  + tests: Skip ansible test on bionic (#1984)
  + Wait for NetworkManager (#1983) [Robert Schweikert]
  + docs: minor polishing (#1979) [s-makin]
  + CI: migrate integration-test to GH actions (#1969)
  + Fix permission of SSH host keys (#1971) [Ron Gebauer]
  + Fix default route rendering on v2 ipv6 (#1973) (LP: #2003562)
  + doc: fix path in net_convert command (#1975)
  + docs: update net_convert docs (#1974)
  + doc: fix dead link
  + cc_set_hostname: ignore /var/lib/cloud/data/set-hostname if it's empty
    (#1967) [Emanuele Giuseppe Esposito]
  + distros/rhel.py: _read_hostname() missing strip on "hostname" (#1941)
    [Mark Mielke]
  + integration tests: add  IBM VPC support (SC-1352) (#1915)
  + machine-id: set to uninitialized to trigger regeneration on clones
    (LP: #1999680)
  + sources/azure: retry on connection error when fetching metdata (#1968)
    [Chris Patterson]
  + Ensure ssh state accurately obtained (#1966)
  + bddeb: drop dh-systemd dependency on newer deb-based releases [d1r3ct0r]
  + doc: fix `config formats` link in cloudsigma.rst (#1960)
  + Fix wrong subp syntax in cc_set_passwords.py (#1961)
  + docs: update the PR template link to readthedocs (#1958) [d1r3ct0r]
  + ci: switch unittests to gh actions (#1956)
  + Add mount_default_fields for PhotonOS. (#1952) [Shreenidhi Shedi]
  + sources/azure: minor refactor for metadata source detection logic
    (#1936) [Chris Patterson]
  + add "CalvoM" as contributor (#1955) [d1r3ct0r]
  + ci: doc to gh actions (#1951)
  + lxd: handle 404 from missing devices route for LXD 4.0 (LP: #2001737)
  + docs: Diataxis overhaul (#1933) [s-makin]
  + vultr: Fix issue regarding cache and region codes (#1938) [eb3095]
  + cc_set_passwords: Move ssh status checking later (SC-1368) (#1909)
    (LP: #1998526)
  + Improve Wireguard module idempotency (#1940) [Fabian Lichtenegger-Lukas]
  + network/netplan: add gateways as on-link when necessary (#1931)
    [Louis Sautier] (LP: #2000596)
  + tests: test_lxd assert features.networks.zones when present (#1939)
  + Use btrfs enquque when available (#1926) [Robert Schweikert]
  + sources/azure: drop description for report_failure_to_fabric() (#1934)
    [Chris Patterson]
  + cc_disk_setup.py: fix MBR single partition creation (#1932)
    [dermotbradley] (LP: #1851438)
  + Fix typo with package_update/package_upgrade (#1927) [eb3095]
  + sources/azure: fix device driver matching for net config (#1914)
    [Chris Patterson]
  + BSD: fix duplicate macs in Ifconfig parser (#1917) [Mina Galić]
  + test: mock dns calls (#1922)
  + pycloudlib: add lunar support for integration tests (#1928)
  + nocloud: add support for dmi variable expansion for seedfrom URL
    (LP: #1994980)
  + tools: read-version drop extra call to git describe --long
  + doc: improve cc_write_files doc (#1916)
  + read-version: When insufficient tags, use cloudinit.version.get_version
  + mounts: document weird prefix in schema (#1913)
  + add utility function test cases (#1910) [sxt1001]
  + test: mock file deletion in dhcp tests (#1911)
  + Ensure network ready before cloud-init service runs on RHEL (#1893)
    (LP: #1998655)
  + docs: add copy button to code blocks (#1890) [s-makin]
  + netplan: define features.NETPLAN_CONFIG_ROOT_READ_ONLY flag
  + azure: fix support for systems without az command installed (#1908)
  + Networking Clarification (#1892)
  + Fix the distro.osfamily output problem in the openEuler system. (#1895)
    [sxt1001] (LP: #1999042)
  + pycloudlib: bump commit dropping azure api smoke test
  + net: netplan config root read-only as wifi config can contain creds
  + autoinstall: clarify docs for users
  + sources/azure: encode health report as utf-8 (#1897) [Chris Patterson]
  + Add back gateway4/6 deprecation to docs (#1898)
  + networkd: Add support for multiple [Route] sections (#1868)
    [Nigel Kukard]
  + doc: add qemu tutorial (#1863)
  + lint: fix tip-flake8 and tip-mypy (#1896)
  + Add support for setting uid when creating users on FreeBSD (#1888)
    [einsibjarni]
  + Fix exception in BSD networking code-path (#1894) [Mina Galić]
  + Append derivatives to is_rhel list in cloud.cfg.tmpl (#1887) [Louis Abel]
  + FreeBSD init: use cloudinit_enable as only rcvar (#1875) [Mina Galić]
  + feat: add support aliyun metadata security harden mode (#1865)
    [Manasseh Zhou]
  + docs: uprate analyze to performance page [s-makin]
  + test: fix lxd preseed managed network config (#1881)
  + Add support for static IPv6 addresses for FreeBSD (#1839) [einsibjarni]
  + Make 3.12 failures not fail the build (#1873)
  + Docs: adding relative links [s-makin]
  + Update read-version
  + Fix setup.py to align with PEP 440 versioning replacing trailing
  + travis: promote 3.11-dev to 3.11 (#1866)
  + test_cloud_sigma: delete useless test (#1828) [sxt1001]
  + Add "nkukard" as contributor (#1864) [Nigel Kukard]
  + tests: ds-id mocks for vmware-rpctool as utility may not exist in env
  + doc: add how to render new module doc (#1855)
  + doc: improve module creation explanation (#1851)
  + Add Support for IPv6 metadata to OpenStack (#1805)
    [Marvin Vogt] (LP: #1906849)
  + add xiaoge1001 to .github-cla-signers (#1854) [sxt1001]
  + network: Deprecate gateway{4,6} keys in network config v2 (#1794)
    (LP: #1992512)
  + VMware: Move Guest Customization transport from OVF to VMware (#1573)
    [PengpengSun]
  + doc: home page links added (#1852) [s-makin]
  From 22.4.2
  + status: handle ds not defined in status.json (#1876) (LP: #1997559)
  From 22.4.1
  + net: skip duplicate mac check for netvsc nic and its VF (#1853)
    [Anh Vo] (LP: #1844191)
  + ChangeLog: whitespace cleanup (#1850)
  + changelog: capture 22.3.1-4 releases</changelog>
  <changelog author="rjschwei@suse.com" date="1681214400">- Sensitive data exposure (bsc#1210277, CVE-2023-1786)
  + Add hidesensitivedata
  + Add cloud-init-cve-2023-1786-redact-inst-data.patch
  + Do not expose sensitive data gathered from the CSP</changelog>
  <changelog author="rjschwei@suse.com" date="1682596800">- Add cloud-init-power-rhel-only.patch (bsc#1210273)
  + Config module cc_refresh_rmc_and_interface is implemented such that
    it will only work on RH distros. Set the module availability accordingly.</changelog>
  <changelog author="rjschwei@suse.com" date="1688644800">- Update cloud-init-write-routes.patch (bsc#1212879)
  + Add necessary import statement
- Enable flake8 linting, fix up patches
  + cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  + cloud-init-power-rhel-only.patch
  + cloud-init-write-routes.patch
  + datasourceLocalDisk.patch</changelog>
  <changelog author="dmueller@suse.com" date="1691928000">- update to 23.1.2:
  * Make user/vendor data sensitive and remove log permissions
  * source: Force OpenStack when it is only option (#2045)
  * sources/azure: fix regressions in IMDS behavior
- drop
  cloud-init-cve-2023-1786-redact-instance-data-json-main.patch (upstream)
- spec-file cleanups, including dropping flake8 (as build fails
  with newer flake8 versions)</changelog>
  <changelog author="rjschwei@suse.com" date="1692014400">- Add cloud-init-flake8-fixes.patch
- Revert chnages from previous commit
  + Disabling checks the primary maintainer enabled for specific reasons
    is not a fix.</changelog>
  <changelog author="rjschwei@suse.com" date="1696852800">- Update to version 23.3 (bsc#1216011, bsc#1215794, bsc#1215740)
  + Remove patches included upstream:
  - cloud-init-fix-ca-test.patch
  - cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  - cloud-init-power-rhel-only.patch
  - cloud-init-flake8-fixes.patch
  + Add
  - cloud-init-keep-flake.patch
  - cloud-init-lint-fixes.patch
  + Update
  - cloud-init-write-routes.patch (bsc#1216007)
  + Bump pycloudlib to 1!5.1.0 for ec2 mantic daily image support (#4390)
  + Fix cc_keyboard in mantic (LP: #2030788)
  + ec2: initialize get_instance_userdata return value to bytes (#4387)
    [Noah Meyerhans]
  + cc_users_groups: Add doas/opendoas support (#4363) [dermotbradley]
  + Fix pip-managed ansible
  + status: treat SubState=running and MainPID=0 as service exited
  + azure/imds: increase read-timeout to 30s (#4372) [Chris Patterson]
  + collect-logs fix memory usage (SC-1590) (#4289)
    [Alec Warren] (LP: #1980150)
  + cc_mounts: Use fallocate to create swapfile on btrfs (#4369) [王煎饼]
  + Undocument nocloud-net (#4318)
  + feat(akamai): add akamai to settings.py and apport.py (#4370)
  + read-version: fallback to get_version when git describe fails (#4366)
  + apt: fix cloud-init status --wait blocking on systemd v 253 (#4364)
  + integration tests: Pass username to pycloudlib (#4324)
  + Bump pycloudlib to 1!5.1.0 (#4353)
  + cloud.cfg.tmpl: reorganise, minimise/reduce duplication (#4272)
    [dermotbradley]
  + analyze: fix (unexpected) timestamp parsing (#4347) [Mina Galić]
  + cc_growpart: fix tests to run on FreeBSD (#4351) [Mina Galić]
  + subp: Fix spurious test failure on FreeBSD (#4355) [Mina Galić]
  + cmd/clean: fix tests on non-Linux platforms (#4352) [Mina Galić]
  + util: Fix get_proc_ppid() on non-Linux systems (#4348) [Mina Galić]
  + cc_wireguard: make tests pass on FreeBSD (#4346) [Mina Galić]
  + unittests: fix breakage in test_read_cfg_paths_fetches_cached_datasource
    (#4328) [Ani Sinha]
  + Fix test_tools.py collection (#4315)
  + cc_keyboard: add Alpine support (#4278) [dermotbradley]
  + Flake8 fixes (#4340) [Robert Schweikert]
  + cc_mounts: Fix swapfile not working on btrfs (#4319) [王煎饼] (LP: #1884127)
  + ds-identify/CloudStack: $DS_MAYBE if vm running on vmware/xen (#4281)
    [Wei Zhou]
  + ec2: Support double encoded userdata (#4276) [Noah Meyerhans]
  + cc_mounts: xfs is a Linux only FS (#4334) [Mina Galić]
  + tests/net: fix TestGetInterfaces' mock coverage for get_master (#4336)
    [Chris Patterson]
  + change openEuler to openeuler and fix some bugs in openEuler (#4317)
    [sxt1001]
  + Replace flake8 with ruff (#4314)
  + NM renderer: set default IPv6 addr-gen-mode for all interfaces to eui64
    (#4291) [Ani Sinha]
  + cc_ssh_import_id: add Alpine support and add doas support (#4277)
    [dermotbradley]
  + sudoers not idempotent (SC-1589)  (#4296) [Alec Warren] (LP: #1998539)
  + Added support for Akamai Connected Cloud (formerly Linode) (#4167)
    [Will Smith]
  + Fix reference before assignment (#4292)
  + Overhaul module reference page (#4237) [Sally]
  + replaced spaces with commas for setting passenv (#4269) [Alec Warren]
  + DS VMware: modify a few log level (#4284) [PengpengSun]
  + tools/read-version refactors and unit tests (#4268)
  + Ensure get_features() grabs all features (#4285)
  + Don't always require passlib dependency (#4274)
  + tests: avoid leaks into host system checking of ovs-vsctl cmd (#4275)
  + Fix NoCloud kernel commandline key parsing (#4273)
  + testing: Clear all LRU caches after each test (#4249)
  + Remove the crypt dependency (#2139) [Gonéri Le Bouder]
  + logging: keep current file mode of log file if its stricter than the
    new mode (#4250) [Ani Sinha]
  + Remove default membership in redundant groups (#4258)
    [Dave Jones] (LP: #1923363)
  + doc: improve datasource_creation.rst (#4262)
  + Remove duplicate Integration testing button (#4261) [Rishita Shaw]
  + tools/read-version: fix the tool so that it can handle version parsing
    errors (#4234) [Ani Sinha]
  + net/dhcp: add udhcpc support (#4190) [Jean-François Roche]
  + DS VMware: add i386 arch dir to deployPkg plugin search path
    [PengpengSun]
  + LXD moved from linuxcontainers.org to Canonical [Simon Deziel]
  + cc_mounts.py: Add note about issue with creating mounts inside mounts
    (#4232) [dermotbradley]
  + lxd: install lxd from snap, not deb if absent in image
  + landscape: use landscape-config to write configuration
  + Add deprecation log during init of DataSourceDigitalOcean (#4194)
    [tyb-truth]
  + doc: fix typo on apt.primary.arches (#4238) [Dan Bungert]
  + Inspect systemd state for cloud-init status (#4230)
  + instance-data: add system-info and features to combined-cloud-config
    (#4224)
  + systemd: Block login until config stage completes (#2111) (LP: #2013403)
  + tests: proposed should invoke apt-get install -t=&lt;release&gt;-proposed
    (#4235)
  + cloud.cfg.tmpl: reinstate ca_certs entry (#4236) [dermotbradley]
  + Remove feature flag override ability (#4228)
  + tests: drop stray unrelated file presence test (#4227)
  + Update LXD URL (#4223) [Sally]
  + schema: add network v1 schema definition and validation functions
  + tests: daily PPA for devel series is version 99.daily update tests to
    match (#4225)
  + instance-data: write /run/cloud-init/combined-cloud-config.json
  + mount parse: Fix matching non-existent directories (#4222) [Mina Galić]
  + Specify build-system for pep517 (#4218)
  + Fix network v2 metric rendering (#4220)
  + Migrate content out of FAQ page (SD-1187) (#4205) [Sally]
  + setup: fix generation of init templates (#4209) [Mina Galić]
  + docs: Correct some bootcmd example wording
  + fix changelog
  + tests: reboot client to assert x-shellscript-per-boot is triggered
  + nocloud: parse_cmdline no longer detects nocloud-net datasource (#4204)
    (LP: 4203, #2025180)
  + Add docstring and typing to mergemanydict (#4200)
  + BSD: add dsidentify to early startup scripts (#4182) [Mina Galić]
  + handler: report errors on skipped merged cloud-config.txt parts
    (LP: #1999952)
  + Add cloud-init summit writeups (#4179) [Sally]
  + tests: Update test_clean_log for oci (#4187)
  + gce: improve ephemeral fallback NIC selection (CPC-2578) (#4163)
  + tests: pin pytest 7.3.1 to avoid adverse testpaths behavior (#4184)
  + Ephemeral Networking for FreeBSD (#2165) [Mina Galić]
  + Clarify directory syntax for nocloud local filesystem. (#4178)
  + Set default renderer as sysconfig for centos/rhel (#4165) [Ani Sinha]
  + Test static routes and netplan 0.106
  + FreeBSD fix parsing of mount and mount options (#2146) [Mina Galić]
  + test: add tracking bug id (#4164)
  + tests: can't match MAC for LXD container veth due to netplan 0.106
    (#4162)
  + Add kaiwalyakoparkar as a contributor (#4156) [Kaiwalya Koparkar]
  + BSD: remove datasource_list from cloud.cfg template (#4159) [Mina Galić]
  + launching salt-minion in masterless mode (#4110) [Denis Halturin]
  + tools: fix run-container builds for rockylinux/8 git hash mismatch
    (#4161)
  + fix doc lint: spellchecker tripped up (#4160) [Mina Galić]
  + Support Ephemeral Networking for BSD (#2127)
  + Added / fixed support for static routes on OpenBSD and FreeBSD (#2157)
    [Kadir Mueller]
  + cc_rsyslog: Refactor for better multi-platform support (#4119)
    [Mina Galić] (LP: #1798055)
  + tests: fix test_lp1835584 (#4154)
  + cloud.cfg mod names: docs and rename salt_minion and set_password (#4153)
  + tests: apt support for deb822 format .sources files on mantic
  + vultr: remove check_route check (#2151) [Jonas Chevalier]
  + Update SECURITY.md (#4150) [Indrranil Pawar]
  + Update CONTRIBUTING.rst (#4149) [Indrranil Pawar]
  + Update .github-cla-signers (#4151) [Indrranil Pawar]
  + Standardise module names in cloud.cfg.tmpl to only use underscore
    (#4128) [dermotbradley]
  + tests: update test_webhook_reporting
  + Modify PR template so autoclose works
  + doc: add missing semi-colon to nocloud cmdline docs (#4120)
  + .gitignore: extend coverage pattern (#4143) [Mina Galić]
  From 23.2.2
  + Fix NoCloud kernel commandline key parsing (#4273) (Fixes: #4271)
    (LP: #2028562)
  + Fix reference before assignment (#4292) (Fixes: #4288) (LP: #2028784)
  From 23.2.1
  + nocloud: Fix parse_cmdline detection of nocloud-net datasource (#4204)
    (Fixes: 4203) (LP: #2025180)
  From 23.2
  + BSD: simplify finding MBR partitions by removing duplicate code
  [Mina Galić]
  + tests: bump pycloudlib version for mantic builds
  + network-manager: Set higher autoconnect priority for nm keyfiles (#3671)
    [Ani Sinha]
  + alpine.py: change the locale file used (#4139) [dermotbradley]
  + cc_ntp: Sync up with current FreeBSD ntp.conf (#4122) [Mina Galić]
  + config: drop refresh_rmc_and_interface as RHEL 7 no longer supported
    [Robert Schweikert]
  + docs: Add feedback button to docs
  + net/sysconfig: enable sysconfig renderer if network manager has ifcfg-rh
    plugin (#4132) [Ani Sinha]
  + For Alpine use os-release PRETTY_NAME (#4138) [dermotbradley]
  + network_manager: add a method for ipv6 static IP configuration (#4127)
    [Ani Sinha]
  + correct misnamed template file host.mariner.tmpl (#4124) [dermotbradley]
  + nm: generate ipv6 stateful dhcp config at par with sysconfig (#4115)
    [Ani Sinha]
  + Add templates for GitHub Issues
  + Add 'peers' and 'allow' directives in cc_ntp (#3124) [Jacob Salmela]
  + FreeBSD: Fix user account locking (#4114) [Mina Galić] (GH: #1854594)
  + FreeBSD: add ResizeGrowFS class to cc_growpart (#2334) [Mina Galić]
  + Update tests in Azure TestCanDevBeReformatted class (#2771)
    [Ksenija Stanojevic]
  + Replace Launchpad references with GitHub Issues
  + Fix KeyError in iproute pformat (#3287) [Dmitry Zykov]
  + schema: read_cfg_paths call init.fetch to lookup /v/l/c/instance
  + azure/errors: introduce reportable errors for imds (#3647)
    [Chris Patterson]
  + FreeBSD (and friends): better identify MBR slices (#2168)
    [Mina Galić] (LP: #2016350)
  + azure/errors: add host reporting for dhcp errors (#2167)
    [Chris Patterson]
  + net: purge blacklist_drivers across net and azure (#2160)
    [Chris Patterson]
  + net: refactor hyper-v VF filtering and apply to get_interfaces() (#2153)
    [Chris Patterson]
  + tests: avoid leaks to underlying filesystem for /etc/cloud/clean.d
    (#2251)
  + net: refactor find_candidate_nics_on_linux() to use get_interfaces()
    (#2159) [Chris Patterson]
  + resolv_conf: Allow &gt; 3 nameservers (#2152) [Major Hayden]
  + Remove mount NTFS error message (#2134) [Ksenija Stanojevic]
  + integration tests: fix image specification parsing (#2166)
  + ci: add hypothesis scheduled GH check (#2149)
  + Move supported distros list to docs (#2162)
  + Fix logger, use instance rather than module function (#2163)
  + README: Point to Github Actions build status (#2158)
  + Revert "fix linux-specific code on bsd (#2143)" (#2161)
  + Do not generate dsa and ed25519 key types when crypto FIPS mode is
    enabled (#2142) [Ani Sinha] (LP: 2017761)
  + Add documentation label automatically (#2156)
  + sources/azure: report success to host and introduce kvp module (#2141)
    [Chris Patterson]
  + setup.py: use pkg-config for udev/rules path (#2137) [dankm]
  + openstack/static: honor the DNS servers associated with a network
    (#2138) [Gonéri Le Bouder]
  + fix linux-specific code on bsd (#2143)
  + cli: schema validation of jinja template user-data (SC-1385) (#2132)
    (LP: #1881925)
  + gce: activate network discovery on every boot (#2128)
  + tests: update integration test to assert 640 across reboots (#2145)
  + Make user/vendor data sensitive and remove log permissions (#2144)
    (LP: #2013967)
  + Update kernel command line docs (SC-1457) (#2133)
  + docs: update network configuration path links (#2140) [d1r3ct0r]
  + sources/azure: report failures to host via kvp (#2136) [Chris Patterson]
  + net: Document use of `ip route append` to add routes (#2130)
  + dhcp: Add missing mocks (#2135)
  + azure/imds: retry fetching metadata up to 300 seconds (#2121)
    [Chris Patterson]
  + [1/2] DHCP: Refactor dhcp client code  (#2122)
  + azure/errors: treat traceback_base64 as string (#2131) [Chris Patterson]
  + azure/errors: introduce reportable errors (#2129) [Chris Patterson]
  + users: schema permit empty list to indicate create no users
  + azure: introduce identity module (#2116) [Chris Patterson]
  + Standardize disabling cloud-init on non-systemd (#2112)
  + Update .github-cla-signers (#2126) [Rob Tongue]
  + NoCloud: Use seedfrom protocol to determine mode (#2107)
  + rhel: Remove sysvinit files. (#2114)
  + tox.ini: set -vvvv --showlocals for pytest (#2104) [Chris Patterson]
  + Fix NoCloud kernel commandline semi-colon args
  + run-container: make the container/VM timeout configurable (#2118)
    [Paride Legovini]
  + suse: Remove sysvinit files. (#2115)
  + test: Backport assert_call_count for old requests (#2119)
  + Add "licebmi" as contributor (#2113) [Mark Martinez]
  + Adapt DataSourceScaleway to upcoming IPv6 support (#2033)
    [Louis Bouchard]
  + rhel: make sure previous-hostname file ends with a new line (#2108)
    [Ani Sinha]
  + Adding contributors for DataSourceAkamai (#2110) [acourdavAkamai]
  + Cleanup ephemeral IP routes on exception (#2100) [sxt1001]
  + commit 09a64badfb3f51b1b391fa29be19962381a4bbeb [sxt1001] (LP: #2011291)
  + Standardize kernel commandline user interface (#2093)
  + config/cc_resizefs: fix do_resize arguments (#2106) [Chris Patterson]
  + Fix test_dhclient_exits_with_error (#2105)
  + net/dhcp: catch dhclient failures and raise NoDHCPLeaseError (#2083)
    [Chris Patterson]
  + sources/azure: move pps handling out of _poll_imds() (#2075)
    [Chris Patterson]
  + tests: bump pycloudlib version (#2102)
  + schema: do not manipulate draft4 metaschema for jsonschema 2.6.0 (#2098)
  + sources/azure/imds: don't count timeout errors as connection errors
    (#2074) [Chris Patterson]
  + Fix Python 3.12 unit test failures (#2099)
  + integration tests: Refactor instance checking (#1989)
  + ci: migrate remaining jobs from travis to gh (#2085)
  + missing ending quote in instancedata docs(#2094) [Hong L]
  + refactor: stop passing log instances to cc_* handlers (#2016) [d1r3ct0r]
  + tests/vmware: fix test_no_data_access_method failure (#2092)
    [Chris Patterson]
  + Don't change permissions of netrules target (#2076) (LP: #2011783)
  + tests/sources: patch util.get_cmdline() for datasource tests (#2091)
    [Chris Patterson]
  + macs: ignore duplicate MAC for devs with driver driver qmi_wwan (#2090)
    (LP: #2008888)
  + Fedora: Enable CA handling (#2086) [František Zatloukal]
  + Send dhcp-client-identifier for InfiniBand ports (#2043) [Waleed Mousa]
  + cc_ansible: complete the examples and doc (#2082) [Yves]
  + bddeb: for dev package, derive debhelper-compat from host system
  + apport: only prompt for cloud_name when instance-data.json is absent
  + datasource: Optimize datasource detection, fix bugs (#2060)
  + Handle non existent ca-cert-config situation (#2073) [Shreenidhi Shedi]
  + sources/azure: add networking check for all source PPS (#2061)
    [Chris Patterson]
  + do not attempt dns resolution on ip addresses (#2040)
  + chore: fix style tip (#2071)
  + Fix metadata IP in instancedata.rst (#2063) [Brian Haley]
  + util: Pass deprecation schedule in deprecate_call() (#2064)
  + config: Update grub-dpkg docs (#2058)
  + docs: Cosmetic improvements and styling (#2057) [s-makin]
  + cc_grub_dpkg: Added UEFI support (#2029) [Alexander Birkner]
  + tests: Write to /var/spool/rsyslog to adhere to apparmor profile (#2059)
  + oracle-ds: prefer system_cfg over ds network config source (#1998)
    (LP: #1956788)
  + Remove dead code (#2038)
  + source: Force OpenStack when it is only option (#2045) (LP: #2008727)
  + cc_ubuntu_advantage: improve UA logs discovery
  + sources/azure: fix regressions in IMDS behavior (#2041) [Chris Patterson]
  + tests: fix test_schema (#2042)
  + dhcp: Cleanup unused kwarg (#2037)
  + sources/vmware/imc: fix-missing-catch-few-negtive-scenarios (#2027)
    [PengpengSun]
  + dhclient_hook: remove vestigal dhclient_hook command (#2015)
  + log: Add standardized deprecation tooling (SC-1312) (#2026)
  + Enable SUSE based distros for ca handling (#2036) [Robert Schweikert]
  From 23.1.2
  + Make user/vendor data sensitive and remove log permissions
    (LP: #2013967) (CVE-2023-1786)
  From 23.1.1
  + source: Force OpenStack when it is only option (#2045)
  + sources/azure: fix regressions in IMDS behavior (#2041)
    [Chris Patterson]</changelog>
  <changelog author="michal.vyskocil@gmail.com" date="1701432000">- Move fdupes call back to %install (boo#1214169)</changelog>
  <changelog author="rjschwei@suse.com" date="1702641600">- Switch build dependency to the generic distribution-release package</changelog>
  <changelog author="rjschwei@suse.com" date="1705665600">- Add cloud-init-pckg-reboot.patch (boo#1198533, bsc#1218952,  jsc#SMO-326)
  + Support reboot on package update/upgrade via the cloud-init config</changelog>
  <changelog author="rjschwei@suse.com" date="1705752000">- Add cloud-init-skip-empty-conf.patch
  + Skip tests with empty config</changelog>
  <changelog author="rjschwei@suse.com" date="1708430400">- Prepare for RPM 4.20 switch patch syntax</changelog>
  <changelog author="fcrozat@suse.com" date="1709726400">- Hardcode distribution to suse for proper cloud.cfg generation
  (bsc#1220132).</changelog>
  <changelog author="rjschwei@suse.com" date="1711627200">- Add  cloud-init-ds-deterministic.patch (bsc#1221132)
  + Do not guess a data source when checking for a CloudStack
    environment</changelog>
  <changelog author="rjschwei@suse.com" date="1712318400">- Add cloud-init-no-openstack-guess.patch (bsc#1222113)
  + Do not guess if we are running on OpenStack or not. Only recognize
    the known markers and enable cloud-init if we know for sure.</changelog>
  <changelog author="rjschwei@suse.com" date="1712318401">- Add cloud-init-no-nmcfg-needed.patch (bsc#1221726)
  + Do not require a NetworkManager config file in order to detect
    NetworkManager as the renderer</changelog>
  <changelog author="rjschwei@suse.com" date="1712664000">- Update cloud-init-no-openstack-guess.patch
  + Do not enable cloud-init on systems where there is no DMI just
    because no data source has been found. No data source means
    cloud-init will not run.</changelog>
  <changelog author="rjschwei@suse.com" date="1714392000">- Add cloud-init-usr-sudoers.patch (bsc#1223469)
  + Handle the existence of /usr/etc/sudoers to search for the expected
    include location</changelog>
  <changelog author="rjschwei@suse.com" date="1717416000">- Add cloud-init-skip-rename.patch (bsc#1219680)
  + Brute force appraoch to skip renames if the device is already present</changelog>
</package>
<package pkgid="23d7b0f373ed8c2df3c26f43b0e9a1c0ea758c9af567e7994847af1add847925" name="cloud-init-config-suse" arch="aarch64">
  <version epoch="0" ver="23.3" rel="150100.8.82.3"/>
  <changelog author="rjschwei@suse.com" date="1675425600">- Add cloud-init-transact-up.patch to support transactional-updates</changelog>
  <changelog author="rjschwei@suse.com" date="1677153600">- Update to version 23.1
  + Remove patches included upstream:
  - cloud-init-btrfs-queue-resize.patch
  - cloud-init-micro-is-suse.patch
  - cloud-init-suse-afternm.patch
  - cloud-init-prefer-nm.patch
  - cloud-init-transact-up.patch
  + Forward port
  - cloud-init-write-routes.patch
  + Added
  - cloud-init-fix-ca-test.patch
  + Support transactional-updates for SUSE based distros (#1997)
    [Robert Schweikert]
  + Set ownership for new folders in Write Files Module (#1980)
    [Jack] (LP: #1990513)
  + add OpenCloudOS and TencentOS support (#1964) [wynnfeng]
  + lxd: Retry if the server isn't ready (#2025)
  + test: switch pycloudlib source to pypi (#2024)
  + test: Fix integration test deprecation message (#2023)
  + Recognize opensuse-microos, dev tooling fixes [Robert Schweikert]
  + sources/azure: refactor imds handler into own module (#1977)
    [Chris Patterson]
  + docs: deprecation generation support [1/2] (#2013)
  + add function is_virtual to distro/FreeBSD (#1957) [Mina Galić]
  + cc_ssh: support multiple hostcertificates (#2018) (LP: #1999164)
  + Fix minor schema validation regression and fixup typing (#2017)
  + doc: Reword user data debug section (#2019)
  + Overhaul/rewrite of certificate handling as follows: (#1962)
    [dermotbradley] (LP: #1931174)
  + disk_setup: use byte string when purging the partition table (#2012)
    [Stefan Prietl]
  + cli: schema also validate vendordata*.
  + ci: sort and add checks for cla signers file [Stefan Prietl]
  + Add "ederst" as contributor (#2010) [Stefan Prietl]
  + readme: add reference to packages dir (#2001)
  + docs: update downstream package list (#2002)
  + docs: add google search verification (#2000) [s-makin]
  + docs: fix 404 render use default notfound_urls_prefix in RTD conf (#2004)
  + Fix OpenStack datasource detection on bare metal (#1923)
    [Alexander Birkner] (LP: #1815990)
  + docs: add themed RTD 404 page and pointer to readthedocs-hosted (#1993)
  + schema: fix gpt labels, use type string for GUID (#1995)
  + cc_disk_setup: code cleanup (#1996)
  + netplan: keep custom strict perms when 50-cloud-init.yaml exists
  + cloud-id: better handling of change in datasource files
    [d1r3ct0r] (LP: #1998998)
  + tests: Remove restart check from test
  + Ignore duplicate macs from mscc_felix and fsl_enetc (LP: #1997922)
  + Warn on empty network key (#1990)
  + Fix Vultr cloud_interfaces usage (#1986) [eb3095]
  + cc_puppet: Update puppet service name (#1970) [d1r3ct0r] (LP: #2002969)
  + docs: Clarify networking docs (#1987)
  + lint: remove httpretty (#1985) [sxt1001]
  + cc_set_passwords: Prevent traceback when restarting ssh (#1981)
  + tests: fix lp1912844 (#1978)
  + tests: Skip ansible test on bionic (#1984)
  + Wait for NetworkManager (#1983) [Robert Schweikert]
  + docs: minor polishing (#1979) [s-makin]
  + CI: migrate integration-test to GH actions (#1969)
  + Fix permission of SSH host keys (#1971) [Ron Gebauer]
  + Fix default route rendering on v2 ipv6 (#1973) (LP: #2003562)
  + doc: fix path in net_convert command (#1975)
  + docs: update net_convert docs (#1974)
  + doc: fix dead link
  + cc_set_hostname: ignore /var/lib/cloud/data/set-hostname if it's empty
    (#1967) [Emanuele Giuseppe Esposito]
  + distros/rhel.py: _read_hostname() missing strip on "hostname" (#1941)
    [Mark Mielke]
  + integration tests: add  IBM VPC support (SC-1352) (#1915)
  + machine-id: set to uninitialized to trigger regeneration on clones
    (LP: #1999680)
  + sources/azure: retry on connection error when fetching metdata (#1968)
    [Chris Patterson]
  + Ensure ssh state accurately obtained (#1966)
  + bddeb: drop dh-systemd dependency on newer deb-based releases [d1r3ct0r]
  + doc: fix `config formats` link in cloudsigma.rst (#1960)
  + Fix wrong subp syntax in cc_set_passwords.py (#1961)
  + docs: update the PR template link to readthedocs (#1958) [d1r3ct0r]
  + ci: switch unittests to gh actions (#1956)
  + Add mount_default_fields for PhotonOS. (#1952) [Shreenidhi Shedi]
  + sources/azure: minor refactor for metadata source detection logic
    (#1936) [Chris Patterson]
  + add "CalvoM" as contributor (#1955) [d1r3ct0r]
  + ci: doc to gh actions (#1951)
  + lxd: handle 404 from missing devices route for LXD 4.0 (LP: #2001737)
  + docs: Diataxis overhaul (#1933) [s-makin]
  + vultr: Fix issue regarding cache and region codes (#1938) [eb3095]
  + cc_set_passwords: Move ssh status checking later (SC-1368) (#1909)
    (LP: #1998526)
  + Improve Wireguard module idempotency (#1940) [Fabian Lichtenegger-Lukas]
  + network/netplan: add gateways as on-link when necessary (#1931)
    [Louis Sautier] (LP: #2000596)
  + tests: test_lxd assert features.networks.zones when present (#1939)
  + Use btrfs enquque when available (#1926) [Robert Schweikert]
  + sources/azure: drop description for report_failure_to_fabric() (#1934)
    [Chris Patterson]
  + cc_disk_setup.py: fix MBR single partition creation (#1932)
    [dermotbradley] (LP: #1851438)
  + Fix typo with package_update/package_upgrade (#1927) [eb3095]
  + sources/azure: fix device driver matching for net config (#1914)
    [Chris Patterson]
  + BSD: fix duplicate macs in Ifconfig parser (#1917) [Mina Galić]
  + test: mock dns calls (#1922)
  + pycloudlib: add lunar support for integration tests (#1928)
  + nocloud: add support for dmi variable expansion for seedfrom URL
    (LP: #1994980)
  + tools: read-version drop extra call to git describe --long
  + doc: improve cc_write_files doc (#1916)
  + read-version: When insufficient tags, use cloudinit.version.get_version
  + mounts: document weird prefix in schema (#1913)
  + add utility function test cases (#1910) [sxt1001]
  + test: mock file deletion in dhcp tests (#1911)
  + Ensure network ready before cloud-init service runs on RHEL (#1893)
    (LP: #1998655)
  + docs: add copy button to code blocks (#1890) [s-makin]
  + netplan: define features.NETPLAN_CONFIG_ROOT_READ_ONLY flag
  + azure: fix support for systems without az command installed (#1908)
  + Networking Clarification (#1892)
  + Fix the distro.osfamily output problem in the openEuler system. (#1895)
    [sxt1001] (LP: #1999042)
  + pycloudlib: bump commit dropping azure api smoke test
  + net: netplan config root read-only as wifi config can contain creds
  + autoinstall: clarify docs for users
  + sources/azure: encode health report as utf-8 (#1897) [Chris Patterson]
  + Add back gateway4/6 deprecation to docs (#1898)
  + networkd: Add support for multiple [Route] sections (#1868)
    [Nigel Kukard]
  + doc: add qemu tutorial (#1863)
  + lint: fix tip-flake8 and tip-mypy (#1896)
  + Add support for setting uid when creating users on FreeBSD (#1888)
    [einsibjarni]
  + Fix exception in BSD networking code-path (#1894) [Mina Galić]
  + Append derivatives to is_rhel list in cloud.cfg.tmpl (#1887) [Louis Abel]
  + FreeBSD init: use cloudinit_enable as only rcvar (#1875) [Mina Galić]
  + feat: add support aliyun metadata security harden mode (#1865)
    [Manasseh Zhou]
  + docs: uprate analyze to performance page [s-makin]
  + test: fix lxd preseed managed network config (#1881)
  + Add support for static IPv6 addresses for FreeBSD (#1839) [einsibjarni]
  + Make 3.12 failures not fail the build (#1873)
  + Docs: adding relative links [s-makin]
  + Update read-version
  + Fix setup.py to align with PEP 440 versioning replacing trailing
  + travis: promote 3.11-dev to 3.11 (#1866)
  + test_cloud_sigma: delete useless test (#1828) [sxt1001]
  + Add "nkukard" as contributor (#1864) [Nigel Kukard]
  + tests: ds-id mocks for vmware-rpctool as utility may not exist in env
  + doc: add how to render new module doc (#1855)
  + doc: improve module creation explanation (#1851)
  + Add Support for IPv6 metadata to OpenStack (#1805)
    [Marvin Vogt] (LP: #1906849)
  + add xiaoge1001 to .github-cla-signers (#1854) [sxt1001]
  + network: Deprecate gateway{4,6} keys in network config v2 (#1794)
    (LP: #1992512)
  + VMware: Move Guest Customization transport from OVF to VMware (#1573)
    [PengpengSun]
  + doc: home page links added (#1852) [s-makin]
  From 22.4.2
  + status: handle ds not defined in status.json (#1876) (LP: #1997559)
  From 22.4.1
  + net: skip duplicate mac check for netvsc nic and its VF (#1853)
    [Anh Vo] (LP: #1844191)
  + ChangeLog: whitespace cleanup (#1850)
  + changelog: capture 22.3.1-4 releases</changelog>
  <changelog author="rjschwei@suse.com" date="1681214400">- Sensitive data exposure (bsc#1210277, CVE-2023-1786)
  + Add hidesensitivedata
  + Add cloud-init-cve-2023-1786-redact-inst-data.patch
  + Do not expose sensitive data gathered from the CSP</changelog>
  <changelog author="rjschwei@suse.com" date="1682596800">- Add cloud-init-power-rhel-only.patch (bsc#1210273)
  + Config module cc_refresh_rmc_and_interface is implemented such that
    it will only work on RH distros. Set the module availability accordingly.</changelog>
  <changelog author="rjschwei@suse.com" date="1688644800">- Update cloud-init-write-routes.patch (bsc#1212879)
  + Add necessary import statement
- Enable flake8 linting, fix up patches
  + cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  + cloud-init-power-rhel-only.patch
  + cloud-init-write-routes.patch
  + datasourceLocalDisk.patch</changelog>
  <changelog author="dmueller@suse.com" date="1691928000">- update to 23.1.2:
  * Make user/vendor data sensitive and remove log permissions
  * source: Force OpenStack when it is only option (#2045)
  * sources/azure: fix regressions in IMDS behavior
- drop
  cloud-init-cve-2023-1786-redact-instance-data-json-main.patch (upstream)
- spec-file cleanups, including dropping flake8 (as build fails
  with newer flake8 versions)</changelog>
  <changelog author="rjschwei@suse.com" date="1692014400">- Add cloud-init-flake8-fixes.patch
- Revert chnages from previous commit
  + Disabling checks the primary maintainer enabled for specific reasons
    is not a fix.</changelog>
  <changelog author="rjschwei@suse.com" date="1696852800">- Update to version 23.3 (bsc#1216011, bsc#1215794, bsc#1215740)
  + Remove patches included upstream:
  - cloud-init-fix-ca-test.patch
  - cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  - cloud-init-power-rhel-only.patch
  - cloud-init-flake8-fixes.patch
  + Add
  - cloud-init-keep-flake.patch
  - cloud-init-lint-fixes.patch
  + Update
  - cloud-init-write-routes.patch (bsc#1216007)
  + Bump pycloudlib to 1!5.1.0 for ec2 mantic daily image support (#4390)
  + Fix cc_keyboard in mantic (LP: #2030788)
  + ec2: initialize get_instance_userdata return value to bytes (#4387)
    [Noah Meyerhans]
  + cc_users_groups: Add doas/opendoas support (#4363) [dermotbradley]
  + Fix pip-managed ansible
  + status: treat SubState=running and MainPID=0 as service exited
  + azure/imds: increase read-timeout to 30s (#4372) [Chris Patterson]
  + collect-logs fix memory usage (SC-1590) (#4289)
    [Alec Warren] (LP: #1980150)
  + cc_mounts: Use fallocate to create swapfile on btrfs (#4369) [王煎饼]
  + Undocument nocloud-net (#4318)
  + feat(akamai): add akamai to settings.py and apport.py (#4370)
  + read-version: fallback to get_version when git describe fails (#4366)
  + apt: fix cloud-init status --wait blocking on systemd v 253 (#4364)
  + integration tests: Pass username to pycloudlib (#4324)
  + Bump pycloudlib to 1!5.1.0 (#4353)
  + cloud.cfg.tmpl: reorganise, minimise/reduce duplication (#4272)
    [dermotbradley]
  + analyze: fix (unexpected) timestamp parsing (#4347) [Mina Galić]
  + cc_growpart: fix tests to run on FreeBSD (#4351) [Mina Galić]
  + subp: Fix spurious test failure on FreeBSD (#4355) [Mina Galić]
  + cmd/clean: fix tests on non-Linux platforms (#4352) [Mina Galić]
  + util: Fix get_proc_ppid() on non-Linux systems (#4348) [Mina Galić]
  + cc_wireguard: make tests pass on FreeBSD (#4346) [Mina Galić]
  + unittests: fix breakage in test_read_cfg_paths_fetches_cached_datasource
    (#4328) [Ani Sinha]
  + Fix test_tools.py collection (#4315)
  + cc_keyboard: add Alpine support (#4278) [dermotbradley]
  + Flake8 fixes (#4340) [Robert Schweikert]
  + cc_mounts: Fix swapfile not working on btrfs (#4319) [王煎饼] (LP: #1884127)
  + ds-identify/CloudStack: $DS_MAYBE if vm running on vmware/xen (#4281)
    [Wei Zhou]
  + ec2: Support double encoded userdata (#4276) [Noah Meyerhans]
  + cc_mounts: xfs is a Linux only FS (#4334) [Mina Galić]
  + tests/net: fix TestGetInterfaces' mock coverage for get_master (#4336)
    [Chris Patterson]
  + change openEuler to openeuler and fix some bugs in openEuler (#4317)
    [sxt1001]
  + Replace flake8 with ruff (#4314)
  + NM renderer: set default IPv6 addr-gen-mode for all interfaces to eui64
    (#4291) [Ani Sinha]
  + cc_ssh_import_id: add Alpine support and add doas support (#4277)
    [dermotbradley]
  + sudoers not idempotent (SC-1589)  (#4296) [Alec Warren] (LP: #1998539)
  + Added support for Akamai Connected Cloud (formerly Linode) (#4167)
    [Will Smith]
  + Fix reference before assignment (#4292)
  + Overhaul module reference page (#4237) [Sally]
  + replaced spaces with commas for setting passenv (#4269) [Alec Warren]
  + DS VMware: modify a few log level (#4284) [PengpengSun]
  + tools/read-version refactors and unit tests (#4268)
  + Ensure get_features() grabs all features (#4285)
  + Don't always require passlib dependency (#4274)
  + tests: avoid leaks into host system checking of ovs-vsctl cmd (#4275)
  + Fix NoCloud kernel commandline key parsing (#4273)
  + testing: Clear all LRU caches after each test (#4249)
  + Remove the crypt dependency (#2139) [Gonéri Le Bouder]
  + logging: keep current file mode of log file if its stricter than the
    new mode (#4250) [Ani Sinha]
  + Remove default membership in redundant groups (#4258)
    [Dave Jones] (LP: #1923363)
  + doc: improve datasource_creation.rst (#4262)
  + Remove duplicate Integration testing button (#4261) [Rishita Shaw]
  + tools/read-version: fix the tool so that it can handle version parsing
    errors (#4234) [Ani Sinha]
  + net/dhcp: add udhcpc support (#4190) [Jean-François Roche]
  + DS VMware: add i386 arch dir to deployPkg plugin search path
    [PengpengSun]
  + LXD moved from linuxcontainers.org to Canonical [Simon Deziel]
  + cc_mounts.py: Add note about issue with creating mounts inside mounts
    (#4232) [dermotbradley]
  + lxd: install lxd from snap, not deb if absent in image
  + landscape: use landscape-config to write configuration
  + Add deprecation log during init of DataSourceDigitalOcean (#4194)
    [tyb-truth]
  + doc: fix typo on apt.primary.arches (#4238) [Dan Bungert]
  + Inspect systemd state for cloud-init status (#4230)
  + instance-data: add system-info and features to combined-cloud-config
    (#4224)
  + systemd: Block login until config stage completes (#2111) (LP: #2013403)
  + tests: proposed should invoke apt-get install -t=&lt;release&gt;-proposed
    (#4235)
  + cloud.cfg.tmpl: reinstate ca_certs entry (#4236) [dermotbradley]
  + Remove feature flag override ability (#4228)
  + tests: drop stray unrelated file presence test (#4227)
  + Update LXD URL (#4223) [Sally]
  + schema: add network v1 schema definition and validation functions
  + tests: daily PPA for devel series is version 99.daily update tests to
    match (#4225)
  + instance-data: write /run/cloud-init/combined-cloud-config.json
  + mount parse: Fix matching non-existent directories (#4222) [Mina Galić]
  + Specify build-system for pep517 (#4218)
  + Fix network v2 metric rendering (#4220)
  + Migrate content out of FAQ page (SD-1187) (#4205) [Sally]
  + setup: fix generation of init templates (#4209) [Mina Galić]
  + docs: Correct some bootcmd example wording
  + fix changelog
  + tests: reboot client to assert x-shellscript-per-boot is triggered
  + nocloud: parse_cmdline no longer detects nocloud-net datasource (#4204)
    (LP: 4203, #2025180)
  + Add docstring and typing to mergemanydict (#4200)
  + BSD: add dsidentify to early startup scripts (#4182) [Mina Galić]
  + handler: report errors on skipped merged cloud-config.txt parts
    (LP: #1999952)
  + Add cloud-init summit writeups (#4179) [Sally]
  + tests: Update test_clean_log for oci (#4187)
  + gce: improve ephemeral fallback NIC selection (CPC-2578) (#4163)
  + tests: pin pytest 7.3.1 to avoid adverse testpaths behavior (#4184)
  + Ephemeral Networking for FreeBSD (#2165) [Mina Galić]
  + Clarify directory syntax for nocloud local filesystem. (#4178)
  + Set default renderer as sysconfig for centos/rhel (#4165) [Ani Sinha]
  + Test static routes and netplan 0.106
  + FreeBSD fix parsing of mount and mount options (#2146) [Mina Galić]
  + test: add tracking bug id (#4164)
  + tests: can't match MAC for LXD container veth due to netplan 0.106
    (#4162)
  + Add kaiwalyakoparkar as a contributor (#4156) [Kaiwalya Koparkar]
  + BSD: remove datasource_list from cloud.cfg template (#4159) [Mina Galić]
  + launching salt-minion in masterless mode (#4110) [Denis Halturin]
  + tools: fix run-container builds for rockylinux/8 git hash mismatch
    (#4161)
  + fix doc lint: spellchecker tripped up (#4160) [Mina Galić]
  + Support Ephemeral Networking for BSD (#2127)
  + Added / fixed support for static routes on OpenBSD and FreeBSD (#2157)
    [Kadir Mueller]
  + cc_rsyslog: Refactor for better multi-platform support (#4119)
    [Mina Galić] (LP: #1798055)
  + tests: fix test_lp1835584 (#4154)
  + cloud.cfg mod names: docs and rename salt_minion and set_password (#4153)
  + tests: apt support for deb822 format .sources files on mantic
  + vultr: remove check_route check (#2151) [Jonas Chevalier]
  + Update SECURITY.md (#4150) [Indrranil Pawar]
  + Update CONTRIBUTING.rst (#4149) [Indrranil Pawar]
  + Update .github-cla-signers (#4151) [Indrranil Pawar]
  + Standardise module names in cloud.cfg.tmpl to only use underscore
    (#4128) [dermotbradley]
  + tests: update test_webhook_reporting
  + Modify PR template so autoclose works
  + doc: add missing semi-colon to nocloud cmdline docs (#4120)
  + .gitignore: extend coverage pattern (#4143) [Mina Galić]
  From 23.2.2
  + Fix NoCloud kernel commandline key parsing (#4273) (Fixes: #4271)
    (LP: #2028562)
  + Fix reference before assignment (#4292) (Fixes: #4288) (LP: #2028784)
  From 23.2.1
  + nocloud: Fix parse_cmdline detection of nocloud-net datasource (#4204)
    (Fixes: 4203) (LP: #2025180)
  From 23.2
  + BSD: simplify finding MBR partitions by removing duplicate code
  [Mina Galić]
  + tests: bump pycloudlib version for mantic builds
  + network-manager: Set higher autoconnect priority for nm keyfiles (#3671)
    [Ani Sinha]
  + alpine.py: change the locale file used (#4139) [dermotbradley]
  + cc_ntp: Sync up with current FreeBSD ntp.conf (#4122) [Mina Galić]
  + config: drop refresh_rmc_and_interface as RHEL 7 no longer supported
    [Robert Schweikert]
  + docs: Add feedback button to docs
  + net/sysconfig: enable sysconfig renderer if network manager has ifcfg-rh
    plugin (#4132) [Ani Sinha]
  + For Alpine use os-release PRETTY_NAME (#4138) [dermotbradley]
  + network_manager: add a method for ipv6 static IP configuration (#4127)
    [Ani Sinha]
  + correct misnamed template file host.mariner.tmpl (#4124) [dermotbradley]
  + nm: generate ipv6 stateful dhcp config at par with sysconfig (#4115)
    [Ani Sinha]
  + Add templates for GitHub Issues
  + Add 'peers' and 'allow' directives in cc_ntp (#3124) [Jacob Salmela]
  + FreeBSD: Fix user account locking (#4114) [Mina Galić] (GH: #1854594)
  + FreeBSD: add ResizeGrowFS class to cc_growpart (#2334) [Mina Galić]
  + Update tests in Azure TestCanDevBeReformatted class (#2771)
    [Ksenija Stanojevic]
  + Replace Launchpad references with GitHub Issues
  + Fix KeyError in iproute pformat (#3287) [Dmitry Zykov]
  + schema: read_cfg_paths call init.fetch to lookup /v/l/c/instance
  + azure/errors: introduce reportable errors for imds (#3647)
    [Chris Patterson]
  + FreeBSD (and friends): better identify MBR slices (#2168)
    [Mina Galić] (LP: #2016350)
  + azure/errors: add host reporting for dhcp errors (#2167)
    [Chris Patterson]
  + net: purge blacklist_drivers across net and azure (#2160)
    [Chris Patterson]
  + net: refactor hyper-v VF filtering and apply to get_interfaces() (#2153)
    [Chris Patterson]
  + tests: avoid leaks to underlying filesystem for /etc/cloud/clean.d
    (#2251)
  + net: refactor find_candidate_nics_on_linux() to use get_interfaces()
    (#2159) [Chris Patterson]
  + resolv_conf: Allow &gt; 3 nameservers (#2152) [Major Hayden]
  + Remove mount NTFS error message (#2134) [Ksenija Stanojevic]
  + integration tests: fix image specification parsing (#2166)
  + ci: add hypothesis scheduled GH check (#2149)
  + Move supported distros list to docs (#2162)
  + Fix logger, use instance rather than module function (#2163)
  + README: Point to Github Actions build status (#2158)
  + Revert "fix linux-specific code on bsd (#2143)" (#2161)
  + Do not generate dsa and ed25519 key types when crypto FIPS mode is
    enabled (#2142) [Ani Sinha] (LP: 2017761)
  + Add documentation label automatically (#2156)
  + sources/azure: report success to host and introduce kvp module (#2141)
    [Chris Patterson]
  + setup.py: use pkg-config for udev/rules path (#2137) [dankm]
  + openstack/static: honor the DNS servers associated with a network
    (#2138) [Gonéri Le Bouder]
  + fix linux-specific code on bsd (#2143)
  + cli: schema validation of jinja template user-data (SC-1385) (#2132)
    (LP: #1881925)
  + gce: activate network discovery on every boot (#2128)
  + tests: update integration test to assert 640 across reboots (#2145)
  + Make user/vendor data sensitive and remove log permissions (#2144)
    (LP: #2013967)
  + Update kernel command line docs (SC-1457) (#2133)
  + docs: update network configuration path links (#2140) [d1r3ct0r]
  + sources/azure: report failures to host via kvp (#2136) [Chris Patterson]
  + net: Document use of `ip route append` to add routes (#2130)
  + dhcp: Add missing mocks (#2135)
  + azure/imds: retry fetching metadata up to 300 seconds (#2121)
    [Chris Patterson]
  + [1/2] DHCP: Refactor dhcp client code  (#2122)
  + azure/errors: treat traceback_base64 as string (#2131) [Chris Patterson]
  + azure/errors: introduce reportable errors (#2129) [Chris Patterson]
  + users: schema permit empty list to indicate create no users
  + azure: introduce identity module (#2116) [Chris Patterson]
  + Standardize disabling cloud-init on non-systemd (#2112)
  + Update .github-cla-signers (#2126) [Rob Tongue]
  + NoCloud: Use seedfrom protocol to determine mode (#2107)
  + rhel: Remove sysvinit files. (#2114)
  + tox.ini: set -vvvv --showlocals for pytest (#2104) [Chris Patterson]
  + Fix NoCloud kernel commandline semi-colon args
  + run-container: make the container/VM timeout configurable (#2118)
    [Paride Legovini]
  + suse: Remove sysvinit files. (#2115)
  + test: Backport assert_call_count for old requests (#2119)
  + Add "licebmi" as contributor (#2113) [Mark Martinez]
  + Adapt DataSourceScaleway to upcoming IPv6 support (#2033)
    [Louis Bouchard]
  + rhel: make sure previous-hostname file ends with a new line (#2108)
    [Ani Sinha]
  + Adding contributors for DataSourceAkamai (#2110) [acourdavAkamai]
  + Cleanup ephemeral IP routes on exception (#2100) [sxt1001]
  + commit 09a64badfb3f51b1b391fa29be19962381a4bbeb [sxt1001] (LP: #2011291)
  + Standardize kernel commandline user interface (#2093)
  + config/cc_resizefs: fix do_resize arguments (#2106) [Chris Patterson]
  + Fix test_dhclient_exits_with_error (#2105)
  + net/dhcp: catch dhclient failures and raise NoDHCPLeaseError (#2083)
    [Chris Patterson]
  + sources/azure: move pps handling out of _poll_imds() (#2075)
    [Chris Patterson]
  + tests: bump pycloudlib version (#2102)
  + schema: do not manipulate draft4 metaschema for jsonschema 2.6.0 (#2098)
  + sources/azure/imds: don't count timeout errors as connection errors
    (#2074) [Chris Patterson]
  + Fix Python 3.12 unit test failures (#2099)
  + integration tests: Refactor instance checking (#1989)
  + ci: migrate remaining jobs from travis to gh (#2085)
  + missing ending quote in instancedata docs(#2094) [Hong L]
  + refactor: stop passing log instances to cc_* handlers (#2016) [d1r3ct0r]
  + tests/vmware: fix test_no_data_access_method failure (#2092)
    [Chris Patterson]
  + Don't change permissions of netrules target (#2076) (LP: #2011783)
  + tests/sources: patch util.get_cmdline() for datasource tests (#2091)
    [Chris Patterson]
  + macs: ignore duplicate MAC for devs with driver driver qmi_wwan (#2090)
    (LP: #2008888)
  + Fedora: Enable CA handling (#2086) [František Zatloukal]
  + Send dhcp-client-identifier for InfiniBand ports (#2043) [Waleed Mousa]
  + cc_ansible: complete the examples and doc (#2082) [Yves]
  + bddeb: for dev package, derive debhelper-compat from host system
  + apport: only prompt for cloud_name when instance-data.json is absent
  + datasource: Optimize datasource detection, fix bugs (#2060)
  + Handle non existent ca-cert-config situation (#2073) [Shreenidhi Shedi]
  + sources/azure: add networking check for all source PPS (#2061)
    [Chris Patterson]
  + do not attempt dns resolution on ip addresses (#2040)
  + chore: fix style tip (#2071)
  + Fix metadata IP in instancedata.rst (#2063) [Brian Haley]
  + util: Pass deprecation schedule in deprecate_call() (#2064)
  + config: Update grub-dpkg docs (#2058)
  + docs: Cosmetic improvements and styling (#2057) [s-makin]
  + cc_grub_dpkg: Added UEFI support (#2029) [Alexander Birkner]
  + tests: Write to /var/spool/rsyslog to adhere to apparmor profile (#2059)
  + oracle-ds: prefer system_cfg over ds network config source (#1998)
    (LP: #1956788)
  + Remove dead code (#2038)
  + source: Force OpenStack when it is only option (#2045) (LP: #2008727)
  + cc_ubuntu_advantage: improve UA logs discovery
  + sources/azure: fix regressions in IMDS behavior (#2041) [Chris Patterson]
  + tests: fix test_schema (#2042)
  + dhcp: Cleanup unused kwarg (#2037)
  + sources/vmware/imc: fix-missing-catch-few-negtive-scenarios (#2027)
    [PengpengSun]
  + dhclient_hook: remove vestigal dhclient_hook command (#2015)
  + log: Add standardized deprecation tooling (SC-1312) (#2026)
  + Enable SUSE based distros for ca handling (#2036) [Robert Schweikert]
  From 23.1.2
  + Make user/vendor data sensitive and remove log permissions
    (LP: #2013967) (CVE-2023-1786)
  From 23.1.1
  + source: Force OpenStack when it is only option (#2045)
  + sources/azure: fix regressions in IMDS behavior (#2041)
    [Chris Patterson]</changelog>
  <changelog author="michal.vyskocil@gmail.com" date="1701432000">- Move fdupes call back to %install (boo#1214169)</changelog>
  <changelog author="rjschwei@suse.com" date="1702641600">- Switch build dependency to the generic distribution-release package</changelog>
  <changelog author="rjschwei@suse.com" date="1705665600">- Add cloud-init-pckg-reboot.patch (boo#1198533, bsc#1218952,  jsc#SMO-326)
  + Support reboot on package update/upgrade via the cloud-init config</changelog>
  <changelog author="rjschwei@suse.com" date="1705752000">- Add cloud-init-skip-empty-conf.patch
  + Skip tests with empty config</changelog>
  <changelog author="rjschwei@suse.com" date="1708430400">- Prepare for RPM 4.20 switch patch syntax</changelog>
  <changelog author="fcrozat@suse.com" date="1709726400">- Hardcode distribution to suse for proper cloud.cfg generation
  (bsc#1220132).</changelog>
  <changelog author="rjschwei@suse.com" date="1711627200">- Add  cloud-init-ds-deterministic.patch (bsc#1221132)
  + Do not guess a data source when checking for a CloudStack
    environment</changelog>
  <changelog author="rjschwei@suse.com" date="1712318400">- Add cloud-init-no-openstack-guess.patch (bsc#1222113)
  + Do not guess if we are running on OpenStack or not. Only recognize
    the known markers and enable cloud-init if we know for sure.</changelog>
  <changelog author="rjschwei@suse.com" date="1712318401">- Add cloud-init-no-nmcfg-needed.patch (bsc#1221726)
  + Do not require a NetworkManager config file in order to detect
    NetworkManager as the renderer</changelog>
  <changelog author="rjschwei@suse.com" date="1712664000">- Update cloud-init-no-openstack-guess.patch
  + Do not enable cloud-init on systems where there is no DMI just
    because no data source has been found. No data source means
    cloud-init will not run.</changelog>
  <changelog author="rjschwei@suse.com" date="1714392000">- Add cloud-init-usr-sudoers.patch (bsc#1223469)
  + Handle the existence of /usr/etc/sudoers to search for the expected
    include location</changelog>
  <changelog author="rjschwei@suse.com" date="1717416000">- Add cloud-init-skip-rename.patch (bsc#1219680)
  + Brute force appraoch to skip renames if the device is already present</changelog>
</package>
<package pkgid="b2cc43b7475ebb68460dbb9b3abf52bd82ee6c83b70a1776365e317c99b304a2" name="cloud-init-config-suse" arch="ppc64le">
  <version epoch="0" ver="23.3" rel="150100.8.82.3"/>
  <changelog author="rjschwei@suse.com" date="1675425600">- Add cloud-init-transact-up.patch to support transactional-updates</changelog>
  <changelog author="rjschwei@suse.com" date="1677153600">- Update to version 23.1
  + Remove patches included upstream:
  - cloud-init-btrfs-queue-resize.patch
  - cloud-init-micro-is-suse.patch
  - cloud-init-suse-afternm.patch
  - cloud-init-prefer-nm.patch
  - cloud-init-transact-up.patch
  + Forward port
  - cloud-init-write-routes.patch
  + Added
  - cloud-init-fix-ca-test.patch
  + Support transactional-updates for SUSE based distros (#1997)
    [Robert Schweikert]
  + Set ownership for new folders in Write Files Module (#1980)
    [Jack] (LP: #1990513)
  + add OpenCloudOS and TencentOS support (#1964) [wynnfeng]
  + lxd: Retry if the server isn't ready (#2025)
  + test: switch pycloudlib source to pypi (#2024)
  + test: Fix integration test deprecation message (#2023)
  + Recognize opensuse-microos, dev tooling fixes [Robert Schweikert]
  + sources/azure: refactor imds handler into own module (#1977)
    [Chris Patterson]
  + docs: deprecation generation support [1/2] (#2013)
  + add function is_virtual to distro/FreeBSD (#1957) [Mina Galić]
  + cc_ssh: support multiple hostcertificates (#2018) (LP: #1999164)
  + Fix minor schema validation regression and fixup typing (#2017)
  + doc: Reword user data debug section (#2019)
  + Overhaul/rewrite of certificate handling as follows: (#1962)
    [dermotbradley] (LP: #1931174)
  + disk_setup: use byte string when purging the partition table (#2012)
    [Stefan Prietl]
  + cli: schema also validate vendordata*.
  + ci: sort and add checks for cla signers file [Stefan Prietl]
  + Add "ederst" as contributor (#2010) [Stefan Prietl]
  + readme: add reference to packages dir (#2001)
  + docs: update downstream package list (#2002)
  + docs: add google search verification (#2000) [s-makin]
  + docs: fix 404 render use default notfound_urls_prefix in RTD conf (#2004)
  + Fix OpenStack datasource detection on bare metal (#1923)
    [Alexander Birkner] (LP: #1815990)
  + docs: add themed RTD 404 page and pointer to readthedocs-hosted (#1993)
  + schema: fix gpt labels, use type string for GUID (#1995)
  + cc_disk_setup: code cleanup (#1996)
  + netplan: keep custom strict perms when 50-cloud-init.yaml exists
  + cloud-id: better handling of change in datasource files
    [d1r3ct0r] (LP: #1998998)
  + tests: Remove restart check from test
  + Ignore duplicate macs from mscc_felix and fsl_enetc (LP: #1997922)
  + Warn on empty network key (#1990)
  + Fix Vultr cloud_interfaces usage (#1986) [eb3095]
  + cc_puppet: Update puppet service name (#1970) [d1r3ct0r] (LP: #2002969)
  + docs: Clarify networking docs (#1987)
  + lint: remove httpretty (#1985) [sxt1001]
  + cc_set_passwords: Prevent traceback when restarting ssh (#1981)
  + tests: fix lp1912844 (#1978)
  + tests: Skip ansible test on bionic (#1984)
  + Wait for NetworkManager (#1983) [Robert Schweikert]
  + docs: minor polishing (#1979) [s-makin]
  + CI: migrate integration-test to GH actions (#1969)
  + Fix permission of SSH host keys (#1971) [Ron Gebauer]
  + Fix default route rendering on v2 ipv6 (#1973) (LP: #2003562)
  + doc: fix path in net_convert command (#1975)
  + docs: update net_convert docs (#1974)
  + doc: fix dead link
  + cc_set_hostname: ignore /var/lib/cloud/data/set-hostname if it's empty
    (#1967) [Emanuele Giuseppe Esposito]
  + distros/rhel.py: _read_hostname() missing strip on "hostname" (#1941)
    [Mark Mielke]
  + integration tests: add  IBM VPC support (SC-1352) (#1915)
  + machine-id: set to uninitialized to trigger regeneration on clones
    (LP: #1999680)
  + sources/azure: retry on connection error when fetching metdata (#1968)
    [Chris Patterson]
  + Ensure ssh state accurately obtained (#1966)
  + bddeb: drop dh-systemd dependency on newer deb-based releases [d1r3ct0r]
  + doc: fix `config formats` link in cloudsigma.rst (#1960)
  + Fix wrong subp syntax in cc_set_passwords.py (#1961)
  + docs: update the PR template link to readthedocs (#1958) [d1r3ct0r]
  + ci: switch unittests to gh actions (#1956)
  + Add mount_default_fields for PhotonOS. (#1952) [Shreenidhi Shedi]
  + sources/azure: minor refactor for metadata source detection logic
    (#1936) [Chris Patterson]
  + add "CalvoM" as contributor (#1955) [d1r3ct0r]
  + ci: doc to gh actions (#1951)
  + lxd: handle 404 from missing devices route for LXD 4.0 (LP: #2001737)
  + docs: Diataxis overhaul (#1933) [s-makin]
  + vultr: Fix issue regarding cache and region codes (#1938) [eb3095]
  + cc_set_passwords: Move ssh status checking later (SC-1368) (#1909)
    (LP: #1998526)
  + Improve Wireguard module idempotency (#1940) [Fabian Lichtenegger-Lukas]
  + network/netplan: add gateways as on-link when necessary (#1931)
    [Louis Sautier] (LP: #2000596)
  + tests: test_lxd assert features.networks.zones when present (#1939)
  + Use btrfs enquque when available (#1926) [Robert Schweikert]
  + sources/azure: drop description for report_failure_to_fabric() (#1934)
    [Chris Patterson]
  + cc_disk_setup.py: fix MBR single partition creation (#1932)
    [dermotbradley] (LP: #1851438)
  + Fix typo with package_update/package_upgrade (#1927) [eb3095]
  + sources/azure: fix device driver matching for net config (#1914)
    [Chris Patterson]
  + BSD: fix duplicate macs in Ifconfig parser (#1917) [Mina Galić]
  + test: mock dns calls (#1922)
  + pycloudlib: add lunar support for integration tests (#1928)
  + nocloud: add support for dmi variable expansion for seedfrom URL
    (LP: #1994980)
  + tools: read-version drop extra call to git describe --long
  + doc: improve cc_write_files doc (#1916)
  + read-version: When insufficient tags, use cloudinit.version.get_version
  + mounts: document weird prefix in schema (#1913)
  + add utility function test cases (#1910) [sxt1001]
  + test: mock file deletion in dhcp tests (#1911)
  + Ensure network ready before cloud-init service runs on RHEL (#1893)
    (LP: #1998655)
  + docs: add copy button to code blocks (#1890) [s-makin]
  + netplan: define features.NETPLAN_CONFIG_ROOT_READ_ONLY flag
  + azure: fix support for systems without az command installed (#1908)
  + Networking Clarification (#1892)
  + Fix the distro.osfamily output problem in the openEuler system. (#1895)
    [sxt1001] (LP: #1999042)
  + pycloudlib: bump commit dropping azure api smoke test
  + net: netplan config root read-only as wifi config can contain creds
  + autoinstall: clarify docs for users
  + sources/azure: encode health report as utf-8 (#1897) [Chris Patterson]
  + Add back gateway4/6 deprecation to docs (#1898)
  + networkd: Add support for multiple [Route] sections (#1868)
    [Nigel Kukard]
  + doc: add qemu tutorial (#1863)
  + lint: fix tip-flake8 and tip-mypy (#1896)
  + Add support for setting uid when creating users on FreeBSD (#1888)
    [einsibjarni]
  + Fix exception in BSD networking code-path (#1894) [Mina Galić]
  + Append derivatives to is_rhel list in cloud.cfg.tmpl (#1887) [Louis Abel]
  + FreeBSD init: use cloudinit_enable as only rcvar (#1875) [Mina Galić]
  + feat: add support aliyun metadata security harden mode (#1865)
    [Manasseh Zhou]
  + docs: uprate analyze to performance page [s-makin]
  + test: fix lxd preseed managed network config (#1881)
  + Add support for static IPv6 addresses for FreeBSD (#1839) [einsibjarni]
  + Make 3.12 failures not fail the build (#1873)
  + Docs: adding relative links [s-makin]
  + Update read-version
  + Fix setup.py to align with PEP 440 versioning replacing trailing
  + travis: promote 3.11-dev to 3.11 (#1866)
  + test_cloud_sigma: delete useless test (#1828) [sxt1001]
  + Add "nkukard" as contributor (#1864) [Nigel Kukard]
  + tests: ds-id mocks for vmware-rpctool as utility may not exist in env
  + doc: add how to render new module doc (#1855)
  + doc: improve module creation explanation (#1851)
  + Add Support for IPv6 metadata to OpenStack (#1805)
    [Marvin Vogt] (LP: #1906849)
  + add xiaoge1001 to .github-cla-signers (#1854) [sxt1001]
  + network: Deprecate gateway{4,6} keys in network config v2 (#1794)
    (LP: #1992512)
  + VMware: Move Guest Customization transport from OVF to VMware (#1573)
    [PengpengSun]
  + doc: home page links added (#1852) [s-makin]
  From 22.4.2
  + status: handle ds not defined in status.json (#1876) (LP: #1997559)
  From 22.4.1
  + net: skip duplicate mac check for netvsc nic and its VF (#1853)
    [Anh Vo] (LP: #1844191)
  + ChangeLog: whitespace cleanup (#1850)
  + changelog: capture 22.3.1-4 releases</changelog>
  <changelog author="rjschwei@suse.com" date="1681214400">- Sensitive data exposure (bsc#1210277, CVE-2023-1786)
  + Add hidesensitivedata
  + Add cloud-init-cve-2023-1786-redact-inst-data.patch
  + Do not expose sensitive data gathered from the CSP</changelog>
  <changelog author="rjschwei@suse.com" date="1682596800">- Add cloud-init-power-rhel-only.patch (bsc#1210273)
  + Config module cc_refresh_rmc_and_interface is implemented such that
    it will only work on RH distros. Set the module availability accordingly.</changelog>
  <changelog author="rjschwei@suse.com" date="1688644800">- Update cloud-init-write-routes.patch (bsc#1212879)
  + Add necessary import statement
- Enable flake8 linting, fix up patches
  + cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  + cloud-init-power-rhel-only.patch
  + cloud-init-write-routes.patch
  + datasourceLocalDisk.patch</changelog>
  <changelog author="dmueller@suse.com" date="1691928000">- update to 23.1.2:
  * Make user/vendor data sensitive and remove log permissions
  * source: Force OpenStack when it is only option (#2045)
  * sources/azure: fix regressions in IMDS behavior
- drop
  cloud-init-cve-2023-1786-redact-instance-data-json-main.patch (upstream)
- spec-file cleanups, including dropping flake8 (as build fails
  with newer flake8 versions)</changelog>
  <changelog author="rjschwei@suse.com" date="1692014400">- Add cloud-init-flake8-fixes.patch
- Revert chnages from previous commit
  + Disabling checks the primary maintainer enabled for specific reasons
    is not a fix.</changelog>
  <changelog author="rjschwei@suse.com" date="1696852800">- Update to version 23.3 (bsc#1216011, bsc#1215794, bsc#1215740)
  + Remove patches included upstream:
  - cloud-init-fix-ca-test.patch
  - cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  - cloud-init-power-rhel-only.patch
  - cloud-init-flake8-fixes.patch
  + Add
  - cloud-init-keep-flake.patch
  - cloud-init-lint-fixes.patch
  + Update
  - cloud-init-write-routes.patch (bsc#1216007)
  + Bump pycloudlib to 1!5.1.0 for ec2 mantic daily image support (#4390)
  + Fix cc_keyboard in mantic (LP: #2030788)
  + ec2: initialize get_instance_userdata return value to bytes (#4387)
    [Noah Meyerhans]
  + cc_users_groups: Add doas/opendoas support (#4363) [dermotbradley]
  + Fix pip-managed ansible
  + status: treat SubState=running and MainPID=0 as service exited
  + azure/imds: increase read-timeout to 30s (#4372) [Chris Patterson]
  + collect-logs fix memory usage (SC-1590) (#4289)
    [Alec Warren] (LP: #1980150)
  + cc_mounts: Use fallocate to create swapfile on btrfs (#4369) [王煎饼]
  + Undocument nocloud-net (#4318)
  + feat(akamai): add akamai to settings.py and apport.py (#4370)
  + read-version: fallback to get_version when git describe fails (#4366)
  + apt: fix cloud-init status --wait blocking on systemd v 253 (#4364)
  + integration tests: Pass username to pycloudlib (#4324)
  + Bump pycloudlib to 1!5.1.0 (#4353)
  + cloud.cfg.tmpl: reorganise, minimise/reduce duplication (#4272)
    [dermotbradley]
  + analyze: fix (unexpected) timestamp parsing (#4347) [Mina Galić]
  + cc_growpart: fix tests to run on FreeBSD (#4351) [Mina Galić]
  + subp: Fix spurious test failure on FreeBSD (#4355) [Mina Galić]
  + cmd/clean: fix tests on non-Linux platforms (#4352) [Mina Galić]
  + util: Fix get_proc_ppid() on non-Linux systems (#4348) [Mina Galić]
  + cc_wireguard: make tests pass on FreeBSD (#4346) [Mina Galić]
  + unittests: fix breakage in test_read_cfg_paths_fetches_cached_datasource
    (#4328) [Ani Sinha]
  + Fix test_tools.py collection (#4315)
  + cc_keyboard: add Alpine support (#4278) [dermotbradley]
  + Flake8 fixes (#4340) [Robert Schweikert]
  + cc_mounts: Fix swapfile not working on btrfs (#4319) [王煎饼] (LP: #1884127)
  + ds-identify/CloudStack: $DS_MAYBE if vm running on vmware/xen (#4281)
    [Wei Zhou]
  + ec2: Support double encoded userdata (#4276) [Noah Meyerhans]
  + cc_mounts: xfs is a Linux only FS (#4334) [Mina Galić]
  + tests/net: fix TestGetInterfaces' mock coverage for get_master (#4336)
    [Chris Patterson]
  + change openEuler to openeuler and fix some bugs in openEuler (#4317)
    [sxt1001]
  + Replace flake8 with ruff (#4314)
  + NM renderer: set default IPv6 addr-gen-mode for all interfaces to eui64
    (#4291) [Ani Sinha]
  + cc_ssh_import_id: add Alpine support and add doas support (#4277)
    [dermotbradley]
  + sudoers not idempotent (SC-1589)  (#4296) [Alec Warren] (LP: #1998539)
  + Added support for Akamai Connected Cloud (formerly Linode) (#4167)
    [Will Smith]
  + Fix reference before assignment (#4292)
  + Overhaul module reference page (#4237) [Sally]
  + replaced spaces with commas for setting passenv (#4269) [Alec Warren]
  + DS VMware: modify a few log level (#4284) [PengpengSun]
  + tools/read-version refactors and unit tests (#4268)
  + Ensure get_features() grabs all features (#4285)
  + Don't always require passlib dependency (#4274)
  + tests: avoid leaks into host system checking of ovs-vsctl cmd (#4275)
  + Fix NoCloud kernel commandline key parsing (#4273)
  + testing: Clear all LRU caches after each test (#4249)
  + Remove the crypt dependency (#2139) [Gonéri Le Bouder]
  + logging: keep current file mode of log file if its stricter than the
    new mode (#4250) [Ani Sinha]
  + Remove default membership in redundant groups (#4258)
    [Dave Jones] (LP: #1923363)
  + doc: improve datasource_creation.rst (#4262)
  + Remove duplicate Integration testing button (#4261) [Rishita Shaw]
  + tools/read-version: fix the tool so that it can handle version parsing
    errors (#4234) [Ani Sinha]
  + net/dhcp: add udhcpc support (#4190) [Jean-François Roche]
  + DS VMware: add i386 arch dir to deployPkg plugin search path
    [PengpengSun]
  + LXD moved from linuxcontainers.org to Canonical [Simon Deziel]
  + cc_mounts.py: Add note about issue with creating mounts inside mounts
    (#4232) [dermotbradley]
  + lxd: install lxd from snap, not deb if absent in image
  + landscape: use landscape-config to write configuration
  + Add deprecation log during init of DataSourceDigitalOcean (#4194)
    [tyb-truth]
  + doc: fix typo on apt.primary.arches (#4238) [Dan Bungert]
  + Inspect systemd state for cloud-init status (#4230)
  + instance-data: add system-info and features to combined-cloud-config
    (#4224)
  + systemd: Block login until config stage completes (#2111) (LP: #2013403)
  + tests: proposed should invoke apt-get install -t=&lt;release&gt;-proposed
    (#4235)
  + cloud.cfg.tmpl: reinstate ca_certs entry (#4236) [dermotbradley]
  + Remove feature flag override ability (#4228)
  + tests: drop stray unrelated file presence test (#4227)
  + Update LXD URL (#4223) [Sally]
  + schema: add network v1 schema definition and validation functions
  + tests: daily PPA for devel series is version 99.daily update tests to
    match (#4225)
  + instance-data: write /run/cloud-init/combined-cloud-config.json
  + mount parse: Fix matching non-existent directories (#4222) [Mina Galić]
  + Specify build-system for pep517 (#4218)
  + Fix network v2 metric rendering (#4220)
  + Migrate content out of FAQ page (SD-1187) (#4205) [Sally]
  + setup: fix generation of init templates (#4209) [Mina Galić]
  + docs: Correct some bootcmd example wording
  + fix changelog
  + tests: reboot client to assert x-shellscript-per-boot is triggered
  + nocloud: parse_cmdline no longer detects nocloud-net datasource (#4204)
    (LP: 4203, #2025180)
  + Add docstring and typing to mergemanydict (#4200)
  + BSD: add dsidentify to early startup scripts (#4182) [Mina Galić]
  + handler: report errors on skipped merged cloud-config.txt parts
    (LP: #1999952)
  + Add cloud-init summit writeups (#4179) [Sally]
  + tests: Update test_clean_log for oci (#4187)
  + gce: improve ephemeral fallback NIC selection (CPC-2578) (#4163)
  + tests: pin pytest 7.3.1 to avoid adverse testpaths behavior (#4184)
  + Ephemeral Networking for FreeBSD (#2165) [Mina Galić]
  + Clarify directory syntax for nocloud local filesystem. (#4178)
  + Set default renderer as sysconfig for centos/rhel (#4165) [Ani Sinha]
  + Test static routes and netplan 0.106
  + FreeBSD fix parsing of mount and mount options (#2146) [Mina Galić]
  + test: add tracking bug id (#4164)
  + tests: can't match MAC for LXD container veth due to netplan 0.106
    (#4162)
  + Add kaiwalyakoparkar as a contributor (#4156) [Kaiwalya Koparkar]
  + BSD: remove datasource_list from cloud.cfg template (#4159) [Mina Galić]
  + launching salt-minion in masterless mode (#4110) [Denis Halturin]
  + tools: fix run-container builds for rockylinux/8 git hash mismatch
    (#4161)
  + fix doc lint: spellchecker tripped up (#4160) [Mina Galić]
  + Support Ephemeral Networking for BSD (#2127)
  + Added / fixed support for static routes on OpenBSD and FreeBSD (#2157)
    [Kadir Mueller]
  + cc_rsyslog: Refactor for better multi-platform support (#4119)
    [Mina Galić] (LP: #1798055)
  + tests: fix test_lp1835584 (#4154)
  + cloud.cfg mod names: docs and rename salt_minion and set_password (#4153)
  + tests: apt support for deb822 format .sources files on mantic
  + vultr: remove check_route check (#2151) [Jonas Chevalier]
  + Update SECURITY.md (#4150) [Indrranil Pawar]
  + Update CONTRIBUTING.rst (#4149) [Indrranil Pawar]
  + Update .github-cla-signers (#4151) [Indrranil Pawar]
  + Standardise module names in cloud.cfg.tmpl to only use underscore
    (#4128) [dermotbradley]
  + tests: update test_webhook_reporting
  + Modify PR template so autoclose works
  + doc: add missing semi-colon to nocloud cmdline docs (#4120)
  + .gitignore: extend coverage pattern (#4143) [Mina Galić]
  From 23.2.2
  + Fix NoCloud kernel commandline key parsing (#4273) (Fixes: #4271)
    (LP: #2028562)
  + Fix reference before assignment (#4292) (Fixes: #4288) (LP: #2028784)
  From 23.2.1
  + nocloud: Fix parse_cmdline detection of nocloud-net datasource (#4204)
    (Fixes: 4203) (LP: #2025180)
  From 23.2
  + BSD: simplify finding MBR partitions by removing duplicate code
  [Mina Galić]
  + tests: bump pycloudlib version for mantic builds
  + network-manager: Set higher autoconnect priority for nm keyfiles (#3671)
    [Ani Sinha]
  + alpine.py: change the locale file used (#4139) [dermotbradley]
  + cc_ntp: Sync up with current FreeBSD ntp.conf (#4122) [Mina Galić]
  + config: drop refresh_rmc_and_interface as RHEL 7 no longer supported
    [Robert Schweikert]
  + docs: Add feedback button to docs
  + net/sysconfig: enable sysconfig renderer if network manager has ifcfg-rh
    plugin (#4132) [Ani Sinha]
  + For Alpine use os-release PRETTY_NAME (#4138) [dermotbradley]
  + network_manager: add a method for ipv6 static IP configuration (#4127)
    [Ani Sinha]
  + correct misnamed template file host.mariner.tmpl (#4124) [dermotbradley]
  + nm: generate ipv6 stateful dhcp config at par with sysconfig (#4115)
    [Ani Sinha]
  + Add templates for GitHub Issues
  + Add 'peers' and 'allow' directives in cc_ntp (#3124) [Jacob Salmela]
  + FreeBSD: Fix user account locking (#4114) [Mina Galić] (GH: #1854594)
  + FreeBSD: add ResizeGrowFS class to cc_growpart (#2334) [Mina Galić]
  + Update tests in Azure TestCanDevBeReformatted class (#2771)
    [Ksenija Stanojevic]
  + Replace Launchpad references with GitHub Issues
  + Fix KeyError in iproute pformat (#3287) [Dmitry Zykov]
  + schema: read_cfg_paths call init.fetch to lookup /v/l/c/instance
  + azure/errors: introduce reportable errors for imds (#3647)
    [Chris Patterson]
  + FreeBSD (and friends): better identify MBR slices (#2168)
    [Mina Galić] (LP: #2016350)
  + azure/errors: add host reporting for dhcp errors (#2167)
    [Chris Patterson]
  + net: purge blacklist_drivers across net and azure (#2160)
    [Chris Patterson]
  + net: refactor hyper-v VF filtering and apply to get_interfaces() (#2153)
    [Chris Patterson]
  + tests: avoid leaks to underlying filesystem for /etc/cloud/clean.d
    (#2251)
  + net: refactor find_candidate_nics_on_linux() to use get_interfaces()
    (#2159) [Chris Patterson]
  + resolv_conf: Allow &gt; 3 nameservers (#2152) [Major Hayden]
  + Remove mount NTFS error message (#2134) [Ksenija Stanojevic]
  + integration tests: fix image specification parsing (#2166)
  + ci: add hypothesis scheduled GH check (#2149)
  + Move supported distros list to docs (#2162)
  + Fix logger, use instance rather than module function (#2163)
  + README: Point to Github Actions build status (#2158)
  + Revert "fix linux-specific code on bsd (#2143)" (#2161)
  + Do not generate dsa and ed25519 key types when crypto FIPS mode is
    enabled (#2142) [Ani Sinha] (LP: 2017761)
  + Add documentation label automatically (#2156)
  + sources/azure: report success to host and introduce kvp module (#2141)
    [Chris Patterson]
  + setup.py: use pkg-config for udev/rules path (#2137) [dankm]
  + openstack/static: honor the DNS servers associated with a network
    (#2138) [Gonéri Le Bouder]
  + fix linux-specific code on bsd (#2143)
  + cli: schema validation of jinja template user-data (SC-1385) (#2132)
    (LP: #1881925)
  + gce: activate network discovery on every boot (#2128)
  + tests: update integration test to assert 640 across reboots (#2145)
  + Make user/vendor data sensitive and remove log permissions (#2144)
    (LP: #2013967)
  + Update kernel command line docs (SC-1457) (#2133)
  + docs: update network configuration path links (#2140) [d1r3ct0r]
  + sources/azure: report failures to host via kvp (#2136) [Chris Patterson]
  + net: Document use of `ip route append` to add routes (#2130)
  + dhcp: Add missing mocks (#2135)
  + azure/imds: retry fetching metadata up to 300 seconds (#2121)
    [Chris Patterson]
  + [1/2] DHCP: Refactor dhcp client code  (#2122)
  + azure/errors: treat traceback_base64 as string (#2131) [Chris Patterson]
  + azure/errors: introduce reportable errors (#2129) [Chris Patterson]
  + users: schema permit empty list to indicate create no users
  + azure: introduce identity module (#2116) [Chris Patterson]
  + Standardize disabling cloud-init on non-systemd (#2112)
  + Update .github-cla-signers (#2126) [Rob Tongue]
  + NoCloud: Use seedfrom protocol to determine mode (#2107)
  + rhel: Remove sysvinit files. (#2114)
  + tox.ini: set -vvvv --showlocals for pytest (#2104) [Chris Patterson]
  + Fix NoCloud kernel commandline semi-colon args
  + run-container: make the container/VM timeout configurable (#2118)
    [Paride Legovini]
  + suse: Remove sysvinit files. (#2115)
  + test: Backport assert_call_count for old requests (#2119)
  + Add "licebmi" as contributor (#2113) [Mark Martinez]
  + Adapt DataSourceScaleway to upcoming IPv6 support (#2033)
    [Louis Bouchard]
  + rhel: make sure previous-hostname file ends with a new line (#2108)
    [Ani Sinha]
  + Adding contributors for DataSourceAkamai (#2110) [acourdavAkamai]
  + Cleanup ephemeral IP routes on exception (#2100) [sxt1001]
  + commit 09a64badfb3f51b1b391fa29be19962381a4bbeb [sxt1001] (LP: #2011291)
  + Standardize kernel commandline user interface (#2093)
  + config/cc_resizefs: fix do_resize arguments (#2106) [Chris Patterson]
  + Fix test_dhclient_exits_with_error (#2105)
  + net/dhcp: catch dhclient failures and raise NoDHCPLeaseError (#2083)
    [Chris Patterson]
  + sources/azure: move pps handling out of _poll_imds() (#2075)
    [Chris Patterson]
  + tests: bump pycloudlib version (#2102)
  + schema: do not manipulate draft4 metaschema for jsonschema 2.6.0 (#2098)
  + sources/azure/imds: don't count timeout errors as connection errors
    (#2074) [Chris Patterson]
  + Fix Python 3.12 unit test failures (#2099)
  + integration tests: Refactor instance checking (#1989)
  + ci: migrate remaining jobs from travis to gh (#2085)
  + missing ending quote in instancedata docs(#2094) [Hong L]
  + refactor: stop passing log instances to cc_* handlers (#2016) [d1r3ct0r]
  + tests/vmware: fix test_no_data_access_method failure (#2092)
    [Chris Patterson]
  + Don't change permissions of netrules target (#2076) (LP: #2011783)
  + tests/sources: patch util.get_cmdline() for datasource tests (#2091)
    [Chris Patterson]
  + macs: ignore duplicate MAC for devs with driver driver qmi_wwan (#2090)
    (LP: #2008888)
  + Fedora: Enable CA handling (#2086) [František Zatloukal]
  + Send dhcp-client-identifier for InfiniBand ports (#2043) [Waleed Mousa]
  + cc_ansible: complete the examples and doc (#2082) [Yves]
  + bddeb: for dev package, derive debhelper-compat from host system
  + apport: only prompt for cloud_name when instance-data.json is absent
  + datasource: Optimize datasource detection, fix bugs (#2060)
  + Handle non existent ca-cert-config situation (#2073) [Shreenidhi Shedi]
  + sources/azure: add networking check for all source PPS (#2061)
    [Chris Patterson]
  + do not attempt dns resolution on ip addresses (#2040)
  + chore: fix style tip (#2071)
  + Fix metadata IP in instancedata.rst (#2063) [Brian Haley]
  + util: Pass deprecation schedule in deprecate_call() (#2064)
  + config: Update grub-dpkg docs (#2058)
  + docs: Cosmetic improvements and styling (#2057) [s-makin]
  + cc_grub_dpkg: Added UEFI support (#2029) [Alexander Birkner]
  + tests: Write to /var/spool/rsyslog to adhere to apparmor profile (#2059)
  + oracle-ds: prefer system_cfg over ds network config source (#1998)
    (LP: #1956788)
  + Remove dead code (#2038)
  + source: Force OpenStack when it is only option (#2045) (LP: #2008727)
  + cc_ubuntu_advantage: improve UA logs discovery
  + sources/azure: fix regressions in IMDS behavior (#2041) [Chris Patterson]
  + tests: fix test_schema (#2042)
  + dhcp: Cleanup unused kwarg (#2037)
  + sources/vmware/imc: fix-missing-catch-few-negtive-scenarios (#2027)
    [PengpengSun]
  + dhclient_hook: remove vestigal dhclient_hook command (#2015)
  + log: Add standardized deprecation tooling (SC-1312) (#2026)
  + Enable SUSE based distros for ca handling (#2036) [Robert Schweikert]
  From 23.1.2
  + Make user/vendor data sensitive and remove log permissions
    (LP: #2013967) (CVE-2023-1786)
  From 23.1.1
  + source: Force OpenStack when it is only option (#2045)
  + sources/azure: fix regressions in IMDS behavior (#2041)
    [Chris Patterson]</changelog>
  <changelog author="michal.vyskocil@gmail.com" date="1701432000">- Move fdupes call back to %install (boo#1214169)</changelog>
  <changelog author="rjschwei@suse.com" date="1702641600">- Switch build dependency to the generic distribution-release package</changelog>
  <changelog author="rjschwei@suse.com" date="1705665600">- Add cloud-init-pckg-reboot.patch (boo#1198533, bsc#1218952,  jsc#SMO-326)
  + Support reboot on package update/upgrade via the cloud-init config</changelog>
  <changelog author="rjschwei@suse.com" date="1705752000">- Add cloud-init-skip-empty-conf.patch
  + Skip tests with empty config</changelog>
  <changelog author="rjschwei@suse.com" date="1708430400">- Prepare for RPM 4.20 switch patch syntax</changelog>
  <changelog author="fcrozat@suse.com" date="1709726400">- Hardcode distribution to suse for proper cloud.cfg generation
  (bsc#1220132).</changelog>
  <changelog author="rjschwei@suse.com" date="1711627200">- Add  cloud-init-ds-deterministic.patch (bsc#1221132)
  + Do not guess a data source when checking for a CloudStack
    environment</changelog>
  <changelog author="rjschwei@suse.com" date="1712318400">- Add cloud-init-no-openstack-guess.patch (bsc#1222113)
  + Do not guess if we are running on OpenStack or not. Only recognize
    the known markers and enable cloud-init if we know for sure.</changelog>
  <changelog author="rjschwei@suse.com" date="1712318401">- Add cloud-init-no-nmcfg-needed.patch (bsc#1221726)
  + Do not require a NetworkManager config file in order to detect
    NetworkManager as the renderer</changelog>
  <changelog author="rjschwei@suse.com" date="1712664000">- Update cloud-init-no-openstack-guess.patch
  + Do not enable cloud-init on systems where there is no DMI just
    because no data source has been found. No data source means
    cloud-init will not run.</changelog>
  <changelog author="rjschwei@suse.com" date="1714392000">- Add cloud-init-usr-sudoers.patch (bsc#1223469)
  + Handle the existence of /usr/etc/sudoers to search for the expected
    include location</changelog>
  <changelog author="rjschwei@suse.com" date="1717416000">- Add cloud-init-skip-rename.patch (bsc#1219680)
  + Brute force appraoch to skip renames if the device is already present</changelog>
</package>
<package pkgid="87f5cfd26646273bb3aba72de6b1d9e121b192b83290401dace8336f7983bbf7" name="cloud-init-config-suse" arch="s390x">
  <version epoch="0" ver="23.3" rel="150100.8.82.3"/>
  <changelog author="rjschwei@suse.com" date="1675425600">- Add cloud-init-transact-up.patch to support transactional-updates</changelog>
  <changelog author="rjschwei@suse.com" date="1677153600">- Update to version 23.1
  + Remove patches included upstream:
  - cloud-init-btrfs-queue-resize.patch
  - cloud-init-micro-is-suse.patch
  - cloud-init-suse-afternm.patch
  - cloud-init-prefer-nm.patch
  - cloud-init-transact-up.patch
  + Forward port
  - cloud-init-write-routes.patch
  + Added
  - cloud-init-fix-ca-test.patch
  + Support transactional-updates for SUSE based distros (#1997)
    [Robert Schweikert]
  + Set ownership for new folders in Write Files Module (#1980)
    [Jack] (LP: #1990513)
  + add OpenCloudOS and TencentOS support (#1964) [wynnfeng]
  + lxd: Retry if the server isn't ready (#2025)
  + test: switch pycloudlib source to pypi (#2024)
  + test: Fix integration test deprecation message (#2023)
  + Recognize opensuse-microos, dev tooling fixes [Robert Schweikert]
  + sources/azure: refactor imds handler into own module (#1977)
    [Chris Patterson]
  + docs: deprecation generation support [1/2] (#2013)
  + add function is_virtual to distro/FreeBSD (#1957) [Mina Galić]
  + cc_ssh: support multiple hostcertificates (#2018) (LP: #1999164)
  + Fix minor schema validation regression and fixup typing (#2017)
  + doc: Reword user data debug section (#2019)
  + Overhaul/rewrite of certificate handling as follows: (#1962)
    [dermotbradley] (LP: #1931174)
  + disk_setup: use byte string when purging the partition table (#2012)
    [Stefan Prietl]
  + cli: schema also validate vendordata*.
  + ci: sort and add checks for cla signers file [Stefan Prietl]
  + Add "ederst" as contributor (#2010) [Stefan Prietl]
  + readme: add reference to packages dir (#2001)
  + docs: update downstream package list (#2002)
  + docs: add google search verification (#2000) [s-makin]
  + docs: fix 404 render use default notfound_urls_prefix in RTD conf (#2004)
  + Fix OpenStack datasource detection on bare metal (#1923)
    [Alexander Birkner] (LP: #1815990)
  + docs: add themed RTD 404 page and pointer to readthedocs-hosted (#1993)
  + schema: fix gpt labels, use type string for GUID (#1995)
  + cc_disk_setup: code cleanup (#1996)
  + netplan: keep custom strict perms when 50-cloud-init.yaml exists
  + cloud-id: better handling of change in datasource files
    [d1r3ct0r] (LP: #1998998)
  + tests: Remove restart check from test
  + Ignore duplicate macs from mscc_felix and fsl_enetc (LP: #1997922)
  + Warn on empty network key (#1990)
  + Fix Vultr cloud_interfaces usage (#1986) [eb3095]
  + cc_puppet: Update puppet service name (#1970) [d1r3ct0r] (LP: #2002969)
  + docs: Clarify networking docs (#1987)
  + lint: remove httpretty (#1985) [sxt1001]
  + cc_set_passwords: Prevent traceback when restarting ssh (#1981)
  + tests: fix lp1912844 (#1978)
  + tests: Skip ansible test on bionic (#1984)
  + Wait for NetworkManager (#1983) [Robert Schweikert]
  + docs: minor polishing (#1979) [s-makin]
  + CI: migrate integration-test to GH actions (#1969)
  + Fix permission of SSH host keys (#1971) [Ron Gebauer]
  + Fix default route rendering on v2 ipv6 (#1973) (LP: #2003562)
  + doc: fix path in net_convert command (#1975)
  + docs: update net_convert docs (#1974)
  + doc: fix dead link
  + cc_set_hostname: ignore /var/lib/cloud/data/set-hostname if it's empty
    (#1967) [Emanuele Giuseppe Esposito]
  + distros/rhel.py: _read_hostname() missing strip on "hostname" (#1941)
    [Mark Mielke]
  + integration tests: add  IBM VPC support (SC-1352) (#1915)
  + machine-id: set to uninitialized to trigger regeneration on clones
    (LP: #1999680)
  + sources/azure: retry on connection error when fetching metdata (#1968)
    [Chris Patterson]
  + Ensure ssh state accurately obtained (#1966)
  + bddeb: drop dh-systemd dependency on newer deb-based releases [d1r3ct0r]
  + doc: fix `config formats` link in cloudsigma.rst (#1960)
  + Fix wrong subp syntax in cc_set_passwords.py (#1961)
  + docs: update the PR template link to readthedocs (#1958) [d1r3ct0r]
  + ci: switch unittests to gh actions (#1956)
  + Add mount_default_fields for PhotonOS. (#1952) [Shreenidhi Shedi]
  + sources/azure: minor refactor for metadata source detection logic
    (#1936) [Chris Patterson]
  + add "CalvoM" as contributor (#1955) [d1r3ct0r]
  + ci: doc to gh actions (#1951)
  + lxd: handle 404 from missing devices route for LXD 4.0 (LP: #2001737)
  + docs: Diataxis overhaul (#1933) [s-makin]
  + vultr: Fix issue regarding cache and region codes (#1938) [eb3095]
  + cc_set_passwords: Move ssh status checking later (SC-1368) (#1909)
    (LP: #1998526)
  + Improve Wireguard module idempotency (#1940) [Fabian Lichtenegger-Lukas]
  + network/netplan: add gateways as on-link when necessary (#1931)
    [Louis Sautier] (LP: #2000596)
  + tests: test_lxd assert features.networks.zones when present (#1939)
  + Use btrfs enquque when available (#1926) [Robert Schweikert]
  + sources/azure: drop description for report_failure_to_fabric() (#1934)
    [Chris Patterson]
  + cc_disk_setup.py: fix MBR single partition creation (#1932)
    [dermotbradley] (LP: #1851438)
  + Fix typo with package_update/package_upgrade (#1927) [eb3095]
  + sources/azure: fix device driver matching for net config (#1914)
    [Chris Patterson]
  + BSD: fix duplicate macs in Ifconfig parser (#1917) [Mina Galić]
  + test: mock dns calls (#1922)
  + pycloudlib: add lunar support for integration tests (#1928)
  + nocloud: add support for dmi variable expansion for seedfrom URL
    (LP: #1994980)
  + tools: read-version drop extra call to git describe --long
  + doc: improve cc_write_files doc (#1916)
  + read-version: When insufficient tags, use cloudinit.version.get_version
  + mounts: document weird prefix in schema (#1913)
  + add utility function test cases (#1910) [sxt1001]
  + test: mock file deletion in dhcp tests (#1911)
  + Ensure network ready before cloud-init service runs on RHEL (#1893)
    (LP: #1998655)
  + docs: add copy button to code blocks (#1890) [s-makin]
  + netplan: define features.NETPLAN_CONFIG_ROOT_READ_ONLY flag
  + azure: fix support for systems without az command installed (#1908)
  + Networking Clarification (#1892)
  + Fix the distro.osfamily output problem in the openEuler system. (#1895)
    [sxt1001] (LP: #1999042)
  + pycloudlib: bump commit dropping azure api smoke test
  + net: netplan config root read-only as wifi config can contain creds
  + autoinstall: clarify docs for users
  + sources/azure: encode health report as utf-8 (#1897) [Chris Patterson]
  + Add back gateway4/6 deprecation to docs (#1898)
  + networkd: Add support for multiple [Route] sections (#1868)
    [Nigel Kukard]
  + doc: add qemu tutorial (#1863)
  + lint: fix tip-flake8 and tip-mypy (#1896)
  + Add support for setting uid when creating users on FreeBSD (#1888)
    [einsibjarni]
  + Fix exception in BSD networking code-path (#1894) [Mina Galić]
  + Append derivatives to is_rhel list in cloud.cfg.tmpl (#1887) [Louis Abel]
  + FreeBSD init: use cloudinit_enable as only rcvar (#1875) [Mina Galić]
  + feat: add support aliyun metadata security harden mode (#1865)
    [Manasseh Zhou]
  + docs: uprate analyze to performance page [s-makin]
  + test: fix lxd preseed managed network config (#1881)
  + Add support for static IPv6 addresses for FreeBSD (#1839) [einsibjarni]
  + Make 3.12 failures not fail the build (#1873)
  + Docs: adding relative links [s-makin]
  + Update read-version
  + Fix setup.py to align with PEP 440 versioning replacing trailing
  + travis: promote 3.11-dev to 3.11 (#1866)
  + test_cloud_sigma: delete useless test (#1828) [sxt1001]
  + Add "nkukard" as contributor (#1864) [Nigel Kukard]
  + tests: ds-id mocks for vmware-rpctool as utility may not exist in env
  + doc: add how to render new module doc (#1855)
  + doc: improve module creation explanation (#1851)
  + Add Support for IPv6 metadata to OpenStack (#1805)
    [Marvin Vogt] (LP: #1906849)
  + add xiaoge1001 to .github-cla-signers (#1854) [sxt1001]
  + network: Deprecate gateway{4,6} keys in network config v2 (#1794)
    (LP: #1992512)
  + VMware: Move Guest Customization transport from OVF to VMware (#1573)
    [PengpengSun]
  + doc: home page links added (#1852) [s-makin]
  From 22.4.2
  + status: handle ds not defined in status.json (#1876) (LP: #1997559)
  From 22.4.1
  + net: skip duplicate mac check for netvsc nic and its VF (#1853)
    [Anh Vo] (LP: #1844191)
  + ChangeLog: whitespace cleanup (#1850)
  + changelog: capture 22.3.1-4 releases</changelog>
  <changelog author="rjschwei@suse.com" date="1681214400">- Sensitive data exposure (bsc#1210277, CVE-2023-1786)
  + Add hidesensitivedata
  + Add cloud-init-cve-2023-1786-redact-inst-data.patch
  + Do not expose sensitive data gathered from the CSP</changelog>
  <changelog author="rjschwei@suse.com" date="1682596800">- Add cloud-init-power-rhel-only.patch (bsc#1210273)
  + Config module cc_refresh_rmc_and_interface is implemented such that
    it will only work on RH distros. Set the module availability accordingly.</changelog>
  <changelog author="rjschwei@suse.com" date="1688644800">- Update cloud-init-write-routes.patch (bsc#1212879)
  + Add necessary import statement
- Enable flake8 linting, fix up patches
  + cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  + cloud-init-power-rhel-only.patch
  + cloud-init-write-routes.patch
  + datasourceLocalDisk.patch</changelog>
  <changelog author="dmueller@suse.com" date="1691928000">- update to 23.1.2:
  * Make user/vendor data sensitive and remove log permissions
  * source: Force OpenStack when it is only option (#2045)
  * sources/azure: fix regressions in IMDS behavior
- drop
  cloud-init-cve-2023-1786-redact-instance-data-json-main.patch (upstream)
- spec-file cleanups, including dropping flake8 (as build fails
  with newer flake8 versions)</changelog>
  <changelog author="rjschwei@suse.com" date="1692014400">- Add cloud-init-flake8-fixes.patch
- Revert chnages from previous commit
  + Disabling checks the primary maintainer enabled for specific reasons
    is not a fix.</changelog>
  <changelog author="rjschwei@suse.com" date="1696852800">- Update to version 23.3 (bsc#1216011, bsc#1215794, bsc#1215740)
  + Remove patches included upstream:
  - cloud-init-fix-ca-test.patch
  - cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  - cloud-init-power-rhel-only.patch
  - cloud-init-flake8-fixes.patch
  + Add
  - cloud-init-keep-flake.patch
  - cloud-init-lint-fixes.patch
  + Update
  - cloud-init-write-routes.patch (bsc#1216007)
  + Bump pycloudlib to 1!5.1.0 for ec2 mantic daily image support (#4390)
  + Fix cc_keyboard in mantic (LP: #2030788)
  + ec2: initialize get_instance_userdata return value to bytes (#4387)
    [Noah Meyerhans]
  + cc_users_groups: Add doas/opendoas support (#4363) [dermotbradley]
  + Fix pip-managed ansible
  + status: treat SubState=running and MainPID=0 as service exited
  + azure/imds: increase read-timeout to 30s (#4372) [Chris Patterson]
  + collect-logs fix memory usage (SC-1590) (#4289)
    [Alec Warren] (LP: #1980150)
  + cc_mounts: Use fallocate to create swapfile on btrfs (#4369) [王煎饼]
  + Undocument nocloud-net (#4318)
  + feat(akamai): add akamai to settings.py and apport.py (#4370)
  + read-version: fallback to get_version when git describe fails (#4366)
  + apt: fix cloud-init status --wait blocking on systemd v 253 (#4364)
  + integration tests: Pass username to pycloudlib (#4324)
  + Bump pycloudlib to 1!5.1.0 (#4353)
  + cloud.cfg.tmpl: reorganise, minimise/reduce duplication (#4272)
    [dermotbradley]
  + analyze: fix (unexpected) timestamp parsing (#4347) [Mina Galić]
  + cc_growpart: fix tests to run on FreeBSD (#4351) [Mina Galić]
  + subp: Fix spurious test failure on FreeBSD (#4355) [Mina Galić]
  + cmd/clean: fix tests on non-Linux platforms (#4352) [Mina Galić]
  + util: Fix get_proc_ppid() on non-Linux systems (#4348) [Mina Galić]
  + cc_wireguard: make tests pass on FreeBSD (#4346) [Mina Galić]
  + unittests: fix breakage in test_read_cfg_paths_fetches_cached_datasource
    (#4328) [Ani Sinha]
  + Fix test_tools.py collection (#4315)
  + cc_keyboard: add Alpine support (#4278) [dermotbradley]
  + Flake8 fixes (#4340) [Robert Schweikert]
  + cc_mounts: Fix swapfile not working on btrfs (#4319) [王煎饼] (LP: #1884127)
  + ds-identify/CloudStack: $DS_MAYBE if vm running on vmware/xen (#4281)
    [Wei Zhou]
  + ec2: Support double encoded userdata (#4276) [Noah Meyerhans]
  + cc_mounts: xfs is a Linux only FS (#4334) [Mina Galić]
  + tests/net: fix TestGetInterfaces' mock coverage for get_master (#4336)
    [Chris Patterson]
  + change openEuler to openeuler and fix some bugs in openEuler (#4317)
    [sxt1001]
  + Replace flake8 with ruff (#4314)
  + NM renderer: set default IPv6 addr-gen-mode for all interfaces to eui64
    (#4291) [Ani Sinha]
  + cc_ssh_import_id: add Alpine support and add doas support (#4277)
    [dermotbradley]
  + sudoers not idempotent (SC-1589)  (#4296) [Alec Warren] (LP: #1998539)
  + Added support for Akamai Connected Cloud (formerly Linode) (#4167)
    [Will Smith]
  + Fix reference before assignment (#4292)
  + Overhaul module reference page (#4237) [Sally]
  + replaced spaces with commas for setting passenv (#4269) [Alec Warren]
  + DS VMware: modify a few log level (#4284) [PengpengSun]
  + tools/read-version refactors and unit tests (#4268)
  + Ensure get_features() grabs all features (#4285)
  + Don't always require passlib dependency (#4274)
  + tests: avoid leaks into host system checking of ovs-vsctl cmd (#4275)
  + Fix NoCloud kernel commandline key parsing (#4273)
  + testing: Clear all LRU caches after each test (#4249)
  + Remove the crypt dependency (#2139) [Gonéri Le Bouder]
  + logging: keep current file mode of log file if its stricter than the
    new mode (#4250) [Ani Sinha]
  + Remove default membership in redundant groups (#4258)
    [Dave Jones] (LP: #1923363)
  + doc: improve datasource_creation.rst (#4262)
  + Remove duplicate Integration testing button (#4261) [Rishita Shaw]
  + tools/read-version: fix the tool so that it can handle version parsing
    errors (#4234) [Ani Sinha]
  + net/dhcp: add udhcpc support (#4190) [Jean-François Roche]
  + DS VMware: add i386 arch dir to deployPkg plugin search path
    [PengpengSun]
  + LXD moved from linuxcontainers.org to Canonical [Simon Deziel]
  + cc_mounts.py: Add note about issue with creating mounts inside mounts
    (#4232) [dermotbradley]
  + lxd: install lxd from snap, not deb if absent in image
  + landscape: use landscape-config to write configuration
  + Add deprecation log during init of DataSourceDigitalOcean (#4194)
    [tyb-truth]
  + doc: fix typo on apt.primary.arches (#4238) [Dan Bungert]
  + Inspect systemd state for cloud-init status (#4230)
  + instance-data: add system-info and features to combined-cloud-config
    (#4224)
  + systemd: Block login until config stage completes (#2111) (LP: #2013403)
  + tests: proposed should invoke apt-get install -t=&lt;release&gt;-proposed
    (#4235)
  + cloud.cfg.tmpl: reinstate ca_certs entry (#4236) [dermotbradley]
  + Remove feature flag override ability (#4228)
  + tests: drop stray unrelated file presence test (#4227)
  + Update LXD URL (#4223) [Sally]
  + schema: add network v1 schema definition and validation functions
  + tests: daily PPA for devel series is version 99.daily update tests to
    match (#4225)
  + instance-data: write /run/cloud-init/combined-cloud-config.json
  + mount parse: Fix matching non-existent directories (#4222) [Mina Galić]
  + Specify build-system for pep517 (#4218)
  + Fix network v2 metric rendering (#4220)
  + Migrate content out of FAQ page (SD-1187) (#4205) [Sally]
  + setup: fix generation of init templates (#4209) [Mina Galić]
  + docs: Correct some bootcmd example wording
  + fix changelog
  + tests: reboot client to assert x-shellscript-per-boot is triggered
  + nocloud: parse_cmdline no longer detects nocloud-net datasource (#4204)
    (LP: 4203, #2025180)
  + Add docstring and typing to mergemanydict (#4200)
  + BSD: add dsidentify to early startup scripts (#4182) [Mina Galić]
  + handler: report errors on skipped merged cloud-config.txt parts
    (LP: #1999952)
  + Add cloud-init summit writeups (#4179) [Sally]
  + tests: Update test_clean_log for oci (#4187)
  + gce: improve ephemeral fallback NIC selection (CPC-2578) (#4163)
  + tests: pin pytest 7.3.1 to avoid adverse testpaths behavior (#4184)
  + Ephemeral Networking for FreeBSD (#2165) [Mina Galić]
  + Clarify directory syntax for nocloud local filesystem. (#4178)
  + Set default renderer as sysconfig for centos/rhel (#4165) [Ani Sinha]
  + Test static routes and netplan 0.106
  + FreeBSD fix parsing of mount and mount options (#2146) [Mina Galić]
  + test: add tracking bug id (#4164)
  + tests: can't match MAC for LXD container veth due to netplan 0.106
    (#4162)
  + Add kaiwalyakoparkar as a contributor (#4156) [Kaiwalya Koparkar]
  + BSD: remove datasource_list from cloud.cfg template (#4159) [Mina Galić]
  + launching salt-minion in masterless mode (#4110) [Denis Halturin]
  + tools: fix run-container builds for rockylinux/8 git hash mismatch
    (#4161)
  + fix doc lint: spellchecker tripped up (#4160) [Mina Galić]
  + Support Ephemeral Networking for BSD (#2127)
  + Added / fixed support for static routes on OpenBSD and FreeBSD (#2157)
    [Kadir Mueller]
  + cc_rsyslog: Refactor for better multi-platform support (#4119)
    [Mina Galić] (LP: #1798055)
  + tests: fix test_lp1835584 (#4154)
  + cloud.cfg mod names: docs and rename salt_minion and set_password (#4153)
  + tests: apt support for deb822 format .sources files on mantic
  + vultr: remove check_route check (#2151) [Jonas Chevalier]
  + Update SECURITY.md (#4150) [Indrranil Pawar]
  + Update CONTRIBUTING.rst (#4149) [Indrranil Pawar]
  + Update .github-cla-signers (#4151) [Indrranil Pawar]
  + Standardise module names in cloud.cfg.tmpl to only use underscore
    (#4128) [dermotbradley]
  + tests: update test_webhook_reporting
  + Modify PR template so autoclose works
  + doc: add missing semi-colon to nocloud cmdline docs (#4120)
  + .gitignore: extend coverage pattern (#4143) [Mina Galić]
  From 23.2.2
  + Fix NoCloud kernel commandline key parsing (#4273) (Fixes: #4271)
    (LP: #2028562)
  + Fix reference before assignment (#4292) (Fixes: #4288) (LP: #2028784)
  From 23.2.1
  + nocloud: Fix parse_cmdline detection of nocloud-net datasource (#4204)
    (Fixes: 4203) (LP: #2025180)
  From 23.2
  + BSD: simplify finding MBR partitions by removing duplicate code
  [Mina Galić]
  + tests: bump pycloudlib version for mantic builds
  + network-manager: Set higher autoconnect priority for nm keyfiles (#3671)
    [Ani Sinha]
  + alpine.py: change the locale file used (#4139) [dermotbradley]
  + cc_ntp: Sync up with current FreeBSD ntp.conf (#4122) [Mina Galić]
  + config: drop refresh_rmc_and_interface as RHEL 7 no longer supported
    [Robert Schweikert]
  + docs: Add feedback button to docs
  + net/sysconfig: enable sysconfig renderer if network manager has ifcfg-rh
    plugin (#4132) [Ani Sinha]
  + For Alpine use os-release PRETTY_NAME (#4138) [dermotbradley]
  + network_manager: add a method for ipv6 static IP configuration (#4127)
    [Ani Sinha]
  + correct misnamed template file host.mariner.tmpl (#4124) [dermotbradley]
  + nm: generate ipv6 stateful dhcp config at par with sysconfig (#4115)
    [Ani Sinha]
  + Add templates for GitHub Issues
  + Add 'peers' and 'allow' directives in cc_ntp (#3124) [Jacob Salmela]
  + FreeBSD: Fix user account locking (#4114) [Mina Galić] (GH: #1854594)
  + FreeBSD: add ResizeGrowFS class to cc_growpart (#2334) [Mina Galić]
  + Update tests in Azure TestCanDevBeReformatted class (#2771)
    [Ksenija Stanojevic]
  + Replace Launchpad references with GitHub Issues
  + Fix KeyError in iproute pformat (#3287) [Dmitry Zykov]
  + schema: read_cfg_paths call init.fetch to lookup /v/l/c/instance
  + azure/errors: introduce reportable errors for imds (#3647)
    [Chris Patterson]
  + FreeBSD (and friends): better identify MBR slices (#2168)
    [Mina Galić] (LP: #2016350)
  + azure/errors: add host reporting for dhcp errors (#2167)
    [Chris Patterson]
  + net: purge blacklist_drivers across net and azure (#2160)
    [Chris Patterson]
  + net: refactor hyper-v VF filtering and apply to get_interfaces() (#2153)
    [Chris Patterson]
  + tests: avoid leaks to underlying filesystem for /etc/cloud/clean.d
    (#2251)
  + net: refactor find_candidate_nics_on_linux() to use get_interfaces()
    (#2159) [Chris Patterson]
  + resolv_conf: Allow &gt; 3 nameservers (#2152) [Major Hayden]
  + Remove mount NTFS error message (#2134) [Ksenija Stanojevic]
  + integration tests: fix image specification parsing (#2166)
  + ci: add hypothesis scheduled GH check (#2149)
  + Move supported distros list to docs (#2162)
  + Fix logger, use instance rather than module function (#2163)
  + README: Point to Github Actions build status (#2158)
  + Revert "fix linux-specific code on bsd (#2143)" (#2161)
  + Do not generate dsa and ed25519 key types when crypto FIPS mode is
    enabled (#2142) [Ani Sinha] (LP: 2017761)
  + Add documentation label automatically (#2156)
  + sources/azure: report success to host and introduce kvp module (#2141)
    [Chris Patterson]
  + setup.py: use pkg-config for udev/rules path (#2137) [dankm]
  + openstack/static: honor the DNS servers associated with a network
    (#2138) [Gonéri Le Bouder]
  + fix linux-specific code on bsd (#2143)
  + cli: schema validation of jinja template user-data (SC-1385) (#2132)
    (LP: #1881925)
  + gce: activate network discovery on every boot (#2128)
  + tests: update integration test to assert 640 across reboots (#2145)
  + Make user/vendor data sensitive and remove log permissions (#2144)
    (LP: #2013967)
  + Update kernel command line docs (SC-1457) (#2133)
  + docs: update network configuration path links (#2140) [d1r3ct0r]
  + sources/azure: report failures to host via kvp (#2136) [Chris Patterson]
  + net: Document use of `ip route append` to add routes (#2130)
  + dhcp: Add missing mocks (#2135)
  + azure/imds: retry fetching metadata up to 300 seconds (#2121)
    [Chris Patterson]
  + [1/2] DHCP: Refactor dhcp client code  (#2122)
  + azure/errors: treat traceback_base64 as string (#2131) [Chris Patterson]
  + azure/errors: introduce reportable errors (#2129) [Chris Patterson]
  + users: schema permit empty list to indicate create no users
  + azure: introduce identity module (#2116) [Chris Patterson]
  + Standardize disabling cloud-init on non-systemd (#2112)
  + Update .github-cla-signers (#2126) [Rob Tongue]
  + NoCloud: Use seedfrom protocol to determine mode (#2107)
  + rhel: Remove sysvinit files. (#2114)
  + tox.ini: set -vvvv --showlocals for pytest (#2104) [Chris Patterson]
  + Fix NoCloud kernel commandline semi-colon args
  + run-container: make the container/VM timeout configurable (#2118)
    [Paride Legovini]
  + suse: Remove sysvinit files. (#2115)
  + test: Backport assert_call_count for old requests (#2119)
  + Add "licebmi" as contributor (#2113) [Mark Martinez]
  + Adapt DataSourceScaleway to upcoming IPv6 support (#2033)
    [Louis Bouchard]
  + rhel: make sure previous-hostname file ends with a new line (#2108)
    [Ani Sinha]
  + Adding contributors for DataSourceAkamai (#2110) [acourdavAkamai]
  + Cleanup ephemeral IP routes on exception (#2100) [sxt1001]
  + commit 09a64badfb3f51b1b391fa29be19962381a4bbeb [sxt1001] (LP: #2011291)
  + Standardize kernel commandline user interface (#2093)
  + config/cc_resizefs: fix do_resize arguments (#2106) [Chris Patterson]
  + Fix test_dhclient_exits_with_error (#2105)
  + net/dhcp: catch dhclient failures and raise NoDHCPLeaseError (#2083)
    [Chris Patterson]
  + sources/azure: move pps handling out of _poll_imds() (#2075)
    [Chris Patterson]
  + tests: bump pycloudlib version (#2102)
  + schema: do not manipulate draft4 metaschema for jsonschema 2.6.0 (#2098)
  + sources/azure/imds: don't count timeout errors as connection errors
    (#2074) [Chris Patterson]
  + Fix Python 3.12 unit test failures (#2099)
  + integration tests: Refactor instance checking (#1989)
  + ci: migrate remaining jobs from travis to gh (#2085)
  + missing ending quote in instancedata docs(#2094) [Hong L]
  + refactor: stop passing log instances to cc_* handlers (#2016) [d1r3ct0r]
  + tests/vmware: fix test_no_data_access_method failure (#2092)
    [Chris Patterson]
  + Don't change permissions of netrules target (#2076) (LP: #2011783)
  + tests/sources: patch util.get_cmdline() for datasource tests (#2091)
    [Chris Patterson]
  + macs: ignore duplicate MAC for devs with driver driver qmi_wwan (#2090)
    (LP: #2008888)
  + Fedora: Enable CA handling (#2086) [František Zatloukal]
  + Send dhcp-client-identifier for InfiniBand ports (#2043) [Waleed Mousa]
  + cc_ansible: complete the examples and doc (#2082) [Yves]
  + bddeb: for dev package, derive debhelper-compat from host system
  + apport: only prompt for cloud_name when instance-data.json is absent
  + datasource: Optimize datasource detection, fix bugs (#2060)
  + Handle non existent ca-cert-config situation (#2073) [Shreenidhi Shedi]
  + sources/azure: add networking check for all source PPS (#2061)
    [Chris Patterson]
  + do not attempt dns resolution on ip addresses (#2040)
  + chore: fix style tip (#2071)
  + Fix metadata IP in instancedata.rst (#2063) [Brian Haley]
  + util: Pass deprecation schedule in deprecate_call() (#2064)
  + config: Update grub-dpkg docs (#2058)
  + docs: Cosmetic improvements and styling (#2057) [s-makin]
  + cc_grub_dpkg: Added UEFI support (#2029) [Alexander Birkner]
  + tests: Write to /var/spool/rsyslog to adhere to apparmor profile (#2059)
  + oracle-ds: prefer system_cfg over ds network config source (#1998)
    (LP: #1956788)
  + Remove dead code (#2038)
  + source: Force OpenStack when it is only option (#2045) (LP: #2008727)
  + cc_ubuntu_advantage: improve UA logs discovery
  + sources/azure: fix regressions in IMDS behavior (#2041) [Chris Patterson]
  + tests: fix test_schema (#2042)
  + dhcp: Cleanup unused kwarg (#2037)
  + sources/vmware/imc: fix-missing-catch-few-negtive-scenarios (#2027)
    [PengpengSun]
  + dhclient_hook: remove vestigal dhclient_hook command (#2015)
  + log: Add standardized deprecation tooling (SC-1312) (#2026)
  + Enable SUSE based distros for ca handling (#2036) [Robert Schweikert]
  From 23.1.2
  + Make user/vendor data sensitive and remove log permissions
    (LP: #2013967) (CVE-2023-1786)
  From 23.1.1
  + source: Force OpenStack when it is only option (#2045)
  + sources/azure: fix regressions in IMDS behavior (#2041)
    [Chris Patterson]</changelog>
  <changelog author="michal.vyskocil@gmail.com" date="1701432000">- Move fdupes call back to %install (boo#1214169)</changelog>
  <changelog author="rjschwei@suse.com" date="1702641600">- Switch build dependency to the generic distribution-release package</changelog>
  <changelog author="rjschwei@suse.com" date="1705665600">- Add cloud-init-pckg-reboot.patch (boo#1198533, bsc#1218952,  jsc#SMO-326)
  + Support reboot on package update/upgrade via the cloud-init config</changelog>
  <changelog author="rjschwei@suse.com" date="1705752000">- Add cloud-init-skip-empty-conf.patch
  + Skip tests with empty config</changelog>
  <changelog author="rjschwei@suse.com" date="1708430400">- Prepare for RPM 4.20 switch patch syntax</changelog>
  <changelog author="fcrozat@suse.com" date="1709726400">- Hardcode distribution to suse for proper cloud.cfg generation
  (bsc#1220132).</changelog>
  <changelog author="rjschwei@suse.com" date="1711627200">- Add  cloud-init-ds-deterministic.patch (bsc#1221132)
  + Do not guess a data source when checking for a CloudStack
    environment</changelog>
  <changelog author="rjschwei@suse.com" date="1712318400">- Add cloud-init-no-openstack-guess.patch (bsc#1222113)
  + Do not guess if we are running on OpenStack or not. Only recognize
    the known markers and enable cloud-init if we know for sure.</changelog>
  <changelog author="rjschwei@suse.com" date="1712318401">- Add cloud-init-no-nmcfg-needed.patch (bsc#1221726)
  + Do not require a NetworkManager config file in order to detect
    NetworkManager as the renderer</changelog>
  <changelog author="rjschwei@suse.com" date="1712664000">- Update cloud-init-no-openstack-guess.patch
  + Do not enable cloud-init on systems where there is no DMI just
    because no data source has been found. No data source means
    cloud-init will not run.</changelog>
  <changelog author="rjschwei@suse.com" date="1714392000">- Add cloud-init-usr-sudoers.patch (bsc#1223469)
  + Handle the existence of /usr/etc/sudoers to search for the expected
    include location</changelog>
  <changelog author="rjschwei@suse.com" date="1717416000">- Add cloud-init-skip-rename.patch (bsc#1219680)
  + Brute force appraoch to skip renames if the device is already present</changelog>
</package>
<package pkgid="7e467efb60d9f208191636e110da38d1827d97fe5ee29e4faf4515a34cb3d366" name="cloud-init-config-suse" arch="x86_64">
  <version epoch="0" ver="23.3" rel="150100.8.82.3"/>
  <changelog author="rjschwei@suse.com" date="1675425600">- Add cloud-init-transact-up.patch to support transactional-updates</changelog>
  <changelog author="rjschwei@suse.com" date="1677153600">- Update to version 23.1
  + Remove patches included upstream:
  - cloud-init-btrfs-queue-resize.patch
  - cloud-init-micro-is-suse.patch
  - cloud-init-suse-afternm.patch
  - cloud-init-prefer-nm.patch
  - cloud-init-transact-up.patch
  + Forward port
  - cloud-init-write-routes.patch
  + Added
  - cloud-init-fix-ca-test.patch
  + Support transactional-updates for SUSE based distros (#1997)
    [Robert Schweikert]
  + Set ownership for new folders in Write Files Module (#1980)
    [Jack] (LP: #1990513)
  + add OpenCloudOS and TencentOS support (#1964) [wynnfeng]
  + lxd: Retry if the server isn't ready (#2025)
  + test: switch pycloudlib source to pypi (#2024)
  + test: Fix integration test deprecation message (#2023)
  + Recognize opensuse-microos, dev tooling fixes [Robert Schweikert]
  + sources/azure: refactor imds handler into own module (#1977)
    [Chris Patterson]
  + docs: deprecation generation support [1/2] (#2013)
  + add function is_virtual to distro/FreeBSD (#1957) [Mina Galić]
  + cc_ssh: support multiple hostcertificates (#2018) (LP: #1999164)
  + Fix minor schema validation regression and fixup typing (#2017)
  + doc: Reword user data debug section (#2019)
  + Overhaul/rewrite of certificate handling as follows: (#1962)
    [dermotbradley] (LP: #1931174)
  + disk_setup: use byte string when purging the partition table (#2012)
    [Stefan Prietl]
  + cli: schema also validate vendordata*.
  + ci: sort and add checks for cla signers file [Stefan Prietl]
  + Add "ederst" as contributor (#2010) [Stefan Prietl]
  + readme: add reference to packages dir (#2001)
  + docs: update downstream package list (#2002)
  + docs: add google search verification (#2000) [s-makin]
  + docs: fix 404 render use default notfound_urls_prefix in RTD conf (#2004)
  + Fix OpenStack datasource detection on bare metal (#1923)
    [Alexander Birkner] (LP: #1815990)
  + docs: add themed RTD 404 page and pointer to readthedocs-hosted (#1993)
  + schema: fix gpt labels, use type string for GUID (#1995)
  + cc_disk_setup: code cleanup (#1996)
  + netplan: keep custom strict perms when 50-cloud-init.yaml exists
  + cloud-id: better handling of change in datasource files
    [d1r3ct0r] (LP: #1998998)
  + tests: Remove restart check from test
  + Ignore duplicate macs from mscc_felix and fsl_enetc (LP: #1997922)
  + Warn on empty network key (#1990)
  + Fix Vultr cloud_interfaces usage (#1986) [eb3095]
  + cc_puppet: Update puppet service name (#1970) [d1r3ct0r] (LP: #2002969)
  + docs: Clarify networking docs (#1987)
  + lint: remove httpretty (#1985) [sxt1001]
  + cc_set_passwords: Prevent traceback when restarting ssh (#1981)
  + tests: fix lp1912844 (#1978)
  + tests: Skip ansible test on bionic (#1984)
  + Wait for NetworkManager (#1983) [Robert Schweikert]
  + docs: minor polishing (#1979) [s-makin]
  + CI: migrate integration-test to GH actions (#1969)
  + Fix permission of SSH host keys (#1971) [Ron Gebauer]
  + Fix default route rendering on v2 ipv6 (#1973) (LP: #2003562)
  + doc: fix path in net_convert command (#1975)
  + docs: update net_convert docs (#1974)
  + doc: fix dead link
  + cc_set_hostname: ignore /var/lib/cloud/data/set-hostname if it's empty
    (#1967) [Emanuele Giuseppe Esposito]
  + distros/rhel.py: _read_hostname() missing strip on "hostname" (#1941)
    [Mark Mielke]
  + integration tests: add  IBM VPC support (SC-1352) (#1915)
  + machine-id: set to uninitialized to trigger regeneration on clones
    (LP: #1999680)
  + sources/azure: retry on connection error when fetching metdata (#1968)
    [Chris Patterson]
  + Ensure ssh state accurately obtained (#1966)
  + bddeb: drop dh-systemd dependency on newer deb-based releases [d1r3ct0r]
  + doc: fix `config formats` link in cloudsigma.rst (#1960)
  + Fix wrong subp syntax in cc_set_passwords.py (#1961)
  + docs: update the PR template link to readthedocs (#1958) [d1r3ct0r]
  + ci: switch unittests to gh actions (#1956)
  + Add mount_default_fields for PhotonOS. (#1952) [Shreenidhi Shedi]
  + sources/azure: minor refactor for metadata source detection logic
    (#1936) [Chris Patterson]
  + add "CalvoM" as contributor (#1955) [d1r3ct0r]
  + ci: doc to gh actions (#1951)
  + lxd: handle 404 from missing devices route for LXD 4.0 (LP: #2001737)
  + docs: Diataxis overhaul (#1933) [s-makin]
  + vultr: Fix issue regarding cache and region codes (#1938) [eb3095]
  + cc_set_passwords: Move ssh status checking later (SC-1368) (#1909)
    (LP: #1998526)
  + Improve Wireguard module idempotency (#1940) [Fabian Lichtenegger-Lukas]
  + network/netplan: add gateways as on-link when necessary (#1931)
    [Louis Sautier] (LP: #2000596)
  + tests: test_lxd assert features.networks.zones when present (#1939)
  + Use btrfs enquque when available (#1926) [Robert Schweikert]
  + sources/azure: drop description for report_failure_to_fabric() (#1934)
    [Chris Patterson]
  + cc_disk_setup.py: fix MBR single partition creation (#1932)
    [dermotbradley] (LP: #1851438)
  + Fix typo with package_update/package_upgrade (#1927) [eb3095]
  + sources/azure: fix device driver matching for net config (#1914)
    [Chris Patterson]
  + BSD: fix duplicate macs in Ifconfig parser (#1917) [Mina Galić]
  + test: mock dns calls (#1922)
  + pycloudlib: add lunar support for integration tests (#1928)
  + nocloud: add support for dmi variable expansion for seedfrom URL
    (LP: #1994980)
  + tools: read-version drop extra call to git describe --long
  + doc: improve cc_write_files doc (#1916)
  + read-version: When insufficient tags, use cloudinit.version.get_version
  + mounts: document weird prefix in schema (#1913)
  + add utility function test cases (#1910) [sxt1001]
  + test: mock file deletion in dhcp tests (#1911)
  + Ensure network ready before cloud-init service runs on RHEL (#1893)
    (LP: #1998655)
  + docs: add copy button to code blocks (#1890) [s-makin]
  + netplan: define features.NETPLAN_CONFIG_ROOT_READ_ONLY flag
  + azure: fix support for systems without az command installed (#1908)
  + Networking Clarification (#1892)
  + Fix the distro.osfamily output problem in the openEuler system. (#1895)
    [sxt1001] (LP: #1999042)
  + pycloudlib: bump commit dropping azure api smoke test
  + net: netplan config root read-only as wifi config can contain creds
  + autoinstall: clarify docs for users
  + sources/azure: encode health report as utf-8 (#1897) [Chris Patterson]
  + Add back gateway4/6 deprecation to docs (#1898)
  + networkd: Add support for multiple [Route] sections (#1868)
    [Nigel Kukard]
  + doc: add qemu tutorial (#1863)
  + lint: fix tip-flake8 and tip-mypy (#1896)
  + Add support for setting uid when creating users on FreeBSD (#1888)
    [einsibjarni]
  + Fix exception in BSD networking code-path (#1894) [Mina Galić]
  + Append derivatives to is_rhel list in cloud.cfg.tmpl (#1887) [Louis Abel]
  + FreeBSD init: use cloudinit_enable as only rcvar (#1875) [Mina Galić]
  + feat: add support aliyun metadata security harden mode (#1865)
    [Manasseh Zhou]
  + docs: uprate analyze to performance page [s-makin]
  + test: fix lxd preseed managed network config (#1881)
  + Add support for static IPv6 addresses for FreeBSD (#1839) [einsibjarni]
  + Make 3.12 failures not fail the build (#1873)
  + Docs: adding relative links [s-makin]
  + Update read-version
  + Fix setup.py to align with PEP 440 versioning replacing trailing
  + travis: promote 3.11-dev to 3.11 (#1866)
  + test_cloud_sigma: delete useless test (#1828) [sxt1001]
  + Add "nkukard" as contributor (#1864) [Nigel Kukard]
  + tests: ds-id mocks for vmware-rpctool as utility may not exist in env
  + doc: add how to render new module doc (#1855)
  + doc: improve module creation explanation (#1851)
  + Add Support for IPv6 metadata to OpenStack (#1805)
    [Marvin Vogt] (LP: #1906849)
  + add xiaoge1001 to .github-cla-signers (#1854) [sxt1001]
  + network: Deprecate gateway{4,6} keys in network config v2 (#1794)
    (LP: #1992512)
  + VMware: Move Guest Customization transport from OVF to VMware (#1573)
    [PengpengSun]
  + doc: home page links added (#1852) [s-makin]
  From 22.4.2
  + status: handle ds not defined in status.json (#1876) (LP: #1997559)
  From 22.4.1
  + net: skip duplicate mac check for netvsc nic and its VF (#1853)
    [Anh Vo] (LP: #1844191)
  + ChangeLog: whitespace cleanup (#1850)
  + changelog: capture 22.3.1-4 releases</changelog>
  <changelog author="rjschwei@suse.com" date="1681214400">- Sensitive data exposure (bsc#1210277, CVE-2023-1786)
  + Add hidesensitivedata
  + Add cloud-init-cve-2023-1786-redact-inst-data.patch
  + Do not expose sensitive data gathered from the CSP</changelog>
  <changelog author="rjschwei@suse.com" date="1682596800">- Add cloud-init-power-rhel-only.patch (bsc#1210273)
  + Config module cc_refresh_rmc_and_interface is implemented such that
    it will only work on RH distros. Set the module availability accordingly.</changelog>
  <changelog author="rjschwei@suse.com" date="1688644800">- Update cloud-init-write-routes.patch (bsc#1212879)
  + Add necessary import statement
- Enable flake8 linting, fix up patches
  + cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  + cloud-init-power-rhel-only.patch
  + cloud-init-write-routes.patch
  + datasourceLocalDisk.patch</changelog>
  <changelog author="dmueller@suse.com" date="1691928000">- update to 23.1.2:
  * Make user/vendor data sensitive and remove log permissions
  * source: Force OpenStack when it is only option (#2045)
  * sources/azure: fix regressions in IMDS behavior
- drop
  cloud-init-cve-2023-1786-redact-instance-data-json-main.patch (upstream)
- spec-file cleanups, including dropping flake8 (as build fails
  with newer flake8 versions)</changelog>
  <changelog author="rjschwei@suse.com" date="1692014400">- Add cloud-init-flake8-fixes.patch
- Revert chnages from previous commit
  + Disabling checks the primary maintainer enabled for specific reasons
    is not a fix.</changelog>
  <changelog author="rjschwei@suse.com" date="1696852800">- Update to version 23.3 (bsc#1216011, bsc#1215794, bsc#1215740)
  + Remove patches included upstream:
  - cloud-init-fix-ca-test.patch
  - cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  - cloud-init-power-rhel-only.patch
  - cloud-init-flake8-fixes.patch
  + Add
  - cloud-init-keep-flake.patch
  - cloud-init-lint-fixes.patch
  + Update
  - cloud-init-write-routes.patch (bsc#1216007)
  + Bump pycloudlib to 1!5.1.0 for ec2 mantic daily image support (#4390)
  + Fix cc_keyboard in mantic (LP: #2030788)
  + ec2: initialize get_instance_userdata return value to bytes (#4387)
    [Noah Meyerhans]
  + cc_users_groups: Add doas/opendoas support (#4363) [dermotbradley]
  + Fix pip-managed ansible
  + status: treat SubState=running and MainPID=0 as service exited
  + azure/imds: increase read-timeout to 30s (#4372) [Chris Patterson]
  + collect-logs fix memory usage (SC-1590) (#4289)
    [Alec Warren] (LP: #1980150)
  + cc_mounts: Use fallocate to create swapfile on btrfs (#4369) [王煎饼]
  + Undocument nocloud-net (#4318)
  + feat(akamai): add akamai to settings.py and apport.py (#4370)
  + read-version: fallback to get_version when git describe fails (#4366)
  + apt: fix cloud-init status --wait blocking on systemd v 253 (#4364)
  + integration tests: Pass username to pycloudlib (#4324)
  + Bump pycloudlib to 1!5.1.0 (#4353)
  + cloud.cfg.tmpl: reorganise, minimise/reduce duplication (#4272)
    [dermotbradley]
  + analyze: fix (unexpected) timestamp parsing (#4347) [Mina Galić]
  + cc_growpart: fix tests to run on FreeBSD (#4351) [Mina Galić]
  + subp: Fix spurious test failure on FreeBSD (#4355) [Mina Galić]
  + cmd/clean: fix tests on non-Linux platforms (#4352) [Mina Galić]
  + util: Fix get_proc_ppid() on non-Linux systems (#4348) [Mina Galić]
  + cc_wireguard: make tests pass on FreeBSD (#4346) [Mina Galić]
  + unittests: fix breakage in test_read_cfg_paths_fetches_cached_datasource
    (#4328) [Ani Sinha]
  + Fix test_tools.py collection (#4315)
  + cc_keyboard: add Alpine support (#4278) [dermotbradley]
  + Flake8 fixes (#4340) [Robert Schweikert]
  + cc_mounts: Fix swapfile not working on btrfs (#4319) [王煎饼] (LP: #1884127)
  + ds-identify/CloudStack: $DS_MAYBE if vm running on vmware/xen (#4281)
    [Wei Zhou]
  + ec2: Support double encoded userdata (#4276) [Noah Meyerhans]
  + cc_mounts: xfs is a Linux only FS (#4334) [Mina Galić]
  + tests/net: fix TestGetInterfaces' mock coverage for get_master (#4336)
    [Chris Patterson]
  + change openEuler to openeuler and fix some bugs in openEuler (#4317)
    [sxt1001]
  + Replace flake8 with ruff (#4314)
  + NM renderer: set default IPv6 addr-gen-mode for all interfaces to eui64
    (#4291) [Ani Sinha]
  + cc_ssh_import_id: add Alpine support and add doas support (#4277)
    [dermotbradley]
  + sudoers not idempotent (SC-1589)  (#4296) [Alec Warren] (LP: #1998539)
  + Added support for Akamai Connected Cloud (formerly Linode) (#4167)
    [Will Smith]
  + Fix reference before assignment (#4292)
  + Overhaul module reference page (#4237) [Sally]
  + replaced spaces with commas for setting passenv (#4269) [Alec Warren]
  + DS VMware: modify a few log level (#4284) [PengpengSun]
  + tools/read-version refactors and unit tests (#4268)
  + Ensure get_features() grabs all features (#4285)
  + Don't always require passlib dependency (#4274)
  + tests: avoid leaks into host system checking of ovs-vsctl cmd (#4275)
  + Fix NoCloud kernel commandline key parsing (#4273)
  + testing: Clear all LRU caches after each test (#4249)
  + Remove the crypt dependency (#2139) [Gonéri Le Bouder]
  + logging: keep current file mode of log file if its stricter than the
    new mode (#4250) [Ani Sinha]
  + Remove default membership in redundant groups (#4258)
    [Dave Jones] (LP: #1923363)
  + doc: improve datasource_creation.rst (#4262)
  + Remove duplicate Integration testing button (#4261) [Rishita Shaw]
  + tools/read-version: fix the tool so that it can handle version parsing
    errors (#4234) [Ani Sinha]
  + net/dhcp: add udhcpc support (#4190) [Jean-François Roche]
  + DS VMware: add i386 arch dir to deployPkg plugin search path
    [PengpengSun]
  + LXD moved from linuxcontainers.org to Canonical [Simon Deziel]
  + cc_mounts.py: Add note about issue with creating mounts inside mounts
    (#4232) [dermotbradley]
  + lxd: install lxd from snap, not deb if absent in image
  + landscape: use landscape-config to write configuration
  + Add deprecation log during init of DataSourceDigitalOcean (#4194)
    [tyb-truth]
  + doc: fix typo on apt.primary.arches (#4238) [Dan Bungert]
  + Inspect systemd state for cloud-init status (#4230)
  + instance-data: add system-info and features to combined-cloud-config
    (#4224)
  + systemd: Block login until config stage completes (#2111) (LP: #2013403)
  + tests: proposed should invoke apt-get install -t=&lt;release&gt;-proposed
    (#4235)
  + cloud.cfg.tmpl: reinstate ca_certs entry (#4236) [dermotbradley]
  + Remove feature flag override ability (#4228)
  + tests: drop stray unrelated file presence test (#4227)
  + Update LXD URL (#4223) [Sally]
  + schema: add network v1 schema definition and validation functions
  + tests: daily PPA for devel series is version 99.daily update tests to
    match (#4225)
  + instance-data: write /run/cloud-init/combined-cloud-config.json
  + mount parse: Fix matching non-existent directories (#4222) [Mina Galić]
  + Specify build-system for pep517 (#4218)
  + Fix network v2 metric rendering (#4220)
  + Migrate content out of FAQ page (SD-1187) (#4205) [Sally]
  + setup: fix generation of init templates (#4209) [Mina Galić]
  + docs: Correct some bootcmd example wording
  + fix changelog
  + tests: reboot client to assert x-shellscript-per-boot is triggered
  + nocloud: parse_cmdline no longer detects nocloud-net datasource (#4204)
    (LP: 4203, #2025180)
  + Add docstring and typing to mergemanydict (#4200)
  + BSD: add dsidentify to early startup scripts (#4182) [Mina Galić]
  + handler: report errors on skipped merged cloud-config.txt parts
    (LP: #1999952)
  + Add cloud-init summit writeups (#4179) [Sally]
  + tests: Update test_clean_log for oci (#4187)
  + gce: improve ephemeral fallback NIC selection (CPC-2578) (#4163)
  + tests: pin pytest 7.3.1 to avoid adverse testpaths behavior (#4184)
  + Ephemeral Networking for FreeBSD (#2165) [Mina Galić]
  + Clarify directory syntax for nocloud local filesystem. (#4178)
  + Set default renderer as sysconfig for centos/rhel (#4165) [Ani Sinha]
  + Test static routes and netplan 0.106
  + FreeBSD fix parsing of mount and mount options (#2146) [Mina Galić]
  + test: add tracking bug id (#4164)
  + tests: can't match MAC for LXD container veth due to netplan 0.106
    (#4162)
  + Add kaiwalyakoparkar as a contributor (#4156) [Kaiwalya Koparkar]
  + BSD: remove datasource_list from cloud.cfg template (#4159) [Mina Galić]
  + launching salt-minion in masterless mode (#4110) [Denis Halturin]
  + tools: fix run-container builds for rockylinux/8 git hash mismatch
    (#4161)
  + fix doc lint: spellchecker tripped up (#4160) [Mina Galić]
  + Support Ephemeral Networking for BSD (#2127)
  + Added / fixed support for static routes on OpenBSD and FreeBSD (#2157)
    [Kadir Mueller]
  + cc_rsyslog: Refactor for better multi-platform support (#4119)
    [Mina Galić] (LP: #1798055)
  + tests: fix test_lp1835584 (#4154)
  + cloud.cfg mod names: docs and rename salt_minion and set_password (#4153)
  + tests: apt support for deb822 format .sources files on mantic
  + vultr: remove check_route check (#2151) [Jonas Chevalier]
  + Update SECURITY.md (#4150) [Indrranil Pawar]
  + Update CONTRIBUTING.rst (#4149) [Indrranil Pawar]
  + Update .github-cla-signers (#4151) [Indrranil Pawar]
  + Standardise module names in cloud.cfg.tmpl to only use underscore
    (#4128) [dermotbradley]
  + tests: update test_webhook_reporting
  + Modify PR template so autoclose works
  + doc: add missing semi-colon to nocloud cmdline docs (#4120)
  + .gitignore: extend coverage pattern (#4143) [Mina Galić]
  From 23.2.2
  + Fix NoCloud kernel commandline key parsing (#4273) (Fixes: #4271)
    (LP: #2028562)
  + Fix reference before assignment (#4292) (Fixes: #4288) (LP: #2028784)
  From 23.2.1
  + nocloud: Fix parse_cmdline detection of nocloud-net datasource (#4204)
    (Fixes: 4203) (LP: #2025180)
  From 23.2
  + BSD: simplify finding MBR partitions by removing duplicate code
  [Mina Galić]
  + tests: bump pycloudlib version for mantic builds
  + network-manager: Set higher autoconnect priority for nm keyfiles (#3671)
    [Ani Sinha]
  + alpine.py: change the locale file used (#4139) [dermotbradley]
  + cc_ntp: Sync up with current FreeBSD ntp.conf (#4122) [Mina Galić]
  + config: drop refresh_rmc_and_interface as RHEL 7 no longer supported
    [Robert Schweikert]
  + docs: Add feedback button to docs
  + net/sysconfig: enable sysconfig renderer if network manager has ifcfg-rh
    plugin (#4132) [Ani Sinha]
  + For Alpine use os-release PRETTY_NAME (#4138) [dermotbradley]
  + network_manager: add a method for ipv6 static IP configuration (#4127)
    [Ani Sinha]
  + correct misnamed template file host.mariner.tmpl (#4124) [dermotbradley]
  + nm: generate ipv6 stateful dhcp config at par with sysconfig (#4115)
    [Ani Sinha]
  + Add templates for GitHub Issues
  + Add 'peers' and 'allow' directives in cc_ntp (#3124) [Jacob Salmela]
  + FreeBSD: Fix user account locking (#4114) [Mina Galić] (GH: #1854594)
  + FreeBSD: add ResizeGrowFS class to cc_growpart (#2334) [Mina Galić]
  + Update tests in Azure TestCanDevBeReformatted class (#2771)
    [Ksenija Stanojevic]
  + Replace Launchpad references with GitHub Issues
  + Fix KeyError in iproute pformat (#3287) [Dmitry Zykov]
  + schema: read_cfg_paths call init.fetch to lookup /v/l/c/instance
  + azure/errors: introduce reportable errors for imds (#3647)
    [Chris Patterson]
  + FreeBSD (and friends): better identify MBR slices (#2168)
    [Mina Galić] (LP: #2016350)
  + azure/errors: add host reporting for dhcp errors (#2167)
    [Chris Patterson]
  + net: purge blacklist_drivers across net and azure (#2160)
    [Chris Patterson]
  + net: refactor hyper-v VF filtering and apply to get_interfaces() (#2153)
    [Chris Patterson]
  + tests: avoid leaks to underlying filesystem for /etc/cloud/clean.d
    (#2251)
  + net: refactor find_candidate_nics_on_linux() to use get_interfaces()
    (#2159) [Chris Patterson]
  + resolv_conf: Allow &gt; 3 nameservers (#2152) [Major Hayden]
  + Remove mount NTFS error message (#2134) [Ksenija Stanojevic]
  + integration tests: fix image specification parsing (#2166)
  + ci: add hypothesis scheduled GH check (#2149)
  + Move supported distros list to docs (#2162)
  + Fix logger, use instance rather than module function (#2163)
  + README: Point to Github Actions build status (#2158)
  + Revert "fix linux-specific code on bsd (#2143)" (#2161)
  + Do not generate dsa and ed25519 key types when crypto FIPS mode is
    enabled (#2142) [Ani Sinha] (LP: 2017761)
  + Add documentation label automatically (#2156)
  + sources/azure: report success to host and introduce kvp module (#2141)
    [Chris Patterson]
  + setup.py: use pkg-config for udev/rules path (#2137) [dankm]
  + openstack/static: honor the DNS servers associated with a network
    (#2138) [Gonéri Le Bouder]
  + fix linux-specific code on bsd (#2143)
  + cli: schema validation of jinja template user-data (SC-1385) (#2132)
    (LP: #1881925)
  + gce: activate network discovery on every boot (#2128)
  + tests: update integration test to assert 640 across reboots (#2145)
  + Make user/vendor data sensitive and remove log permissions (#2144)
    (LP: #2013967)
  + Update kernel command line docs (SC-1457) (#2133)
  + docs: update network configuration path links (#2140) [d1r3ct0r]
  + sources/azure: report failures to host via kvp (#2136) [Chris Patterson]
  + net: Document use of `ip route append` to add routes (#2130)
  + dhcp: Add missing mocks (#2135)
  + azure/imds: retry fetching metadata up to 300 seconds (#2121)
    [Chris Patterson]
  + [1/2] DHCP: Refactor dhcp client code  (#2122)
  + azure/errors: treat traceback_base64 as string (#2131) [Chris Patterson]
  + azure/errors: introduce reportable errors (#2129) [Chris Patterson]
  + users: schema permit empty list to indicate create no users
  + azure: introduce identity module (#2116) [Chris Patterson]
  + Standardize disabling cloud-init on non-systemd (#2112)
  + Update .github-cla-signers (#2126) [Rob Tongue]
  + NoCloud: Use seedfrom protocol to determine mode (#2107)
  + rhel: Remove sysvinit files. (#2114)
  + tox.ini: set -vvvv --showlocals for pytest (#2104) [Chris Patterson]
  + Fix NoCloud kernel commandline semi-colon args
  + run-container: make the container/VM timeout configurable (#2118)
    [Paride Legovini]
  + suse: Remove sysvinit files. (#2115)
  + test: Backport assert_call_count for old requests (#2119)
  + Add "licebmi" as contributor (#2113) [Mark Martinez]
  + Adapt DataSourceScaleway to upcoming IPv6 support (#2033)
    [Louis Bouchard]
  + rhel: make sure previous-hostname file ends with a new line (#2108)
    [Ani Sinha]
  + Adding contributors for DataSourceAkamai (#2110) [acourdavAkamai]
  + Cleanup ephemeral IP routes on exception (#2100) [sxt1001]
  + commit 09a64badfb3f51b1b391fa29be19962381a4bbeb [sxt1001] (LP: #2011291)
  + Standardize kernel commandline user interface (#2093)
  + config/cc_resizefs: fix do_resize arguments (#2106) [Chris Patterson]
  + Fix test_dhclient_exits_with_error (#2105)
  + net/dhcp: catch dhclient failures and raise NoDHCPLeaseError (#2083)
    [Chris Patterson]
  + sources/azure: move pps handling out of _poll_imds() (#2075)
    [Chris Patterson]
  + tests: bump pycloudlib version (#2102)
  + schema: do not manipulate draft4 metaschema for jsonschema 2.6.0 (#2098)
  + sources/azure/imds: don't count timeout errors as connection errors
    (#2074) [Chris Patterson]
  + Fix Python 3.12 unit test failures (#2099)
  + integration tests: Refactor instance checking (#1989)
  + ci: migrate remaining jobs from travis to gh (#2085)
  + missing ending quote in instancedata docs(#2094) [Hong L]
  + refactor: stop passing log instances to cc_* handlers (#2016) [d1r3ct0r]
  + tests/vmware: fix test_no_data_access_method failure (#2092)
    [Chris Patterson]
  + Don't change permissions of netrules target (#2076) (LP: #2011783)
  + tests/sources: patch util.get_cmdline() for datasource tests (#2091)
    [Chris Patterson]
  + macs: ignore duplicate MAC for devs with driver driver qmi_wwan (#2090)
    (LP: #2008888)
  + Fedora: Enable CA handling (#2086) [František Zatloukal]
  + Send dhcp-client-identifier for InfiniBand ports (#2043) [Waleed Mousa]
  + cc_ansible: complete the examples and doc (#2082) [Yves]
  + bddeb: for dev package, derive debhelper-compat from host system
  + apport: only prompt for cloud_name when instance-data.json is absent
  + datasource: Optimize datasource detection, fix bugs (#2060)
  + Handle non existent ca-cert-config situation (#2073) [Shreenidhi Shedi]
  + sources/azure: add networking check for all source PPS (#2061)
    [Chris Patterson]
  + do not attempt dns resolution on ip addresses (#2040)
  + chore: fix style tip (#2071)
  + Fix metadata IP in instancedata.rst (#2063) [Brian Haley]
  + util: Pass deprecation schedule in deprecate_call() (#2064)
  + config: Update grub-dpkg docs (#2058)
  + docs: Cosmetic improvements and styling (#2057) [s-makin]
  + cc_grub_dpkg: Added UEFI support (#2029) [Alexander Birkner]
  + tests: Write to /var/spool/rsyslog to adhere to apparmor profile (#2059)
  + oracle-ds: prefer system_cfg over ds network config source (#1998)
    (LP: #1956788)
  + Remove dead code (#2038)
  + source: Force OpenStack when it is only option (#2045) (LP: #2008727)
  + cc_ubuntu_advantage: improve UA logs discovery
  + sources/azure: fix regressions in IMDS behavior (#2041) [Chris Patterson]
  + tests: fix test_schema (#2042)
  + dhcp: Cleanup unused kwarg (#2037)
  + sources/vmware/imc: fix-missing-catch-few-negtive-scenarios (#2027)
    [PengpengSun]
  + dhclient_hook: remove vestigal dhclient_hook command (#2015)
  + log: Add standardized deprecation tooling (SC-1312) (#2026)
  + Enable SUSE based distros for ca handling (#2036) [Robert Schweikert]
  From 23.1.2
  + Make user/vendor data sensitive and remove log permissions
    (LP: #2013967) (CVE-2023-1786)
  From 23.1.1
  + source: Force OpenStack when it is only option (#2045)
  + sources/azure: fix regressions in IMDS behavior (#2041)
    [Chris Patterson]</changelog>
  <changelog author="michal.vyskocil@gmail.com" date="1701432000">- Move fdupes call back to %install (boo#1214169)</changelog>
  <changelog author="rjschwei@suse.com" date="1702641600">- Switch build dependency to the generic distribution-release package</changelog>
  <changelog author="rjschwei@suse.com" date="1705665600">- Add cloud-init-pckg-reboot.patch (boo#1198533, bsc#1218952,  jsc#SMO-326)
  + Support reboot on package update/upgrade via the cloud-init config</changelog>
  <changelog author="rjschwei@suse.com" date="1705752000">- Add cloud-init-skip-empty-conf.patch
  + Skip tests with empty config</changelog>
  <changelog author="rjschwei@suse.com" date="1708430400">- Prepare for RPM 4.20 switch patch syntax</changelog>
  <changelog author="fcrozat@suse.com" date="1709726400">- Hardcode distribution to suse for proper cloud.cfg generation
  (bsc#1220132).</changelog>
  <changelog author="rjschwei@suse.com" date="1711627200">- Add  cloud-init-ds-deterministic.patch (bsc#1221132)
  + Do not guess a data source when checking for a CloudStack
    environment</changelog>
  <changelog author="rjschwei@suse.com" date="1712318400">- Add cloud-init-no-openstack-guess.patch (bsc#1222113)
  + Do not guess if we are running on OpenStack or not. Only recognize
    the known markers and enable cloud-init if we know for sure.</changelog>
  <changelog author="rjschwei@suse.com" date="1712318401">- Add cloud-init-no-nmcfg-needed.patch (bsc#1221726)
  + Do not require a NetworkManager config file in order to detect
    NetworkManager as the renderer</changelog>
  <changelog author="rjschwei@suse.com" date="1712664000">- Update cloud-init-no-openstack-guess.patch
  + Do not enable cloud-init on systems where there is no DMI just
    because no data source has been found. No data source means
    cloud-init will not run.</changelog>
  <changelog author="rjschwei@suse.com" date="1714392000">- Add cloud-init-usr-sudoers.patch (bsc#1223469)
  + Handle the existence of /usr/etc/sudoers to search for the expected
    include location</changelog>
  <changelog author="rjschwei@suse.com" date="1717416000">- Add cloud-init-skip-rename.patch (bsc#1219680)
  + Brute force appraoch to skip renames if the device is already present</changelog>
</package>
<package pkgid="a623f3427c8995aaa853ff8ac1ac774f5ea26f749b4fbf1190b3ccb05e782d94" name="cloud-init-doc" arch="aarch64">
  <version epoch="0" ver="23.3" rel="150100.8.82.3"/>
  <changelog author="rjschwei@suse.com" date="1675425600">- Add cloud-init-transact-up.patch to support transactional-updates</changelog>
  <changelog author="rjschwei@suse.com" date="1677153600">- Update to version 23.1
  + Remove patches included upstream:
  - cloud-init-btrfs-queue-resize.patch
  - cloud-init-micro-is-suse.patch
  - cloud-init-suse-afternm.patch
  - cloud-init-prefer-nm.patch
  - cloud-init-transact-up.patch
  + Forward port
  - cloud-init-write-routes.patch
  + Added
  - cloud-init-fix-ca-test.patch
  + Support transactional-updates for SUSE based distros (#1997)
    [Robert Schweikert]
  + Set ownership for new folders in Write Files Module (#1980)
    [Jack] (LP: #1990513)
  + add OpenCloudOS and TencentOS support (#1964) [wynnfeng]
  + lxd: Retry if the server isn't ready (#2025)
  + test: switch pycloudlib source to pypi (#2024)
  + test: Fix integration test deprecation message (#2023)
  + Recognize opensuse-microos, dev tooling fixes [Robert Schweikert]
  + sources/azure: refactor imds handler into own module (#1977)
    [Chris Patterson]
  + docs: deprecation generation support [1/2] (#2013)
  + add function is_virtual to distro/FreeBSD (#1957) [Mina Galić]
  + cc_ssh: support multiple hostcertificates (#2018) (LP: #1999164)
  + Fix minor schema validation regression and fixup typing (#2017)
  + doc: Reword user data debug section (#2019)
  + Overhaul/rewrite of certificate handling as follows: (#1962)
    [dermotbradley] (LP: #1931174)
  + disk_setup: use byte string when purging the partition table (#2012)
    [Stefan Prietl]
  + cli: schema also validate vendordata*.
  + ci: sort and add checks for cla signers file [Stefan Prietl]
  + Add "ederst" as contributor (#2010) [Stefan Prietl]
  + readme: add reference to packages dir (#2001)
  + docs: update downstream package list (#2002)
  + docs: add google search verification (#2000) [s-makin]
  + docs: fix 404 render use default notfound_urls_prefix in RTD conf (#2004)
  + Fix OpenStack datasource detection on bare metal (#1923)
    [Alexander Birkner] (LP: #1815990)
  + docs: add themed RTD 404 page and pointer to readthedocs-hosted (#1993)
  + schema: fix gpt labels, use type string for GUID (#1995)
  + cc_disk_setup: code cleanup (#1996)
  + netplan: keep custom strict perms when 50-cloud-init.yaml exists
  + cloud-id: better handling of change in datasource files
    [d1r3ct0r] (LP: #1998998)
  + tests: Remove restart check from test
  + Ignore duplicate macs from mscc_felix and fsl_enetc (LP: #1997922)
  + Warn on empty network key (#1990)
  + Fix Vultr cloud_interfaces usage (#1986) [eb3095]
  + cc_puppet: Update puppet service name (#1970) [d1r3ct0r] (LP: #2002969)
  + docs: Clarify networking docs (#1987)
  + lint: remove httpretty (#1985) [sxt1001]
  + cc_set_passwords: Prevent traceback when restarting ssh (#1981)
  + tests: fix lp1912844 (#1978)
  + tests: Skip ansible test on bionic (#1984)
  + Wait for NetworkManager (#1983) [Robert Schweikert]
  + docs: minor polishing (#1979) [s-makin]
  + CI: migrate integration-test to GH actions (#1969)
  + Fix permission of SSH host keys (#1971) [Ron Gebauer]
  + Fix default route rendering on v2 ipv6 (#1973) (LP: #2003562)
  + doc: fix path in net_convert command (#1975)
  + docs: update net_convert docs (#1974)
  + doc: fix dead link
  + cc_set_hostname: ignore /var/lib/cloud/data/set-hostname if it's empty
    (#1967) [Emanuele Giuseppe Esposito]
  + distros/rhel.py: _read_hostname() missing strip on "hostname" (#1941)
    [Mark Mielke]
  + integration tests: add  IBM VPC support (SC-1352) (#1915)
  + machine-id: set to uninitialized to trigger regeneration on clones
    (LP: #1999680)
  + sources/azure: retry on connection error when fetching metdata (#1968)
    [Chris Patterson]
  + Ensure ssh state accurately obtained (#1966)
  + bddeb: drop dh-systemd dependency on newer deb-based releases [d1r3ct0r]
  + doc: fix `config formats` link in cloudsigma.rst (#1960)
  + Fix wrong subp syntax in cc_set_passwords.py (#1961)
  + docs: update the PR template link to readthedocs (#1958) [d1r3ct0r]
  + ci: switch unittests to gh actions (#1956)
  + Add mount_default_fields for PhotonOS. (#1952) [Shreenidhi Shedi]
  + sources/azure: minor refactor for metadata source detection logic
    (#1936) [Chris Patterson]
  + add "CalvoM" as contributor (#1955) [d1r3ct0r]
  + ci: doc to gh actions (#1951)
  + lxd: handle 404 from missing devices route for LXD 4.0 (LP: #2001737)
  + docs: Diataxis overhaul (#1933) [s-makin]
  + vultr: Fix issue regarding cache and region codes (#1938) [eb3095]
  + cc_set_passwords: Move ssh status checking later (SC-1368) (#1909)
    (LP: #1998526)
  + Improve Wireguard module idempotency (#1940) [Fabian Lichtenegger-Lukas]
  + network/netplan: add gateways as on-link when necessary (#1931)
    [Louis Sautier] (LP: #2000596)
  + tests: test_lxd assert features.networks.zones when present (#1939)
  + Use btrfs enquque when available (#1926) [Robert Schweikert]
  + sources/azure: drop description for report_failure_to_fabric() (#1934)
    [Chris Patterson]
  + cc_disk_setup.py: fix MBR single partition creation (#1932)
    [dermotbradley] (LP: #1851438)
  + Fix typo with package_update/package_upgrade (#1927) [eb3095]
  + sources/azure: fix device driver matching for net config (#1914)
    [Chris Patterson]
  + BSD: fix duplicate macs in Ifconfig parser (#1917) [Mina Galić]
  + test: mock dns calls (#1922)
  + pycloudlib: add lunar support for integration tests (#1928)
  + nocloud: add support for dmi variable expansion for seedfrom URL
    (LP: #1994980)
  + tools: read-version drop extra call to git describe --long
  + doc: improve cc_write_files doc (#1916)
  + read-version: When insufficient tags, use cloudinit.version.get_version
  + mounts: document weird prefix in schema (#1913)
  + add utility function test cases (#1910) [sxt1001]
  + test: mock file deletion in dhcp tests (#1911)
  + Ensure network ready before cloud-init service runs on RHEL (#1893)
    (LP: #1998655)
  + docs: add copy button to code blocks (#1890) [s-makin]
  + netplan: define features.NETPLAN_CONFIG_ROOT_READ_ONLY flag
  + azure: fix support for systems without az command installed (#1908)
  + Networking Clarification (#1892)
  + Fix the distro.osfamily output problem in the openEuler system. (#1895)
    [sxt1001] (LP: #1999042)
  + pycloudlib: bump commit dropping azure api smoke test
  + net: netplan config root read-only as wifi config can contain creds
  + autoinstall: clarify docs for users
  + sources/azure: encode health report as utf-8 (#1897) [Chris Patterson]
  + Add back gateway4/6 deprecation to docs (#1898)
  + networkd: Add support for multiple [Route] sections (#1868)
    [Nigel Kukard]
  + doc: add qemu tutorial (#1863)
  + lint: fix tip-flake8 and tip-mypy (#1896)
  + Add support for setting uid when creating users on FreeBSD (#1888)
    [einsibjarni]
  + Fix exception in BSD networking code-path (#1894) [Mina Galić]
  + Append derivatives to is_rhel list in cloud.cfg.tmpl (#1887) [Louis Abel]
  + FreeBSD init: use cloudinit_enable as only rcvar (#1875) [Mina Galić]
  + feat: add support aliyun metadata security harden mode (#1865)
    [Manasseh Zhou]
  + docs: uprate analyze to performance page [s-makin]
  + test: fix lxd preseed managed network config (#1881)
  + Add support for static IPv6 addresses for FreeBSD (#1839) [einsibjarni]
  + Make 3.12 failures not fail the build (#1873)
  + Docs: adding relative links [s-makin]
  + Update read-version
  + Fix setup.py to align with PEP 440 versioning replacing trailing
  + travis: promote 3.11-dev to 3.11 (#1866)
  + test_cloud_sigma: delete useless test (#1828) [sxt1001]
  + Add "nkukard" as contributor (#1864) [Nigel Kukard]
  + tests: ds-id mocks for vmware-rpctool as utility may not exist in env
  + doc: add how to render new module doc (#1855)
  + doc: improve module creation explanation (#1851)
  + Add Support for IPv6 metadata to OpenStack (#1805)
    [Marvin Vogt] (LP: #1906849)
  + add xiaoge1001 to .github-cla-signers (#1854) [sxt1001]
  + network: Deprecate gateway{4,6} keys in network config v2 (#1794)
    (LP: #1992512)
  + VMware: Move Guest Customization transport from OVF to VMware (#1573)
    [PengpengSun]
  + doc: home page links added (#1852) [s-makin]
  From 22.4.2
  + status: handle ds not defined in status.json (#1876) (LP: #1997559)
  From 22.4.1
  + net: skip duplicate mac check for netvsc nic and its VF (#1853)
    [Anh Vo] (LP: #1844191)
  + ChangeLog: whitespace cleanup (#1850)
  + changelog: capture 22.3.1-4 releases</changelog>
  <changelog author="rjschwei@suse.com" date="1681214400">- Sensitive data exposure (bsc#1210277, CVE-2023-1786)
  + Add hidesensitivedata
  + Add cloud-init-cve-2023-1786-redact-inst-data.patch
  + Do not expose sensitive data gathered from the CSP</changelog>
  <changelog author="rjschwei@suse.com" date="1682596800">- Add cloud-init-power-rhel-only.patch (bsc#1210273)
  + Config module cc_refresh_rmc_and_interface is implemented such that
    it will only work on RH distros. Set the module availability accordingly.</changelog>
  <changelog author="rjschwei@suse.com" date="1688644800">- Update cloud-init-write-routes.patch (bsc#1212879)
  + Add necessary import statement
- Enable flake8 linting, fix up patches
  + cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  + cloud-init-power-rhel-only.patch
  + cloud-init-write-routes.patch
  + datasourceLocalDisk.patch</changelog>
  <changelog author="dmueller@suse.com" date="1691928000">- update to 23.1.2:
  * Make user/vendor data sensitive and remove log permissions
  * source: Force OpenStack when it is only option (#2045)
  * sources/azure: fix regressions in IMDS behavior
- drop
  cloud-init-cve-2023-1786-redact-instance-data-json-main.patch (upstream)
- spec-file cleanups, including dropping flake8 (as build fails
  with newer flake8 versions)</changelog>
  <changelog author="rjschwei@suse.com" date="1692014400">- Add cloud-init-flake8-fixes.patch
- Revert chnages from previous commit
  + Disabling checks the primary maintainer enabled for specific reasons
    is not a fix.</changelog>
  <changelog author="rjschwei@suse.com" date="1696852800">- Update to version 23.3 (bsc#1216011, bsc#1215794, bsc#1215740)
  + Remove patches included upstream:
  - cloud-init-fix-ca-test.patch
  - cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  - cloud-init-power-rhel-only.patch
  - cloud-init-flake8-fixes.patch
  + Add
  - cloud-init-keep-flake.patch
  - cloud-init-lint-fixes.patch
  + Update
  - cloud-init-write-routes.patch (bsc#1216007)
  + Bump pycloudlib to 1!5.1.0 for ec2 mantic daily image support (#4390)
  + Fix cc_keyboard in mantic (LP: #2030788)
  + ec2: initialize get_instance_userdata return value to bytes (#4387)
    [Noah Meyerhans]
  + cc_users_groups: Add doas/opendoas support (#4363) [dermotbradley]
  + Fix pip-managed ansible
  + status: treat SubState=running and MainPID=0 as service exited
  + azure/imds: increase read-timeout to 30s (#4372) [Chris Patterson]
  + collect-logs fix memory usage (SC-1590) (#4289)
    [Alec Warren] (LP: #1980150)
  + cc_mounts: Use fallocate to create swapfile on btrfs (#4369) [王煎饼]
  + Undocument nocloud-net (#4318)
  + feat(akamai): add akamai to settings.py and apport.py (#4370)
  + read-version: fallback to get_version when git describe fails (#4366)
  + apt: fix cloud-init status --wait blocking on systemd v 253 (#4364)
  + integration tests: Pass username to pycloudlib (#4324)
  + Bump pycloudlib to 1!5.1.0 (#4353)
  + cloud.cfg.tmpl: reorganise, minimise/reduce duplication (#4272)
    [dermotbradley]
  + analyze: fix (unexpected) timestamp parsing (#4347) [Mina Galić]
  + cc_growpart: fix tests to run on FreeBSD (#4351) [Mina Galić]
  + subp: Fix spurious test failure on FreeBSD (#4355) [Mina Galić]
  + cmd/clean: fix tests on non-Linux platforms (#4352) [Mina Galić]
  + util: Fix get_proc_ppid() on non-Linux systems (#4348) [Mina Galić]
  + cc_wireguard: make tests pass on FreeBSD (#4346) [Mina Galić]
  + unittests: fix breakage in test_read_cfg_paths_fetches_cached_datasource
    (#4328) [Ani Sinha]
  + Fix test_tools.py collection (#4315)
  + cc_keyboard: add Alpine support (#4278) [dermotbradley]
  + Flake8 fixes (#4340) [Robert Schweikert]
  + cc_mounts: Fix swapfile not working on btrfs (#4319) [王煎饼] (LP: #1884127)
  + ds-identify/CloudStack: $DS_MAYBE if vm running on vmware/xen (#4281)
    [Wei Zhou]
  + ec2: Support double encoded userdata (#4276) [Noah Meyerhans]
  + cc_mounts: xfs is a Linux only FS (#4334) [Mina Galić]
  + tests/net: fix TestGetInterfaces' mock coverage for get_master (#4336)
    [Chris Patterson]
  + change openEuler to openeuler and fix some bugs in openEuler (#4317)
    [sxt1001]
  + Replace flake8 with ruff (#4314)
  + NM renderer: set default IPv6 addr-gen-mode for all interfaces to eui64
    (#4291) [Ani Sinha]
  + cc_ssh_import_id: add Alpine support and add doas support (#4277)
    [dermotbradley]
  + sudoers not idempotent (SC-1589)  (#4296) [Alec Warren] (LP: #1998539)
  + Added support for Akamai Connected Cloud (formerly Linode) (#4167)
    [Will Smith]
  + Fix reference before assignment (#4292)
  + Overhaul module reference page (#4237) [Sally]
  + replaced spaces with commas for setting passenv (#4269) [Alec Warren]
  + DS VMware: modify a few log level (#4284) [PengpengSun]
  + tools/read-version refactors and unit tests (#4268)
  + Ensure get_features() grabs all features (#4285)
  + Don't always require passlib dependency (#4274)
  + tests: avoid leaks into host system checking of ovs-vsctl cmd (#4275)
  + Fix NoCloud kernel commandline key parsing (#4273)
  + testing: Clear all LRU caches after each test (#4249)
  + Remove the crypt dependency (#2139) [Gonéri Le Bouder]
  + logging: keep current file mode of log file if its stricter than the
    new mode (#4250) [Ani Sinha]
  + Remove default membership in redundant groups (#4258)
    [Dave Jones] (LP: #1923363)
  + doc: improve datasource_creation.rst (#4262)
  + Remove duplicate Integration testing button (#4261) [Rishita Shaw]
  + tools/read-version: fix the tool so that it can handle version parsing
    errors (#4234) [Ani Sinha]
  + net/dhcp: add udhcpc support (#4190) [Jean-François Roche]
  + DS VMware: add i386 arch dir to deployPkg plugin search path
    [PengpengSun]
  + LXD moved from linuxcontainers.org to Canonical [Simon Deziel]
  + cc_mounts.py: Add note about issue with creating mounts inside mounts
    (#4232) [dermotbradley]
  + lxd: install lxd from snap, not deb if absent in image
  + landscape: use landscape-config to write configuration
  + Add deprecation log during init of DataSourceDigitalOcean (#4194)
    [tyb-truth]
  + doc: fix typo on apt.primary.arches (#4238) [Dan Bungert]
  + Inspect systemd state for cloud-init status (#4230)
  + instance-data: add system-info and features to combined-cloud-config
    (#4224)
  + systemd: Block login until config stage completes (#2111) (LP: #2013403)
  + tests: proposed should invoke apt-get install -t=&lt;release&gt;-proposed
    (#4235)
  + cloud.cfg.tmpl: reinstate ca_certs entry (#4236) [dermotbradley]
  + Remove feature flag override ability (#4228)
  + tests: drop stray unrelated file presence test (#4227)
  + Update LXD URL (#4223) [Sally]
  + schema: add network v1 schema definition and validation functions
  + tests: daily PPA for devel series is version 99.daily update tests to
    match (#4225)
  + instance-data: write /run/cloud-init/combined-cloud-config.json
  + mount parse: Fix matching non-existent directories (#4222) [Mina Galić]
  + Specify build-system for pep517 (#4218)
  + Fix network v2 metric rendering (#4220)
  + Migrate content out of FAQ page (SD-1187) (#4205) [Sally]
  + setup: fix generation of init templates (#4209) [Mina Galić]
  + docs: Correct some bootcmd example wording
  + fix changelog
  + tests: reboot client to assert x-shellscript-per-boot is triggered
  + nocloud: parse_cmdline no longer detects nocloud-net datasource (#4204)
    (LP: 4203, #2025180)
  + Add docstring and typing to mergemanydict (#4200)
  + BSD: add dsidentify to early startup scripts (#4182) [Mina Galić]
  + handler: report errors on skipped merged cloud-config.txt parts
    (LP: #1999952)
  + Add cloud-init summit writeups (#4179) [Sally]
  + tests: Update test_clean_log for oci (#4187)
  + gce: improve ephemeral fallback NIC selection (CPC-2578) (#4163)
  + tests: pin pytest 7.3.1 to avoid adverse testpaths behavior (#4184)
  + Ephemeral Networking for FreeBSD (#2165) [Mina Galić]
  + Clarify directory syntax for nocloud local filesystem. (#4178)
  + Set default renderer as sysconfig for centos/rhel (#4165) [Ani Sinha]
  + Test static routes and netplan 0.106
  + FreeBSD fix parsing of mount and mount options (#2146) [Mina Galić]
  + test: add tracking bug id (#4164)
  + tests: can't match MAC for LXD container veth due to netplan 0.106
    (#4162)
  + Add kaiwalyakoparkar as a contributor (#4156) [Kaiwalya Koparkar]
  + BSD: remove datasource_list from cloud.cfg template (#4159) [Mina Galić]
  + launching salt-minion in masterless mode (#4110) [Denis Halturin]
  + tools: fix run-container builds for rockylinux/8 git hash mismatch
    (#4161)
  + fix doc lint: spellchecker tripped up (#4160) [Mina Galić]
  + Support Ephemeral Networking for BSD (#2127)
  + Added / fixed support for static routes on OpenBSD and FreeBSD (#2157)
    [Kadir Mueller]
  + cc_rsyslog: Refactor for better multi-platform support (#4119)
    [Mina Galić] (LP: #1798055)
  + tests: fix test_lp1835584 (#4154)
  + cloud.cfg mod names: docs and rename salt_minion and set_password (#4153)
  + tests: apt support for deb822 format .sources files on mantic
  + vultr: remove check_route check (#2151) [Jonas Chevalier]
  + Update SECURITY.md (#4150) [Indrranil Pawar]
  + Update CONTRIBUTING.rst (#4149) [Indrranil Pawar]
  + Update .github-cla-signers (#4151) [Indrranil Pawar]
  + Standardise module names in cloud.cfg.tmpl to only use underscore
    (#4128) [dermotbradley]
  + tests: update test_webhook_reporting
  + Modify PR template so autoclose works
  + doc: add missing semi-colon to nocloud cmdline docs (#4120)
  + .gitignore: extend coverage pattern (#4143) [Mina Galić]
  From 23.2.2
  + Fix NoCloud kernel commandline key parsing (#4273) (Fixes: #4271)
    (LP: #2028562)
  + Fix reference before assignment (#4292) (Fixes: #4288) (LP: #2028784)
  From 23.2.1
  + nocloud: Fix parse_cmdline detection of nocloud-net datasource (#4204)
    (Fixes: 4203) (LP: #2025180)
  From 23.2
  + BSD: simplify finding MBR partitions by removing duplicate code
  [Mina Galić]
  + tests: bump pycloudlib version for mantic builds
  + network-manager: Set higher autoconnect priority for nm keyfiles (#3671)
    [Ani Sinha]
  + alpine.py: change the locale file used (#4139) [dermotbradley]
  + cc_ntp: Sync up with current FreeBSD ntp.conf (#4122) [Mina Galić]
  + config: drop refresh_rmc_and_interface as RHEL 7 no longer supported
    [Robert Schweikert]
  + docs: Add feedback button to docs
  + net/sysconfig: enable sysconfig renderer if network manager has ifcfg-rh
    plugin (#4132) [Ani Sinha]
  + For Alpine use os-release PRETTY_NAME (#4138) [dermotbradley]
  + network_manager: add a method for ipv6 static IP configuration (#4127)
    [Ani Sinha]
  + correct misnamed template file host.mariner.tmpl (#4124) [dermotbradley]
  + nm: generate ipv6 stateful dhcp config at par with sysconfig (#4115)
    [Ani Sinha]
  + Add templates for GitHub Issues
  + Add 'peers' and 'allow' directives in cc_ntp (#3124) [Jacob Salmela]
  + FreeBSD: Fix user account locking (#4114) [Mina Galić] (GH: #1854594)
  + FreeBSD: add ResizeGrowFS class to cc_growpart (#2334) [Mina Galić]
  + Update tests in Azure TestCanDevBeReformatted class (#2771)
    [Ksenija Stanojevic]
  + Replace Launchpad references with GitHub Issues
  + Fix KeyError in iproute pformat (#3287) [Dmitry Zykov]
  + schema: read_cfg_paths call init.fetch to lookup /v/l/c/instance
  + azure/errors: introduce reportable errors for imds (#3647)
    [Chris Patterson]
  + FreeBSD (and friends): better identify MBR slices (#2168)
    [Mina Galić] (LP: #2016350)
  + azure/errors: add host reporting for dhcp errors (#2167)
    [Chris Patterson]
  + net: purge blacklist_drivers across net and azure (#2160)
    [Chris Patterson]
  + net: refactor hyper-v VF filtering and apply to get_interfaces() (#2153)
    [Chris Patterson]
  + tests: avoid leaks to underlying filesystem for /etc/cloud/clean.d
    (#2251)
  + net: refactor find_candidate_nics_on_linux() to use get_interfaces()
    (#2159) [Chris Patterson]
  + resolv_conf: Allow &gt; 3 nameservers (#2152) [Major Hayden]
  + Remove mount NTFS error message (#2134) [Ksenija Stanojevic]
  + integration tests: fix image specification parsing (#2166)
  + ci: add hypothesis scheduled GH check (#2149)
  + Move supported distros list to docs (#2162)
  + Fix logger, use instance rather than module function (#2163)
  + README: Point to Github Actions build status (#2158)
  + Revert "fix linux-specific code on bsd (#2143)" (#2161)
  + Do not generate dsa and ed25519 key types when crypto FIPS mode is
    enabled (#2142) [Ani Sinha] (LP: 2017761)
  + Add documentation label automatically (#2156)
  + sources/azure: report success to host and introduce kvp module (#2141)
    [Chris Patterson]
  + setup.py: use pkg-config for udev/rules path (#2137) [dankm]
  + openstack/static: honor the DNS servers associated with a network
    (#2138) [Gonéri Le Bouder]
  + fix linux-specific code on bsd (#2143)
  + cli: schema validation of jinja template user-data (SC-1385) (#2132)
    (LP: #1881925)
  + gce: activate network discovery on every boot (#2128)
  + tests: update integration test to assert 640 across reboots (#2145)
  + Make user/vendor data sensitive and remove log permissions (#2144)
    (LP: #2013967)
  + Update kernel command line docs (SC-1457) (#2133)
  + docs: update network configuration path links (#2140) [d1r3ct0r]
  + sources/azure: report failures to host via kvp (#2136) [Chris Patterson]
  + net: Document use of `ip route append` to add routes (#2130)
  + dhcp: Add missing mocks (#2135)
  + azure/imds: retry fetching metadata up to 300 seconds (#2121)
    [Chris Patterson]
  + [1/2] DHCP: Refactor dhcp client code  (#2122)
  + azure/errors: treat traceback_base64 as string (#2131) [Chris Patterson]
  + azure/errors: introduce reportable errors (#2129) [Chris Patterson]
  + users: schema permit empty list to indicate create no users
  + azure: introduce identity module (#2116) [Chris Patterson]
  + Standardize disabling cloud-init on non-systemd (#2112)
  + Update .github-cla-signers (#2126) [Rob Tongue]
  + NoCloud: Use seedfrom protocol to determine mode (#2107)
  + rhel: Remove sysvinit files. (#2114)
  + tox.ini: set -vvvv --showlocals for pytest (#2104) [Chris Patterson]
  + Fix NoCloud kernel commandline semi-colon args
  + run-container: make the container/VM timeout configurable (#2118)
    [Paride Legovini]
  + suse: Remove sysvinit files. (#2115)
  + test: Backport assert_call_count for old requests (#2119)
  + Add "licebmi" as contributor (#2113) [Mark Martinez]
  + Adapt DataSourceScaleway to upcoming IPv6 support (#2033)
    [Louis Bouchard]
  + rhel: make sure previous-hostname file ends with a new line (#2108)
    [Ani Sinha]
  + Adding contributors for DataSourceAkamai (#2110) [acourdavAkamai]
  + Cleanup ephemeral IP routes on exception (#2100) [sxt1001]
  + commit 09a64badfb3f51b1b391fa29be19962381a4bbeb [sxt1001] (LP: #2011291)
  + Standardize kernel commandline user interface (#2093)
  + config/cc_resizefs: fix do_resize arguments (#2106) [Chris Patterson]
  + Fix test_dhclient_exits_with_error (#2105)
  + net/dhcp: catch dhclient failures and raise NoDHCPLeaseError (#2083)
    [Chris Patterson]
  + sources/azure: move pps handling out of _poll_imds() (#2075)
    [Chris Patterson]
  + tests: bump pycloudlib version (#2102)
  + schema: do not manipulate draft4 metaschema for jsonschema 2.6.0 (#2098)
  + sources/azure/imds: don't count timeout errors as connection errors
    (#2074) [Chris Patterson]
  + Fix Python 3.12 unit test failures (#2099)
  + integration tests: Refactor instance checking (#1989)
  + ci: migrate remaining jobs from travis to gh (#2085)
  + missing ending quote in instancedata docs(#2094) [Hong L]
  + refactor: stop passing log instances to cc_* handlers (#2016) [d1r3ct0r]
  + tests/vmware: fix test_no_data_access_method failure (#2092)
    [Chris Patterson]
  + Don't change permissions of netrules target (#2076) (LP: #2011783)
  + tests/sources: patch util.get_cmdline() for datasource tests (#2091)
    [Chris Patterson]
  + macs: ignore duplicate MAC for devs with driver driver qmi_wwan (#2090)
    (LP: #2008888)
  + Fedora: Enable CA handling (#2086) [František Zatloukal]
  + Send dhcp-client-identifier for InfiniBand ports (#2043) [Waleed Mousa]
  + cc_ansible: complete the examples and doc (#2082) [Yves]
  + bddeb: for dev package, derive debhelper-compat from host system
  + apport: only prompt for cloud_name when instance-data.json is absent
  + datasource: Optimize datasource detection, fix bugs (#2060)
  + Handle non existent ca-cert-config situation (#2073) [Shreenidhi Shedi]
  + sources/azure: add networking check for all source PPS (#2061)
    [Chris Patterson]
  + do not attempt dns resolution on ip addresses (#2040)
  + chore: fix style tip (#2071)
  + Fix metadata IP in instancedata.rst (#2063) [Brian Haley]
  + util: Pass deprecation schedule in deprecate_call() (#2064)
  + config: Update grub-dpkg docs (#2058)
  + docs: Cosmetic improvements and styling (#2057) [s-makin]
  + cc_grub_dpkg: Added UEFI support (#2029) [Alexander Birkner]
  + tests: Write to /var/spool/rsyslog to adhere to apparmor profile (#2059)
  + oracle-ds: prefer system_cfg over ds network config source (#1998)
    (LP: #1956788)
  + Remove dead code (#2038)
  + source: Force OpenStack when it is only option (#2045) (LP: #2008727)
  + cc_ubuntu_advantage: improve UA logs discovery
  + sources/azure: fix regressions in IMDS behavior (#2041) [Chris Patterson]
  + tests: fix test_schema (#2042)
  + dhcp: Cleanup unused kwarg (#2037)
  + sources/vmware/imc: fix-missing-catch-few-negtive-scenarios (#2027)
    [PengpengSun]
  + dhclient_hook: remove vestigal dhclient_hook command (#2015)
  + log: Add standardized deprecation tooling (SC-1312) (#2026)
  + Enable SUSE based distros for ca handling (#2036) [Robert Schweikert]
  From 23.1.2
  + Make user/vendor data sensitive and remove log permissions
    (LP: #2013967) (CVE-2023-1786)
  From 23.1.1
  + source: Force OpenStack when it is only option (#2045)
  + sources/azure: fix regressions in IMDS behavior (#2041)
    [Chris Patterson]</changelog>
  <changelog author="michal.vyskocil@gmail.com" date="1701432000">- Move fdupes call back to %install (boo#1214169)</changelog>
  <changelog author="rjschwei@suse.com" date="1702641600">- Switch build dependency to the generic distribution-release package</changelog>
  <changelog author="rjschwei@suse.com" date="1705665600">- Add cloud-init-pckg-reboot.patch (boo#1198533, bsc#1218952,  jsc#SMO-326)
  + Support reboot on package update/upgrade via the cloud-init config</changelog>
  <changelog author="rjschwei@suse.com" date="1705752000">- Add cloud-init-skip-empty-conf.patch
  + Skip tests with empty config</changelog>
  <changelog author="rjschwei@suse.com" date="1708430400">- Prepare for RPM 4.20 switch patch syntax</changelog>
  <changelog author="fcrozat@suse.com" date="1709726400">- Hardcode distribution to suse for proper cloud.cfg generation
  (bsc#1220132).</changelog>
  <changelog author="rjschwei@suse.com" date="1711627200">- Add  cloud-init-ds-deterministic.patch (bsc#1221132)
  + Do not guess a data source when checking for a CloudStack
    environment</changelog>
  <changelog author="rjschwei@suse.com" date="1712318400">- Add cloud-init-no-openstack-guess.patch (bsc#1222113)
  + Do not guess if we are running on OpenStack or not. Only recognize
    the known markers and enable cloud-init if we know for sure.</changelog>
  <changelog author="rjschwei@suse.com" date="1712318401">- Add cloud-init-no-nmcfg-needed.patch (bsc#1221726)
  + Do not require a NetworkManager config file in order to detect
    NetworkManager as the renderer</changelog>
  <changelog author="rjschwei@suse.com" date="1712664000">- Update cloud-init-no-openstack-guess.patch
  + Do not enable cloud-init on systems where there is no DMI just
    because no data source has been found. No data source means
    cloud-init will not run.</changelog>
  <changelog author="rjschwei@suse.com" date="1714392000">- Add cloud-init-usr-sudoers.patch (bsc#1223469)
  + Handle the existence of /usr/etc/sudoers to search for the expected
    include location</changelog>
  <changelog author="rjschwei@suse.com" date="1717416000">- Add cloud-init-skip-rename.patch (bsc#1219680)
  + Brute force appraoch to skip renames if the device is already present</changelog>
</package>
<package pkgid="b0cffe097f4e97548ec6b43d58330ba323c3c9a0c26c503138185d1caffbdd1e" name="cloud-init-doc" arch="ppc64le">
  <version epoch="0" ver="23.3" rel="150100.8.82.3"/>
  <changelog author="rjschwei@suse.com" date="1675425600">- Add cloud-init-transact-up.patch to support transactional-updates</changelog>
  <changelog author="rjschwei@suse.com" date="1677153600">- Update to version 23.1
  + Remove patches included upstream:
  - cloud-init-btrfs-queue-resize.patch
  - cloud-init-micro-is-suse.patch
  - cloud-init-suse-afternm.patch
  - cloud-init-prefer-nm.patch
  - cloud-init-transact-up.patch
  + Forward port
  - cloud-init-write-routes.patch
  + Added
  - cloud-init-fix-ca-test.patch
  + Support transactional-updates for SUSE based distros (#1997)
    [Robert Schweikert]
  + Set ownership for new folders in Write Files Module (#1980)
    [Jack] (LP: #1990513)
  + add OpenCloudOS and TencentOS support (#1964) [wynnfeng]
  + lxd: Retry if the server isn't ready (#2025)
  + test: switch pycloudlib source to pypi (#2024)
  + test: Fix integration test deprecation message (#2023)
  + Recognize opensuse-microos, dev tooling fixes [Robert Schweikert]
  + sources/azure: refactor imds handler into own module (#1977)
    [Chris Patterson]
  + docs: deprecation generation support [1/2] (#2013)
  + add function is_virtual to distro/FreeBSD (#1957) [Mina Galić]
  + cc_ssh: support multiple hostcertificates (#2018) (LP: #1999164)
  + Fix minor schema validation regression and fixup typing (#2017)
  + doc: Reword user data debug section (#2019)
  + Overhaul/rewrite of certificate handling as follows: (#1962)
    [dermotbradley] (LP: #1931174)
  + disk_setup: use byte string when purging the partition table (#2012)
    [Stefan Prietl]
  + cli: schema also validate vendordata*.
  + ci: sort and add checks for cla signers file [Stefan Prietl]
  + Add "ederst" as contributor (#2010) [Stefan Prietl]
  + readme: add reference to packages dir (#2001)
  + docs: update downstream package list (#2002)
  + docs: add google search verification (#2000) [s-makin]
  + docs: fix 404 render use default notfound_urls_prefix in RTD conf (#2004)
  + Fix OpenStack datasource detection on bare metal (#1923)
    [Alexander Birkner] (LP: #1815990)
  + docs: add themed RTD 404 page and pointer to readthedocs-hosted (#1993)
  + schema: fix gpt labels, use type string for GUID (#1995)
  + cc_disk_setup: code cleanup (#1996)
  + netplan: keep custom strict perms when 50-cloud-init.yaml exists
  + cloud-id: better handling of change in datasource files
    [d1r3ct0r] (LP: #1998998)
  + tests: Remove restart check from test
  + Ignore duplicate macs from mscc_felix and fsl_enetc (LP: #1997922)
  + Warn on empty network key (#1990)
  + Fix Vultr cloud_interfaces usage (#1986) [eb3095]
  + cc_puppet: Update puppet service name (#1970) [d1r3ct0r] (LP: #2002969)
  + docs: Clarify networking docs (#1987)
  + lint: remove httpretty (#1985) [sxt1001]
  + cc_set_passwords: Prevent traceback when restarting ssh (#1981)
  + tests: fix lp1912844 (#1978)
  + tests: Skip ansible test on bionic (#1984)
  + Wait for NetworkManager (#1983) [Robert Schweikert]
  + docs: minor polishing (#1979) [s-makin]
  + CI: migrate integration-test to GH actions (#1969)
  + Fix permission of SSH host keys (#1971) [Ron Gebauer]
  + Fix default route rendering on v2 ipv6 (#1973) (LP: #2003562)
  + doc: fix path in net_convert command (#1975)
  + docs: update net_convert docs (#1974)
  + doc: fix dead link
  + cc_set_hostname: ignore /var/lib/cloud/data/set-hostname if it's empty
    (#1967) [Emanuele Giuseppe Esposito]
  + distros/rhel.py: _read_hostname() missing strip on "hostname" (#1941)
    [Mark Mielke]
  + integration tests: add  IBM VPC support (SC-1352) (#1915)
  + machine-id: set to uninitialized to trigger regeneration on clones
    (LP: #1999680)
  + sources/azure: retry on connection error when fetching metdata (#1968)
    [Chris Patterson]
  + Ensure ssh state accurately obtained (#1966)
  + bddeb: drop dh-systemd dependency on newer deb-based releases [d1r3ct0r]
  + doc: fix `config formats` link in cloudsigma.rst (#1960)
  + Fix wrong subp syntax in cc_set_passwords.py (#1961)
  + docs: update the PR template link to readthedocs (#1958) [d1r3ct0r]
  + ci: switch unittests to gh actions (#1956)
  + Add mount_default_fields for PhotonOS. (#1952) [Shreenidhi Shedi]
  + sources/azure: minor refactor for metadata source detection logic
    (#1936) [Chris Patterson]
  + add "CalvoM" as contributor (#1955) [d1r3ct0r]
  + ci: doc to gh actions (#1951)
  + lxd: handle 404 from missing devices route for LXD 4.0 (LP: #2001737)
  + docs: Diataxis overhaul (#1933) [s-makin]
  + vultr: Fix issue regarding cache and region codes (#1938) [eb3095]
  + cc_set_passwords: Move ssh status checking later (SC-1368) (#1909)
    (LP: #1998526)
  + Improve Wireguard module idempotency (#1940) [Fabian Lichtenegger-Lukas]
  + network/netplan: add gateways as on-link when necessary (#1931)
    [Louis Sautier] (LP: #2000596)
  + tests: test_lxd assert features.networks.zones when present (#1939)
  + Use btrfs enquque when available (#1926) [Robert Schweikert]
  + sources/azure: drop description for report_failure_to_fabric() (#1934)
    [Chris Patterson]
  + cc_disk_setup.py: fix MBR single partition creation (#1932)
    [dermotbradley] (LP: #1851438)
  + Fix typo with package_update/package_upgrade (#1927) [eb3095]
  + sources/azure: fix device driver matching for net config (#1914)
    [Chris Patterson]
  + BSD: fix duplicate macs in Ifconfig parser (#1917) [Mina Galić]
  + test: mock dns calls (#1922)
  + pycloudlib: add lunar support for integration tests (#1928)
  + nocloud: add support for dmi variable expansion for seedfrom URL
    (LP: #1994980)
  + tools: read-version drop extra call to git describe --long
  + doc: improve cc_write_files doc (#1916)
  + read-version: When insufficient tags, use cloudinit.version.get_version
  + mounts: document weird prefix in schema (#1913)
  + add utility function test cases (#1910) [sxt1001]
  + test: mock file deletion in dhcp tests (#1911)
  + Ensure network ready before cloud-init service runs on RHEL (#1893)
    (LP: #1998655)
  + docs: add copy button to code blocks (#1890) [s-makin]
  + netplan: define features.NETPLAN_CONFIG_ROOT_READ_ONLY flag
  + azure: fix support for systems without az command installed (#1908)
  + Networking Clarification (#1892)
  + Fix the distro.osfamily output problem in the openEuler system. (#1895)
    [sxt1001] (LP: #1999042)
  + pycloudlib: bump commit dropping azure api smoke test
  + net: netplan config root read-only as wifi config can contain creds
  + autoinstall: clarify docs for users
  + sources/azure: encode health report as utf-8 (#1897) [Chris Patterson]
  + Add back gateway4/6 deprecation to docs (#1898)
  + networkd: Add support for multiple [Route] sections (#1868)
    [Nigel Kukard]
  + doc: add qemu tutorial (#1863)
  + lint: fix tip-flake8 and tip-mypy (#1896)
  + Add support for setting uid when creating users on FreeBSD (#1888)
    [einsibjarni]
  + Fix exception in BSD networking code-path (#1894) [Mina Galić]
  + Append derivatives to is_rhel list in cloud.cfg.tmpl (#1887) [Louis Abel]
  + FreeBSD init: use cloudinit_enable as only rcvar (#1875) [Mina Galić]
  + feat: add support aliyun metadata security harden mode (#1865)
    [Manasseh Zhou]
  + docs: uprate analyze to performance page [s-makin]
  + test: fix lxd preseed managed network config (#1881)
  + Add support for static IPv6 addresses for FreeBSD (#1839) [einsibjarni]
  + Make 3.12 failures not fail the build (#1873)
  + Docs: adding relative links [s-makin]
  + Update read-version
  + Fix setup.py to align with PEP 440 versioning replacing trailing
  + travis: promote 3.11-dev to 3.11 (#1866)
  + test_cloud_sigma: delete useless test (#1828) [sxt1001]
  + Add "nkukard" as contributor (#1864) [Nigel Kukard]
  + tests: ds-id mocks for vmware-rpctool as utility may not exist in env
  + doc: add how to render new module doc (#1855)
  + doc: improve module creation explanation (#1851)
  + Add Support for IPv6 metadata to OpenStack (#1805)
    [Marvin Vogt] (LP: #1906849)
  + add xiaoge1001 to .github-cla-signers (#1854) [sxt1001]
  + network: Deprecate gateway{4,6} keys in network config v2 (#1794)
    (LP: #1992512)
  + VMware: Move Guest Customization transport from OVF to VMware (#1573)
    [PengpengSun]
  + doc: home page links added (#1852) [s-makin]
  From 22.4.2
  + status: handle ds not defined in status.json (#1876) (LP: #1997559)
  From 22.4.1
  + net: skip duplicate mac check for netvsc nic and its VF (#1853)
    [Anh Vo] (LP: #1844191)
  + ChangeLog: whitespace cleanup (#1850)
  + changelog: capture 22.3.1-4 releases</changelog>
  <changelog author="rjschwei@suse.com" date="1681214400">- Sensitive data exposure (bsc#1210277, CVE-2023-1786)
  + Add hidesensitivedata
  + Add cloud-init-cve-2023-1786-redact-inst-data.patch
  + Do not expose sensitive data gathered from the CSP</changelog>
  <changelog author="rjschwei@suse.com" date="1682596800">- Add cloud-init-power-rhel-only.patch (bsc#1210273)
  + Config module cc_refresh_rmc_and_interface is implemented such that
    it will only work on RH distros. Set the module availability accordingly.</changelog>
  <changelog author="rjschwei@suse.com" date="1688644800">- Update cloud-init-write-routes.patch (bsc#1212879)
  + Add necessary import statement
- Enable flake8 linting, fix up patches
  + cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  + cloud-init-power-rhel-only.patch
  + cloud-init-write-routes.patch
  + datasourceLocalDisk.patch</changelog>
  <changelog author="dmueller@suse.com" date="1691928000">- update to 23.1.2:
  * Make user/vendor data sensitive and remove log permissions
  * source: Force OpenStack when it is only option (#2045)
  * sources/azure: fix regressions in IMDS behavior
- drop
  cloud-init-cve-2023-1786-redact-instance-data-json-main.patch (upstream)
- spec-file cleanups, including dropping flake8 (as build fails
  with newer flake8 versions)</changelog>
  <changelog author="rjschwei@suse.com" date="1692014400">- Add cloud-init-flake8-fixes.patch
- Revert chnages from previous commit
  + Disabling checks the primary maintainer enabled for specific reasons
    is not a fix.</changelog>
  <changelog author="rjschwei@suse.com" date="1696852800">- Update to version 23.3 (bsc#1216011, bsc#1215794, bsc#1215740)
  + Remove patches included upstream:
  - cloud-init-fix-ca-test.patch
  - cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  - cloud-init-power-rhel-only.patch
  - cloud-init-flake8-fixes.patch
  + Add
  - cloud-init-keep-flake.patch
  - cloud-init-lint-fixes.patch
  + Update
  - cloud-init-write-routes.patch (bsc#1216007)
  + Bump pycloudlib to 1!5.1.0 for ec2 mantic daily image support (#4390)
  + Fix cc_keyboard in mantic (LP: #2030788)
  + ec2: initialize get_instance_userdata return value to bytes (#4387)
    [Noah Meyerhans]
  + cc_users_groups: Add doas/opendoas support (#4363) [dermotbradley]
  + Fix pip-managed ansible
  + status: treat SubState=running and MainPID=0 as service exited
  + azure/imds: increase read-timeout to 30s (#4372) [Chris Patterson]
  + collect-logs fix memory usage (SC-1590) (#4289)
    [Alec Warren] (LP: #1980150)
  + cc_mounts: Use fallocate to create swapfile on btrfs (#4369) [王煎饼]
  + Undocument nocloud-net (#4318)
  + feat(akamai): add akamai to settings.py and apport.py (#4370)
  + read-version: fallback to get_version when git describe fails (#4366)
  + apt: fix cloud-init status --wait blocking on systemd v 253 (#4364)
  + integration tests: Pass username to pycloudlib (#4324)
  + Bump pycloudlib to 1!5.1.0 (#4353)
  + cloud.cfg.tmpl: reorganise, minimise/reduce duplication (#4272)
    [dermotbradley]
  + analyze: fix (unexpected) timestamp parsing (#4347) [Mina Galić]
  + cc_growpart: fix tests to run on FreeBSD (#4351) [Mina Galić]
  + subp: Fix spurious test failure on FreeBSD (#4355) [Mina Galić]
  + cmd/clean: fix tests on non-Linux platforms (#4352) [Mina Galić]
  + util: Fix get_proc_ppid() on non-Linux systems (#4348) [Mina Galić]
  + cc_wireguard: make tests pass on FreeBSD (#4346) [Mina Galić]
  + unittests: fix breakage in test_read_cfg_paths_fetches_cached_datasource
    (#4328) [Ani Sinha]
  + Fix test_tools.py collection (#4315)
  + cc_keyboard: add Alpine support (#4278) [dermotbradley]
  + Flake8 fixes (#4340) [Robert Schweikert]
  + cc_mounts: Fix swapfile not working on btrfs (#4319) [王煎饼] (LP: #1884127)
  + ds-identify/CloudStack: $DS_MAYBE if vm running on vmware/xen (#4281)
    [Wei Zhou]
  + ec2: Support double encoded userdata (#4276) [Noah Meyerhans]
  + cc_mounts: xfs is a Linux only FS (#4334) [Mina Galić]
  + tests/net: fix TestGetInterfaces' mock coverage for get_master (#4336)
    [Chris Patterson]
  + change openEuler to openeuler and fix some bugs in openEuler (#4317)
    [sxt1001]
  + Replace flake8 with ruff (#4314)
  + NM renderer: set default IPv6 addr-gen-mode for all interfaces to eui64
    (#4291) [Ani Sinha]
  + cc_ssh_import_id: add Alpine support and add doas support (#4277)
    [dermotbradley]
  + sudoers not idempotent (SC-1589)  (#4296) [Alec Warren] (LP: #1998539)
  + Added support for Akamai Connected Cloud (formerly Linode) (#4167)
    [Will Smith]
  + Fix reference before assignment (#4292)
  + Overhaul module reference page (#4237) [Sally]
  + replaced spaces with commas for setting passenv (#4269) [Alec Warren]
  + DS VMware: modify a few log level (#4284) [PengpengSun]
  + tools/read-version refactors and unit tests (#4268)
  + Ensure get_features() grabs all features (#4285)
  + Don't always require passlib dependency (#4274)
  + tests: avoid leaks into host system checking of ovs-vsctl cmd (#4275)
  + Fix NoCloud kernel commandline key parsing (#4273)
  + testing: Clear all LRU caches after each test (#4249)
  + Remove the crypt dependency (#2139) [Gonéri Le Bouder]
  + logging: keep current file mode of log file if its stricter than the
    new mode (#4250) [Ani Sinha]
  + Remove default membership in redundant groups (#4258)
    [Dave Jones] (LP: #1923363)
  + doc: improve datasource_creation.rst (#4262)
  + Remove duplicate Integration testing button (#4261) [Rishita Shaw]
  + tools/read-version: fix the tool so that it can handle version parsing
    errors (#4234) [Ani Sinha]
  + net/dhcp: add udhcpc support (#4190) [Jean-François Roche]
  + DS VMware: add i386 arch dir to deployPkg plugin search path
    [PengpengSun]
  + LXD moved from linuxcontainers.org to Canonical [Simon Deziel]
  + cc_mounts.py: Add note about issue with creating mounts inside mounts
    (#4232) [dermotbradley]
  + lxd: install lxd from snap, not deb if absent in image
  + landscape: use landscape-config to write configuration
  + Add deprecation log during init of DataSourceDigitalOcean (#4194)
    [tyb-truth]
  + doc: fix typo on apt.primary.arches (#4238) [Dan Bungert]
  + Inspect systemd state for cloud-init status (#4230)
  + instance-data: add system-info and features to combined-cloud-config
    (#4224)
  + systemd: Block login until config stage completes (#2111) (LP: #2013403)
  + tests: proposed should invoke apt-get install -t=&lt;release&gt;-proposed
    (#4235)
  + cloud.cfg.tmpl: reinstate ca_certs entry (#4236) [dermotbradley]
  + Remove feature flag override ability (#4228)
  + tests: drop stray unrelated file presence test (#4227)
  + Update LXD URL (#4223) [Sally]
  + schema: add network v1 schema definition and validation functions
  + tests: daily PPA for devel series is version 99.daily update tests to
    match (#4225)
  + instance-data: write /run/cloud-init/combined-cloud-config.json
  + mount parse: Fix matching non-existent directories (#4222) [Mina Galić]
  + Specify build-system for pep517 (#4218)
  + Fix network v2 metric rendering (#4220)
  + Migrate content out of FAQ page (SD-1187) (#4205) [Sally]
  + setup: fix generation of init templates (#4209) [Mina Galić]
  + docs: Correct some bootcmd example wording
  + fix changelog
  + tests: reboot client to assert x-shellscript-per-boot is triggered
  + nocloud: parse_cmdline no longer detects nocloud-net datasource (#4204)
    (LP: 4203, #2025180)
  + Add docstring and typing to mergemanydict (#4200)
  + BSD: add dsidentify to early startup scripts (#4182) [Mina Galić]
  + handler: report errors on skipped merged cloud-config.txt parts
    (LP: #1999952)
  + Add cloud-init summit writeups (#4179) [Sally]
  + tests: Update test_clean_log for oci (#4187)
  + gce: improve ephemeral fallback NIC selection (CPC-2578) (#4163)
  + tests: pin pytest 7.3.1 to avoid adverse testpaths behavior (#4184)
  + Ephemeral Networking for FreeBSD (#2165) [Mina Galić]
  + Clarify directory syntax for nocloud local filesystem. (#4178)
  + Set default renderer as sysconfig for centos/rhel (#4165) [Ani Sinha]
  + Test static routes and netplan 0.106
  + FreeBSD fix parsing of mount and mount options (#2146) [Mina Galić]
  + test: add tracking bug id (#4164)
  + tests: can't match MAC for LXD container veth due to netplan 0.106
    (#4162)
  + Add kaiwalyakoparkar as a contributor (#4156) [Kaiwalya Koparkar]
  + BSD: remove datasource_list from cloud.cfg template (#4159) [Mina Galić]
  + launching salt-minion in masterless mode (#4110) [Denis Halturin]
  + tools: fix run-container builds for rockylinux/8 git hash mismatch
    (#4161)
  + fix doc lint: spellchecker tripped up (#4160) [Mina Galić]
  + Support Ephemeral Networking for BSD (#2127)
  + Added / fixed support for static routes on OpenBSD and FreeBSD (#2157)
    [Kadir Mueller]
  + cc_rsyslog: Refactor for better multi-platform support (#4119)
    [Mina Galić] (LP: #1798055)
  + tests: fix test_lp1835584 (#4154)
  + cloud.cfg mod names: docs and rename salt_minion and set_password (#4153)
  + tests: apt support for deb822 format .sources files on mantic
  + vultr: remove check_route check (#2151) [Jonas Chevalier]
  + Update SECURITY.md (#4150) [Indrranil Pawar]
  + Update CONTRIBUTING.rst (#4149) [Indrranil Pawar]
  + Update .github-cla-signers (#4151) [Indrranil Pawar]
  + Standardise module names in cloud.cfg.tmpl to only use underscore
    (#4128) [dermotbradley]
  + tests: update test_webhook_reporting
  + Modify PR template so autoclose works
  + doc: add missing semi-colon to nocloud cmdline docs (#4120)
  + .gitignore: extend coverage pattern (#4143) [Mina Galić]
  From 23.2.2
  + Fix NoCloud kernel commandline key parsing (#4273) (Fixes: #4271)
    (LP: #2028562)
  + Fix reference before assignment (#4292) (Fixes: #4288) (LP: #2028784)
  From 23.2.1
  + nocloud: Fix parse_cmdline detection of nocloud-net datasource (#4204)
    (Fixes: 4203) (LP: #2025180)
  From 23.2
  + BSD: simplify finding MBR partitions by removing duplicate code
  [Mina Galić]
  + tests: bump pycloudlib version for mantic builds
  + network-manager: Set higher autoconnect priority for nm keyfiles (#3671)
    [Ani Sinha]
  + alpine.py: change the locale file used (#4139) [dermotbradley]
  + cc_ntp: Sync up with current FreeBSD ntp.conf (#4122) [Mina Galić]
  + config: drop refresh_rmc_and_interface as RHEL 7 no longer supported
    [Robert Schweikert]
  + docs: Add feedback button to docs
  + net/sysconfig: enable sysconfig renderer if network manager has ifcfg-rh
    plugin (#4132) [Ani Sinha]
  + For Alpine use os-release PRETTY_NAME (#4138) [dermotbradley]
  + network_manager: add a method for ipv6 static IP configuration (#4127)
    [Ani Sinha]
  + correct misnamed template file host.mariner.tmpl (#4124) [dermotbradley]
  + nm: generate ipv6 stateful dhcp config at par with sysconfig (#4115)
    [Ani Sinha]
  + Add templates for GitHub Issues
  + Add 'peers' and 'allow' directives in cc_ntp (#3124) [Jacob Salmela]
  + FreeBSD: Fix user account locking (#4114) [Mina Galić] (GH: #1854594)
  + FreeBSD: add ResizeGrowFS class to cc_growpart (#2334) [Mina Galić]
  + Update tests in Azure TestCanDevBeReformatted class (#2771)
    [Ksenija Stanojevic]
  + Replace Launchpad references with GitHub Issues
  + Fix KeyError in iproute pformat (#3287) [Dmitry Zykov]
  + schema: read_cfg_paths call init.fetch to lookup /v/l/c/instance
  + azure/errors: introduce reportable errors for imds (#3647)
    [Chris Patterson]
  + FreeBSD (and friends): better identify MBR slices (#2168)
    [Mina Galić] (LP: #2016350)
  + azure/errors: add host reporting for dhcp errors (#2167)
    [Chris Patterson]
  + net: purge blacklist_drivers across net and azure (#2160)
    [Chris Patterson]
  + net: refactor hyper-v VF filtering and apply to get_interfaces() (#2153)
    [Chris Patterson]
  + tests: avoid leaks to underlying filesystem for /etc/cloud/clean.d
    (#2251)
  + net: refactor find_candidate_nics_on_linux() to use get_interfaces()
    (#2159) [Chris Patterson]
  + resolv_conf: Allow &gt; 3 nameservers (#2152) [Major Hayden]
  + Remove mount NTFS error message (#2134) [Ksenija Stanojevic]
  + integration tests: fix image specification parsing (#2166)
  + ci: add hypothesis scheduled GH check (#2149)
  + Move supported distros list to docs (#2162)
  + Fix logger, use instance rather than module function (#2163)
  + README: Point to Github Actions build status (#2158)
  + Revert "fix linux-specific code on bsd (#2143)" (#2161)
  + Do not generate dsa and ed25519 key types when crypto FIPS mode is
    enabled (#2142) [Ani Sinha] (LP: 2017761)
  + Add documentation label automatically (#2156)
  + sources/azure: report success to host and introduce kvp module (#2141)
    [Chris Patterson]
  + setup.py: use pkg-config for udev/rules path (#2137) [dankm]
  + openstack/static: honor the DNS servers associated with a network
    (#2138) [Gonéri Le Bouder]
  + fix linux-specific code on bsd (#2143)
  + cli: schema validation of jinja template user-data (SC-1385) (#2132)
    (LP: #1881925)
  + gce: activate network discovery on every boot (#2128)
  + tests: update integration test to assert 640 across reboots (#2145)
  + Make user/vendor data sensitive and remove log permissions (#2144)
    (LP: #2013967)
  + Update kernel command line docs (SC-1457) (#2133)
  + docs: update network configuration path links (#2140) [d1r3ct0r]
  + sources/azure: report failures to host via kvp (#2136) [Chris Patterson]
  + net: Document use of `ip route append` to add routes (#2130)
  + dhcp: Add missing mocks (#2135)
  + azure/imds: retry fetching metadata up to 300 seconds (#2121)
    [Chris Patterson]
  + [1/2] DHCP: Refactor dhcp client code  (#2122)
  + azure/errors: treat traceback_base64 as string (#2131) [Chris Patterson]
  + azure/errors: introduce reportable errors (#2129) [Chris Patterson]
  + users: schema permit empty list to indicate create no users
  + azure: introduce identity module (#2116) [Chris Patterson]
  + Standardize disabling cloud-init on non-systemd (#2112)
  + Update .github-cla-signers (#2126) [Rob Tongue]
  + NoCloud: Use seedfrom protocol to determine mode (#2107)
  + rhel: Remove sysvinit files. (#2114)
  + tox.ini: set -vvvv --showlocals for pytest (#2104) [Chris Patterson]
  + Fix NoCloud kernel commandline semi-colon args
  + run-container: make the container/VM timeout configurable (#2118)
    [Paride Legovini]
  + suse: Remove sysvinit files. (#2115)
  + test: Backport assert_call_count for old requests (#2119)
  + Add "licebmi" as contributor (#2113) [Mark Martinez]
  + Adapt DataSourceScaleway to upcoming IPv6 support (#2033)
    [Louis Bouchard]
  + rhel: make sure previous-hostname file ends with a new line (#2108)
    [Ani Sinha]
  + Adding contributors for DataSourceAkamai (#2110) [acourdavAkamai]
  + Cleanup ephemeral IP routes on exception (#2100) [sxt1001]
  + commit 09a64badfb3f51b1b391fa29be19962381a4bbeb [sxt1001] (LP: #2011291)
  + Standardize kernel commandline user interface (#2093)
  + config/cc_resizefs: fix do_resize arguments (#2106) [Chris Patterson]
  + Fix test_dhclient_exits_with_error (#2105)
  + net/dhcp: catch dhclient failures and raise NoDHCPLeaseError (#2083)
    [Chris Patterson]
  + sources/azure: move pps handling out of _poll_imds() (#2075)
    [Chris Patterson]
  + tests: bump pycloudlib version (#2102)
  + schema: do not manipulate draft4 metaschema for jsonschema 2.6.0 (#2098)
  + sources/azure/imds: don't count timeout errors as connection errors
    (#2074) [Chris Patterson]
  + Fix Python 3.12 unit test failures (#2099)
  + integration tests: Refactor instance checking (#1989)
  + ci: migrate remaining jobs from travis to gh (#2085)
  + missing ending quote in instancedata docs(#2094) [Hong L]
  + refactor: stop passing log instances to cc_* handlers (#2016) [d1r3ct0r]
  + tests/vmware: fix test_no_data_access_method failure (#2092)
    [Chris Patterson]
  + Don't change permissions of netrules target (#2076) (LP: #2011783)
  + tests/sources: patch util.get_cmdline() for datasource tests (#2091)
    [Chris Patterson]
  + macs: ignore duplicate MAC for devs with driver driver qmi_wwan (#2090)
    (LP: #2008888)
  + Fedora: Enable CA handling (#2086) [František Zatloukal]
  + Send dhcp-client-identifier for InfiniBand ports (#2043) [Waleed Mousa]
  + cc_ansible: complete the examples and doc (#2082) [Yves]
  + bddeb: for dev package, derive debhelper-compat from host system
  + apport: only prompt for cloud_name when instance-data.json is absent
  + datasource: Optimize datasource detection, fix bugs (#2060)
  + Handle non existent ca-cert-config situation (#2073) [Shreenidhi Shedi]
  + sources/azure: add networking check for all source PPS (#2061)
    [Chris Patterson]
  + do not attempt dns resolution on ip addresses (#2040)
  + chore: fix style tip (#2071)
  + Fix metadata IP in instancedata.rst (#2063) [Brian Haley]
  + util: Pass deprecation schedule in deprecate_call() (#2064)
  + config: Update grub-dpkg docs (#2058)
  + docs: Cosmetic improvements and styling (#2057) [s-makin]
  + cc_grub_dpkg: Added UEFI support (#2029) [Alexander Birkner]
  + tests: Write to /var/spool/rsyslog to adhere to apparmor profile (#2059)
  + oracle-ds: prefer system_cfg over ds network config source (#1998)
    (LP: #1956788)
  + Remove dead code (#2038)
  + source: Force OpenStack when it is only option (#2045) (LP: #2008727)
  + cc_ubuntu_advantage: improve UA logs discovery
  + sources/azure: fix regressions in IMDS behavior (#2041) [Chris Patterson]
  + tests: fix test_schema (#2042)
  + dhcp: Cleanup unused kwarg (#2037)
  + sources/vmware/imc: fix-missing-catch-few-negtive-scenarios (#2027)
    [PengpengSun]
  + dhclient_hook: remove vestigal dhclient_hook command (#2015)
  + log: Add standardized deprecation tooling (SC-1312) (#2026)
  + Enable SUSE based distros for ca handling (#2036) [Robert Schweikert]
  From 23.1.2
  + Make user/vendor data sensitive and remove log permissions
    (LP: #2013967) (CVE-2023-1786)
  From 23.1.1
  + source: Force OpenStack when it is only option (#2045)
  + sources/azure: fix regressions in IMDS behavior (#2041)
    [Chris Patterson]</changelog>
  <changelog author="michal.vyskocil@gmail.com" date="1701432000">- Move fdupes call back to %install (boo#1214169)</changelog>
  <changelog author="rjschwei@suse.com" date="1702641600">- Switch build dependency to the generic distribution-release package</changelog>
  <changelog author="rjschwei@suse.com" date="1705665600">- Add cloud-init-pckg-reboot.patch (boo#1198533, bsc#1218952,  jsc#SMO-326)
  + Support reboot on package update/upgrade via the cloud-init config</changelog>
  <changelog author="rjschwei@suse.com" date="1705752000">- Add cloud-init-skip-empty-conf.patch
  + Skip tests with empty config</changelog>
  <changelog author="rjschwei@suse.com" date="1708430400">- Prepare for RPM 4.20 switch patch syntax</changelog>
  <changelog author="fcrozat@suse.com" date="1709726400">- Hardcode distribution to suse for proper cloud.cfg generation
  (bsc#1220132).</changelog>
  <changelog author="rjschwei@suse.com" date="1711627200">- Add  cloud-init-ds-deterministic.patch (bsc#1221132)
  + Do not guess a data source when checking for a CloudStack
    environment</changelog>
  <changelog author="rjschwei@suse.com" date="1712318400">- Add cloud-init-no-openstack-guess.patch (bsc#1222113)
  + Do not guess if we are running on OpenStack or not. Only recognize
    the known markers and enable cloud-init if we know for sure.</changelog>
  <changelog author="rjschwei@suse.com" date="1712318401">- Add cloud-init-no-nmcfg-needed.patch (bsc#1221726)
  + Do not require a NetworkManager config file in order to detect
    NetworkManager as the renderer</changelog>
  <changelog author="rjschwei@suse.com" date="1712664000">- Update cloud-init-no-openstack-guess.patch
  + Do not enable cloud-init on systems where there is no DMI just
    because no data source has been found. No data source means
    cloud-init will not run.</changelog>
  <changelog author="rjschwei@suse.com" date="1714392000">- Add cloud-init-usr-sudoers.patch (bsc#1223469)
  + Handle the existence of /usr/etc/sudoers to search for the expected
    include location</changelog>
  <changelog author="rjschwei@suse.com" date="1717416000">- Add cloud-init-skip-rename.patch (bsc#1219680)
  + Brute force appraoch to skip renames if the device is already present</changelog>
</package>
<package pkgid="d2b3cd8b40e0b82c511ecb5dbb01b8c9c93e9bcba1ba66a6f8c126bab114b03e" name="cloud-init-doc" arch="s390x">
  <version epoch="0" ver="23.3" rel="150100.8.82.3"/>
  <changelog author="rjschwei@suse.com" date="1675425600">- Add cloud-init-transact-up.patch to support transactional-updates</changelog>
  <changelog author="rjschwei@suse.com" date="1677153600">- Update to version 23.1
  + Remove patches included upstream:
  - cloud-init-btrfs-queue-resize.patch
  - cloud-init-micro-is-suse.patch
  - cloud-init-suse-afternm.patch
  - cloud-init-prefer-nm.patch
  - cloud-init-transact-up.patch
  + Forward port
  - cloud-init-write-routes.patch
  + Added
  - cloud-init-fix-ca-test.patch
  + Support transactional-updates for SUSE based distros (#1997)
    [Robert Schweikert]
  + Set ownership for new folders in Write Files Module (#1980)
    [Jack] (LP: #1990513)
  + add OpenCloudOS and TencentOS support (#1964) [wynnfeng]
  + lxd: Retry if the server isn't ready (#2025)
  + test: switch pycloudlib source to pypi (#2024)
  + test: Fix integration test deprecation message (#2023)
  + Recognize opensuse-microos, dev tooling fixes [Robert Schweikert]
  + sources/azure: refactor imds handler into own module (#1977)
    [Chris Patterson]
  + docs: deprecation generation support [1/2] (#2013)
  + add function is_virtual to distro/FreeBSD (#1957) [Mina Galić]
  + cc_ssh: support multiple hostcertificates (#2018) (LP: #1999164)
  + Fix minor schema validation regression and fixup typing (#2017)
  + doc: Reword user data debug section (#2019)
  + Overhaul/rewrite of certificate handling as follows: (#1962)
    [dermotbradley] (LP: #1931174)
  + disk_setup: use byte string when purging the partition table (#2012)
    [Stefan Prietl]
  + cli: schema also validate vendordata*.
  + ci: sort and add checks for cla signers file [Stefan Prietl]
  + Add "ederst" as contributor (#2010) [Stefan Prietl]
  + readme: add reference to packages dir (#2001)
  + docs: update downstream package list (#2002)
  + docs: add google search verification (#2000) [s-makin]
  + docs: fix 404 render use default notfound_urls_prefix in RTD conf (#2004)
  + Fix OpenStack datasource detection on bare metal (#1923)
    [Alexander Birkner] (LP: #1815990)
  + docs: add themed RTD 404 page and pointer to readthedocs-hosted (#1993)
  + schema: fix gpt labels, use type string for GUID (#1995)
  + cc_disk_setup: code cleanup (#1996)
  + netplan: keep custom strict perms when 50-cloud-init.yaml exists
  + cloud-id: better handling of change in datasource files
    [d1r3ct0r] (LP: #1998998)
  + tests: Remove restart check from test
  + Ignore duplicate macs from mscc_felix and fsl_enetc (LP: #1997922)
  + Warn on empty network key (#1990)
  + Fix Vultr cloud_interfaces usage (#1986) [eb3095]
  + cc_puppet: Update puppet service name (#1970) [d1r3ct0r] (LP: #2002969)
  + docs: Clarify networking docs (#1987)
  + lint: remove httpretty (#1985) [sxt1001]
  + cc_set_passwords: Prevent traceback when restarting ssh (#1981)
  + tests: fix lp1912844 (#1978)
  + tests: Skip ansible test on bionic (#1984)
  + Wait for NetworkManager (#1983) [Robert Schweikert]
  + docs: minor polishing (#1979) [s-makin]
  + CI: migrate integration-test to GH actions (#1969)
  + Fix permission of SSH host keys (#1971) [Ron Gebauer]
  + Fix default route rendering on v2 ipv6 (#1973) (LP: #2003562)
  + doc: fix path in net_convert command (#1975)
  + docs: update net_convert docs (#1974)
  + doc: fix dead link
  + cc_set_hostname: ignore /var/lib/cloud/data/set-hostname if it's empty
    (#1967) [Emanuele Giuseppe Esposito]
  + distros/rhel.py: _read_hostname() missing strip on "hostname" (#1941)
    [Mark Mielke]
  + integration tests: add  IBM VPC support (SC-1352) (#1915)
  + machine-id: set to uninitialized to trigger regeneration on clones
    (LP: #1999680)
  + sources/azure: retry on connection error when fetching metdata (#1968)
    [Chris Patterson]
  + Ensure ssh state accurately obtained (#1966)
  + bddeb: drop dh-systemd dependency on newer deb-based releases [d1r3ct0r]
  + doc: fix `config formats` link in cloudsigma.rst (#1960)
  + Fix wrong subp syntax in cc_set_passwords.py (#1961)
  + docs: update the PR template link to readthedocs (#1958) [d1r3ct0r]
  + ci: switch unittests to gh actions (#1956)
  + Add mount_default_fields for PhotonOS. (#1952) [Shreenidhi Shedi]
  + sources/azure: minor refactor for metadata source detection logic
    (#1936) [Chris Patterson]
  + add "CalvoM" as contributor (#1955) [d1r3ct0r]
  + ci: doc to gh actions (#1951)
  + lxd: handle 404 from missing devices route for LXD 4.0 (LP: #2001737)
  + docs: Diataxis overhaul (#1933) [s-makin]
  + vultr: Fix issue regarding cache and region codes (#1938) [eb3095]
  + cc_set_passwords: Move ssh status checking later (SC-1368) (#1909)
    (LP: #1998526)
  + Improve Wireguard module idempotency (#1940) [Fabian Lichtenegger-Lukas]
  + network/netplan: add gateways as on-link when necessary (#1931)
    [Louis Sautier] (LP: #2000596)
  + tests: test_lxd assert features.networks.zones when present (#1939)
  + Use btrfs enquque when available (#1926) [Robert Schweikert]
  + sources/azure: drop description for report_failure_to_fabric() (#1934)
    [Chris Patterson]
  + cc_disk_setup.py: fix MBR single partition creation (#1932)
    [dermotbradley] (LP: #1851438)
  + Fix typo with package_update/package_upgrade (#1927) [eb3095]
  + sources/azure: fix device driver matching for net config (#1914)
    [Chris Patterson]
  + BSD: fix duplicate macs in Ifconfig parser (#1917) [Mina Galić]
  + test: mock dns calls (#1922)
  + pycloudlib: add lunar support for integration tests (#1928)
  + nocloud: add support for dmi variable expansion for seedfrom URL
    (LP: #1994980)
  + tools: read-version drop extra call to git describe --long
  + doc: improve cc_write_files doc (#1916)
  + read-version: When insufficient tags, use cloudinit.version.get_version
  + mounts: document weird prefix in schema (#1913)
  + add utility function test cases (#1910) [sxt1001]
  + test: mock file deletion in dhcp tests (#1911)
  + Ensure network ready before cloud-init service runs on RHEL (#1893)
    (LP: #1998655)
  + docs: add copy button to code blocks (#1890) [s-makin]
  + netplan: define features.NETPLAN_CONFIG_ROOT_READ_ONLY flag
  + azure: fix support for systems without az command installed (#1908)
  + Networking Clarification (#1892)
  + Fix the distro.osfamily output problem in the openEuler system. (#1895)
    [sxt1001] (LP: #1999042)
  + pycloudlib: bump commit dropping azure api smoke test
  + net: netplan config root read-only as wifi config can contain creds
  + autoinstall: clarify docs for users
  + sources/azure: encode health report as utf-8 (#1897) [Chris Patterson]
  + Add back gateway4/6 deprecation to docs (#1898)
  + networkd: Add support for multiple [Route] sections (#1868)
    [Nigel Kukard]
  + doc: add qemu tutorial (#1863)
  + lint: fix tip-flake8 and tip-mypy (#1896)
  + Add support for setting uid when creating users on FreeBSD (#1888)
    [einsibjarni]
  + Fix exception in BSD networking code-path (#1894) [Mina Galić]
  + Append derivatives to is_rhel list in cloud.cfg.tmpl (#1887) [Louis Abel]
  + FreeBSD init: use cloudinit_enable as only rcvar (#1875) [Mina Galić]
  + feat: add support aliyun metadata security harden mode (#1865)
    [Manasseh Zhou]
  + docs: uprate analyze to performance page [s-makin]
  + test: fix lxd preseed managed network config (#1881)
  + Add support for static IPv6 addresses for FreeBSD (#1839) [einsibjarni]
  + Make 3.12 failures not fail the build (#1873)
  + Docs: adding relative links [s-makin]
  + Update read-version
  + Fix setup.py to align with PEP 440 versioning replacing trailing
  + travis: promote 3.11-dev to 3.11 (#1866)
  + test_cloud_sigma: delete useless test (#1828) [sxt1001]
  + Add "nkukard" as contributor (#1864) [Nigel Kukard]
  + tests: ds-id mocks for vmware-rpctool as utility may not exist in env
  + doc: add how to render new module doc (#1855)
  + doc: improve module creation explanation (#1851)
  + Add Support for IPv6 metadata to OpenStack (#1805)
    [Marvin Vogt] (LP: #1906849)
  + add xiaoge1001 to .github-cla-signers (#1854) [sxt1001]
  + network: Deprecate gateway{4,6} keys in network config v2 (#1794)
    (LP: #1992512)
  + VMware: Move Guest Customization transport from OVF to VMware (#1573)
    [PengpengSun]
  + doc: home page links added (#1852) [s-makin]
  From 22.4.2
  + status: handle ds not defined in status.json (#1876) (LP: #1997559)
  From 22.4.1
  + net: skip duplicate mac check for netvsc nic and its VF (#1853)
    [Anh Vo] (LP: #1844191)
  + ChangeLog: whitespace cleanup (#1850)
  + changelog: capture 22.3.1-4 releases</changelog>
  <changelog author="rjschwei@suse.com" date="1681214400">- Sensitive data exposure (bsc#1210277, CVE-2023-1786)
  + Add hidesensitivedata
  + Add cloud-init-cve-2023-1786-redact-inst-data.patch
  + Do not expose sensitive data gathered from the CSP</changelog>
  <changelog author="rjschwei@suse.com" date="1682596800">- Add cloud-init-power-rhel-only.patch (bsc#1210273)
  + Config module cc_refresh_rmc_and_interface is implemented such that
    it will only work on RH distros. Set the module availability accordingly.</changelog>
  <changelog author="rjschwei@suse.com" date="1688644800">- Update cloud-init-write-routes.patch (bsc#1212879)
  + Add necessary import statement
- Enable flake8 linting, fix up patches
  + cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  + cloud-init-power-rhel-only.patch
  + cloud-init-write-routes.patch
  + datasourceLocalDisk.patch</changelog>
  <changelog author="dmueller@suse.com" date="1691928000">- update to 23.1.2:
  * Make user/vendor data sensitive and remove log permissions
  * source: Force OpenStack when it is only option (#2045)
  * sources/azure: fix regressions in IMDS behavior
- drop
  cloud-init-cve-2023-1786-redact-instance-data-json-main.patch (upstream)
- spec-file cleanups, including dropping flake8 (as build fails
  with newer flake8 versions)</changelog>
  <changelog author="rjschwei@suse.com" date="1692014400">- Add cloud-init-flake8-fixes.patch
- Revert chnages from previous commit
  + Disabling checks the primary maintainer enabled for specific reasons
    is not a fix.</changelog>
  <changelog author="rjschwei@suse.com" date="1696852800">- Update to version 23.3 (bsc#1216011, bsc#1215794, bsc#1215740)
  + Remove patches included upstream:
  - cloud-init-fix-ca-test.patch
  - cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  - cloud-init-power-rhel-only.patch
  - cloud-init-flake8-fixes.patch
  + Add
  - cloud-init-keep-flake.patch
  - cloud-init-lint-fixes.patch
  + Update
  - cloud-init-write-routes.patch (bsc#1216007)
  + Bump pycloudlib to 1!5.1.0 for ec2 mantic daily image support (#4390)
  + Fix cc_keyboard in mantic (LP: #2030788)
  + ec2: initialize get_instance_userdata return value to bytes (#4387)
    [Noah Meyerhans]
  + cc_users_groups: Add doas/opendoas support (#4363) [dermotbradley]
  + Fix pip-managed ansible
  + status: treat SubState=running and MainPID=0 as service exited
  + azure/imds: increase read-timeout to 30s (#4372) [Chris Patterson]
  + collect-logs fix memory usage (SC-1590) (#4289)
    [Alec Warren] (LP: #1980150)
  + cc_mounts: Use fallocate to create swapfile on btrfs (#4369) [王煎饼]
  + Undocument nocloud-net (#4318)
  + feat(akamai): add akamai to settings.py and apport.py (#4370)
  + read-version: fallback to get_version when git describe fails (#4366)
  + apt: fix cloud-init status --wait blocking on systemd v 253 (#4364)
  + integration tests: Pass username to pycloudlib (#4324)
  + Bump pycloudlib to 1!5.1.0 (#4353)
  + cloud.cfg.tmpl: reorganise, minimise/reduce duplication (#4272)
    [dermotbradley]
  + analyze: fix (unexpected) timestamp parsing (#4347) [Mina Galić]
  + cc_growpart: fix tests to run on FreeBSD (#4351) [Mina Galić]
  + subp: Fix spurious test failure on FreeBSD (#4355) [Mina Galić]
  + cmd/clean: fix tests on non-Linux platforms (#4352) [Mina Galić]
  + util: Fix get_proc_ppid() on non-Linux systems (#4348) [Mina Galić]
  + cc_wireguard: make tests pass on FreeBSD (#4346) [Mina Galić]
  + unittests: fix breakage in test_read_cfg_paths_fetches_cached_datasource
    (#4328) [Ani Sinha]
  + Fix test_tools.py collection (#4315)
  + cc_keyboard: add Alpine support (#4278) [dermotbradley]
  + Flake8 fixes (#4340) [Robert Schweikert]
  + cc_mounts: Fix swapfile not working on btrfs (#4319) [王煎饼] (LP: #1884127)
  + ds-identify/CloudStack: $DS_MAYBE if vm running on vmware/xen (#4281)
    [Wei Zhou]
  + ec2: Support double encoded userdata (#4276) [Noah Meyerhans]
  + cc_mounts: xfs is a Linux only FS (#4334) [Mina Galić]
  + tests/net: fix TestGetInterfaces' mock coverage for get_master (#4336)
    [Chris Patterson]
  + change openEuler to openeuler and fix some bugs in openEuler (#4317)
    [sxt1001]
  + Replace flake8 with ruff (#4314)
  + NM renderer: set default IPv6 addr-gen-mode for all interfaces to eui64
    (#4291) [Ani Sinha]
  + cc_ssh_import_id: add Alpine support and add doas support (#4277)
    [dermotbradley]
  + sudoers not idempotent (SC-1589)  (#4296) [Alec Warren] (LP: #1998539)
  + Added support for Akamai Connected Cloud (formerly Linode) (#4167)
    [Will Smith]
  + Fix reference before assignment (#4292)
  + Overhaul module reference page (#4237) [Sally]
  + replaced spaces with commas for setting passenv (#4269) [Alec Warren]
  + DS VMware: modify a few log level (#4284) [PengpengSun]
  + tools/read-version refactors and unit tests (#4268)
  + Ensure get_features() grabs all features (#4285)
  + Don't always require passlib dependency (#4274)
  + tests: avoid leaks into host system checking of ovs-vsctl cmd (#4275)
  + Fix NoCloud kernel commandline key parsing (#4273)
  + testing: Clear all LRU caches after each test (#4249)
  + Remove the crypt dependency (#2139) [Gonéri Le Bouder]
  + logging: keep current file mode of log file if its stricter than the
    new mode (#4250) [Ani Sinha]
  + Remove default membership in redundant groups (#4258)
    [Dave Jones] (LP: #1923363)
  + doc: improve datasource_creation.rst (#4262)
  + Remove duplicate Integration testing button (#4261) [Rishita Shaw]
  + tools/read-version: fix the tool so that it can handle version parsing
    errors (#4234) [Ani Sinha]
  + net/dhcp: add udhcpc support (#4190) [Jean-François Roche]
  + DS VMware: add i386 arch dir to deployPkg plugin search path
    [PengpengSun]
  + LXD moved from linuxcontainers.org to Canonical [Simon Deziel]
  + cc_mounts.py: Add note about issue with creating mounts inside mounts
    (#4232) [dermotbradley]
  + lxd: install lxd from snap, not deb if absent in image
  + landscape: use landscape-config to write configuration
  + Add deprecation log during init of DataSourceDigitalOcean (#4194)
    [tyb-truth]
  + doc: fix typo on apt.primary.arches (#4238) [Dan Bungert]
  + Inspect systemd state for cloud-init status (#4230)
  + instance-data: add system-info and features to combined-cloud-config
    (#4224)
  + systemd: Block login until config stage completes (#2111) (LP: #2013403)
  + tests: proposed should invoke apt-get install -t=&lt;release&gt;-proposed
    (#4235)
  + cloud.cfg.tmpl: reinstate ca_certs entry (#4236) [dermotbradley]
  + Remove feature flag override ability (#4228)
  + tests: drop stray unrelated file presence test (#4227)
  + Update LXD URL (#4223) [Sally]
  + schema: add network v1 schema definition and validation functions
  + tests: daily PPA for devel series is version 99.daily update tests to
    match (#4225)
  + instance-data: write /run/cloud-init/combined-cloud-config.json
  + mount parse: Fix matching non-existent directories (#4222) [Mina Galić]
  + Specify build-system for pep517 (#4218)
  + Fix network v2 metric rendering (#4220)
  + Migrate content out of FAQ page (SD-1187) (#4205) [Sally]
  + setup: fix generation of init templates (#4209) [Mina Galić]
  + docs: Correct some bootcmd example wording
  + fix changelog
  + tests: reboot client to assert x-shellscript-per-boot is triggered
  + nocloud: parse_cmdline no longer detects nocloud-net datasource (#4204)
    (LP: 4203, #2025180)
  + Add docstring and typing to mergemanydict (#4200)
  + BSD: add dsidentify to early startup scripts (#4182) [Mina Galić]
  + handler: report errors on skipped merged cloud-config.txt parts
    (LP: #1999952)
  + Add cloud-init summit writeups (#4179) [Sally]
  + tests: Update test_clean_log for oci (#4187)
  + gce: improve ephemeral fallback NIC selection (CPC-2578) (#4163)
  + tests: pin pytest 7.3.1 to avoid adverse testpaths behavior (#4184)
  + Ephemeral Networking for FreeBSD (#2165) [Mina Galić]
  + Clarify directory syntax for nocloud local filesystem. (#4178)
  + Set default renderer as sysconfig for centos/rhel (#4165) [Ani Sinha]
  + Test static routes and netplan 0.106
  + FreeBSD fix parsing of mount and mount options (#2146) [Mina Galić]
  + test: add tracking bug id (#4164)
  + tests: can't match MAC for LXD container veth due to netplan 0.106
    (#4162)
  + Add kaiwalyakoparkar as a contributor (#4156) [Kaiwalya Koparkar]
  + BSD: remove datasource_list from cloud.cfg template (#4159) [Mina Galić]
  + launching salt-minion in masterless mode (#4110) [Denis Halturin]
  + tools: fix run-container builds for rockylinux/8 git hash mismatch
    (#4161)
  + fix doc lint: spellchecker tripped up (#4160) [Mina Galić]
  + Support Ephemeral Networking for BSD (#2127)
  + Added / fixed support for static routes on OpenBSD and FreeBSD (#2157)
    [Kadir Mueller]
  + cc_rsyslog: Refactor for better multi-platform support (#4119)
    [Mina Galić] (LP: #1798055)
  + tests: fix test_lp1835584 (#4154)
  + cloud.cfg mod names: docs and rename salt_minion and set_password (#4153)
  + tests: apt support for deb822 format .sources files on mantic
  + vultr: remove check_route check (#2151) [Jonas Chevalier]
  + Update SECURITY.md (#4150) [Indrranil Pawar]
  + Update CONTRIBUTING.rst (#4149) [Indrranil Pawar]
  + Update .github-cla-signers (#4151) [Indrranil Pawar]
  + Standardise module names in cloud.cfg.tmpl to only use underscore
    (#4128) [dermotbradley]
  + tests: update test_webhook_reporting
  + Modify PR template so autoclose works
  + doc: add missing semi-colon to nocloud cmdline docs (#4120)
  + .gitignore: extend coverage pattern (#4143) [Mina Galić]
  From 23.2.2
  + Fix NoCloud kernel commandline key parsing (#4273) (Fixes: #4271)
    (LP: #2028562)
  + Fix reference before assignment (#4292) (Fixes: #4288) (LP: #2028784)
  From 23.2.1
  + nocloud: Fix parse_cmdline detection of nocloud-net datasource (#4204)
    (Fixes: 4203) (LP: #2025180)
  From 23.2
  + BSD: simplify finding MBR partitions by removing duplicate code
  [Mina Galić]
  + tests: bump pycloudlib version for mantic builds
  + network-manager: Set higher autoconnect priority for nm keyfiles (#3671)
    [Ani Sinha]
  + alpine.py: change the locale file used (#4139) [dermotbradley]
  + cc_ntp: Sync up with current FreeBSD ntp.conf (#4122) [Mina Galić]
  + config: drop refresh_rmc_and_interface as RHEL 7 no longer supported
    [Robert Schweikert]
  + docs: Add feedback button to docs
  + net/sysconfig: enable sysconfig renderer if network manager has ifcfg-rh
    plugin (#4132) [Ani Sinha]
  + For Alpine use os-release PRETTY_NAME (#4138) [dermotbradley]
  + network_manager: add a method for ipv6 static IP configuration (#4127)
    [Ani Sinha]
  + correct misnamed template file host.mariner.tmpl (#4124) [dermotbradley]
  + nm: generate ipv6 stateful dhcp config at par with sysconfig (#4115)
    [Ani Sinha]
  + Add templates for GitHub Issues
  + Add 'peers' and 'allow' directives in cc_ntp (#3124) [Jacob Salmela]
  + FreeBSD: Fix user account locking (#4114) [Mina Galić] (GH: #1854594)
  + FreeBSD: add ResizeGrowFS class to cc_growpart (#2334) [Mina Galić]
  + Update tests in Azure TestCanDevBeReformatted class (#2771)
    [Ksenija Stanojevic]
  + Replace Launchpad references with GitHub Issues
  + Fix KeyError in iproute pformat (#3287) [Dmitry Zykov]
  + schema: read_cfg_paths call init.fetch to lookup /v/l/c/instance
  + azure/errors: introduce reportable errors for imds (#3647)
    [Chris Patterson]
  + FreeBSD (and friends): better identify MBR slices (#2168)
    [Mina Galić] (LP: #2016350)
  + azure/errors: add host reporting for dhcp errors (#2167)
    [Chris Patterson]
  + net: purge blacklist_drivers across net and azure (#2160)
    [Chris Patterson]
  + net: refactor hyper-v VF filtering and apply to get_interfaces() (#2153)
    [Chris Patterson]
  + tests: avoid leaks to underlying filesystem for /etc/cloud/clean.d
    (#2251)
  + net: refactor find_candidate_nics_on_linux() to use get_interfaces()
    (#2159) [Chris Patterson]
  + resolv_conf: Allow &gt; 3 nameservers (#2152) [Major Hayden]
  + Remove mount NTFS error message (#2134) [Ksenija Stanojevic]
  + integration tests: fix image specification parsing (#2166)
  + ci: add hypothesis scheduled GH check (#2149)
  + Move supported distros list to docs (#2162)
  + Fix logger, use instance rather than module function (#2163)
  + README: Point to Github Actions build status (#2158)
  + Revert "fix linux-specific code on bsd (#2143)" (#2161)
  + Do not generate dsa and ed25519 key types when crypto FIPS mode is
    enabled (#2142) [Ani Sinha] (LP: 2017761)
  + Add documentation label automatically (#2156)
  + sources/azure: report success to host and introduce kvp module (#2141)
    [Chris Patterson]
  + setup.py: use pkg-config for udev/rules path (#2137) [dankm]
  + openstack/static: honor the DNS servers associated with a network
    (#2138) [Gonéri Le Bouder]
  + fix linux-specific code on bsd (#2143)
  + cli: schema validation of jinja template user-data (SC-1385) (#2132)
    (LP: #1881925)
  + gce: activate network discovery on every boot (#2128)
  + tests: update integration test to assert 640 across reboots (#2145)
  + Make user/vendor data sensitive and remove log permissions (#2144)
    (LP: #2013967)
  + Update kernel command line docs (SC-1457) (#2133)
  + docs: update network configuration path links (#2140) [d1r3ct0r]
  + sources/azure: report failures to host via kvp (#2136) [Chris Patterson]
  + net: Document use of `ip route append` to add routes (#2130)
  + dhcp: Add missing mocks (#2135)
  + azure/imds: retry fetching metadata up to 300 seconds (#2121)
    [Chris Patterson]
  + [1/2] DHCP: Refactor dhcp client code  (#2122)
  + azure/errors: treat traceback_base64 as string (#2131) [Chris Patterson]
  + azure/errors: introduce reportable errors (#2129) [Chris Patterson]
  + users: schema permit empty list to indicate create no users
  + azure: introduce identity module (#2116) [Chris Patterson]
  + Standardize disabling cloud-init on non-systemd (#2112)
  + Update .github-cla-signers (#2126) [Rob Tongue]
  + NoCloud: Use seedfrom protocol to determine mode (#2107)
  + rhel: Remove sysvinit files. (#2114)
  + tox.ini: set -vvvv --showlocals for pytest (#2104) [Chris Patterson]
  + Fix NoCloud kernel commandline semi-colon args
  + run-container: make the container/VM timeout configurable (#2118)
    [Paride Legovini]
  + suse: Remove sysvinit files. (#2115)
  + test: Backport assert_call_count for old requests (#2119)
  + Add "licebmi" as contributor (#2113) [Mark Martinez]
  + Adapt DataSourceScaleway to upcoming IPv6 support (#2033)
    [Louis Bouchard]
  + rhel: make sure previous-hostname file ends with a new line (#2108)
    [Ani Sinha]
  + Adding contributors for DataSourceAkamai (#2110) [acourdavAkamai]
  + Cleanup ephemeral IP routes on exception (#2100) [sxt1001]
  + commit 09a64badfb3f51b1b391fa29be19962381a4bbeb [sxt1001] (LP: #2011291)
  + Standardize kernel commandline user interface (#2093)
  + config/cc_resizefs: fix do_resize arguments (#2106) [Chris Patterson]
  + Fix test_dhclient_exits_with_error (#2105)
  + net/dhcp: catch dhclient failures and raise NoDHCPLeaseError (#2083)
    [Chris Patterson]
  + sources/azure: move pps handling out of _poll_imds() (#2075)
    [Chris Patterson]
  + tests: bump pycloudlib version (#2102)
  + schema: do not manipulate draft4 metaschema for jsonschema 2.6.0 (#2098)
  + sources/azure/imds: don't count timeout errors as connection errors
    (#2074) [Chris Patterson]
  + Fix Python 3.12 unit test failures (#2099)
  + integration tests: Refactor instance checking (#1989)
  + ci: migrate remaining jobs from travis to gh (#2085)
  + missing ending quote in instancedata docs(#2094) [Hong L]
  + refactor: stop passing log instances to cc_* handlers (#2016) [d1r3ct0r]
  + tests/vmware: fix test_no_data_access_method failure (#2092)
    [Chris Patterson]
  + Don't change permissions of netrules target (#2076) (LP: #2011783)
  + tests/sources: patch util.get_cmdline() for datasource tests (#2091)
    [Chris Patterson]
  + macs: ignore duplicate MAC for devs with driver driver qmi_wwan (#2090)
    (LP: #2008888)
  + Fedora: Enable CA handling (#2086) [František Zatloukal]
  + Send dhcp-client-identifier for InfiniBand ports (#2043) [Waleed Mousa]
  + cc_ansible: complete the examples and doc (#2082) [Yves]
  + bddeb: for dev package, derive debhelper-compat from host system
  + apport: only prompt for cloud_name when instance-data.json is absent
  + datasource: Optimize datasource detection, fix bugs (#2060)
  + Handle non existent ca-cert-config situation (#2073) [Shreenidhi Shedi]
  + sources/azure: add networking check for all source PPS (#2061)
    [Chris Patterson]
  + do not attempt dns resolution on ip addresses (#2040)
  + chore: fix style tip (#2071)
  + Fix metadata IP in instancedata.rst (#2063) [Brian Haley]
  + util: Pass deprecation schedule in deprecate_call() (#2064)
  + config: Update grub-dpkg docs (#2058)
  + docs: Cosmetic improvements and styling (#2057) [s-makin]
  + cc_grub_dpkg: Added UEFI support (#2029) [Alexander Birkner]
  + tests: Write to /var/spool/rsyslog to adhere to apparmor profile (#2059)
  + oracle-ds: prefer system_cfg over ds network config source (#1998)
    (LP: #1956788)
  + Remove dead code (#2038)
  + source: Force OpenStack when it is only option (#2045) (LP: #2008727)
  + cc_ubuntu_advantage: improve UA logs discovery
  + sources/azure: fix regressions in IMDS behavior (#2041) [Chris Patterson]
  + tests: fix test_schema (#2042)
  + dhcp: Cleanup unused kwarg (#2037)
  + sources/vmware/imc: fix-missing-catch-few-negtive-scenarios (#2027)
    [PengpengSun]
  + dhclient_hook: remove vestigal dhclient_hook command (#2015)
  + log: Add standardized deprecation tooling (SC-1312) (#2026)
  + Enable SUSE based distros for ca handling (#2036) [Robert Schweikert]
  From 23.1.2
  + Make user/vendor data sensitive and remove log permissions
    (LP: #2013967) (CVE-2023-1786)
  From 23.1.1
  + source: Force OpenStack when it is only option (#2045)
  + sources/azure: fix regressions in IMDS behavior (#2041)
    [Chris Patterson]</changelog>
  <changelog author="michal.vyskocil@gmail.com" date="1701432000">- Move fdupes call back to %install (boo#1214169)</changelog>
  <changelog author="rjschwei@suse.com" date="1702641600">- Switch build dependency to the generic distribution-release package</changelog>
  <changelog author="rjschwei@suse.com" date="1705665600">- Add cloud-init-pckg-reboot.patch (boo#1198533, bsc#1218952,  jsc#SMO-326)
  + Support reboot on package update/upgrade via the cloud-init config</changelog>
  <changelog author="rjschwei@suse.com" date="1705752000">- Add cloud-init-skip-empty-conf.patch
  + Skip tests with empty config</changelog>
  <changelog author="rjschwei@suse.com" date="1708430400">- Prepare for RPM 4.20 switch patch syntax</changelog>
  <changelog author="fcrozat@suse.com" date="1709726400">- Hardcode distribution to suse for proper cloud.cfg generation
  (bsc#1220132).</changelog>
  <changelog author="rjschwei@suse.com" date="1711627200">- Add  cloud-init-ds-deterministic.patch (bsc#1221132)
  + Do not guess a data source when checking for a CloudStack
    environment</changelog>
  <changelog author="rjschwei@suse.com" date="1712318400">- Add cloud-init-no-openstack-guess.patch (bsc#1222113)
  + Do not guess if we are running on OpenStack or not. Only recognize
    the known markers and enable cloud-init if we know for sure.</changelog>
  <changelog author="rjschwei@suse.com" date="1712318401">- Add cloud-init-no-nmcfg-needed.patch (bsc#1221726)
  + Do not require a NetworkManager config file in order to detect
    NetworkManager as the renderer</changelog>
  <changelog author="rjschwei@suse.com" date="1712664000">- Update cloud-init-no-openstack-guess.patch
  + Do not enable cloud-init on systems where there is no DMI just
    because no data source has been found. No data source means
    cloud-init will not run.</changelog>
  <changelog author="rjschwei@suse.com" date="1714392000">- Add cloud-init-usr-sudoers.patch (bsc#1223469)
  + Handle the existence of /usr/etc/sudoers to search for the expected
    include location</changelog>
  <changelog author="rjschwei@suse.com" date="1717416000">- Add cloud-init-skip-rename.patch (bsc#1219680)
  + Brute force appraoch to skip renames if the device is already present</changelog>
</package>
<package pkgid="cad254a0812f7a1e50897222f1db3e0c15a4f657f05e0565cc90bcc584f7db24" name="cloud-init-doc" arch="x86_64">
  <version epoch="0" ver="23.3" rel="150100.8.82.3"/>
  <changelog author="rjschwei@suse.com" date="1675425600">- Add cloud-init-transact-up.patch to support transactional-updates</changelog>
  <changelog author="rjschwei@suse.com" date="1677153600">- Update to version 23.1
  + Remove patches included upstream:
  - cloud-init-btrfs-queue-resize.patch
  - cloud-init-micro-is-suse.patch
  - cloud-init-suse-afternm.patch
  - cloud-init-prefer-nm.patch
  - cloud-init-transact-up.patch
  + Forward port
  - cloud-init-write-routes.patch
  + Added
  - cloud-init-fix-ca-test.patch
  + Support transactional-updates for SUSE based distros (#1997)
    [Robert Schweikert]
  + Set ownership for new folders in Write Files Module (#1980)
    [Jack] (LP: #1990513)
  + add OpenCloudOS and TencentOS support (#1964) [wynnfeng]
  + lxd: Retry if the server isn't ready (#2025)
  + test: switch pycloudlib source to pypi (#2024)
  + test: Fix integration test deprecation message (#2023)
  + Recognize opensuse-microos, dev tooling fixes [Robert Schweikert]
  + sources/azure: refactor imds handler into own module (#1977)
    [Chris Patterson]
  + docs: deprecation generation support [1/2] (#2013)
  + add function is_virtual to distro/FreeBSD (#1957) [Mina Galić]
  + cc_ssh: support multiple hostcertificates (#2018) (LP: #1999164)
  + Fix minor schema validation regression and fixup typing (#2017)
  + doc: Reword user data debug section (#2019)
  + Overhaul/rewrite of certificate handling as follows: (#1962)
    [dermotbradley] (LP: #1931174)
  + disk_setup: use byte string when purging the partition table (#2012)
    [Stefan Prietl]
  + cli: schema also validate vendordata*.
  + ci: sort and add checks for cla signers file [Stefan Prietl]
  + Add "ederst" as contributor (#2010) [Stefan Prietl]
  + readme: add reference to packages dir (#2001)
  + docs: update downstream package list (#2002)
  + docs: add google search verification (#2000) [s-makin]
  + docs: fix 404 render use default notfound_urls_prefix in RTD conf (#2004)
  + Fix OpenStack datasource detection on bare metal (#1923)
    [Alexander Birkner] (LP: #1815990)
  + docs: add themed RTD 404 page and pointer to readthedocs-hosted (#1993)
  + schema: fix gpt labels, use type string for GUID (#1995)
  + cc_disk_setup: code cleanup (#1996)
  + netplan: keep custom strict perms when 50-cloud-init.yaml exists
  + cloud-id: better handling of change in datasource files
    [d1r3ct0r] (LP: #1998998)
  + tests: Remove restart check from test
  + Ignore duplicate macs from mscc_felix and fsl_enetc (LP: #1997922)
  + Warn on empty network key (#1990)
  + Fix Vultr cloud_interfaces usage (#1986) [eb3095]
  + cc_puppet: Update puppet service name (#1970) [d1r3ct0r] (LP: #2002969)
  + docs: Clarify networking docs (#1987)
  + lint: remove httpretty (#1985) [sxt1001]
  + cc_set_passwords: Prevent traceback when restarting ssh (#1981)
  + tests: fix lp1912844 (#1978)
  + tests: Skip ansible test on bionic (#1984)
  + Wait for NetworkManager (#1983) [Robert Schweikert]
  + docs: minor polishing (#1979) [s-makin]
  + CI: migrate integration-test to GH actions (#1969)
  + Fix permission of SSH host keys (#1971) [Ron Gebauer]
  + Fix default route rendering on v2 ipv6 (#1973) (LP: #2003562)
  + doc: fix path in net_convert command (#1975)
  + docs: update net_convert docs (#1974)
  + doc: fix dead link
  + cc_set_hostname: ignore /var/lib/cloud/data/set-hostname if it's empty
    (#1967) [Emanuele Giuseppe Esposito]
  + distros/rhel.py: _read_hostname() missing strip on "hostname" (#1941)
    [Mark Mielke]
  + integration tests: add  IBM VPC support (SC-1352) (#1915)
  + machine-id: set to uninitialized to trigger regeneration on clones
    (LP: #1999680)
  + sources/azure: retry on connection error when fetching metdata (#1968)
    [Chris Patterson]
  + Ensure ssh state accurately obtained (#1966)
  + bddeb: drop dh-systemd dependency on newer deb-based releases [d1r3ct0r]
  + doc: fix `config formats` link in cloudsigma.rst (#1960)
  + Fix wrong subp syntax in cc_set_passwords.py (#1961)
  + docs: update the PR template link to readthedocs (#1958) [d1r3ct0r]
  + ci: switch unittests to gh actions (#1956)
  + Add mount_default_fields for PhotonOS. (#1952) [Shreenidhi Shedi]
  + sources/azure: minor refactor for metadata source detection logic
    (#1936) [Chris Patterson]
  + add "CalvoM" as contributor (#1955) [d1r3ct0r]
  + ci: doc to gh actions (#1951)
  + lxd: handle 404 from missing devices route for LXD 4.0 (LP: #2001737)
  + docs: Diataxis overhaul (#1933) [s-makin]
  + vultr: Fix issue regarding cache and region codes (#1938) [eb3095]
  + cc_set_passwords: Move ssh status checking later (SC-1368) (#1909)
    (LP: #1998526)
  + Improve Wireguard module idempotency (#1940) [Fabian Lichtenegger-Lukas]
  + network/netplan: add gateways as on-link when necessary (#1931)
    [Louis Sautier] (LP: #2000596)
  + tests: test_lxd assert features.networks.zones when present (#1939)
  + Use btrfs enquque when available (#1926) [Robert Schweikert]
  + sources/azure: drop description for report_failure_to_fabric() (#1934)
    [Chris Patterson]
  + cc_disk_setup.py: fix MBR single partition creation (#1932)
    [dermotbradley] (LP: #1851438)
  + Fix typo with package_update/package_upgrade (#1927) [eb3095]
  + sources/azure: fix device driver matching for net config (#1914)
    [Chris Patterson]
  + BSD: fix duplicate macs in Ifconfig parser (#1917) [Mina Galić]
  + test: mock dns calls (#1922)
  + pycloudlib: add lunar support for integration tests (#1928)
  + nocloud: add support for dmi variable expansion for seedfrom URL
    (LP: #1994980)
  + tools: read-version drop extra call to git describe --long
  + doc: improve cc_write_files doc (#1916)
  + read-version: When insufficient tags, use cloudinit.version.get_version
  + mounts: document weird prefix in schema (#1913)
  + add utility function test cases (#1910) [sxt1001]
  + test: mock file deletion in dhcp tests (#1911)
  + Ensure network ready before cloud-init service runs on RHEL (#1893)
    (LP: #1998655)
  + docs: add copy button to code blocks (#1890) [s-makin]
  + netplan: define features.NETPLAN_CONFIG_ROOT_READ_ONLY flag
  + azure: fix support for systems without az command installed (#1908)
  + Networking Clarification (#1892)
  + Fix the distro.osfamily output problem in the openEuler system. (#1895)
    [sxt1001] (LP: #1999042)
  + pycloudlib: bump commit dropping azure api smoke test
  + net: netplan config root read-only as wifi config can contain creds
  + autoinstall: clarify docs for users
  + sources/azure: encode health report as utf-8 (#1897) [Chris Patterson]
  + Add back gateway4/6 deprecation to docs (#1898)
  + networkd: Add support for multiple [Route] sections (#1868)
    [Nigel Kukard]
  + doc: add qemu tutorial (#1863)
  + lint: fix tip-flake8 and tip-mypy (#1896)
  + Add support for setting uid when creating users on FreeBSD (#1888)
    [einsibjarni]
  + Fix exception in BSD networking code-path (#1894) [Mina Galić]
  + Append derivatives to is_rhel list in cloud.cfg.tmpl (#1887) [Louis Abel]
  + FreeBSD init: use cloudinit_enable as only rcvar (#1875) [Mina Galić]
  + feat: add support aliyun metadata security harden mode (#1865)
    [Manasseh Zhou]
  + docs: uprate analyze to performance page [s-makin]
  + test: fix lxd preseed managed network config (#1881)
  + Add support for static IPv6 addresses for FreeBSD (#1839) [einsibjarni]
  + Make 3.12 failures not fail the build (#1873)
  + Docs: adding relative links [s-makin]
  + Update read-version
  + Fix setup.py to align with PEP 440 versioning replacing trailing
  + travis: promote 3.11-dev to 3.11 (#1866)
  + test_cloud_sigma: delete useless test (#1828) [sxt1001]
  + Add "nkukard" as contributor (#1864) [Nigel Kukard]
  + tests: ds-id mocks for vmware-rpctool as utility may not exist in env
  + doc: add how to render new module doc (#1855)
  + doc: improve module creation explanation (#1851)
  + Add Support for IPv6 metadata to OpenStack (#1805)
    [Marvin Vogt] (LP: #1906849)
  + add xiaoge1001 to .github-cla-signers (#1854) [sxt1001]
  + network: Deprecate gateway{4,6} keys in network config v2 (#1794)
    (LP: #1992512)
  + VMware: Move Guest Customization transport from OVF to VMware (#1573)
    [PengpengSun]
  + doc: home page links added (#1852) [s-makin]
  From 22.4.2
  + status: handle ds not defined in status.json (#1876) (LP: #1997559)
  From 22.4.1
  + net: skip duplicate mac check for netvsc nic and its VF (#1853)
    [Anh Vo] (LP: #1844191)
  + ChangeLog: whitespace cleanup (#1850)
  + changelog: capture 22.3.1-4 releases</changelog>
  <changelog author="rjschwei@suse.com" date="1681214400">- Sensitive data exposure (bsc#1210277, CVE-2023-1786)
  + Add hidesensitivedata
  + Add cloud-init-cve-2023-1786-redact-inst-data.patch
  + Do not expose sensitive data gathered from the CSP</changelog>
  <changelog author="rjschwei@suse.com" date="1682596800">- Add cloud-init-power-rhel-only.patch (bsc#1210273)
  + Config module cc_refresh_rmc_and_interface is implemented such that
    it will only work on RH distros. Set the module availability accordingly.</changelog>
  <changelog author="rjschwei@suse.com" date="1688644800">- Update cloud-init-write-routes.patch (bsc#1212879)
  + Add necessary import statement
- Enable flake8 linting, fix up patches
  + cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  + cloud-init-power-rhel-only.patch
  + cloud-init-write-routes.patch
  + datasourceLocalDisk.patch</changelog>
  <changelog author="dmueller@suse.com" date="1691928000">- update to 23.1.2:
  * Make user/vendor data sensitive and remove log permissions
  * source: Force OpenStack when it is only option (#2045)
  * sources/azure: fix regressions in IMDS behavior
- drop
  cloud-init-cve-2023-1786-redact-instance-data-json-main.patch (upstream)
- spec-file cleanups, including dropping flake8 (as build fails
  with newer flake8 versions)</changelog>
  <changelog author="rjschwei@suse.com" date="1692014400">- Add cloud-init-flake8-fixes.patch
- Revert chnages from previous commit
  + Disabling checks the primary maintainer enabled for specific reasons
    is not a fix.</changelog>
  <changelog author="rjschwei@suse.com" date="1696852800">- Update to version 23.3 (bsc#1216011, bsc#1215794, bsc#1215740)
  + Remove patches included upstream:
  - cloud-init-fix-ca-test.patch
  - cloud-init-cve-2023-1786-redact-instance-data-json-main.patch
  - cloud-init-power-rhel-only.patch
  - cloud-init-flake8-fixes.patch
  + Add
  - cloud-init-keep-flake.patch
  - cloud-init-lint-fixes.patch
  + Update
  - cloud-init-write-routes.patch (bsc#1216007)
  + Bump pycloudlib to 1!5.1.0 for ec2 mantic daily image support (#4390)
  + Fix cc_keyboard in mantic (LP: #2030788)
  + ec2: initialize get_instance_userdata return value to bytes (#4387)
    [Noah Meyerhans]
  + cc_users_groups: Add doas/opendoas support (#4363) [dermotbradley]
  + Fix pip-managed ansible
  + status: treat SubState=running and MainPID=0 as service exited
  + azure/imds: increase read-timeout to 30s (#4372) [Chris Patterson]
  + collect-logs fix memory usage (SC-1590) (#4289)
    [Alec Warren] (LP: #1980150)
  + cc_mounts: Use fallocate to create swapfile on btrfs (#4369) [王煎饼]
  + Undocument nocloud-net (#4318)
  + feat(akamai): add akamai to settings.py and apport.py (#4370)
  + read-version: fallback to get_version when git describe fails (#4366)
  + apt: fix cloud-init status --wait blocking on systemd v 253 (#4364)
  + integration tests: Pass username to pycloudlib (#4324)
  + Bump pycloudlib to 1!5.1.0 (#4353)
  + cloud.cfg.tmpl: reorganise, minimise/reduce duplication (#4272)
    [dermotbradley]
  + analyze: fix (unexpected) timestamp parsing (#4347) [Mina Galić]
  + cc_growpart: fix tests to run on FreeBSD (#4351) [Mina Galić]
  + subp: Fix spurious test failure on FreeBSD (#4355) [Mina Galić]
  + cmd/clean: fix tests on non-Linux platforms (#4352) [Mina Galić]
  + util: Fix get_proc_ppid() on non-Linux systems (#4348) [Mina Galić]
  + cc_wireguard: make tests pass on FreeBSD (#4346) [Mina Galić]
  + unittests: fix breakage in test_read_cfg_paths_fetches_cached_datasource
    (#4328) [Ani Sinha]
  + Fix test_tools.py collection (#4315)
  + cc_keyboard: add Alpine support (#4278) [dermotbradley]
  + Flake8 fixes (#4340) [Robert Schweikert]
  + cc_mounts: Fix swapfile not working on btrfs (#4319) [王煎饼] (LP: #1884127)
  + ds-identify/CloudStack: $DS_MAYBE if vm running on vmware/xen (#4281)
    [Wei Zhou]
  + ec2: Support double encoded userdata (#4276) [Noah Meyerhans]
  + cc_mounts: xfs is a Linux only FS (#4334) [Mina Galić]
  + tests/net: fix TestGetInterfaces' mock coverage for get_master (#4336)
    [Chris Patterson]
  + change openEuler to openeuler and fix some bugs in openEuler (#4317)
    [sxt1001]
  + Replace flake8 with ruff (#4314)
  + NM renderer: set default IPv6 addr-gen-mode for all interfaces to eui64
    (#4291) [Ani Sinha]
  + cc_ssh_import_id: add Alpine support and add doas support (#4277)
    [dermotbradley]
  + sudoers not idempotent (SC-1589)  (#4296) [Alec Warren] (LP: #1998539)
  + Added support for Akamai Connected Cloud (formerly Linode) (#4167)
    [Will Smith]
  + Fix reference before assignment (#4292)
  + Overhaul module reference page (#4237) [Sally]
  + replaced spaces with commas for setting passenv (#4269) [Alec Warren]
  + DS VMware: modify a few log level (#4284) [PengpengSun]
  + tools/read-version refactors and unit tests (#4268)
  + Ensure get_features() grabs all features (#4285)
  + Don't always require passlib dependency (#4274)
  + tests: avoid leaks into host system checking of ovs-vsctl cmd (#4275)
  + Fix NoCloud kernel commandline key parsing (#4273)
  + testing: Clear all LRU caches after each test (#4249)
  + Remove the crypt dependency (#2139) [Gonéri Le Bouder]
  + logging: keep current file mode of log file if its stricter than the
    new mode (#4250) [Ani Sinha]
  + Remove default membership in redundant groups (#4258)
    [Dave Jones] (LP: #1923363)
  + doc: improve datasource_creation.rst (#4262)
  + Remove duplicate Integration testing button (#4261) [Rishita Shaw]
  + tools/read-version: fix the tool so that it can handle version parsing
    errors (#4234) [Ani Sinha]
  + net/dhcp: add udhcpc support (#4190) [Jean-François Roche]
  + DS VMware: add i386 arch dir to deployPkg plugin search path
    [PengpengSun]
  + LXD moved from linuxcontainers.org to Canonical [Simon Deziel]
  + cc_mounts.py: Add note about issue with creating mounts inside mounts
    (#4232) [dermotbradley]
  + lxd: install lxd from snap, not deb if absent in image
  + landscape: use landscape-config to write configuration
  + Add deprecation log during init of DataSourceDigitalOcean (#4194)
    [tyb-truth]
  + doc: fix typo on apt.primary.arches (#4238) [Dan Bungert]
  + Inspect systemd state for cloud-init status (#4230)
  + instance-data: add system-info and features to combined-cloud-config
    (#4224)
  + systemd: Block login until config stage completes (#2111) (LP: #2013403)
  + tests: proposed should invoke apt-get install -t=&lt;release&gt;-proposed
    (#4235)
  + cloud.cfg.tmpl: reinstate ca_certs entry (#4236) [dermotbradley]
  + Remove feature flag override ability (#4228)
  + tests: drop stray unrelated file presence test (#4227)
  + Update LXD URL (#4223) [Sally]
  + schema: add network v1 schema definition and validation functions
  + tests: daily PPA for devel series is version 99.daily update tests to
    match (#4225)
  + instance-data: write /run/cloud-init/combined-cloud-config.json
  + mount parse: Fix matching non-existent directories (#4222) [Mina Galić]
  + Specify build-system for pep517 (#4218)
  + Fix network v2 metric rendering (#4220)
  + Migrate content out of FAQ page (SD-1187) (#4205) [Sally]
  + setup: fix generation of init templates (#4209) [Mina Galić]
  + docs: Correct some bootcmd example wording
  + fix changelog
  + tests: reboot client to assert x-shellscript-per-boot is triggered
  + nocloud: parse_cmdline no longer detects nocloud-net datasource (#4204)
    (LP: 4203, #2025180)
  + Add docstring and typing to mergemanydict (#4200)
  + BSD: add dsidentify to early startup scripts (#4182) [Mina Galić]
  + handler: report errors on skipped merged cloud-config.txt parts
    (LP: #1999952)
  + Add cloud-init summit writeups (#4179) [Sally]
  + tests: Update test_clean_log for oci (#4187)
  + gce: improve ephemeral fallback NIC selection (CPC-2578) (#4163)
  + tests: pin pytest 7.3.1 to avoid adverse testpaths behavior (#4184)
  + Ephemeral Networking for FreeBSD (#2165) [Mina Galić]
  + Clarify directory syntax for nocloud local filesystem. (#4178)
  + Set default renderer as sysconfig for centos/rhel (#4165) [Ani Sinha]
  + Test static routes and netplan 0.106
  + FreeBSD fix parsing of mount and mount options (#2146) [Mina Galić]
  + test: add tracking bug id (#4164)
  + tests: can't match MAC for LXD container veth due to netplan 0.106
    (#4162)
  + Add kaiwalyakoparkar as a contributor (#4156) [Kaiwalya Koparkar]
  + BSD: remove datasource_list from cloud.cfg template (#4159) [Mina Galić]
  + launching salt-minion in masterless mode (#4110) [Denis Halturin]
  + tools: fix run-container builds for rockylinux/8 git hash mismatch
    (#4161)
  + fix doc lint: spellchecker tripped up (#4160) [Mina Galić]
  + Support Ephemeral Networking for BSD (#2127)
  + Added / fixed support for static routes on OpenBSD and FreeBSD (#2157)
    [Kadir Mueller]
  + cc_rsyslog: Refactor for better multi-platform support (#4119)
    [Mina Galić] (LP: #1798055)
  + tests: fix test_lp1835584 (#4154)
  + cloud.cfg mod names: docs and rename salt_minion and set_password (#4153)
  + tests: apt support for deb822 format .sources files on mantic
  + vultr: remove check_route check (#2151) [Jonas Chevalier]
  + Update SECURITY.md (#4150) [Indrranil Pawar]
  + Update CONTRIBUTING.rst (#4149) [Indrranil Pawar]
  + Update .github-cla-signers (#4151) [Indrranil Pawar]
  + Standardise module names in cloud.cfg.tmpl to only use underscore
    (#4128) [dermotbradley]
  + tests: update test_webhook_reporting
  + Modify PR template so autoclose works
  + doc: add missing semi-colon to nocloud cmdline docs (#4120)
  + .gitignore: extend coverage pattern (#4143) [Mina Galić]
  From 23.2.2
  + Fix NoCloud kernel commandline key parsing (#4273) (Fixes: #4271)
    (LP: #2028562)
  + Fix reference before assignment (#4292) (Fixes: #4288) (LP: #2028784)
  From 23.2.1
  + nocloud: Fix parse_cmdline detection of nocloud-net datasource (#4204)
    (Fixes: 4203) (LP: #2025180)
  From 23.2
  + BSD: simplify finding MBR partitions by removing duplicate code
  [Mina Galić]
  + tests: bump pycloudlib version for mantic builds
  + network-manager: Set higher autoconnect priority for nm keyfiles (#3671)
    [Ani Sinha]
  + alpine.py: change the locale file used (#4139) [dermotbradley]
  + cc_ntp: Sync up with current FreeBSD ntp.conf (#4122) [Mina Galić]
  + config: drop refresh_rmc_and_interface as RHEL 7 no longer supported
    [Robert Schweikert]
  + docs: Add feedback button to docs
  + net/sysconfig: enable sysconfig renderer if network manager has ifcfg-rh
    plugin (#4132) [Ani Sinha]
  + For Alpine use os-release PRETTY_NAME (#4138) [dermotbradley]
  + network_manager: add a method for ipv6 static IP configuration (#4127)
    [Ani Sinha]
  + correct misnamed template file host.mariner.tmpl (#4124) [dermotbradley]
  + nm: generate ipv6 stateful dhcp config at par with sysconfig (#4115)
    [Ani Sinha]
  + Add templates for GitHub Issues
  + Add 'peers' and 'allow' directives in cc_ntp (#3124) [Jacob Salmela]
  + FreeBSD: Fix user account locking (#4114) [Mina Galić] (GH: #1854594)
  + FreeBSD: add ResizeGrowFS class to cc_growpart (#2334) [Mina Galić]
  + Update tests in Azure TestCanDevBeReformatted class (#2771)
    [Ksenija Stanojevic]
  + Replace Launchpad references with GitHub Issues
  + Fix KeyError in iproute pformat (#3287) [Dmitry Zykov]
  + schema: read_cfg_paths call init.fetch to lookup /v/l/c/instance
  + azure/errors: introduce reportable errors for imds (#3647)
    [Chris Patterson]
  + FreeBSD (and friends): better identify MBR slices (#2168)
    [Mina Galić] (LP: #2016350)
  + azure/errors: add host reporting for dhcp errors (#2167)
    [Chris Patterson]
  + net: purge blacklist_drivers across net and azure (#2160)
    [Chris Patterson]
  + net: refactor hyper-v VF filtering and apply to get_interfaces() (#2153)
    [Chris Patterson]
  + tests: avoid leaks to underlying filesystem for /etc/cloud/clean.d
    (#2251)
  + net: refactor find_candidate_nics_on_linux() to use get_interfaces()
    (#2159) [Chris Patterson]
  + resolv_conf: Allow &gt; 3 nameservers (#2152) [Major Hayden]
  + Remove mount NTFS error message (#2134) [Ksenija Stanojevic]
  + integration tests: fix image specification parsing (#2166)
  + ci: add hypothesis scheduled GH check (#2149)
  + Move supported distros list to docs (#2162)
  + Fix logger, use instance rather than module function (#2163)
  + README: Point to Github Actions build status (#2158)
  + Revert "fix linux-specific code on bsd (#2143)" (#2161)
  + Do not generate dsa and ed25519 key types when crypto FIPS mode is
    enabled (#2142) [Ani Sinha] (LP: 2017761)
  + Add documentation label automatically (#2156)
  + sources/azure: report success to host and introduce kvp module (#2141)
    [Chris Patterson]
  + setup.py: use pkg-config for udev/rules path (#2137) [dankm]
  + openstack/static: honor the DNS servers associated with a network
    (#2138) [Gonéri Le Bouder]
  + fix linux-specific code on bsd (#2143)
  + cli: schema validation of jinja template user-data (SC-1385) (#2132)
    (LP: #1881925)
  + gce: activate network discovery on every boot (#2128)
  + tests: update integration test to assert 640 across reboots (#2145)
  + Make user/vendor data sensitive and remove log permissions (#2144)
    (LP: #2013967)
  + Update kernel command line docs (SC-1457) (#2133)
  + docs: update network configuration path links (#2140) [d1r3ct0r]
  + sources/azure: report failures to host via kvp (#2136) [Chris Patterson]
  + net: Document use of `ip route append` to add routes (#2130)
  + dhcp: Add missing mocks (#2135)
  + azure/imds: retry fetching metadata up to 300 seconds (#2121)
    [Chris Patterson]
  + [1/2] DHCP: Refactor dhcp client code  (#2122)
  + azure/errors: treat traceback_base64 as string (#2131) [Chris Patterson]
  + azure/errors: introduce reportable errors (#2129) [Chris Patterson]
  + users: schema permit empty list to indicate create no users
  + azure: introduce identity module (#2116) [Chris Patterson]
  + Standardize disabling cloud-init on non-systemd (#2112)
  + Update .github-cla-signers (#2126) [Rob Tongue]
  + NoCloud: Use seedfrom protocol to determine mode (#2107)
  + rhel: Remove sysvinit files. (#2114)
  + tox.ini: set -vvvv --showlocals for pytest (#2104) [Chris Patterson]
  + Fix NoCloud kernel commandline semi-colon args
  + run-container: make the container/VM timeout configurable (#2118)
    [Paride Legovini]
  + suse: Remove sysvinit files. (#2115)
  + test: Backport assert_call_count for old requests (#2119)
  + Add "licebmi" as contributor (#2113) [Mark Martinez]
  + Adapt DataSourceScaleway to upcoming IPv6 support (#2033)
    [Louis Bouchard]
  + rhel: make sure previous-hostname file ends with a new line (#2108)
    [Ani Sinha]
  + Adding contributors for DataSourceAkamai (#2110) [acourdavAkamai]
  + Cleanup ephemeral IP routes on exception (#2100) [sxt1001]
  + commit 09a64badfb3f51b1b391fa29be19962381a4bbeb [sxt1001] (LP: #2011291)
  + Standardize kernel commandline user interface (#2093)
  + config/cc_resizefs: fix do_resize arguments (#2106) [Chris Patterson]
  + Fix test_dhclient_exits_with_error (#2105)
  + net/dhcp: catch dhclient failures and raise NoDHCPLeaseError (#2083)
    [Chris Patterson]
  + sources/azure: move pps handling out of _poll_imds() (#2075)
    [Chris Patterson]
  + tests: bump pycloudlib version (#2102)
  + schema: do not manipulate draft4 metaschema for jsonschema 2.6.0 (#2098)
  + sources/azure/imds: don't count timeout errors as connection errors
    (#2074) [Chris Patterson]
  + Fix Python 3.12 unit test failures (#2099)
  + integration tests: Refactor instance checking (#1989)
  + ci: migrate remaining jobs from travis to gh (#2085)
  + missing ending quote in instancedata docs(#2094) [Hong L]
  + refactor: stop passing log instances to cc_* handlers (#2016) [d1r3ct0r]
  + tests/vmware: fix test_no_data_access_method failure (#2092)
    [Chris Patterson]
  + Don't change permissions of netrules target (#2076) (LP: #2011783)
  + tests/sources: patch util.get_cmdline() for datasource tests (#2091)
    [Chris Patterson]
  + macs: ignore duplicate MAC for devs with driver driver qmi_wwan (#2090)
    (LP: #2008888)
  + Fedora: Enable CA handling (#2086) [František Zatloukal]
  + Send dhcp-client-identifier for InfiniBand ports (#2043) [Waleed Mousa]
  + cc_ansible: complete the examples and doc (#2082) [Yves]
  + bddeb: for dev package, derive debhelper-compat from host system
  + apport: only prompt for cloud_name when instance-data.json is absent
  + datasource: Optimize datasource detection, fix bugs (#2060)
  + Handle non existent ca-cert-config situation (#2073) [Shreenidhi Shedi]
  + sources/azure: add networking check for all source PPS (#2061)
    [Chris Patterson]
  + do not attempt dns resolution on ip addresses (#2040)
  + chore: fix style tip (#2071)
  + Fix metadata IP in instancedata.rst (#2063) [Brian Haley]
  + util: Pass deprecation schedule in deprecate_call() (#2064)
  + config: Update grub-dpkg docs (#2058)
  + docs: Cosmetic improvements and styling (#2057) [s-makin]
  + cc_grub_dpkg: Added UEFI support (#2029) [Alexander Birkner]
  + tests: Write to /var/spool/rsyslog to adhere to apparmor profile (#2059)
  + oracle-ds: prefer system_cfg over ds network config source (#1998)
    (LP: #1956788)
  + Remove dead code (#2038)
  + source: Force OpenStack when it is only option (#2045) (LP: #2008727)
  + cc_ubuntu_advantage: improve UA logs discovery
  + sources/azure: fix regressions in IMDS behavior (#2041) [Chris Patterson]
  + tests: fix test_schema (#2042)
  + dhcp: Cleanup unused kwarg (#2037)
  + sources/vmware/imc: fix-missing-catch-few-negtive-scenarios (#2027)
    [PengpengSun]
  + dhclient_hook: remove vestigal dhclient_hook command (#2015)
  + log: Add standardized deprecation tooling (SC-1312) (#2026)
  + Enable SUSE based distros for ca handling (#2036) [Robert Schweikert]
  From 23.1.2
  + Make user/vendor data sensitive and remove log permissions
    (LP: #2013967) (CVE-2023-1786)
  From 23.1.1
  + source: Force OpenStack when it is only option (#2045)
  + sources/azure: fix regressions in IMDS behavior (#2041)
    [Chris Patterson]</changelog>
  <changelog author="michal.vyskocil@gmail.com" date="1701432000">- Move fdupes call back to %install (boo#1214169)</changelog>
  <changelog author="rjschwei@suse.com" date="1702641600">- Switch build dependency to the generic distribution-release package</changelog>
  <changelog author="rjschwei@suse.com" date="1705665600">- Add cloud-init-pckg-reboot.patch (boo#1198533, bsc#1218952,  jsc#SMO-326)
  + Support reboot on package update/upgrade via the cloud-init config</changelog>
  <changelog author="rjschwei@suse.com" date="1705752000">- Add cloud-init-skip-empty-conf.patch
  + Skip tests with empty config</changelog>
  <changelog author="rjschwei@suse.com" date="1708430400">- Prepare for RPM 4.20 switch patch syntax</changelog>
  <changelog author="fcrozat@suse.com" date="1709726400">- Hardcode distribution to suse for proper cloud.cfg generation
  (bsc#1220132).</changelog>
  <changelog author="rjschwei@suse.com" date="1711627200">- Add  cloud-init-ds-deterministic.patch (bsc#1221132)
  + Do not guess a data source when checking for a CloudStack
    environment</changelog>
  <changelog author="rjschwei@suse.com" date="1712318400">- Add cloud-init-no-openstack-guess.patch (bsc#1222113)
  + Do not guess if we are running on OpenStack or not. Only recognize
    the known markers and enable cloud-init if we know for sure.</changelog>
  <changelog author="rjschwei@suse.com" date="1712318401">- Add cloud-init-no-nmcfg-needed.patch (bsc#1221726)
  + Do not require a NetworkManager config file in order to detect
    NetworkManager as the renderer</changelog>
  <changelog author="rjschwei@suse.com" date="1712664000">- Update cloud-init-no-openstack-guess.patch
  + Do not enable cloud-init on systems where there is no DMI just
    because no data source has been found. No data source means
    cloud-init will not run.</changelog>
  <changelog author="rjschwei@suse.com" date="1714392000">- Add cloud-init-usr-sudoers.patch (bsc#1223469)
  + Handle the existence of /usr/etc/sudoers to search for the expected
    include location</changelog>
  <changelog author="rjschwei@suse.com" date="1717416000">- Add cloud-init-skip-rename.patch (bsc#1219680)
  + Brute force appraoch to skip renames if the device is already present</changelog>
</package>
<package pkgid="f0cd328d8891cffd15db8bee523fb6cea598864aaa8dfe5402d91c620866bb5d" name="cloud-regionsrv-client" arch="aarch64">
  <version epoch="0" ver="10.3.0" rel="150300.13.3.1"/>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
</package>
<package pkgid="91039b015f0f50482897b159a6e26d77a27f8a942dc84f9735c067caa35d226b" name="cloud-regionsrv-client" arch="ppc64le">
  <version epoch="0" ver="10.3.0" rel="150300.13.3.1"/>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
</package>
<package pkgid="5fda9655e65db684b9d34502cbad258dd64a49187f8fa4736481947f3db8e010" name="cloud-regionsrv-client" arch="s390x">
  <version epoch="0" ver="10.3.0" rel="150300.13.3.1"/>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
</package>
<package pkgid="744c4d48a3c8a727967defe48a4df7eeec3773249e7acbeefd0355e46aaaa63a" name="cloud-regionsrv-client" arch="src">
  <version epoch="0" ver="10.3.0" rel="150300.13.3.1"/>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
</package>
<package pkgid="7cef108db4915428a7f5d5a8230c529e41f64857f12efd91b167576b4f4d307a" name="cloud-regionsrv-client" arch="x86_64">
  <version epoch="0" ver="10.3.0" rel="150300.13.3.1"/>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
</package>
<package pkgid="9bb89a6a7001b53188d4e61b360c10405a673cabfbfb699192a7cd0162085fcd" name="cloud-regionsrv-client" arch="aarch64">
  <version epoch="0" ver="10.3.0" rel="150300.13.6.1"/>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
</package>
<package pkgid="429dd7cec423d5abfa2176b25a6b5e4f5d14fc4d80b0f15f1aa1b5516ded299b" name="cloud-regionsrv-client" arch="ppc64le">
  <version epoch="0" ver="10.3.0" rel="150300.13.6.1"/>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
</package>
<package pkgid="cabbbad538cb978427cd5c2c261d41cac4355add617c133804812ba44bfbab60" name="cloud-regionsrv-client" arch="s390x">
  <version epoch="0" ver="10.3.0" rel="150300.13.6.1"/>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
</package>
<package pkgid="cf541470367ecf98ecb34ff90d61a541af2dd3d9c7714e9e639efbe715ad557e" name="cloud-regionsrv-client" arch="src">
  <version epoch="0" ver="10.3.0" rel="150300.13.6.1"/>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
</package>
<package pkgid="8d1ffcd8abe0eae20d454a9081ae9c814ab785506a9b560f2a0b32e7b2f21a53" name="cloud-regionsrv-client" arch="x86_64">
  <version epoch="0" ver="10.3.0" rel="150300.13.6.1"/>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
</package>
<package pkgid="549fa02f39f7eeb27347f486cb14ffbdeef194bb403e0c8ba882c2d77878308b" name="cloud-regionsrv-client" arch="noarch">
  <version epoch="0" ver="10.3.4" rel="150300.13.9.1"/>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
  <changelog author="rjschwei@suse.com" date="1724846400">- Update to 10.3.4
  + Modify the message when network access over a specific IP version does
    not work. This is an informational message and should not look like
    an error
  + Inform the user that LTSS registration takes a little longer
  + Add fix-for-sles12-no-trans_update.patch
    + SLE 12 family has no products with transactional-update we do not
    need to look for this condition
- From 10.3.3 (bsc#1229472)
  + Handle changes in process structure to properly identify the running
    zypper parent process and only check for 1 PID
- From 10.3.2
  + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream
- From 10.3.1 (jsc#PCT-400)
  + Add support for LTSS registration
  + Add fix-for-sles12-disable-registry.patch
    ~ No container support in SLE 12</changelog>
</package>
<package pkgid="568b23b961a24b8d55d008477ce17b858816efb2fa0316e43e643c5efc377acf" name="cloud-regionsrv-client" arch="src">
  <version epoch="0" ver="10.3.4" rel="150300.13.9.1"/>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
  <changelog author="rjschwei@suse.com" date="1724846400">- Update to 10.3.4
  + Modify the message when network access over a specific IP version does
    not work. This is an informational message and should not look like
    an error
  + Inform the user that LTSS registration takes a little longer
  + Add fix-for-sles12-no-trans_update.patch
    + SLE 12 family has no products with transactional-update we do not
    need to look for this condition
- From 10.3.3 (bsc#1229472)
  + Handle changes in process structure to properly identify the running
    zypper parent process and only check for 1 PID
- From 10.3.2
  + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream
- From 10.3.1 (jsc#PCT-400)
  + Add support for LTSS registration
  + Add fix-for-sles12-disable-registry.patch
    ~ No container support in SLE 12</changelog>
</package>
<package pkgid="ae999e5184ba0c380a5ad71dee7a5c2ef9a046c463fb081383473232ddd5d3ef" name="cloud-regionsrv-client-addon-azure" arch="noarch">
  <version epoch="0" ver="1.0.5" rel="150300.13.3.1"/>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
</package>
<package pkgid="42d7c0d8ae9348713c6386f7cf388ab4946fbcf307a9fe846c026826dbe72ba9" name="cloud-regionsrv-client-addon-azure" arch="noarch">
  <version epoch="0" ver="1.0.5" rel="150300.13.6.1"/>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
</package>
<package pkgid="1e821cf019d6514a0e5678fc13eeec4974a773c10742c42d33197c08b28b8fdc" name="cloud-regionsrv-client-addon-azure" arch="noarch">
  <version epoch="0" ver="1.0.5" rel="150300.13.9.1"/>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
  <changelog author="rjschwei@suse.com" date="1724846400">- Update to 10.3.4
  + Modify the message when network access over a specific IP version does
    not work. This is an informational message and should not look like
    an error
  + Inform the user that LTSS registration takes a little longer
  + Add fix-for-sles12-no-trans_update.patch
    + SLE 12 family has no products with transactional-update we do not
    need to look for this condition
- From 10.3.3 (bsc#1229472)
  + Handle changes in process structure to properly identify the running
    zypper parent process and only check for 1 PID
- From 10.3.2
  + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream
- From 10.3.1 (jsc#PCT-400)
  + Add support for LTSS registration
  + Add fix-for-sles12-disable-registry.patch
    ~ No container support in SLE 12</changelog>
</package>
<package pkgid="33a1374433dd2123dcc9f470a995180c1938585d9f57b156124b86cd19f67c9b" name="cloud-regionsrv-client-generic-config" arch="aarch64">
  <version epoch="0" ver="1.0.0" rel="150300.13.3.1"/>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
</package>
<package pkgid="d46066f079eb19cb4248331da9e68c66e91732f10b882aa3800b0e5311735252" name="cloud-regionsrv-client-generic-config" arch="ppc64le">
  <version epoch="0" ver="1.0.0" rel="150300.13.3.1"/>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
</package>
<package pkgid="f7e2a00cefd5959eabba3d057da935500882e7b9988a7fe337569affab8dc16b" name="cloud-regionsrv-client-generic-config" arch="s390x">
  <version epoch="0" ver="1.0.0" rel="150300.13.3.1"/>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
</package>
<package pkgid="e889e74b79c458a11512ad5a93e5763faf7878e9367920b96cef36ae6c73c3a4" name="cloud-regionsrv-client-generic-config" arch="x86_64">
  <version epoch="0" ver="1.0.0" rel="150300.13.3.1"/>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
</package>
<package pkgid="d7d159e3fe580fea182261011e921db61af8e58961984800d9dc618ebae8ef7d" name="cloud-regionsrv-client-generic-config" arch="aarch64">
  <version epoch="0" ver="1.0.0" rel="150300.13.6.1"/>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
</package>
<package pkgid="715ee7312a04fb2530d775bb0843c6e69ca0b27d7f4fbd1c9d019b3bc260e986" name="cloud-regionsrv-client-generic-config" arch="ppc64le">
  <version epoch="0" ver="1.0.0" rel="150300.13.6.1"/>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
</package>
<package pkgid="0a337bc7ec79f3d88e48cb4ba6378efc82251a44f0e3564d2e5d9471f4167451" name="cloud-regionsrv-client-generic-config" arch="s390x">
  <version epoch="0" ver="1.0.0" rel="150300.13.6.1"/>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
</package>
<package pkgid="7746fafdc52cc6403857d05170b88f6949526a1bd49dfaf4c28946964c06fbab" name="cloud-regionsrv-client-generic-config" arch="x86_64">
  <version epoch="0" ver="1.0.0" rel="150300.13.6.1"/>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
</package>
<package pkgid="2801d7095111cc584030e6b7ce3b59ea9a3981e0cf611f65eb36fb8d25361bcc" name="cloud-regionsrv-client-generic-config" arch="noarch">
  <version epoch="0" ver="1.0.0" rel="150300.13.9.1"/>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
  <changelog author="rjschwei@suse.com" date="1724846400">- Update to 10.3.4
  + Modify the message when network access over a specific IP version does
    not work. This is an informational message and should not look like
    an error
  + Inform the user that LTSS registration takes a little longer
  + Add fix-for-sles12-no-trans_update.patch
    + SLE 12 family has no products with transactional-update we do not
    need to look for this condition
- From 10.3.3 (bsc#1229472)
  + Handle changes in process structure to properly identify the running
    zypper parent process and only check for 1 PID
- From 10.3.2
  + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream
- From 10.3.1 (jsc#PCT-400)
  + Add support for LTSS registration
  + Add fix-for-sles12-disable-registry.patch
    ~ No container support in SLE 12</changelog>
</package>
<package pkgid="f66d26a57ae685e4d8d28c35f1140850e9653576c7c3d2d60586f5c2208c672e" name="cloud-regionsrv-client-plugin-azure" arch="aarch64">
  <version epoch="0" ver="2.0.0" rel="150300.13.3.1"/>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
</package>
<package pkgid="906f252e322d2ab57e42b1002b30872f80b8b43b34bb6119b98399d3bbabafeb" name="cloud-regionsrv-client-plugin-azure" arch="ppc64le">
  <version epoch="0" ver="2.0.0" rel="150300.13.3.1"/>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
</package>
<package pkgid="75a365375e29370f469d978461a915ceeca8da8bc55faf9e4e0c09267d7f2b11" name="cloud-regionsrv-client-plugin-azure" arch="s390x">
  <version epoch="0" ver="2.0.0" rel="150300.13.3.1"/>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
</package>
<package pkgid="0938f5851f75025f3fbc2c90d98e1a2ee85b3c475961c1f18829612a2fdccd7b" name="cloud-regionsrv-client-plugin-azure" arch="x86_64">
  <version epoch="0" ver="2.0.0" rel="150300.13.3.1"/>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
</package>
<package pkgid="e7fa0bf9ddd9d7f143f22afa211a01648fc15a6979b7337468d39761dec06c7e" name="cloud-regionsrv-client-plugin-azure" arch="aarch64">
  <version epoch="0" ver="2.0.0" rel="150300.13.6.1"/>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
</package>
<package pkgid="a589841816b2a4bc96ff220128d2a6760abc6bb0990a816c63a6d2c8fcdc5a7e" name="cloud-regionsrv-client-plugin-azure" arch="ppc64le">
  <version epoch="0" ver="2.0.0" rel="150300.13.6.1"/>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
</package>
<package pkgid="64564d46f5b98efd16ac02df439ba5bd78ce67983b22c50ad106bedf30f043cb" name="cloud-regionsrv-client-plugin-azure" arch="s390x">
  <version epoch="0" ver="2.0.0" rel="150300.13.6.1"/>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
</package>
<package pkgid="46803198f2d13021a1a40a877ff86f26757ab168985f3f882fe369b5facbc787" name="cloud-regionsrv-client-plugin-azure" arch="x86_64">
  <version epoch="0" ver="2.0.0" rel="150300.13.6.1"/>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
</package>
<package pkgid="066bf71dba544f3ed91a7b400821ed8903b2fb238941c230294c110a6af8371e" name="cloud-regionsrv-client-plugin-azure" arch="noarch">
  <version epoch="0" ver="2.0.0" rel="150300.13.9.1"/>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
  <changelog author="rjschwei@suse.com" date="1724846400">- Update to 10.3.4
  + Modify the message when network access over a specific IP version does
    not work. This is an informational message and should not look like
    an error
  + Inform the user that LTSS registration takes a little longer
  + Add fix-for-sles12-no-trans_update.patch
    + SLE 12 family has no products with transactional-update we do not
    need to look for this condition
- From 10.3.3 (bsc#1229472)
  + Handle changes in process structure to properly identify the running
    zypper parent process and only check for 1 PID
- From 10.3.2
  + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream
- From 10.3.1 (jsc#PCT-400)
  + Add support for LTSS registration
  + Add fix-for-sles12-disable-registry.patch
    ~ No container support in SLE 12</changelog>
</package>
<package pkgid="cc551ffa88e35192122b03cf272175e88aa0864b7c95966ae729b6d70d778de4" name="cloud-regionsrv-client-plugin-ec2" arch="aarch64">
  <version epoch="0" ver="1.0.4" rel="150300.13.3.1"/>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
</package>
<package pkgid="6449dea0e2da1c1ac4c197b193bde0528c37e27193353571f5ed3a316d48d8c8" name="cloud-regionsrv-client-plugin-ec2" arch="ppc64le">
  <version epoch="0" ver="1.0.4" rel="150300.13.3.1"/>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
</package>
<package pkgid="aa56053fa756a0d37635eb34649618499ee406a38013b75f9f31bdb360192350" name="cloud-regionsrv-client-plugin-ec2" arch="s390x">
  <version epoch="0" ver="1.0.4" rel="150300.13.3.1"/>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
</package>
<package pkgid="1c791f601cec59f47763f32e84fe7c2df7870bd10f88eec7f9a8dd9164a83aae" name="cloud-regionsrv-client-plugin-ec2" arch="x86_64">
  <version epoch="0" ver="1.0.4" rel="150300.13.3.1"/>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
</package>
<package pkgid="b55e0548178c95e33631ed7fb279db9d7cdf1767da958f447abefbb2a0af4e21" name="cloud-regionsrv-client-plugin-ec2" arch="aarch64">
  <version epoch="0" ver="1.0.4" rel="150300.13.6.1"/>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
</package>
<package pkgid="ea84184055043e37917b5ace2701e402131a4a4aa07e0f4d1536eff3a0f7e06b" name="cloud-regionsrv-client-plugin-ec2" arch="ppc64le">
  <version epoch="0" ver="1.0.4" rel="150300.13.6.1"/>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
</package>
<package pkgid="44dddf9a2b3dc899fb00b0971f374af903f6ae6b22ea285fdc653da3f58b4e5b" name="cloud-regionsrv-client-plugin-ec2" arch="s390x">
  <version epoch="0" ver="1.0.4" rel="150300.13.6.1"/>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
</package>
<package pkgid="a6a00fe5eaf270eb291836699738fdeb20ad291457e048e27643ff943ebc0c17" name="cloud-regionsrv-client-plugin-ec2" arch="x86_64">
  <version epoch="0" ver="1.0.4" rel="150300.13.6.1"/>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
</package>
<package pkgid="32c770fdaaf76067db9f9b845365822a2846d56562521840993f078ab90815b7" name="cloud-regionsrv-client-plugin-ec2" arch="noarch">
  <version epoch="0" ver="1.0.4" rel="150300.13.9.1"/>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
  <changelog author="rjschwei@suse.com" date="1724846400">- Update to 10.3.4
  + Modify the message when network access over a specific IP version does
    not work. This is an informational message and should not look like
    an error
  + Inform the user that LTSS registration takes a little longer
  + Add fix-for-sles12-no-trans_update.patch
    + SLE 12 family has no products with transactional-update we do not
    need to look for this condition
- From 10.3.3 (bsc#1229472)
  + Handle changes in process structure to properly identify the running
    zypper parent process and only check for 1 PID
- From 10.3.2
  + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream
- From 10.3.1 (jsc#PCT-400)
  + Add support for LTSS registration
  + Add fix-for-sles12-disable-registry.patch
    ~ No container support in SLE 12</changelog>
</package>
<package pkgid="cc24c13100a6110a01534f1c2e05153d18f068b21789744a61743ff7b88f23be" name="cloud-regionsrv-client-plugin-gce" arch="aarch64">
  <version epoch="0" ver="1.0.0" rel="150300.13.3.1"/>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
</package>
<package pkgid="aa63b4ed8103e81512f9cff798ed631af0f0db0ff5c73d9fe7762a005c4accfd" name="cloud-regionsrv-client-plugin-gce" arch="ppc64le">
  <version epoch="0" ver="1.0.0" rel="150300.13.3.1"/>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
</package>
<package pkgid="15ab651d8ffedc3b7df702bf00622e29aaf6fc034d741cd1044fb2b485dd4491" name="cloud-regionsrv-client-plugin-gce" arch="s390x">
  <version epoch="0" ver="1.0.0" rel="150300.13.3.1"/>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
</package>
<package pkgid="a76fdf81835c6c2bcb2945cbd56077de19c8771ba9588af62f82452ce260262e" name="cloud-regionsrv-client-plugin-gce" arch="x86_64">
  <version epoch="0" ver="1.0.0" rel="150300.13.3.1"/>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
</package>
<package pkgid="7ad84442228758fca07ba7ff091a5abc31d9aa66f6a543fa8c8b043444bab078" name="cloud-regionsrv-client-plugin-gce" arch="aarch64">
  <version epoch="0" ver="1.0.0" rel="150300.13.6.1"/>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
</package>
<package pkgid="26b10c2dd23935aa097db41669e6932c09d4ba44ce2eb8ab27487988c744ba1f" name="cloud-regionsrv-client-plugin-gce" arch="ppc64le">
  <version epoch="0" ver="1.0.0" rel="150300.13.6.1"/>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
</package>
<package pkgid="93a71b1fb3de476deab6eb735d59824994c7cb782c90faf69ecc1079b6d6fde2" name="cloud-regionsrv-client-plugin-gce" arch="s390x">
  <version epoch="0" ver="1.0.0" rel="150300.13.6.1"/>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
</package>
<package pkgid="9da0bc0c8c8670649ca5317e10c5c48b8021b4f52a8ca42eaa88376c4e805144" name="cloud-regionsrv-client-plugin-gce" arch="x86_64">
  <version epoch="0" ver="1.0.0" rel="150300.13.6.1"/>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
</package>
<package pkgid="8982b3972892132e2dc9d1c1575cfbf0557a0c77ce6823f985a1bd1bd9fdaf99" name="cloud-regionsrv-client-plugin-gce" arch="noarch">
  <version epoch="0" ver="1.0.0" rel="150300.13.9.1"/>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
  <changelog author="jesus.bv@suse.com" date="1700740800">- Update to version 10.1.4 (bsc#1217451)
  + Fetch cert for new update server during failover</changelog>
  <changelog author="rjschwei@suse.com" date="1701864000">- Update to version 10.1.5 (bsc#1217583)
  + Fix fallback path when IPv6 network path is not usable
  + Enable an IPv6 fallback path in IMDS access if it cannot be accessed
    over IPv4
  + Enable IMDS access over IPv6</changelog>
  <changelog author="rjschwei@suse.com" date="1706097600">- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
  + Fix the algorithm to determine the region from the availability zone
    information retrieved from IMDS.
- Update to version 10.1.6
  + Support specifying an IPv6 address for a manually configured target
    update server.</changelog>
  <changelog author="rjschwei@suse.com" date="1708603200">- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
  + Fix the failover path to a new target update server. At present a new
    server is not found since credential validation fails. We targeted
    the server detected in down condition to verify the credentials instead
    of the replacement server.</changelog>
  <changelog author="rjschwei@suse.com" date="1715256000">- Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
  + In addition to logging, write message to stderr when registration fails
  + Detect transactional-update system with read only setup and use
    the transactional-update command to register
  + Handle operation in a different target root directory for credentials
    checking</changelog>
  <changelog author="jesus.bv@suse.com" date="1719921600">- Update to version 10.3.0 (bsc#1227308, bsc#1222985)
  + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
  + Add running command as root through sudoers file</changelog>
  <changelog author="rjschwei@suse.com" date="1723723200">- Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
  + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.</changelog>
  <changelog author="rjschwei@suse.com" date="1724846400">- Update to 10.3.4
  + Modify the message when network access over a specific IP version does
    not work. This is an informational message and should not look like
    an error
  + Inform the user that LTSS registration takes a little longer
  + Add fix-for-sles12-no-trans_update.patch
    + SLE 12 family has no products with transactional-update we do not
    need to look for this condition
- From 10.3.3 (bsc#1229472)
  + Handle changes in process structure to properly identify the running
    zypper parent process and only check for 1 PID
- From 10.3.2
  + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream
- From 10.3.1 (jsc#PCT-400)
  + Add support for LTSS registration
  + Add fix-for-sles12-disable-registry.patch
    ~ No container support in SLE 12</changelog>
</package>
<package pkgid="daccd205d3f33241e8196e50dc9197ab0b196c64f8e468cda1bd9a9424c733e0" name="cluster-md-kmp-64kb" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.14.1"/>
  <changelog author="tiwai@suse.de" date="1719662400">- gpiolib: cdev: Disallow reconfiguration without direction
  (uAPI v1) (git-fixes).
- gpio: davinci: Validate the obtained number of IRQs (git-fixes).
- commit 919ebd1</changelog>
  <changelog author="tiwai@suse.de" date="1719748800">- i2c: testunit: discard write requests while old command is
  running (git-fixes).
- i2c: testunit: don't erase registers after STOP (git-fixes).
- mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
  (git-fixes).
- mmc: sdhci: Do not invert write-protect twice (git-fixes).
- mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
  (git-fixes).
- mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
  (git-fixes).
- commit 448487d</changelog>
  <changelog author="tiwai@suse.de" date="1719748801">- crypto: iaa - Account for cpu-less numa nodes (bsc#1227190).
- commit cd600aa</changelog>
  <changelog author="tiwai@suse.de" date="1719748802">- crypto: deflate - Add aliases to deflate (bsc#1227190).
- commit 27ffd92</changelog>
  <changelog author="tiwai@suse.de" date="1719835200">- ata: ahci: Clean up sysfs file on error (git-fixes).
- ata: libata-core: Fix double free on error (git-fixes).
- ata,scsi: libata-core: Do not leak memory for ata_port struct
  members (git-fixes).
- ata: libata-core: Fix null pointer dereference on error
  (git-fixes).
- kbuild: Fix build target deb-pkg: ln: failed to create hard link
  (git-fixes).
- kbuild: doc: Update default INSTALL_MOD_DIR from extra to
  updates (git-fixes).
- kbuild: Install dtb files as 0644 in Makefile.dtbinst
  (git-fixes).
- counter: ti-eqep: enable clock at probe (git-fixes).
- iio: chemical: bme680: Fix sensor data read operation
  (git-fixes).
- iio: chemical: bme680: Fix overflows in compensate() functions
  (git-fixes).
- iio: chemical: bme680: Fix calibration data variable
  (git-fixes).
- iio: chemical: bme680: Fix pressure value output (git-fixes).
- iio: accel: fxls8962af: select IIO_BUFFER &amp; IIO_KFIFO_BUF
  (git-fixes).
- iio: adc: ad7266: Fix variable checking bug (git-fixes).
- iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
  (git-fixes).
- serial: bcm63xx-uart: fix tx after conversion to
  uart_port_tx_limited() (git-fixes).
- serial: core: introduce uart_port_tx_limited_flags()
  (git-fixes).
- Revert "serial: core: only stop transmit when HW fifo is empty"
  (git-fixes).
- tty: mcf: MCF54418 has 10 UARTS (git-fixes).
- usb: gadget: aspeed_udc: fix device address configuration
  (git-fixes).
- usb: dwc3: core: remove lock of otg mode during gadget
  suspend/resume to avoid deadlock (git-fixes).
- usb: typec: ucsi: glink: fix child node release in probe
  function (git-fixes).
- usb: musb: da8xx: fix a resource leak in probe() (git-fixes).
- usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  (git-fixes).
- usb: gadget: printer: fix races against disable (git-fixes).
- PCI/MSI: Fix UAF in msi_capability_init (git-fixes).
- commit a2ea5a9</changelog>
  <changelog author="ptesarik@suse.com" date="1719835201">- net: ena: Fix redundant device NUMA node override
  (jsc#PED-8688).
- commit 6ad6684</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835202">- tcp: do not accept ACK of bytes we never sent (CVE-2023-52881
  bsc#1225611).
- commit 16404a6</changelog>
  <changelog author="mhocko@suse.com" date="1719835203">- Update
  patches.suse/1352-drm-amdgpu-Fix-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52883
  bsc#1226630).
- Update
  patches.suse/9p-add-missing-locking-around-taking-dentry-fid-list.patch
  (git-fixes CVE-2024-39463 bsc#1227090).
- Update
  patches.suse/ALSA-Fix-deadlocks-with-kctl-removals-at-disconnecti.patch
  (stable-fixes CVE-2024-38600 bsc#1226864).
- Update
  patches.suse/ALSA-core-Fix-NULL-module-pointer-assignment-at-card.patch
  (git-fixes CVE-2024-38605 bsc#1226740).
- Update
  patches.suse/ALSA-hda-Fix-possible-null-ptr-deref-when-assigning-.patch
  (git-fixes CVE-2023-52806 bsc#1225554).
- Update
  patches.suse/ALSA-hda-cs_dsp_ctl-Use-private_free-for-control-cle.patch
  (git-fixes CVE-2024-38388 bsc#1226890).
- Update
  patches.suse/ALSA-timer-Set-lower-bound-of-start-tick-time.patch
  (stable-fixes git-fixes CVE-2024-38618 bsc#1226754).
- Update
  patches.suse/ASoC-kirkwood-Fix-potential-NULL-dereference.patch
  (git-fixes CVE-2024-38550 bsc#1226633).
- Update
  patches.suse/ASoC-mediatek-Assign-dummy-when-codec-not-specified-.patch
  (git-fixes CVE-2024-38551 bsc#1226761).
- Update
  patches.suse/Bluetooth-btusb-Add-date-evt_skb-is-NULL-check.patch
  (git-fixes CVE-2023-52833 bsc#1225595).
- Update
  patches.suse/Bluetooth-hci_core-Fix-possible-buffer-overflow.patch
  (git-fixes CVE-2024-26889).
- Update
  patches.suse/HID-uclogic-Fix-user-memory-access-bug-in-uclogic_pa.patch
  (git-fixes CVE-2023-52866 bsc#1225120).
- Update
  patches.suse/IB-mlx5-Fix-init-stage-error-handling-to-avoid-doubl.patch
  (jsc#PED-6864 CVE-2023-52851 bsc#1225587).
- Update
  patches.suse/Input-cyapa-add-missing-input-core-locking-to-suspen.patch
  (git-fixes CVE-2023-52884 bsc#1226764).
- Update
  patches.suse/Input-synaptics-rmi4-fix-use-after-free-in-rmi_unreg.patch
  (git-fixes CVE-2023-52840 bsc#1224928).
- Update
  patches.suse/KEYS-trusted-Do-not-use-WARN-when-encode-fails.patch
  (git-fixes CVE-2024-36975 bsc#1226520).
- Update
  patches.suse/KEYS-trusted-Fix-memory-leak-in-tpm2_key_encode.patch
  (git-fixes CVE-2024-36967 bsc#1226131).
- Update
  patches.suse/RDMA-cma-Fix-kmemleak-in-rdma_core-observed-during-b.patch
  (git-fixes CVE-2024-38539 bsc#1226608).
- Update patches.suse/RDMA-hns-Fix-UAF-for-cq-async-event.patch
  (git-fixes CVE-2024-38545 bsc#1226595).
- Update
  patches.suse/RDMA-hns-Fix-deadlock-on-SRQ-async-events.patch
  (git-fixes CVE-2024-38591 bsc#1226738).
- Update
  patches.suse/RDMA-hns-Modify-the-print-level-of-CQE-error.patch
  (git-fixes CVE-2024-38590 bsc#1226839).
- Update
  patches.suse/RDMA-rxe-Fix-seg-fault-in-rxe_comp_queue_pkt.patch
  (git-fixes CVE-2024-38544 bsc#1226597).
- Update
  patches.suse/SUNRPC-Fix-RPC-client-cleaned-up-the-freed-pipefs-de.patch
  (git-fixes CVE-2023-52803 bsc#1225008).
- Update patches.suse/af_unix-Clear-stale-u-oob_skb.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-35970 bsc#1224584).
- Update
  patches.suse/af_unix-Drop-oob_skb-ref-before-purging-queue-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26750 bsc#1222617).
- Update
  patches.suse/af_unix-Fix-task-hung-while-purging-oob_skb-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26780 bsc#1222588).
- Update
  patches.suse/af_unix-Update-unix_sk-sk-oob_skb-under-sk_receive_queue-lock.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-36972 bsc#1226163).
- Update
  patches.suse/arm64-Restrict-CPU_BIG_ENDIAN-to-GNU-as-or-LLVM-IAS-.patch
  (git-fixes CVE-2023-52750 bsc#1225485).
- Update
  patches.suse/atl1c-Work-around-the-DMA-RX-overflow-issue.patch
  (git-fixes CVE-2023-52834 bsc#1225599).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issue-of-net_device.patch
  (git-fixes CVE-2024-38554 bsc#1226742).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issues-of-ax25_dev.patch
  (git-fixes CVE-2024-38602 bsc#1226613).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-reorder-of-WRITE-lqueued.patch
  (bsc#1225605 CVE-2024-38384 bsc#1226938).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-resetting-io-stat.patch
  (bsc#1225605 CVE-2024-38663 bsc#1226939).
- Update
  patches.suse/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch
  (git-fixes CVE-2024-38540 bsc#1226582).
- Update
  patches.suse/bonding-stop-the-device-in-bond_setup_by_slave.patch
  (git-fixes CVE-2023-52784 bsc#1224946).
- Update
  patches.suse/can-dev-can_put_echo_skb-don-t-crash-kernel-if-can_p.patch
  (git-fixes CVE-2023-52878 bsc#1225000).
- Update
  patches.suse/clk-mediatek-clk-mt2701-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52875 bsc#1225096).
- Update
  patches.suse/clk-mediatek-clk-mt6765-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52870 bsc#1224937).
- Update
  patches.suse/clk-mediatek-clk-mt6779-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52873 bsc#1225589).
- Update
  patches.suse/clk-mediatek-clk-mt6797-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52865 bsc#1225086).
- Update
  patches.suse/clk-mediatek-clk-mt7629-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52858 bsc#1225566).
- Update
  patches.suse/clk-mediatek-clk-mt7629-eth-Add-check-for-mtk_alloc_.patch
  (git-fixes CVE-2023-52876 bsc#1225036).
- Update
  patches.suse/cppc_cpufreq-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38573 bsc#1226739).
- Update patches.suse/cpufreq-exit-callback-is-optional.patch
  (git-fixes CVE-2024-38615 bsc#1226592).
- Update patches.suse/crypto-bcm-Fix-pointer-arithmetic.patch
  (git-fixes CVE-2024-38579 bsc#1226637).
- Update
  patches.suse/crypto-pcrypt-Fix-hungtask-for-PADATA_RESET.patch
  (git-fixes CVE-2023-52813 bsc#1225527).
- Update patches.suse/cxl-mem-Fix-shutdown-order.patch (git-fixes
  CVE-2023-52849 bsc#1224949).
- Update
  patches.suse/cxl-region-Do-not-try-to-cleanup-after-cxl_region_se.patch
  (git-fixes CVE-2023-52792 bsc#1225477).
- Update patches.suse/cxl-region-Fix-cxlr_pmem-leaks.patch
  (git-fixes CVE-2024-38391 bsc#1226894).
- Update
  patches.suse/dma-buf-sw-sync-don-t-enable-IRQ-from-sync_print_obj.patch
  (git-fixes CVE-2024-38780 bsc#1226886).
- Update
  patches.suse/dma-mapping-benchmark-fix-node-id-validation.patch
  (git-fixes CVE-2024-34777 bsc#1226796).
- Update
  patches.suse/dma-mapping-benchmark-handle-NUMA_NO_NODE-correctly.patch
  (git-fixes CVE-2024-39277 bsc#1226909).
- Update
  patches.suse/dmaengine-idxd-Avoid-unnecessary-destruction-of-file.patch
  (git-fixes CVE-2024-38629 bsc#1226905).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Pola.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52819
  bsc#1225532).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-SMU7.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52818
  bsc#1225530).
- Update
  patches.suse/drm-amd-check-num-of-link-levels-when-update-pcie-pa.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52812
  bsc#1225564).
- Update
  patches.suse/drm-amd-display-Avoid-NULL-dereference-of-timing-gen.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52753
  bsc#1225478).
- Update
  patches.suse/drm-amd-display-Fix-division-by-zero-in-setup_dsc_co.patch
  (stable-fixes CVE-2024-36969 bsc#1226155).
- Update
  patches.suse/drm-amd-display-Fix-null-pointer-dereference-in-erro.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52862
  bsc#1225015).
- Update
  patches.suse/drm-amd-display-Fix-potential-index-out-of-bounds-in.patch
  (git-fixes CVE-2024-38552 bsc#1226767).
- Update
  patches.suse/drm-amd-display-fix-a-NULL-pointer-dereference-in-am.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52773
  bsc#1225041).
- Update
  patches.suse/drm-amd-display-fixed-integer-types-and-null-check-l.patch
  (git-fixes CVE-2024-26767).
- Update
  patches.suse/drm-amdgpu-Fix-a-null-pointer-access-when-the-smc_rr.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52817
  bsc#1225569).
- Update
  patches.suse/drm-amdgpu-Fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch
  (git-fixes CVE-2024-39291 bsc#1226934).
- Update
  patches.suse/drm-amdgpu-Fix-potential-null-pointer-derefernce.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52814
  bsc#1225565).
- Update
  patches.suse/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch
  (stable-fixes CVE-2024-39471 bsc#1227096).
- Update
  patches.suse/drm-amdgpu-mes-fix-use-after-free-issue.patch
  (stable-fixes CVE-2024-38581 bsc#1226657).
- Update
  patches.suse/drm-amdgpu-vkms-fix-a-possible-null-pointer-derefere.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52815
  bsc#1225568).
- Update
  patches.suse/drm-amdkfd-Fix-a-race-condition-of-vram-buffer-unref.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52825
  bsc#1225076).
- Update
  patches.suse/drm-amdkfd-Fix-shift-out-of-bounds-issue.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52816
  bsc#1225529).
- Update
  patches.suse/drm-bridge-cdns-mhdp8546-Fix-possible-null-pointer-d.patch
  (git-fixes CVE-2024-38548).
- Update
  patches.suse/drm-bridge-it66121-Fix-invalid-connector-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52861
  bsc#1224941).
- Update
  patches.suse/drm-bridge-lt8912b-Fix-crash-on-bridge-detach.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52856
  bsc#1224932).
- Update
  patches.suse/drm-mediatek-Add-0-size-check-to-mtk_drm_gem_obj.patch
  (git-fixes CVE-2024-38549 bsc#1226735).
- Update
  patches.suse/drm-mediatek-Fix-coverity-issue-with-unintentional-i.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52857
  bsc#1225581).
- Update
  patches.suse/drm-mediatek-Init-ddp_comp-with-devm_kcalloc.patch
  (git-fixes CVE-2024-38592 bsc#1226844).
- Update
  patches.suse/drm-msm-a6xx-Avoid-a-nullptr-dereference-when-speedb.patch
  (git-fixes CVE-2024-38390 bsc#1226891).
- Update
  patches.suse/drm-msm-dpu-Add-callback-function-pointer-check-befo.patch
  (git-fixes CVE-2024-38622 bsc#1226856).
- Update
  patches.suse/drm-panel-fix-a-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52821
  bsc#1225022).
- Update
  patches.suse/drm-panel-panel-tpo-tpg110-fix-a-possible-null-point.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52826
  bsc#1225077).
- Update patches.suse/drm-radeon-possible-buffer-overflow.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52867
  bsc#1225009).
- Update
  patches.suse/drm-vc4-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38546 bsc#1226593).
- Update
  patches.suse/drm-vmwgfx-Fix-invalid-reads-in-fence-signaled-event.patch
  (git-fixes CVE-2024-36960 bsc#1225872).
- Update
  patches.suse/drm-zynqmp_dpsub-Always-register-bridge.patch
  (git-fixes CVE-2024-38664 bsc#1226941).
- Update
  patches.suse/e1000e-change-usleep_range-to-udelay-in-PHY-mdic-acc.patch
  (CVE-2024-39296 bsc#1226989 CVE-2024-36887 bsc#1225731).
- Update
  patches.suse/ecryptfs-Fix-buffer-size-for-tag-66-packet.patch
  (git-fixes CVE-2024-38578 bsc#1226634).
- Update
  patches.suse/efi-libstub-only-free-priv.runtime_map-when-allocate.patch
  (git-fixes CVE-2024-33619 bsc#1226768).
- Update
  patches.suse/fbdev-imsttfb-fix-a-resource-leak-in-probe.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52838
  bsc#1225031).
- Update
  patches.suse/fs-9p-only-translate-RWX-permissions-for-plain-9P200.patch
  (git-fixes CVE-2024-36964 bsc#1225866).
- Update
  patches.suse/fs-jfs-Add-check-for-negative-db_l2nbperpage.patch
  (git-fixes CVE-2023-52810 bsc#1225557).
- Update
  patches.suse/fs-jfs-Add-validity-check-for-db_maxag-and-db_agpref.patch
  (git-fixes CVE-2023-52804 bsc#1225550).
- Update
  patches.suse/ftrace-Fix-possible-use-after-free-issue-in-ftrace_location.patch
  (git-fixes CVE-2024-38588 bsc#1226837).
- Update
  patches.suse/genirq-irqdesc-Prevent-use-after-free-in-irq_find_at.patch
  (git-fixes CVE-2024-38385 bsc#1227085).
- Update patches.suse/gfs2-ignore-negated-quota-changes.patch
  (git-fixes CVE-2023-52759 bsc#1225560).
- Update
  patches.suse/hid-cp2112-Fix-duplicate-workqueue-initialization.patch
  (git-fixes CVE-2023-52853 bsc#1224988).
- Update
  patches.suse/hwmon-axi-fan-control-Fix-possible-NULL-pointer-dere.patch
  (git-fixes CVE-2023-52863 bsc#1225586).
- Update
  patches.suse/i2c-acpi-Unbind-mux-adapters-before-delete.patch
  (git-fixes CVE-2024-39362 bsc#1226995).
- Update
  patches.suse/i2c-core-Run-atomic-i2c-xfer-when-preemptible.patch
  (git-fixes CVE-2023-52791 bsc#1225108).
- Update
  patches.suse/i3c-master-mipi-i3c-hci-Fix-a-kernel-panic-for-acces.patch
  (git-fixes CVE-2023-52763 bsc#1225570).
- Update
  patches.suse/i3c-mipi-i3c-hci-Fix-out-of-bounds-access-in-hci_dma.patch
  (git-fixes CVE-2023-52766).
- Update
  patches.suse/i915-perf-Fix-NULL-deref-bugs-with-drm_dbg-calls.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52788
  bsc#1225106).
- Update
  patches.suse/igb-Fix-string-truncation-warnings-in-igb_set_fw_ver.patch
  (git-fixes CVE-2024-36010 bsc#1225594).
- Update
  patches.suse/iommu-vt-d-Fix-WARN_ON-in-iommu-probe-path.patch
  (git-fixes CVE-2024-35957 bsc#1224673).
- Update
  patches.suse/iommufd-Fix-missing-update-of-domains_itree-after-splitting-iopt
  (jsc#PED-7779 jsc#PED-7780 CVE-2023-52801 bsc#1225006).
- Update
  patches.suse/ipvlan-add-ipvlan_route_v6_outbound-helper.patch
  (git-fixes CVE-2023-52796 bsc#1224930).
- Update
  patches.suse/jffs2-prevent-xattr-node-from-overflowing-the-eraseblock.patch
  (git-fixes CVE-2024-38599 bsc#1226848).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-dbFindLeaf.patch
  (git-fixes CVE-2023-52799 bsc#1225472).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-diAlloc.patch
  (git-fixes CVE-2023-52805 bsc#1225553).
- Update
  patches.suse/kunit-fortify-Fix-mismatched-kvalloc-vfree-usage.patch
  (git-fixes CVE-2024-38617 bsc#1226859).
- Update
  patches.suse/lib-generic-radix-tree.c-Don-t-overflow-in-peek.patch
  (git-fixes CVE-2021-47432 bsc#1225391).
- Update
  patches.suse/lib-test_hmm.c-handle-src_pfns-and-dst_pfns-allocati.patch
  (git-fixes CVE-2024-38543 bsc#1226594).
- Update
  patches.suse/locking-ww_mutex-test-Fix-potential-workqueue-corrup.patch
  (bsc#1219953 CVE-2023-52836 bsc#1225609).
- Update
  patches.suse/md-Don-t-ignore-suspended-array-in-md_check_recovery-1baa.patch
  (bsc#1219596 CVE-2024-26758).
- Update
  patches.suse/media-atomisp-ssh_css-Fix-a-null-pointer-dereference.patch
  (git-fixes CVE-2024-38547 bsc#1226632).
- Update
  patches.suse/media-bttv-fix-use-after-free-error-due-to-btv-timeo.patch
  (git-fixes CVE-2023-52847 bsc#1225588).
- Update
  patches.suse/media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch
  (git-fixes CVE-2023-52764 bsc#1225571).
- Update
  patches.suse/media-hantro-Check-whether-reset-op-is-defined-befor.patch
  (git-fixes CVE-2023-52850 bsc#1225014).
- Update
  patches.suse/media-i2c-et8ek8-Don-t-strip-remove-function-when-dr.patch
  (git-fixes CVE-2024-38611 bsc#1226760).
- Update
  patches.suse/media-imon-fix-access-to-invalid-resource-for-the-se.patch
  (git-fixes CVE-2023-52754 bsc#1225490).
- Update
  patches.suse/media-lgdt3306a-Add-a-check-against-null-pointer-def.patch
  (stable-fixes CVE-2022-48772 bsc#1226976).
- Update
  patches.suse/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch
  (git-fixes CVE-2024-38621 bsc#1226895).
- Update
  patches.suse/media-vidtv-mux-Add-check-and-kfree-for-kstrdup.patch
  (git-fixes CVE-2023-52841 bsc#1225592).
- Update patches.suse/media-vidtv-psi-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52844 bsc#1225590).
- Update
  patches.suse/mfd-qcom-spmi-pmic-Fix-revid-implementation.patch
  (git-fixes CVE-2023-52765 bsc#1225029).
- Update
  patches.suse/misc-microchip-pci1xxxx-fix-double-free-in-the-error.patch
  (git-fixes CVE-2024-36973 bsc#1226457).
- Update
  patches.suse/net-hns3-fix-out-of-bounds-access-may-occur-when-coa.patch
  (git-fixes CVE-2023-52807 bsc#1225097).
- Update
  patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch
  (git-fixes CVE-2024-36962 bsc#1225827).
- Update
  patches.suse/net-mlx5-Fix-peer-devlink-set-for-SF-representor-dev.patch
  (git-fixes CVE-2024-38595 bsc#1226741).
- Update
  patches.suse/net-mlx5e-Track-xmit-submission-to-PTP-WQ-after-popu.patch
  (jsc#PED-3311 CVE-2023-52782 bsc#1225103).
- Update
  patches.suse/net-mvneta-fix-calls-to-page_pool_get_stats.patch
  (git-fixes CVE-2023-52780 bsc#1224933).
- Update
  patches.suse/net-wangxun-fix-kernel-panic-due-to-null-pointer.patch
  (git-fixes CVE-2023-52783 bsc#1225104).
- Update
  patches.suse/netfilter-complete-validation-of-user-input.patch
  (git-fixes CVE-2024-35896 bsc#1224662 CVE-2024-35962
  bsc#1224583).
- Update
  patches.suse/nfc-nci-Fix-uninit-value-in-nci_rx_work.patch
  (git-fixes CVE-2024-38381 bsc#1226878).
- Update
  patches.suse/nilfs2-fix-nilfs_empty_dir-misjudgment-and-long-loop.patch
  (git-fixes CVE-2024-39469 bsc#1226992).
- Update
  patches.suse/nilfs2-fix-potential-hang-in-nilfs_detach_log_writer.patch
  (git-fixes CVE-2024-38582 bsc#1226658).
- Update
  patches.suse/nilfs2-fix-use-after-free-of-timer-for-log-writer-th.patch
  (git-fixes CVE-2024-38583 bsc#1226777).
- Update
  patches.suse/of-module-add-buffer-overflow-check-in-of_modalias.patch
  (git-fixes CVE-2024-38541 bsc#1226587).
- Update
  patches.suse/padata-Fix-refcnt-handling-in-padata_free_shell.patch
  (git-fixes CVE-2023-52854 bsc#1225584).
- Update
  patches.suse/perf-core-Bail-out-early-if-the-request-AUX-area-is-out-of-bound.patch
  (git-fixes CVE-2023-52835 bsc#1225602).
- Update
  patches.suse/platform-x86-wmi-Fix-opening-of-char-device.patch
  (git-fixes CVE-2023-52864 bsc#1225132).
- Update
  patches.suse/powerpc-pseries-iommu-LPAR-panics-during-boot-up-wit.patch
  (bsc#1222011 ltc#205900 CVE-2024-36926 bsc#1225829).
- Update patches.suse/pstore-platform-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52869 bsc#1225050).
- Update
  patches.suse/remoteproc-mediatek-Make-sure-IPI-buffer-fits-in-L2T.patch
  (git-fixes CVE-2024-36965 bsc#1226149).
- Update
  patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch
  (git-fixes CVE-2024-38601 bsc#1226876).
- Update
  patches.suse/s390-dasd-protect-device-queue-against-concurrent-access.patch
  (git-fixes bsc#1217481 CVE-2023-52774 bsc#1225572).
- Update
  patches.suse/scsi-hisi_sas-Set-debugfs_dir-pointer-to-NULL-after-removing-debugfs.patch
  (git-fixes CVE-2023-52808 bsc#1225555).
- Update
  patches.suse/scsi-ibmvfc-Remove-BUG_ON-in-the-case-of-an-empty-ev.patch
  (bsc#1209834 ltc#202097 CVE-2023-52811 bsc#1225559).
- Update
  patches.suse/scsi-libfc-Fix-potential-NULL-pointer-dereference-in-fc_lport_ptp_setup.patch
  (git-fixes CVE-2023-52809 bsc#1225556).
- Update
  patches.suse/scsi-lpfc-Move-NPIV-s-transport-unregistration-to-af.patch
  (bsc#1221777 CVE-2024-36952 bsc#1225898).
- Update
  patches.suse/scsi-lpfc-Release-hbalock-before-calling-lpfc_worker.patch
  (bsc#1221777 CVE-2024-36924 bsc#1225820).
- Update
  patches.suse/serial-max3100-Lock-port-lock-when-calling-uart_hand.patch
  (git-fixes CVE-2024-38634 bsc#1226868).
- Update
  patches.suse/serial-max3100-Update-uart_driver_registered-on-driv.patch
  (git-fixes CVE-2024-38633 bsc#1226867).
- Update
  patches.suse/soc-qcom-llcc-Handle-a-second-device-without-data-co.patch
  (git-fixes CVE-2023-52871 bsc#1225534).
- Update
  patches.suse/soundwire-cadence-fix-invalid-PDI-offset.patch
  (stable-fixes CVE-2024-38635 bsc#1226863).
- Update patches.suse/speakup-Fix-sizeof-vs-ARRAY_SIZE-bug.patch
  (git-fixes CVE-2024-38587 bsc#1226780).
- Update patches.suse/spi-Fix-null-dereference-on-suspend.patch
  (git-fixes CVE-2023-52749 bsc#1225476).
- Update
  patches.suse/thermal-core-prevent-potential-string-overflow.patch
  (git-fixes CVE-2023-52868 bsc#1225044).
- Update
  patches.suse/thermal-drivers-qcom-lmh-Check-for-SCM-availability-.patch
  (git-fixes CVE-2024-39466 bsc#1227089).
- Update
  patches.suse/thermal-drivers-tsens-Fix-null-pointer-dereference.patch
  (git-fixes CVE-2024-38571 bsc#1226737).
- Update
  patches.suse/thermal-intel-powerclamp-fix-mismatch-in-get-functio.patch
  (git-fixes CVE-2023-52794 bsc#1225028).
- Update
  patches.suse/tls-fix-NULL-deref-on-tls_sw_splice_eof-with-empty-r.patch
  (jsc#PED-6831 CVE-2023-52767 bsc#1224998).
- Update
  patches.suse/tpm_tis_spi-Account-for-SPI-header-when-allocating-T.patch
  (git-fixes CVE-2024-36477 bsc#1226840).
- Update
  patches.suse/tracing-Have-trace_event_file-have-ref-counters.patch
  (git-fixes CVE-2023-52879 bsc#1225101).
- Update
  patches.suse/tracing-trigger-Fix-to-return-error-if-failed-to-alloc-snapshot.patch
  (git-fixes CVE-2024-26920).
- Update
  patches.suse/tty-n_gsm-fix-race-condition-in-status-line-change-o.patch
  (git-fixes CVE-2023-52872 bsc#1225591).
- Update
  patches.suse/tty-n_gsm-require-CAP_NET_ADMIN-to-attach-N_GSM0710-.patch
  (bsc#1222619 CVE-2023-52880).
- Update
  patches.suse/tty-vcc-Add-check-for-kstrdup-in-vcc_probe.patch
  (git-fixes CVE-2023-52789 bsc#1225180).
- Update
  patches.suse/usb-config-fix-iteration-issue-in-usb_get_bos_descri.patch
  (git-fixes CVE-2023-52781 bsc#1225092).
- Update
  patches.suse/usb-dwc3-Wait-unconditionally-after-issuing-EndXfer-.patch
  (git-fixes CVE-2024-36977 bsc#1226513).
- Update
  patches.suse/usb-gadget-u_audio-Fix-race-condition-use-of-control.patch
  (git-fixes CVE-2024-38628 bsc#1226911).
- Update
  patches.suse/usb-storage-alauda-Check-whether-the-media-is-initia.patch
  (git-fixes CVE-2024-38619 bsc#1226861).
- Update
  patches.suse/usb-typec-tcpm-Fix-NULL-pointer-dereference-in-tcpm_.patch
  (git-fixes CVE-2023-52877 bsc#1224944).
- Update
  patches.suse/vhost-vdpa-fix-use-after-free-in-vhost_vdpa_probe.patch
  (jsc#PED-3311 CVE-2023-52795 bsc#1225085).
- Update
  patches.suse/virtio-blk-fix-implicit-overflow-on-virtio_max_dma_s.patch
  (git-fixes CVE-2023-52762 bsc#1225573).
- Update
  patches.suse/virtio-vsock-Fix-uninit-value-in-virtio_transport_re.patch
  (jsc#PED-5505 CVE-2023-52842 bsc#1225025).
- Update
  patches.suse/watchdog-cpu5wdt.c-Fix-use-after-free-bug-caused-by-.patch
  (git-fixes CVE-2024-38630 bsc#1226908).
- Update
  patches.suse/wifi-ar5523-enable-proper-endpoint-verification.patch
  (git-fixes CVE-2024-38565 bsc#1226747).
- Update
  patches.suse/wifi-ath11k-fix-dfs-radar-event-locking.patch
  (git-fixes CVE-2023-52798 bsc#1224947).
- Update
  patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch
  (git-fixes CVE-2023-52777 bsc#1224992).
- Update patches.suse/wifi-ath11k-fix-htt-pktlog-locking.patch
  (git-fixes CVE-2023-52800).
- Update
  patches.suse/wifi-ath12k-fix-dfs-radar-and-temperature-event-lock.patch
  (git-fixes CVE-2023-52776 bsc#1225090).
- Update
  patches.suse/wifi-ath12k-fix-htt-mlo-offset-event-locking.patch
  (git-fixes CVE-2023-52769 bsc#1225001).
- Update
  patches.suse/wifi-ath12k-fix-out-of-bound-access-of-qmi_invoke_ha.patch
  (git-fixes CVE-2024-38572 bsc#1226776).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-read-in-ath12k.patch
  (git-fixes CVE-2023-52827 bsc#1225078).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-write-in-ath12.patch
  (git-fixes CVE-2023-52829 bsc#1225081).
- Update
  patches.suse/wifi-brcmfmac-pcie-handle-randbuf-allocation-failure.patch
  (git-fixes CVE-2024-38575 bsc#1226612).
- Update
  patches.suse/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch
  (git-fixes CVE-2024-38567 bsc#1226769).
- Update
  patches.suse/wifi-carl9170-re-fix-fortified-memset-warning.patch
  (git-fixes CVE-2024-38616 bsc#1226852).
- Update
  patches.suse/wifi-mac80211-don-t-return-unset-power-in-ieee80211_.patch
  (git-fixes CVE-2023-52832 bsc#1225577).
- Update
  patches.suse/wifi-nl80211-Avoid-address-calculations-via-out-of-b.patch
  (git-fixes CVE-2024-38562 bsc#1226788).
- Update
  patches.suse/wifi-wilc1000-use-vmm_table-as-array-in-wilc-struct.patch
  (git-fixes CVE-2023-52768 bsc#1225004).
- Update
  patches.suse/x86-tdx-Zero-out-the-missing-RSI-in-TDX_HYPERCALL-macro.patch
  (jsc#PED-5824 CVE-2023-52874 bsc#1225049).
- commit 33efdc4</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835204">- tcp: Use refcount_inc_not_zero() in tcp_twsk_unique()
  (CVE-2024-36904 bsc#1225732).
- commit d578dcc</changelog>
  <changelog author="heming.zhao@suse.com" date="1719921600">- gfs2: Fix potential glock use-after-free on unmount (bsc#1226775
  CVE-2024-38570).
- gfs2: Rename sd_{ glock =&gt; kill }_wait (bsc#1226775
  CVE-2024-38570).
- commit f3adbca</changelog>
  <changelog author="tiwai@suse.de" date="1719921601">- Correct SCSI patch references (bsc#1225767 CVE-2024-36919 bsc#1226785 CVE-2024-38559)
- commit e8ea587</changelog>
  <changelog author="tiwai@suse.de" date="1719921602">- mtd: rawnand: rockchip: ensure NVDDR timings are rejected
  (git-fixes).
- mtd: rawnand: Bypass a couple of sanity checks during NAND
  identification (git-fixes).
- mtd: rawnand: Fix the nand_read_data_op() early check
  (git-fixes).
- mtd: rawnand: Ensure ECC configuration is propagated to upper
  layers (git-fixes).
- commit e545951</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1719921603">- kernel-doc: fix struct_group_tagged() parsing (git-fixes).
- commit e3a2a2e</changelog>
  <changelog author="fdmanana@suse.com" date="1719921604">- btrfs: fix crash on racing fsync and size-extending write into
  prealloc (bsc#1227101 CVE-2024-37354).
- commit 1d355af</changelog>
  <changelog author="vbabka@suse.cz" date="1719921605">- virt: acrn: stop using follow_pfn (CVE-2024-38610 bsc#1226758).
- commit c2ea51b</changelog>
  <changelog author="vbabka@suse.cz" date="1719921606">- drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
  (CVE-2024-38610 bsc#1226758).
- commit 7069ac2</changelog>
  <changelog author="rhopkins@suse.de" date="1719921607">- hsr: Prevent use after free in prp_create_tagged_frame()
  (CVE-2023-52846 bsc#1225098).
- commit cf63988</changelog>
  <changelog author="krisman@suse.de" date="1719921608">- io_uring: Fix io_cqring_wait() not restoring sigmask on
  get_timespec64() failure (git-fixes).
- commit e640a65</changelog>
  <changelog author="krisman@suse.de" date="1719921609">- io_uring: check for non-NULL file pointer in io_file_can_poll()
  (bsc#1226990 CVE-2024-39371).
- io_uring/io-wq: Use set_bit() and test_bit() at worker-&gt;flags
  (git-fixes).
- io_uring/sqpoll: work around a potential audit memory leak
  (git-fixes).
- commit 24603fc</changelog>
  <changelog author="krisman@suse.de" date="1719921610">- io_uring/rsrc: fix incorrect assignment of iter-&gt;nr_segs in
  io_import_fixed (git-fixes).
- io_uring/rsrc: don't lock while !TASK_RUNNING (git-fixes).
- io_uring/io-wq: avoid garbage value of 'match' in
  io_wq_enqueue() (git-fixes).
- commit 7d3e252</changelog>
</package>
<package pkgid="047f0f423e7db63bb2a408eb38dc9c34a47bc2bc5bcdce799e9fbda1e3001b22" name="cluster-md-kmp-64kb" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.17.1"/>
  <changelog author="tiwai@suse.de" date="1722081600">- auxdisplay: ht16k33: Drop reference after LED registration
  (git-fixes).
- ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
  on unprepare (git-fixes).
- ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
- ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
  reachable (git-fixes).
- ASoC: sof: amd: fix for firmware reload failure in Vangogh
  platform (git-fixes).
- ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
- ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
  (git-fixes).
- ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
- ALSA: ump: Don't update FB name for static blocks (git-fixes).
- drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
- drm/i915/gt: Do not consider preemption during execlists_dequeue
  for gen8 (git-fixes).
- drm/i915/dp: Don't switch the LTTPR mode on an active link
  (git-fixes).
- commit d7e2deb</changelog>
  <changelog author="tiwai@suse.de" date="1722081601">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
</package>
<package pkgid="958182b0cd6893a5cf3f28a842349ad19b6b32922ceb9db67e59383bbf9a646d" name="cluster-md-kmp-64kb" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.7.3"/>
  <changelog author="mkubecek@suse.cz" date="1717416000">- netfilter: nf_tables: release mutex after nft_gc_seq_end from
  abort path (CVE-2024-26925 bsc#1223390).
- commit 578a709</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717416001">- Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
  The L3 bsc#1225765 was created seperately since our customer requires
  PTF.
- Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
- Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
- Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
- Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
- commit 054635e</changelog>
  <changelog author="msuchanek@suse.de" date="1717416002">- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
- powerpc/uaccess: Fix build errors seen with GCC 13/14
  (bsc#1194869).
- commit 46b5d84</changelog>
  <changelog author="msuchanek@suse.de" date="1717416003">- blacklist.conf: PPC fsl_msi is not used
- commit ae6590d</changelog>
  <changelog author="msuchanek@suse.de" date="1717416004">- powerpc/pseries/lparcfg: drop error message from guest name
  lookup (bsc#1187716 ltc#193451 git-fixes).
- commit ceab637</changelog>
  <changelog author="mfranc@suse.cz" date="1717416005">- Update
  patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
  (git-fixes CVE-2024-36955).
- Update
  patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
  (git-fixes bsc#1225715 CVE-2024-36906).
- Update
  patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
  (git-fixes bsc#1225579 CVE-2024-36011).
- Update
  patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
  (git-fixes bsc#1225578 CVE-2024-36013).
- Update
  patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
  (git-fixes bsc#1225502 CVE-2024-36012).
- Update
  patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
  (git-fixes bsc#1225722 CVE-2024-36880).
- Update
  patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
  (git-fixes CVE-2024-36942).
- Update
  patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
  (git-fixes bsc#1225720 CVE-2024-36032).
- Update
  patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
  (git-fixes bsc#1223749 CVE-2024-26990).
- Update
  patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
  (git-fixes bsc#1223692 CVE-2024-26992).
- Update
  patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
  (stable-fixes CVE-2024-36944).
- Update
  patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
  (git-fixes bsc#1225734 CVE-2024-36896).
- Update
  patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
  (stable-fixes CVE-2024-36949).
- Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
  (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
- Update
  patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
  (git-fixes bsc#1225692 CVE-2023-52882).
- Update
  patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
  (git-fixes CVE-2024-26761).
- Update
  patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
  (stable-fixes bsc#1225735 CVE-2024-36897).
- Update
  patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
  (stable-fixes bsc#1225705 CVE-2024-36026).
- Update
  patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
  (stable-fixes CVE-2024-36951).
- Update
  patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
  (git-fixes bsc#1225593 CVE-2024-36014).
- Update
  patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
  (stable-fixes bsc#1225728 CVE-2024-36885).
- Update
  patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
  (git-fixes bsc#1225773 CVE-2024-36936).
- Update
  patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
  (stable-fixes CVE-2024-36950).
- Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
  (git-fixes bsc#1225736 CVE-2024-36898).
- Update
  patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
  (git-fixes bsc#1225698 CVE-2024-36020).
- Update
  patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
  (git-fixes bsc#1225710 CVE-2024-36891).
- Update
  patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
  (git-fixes bsc#1225714 CVE-2024-36890).
- Update
  patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
  (git-fixes bsc#1225708 CVE-2024-36029).
- Update
  patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
  (git-fixes bsc#1225699 CVE-2024-36021).
- Update
  patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
  (git-fixes CVE-2024-26943).
- Update
  patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
  (git-fixes bsc#1225694 CVE-2024-36018).
- Update
  patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
  (git-fixes CVE-2024-36940).
- Update
  patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
  (git-fixes CVE-2024-36959).
- Update
  patches.suse/ppdev-Add-an-error-check-in-register_device.patch
  (git-fixes bsc#1225640 CVE-2024-36015).
- Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
  CVE-2024-36947).
- Update
  patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
  (git-fixes bsc#1225695 CVE-2024-36019).
- Update
  patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
  (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
- Update
  patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
  (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
- Update
  patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
  (git-fixes bsc#1225704 CVE-2024-36025).
- Update
  patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
  (git-fixes CVE-2024-36930).
- Update
  patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
  (bsc#1224331 bsc#1224602 CVE-2024-35814).
- Update
  patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
  (git-fixes bsc#1225642 CVE-2024-36016).
- Update
  patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
  (git-fixes bsc#1225749 CVE-2024-36894).
- Update
  patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
  (git-fixes bsc#1225750 CVE-2024-36895).
- Update
  patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
  (git-fixes bsc#1225748 CVE-2024-36893).
- Update
  patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
  (stable-fixes bsc#1225769 CVE-2024-36921).
- Update
  patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
  (stable-fixes CVE-2024-36922).
- Update
  patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
  (git-fixes CVE-2024-36941).
- Update
  patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
  (git-fixes bsc#1224742 CVE-2024-35803).
- commit 539780f</changelog>
  <changelog author="dwagner@suse.de" date="1717416006">- nvmet: fix ns enable/disable possible hang (git-fixes).
- nvme-multipath: fix io accounting on failover (git-fixes).
- nvme: fix multipath batched completion accounting (git-fixes).
- commit ed3b392</changelog>
  <changelog author="dwagner@suse.de" date="1717416007">- scsi: lpfc: Copyright updates for 14.4.0.2 patches
  (bsc#1225842).
- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
  (bsc#1225842).
  Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
  (bsc#1225842).
- scsi: lpfc: Clear deferred RSCN processing flag when driver
  is unloading (bsc#1225842).
- scsi: lpfc: Update logging of protection type for T10 DIF I/O
  (bsc#1225842).
- scsi: lpfc: Change default logging level for unsolicited CT
  MIB commands (bsc#1225842).
- commit 5a56384</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416008">- smb: client: fix mount when dns_resolver key is not available
  (git-fixes, bsc#1225172).
- commit 28edb5c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416009">- cifs: fix leak of iface for primary channel (git-fixes,
  bsc#1225172).
- commit b7eb8e8</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416010">- Revert "cifs: reconnect work should have reference on server
  struct" (git-fixes, bsc#1225172).
- commit 3ca4c0c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416011">- smb: client: fix parsing of SMB3.1.1 POSIX create context
  (git-fixes, bsc#1225172).
- commit 5f27f69</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416012">- cifs: failure to add channel on iface should bump up weight
  (git-fixes, bsc#1225172).
- commit 007b237</changelog>
  <changelog author="tonyj@suse.de" date="1717416013">- perf/x86: Fix out of range data (git-fixes).
- perf/x86/intel/ds: Don't clear -&gt;pebs_data_cfg for the last
  PEBS event (git-fixes).
- perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
- commit 664d77f</changelog>
  <changelog author="dsterba@suse.com" date="1717588800">- blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
- Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
  Quoting bsc#1225945#c11:
  "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
  transaction for every subvol create")
  ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
  unwritten extent buffer after snapshotting a new subvolume") was never
  backported."
- commit d947258</changelog>
  <changelog author="tonyj@suse.de" date="1717588801">- perf pmu: Count sys and cpuid JSON events separately (git
  fixes).
- perf stat: Don't display metric header for non-leader uncore
  events (git-fixes).
- perf daemon: Fix file leak in daemon_session__control
  (git-fixes).
- perf symbols: Fix ownership of string in dso__load_vmlinux()
  (git-fixes).
- perf thread: Fixes to thread__new() related to initializing comm
  (git-fixes).
- perf report: Avoid SEGV in report__setup_sample_type()
  (git-fixes).
- perf ui browser: Don't save pointer to stack memory (git-fixes).
- perf bench internals inject-build-id: Fix trap divide when
  collecting just one DSO (git-fixes).
- perf intel-pt: Fix unassigned instruction op (discovered by
  MemorySanitizer) (git-fixes).
- perf test shell arm_coresight: Increase buffer size for
  Coresight basic tests (git-fixes).
- perf docs: Document bpf event modifier (git-fixes).
- perf bench uprobe: Remove lib64 from libc.so.6 binary path
  (git-fixes).
- perf record: Fix debug message placement for test consumption
  (git-fixes).
- perf tests: Apply attributes to all events in object code
  reading test (git-fixes).
- perf tests: Make "test data symbol" more robust on Neoverse N1
  (git-fixes).
- perf annotate: Fix annotation_calc_lines() to pass correct
  address to get_srcline() (git-fixes).
- perf stat: Do not fail on metrics on s390 z/VM systems
  (git-fixes).
- perf sched timehist: Fix -g/--call-graph option failure
  (git-fixes).
- perf annotate: Get rid of duplicate --group option item
  (git-fixes).
- perf probe: Add missing libgen.h header needed for using
  basename() (git-fixes).
- perf record: Delete session after stopping sideband thread
  (git-fixes).
- perf auxtrace: Fix multiple use of --itrace option (git-fixes).
- perf script: Show also errors for --insn-trace option
  (git-fixes).
- perf lock contention: Add a missing NULL check (git-fixes).
- perf vendor events amd: Fix Zen 4 cache latency events
  (git-fixes).
- libperf evlist: Avoid out-of-bounds access (git-fixes).
- perf pmu: Fix a potential memory leak in perf_pmu__lookup()
  (git-fixes).
- perf print-events: make is_event_supported() more robust
  (git-fixes).
- perf list: fix short description for some cache events
  (git-fixes).
- perf metric: Don't remove scale from counts (git-fixes).
- perf stat: Avoid metric-only segv (git-fixes).
- perf expr: Fix "has_event" function for metric style events
  (git-fixes).
- perf srcline: Add missed addr2line closes (git-fixes).
- perf thread_map: Free strlist on normal path in
  thread_map__new_by_tid_str() (git-fixes).
- perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
- perf jevents: Drop or simplify small integer values (git-fixes).
- perf evsel: Fix duplicate initialization of data-&gt;id in
  evsel__parse_sample() (git-fixes).
- perf pmu: Treat the msr pmu as software (git-fixes).
- perf record: Check conflict between '--timestamp-filename'
  option and pipe mode before recording (git-fixes).
- perf record: Fix possible incorrect free in
  record__switch_output() (git-fixes).
- perf vendor events amd: Add Zen 4 memory controller events
  (git-fixes).
- perf top: Uniform the event name for the hybrid machine
  (git-fixes).
- perf top: Use evsel's cpus to replace user_requested_cpus
  (git-fixes).
- commit a1f9340</changelog>
  <changelog author="tonyj@suse.de" date="1717675200">- perf ui browser: Avoid SEGV on title (git fixes).
- commit 1578c22</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675201">- inet: inet_defrag: prevent sk release while still in use
  (CVE-2024-26921 bsc#1223138).
- commit 2016faf</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675202">- net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
- commit 7bf5961</changelog>
  <changelog author="tiwai@suse.de" date="1718366400">- Temporarily drop KVM patch that caused a regression (bsc#1226158)
  Delete patches.suse/KVM-x86-pmu-Prioritize-VMX-interception-over-GP-on-R.patch
- commit 33f31da</changelog>
</package>
<package pkgid="5fc3d188c764a00f12ebd7d52b7392c57222cf08d08262ed71b9bbb9e3390009" name="cluster-md-kmp-azure" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.8.11.1"/>
  <changelog author="lhenriques@suse.de" date="1725019200">- virtiofs: forbid newlines in tags (bsc#1229940).
- commit 61514ce</changelog>
  <changelog author="lhenriques@suse.de" date="1725019201">- blacklist.conf: add 053fc4f755ad fuse: fix UAF in rcu pathwalks
  This commit breaks kABI and the data structure has no free room for the
  extra field, i.e. memcpy would fail to copy the additional member added by
  this patch.
- commit 941b81c</changelog>
  <changelog author="vkarasulli@suse.de" date="1725019202">- iommufd/device: Fix hwpt at err_unresv in
  iommufd_device_do_replace() (git-fixes).
- commit bbc9a65</changelog>
  <changelog author="vkarasulli@suse.de" date="1725019203">- iommu/vt-d: Fix identity map bounds in si_domain_init()
  (git-fixes).
- commit b4d27e5</changelog>
  <changelog author="lduncan@suse.com" date="1725019204">- scsi: lpfc: Fix a possible null pointer dereference (bsc#1229315
  CVE-2024-43821).
- commit eb73e94</changelog>
  <changelog author="vkarasulli@suse.de" date="1725019205">- iommu/amd: Convert comma to semicolon (git-fixes).
- commit 2714d8b</changelog>
  <changelog author="mkoutny@suse.com" date="1725019206">- Update
  patches.suse/0001-net-rds-fix-possible-cp-null-dereference.patch
  (git-fixes CVE-2024-35902 bsc#1224496).
- Update
  patches.suse/ASoC-TAS2781-Fix-tasdev_load_calibrated_data.patch
  (git-fixes CVE-2024-42278 bsc#1229403).
- Update
  patches.suse/ASoC-amd-Adjust-error-handling-in-case-of-absent-cod.patch
  (git-fixes CVE-2024-43818 bsc#1229296).
- Update
  patches.suse/ASoC-fsl-fsl_qmc_audio-Check-devm_kasprintf-returned.patch
  (git-fixes CVE-2024-42298 bsc#1229369).
- Update
  patches.suse/Bluetooth-MGMT-Add-error-handling-to-pair_device.patch
  (git-fixes CVE-2024-43884 bsc#1229739).
- Update
  patches.suse/KVM-Always-flush-async-PF-workqueue-when-vCPU-is-bei.patch
  (git-fixes CVE-2024-26976 bsc#1223635).
- Update
  patches.suse/PCI-DPC-Fix-use-after-free-on-concurrent-DPC-and-hot.patch
  (git-fixes CVE-2024-42302 bsc#1229366).
- Update
  patches.suse/PCI-endpoint-Clean-up-error-handling-in-vpci_scan_bu.patch
  (git-fixes CVE-2024-43875 bsc#1229486).
- Update
  patches.suse/PCI-endpoint-pci-epf-test-Make-use-of-cached-epc_fea.patch
  (git-fixes CVE-2024-43824 bsc#1229320).
- Update
  patches.suse/PCI-keystone-Fix-NULL-pointer-dereference-in-case-of.patch
  (git-fixes CVE-2024-43823 bsc#1229303).
- Update
  patches.suse/PCI-rcar-Demote-WARN-to-dev_warn_ratelimited-in-rcar.patch
  (git-fixes CVE-2024-43876 bsc#1229485).
- Update
  patches.suse/RDMA-hns-Fix-soft-lockup-under-heavy-CEQE-load.patch
  (git-fixes CVE-2024-43872 bsc#1229489).
- Update
  patches.suse/RDMA-iwcm-Fix-a-use-after-free-related-to-destroying.patch
  (git-fixes CVE-2024-42285 bsc#1229381).
- Update
  patches.suse/Revert-ALSA-firewire-lib-operate-for-period-elapse-e.patch
  (bsc#1208783 CVE-2024-42274 bsc#1229417).
- Update
  patches.suse/SUNRPC-add-a-missing-rpc_stat-for-TCP-TLS.patch
  (git-fixes CVE-2024-36907 bsc#1225751).
- Update
  patches.suse/bpf-arm64-Fix-trampoline-for-BPF_TRAMP_F_CALL_ORIG.patch
  (git-fixes CVE-2024-43840 bsc#1229344).
- Update
  patches.suse/btrfs-fix-double-inode-unlock-for-direct-IO-sync-wri.patch
  (git-fixes CVE-2024-43885 bsc#1229747).
- Update
  patches.suse/btrfs-fix-extent-map-use-after-free-when-adding-page.patch
  (git-fixes CVE-2024-42314 bsc#1229355).
- Update
  patches.suse/cgroup-cpuset-Prevent-UAF-in-proc_cpuset_show.patch
  (bsc#1228801 CVE-2024-43853 bsc#1229292).
- Update
  patches.suse/crypto-ccp-Fix-null-pointer-dereference-in-__sev_snp.patch
  (git-fixes CVE-2024-43874 bsc#1229487).
- Update
  patches.suse/devres-Fix-memory-leakage-caused-by-driver-API-devm_.patch
  (git-fixes CVE-2024-43871 bsc#1229490).
- Update
  patches.suse/dma-fix-call-order-in-dmam_free_coherent.patch
  (git-fixes CVE-2024-43856 bsc#1229346).
- Update
  patches.suse/drm-admgpu-fix-dereferencing-null-pointer-context.patch
  (stable-fixes CVE-2024-43906 bsc#1229785).
- Update
  patches.suse/drm-amd-display-Add-NULL-check-for-afb-before-derefe.patch
  (stable-fixes CVE-2024-43903 bsc#1229781).
- Update
  patches.suse/drm-amd-display-Add-null-checker-before-passing-vari.patch
  (stable-fixes CVE-2024-43902 bsc#1229767).
- Update
  patches.suse/drm-amd-display-Skip-Recompute-DSC-Params-if-no-Stre.patch
  (stable-fixes CVE-2024-43895 bsc#1229755).
- Update
  patches.suse/drm-amd-pm-Fix-the-null-pointer-dereference-for-vega.patch
  (stable-fixes CVE-2024-43905 bsc#1229784).
- Update
  patches.suse/drm-amdgpu-Fix-the-null-pointer-dereference-to-ras_m.patch
  (stable-fixes CVE-2024-43908 bsc#1229788).
- Update
  patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-for-s.patch
  (stable-fixes CVE-2024-43909 bsc#1229789).
- Update
  patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-in-ap.patch
  (stable-fixes CVE-2024-43907 bsc#1229787).
- Update
  patches.suse/drm-client-fix-null-pointer-dereference-in-drm_clien.patch
  (git-fixes CVE-2024-43894 bsc#1229746).
- Update
  patches.suse/drm-gma500-fix-null-pointer-dereference-in-cdv_intel.patch
  (git-fixes CVE-2024-42310 bsc#1229358).
- Update
  patches.suse/drm-gma500-fix-null-pointer-dereference-in-psb_intel.patch
  (git-fixes CVE-2024-42309 bsc#1229359).
- Update
  patches.suse/drm-nouveau-prime-fix-refcount-underflow.patch
  (git-fixes CVE-2024-43867 bsc#1229493).
- Update patches.suse/drm-qxl-Add-check-for-drm_cvt_mode.patch
  (git-fixes CVE-2024-43829 bsc#1229341).
- Update
  patches.suse/drm-vmwgfx-Fix-a-deadlock-in-dma-buf-fence-polling.patch
  (git-fixes CVE-2024-43863 bsc#1229497).
- Update
  patches.suse/exfat-fix-potential-deadlock-on-__exfat_get_dentry_set.patch
  (git-fixes CVE-2024-42315 bsc#1229354).
- Update
  patches.suse/gpio-prevent-potential-speculation-leaks-in-gpio_dev.patch
  (stable-fixes CVE-2024-44931 bsc#1229837).
- Update
  patches.suse/hfs-fix-to-initialize-fields-of-hfs_inode_info-after-hfs_alloc_inode.patch
  (git-fixes CVE-2024-42311 bsc#1229413).
- Update
  patches.suse/iio-Fix-the-sorting-functionality-in-iio_gts_build_a.patch
  (git-fixes CVE-2024-43825 bsc#1229298).
- Update
  patches.suse/jfs-Fix-array-index-out-of-bounds-in-diFree.patch
  (git-fixes CVE-2024-43858 bsc#1229414).
- Update
  patches.suse/jfs-Fix-shift-out-of-bounds-in-dbDiscardAG.patch
  (git-fixes CVE-2024-44938 bsc#1229792).
- Update
  patches.suse/jfs-fix-null-ptr-deref-in-dtInsertEntry.patch
  (git-fixes CVE-2024-44939 bsc#1229820).
- Update
  patches.suse/kobject_uevent-Fix-OOB-access-within-zap_modalias_en.patch
  (git-fixes CVE-2024-42292 bsc#1229373).
- Update
  patches.suse/kvm-s390-Reject-memory-region-operations-for-ucontrol-VMs.patch
  (git-fixes bsc#1229168 CVE-2024-43819 bsc#1229290).
- Update
  patches.suse/leds-trigger-Unregister-sysfs-attributes-before-call.patch
  (git-fixes CVE-2024-43830 bsc#1229305).
- Update
  patches.suse/lib-objagg-Fix-general-protection-fault.patch
  (git-fixes CVE-2024-43846 bsc#1229360).
- Update
  patches.suse/libbpf-Use-OPTS_SET-macro-in-bpf_xdp_query.patch
  (git-fixes CVE-2024-27050 bsc#1223767).
- Update
  patches.suse/mISDN-Fix-a-use-after-free-in-hfcmulti_tx.patch
  (git-fixes CVE-2024-42280 bsc#1229388).
- Update
  patches.suse/mailbox-mtk-cmdq-Move-devm_mbox_controller_register-.patch
  (git-fixes CVE-2024-42319 bsc#1229350).
- Update
  patches.suse/md-raid5-fix-deadlock-that-raid5d-wait-for-itself-to-clear-MD_SB_CHANGE_PENDING-151f.patch
  (git-fixes CVE-2024-39476 bsc#1227437).
- Update
  patches.suse/media-imx-pxp-Fix-ERR_PTR-dereference-in-pxp_probe.patch
  (git-fixes CVE-2024-42303 bsc#1229365).
- Update
  patches.suse/media-pci-ivtv-Add-check-for-DMA-map-result.patch
  (git-fixes CVE-2024-43877 bsc#1229484).
- Update
  patches.suse/media-v4l-async-Fix-NULL-pointer-dereference-in-addi.patch
  (git-fixes CVE-2024-43833 bsc#1229299).
- Update
  patches.suse/media-venus-fix-use-after-free-in-vdec_close.patch
  (git-fixes CVE-2024-42313 bsc#1229356).
- Update
  patches.suse/media-xc2028-avoid-use-after-free-in-load_firmware_c.patch
  (stable-fixes CVE-2024-43900 bsc#1229756).
- Update
  patches.suse/memcg-protect-concurrent-access-to-mem_cgroup_idr.patch
  (git-fixes CVE-2024-43892 bsc#1229761).
- Update
  patches.suse/net-drop-bad-gso-csum_start-and-offset-in-virtio_net.patch
  (git-fixes CVE-2024-43897 bsc#1229752).
- Update
  patches.suse/net-iucv-fix-use-after-free-in-iucv_sock_close.patch
  (bsc#1228973 CVE-2024-42271 bsc#1229400).
- Update patches.suse/net-missing-check-virtio.patch (git-fixes
  CVE-2024-43817 bsc#1229312).
- Update
  patches.suse/net-usb-qmi_wwan-fix-memory-leak-for-not-ip-packets.patch
  (git-fixes CVE-2024-43861 bsc#1229500).
- Update
  patches.suse/nfs-pass-explicit-offset-count-to-trace-events.patch
  (git-fixes CVE-2024-43826 bsc#1229294).
- Update
  patches.suse/nvme-pci-add-missing-condition-check-for-existence-o.patch
  (git-fixes CVE-2024-42276 bsc#1229410).
- Update
  patches.suse/padata-Fix-possible-divide-by-0-panic-in-padata_mt_h.patch
  (git-fixes CVE-2024-43889 bsc#1229743).
- Update
  patches.suse/remoteproc-imx_rproc-Skip-over-memory-region-when-no.patch
  (git-fixes CVE-2024-43860 bsc#1229319).
- Update
  patches.suse/s390-dasd-fix-error-checks-in-dasd_copy_pair_store.patch
  (git-fixes bsc#1229173 CVE-2024-42320 bsc#1229349).
- Update
  patches.suse/scsi-lpfc-Revise-lpfc_prep_embed_io-routine-with-pro.patch
  (bsc#1228857 CVE-2024-43816 bsc#1229318).
- Update
  patches.suse/scsi-qla2xxx-Complete-command-early-within-lock.patch
  (bsc#1228850 CVE-2024-42287 bsc#1229392).
- Update
  patches.suse/scsi-qla2xxx-During-vport-delete-send-async-logout-e.patch
  (bsc#1228850 CVE-2024-42289 bsc#1229399).
- Update
  patches.suse/scsi-qla2xxx-Fix-for-possible-memory-corruption.patch
  (bsc#1228850 CVE-2024-42288 bsc#1229398).
- Update
  patches.suse/scsi-qla2xxx-validate-nvme_local_port-correctly.patch
  (bsc#1228850 CVE-2024-42286 bsc#1229395).
- Update
  patches.suse/serial-core-check-uartclk-for-zero-to-avoid-divide-b.patch
  (stable-fixes CVE-2024-43893 bsc#1229759).
- Update
  patches.suse/soc-qcom-pdr-protect-locator_addr-with-the-main-mute.patch
  (git-fixes CVE-2024-43849 bsc#1229307).
- Update
  patches.suse/soc-xilinx-rename-cpu_number1-to-dummy_cpu_number.patch
  (git-fixes CVE-2024-43851 bsc#1229313).
- Update
  patches.suse/spi-microchip-core-ensure-TX-and-RX-FIFOs-are-empty-.patch
  (git-fixes CVE-2024-42279 bsc#1229390).
- Update
  patches.suse/usb-vhci-hcd-Do-not-drop-references-before-new-refer.patch
  (stable-fixes CVE-2024-43883 bsc#1229707).
- Update
  patches.suse/vhost-vsock-always-initialize-seqpacket_allow.patch
  (git-fixes CVE-2024-43873 bsc#1229488).
- Update
  patches.suse/wifi-ath12k-change-DMA-direction-while-mapping-reinj.patch
  (git-fixes CVE-2024-43881 bsc#1229480).
- Update
  patches.suse/wifi-ath12k-fix-invalid-memory-access-while-processi.patch
  (git-fixes CVE-2024-43847 bsc#1229291).
- Update
  patches.suse/wifi-cfg80211-handle-2x996-RU-allocation-in-cfg80211.patch
  (git-fixes CVE-2024-43879 bsc#1229482).
- Update
  patches.suse/wifi-nl80211-disallow-setting-special-AP-channel-wid.patch
  (stable-fixes CVE-2024-43912 bsc#1229830).
- Update
  patches.suse/wifi-rtw89-Fix-array-index-mistake-in-rtw89_sta_info.patch
  (git-fixes CVE-2024-43842 bsc#1229317).
- Update
  patches.suse/wifi-virt_wifi-avoid-reporting-connection-success-wi.patch
  (git-fixes CVE-2024-43841 bsc#1229304).
- commit 140ec33</changelog>
  <changelog author="tiwai@suse.de" date="1725105600">- dmaengine: dw: Add memory bus width verification (git-fixes).
- dmaengine: dw: Add peripheral bus width verification
  (git-fixes).
- soundwire: stream: fix programming slave ports for non-continous
  port maps (git-fixes).
- commit b7e9784</changelog>
  <changelog author="tiwai@suse.de" date="1725192000">- usb: cdnsp: fix for Link TRB with TC (git-fixes).
- usb: dwc3: st: add missing depopulate in probe error path
  (git-fixes).
- usb: dwc3: st: fix probed platform device ref count on probe
  error path (git-fixes).
- usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in
  remove_power_attributes() (git-fixes).
- usb: typec: fsa4480: Relax CHIP_ID check (git-fixes).
- usb: dwc3: omap: add missing depopulate in probe error path
  (git-fixes).
- usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function
  (git-fixes).
- soc: qcom: pmic_glink: Actually communicate when remote goes
  down (git-fixes).
- soc: qcom: cmd-db: Map shared memory as WC, not WB (git-fixes).
- commit 7121142</changelog>
  <changelog author="ailiop@suse.com" date="1725192001">- xfs: Fix the owner setting issue for rmap query in xfs fsmap
  (git-fixes).
- commit 49b5eec</changelog>
  <changelog author="ailiop@suse.com" date="1725192002">- xfs: use XFS_BUF_DADDR_NULL for daddrs in getfsmap code
  (git-fixes).
- commit 288ad9b</changelog>
  <changelog author="ailiop@suse.com" date="1725192003">- xfs: Fix missing interval for missing_owner in xfs fsmap
  (git-fixes).
- commit 5448ab5</changelog>
  <changelog author="ohering@suse.de" date="1725278400">- net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response (git-fixes).
- commit 4dc1da1</changelog>
  <changelog author="osalvador@suse.de" date="1725278401">- mm/sparsemem: fix race in accessing memory_section-&gt;usage
  (bsc#1221326 CVE-2023-52489).
- commit 6aa8957</changelog>
  <changelog author="osalvador@suse.de" date="1725278402">- mm, kmsan: fix infinite recursion due to RCU critical section
  (git-fixes).
- commit 16ad73a</changelog>
  <changelog author="osalvador@suse.de" date="1725278403">- mm: prevent derefencing NULL ptr in pfn_section_valid()
  (git-fixes).
- commit 35f619d</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1725278404">- bluetooth/l2cap: sync sock recv cb and release (bsc#1228576
  CVE-2024-41062).
- commit 6553526</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1725278405">- Bluetooth: L2CAP: Fix deadlock (git-fixes).
- commit 13aba13</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1725278406">- Bluetooth: Fix usage of __hci_cmd_sync_status (git-fixes).
- commit 1bec58d</changelog>
  <changelog author="lhenriques@suse.de" date="1725278407">- ceph: periodically flush the cap releases (bsc#1230056).
- commit e22b6e0</changelog>
</package>
<package pkgid="de2f8cc3e89f41c424dd4a104628345cbdc3da43bc4bdb76a4b95d47a8461ea3" name="cluster-md-kmp-azure" arch="x86_64">
  <version epoch="0" ver="6.4.0" rel="150600.8.11.1"/>
  <changelog author="lhenriques@suse.de" date="1725019200">- virtiofs: forbid newlines in tags (bsc#1229940).
- commit 61514ce</changelog>
  <changelog author="lhenriques@suse.de" date="1725019201">- blacklist.conf: add 053fc4f755ad fuse: fix UAF in rcu pathwalks
  This commit breaks kABI and the data structure has no free room for the
  extra field, i.e. memcpy would fail to copy the additional member added by
  this patch.
- commit 941b81c</changelog>
  <changelog author="vkarasulli@suse.de" date="1725019202">- iommufd/device: Fix hwpt at err_unresv in
  iommufd_device_do_replace() (git-fixes).
- commit bbc9a65</changelog>
  <changelog author="vkarasulli@suse.de" date="1725019203">- iommu/vt-d: Fix identity map bounds in si_domain_init()
  (git-fixes).
- commit b4d27e5</changelog>
  <changelog author="lduncan@suse.com" date="1725019204">- scsi: lpfc: Fix a possible null pointer dereference (bsc#1229315
  CVE-2024-43821).
- commit eb73e94</changelog>
  <changelog author="vkarasulli@suse.de" date="1725019205">- iommu/amd: Convert comma to semicolon (git-fixes).
- commit 2714d8b</changelog>
  <changelog author="mkoutny@suse.com" date="1725019206">- Update
  patches.suse/0001-net-rds-fix-possible-cp-null-dereference.patch
  (git-fixes CVE-2024-35902 bsc#1224496).
- Update
  patches.suse/ASoC-TAS2781-Fix-tasdev_load_calibrated_data.patch
  (git-fixes CVE-2024-42278 bsc#1229403).
- Update
  patches.suse/ASoC-amd-Adjust-error-handling-in-case-of-absent-cod.patch
  (git-fixes CVE-2024-43818 bsc#1229296).
- Update
  patches.suse/ASoC-fsl-fsl_qmc_audio-Check-devm_kasprintf-returned.patch
  (git-fixes CVE-2024-42298 bsc#1229369).
- Update
  patches.suse/Bluetooth-MGMT-Add-error-handling-to-pair_device.patch
  (git-fixes CVE-2024-43884 bsc#1229739).
- Update
  patches.suse/KVM-Always-flush-async-PF-workqueue-when-vCPU-is-bei.patch
  (git-fixes CVE-2024-26976 bsc#1223635).
- Update
  patches.suse/PCI-DPC-Fix-use-after-free-on-concurrent-DPC-and-hot.patch
  (git-fixes CVE-2024-42302 bsc#1229366).
- Update
  patches.suse/PCI-endpoint-Clean-up-error-handling-in-vpci_scan_bu.patch
  (git-fixes CVE-2024-43875 bsc#1229486).
- Update
  patches.suse/PCI-endpoint-pci-epf-test-Make-use-of-cached-epc_fea.patch
  (git-fixes CVE-2024-43824 bsc#1229320).
- Update
  patches.suse/PCI-keystone-Fix-NULL-pointer-dereference-in-case-of.patch
  (git-fixes CVE-2024-43823 bsc#1229303).
- Update
  patches.suse/PCI-rcar-Demote-WARN-to-dev_warn_ratelimited-in-rcar.patch
  (git-fixes CVE-2024-43876 bsc#1229485).
- Update
  patches.suse/RDMA-hns-Fix-soft-lockup-under-heavy-CEQE-load.patch
  (git-fixes CVE-2024-43872 bsc#1229489).
- Update
  patches.suse/RDMA-iwcm-Fix-a-use-after-free-related-to-destroying.patch
  (git-fixes CVE-2024-42285 bsc#1229381).
- Update
  patches.suse/Revert-ALSA-firewire-lib-operate-for-period-elapse-e.patch
  (bsc#1208783 CVE-2024-42274 bsc#1229417).
- Update
  patches.suse/SUNRPC-add-a-missing-rpc_stat-for-TCP-TLS.patch
  (git-fixes CVE-2024-36907 bsc#1225751).
- Update
  patches.suse/bpf-arm64-Fix-trampoline-for-BPF_TRAMP_F_CALL_ORIG.patch
  (git-fixes CVE-2024-43840 bsc#1229344).
- Update
  patches.suse/btrfs-fix-double-inode-unlock-for-direct-IO-sync-wri.patch
  (git-fixes CVE-2024-43885 bsc#1229747).
- Update
  patches.suse/btrfs-fix-extent-map-use-after-free-when-adding-page.patch
  (git-fixes CVE-2024-42314 bsc#1229355).
- Update
  patches.suse/cgroup-cpuset-Prevent-UAF-in-proc_cpuset_show.patch
  (bsc#1228801 CVE-2024-43853 bsc#1229292).
- Update
  patches.suse/crypto-ccp-Fix-null-pointer-dereference-in-__sev_snp.patch
  (git-fixes CVE-2024-43874 bsc#1229487).
- Update
  patches.suse/devres-Fix-memory-leakage-caused-by-driver-API-devm_.patch
  (git-fixes CVE-2024-43871 bsc#1229490).
- Update
  patches.suse/dma-fix-call-order-in-dmam_free_coherent.patch
  (git-fixes CVE-2024-43856 bsc#1229346).
- Update
  patches.suse/drm-admgpu-fix-dereferencing-null-pointer-context.patch
  (stable-fixes CVE-2024-43906 bsc#1229785).
- Update
  patches.suse/drm-amd-display-Add-NULL-check-for-afb-before-derefe.patch
  (stable-fixes CVE-2024-43903 bsc#1229781).
- Update
  patches.suse/drm-amd-display-Add-null-checker-before-passing-vari.patch
  (stable-fixes CVE-2024-43902 bsc#1229767).
- Update
  patches.suse/drm-amd-display-Skip-Recompute-DSC-Params-if-no-Stre.patch
  (stable-fixes CVE-2024-43895 bsc#1229755).
- Update
  patches.suse/drm-amd-pm-Fix-the-null-pointer-dereference-for-vega.patch
  (stable-fixes CVE-2024-43905 bsc#1229784).
- Update
  patches.suse/drm-amdgpu-Fix-the-null-pointer-dereference-to-ras_m.patch
  (stable-fixes CVE-2024-43908 bsc#1229788).
- Update
  patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-for-s.patch
  (stable-fixes CVE-2024-43909 bsc#1229789).
- Update
  patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-in-ap.patch
  (stable-fixes CVE-2024-43907 bsc#1229787).
- Update
  patches.suse/drm-client-fix-null-pointer-dereference-in-drm_clien.patch
  (git-fixes CVE-2024-43894 bsc#1229746).
- Update
  patches.suse/drm-gma500-fix-null-pointer-dereference-in-cdv_intel.patch
  (git-fixes CVE-2024-42310 bsc#1229358).
- Update
  patches.suse/drm-gma500-fix-null-pointer-dereference-in-psb_intel.patch
  (git-fixes CVE-2024-42309 bsc#1229359).
- Update
  patches.suse/drm-nouveau-prime-fix-refcount-underflow.patch
  (git-fixes CVE-2024-43867 bsc#1229493).
- Update patches.suse/drm-qxl-Add-check-for-drm_cvt_mode.patch
  (git-fixes CVE-2024-43829 bsc#1229341).
- Update
  patches.suse/drm-vmwgfx-Fix-a-deadlock-in-dma-buf-fence-polling.patch
  (git-fixes CVE-2024-43863 bsc#1229497).
- Update
  patches.suse/exfat-fix-potential-deadlock-on-__exfat_get_dentry_set.patch
  (git-fixes CVE-2024-42315 bsc#1229354).
- Update
  patches.suse/gpio-prevent-potential-speculation-leaks-in-gpio_dev.patch
  (stable-fixes CVE-2024-44931 bsc#1229837).
- Update
  patches.suse/hfs-fix-to-initialize-fields-of-hfs_inode_info-after-hfs_alloc_inode.patch
  (git-fixes CVE-2024-42311 bsc#1229413).
- Update
  patches.suse/iio-Fix-the-sorting-functionality-in-iio_gts_build_a.patch
  (git-fixes CVE-2024-43825 bsc#1229298).
- Update
  patches.suse/jfs-Fix-array-index-out-of-bounds-in-diFree.patch
  (git-fixes CVE-2024-43858 bsc#1229414).
- Update
  patches.suse/jfs-Fix-shift-out-of-bounds-in-dbDiscardAG.patch
  (git-fixes CVE-2024-44938 bsc#1229792).
- Update
  patches.suse/jfs-fix-null-ptr-deref-in-dtInsertEntry.patch
  (git-fixes CVE-2024-44939 bsc#1229820).
- Update
  patches.suse/kobject_uevent-Fix-OOB-access-within-zap_modalias_en.patch
  (git-fixes CVE-2024-42292 bsc#1229373).
- Update
  patches.suse/kvm-s390-Reject-memory-region-operations-for-ucontrol-VMs.patch
  (git-fixes bsc#1229168 CVE-2024-43819 bsc#1229290).
- Update
  patches.suse/leds-trigger-Unregister-sysfs-attributes-before-call.patch
  (git-fixes CVE-2024-43830 bsc#1229305).
- Update
  patches.suse/lib-objagg-Fix-general-protection-fault.patch
  (git-fixes CVE-2024-43846 bsc#1229360).
- Update
  patches.suse/libbpf-Use-OPTS_SET-macro-in-bpf_xdp_query.patch
  (git-fixes CVE-2024-27050 bsc#1223767).
- Update
  patches.suse/mISDN-Fix-a-use-after-free-in-hfcmulti_tx.patch
  (git-fixes CVE-2024-42280 bsc#1229388).
- Update
  patches.suse/mailbox-mtk-cmdq-Move-devm_mbox_controller_register-.patch
  (git-fixes CVE-2024-42319 bsc#1229350).
- Update
  patches.suse/md-raid5-fix-deadlock-that-raid5d-wait-for-itself-to-clear-MD_SB_CHANGE_PENDING-151f.patch
  (git-fixes CVE-2024-39476 bsc#1227437).
- Update
  patches.suse/media-imx-pxp-Fix-ERR_PTR-dereference-in-pxp_probe.patch
  (git-fixes CVE-2024-42303 bsc#1229365).
- Update
  patches.suse/media-pci-ivtv-Add-check-for-DMA-map-result.patch
  (git-fixes CVE-2024-43877 bsc#1229484).
- Update
  patches.suse/media-v4l-async-Fix-NULL-pointer-dereference-in-addi.patch
  (git-fixes CVE-2024-43833 bsc#1229299).
- Update
  patches.suse/media-venus-fix-use-after-free-in-vdec_close.patch
  (git-fixes CVE-2024-42313 bsc#1229356).
- Update
  patches.suse/media-xc2028-avoid-use-after-free-in-load_firmware_c.patch
  (stable-fixes CVE-2024-43900 bsc#1229756).
- Update
  patches.suse/memcg-protect-concurrent-access-to-mem_cgroup_idr.patch
  (git-fixes CVE-2024-43892 bsc#1229761).
- Update
  patches.suse/net-drop-bad-gso-csum_start-and-offset-in-virtio_net.patch
  (git-fixes CVE-2024-43897 bsc#1229752).
- Update
  patches.suse/net-iucv-fix-use-after-free-in-iucv_sock_close.patch
  (bsc#1228973 CVE-2024-42271 bsc#1229400).
- Update patches.suse/net-missing-check-virtio.patch (git-fixes
  CVE-2024-43817 bsc#1229312).
- Update
  patches.suse/net-usb-qmi_wwan-fix-memory-leak-for-not-ip-packets.patch
  (git-fixes CVE-2024-43861 bsc#1229500).
- Update
  patches.suse/nfs-pass-explicit-offset-count-to-trace-events.patch
  (git-fixes CVE-2024-43826 bsc#1229294).
- Update
  patches.suse/nvme-pci-add-missing-condition-check-for-existence-o.patch
  (git-fixes CVE-2024-42276 bsc#1229410).
- Update
  patches.suse/padata-Fix-possible-divide-by-0-panic-in-padata_mt_h.patch
  (git-fixes CVE-2024-43889 bsc#1229743).
- Update
  patches.suse/remoteproc-imx_rproc-Skip-over-memory-region-when-no.patch
  (git-fixes CVE-2024-43860 bsc#1229319).
- Update
  patches.suse/s390-dasd-fix-error-checks-in-dasd_copy_pair_store.patch
  (git-fixes bsc#1229173 CVE-2024-42320 bsc#1229349).
- Update
  patches.suse/scsi-lpfc-Revise-lpfc_prep_embed_io-routine-with-pro.patch
  (bsc#1228857 CVE-2024-43816 bsc#1229318).
- Update
  patches.suse/scsi-qla2xxx-Complete-command-early-within-lock.patch
  (bsc#1228850 CVE-2024-42287 bsc#1229392).
- Update
  patches.suse/scsi-qla2xxx-During-vport-delete-send-async-logout-e.patch
  (bsc#1228850 CVE-2024-42289 bsc#1229399).
- Update
  patches.suse/scsi-qla2xxx-Fix-for-possible-memory-corruption.patch
  (bsc#1228850 CVE-2024-42288 bsc#1229398).
- Update
  patches.suse/scsi-qla2xxx-validate-nvme_local_port-correctly.patch
  (bsc#1228850 CVE-2024-42286 bsc#1229395).
- Update
  patches.suse/serial-core-check-uartclk-for-zero-to-avoid-divide-b.patch
  (stable-fixes CVE-2024-43893 bsc#1229759).
- Update
  patches.suse/soc-qcom-pdr-protect-locator_addr-with-the-main-mute.patch
  (git-fixes CVE-2024-43849 bsc#1229307).
- Update
  patches.suse/soc-xilinx-rename-cpu_number1-to-dummy_cpu_number.patch
  (git-fixes CVE-2024-43851 bsc#1229313).
- Update
  patches.suse/spi-microchip-core-ensure-TX-and-RX-FIFOs-are-empty-.patch
  (git-fixes CVE-2024-42279 bsc#1229390).
- Update
  patches.suse/usb-vhci-hcd-Do-not-drop-references-before-new-refer.patch
  (stable-fixes CVE-2024-43883 bsc#1229707).
- Update
  patches.suse/vhost-vsock-always-initialize-seqpacket_allow.patch
  (git-fixes CVE-2024-43873 bsc#1229488).
- Update
  patches.suse/wifi-ath12k-change-DMA-direction-while-mapping-reinj.patch
  (git-fixes CVE-2024-43881 bsc#1229480).
- Update
  patches.suse/wifi-ath12k-fix-invalid-memory-access-while-processi.patch
  (git-fixes CVE-2024-43847 bsc#1229291).
- Update
  patches.suse/wifi-cfg80211-handle-2x996-RU-allocation-in-cfg80211.patch
  (git-fixes CVE-2024-43879 bsc#1229482).
- Update
  patches.suse/wifi-nl80211-disallow-setting-special-AP-channel-wid.patch
  (stable-fixes CVE-2024-43912 bsc#1229830).
- Update
  patches.suse/wifi-rtw89-Fix-array-index-mistake-in-rtw89_sta_info.patch
  (git-fixes CVE-2024-43842 bsc#1229317).
- Update
  patches.suse/wifi-virt_wifi-avoid-reporting-connection-success-wi.patch
  (git-fixes CVE-2024-43841 bsc#1229304).
- commit 140ec33</changelog>
  <changelog author="tiwai@suse.de" date="1725105600">- dmaengine: dw: Add memory bus width verification (git-fixes).
- dmaengine: dw: Add peripheral bus width verification
  (git-fixes).
- soundwire: stream: fix programming slave ports for non-continous
  port maps (git-fixes).
- commit b7e9784</changelog>
  <changelog author="tiwai@suse.de" date="1725192000">- usb: cdnsp: fix for Link TRB with TC (git-fixes).
- usb: dwc3: st: add missing depopulate in probe error path
  (git-fixes).
- usb: dwc3: st: fix probed platform device ref count on probe
  error path (git-fixes).
- usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in
  remove_power_attributes() (git-fixes).
- usb: typec: fsa4480: Relax CHIP_ID check (git-fixes).
- usb: dwc3: omap: add missing depopulate in probe error path
  (git-fixes).
- usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function
  (git-fixes).
- soc: qcom: pmic_glink: Actually communicate when remote goes
  down (git-fixes).
- soc: qcom: cmd-db: Map shared memory as WC, not WB (git-fixes).
- commit 7121142</changelog>
  <changelog author="ailiop@suse.com" date="1725192001">- xfs: Fix the owner setting issue for rmap query in xfs fsmap
  (git-fixes).
- commit 49b5eec</changelog>
  <changelog author="ailiop@suse.com" date="1725192002">- xfs: use XFS_BUF_DADDR_NULL for daddrs in getfsmap code
  (git-fixes).
- commit 288ad9b</changelog>
  <changelog author="ailiop@suse.com" date="1725192003">- xfs: Fix missing interval for missing_owner in xfs fsmap
  (git-fixes).
- commit 5448ab5</changelog>
  <changelog author="ohering@suse.de" date="1725278400">- net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response (git-fixes).
- commit 4dc1da1</changelog>
  <changelog author="osalvador@suse.de" date="1725278401">- mm/sparsemem: fix race in accessing memory_section-&gt;usage
  (bsc#1221326 CVE-2023-52489).
- commit 6aa8957</changelog>
  <changelog author="osalvador@suse.de" date="1725278402">- mm, kmsan: fix infinite recursion due to RCU critical section
  (git-fixes).
- commit 16ad73a</changelog>
  <changelog author="osalvador@suse.de" date="1725278403">- mm: prevent derefencing NULL ptr in pfn_section_valid()
  (git-fixes).
- commit 35f619d</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1725278404">- bluetooth/l2cap: sync sock recv cb and release (bsc#1228576
  CVE-2024-41062).
- commit 6553526</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1725278405">- Bluetooth: L2CAP: Fix deadlock (git-fixes).
- commit 13aba13</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1725278406">- Bluetooth: Fix usage of __hci_cmd_sync_status (git-fixes).
- commit 1bec58d</changelog>
  <changelog author="lhenriques@suse.de" date="1725278407">- ceph: periodically flush the cap releases (bsc#1230056).
- commit e22b6e0</changelog>
</package>
<package pkgid="6c42edd4bad2765dad42f1db9aa877523f53c33bee5d6e60032fbca6b3d79e33" name="cluster-md-kmp-azure" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.8.5.4"/>
  <changelog author="mkubecek@suse.cz" date="1717416000">- series.conf: cleanup
  Fix subsection header to silence series_insert error.
- commit 4628dc3</changelog>
  <changelog author="mkubecek@suse.cz" date="1717416001">- netfilter: nf_tables: release mutex after nft_gc_seq_end from
  abort path (CVE-2024-26925 bsc#1223390).
- commit 578a709</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717416002">- Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
  The L3 bsc#1225765 was created seperately since our customer requires
  PTF.
- Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
- Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
- Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
- Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
- commit 054635e</changelog>
  <changelog author="msuchanek@suse.de" date="1717416003">- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
- powerpc/uaccess: Fix build errors seen with GCC 13/14
  (bsc#1194869).
- commit 46b5d84</changelog>
  <changelog author="msuchanek@suse.de" date="1717416004">- blacklist.conf: PPC fsl_msi is not used
- commit ae6590d</changelog>
  <changelog author="msuchanek@suse.de" date="1717416005">- powerpc/pseries/lparcfg: drop error message from guest name
  lookup (bsc#1187716 ltc#193451 git-fixes).
- commit ceab637</changelog>
  <changelog author="mfranc@suse.cz" date="1717416006">- Update
  patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
  (git-fixes CVE-2024-36955).
- Update
  patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
  (git-fixes bsc#1225715 CVE-2024-36906).
- Update
  patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
  (git-fixes bsc#1225579 CVE-2024-36011).
- Update
  patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
  (git-fixes bsc#1225578 CVE-2024-36013).
- Update
  patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
  (git-fixes bsc#1225502 CVE-2024-36012).
- Update
  patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
  (git-fixes bsc#1225722 CVE-2024-36880).
- Update
  patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
  (git-fixes CVE-2024-36942).
- Update
  patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
  (git-fixes bsc#1225720 CVE-2024-36032).
- Update
  patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
  (git-fixes bsc#1223749 CVE-2024-26990).
- Update
  patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
  (git-fixes bsc#1223692 CVE-2024-26992).
- Update
  patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
  (stable-fixes CVE-2024-36944).
- Update
  patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
  (git-fixes bsc#1225734 CVE-2024-36896).
- Update
  patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
  (stable-fixes CVE-2024-36949).
- Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
  (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
- Update
  patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
  (git-fixes bsc#1225692 CVE-2023-52882).
- Update
  patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
  (git-fixes CVE-2024-26761).
- Update
  patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
  (stable-fixes bsc#1225735 CVE-2024-36897).
- Update
  patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
  (stable-fixes bsc#1225705 CVE-2024-36026).
- Update
  patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
  (stable-fixes CVE-2024-36951).
- Update
  patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
  (git-fixes bsc#1225593 CVE-2024-36014).
- Update
  patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
  (stable-fixes bsc#1225728 CVE-2024-36885).
- Update
  patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
  (git-fixes bsc#1225773 CVE-2024-36936).
- Update
  patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
  (stable-fixes CVE-2024-36950).
- Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
  (git-fixes bsc#1225736 CVE-2024-36898).
- Update
  patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
  (git-fixes bsc#1225698 CVE-2024-36020).
- Update
  patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
  (git-fixes bsc#1225710 CVE-2024-36891).
- Update
  patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
  (git-fixes bsc#1225714 CVE-2024-36890).
- Update
  patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
  (git-fixes bsc#1225708 CVE-2024-36029).
- Update
  patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
  (git-fixes bsc#1225699 CVE-2024-36021).
- Update
  patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
  (git-fixes CVE-2024-26943).
- Update
  patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
  (git-fixes bsc#1225694 CVE-2024-36018).
- Update
  patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
  (git-fixes CVE-2024-36940).
- Update
  patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
  (git-fixes CVE-2024-36959).
- Update
  patches.suse/ppdev-Add-an-error-check-in-register_device.patch
  (git-fixes bsc#1225640 CVE-2024-36015).
- Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
  CVE-2024-36947).
- Update
  patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
  (git-fixes bsc#1225695 CVE-2024-36019).
- Update
  patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
  (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
- Update
  patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
  (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
- Update
  patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
  (git-fixes bsc#1225704 CVE-2024-36025).
- Update
  patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
  (git-fixes CVE-2024-36930).
- Update
  patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
  (bsc#1224331 bsc#1224602 CVE-2024-35814).
- Update
  patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
  (git-fixes bsc#1225642 CVE-2024-36016).
- Update
  patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
  (git-fixes bsc#1225749 CVE-2024-36894).
- Update
  patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
  (git-fixes bsc#1225750 CVE-2024-36895).
- Update
  patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
  (git-fixes bsc#1225748 CVE-2024-36893).
- Update
  patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
  (stable-fixes bsc#1225769 CVE-2024-36921).
- Update
  patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
  (stable-fixes CVE-2024-36922).
- Update
  patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
  (git-fixes CVE-2024-36941).
- Update
  patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
  (git-fixes bsc#1224742 CVE-2024-35803).
- commit 539780f</changelog>
  <changelog author="dwagner@suse.de" date="1717416007">- nvmet: fix ns enable/disable possible hang (git-fixes).
- nvme-multipath: fix io accounting on failover (git-fixes).
- nvme: fix multipath batched completion accounting (git-fixes).
- commit ed3b392</changelog>
  <changelog author="dwagner@suse.de" date="1717416008">- scsi: lpfc: Copyright updates for 14.4.0.2 patches
  (bsc#1225842).
- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
  (bsc#1225842).
  Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
  (bsc#1225842).
- scsi: lpfc: Clear deferred RSCN processing flag when driver
  is unloading (bsc#1225842).
- scsi: lpfc: Update logging of protection type for T10 DIF I/O
  (bsc#1225842).
- scsi: lpfc: Change default logging level for unsolicited CT
  MIB commands (bsc#1225842).
- commit 5a56384</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416009">- smb: client: fix mount when dns_resolver key is not available
  (git-fixes, bsc#1225172).
- commit 28edb5c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416010">- cifs: fix leak of iface for primary channel (git-fixes,
  bsc#1225172).
- commit b7eb8e8</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416011">- Revert "cifs: reconnect work should have reference on server
  struct" (git-fixes, bsc#1225172).
- commit 3ca4c0c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416012">- smb: client: fix parsing of SMB3.1.1 POSIX create context
  (git-fixes, bsc#1225172).
- commit 5f27f69</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416013">- cifs: failure to add channel on iface should bump up weight
  (git-fixes, bsc#1225172).
- commit 007b237</changelog>
  <changelog author="tonyj@suse.de" date="1717416014">- perf/x86: Fix out of range data (git-fixes).
- perf/x86/intel/ds: Don't clear -&gt;pebs_data_cfg for the last
  PEBS event (git-fixes).
- perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
- commit 664d77f</changelog>
  <changelog author="dsterba@suse.com" date="1717588800">- blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
- Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
  Quoting bsc#1225945#c11:
  "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
  transaction for every subvol create")
  ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
  unwritten extent buffer after snapshotting a new subvolume") was never
  backported."
- commit d947258</changelog>
  <changelog author="tonyj@suse.de" date="1717588801">- perf pmu: Count sys and cpuid JSON events separately (git
  fixes).
- perf stat: Don't display metric header for non-leader uncore
  events (git-fixes).
- perf daemon: Fix file leak in daemon_session__control
  (git-fixes).
- perf symbols: Fix ownership of string in dso__load_vmlinux()
  (git-fixes).
- perf thread: Fixes to thread__new() related to initializing comm
  (git-fixes).
- perf report: Avoid SEGV in report__setup_sample_type()
  (git-fixes).
- perf ui browser: Don't save pointer to stack memory (git-fixes).
- perf bench internals inject-build-id: Fix trap divide when
  collecting just one DSO (git-fixes).
- perf intel-pt: Fix unassigned instruction op (discovered by
  MemorySanitizer) (git-fixes).
- perf test shell arm_coresight: Increase buffer size for
  Coresight basic tests (git-fixes).
- perf docs: Document bpf event modifier (git-fixes).
- perf bench uprobe: Remove lib64 from libc.so.6 binary path
  (git-fixes).
- perf record: Fix debug message placement for test consumption
  (git-fixes).
- perf tests: Apply attributes to all events in object code
  reading test (git-fixes).
- perf tests: Make "test data symbol" more robust on Neoverse N1
  (git-fixes).
- perf annotate: Fix annotation_calc_lines() to pass correct
  address to get_srcline() (git-fixes).
- perf stat: Do not fail on metrics on s390 z/VM systems
  (git-fixes).
- perf sched timehist: Fix -g/--call-graph option failure
  (git-fixes).
- perf annotate: Get rid of duplicate --group option item
  (git-fixes).
- perf probe: Add missing libgen.h header needed for using
  basename() (git-fixes).
- perf record: Delete session after stopping sideband thread
  (git-fixes).
- perf auxtrace: Fix multiple use of --itrace option (git-fixes).
- perf script: Show also errors for --insn-trace option
  (git-fixes).
- perf lock contention: Add a missing NULL check (git-fixes).
- perf vendor events amd: Fix Zen 4 cache latency events
  (git-fixes).
- libperf evlist: Avoid out-of-bounds access (git-fixes).
- perf pmu: Fix a potential memory leak in perf_pmu__lookup()
  (git-fixes).
- perf print-events: make is_event_supported() more robust
  (git-fixes).
- perf list: fix short description for some cache events
  (git-fixes).
- perf metric: Don't remove scale from counts (git-fixes).
- perf stat: Avoid metric-only segv (git-fixes).
- perf expr: Fix "has_event" function for metric style events
  (git-fixes).
- perf srcline: Add missed addr2line closes (git-fixes).
- perf thread_map: Free strlist on normal path in
  thread_map__new_by_tid_str() (git-fixes).
- perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
- perf jevents: Drop or simplify small integer values (git-fixes).
- perf evsel: Fix duplicate initialization of data-&gt;id in
  evsel__parse_sample() (git-fixes).
- perf pmu: Treat the msr pmu as software (git-fixes).
- perf record: Check conflict between '--timestamp-filename'
  option and pipe mode before recording (git-fixes).
- perf record: Fix possible incorrect free in
  record__switch_output() (git-fixes).
- perf vendor events amd: Add Zen 4 memory controller events
  (git-fixes).
- perf top: Uniform the event name for the hybrid machine
  (git-fixes).
- perf top: Use evsel's cpus to replace user_requested_cpus
  (git-fixes).
- commit a1f9340</changelog>
  <changelog author="tonyj@suse.de" date="1717675200">- perf ui browser: Avoid SEGV on title (git fixes).
- commit 1578c22</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675201">- inet: inet_defrag: prevent sk release while still in use
  (CVE-2024-26921 bsc#1223138).
- commit 2016faf</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675202">- net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
- commit 7bf5961</changelog>
</package>
<package pkgid="9d25650fb9b39373180ef03939986086bf8f726c8f47661afec6adeefa03bf86" name="cluster-md-kmp-azure" arch="x86_64">
  <version epoch="0" ver="6.4.0" rel="150600.8.5.4"/>
  <changelog author="mkubecek@suse.cz" date="1717416000">- series.conf: cleanup
  Fix subsection header to silence series_insert error.
- commit 4628dc3</changelog>
  <changelog author="mkubecek@suse.cz" date="1717416001">- netfilter: nf_tables: release mutex after nft_gc_seq_end from
  abort path (CVE-2024-26925 bsc#1223390).
- commit 578a709</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717416002">- Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
  The L3 bsc#1225765 was created seperately since our customer requires
  PTF.
- Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
- Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
- Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
- Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
- commit 054635e</changelog>
  <changelog author="msuchanek@suse.de" date="1717416003">- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
- powerpc/uaccess: Fix build errors seen with GCC 13/14
  (bsc#1194869).
- commit 46b5d84</changelog>
  <changelog author="msuchanek@suse.de" date="1717416004">- blacklist.conf: PPC fsl_msi is not used
- commit ae6590d</changelog>
  <changelog author="msuchanek@suse.de" date="1717416005">- powerpc/pseries/lparcfg: drop error message from guest name
  lookup (bsc#1187716 ltc#193451 git-fixes).
- commit ceab637</changelog>
  <changelog author="mfranc@suse.cz" date="1717416006">- Update
  patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
  (git-fixes CVE-2024-36955).
- Update
  patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
  (git-fixes bsc#1225715 CVE-2024-36906).
- Update
  patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
  (git-fixes bsc#1225579 CVE-2024-36011).
- Update
  patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
  (git-fixes bsc#1225578 CVE-2024-36013).
- Update
  patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
  (git-fixes bsc#1225502 CVE-2024-36012).
- Update
  patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
  (git-fixes bsc#1225722 CVE-2024-36880).
- Update
  patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
  (git-fixes CVE-2024-36942).
- Update
  patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
  (git-fixes bsc#1225720 CVE-2024-36032).
- Update
  patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
  (git-fixes bsc#1223749 CVE-2024-26990).
- Update
  patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
  (git-fixes bsc#1223692 CVE-2024-26992).
- Update
  patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
  (stable-fixes CVE-2024-36944).
- Update
  patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
  (git-fixes bsc#1225734 CVE-2024-36896).
- Update
  patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
  (stable-fixes CVE-2024-36949).
- Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
  (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
- Update
  patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
  (git-fixes bsc#1225692 CVE-2023-52882).
- Update
  patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
  (git-fixes CVE-2024-26761).
- Update
  patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
  (stable-fixes bsc#1225735 CVE-2024-36897).
- Update
  patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
  (stable-fixes bsc#1225705 CVE-2024-36026).
- Update
  patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
  (stable-fixes CVE-2024-36951).
- Update
  patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
  (git-fixes bsc#1225593 CVE-2024-36014).
- Update
  patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
  (stable-fixes bsc#1225728 CVE-2024-36885).
- Update
  patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
  (git-fixes bsc#1225773 CVE-2024-36936).
- Update
  patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
  (stable-fixes CVE-2024-36950).
- Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
  (git-fixes bsc#1225736 CVE-2024-36898).
- Update
  patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
  (git-fixes bsc#1225698 CVE-2024-36020).
- Update
  patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
  (git-fixes bsc#1225710 CVE-2024-36891).
- Update
  patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
  (git-fixes bsc#1225714 CVE-2024-36890).
- Update
  patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
  (git-fixes bsc#1225708 CVE-2024-36029).
- Update
  patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
  (git-fixes bsc#1225699 CVE-2024-36021).
- Update
  patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
  (git-fixes CVE-2024-26943).
- Update
  patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
  (git-fixes bsc#1225694 CVE-2024-36018).
- Update
  patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
  (git-fixes CVE-2024-36940).
- Update
  patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
  (git-fixes CVE-2024-36959).
- Update
  patches.suse/ppdev-Add-an-error-check-in-register_device.patch
  (git-fixes bsc#1225640 CVE-2024-36015).
- Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
  CVE-2024-36947).
- Update
  patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
  (git-fixes bsc#1225695 CVE-2024-36019).
- Update
  patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
  (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
- Update
  patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
  (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
- Update
  patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
  (git-fixes bsc#1225704 CVE-2024-36025).
- Update
  patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
  (git-fixes CVE-2024-36930).
- Update
  patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
  (bsc#1224331 bsc#1224602 CVE-2024-35814).
- Update
  patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
  (git-fixes bsc#1225642 CVE-2024-36016).
- Update
  patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
  (git-fixes bsc#1225749 CVE-2024-36894).
- Update
  patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
  (git-fixes bsc#1225750 CVE-2024-36895).
- Update
  patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
  (git-fixes bsc#1225748 CVE-2024-36893).
- Update
  patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
  (stable-fixes bsc#1225769 CVE-2024-36921).
- Update
  patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
  (stable-fixes CVE-2024-36922).
- Update
  patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
  (git-fixes CVE-2024-36941).
- Update
  patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
  (git-fixes bsc#1224742 CVE-2024-35803).
- commit 539780f</changelog>
  <changelog author="dwagner@suse.de" date="1717416007">- nvmet: fix ns enable/disable possible hang (git-fixes).
- nvme-multipath: fix io accounting on failover (git-fixes).
- nvme: fix multipath batched completion accounting (git-fixes).
- commit ed3b392</changelog>
  <changelog author="dwagner@suse.de" date="1717416008">- scsi: lpfc: Copyright updates for 14.4.0.2 patches
  (bsc#1225842).
- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
  (bsc#1225842).
  Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
  (bsc#1225842).
- scsi: lpfc: Clear deferred RSCN processing flag when driver
  is unloading (bsc#1225842).
- scsi: lpfc: Update logging of protection type for T10 DIF I/O
  (bsc#1225842).
- scsi: lpfc: Change default logging level for unsolicited CT
  MIB commands (bsc#1225842).
- commit 5a56384</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416009">- smb: client: fix mount when dns_resolver key is not available
  (git-fixes, bsc#1225172).
- commit 28edb5c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416010">- cifs: fix leak of iface for primary channel (git-fixes,
  bsc#1225172).
- commit b7eb8e8</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416011">- Revert "cifs: reconnect work should have reference on server
  struct" (git-fixes, bsc#1225172).
- commit 3ca4c0c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416012">- smb: client: fix parsing of SMB3.1.1 POSIX create context
  (git-fixes, bsc#1225172).
- commit 5f27f69</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416013">- cifs: failure to add channel on iface should bump up weight
  (git-fixes, bsc#1225172).
- commit 007b237</changelog>
  <changelog author="tonyj@suse.de" date="1717416014">- perf/x86: Fix out of range data (git-fixes).
- perf/x86/intel/ds: Don't clear -&gt;pebs_data_cfg for the last
  PEBS event (git-fixes).
- perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
- commit 664d77f</changelog>
  <changelog author="dsterba@suse.com" date="1717588800">- blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
- Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
  Quoting bsc#1225945#c11:
  "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
  transaction for every subvol create")
  ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
  unwritten extent buffer after snapshotting a new subvolume") was never
  backported."
- commit d947258</changelog>
  <changelog author="tonyj@suse.de" date="1717588801">- perf pmu: Count sys and cpuid JSON events separately (git
  fixes).
- perf stat: Don't display metric header for non-leader uncore
  events (git-fixes).
- perf daemon: Fix file leak in daemon_session__control
  (git-fixes).
- perf symbols: Fix ownership of string in dso__load_vmlinux()
  (git-fixes).
- perf thread: Fixes to thread__new() related to initializing comm
  (git-fixes).
- perf report: Avoid SEGV in report__setup_sample_type()
  (git-fixes).
- perf ui browser: Don't save pointer to stack memory (git-fixes).
- perf bench internals inject-build-id: Fix trap divide when
  collecting just one DSO (git-fixes).
- perf intel-pt: Fix unassigned instruction op (discovered by
  MemorySanitizer) (git-fixes).
- perf test shell arm_coresight: Increase buffer size for
  Coresight basic tests (git-fixes).
- perf docs: Document bpf event modifier (git-fixes).
- perf bench uprobe: Remove lib64 from libc.so.6 binary path
  (git-fixes).
- perf record: Fix debug message placement for test consumption
  (git-fixes).
- perf tests: Apply attributes to all events in object code
  reading test (git-fixes).
- perf tests: Make "test data symbol" more robust on Neoverse N1
  (git-fixes).
- perf annotate: Fix annotation_calc_lines() to pass correct
  address to get_srcline() (git-fixes).
- perf stat: Do not fail on metrics on s390 z/VM systems
  (git-fixes).
- perf sched timehist: Fix -g/--call-graph option failure
  (git-fixes).
- perf annotate: Get rid of duplicate --group option item
  (git-fixes).
- perf probe: Add missing libgen.h header needed for using
  basename() (git-fixes).
- perf record: Delete session after stopping sideband thread
  (git-fixes).
- perf auxtrace: Fix multiple use of --itrace option (git-fixes).
- perf script: Show also errors for --insn-trace option
  (git-fixes).
- perf lock contention: Add a missing NULL check (git-fixes).
- perf vendor events amd: Fix Zen 4 cache latency events
  (git-fixes).
- libperf evlist: Avoid out-of-bounds access (git-fixes).
- perf pmu: Fix a potential memory leak in perf_pmu__lookup()
  (git-fixes).
- perf print-events: make is_event_supported() more robust
  (git-fixes).
- perf list: fix short description for some cache events
  (git-fixes).
- perf metric: Don't remove scale from counts (git-fixes).
- perf stat: Avoid metric-only segv (git-fixes).
- perf expr: Fix "has_event" function for metric style events
  (git-fixes).
- perf srcline: Add missed addr2line closes (git-fixes).
- perf thread_map: Free strlist on normal path in
  thread_map__new_by_tid_str() (git-fixes).
- perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
- perf jevents: Drop or simplify small integer values (git-fixes).
- perf evsel: Fix duplicate initialization of data-&gt;id in
  evsel__parse_sample() (git-fixes).
- perf pmu: Treat the msr pmu as software (git-fixes).
- perf record: Check conflict between '--timestamp-filename'
  option and pipe mode before recording (git-fixes).
- perf record: Fix possible incorrect free in
  record__switch_output() (git-fixes).
- perf vendor events amd: Add Zen 4 memory controller events
  (git-fixes).
- perf top: Uniform the event name for the hybrid machine
  (git-fixes).
- perf top: Use evsel's cpus to replace user_requested_cpus
  (git-fixes).
- commit a1f9340</changelog>
  <changelog author="tonyj@suse.de" date="1717675200">- perf ui browser: Avoid SEGV on title (git fixes).
- commit 1578c22</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675201">- inet: inet_defrag: prevent sk release while still in use
  (CVE-2024-26921 bsc#1223138).
- commit 2016faf</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675202">- net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
- commit 7bf5961</changelog>
</package>
<package pkgid="9e62a924abd03a691c60caf91a93079da8a2c23043720338fffc3824ac92e267" name="cluster-md-kmp-azure" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.8.8.2"/>
  <changelog author="tiwai@suse.de" date="1722081600">- auxdisplay: ht16k33: Drop reference after LED registration
  (git-fixes).
- ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
  on unprepare (git-fixes).
- ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
- ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
  reachable (git-fixes).
- ASoC: sof: amd: fix for firmware reload failure in Vangogh
  platform (git-fixes).
- ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
- ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
  (git-fixes).
- ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
- ALSA: ump: Don't update FB name for static blocks (git-fixes).
- drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
- drm/i915/gt: Do not consider preemption during execlists_dequeue
  for gen8 (git-fixes).
- drm/i915/dp: Don't switch the LTTPR mode on an active link
  (git-fixes).
- commit d7e2deb</changelog>
  <changelog author="tiwai@suse.de" date="1722081601">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
</package>
<package pkgid="4888bd4e42f4d25308448074b2dc460743d6cab9d800d316c262eb6170592805" name="cluster-md-kmp-azure" arch="x86_64">
  <version epoch="0" ver="6.4.0" rel="150600.8.8.2"/>
  <changelog author="tiwai@suse.de" date="1722081600">- auxdisplay: ht16k33: Drop reference after LED registration
  (git-fixes).
- ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
  on unprepare (git-fixes).
- ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
- ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
  reachable (git-fixes).
- ASoC: sof: amd: fix for firmware reload failure in Vangogh
  platform (git-fixes).
- ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
- ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
  (git-fixes).
- ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
- ALSA: ump: Don't update FB name for static blocks (git-fixes).
- drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
- drm/i915/gt: Do not consider preemption during execlists_dequeue
  for gen8 (git-fixes).
- drm/i915/dp: Don't switch the LTTPR mode on an active link
  (git-fixes).
- commit d7e2deb</changelog>
  <changelog author="tiwai@suse.de" date="1722081601">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
</package>
<package pkgid="0ae66e63c48b09e959a6bccba7b155fa3e6ebb362c142409899d4eeec99746c8" name="cluster-md-kmp-default" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.14.2"/>
  <changelog author="tiwai@suse.de" date="1719662400">- gpiolib: cdev: Disallow reconfiguration without direction
  (uAPI v1) (git-fixes).
- gpio: davinci: Validate the obtained number of IRQs (git-fixes).
- commit 919ebd1</changelog>
  <changelog author="tiwai@suse.de" date="1719748800">- i2c: testunit: discard write requests while old command is
  running (git-fixes).
- i2c: testunit: don't erase registers after STOP (git-fixes).
- mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
  (git-fixes).
- mmc: sdhci: Do not invert write-protect twice (git-fixes).
- mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
  (git-fixes).
- mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
  (git-fixes).
- commit 448487d</changelog>
  <changelog author="tiwai@suse.de" date="1719748801">- crypto: iaa - Account for cpu-less numa nodes (bsc#1227190).
- commit cd600aa</changelog>
  <changelog author="tiwai@suse.de" date="1719748802">- crypto: deflate - Add aliases to deflate (bsc#1227190).
- commit 27ffd92</changelog>
  <changelog author="tiwai@suse.de" date="1719835200">- ata: ahci: Clean up sysfs file on error (git-fixes).
- ata: libata-core: Fix double free on error (git-fixes).
- ata,scsi: libata-core: Do not leak memory for ata_port struct
  members (git-fixes).
- ata: libata-core: Fix null pointer dereference on error
  (git-fixes).
- kbuild: Fix build target deb-pkg: ln: failed to create hard link
  (git-fixes).
- kbuild: doc: Update default INSTALL_MOD_DIR from extra to
  updates (git-fixes).
- kbuild: Install dtb files as 0644 in Makefile.dtbinst
  (git-fixes).
- counter: ti-eqep: enable clock at probe (git-fixes).
- iio: chemical: bme680: Fix sensor data read operation
  (git-fixes).
- iio: chemical: bme680: Fix overflows in compensate() functions
  (git-fixes).
- iio: chemical: bme680: Fix calibration data variable
  (git-fixes).
- iio: chemical: bme680: Fix pressure value output (git-fixes).
- iio: accel: fxls8962af: select IIO_BUFFER &amp; IIO_KFIFO_BUF
  (git-fixes).
- iio: adc: ad7266: Fix variable checking bug (git-fixes).
- iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
  (git-fixes).
- serial: bcm63xx-uart: fix tx after conversion to
  uart_port_tx_limited() (git-fixes).
- serial: core: introduce uart_port_tx_limited_flags()
  (git-fixes).
- Revert "serial: core: only stop transmit when HW fifo is empty"
  (git-fixes).
- tty: mcf: MCF54418 has 10 UARTS (git-fixes).
- usb: gadget: aspeed_udc: fix device address configuration
  (git-fixes).
- usb: dwc3: core: remove lock of otg mode during gadget
  suspend/resume to avoid deadlock (git-fixes).
- usb: typec: ucsi: glink: fix child node release in probe
  function (git-fixes).
- usb: musb: da8xx: fix a resource leak in probe() (git-fixes).
- usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  (git-fixes).
- usb: gadget: printer: fix races against disable (git-fixes).
- PCI/MSI: Fix UAF in msi_capability_init (git-fixes).
- commit a2ea5a9</changelog>
  <changelog author="ptesarik@suse.com" date="1719835201">- net: ena: Fix redundant device NUMA node override
  (jsc#PED-8688).
- commit 6ad6684</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835202">- tcp: do not accept ACK of bytes we never sent (CVE-2023-52881
  bsc#1225611).
- commit 16404a6</changelog>
  <changelog author="mhocko@suse.com" date="1719835203">- Update
  patches.suse/1352-drm-amdgpu-Fix-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52883
  bsc#1226630).
- Update
  patches.suse/9p-add-missing-locking-around-taking-dentry-fid-list.patch
  (git-fixes CVE-2024-39463 bsc#1227090).
- Update
  patches.suse/ALSA-Fix-deadlocks-with-kctl-removals-at-disconnecti.patch
  (stable-fixes CVE-2024-38600 bsc#1226864).
- Update
  patches.suse/ALSA-core-Fix-NULL-module-pointer-assignment-at-card.patch
  (git-fixes CVE-2024-38605 bsc#1226740).
- Update
  patches.suse/ALSA-hda-Fix-possible-null-ptr-deref-when-assigning-.patch
  (git-fixes CVE-2023-52806 bsc#1225554).
- Update
  patches.suse/ALSA-hda-cs_dsp_ctl-Use-private_free-for-control-cle.patch
  (git-fixes CVE-2024-38388 bsc#1226890).
- Update
  patches.suse/ALSA-timer-Set-lower-bound-of-start-tick-time.patch
  (stable-fixes git-fixes CVE-2024-38618 bsc#1226754).
- Update
  patches.suse/ASoC-kirkwood-Fix-potential-NULL-dereference.patch
  (git-fixes CVE-2024-38550 bsc#1226633).
- Update
  patches.suse/ASoC-mediatek-Assign-dummy-when-codec-not-specified-.patch
  (git-fixes CVE-2024-38551 bsc#1226761).
- Update
  patches.suse/Bluetooth-btusb-Add-date-evt_skb-is-NULL-check.patch
  (git-fixes CVE-2023-52833 bsc#1225595).
- Update
  patches.suse/Bluetooth-hci_core-Fix-possible-buffer-overflow.patch
  (git-fixes CVE-2024-26889).
- Update
  patches.suse/HID-uclogic-Fix-user-memory-access-bug-in-uclogic_pa.patch
  (git-fixes CVE-2023-52866 bsc#1225120).
- Update
  patches.suse/IB-mlx5-Fix-init-stage-error-handling-to-avoid-doubl.patch
  (jsc#PED-6864 CVE-2023-52851 bsc#1225587).
- Update
  patches.suse/Input-cyapa-add-missing-input-core-locking-to-suspen.patch
  (git-fixes CVE-2023-52884 bsc#1226764).
- Update
  patches.suse/Input-synaptics-rmi4-fix-use-after-free-in-rmi_unreg.patch
  (git-fixes CVE-2023-52840 bsc#1224928).
- Update
  patches.suse/KEYS-trusted-Do-not-use-WARN-when-encode-fails.patch
  (git-fixes CVE-2024-36975 bsc#1226520).
- Update
  patches.suse/KEYS-trusted-Fix-memory-leak-in-tpm2_key_encode.patch
  (git-fixes CVE-2024-36967 bsc#1226131).
- Update
  patches.suse/RDMA-cma-Fix-kmemleak-in-rdma_core-observed-during-b.patch
  (git-fixes CVE-2024-38539 bsc#1226608).
- Update patches.suse/RDMA-hns-Fix-UAF-for-cq-async-event.patch
  (git-fixes CVE-2024-38545 bsc#1226595).
- Update
  patches.suse/RDMA-hns-Fix-deadlock-on-SRQ-async-events.patch
  (git-fixes CVE-2024-38591 bsc#1226738).
- Update
  patches.suse/RDMA-hns-Modify-the-print-level-of-CQE-error.patch
  (git-fixes CVE-2024-38590 bsc#1226839).
- Update
  patches.suse/RDMA-rxe-Fix-seg-fault-in-rxe_comp_queue_pkt.patch
  (git-fixes CVE-2024-38544 bsc#1226597).
- Update
  patches.suse/SUNRPC-Fix-RPC-client-cleaned-up-the-freed-pipefs-de.patch
  (git-fixes CVE-2023-52803 bsc#1225008).
- Update patches.suse/af_unix-Clear-stale-u-oob_skb.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-35970 bsc#1224584).
- Update
  patches.suse/af_unix-Drop-oob_skb-ref-before-purging-queue-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26750 bsc#1222617).
- Update
  patches.suse/af_unix-Fix-task-hung-while-purging-oob_skb-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26780 bsc#1222588).
- Update
  patches.suse/af_unix-Update-unix_sk-sk-oob_skb-under-sk_receive_queue-lock.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-36972 bsc#1226163).
- Update
  patches.suse/arm64-Restrict-CPU_BIG_ENDIAN-to-GNU-as-or-LLVM-IAS-.patch
  (git-fixes CVE-2023-52750 bsc#1225485).
- Update
  patches.suse/atl1c-Work-around-the-DMA-RX-overflow-issue.patch
  (git-fixes CVE-2023-52834 bsc#1225599).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issue-of-net_device.patch
  (git-fixes CVE-2024-38554 bsc#1226742).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issues-of-ax25_dev.patch
  (git-fixes CVE-2024-38602 bsc#1226613).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-reorder-of-WRITE-lqueued.patch
  (bsc#1225605 CVE-2024-38384 bsc#1226938).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-resetting-io-stat.patch
  (bsc#1225605 CVE-2024-38663 bsc#1226939).
- Update
  patches.suse/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch
  (git-fixes CVE-2024-38540 bsc#1226582).
- Update
  patches.suse/bonding-stop-the-device-in-bond_setup_by_slave.patch
  (git-fixes CVE-2023-52784 bsc#1224946).
- Update
  patches.suse/can-dev-can_put_echo_skb-don-t-crash-kernel-if-can_p.patch
  (git-fixes CVE-2023-52878 bsc#1225000).
- Update
  patches.suse/clk-mediatek-clk-mt2701-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52875 bsc#1225096).
- Update
  patches.suse/clk-mediatek-clk-mt6765-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52870 bsc#1224937).
- Update
  patches.suse/clk-mediatek-clk-mt6779-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52873 bsc#1225589).
- Update
  patches.suse/clk-mediatek-clk-mt6797-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52865 bsc#1225086).
- Update
  patches.suse/clk-mediatek-clk-mt7629-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52858 bsc#1225566).
- Update
  patches.suse/clk-mediatek-clk-mt7629-eth-Add-check-for-mtk_alloc_.patch
  (git-fixes CVE-2023-52876 bsc#1225036).
- Update
  patches.suse/cppc_cpufreq-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38573 bsc#1226739).
- Update patches.suse/cpufreq-exit-callback-is-optional.patch
  (git-fixes CVE-2024-38615 bsc#1226592).
- Update patches.suse/crypto-bcm-Fix-pointer-arithmetic.patch
  (git-fixes CVE-2024-38579 bsc#1226637).
- Update
  patches.suse/crypto-pcrypt-Fix-hungtask-for-PADATA_RESET.patch
  (git-fixes CVE-2023-52813 bsc#1225527).
- Update patches.suse/cxl-mem-Fix-shutdown-order.patch (git-fixes
  CVE-2023-52849 bsc#1224949).
- Update
  patches.suse/cxl-region-Do-not-try-to-cleanup-after-cxl_region_se.patch
  (git-fixes CVE-2023-52792 bsc#1225477).
- Update patches.suse/cxl-region-Fix-cxlr_pmem-leaks.patch
  (git-fixes CVE-2024-38391 bsc#1226894).
- Update
  patches.suse/dma-buf-sw-sync-don-t-enable-IRQ-from-sync_print_obj.patch
  (git-fixes CVE-2024-38780 bsc#1226886).
- Update
  patches.suse/dma-mapping-benchmark-fix-node-id-validation.patch
  (git-fixes CVE-2024-34777 bsc#1226796).
- Update
  patches.suse/dma-mapping-benchmark-handle-NUMA_NO_NODE-correctly.patch
  (git-fixes CVE-2024-39277 bsc#1226909).
- Update
  patches.suse/dmaengine-idxd-Avoid-unnecessary-destruction-of-file.patch
  (git-fixes CVE-2024-38629 bsc#1226905).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Pola.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52819
  bsc#1225532).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-SMU7.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52818
  bsc#1225530).
- Update
  patches.suse/drm-amd-check-num-of-link-levels-when-update-pcie-pa.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52812
  bsc#1225564).
- Update
  patches.suse/drm-amd-display-Avoid-NULL-dereference-of-timing-gen.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52753
  bsc#1225478).
- Update
  patches.suse/drm-amd-display-Fix-division-by-zero-in-setup_dsc_co.patch
  (stable-fixes CVE-2024-36969 bsc#1226155).
- Update
  patches.suse/drm-amd-display-Fix-null-pointer-dereference-in-erro.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52862
  bsc#1225015).
- Update
  patches.suse/drm-amd-display-Fix-potential-index-out-of-bounds-in.patch
  (git-fixes CVE-2024-38552 bsc#1226767).
- Update
  patches.suse/drm-amd-display-fix-a-NULL-pointer-dereference-in-am.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52773
  bsc#1225041).
- Update
  patches.suse/drm-amd-display-fixed-integer-types-and-null-check-l.patch
  (git-fixes CVE-2024-26767).
- Update
  patches.suse/drm-amdgpu-Fix-a-null-pointer-access-when-the-smc_rr.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52817
  bsc#1225569).
- Update
  patches.suse/drm-amdgpu-Fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch
  (git-fixes CVE-2024-39291 bsc#1226934).
- Update
  patches.suse/drm-amdgpu-Fix-potential-null-pointer-derefernce.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52814
  bsc#1225565).
- Update
  patches.suse/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch
  (stable-fixes CVE-2024-39471 bsc#1227096).
- Update
  patches.suse/drm-amdgpu-mes-fix-use-after-free-issue.patch
  (stable-fixes CVE-2024-38581 bsc#1226657).
- Update
  patches.suse/drm-amdgpu-vkms-fix-a-possible-null-pointer-derefere.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52815
  bsc#1225568).
- Update
  patches.suse/drm-amdkfd-Fix-a-race-condition-of-vram-buffer-unref.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52825
  bsc#1225076).
- Update
  patches.suse/drm-amdkfd-Fix-shift-out-of-bounds-issue.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52816
  bsc#1225529).
- Update
  patches.suse/drm-bridge-cdns-mhdp8546-Fix-possible-null-pointer-d.patch
  (git-fixes CVE-2024-38548).
- Update
  patches.suse/drm-bridge-it66121-Fix-invalid-connector-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52861
  bsc#1224941).
- Update
  patches.suse/drm-bridge-lt8912b-Fix-crash-on-bridge-detach.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52856
  bsc#1224932).
- Update
  patches.suse/drm-mediatek-Add-0-size-check-to-mtk_drm_gem_obj.patch
  (git-fixes CVE-2024-38549 bsc#1226735).
- Update
  patches.suse/drm-mediatek-Fix-coverity-issue-with-unintentional-i.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52857
  bsc#1225581).
- Update
  patches.suse/drm-mediatek-Init-ddp_comp-with-devm_kcalloc.patch
  (git-fixes CVE-2024-38592 bsc#1226844).
- Update
  patches.suse/drm-msm-a6xx-Avoid-a-nullptr-dereference-when-speedb.patch
  (git-fixes CVE-2024-38390 bsc#1226891).
- Update
  patches.suse/drm-msm-dpu-Add-callback-function-pointer-check-befo.patch
  (git-fixes CVE-2024-38622 bsc#1226856).
- Update
  patches.suse/drm-panel-fix-a-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52821
  bsc#1225022).
- Update
  patches.suse/drm-panel-panel-tpo-tpg110-fix-a-possible-null-point.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52826
  bsc#1225077).
- Update patches.suse/drm-radeon-possible-buffer-overflow.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52867
  bsc#1225009).
- Update
  patches.suse/drm-vc4-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38546 bsc#1226593).
- Update
  patches.suse/drm-vmwgfx-Fix-invalid-reads-in-fence-signaled-event.patch
  (git-fixes CVE-2024-36960 bsc#1225872).
- Update
  patches.suse/drm-zynqmp_dpsub-Always-register-bridge.patch
  (git-fixes CVE-2024-38664 bsc#1226941).
- Update
  patches.suse/e1000e-change-usleep_range-to-udelay-in-PHY-mdic-acc.patch
  (CVE-2024-39296 bsc#1226989 CVE-2024-36887 bsc#1225731).
- Update
  patches.suse/ecryptfs-Fix-buffer-size-for-tag-66-packet.patch
  (git-fixes CVE-2024-38578 bsc#1226634).
- Update
  patches.suse/efi-libstub-only-free-priv.runtime_map-when-allocate.patch
  (git-fixes CVE-2024-33619 bsc#1226768).
- Update
  patches.suse/fbdev-imsttfb-fix-a-resource-leak-in-probe.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52838
  bsc#1225031).
- Update
  patches.suse/fs-9p-only-translate-RWX-permissions-for-plain-9P200.patch
  (git-fixes CVE-2024-36964 bsc#1225866).
- Update
  patches.suse/fs-jfs-Add-check-for-negative-db_l2nbperpage.patch
  (git-fixes CVE-2023-52810 bsc#1225557).
- Update
  patches.suse/fs-jfs-Add-validity-check-for-db_maxag-and-db_agpref.patch
  (git-fixes CVE-2023-52804 bsc#1225550).
- Update
  patches.suse/ftrace-Fix-possible-use-after-free-issue-in-ftrace_location.patch
  (git-fixes CVE-2024-38588 bsc#1226837).
- Update
  patches.suse/genirq-irqdesc-Prevent-use-after-free-in-irq_find_at.patch
  (git-fixes CVE-2024-38385 bsc#1227085).
- Update patches.suse/gfs2-ignore-negated-quota-changes.patch
  (git-fixes CVE-2023-52759 bsc#1225560).
- Update
  patches.suse/hid-cp2112-Fix-duplicate-workqueue-initialization.patch
  (git-fixes CVE-2023-52853 bsc#1224988).
- Update
  patches.suse/hwmon-axi-fan-control-Fix-possible-NULL-pointer-dere.patch
  (git-fixes CVE-2023-52863 bsc#1225586).
- Update
  patches.suse/i2c-acpi-Unbind-mux-adapters-before-delete.patch
  (git-fixes CVE-2024-39362 bsc#1226995).
- Update
  patches.suse/i2c-core-Run-atomic-i2c-xfer-when-preemptible.patch
  (git-fixes CVE-2023-52791 bsc#1225108).
- Update
  patches.suse/i3c-master-mipi-i3c-hci-Fix-a-kernel-panic-for-acces.patch
  (git-fixes CVE-2023-52763 bsc#1225570).
- Update
  patches.suse/i3c-mipi-i3c-hci-Fix-out-of-bounds-access-in-hci_dma.patch
  (git-fixes CVE-2023-52766).
- Update
  patches.suse/i915-perf-Fix-NULL-deref-bugs-with-drm_dbg-calls.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52788
  bsc#1225106).
- Update
  patches.suse/igb-Fix-string-truncation-warnings-in-igb_set_fw_ver.patch
  (git-fixes CVE-2024-36010 bsc#1225594).
- Update
  patches.suse/iommu-vt-d-Fix-WARN_ON-in-iommu-probe-path.patch
  (git-fixes CVE-2024-35957 bsc#1224673).
- Update
  patches.suse/iommufd-Fix-missing-update-of-domains_itree-after-splitting-iopt
  (jsc#PED-7779 jsc#PED-7780 CVE-2023-52801 bsc#1225006).
- Update
  patches.suse/ipvlan-add-ipvlan_route_v6_outbound-helper.patch
  (git-fixes CVE-2023-52796 bsc#1224930).
- Update
  patches.suse/jffs2-prevent-xattr-node-from-overflowing-the-eraseblock.patch
  (git-fixes CVE-2024-38599 bsc#1226848).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-dbFindLeaf.patch
  (git-fixes CVE-2023-52799 bsc#1225472).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-diAlloc.patch
  (git-fixes CVE-2023-52805 bsc#1225553).
- Update
  patches.suse/kunit-fortify-Fix-mismatched-kvalloc-vfree-usage.patch
  (git-fixes CVE-2024-38617 bsc#1226859).
- Update
  patches.suse/lib-generic-radix-tree.c-Don-t-overflow-in-peek.patch
  (git-fixes CVE-2021-47432 bsc#1225391).
- Update
  patches.suse/lib-test_hmm.c-handle-src_pfns-and-dst_pfns-allocati.patch
  (git-fixes CVE-2024-38543 bsc#1226594).
- Update
  patches.suse/locking-ww_mutex-test-Fix-potential-workqueue-corrup.patch
  (bsc#1219953 CVE-2023-52836 bsc#1225609).
- Update
  patches.suse/md-Don-t-ignore-suspended-array-in-md_check_recovery-1baa.patch
  (bsc#1219596 CVE-2024-26758).
- Update
  patches.suse/media-atomisp-ssh_css-Fix-a-null-pointer-dereference.patch
  (git-fixes CVE-2024-38547 bsc#1226632).
- Update
  patches.suse/media-bttv-fix-use-after-free-error-due-to-btv-timeo.patch
  (git-fixes CVE-2023-52847 bsc#1225588).
- Update
  patches.suse/media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch
  (git-fixes CVE-2023-52764 bsc#1225571).
- Update
  patches.suse/media-hantro-Check-whether-reset-op-is-defined-befor.patch
  (git-fixes CVE-2023-52850 bsc#1225014).
- Update
  patches.suse/media-i2c-et8ek8-Don-t-strip-remove-function-when-dr.patch
  (git-fixes CVE-2024-38611 bsc#1226760).
- Update
  patches.suse/media-imon-fix-access-to-invalid-resource-for-the-se.patch
  (git-fixes CVE-2023-52754 bsc#1225490).
- Update
  patches.suse/media-lgdt3306a-Add-a-check-against-null-pointer-def.patch
  (stable-fixes CVE-2022-48772 bsc#1226976).
- Update
  patches.suse/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch
  (git-fixes CVE-2024-38621 bsc#1226895).
- Update
  patches.suse/media-vidtv-mux-Add-check-and-kfree-for-kstrdup.patch
  (git-fixes CVE-2023-52841 bsc#1225592).
- Update patches.suse/media-vidtv-psi-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52844 bsc#1225590).
- Update
  patches.suse/mfd-qcom-spmi-pmic-Fix-revid-implementation.patch
  (git-fixes CVE-2023-52765 bsc#1225029).
- Update
  patches.suse/misc-microchip-pci1xxxx-fix-double-free-in-the-error.patch
  (git-fixes CVE-2024-36973 bsc#1226457).
- Update
  patches.suse/net-hns3-fix-out-of-bounds-access-may-occur-when-coa.patch
  (git-fixes CVE-2023-52807 bsc#1225097).
- Update
  patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch
  (git-fixes CVE-2024-36962 bsc#1225827).
- Update
  patches.suse/net-mlx5-Fix-peer-devlink-set-for-SF-representor-dev.patch
  (git-fixes CVE-2024-38595 bsc#1226741).
- Update
  patches.suse/net-mlx5e-Track-xmit-submission-to-PTP-WQ-after-popu.patch
  (jsc#PED-3311 CVE-2023-52782 bsc#1225103).
- Update
  patches.suse/net-mvneta-fix-calls-to-page_pool_get_stats.patch
  (git-fixes CVE-2023-52780 bsc#1224933).
- Update
  patches.suse/net-wangxun-fix-kernel-panic-due-to-null-pointer.patch
  (git-fixes CVE-2023-52783 bsc#1225104).
- Update
  patches.suse/netfilter-complete-validation-of-user-input.patch
  (git-fixes CVE-2024-35896 bsc#1224662 CVE-2024-35962
  bsc#1224583).
- Update
  patches.suse/nfc-nci-Fix-uninit-value-in-nci_rx_work.patch
  (git-fixes CVE-2024-38381 bsc#1226878).
- Update
  patches.suse/nilfs2-fix-nilfs_empty_dir-misjudgment-and-long-loop.patch
  (git-fixes CVE-2024-39469 bsc#1226992).
- Update
  patches.suse/nilfs2-fix-potential-hang-in-nilfs_detach_log_writer.patch
  (git-fixes CVE-2024-38582 bsc#1226658).
- Update
  patches.suse/nilfs2-fix-use-after-free-of-timer-for-log-writer-th.patch
  (git-fixes CVE-2024-38583 bsc#1226777).
- Update
  patches.suse/of-module-add-buffer-overflow-check-in-of_modalias.patch
  (git-fixes CVE-2024-38541 bsc#1226587).
- Update
  patches.suse/padata-Fix-refcnt-handling-in-padata_free_shell.patch
  (git-fixes CVE-2023-52854 bsc#1225584).
- Update
  patches.suse/perf-core-Bail-out-early-if-the-request-AUX-area-is-out-of-bound.patch
  (git-fixes CVE-2023-52835 bsc#1225602).
- Update
  patches.suse/platform-x86-wmi-Fix-opening-of-char-device.patch
  (git-fixes CVE-2023-52864 bsc#1225132).
- Update
  patches.suse/powerpc-pseries-iommu-LPAR-panics-during-boot-up-wit.patch
  (bsc#1222011 ltc#205900 CVE-2024-36926 bsc#1225829).
- Update patches.suse/pstore-platform-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52869 bsc#1225050).
- Update
  patches.suse/remoteproc-mediatek-Make-sure-IPI-buffer-fits-in-L2T.patch
  (git-fixes CVE-2024-36965 bsc#1226149).
- Update
  patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch
  (git-fixes CVE-2024-38601 bsc#1226876).
- Update
  patches.suse/s390-dasd-protect-device-queue-against-concurrent-access.patch
  (git-fixes bsc#1217481 CVE-2023-52774 bsc#1225572).
- Update
  patches.suse/scsi-hisi_sas-Set-debugfs_dir-pointer-to-NULL-after-removing-debugfs.patch
  (git-fixes CVE-2023-52808 bsc#1225555).
- Update
  patches.suse/scsi-ibmvfc-Remove-BUG_ON-in-the-case-of-an-empty-ev.patch
  (bsc#1209834 ltc#202097 CVE-2023-52811 bsc#1225559).
- Update
  patches.suse/scsi-libfc-Fix-potential-NULL-pointer-dereference-in-fc_lport_ptp_setup.patch
  (git-fixes CVE-2023-52809 bsc#1225556).
- Update
  patches.suse/scsi-lpfc-Move-NPIV-s-transport-unregistration-to-af.patch
  (bsc#1221777 CVE-2024-36952 bsc#1225898).
- Update
  patches.suse/scsi-lpfc-Release-hbalock-before-calling-lpfc_worker.patch
  (bsc#1221777 CVE-2024-36924 bsc#1225820).
- Update
  patches.suse/serial-max3100-Lock-port-lock-when-calling-uart_hand.patch
  (git-fixes CVE-2024-38634 bsc#1226868).
- Update
  patches.suse/serial-max3100-Update-uart_driver_registered-on-driv.patch
  (git-fixes CVE-2024-38633 bsc#1226867).
- Update
  patches.suse/soc-qcom-llcc-Handle-a-second-device-without-data-co.patch
  (git-fixes CVE-2023-52871 bsc#1225534).
- Update
  patches.suse/soundwire-cadence-fix-invalid-PDI-offset.patch
  (stable-fixes CVE-2024-38635 bsc#1226863).
- Update patches.suse/speakup-Fix-sizeof-vs-ARRAY_SIZE-bug.patch
  (git-fixes CVE-2024-38587 bsc#1226780).
- Update patches.suse/spi-Fix-null-dereference-on-suspend.patch
  (git-fixes CVE-2023-52749 bsc#1225476).
- Update
  patches.suse/thermal-core-prevent-potential-string-overflow.patch
  (git-fixes CVE-2023-52868 bsc#1225044).
- Update
  patches.suse/thermal-drivers-qcom-lmh-Check-for-SCM-availability-.patch
  (git-fixes CVE-2024-39466 bsc#1227089).
- Update
  patches.suse/thermal-drivers-tsens-Fix-null-pointer-dereference.patch
  (git-fixes CVE-2024-38571 bsc#1226737).
- Update
  patches.suse/thermal-intel-powerclamp-fix-mismatch-in-get-functio.patch
  (git-fixes CVE-2023-52794 bsc#1225028).
- Update
  patches.suse/tls-fix-NULL-deref-on-tls_sw_splice_eof-with-empty-r.patch
  (jsc#PED-6831 CVE-2023-52767 bsc#1224998).
- Update
  patches.suse/tpm_tis_spi-Account-for-SPI-header-when-allocating-T.patch
  (git-fixes CVE-2024-36477 bsc#1226840).
- Update
  patches.suse/tracing-Have-trace_event_file-have-ref-counters.patch
  (git-fixes CVE-2023-52879 bsc#1225101).
- Update
  patches.suse/tracing-trigger-Fix-to-return-error-if-failed-to-alloc-snapshot.patch
  (git-fixes CVE-2024-26920).
- Update
  patches.suse/tty-n_gsm-fix-race-condition-in-status-line-change-o.patch
  (git-fixes CVE-2023-52872 bsc#1225591).
- Update
  patches.suse/tty-n_gsm-require-CAP_NET_ADMIN-to-attach-N_GSM0710-.patch
  (bsc#1222619 CVE-2023-52880).
- Update
  patches.suse/tty-vcc-Add-check-for-kstrdup-in-vcc_probe.patch
  (git-fixes CVE-2023-52789 bsc#1225180).
- Update
  patches.suse/usb-config-fix-iteration-issue-in-usb_get_bos_descri.patch
  (git-fixes CVE-2023-52781 bsc#1225092).
- Update
  patches.suse/usb-dwc3-Wait-unconditionally-after-issuing-EndXfer-.patch
  (git-fixes CVE-2024-36977 bsc#1226513).
- Update
  patches.suse/usb-gadget-u_audio-Fix-race-condition-use-of-control.patch
  (git-fixes CVE-2024-38628 bsc#1226911).
- Update
  patches.suse/usb-storage-alauda-Check-whether-the-media-is-initia.patch
  (git-fixes CVE-2024-38619 bsc#1226861).
- Update
  patches.suse/usb-typec-tcpm-Fix-NULL-pointer-dereference-in-tcpm_.patch
  (git-fixes CVE-2023-52877 bsc#1224944).
- Update
  patches.suse/vhost-vdpa-fix-use-after-free-in-vhost_vdpa_probe.patch
  (jsc#PED-3311 CVE-2023-52795 bsc#1225085).
- Update
  patches.suse/virtio-blk-fix-implicit-overflow-on-virtio_max_dma_s.patch
  (git-fixes CVE-2023-52762 bsc#1225573).
- Update
  patches.suse/virtio-vsock-Fix-uninit-value-in-virtio_transport_re.patch
  (jsc#PED-5505 CVE-2023-52842 bsc#1225025).
- Update
  patches.suse/watchdog-cpu5wdt.c-Fix-use-after-free-bug-caused-by-.patch
  (git-fixes CVE-2024-38630 bsc#1226908).
- Update
  patches.suse/wifi-ar5523-enable-proper-endpoint-verification.patch
  (git-fixes CVE-2024-38565 bsc#1226747).
- Update
  patches.suse/wifi-ath11k-fix-dfs-radar-event-locking.patch
  (git-fixes CVE-2023-52798 bsc#1224947).
- Update
  patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch
  (git-fixes CVE-2023-52777 bsc#1224992).
- Update patches.suse/wifi-ath11k-fix-htt-pktlog-locking.patch
  (git-fixes CVE-2023-52800).
- Update
  patches.suse/wifi-ath12k-fix-dfs-radar-and-temperature-event-lock.patch
  (git-fixes CVE-2023-52776 bsc#1225090).
- Update
  patches.suse/wifi-ath12k-fix-htt-mlo-offset-event-locking.patch
  (git-fixes CVE-2023-52769 bsc#1225001).
- Update
  patches.suse/wifi-ath12k-fix-out-of-bound-access-of-qmi_invoke_ha.patch
  (git-fixes CVE-2024-38572 bsc#1226776).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-read-in-ath12k.patch
  (git-fixes CVE-2023-52827 bsc#1225078).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-write-in-ath12.patch
  (git-fixes CVE-2023-52829 bsc#1225081).
- Update
  patches.suse/wifi-brcmfmac-pcie-handle-randbuf-allocation-failure.patch
  (git-fixes CVE-2024-38575 bsc#1226612).
- Update
  patches.suse/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch
  (git-fixes CVE-2024-38567 bsc#1226769).
- Update
  patches.suse/wifi-carl9170-re-fix-fortified-memset-warning.patch
  (git-fixes CVE-2024-38616 bsc#1226852).
- Update
  patches.suse/wifi-mac80211-don-t-return-unset-power-in-ieee80211_.patch
  (git-fixes CVE-2023-52832 bsc#1225577).
- Update
  patches.suse/wifi-nl80211-Avoid-address-calculations-via-out-of-b.patch
  (git-fixes CVE-2024-38562 bsc#1226788).
- Update
  patches.suse/wifi-wilc1000-use-vmm_table-as-array-in-wilc-struct.patch
  (git-fixes CVE-2023-52768 bsc#1225004).
- Update
  patches.suse/x86-tdx-Zero-out-the-missing-RSI-in-TDX_HYPERCALL-macro.patch
  (jsc#PED-5824 CVE-2023-52874 bsc#1225049).
- commit 33efdc4</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835204">- tcp: Use refcount_inc_not_zero() in tcp_twsk_unique()
  (CVE-2024-36904 bsc#1225732).
- commit d578dcc</changelog>
  <changelog author="heming.zhao@suse.com" date="1719921600">- gfs2: Fix potential glock use-after-free on unmount (bsc#1226775
  CVE-2024-38570).
- gfs2: Rename sd_{ glock =&gt; kill }_wait (bsc#1226775
  CVE-2024-38570).
- commit f3adbca</changelog>
  <changelog author="tiwai@suse.de" date="1719921601">- Correct SCSI patch references (bsc#1225767 CVE-2024-36919 bsc#1226785 CVE-2024-38559)
- commit e8ea587</changelog>
  <changelog author="tiwai@suse.de" date="1719921602">- mtd: rawnand: rockchip: ensure NVDDR timings are rejected
  (git-fixes).
- mtd: rawnand: Bypass a couple of sanity checks during NAND
  identification (git-fixes).
- mtd: rawnand: Fix the nand_read_data_op() early check
  (git-fixes).
- mtd: rawnand: Ensure ECC configuration is propagated to upper
  layers (git-fixes).
- commit e545951</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1719921603">- kernel-doc: fix struct_group_tagged() parsing (git-fixes).
- commit e3a2a2e</changelog>
  <changelog author="fdmanana@suse.com" date="1719921604">- btrfs: fix crash on racing fsync and size-extending write into
  prealloc (bsc#1227101 CVE-2024-37354).
- commit 1d355af</changelog>
  <changelog author="vbabka@suse.cz" date="1719921605">- virt: acrn: stop using follow_pfn (CVE-2024-38610 bsc#1226758).
- commit c2ea51b</changelog>
  <changelog author="vbabka@suse.cz" date="1719921606">- drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
  (CVE-2024-38610 bsc#1226758).
- commit 7069ac2</changelog>
  <changelog author="rhopkins@suse.de" date="1719921607">- hsr: Prevent use after free in prp_create_tagged_frame()
  (CVE-2023-52846 bsc#1225098).
- commit cf63988</changelog>
  <changelog author="krisman@suse.de" date="1719921608">- io_uring: Fix io_cqring_wait() not restoring sigmask on
  get_timespec64() failure (git-fixes).
- commit e640a65</changelog>
  <changelog author="krisman@suse.de" date="1719921609">- io_uring: check for non-NULL file pointer in io_file_can_poll()
  (bsc#1226990 CVE-2024-39371).
- io_uring/io-wq: Use set_bit() and test_bit() at worker-&gt;flags
  (git-fixes).
- io_uring/sqpoll: work around a potential audit memory leak
  (git-fixes).
- commit 24603fc</changelog>
  <changelog author="krisman@suse.de" date="1719921610">- io_uring/rsrc: fix incorrect assignment of iter-&gt;nr_segs in
  io_import_fixed (git-fixes).
- io_uring/rsrc: don't lock while !TASK_RUNNING (git-fixes).
- io_uring/io-wq: avoid garbage value of 'match' in
  io_wq_enqueue() (git-fixes).
- commit 7d3e252</changelog>
</package>
<package pkgid="b1cc34f305cba68a302cf343d3d9a327386b255da3de675a86b20c708f12f977" name="cluster-md-kmp-default" arch="ppc64le">
  <version epoch="0" ver="6.4.0" rel="150600.23.14.2"/>
  <changelog author="tiwai@suse.de" date="1719662400">- gpiolib: cdev: Disallow reconfiguration without direction
  (uAPI v1) (git-fixes).
- gpio: davinci: Validate the obtained number of IRQs (git-fixes).
- commit 919ebd1</changelog>
  <changelog author="tiwai@suse.de" date="1719748800">- i2c: testunit: discard write requests while old command is
  running (git-fixes).
- i2c: testunit: don't erase registers after STOP (git-fixes).
- mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
  (git-fixes).
- mmc: sdhci: Do not invert write-protect twice (git-fixes).
- mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
  (git-fixes).
- mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
  (git-fixes).
- commit 448487d</changelog>
  <changelog author="tiwai@suse.de" date="1719748801">- crypto: iaa - Account for cpu-less numa nodes (bsc#1227190).
- commit cd600aa</changelog>
  <changelog author="tiwai@suse.de" date="1719748802">- crypto: deflate - Add aliases to deflate (bsc#1227190).
- commit 27ffd92</changelog>
  <changelog author="tiwai@suse.de" date="1719835200">- ata: ahci: Clean up sysfs file on error (git-fixes).
- ata: libata-core: Fix double free on error (git-fixes).
- ata,scsi: libata-core: Do not leak memory for ata_port struct
  members (git-fixes).
- ata: libata-core: Fix null pointer dereference on error
  (git-fixes).
- kbuild: Fix build target deb-pkg: ln: failed to create hard link
  (git-fixes).
- kbuild: doc: Update default INSTALL_MOD_DIR from extra to
  updates (git-fixes).
- kbuild: Install dtb files as 0644 in Makefile.dtbinst
  (git-fixes).
- counter: ti-eqep: enable clock at probe (git-fixes).
- iio: chemical: bme680: Fix sensor data read operation
  (git-fixes).
- iio: chemical: bme680: Fix overflows in compensate() functions
  (git-fixes).
- iio: chemical: bme680: Fix calibration data variable
  (git-fixes).
- iio: chemical: bme680: Fix pressure value output (git-fixes).
- iio: accel: fxls8962af: select IIO_BUFFER &amp; IIO_KFIFO_BUF
  (git-fixes).
- iio: adc: ad7266: Fix variable checking bug (git-fixes).
- iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
  (git-fixes).
- serial: bcm63xx-uart: fix tx after conversion to
  uart_port_tx_limited() (git-fixes).
- serial: core: introduce uart_port_tx_limited_flags()
  (git-fixes).
- Revert "serial: core: only stop transmit when HW fifo is empty"
  (git-fixes).
- tty: mcf: MCF54418 has 10 UARTS (git-fixes).
- usb: gadget: aspeed_udc: fix device address configuration
  (git-fixes).
- usb: dwc3: core: remove lock of otg mode during gadget
  suspend/resume to avoid deadlock (git-fixes).
- usb: typec: ucsi: glink: fix child node release in probe
  function (git-fixes).
- usb: musb: da8xx: fix a resource leak in probe() (git-fixes).
- usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  (git-fixes).
- usb: gadget: printer: fix races against disable (git-fixes).
- PCI/MSI: Fix UAF in msi_capability_init (git-fixes).
- commit a2ea5a9</changelog>
  <changelog author="ptesarik@suse.com" date="1719835201">- net: ena: Fix redundant device NUMA node override
  (jsc#PED-8688).
- commit 6ad6684</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835202">- tcp: do not accept ACK of bytes we never sent (CVE-2023-52881
  bsc#1225611).
- commit 16404a6</changelog>
  <changelog author="mhocko@suse.com" date="1719835203">- Update
  patches.suse/1352-drm-amdgpu-Fix-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52883
  bsc#1226630).
- Update
  patches.suse/9p-add-missing-locking-around-taking-dentry-fid-list.patch
  (git-fixes CVE-2024-39463 bsc#1227090).
- Update
  patches.suse/ALSA-Fix-deadlocks-with-kctl-removals-at-disconnecti.patch
  (stable-fixes CVE-2024-38600 bsc#1226864).
- Update
  patches.suse/ALSA-core-Fix-NULL-module-pointer-assignment-at-card.patch
  (git-fixes CVE-2024-38605 bsc#1226740).
- Update
  patches.suse/ALSA-hda-Fix-possible-null-ptr-deref-when-assigning-.patch
  (git-fixes CVE-2023-52806 bsc#1225554).
- Update
  patches.suse/ALSA-hda-cs_dsp_ctl-Use-private_free-for-control-cle.patch
  (git-fixes CVE-2024-38388 bsc#1226890).
- Update
  patches.suse/ALSA-timer-Set-lower-bound-of-start-tick-time.patch
  (stable-fixes git-fixes CVE-2024-38618 bsc#1226754).
- Update
  patches.suse/ASoC-kirkwood-Fix-potential-NULL-dereference.patch
  (git-fixes CVE-2024-38550 bsc#1226633).
- Update
  patches.suse/ASoC-mediatek-Assign-dummy-when-codec-not-specified-.patch
  (git-fixes CVE-2024-38551 bsc#1226761).
- Update
  patches.suse/Bluetooth-btusb-Add-date-evt_skb-is-NULL-check.patch
  (git-fixes CVE-2023-52833 bsc#1225595).
- Update
  patches.suse/Bluetooth-hci_core-Fix-possible-buffer-overflow.patch
  (git-fixes CVE-2024-26889).
- Update
  patches.suse/HID-uclogic-Fix-user-memory-access-bug-in-uclogic_pa.patch
  (git-fixes CVE-2023-52866 bsc#1225120).
- Update
  patches.suse/IB-mlx5-Fix-init-stage-error-handling-to-avoid-doubl.patch
  (jsc#PED-6864 CVE-2023-52851 bsc#1225587).
- Update
  patches.suse/Input-cyapa-add-missing-input-core-locking-to-suspen.patch
  (git-fixes CVE-2023-52884 bsc#1226764).
- Update
  patches.suse/Input-synaptics-rmi4-fix-use-after-free-in-rmi_unreg.patch
  (git-fixes CVE-2023-52840 bsc#1224928).
- Update
  patches.suse/KEYS-trusted-Do-not-use-WARN-when-encode-fails.patch
  (git-fixes CVE-2024-36975 bsc#1226520).
- Update
  patches.suse/KEYS-trusted-Fix-memory-leak-in-tpm2_key_encode.patch
  (git-fixes CVE-2024-36967 bsc#1226131).
- Update
  patches.suse/RDMA-cma-Fix-kmemleak-in-rdma_core-observed-during-b.patch
  (git-fixes CVE-2024-38539 bsc#1226608).
- Update patches.suse/RDMA-hns-Fix-UAF-for-cq-async-event.patch
  (git-fixes CVE-2024-38545 bsc#1226595).
- Update
  patches.suse/RDMA-hns-Fix-deadlock-on-SRQ-async-events.patch
  (git-fixes CVE-2024-38591 bsc#1226738).
- Update
  patches.suse/RDMA-hns-Modify-the-print-level-of-CQE-error.patch
  (git-fixes CVE-2024-38590 bsc#1226839).
- Update
  patches.suse/RDMA-rxe-Fix-seg-fault-in-rxe_comp_queue_pkt.patch
  (git-fixes CVE-2024-38544 bsc#1226597).
- Update
  patches.suse/SUNRPC-Fix-RPC-client-cleaned-up-the-freed-pipefs-de.patch
  (git-fixes CVE-2023-52803 bsc#1225008).
- Update patches.suse/af_unix-Clear-stale-u-oob_skb.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-35970 bsc#1224584).
- Update
  patches.suse/af_unix-Drop-oob_skb-ref-before-purging-queue-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26750 bsc#1222617).
- Update
  patches.suse/af_unix-Fix-task-hung-while-purging-oob_skb-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26780 bsc#1222588).
- Update
  patches.suse/af_unix-Update-unix_sk-sk-oob_skb-under-sk_receive_queue-lock.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-36972 bsc#1226163).
- Update
  patches.suse/arm64-Restrict-CPU_BIG_ENDIAN-to-GNU-as-or-LLVM-IAS-.patch
  (git-fixes CVE-2023-52750 bsc#1225485).
- Update
  patches.suse/atl1c-Work-around-the-DMA-RX-overflow-issue.patch
  (git-fixes CVE-2023-52834 bsc#1225599).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issue-of-net_device.patch
  (git-fixes CVE-2024-38554 bsc#1226742).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issues-of-ax25_dev.patch
  (git-fixes CVE-2024-38602 bsc#1226613).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-reorder-of-WRITE-lqueued.patch
  (bsc#1225605 CVE-2024-38384 bsc#1226938).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-resetting-io-stat.patch
  (bsc#1225605 CVE-2024-38663 bsc#1226939).
- Update
  patches.suse/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch
  (git-fixes CVE-2024-38540 bsc#1226582).
- Update
  patches.suse/bonding-stop-the-device-in-bond_setup_by_slave.patch
  (git-fixes CVE-2023-52784 bsc#1224946).
- Update
  patches.suse/can-dev-can_put_echo_skb-don-t-crash-kernel-if-can_p.patch
  (git-fixes CVE-2023-52878 bsc#1225000).
- Update
  patches.suse/clk-mediatek-clk-mt2701-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52875 bsc#1225096).
- Update
  patches.suse/clk-mediatek-clk-mt6765-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52870 bsc#1224937).
- Update
  patches.suse/clk-mediatek-clk-mt6779-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52873 bsc#1225589).
- Update
  patches.suse/clk-mediatek-clk-mt6797-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52865 bsc#1225086).
- Update
  patches.suse/clk-mediatek-clk-mt7629-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52858 bsc#1225566).
- Update
  patches.suse/clk-mediatek-clk-mt7629-eth-Add-check-for-mtk_alloc_.patch
  (git-fixes CVE-2023-52876 bsc#1225036).
- Update
  patches.suse/cppc_cpufreq-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38573 bsc#1226739).
- Update patches.suse/cpufreq-exit-callback-is-optional.patch
  (git-fixes CVE-2024-38615 bsc#1226592).
- Update patches.suse/crypto-bcm-Fix-pointer-arithmetic.patch
  (git-fixes CVE-2024-38579 bsc#1226637).
- Update
  patches.suse/crypto-pcrypt-Fix-hungtask-for-PADATA_RESET.patch
  (git-fixes CVE-2023-52813 bsc#1225527).
- Update patches.suse/cxl-mem-Fix-shutdown-order.patch (git-fixes
  CVE-2023-52849 bsc#1224949).
- Update
  patches.suse/cxl-region-Do-not-try-to-cleanup-after-cxl_region_se.patch
  (git-fixes CVE-2023-52792 bsc#1225477).
- Update patches.suse/cxl-region-Fix-cxlr_pmem-leaks.patch
  (git-fixes CVE-2024-38391 bsc#1226894).
- Update
  patches.suse/dma-buf-sw-sync-don-t-enable-IRQ-from-sync_print_obj.patch
  (git-fixes CVE-2024-38780 bsc#1226886).
- Update
  patches.suse/dma-mapping-benchmark-fix-node-id-validation.patch
  (git-fixes CVE-2024-34777 bsc#1226796).
- Update
  patches.suse/dma-mapping-benchmark-handle-NUMA_NO_NODE-correctly.patch
  (git-fixes CVE-2024-39277 bsc#1226909).
- Update
  patches.suse/dmaengine-idxd-Avoid-unnecessary-destruction-of-file.patch
  (git-fixes CVE-2024-38629 bsc#1226905).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Pola.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52819
  bsc#1225532).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-SMU7.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52818
  bsc#1225530).
- Update
  patches.suse/drm-amd-check-num-of-link-levels-when-update-pcie-pa.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52812
  bsc#1225564).
- Update
  patches.suse/drm-amd-display-Avoid-NULL-dereference-of-timing-gen.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52753
  bsc#1225478).
- Update
  patches.suse/drm-amd-display-Fix-division-by-zero-in-setup_dsc_co.patch
  (stable-fixes CVE-2024-36969 bsc#1226155).
- Update
  patches.suse/drm-amd-display-Fix-null-pointer-dereference-in-erro.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52862
  bsc#1225015).
- Update
  patches.suse/drm-amd-display-Fix-potential-index-out-of-bounds-in.patch
  (git-fixes CVE-2024-38552 bsc#1226767).
- Update
  patches.suse/drm-amd-display-fix-a-NULL-pointer-dereference-in-am.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52773
  bsc#1225041).
- Update
  patches.suse/drm-amd-display-fixed-integer-types-and-null-check-l.patch
  (git-fixes CVE-2024-26767).
- Update
  patches.suse/drm-amdgpu-Fix-a-null-pointer-access-when-the-smc_rr.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52817
  bsc#1225569).
- Update
  patches.suse/drm-amdgpu-Fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch
  (git-fixes CVE-2024-39291 bsc#1226934).
- Update
  patches.suse/drm-amdgpu-Fix-potential-null-pointer-derefernce.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52814
  bsc#1225565).
- Update
  patches.suse/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch
  (stable-fixes CVE-2024-39471 bsc#1227096).
- Update
  patches.suse/drm-amdgpu-mes-fix-use-after-free-issue.patch
  (stable-fixes CVE-2024-38581 bsc#1226657).
- Update
  patches.suse/drm-amdgpu-vkms-fix-a-possible-null-pointer-derefere.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52815
  bsc#1225568).
- Update
  patches.suse/drm-amdkfd-Fix-a-race-condition-of-vram-buffer-unref.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52825
  bsc#1225076).
- Update
  patches.suse/drm-amdkfd-Fix-shift-out-of-bounds-issue.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52816
  bsc#1225529).
- Update
  patches.suse/drm-bridge-cdns-mhdp8546-Fix-possible-null-pointer-d.patch
  (git-fixes CVE-2024-38548).
- Update
  patches.suse/drm-bridge-it66121-Fix-invalid-connector-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52861
  bsc#1224941).
- Update
  patches.suse/drm-bridge-lt8912b-Fix-crash-on-bridge-detach.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52856
  bsc#1224932).
- Update
  patches.suse/drm-mediatek-Add-0-size-check-to-mtk_drm_gem_obj.patch
  (git-fixes CVE-2024-38549 bsc#1226735).
- Update
  patches.suse/drm-mediatek-Fix-coverity-issue-with-unintentional-i.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52857
  bsc#1225581).
- Update
  patches.suse/drm-mediatek-Init-ddp_comp-with-devm_kcalloc.patch
  (git-fixes CVE-2024-38592 bsc#1226844).
- Update
  patches.suse/drm-msm-a6xx-Avoid-a-nullptr-dereference-when-speedb.patch
  (git-fixes CVE-2024-38390 bsc#1226891).
- Update
  patches.suse/drm-msm-dpu-Add-callback-function-pointer-check-befo.patch
  (git-fixes CVE-2024-38622 bsc#1226856).
- Update
  patches.suse/drm-panel-fix-a-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52821
  bsc#1225022).
- Update
  patches.suse/drm-panel-panel-tpo-tpg110-fix-a-possible-null-point.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52826
  bsc#1225077).
- Update patches.suse/drm-radeon-possible-buffer-overflow.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52867
  bsc#1225009).
- Update
  patches.suse/drm-vc4-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38546 bsc#1226593).
- Update
  patches.suse/drm-vmwgfx-Fix-invalid-reads-in-fence-signaled-event.patch
  (git-fixes CVE-2024-36960 bsc#1225872).
- Update
  patches.suse/drm-zynqmp_dpsub-Always-register-bridge.patch
  (git-fixes CVE-2024-38664 bsc#1226941).
- Update
  patches.suse/e1000e-change-usleep_range-to-udelay-in-PHY-mdic-acc.patch
  (CVE-2024-39296 bsc#1226989 CVE-2024-36887 bsc#1225731).
- Update
  patches.suse/ecryptfs-Fix-buffer-size-for-tag-66-packet.patch
  (git-fixes CVE-2024-38578 bsc#1226634).
- Update
  patches.suse/efi-libstub-only-free-priv.runtime_map-when-allocate.patch
  (git-fixes CVE-2024-33619 bsc#1226768).
- Update
  patches.suse/fbdev-imsttfb-fix-a-resource-leak-in-probe.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52838
  bsc#1225031).
- Update
  patches.suse/fs-9p-only-translate-RWX-permissions-for-plain-9P200.patch
  (git-fixes CVE-2024-36964 bsc#1225866).
- Update
  patches.suse/fs-jfs-Add-check-for-negative-db_l2nbperpage.patch
  (git-fixes CVE-2023-52810 bsc#1225557).
- Update
  patches.suse/fs-jfs-Add-validity-check-for-db_maxag-and-db_agpref.patch
  (git-fixes CVE-2023-52804 bsc#1225550).
- Update
  patches.suse/ftrace-Fix-possible-use-after-free-issue-in-ftrace_location.patch
  (git-fixes CVE-2024-38588 bsc#1226837).
- Update
  patches.suse/genirq-irqdesc-Prevent-use-after-free-in-irq_find_at.patch
  (git-fixes CVE-2024-38385 bsc#1227085).
- Update patches.suse/gfs2-ignore-negated-quota-changes.patch
  (git-fixes CVE-2023-52759 bsc#1225560).
- Update
  patches.suse/hid-cp2112-Fix-duplicate-workqueue-initialization.patch
  (git-fixes CVE-2023-52853 bsc#1224988).
- Update
  patches.suse/hwmon-axi-fan-control-Fix-possible-NULL-pointer-dere.patch
  (git-fixes CVE-2023-52863 bsc#1225586).
- Update
  patches.suse/i2c-acpi-Unbind-mux-adapters-before-delete.patch
  (git-fixes CVE-2024-39362 bsc#1226995).
- Update
  patches.suse/i2c-core-Run-atomic-i2c-xfer-when-preemptible.patch
  (git-fixes CVE-2023-52791 bsc#1225108).
- Update
  patches.suse/i3c-master-mipi-i3c-hci-Fix-a-kernel-panic-for-acces.patch
  (git-fixes CVE-2023-52763 bsc#1225570).
- Update
  patches.suse/i3c-mipi-i3c-hci-Fix-out-of-bounds-access-in-hci_dma.patch
  (git-fixes CVE-2023-52766).
- Update
  patches.suse/i915-perf-Fix-NULL-deref-bugs-with-drm_dbg-calls.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52788
  bsc#1225106).
- Update
  patches.suse/igb-Fix-string-truncation-warnings-in-igb_set_fw_ver.patch
  (git-fixes CVE-2024-36010 bsc#1225594).
- Update
  patches.suse/iommu-vt-d-Fix-WARN_ON-in-iommu-probe-path.patch
  (git-fixes CVE-2024-35957 bsc#1224673).
- Update
  patches.suse/iommufd-Fix-missing-update-of-domains_itree-after-splitting-iopt
  (jsc#PED-7779 jsc#PED-7780 CVE-2023-52801 bsc#1225006).
- Update
  patches.suse/ipvlan-add-ipvlan_route_v6_outbound-helper.patch
  (git-fixes CVE-2023-52796 bsc#1224930).
- Update
  patches.suse/jffs2-prevent-xattr-node-from-overflowing-the-eraseblock.patch
  (git-fixes CVE-2024-38599 bsc#1226848).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-dbFindLeaf.patch
  (git-fixes CVE-2023-52799 bsc#1225472).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-diAlloc.patch
  (git-fixes CVE-2023-52805 bsc#1225553).
- Update
  patches.suse/kunit-fortify-Fix-mismatched-kvalloc-vfree-usage.patch
  (git-fixes CVE-2024-38617 bsc#1226859).
- Update
  patches.suse/lib-generic-radix-tree.c-Don-t-overflow-in-peek.patch
  (git-fixes CVE-2021-47432 bsc#1225391).
- Update
  patches.suse/lib-test_hmm.c-handle-src_pfns-and-dst_pfns-allocati.patch
  (git-fixes CVE-2024-38543 bsc#1226594).
- Update
  patches.suse/locking-ww_mutex-test-Fix-potential-workqueue-corrup.patch
  (bsc#1219953 CVE-2023-52836 bsc#1225609).
- Update
  patches.suse/md-Don-t-ignore-suspended-array-in-md_check_recovery-1baa.patch
  (bsc#1219596 CVE-2024-26758).
- Update
  patches.suse/media-atomisp-ssh_css-Fix-a-null-pointer-dereference.patch
  (git-fixes CVE-2024-38547 bsc#1226632).
- Update
  patches.suse/media-bttv-fix-use-after-free-error-due-to-btv-timeo.patch
  (git-fixes CVE-2023-52847 bsc#1225588).
- Update
  patches.suse/media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch
  (git-fixes CVE-2023-52764 bsc#1225571).
- Update
  patches.suse/media-hantro-Check-whether-reset-op-is-defined-befor.patch
  (git-fixes CVE-2023-52850 bsc#1225014).
- Update
  patches.suse/media-i2c-et8ek8-Don-t-strip-remove-function-when-dr.patch
  (git-fixes CVE-2024-38611 bsc#1226760).
- Update
  patches.suse/media-imon-fix-access-to-invalid-resource-for-the-se.patch
  (git-fixes CVE-2023-52754 bsc#1225490).
- Update
  patches.suse/media-lgdt3306a-Add-a-check-against-null-pointer-def.patch
  (stable-fixes CVE-2022-48772 bsc#1226976).
- Update
  patches.suse/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch
  (git-fixes CVE-2024-38621 bsc#1226895).
- Update
  patches.suse/media-vidtv-mux-Add-check-and-kfree-for-kstrdup.patch
  (git-fixes CVE-2023-52841 bsc#1225592).
- Update patches.suse/media-vidtv-psi-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52844 bsc#1225590).
- Update
  patches.suse/mfd-qcom-spmi-pmic-Fix-revid-implementation.patch
  (git-fixes CVE-2023-52765 bsc#1225029).
- Update
  patches.suse/misc-microchip-pci1xxxx-fix-double-free-in-the-error.patch
  (git-fixes CVE-2024-36973 bsc#1226457).
- Update
  patches.suse/net-hns3-fix-out-of-bounds-access-may-occur-when-coa.patch
  (git-fixes CVE-2023-52807 bsc#1225097).
- Update
  patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch
  (git-fixes CVE-2024-36962 bsc#1225827).
- Update
  patches.suse/net-mlx5-Fix-peer-devlink-set-for-SF-representor-dev.patch
  (git-fixes CVE-2024-38595 bsc#1226741).
- Update
  patches.suse/net-mlx5e-Track-xmit-submission-to-PTP-WQ-after-popu.patch
  (jsc#PED-3311 CVE-2023-52782 bsc#1225103).
- Update
  patches.suse/net-mvneta-fix-calls-to-page_pool_get_stats.patch
  (git-fixes CVE-2023-52780 bsc#1224933).
- Update
  patches.suse/net-wangxun-fix-kernel-panic-due-to-null-pointer.patch
  (git-fixes CVE-2023-52783 bsc#1225104).
- Update
  patches.suse/netfilter-complete-validation-of-user-input.patch
  (git-fixes CVE-2024-35896 bsc#1224662 CVE-2024-35962
  bsc#1224583).
- Update
  patches.suse/nfc-nci-Fix-uninit-value-in-nci_rx_work.patch
  (git-fixes CVE-2024-38381 bsc#1226878).
- Update
  patches.suse/nilfs2-fix-nilfs_empty_dir-misjudgment-and-long-loop.patch
  (git-fixes CVE-2024-39469 bsc#1226992).
- Update
  patches.suse/nilfs2-fix-potential-hang-in-nilfs_detach_log_writer.patch
  (git-fixes CVE-2024-38582 bsc#1226658).
- Update
  patches.suse/nilfs2-fix-use-after-free-of-timer-for-log-writer-th.patch
  (git-fixes CVE-2024-38583 bsc#1226777).
- Update
  patches.suse/of-module-add-buffer-overflow-check-in-of_modalias.patch
  (git-fixes CVE-2024-38541 bsc#1226587).
- Update
  patches.suse/padata-Fix-refcnt-handling-in-padata_free_shell.patch
  (git-fixes CVE-2023-52854 bsc#1225584).
- Update
  patches.suse/perf-core-Bail-out-early-if-the-request-AUX-area-is-out-of-bound.patch
  (git-fixes CVE-2023-52835 bsc#1225602).
- Update
  patches.suse/platform-x86-wmi-Fix-opening-of-char-device.patch
  (git-fixes CVE-2023-52864 bsc#1225132).
- Update
  patches.suse/powerpc-pseries-iommu-LPAR-panics-during-boot-up-wit.patch
  (bsc#1222011 ltc#205900 CVE-2024-36926 bsc#1225829).
- Update patches.suse/pstore-platform-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52869 bsc#1225050).
- Update
  patches.suse/remoteproc-mediatek-Make-sure-IPI-buffer-fits-in-L2T.patch
  (git-fixes CVE-2024-36965 bsc#1226149).
- Update
  patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch
  (git-fixes CVE-2024-38601 bsc#1226876).
- Update
  patches.suse/s390-dasd-protect-device-queue-against-concurrent-access.patch
  (git-fixes bsc#1217481 CVE-2023-52774 bsc#1225572).
- Update
  patches.suse/scsi-hisi_sas-Set-debugfs_dir-pointer-to-NULL-after-removing-debugfs.patch
  (git-fixes CVE-2023-52808 bsc#1225555).
- Update
  patches.suse/scsi-ibmvfc-Remove-BUG_ON-in-the-case-of-an-empty-ev.patch
  (bsc#1209834 ltc#202097 CVE-2023-52811 bsc#1225559).
- Update
  patches.suse/scsi-libfc-Fix-potential-NULL-pointer-dereference-in-fc_lport_ptp_setup.patch
  (git-fixes CVE-2023-52809 bsc#1225556).
- Update
  patches.suse/scsi-lpfc-Move-NPIV-s-transport-unregistration-to-af.patch
  (bsc#1221777 CVE-2024-36952 bsc#1225898).
- Update
  patches.suse/scsi-lpfc-Release-hbalock-before-calling-lpfc_worker.patch
  (bsc#1221777 CVE-2024-36924 bsc#1225820).
- Update
  patches.suse/serial-max3100-Lock-port-lock-when-calling-uart_hand.patch
  (git-fixes CVE-2024-38634 bsc#1226868).
- Update
  patches.suse/serial-max3100-Update-uart_driver_registered-on-driv.patch
  (git-fixes CVE-2024-38633 bsc#1226867).
- Update
  patches.suse/soc-qcom-llcc-Handle-a-second-device-without-data-co.patch
  (git-fixes CVE-2023-52871 bsc#1225534).
- Update
  patches.suse/soundwire-cadence-fix-invalid-PDI-offset.patch
  (stable-fixes CVE-2024-38635 bsc#1226863).
- Update patches.suse/speakup-Fix-sizeof-vs-ARRAY_SIZE-bug.patch
  (git-fixes CVE-2024-38587 bsc#1226780).
- Update patches.suse/spi-Fix-null-dereference-on-suspend.patch
  (git-fixes CVE-2023-52749 bsc#1225476).
- Update
  patches.suse/thermal-core-prevent-potential-string-overflow.patch
  (git-fixes CVE-2023-52868 bsc#1225044).
- Update
  patches.suse/thermal-drivers-qcom-lmh-Check-for-SCM-availability-.patch
  (git-fixes CVE-2024-39466 bsc#1227089).
- Update
  patches.suse/thermal-drivers-tsens-Fix-null-pointer-dereference.patch
  (git-fixes CVE-2024-38571 bsc#1226737).
- Update
  patches.suse/thermal-intel-powerclamp-fix-mismatch-in-get-functio.patch
  (git-fixes CVE-2023-52794 bsc#1225028).
- Update
  patches.suse/tls-fix-NULL-deref-on-tls_sw_splice_eof-with-empty-r.patch
  (jsc#PED-6831 CVE-2023-52767 bsc#1224998).
- Update
  patches.suse/tpm_tis_spi-Account-for-SPI-header-when-allocating-T.patch
  (git-fixes CVE-2024-36477 bsc#1226840).
- Update
  patches.suse/tracing-Have-trace_event_file-have-ref-counters.patch
  (git-fixes CVE-2023-52879 bsc#1225101).
- Update
  patches.suse/tracing-trigger-Fix-to-return-error-if-failed-to-alloc-snapshot.patch
  (git-fixes CVE-2024-26920).
- Update
  patches.suse/tty-n_gsm-fix-race-condition-in-status-line-change-o.patch
  (git-fixes CVE-2023-52872 bsc#1225591).
- Update
  patches.suse/tty-n_gsm-require-CAP_NET_ADMIN-to-attach-N_GSM0710-.patch
  (bsc#1222619 CVE-2023-52880).
- Update
  patches.suse/tty-vcc-Add-check-for-kstrdup-in-vcc_probe.patch
  (git-fixes CVE-2023-52789 bsc#1225180).
- Update
  patches.suse/usb-config-fix-iteration-issue-in-usb_get_bos_descri.patch
  (git-fixes CVE-2023-52781 bsc#1225092).
- Update
  patches.suse/usb-dwc3-Wait-unconditionally-after-issuing-EndXfer-.patch
  (git-fixes CVE-2024-36977 bsc#1226513).
- Update
  patches.suse/usb-gadget-u_audio-Fix-race-condition-use-of-control.patch
  (git-fixes CVE-2024-38628 bsc#1226911).
- Update
  patches.suse/usb-storage-alauda-Check-whether-the-media-is-initia.patch
  (git-fixes CVE-2024-38619 bsc#1226861).
- Update
  patches.suse/usb-typec-tcpm-Fix-NULL-pointer-dereference-in-tcpm_.patch
  (git-fixes CVE-2023-52877 bsc#1224944).
- Update
  patches.suse/vhost-vdpa-fix-use-after-free-in-vhost_vdpa_probe.patch
  (jsc#PED-3311 CVE-2023-52795 bsc#1225085).
- Update
  patches.suse/virtio-blk-fix-implicit-overflow-on-virtio_max_dma_s.patch
  (git-fixes CVE-2023-52762 bsc#1225573).
- Update
  patches.suse/virtio-vsock-Fix-uninit-value-in-virtio_transport_re.patch
  (jsc#PED-5505 CVE-2023-52842 bsc#1225025).
- Update
  patches.suse/watchdog-cpu5wdt.c-Fix-use-after-free-bug-caused-by-.patch
  (git-fixes CVE-2024-38630 bsc#1226908).
- Update
  patches.suse/wifi-ar5523-enable-proper-endpoint-verification.patch
  (git-fixes CVE-2024-38565 bsc#1226747).
- Update
  patches.suse/wifi-ath11k-fix-dfs-radar-event-locking.patch
  (git-fixes CVE-2023-52798 bsc#1224947).
- Update
  patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch
  (git-fixes CVE-2023-52777 bsc#1224992).
- Update patches.suse/wifi-ath11k-fix-htt-pktlog-locking.patch
  (git-fixes CVE-2023-52800).
- Update
  patches.suse/wifi-ath12k-fix-dfs-radar-and-temperature-event-lock.patch
  (git-fixes CVE-2023-52776 bsc#1225090).
- Update
  patches.suse/wifi-ath12k-fix-htt-mlo-offset-event-locking.patch
  (git-fixes CVE-2023-52769 bsc#1225001).
- Update
  patches.suse/wifi-ath12k-fix-out-of-bound-access-of-qmi_invoke_ha.patch
  (git-fixes CVE-2024-38572 bsc#1226776).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-read-in-ath12k.patch
  (git-fixes CVE-2023-52827 bsc#1225078).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-write-in-ath12.patch
  (git-fixes CVE-2023-52829 bsc#1225081).
- Update
  patches.suse/wifi-brcmfmac-pcie-handle-randbuf-allocation-failure.patch
  (git-fixes CVE-2024-38575 bsc#1226612).
- Update
  patches.suse/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch
  (git-fixes CVE-2024-38567 bsc#1226769).
- Update
  patches.suse/wifi-carl9170-re-fix-fortified-memset-warning.patch
  (git-fixes CVE-2024-38616 bsc#1226852).
- Update
  patches.suse/wifi-mac80211-don-t-return-unset-power-in-ieee80211_.patch
  (git-fixes CVE-2023-52832 bsc#1225577).
- Update
  patches.suse/wifi-nl80211-Avoid-address-calculations-via-out-of-b.patch
  (git-fixes CVE-2024-38562 bsc#1226788).
- Update
  patches.suse/wifi-wilc1000-use-vmm_table-as-array-in-wilc-struct.patch
  (git-fixes CVE-2023-52768 bsc#1225004).
- Update
  patches.suse/x86-tdx-Zero-out-the-missing-RSI-in-TDX_HYPERCALL-macro.patch
  (jsc#PED-5824 CVE-2023-52874 bsc#1225049).
- commit 33efdc4</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835204">- tcp: Use refcount_inc_not_zero() in tcp_twsk_unique()
  (CVE-2024-36904 bsc#1225732).
- commit d578dcc</changelog>
  <changelog author="heming.zhao@suse.com" date="1719921600">- gfs2: Fix potential glock use-after-free on unmount (bsc#1226775
  CVE-2024-38570).
- gfs2: Rename sd_{ glock =&gt; kill }_wait (bsc#1226775
  CVE-2024-38570).
- commit f3adbca</changelog>
  <changelog author="tiwai@suse.de" date="1719921601">- Correct SCSI patch references (bsc#1225767 CVE-2024-36919 bsc#1226785 CVE-2024-38559)
- commit e8ea587</changelog>
  <changelog author="tiwai@suse.de" date="1719921602">- mtd: rawnand: rockchip: ensure NVDDR timings are rejected
  (git-fixes).
- mtd: rawnand: Bypass a couple of sanity checks during NAND
  identification (git-fixes).
- mtd: rawnand: Fix the nand_read_data_op() early check
  (git-fixes).
- mtd: rawnand: Ensure ECC configuration is propagated to upper
  layers (git-fixes).
- commit e545951</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1719921603">- kernel-doc: fix struct_group_tagged() parsing (git-fixes).
- commit e3a2a2e</changelog>
  <changelog author="fdmanana@suse.com" date="1719921604">- btrfs: fix crash on racing fsync and size-extending write into
  prealloc (bsc#1227101 CVE-2024-37354).
- commit 1d355af</changelog>
  <changelog author="vbabka@suse.cz" date="1719921605">- virt: acrn: stop using follow_pfn (CVE-2024-38610 bsc#1226758).
- commit c2ea51b</changelog>
  <changelog author="vbabka@suse.cz" date="1719921606">- drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
  (CVE-2024-38610 bsc#1226758).
- commit 7069ac2</changelog>
  <changelog author="rhopkins@suse.de" date="1719921607">- hsr: Prevent use after free in prp_create_tagged_frame()
  (CVE-2023-52846 bsc#1225098).
- commit cf63988</changelog>
  <changelog author="krisman@suse.de" date="1719921608">- io_uring: Fix io_cqring_wait() not restoring sigmask on
  get_timespec64() failure (git-fixes).
- commit e640a65</changelog>
  <changelog author="krisman@suse.de" date="1719921609">- io_uring: check for non-NULL file pointer in io_file_can_poll()
  (bsc#1226990 CVE-2024-39371).
- io_uring/io-wq: Use set_bit() and test_bit() at worker-&gt;flags
  (git-fixes).
- io_uring/sqpoll: work around a potential audit memory leak
  (git-fixes).
- commit 24603fc</changelog>
  <changelog author="krisman@suse.de" date="1719921610">- io_uring/rsrc: fix incorrect assignment of iter-&gt;nr_segs in
  io_import_fixed (git-fixes).
- io_uring/rsrc: don't lock while !TASK_RUNNING (git-fixes).
- io_uring/io-wq: avoid garbage value of 'match' in
  io_wq_enqueue() (git-fixes).
- commit 7d3e252</changelog>
</package>
<package pkgid="bc2d8ba2bb72bea2ba43224c154edd8fccb8bdbfdaa6b1727d2c04e1b6939805" name="cluster-md-kmp-default" arch="s390x">
  <version epoch="0" ver="6.4.0" rel="150600.23.14.2"/>
  <changelog author="tiwai@suse.de" date="1719662400">- gpiolib: cdev: Disallow reconfiguration without direction
  (uAPI v1) (git-fixes).
- gpio: davinci: Validate the obtained number of IRQs (git-fixes).
- commit 919ebd1</changelog>
  <changelog author="tiwai@suse.de" date="1719748800">- i2c: testunit: discard write requests while old command is
  running (git-fixes).
- i2c: testunit: don't erase registers after STOP (git-fixes).
- mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
  (git-fixes).
- mmc: sdhci: Do not invert write-protect twice (git-fixes).
- mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
  (git-fixes).
- mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
  (git-fixes).
- commit 448487d</changelog>
  <changelog author="tiwai@suse.de" date="1719748801">- crypto: iaa - Account for cpu-less numa nodes (bsc#1227190).
- commit cd600aa</changelog>
  <changelog author="tiwai@suse.de" date="1719748802">- crypto: deflate - Add aliases to deflate (bsc#1227190).
- commit 27ffd92</changelog>
  <changelog author="tiwai@suse.de" date="1719835200">- ata: ahci: Clean up sysfs file on error (git-fixes).
- ata: libata-core: Fix double free on error (git-fixes).
- ata,scsi: libata-core: Do not leak memory for ata_port struct
  members (git-fixes).
- ata: libata-core: Fix null pointer dereference on error
  (git-fixes).
- kbuild: Fix build target deb-pkg: ln: failed to create hard link
  (git-fixes).
- kbuild: doc: Update default INSTALL_MOD_DIR from extra to
  updates (git-fixes).
- kbuild: Install dtb files as 0644 in Makefile.dtbinst
  (git-fixes).
- counter: ti-eqep: enable clock at probe (git-fixes).
- iio: chemical: bme680: Fix sensor data read operation
  (git-fixes).
- iio: chemical: bme680: Fix overflows in compensate() functions
  (git-fixes).
- iio: chemical: bme680: Fix calibration data variable
  (git-fixes).
- iio: chemical: bme680: Fix pressure value output (git-fixes).
- iio: accel: fxls8962af: select IIO_BUFFER &amp; IIO_KFIFO_BUF
  (git-fixes).
- iio: adc: ad7266: Fix variable checking bug (git-fixes).
- iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
  (git-fixes).
- serial: bcm63xx-uart: fix tx after conversion to
  uart_port_tx_limited() (git-fixes).
- serial: core: introduce uart_port_tx_limited_flags()
  (git-fixes).
- Revert "serial: core: only stop transmit when HW fifo is empty"
  (git-fixes).
- tty: mcf: MCF54418 has 10 UARTS (git-fixes).
- usb: gadget: aspeed_udc: fix device address configuration
  (git-fixes).
- usb: dwc3: core: remove lock of otg mode during gadget
  suspend/resume to avoid deadlock (git-fixes).
- usb: typec: ucsi: glink: fix child node release in probe
  function (git-fixes).
- usb: musb: da8xx: fix a resource leak in probe() (git-fixes).
- usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  (git-fixes).
- usb: gadget: printer: fix races against disable (git-fixes).
- PCI/MSI: Fix UAF in msi_capability_init (git-fixes).
- commit a2ea5a9</changelog>
  <changelog author="ptesarik@suse.com" date="1719835201">- net: ena: Fix redundant device NUMA node override
  (jsc#PED-8688).
- commit 6ad6684</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835202">- tcp: do not accept ACK of bytes we never sent (CVE-2023-52881
  bsc#1225611).
- commit 16404a6</changelog>
  <changelog author="mhocko@suse.com" date="1719835203">- Update
  patches.suse/1352-drm-amdgpu-Fix-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52883
  bsc#1226630).
- Update
  patches.suse/9p-add-missing-locking-around-taking-dentry-fid-list.patch
  (git-fixes CVE-2024-39463 bsc#1227090).
- Update
  patches.suse/ALSA-Fix-deadlocks-with-kctl-removals-at-disconnecti.patch
  (stable-fixes CVE-2024-38600 bsc#1226864).
- Update
  patches.suse/ALSA-core-Fix-NULL-module-pointer-assignment-at-card.patch
  (git-fixes CVE-2024-38605 bsc#1226740).
- Update
  patches.suse/ALSA-hda-Fix-possible-null-ptr-deref-when-assigning-.patch
  (git-fixes CVE-2023-52806 bsc#1225554).
- Update
  patches.suse/ALSA-hda-cs_dsp_ctl-Use-private_free-for-control-cle.patch
  (git-fixes CVE-2024-38388 bsc#1226890).
- Update
  patches.suse/ALSA-timer-Set-lower-bound-of-start-tick-time.patch
  (stable-fixes git-fixes CVE-2024-38618 bsc#1226754).
- Update
  patches.suse/ASoC-kirkwood-Fix-potential-NULL-dereference.patch
  (git-fixes CVE-2024-38550 bsc#1226633).
- Update
  patches.suse/ASoC-mediatek-Assign-dummy-when-codec-not-specified-.patch
  (git-fixes CVE-2024-38551 bsc#1226761).
- Update
  patches.suse/Bluetooth-btusb-Add-date-evt_skb-is-NULL-check.patch
  (git-fixes CVE-2023-52833 bsc#1225595).
- Update
  patches.suse/Bluetooth-hci_core-Fix-possible-buffer-overflow.patch
  (git-fixes CVE-2024-26889).
- Update
  patches.suse/HID-uclogic-Fix-user-memory-access-bug-in-uclogic_pa.patch
  (git-fixes CVE-2023-52866 bsc#1225120).
- Update
  patches.suse/IB-mlx5-Fix-init-stage-error-handling-to-avoid-doubl.patch
  (jsc#PED-6864 CVE-2023-52851 bsc#1225587).
- Update
  patches.suse/Input-cyapa-add-missing-input-core-locking-to-suspen.patch
  (git-fixes CVE-2023-52884 bsc#1226764).
- Update
  patches.suse/Input-synaptics-rmi4-fix-use-after-free-in-rmi_unreg.patch
  (git-fixes CVE-2023-52840 bsc#1224928).
- Update
  patches.suse/KEYS-trusted-Do-not-use-WARN-when-encode-fails.patch
  (git-fixes CVE-2024-36975 bsc#1226520).
- Update
  patches.suse/KEYS-trusted-Fix-memory-leak-in-tpm2_key_encode.patch
  (git-fixes CVE-2024-36967 bsc#1226131).
- Update
  patches.suse/RDMA-cma-Fix-kmemleak-in-rdma_core-observed-during-b.patch
  (git-fixes CVE-2024-38539 bsc#1226608).
- Update patches.suse/RDMA-hns-Fix-UAF-for-cq-async-event.patch
  (git-fixes CVE-2024-38545 bsc#1226595).
- Update
  patches.suse/RDMA-hns-Fix-deadlock-on-SRQ-async-events.patch
  (git-fixes CVE-2024-38591 bsc#1226738).
- Update
  patches.suse/RDMA-hns-Modify-the-print-level-of-CQE-error.patch
  (git-fixes CVE-2024-38590 bsc#1226839).
- Update
  patches.suse/RDMA-rxe-Fix-seg-fault-in-rxe_comp_queue_pkt.patch
  (git-fixes CVE-2024-38544 bsc#1226597).
- Update
  patches.suse/SUNRPC-Fix-RPC-client-cleaned-up-the-freed-pipefs-de.patch
  (git-fixes CVE-2023-52803 bsc#1225008).
- Update patches.suse/af_unix-Clear-stale-u-oob_skb.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-35970 bsc#1224584).
- Update
  patches.suse/af_unix-Drop-oob_skb-ref-before-purging-queue-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26750 bsc#1222617).
- Update
  patches.suse/af_unix-Fix-task-hung-while-purging-oob_skb-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26780 bsc#1222588).
- Update
  patches.suse/af_unix-Update-unix_sk-sk-oob_skb-under-sk_receive_queue-lock.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-36972 bsc#1226163).
- Update
  patches.suse/arm64-Restrict-CPU_BIG_ENDIAN-to-GNU-as-or-LLVM-IAS-.patch
  (git-fixes CVE-2023-52750 bsc#1225485).
- Update
  patches.suse/atl1c-Work-around-the-DMA-RX-overflow-issue.patch
  (git-fixes CVE-2023-52834 bsc#1225599).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issue-of-net_device.patch
  (git-fixes CVE-2024-38554 bsc#1226742).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issues-of-ax25_dev.patch
  (git-fixes CVE-2024-38602 bsc#1226613).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-reorder-of-WRITE-lqueued.patch
  (bsc#1225605 CVE-2024-38384 bsc#1226938).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-resetting-io-stat.patch
  (bsc#1225605 CVE-2024-38663 bsc#1226939).
- Update
  patches.suse/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch
  (git-fixes CVE-2024-38540 bsc#1226582).
- Update
  patches.suse/bonding-stop-the-device-in-bond_setup_by_slave.patch
  (git-fixes CVE-2023-52784 bsc#1224946).
- Update
  patches.suse/can-dev-can_put_echo_skb-don-t-crash-kernel-if-can_p.patch
  (git-fixes CVE-2023-52878 bsc#1225000).
- Update
  patches.suse/clk-mediatek-clk-mt2701-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52875 bsc#1225096).
- Update
  patches.suse/clk-mediatek-clk-mt6765-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52870 bsc#1224937).
- Update
  patches.suse/clk-mediatek-clk-mt6779-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52873 bsc#1225589).
- Update
  patches.suse/clk-mediatek-clk-mt6797-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52865 bsc#1225086).
- Update
  patches.suse/clk-mediatek-clk-mt7629-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52858 bsc#1225566).
- Update
  patches.suse/clk-mediatek-clk-mt7629-eth-Add-check-for-mtk_alloc_.patch
  (git-fixes CVE-2023-52876 bsc#1225036).
- Update
  patches.suse/cppc_cpufreq-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38573 bsc#1226739).
- Update patches.suse/cpufreq-exit-callback-is-optional.patch
  (git-fixes CVE-2024-38615 bsc#1226592).
- Update patches.suse/crypto-bcm-Fix-pointer-arithmetic.patch
  (git-fixes CVE-2024-38579 bsc#1226637).
- Update
  patches.suse/crypto-pcrypt-Fix-hungtask-for-PADATA_RESET.patch
  (git-fixes CVE-2023-52813 bsc#1225527).
- Update patches.suse/cxl-mem-Fix-shutdown-order.patch (git-fixes
  CVE-2023-52849 bsc#1224949).
- Update
  patches.suse/cxl-region-Do-not-try-to-cleanup-after-cxl_region_se.patch
  (git-fixes CVE-2023-52792 bsc#1225477).
- Update patches.suse/cxl-region-Fix-cxlr_pmem-leaks.patch
  (git-fixes CVE-2024-38391 bsc#1226894).
- Update
  patches.suse/dma-buf-sw-sync-don-t-enable-IRQ-from-sync_print_obj.patch
  (git-fixes CVE-2024-38780 bsc#1226886).
- Update
  patches.suse/dma-mapping-benchmark-fix-node-id-validation.patch
  (git-fixes CVE-2024-34777 bsc#1226796).
- Update
  patches.suse/dma-mapping-benchmark-handle-NUMA_NO_NODE-correctly.patch
  (git-fixes CVE-2024-39277 bsc#1226909).
- Update
  patches.suse/dmaengine-idxd-Avoid-unnecessary-destruction-of-file.patch
  (git-fixes CVE-2024-38629 bsc#1226905).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Pola.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52819
  bsc#1225532).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-SMU7.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52818
  bsc#1225530).
- Update
  patches.suse/drm-amd-check-num-of-link-levels-when-update-pcie-pa.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52812
  bsc#1225564).
- Update
  patches.suse/drm-amd-display-Avoid-NULL-dereference-of-timing-gen.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52753
  bsc#1225478).
- Update
  patches.suse/drm-amd-display-Fix-division-by-zero-in-setup_dsc_co.patch
  (stable-fixes CVE-2024-36969 bsc#1226155).
- Update
  patches.suse/drm-amd-display-Fix-null-pointer-dereference-in-erro.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52862
  bsc#1225015).
- Update
  patches.suse/drm-amd-display-Fix-potential-index-out-of-bounds-in.patch
  (git-fixes CVE-2024-38552 bsc#1226767).
- Update
  patches.suse/drm-amd-display-fix-a-NULL-pointer-dereference-in-am.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52773
  bsc#1225041).
- Update
  patches.suse/drm-amd-display-fixed-integer-types-and-null-check-l.patch
  (git-fixes CVE-2024-26767).
- Update
  patches.suse/drm-amdgpu-Fix-a-null-pointer-access-when-the-smc_rr.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52817
  bsc#1225569).
- Update
  patches.suse/drm-amdgpu-Fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch
  (git-fixes CVE-2024-39291 bsc#1226934).
- Update
  patches.suse/drm-amdgpu-Fix-potential-null-pointer-derefernce.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52814
  bsc#1225565).
- Update
  patches.suse/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch
  (stable-fixes CVE-2024-39471 bsc#1227096).
- Update
  patches.suse/drm-amdgpu-mes-fix-use-after-free-issue.patch
  (stable-fixes CVE-2024-38581 bsc#1226657).
- Update
  patches.suse/drm-amdgpu-vkms-fix-a-possible-null-pointer-derefere.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52815
  bsc#1225568).
- Update
  patches.suse/drm-amdkfd-Fix-a-race-condition-of-vram-buffer-unref.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52825
  bsc#1225076).
- Update
  patches.suse/drm-amdkfd-Fix-shift-out-of-bounds-issue.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52816
  bsc#1225529).
- Update
  patches.suse/drm-bridge-cdns-mhdp8546-Fix-possible-null-pointer-d.patch
  (git-fixes CVE-2024-38548).
- Update
  patches.suse/drm-bridge-it66121-Fix-invalid-connector-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52861
  bsc#1224941).
- Update
  patches.suse/drm-bridge-lt8912b-Fix-crash-on-bridge-detach.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52856
  bsc#1224932).
- Update
  patches.suse/drm-mediatek-Add-0-size-check-to-mtk_drm_gem_obj.patch
  (git-fixes CVE-2024-38549 bsc#1226735).
- Update
  patches.suse/drm-mediatek-Fix-coverity-issue-with-unintentional-i.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52857
  bsc#1225581).
- Update
  patches.suse/drm-mediatek-Init-ddp_comp-with-devm_kcalloc.patch
  (git-fixes CVE-2024-38592 bsc#1226844).
- Update
  patches.suse/drm-msm-a6xx-Avoid-a-nullptr-dereference-when-speedb.patch
  (git-fixes CVE-2024-38390 bsc#1226891).
- Update
  patches.suse/drm-msm-dpu-Add-callback-function-pointer-check-befo.patch
  (git-fixes CVE-2024-38622 bsc#1226856).
- Update
  patches.suse/drm-panel-fix-a-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52821
  bsc#1225022).
- Update
  patches.suse/drm-panel-panel-tpo-tpg110-fix-a-possible-null-point.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52826
  bsc#1225077).
- Update patches.suse/drm-radeon-possible-buffer-overflow.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52867
  bsc#1225009).
- Update
  patches.suse/drm-vc4-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38546 bsc#1226593).
- Update
  patches.suse/drm-vmwgfx-Fix-invalid-reads-in-fence-signaled-event.patch
  (git-fixes CVE-2024-36960 bsc#1225872).
- Update
  patches.suse/drm-zynqmp_dpsub-Always-register-bridge.patch
  (git-fixes CVE-2024-38664 bsc#1226941).
- Update
  patches.suse/e1000e-change-usleep_range-to-udelay-in-PHY-mdic-acc.patch
  (CVE-2024-39296 bsc#1226989 CVE-2024-36887 bsc#1225731).
- Update
  patches.suse/ecryptfs-Fix-buffer-size-for-tag-66-packet.patch
  (git-fixes CVE-2024-38578 bsc#1226634).
- Update
  patches.suse/efi-libstub-only-free-priv.runtime_map-when-allocate.patch
  (git-fixes CVE-2024-33619 bsc#1226768).
- Update
  patches.suse/fbdev-imsttfb-fix-a-resource-leak-in-probe.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52838
  bsc#1225031).
- Update
  patches.suse/fs-9p-only-translate-RWX-permissions-for-plain-9P200.patch
  (git-fixes CVE-2024-36964 bsc#1225866).
- Update
  patches.suse/fs-jfs-Add-check-for-negative-db_l2nbperpage.patch
  (git-fixes CVE-2023-52810 bsc#1225557).
- Update
  patches.suse/fs-jfs-Add-validity-check-for-db_maxag-and-db_agpref.patch
  (git-fixes CVE-2023-52804 bsc#1225550).
- Update
  patches.suse/ftrace-Fix-possible-use-after-free-issue-in-ftrace_location.patch
  (git-fixes CVE-2024-38588 bsc#1226837).
- Update
  patches.suse/genirq-irqdesc-Prevent-use-after-free-in-irq_find_at.patch
  (git-fixes CVE-2024-38385 bsc#1227085).
- Update patches.suse/gfs2-ignore-negated-quota-changes.patch
  (git-fixes CVE-2023-52759 bsc#1225560).
- Update
  patches.suse/hid-cp2112-Fix-duplicate-workqueue-initialization.patch
  (git-fixes CVE-2023-52853 bsc#1224988).
- Update
  patches.suse/hwmon-axi-fan-control-Fix-possible-NULL-pointer-dere.patch
  (git-fixes CVE-2023-52863 bsc#1225586).
- Update
  patches.suse/i2c-acpi-Unbind-mux-adapters-before-delete.patch
  (git-fixes CVE-2024-39362 bsc#1226995).
- Update
  patches.suse/i2c-core-Run-atomic-i2c-xfer-when-preemptible.patch
  (git-fixes CVE-2023-52791 bsc#1225108).
- Update
  patches.suse/i3c-master-mipi-i3c-hci-Fix-a-kernel-panic-for-acces.patch
  (git-fixes CVE-2023-52763 bsc#1225570).
- Update
  patches.suse/i3c-mipi-i3c-hci-Fix-out-of-bounds-access-in-hci_dma.patch
  (git-fixes CVE-2023-52766).
- Update
  patches.suse/i915-perf-Fix-NULL-deref-bugs-with-drm_dbg-calls.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52788
  bsc#1225106).
- Update
  patches.suse/igb-Fix-string-truncation-warnings-in-igb_set_fw_ver.patch
  (git-fixes CVE-2024-36010 bsc#1225594).
- Update
  patches.suse/iommu-vt-d-Fix-WARN_ON-in-iommu-probe-path.patch
  (git-fixes CVE-2024-35957 bsc#1224673).
- Update
  patches.suse/iommufd-Fix-missing-update-of-domains_itree-after-splitting-iopt
  (jsc#PED-7779 jsc#PED-7780 CVE-2023-52801 bsc#1225006).
- Update
  patches.suse/ipvlan-add-ipvlan_route_v6_outbound-helper.patch
  (git-fixes CVE-2023-52796 bsc#1224930).
- Update
  patches.suse/jffs2-prevent-xattr-node-from-overflowing-the-eraseblock.patch
  (git-fixes CVE-2024-38599 bsc#1226848).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-dbFindLeaf.patch
  (git-fixes CVE-2023-52799 bsc#1225472).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-diAlloc.patch
  (git-fixes CVE-2023-52805 bsc#1225553).
- Update
  patches.suse/kunit-fortify-Fix-mismatched-kvalloc-vfree-usage.patch
  (git-fixes CVE-2024-38617 bsc#1226859).
- Update
  patches.suse/lib-generic-radix-tree.c-Don-t-overflow-in-peek.patch
  (git-fixes CVE-2021-47432 bsc#1225391).
- Update
  patches.suse/lib-test_hmm.c-handle-src_pfns-and-dst_pfns-allocati.patch
  (git-fixes CVE-2024-38543 bsc#1226594).
- Update
  patches.suse/locking-ww_mutex-test-Fix-potential-workqueue-corrup.patch
  (bsc#1219953 CVE-2023-52836 bsc#1225609).
- Update
  patches.suse/md-Don-t-ignore-suspended-array-in-md_check_recovery-1baa.patch
  (bsc#1219596 CVE-2024-26758).
- Update
  patches.suse/media-atomisp-ssh_css-Fix-a-null-pointer-dereference.patch
  (git-fixes CVE-2024-38547 bsc#1226632).
- Update
  patches.suse/media-bttv-fix-use-after-free-error-due-to-btv-timeo.patch
  (git-fixes CVE-2023-52847 bsc#1225588).
- Update
  patches.suse/media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch
  (git-fixes CVE-2023-52764 bsc#1225571).
- Update
  patches.suse/media-hantro-Check-whether-reset-op-is-defined-befor.patch
  (git-fixes CVE-2023-52850 bsc#1225014).
- Update
  patches.suse/media-i2c-et8ek8-Don-t-strip-remove-function-when-dr.patch
  (git-fixes CVE-2024-38611 bsc#1226760).
- Update
  patches.suse/media-imon-fix-access-to-invalid-resource-for-the-se.patch
  (git-fixes CVE-2023-52754 bsc#1225490).
- Update
  patches.suse/media-lgdt3306a-Add-a-check-against-null-pointer-def.patch
  (stable-fixes CVE-2022-48772 bsc#1226976).
- Update
  patches.suse/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch
  (git-fixes CVE-2024-38621 bsc#1226895).
- Update
  patches.suse/media-vidtv-mux-Add-check-and-kfree-for-kstrdup.patch
  (git-fixes CVE-2023-52841 bsc#1225592).
- Update patches.suse/media-vidtv-psi-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52844 bsc#1225590).
- Update
  patches.suse/mfd-qcom-spmi-pmic-Fix-revid-implementation.patch
  (git-fixes CVE-2023-52765 bsc#1225029).
- Update
  patches.suse/misc-microchip-pci1xxxx-fix-double-free-in-the-error.patch
  (git-fixes CVE-2024-36973 bsc#1226457).
- Update
  patches.suse/net-hns3-fix-out-of-bounds-access-may-occur-when-coa.patch
  (git-fixes CVE-2023-52807 bsc#1225097).
- Update
  patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch
  (git-fixes CVE-2024-36962 bsc#1225827).
- Update
  patches.suse/net-mlx5-Fix-peer-devlink-set-for-SF-representor-dev.patch
  (git-fixes CVE-2024-38595 bsc#1226741).
- Update
  patches.suse/net-mlx5e-Track-xmit-submission-to-PTP-WQ-after-popu.patch
  (jsc#PED-3311 CVE-2023-52782 bsc#1225103).
- Update
  patches.suse/net-mvneta-fix-calls-to-page_pool_get_stats.patch
  (git-fixes CVE-2023-52780 bsc#1224933).
- Update
  patches.suse/net-wangxun-fix-kernel-panic-due-to-null-pointer.patch
  (git-fixes CVE-2023-52783 bsc#1225104).
- Update
  patches.suse/netfilter-complete-validation-of-user-input.patch
  (git-fixes CVE-2024-35896 bsc#1224662 CVE-2024-35962
  bsc#1224583).
- Update
  patches.suse/nfc-nci-Fix-uninit-value-in-nci_rx_work.patch
  (git-fixes CVE-2024-38381 bsc#1226878).
- Update
  patches.suse/nilfs2-fix-nilfs_empty_dir-misjudgment-and-long-loop.patch
  (git-fixes CVE-2024-39469 bsc#1226992).
- Update
  patches.suse/nilfs2-fix-potential-hang-in-nilfs_detach_log_writer.patch
  (git-fixes CVE-2024-38582 bsc#1226658).
- Update
  patches.suse/nilfs2-fix-use-after-free-of-timer-for-log-writer-th.patch
  (git-fixes CVE-2024-38583 bsc#1226777).
- Update
  patches.suse/of-module-add-buffer-overflow-check-in-of_modalias.patch
  (git-fixes CVE-2024-38541 bsc#1226587).
- Update
  patches.suse/padata-Fix-refcnt-handling-in-padata_free_shell.patch
  (git-fixes CVE-2023-52854 bsc#1225584).
- Update
  patches.suse/perf-core-Bail-out-early-if-the-request-AUX-area-is-out-of-bound.patch
  (git-fixes CVE-2023-52835 bsc#1225602).
- Update
  patches.suse/platform-x86-wmi-Fix-opening-of-char-device.patch
  (git-fixes CVE-2023-52864 bsc#1225132).
- Update
  patches.suse/powerpc-pseries-iommu-LPAR-panics-during-boot-up-wit.patch
  (bsc#1222011 ltc#205900 CVE-2024-36926 bsc#1225829).
- Update patches.suse/pstore-platform-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52869 bsc#1225050).
- Update
  patches.suse/remoteproc-mediatek-Make-sure-IPI-buffer-fits-in-L2T.patch
  (git-fixes CVE-2024-36965 bsc#1226149).
- Update
  patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch
  (git-fixes CVE-2024-38601 bsc#1226876).
- Update
  patches.suse/s390-dasd-protect-device-queue-against-concurrent-access.patch
  (git-fixes bsc#1217481 CVE-2023-52774 bsc#1225572).
- Update
  patches.suse/scsi-hisi_sas-Set-debugfs_dir-pointer-to-NULL-after-removing-debugfs.patch
  (git-fixes CVE-2023-52808 bsc#1225555).
- Update
  patches.suse/scsi-ibmvfc-Remove-BUG_ON-in-the-case-of-an-empty-ev.patch
  (bsc#1209834 ltc#202097 CVE-2023-52811 bsc#1225559).
- Update
  patches.suse/scsi-libfc-Fix-potential-NULL-pointer-dereference-in-fc_lport_ptp_setup.patch
  (git-fixes CVE-2023-52809 bsc#1225556).
- Update
  patches.suse/scsi-lpfc-Move-NPIV-s-transport-unregistration-to-af.patch
  (bsc#1221777 CVE-2024-36952 bsc#1225898).
- Update
  patches.suse/scsi-lpfc-Release-hbalock-before-calling-lpfc_worker.patch
  (bsc#1221777 CVE-2024-36924 bsc#1225820).
- Update
  patches.suse/serial-max3100-Lock-port-lock-when-calling-uart_hand.patch
  (git-fixes CVE-2024-38634 bsc#1226868).
- Update
  patches.suse/serial-max3100-Update-uart_driver_registered-on-driv.patch
  (git-fixes CVE-2024-38633 bsc#1226867).
- Update
  patches.suse/soc-qcom-llcc-Handle-a-second-device-without-data-co.patch
  (git-fixes CVE-2023-52871 bsc#1225534).
- Update
  patches.suse/soundwire-cadence-fix-invalid-PDI-offset.patch
  (stable-fixes CVE-2024-38635 bsc#1226863).
- Update patches.suse/speakup-Fix-sizeof-vs-ARRAY_SIZE-bug.patch
  (git-fixes CVE-2024-38587 bsc#1226780).
- Update patches.suse/spi-Fix-null-dereference-on-suspend.patch
  (git-fixes CVE-2023-52749 bsc#1225476).
- Update
  patches.suse/thermal-core-prevent-potential-string-overflow.patch
  (git-fixes CVE-2023-52868 bsc#1225044).
- Update
  patches.suse/thermal-drivers-qcom-lmh-Check-for-SCM-availability-.patch
  (git-fixes CVE-2024-39466 bsc#1227089).
- Update
  patches.suse/thermal-drivers-tsens-Fix-null-pointer-dereference.patch
  (git-fixes CVE-2024-38571 bsc#1226737).
- Update
  patches.suse/thermal-intel-powerclamp-fix-mismatch-in-get-functio.patch
  (git-fixes CVE-2023-52794 bsc#1225028).
- Update
  patches.suse/tls-fix-NULL-deref-on-tls_sw_splice_eof-with-empty-r.patch
  (jsc#PED-6831 CVE-2023-52767 bsc#1224998).
- Update
  patches.suse/tpm_tis_spi-Account-for-SPI-header-when-allocating-T.patch
  (git-fixes CVE-2024-36477 bsc#1226840).
- Update
  patches.suse/tracing-Have-trace_event_file-have-ref-counters.patch
  (git-fixes CVE-2023-52879 bsc#1225101).
- Update
  patches.suse/tracing-trigger-Fix-to-return-error-if-failed-to-alloc-snapshot.patch
  (git-fixes CVE-2024-26920).
- Update
  patches.suse/tty-n_gsm-fix-race-condition-in-status-line-change-o.patch
  (git-fixes CVE-2023-52872 bsc#1225591).
- Update
  patches.suse/tty-n_gsm-require-CAP_NET_ADMIN-to-attach-N_GSM0710-.patch
  (bsc#1222619 CVE-2023-52880).
- Update
  patches.suse/tty-vcc-Add-check-for-kstrdup-in-vcc_probe.patch
  (git-fixes CVE-2023-52789 bsc#1225180).
- Update
  patches.suse/usb-config-fix-iteration-issue-in-usb_get_bos_descri.patch
  (git-fixes CVE-2023-52781 bsc#1225092).
- Update
  patches.suse/usb-dwc3-Wait-unconditionally-after-issuing-EndXfer-.patch
  (git-fixes CVE-2024-36977 bsc#1226513).
- Update
  patches.suse/usb-gadget-u_audio-Fix-race-condition-use-of-control.patch
  (git-fixes CVE-2024-38628 bsc#1226911).
- Update
  patches.suse/usb-storage-alauda-Check-whether-the-media-is-initia.patch
  (git-fixes CVE-2024-38619 bsc#1226861).
- Update
  patches.suse/usb-typec-tcpm-Fix-NULL-pointer-dereference-in-tcpm_.patch
  (git-fixes CVE-2023-52877 bsc#1224944).
- Update
  patches.suse/vhost-vdpa-fix-use-after-free-in-vhost_vdpa_probe.patch
  (jsc#PED-3311 CVE-2023-52795 bsc#1225085).
- Update
  patches.suse/virtio-blk-fix-implicit-overflow-on-virtio_max_dma_s.patch
  (git-fixes CVE-2023-52762 bsc#1225573).
- Update
  patches.suse/virtio-vsock-Fix-uninit-value-in-virtio_transport_re.patch
  (jsc#PED-5505 CVE-2023-52842 bsc#1225025).
- Update
  patches.suse/watchdog-cpu5wdt.c-Fix-use-after-free-bug-caused-by-.patch
  (git-fixes CVE-2024-38630 bsc#1226908).
- Update
  patches.suse/wifi-ar5523-enable-proper-endpoint-verification.patch
  (git-fixes CVE-2024-38565 bsc#1226747).
- Update
  patches.suse/wifi-ath11k-fix-dfs-radar-event-locking.patch
  (git-fixes CVE-2023-52798 bsc#1224947).
- Update
  patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch
  (git-fixes CVE-2023-52777 bsc#1224992).
- Update patches.suse/wifi-ath11k-fix-htt-pktlog-locking.patch
  (git-fixes CVE-2023-52800).
- Update
  patches.suse/wifi-ath12k-fix-dfs-radar-and-temperature-event-lock.patch
  (git-fixes CVE-2023-52776 bsc#1225090).
- Update
  patches.suse/wifi-ath12k-fix-htt-mlo-offset-event-locking.patch
  (git-fixes CVE-2023-52769 bsc#1225001).
- Update
  patches.suse/wifi-ath12k-fix-out-of-bound-access-of-qmi_invoke_ha.patch
  (git-fixes CVE-2024-38572 bsc#1226776).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-read-in-ath12k.patch
  (git-fixes CVE-2023-52827 bsc#1225078).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-write-in-ath12.patch
  (git-fixes CVE-2023-52829 bsc#1225081).
- Update
  patches.suse/wifi-brcmfmac-pcie-handle-randbuf-allocation-failure.patch
  (git-fixes CVE-2024-38575 bsc#1226612).
- Update
  patches.suse/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch
  (git-fixes CVE-2024-38567 bsc#1226769).
- Update
  patches.suse/wifi-carl9170-re-fix-fortified-memset-warning.patch
  (git-fixes CVE-2024-38616 bsc#1226852).
- Update
  patches.suse/wifi-mac80211-don-t-return-unset-power-in-ieee80211_.patch
  (git-fixes CVE-2023-52832 bsc#1225577).
- Update
  patches.suse/wifi-nl80211-Avoid-address-calculations-via-out-of-b.patch
  (git-fixes CVE-2024-38562 bsc#1226788).
- Update
  patches.suse/wifi-wilc1000-use-vmm_table-as-array-in-wilc-struct.patch
  (git-fixes CVE-2023-52768 bsc#1225004).
- Update
  patches.suse/x86-tdx-Zero-out-the-missing-RSI-in-TDX_HYPERCALL-macro.patch
  (jsc#PED-5824 CVE-2023-52874 bsc#1225049).
- commit 33efdc4</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835204">- tcp: Use refcount_inc_not_zero() in tcp_twsk_unique()
  (CVE-2024-36904 bsc#1225732).
- commit d578dcc</changelog>
  <changelog author="heming.zhao@suse.com" date="1719921600">- gfs2: Fix potential glock use-after-free on unmount (bsc#1226775
  CVE-2024-38570).
- gfs2: Rename sd_{ glock =&gt; kill }_wait (bsc#1226775
  CVE-2024-38570).
- commit f3adbca</changelog>
  <changelog author="tiwai@suse.de" date="1719921601">- Correct SCSI patch references (bsc#1225767 CVE-2024-36919 bsc#1226785 CVE-2024-38559)
- commit e8ea587</changelog>
  <changelog author="tiwai@suse.de" date="1719921602">- mtd: rawnand: rockchip: ensure NVDDR timings are rejected
  (git-fixes).
- mtd: rawnand: Bypass a couple of sanity checks during NAND
  identification (git-fixes).
- mtd: rawnand: Fix the nand_read_data_op() early check
  (git-fixes).
- mtd: rawnand: Ensure ECC configuration is propagated to upper
  layers (git-fixes).
- commit e545951</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1719921603">- kernel-doc: fix struct_group_tagged() parsing (git-fixes).
- commit e3a2a2e</changelog>
  <changelog author="fdmanana@suse.com" date="1719921604">- btrfs: fix crash on racing fsync and size-extending write into
  prealloc (bsc#1227101 CVE-2024-37354).
- commit 1d355af</changelog>
  <changelog author="vbabka@suse.cz" date="1719921605">- virt: acrn: stop using follow_pfn (CVE-2024-38610 bsc#1226758).
- commit c2ea51b</changelog>
  <changelog author="vbabka@suse.cz" date="1719921606">- drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
  (CVE-2024-38610 bsc#1226758).
- commit 7069ac2</changelog>
  <changelog author="rhopkins@suse.de" date="1719921607">- hsr: Prevent use after free in prp_create_tagged_frame()
  (CVE-2023-52846 bsc#1225098).
- commit cf63988</changelog>
  <changelog author="krisman@suse.de" date="1719921608">- io_uring: Fix io_cqring_wait() not restoring sigmask on
  get_timespec64() failure (git-fixes).
- commit e640a65</changelog>
  <changelog author="krisman@suse.de" date="1719921609">- io_uring: check for non-NULL file pointer in io_file_can_poll()
  (bsc#1226990 CVE-2024-39371).
- io_uring/io-wq: Use set_bit() and test_bit() at worker-&gt;flags
  (git-fixes).
- io_uring/sqpoll: work around a potential audit memory leak
  (git-fixes).
- commit 24603fc</changelog>
  <changelog author="krisman@suse.de" date="1719921610">- io_uring/rsrc: fix incorrect assignment of iter-&gt;nr_segs in
  io_import_fixed (git-fixes).
- io_uring/rsrc: don't lock while !TASK_RUNNING (git-fixes).
- io_uring/io-wq: avoid garbage value of 'match' in
  io_wq_enqueue() (git-fixes).
- commit 7d3e252</changelog>
</package>
<package pkgid="13de159d55f8baaf9099ee3fac7b954785ce8f5c45d7c0f285dfee2261f6ce08" name="cluster-md-kmp-default" arch="x86_64">
  <version epoch="0" ver="6.4.0" rel="150600.23.14.2"/>
  <changelog author="tiwai@suse.de" date="1719662400">- gpiolib: cdev: Disallow reconfiguration without direction
  (uAPI v1) (git-fixes).
- gpio: davinci: Validate the obtained number of IRQs (git-fixes).
- commit 919ebd1</changelog>
  <changelog author="tiwai@suse.de" date="1719748800">- i2c: testunit: discard write requests while old command is
  running (git-fixes).
- i2c: testunit: don't erase registers after STOP (git-fixes).
- mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
  (git-fixes).
- mmc: sdhci: Do not invert write-protect twice (git-fixes).
- mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
  (git-fixes).
- mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
  (git-fixes).
- commit 448487d</changelog>
  <changelog author="tiwai@suse.de" date="1719748801">- crypto: iaa - Account for cpu-less numa nodes (bsc#1227190).
- commit cd600aa</changelog>
  <changelog author="tiwai@suse.de" date="1719748802">- crypto: deflate - Add aliases to deflate (bsc#1227190).
- commit 27ffd92</changelog>
  <changelog author="tiwai@suse.de" date="1719835200">- ata: ahci: Clean up sysfs file on error (git-fixes).
- ata: libata-core: Fix double free on error (git-fixes).
- ata,scsi: libata-core: Do not leak memory for ata_port struct
  members (git-fixes).
- ata: libata-core: Fix null pointer dereference on error
  (git-fixes).
- kbuild: Fix build target deb-pkg: ln: failed to create hard link
  (git-fixes).
- kbuild: doc: Update default INSTALL_MOD_DIR from extra to
  updates (git-fixes).
- kbuild: Install dtb files as 0644 in Makefile.dtbinst
  (git-fixes).
- counter: ti-eqep: enable clock at probe (git-fixes).
- iio: chemical: bme680: Fix sensor data read operation
  (git-fixes).
- iio: chemical: bme680: Fix overflows in compensate() functions
  (git-fixes).
- iio: chemical: bme680: Fix calibration data variable
  (git-fixes).
- iio: chemical: bme680: Fix pressure value output (git-fixes).
- iio: accel: fxls8962af: select IIO_BUFFER &amp; IIO_KFIFO_BUF
  (git-fixes).
- iio: adc: ad7266: Fix variable checking bug (git-fixes).
- iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
  (git-fixes).
- serial: bcm63xx-uart: fix tx after conversion to
  uart_port_tx_limited() (git-fixes).
- serial: core: introduce uart_port_tx_limited_flags()
  (git-fixes).
- Revert "serial: core: only stop transmit when HW fifo is empty"
  (git-fixes).
- tty: mcf: MCF54418 has 10 UARTS (git-fixes).
- usb: gadget: aspeed_udc: fix device address configuration
  (git-fixes).
- usb: dwc3: core: remove lock of otg mode during gadget
  suspend/resume to avoid deadlock (git-fixes).
- usb: typec: ucsi: glink: fix child node release in probe
  function (git-fixes).
- usb: musb: da8xx: fix a resource leak in probe() (git-fixes).
- usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  (git-fixes).
- usb: gadget: printer: fix races against disable (git-fixes).
- PCI/MSI: Fix UAF in msi_capability_init (git-fixes).
- commit a2ea5a9</changelog>
  <changelog author="ptesarik@suse.com" date="1719835201">- net: ena: Fix redundant device NUMA node override
  (jsc#PED-8688).
- commit 6ad6684</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835202">- tcp: do not accept ACK of bytes we never sent (CVE-2023-52881
  bsc#1225611).
- commit 16404a6</changelog>
  <changelog author="mhocko@suse.com" date="1719835203">- Update
  patches.suse/1352-drm-amdgpu-Fix-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52883
  bsc#1226630).
- Update
  patches.suse/9p-add-missing-locking-around-taking-dentry-fid-list.patch
  (git-fixes CVE-2024-39463 bsc#1227090).
- Update
  patches.suse/ALSA-Fix-deadlocks-with-kctl-removals-at-disconnecti.patch
  (stable-fixes CVE-2024-38600 bsc#1226864).
- Update
  patches.suse/ALSA-core-Fix-NULL-module-pointer-assignment-at-card.patch
  (git-fixes CVE-2024-38605 bsc#1226740).
- Update
  patches.suse/ALSA-hda-Fix-possible-null-ptr-deref-when-assigning-.patch
  (git-fixes CVE-2023-52806 bsc#1225554).
- Update
  patches.suse/ALSA-hda-cs_dsp_ctl-Use-private_free-for-control-cle.patch
  (git-fixes CVE-2024-38388 bsc#1226890).
- Update
  patches.suse/ALSA-timer-Set-lower-bound-of-start-tick-time.patch
  (stable-fixes git-fixes CVE-2024-38618 bsc#1226754).
- Update
  patches.suse/ASoC-kirkwood-Fix-potential-NULL-dereference.patch
  (git-fixes CVE-2024-38550 bsc#1226633).
- Update
  patches.suse/ASoC-mediatek-Assign-dummy-when-codec-not-specified-.patch
  (git-fixes CVE-2024-38551 bsc#1226761).
- Update
  patches.suse/Bluetooth-btusb-Add-date-evt_skb-is-NULL-check.patch
  (git-fixes CVE-2023-52833 bsc#1225595).
- Update
  patches.suse/Bluetooth-hci_core-Fix-possible-buffer-overflow.patch
  (git-fixes CVE-2024-26889).
- Update
  patches.suse/HID-uclogic-Fix-user-memory-access-bug-in-uclogic_pa.patch
  (git-fixes CVE-2023-52866 bsc#1225120).
- Update
  patches.suse/IB-mlx5-Fix-init-stage-error-handling-to-avoid-doubl.patch
  (jsc#PED-6864 CVE-2023-52851 bsc#1225587).
- Update
  patches.suse/Input-cyapa-add-missing-input-core-locking-to-suspen.patch
  (git-fixes CVE-2023-52884 bsc#1226764).
- Update
  patches.suse/Input-synaptics-rmi4-fix-use-after-free-in-rmi_unreg.patch
  (git-fixes CVE-2023-52840 bsc#1224928).
- Update
  patches.suse/KEYS-trusted-Do-not-use-WARN-when-encode-fails.patch
  (git-fixes CVE-2024-36975 bsc#1226520).
- Update
  patches.suse/KEYS-trusted-Fix-memory-leak-in-tpm2_key_encode.patch
  (git-fixes CVE-2024-36967 bsc#1226131).
- Update
  patches.suse/RDMA-cma-Fix-kmemleak-in-rdma_core-observed-during-b.patch
  (git-fixes CVE-2024-38539 bsc#1226608).
- Update patches.suse/RDMA-hns-Fix-UAF-for-cq-async-event.patch
  (git-fixes CVE-2024-38545 bsc#1226595).
- Update
  patches.suse/RDMA-hns-Fix-deadlock-on-SRQ-async-events.patch
  (git-fixes CVE-2024-38591 bsc#1226738).
- Update
  patches.suse/RDMA-hns-Modify-the-print-level-of-CQE-error.patch
  (git-fixes CVE-2024-38590 bsc#1226839).
- Update
  patches.suse/RDMA-rxe-Fix-seg-fault-in-rxe_comp_queue_pkt.patch
  (git-fixes CVE-2024-38544 bsc#1226597).
- Update
  patches.suse/SUNRPC-Fix-RPC-client-cleaned-up-the-freed-pipefs-de.patch
  (git-fixes CVE-2023-52803 bsc#1225008).
- Update patches.suse/af_unix-Clear-stale-u-oob_skb.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-35970 bsc#1224584).
- Update
  patches.suse/af_unix-Drop-oob_skb-ref-before-purging-queue-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26750 bsc#1222617).
- Update
  patches.suse/af_unix-Fix-task-hung-while-purging-oob_skb-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26780 bsc#1222588).
- Update
  patches.suse/af_unix-Update-unix_sk-sk-oob_skb-under-sk_receive_queue-lock.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-36972 bsc#1226163).
- Update
  patches.suse/arm64-Restrict-CPU_BIG_ENDIAN-to-GNU-as-or-LLVM-IAS-.patch
  (git-fixes CVE-2023-52750 bsc#1225485).
- Update
  patches.suse/atl1c-Work-around-the-DMA-RX-overflow-issue.patch
  (git-fixes CVE-2023-52834 bsc#1225599).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issue-of-net_device.patch
  (git-fixes CVE-2024-38554 bsc#1226742).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issues-of-ax25_dev.patch
  (git-fixes CVE-2024-38602 bsc#1226613).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-reorder-of-WRITE-lqueued.patch
  (bsc#1225605 CVE-2024-38384 bsc#1226938).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-resetting-io-stat.patch
  (bsc#1225605 CVE-2024-38663 bsc#1226939).
- Update
  patches.suse/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch
  (git-fixes CVE-2024-38540 bsc#1226582).
- Update
  patches.suse/bonding-stop-the-device-in-bond_setup_by_slave.patch
  (git-fixes CVE-2023-52784 bsc#1224946).
- Update
  patches.suse/can-dev-can_put_echo_skb-don-t-crash-kernel-if-can_p.patch
  (git-fixes CVE-2023-52878 bsc#1225000).
- Update
  patches.suse/clk-mediatek-clk-mt2701-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52875 bsc#1225096).
- Update
  patches.suse/clk-mediatek-clk-mt6765-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52870 bsc#1224937).
- Update
  patches.suse/clk-mediatek-clk-mt6779-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52873 bsc#1225589).
- Update
  patches.suse/clk-mediatek-clk-mt6797-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52865 bsc#1225086).
- Update
  patches.suse/clk-mediatek-clk-mt7629-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52858 bsc#1225566).
- Update
  patches.suse/clk-mediatek-clk-mt7629-eth-Add-check-for-mtk_alloc_.patch
  (git-fixes CVE-2023-52876 bsc#1225036).
- Update
  patches.suse/cppc_cpufreq-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38573 bsc#1226739).
- Update patches.suse/cpufreq-exit-callback-is-optional.patch
  (git-fixes CVE-2024-38615 bsc#1226592).
- Update patches.suse/crypto-bcm-Fix-pointer-arithmetic.patch
  (git-fixes CVE-2024-38579 bsc#1226637).
- Update
  patches.suse/crypto-pcrypt-Fix-hungtask-for-PADATA_RESET.patch
  (git-fixes CVE-2023-52813 bsc#1225527).
- Update patches.suse/cxl-mem-Fix-shutdown-order.patch (git-fixes
  CVE-2023-52849 bsc#1224949).
- Update
  patches.suse/cxl-region-Do-not-try-to-cleanup-after-cxl_region_se.patch
  (git-fixes CVE-2023-52792 bsc#1225477).
- Update patches.suse/cxl-region-Fix-cxlr_pmem-leaks.patch
  (git-fixes CVE-2024-38391 bsc#1226894).
- Update
  patches.suse/dma-buf-sw-sync-don-t-enable-IRQ-from-sync_print_obj.patch
  (git-fixes CVE-2024-38780 bsc#1226886).
- Update
  patches.suse/dma-mapping-benchmark-fix-node-id-validation.patch
  (git-fixes CVE-2024-34777 bsc#1226796).
- Update
  patches.suse/dma-mapping-benchmark-handle-NUMA_NO_NODE-correctly.patch
  (git-fixes CVE-2024-39277 bsc#1226909).
- Update
  patches.suse/dmaengine-idxd-Avoid-unnecessary-destruction-of-file.patch
  (git-fixes CVE-2024-38629 bsc#1226905).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Pola.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52819
  bsc#1225532).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-SMU7.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52818
  bsc#1225530).
- Update
  patches.suse/drm-amd-check-num-of-link-levels-when-update-pcie-pa.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52812
  bsc#1225564).
- Update
  patches.suse/drm-amd-display-Avoid-NULL-dereference-of-timing-gen.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52753
  bsc#1225478).
- Update
  patches.suse/drm-amd-display-Fix-division-by-zero-in-setup_dsc_co.patch
  (stable-fixes CVE-2024-36969 bsc#1226155).
- Update
  patches.suse/drm-amd-display-Fix-null-pointer-dereference-in-erro.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52862
  bsc#1225015).
- Update
  patches.suse/drm-amd-display-Fix-potential-index-out-of-bounds-in.patch
  (git-fixes CVE-2024-38552 bsc#1226767).
- Update
  patches.suse/drm-amd-display-fix-a-NULL-pointer-dereference-in-am.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52773
  bsc#1225041).
- Update
  patches.suse/drm-amd-display-fixed-integer-types-and-null-check-l.patch
  (git-fixes CVE-2024-26767).
- Update
  patches.suse/drm-amdgpu-Fix-a-null-pointer-access-when-the-smc_rr.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52817
  bsc#1225569).
- Update
  patches.suse/drm-amdgpu-Fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch
  (git-fixes CVE-2024-39291 bsc#1226934).
- Update
  patches.suse/drm-amdgpu-Fix-potential-null-pointer-derefernce.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52814
  bsc#1225565).
- Update
  patches.suse/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch
  (stable-fixes CVE-2024-39471 bsc#1227096).
- Update
  patches.suse/drm-amdgpu-mes-fix-use-after-free-issue.patch
  (stable-fixes CVE-2024-38581 bsc#1226657).
- Update
  patches.suse/drm-amdgpu-vkms-fix-a-possible-null-pointer-derefere.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52815
  bsc#1225568).
- Update
  patches.suse/drm-amdkfd-Fix-a-race-condition-of-vram-buffer-unref.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52825
  bsc#1225076).
- Update
  patches.suse/drm-amdkfd-Fix-shift-out-of-bounds-issue.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52816
  bsc#1225529).
- Update
  patches.suse/drm-bridge-cdns-mhdp8546-Fix-possible-null-pointer-d.patch
  (git-fixes CVE-2024-38548).
- Update
  patches.suse/drm-bridge-it66121-Fix-invalid-connector-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52861
  bsc#1224941).
- Update
  patches.suse/drm-bridge-lt8912b-Fix-crash-on-bridge-detach.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52856
  bsc#1224932).
- Update
  patches.suse/drm-mediatek-Add-0-size-check-to-mtk_drm_gem_obj.patch
  (git-fixes CVE-2024-38549 bsc#1226735).
- Update
  patches.suse/drm-mediatek-Fix-coverity-issue-with-unintentional-i.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52857
  bsc#1225581).
- Update
  patches.suse/drm-mediatek-Init-ddp_comp-with-devm_kcalloc.patch
  (git-fixes CVE-2024-38592 bsc#1226844).
- Update
  patches.suse/drm-msm-a6xx-Avoid-a-nullptr-dereference-when-speedb.patch
  (git-fixes CVE-2024-38390 bsc#1226891).
- Update
  patches.suse/drm-msm-dpu-Add-callback-function-pointer-check-befo.patch
  (git-fixes CVE-2024-38622 bsc#1226856).
- Update
  patches.suse/drm-panel-fix-a-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52821
  bsc#1225022).
- Update
  patches.suse/drm-panel-panel-tpo-tpg110-fix-a-possible-null-point.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52826
  bsc#1225077).
- Update patches.suse/drm-radeon-possible-buffer-overflow.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52867
  bsc#1225009).
- Update
  patches.suse/drm-vc4-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38546 bsc#1226593).
- Update
  patches.suse/drm-vmwgfx-Fix-invalid-reads-in-fence-signaled-event.patch
  (git-fixes CVE-2024-36960 bsc#1225872).
- Update
  patches.suse/drm-zynqmp_dpsub-Always-register-bridge.patch
  (git-fixes CVE-2024-38664 bsc#1226941).
- Update
  patches.suse/e1000e-change-usleep_range-to-udelay-in-PHY-mdic-acc.patch
  (CVE-2024-39296 bsc#1226989 CVE-2024-36887 bsc#1225731).
- Update
  patches.suse/ecryptfs-Fix-buffer-size-for-tag-66-packet.patch
  (git-fixes CVE-2024-38578 bsc#1226634).
- Update
  patches.suse/efi-libstub-only-free-priv.runtime_map-when-allocate.patch
  (git-fixes CVE-2024-33619 bsc#1226768).
- Update
  patches.suse/fbdev-imsttfb-fix-a-resource-leak-in-probe.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52838
  bsc#1225031).
- Update
  patches.suse/fs-9p-only-translate-RWX-permissions-for-plain-9P200.patch
  (git-fixes CVE-2024-36964 bsc#1225866).
- Update
  patches.suse/fs-jfs-Add-check-for-negative-db_l2nbperpage.patch
  (git-fixes CVE-2023-52810 bsc#1225557).
- Update
  patches.suse/fs-jfs-Add-validity-check-for-db_maxag-and-db_agpref.patch
  (git-fixes CVE-2023-52804 bsc#1225550).
- Update
  patches.suse/ftrace-Fix-possible-use-after-free-issue-in-ftrace_location.patch
  (git-fixes CVE-2024-38588 bsc#1226837).
- Update
  patches.suse/genirq-irqdesc-Prevent-use-after-free-in-irq_find_at.patch
  (git-fixes CVE-2024-38385 bsc#1227085).
- Update patches.suse/gfs2-ignore-negated-quota-changes.patch
  (git-fixes CVE-2023-52759 bsc#1225560).
- Update
  patches.suse/hid-cp2112-Fix-duplicate-workqueue-initialization.patch
  (git-fixes CVE-2023-52853 bsc#1224988).
- Update
  patches.suse/hwmon-axi-fan-control-Fix-possible-NULL-pointer-dere.patch
  (git-fixes CVE-2023-52863 bsc#1225586).
- Update
  patches.suse/i2c-acpi-Unbind-mux-adapters-before-delete.patch
  (git-fixes CVE-2024-39362 bsc#1226995).
- Update
  patches.suse/i2c-core-Run-atomic-i2c-xfer-when-preemptible.patch
  (git-fixes CVE-2023-52791 bsc#1225108).
- Update
  patches.suse/i3c-master-mipi-i3c-hci-Fix-a-kernel-panic-for-acces.patch
  (git-fixes CVE-2023-52763 bsc#1225570).
- Update
  patches.suse/i3c-mipi-i3c-hci-Fix-out-of-bounds-access-in-hci_dma.patch
  (git-fixes CVE-2023-52766).
- Update
  patches.suse/i915-perf-Fix-NULL-deref-bugs-with-drm_dbg-calls.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52788
  bsc#1225106).
- Update
  patches.suse/igb-Fix-string-truncation-warnings-in-igb_set_fw_ver.patch
  (git-fixes CVE-2024-36010 bsc#1225594).
- Update
  patches.suse/iommu-vt-d-Fix-WARN_ON-in-iommu-probe-path.patch
  (git-fixes CVE-2024-35957 bsc#1224673).
- Update
  patches.suse/iommufd-Fix-missing-update-of-domains_itree-after-splitting-iopt
  (jsc#PED-7779 jsc#PED-7780 CVE-2023-52801 bsc#1225006).
- Update
  patches.suse/ipvlan-add-ipvlan_route_v6_outbound-helper.patch
  (git-fixes CVE-2023-52796 bsc#1224930).
- Update
  patches.suse/jffs2-prevent-xattr-node-from-overflowing-the-eraseblock.patch
  (git-fixes CVE-2024-38599 bsc#1226848).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-dbFindLeaf.patch
  (git-fixes CVE-2023-52799 bsc#1225472).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-diAlloc.patch
  (git-fixes CVE-2023-52805 bsc#1225553).
- Update
  patches.suse/kunit-fortify-Fix-mismatched-kvalloc-vfree-usage.patch
  (git-fixes CVE-2024-38617 bsc#1226859).
- Update
  patches.suse/lib-generic-radix-tree.c-Don-t-overflow-in-peek.patch
  (git-fixes CVE-2021-47432 bsc#1225391).
- Update
  patches.suse/lib-test_hmm.c-handle-src_pfns-and-dst_pfns-allocati.patch
  (git-fixes CVE-2024-38543 bsc#1226594).
- Update
  patches.suse/locking-ww_mutex-test-Fix-potential-workqueue-corrup.patch
  (bsc#1219953 CVE-2023-52836 bsc#1225609).
- Update
  patches.suse/md-Don-t-ignore-suspended-array-in-md_check_recovery-1baa.patch
  (bsc#1219596 CVE-2024-26758).
- Update
  patches.suse/media-atomisp-ssh_css-Fix-a-null-pointer-dereference.patch
  (git-fixes CVE-2024-38547 bsc#1226632).
- Update
  patches.suse/media-bttv-fix-use-after-free-error-due-to-btv-timeo.patch
  (git-fixes CVE-2023-52847 bsc#1225588).
- Update
  patches.suse/media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch
  (git-fixes CVE-2023-52764 bsc#1225571).
- Update
  patches.suse/media-hantro-Check-whether-reset-op-is-defined-befor.patch
  (git-fixes CVE-2023-52850 bsc#1225014).
- Update
  patches.suse/media-i2c-et8ek8-Don-t-strip-remove-function-when-dr.patch
  (git-fixes CVE-2024-38611 bsc#1226760).
- Update
  patches.suse/media-imon-fix-access-to-invalid-resource-for-the-se.patch
  (git-fixes CVE-2023-52754 bsc#1225490).
- Update
  patches.suse/media-lgdt3306a-Add-a-check-against-null-pointer-def.patch
  (stable-fixes CVE-2022-48772 bsc#1226976).
- Update
  patches.suse/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch
  (git-fixes CVE-2024-38621 bsc#1226895).
- Update
  patches.suse/media-vidtv-mux-Add-check-and-kfree-for-kstrdup.patch
  (git-fixes CVE-2023-52841 bsc#1225592).
- Update patches.suse/media-vidtv-psi-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52844 bsc#1225590).
- Update
  patches.suse/mfd-qcom-spmi-pmic-Fix-revid-implementation.patch
  (git-fixes CVE-2023-52765 bsc#1225029).
- Update
  patches.suse/misc-microchip-pci1xxxx-fix-double-free-in-the-error.patch
  (git-fixes CVE-2024-36973 bsc#1226457).
- Update
  patches.suse/net-hns3-fix-out-of-bounds-access-may-occur-when-coa.patch
  (git-fixes CVE-2023-52807 bsc#1225097).
- Update
  patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch
  (git-fixes CVE-2024-36962 bsc#1225827).
- Update
  patches.suse/net-mlx5-Fix-peer-devlink-set-for-SF-representor-dev.patch
  (git-fixes CVE-2024-38595 bsc#1226741).
- Update
  patches.suse/net-mlx5e-Track-xmit-submission-to-PTP-WQ-after-popu.patch
  (jsc#PED-3311 CVE-2023-52782 bsc#1225103).
- Update
  patches.suse/net-mvneta-fix-calls-to-page_pool_get_stats.patch
  (git-fixes CVE-2023-52780 bsc#1224933).
- Update
  patches.suse/net-wangxun-fix-kernel-panic-due-to-null-pointer.patch
  (git-fixes CVE-2023-52783 bsc#1225104).
- Update
  patches.suse/netfilter-complete-validation-of-user-input.patch
  (git-fixes CVE-2024-35896 bsc#1224662 CVE-2024-35962
  bsc#1224583).
- Update
  patches.suse/nfc-nci-Fix-uninit-value-in-nci_rx_work.patch
  (git-fixes CVE-2024-38381 bsc#1226878).
- Update
  patches.suse/nilfs2-fix-nilfs_empty_dir-misjudgment-and-long-loop.patch
  (git-fixes CVE-2024-39469 bsc#1226992).
- Update
  patches.suse/nilfs2-fix-potential-hang-in-nilfs_detach_log_writer.patch
  (git-fixes CVE-2024-38582 bsc#1226658).
- Update
  patches.suse/nilfs2-fix-use-after-free-of-timer-for-log-writer-th.patch
  (git-fixes CVE-2024-38583 bsc#1226777).
- Update
  patches.suse/of-module-add-buffer-overflow-check-in-of_modalias.patch
  (git-fixes CVE-2024-38541 bsc#1226587).
- Update
  patches.suse/padata-Fix-refcnt-handling-in-padata_free_shell.patch
  (git-fixes CVE-2023-52854 bsc#1225584).
- Update
  patches.suse/perf-core-Bail-out-early-if-the-request-AUX-area-is-out-of-bound.patch
  (git-fixes CVE-2023-52835 bsc#1225602).
- Update
  patches.suse/platform-x86-wmi-Fix-opening-of-char-device.patch
  (git-fixes CVE-2023-52864 bsc#1225132).
- Update
  patches.suse/powerpc-pseries-iommu-LPAR-panics-during-boot-up-wit.patch
  (bsc#1222011 ltc#205900 CVE-2024-36926 bsc#1225829).
- Update patches.suse/pstore-platform-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52869 bsc#1225050).
- Update
  patches.suse/remoteproc-mediatek-Make-sure-IPI-buffer-fits-in-L2T.patch
  (git-fixes CVE-2024-36965 bsc#1226149).
- Update
  patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch
  (git-fixes CVE-2024-38601 bsc#1226876).
- Update
  patches.suse/s390-dasd-protect-device-queue-against-concurrent-access.patch
  (git-fixes bsc#1217481 CVE-2023-52774 bsc#1225572).
- Update
  patches.suse/scsi-hisi_sas-Set-debugfs_dir-pointer-to-NULL-after-removing-debugfs.patch
  (git-fixes CVE-2023-52808 bsc#1225555).
- Update
  patches.suse/scsi-ibmvfc-Remove-BUG_ON-in-the-case-of-an-empty-ev.patch
  (bsc#1209834 ltc#202097 CVE-2023-52811 bsc#1225559).
- Update
  patches.suse/scsi-libfc-Fix-potential-NULL-pointer-dereference-in-fc_lport_ptp_setup.patch
  (git-fixes CVE-2023-52809 bsc#1225556).
- Update
  patches.suse/scsi-lpfc-Move-NPIV-s-transport-unregistration-to-af.patch
  (bsc#1221777 CVE-2024-36952 bsc#1225898).
- Update
  patches.suse/scsi-lpfc-Release-hbalock-before-calling-lpfc_worker.patch
  (bsc#1221777 CVE-2024-36924 bsc#1225820).
- Update
  patches.suse/serial-max3100-Lock-port-lock-when-calling-uart_hand.patch
  (git-fixes CVE-2024-38634 bsc#1226868).
- Update
  patches.suse/serial-max3100-Update-uart_driver_registered-on-driv.patch
  (git-fixes CVE-2024-38633 bsc#1226867).
- Update
  patches.suse/soc-qcom-llcc-Handle-a-second-device-without-data-co.patch
  (git-fixes CVE-2023-52871 bsc#1225534).
- Update
  patches.suse/soundwire-cadence-fix-invalid-PDI-offset.patch
  (stable-fixes CVE-2024-38635 bsc#1226863).
- Update patches.suse/speakup-Fix-sizeof-vs-ARRAY_SIZE-bug.patch
  (git-fixes CVE-2024-38587 bsc#1226780).
- Update patches.suse/spi-Fix-null-dereference-on-suspend.patch
  (git-fixes CVE-2023-52749 bsc#1225476).
- Update
  patches.suse/thermal-core-prevent-potential-string-overflow.patch
  (git-fixes CVE-2023-52868 bsc#1225044).
- Update
  patches.suse/thermal-drivers-qcom-lmh-Check-for-SCM-availability-.patch
  (git-fixes CVE-2024-39466 bsc#1227089).
- Update
  patches.suse/thermal-drivers-tsens-Fix-null-pointer-dereference.patch
  (git-fixes CVE-2024-38571 bsc#1226737).
- Update
  patches.suse/thermal-intel-powerclamp-fix-mismatch-in-get-functio.patch
  (git-fixes CVE-2023-52794 bsc#1225028).
- Update
  patches.suse/tls-fix-NULL-deref-on-tls_sw_splice_eof-with-empty-r.patch
  (jsc#PED-6831 CVE-2023-52767 bsc#1224998).
- Update
  patches.suse/tpm_tis_spi-Account-for-SPI-header-when-allocating-T.patch
  (git-fixes CVE-2024-36477 bsc#1226840).
- Update
  patches.suse/tracing-Have-trace_event_file-have-ref-counters.patch
  (git-fixes CVE-2023-52879 bsc#1225101).
- Update
  patches.suse/tracing-trigger-Fix-to-return-error-if-failed-to-alloc-snapshot.patch
  (git-fixes CVE-2024-26920).
- Update
  patches.suse/tty-n_gsm-fix-race-condition-in-status-line-change-o.patch
  (git-fixes CVE-2023-52872 bsc#1225591).
- Update
  patches.suse/tty-n_gsm-require-CAP_NET_ADMIN-to-attach-N_GSM0710-.patch
  (bsc#1222619 CVE-2023-52880).
- Update
  patches.suse/tty-vcc-Add-check-for-kstrdup-in-vcc_probe.patch
  (git-fixes CVE-2023-52789 bsc#1225180).
- Update
  patches.suse/usb-config-fix-iteration-issue-in-usb_get_bos_descri.patch
  (git-fixes CVE-2023-52781 bsc#1225092).
- Update
  patches.suse/usb-dwc3-Wait-unconditionally-after-issuing-EndXfer-.patch
  (git-fixes CVE-2024-36977 bsc#1226513).
- Update
  patches.suse/usb-gadget-u_audio-Fix-race-condition-use-of-control.patch
  (git-fixes CVE-2024-38628 bsc#1226911).
- Update
  patches.suse/usb-storage-alauda-Check-whether-the-media-is-initia.patch
  (git-fixes CVE-2024-38619 bsc#1226861).
- Update
  patches.suse/usb-typec-tcpm-Fix-NULL-pointer-dereference-in-tcpm_.patch
  (git-fixes CVE-2023-52877 bsc#1224944).
- Update
  patches.suse/vhost-vdpa-fix-use-after-free-in-vhost_vdpa_probe.patch
  (jsc#PED-3311 CVE-2023-52795 bsc#1225085).
- Update
  patches.suse/virtio-blk-fix-implicit-overflow-on-virtio_max_dma_s.patch
  (git-fixes CVE-2023-52762 bsc#1225573).
- Update
  patches.suse/virtio-vsock-Fix-uninit-value-in-virtio_transport_re.patch
  (jsc#PED-5505 CVE-2023-52842 bsc#1225025).
- Update
  patches.suse/watchdog-cpu5wdt.c-Fix-use-after-free-bug-caused-by-.patch
  (git-fixes CVE-2024-38630 bsc#1226908).
- Update
  patches.suse/wifi-ar5523-enable-proper-endpoint-verification.patch
  (git-fixes CVE-2024-38565 bsc#1226747).
- Update
  patches.suse/wifi-ath11k-fix-dfs-radar-event-locking.patch
  (git-fixes CVE-2023-52798 bsc#1224947).
- Update
  patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch
  (git-fixes CVE-2023-52777 bsc#1224992).
- Update patches.suse/wifi-ath11k-fix-htt-pktlog-locking.patch
  (git-fixes CVE-2023-52800).
- Update
  patches.suse/wifi-ath12k-fix-dfs-radar-and-temperature-event-lock.patch
  (git-fixes CVE-2023-52776 bsc#1225090).
- Update
  patches.suse/wifi-ath12k-fix-htt-mlo-offset-event-locking.patch
  (git-fixes CVE-2023-52769 bsc#1225001).
- Update
  patches.suse/wifi-ath12k-fix-out-of-bound-access-of-qmi_invoke_ha.patch
  (git-fixes CVE-2024-38572 bsc#1226776).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-read-in-ath12k.patch
  (git-fixes CVE-2023-52827 bsc#1225078).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-write-in-ath12.patch
  (git-fixes CVE-2023-52829 bsc#1225081).
- Update
  patches.suse/wifi-brcmfmac-pcie-handle-randbuf-allocation-failure.patch
  (git-fixes CVE-2024-38575 bsc#1226612).
- Update
  patches.suse/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch
  (git-fixes CVE-2024-38567 bsc#1226769).
- Update
  patches.suse/wifi-carl9170-re-fix-fortified-memset-warning.patch
  (git-fixes CVE-2024-38616 bsc#1226852).
- Update
  patches.suse/wifi-mac80211-don-t-return-unset-power-in-ieee80211_.patch
  (git-fixes CVE-2023-52832 bsc#1225577).
- Update
  patches.suse/wifi-nl80211-Avoid-address-calculations-via-out-of-b.patch
  (git-fixes CVE-2024-38562 bsc#1226788).
- Update
  patches.suse/wifi-wilc1000-use-vmm_table-as-array-in-wilc-struct.patch
  (git-fixes CVE-2023-52768 bsc#1225004).
- Update
  patches.suse/x86-tdx-Zero-out-the-missing-RSI-in-TDX_HYPERCALL-macro.patch
  (jsc#PED-5824 CVE-2023-52874 bsc#1225049).
- commit 33efdc4</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835204">- tcp: Use refcount_inc_not_zero() in tcp_twsk_unique()
  (CVE-2024-36904 bsc#1225732).
- commit d578dcc</changelog>
  <changelog author="heming.zhao@suse.com" date="1719921600">- gfs2: Fix potential glock use-after-free on unmount (bsc#1226775
  CVE-2024-38570).
- gfs2: Rename sd_{ glock =&gt; kill }_wait (bsc#1226775
  CVE-2024-38570).
- commit f3adbca</changelog>
  <changelog author="tiwai@suse.de" date="1719921601">- Correct SCSI patch references (bsc#1225767 CVE-2024-36919 bsc#1226785 CVE-2024-38559)
- commit e8ea587</changelog>
  <changelog author="tiwai@suse.de" date="1719921602">- mtd: rawnand: rockchip: ensure NVDDR timings are rejected
  (git-fixes).
- mtd: rawnand: Bypass a couple of sanity checks during NAND
  identification (git-fixes).
- mtd: rawnand: Fix the nand_read_data_op() early check
  (git-fixes).
- mtd: rawnand: Ensure ECC configuration is propagated to upper
  layers (git-fixes).
- commit e545951</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1719921603">- kernel-doc: fix struct_group_tagged() parsing (git-fixes).
- commit e3a2a2e</changelog>
  <changelog author="fdmanana@suse.com" date="1719921604">- btrfs: fix crash on racing fsync and size-extending write into
  prealloc (bsc#1227101 CVE-2024-37354).
- commit 1d355af</changelog>
  <changelog author="vbabka@suse.cz" date="1719921605">- virt: acrn: stop using follow_pfn (CVE-2024-38610 bsc#1226758).
- commit c2ea51b</changelog>
  <changelog author="vbabka@suse.cz" date="1719921606">- drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
  (CVE-2024-38610 bsc#1226758).
- commit 7069ac2</changelog>
  <changelog author="rhopkins@suse.de" date="1719921607">- hsr: Prevent use after free in prp_create_tagged_frame()
  (CVE-2023-52846 bsc#1225098).
- commit cf63988</changelog>
  <changelog author="krisman@suse.de" date="1719921608">- io_uring: Fix io_cqring_wait() not restoring sigmask on
  get_timespec64() failure (git-fixes).
- commit e640a65</changelog>
  <changelog author="krisman@suse.de" date="1719921609">- io_uring: check for non-NULL file pointer in io_file_can_poll()
  (bsc#1226990 CVE-2024-39371).
- io_uring/io-wq: Use set_bit() and test_bit() at worker-&gt;flags
  (git-fixes).
- io_uring/sqpoll: work around a potential audit memory leak
  (git-fixes).
- commit 24603fc</changelog>
  <changelog author="krisman@suse.de" date="1719921610">- io_uring/rsrc: fix incorrect assignment of iter-&gt;nr_segs in
  io_import_fixed (git-fixes).
- io_uring/rsrc: don't lock while !TASK_RUNNING (git-fixes).
- io_uring/io-wq: avoid garbage value of 'match' in
  io_wq_enqueue() (git-fixes).
- commit 7d3e252</changelog>
</package>
<package pkgid="a8caff43a2e9e1d9359fd22a4a9ffc17a8988ebd76af217c65168400d6048602" name="cluster-md-kmp-default" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.17.1"/>
  <changelog author="tiwai@suse.de" date="1722081600">- auxdisplay: ht16k33: Drop reference after LED registration
  (git-fixes).
- ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
  on unprepare (git-fixes).
- ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
- ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
  reachable (git-fixes).
- ASoC: sof: amd: fix for firmware reload failure in Vangogh
  platform (git-fixes).
- ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
- ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
  (git-fixes).
- ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
- ALSA: ump: Don't update FB name for static blocks (git-fixes).
- drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
- drm/i915/gt: Do not consider preemption during execlists_dequeue
  for gen8 (git-fixes).
- drm/i915/dp: Don't switch the LTTPR mode on an active link
  (git-fixes).
- commit d7e2deb</changelog>
  <changelog author="tiwai@suse.de" date="1722081601">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
</package>
<package pkgid="73fb9b5a0176a4eab994828f0f68554740c75fa68a76ac8715500d281c109ba2" name="cluster-md-kmp-default" arch="ppc64le">
  <version epoch="0" ver="6.4.0" rel="150600.23.17.1"/>
  <changelog author="tiwai@suse.de" date="1722081600">- auxdisplay: ht16k33: Drop reference after LED registration
  (git-fixes).
- ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
  on unprepare (git-fixes).
- ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
- ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
  reachable (git-fixes).
- ASoC: sof: amd: fix for firmware reload failure in Vangogh
  platform (git-fixes).
- ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
- ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
  (git-fixes).
- ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
- ALSA: ump: Don't update FB name for static blocks (git-fixes).
- drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
- drm/i915/gt: Do not consider preemption during execlists_dequeue
  for gen8 (git-fixes).
- drm/i915/dp: Don't switch the LTTPR mode on an active link
  (git-fixes).
- commit d7e2deb</changelog>
  <changelog author="tiwai@suse.de" date="1722081601">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
</package>
<package pkgid="784084fe253ed347ff2c5f5e781a63c7cd52ad450538e6f842f507b06fe27d91" name="cluster-md-kmp-default" arch="s390x">
  <version epoch="0" ver="6.4.0" rel="150600.23.17.1"/>
  <changelog author="tiwai@suse.de" date="1722081600">- auxdisplay: ht16k33: Drop reference after LED registration
  (git-fixes).
- ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
  on unprepare (git-fixes).
- ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
- ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
  reachable (git-fixes).
- ASoC: sof: amd: fix for firmware reload failure in Vangogh
  platform (git-fixes).
- ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
- ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
  (git-fixes).
- ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
- ALSA: ump: Don't update FB name for static blocks (git-fixes).
- drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
- drm/i915/gt: Do not consider preemption during execlists_dequeue
  for gen8 (git-fixes).
- drm/i915/dp: Don't switch the LTTPR mode on an active link
  (git-fixes).
- commit d7e2deb</changelog>
  <changelog author="tiwai@suse.de" date="1722081601">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
</package>
<package pkgid="98378052350f54afa9566df5522c83259fab895c490735cbc73433008c7f77f2" name="cluster-md-kmp-default" arch="x86_64">
  <version epoch="0" ver="6.4.0" rel="150600.23.17.1"/>
  <changelog author="tiwai@suse.de" date="1722081600">- auxdisplay: ht16k33: Drop reference after LED registration
  (git-fixes).
- ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
  on unprepare (git-fixes).
- ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
- ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
  reachable (git-fixes).
- ASoC: sof: amd: fix for firmware reload failure in Vangogh
  platform (git-fixes).
- ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
- ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
  (git-fixes).
- ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
- ALSA: ump: Don't update FB name for static blocks (git-fixes).
- drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
- drm/i915/gt: Do not consider preemption during execlists_dequeue
  for gen8 (git-fixes).
- drm/i915/dp: Don't switch the LTTPR mode on an active link
  (git-fixes).
- commit d7e2deb</changelog>
  <changelog author="tiwai@suse.de" date="1722081601">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
</package>
<package pkgid="2053de1a29d5e28dec2663ac8fb834a20571e0086f119b69a21ecbb2915b416c" name="cluster-md-kmp-default" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.7.3"/>
  <changelog author="mkubecek@suse.cz" date="1717416000">- netfilter: nf_tables: release mutex after nft_gc_seq_end from
  abort path (CVE-2024-26925 bsc#1223390).
- commit 578a709</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717416001">- Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
  The L3 bsc#1225765 was created seperately since our customer requires
  PTF.
- Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
- Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
- Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
- Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
- commit 054635e</changelog>
  <changelog author="msuchanek@suse.de" date="1717416002">- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
- powerpc/uaccess: Fix build errors seen with GCC 13/14
  (bsc#1194869).
- commit 46b5d84</changelog>
  <changelog author="msuchanek@suse.de" date="1717416003">- blacklist.conf: PPC fsl_msi is not used
- commit ae6590d</changelog>
  <changelog author="msuchanek@suse.de" date="1717416004">- powerpc/pseries/lparcfg: drop error message from guest name
  lookup (bsc#1187716 ltc#193451 git-fixes).
- commit ceab637</changelog>
  <changelog author="mfranc@suse.cz" date="1717416005">- Update
  patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
  (git-fixes CVE-2024-36955).
- Update
  patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
  (git-fixes bsc#1225715 CVE-2024-36906).
- Update
  patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
  (git-fixes bsc#1225579 CVE-2024-36011).
- Update
  patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
  (git-fixes bsc#1225578 CVE-2024-36013).
- Update
  patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
  (git-fixes bsc#1225502 CVE-2024-36012).
- Update
  patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
  (git-fixes bsc#1225722 CVE-2024-36880).
- Update
  patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
  (git-fixes CVE-2024-36942).
- Update
  patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
  (git-fixes bsc#1225720 CVE-2024-36032).
- Update
  patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
  (git-fixes bsc#1223749 CVE-2024-26990).
- Update
  patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
  (git-fixes bsc#1223692 CVE-2024-26992).
- Update
  patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
  (stable-fixes CVE-2024-36944).
- Update
  patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
  (git-fixes bsc#1225734 CVE-2024-36896).
- Update
  patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
  (stable-fixes CVE-2024-36949).
- Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
  (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
- Update
  patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
  (git-fixes bsc#1225692 CVE-2023-52882).
- Update
  patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
  (git-fixes CVE-2024-26761).
- Update
  patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
  (stable-fixes bsc#1225735 CVE-2024-36897).
- Update
  patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
  (stable-fixes bsc#1225705 CVE-2024-36026).
- Update
  patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
  (stable-fixes CVE-2024-36951).
- Update
  patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
  (git-fixes bsc#1225593 CVE-2024-36014).
- Update
  patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
  (stable-fixes bsc#1225728 CVE-2024-36885).
- Update
  patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
  (git-fixes bsc#1225773 CVE-2024-36936).
- Update
  patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
  (stable-fixes CVE-2024-36950).
- Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
  (git-fixes bsc#1225736 CVE-2024-36898).
- Update
  patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
  (git-fixes bsc#1225698 CVE-2024-36020).
- Update
  patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
  (git-fixes bsc#1225710 CVE-2024-36891).
- Update
  patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
  (git-fixes bsc#1225714 CVE-2024-36890).
- Update
  patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
  (git-fixes bsc#1225708 CVE-2024-36029).
- Update
  patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
  (git-fixes bsc#1225699 CVE-2024-36021).
- Update
  patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
  (git-fixes CVE-2024-26943).
- Update
  patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
  (git-fixes bsc#1225694 CVE-2024-36018).
- Update
  patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
  (git-fixes CVE-2024-36940).
- Update
  patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
  (git-fixes CVE-2024-36959).
- Update
  patches.suse/ppdev-Add-an-error-check-in-register_device.patch
  (git-fixes bsc#1225640 CVE-2024-36015).
- Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
  CVE-2024-36947).
- Update
  patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
  (git-fixes bsc#1225695 CVE-2024-36019).
- Update
  patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
  (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
- Update
  patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
  (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
- Update
  patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
  (git-fixes bsc#1225704 CVE-2024-36025).
- Update
  patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
  (git-fixes CVE-2024-36930).
- Update
  patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
  (bsc#1224331 bsc#1224602 CVE-2024-35814).
- Update
  patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
  (git-fixes bsc#1225642 CVE-2024-36016).
- Update
  patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
  (git-fixes bsc#1225749 CVE-2024-36894).
- Update
  patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
  (git-fixes bsc#1225750 CVE-2024-36895).
- Update
  patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
  (git-fixes bsc#1225748 CVE-2024-36893).
- Update
  patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
  (stable-fixes bsc#1225769 CVE-2024-36921).
- Update
  patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
  (stable-fixes CVE-2024-36922).
- Update
  patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
  (git-fixes CVE-2024-36941).
- Update
  patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
  (git-fixes bsc#1224742 CVE-2024-35803).
- commit 539780f</changelog>
  <changelog author="dwagner@suse.de" date="1717416006">- nvmet: fix ns enable/disable possible hang (git-fixes).
- nvme-multipath: fix io accounting on failover (git-fixes).
- nvme: fix multipath batched completion accounting (git-fixes).
- commit ed3b392</changelog>
  <changelog author="dwagner@suse.de" date="1717416007">- scsi: lpfc: Copyright updates for 14.4.0.2 patches
  (bsc#1225842).
- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
  (bsc#1225842).
  Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
  (bsc#1225842).
- scsi: lpfc: Clear deferred RSCN processing flag when driver
  is unloading (bsc#1225842).
- scsi: lpfc: Update logging of protection type for T10 DIF I/O
  (bsc#1225842).
- scsi: lpfc: Change default logging level for unsolicited CT
  MIB commands (bsc#1225842).
- commit 5a56384</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416008">- smb: client: fix mount when dns_resolver key is not available
  (git-fixes, bsc#1225172).
- commit 28edb5c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416009">- cifs: fix leak of iface for primary channel (git-fixes,
  bsc#1225172).
- commit b7eb8e8</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416010">- Revert "cifs: reconnect work should have reference on server
  struct" (git-fixes, bsc#1225172).
- commit 3ca4c0c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416011">- smb: client: fix parsing of SMB3.1.1 POSIX create context
  (git-fixes, bsc#1225172).
- commit 5f27f69</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416012">- cifs: failure to add channel on iface should bump up weight
  (git-fixes, bsc#1225172).
- commit 007b237</changelog>
  <changelog author="tonyj@suse.de" date="1717416013">- perf/x86: Fix out of range data (git-fixes).
- perf/x86/intel/ds: Don't clear -&gt;pebs_data_cfg for the last
  PEBS event (git-fixes).
- perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
- commit 664d77f</changelog>
  <changelog author="dsterba@suse.com" date="1717588800">- blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
- Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
  Quoting bsc#1225945#c11:
  "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
  transaction for every subvol create")
  ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
  unwritten extent buffer after snapshotting a new subvolume") was never
  backported."
- commit d947258</changelog>
  <changelog author="tonyj@suse.de" date="1717588801">- perf pmu: Count sys and cpuid JSON events separately (git
  fixes).
- perf stat: Don't display metric header for non-leader uncore
  events (git-fixes).
- perf daemon: Fix file leak in daemon_session__control
  (git-fixes).
- perf symbols: Fix ownership of string in dso__load_vmlinux()
  (git-fixes).
- perf thread: Fixes to thread__new() related to initializing comm
  (git-fixes).
- perf report: Avoid SEGV in report__setup_sample_type()
  (git-fixes).
- perf ui browser: Don't save pointer to stack memory (git-fixes).
- perf bench internals inject-build-id: Fix trap divide when
  collecting just one DSO (git-fixes).
- perf intel-pt: Fix unassigned instruction op (discovered by
  MemorySanitizer) (git-fixes).
- perf test shell arm_coresight: Increase buffer size for
  Coresight basic tests (git-fixes).
- perf docs: Document bpf event modifier (git-fixes).
- perf bench uprobe: Remove lib64 from libc.so.6 binary path
  (git-fixes).
- perf record: Fix debug message placement for test consumption
  (git-fixes).
- perf tests: Apply attributes to all events in object code
  reading test (git-fixes).
- perf tests: Make "test data symbol" more robust on Neoverse N1
  (git-fixes).
- perf annotate: Fix annotation_calc_lines() to pass correct
  address to get_srcline() (git-fixes).
- perf stat: Do not fail on metrics on s390 z/VM systems
  (git-fixes).
- perf sched timehist: Fix -g/--call-graph option failure
  (git-fixes).
- perf annotate: Get rid of duplicate --group option item
  (git-fixes).
- perf probe: Add missing libgen.h header needed for using
  basename() (git-fixes).
- perf record: Delete session after stopping sideband thread
  (git-fixes).
- perf auxtrace: Fix multiple use of --itrace option (git-fixes).
- perf script: Show also errors for --insn-trace option
  (git-fixes).
- perf lock contention: Add a missing NULL check (git-fixes).
- perf vendor events amd: Fix Zen 4 cache latency events
  (git-fixes).
- libperf evlist: Avoid out-of-bounds access (git-fixes).
- perf pmu: Fix a potential memory leak in perf_pmu__lookup()
  (git-fixes).
- perf print-events: make is_event_supported() more robust
  (git-fixes).
- perf list: fix short description for some cache events
  (git-fixes).
- perf metric: Don't remove scale from counts (git-fixes).
- perf stat: Avoid metric-only segv (git-fixes).
- perf expr: Fix "has_event" function for metric style events
  (git-fixes).
- perf srcline: Add missed addr2line closes (git-fixes).
- perf thread_map: Free strlist on normal path in
  thread_map__new_by_tid_str() (git-fixes).
- perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
- perf jevents: Drop or simplify small integer values (git-fixes).
- perf evsel: Fix duplicate initialization of data-&gt;id in
  evsel__parse_sample() (git-fixes).
- perf pmu: Treat the msr pmu as software (git-fixes).
- perf record: Check conflict between '--timestamp-filename'
  option and pipe mode before recording (git-fixes).
- perf record: Fix possible incorrect free in
  record__switch_output() (git-fixes).
- perf vendor events amd: Add Zen 4 memory controller events
  (git-fixes).
- perf top: Uniform the event name for the hybrid machine
  (git-fixes).
- perf top: Use evsel's cpus to replace user_requested_cpus
  (git-fixes).
- commit a1f9340</changelog>
  <changelog author="tonyj@suse.de" date="1717675200">- perf ui browser: Avoid SEGV on title (git fixes).
- commit 1578c22</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675201">- inet: inet_defrag: prevent sk release while still in use
  (CVE-2024-26921 bsc#1223138).
- commit 2016faf</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675202">- net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
- commit 7bf5961</changelog>
  <changelog author="tiwai@suse.de" date="1718366400">- Temporarily drop KVM patch that caused a regression (bsc#1226158)
  Delete patches.suse/KVM-x86-pmu-Prioritize-VMX-interception-over-GP-on-R.patch
- commit 33f31da</changelog>
</package>
<package pkgid="09894bd4f0b0d0cfaa6b0fa6326756f67122973d4e25e8fb387347509f29e75f" name="cluster-md-kmp-default" arch="ppc64le">
  <version epoch="0" ver="6.4.0" rel="150600.23.7.3"/>
  <changelog author="mkubecek@suse.cz" date="1717416000">- netfilter: nf_tables: release mutex after nft_gc_seq_end from
  abort path (CVE-2024-26925 bsc#1223390).
- commit 578a709</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717416001">- Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
  The L3 bsc#1225765 was created seperately since our customer requires
  PTF.
- Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
- Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
- Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
- Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
- commit 054635e</changelog>
  <changelog author="msuchanek@suse.de" date="1717416002">- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
- powerpc/uaccess: Fix build errors seen with GCC 13/14
  (bsc#1194869).
- commit 46b5d84</changelog>
  <changelog author="msuchanek@suse.de" date="1717416003">- blacklist.conf: PPC fsl_msi is not used
- commit ae6590d</changelog>
  <changelog author="msuchanek@suse.de" date="1717416004">- powerpc/pseries/lparcfg: drop error message from guest name
  lookup (bsc#1187716 ltc#193451 git-fixes).
- commit ceab637</changelog>
  <changelog author="mfranc@suse.cz" date="1717416005">- Update
  patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
  (git-fixes CVE-2024-36955).
- Update
  patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
  (git-fixes bsc#1225715 CVE-2024-36906).
- Update
  patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
  (git-fixes bsc#1225579 CVE-2024-36011).
- Update
  patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
  (git-fixes bsc#1225578 CVE-2024-36013).
- Update
  patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
  (git-fixes bsc#1225502 CVE-2024-36012).
- Update
  patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
  (git-fixes bsc#1225722 CVE-2024-36880).
- Update
  patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
  (git-fixes CVE-2024-36942).
- Update
  patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
  (git-fixes bsc#1225720 CVE-2024-36032).
- Update
  patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
  (git-fixes bsc#1223749 CVE-2024-26990).
- Update
  patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
  (git-fixes bsc#1223692 CVE-2024-26992).
- Update
  patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
  (stable-fixes CVE-2024-36944).
- Update
  patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
  (git-fixes bsc#1225734 CVE-2024-36896).
- Update
  patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
  (stable-fixes CVE-2024-36949).
- Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
  (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
- Update
  patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
  (git-fixes bsc#1225692 CVE-2023-52882).
- Update
  patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
  (git-fixes CVE-2024-26761).
- Update
  patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
  (stable-fixes bsc#1225735 CVE-2024-36897).
- Update
  patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
  (stable-fixes bsc#1225705 CVE-2024-36026).
- Update
  patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
  (stable-fixes CVE-2024-36951).
- Update
  patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
  (git-fixes bsc#1225593 CVE-2024-36014).
- Update
  patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
  (stable-fixes bsc#1225728 CVE-2024-36885).
- Update
  patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
  (git-fixes bsc#1225773 CVE-2024-36936).
- Update
  patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
  (stable-fixes CVE-2024-36950).
- Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
  (git-fixes bsc#1225736 CVE-2024-36898).
- Update
  patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
  (git-fixes bsc#1225698 CVE-2024-36020).
- Update
  patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
  (git-fixes bsc#1225710 CVE-2024-36891).
- Update
  patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
  (git-fixes bsc#1225714 CVE-2024-36890).
- Update
  patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
  (git-fixes bsc#1225708 CVE-2024-36029).
- Update
  patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
  (git-fixes bsc#1225699 CVE-2024-36021).
- Update
  patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
  (git-fixes CVE-2024-26943).
- Update
  patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
  (git-fixes bsc#1225694 CVE-2024-36018).
- Update
  patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
  (git-fixes CVE-2024-36940).
- Update
  patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
  (git-fixes CVE-2024-36959).
- Update
  patches.suse/ppdev-Add-an-error-check-in-register_device.patch
  (git-fixes bsc#1225640 CVE-2024-36015).
- Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
  CVE-2024-36947).
- Update
  patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
  (git-fixes bsc#1225695 CVE-2024-36019).
- Update
  patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
  (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
- Update
  patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
  (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
- Update
  patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
  (git-fixes bsc#1225704 CVE-2024-36025).
- Update
  patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
  (git-fixes CVE-2024-36930).
- Update
  patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
  (bsc#1224331 bsc#1224602 CVE-2024-35814).
- Update
  patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
  (git-fixes bsc#1225642 CVE-2024-36016).
- Update
  patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
  (git-fixes bsc#1225749 CVE-2024-36894).
- Update
  patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
  (git-fixes bsc#1225750 CVE-2024-36895).
- Update
  patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
  (git-fixes bsc#1225748 CVE-2024-36893).
- Update
  patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
  (stable-fixes bsc#1225769 CVE-2024-36921).
- Update
  patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
  (stable-fixes CVE-2024-36922).
- Update
  patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
  (git-fixes CVE-2024-36941).
- Update
  patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
  (git-fixes bsc#1224742 CVE-2024-35803).
- commit 539780f</changelog>
  <changelog author="dwagner@suse.de" date="1717416006">- nvmet: fix ns enable/disable possible hang (git-fixes).
- nvme-multipath: fix io accounting on failover (git-fixes).
- nvme: fix multipath batched completion accounting (git-fixes).
- commit ed3b392</changelog>
  <changelog author="dwagner@suse.de" date="1717416007">- scsi: lpfc: Copyright updates for 14.4.0.2 patches
  (bsc#1225842).
- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
  (bsc#1225842).
  Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
  (bsc#1225842).
- scsi: lpfc: Clear deferred RSCN processing flag when driver
  is unloading (bsc#1225842).
- scsi: lpfc: Update logging of protection type for T10 DIF I/O
  (bsc#1225842).
- scsi: lpfc: Change default logging level for unsolicited CT
  MIB commands (bsc#1225842).
- commit 5a56384</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416008">- smb: client: fix mount when dns_resolver key is not available
  (git-fixes, bsc#1225172).
- commit 28edb5c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416009">- cifs: fix leak of iface for primary channel (git-fixes,
  bsc#1225172).
- commit b7eb8e8</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416010">- Revert "cifs: reconnect work should have reference on server
  struct" (git-fixes, bsc#1225172).
- commit 3ca4c0c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416011">- smb: client: fix parsing of SMB3.1.1 POSIX create context
  (git-fixes, bsc#1225172).
- commit 5f27f69</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416012">- cifs: failure to add channel on iface should bump up weight
  (git-fixes, bsc#1225172).
- commit 007b237</changelog>
  <changelog author="tonyj@suse.de" date="1717416013">- perf/x86: Fix out of range data (git-fixes).
- perf/x86/intel/ds: Don't clear -&gt;pebs_data_cfg for the last
  PEBS event (git-fixes).
- perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
- commit 664d77f</changelog>
  <changelog author="dsterba@suse.com" date="1717588800">- blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
- Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
  Quoting bsc#1225945#c11:
  "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
  transaction for every subvol create")
  ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
  unwritten extent buffer after snapshotting a new subvolume") was never
  backported."
- commit d947258</changelog>
  <changelog author="tonyj@suse.de" date="1717588801">- perf pmu: Count sys and cpuid JSON events separately (git
  fixes).
- perf stat: Don't display metric header for non-leader uncore
  events (git-fixes).
- perf daemon: Fix file leak in daemon_session__control
  (git-fixes).
- perf symbols: Fix ownership of string in dso__load_vmlinux()
  (git-fixes).
- perf thread: Fixes to thread__new() related to initializing comm
  (git-fixes).
- perf report: Avoid SEGV in report__setup_sample_type()
  (git-fixes).
- perf ui browser: Don't save pointer to stack memory (git-fixes).
- perf bench internals inject-build-id: Fix trap divide when
  collecting just one DSO (git-fixes).
- perf intel-pt: Fix unassigned instruction op (discovered by
  MemorySanitizer) (git-fixes).
- perf test shell arm_coresight: Increase buffer size for
  Coresight basic tests (git-fixes).
- perf docs: Document bpf event modifier (git-fixes).
- perf bench uprobe: Remove lib64 from libc.so.6 binary path
  (git-fixes).
- perf record: Fix debug message placement for test consumption
  (git-fixes).
- perf tests: Apply attributes to all events in object code
  reading test (git-fixes).
- perf tests: Make "test data symbol" more robust on Neoverse N1
  (git-fixes).
- perf annotate: Fix annotation_calc_lines() to pass correct
  address to get_srcline() (git-fixes).
- perf stat: Do not fail on metrics on s390 z/VM systems
  (git-fixes).
- perf sched timehist: Fix -g/--call-graph option failure
  (git-fixes).
- perf annotate: Get rid of duplicate --group option item
  (git-fixes).
- perf probe: Add missing libgen.h header needed for using
  basename() (git-fixes).
- perf record: Delete session after stopping sideband thread
  (git-fixes).
- perf auxtrace: Fix multiple use of --itrace option (git-fixes).
- perf script: Show also errors for --insn-trace option
  (git-fixes).
- perf lock contention: Add a missing NULL check (git-fixes).
- perf vendor events amd: Fix Zen 4 cache latency events
  (git-fixes).
- libperf evlist: Avoid out-of-bounds access (git-fixes).
- perf pmu: Fix a potential memory leak in perf_pmu__lookup()
  (git-fixes).
- perf print-events: make is_event_supported() more robust
  (git-fixes).
- perf list: fix short description for some cache events
  (git-fixes).
- perf metric: Don't remove scale from counts (git-fixes).
- perf stat: Avoid metric-only segv (git-fixes).
- perf expr: Fix "has_event" function for metric style events
  (git-fixes).
- perf srcline: Add missed addr2line closes (git-fixes).
- perf thread_map: Free strlist on normal path in
  thread_map__new_by_tid_str() (git-fixes).
- perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
- perf jevents: Drop or simplify small integer values (git-fixes).
- perf evsel: Fix duplicate initialization of data-&gt;id in
  evsel__parse_sample() (git-fixes).
- perf pmu: Treat the msr pmu as software (git-fixes).
- perf record: Check conflict between '--timestamp-filename'
  option and pipe mode before recording (git-fixes).
- perf record: Fix possible incorrect free in
  record__switch_output() (git-fixes).
- perf vendor events amd: Add Zen 4 memory controller events
  (git-fixes).
- perf top: Uniform the event name for the hybrid machine
  (git-fixes).
- perf top: Use evsel's cpus to replace user_requested_cpus
  (git-fixes).
- commit a1f9340</changelog>
  <changelog author="tonyj@suse.de" date="1717675200">- perf ui browser: Avoid SEGV on title (git fixes).
- commit 1578c22</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675201">- inet: inet_defrag: prevent sk release while still in use
  (CVE-2024-26921 bsc#1223138).
- commit 2016faf</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675202">- net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
- commit 7bf5961</changelog>
  <changelog author="tiwai@suse.de" date="1718366400">- Temporarily drop KVM patch that caused a regression (bsc#1226158)
  Delete patches.suse/KVM-x86-pmu-Prioritize-VMX-interception-over-GP-on-R.patch
- commit 33f31da</changelog>
</package>
<package pkgid="8d33030930afc040d469c3a62c810f31aac4a0faca01cae26a4dbd5d728323bc" name="cluster-md-kmp-default" arch="s390x">
  <version epoch="0" ver="6.4.0" rel="150600.23.7.3"/>
  <changelog author="mkubecek@suse.cz" date="1717416000">- netfilter: nf_tables: release mutex after nft_gc_seq_end from
  abort path (CVE-2024-26925 bsc#1223390).
- commit 578a709</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717416001">- Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
  The L3 bsc#1225765 was created seperately since our customer requires
  PTF.
- Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
- Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
- Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
- Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
- commit 054635e</changelog>
  <changelog author="msuchanek@suse.de" date="1717416002">- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
- powerpc/uaccess: Fix build errors seen with GCC 13/14
  (bsc#1194869).
- commit 46b5d84</changelog>
  <changelog author="msuchanek@suse.de" date="1717416003">- blacklist.conf: PPC fsl_msi is not used
- commit ae6590d</changelog>
  <changelog author="msuchanek@suse.de" date="1717416004">- powerpc/pseries/lparcfg: drop error message from guest name
  lookup (bsc#1187716 ltc#193451 git-fixes).
- commit ceab637</changelog>
  <changelog author="mfranc@suse.cz" date="1717416005">- Update
  patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
  (git-fixes CVE-2024-36955).
- Update
  patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
  (git-fixes bsc#1225715 CVE-2024-36906).
- Update
  patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
  (git-fixes bsc#1225579 CVE-2024-36011).
- Update
  patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
  (git-fixes bsc#1225578 CVE-2024-36013).
- Update
  patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
  (git-fixes bsc#1225502 CVE-2024-36012).
- Update
  patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
  (git-fixes bsc#1225722 CVE-2024-36880).
- Update
  patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
  (git-fixes CVE-2024-36942).
- Update
  patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
  (git-fixes bsc#1225720 CVE-2024-36032).
- Update
  patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
  (git-fixes bsc#1223749 CVE-2024-26990).
- Update
  patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
  (git-fixes bsc#1223692 CVE-2024-26992).
- Update
  patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
  (stable-fixes CVE-2024-36944).
- Update
  patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
  (git-fixes bsc#1225734 CVE-2024-36896).
- Update
  patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
  (stable-fixes CVE-2024-36949).
- Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
  (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
- Update
  patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
  (git-fixes bsc#1225692 CVE-2023-52882).
- Update
  patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
  (git-fixes CVE-2024-26761).
- Update
  patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
  (stable-fixes bsc#1225735 CVE-2024-36897).
- Update
  patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
  (stable-fixes bsc#1225705 CVE-2024-36026).
- Update
  patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
  (stable-fixes CVE-2024-36951).
- Update
  patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
  (git-fixes bsc#1225593 CVE-2024-36014).
- Update
  patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
  (stable-fixes bsc#1225728 CVE-2024-36885).
- Update
  patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
  (git-fixes bsc#1225773 CVE-2024-36936).
- Update
  patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
  (stable-fixes CVE-2024-36950).
- Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
  (git-fixes bsc#1225736 CVE-2024-36898).
- Update
  patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
  (git-fixes bsc#1225698 CVE-2024-36020).
- Update
  patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
  (git-fixes bsc#1225710 CVE-2024-36891).
- Update
  patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
  (git-fixes bsc#1225714 CVE-2024-36890).
- Update
  patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
  (git-fixes bsc#1225708 CVE-2024-36029).
- Update
  patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
  (git-fixes bsc#1225699 CVE-2024-36021).
- Update
  patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
  (git-fixes CVE-2024-26943).
- Update
  patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
  (git-fixes bsc#1225694 CVE-2024-36018).
- Update
  patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
  (git-fixes CVE-2024-36940).
- Update
  patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
  (git-fixes CVE-2024-36959).
- Update
  patches.suse/ppdev-Add-an-error-check-in-register_device.patch
  (git-fixes bsc#1225640 CVE-2024-36015).
- Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
  CVE-2024-36947).
- Update
  patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
  (git-fixes bsc#1225695 CVE-2024-36019).
- Update
  patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
  (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
- Update
  patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
  (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
- Update
  patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
  (git-fixes bsc#1225704 CVE-2024-36025).
- Update
  patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
  (git-fixes CVE-2024-36930).
- Update
  patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
  (bsc#1224331 bsc#1224602 CVE-2024-35814).
- Update
  patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
  (git-fixes bsc#1225642 CVE-2024-36016).
- Update
  patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
  (git-fixes bsc#1225749 CVE-2024-36894).
- Update
  patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
  (git-fixes bsc#1225750 CVE-2024-36895).
- Update
  patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
  (git-fixes bsc#1225748 CVE-2024-36893).
- Update
  patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
  (stable-fixes bsc#1225769 CVE-2024-36921).
- Update
  patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
  (stable-fixes CVE-2024-36922).
- Update
  patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
  (git-fixes CVE-2024-36941).
- Update
  patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
  (git-fixes bsc#1224742 CVE-2024-35803).
- commit 539780f</changelog>
  <changelog author="dwagner@suse.de" date="1717416006">- nvmet: fix ns enable/disable possible hang (git-fixes).
- nvme-multipath: fix io accounting on failover (git-fixes).
- nvme: fix multipath batched completion accounting (git-fixes).
- commit ed3b392</changelog>
  <changelog author="dwagner@suse.de" date="1717416007">- scsi: lpfc: Copyright updates for 14.4.0.2 patches
  (bsc#1225842).
- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
  (bsc#1225842).
  Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
  (bsc#1225842).
- scsi: lpfc: Clear deferred RSCN processing flag when driver
  is unloading (bsc#1225842).
- scsi: lpfc: Update logging of protection type for T10 DIF I/O
  (bsc#1225842).
- scsi: lpfc: Change default logging level for unsolicited CT
  MIB commands (bsc#1225842).
- commit 5a56384</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416008">- smb: client: fix mount when dns_resolver key is not available
  (git-fixes, bsc#1225172).
- commit 28edb5c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416009">- cifs: fix leak of iface for primary channel (git-fixes,
  bsc#1225172).
- commit b7eb8e8</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416010">- Revert "cifs: reconnect work should have reference on server
  struct" (git-fixes, bsc#1225172).
- commit 3ca4c0c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416011">- smb: client: fix parsing of SMB3.1.1 POSIX create context
  (git-fixes, bsc#1225172).
- commit 5f27f69</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416012">- cifs: failure to add channel on iface should bump up weight
  (git-fixes, bsc#1225172).
- commit 007b237</changelog>
  <changelog author="tonyj@suse.de" date="1717416013">- perf/x86: Fix out of range data (git-fixes).
- perf/x86/intel/ds: Don't clear -&gt;pebs_data_cfg for the last
  PEBS event (git-fixes).
- perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
- commit 664d77f</changelog>
  <changelog author="dsterba@suse.com" date="1717588800">- blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
- Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
  Quoting bsc#1225945#c11:
  "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
  transaction for every subvol create")
  ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
  unwritten extent buffer after snapshotting a new subvolume") was never
  backported."
- commit d947258</changelog>
  <changelog author="tonyj@suse.de" date="1717588801">- perf pmu: Count sys and cpuid JSON events separately (git
  fixes).
- perf stat: Don't display metric header for non-leader uncore
  events (git-fixes).
- perf daemon: Fix file leak in daemon_session__control
  (git-fixes).
- perf symbols: Fix ownership of string in dso__load_vmlinux()
  (git-fixes).
- perf thread: Fixes to thread__new() related to initializing comm
  (git-fixes).
- perf report: Avoid SEGV in report__setup_sample_type()
  (git-fixes).
- perf ui browser: Don't save pointer to stack memory (git-fixes).
- perf bench internals inject-build-id: Fix trap divide when
  collecting just one DSO (git-fixes).
- perf intel-pt: Fix unassigned instruction op (discovered by
  MemorySanitizer) (git-fixes).
- perf test shell arm_coresight: Increase buffer size for
  Coresight basic tests (git-fixes).
- perf docs: Document bpf event modifier (git-fixes).
- perf bench uprobe: Remove lib64 from libc.so.6 binary path
  (git-fixes).
- perf record: Fix debug message placement for test consumption
  (git-fixes).
- perf tests: Apply attributes to all events in object code
  reading test (git-fixes).
- perf tests: Make "test data symbol" more robust on Neoverse N1
  (git-fixes).
- perf annotate: Fix annotation_calc_lines() to pass correct
  address to get_srcline() (git-fixes).
- perf stat: Do not fail on metrics on s390 z/VM systems
  (git-fixes).
- perf sched timehist: Fix -g/--call-graph option failure
  (git-fixes).
- perf annotate: Get rid of duplicate --group option item
  (git-fixes).
- perf probe: Add missing libgen.h header needed for using
  basename() (git-fixes).
- perf record: Delete session after stopping sideband thread
  (git-fixes).
- perf auxtrace: Fix multiple use of --itrace option (git-fixes).
- perf script: Show also errors for --insn-trace option
  (git-fixes).
- perf lock contention: Add a missing NULL check (git-fixes).
- perf vendor events amd: Fix Zen 4 cache latency events
  (git-fixes).
- libperf evlist: Avoid out-of-bounds access (git-fixes).
- perf pmu: Fix a potential memory leak in perf_pmu__lookup()
  (git-fixes).
- perf print-events: make is_event_supported() more robust
  (git-fixes).
- perf list: fix short description for some cache events
  (git-fixes).
- perf metric: Don't remove scale from counts (git-fixes).
- perf stat: Avoid metric-only segv (git-fixes).
- perf expr: Fix "has_event" function for metric style events
  (git-fixes).
- perf srcline: Add missed addr2line closes (git-fixes).
- perf thread_map: Free strlist on normal path in
  thread_map__new_by_tid_str() (git-fixes).
- perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
- perf jevents: Drop or simplify small integer values (git-fixes).
- perf evsel: Fix duplicate initialization of data-&gt;id in
  evsel__parse_sample() (git-fixes).
- perf pmu: Treat the msr pmu as software (git-fixes).
- perf record: Check conflict between '--timestamp-filename'
  option and pipe mode before recording (git-fixes).
- perf record: Fix possible incorrect free in
  record__switch_output() (git-fixes).
- perf vendor events amd: Add Zen 4 memory controller events
  (git-fixes).
- perf top: Uniform the event name for the hybrid machine
  (git-fixes).
- perf top: Use evsel's cpus to replace user_requested_cpus
  (git-fixes).
- commit a1f9340</changelog>
  <changelog author="tonyj@suse.de" date="1717675200">- perf ui browser: Avoid SEGV on title (git fixes).
- commit 1578c22</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675201">- inet: inet_defrag: prevent sk release while still in use
  (CVE-2024-26921 bsc#1223138).
- commit 2016faf</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675202">- net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
- commit 7bf5961</changelog>
  <changelog author="tiwai@suse.de" date="1718366400">- Temporarily drop KVM patch that caused a regression (bsc#1226158)
  Delete patches.suse/KVM-x86-pmu-Prioritize-VMX-interception-over-GP-on-R.patch
- commit 33f31da</changelog>
</package>
<package pkgid="89a8f01b3def4051ef9d4fba553880b7bb82a6fa4739b6b9c188d3090f9a06ec" name="cluster-md-kmp-default" arch="x86_64">
  <version epoch="0" ver="6.4.0" rel="150600.23.7.3"/>
  <changelog author="mkubecek@suse.cz" date="1717416000">- netfilter: nf_tables: release mutex after nft_gc_seq_end from
  abort path (CVE-2024-26925 bsc#1223390).
- commit 578a709</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717416001">- Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
  The L3 bsc#1225765 was created seperately since our customer requires
  PTF.
- Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
- Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
- Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
- Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
- commit 054635e</changelog>
  <changelog author="msuchanek@suse.de" date="1717416002">- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
- powerpc/uaccess: Fix build errors seen with GCC 13/14
  (bsc#1194869).
- commit 46b5d84</changelog>
  <changelog author="msuchanek@suse.de" date="1717416003">- blacklist.conf: PPC fsl_msi is not used
- commit ae6590d</changelog>
  <changelog author="msuchanek@suse.de" date="1717416004">- powerpc/pseries/lparcfg: drop error message from guest name
  lookup (bsc#1187716 ltc#193451 git-fixes).
- commit ceab637</changelog>
  <changelog author="mfranc@suse.cz" date="1717416005">- Update
  patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
  (git-fixes CVE-2024-36955).
- Update
  patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
  (git-fixes bsc#1225715 CVE-2024-36906).
- Update
  patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
  (git-fixes bsc#1225579 CVE-2024-36011).
- Update
  patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
  (git-fixes bsc#1225578 CVE-2024-36013).
- Update
  patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
  (git-fixes bsc#1225502 CVE-2024-36012).
- Update
  patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
  (git-fixes bsc#1225722 CVE-2024-36880).
- Update
  patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
  (git-fixes CVE-2024-36942).
- Update
  patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
  (git-fixes bsc#1225720 CVE-2024-36032).
- Update
  patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
  (git-fixes bsc#1223749 CVE-2024-26990).
- Update
  patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
  (git-fixes bsc#1223692 CVE-2024-26992).
- Update
  patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
  (stable-fixes CVE-2024-36944).
- Update
  patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
  (git-fixes bsc#1225734 CVE-2024-36896).
- Update
  patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
  (stable-fixes CVE-2024-36949).
- Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
  (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
- Update
  patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
  (git-fixes bsc#1225692 CVE-2023-52882).
- Update
  patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
  (git-fixes CVE-2024-26761).
- Update
  patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
  (stable-fixes bsc#1225735 CVE-2024-36897).
- Update
  patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
  (stable-fixes bsc#1225705 CVE-2024-36026).
- Update
  patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
  (stable-fixes CVE-2024-36951).
- Update
  patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
  (git-fixes bsc#1225593 CVE-2024-36014).
- Update
  patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
  (stable-fixes bsc#1225728 CVE-2024-36885).
- Update
  patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
  (git-fixes bsc#1225773 CVE-2024-36936).
- Update
  patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
  (stable-fixes CVE-2024-36950).
- Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
  (git-fixes bsc#1225736 CVE-2024-36898).
- Update
  patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
  (git-fixes bsc#1225698 CVE-2024-36020).
- Update
  patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
  (git-fixes bsc#1225710 CVE-2024-36891).
- Update
  patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
  (git-fixes bsc#1225714 CVE-2024-36890).
- Update
  patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
  (git-fixes bsc#1225708 CVE-2024-36029).
- Update
  patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
  (git-fixes bsc#1225699 CVE-2024-36021).
- Update
  patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
  (git-fixes CVE-2024-26943).
- Update
  patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
  (git-fixes bsc#1225694 CVE-2024-36018).
- Update
  patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
  (git-fixes CVE-2024-36940).
- Update
  patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
  (git-fixes CVE-2024-36959).
- Update
  patches.suse/ppdev-Add-an-error-check-in-register_device.patch
  (git-fixes bsc#1225640 CVE-2024-36015).
- Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
  CVE-2024-36947).
- Update
  patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
  (git-fixes bsc#1225695 CVE-2024-36019).
- Update
  patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
  (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
- Update
  patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
  (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
- Update
  patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
  (git-fixes bsc#1225704 CVE-2024-36025).
- Update
  patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
  (git-fixes CVE-2024-36930).
- Update
  patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
  (bsc#1224331 bsc#1224602 CVE-2024-35814).
- Update
  patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
  (git-fixes bsc#1225642 CVE-2024-36016).
- Update
  patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
  (git-fixes bsc#1225749 CVE-2024-36894).
- Update
  patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
  (git-fixes bsc#1225750 CVE-2024-36895).
- Update
  patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
  (git-fixes bsc#1225748 CVE-2024-36893).
- Update
  patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
  (stable-fixes bsc#1225769 CVE-2024-36921).
- Update
  patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
  (stable-fixes CVE-2024-36922).
- Update
  patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
  (git-fixes CVE-2024-36941).
- Update
  patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
  (git-fixes bsc#1224742 CVE-2024-35803).
- commit 539780f</changelog>
  <changelog author="dwagner@suse.de" date="1717416006">- nvmet: fix ns enable/disable possible hang (git-fixes).
- nvme-multipath: fix io accounting on failover (git-fixes).
- nvme: fix multipath batched completion accounting (git-fixes).
- commit ed3b392</changelog>
  <changelog author="dwagner@suse.de" date="1717416007">- scsi: lpfc: Copyright updates for 14.4.0.2 patches
  (bsc#1225842).
- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
  (bsc#1225842).
  Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
  (bsc#1225842).
- scsi: lpfc: Clear deferred RSCN processing flag when driver
  is unloading (bsc#1225842).
- scsi: lpfc: Update logging of protection type for T10 DIF I/O
  (bsc#1225842).
- scsi: lpfc: Change default logging level for unsolicited CT
  MIB commands (bsc#1225842).
- commit 5a56384</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416008">- smb: client: fix mount when dns_resolver key is not available
  (git-fixes, bsc#1225172).
- commit 28edb5c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416009">- cifs: fix leak of iface for primary channel (git-fixes,
  bsc#1225172).
- commit b7eb8e8</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416010">- Revert "cifs: reconnect work should have reference on server
  struct" (git-fixes, bsc#1225172).
- commit 3ca4c0c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416011">- smb: client: fix parsing of SMB3.1.1 POSIX create context
  (git-fixes, bsc#1225172).
- commit 5f27f69</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416012">- cifs: failure to add channel on iface should bump up weight
  (git-fixes, bsc#1225172).
- commit 007b237</changelog>
  <changelog author="tonyj@suse.de" date="1717416013">- perf/x86: Fix out of range data (git-fixes).
- perf/x86/intel/ds: Don't clear -&gt;pebs_data_cfg for the last
  PEBS event (git-fixes).
- perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
- commit 664d77f</changelog>
  <changelog author="dsterba@suse.com" date="1717588800">- blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
- Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
  Quoting bsc#1225945#c11:
  "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
  transaction for every subvol create")
  ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
  unwritten extent buffer after snapshotting a new subvolume") was never
  backported."
- commit d947258</changelog>
  <changelog author="tonyj@suse.de" date="1717588801">- perf pmu: Count sys and cpuid JSON events separately (git
  fixes).
- perf stat: Don't display metric header for non-leader uncore
  events (git-fixes).
- perf daemon: Fix file leak in daemon_session__control
  (git-fixes).
- perf symbols: Fix ownership of string in dso__load_vmlinux()
  (git-fixes).
- perf thread: Fixes to thread__new() related to initializing comm
  (git-fixes).
- perf report: Avoid SEGV in report__setup_sample_type()
  (git-fixes).
- perf ui browser: Don't save pointer to stack memory (git-fixes).
- perf bench internals inject-build-id: Fix trap divide when
  collecting just one DSO (git-fixes).
- perf intel-pt: Fix unassigned instruction op (discovered by
  MemorySanitizer) (git-fixes).
- perf test shell arm_coresight: Increase buffer size for
  Coresight basic tests (git-fixes).
- perf docs: Document bpf event modifier (git-fixes).
- perf bench uprobe: Remove lib64 from libc.so.6 binary path
  (git-fixes).
- perf record: Fix debug message placement for test consumption
  (git-fixes).
- perf tests: Apply attributes to all events in object code
  reading test (git-fixes).
- perf tests: Make "test data symbol" more robust on Neoverse N1
  (git-fixes).
- perf annotate: Fix annotation_calc_lines() to pass correct
  address to get_srcline() (git-fixes).
- perf stat: Do not fail on metrics on s390 z/VM systems
  (git-fixes).
- perf sched timehist: Fix -g/--call-graph option failure
  (git-fixes).
- perf annotate: Get rid of duplicate --group option item
  (git-fixes).
- perf probe: Add missing libgen.h header needed for using
  basename() (git-fixes).
- perf record: Delete session after stopping sideband thread
  (git-fixes).
- perf auxtrace: Fix multiple use of --itrace option (git-fixes).
- perf script: Show also errors for --insn-trace option
  (git-fixes).
- perf lock contention: Add a missing NULL check (git-fixes).
- perf vendor events amd: Fix Zen 4 cache latency events
  (git-fixes).
- libperf evlist: Avoid out-of-bounds access (git-fixes).
- perf pmu: Fix a potential memory leak in perf_pmu__lookup()
  (git-fixes).
- perf print-events: make is_event_supported() more robust
  (git-fixes).
- perf list: fix short description for some cache events
  (git-fixes).
- perf metric: Don't remove scale from counts (git-fixes).
- perf stat: Avoid metric-only segv (git-fixes).
- perf expr: Fix "has_event" function for metric style events
  (git-fixes).
- perf srcline: Add missed addr2line closes (git-fixes).
- perf thread_map: Free strlist on normal path in
  thread_map__new_by_tid_str() (git-fixes).
- perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
- perf jevents: Drop or simplify small integer values (git-fixes).
- perf evsel: Fix duplicate initialization of data-&gt;id in
  evsel__parse_sample() (git-fixes).
- perf pmu: Treat the msr pmu as software (git-fixes).
- perf record: Check conflict between '--timestamp-filename'
  option and pipe mode before recording (git-fixes).
- perf record: Fix possible incorrect free in
  record__switch_output() (git-fixes).
- perf vendor events amd: Add Zen 4 memory controller events
  (git-fixes).
- perf top: Uniform the event name for the hybrid machine
  (git-fixes).
- perf top: Use evsel's cpus to replace user_requested_cpus
  (git-fixes).
- commit a1f9340</changelog>
  <changelog author="tonyj@suse.de" date="1717675200">- perf ui browser: Avoid SEGV on title (git fixes).
- commit 1578c22</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675201">- inet: inet_defrag: prevent sk release while still in use
  (CVE-2024-26921 bsc#1223138).
- commit 2016faf</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675202">- net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
- commit 7bf5961</changelog>
  <changelog author="tiwai@suse.de" date="1718366400">- Temporarily drop KVM patch that caused a regression (bsc#1226158)
  Delete patches.suse/KVM-x86-pmu-Prioritize-VMX-interception-over-GP-on-R.patch
- commit 33f31da</changelog>
</package>
<package pkgid="7c55fc02d2368886405b03bd3f69d4fa21b675aecceb0ac2ef46bdd50c1c88d6" name="cluster-md-kmp-rt" arch="x86_64">
  <version epoch="0" ver="6.4.0" rel="150600.10.5.1"/>
  <changelog author="tiwai@suse.de" date="1722081600">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
  <changelog author="pmladek@suse.com" date="1723204800">- blacklist.conf: printk/sysctl: breaks kernel without pre-requisite
  patches (bsc#1229025)
- Delete
  patches.suse/printk-Remove-the-now-superfluous-sentinel-elements-from-ctl_table-array.patch.
- commit db77a25</changelog>
</package>
<package pkgid="189925fe76eec27dfc7b2006f0adfc6a6af99ec6d1029930f855c0d67c168664" name="cluster-md-kmp-rt" arch="x86_64">
  <version epoch="0" ver="6.4.0" rel="150600.10.8.3"/>
  <changelog author="lhenriques@suse.de" date="1725019200">- virtiofs: forbid newlines in tags (bsc#1229940).
- commit 61514ce</changelog>
  <changelog author="lhenriques@suse.de" date="1725019201">- blacklist.conf: add 053fc4f755ad fuse: fix UAF in rcu pathwalks
  This commit breaks kABI and the data structure has no free room for the
  extra field, i.e. memcpy would fail to copy the additional member added by
  this patch.
- commit 941b81c</changelog>
  <changelog author="vkarasulli@suse.de" date="1725019202">- iommufd/device: Fix hwpt at err_unresv in
  iommufd_device_do_replace() (git-fixes).
- commit bbc9a65</changelog>
  <changelog author="vkarasulli@suse.de" date="1725019203">- iommu/vt-d: Fix identity map bounds in si_domain_init()
  (git-fixes).
- commit b4d27e5</changelog>
  <changelog author="lduncan@suse.com" date="1725019204">- scsi: lpfc: Fix a possible null pointer dereference (bsc#1229315
  CVE-2024-43821).
- commit eb73e94</changelog>
  <changelog author="vkarasulli@suse.de" date="1725019205">- iommu/amd: Convert comma to semicolon (git-fixes).
- commit 2714d8b</changelog>
  <changelog author="mkoutny@suse.com" date="1725019206">- Update
  patches.suse/0001-net-rds-fix-possible-cp-null-dereference.patch
  (git-fixes CVE-2024-35902 bsc#1224496).
- Update
  patches.suse/ASoC-TAS2781-Fix-tasdev_load_calibrated_data.patch
  (git-fixes CVE-2024-42278 bsc#1229403).
- Update
  patches.suse/ASoC-amd-Adjust-error-handling-in-case-of-absent-cod.patch
  (git-fixes CVE-2024-43818 bsc#1229296).
- Update
  patches.suse/ASoC-fsl-fsl_qmc_audio-Check-devm_kasprintf-returned.patch
  (git-fixes CVE-2024-42298 bsc#1229369).
- Update
  patches.suse/Bluetooth-MGMT-Add-error-handling-to-pair_device.patch
  (git-fixes CVE-2024-43884 bsc#1229739).
- Update
  patches.suse/KVM-Always-flush-async-PF-workqueue-when-vCPU-is-bei.patch
  (git-fixes CVE-2024-26976 bsc#1223635).
- Update
  patches.suse/PCI-DPC-Fix-use-after-free-on-concurrent-DPC-and-hot.patch
  (git-fixes CVE-2024-42302 bsc#1229366).
- Update
  patches.suse/PCI-endpoint-Clean-up-error-handling-in-vpci_scan_bu.patch
  (git-fixes CVE-2024-43875 bsc#1229486).
- Update
  patches.suse/PCI-endpoint-pci-epf-test-Make-use-of-cached-epc_fea.patch
  (git-fixes CVE-2024-43824 bsc#1229320).
- Update
  patches.suse/PCI-keystone-Fix-NULL-pointer-dereference-in-case-of.patch
  (git-fixes CVE-2024-43823 bsc#1229303).
- Update
  patches.suse/PCI-rcar-Demote-WARN-to-dev_warn_ratelimited-in-rcar.patch
  (git-fixes CVE-2024-43876 bsc#1229485).
- Update
  patches.suse/RDMA-hns-Fix-soft-lockup-under-heavy-CEQE-load.patch
  (git-fixes CVE-2024-43872 bsc#1229489).
- Update
  patches.suse/RDMA-iwcm-Fix-a-use-after-free-related-to-destroying.patch
  (git-fixes CVE-2024-42285 bsc#1229381).
- Update
  patches.suse/Revert-ALSA-firewire-lib-operate-for-period-elapse-e.patch
  (bsc#1208783 CVE-2024-42274 bsc#1229417).
- Update
  patches.suse/SUNRPC-add-a-missing-rpc_stat-for-TCP-TLS.patch
  (git-fixes CVE-2024-36907 bsc#1225751).
- Update
  patches.suse/bpf-arm64-Fix-trampoline-for-BPF_TRAMP_F_CALL_ORIG.patch
  (git-fixes CVE-2024-43840 bsc#1229344).
- Update
  patches.suse/btrfs-fix-double-inode-unlock-for-direct-IO-sync-wri.patch
  (git-fixes CVE-2024-43885 bsc#1229747).
- Update
  patches.suse/btrfs-fix-extent-map-use-after-free-when-adding-page.patch
  (git-fixes CVE-2024-42314 bsc#1229355).
- Update
  patches.suse/cgroup-cpuset-Prevent-UAF-in-proc_cpuset_show.patch
  (bsc#1228801 CVE-2024-43853 bsc#1229292).
- Update
  patches.suse/crypto-ccp-Fix-null-pointer-dereference-in-__sev_snp.patch
  (git-fixes CVE-2024-43874 bsc#1229487).
- Update
  patches.suse/devres-Fix-memory-leakage-caused-by-driver-API-devm_.patch
  (git-fixes CVE-2024-43871 bsc#1229490).
- Update
  patches.suse/dma-fix-call-order-in-dmam_free_coherent.patch
  (git-fixes CVE-2024-43856 bsc#1229346).
- Update
  patches.suse/drm-admgpu-fix-dereferencing-null-pointer-context.patch
  (stable-fixes CVE-2024-43906 bsc#1229785).
- Update
  patches.suse/drm-amd-display-Add-NULL-check-for-afb-before-derefe.patch
  (stable-fixes CVE-2024-43903 bsc#1229781).
- Update
  patches.suse/drm-amd-display-Add-null-checker-before-passing-vari.patch
  (stable-fixes CVE-2024-43902 bsc#1229767).
- Update
  patches.suse/drm-amd-display-Skip-Recompute-DSC-Params-if-no-Stre.patch
  (stable-fixes CVE-2024-43895 bsc#1229755).
- Update
  patches.suse/drm-amd-pm-Fix-the-null-pointer-dereference-for-vega.patch
  (stable-fixes CVE-2024-43905 bsc#1229784).
- Update
  patches.suse/drm-amdgpu-Fix-the-null-pointer-dereference-to-ras_m.patch
  (stable-fixes CVE-2024-43908 bsc#1229788).
- Update
  patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-for-s.patch
  (stable-fixes CVE-2024-43909 bsc#1229789).
- Update
  patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-in-ap.patch
  (stable-fixes CVE-2024-43907 bsc#1229787).
- Update
  patches.suse/drm-client-fix-null-pointer-dereference-in-drm_clien.patch
  (git-fixes CVE-2024-43894 bsc#1229746).
- Update
  patches.suse/drm-gma500-fix-null-pointer-dereference-in-cdv_intel.patch
  (git-fixes CVE-2024-42310 bsc#1229358).
- Update
  patches.suse/drm-gma500-fix-null-pointer-dereference-in-psb_intel.patch
  (git-fixes CVE-2024-42309 bsc#1229359).
- Update
  patches.suse/drm-nouveau-prime-fix-refcount-underflow.patch
  (git-fixes CVE-2024-43867 bsc#1229493).
- Update patches.suse/drm-qxl-Add-check-for-drm_cvt_mode.patch
  (git-fixes CVE-2024-43829 bsc#1229341).
- Update
  patches.suse/drm-vmwgfx-Fix-a-deadlock-in-dma-buf-fence-polling.patch
  (git-fixes CVE-2024-43863 bsc#1229497).
- Update
  patches.suse/exfat-fix-potential-deadlock-on-__exfat_get_dentry_set.patch
  (git-fixes CVE-2024-42315 bsc#1229354).
- Update
  patches.suse/gpio-prevent-potential-speculation-leaks-in-gpio_dev.patch
  (stable-fixes CVE-2024-44931 bsc#1229837).
- Update
  patches.suse/hfs-fix-to-initialize-fields-of-hfs_inode_info-after-hfs_alloc_inode.patch
  (git-fixes CVE-2024-42311 bsc#1229413).
- Update
  patches.suse/iio-Fix-the-sorting-functionality-in-iio_gts_build_a.patch
  (git-fixes CVE-2024-43825 bsc#1229298).
- Update
  patches.suse/jfs-Fix-array-index-out-of-bounds-in-diFree.patch
  (git-fixes CVE-2024-43858 bsc#1229414).
- Update
  patches.suse/jfs-Fix-shift-out-of-bounds-in-dbDiscardAG.patch
  (git-fixes CVE-2024-44938 bsc#1229792).
- Update
  patches.suse/jfs-fix-null-ptr-deref-in-dtInsertEntry.patch
  (git-fixes CVE-2024-44939 bsc#1229820).
- Update
  patches.suse/kobject_uevent-Fix-OOB-access-within-zap_modalias_en.patch
  (git-fixes CVE-2024-42292 bsc#1229373).
- Update
  patches.suse/kvm-s390-Reject-memory-region-operations-for-ucontrol-VMs.patch
  (git-fixes bsc#1229168 CVE-2024-43819 bsc#1229290).
- Update
  patches.suse/leds-trigger-Unregister-sysfs-attributes-before-call.patch
  (git-fixes CVE-2024-43830 bsc#1229305).
- Update
  patches.suse/lib-objagg-Fix-general-protection-fault.patch
  (git-fixes CVE-2024-43846 bsc#1229360).
- Update
  patches.suse/libbpf-Use-OPTS_SET-macro-in-bpf_xdp_query.patch
  (git-fixes CVE-2024-27050 bsc#1223767).
- Update
  patches.suse/mISDN-Fix-a-use-after-free-in-hfcmulti_tx.patch
  (git-fixes CVE-2024-42280 bsc#1229388).
- Update
  patches.suse/mailbox-mtk-cmdq-Move-devm_mbox_controller_register-.patch
  (git-fixes CVE-2024-42319 bsc#1229350).
- Update
  patches.suse/md-raid5-fix-deadlock-that-raid5d-wait-for-itself-to-clear-MD_SB_CHANGE_PENDING-151f.patch
  (git-fixes CVE-2024-39476 bsc#1227437).
- Update
  patches.suse/media-imx-pxp-Fix-ERR_PTR-dereference-in-pxp_probe.patch
  (git-fixes CVE-2024-42303 bsc#1229365).
- Update
  patches.suse/media-pci-ivtv-Add-check-for-DMA-map-result.patch
  (git-fixes CVE-2024-43877 bsc#1229484).
- Update
  patches.suse/media-v4l-async-Fix-NULL-pointer-dereference-in-addi.patch
  (git-fixes CVE-2024-43833 bsc#1229299).
- Update
  patches.suse/media-venus-fix-use-after-free-in-vdec_close.patch
  (git-fixes CVE-2024-42313 bsc#1229356).
- Update
  patches.suse/media-xc2028-avoid-use-after-free-in-load_firmware_c.patch
  (stable-fixes CVE-2024-43900 bsc#1229756).
- Update
  patches.suse/memcg-protect-concurrent-access-to-mem_cgroup_idr.patch
  (git-fixes CVE-2024-43892 bsc#1229761).
- Update
  patches.suse/net-drop-bad-gso-csum_start-and-offset-in-virtio_net.patch
  (git-fixes CVE-2024-43897 bsc#1229752).
- Update
  patches.suse/net-iucv-fix-use-after-free-in-iucv_sock_close.patch
  (bsc#1228973 CVE-2024-42271 bsc#1229400).
- Update patches.suse/net-missing-check-virtio.patch (git-fixes
  CVE-2024-43817 bsc#1229312).
- Update
  patches.suse/net-usb-qmi_wwan-fix-memory-leak-for-not-ip-packets.patch
  (git-fixes CVE-2024-43861 bsc#1229500).
- Update
  patches.suse/nfs-pass-explicit-offset-count-to-trace-events.patch
  (git-fixes CVE-2024-43826 bsc#1229294).
- Update
  patches.suse/nvme-pci-add-missing-condition-check-for-existence-o.patch
  (git-fixes CVE-2024-42276 bsc#1229410).
- Update
  patches.suse/padata-Fix-possible-divide-by-0-panic-in-padata_mt_h.patch
  (git-fixes CVE-2024-43889 bsc#1229743).
- Update
  patches.suse/remoteproc-imx_rproc-Skip-over-memory-region-when-no.patch
  (git-fixes CVE-2024-43860 bsc#1229319).
- Update
  patches.suse/s390-dasd-fix-error-checks-in-dasd_copy_pair_store.patch
  (git-fixes bsc#1229173 CVE-2024-42320 bsc#1229349).
- Update
  patches.suse/scsi-lpfc-Revise-lpfc_prep_embed_io-routine-with-pro.patch
  (bsc#1228857 CVE-2024-43816 bsc#1229318).
- Update
  patches.suse/scsi-qla2xxx-Complete-command-early-within-lock.patch
  (bsc#1228850 CVE-2024-42287 bsc#1229392).
- Update
  patches.suse/scsi-qla2xxx-During-vport-delete-send-async-logout-e.patch
  (bsc#1228850 CVE-2024-42289 bsc#1229399).
- Update
  patches.suse/scsi-qla2xxx-Fix-for-possible-memory-corruption.patch
  (bsc#1228850 CVE-2024-42288 bsc#1229398).
- Update
  patches.suse/scsi-qla2xxx-validate-nvme_local_port-correctly.patch
  (bsc#1228850 CVE-2024-42286 bsc#1229395).
- Update
  patches.suse/serial-core-check-uartclk-for-zero-to-avoid-divide-b.patch
  (stable-fixes CVE-2024-43893 bsc#1229759).
- Update
  patches.suse/soc-qcom-pdr-protect-locator_addr-with-the-main-mute.patch
  (git-fixes CVE-2024-43849 bsc#1229307).
- Update
  patches.suse/soc-xilinx-rename-cpu_number1-to-dummy_cpu_number.patch
  (git-fixes CVE-2024-43851 bsc#1229313).
- Update
  patches.suse/spi-microchip-core-ensure-TX-and-RX-FIFOs-are-empty-.patch
  (git-fixes CVE-2024-42279 bsc#1229390).
- Update
  patches.suse/usb-vhci-hcd-Do-not-drop-references-before-new-refer.patch
  (stable-fixes CVE-2024-43883 bsc#1229707).
- Update
  patches.suse/vhost-vsock-always-initialize-seqpacket_allow.patch
  (git-fixes CVE-2024-43873 bsc#1229488).
- Update
  patches.suse/wifi-ath12k-change-DMA-direction-while-mapping-reinj.patch
  (git-fixes CVE-2024-43881 bsc#1229480).
- Update
  patches.suse/wifi-ath12k-fix-invalid-memory-access-while-processi.patch
  (git-fixes CVE-2024-43847 bsc#1229291).
- Update
  patches.suse/wifi-cfg80211-handle-2x996-RU-allocation-in-cfg80211.patch
  (git-fixes CVE-2024-43879 bsc#1229482).
- Update
  patches.suse/wifi-nl80211-disallow-setting-special-AP-channel-wid.patch
  (stable-fixes CVE-2024-43912 bsc#1229830).
- Update
  patches.suse/wifi-rtw89-Fix-array-index-mistake-in-rtw89_sta_info.patch
  (git-fixes CVE-2024-43842 bsc#1229317).
- Update
  patches.suse/wifi-virt_wifi-avoid-reporting-connection-success-wi.patch
  (git-fixes CVE-2024-43841 bsc#1229304).
- commit 140ec33</changelog>
  <changelog author="tiwai@suse.de" date="1725105600">- dmaengine: dw: Add memory bus width verification (git-fixes).
- dmaengine: dw: Add peripheral bus width verification
  (git-fixes).
- soundwire: stream: fix programming slave ports for non-continous
  port maps (git-fixes).
- commit b7e9784</changelog>
  <changelog author="tiwai@suse.de" date="1725192000">- usb: cdnsp: fix for Link TRB with TC (git-fixes).
- usb: dwc3: st: add missing depopulate in probe error path
  (git-fixes).
- usb: dwc3: st: fix probed platform device ref count on probe
  error path (git-fixes).
- usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in
  remove_power_attributes() (git-fixes).
- usb: typec: fsa4480: Relax CHIP_ID check (git-fixes).
- usb: dwc3: omap: add missing depopulate in probe error path
  (git-fixes).
- usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function
  (git-fixes).
- soc: qcom: pmic_glink: Actually communicate when remote goes
  down (git-fixes).
- soc: qcom: cmd-db: Map shared memory as WC, not WB (git-fixes).
- commit 7121142</changelog>
  <changelog author="ailiop@suse.com" date="1725192001">- xfs: Fix the owner setting issue for rmap query in xfs fsmap
  (git-fixes).
- commit 49b5eec</changelog>
  <changelog author="ailiop@suse.com" date="1725192002">- xfs: use XFS_BUF_DADDR_NULL for daddrs in getfsmap code
  (git-fixes).
- commit 288ad9b</changelog>
  <changelog author="ailiop@suse.com" date="1725192003">- xfs: Fix missing interval for missing_owner in xfs fsmap
  (git-fixes).
- commit 5448ab5</changelog>
  <changelog author="ohering@suse.de" date="1725278400">- net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response (git-fixes).
- commit 4dc1da1</changelog>
  <changelog author="osalvador@suse.de" date="1725278401">- mm/sparsemem: fix race in accessing memory_section-&gt;usage
  (bsc#1221326 CVE-2023-52489).
- commit 6aa8957</changelog>
  <changelog author="osalvador@suse.de" date="1725278402">- mm, kmsan: fix infinite recursion due to RCU critical section
  (git-fixes).
- commit 16ad73a</changelog>
  <changelog author="osalvador@suse.de" date="1725278403">- mm: prevent derefencing NULL ptr in pfn_section_valid()
  (git-fixes).
- commit 35f619d</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1725278404">- bluetooth/l2cap: sync sock recv cb and release (bsc#1228576
  CVE-2024-41062).
- commit 6553526</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1725278405">- Bluetooth: L2CAP: Fix deadlock (git-fixes).
- commit 13aba13</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1725278406">- Bluetooth: Fix usage of __hci_cmd_sync_status (git-fixes).
- commit 1bec58d</changelog>
  <changelog author="lhenriques@suse.de" date="1725278407">- ceph: periodically flush the cap releases (bsc#1230056).
- commit e22b6e0</changelog>
</package>
<package pkgid="8016cb3a0416afeae90716beaeea9cfc847bec22f2e56d714b47ecf5f9a8cdee" name="cmake3" arch="aarch64">
  <version epoch="0" ver="3.20.0" rel="150200.6.3.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1567598400">- cmake 3.15.3:
  * CrayPrgEnv compiler wrapper support updated for 19.06
- includes changes from 3.15.2:
  * Fix CMAKE_FIND_PACKAGE_PREFER_CONFIG variable causing the
    find_package() command to fail on a missing package even
    without the REQUIRED option</changelog>
  <changelog author="sflees@suse.de" date="1572177600">- cmake 3.15.4
  * In CMake 3.15.0 through 3.15.3, the EXCLUDE_FROM_ALL directory
    property was regressed from pre-3.14 behavior and caused targets
    within the directory to be excluded even from its own “all”.
    This has been fixed. The bug also existed in 3.14.0 through
    3.14.6 and is fixed in 3.14.7.
- Use pkgconfig for dependencies where possible (required due to
  tumbleweed build changes)</changelog>
  <changelog author="tchvatal@suse.com" date="1572609600">- Update cmake conditionals to make sure the multibuild is
  nicely leveraged</changelog>
  <changelog author="simonf.lees@suse.com" date="1572955200">- Drop debug patch (never in factory) and update patch numbers</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1573387200">- cmake 3.15.5:
  * no changelog available</changelog>
  <changelog author="mpluskal@suse.com" date="1573646400">- Switch back to libcurl-mini-devel to avoid new build cycle</changelog>
  <changelog author="foss@grueninger.de" date="1574769600">- update to CMake 3.16
  Changelog see https://blog.kitware.com/cmake-3-16-0-available-for-download/
- drop patch form.patch, fixed upstream</changelog>
  <changelog author="sflees@suse.de" date="1574856000">- Fix numbering of patches.</changelog>
  <changelog author="foss@grueninger.de" date="1576843200">- update to CMAke 3.16.2
  * FindBLAS: Consider OpenBLAS with thread libraries only with C or CXX
  * FindBoost: Add support for Boost 1.72
  * FindLAPACK: Fix support for LAPACK symbols inside BLAS libraries
  Full changelog see https://blog.kitware.com/cmake-3-16-2-available-for-download/</changelog>
  <changelog author="asn@cryptomilk.org" date="1579003200">- Fix setting CMAKE_INSTALL_LIBDIR in cmake macro
  * This is a relative path, see `cmake --help-module GNUInstallDirs`
- Do NOT set -DCMAKE_SKIP_RPATH:BOOL=OFF
  * A lot of applications have private libraries in a subdirectory
    and require linking with RPATH which is totally valid.</changelog>
  <changelog author="junghans@votca.org" date="1579003201">- use cmake generics in marcos.cmake</changelog>
  <changelog author="tchvatal@suse.com" date="1580904000">- Add new -mini flavor in order to break up cycles
  * make sure the default cmake links now all system libraries
    and mini uses bundled stuff as needed
- Switch to python3 variant of Sphinx on the manpage/docu creation</changelog>
  <changelog author="sflees@suse.de" date="1581076800">- Revert "use cmake generics in marcos.cmake" it breaks many
  cases in stagings.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1581336000">- Revert LIBDIR change in macros - it is inconsistent (all other
  INSTALL_&lt;dir&gt;s use absolute paths), unneeded (paths may be
  absolute or relative), and breaks a number of packages.
- Update minimum libarchive version, &gt;= 3.3.3.
- Do not flag macros as config file.
- Adjust constraints (7G disk space is required, independent
  of architecture).</changelog>
  <changelog author="dimstar@opensuse.org" date="1582113600">- Change cmake to be a meta-package that requires
  cmake-implementation. This new symbol is provided by the (newly
  named) cmake-full package as well as cmake-mini.
- This is needed as the original attempt of using Substitute in OBS
  actually rewrites the used spec files on disk, not only on the
  fly and we ended up with packages Requiring cmake-mini (which is
  not installable on end user systems).</changelog>
  <changelog author="foss@grueninger.de" date="1584878400">- update to 3.17.0
  * cmake(1) gained a “Ninja Multi-Config” generator, which
    can be used to build multiple configurations at once.
  * cmake(1) gained a “–debug-find” command-line option to
    enable additional human-readable output on where find
    commands search.
  * Target link properties are now transitive over
    private dependencies on static libraries. See policy “CMP0099”.
  * cmake(1) gained a “-E rm” command-line tool that can
    be used to remove directories and files.
  Full changelog see
  https://blog.kitware.com/cmake-3-17-0-available-for-download/</changelog>
  <changelog author="sflees@suse.de" date="1584964800">- Many Leap packages don't build without -DCMAKE_SKIP_RPATH:BOOL=ON
  so leave this change to the next major version of Leap / SLE</changelog>
  <changelog author="sflees@suse.de" date="1585224000">- Fix mistake in previous change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628251200">- copypac from SLE-15, because of Firefox91 (bsc#1188891)
  (Dependency chain: cmake3 -&gt; Rust -&gt; Firefox)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718366400">- Needed for Firefox 128 (bsc#1226316)
  (Dependency chain: cmake3 -&gt; Rust1.78 -&gt; Firefox)
- Update to 3.20.0
  * The “cmake_path()” command was added for operations on
    filesystem paths.
  * The “target_sources()” command now supports targets created
    by the “add_custom_target()” command.
  * The “ExternalProject” module “ExternalProject_Add()” function
    gained a “CONFIGURE_HANDLED_BY_BUILD” option.
  * “ctest(1)” gained a “–test-dir” option to specify the directory
    in which to look for tests.
- update to 3.19.7:
  * With :ref:`Visual Studio Generators` for VS 2017 and higher, the
    :variable:`CMAKE_GENERATOR_TOOLSET` field ``version=`` now accepts
    three-component MSVC toolset versions such as ``14.28.29910``.
    See the :variable:`CMAKE_VS_PLATFORM_TOOLSET_VERSION` variable.
- cmake 3.19.6:
  * The cmake-presets(7) feature no longer allows comments in
    CMakePresets.json or CMakeUserPresets.json files. This was
    mistakenly allowed by the implementation in 3.19.0 to 3.19.5
- Update to CMake 3.19.5
  * FindBoost: Add support for Boost 1.75
  * FindCUDAToolkit: Restore use of CUDA_PATH environment variable
- A quick note that tumbleweed isn't affeted by bsc#1181680 which
  is being fixed for SLE.
- cmake 3.19.4:
  * fixes for other platforms
- cmake 3.19.3:
  * FetchContent: Relative SOURCE_DIR override cannot be a hard error
  * FindMPI: remove single quotes from include path
  * FindHDF5: Fix finding both debug and release libs
  * cmake-gui: Restore linking of Qt resources
  * cmMakefile: Don't expand bracket arguments in --trace-expand
- update to 3.19.2:
  * various Apple-Silicon support fixes
  * The CMAKE_ISPC_HEADER_SUFFIX variable and corresponding ISPC_HEADER_SUFFIX
  target property were added to control the header suffix used by ISPC
  compiler generated headers.
- remove 5556.patch (upstream)
- Add 5556.patch: export: Do not fail generation for separate
  namelink only case. Fixes regression, blocking other packages
  from build,
- cmake 3.19.1:
  * avoid breaking projects relying on using the LANGUAGE property
    to cause the specified language's compiler to be used
  * CUDA 11.1 support for Clang.
- cmake 3.19.0:
  * cmake(1) and cmake-gui(1) now recognize CMakePresets.json and
    CMakeUserPresets.json files
  * support for ISPC
  * exctend CUDA language support for Clang
  * extend cmake-file-ap "codemodel"
  * cli --install supports --default-directory-permissions
  * cli supports creating hardlinks
  * CMake GUI now has an environment variable editor
  * Multiple cmake commands support new options and subcommands
  * Multiple variables added or functionalities extended
  * Multiple new modules and added functionality to existing modules
  * Compatibility with versions of CMake older than 2.8.12 is now
    deprecated and will be removed from a future version. Calls to
    cmake_minimum_required() or cmake_policy() that set the policy
    version to an older value now issue a deprecation diagnostic.
  * cmake-gui now requires Qt5
- cmake 3.18.4:
  * no upstream changelog
- update to 3.18.3:
  * The Compile Features functionality was updated for MSVC 19.28
- reapply this change (bsc#1174581):
  * Fix setting CMAKE_INSTALL_LIBDIR in cmake macro
  * This is a relative path, see `cmake --help-module GNUInstallDirs`
  see also
  https://gitlab.kitware.com/cmake/cmake/-/issues/20250
  https://github.com/arvidn/libtorrent/issues/5125#issuecomment-691559244
- update to 3.18.2:
  * The default value of :variable:`CMAKE_AUTOMOC_PATH_PREFIX` was changed to
  ``OFF`` because this feature can break existing projects that have
  identically named header files in different include directories.
  This restores compatibility with behavior of CMake 3.15 and below.
  * The :manual:`Compile Features &lt;cmake-compile-features(7)&gt;` functionality
  was updated for MSVC 19.27 as mentioned above.
- cmake 3.18.1:
  * Revert undocumented fix in 3.18.0 in the add_test() command
    for special characters to avoid breaking existing projects that
    worked around the issue. Will be reintroduced later
- drop no-system-nghttp2.patch, upstream
- Install the rpm provides handler to the correct location
  (%{_rpmconfigdir, not %{_libexecdir}).
- update to cmake 3.18.0
  * The “CUDA” language can now be compiled using Clang on non-Windows platforms.
  * “cmake(1)” gained support for profiling of CMake scripts
  * The “cmake_language()” command was added for meta-operations on
    scripted or built-in commands, starting with a mode to “CALL” other
    commands, and “EVAL CODE” to inplace evaluate a CMake script.
  * The “find_program()”, “find_library()”, “find_path()” and
    “find_file()” commands gained a new “REQUIRED” option that will stop
    processing with an error message if nothing is found.
  * The “CheckLinkerFlag” module has been added to provide a facility to
    check validity of link flags.
  * “ccmake(1)” learned to read a “CCMAKE_COLORS” environment variable
    to customize colors.
- Drop patch lua54.patch, it became part of upstream
- Udjust patch cmake-fix-ruby-test.patch
- Add patch no-system-nghttp2.patch which will become part of 3.18.1
  to disable nghttp2 from system for cmake-mini
- Add lua54.patch which adds 5.4 among allowed versions of
  Lua interpreter.
  (https://gitlab.kitware.com/cmake/cmake/-/issues/20933)
- Use plain autosetup
- DCMAKE_MODULES_INSTALL_DIR should be %{_libdir}/cmake/%{name}
- Set CMAKE_INSTALL_LIBEXECDIR=%{_libexecdir}
- Use -DCMAKE_SKIP_INSTALL_RPATHS:BOOL=ON instead of completely
  removing rpaths. boo#1172331
- cmake 3.17.3:
  * Selection of the Objective C or C++ compiler now considers the
    CC or CXX environment variable if the OBJC or OBJCXX
    environment variable is not set
  * The FindPkgConfig module now extracts include directories
    prefixed with -isystem into the *_INCLUDE_DIRS variables and
    INTERFACE_INCLUDE_DIRECTORIES target properties
  * FindOpenSSL: Detect OpenSSL 3.0.0 (bsc#1172267)
- cmake 3.17.2:
  * fixes dealing with boost 1.73
- Add cmake-fix-png-include-dir.patch to fix the png include dir
  search.
- cmake 3.17.1:
  * The :cpack_gen:`CPack NSIS Generator` now requires NSIS 3.0 or later</changelog>
</package>
<package pkgid="5549202c1405da3b11970b468b4816bcdfc30288dabcb6f627f45fcc532818e4" name="cmake3" arch="ppc64le">
  <version epoch="0" ver="3.20.0" rel="150200.6.3.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1567598400">- cmake 3.15.3:
  * CrayPrgEnv compiler wrapper support updated for 19.06
- includes changes from 3.15.2:
  * Fix CMAKE_FIND_PACKAGE_PREFER_CONFIG variable causing the
    find_package() command to fail on a missing package even
    without the REQUIRED option</changelog>
  <changelog author="sflees@suse.de" date="1572177600">- cmake 3.15.4
  * In CMake 3.15.0 through 3.15.3, the EXCLUDE_FROM_ALL directory
    property was regressed from pre-3.14 behavior and caused targets
    within the directory to be excluded even from its own “all”.
    This has been fixed. The bug also existed in 3.14.0 through
    3.14.6 and is fixed in 3.14.7.
- Use pkgconfig for dependencies where possible (required due to
  tumbleweed build changes)</changelog>
  <changelog author="tchvatal@suse.com" date="1572609600">- Update cmake conditionals to make sure the multibuild is
  nicely leveraged</changelog>
  <changelog author="simonf.lees@suse.com" date="1572955200">- Drop debug patch (never in factory) and update patch numbers</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1573387200">- cmake 3.15.5:
  * no changelog available</changelog>
  <changelog author="mpluskal@suse.com" date="1573646400">- Switch back to libcurl-mini-devel to avoid new build cycle</changelog>
  <changelog author="foss@grueninger.de" date="1574769600">- update to CMake 3.16
  Changelog see https://blog.kitware.com/cmake-3-16-0-available-for-download/
- drop patch form.patch, fixed upstream</changelog>
  <changelog author="sflees@suse.de" date="1574856000">- Fix numbering of patches.</changelog>
  <changelog author="foss@grueninger.de" date="1576843200">- update to CMAke 3.16.2
  * FindBLAS: Consider OpenBLAS with thread libraries only with C or CXX
  * FindBoost: Add support for Boost 1.72
  * FindLAPACK: Fix support for LAPACK symbols inside BLAS libraries
  Full changelog see https://blog.kitware.com/cmake-3-16-2-available-for-download/</changelog>
  <changelog author="asn@cryptomilk.org" date="1579003200">- Fix setting CMAKE_INSTALL_LIBDIR in cmake macro
  * This is a relative path, see `cmake --help-module GNUInstallDirs`
- Do NOT set -DCMAKE_SKIP_RPATH:BOOL=OFF
  * A lot of applications have private libraries in a subdirectory
    and require linking with RPATH which is totally valid.</changelog>
  <changelog author="junghans@votca.org" date="1579003201">- use cmake generics in marcos.cmake</changelog>
  <changelog author="tchvatal@suse.com" date="1580904000">- Add new -mini flavor in order to break up cycles
  * make sure the default cmake links now all system libraries
    and mini uses bundled stuff as needed
- Switch to python3 variant of Sphinx on the manpage/docu creation</changelog>
  <changelog author="sflees@suse.de" date="1581076800">- Revert "use cmake generics in marcos.cmake" it breaks many
  cases in stagings.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1581336000">- Revert LIBDIR change in macros - it is inconsistent (all other
  INSTALL_&lt;dir&gt;s use absolute paths), unneeded (paths may be
  absolute or relative), and breaks a number of packages.
- Update minimum libarchive version, &gt;= 3.3.3.
- Do not flag macros as config file.
- Adjust constraints (7G disk space is required, independent
  of architecture).</changelog>
  <changelog author="dimstar@opensuse.org" date="1582113600">- Change cmake to be a meta-package that requires
  cmake-implementation. This new symbol is provided by the (newly
  named) cmake-full package as well as cmake-mini.
- This is needed as the original attempt of using Substitute in OBS
  actually rewrites the used spec files on disk, not only on the
  fly and we ended up with packages Requiring cmake-mini (which is
  not installable on end user systems).</changelog>
  <changelog author="foss@grueninger.de" date="1584878400">- update to 3.17.0
  * cmake(1) gained a “Ninja Multi-Config” generator, which
    can be used to build multiple configurations at once.
  * cmake(1) gained a “–debug-find” command-line option to
    enable additional human-readable output on where find
    commands search.
  * Target link properties are now transitive over
    private dependencies on static libraries. See policy “CMP0099”.
  * cmake(1) gained a “-E rm” command-line tool that can
    be used to remove directories and files.
  Full changelog see
  https://blog.kitware.com/cmake-3-17-0-available-for-download/</changelog>
  <changelog author="sflees@suse.de" date="1584964800">- Many Leap packages don't build without -DCMAKE_SKIP_RPATH:BOOL=ON
  so leave this change to the next major version of Leap / SLE</changelog>
  <changelog author="sflees@suse.de" date="1585224000">- Fix mistake in previous change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628251200">- copypac from SLE-15, because of Firefox91 (bsc#1188891)
  (Dependency chain: cmake3 -&gt; Rust -&gt; Firefox)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718366400">- Needed for Firefox 128 (bsc#1226316)
  (Dependency chain: cmake3 -&gt; Rust1.78 -&gt; Firefox)
- Update to 3.20.0
  * The “cmake_path()” command was added for operations on
    filesystem paths.
  * The “target_sources()” command now supports targets created
    by the “add_custom_target()” command.
  * The “ExternalProject” module “ExternalProject_Add()” function
    gained a “CONFIGURE_HANDLED_BY_BUILD” option.
  * “ctest(1)” gained a “–test-dir” option to specify the directory
    in which to look for tests.
- update to 3.19.7:
  * With :ref:`Visual Studio Generators` for VS 2017 and higher, the
    :variable:`CMAKE_GENERATOR_TOOLSET` field ``version=`` now accepts
    three-component MSVC toolset versions such as ``14.28.29910``.
    See the :variable:`CMAKE_VS_PLATFORM_TOOLSET_VERSION` variable.
- cmake 3.19.6:
  * The cmake-presets(7) feature no longer allows comments in
    CMakePresets.json or CMakeUserPresets.json files. This was
    mistakenly allowed by the implementation in 3.19.0 to 3.19.5
- Update to CMake 3.19.5
  * FindBoost: Add support for Boost 1.75
  * FindCUDAToolkit: Restore use of CUDA_PATH environment variable
- A quick note that tumbleweed isn't affeted by bsc#1181680 which
  is being fixed for SLE.
- cmake 3.19.4:
  * fixes for other platforms
- cmake 3.19.3:
  * FetchContent: Relative SOURCE_DIR override cannot be a hard error
  * FindMPI: remove single quotes from include path
  * FindHDF5: Fix finding both debug and release libs
  * cmake-gui: Restore linking of Qt resources
  * cmMakefile: Don't expand bracket arguments in --trace-expand
- update to 3.19.2:
  * various Apple-Silicon support fixes
  * The CMAKE_ISPC_HEADER_SUFFIX variable and corresponding ISPC_HEADER_SUFFIX
  target property were added to control the header suffix used by ISPC
  compiler generated headers.
- remove 5556.patch (upstream)
- Add 5556.patch: export: Do not fail generation for separate
  namelink only case. Fixes regression, blocking other packages
  from build,
- cmake 3.19.1:
  * avoid breaking projects relying on using the LANGUAGE property
    to cause the specified language's compiler to be used
  * CUDA 11.1 support for Clang.
- cmake 3.19.0:
  * cmake(1) and cmake-gui(1) now recognize CMakePresets.json and
    CMakeUserPresets.json files
  * support for ISPC
  * exctend CUDA language support for Clang
  * extend cmake-file-ap "codemodel"
  * cli --install supports --default-directory-permissions
  * cli supports creating hardlinks
  * CMake GUI now has an environment variable editor
  * Multiple cmake commands support new options and subcommands
  * Multiple variables added or functionalities extended
  * Multiple new modules and added functionality to existing modules
  * Compatibility with versions of CMake older than 2.8.12 is now
    deprecated and will be removed from a future version. Calls to
    cmake_minimum_required() or cmake_policy() that set the policy
    version to an older value now issue a deprecation diagnostic.
  * cmake-gui now requires Qt5
- cmake 3.18.4:
  * no upstream changelog
- update to 3.18.3:
  * The Compile Features functionality was updated for MSVC 19.28
- reapply this change (bsc#1174581):
  * Fix setting CMAKE_INSTALL_LIBDIR in cmake macro
  * This is a relative path, see `cmake --help-module GNUInstallDirs`
  see also
  https://gitlab.kitware.com/cmake/cmake/-/issues/20250
  https://github.com/arvidn/libtorrent/issues/5125#issuecomment-691559244
- update to 3.18.2:
  * The default value of :variable:`CMAKE_AUTOMOC_PATH_PREFIX` was changed to
  ``OFF`` because this feature can break existing projects that have
  identically named header files in different include directories.
  This restores compatibility with behavior of CMake 3.15 and below.
  * The :manual:`Compile Features &lt;cmake-compile-features(7)&gt;` functionality
  was updated for MSVC 19.27 as mentioned above.
- cmake 3.18.1:
  * Revert undocumented fix in 3.18.0 in the add_test() command
    for special characters to avoid breaking existing projects that
    worked around the issue. Will be reintroduced later
- drop no-system-nghttp2.patch, upstream
- Install the rpm provides handler to the correct location
  (%{_rpmconfigdir, not %{_libexecdir}).
- update to cmake 3.18.0
  * The “CUDA” language can now be compiled using Clang on non-Windows platforms.
  * “cmake(1)” gained support for profiling of CMake scripts
  * The “cmake_language()” command was added for meta-operations on
    scripted or built-in commands, starting with a mode to “CALL” other
    commands, and “EVAL CODE” to inplace evaluate a CMake script.
  * The “find_program()”, “find_library()”, “find_path()” and
    “find_file()” commands gained a new “REQUIRED” option that will stop
    processing with an error message if nothing is found.
  * The “CheckLinkerFlag” module has been added to provide a facility to
    check validity of link flags.
  * “ccmake(1)” learned to read a “CCMAKE_COLORS” environment variable
    to customize colors.
- Drop patch lua54.patch, it became part of upstream
- Udjust patch cmake-fix-ruby-test.patch
- Add patch no-system-nghttp2.patch which will become part of 3.18.1
  to disable nghttp2 from system for cmake-mini
- Add lua54.patch which adds 5.4 among allowed versions of
  Lua interpreter.
  (https://gitlab.kitware.com/cmake/cmake/-/issues/20933)
- Use plain autosetup
- DCMAKE_MODULES_INSTALL_DIR should be %{_libdir}/cmake/%{name}
- Set CMAKE_INSTALL_LIBEXECDIR=%{_libexecdir}
- Use -DCMAKE_SKIP_INSTALL_RPATHS:BOOL=ON instead of completely
  removing rpaths. boo#1172331
- cmake 3.17.3:
  * Selection of the Objective C or C++ compiler now considers the
    CC or CXX environment variable if the OBJC or OBJCXX
    environment variable is not set
  * The FindPkgConfig module now extracts include directories
    prefixed with -isystem into the *_INCLUDE_DIRS variables and
    INTERFACE_INCLUDE_DIRECTORIES target properties
  * FindOpenSSL: Detect OpenSSL 3.0.0 (bsc#1172267)
- cmake 3.17.2:
  * fixes dealing with boost 1.73
- Add cmake-fix-png-include-dir.patch to fix the png include dir
  search.
- cmake 3.17.1:
  * The :cpack_gen:`CPack NSIS Generator` now requires NSIS 3.0 or later</changelog>
</package>
<package pkgid="b935562a32f7ec771106e660449ab0c46f9e31c8a5e55d15bf09a3d898d9f68b" name="cmake3" arch="s390x">
  <version epoch="0" ver="3.20.0" rel="150200.6.3.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1567598400">- cmake 3.15.3:
  * CrayPrgEnv compiler wrapper support updated for 19.06
- includes changes from 3.15.2:
  * Fix CMAKE_FIND_PACKAGE_PREFER_CONFIG variable causing the
    find_package() command to fail on a missing package even
    without the REQUIRED option</changelog>
  <changelog author="sflees@suse.de" date="1572177600">- cmake 3.15.4
  * In CMake 3.15.0 through 3.15.3, the EXCLUDE_FROM_ALL directory
    property was regressed from pre-3.14 behavior and caused targets
    within the directory to be excluded even from its own “all”.
    This has been fixed. The bug also existed in 3.14.0 through
    3.14.6 and is fixed in 3.14.7.
- Use pkgconfig for dependencies where possible (required due to
  tumbleweed build changes)</changelog>
  <changelog author="tchvatal@suse.com" date="1572609600">- Update cmake conditionals to make sure the multibuild is
  nicely leveraged</changelog>
  <changelog author="simonf.lees@suse.com" date="1572955200">- Drop debug patch (never in factory) and update patch numbers</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1573387200">- cmake 3.15.5:
  * no changelog available</changelog>
  <changelog author="mpluskal@suse.com" date="1573646400">- Switch back to libcurl-mini-devel to avoid new build cycle</changelog>
  <changelog author="foss@grueninger.de" date="1574769600">- update to CMake 3.16
  Changelog see https://blog.kitware.com/cmake-3-16-0-available-for-download/
- drop patch form.patch, fixed upstream</changelog>
  <changelog author="sflees@suse.de" date="1574856000">- Fix numbering of patches.</changelog>
  <changelog author="foss@grueninger.de" date="1576843200">- update to CMAke 3.16.2
  * FindBLAS: Consider OpenBLAS with thread libraries only with C or CXX
  * FindBoost: Add support for Boost 1.72
  * FindLAPACK: Fix support for LAPACK symbols inside BLAS libraries
  Full changelog see https://blog.kitware.com/cmake-3-16-2-available-for-download/</changelog>
  <changelog author="asn@cryptomilk.org" date="1579003200">- Fix setting CMAKE_INSTALL_LIBDIR in cmake macro
  * This is a relative path, see `cmake --help-module GNUInstallDirs`
- Do NOT set -DCMAKE_SKIP_RPATH:BOOL=OFF
  * A lot of applications have private libraries in a subdirectory
    and require linking with RPATH which is totally valid.</changelog>
  <changelog author="junghans@votca.org" date="1579003201">- use cmake generics in marcos.cmake</changelog>
  <changelog author="tchvatal@suse.com" date="1580904000">- Add new -mini flavor in order to break up cycles
  * make sure the default cmake links now all system libraries
    and mini uses bundled stuff as needed
- Switch to python3 variant of Sphinx on the manpage/docu creation</changelog>
  <changelog author="sflees@suse.de" date="1581076800">- Revert "use cmake generics in marcos.cmake" it breaks many
  cases in stagings.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1581336000">- Revert LIBDIR change in macros - it is inconsistent (all other
  INSTALL_&lt;dir&gt;s use absolute paths), unneeded (paths may be
  absolute or relative), and breaks a number of packages.
- Update minimum libarchive version, &gt;= 3.3.3.
- Do not flag macros as config file.
- Adjust constraints (7G disk space is required, independent
  of architecture).</changelog>
  <changelog author="dimstar@opensuse.org" date="1582113600">- Change cmake to be a meta-package that requires
  cmake-implementation. This new symbol is provided by the (newly
  named) cmake-full package as well as cmake-mini.
- This is needed as the original attempt of using Substitute in OBS
  actually rewrites the used spec files on disk, not only on the
  fly and we ended up with packages Requiring cmake-mini (which is
  not installable on end user systems).</changelog>
  <changelog author="foss@grueninger.de" date="1584878400">- update to 3.17.0
  * cmake(1) gained a “Ninja Multi-Config” generator, which
    can be used to build multiple configurations at once.
  * cmake(1) gained a “–debug-find” command-line option to
    enable additional human-readable output on where find
    commands search.
  * Target link properties are now transitive over
    private dependencies on static libraries. See policy “CMP0099”.
  * cmake(1) gained a “-E rm” command-line tool that can
    be used to remove directories and files.
  Full changelog see
  https://blog.kitware.com/cmake-3-17-0-available-for-download/</changelog>
  <changelog author="sflees@suse.de" date="1584964800">- Many Leap packages don't build without -DCMAKE_SKIP_RPATH:BOOL=ON
  so leave this change to the next major version of Leap / SLE</changelog>
  <changelog author="sflees@suse.de" date="1585224000">- Fix mistake in previous change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628251200">- copypac from SLE-15, because of Firefox91 (bsc#1188891)
  (Dependency chain: cmake3 -&gt; Rust -&gt; Firefox)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718366400">- Needed for Firefox 128 (bsc#1226316)
  (Dependency chain: cmake3 -&gt; Rust1.78 -&gt; Firefox)
- Update to 3.20.0
  * The “cmake_path()” command was added for operations on
    filesystem paths.
  * The “target_sources()” command now supports targets created
    by the “add_custom_target()” command.
  * The “ExternalProject” module “ExternalProject_Add()” function
    gained a “CONFIGURE_HANDLED_BY_BUILD” option.
  * “ctest(1)” gained a “–test-dir” option to specify the directory
    in which to look for tests.
- update to 3.19.7:
  * With :ref:`Visual Studio Generators` for VS 2017 and higher, the
    :variable:`CMAKE_GENERATOR_TOOLSET` field ``version=`` now accepts
    three-component MSVC toolset versions such as ``14.28.29910``.
    See the :variable:`CMAKE_VS_PLATFORM_TOOLSET_VERSION` variable.
- cmake 3.19.6:
  * The cmake-presets(7) feature no longer allows comments in
    CMakePresets.json or CMakeUserPresets.json files. This was
    mistakenly allowed by the implementation in 3.19.0 to 3.19.5
- Update to CMake 3.19.5
  * FindBoost: Add support for Boost 1.75
  * FindCUDAToolkit: Restore use of CUDA_PATH environment variable
- A quick note that tumbleweed isn't affeted by bsc#1181680 which
  is being fixed for SLE.
- cmake 3.19.4:
  * fixes for other platforms
- cmake 3.19.3:
  * FetchContent: Relative SOURCE_DIR override cannot be a hard error
  * FindMPI: remove single quotes from include path
  * FindHDF5: Fix finding both debug and release libs
  * cmake-gui: Restore linking of Qt resources
  * cmMakefile: Don't expand bracket arguments in --trace-expand
- update to 3.19.2:
  * various Apple-Silicon support fixes
  * The CMAKE_ISPC_HEADER_SUFFIX variable and corresponding ISPC_HEADER_SUFFIX
  target property were added to control the header suffix used by ISPC
  compiler generated headers.
- remove 5556.patch (upstream)
- Add 5556.patch: export: Do not fail generation for separate
  namelink only case. Fixes regression, blocking other packages
  from build,
- cmake 3.19.1:
  * avoid breaking projects relying on using the LANGUAGE property
    to cause the specified language's compiler to be used
  * CUDA 11.1 support for Clang.
- cmake 3.19.0:
  * cmake(1) and cmake-gui(1) now recognize CMakePresets.json and
    CMakeUserPresets.json files
  * support for ISPC
  * exctend CUDA language support for Clang
  * extend cmake-file-ap "codemodel"
  * cli --install supports --default-directory-permissions
  * cli supports creating hardlinks
  * CMake GUI now has an environment variable editor
  * Multiple cmake commands support new options and subcommands
  * Multiple variables added or functionalities extended
  * Multiple new modules and added functionality to existing modules
  * Compatibility with versions of CMake older than 2.8.12 is now
    deprecated and will be removed from a future version. Calls to
    cmake_minimum_required() or cmake_policy() that set the policy
    version to an older value now issue a deprecation diagnostic.
  * cmake-gui now requires Qt5
- cmake 3.18.4:
  * no upstream changelog
- update to 3.18.3:
  * The Compile Features functionality was updated for MSVC 19.28
- reapply this change (bsc#1174581):
  * Fix setting CMAKE_INSTALL_LIBDIR in cmake macro
  * This is a relative path, see `cmake --help-module GNUInstallDirs`
  see also
  https://gitlab.kitware.com/cmake/cmake/-/issues/20250
  https://github.com/arvidn/libtorrent/issues/5125#issuecomment-691559244
- update to 3.18.2:
  * The default value of :variable:`CMAKE_AUTOMOC_PATH_PREFIX` was changed to
  ``OFF`` because this feature can break existing projects that have
  identically named header files in different include directories.
  This restores compatibility with behavior of CMake 3.15 and below.
  * The :manual:`Compile Features &lt;cmake-compile-features(7)&gt;` functionality
  was updated for MSVC 19.27 as mentioned above.
- cmake 3.18.1:
  * Revert undocumented fix in 3.18.0 in the add_test() command
    for special characters to avoid breaking existing projects that
    worked around the issue. Will be reintroduced later
- drop no-system-nghttp2.patch, upstream
- Install the rpm provides handler to the correct location
  (%{_rpmconfigdir, not %{_libexecdir}).
- update to cmake 3.18.0
  * The “CUDA” language can now be compiled using Clang on non-Windows platforms.
  * “cmake(1)” gained support for profiling of CMake scripts
  * The “cmake_language()” command was added for meta-operations on
    scripted or built-in commands, starting with a mode to “CALL” other
    commands, and “EVAL CODE” to inplace evaluate a CMake script.
  * The “find_program()”, “find_library()”, “find_path()” and
    “find_file()” commands gained a new “REQUIRED” option that will stop
    processing with an error message if nothing is found.
  * The “CheckLinkerFlag” module has been added to provide a facility to
    check validity of link flags.
  * “ccmake(1)” learned to read a “CCMAKE_COLORS” environment variable
    to customize colors.
- Drop patch lua54.patch, it became part of upstream
- Udjust patch cmake-fix-ruby-test.patch
- Add patch no-system-nghttp2.patch which will become part of 3.18.1
  to disable nghttp2 from system for cmake-mini
- Add lua54.patch which adds 5.4 among allowed versions of
  Lua interpreter.
  (https://gitlab.kitware.com/cmake/cmake/-/issues/20933)
- Use plain autosetup
- DCMAKE_MODULES_INSTALL_DIR should be %{_libdir}/cmake/%{name}
- Set CMAKE_INSTALL_LIBEXECDIR=%{_libexecdir}
- Use -DCMAKE_SKIP_INSTALL_RPATHS:BOOL=ON instead of completely
  removing rpaths. boo#1172331
- cmake 3.17.3:
  * Selection of the Objective C or C++ compiler now considers the
    CC or CXX environment variable if the OBJC or OBJCXX
    environment variable is not set
  * The FindPkgConfig module now extracts include directories
    prefixed with -isystem into the *_INCLUDE_DIRS variables and
    INTERFACE_INCLUDE_DIRECTORIES target properties
  * FindOpenSSL: Detect OpenSSL 3.0.0 (bsc#1172267)
- cmake 3.17.2:
  * fixes dealing with boost 1.73
- Add cmake-fix-png-include-dir.patch to fix the png include dir
  search.
- cmake 3.17.1:
  * The :cpack_gen:`CPack NSIS Generator` now requires NSIS 3.0 or later</changelog>
</package>
<package pkgid="0c715b5a0f3c81798ced257a2bf89b7b9a0a39c1f53af40f11d0e118953e4107" name="cmake3" arch="src">
  <version epoch="0" ver="3.20.0" rel="150200.6.3.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1567598400">- cmake 3.15.3:
  * CrayPrgEnv compiler wrapper support updated for 19.06
- includes changes from 3.15.2:
  * Fix CMAKE_FIND_PACKAGE_PREFER_CONFIG variable causing the
    find_package() command to fail on a missing package even
    without the REQUIRED option</changelog>
  <changelog author="sflees@suse.de" date="1572177600">- cmake 3.15.4
  * In CMake 3.15.0 through 3.15.3, the EXCLUDE_FROM_ALL directory
    property was regressed from pre-3.14 behavior and caused targets
    within the directory to be excluded even from its own “all”.
    This has been fixed. The bug also existed in 3.14.0 through
    3.14.6 and is fixed in 3.14.7.
- Use pkgconfig for dependencies where possible (required due to
  tumbleweed build changes)</changelog>
  <changelog author="tchvatal@suse.com" date="1572609600">- Update cmake conditionals to make sure the multibuild is
  nicely leveraged</changelog>
  <changelog author="simonf.lees@suse.com" date="1572955200">- Drop debug patch (never in factory) and update patch numbers</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1573387200">- cmake 3.15.5:
  * no changelog available</changelog>
  <changelog author="mpluskal@suse.com" date="1573646400">- Switch back to libcurl-mini-devel to avoid new build cycle</changelog>
  <changelog author="foss@grueninger.de" date="1574769600">- update to CMake 3.16
  Changelog see https://blog.kitware.com/cmake-3-16-0-available-for-download/
- drop patch form.patch, fixed upstream</changelog>
  <changelog author="sflees@suse.de" date="1574856000">- Fix numbering of patches.</changelog>
  <changelog author="foss@grueninger.de" date="1576843200">- update to CMAke 3.16.2
  * FindBLAS: Consider OpenBLAS with thread libraries only with C or CXX
  * FindBoost: Add support for Boost 1.72
  * FindLAPACK: Fix support for LAPACK symbols inside BLAS libraries
  Full changelog see https://blog.kitware.com/cmake-3-16-2-available-for-download/</changelog>
  <changelog author="asn@cryptomilk.org" date="1579003200">- Fix setting CMAKE_INSTALL_LIBDIR in cmake macro
  * This is a relative path, see `cmake --help-module GNUInstallDirs`
- Do NOT set -DCMAKE_SKIP_RPATH:BOOL=OFF
  * A lot of applications have private libraries in a subdirectory
    and require linking with RPATH which is totally valid.</changelog>
  <changelog author="junghans@votca.org" date="1579003201">- use cmake generics in marcos.cmake</changelog>
  <changelog author="tchvatal@suse.com" date="1580904000">- Add new -mini flavor in order to break up cycles
  * make sure the default cmake links now all system libraries
    and mini uses bundled stuff as needed
- Switch to python3 variant of Sphinx on the manpage/docu creation</changelog>
  <changelog author="sflees@suse.de" date="1581076800">- Revert "use cmake generics in marcos.cmake" it breaks many
  cases in stagings.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1581336000">- Revert LIBDIR change in macros - it is inconsistent (all other
  INSTALL_&lt;dir&gt;s use absolute paths), unneeded (paths may be
  absolute or relative), and breaks a number of packages.
- Update minimum libarchive version, &gt;= 3.3.3.
- Do not flag macros as config file.
- Adjust constraints (7G disk space is required, independent
  of architecture).</changelog>
  <changelog author="dimstar@opensuse.org" date="1582113600">- Change cmake to be a meta-package that requires
  cmake-implementation. This new symbol is provided by the (newly
  named) cmake-full package as well as cmake-mini.
- This is needed as the original attempt of using Substitute in OBS
  actually rewrites the used spec files on disk, not only on the
  fly and we ended up with packages Requiring cmake-mini (which is
  not installable on end user systems).</changelog>
  <changelog author="foss@grueninger.de" date="1584878400">- update to 3.17.0
  * cmake(1) gained a “Ninja Multi-Config” generator, which
    can be used to build multiple configurations at once.
  * cmake(1) gained a “–debug-find” command-line option to
    enable additional human-readable output on where find
    commands search.
  * Target link properties are now transitive over
    private dependencies on static libraries. See policy “CMP0099”.
  * cmake(1) gained a “-E rm” command-line tool that can
    be used to remove directories and files.
  Full changelog see
  https://blog.kitware.com/cmake-3-17-0-available-for-download/</changelog>
  <changelog author="sflees@suse.de" date="1584964800">- Many Leap packages don't build without -DCMAKE_SKIP_RPATH:BOOL=ON
  so leave this change to the next major version of Leap / SLE</changelog>
  <changelog author="sflees@suse.de" date="1585224000">- Fix mistake in previous change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628251200">- copypac from SLE-15, because of Firefox91 (bsc#1188891)
  (Dependency chain: cmake3 -&gt; Rust -&gt; Firefox)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718366400">- Needed for Firefox 128 (bsc#1226316)
  (Dependency chain: cmake3 -&gt; Rust1.78 -&gt; Firefox)
- Update to 3.20.0
  * The “cmake_path()” command was added for operations on
    filesystem paths.
  * The “target_sources()” command now supports targets created
    by the “add_custom_target()” command.
  * The “ExternalProject” module “ExternalProject_Add()” function
    gained a “CONFIGURE_HANDLED_BY_BUILD” option.
  * “ctest(1)” gained a “–test-dir” option to specify the directory
    in which to look for tests.
- update to 3.19.7:
  * With :ref:`Visual Studio Generators` for VS 2017 and higher, the
    :variable:`CMAKE_GENERATOR_TOOLSET` field ``version=`` now accepts
    three-component MSVC toolset versions such as ``14.28.29910``.
    See the :variable:`CMAKE_VS_PLATFORM_TOOLSET_VERSION` variable.
- cmake 3.19.6:
  * The cmake-presets(7) feature no longer allows comments in
    CMakePresets.json or CMakeUserPresets.json files. This was
    mistakenly allowed by the implementation in 3.19.0 to 3.19.5
- Update to CMake 3.19.5
  * FindBoost: Add support for Boost 1.75
  * FindCUDAToolkit: Restore use of CUDA_PATH environment variable
- A quick note that tumbleweed isn't affeted by bsc#1181680 which
  is being fixed for SLE.
- cmake 3.19.4:
  * fixes for other platforms
- cmake 3.19.3:
  * FetchContent: Relative SOURCE_DIR override cannot be a hard error
  * FindMPI: remove single quotes from include path
  * FindHDF5: Fix finding both debug and release libs
  * cmake-gui: Restore linking of Qt resources
  * cmMakefile: Don't expand bracket arguments in --trace-expand
- update to 3.19.2:
  * various Apple-Silicon support fixes
  * The CMAKE_ISPC_HEADER_SUFFIX variable and corresponding ISPC_HEADER_SUFFIX
  target property were added to control the header suffix used by ISPC
  compiler generated headers.
- remove 5556.patch (upstream)
- Add 5556.patch: export: Do not fail generation for separate
  namelink only case. Fixes regression, blocking other packages
  from build,
- cmake 3.19.1:
  * avoid breaking projects relying on using the LANGUAGE property
    to cause the specified language's compiler to be used
  * CUDA 11.1 support for Clang.
- cmake 3.19.0:
  * cmake(1) and cmake-gui(1) now recognize CMakePresets.json and
    CMakeUserPresets.json files
  * support for ISPC
  * exctend CUDA language support for Clang
  * extend cmake-file-ap "codemodel"
  * cli --install supports --default-directory-permissions
  * cli supports creating hardlinks
  * CMake GUI now has an environment variable editor
  * Multiple cmake commands support new options and subcommands
  * Multiple variables added or functionalities extended
  * Multiple new modules and added functionality to existing modules
  * Compatibility with versions of CMake older than 2.8.12 is now
    deprecated and will be removed from a future version. Calls to
    cmake_minimum_required() or cmake_policy() that set the policy
    version to an older value now issue a deprecation diagnostic.
  * cmake-gui now requires Qt5
- cmake 3.18.4:
  * no upstream changelog
- update to 3.18.3:
  * The Compile Features functionality was updated for MSVC 19.28
- reapply this change (bsc#1174581):
  * Fix setting CMAKE_INSTALL_LIBDIR in cmake macro
  * This is a relative path, see `cmake --help-module GNUInstallDirs`
  see also
  https://gitlab.kitware.com/cmake/cmake/-/issues/20250
  https://github.com/arvidn/libtorrent/issues/5125#issuecomment-691559244
- update to 3.18.2:
  * The default value of :variable:`CMAKE_AUTOMOC_PATH_PREFIX` was changed to
  ``OFF`` because this feature can break existing projects that have
  identically named header files in different include directories.
  This restores compatibility with behavior of CMake 3.15 and below.
  * The :manual:`Compile Features &lt;cmake-compile-features(7)&gt;` functionality
  was updated for MSVC 19.27 as mentioned above.
- cmake 3.18.1:
  * Revert undocumented fix in 3.18.0 in the add_test() command
    for special characters to avoid breaking existing projects that
    worked around the issue. Will be reintroduced later
- drop no-system-nghttp2.patch, upstream
- Install the rpm provides handler to the correct location
  (%{_rpmconfigdir, not %{_libexecdir}).
- update to cmake 3.18.0
  * The “CUDA” language can now be compiled using Clang on non-Windows platforms.
  * “cmake(1)” gained support for profiling of CMake scripts
  * The “cmake_language()” command was added for meta-operations on
    scripted or built-in commands, starting with a mode to “CALL” other
    commands, and “EVAL CODE” to inplace evaluate a CMake script.
  * The “find_program()”, “find_library()”, “find_path()” and
    “find_file()” commands gained a new “REQUIRED” option that will stop
    processing with an error message if nothing is found.
  * The “CheckLinkerFlag” module has been added to provide a facility to
    check validity of link flags.
  * “ccmake(1)” learned to read a “CCMAKE_COLORS” environment variable
    to customize colors.
- Drop patch lua54.patch, it became part of upstream
- Udjust patch cmake-fix-ruby-test.patch
- Add patch no-system-nghttp2.patch which will become part of 3.18.1
  to disable nghttp2 from system for cmake-mini
- Add lua54.patch which adds 5.4 among allowed versions of
  Lua interpreter.
  (https://gitlab.kitware.com/cmake/cmake/-/issues/20933)
- Use plain autosetup
- DCMAKE_MODULES_INSTALL_DIR should be %{_libdir}/cmake/%{name}
- Set CMAKE_INSTALL_LIBEXECDIR=%{_libexecdir}
- Use -DCMAKE_SKIP_INSTALL_RPATHS:BOOL=ON instead of completely
  removing rpaths. boo#1172331
- cmake 3.17.3:
  * Selection of the Objective C or C++ compiler now considers the
    CC or CXX environment variable if the OBJC or OBJCXX
    environment variable is not set
  * The FindPkgConfig module now extracts include directories
    prefixed with -isystem into the *_INCLUDE_DIRS variables and
    INTERFACE_INCLUDE_DIRECTORIES target properties
  * FindOpenSSL: Detect OpenSSL 3.0.0 (bsc#1172267)
- cmake 3.17.2:
  * fixes dealing with boost 1.73
- Add cmake-fix-png-include-dir.patch to fix the png include dir
  search.
- cmake 3.17.1:
  * The :cpack_gen:`CPack NSIS Generator` now requires NSIS 3.0 or later</changelog>
</package>
<package pkgid="930d5d446c50ed4e4c213be46951eb1ef569ffb150ef7351d711d2220c137d3d" name="cmake3" arch="x86_64">
  <version epoch="0" ver="3.20.0" rel="150200.6.3.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1567598400">- cmake 3.15.3:
  * CrayPrgEnv compiler wrapper support updated for 19.06
- includes changes from 3.15.2:
  * Fix CMAKE_FIND_PACKAGE_PREFER_CONFIG variable causing the
    find_package() command to fail on a missing package even
    without the REQUIRED option</changelog>
  <changelog author="sflees@suse.de" date="1572177600">- cmake 3.15.4
  * In CMake 3.15.0 through 3.15.3, the EXCLUDE_FROM_ALL directory
    property was regressed from pre-3.14 behavior and caused targets
    within the directory to be excluded even from its own “all”.
    This has been fixed. The bug also existed in 3.14.0 through
    3.14.6 and is fixed in 3.14.7.
- Use pkgconfig for dependencies where possible (required due to
  tumbleweed build changes)</changelog>
  <changelog author="tchvatal@suse.com" date="1572609600">- Update cmake conditionals to make sure the multibuild is
  nicely leveraged</changelog>
  <changelog author="simonf.lees@suse.com" date="1572955200">- Drop debug patch (never in factory) and update patch numbers</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1573387200">- cmake 3.15.5:
  * no changelog available</changelog>
  <changelog author="mpluskal@suse.com" date="1573646400">- Switch back to libcurl-mini-devel to avoid new build cycle</changelog>
  <changelog author="foss@grueninger.de" date="1574769600">- update to CMake 3.16
  Changelog see https://blog.kitware.com/cmake-3-16-0-available-for-download/
- drop patch form.patch, fixed upstream</changelog>
  <changelog author="sflees@suse.de" date="1574856000">- Fix numbering of patches.</changelog>
  <changelog author="foss@grueninger.de" date="1576843200">- update to CMAke 3.16.2
  * FindBLAS: Consider OpenBLAS with thread libraries only with C or CXX
  * FindBoost: Add support for Boost 1.72
  * FindLAPACK: Fix support for LAPACK symbols inside BLAS libraries
  Full changelog see https://blog.kitware.com/cmake-3-16-2-available-for-download/</changelog>
  <changelog author="asn@cryptomilk.org" date="1579003200">- Fix setting CMAKE_INSTALL_LIBDIR in cmake macro
  * This is a relative path, see `cmake --help-module GNUInstallDirs`
- Do NOT set -DCMAKE_SKIP_RPATH:BOOL=OFF
  * A lot of applications have private libraries in a subdirectory
    and require linking with RPATH which is totally valid.</changelog>
  <changelog author="junghans@votca.org" date="1579003201">- use cmake generics in marcos.cmake</changelog>
  <changelog author="tchvatal@suse.com" date="1580904000">- Add new -mini flavor in order to break up cycles
  * make sure the default cmake links now all system libraries
    and mini uses bundled stuff as needed
- Switch to python3 variant of Sphinx on the manpage/docu creation</changelog>
  <changelog author="sflees@suse.de" date="1581076800">- Revert "use cmake generics in marcos.cmake" it breaks many
  cases in stagings.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1581336000">- Revert LIBDIR change in macros - it is inconsistent (all other
  INSTALL_&lt;dir&gt;s use absolute paths), unneeded (paths may be
  absolute or relative), and breaks a number of packages.
- Update minimum libarchive version, &gt;= 3.3.3.
- Do not flag macros as config file.
- Adjust constraints (7G disk space is required, independent
  of architecture).</changelog>
  <changelog author="dimstar@opensuse.org" date="1582113600">- Change cmake to be a meta-package that requires
  cmake-implementation. This new symbol is provided by the (newly
  named) cmake-full package as well as cmake-mini.
- This is needed as the original attempt of using Substitute in OBS
  actually rewrites the used spec files on disk, not only on the
  fly and we ended up with packages Requiring cmake-mini (which is
  not installable on end user systems).</changelog>
  <changelog author="foss@grueninger.de" date="1584878400">- update to 3.17.0
  * cmake(1) gained a “Ninja Multi-Config” generator, which
    can be used to build multiple configurations at once.
  * cmake(1) gained a “–debug-find” command-line option to
    enable additional human-readable output on where find
    commands search.
  * Target link properties are now transitive over
    private dependencies on static libraries. See policy “CMP0099”.
  * cmake(1) gained a “-E rm” command-line tool that can
    be used to remove directories and files.
  Full changelog see
  https://blog.kitware.com/cmake-3-17-0-available-for-download/</changelog>
  <changelog author="sflees@suse.de" date="1584964800">- Many Leap packages don't build without -DCMAKE_SKIP_RPATH:BOOL=ON
  so leave this change to the next major version of Leap / SLE</changelog>
  <changelog author="sflees@suse.de" date="1585224000">- Fix mistake in previous change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628251200">- copypac from SLE-15, because of Firefox91 (bsc#1188891)
  (Dependency chain: cmake3 -&gt; Rust -&gt; Firefox)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718366400">- Needed for Firefox 128 (bsc#1226316)
  (Dependency chain: cmake3 -&gt; Rust1.78 -&gt; Firefox)
- Update to 3.20.0
  * The “cmake_path()” command was added for operations on
    filesystem paths.
  * The “target_sources()” command now supports targets created
    by the “add_custom_target()” command.
  * The “ExternalProject” module “ExternalProject_Add()” function
    gained a “CONFIGURE_HANDLED_BY_BUILD” option.
  * “ctest(1)” gained a “–test-dir” option to specify the directory
    in which to look for tests.
- update to 3.19.7:
  * With :ref:`Visual Studio Generators` for VS 2017 and higher, the
    :variable:`CMAKE_GENERATOR_TOOLSET` field ``version=`` now accepts
    three-component MSVC toolset versions such as ``14.28.29910``.
    See the :variable:`CMAKE_VS_PLATFORM_TOOLSET_VERSION` variable.
- cmake 3.19.6:
  * The cmake-presets(7) feature no longer allows comments in
    CMakePresets.json or CMakeUserPresets.json files. This was
    mistakenly allowed by the implementation in 3.19.0 to 3.19.5
- Update to CMake 3.19.5
  * FindBoost: Add support for Boost 1.75
  * FindCUDAToolkit: Restore use of CUDA_PATH environment variable
- A quick note that tumbleweed isn't affeted by bsc#1181680 which
  is being fixed for SLE.
- cmake 3.19.4:
  * fixes for other platforms
- cmake 3.19.3:
  * FetchContent: Relative SOURCE_DIR override cannot be a hard error
  * FindMPI: remove single quotes from include path
  * FindHDF5: Fix finding both debug and release libs
  * cmake-gui: Restore linking of Qt resources
  * cmMakefile: Don't expand bracket arguments in --trace-expand
- update to 3.19.2:
  * various Apple-Silicon support fixes
  * The CMAKE_ISPC_HEADER_SUFFIX variable and corresponding ISPC_HEADER_SUFFIX
  target property were added to control the header suffix used by ISPC
  compiler generated headers.
- remove 5556.patch (upstream)
- Add 5556.patch: export: Do not fail generation for separate
  namelink only case. Fixes regression, blocking other packages
  from build,
- cmake 3.19.1:
  * avoid breaking projects relying on using the LANGUAGE property
    to cause the specified language's compiler to be used
  * CUDA 11.1 support for Clang.
- cmake 3.19.0:
  * cmake(1) and cmake-gui(1) now recognize CMakePresets.json and
    CMakeUserPresets.json files
  * support for ISPC
  * exctend CUDA language support for Clang
  * extend cmake-file-ap "codemodel"
  * cli --install supports --default-directory-permissions
  * cli supports creating hardlinks
  * CMake GUI now has an environment variable editor
  * Multiple cmake commands support new options and subcommands
  * Multiple variables added or functionalities extended
  * Multiple new modules and added functionality to existing modules
  * Compatibility with versions of CMake older than 2.8.12 is now
    deprecated and will be removed from a future version. Calls to
    cmake_minimum_required() or cmake_policy() that set the policy
    version to an older value now issue a deprecation diagnostic.
  * cmake-gui now requires Qt5
- cmake 3.18.4:
  * no upstream changelog
- update to 3.18.3:
  * The Compile Features functionality was updated for MSVC 19.28
- reapply this change (bsc#1174581):
  * Fix setting CMAKE_INSTALL_LIBDIR in cmake macro
  * This is a relative path, see `cmake --help-module GNUInstallDirs`
  see also
  https://gitlab.kitware.com/cmake/cmake/-/issues/20250
  https://github.com/arvidn/libtorrent/issues/5125#issuecomment-691559244
- update to 3.18.2:
  * The default value of :variable:`CMAKE_AUTOMOC_PATH_PREFIX` was changed to
  ``OFF`` because this feature can break existing projects that have
  identically named header files in different include directories.
  This restores compatibility with behavior of CMake 3.15 and below.
  * The :manual:`Compile Features &lt;cmake-compile-features(7)&gt;` functionality
  was updated for MSVC 19.27 as mentioned above.
- cmake 3.18.1:
  * Revert undocumented fix in 3.18.0 in the add_test() command
    for special characters to avoid breaking existing projects that
    worked around the issue. Will be reintroduced later
- drop no-system-nghttp2.patch, upstream
- Install the rpm provides handler to the correct location
  (%{_rpmconfigdir, not %{_libexecdir}).
- update to cmake 3.18.0
  * The “CUDA” language can now be compiled using Clang on non-Windows platforms.
  * “cmake(1)” gained support for profiling of CMake scripts
  * The “cmake_language()” command was added for meta-operations on
    scripted or built-in commands, starting with a mode to “CALL” other
    commands, and “EVAL CODE” to inplace evaluate a CMake script.
  * The “find_program()”, “find_library()”, “find_path()” and
    “find_file()” commands gained a new “REQUIRED” option that will stop
    processing with an error message if nothing is found.
  * The “CheckLinkerFlag” module has been added to provide a facility to
    check validity of link flags.
  * “ccmake(1)” learned to read a “CCMAKE_COLORS” environment variable
    to customize colors.
- Drop patch lua54.patch, it became part of upstream
- Udjust patch cmake-fix-ruby-test.patch
- Add patch no-system-nghttp2.patch which will become part of 3.18.1
  to disable nghttp2 from system for cmake-mini
- Add lua54.patch which adds 5.4 among allowed versions of
  Lua interpreter.
  (https://gitlab.kitware.com/cmake/cmake/-/issues/20933)
- Use plain autosetup
- DCMAKE_MODULES_INSTALL_DIR should be %{_libdir}/cmake/%{name}
- Set CMAKE_INSTALL_LIBEXECDIR=%{_libexecdir}
- Use -DCMAKE_SKIP_INSTALL_RPATHS:BOOL=ON instead of completely
  removing rpaths. boo#1172331
- cmake 3.17.3:
  * Selection of the Objective C or C++ compiler now considers the
    CC or CXX environment variable if the OBJC or OBJCXX
    environment variable is not set
  * The FindPkgConfig module now extracts include directories
    prefixed with -isystem into the *_INCLUDE_DIRS variables and
    INTERFACE_INCLUDE_DIRECTORIES target properties
  * FindOpenSSL: Detect OpenSSL 3.0.0 (bsc#1172267)
- cmake 3.17.2:
  * fixes dealing with boost 1.73
- Add cmake-fix-png-include-dir.patch to fix the png include dir
  search.
- cmake 3.17.1:
  * The :cpack_gen:`CPack NSIS Generator` now requires NSIS 3.0 or later</changelog>
</package>
<package pkgid="3d0ba1c1265b4769b22524184147475e7a95f6544b0c295be89b4154f3286e80" name="cmake3-full" arch="aarch64">
  <version epoch="0" ver="3.20.0" rel="150200.6.3.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1567598400">- cmake 3.15.3:
  * CrayPrgEnv compiler wrapper support updated for 19.06
- includes changes from 3.15.2:
  * Fix CMAKE_FIND_PACKAGE_PREFER_CONFIG variable causing the
    find_package() command to fail on a missing package even
    without the REQUIRED option</changelog>
  <changelog author="sflees@suse.de" date="1572177600">- cmake 3.15.4
  * In CMake 3.15.0 through 3.15.3, the EXCLUDE_FROM_ALL directory
    property was regressed from pre-3.14 behavior and caused targets
    within the directory to be excluded even from its own “all”.
    This has been fixed. The bug also existed in 3.14.0 through
    3.14.6 and is fixed in 3.14.7.
- Use pkgconfig for dependencies where possible (required due to
  tumbleweed build changes)</changelog>
  <changelog author="tchvatal@suse.com" date="1572609600">- Update cmake conditionals to make sure the multibuild is
  nicely leveraged</changelog>
  <changelog author="simonf.lees@suse.com" date="1572955200">- Drop debug patch (never in factory) and update patch numbers</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1573387200">- cmake 3.15.5:
  * no changelog available</changelog>
  <changelog author="mpluskal@suse.com" date="1573646400">- Switch back to libcurl-mini-devel to avoid new build cycle</changelog>
  <changelog author="foss@grueninger.de" date="1574769600">- update to CMake 3.16
  Changelog see https://blog.kitware.com/cmake-3-16-0-available-for-download/
- drop patch form.patch, fixed upstream</changelog>
  <changelog author="sflees@suse.de" date="1574856000">- Fix numbering of patches.</changelog>
  <changelog author="foss@grueninger.de" date="1576843200">- update to CMAke 3.16.2
  * FindBLAS: Consider OpenBLAS with thread libraries only with C or CXX
  * FindBoost: Add support for Boost 1.72
  * FindLAPACK: Fix support for LAPACK symbols inside BLAS libraries
  Full changelog see https://blog.kitware.com/cmake-3-16-2-available-for-download/</changelog>
  <changelog author="asn@cryptomilk.org" date="1579003200">- Fix setting CMAKE_INSTALL_LIBDIR in cmake macro
  * This is a relative path, see `cmake --help-module GNUInstallDirs`
- Do NOT set -DCMAKE_SKIP_RPATH:BOOL=OFF
  * A lot of applications have private libraries in a subdirectory
    and require linking with RPATH which is totally valid.</changelog>
  <changelog author="junghans@votca.org" date="1579003201">- use cmake generics in marcos.cmake</changelog>
  <changelog author="tchvatal@suse.com" date="1580904000">- Add new -mini flavor in order to break up cycles
  * make sure the default cmake links now all system libraries
    and mini uses bundled stuff as needed
- Switch to python3 variant of Sphinx on the manpage/docu creation</changelog>
  <changelog author="sflees@suse.de" date="1581076800">- Revert "use cmake generics in marcos.cmake" it breaks many
  cases in stagings.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1581336000">- Revert LIBDIR change in macros - it is inconsistent (all other
  INSTALL_&lt;dir&gt;s use absolute paths), unneeded (paths may be
  absolute or relative), and breaks a number of packages.
- Update minimum libarchive version, &gt;= 3.3.3.
- Do not flag macros as config file.
- Adjust constraints (7G disk space is required, independent
  of architecture).</changelog>
  <changelog author="dimstar@opensuse.org" date="1582113600">- Change cmake to be a meta-package that requires
  cmake-implementation. This new symbol is provided by the (newly
  named) cmake-full package as well as cmake-mini.
- This is needed as the original attempt of using Substitute in OBS
  actually rewrites the used spec files on disk, not only on the
  fly and we ended up with packages Requiring cmake-mini (which is
  not installable on end user systems).</changelog>
  <changelog author="foss@grueninger.de" date="1584878400">- update to 3.17.0
  * cmake(1) gained a “Ninja Multi-Config” generator, which
    can be used to build multiple configurations at once.
  * cmake(1) gained a “–debug-find” command-line option to
    enable additional human-readable output on where find
    commands search.
  * Target link properties are now transitive over
    private dependencies on static libraries. See policy “CMP0099”.
  * cmake(1) gained a “-E rm” command-line tool that can
    be used to remove directories and files.
  Full changelog see
  https://blog.kitware.com/cmake-3-17-0-available-for-download/</changelog>
  <changelog author="sflees@suse.de" date="1584964800">- Many Leap packages don't build without -DCMAKE_SKIP_RPATH:BOOL=ON
  so leave this change to the next major version of Leap / SLE</changelog>
  <changelog author="sflees@suse.de" date="1585224000">- Fix mistake in previous change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628251200">- copypac from SLE-15, because of Firefox91 (bsc#1188891)
  (Dependency chain: cmake3 -&gt; Rust -&gt; Firefox)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718366400">- Needed for Firefox 128 (bsc#1226316)
  (Dependency chain: cmake3 -&gt; Rust1.78 -&gt; Firefox)
- Update to 3.20.0
  * The “cmake_path()” command was added for operations on
    filesystem paths.
  * The “target_sources()” command now supports targets created
    by the “add_custom_target()” command.
  * The “ExternalProject” module “ExternalProject_Add()” function
    gained a “CONFIGURE_HANDLED_BY_BUILD” option.
  * “ctest(1)” gained a “–test-dir” option to specify the directory
    in which to look for tests.
- update to 3.19.7:
  * With :ref:`Visual Studio Generators` for VS 2017 and higher, the
    :variable:`CMAKE_GENERATOR_TOOLSET` field ``version=`` now accepts
    three-component MSVC toolset versions such as ``14.28.29910``.
    See the :variable:`CMAKE_VS_PLATFORM_TOOLSET_VERSION` variable.
- cmake 3.19.6:
  * The cmake-presets(7) feature no longer allows comments in
    CMakePresets.json or CMakeUserPresets.json files. This was
    mistakenly allowed by the implementation in 3.19.0 to 3.19.5
- Update to CMake 3.19.5
  * FindBoost: Add support for Boost 1.75
  * FindCUDAToolkit: Restore use of CUDA_PATH environment variable
- A quick note that tumbleweed isn't affeted by bsc#1181680 which
  is being fixed for SLE.
- cmake 3.19.4:
  * fixes for other platforms
- cmake 3.19.3:
  * FetchContent: Relative SOURCE_DIR override cannot be a hard error
  * FindMPI: remove single quotes from include path
  * FindHDF5: Fix finding both debug and release libs
  * cmake-gui: Restore linking of Qt resources
  * cmMakefile: Don't expand bracket arguments in --trace-expand
- update to 3.19.2:
  * various Apple-Silicon support fixes
  * The CMAKE_ISPC_HEADER_SUFFIX variable and corresponding ISPC_HEADER_SUFFIX
  target property were added to control the header suffix used by ISPC
  compiler generated headers.
- remove 5556.patch (upstream)
- Add 5556.patch: export: Do not fail generation for separate
  namelink only case. Fixes regression, blocking other packages
  from build,
- cmake 3.19.1:
  * avoid breaking projects relying on using the LANGUAGE property
    to cause the specified language's compiler to be used
  * CUDA 11.1 support for Clang.
- cmake 3.19.0:
  * cmake(1) and cmake-gui(1) now recognize CMakePresets.json and
    CMakeUserPresets.json files
  * support for ISPC
  * exctend CUDA language support for Clang
  * extend cmake-file-ap "codemodel"
  * cli --install supports --default-directory-permissions
  * cli supports creating hardlinks
  * CMake GUI now has an environment variable editor
  * Multiple cmake commands support new options and subcommands
  * Multiple variables added or functionalities extended
  * Multiple new modules and added functionality to existing modules
  * Compatibility with versions of CMake older than 2.8.12 is now
    deprecated and will be removed from a future version. Calls to
    cmake_minimum_required() or cmake_policy() that set the policy
    version to an older value now issue a deprecation diagnostic.
  * cmake-gui now requires Qt5
- cmake 3.18.4:
  * no upstream changelog
- update to 3.18.3:
  * The Compile Features functionality was updated for MSVC 19.28
- reapply this change (bsc#1174581):
  * Fix setting CMAKE_INSTALL_LIBDIR in cmake macro
  * This is a relative path, see `cmake --help-module GNUInstallDirs`
  see also
  https://gitlab.kitware.com/cmake/cmake/-/issues/20250
  https://github.com/arvidn/libtorrent/issues/5125#issuecomment-691559244
- update to 3.18.2:
  * The default value of :variable:`CMAKE_AUTOMOC_PATH_PREFIX` was changed to
  ``OFF`` because this feature can break existing projects that have
  identically named header files in different include directories.
  This restores compatibility with behavior of CMake 3.15 and below.
  * The :manual:`Compile Features &lt;cmake-compile-features(7)&gt;` functionality
  was updated for MSVC 19.27 as mentioned above.
- cmake 3.18.1:
  * Revert undocumented fix in 3.18.0 in the add_test() command
    for special characters to avoid breaking existing projects that
    worked around the issue. Will be reintroduced later
- drop no-system-nghttp2.patch, upstream
- Install the rpm provides handler to the correct location
  (%{_rpmconfigdir, not %{_libexecdir}).
- update to cmake 3.18.0
  * The “CUDA” language can now be compiled using Clang on non-Windows platforms.
  * “cmake(1)” gained support for profiling of CMake scripts
  * The “cmake_language()” command was added for meta-operations on
    scripted or built-in commands, starting with a mode to “CALL” other
    commands, and “EVAL CODE” to inplace evaluate a CMake script.
  * The “find_program()”, “find_library()”, “find_path()” and
    “find_file()” commands gained a new “REQUIRED” option that will stop
    processing with an error message if nothing is found.
  * The “CheckLinkerFlag” module has been added to provide a facility to
    check validity of link flags.
  * “ccmake(1)” learned to read a “CCMAKE_COLORS” environment variable
    to customize colors.
- Drop patch lua54.patch, it became part of upstream
- Udjust patch cmake-fix-ruby-test.patch
- Add patch no-system-nghttp2.patch which will become part of 3.18.1
  to disable nghttp2 from system for cmake-mini
- Add lua54.patch which adds 5.4 among allowed versions of
  Lua interpreter.
  (https://gitlab.kitware.com/cmake/cmake/-/issues/20933)
- Use plain autosetup
- DCMAKE_MODULES_INSTALL_DIR should be %{_libdir}/cmake/%{name}
- Set CMAKE_INSTALL_LIBEXECDIR=%{_libexecdir}
- Use -DCMAKE_SKIP_INSTALL_RPATHS:BOOL=ON instead of completely
  removing rpaths. boo#1172331
- cmake 3.17.3:
  * Selection of the Objective C or C++ compiler now considers the
    CC or CXX environment variable if the OBJC or OBJCXX
    environment variable is not set
  * The FindPkgConfig module now extracts include directories
    prefixed with -isystem into the *_INCLUDE_DIRS variables and
    INTERFACE_INCLUDE_DIRECTORIES target properties
  * FindOpenSSL: Detect OpenSSL 3.0.0 (bsc#1172267)
- cmake 3.17.2:
  * fixes dealing with boost 1.73
- Add cmake-fix-png-include-dir.patch to fix the png include dir
  search.
- cmake 3.17.1:
  * The :cpack_gen:`CPack NSIS Generator` now requires NSIS 3.0 or later</changelog>
</package>
<package pkgid="d110a1e0f8308ddb618a1c92e059e7a4d288628a3d94c6897b0d2df059dc46c1" name="cmake3-full" arch="ppc64le">
  <version epoch="0" ver="3.20.0" rel="150200.6.3.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1567598400">- cmake 3.15.3:
  * CrayPrgEnv compiler wrapper support updated for 19.06
- includes changes from 3.15.2:
  * Fix CMAKE_FIND_PACKAGE_PREFER_CONFIG variable causing the
    find_package() command to fail on a missing package even
    without the REQUIRED option</changelog>
  <changelog author="sflees@suse.de" date="1572177600">- cmake 3.15.4
  * In CMake 3.15.0 through 3.15.3, the EXCLUDE_FROM_ALL directory
    property was regressed from pre-3.14 behavior and caused targets
    within the directory to be excluded even from its own “all”.
    This has been fixed. The bug also existed in 3.14.0 through
    3.14.6 and is fixed in 3.14.7.
- Use pkgconfig for dependencies where possible (required due to
  tumbleweed build changes)</changelog>
  <changelog author="tchvatal@suse.com" date="1572609600">- Update cmake conditionals to make sure the multibuild is
  nicely leveraged</changelog>
  <changelog author="simonf.lees@suse.com" date="1572955200">- Drop debug patch (never in factory) and update patch numbers</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1573387200">- cmake 3.15.5:
  * no changelog available</changelog>
  <changelog author="mpluskal@suse.com" date="1573646400">- Switch back to libcurl-mini-devel to avoid new build cycle</changelog>
  <changelog author="foss@grueninger.de" date="1574769600">- update to CMake 3.16
  Changelog see https://blog.kitware.com/cmake-3-16-0-available-for-download/
- drop patch form.patch, fixed upstream</changelog>
  <changelog author="sflees@suse.de" date="1574856000">- Fix numbering of patches.</changelog>
  <changelog author="foss@grueninger.de" date="1576843200">- update to CMAke 3.16.2
  * FindBLAS: Consider OpenBLAS with thread libraries only with C or CXX
  * FindBoost: Add support for Boost 1.72
  * FindLAPACK: Fix support for LAPACK symbols inside BLAS libraries
  Full changelog see https://blog.kitware.com/cmake-3-16-2-available-for-download/</changelog>
  <changelog author="asn@cryptomilk.org" date="1579003200">- Fix setting CMAKE_INSTALL_LIBDIR in cmake macro
  * This is a relative path, see `cmake --help-module GNUInstallDirs`
- Do NOT set -DCMAKE_SKIP_RPATH:BOOL=OFF
  * A lot of applications have private libraries in a subdirectory
    and require linking with RPATH which is totally valid.</changelog>
  <changelog author="junghans@votca.org" date="1579003201">- use cmake generics in marcos.cmake</changelog>
  <changelog author="tchvatal@suse.com" date="1580904000">- Add new -mini flavor in order to break up cycles
  * make sure the default cmake links now all system libraries
    and mini uses bundled stuff as needed
- Switch to python3 variant of Sphinx on the manpage/docu creation</changelog>
  <changelog author="sflees@suse.de" date="1581076800">- Revert "use cmake generics in marcos.cmake" it breaks many
  cases in stagings.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1581336000">- Revert LIBDIR change in macros - it is inconsistent (all other
  INSTALL_&lt;dir&gt;s use absolute paths), unneeded (paths may be
  absolute or relative), and breaks a number of packages.
- Update minimum libarchive version, &gt;= 3.3.3.
- Do not flag macros as config file.
- Adjust constraints (7G disk space is required, independent
  of architecture).</changelog>
  <changelog author="dimstar@opensuse.org" date="1582113600">- Change cmake to be a meta-package that requires
  cmake-implementation. This new symbol is provided by the (newly
  named) cmake-full package as well as cmake-mini.
- This is needed as the original attempt of using Substitute in OBS
  actually rewrites the used spec files on disk, not only on the
  fly and we ended up with packages Requiring cmake-mini (which is
  not installable on end user systems).</changelog>
  <changelog author="foss@grueninger.de" date="1584878400">- update to 3.17.0
  * cmake(1) gained a “Ninja Multi-Config” generator, which
    can be used to build multiple configurations at once.
  * cmake(1) gained a “–debug-find” command-line option to
    enable additional human-readable output on where find
    commands search.
  * Target link properties are now transitive over
    private dependencies on static libraries. See policy “CMP0099”.
  * cmake(1) gained a “-E rm” command-line tool that can
    be used to remove directories and files.
  Full changelog see
  https://blog.kitware.com/cmake-3-17-0-available-for-download/</changelog>
  <changelog author="sflees@suse.de" date="1584964800">- Many Leap packages don't build without -DCMAKE_SKIP_RPATH:BOOL=ON
  so leave this change to the next major version of Leap / SLE</changelog>
  <changelog author="sflees@suse.de" date="1585224000">- Fix mistake in previous change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628251200">- copypac from SLE-15, because of Firefox91 (bsc#1188891)
  (Dependency chain: cmake3 -&gt; Rust -&gt; Firefox)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718366400">- Needed for Firefox 128 (bsc#1226316)
  (Dependency chain: cmake3 -&gt; Rust1.78 -&gt; Firefox)
- Update to 3.20.0
  * The “cmake_path()” command was added for operations on
    filesystem paths.
  * The “target_sources()” command now supports targets created
    by the “add_custom_target()” command.
  * The “ExternalProject” module “ExternalProject_Add()” function
    gained a “CONFIGURE_HANDLED_BY_BUILD” option.
  * “ctest(1)” gained a “–test-dir” option to specify the directory
    in which to look for tests.
- update to 3.19.7:
  * With :ref:`Visual Studio Generators` for VS 2017 and higher, the
    :variable:`CMAKE_GENERATOR_TOOLSET` field ``version=`` now accepts
    three-component MSVC toolset versions such as ``14.28.29910``.
    See the :variable:`CMAKE_VS_PLATFORM_TOOLSET_VERSION` variable.
- cmake 3.19.6:
  * The cmake-presets(7) feature no longer allows comments in
    CMakePresets.json or CMakeUserPresets.json files. This was
    mistakenly allowed by the implementation in 3.19.0 to 3.19.5
- Update to CMake 3.19.5
  * FindBoost: Add support for Boost 1.75
  * FindCUDAToolkit: Restore use of CUDA_PATH environment variable
- A quick note that tumbleweed isn't affeted by bsc#1181680 which
  is being fixed for SLE.
- cmake 3.19.4:
  * fixes for other platforms
- cmake 3.19.3:
  * FetchContent: Relative SOURCE_DIR override cannot be a hard error
  * FindMPI: remove single quotes from include path
  * FindHDF5: Fix finding both debug and release libs
  * cmake-gui: Restore linking of Qt resources
  * cmMakefile: Don't expand bracket arguments in --trace-expand
- update to 3.19.2:
  * various Apple-Silicon support fixes
  * The CMAKE_ISPC_HEADER_SUFFIX variable and corresponding ISPC_HEADER_SUFFIX
  target property were added to control the header suffix used by ISPC
  compiler generated headers.
- remove 5556.patch (upstream)
- Add 5556.patch: export: Do not fail generation for separate
  namelink only case. Fixes regression, blocking other packages
  from build,
- cmake 3.19.1:
  * avoid breaking projects relying on using the LANGUAGE property
    to cause the specified language's compiler to be used
  * CUDA 11.1 support for Clang.
- cmake 3.19.0:
  * cmake(1) and cmake-gui(1) now recognize CMakePresets.json and
    CMakeUserPresets.json files
  * support for ISPC
  * exctend CUDA language support for Clang
  * extend cmake-file-ap "codemodel"
  * cli --install supports --default-directory-permissions
  * cli supports creating hardlinks
  * CMake GUI now has an environment variable editor
  * Multiple cmake commands support new options and subcommands
  * Multiple variables added or functionalities extended
  * Multiple new modules and added functionality to existing modules
  * Compatibility with versions of CMake older than 2.8.12 is now
    deprecated and will be removed from a future version. Calls to
    cmake_minimum_required() or cmake_policy() that set the policy
    version to an older value now issue a deprecation diagnostic.
  * cmake-gui now requires Qt5
- cmake 3.18.4:
  * no upstream changelog
- update to 3.18.3:
  * The Compile Features functionality was updated for MSVC 19.28
- reapply this change (bsc#1174581):
  * Fix setting CMAKE_INSTALL_LIBDIR in cmake macro
  * This is a relative path, see `cmake --help-module GNUInstallDirs`
  see also
  https://gitlab.kitware.com/cmake/cmake/-/issues/20250
  https://github.com/arvidn/libtorrent/issues/5125#issuecomment-691559244
- update to 3.18.2:
  * The default value of :variable:`CMAKE_AUTOMOC_PATH_PREFIX` was changed to
  ``OFF`` because this feature can break existing projects that have
  identically named header files in different include directories.
  This restores compatibility with behavior of CMake 3.15 and below.
  * The :manual:`Compile Features &lt;cmake-compile-features(7)&gt;` functionality
  was updated for MSVC 19.27 as mentioned above.
- cmake 3.18.1:
  * Revert undocumented fix in 3.18.0 in the add_test() command
    for special characters to avoid breaking existing projects that
    worked around the issue. Will be reintroduced later
- drop no-system-nghttp2.patch, upstream
- Install the rpm provides handler to the correct location
  (%{_rpmconfigdir, not %{_libexecdir}).
- update to cmake 3.18.0
  * The “CUDA” language can now be compiled using Clang on non-Windows platforms.
  * “cmake(1)” gained support for profiling of CMake scripts
  * The “cmake_language()” command was added for meta-operations on
    scripted or built-in commands, starting with a mode to “CALL” other
    commands, and “EVAL CODE” to inplace evaluate a CMake script.
  * The “find_program()”, “find_library()”, “find_path()” and
    “find_file()” commands gained a new “REQUIRED” option that will stop
    processing with an error message if nothing is found.
  * The “CheckLinkerFlag” module has been added to provide a facility to
    check validity of link flags.
  * “ccmake(1)” learned to read a “CCMAKE_COLORS” environment variable
    to customize colors.
- Drop patch lua54.patch, it became part of upstream
- Udjust patch cmake-fix-ruby-test.patch
- Add patch no-system-nghttp2.patch which will become part of 3.18.1
  to disable nghttp2 from system for cmake-mini
- Add lua54.patch which adds 5.4 among allowed versions of
  Lua interpreter.
  (https://gitlab.kitware.com/cmake/cmake/-/issues/20933)
- Use plain autosetup
- DCMAKE_MODULES_INSTALL_DIR should be %{_libdir}/cmake/%{name}
- Set CMAKE_INSTALL_LIBEXECDIR=%{_libexecdir}
- Use -DCMAKE_SKIP_INSTALL_RPATHS:BOOL=ON instead of completely
  removing rpaths. boo#1172331
- cmake 3.17.3:
  * Selection of the Objective C or C++ compiler now considers the
    CC or CXX environment variable if the OBJC or OBJCXX
    environment variable is not set
  * The FindPkgConfig module now extracts include directories
    prefixed with -isystem into the *_INCLUDE_DIRS variables and
    INTERFACE_INCLUDE_DIRECTORIES target properties
  * FindOpenSSL: Detect OpenSSL 3.0.0 (bsc#1172267)
- cmake 3.17.2:
  * fixes dealing with boost 1.73
- Add cmake-fix-png-include-dir.patch to fix the png include dir
  search.
- cmake 3.17.1:
  * The :cpack_gen:`CPack NSIS Generator` now requires NSIS 3.0 or later</changelog>
</package>
<package pkgid="3af5ffb316796971faf56e8ebf4a688202d319d99ba02708bbe637b5fc1e836c" name="cmake3-full" arch="s390x">
  <version epoch="0" ver="3.20.0" rel="150200.6.3.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1567598400">- cmake 3.15.3:
  * CrayPrgEnv compiler wrapper support updated for 19.06
- includes changes from 3.15.2:
  * Fix CMAKE_FIND_PACKAGE_PREFER_CONFIG variable causing the
    find_package() command to fail on a missing package even
    without the REQUIRED option</changelog>
  <changelog author="sflees@suse.de" date="1572177600">- cmake 3.15.4
  * In CMake 3.15.0 through 3.15.3, the EXCLUDE_FROM_ALL directory
    property was regressed from pre-3.14 behavior and caused targets
    within the directory to be excluded even from its own “all”.
    This has been fixed. The bug also existed in 3.14.0 through
    3.14.6 and is fixed in 3.14.7.
- Use pkgconfig for dependencies where possible (required due to
  tumbleweed build changes)</changelog>
  <changelog author="tchvatal@suse.com" date="1572609600">- Update cmake conditionals to make sure the multibuild is
  nicely leveraged</changelog>
  <changelog author="simonf.lees@suse.com" date="1572955200">- Drop debug patch (never in factory) and update patch numbers</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1573387200">- cmake 3.15.5:
  * no changelog available</changelog>
  <changelog author="mpluskal@suse.com" date="1573646400">- Switch back to libcurl-mini-devel to avoid new build cycle</changelog>
  <changelog author="foss@grueninger.de" date="1574769600">- update to CMake 3.16
  Changelog see https://blog.kitware.com/cmake-3-16-0-available-for-download/
- drop patch form.patch, fixed upstream</changelog>
  <changelog author="sflees@suse.de" date="1574856000">- Fix numbering of patches.</changelog>
  <changelog author="foss@grueninger.de" date="1576843200">- update to CMAke 3.16.2
  * FindBLAS: Consider OpenBLAS with thread libraries only with C or CXX
  * FindBoost: Add support for Boost 1.72
  * FindLAPACK: Fix support for LAPACK symbols inside BLAS libraries
  Full changelog see https://blog.kitware.com/cmake-3-16-2-available-for-download/</changelog>
  <changelog author="asn@cryptomilk.org" date="1579003200">- Fix setting CMAKE_INSTALL_LIBDIR in cmake macro
  * This is a relative path, see `cmake --help-module GNUInstallDirs`
- Do NOT set -DCMAKE_SKIP_RPATH:BOOL=OFF
  * A lot of applications have private libraries in a subdirectory
    and require linking with RPATH which is totally valid.</changelog>
  <changelog author="junghans@votca.org" date="1579003201">- use cmake generics in marcos.cmake</changelog>
  <changelog author="tchvatal@suse.com" date="1580904000">- Add new -mini flavor in order to break up cycles
  * make sure the default cmake links now all system libraries
    and mini uses bundled stuff as needed
- Switch to python3 variant of Sphinx on the manpage/docu creation</changelog>
  <changelog author="sflees@suse.de" date="1581076800">- Revert "use cmake generics in marcos.cmake" it breaks many
  cases in stagings.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1581336000">- Revert LIBDIR change in macros - it is inconsistent (all other
  INSTALL_&lt;dir&gt;s use absolute paths), unneeded (paths may be
  absolute or relative), and breaks a number of packages.
- Update minimum libarchive version, &gt;= 3.3.3.
- Do not flag macros as config file.
- Adjust constraints (7G disk space is required, independent
  of architecture).</changelog>
  <changelog author="dimstar@opensuse.org" date="1582113600">- Change cmake to be a meta-package that requires
  cmake-implementation. This new symbol is provided by the (newly
  named) cmake-full package as well as cmake-mini.
- This is needed as the original attempt of using Substitute in OBS
  actually rewrites the used spec files on disk, not only on the
  fly and we ended up with packages Requiring cmake-mini (which is
  not installable on end user systems).</changelog>
  <changelog author="foss@grueninger.de" date="1584878400">- update to 3.17.0
  * cmake(1) gained a “Ninja Multi-Config” generator, which
    can be used to build multiple configurations at once.
  * cmake(1) gained a “–debug-find” command-line option to
    enable additional human-readable output on where find
    commands search.
  * Target link properties are now transitive over
    private dependencies on static libraries. See policy “CMP0099”.
  * cmake(1) gained a “-E rm” command-line tool that can
    be used to remove directories and files.
  Full changelog see
  https://blog.kitware.com/cmake-3-17-0-available-for-download/</changelog>
  <changelog author="sflees@suse.de" date="1584964800">- Many Leap packages don't build without -DCMAKE_SKIP_RPATH:BOOL=ON
  so leave this change to the next major version of Leap / SLE</changelog>
  <changelog author="sflees@suse.de" date="1585224000">- Fix mistake in previous change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628251200">- copypac from SLE-15, because of Firefox91 (bsc#1188891)
  (Dependency chain: cmake3 -&gt; Rust -&gt; Firefox)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718366400">- Needed for Firefox 128 (bsc#1226316)
  (Dependency chain: cmake3 -&gt; Rust1.78 -&gt; Firefox)
- Update to 3.20.0
  * The “cmake_path()” command was added for operations on
    filesystem paths.
  * The “target_sources()” command now supports targets created
    by the “add_custom_target()” command.
  * The “ExternalProject” module “ExternalProject_Add()” function
    gained a “CONFIGURE_HANDLED_BY_BUILD” option.
  * “ctest(1)” gained a “–test-dir” option to specify the directory
    in which to look for tests.
- update to 3.19.7:
  * With :ref:`Visual Studio Generators` for VS 2017 and higher, the
    :variable:`CMAKE_GENERATOR_TOOLSET` field ``version=`` now accepts
    three-component MSVC toolset versions such as ``14.28.29910``.
    See the :variable:`CMAKE_VS_PLATFORM_TOOLSET_VERSION` variable.
- cmake 3.19.6:
  * The cmake-presets(7) feature no longer allows comments in
    CMakePresets.json or CMakeUserPresets.json files. This was
    mistakenly allowed by the implementation in 3.19.0 to 3.19.5
- Update to CMake 3.19.5
  * FindBoost: Add support for Boost 1.75
  * FindCUDAToolkit: Restore use of CUDA_PATH environment variable
- A quick note that tumbleweed isn't affeted by bsc#1181680 which
  is being fixed for SLE.
- cmake 3.19.4:
  * fixes for other platforms
- cmake 3.19.3:
  * FetchContent: Relative SOURCE_DIR override cannot be a hard error
  * FindMPI: remove single quotes from include path
  * FindHDF5: Fix finding both debug and release libs
  * cmake-gui: Restore linking of Qt resources
  * cmMakefile: Don't expand bracket arguments in --trace-expand
- update to 3.19.2:
  * various Apple-Silicon support fixes
  * The CMAKE_ISPC_HEADER_SUFFIX variable and corresponding ISPC_HEADER_SUFFIX
  target property were added to control the header suffix used by ISPC
  compiler generated headers.
- remove 5556.patch (upstream)
- Add 5556.patch: export: Do not fail generation for separate
  namelink only case. Fixes regression, blocking other packages
  from build,
- cmake 3.19.1:
  * avoid breaking projects relying on using the LANGUAGE property
    to cause the specified language's compiler to be used
  * CUDA 11.1 support for Clang.
- cmake 3.19.0:
  * cmake(1) and cmake-gui(1) now recognize CMakePresets.json and
    CMakeUserPresets.json files
  * support for ISPC
  * exctend CUDA language support for Clang
  * extend cmake-file-ap "codemodel"
  * cli --install supports --default-directory-permissions
  * cli supports creating hardlinks
  * CMake GUI now has an environment variable editor
  * Multiple cmake commands support new options and subcommands
  * Multiple variables added or functionalities extended
  * Multiple new modules and added functionality to existing modules
  * Compatibility with versions of CMake older than 2.8.12 is now
    deprecated and will be removed from a future version. Calls to
    cmake_minimum_required() or cmake_policy() that set the policy
    version to an older value now issue a deprecation diagnostic.
  * cmake-gui now requires Qt5
- cmake 3.18.4:
  * no upstream changelog
- update to 3.18.3:
  * The Compile Features functionality was updated for MSVC 19.28
- reapply this change (bsc#1174581):
  * Fix setting CMAKE_INSTALL_LIBDIR in cmake macro
  * This is a relative path, see `cmake --help-module GNUInstallDirs`
  see also
  https://gitlab.kitware.com/cmake/cmake/-/issues/20250
  https://github.com/arvidn/libtorrent/issues/5125#issuecomment-691559244
- update to 3.18.2:
  * The default value of :variable:`CMAKE_AUTOMOC_PATH_PREFIX` was changed to
  ``OFF`` because this feature can break existing projects that have
  identically named header files in different include directories.
  This restores compatibility with behavior of CMake 3.15 and below.
  * The :manual:`Compile Features &lt;cmake-compile-features(7)&gt;` functionality
  was updated for MSVC 19.27 as mentioned above.
- cmake 3.18.1:
  * Revert undocumented fix in 3.18.0 in the add_test() command
    for special characters to avoid breaking existing projects that
    worked around the issue. Will be reintroduced later
- drop no-system-nghttp2.patch, upstream
- Install the rpm provides handler to the correct location
  (%{_rpmconfigdir, not %{_libexecdir}).
- update to cmake 3.18.0
  * The “CUDA” language can now be compiled using Clang on non-Windows platforms.
  * “cmake(1)” gained support for profiling of CMake scripts
  * The “cmake_language()” command was added for meta-operations on
    scripted or built-in commands, starting with a mode to “CALL” other
    commands, and “EVAL CODE” to inplace evaluate a CMake script.
  * The “find_program()”, “find_library()”, “find_path()” and
    “find_file()” commands gained a new “REQUIRED” option that will stop
    processing with an error message if nothing is found.
  * The “CheckLinkerFlag” module has been added to provide a facility to
    check validity of link flags.
  * “ccmake(1)” learned to read a “CCMAKE_COLORS” environment variable
    to customize colors.
- Drop patch lua54.patch, it became part of upstream
- Udjust patch cmake-fix-ruby-test.patch
- Add patch no-system-nghttp2.patch which will become part of 3.18.1
  to disable nghttp2 from system for cmake-mini
- Add lua54.patch which adds 5.4 among allowed versions of
  Lua interpreter.
  (https://gitlab.kitware.com/cmake/cmake/-/issues/20933)
- Use plain autosetup
- DCMAKE_MODULES_INSTALL_DIR should be %{_libdir}/cmake/%{name}
- Set CMAKE_INSTALL_LIBEXECDIR=%{_libexecdir}
- Use -DCMAKE_SKIP_INSTALL_RPATHS:BOOL=ON instead of completely
  removing rpaths. boo#1172331
- cmake 3.17.3:
  * Selection of the Objective C or C++ compiler now considers the
    CC or CXX environment variable if the OBJC or OBJCXX
    environment variable is not set
  * The FindPkgConfig module now extracts include directories
    prefixed with -isystem into the *_INCLUDE_DIRS variables and
    INTERFACE_INCLUDE_DIRECTORIES target properties
  * FindOpenSSL: Detect OpenSSL 3.0.0 (bsc#1172267)
- cmake 3.17.2:
  * fixes dealing with boost 1.73
- Add cmake-fix-png-include-dir.patch to fix the png include dir
  search.
- cmake 3.17.1:
  * The :cpack_gen:`CPack NSIS Generator` now requires NSIS 3.0 or later</changelog>
</package>
<package pkgid="d5fa21e2633ace52fa5699c86d4d71ecd8790d7955729ec9a326d1ae352a44c0" name="cmake3-full" arch="src">
  <version epoch="0" ver="3.20.0" rel="150200.6.3.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1567598400">- cmake 3.15.3:
  * CrayPrgEnv compiler wrapper support updated for 19.06
- includes changes from 3.15.2:
  * Fix CMAKE_FIND_PACKAGE_PREFER_CONFIG variable causing the
    find_package() command to fail on a missing package even
    without the REQUIRED option</changelog>
  <changelog author="sflees@suse.de" date="1572177600">- cmake 3.15.4
  * In CMake 3.15.0 through 3.15.3, the EXCLUDE_FROM_ALL directory
    property was regressed from pre-3.14 behavior and caused targets
    within the directory to be excluded even from its own “all”.
    This has been fixed. The bug also existed in 3.14.0 through
    3.14.6 and is fixed in 3.14.7.
- Use pkgconfig for dependencies where possible (required due to
  tumbleweed build changes)</changelog>
  <changelog author="tchvatal@suse.com" date="1572609600">- Update cmake conditionals to make sure the multibuild is
  nicely leveraged</changelog>
  <changelog author="simonf.lees@suse.com" date="1572955200">- Drop debug patch (never in factory) and update patch numbers</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1573387200">- cmake 3.15.5:
  * no changelog available</changelog>
  <changelog author="mpluskal@suse.com" date="1573646400">- Switch back to libcurl-mini-devel to avoid new build cycle</changelog>
  <changelog author="foss@grueninger.de" date="1574769600">- update to CMake 3.16
  Changelog see https://blog.kitware.com/cmake-3-16-0-available-for-download/
- drop patch form.patch, fixed upstream</changelog>
  <changelog author="sflees@suse.de" date="1574856000">- Fix numbering of patches.</changelog>
  <changelog author="foss@grueninger.de" date="1576843200">- update to CMAke 3.16.2
  * FindBLAS: Consider OpenBLAS with thread libraries only with C or CXX
  * FindBoost: Add support for Boost 1.72
  * FindLAPACK: Fix support for LAPACK symbols inside BLAS libraries
  Full changelog see https://blog.kitware.com/cmake-3-16-2-available-for-download/</changelog>
  <changelog author="asn@cryptomilk.org" date="1579003200">- Fix setting CMAKE_INSTALL_LIBDIR in cmake macro
  * This is a relative path, see `cmake --help-module GNUInstallDirs`
- Do NOT set -DCMAKE_SKIP_RPATH:BOOL=OFF
  * A lot of applications have private libraries in a subdirectory
    and require linking with RPATH which is totally valid.</changelog>
  <changelog author="junghans@votca.org" date="1579003201">- use cmake generics in marcos.cmake</changelog>
  <changelog author="tchvatal@suse.com" date="1580904000">- Add new -mini flavor in order to break up cycles
  * make sure the default cmake links now all system libraries
    and mini uses bundled stuff as needed
- Switch to python3 variant of Sphinx on the manpage/docu creation</changelog>
  <changelog author="sflees@suse.de" date="1581076800">- Revert "use cmake generics in marcos.cmake" it breaks many
  cases in stagings.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1581336000">- Revert LIBDIR change in macros - it is inconsistent (all other
  INSTALL_&lt;dir&gt;s use absolute paths), unneeded (paths may be
  absolute or relative), and breaks a number of packages.
- Update minimum libarchive version, &gt;= 3.3.3.
- Do not flag macros as config file.
- Adjust constraints (7G disk space is required, independent
  of architecture).</changelog>
  <changelog author="dimstar@opensuse.org" date="1582113600">- Change cmake to be a meta-package that requires
  cmake-implementation. This new symbol is provided by the (newly
  named) cmake-full package as well as cmake-mini.
- This is needed as the original attempt of using Substitute in OBS
  actually rewrites the used spec files on disk, not only on the
  fly and we ended up with packages Requiring cmake-mini (which is
  not installable on end user systems).</changelog>
  <changelog author="foss@grueninger.de" date="1584878400">- update to 3.17.0
  * cmake(1) gained a “Ninja Multi-Config” generator, which
    can be used to build multiple configurations at once.
  * cmake(1) gained a “–debug-find” command-line option to
    enable additional human-readable output on where find
    commands search.
  * Target link properties are now transitive over
    private dependencies on static libraries. See policy “CMP0099”.
  * cmake(1) gained a “-E rm” command-line tool that can
    be used to remove directories and files.
  Full changelog see
  https://blog.kitware.com/cmake-3-17-0-available-for-download/</changelog>
  <changelog author="sflees@suse.de" date="1584964800">- Many Leap packages don't build without -DCMAKE_SKIP_RPATH:BOOL=ON
  so leave this change to the next major version of Leap / SLE</changelog>
  <changelog author="sflees@suse.de" date="1585224000">- Fix mistake in previous change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628251200">- copypac from SLE-15, because of Firefox91 (bsc#1188891)
  (Dependency chain: cmake3 -&gt; Rust -&gt; Firefox)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718366400">- Needed for Firefox 128 (bsc#1226316)
  (Dependency chain: cmake3 -&gt; Rust1.78 -&gt; Firefox)
- Update to 3.20.0
  * The “cmake_path()” command was added for operations on
    filesystem paths.
  * The “target_sources()” command now supports targets created
    by the “add_custom_target()” command.
  * The “ExternalProject” module “ExternalProject_Add()” function
    gained a “CONFIGURE_HANDLED_BY_BUILD” option.
  * “ctest(1)” gained a “–test-dir” option to specify the directory
    in which to look for tests.
- update to 3.19.7:
  * With :ref:`Visual Studio Generators` for VS 2017 and higher, the
    :variable:`CMAKE_GENERATOR_TOOLSET` field ``version=`` now accepts
    three-component MSVC toolset versions such as ``14.28.29910``.
    See the :variable:`CMAKE_VS_PLATFORM_TOOLSET_VERSION` variable.
- cmake 3.19.6:
  * The cmake-presets(7) feature no longer allows comments in
    CMakePresets.json or CMakeUserPresets.json files. This was
    mistakenly allowed by the implementation in 3.19.0 to 3.19.5
- Update to CMake 3.19.5
  * FindBoost: Add support for Boost 1.75
  * FindCUDAToolkit: Restore use of CUDA_PATH environment variable
- A quick note that tumbleweed isn't affeted by bsc#1181680 which
  is being fixed for SLE.
- cmake 3.19.4:
  * fixes for other platforms
- cmake 3.19.3:
  * FetchContent: Relative SOURCE_DIR override cannot be a hard error
  * FindMPI: remove single quotes from include path
  * FindHDF5: Fix finding both debug and release libs
  * cmake-gui: Restore linking of Qt resources
  * cmMakefile: Don't expand bracket arguments in --trace-expand
- update to 3.19.2:
  * various Apple-Silicon support fixes
  * The CMAKE_ISPC_HEADER_SUFFIX variable and corresponding ISPC_HEADER_SUFFIX
  target property were added to control the header suffix used by ISPC
  compiler generated headers.
- remove 5556.patch (upstream)
- Add 5556.patch: export: Do not fail generation for separate
  namelink only case. Fixes regression, blocking other packages
  from build,
- cmake 3.19.1:
  * avoid breaking projects relying on using the LANGUAGE property
    to cause the specified language's compiler to be used
  * CUDA 11.1 support for Clang.
- cmake 3.19.0:
  * cmake(1) and cmake-gui(1) now recognize CMakePresets.json and
    CMakeUserPresets.json files
  * support for ISPC
  * exctend CUDA language support for Clang
  * extend cmake-file-ap "codemodel"
  * cli --install supports --default-directory-permissions
  * cli supports creating hardlinks
  * CMake GUI now has an environment variable editor
  * Multiple cmake commands support new options and subcommands
  * Multiple variables added or functionalities extended
  * Multiple new modules and added functionality to existing modules
  * Compatibility with versions of CMake older than 2.8.12 is now
    deprecated and will be removed from a future version. Calls to
    cmake_minimum_required() or cmake_policy() that set the policy
    version to an older value now issue a deprecation diagnostic.
  * cmake-gui now requires Qt5
- cmake 3.18.4:
  * no upstream changelog
- update to 3.18.3:
  * The Compile Features functionality was updated for MSVC 19.28
- reapply this change (bsc#1174581):
  * Fix setting CMAKE_INSTALL_LIBDIR in cmake macro
  * This is a relative path, see `cmake --help-module GNUInstallDirs`
  see also
  https://gitlab.kitware.com/cmake/cmake/-/issues/20250
  https://github.com/arvidn/libtorrent/issues/5125#issuecomment-691559244
- update to 3.18.2:
  * The default value of :variable:`CMAKE_AUTOMOC_PATH_PREFIX` was changed to
  ``OFF`` because this feature can break existing projects that have
  identically named header files in different include directories.
  This restores compatibility with behavior of CMake 3.15 and below.
  * The :manual:`Compile Features &lt;cmake-compile-features(7)&gt;` functionality
  was updated for MSVC 19.27 as mentioned above.
- cmake 3.18.1:
  * Revert undocumented fix in 3.18.0 in the add_test() command
    for special characters to avoid breaking existing projects that
    worked around the issue. Will be reintroduced later
- drop no-system-nghttp2.patch, upstream
- Install the rpm provides handler to the correct location
  (%{_rpmconfigdir, not %{_libexecdir}).
- update to cmake 3.18.0
  * The “CUDA” language can now be compiled using Clang on non-Windows platforms.
  * “cmake(1)” gained support for profiling of CMake scripts
  * The “cmake_language()” command was added for meta-operations on
    scripted or built-in commands, starting with a mode to “CALL” other
    commands, and “EVAL CODE” to inplace evaluate a CMake script.
  * The “find_program()”, “find_library()”, “find_path()” and
    “find_file()” commands gained a new “REQUIRED” option that will stop
    processing with an error message if nothing is found.
  * The “CheckLinkerFlag” module has been added to provide a facility to
    check validity of link flags.
  * “ccmake(1)” learned to read a “CCMAKE_COLORS” environment variable
    to customize colors.
- Drop patch lua54.patch, it became part of upstream
- Udjust patch cmake-fix-ruby-test.patch
- Add patch no-system-nghttp2.patch which will become part of 3.18.1
  to disable nghttp2 from system for cmake-mini
- Add lua54.patch which adds 5.4 among allowed versions of
  Lua interpreter.
  (https://gitlab.kitware.com/cmake/cmake/-/issues/20933)
- Use plain autosetup
- DCMAKE_MODULES_INSTALL_DIR should be %{_libdir}/cmake/%{name}
- Set CMAKE_INSTALL_LIBEXECDIR=%{_libexecdir}
- Use -DCMAKE_SKIP_INSTALL_RPATHS:BOOL=ON instead of completely
  removing rpaths. boo#1172331
- cmake 3.17.3:
  * Selection of the Objective C or C++ compiler now considers the
    CC or CXX environment variable if the OBJC or OBJCXX
    environment variable is not set
  * The FindPkgConfig module now extracts include directories
    prefixed with -isystem into the *_INCLUDE_DIRS variables and
    INTERFACE_INCLUDE_DIRECTORIES target properties
  * FindOpenSSL: Detect OpenSSL 3.0.0 (bsc#1172267)
- cmake 3.17.2:
  * fixes dealing with boost 1.73
- Add cmake-fix-png-include-dir.patch to fix the png include dir
  search.
- cmake 3.17.1:
  * The :cpack_gen:`CPack NSIS Generator` now requires NSIS 3.0 or later</changelog>
</package>
<package pkgid="4ef9c46e36ee0e4c0644746c02003b4408eb05352835ee74aabd982108c72dc7" name="cmake3-full" arch="x86_64">
  <version epoch="0" ver="3.20.0" rel="150200.6.3.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1567598400">- cmake 3.15.3:
  * CrayPrgEnv compiler wrapper support updated for 19.06
- includes changes from 3.15.2:
  * Fix CMAKE_FIND_PACKAGE_PREFER_CONFIG variable causing the
    find_package() command to fail on a missing package even
    without the REQUIRED option</changelog>
  <changelog author="sflees@suse.de" date="1572177600">- cmake 3.15.4
  * In CMake 3.15.0 through 3.15.3, the EXCLUDE_FROM_ALL directory
    property was regressed from pre-3.14 behavior and caused targets
    within the directory to be excluded even from its own “all”.
    This has been fixed. The bug also existed in 3.14.0 through
    3.14.6 and is fixed in 3.14.7.
- Use pkgconfig for dependencies where possible (required due to
  tumbleweed build changes)</changelog>
  <changelog author="tchvatal@suse.com" date="1572609600">- Update cmake conditionals to make sure the multibuild is
  nicely leveraged</changelog>
  <changelog author="simonf.lees@suse.com" date="1572955200">- Drop debug patch (never in factory) and update patch numbers</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1573387200">- cmake 3.15.5:
  * no changelog available</changelog>
  <changelog author="mpluskal@suse.com" date="1573646400">- Switch back to libcurl-mini-devel to avoid new build cycle</changelog>
  <changelog author="foss@grueninger.de" date="1574769600">- update to CMake 3.16
  Changelog see https://blog.kitware.com/cmake-3-16-0-available-for-download/
- drop patch form.patch, fixed upstream</changelog>
  <changelog author="sflees@suse.de" date="1574856000">- Fix numbering of patches.</changelog>
  <changelog author="foss@grueninger.de" date="1576843200">- update to CMAke 3.16.2
  * FindBLAS: Consider OpenBLAS with thread libraries only with C or CXX
  * FindBoost: Add support for Boost 1.72
  * FindLAPACK: Fix support for LAPACK symbols inside BLAS libraries
  Full changelog see https://blog.kitware.com/cmake-3-16-2-available-for-download/</changelog>
  <changelog author="asn@cryptomilk.org" date="1579003200">- Fix setting CMAKE_INSTALL_LIBDIR in cmake macro
  * This is a relative path, see `cmake --help-module GNUInstallDirs`
- Do NOT set -DCMAKE_SKIP_RPATH:BOOL=OFF
  * A lot of applications have private libraries in a subdirectory
    and require linking with RPATH which is totally valid.</changelog>
  <changelog author="junghans@votca.org" date="1579003201">- use cmake generics in marcos.cmake</changelog>
  <changelog author="tchvatal@suse.com" date="1580904000">- Add new -mini flavor in order to break up cycles
  * make sure the default cmake links now all system libraries
    and mini uses bundled stuff as needed
- Switch to python3 variant of Sphinx on the manpage/docu creation</changelog>
  <changelog author="sflees@suse.de" date="1581076800">- Revert "use cmake generics in marcos.cmake" it breaks many
  cases in stagings.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1581336000">- Revert LIBDIR change in macros - it is inconsistent (all other
  INSTALL_&lt;dir&gt;s use absolute paths), unneeded (paths may be
  absolute or relative), and breaks a number of packages.
- Update minimum libarchive version, &gt;= 3.3.3.
- Do not flag macros as config file.
- Adjust constraints (7G disk space is required, independent
  of architecture).</changelog>
  <changelog author="dimstar@opensuse.org" date="1582113600">- Change cmake to be a meta-package that requires
  cmake-implementation. This new symbol is provided by the (newly
  named) cmake-full package as well as cmake-mini.
- This is needed as the original attempt of using Substitute in OBS
  actually rewrites the used spec files on disk, not only on the
  fly and we ended up with packages Requiring cmake-mini (which is
  not installable on end user systems).</changelog>
  <changelog author="foss@grueninger.de" date="1584878400">- update to 3.17.0
  * cmake(1) gained a “Ninja Multi-Config” generator, which
    can be used to build multiple configurations at once.
  * cmake(1) gained a “–debug-find” command-line option to
    enable additional human-readable output on where find
    commands search.
  * Target link properties are now transitive over
    private dependencies on static libraries. See policy “CMP0099”.
  * cmake(1) gained a “-E rm” command-line tool that can
    be used to remove directories and files.
  Full changelog see
  https://blog.kitware.com/cmake-3-17-0-available-for-download/</changelog>
  <changelog author="sflees@suse.de" date="1584964800">- Many Leap packages don't build without -DCMAKE_SKIP_RPATH:BOOL=ON
  so leave this change to the next major version of Leap / SLE</changelog>
  <changelog author="sflees@suse.de" date="1585224000">- Fix mistake in previous change.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628251200">- copypac from SLE-15, because of Firefox91 (bsc#1188891)
  (Dependency chain: cmake3 -&gt; Rust -&gt; Firefox)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1718366400">- Needed for Firefox 128 (bsc#1226316)
  (Dependency chain: cmake3 -&gt; Rust1.78 -&gt; Firefox)
- Update to 3.20.0
  * The “cmake_path()” command was added for operations on
    filesystem paths.
  * The “target_sources()” command now supports targets created
    by the “add_custom_target()” command.
  * The “ExternalProject” module “ExternalProject_Add()” function
    gained a “CONFIGURE_HANDLED_BY_BUILD” option.
  * “ctest(1)” gained a “–test-dir” option to specify the directory
    in which to look for tests.
- update to 3.19.7:
  * With :ref:`Visual Studio Generators` for VS 2017 and higher, the
    :variable:`CMAKE_GENERATOR_TOOLSET` field ``version=`` now accepts
    three-component MSVC toolset versions such as ``14.28.29910``.
    See the :variable:`CMAKE_VS_PLATFORM_TOOLSET_VERSION` variable.
- cmake 3.19.6:
  * The cmake-presets(7) feature no longer allows comments in
    CMakePresets.json or CMakeUserPresets.json files. This was
    mistakenly allowed by the implementation in 3.19.0 to 3.19.5
- Update to CMake 3.19.5
  * FindBoost: Add support for Boost 1.75
  * FindCUDAToolkit: Restore use of CUDA_PATH environment variable
- A quick note that tumbleweed isn't affeted by bsc#1181680 which
  is being fixed for SLE.
- cmake 3.19.4:
  * fixes for other platforms
- cmake 3.19.3:
  * FetchContent: Relative SOURCE_DIR override cannot be a hard error
  * FindMPI: remove single quotes from include path
  * FindHDF5: Fix finding both debug and release libs
  * cmake-gui: Restore linking of Qt resources
  * cmMakefile: Don't expand bracket arguments in --trace-expand
- update to 3.19.2:
  * various Apple-Silicon support fixes
  * The CMAKE_ISPC_HEADER_SUFFIX variable and corresponding ISPC_HEADER_SUFFIX
  target property were added to control the header suffix used by ISPC
  compiler generated headers.
- remove 5556.patch (upstream)
- Add 5556.patch: export: Do not fail generation for separate
  namelink only case. Fixes regression, blocking other packages
  from build,
- cmake 3.19.1:
  * avoid breaking projects relying on using the LANGUAGE property
    to cause the specified language's compiler to be used
  * CUDA 11.1 support for Clang.
- cmake 3.19.0:
  * cmake(1) and cmake-gui(1) now recognize CMakePresets.json and
    CMakeUserPresets.json files
  * support for ISPC
  * exctend CUDA language support for Clang
  * extend cmake-file-ap "codemodel"
  * cli --install supports --default-directory-permissions
  * cli supports creating hardlinks
  * CMake GUI now has an environment variable editor
  * Multiple cmake commands support new options and subcommands
  * Multiple variables added or functionalities extended
  * Multiple new modules and added functionality to existing modules
  * Compatibility with versions of CMake older than 2.8.12 is now
    deprecated and will be removed from a future version. Calls to
    cmake_minimum_required() or cmake_policy() that set the policy
    version to an older value now issue a deprecation diagnostic.
  * cmake-gui now requires Qt5
- cmake 3.18.4:
  * no upstream changelog
- update to 3.18.3:
  * The Compile Features functionality was updated for MSVC 19.28
- reapply this change (bsc#1174581):
  * Fix setting CMAKE_INSTALL_LIBDIR in cmake macro
  * This is a relative path, see `cmake --help-module GNUInstallDirs`
  see also
  https://gitlab.kitware.com/cmake/cmake/-/issues/20250
  https://github.com/arvidn/libtorrent/issues/5125#issuecomment-691559244
- update to 3.18.2:
  * The default value of :variable:`CMAKE_AUTOMOC_PATH_PREFIX` was changed to
  ``OFF`` because this feature can break existing projects that have
  identically named header files in different include directories.
  This restores compatibility with behavior of CMake 3.15 and below.
  * The :manual:`Compile Features &lt;cmake-compile-features(7)&gt;` functionality
  was updated for MSVC 19.27 as mentioned above.
- cmake 3.18.1:
  * Revert undocumented fix in 3.18.0 in the add_test() command
    for special characters to avoid breaking existing projects that
    worked around the issue. Will be reintroduced later
- drop no-system-nghttp2.patch, upstream
- Install the rpm provides handler to the correct location
  (%{_rpmconfigdir, not %{_libexecdir}).
- update to cmake 3.18.0
  * The “CUDA” language can now be compiled using Clang on non-Windows platforms.
  * “cmake(1)” gained support for profiling of CMake scripts
  * The “cmake_language()” command was added for meta-operations on
    scripted or built-in commands, starting with a mode to “CALL” other
    commands, and “EVAL CODE” to inplace evaluate a CMake script.
  * The “find_program()”, “find_library()”, “find_path()” and
    “find_file()” commands gained a new “REQUIRED” option that will stop
    processing with an error message if nothing is found.
  * The “CheckLinkerFlag” module has been added to provide a facility to
    check validity of link flags.
  * “ccmake(1)” learned to read a “CCMAKE_COLORS” environment variable
    to customize colors.
- Drop patch lua54.patch, it became part of upstream
- Udjust patch cmake-fix-ruby-test.patch
- Add patch no-system-nghttp2.patch which will become part of 3.18.1
  to disable nghttp2 from system for cmake-mini
- Add lua54.patch which adds 5.4 among allowed versions of
  Lua interpreter.
  (https://gitlab.kitware.com/cmake/cmake/-/issues/20933)
- Use plain autosetup
- DCMAKE_MODULES_INSTALL_DIR should be %{_libdir}/cmake/%{name}
- Set CMAKE_INSTALL_LIBEXECDIR=%{_libexecdir}
- Use -DCMAKE_SKIP_INSTALL_RPATHS:BOOL=ON instead of completely
  removing rpaths. boo#1172331
- cmake 3.17.3:
  * Selection of the Objective C or C++ compiler now considers the
    CC or CXX environment variable if the OBJC or OBJCXX
    environment variable is not set
  * The FindPkgConfig module now extracts include directories
    prefixed with -isystem into the *_INCLUDE_DIRS variables and
    INTERFACE_INCLUDE_DIRECTORIES target properties
  * FindOpenSSL: Detect OpenSSL 3.0.0 (bsc#1172267)
- cmake 3.17.2:
  * fixes dealing with boost 1.73
- Add cmake-fix-png-include-dir.patch to fix the png include dir
  search.
- cmake 3.17.1:
  * The :cpack_gen:`CPack NSIS Generator` now requires NSIS 3.0 or later</changelog>
</package>
<package pkgid="c8134a8f047c833e9d60ed3389d3de0b8d88b48f046a2be8889c5f9679d043c6" name="colord" arch="aarch64">
  <version epoch="0" ver="1.4.6" rel="150600.3.3.1"/>
  <changelog author="jengelh@inai.de" date="1506945600">- Update package summaries. Replace old RPM shell variables.</changelog>
  <changelog author="dimstar@opensuse.org" date="1507291200">- Collapse files section for gtk-doc.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1520942400">- Update to version 1.4.2:
  + New Features:
  - Add cd_icc_set_created.
  - Add --enable-timestamps option for CREATED header.
  + Bugfixes:
  - Avoid buffer overflow when reading profile_id.
  - Fix the detection of duplicate EDIDs.
  - Make udev hwdb optional by using pnp.ids as fallback.
  - Raise _XOPEN_SOURCE to 700 to enable C99 on FreeBSD.
  - Refactor build directory selection.
  - Set cd-create-profile date to SOURCE_DATE_EPOCH.
- Pass new option enable-udev-rules=true to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1524398400">- Update to version 1.4.3:
  + Bugfixes:
  - Make cd_color_get_blackbody_rgb_full safer.
  - Update style of Meson build options.
  - Update warning about running daemon as root.
- Update options passed to meson following upstream changes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1549886400">- Fix meson parameters: -Dargyllcms-sensor=true must be
  - Dargyllcms_sensor=true (boo#1124388).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1561550400">- Change BuildRequires to docbook-utils-minimal, otherwise the build
  pulls in half of texlive and all its dependencies. Only man pages
  and HTML API docs are generated, no need for PS/PDF generation.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570536000">- Also allow /var/lib/colord/icc/ in AppArmor profile (boo#1112230)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1571832000">- Update to version 1.4.4:
  + New Features:
  - Actually install the installed tests.
  - Allow building without the daemon.
  + Bugfixes:
  - Consistently search for spotread in $PATH.
  - Don't hard-require spotread to build argyll sensor.
  - Fix linker argument checks.
  - Include C header in Colorhug-1.0.gir.
  - Pass -DCD_COMPILATION to gir compiler.
  - Port manpages to xsltproc and DocBook 5.
- Replace docbook-utils-minimal with docbook5-xsl-stylesheets
  BuildRequires following upstreams port.
- Add _constraints file, avoid random buildfails for i586 and other
  arches.</changelog>
  <changelog author="rbrown@suse.com" date="1575460800">- Add add-spyderx.patch for datacolor SpyderX supprot (will be in
  version 1.4.5).
- Move colord-session.service and tmpfiles config from
  libcolord-devel to colord package.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610020800">- Update to version 1.4.5:
  + New Features:
  - Add cd_icc_create_default_full
  - Add cd_icc_utils_get_adaptation_matrix
  - Add cd_mat33_is_finite
  - Add support for datacolor SpyderX
  + Bugfixes:
  - Check for errors from more sqlite calls
  - Fix cd_icc_load_data() annotation for the data array
  - Fix cd-sensor-dummy
  - Fix more annotation for data arrays
  - Fix owner and permissions on existing state files
  - Fix segfault due to dereferencing NULL pointer
  - Make the build reproductible
  - Refactor opening of mapping database and try again if fails
- Drop add-spyderx.patch: Included upstream in new release.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1610625600">- allow access to /usr/local/share/color in AppArmor profile (boo#1180898)</changelog>
  <changelog author="gmbr3@opensuse.org" date="1637409600">- Change to systemd-sysusers</changelog>
  <changelog author="jsegitz@suse.com" date="1639396800">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_colord.service.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1648209600">- Update to version 1.4.6:
  + Add missing copyright notices.
  + Add Spyder X entry.
  + Document where to send patches.
  + Don't use exact floating point comparisons.
  + Drop option for removed reverse engineering tools.
  + Drop references to hughski.com.
  + Fix a small memory leak in sqlite3_exec().
  + Fix typo in device-removed signal documentation.
  + Make introspection optional in meson.
- Drop -Dreverse=false meson parameter: no longer supported.
- Fix a few rpmlint warnings:
  + Do not self-obsolete shared-color-profiles by providing the
    symbol with a version.
  + Call +%tmpfiles_create %{_tmpfilesdir}/colord.conf in %post.
  + Package /usr/share/bash-completion/completions/colormgr with
    mode 644: the files are not executed, but sourced.
  + Own %{_localstatedir}/lib/colord/icc (ghost): this directory is
    generated by %tmpfiles_create.</changelog>
  <changelog author="mgorse@suse.com" date="1663329600">- Add colord-CVE-2021-42523.patch: fix a small memory leak on db
  open failure (boo#1202802 CVE-2021-42523).</changelog>
  <changelog author="fcrozat@suse.com" date="1683288000">- Tune _constraints for various architectures.</changelog>
  <changelog author="schwab@suse.de" date="1690977600">- Reduce memory constraints for riscv64</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1725451200">- Remove script in %pre to change ownership of /var/lib/colord
  (bsc#1208056).</changelog>
</package>
<package pkgid="5c1e6506cfc51a670764e963f91fb076232ed1cff2bb5a86b28fc7767336691e" name="colord" arch="ppc64le">
  <version epoch="0" ver="1.4.6" rel="150600.3.3.1"/>
  <changelog author="jengelh@inai.de" date="1506945600">- Update package summaries. Replace old RPM shell variables.</changelog>
  <changelog author="dimstar@opensuse.org" date="1507291200">- Collapse files section for gtk-doc.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1520942400">- Update to version 1.4.2:
  + New Features:
  - Add cd_icc_set_created.
  - Add --enable-timestamps option for CREATED header.
  + Bugfixes:
  - Avoid buffer overflow when reading profile_id.
  - Fix the detection of duplicate EDIDs.
  - Make udev hwdb optional by using pnp.ids as fallback.
  - Raise _XOPEN_SOURCE to 700 to enable C99 on FreeBSD.
  - Refactor build directory selection.
  - Set cd-create-profile date to SOURCE_DATE_EPOCH.
- Pass new option enable-udev-rules=true to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1524398400">- Update to version 1.4.3:
  + Bugfixes:
  - Make cd_color_get_blackbody_rgb_full safer.
  - Update style of Meson build options.
  - Update warning about running daemon as root.
- Update options passed to meson following upstream changes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1549886400">- Fix meson parameters: -Dargyllcms-sensor=true must be
  - Dargyllcms_sensor=true (boo#1124388).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1561550400">- Change BuildRequires to docbook-utils-minimal, otherwise the build
  pulls in half of texlive and all its dependencies. Only man pages
  and HTML API docs are generated, no need for PS/PDF generation.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570536000">- Also allow /var/lib/colord/icc/ in AppArmor profile (boo#1112230)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1571832000">- Update to version 1.4.4:
  + New Features:
  - Actually install the installed tests.
  - Allow building without the daemon.
  + Bugfixes:
  - Consistently search for spotread in $PATH.
  - Don't hard-require spotread to build argyll sensor.
  - Fix linker argument checks.
  - Include C header in Colorhug-1.0.gir.
  - Pass -DCD_COMPILATION to gir compiler.
  - Port manpages to xsltproc and DocBook 5.
- Replace docbook-utils-minimal with docbook5-xsl-stylesheets
  BuildRequires following upstreams port.
- Add _constraints file, avoid random buildfails for i586 and other
  arches.</changelog>
  <changelog author="rbrown@suse.com" date="1575460800">- Add add-spyderx.patch for datacolor SpyderX supprot (will be in
  version 1.4.5).
- Move colord-session.service and tmpfiles config from
  libcolord-devel to colord package.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610020800">- Update to version 1.4.5:
  + New Features:
  - Add cd_icc_create_default_full
  - Add cd_icc_utils_get_adaptation_matrix
  - Add cd_mat33_is_finite
  - Add support for datacolor SpyderX
  + Bugfixes:
  - Check for errors from more sqlite calls
  - Fix cd_icc_load_data() annotation for the data array
  - Fix cd-sensor-dummy
  - Fix more annotation for data arrays
  - Fix owner and permissions on existing state files
  - Fix segfault due to dereferencing NULL pointer
  - Make the build reproductible
  - Refactor opening of mapping database and try again if fails
- Drop add-spyderx.patch: Included upstream in new release.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1610625600">- allow access to /usr/local/share/color in AppArmor profile (boo#1180898)</changelog>
  <changelog author="gmbr3@opensuse.org" date="1637409600">- Change to systemd-sysusers</changelog>
  <changelog author="jsegitz@suse.com" date="1639396800">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_colord.service.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1648209600">- Update to version 1.4.6:
  + Add missing copyright notices.
  + Add Spyder X entry.
  + Document where to send patches.
  + Don't use exact floating point comparisons.
  + Drop option for removed reverse engineering tools.
  + Drop references to hughski.com.
  + Fix a small memory leak in sqlite3_exec().
  + Fix typo in device-removed signal documentation.
  + Make introspection optional in meson.
- Drop -Dreverse=false meson parameter: no longer supported.
- Fix a few rpmlint warnings:
  + Do not self-obsolete shared-color-profiles by providing the
    symbol with a version.
  + Call +%tmpfiles_create %{_tmpfilesdir}/colord.conf in %post.
  + Package /usr/share/bash-completion/completions/colormgr with
    mode 644: the files are not executed, but sourced.
  + Own %{_localstatedir}/lib/colord/icc (ghost): this directory is
    generated by %tmpfiles_create.</changelog>
  <changelog author="mgorse@suse.com" date="1663329600">- Add colord-CVE-2021-42523.patch: fix a small memory leak on db
  open failure (boo#1202802 CVE-2021-42523).</changelog>
  <changelog author="fcrozat@suse.com" date="1683288000">- Tune _constraints for various architectures.</changelog>
  <changelog author="schwab@suse.de" date="1690977600">- Reduce memory constraints for riscv64</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1725451200">- Remove script in %pre to change ownership of /var/lib/colord
  (bsc#1208056).</changelog>
</package>
<package pkgid="25f5d2bb6a9fbb602e37639cb52d374904b9e0ff8282cb29f598b26af13cc827" name="colord" arch="s390x">
  <version epoch="0" ver="1.4.6" rel="150600.3.3.1"/>
  <changelog author="jengelh@inai.de" date="1506945600">- Update package summaries. Replace old RPM shell variables.</changelog>
  <changelog author="dimstar@opensuse.org" date="1507291200">- Collapse files section for gtk-doc.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1520942400">- Update to version 1.4.2:
  + New Features:
  - Add cd_icc_set_created.
  - Add --enable-timestamps option for CREATED header.
  + Bugfixes:
  - Avoid buffer overflow when reading profile_id.
  - Fix the detection of duplicate EDIDs.
  - Make udev hwdb optional by using pnp.ids as fallback.
  - Raise _XOPEN_SOURCE to 700 to enable C99 on FreeBSD.
  - Refactor build directory selection.
  - Set cd-create-profile date to SOURCE_DATE_EPOCH.
- Pass new option enable-udev-rules=true to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1524398400">- Update to version 1.4.3:
  + Bugfixes:
  - Make cd_color_get_blackbody_rgb_full safer.
  - Update style of Meson build options.
  - Update warning about running daemon as root.
- Update options passed to meson following upstream changes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1549886400">- Fix meson parameters: -Dargyllcms-sensor=true must be
  - Dargyllcms_sensor=true (boo#1124388).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1561550400">- Change BuildRequires to docbook-utils-minimal, otherwise the build
  pulls in half of texlive and all its dependencies. Only man pages
  and HTML API docs are generated, no need for PS/PDF generation.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570536000">- Also allow /var/lib/colord/icc/ in AppArmor profile (boo#1112230)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1571832000">- Update to version 1.4.4:
  + New Features:
  - Actually install the installed tests.
  - Allow building without the daemon.
  + Bugfixes:
  - Consistently search for spotread in $PATH.
  - Don't hard-require spotread to build argyll sensor.
  - Fix linker argument checks.
  - Include C header in Colorhug-1.0.gir.
  - Pass -DCD_COMPILATION to gir compiler.
  - Port manpages to xsltproc and DocBook 5.
- Replace docbook-utils-minimal with docbook5-xsl-stylesheets
  BuildRequires following upstreams port.
- Add _constraints file, avoid random buildfails for i586 and other
  arches.</changelog>
  <changelog author="rbrown@suse.com" date="1575460800">- Add add-spyderx.patch for datacolor SpyderX supprot (will be in
  version 1.4.5).
- Move colord-session.service and tmpfiles config from
  libcolord-devel to colord package.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610020800">- Update to version 1.4.5:
  + New Features:
  - Add cd_icc_create_default_full
  - Add cd_icc_utils_get_adaptation_matrix
  - Add cd_mat33_is_finite
  - Add support for datacolor SpyderX
  + Bugfixes:
  - Check for errors from more sqlite calls
  - Fix cd_icc_load_data() annotation for the data array
  - Fix cd-sensor-dummy
  - Fix more annotation for data arrays
  - Fix owner and permissions on existing state files
  - Fix segfault due to dereferencing NULL pointer
  - Make the build reproductible
  - Refactor opening of mapping database and try again if fails
- Drop add-spyderx.patch: Included upstream in new release.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1610625600">- allow access to /usr/local/share/color in AppArmor profile (boo#1180898)</changelog>
  <changelog author="gmbr3@opensuse.org" date="1637409600">- Change to systemd-sysusers</changelog>
  <changelog author="jsegitz@suse.com" date="1639396800">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_colord.service.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1648209600">- Update to version 1.4.6:
  + Add missing copyright notices.
  + Add Spyder X entry.
  + Document where to send patches.
  + Don't use exact floating point comparisons.
  + Drop option for removed reverse engineering tools.
  + Drop references to hughski.com.
  + Fix a small memory leak in sqlite3_exec().
  + Fix typo in device-removed signal documentation.
  + Make introspection optional in meson.
- Drop -Dreverse=false meson parameter: no longer supported.
- Fix a few rpmlint warnings:
  + Do not self-obsolete shared-color-profiles by providing the
    symbol with a version.
  + Call +%tmpfiles_create %{_tmpfilesdir}/colord.conf in %post.
  + Package /usr/share/bash-completion/completions/colormgr with
    mode 644: the files are not executed, but sourced.
  + Own %{_localstatedir}/lib/colord/icc (ghost): this directory is
    generated by %tmpfiles_create.</changelog>
  <changelog author="mgorse@suse.com" date="1663329600">- Add colord-CVE-2021-42523.patch: fix a small memory leak on db
  open failure (boo#1202802 CVE-2021-42523).</changelog>
  <changelog author="fcrozat@suse.com" date="1683288000">- Tune _constraints for various architectures.</changelog>
  <changelog author="schwab@suse.de" date="1690977600">- Reduce memory constraints for riscv64</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1725451200">- Remove script in %pre to change ownership of /var/lib/colord
  (bsc#1208056).</changelog>
</package>
<package pkgid="0b6a76fe639ce546bfe490b95845b4138d6de381452114280039b2a0d5f84f69" name="colord" arch="src">
  <version epoch="0" ver="1.4.6" rel="150600.3.3.1"/>
  <changelog author="jengelh@inai.de" date="1506945600">- Update package summaries. Replace old RPM shell variables.</changelog>
  <changelog author="dimstar@opensuse.org" date="1507291200">- Collapse files section for gtk-doc.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1520942400">- Update to version 1.4.2:
  + New Features:
  - Add cd_icc_set_created.
  - Add --enable-timestamps option for CREATED header.
  + Bugfixes:
  - Avoid buffer overflow when reading profile_id.
  - Fix the detection of duplicate EDIDs.
  - Make udev hwdb optional by using pnp.ids as fallback.
  - Raise _XOPEN_SOURCE to 700 to enable C99 on FreeBSD.
  - Refactor build directory selection.
  - Set cd-create-profile date to SOURCE_DATE_EPOCH.
- Pass new option enable-udev-rules=true to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1524398400">- Update to version 1.4.3:
  + Bugfixes:
  - Make cd_color_get_blackbody_rgb_full safer.
  - Update style of Meson build options.
  - Update warning about running daemon as root.
- Update options passed to meson following upstream changes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1549886400">- Fix meson parameters: -Dargyllcms-sensor=true must be
  - Dargyllcms_sensor=true (boo#1124388).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1561550400">- Change BuildRequires to docbook-utils-minimal, otherwise the build
  pulls in half of texlive and all its dependencies. Only man pages
  and HTML API docs are generated, no need for PS/PDF generation.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570536000">- Also allow /var/lib/colord/icc/ in AppArmor profile (boo#1112230)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1571832000">- Update to version 1.4.4:
  + New Features:
  - Actually install the installed tests.
  - Allow building without the daemon.
  + Bugfixes:
  - Consistently search for spotread in $PATH.
  - Don't hard-require spotread to build argyll sensor.
  - Fix linker argument checks.
  - Include C header in Colorhug-1.0.gir.
  - Pass -DCD_COMPILATION to gir compiler.
  - Port manpages to xsltproc and DocBook 5.
- Replace docbook-utils-minimal with docbook5-xsl-stylesheets
  BuildRequires following upstreams port.
- Add _constraints file, avoid random buildfails for i586 and other
  arches.</changelog>
  <changelog author="rbrown@suse.com" date="1575460800">- Add add-spyderx.patch for datacolor SpyderX supprot (will be in
  version 1.4.5).
- Move colord-session.service and tmpfiles config from
  libcolord-devel to colord package.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610020800">- Update to version 1.4.5:
  + New Features:
  - Add cd_icc_create_default_full
  - Add cd_icc_utils_get_adaptation_matrix
  - Add cd_mat33_is_finite
  - Add support for datacolor SpyderX
  + Bugfixes:
  - Check for errors from more sqlite calls
  - Fix cd_icc_load_data() annotation for the data array
  - Fix cd-sensor-dummy
  - Fix more annotation for data arrays
  - Fix owner and permissions on existing state files
  - Fix segfault due to dereferencing NULL pointer
  - Make the build reproductible
  - Refactor opening of mapping database and try again if fails
- Drop add-spyderx.patch: Included upstream in new release.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1610625600">- allow access to /usr/local/share/color in AppArmor profile (boo#1180898)</changelog>
  <changelog author="gmbr3@opensuse.org" date="1637409600">- Change to systemd-sysusers</changelog>
  <changelog author="jsegitz@suse.com" date="1639396800">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_colord.service.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1648209600">- Update to version 1.4.6:
  + Add missing copyright notices.
  + Add Spyder X entry.
  + Document where to send patches.
  + Don't use exact floating point comparisons.
  + Drop option for removed reverse engineering tools.
  + Drop references to hughski.com.
  + Fix a small memory leak in sqlite3_exec().
  + Fix typo in device-removed signal documentation.
  + Make introspection optional in meson.
- Drop -Dreverse=false meson parameter: no longer supported.
- Fix a few rpmlint warnings:
  + Do not self-obsolete shared-color-profiles by providing the
    symbol with a version.
  + Call +%tmpfiles_create %{_tmpfilesdir}/colord.conf in %post.
  + Package /usr/share/bash-completion/completions/colormgr with
    mode 644: the files are not executed, but sourced.
  + Own %{_localstatedir}/lib/colord/icc (ghost): this directory is
    generated by %tmpfiles_create.</changelog>
  <changelog author="mgorse@suse.com" date="1663329600">- Add colord-CVE-2021-42523.patch: fix a small memory leak on db
  open failure (boo#1202802 CVE-2021-42523).</changelog>
  <changelog author="fcrozat@suse.com" date="1683288000">- Tune _constraints for various architectures.</changelog>
  <changelog author="schwab@suse.de" date="1690977600">- Reduce memory constraints for riscv64</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1725451200">- Remove script in %pre to change ownership of /var/lib/colord
  (bsc#1208056).</changelog>
</package>
<package pkgid="f2a35187ad4e26ca24db0097f9f97554e8899e72ed61b5203485fff8b89a1ed7" name="colord" arch="x86_64">
  <version epoch="0" ver="1.4.6" rel="150600.3.3.1"/>
  <changelog author="jengelh@inai.de" date="1506945600">- Update package summaries. Replace old RPM shell variables.</changelog>
  <changelog author="dimstar@opensuse.org" date="1507291200">- Collapse files section for gtk-doc.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1520942400">- Update to version 1.4.2:
  + New Features:
  - Add cd_icc_set_created.
  - Add --enable-timestamps option for CREATED header.
  + Bugfixes:
  - Avoid buffer overflow when reading profile_id.
  - Fix the detection of duplicate EDIDs.
  - Make udev hwdb optional by using pnp.ids as fallback.
  - Raise _XOPEN_SOURCE to 700 to enable C99 on FreeBSD.
  - Refactor build directory selection.
  - Set cd-create-profile date to SOURCE_DATE_EPOCH.
- Pass new option enable-udev-rules=true to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1524398400">- Update to version 1.4.3:
  + Bugfixes:
  - Make cd_color_get_blackbody_rgb_full safer.
  - Update style of Meson build options.
  - Update warning about running daemon as root.
- Update options passed to meson following upstream changes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1549886400">- Fix meson parameters: -Dargyllcms-sensor=true must be
  - Dargyllcms_sensor=true (boo#1124388).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1561550400">- Change BuildRequires to docbook-utils-minimal, otherwise the build
  pulls in half of texlive and all its dependencies. Only man pages
  and HTML API docs are generated, no need for PS/PDF generation.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570536000">- Also allow /var/lib/colord/icc/ in AppArmor profile (boo#1112230)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1571832000">- Update to version 1.4.4:
  + New Features:
  - Actually install the installed tests.
  - Allow building without the daemon.
  + Bugfixes:
  - Consistently search for spotread in $PATH.
  - Don't hard-require spotread to build argyll sensor.
  - Fix linker argument checks.
  - Include C header in Colorhug-1.0.gir.
  - Pass -DCD_COMPILATION to gir compiler.
  - Port manpages to xsltproc and DocBook 5.
- Replace docbook-utils-minimal with docbook5-xsl-stylesheets
  BuildRequires following upstreams port.
- Add _constraints file, avoid random buildfails for i586 and other
  arches.</changelog>
  <changelog author="rbrown@suse.com" date="1575460800">- Add add-spyderx.patch for datacolor SpyderX supprot (will be in
  version 1.4.5).
- Move colord-session.service and tmpfiles config from
  libcolord-devel to colord package.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610020800">- Update to version 1.4.5:
  + New Features:
  - Add cd_icc_create_default_full
  - Add cd_icc_utils_get_adaptation_matrix
  - Add cd_mat33_is_finite
  - Add support for datacolor SpyderX
  + Bugfixes:
  - Check for errors from more sqlite calls
  - Fix cd_icc_load_data() annotation for the data array
  - Fix cd-sensor-dummy
  - Fix more annotation for data arrays
  - Fix owner and permissions on existing state files
  - Fix segfault due to dereferencing NULL pointer
  - Make the build reproductible
  - Refactor opening of mapping database and try again if fails
- Drop add-spyderx.patch: Included upstream in new release.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1610625600">- allow access to /usr/local/share/color in AppArmor profile (boo#1180898)</changelog>
  <changelog author="gmbr3@opensuse.org" date="1637409600">- Change to systemd-sysusers</changelog>
  <changelog author="jsegitz@suse.com" date="1639396800">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_colord.service.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1648209600">- Update to version 1.4.6:
  + Add missing copyright notices.
  + Add Spyder X entry.
  + Document where to send patches.
  + Don't use exact floating point comparisons.
  + Drop option for removed reverse engineering tools.
  + Drop references to hughski.com.
  + Fix a small memory leak in sqlite3_exec().
  + Fix typo in device-removed signal documentation.
  + Make introspection optional in meson.
- Drop -Dreverse=false meson parameter: no longer supported.
- Fix a few rpmlint warnings:
  + Do not self-obsolete shared-color-profiles by providing the
    symbol with a version.
  + Call +%tmpfiles_create %{_tmpfilesdir}/colord.conf in %post.
  + Package /usr/share/bash-completion/completions/colormgr with
    mode 644: the files are not executed, but sourced.
  + Own %{_localstatedir}/lib/colord/icc (ghost): this directory is
    generated by %tmpfiles_create.</changelog>
  <changelog author="mgorse@suse.com" date="1663329600">- Add colord-CVE-2021-42523.patch: fix a small memory leak on db
  open failure (boo#1202802 CVE-2021-42523).</changelog>
  <changelog author="fcrozat@suse.com" date="1683288000">- Tune _constraints for various architectures.</changelog>
  <changelog author="schwab@suse.de" date="1690977600">- Reduce memory constraints for riscv64</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1725451200">- Remove script in %pre to change ownership of /var/lib/colord
  (bsc#1208056).</changelog>
</package>
<package pkgid="01c7466ef28835498cdf8ef5dfa1e724d951ef031e7e59c6c724e449e2e39347" name="colord-color-profiles" arch="aarch64">
  <version epoch="0" ver="1.4.6" rel="150600.3.3.1"/>
  <changelog author="jengelh@inai.de" date="1506945600">- Update package summaries. Replace old RPM shell variables.</changelog>
  <changelog author="dimstar@opensuse.org" date="1507291200">- Collapse files section for gtk-doc.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1520942400">- Update to version 1.4.2:
  + New Features:
  - Add cd_icc_set_created.
  - Add --enable-timestamps option for CREATED header.
  + Bugfixes:
  - Avoid buffer overflow when reading profile_id.
  - Fix the detection of duplicate EDIDs.
  - Make udev hwdb optional by using pnp.ids as fallback.
  - Raise _XOPEN_SOURCE to 700 to enable C99 on FreeBSD.
  - Refactor build directory selection.
  - Set cd-create-profile date to SOURCE_DATE_EPOCH.
- Pass new option enable-udev-rules=true to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1524398400">- Update to version 1.4.3:
  + Bugfixes:
  - Make cd_color_get_blackbody_rgb_full safer.
  - Update style of Meson build options.
  - Update warning about running daemon as root.
- Update options passed to meson following upstream changes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1549886400">- Fix meson parameters: -Dargyllcms-sensor=true must be
  - Dargyllcms_sensor=true (boo#1124388).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1561550400">- Change BuildRequires to docbook-utils-minimal, otherwise the build
  pulls in half of texlive and all its dependencies. Only man pages
  and HTML API docs are generated, no need for PS/PDF generation.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570536000">- Also allow /var/lib/colord/icc/ in AppArmor profile (boo#1112230)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1571832000">- Update to version 1.4.4:
  + New Features:
  - Actually install the installed tests.
  - Allow building without the daemon.
  + Bugfixes:
  - Consistently search for spotread in $PATH.
  - Don't hard-require spotread to build argyll sensor.
  - Fix linker argument checks.
  - Include C header in Colorhug-1.0.gir.
  - Pass -DCD_COMPILATION to gir compiler.
  - Port manpages to xsltproc and DocBook 5.
- Replace docbook-utils-minimal with docbook5-xsl-stylesheets
  BuildRequires following upstreams port.
- Add _constraints file, avoid random buildfails for i586 and other
  arches.</changelog>
  <changelog author="rbrown@suse.com" date="1575460800">- Add add-spyderx.patch for datacolor SpyderX supprot (will be in
  version 1.4.5).
- Move colord-session.service and tmpfiles config from
  libcolord-devel to colord package.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610020800">- Update to version 1.4.5:
  + New Features:
  - Add cd_icc_create_default_full
  - Add cd_icc_utils_get_adaptation_matrix
  - Add cd_mat33_is_finite
  - Add support for datacolor SpyderX
  + Bugfixes:
  - Check for errors from more sqlite calls
  - Fix cd_icc_load_data() annotation for the data array
  - Fix cd-sensor-dummy
  - Fix more annotation for data arrays
  - Fix owner and permissions on existing state files
  - Fix segfault due to dereferencing NULL pointer
  - Make the build reproductible
  - Refactor opening of mapping database and try again if fails
- Drop add-spyderx.patch: Included upstream in new release.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1610625600">- allow access to /usr/local/share/color in AppArmor profile (boo#1180898)</changelog>
  <changelog author="gmbr3@opensuse.org" date="1637409600">- Change to systemd-sysusers</changelog>
  <changelog author="jsegitz@suse.com" date="1639396800">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_colord.service.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1648209600">- Update to version 1.4.6:
  + Add missing copyright notices.
  + Add Spyder X entry.
  + Document where to send patches.
  + Don't use exact floating point comparisons.
  + Drop option for removed reverse engineering tools.
  + Drop references to hughski.com.
  + Fix a small memory leak in sqlite3_exec().
  + Fix typo in device-removed signal documentation.
  + Make introspection optional in meson.
- Drop -Dreverse=false meson parameter: no longer supported.
- Fix a few rpmlint warnings:
  + Do not self-obsolete shared-color-profiles by providing the
    symbol with a version.
  + Call +%tmpfiles_create %{_tmpfilesdir}/colord.conf in %post.
  + Package /usr/share/bash-completion/completions/colormgr with
    mode 644: the files are not executed, but sourced.
  + Own %{_localstatedir}/lib/colord/icc (ghost): this directory is
    generated by %tmpfiles_create.</changelog>
  <changelog author="mgorse@suse.com" date="1663329600">- Add colord-CVE-2021-42523.patch: fix a small memory leak on db
  open failure (boo#1202802 CVE-2021-42523).</changelog>
  <changelog author="fcrozat@suse.com" date="1683288000">- Tune _constraints for various architectures.</changelog>
  <changelog author="schwab@suse.de" date="1690977600">- Reduce memory constraints for riscv64</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1725451200">- Remove script in %pre to change ownership of /var/lib/colord
  (bsc#1208056).</changelog>
</package>
<package pkgid="8752c624c9714d7d7c47f80ba6a8d2701709aed45953b23c5e718c40fa36643e" name="colord-color-profiles" arch="ppc64le">
  <version epoch="0" ver="1.4.6" rel="150600.3.3.1"/>
  <changelog author="jengelh@inai.de" date="1506945600">- Update package summaries. Replace old RPM shell variables.</changelog>
  <changelog author="dimstar@opensuse.org" date="1507291200">- Collapse files section for gtk-doc.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1520942400">- Update to version 1.4.2:
  + New Features:
  - Add cd_icc_set_created.
  - Add --enable-timestamps option for CREATED header.
  + Bugfixes:
  - Avoid buffer overflow when reading profile_id.
  - Fix the detection of duplicate EDIDs.
  - Make udev hwdb optional by using pnp.ids as fallback.
  - Raise _XOPEN_SOURCE to 700 to enable C99 on FreeBSD.
  - Refactor build directory selection.
  - Set cd-create-profile date to SOURCE_DATE_EPOCH.
- Pass new option enable-udev-rules=true to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1524398400">- Update to version 1.4.3:
  + Bugfixes:
  - Make cd_color_get_blackbody_rgb_full safer.
  - Update style of Meson build options.
  - Update warning about running daemon as root.
- Update options passed to meson following upstream changes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1549886400">- Fix meson parameters: -Dargyllcms-sensor=true must be
  - Dargyllcms_sensor=true (boo#1124388).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1561550400">- Change BuildRequires to docbook-utils-minimal, otherwise the build
  pulls in half of texlive and all its dependencies. Only man pages
  and HTML API docs are generated, no need for PS/PDF generation.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570536000">- Also allow /var/lib/colord/icc/ in AppArmor profile (boo#1112230)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1571832000">- Update to version 1.4.4:
  + New Features:
  - Actually install the installed tests.
  - Allow building without the daemon.
  + Bugfixes:
  - Consistently search for spotread in $PATH.
  - Don't hard-require spotread to build argyll sensor.
  - Fix linker argument checks.
  - Include C header in Colorhug-1.0.gir.
  - Pass -DCD_COMPILATION to gir compiler.
  - Port manpages to xsltproc and DocBook 5.
- Replace docbook-utils-minimal with docbook5-xsl-stylesheets
  BuildRequires following upstreams port.
- Add _constraints file, avoid random buildfails for i586 and other
  arches.</changelog>
  <changelog author="rbrown@suse.com" date="1575460800">- Add add-spyderx.patch for datacolor SpyderX supprot (will be in
  version 1.4.5).
- Move colord-session.service and tmpfiles config from
  libcolord-devel to colord package.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610020800">- Update to version 1.4.5:
  + New Features:
  - Add cd_icc_create_default_full
  - Add cd_icc_utils_get_adaptation_matrix
  - Add cd_mat33_is_finite
  - Add support for datacolor SpyderX
  + Bugfixes:
  - Check for errors from more sqlite calls
  - Fix cd_icc_load_data() annotation for the data array
  - Fix cd-sensor-dummy
  - Fix more annotation for data arrays
  - Fix owner and permissions on existing state files
  - Fix segfault due to dereferencing NULL pointer
  - Make the build reproductible
  - Refactor opening of mapping database and try again if fails
- Drop add-spyderx.patch: Included upstream in new release.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1610625600">- allow access to /usr/local/share/color in AppArmor profile (boo#1180898)</changelog>
  <changelog author="gmbr3@opensuse.org" date="1637409600">- Change to systemd-sysusers</changelog>
  <changelog author="jsegitz@suse.com" date="1639396800">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_colord.service.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1648209600">- Update to version 1.4.6:
  + Add missing copyright notices.
  + Add Spyder X entry.
  + Document where to send patches.
  + Don't use exact floating point comparisons.
  + Drop option for removed reverse engineering tools.
  + Drop references to hughski.com.
  + Fix a small memory leak in sqlite3_exec().
  + Fix typo in device-removed signal documentation.
  + Make introspection optional in meson.
- Drop -Dreverse=false meson parameter: no longer supported.
- Fix a few rpmlint warnings:
  + Do not self-obsolete shared-color-profiles by providing the
    symbol with a version.
  + Call +%tmpfiles_create %{_tmpfilesdir}/colord.conf in %post.
  + Package /usr/share/bash-completion/completions/colormgr with
    mode 644: the files are not executed, but sourced.
  + Own %{_localstatedir}/lib/colord/icc (ghost): this directory is
    generated by %tmpfiles_create.</changelog>
  <changelog author="mgorse@suse.com" date="1663329600">- Add colord-CVE-2021-42523.patch: fix a small memory leak on db
  open failure (boo#1202802 CVE-2021-42523).</changelog>
  <changelog author="fcrozat@suse.com" date="1683288000">- Tune _constraints for various architectures.</changelog>
  <changelog author="schwab@suse.de" date="1690977600">- Reduce memory constraints for riscv64</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1725451200">- Remove script in %pre to change ownership of /var/lib/colord
  (bsc#1208056).</changelog>
</package>
<package pkgid="0b638e0d4058d09a00b56f861cab1de536e0eb10026a6c0234669a2b83f0fdae" name="colord-color-profiles" arch="s390x">
  <version epoch="0" ver="1.4.6" rel="150600.3.3.1"/>
  <changelog author="jengelh@inai.de" date="1506945600">- Update package summaries. Replace old RPM shell variables.</changelog>
  <changelog author="dimstar@opensuse.org" date="1507291200">- Collapse files section for gtk-doc.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1520942400">- Update to version 1.4.2:
  + New Features:
  - Add cd_icc_set_created.
  - Add --enable-timestamps option for CREATED header.
  + Bugfixes:
  - Avoid buffer overflow when reading profile_id.
  - Fix the detection of duplicate EDIDs.
  - Make udev hwdb optional by using pnp.ids as fallback.
  - Raise _XOPEN_SOURCE to 700 to enable C99 on FreeBSD.
  - Refactor build directory selection.
  - Set cd-create-profile date to SOURCE_DATE_EPOCH.
- Pass new option enable-udev-rules=true to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1524398400">- Update to version 1.4.3:
  + Bugfixes:
  - Make cd_color_get_blackbody_rgb_full safer.
  - Update style of Meson build options.
  - Update warning about running daemon as root.
- Update options passed to meson following upstream changes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1549886400">- Fix meson parameters: -Dargyllcms-sensor=true must be
  - Dargyllcms_sensor=true (boo#1124388).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1561550400">- Change BuildRequires to docbook-utils-minimal, otherwise the build
  pulls in half of texlive and all its dependencies. Only man pages
  and HTML API docs are generated, no need for PS/PDF generation.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570536000">- Also allow /var/lib/colord/icc/ in AppArmor profile (boo#1112230)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1571832000">- Update to version 1.4.4:
  + New Features:
  - Actually install the installed tests.
  - Allow building without the daemon.
  + Bugfixes:
  - Consistently search for spotread in $PATH.
  - Don't hard-require spotread to build argyll sensor.
  - Fix linker argument checks.
  - Include C header in Colorhug-1.0.gir.
  - Pass -DCD_COMPILATION to gir compiler.
  - Port manpages to xsltproc and DocBook 5.
- Replace docbook-utils-minimal with docbook5-xsl-stylesheets
  BuildRequires following upstreams port.
- Add _constraints file, avoid random buildfails for i586 and other
  arches.</changelog>
  <changelog author="rbrown@suse.com" date="1575460800">- Add add-spyderx.patch for datacolor SpyderX supprot (will be in
  version 1.4.5).
- Move colord-session.service and tmpfiles config from
  libcolord-devel to colord package.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610020800">- Update to version 1.4.5:
  + New Features:
  - Add cd_icc_create_default_full
  - Add cd_icc_utils_get_adaptation_matrix
  - Add cd_mat33_is_finite
  - Add support for datacolor SpyderX
  + Bugfixes:
  - Check for errors from more sqlite calls
  - Fix cd_icc_load_data() annotation for the data array
  - Fix cd-sensor-dummy
  - Fix more annotation for data arrays
  - Fix owner and permissions on existing state files
  - Fix segfault due to dereferencing NULL pointer
  - Make the build reproductible
  - Refactor opening of mapping database and try again if fails
- Drop add-spyderx.patch: Included upstream in new release.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1610625600">- allow access to /usr/local/share/color in AppArmor profile (boo#1180898)</changelog>
  <changelog author="gmbr3@opensuse.org" date="1637409600">- Change to systemd-sysusers</changelog>
  <changelog author="jsegitz@suse.com" date="1639396800">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_colord.service.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1648209600">- Update to version 1.4.6:
  + Add missing copyright notices.
  + Add Spyder X entry.
  + Document where to send patches.
  + Don't use exact floating point comparisons.
  + Drop option for removed reverse engineering tools.
  + Drop references to hughski.com.
  + Fix a small memory leak in sqlite3_exec().
  + Fix typo in device-removed signal documentation.
  + Make introspection optional in meson.
- Drop -Dreverse=false meson parameter: no longer supported.
- Fix a few rpmlint warnings:
  + Do not self-obsolete shared-color-profiles by providing the
    symbol with a version.
  + Call +%tmpfiles_create %{_tmpfilesdir}/colord.conf in %post.
  + Package /usr/share/bash-completion/completions/colormgr with
    mode 644: the files are not executed, but sourced.
  + Own %{_localstatedir}/lib/colord/icc (ghost): this directory is
    generated by %tmpfiles_create.</changelog>
  <changelog author="mgorse@suse.com" date="1663329600">- Add colord-CVE-2021-42523.patch: fix a small memory leak on db
  open failure (boo#1202802 CVE-2021-42523).</changelog>
  <changelog author="fcrozat@suse.com" date="1683288000">- Tune _constraints for various architectures.</changelog>
  <changelog author="schwab@suse.de" date="1690977600">- Reduce memory constraints for riscv64</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1725451200">- Remove script in %pre to change ownership of /var/lib/colord
  (bsc#1208056).</changelog>
</package>
<package pkgid="e88bca7f2cb3e06081b19f43b93944bb903c1f6b9be955e5b23fb66c83c3377a" name="colord-color-profiles" arch="x86_64">
  <version epoch="0" ver="1.4.6" rel="150600.3.3.1"/>
  <changelog author="jengelh@inai.de" date="1506945600">- Update package summaries. Replace old RPM shell variables.</changelog>
  <changelog author="dimstar@opensuse.org" date="1507291200">- Collapse files section for gtk-doc.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1520942400">- Update to version 1.4.2:
  + New Features:
  - Add cd_icc_set_created.
  - Add --enable-timestamps option for CREATED header.
  + Bugfixes:
  - Avoid buffer overflow when reading profile_id.
  - Fix the detection of duplicate EDIDs.
  - Make udev hwdb optional by using pnp.ids as fallback.
  - Raise _XOPEN_SOURCE to 700 to enable C99 on FreeBSD.
  - Refactor build directory selection.
  - Set cd-create-profile date to SOURCE_DATE_EPOCH.
- Pass new option enable-udev-rules=true to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1524398400">- Update to version 1.4.3:
  + Bugfixes:
  - Make cd_color_get_blackbody_rgb_full safer.
  - Update style of Meson build options.
  - Update warning about running daemon as root.
- Update options passed to meson following upstream changes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1549886400">- Fix meson parameters: -Dargyllcms-sensor=true must be
  - Dargyllcms_sensor=true (boo#1124388).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1561550400">- Change BuildRequires to docbook-utils-minimal, otherwise the build
  pulls in half of texlive and all its dependencies. Only man pages
  and HTML API docs are generated, no need for PS/PDF generation.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570536000">- Also allow /var/lib/colord/icc/ in AppArmor profile (boo#1112230)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1571832000">- Update to version 1.4.4:
  + New Features:
  - Actually install the installed tests.
  - Allow building without the daemon.
  + Bugfixes:
  - Consistently search for spotread in $PATH.
  - Don't hard-require spotread to build argyll sensor.
  - Fix linker argument checks.
  - Include C header in Colorhug-1.0.gir.
  - Pass -DCD_COMPILATION to gir compiler.
  - Port manpages to xsltproc and DocBook 5.
- Replace docbook-utils-minimal with docbook5-xsl-stylesheets
  BuildRequires following upstreams port.
- Add _constraints file, avoid random buildfails for i586 and other
  arches.</changelog>
  <changelog author="rbrown@suse.com" date="1575460800">- Add add-spyderx.patch for datacolor SpyderX supprot (will be in
  version 1.4.5).
- Move colord-session.service and tmpfiles config from
  libcolord-devel to colord package.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610020800">- Update to version 1.4.5:
  + New Features:
  - Add cd_icc_create_default_full
  - Add cd_icc_utils_get_adaptation_matrix
  - Add cd_mat33_is_finite
  - Add support for datacolor SpyderX
  + Bugfixes:
  - Check for errors from more sqlite calls
  - Fix cd_icc_load_data() annotation for the data array
  - Fix cd-sensor-dummy
  - Fix more annotation for data arrays
  - Fix owner and permissions on existing state files
  - Fix segfault due to dereferencing NULL pointer
  - Make the build reproductible
  - Refactor opening of mapping database and try again if fails
- Drop add-spyderx.patch: Included upstream in new release.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1610625600">- allow access to /usr/local/share/color in AppArmor profile (boo#1180898)</changelog>
  <changelog author="gmbr3@opensuse.org" date="1637409600">- Change to systemd-sysusers</changelog>
  <changelog author="jsegitz@suse.com" date="1639396800">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_colord.service.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1648209600">- Update to version 1.4.6:
  + Add missing copyright notices.
  + Add Spyder X entry.
  + Document where to send patches.
  + Don't use exact floating point comparisons.
  + Drop option for removed reverse engineering tools.
  + Drop references to hughski.com.
  + Fix a small memory leak in sqlite3_exec().
  + Fix typo in device-removed signal documentation.
  + Make introspection optional in meson.
- Drop -Dreverse=false meson parameter: no longer supported.
- Fix a few rpmlint warnings:
  + Do not self-obsolete shared-color-profiles by providing the
    symbol with a version.
  + Call +%tmpfiles_create %{_tmpfilesdir}/colord.conf in %post.
  + Package /usr/share/bash-completion/completions/colormgr with
    mode 644: the files are not executed, but sourced.
  + Own %{_localstatedir}/lib/colord/icc (ghost): this directory is
    generated by %tmpfiles_create.</changelog>
  <changelog author="mgorse@suse.com" date="1663329600">- Add colord-CVE-2021-42523.patch: fix a small memory leak on db
  open failure (boo#1202802 CVE-2021-42523).</changelog>
  <changelog author="fcrozat@suse.com" date="1683288000">- Tune _constraints for various architectures.</changelog>
  <changelog author="schwab@suse.de" date="1690977600">- Reduce memory constraints for riscv64</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1725451200">- Remove script in %pre to change ownership of /var/lib/colord
  (bsc#1208056).</changelog>
</package>
<package pkgid="d8a965d63791e8d7d246777f580789ee8efd9abf15eb7eb643d8f85e502ce26e" name="colord-lang" arch="noarch">
  <version epoch="0" ver="1.4.6" rel="150600.3.3.1"/>
  <changelog author="jengelh@inai.de" date="1506945600">- Update package summaries. Replace old RPM shell variables.</changelog>
  <changelog author="dimstar@opensuse.org" date="1507291200">- Collapse files section for gtk-doc.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1520942400">- Update to version 1.4.2:
  + New Features:
  - Add cd_icc_set_created.
  - Add --enable-timestamps option for CREATED header.
  + Bugfixes:
  - Avoid buffer overflow when reading profile_id.
  - Fix the detection of duplicate EDIDs.
  - Make udev hwdb optional by using pnp.ids as fallback.
  - Raise _XOPEN_SOURCE to 700 to enable C99 on FreeBSD.
  - Refactor build directory selection.
  - Set cd-create-profile date to SOURCE_DATE_EPOCH.
- Pass new option enable-udev-rules=true to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1524398400">- Update to version 1.4.3:
  + Bugfixes:
  - Make cd_color_get_blackbody_rgb_full safer.
  - Update style of Meson build options.
  - Update warning about running daemon as root.
- Update options passed to meson following upstream changes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1549886400">- Fix meson parameters: -Dargyllcms-sensor=true must be
  - Dargyllcms_sensor=true (boo#1124388).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1561550400">- Change BuildRequires to docbook-utils-minimal, otherwise the build
  pulls in half of texlive and all its dependencies. Only man pages
  and HTML API docs are generated, no need for PS/PDF generation.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570536000">- Also allow /var/lib/colord/icc/ in AppArmor profile (boo#1112230)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1571832000">- Update to version 1.4.4:
  + New Features:
  - Actually install the installed tests.
  - Allow building without the daemon.
  + Bugfixes:
  - Consistently search for spotread in $PATH.
  - Don't hard-require spotread to build argyll sensor.
  - Fix linker argument checks.
  - Include C header in Colorhug-1.0.gir.
  - Pass -DCD_COMPILATION to gir compiler.
  - Port manpages to xsltproc and DocBook 5.
- Replace docbook-utils-minimal with docbook5-xsl-stylesheets
  BuildRequires following upstreams port.
- Add _constraints file, avoid random buildfails for i586 and other
  arches.</changelog>
  <changelog author="rbrown@suse.com" date="1575460800">- Add add-spyderx.patch for datacolor SpyderX supprot (will be in
  version 1.4.5).
- Move colord-session.service and tmpfiles config from
  libcolord-devel to colord package.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610020800">- Update to version 1.4.5:
  + New Features:
  - Add cd_icc_create_default_full
  - Add cd_icc_utils_get_adaptation_matrix
  - Add cd_mat33_is_finite
  - Add support for datacolor SpyderX
  + Bugfixes:
  - Check for errors from more sqlite calls
  - Fix cd_icc_load_data() annotation for the data array
  - Fix cd-sensor-dummy
  - Fix more annotation for data arrays
  - Fix owner and permissions on existing state files
  - Fix segfault due to dereferencing NULL pointer
  - Make the build reproductible
  - Refactor opening of mapping database and try again if fails
- Drop add-spyderx.patch: Included upstream in new release.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1610625600">- allow access to /usr/local/share/color in AppArmor profile (boo#1180898)</changelog>
  <changelog author="gmbr3@opensuse.org" date="1637409600">- Change to systemd-sysusers</changelog>
  <changelog author="jsegitz@suse.com" date="1639396800">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_colord.service.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1648209600">- Update to version 1.4.6:
  + Add missing copyright notices.
  + Add Spyder X entry.
  + Document where to send patches.
  + Don't use exact floating point comparisons.
  + Drop option for removed reverse engineering tools.
  + Drop references to hughski.com.
  + Fix a small memory leak in sqlite3_exec().
  + Fix typo in device-removed signal documentation.
  + Make introspection optional in meson.
- Drop -Dreverse=false meson parameter: no longer supported.
- Fix a few rpmlint warnings:
  + Do not self-obsolete shared-color-profiles by providing the
    symbol with a version.
  + Call +%tmpfiles_create %{_tmpfilesdir}/colord.conf in %post.
  + Package /usr/share/bash-completion/completions/colormgr with
    mode 644: the files are not executed, but sourced.
  + Own %{_localstatedir}/lib/colord/icc (ghost): this directory is
    generated by %tmpfiles_create.</changelog>
  <changelog author="mgorse@suse.com" date="1663329600">- Add colord-CVE-2021-42523.patch: fix a small memory leak on db
  open failure (boo#1202802 CVE-2021-42523).</changelog>
  <changelog author="fcrozat@suse.com" date="1683288000">- Tune _constraints for various architectures.</changelog>
  <changelog author="schwab@suse.de" date="1690977600">- Reduce memory constraints for riscv64</changelog>
  <changelog author="xiaoguang.wang@suse.com" date="1725451200">- Remove script in %pre to change ownership of /var/lib/colord
  (bsc#1208056).</changelog>
</package>
<package pkgid="a84a176799b0950900816901c0d84544b82fea79d484ac1f0d1a67b6d6cf6f67" name="containerd" arch="aarch64">
  <version epoch="0" ver="1.7.17" rel="150000.111.3"/>
  <changelog author="dmueller@suse.com" date="1669723200">- add devel subpackage, which is needed by open-vm-tools</changelog>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for
  CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.9&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670328001">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.19&gt;
  Includes fixes for:
  - CVE-2023-25153 bsc#1208423
  - CVE-2023-25173 bsc#1208426</changelog>
  <changelog author="asarai@suse.com" date="1681819200">- Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.20&gt;</changelog>
  <changelog author="meissner@suse.com" date="1683201600">[ This was only released in SLE. ]
- unversion to golang requires to always use the current default go.
  (bsc#1210298)</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.21&gt; bsc#1211578
- Require a minimum Go version explicitly rather than using golang(API).
  Fixes the change for bsc#1210298.</changelog>
  <changelog author="priyanka.saggu@suse.com" date="1693483200">- Add `Provides: cri-runtime` to use containerd as container runtime in Factory
  Kubernetes packages</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.6&gt; bsc#1215323</changelog>
  <changelog author="asarai@suse.com" date="1697198400">- Update to containerd v1.7.7. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.7&gt;
- Add patch to fix build on SLE-12:
  + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to containerd v1.7.8. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.8&gt; bsc#1200528
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1701691200">- Update to containerd v1.7.10. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.10&gt;
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1704715200">- Add patch for bsc#1217952:
  + 0002-shim-Create-pid-file-with-0644-permissions.patch</changelog>
  <changelog author="dcermak@suse.com" date="1705320000">- Enable manpage generation
- Make devel package noarch
- adjust rpmlint filters</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="eyadlorenzo@gmail.com" date="1713700800">- Use obs_scm service instead of tar_scm
- Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch
  (merged upstream at
  &lt;https://github.com/containerd/containerd/pull/9571&gt;)
- Update to containerd v1.7.15. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.15&gt;
- Update to containerd v1.7.14. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.14&gt;
- Update to containerd v1.7.13. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.13&gt;
- Update to containerd v1.7.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.12&gt;
- Update to containerd v1.7.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.11&gt;
  GHSA-jq35-85cj-fj4p bsc#1224323</changelog>
  <changelog author="asarai@suse.com" date="1716379200">- Update to containerd v1.7.17. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.17&gt;
- Switch back to using tar_scm service. Aside from obs_scm using more bandwidth
  and storage than a locally-compressed tar.xz, it seems there's some weird
  issue with paths in obscpio that break our SLE-12-only patch.
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
- Update to containerd v1.7.16. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.16&gt;
  CVE-2023-45288 bsc#1221400</changelog>
</package>
<package pkgid="634511ca53b8244a50b9946c5ce5e452668a3797b728cbbf0b7af2d1551f3d5d" name="containerd" arch="ppc64le">
  <version epoch="0" ver="1.7.17" rel="150000.111.3"/>
  <changelog author="dmueller@suse.com" date="1669723200">- add devel subpackage, which is needed by open-vm-tools</changelog>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for
  CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.9&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670328001">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.19&gt;
  Includes fixes for:
  - CVE-2023-25153 bsc#1208423
  - CVE-2023-25173 bsc#1208426</changelog>
  <changelog author="asarai@suse.com" date="1681819200">- Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.20&gt;</changelog>
  <changelog author="meissner@suse.com" date="1683201600">[ This was only released in SLE. ]
- unversion to golang requires to always use the current default go.
  (bsc#1210298)</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.21&gt; bsc#1211578
- Require a minimum Go version explicitly rather than using golang(API).
  Fixes the change for bsc#1210298.</changelog>
  <changelog author="priyanka.saggu@suse.com" date="1693483200">- Add `Provides: cri-runtime` to use containerd as container runtime in Factory
  Kubernetes packages</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.6&gt; bsc#1215323</changelog>
  <changelog author="asarai@suse.com" date="1697198400">- Update to containerd v1.7.7. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.7&gt;
- Add patch to fix build on SLE-12:
  + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to containerd v1.7.8. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.8&gt; bsc#1200528
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1701691200">- Update to containerd v1.7.10. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.10&gt;
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1704715200">- Add patch for bsc#1217952:
  + 0002-shim-Create-pid-file-with-0644-permissions.patch</changelog>
  <changelog author="dcermak@suse.com" date="1705320000">- Enable manpage generation
- Make devel package noarch
- adjust rpmlint filters</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="eyadlorenzo@gmail.com" date="1713700800">- Use obs_scm service instead of tar_scm
- Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch
  (merged upstream at
  &lt;https://github.com/containerd/containerd/pull/9571&gt;)
- Update to containerd v1.7.15. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.15&gt;
- Update to containerd v1.7.14. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.14&gt;
- Update to containerd v1.7.13. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.13&gt;
- Update to containerd v1.7.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.12&gt;
- Update to containerd v1.7.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.11&gt;
  GHSA-jq35-85cj-fj4p bsc#1224323</changelog>
  <changelog author="asarai@suse.com" date="1716379200">- Update to containerd v1.7.17. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.17&gt;
- Switch back to using tar_scm service. Aside from obs_scm using more bandwidth
  and storage than a locally-compressed tar.xz, it seems there's some weird
  issue with paths in obscpio that break our SLE-12-only patch.
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
- Update to containerd v1.7.16. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.16&gt;
  CVE-2023-45288 bsc#1221400</changelog>
</package>
<package pkgid="ebbc04a4ef6a808e87408e2bc31c3ad6db639e61972609e718003a024c8a32d9" name="containerd" arch="s390x">
  <version epoch="0" ver="1.7.17" rel="150000.111.3"/>
  <changelog author="dmueller@suse.com" date="1669723200">- add devel subpackage, which is needed by open-vm-tools</changelog>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for
  CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.9&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670328001">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.19&gt;
  Includes fixes for:
  - CVE-2023-25153 bsc#1208423
  - CVE-2023-25173 bsc#1208426</changelog>
  <changelog author="asarai@suse.com" date="1681819200">- Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.20&gt;</changelog>
  <changelog author="meissner@suse.com" date="1683201600">[ This was only released in SLE. ]
- unversion to golang requires to always use the current default go.
  (bsc#1210298)</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.21&gt; bsc#1211578
- Require a minimum Go version explicitly rather than using golang(API).
  Fixes the change for bsc#1210298.</changelog>
  <changelog author="priyanka.saggu@suse.com" date="1693483200">- Add `Provides: cri-runtime` to use containerd as container runtime in Factory
  Kubernetes packages</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.6&gt; bsc#1215323</changelog>
  <changelog author="asarai@suse.com" date="1697198400">- Update to containerd v1.7.7. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.7&gt;
- Add patch to fix build on SLE-12:
  + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to containerd v1.7.8. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.8&gt; bsc#1200528
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1701691200">- Update to containerd v1.7.10. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.10&gt;
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1704715200">- Add patch for bsc#1217952:
  + 0002-shim-Create-pid-file-with-0644-permissions.patch</changelog>
  <changelog author="dcermak@suse.com" date="1705320000">- Enable manpage generation
- Make devel package noarch
- adjust rpmlint filters</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="eyadlorenzo@gmail.com" date="1713700800">- Use obs_scm service instead of tar_scm
- Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch
  (merged upstream at
  &lt;https://github.com/containerd/containerd/pull/9571&gt;)
- Update to containerd v1.7.15. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.15&gt;
- Update to containerd v1.7.14. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.14&gt;
- Update to containerd v1.7.13. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.13&gt;
- Update to containerd v1.7.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.12&gt;
- Update to containerd v1.7.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.11&gt;
  GHSA-jq35-85cj-fj4p bsc#1224323</changelog>
  <changelog author="asarai@suse.com" date="1716379200">- Update to containerd v1.7.17. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.17&gt;
- Switch back to using tar_scm service. Aside from obs_scm using more bandwidth
  and storage than a locally-compressed tar.xz, it seems there's some weird
  issue with paths in obscpio that break our SLE-12-only patch.
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
- Update to containerd v1.7.16. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.16&gt;
  CVE-2023-45288 bsc#1221400</changelog>
</package>
<package pkgid="439a1bf8606e0d62e2af6c2a21fdbadf1aef19a1f5a3229625115f51fba422ab" name="containerd" arch="src">
  <version epoch="0" ver="1.7.17" rel="150000.111.3"/>
  <changelog author="dmueller@suse.com" date="1669723200">- add devel subpackage, which is needed by open-vm-tools</changelog>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for
  CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.9&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670328001">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.19&gt;
  Includes fixes for:
  - CVE-2023-25153 bsc#1208423
  - CVE-2023-25173 bsc#1208426</changelog>
  <changelog author="asarai@suse.com" date="1681819200">- Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.20&gt;</changelog>
  <changelog author="meissner@suse.com" date="1683201600">[ This was only released in SLE. ]
- unversion to golang requires to always use the current default go.
  (bsc#1210298)</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.21&gt; bsc#1211578
- Require a minimum Go version explicitly rather than using golang(API).
  Fixes the change for bsc#1210298.</changelog>
  <changelog author="priyanka.saggu@suse.com" date="1693483200">- Add `Provides: cri-runtime` to use containerd as container runtime in Factory
  Kubernetes packages</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.6&gt; bsc#1215323</changelog>
  <changelog author="asarai@suse.com" date="1697198400">- Update to containerd v1.7.7. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.7&gt;
- Add patch to fix build on SLE-12:
  + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to containerd v1.7.8. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.8&gt; bsc#1200528
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1701691200">- Update to containerd v1.7.10. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.10&gt;
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1704715200">- Add patch for bsc#1217952:
  + 0002-shim-Create-pid-file-with-0644-permissions.patch</changelog>
  <changelog author="dcermak@suse.com" date="1705320000">- Enable manpage generation
- Make devel package noarch
- adjust rpmlint filters</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="eyadlorenzo@gmail.com" date="1713700800">- Use obs_scm service instead of tar_scm
- Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch
  (merged upstream at
  &lt;https://github.com/containerd/containerd/pull/9571&gt;)
- Update to containerd v1.7.15. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.15&gt;
- Update to containerd v1.7.14. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.14&gt;
- Update to containerd v1.7.13. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.13&gt;
- Update to containerd v1.7.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.12&gt;
- Update to containerd v1.7.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.11&gt;
  GHSA-jq35-85cj-fj4p bsc#1224323</changelog>
  <changelog author="asarai@suse.com" date="1716379200">- Update to containerd v1.7.17. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.17&gt;
- Switch back to using tar_scm service. Aside from obs_scm using more bandwidth
  and storage than a locally-compressed tar.xz, it seems there's some weird
  issue with paths in obscpio that break our SLE-12-only patch.
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
- Update to containerd v1.7.16. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.16&gt;
  CVE-2023-45288 bsc#1221400</changelog>
</package>
<package pkgid="64adbd9395d3373ebb983aaa8ca93af8287bf2e63c96f13a1af3dffa396942dc" name="containerd" arch="x86_64">
  <version epoch="0" ver="1.7.17" rel="150000.111.3"/>
  <changelog author="dmueller@suse.com" date="1669723200">- add devel subpackage, which is needed by open-vm-tools</changelog>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for
  CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.9&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670328001">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.19&gt;
  Includes fixes for:
  - CVE-2023-25153 bsc#1208423
  - CVE-2023-25173 bsc#1208426</changelog>
  <changelog author="asarai@suse.com" date="1681819200">- Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.20&gt;</changelog>
  <changelog author="meissner@suse.com" date="1683201600">[ This was only released in SLE. ]
- unversion to golang requires to always use the current default go.
  (bsc#1210298)</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.21&gt; bsc#1211578
- Require a minimum Go version explicitly rather than using golang(API).
  Fixes the change for bsc#1210298.</changelog>
  <changelog author="priyanka.saggu@suse.com" date="1693483200">- Add `Provides: cri-runtime` to use containerd as container runtime in Factory
  Kubernetes packages</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.6&gt; bsc#1215323</changelog>
  <changelog author="asarai@suse.com" date="1697198400">- Update to containerd v1.7.7. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.7&gt;
- Add patch to fix build on SLE-12:
  + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to containerd v1.7.8. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.8&gt; bsc#1200528
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1701691200">- Update to containerd v1.7.10. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.10&gt;
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1704715200">- Add patch for bsc#1217952:
  + 0002-shim-Create-pid-file-with-0644-permissions.patch</changelog>
  <changelog author="dcermak@suse.com" date="1705320000">- Enable manpage generation
- Make devel package noarch
- adjust rpmlint filters</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="eyadlorenzo@gmail.com" date="1713700800">- Use obs_scm service instead of tar_scm
- Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch
  (merged upstream at
  &lt;https://github.com/containerd/containerd/pull/9571&gt;)
- Update to containerd v1.7.15. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.15&gt;
- Update to containerd v1.7.14. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.14&gt;
- Update to containerd v1.7.13. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.13&gt;
- Update to containerd v1.7.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.12&gt;
- Update to containerd v1.7.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.11&gt;
  GHSA-jq35-85cj-fj4p bsc#1224323</changelog>
  <changelog author="asarai@suse.com" date="1716379200">- Update to containerd v1.7.17. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.17&gt;
- Switch back to using tar_scm service. Aside from obs_scm using more bandwidth
  and storage than a locally-compressed tar.xz, it seems there's some weird
  issue with paths in obscpio that break our SLE-12-only patch.
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
- Update to containerd v1.7.16. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.16&gt;
  CVE-2023-45288 bsc#1221400</changelog>
</package>
<package pkgid="b484950d41c414cb3dafd9ac44fd7b8b97235247885573b12e8723eaf846153d" name="containerd" arch="aarch64">
  <version epoch="0" ver="1.7.17" rel="150000.114.1"/>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for
  CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.9&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670328001">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.19&gt;
  Includes fixes for:
  - CVE-2023-25153 bsc#1208423
  - CVE-2023-25173 bsc#1208426</changelog>
  <changelog author="asarai@suse.com" date="1681819200">- Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.20&gt;</changelog>
  <changelog author="meissner@suse.com" date="1683201600">[ This was only released in SLE. ]
- unversion to golang requires to always use the current default go.
  (bsc#1210298)</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.21&gt; bsc#1211578
- Require a minimum Go version explicitly rather than using golang(API).
  Fixes the change for bsc#1210298.</changelog>
  <changelog author="priyanka.saggu@suse.com" date="1693483200">- Add `Provides: cri-runtime` to use containerd as container runtime in Factory
  Kubernetes packages</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.6&gt; bsc#1215323</changelog>
  <changelog author="asarai@suse.com" date="1697198400">- Update to containerd v1.7.7. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.7&gt;
- Add patch to fix build on SLE-12:
  + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to containerd v1.7.8. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.8&gt; bsc#1200528
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1701691200">- Update to containerd v1.7.10. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.10&gt;
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1704715200">- Add patch for bsc#1217952:
  + 0002-shim-Create-pid-file-with-0644-permissions.patch</changelog>
  <changelog author="dcermak@suse.com" date="1705320000">- Enable manpage generation
- Make devel package noarch
- adjust rpmlint filters</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="eyadlorenzo@gmail.com" date="1713700800">- Use obs_scm service instead of tar_scm
- Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch
  (merged upstream at
  &lt;https://github.com/containerd/containerd/pull/9571&gt;)
- Update to containerd v1.7.15. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.15&gt;
- Update to containerd v1.7.14. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.14&gt;
- Update to containerd v1.7.13. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.13&gt;
- Update to containerd v1.7.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.12&gt;
- Update to containerd v1.7.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.11&gt;
  GHSA-jq35-85cj-fj4p bsc#1224323</changelog>
  <changelog author="asarai@suse.com" date="1716379200">- Update to containerd v1.7.17. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.17&gt;
- Switch back to using tar_scm service. Aside from obs_scm using more bandwidth
  and storage than a locally-compressed tar.xz, it seems there's some weird
  issue with paths in obscpio that break our SLE-12-only patch.
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
- Update to containerd v1.7.16. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.16&gt;
  CVE-2023-45288 bsc#1221400</changelog>
  <changelog author="dcermak@suse.com" date="1719230400">- Revert noarch for devel subpackage
  Switching to noarch causes issues on SLES maintenance updates, reverting it
  fixes our image builds</changelog>
</package>
<package pkgid="6032a4c9b58d0da2a7916e6177e2ba10915a015937af565779c23c8576a70741" name="containerd" arch="ppc64le">
  <version epoch="0" ver="1.7.17" rel="150000.114.1"/>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for
  CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.9&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670328001">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.19&gt;
  Includes fixes for:
  - CVE-2023-25153 bsc#1208423
  - CVE-2023-25173 bsc#1208426</changelog>
  <changelog author="asarai@suse.com" date="1681819200">- Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.20&gt;</changelog>
  <changelog author="meissner@suse.com" date="1683201600">[ This was only released in SLE. ]
- unversion to golang requires to always use the current default go.
  (bsc#1210298)</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.21&gt; bsc#1211578
- Require a minimum Go version explicitly rather than using golang(API).
  Fixes the change for bsc#1210298.</changelog>
  <changelog author="priyanka.saggu@suse.com" date="1693483200">- Add `Provides: cri-runtime` to use containerd as container runtime in Factory
  Kubernetes packages</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.6&gt; bsc#1215323</changelog>
  <changelog author="asarai@suse.com" date="1697198400">- Update to containerd v1.7.7. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.7&gt;
- Add patch to fix build on SLE-12:
  + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to containerd v1.7.8. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.8&gt; bsc#1200528
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1701691200">- Update to containerd v1.7.10. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.10&gt;
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1704715200">- Add patch for bsc#1217952:
  + 0002-shim-Create-pid-file-with-0644-permissions.patch</changelog>
  <changelog author="dcermak@suse.com" date="1705320000">- Enable manpage generation
- Make devel package noarch
- adjust rpmlint filters</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="eyadlorenzo@gmail.com" date="1713700800">- Use obs_scm service instead of tar_scm
- Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch
  (merged upstream at
  &lt;https://github.com/containerd/containerd/pull/9571&gt;)
- Update to containerd v1.7.15. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.15&gt;
- Update to containerd v1.7.14. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.14&gt;
- Update to containerd v1.7.13. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.13&gt;
- Update to containerd v1.7.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.12&gt;
- Update to containerd v1.7.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.11&gt;
  GHSA-jq35-85cj-fj4p bsc#1224323</changelog>
  <changelog author="asarai@suse.com" date="1716379200">- Update to containerd v1.7.17. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.17&gt;
- Switch back to using tar_scm service. Aside from obs_scm using more bandwidth
  and storage than a locally-compressed tar.xz, it seems there's some weird
  issue with paths in obscpio that break our SLE-12-only patch.
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
- Update to containerd v1.7.16. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.16&gt;
  CVE-2023-45288 bsc#1221400</changelog>
  <changelog author="dcermak@suse.com" date="1719230400">- Revert noarch for devel subpackage
  Switching to noarch causes issues on SLES maintenance updates, reverting it
  fixes our image builds</changelog>
</package>
<package pkgid="9d3e3ad597e82320ea39dc2ef1d3a390fef4c8085624f7561c4ee3ca7bbd5c6d" name="containerd" arch="s390x">
  <version epoch="0" ver="1.7.17" rel="150000.114.1"/>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for
  CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.9&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670328001">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.19&gt;
  Includes fixes for:
  - CVE-2023-25153 bsc#1208423
  - CVE-2023-25173 bsc#1208426</changelog>
  <changelog author="asarai@suse.com" date="1681819200">- Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.20&gt;</changelog>
  <changelog author="meissner@suse.com" date="1683201600">[ This was only released in SLE. ]
- unversion to golang requires to always use the current default go.
  (bsc#1210298)</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.21&gt; bsc#1211578
- Require a minimum Go version explicitly rather than using golang(API).
  Fixes the change for bsc#1210298.</changelog>
  <changelog author="priyanka.saggu@suse.com" date="1693483200">- Add `Provides: cri-runtime` to use containerd as container runtime in Factory
  Kubernetes packages</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.6&gt; bsc#1215323</changelog>
  <changelog author="asarai@suse.com" date="1697198400">- Update to containerd v1.7.7. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.7&gt;
- Add patch to fix build on SLE-12:
  + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to containerd v1.7.8. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.8&gt; bsc#1200528
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1701691200">- Update to containerd v1.7.10. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.10&gt;
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1704715200">- Add patch for bsc#1217952:
  + 0002-shim-Create-pid-file-with-0644-permissions.patch</changelog>
  <changelog author="dcermak@suse.com" date="1705320000">- Enable manpage generation
- Make devel package noarch
- adjust rpmlint filters</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="eyadlorenzo@gmail.com" date="1713700800">- Use obs_scm service instead of tar_scm
- Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch
  (merged upstream at
  &lt;https://github.com/containerd/containerd/pull/9571&gt;)
- Update to containerd v1.7.15. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.15&gt;
- Update to containerd v1.7.14. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.14&gt;
- Update to containerd v1.7.13. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.13&gt;
- Update to containerd v1.7.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.12&gt;
- Update to containerd v1.7.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.11&gt;
  GHSA-jq35-85cj-fj4p bsc#1224323</changelog>
  <changelog author="asarai@suse.com" date="1716379200">- Update to containerd v1.7.17. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.17&gt;
- Switch back to using tar_scm service. Aside from obs_scm using more bandwidth
  and storage than a locally-compressed tar.xz, it seems there's some weird
  issue with paths in obscpio that break our SLE-12-only patch.
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
- Update to containerd v1.7.16. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.16&gt;
  CVE-2023-45288 bsc#1221400</changelog>
  <changelog author="dcermak@suse.com" date="1719230400">- Revert noarch for devel subpackage
  Switching to noarch causes issues on SLES maintenance updates, reverting it
  fixes our image builds</changelog>
</package>
<package pkgid="e8d8069e9d9c8c34cf8e81ecce2f44512dbf3d084f785ca3eb3d72d38ba6a817" name="containerd" arch="src">
  <version epoch="0" ver="1.7.17" rel="150000.114.1"/>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for
  CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.9&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670328001">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.19&gt;
  Includes fixes for:
  - CVE-2023-25153 bsc#1208423
  - CVE-2023-25173 bsc#1208426</changelog>
  <changelog author="asarai@suse.com" date="1681819200">- Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.20&gt;</changelog>
  <changelog author="meissner@suse.com" date="1683201600">[ This was only released in SLE. ]
- unversion to golang requires to always use the current default go.
  (bsc#1210298)</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.21&gt; bsc#1211578
- Require a minimum Go version explicitly rather than using golang(API).
  Fixes the change for bsc#1210298.</changelog>
  <changelog author="priyanka.saggu@suse.com" date="1693483200">- Add `Provides: cri-runtime` to use containerd as container runtime in Factory
  Kubernetes packages</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.6&gt; bsc#1215323</changelog>
  <changelog author="asarai@suse.com" date="1697198400">- Update to containerd v1.7.7. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.7&gt;
- Add patch to fix build on SLE-12:
  + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to containerd v1.7.8. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.8&gt; bsc#1200528
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1701691200">- Update to containerd v1.7.10. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.10&gt;
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1704715200">- Add patch for bsc#1217952:
  + 0002-shim-Create-pid-file-with-0644-permissions.patch</changelog>
  <changelog author="dcermak@suse.com" date="1705320000">- Enable manpage generation
- Make devel package noarch
- adjust rpmlint filters</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="eyadlorenzo@gmail.com" date="1713700800">- Use obs_scm service instead of tar_scm
- Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch
  (merged upstream at
  &lt;https://github.com/containerd/containerd/pull/9571&gt;)
- Update to containerd v1.7.15. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.15&gt;
- Update to containerd v1.7.14. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.14&gt;
- Update to containerd v1.7.13. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.13&gt;
- Update to containerd v1.7.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.12&gt;
- Update to containerd v1.7.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.11&gt;
  GHSA-jq35-85cj-fj4p bsc#1224323</changelog>
  <changelog author="asarai@suse.com" date="1716379200">- Update to containerd v1.7.17. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.17&gt;
- Switch back to using tar_scm service. Aside from obs_scm using more bandwidth
  and storage than a locally-compressed tar.xz, it seems there's some weird
  issue with paths in obscpio that break our SLE-12-only patch.
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
- Update to containerd v1.7.16. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.16&gt;
  CVE-2023-45288 bsc#1221400</changelog>
  <changelog author="dcermak@suse.com" date="1719230400">- Revert noarch for devel subpackage
  Switching to noarch causes issues on SLES maintenance updates, reverting it
  fixes our image builds</changelog>
</package>
<package pkgid="ab475be7032936624df606af6748124192243f427cec3088f247f10449d899c3" name="containerd" arch="x86_64">
  <version epoch="0" ver="1.7.17" rel="150000.114.1"/>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for
  CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.9&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670328001">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.19&gt;
  Includes fixes for:
  - CVE-2023-25153 bsc#1208423
  - CVE-2023-25173 bsc#1208426</changelog>
  <changelog author="asarai@suse.com" date="1681819200">- Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.20&gt;</changelog>
  <changelog author="meissner@suse.com" date="1683201600">[ This was only released in SLE. ]
- unversion to golang requires to always use the current default go.
  (bsc#1210298)</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.21&gt; bsc#1211578
- Require a minimum Go version explicitly rather than using golang(API).
  Fixes the change for bsc#1210298.</changelog>
  <changelog author="priyanka.saggu@suse.com" date="1693483200">- Add `Provides: cri-runtime` to use containerd as container runtime in Factory
  Kubernetes packages</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.6&gt; bsc#1215323</changelog>
  <changelog author="asarai@suse.com" date="1697198400">- Update to containerd v1.7.7. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.7&gt;
- Add patch to fix build on SLE-12:
  + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to containerd v1.7.8. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.8&gt; bsc#1200528
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1701691200">- Update to containerd v1.7.10. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.10&gt;
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1704715200">- Add patch for bsc#1217952:
  + 0002-shim-Create-pid-file-with-0644-permissions.patch</changelog>
  <changelog author="dcermak@suse.com" date="1705320000">- Enable manpage generation
- Make devel package noarch
- adjust rpmlint filters</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="eyadlorenzo@gmail.com" date="1713700800">- Use obs_scm service instead of tar_scm
- Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch
  (merged upstream at
  &lt;https://github.com/containerd/containerd/pull/9571&gt;)
- Update to containerd v1.7.15. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.15&gt;
- Update to containerd v1.7.14. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.14&gt;
- Update to containerd v1.7.13. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.13&gt;
- Update to containerd v1.7.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.12&gt;
- Update to containerd v1.7.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.11&gt;
  GHSA-jq35-85cj-fj4p bsc#1224323</changelog>
  <changelog author="asarai@suse.com" date="1716379200">- Update to containerd v1.7.17. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.17&gt;
- Switch back to using tar_scm service. Aside from obs_scm using more bandwidth
  and storage than a locally-compressed tar.xz, it seems there's some weird
  issue with paths in obscpio that break our SLE-12-only patch.
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
- Update to containerd v1.7.16. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.16&gt;
  CVE-2023-45288 bsc#1221400</changelog>
  <changelog author="dcermak@suse.com" date="1719230400">- Revert noarch for devel subpackage
  Switching to noarch causes issues on SLES maintenance updates, reverting it
  fixes our image builds</changelog>
</package>
<package pkgid="7b79ff08e48ff9c6af252b4df349bc4d78202ef892b77e38b1219e933c90502a" name="containerd" arch="aarch64">
  <version epoch="0" ver="1.7.21" rel="150000.117.1"/>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.19&gt;
  Includes fixes for:
  - CVE-2023-25153 bsc#1208423
  - CVE-2023-25173 bsc#1208426</changelog>
  <changelog author="asarai@suse.com" date="1681819200">- Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.20&gt;</changelog>
  <changelog author="meissner@suse.com" date="1683201600">[ This was only released in SLE. ]
- unversion to golang requires to always use the current default go.
  (bsc#1210298)</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.21&gt; bsc#1211578
- Require a minimum Go version explicitly rather than using golang(API).
  Fixes the change for bsc#1210298.</changelog>
  <changelog author="priyanka.saggu@suse.com" date="1693483200">- Add `Provides: cri-runtime` to use containerd as container runtime in Factory
  Kubernetes packages</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.6&gt; bsc#1215323</changelog>
  <changelog author="asarai@suse.com" date="1697198400">- Update to containerd v1.7.7. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.7&gt;
- Add patch to fix build on SLE-12:
  + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to containerd v1.7.8. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.8&gt;
  Includes fixes for:
  - CVE-2022-1996 bsc#1200528
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1701691200">- Update to containerd v1.7.10. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.10&gt;
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1704715200">- Add patch for bsc#1217952:
  + 0002-shim-Create-pid-file-with-0644-permissions.patch</changelog>
  <changelog author="dcermak@suse.com" date="1705320000">- Enable manpage generation
- Make devel package noarch
- adjust rpmlint filters</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="eyadlorenzo@gmail.com" date="1713700800">- Use obs_scm service instead of tar_scm
- Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch
  (merged upstream at
  &lt;https://github.com/containerd/containerd/pull/9571&gt;)
- Update to containerd v1.7.15. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.15&gt;
- Update to containerd v1.7.14. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.14&gt;
- Update to containerd v1.7.13. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.13&gt;
- Update to containerd v1.7.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.12&gt;
- Update to containerd v1.7.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.11&gt;
  GHSA-jq35-85cj-fj4p bsc#1224323</changelog>
  <changelog author="asarai@suse.com" date="1716379200">- Update to containerd v1.7.17. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.17&gt;
- Switch back to using tar_scm service. Aside from obs_scm using more bandwidth
  and storage than a locally-compressed tar.xz, it seems there's some weird
  issue with paths in obscpio that break our SLE-12-only patch.
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
- Update to containerd v1.7.16. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.16&gt;
  CVE-2023-45288 bsc#1221400</changelog>
  <changelog author="dcermak@suse.com" date="1719230400">- Revert noarch for devel subpackage for SLE 15
  Switching to noarch causes issues on SLES maintenance updates, reverting it
  fixes our image builds</changelog>
  <changelog author="asarai@suse.com" date="1725537600">- Update to containerd v1.7.21. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.21&gt;
  Fixes CVE-2023-47108. bsc#1217070
  Fixes CVE-2023-45142. bsc#1228553
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
</package>
<package pkgid="b8b3d1cfab441f78963f6e31050f5bc37e4f72e943e5490a2fde2ad03f005632" name="containerd" arch="ppc64le">
  <version epoch="0" ver="1.7.21" rel="150000.117.1"/>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.19&gt;
  Includes fixes for:
  - CVE-2023-25153 bsc#1208423
  - CVE-2023-25173 bsc#1208426</changelog>
  <changelog author="asarai@suse.com" date="1681819200">- Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.20&gt;</changelog>
  <changelog author="meissner@suse.com" date="1683201600">[ This was only released in SLE. ]
- unversion to golang requires to always use the current default go.
  (bsc#1210298)</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.21&gt; bsc#1211578
- Require a minimum Go version explicitly rather than using golang(API).
  Fixes the change for bsc#1210298.</changelog>
  <changelog author="priyanka.saggu@suse.com" date="1693483200">- Add `Provides: cri-runtime` to use containerd as container runtime in Factory
  Kubernetes packages</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.6&gt; bsc#1215323</changelog>
  <changelog author="asarai@suse.com" date="1697198400">- Update to containerd v1.7.7. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.7&gt;
- Add patch to fix build on SLE-12:
  + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to containerd v1.7.8. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.8&gt;
  Includes fixes for:
  - CVE-2022-1996 bsc#1200528
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1701691200">- Update to containerd v1.7.10. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.10&gt;
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1704715200">- Add patch for bsc#1217952:
  + 0002-shim-Create-pid-file-with-0644-permissions.patch</changelog>
  <changelog author="dcermak@suse.com" date="1705320000">- Enable manpage generation
- Make devel package noarch
- adjust rpmlint filters</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="eyadlorenzo@gmail.com" date="1713700800">- Use obs_scm service instead of tar_scm
- Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch
  (merged upstream at
  &lt;https://github.com/containerd/containerd/pull/9571&gt;)
- Update to containerd v1.7.15. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.15&gt;
- Update to containerd v1.7.14. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.14&gt;
- Update to containerd v1.7.13. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.13&gt;
- Update to containerd v1.7.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.12&gt;
- Update to containerd v1.7.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.11&gt;
  GHSA-jq35-85cj-fj4p bsc#1224323</changelog>
  <changelog author="asarai@suse.com" date="1716379200">- Update to containerd v1.7.17. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.17&gt;
- Switch back to using tar_scm service. Aside from obs_scm using more bandwidth
  and storage than a locally-compressed tar.xz, it seems there's some weird
  issue with paths in obscpio that break our SLE-12-only patch.
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
- Update to containerd v1.7.16. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.16&gt;
  CVE-2023-45288 bsc#1221400</changelog>
  <changelog author="dcermak@suse.com" date="1719230400">- Revert noarch for devel subpackage for SLE 15
  Switching to noarch causes issues on SLES maintenance updates, reverting it
  fixes our image builds</changelog>
  <changelog author="asarai@suse.com" date="1725537600">- Update to containerd v1.7.21. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.21&gt;
  Fixes CVE-2023-47108. bsc#1217070
  Fixes CVE-2023-45142. bsc#1228553
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
</package>
<package pkgid="ab0d1ab256e384387bfc33b77561b196f8b04d5c8f80e0d9030a434be7e74b1c" name="containerd" arch="s390x">
  <version epoch="0" ver="1.7.21" rel="150000.117.1"/>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.19&gt;
  Includes fixes for:
  - CVE-2023-25153 bsc#1208423
  - CVE-2023-25173 bsc#1208426</changelog>
  <changelog author="asarai@suse.com" date="1681819200">- Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.20&gt;</changelog>
  <changelog author="meissner@suse.com" date="1683201600">[ This was only released in SLE. ]
- unversion to golang requires to always use the current default go.
  (bsc#1210298)</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.21&gt; bsc#1211578
- Require a minimum Go version explicitly rather than using golang(API).
  Fixes the change for bsc#1210298.</changelog>
  <changelog author="priyanka.saggu@suse.com" date="1693483200">- Add `Provides: cri-runtime` to use containerd as container runtime in Factory
  Kubernetes packages</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.6&gt; bsc#1215323</changelog>
  <changelog author="asarai@suse.com" date="1697198400">- Update to containerd v1.7.7. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.7&gt;
- Add patch to fix build on SLE-12:
  + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to containerd v1.7.8. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.8&gt;
  Includes fixes for:
  - CVE-2022-1996 bsc#1200528
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1701691200">- Update to containerd v1.7.10. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.10&gt;
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1704715200">- Add patch for bsc#1217952:
  + 0002-shim-Create-pid-file-with-0644-permissions.patch</changelog>
  <changelog author="dcermak@suse.com" date="1705320000">- Enable manpage generation
- Make devel package noarch
- adjust rpmlint filters</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="eyadlorenzo@gmail.com" date="1713700800">- Use obs_scm service instead of tar_scm
- Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch
  (merged upstream at
  &lt;https://github.com/containerd/containerd/pull/9571&gt;)
- Update to containerd v1.7.15. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.15&gt;
- Update to containerd v1.7.14. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.14&gt;
- Update to containerd v1.7.13. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.13&gt;
- Update to containerd v1.7.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.12&gt;
- Update to containerd v1.7.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.11&gt;
  GHSA-jq35-85cj-fj4p bsc#1224323</changelog>
  <changelog author="asarai@suse.com" date="1716379200">- Update to containerd v1.7.17. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.17&gt;
- Switch back to using tar_scm service. Aside from obs_scm using more bandwidth
  and storage than a locally-compressed tar.xz, it seems there's some weird
  issue with paths in obscpio that break our SLE-12-only patch.
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
- Update to containerd v1.7.16. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.16&gt;
  CVE-2023-45288 bsc#1221400</changelog>
  <changelog author="dcermak@suse.com" date="1719230400">- Revert noarch for devel subpackage for SLE 15
  Switching to noarch causes issues on SLES maintenance updates, reverting it
  fixes our image builds</changelog>
  <changelog author="asarai@suse.com" date="1725537600">- Update to containerd v1.7.21. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.21&gt;
  Fixes CVE-2023-47108. bsc#1217070
  Fixes CVE-2023-45142. bsc#1228553
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
</package>
<package pkgid="f034e46b1b2736cc248d004e01bb1a18051600b78f0a64d30a2b5932502bff18" name="containerd" arch="src">
  <version epoch="0" ver="1.7.21" rel="150000.117.1"/>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.19&gt;
  Includes fixes for:
  - CVE-2023-25153 bsc#1208423
  - CVE-2023-25173 bsc#1208426</changelog>
  <changelog author="asarai@suse.com" date="1681819200">- Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.20&gt;</changelog>
  <changelog author="meissner@suse.com" date="1683201600">[ This was only released in SLE. ]
- unversion to golang requires to always use the current default go.
  (bsc#1210298)</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.21&gt; bsc#1211578
- Require a minimum Go version explicitly rather than using golang(API).
  Fixes the change for bsc#1210298.</changelog>
  <changelog author="priyanka.saggu@suse.com" date="1693483200">- Add `Provides: cri-runtime` to use containerd as container runtime in Factory
  Kubernetes packages</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.6&gt; bsc#1215323</changelog>
  <changelog author="asarai@suse.com" date="1697198400">- Update to containerd v1.7.7. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.7&gt;
- Add patch to fix build on SLE-12:
  + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to containerd v1.7.8. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.8&gt;
  Includes fixes for:
  - CVE-2022-1996 bsc#1200528
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1701691200">- Update to containerd v1.7.10. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.10&gt;
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1704715200">- Add patch for bsc#1217952:
  + 0002-shim-Create-pid-file-with-0644-permissions.patch</changelog>
  <changelog author="dcermak@suse.com" date="1705320000">- Enable manpage generation
- Make devel package noarch
- adjust rpmlint filters</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="eyadlorenzo@gmail.com" date="1713700800">- Use obs_scm service instead of tar_scm
- Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch
  (merged upstream at
  &lt;https://github.com/containerd/containerd/pull/9571&gt;)
- Update to containerd v1.7.15. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.15&gt;
- Update to containerd v1.7.14. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.14&gt;
- Update to containerd v1.7.13. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.13&gt;
- Update to containerd v1.7.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.12&gt;
- Update to containerd v1.7.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.11&gt;
  GHSA-jq35-85cj-fj4p bsc#1224323</changelog>
  <changelog author="asarai@suse.com" date="1716379200">- Update to containerd v1.7.17. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.17&gt;
- Switch back to using tar_scm service. Aside from obs_scm using more bandwidth
  and storage than a locally-compressed tar.xz, it seems there's some weird
  issue with paths in obscpio that break our SLE-12-only patch.
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
- Update to containerd v1.7.16. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.16&gt;
  CVE-2023-45288 bsc#1221400</changelog>
  <changelog author="dcermak@suse.com" date="1719230400">- Revert noarch for devel subpackage for SLE 15
  Switching to noarch causes issues on SLES maintenance updates, reverting it
  fixes our image builds</changelog>
  <changelog author="asarai@suse.com" date="1725537600">- Update to containerd v1.7.21. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.21&gt;
  Fixes CVE-2023-47108. bsc#1217070
  Fixes CVE-2023-45142. bsc#1228553
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
</package>
<package pkgid="6271ef86d873d9405e2852d44a9e6a4ba24c6f88c10e42c62c40df151fefa67a" name="containerd" arch="x86_64">
  <version epoch="0" ver="1.7.21" rel="150000.117.1"/>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.19&gt;
  Includes fixes for:
  - CVE-2023-25153 bsc#1208423
  - CVE-2023-25173 bsc#1208426</changelog>
  <changelog author="asarai@suse.com" date="1681819200">- Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.20&gt;</changelog>
  <changelog author="meissner@suse.com" date="1683201600">[ This was only released in SLE. ]
- unversion to golang requires to always use the current default go.
  (bsc#1210298)</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.21&gt; bsc#1211578
- Require a minimum Go version explicitly rather than using golang(API).
  Fixes the change for bsc#1210298.</changelog>
  <changelog author="priyanka.saggu@suse.com" date="1693483200">- Add `Provides: cri-runtime` to use containerd as container runtime in Factory
  Kubernetes packages</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.6&gt; bsc#1215323</changelog>
  <changelog author="asarai@suse.com" date="1697198400">- Update to containerd v1.7.7. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.7&gt;
- Add patch to fix build on SLE-12:
  + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to containerd v1.7.8. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.8&gt;
  Includes fixes for:
  - CVE-2022-1996 bsc#1200528
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1701691200">- Update to containerd v1.7.10. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.10&gt;
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1704715200">- Add patch for bsc#1217952:
  + 0002-shim-Create-pid-file-with-0644-permissions.patch</changelog>
  <changelog author="dcermak@suse.com" date="1705320000">- Enable manpage generation
- Make devel package noarch
- adjust rpmlint filters</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="eyadlorenzo@gmail.com" date="1713700800">- Use obs_scm service instead of tar_scm
- Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch
  (merged upstream at
  &lt;https://github.com/containerd/containerd/pull/9571&gt;)
- Update to containerd v1.7.15. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.15&gt;
- Update to containerd v1.7.14. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.14&gt;
- Update to containerd v1.7.13. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.13&gt;
- Update to containerd v1.7.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.12&gt;
- Update to containerd v1.7.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.11&gt;
  GHSA-jq35-85cj-fj4p bsc#1224323</changelog>
  <changelog author="asarai@suse.com" date="1716379200">- Update to containerd v1.7.17. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.17&gt;
- Switch back to using tar_scm service. Aside from obs_scm using more bandwidth
  and storage than a locally-compressed tar.xz, it seems there's some weird
  issue with paths in obscpio that break our SLE-12-only patch.
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
- Update to containerd v1.7.16. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.16&gt;
  CVE-2023-45288 bsc#1221400</changelog>
  <changelog author="dcermak@suse.com" date="1719230400">- Revert noarch for devel subpackage for SLE 15
  Switching to noarch causes issues on SLES maintenance updates, reverting it
  fixes our image builds</changelog>
  <changelog author="asarai@suse.com" date="1725537600">- Update to containerd v1.7.21. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.21&gt;
  Fixes CVE-2023-47108. bsc#1217070
  Fixes CVE-2023-45142. bsc#1228553
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
</package>
<package pkgid="5d40a1300e892966b47a3f9eafcbf00619f65bbfa65ad0e462a65f9417cd24d2" name="containerd-ctr" arch="aarch64">
  <version epoch="0" ver="1.7.17" rel="150000.111.3"/>
  <changelog author="dmueller@suse.com" date="1669723200">- add devel subpackage, which is needed by open-vm-tools</changelog>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for
  CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.9&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670328001">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.19&gt;
  Includes fixes for:
  - CVE-2023-25153 bsc#1208423
  - CVE-2023-25173 bsc#1208426</changelog>
  <changelog author="asarai@suse.com" date="1681819200">- Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.20&gt;</changelog>
  <changelog author="meissner@suse.com" date="1683201600">[ This was only released in SLE. ]
- unversion to golang requires to always use the current default go.
  (bsc#1210298)</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.21&gt; bsc#1211578
- Require a minimum Go version explicitly rather than using golang(API).
  Fixes the change for bsc#1210298.</changelog>
  <changelog author="priyanka.saggu@suse.com" date="1693483200">- Add `Provides: cri-runtime` to use containerd as container runtime in Factory
  Kubernetes packages</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.6&gt; bsc#1215323</changelog>
  <changelog author="asarai@suse.com" date="1697198400">- Update to containerd v1.7.7. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.7&gt;
- Add patch to fix build on SLE-12:
  + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to containerd v1.7.8. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.8&gt; bsc#1200528
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1701691200">- Update to containerd v1.7.10. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.10&gt;
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1704715200">- Add patch for bsc#1217952:
  + 0002-shim-Create-pid-file-with-0644-permissions.patch</changelog>
  <changelog author="dcermak@suse.com" date="1705320000">- Enable manpage generation
- Make devel package noarch
- adjust rpmlint filters</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="eyadlorenzo@gmail.com" date="1713700800">- Use obs_scm service instead of tar_scm
- Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch
  (merged upstream at
  &lt;https://github.com/containerd/containerd/pull/9571&gt;)
- Update to containerd v1.7.15. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.15&gt;
- Update to containerd v1.7.14. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.14&gt;
- Update to containerd v1.7.13. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.13&gt;
- Update to containerd v1.7.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.12&gt;
- Update to containerd v1.7.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.11&gt;
  GHSA-jq35-85cj-fj4p bsc#1224323</changelog>
  <changelog author="asarai@suse.com" date="1716379200">- Update to containerd v1.7.17. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.17&gt;
- Switch back to using tar_scm service. Aside from obs_scm using more bandwidth
  and storage than a locally-compressed tar.xz, it seems there's some weird
  issue with paths in obscpio that break our SLE-12-only patch.
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
- Update to containerd v1.7.16. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.16&gt;
  CVE-2023-45288 bsc#1221400</changelog>
</package>
<package pkgid="8e36bf274f0897236c9bd210ec5455284651282cdceb461253606390946a4263" name="containerd-ctr" arch="ppc64le">
  <version epoch="0" ver="1.7.17" rel="150000.111.3"/>
  <changelog author="dmueller@suse.com" date="1669723200">- add devel subpackage, which is needed by open-vm-tools</changelog>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for
  CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.9&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670328001">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.19&gt;
  Includes fixes for:
  - CVE-2023-25153 bsc#1208423
  - CVE-2023-25173 bsc#1208426</changelog>
  <changelog author="asarai@suse.com" date="1681819200">- Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.20&gt;</changelog>
  <changelog author="meissner@suse.com" date="1683201600">[ This was only released in SLE. ]
- unversion to golang requires to always use the current default go.
  (bsc#1210298)</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.21&gt; bsc#1211578
- Require a minimum Go version explicitly rather than using golang(API).
  Fixes the change for bsc#1210298.</changelog>
  <changelog author="priyanka.saggu@suse.com" date="1693483200">- Add `Provides: cri-runtime` to use containerd as container runtime in Factory
  Kubernetes packages</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.6&gt; bsc#1215323</changelog>
  <changelog author="asarai@suse.com" date="1697198400">- Update to containerd v1.7.7. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.7&gt;
- Add patch to fix build on SLE-12:
  + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to containerd v1.7.8. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.8&gt; bsc#1200528
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1701691200">- Update to containerd v1.7.10. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.10&gt;
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1704715200">- Add patch for bsc#1217952:
  + 0002-shim-Create-pid-file-with-0644-permissions.patch</changelog>
  <changelog author="dcermak@suse.com" date="1705320000">- Enable manpage generation
- Make devel package noarch
- adjust rpmlint filters</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="eyadlorenzo@gmail.com" date="1713700800">- Use obs_scm service instead of tar_scm
- Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch
  (merged upstream at
  &lt;https://github.com/containerd/containerd/pull/9571&gt;)
- Update to containerd v1.7.15. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.15&gt;
- Update to containerd v1.7.14. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.14&gt;
- Update to containerd v1.7.13. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.13&gt;
- Update to containerd v1.7.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.12&gt;
- Update to containerd v1.7.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.11&gt;
  GHSA-jq35-85cj-fj4p bsc#1224323</changelog>
  <changelog author="asarai@suse.com" date="1716379200">- Update to containerd v1.7.17. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.17&gt;
- Switch back to using tar_scm service. Aside from obs_scm using more bandwidth
  and storage than a locally-compressed tar.xz, it seems there's some weird
  issue with paths in obscpio that break our SLE-12-only patch.
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
- Update to containerd v1.7.16. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.16&gt;
  CVE-2023-45288 bsc#1221400</changelog>
</package>
<package pkgid="686bc8eccc674be5cd44c594793a809a0151536e51f507f02982cb8773a46551" name="containerd-ctr" arch="s390x">
  <version epoch="0" ver="1.7.17" rel="150000.111.3"/>
  <changelog author="dmueller@suse.com" date="1669723200">- add devel subpackage, which is needed by open-vm-tools</changelog>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for
  CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.9&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670328001">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.19&gt;
  Includes fixes for:
  - CVE-2023-25153 bsc#1208423
  - CVE-2023-25173 bsc#1208426</changelog>
  <changelog author="asarai@suse.com" date="1681819200">- Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.20&gt;</changelog>
  <changelog author="meissner@suse.com" date="1683201600">[ This was only released in SLE. ]
- unversion to golang requires to always use the current default go.
  (bsc#1210298)</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.21&gt; bsc#1211578
- Require a minimum Go version explicitly rather than using golang(API).
  Fixes the change for bsc#1210298.</changelog>
  <changelog author="priyanka.saggu@suse.com" date="1693483200">- Add `Provides: cri-runtime` to use containerd as container runtime in Factory
  Kubernetes packages</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.6&gt; bsc#1215323</changelog>
  <changelog author="asarai@suse.com" date="1697198400">- Update to containerd v1.7.7. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.7&gt;
- Add patch to fix build on SLE-12:
  + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to containerd v1.7.8. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.8&gt; bsc#1200528
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1701691200">- Update to containerd v1.7.10. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.10&gt;
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1704715200">- Add patch for bsc#1217952:
  + 0002-shim-Create-pid-file-with-0644-permissions.patch</changelog>
  <changelog author="dcermak@suse.com" date="1705320000">- Enable manpage generation
- Make devel package noarch
- adjust rpmlint filters</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="eyadlorenzo@gmail.com" date="1713700800">- Use obs_scm service instead of tar_scm
- Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch
  (merged upstream at
  &lt;https://github.com/containerd/containerd/pull/9571&gt;)
- Update to containerd v1.7.15. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.15&gt;
- Update to containerd v1.7.14. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.14&gt;
- Update to containerd v1.7.13. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.13&gt;
- Update to containerd v1.7.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.12&gt;
- Update to containerd v1.7.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.11&gt;
  GHSA-jq35-85cj-fj4p bsc#1224323</changelog>
  <changelog author="asarai@suse.com" date="1716379200">- Update to containerd v1.7.17. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.17&gt;
- Switch back to using tar_scm service. Aside from obs_scm using more bandwidth
  and storage than a locally-compressed tar.xz, it seems there's some weird
  issue with paths in obscpio that break our SLE-12-only patch.
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
- Update to containerd v1.7.16. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.16&gt;
  CVE-2023-45288 bsc#1221400</changelog>
</package>
<package pkgid="f1df2a2a686088dd1d244d513a38930cc7050889b1f1f2d203f8b186918bc696" name="containerd-ctr" arch="x86_64">
  <version epoch="0" ver="1.7.17" rel="150000.111.3"/>
  <changelog author="dmueller@suse.com" date="1669723200">- add devel subpackage, which is needed by open-vm-tools</changelog>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for
  CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.9&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670328001">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.19&gt;
  Includes fixes for:
  - CVE-2023-25153 bsc#1208423
  - CVE-2023-25173 bsc#1208426</changelog>
  <changelog author="asarai@suse.com" date="1681819200">- Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.20&gt;</changelog>
  <changelog author="meissner@suse.com" date="1683201600">[ This was only released in SLE. ]
- unversion to golang requires to always use the current default go.
  (bsc#1210298)</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.21&gt; bsc#1211578
- Require a minimum Go version explicitly rather than using golang(API).
  Fixes the change for bsc#1210298.</changelog>
  <changelog author="priyanka.saggu@suse.com" date="1693483200">- Add `Provides: cri-runtime` to use containerd as container runtime in Factory
  Kubernetes packages</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.6&gt; bsc#1215323</changelog>
  <changelog author="asarai@suse.com" date="1697198400">- Update to containerd v1.7.7. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.7&gt;
- Add patch to fix build on SLE-12:
  + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to containerd v1.7.8. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.8&gt; bsc#1200528
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1701691200">- Update to containerd v1.7.10. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.10&gt;
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1704715200">- Add patch for bsc#1217952:
  + 0002-shim-Create-pid-file-with-0644-permissions.patch</changelog>
  <changelog author="dcermak@suse.com" date="1705320000">- Enable manpage generation
- Make devel package noarch
- adjust rpmlint filters</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="eyadlorenzo@gmail.com" date="1713700800">- Use obs_scm service instead of tar_scm
- Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch
  (merged upstream at
  &lt;https://github.com/containerd/containerd/pull/9571&gt;)
- Update to containerd v1.7.15. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.15&gt;
- Update to containerd v1.7.14. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.14&gt;
- Update to containerd v1.7.13. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.13&gt;
- Update to containerd v1.7.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.12&gt;
- Update to containerd v1.7.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.11&gt;
  GHSA-jq35-85cj-fj4p bsc#1224323</changelog>
  <changelog author="asarai@suse.com" date="1716379200">- Update to containerd v1.7.17. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.17&gt;
- Switch back to using tar_scm service. Aside from obs_scm using more bandwidth
  and storage than a locally-compressed tar.xz, it seems there's some weird
  issue with paths in obscpio that break our SLE-12-only patch.
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
- Update to containerd v1.7.16. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.16&gt;
  CVE-2023-45288 bsc#1221400</changelog>
</package>
<package pkgid="aedb9adf40ad327215357f3c6bed24c598ed53db86faeefa42b8419317ed162c" name="containerd-ctr" arch="aarch64">
  <version epoch="0" ver="1.7.17" rel="150000.114.1"/>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for
  CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.9&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670328001">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.19&gt;
  Includes fixes for:
  - CVE-2023-25153 bsc#1208423
  - CVE-2023-25173 bsc#1208426</changelog>
  <changelog author="asarai@suse.com" date="1681819200">- Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.20&gt;</changelog>
  <changelog author="meissner@suse.com" date="1683201600">[ This was only released in SLE. ]
- unversion to golang requires to always use the current default go.
  (bsc#1210298)</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.21&gt; bsc#1211578
- Require a minimum Go version explicitly rather than using golang(API).
  Fixes the change for bsc#1210298.</changelog>
  <changelog author="priyanka.saggu@suse.com" date="1693483200">- Add `Provides: cri-runtime` to use containerd as container runtime in Factory
  Kubernetes packages</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.6&gt; bsc#1215323</changelog>
  <changelog author="asarai@suse.com" date="1697198400">- Update to containerd v1.7.7. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.7&gt;
- Add patch to fix build on SLE-12:
  + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to containerd v1.7.8. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.8&gt; bsc#1200528
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1701691200">- Update to containerd v1.7.10. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.10&gt;
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1704715200">- Add patch for bsc#1217952:
  + 0002-shim-Create-pid-file-with-0644-permissions.patch</changelog>
  <changelog author="dcermak@suse.com" date="1705320000">- Enable manpage generation
- Make devel package noarch
- adjust rpmlint filters</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="eyadlorenzo@gmail.com" date="1713700800">- Use obs_scm service instead of tar_scm
- Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch
  (merged upstream at
  &lt;https://github.com/containerd/containerd/pull/9571&gt;)
- Update to containerd v1.7.15. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.15&gt;
- Update to containerd v1.7.14. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.14&gt;
- Update to containerd v1.7.13. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.13&gt;
- Update to containerd v1.7.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.12&gt;
- Update to containerd v1.7.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.11&gt;
  GHSA-jq35-85cj-fj4p bsc#1224323</changelog>
  <changelog author="asarai@suse.com" date="1716379200">- Update to containerd v1.7.17. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.17&gt;
- Switch back to using tar_scm service. Aside from obs_scm using more bandwidth
  and storage than a locally-compressed tar.xz, it seems there's some weird
  issue with paths in obscpio that break our SLE-12-only patch.
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
- Update to containerd v1.7.16. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.16&gt;
  CVE-2023-45288 bsc#1221400</changelog>
  <changelog author="dcermak@suse.com" date="1719230400">- Revert noarch for devel subpackage
  Switching to noarch causes issues on SLES maintenance updates, reverting it
  fixes our image builds</changelog>
</package>
<package pkgid="84459cb554723cdffbb01362493beb4f2011605b0faf208f5b5911ca5f2bf14e" name="containerd-ctr" arch="ppc64le">
  <version epoch="0" ver="1.7.17" rel="150000.114.1"/>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for
  CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.9&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670328001">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.19&gt;
  Includes fixes for:
  - CVE-2023-25153 bsc#1208423
  - CVE-2023-25173 bsc#1208426</changelog>
  <changelog author="asarai@suse.com" date="1681819200">- Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.20&gt;</changelog>
  <changelog author="meissner@suse.com" date="1683201600">[ This was only released in SLE. ]
- unversion to golang requires to always use the current default go.
  (bsc#1210298)</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.21&gt; bsc#1211578
- Require a minimum Go version explicitly rather than using golang(API).
  Fixes the change for bsc#1210298.</changelog>
  <changelog author="priyanka.saggu@suse.com" date="1693483200">- Add `Provides: cri-runtime` to use containerd as container runtime in Factory
  Kubernetes packages</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.6&gt; bsc#1215323</changelog>
  <changelog author="asarai@suse.com" date="1697198400">- Update to containerd v1.7.7. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.7&gt;
- Add patch to fix build on SLE-12:
  + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to containerd v1.7.8. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.8&gt; bsc#1200528
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1701691200">- Update to containerd v1.7.10. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.10&gt;
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1704715200">- Add patch for bsc#1217952:
  + 0002-shim-Create-pid-file-with-0644-permissions.patch</changelog>
  <changelog author="dcermak@suse.com" date="1705320000">- Enable manpage generation
- Make devel package noarch
- adjust rpmlint filters</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="eyadlorenzo@gmail.com" date="1713700800">- Use obs_scm service instead of tar_scm
- Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch
  (merged upstream at
  &lt;https://github.com/containerd/containerd/pull/9571&gt;)
- Update to containerd v1.7.15. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.15&gt;
- Update to containerd v1.7.14. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.14&gt;
- Update to containerd v1.7.13. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.13&gt;
- Update to containerd v1.7.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.12&gt;
- Update to containerd v1.7.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.11&gt;
  GHSA-jq35-85cj-fj4p bsc#1224323</changelog>
  <changelog author="asarai@suse.com" date="1716379200">- Update to containerd v1.7.17. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.17&gt;
- Switch back to using tar_scm service. Aside from obs_scm using more bandwidth
  and storage than a locally-compressed tar.xz, it seems there's some weird
  issue with paths in obscpio that break our SLE-12-only patch.
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
- Update to containerd v1.7.16. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.16&gt;
  CVE-2023-45288 bsc#1221400</changelog>
  <changelog author="dcermak@suse.com" date="1719230400">- Revert noarch for devel subpackage
  Switching to noarch causes issues on SLES maintenance updates, reverting it
  fixes our image builds</changelog>
</package>
<package pkgid="ff3962af40027d362c7dfd064a17e29bb0f0647e773a06e3dbcea97f746eafc2" name="containerd-ctr" arch="s390x">
  <version epoch="0" ver="1.7.17" rel="150000.114.1"/>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for
  CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.9&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670328001">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.19&gt;
  Includes fixes for:
  - CVE-2023-25153 bsc#1208423
  - CVE-2023-25173 bsc#1208426</changelog>
  <changelog author="asarai@suse.com" date="1681819200">- Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.20&gt;</changelog>
  <changelog author="meissner@suse.com" date="1683201600">[ This was only released in SLE. ]
- unversion to golang requires to always use the current default go.
  (bsc#1210298)</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.21&gt; bsc#1211578
- Require a minimum Go version explicitly rather than using golang(API).
  Fixes the change for bsc#1210298.</changelog>
  <changelog author="priyanka.saggu@suse.com" date="1693483200">- Add `Provides: cri-runtime` to use containerd as container runtime in Factory
  Kubernetes packages</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.6&gt; bsc#1215323</changelog>
  <changelog author="asarai@suse.com" date="1697198400">- Update to containerd v1.7.7. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.7&gt;
- Add patch to fix build on SLE-12:
  + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to containerd v1.7.8. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.8&gt; bsc#1200528
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1701691200">- Update to containerd v1.7.10. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.10&gt;
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1704715200">- Add patch for bsc#1217952:
  + 0002-shim-Create-pid-file-with-0644-permissions.patch</changelog>
  <changelog author="dcermak@suse.com" date="1705320000">- Enable manpage generation
- Make devel package noarch
- adjust rpmlint filters</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="eyadlorenzo@gmail.com" date="1713700800">- Use obs_scm service instead of tar_scm
- Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch
  (merged upstream at
  &lt;https://github.com/containerd/containerd/pull/9571&gt;)
- Update to containerd v1.7.15. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.15&gt;
- Update to containerd v1.7.14. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.14&gt;
- Update to containerd v1.7.13. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.13&gt;
- Update to containerd v1.7.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.12&gt;
- Update to containerd v1.7.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.11&gt;
  GHSA-jq35-85cj-fj4p bsc#1224323</changelog>
  <changelog author="asarai@suse.com" date="1716379200">- Update to containerd v1.7.17. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.17&gt;
- Switch back to using tar_scm service. Aside from obs_scm using more bandwidth
  and storage than a locally-compressed tar.xz, it seems there's some weird
  issue with paths in obscpio that break our SLE-12-only patch.
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
- Update to containerd v1.7.16. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.16&gt;
  CVE-2023-45288 bsc#1221400</changelog>
  <changelog author="dcermak@suse.com" date="1719230400">- Revert noarch for devel subpackage
  Switching to noarch causes issues on SLES maintenance updates, reverting it
  fixes our image builds</changelog>
</package>
<package pkgid="77c93f67e3792f196c3fce06664472f7ad467cd3fed1f228ad857763b105b5a8" name="containerd-ctr" arch="x86_64">
  <version epoch="0" ver="1.7.17" rel="150000.114.1"/>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for
  CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.9&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670328001">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.19&gt;
  Includes fixes for:
  - CVE-2023-25153 bsc#1208423
  - CVE-2023-25173 bsc#1208426</changelog>
  <changelog author="asarai@suse.com" date="1681819200">- Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.20&gt;</changelog>
  <changelog author="meissner@suse.com" date="1683201600">[ This was only released in SLE. ]
- unversion to golang requires to always use the current default go.
  (bsc#1210298)</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.21&gt; bsc#1211578
- Require a minimum Go version explicitly rather than using golang(API).
  Fixes the change for bsc#1210298.</changelog>
  <changelog author="priyanka.saggu@suse.com" date="1693483200">- Add `Provides: cri-runtime` to use containerd as container runtime in Factory
  Kubernetes packages</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.6&gt; bsc#1215323</changelog>
  <changelog author="asarai@suse.com" date="1697198400">- Update to containerd v1.7.7. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.7&gt;
- Add patch to fix build on SLE-12:
  + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to containerd v1.7.8. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.8&gt; bsc#1200528
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1701691200">- Update to containerd v1.7.10. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.10&gt;
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1704715200">- Add patch for bsc#1217952:
  + 0002-shim-Create-pid-file-with-0644-permissions.patch</changelog>
  <changelog author="dcermak@suse.com" date="1705320000">- Enable manpage generation
- Make devel package noarch
- adjust rpmlint filters</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="eyadlorenzo@gmail.com" date="1713700800">- Use obs_scm service instead of tar_scm
- Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch
  (merged upstream at
  &lt;https://github.com/containerd/containerd/pull/9571&gt;)
- Update to containerd v1.7.15. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.15&gt;
- Update to containerd v1.7.14. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.14&gt;
- Update to containerd v1.7.13. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.13&gt;
- Update to containerd v1.7.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.12&gt;
- Update to containerd v1.7.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.11&gt;
  GHSA-jq35-85cj-fj4p bsc#1224323</changelog>
  <changelog author="asarai@suse.com" date="1716379200">- Update to containerd v1.7.17. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.17&gt;
- Switch back to using tar_scm service. Aside from obs_scm using more bandwidth
  and storage than a locally-compressed tar.xz, it seems there's some weird
  issue with paths in obscpio that break our SLE-12-only patch.
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
- Update to containerd v1.7.16. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.16&gt;
  CVE-2023-45288 bsc#1221400</changelog>
  <changelog author="dcermak@suse.com" date="1719230400">- Revert noarch for devel subpackage
  Switching to noarch causes issues on SLES maintenance updates, reverting it
  fixes our image builds</changelog>
</package>
<package pkgid="c2baf5a8c7567a83b960a5e5b79129bff2daad8a621e1e852bce000cc97eae18" name="containerd-ctr" arch="aarch64">
  <version epoch="0" ver="1.7.21" rel="150000.117.1"/>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.19&gt;
  Includes fixes for:
  - CVE-2023-25153 bsc#1208423
  - CVE-2023-25173 bsc#1208426</changelog>
  <changelog author="asarai@suse.com" date="1681819200">- Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.20&gt;</changelog>
  <changelog author="meissner@suse.com" date="1683201600">[ This was only released in SLE. ]
- unversion to golang requires to always use the current default go.
  (bsc#1210298)</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.21&gt; bsc#1211578
- Require a minimum Go version explicitly rather than using golang(API).
  Fixes the change for bsc#1210298.</changelog>
  <changelog author="priyanka.saggu@suse.com" date="1693483200">- Add `Provides: cri-runtime` to use containerd as container runtime in Factory
  Kubernetes packages</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.6&gt; bsc#1215323</changelog>
  <changelog author="asarai@suse.com" date="1697198400">- Update to containerd v1.7.7. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.7&gt;
- Add patch to fix build on SLE-12:
  + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to containerd v1.7.8. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.8&gt;
  Includes fixes for:
  - CVE-2022-1996 bsc#1200528
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1701691200">- Update to containerd v1.7.10. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.10&gt;
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1704715200">- Add patch for bsc#1217952:
  + 0002-shim-Create-pid-file-with-0644-permissions.patch</changelog>
  <changelog author="dcermak@suse.com" date="1705320000">- Enable manpage generation
- Make devel package noarch
- adjust rpmlint filters</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="eyadlorenzo@gmail.com" date="1713700800">- Use obs_scm service instead of tar_scm
- Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch
  (merged upstream at
  &lt;https://github.com/containerd/containerd/pull/9571&gt;)
- Update to containerd v1.7.15. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.15&gt;
- Update to containerd v1.7.14. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.14&gt;
- Update to containerd v1.7.13. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.13&gt;
- Update to containerd v1.7.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.12&gt;
- Update to containerd v1.7.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.11&gt;
  GHSA-jq35-85cj-fj4p bsc#1224323</changelog>
  <changelog author="asarai@suse.com" date="1716379200">- Update to containerd v1.7.17. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.17&gt;
- Switch back to using tar_scm service. Aside from obs_scm using more bandwidth
  and storage than a locally-compressed tar.xz, it seems there's some weird
  issue with paths in obscpio that break our SLE-12-only patch.
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
- Update to containerd v1.7.16. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.16&gt;
  CVE-2023-45288 bsc#1221400</changelog>
  <changelog author="dcermak@suse.com" date="1719230400">- Revert noarch for devel subpackage for SLE 15
  Switching to noarch causes issues on SLES maintenance updates, reverting it
  fixes our image builds</changelog>
  <changelog author="asarai@suse.com" date="1725537600">- Update to containerd v1.7.21. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.21&gt;
  Fixes CVE-2023-47108. bsc#1217070
  Fixes CVE-2023-45142. bsc#1228553
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
</package>
<package pkgid="37d0c7132509469287a21fd5ab24ab9b5d40009070fa85a9508ff64f1dadbfc3" name="containerd-ctr" arch="ppc64le">
  <version epoch="0" ver="1.7.21" rel="150000.117.1"/>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.19&gt;
  Includes fixes for:
  - CVE-2023-25153 bsc#1208423
  - CVE-2023-25173 bsc#1208426</changelog>
  <changelog author="asarai@suse.com" date="1681819200">- Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.20&gt;</changelog>
  <changelog author="meissner@suse.com" date="1683201600">[ This was only released in SLE. ]
- unversion to golang requires to always use the current default go.
  (bsc#1210298)</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.21&gt; bsc#1211578
- Require a minimum Go version explicitly rather than using golang(API).
  Fixes the change for bsc#1210298.</changelog>
  <changelog author="priyanka.saggu@suse.com" date="1693483200">- Add `Provides: cri-runtime` to use containerd as container runtime in Factory
  Kubernetes packages</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.6&gt; bsc#1215323</changelog>
  <changelog author="asarai@suse.com" date="1697198400">- Update to containerd v1.7.7. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.7&gt;
- Add patch to fix build on SLE-12:
  + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to containerd v1.7.8. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.8&gt;
  Includes fixes for:
  - CVE-2022-1996 bsc#1200528
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1701691200">- Update to containerd v1.7.10. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.10&gt;
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1704715200">- Add patch for bsc#1217952:
  + 0002-shim-Create-pid-file-with-0644-permissions.patch</changelog>
  <changelog author="dcermak@suse.com" date="1705320000">- Enable manpage generation
- Make devel package noarch
- adjust rpmlint filters</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="eyadlorenzo@gmail.com" date="1713700800">- Use obs_scm service instead of tar_scm
- Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch
  (merged upstream at
  &lt;https://github.com/containerd/containerd/pull/9571&gt;)
- Update to containerd v1.7.15. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.15&gt;
- Update to containerd v1.7.14. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.14&gt;
- Update to containerd v1.7.13. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.13&gt;
- Update to containerd v1.7.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.12&gt;
- Update to containerd v1.7.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.11&gt;
  GHSA-jq35-85cj-fj4p bsc#1224323</changelog>
  <changelog author="asarai@suse.com" date="1716379200">- Update to containerd v1.7.17. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.17&gt;
- Switch back to using tar_scm service. Aside from obs_scm using more bandwidth
  and storage than a locally-compressed tar.xz, it seems there's some weird
  issue with paths in obscpio that break our SLE-12-only patch.
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
- Update to containerd v1.7.16. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.16&gt;
  CVE-2023-45288 bsc#1221400</changelog>
  <changelog author="dcermak@suse.com" date="1719230400">- Revert noarch for devel subpackage for SLE 15
  Switching to noarch causes issues on SLES maintenance updates, reverting it
  fixes our image builds</changelog>
  <changelog author="asarai@suse.com" date="1725537600">- Update to containerd v1.7.21. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.21&gt;
  Fixes CVE-2023-47108. bsc#1217070
  Fixes CVE-2023-45142. bsc#1228553
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
</package>
<package pkgid="e2e13a2c02043f0a6d3a744f2cdda6e9c77051ab967412ee754b70b701ce1f4e" name="containerd-ctr" arch="s390x">
  <version epoch="0" ver="1.7.21" rel="150000.117.1"/>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.19&gt;
  Includes fixes for:
  - CVE-2023-25153 bsc#1208423
  - CVE-2023-25173 bsc#1208426</changelog>
  <changelog author="asarai@suse.com" date="1681819200">- Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.20&gt;</changelog>
  <changelog author="meissner@suse.com" date="1683201600">[ This was only released in SLE. ]
- unversion to golang requires to always use the current default go.
  (bsc#1210298)</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.21&gt; bsc#1211578
- Require a minimum Go version explicitly rather than using golang(API).
  Fixes the change for bsc#1210298.</changelog>
  <changelog author="priyanka.saggu@suse.com" date="1693483200">- Add `Provides: cri-runtime` to use containerd as container runtime in Factory
  Kubernetes packages</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.6&gt; bsc#1215323</changelog>
  <changelog author="asarai@suse.com" date="1697198400">- Update to containerd v1.7.7. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.7&gt;
- Add patch to fix build on SLE-12:
  + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to containerd v1.7.8. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.8&gt;
  Includes fixes for:
  - CVE-2022-1996 bsc#1200528
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1701691200">- Update to containerd v1.7.10. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.10&gt;
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1704715200">- Add patch for bsc#1217952:
  + 0002-shim-Create-pid-file-with-0644-permissions.patch</changelog>
  <changelog author="dcermak@suse.com" date="1705320000">- Enable manpage generation
- Make devel package noarch
- adjust rpmlint filters</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="eyadlorenzo@gmail.com" date="1713700800">- Use obs_scm service instead of tar_scm
- Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch
  (merged upstream at
  &lt;https://github.com/containerd/containerd/pull/9571&gt;)
- Update to containerd v1.7.15. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.15&gt;
- Update to containerd v1.7.14. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.14&gt;
- Update to containerd v1.7.13. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.13&gt;
- Update to containerd v1.7.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.12&gt;
- Update to containerd v1.7.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.11&gt;
  GHSA-jq35-85cj-fj4p bsc#1224323</changelog>
  <changelog author="asarai@suse.com" date="1716379200">- Update to containerd v1.7.17. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.17&gt;
- Switch back to using tar_scm service. Aside from obs_scm using more bandwidth
  and storage than a locally-compressed tar.xz, it seems there's some weird
  issue with paths in obscpio that break our SLE-12-only patch.
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
- Update to containerd v1.7.16. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.16&gt;
  CVE-2023-45288 bsc#1221400</changelog>
  <changelog author="dcermak@suse.com" date="1719230400">- Revert noarch for devel subpackage for SLE 15
  Switching to noarch causes issues on SLES maintenance updates, reverting it
  fixes our image builds</changelog>
  <changelog author="asarai@suse.com" date="1725537600">- Update to containerd v1.7.21. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.21&gt;
  Fixes CVE-2023-47108. bsc#1217070
  Fixes CVE-2023-45142. bsc#1228553
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
</package>
<package pkgid="70460347e8ad038fb31466cb8a797531013b702000dd74ccea08948496a584c2" name="containerd-ctr" arch="x86_64">
  <version epoch="0" ver="1.7.21" rel="150000.117.1"/>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.19&gt;
  Includes fixes for:
  - CVE-2023-25153 bsc#1208423
  - CVE-2023-25173 bsc#1208426</changelog>
  <changelog author="asarai@suse.com" date="1681819200">- Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.20&gt;</changelog>
  <changelog author="meissner@suse.com" date="1683201600">[ This was only released in SLE. ]
- unversion to golang requires to always use the current default go.
  (bsc#1210298)</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.21&gt; bsc#1211578
- Require a minimum Go version explicitly rather than using golang(API).
  Fixes the change for bsc#1210298.</changelog>
  <changelog author="priyanka.saggu@suse.com" date="1693483200">- Add `Provides: cri-runtime` to use containerd as container runtime in Factory
  Kubernetes packages</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.6&gt; bsc#1215323</changelog>
  <changelog author="asarai@suse.com" date="1697198400">- Update to containerd v1.7.7. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.7&gt;
- Add patch to fix build on SLE-12:
  + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to containerd v1.7.8. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.8&gt;
  Includes fixes for:
  - CVE-2022-1996 bsc#1200528
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1701691200">- Update to containerd v1.7.10. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.10&gt;
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1704715200">- Add patch for bsc#1217952:
  + 0002-shim-Create-pid-file-with-0644-permissions.patch</changelog>
  <changelog author="dcermak@suse.com" date="1705320000">- Enable manpage generation
- Make devel package noarch
- adjust rpmlint filters</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="eyadlorenzo@gmail.com" date="1713700800">- Use obs_scm service instead of tar_scm
- Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch
  (merged upstream at
  &lt;https://github.com/containerd/containerd/pull/9571&gt;)
- Update to containerd v1.7.15. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.15&gt;
- Update to containerd v1.7.14. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.14&gt;
- Update to containerd v1.7.13. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.13&gt;
- Update to containerd v1.7.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.12&gt;
- Update to containerd v1.7.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.11&gt;
  GHSA-jq35-85cj-fj4p bsc#1224323</changelog>
  <changelog author="asarai@suse.com" date="1716379200">- Update to containerd v1.7.17. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.17&gt;
- Switch back to using tar_scm service. Aside from obs_scm using more bandwidth
  and storage than a locally-compressed tar.xz, it seems there's some weird
  issue with paths in obscpio that break our SLE-12-only patch.
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
- Update to containerd v1.7.16. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.16&gt;
  CVE-2023-45288 bsc#1221400</changelog>
  <changelog author="dcermak@suse.com" date="1719230400">- Revert noarch for devel subpackage for SLE 15
  Switching to noarch causes issues on SLES maintenance updates, reverting it
  fixes our image builds</changelog>
  <changelog author="asarai@suse.com" date="1725537600">- Update to containerd v1.7.21. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.21&gt;
  Fixes CVE-2023-47108. bsc#1217070
  Fixes CVE-2023-45142. bsc#1228553
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
</package>
<package pkgid="dae1b74fab8e7ad522c5e8c3f3a43abded96de131f450f123222637058ead6a7" name="containerd-devel" arch="noarch">
  <version epoch="0" ver="1.7.17" rel="150000.111.3"/>
  <changelog author="dmueller@suse.com" date="1669723200">- add devel subpackage, which is needed by open-vm-tools</changelog>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for
  CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.9&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670328001">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.19&gt;
  Includes fixes for:
  - CVE-2023-25153 bsc#1208423
  - CVE-2023-25173 bsc#1208426</changelog>
  <changelog author="asarai@suse.com" date="1681819200">- Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.20&gt;</changelog>
  <changelog author="meissner@suse.com" date="1683201600">[ This was only released in SLE. ]
- unversion to golang requires to always use the current default go.
  (bsc#1210298)</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.21&gt; bsc#1211578
- Require a minimum Go version explicitly rather than using golang(API).
  Fixes the change for bsc#1210298.</changelog>
  <changelog author="priyanka.saggu@suse.com" date="1693483200">- Add `Provides: cri-runtime` to use containerd as container runtime in Factory
  Kubernetes packages</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.6&gt; bsc#1215323</changelog>
  <changelog author="asarai@suse.com" date="1697198400">- Update to containerd v1.7.7. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.7&gt;
- Add patch to fix build on SLE-12:
  + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to containerd v1.7.8. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.8&gt; bsc#1200528
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1701691200">- Update to containerd v1.7.10. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.10&gt;
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1704715200">- Add patch for bsc#1217952:
  + 0002-shim-Create-pid-file-with-0644-permissions.patch</changelog>
  <changelog author="dcermak@suse.com" date="1705320000">- Enable manpage generation
- Make devel package noarch
- adjust rpmlint filters</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="eyadlorenzo@gmail.com" date="1713700800">- Use obs_scm service instead of tar_scm
- Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch
  (merged upstream at
  &lt;https://github.com/containerd/containerd/pull/9571&gt;)
- Update to containerd v1.7.15. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.15&gt;
- Update to containerd v1.7.14. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.14&gt;
- Update to containerd v1.7.13. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.13&gt;
- Update to containerd v1.7.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.12&gt;
- Update to containerd v1.7.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.11&gt;
  GHSA-jq35-85cj-fj4p bsc#1224323</changelog>
  <changelog author="asarai@suse.com" date="1716379200">- Update to containerd v1.7.17. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.17&gt;
- Switch back to using tar_scm service. Aside from obs_scm using more bandwidth
  and storage than a locally-compressed tar.xz, it seems there's some weird
  issue with paths in obscpio that break our SLE-12-only patch.
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
- Update to containerd v1.7.16. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.16&gt;
  CVE-2023-45288 bsc#1221400</changelog>
</package>
<package pkgid="5e0ef3a86fd31fb7516413aed323736420aa6e6f24e4507be4f485548f770fe3" name="containerd-devel" arch="aarch64">
  <version epoch="0" ver="1.7.17" rel="150000.114.1"/>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for
  CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.9&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670328001">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.19&gt;
  Includes fixes for:
  - CVE-2023-25153 bsc#1208423
  - CVE-2023-25173 bsc#1208426</changelog>
  <changelog author="asarai@suse.com" date="1681819200">- Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.20&gt;</changelog>
  <changelog author="meissner@suse.com" date="1683201600">[ This was only released in SLE. ]
- unversion to golang requires to always use the current default go.
  (bsc#1210298)</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.21&gt; bsc#1211578
- Require a minimum Go version explicitly rather than using golang(API).
  Fixes the change for bsc#1210298.</changelog>
  <changelog author="priyanka.saggu@suse.com" date="1693483200">- Add `Provides: cri-runtime` to use containerd as container runtime in Factory
  Kubernetes packages</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.6&gt; bsc#1215323</changelog>
  <changelog author="asarai@suse.com" date="1697198400">- Update to containerd v1.7.7. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.7&gt;
- Add patch to fix build on SLE-12:
  + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to containerd v1.7.8. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.8&gt; bsc#1200528
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1701691200">- Update to containerd v1.7.10. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.10&gt;
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1704715200">- Add patch for bsc#1217952:
  + 0002-shim-Create-pid-file-with-0644-permissions.patch</changelog>
  <changelog author="dcermak@suse.com" date="1705320000">- Enable manpage generation
- Make devel package noarch
- adjust rpmlint filters</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="eyadlorenzo@gmail.com" date="1713700800">- Use obs_scm service instead of tar_scm
- Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch
  (merged upstream at
  &lt;https://github.com/containerd/containerd/pull/9571&gt;)
- Update to containerd v1.7.15. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.15&gt;
- Update to containerd v1.7.14. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.14&gt;
- Update to containerd v1.7.13. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.13&gt;
- Update to containerd v1.7.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.12&gt;
- Update to containerd v1.7.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.11&gt;
  GHSA-jq35-85cj-fj4p bsc#1224323</changelog>
  <changelog author="asarai@suse.com" date="1716379200">- Update to containerd v1.7.17. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.17&gt;
- Switch back to using tar_scm service. Aside from obs_scm using more bandwidth
  and storage than a locally-compressed tar.xz, it seems there's some weird
  issue with paths in obscpio that break our SLE-12-only patch.
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
- Update to containerd v1.7.16. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.16&gt;
  CVE-2023-45288 bsc#1221400</changelog>
  <changelog author="dcermak@suse.com" date="1719230400">- Revert noarch for devel subpackage
  Switching to noarch causes issues on SLES maintenance updates, reverting it
  fixes our image builds</changelog>
</package>
<package pkgid="35a2c155c66de6dd0f9d203a39d92361a895e802fe5c515ffe34e3592340ec5e" name="containerd-devel" arch="ppc64le">
  <version epoch="0" ver="1.7.17" rel="150000.114.1"/>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for
  CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.9&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670328001">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.19&gt;
  Includes fixes for:
  - CVE-2023-25153 bsc#1208423
  - CVE-2023-25173 bsc#1208426</changelog>
  <changelog author="asarai@suse.com" date="1681819200">- Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.20&gt;</changelog>
  <changelog author="meissner@suse.com" date="1683201600">[ This was only released in SLE. ]
- unversion to golang requires to always use the current default go.
  (bsc#1210298)</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.21&gt; bsc#1211578
- Require a minimum Go version explicitly rather than using golang(API).
  Fixes the change for bsc#1210298.</changelog>
  <changelog author="priyanka.saggu@suse.com" date="1693483200">- Add `Provides: cri-runtime` to use containerd as container runtime in Factory
  Kubernetes packages</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.6&gt; bsc#1215323</changelog>
  <changelog author="asarai@suse.com" date="1697198400">- Update to containerd v1.7.7. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.7&gt;
- Add patch to fix build on SLE-12:
  + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to containerd v1.7.8. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.8&gt; bsc#1200528
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1701691200">- Update to containerd v1.7.10. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.10&gt;
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1704715200">- Add patch for bsc#1217952:
  + 0002-shim-Create-pid-file-with-0644-permissions.patch</changelog>
  <changelog author="dcermak@suse.com" date="1705320000">- Enable manpage generation
- Make devel package noarch
- adjust rpmlint filters</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="eyadlorenzo@gmail.com" date="1713700800">- Use obs_scm service instead of tar_scm
- Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch
  (merged upstream at
  &lt;https://github.com/containerd/containerd/pull/9571&gt;)
- Update to containerd v1.7.15. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.15&gt;
- Update to containerd v1.7.14. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.14&gt;
- Update to containerd v1.7.13. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.13&gt;
- Update to containerd v1.7.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.12&gt;
- Update to containerd v1.7.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.11&gt;
  GHSA-jq35-85cj-fj4p bsc#1224323</changelog>
  <changelog author="asarai@suse.com" date="1716379200">- Update to containerd v1.7.17. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.17&gt;
- Switch back to using tar_scm service. Aside from obs_scm using more bandwidth
  and storage than a locally-compressed tar.xz, it seems there's some weird
  issue with paths in obscpio that break our SLE-12-only patch.
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
- Update to containerd v1.7.16. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.16&gt;
  CVE-2023-45288 bsc#1221400</changelog>
  <changelog author="dcermak@suse.com" date="1719230400">- Revert noarch for devel subpackage
  Switching to noarch causes issues on SLES maintenance updates, reverting it
  fixes our image builds</changelog>
</package>
<package pkgid="ccdf02b1b0369d3b3671957ff65ab0c8d013a0151978bcc5d7bde69f0826336a" name="containerd-devel" arch="s390x">
  <version epoch="0" ver="1.7.17" rel="150000.114.1"/>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for
  CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.9&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670328001">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.19&gt;
  Includes fixes for:
  - CVE-2023-25153 bsc#1208423
  - CVE-2023-25173 bsc#1208426</changelog>
  <changelog author="asarai@suse.com" date="1681819200">- Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.20&gt;</changelog>
  <changelog author="meissner@suse.com" date="1683201600">[ This was only released in SLE. ]
- unversion to golang requires to always use the current default go.
  (bsc#1210298)</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.21&gt; bsc#1211578
- Require a minimum Go version explicitly rather than using golang(API).
  Fixes the change for bsc#1210298.</changelog>
  <changelog author="priyanka.saggu@suse.com" date="1693483200">- Add `Provides: cri-runtime` to use containerd as container runtime in Factory
  Kubernetes packages</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.6&gt; bsc#1215323</changelog>
  <changelog author="asarai@suse.com" date="1697198400">- Update to containerd v1.7.7. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.7&gt;
- Add patch to fix build on SLE-12:
  + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to containerd v1.7.8. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.8&gt; bsc#1200528
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1701691200">- Update to containerd v1.7.10. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.10&gt;
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1704715200">- Add patch for bsc#1217952:
  + 0002-shim-Create-pid-file-with-0644-permissions.patch</changelog>
  <changelog author="dcermak@suse.com" date="1705320000">- Enable manpage generation
- Make devel package noarch
- adjust rpmlint filters</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="eyadlorenzo@gmail.com" date="1713700800">- Use obs_scm service instead of tar_scm
- Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch
  (merged upstream at
  &lt;https://github.com/containerd/containerd/pull/9571&gt;)
- Update to containerd v1.7.15. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.15&gt;
- Update to containerd v1.7.14. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.14&gt;
- Update to containerd v1.7.13. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.13&gt;
- Update to containerd v1.7.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.12&gt;
- Update to containerd v1.7.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.11&gt;
  GHSA-jq35-85cj-fj4p bsc#1224323</changelog>
  <changelog author="asarai@suse.com" date="1716379200">- Update to containerd v1.7.17. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.17&gt;
- Switch back to using tar_scm service. Aside from obs_scm using more bandwidth
  and storage than a locally-compressed tar.xz, it seems there's some weird
  issue with paths in obscpio that break our SLE-12-only patch.
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
- Update to containerd v1.7.16. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.16&gt;
  CVE-2023-45288 bsc#1221400</changelog>
  <changelog author="dcermak@suse.com" date="1719230400">- Revert noarch for devel subpackage
  Switching to noarch causes issues on SLES maintenance updates, reverting it
  fixes our image builds</changelog>
</package>
<package pkgid="b0922bad819389486c9764144b8fcf8eb65a06481dd2ec34c9ec6f95f977f6db" name="containerd-devel" arch="x86_64">
  <version epoch="0" ver="1.7.17" rel="150000.114.1"/>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for
  CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.9&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670328001">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.19&gt;
  Includes fixes for:
  - CVE-2023-25153 bsc#1208423
  - CVE-2023-25173 bsc#1208426</changelog>
  <changelog author="asarai@suse.com" date="1681819200">- Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.20&gt;</changelog>
  <changelog author="meissner@suse.com" date="1683201600">[ This was only released in SLE. ]
- unversion to golang requires to always use the current default go.
  (bsc#1210298)</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.21&gt; bsc#1211578
- Require a minimum Go version explicitly rather than using golang(API).
  Fixes the change for bsc#1210298.</changelog>
  <changelog author="priyanka.saggu@suse.com" date="1693483200">- Add `Provides: cri-runtime` to use containerd as container runtime in Factory
  Kubernetes packages</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.6&gt; bsc#1215323</changelog>
  <changelog author="asarai@suse.com" date="1697198400">- Update to containerd v1.7.7. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.7&gt;
- Add patch to fix build on SLE-12:
  + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to containerd v1.7.8. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.8&gt; bsc#1200528
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1701691200">- Update to containerd v1.7.10. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.10&gt;
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1704715200">- Add patch for bsc#1217952:
  + 0002-shim-Create-pid-file-with-0644-permissions.patch</changelog>
  <changelog author="dcermak@suse.com" date="1705320000">- Enable manpage generation
- Make devel package noarch
- adjust rpmlint filters</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="eyadlorenzo@gmail.com" date="1713700800">- Use obs_scm service instead of tar_scm
- Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch
  (merged upstream at
  &lt;https://github.com/containerd/containerd/pull/9571&gt;)
- Update to containerd v1.7.15. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.15&gt;
- Update to containerd v1.7.14. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.14&gt;
- Update to containerd v1.7.13. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.13&gt;
- Update to containerd v1.7.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.12&gt;
- Update to containerd v1.7.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.11&gt;
  GHSA-jq35-85cj-fj4p bsc#1224323</changelog>
  <changelog author="asarai@suse.com" date="1716379200">- Update to containerd v1.7.17. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.17&gt;
- Switch back to using tar_scm service. Aside from obs_scm using more bandwidth
  and storage than a locally-compressed tar.xz, it seems there's some weird
  issue with paths in obscpio that break our SLE-12-only patch.
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
- Update to containerd v1.7.16. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.16&gt;
  CVE-2023-45288 bsc#1221400</changelog>
  <changelog author="dcermak@suse.com" date="1719230400">- Revert noarch for devel subpackage
  Switching to noarch causes issues on SLES maintenance updates, reverting it
  fixes our image builds</changelog>
</package>
<package pkgid="2b8fbce7a838cf1477f9ca6ef7be0848434ca82c1403f06ec8c992363581fa58" name="containerd-devel" arch="aarch64">
  <version epoch="0" ver="1.7.21" rel="150000.117.1"/>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.19&gt;
  Includes fixes for:
  - CVE-2023-25153 bsc#1208423
  - CVE-2023-25173 bsc#1208426</changelog>
  <changelog author="asarai@suse.com" date="1681819200">- Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.20&gt;</changelog>
  <changelog author="meissner@suse.com" date="1683201600">[ This was only released in SLE. ]
- unversion to golang requires to always use the current default go.
  (bsc#1210298)</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.21&gt; bsc#1211578
- Require a minimum Go version explicitly rather than using golang(API).
  Fixes the change for bsc#1210298.</changelog>
  <changelog author="priyanka.saggu@suse.com" date="1693483200">- Add `Provides: cri-runtime` to use containerd as container runtime in Factory
  Kubernetes packages</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.6&gt; bsc#1215323</changelog>
  <changelog author="asarai@suse.com" date="1697198400">- Update to containerd v1.7.7. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.7&gt;
- Add patch to fix build on SLE-12:
  + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to containerd v1.7.8. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.8&gt;
  Includes fixes for:
  - CVE-2022-1996 bsc#1200528
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1701691200">- Update to containerd v1.7.10. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.10&gt;
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1704715200">- Add patch for bsc#1217952:
  + 0002-shim-Create-pid-file-with-0644-permissions.patch</changelog>
  <changelog author="dcermak@suse.com" date="1705320000">- Enable manpage generation
- Make devel package noarch
- adjust rpmlint filters</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="eyadlorenzo@gmail.com" date="1713700800">- Use obs_scm service instead of tar_scm
- Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch
  (merged upstream at
  &lt;https://github.com/containerd/containerd/pull/9571&gt;)
- Update to containerd v1.7.15. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.15&gt;
- Update to containerd v1.7.14. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.14&gt;
- Update to containerd v1.7.13. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.13&gt;
- Update to containerd v1.7.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.12&gt;
- Update to containerd v1.7.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.11&gt;
  GHSA-jq35-85cj-fj4p bsc#1224323</changelog>
  <changelog author="asarai@suse.com" date="1716379200">- Update to containerd v1.7.17. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.17&gt;
- Switch back to using tar_scm service. Aside from obs_scm using more bandwidth
  and storage than a locally-compressed tar.xz, it seems there's some weird
  issue with paths in obscpio that break our SLE-12-only patch.
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
- Update to containerd v1.7.16. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.16&gt;
  CVE-2023-45288 bsc#1221400</changelog>
  <changelog author="dcermak@suse.com" date="1719230400">- Revert noarch for devel subpackage for SLE 15
  Switching to noarch causes issues on SLES maintenance updates, reverting it
  fixes our image builds</changelog>
  <changelog author="asarai@suse.com" date="1725537600">- Update to containerd v1.7.21. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.21&gt;
  Fixes CVE-2023-47108. bsc#1217070
  Fixes CVE-2023-45142. bsc#1228553
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
</package>
<package pkgid="ff3f8d06776cf38d46ee2621b654e0686f90225266983fd725e5b9d1af886ded" name="containerd-devel" arch="ppc64le">
  <version epoch="0" ver="1.7.21" rel="150000.117.1"/>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.19&gt;
  Includes fixes for:
  - CVE-2023-25153 bsc#1208423
  - CVE-2023-25173 bsc#1208426</changelog>
  <changelog author="asarai@suse.com" date="1681819200">- Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.20&gt;</changelog>
  <changelog author="meissner@suse.com" date="1683201600">[ This was only released in SLE. ]
- unversion to golang requires to always use the current default go.
  (bsc#1210298)</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.21&gt; bsc#1211578
- Require a minimum Go version explicitly rather than using golang(API).
  Fixes the change for bsc#1210298.</changelog>
  <changelog author="priyanka.saggu@suse.com" date="1693483200">- Add `Provides: cri-runtime` to use containerd as container runtime in Factory
  Kubernetes packages</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.6&gt; bsc#1215323</changelog>
  <changelog author="asarai@suse.com" date="1697198400">- Update to containerd v1.7.7. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.7&gt;
- Add patch to fix build on SLE-12:
  + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to containerd v1.7.8. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.8&gt;
  Includes fixes for:
  - CVE-2022-1996 bsc#1200528
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1701691200">- Update to containerd v1.7.10. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.10&gt;
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1704715200">- Add patch for bsc#1217952:
  + 0002-shim-Create-pid-file-with-0644-permissions.patch</changelog>
  <changelog author="dcermak@suse.com" date="1705320000">- Enable manpage generation
- Make devel package noarch
- adjust rpmlint filters</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="eyadlorenzo@gmail.com" date="1713700800">- Use obs_scm service instead of tar_scm
- Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch
  (merged upstream at
  &lt;https://github.com/containerd/containerd/pull/9571&gt;)
- Update to containerd v1.7.15. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.15&gt;
- Update to containerd v1.7.14. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.14&gt;
- Update to containerd v1.7.13. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.13&gt;
- Update to containerd v1.7.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.12&gt;
- Update to containerd v1.7.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.11&gt;
  GHSA-jq35-85cj-fj4p bsc#1224323</changelog>
  <changelog author="asarai@suse.com" date="1716379200">- Update to containerd v1.7.17. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.17&gt;
- Switch back to using tar_scm service. Aside from obs_scm using more bandwidth
  and storage than a locally-compressed tar.xz, it seems there's some weird
  issue with paths in obscpio that break our SLE-12-only patch.
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
- Update to containerd v1.7.16. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.16&gt;
  CVE-2023-45288 bsc#1221400</changelog>
  <changelog author="dcermak@suse.com" date="1719230400">- Revert noarch for devel subpackage for SLE 15
  Switching to noarch causes issues on SLES maintenance updates, reverting it
  fixes our image builds</changelog>
  <changelog author="asarai@suse.com" date="1725537600">- Update to containerd v1.7.21. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.21&gt;
  Fixes CVE-2023-47108. bsc#1217070
  Fixes CVE-2023-45142. bsc#1228553
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
</package>
<package pkgid="717309120f3ae848a4b0fde4f4e606f49b105a1c6360607cba4983237d1e4883" name="containerd-devel" arch="s390x">
  <version epoch="0" ver="1.7.21" rel="150000.117.1"/>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.19&gt;
  Includes fixes for:
  - CVE-2023-25153 bsc#1208423
  - CVE-2023-25173 bsc#1208426</changelog>
  <changelog author="asarai@suse.com" date="1681819200">- Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.20&gt;</changelog>
  <changelog author="meissner@suse.com" date="1683201600">[ This was only released in SLE. ]
- unversion to golang requires to always use the current default go.
  (bsc#1210298)</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.21&gt; bsc#1211578
- Require a minimum Go version explicitly rather than using golang(API).
  Fixes the change for bsc#1210298.</changelog>
  <changelog author="priyanka.saggu@suse.com" date="1693483200">- Add `Provides: cri-runtime` to use containerd as container runtime in Factory
  Kubernetes packages</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.6&gt; bsc#1215323</changelog>
  <changelog author="asarai@suse.com" date="1697198400">- Update to containerd v1.7.7. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.7&gt;
- Add patch to fix build on SLE-12:
  + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to containerd v1.7.8. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.8&gt;
  Includes fixes for:
  - CVE-2022-1996 bsc#1200528
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1701691200">- Update to containerd v1.7.10. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.10&gt;
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1704715200">- Add patch for bsc#1217952:
  + 0002-shim-Create-pid-file-with-0644-permissions.patch</changelog>
  <changelog author="dcermak@suse.com" date="1705320000">- Enable manpage generation
- Make devel package noarch
- adjust rpmlint filters</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="eyadlorenzo@gmail.com" date="1713700800">- Use obs_scm service instead of tar_scm
- Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch
  (merged upstream at
  &lt;https://github.com/containerd/containerd/pull/9571&gt;)
- Update to containerd v1.7.15. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.15&gt;
- Update to containerd v1.7.14. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.14&gt;
- Update to containerd v1.7.13. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.13&gt;
- Update to containerd v1.7.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.12&gt;
- Update to containerd v1.7.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.11&gt;
  GHSA-jq35-85cj-fj4p bsc#1224323</changelog>
  <changelog author="asarai@suse.com" date="1716379200">- Update to containerd v1.7.17. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.17&gt;
- Switch back to using tar_scm service. Aside from obs_scm using more bandwidth
  and storage than a locally-compressed tar.xz, it seems there's some weird
  issue with paths in obscpio that break our SLE-12-only patch.
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
- Update to containerd v1.7.16. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.16&gt;
  CVE-2023-45288 bsc#1221400</changelog>
  <changelog author="dcermak@suse.com" date="1719230400">- Revert noarch for devel subpackage for SLE 15
  Switching to noarch causes issues on SLES maintenance updates, reverting it
  fixes our image builds</changelog>
  <changelog author="asarai@suse.com" date="1725537600">- Update to containerd v1.7.21. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.21&gt;
  Fixes CVE-2023-47108. bsc#1217070
  Fixes CVE-2023-45142. bsc#1228553
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
</package>
<package pkgid="140410e471a4e728e69b265ecea26dd5f8557024774382263b1263efe8266743" name="containerd-devel" arch="x86_64">
  <version epoch="0" ver="1.7.21" rel="150000.117.1"/>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.19&gt;
  Includes fixes for:
  - CVE-2023-25153 bsc#1208423
  - CVE-2023-25173 bsc#1208426</changelog>
  <changelog author="asarai@suse.com" date="1681819200">- Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.20&gt;</changelog>
  <changelog author="meissner@suse.com" date="1683201600">[ This was only released in SLE. ]
- unversion to golang requires to always use the current default go.
  (bsc#1210298)</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.21&gt; bsc#1211578
- Require a minimum Go version explicitly rather than using golang(API).
  Fixes the change for bsc#1210298.</changelog>
  <changelog author="priyanka.saggu@suse.com" date="1693483200">- Add `Provides: cri-runtime` to use containerd as container runtime in Factory
  Kubernetes packages</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.6&gt; bsc#1215323</changelog>
  <changelog author="asarai@suse.com" date="1697198400">- Update to containerd v1.7.7. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.7&gt;
- Add patch to fix build on SLE-12:
  + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to containerd v1.7.8. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.8&gt;
  Includes fixes for:
  - CVE-2022-1996 bsc#1200528
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="asarai@suse.com" date="1701691200">- Update to containerd v1.7.10. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.10&gt;
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1704715200">- Add patch for bsc#1217952:
  + 0002-shim-Create-pid-file-with-0644-permissions.patch</changelog>
  <changelog author="dcermak@suse.com" date="1705320000">- Enable manpage generation
- Make devel package noarch
- adjust rpmlint filters</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="eyadlorenzo@gmail.com" date="1713700800">- Use obs_scm service instead of tar_scm
- Removed patch 0002-shim-Create-pid-file-with-0644-permissions.patch
  (merged upstream at
  &lt;https://github.com/containerd/containerd/pull/9571&gt;)
- Update to containerd v1.7.15. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.15&gt;
- Update to containerd v1.7.14. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.14&gt;
- Update to containerd v1.7.13. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.13&gt;
- Update to containerd v1.7.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.12&gt;
- Update to containerd v1.7.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.11&gt;
  GHSA-jq35-85cj-fj4p bsc#1224323</changelog>
  <changelog author="asarai@suse.com" date="1716379200">- Update to containerd v1.7.17. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.17&gt;
- Switch back to using tar_scm service. Aside from obs_scm using more bandwidth
  and storage than a locally-compressed tar.xz, it seems there's some weird
  issue with paths in obscpio that break our SLE-12-only patch.
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
- Update to containerd v1.7.16. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.16&gt;
  CVE-2023-45288 bsc#1221400</changelog>
  <changelog author="dcermak@suse.com" date="1719230400">- Revert noarch for devel subpackage for SLE 15
  Switching to noarch causes issues on SLES maintenance updates, reverting it
  fixes our image builds</changelog>
  <changelog author="asarai@suse.com" date="1725537600">- Update to containerd v1.7.21. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.21&gt;
  Fixes CVE-2023-47108. bsc#1217070
  Fixes CVE-2023-45142. bsc#1228553
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
</package>
<package pkgid="58b4d08018e53d2b4dd83769c1671be5eedd195aa66f27a36288d379120ea09a" name="containerized-data-importer" arch="src">
  <version epoch="0" ver="1.58.0" rel="150600.3.3.2"/>
  <changelog author="vasily.ulyanov@suse.com" date="1626091200">- Update to version 1.36.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.36.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1628596800">- Update to version 1.37.1
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.37.1</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1633953600">- Update to version 1.40.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.40.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1636718400">- Update to version 1.41.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.41.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1637928000">- Detect SLE15 SP4 build environment</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1639915200">- Update to version 1.42.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.42.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1641816000">- Update to version 1.43.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1650974400">- Increase storage requirements in _constraints (bsc#1198791)</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393600">- Pack only cdi-operator and cdi-cr release manifests</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1658923200">- Update to version 1.51.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0
- Fix CVE-2022-1996 go-restful: CORS bypass (bsc#1200528)
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665403200">- Update to version 1.55.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.55.0
- Drop upstreamed patches:
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller
- Update SP5 kubevirt registry path (bsc#1204140)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665835200">- Build tools/cdi-containerimage-server with CGO_ENABLED=0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1669896000">- Ensure RPMs and containers are built against the same distro
- Be more strict when discovering the registry path: error out if the
  distro is unknown, instead of falling through to 'opensuse' by
  default</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1679659200">- Use recent golang compiler (bsc#1208916)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1689163200">- Add registry path for SLE15 SP6</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697630400">- Update to version 1.56.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.56.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697803200">- Update to version 1.57.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.57.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1700568000">- Update to version 1.58.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1704283200">- Set ExclusiveArch conditionally depending on the distro
- Remove SLE15 SP4 from the distro check (end of general support)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1715688000">- Bump github.com/containers/image/v5 (bsc#1224119, CVE-2024-3727)
  0001-Bump-github.com-containers-image-v5-to-v5.30.1.patch</changelog>
</package>
<package pkgid="6f5341b94b3de6ba9ba510be3b3038dbf7ae57387477528c99cd00a3d6f96c3d" name="containerized-data-importer" arch="src">
  <version epoch="0" ver="1.59.0" rel="150600.3.6.1"/>
  <changelog author="vasily.ulyanov@suse.com" date="1628596800">- Update to version 1.37.1
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.37.1</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1633953600">- Update to version 1.40.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.40.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1636718400">- Update to version 1.41.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.41.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1637928000">- Detect SLE15 SP4 build environment</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1639915200">- Update to version 1.42.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.42.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1641816000">- Update to version 1.43.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1650974400">- Increase storage requirements in _constraints (bsc#1198791)</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393600">- Pack only cdi-operator and cdi-cr release manifests</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1658923200">- Update to version 1.51.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0
- Fix CVE-2022-1996 go-restful: CORS bypass (bsc#1200528)
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665403200">- Update to version 1.55.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.55.0
- Drop upstreamed patches:
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller
- Update SP5 kubevirt registry path (bsc#1204140)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665835200">- Build tools/cdi-containerimage-server with CGO_ENABLED=0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1669896000">- Ensure RPMs and containers are built against the same distro
- Be more strict when discovering the registry path: error out if the
  distro is unknown, instead of falling through to 'opensuse' by
  default</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1679659200">- Use recent golang compiler (bsc#1208916)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1689163200">- Add registry path for SLE15 SP6</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697630400">- Update to version 1.56.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.56.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697803200">- Update to version 1.57.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.57.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1700568000">- Update to version 1.58.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1704283200">- Set ExclusiveArch conditionally depending on the distro
- Remove SLE15 SP4 from the distro check (end of general support)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1715688000">- Bump github.com/containers/image/v5 (bsc#1224119, CVE-2024-3727)
  0001-Bump-github.com-containers-image-v5-to-v5.30.1.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1720440000">- Update to version 1.59.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.59.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.1</changelog>
</package>
<package pkgid="26c0acdafdca6b785d2f23a6730c6cd1e843d1154feb75a16df95524e0ac19c2" name="containerized-data-importer" arch="src">
  <version epoch="0" ver="1.60.1" rel="150600.3.9.1"/>
  <changelog author="vasily.ulyanov@suse.com" date="1636718400">- Update to version 1.41.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.41.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1637928000">- Detect SLE15 SP4 build environment</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1639915200">- Update to version 1.42.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.42.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1641816000">- Update to version 1.43.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1650974400">- Increase storage requirements in _constraints (bsc#1198791)</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393600">- Pack only cdi-operator and cdi-cr release manifests</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1658923200">- Update to version 1.51.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0
- Fix CVE-2022-1996 go-restful: CORS bypass (bsc#1200528)
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665403200">- Update to version 1.55.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.55.0
- Drop upstreamed patches:
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller
- Update SP5 kubevirt registry path (bsc#1204140)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665835200">- Build tools/cdi-containerimage-server with CGO_ENABLED=0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1669896000">- Ensure RPMs and containers are built against the same distro
- Be more strict when discovering the registry path: error out if the
  distro is unknown, instead of falling through to 'opensuse' by
  default</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1679659200">- Use recent golang compiler (bsc#1208916)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1689163200">- Add registry path for SLE15 SP6</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697630400">- Update to version 1.56.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.56.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697803200">- Update to version 1.57.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.57.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1700568000">- Update to version 1.58.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1704283200">- Set ExclusiveArch conditionally depending on the distro
- Remove SLE15 SP4 from the distro check (end of general support)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1715688000">- Bump github.com/containers/image/v5 (bsc#1224119, CVE-2024-3727)
  0001-Bump-github.com-containers-image-v5-to-v5.30.1.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1720440000">- Update to version 1.59.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.59.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.1</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1721390400">- Add registry path for SLE15 SP7</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1724068800">- Update to version 1.60.1
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.60.1
- Drop upstreamed patch
  0001-Bump-github.com-containers-image-v5-to-v5.30.1.patch</changelog>
</package>
<package pkgid="bff8480946306fa0e9a1b723bc605f21b168b4bcd3a5385d656511f4fd2135a4" name="containerized-data-importer-api" arch="x86_64">
  <version epoch="0" ver="1.58.0" rel="150600.3.3.2"/>
  <changelog author="vasily.ulyanov@suse.com" date="1626091200">- Update to version 1.36.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.36.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1628596800">- Update to version 1.37.1
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.37.1</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1633953600">- Update to version 1.40.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.40.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1636718400">- Update to version 1.41.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.41.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1637928000">- Detect SLE15 SP4 build environment</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1639915200">- Update to version 1.42.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.42.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1641816000">- Update to version 1.43.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1650974400">- Increase storage requirements in _constraints (bsc#1198791)</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393600">- Pack only cdi-operator and cdi-cr release manifests</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1658923200">- Update to version 1.51.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0
- Fix CVE-2022-1996 go-restful: CORS bypass (bsc#1200528)
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665403200">- Update to version 1.55.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.55.0
- Drop upstreamed patches:
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller
- Update SP5 kubevirt registry path (bsc#1204140)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665835200">- Build tools/cdi-containerimage-server with CGO_ENABLED=0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1669896000">- Ensure RPMs and containers are built against the same distro
- Be more strict when discovering the registry path: error out if the
  distro is unknown, instead of falling through to 'opensuse' by
  default</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1679659200">- Use recent golang compiler (bsc#1208916)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1689163200">- Add registry path for SLE15 SP6</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697630400">- Update to version 1.56.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.56.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697803200">- Update to version 1.57.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.57.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1700568000">- Update to version 1.58.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1704283200">- Set ExclusiveArch conditionally depending on the distro
- Remove SLE15 SP4 from the distro check (end of general support)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1715688000">- Bump github.com/containers/image/v5 (bsc#1224119, CVE-2024-3727)
  0001-Bump-github.com-containers-image-v5-to-v5.30.1.patch</changelog>
</package>
<package pkgid="76fb3c89cf1ebd4bde741562020cb119cef43639e4f3d1cb5305661874ad92d0" name="containerized-data-importer-api" arch="x86_64">
  <version epoch="0" ver="1.59.0" rel="150600.3.6.1"/>
  <changelog author="vasily.ulyanov@suse.com" date="1628596800">- Update to version 1.37.1
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.37.1</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1633953600">- Update to version 1.40.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.40.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1636718400">- Update to version 1.41.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.41.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1637928000">- Detect SLE15 SP4 build environment</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1639915200">- Update to version 1.42.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.42.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1641816000">- Update to version 1.43.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1650974400">- Increase storage requirements in _constraints (bsc#1198791)</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393600">- Pack only cdi-operator and cdi-cr release manifests</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1658923200">- Update to version 1.51.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0
- Fix CVE-2022-1996 go-restful: CORS bypass (bsc#1200528)
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665403200">- Update to version 1.55.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.55.0
- Drop upstreamed patches:
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller
- Update SP5 kubevirt registry path (bsc#1204140)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665835200">- Build tools/cdi-containerimage-server with CGO_ENABLED=0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1669896000">- Ensure RPMs and containers are built against the same distro
- Be more strict when discovering the registry path: error out if the
  distro is unknown, instead of falling through to 'opensuse' by
  default</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1679659200">- Use recent golang compiler (bsc#1208916)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1689163200">- Add registry path for SLE15 SP6</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697630400">- Update to version 1.56.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.56.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697803200">- Update to version 1.57.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.57.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1700568000">- Update to version 1.58.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1704283200">- Set ExclusiveArch conditionally depending on the distro
- Remove SLE15 SP4 from the distro check (end of general support)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1715688000">- Bump github.com/containers/image/v5 (bsc#1224119, CVE-2024-3727)
  0001-Bump-github.com-containers-image-v5-to-v5.30.1.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1720440000">- Update to version 1.59.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.59.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.1</changelog>
</package>
<package pkgid="1caff69c4b7edfed58c2a4715d975b44b4cbe2dd5949fd7c031612eaf3671ac4" name="containerized-data-importer-api" arch="x86_64">
  <version epoch="0" ver="1.60.1" rel="150600.3.9.1"/>
  <changelog author="vasily.ulyanov@suse.com" date="1636718400">- Update to version 1.41.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.41.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1637928000">- Detect SLE15 SP4 build environment</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1639915200">- Update to version 1.42.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.42.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1641816000">- Update to version 1.43.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1650974400">- Increase storage requirements in _constraints (bsc#1198791)</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393600">- Pack only cdi-operator and cdi-cr release manifests</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1658923200">- Update to version 1.51.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0
- Fix CVE-2022-1996 go-restful: CORS bypass (bsc#1200528)
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665403200">- Update to version 1.55.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.55.0
- Drop upstreamed patches:
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller
- Update SP5 kubevirt registry path (bsc#1204140)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665835200">- Build tools/cdi-containerimage-server with CGO_ENABLED=0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1669896000">- Ensure RPMs and containers are built against the same distro
- Be more strict when discovering the registry path: error out if the
  distro is unknown, instead of falling through to 'opensuse' by
  default</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1679659200">- Use recent golang compiler (bsc#1208916)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1689163200">- Add registry path for SLE15 SP6</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697630400">- Update to version 1.56.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.56.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697803200">- Update to version 1.57.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.57.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1700568000">- Update to version 1.58.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1704283200">- Set ExclusiveArch conditionally depending on the distro
- Remove SLE15 SP4 from the distro check (end of general support)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1715688000">- Bump github.com/containers/image/v5 (bsc#1224119, CVE-2024-3727)
  0001-Bump-github.com-containers-image-v5-to-v5.30.1.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1720440000">- Update to version 1.59.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.59.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.1</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1721390400">- Add registry path for SLE15 SP7</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1724068800">- Update to version 1.60.1
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.60.1
- Drop upstreamed patch
  0001-Bump-github.com-containers-image-v5-to-v5.30.1.patch</changelog>
</package>
<package pkgid="665258b356378bbceb516fc9a92c4224b76eb8418b6f7477a8aa4bfec8a39467" name="containerized-data-importer-cloner" arch="x86_64">
  <version epoch="0" ver="1.58.0" rel="150600.3.3.2"/>
  <changelog author="vasily.ulyanov@suse.com" date="1626091200">- Update to version 1.36.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.36.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1628596800">- Update to version 1.37.1
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.37.1</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1633953600">- Update to version 1.40.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.40.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1636718400">- Update to version 1.41.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.41.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1637928000">- Detect SLE15 SP4 build environment</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1639915200">- Update to version 1.42.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.42.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1641816000">- Update to version 1.43.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1650974400">- Increase storage requirements in _constraints (bsc#1198791)</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393600">- Pack only cdi-operator and cdi-cr release manifests</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1658923200">- Update to version 1.51.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0
- Fix CVE-2022-1996 go-restful: CORS bypass (bsc#1200528)
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665403200">- Update to version 1.55.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.55.0
- Drop upstreamed patches:
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller
- Update SP5 kubevirt registry path (bsc#1204140)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665835200">- Build tools/cdi-containerimage-server with CGO_ENABLED=0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1669896000">- Ensure RPMs and containers are built against the same distro
- Be more strict when discovering the registry path: error out if the
  distro is unknown, instead of falling through to 'opensuse' by
  default</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1679659200">- Use recent golang compiler (bsc#1208916)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1689163200">- Add registry path for SLE15 SP6</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697630400">- Update to version 1.56.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.56.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697803200">- Update to version 1.57.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.57.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1700568000">- Update to version 1.58.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1704283200">- Set ExclusiveArch conditionally depending on the distro
- Remove SLE15 SP4 from the distro check (end of general support)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1715688000">- Bump github.com/containers/image/v5 (bsc#1224119, CVE-2024-3727)
  0001-Bump-github.com-containers-image-v5-to-v5.30.1.patch</changelog>
</package>
<package pkgid="18a7b3f3f607922dd503e5da82aa0e4e68dea308c99b6e3747030ea83c9cf5ad" name="containerized-data-importer-cloner" arch="x86_64">
  <version epoch="0" ver="1.59.0" rel="150600.3.6.1"/>
  <changelog author="vasily.ulyanov@suse.com" date="1628596800">- Update to version 1.37.1
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.37.1</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1633953600">- Update to version 1.40.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.40.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1636718400">- Update to version 1.41.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.41.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1637928000">- Detect SLE15 SP4 build environment</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1639915200">- Update to version 1.42.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.42.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1641816000">- Update to version 1.43.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1650974400">- Increase storage requirements in _constraints (bsc#1198791)</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393600">- Pack only cdi-operator and cdi-cr release manifests</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1658923200">- Update to version 1.51.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0
- Fix CVE-2022-1996 go-restful: CORS bypass (bsc#1200528)
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665403200">- Update to version 1.55.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.55.0
- Drop upstreamed patches:
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller
- Update SP5 kubevirt registry path (bsc#1204140)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665835200">- Build tools/cdi-containerimage-server with CGO_ENABLED=0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1669896000">- Ensure RPMs and containers are built against the same distro
- Be more strict when discovering the registry path: error out if the
  distro is unknown, instead of falling through to 'opensuse' by
  default</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1679659200">- Use recent golang compiler (bsc#1208916)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1689163200">- Add registry path for SLE15 SP6</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697630400">- Update to version 1.56.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.56.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697803200">- Update to version 1.57.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.57.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1700568000">- Update to version 1.58.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1704283200">- Set ExclusiveArch conditionally depending on the distro
- Remove SLE15 SP4 from the distro check (end of general support)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1715688000">- Bump github.com/containers/image/v5 (bsc#1224119, CVE-2024-3727)
  0001-Bump-github.com-containers-image-v5-to-v5.30.1.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1720440000">- Update to version 1.59.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.59.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.1</changelog>
</package>
<package pkgid="8f7720f02ab411f8407bc9f339da3982c5a33e0d99a01e177db251682fa2c263" name="containerized-data-importer-cloner" arch="x86_64">
  <version epoch="0" ver="1.60.1" rel="150600.3.9.1"/>
  <changelog author="vasily.ulyanov@suse.com" date="1636718400">- Update to version 1.41.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.41.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1637928000">- Detect SLE15 SP4 build environment</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1639915200">- Update to version 1.42.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.42.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1641816000">- Update to version 1.43.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1650974400">- Increase storage requirements in _constraints (bsc#1198791)</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393600">- Pack only cdi-operator and cdi-cr release manifests</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1658923200">- Update to version 1.51.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0
- Fix CVE-2022-1996 go-restful: CORS bypass (bsc#1200528)
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665403200">- Update to version 1.55.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.55.0
- Drop upstreamed patches:
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller
- Update SP5 kubevirt registry path (bsc#1204140)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665835200">- Build tools/cdi-containerimage-server with CGO_ENABLED=0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1669896000">- Ensure RPMs and containers are built against the same distro
- Be more strict when discovering the registry path: error out if the
  distro is unknown, instead of falling through to 'opensuse' by
  default</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1679659200">- Use recent golang compiler (bsc#1208916)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1689163200">- Add registry path for SLE15 SP6</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697630400">- Update to version 1.56.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.56.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697803200">- Update to version 1.57.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.57.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1700568000">- Update to version 1.58.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1704283200">- Set ExclusiveArch conditionally depending on the distro
- Remove SLE15 SP4 from the distro check (end of general support)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1715688000">- Bump github.com/containers/image/v5 (bsc#1224119, CVE-2024-3727)
  0001-Bump-github.com-containers-image-v5-to-v5.30.1.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1720440000">- Update to version 1.59.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.59.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.1</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1721390400">- Add registry path for SLE15 SP7</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1724068800">- Update to version 1.60.1
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.60.1
- Drop upstreamed patch
  0001-Bump-github.com-containers-image-v5-to-v5.30.1.patch</changelog>
</package>
<package pkgid="62c0ea03652142c20c8bffda1ae4a446bbb76bc2903f62d45113c499eb5ed8a9" name="containerized-data-importer-controller" arch="x86_64">
  <version epoch="0" ver="1.58.0" rel="150600.3.3.2"/>
  <changelog author="vasily.ulyanov@suse.com" date="1626091200">- Update to version 1.36.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.36.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1628596800">- Update to version 1.37.1
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.37.1</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1633953600">- Update to version 1.40.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.40.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1636718400">- Update to version 1.41.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.41.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1637928000">- Detect SLE15 SP4 build environment</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1639915200">- Update to version 1.42.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.42.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1641816000">- Update to version 1.43.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1650974400">- Increase storage requirements in _constraints (bsc#1198791)</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393600">- Pack only cdi-operator and cdi-cr release manifests</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1658923200">- Update to version 1.51.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0
- Fix CVE-2022-1996 go-restful: CORS bypass (bsc#1200528)
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665403200">- Update to version 1.55.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.55.0
- Drop upstreamed patches:
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller
- Update SP5 kubevirt registry path (bsc#1204140)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665835200">- Build tools/cdi-containerimage-server with CGO_ENABLED=0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1669896000">- Ensure RPMs and containers are built against the same distro
- Be more strict when discovering the registry path: error out if the
  distro is unknown, instead of falling through to 'opensuse' by
  default</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1679659200">- Use recent golang compiler (bsc#1208916)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1689163200">- Add registry path for SLE15 SP6</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697630400">- Update to version 1.56.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.56.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697803200">- Update to version 1.57.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.57.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1700568000">- Update to version 1.58.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1704283200">- Set ExclusiveArch conditionally depending on the distro
- Remove SLE15 SP4 from the distro check (end of general support)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1715688000">- Bump github.com/containers/image/v5 (bsc#1224119, CVE-2024-3727)
  0001-Bump-github.com-containers-image-v5-to-v5.30.1.patch</changelog>
</package>
<package pkgid="7fdac070221f5a3a5866fded2ab37ce9b487d44aa3d43b7bf1af88c16b6defcb" name="containerized-data-importer-controller" arch="x86_64">
  <version epoch="0" ver="1.59.0" rel="150600.3.6.1"/>
  <changelog author="vasily.ulyanov@suse.com" date="1628596800">- Update to version 1.37.1
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.37.1</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1633953600">- Update to version 1.40.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.40.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1636718400">- Update to version 1.41.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.41.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1637928000">- Detect SLE15 SP4 build environment</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1639915200">- Update to version 1.42.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.42.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1641816000">- Update to version 1.43.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1650974400">- Increase storage requirements in _constraints (bsc#1198791)</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393600">- Pack only cdi-operator and cdi-cr release manifests</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1658923200">- Update to version 1.51.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0
- Fix CVE-2022-1996 go-restful: CORS bypass (bsc#1200528)
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665403200">- Update to version 1.55.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.55.0
- Drop upstreamed patches:
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller
- Update SP5 kubevirt registry path (bsc#1204140)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665835200">- Build tools/cdi-containerimage-server with CGO_ENABLED=0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1669896000">- Ensure RPMs and containers are built against the same distro
- Be more strict when discovering the registry path: error out if the
  distro is unknown, instead of falling through to 'opensuse' by
  default</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1679659200">- Use recent golang compiler (bsc#1208916)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1689163200">- Add registry path for SLE15 SP6</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697630400">- Update to version 1.56.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.56.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697803200">- Update to version 1.57.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.57.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1700568000">- Update to version 1.58.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1704283200">- Set ExclusiveArch conditionally depending on the distro
- Remove SLE15 SP4 from the distro check (end of general support)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1715688000">- Bump github.com/containers/image/v5 (bsc#1224119, CVE-2024-3727)
  0001-Bump-github.com-containers-image-v5-to-v5.30.1.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1720440000">- Update to version 1.59.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.59.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.1</changelog>
</package>
<package pkgid="e2c5480a4ff9677fabfd3375dc9ca1487ad0fd3e8d8d3e20573005e5aaba2627" name="containerized-data-importer-controller" arch="x86_64">
  <version epoch="0" ver="1.60.1" rel="150600.3.9.1"/>
  <changelog author="vasily.ulyanov@suse.com" date="1636718400">- Update to version 1.41.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.41.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1637928000">- Detect SLE15 SP4 build environment</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1639915200">- Update to version 1.42.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.42.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1641816000">- Update to version 1.43.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1650974400">- Increase storage requirements in _constraints (bsc#1198791)</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393600">- Pack only cdi-operator and cdi-cr release manifests</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1658923200">- Update to version 1.51.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0
- Fix CVE-2022-1996 go-restful: CORS bypass (bsc#1200528)
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665403200">- Update to version 1.55.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.55.0
- Drop upstreamed patches:
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller
- Update SP5 kubevirt registry path (bsc#1204140)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665835200">- Build tools/cdi-containerimage-server with CGO_ENABLED=0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1669896000">- Ensure RPMs and containers are built against the same distro
- Be more strict when discovering the registry path: error out if the
  distro is unknown, instead of falling through to 'opensuse' by
  default</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1679659200">- Use recent golang compiler (bsc#1208916)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1689163200">- Add registry path for SLE15 SP6</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697630400">- Update to version 1.56.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.56.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697803200">- Update to version 1.57.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.57.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1700568000">- Update to version 1.58.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1704283200">- Set ExclusiveArch conditionally depending on the distro
- Remove SLE15 SP4 from the distro check (end of general support)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1715688000">- Bump github.com/containers/image/v5 (bsc#1224119, CVE-2024-3727)
  0001-Bump-github.com-containers-image-v5-to-v5.30.1.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1720440000">- Update to version 1.59.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.59.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.1</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1721390400">- Add registry path for SLE15 SP7</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1724068800">- Update to version 1.60.1
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.60.1
- Drop upstreamed patch
  0001-Bump-github.com-containers-image-v5-to-v5.30.1.patch</changelog>
</package>
<package pkgid="4d352b99be95ab32649e3289d7c68e6c5d14aa5fae5dea13cc4490763875eb81" name="containerized-data-importer-importer" arch="x86_64">
  <version epoch="0" ver="1.58.0" rel="150600.3.3.2"/>
  <changelog author="vasily.ulyanov@suse.com" date="1626091200">- Update to version 1.36.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.36.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1628596800">- Update to version 1.37.1
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.37.1</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1633953600">- Update to version 1.40.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.40.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1636718400">- Update to version 1.41.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.41.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1637928000">- Detect SLE15 SP4 build environment</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1639915200">- Update to version 1.42.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.42.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1641816000">- Update to version 1.43.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1650974400">- Increase storage requirements in _constraints (bsc#1198791)</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393600">- Pack only cdi-operator and cdi-cr release manifests</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1658923200">- Update to version 1.51.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0
- Fix CVE-2022-1996 go-restful: CORS bypass (bsc#1200528)
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665403200">- Update to version 1.55.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.55.0
- Drop upstreamed patches:
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller
- Update SP5 kubevirt registry path (bsc#1204140)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665835200">- Build tools/cdi-containerimage-server with CGO_ENABLED=0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1669896000">- Ensure RPMs and containers are built against the same distro
- Be more strict when discovering the registry path: error out if the
  distro is unknown, instead of falling through to 'opensuse' by
  default</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1679659200">- Use recent golang compiler (bsc#1208916)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1689163200">- Add registry path for SLE15 SP6</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697630400">- Update to version 1.56.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.56.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697803200">- Update to version 1.57.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.57.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1700568000">- Update to version 1.58.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1704283200">- Set ExclusiveArch conditionally depending on the distro
- Remove SLE15 SP4 from the distro check (end of general support)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1715688000">- Bump github.com/containers/image/v5 (bsc#1224119, CVE-2024-3727)
  0001-Bump-github.com-containers-image-v5-to-v5.30.1.patch</changelog>
</package>
<package pkgid="24540fe8e5c9f0f377e22dfbdc81e214a3128af201a7cdb66359421f48d69509" name="containerized-data-importer-importer" arch="x86_64">
  <version epoch="0" ver="1.59.0" rel="150600.3.6.1"/>
  <changelog author="vasily.ulyanov@suse.com" date="1628596800">- Update to version 1.37.1
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.37.1</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1633953600">- Update to version 1.40.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.40.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1636718400">- Update to version 1.41.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.41.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1637928000">- Detect SLE15 SP4 build environment</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1639915200">- Update to version 1.42.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.42.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1641816000">- Update to version 1.43.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1650974400">- Increase storage requirements in _constraints (bsc#1198791)</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393600">- Pack only cdi-operator and cdi-cr release manifests</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1658923200">- Update to version 1.51.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0
- Fix CVE-2022-1996 go-restful: CORS bypass (bsc#1200528)
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665403200">- Update to version 1.55.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.55.0
- Drop upstreamed patches:
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller
- Update SP5 kubevirt registry path (bsc#1204140)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665835200">- Build tools/cdi-containerimage-server with CGO_ENABLED=0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1669896000">- Ensure RPMs and containers are built against the same distro
- Be more strict when discovering the registry path: error out if the
  distro is unknown, instead of falling through to 'opensuse' by
  default</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1679659200">- Use recent golang compiler (bsc#1208916)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1689163200">- Add registry path for SLE15 SP6</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697630400">- Update to version 1.56.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.56.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697803200">- Update to version 1.57.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.57.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1700568000">- Update to version 1.58.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1704283200">- Set ExclusiveArch conditionally depending on the distro
- Remove SLE15 SP4 from the distro check (end of general support)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1715688000">- Bump github.com/containers/image/v5 (bsc#1224119, CVE-2024-3727)
  0001-Bump-github.com-containers-image-v5-to-v5.30.1.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1720440000">- Update to version 1.59.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.59.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.1</changelog>
</package>
<package pkgid="5e26e9b040d7fe67d7ddd2822869739fde65ebf37d7cb13e9b2044b22d805749" name="containerized-data-importer-importer" arch="x86_64">
  <version epoch="0" ver="1.60.1" rel="150600.3.9.1"/>
  <changelog author="vasily.ulyanov@suse.com" date="1636718400">- Update to version 1.41.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.41.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1637928000">- Detect SLE15 SP4 build environment</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1639915200">- Update to version 1.42.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.42.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1641816000">- Update to version 1.43.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1650974400">- Increase storage requirements in _constraints (bsc#1198791)</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393600">- Pack only cdi-operator and cdi-cr release manifests</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1658923200">- Update to version 1.51.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0
- Fix CVE-2022-1996 go-restful: CORS bypass (bsc#1200528)
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665403200">- Update to version 1.55.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.55.0
- Drop upstreamed patches:
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller
- Update SP5 kubevirt registry path (bsc#1204140)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665835200">- Build tools/cdi-containerimage-server with CGO_ENABLED=0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1669896000">- Ensure RPMs and containers are built against the same distro
- Be more strict when discovering the registry path: error out if the
  distro is unknown, instead of falling through to 'opensuse' by
  default</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1679659200">- Use recent golang compiler (bsc#1208916)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1689163200">- Add registry path for SLE15 SP6</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697630400">- Update to version 1.56.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.56.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697803200">- Update to version 1.57.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.57.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1700568000">- Update to version 1.58.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1704283200">- Set ExclusiveArch conditionally depending on the distro
- Remove SLE15 SP4 from the distro check (end of general support)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1715688000">- Bump github.com/containers/image/v5 (bsc#1224119, CVE-2024-3727)
  0001-Bump-github.com-containers-image-v5-to-v5.30.1.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1720440000">- Update to version 1.59.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.59.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.1</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1721390400">- Add registry path for SLE15 SP7</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1724068800">- Update to version 1.60.1
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.60.1
- Drop upstreamed patch
  0001-Bump-github.com-containers-image-v5-to-v5.30.1.patch</changelog>
</package>
<package pkgid="f192dfd92d329365a4c5effc155d85de7ed72bf6598b50830c1158748e709b76" name="containerized-data-importer-manifests" arch="x86_64">
  <version epoch="0" ver="1.58.0" rel="150600.3.3.2"/>
  <changelog author="vasily.ulyanov@suse.com" date="1626091200">- Update to version 1.36.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.36.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1628596800">- Update to version 1.37.1
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.37.1</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1633953600">- Update to version 1.40.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.40.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1636718400">- Update to version 1.41.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.41.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1637928000">- Detect SLE15 SP4 build environment</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1639915200">- Update to version 1.42.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.42.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1641816000">- Update to version 1.43.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1650974400">- Increase storage requirements in _constraints (bsc#1198791)</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393600">- Pack only cdi-operator and cdi-cr release manifests</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1658923200">- Update to version 1.51.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0
- Fix CVE-2022-1996 go-restful: CORS bypass (bsc#1200528)
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665403200">- Update to version 1.55.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.55.0
- Drop upstreamed patches:
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller
- Update SP5 kubevirt registry path (bsc#1204140)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665835200">- Build tools/cdi-containerimage-server with CGO_ENABLED=0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1669896000">- Ensure RPMs and containers are built against the same distro
- Be more strict when discovering the registry path: error out if the
  distro is unknown, instead of falling through to 'opensuse' by
  default</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1679659200">- Use recent golang compiler (bsc#1208916)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1689163200">- Add registry path for SLE15 SP6</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697630400">- Update to version 1.56.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.56.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697803200">- Update to version 1.57.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.57.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1700568000">- Update to version 1.58.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1704283200">- Set ExclusiveArch conditionally depending on the distro
- Remove SLE15 SP4 from the distro check (end of general support)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1715688000">- Bump github.com/containers/image/v5 (bsc#1224119, CVE-2024-3727)
  0001-Bump-github.com-containers-image-v5-to-v5.30.1.patch</changelog>
</package>
<package pkgid="f1b2f8400386f0733f59a2afc580ffbb3836b3fabdd0bff5228b025f2ae8f3b1" name="containerized-data-importer-manifests" arch="x86_64">
  <version epoch="0" ver="1.59.0" rel="150600.3.6.1"/>
  <changelog author="vasily.ulyanov@suse.com" date="1628596800">- Update to version 1.37.1
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.37.1</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1633953600">- Update to version 1.40.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.40.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1636718400">- Update to version 1.41.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.41.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1637928000">- Detect SLE15 SP4 build environment</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1639915200">- Update to version 1.42.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.42.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1641816000">- Update to version 1.43.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1650974400">- Increase storage requirements in _constraints (bsc#1198791)</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393600">- Pack only cdi-operator and cdi-cr release manifests</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1658923200">- Update to version 1.51.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0
- Fix CVE-2022-1996 go-restful: CORS bypass (bsc#1200528)
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665403200">- Update to version 1.55.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.55.0
- Drop upstreamed patches:
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller
- Update SP5 kubevirt registry path (bsc#1204140)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665835200">- Build tools/cdi-containerimage-server with CGO_ENABLED=0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1669896000">- Ensure RPMs and containers are built against the same distro
- Be more strict when discovering the registry path: error out if the
  distro is unknown, instead of falling through to 'opensuse' by
  default</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1679659200">- Use recent golang compiler (bsc#1208916)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1689163200">- Add registry path for SLE15 SP6</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697630400">- Update to version 1.56.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.56.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697803200">- Update to version 1.57.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.57.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1700568000">- Update to version 1.58.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1704283200">- Set ExclusiveArch conditionally depending on the distro
- Remove SLE15 SP4 from the distro check (end of general support)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1715688000">- Bump github.com/containers/image/v5 (bsc#1224119, CVE-2024-3727)
  0001-Bump-github.com-containers-image-v5-to-v5.30.1.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1720440000">- Update to version 1.59.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.59.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.1</changelog>
</package>
<package pkgid="9edab9a4be2f1ba7dd0cd4e62d5f73d9dfd55890c67ed9f7d66113d9dc01e84c" name="containerized-data-importer-manifests" arch="x86_64">
  <version epoch="0" ver="1.60.1" rel="150600.3.9.1"/>
  <changelog author="vasily.ulyanov@suse.com" date="1636718400">- Update to version 1.41.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.41.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1637928000">- Detect SLE15 SP4 build environment</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1639915200">- Update to version 1.42.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.42.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1641816000">- Update to version 1.43.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1650974400">- Increase storage requirements in _constraints (bsc#1198791)</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393600">- Pack only cdi-operator and cdi-cr release manifests</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1658923200">- Update to version 1.51.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0
- Fix CVE-2022-1996 go-restful: CORS bypass (bsc#1200528)
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665403200">- Update to version 1.55.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.55.0
- Drop upstreamed patches:
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller
- Update SP5 kubevirt registry path (bsc#1204140)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665835200">- Build tools/cdi-containerimage-server with CGO_ENABLED=0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1669896000">- Ensure RPMs and containers are built against the same distro
- Be more strict when discovering the registry path: error out if the
  distro is unknown, instead of falling through to 'opensuse' by
  default</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1679659200">- Use recent golang compiler (bsc#1208916)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1689163200">- Add registry path for SLE15 SP6</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697630400">- Update to version 1.56.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.56.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697803200">- Update to version 1.57.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.57.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1700568000">- Update to version 1.58.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1704283200">- Set ExclusiveArch conditionally depending on the distro
- Remove SLE15 SP4 from the distro check (end of general support)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1715688000">- Bump github.com/containers/image/v5 (bsc#1224119, CVE-2024-3727)
  0001-Bump-github.com-containers-image-v5-to-v5.30.1.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1720440000">- Update to version 1.59.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.59.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.1</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1721390400">- Add registry path for SLE15 SP7</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1724068800">- Update to version 1.60.1
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.60.1
- Drop upstreamed patch
  0001-Bump-github.com-containers-image-v5-to-v5.30.1.patch</changelog>
</package>
<package pkgid="f04e4b02a78a23ba76930e9f46302a9a39cba1f02c97831813c3d8d2c4ea01b4" name="containerized-data-importer-operator" arch="x86_64">
  <version epoch="0" ver="1.58.0" rel="150600.3.3.2"/>
  <changelog author="vasily.ulyanov@suse.com" date="1626091200">- Update to version 1.36.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.36.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1628596800">- Update to version 1.37.1
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.37.1</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1633953600">- Update to version 1.40.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.40.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1636718400">- Update to version 1.41.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.41.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1637928000">- Detect SLE15 SP4 build environment</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1639915200">- Update to version 1.42.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.42.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1641816000">- Update to version 1.43.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1650974400">- Increase storage requirements in _constraints (bsc#1198791)</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393600">- Pack only cdi-operator and cdi-cr release manifests</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1658923200">- Update to version 1.51.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0
- Fix CVE-2022-1996 go-restful: CORS bypass (bsc#1200528)
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665403200">- Update to version 1.55.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.55.0
- Drop upstreamed patches:
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller
- Update SP5 kubevirt registry path (bsc#1204140)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665835200">- Build tools/cdi-containerimage-server with CGO_ENABLED=0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1669896000">- Ensure RPMs and containers are built against the same distro
- Be more strict when discovering the registry path: error out if the
  distro is unknown, instead of falling through to 'opensuse' by
  default</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1679659200">- Use recent golang compiler (bsc#1208916)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1689163200">- Add registry path for SLE15 SP6</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697630400">- Update to version 1.56.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.56.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697803200">- Update to version 1.57.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.57.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1700568000">- Update to version 1.58.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1704283200">- Set ExclusiveArch conditionally depending on the distro
- Remove SLE15 SP4 from the distro check (end of general support)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1715688000">- Bump github.com/containers/image/v5 (bsc#1224119, CVE-2024-3727)
  0001-Bump-github.com-containers-image-v5-to-v5.30.1.patch</changelog>
</package>
<package pkgid="09195485f3efab19539c41e6a4d34acf783e57371a18f8f54e01e6c345efa377" name="containerized-data-importer-operator" arch="x86_64">
  <version epoch="0" ver="1.59.0" rel="150600.3.6.1"/>
  <changelog author="vasily.ulyanov@suse.com" date="1628596800">- Update to version 1.37.1
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.37.1</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1633953600">- Update to version 1.40.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.40.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1636718400">- Update to version 1.41.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.41.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1637928000">- Detect SLE15 SP4 build environment</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1639915200">- Update to version 1.42.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.42.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1641816000">- Update to version 1.43.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1650974400">- Increase storage requirements in _constraints (bsc#1198791)</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393600">- Pack only cdi-operator and cdi-cr release manifests</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1658923200">- Update to version 1.51.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0
- Fix CVE-2022-1996 go-restful: CORS bypass (bsc#1200528)
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665403200">- Update to version 1.55.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.55.0
- Drop upstreamed patches:
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller
- Update SP5 kubevirt registry path (bsc#1204140)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665835200">- Build tools/cdi-containerimage-server with CGO_ENABLED=0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1669896000">- Ensure RPMs and containers are built against the same distro
- Be more strict when discovering the registry path: error out if the
  distro is unknown, instead of falling through to 'opensuse' by
  default</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1679659200">- Use recent golang compiler (bsc#1208916)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1689163200">- Add registry path for SLE15 SP6</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697630400">- Update to version 1.56.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.56.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697803200">- Update to version 1.57.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.57.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1700568000">- Update to version 1.58.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1704283200">- Set ExclusiveArch conditionally depending on the distro
- Remove SLE15 SP4 from the distro check (end of general support)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1715688000">- Bump github.com/containers/image/v5 (bsc#1224119, CVE-2024-3727)
  0001-Bump-github.com-containers-image-v5-to-v5.30.1.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1720440000">- Update to version 1.59.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.59.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.1</changelog>
</package>
<package pkgid="17a4579992bece2e832e9972d797e57747bd938bf37a793a189bc52ff61185e4" name="containerized-data-importer-operator" arch="x86_64">
  <version epoch="0" ver="1.60.1" rel="150600.3.9.1"/>
  <changelog author="vasily.ulyanov@suse.com" date="1636718400">- Update to version 1.41.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.41.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1637928000">- Detect SLE15 SP4 build environment</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1639915200">- Update to version 1.42.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.42.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1641816000">- Update to version 1.43.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1650974400">- Increase storage requirements in _constraints (bsc#1198791)</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393600">- Pack only cdi-operator and cdi-cr release manifests</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1658923200">- Update to version 1.51.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0
- Fix CVE-2022-1996 go-restful: CORS bypass (bsc#1200528)
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665403200">- Update to version 1.55.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.55.0
- Drop upstreamed patches:
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller
- Update SP5 kubevirt registry path (bsc#1204140)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665835200">- Build tools/cdi-containerimage-server with CGO_ENABLED=0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1669896000">- Ensure RPMs and containers are built against the same distro
- Be more strict when discovering the registry path: error out if the
  distro is unknown, instead of falling through to 'opensuse' by
  default</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1679659200">- Use recent golang compiler (bsc#1208916)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1689163200">- Add registry path for SLE15 SP6</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697630400">- Update to version 1.56.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.56.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697803200">- Update to version 1.57.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.57.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1700568000">- Update to version 1.58.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1704283200">- Set ExclusiveArch conditionally depending on the distro
- Remove SLE15 SP4 from the distro check (end of general support)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1715688000">- Bump github.com/containers/image/v5 (bsc#1224119, CVE-2024-3727)
  0001-Bump-github.com-containers-image-v5-to-v5.30.1.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1720440000">- Update to version 1.59.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.59.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.1</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1721390400">- Add registry path for SLE15 SP7</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1724068800">- Update to version 1.60.1
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.60.1
- Drop upstreamed patch
  0001-Bump-github.com-containers-image-v5-to-v5.30.1.patch</changelog>
</package>
<package pkgid="081bfd650e644db1feda2bf4e007d1500105b389dde57215116608066ad33ed5" name="containerized-data-importer-uploadproxy" arch="x86_64">
  <version epoch="0" ver="1.58.0" rel="150600.3.3.2"/>
  <changelog author="vasily.ulyanov@suse.com" date="1626091200">- Update to version 1.36.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.36.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1628596800">- Update to version 1.37.1
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.37.1</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1633953600">- Update to version 1.40.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.40.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1636718400">- Update to version 1.41.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.41.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1637928000">- Detect SLE15 SP4 build environment</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1639915200">- Update to version 1.42.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.42.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1641816000">- Update to version 1.43.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1650974400">- Increase storage requirements in _constraints (bsc#1198791)</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393600">- Pack only cdi-operator and cdi-cr release manifests</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1658923200">- Update to version 1.51.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0
- Fix CVE-2022-1996 go-restful: CORS bypass (bsc#1200528)
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665403200">- Update to version 1.55.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.55.0
- Drop upstreamed patches:
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller
- Update SP5 kubevirt registry path (bsc#1204140)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665835200">- Build tools/cdi-containerimage-server with CGO_ENABLED=0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1669896000">- Ensure RPMs and containers are built against the same distro
- Be more strict when discovering the registry path: error out if the
  distro is unknown, instead of falling through to 'opensuse' by
  default</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1679659200">- Use recent golang compiler (bsc#1208916)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1689163200">- Add registry path for SLE15 SP6</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697630400">- Update to version 1.56.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.56.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697803200">- Update to version 1.57.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.57.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1700568000">- Update to version 1.58.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1704283200">- Set ExclusiveArch conditionally depending on the distro
- Remove SLE15 SP4 from the distro check (end of general support)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1715688000">- Bump github.com/containers/image/v5 (bsc#1224119, CVE-2024-3727)
  0001-Bump-github.com-containers-image-v5-to-v5.30.1.patch</changelog>
</package>
<package pkgid="8bb8dbfbe1b00b249ce950d4b5e243c78a9868d4279147ab0d6fc4cfaf7edd92" name="containerized-data-importer-uploadproxy" arch="x86_64">
  <version epoch="0" ver="1.59.0" rel="150600.3.6.1"/>
  <changelog author="vasily.ulyanov@suse.com" date="1628596800">- Update to version 1.37.1
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.37.1</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1633953600">- Update to version 1.40.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.40.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1636718400">- Update to version 1.41.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.41.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1637928000">- Detect SLE15 SP4 build environment</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1639915200">- Update to version 1.42.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.42.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1641816000">- Update to version 1.43.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1650974400">- Increase storage requirements in _constraints (bsc#1198791)</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393600">- Pack only cdi-operator and cdi-cr release manifests</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1658923200">- Update to version 1.51.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0
- Fix CVE-2022-1996 go-restful: CORS bypass (bsc#1200528)
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665403200">- Update to version 1.55.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.55.0
- Drop upstreamed patches:
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller
- Update SP5 kubevirt registry path (bsc#1204140)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665835200">- Build tools/cdi-containerimage-server with CGO_ENABLED=0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1669896000">- Ensure RPMs and containers are built against the same distro
- Be more strict when discovering the registry path: error out if the
  distro is unknown, instead of falling through to 'opensuse' by
  default</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1679659200">- Use recent golang compiler (bsc#1208916)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1689163200">- Add registry path for SLE15 SP6</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697630400">- Update to version 1.56.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.56.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697803200">- Update to version 1.57.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.57.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1700568000">- Update to version 1.58.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1704283200">- Set ExclusiveArch conditionally depending on the distro
- Remove SLE15 SP4 from the distro check (end of general support)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1715688000">- Bump github.com/containers/image/v5 (bsc#1224119, CVE-2024-3727)
  0001-Bump-github.com-containers-image-v5-to-v5.30.1.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1720440000">- Update to version 1.59.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.59.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.1</changelog>
</package>
<package pkgid="77aca2d76ff3c68936ca015c16bf9c43b287ce4782df16e5b576093d03cebd92" name="containerized-data-importer-uploadproxy" arch="x86_64">
  <version epoch="0" ver="1.60.1" rel="150600.3.9.1"/>
  <changelog author="vasily.ulyanov@suse.com" date="1636718400">- Update to version 1.41.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.41.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1637928000">- Detect SLE15 SP4 build environment</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1639915200">- Update to version 1.42.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.42.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1641816000">- Update to version 1.43.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1650974400">- Increase storage requirements in _constraints (bsc#1198791)</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393600">- Pack only cdi-operator and cdi-cr release manifests</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1658923200">- Update to version 1.51.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0
- Fix CVE-2022-1996 go-restful: CORS bypass (bsc#1200528)
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665403200">- Update to version 1.55.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.55.0
- Drop upstreamed patches:
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller
- Update SP5 kubevirt registry path (bsc#1204140)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665835200">- Build tools/cdi-containerimage-server with CGO_ENABLED=0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1669896000">- Ensure RPMs and containers are built against the same distro
- Be more strict when discovering the registry path: error out if the
  distro is unknown, instead of falling through to 'opensuse' by
  default</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1679659200">- Use recent golang compiler (bsc#1208916)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1689163200">- Add registry path for SLE15 SP6</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697630400">- Update to version 1.56.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.56.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697803200">- Update to version 1.57.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.57.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1700568000">- Update to version 1.58.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1704283200">- Set ExclusiveArch conditionally depending on the distro
- Remove SLE15 SP4 from the distro check (end of general support)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1715688000">- Bump github.com/containers/image/v5 (bsc#1224119, CVE-2024-3727)
  0001-Bump-github.com-containers-image-v5-to-v5.30.1.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1720440000">- Update to version 1.59.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.59.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.1</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1721390400">- Add registry path for SLE15 SP7</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1724068800">- Update to version 1.60.1
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.60.1
- Drop upstreamed patch
  0001-Bump-github.com-containers-image-v5-to-v5.30.1.patch</changelog>
</package>
<package pkgid="2ef72eb1e41349f5a7df070bbb7376b1f3e71274c610e7ca19062af1443c7a9c" name="containerized-data-importer-uploadserver" arch="x86_64">
  <version epoch="0" ver="1.58.0" rel="150600.3.3.2"/>
  <changelog author="vasily.ulyanov@suse.com" date="1626091200">- Update to version 1.36.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.36.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1628596800">- Update to version 1.37.1
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.37.1</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1633953600">- Update to version 1.40.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.40.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1636718400">- Update to version 1.41.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.41.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1637928000">- Detect SLE15 SP4 build environment</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1639915200">- Update to version 1.42.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.42.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1641816000">- Update to version 1.43.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1650974400">- Increase storage requirements in _constraints (bsc#1198791)</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393600">- Pack only cdi-operator and cdi-cr release manifests</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1658923200">- Update to version 1.51.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0
- Fix CVE-2022-1996 go-restful: CORS bypass (bsc#1200528)
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665403200">- Update to version 1.55.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.55.0
- Drop upstreamed patches:
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller
- Update SP5 kubevirt registry path (bsc#1204140)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665835200">- Build tools/cdi-containerimage-server with CGO_ENABLED=0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1669896000">- Ensure RPMs and containers are built against the same distro
- Be more strict when discovering the registry path: error out if the
  distro is unknown, instead of falling through to 'opensuse' by
  default</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1679659200">- Use recent golang compiler (bsc#1208916)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1689163200">- Add registry path for SLE15 SP6</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697630400">- Update to version 1.56.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.56.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697803200">- Update to version 1.57.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.57.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1700568000">- Update to version 1.58.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1704283200">- Set ExclusiveArch conditionally depending on the distro
- Remove SLE15 SP4 from the distro check (end of general support)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1715688000">- Bump github.com/containers/image/v5 (bsc#1224119, CVE-2024-3727)
  0001-Bump-github.com-containers-image-v5-to-v5.30.1.patch</changelog>
</package>
<package pkgid="ed9eac5bf2778977877c8b8bc0bb9b76490c0d2add282157abcdc382a2454592" name="containerized-data-importer-uploadserver" arch="x86_64">
  <version epoch="0" ver="1.59.0" rel="150600.3.6.1"/>
  <changelog author="vasily.ulyanov@suse.com" date="1628596800">- Update to version 1.37.1
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.37.1</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1633953600">- Update to version 1.40.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.40.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1636718400">- Update to version 1.41.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.41.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1637928000">- Detect SLE15 SP4 build environment</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1639915200">- Update to version 1.42.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.42.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1641816000">- Update to version 1.43.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1650974400">- Increase storage requirements in _constraints (bsc#1198791)</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393600">- Pack only cdi-operator and cdi-cr release manifests</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1658923200">- Update to version 1.51.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0
- Fix CVE-2022-1996 go-restful: CORS bypass (bsc#1200528)
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665403200">- Update to version 1.55.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.55.0
- Drop upstreamed patches:
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller
- Update SP5 kubevirt registry path (bsc#1204140)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665835200">- Build tools/cdi-containerimage-server with CGO_ENABLED=0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1669896000">- Ensure RPMs and containers are built against the same distro
- Be more strict when discovering the registry path: error out if the
  distro is unknown, instead of falling through to 'opensuse' by
  default</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1679659200">- Use recent golang compiler (bsc#1208916)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1689163200">- Add registry path for SLE15 SP6</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697630400">- Update to version 1.56.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.56.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697803200">- Update to version 1.57.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.57.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1700568000">- Update to version 1.58.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1704283200">- Set ExclusiveArch conditionally depending on the distro
- Remove SLE15 SP4 from the distro check (end of general support)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1715688000">- Bump github.com/containers/image/v5 (bsc#1224119, CVE-2024-3727)
  0001-Bump-github.com-containers-image-v5-to-v5.30.1.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1720440000">- Update to version 1.59.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.59.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.1</changelog>
</package>
<package pkgid="4af5fcdc770c16017e47606aacc85ca37d9499b0f7bd0048433723bd1d81e7db" name="containerized-data-importer-uploadserver" arch="x86_64">
  <version epoch="0" ver="1.60.1" rel="150600.3.9.1"/>
  <changelog author="vasily.ulyanov@suse.com" date="1636718400">- Update to version 1.41.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.41.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1637928000">- Detect SLE15 SP4 build environment</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1639915200">- Update to version 1.42.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.42.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1641816000">- Update to version 1.43.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1650974400">- Increase storage requirements in _constraints (bsc#1198791)</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393600">- Pack only cdi-operator and cdi-cr release manifests</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1658923200">- Update to version 1.51.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0
- Fix CVE-2022-1996 go-restful: CORS bypass (bsc#1200528)
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665403200">- Update to version 1.55.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.55.0
- Drop upstreamed patches:
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller
- Update SP5 kubevirt registry path (bsc#1204140)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665835200">- Build tools/cdi-containerimage-server with CGO_ENABLED=0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1669896000">- Ensure RPMs and containers are built against the same distro
- Be more strict when discovering the registry path: error out if the
  distro is unknown, instead of falling through to 'opensuse' by
  default</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1679659200">- Use recent golang compiler (bsc#1208916)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1689163200">- Add registry path for SLE15 SP6</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697630400">- Update to version 1.56.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.56.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1697803200">- Update to version 1.57.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.57.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1700568000">- Update to version 1.58.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1704283200">- Set ExclusiveArch conditionally depending on the distro
- Remove SLE15 SP4 from the distro check (end of general support)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1715688000">- Bump github.com/containers/image/v5 (bsc#1224119, CVE-2024-3727)
  0001-Bump-github.com-containers-image-v5-to-v5.30.1.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1720440000">- Update to version 1.59.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.59.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.58.1</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1721390400">- Add registry path for SLE15 SP7</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1724068800">- Update to version 1.60.1
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.60.1
- Drop upstreamed patch
  0001-Bump-github.com-containers-image-v5-to-v5.30.1.patch</changelog>
</package>
<package pkgid="10c9047991d2f26907fb3255c69e4e8700b44a588d76ede12fa7277a52b2233b" name="corepack20" arch="aarch64">
  <version epoch="0" ver="20.15.1" rel="150600.3.3.2"/>
  <changelog author="adam.majer@suse.de" date="1692964800">- Temporarily bundle ICU for SLE15 SP6 (jsc#PED-4819)</changelog>
  <changelog author="adam.majer@suse.de" date="1693915200">- Update to 20.6.0:
  * add support for .env files to configure envrionment variables
  * import.meta.resolve unflagged
  * deps: npm updated to 9.8.1
- nodejs.keyring: updated to include current upstream releasers</changelog>
  <changelog author="adam.majer@suse.de" date="1694174400">- f0ff63fbc32ea55f3d92c5c89fdb91ec47786859.patch: fixes issues with
  Angular and other software that tries to load ECM modules in
  somewhat circular fashion ending up with multiple executions.</changelog>
  <changelog author="adam.majer@suse.de" date="1695038400">- Update to 20.6.1:
  * f0ff63fbc32ea55f3d92c5c89fdb91ec47786859.patch: removed, upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1695124800">- Update to 20.7.0:
  * src: support multiple --env-file declarations
  * deps: upgrade npm to 10.1.0
  * doc: move and rename loaders section
  * lib: add api to detect whether source-maps are enabled
  * src,permission: add multiple allow-fs-* flags
  * test_runner: expose location of tests
- z13.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1696507200">- Update to 20.8.0:
  * Stream performance improvements
  * Rework of memory management in vm APIs with the importModuleDynamically
    option
  * test_runner:
    + accept testOnly in run
    + add junit reporter
- fix_ci_tests.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1697457600">- Security fixes relase 20.8.1
  * (CVE-2023-44487, bsc#1216190): nghttp2 Security Release
  * (CVE-2023-45143, bsc#1216205): undici Security Release
  * (CVE-2023-39332, bsc#1216271): Path traversal through path stored in Uint8Array
  * (CVE-2023-39331, bsc#1216270): Permission model improperly protects against path traversal
  * (CVE-2023-38552, bsc#1216272): Integrity checks according to policies can be circumvented
  * (CVE-2023-39333, bsc#1216273): Code injection via WebAssembly export names
- fix_ci_tests.patch: refreshed</changelog>
  <changelog author="dimstar@opensuse.org" date="1698148800">- Add nodejs20-zlib-1.3.patch: Support zlib version with only
  major.minor versions, like zlib 1.3.</changelog>
  <changelog author="adam.majer@suse.de" date="1698408000">- fix_ci_tests.patch: adapt for openssl 3.1.4</changelog>
  <changelog author="adam.majer@suse.de" date="1699531200">- Update to 20.9.0:
  * No changes, just LTS transition</changelog>
  <changelog author="adam.majer@suse.de" date="1700740800">- Update to 20.10.0:
  * --experimental-default-type flag to flip module defaults
  * The new flag --experimental-detect-module can be used to
  automatically run ES modules when their syntax can be detected.
  * Added flush option in file system functions for fs.writeFile functions
  * Added experimental WebSocket client
  * vm: fix V8 compilation cache support for vm.Script. This fixes
  performance regression since v16.x when support for
  importModuleDynamically was added to vm.Script
  For details, see
  https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V20.md#20.10.0
- nodejs20-zlib-1.3.patch: upstreamed, removed
- fix_ci_tests.patch, node-gyp-addon-gypi.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1704196800">- c-ares-fixes.patch: fixes unit tests for new c-ares</changelog>
  <changelog author="adam.majer@suse.de" date="1704715200">- c-ares-fixes.patch: add additional backports for unit test fixes</changelog>
  <changelog author="adam.majer@suse.de" date="1706529600">- fix_ci_tests.patch: disable test_crypto_fips for openssl 3.x,
  to be fixed soon (bsc#1219152)</changelog>
  <changelog author="adam.majer@suse.de" date="1707739200">- update to 20.11.0:
  * esm: add import.meta.dirname and import.meta.filename
  * fs: add c++ fast path for writeFileSync utf8
  * module: remove useCustomLoadersIfPresent flag
  * module: bootstrap module loaders in shadow realm
  * src: add --disable-warning option
  * src: create per isolate proxy env template
  * src: make process binding data weak
  * stream: use Array for Readable buffer
  * stream: optimize creation
  * test_runner: adds built in lcov reporter
  * test_runner: add Date to the supported mock APIs
  * test_runner, cli: add --test-timeout flag
- c-ares-fixes.patch, fix_ci_tests.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1708084800">- Update to 20.11.1: (security updates)
  * (CVE-2024-21892, bsc#1219992) - Code injection and privilege escalation through Linux capabilities- (High)
  * (CVE-2024-22019, bsc#1219993) - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High)
  * (CVE-2024-21896, bsc#1219994) - Path traversal by monkey-patching Buffer internals- (High)
  * (CVE-2024-22017, bsc#1219995) - setuid() does not drop all privileges due to io_uring - (High)
  * (CVE-2023-46809, bsc#1219997) - Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium)
  * (CVE-2024-21891, bsc#1219998) - Multiple permission model bypasses due to improper path traversal sequence sanitization - (Medium)
  * (CVE-2024-21890, bsc#1219999) - Improper handling of wildcards in --allow-fs-read and --allow-fs-write (Medium)
  * (CVE-2024-22025, bsc#1220014) - Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium)
  * undici version 5.28.3 (CVE-2024-24758, bsc#1220017)
  * libuv version 1.48.0 (CVE-2024-24806, bsc#1220053)</changelog>
  <changelog author="adam.majer@suse.de" date="1712059200">- Update to 20.12.0:
  * crypto: implement crypto.hash()
  * util: add loading and parsing environment variables
  * new connection attempt events: connectionAttempt,
    connectionAttemptFailed, connectionAttemptTimeout
  * sea: support embedding assets
  * support configurable snapshot through --build-snapshot-config flag
  * util.styleText(format, text): This function returns a formatted
    text considering the format passed.
  * vm: support using the default loader to handle dynamic import()
- c-ares-fixes.patch: removed, upstreamed
- nodejs-libpath.patch, versioned.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1712664000">- Update to 20.12.1:
  * CVE-2024-27983 - Assertion failed in node::http2::Http2Session::~Http2Session()
    leads to HTTP/2 server crash- (High) (bsc#1222244)
  * CVE-2024-27982 - HTTP Request Smuggling via Content Length
    Obfuscation- (Medium) (bsc#1222384)
  * updated dependencies:
    + llhttp version 9.2.1
    + undici version 5.28.4 (bsc#1222530, bsc#1222603,
    CVE-2024-30260, CVE-2024-30261)
- node-gyp-addon-gypi.patch: adapted for new unit test layouts
- fix_ci_tests.patch: add benchmark fix</changelog>
  <changelog author="adam.majer@suse.de" date="1716897600">- Update to 20.13.1:
  * buffer: improve base64 and base64url performance
  * crypto: deprecate implicitly shortened GCM tags
  * events,doc: mark CustomEvent as stable
  * fs: add stacktrace to fs/promises
  * report: add --report-exclude-network option
  * src: add uv_get_available_memory to report and process
  * stream: support typed arrays
  * util: support array of formats in util.styleText
  * v8: implement v8.queryObjects() for memory leak regression testing
  * watch: mark as stable
- versioned.patch: refreshed
- cares_sle12_capabilities.patch: SLES12 compatibility</changelog>
  <changelog author="adam.majer@suse.de" date="1720785600">- Update to 20.15.1:
  * Bypass incomplete fix of CVE-2024-27980 (bsc#1227560, CVE-2024-36138)
  * Bypass network import restriction via data URL (bsc#1227554, CVE-2024-22020)
  * fs.lstat bypasses permission model (bsc#1227562, CVE-2024-22018)
  * fs.fchown/fchmod bypasses permission model (bsc#1227561, CVE-2024-36137)
  * Permission model improperly processes UNC paths (bsc#1227563, CVE-2024-37372)
- Changes in 20.15.0:
  * test_runner: support test plans
  * inspector: introduce the --inspect-wait flag
  * zlib: expose zlib.crc32()
  * cli: allow running wasm in limited vmem with --disable-wasm-trap-handler
- Changes in 20.14.0
  * src,permission: throw async errors on async APIs
  * test_runner: support forced exit
- fix_ci_tests.patch, npm_search_paths.patch: refreshed
- skip_no_console.patch: dropped, upstreamed</changelog>
</package>
<package pkgid="d3c9de3b8e37c36b079405ffdb8fd65452c63938b6ba66def8f66d6ff67d935e" name="corepack20" arch="ppc64le">
  <version epoch="0" ver="20.15.1" rel="150600.3.3.2"/>
  <changelog author="adam.majer@suse.de" date="1692964800">- Temporarily bundle ICU for SLE15 SP6 (jsc#PED-4819)</changelog>
  <changelog author="adam.majer@suse.de" date="1693915200">- Update to 20.6.0:
  * add support for .env files to configure envrionment variables
  * import.meta.resolve unflagged
  * deps: npm updated to 9.8.1
- nodejs.keyring: updated to include current upstream releasers</changelog>
  <changelog author="adam.majer@suse.de" date="1694174400">- f0ff63fbc32ea55f3d92c5c89fdb91ec47786859.patch: fixes issues with
  Angular and other software that tries to load ECM modules in
  somewhat circular fashion ending up with multiple executions.</changelog>
  <changelog author="adam.majer@suse.de" date="1695038400">- Update to 20.6.1:
  * f0ff63fbc32ea55f3d92c5c89fdb91ec47786859.patch: removed, upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1695124800">- Update to 20.7.0:
  * src: support multiple --env-file declarations
  * deps: upgrade npm to 10.1.0
  * doc: move and rename loaders section
  * lib: add api to detect whether source-maps are enabled
  * src,permission: add multiple allow-fs-* flags
  * test_runner: expose location of tests
- z13.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1696507200">- Update to 20.8.0:
  * Stream performance improvements
  * Rework of memory management in vm APIs with the importModuleDynamically
    option
  * test_runner:
    + accept testOnly in run
    + add junit reporter
- fix_ci_tests.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1697457600">- Security fixes relase 20.8.1
  * (CVE-2023-44487, bsc#1216190): nghttp2 Security Release
  * (CVE-2023-45143, bsc#1216205): undici Security Release
  * (CVE-2023-39332, bsc#1216271): Path traversal through path stored in Uint8Array
  * (CVE-2023-39331, bsc#1216270): Permission model improperly protects against path traversal
  * (CVE-2023-38552, bsc#1216272): Integrity checks according to policies can be circumvented
  * (CVE-2023-39333, bsc#1216273): Code injection via WebAssembly export names
- fix_ci_tests.patch: refreshed</changelog>
  <changelog author="dimstar@opensuse.org" date="1698148800">- Add nodejs20-zlib-1.3.patch: Support zlib version with only
  major.minor versions, like zlib 1.3.</changelog>
  <changelog author="adam.majer@suse.de" date="1698408000">- fix_ci_tests.patch: adapt for openssl 3.1.4</changelog>
  <changelog author="adam.majer@suse.de" date="1699531200">- Update to 20.9.0:
  * No changes, just LTS transition</changelog>
  <changelog author="adam.majer@suse.de" date="1700740800">- Update to 20.10.0:
  * --experimental-default-type flag to flip module defaults
  * The new flag --experimental-detect-module can be used to
  automatically run ES modules when their syntax can be detected.
  * Added flush option in file system functions for fs.writeFile functions
  * Added experimental WebSocket client
  * vm: fix V8 compilation cache support for vm.Script. This fixes
  performance regression since v16.x when support for
  importModuleDynamically was added to vm.Script
  For details, see
  https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V20.md#20.10.0
- nodejs20-zlib-1.3.patch: upstreamed, removed
- fix_ci_tests.patch, node-gyp-addon-gypi.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1704196800">- c-ares-fixes.patch: fixes unit tests for new c-ares</changelog>
  <changelog author="adam.majer@suse.de" date="1704715200">- c-ares-fixes.patch: add additional backports for unit test fixes</changelog>
  <changelog author="adam.majer@suse.de" date="1706529600">- fix_ci_tests.patch: disable test_crypto_fips for openssl 3.x,
  to be fixed soon (bsc#1219152)</changelog>
  <changelog author="adam.majer@suse.de" date="1707739200">- update to 20.11.0:
  * esm: add import.meta.dirname and import.meta.filename
  * fs: add c++ fast path for writeFileSync utf8
  * module: remove useCustomLoadersIfPresent flag
  * module: bootstrap module loaders in shadow realm
  * src: add --disable-warning option
  * src: create per isolate proxy env template
  * src: make process binding data weak
  * stream: use Array for Readable buffer
  * stream: optimize creation
  * test_runner: adds built in lcov reporter
  * test_runner: add Date to the supported mock APIs
  * test_runner, cli: add --test-timeout flag
- c-ares-fixes.patch, fix_ci_tests.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1708084800">- Update to 20.11.1: (security updates)
  * (CVE-2024-21892, bsc#1219992) - Code injection and privilege escalation through Linux capabilities- (High)
  * (CVE-2024-22019, bsc#1219993) - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High)
  * (CVE-2024-21896, bsc#1219994) - Path traversal by monkey-patching Buffer internals- (High)
  * (CVE-2024-22017, bsc#1219995) - setuid() does not drop all privileges due to io_uring - (High)
  * (CVE-2023-46809, bsc#1219997) - Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium)
  * (CVE-2024-21891, bsc#1219998) - Multiple permission model bypasses due to improper path traversal sequence sanitization - (Medium)
  * (CVE-2024-21890, bsc#1219999) - Improper handling of wildcards in --allow-fs-read and --allow-fs-write (Medium)
  * (CVE-2024-22025, bsc#1220014) - Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium)
  * undici version 5.28.3 (CVE-2024-24758, bsc#1220017)
  * libuv version 1.48.0 (CVE-2024-24806, bsc#1220053)</changelog>
  <changelog author="adam.majer@suse.de" date="1712059200">- Update to 20.12.0:
  * crypto: implement crypto.hash()
  * util: add loading and parsing environment variables
  * new connection attempt events: connectionAttempt,
    connectionAttemptFailed, connectionAttemptTimeout
  * sea: support embedding assets
  * support configurable snapshot through --build-snapshot-config flag
  * util.styleText(format, text): This function returns a formatted
    text considering the format passed.
  * vm: support using the default loader to handle dynamic import()
- c-ares-fixes.patch: removed, upstreamed
- nodejs-libpath.patch, versioned.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1712664000">- Update to 20.12.1:
  * CVE-2024-27983 - Assertion failed in node::http2::Http2Session::~Http2Session()
    leads to HTTP/2 server crash- (High) (bsc#1222244)
  * CVE-2024-27982 - HTTP Request Smuggling via Content Length
    Obfuscation- (Medium) (bsc#1222384)
  * updated dependencies:
    + llhttp version 9.2.1
    + undici version 5.28.4 (bsc#1222530, bsc#1222603,
    CVE-2024-30260, CVE-2024-30261)
- node-gyp-addon-gypi.patch: adapted for new unit test layouts
- fix_ci_tests.patch: add benchmark fix</changelog>
  <changelog author="adam.majer@suse.de" date="1716897600">- Update to 20.13.1:
  * buffer: improve base64 and base64url performance
  * crypto: deprecate implicitly shortened GCM tags
  * events,doc: mark CustomEvent as stable
  * fs: add stacktrace to fs/promises
  * report: add --report-exclude-network option
  * src: add uv_get_available_memory to report and process
  * stream: support typed arrays
  * util: support array of formats in util.styleText
  * v8: implement v8.queryObjects() for memory leak regression testing
  * watch: mark as stable
- versioned.patch: refreshed
- cares_sle12_capabilities.patch: SLES12 compatibility</changelog>
  <changelog author="adam.majer@suse.de" date="1720785600">- Update to 20.15.1:
  * Bypass incomplete fix of CVE-2024-27980 (bsc#1227560, CVE-2024-36138)
  * Bypass network import restriction via data URL (bsc#1227554, CVE-2024-22020)
  * fs.lstat bypasses permission model (bsc#1227562, CVE-2024-22018)
  * fs.fchown/fchmod bypasses permission model (bsc#1227561, CVE-2024-36137)
  * Permission model improperly processes UNC paths (bsc#1227563, CVE-2024-37372)
- Changes in 20.15.0:
  * test_runner: support test plans
  * inspector: introduce the --inspect-wait flag
  * zlib: expose zlib.crc32()
  * cli: allow running wasm in limited vmem with --disable-wasm-trap-handler
- Changes in 20.14.0
  * src,permission: throw async errors on async APIs
  * test_runner: support forced exit
- fix_ci_tests.patch, npm_search_paths.patch: refreshed
- skip_no_console.patch: dropped, upstreamed</changelog>
</package>
<package pkgid="858bd8ee98aa356763e532920c6e48f6d32524c73ce19bc6b07d71c96414d5bc" name="corepack20" arch="s390x">
  <version epoch="0" ver="20.15.1" rel="150600.3.3.2"/>
  <changelog author="adam.majer@suse.de" date="1692964800">- Temporarily bundle ICU for SLE15 SP6 (jsc#PED-4819)</changelog>
  <changelog author="adam.majer@suse.de" date="1693915200">- Update to 20.6.0:
  * add support for .env files to configure envrionment variables
  * import.meta.resolve unflagged
  * deps: npm updated to 9.8.1
- nodejs.keyring: updated to include current upstream releasers</changelog>
  <changelog author="adam.majer@suse.de" date="1694174400">- f0ff63fbc32ea55f3d92c5c89fdb91ec47786859.patch: fixes issues with
  Angular and other software that tries to load ECM modules in
  somewhat circular fashion ending up with multiple executions.</changelog>
  <changelog author="adam.majer@suse.de" date="1695038400">- Update to 20.6.1:
  * f0ff63fbc32ea55f3d92c5c89fdb91ec47786859.patch: removed, upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1695124800">- Update to 20.7.0:
  * src: support multiple --env-file declarations
  * deps: upgrade npm to 10.1.0
  * doc: move and rename loaders section
  * lib: add api to detect whether source-maps are enabled
  * src,permission: add multiple allow-fs-* flags
  * test_runner: expose location of tests
- z13.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1696507200">- Update to 20.8.0:
  * Stream performance improvements
  * Rework of memory management in vm APIs with the importModuleDynamically
    option
  * test_runner:
    + accept testOnly in run
    + add junit reporter
- fix_ci_tests.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1697457600">- Security fixes relase 20.8.1
  * (CVE-2023-44487, bsc#1216190): nghttp2 Security Release
  * (CVE-2023-45143, bsc#1216205): undici Security Release
  * (CVE-2023-39332, bsc#1216271): Path traversal through path stored in Uint8Array
  * (CVE-2023-39331, bsc#1216270): Permission model improperly protects against path traversal
  * (CVE-2023-38552, bsc#1216272): Integrity checks according to policies can be circumvented
  * (CVE-2023-39333, bsc#1216273): Code injection via WebAssembly export names
- fix_ci_tests.patch: refreshed</changelog>
  <changelog author="dimstar@opensuse.org" date="1698148800">- Add nodejs20-zlib-1.3.patch: Support zlib version with only
  major.minor versions, like zlib 1.3.</changelog>
  <changelog author="adam.majer@suse.de" date="1698408000">- fix_ci_tests.patch: adapt for openssl 3.1.4</changelog>
  <changelog author="adam.majer@suse.de" date="1699531200">- Update to 20.9.0:
  * No changes, just LTS transition</changelog>
  <changelog author="adam.majer@suse.de" date="1700740800">- Update to 20.10.0:
  * --experimental-default-type flag to flip module defaults
  * The new flag --experimental-detect-module can be used to
  automatically run ES modules when their syntax can be detected.
  * Added flush option in file system functions for fs.writeFile functions
  * Added experimental WebSocket client
  * vm: fix V8 compilation cache support for vm.Script. This fixes
  performance regression since v16.x when support for
  importModuleDynamically was added to vm.Script
  For details, see
  https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V20.md#20.10.0
- nodejs20-zlib-1.3.patch: upstreamed, removed
- fix_ci_tests.patch, node-gyp-addon-gypi.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1704196800">- c-ares-fixes.patch: fixes unit tests for new c-ares</changelog>
  <changelog author="adam.majer@suse.de" date="1704715200">- c-ares-fixes.patch: add additional backports for unit test fixes</changelog>
  <changelog author="adam.majer@suse.de" date="1706529600">- fix_ci_tests.patch: disable test_crypto_fips for openssl 3.x,
  to be fixed soon (bsc#1219152)</changelog>
  <changelog author="adam.majer@suse.de" date="1707739200">- update to 20.11.0:
  * esm: add import.meta.dirname and import.meta.filename
  * fs: add c++ fast path for writeFileSync utf8
  * module: remove useCustomLoadersIfPresent flag
  * module: bootstrap module loaders in shadow realm
  * src: add --disable-warning option
  * src: create per isolate proxy env template
  * src: make process binding data weak
  * stream: use Array for Readable buffer
  * stream: optimize creation
  * test_runner: adds built in lcov reporter
  * test_runner: add Date to the supported mock APIs
  * test_runner, cli: add --test-timeout flag
- c-ares-fixes.patch, fix_ci_tests.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1708084800">- Update to 20.11.1: (security updates)
  * (CVE-2024-21892, bsc#1219992) - Code injection and privilege escalation through Linux capabilities- (High)
  * (CVE-2024-22019, bsc#1219993) - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High)
  * (CVE-2024-21896, bsc#1219994) - Path traversal by monkey-patching Buffer internals- (High)
  * (CVE-2024-22017, bsc#1219995) - setuid() does not drop all privileges due to io_uring - (High)
  * (CVE-2023-46809, bsc#1219997) - Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium)
  * (CVE-2024-21891, bsc#1219998) - Multiple permission model bypasses due to improper path traversal sequence sanitization - (Medium)
  * (CVE-2024-21890, bsc#1219999) - Improper handling of wildcards in --allow-fs-read and --allow-fs-write (Medium)
  * (CVE-2024-22025, bsc#1220014) - Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium)
  * undici version 5.28.3 (CVE-2024-24758, bsc#1220017)
  * libuv version 1.48.0 (CVE-2024-24806, bsc#1220053)</changelog>
  <changelog author="adam.majer@suse.de" date="1712059200">- Update to 20.12.0:
  * crypto: implement crypto.hash()
  * util: add loading and parsing environment variables
  * new connection attempt events: connectionAttempt,
    connectionAttemptFailed, connectionAttemptTimeout
  * sea: support embedding assets
  * support configurable snapshot through --build-snapshot-config flag
  * util.styleText(format, text): This function returns a formatted
    text considering the format passed.
  * vm: support using the default loader to handle dynamic import()
- c-ares-fixes.patch: removed, upstreamed
- nodejs-libpath.patch, versioned.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1712664000">- Update to 20.12.1:
  * CVE-2024-27983 - Assertion failed in node::http2::Http2Session::~Http2Session()
    leads to HTTP/2 server crash- (High) (bsc#1222244)
  * CVE-2024-27982 - HTTP Request Smuggling via Content Length
    Obfuscation- (Medium) (bsc#1222384)
  * updated dependencies:
    + llhttp version 9.2.1
    + undici version 5.28.4 (bsc#1222530, bsc#1222603,
    CVE-2024-30260, CVE-2024-30261)
- node-gyp-addon-gypi.patch: adapted for new unit test layouts
- fix_ci_tests.patch: add benchmark fix</changelog>
  <changelog author="adam.majer@suse.de" date="1716897600">- Update to 20.13.1:
  * buffer: improve base64 and base64url performance
  * crypto: deprecate implicitly shortened GCM tags
  * events,doc: mark CustomEvent as stable
  * fs: add stacktrace to fs/promises
  * report: add --report-exclude-network option
  * src: add uv_get_available_memory to report and process
  * stream: support typed arrays
  * util: support array of formats in util.styleText
  * v8: implement v8.queryObjects() for memory leak regression testing
  * watch: mark as stable
- versioned.patch: refreshed
- cares_sle12_capabilities.patch: SLES12 compatibility</changelog>
  <changelog author="adam.majer@suse.de" date="1720785600">- Update to 20.15.1:
  * Bypass incomplete fix of CVE-2024-27980 (bsc#1227560, CVE-2024-36138)
  * Bypass network import restriction via data URL (bsc#1227554, CVE-2024-22020)
  * fs.lstat bypasses permission model (bsc#1227562, CVE-2024-22018)
  * fs.fchown/fchmod bypasses permission model (bsc#1227561, CVE-2024-36137)
  * Permission model improperly processes UNC paths (bsc#1227563, CVE-2024-37372)
- Changes in 20.15.0:
  * test_runner: support test plans
  * inspector: introduce the --inspect-wait flag
  * zlib: expose zlib.crc32()
  * cli: allow running wasm in limited vmem with --disable-wasm-trap-handler
- Changes in 20.14.0
  * src,permission: throw async errors on async APIs
  * test_runner: support forced exit
- fix_ci_tests.patch, npm_search_paths.patch: refreshed
- skip_no_console.patch: dropped, upstreamed</changelog>
</package>
<package pkgid="ac92562dabb05eacf7e8eb72805e80dbc828576c3fbc051579f9aee83145c367" name="corepack20" arch="x86_64">
  <version epoch="0" ver="20.15.1" rel="150600.3.3.2"/>
  <changelog author="adam.majer@suse.de" date="1692964800">- Temporarily bundle ICU for SLE15 SP6 (jsc#PED-4819)</changelog>
  <changelog author="adam.majer@suse.de" date="1693915200">- Update to 20.6.0:
  * add support for .env files to configure envrionment variables
  * import.meta.resolve unflagged
  * deps: npm updated to 9.8.1
- nodejs.keyring: updated to include current upstream releasers</changelog>
  <changelog author="adam.majer@suse.de" date="1694174400">- f0ff63fbc32ea55f3d92c5c89fdb91ec47786859.patch: fixes issues with
  Angular and other software that tries to load ECM modules in
  somewhat circular fashion ending up with multiple executions.</changelog>
  <changelog author="adam.majer@suse.de" date="1695038400">- Update to 20.6.1:
  * f0ff63fbc32ea55f3d92c5c89fdb91ec47786859.patch: removed, upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1695124800">- Update to 20.7.0:
  * src: support multiple --env-file declarations
  * deps: upgrade npm to 10.1.0
  * doc: move and rename loaders section
  * lib: add api to detect whether source-maps are enabled
  * src,permission: add multiple allow-fs-* flags
  * test_runner: expose location of tests
- z13.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1696507200">- Update to 20.8.0:
  * Stream performance improvements
  * Rework of memory management in vm APIs with the importModuleDynamically
    option
  * test_runner:
    + accept testOnly in run
    + add junit reporter
- fix_ci_tests.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1697457600">- Security fixes relase 20.8.1
  * (CVE-2023-44487, bsc#1216190): nghttp2 Security Release
  * (CVE-2023-45143, bsc#1216205): undici Security Release
  * (CVE-2023-39332, bsc#1216271): Path traversal through path stored in Uint8Array
  * (CVE-2023-39331, bsc#1216270): Permission model improperly protects against path traversal
  * (CVE-2023-38552, bsc#1216272): Integrity checks according to policies can be circumvented
  * (CVE-2023-39333, bsc#1216273): Code injection via WebAssembly export names
- fix_ci_tests.patch: refreshed</changelog>
  <changelog author="dimstar@opensuse.org" date="1698148800">- Add nodejs20-zlib-1.3.patch: Support zlib version with only
  major.minor versions, like zlib 1.3.</changelog>
  <changelog author="adam.majer@suse.de" date="1698408000">- fix_ci_tests.patch: adapt for openssl 3.1.4</changelog>
  <changelog author="adam.majer@suse.de" date="1699531200">- Update to 20.9.0:
  * No changes, just LTS transition</changelog>
  <changelog author="adam.majer@suse.de" date="1700740800">- Update to 20.10.0:
  * --experimental-default-type flag to flip module defaults
  * The new flag --experimental-detect-module can be used to
  automatically run ES modules when their syntax can be detected.
  * Added flush option in file system functions for fs.writeFile functions
  * Added experimental WebSocket client
  * vm: fix V8 compilation cache support for vm.Script. This fixes
  performance regression since v16.x when support for
  importModuleDynamically was added to vm.Script
  For details, see
  https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V20.md#20.10.0
- nodejs20-zlib-1.3.patch: upstreamed, removed
- fix_ci_tests.patch, node-gyp-addon-gypi.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1704196800">- c-ares-fixes.patch: fixes unit tests for new c-ares</changelog>
  <changelog author="adam.majer@suse.de" date="1704715200">- c-ares-fixes.patch: add additional backports for unit test fixes</changelog>
  <changelog author="adam.majer@suse.de" date="1706529600">- fix_ci_tests.patch: disable test_crypto_fips for openssl 3.x,
  to be fixed soon (bsc#1219152)</changelog>
  <changelog author="adam.majer@suse.de" date="1707739200">- update to 20.11.0:
  * esm: add import.meta.dirname and import.meta.filename
  * fs: add c++ fast path for writeFileSync utf8
  * module: remove useCustomLoadersIfPresent flag
  * module: bootstrap module loaders in shadow realm
  * src: add --disable-warning option
  * src: create per isolate proxy env template
  * src: make process binding data weak
  * stream: use Array for Readable buffer
  * stream: optimize creation
  * test_runner: adds built in lcov reporter
  * test_runner: add Date to the supported mock APIs
  * test_runner, cli: add --test-timeout flag
- c-ares-fixes.patch, fix_ci_tests.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1708084800">- Update to 20.11.1: (security updates)
  * (CVE-2024-21892, bsc#1219992) - Code injection and privilege escalation through Linux capabilities- (High)
  * (CVE-2024-22019, bsc#1219993) - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High)
  * (CVE-2024-21896, bsc#1219994) - Path traversal by monkey-patching Buffer internals- (High)
  * (CVE-2024-22017, bsc#1219995) - setuid() does not drop all privileges due to io_uring - (High)
  * (CVE-2023-46809, bsc#1219997) - Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium)
  * (CVE-2024-21891, bsc#1219998) - Multiple permission model bypasses due to improper path traversal sequence sanitization - (Medium)
  * (CVE-2024-21890, bsc#1219999) - Improper handling of wildcards in --allow-fs-read and --allow-fs-write (Medium)
  * (CVE-2024-22025, bsc#1220014) - Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium)
  * undici version 5.28.3 (CVE-2024-24758, bsc#1220017)
  * libuv version 1.48.0 (CVE-2024-24806, bsc#1220053)</changelog>
  <changelog author="adam.majer@suse.de" date="1712059200">- Update to 20.12.0:
  * crypto: implement crypto.hash()
  * util: add loading and parsing environment variables
  * new connection attempt events: connectionAttempt,
    connectionAttemptFailed, connectionAttemptTimeout
  * sea: support embedding assets
  * support configurable snapshot through --build-snapshot-config flag
  * util.styleText(format, text): This function returns a formatted
    text considering the format passed.
  * vm: support using the default loader to handle dynamic import()
- c-ares-fixes.patch: removed, upstreamed
- nodejs-libpath.patch, versioned.patch: refreshed</changelog>
  <changelog author="adam.majer@suse.de" date="1712664000">- Update to 20.12.1:
  * CVE-2024-27983 - Assertion failed in node::http2::Http2Session::~Http2Session()
    leads to HTTP/2 server crash- (High) (bsc#1222244)
  * CVE-2024-27982 - HTTP Request Smuggling via Content Length
    Obfuscation- (Medium) (bsc#1222384)
  * updated dependencies:
    + llhttp version 9.2.1
    + undici version 5.28.4 (bsc#1222530, bsc#1222603,
    CVE-2024-30260, CVE-2024-30261)
- node-gyp-addon-gypi.patch: adapted for new unit test layouts
- fix_ci_tests.patch: add benchmark fix</changelog>
  <changelog author="adam.majer@suse.de" date="1716897600">- Update to 20.13.1:
  * buffer: improve base64 and base64url performance
  * crypto: deprecate implicitly shortened GCM tags
  * events,doc: mark CustomEvent as stable
  * fs: add stacktrace to fs/promises
  * report: add --report-exclude-network option
  * src: add uv_get_available_memory to report and process
  * stream: support typed arrays
  * util: support array of formats in util.styleText
  * v8: implement v8.queryObjects() for memory leak regression testing
  * watch: mark as stable
- versioned.patch: refreshed
- cares_sle12_capabilities.patch: SLES12 compatibility</changelog>
  <changelog author="adam.majer@suse.de" date="1720785600">- Update to 20.15.1:
  * Bypass incomplete fix of CVE-2024-27980 (bsc#1227560, CVE-2024-36138)
  * Bypass network import restriction via data URL (bsc#1227554, CVE-2024-22020)
  * fs.lstat bypasses permission model (bsc#1227562, CVE-2024-22018)
  * fs.fchown/fchmod bypasses permission model (bsc#1227561, CVE-2024-36137)
  * Permission model improperly processes UNC paths (bsc#1227563, CVE-2024-37372)
- Changes in 20.15.0:
  * test_runner: support test plans
  * inspector: introduce the --inspect-wait flag
  * zlib: expose zlib.crc32()
  * cli: allow running wasm in limited vmem with --disable-wasm-trap-handler
- Changes in 20.14.0
  * src,permission: throw async errors on async APIs
  * test_runner: support forced exit
- fix_ci_tests.patch, npm_search_paths.patch: refreshed
- skip_no_console.patch: dropped, upstreamed</changelog>
</package>
<package pkgid="6e588d986f5396f61e522d7ced6f4756e23036a2a1844abf197c2187ad420e0d" name="coreutils" arch="aarch64">
  <version epoch="0" ver="8.32" rel="150400.9.6.1"/>
  <changelog author="mail@bernhard-voelker.de" date="1493726400">- coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch:
  Add upstream patch to fix an heap overflow security issue
  in date(1) and touch(1) with a large TZ variable
  (CVE-2017-7476, rh#1444774, boo#1037124).</changelog>
  <changelog author="ghe@suse.com" date="1502884800">- Drop coreutils-ocfs2_reflinks.patch
  OCFS2 file system has supported file clone ioctls like btrfs,
  then, coreutils doesn't need this patch from the kernel v4.10-rc1</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1504526400">- Update to 8.28
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.keyring: Update from upstream (Savannah).
- Remove now-upstream patches:
  * coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch
  * coreutils-tests-port-to-timezone-2017a.patch
- coreutils.spec: Add "BuildRequires: user(bin)" for the tests.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1514462400">- Update to 8.29:
  * Noteworthy changes in release 8.29 (2017-12-27) [stable]
  * * Bug fixes
  b2sum no longer crashes when processing certain truncated check files.
  [bug introduced with b2sum coreutils-8.26]
  dd now ensures the correct cache ranges are specified for the "nocache"
  and "direct" flags.  Previously some pages in the page cache were not
  invalidated.  [bug introduced for "direct" in coreutils-7.5,
  and with the "nocache" implementation in coreutils-8.11]
  df no longer hangs when given a fifo argument.
  [bug introduced in coreutils-7.3]
  ptx -S no longer infloops for a pattern which returns zero-length matches.
  [the bug dates back to the initial implementation]
  shred --remove will again repeatedly rename files with shortening names
  to attempt to hide the original length of the file name.
  [bug introduced in coreutils-8.28]
  stty no longer crashes when processing settings with -F also specified.
  [bug introduced in fileutils-4.0]
  tail --bytes again supports non seekable inputs on all systems.
  On systems like android it always tried to process as seekable inputs.
  [bug introduced in coreutils-8.24]
  timeout will again notice its managed command exiting, even when
  invoked with blocked CHLD signal, or in a narrow window where
  this CHLD signal from the exiting child was missed.  In each case
  timeout would have then waited for the time limit to expire.
  [bug introduced in coreutils-8.27]
  * * New features
  timeout now supports the --verbose option to diagnose forced termination.
  * * Improvements
  dd now supports iflag=direct with arbitrary sized files on all file systems.
  tail --bytes=NUM will efficiently seek to the end of block devices,
  rather than reading from the start.
  Utilities which do not support long options (other than the default --help
  and --version), e.g. cksum and sleep, now use more consistent error diagnostic
  for unknown long options.
  * * Build-related
  Default man pages are now distributed which are used if perl is
  not available on the build system, or when cross compiling.
- Refresh patches (line number changes only):
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1530619200">- Update to 8.30:
  * Noteworthy changes in release 8.30 (2018-07-01) [stable]
  * * Bug fixes
  'cp --symlink SRC DST' will again correctly validate DST.
  If DST is a regular file and SRC is a symlink to DST,
  then cp will no longer allow that operation to clobber DST.
  Also with -d, if DST is a symlink, then it can always be replaced,
  even if it points to SRC on a separate device.
  [bugs introduced with coreutils-8.27]
  'cp -n -u' and 'mv -n -u' now consistently ignore the -u option.
  Previously, this option combination suffered from race conditions
  that caused -u to sometimes override -n.
  [bug introduced with coreutils-7.1]
  'cp -a --no-preserve=mode' now sets appropriate default permissions
  for non regular files like fifos and character device nodes etc.,
  and leaves mode bits of existing files unchanged.
  Previously it would have set executable bits on created special files,
  and set mode bits for existing files as if they had been created.
  [bug introduced with coreutils-8.20]
  'cp --remove-destination file symlink' now removes the symlink
  even if it can't be traversed.
  [bug introduced with --remove-destination in fileutils-4.1.1]
  ls no longer truncates the abbreviated month names that have a
  display width between 6 and 12 inclusive.  Previously this would have
  output ambiguous months for Arabic or Catalan locales.
  'ls -aA' is now equivalent to 'ls -A', since -A now overrides -a.
  [bug introduced in coreutils-5.3.0]
  'mv -n A B' no longer suffers from a race condition that can
  overwrite a simultaneously-created B.  This bug fix requires
  platform support for the renameat2 or renameatx_np syscalls, found
  in recent Linux and macOS kernels.  As a side effect, ‘mv -n A A’
  now silently does nothing if A exists.
  [bug introduced with coreutils-7.1]
  * * Changes in behavior
  'cp --force file symlink' now removes the symlink even if
  it is self referential.
  ls --color now matches file extensions case insensitively.
  * * New features
  cp --reflink now supports --reflink=never to enforce a standard copy.
  env supports a new -v/--debug option to show verbose information about
  each processing step.
  env supports a new -S/--split-string=S option to split a single argument
  string into multiple arguments. Used to pass multiple arguments in scripts
  (shebang lines).
  md5sum accepts a new option: --zero (-z) to delimit the output lines with a
  NUL instead of a newline character.  This also disables file name escaping.
  This also applies to sha*sum and b2sum.
  rm --preserve-root now supports the --preserve-root=all option to
  reject any command line argument that is mounted to a separate file system.
  * * Improvements
  cut supports line lengths up to the max file size on 32 bit systems.
  Previously only offsets up to SIZE_MAX-1 were supported.
  stat and tail now know about the "exfs" file system, which is a
  version of XFS.  stat -f --format=%T now reports the file system type,
  and tail -f uses inotify.
  wc avoids redundant processing of ASCII text in multibyte locales,
  which is especially significant on macOS.
  * * Build-related
  Adjust to glibc &gt;= 2.28  (bsc#1182550, jsc#SLE-13520, jsc#SLE-13756)
- Refresh patches (line number changes only):
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * (License): osc changed the value from "GPL-3.0+" to "GPL-3.0-or-later".
  * (build): Make sure that parse-datetime.{c,y} ends up in debuginfo (rh#1555079).
- coreutils-i18n.patch:
  * src/exand.c,src/unexpand.c: Avoid -Wcomment warning.
  * src/cut.c (cut_characters_or_cut_bytes_no_split): Change idx from size_t
    to uintmax_t type to avoid a regression on i586, armv7l and ppc.
    Compare upstream, non-MB commit:
    https://git.sv.gnu.org/cgit/coreutils.git/commit/?id=d1a754c8272
    (cut_fields_mb): Likewise for field_idx.
  * tests/misc/cut.pl: Remove downstream tweaks as upstream MB tests are
    working since a while.
- coreutils.keyring: Update Assaf Gordon's GPG public key.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1552305600">- Update to 8.31:
  * Noteworthy changes in release 8.31 (2019-03-10) [stable]
  * * Bug fixes
  'base64 a b' now correctly diagnoses 'b' as the extra operand, not 'a'.
  [bug introduced in coreutils-5.3.0]
  When B already exists, 'cp -il A B' no longer immediately fails
  after asking the user whether to proceed.
  [This bug was present in "the beginning".]
  df no longer corrupts displayed multibyte characters on macOS.
  [bug introduced with coreutils-8.18]
  seq no longer outputs inconsistent decimal point characters
  for the last number, when locales are misconfigured.
  [bug introduced in coreutils-7.0]
  shred, sort, and split no longer falsely report ftruncate errors
  when outputting to less-common file types.  For example, the shell
  command 'sort /dev/null -o /dev/stdout | cat' no longer fails with
  an "error truncating" diagnostic.
  [bug was introduced with coreutils-8.18 for sort and split, and
  (for shared memory objects only) with fileutils-4.1 for shred]
  sync no longer fails for write-only file arguments.
  [bug introduced with argument support to sync in coreutils-8.24]
  'tail -f file | filter' no longer exits immediately on AIX.
  [bug introduced in coreutils-8.28]
  'tail -f file | filter' no longer goes into an infinite loop
  if filter exits and SIGPIPE is ignored.
  [bug introduced in coreutils-8.28]
  * * Changes in behavior
  cksum, dd, hostid, hostname, link, logname, sleep, tsort, unlink,
  uptime, users, whoami, yes: now always process --help and --version options,
  regardless of any other arguments present before any optional '--'
  end-of-options marker.
  nohup now processes --help and --version as first options even if other
  parameters follow.
  'yes a -- b' now outputs 'a b' instead of including the end-of-options
  marker as before: 'a -- b'.
  echo now always processes backslash escapes when the POSIXLY_CORRECT
  environment variable is set.
  When possible 'ln A B' now merely links A to B and reports an error
  if this fails, instead of statting A and B before linking.  This
  uses fewer system calls and avoids some races.  The old statting
  approach is still used in situations where hard links to directories
  are allowed (e.g., NetBSD when superuser).
  ls --group-directories-first will also group symlinks to directories.
  'test -a FILE' is not supported anymore.  Long ago, there were concerns about
  the high probability of humans confusing the -a primary with the -a binary
  operator, so POSIX changed this to 'test -e FILE'.  Scripts using it were
  already broken and non-portable; the -a unary operator was never documented.
  wc now treats non breaking space characters as word delimiters
  unless the POSIXLY_CORRECT environment variable is set.
  * * New features
  id now supports specifying multiple users.
  'date' now supports the '+' conversion specification flag,
  introduced in POSIX.1-2017.
  printf, seq, sleep, tail, and timeout now accept floating point
  numbers in either the current or the C locale.  For example, if the
  current locale's decimal point is ',', 'sleep 0,1' and 'sleep 0.1'
  now mean the same thing.  Previously, these commands accepted only
  C-locale syntax with '.' as the decimal point.  The new behavior is
  more compatible with other implementations in non-C locales.
  test now supports the '-N FILE' unary operator (like e.g. bash) to check
  whether FILE exists and has been modified since it was last read.
  env now supports '--default-signal[=SIG]', '--ignore-signal[=SIG]', and
  '--block-signal[=SIG], to setup signal handling before executing a program.
  env now supports '--list-signal-handling' to indicate non-default
  signal handling before executing a program.
  * * New commands
  basenc is added to complement existing base64,base32 commands,
  and encodes and decodes printable text using various common encodings:
  base64,base64url,base32,base32hex,base16,base2,z85.
  * * Improvements
  ls -l now better aligns abbreviated months containing digits,
  which is common in Asian locales.
  stat and tail now know about the "sdcardfs" file system on Android.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  stat now prints file creation time when supported by the file system,
  on GNU Linux systems with glibc &gt;= 2.28 and kernel &gt;= 4.11.
- Refresh patches (line number changes only):
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-misc.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * Version: bump version.
  * URL: Use https scheme.
  * %description: Add 'basenc' tool.
  * Change gitweb to cgit URL with https in a comment.
- coreutils.keyring:
  * Update for added section headers ('GPG keys of &lt;MAINTAINER&gt;').</changelog>
  <changelog author="lnussel@suse.de" date="1568894400">- Do not recommend lang package. The lang package already has a
  supplements.</changelog>
  <changelog author="lnussel@suse.de" date="1578571200">- switch to multibuild
- add coreutils-single subpackage that contains a single binary coreutils tool
  similar to busybox
- package LC_CTIME directories also in lang package
- split off doc package
- remove info macros, handled by file trigger nowadays</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1579521600">- minor: remove obsolete comment in spec file.</changelog>
  <changelog author="lnussel@suse.de" date="1580212800">- disable single and testsuite builds in rings/staging
- remove duplicate "coreutils" in flavor to make it look nicer in OBS</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1583755200">- Update to 8.32:
  * Noteworthy changes in release 8.32 (2020-03-05) [stable]
  * * Bug fixes
  cp now copies /dev/fd/N correctly on platforms like Solaris where
  it is a character-special file whose minor device number is N.
  [bug introduced in fileutils-4.1.6]
  dd conv=fdatasync no longer reports a "Bad file descriptor" error
  when fdatasync is interrupted, and dd now retries interrupted calls
  to close, fdatasync, fstat and fsync instead of incorrectly
  reporting an "Interrupted system call" error.
  [bugs introduced in coreutils-6.0]
  df now correctly parses the /proc/self/mountinfo file for unusual entries
  like ones with '\r' in a field value ("mount -t tmpfs tmpfs /foo$'\r'bar"),
  when the source field is empty ('mount -t tmpfs "" /mnt'), and when the
  filesystem type contains characters like a blank which need escaping.
  [bugs introduced in coreutils-8.24 with the introduction of reading
  the /proc/self/mountinfo file]
  factor again outputs immediately when stdout is a tty but stdin is not.
  [bug introduced in coreutils-8.24]
  ln works again on old systems without O_DIRECTORY support (like Solaris 10),
  and on systems where symlink ("x", ".") fails with errno == EINVAL
  (like Solaris 10 and Solaris 11).
  [bug introduced in coreutils-8.31]
  rmdir --ignore-fail-on-non-empty now works correctly for directories
  that fail to be removed due to permission issues.  Previously the exit status
  was reversed, failing for non empty and succeeding for empty directories.
  [bug introduced in coreutils-6.11]
  'shuf -r -n 0 file' no longer mistakenly reads from standard input.
  [bug introduced with the --repeat feature in coreutils-8.22]
  split no longer reports a "output file suffixes exhausted" error
  when the specified number of files is evenly divisible by 10, 16, 26,
  for --numeric, --hex, or default alphabetic suffixes respectively.
  [bug introduced in coreutils-8.24]
  seq no longer prints an extra line under certain circumstances (such as
  'seq -f "%g " 1000000 1000000').
  [bug introduced in coreutils-6.10]
  * * Changes in behavior
  Several programs now check that numbers end properly.  For example,
  'du -d 1x' now reports an error instead of silently ignoring the 'x'.
  Affected programs and options include du -d, expr's numeric operands
  on non-GMP builds, install -g and -o, ls's TABSIZE environment
  variable, mknod b and c, ptx -g and -w, shuf -n, and sort --batch-size
  and --parallel.
  date now parses military time zones in accordance with common usage:
    "A" to "M"  are equivalent to UTC+1 to UTC+12
    "N" to "Y"  are equivalent to UTC-1 to UTC-12
    "Z" is "zulu" time (UTC).
  For example, 'date -d "09:00B" is now equivalent to 9am in UTC+2 time zone.
  Previously, military time zones were parsed according to the obsolete
  rfc822, with their value negated (e.g., "B" was equivalent to UTC-2).
  [The old behavior was introduced in sh-utils 2.0.15 ca. 1999, predating
  coreutils package.]
  ls issues an error message on a removed directory, on GNU/Linux systems.
  Previously no error and no entries were output, and so indistinguishable
  from an empty directory, with default ls options.
  uniq no longer uses strcoll() to determine string equivalence,
  and so will operate more efficiently and consistently.
  * * New Features
  ls now supports the --time=birth option to display and sort by
  file creation time, where available.
  od --skip-bytes now can use lseek even if the input is not a regular
  file, greatly improving performance in some cases.
  stat(1) supports a new --cached= option, used on systems with statx(2)
  to control cache coherency of file system attributes,
  useful on network file systems.
  * * Improvements
  stat and ls now use the statx() system call where available, which can
  operate more efficiently by only retrieving requested attributes.
  stat and tail now know about the "binderfs", "dma-buf-fs", "erofs",
  "ppc-cmm-fs", and "z3fold" file systems.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  * * Build-related
  gzip-compressed tarballs are distributed once again
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-invalid-ids.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils-i18n.patch:
  * uniq: remove collation handling as required by newer POSIX; see
  - https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8e81d44b5
  - https://www.austingroupbugs.net/view.php?id=963
- coreutils-ls-restore-8.31-behavior-on-removed-dirs.patch:
  * Add patch for 'ls' to restore 8.31 behavior on removed directories.
- coreutils.spec:
  * Version: bump version.
  * %check: re-enable regular 'make check' for non-multibuild package.
  * reference the above new patch.
- coreutils.keyring:
  * Update from upstream (Savannah).</changelog>
  <changelog author="dmueller@suse.com" date="1588593600">- add coreutils-use-python3.patch to minimally port away from
  python 2.x use of pyinotify in the testsuite</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1592049600">- coreutils-gnulib-disable-test-float.patch: Add patch to temporarily
  disable the gnulib test 'test-float' failing on ppc and ppc64le.
- coreutils.spec: Reference the patch.  While at it, avoid conditional
  Patch and Source entries as that break cross-platform builds from
  source RPMs.</changelog>
  <changelog author="dimstar@opensuse.org" date="1594900800">- Drop suse-module-tools BuildRequires: this was used for the macro
  regenerate_initrd_post/posttrans, which have been moved to
  rpm-config-SUSE in Jan 2019.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1598875200">- gnulib-test-avoid-FP-perror-strerror.patch: Add patch to
  avoid false-positive error in gnulib tests 'test-perror2' and
  'test-strerror_r', visible on armv7l.
- coreutils.spec: Reference the patch.</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="zpetrova@suse.com" date="1635163200">- coreutils-df-fuse-portal-dummy.patch:
  df: Add "fuse.portal" as a dummy file system (used in flatpak
  implementations). (bsc#1189152)</changelog>
  <changelog author="ailiop@suse.com" date="1706529600">- tail: fix tailing sysfs files where PAGE_SIZE &gt; BUFSIZ (bsc#1219321)
  - add coreutils-tail-fix-tailing-sysfs-files-where-PAGE_SIZE-BUFSIZ.patch</changelog>
  <changelog author="tabraham@suse.com" date="1712059200">- ls: avoid triggering automounts (bsc#1221632)
  - add coreutils-ls-avoid-triggering-automounts.patch</changelog>
</package>
<package pkgid="a2d28b60870c8f3eb326a331deb8a2b9fa85f93487a881e5deb941be7e17dc94" name="coreutils" arch="ppc64le">
  <version epoch="0" ver="8.32" rel="150400.9.6.1"/>
  <changelog author="mail@bernhard-voelker.de" date="1493726400">- coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch:
  Add upstream patch to fix an heap overflow security issue
  in date(1) and touch(1) with a large TZ variable
  (CVE-2017-7476, rh#1444774, boo#1037124).</changelog>
  <changelog author="ghe@suse.com" date="1502884800">- Drop coreutils-ocfs2_reflinks.patch
  OCFS2 file system has supported file clone ioctls like btrfs,
  then, coreutils doesn't need this patch from the kernel v4.10-rc1</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1504526400">- Update to 8.28
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.keyring: Update from upstream (Savannah).
- Remove now-upstream patches:
  * coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch
  * coreutils-tests-port-to-timezone-2017a.patch
- coreutils.spec: Add "BuildRequires: user(bin)" for the tests.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1514462400">- Update to 8.29:
  * Noteworthy changes in release 8.29 (2017-12-27) [stable]
  * * Bug fixes
  b2sum no longer crashes when processing certain truncated check files.
  [bug introduced with b2sum coreutils-8.26]
  dd now ensures the correct cache ranges are specified for the "nocache"
  and "direct" flags.  Previously some pages in the page cache were not
  invalidated.  [bug introduced for "direct" in coreutils-7.5,
  and with the "nocache" implementation in coreutils-8.11]
  df no longer hangs when given a fifo argument.
  [bug introduced in coreutils-7.3]
  ptx -S no longer infloops for a pattern which returns zero-length matches.
  [the bug dates back to the initial implementation]
  shred --remove will again repeatedly rename files with shortening names
  to attempt to hide the original length of the file name.
  [bug introduced in coreutils-8.28]
  stty no longer crashes when processing settings with -F also specified.
  [bug introduced in fileutils-4.0]
  tail --bytes again supports non seekable inputs on all systems.
  On systems like android it always tried to process as seekable inputs.
  [bug introduced in coreutils-8.24]
  timeout will again notice its managed command exiting, even when
  invoked with blocked CHLD signal, or in a narrow window where
  this CHLD signal from the exiting child was missed.  In each case
  timeout would have then waited for the time limit to expire.
  [bug introduced in coreutils-8.27]
  * * New features
  timeout now supports the --verbose option to diagnose forced termination.
  * * Improvements
  dd now supports iflag=direct with arbitrary sized files on all file systems.
  tail --bytes=NUM will efficiently seek to the end of block devices,
  rather than reading from the start.
  Utilities which do not support long options (other than the default --help
  and --version), e.g. cksum and sleep, now use more consistent error diagnostic
  for unknown long options.
  * * Build-related
  Default man pages are now distributed which are used if perl is
  not available on the build system, or when cross compiling.
- Refresh patches (line number changes only):
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1530619200">- Update to 8.30:
  * Noteworthy changes in release 8.30 (2018-07-01) [stable]
  * * Bug fixes
  'cp --symlink SRC DST' will again correctly validate DST.
  If DST is a regular file and SRC is a symlink to DST,
  then cp will no longer allow that operation to clobber DST.
  Also with -d, if DST is a symlink, then it can always be replaced,
  even if it points to SRC on a separate device.
  [bugs introduced with coreutils-8.27]
  'cp -n -u' and 'mv -n -u' now consistently ignore the -u option.
  Previously, this option combination suffered from race conditions
  that caused -u to sometimes override -n.
  [bug introduced with coreutils-7.1]
  'cp -a --no-preserve=mode' now sets appropriate default permissions
  for non regular files like fifos and character device nodes etc.,
  and leaves mode bits of existing files unchanged.
  Previously it would have set executable bits on created special files,
  and set mode bits for existing files as if they had been created.
  [bug introduced with coreutils-8.20]
  'cp --remove-destination file symlink' now removes the symlink
  even if it can't be traversed.
  [bug introduced with --remove-destination in fileutils-4.1.1]
  ls no longer truncates the abbreviated month names that have a
  display width between 6 and 12 inclusive.  Previously this would have
  output ambiguous months for Arabic or Catalan locales.
  'ls -aA' is now equivalent to 'ls -A', since -A now overrides -a.
  [bug introduced in coreutils-5.3.0]
  'mv -n A B' no longer suffers from a race condition that can
  overwrite a simultaneously-created B.  This bug fix requires
  platform support for the renameat2 or renameatx_np syscalls, found
  in recent Linux and macOS kernels.  As a side effect, ‘mv -n A A’
  now silently does nothing if A exists.
  [bug introduced with coreutils-7.1]
  * * Changes in behavior
  'cp --force file symlink' now removes the symlink even if
  it is self referential.
  ls --color now matches file extensions case insensitively.
  * * New features
  cp --reflink now supports --reflink=never to enforce a standard copy.
  env supports a new -v/--debug option to show verbose information about
  each processing step.
  env supports a new -S/--split-string=S option to split a single argument
  string into multiple arguments. Used to pass multiple arguments in scripts
  (shebang lines).
  md5sum accepts a new option: --zero (-z) to delimit the output lines with a
  NUL instead of a newline character.  This also disables file name escaping.
  This also applies to sha*sum and b2sum.
  rm --preserve-root now supports the --preserve-root=all option to
  reject any command line argument that is mounted to a separate file system.
  * * Improvements
  cut supports line lengths up to the max file size on 32 bit systems.
  Previously only offsets up to SIZE_MAX-1 were supported.
  stat and tail now know about the "exfs" file system, which is a
  version of XFS.  stat -f --format=%T now reports the file system type,
  and tail -f uses inotify.
  wc avoids redundant processing of ASCII text in multibyte locales,
  which is especially significant on macOS.
  * * Build-related
  Adjust to glibc &gt;= 2.28  (bsc#1182550, jsc#SLE-13520, jsc#SLE-13756)
- Refresh patches (line number changes only):
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * (License): osc changed the value from "GPL-3.0+" to "GPL-3.0-or-later".
  * (build): Make sure that parse-datetime.{c,y} ends up in debuginfo (rh#1555079).
- coreutils-i18n.patch:
  * src/exand.c,src/unexpand.c: Avoid -Wcomment warning.
  * src/cut.c (cut_characters_or_cut_bytes_no_split): Change idx from size_t
    to uintmax_t type to avoid a regression on i586, armv7l and ppc.
    Compare upstream, non-MB commit:
    https://git.sv.gnu.org/cgit/coreutils.git/commit/?id=d1a754c8272
    (cut_fields_mb): Likewise for field_idx.
  * tests/misc/cut.pl: Remove downstream tweaks as upstream MB tests are
    working since a while.
- coreutils.keyring: Update Assaf Gordon's GPG public key.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1552305600">- Update to 8.31:
  * Noteworthy changes in release 8.31 (2019-03-10) [stable]
  * * Bug fixes
  'base64 a b' now correctly diagnoses 'b' as the extra operand, not 'a'.
  [bug introduced in coreutils-5.3.0]
  When B already exists, 'cp -il A B' no longer immediately fails
  after asking the user whether to proceed.
  [This bug was present in "the beginning".]
  df no longer corrupts displayed multibyte characters on macOS.
  [bug introduced with coreutils-8.18]
  seq no longer outputs inconsistent decimal point characters
  for the last number, when locales are misconfigured.
  [bug introduced in coreutils-7.0]
  shred, sort, and split no longer falsely report ftruncate errors
  when outputting to less-common file types.  For example, the shell
  command 'sort /dev/null -o /dev/stdout | cat' no longer fails with
  an "error truncating" diagnostic.
  [bug was introduced with coreutils-8.18 for sort and split, and
  (for shared memory objects only) with fileutils-4.1 for shred]
  sync no longer fails for write-only file arguments.
  [bug introduced with argument support to sync in coreutils-8.24]
  'tail -f file | filter' no longer exits immediately on AIX.
  [bug introduced in coreutils-8.28]
  'tail -f file | filter' no longer goes into an infinite loop
  if filter exits and SIGPIPE is ignored.
  [bug introduced in coreutils-8.28]
  * * Changes in behavior
  cksum, dd, hostid, hostname, link, logname, sleep, tsort, unlink,
  uptime, users, whoami, yes: now always process --help and --version options,
  regardless of any other arguments present before any optional '--'
  end-of-options marker.
  nohup now processes --help and --version as first options even if other
  parameters follow.
  'yes a -- b' now outputs 'a b' instead of including the end-of-options
  marker as before: 'a -- b'.
  echo now always processes backslash escapes when the POSIXLY_CORRECT
  environment variable is set.
  When possible 'ln A B' now merely links A to B and reports an error
  if this fails, instead of statting A and B before linking.  This
  uses fewer system calls and avoids some races.  The old statting
  approach is still used in situations where hard links to directories
  are allowed (e.g., NetBSD when superuser).
  ls --group-directories-first will also group symlinks to directories.
  'test -a FILE' is not supported anymore.  Long ago, there were concerns about
  the high probability of humans confusing the -a primary with the -a binary
  operator, so POSIX changed this to 'test -e FILE'.  Scripts using it were
  already broken and non-portable; the -a unary operator was never documented.
  wc now treats non breaking space characters as word delimiters
  unless the POSIXLY_CORRECT environment variable is set.
  * * New features
  id now supports specifying multiple users.
  'date' now supports the '+' conversion specification flag,
  introduced in POSIX.1-2017.
  printf, seq, sleep, tail, and timeout now accept floating point
  numbers in either the current or the C locale.  For example, if the
  current locale's decimal point is ',', 'sleep 0,1' and 'sleep 0.1'
  now mean the same thing.  Previously, these commands accepted only
  C-locale syntax with '.' as the decimal point.  The new behavior is
  more compatible with other implementations in non-C locales.
  test now supports the '-N FILE' unary operator (like e.g. bash) to check
  whether FILE exists and has been modified since it was last read.
  env now supports '--default-signal[=SIG]', '--ignore-signal[=SIG]', and
  '--block-signal[=SIG], to setup signal handling before executing a program.
  env now supports '--list-signal-handling' to indicate non-default
  signal handling before executing a program.
  * * New commands
  basenc is added to complement existing base64,base32 commands,
  and encodes and decodes printable text using various common encodings:
  base64,base64url,base32,base32hex,base16,base2,z85.
  * * Improvements
  ls -l now better aligns abbreviated months containing digits,
  which is common in Asian locales.
  stat and tail now know about the "sdcardfs" file system on Android.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  stat now prints file creation time when supported by the file system,
  on GNU Linux systems with glibc &gt;= 2.28 and kernel &gt;= 4.11.
- Refresh patches (line number changes only):
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-misc.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * Version: bump version.
  * URL: Use https scheme.
  * %description: Add 'basenc' tool.
  * Change gitweb to cgit URL with https in a comment.
- coreutils.keyring:
  * Update for added section headers ('GPG keys of &lt;MAINTAINER&gt;').</changelog>
  <changelog author="lnussel@suse.de" date="1568894400">- Do not recommend lang package. The lang package already has a
  supplements.</changelog>
  <changelog author="lnussel@suse.de" date="1578571200">- switch to multibuild
- add coreutils-single subpackage that contains a single binary coreutils tool
  similar to busybox
- package LC_CTIME directories also in lang package
- split off doc package
- remove info macros, handled by file trigger nowadays</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1579521600">- minor: remove obsolete comment in spec file.</changelog>
  <changelog author="lnussel@suse.de" date="1580212800">- disable single and testsuite builds in rings/staging
- remove duplicate "coreutils" in flavor to make it look nicer in OBS</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1583755200">- Update to 8.32:
  * Noteworthy changes in release 8.32 (2020-03-05) [stable]
  * * Bug fixes
  cp now copies /dev/fd/N correctly on platforms like Solaris where
  it is a character-special file whose minor device number is N.
  [bug introduced in fileutils-4.1.6]
  dd conv=fdatasync no longer reports a "Bad file descriptor" error
  when fdatasync is interrupted, and dd now retries interrupted calls
  to close, fdatasync, fstat and fsync instead of incorrectly
  reporting an "Interrupted system call" error.
  [bugs introduced in coreutils-6.0]
  df now correctly parses the /proc/self/mountinfo file for unusual entries
  like ones with '\r' in a field value ("mount -t tmpfs tmpfs /foo$'\r'bar"),
  when the source field is empty ('mount -t tmpfs "" /mnt'), and when the
  filesystem type contains characters like a blank which need escaping.
  [bugs introduced in coreutils-8.24 with the introduction of reading
  the /proc/self/mountinfo file]
  factor again outputs immediately when stdout is a tty but stdin is not.
  [bug introduced in coreutils-8.24]
  ln works again on old systems without O_DIRECTORY support (like Solaris 10),
  and on systems where symlink ("x", ".") fails with errno == EINVAL
  (like Solaris 10 and Solaris 11).
  [bug introduced in coreutils-8.31]
  rmdir --ignore-fail-on-non-empty now works correctly for directories
  that fail to be removed due to permission issues.  Previously the exit status
  was reversed, failing for non empty and succeeding for empty directories.
  [bug introduced in coreutils-6.11]
  'shuf -r -n 0 file' no longer mistakenly reads from standard input.
  [bug introduced with the --repeat feature in coreutils-8.22]
  split no longer reports a "output file suffixes exhausted" error
  when the specified number of files is evenly divisible by 10, 16, 26,
  for --numeric, --hex, or default alphabetic suffixes respectively.
  [bug introduced in coreutils-8.24]
  seq no longer prints an extra line under certain circumstances (such as
  'seq -f "%g " 1000000 1000000').
  [bug introduced in coreutils-6.10]
  * * Changes in behavior
  Several programs now check that numbers end properly.  For example,
  'du -d 1x' now reports an error instead of silently ignoring the 'x'.
  Affected programs and options include du -d, expr's numeric operands
  on non-GMP builds, install -g and -o, ls's TABSIZE environment
  variable, mknod b and c, ptx -g and -w, shuf -n, and sort --batch-size
  and --parallel.
  date now parses military time zones in accordance with common usage:
    "A" to "M"  are equivalent to UTC+1 to UTC+12
    "N" to "Y"  are equivalent to UTC-1 to UTC-12
    "Z" is "zulu" time (UTC).
  For example, 'date -d "09:00B" is now equivalent to 9am in UTC+2 time zone.
  Previously, military time zones were parsed according to the obsolete
  rfc822, with their value negated (e.g., "B" was equivalent to UTC-2).
  [The old behavior was introduced in sh-utils 2.0.15 ca. 1999, predating
  coreutils package.]
  ls issues an error message on a removed directory, on GNU/Linux systems.
  Previously no error and no entries were output, and so indistinguishable
  from an empty directory, with default ls options.
  uniq no longer uses strcoll() to determine string equivalence,
  and so will operate more efficiently and consistently.
  * * New Features
  ls now supports the --time=birth option to display and sort by
  file creation time, where available.
  od --skip-bytes now can use lseek even if the input is not a regular
  file, greatly improving performance in some cases.
  stat(1) supports a new --cached= option, used on systems with statx(2)
  to control cache coherency of file system attributes,
  useful on network file systems.
  * * Improvements
  stat and ls now use the statx() system call where available, which can
  operate more efficiently by only retrieving requested attributes.
  stat and tail now know about the "binderfs", "dma-buf-fs", "erofs",
  "ppc-cmm-fs", and "z3fold" file systems.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  * * Build-related
  gzip-compressed tarballs are distributed once again
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-invalid-ids.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils-i18n.patch:
  * uniq: remove collation handling as required by newer POSIX; see
  - https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8e81d44b5
  - https://www.austingroupbugs.net/view.php?id=963
- coreutils-ls-restore-8.31-behavior-on-removed-dirs.patch:
  * Add patch for 'ls' to restore 8.31 behavior on removed directories.
- coreutils.spec:
  * Version: bump version.
  * %check: re-enable regular 'make check' for non-multibuild package.
  * reference the above new patch.
- coreutils.keyring:
  * Update from upstream (Savannah).</changelog>
  <changelog author="dmueller@suse.com" date="1588593600">- add coreutils-use-python3.patch to minimally port away from
  python 2.x use of pyinotify in the testsuite</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1592049600">- coreutils-gnulib-disable-test-float.patch: Add patch to temporarily
  disable the gnulib test 'test-float' failing on ppc and ppc64le.
- coreutils.spec: Reference the patch.  While at it, avoid conditional
  Patch and Source entries as that break cross-platform builds from
  source RPMs.</changelog>
  <changelog author="dimstar@opensuse.org" date="1594900800">- Drop suse-module-tools BuildRequires: this was used for the macro
  regenerate_initrd_post/posttrans, which have been moved to
  rpm-config-SUSE in Jan 2019.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1598875200">- gnulib-test-avoid-FP-perror-strerror.patch: Add patch to
  avoid false-positive error in gnulib tests 'test-perror2' and
  'test-strerror_r', visible on armv7l.
- coreutils.spec: Reference the patch.</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="zpetrova@suse.com" date="1635163200">- coreutils-df-fuse-portal-dummy.patch:
  df: Add "fuse.portal" as a dummy file system (used in flatpak
  implementations). (bsc#1189152)</changelog>
  <changelog author="ailiop@suse.com" date="1706529600">- tail: fix tailing sysfs files where PAGE_SIZE &gt; BUFSIZ (bsc#1219321)
  - add coreutils-tail-fix-tailing-sysfs-files-where-PAGE_SIZE-BUFSIZ.patch</changelog>
  <changelog author="tabraham@suse.com" date="1712059200">- ls: avoid triggering automounts (bsc#1221632)
  - add coreutils-ls-avoid-triggering-automounts.patch</changelog>
</package>
<package pkgid="f926e9b97d825bf362bab843b9cf5755c011aa25dbc6822394fab8413b731010" name="coreutils" arch="s390x">
  <version epoch="0" ver="8.32" rel="150400.9.6.1"/>
  <changelog author="mail@bernhard-voelker.de" date="1493726400">- coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch:
  Add upstream patch to fix an heap overflow security issue
  in date(1) and touch(1) with a large TZ variable
  (CVE-2017-7476, rh#1444774, boo#1037124).</changelog>
  <changelog author="ghe@suse.com" date="1502884800">- Drop coreutils-ocfs2_reflinks.patch
  OCFS2 file system has supported file clone ioctls like btrfs,
  then, coreutils doesn't need this patch from the kernel v4.10-rc1</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1504526400">- Update to 8.28
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.keyring: Update from upstream (Savannah).
- Remove now-upstream patches:
  * coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch
  * coreutils-tests-port-to-timezone-2017a.patch
- coreutils.spec: Add "BuildRequires: user(bin)" for the tests.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1514462400">- Update to 8.29:
  * Noteworthy changes in release 8.29 (2017-12-27) [stable]
  * * Bug fixes
  b2sum no longer crashes when processing certain truncated check files.
  [bug introduced with b2sum coreutils-8.26]
  dd now ensures the correct cache ranges are specified for the "nocache"
  and "direct" flags.  Previously some pages in the page cache were not
  invalidated.  [bug introduced for "direct" in coreutils-7.5,
  and with the "nocache" implementation in coreutils-8.11]
  df no longer hangs when given a fifo argument.
  [bug introduced in coreutils-7.3]
  ptx -S no longer infloops for a pattern which returns zero-length matches.
  [the bug dates back to the initial implementation]
  shred --remove will again repeatedly rename files with shortening names
  to attempt to hide the original length of the file name.
  [bug introduced in coreutils-8.28]
  stty no longer crashes when processing settings with -F also specified.
  [bug introduced in fileutils-4.0]
  tail --bytes again supports non seekable inputs on all systems.
  On systems like android it always tried to process as seekable inputs.
  [bug introduced in coreutils-8.24]
  timeout will again notice its managed command exiting, even when
  invoked with blocked CHLD signal, or in a narrow window where
  this CHLD signal from the exiting child was missed.  In each case
  timeout would have then waited for the time limit to expire.
  [bug introduced in coreutils-8.27]
  * * New features
  timeout now supports the --verbose option to diagnose forced termination.
  * * Improvements
  dd now supports iflag=direct with arbitrary sized files on all file systems.
  tail --bytes=NUM will efficiently seek to the end of block devices,
  rather than reading from the start.
  Utilities which do not support long options (other than the default --help
  and --version), e.g. cksum and sleep, now use more consistent error diagnostic
  for unknown long options.
  * * Build-related
  Default man pages are now distributed which are used if perl is
  not available on the build system, or when cross compiling.
- Refresh patches (line number changes only):
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1530619200">- Update to 8.30:
  * Noteworthy changes in release 8.30 (2018-07-01) [stable]
  * * Bug fixes
  'cp --symlink SRC DST' will again correctly validate DST.
  If DST is a regular file and SRC is a symlink to DST,
  then cp will no longer allow that operation to clobber DST.
  Also with -d, if DST is a symlink, then it can always be replaced,
  even if it points to SRC on a separate device.
  [bugs introduced with coreutils-8.27]
  'cp -n -u' and 'mv -n -u' now consistently ignore the -u option.
  Previously, this option combination suffered from race conditions
  that caused -u to sometimes override -n.
  [bug introduced with coreutils-7.1]
  'cp -a --no-preserve=mode' now sets appropriate default permissions
  for non regular files like fifos and character device nodes etc.,
  and leaves mode bits of existing files unchanged.
  Previously it would have set executable bits on created special files,
  and set mode bits for existing files as if they had been created.
  [bug introduced with coreutils-8.20]
  'cp --remove-destination file symlink' now removes the symlink
  even if it can't be traversed.
  [bug introduced with --remove-destination in fileutils-4.1.1]
  ls no longer truncates the abbreviated month names that have a
  display width between 6 and 12 inclusive.  Previously this would have
  output ambiguous months for Arabic or Catalan locales.
  'ls -aA' is now equivalent to 'ls -A', since -A now overrides -a.
  [bug introduced in coreutils-5.3.0]
  'mv -n A B' no longer suffers from a race condition that can
  overwrite a simultaneously-created B.  This bug fix requires
  platform support for the renameat2 or renameatx_np syscalls, found
  in recent Linux and macOS kernels.  As a side effect, ‘mv -n A A’
  now silently does nothing if A exists.
  [bug introduced with coreutils-7.1]
  * * Changes in behavior
  'cp --force file symlink' now removes the symlink even if
  it is self referential.
  ls --color now matches file extensions case insensitively.
  * * New features
  cp --reflink now supports --reflink=never to enforce a standard copy.
  env supports a new -v/--debug option to show verbose information about
  each processing step.
  env supports a new -S/--split-string=S option to split a single argument
  string into multiple arguments. Used to pass multiple arguments in scripts
  (shebang lines).
  md5sum accepts a new option: --zero (-z) to delimit the output lines with a
  NUL instead of a newline character.  This also disables file name escaping.
  This also applies to sha*sum and b2sum.
  rm --preserve-root now supports the --preserve-root=all option to
  reject any command line argument that is mounted to a separate file system.
  * * Improvements
  cut supports line lengths up to the max file size on 32 bit systems.
  Previously only offsets up to SIZE_MAX-1 were supported.
  stat and tail now know about the "exfs" file system, which is a
  version of XFS.  stat -f --format=%T now reports the file system type,
  and tail -f uses inotify.
  wc avoids redundant processing of ASCII text in multibyte locales,
  which is especially significant on macOS.
  * * Build-related
  Adjust to glibc &gt;= 2.28  (bsc#1182550, jsc#SLE-13520, jsc#SLE-13756)
- Refresh patches (line number changes only):
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * (License): osc changed the value from "GPL-3.0+" to "GPL-3.0-or-later".
  * (build): Make sure that parse-datetime.{c,y} ends up in debuginfo (rh#1555079).
- coreutils-i18n.patch:
  * src/exand.c,src/unexpand.c: Avoid -Wcomment warning.
  * src/cut.c (cut_characters_or_cut_bytes_no_split): Change idx from size_t
    to uintmax_t type to avoid a regression on i586, armv7l and ppc.
    Compare upstream, non-MB commit:
    https://git.sv.gnu.org/cgit/coreutils.git/commit/?id=d1a754c8272
    (cut_fields_mb): Likewise for field_idx.
  * tests/misc/cut.pl: Remove downstream tweaks as upstream MB tests are
    working since a while.
- coreutils.keyring: Update Assaf Gordon's GPG public key.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1552305600">- Update to 8.31:
  * Noteworthy changes in release 8.31 (2019-03-10) [stable]
  * * Bug fixes
  'base64 a b' now correctly diagnoses 'b' as the extra operand, not 'a'.
  [bug introduced in coreutils-5.3.0]
  When B already exists, 'cp -il A B' no longer immediately fails
  after asking the user whether to proceed.
  [This bug was present in "the beginning".]
  df no longer corrupts displayed multibyte characters on macOS.
  [bug introduced with coreutils-8.18]
  seq no longer outputs inconsistent decimal point characters
  for the last number, when locales are misconfigured.
  [bug introduced in coreutils-7.0]
  shred, sort, and split no longer falsely report ftruncate errors
  when outputting to less-common file types.  For example, the shell
  command 'sort /dev/null -o /dev/stdout | cat' no longer fails with
  an "error truncating" diagnostic.
  [bug was introduced with coreutils-8.18 for sort and split, and
  (for shared memory objects only) with fileutils-4.1 for shred]
  sync no longer fails for write-only file arguments.
  [bug introduced with argument support to sync in coreutils-8.24]
  'tail -f file | filter' no longer exits immediately on AIX.
  [bug introduced in coreutils-8.28]
  'tail -f file | filter' no longer goes into an infinite loop
  if filter exits and SIGPIPE is ignored.
  [bug introduced in coreutils-8.28]
  * * Changes in behavior
  cksum, dd, hostid, hostname, link, logname, sleep, tsort, unlink,
  uptime, users, whoami, yes: now always process --help and --version options,
  regardless of any other arguments present before any optional '--'
  end-of-options marker.
  nohup now processes --help and --version as first options even if other
  parameters follow.
  'yes a -- b' now outputs 'a b' instead of including the end-of-options
  marker as before: 'a -- b'.
  echo now always processes backslash escapes when the POSIXLY_CORRECT
  environment variable is set.
  When possible 'ln A B' now merely links A to B and reports an error
  if this fails, instead of statting A and B before linking.  This
  uses fewer system calls and avoids some races.  The old statting
  approach is still used in situations where hard links to directories
  are allowed (e.g., NetBSD when superuser).
  ls --group-directories-first will also group symlinks to directories.
  'test -a FILE' is not supported anymore.  Long ago, there were concerns about
  the high probability of humans confusing the -a primary with the -a binary
  operator, so POSIX changed this to 'test -e FILE'.  Scripts using it were
  already broken and non-portable; the -a unary operator was never documented.
  wc now treats non breaking space characters as word delimiters
  unless the POSIXLY_CORRECT environment variable is set.
  * * New features
  id now supports specifying multiple users.
  'date' now supports the '+' conversion specification flag,
  introduced in POSIX.1-2017.
  printf, seq, sleep, tail, and timeout now accept floating point
  numbers in either the current or the C locale.  For example, if the
  current locale's decimal point is ',', 'sleep 0,1' and 'sleep 0.1'
  now mean the same thing.  Previously, these commands accepted only
  C-locale syntax with '.' as the decimal point.  The new behavior is
  more compatible with other implementations in non-C locales.
  test now supports the '-N FILE' unary operator (like e.g. bash) to check
  whether FILE exists and has been modified since it was last read.
  env now supports '--default-signal[=SIG]', '--ignore-signal[=SIG]', and
  '--block-signal[=SIG], to setup signal handling before executing a program.
  env now supports '--list-signal-handling' to indicate non-default
  signal handling before executing a program.
  * * New commands
  basenc is added to complement existing base64,base32 commands,
  and encodes and decodes printable text using various common encodings:
  base64,base64url,base32,base32hex,base16,base2,z85.
  * * Improvements
  ls -l now better aligns abbreviated months containing digits,
  which is common in Asian locales.
  stat and tail now know about the "sdcardfs" file system on Android.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  stat now prints file creation time when supported by the file system,
  on GNU Linux systems with glibc &gt;= 2.28 and kernel &gt;= 4.11.
- Refresh patches (line number changes only):
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-misc.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * Version: bump version.
  * URL: Use https scheme.
  * %description: Add 'basenc' tool.
  * Change gitweb to cgit URL with https in a comment.
- coreutils.keyring:
  * Update for added section headers ('GPG keys of &lt;MAINTAINER&gt;').</changelog>
  <changelog author="lnussel@suse.de" date="1568894400">- Do not recommend lang package. The lang package already has a
  supplements.</changelog>
  <changelog author="lnussel@suse.de" date="1578571200">- switch to multibuild
- add coreutils-single subpackage that contains a single binary coreutils tool
  similar to busybox
- package LC_CTIME directories also in lang package
- split off doc package
- remove info macros, handled by file trigger nowadays</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1579521600">- minor: remove obsolete comment in spec file.</changelog>
  <changelog author="lnussel@suse.de" date="1580212800">- disable single and testsuite builds in rings/staging
- remove duplicate "coreutils" in flavor to make it look nicer in OBS</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1583755200">- Update to 8.32:
  * Noteworthy changes in release 8.32 (2020-03-05) [stable]
  * * Bug fixes
  cp now copies /dev/fd/N correctly on platforms like Solaris where
  it is a character-special file whose minor device number is N.
  [bug introduced in fileutils-4.1.6]
  dd conv=fdatasync no longer reports a "Bad file descriptor" error
  when fdatasync is interrupted, and dd now retries interrupted calls
  to close, fdatasync, fstat and fsync instead of incorrectly
  reporting an "Interrupted system call" error.
  [bugs introduced in coreutils-6.0]
  df now correctly parses the /proc/self/mountinfo file for unusual entries
  like ones with '\r' in a field value ("mount -t tmpfs tmpfs /foo$'\r'bar"),
  when the source field is empty ('mount -t tmpfs "" /mnt'), and when the
  filesystem type contains characters like a blank which need escaping.
  [bugs introduced in coreutils-8.24 with the introduction of reading
  the /proc/self/mountinfo file]
  factor again outputs immediately when stdout is a tty but stdin is not.
  [bug introduced in coreutils-8.24]
  ln works again on old systems without O_DIRECTORY support (like Solaris 10),
  and on systems where symlink ("x", ".") fails with errno == EINVAL
  (like Solaris 10 and Solaris 11).
  [bug introduced in coreutils-8.31]
  rmdir --ignore-fail-on-non-empty now works correctly for directories
  that fail to be removed due to permission issues.  Previously the exit status
  was reversed, failing for non empty and succeeding for empty directories.
  [bug introduced in coreutils-6.11]
  'shuf -r -n 0 file' no longer mistakenly reads from standard input.
  [bug introduced with the --repeat feature in coreutils-8.22]
  split no longer reports a "output file suffixes exhausted" error
  when the specified number of files is evenly divisible by 10, 16, 26,
  for --numeric, --hex, or default alphabetic suffixes respectively.
  [bug introduced in coreutils-8.24]
  seq no longer prints an extra line under certain circumstances (such as
  'seq -f "%g " 1000000 1000000').
  [bug introduced in coreutils-6.10]
  * * Changes in behavior
  Several programs now check that numbers end properly.  For example,
  'du -d 1x' now reports an error instead of silently ignoring the 'x'.
  Affected programs and options include du -d, expr's numeric operands
  on non-GMP builds, install -g and -o, ls's TABSIZE environment
  variable, mknod b and c, ptx -g and -w, shuf -n, and sort --batch-size
  and --parallel.
  date now parses military time zones in accordance with common usage:
    "A" to "M"  are equivalent to UTC+1 to UTC+12
    "N" to "Y"  are equivalent to UTC-1 to UTC-12
    "Z" is "zulu" time (UTC).
  For example, 'date -d "09:00B" is now equivalent to 9am in UTC+2 time zone.
  Previously, military time zones were parsed according to the obsolete
  rfc822, with their value negated (e.g., "B" was equivalent to UTC-2).
  [The old behavior was introduced in sh-utils 2.0.15 ca. 1999, predating
  coreutils package.]
  ls issues an error message on a removed directory, on GNU/Linux systems.
  Previously no error and no entries were output, and so indistinguishable
  from an empty directory, with default ls options.
  uniq no longer uses strcoll() to determine string equivalence,
  and so will operate more efficiently and consistently.
  * * New Features
  ls now supports the --time=birth option to display and sort by
  file creation time, where available.
  od --skip-bytes now can use lseek even if the input is not a regular
  file, greatly improving performance in some cases.
  stat(1) supports a new --cached= option, used on systems with statx(2)
  to control cache coherency of file system attributes,
  useful on network file systems.
  * * Improvements
  stat and ls now use the statx() system call where available, which can
  operate more efficiently by only retrieving requested attributes.
  stat and tail now know about the "binderfs", "dma-buf-fs", "erofs",
  "ppc-cmm-fs", and "z3fold" file systems.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  * * Build-related
  gzip-compressed tarballs are distributed once again
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-invalid-ids.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils-i18n.patch:
  * uniq: remove collation handling as required by newer POSIX; see
  - https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8e81d44b5
  - https://www.austingroupbugs.net/view.php?id=963
- coreutils-ls-restore-8.31-behavior-on-removed-dirs.patch:
  * Add patch for 'ls' to restore 8.31 behavior on removed directories.
- coreutils.spec:
  * Version: bump version.
  * %check: re-enable regular 'make check' for non-multibuild package.
  * reference the above new patch.
- coreutils.keyring:
  * Update from upstream (Savannah).</changelog>
  <changelog author="dmueller@suse.com" date="1588593600">- add coreutils-use-python3.patch to minimally port away from
  python 2.x use of pyinotify in the testsuite</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1592049600">- coreutils-gnulib-disable-test-float.patch: Add patch to temporarily
  disable the gnulib test 'test-float' failing on ppc and ppc64le.
- coreutils.spec: Reference the patch.  While at it, avoid conditional
  Patch and Source entries as that break cross-platform builds from
  source RPMs.</changelog>
  <changelog author="dimstar@opensuse.org" date="1594900800">- Drop suse-module-tools BuildRequires: this was used for the macro
  regenerate_initrd_post/posttrans, which have been moved to
  rpm-config-SUSE in Jan 2019.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1598875200">- gnulib-test-avoid-FP-perror-strerror.patch: Add patch to
  avoid false-positive error in gnulib tests 'test-perror2' and
  'test-strerror_r', visible on armv7l.
- coreutils.spec: Reference the patch.</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="zpetrova@suse.com" date="1635163200">- coreutils-df-fuse-portal-dummy.patch:
  df: Add "fuse.portal" as a dummy file system (used in flatpak
  implementations). (bsc#1189152)</changelog>
  <changelog author="ailiop@suse.com" date="1706529600">- tail: fix tailing sysfs files where PAGE_SIZE &gt; BUFSIZ (bsc#1219321)
  - add coreutils-tail-fix-tailing-sysfs-files-where-PAGE_SIZE-BUFSIZ.patch</changelog>
  <changelog author="tabraham@suse.com" date="1712059200">- ls: avoid triggering automounts (bsc#1221632)
  - add coreutils-ls-avoid-triggering-automounts.patch</changelog>
</package>
<package pkgid="f81cc4e0f5ea5f5de70095456a020b275b59c0161cf4644e9a889361e5e17290" name="coreutils" arch="src">
  <version epoch="0" ver="8.32" rel="150400.9.6.1"/>
  <changelog author="mail@bernhard-voelker.de" date="1493726400">- coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch:
  Add upstream patch to fix an heap overflow security issue
  in date(1) and touch(1) with a large TZ variable
  (CVE-2017-7476, rh#1444774, boo#1037124).</changelog>
  <changelog author="ghe@suse.com" date="1502884800">- Drop coreutils-ocfs2_reflinks.patch
  OCFS2 file system has supported file clone ioctls like btrfs,
  then, coreutils doesn't need this patch from the kernel v4.10-rc1</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1504526400">- Update to 8.28
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.keyring: Update from upstream (Savannah).
- Remove now-upstream patches:
  * coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch
  * coreutils-tests-port-to-timezone-2017a.patch
- coreutils.spec: Add "BuildRequires: user(bin)" for the tests.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1514462400">- Update to 8.29:
  * Noteworthy changes in release 8.29 (2017-12-27) [stable]
  * * Bug fixes
  b2sum no longer crashes when processing certain truncated check files.
  [bug introduced with b2sum coreutils-8.26]
  dd now ensures the correct cache ranges are specified for the "nocache"
  and "direct" flags.  Previously some pages in the page cache were not
  invalidated.  [bug introduced for "direct" in coreutils-7.5,
  and with the "nocache" implementation in coreutils-8.11]
  df no longer hangs when given a fifo argument.
  [bug introduced in coreutils-7.3]
  ptx -S no longer infloops for a pattern which returns zero-length matches.
  [the bug dates back to the initial implementation]
  shred --remove will again repeatedly rename files with shortening names
  to attempt to hide the original length of the file name.
  [bug introduced in coreutils-8.28]
  stty no longer crashes when processing settings with -F also specified.
  [bug introduced in fileutils-4.0]
  tail --bytes again supports non seekable inputs on all systems.
  On systems like android it always tried to process as seekable inputs.
  [bug introduced in coreutils-8.24]
  timeout will again notice its managed command exiting, even when
  invoked with blocked CHLD signal, or in a narrow window where
  this CHLD signal from the exiting child was missed.  In each case
  timeout would have then waited for the time limit to expire.
  [bug introduced in coreutils-8.27]
  * * New features
  timeout now supports the --verbose option to diagnose forced termination.
  * * Improvements
  dd now supports iflag=direct with arbitrary sized files on all file systems.
  tail --bytes=NUM will efficiently seek to the end of block devices,
  rather than reading from the start.
  Utilities which do not support long options (other than the default --help
  and --version), e.g. cksum and sleep, now use more consistent error diagnostic
  for unknown long options.
  * * Build-related
  Default man pages are now distributed which are used if perl is
  not available on the build system, or when cross compiling.
- Refresh patches (line number changes only):
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1530619200">- Update to 8.30:
  * Noteworthy changes in release 8.30 (2018-07-01) [stable]
  * * Bug fixes
  'cp --symlink SRC DST' will again correctly validate DST.
  If DST is a regular file and SRC is a symlink to DST,
  then cp will no longer allow that operation to clobber DST.
  Also with -d, if DST is a symlink, then it can always be replaced,
  even if it points to SRC on a separate device.
  [bugs introduced with coreutils-8.27]
  'cp -n -u' and 'mv -n -u' now consistently ignore the -u option.
  Previously, this option combination suffered from race conditions
  that caused -u to sometimes override -n.
  [bug introduced with coreutils-7.1]
  'cp -a --no-preserve=mode' now sets appropriate default permissions
  for non regular files like fifos and character device nodes etc.,
  and leaves mode bits of existing files unchanged.
  Previously it would have set executable bits on created special files,
  and set mode bits for existing files as if they had been created.
  [bug introduced with coreutils-8.20]
  'cp --remove-destination file symlink' now removes the symlink
  even if it can't be traversed.
  [bug introduced with --remove-destination in fileutils-4.1.1]
  ls no longer truncates the abbreviated month names that have a
  display width between 6 and 12 inclusive.  Previously this would have
  output ambiguous months for Arabic or Catalan locales.
  'ls -aA' is now equivalent to 'ls -A', since -A now overrides -a.
  [bug introduced in coreutils-5.3.0]
  'mv -n A B' no longer suffers from a race condition that can
  overwrite a simultaneously-created B.  This bug fix requires
  platform support for the renameat2 or renameatx_np syscalls, found
  in recent Linux and macOS kernels.  As a side effect, ‘mv -n A A’
  now silently does nothing if A exists.
  [bug introduced with coreutils-7.1]
  * * Changes in behavior
  'cp --force file symlink' now removes the symlink even if
  it is self referential.
  ls --color now matches file extensions case insensitively.
  * * New features
  cp --reflink now supports --reflink=never to enforce a standard copy.
  env supports a new -v/--debug option to show verbose information about
  each processing step.
  env supports a new -S/--split-string=S option to split a single argument
  string into multiple arguments. Used to pass multiple arguments in scripts
  (shebang lines).
  md5sum accepts a new option: --zero (-z) to delimit the output lines with a
  NUL instead of a newline character.  This also disables file name escaping.
  This also applies to sha*sum and b2sum.
  rm --preserve-root now supports the --preserve-root=all option to
  reject any command line argument that is mounted to a separate file system.
  * * Improvements
  cut supports line lengths up to the max file size on 32 bit systems.
  Previously only offsets up to SIZE_MAX-1 were supported.
  stat and tail now know about the "exfs" file system, which is a
  version of XFS.  stat -f --format=%T now reports the file system type,
  and tail -f uses inotify.
  wc avoids redundant processing of ASCII text in multibyte locales,
  which is especially significant on macOS.
  * * Build-related
  Adjust to glibc &gt;= 2.28  (bsc#1182550, jsc#SLE-13520, jsc#SLE-13756)
- Refresh patches (line number changes only):
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * (License): osc changed the value from "GPL-3.0+" to "GPL-3.0-or-later".
  * (build): Make sure that parse-datetime.{c,y} ends up in debuginfo (rh#1555079).
- coreutils-i18n.patch:
  * src/exand.c,src/unexpand.c: Avoid -Wcomment warning.
  * src/cut.c (cut_characters_or_cut_bytes_no_split): Change idx from size_t
    to uintmax_t type to avoid a regression on i586, armv7l and ppc.
    Compare upstream, non-MB commit:
    https://git.sv.gnu.org/cgit/coreutils.git/commit/?id=d1a754c8272
    (cut_fields_mb): Likewise for field_idx.
  * tests/misc/cut.pl: Remove downstream tweaks as upstream MB tests are
    working since a while.
- coreutils.keyring: Update Assaf Gordon's GPG public key.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1552305600">- Update to 8.31:
  * Noteworthy changes in release 8.31 (2019-03-10) [stable]
  * * Bug fixes
  'base64 a b' now correctly diagnoses 'b' as the extra operand, not 'a'.
  [bug introduced in coreutils-5.3.0]
  When B already exists, 'cp -il A B' no longer immediately fails
  after asking the user whether to proceed.
  [This bug was present in "the beginning".]
  df no longer corrupts displayed multibyte characters on macOS.
  [bug introduced with coreutils-8.18]
  seq no longer outputs inconsistent decimal point characters
  for the last number, when locales are misconfigured.
  [bug introduced in coreutils-7.0]
  shred, sort, and split no longer falsely report ftruncate errors
  when outputting to less-common file types.  For example, the shell
  command 'sort /dev/null -o /dev/stdout | cat' no longer fails with
  an "error truncating" diagnostic.
  [bug was introduced with coreutils-8.18 for sort and split, and
  (for shared memory objects only) with fileutils-4.1 for shred]
  sync no longer fails for write-only file arguments.
  [bug introduced with argument support to sync in coreutils-8.24]
  'tail -f file | filter' no longer exits immediately on AIX.
  [bug introduced in coreutils-8.28]
  'tail -f file | filter' no longer goes into an infinite loop
  if filter exits and SIGPIPE is ignored.
  [bug introduced in coreutils-8.28]
  * * Changes in behavior
  cksum, dd, hostid, hostname, link, logname, sleep, tsort, unlink,
  uptime, users, whoami, yes: now always process --help and --version options,
  regardless of any other arguments present before any optional '--'
  end-of-options marker.
  nohup now processes --help and --version as first options even if other
  parameters follow.
  'yes a -- b' now outputs 'a b' instead of including the end-of-options
  marker as before: 'a -- b'.
  echo now always processes backslash escapes when the POSIXLY_CORRECT
  environment variable is set.
  When possible 'ln A B' now merely links A to B and reports an error
  if this fails, instead of statting A and B before linking.  This
  uses fewer system calls and avoids some races.  The old statting
  approach is still used in situations where hard links to directories
  are allowed (e.g., NetBSD when superuser).
  ls --group-directories-first will also group symlinks to directories.
  'test -a FILE' is not supported anymore.  Long ago, there were concerns about
  the high probability of humans confusing the -a primary with the -a binary
  operator, so POSIX changed this to 'test -e FILE'.  Scripts using it were
  already broken and non-portable; the -a unary operator was never documented.
  wc now treats non breaking space characters as word delimiters
  unless the POSIXLY_CORRECT environment variable is set.
  * * New features
  id now supports specifying multiple users.
  'date' now supports the '+' conversion specification flag,
  introduced in POSIX.1-2017.
  printf, seq, sleep, tail, and timeout now accept floating point
  numbers in either the current or the C locale.  For example, if the
  current locale's decimal point is ',', 'sleep 0,1' and 'sleep 0.1'
  now mean the same thing.  Previously, these commands accepted only
  C-locale syntax with '.' as the decimal point.  The new behavior is
  more compatible with other implementations in non-C locales.
  test now supports the '-N FILE' unary operator (like e.g. bash) to check
  whether FILE exists and has been modified since it was last read.
  env now supports '--default-signal[=SIG]', '--ignore-signal[=SIG]', and
  '--block-signal[=SIG], to setup signal handling before executing a program.
  env now supports '--list-signal-handling' to indicate non-default
  signal handling before executing a program.
  * * New commands
  basenc is added to complement existing base64,base32 commands,
  and encodes and decodes printable text using various common encodings:
  base64,base64url,base32,base32hex,base16,base2,z85.
  * * Improvements
  ls -l now better aligns abbreviated months containing digits,
  which is common in Asian locales.
  stat and tail now know about the "sdcardfs" file system on Android.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  stat now prints file creation time when supported by the file system,
  on GNU Linux systems with glibc &gt;= 2.28 and kernel &gt;= 4.11.
- Refresh patches (line number changes only):
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-misc.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * Version: bump version.
  * URL: Use https scheme.
  * %description: Add 'basenc' tool.
  * Change gitweb to cgit URL with https in a comment.
- coreutils.keyring:
  * Update for added section headers ('GPG keys of &lt;MAINTAINER&gt;').</changelog>
  <changelog author="lnussel@suse.de" date="1568894400">- Do not recommend lang package. The lang package already has a
  supplements.</changelog>
  <changelog author="lnussel@suse.de" date="1578571200">- switch to multibuild
- add coreutils-single subpackage that contains a single binary coreutils tool
  similar to busybox
- package LC_CTIME directories also in lang package
- split off doc package
- remove info macros, handled by file trigger nowadays</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1579521600">- minor: remove obsolete comment in spec file.</changelog>
  <changelog author="lnussel@suse.de" date="1580212800">- disable single and testsuite builds in rings/staging
- remove duplicate "coreutils" in flavor to make it look nicer in OBS</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1583755200">- Update to 8.32:
  * Noteworthy changes in release 8.32 (2020-03-05) [stable]
  * * Bug fixes
  cp now copies /dev/fd/N correctly on platforms like Solaris where
  it is a character-special file whose minor device number is N.
  [bug introduced in fileutils-4.1.6]
  dd conv=fdatasync no longer reports a "Bad file descriptor" error
  when fdatasync is interrupted, and dd now retries interrupted calls
  to close, fdatasync, fstat and fsync instead of incorrectly
  reporting an "Interrupted system call" error.
  [bugs introduced in coreutils-6.0]
  df now correctly parses the /proc/self/mountinfo file for unusual entries
  like ones with '\r' in a field value ("mount -t tmpfs tmpfs /foo$'\r'bar"),
  when the source field is empty ('mount -t tmpfs "" /mnt'), and when the
  filesystem type contains characters like a blank which need escaping.
  [bugs introduced in coreutils-8.24 with the introduction of reading
  the /proc/self/mountinfo file]
  factor again outputs immediately when stdout is a tty but stdin is not.
  [bug introduced in coreutils-8.24]
  ln works again on old systems without O_DIRECTORY support (like Solaris 10),
  and on systems where symlink ("x", ".") fails with errno == EINVAL
  (like Solaris 10 and Solaris 11).
  [bug introduced in coreutils-8.31]
  rmdir --ignore-fail-on-non-empty now works correctly for directories
  that fail to be removed due to permission issues.  Previously the exit status
  was reversed, failing for non empty and succeeding for empty directories.
  [bug introduced in coreutils-6.11]
  'shuf -r -n 0 file' no longer mistakenly reads from standard input.
  [bug introduced with the --repeat feature in coreutils-8.22]
  split no longer reports a "output file suffixes exhausted" error
  when the specified number of files is evenly divisible by 10, 16, 26,
  for --numeric, --hex, or default alphabetic suffixes respectively.
  [bug introduced in coreutils-8.24]
  seq no longer prints an extra line under certain circumstances (such as
  'seq -f "%g " 1000000 1000000').
  [bug introduced in coreutils-6.10]
  * * Changes in behavior
  Several programs now check that numbers end properly.  For example,
  'du -d 1x' now reports an error instead of silently ignoring the 'x'.
  Affected programs and options include du -d, expr's numeric operands
  on non-GMP builds, install -g and -o, ls's TABSIZE environment
  variable, mknod b and c, ptx -g and -w, shuf -n, and sort --batch-size
  and --parallel.
  date now parses military time zones in accordance with common usage:
    "A" to "M"  are equivalent to UTC+1 to UTC+12
    "N" to "Y"  are equivalent to UTC-1 to UTC-12
    "Z" is "zulu" time (UTC).
  For example, 'date -d "09:00B" is now equivalent to 9am in UTC+2 time zone.
  Previously, military time zones were parsed according to the obsolete
  rfc822, with their value negated (e.g., "B" was equivalent to UTC-2).
  [The old behavior was introduced in sh-utils 2.0.15 ca. 1999, predating
  coreutils package.]
  ls issues an error message on a removed directory, on GNU/Linux systems.
  Previously no error and no entries were output, and so indistinguishable
  from an empty directory, with default ls options.
  uniq no longer uses strcoll() to determine string equivalence,
  and so will operate more efficiently and consistently.
  * * New Features
  ls now supports the --time=birth option to display and sort by
  file creation time, where available.
  od --skip-bytes now can use lseek even if the input is not a regular
  file, greatly improving performance in some cases.
  stat(1) supports a new --cached= option, used on systems with statx(2)
  to control cache coherency of file system attributes,
  useful on network file systems.
  * * Improvements
  stat and ls now use the statx() system call where available, which can
  operate more efficiently by only retrieving requested attributes.
  stat and tail now know about the "binderfs", "dma-buf-fs", "erofs",
  "ppc-cmm-fs", and "z3fold" file systems.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  * * Build-related
  gzip-compressed tarballs are distributed once again
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-invalid-ids.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils-i18n.patch:
  * uniq: remove collation handling as required by newer POSIX; see
  - https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8e81d44b5
  - https://www.austingroupbugs.net/view.php?id=963
- coreutils-ls-restore-8.31-behavior-on-removed-dirs.patch:
  * Add patch for 'ls' to restore 8.31 behavior on removed directories.
- coreutils.spec:
  * Version: bump version.
  * %check: re-enable regular 'make check' for non-multibuild package.
  * reference the above new patch.
- coreutils.keyring:
  * Update from upstream (Savannah).</changelog>
  <changelog author="dmueller@suse.com" date="1588593600">- add coreutils-use-python3.patch to minimally port away from
  python 2.x use of pyinotify in the testsuite</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1592049600">- coreutils-gnulib-disable-test-float.patch: Add patch to temporarily
  disable the gnulib test 'test-float' failing on ppc and ppc64le.
- coreutils.spec: Reference the patch.  While at it, avoid conditional
  Patch and Source entries as that break cross-platform builds from
  source RPMs.</changelog>
  <changelog author="dimstar@opensuse.org" date="1594900800">- Drop suse-module-tools BuildRequires: this was used for the macro
  regenerate_initrd_post/posttrans, which have been moved to
  rpm-config-SUSE in Jan 2019.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1598875200">- gnulib-test-avoid-FP-perror-strerror.patch: Add patch to
  avoid false-positive error in gnulib tests 'test-perror2' and
  'test-strerror_r', visible on armv7l.
- coreutils.spec: Reference the patch.</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="zpetrova@suse.com" date="1635163200">- coreutils-df-fuse-portal-dummy.patch:
  df: Add "fuse.portal" as a dummy file system (used in flatpak
  implementations). (bsc#1189152)</changelog>
  <changelog author="ailiop@suse.com" date="1706529600">- tail: fix tailing sysfs files where PAGE_SIZE &gt; BUFSIZ (bsc#1219321)
  - add coreutils-tail-fix-tailing-sysfs-files-where-PAGE_SIZE-BUFSIZ.patch</changelog>
  <changelog author="tabraham@suse.com" date="1712059200">- ls: avoid triggering automounts (bsc#1221632)
  - add coreutils-ls-avoid-triggering-automounts.patch</changelog>
</package>
<package pkgid="e22285e41ab6361c1368ecbacea6be3ca9fae0947af4abebf73d5a876c47693d" name="coreutils" arch="x86_64">
  <version epoch="0" ver="8.32" rel="150400.9.6.1"/>
  <changelog author="mail@bernhard-voelker.de" date="1493726400">- coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch:
  Add upstream patch to fix an heap overflow security issue
  in date(1) and touch(1) with a large TZ variable
  (CVE-2017-7476, rh#1444774, boo#1037124).</changelog>
  <changelog author="ghe@suse.com" date="1502884800">- Drop coreutils-ocfs2_reflinks.patch
  OCFS2 file system has supported file clone ioctls like btrfs,
  then, coreutils doesn't need this patch from the kernel v4.10-rc1</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1504526400">- Update to 8.28
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.keyring: Update from upstream (Savannah).
- Remove now-upstream patches:
  * coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch
  * coreutils-tests-port-to-timezone-2017a.patch
- coreutils.spec: Add "BuildRequires: user(bin)" for the tests.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1514462400">- Update to 8.29:
  * Noteworthy changes in release 8.29 (2017-12-27) [stable]
  * * Bug fixes
  b2sum no longer crashes when processing certain truncated check files.
  [bug introduced with b2sum coreutils-8.26]
  dd now ensures the correct cache ranges are specified for the "nocache"
  and "direct" flags.  Previously some pages in the page cache were not
  invalidated.  [bug introduced for "direct" in coreutils-7.5,
  and with the "nocache" implementation in coreutils-8.11]
  df no longer hangs when given a fifo argument.
  [bug introduced in coreutils-7.3]
  ptx -S no longer infloops for a pattern which returns zero-length matches.
  [the bug dates back to the initial implementation]
  shred --remove will again repeatedly rename files with shortening names
  to attempt to hide the original length of the file name.
  [bug introduced in coreutils-8.28]
  stty no longer crashes when processing settings with -F also specified.
  [bug introduced in fileutils-4.0]
  tail --bytes again supports non seekable inputs on all systems.
  On systems like android it always tried to process as seekable inputs.
  [bug introduced in coreutils-8.24]
  timeout will again notice its managed command exiting, even when
  invoked with blocked CHLD signal, or in a narrow window where
  this CHLD signal from the exiting child was missed.  In each case
  timeout would have then waited for the time limit to expire.
  [bug introduced in coreutils-8.27]
  * * New features
  timeout now supports the --verbose option to diagnose forced termination.
  * * Improvements
  dd now supports iflag=direct with arbitrary sized files on all file systems.
  tail --bytes=NUM will efficiently seek to the end of block devices,
  rather than reading from the start.
  Utilities which do not support long options (other than the default --help
  and --version), e.g. cksum and sleep, now use more consistent error diagnostic
  for unknown long options.
  * * Build-related
  Default man pages are now distributed which are used if perl is
  not available on the build system, or when cross compiling.
- Refresh patches (line number changes only):
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1530619200">- Update to 8.30:
  * Noteworthy changes in release 8.30 (2018-07-01) [stable]
  * * Bug fixes
  'cp --symlink SRC DST' will again correctly validate DST.
  If DST is a regular file and SRC is a symlink to DST,
  then cp will no longer allow that operation to clobber DST.
  Also with -d, if DST is a symlink, then it can always be replaced,
  even if it points to SRC on a separate device.
  [bugs introduced with coreutils-8.27]
  'cp -n -u' and 'mv -n -u' now consistently ignore the -u option.
  Previously, this option combination suffered from race conditions
  that caused -u to sometimes override -n.
  [bug introduced with coreutils-7.1]
  'cp -a --no-preserve=mode' now sets appropriate default permissions
  for non regular files like fifos and character device nodes etc.,
  and leaves mode bits of existing files unchanged.
  Previously it would have set executable bits on created special files,
  and set mode bits for existing files as if they had been created.
  [bug introduced with coreutils-8.20]
  'cp --remove-destination file symlink' now removes the symlink
  even if it can't be traversed.
  [bug introduced with --remove-destination in fileutils-4.1.1]
  ls no longer truncates the abbreviated month names that have a
  display width between 6 and 12 inclusive.  Previously this would have
  output ambiguous months for Arabic or Catalan locales.
  'ls -aA' is now equivalent to 'ls -A', since -A now overrides -a.
  [bug introduced in coreutils-5.3.0]
  'mv -n A B' no longer suffers from a race condition that can
  overwrite a simultaneously-created B.  This bug fix requires
  platform support for the renameat2 or renameatx_np syscalls, found
  in recent Linux and macOS kernels.  As a side effect, ‘mv -n A A’
  now silently does nothing if A exists.
  [bug introduced with coreutils-7.1]
  * * Changes in behavior
  'cp --force file symlink' now removes the symlink even if
  it is self referential.
  ls --color now matches file extensions case insensitively.
  * * New features
  cp --reflink now supports --reflink=never to enforce a standard copy.
  env supports a new -v/--debug option to show verbose information about
  each processing step.
  env supports a new -S/--split-string=S option to split a single argument
  string into multiple arguments. Used to pass multiple arguments in scripts
  (shebang lines).
  md5sum accepts a new option: --zero (-z) to delimit the output lines with a
  NUL instead of a newline character.  This also disables file name escaping.
  This also applies to sha*sum and b2sum.
  rm --preserve-root now supports the --preserve-root=all option to
  reject any command line argument that is mounted to a separate file system.
  * * Improvements
  cut supports line lengths up to the max file size on 32 bit systems.
  Previously only offsets up to SIZE_MAX-1 were supported.
  stat and tail now know about the "exfs" file system, which is a
  version of XFS.  stat -f --format=%T now reports the file system type,
  and tail -f uses inotify.
  wc avoids redundant processing of ASCII text in multibyte locales,
  which is especially significant on macOS.
  * * Build-related
  Adjust to glibc &gt;= 2.28  (bsc#1182550, jsc#SLE-13520, jsc#SLE-13756)
- Refresh patches (line number changes only):
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * (License): osc changed the value from "GPL-3.0+" to "GPL-3.0-or-later".
  * (build): Make sure that parse-datetime.{c,y} ends up in debuginfo (rh#1555079).
- coreutils-i18n.patch:
  * src/exand.c,src/unexpand.c: Avoid -Wcomment warning.
  * src/cut.c (cut_characters_or_cut_bytes_no_split): Change idx from size_t
    to uintmax_t type to avoid a regression on i586, armv7l and ppc.
    Compare upstream, non-MB commit:
    https://git.sv.gnu.org/cgit/coreutils.git/commit/?id=d1a754c8272
    (cut_fields_mb): Likewise for field_idx.
  * tests/misc/cut.pl: Remove downstream tweaks as upstream MB tests are
    working since a while.
- coreutils.keyring: Update Assaf Gordon's GPG public key.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1552305600">- Update to 8.31:
  * Noteworthy changes in release 8.31 (2019-03-10) [stable]
  * * Bug fixes
  'base64 a b' now correctly diagnoses 'b' as the extra operand, not 'a'.
  [bug introduced in coreutils-5.3.0]
  When B already exists, 'cp -il A B' no longer immediately fails
  after asking the user whether to proceed.
  [This bug was present in "the beginning".]
  df no longer corrupts displayed multibyte characters on macOS.
  [bug introduced with coreutils-8.18]
  seq no longer outputs inconsistent decimal point characters
  for the last number, when locales are misconfigured.
  [bug introduced in coreutils-7.0]
  shred, sort, and split no longer falsely report ftruncate errors
  when outputting to less-common file types.  For example, the shell
  command 'sort /dev/null -o /dev/stdout | cat' no longer fails with
  an "error truncating" diagnostic.
  [bug was introduced with coreutils-8.18 for sort and split, and
  (for shared memory objects only) with fileutils-4.1 for shred]
  sync no longer fails for write-only file arguments.
  [bug introduced with argument support to sync in coreutils-8.24]
  'tail -f file | filter' no longer exits immediately on AIX.
  [bug introduced in coreutils-8.28]
  'tail -f file | filter' no longer goes into an infinite loop
  if filter exits and SIGPIPE is ignored.
  [bug introduced in coreutils-8.28]
  * * Changes in behavior
  cksum, dd, hostid, hostname, link, logname, sleep, tsort, unlink,
  uptime, users, whoami, yes: now always process --help and --version options,
  regardless of any other arguments present before any optional '--'
  end-of-options marker.
  nohup now processes --help and --version as first options even if other
  parameters follow.
  'yes a -- b' now outputs 'a b' instead of including the end-of-options
  marker as before: 'a -- b'.
  echo now always processes backslash escapes when the POSIXLY_CORRECT
  environment variable is set.
  When possible 'ln A B' now merely links A to B and reports an error
  if this fails, instead of statting A and B before linking.  This
  uses fewer system calls and avoids some races.  The old statting
  approach is still used in situations where hard links to directories
  are allowed (e.g., NetBSD when superuser).
  ls --group-directories-first will also group symlinks to directories.
  'test -a FILE' is not supported anymore.  Long ago, there were concerns about
  the high probability of humans confusing the -a primary with the -a binary
  operator, so POSIX changed this to 'test -e FILE'.  Scripts using it were
  already broken and non-portable; the -a unary operator was never documented.
  wc now treats non breaking space characters as word delimiters
  unless the POSIXLY_CORRECT environment variable is set.
  * * New features
  id now supports specifying multiple users.
  'date' now supports the '+' conversion specification flag,
  introduced in POSIX.1-2017.
  printf, seq, sleep, tail, and timeout now accept floating point
  numbers in either the current or the C locale.  For example, if the
  current locale's decimal point is ',', 'sleep 0,1' and 'sleep 0.1'
  now mean the same thing.  Previously, these commands accepted only
  C-locale syntax with '.' as the decimal point.  The new behavior is
  more compatible with other implementations in non-C locales.
  test now supports the '-N FILE' unary operator (like e.g. bash) to check
  whether FILE exists and has been modified since it was last read.
  env now supports '--default-signal[=SIG]', '--ignore-signal[=SIG]', and
  '--block-signal[=SIG], to setup signal handling before executing a program.
  env now supports '--list-signal-handling' to indicate non-default
  signal handling before executing a program.
  * * New commands
  basenc is added to complement existing base64,base32 commands,
  and encodes and decodes printable text using various common encodings:
  base64,base64url,base32,base32hex,base16,base2,z85.
  * * Improvements
  ls -l now better aligns abbreviated months containing digits,
  which is common in Asian locales.
  stat and tail now know about the "sdcardfs" file system on Android.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  stat now prints file creation time when supported by the file system,
  on GNU Linux systems with glibc &gt;= 2.28 and kernel &gt;= 4.11.
- Refresh patches (line number changes only):
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-misc.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * Version: bump version.
  * URL: Use https scheme.
  * %description: Add 'basenc' tool.
  * Change gitweb to cgit URL with https in a comment.
- coreutils.keyring:
  * Update for added section headers ('GPG keys of &lt;MAINTAINER&gt;').</changelog>
  <changelog author="lnussel@suse.de" date="1568894400">- Do not recommend lang package. The lang package already has a
  supplements.</changelog>
  <changelog author="lnussel@suse.de" date="1578571200">- switch to multibuild
- add coreutils-single subpackage that contains a single binary coreutils tool
  similar to busybox
- package LC_CTIME directories also in lang package
- split off doc package
- remove info macros, handled by file trigger nowadays</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1579521600">- minor: remove obsolete comment in spec file.</changelog>
  <changelog author="lnussel@suse.de" date="1580212800">- disable single and testsuite builds in rings/staging
- remove duplicate "coreutils" in flavor to make it look nicer in OBS</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1583755200">- Update to 8.32:
  * Noteworthy changes in release 8.32 (2020-03-05) [stable]
  * * Bug fixes
  cp now copies /dev/fd/N correctly on platforms like Solaris where
  it is a character-special file whose minor device number is N.
  [bug introduced in fileutils-4.1.6]
  dd conv=fdatasync no longer reports a "Bad file descriptor" error
  when fdatasync is interrupted, and dd now retries interrupted calls
  to close, fdatasync, fstat and fsync instead of incorrectly
  reporting an "Interrupted system call" error.
  [bugs introduced in coreutils-6.0]
  df now correctly parses the /proc/self/mountinfo file for unusual entries
  like ones with '\r' in a field value ("mount -t tmpfs tmpfs /foo$'\r'bar"),
  when the source field is empty ('mount -t tmpfs "" /mnt'), and when the
  filesystem type contains characters like a blank which need escaping.
  [bugs introduced in coreutils-8.24 with the introduction of reading
  the /proc/self/mountinfo file]
  factor again outputs immediately when stdout is a tty but stdin is not.
  [bug introduced in coreutils-8.24]
  ln works again on old systems without O_DIRECTORY support (like Solaris 10),
  and on systems where symlink ("x", ".") fails with errno == EINVAL
  (like Solaris 10 and Solaris 11).
  [bug introduced in coreutils-8.31]
  rmdir --ignore-fail-on-non-empty now works correctly for directories
  that fail to be removed due to permission issues.  Previously the exit status
  was reversed, failing for non empty and succeeding for empty directories.
  [bug introduced in coreutils-6.11]
  'shuf -r -n 0 file' no longer mistakenly reads from standard input.
  [bug introduced with the --repeat feature in coreutils-8.22]
  split no longer reports a "output file suffixes exhausted" error
  when the specified number of files is evenly divisible by 10, 16, 26,
  for --numeric, --hex, or default alphabetic suffixes respectively.
  [bug introduced in coreutils-8.24]
  seq no longer prints an extra line under certain circumstances (such as
  'seq -f "%g " 1000000 1000000').
  [bug introduced in coreutils-6.10]
  * * Changes in behavior
  Several programs now check that numbers end properly.  For example,
  'du -d 1x' now reports an error instead of silently ignoring the 'x'.
  Affected programs and options include du -d, expr's numeric operands
  on non-GMP builds, install -g and -o, ls's TABSIZE environment
  variable, mknod b and c, ptx -g and -w, shuf -n, and sort --batch-size
  and --parallel.
  date now parses military time zones in accordance with common usage:
    "A" to "M"  are equivalent to UTC+1 to UTC+12
    "N" to "Y"  are equivalent to UTC-1 to UTC-12
    "Z" is "zulu" time (UTC).
  For example, 'date -d "09:00B" is now equivalent to 9am in UTC+2 time zone.
  Previously, military time zones were parsed according to the obsolete
  rfc822, with their value negated (e.g., "B" was equivalent to UTC-2).
  [The old behavior was introduced in sh-utils 2.0.15 ca. 1999, predating
  coreutils package.]
  ls issues an error message on a removed directory, on GNU/Linux systems.
  Previously no error and no entries were output, and so indistinguishable
  from an empty directory, with default ls options.
  uniq no longer uses strcoll() to determine string equivalence,
  and so will operate more efficiently and consistently.
  * * New Features
  ls now supports the --time=birth option to display and sort by
  file creation time, where available.
  od --skip-bytes now can use lseek even if the input is not a regular
  file, greatly improving performance in some cases.
  stat(1) supports a new --cached= option, used on systems with statx(2)
  to control cache coherency of file system attributes,
  useful on network file systems.
  * * Improvements
  stat and ls now use the statx() system call where available, which can
  operate more efficiently by only retrieving requested attributes.
  stat and tail now know about the "binderfs", "dma-buf-fs", "erofs",
  "ppc-cmm-fs", and "z3fold" file systems.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  * * Build-related
  gzip-compressed tarballs are distributed once again
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-invalid-ids.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils-i18n.patch:
  * uniq: remove collation handling as required by newer POSIX; see
  - https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8e81d44b5
  - https://www.austingroupbugs.net/view.php?id=963
- coreutils-ls-restore-8.31-behavior-on-removed-dirs.patch:
  * Add patch for 'ls' to restore 8.31 behavior on removed directories.
- coreutils.spec:
  * Version: bump version.
  * %check: re-enable regular 'make check' for non-multibuild package.
  * reference the above new patch.
- coreutils.keyring:
  * Update from upstream (Savannah).</changelog>
  <changelog author="dmueller@suse.com" date="1588593600">- add coreutils-use-python3.patch to minimally port away from
  python 2.x use of pyinotify in the testsuite</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1592049600">- coreutils-gnulib-disable-test-float.patch: Add patch to temporarily
  disable the gnulib test 'test-float' failing on ppc and ppc64le.
- coreutils.spec: Reference the patch.  While at it, avoid conditional
  Patch and Source entries as that break cross-platform builds from
  source RPMs.</changelog>
  <changelog author="dimstar@opensuse.org" date="1594900800">- Drop suse-module-tools BuildRequires: this was used for the macro
  regenerate_initrd_post/posttrans, which have been moved to
  rpm-config-SUSE in Jan 2019.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1598875200">- gnulib-test-avoid-FP-perror-strerror.patch: Add patch to
  avoid false-positive error in gnulib tests 'test-perror2' and
  'test-strerror_r', visible on armv7l.
- coreutils.spec: Reference the patch.</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="zpetrova@suse.com" date="1635163200">- coreutils-df-fuse-portal-dummy.patch:
  df: Add "fuse.portal" as a dummy file system (used in flatpak
  implementations). (bsc#1189152)</changelog>
  <changelog author="ailiop@suse.com" date="1706529600">- tail: fix tailing sysfs files where PAGE_SIZE &gt; BUFSIZ (bsc#1219321)
  - add coreutils-tail-fix-tailing-sysfs-files-where-PAGE_SIZE-BUFSIZ.patch</changelog>
  <changelog author="tabraham@suse.com" date="1712059200">- ls: avoid triggering automounts (bsc#1221632)
  - add coreutils-ls-avoid-triggering-automounts.patch</changelog>
</package>
<package pkgid="eebd3022420daad6fe67c24d067245041c6ae5c114012a62b5aa899642cca44b" name="coreutils-doc" arch="noarch">
  <version epoch="0" ver="8.32" rel="150400.9.6.1"/>
  <changelog author="mail@bernhard-voelker.de" date="1493726400">- coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch:
  Add upstream patch to fix an heap overflow security issue
  in date(1) and touch(1) with a large TZ variable
  (CVE-2017-7476, rh#1444774, boo#1037124).</changelog>
  <changelog author="ghe@suse.com" date="1502884800">- Drop coreutils-ocfs2_reflinks.patch
  OCFS2 file system has supported file clone ioctls like btrfs,
  then, coreutils doesn't need this patch from the kernel v4.10-rc1</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1504526400">- Update to 8.28
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.keyring: Update from upstream (Savannah).
- Remove now-upstream patches:
  * coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch
  * coreutils-tests-port-to-timezone-2017a.patch
- coreutils.spec: Add "BuildRequires: user(bin)" for the tests.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1514462400">- Update to 8.29:
  * Noteworthy changes in release 8.29 (2017-12-27) [stable]
  * * Bug fixes
  b2sum no longer crashes when processing certain truncated check files.
  [bug introduced with b2sum coreutils-8.26]
  dd now ensures the correct cache ranges are specified for the "nocache"
  and "direct" flags.  Previously some pages in the page cache were not
  invalidated.  [bug introduced for "direct" in coreutils-7.5,
  and with the "nocache" implementation in coreutils-8.11]
  df no longer hangs when given a fifo argument.
  [bug introduced in coreutils-7.3]
  ptx -S no longer infloops for a pattern which returns zero-length matches.
  [the bug dates back to the initial implementation]
  shred --remove will again repeatedly rename files with shortening names
  to attempt to hide the original length of the file name.
  [bug introduced in coreutils-8.28]
  stty no longer crashes when processing settings with -F also specified.
  [bug introduced in fileutils-4.0]
  tail --bytes again supports non seekable inputs on all systems.
  On systems like android it always tried to process as seekable inputs.
  [bug introduced in coreutils-8.24]
  timeout will again notice its managed command exiting, even when
  invoked with blocked CHLD signal, or in a narrow window where
  this CHLD signal from the exiting child was missed.  In each case
  timeout would have then waited for the time limit to expire.
  [bug introduced in coreutils-8.27]
  * * New features
  timeout now supports the --verbose option to diagnose forced termination.
  * * Improvements
  dd now supports iflag=direct with arbitrary sized files on all file systems.
  tail --bytes=NUM will efficiently seek to the end of block devices,
  rather than reading from the start.
  Utilities which do not support long options (other than the default --help
  and --version), e.g. cksum and sleep, now use more consistent error diagnostic
  for unknown long options.
  * * Build-related
  Default man pages are now distributed which are used if perl is
  not available on the build system, or when cross compiling.
- Refresh patches (line number changes only):
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1530619200">- Update to 8.30:
  * Noteworthy changes in release 8.30 (2018-07-01) [stable]
  * * Bug fixes
  'cp --symlink SRC DST' will again correctly validate DST.
  If DST is a regular file and SRC is a symlink to DST,
  then cp will no longer allow that operation to clobber DST.
  Also with -d, if DST is a symlink, then it can always be replaced,
  even if it points to SRC on a separate device.
  [bugs introduced with coreutils-8.27]
  'cp -n -u' and 'mv -n -u' now consistently ignore the -u option.
  Previously, this option combination suffered from race conditions
  that caused -u to sometimes override -n.
  [bug introduced with coreutils-7.1]
  'cp -a --no-preserve=mode' now sets appropriate default permissions
  for non regular files like fifos and character device nodes etc.,
  and leaves mode bits of existing files unchanged.
  Previously it would have set executable bits on created special files,
  and set mode bits for existing files as if they had been created.
  [bug introduced with coreutils-8.20]
  'cp --remove-destination file symlink' now removes the symlink
  even if it can't be traversed.
  [bug introduced with --remove-destination in fileutils-4.1.1]
  ls no longer truncates the abbreviated month names that have a
  display width between 6 and 12 inclusive.  Previously this would have
  output ambiguous months for Arabic or Catalan locales.
  'ls -aA' is now equivalent to 'ls -A', since -A now overrides -a.
  [bug introduced in coreutils-5.3.0]
  'mv -n A B' no longer suffers from a race condition that can
  overwrite a simultaneously-created B.  This bug fix requires
  platform support for the renameat2 or renameatx_np syscalls, found
  in recent Linux and macOS kernels.  As a side effect, ‘mv -n A A’
  now silently does nothing if A exists.
  [bug introduced with coreutils-7.1]
  * * Changes in behavior
  'cp --force file symlink' now removes the symlink even if
  it is self referential.
  ls --color now matches file extensions case insensitively.
  * * New features
  cp --reflink now supports --reflink=never to enforce a standard copy.
  env supports a new -v/--debug option to show verbose information about
  each processing step.
  env supports a new -S/--split-string=S option to split a single argument
  string into multiple arguments. Used to pass multiple arguments in scripts
  (shebang lines).
  md5sum accepts a new option: --zero (-z) to delimit the output lines with a
  NUL instead of a newline character.  This also disables file name escaping.
  This also applies to sha*sum and b2sum.
  rm --preserve-root now supports the --preserve-root=all option to
  reject any command line argument that is mounted to a separate file system.
  * * Improvements
  cut supports line lengths up to the max file size on 32 bit systems.
  Previously only offsets up to SIZE_MAX-1 were supported.
  stat and tail now know about the "exfs" file system, which is a
  version of XFS.  stat -f --format=%T now reports the file system type,
  and tail -f uses inotify.
  wc avoids redundant processing of ASCII text in multibyte locales,
  which is especially significant on macOS.
  * * Build-related
  Adjust to glibc &gt;= 2.28  (bsc#1182550, jsc#SLE-13520, jsc#SLE-13756)
- Refresh patches (line number changes only):
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * (License): osc changed the value from "GPL-3.0+" to "GPL-3.0-or-later".
  * (build): Make sure that parse-datetime.{c,y} ends up in debuginfo (rh#1555079).
- coreutils-i18n.patch:
  * src/exand.c,src/unexpand.c: Avoid -Wcomment warning.
  * src/cut.c (cut_characters_or_cut_bytes_no_split): Change idx from size_t
    to uintmax_t type to avoid a regression on i586, armv7l and ppc.
    Compare upstream, non-MB commit:
    https://git.sv.gnu.org/cgit/coreutils.git/commit/?id=d1a754c8272
    (cut_fields_mb): Likewise for field_idx.
  * tests/misc/cut.pl: Remove downstream tweaks as upstream MB tests are
    working since a while.
- coreutils.keyring: Update Assaf Gordon's GPG public key.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1552305600">- Update to 8.31:
  * Noteworthy changes in release 8.31 (2019-03-10) [stable]
  * * Bug fixes
  'base64 a b' now correctly diagnoses 'b' as the extra operand, not 'a'.
  [bug introduced in coreutils-5.3.0]
  When B already exists, 'cp -il A B' no longer immediately fails
  after asking the user whether to proceed.
  [This bug was present in "the beginning".]
  df no longer corrupts displayed multibyte characters on macOS.
  [bug introduced with coreutils-8.18]
  seq no longer outputs inconsistent decimal point characters
  for the last number, when locales are misconfigured.
  [bug introduced in coreutils-7.0]
  shred, sort, and split no longer falsely report ftruncate errors
  when outputting to less-common file types.  For example, the shell
  command 'sort /dev/null -o /dev/stdout | cat' no longer fails with
  an "error truncating" diagnostic.
  [bug was introduced with coreutils-8.18 for sort and split, and
  (for shared memory objects only) with fileutils-4.1 for shred]
  sync no longer fails for write-only file arguments.
  [bug introduced with argument support to sync in coreutils-8.24]
  'tail -f file | filter' no longer exits immediately on AIX.
  [bug introduced in coreutils-8.28]
  'tail -f file | filter' no longer goes into an infinite loop
  if filter exits and SIGPIPE is ignored.
  [bug introduced in coreutils-8.28]
  * * Changes in behavior
  cksum, dd, hostid, hostname, link, logname, sleep, tsort, unlink,
  uptime, users, whoami, yes: now always process --help and --version options,
  regardless of any other arguments present before any optional '--'
  end-of-options marker.
  nohup now processes --help and --version as first options even if other
  parameters follow.
  'yes a -- b' now outputs 'a b' instead of including the end-of-options
  marker as before: 'a -- b'.
  echo now always processes backslash escapes when the POSIXLY_CORRECT
  environment variable is set.
  When possible 'ln A B' now merely links A to B and reports an error
  if this fails, instead of statting A and B before linking.  This
  uses fewer system calls and avoids some races.  The old statting
  approach is still used in situations where hard links to directories
  are allowed (e.g., NetBSD when superuser).
  ls --group-directories-first will also group symlinks to directories.
  'test -a FILE' is not supported anymore.  Long ago, there were concerns about
  the high probability of humans confusing the -a primary with the -a binary
  operator, so POSIX changed this to 'test -e FILE'.  Scripts using it were
  already broken and non-portable; the -a unary operator was never documented.
  wc now treats non breaking space characters as word delimiters
  unless the POSIXLY_CORRECT environment variable is set.
  * * New features
  id now supports specifying multiple users.
  'date' now supports the '+' conversion specification flag,
  introduced in POSIX.1-2017.
  printf, seq, sleep, tail, and timeout now accept floating point
  numbers in either the current or the C locale.  For example, if the
  current locale's decimal point is ',', 'sleep 0,1' and 'sleep 0.1'
  now mean the same thing.  Previously, these commands accepted only
  C-locale syntax with '.' as the decimal point.  The new behavior is
  more compatible with other implementations in non-C locales.
  test now supports the '-N FILE' unary operator (like e.g. bash) to check
  whether FILE exists and has been modified since it was last read.
  env now supports '--default-signal[=SIG]', '--ignore-signal[=SIG]', and
  '--block-signal[=SIG], to setup signal handling before executing a program.
  env now supports '--list-signal-handling' to indicate non-default
  signal handling before executing a program.
  * * New commands
  basenc is added to complement existing base64,base32 commands,
  and encodes and decodes printable text using various common encodings:
  base64,base64url,base32,base32hex,base16,base2,z85.
  * * Improvements
  ls -l now better aligns abbreviated months containing digits,
  which is common in Asian locales.
  stat and tail now know about the "sdcardfs" file system on Android.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  stat now prints file creation time when supported by the file system,
  on GNU Linux systems with glibc &gt;= 2.28 and kernel &gt;= 4.11.
- Refresh patches (line number changes only):
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-misc.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * Version: bump version.
  * URL: Use https scheme.
  * %description: Add 'basenc' tool.
  * Change gitweb to cgit URL with https in a comment.
- coreutils.keyring:
  * Update for added section headers ('GPG keys of &lt;MAINTAINER&gt;').</changelog>
  <changelog author="lnussel@suse.de" date="1568894400">- Do not recommend lang package. The lang package already has a
  supplements.</changelog>
  <changelog author="lnussel@suse.de" date="1578571200">- switch to multibuild
- add coreutils-single subpackage that contains a single binary coreutils tool
  similar to busybox
- package LC_CTIME directories also in lang package
- split off doc package
- remove info macros, handled by file trigger nowadays</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1579521600">- minor: remove obsolete comment in spec file.</changelog>
  <changelog author="lnussel@suse.de" date="1580212800">- disable single and testsuite builds in rings/staging
- remove duplicate "coreutils" in flavor to make it look nicer in OBS</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1583755200">- Update to 8.32:
  * Noteworthy changes in release 8.32 (2020-03-05) [stable]
  * * Bug fixes
  cp now copies /dev/fd/N correctly on platforms like Solaris where
  it is a character-special file whose minor device number is N.
  [bug introduced in fileutils-4.1.6]
  dd conv=fdatasync no longer reports a "Bad file descriptor" error
  when fdatasync is interrupted, and dd now retries interrupted calls
  to close, fdatasync, fstat and fsync instead of incorrectly
  reporting an "Interrupted system call" error.
  [bugs introduced in coreutils-6.0]
  df now correctly parses the /proc/self/mountinfo file for unusual entries
  like ones with '\r' in a field value ("mount -t tmpfs tmpfs /foo$'\r'bar"),
  when the source field is empty ('mount -t tmpfs "" /mnt'), and when the
  filesystem type contains characters like a blank which need escaping.
  [bugs introduced in coreutils-8.24 with the introduction of reading
  the /proc/self/mountinfo file]
  factor again outputs immediately when stdout is a tty but stdin is not.
  [bug introduced in coreutils-8.24]
  ln works again on old systems without O_DIRECTORY support (like Solaris 10),
  and on systems where symlink ("x", ".") fails with errno == EINVAL
  (like Solaris 10 and Solaris 11).
  [bug introduced in coreutils-8.31]
  rmdir --ignore-fail-on-non-empty now works correctly for directories
  that fail to be removed due to permission issues.  Previously the exit status
  was reversed, failing for non empty and succeeding for empty directories.
  [bug introduced in coreutils-6.11]
  'shuf -r -n 0 file' no longer mistakenly reads from standard input.
  [bug introduced with the --repeat feature in coreutils-8.22]
  split no longer reports a "output file suffixes exhausted" error
  when the specified number of files is evenly divisible by 10, 16, 26,
  for --numeric, --hex, or default alphabetic suffixes respectively.
  [bug introduced in coreutils-8.24]
  seq no longer prints an extra line under certain circumstances (such as
  'seq -f "%g " 1000000 1000000').
  [bug introduced in coreutils-6.10]
  * * Changes in behavior
  Several programs now check that numbers end properly.  For example,
  'du -d 1x' now reports an error instead of silently ignoring the 'x'.
  Affected programs and options include du -d, expr's numeric operands
  on non-GMP builds, install -g and -o, ls's TABSIZE environment
  variable, mknod b and c, ptx -g and -w, shuf -n, and sort --batch-size
  and --parallel.
  date now parses military time zones in accordance with common usage:
    "A" to "M"  are equivalent to UTC+1 to UTC+12
    "N" to "Y"  are equivalent to UTC-1 to UTC-12
    "Z" is "zulu" time (UTC).
  For example, 'date -d "09:00B" is now equivalent to 9am in UTC+2 time zone.
  Previously, military time zones were parsed according to the obsolete
  rfc822, with their value negated (e.g., "B" was equivalent to UTC-2).
  [The old behavior was introduced in sh-utils 2.0.15 ca. 1999, predating
  coreutils package.]
  ls issues an error message on a removed directory, on GNU/Linux systems.
  Previously no error and no entries were output, and so indistinguishable
  from an empty directory, with default ls options.
  uniq no longer uses strcoll() to determine string equivalence,
  and so will operate more efficiently and consistently.
  * * New Features
  ls now supports the --time=birth option to display and sort by
  file creation time, where available.
  od --skip-bytes now can use lseek even if the input is not a regular
  file, greatly improving performance in some cases.
  stat(1) supports a new --cached= option, used on systems with statx(2)
  to control cache coherency of file system attributes,
  useful on network file systems.
  * * Improvements
  stat and ls now use the statx() system call where available, which can
  operate more efficiently by only retrieving requested attributes.
  stat and tail now know about the "binderfs", "dma-buf-fs", "erofs",
  "ppc-cmm-fs", and "z3fold" file systems.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  * * Build-related
  gzip-compressed tarballs are distributed once again
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-invalid-ids.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils-i18n.patch:
  * uniq: remove collation handling as required by newer POSIX; see
  - https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8e81d44b5
  - https://www.austingroupbugs.net/view.php?id=963
- coreutils-ls-restore-8.31-behavior-on-removed-dirs.patch:
  * Add patch for 'ls' to restore 8.31 behavior on removed directories.
- coreutils.spec:
  * Version: bump version.
  * %check: re-enable regular 'make check' for non-multibuild package.
  * reference the above new patch.
- coreutils.keyring:
  * Update from upstream (Savannah).</changelog>
  <changelog author="dmueller@suse.com" date="1588593600">- add coreutils-use-python3.patch to minimally port away from
  python 2.x use of pyinotify in the testsuite</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1592049600">- coreutils-gnulib-disable-test-float.patch: Add patch to temporarily
  disable the gnulib test 'test-float' failing on ppc and ppc64le.
- coreutils.spec: Reference the patch.  While at it, avoid conditional
  Patch and Source entries as that break cross-platform builds from
  source RPMs.</changelog>
  <changelog author="dimstar@opensuse.org" date="1594900800">- Drop suse-module-tools BuildRequires: this was used for the macro
  regenerate_initrd_post/posttrans, which have been moved to
  rpm-config-SUSE in Jan 2019.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1598875200">- gnulib-test-avoid-FP-perror-strerror.patch: Add patch to
  avoid false-positive error in gnulib tests 'test-perror2' and
  'test-strerror_r', visible on armv7l.
- coreutils.spec: Reference the patch.</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="zpetrova@suse.com" date="1635163200">- coreutils-df-fuse-portal-dummy.patch:
  df: Add "fuse.portal" as a dummy file system (used in flatpak
  implementations). (bsc#1189152)</changelog>
  <changelog author="ailiop@suse.com" date="1706529600">- tail: fix tailing sysfs files where PAGE_SIZE &gt; BUFSIZ (bsc#1219321)
  - add coreutils-tail-fix-tailing-sysfs-files-where-PAGE_SIZE-BUFSIZ.patch</changelog>
  <changelog author="tabraham@suse.com" date="1712059200">- ls: avoid triggering automounts (bsc#1221632)
  - add coreutils-ls-avoid-triggering-automounts.patch</changelog>
</package>
<package pkgid="85f0d634a0b7d8dee6715ce0c082bed64b521eb5f1f5e9fa58700c3374505f8f" name="coreutils-lang" arch="noarch">
  <version epoch="0" ver="8.32" rel="150400.9.6.1"/>
  <changelog author="mail@bernhard-voelker.de" date="1493726400">- coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch:
  Add upstream patch to fix an heap overflow security issue
  in date(1) and touch(1) with a large TZ variable
  (CVE-2017-7476, rh#1444774, boo#1037124).</changelog>
  <changelog author="ghe@suse.com" date="1502884800">- Drop coreutils-ocfs2_reflinks.patch
  OCFS2 file system has supported file clone ioctls like btrfs,
  then, coreutils doesn't need this patch from the kernel v4.10-rc1</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1504526400">- Update to 8.28
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.keyring: Update from upstream (Savannah).
- Remove now-upstream patches:
  * coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch
  * coreutils-tests-port-to-timezone-2017a.patch
- coreutils.spec: Add "BuildRequires: user(bin)" for the tests.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1514462400">- Update to 8.29:
  * Noteworthy changes in release 8.29 (2017-12-27) [stable]
  * * Bug fixes
  b2sum no longer crashes when processing certain truncated check files.
  [bug introduced with b2sum coreutils-8.26]
  dd now ensures the correct cache ranges are specified for the "nocache"
  and "direct" flags.  Previously some pages in the page cache were not
  invalidated.  [bug introduced for "direct" in coreutils-7.5,
  and with the "nocache" implementation in coreutils-8.11]
  df no longer hangs when given a fifo argument.
  [bug introduced in coreutils-7.3]
  ptx -S no longer infloops for a pattern which returns zero-length matches.
  [the bug dates back to the initial implementation]
  shred --remove will again repeatedly rename files with shortening names
  to attempt to hide the original length of the file name.
  [bug introduced in coreutils-8.28]
  stty no longer crashes when processing settings with -F also specified.
  [bug introduced in fileutils-4.0]
  tail --bytes again supports non seekable inputs on all systems.
  On systems like android it always tried to process as seekable inputs.
  [bug introduced in coreutils-8.24]
  timeout will again notice its managed command exiting, even when
  invoked with blocked CHLD signal, or in a narrow window where
  this CHLD signal from the exiting child was missed.  In each case
  timeout would have then waited for the time limit to expire.
  [bug introduced in coreutils-8.27]
  * * New features
  timeout now supports the --verbose option to diagnose forced termination.
  * * Improvements
  dd now supports iflag=direct with arbitrary sized files on all file systems.
  tail --bytes=NUM will efficiently seek to the end of block devices,
  rather than reading from the start.
  Utilities which do not support long options (other than the default --help
  and --version), e.g. cksum and sleep, now use more consistent error diagnostic
  for unknown long options.
  * * Build-related
  Default man pages are now distributed which are used if perl is
  not available on the build system, or when cross compiling.
- Refresh patches (line number changes only):
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1530619200">- Update to 8.30:
  * Noteworthy changes in release 8.30 (2018-07-01) [stable]
  * * Bug fixes
  'cp --symlink SRC DST' will again correctly validate DST.
  If DST is a regular file and SRC is a symlink to DST,
  then cp will no longer allow that operation to clobber DST.
  Also with -d, if DST is a symlink, then it can always be replaced,
  even if it points to SRC on a separate device.
  [bugs introduced with coreutils-8.27]
  'cp -n -u' and 'mv -n -u' now consistently ignore the -u option.
  Previously, this option combination suffered from race conditions
  that caused -u to sometimes override -n.
  [bug introduced with coreutils-7.1]
  'cp -a --no-preserve=mode' now sets appropriate default permissions
  for non regular files like fifos and character device nodes etc.,
  and leaves mode bits of existing files unchanged.
  Previously it would have set executable bits on created special files,
  and set mode bits for existing files as if they had been created.
  [bug introduced with coreutils-8.20]
  'cp --remove-destination file symlink' now removes the symlink
  even if it can't be traversed.
  [bug introduced with --remove-destination in fileutils-4.1.1]
  ls no longer truncates the abbreviated month names that have a
  display width between 6 and 12 inclusive.  Previously this would have
  output ambiguous months for Arabic or Catalan locales.
  'ls -aA' is now equivalent to 'ls -A', since -A now overrides -a.
  [bug introduced in coreutils-5.3.0]
  'mv -n A B' no longer suffers from a race condition that can
  overwrite a simultaneously-created B.  This bug fix requires
  platform support for the renameat2 or renameatx_np syscalls, found
  in recent Linux and macOS kernels.  As a side effect, ‘mv -n A A’
  now silently does nothing if A exists.
  [bug introduced with coreutils-7.1]
  * * Changes in behavior
  'cp --force file symlink' now removes the symlink even if
  it is self referential.
  ls --color now matches file extensions case insensitively.
  * * New features
  cp --reflink now supports --reflink=never to enforce a standard copy.
  env supports a new -v/--debug option to show verbose information about
  each processing step.
  env supports a new -S/--split-string=S option to split a single argument
  string into multiple arguments. Used to pass multiple arguments in scripts
  (shebang lines).
  md5sum accepts a new option: --zero (-z) to delimit the output lines with a
  NUL instead of a newline character.  This also disables file name escaping.
  This also applies to sha*sum and b2sum.
  rm --preserve-root now supports the --preserve-root=all option to
  reject any command line argument that is mounted to a separate file system.
  * * Improvements
  cut supports line lengths up to the max file size on 32 bit systems.
  Previously only offsets up to SIZE_MAX-1 were supported.
  stat and tail now know about the "exfs" file system, which is a
  version of XFS.  stat -f --format=%T now reports the file system type,
  and tail -f uses inotify.
  wc avoids redundant processing of ASCII text in multibyte locales,
  which is especially significant on macOS.
  * * Build-related
  Adjust to glibc &gt;= 2.28  (bsc#1182550, jsc#SLE-13520, jsc#SLE-13756)
- Refresh patches (line number changes only):
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * (License): osc changed the value from "GPL-3.0+" to "GPL-3.0-or-later".
  * (build): Make sure that parse-datetime.{c,y} ends up in debuginfo (rh#1555079).
- coreutils-i18n.patch:
  * src/exand.c,src/unexpand.c: Avoid -Wcomment warning.
  * src/cut.c (cut_characters_or_cut_bytes_no_split): Change idx from size_t
    to uintmax_t type to avoid a regression on i586, armv7l and ppc.
    Compare upstream, non-MB commit:
    https://git.sv.gnu.org/cgit/coreutils.git/commit/?id=d1a754c8272
    (cut_fields_mb): Likewise for field_idx.
  * tests/misc/cut.pl: Remove downstream tweaks as upstream MB tests are
    working since a while.
- coreutils.keyring: Update Assaf Gordon's GPG public key.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1552305600">- Update to 8.31:
  * Noteworthy changes in release 8.31 (2019-03-10) [stable]
  * * Bug fixes
  'base64 a b' now correctly diagnoses 'b' as the extra operand, not 'a'.
  [bug introduced in coreutils-5.3.0]
  When B already exists, 'cp -il A B' no longer immediately fails
  after asking the user whether to proceed.
  [This bug was present in "the beginning".]
  df no longer corrupts displayed multibyte characters on macOS.
  [bug introduced with coreutils-8.18]
  seq no longer outputs inconsistent decimal point characters
  for the last number, when locales are misconfigured.
  [bug introduced in coreutils-7.0]
  shred, sort, and split no longer falsely report ftruncate errors
  when outputting to less-common file types.  For example, the shell
  command 'sort /dev/null -o /dev/stdout | cat' no longer fails with
  an "error truncating" diagnostic.
  [bug was introduced with coreutils-8.18 for sort and split, and
  (for shared memory objects only) with fileutils-4.1 for shred]
  sync no longer fails for write-only file arguments.
  [bug introduced with argument support to sync in coreutils-8.24]
  'tail -f file | filter' no longer exits immediately on AIX.
  [bug introduced in coreutils-8.28]
  'tail -f file | filter' no longer goes into an infinite loop
  if filter exits and SIGPIPE is ignored.
  [bug introduced in coreutils-8.28]
  * * Changes in behavior
  cksum, dd, hostid, hostname, link, logname, sleep, tsort, unlink,
  uptime, users, whoami, yes: now always process --help and --version options,
  regardless of any other arguments present before any optional '--'
  end-of-options marker.
  nohup now processes --help and --version as first options even if other
  parameters follow.
  'yes a -- b' now outputs 'a b' instead of including the end-of-options
  marker as before: 'a -- b'.
  echo now always processes backslash escapes when the POSIXLY_CORRECT
  environment variable is set.
  When possible 'ln A B' now merely links A to B and reports an error
  if this fails, instead of statting A and B before linking.  This
  uses fewer system calls and avoids some races.  The old statting
  approach is still used in situations where hard links to directories
  are allowed (e.g., NetBSD when superuser).
  ls --group-directories-first will also group symlinks to directories.
  'test -a FILE' is not supported anymore.  Long ago, there were concerns about
  the high probability of humans confusing the -a primary with the -a binary
  operator, so POSIX changed this to 'test -e FILE'.  Scripts using it were
  already broken and non-portable; the -a unary operator was never documented.
  wc now treats non breaking space characters as word delimiters
  unless the POSIXLY_CORRECT environment variable is set.
  * * New features
  id now supports specifying multiple users.
  'date' now supports the '+' conversion specification flag,
  introduced in POSIX.1-2017.
  printf, seq, sleep, tail, and timeout now accept floating point
  numbers in either the current or the C locale.  For example, if the
  current locale's decimal point is ',', 'sleep 0,1' and 'sleep 0.1'
  now mean the same thing.  Previously, these commands accepted only
  C-locale syntax with '.' as the decimal point.  The new behavior is
  more compatible with other implementations in non-C locales.
  test now supports the '-N FILE' unary operator (like e.g. bash) to check
  whether FILE exists and has been modified since it was last read.
  env now supports '--default-signal[=SIG]', '--ignore-signal[=SIG]', and
  '--block-signal[=SIG], to setup signal handling before executing a program.
  env now supports '--list-signal-handling' to indicate non-default
  signal handling before executing a program.
  * * New commands
  basenc is added to complement existing base64,base32 commands,
  and encodes and decodes printable text using various common encodings:
  base64,base64url,base32,base32hex,base16,base2,z85.
  * * Improvements
  ls -l now better aligns abbreviated months containing digits,
  which is common in Asian locales.
  stat and tail now know about the "sdcardfs" file system on Android.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  stat now prints file creation time when supported by the file system,
  on GNU Linux systems with glibc &gt;= 2.28 and kernel &gt;= 4.11.
- Refresh patches (line number changes only):
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-misc.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * Version: bump version.
  * URL: Use https scheme.
  * %description: Add 'basenc' tool.
  * Change gitweb to cgit URL with https in a comment.
- coreutils.keyring:
  * Update for added section headers ('GPG keys of &lt;MAINTAINER&gt;').</changelog>
  <changelog author="lnussel@suse.de" date="1568894400">- Do not recommend lang package. The lang package already has a
  supplements.</changelog>
  <changelog author="lnussel@suse.de" date="1578571200">- switch to multibuild
- add coreutils-single subpackage that contains a single binary coreutils tool
  similar to busybox
- package LC_CTIME directories also in lang package
- split off doc package
- remove info macros, handled by file trigger nowadays</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1579521600">- minor: remove obsolete comment in spec file.</changelog>
  <changelog author="lnussel@suse.de" date="1580212800">- disable single and testsuite builds in rings/staging
- remove duplicate "coreutils" in flavor to make it look nicer in OBS</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1583755200">- Update to 8.32:
  * Noteworthy changes in release 8.32 (2020-03-05) [stable]
  * * Bug fixes
  cp now copies /dev/fd/N correctly on platforms like Solaris where
  it is a character-special file whose minor device number is N.
  [bug introduced in fileutils-4.1.6]
  dd conv=fdatasync no longer reports a "Bad file descriptor" error
  when fdatasync is interrupted, and dd now retries interrupted calls
  to close, fdatasync, fstat and fsync instead of incorrectly
  reporting an "Interrupted system call" error.
  [bugs introduced in coreutils-6.0]
  df now correctly parses the /proc/self/mountinfo file for unusual entries
  like ones with '\r' in a field value ("mount -t tmpfs tmpfs /foo$'\r'bar"),
  when the source field is empty ('mount -t tmpfs "" /mnt'), and when the
  filesystem type contains characters like a blank which need escaping.
  [bugs introduced in coreutils-8.24 with the introduction of reading
  the /proc/self/mountinfo file]
  factor again outputs immediately when stdout is a tty but stdin is not.
  [bug introduced in coreutils-8.24]
  ln works again on old systems without O_DIRECTORY support (like Solaris 10),
  and on systems where symlink ("x", ".") fails with errno == EINVAL
  (like Solaris 10 and Solaris 11).
  [bug introduced in coreutils-8.31]
  rmdir --ignore-fail-on-non-empty now works correctly for directories
  that fail to be removed due to permission issues.  Previously the exit status
  was reversed, failing for non empty and succeeding for empty directories.
  [bug introduced in coreutils-6.11]
  'shuf -r -n 0 file' no longer mistakenly reads from standard input.
  [bug introduced with the --repeat feature in coreutils-8.22]
  split no longer reports a "output file suffixes exhausted" error
  when the specified number of files is evenly divisible by 10, 16, 26,
  for --numeric, --hex, or default alphabetic suffixes respectively.
  [bug introduced in coreutils-8.24]
  seq no longer prints an extra line under certain circumstances (such as
  'seq -f "%g " 1000000 1000000').
  [bug introduced in coreutils-6.10]
  * * Changes in behavior
  Several programs now check that numbers end properly.  For example,
  'du -d 1x' now reports an error instead of silently ignoring the 'x'.
  Affected programs and options include du -d, expr's numeric operands
  on non-GMP builds, install -g and -o, ls's TABSIZE environment
  variable, mknod b and c, ptx -g and -w, shuf -n, and sort --batch-size
  and --parallel.
  date now parses military time zones in accordance with common usage:
    "A" to "M"  are equivalent to UTC+1 to UTC+12
    "N" to "Y"  are equivalent to UTC-1 to UTC-12
    "Z" is "zulu" time (UTC).
  For example, 'date -d "09:00B" is now equivalent to 9am in UTC+2 time zone.
  Previously, military time zones were parsed according to the obsolete
  rfc822, with their value negated (e.g., "B" was equivalent to UTC-2).
  [The old behavior was introduced in sh-utils 2.0.15 ca. 1999, predating
  coreutils package.]
  ls issues an error message on a removed directory, on GNU/Linux systems.
  Previously no error and no entries were output, and so indistinguishable
  from an empty directory, with default ls options.
  uniq no longer uses strcoll() to determine string equivalence,
  and so will operate more efficiently and consistently.
  * * New Features
  ls now supports the --time=birth option to display and sort by
  file creation time, where available.
  od --skip-bytes now can use lseek even if the input is not a regular
  file, greatly improving performance in some cases.
  stat(1) supports a new --cached= option, used on systems with statx(2)
  to control cache coherency of file system attributes,
  useful on network file systems.
  * * Improvements
  stat and ls now use the statx() system call where available, which can
  operate more efficiently by only retrieving requested attributes.
  stat and tail now know about the "binderfs", "dma-buf-fs", "erofs",
  "ppc-cmm-fs", and "z3fold" file systems.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  * * Build-related
  gzip-compressed tarballs are distributed once again
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-invalid-ids.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils-i18n.patch:
  * uniq: remove collation handling as required by newer POSIX; see
  - https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8e81d44b5
  - https://www.austingroupbugs.net/view.php?id=963
- coreutils-ls-restore-8.31-behavior-on-removed-dirs.patch:
  * Add patch for 'ls' to restore 8.31 behavior on removed directories.
- coreutils.spec:
  * Version: bump version.
  * %check: re-enable regular 'make check' for non-multibuild package.
  * reference the above new patch.
- coreutils.keyring:
  * Update from upstream (Savannah).</changelog>
  <changelog author="dmueller@suse.com" date="1588593600">- add coreutils-use-python3.patch to minimally port away from
  python 2.x use of pyinotify in the testsuite</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1592049600">- coreutils-gnulib-disable-test-float.patch: Add patch to temporarily
  disable the gnulib test 'test-float' failing on ppc and ppc64le.
- coreutils.spec: Reference the patch.  While at it, avoid conditional
  Patch and Source entries as that break cross-platform builds from
  source RPMs.</changelog>
  <changelog author="dimstar@opensuse.org" date="1594900800">- Drop suse-module-tools BuildRequires: this was used for the macro
  regenerate_initrd_post/posttrans, which have been moved to
  rpm-config-SUSE in Jan 2019.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1598875200">- gnulib-test-avoid-FP-perror-strerror.patch: Add patch to
  avoid false-positive error in gnulib tests 'test-perror2' and
  'test-strerror_r', visible on armv7l.
- coreutils.spec: Reference the patch.</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="zpetrova@suse.com" date="1635163200">- coreutils-df-fuse-portal-dummy.patch:
  df: Add "fuse.portal" as a dummy file system (used in flatpak
  implementations). (bsc#1189152)</changelog>
  <changelog author="ailiop@suse.com" date="1706529600">- tail: fix tailing sysfs files where PAGE_SIZE &gt; BUFSIZ (bsc#1219321)
  - add coreutils-tail-fix-tailing-sysfs-files-where-PAGE_SIZE-BUFSIZ.patch</changelog>
  <changelog author="tabraham@suse.com" date="1712059200">- ls: avoid triggering automounts (bsc#1221632)
  - add coreutils-ls-avoid-triggering-automounts.patch</changelog>
</package>
<package pkgid="f56447ea35e347f59115af9420d1d56f9de6f84ec0b3d8a21d411a78c07ab99f" name="coreutils-single" arch="aarch64">
  <version epoch="0" ver="8.32" rel="150400.9.6.1"/>
  <changelog author="mail@bernhard-voelker.de" date="1493726400">- coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch:
  Add upstream patch to fix an heap overflow security issue
  in date(1) and touch(1) with a large TZ variable
  (CVE-2017-7476, rh#1444774, boo#1037124).</changelog>
  <changelog author="ghe@suse.com" date="1502884800">- Drop coreutils-ocfs2_reflinks.patch
  OCFS2 file system has supported file clone ioctls like btrfs,
  then, coreutils doesn't need this patch from the kernel v4.10-rc1</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1504526400">- Update to 8.28
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.keyring: Update from upstream (Savannah).
- Remove now-upstream patches:
  * coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch
  * coreutils-tests-port-to-timezone-2017a.patch
- coreutils.spec: Add "BuildRequires: user(bin)" for the tests.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1514462400">- Update to 8.29:
  * Noteworthy changes in release 8.29 (2017-12-27) [stable]
  * * Bug fixes
  b2sum no longer crashes when processing certain truncated check files.
  [bug introduced with b2sum coreutils-8.26]
  dd now ensures the correct cache ranges are specified for the "nocache"
  and "direct" flags.  Previously some pages in the page cache were not
  invalidated.  [bug introduced for "direct" in coreutils-7.5,
  and with the "nocache" implementation in coreutils-8.11]
  df no longer hangs when given a fifo argument.
  [bug introduced in coreutils-7.3]
  ptx -S no longer infloops for a pattern which returns zero-length matches.
  [the bug dates back to the initial implementation]
  shred --remove will again repeatedly rename files with shortening names
  to attempt to hide the original length of the file name.
  [bug introduced in coreutils-8.28]
  stty no longer crashes when processing settings with -F also specified.
  [bug introduced in fileutils-4.0]
  tail --bytes again supports non seekable inputs on all systems.
  On systems like android it always tried to process as seekable inputs.
  [bug introduced in coreutils-8.24]
  timeout will again notice its managed command exiting, even when
  invoked with blocked CHLD signal, or in a narrow window where
  this CHLD signal from the exiting child was missed.  In each case
  timeout would have then waited for the time limit to expire.
  [bug introduced in coreutils-8.27]
  * * New features
  timeout now supports the --verbose option to diagnose forced termination.
  * * Improvements
  dd now supports iflag=direct with arbitrary sized files on all file systems.
  tail --bytes=NUM will efficiently seek to the end of block devices,
  rather than reading from the start.
  Utilities which do not support long options (other than the default --help
  and --version), e.g. cksum and sleep, now use more consistent error diagnostic
  for unknown long options.
  * * Build-related
  Default man pages are now distributed which are used if perl is
  not available on the build system, or when cross compiling.
- Refresh patches (line number changes only):
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1530619200">- Update to 8.30:
  * Noteworthy changes in release 8.30 (2018-07-01) [stable]
  * * Bug fixes
  'cp --symlink SRC DST' will again correctly validate DST.
  If DST is a regular file and SRC is a symlink to DST,
  then cp will no longer allow that operation to clobber DST.
  Also with -d, if DST is a symlink, then it can always be replaced,
  even if it points to SRC on a separate device.
  [bugs introduced with coreutils-8.27]
  'cp -n -u' and 'mv -n -u' now consistently ignore the -u option.
  Previously, this option combination suffered from race conditions
  that caused -u to sometimes override -n.
  [bug introduced with coreutils-7.1]
  'cp -a --no-preserve=mode' now sets appropriate default permissions
  for non regular files like fifos and character device nodes etc.,
  and leaves mode bits of existing files unchanged.
  Previously it would have set executable bits on created special files,
  and set mode bits for existing files as if they had been created.
  [bug introduced with coreutils-8.20]
  'cp --remove-destination file symlink' now removes the symlink
  even if it can't be traversed.
  [bug introduced with --remove-destination in fileutils-4.1.1]
  ls no longer truncates the abbreviated month names that have a
  display width between 6 and 12 inclusive.  Previously this would have
  output ambiguous months for Arabic or Catalan locales.
  'ls -aA' is now equivalent to 'ls -A', since -A now overrides -a.
  [bug introduced in coreutils-5.3.0]
  'mv -n A B' no longer suffers from a race condition that can
  overwrite a simultaneously-created B.  This bug fix requires
  platform support for the renameat2 or renameatx_np syscalls, found
  in recent Linux and macOS kernels.  As a side effect, ‘mv -n A A’
  now silently does nothing if A exists.
  [bug introduced with coreutils-7.1]
  * * Changes in behavior
  'cp --force file symlink' now removes the symlink even if
  it is self referential.
  ls --color now matches file extensions case insensitively.
  * * New features
  cp --reflink now supports --reflink=never to enforce a standard copy.
  env supports a new -v/--debug option to show verbose information about
  each processing step.
  env supports a new -S/--split-string=S option to split a single argument
  string into multiple arguments. Used to pass multiple arguments in scripts
  (shebang lines).
  md5sum accepts a new option: --zero (-z) to delimit the output lines with a
  NUL instead of a newline character.  This also disables file name escaping.
  This also applies to sha*sum and b2sum.
  rm --preserve-root now supports the --preserve-root=all option to
  reject any command line argument that is mounted to a separate file system.
  * * Improvements
  cut supports line lengths up to the max file size on 32 bit systems.
  Previously only offsets up to SIZE_MAX-1 were supported.
  stat and tail now know about the "exfs" file system, which is a
  version of XFS.  stat -f --format=%T now reports the file system type,
  and tail -f uses inotify.
  wc avoids redundant processing of ASCII text in multibyte locales,
  which is especially significant on macOS.
  * * Build-related
  Adjust to glibc &gt;= 2.28  (bsc#1182550, jsc#SLE-13520, jsc#SLE-13756)
- Refresh patches (line number changes only):
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * (License): osc changed the value from "GPL-3.0+" to "GPL-3.0-or-later".
  * (build): Make sure that parse-datetime.{c,y} ends up in debuginfo (rh#1555079).
- coreutils-i18n.patch:
  * src/exand.c,src/unexpand.c: Avoid -Wcomment warning.
  * src/cut.c (cut_characters_or_cut_bytes_no_split): Change idx from size_t
    to uintmax_t type to avoid a regression on i586, armv7l and ppc.
    Compare upstream, non-MB commit:
    https://git.sv.gnu.org/cgit/coreutils.git/commit/?id=d1a754c8272
    (cut_fields_mb): Likewise for field_idx.
  * tests/misc/cut.pl: Remove downstream tweaks as upstream MB tests are
    working since a while.
- coreutils.keyring: Update Assaf Gordon's GPG public key.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1552305600">- Update to 8.31:
  * Noteworthy changes in release 8.31 (2019-03-10) [stable]
  * * Bug fixes
  'base64 a b' now correctly diagnoses 'b' as the extra operand, not 'a'.
  [bug introduced in coreutils-5.3.0]
  When B already exists, 'cp -il A B' no longer immediately fails
  after asking the user whether to proceed.
  [This bug was present in "the beginning".]
  df no longer corrupts displayed multibyte characters on macOS.
  [bug introduced with coreutils-8.18]
  seq no longer outputs inconsistent decimal point characters
  for the last number, when locales are misconfigured.
  [bug introduced in coreutils-7.0]
  shred, sort, and split no longer falsely report ftruncate errors
  when outputting to less-common file types.  For example, the shell
  command 'sort /dev/null -o /dev/stdout | cat' no longer fails with
  an "error truncating" diagnostic.
  [bug was introduced with coreutils-8.18 for sort and split, and
  (for shared memory objects only) with fileutils-4.1 for shred]
  sync no longer fails for write-only file arguments.
  [bug introduced with argument support to sync in coreutils-8.24]
  'tail -f file | filter' no longer exits immediately on AIX.
  [bug introduced in coreutils-8.28]
  'tail -f file | filter' no longer goes into an infinite loop
  if filter exits and SIGPIPE is ignored.
  [bug introduced in coreutils-8.28]
  * * Changes in behavior
  cksum, dd, hostid, hostname, link, logname, sleep, tsort, unlink,
  uptime, users, whoami, yes: now always process --help and --version options,
  regardless of any other arguments present before any optional '--'
  end-of-options marker.
  nohup now processes --help and --version as first options even if other
  parameters follow.
  'yes a -- b' now outputs 'a b' instead of including the end-of-options
  marker as before: 'a -- b'.
  echo now always processes backslash escapes when the POSIXLY_CORRECT
  environment variable is set.
  When possible 'ln A B' now merely links A to B and reports an error
  if this fails, instead of statting A and B before linking.  This
  uses fewer system calls and avoids some races.  The old statting
  approach is still used in situations where hard links to directories
  are allowed (e.g., NetBSD when superuser).
  ls --group-directories-first will also group symlinks to directories.
  'test -a FILE' is not supported anymore.  Long ago, there were concerns about
  the high probability of humans confusing the -a primary with the -a binary
  operator, so POSIX changed this to 'test -e FILE'.  Scripts using it were
  already broken and non-portable; the -a unary operator was never documented.
  wc now treats non breaking space characters as word delimiters
  unless the POSIXLY_CORRECT environment variable is set.
  * * New features
  id now supports specifying multiple users.
  'date' now supports the '+' conversion specification flag,
  introduced in POSIX.1-2017.
  printf, seq, sleep, tail, and timeout now accept floating point
  numbers in either the current or the C locale.  For example, if the
  current locale's decimal point is ',', 'sleep 0,1' and 'sleep 0.1'
  now mean the same thing.  Previously, these commands accepted only
  C-locale syntax with '.' as the decimal point.  The new behavior is
  more compatible with other implementations in non-C locales.
  test now supports the '-N FILE' unary operator (like e.g. bash) to check
  whether FILE exists and has been modified since it was last read.
  env now supports '--default-signal[=SIG]', '--ignore-signal[=SIG]', and
  '--block-signal[=SIG], to setup signal handling before executing a program.
  env now supports '--list-signal-handling' to indicate non-default
  signal handling before executing a program.
  * * New commands
  basenc is added to complement existing base64,base32 commands,
  and encodes and decodes printable text using various common encodings:
  base64,base64url,base32,base32hex,base16,base2,z85.
  * * Improvements
  ls -l now better aligns abbreviated months containing digits,
  which is common in Asian locales.
  stat and tail now know about the "sdcardfs" file system on Android.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  stat now prints file creation time when supported by the file system,
  on GNU Linux systems with glibc &gt;= 2.28 and kernel &gt;= 4.11.
- Refresh patches (line number changes only):
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-misc.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * Version: bump version.
  * URL: Use https scheme.
  * %description: Add 'basenc' tool.
  * Change gitweb to cgit URL with https in a comment.
- coreutils.keyring:
  * Update for added section headers ('GPG keys of &lt;MAINTAINER&gt;').</changelog>
  <changelog author="lnussel@suse.de" date="1568894400">- Do not recommend lang package. The lang package already has a
  supplements.</changelog>
  <changelog author="lnussel@suse.de" date="1578571200">- switch to multibuild
- add coreutils-single subpackage that contains a single binary coreutils tool
  similar to busybox
- package LC_CTIME directories also in lang package
- split off doc package
- remove info macros, handled by file trigger nowadays</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1579521600">- minor: remove obsolete comment in spec file.</changelog>
  <changelog author="lnussel@suse.de" date="1580212800">- disable single and testsuite builds in rings/staging
- remove duplicate "coreutils" in flavor to make it look nicer in OBS</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1583755200">- Update to 8.32:
  * Noteworthy changes in release 8.32 (2020-03-05) [stable]
  * * Bug fixes
  cp now copies /dev/fd/N correctly on platforms like Solaris where
  it is a character-special file whose minor device number is N.
  [bug introduced in fileutils-4.1.6]
  dd conv=fdatasync no longer reports a "Bad file descriptor" error
  when fdatasync is interrupted, and dd now retries interrupted calls
  to close, fdatasync, fstat and fsync instead of incorrectly
  reporting an "Interrupted system call" error.
  [bugs introduced in coreutils-6.0]
  df now correctly parses the /proc/self/mountinfo file for unusual entries
  like ones with '\r' in a field value ("mount -t tmpfs tmpfs /foo$'\r'bar"),
  when the source field is empty ('mount -t tmpfs "" /mnt'), and when the
  filesystem type contains characters like a blank which need escaping.
  [bugs introduced in coreutils-8.24 with the introduction of reading
  the /proc/self/mountinfo file]
  factor again outputs immediately when stdout is a tty but stdin is not.
  [bug introduced in coreutils-8.24]
  ln works again on old systems without O_DIRECTORY support (like Solaris 10),
  and on systems where symlink ("x", ".") fails with errno == EINVAL
  (like Solaris 10 and Solaris 11).
  [bug introduced in coreutils-8.31]
  rmdir --ignore-fail-on-non-empty now works correctly for directories
  that fail to be removed due to permission issues.  Previously the exit status
  was reversed, failing for non empty and succeeding for empty directories.
  [bug introduced in coreutils-6.11]
  'shuf -r -n 0 file' no longer mistakenly reads from standard input.
  [bug introduced with the --repeat feature in coreutils-8.22]
  split no longer reports a "output file suffixes exhausted" error
  when the specified number of files is evenly divisible by 10, 16, 26,
  for --numeric, --hex, or default alphabetic suffixes respectively.
  [bug introduced in coreutils-8.24]
  seq no longer prints an extra line under certain circumstances (such as
  'seq -f "%g " 1000000 1000000').
  [bug introduced in coreutils-6.10]
  * * Changes in behavior
  Several programs now check that numbers end properly.  For example,
  'du -d 1x' now reports an error instead of silently ignoring the 'x'.
  Affected programs and options include du -d, expr's numeric operands
  on non-GMP builds, install -g and -o, ls's TABSIZE environment
  variable, mknod b and c, ptx -g and -w, shuf -n, and sort --batch-size
  and --parallel.
  date now parses military time zones in accordance with common usage:
    "A" to "M"  are equivalent to UTC+1 to UTC+12
    "N" to "Y"  are equivalent to UTC-1 to UTC-12
    "Z" is "zulu" time (UTC).
  For example, 'date -d "09:00B" is now equivalent to 9am in UTC+2 time zone.
  Previously, military time zones were parsed according to the obsolete
  rfc822, with their value negated (e.g., "B" was equivalent to UTC-2).
  [The old behavior was introduced in sh-utils 2.0.15 ca. 1999, predating
  coreutils package.]
  ls issues an error message on a removed directory, on GNU/Linux systems.
  Previously no error and no entries were output, and so indistinguishable
  from an empty directory, with default ls options.
  uniq no longer uses strcoll() to determine string equivalence,
  and so will operate more efficiently and consistently.
  * * New Features
  ls now supports the --time=birth option to display and sort by
  file creation time, where available.
  od --skip-bytes now can use lseek even if the input is not a regular
  file, greatly improving performance in some cases.
  stat(1) supports a new --cached= option, used on systems with statx(2)
  to control cache coherency of file system attributes,
  useful on network file systems.
  * * Improvements
  stat and ls now use the statx() system call where available, which can
  operate more efficiently by only retrieving requested attributes.
  stat and tail now know about the "binderfs", "dma-buf-fs", "erofs",
  "ppc-cmm-fs", and "z3fold" file systems.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  * * Build-related
  gzip-compressed tarballs are distributed once again
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-invalid-ids.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils-i18n.patch:
  * uniq: remove collation handling as required by newer POSIX; see
  - https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8e81d44b5
  - https://www.austingroupbugs.net/view.php?id=963
- coreutils-ls-restore-8.31-behavior-on-removed-dirs.patch:
  * Add patch for 'ls' to restore 8.31 behavior on removed directories.
- coreutils.spec:
  * Version: bump version.
  * %check: re-enable regular 'make check' for non-multibuild package.
  * reference the above new patch.
- coreutils.keyring:
  * Update from upstream (Savannah).</changelog>
  <changelog author="dmueller@suse.com" date="1588593600">- add coreutils-use-python3.patch to minimally port away from
  python 2.x use of pyinotify in the testsuite</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1592049600">- coreutils-gnulib-disable-test-float.patch: Add patch to temporarily
  disable the gnulib test 'test-float' failing on ppc and ppc64le.
- coreutils.spec: Reference the patch.  While at it, avoid conditional
  Patch and Source entries as that break cross-platform builds from
  source RPMs.</changelog>
  <changelog author="dimstar@opensuse.org" date="1594900800">- Drop suse-module-tools BuildRequires: this was used for the macro
  regenerate_initrd_post/posttrans, which have been moved to
  rpm-config-SUSE in Jan 2019.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1598875200">- gnulib-test-avoid-FP-perror-strerror.patch: Add patch to
  avoid false-positive error in gnulib tests 'test-perror2' and
  'test-strerror_r', visible on armv7l.
- coreutils.spec: Reference the patch.</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="zpetrova@suse.com" date="1635163200">- coreutils-df-fuse-portal-dummy.patch:
  df: Add "fuse.portal" as a dummy file system (used in flatpak
  implementations). (bsc#1189152)</changelog>
  <changelog author="ailiop@suse.com" date="1706529600">- tail: fix tailing sysfs files where PAGE_SIZE &gt; BUFSIZ (bsc#1219321)
  - add coreutils-tail-fix-tailing-sysfs-files-where-PAGE_SIZE-BUFSIZ.patch</changelog>
  <changelog author="tabraham@suse.com" date="1712059200">- ls: avoid triggering automounts (bsc#1221632)
  - add coreutils-ls-avoid-triggering-automounts.patch</changelog>
</package>
<package pkgid="586995cce5e556fa93f3cd8960fe69ea9cb0307d703132595cdcb2aa9988efc4" name="coreutils-single" arch="ppc64le">
  <version epoch="0" ver="8.32" rel="150400.9.6.1"/>
  <changelog author="mail@bernhard-voelker.de" date="1493726400">- coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch:
  Add upstream patch to fix an heap overflow security issue
  in date(1) and touch(1) with a large TZ variable
  (CVE-2017-7476, rh#1444774, boo#1037124).</changelog>
  <changelog author="ghe@suse.com" date="1502884800">- Drop coreutils-ocfs2_reflinks.patch
  OCFS2 file system has supported file clone ioctls like btrfs,
  then, coreutils doesn't need this patch from the kernel v4.10-rc1</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1504526400">- Update to 8.28
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.keyring: Update from upstream (Savannah).
- Remove now-upstream patches:
  * coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch
  * coreutils-tests-port-to-timezone-2017a.patch
- coreutils.spec: Add "BuildRequires: user(bin)" for the tests.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1514462400">- Update to 8.29:
  * Noteworthy changes in release 8.29 (2017-12-27) [stable]
  * * Bug fixes
  b2sum no longer crashes when processing certain truncated check files.
  [bug introduced with b2sum coreutils-8.26]
  dd now ensures the correct cache ranges are specified for the "nocache"
  and "direct" flags.  Previously some pages in the page cache were not
  invalidated.  [bug introduced for "direct" in coreutils-7.5,
  and with the "nocache" implementation in coreutils-8.11]
  df no longer hangs when given a fifo argument.
  [bug introduced in coreutils-7.3]
  ptx -S no longer infloops for a pattern which returns zero-length matches.
  [the bug dates back to the initial implementation]
  shred --remove will again repeatedly rename files with shortening names
  to attempt to hide the original length of the file name.
  [bug introduced in coreutils-8.28]
  stty no longer crashes when processing settings with -F also specified.
  [bug introduced in fileutils-4.0]
  tail --bytes again supports non seekable inputs on all systems.
  On systems like android it always tried to process as seekable inputs.
  [bug introduced in coreutils-8.24]
  timeout will again notice its managed command exiting, even when
  invoked with blocked CHLD signal, or in a narrow window where
  this CHLD signal from the exiting child was missed.  In each case
  timeout would have then waited for the time limit to expire.
  [bug introduced in coreutils-8.27]
  * * New features
  timeout now supports the --verbose option to diagnose forced termination.
  * * Improvements
  dd now supports iflag=direct with arbitrary sized files on all file systems.
  tail --bytes=NUM will efficiently seek to the end of block devices,
  rather than reading from the start.
  Utilities which do not support long options (other than the default --help
  and --version), e.g. cksum and sleep, now use more consistent error diagnostic
  for unknown long options.
  * * Build-related
  Default man pages are now distributed which are used if perl is
  not available on the build system, or when cross compiling.
- Refresh patches (line number changes only):
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1530619200">- Update to 8.30:
  * Noteworthy changes in release 8.30 (2018-07-01) [stable]
  * * Bug fixes
  'cp --symlink SRC DST' will again correctly validate DST.
  If DST is a regular file and SRC is a symlink to DST,
  then cp will no longer allow that operation to clobber DST.
  Also with -d, if DST is a symlink, then it can always be replaced,
  even if it points to SRC on a separate device.
  [bugs introduced with coreutils-8.27]
  'cp -n -u' and 'mv -n -u' now consistently ignore the -u option.
  Previously, this option combination suffered from race conditions
  that caused -u to sometimes override -n.
  [bug introduced with coreutils-7.1]
  'cp -a --no-preserve=mode' now sets appropriate default permissions
  for non regular files like fifos and character device nodes etc.,
  and leaves mode bits of existing files unchanged.
  Previously it would have set executable bits on created special files,
  and set mode bits for existing files as if they had been created.
  [bug introduced with coreutils-8.20]
  'cp --remove-destination file symlink' now removes the symlink
  even if it can't be traversed.
  [bug introduced with --remove-destination in fileutils-4.1.1]
  ls no longer truncates the abbreviated month names that have a
  display width between 6 and 12 inclusive.  Previously this would have
  output ambiguous months for Arabic or Catalan locales.
  'ls -aA' is now equivalent to 'ls -A', since -A now overrides -a.
  [bug introduced in coreutils-5.3.0]
  'mv -n A B' no longer suffers from a race condition that can
  overwrite a simultaneously-created B.  This bug fix requires
  platform support for the renameat2 or renameatx_np syscalls, found
  in recent Linux and macOS kernels.  As a side effect, ‘mv -n A A’
  now silently does nothing if A exists.
  [bug introduced with coreutils-7.1]
  * * Changes in behavior
  'cp --force file symlink' now removes the symlink even if
  it is self referential.
  ls --color now matches file extensions case insensitively.
  * * New features
  cp --reflink now supports --reflink=never to enforce a standard copy.
  env supports a new -v/--debug option to show verbose information about
  each processing step.
  env supports a new -S/--split-string=S option to split a single argument
  string into multiple arguments. Used to pass multiple arguments in scripts
  (shebang lines).
  md5sum accepts a new option: --zero (-z) to delimit the output lines with a
  NUL instead of a newline character.  This also disables file name escaping.
  This also applies to sha*sum and b2sum.
  rm --preserve-root now supports the --preserve-root=all option to
  reject any command line argument that is mounted to a separate file system.
  * * Improvements
  cut supports line lengths up to the max file size on 32 bit systems.
  Previously only offsets up to SIZE_MAX-1 were supported.
  stat and tail now know about the "exfs" file system, which is a
  version of XFS.  stat -f --format=%T now reports the file system type,
  and tail -f uses inotify.
  wc avoids redundant processing of ASCII text in multibyte locales,
  which is especially significant on macOS.
  * * Build-related
  Adjust to glibc &gt;= 2.28  (bsc#1182550, jsc#SLE-13520, jsc#SLE-13756)
- Refresh patches (line number changes only):
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * (License): osc changed the value from "GPL-3.0+" to "GPL-3.0-or-later".
  * (build): Make sure that parse-datetime.{c,y} ends up in debuginfo (rh#1555079).
- coreutils-i18n.patch:
  * src/exand.c,src/unexpand.c: Avoid -Wcomment warning.
  * src/cut.c (cut_characters_or_cut_bytes_no_split): Change idx from size_t
    to uintmax_t type to avoid a regression on i586, armv7l and ppc.
    Compare upstream, non-MB commit:
    https://git.sv.gnu.org/cgit/coreutils.git/commit/?id=d1a754c8272
    (cut_fields_mb): Likewise for field_idx.
  * tests/misc/cut.pl: Remove downstream tweaks as upstream MB tests are
    working since a while.
- coreutils.keyring: Update Assaf Gordon's GPG public key.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1552305600">- Update to 8.31:
  * Noteworthy changes in release 8.31 (2019-03-10) [stable]
  * * Bug fixes
  'base64 a b' now correctly diagnoses 'b' as the extra operand, not 'a'.
  [bug introduced in coreutils-5.3.0]
  When B already exists, 'cp -il A B' no longer immediately fails
  after asking the user whether to proceed.
  [This bug was present in "the beginning".]
  df no longer corrupts displayed multibyte characters on macOS.
  [bug introduced with coreutils-8.18]
  seq no longer outputs inconsistent decimal point characters
  for the last number, when locales are misconfigured.
  [bug introduced in coreutils-7.0]
  shred, sort, and split no longer falsely report ftruncate errors
  when outputting to less-common file types.  For example, the shell
  command 'sort /dev/null -o /dev/stdout | cat' no longer fails with
  an "error truncating" diagnostic.
  [bug was introduced with coreutils-8.18 for sort and split, and
  (for shared memory objects only) with fileutils-4.1 for shred]
  sync no longer fails for write-only file arguments.
  [bug introduced with argument support to sync in coreutils-8.24]
  'tail -f file | filter' no longer exits immediately on AIX.
  [bug introduced in coreutils-8.28]
  'tail -f file | filter' no longer goes into an infinite loop
  if filter exits and SIGPIPE is ignored.
  [bug introduced in coreutils-8.28]
  * * Changes in behavior
  cksum, dd, hostid, hostname, link, logname, sleep, tsort, unlink,
  uptime, users, whoami, yes: now always process --help and --version options,
  regardless of any other arguments present before any optional '--'
  end-of-options marker.
  nohup now processes --help and --version as first options even if other
  parameters follow.
  'yes a -- b' now outputs 'a b' instead of including the end-of-options
  marker as before: 'a -- b'.
  echo now always processes backslash escapes when the POSIXLY_CORRECT
  environment variable is set.
  When possible 'ln A B' now merely links A to B and reports an error
  if this fails, instead of statting A and B before linking.  This
  uses fewer system calls and avoids some races.  The old statting
  approach is still used in situations where hard links to directories
  are allowed (e.g., NetBSD when superuser).
  ls --group-directories-first will also group symlinks to directories.
  'test -a FILE' is not supported anymore.  Long ago, there were concerns about
  the high probability of humans confusing the -a primary with the -a binary
  operator, so POSIX changed this to 'test -e FILE'.  Scripts using it were
  already broken and non-portable; the -a unary operator was never documented.
  wc now treats non breaking space characters as word delimiters
  unless the POSIXLY_CORRECT environment variable is set.
  * * New features
  id now supports specifying multiple users.
  'date' now supports the '+' conversion specification flag,
  introduced in POSIX.1-2017.
  printf, seq, sleep, tail, and timeout now accept floating point
  numbers in either the current or the C locale.  For example, if the
  current locale's decimal point is ',', 'sleep 0,1' and 'sleep 0.1'
  now mean the same thing.  Previously, these commands accepted only
  C-locale syntax with '.' as the decimal point.  The new behavior is
  more compatible with other implementations in non-C locales.
  test now supports the '-N FILE' unary operator (like e.g. bash) to check
  whether FILE exists and has been modified since it was last read.
  env now supports '--default-signal[=SIG]', '--ignore-signal[=SIG]', and
  '--block-signal[=SIG], to setup signal handling before executing a program.
  env now supports '--list-signal-handling' to indicate non-default
  signal handling before executing a program.
  * * New commands
  basenc is added to complement existing base64,base32 commands,
  and encodes and decodes printable text using various common encodings:
  base64,base64url,base32,base32hex,base16,base2,z85.
  * * Improvements
  ls -l now better aligns abbreviated months containing digits,
  which is common in Asian locales.
  stat and tail now know about the "sdcardfs" file system on Android.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  stat now prints file creation time when supported by the file system,
  on GNU Linux systems with glibc &gt;= 2.28 and kernel &gt;= 4.11.
- Refresh patches (line number changes only):
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-misc.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * Version: bump version.
  * URL: Use https scheme.
  * %description: Add 'basenc' tool.
  * Change gitweb to cgit URL with https in a comment.
- coreutils.keyring:
  * Update for added section headers ('GPG keys of &lt;MAINTAINER&gt;').</changelog>
  <changelog author="lnussel@suse.de" date="1568894400">- Do not recommend lang package. The lang package already has a
  supplements.</changelog>
  <changelog author="lnussel@suse.de" date="1578571200">- switch to multibuild
- add coreutils-single subpackage that contains a single binary coreutils tool
  similar to busybox
- package LC_CTIME directories also in lang package
- split off doc package
- remove info macros, handled by file trigger nowadays</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1579521600">- minor: remove obsolete comment in spec file.</changelog>
  <changelog author="lnussel@suse.de" date="1580212800">- disable single and testsuite builds in rings/staging
- remove duplicate "coreutils" in flavor to make it look nicer in OBS</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1583755200">- Update to 8.32:
  * Noteworthy changes in release 8.32 (2020-03-05) [stable]
  * * Bug fixes
  cp now copies /dev/fd/N correctly on platforms like Solaris where
  it is a character-special file whose minor device number is N.
  [bug introduced in fileutils-4.1.6]
  dd conv=fdatasync no longer reports a "Bad file descriptor" error
  when fdatasync is interrupted, and dd now retries interrupted calls
  to close, fdatasync, fstat and fsync instead of incorrectly
  reporting an "Interrupted system call" error.
  [bugs introduced in coreutils-6.0]
  df now correctly parses the /proc/self/mountinfo file for unusual entries
  like ones with '\r' in a field value ("mount -t tmpfs tmpfs /foo$'\r'bar"),
  when the source field is empty ('mount -t tmpfs "" /mnt'), and when the
  filesystem type contains characters like a blank which need escaping.
  [bugs introduced in coreutils-8.24 with the introduction of reading
  the /proc/self/mountinfo file]
  factor again outputs immediately when stdout is a tty but stdin is not.
  [bug introduced in coreutils-8.24]
  ln works again on old systems without O_DIRECTORY support (like Solaris 10),
  and on systems where symlink ("x", ".") fails with errno == EINVAL
  (like Solaris 10 and Solaris 11).
  [bug introduced in coreutils-8.31]
  rmdir --ignore-fail-on-non-empty now works correctly for directories
  that fail to be removed due to permission issues.  Previously the exit status
  was reversed, failing for non empty and succeeding for empty directories.
  [bug introduced in coreutils-6.11]
  'shuf -r -n 0 file' no longer mistakenly reads from standard input.
  [bug introduced with the --repeat feature in coreutils-8.22]
  split no longer reports a "output file suffixes exhausted" error
  when the specified number of files is evenly divisible by 10, 16, 26,
  for --numeric, --hex, or default alphabetic suffixes respectively.
  [bug introduced in coreutils-8.24]
  seq no longer prints an extra line under certain circumstances (such as
  'seq -f "%g " 1000000 1000000').
  [bug introduced in coreutils-6.10]
  * * Changes in behavior
  Several programs now check that numbers end properly.  For example,
  'du -d 1x' now reports an error instead of silently ignoring the 'x'.
  Affected programs and options include du -d, expr's numeric operands
  on non-GMP builds, install -g and -o, ls's TABSIZE environment
  variable, mknod b and c, ptx -g and -w, shuf -n, and sort --batch-size
  and --parallel.
  date now parses military time zones in accordance with common usage:
    "A" to "M"  are equivalent to UTC+1 to UTC+12
    "N" to "Y"  are equivalent to UTC-1 to UTC-12
    "Z" is "zulu" time (UTC).
  For example, 'date -d "09:00B" is now equivalent to 9am in UTC+2 time zone.
  Previously, military time zones were parsed according to the obsolete
  rfc822, with their value negated (e.g., "B" was equivalent to UTC-2).
  [The old behavior was introduced in sh-utils 2.0.15 ca. 1999, predating
  coreutils package.]
  ls issues an error message on a removed directory, on GNU/Linux systems.
  Previously no error and no entries were output, and so indistinguishable
  from an empty directory, with default ls options.
  uniq no longer uses strcoll() to determine string equivalence,
  and so will operate more efficiently and consistently.
  * * New Features
  ls now supports the --time=birth option to display and sort by
  file creation time, where available.
  od --skip-bytes now can use lseek even if the input is not a regular
  file, greatly improving performance in some cases.
  stat(1) supports a new --cached= option, used on systems with statx(2)
  to control cache coherency of file system attributes,
  useful on network file systems.
  * * Improvements
  stat and ls now use the statx() system call where available, which can
  operate more efficiently by only retrieving requested attributes.
  stat and tail now know about the "binderfs", "dma-buf-fs", "erofs",
  "ppc-cmm-fs", and "z3fold" file systems.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  * * Build-related
  gzip-compressed tarballs are distributed once again
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-invalid-ids.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils-i18n.patch:
  * uniq: remove collation handling as required by newer POSIX; see
  - https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8e81d44b5
  - https://www.austingroupbugs.net/view.php?id=963
- coreutils-ls-restore-8.31-behavior-on-removed-dirs.patch:
  * Add patch for 'ls' to restore 8.31 behavior on removed directories.
- coreutils.spec:
  * Version: bump version.
  * %check: re-enable regular 'make check' for non-multibuild package.
  * reference the above new patch.
- coreutils.keyring:
  * Update from upstream (Savannah).</changelog>
  <changelog author="dmueller@suse.com" date="1588593600">- add coreutils-use-python3.patch to minimally port away from
  python 2.x use of pyinotify in the testsuite</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1592049600">- coreutils-gnulib-disable-test-float.patch: Add patch to temporarily
  disable the gnulib test 'test-float' failing on ppc and ppc64le.
- coreutils.spec: Reference the patch.  While at it, avoid conditional
  Patch and Source entries as that break cross-platform builds from
  source RPMs.</changelog>
  <changelog author="dimstar@opensuse.org" date="1594900800">- Drop suse-module-tools BuildRequires: this was used for the macro
  regenerate_initrd_post/posttrans, which have been moved to
  rpm-config-SUSE in Jan 2019.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1598875200">- gnulib-test-avoid-FP-perror-strerror.patch: Add patch to
  avoid false-positive error in gnulib tests 'test-perror2' and
  'test-strerror_r', visible on armv7l.
- coreutils.spec: Reference the patch.</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="zpetrova@suse.com" date="1635163200">- coreutils-df-fuse-portal-dummy.patch:
  df: Add "fuse.portal" as a dummy file system (used in flatpak
  implementations). (bsc#1189152)</changelog>
  <changelog author="ailiop@suse.com" date="1706529600">- tail: fix tailing sysfs files where PAGE_SIZE &gt; BUFSIZ (bsc#1219321)
  - add coreutils-tail-fix-tailing-sysfs-files-where-PAGE_SIZE-BUFSIZ.patch</changelog>
  <changelog author="tabraham@suse.com" date="1712059200">- ls: avoid triggering automounts (bsc#1221632)
  - add coreutils-ls-avoid-triggering-automounts.patch</changelog>
</package>
<package pkgid="b9873aeb8487f07ff0ce0cd9283d785cd43c9b731c239b8a796fc47b69109471" name="coreutils-single" arch="s390x">
  <version epoch="0" ver="8.32" rel="150400.9.6.1"/>
  <changelog author="mail@bernhard-voelker.de" date="1493726400">- coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch:
  Add upstream patch to fix an heap overflow security issue
  in date(1) and touch(1) with a large TZ variable
  (CVE-2017-7476, rh#1444774, boo#1037124).</changelog>
  <changelog author="ghe@suse.com" date="1502884800">- Drop coreutils-ocfs2_reflinks.patch
  OCFS2 file system has supported file clone ioctls like btrfs,
  then, coreutils doesn't need this patch from the kernel v4.10-rc1</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1504526400">- Update to 8.28
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.keyring: Update from upstream (Savannah).
- Remove now-upstream patches:
  * coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch
  * coreutils-tests-port-to-timezone-2017a.patch
- coreutils.spec: Add "BuildRequires: user(bin)" for the tests.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1514462400">- Update to 8.29:
  * Noteworthy changes in release 8.29 (2017-12-27) [stable]
  * * Bug fixes
  b2sum no longer crashes when processing certain truncated check files.
  [bug introduced with b2sum coreutils-8.26]
  dd now ensures the correct cache ranges are specified for the "nocache"
  and "direct" flags.  Previously some pages in the page cache were not
  invalidated.  [bug introduced for "direct" in coreutils-7.5,
  and with the "nocache" implementation in coreutils-8.11]
  df no longer hangs when given a fifo argument.
  [bug introduced in coreutils-7.3]
  ptx -S no longer infloops for a pattern which returns zero-length matches.
  [the bug dates back to the initial implementation]
  shred --remove will again repeatedly rename files with shortening names
  to attempt to hide the original length of the file name.
  [bug introduced in coreutils-8.28]
  stty no longer crashes when processing settings with -F also specified.
  [bug introduced in fileutils-4.0]
  tail --bytes again supports non seekable inputs on all systems.
  On systems like android it always tried to process as seekable inputs.
  [bug introduced in coreutils-8.24]
  timeout will again notice its managed command exiting, even when
  invoked with blocked CHLD signal, or in a narrow window where
  this CHLD signal from the exiting child was missed.  In each case
  timeout would have then waited for the time limit to expire.
  [bug introduced in coreutils-8.27]
  * * New features
  timeout now supports the --verbose option to diagnose forced termination.
  * * Improvements
  dd now supports iflag=direct with arbitrary sized files on all file systems.
  tail --bytes=NUM will efficiently seek to the end of block devices,
  rather than reading from the start.
  Utilities which do not support long options (other than the default --help
  and --version), e.g. cksum and sleep, now use more consistent error diagnostic
  for unknown long options.
  * * Build-related
  Default man pages are now distributed which are used if perl is
  not available on the build system, or when cross compiling.
- Refresh patches (line number changes only):
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1530619200">- Update to 8.30:
  * Noteworthy changes in release 8.30 (2018-07-01) [stable]
  * * Bug fixes
  'cp --symlink SRC DST' will again correctly validate DST.
  If DST is a regular file and SRC is a symlink to DST,
  then cp will no longer allow that operation to clobber DST.
  Also with -d, if DST is a symlink, then it can always be replaced,
  even if it points to SRC on a separate device.
  [bugs introduced with coreutils-8.27]
  'cp -n -u' and 'mv -n -u' now consistently ignore the -u option.
  Previously, this option combination suffered from race conditions
  that caused -u to sometimes override -n.
  [bug introduced with coreutils-7.1]
  'cp -a --no-preserve=mode' now sets appropriate default permissions
  for non regular files like fifos and character device nodes etc.,
  and leaves mode bits of existing files unchanged.
  Previously it would have set executable bits on created special files,
  and set mode bits for existing files as if they had been created.
  [bug introduced with coreutils-8.20]
  'cp --remove-destination file symlink' now removes the symlink
  even if it can't be traversed.
  [bug introduced with --remove-destination in fileutils-4.1.1]
  ls no longer truncates the abbreviated month names that have a
  display width between 6 and 12 inclusive.  Previously this would have
  output ambiguous months for Arabic or Catalan locales.
  'ls -aA' is now equivalent to 'ls -A', since -A now overrides -a.
  [bug introduced in coreutils-5.3.0]
  'mv -n A B' no longer suffers from a race condition that can
  overwrite a simultaneously-created B.  This bug fix requires
  platform support for the renameat2 or renameatx_np syscalls, found
  in recent Linux and macOS kernels.  As a side effect, ‘mv -n A A’
  now silently does nothing if A exists.
  [bug introduced with coreutils-7.1]
  * * Changes in behavior
  'cp --force file symlink' now removes the symlink even if
  it is self referential.
  ls --color now matches file extensions case insensitively.
  * * New features
  cp --reflink now supports --reflink=never to enforce a standard copy.
  env supports a new -v/--debug option to show verbose information about
  each processing step.
  env supports a new -S/--split-string=S option to split a single argument
  string into multiple arguments. Used to pass multiple arguments in scripts
  (shebang lines).
  md5sum accepts a new option: --zero (-z) to delimit the output lines with a
  NUL instead of a newline character.  This also disables file name escaping.
  This also applies to sha*sum and b2sum.
  rm --preserve-root now supports the --preserve-root=all option to
  reject any command line argument that is mounted to a separate file system.
  * * Improvements
  cut supports line lengths up to the max file size on 32 bit systems.
  Previously only offsets up to SIZE_MAX-1 were supported.
  stat and tail now know about the "exfs" file system, which is a
  version of XFS.  stat -f --format=%T now reports the file system type,
  and tail -f uses inotify.
  wc avoids redundant processing of ASCII text in multibyte locales,
  which is especially significant on macOS.
  * * Build-related
  Adjust to glibc &gt;= 2.28  (bsc#1182550, jsc#SLE-13520, jsc#SLE-13756)
- Refresh patches (line number changes only):
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * (License): osc changed the value from "GPL-3.0+" to "GPL-3.0-or-later".
  * (build): Make sure that parse-datetime.{c,y} ends up in debuginfo (rh#1555079).
- coreutils-i18n.patch:
  * src/exand.c,src/unexpand.c: Avoid -Wcomment warning.
  * src/cut.c (cut_characters_or_cut_bytes_no_split): Change idx from size_t
    to uintmax_t type to avoid a regression on i586, armv7l and ppc.
    Compare upstream, non-MB commit:
    https://git.sv.gnu.org/cgit/coreutils.git/commit/?id=d1a754c8272
    (cut_fields_mb): Likewise for field_idx.
  * tests/misc/cut.pl: Remove downstream tweaks as upstream MB tests are
    working since a while.
- coreutils.keyring: Update Assaf Gordon's GPG public key.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1552305600">- Update to 8.31:
  * Noteworthy changes in release 8.31 (2019-03-10) [stable]
  * * Bug fixes
  'base64 a b' now correctly diagnoses 'b' as the extra operand, not 'a'.
  [bug introduced in coreutils-5.3.0]
  When B already exists, 'cp -il A B' no longer immediately fails
  after asking the user whether to proceed.
  [This bug was present in "the beginning".]
  df no longer corrupts displayed multibyte characters on macOS.
  [bug introduced with coreutils-8.18]
  seq no longer outputs inconsistent decimal point characters
  for the last number, when locales are misconfigured.
  [bug introduced in coreutils-7.0]
  shred, sort, and split no longer falsely report ftruncate errors
  when outputting to less-common file types.  For example, the shell
  command 'sort /dev/null -o /dev/stdout | cat' no longer fails with
  an "error truncating" diagnostic.
  [bug was introduced with coreutils-8.18 for sort and split, and
  (for shared memory objects only) with fileutils-4.1 for shred]
  sync no longer fails for write-only file arguments.
  [bug introduced with argument support to sync in coreutils-8.24]
  'tail -f file | filter' no longer exits immediately on AIX.
  [bug introduced in coreutils-8.28]
  'tail -f file | filter' no longer goes into an infinite loop
  if filter exits and SIGPIPE is ignored.
  [bug introduced in coreutils-8.28]
  * * Changes in behavior
  cksum, dd, hostid, hostname, link, logname, sleep, tsort, unlink,
  uptime, users, whoami, yes: now always process --help and --version options,
  regardless of any other arguments present before any optional '--'
  end-of-options marker.
  nohup now processes --help and --version as first options even if other
  parameters follow.
  'yes a -- b' now outputs 'a b' instead of including the end-of-options
  marker as before: 'a -- b'.
  echo now always processes backslash escapes when the POSIXLY_CORRECT
  environment variable is set.
  When possible 'ln A B' now merely links A to B and reports an error
  if this fails, instead of statting A and B before linking.  This
  uses fewer system calls and avoids some races.  The old statting
  approach is still used in situations where hard links to directories
  are allowed (e.g., NetBSD when superuser).
  ls --group-directories-first will also group symlinks to directories.
  'test -a FILE' is not supported anymore.  Long ago, there were concerns about
  the high probability of humans confusing the -a primary with the -a binary
  operator, so POSIX changed this to 'test -e FILE'.  Scripts using it were
  already broken and non-portable; the -a unary operator was never documented.
  wc now treats non breaking space characters as word delimiters
  unless the POSIXLY_CORRECT environment variable is set.
  * * New features
  id now supports specifying multiple users.
  'date' now supports the '+' conversion specification flag,
  introduced in POSIX.1-2017.
  printf, seq, sleep, tail, and timeout now accept floating point
  numbers in either the current or the C locale.  For example, if the
  current locale's decimal point is ',', 'sleep 0,1' and 'sleep 0.1'
  now mean the same thing.  Previously, these commands accepted only
  C-locale syntax with '.' as the decimal point.  The new behavior is
  more compatible with other implementations in non-C locales.
  test now supports the '-N FILE' unary operator (like e.g. bash) to check
  whether FILE exists and has been modified since it was last read.
  env now supports '--default-signal[=SIG]', '--ignore-signal[=SIG]', and
  '--block-signal[=SIG], to setup signal handling before executing a program.
  env now supports '--list-signal-handling' to indicate non-default
  signal handling before executing a program.
  * * New commands
  basenc is added to complement existing base64,base32 commands,
  and encodes and decodes printable text using various common encodings:
  base64,base64url,base32,base32hex,base16,base2,z85.
  * * Improvements
  ls -l now better aligns abbreviated months containing digits,
  which is common in Asian locales.
  stat and tail now know about the "sdcardfs" file system on Android.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  stat now prints file creation time when supported by the file system,
  on GNU Linux systems with glibc &gt;= 2.28 and kernel &gt;= 4.11.
- Refresh patches (line number changes only):
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-misc.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * Version: bump version.
  * URL: Use https scheme.
  * %description: Add 'basenc' tool.
  * Change gitweb to cgit URL with https in a comment.
- coreutils.keyring:
  * Update for added section headers ('GPG keys of &lt;MAINTAINER&gt;').</changelog>
  <changelog author="lnussel@suse.de" date="1568894400">- Do not recommend lang package. The lang package already has a
  supplements.</changelog>
  <changelog author="lnussel@suse.de" date="1578571200">- switch to multibuild
- add coreutils-single subpackage that contains a single binary coreutils tool
  similar to busybox
- package LC_CTIME directories also in lang package
- split off doc package
- remove info macros, handled by file trigger nowadays</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1579521600">- minor: remove obsolete comment in spec file.</changelog>
  <changelog author="lnussel@suse.de" date="1580212800">- disable single and testsuite builds in rings/staging
- remove duplicate "coreutils" in flavor to make it look nicer in OBS</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1583755200">- Update to 8.32:
  * Noteworthy changes in release 8.32 (2020-03-05) [stable]
  * * Bug fixes
  cp now copies /dev/fd/N correctly on platforms like Solaris where
  it is a character-special file whose minor device number is N.
  [bug introduced in fileutils-4.1.6]
  dd conv=fdatasync no longer reports a "Bad file descriptor" error
  when fdatasync is interrupted, and dd now retries interrupted calls
  to close, fdatasync, fstat and fsync instead of incorrectly
  reporting an "Interrupted system call" error.
  [bugs introduced in coreutils-6.0]
  df now correctly parses the /proc/self/mountinfo file for unusual entries
  like ones with '\r' in a field value ("mount -t tmpfs tmpfs /foo$'\r'bar"),
  when the source field is empty ('mount -t tmpfs "" /mnt'), and when the
  filesystem type contains characters like a blank which need escaping.
  [bugs introduced in coreutils-8.24 with the introduction of reading
  the /proc/self/mountinfo file]
  factor again outputs immediately when stdout is a tty but stdin is not.
  [bug introduced in coreutils-8.24]
  ln works again on old systems without O_DIRECTORY support (like Solaris 10),
  and on systems where symlink ("x", ".") fails with errno == EINVAL
  (like Solaris 10 and Solaris 11).
  [bug introduced in coreutils-8.31]
  rmdir --ignore-fail-on-non-empty now works correctly for directories
  that fail to be removed due to permission issues.  Previously the exit status
  was reversed, failing for non empty and succeeding for empty directories.
  [bug introduced in coreutils-6.11]
  'shuf -r -n 0 file' no longer mistakenly reads from standard input.
  [bug introduced with the --repeat feature in coreutils-8.22]
  split no longer reports a "output file suffixes exhausted" error
  when the specified number of files is evenly divisible by 10, 16, 26,
  for --numeric, --hex, or default alphabetic suffixes respectively.
  [bug introduced in coreutils-8.24]
  seq no longer prints an extra line under certain circumstances (such as
  'seq -f "%g " 1000000 1000000').
  [bug introduced in coreutils-6.10]
  * * Changes in behavior
  Several programs now check that numbers end properly.  For example,
  'du -d 1x' now reports an error instead of silently ignoring the 'x'.
  Affected programs and options include du -d, expr's numeric operands
  on non-GMP builds, install -g and -o, ls's TABSIZE environment
  variable, mknod b and c, ptx -g and -w, shuf -n, and sort --batch-size
  and --parallel.
  date now parses military time zones in accordance with common usage:
    "A" to "M"  are equivalent to UTC+1 to UTC+12
    "N" to "Y"  are equivalent to UTC-1 to UTC-12
    "Z" is "zulu" time (UTC).
  For example, 'date -d "09:00B" is now equivalent to 9am in UTC+2 time zone.
  Previously, military time zones were parsed according to the obsolete
  rfc822, with their value negated (e.g., "B" was equivalent to UTC-2).
  [The old behavior was introduced in sh-utils 2.0.15 ca. 1999, predating
  coreutils package.]
  ls issues an error message on a removed directory, on GNU/Linux systems.
  Previously no error and no entries were output, and so indistinguishable
  from an empty directory, with default ls options.
  uniq no longer uses strcoll() to determine string equivalence,
  and so will operate more efficiently and consistently.
  * * New Features
  ls now supports the --time=birth option to display and sort by
  file creation time, where available.
  od --skip-bytes now can use lseek even if the input is not a regular
  file, greatly improving performance in some cases.
  stat(1) supports a new --cached= option, used on systems with statx(2)
  to control cache coherency of file system attributes,
  useful on network file systems.
  * * Improvements
  stat and ls now use the statx() system call where available, which can
  operate more efficiently by only retrieving requested attributes.
  stat and tail now know about the "binderfs", "dma-buf-fs", "erofs",
  "ppc-cmm-fs", and "z3fold" file systems.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  * * Build-related
  gzip-compressed tarballs are distributed once again
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-invalid-ids.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils-i18n.patch:
  * uniq: remove collation handling as required by newer POSIX; see
  - https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8e81d44b5
  - https://www.austingroupbugs.net/view.php?id=963
- coreutils-ls-restore-8.31-behavior-on-removed-dirs.patch:
  * Add patch for 'ls' to restore 8.31 behavior on removed directories.
- coreutils.spec:
  * Version: bump version.
  * %check: re-enable regular 'make check' for non-multibuild package.
  * reference the above new patch.
- coreutils.keyring:
  * Update from upstream (Savannah).</changelog>
  <changelog author="dmueller@suse.com" date="1588593600">- add coreutils-use-python3.patch to minimally port away from
  python 2.x use of pyinotify in the testsuite</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1592049600">- coreutils-gnulib-disable-test-float.patch: Add patch to temporarily
  disable the gnulib test 'test-float' failing on ppc and ppc64le.
- coreutils.spec: Reference the patch.  While at it, avoid conditional
  Patch and Source entries as that break cross-platform builds from
  source RPMs.</changelog>
  <changelog author="dimstar@opensuse.org" date="1594900800">- Drop suse-module-tools BuildRequires: this was used for the macro
  regenerate_initrd_post/posttrans, which have been moved to
  rpm-config-SUSE in Jan 2019.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1598875200">- gnulib-test-avoid-FP-perror-strerror.patch: Add patch to
  avoid false-positive error in gnulib tests 'test-perror2' and
  'test-strerror_r', visible on armv7l.
- coreutils.spec: Reference the patch.</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="zpetrova@suse.com" date="1635163200">- coreutils-df-fuse-portal-dummy.patch:
  df: Add "fuse.portal" as a dummy file system (used in flatpak
  implementations). (bsc#1189152)</changelog>
  <changelog author="ailiop@suse.com" date="1706529600">- tail: fix tailing sysfs files where PAGE_SIZE &gt; BUFSIZ (bsc#1219321)
  - add coreutils-tail-fix-tailing-sysfs-files-where-PAGE_SIZE-BUFSIZ.patch</changelog>
  <changelog author="tabraham@suse.com" date="1712059200">- ls: avoid triggering automounts (bsc#1221632)
  - add coreutils-ls-avoid-triggering-automounts.patch</changelog>
</package>
<package pkgid="819a2198c0518e5e7ce8671fe8ab012d2b14859e725d0745201f768e95ff211b" name="coreutils-single" arch="src">
  <version epoch="0" ver="8.32" rel="150400.9.6.1"/>
  <changelog author="mail@bernhard-voelker.de" date="1493726400">- coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch:
  Add upstream patch to fix an heap overflow security issue
  in date(1) and touch(1) with a large TZ variable
  (CVE-2017-7476, rh#1444774, boo#1037124).</changelog>
  <changelog author="ghe@suse.com" date="1502884800">- Drop coreutils-ocfs2_reflinks.patch
  OCFS2 file system has supported file clone ioctls like btrfs,
  then, coreutils doesn't need this patch from the kernel v4.10-rc1</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1504526400">- Update to 8.28
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.keyring: Update from upstream (Savannah).
- Remove now-upstream patches:
  * coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch
  * coreutils-tests-port-to-timezone-2017a.patch
- coreutils.spec: Add "BuildRequires: user(bin)" for the tests.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1514462400">- Update to 8.29:
  * Noteworthy changes in release 8.29 (2017-12-27) [stable]
  * * Bug fixes
  b2sum no longer crashes when processing certain truncated check files.
  [bug introduced with b2sum coreutils-8.26]
  dd now ensures the correct cache ranges are specified for the "nocache"
  and "direct" flags.  Previously some pages in the page cache were not
  invalidated.  [bug introduced for "direct" in coreutils-7.5,
  and with the "nocache" implementation in coreutils-8.11]
  df no longer hangs when given a fifo argument.
  [bug introduced in coreutils-7.3]
  ptx -S no longer infloops for a pattern which returns zero-length matches.
  [the bug dates back to the initial implementation]
  shred --remove will again repeatedly rename files with shortening names
  to attempt to hide the original length of the file name.
  [bug introduced in coreutils-8.28]
  stty no longer crashes when processing settings with -F also specified.
  [bug introduced in fileutils-4.0]
  tail --bytes again supports non seekable inputs on all systems.
  On systems like android it always tried to process as seekable inputs.
  [bug introduced in coreutils-8.24]
  timeout will again notice its managed command exiting, even when
  invoked with blocked CHLD signal, or in a narrow window where
  this CHLD signal from the exiting child was missed.  In each case
  timeout would have then waited for the time limit to expire.
  [bug introduced in coreutils-8.27]
  * * New features
  timeout now supports the --verbose option to diagnose forced termination.
  * * Improvements
  dd now supports iflag=direct with arbitrary sized files on all file systems.
  tail --bytes=NUM will efficiently seek to the end of block devices,
  rather than reading from the start.
  Utilities which do not support long options (other than the default --help
  and --version), e.g. cksum and sleep, now use more consistent error diagnostic
  for unknown long options.
  * * Build-related
  Default man pages are now distributed which are used if perl is
  not available on the build system, or when cross compiling.
- Refresh patches (line number changes only):
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1530619200">- Update to 8.30:
  * Noteworthy changes in release 8.30 (2018-07-01) [stable]
  * * Bug fixes
  'cp --symlink SRC DST' will again correctly validate DST.
  If DST is a regular file and SRC is a symlink to DST,
  then cp will no longer allow that operation to clobber DST.
  Also with -d, if DST is a symlink, then it can always be replaced,
  even if it points to SRC on a separate device.
  [bugs introduced with coreutils-8.27]
  'cp -n -u' and 'mv -n -u' now consistently ignore the -u option.
  Previously, this option combination suffered from race conditions
  that caused -u to sometimes override -n.
  [bug introduced with coreutils-7.1]
  'cp -a --no-preserve=mode' now sets appropriate default permissions
  for non regular files like fifos and character device nodes etc.,
  and leaves mode bits of existing files unchanged.
  Previously it would have set executable bits on created special files,
  and set mode bits for existing files as if they had been created.
  [bug introduced with coreutils-8.20]
  'cp --remove-destination file symlink' now removes the symlink
  even if it can't be traversed.
  [bug introduced with --remove-destination in fileutils-4.1.1]
  ls no longer truncates the abbreviated month names that have a
  display width between 6 and 12 inclusive.  Previously this would have
  output ambiguous months for Arabic or Catalan locales.
  'ls -aA' is now equivalent to 'ls -A', since -A now overrides -a.
  [bug introduced in coreutils-5.3.0]
  'mv -n A B' no longer suffers from a race condition that can
  overwrite a simultaneously-created B.  This bug fix requires
  platform support for the renameat2 or renameatx_np syscalls, found
  in recent Linux and macOS kernels.  As a side effect, ‘mv -n A A’
  now silently does nothing if A exists.
  [bug introduced with coreutils-7.1]
  * * Changes in behavior
  'cp --force file symlink' now removes the symlink even if
  it is self referential.
  ls --color now matches file extensions case insensitively.
  * * New features
  cp --reflink now supports --reflink=never to enforce a standard copy.
  env supports a new -v/--debug option to show verbose information about
  each processing step.
  env supports a new -S/--split-string=S option to split a single argument
  string into multiple arguments. Used to pass multiple arguments in scripts
  (shebang lines).
  md5sum accepts a new option: --zero (-z) to delimit the output lines with a
  NUL instead of a newline character.  This also disables file name escaping.
  This also applies to sha*sum and b2sum.
  rm --preserve-root now supports the --preserve-root=all option to
  reject any command line argument that is mounted to a separate file system.
  * * Improvements
  cut supports line lengths up to the max file size on 32 bit systems.
  Previously only offsets up to SIZE_MAX-1 were supported.
  stat and tail now know about the "exfs" file system, which is a
  version of XFS.  stat -f --format=%T now reports the file system type,
  and tail -f uses inotify.
  wc avoids redundant processing of ASCII text in multibyte locales,
  which is especially significant on macOS.
  * * Build-related
  Adjust to glibc &gt;= 2.28  (bsc#1182550, jsc#SLE-13520, jsc#SLE-13756)
- Refresh patches (line number changes only):
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * (License): osc changed the value from "GPL-3.0+" to "GPL-3.0-or-later".
  * (build): Make sure that parse-datetime.{c,y} ends up in debuginfo (rh#1555079).
- coreutils-i18n.patch:
  * src/exand.c,src/unexpand.c: Avoid -Wcomment warning.
  * src/cut.c (cut_characters_or_cut_bytes_no_split): Change idx from size_t
    to uintmax_t type to avoid a regression on i586, armv7l and ppc.
    Compare upstream, non-MB commit:
    https://git.sv.gnu.org/cgit/coreutils.git/commit/?id=d1a754c8272
    (cut_fields_mb): Likewise for field_idx.
  * tests/misc/cut.pl: Remove downstream tweaks as upstream MB tests are
    working since a while.
- coreutils.keyring: Update Assaf Gordon's GPG public key.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1552305600">- Update to 8.31:
  * Noteworthy changes in release 8.31 (2019-03-10) [stable]
  * * Bug fixes
  'base64 a b' now correctly diagnoses 'b' as the extra operand, not 'a'.
  [bug introduced in coreutils-5.3.0]
  When B already exists, 'cp -il A B' no longer immediately fails
  after asking the user whether to proceed.
  [This bug was present in "the beginning".]
  df no longer corrupts displayed multibyte characters on macOS.
  [bug introduced with coreutils-8.18]
  seq no longer outputs inconsistent decimal point characters
  for the last number, when locales are misconfigured.
  [bug introduced in coreutils-7.0]
  shred, sort, and split no longer falsely report ftruncate errors
  when outputting to less-common file types.  For example, the shell
  command 'sort /dev/null -o /dev/stdout | cat' no longer fails with
  an "error truncating" diagnostic.
  [bug was introduced with coreutils-8.18 for sort and split, and
  (for shared memory objects only) with fileutils-4.1 for shred]
  sync no longer fails for write-only file arguments.
  [bug introduced with argument support to sync in coreutils-8.24]
  'tail -f file | filter' no longer exits immediately on AIX.
  [bug introduced in coreutils-8.28]
  'tail -f file | filter' no longer goes into an infinite loop
  if filter exits and SIGPIPE is ignored.
  [bug introduced in coreutils-8.28]
  * * Changes in behavior
  cksum, dd, hostid, hostname, link, logname, sleep, tsort, unlink,
  uptime, users, whoami, yes: now always process --help and --version options,
  regardless of any other arguments present before any optional '--'
  end-of-options marker.
  nohup now processes --help and --version as first options even if other
  parameters follow.
  'yes a -- b' now outputs 'a b' instead of including the end-of-options
  marker as before: 'a -- b'.
  echo now always processes backslash escapes when the POSIXLY_CORRECT
  environment variable is set.
  When possible 'ln A B' now merely links A to B and reports an error
  if this fails, instead of statting A and B before linking.  This
  uses fewer system calls and avoids some races.  The old statting
  approach is still used in situations where hard links to directories
  are allowed (e.g., NetBSD when superuser).
  ls --group-directories-first will also group symlinks to directories.
  'test -a FILE' is not supported anymore.  Long ago, there were concerns about
  the high probability of humans confusing the -a primary with the -a binary
  operator, so POSIX changed this to 'test -e FILE'.  Scripts using it were
  already broken and non-portable; the -a unary operator was never documented.
  wc now treats non breaking space characters as word delimiters
  unless the POSIXLY_CORRECT environment variable is set.
  * * New features
  id now supports specifying multiple users.
  'date' now supports the '+' conversion specification flag,
  introduced in POSIX.1-2017.
  printf, seq, sleep, tail, and timeout now accept floating point
  numbers in either the current or the C locale.  For example, if the
  current locale's decimal point is ',', 'sleep 0,1' and 'sleep 0.1'
  now mean the same thing.  Previously, these commands accepted only
  C-locale syntax with '.' as the decimal point.  The new behavior is
  more compatible with other implementations in non-C locales.
  test now supports the '-N FILE' unary operator (like e.g. bash) to check
  whether FILE exists and has been modified since it was last read.
  env now supports '--default-signal[=SIG]', '--ignore-signal[=SIG]', and
  '--block-signal[=SIG], to setup signal handling before executing a program.
  env now supports '--list-signal-handling' to indicate non-default
  signal handling before executing a program.
  * * New commands
  basenc is added to complement existing base64,base32 commands,
  and encodes and decodes printable text using various common encodings:
  base64,base64url,base32,base32hex,base16,base2,z85.
  * * Improvements
  ls -l now better aligns abbreviated months containing digits,
  which is common in Asian locales.
  stat and tail now know about the "sdcardfs" file system on Android.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  stat now prints file creation time when supported by the file system,
  on GNU Linux systems with glibc &gt;= 2.28 and kernel &gt;= 4.11.
- Refresh patches (line number changes only):
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-misc.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * Version: bump version.
  * URL: Use https scheme.
  * %description: Add 'basenc' tool.
  * Change gitweb to cgit URL with https in a comment.
- coreutils.keyring:
  * Update for added section headers ('GPG keys of &lt;MAINTAINER&gt;').</changelog>
  <changelog author="lnussel@suse.de" date="1568894400">- Do not recommend lang package. The lang package already has a
  supplements.</changelog>
  <changelog author="lnussel@suse.de" date="1578571200">- switch to multibuild
- add coreutils-single subpackage that contains a single binary coreutils tool
  similar to busybox
- package LC_CTIME directories also in lang package
- split off doc package
- remove info macros, handled by file trigger nowadays</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1579521600">- minor: remove obsolete comment in spec file.</changelog>
  <changelog author="lnussel@suse.de" date="1580212800">- disable single and testsuite builds in rings/staging
- remove duplicate "coreutils" in flavor to make it look nicer in OBS</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1583755200">- Update to 8.32:
  * Noteworthy changes in release 8.32 (2020-03-05) [stable]
  * * Bug fixes
  cp now copies /dev/fd/N correctly on platforms like Solaris where
  it is a character-special file whose minor device number is N.
  [bug introduced in fileutils-4.1.6]
  dd conv=fdatasync no longer reports a "Bad file descriptor" error
  when fdatasync is interrupted, and dd now retries interrupted calls
  to close, fdatasync, fstat and fsync instead of incorrectly
  reporting an "Interrupted system call" error.
  [bugs introduced in coreutils-6.0]
  df now correctly parses the /proc/self/mountinfo file for unusual entries
  like ones with '\r' in a field value ("mount -t tmpfs tmpfs /foo$'\r'bar"),
  when the source field is empty ('mount -t tmpfs "" /mnt'), and when the
  filesystem type contains characters like a blank which need escaping.
  [bugs introduced in coreutils-8.24 with the introduction of reading
  the /proc/self/mountinfo file]
  factor again outputs immediately when stdout is a tty but stdin is not.
  [bug introduced in coreutils-8.24]
  ln works again on old systems without O_DIRECTORY support (like Solaris 10),
  and on systems where symlink ("x", ".") fails with errno == EINVAL
  (like Solaris 10 and Solaris 11).
  [bug introduced in coreutils-8.31]
  rmdir --ignore-fail-on-non-empty now works correctly for directories
  that fail to be removed due to permission issues.  Previously the exit status
  was reversed, failing for non empty and succeeding for empty directories.
  [bug introduced in coreutils-6.11]
  'shuf -r -n 0 file' no longer mistakenly reads from standard input.
  [bug introduced with the --repeat feature in coreutils-8.22]
  split no longer reports a "output file suffixes exhausted" error
  when the specified number of files is evenly divisible by 10, 16, 26,
  for --numeric, --hex, or default alphabetic suffixes respectively.
  [bug introduced in coreutils-8.24]
  seq no longer prints an extra line under certain circumstances (such as
  'seq -f "%g " 1000000 1000000').
  [bug introduced in coreutils-6.10]
  * * Changes in behavior
  Several programs now check that numbers end properly.  For example,
  'du -d 1x' now reports an error instead of silently ignoring the 'x'.
  Affected programs and options include du -d, expr's numeric operands
  on non-GMP builds, install -g and -o, ls's TABSIZE environment
  variable, mknod b and c, ptx -g and -w, shuf -n, and sort --batch-size
  and --parallel.
  date now parses military time zones in accordance with common usage:
    "A" to "M"  are equivalent to UTC+1 to UTC+12
    "N" to "Y"  are equivalent to UTC-1 to UTC-12
    "Z" is "zulu" time (UTC).
  For example, 'date -d "09:00B" is now equivalent to 9am in UTC+2 time zone.
  Previously, military time zones were parsed according to the obsolete
  rfc822, with their value negated (e.g., "B" was equivalent to UTC-2).
  [The old behavior was introduced in sh-utils 2.0.15 ca. 1999, predating
  coreutils package.]
  ls issues an error message on a removed directory, on GNU/Linux systems.
  Previously no error and no entries were output, and so indistinguishable
  from an empty directory, with default ls options.
  uniq no longer uses strcoll() to determine string equivalence,
  and so will operate more efficiently and consistently.
  * * New Features
  ls now supports the --time=birth option to display and sort by
  file creation time, where available.
  od --skip-bytes now can use lseek even if the input is not a regular
  file, greatly improving performance in some cases.
  stat(1) supports a new --cached= option, used on systems with statx(2)
  to control cache coherency of file system attributes,
  useful on network file systems.
  * * Improvements
  stat and ls now use the statx() system call where available, which can
  operate more efficiently by only retrieving requested attributes.
  stat and tail now know about the "binderfs", "dma-buf-fs", "erofs",
  "ppc-cmm-fs", and "z3fold" file systems.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  * * Build-related
  gzip-compressed tarballs are distributed once again
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-invalid-ids.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils-i18n.patch:
  * uniq: remove collation handling as required by newer POSIX; see
  - https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8e81d44b5
  - https://www.austingroupbugs.net/view.php?id=963
- coreutils-ls-restore-8.31-behavior-on-removed-dirs.patch:
  * Add patch for 'ls' to restore 8.31 behavior on removed directories.
- coreutils.spec:
  * Version: bump version.
  * %check: re-enable regular 'make check' for non-multibuild package.
  * reference the above new patch.
- coreutils.keyring:
  * Update from upstream (Savannah).</changelog>
  <changelog author="dmueller@suse.com" date="1588593600">- add coreutils-use-python3.patch to minimally port away from
  python 2.x use of pyinotify in the testsuite</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1592049600">- coreutils-gnulib-disable-test-float.patch: Add patch to temporarily
  disable the gnulib test 'test-float' failing on ppc and ppc64le.
- coreutils.spec: Reference the patch.  While at it, avoid conditional
  Patch and Source entries as that break cross-platform builds from
  source RPMs.</changelog>
  <changelog author="dimstar@opensuse.org" date="1594900800">- Drop suse-module-tools BuildRequires: this was used for the macro
  regenerate_initrd_post/posttrans, which have been moved to
  rpm-config-SUSE in Jan 2019.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1598875200">- gnulib-test-avoid-FP-perror-strerror.patch: Add patch to
  avoid false-positive error in gnulib tests 'test-perror2' and
  'test-strerror_r', visible on armv7l.
- coreutils.spec: Reference the patch.</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="zpetrova@suse.com" date="1635163200">- coreutils-df-fuse-portal-dummy.patch:
  df: Add "fuse.portal" as a dummy file system (used in flatpak
  implementations). (bsc#1189152)</changelog>
  <changelog author="ailiop@suse.com" date="1706529600">- tail: fix tailing sysfs files where PAGE_SIZE &gt; BUFSIZ (bsc#1219321)
  - add coreutils-tail-fix-tailing-sysfs-files-where-PAGE_SIZE-BUFSIZ.patch</changelog>
  <changelog author="tabraham@suse.com" date="1712059200">- ls: avoid triggering automounts (bsc#1221632)
  - add coreutils-ls-avoid-triggering-automounts.patch</changelog>
</package>
<package pkgid="dbe912da068f380e27793ea573b06ed9709e1cdf01de373a19aa098b742301ee" name="coreutils-single" arch="x86_64">
  <version epoch="0" ver="8.32" rel="150400.9.6.1"/>
  <changelog author="mail@bernhard-voelker.de" date="1493726400">- coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch:
  Add upstream patch to fix an heap overflow security issue
  in date(1) and touch(1) with a large TZ variable
  (CVE-2017-7476, rh#1444774, boo#1037124).</changelog>
  <changelog author="ghe@suse.com" date="1502884800">- Drop coreutils-ocfs2_reflinks.patch
  OCFS2 file system has supported file clone ioctls like btrfs,
  then, coreutils doesn't need this patch from the kernel v4.10-rc1</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1504526400">- Update to 8.28
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.keyring: Update from upstream (Savannah).
- Remove now-upstream patches:
  * coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch
  * coreutils-tests-port-to-timezone-2017a.patch
- coreutils.spec: Add "BuildRequires: user(bin)" for the tests.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1514462400">- Update to 8.29:
  * Noteworthy changes in release 8.29 (2017-12-27) [stable]
  * * Bug fixes
  b2sum no longer crashes when processing certain truncated check files.
  [bug introduced with b2sum coreutils-8.26]
  dd now ensures the correct cache ranges are specified for the "nocache"
  and "direct" flags.  Previously some pages in the page cache were not
  invalidated.  [bug introduced for "direct" in coreutils-7.5,
  and with the "nocache" implementation in coreutils-8.11]
  df no longer hangs when given a fifo argument.
  [bug introduced in coreutils-7.3]
  ptx -S no longer infloops for a pattern which returns zero-length matches.
  [the bug dates back to the initial implementation]
  shred --remove will again repeatedly rename files with shortening names
  to attempt to hide the original length of the file name.
  [bug introduced in coreutils-8.28]
  stty no longer crashes when processing settings with -F also specified.
  [bug introduced in fileutils-4.0]
  tail --bytes again supports non seekable inputs on all systems.
  On systems like android it always tried to process as seekable inputs.
  [bug introduced in coreutils-8.24]
  timeout will again notice its managed command exiting, even when
  invoked with blocked CHLD signal, or in a narrow window where
  this CHLD signal from the exiting child was missed.  In each case
  timeout would have then waited for the time limit to expire.
  [bug introduced in coreutils-8.27]
  * * New features
  timeout now supports the --verbose option to diagnose forced termination.
  * * Improvements
  dd now supports iflag=direct with arbitrary sized files on all file systems.
  tail --bytes=NUM will efficiently seek to the end of block devices,
  rather than reading from the start.
  Utilities which do not support long options (other than the default --help
  and --version), e.g. cksum and sleep, now use more consistent error diagnostic
  for unknown long options.
  * * Build-related
  Default man pages are now distributed which are used if perl is
  not available on the build system, or when cross compiling.
- Refresh patches (line number changes only):
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1530619200">- Update to 8.30:
  * Noteworthy changes in release 8.30 (2018-07-01) [stable]
  * * Bug fixes
  'cp --symlink SRC DST' will again correctly validate DST.
  If DST is a regular file and SRC is a symlink to DST,
  then cp will no longer allow that operation to clobber DST.
  Also with -d, if DST is a symlink, then it can always be replaced,
  even if it points to SRC on a separate device.
  [bugs introduced with coreutils-8.27]
  'cp -n -u' and 'mv -n -u' now consistently ignore the -u option.
  Previously, this option combination suffered from race conditions
  that caused -u to sometimes override -n.
  [bug introduced with coreutils-7.1]
  'cp -a --no-preserve=mode' now sets appropriate default permissions
  for non regular files like fifos and character device nodes etc.,
  and leaves mode bits of existing files unchanged.
  Previously it would have set executable bits on created special files,
  and set mode bits for existing files as if they had been created.
  [bug introduced with coreutils-8.20]
  'cp --remove-destination file symlink' now removes the symlink
  even if it can't be traversed.
  [bug introduced with --remove-destination in fileutils-4.1.1]
  ls no longer truncates the abbreviated month names that have a
  display width between 6 and 12 inclusive.  Previously this would have
  output ambiguous months for Arabic or Catalan locales.
  'ls -aA' is now equivalent to 'ls -A', since -A now overrides -a.
  [bug introduced in coreutils-5.3.0]
  'mv -n A B' no longer suffers from a race condition that can
  overwrite a simultaneously-created B.  This bug fix requires
  platform support for the renameat2 or renameatx_np syscalls, found
  in recent Linux and macOS kernels.  As a side effect, ‘mv -n A A’
  now silently does nothing if A exists.
  [bug introduced with coreutils-7.1]
  * * Changes in behavior
  'cp --force file symlink' now removes the symlink even if
  it is self referential.
  ls --color now matches file extensions case insensitively.
  * * New features
  cp --reflink now supports --reflink=never to enforce a standard copy.
  env supports a new -v/--debug option to show verbose information about
  each processing step.
  env supports a new -S/--split-string=S option to split a single argument
  string into multiple arguments. Used to pass multiple arguments in scripts
  (shebang lines).
  md5sum accepts a new option: --zero (-z) to delimit the output lines with a
  NUL instead of a newline character.  This also disables file name escaping.
  This also applies to sha*sum and b2sum.
  rm --preserve-root now supports the --preserve-root=all option to
  reject any command line argument that is mounted to a separate file system.
  * * Improvements
  cut supports line lengths up to the max file size on 32 bit systems.
  Previously only offsets up to SIZE_MAX-1 were supported.
  stat and tail now know about the "exfs" file system, which is a
  version of XFS.  stat -f --format=%T now reports the file system type,
  and tail -f uses inotify.
  wc avoids redundant processing of ASCII text in multibyte locales,
  which is especially significant on macOS.
  * * Build-related
  Adjust to glibc &gt;= 2.28  (bsc#1182550, jsc#SLE-13520, jsc#SLE-13756)
- Refresh patches (line number changes only):
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * (License): osc changed the value from "GPL-3.0+" to "GPL-3.0-or-later".
  * (build): Make sure that parse-datetime.{c,y} ends up in debuginfo (rh#1555079).
- coreutils-i18n.patch:
  * src/exand.c,src/unexpand.c: Avoid -Wcomment warning.
  * src/cut.c (cut_characters_or_cut_bytes_no_split): Change idx from size_t
    to uintmax_t type to avoid a regression on i586, armv7l and ppc.
    Compare upstream, non-MB commit:
    https://git.sv.gnu.org/cgit/coreutils.git/commit/?id=d1a754c8272
    (cut_fields_mb): Likewise for field_idx.
  * tests/misc/cut.pl: Remove downstream tweaks as upstream MB tests are
    working since a while.
- coreutils.keyring: Update Assaf Gordon's GPG public key.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1552305600">- Update to 8.31:
  * Noteworthy changes in release 8.31 (2019-03-10) [stable]
  * * Bug fixes
  'base64 a b' now correctly diagnoses 'b' as the extra operand, not 'a'.
  [bug introduced in coreutils-5.3.0]
  When B already exists, 'cp -il A B' no longer immediately fails
  after asking the user whether to proceed.
  [This bug was present in "the beginning".]
  df no longer corrupts displayed multibyte characters on macOS.
  [bug introduced with coreutils-8.18]
  seq no longer outputs inconsistent decimal point characters
  for the last number, when locales are misconfigured.
  [bug introduced in coreutils-7.0]
  shred, sort, and split no longer falsely report ftruncate errors
  when outputting to less-common file types.  For example, the shell
  command 'sort /dev/null -o /dev/stdout | cat' no longer fails with
  an "error truncating" diagnostic.
  [bug was introduced with coreutils-8.18 for sort and split, and
  (for shared memory objects only) with fileutils-4.1 for shred]
  sync no longer fails for write-only file arguments.
  [bug introduced with argument support to sync in coreutils-8.24]
  'tail -f file | filter' no longer exits immediately on AIX.
  [bug introduced in coreutils-8.28]
  'tail -f file | filter' no longer goes into an infinite loop
  if filter exits and SIGPIPE is ignored.
  [bug introduced in coreutils-8.28]
  * * Changes in behavior
  cksum, dd, hostid, hostname, link, logname, sleep, tsort, unlink,
  uptime, users, whoami, yes: now always process --help and --version options,
  regardless of any other arguments present before any optional '--'
  end-of-options marker.
  nohup now processes --help and --version as first options even if other
  parameters follow.
  'yes a -- b' now outputs 'a b' instead of including the end-of-options
  marker as before: 'a -- b'.
  echo now always processes backslash escapes when the POSIXLY_CORRECT
  environment variable is set.
  When possible 'ln A B' now merely links A to B and reports an error
  if this fails, instead of statting A and B before linking.  This
  uses fewer system calls and avoids some races.  The old statting
  approach is still used in situations where hard links to directories
  are allowed (e.g., NetBSD when superuser).
  ls --group-directories-first will also group symlinks to directories.
  'test -a FILE' is not supported anymore.  Long ago, there were concerns about
  the high probability of humans confusing the -a primary with the -a binary
  operator, so POSIX changed this to 'test -e FILE'.  Scripts using it were
  already broken and non-portable; the -a unary operator was never documented.
  wc now treats non breaking space characters as word delimiters
  unless the POSIXLY_CORRECT environment variable is set.
  * * New features
  id now supports specifying multiple users.
  'date' now supports the '+' conversion specification flag,
  introduced in POSIX.1-2017.
  printf, seq, sleep, tail, and timeout now accept floating point
  numbers in either the current or the C locale.  For example, if the
  current locale's decimal point is ',', 'sleep 0,1' and 'sleep 0.1'
  now mean the same thing.  Previously, these commands accepted only
  C-locale syntax with '.' as the decimal point.  The new behavior is
  more compatible with other implementations in non-C locales.
  test now supports the '-N FILE' unary operator (like e.g. bash) to check
  whether FILE exists and has been modified since it was last read.
  env now supports '--default-signal[=SIG]', '--ignore-signal[=SIG]', and
  '--block-signal[=SIG], to setup signal handling before executing a program.
  env now supports '--list-signal-handling' to indicate non-default
  signal handling before executing a program.
  * * New commands
  basenc is added to complement existing base64,base32 commands,
  and encodes and decodes printable text using various common encodings:
  base64,base64url,base32,base32hex,base16,base2,z85.
  * * Improvements
  ls -l now better aligns abbreviated months containing digits,
  which is common in Asian locales.
  stat and tail now know about the "sdcardfs" file system on Android.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  stat now prints file creation time when supported by the file system,
  on GNU Linux systems with glibc &gt;= 2.28 and kernel &gt;= 4.11.
- Refresh patches (line number changes only):
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-misc.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * Version: bump version.
  * URL: Use https scheme.
  * %description: Add 'basenc' tool.
  * Change gitweb to cgit URL with https in a comment.
- coreutils.keyring:
  * Update for added section headers ('GPG keys of &lt;MAINTAINER&gt;').</changelog>
  <changelog author="lnussel@suse.de" date="1568894400">- Do not recommend lang package. The lang package already has a
  supplements.</changelog>
  <changelog author="lnussel@suse.de" date="1578571200">- switch to multibuild
- add coreutils-single subpackage that contains a single binary coreutils tool
  similar to busybox
- package LC_CTIME directories also in lang package
- split off doc package
- remove info macros, handled by file trigger nowadays</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1579521600">- minor: remove obsolete comment in spec file.</changelog>
  <changelog author="lnussel@suse.de" date="1580212800">- disable single and testsuite builds in rings/staging
- remove duplicate "coreutils" in flavor to make it look nicer in OBS</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1583755200">- Update to 8.32:
  * Noteworthy changes in release 8.32 (2020-03-05) [stable]
  * * Bug fixes
  cp now copies /dev/fd/N correctly on platforms like Solaris where
  it is a character-special file whose minor device number is N.
  [bug introduced in fileutils-4.1.6]
  dd conv=fdatasync no longer reports a "Bad file descriptor" error
  when fdatasync is interrupted, and dd now retries interrupted calls
  to close, fdatasync, fstat and fsync instead of incorrectly
  reporting an "Interrupted system call" error.
  [bugs introduced in coreutils-6.0]
  df now correctly parses the /proc/self/mountinfo file for unusual entries
  like ones with '\r' in a field value ("mount -t tmpfs tmpfs /foo$'\r'bar"),
  when the source field is empty ('mount -t tmpfs "" /mnt'), and when the
  filesystem type contains characters like a blank which need escaping.
  [bugs introduced in coreutils-8.24 with the introduction of reading
  the /proc/self/mountinfo file]
  factor again outputs immediately when stdout is a tty but stdin is not.
  [bug introduced in coreutils-8.24]
  ln works again on old systems without O_DIRECTORY support (like Solaris 10),
  and on systems where symlink ("x", ".") fails with errno == EINVAL
  (like Solaris 10 and Solaris 11).
  [bug introduced in coreutils-8.31]
  rmdir --ignore-fail-on-non-empty now works correctly for directories
  that fail to be removed due to permission issues.  Previously the exit status
  was reversed, failing for non empty and succeeding for empty directories.
  [bug introduced in coreutils-6.11]
  'shuf -r -n 0 file' no longer mistakenly reads from standard input.
  [bug introduced with the --repeat feature in coreutils-8.22]
  split no longer reports a "output file suffixes exhausted" error
  when the specified number of files is evenly divisible by 10, 16, 26,
  for --numeric, --hex, or default alphabetic suffixes respectively.
  [bug introduced in coreutils-8.24]
  seq no longer prints an extra line under certain circumstances (such as
  'seq -f "%g " 1000000 1000000').
  [bug introduced in coreutils-6.10]
  * * Changes in behavior
  Several programs now check that numbers end properly.  For example,
  'du -d 1x' now reports an error instead of silently ignoring the 'x'.
  Affected programs and options include du -d, expr's numeric operands
  on non-GMP builds, install -g and -o, ls's TABSIZE environment
  variable, mknod b and c, ptx -g and -w, shuf -n, and sort --batch-size
  and --parallel.
  date now parses military time zones in accordance with common usage:
    "A" to "M"  are equivalent to UTC+1 to UTC+12
    "N" to "Y"  are equivalent to UTC-1 to UTC-12
    "Z" is "zulu" time (UTC).
  For example, 'date -d "09:00B" is now equivalent to 9am in UTC+2 time zone.
  Previously, military time zones were parsed according to the obsolete
  rfc822, with their value negated (e.g., "B" was equivalent to UTC-2).
  [The old behavior was introduced in sh-utils 2.0.15 ca. 1999, predating
  coreutils package.]
  ls issues an error message on a removed directory, on GNU/Linux systems.
  Previously no error and no entries were output, and so indistinguishable
  from an empty directory, with default ls options.
  uniq no longer uses strcoll() to determine string equivalence,
  and so will operate more efficiently and consistently.
  * * New Features
  ls now supports the --time=birth option to display and sort by
  file creation time, where available.
  od --skip-bytes now can use lseek even if the input is not a regular
  file, greatly improving performance in some cases.
  stat(1) supports a new --cached= option, used on systems with statx(2)
  to control cache coherency of file system attributes,
  useful on network file systems.
  * * Improvements
  stat and ls now use the statx() system call where available, which can
  operate more efficiently by only retrieving requested attributes.
  stat and tail now know about the "binderfs", "dma-buf-fs", "erofs",
  "ppc-cmm-fs", and "z3fold" file systems.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  * * Build-related
  gzip-compressed tarballs are distributed once again
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-invalid-ids.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils-i18n.patch:
  * uniq: remove collation handling as required by newer POSIX; see
  - https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8e81d44b5
  - https://www.austingroupbugs.net/view.php?id=963
- coreutils-ls-restore-8.31-behavior-on-removed-dirs.patch:
  * Add patch for 'ls' to restore 8.31 behavior on removed directories.
- coreutils.spec:
  * Version: bump version.
  * %check: re-enable regular 'make check' for non-multibuild package.
  * reference the above new patch.
- coreutils.keyring:
  * Update from upstream (Savannah).</changelog>
  <changelog author="dmueller@suse.com" date="1588593600">- add coreutils-use-python3.patch to minimally port away from
  python 2.x use of pyinotify in the testsuite</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1592049600">- coreutils-gnulib-disable-test-float.patch: Add patch to temporarily
  disable the gnulib test 'test-float' failing on ppc and ppc64le.
- coreutils.spec: Reference the patch.  While at it, avoid conditional
  Patch and Source entries as that break cross-platform builds from
  source RPMs.</changelog>
  <changelog author="dimstar@opensuse.org" date="1594900800">- Drop suse-module-tools BuildRequires: this was used for the macro
  regenerate_initrd_post/posttrans, which have been moved to
  rpm-config-SUSE in Jan 2019.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1598875200">- gnulib-test-avoid-FP-perror-strerror.patch: Add patch to
  avoid false-positive error in gnulib tests 'test-perror2' and
  'test-strerror_r', visible on armv7l.
- coreutils.spec: Reference the patch.</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="zpetrova@suse.com" date="1635163200">- coreutils-df-fuse-portal-dummy.patch:
  df: Add "fuse.portal" as a dummy file system (used in flatpak
  implementations). (bsc#1189152)</changelog>
  <changelog author="ailiop@suse.com" date="1706529600">- tail: fix tailing sysfs files where PAGE_SIZE &gt; BUFSIZ (bsc#1219321)
  - add coreutils-tail-fix-tailing-sysfs-files-where-PAGE_SIZE-BUFSIZ.patch</changelog>
  <changelog author="tabraham@suse.com" date="1712059200">- ls: avoid triggering automounts (bsc#1221632)
  - add coreutils-ls-avoid-triggering-automounts.patch</changelog>
</package>
<package pkgid="95684706fe9ec050dfac3cc502b05cd707ebc323019d47c49e6156041a525668" name="coreutils-testsuite" arch="aarch64">
  <version epoch="0" ver="8.32" rel="150400.9.6.2"/>
  <changelog author="mail@bernhard-voelker.de" date="1493726400">- coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch:
  Add upstream patch to fix an heap overflow security issue
  in date(1) and touch(1) with a large TZ variable
  (CVE-2017-7476, rh#1444774, boo#1037124).</changelog>
  <changelog author="ghe@suse.com" date="1502884800">- Drop coreutils-ocfs2_reflinks.patch
  OCFS2 file system has supported file clone ioctls like btrfs,
  then, coreutils doesn't need this patch from the kernel v4.10-rc1</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1504526400">- Update to 8.28
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.keyring: Update from upstream (Savannah).
- Remove now-upstream patches:
  * coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch
  * coreutils-tests-port-to-timezone-2017a.patch
- coreutils.spec: Add "BuildRequires: user(bin)" for the tests.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1514462400">- Update to 8.29:
  * Noteworthy changes in release 8.29 (2017-12-27) [stable]
  * * Bug fixes
  b2sum no longer crashes when processing certain truncated check files.
  [bug introduced with b2sum coreutils-8.26]
  dd now ensures the correct cache ranges are specified for the "nocache"
  and "direct" flags.  Previously some pages in the page cache were not
  invalidated.  [bug introduced for "direct" in coreutils-7.5,
  and with the "nocache" implementation in coreutils-8.11]
  df no longer hangs when given a fifo argument.
  [bug introduced in coreutils-7.3]
  ptx -S no longer infloops for a pattern which returns zero-length matches.
  [the bug dates back to the initial implementation]
  shred --remove will again repeatedly rename files with shortening names
  to attempt to hide the original length of the file name.
  [bug introduced in coreutils-8.28]
  stty no longer crashes when processing settings with -F also specified.
  [bug introduced in fileutils-4.0]
  tail --bytes again supports non seekable inputs on all systems.
  On systems like android it always tried to process as seekable inputs.
  [bug introduced in coreutils-8.24]
  timeout will again notice its managed command exiting, even when
  invoked with blocked CHLD signal, or in a narrow window where
  this CHLD signal from the exiting child was missed.  In each case
  timeout would have then waited for the time limit to expire.
  [bug introduced in coreutils-8.27]
  * * New features
  timeout now supports the --verbose option to diagnose forced termination.
  * * Improvements
  dd now supports iflag=direct with arbitrary sized files on all file systems.
  tail --bytes=NUM will efficiently seek to the end of block devices,
  rather than reading from the start.
  Utilities which do not support long options (other than the default --help
  and --version), e.g. cksum and sleep, now use more consistent error diagnostic
  for unknown long options.
  * * Build-related
  Default man pages are now distributed which are used if perl is
  not available on the build system, or when cross compiling.
- Refresh patches (line number changes only):
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1530619200">- Update to 8.30:
  * Noteworthy changes in release 8.30 (2018-07-01) [stable]
  * * Bug fixes
  'cp --symlink SRC DST' will again correctly validate DST.
  If DST is a regular file and SRC is a symlink to DST,
  then cp will no longer allow that operation to clobber DST.
  Also with -d, if DST is a symlink, then it can always be replaced,
  even if it points to SRC on a separate device.
  [bugs introduced with coreutils-8.27]
  'cp -n -u' and 'mv -n -u' now consistently ignore the -u option.
  Previously, this option combination suffered from race conditions
  that caused -u to sometimes override -n.
  [bug introduced with coreutils-7.1]
  'cp -a --no-preserve=mode' now sets appropriate default permissions
  for non regular files like fifos and character device nodes etc.,
  and leaves mode bits of existing files unchanged.
  Previously it would have set executable bits on created special files,
  and set mode bits for existing files as if they had been created.
  [bug introduced with coreutils-8.20]
  'cp --remove-destination file symlink' now removes the symlink
  even if it can't be traversed.
  [bug introduced with --remove-destination in fileutils-4.1.1]
  ls no longer truncates the abbreviated month names that have a
  display width between 6 and 12 inclusive.  Previously this would have
  output ambiguous months for Arabic or Catalan locales.
  'ls -aA' is now equivalent to 'ls -A', since -A now overrides -a.
  [bug introduced in coreutils-5.3.0]
  'mv -n A B' no longer suffers from a race condition that can
  overwrite a simultaneously-created B.  This bug fix requires
  platform support for the renameat2 or renameatx_np syscalls, found
  in recent Linux and macOS kernels.  As a side effect, ‘mv -n A A’
  now silently does nothing if A exists.
  [bug introduced with coreutils-7.1]
  * * Changes in behavior
  'cp --force file symlink' now removes the symlink even if
  it is self referential.
  ls --color now matches file extensions case insensitively.
  * * New features
  cp --reflink now supports --reflink=never to enforce a standard copy.
  env supports a new -v/--debug option to show verbose information about
  each processing step.
  env supports a new -S/--split-string=S option to split a single argument
  string into multiple arguments. Used to pass multiple arguments in scripts
  (shebang lines).
  md5sum accepts a new option: --zero (-z) to delimit the output lines with a
  NUL instead of a newline character.  This also disables file name escaping.
  This also applies to sha*sum and b2sum.
  rm --preserve-root now supports the --preserve-root=all option to
  reject any command line argument that is mounted to a separate file system.
  * * Improvements
  cut supports line lengths up to the max file size on 32 bit systems.
  Previously only offsets up to SIZE_MAX-1 were supported.
  stat and tail now know about the "exfs" file system, which is a
  version of XFS.  stat -f --format=%T now reports the file system type,
  and tail -f uses inotify.
  wc avoids redundant processing of ASCII text in multibyte locales,
  which is especially significant on macOS.
  * * Build-related
  Adjust to glibc &gt;= 2.28  (bsc#1182550, jsc#SLE-13520, jsc#SLE-13756)
- Refresh patches (line number changes only):
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * (License): osc changed the value from "GPL-3.0+" to "GPL-3.0-or-later".
  * (build): Make sure that parse-datetime.{c,y} ends up in debuginfo (rh#1555079).
- coreutils-i18n.patch:
  * src/exand.c,src/unexpand.c: Avoid -Wcomment warning.
  * src/cut.c (cut_characters_or_cut_bytes_no_split): Change idx from size_t
    to uintmax_t type to avoid a regression on i586, armv7l and ppc.
    Compare upstream, non-MB commit:
    https://git.sv.gnu.org/cgit/coreutils.git/commit/?id=d1a754c8272
    (cut_fields_mb): Likewise for field_idx.
  * tests/misc/cut.pl: Remove downstream tweaks as upstream MB tests are
    working since a while.
- coreutils.keyring: Update Assaf Gordon's GPG public key.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1552305600">- Update to 8.31:
  * Noteworthy changes in release 8.31 (2019-03-10) [stable]
  * * Bug fixes
  'base64 a b' now correctly diagnoses 'b' as the extra operand, not 'a'.
  [bug introduced in coreutils-5.3.0]
  When B already exists, 'cp -il A B' no longer immediately fails
  after asking the user whether to proceed.
  [This bug was present in "the beginning".]
  df no longer corrupts displayed multibyte characters on macOS.
  [bug introduced with coreutils-8.18]
  seq no longer outputs inconsistent decimal point characters
  for the last number, when locales are misconfigured.
  [bug introduced in coreutils-7.0]
  shred, sort, and split no longer falsely report ftruncate errors
  when outputting to less-common file types.  For example, the shell
  command 'sort /dev/null -o /dev/stdout | cat' no longer fails with
  an "error truncating" diagnostic.
  [bug was introduced with coreutils-8.18 for sort and split, and
  (for shared memory objects only) with fileutils-4.1 for shred]
  sync no longer fails for write-only file arguments.
  [bug introduced with argument support to sync in coreutils-8.24]
  'tail -f file | filter' no longer exits immediately on AIX.
  [bug introduced in coreutils-8.28]
  'tail -f file | filter' no longer goes into an infinite loop
  if filter exits and SIGPIPE is ignored.
  [bug introduced in coreutils-8.28]
  * * Changes in behavior
  cksum, dd, hostid, hostname, link, logname, sleep, tsort, unlink,
  uptime, users, whoami, yes: now always process --help and --version options,
  regardless of any other arguments present before any optional '--'
  end-of-options marker.
  nohup now processes --help and --version as first options even if other
  parameters follow.
  'yes a -- b' now outputs 'a b' instead of including the end-of-options
  marker as before: 'a -- b'.
  echo now always processes backslash escapes when the POSIXLY_CORRECT
  environment variable is set.
  When possible 'ln A B' now merely links A to B and reports an error
  if this fails, instead of statting A and B before linking.  This
  uses fewer system calls and avoids some races.  The old statting
  approach is still used in situations where hard links to directories
  are allowed (e.g., NetBSD when superuser).
  ls --group-directories-first will also group symlinks to directories.
  'test -a FILE' is not supported anymore.  Long ago, there were concerns about
  the high probability of humans confusing the -a primary with the -a binary
  operator, so POSIX changed this to 'test -e FILE'.  Scripts using it were
  already broken and non-portable; the -a unary operator was never documented.
  wc now treats non breaking space characters as word delimiters
  unless the POSIXLY_CORRECT environment variable is set.
  * * New features
  id now supports specifying multiple users.
  'date' now supports the '+' conversion specification flag,
  introduced in POSIX.1-2017.
  printf, seq, sleep, tail, and timeout now accept floating point
  numbers in either the current or the C locale.  For example, if the
  current locale's decimal point is ',', 'sleep 0,1' and 'sleep 0.1'
  now mean the same thing.  Previously, these commands accepted only
  C-locale syntax with '.' as the decimal point.  The new behavior is
  more compatible with other implementations in non-C locales.
  test now supports the '-N FILE' unary operator (like e.g. bash) to check
  whether FILE exists and has been modified since it was last read.
  env now supports '--default-signal[=SIG]', '--ignore-signal[=SIG]', and
  '--block-signal[=SIG], to setup signal handling before executing a program.
  env now supports '--list-signal-handling' to indicate non-default
  signal handling before executing a program.
  * * New commands
  basenc is added to complement existing base64,base32 commands,
  and encodes and decodes printable text using various common encodings:
  base64,base64url,base32,base32hex,base16,base2,z85.
  * * Improvements
  ls -l now better aligns abbreviated months containing digits,
  which is common in Asian locales.
  stat and tail now know about the "sdcardfs" file system on Android.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  stat now prints file creation time when supported by the file system,
  on GNU Linux systems with glibc &gt;= 2.28 and kernel &gt;= 4.11.
- Refresh patches (line number changes only):
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-misc.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * Version: bump version.
  * URL: Use https scheme.
  * %description: Add 'basenc' tool.
  * Change gitweb to cgit URL with https in a comment.
- coreutils.keyring:
  * Update for added section headers ('GPG keys of &lt;MAINTAINER&gt;').</changelog>
  <changelog author="lnussel@suse.de" date="1568894400">- Do not recommend lang package. The lang package already has a
  supplements.</changelog>
  <changelog author="lnussel@suse.de" date="1578571200">- switch to multibuild
- add coreutils-single subpackage that contains a single binary coreutils tool
  similar to busybox
- package LC_CTIME directories also in lang package
- split off doc package
- remove info macros, handled by file trigger nowadays</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1579521600">- minor: remove obsolete comment in spec file.</changelog>
  <changelog author="lnussel@suse.de" date="1580212800">- disable single and testsuite builds in rings/staging
- remove duplicate "coreutils" in flavor to make it look nicer in OBS</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1583755200">- Update to 8.32:
  * Noteworthy changes in release 8.32 (2020-03-05) [stable]
  * * Bug fixes
  cp now copies /dev/fd/N correctly on platforms like Solaris where
  it is a character-special file whose minor device number is N.
  [bug introduced in fileutils-4.1.6]
  dd conv=fdatasync no longer reports a "Bad file descriptor" error
  when fdatasync is interrupted, and dd now retries interrupted calls
  to close, fdatasync, fstat and fsync instead of incorrectly
  reporting an "Interrupted system call" error.
  [bugs introduced in coreutils-6.0]
  df now correctly parses the /proc/self/mountinfo file for unusual entries
  like ones with '\r' in a field value ("mount -t tmpfs tmpfs /foo$'\r'bar"),
  when the source field is empty ('mount -t tmpfs "" /mnt'), and when the
  filesystem type contains characters like a blank which need escaping.
  [bugs introduced in coreutils-8.24 with the introduction of reading
  the /proc/self/mountinfo file]
  factor again outputs immediately when stdout is a tty but stdin is not.
  [bug introduced in coreutils-8.24]
  ln works again on old systems without O_DIRECTORY support (like Solaris 10),
  and on systems where symlink ("x", ".") fails with errno == EINVAL
  (like Solaris 10 and Solaris 11).
  [bug introduced in coreutils-8.31]
  rmdir --ignore-fail-on-non-empty now works correctly for directories
  that fail to be removed due to permission issues.  Previously the exit status
  was reversed, failing for non empty and succeeding for empty directories.
  [bug introduced in coreutils-6.11]
  'shuf -r -n 0 file' no longer mistakenly reads from standard input.
  [bug introduced with the --repeat feature in coreutils-8.22]
  split no longer reports a "output file suffixes exhausted" error
  when the specified number of files is evenly divisible by 10, 16, 26,
  for --numeric, --hex, or default alphabetic suffixes respectively.
  [bug introduced in coreutils-8.24]
  seq no longer prints an extra line under certain circumstances (such as
  'seq -f "%g " 1000000 1000000').
  [bug introduced in coreutils-6.10]
  * * Changes in behavior
  Several programs now check that numbers end properly.  For example,
  'du -d 1x' now reports an error instead of silently ignoring the 'x'.
  Affected programs and options include du -d, expr's numeric operands
  on non-GMP builds, install -g and -o, ls's TABSIZE environment
  variable, mknod b and c, ptx -g and -w, shuf -n, and sort --batch-size
  and --parallel.
  date now parses military time zones in accordance with common usage:
    "A" to "M"  are equivalent to UTC+1 to UTC+12
    "N" to "Y"  are equivalent to UTC-1 to UTC-12
    "Z" is "zulu" time (UTC).
  For example, 'date -d "09:00B" is now equivalent to 9am in UTC+2 time zone.
  Previously, military time zones were parsed according to the obsolete
  rfc822, with their value negated (e.g., "B" was equivalent to UTC-2).
  [The old behavior was introduced in sh-utils 2.0.15 ca. 1999, predating
  coreutils package.]
  ls issues an error message on a removed directory, on GNU/Linux systems.
  Previously no error and no entries were output, and so indistinguishable
  from an empty directory, with default ls options.
  uniq no longer uses strcoll() to determine string equivalence,
  and so will operate more efficiently and consistently.
  * * New Features
  ls now supports the --time=birth option to display and sort by
  file creation time, where available.
  od --skip-bytes now can use lseek even if the input is not a regular
  file, greatly improving performance in some cases.
  stat(1) supports a new --cached= option, used on systems with statx(2)
  to control cache coherency of file system attributes,
  useful on network file systems.
  * * Improvements
  stat and ls now use the statx() system call where available, which can
  operate more efficiently by only retrieving requested attributes.
  stat and tail now know about the "binderfs", "dma-buf-fs", "erofs",
  "ppc-cmm-fs", and "z3fold" file systems.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  * * Build-related
  gzip-compressed tarballs are distributed once again
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-invalid-ids.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils-i18n.patch:
  * uniq: remove collation handling as required by newer POSIX; see
  - https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8e81d44b5
  - https://www.austingroupbugs.net/view.php?id=963
- coreutils-ls-restore-8.31-behavior-on-removed-dirs.patch:
  * Add patch for 'ls' to restore 8.31 behavior on removed directories.
- coreutils.spec:
  * Version: bump version.
  * %check: re-enable regular 'make check' for non-multibuild package.
  * reference the above new patch.
- coreutils.keyring:
  * Update from upstream (Savannah).</changelog>
  <changelog author="dmueller@suse.com" date="1588593600">- add coreutils-use-python3.patch to minimally port away from
  python 2.x use of pyinotify in the testsuite</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1592049600">- coreutils-gnulib-disable-test-float.patch: Add patch to temporarily
  disable the gnulib test 'test-float' failing on ppc and ppc64le.
- coreutils.spec: Reference the patch.  While at it, avoid conditional
  Patch and Source entries as that break cross-platform builds from
  source RPMs.</changelog>
  <changelog author="dimstar@opensuse.org" date="1594900800">- Drop suse-module-tools BuildRequires: this was used for the macro
  regenerate_initrd_post/posttrans, which have been moved to
  rpm-config-SUSE in Jan 2019.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1598875200">- gnulib-test-avoid-FP-perror-strerror.patch: Add patch to
  avoid false-positive error in gnulib tests 'test-perror2' and
  'test-strerror_r', visible on armv7l.
- coreutils.spec: Reference the patch.</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="zpetrova@suse.com" date="1635163200">- coreutils-df-fuse-portal-dummy.patch:
  df: Add "fuse.portal" as a dummy file system (used in flatpak
  implementations). (bsc#1189152)</changelog>
  <changelog author="ailiop@suse.com" date="1706529600">- tail: fix tailing sysfs files where PAGE_SIZE &gt; BUFSIZ (bsc#1219321)
  - add coreutils-tail-fix-tailing-sysfs-files-where-PAGE_SIZE-BUFSIZ.patch</changelog>
  <changelog author="tabraham@suse.com" date="1712059200">- ls: avoid triggering automounts (bsc#1221632)
  - add coreutils-ls-avoid-triggering-automounts.patch</changelog>
</package>
<package pkgid="f3ab1a0a03283bc58a2c6c5a6243c5ab146c5d46faca8026c84e646e711aac34" name="coreutils-testsuite" arch="ppc64le">
  <version epoch="0" ver="8.32" rel="150400.9.6.2"/>
  <changelog author="mail@bernhard-voelker.de" date="1493726400">- coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch:
  Add upstream patch to fix an heap overflow security issue
  in date(1) and touch(1) with a large TZ variable
  (CVE-2017-7476, rh#1444774, boo#1037124).</changelog>
  <changelog author="ghe@suse.com" date="1502884800">- Drop coreutils-ocfs2_reflinks.patch
  OCFS2 file system has supported file clone ioctls like btrfs,
  then, coreutils doesn't need this patch from the kernel v4.10-rc1</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1504526400">- Update to 8.28
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.keyring: Update from upstream (Savannah).
- Remove now-upstream patches:
  * coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch
  * coreutils-tests-port-to-timezone-2017a.patch
- coreutils.spec: Add "BuildRequires: user(bin)" for the tests.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1514462400">- Update to 8.29:
  * Noteworthy changes in release 8.29 (2017-12-27) [stable]
  * * Bug fixes
  b2sum no longer crashes when processing certain truncated check files.
  [bug introduced with b2sum coreutils-8.26]
  dd now ensures the correct cache ranges are specified for the "nocache"
  and "direct" flags.  Previously some pages in the page cache were not
  invalidated.  [bug introduced for "direct" in coreutils-7.5,
  and with the "nocache" implementation in coreutils-8.11]
  df no longer hangs when given a fifo argument.
  [bug introduced in coreutils-7.3]
  ptx -S no longer infloops for a pattern which returns zero-length matches.
  [the bug dates back to the initial implementation]
  shred --remove will again repeatedly rename files with shortening names
  to attempt to hide the original length of the file name.
  [bug introduced in coreutils-8.28]
  stty no longer crashes when processing settings with -F also specified.
  [bug introduced in fileutils-4.0]
  tail --bytes again supports non seekable inputs on all systems.
  On systems like android it always tried to process as seekable inputs.
  [bug introduced in coreutils-8.24]
  timeout will again notice its managed command exiting, even when
  invoked with blocked CHLD signal, or in a narrow window where
  this CHLD signal from the exiting child was missed.  In each case
  timeout would have then waited for the time limit to expire.
  [bug introduced in coreutils-8.27]
  * * New features
  timeout now supports the --verbose option to diagnose forced termination.
  * * Improvements
  dd now supports iflag=direct with arbitrary sized files on all file systems.
  tail --bytes=NUM will efficiently seek to the end of block devices,
  rather than reading from the start.
  Utilities which do not support long options (other than the default --help
  and --version), e.g. cksum and sleep, now use more consistent error diagnostic
  for unknown long options.
  * * Build-related
  Default man pages are now distributed which are used if perl is
  not available on the build system, or when cross compiling.
- Refresh patches (line number changes only):
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1530619200">- Update to 8.30:
  * Noteworthy changes in release 8.30 (2018-07-01) [stable]
  * * Bug fixes
  'cp --symlink SRC DST' will again correctly validate DST.
  If DST is a regular file and SRC is a symlink to DST,
  then cp will no longer allow that operation to clobber DST.
  Also with -d, if DST is a symlink, then it can always be replaced,
  even if it points to SRC on a separate device.
  [bugs introduced with coreutils-8.27]
  'cp -n -u' and 'mv -n -u' now consistently ignore the -u option.
  Previously, this option combination suffered from race conditions
  that caused -u to sometimes override -n.
  [bug introduced with coreutils-7.1]
  'cp -a --no-preserve=mode' now sets appropriate default permissions
  for non regular files like fifos and character device nodes etc.,
  and leaves mode bits of existing files unchanged.
  Previously it would have set executable bits on created special files,
  and set mode bits for existing files as if they had been created.
  [bug introduced with coreutils-8.20]
  'cp --remove-destination file symlink' now removes the symlink
  even if it can't be traversed.
  [bug introduced with --remove-destination in fileutils-4.1.1]
  ls no longer truncates the abbreviated month names that have a
  display width between 6 and 12 inclusive.  Previously this would have
  output ambiguous months for Arabic or Catalan locales.
  'ls -aA' is now equivalent to 'ls -A', since -A now overrides -a.
  [bug introduced in coreutils-5.3.0]
  'mv -n A B' no longer suffers from a race condition that can
  overwrite a simultaneously-created B.  This bug fix requires
  platform support for the renameat2 or renameatx_np syscalls, found
  in recent Linux and macOS kernels.  As a side effect, ‘mv -n A A’
  now silently does nothing if A exists.
  [bug introduced with coreutils-7.1]
  * * Changes in behavior
  'cp --force file symlink' now removes the symlink even if
  it is self referential.
  ls --color now matches file extensions case insensitively.
  * * New features
  cp --reflink now supports --reflink=never to enforce a standard copy.
  env supports a new -v/--debug option to show verbose information about
  each processing step.
  env supports a new -S/--split-string=S option to split a single argument
  string into multiple arguments. Used to pass multiple arguments in scripts
  (shebang lines).
  md5sum accepts a new option: --zero (-z) to delimit the output lines with a
  NUL instead of a newline character.  This also disables file name escaping.
  This also applies to sha*sum and b2sum.
  rm --preserve-root now supports the --preserve-root=all option to
  reject any command line argument that is mounted to a separate file system.
  * * Improvements
  cut supports line lengths up to the max file size on 32 bit systems.
  Previously only offsets up to SIZE_MAX-1 were supported.
  stat and tail now know about the "exfs" file system, which is a
  version of XFS.  stat -f --format=%T now reports the file system type,
  and tail -f uses inotify.
  wc avoids redundant processing of ASCII text in multibyte locales,
  which is especially significant on macOS.
  * * Build-related
  Adjust to glibc &gt;= 2.28  (bsc#1182550, jsc#SLE-13520, jsc#SLE-13756)
- Refresh patches (line number changes only):
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * (License): osc changed the value from "GPL-3.0+" to "GPL-3.0-or-later".
  * (build): Make sure that parse-datetime.{c,y} ends up in debuginfo (rh#1555079).
- coreutils-i18n.patch:
  * src/exand.c,src/unexpand.c: Avoid -Wcomment warning.
  * src/cut.c (cut_characters_or_cut_bytes_no_split): Change idx from size_t
    to uintmax_t type to avoid a regression on i586, armv7l and ppc.
    Compare upstream, non-MB commit:
    https://git.sv.gnu.org/cgit/coreutils.git/commit/?id=d1a754c8272
    (cut_fields_mb): Likewise for field_idx.
  * tests/misc/cut.pl: Remove downstream tweaks as upstream MB tests are
    working since a while.
- coreutils.keyring: Update Assaf Gordon's GPG public key.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1552305600">- Update to 8.31:
  * Noteworthy changes in release 8.31 (2019-03-10) [stable]
  * * Bug fixes
  'base64 a b' now correctly diagnoses 'b' as the extra operand, not 'a'.
  [bug introduced in coreutils-5.3.0]
  When B already exists, 'cp -il A B' no longer immediately fails
  after asking the user whether to proceed.
  [This bug was present in "the beginning".]
  df no longer corrupts displayed multibyte characters on macOS.
  [bug introduced with coreutils-8.18]
  seq no longer outputs inconsistent decimal point characters
  for the last number, when locales are misconfigured.
  [bug introduced in coreutils-7.0]
  shred, sort, and split no longer falsely report ftruncate errors
  when outputting to less-common file types.  For example, the shell
  command 'sort /dev/null -o /dev/stdout | cat' no longer fails with
  an "error truncating" diagnostic.
  [bug was introduced with coreutils-8.18 for sort and split, and
  (for shared memory objects only) with fileutils-4.1 for shred]
  sync no longer fails for write-only file arguments.
  [bug introduced with argument support to sync in coreutils-8.24]
  'tail -f file | filter' no longer exits immediately on AIX.
  [bug introduced in coreutils-8.28]
  'tail -f file | filter' no longer goes into an infinite loop
  if filter exits and SIGPIPE is ignored.
  [bug introduced in coreutils-8.28]
  * * Changes in behavior
  cksum, dd, hostid, hostname, link, logname, sleep, tsort, unlink,
  uptime, users, whoami, yes: now always process --help and --version options,
  regardless of any other arguments present before any optional '--'
  end-of-options marker.
  nohup now processes --help and --version as first options even if other
  parameters follow.
  'yes a -- b' now outputs 'a b' instead of including the end-of-options
  marker as before: 'a -- b'.
  echo now always processes backslash escapes when the POSIXLY_CORRECT
  environment variable is set.
  When possible 'ln A B' now merely links A to B and reports an error
  if this fails, instead of statting A and B before linking.  This
  uses fewer system calls and avoids some races.  The old statting
  approach is still used in situations where hard links to directories
  are allowed (e.g., NetBSD when superuser).
  ls --group-directories-first will also group symlinks to directories.
  'test -a FILE' is not supported anymore.  Long ago, there were concerns about
  the high probability of humans confusing the -a primary with the -a binary
  operator, so POSIX changed this to 'test -e FILE'.  Scripts using it were
  already broken and non-portable; the -a unary operator was never documented.
  wc now treats non breaking space characters as word delimiters
  unless the POSIXLY_CORRECT environment variable is set.
  * * New features
  id now supports specifying multiple users.
  'date' now supports the '+' conversion specification flag,
  introduced in POSIX.1-2017.
  printf, seq, sleep, tail, and timeout now accept floating point
  numbers in either the current or the C locale.  For example, if the
  current locale's decimal point is ',', 'sleep 0,1' and 'sleep 0.1'
  now mean the same thing.  Previously, these commands accepted only
  C-locale syntax with '.' as the decimal point.  The new behavior is
  more compatible with other implementations in non-C locales.
  test now supports the '-N FILE' unary operator (like e.g. bash) to check
  whether FILE exists and has been modified since it was last read.
  env now supports '--default-signal[=SIG]', '--ignore-signal[=SIG]', and
  '--block-signal[=SIG], to setup signal handling before executing a program.
  env now supports '--list-signal-handling' to indicate non-default
  signal handling before executing a program.
  * * New commands
  basenc is added to complement existing base64,base32 commands,
  and encodes and decodes printable text using various common encodings:
  base64,base64url,base32,base32hex,base16,base2,z85.
  * * Improvements
  ls -l now better aligns abbreviated months containing digits,
  which is common in Asian locales.
  stat and tail now know about the "sdcardfs" file system on Android.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  stat now prints file creation time when supported by the file system,
  on GNU Linux systems with glibc &gt;= 2.28 and kernel &gt;= 4.11.
- Refresh patches (line number changes only):
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-misc.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * Version: bump version.
  * URL: Use https scheme.
  * %description: Add 'basenc' tool.
  * Change gitweb to cgit URL with https in a comment.
- coreutils.keyring:
  * Update for added section headers ('GPG keys of &lt;MAINTAINER&gt;').</changelog>
  <changelog author="lnussel@suse.de" date="1568894400">- Do not recommend lang package. The lang package already has a
  supplements.</changelog>
  <changelog author="lnussel@suse.de" date="1578571200">- switch to multibuild
- add coreutils-single subpackage that contains a single binary coreutils tool
  similar to busybox
- package LC_CTIME directories also in lang package
- split off doc package
- remove info macros, handled by file trigger nowadays</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1579521600">- minor: remove obsolete comment in spec file.</changelog>
  <changelog author="lnussel@suse.de" date="1580212800">- disable single and testsuite builds in rings/staging
- remove duplicate "coreutils" in flavor to make it look nicer in OBS</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1583755200">- Update to 8.32:
  * Noteworthy changes in release 8.32 (2020-03-05) [stable]
  * * Bug fixes
  cp now copies /dev/fd/N correctly on platforms like Solaris where
  it is a character-special file whose minor device number is N.
  [bug introduced in fileutils-4.1.6]
  dd conv=fdatasync no longer reports a "Bad file descriptor" error
  when fdatasync is interrupted, and dd now retries interrupted calls
  to close, fdatasync, fstat and fsync instead of incorrectly
  reporting an "Interrupted system call" error.
  [bugs introduced in coreutils-6.0]
  df now correctly parses the /proc/self/mountinfo file for unusual entries
  like ones with '\r' in a field value ("mount -t tmpfs tmpfs /foo$'\r'bar"),
  when the source field is empty ('mount -t tmpfs "" /mnt'), and when the
  filesystem type contains characters like a blank which need escaping.
  [bugs introduced in coreutils-8.24 with the introduction of reading
  the /proc/self/mountinfo file]
  factor again outputs immediately when stdout is a tty but stdin is not.
  [bug introduced in coreutils-8.24]
  ln works again on old systems without O_DIRECTORY support (like Solaris 10),
  and on systems where symlink ("x", ".") fails with errno == EINVAL
  (like Solaris 10 and Solaris 11).
  [bug introduced in coreutils-8.31]
  rmdir --ignore-fail-on-non-empty now works correctly for directories
  that fail to be removed due to permission issues.  Previously the exit status
  was reversed, failing for non empty and succeeding for empty directories.
  [bug introduced in coreutils-6.11]
  'shuf -r -n 0 file' no longer mistakenly reads from standard input.
  [bug introduced with the --repeat feature in coreutils-8.22]
  split no longer reports a "output file suffixes exhausted" error
  when the specified number of files is evenly divisible by 10, 16, 26,
  for --numeric, --hex, or default alphabetic suffixes respectively.
  [bug introduced in coreutils-8.24]
  seq no longer prints an extra line under certain circumstances (such as
  'seq -f "%g " 1000000 1000000').
  [bug introduced in coreutils-6.10]
  * * Changes in behavior
  Several programs now check that numbers end properly.  For example,
  'du -d 1x' now reports an error instead of silently ignoring the 'x'.
  Affected programs and options include du -d, expr's numeric operands
  on non-GMP builds, install -g and -o, ls's TABSIZE environment
  variable, mknod b and c, ptx -g and -w, shuf -n, and sort --batch-size
  and --parallel.
  date now parses military time zones in accordance with common usage:
    "A" to "M"  are equivalent to UTC+1 to UTC+12
    "N" to "Y"  are equivalent to UTC-1 to UTC-12
    "Z" is "zulu" time (UTC).
  For example, 'date -d "09:00B" is now equivalent to 9am in UTC+2 time zone.
  Previously, military time zones were parsed according to the obsolete
  rfc822, with their value negated (e.g., "B" was equivalent to UTC-2).
  [The old behavior was introduced in sh-utils 2.0.15 ca. 1999, predating
  coreutils package.]
  ls issues an error message on a removed directory, on GNU/Linux systems.
  Previously no error and no entries were output, and so indistinguishable
  from an empty directory, with default ls options.
  uniq no longer uses strcoll() to determine string equivalence,
  and so will operate more efficiently and consistently.
  * * New Features
  ls now supports the --time=birth option to display and sort by
  file creation time, where available.
  od --skip-bytes now can use lseek even if the input is not a regular
  file, greatly improving performance in some cases.
  stat(1) supports a new --cached= option, used on systems with statx(2)
  to control cache coherency of file system attributes,
  useful on network file systems.
  * * Improvements
  stat and ls now use the statx() system call where available, which can
  operate more efficiently by only retrieving requested attributes.
  stat and tail now know about the "binderfs", "dma-buf-fs", "erofs",
  "ppc-cmm-fs", and "z3fold" file systems.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  * * Build-related
  gzip-compressed tarballs are distributed once again
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-invalid-ids.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils-i18n.patch:
  * uniq: remove collation handling as required by newer POSIX; see
  - https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8e81d44b5
  - https://www.austingroupbugs.net/view.php?id=963
- coreutils-ls-restore-8.31-behavior-on-removed-dirs.patch:
  * Add patch for 'ls' to restore 8.31 behavior on removed directories.
- coreutils.spec:
  * Version: bump version.
  * %check: re-enable regular 'make check' for non-multibuild package.
  * reference the above new patch.
- coreutils.keyring:
  * Update from upstream (Savannah).</changelog>
  <changelog author="dmueller@suse.com" date="1588593600">- add coreutils-use-python3.patch to minimally port away from
  python 2.x use of pyinotify in the testsuite</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1592049600">- coreutils-gnulib-disable-test-float.patch: Add patch to temporarily
  disable the gnulib test 'test-float' failing on ppc and ppc64le.
- coreutils.spec: Reference the patch.  While at it, avoid conditional
  Patch and Source entries as that break cross-platform builds from
  source RPMs.</changelog>
  <changelog author="dimstar@opensuse.org" date="1594900800">- Drop suse-module-tools BuildRequires: this was used for the macro
  regenerate_initrd_post/posttrans, which have been moved to
  rpm-config-SUSE in Jan 2019.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1598875200">- gnulib-test-avoid-FP-perror-strerror.patch: Add patch to
  avoid false-positive error in gnulib tests 'test-perror2' and
  'test-strerror_r', visible on armv7l.
- coreutils.spec: Reference the patch.</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="zpetrova@suse.com" date="1635163200">- coreutils-df-fuse-portal-dummy.patch:
  df: Add "fuse.portal" as a dummy file system (used in flatpak
  implementations). (bsc#1189152)</changelog>
  <changelog author="ailiop@suse.com" date="1706529600">- tail: fix tailing sysfs files where PAGE_SIZE &gt; BUFSIZ (bsc#1219321)
  - add coreutils-tail-fix-tailing-sysfs-files-where-PAGE_SIZE-BUFSIZ.patch</changelog>
  <changelog author="tabraham@suse.com" date="1712059200">- ls: avoid triggering automounts (bsc#1221632)
  - add coreutils-ls-avoid-triggering-automounts.patch</changelog>
</package>
<package pkgid="5d11f44f15557facd039aa48521abf1d44ba10e54511720fcc212faf835c5b23" name="coreutils-testsuite" arch="s390x">
  <version epoch="0" ver="8.32" rel="150400.9.6.2"/>
  <changelog author="mail@bernhard-voelker.de" date="1493726400">- coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch:
  Add upstream patch to fix an heap overflow security issue
  in date(1) and touch(1) with a large TZ variable
  (CVE-2017-7476, rh#1444774, boo#1037124).</changelog>
  <changelog author="ghe@suse.com" date="1502884800">- Drop coreutils-ocfs2_reflinks.patch
  OCFS2 file system has supported file clone ioctls like btrfs,
  then, coreutils doesn't need this patch from the kernel v4.10-rc1</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1504526400">- Update to 8.28
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.keyring: Update from upstream (Savannah).
- Remove now-upstream patches:
  * coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch
  * coreutils-tests-port-to-timezone-2017a.patch
- coreutils.spec: Add "BuildRequires: user(bin)" for the tests.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1514462400">- Update to 8.29:
  * Noteworthy changes in release 8.29 (2017-12-27) [stable]
  * * Bug fixes
  b2sum no longer crashes when processing certain truncated check files.
  [bug introduced with b2sum coreutils-8.26]
  dd now ensures the correct cache ranges are specified for the "nocache"
  and "direct" flags.  Previously some pages in the page cache were not
  invalidated.  [bug introduced for "direct" in coreutils-7.5,
  and with the "nocache" implementation in coreutils-8.11]
  df no longer hangs when given a fifo argument.
  [bug introduced in coreutils-7.3]
  ptx -S no longer infloops for a pattern which returns zero-length matches.
  [the bug dates back to the initial implementation]
  shred --remove will again repeatedly rename files with shortening names
  to attempt to hide the original length of the file name.
  [bug introduced in coreutils-8.28]
  stty no longer crashes when processing settings with -F also specified.
  [bug introduced in fileutils-4.0]
  tail --bytes again supports non seekable inputs on all systems.
  On systems like android it always tried to process as seekable inputs.
  [bug introduced in coreutils-8.24]
  timeout will again notice its managed command exiting, even when
  invoked with blocked CHLD signal, or in a narrow window where
  this CHLD signal from the exiting child was missed.  In each case
  timeout would have then waited for the time limit to expire.
  [bug introduced in coreutils-8.27]
  * * New features
  timeout now supports the --verbose option to diagnose forced termination.
  * * Improvements
  dd now supports iflag=direct with arbitrary sized files on all file systems.
  tail --bytes=NUM will efficiently seek to the end of block devices,
  rather than reading from the start.
  Utilities which do not support long options (other than the default --help
  and --version), e.g. cksum and sleep, now use more consistent error diagnostic
  for unknown long options.
  * * Build-related
  Default man pages are now distributed which are used if perl is
  not available on the build system, or when cross compiling.
- Refresh patches (line number changes only):
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1530619200">- Update to 8.30:
  * Noteworthy changes in release 8.30 (2018-07-01) [stable]
  * * Bug fixes
  'cp --symlink SRC DST' will again correctly validate DST.
  If DST is a regular file and SRC is a symlink to DST,
  then cp will no longer allow that operation to clobber DST.
  Also with -d, if DST is a symlink, then it can always be replaced,
  even if it points to SRC on a separate device.
  [bugs introduced with coreutils-8.27]
  'cp -n -u' and 'mv -n -u' now consistently ignore the -u option.
  Previously, this option combination suffered from race conditions
  that caused -u to sometimes override -n.
  [bug introduced with coreutils-7.1]
  'cp -a --no-preserve=mode' now sets appropriate default permissions
  for non regular files like fifos and character device nodes etc.,
  and leaves mode bits of existing files unchanged.
  Previously it would have set executable bits on created special files,
  and set mode bits for existing files as if they had been created.
  [bug introduced with coreutils-8.20]
  'cp --remove-destination file symlink' now removes the symlink
  even if it can't be traversed.
  [bug introduced with --remove-destination in fileutils-4.1.1]
  ls no longer truncates the abbreviated month names that have a
  display width between 6 and 12 inclusive.  Previously this would have
  output ambiguous months for Arabic or Catalan locales.
  'ls -aA' is now equivalent to 'ls -A', since -A now overrides -a.
  [bug introduced in coreutils-5.3.0]
  'mv -n A B' no longer suffers from a race condition that can
  overwrite a simultaneously-created B.  This bug fix requires
  platform support for the renameat2 or renameatx_np syscalls, found
  in recent Linux and macOS kernels.  As a side effect, ‘mv -n A A’
  now silently does nothing if A exists.
  [bug introduced with coreutils-7.1]
  * * Changes in behavior
  'cp --force file symlink' now removes the symlink even if
  it is self referential.
  ls --color now matches file extensions case insensitively.
  * * New features
  cp --reflink now supports --reflink=never to enforce a standard copy.
  env supports a new -v/--debug option to show verbose information about
  each processing step.
  env supports a new -S/--split-string=S option to split a single argument
  string into multiple arguments. Used to pass multiple arguments in scripts
  (shebang lines).
  md5sum accepts a new option: --zero (-z) to delimit the output lines with a
  NUL instead of a newline character.  This also disables file name escaping.
  This also applies to sha*sum and b2sum.
  rm --preserve-root now supports the --preserve-root=all option to
  reject any command line argument that is mounted to a separate file system.
  * * Improvements
  cut supports line lengths up to the max file size on 32 bit systems.
  Previously only offsets up to SIZE_MAX-1 were supported.
  stat and tail now know about the "exfs" file system, which is a
  version of XFS.  stat -f --format=%T now reports the file system type,
  and tail -f uses inotify.
  wc avoids redundant processing of ASCII text in multibyte locales,
  which is especially significant on macOS.
  * * Build-related
  Adjust to glibc &gt;= 2.28  (bsc#1182550, jsc#SLE-13520, jsc#SLE-13756)
- Refresh patches (line number changes only):
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * (License): osc changed the value from "GPL-3.0+" to "GPL-3.0-or-later".
  * (build): Make sure that parse-datetime.{c,y} ends up in debuginfo (rh#1555079).
- coreutils-i18n.patch:
  * src/exand.c,src/unexpand.c: Avoid -Wcomment warning.
  * src/cut.c (cut_characters_or_cut_bytes_no_split): Change idx from size_t
    to uintmax_t type to avoid a regression on i586, armv7l and ppc.
    Compare upstream, non-MB commit:
    https://git.sv.gnu.org/cgit/coreutils.git/commit/?id=d1a754c8272
    (cut_fields_mb): Likewise for field_idx.
  * tests/misc/cut.pl: Remove downstream tweaks as upstream MB tests are
    working since a while.
- coreutils.keyring: Update Assaf Gordon's GPG public key.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1552305600">- Update to 8.31:
  * Noteworthy changes in release 8.31 (2019-03-10) [stable]
  * * Bug fixes
  'base64 a b' now correctly diagnoses 'b' as the extra operand, not 'a'.
  [bug introduced in coreutils-5.3.0]
  When B already exists, 'cp -il A B' no longer immediately fails
  after asking the user whether to proceed.
  [This bug was present in "the beginning".]
  df no longer corrupts displayed multibyte characters on macOS.
  [bug introduced with coreutils-8.18]
  seq no longer outputs inconsistent decimal point characters
  for the last number, when locales are misconfigured.
  [bug introduced in coreutils-7.0]
  shred, sort, and split no longer falsely report ftruncate errors
  when outputting to less-common file types.  For example, the shell
  command 'sort /dev/null -o /dev/stdout | cat' no longer fails with
  an "error truncating" diagnostic.
  [bug was introduced with coreutils-8.18 for sort and split, and
  (for shared memory objects only) with fileutils-4.1 for shred]
  sync no longer fails for write-only file arguments.
  [bug introduced with argument support to sync in coreutils-8.24]
  'tail -f file | filter' no longer exits immediately on AIX.
  [bug introduced in coreutils-8.28]
  'tail -f file | filter' no longer goes into an infinite loop
  if filter exits and SIGPIPE is ignored.
  [bug introduced in coreutils-8.28]
  * * Changes in behavior
  cksum, dd, hostid, hostname, link, logname, sleep, tsort, unlink,
  uptime, users, whoami, yes: now always process --help and --version options,
  regardless of any other arguments present before any optional '--'
  end-of-options marker.
  nohup now processes --help and --version as first options even if other
  parameters follow.
  'yes a -- b' now outputs 'a b' instead of including the end-of-options
  marker as before: 'a -- b'.
  echo now always processes backslash escapes when the POSIXLY_CORRECT
  environment variable is set.
  When possible 'ln A B' now merely links A to B and reports an error
  if this fails, instead of statting A and B before linking.  This
  uses fewer system calls and avoids some races.  The old statting
  approach is still used in situations where hard links to directories
  are allowed (e.g., NetBSD when superuser).
  ls --group-directories-first will also group symlinks to directories.
  'test -a FILE' is not supported anymore.  Long ago, there were concerns about
  the high probability of humans confusing the -a primary with the -a binary
  operator, so POSIX changed this to 'test -e FILE'.  Scripts using it were
  already broken and non-portable; the -a unary operator was never documented.
  wc now treats non breaking space characters as word delimiters
  unless the POSIXLY_CORRECT environment variable is set.
  * * New features
  id now supports specifying multiple users.
  'date' now supports the '+' conversion specification flag,
  introduced in POSIX.1-2017.
  printf, seq, sleep, tail, and timeout now accept floating point
  numbers in either the current or the C locale.  For example, if the
  current locale's decimal point is ',', 'sleep 0,1' and 'sleep 0.1'
  now mean the same thing.  Previously, these commands accepted only
  C-locale syntax with '.' as the decimal point.  The new behavior is
  more compatible with other implementations in non-C locales.
  test now supports the '-N FILE' unary operator (like e.g. bash) to check
  whether FILE exists and has been modified since it was last read.
  env now supports '--default-signal[=SIG]', '--ignore-signal[=SIG]', and
  '--block-signal[=SIG], to setup signal handling before executing a program.
  env now supports '--list-signal-handling' to indicate non-default
  signal handling before executing a program.
  * * New commands
  basenc is added to complement existing base64,base32 commands,
  and encodes and decodes printable text using various common encodings:
  base64,base64url,base32,base32hex,base16,base2,z85.
  * * Improvements
  ls -l now better aligns abbreviated months containing digits,
  which is common in Asian locales.
  stat and tail now know about the "sdcardfs" file system on Android.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  stat now prints file creation time when supported by the file system,
  on GNU Linux systems with glibc &gt;= 2.28 and kernel &gt;= 4.11.
- Refresh patches (line number changes only):
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-misc.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * Version: bump version.
  * URL: Use https scheme.
  * %description: Add 'basenc' tool.
  * Change gitweb to cgit URL with https in a comment.
- coreutils.keyring:
  * Update for added section headers ('GPG keys of &lt;MAINTAINER&gt;').</changelog>
  <changelog author="lnussel@suse.de" date="1568894400">- Do not recommend lang package. The lang package already has a
  supplements.</changelog>
  <changelog author="lnussel@suse.de" date="1578571200">- switch to multibuild
- add coreutils-single subpackage that contains a single binary coreutils tool
  similar to busybox
- package LC_CTIME directories also in lang package
- split off doc package
- remove info macros, handled by file trigger nowadays</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1579521600">- minor: remove obsolete comment in spec file.</changelog>
  <changelog author="lnussel@suse.de" date="1580212800">- disable single and testsuite builds in rings/staging
- remove duplicate "coreutils" in flavor to make it look nicer in OBS</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1583755200">- Update to 8.32:
  * Noteworthy changes in release 8.32 (2020-03-05) [stable]
  * * Bug fixes
  cp now copies /dev/fd/N correctly on platforms like Solaris where
  it is a character-special file whose minor device number is N.
  [bug introduced in fileutils-4.1.6]
  dd conv=fdatasync no longer reports a "Bad file descriptor" error
  when fdatasync is interrupted, and dd now retries interrupted calls
  to close, fdatasync, fstat and fsync instead of incorrectly
  reporting an "Interrupted system call" error.
  [bugs introduced in coreutils-6.0]
  df now correctly parses the /proc/self/mountinfo file for unusual entries
  like ones with '\r' in a field value ("mount -t tmpfs tmpfs /foo$'\r'bar"),
  when the source field is empty ('mount -t tmpfs "" /mnt'), and when the
  filesystem type contains characters like a blank which need escaping.
  [bugs introduced in coreutils-8.24 with the introduction of reading
  the /proc/self/mountinfo file]
  factor again outputs immediately when stdout is a tty but stdin is not.
  [bug introduced in coreutils-8.24]
  ln works again on old systems without O_DIRECTORY support (like Solaris 10),
  and on systems where symlink ("x", ".") fails with errno == EINVAL
  (like Solaris 10 and Solaris 11).
  [bug introduced in coreutils-8.31]
  rmdir --ignore-fail-on-non-empty now works correctly for directories
  that fail to be removed due to permission issues.  Previously the exit status
  was reversed, failing for non empty and succeeding for empty directories.
  [bug introduced in coreutils-6.11]
  'shuf -r -n 0 file' no longer mistakenly reads from standard input.
  [bug introduced with the --repeat feature in coreutils-8.22]
  split no longer reports a "output file suffixes exhausted" error
  when the specified number of files is evenly divisible by 10, 16, 26,
  for --numeric, --hex, or default alphabetic suffixes respectively.
  [bug introduced in coreutils-8.24]
  seq no longer prints an extra line under certain circumstances (such as
  'seq -f "%g " 1000000 1000000').
  [bug introduced in coreutils-6.10]
  * * Changes in behavior
  Several programs now check that numbers end properly.  For example,
  'du -d 1x' now reports an error instead of silently ignoring the 'x'.
  Affected programs and options include du -d, expr's numeric operands
  on non-GMP builds, install -g and -o, ls's TABSIZE environment
  variable, mknod b and c, ptx -g and -w, shuf -n, and sort --batch-size
  and --parallel.
  date now parses military time zones in accordance with common usage:
    "A" to "M"  are equivalent to UTC+1 to UTC+12
    "N" to "Y"  are equivalent to UTC-1 to UTC-12
    "Z" is "zulu" time (UTC).
  For example, 'date -d "09:00B" is now equivalent to 9am in UTC+2 time zone.
  Previously, military time zones were parsed according to the obsolete
  rfc822, with their value negated (e.g., "B" was equivalent to UTC-2).
  [The old behavior was introduced in sh-utils 2.0.15 ca. 1999, predating
  coreutils package.]
  ls issues an error message on a removed directory, on GNU/Linux systems.
  Previously no error and no entries were output, and so indistinguishable
  from an empty directory, with default ls options.
  uniq no longer uses strcoll() to determine string equivalence,
  and so will operate more efficiently and consistently.
  * * New Features
  ls now supports the --time=birth option to display and sort by
  file creation time, where available.
  od --skip-bytes now can use lseek even if the input is not a regular
  file, greatly improving performance in some cases.
  stat(1) supports a new --cached= option, used on systems with statx(2)
  to control cache coherency of file system attributes,
  useful on network file systems.
  * * Improvements
  stat and ls now use the statx() system call where available, which can
  operate more efficiently by only retrieving requested attributes.
  stat and tail now know about the "binderfs", "dma-buf-fs", "erofs",
  "ppc-cmm-fs", and "z3fold" file systems.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  * * Build-related
  gzip-compressed tarballs are distributed once again
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-invalid-ids.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils-i18n.patch:
  * uniq: remove collation handling as required by newer POSIX; see
  - https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8e81d44b5
  - https://www.austingroupbugs.net/view.php?id=963
- coreutils-ls-restore-8.31-behavior-on-removed-dirs.patch:
  * Add patch for 'ls' to restore 8.31 behavior on removed directories.
- coreutils.spec:
  * Version: bump version.
  * %check: re-enable regular 'make check' for non-multibuild package.
  * reference the above new patch.
- coreutils.keyring:
  * Update from upstream (Savannah).</changelog>
  <changelog author="dmueller@suse.com" date="1588593600">- add coreutils-use-python3.patch to minimally port away from
  python 2.x use of pyinotify in the testsuite</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1592049600">- coreutils-gnulib-disable-test-float.patch: Add patch to temporarily
  disable the gnulib test 'test-float' failing on ppc and ppc64le.
- coreutils.spec: Reference the patch.  While at it, avoid conditional
  Patch and Source entries as that break cross-platform builds from
  source RPMs.</changelog>
  <changelog author="dimstar@opensuse.org" date="1594900800">- Drop suse-module-tools BuildRequires: this was used for the macro
  regenerate_initrd_post/posttrans, which have been moved to
  rpm-config-SUSE in Jan 2019.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1598875200">- gnulib-test-avoid-FP-perror-strerror.patch: Add patch to
  avoid false-positive error in gnulib tests 'test-perror2' and
  'test-strerror_r', visible on armv7l.
- coreutils.spec: Reference the patch.</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="zpetrova@suse.com" date="1635163200">- coreutils-df-fuse-portal-dummy.patch:
  df: Add "fuse.portal" as a dummy file system (used in flatpak
  implementations). (bsc#1189152)</changelog>
  <changelog author="ailiop@suse.com" date="1706529600">- tail: fix tailing sysfs files where PAGE_SIZE &gt; BUFSIZ (bsc#1219321)
  - add coreutils-tail-fix-tailing-sysfs-files-where-PAGE_SIZE-BUFSIZ.patch</changelog>
  <changelog author="tabraham@suse.com" date="1712059200">- ls: avoid triggering automounts (bsc#1221632)
  - add coreutils-ls-avoid-triggering-automounts.patch</changelog>
</package>
<package pkgid="f46e941536a3b0c74107d72acef2c6376005b66cc30de95578b53ac19436dee6" name="coreutils-testsuite" arch="src">
  <version epoch="0" ver="8.32" rel="150400.9.6.2"/>
  <changelog author="mail@bernhard-voelker.de" date="1493726400">- coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch:
  Add upstream patch to fix an heap overflow security issue
  in date(1) and touch(1) with a large TZ variable
  (CVE-2017-7476, rh#1444774, boo#1037124).</changelog>
  <changelog author="ghe@suse.com" date="1502884800">- Drop coreutils-ocfs2_reflinks.patch
  OCFS2 file system has supported file clone ioctls like btrfs,
  then, coreutils doesn't need this patch from the kernel v4.10-rc1</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1504526400">- Update to 8.28
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.keyring: Update from upstream (Savannah).
- Remove now-upstream patches:
  * coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch
  * coreutils-tests-port-to-timezone-2017a.patch
- coreutils.spec: Add "BuildRequires: user(bin)" for the tests.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1514462400">- Update to 8.29:
  * Noteworthy changes in release 8.29 (2017-12-27) [stable]
  * * Bug fixes
  b2sum no longer crashes when processing certain truncated check files.
  [bug introduced with b2sum coreutils-8.26]
  dd now ensures the correct cache ranges are specified for the "nocache"
  and "direct" flags.  Previously some pages in the page cache were not
  invalidated.  [bug introduced for "direct" in coreutils-7.5,
  and with the "nocache" implementation in coreutils-8.11]
  df no longer hangs when given a fifo argument.
  [bug introduced in coreutils-7.3]
  ptx -S no longer infloops for a pattern which returns zero-length matches.
  [the bug dates back to the initial implementation]
  shred --remove will again repeatedly rename files with shortening names
  to attempt to hide the original length of the file name.
  [bug introduced in coreutils-8.28]
  stty no longer crashes when processing settings with -F also specified.
  [bug introduced in fileutils-4.0]
  tail --bytes again supports non seekable inputs on all systems.
  On systems like android it always tried to process as seekable inputs.
  [bug introduced in coreutils-8.24]
  timeout will again notice its managed command exiting, even when
  invoked with blocked CHLD signal, or in a narrow window where
  this CHLD signal from the exiting child was missed.  In each case
  timeout would have then waited for the time limit to expire.
  [bug introduced in coreutils-8.27]
  * * New features
  timeout now supports the --verbose option to diagnose forced termination.
  * * Improvements
  dd now supports iflag=direct with arbitrary sized files on all file systems.
  tail --bytes=NUM will efficiently seek to the end of block devices,
  rather than reading from the start.
  Utilities which do not support long options (other than the default --help
  and --version), e.g. cksum and sleep, now use more consistent error diagnostic
  for unknown long options.
  * * Build-related
  Default man pages are now distributed which are used if perl is
  not available on the build system, or when cross compiling.
- Refresh patches (line number changes only):
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1530619200">- Update to 8.30:
  * Noteworthy changes in release 8.30 (2018-07-01) [stable]
  * * Bug fixes
  'cp --symlink SRC DST' will again correctly validate DST.
  If DST is a regular file and SRC is a symlink to DST,
  then cp will no longer allow that operation to clobber DST.
  Also with -d, if DST is a symlink, then it can always be replaced,
  even if it points to SRC on a separate device.
  [bugs introduced with coreutils-8.27]
  'cp -n -u' and 'mv -n -u' now consistently ignore the -u option.
  Previously, this option combination suffered from race conditions
  that caused -u to sometimes override -n.
  [bug introduced with coreutils-7.1]
  'cp -a --no-preserve=mode' now sets appropriate default permissions
  for non regular files like fifos and character device nodes etc.,
  and leaves mode bits of existing files unchanged.
  Previously it would have set executable bits on created special files,
  and set mode bits for existing files as if they had been created.
  [bug introduced with coreutils-8.20]
  'cp --remove-destination file symlink' now removes the symlink
  even if it can't be traversed.
  [bug introduced with --remove-destination in fileutils-4.1.1]
  ls no longer truncates the abbreviated month names that have a
  display width between 6 and 12 inclusive.  Previously this would have
  output ambiguous months for Arabic or Catalan locales.
  'ls -aA' is now equivalent to 'ls -A', since -A now overrides -a.
  [bug introduced in coreutils-5.3.0]
  'mv -n A B' no longer suffers from a race condition that can
  overwrite a simultaneously-created B.  This bug fix requires
  platform support for the renameat2 or renameatx_np syscalls, found
  in recent Linux and macOS kernels.  As a side effect, ‘mv -n A A’
  now silently does nothing if A exists.
  [bug introduced with coreutils-7.1]
  * * Changes in behavior
  'cp --force file symlink' now removes the symlink even if
  it is self referential.
  ls --color now matches file extensions case insensitively.
  * * New features
  cp --reflink now supports --reflink=never to enforce a standard copy.
  env supports a new -v/--debug option to show verbose information about
  each processing step.
  env supports a new -S/--split-string=S option to split a single argument
  string into multiple arguments. Used to pass multiple arguments in scripts
  (shebang lines).
  md5sum accepts a new option: --zero (-z) to delimit the output lines with a
  NUL instead of a newline character.  This also disables file name escaping.
  This also applies to sha*sum and b2sum.
  rm --preserve-root now supports the --preserve-root=all option to
  reject any command line argument that is mounted to a separate file system.
  * * Improvements
  cut supports line lengths up to the max file size on 32 bit systems.
  Previously only offsets up to SIZE_MAX-1 were supported.
  stat and tail now know about the "exfs" file system, which is a
  version of XFS.  stat -f --format=%T now reports the file system type,
  and tail -f uses inotify.
  wc avoids redundant processing of ASCII text in multibyte locales,
  which is especially significant on macOS.
  * * Build-related
  Adjust to glibc &gt;= 2.28  (bsc#1182550, jsc#SLE-13520, jsc#SLE-13756)
- Refresh patches (line number changes only):
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * (License): osc changed the value from "GPL-3.0+" to "GPL-3.0-or-later".
  * (build): Make sure that parse-datetime.{c,y} ends up in debuginfo (rh#1555079).
- coreutils-i18n.patch:
  * src/exand.c,src/unexpand.c: Avoid -Wcomment warning.
  * src/cut.c (cut_characters_or_cut_bytes_no_split): Change idx from size_t
    to uintmax_t type to avoid a regression on i586, armv7l and ppc.
    Compare upstream, non-MB commit:
    https://git.sv.gnu.org/cgit/coreutils.git/commit/?id=d1a754c8272
    (cut_fields_mb): Likewise for field_idx.
  * tests/misc/cut.pl: Remove downstream tweaks as upstream MB tests are
    working since a while.
- coreutils.keyring: Update Assaf Gordon's GPG public key.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1552305600">- Update to 8.31:
  * Noteworthy changes in release 8.31 (2019-03-10) [stable]
  * * Bug fixes
  'base64 a b' now correctly diagnoses 'b' as the extra operand, not 'a'.
  [bug introduced in coreutils-5.3.0]
  When B already exists, 'cp -il A B' no longer immediately fails
  after asking the user whether to proceed.
  [This bug was present in "the beginning".]
  df no longer corrupts displayed multibyte characters on macOS.
  [bug introduced with coreutils-8.18]
  seq no longer outputs inconsistent decimal point characters
  for the last number, when locales are misconfigured.
  [bug introduced in coreutils-7.0]
  shred, sort, and split no longer falsely report ftruncate errors
  when outputting to less-common file types.  For example, the shell
  command 'sort /dev/null -o /dev/stdout | cat' no longer fails with
  an "error truncating" diagnostic.
  [bug was introduced with coreutils-8.18 for sort and split, and
  (for shared memory objects only) with fileutils-4.1 for shred]
  sync no longer fails for write-only file arguments.
  [bug introduced with argument support to sync in coreutils-8.24]
  'tail -f file | filter' no longer exits immediately on AIX.
  [bug introduced in coreutils-8.28]
  'tail -f file | filter' no longer goes into an infinite loop
  if filter exits and SIGPIPE is ignored.
  [bug introduced in coreutils-8.28]
  * * Changes in behavior
  cksum, dd, hostid, hostname, link, logname, sleep, tsort, unlink,
  uptime, users, whoami, yes: now always process --help and --version options,
  regardless of any other arguments present before any optional '--'
  end-of-options marker.
  nohup now processes --help and --version as first options even if other
  parameters follow.
  'yes a -- b' now outputs 'a b' instead of including the end-of-options
  marker as before: 'a -- b'.
  echo now always processes backslash escapes when the POSIXLY_CORRECT
  environment variable is set.
  When possible 'ln A B' now merely links A to B and reports an error
  if this fails, instead of statting A and B before linking.  This
  uses fewer system calls and avoids some races.  The old statting
  approach is still used in situations where hard links to directories
  are allowed (e.g., NetBSD when superuser).
  ls --group-directories-first will also group symlinks to directories.
  'test -a FILE' is not supported anymore.  Long ago, there were concerns about
  the high probability of humans confusing the -a primary with the -a binary
  operator, so POSIX changed this to 'test -e FILE'.  Scripts using it were
  already broken and non-portable; the -a unary operator was never documented.
  wc now treats non breaking space characters as word delimiters
  unless the POSIXLY_CORRECT environment variable is set.
  * * New features
  id now supports specifying multiple users.
  'date' now supports the '+' conversion specification flag,
  introduced in POSIX.1-2017.
  printf, seq, sleep, tail, and timeout now accept floating point
  numbers in either the current or the C locale.  For example, if the
  current locale's decimal point is ',', 'sleep 0,1' and 'sleep 0.1'
  now mean the same thing.  Previously, these commands accepted only
  C-locale syntax with '.' as the decimal point.  The new behavior is
  more compatible with other implementations in non-C locales.
  test now supports the '-N FILE' unary operator (like e.g. bash) to check
  whether FILE exists and has been modified since it was last read.
  env now supports '--default-signal[=SIG]', '--ignore-signal[=SIG]', and
  '--block-signal[=SIG], to setup signal handling before executing a program.
  env now supports '--list-signal-handling' to indicate non-default
  signal handling before executing a program.
  * * New commands
  basenc is added to complement existing base64,base32 commands,
  and encodes and decodes printable text using various common encodings:
  base64,base64url,base32,base32hex,base16,base2,z85.
  * * Improvements
  ls -l now better aligns abbreviated months containing digits,
  which is common in Asian locales.
  stat and tail now know about the "sdcardfs" file system on Android.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  stat now prints file creation time when supported by the file system,
  on GNU Linux systems with glibc &gt;= 2.28 and kernel &gt;= 4.11.
- Refresh patches (line number changes only):
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-misc.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * Version: bump version.
  * URL: Use https scheme.
  * %description: Add 'basenc' tool.
  * Change gitweb to cgit URL with https in a comment.
- coreutils.keyring:
  * Update for added section headers ('GPG keys of &lt;MAINTAINER&gt;').</changelog>
  <changelog author="lnussel@suse.de" date="1568894400">- Do not recommend lang package. The lang package already has a
  supplements.</changelog>
  <changelog author="lnussel@suse.de" date="1578571200">- switch to multibuild
- add coreutils-single subpackage that contains a single binary coreutils tool
  similar to busybox
- package LC_CTIME directories also in lang package
- split off doc package
- remove info macros, handled by file trigger nowadays</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1579521600">- minor: remove obsolete comment in spec file.</changelog>
  <changelog author="lnussel@suse.de" date="1580212800">- disable single and testsuite builds in rings/staging
- remove duplicate "coreutils" in flavor to make it look nicer in OBS</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1583755200">- Update to 8.32:
  * Noteworthy changes in release 8.32 (2020-03-05) [stable]
  * * Bug fixes
  cp now copies /dev/fd/N correctly on platforms like Solaris where
  it is a character-special file whose minor device number is N.
  [bug introduced in fileutils-4.1.6]
  dd conv=fdatasync no longer reports a "Bad file descriptor" error
  when fdatasync is interrupted, and dd now retries interrupted calls
  to close, fdatasync, fstat and fsync instead of incorrectly
  reporting an "Interrupted system call" error.
  [bugs introduced in coreutils-6.0]
  df now correctly parses the /proc/self/mountinfo file for unusual entries
  like ones with '\r' in a field value ("mount -t tmpfs tmpfs /foo$'\r'bar"),
  when the source field is empty ('mount -t tmpfs "" /mnt'), and when the
  filesystem type contains characters like a blank which need escaping.
  [bugs introduced in coreutils-8.24 with the introduction of reading
  the /proc/self/mountinfo file]
  factor again outputs immediately when stdout is a tty but stdin is not.
  [bug introduced in coreutils-8.24]
  ln works again on old systems without O_DIRECTORY support (like Solaris 10),
  and on systems where symlink ("x", ".") fails with errno == EINVAL
  (like Solaris 10 and Solaris 11).
  [bug introduced in coreutils-8.31]
  rmdir --ignore-fail-on-non-empty now works correctly for directories
  that fail to be removed due to permission issues.  Previously the exit status
  was reversed, failing for non empty and succeeding for empty directories.
  [bug introduced in coreutils-6.11]
  'shuf -r -n 0 file' no longer mistakenly reads from standard input.
  [bug introduced with the --repeat feature in coreutils-8.22]
  split no longer reports a "output file suffixes exhausted" error
  when the specified number of files is evenly divisible by 10, 16, 26,
  for --numeric, --hex, or default alphabetic suffixes respectively.
  [bug introduced in coreutils-8.24]
  seq no longer prints an extra line under certain circumstances (such as
  'seq -f "%g " 1000000 1000000').
  [bug introduced in coreutils-6.10]
  * * Changes in behavior
  Several programs now check that numbers end properly.  For example,
  'du -d 1x' now reports an error instead of silently ignoring the 'x'.
  Affected programs and options include du -d, expr's numeric operands
  on non-GMP builds, install -g and -o, ls's TABSIZE environment
  variable, mknod b and c, ptx -g and -w, shuf -n, and sort --batch-size
  and --parallel.
  date now parses military time zones in accordance with common usage:
    "A" to "M"  are equivalent to UTC+1 to UTC+12
    "N" to "Y"  are equivalent to UTC-1 to UTC-12
    "Z" is "zulu" time (UTC).
  For example, 'date -d "09:00B" is now equivalent to 9am in UTC+2 time zone.
  Previously, military time zones were parsed according to the obsolete
  rfc822, with their value negated (e.g., "B" was equivalent to UTC-2).
  [The old behavior was introduced in sh-utils 2.0.15 ca. 1999, predating
  coreutils package.]
  ls issues an error message on a removed directory, on GNU/Linux systems.
  Previously no error and no entries were output, and so indistinguishable
  from an empty directory, with default ls options.
  uniq no longer uses strcoll() to determine string equivalence,
  and so will operate more efficiently and consistently.
  * * New Features
  ls now supports the --time=birth option to display and sort by
  file creation time, where available.
  od --skip-bytes now can use lseek even if the input is not a regular
  file, greatly improving performance in some cases.
  stat(1) supports a new --cached= option, used on systems with statx(2)
  to control cache coherency of file system attributes,
  useful on network file systems.
  * * Improvements
  stat and ls now use the statx() system call where available, which can
  operate more efficiently by only retrieving requested attributes.
  stat and tail now know about the "binderfs", "dma-buf-fs", "erofs",
  "ppc-cmm-fs", and "z3fold" file systems.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  * * Build-related
  gzip-compressed tarballs are distributed once again
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-invalid-ids.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils-i18n.patch:
  * uniq: remove collation handling as required by newer POSIX; see
  - https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8e81d44b5
  - https://www.austingroupbugs.net/view.php?id=963
- coreutils-ls-restore-8.31-behavior-on-removed-dirs.patch:
  * Add patch for 'ls' to restore 8.31 behavior on removed directories.
- coreutils.spec:
  * Version: bump version.
  * %check: re-enable regular 'make check' for non-multibuild package.
  * reference the above new patch.
- coreutils.keyring:
  * Update from upstream (Savannah).</changelog>
  <changelog author="dmueller@suse.com" date="1588593600">- add coreutils-use-python3.patch to minimally port away from
  python 2.x use of pyinotify in the testsuite</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1592049600">- coreutils-gnulib-disable-test-float.patch: Add patch to temporarily
  disable the gnulib test 'test-float' failing on ppc and ppc64le.
- coreutils.spec: Reference the patch.  While at it, avoid conditional
  Patch and Source entries as that break cross-platform builds from
  source RPMs.</changelog>
  <changelog author="dimstar@opensuse.org" date="1594900800">- Drop suse-module-tools BuildRequires: this was used for the macro
  regenerate_initrd_post/posttrans, which have been moved to
  rpm-config-SUSE in Jan 2019.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1598875200">- gnulib-test-avoid-FP-perror-strerror.patch: Add patch to
  avoid false-positive error in gnulib tests 'test-perror2' and
  'test-strerror_r', visible on armv7l.
- coreutils.spec: Reference the patch.</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="zpetrova@suse.com" date="1635163200">- coreutils-df-fuse-portal-dummy.patch:
  df: Add "fuse.portal" as a dummy file system (used in flatpak
  implementations). (bsc#1189152)</changelog>
  <changelog author="ailiop@suse.com" date="1706529600">- tail: fix tailing sysfs files where PAGE_SIZE &gt; BUFSIZ (bsc#1219321)
  - add coreutils-tail-fix-tailing-sysfs-files-where-PAGE_SIZE-BUFSIZ.patch</changelog>
  <changelog author="tabraham@suse.com" date="1712059200">- ls: avoid triggering automounts (bsc#1221632)
  - add coreutils-ls-avoid-triggering-automounts.patch</changelog>
</package>
<package pkgid="404d0ef6e67d6a331faf2baca9833b81327fd5d08fbf07ca91b0ece618836011" name="coreutils-testsuite" arch="x86_64">
  <version epoch="0" ver="8.32" rel="150400.9.6.2"/>
  <changelog author="mail@bernhard-voelker.de" date="1493726400">- coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch:
  Add upstream patch to fix an heap overflow security issue
  in date(1) and touch(1) with a large TZ variable
  (CVE-2017-7476, rh#1444774, boo#1037124).</changelog>
  <changelog author="ghe@suse.com" date="1502884800">- Drop coreutils-ocfs2_reflinks.patch
  OCFS2 file system has supported file clone ioctls like btrfs,
  then, coreutils doesn't need this patch from the kernel v4.10-rc1</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1504526400">- Update to 8.28
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.keyring: Update from upstream (Savannah).
- Remove now-upstream patches:
  * coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch
  * coreutils-tests-port-to-timezone-2017a.patch
- coreutils.spec: Add "BuildRequires: user(bin)" for the tests.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1514462400">- Update to 8.29:
  * Noteworthy changes in release 8.29 (2017-12-27) [stable]
  * * Bug fixes
  b2sum no longer crashes when processing certain truncated check files.
  [bug introduced with b2sum coreutils-8.26]
  dd now ensures the correct cache ranges are specified for the "nocache"
  and "direct" flags.  Previously some pages in the page cache were not
  invalidated.  [bug introduced for "direct" in coreutils-7.5,
  and with the "nocache" implementation in coreutils-8.11]
  df no longer hangs when given a fifo argument.
  [bug introduced in coreutils-7.3]
  ptx -S no longer infloops for a pattern which returns zero-length matches.
  [the bug dates back to the initial implementation]
  shred --remove will again repeatedly rename files with shortening names
  to attempt to hide the original length of the file name.
  [bug introduced in coreutils-8.28]
  stty no longer crashes when processing settings with -F also specified.
  [bug introduced in fileutils-4.0]
  tail --bytes again supports non seekable inputs on all systems.
  On systems like android it always tried to process as seekable inputs.
  [bug introduced in coreutils-8.24]
  timeout will again notice its managed command exiting, even when
  invoked with blocked CHLD signal, or in a narrow window where
  this CHLD signal from the exiting child was missed.  In each case
  timeout would have then waited for the time limit to expire.
  [bug introduced in coreutils-8.27]
  * * New features
  timeout now supports the --verbose option to diagnose forced termination.
  * * Improvements
  dd now supports iflag=direct with arbitrary sized files on all file systems.
  tail --bytes=NUM will efficiently seek to the end of block devices,
  rather than reading from the start.
  Utilities which do not support long options (other than the default --help
  and --version), e.g. cksum and sleep, now use more consistent error diagnostic
  for unknown long options.
  * * Build-related
  Default man pages are now distributed which are used if perl is
  not available on the build system, or when cross compiling.
- Refresh patches (line number changes only):
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1530619200">- Update to 8.30:
  * Noteworthy changes in release 8.30 (2018-07-01) [stable]
  * * Bug fixes
  'cp --symlink SRC DST' will again correctly validate DST.
  If DST is a regular file and SRC is a symlink to DST,
  then cp will no longer allow that operation to clobber DST.
  Also with -d, if DST is a symlink, then it can always be replaced,
  even if it points to SRC on a separate device.
  [bugs introduced with coreutils-8.27]
  'cp -n -u' and 'mv -n -u' now consistently ignore the -u option.
  Previously, this option combination suffered from race conditions
  that caused -u to sometimes override -n.
  [bug introduced with coreutils-7.1]
  'cp -a --no-preserve=mode' now sets appropriate default permissions
  for non regular files like fifos and character device nodes etc.,
  and leaves mode bits of existing files unchanged.
  Previously it would have set executable bits on created special files,
  and set mode bits for existing files as if they had been created.
  [bug introduced with coreutils-8.20]
  'cp --remove-destination file symlink' now removes the symlink
  even if it can't be traversed.
  [bug introduced with --remove-destination in fileutils-4.1.1]
  ls no longer truncates the abbreviated month names that have a
  display width between 6 and 12 inclusive.  Previously this would have
  output ambiguous months for Arabic or Catalan locales.
  'ls -aA' is now equivalent to 'ls -A', since -A now overrides -a.
  [bug introduced in coreutils-5.3.0]
  'mv -n A B' no longer suffers from a race condition that can
  overwrite a simultaneously-created B.  This bug fix requires
  platform support for the renameat2 or renameatx_np syscalls, found
  in recent Linux and macOS kernels.  As a side effect, ‘mv -n A A’
  now silently does nothing if A exists.
  [bug introduced with coreutils-7.1]
  * * Changes in behavior
  'cp --force file symlink' now removes the symlink even if
  it is self referential.
  ls --color now matches file extensions case insensitively.
  * * New features
  cp --reflink now supports --reflink=never to enforce a standard copy.
  env supports a new -v/--debug option to show verbose information about
  each processing step.
  env supports a new -S/--split-string=S option to split a single argument
  string into multiple arguments. Used to pass multiple arguments in scripts
  (shebang lines).
  md5sum accepts a new option: --zero (-z) to delimit the output lines with a
  NUL instead of a newline character.  This also disables file name escaping.
  This also applies to sha*sum and b2sum.
  rm --preserve-root now supports the --preserve-root=all option to
  reject any command line argument that is mounted to a separate file system.
  * * Improvements
  cut supports line lengths up to the max file size on 32 bit systems.
  Previously only offsets up to SIZE_MAX-1 were supported.
  stat and tail now know about the "exfs" file system, which is a
  version of XFS.  stat -f --format=%T now reports the file system type,
  and tail -f uses inotify.
  wc avoids redundant processing of ASCII text in multibyte locales,
  which is especially significant on macOS.
  * * Build-related
  Adjust to glibc &gt;= 2.28  (bsc#1182550, jsc#SLE-13520, jsc#SLE-13756)
- Refresh patches (line number changes only):
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * (License): osc changed the value from "GPL-3.0+" to "GPL-3.0-or-later".
  * (build): Make sure that parse-datetime.{c,y} ends up in debuginfo (rh#1555079).
- coreutils-i18n.patch:
  * src/exand.c,src/unexpand.c: Avoid -Wcomment warning.
  * src/cut.c (cut_characters_or_cut_bytes_no_split): Change idx from size_t
    to uintmax_t type to avoid a regression on i586, armv7l and ppc.
    Compare upstream, non-MB commit:
    https://git.sv.gnu.org/cgit/coreutils.git/commit/?id=d1a754c8272
    (cut_fields_mb): Likewise for field_idx.
  * tests/misc/cut.pl: Remove downstream tweaks as upstream MB tests are
    working since a while.
- coreutils.keyring: Update Assaf Gordon's GPG public key.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1552305600">- Update to 8.31:
  * Noteworthy changes in release 8.31 (2019-03-10) [stable]
  * * Bug fixes
  'base64 a b' now correctly diagnoses 'b' as the extra operand, not 'a'.
  [bug introduced in coreutils-5.3.0]
  When B already exists, 'cp -il A B' no longer immediately fails
  after asking the user whether to proceed.
  [This bug was present in "the beginning".]
  df no longer corrupts displayed multibyte characters on macOS.
  [bug introduced with coreutils-8.18]
  seq no longer outputs inconsistent decimal point characters
  for the last number, when locales are misconfigured.
  [bug introduced in coreutils-7.0]
  shred, sort, and split no longer falsely report ftruncate errors
  when outputting to less-common file types.  For example, the shell
  command 'sort /dev/null -o /dev/stdout | cat' no longer fails with
  an "error truncating" diagnostic.
  [bug was introduced with coreutils-8.18 for sort and split, and
  (for shared memory objects only) with fileutils-4.1 for shred]
  sync no longer fails for write-only file arguments.
  [bug introduced with argument support to sync in coreutils-8.24]
  'tail -f file | filter' no longer exits immediately on AIX.
  [bug introduced in coreutils-8.28]
  'tail -f file | filter' no longer goes into an infinite loop
  if filter exits and SIGPIPE is ignored.
  [bug introduced in coreutils-8.28]
  * * Changes in behavior
  cksum, dd, hostid, hostname, link, logname, sleep, tsort, unlink,
  uptime, users, whoami, yes: now always process --help and --version options,
  regardless of any other arguments present before any optional '--'
  end-of-options marker.
  nohup now processes --help and --version as first options even if other
  parameters follow.
  'yes a -- b' now outputs 'a b' instead of including the end-of-options
  marker as before: 'a -- b'.
  echo now always processes backslash escapes when the POSIXLY_CORRECT
  environment variable is set.
  When possible 'ln A B' now merely links A to B and reports an error
  if this fails, instead of statting A and B before linking.  This
  uses fewer system calls and avoids some races.  The old statting
  approach is still used in situations where hard links to directories
  are allowed (e.g., NetBSD when superuser).
  ls --group-directories-first will also group symlinks to directories.
  'test -a FILE' is not supported anymore.  Long ago, there were concerns about
  the high probability of humans confusing the -a primary with the -a binary
  operator, so POSIX changed this to 'test -e FILE'.  Scripts using it were
  already broken and non-portable; the -a unary operator was never documented.
  wc now treats non breaking space characters as word delimiters
  unless the POSIXLY_CORRECT environment variable is set.
  * * New features
  id now supports specifying multiple users.
  'date' now supports the '+' conversion specification flag,
  introduced in POSIX.1-2017.
  printf, seq, sleep, tail, and timeout now accept floating point
  numbers in either the current or the C locale.  For example, if the
  current locale's decimal point is ',', 'sleep 0,1' and 'sleep 0.1'
  now mean the same thing.  Previously, these commands accepted only
  C-locale syntax with '.' as the decimal point.  The new behavior is
  more compatible with other implementations in non-C locales.
  test now supports the '-N FILE' unary operator (like e.g. bash) to check
  whether FILE exists and has been modified since it was last read.
  env now supports '--default-signal[=SIG]', '--ignore-signal[=SIG]', and
  '--block-signal[=SIG], to setup signal handling before executing a program.
  env now supports '--list-signal-handling' to indicate non-default
  signal handling before executing a program.
  * * New commands
  basenc is added to complement existing base64,base32 commands,
  and encodes and decodes printable text using various common encodings:
  base64,base64url,base32,base32hex,base16,base2,z85.
  * * Improvements
  ls -l now better aligns abbreviated months containing digits,
  which is common in Asian locales.
  stat and tail now know about the "sdcardfs" file system on Android.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  stat now prints file creation time when supported by the file system,
  on GNU Linux systems with glibc &gt;= 2.28 and kernel &gt;= 4.11.
- Refresh patches (line number changes only):
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-misc.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * Version: bump version.
  * URL: Use https scheme.
  * %description: Add 'basenc' tool.
  * Change gitweb to cgit URL with https in a comment.
- coreutils.keyring:
  * Update for added section headers ('GPG keys of &lt;MAINTAINER&gt;').</changelog>
  <changelog author="lnussel@suse.de" date="1568894400">- Do not recommend lang package. The lang package already has a
  supplements.</changelog>
  <changelog author="lnussel@suse.de" date="1578571200">- switch to multibuild
- add coreutils-single subpackage that contains a single binary coreutils tool
  similar to busybox
- package LC_CTIME directories also in lang package
- split off doc package
- remove info macros, handled by file trigger nowadays</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1579521600">- minor: remove obsolete comment in spec file.</changelog>
  <changelog author="lnussel@suse.de" date="1580212800">- disable single and testsuite builds in rings/staging
- remove duplicate "coreutils" in flavor to make it look nicer in OBS</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1583755200">- Update to 8.32:
  * Noteworthy changes in release 8.32 (2020-03-05) [stable]
  * * Bug fixes
  cp now copies /dev/fd/N correctly on platforms like Solaris where
  it is a character-special file whose minor device number is N.
  [bug introduced in fileutils-4.1.6]
  dd conv=fdatasync no longer reports a "Bad file descriptor" error
  when fdatasync is interrupted, and dd now retries interrupted calls
  to close, fdatasync, fstat and fsync instead of incorrectly
  reporting an "Interrupted system call" error.
  [bugs introduced in coreutils-6.0]
  df now correctly parses the /proc/self/mountinfo file for unusual entries
  like ones with '\r' in a field value ("mount -t tmpfs tmpfs /foo$'\r'bar"),
  when the source field is empty ('mount -t tmpfs "" /mnt'), and when the
  filesystem type contains characters like a blank which need escaping.
  [bugs introduced in coreutils-8.24 with the introduction of reading
  the /proc/self/mountinfo file]
  factor again outputs immediately when stdout is a tty but stdin is not.
  [bug introduced in coreutils-8.24]
  ln works again on old systems without O_DIRECTORY support (like Solaris 10),
  and on systems where symlink ("x", ".") fails with errno == EINVAL
  (like Solaris 10 and Solaris 11).
  [bug introduced in coreutils-8.31]
  rmdir --ignore-fail-on-non-empty now works correctly for directories
  that fail to be removed due to permission issues.  Previously the exit status
  was reversed, failing for non empty and succeeding for empty directories.
  [bug introduced in coreutils-6.11]
  'shuf -r -n 0 file' no longer mistakenly reads from standard input.
  [bug introduced with the --repeat feature in coreutils-8.22]
  split no longer reports a "output file suffixes exhausted" error
  when the specified number of files is evenly divisible by 10, 16, 26,
  for --numeric, --hex, or default alphabetic suffixes respectively.
  [bug introduced in coreutils-8.24]
  seq no longer prints an extra line under certain circumstances (such as
  'seq -f "%g " 1000000 1000000').
  [bug introduced in coreutils-6.10]
  * * Changes in behavior
  Several programs now check that numbers end properly.  For example,
  'du -d 1x' now reports an error instead of silently ignoring the 'x'.
  Affected programs and options include du -d, expr's numeric operands
  on non-GMP builds, install -g and -o, ls's TABSIZE environment
  variable, mknod b and c, ptx -g and -w, shuf -n, and sort --batch-size
  and --parallel.
  date now parses military time zones in accordance with common usage:
    "A" to "M"  are equivalent to UTC+1 to UTC+12
    "N" to "Y"  are equivalent to UTC-1 to UTC-12
    "Z" is "zulu" time (UTC).
  For example, 'date -d "09:00B" is now equivalent to 9am in UTC+2 time zone.
  Previously, military time zones were parsed according to the obsolete
  rfc822, with their value negated (e.g., "B" was equivalent to UTC-2).
  [The old behavior was introduced in sh-utils 2.0.15 ca. 1999, predating
  coreutils package.]
  ls issues an error message on a removed directory, on GNU/Linux systems.
  Previously no error and no entries were output, and so indistinguishable
  from an empty directory, with default ls options.
  uniq no longer uses strcoll() to determine string equivalence,
  and so will operate more efficiently and consistently.
  * * New Features
  ls now supports the --time=birth option to display and sort by
  file creation time, where available.
  od --skip-bytes now can use lseek even if the input is not a regular
  file, greatly improving performance in some cases.
  stat(1) supports a new --cached= option, used on systems with statx(2)
  to control cache coherency of file system attributes,
  useful on network file systems.
  * * Improvements
  stat and ls now use the statx() system call where available, which can
  operate more efficiently by only retrieving requested attributes.
  stat and tail now know about the "binderfs", "dma-buf-fs", "erofs",
  "ppc-cmm-fs", and "z3fold" file systems.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  * * Build-related
  gzip-compressed tarballs are distributed once again
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-invalid-ids.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils-i18n.patch:
  * uniq: remove collation handling as required by newer POSIX; see
  - https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8e81d44b5
  - https://www.austingroupbugs.net/view.php?id=963
- coreutils-ls-restore-8.31-behavior-on-removed-dirs.patch:
  * Add patch for 'ls' to restore 8.31 behavior on removed directories.
- coreutils.spec:
  * Version: bump version.
  * %check: re-enable regular 'make check' for non-multibuild package.
  * reference the above new patch.
- coreutils.keyring:
  * Update from upstream (Savannah).</changelog>
  <changelog author="dmueller@suse.com" date="1588593600">- add coreutils-use-python3.patch to minimally port away from
  python 2.x use of pyinotify in the testsuite</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1592049600">- coreutils-gnulib-disable-test-float.patch: Add patch to temporarily
  disable the gnulib test 'test-float' failing on ppc and ppc64le.
- coreutils.spec: Reference the patch.  While at it, avoid conditional
  Patch and Source entries as that break cross-platform builds from
  source RPMs.</changelog>
  <changelog author="dimstar@opensuse.org" date="1594900800">- Drop suse-module-tools BuildRequires: this was used for the macro
  regenerate_initrd_post/posttrans, which have been moved to
  rpm-config-SUSE in Jan 2019.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1598875200">- gnulib-test-avoid-FP-perror-strerror.patch: Add patch to
  avoid false-positive error in gnulib tests 'test-perror2' and
  'test-strerror_r', visible on armv7l.
- coreutils.spec: Reference the patch.</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="zpetrova@suse.com" date="1635163200">- coreutils-df-fuse-portal-dummy.patch:
  df: Add "fuse.portal" as a dummy file system (used in flatpak
  implementations). (bsc#1189152)</changelog>
  <changelog author="ailiop@suse.com" date="1706529600">- tail: fix tailing sysfs files where PAGE_SIZE &gt; BUFSIZ (bsc#1219321)
  - add coreutils-tail-fix-tailing-sysfs-files-where-PAGE_SIZE-BUFSIZ.patch</changelog>
  <changelog author="tabraham@suse.com" date="1712059200">- ls: avoid triggering automounts (bsc#1221632)
  - add coreutils-ls-avoid-triggering-automounts.patch</changelog>
</package>
<package pkgid="1ad387e7e8b745240d818fe598ab48fe4fcc9d2852adf3060365bfc487090a0b" name="cosign" arch="aarch64">
  <version epoch="0" ver="2.2.4" rel="150400.3.20.1"/>
  <changelog author="meissner@suse.com" date="1645444800">- updated to 1.5.2:
  - This release contains fixes for CVE-2022-23649, affecting signature
    validations with Rekor. Only validation is affected, it is not necessary
    to re-sign any artifacts. (bsc#1196239)
- updated to 1.5.1:
  - Bump sigstore/sigstore to pick up oidc login for vault. (#1377)
  - Bump google.golang.org/api from 0.65.0 to 0.66.0 (#1371)
  - expose dafaults fulcio, rekor, oidc issuer urls (#1368)
  - add check to make sure the go modules are in sync (#1369)
  - README: fix link to race conditions (#1367)
  - Bump cloud.google.com/go/storage from 1.18.2 to 1.19.0 (#1365)
  - docs: verify-attestation cue and rego policy doc (#1362)
  - Update verify-blob to support DSSEs (#1355)
  - organize, update select deps (#1358)
  - Bump go-containerregistry to pick up ACR keychain fix (#1357)
  - Bump github.com/go-openapi/runtime from 0.21.0 to 0.21.1 (#1352)
  - sync go modules (#1353)</changelog>
  <changelog author="meissner@suse.com" date="1648814400">- updated to 1.6.0
  - Fix double time import in e2e tests by @saschagrunert in #1388
  - Add --timeout support to sign command by @saschagrunert in #1379
  - Fix comparison in replace option for attestation by @bburky in #1366
  - Add Cosign logo to README by @nsmith5 in #1395
  - Minor refactor to verify SCT and Rekor entry with multiple keys by @haydentherapper in #1396
  - Fix a link of SECURITY.md by @knqyf263 in #1399
  - update cosign and cross-build image for the release job by @cpanato in #1400
  - feat: login command by @developer-guy in #1398
  - TUF: Add root status output by @asraa in #1404
  - Add a newline after password input by @knqyf263 in #1407
  - make imageRef lowercase before parsing by @bobcallaway in #1409
  - Improve error message when image is not found in registry by @imjasonh in #1410
  - Add ability to override the Spiffe socket via environmental variable: by @vaikas in #1421
  - Fix incorrect error check when verifying SCT by @haydentherapper in #1422
  - Skip the ReadWrite test that flakes on Windows. by @dlorenc in #1415
  - Allow PassFunc to be nil by @saschagrunert in #1426
  - Update the cosign keyless documentation to point to the GA release. by @dlorenc in #1427
  - Remove TUF timestamp from OCI signature bundle by @haydentherapper in #1428
  - Add docs on API stability and deprecation table by @priyawadhwa in #1429
  - update cross-build image which adds goimports by @cpanato in #1435
  - feat: enhance clean cmd capability by @developer-guy in #1430
  - use the upstream kubernetes version lib and ldflags by @n3wscott in #1413
  - Improve log lines to match with implementation by @marcofranssen in #1432
  - feat: fig autocomplete feature by @developer-guy in #1360
  - update cross-build to use go 1.17.7 by @cpanato in #1446
  - Fetch verification targets by TUF custom metadata by @haydentherapper in #1423
  - feat: add -buildid= to ldflags by @developer-guy in #1451
  - Streamline SignBlobCmd API with SignCmd by @saschagrunert in #1454
  - convert release cosigned to also generate yaml artifact. by @k4leung4 in #1453
  - Fix tkn link in readme by @Yongxuanzhang in #1459
  - Print message when verifying with old TUF targets by @haydentherapper in #1468
  - fix(sign): refactor unsupported provider log by @Dentrax in #1464
  - tests: /bin/bash -&gt; /usr/bin/env bash by @znewman01 in #1470
  - Double goreleaser timeout by @znewman01 in #1472
  - increase timeout for goreleaser snapshot by @cpanato in #1473
  - fix(sign): kms unspported message by @Dentrax in #1475
  - refactor release cloudbuild job by @cpanato in #1476
  - Fix wording on attach attestation help by @luhring in #1480
  - update go-tuf and simplify TUF client code by @asraa in #1455
  - add initial changelog for 1.5.2 by @cpanato in #1483
  - Fix linter error on main by @priyawadhwa in #1484
  - Update Changelog for Security Advisory by @cpanato in #1485
  - chore(makefile): use kocache, convert publish to build by @developer-guy in #1488
  - Pick up a change to quiet ECR-login logging. by @mattmoor in #1491
  - feat: support other types in copy cmd by @developer-guy in #1493
  - Pick up some of the shared workflows by @mattmoor in #1490
  - feat: nominate Dentrax as codeowner by @developer-guy in #1492
  - add correct layer media type to cosign attach attestation by @spiffcs in #1503
  - This sets up the scaffolding for the cosigned CRD types. by @mattmoor in #1504
  - use v6 api calls in GH action for updating release milestones by @bobcallaway in #1511
  - Add skeleton reconciler for cosigned API CRD. by @mattmoor in #1513
  - bug fix: import ed25519 keys and fix error handling by @asraa in #1518
  - optimize codeql speed by using caching and tracing by @bobcallaway in #1519
  - Add a dummy.go file to allow vendoring config by @jdolitsky in #1520
  - Add CertExtensions func to extract all extensions by @ckotzbauer in #1515
  - chore(ci): add artifact hub support by @Dentrax in #1522
  - Change Fulcio URL default to be fulcio.sigstore.dev by @haydentherapper in #1529
  - Add codecov as github action, set permissions to read content only by @k4leung4 in #1530
  - images: remove --bare flags that conflict with --base-import-paths by @cpanato in #1533
  - Quay OCI Support in README by @sabre1041 in #1539
  - add rpm,deb and apks for cosign packages by @strongjz in #1537
  - Consistent parenthesis use in Makefile by @k4leung4 in #1541
  - add changelog for 1.6.0 by @cpanato in #1535
  - update golang cross image by @cpanato in #1543
  - Add fields in policy CRD by @kkavitha in #1540
  - Disable for now due some issues when downloading the knative module by @cpanato in #1546</changelog>
  <changelog author="meissner@suse.com" date="1650974400">- updated to 1.7.2
  - [Cosigned] Fix publicKey unmarshal by @DennyHoang in #1719
  - fix: add permissions to patch events by @hectorj2f in #1722
  - Make public all types required to use ValidatePolicy by @jdolitsky in #1727
  - Add unit tests for IntotoAttestation verifier. by @vaikas in #1728
  - Remove newline from download sbom output by @ribbybibby in #1732
  - Fix packages name and binary in the packages by @cpanato in #1734
  - Fix fulcioroots test and linter error by @haydentherapper in #1741
  - Support non-ECDSA public keys in certificates by @haydentherapper in #1740
  - bug: remove old fulcio root and fix fallback target code by @asraa in #1738
- updated to 1.7.1
  - pkcs11: fix build instructions by @rgerganov in #1550
  - add definition for artifact hub to verify the ownership by @cpanato in #1563
  - Add example using AWS Key Management Service (KMS) by @davivcgarcia in #1564
  - Start of the necessary pieces to get #1418 and #1419 implemented by @vaikas in #1562
  - Support deletion of ClusterImagePolicy by @vaikas in #1580
  - 1417 policy validations by @kkavitha in #1548
  - Don't lowercase input image refs, just fail by @imjasonh in #1586
  - Fix #1583 #1582. Disallow regex now until implemented. by @vaikas in #1584
  - Fix piping 'cosign verify' using fulcio/rekor by @marcofranssen in #1590
  - Fix #1592 move authorities as siblings of images. by @vaikas in #1593
  - Add ability to inline secrets from SecretRef to configmap. by @vaikas in #1595
  - Fix copy/paste mistake in repo name. by @k4leung4 in #1600
  - Use reusuable release workflow in sigstore/sigstore by @k4leung4 in #1599
  - Add public key validation by @kkavitha in #1598
  - Validate a public key in a secret is valid. by @vaikas in #1602
  - Ensure entry is removed from CM on secret error. by @vaikas in #1605
  - Add two env variables. One for using Rekor public key from OOB and one for fetching it from Rekor server by @vaikas in #1610
  - Init entity from ociremote when signing a digest ref by @puerco in #1616
  - rename ca-key to ca-cert. Fix 1608, 1613 by @vaikas in #1617
  - improve cosigned validation error messages by @cpanato in #1618
  - Use latest knative/pkg's configmap informer by @tcnghia in #1615
  - Included OpenSSF Best Practices Badge by @naveensrinivasan in #1628
  - FUN.md broke when RecordObj changed to HashedRecordObj by @MitchellJThomas in #1633
  - update crane to v0.8.0 release by @cpanato in #1635
  - push latest tag when building a release by @cpanato in #1636
  - Add extra label and change the latest tag to unstable for non tagged releases by @cpanato in #1637
  - Document Elastic container registry support by @mgreau in #1641
  - Validate authority keys by @coyote240 in #1623
  - feat: tree command utility by @developer-guy in #1603
  - fix build date format for version command by @cpanato in #1644
  - Add support for intermediate certificates when verifiying by @haydentherapper in #1631
  - Prompt user before running cosign clean by @priyawadhwa in #1649
  - Use ClusterImagePolicy with Keyless + e2e tests for CIP with kind by @vaikas in #1650
  - KEYLESS.md: Shorten example OAuth URL by @tstromberg in #1661
  - Use syscall.Stdin for input handle. Fixes #1153 by @mdp in #1657
  - Add support for certificate chain to verify certificate by @haydentherapper in #1659
  - First batch of followups to #1650 by @vaikas in #1664
  - Add certificate chain flag for signing by @haydentherapper in #1656
  - [attach]: Add specific suffixes mediaTypes to sboms by @hectorj2f in #1663
  - update font when output the cosign version by @cpanato in #1668
  - feat: add ability to override registry keychain by @noamichael in #1666
  - remove replace directive by @cpanato in #1669
  - Refactor based on discussions in #1650 by @vaikas in #1674
  - Find all valid entries in verify-blob by @priyawadhwa in #1673
  - Fix relative paths in Gitub OIDC blob test by @priyawadhwa in #1677
  - Add support for cert and cert chain flags with PKCS11 tokens by @haydentherapper in #1671
  - Use cosign @ HEAD for Github OIDC sign blob test by @priyawadhwa in #1678
  - Make cosign copy copy metadata attached to child images. by @mattmoor in #1682
  - change file_name_template to PackageName by @strongjz in #1683
  - Update error message for verify/verify attestation by @haydentherapper in #1686
  - cosign clean: Don't log failure if the registry responds with 404 by @imjasonh in #1687
  - verify: add leaf hash verification for tlog entries by @asraa in #1688
  - Fix handling of policy in verify-attestation by @lcarva in #1672
  - Add e2e test for attest / verify-attestation by @vaikas in #1685
  - verify: remove extra calls to rekor for verify and verify-blob by @asraa in #1694
  - Remove the hardcoded sigstore audience by @mattmoor in #1698
  - Use ValidatePubKey from sigstore/sigstore by @haydentherapper in #1676
  - Use the github actions from sigstore/scaffolding. by @vaikas in #1699
  - sign: set the oidc redirect uri by @hectorj2f in #1675
  - add back the go mod proxy by @cpanato in #1701
  - enable 1.23 tests (Test cosigned with ClusterImagePolicy) by @cpanato in #1702
  - Fix incorrect unmarshalling of SCT response by @haydentherapper in #1704
  - Make CLI flag for OIDC client secret take a path by @znewman01 in #1705
  - cosigned: read the public key from the kms authority by @hectorj2f in #1706
  - fix latest tag when running a release job by @cpanato in #1707
  - [Cosigned] Parse and store publicKey data earlier by @DennyHoang in #1681
  - Dont overwrite token set in keyOpts by @puerco in #1709
  - refactor release job by @cpanato in #1710</changelog>
  <changelog author="meissner@suse.com" date="1653134400">- updated to 1.8.0
  - Move the KMS integration imports into the binary entrypoints by @mattmoor in #1744
  - [Cosigned] Convert functions for webhookCIP from v1alpha1 by @DennyHoang in #1736
  - Refactor policy related code, add support for vuln verify by @vaikas in #1747
  - Use bundle log ID to find verification key by @haydentherapper in #1748
  - [cosigned] The webhook name is now configurable via --webhook-name flag by @vpnachev in #1726
  - Add intermediate CA certificate pool for Fulcio by @haydentherapper in #1749
  - test: create fake TUF test root and create test SETs for verification by @asraa in #1750
  - Implement identities, fix bug in webhook validation. by @vaikas in #1759
  - Validate issuer/subject regexp in validate webhook. by @vaikas in #1761
  - chore: add warning when attaching sBOMs by @hectorj2f in #1756
  - Verify embedded SCTs by @haydentherapper in #1731
  - chore: add warning when downloading a sBOM by @hectorj2f in #1763
  - [policy-webhook] The webhooks name is now configurable via --(validating|mutating)-webhook-name flags by @vpnachev in #1757
  - Break the CIP action tests into a sh script. by @vaikas in #1767
  - tuf: add debug info if tuf update fails by @asraa in #1766
  - cosigned: add support for rsa keys by @hectorj2f in #1768
  - Cosigned validate against remote sig src by @DennyHoang in #1754
  - Add Fulcio intermediate CA certificate to intermediate pool by @haydentherapper in #1774
  - fix: more informative error by @ybelMekk in #1778
  - Run update-codegen. by @wlynch in #1789
  - Remove the dependency on v1alpha1.Identity which brings in unnecessary k8s deps. by @vaikas in #1790
  - Refactor fulcio signer to take in KeyOpts. by @wlynch in #1788
  - test: add cue unit tests by @hectorj2f in #1791
  - Attestations + policy in cip. by @vaikas in #1772
  - chore: add rego function to consume modules and evaluate them by @hectorj2f in #1787
  - Add parallelization for processing policies / authorities. by @vaikas in #1795
  - Allow passing keys via environment variables (env:// refs) by @znewman01 in #1794
  - Handle context cancelled properly + tests. by @vaikas in #1796
  - Fix a bug where an error would send duplicate results. by @vaikas in #1797
  - Revert "Refactor fulcio signer to take in KeyOpts. (#1788)" by @wlynch in #1798
  - cosigned: Unify cue data and policy before evaluating it by @hectorj2f in #1793
  - Don't fail open in VerifyBundle by @mtrmac in #1648
  - Load in intermediate cert pool from TUF by @haydentherapper in #1804
  - Support PKCS1 encoded and non-ECDSA CT log public keys by @haydentherapper in #1806</changelog>
  <changelog author="meissner@suse.com" date="1655553600">- updated to 1.9.0
  - Check failure message of policy that fails with issuer mismatch by @vaikas in #1815
  - [Cosigned] Add signature pull secrets by @DennyHoang in #1805
  - feat: add rego policy support by @hectorj2f in #1817
  - Refactor fulcio signer to take in KeyOpts (take 2) by @wlynch in #1818
  - cosigned: Test unsupported KMS providers by @imjasonh in #1820
  - chore(deps): Included dependency review by @naveensrinivasan in #1792
  - Add auth flow option to KeyOpts. by @wlynch in #1827
  - Document Staging instance usage with Keyless by @k4leung4 in #1824
  - New flag --oidc-providers-disable to disable OIDC providers by @puerco in #1832
  - Validate tlog entry when verifying signature via public key. by @wlynch in #1833
  - Add function to explicitly request a certain provider by @priyawadhwa in #1837
  - cosigned: Fix podAntiAffinity labels by @elfotografo007 in #1841
  - remove exclude from go.mod by @cpanato in #1846
  - [Cosigned] Glob matching improvement by @DennyHoang in #1842
  - sget: Enable KMS providers for sget by @imjasonh in #1852
  - Fix piv-tool generate-key command in TOKENS doc by @nealmcb in #1850
  - Add IBM Cloud Container Registry to tested registry list by @bainsy88 in #1856
  - If SBOM ref has .json suffix, assume JSON mediatype by @jdolitsky in #1859
  - Add rekor.0.pub TUF target to unit tests by @priyawadhwa in #1860
  - Normalize certificate flag names by @haydentherapper in #1868
  - Check certificate policy flags with only a certificate by @haydentherapper in #1869
  - Update go to 1.17.10 / cosign image to 1.18.0 and actions setup go by @cpanato in #1861
  - Point git commmit FUN.md to gitsign! by @wlynch in #1874
  - [cosigned] remove regex from the image pattern fields by @hectorj2f in #1873
  - go.mod: format go.mod by @zchee in #1879
  - Remove dependency on deprecated github.com/pkg/errors by @zchee in #1887
  - tree: only report artifacts that are present by @ribbybibby in #1872
  - update README with ebpf modules by @EItanya in #1888
  - Update github.com/google/go-containerregistry/pkg/authn/k8schain module to f1b065c6cb3d by @vpnachev in #1889
  - v1beta1 API for cosigned by @vaikas in #1890
  - tree: support --attachment-tag-prefix by @ribbybibby in #1900
  - [cosigned] Remove undefined apiGroups from policy clusterrole by @vpnachev in #1896
  - GHSA-66x3-6cw3-v5gj: Update go-tuf to v0.3.0 by @janisz in #1894
  - The timeout arg in golangci-lint has been moved to the generic args p… by @dlorenc in #1901
  - [cosigned] Rename cosigned references to policy-controller by @hectorj2f in #1893
  - Move deprecated dependency: google/trillian/merkle to transparency-dev by @cpanato in #1910
  - Add support for "**" in image glob matching by @imjasonh in #1914
  - Add privacy statement for PII storage by @haydentherapper in #1909
  - Do not push to public rekor. by @vaikas in #1931
  - fix: fix fetching updated targets from TUF root by @asraa in #1921
  - fix: fix #1930 for AWS KMS formats by @vaikas in #1946
  - update cross-builder image to use go1.17.11 by @cpanato in #1950
  - remove deprecation from goreleaser, go-fish is not supported anymore by @cpanato in #1952
  - add changelog for v1.9.0 by @cpanato in #1955
  - add parallelism for goreleaser by @cpanato in #1957</changelog>
  <changelog author="meissner@suse.com" date="1658923200">- updated to 1.10.0
  - replace gcr.io/distroless/ to use ghcr.io/distroless/ by @cpanato in #1961
  - Separate RegExp matching of issuer/subject from strict by @vaikas in #1956
  - tuf: improve TUF client concurrency and caching by @asraa in #1953
  - Add Cloudsmith Container Registry to tested registry list by @ciaracarey in #1966
  - feat(fulcioroots): singleton error pattern by @developer-guy in #1965
  - Drop tuf client dependency on GCS client library by @imjasonh in #1967
  - Add spdxjson predicate type for attestations by @jdolitsky in #1974
  - Remove policy-controller now that it lives in sigstore/policy-controller by @vaikas in #1976
  - cleanup: unexport kubernetes.Client method by @imjasonh in #1973
  - cleanup ci job and remove policy-controller references by @cpanato in #1981
  - fix/update post build job by @cpanato in #1983
  - docs: updated Azure kms commands. by @JBrejnholt in #1972
  - Add cyclonedx predicate type for attestations by @jdolitsky in #1977
  - Route deprecated -version to version subcommand by @puerco in #1854
  - docs(readme): add installation steps for container image for cosign binary by @developer-guy in #1986
  - Add --platform flag to cosign sbom download by @puerco in #1975
  - Use pkg/fulcioroots and pkg/tuf from sigstore/sigstore by @imjasonh in #1866
  - Add --oidc-provider flag to specify which provider to use for ambient credentials by @priyawadhwa in #1998
  - encrypt values to create the github action secret by @cpanato in #1990
  - sign-blob: bundle should work independently and respect --output-certificate and --output-signature by @Dentrax in #2016
  - Attempt to clean up pkg/cosign by @imjasonh in #2018
  - public-key: fix command description by @Dentrax in #2024
  - [NFC] specs: fix list formatting on SIGNATURE_SPEC by @woodruffw in #2030
  - feat: cert-extensions verify by @developer-guy in #1626
  - Fix #1378 create new attestation signature in replace mode if not existent by @Syquel in #2014
  - Use cosign.ConfirmPrompt more consistently by @imjasonh in #2039
  - chore: add a note about SIGSTORE_REKOR_PUBLIC_KEY var by @hectorj2f in #2040
  - Fix OIDC test by @cpanato in #2050
  - Add env subcommand. by @wlynch in #2051
  - remove tests with 1.21 k8s cluster because it is deprecated and add v1.23/24 by @cpanato in #2055
  - update ct/otel and etcd by @cpanato in #2054
  - chore(deps): CycloneDX PredicateType changed to use in-toto-golang by @masahiro331 in #2067
  - Remove replace directives in go.mod. by @wlynch in #2070
  - update design doc link by @bobcallaway in #2077
  - Remove hack/tools.go by @imjasonh in #2080
  - fix missing quote by @cpanato in #2090
- removed cosigned and webhook</changelog>
  <changelog author="meissner@suse.com" date="1659700800">- updated to 1.10.1 (jsc#SLE-23879)
  - CVE-2022-35929: Fixed that cosign verify-attestaton --type can
    report a false positive if any attestation exists (GHSA-vjxv-45g9-9296
    (bsc#1202157)
- What else changed:
  - add flag to allow skipping upload to transparency log by @k4leung4 in #2089
  - Improve error message when no sigs/atts are found for an image by @imjasonh in #2101
  - Change Result in Vulnerability Attestation to interface{} by @knqyf263 in #2096
  - Fix field names in the vulnerability attestation by @otms61 in #2099
  - remove style jobs and cleanup makefile gofmt and goimports are running already with golangci-lint by @cpanato in #2105
  - sparkles Enable Scorecard badge by @azeemshaikh38 in #2109
  - Resolves #522 set Created date to time of execution by @Lerentis in #2108
  - Introduce a custom error type to classify errors. by @mattmoor in #2114
  - feat: attach: attestation: allow passing multiple payloads by @Dentrax in #2085
  - update cross-builder to go1.18.5 and cosign image to 1.10.0 by @cpanato in #2119
  - chore: fix documentation and warning on using untrusted rekor key by @asraa in #2124
  - Correct the type used for attest by @mattmoor in #2128</changelog>
  <changelog author="meissner@suse.com" date="1663243200">- updated to 1.12.0 (jsc#SLE-23879)
  - CVE-2022-36056: Fixed verify-blob could successfully verify an artifact when verification should have failed (bsc#1203430)
  - Support non-ECDSA key types for verify-blob by @haydentherapper in #2203
  - feat: integrate Alibaba Cloud Container Registry cred helper by @mozillazg in #2008
  - remove double quotes, looks like it is passing as a single string to cosign and not as an array by @cpanato in #2205
  - Clarify error when KMS provider fails to load by @znewman01 in #2220
  - feat: set annotations to generate additional bash completion information by @dirien in #2221
  - Add deprecation warning for sget CLI and packages by @imjasonh in #2019
  - upgrade setup-ko to point to new repo by @imjasonh in #2225
  - Temp fix for e2e test by @haydentherapper in #2247
  - update kind to use release v0.15.0 and some version comments by @cpanato in #2246
  - Fix e2e test failure, add test for local bundle without rekor bundle by @haydentherapper in #2248
  - fix: fix secret test, non-experimental bundle should pass by @asraa in #2249
- updated to 1.11.1
  - add stale workflow using the workflow template by @cpanato in #2175
  - Update Scorecard action to v2:alpha by @azeemshaikh38 in #2177
  - add release cadence section in the readme by @cpanato in #2179
  - feat: Rework fig autocomplete command by @dirien in #2187
  - fix: fix typo that caused attestation verification failure by @asraa in #2199
- updated to 1.11.0
  - Verify the certificate chain against the Fulcio root trust by default by @wata727 in #2139
  - Add notes to clarify registry use. by @bendory in #2145
  - Use TUF from scaffolding for validating cosign. by @vaikas in #2146
  - docs: clarify wording in spec about usage of certificate chain by @asraa in #2152
  - fix: fix blob verification output with sharded rekor tlogs by @asraa in #2157
  - fix: adds envelope hash to in-toto entries in tlog entry creation by @nkreiger in #2118
  - fix handling of verify-attestation types for URIs by @otms61 in #2159
  - fix oidc post-merge job by @cpanato in #2164
  - Remove third_party by @imjasonh in #2166
  - use updated device flow logic with PKCE by @bobcallaway in #2163
  - fix: rekor get tlog entry with uuid by @asraa in #2058
  - update e2e job to run only when push to main by @cpanato in #2169
  - fix: add env cmd to root by @developer-guy in #2171
  - fix panic when os.Stat returns an error besides ErrNotExists by @dsa0x in #2162</changelog>
  <changelog author="dmueller@suse.com" date="1664280000">- update to 1.12.1:
  * fix: Pulls Fulcio root and intermediate when --certificate-chain is not
    passed into verify-blob command. The v1.12.0 release introduced a
    regression: when COSIGN_EXPERIMENTAL was not set, cosign verify-blob would
    check a --certificate (without a --certificate-chain provided) against the
    operating system root CA bundle. In this release, Cosign checks the
    certificate against Fulcio's CA root instead (restoring the earlier
    behavior).
  * fix: fix cert chain validation for verify-blob in non-experimental mode
  * fix: add COSIGN_EXPERIMENTAL=1 for verify-bloba
  * Fix BYO-root with intermediate to fetch intermediates from annotation
  * fix: fixing breaking changes in rekor v1.12.0 upgrade
- use go-modules service to generate the vendor.tar and use zstd</changelog>
  <changelog author="meissner@suse.com" date="1666094400">- update to 1.13.1:
  * verify-blob-attestation: allow multiple subjects in in_toto attestation (#2341)
  * Nits for #2337 (#2342)
  * Add verify-blob-attestation command and tests (#2337)
  * Update warning when users sign images by tag. (#2313)
  * Remove experimental flags from attest-blob and refactor (#2338)
  * Add --output-attestation flag to attest-blob and remove experimental signing (#2332)
  * Add attest-blob command (#2286)
  * Add '--cert-identity' flag to support subject alternate names for ver… (#2278)
  * Update Dockerfile section of README (#2323)
  * Fix option description: "sign" --&gt; "verify" (#2306)
- update to 1.13.0:
  * feat: use stdin as an input for predicate by @developer-guy in https://github.com/sigstore/cosign/pull/2269
  * feat: improve the verification message by @developer-guy in https://github.com/sigstore/cosign/pull/2268
  * use scaffolding 0.4.8 for tests. by @vaikas in https://github.com/sigstore/cosign/pull/2280
  * fix pivtool generate key touch policy by @cpanato in https://github.com/sigstore/cosign/pull/2282
  * Check error on chain verification failure by @haydentherapper in https://github.com/sigstore/cosign/pull/2284
  * Fix: Remove an extra registry request from verification path. by @mattmoor in https://github.com/sigstore/cosign/pull/2285
  * Fix: Create a static copy of signatures as part of verification. by @mattmoor in https://github.com/sigstore/cosign/pull/2287
  * Data race in FetchSignaturesForReference by @RTann in https://github.com/sigstore/cosign/pull/2283
  * Add support for Fulcio username identity in SAN by @haydentherapper in https://github.com/sigstore/cosign/pull/2291
  * fix: make tlog entry lookups for online verification shard-aware by @asraa in https://github.com/sigstore/cosign/pull/2297
  * Better help text to sign and verify SBOM by @ChristianCiach in https://github.com/sigstore/cosign/pull/2308
  * Adding warning to pin to digest by @ChaosInTheCRD in https://github.com/sigstore/cosign/pull/2311
  * Add annotations for upload blob. by @cldmnky in https://github.com/sigstore/cosign/pull/2188
  * replace deprecate package by @cpanato in https://github.com/sigstore/cosign/pull/2314
  * update release images to use go1.19.2 and cosign v1.12.1 by @cpanato in https://github.com/sigstore/cosign/pull/2315</changelog>
  <changelog author="meissner@suse.com" date="1677499200">- update to 2.0.0 (jsc#SLE-23879)
  Breaking Changes:
  * insecure-skip-tlog-verify: rename and adapt the cert expiration check (#2620)
  * Deprecate --certificate-email flag. Make --certificate-identity and -… (#2411)
  Enhancements:
  * Change go module name to github.com/sigstore/cosign/v2 for Cosign 2.0 (#2544)
  * Allow users to pass in a path for the --identity-token flag (#2538)
  * Breaking change: Respect tlog-upload=false, default to true (#2505)
  * Support outputing a certificate without uploading to the tlog (#2506)
  * Attestation/Blob signing and verification using a RFC3161 time-stamping server (#2464)
  * respect tlog-upload flag with TSA (#2474)
  * Better feedback if specifying incompatible argument on cosign sign --attachment (#2449)
  * Support TSA and Rekor verifications (#2463)
  * add support for tsa signing and verification of images (#2460)
  * cosign policy sign: remove experimental flag and make keyless signing default (#2459)
  * Remove experimental mode from cosign attest and verify-attestation (#2458)
  * Remove experimental mode from sign-blob and verify-blob (#2457)
  * Add --offline flag to force offline verification (#2427)
  * Air gap support (#2299)
  * Breaking change: Change SCT verification behavior to default to enforcement (#2400)
  * Breaking change: remove --force flag from sign and attest and rely on --yes flag to skip confirmation (#2399)
  * Breaking change: replace --no-tlog-upload flag with --tlog-upload flag (#2397)
  * Remove experimental flag from cosign sign and cosign verify (#2387)
  * verify: remove SIGSTORE_TRUST_REKOR_API_PUBLIC_KEY test env var for using a key from rekor's API (#2362)
  * Add warning to use digest instead of tags to other cosign commands (#2650)
  * Fix up UI messages (#2629)
  * Remove hardcoded Fulcio from output (#2621)
  * Fix missing privacy statement, print in multiple locations (#2622)
  * feat: allows custom key names for import-key-pair (#2587)
  * feat: support keyless verification for verify-blob-attestation (#2525)
  * attest-blob: add functionality for keyless signing (#2515)
  * Rego: add support for custom error/warning messages when evaluating rego rules (#2577)
  * feat: add debug information to cert validation error (#2579)
  * Support non-Sigstore TSA requests (#2708)
  * Add COSIGN_OCI_EXPERIMENTAL, push .sig/.sbom using OCI 1.1+ digest tag (#2684)
  * Output certificate in bundle when entry is not uploaded to Rekor (#2715)
  * attach signature and attach sbom must use STDIN to upload raw string (#2637)
  * add generate-key-pair GitHub Enterprise server support (#2676)
  * add in format string for warning (#2699)
  * Support for fetching Fulcio certs with self-managed key (#2532)
  * 2476 predicate type download (#2484)
  Bug Fixes:
  * Fix the file existence check. (#2552)
  * Fix timestamp verification, add verify-blob tests (#2527)
  * Fix(verify): Consolidate certificate expiry logic (#2504)
  * Updates to Timestamp signing and verification (#2499)
  * Fix: removes attestation payload from attest-blob's output &amp; no base64 encoding (#2498)
  * Fix path for e2e-tests badge (#2490)
  * Fix spdx json media type (#2479)
  * Fix sct verificaction (#2426)
  * Fix: panic with unsigned local image (#2656)
  * Make sure a cert passed in via --cert matches the bundle cert (#2652)
  * Fix: fix github oidc post submit test (#2594)
  * Fix: add enhanced error messages for failing verification with TUF targets (#2589)
  * Fix: Add missing schemes to cosign predicate types. (#2717)
  * Fix: Drop the CosignPredicate wrapper around SBOM attestations. (#2718)
  * Fix prompts with Windows line endings (#2674)</changelog>
  <changelog author="dmueller@suse.com" date="1680609600">- fix buildtags
- build against a maintained golang version (upstream uses go1.20)</changelog>
  <changelog author="meissner@suse.com" date="1681732800">- update to 2.0.1 (jsc#SLE-23879)
  Enhancements
  - Add environment variable token provider (#2864)
  - Remove cosign policy command (#2846)
  - Allow customising 'go' executable with GOEXE var (#2841)
  - Consistent tlog warnings during verification (#2840)
  - Add riscv64 arch (#2821)
  - Default generated PEM labels to SIGSTORE (#2735)
  - Update privacy statement and confirmation (#2797)
  - Add exit codes for verify errors (#2766)
  - Add Buildkite provider (#2779)
  - verify-blob-attestation: Loosen arg requirements if --check-claims=false (#2746)
  Bug Fixes
  - PKCS11 sessions are now opened read only (#2853)
  - Makefile: date format of log should not show signatures (#2835)
  - Add missing flags to cosign verify dockerfile/manifest (#2830)
  - Add a warning to remember how to configure a custom Gitlab host (#2816)
  - Remove tag warning message from save/copy commands (#2799)
  - Mark keyless pem files with b64 (#2671)</changelog>
  <changelog author="meissner@suse.com" date="1683460800">- update to 2.0.2 (jsc#SLE-23879)
  Enhancements
  - Update sigstore/sigstore to v1.6.2 to pick up TUF CDN change (#2891)
  - feat: Make cosign copy faster (#2901)
  - remove sget (#2885)
  - Require a payload to be provided with a signature (#2785)
  Bug Fixes
  - cmd: Change error message from KeyParseError to PubKeyParseError for verify-blob. (#2876)
  - Use SOURCE_DATE_EPOCH for OCI CreatedAt times (#2878)
  Documentation
  - Remove experimental warning from Fulcio flags (#2923)
  - add missing oidc provider (#2922)
  - Add zot as a supported registry (#2920)
  - deprecates kms_support docs (#2900)
  - chore(docs) deprecate note for usage docs (#2906)
  - adds note of deprecation for examples.md docs (#2899)</changelog>
  <changelog author="meissner@suse.com" date="1687867200">- updated to 2.1.1 (jsc#SLE-23879)
  - Bug Fixes
  - wait for the workers become available again to continue the execution (#3084)
  - fix help text when in a container (#3082)
- updated to 2.1.0 (jsc#SLE-23879)
  - Breaking Change: The predicate is now a required flag in the attest commands, set via the --type flag.
  - Enhancements
  - Verify sigs and attestations in parallel (#3066)
  - Deep inspect attestations when filtering download (#3031)
  - refactor bundle validation code, add support for DSSE rekor type (#3016)
  - Allow overriding remote options (#3049)
  - feat: adds no cert found on sig exit code (#3038)
  - Make predicate a required flag in attest commands (#3033)
  - Added support for attaching Time stamp authority Response in attach command (#3001)
  - Add sign --sign-container-identity CLI (#2984)
  - Feature: Allow cosign to sign digests before they are uploaded. (#2959)
  - accepts attachment-tag-prefix for cosign copy (#3014)
  - Feature: adds '--allow-insecure-registry' for cosign load (#3000)
  - download attestation: support --platform flag (#2980)
  - Cleanup: Add Digest to the SignedEntity interface. (#2960)
  - verify command: support keyless verification using only a provided certificate chain with non-fulcio roots (#2845)
  - verify: use workers to limit the paralellism when verifying images with --max-workers flag (#3069)
  - Bug Fixes
  - Fix pkg/cosign/errors (#3050)
  - Fix: update doc to refer to github-actions oidc provider (#3040)
  - Fix: prefer GitHub OIDC provider if enabled (#3044)
  - Fix --sig-only in cosign copy (#3074)
  - Documentation
  - Fix links to sigstore/docs in markdown files (#3064)</changelog>
  <changelog author="meissner@suse.com" date="1693569600">- updated to 2.2.0 (jsc#SLE-23879)
  - Enhancements
  * switch to uploading DSSE types to rekor instead of intoto (#3113)
  * add 'cosign sign' command-line parameters for mTLS (#3052)
  * improve error messages around bundle != payload hash (#3146)
  * make VerifyImageAttestation function public (#3156)
  * Switch to cryptoutils function for SANS (#3185)
  * Handle HTTP_1_1_REQUIRED errors in github provider (#3172)
  - Bug Fixes
  * Fix nondeterminsitic timestamps (#3121)
  - Documentation
  * doc: Add example of sign-blob with key in env var (#3152)
  * add deprecation notice for cosign-releases GCS bucket (#3148)
  * update doc links (#3186)</changelog>
  <changelog author="meissner@suse.com" date="1699358400">- updated to 2.2.1 (jsc#SLE-23879)
  This release comes with a fix for
  CVE-2023-46737 / bsc#1216933 described in this [Github Security
  Advisory](https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9).
  Enhancements:
  * feat: Support basic auth and bearer auth login to registry (#3310)
  * add support for ignoring certificates with pkcs11 (#3334)
  * Support ReplaceOp in Signatures (#3315)
  * feat: added ability to get image digest back via triangulate (#3255)
  * feat: add `--only` flag in `cosign copy` to copy sign, att &amp; sbom (#3247)
  * feat: add support attaching a Rekor bundle to a container (#3246)
  * feat: add support outputting rekor response on signing (#3248)
  * feat: improve dockerfile verify subcommand (#3264)
  * Add guard flag for experimental OCI 1.1 verify. (#3272)
  * Deprecate SBOM attachments (#3256)
  * feat: dedent line in cosign copy doc (#3244)
  * feat: add platform flag to cosign copy command (#3234)
  * Add SLSA 1.0 attestation support to cosign. Closes #2860 (#3219)
  * attest: pass OCI remote opts to att resolver. (#3225)
  Bug Fixes:
  * Merge pull request from GHSA-vfp6-jrw2-99g9
  * fix: allow cosign download sbom when image is absent (#3245)
  * ci: add a OCI registry test for referrers support (#3253)
  * Fix ReplaceSignatures (#3292)
  * Stop using deprecated in_toto.ProvenanceStatement (#3243)
  * Fixes #3236, disable SCT checking for a cosign verification when usin… (#3237)
  * fix: update error in `SignedEntity` to be more descriptive (#3233)
  * Fail timestamp verification if no root is provided (#3224)
  Documentation:
  * Add some docs about verifying in an air-gapped environment (#3321)
  * Update CONTRIBUTING.md (#3268)
  * docs: improves the Contribution guidelines (#3257)
  * Remove security policy (#3230)
  Others:
  * Set go to min 1.21 and update dependencies  (#3327)
  * Update contact for code of conduct (#3266)
  * Update .ko.yaml (#3240)</changelog>
  <changelog author="marcos.bjoerkelund@suse.com" date="1702382400">- updated to 2.2.2 (jsc#SLE-23879)
  v2.2.2 adds a new container with a shell,
  gcr.io/projectsigstore/cosign:vx.y.z-dev, in addition to the existing
  container gcr.io/projectsigstore/cosign:vx.y.z without a shell.
  For private deployments, we have also added an alias for
  - -insecure-skip-log, --private-infrastructure.
  Bug Fixes:
  * chore(deps): bump github.com/sigstore/sigstore from 1.7.5 to 1.7.6 (#3411) which fixes a bug with using Azure KMS
  * Don't require CT log keys if using a key/sk (#3415)
  * Fix copy without any flag set (#3409)
  * Update cosign generate cmd to not include newline (#3393)
  * Fix idempotency error with signing (#3371)
  Features:
  * Add --yes flag cosign import-key-pair to skip the overwrite confirmation. (#3383)
  * Use the timeout flag value in verify* commands. (#3391)
  * add --private-infrastructure flag (#3369)
  Container Updates:
  * Bump builder image to use go1.21.4 and add new cosign image tags with shell (#3373)
  Documentation:
  * Update SBOM_SPEC.md (#3358)</changelog>
  <changelog author="meissner@suse.com" date="1706875200">- updated to 2.2.3 (jsc#SLE-23879)
  Bug Fixes:
  * Fix race condition on verification with multiple signatures attached to image (#3486)
  * fix(clean): Fix clean cmd for private registries (#3446)
  * Fixed BYO PKI verification (#3427)
  Features:
  * Allow for option in cosign attest and attest-blob to upload attestation as supported in Rekor (#3466)
  * Add support for OpenVEX predicate type (#3405)
  Documentation:
  * Resolves #3088: `version` sub-command expected behaviour documentation and testing (#3447)
  * add examples for cosign attach signature cmd (#3468)
  Misc:
  * Remove CertSubject function (#3467)
  * Use local rekor and fulcio instances in e2e tests (#3478)
- bumped embedded golang.org/x/crypto/ssh to fix the Terrapin attack CVE-2023-48795 (bsc#1218207)</changelog>
  <changelog author="meissner@suse.com" date="1713182400">- updated to 2.2.4 (jsc#SLE-23879)
  * Bug Fixes
  * Fixes for GHSA-88jx-383q-w4qc and GHSA-95pr-fxf5-86gv (#3661)
  - CVE-2024-29902: Malicious attachments can cause system-wide denial of service (bsc#1222835)
  - CVE-2024-29903: Malicious artifects can cause machine-wide denial of service (bsc#1222837)
  * ErrNoSignaturesFound should be used when there is no signature attached to an image. (#3526)
  * fix semgrep issues for dgryski.semgrep-go ruleset (#3541)
  * Honor creation timestamp for signatures again (#3549)
  * Features
  * Adds Support for Fulcio Client Credentials Flow, and Argument to Set Flow Explicitly (#3578)
  * Documentation
  * add oci bundle spec (#3622)
  * Correct help text of triangulate cmd (#3551)
  * Correct help text of verify-attestation policy argument (#3527)
  * feat: add OVHcloud MPR registry tested with cosign (#3639)</changelog>
</package>
<package pkgid="caee9168cb35b78902f676eedea6dd249fd2ce02feda37266e56cd9cdb31430e" name="cosign" arch="ppc64le">
  <version epoch="0" ver="2.2.4" rel="150400.3.20.1"/>
  <changelog author="meissner@suse.com" date="1645444800">- updated to 1.5.2:
  - This release contains fixes for CVE-2022-23649, affecting signature
    validations with Rekor. Only validation is affected, it is not necessary
    to re-sign any artifacts. (bsc#1196239)
- updated to 1.5.1:
  - Bump sigstore/sigstore to pick up oidc login for vault. (#1377)
  - Bump google.golang.org/api from 0.65.0 to 0.66.0 (#1371)
  - expose dafaults fulcio, rekor, oidc issuer urls (#1368)
  - add check to make sure the go modules are in sync (#1369)
  - README: fix link to race conditions (#1367)
  - Bump cloud.google.com/go/storage from 1.18.2 to 1.19.0 (#1365)
  - docs: verify-attestation cue and rego policy doc (#1362)
  - Update verify-blob to support DSSEs (#1355)
  - organize, update select deps (#1358)
  - Bump go-containerregistry to pick up ACR keychain fix (#1357)
  - Bump github.com/go-openapi/runtime from 0.21.0 to 0.21.1 (#1352)
  - sync go modules (#1353)</changelog>
  <changelog author="meissner@suse.com" date="1648814400">- updated to 1.6.0
  - Fix double time import in e2e tests by @saschagrunert in #1388
  - Add --timeout support to sign command by @saschagrunert in #1379
  - Fix comparison in replace option for attestation by @bburky in #1366
  - Add Cosign logo to README by @nsmith5 in #1395
  - Minor refactor to verify SCT and Rekor entry with multiple keys by @haydentherapper in #1396
  - Fix a link of SECURITY.md by @knqyf263 in #1399
  - update cosign and cross-build image for the release job by @cpanato in #1400
  - feat: login command by @developer-guy in #1398
  - TUF: Add root status output by @asraa in #1404
  - Add a newline after password input by @knqyf263 in #1407
  - make imageRef lowercase before parsing by @bobcallaway in #1409
  - Improve error message when image is not found in registry by @imjasonh in #1410
  - Add ability to override the Spiffe socket via environmental variable: by @vaikas in #1421
  - Fix incorrect error check when verifying SCT by @haydentherapper in #1422
  - Skip the ReadWrite test that flakes on Windows. by @dlorenc in #1415
  - Allow PassFunc to be nil by @saschagrunert in #1426
  - Update the cosign keyless documentation to point to the GA release. by @dlorenc in #1427
  - Remove TUF timestamp from OCI signature bundle by @haydentherapper in #1428
  - Add docs on API stability and deprecation table by @priyawadhwa in #1429
  - update cross-build image which adds goimports by @cpanato in #1435
  - feat: enhance clean cmd capability by @developer-guy in #1430
  - use the upstream kubernetes version lib and ldflags by @n3wscott in #1413
  - Improve log lines to match with implementation by @marcofranssen in #1432
  - feat: fig autocomplete feature by @developer-guy in #1360
  - update cross-build to use go 1.17.7 by @cpanato in #1446
  - Fetch verification targets by TUF custom metadata by @haydentherapper in #1423
  - feat: add -buildid= to ldflags by @developer-guy in #1451
  - Streamline SignBlobCmd API with SignCmd by @saschagrunert in #1454
  - convert release cosigned to also generate yaml artifact. by @k4leung4 in #1453
  - Fix tkn link in readme by @Yongxuanzhang in #1459
  - Print message when verifying with old TUF targets by @haydentherapper in #1468
  - fix(sign): refactor unsupported provider log by @Dentrax in #1464
  - tests: /bin/bash -&gt; /usr/bin/env bash by @znewman01 in #1470
  - Double goreleaser timeout by @znewman01 in #1472
  - increase timeout for goreleaser snapshot by @cpanato in #1473
  - fix(sign): kms unspported message by @Dentrax in #1475
  - refactor release cloudbuild job by @cpanato in #1476
  - Fix wording on attach attestation help by @luhring in #1480
  - update go-tuf and simplify TUF client code by @asraa in #1455
  - add initial changelog for 1.5.2 by @cpanato in #1483
  - Fix linter error on main by @priyawadhwa in #1484
  - Update Changelog for Security Advisory by @cpanato in #1485
  - chore(makefile): use kocache, convert publish to build by @developer-guy in #1488
  - Pick up a change to quiet ECR-login logging. by @mattmoor in #1491
  - feat: support other types in copy cmd by @developer-guy in #1493
  - Pick up some of the shared workflows by @mattmoor in #1490
  - feat: nominate Dentrax as codeowner by @developer-guy in #1492
  - add correct layer media type to cosign attach attestation by @spiffcs in #1503
  - This sets up the scaffolding for the cosigned CRD types. by @mattmoor in #1504
  - use v6 api calls in GH action for updating release milestones by @bobcallaway in #1511
  - Add skeleton reconciler for cosigned API CRD. by @mattmoor in #1513
  - bug fix: import ed25519 keys and fix error handling by @asraa in #1518
  - optimize codeql speed by using caching and tracing by @bobcallaway in #1519
  - Add a dummy.go file to allow vendoring config by @jdolitsky in #1520
  - Add CertExtensions func to extract all extensions by @ckotzbauer in #1515
  - chore(ci): add artifact hub support by @Dentrax in #1522
  - Change Fulcio URL default to be fulcio.sigstore.dev by @haydentherapper in #1529
  - Add codecov as github action, set permissions to read content only by @k4leung4 in #1530
  - images: remove --bare flags that conflict with --base-import-paths by @cpanato in #1533
  - Quay OCI Support in README by @sabre1041 in #1539
  - add rpm,deb and apks for cosign packages by @strongjz in #1537
  - Consistent parenthesis use in Makefile by @k4leung4 in #1541
  - add changelog for 1.6.0 by @cpanato in #1535
  - update golang cross image by @cpanato in #1543
  - Add fields in policy CRD by @kkavitha in #1540
  - Disable for now due some issues when downloading the knative module by @cpanato in #1546</changelog>
  <changelog author="meissner@suse.com" date="1650974400">- updated to 1.7.2
  - [Cosigned] Fix publicKey unmarshal by @DennyHoang in #1719
  - fix: add permissions to patch events by @hectorj2f in #1722
  - Make public all types required to use ValidatePolicy by @jdolitsky in #1727
  - Add unit tests for IntotoAttestation verifier. by @vaikas in #1728
  - Remove newline from download sbom output by @ribbybibby in #1732
  - Fix packages name and binary in the packages by @cpanato in #1734
  - Fix fulcioroots test and linter error by @haydentherapper in #1741
  - Support non-ECDSA public keys in certificates by @haydentherapper in #1740
  - bug: remove old fulcio root and fix fallback target code by @asraa in #1738
- updated to 1.7.1
  - pkcs11: fix build instructions by @rgerganov in #1550
  - add definition for artifact hub to verify the ownership by @cpanato in #1563
  - Add example using AWS Key Management Service (KMS) by @davivcgarcia in #1564
  - Start of the necessary pieces to get #1418 and #1419 implemented by @vaikas in #1562
  - Support deletion of ClusterImagePolicy by @vaikas in #1580
  - 1417 policy validations by @kkavitha in #1548
  - Don't lowercase input image refs, just fail by @imjasonh in #1586
  - Fix #1583 #1582. Disallow regex now until implemented. by @vaikas in #1584
  - Fix piping 'cosign verify' using fulcio/rekor by @marcofranssen in #1590
  - Fix #1592 move authorities as siblings of images. by @vaikas in #1593
  - Add ability to inline secrets from SecretRef to configmap. by @vaikas in #1595
  - Fix copy/paste mistake in repo name. by @k4leung4 in #1600
  - Use reusuable release workflow in sigstore/sigstore by @k4leung4 in #1599
  - Add public key validation by @kkavitha in #1598
  - Validate a public key in a secret is valid. by @vaikas in #1602
  - Ensure entry is removed from CM on secret error. by @vaikas in #1605
  - Add two env variables. One for using Rekor public key from OOB and one for fetching it from Rekor server by @vaikas in #1610
  - Init entity from ociremote when signing a digest ref by @puerco in #1616
  - rename ca-key to ca-cert. Fix 1608, 1613 by @vaikas in #1617
  - improve cosigned validation error messages by @cpanato in #1618
  - Use latest knative/pkg's configmap informer by @tcnghia in #1615
  - Included OpenSSF Best Practices Badge by @naveensrinivasan in #1628
  - FUN.md broke when RecordObj changed to HashedRecordObj by @MitchellJThomas in #1633
  - update crane to v0.8.0 release by @cpanato in #1635
  - push latest tag when building a release by @cpanato in #1636
  - Add extra label and change the latest tag to unstable for non tagged releases by @cpanato in #1637
  - Document Elastic container registry support by @mgreau in #1641
  - Validate authority keys by @coyote240 in #1623
  - feat: tree command utility by @developer-guy in #1603
  - fix build date format for version command by @cpanato in #1644
  - Add support for intermediate certificates when verifiying by @haydentherapper in #1631
  - Prompt user before running cosign clean by @priyawadhwa in #1649
  - Use ClusterImagePolicy with Keyless + e2e tests for CIP with kind by @vaikas in #1650
  - KEYLESS.md: Shorten example OAuth URL by @tstromberg in #1661
  - Use syscall.Stdin for input handle. Fixes #1153 by @mdp in #1657
  - Add support for certificate chain to verify certificate by @haydentherapper in #1659
  - First batch of followups to #1650 by @vaikas in #1664
  - Add certificate chain flag for signing by @haydentherapper in #1656
  - [attach]: Add specific suffixes mediaTypes to sboms by @hectorj2f in #1663
  - update font when output the cosign version by @cpanato in #1668
  - feat: add ability to override registry keychain by @noamichael in #1666
  - remove replace directive by @cpanato in #1669
  - Refactor based on discussions in #1650 by @vaikas in #1674
  - Find all valid entries in verify-blob by @priyawadhwa in #1673
  - Fix relative paths in Gitub OIDC blob test by @priyawadhwa in #1677
  - Add support for cert and cert chain flags with PKCS11 tokens by @haydentherapper in #1671
  - Use cosign @ HEAD for Github OIDC sign blob test by @priyawadhwa in #1678
  - Make cosign copy copy metadata attached to child images. by @mattmoor in #1682
  - change file_name_template to PackageName by @strongjz in #1683
  - Update error message for verify/verify attestation by @haydentherapper in #1686
  - cosign clean: Don't log failure if the registry responds with 404 by @imjasonh in #1687
  - verify: add leaf hash verification for tlog entries by @asraa in #1688
  - Fix handling of policy in verify-attestation by @lcarva in #1672
  - Add e2e test for attest / verify-attestation by @vaikas in #1685
  - verify: remove extra calls to rekor for verify and verify-blob by @asraa in #1694
  - Remove the hardcoded sigstore audience by @mattmoor in #1698
  - Use ValidatePubKey from sigstore/sigstore by @haydentherapper in #1676
  - Use the github actions from sigstore/scaffolding. by @vaikas in #1699
  - sign: set the oidc redirect uri by @hectorj2f in #1675
  - add back the go mod proxy by @cpanato in #1701
  - enable 1.23 tests (Test cosigned with ClusterImagePolicy) by @cpanato in #1702
  - Fix incorrect unmarshalling of SCT response by @haydentherapper in #1704
  - Make CLI flag for OIDC client secret take a path by @znewman01 in #1705
  - cosigned: read the public key from the kms authority by @hectorj2f in #1706
  - fix latest tag when running a release job by @cpanato in #1707
  - [Cosigned] Parse and store publicKey data earlier by @DennyHoang in #1681
  - Dont overwrite token set in keyOpts by @puerco in #1709
  - refactor release job by @cpanato in #1710</changelog>
  <changelog author="meissner@suse.com" date="1653134400">- updated to 1.8.0
  - Move the KMS integration imports into the binary entrypoints by @mattmoor in #1744
  - [Cosigned] Convert functions for webhookCIP from v1alpha1 by @DennyHoang in #1736
  - Refactor policy related code, add support for vuln verify by @vaikas in #1747
  - Use bundle log ID to find verification key by @haydentherapper in #1748
  - [cosigned] The webhook name is now configurable via --webhook-name flag by @vpnachev in #1726
  - Add intermediate CA certificate pool for Fulcio by @haydentherapper in #1749
  - test: create fake TUF test root and create test SETs for verification by @asraa in #1750
  - Implement identities, fix bug in webhook validation. by @vaikas in #1759
  - Validate issuer/subject regexp in validate webhook. by @vaikas in #1761
  - chore: add warning when attaching sBOMs by @hectorj2f in #1756
  - Verify embedded SCTs by @haydentherapper in #1731
  - chore: add warning when downloading a sBOM by @hectorj2f in #1763
  - [policy-webhook] The webhooks name is now configurable via --(validating|mutating)-webhook-name flags by @vpnachev in #1757
  - Break the CIP action tests into a sh script. by @vaikas in #1767
  - tuf: add debug info if tuf update fails by @asraa in #1766
  - cosigned: add support for rsa keys by @hectorj2f in #1768
  - Cosigned validate against remote sig src by @DennyHoang in #1754
  - Add Fulcio intermediate CA certificate to intermediate pool by @haydentherapper in #1774
  - fix: more informative error by @ybelMekk in #1778
  - Run update-codegen. by @wlynch in #1789
  - Remove the dependency on v1alpha1.Identity which brings in unnecessary k8s deps. by @vaikas in #1790
  - Refactor fulcio signer to take in KeyOpts. by @wlynch in #1788
  - test: add cue unit tests by @hectorj2f in #1791
  - Attestations + policy in cip. by @vaikas in #1772
  - chore: add rego function to consume modules and evaluate them by @hectorj2f in #1787
  - Add parallelization for processing policies / authorities. by @vaikas in #1795
  - Allow passing keys via environment variables (env:// refs) by @znewman01 in #1794
  - Handle context cancelled properly + tests. by @vaikas in #1796
  - Fix a bug where an error would send duplicate results. by @vaikas in #1797
  - Revert "Refactor fulcio signer to take in KeyOpts. (#1788)" by @wlynch in #1798
  - cosigned: Unify cue data and policy before evaluating it by @hectorj2f in #1793
  - Don't fail open in VerifyBundle by @mtrmac in #1648
  - Load in intermediate cert pool from TUF by @haydentherapper in #1804
  - Support PKCS1 encoded and non-ECDSA CT log public keys by @haydentherapper in #1806</changelog>
  <changelog author="meissner@suse.com" date="1655553600">- updated to 1.9.0
  - Check failure message of policy that fails with issuer mismatch by @vaikas in #1815
  - [Cosigned] Add signature pull secrets by @DennyHoang in #1805
  - feat: add rego policy support by @hectorj2f in #1817
  - Refactor fulcio signer to take in KeyOpts (take 2) by @wlynch in #1818
  - cosigned: Test unsupported KMS providers by @imjasonh in #1820
  - chore(deps): Included dependency review by @naveensrinivasan in #1792
  - Add auth flow option to KeyOpts. by @wlynch in #1827
  - Document Staging instance usage with Keyless by @k4leung4 in #1824
  - New flag --oidc-providers-disable to disable OIDC providers by @puerco in #1832
  - Validate tlog entry when verifying signature via public key. by @wlynch in #1833
  - Add function to explicitly request a certain provider by @priyawadhwa in #1837
  - cosigned: Fix podAntiAffinity labels by @elfotografo007 in #1841
  - remove exclude from go.mod by @cpanato in #1846
  - [Cosigned] Glob matching improvement by @DennyHoang in #1842
  - sget: Enable KMS providers for sget by @imjasonh in #1852
  - Fix piv-tool generate-key command in TOKENS doc by @nealmcb in #1850
  - Add IBM Cloud Container Registry to tested registry list by @bainsy88 in #1856
  - If SBOM ref has .json suffix, assume JSON mediatype by @jdolitsky in #1859
  - Add rekor.0.pub TUF target to unit tests by @priyawadhwa in #1860
  - Normalize certificate flag names by @haydentherapper in #1868
  - Check certificate policy flags with only a certificate by @haydentherapper in #1869
  - Update go to 1.17.10 / cosign image to 1.18.0 and actions setup go by @cpanato in #1861
  - Point git commmit FUN.md to gitsign! by @wlynch in #1874
  - [cosigned] remove regex from the image pattern fields by @hectorj2f in #1873
  - go.mod: format go.mod by @zchee in #1879
  - Remove dependency on deprecated github.com/pkg/errors by @zchee in #1887
  - tree: only report artifacts that are present by @ribbybibby in #1872
  - update README with ebpf modules by @EItanya in #1888
  - Update github.com/google/go-containerregistry/pkg/authn/k8schain module to f1b065c6cb3d by @vpnachev in #1889
  - v1beta1 API for cosigned by @vaikas in #1890
  - tree: support --attachment-tag-prefix by @ribbybibby in #1900
  - [cosigned] Remove undefined apiGroups from policy clusterrole by @vpnachev in #1896
  - GHSA-66x3-6cw3-v5gj: Update go-tuf to v0.3.0 by @janisz in #1894
  - The timeout arg in golangci-lint has been moved to the generic args p… by @dlorenc in #1901
  - [cosigned] Rename cosigned references to policy-controller by @hectorj2f in #1893
  - Move deprecated dependency: google/trillian/merkle to transparency-dev by @cpanato in #1910
  - Add support for "**" in image glob matching by @imjasonh in #1914
  - Add privacy statement for PII storage by @haydentherapper in #1909
  - Do not push to public rekor. by @vaikas in #1931
  - fix: fix fetching updated targets from TUF root by @asraa in #1921
  - fix: fix #1930 for AWS KMS formats by @vaikas in #1946
  - update cross-builder image to use go1.17.11 by @cpanato in #1950
  - remove deprecation from goreleaser, go-fish is not supported anymore by @cpanato in #1952
  - add changelog for v1.9.0 by @cpanato in #1955
  - add parallelism for goreleaser by @cpanato in #1957</changelog>
  <changelog author="meissner@suse.com" date="1658923200">- updated to 1.10.0
  - replace gcr.io/distroless/ to use ghcr.io/distroless/ by @cpanato in #1961
  - Separate RegExp matching of issuer/subject from strict by @vaikas in #1956
  - tuf: improve TUF client concurrency and caching by @asraa in #1953
  - Add Cloudsmith Container Registry to tested registry list by @ciaracarey in #1966
  - feat(fulcioroots): singleton error pattern by @developer-guy in #1965
  - Drop tuf client dependency on GCS client library by @imjasonh in #1967
  - Add spdxjson predicate type for attestations by @jdolitsky in #1974
  - Remove policy-controller now that it lives in sigstore/policy-controller by @vaikas in #1976
  - cleanup: unexport kubernetes.Client method by @imjasonh in #1973
  - cleanup ci job and remove policy-controller references by @cpanato in #1981
  - fix/update post build job by @cpanato in #1983
  - docs: updated Azure kms commands. by @JBrejnholt in #1972
  - Add cyclonedx predicate type for attestations by @jdolitsky in #1977
  - Route deprecated -version to version subcommand by @puerco in #1854
  - docs(readme): add installation steps for container image for cosign binary by @developer-guy in #1986
  - Add --platform flag to cosign sbom download by @puerco in #1975
  - Use pkg/fulcioroots and pkg/tuf from sigstore/sigstore by @imjasonh in #1866
  - Add --oidc-provider flag to specify which provider to use for ambient credentials by @priyawadhwa in #1998
  - encrypt values to create the github action secret by @cpanato in #1990
  - sign-blob: bundle should work independently and respect --output-certificate and --output-signature by @Dentrax in #2016
  - Attempt to clean up pkg/cosign by @imjasonh in #2018
  - public-key: fix command description by @Dentrax in #2024
  - [NFC] specs: fix list formatting on SIGNATURE_SPEC by @woodruffw in #2030
  - feat: cert-extensions verify by @developer-guy in #1626
  - Fix #1378 create new attestation signature in replace mode if not existent by @Syquel in #2014
  - Use cosign.ConfirmPrompt more consistently by @imjasonh in #2039
  - chore: add a note about SIGSTORE_REKOR_PUBLIC_KEY var by @hectorj2f in #2040
  - Fix OIDC test by @cpanato in #2050
  - Add env subcommand. by @wlynch in #2051
  - remove tests with 1.21 k8s cluster because it is deprecated and add v1.23/24 by @cpanato in #2055
  - update ct/otel and etcd by @cpanato in #2054
  - chore(deps): CycloneDX PredicateType changed to use in-toto-golang by @masahiro331 in #2067
  - Remove replace directives in go.mod. by @wlynch in #2070
  - update design doc link by @bobcallaway in #2077
  - Remove hack/tools.go by @imjasonh in #2080
  - fix missing quote by @cpanato in #2090
- removed cosigned and webhook</changelog>
  <changelog author="meissner@suse.com" date="1659700800">- updated to 1.10.1 (jsc#SLE-23879)
  - CVE-2022-35929: Fixed that cosign verify-attestaton --type can
    report a false positive if any attestation exists (GHSA-vjxv-45g9-9296
    (bsc#1202157)
- What else changed:
  - add flag to allow skipping upload to transparency log by @k4leung4 in #2089
  - Improve error message when no sigs/atts are found for an image by @imjasonh in #2101
  - Change Result in Vulnerability Attestation to interface{} by @knqyf263 in #2096
  - Fix field names in the vulnerability attestation by @otms61 in #2099
  - remove style jobs and cleanup makefile gofmt and goimports are running already with golangci-lint by @cpanato in #2105
  - sparkles Enable Scorecard badge by @azeemshaikh38 in #2109
  - Resolves #522 set Created date to time of execution by @Lerentis in #2108
  - Introduce a custom error type to classify errors. by @mattmoor in #2114
  - feat: attach: attestation: allow passing multiple payloads by @Dentrax in #2085
  - update cross-builder to go1.18.5 and cosign image to 1.10.0 by @cpanato in #2119
  - chore: fix documentation and warning on using untrusted rekor key by @asraa in #2124
  - Correct the type used for attest by @mattmoor in #2128</changelog>
  <changelog author="meissner@suse.com" date="1663243200">- updated to 1.12.0 (jsc#SLE-23879)
  - CVE-2022-36056: Fixed verify-blob could successfully verify an artifact when verification should have failed (bsc#1203430)
  - Support non-ECDSA key types for verify-blob by @haydentherapper in #2203
  - feat: integrate Alibaba Cloud Container Registry cred helper by @mozillazg in #2008
  - remove double quotes, looks like it is passing as a single string to cosign and not as an array by @cpanato in #2205
  - Clarify error when KMS provider fails to load by @znewman01 in #2220
  - feat: set annotations to generate additional bash completion information by @dirien in #2221
  - Add deprecation warning for sget CLI and packages by @imjasonh in #2019
  - upgrade setup-ko to point to new repo by @imjasonh in #2225
  - Temp fix for e2e test by @haydentherapper in #2247
  - update kind to use release v0.15.0 and some version comments by @cpanato in #2246
  - Fix e2e test failure, add test for local bundle without rekor bundle by @haydentherapper in #2248
  - fix: fix secret test, non-experimental bundle should pass by @asraa in #2249
- updated to 1.11.1
  - add stale workflow using the workflow template by @cpanato in #2175
  - Update Scorecard action to v2:alpha by @azeemshaikh38 in #2177
  - add release cadence section in the readme by @cpanato in #2179
  - feat: Rework fig autocomplete command by @dirien in #2187
  - fix: fix typo that caused attestation verification failure by @asraa in #2199
- updated to 1.11.0
  - Verify the certificate chain against the Fulcio root trust by default by @wata727 in #2139
  - Add notes to clarify registry use. by @bendory in #2145
  - Use TUF from scaffolding for validating cosign. by @vaikas in #2146
  - docs: clarify wording in spec about usage of certificate chain by @asraa in #2152
  - fix: fix blob verification output with sharded rekor tlogs by @asraa in #2157
  - fix: adds envelope hash to in-toto entries in tlog entry creation by @nkreiger in #2118
  - fix handling of verify-attestation types for URIs by @otms61 in #2159
  - fix oidc post-merge job by @cpanato in #2164
  - Remove third_party by @imjasonh in #2166
  - use updated device flow logic with PKCE by @bobcallaway in #2163
  - fix: rekor get tlog entry with uuid by @asraa in #2058
  - update e2e job to run only when push to main by @cpanato in #2169
  - fix: add env cmd to root by @developer-guy in #2171
  - fix panic when os.Stat returns an error besides ErrNotExists by @dsa0x in #2162</changelog>
  <changelog author="dmueller@suse.com" date="1664280000">- update to 1.12.1:
  * fix: Pulls Fulcio root and intermediate when --certificate-chain is not
    passed into verify-blob command. The v1.12.0 release introduced a
    regression: when COSIGN_EXPERIMENTAL was not set, cosign verify-blob would
    check a --certificate (without a --certificate-chain provided) against the
    operating system root CA bundle. In this release, Cosign checks the
    certificate against Fulcio's CA root instead (restoring the earlier
    behavior).
  * fix: fix cert chain validation for verify-blob in non-experimental mode
  * fix: add COSIGN_EXPERIMENTAL=1 for verify-bloba
  * Fix BYO-root with intermediate to fetch intermediates from annotation
  * fix: fixing breaking changes in rekor v1.12.0 upgrade
- use go-modules service to generate the vendor.tar and use zstd</changelog>
  <changelog author="meissner@suse.com" date="1666094400">- update to 1.13.1:
  * verify-blob-attestation: allow multiple subjects in in_toto attestation (#2341)
  * Nits for #2337 (#2342)
  * Add verify-blob-attestation command and tests (#2337)
  * Update warning when users sign images by tag. (#2313)
  * Remove experimental flags from attest-blob and refactor (#2338)
  * Add --output-attestation flag to attest-blob and remove experimental signing (#2332)
  * Add attest-blob command (#2286)
  * Add '--cert-identity' flag to support subject alternate names for ver… (#2278)
  * Update Dockerfile section of README (#2323)
  * Fix option description: "sign" --&gt; "verify" (#2306)
- update to 1.13.0:
  * feat: use stdin as an input for predicate by @developer-guy in https://github.com/sigstore/cosign/pull/2269
  * feat: improve the verification message by @developer-guy in https://github.com/sigstore/cosign/pull/2268
  * use scaffolding 0.4.8 for tests. by @vaikas in https://github.com/sigstore/cosign/pull/2280
  * fix pivtool generate key touch policy by @cpanato in https://github.com/sigstore/cosign/pull/2282
  * Check error on chain verification failure by @haydentherapper in https://github.com/sigstore/cosign/pull/2284
  * Fix: Remove an extra registry request from verification path. by @mattmoor in https://github.com/sigstore/cosign/pull/2285
  * Fix: Create a static copy of signatures as part of verification. by @mattmoor in https://github.com/sigstore/cosign/pull/2287
  * Data race in FetchSignaturesForReference by @RTann in https://github.com/sigstore/cosign/pull/2283
  * Add support for Fulcio username identity in SAN by @haydentherapper in https://github.com/sigstore/cosign/pull/2291
  * fix: make tlog entry lookups for online verification shard-aware by @asraa in https://github.com/sigstore/cosign/pull/2297
  * Better help text to sign and verify SBOM by @ChristianCiach in https://github.com/sigstore/cosign/pull/2308
  * Adding warning to pin to digest by @ChaosInTheCRD in https://github.com/sigstore/cosign/pull/2311
  * Add annotations for upload blob. by @cldmnky in https://github.com/sigstore/cosign/pull/2188
  * replace deprecate package by @cpanato in https://github.com/sigstore/cosign/pull/2314
  * update release images to use go1.19.2 and cosign v1.12.1 by @cpanato in https://github.com/sigstore/cosign/pull/2315</changelog>
  <changelog author="meissner@suse.com" date="1677499200">- update to 2.0.0 (jsc#SLE-23879)
  Breaking Changes:
  * insecure-skip-tlog-verify: rename and adapt the cert expiration check (#2620)
  * Deprecate --certificate-email flag. Make --certificate-identity and -… (#2411)
  Enhancements:
  * Change go module name to github.com/sigstore/cosign/v2 for Cosign 2.0 (#2544)
  * Allow users to pass in a path for the --identity-token flag (#2538)
  * Breaking change: Respect tlog-upload=false, default to true (#2505)
  * Support outputing a certificate without uploading to the tlog (#2506)
  * Attestation/Blob signing and verification using a RFC3161 time-stamping server (#2464)
  * respect tlog-upload flag with TSA (#2474)
  * Better feedback if specifying incompatible argument on cosign sign --attachment (#2449)
  * Support TSA and Rekor verifications (#2463)
  * add support for tsa signing and verification of images (#2460)
  * cosign policy sign: remove experimental flag and make keyless signing default (#2459)
  * Remove experimental mode from cosign attest and verify-attestation (#2458)
  * Remove experimental mode from sign-blob and verify-blob (#2457)
  * Add --offline flag to force offline verification (#2427)
  * Air gap support (#2299)
  * Breaking change: Change SCT verification behavior to default to enforcement (#2400)
  * Breaking change: remove --force flag from sign and attest and rely on --yes flag to skip confirmation (#2399)
  * Breaking change: replace --no-tlog-upload flag with --tlog-upload flag (#2397)
  * Remove experimental flag from cosign sign and cosign verify (#2387)
  * verify: remove SIGSTORE_TRUST_REKOR_API_PUBLIC_KEY test env var for using a key from rekor's API (#2362)
  * Add warning to use digest instead of tags to other cosign commands (#2650)
  * Fix up UI messages (#2629)
  * Remove hardcoded Fulcio from output (#2621)
  * Fix missing privacy statement, print in multiple locations (#2622)
  * feat: allows custom key names for import-key-pair (#2587)
  * feat: support keyless verification for verify-blob-attestation (#2525)
  * attest-blob: add functionality for keyless signing (#2515)
  * Rego: add support for custom error/warning messages when evaluating rego rules (#2577)
  * feat: add debug information to cert validation error (#2579)
  * Support non-Sigstore TSA requests (#2708)
  * Add COSIGN_OCI_EXPERIMENTAL, push .sig/.sbom using OCI 1.1+ digest tag (#2684)
  * Output certificate in bundle when entry is not uploaded to Rekor (#2715)
  * attach signature and attach sbom must use STDIN to upload raw string (#2637)
  * add generate-key-pair GitHub Enterprise server support (#2676)
  * add in format string for warning (#2699)
  * Support for fetching Fulcio certs with self-managed key (#2532)
  * 2476 predicate type download (#2484)
  Bug Fixes:
  * Fix the file existence check. (#2552)
  * Fix timestamp verification, add verify-blob tests (#2527)
  * Fix(verify): Consolidate certificate expiry logic (#2504)
  * Updates to Timestamp signing and verification (#2499)
  * Fix: removes attestation payload from attest-blob's output &amp; no base64 encoding (#2498)
  * Fix path for e2e-tests badge (#2490)
  * Fix spdx json media type (#2479)
  * Fix sct verificaction (#2426)
  * Fix: panic with unsigned local image (#2656)
  * Make sure a cert passed in via --cert matches the bundle cert (#2652)
  * Fix: fix github oidc post submit test (#2594)
  * Fix: add enhanced error messages for failing verification with TUF targets (#2589)
  * Fix: Add missing schemes to cosign predicate types. (#2717)
  * Fix: Drop the CosignPredicate wrapper around SBOM attestations. (#2718)
  * Fix prompts with Windows line endings (#2674)</changelog>
  <changelog author="dmueller@suse.com" date="1680609600">- fix buildtags
- build against a maintained golang version (upstream uses go1.20)</changelog>
  <changelog author="meissner@suse.com" date="1681732800">- update to 2.0.1 (jsc#SLE-23879)
  Enhancements
  - Add environment variable token provider (#2864)
  - Remove cosign policy command (#2846)
  - Allow customising 'go' executable with GOEXE var (#2841)
  - Consistent tlog warnings during verification (#2840)
  - Add riscv64 arch (#2821)
  - Default generated PEM labels to SIGSTORE (#2735)
  - Update privacy statement and confirmation (#2797)
  - Add exit codes for verify errors (#2766)
  - Add Buildkite provider (#2779)
  - verify-blob-attestation: Loosen arg requirements if --check-claims=false (#2746)
  Bug Fixes
  - PKCS11 sessions are now opened read only (#2853)
  - Makefile: date format of log should not show signatures (#2835)
  - Add missing flags to cosign verify dockerfile/manifest (#2830)
  - Add a warning to remember how to configure a custom Gitlab host (#2816)
  - Remove tag warning message from save/copy commands (#2799)
  - Mark keyless pem files with b64 (#2671)</changelog>
  <changelog author="meissner@suse.com" date="1683460800">- update to 2.0.2 (jsc#SLE-23879)
  Enhancements
  - Update sigstore/sigstore to v1.6.2 to pick up TUF CDN change (#2891)
  - feat: Make cosign copy faster (#2901)
  - remove sget (#2885)
  - Require a payload to be provided with a signature (#2785)
  Bug Fixes
  - cmd: Change error message from KeyParseError to PubKeyParseError for verify-blob. (#2876)
  - Use SOURCE_DATE_EPOCH for OCI CreatedAt times (#2878)
  Documentation
  - Remove experimental warning from Fulcio flags (#2923)
  - add missing oidc provider (#2922)
  - Add zot as a supported registry (#2920)
  - deprecates kms_support docs (#2900)
  - chore(docs) deprecate note for usage docs (#2906)
  - adds note of deprecation for examples.md docs (#2899)</changelog>
  <changelog author="meissner@suse.com" date="1687867200">- updated to 2.1.1 (jsc#SLE-23879)
  - Bug Fixes
  - wait for the workers become available again to continue the execution (#3084)
  - fix help text when in a container (#3082)
- updated to 2.1.0 (jsc#SLE-23879)
  - Breaking Change: The predicate is now a required flag in the attest commands, set via the --type flag.
  - Enhancements
  - Verify sigs and attestations in parallel (#3066)
  - Deep inspect attestations when filtering download (#3031)
  - refactor bundle validation code, add support for DSSE rekor type (#3016)
  - Allow overriding remote options (#3049)
  - feat: adds no cert found on sig exit code (#3038)
  - Make predicate a required flag in attest commands (#3033)
  - Added support for attaching Time stamp authority Response in attach command (#3001)
  - Add sign --sign-container-identity CLI (#2984)
  - Feature: Allow cosign to sign digests before they are uploaded. (#2959)
  - accepts attachment-tag-prefix for cosign copy (#3014)
  - Feature: adds '--allow-insecure-registry' for cosign load (#3000)
  - download attestation: support --platform flag (#2980)
  - Cleanup: Add Digest to the SignedEntity interface. (#2960)
  - verify command: support keyless verification using only a provided certificate chain with non-fulcio roots (#2845)
  - verify: use workers to limit the paralellism when verifying images with --max-workers flag (#3069)
  - Bug Fixes
  - Fix pkg/cosign/errors (#3050)
  - Fix: update doc to refer to github-actions oidc provider (#3040)
  - Fix: prefer GitHub OIDC provider if enabled (#3044)
  - Fix --sig-only in cosign copy (#3074)
  - Documentation
  - Fix links to sigstore/docs in markdown files (#3064)</changelog>
  <changelog author="meissner@suse.com" date="1693569600">- updated to 2.2.0 (jsc#SLE-23879)
  - Enhancements
  * switch to uploading DSSE types to rekor instead of intoto (#3113)
  * add 'cosign sign' command-line parameters for mTLS (#3052)
  * improve error messages around bundle != payload hash (#3146)
  * make VerifyImageAttestation function public (#3156)
  * Switch to cryptoutils function for SANS (#3185)
  * Handle HTTP_1_1_REQUIRED errors in github provider (#3172)
  - Bug Fixes
  * Fix nondeterminsitic timestamps (#3121)
  - Documentation
  * doc: Add example of sign-blob with key in env var (#3152)
  * add deprecation notice for cosign-releases GCS bucket (#3148)
  * update doc links (#3186)</changelog>
  <changelog author="meissner@suse.com" date="1699358400">- updated to 2.2.1 (jsc#SLE-23879)
  This release comes with a fix for
  CVE-2023-46737 / bsc#1216933 described in this [Github Security
  Advisory](https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9).
  Enhancements:
  * feat: Support basic auth and bearer auth login to registry (#3310)
  * add support for ignoring certificates with pkcs11 (#3334)
  * Support ReplaceOp in Signatures (#3315)
  * feat: added ability to get image digest back via triangulate (#3255)
  * feat: add `--only` flag in `cosign copy` to copy sign, att &amp; sbom (#3247)
  * feat: add support attaching a Rekor bundle to a container (#3246)
  * feat: add support outputting rekor response on signing (#3248)
  * feat: improve dockerfile verify subcommand (#3264)
  * Add guard flag for experimental OCI 1.1 verify. (#3272)
  * Deprecate SBOM attachments (#3256)
  * feat: dedent line in cosign copy doc (#3244)
  * feat: add platform flag to cosign copy command (#3234)
  * Add SLSA 1.0 attestation support to cosign. Closes #2860 (#3219)
  * attest: pass OCI remote opts to att resolver. (#3225)
  Bug Fixes:
  * Merge pull request from GHSA-vfp6-jrw2-99g9
  * fix: allow cosign download sbom when image is absent (#3245)
  * ci: add a OCI registry test for referrers support (#3253)
  * Fix ReplaceSignatures (#3292)
  * Stop using deprecated in_toto.ProvenanceStatement (#3243)
  * Fixes #3236, disable SCT checking for a cosign verification when usin… (#3237)
  * fix: update error in `SignedEntity` to be more descriptive (#3233)
  * Fail timestamp verification if no root is provided (#3224)
  Documentation:
  * Add some docs about verifying in an air-gapped environment (#3321)
  * Update CONTRIBUTING.md (#3268)
  * docs: improves the Contribution guidelines (#3257)
  * Remove security policy (#3230)
  Others:
  * Set go to min 1.21 and update dependencies  (#3327)
  * Update contact for code of conduct (#3266)
  * Update .ko.yaml (#3240)</changelog>
  <changelog author="marcos.bjoerkelund@suse.com" date="1702382400">- updated to 2.2.2 (jsc#SLE-23879)
  v2.2.2 adds a new container with a shell,
  gcr.io/projectsigstore/cosign:vx.y.z-dev, in addition to the existing
  container gcr.io/projectsigstore/cosign:vx.y.z without a shell.
  For private deployments, we have also added an alias for
  - -insecure-skip-log, --private-infrastructure.
  Bug Fixes:
  * chore(deps): bump github.com/sigstore/sigstore from 1.7.5 to 1.7.6 (#3411) which fixes a bug with using Azure KMS
  * Don't require CT log keys if using a key/sk (#3415)
  * Fix copy without any flag set (#3409)
  * Update cosign generate cmd to not include newline (#3393)
  * Fix idempotency error with signing (#3371)
  Features:
  * Add --yes flag cosign import-key-pair to skip the overwrite confirmation. (#3383)
  * Use the timeout flag value in verify* commands. (#3391)
  * add --private-infrastructure flag (#3369)
  Container Updates:
  * Bump builder image to use go1.21.4 and add new cosign image tags with shell (#3373)
  Documentation:
  * Update SBOM_SPEC.md (#3358)</changelog>
  <changelog author="meissner@suse.com" date="1706875200">- updated to 2.2.3 (jsc#SLE-23879)
  Bug Fixes:
  * Fix race condition on verification with multiple signatures attached to image (#3486)
  * fix(clean): Fix clean cmd for private registries (#3446)
  * Fixed BYO PKI verification (#3427)
  Features:
  * Allow for option in cosign attest and attest-blob to upload attestation as supported in Rekor (#3466)
  * Add support for OpenVEX predicate type (#3405)
  Documentation:
  * Resolves #3088: `version` sub-command expected behaviour documentation and testing (#3447)
  * add examples for cosign attach signature cmd (#3468)
  Misc:
  * Remove CertSubject function (#3467)
  * Use local rekor and fulcio instances in e2e tests (#3478)
- bumped embedded golang.org/x/crypto/ssh to fix the Terrapin attack CVE-2023-48795 (bsc#1218207)</changelog>
  <changelog author="meissner@suse.com" date="1713182400">- updated to 2.2.4 (jsc#SLE-23879)
  * Bug Fixes
  * Fixes for GHSA-88jx-383q-w4qc and GHSA-95pr-fxf5-86gv (#3661)
  - CVE-2024-29902: Malicious attachments can cause system-wide denial of service (bsc#1222835)
  - CVE-2024-29903: Malicious artifects can cause machine-wide denial of service (bsc#1222837)
  * ErrNoSignaturesFound should be used when there is no signature attached to an image. (#3526)
  * fix semgrep issues for dgryski.semgrep-go ruleset (#3541)
  * Honor creation timestamp for signatures again (#3549)
  * Features
  * Adds Support for Fulcio Client Credentials Flow, and Argument to Set Flow Explicitly (#3578)
  * Documentation
  * add oci bundle spec (#3622)
  * Correct help text of triangulate cmd (#3551)
  * Correct help text of verify-attestation policy argument (#3527)
  * feat: add OVHcloud MPR registry tested with cosign (#3639)</changelog>
</package>
<package pkgid="5591f0bbe03138b048990892860dc910829d71019afba24a504d61b0ac58653b" name="cosign" arch="s390x">
  <version epoch="0" ver="2.2.4" rel="150400.3.20.1"/>
  <changelog author="meissner@suse.com" date="1645444800">- updated to 1.5.2:
  - This release contains fixes for CVE-2022-23649, affecting signature
    validations with Rekor. Only validation is affected, it is not necessary
    to re-sign any artifacts. (bsc#1196239)
- updated to 1.5.1:
  - Bump sigstore/sigstore to pick up oidc login for vault. (#1377)
  - Bump google.golang.org/api from 0.65.0 to 0.66.0 (#1371)
  - expose dafaults fulcio, rekor, oidc issuer urls (#1368)
  - add check to make sure the go modules are in sync (#1369)
  - README: fix link to race conditions (#1367)
  - Bump cloud.google.com/go/storage from 1.18.2 to 1.19.0 (#1365)
  - docs: verify-attestation cue and rego policy doc (#1362)
  - Update verify-blob to support DSSEs (#1355)
  - organize, update select deps (#1358)
  - Bump go-containerregistry to pick up ACR keychain fix (#1357)
  - Bump github.com/go-openapi/runtime from 0.21.0 to 0.21.1 (#1352)
  - sync go modules (#1353)</changelog>
  <changelog author="meissner@suse.com" date="1648814400">- updated to 1.6.0
  - Fix double time import in e2e tests by @saschagrunert in #1388
  - Add --timeout support to sign command by @saschagrunert in #1379
  - Fix comparison in replace option for attestation by @bburky in #1366
  - Add Cosign logo to README by @nsmith5 in #1395
  - Minor refactor to verify SCT and Rekor entry with multiple keys by @haydentherapper in #1396
  - Fix a link of SECURITY.md by @knqyf263 in #1399
  - update cosign and cross-build image for the release job by @cpanato in #1400
  - feat: login command by @developer-guy in #1398
  - TUF: Add root status output by @asraa in #1404
  - Add a newline after password input by @knqyf263 in #1407
  - make imageRef lowercase before parsing by @bobcallaway in #1409
  - Improve error message when image is not found in registry by @imjasonh in #1410
  - Add ability to override the Spiffe socket via environmental variable: by @vaikas in #1421
  - Fix incorrect error check when verifying SCT by @haydentherapper in #1422
  - Skip the ReadWrite test that flakes on Windows. by @dlorenc in #1415
  - Allow PassFunc to be nil by @saschagrunert in #1426
  - Update the cosign keyless documentation to point to the GA release. by @dlorenc in #1427
  - Remove TUF timestamp from OCI signature bundle by @haydentherapper in #1428
  - Add docs on API stability and deprecation table by @priyawadhwa in #1429
  - update cross-build image which adds goimports by @cpanato in #1435
  - feat: enhance clean cmd capability by @developer-guy in #1430
  - use the upstream kubernetes version lib and ldflags by @n3wscott in #1413
  - Improve log lines to match with implementation by @marcofranssen in #1432
  - feat: fig autocomplete feature by @developer-guy in #1360
  - update cross-build to use go 1.17.7 by @cpanato in #1446
  - Fetch verification targets by TUF custom metadata by @haydentherapper in #1423
  - feat: add -buildid= to ldflags by @developer-guy in #1451
  - Streamline SignBlobCmd API with SignCmd by @saschagrunert in #1454
  - convert release cosigned to also generate yaml artifact. by @k4leung4 in #1453
  - Fix tkn link in readme by @Yongxuanzhang in #1459
  - Print message when verifying with old TUF targets by @haydentherapper in #1468
  - fix(sign): refactor unsupported provider log by @Dentrax in #1464
  - tests: /bin/bash -&gt; /usr/bin/env bash by @znewman01 in #1470
  - Double goreleaser timeout by @znewman01 in #1472
  - increase timeout for goreleaser snapshot by @cpanato in #1473
  - fix(sign): kms unspported message by @Dentrax in #1475
  - refactor release cloudbuild job by @cpanato in #1476
  - Fix wording on attach attestation help by @luhring in #1480
  - update go-tuf and simplify TUF client code by @asraa in #1455
  - add initial changelog for 1.5.2 by @cpanato in #1483
  - Fix linter error on main by @priyawadhwa in #1484
  - Update Changelog for Security Advisory by @cpanato in #1485
  - chore(makefile): use kocache, convert publish to build by @developer-guy in #1488
  - Pick up a change to quiet ECR-login logging. by @mattmoor in #1491
  - feat: support other types in copy cmd by @developer-guy in #1493
  - Pick up some of the shared workflows by @mattmoor in #1490
  - feat: nominate Dentrax as codeowner by @developer-guy in #1492
  - add correct layer media type to cosign attach attestation by @spiffcs in #1503
  - This sets up the scaffolding for the cosigned CRD types. by @mattmoor in #1504
  - use v6 api calls in GH action for updating release milestones by @bobcallaway in #1511
  - Add skeleton reconciler for cosigned API CRD. by @mattmoor in #1513
  - bug fix: import ed25519 keys and fix error handling by @asraa in #1518
  - optimize codeql speed by using caching and tracing by @bobcallaway in #1519
  - Add a dummy.go file to allow vendoring config by @jdolitsky in #1520
  - Add CertExtensions func to extract all extensions by @ckotzbauer in #1515
  - chore(ci): add artifact hub support by @Dentrax in #1522
  - Change Fulcio URL default to be fulcio.sigstore.dev by @haydentherapper in #1529
  - Add codecov as github action, set permissions to read content only by @k4leung4 in #1530
  - images: remove --bare flags that conflict with --base-import-paths by @cpanato in #1533
  - Quay OCI Support in README by @sabre1041 in #1539
  - add rpm,deb and apks for cosign packages by @strongjz in #1537
  - Consistent parenthesis use in Makefile by @k4leung4 in #1541
  - add changelog for 1.6.0 by @cpanato in #1535
  - update golang cross image by @cpanato in #1543
  - Add fields in policy CRD by @kkavitha in #1540
  - Disable for now due some issues when downloading the knative module by @cpanato in #1546</changelog>
  <changelog author="meissner@suse.com" date="1650974400">- updated to 1.7.2
  - [Cosigned] Fix publicKey unmarshal by @DennyHoang in #1719
  - fix: add permissions to patch events by @hectorj2f in #1722
  - Make public all types required to use ValidatePolicy by @jdolitsky in #1727
  - Add unit tests for IntotoAttestation verifier. by @vaikas in #1728
  - Remove newline from download sbom output by @ribbybibby in #1732
  - Fix packages name and binary in the packages by @cpanato in #1734
  - Fix fulcioroots test and linter error by @haydentherapper in #1741
  - Support non-ECDSA public keys in certificates by @haydentherapper in #1740
  - bug: remove old fulcio root and fix fallback target code by @asraa in #1738
- updated to 1.7.1
  - pkcs11: fix build instructions by @rgerganov in #1550
  - add definition for artifact hub to verify the ownership by @cpanato in #1563
  - Add example using AWS Key Management Service (KMS) by @davivcgarcia in #1564
  - Start of the necessary pieces to get #1418 and #1419 implemented by @vaikas in #1562
  - Support deletion of ClusterImagePolicy by @vaikas in #1580
  - 1417 policy validations by @kkavitha in #1548
  - Don't lowercase input image refs, just fail by @imjasonh in #1586
  - Fix #1583 #1582. Disallow regex now until implemented. by @vaikas in #1584
  - Fix piping 'cosign verify' using fulcio/rekor by @marcofranssen in #1590
  - Fix #1592 move authorities as siblings of images. by @vaikas in #1593
  - Add ability to inline secrets from SecretRef to configmap. by @vaikas in #1595
  - Fix copy/paste mistake in repo name. by @k4leung4 in #1600
  - Use reusuable release workflow in sigstore/sigstore by @k4leung4 in #1599
  - Add public key validation by @kkavitha in #1598
  - Validate a public key in a secret is valid. by @vaikas in #1602
  - Ensure entry is removed from CM on secret error. by @vaikas in #1605
  - Add two env variables. One for using Rekor public key from OOB and one for fetching it from Rekor server by @vaikas in #1610
  - Init entity from ociremote when signing a digest ref by @puerco in #1616
  - rename ca-key to ca-cert. Fix 1608, 1613 by @vaikas in #1617
  - improve cosigned validation error messages by @cpanato in #1618
  - Use latest knative/pkg's configmap informer by @tcnghia in #1615
  - Included OpenSSF Best Practices Badge by @naveensrinivasan in #1628
  - FUN.md broke when RecordObj changed to HashedRecordObj by @MitchellJThomas in #1633
  - update crane to v0.8.0 release by @cpanato in #1635
  - push latest tag when building a release by @cpanato in #1636
  - Add extra label and change the latest tag to unstable for non tagged releases by @cpanato in #1637
  - Document Elastic container registry support by @mgreau in #1641
  - Validate authority keys by @coyote240 in #1623
  - feat: tree command utility by @developer-guy in #1603
  - fix build date format for version command by @cpanato in #1644
  - Add support for intermediate certificates when verifiying by @haydentherapper in #1631
  - Prompt user before running cosign clean by @priyawadhwa in #1649
  - Use ClusterImagePolicy with Keyless + e2e tests for CIP with kind by @vaikas in #1650
  - KEYLESS.md: Shorten example OAuth URL by @tstromberg in #1661
  - Use syscall.Stdin for input handle. Fixes #1153 by @mdp in #1657
  - Add support for certificate chain to verify certificate by @haydentherapper in #1659
  - First batch of followups to #1650 by @vaikas in #1664
  - Add certificate chain flag for signing by @haydentherapper in #1656
  - [attach]: Add specific suffixes mediaTypes to sboms by @hectorj2f in #1663
  - update font when output the cosign version by @cpanato in #1668
  - feat: add ability to override registry keychain by @noamichael in #1666
  - remove replace directive by @cpanato in #1669
  - Refactor based on discussions in #1650 by @vaikas in #1674
  - Find all valid entries in verify-blob by @priyawadhwa in #1673
  - Fix relative paths in Gitub OIDC blob test by @priyawadhwa in #1677
  - Add support for cert and cert chain flags with PKCS11 tokens by @haydentherapper in #1671
  - Use cosign @ HEAD for Github OIDC sign blob test by @priyawadhwa in #1678
  - Make cosign copy copy metadata attached to child images. by @mattmoor in #1682
  - change file_name_template to PackageName by @strongjz in #1683
  - Update error message for verify/verify attestation by @haydentherapper in #1686
  - cosign clean: Don't log failure if the registry responds with 404 by @imjasonh in #1687
  - verify: add leaf hash verification for tlog entries by @asraa in #1688
  - Fix handling of policy in verify-attestation by @lcarva in #1672
  - Add e2e test for attest / verify-attestation by @vaikas in #1685
  - verify: remove extra calls to rekor for verify and verify-blob by @asraa in #1694
  - Remove the hardcoded sigstore audience by @mattmoor in #1698
  - Use ValidatePubKey from sigstore/sigstore by @haydentherapper in #1676
  - Use the github actions from sigstore/scaffolding. by @vaikas in #1699
  - sign: set the oidc redirect uri by @hectorj2f in #1675
  - add back the go mod proxy by @cpanato in #1701
  - enable 1.23 tests (Test cosigned with ClusterImagePolicy) by @cpanato in #1702
  - Fix incorrect unmarshalling of SCT response by @haydentherapper in #1704
  - Make CLI flag for OIDC client secret take a path by @znewman01 in #1705
  - cosigned: read the public key from the kms authority by @hectorj2f in #1706
  - fix latest tag when running a release job by @cpanato in #1707
  - [Cosigned] Parse and store publicKey data earlier by @DennyHoang in #1681
  - Dont overwrite token set in keyOpts by @puerco in #1709
  - refactor release job by @cpanato in #1710</changelog>
  <changelog author="meissner@suse.com" date="1653134400">- updated to 1.8.0
  - Move the KMS integration imports into the binary entrypoints by @mattmoor in #1744
  - [Cosigned] Convert functions for webhookCIP from v1alpha1 by @DennyHoang in #1736
  - Refactor policy related code, add support for vuln verify by @vaikas in #1747
  - Use bundle log ID to find verification key by @haydentherapper in #1748
  - [cosigned] The webhook name is now configurable via --webhook-name flag by @vpnachev in #1726
  - Add intermediate CA certificate pool for Fulcio by @haydentherapper in #1749
  - test: create fake TUF test root and create test SETs for verification by @asraa in #1750
  - Implement identities, fix bug in webhook validation. by @vaikas in #1759
  - Validate issuer/subject regexp in validate webhook. by @vaikas in #1761
  - chore: add warning when attaching sBOMs by @hectorj2f in #1756
  - Verify embedded SCTs by @haydentherapper in #1731
  - chore: add warning when downloading a sBOM by @hectorj2f in #1763
  - [policy-webhook] The webhooks name is now configurable via --(validating|mutating)-webhook-name flags by @vpnachev in #1757
  - Break the CIP action tests into a sh script. by @vaikas in #1767
  - tuf: add debug info if tuf update fails by @asraa in #1766
  - cosigned: add support for rsa keys by @hectorj2f in #1768
  - Cosigned validate against remote sig src by @DennyHoang in #1754
  - Add Fulcio intermediate CA certificate to intermediate pool by @haydentherapper in #1774
  - fix: more informative error by @ybelMekk in #1778
  - Run update-codegen. by @wlynch in #1789
  - Remove the dependency on v1alpha1.Identity which brings in unnecessary k8s deps. by @vaikas in #1790
  - Refactor fulcio signer to take in KeyOpts. by @wlynch in #1788
  - test: add cue unit tests by @hectorj2f in #1791
  - Attestations + policy in cip. by @vaikas in #1772
  - chore: add rego function to consume modules and evaluate them by @hectorj2f in #1787
  - Add parallelization for processing policies / authorities. by @vaikas in #1795
  - Allow passing keys via environment variables (env:// refs) by @znewman01 in #1794
  - Handle context cancelled properly + tests. by @vaikas in #1796
  - Fix a bug where an error would send duplicate results. by @vaikas in #1797
  - Revert "Refactor fulcio signer to take in KeyOpts. (#1788)" by @wlynch in #1798
  - cosigned: Unify cue data and policy before evaluating it by @hectorj2f in #1793
  - Don't fail open in VerifyBundle by @mtrmac in #1648
  - Load in intermediate cert pool from TUF by @haydentherapper in #1804
  - Support PKCS1 encoded and non-ECDSA CT log public keys by @haydentherapper in #1806</changelog>
  <changelog author="meissner@suse.com" date="1655553600">- updated to 1.9.0
  - Check failure message of policy that fails with issuer mismatch by @vaikas in #1815
  - [Cosigned] Add signature pull secrets by @DennyHoang in #1805
  - feat: add rego policy support by @hectorj2f in #1817
  - Refactor fulcio signer to take in KeyOpts (take 2) by @wlynch in #1818
  - cosigned: Test unsupported KMS providers by @imjasonh in #1820
  - chore(deps): Included dependency review by @naveensrinivasan in #1792
  - Add auth flow option to KeyOpts. by @wlynch in #1827
  - Document Staging instance usage with Keyless by @k4leung4 in #1824
  - New flag --oidc-providers-disable to disable OIDC providers by @puerco in #1832
  - Validate tlog entry when verifying signature via public key. by @wlynch in #1833
  - Add function to explicitly request a certain provider by @priyawadhwa in #1837
  - cosigned: Fix podAntiAffinity labels by @elfotografo007 in #1841
  - remove exclude from go.mod by @cpanato in #1846
  - [Cosigned] Glob matching improvement by @DennyHoang in #1842
  - sget: Enable KMS providers for sget by @imjasonh in #1852
  - Fix piv-tool generate-key command in TOKENS doc by @nealmcb in #1850
  - Add IBM Cloud Container Registry to tested registry list by @bainsy88 in #1856
  - If SBOM ref has .json suffix, assume JSON mediatype by @jdolitsky in #1859
  - Add rekor.0.pub TUF target to unit tests by @priyawadhwa in #1860
  - Normalize certificate flag names by @haydentherapper in #1868
  - Check certificate policy flags with only a certificate by @haydentherapper in #1869
  - Update go to 1.17.10 / cosign image to 1.18.0 and actions setup go by @cpanato in #1861
  - Point git commmit FUN.md to gitsign! by @wlynch in #1874
  - [cosigned] remove regex from the image pattern fields by @hectorj2f in #1873
  - go.mod: format go.mod by @zchee in #1879
  - Remove dependency on deprecated github.com/pkg/errors by @zchee in #1887
  - tree: only report artifacts that are present by @ribbybibby in #1872
  - update README with ebpf modules by @EItanya in #1888
  - Update github.com/google/go-containerregistry/pkg/authn/k8schain module to f1b065c6cb3d by @vpnachev in #1889
  - v1beta1 API for cosigned by @vaikas in #1890
  - tree: support --attachment-tag-prefix by @ribbybibby in #1900
  - [cosigned] Remove undefined apiGroups from policy clusterrole by @vpnachev in #1896
  - GHSA-66x3-6cw3-v5gj: Update go-tuf to v0.3.0 by @janisz in #1894
  - The timeout arg in golangci-lint has been moved to the generic args p… by @dlorenc in #1901
  - [cosigned] Rename cosigned references to policy-controller by @hectorj2f in #1893
  - Move deprecated dependency: google/trillian/merkle to transparency-dev by @cpanato in #1910
  - Add support for "**" in image glob matching by @imjasonh in #1914
  - Add privacy statement for PII storage by @haydentherapper in #1909
  - Do not push to public rekor. by @vaikas in #1931
  - fix: fix fetching updated targets from TUF root by @asraa in #1921
  - fix: fix #1930 for AWS KMS formats by @vaikas in #1946
  - update cross-builder image to use go1.17.11 by @cpanato in #1950
  - remove deprecation from goreleaser, go-fish is not supported anymore by @cpanato in #1952
  - add changelog for v1.9.0 by @cpanato in #1955
  - add parallelism for goreleaser by @cpanato in #1957</changelog>
  <changelog author="meissner@suse.com" date="1658923200">- updated to 1.10.0
  - replace gcr.io/distroless/ to use ghcr.io/distroless/ by @cpanato in #1961
  - Separate RegExp matching of issuer/subject from strict by @vaikas in #1956
  - tuf: improve TUF client concurrency and caching by @asraa in #1953
  - Add Cloudsmith Container Registry to tested registry list by @ciaracarey in #1966
  - feat(fulcioroots): singleton error pattern by @developer-guy in #1965
  - Drop tuf client dependency on GCS client library by @imjasonh in #1967
  - Add spdxjson predicate type for attestations by @jdolitsky in #1974
  - Remove policy-controller now that it lives in sigstore/policy-controller by @vaikas in #1976
  - cleanup: unexport kubernetes.Client method by @imjasonh in #1973
  - cleanup ci job and remove policy-controller references by @cpanato in #1981
  - fix/update post build job by @cpanato in #1983
  - docs: updated Azure kms commands. by @JBrejnholt in #1972
  - Add cyclonedx predicate type for attestations by @jdolitsky in #1977
  - Route deprecated -version to version subcommand by @puerco in #1854
  - docs(readme): add installation steps for container image for cosign binary by @developer-guy in #1986
  - Add --platform flag to cosign sbom download by @puerco in #1975
  - Use pkg/fulcioroots and pkg/tuf from sigstore/sigstore by @imjasonh in #1866
  - Add --oidc-provider flag to specify which provider to use for ambient credentials by @priyawadhwa in #1998
  - encrypt values to create the github action secret by @cpanato in #1990
  - sign-blob: bundle should work independently and respect --output-certificate and --output-signature by @Dentrax in #2016
  - Attempt to clean up pkg/cosign by @imjasonh in #2018
  - public-key: fix command description by @Dentrax in #2024
  - [NFC] specs: fix list formatting on SIGNATURE_SPEC by @woodruffw in #2030
  - feat: cert-extensions verify by @developer-guy in #1626
  - Fix #1378 create new attestation signature in replace mode if not existent by @Syquel in #2014
  - Use cosign.ConfirmPrompt more consistently by @imjasonh in #2039
  - chore: add a note about SIGSTORE_REKOR_PUBLIC_KEY var by @hectorj2f in #2040
  - Fix OIDC test by @cpanato in #2050
  - Add env subcommand. by @wlynch in #2051
  - remove tests with 1.21 k8s cluster because it is deprecated and add v1.23/24 by @cpanato in #2055
  - update ct/otel and etcd by @cpanato in #2054
  - chore(deps): CycloneDX PredicateType changed to use in-toto-golang by @masahiro331 in #2067
  - Remove replace directives in go.mod. by @wlynch in #2070
  - update design doc link by @bobcallaway in #2077
  - Remove hack/tools.go by @imjasonh in #2080
  - fix missing quote by @cpanato in #2090
- removed cosigned and webhook</changelog>
  <changelog author="meissner@suse.com" date="1659700800">- updated to 1.10.1 (jsc#SLE-23879)
  - CVE-2022-35929: Fixed that cosign verify-attestaton --type can
    report a false positive if any attestation exists (GHSA-vjxv-45g9-9296
    (bsc#1202157)
- What else changed:
  - add flag to allow skipping upload to transparency log by @k4leung4 in #2089
  - Improve error message when no sigs/atts are found for an image by @imjasonh in #2101
  - Change Result in Vulnerability Attestation to interface{} by @knqyf263 in #2096
  - Fix field names in the vulnerability attestation by @otms61 in #2099
  - remove style jobs and cleanup makefile gofmt and goimports are running already with golangci-lint by @cpanato in #2105
  - sparkles Enable Scorecard badge by @azeemshaikh38 in #2109
  - Resolves #522 set Created date to time of execution by @Lerentis in #2108
  - Introduce a custom error type to classify errors. by @mattmoor in #2114
  - feat: attach: attestation: allow passing multiple payloads by @Dentrax in #2085
  - update cross-builder to go1.18.5 and cosign image to 1.10.0 by @cpanato in #2119
  - chore: fix documentation and warning on using untrusted rekor key by @asraa in #2124
  - Correct the type used for attest by @mattmoor in #2128</changelog>
  <changelog author="meissner@suse.com" date="1663243200">- updated to 1.12.0 (jsc#SLE-23879)
  - CVE-2022-36056: Fixed verify-blob could successfully verify an artifact when verification should have failed (bsc#1203430)
  - Support non-ECDSA key types for verify-blob by @haydentherapper in #2203
  - feat: integrate Alibaba Cloud Container Registry cred helper by @mozillazg in #2008
  - remove double quotes, looks like it is passing as a single string to cosign and not as an array by @cpanato in #2205
  - Clarify error when KMS provider fails to load by @znewman01 in #2220
  - feat: set annotations to generate additional bash completion information by @dirien in #2221
  - Add deprecation warning for sget CLI and packages by @imjasonh in #2019
  - upgrade setup-ko to point to new repo by @imjasonh in #2225
  - Temp fix for e2e test by @haydentherapper in #2247
  - update kind to use release v0.15.0 and some version comments by @cpanato in #2246
  - Fix e2e test failure, add test for local bundle without rekor bundle by @haydentherapper in #2248
  - fix: fix secret test, non-experimental bundle should pass by @asraa in #2249
- updated to 1.11.1
  - add stale workflow using the workflow template by @cpanato in #2175
  - Update Scorecard action to v2:alpha by @azeemshaikh38 in #2177
  - add release cadence section in the readme by @cpanato in #2179
  - feat: Rework fig autocomplete command by @dirien in #2187
  - fix: fix typo that caused attestation verification failure by @asraa in #2199
- updated to 1.11.0
  - Verify the certificate chain against the Fulcio root trust by default by @wata727 in #2139
  - Add notes to clarify registry use. by @bendory in #2145
  - Use TUF from scaffolding for validating cosign. by @vaikas in #2146
  - docs: clarify wording in spec about usage of certificate chain by @asraa in #2152
  - fix: fix blob verification output with sharded rekor tlogs by @asraa in #2157
  - fix: adds envelope hash to in-toto entries in tlog entry creation by @nkreiger in #2118
  - fix handling of verify-attestation types for URIs by @otms61 in #2159
  - fix oidc post-merge job by @cpanato in #2164
  - Remove third_party by @imjasonh in #2166
  - use updated device flow logic with PKCE by @bobcallaway in #2163
  - fix: rekor get tlog entry with uuid by @asraa in #2058
  - update e2e job to run only when push to main by @cpanato in #2169
  - fix: add env cmd to root by @developer-guy in #2171
  - fix panic when os.Stat returns an error besides ErrNotExists by @dsa0x in #2162</changelog>
  <changelog author="dmueller@suse.com" date="1664280000">- update to 1.12.1:
  * fix: Pulls Fulcio root and intermediate when --certificate-chain is not
    passed into verify-blob command. The v1.12.0 release introduced a
    regression: when COSIGN_EXPERIMENTAL was not set, cosign verify-blob would
    check a --certificate (without a --certificate-chain provided) against the
    operating system root CA bundle. In this release, Cosign checks the
    certificate against Fulcio's CA root instead (restoring the earlier
    behavior).
  * fix: fix cert chain validation for verify-blob in non-experimental mode
  * fix: add COSIGN_EXPERIMENTAL=1 for verify-bloba
  * Fix BYO-root with intermediate to fetch intermediates from annotation
  * fix: fixing breaking changes in rekor v1.12.0 upgrade
- use go-modules service to generate the vendor.tar and use zstd</changelog>
  <changelog author="meissner@suse.com" date="1666094400">- update to 1.13.1:
  * verify-blob-attestation: allow multiple subjects in in_toto attestation (#2341)
  * Nits for #2337 (#2342)
  * Add verify-blob-attestation command and tests (#2337)
  * Update warning when users sign images by tag. (#2313)
  * Remove experimental flags from attest-blob and refactor (#2338)
  * Add --output-attestation flag to attest-blob and remove experimental signing (#2332)
  * Add attest-blob command (#2286)
  * Add '--cert-identity' flag to support subject alternate names for ver… (#2278)
  * Update Dockerfile section of README (#2323)
  * Fix option description: "sign" --&gt; "verify" (#2306)
- update to 1.13.0:
  * feat: use stdin as an input for predicate by @developer-guy in https://github.com/sigstore/cosign/pull/2269
  * feat: improve the verification message by @developer-guy in https://github.com/sigstore/cosign/pull/2268
  * use scaffolding 0.4.8 for tests. by @vaikas in https://github.com/sigstore/cosign/pull/2280
  * fix pivtool generate key touch policy by @cpanato in https://github.com/sigstore/cosign/pull/2282
  * Check error on chain verification failure by @haydentherapper in https://github.com/sigstore/cosign/pull/2284
  * Fix: Remove an extra registry request from verification path. by @mattmoor in https://github.com/sigstore/cosign/pull/2285
  * Fix: Create a static copy of signatures as part of verification. by @mattmoor in https://github.com/sigstore/cosign/pull/2287
  * Data race in FetchSignaturesForReference by @RTann in https://github.com/sigstore/cosign/pull/2283
  * Add support for Fulcio username identity in SAN by @haydentherapper in https://github.com/sigstore/cosign/pull/2291
  * fix: make tlog entry lookups for online verification shard-aware by @asraa in https://github.com/sigstore/cosign/pull/2297
  * Better help text to sign and verify SBOM by @ChristianCiach in https://github.com/sigstore/cosign/pull/2308
  * Adding warning to pin to digest by @ChaosInTheCRD in https://github.com/sigstore/cosign/pull/2311
  * Add annotations for upload blob. by @cldmnky in https://github.com/sigstore/cosign/pull/2188
  * replace deprecate package by @cpanato in https://github.com/sigstore/cosign/pull/2314
  * update release images to use go1.19.2 and cosign v1.12.1 by @cpanato in https://github.com/sigstore/cosign/pull/2315</changelog>
  <changelog author="meissner@suse.com" date="1677499200">- update to 2.0.0 (jsc#SLE-23879)
  Breaking Changes:
  * insecure-skip-tlog-verify: rename and adapt the cert expiration check (#2620)
  * Deprecate --certificate-email flag. Make --certificate-identity and -… (#2411)
  Enhancements:
  * Change go module name to github.com/sigstore/cosign/v2 for Cosign 2.0 (#2544)
  * Allow users to pass in a path for the --identity-token flag (#2538)
  * Breaking change: Respect tlog-upload=false, default to true (#2505)
  * Support outputing a certificate without uploading to the tlog (#2506)
  * Attestation/Blob signing and verification using a RFC3161 time-stamping server (#2464)
  * respect tlog-upload flag with TSA (#2474)
  * Better feedback if specifying incompatible argument on cosign sign --attachment (#2449)
  * Support TSA and Rekor verifications (#2463)
  * add support for tsa signing and verification of images (#2460)
  * cosign policy sign: remove experimental flag and make keyless signing default (#2459)
  * Remove experimental mode from cosign attest and verify-attestation (#2458)
  * Remove experimental mode from sign-blob and verify-blob (#2457)
  * Add --offline flag to force offline verification (#2427)
  * Air gap support (#2299)
  * Breaking change: Change SCT verification behavior to default to enforcement (#2400)
  * Breaking change: remove --force flag from sign and attest and rely on --yes flag to skip confirmation (#2399)
  * Breaking change: replace --no-tlog-upload flag with --tlog-upload flag (#2397)
  * Remove experimental flag from cosign sign and cosign verify (#2387)
  * verify: remove SIGSTORE_TRUST_REKOR_API_PUBLIC_KEY test env var for using a key from rekor's API (#2362)
  * Add warning to use digest instead of tags to other cosign commands (#2650)
  * Fix up UI messages (#2629)
  * Remove hardcoded Fulcio from output (#2621)
  * Fix missing privacy statement, print in multiple locations (#2622)
  * feat: allows custom key names for import-key-pair (#2587)
  * feat: support keyless verification for verify-blob-attestation (#2525)
  * attest-blob: add functionality for keyless signing (#2515)
  * Rego: add support for custom error/warning messages when evaluating rego rules (#2577)
  * feat: add debug information to cert validation error (#2579)
  * Support non-Sigstore TSA requests (#2708)
  * Add COSIGN_OCI_EXPERIMENTAL, push .sig/.sbom using OCI 1.1+ digest tag (#2684)
  * Output certificate in bundle when entry is not uploaded to Rekor (#2715)
  * attach signature and attach sbom must use STDIN to upload raw string (#2637)
  * add generate-key-pair GitHub Enterprise server support (#2676)
  * add in format string for warning (#2699)
  * Support for fetching Fulcio certs with self-managed key (#2532)
  * 2476 predicate type download (#2484)
  Bug Fixes:
  * Fix the file existence check. (#2552)
  * Fix timestamp verification, add verify-blob tests (#2527)
  * Fix(verify): Consolidate certificate expiry logic (#2504)
  * Updates to Timestamp signing and verification (#2499)
  * Fix: removes attestation payload from attest-blob's output &amp; no base64 encoding (#2498)
  * Fix path for e2e-tests badge (#2490)
  * Fix spdx json media type (#2479)
  * Fix sct verificaction (#2426)
  * Fix: panic with unsigned local image (#2656)
  * Make sure a cert passed in via --cert matches the bundle cert (#2652)
  * Fix: fix github oidc post submit test (#2594)
  * Fix: add enhanced error messages for failing verification with TUF targets (#2589)
  * Fix: Add missing schemes to cosign predicate types. (#2717)
  * Fix: Drop the CosignPredicate wrapper around SBOM attestations. (#2718)
  * Fix prompts with Windows line endings (#2674)</changelog>
  <changelog author="dmueller@suse.com" date="1680609600">- fix buildtags
- build against a maintained golang version (upstream uses go1.20)</changelog>
  <changelog author="meissner@suse.com" date="1681732800">- update to 2.0.1 (jsc#SLE-23879)
  Enhancements
  - Add environment variable token provider (#2864)
  - Remove cosign policy command (#2846)
  - Allow customising 'go' executable with GOEXE var (#2841)
  - Consistent tlog warnings during verification (#2840)
  - Add riscv64 arch (#2821)
  - Default generated PEM labels to SIGSTORE (#2735)
  - Update privacy statement and confirmation (#2797)
  - Add exit codes for verify errors (#2766)
  - Add Buildkite provider (#2779)
  - verify-blob-attestation: Loosen arg requirements if --check-claims=false (#2746)
  Bug Fixes
  - PKCS11 sessions are now opened read only (#2853)
  - Makefile: date format of log should not show signatures (#2835)
  - Add missing flags to cosign verify dockerfile/manifest (#2830)
  - Add a warning to remember how to configure a custom Gitlab host (#2816)
  - Remove tag warning message from save/copy commands (#2799)
  - Mark keyless pem files with b64 (#2671)</changelog>
  <changelog author="meissner@suse.com" date="1683460800">- update to 2.0.2 (jsc#SLE-23879)
  Enhancements
  - Update sigstore/sigstore to v1.6.2 to pick up TUF CDN change (#2891)
  - feat: Make cosign copy faster (#2901)
  - remove sget (#2885)
  - Require a payload to be provided with a signature (#2785)
  Bug Fixes
  - cmd: Change error message from KeyParseError to PubKeyParseError for verify-blob. (#2876)
  - Use SOURCE_DATE_EPOCH for OCI CreatedAt times (#2878)
  Documentation
  - Remove experimental warning from Fulcio flags (#2923)
  - add missing oidc provider (#2922)
  - Add zot as a supported registry (#2920)
  - deprecates kms_support docs (#2900)
  - chore(docs) deprecate note for usage docs (#2906)
  - adds note of deprecation for examples.md docs (#2899)</changelog>
  <changelog author="meissner@suse.com" date="1687867200">- updated to 2.1.1 (jsc#SLE-23879)
  - Bug Fixes
  - wait for the workers become available again to continue the execution (#3084)
  - fix help text when in a container (#3082)
- updated to 2.1.0 (jsc#SLE-23879)
  - Breaking Change: The predicate is now a required flag in the attest commands, set via the --type flag.
  - Enhancements
  - Verify sigs and attestations in parallel (#3066)
  - Deep inspect attestations when filtering download (#3031)
  - refactor bundle validation code, add support for DSSE rekor type (#3016)
  - Allow overriding remote options (#3049)
  - feat: adds no cert found on sig exit code (#3038)
  - Make predicate a required flag in attest commands (#3033)
  - Added support for attaching Time stamp authority Response in attach command (#3001)
  - Add sign --sign-container-identity CLI (#2984)
  - Feature: Allow cosign to sign digests before they are uploaded. (#2959)
  - accepts attachment-tag-prefix for cosign copy (#3014)
  - Feature: adds '--allow-insecure-registry' for cosign load (#3000)
  - download attestation: support --platform flag (#2980)
  - Cleanup: Add Digest to the SignedEntity interface. (#2960)
  - verify command: support keyless verification using only a provided certificate chain with non-fulcio roots (#2845)
  - verify: use workers to limit the paralellism when verifying images with --max-workers flag (#3069)
  - Bug Fixes
  - Fix pkg/cosign/errors (#3050)
  - Fix: update doc to refer to github-actions oidc provider (#3040)
  - Fix: prefer GitHub OIDC provider if enabled (#3044)
  - Fix --sig-only in cosign copy (#3074)
  - Documentation
  - Fix links to sigstore/docs in markdown files (#3064)</changelog>
  <changelog author="meissner@suse.com" date="1693569600">- updated to 2.2.0 (jsc#SLE-23879)
  - Enhancements
  * switch to uploading DSSE types to rekor instead of intoto (#3113)
  * add 'cosign sign' command-line parameters for mTLS (#3052)
  * improve error messages around bundle != payload hash (#3146)
  * make VerifyImageAttestation function public (#3156)
  * Switch to cryptoutils function for SANS (#3185)
  * Handle HTTP_1_1_REQUIRED errors in github provider (#3172)
  - Bug Fixes
  * Fix nondeterminsitic timestamps (#3121)
  - Documentation
  * doc: Add example of sign-blob with key in env var (#3152)
  * add deprecation notice for cosign-releases GCS bucket (#3148)
  * update doc links (#3186)</changelog>
  <changelog author="meissner@suse.com" date="1699358400">- updated to 2.2.1 (jsc#SLE-23879)
  This release comes with a fix for
  CVE-2023-46737 / bsc#1216933 described in this [Github Security
  Advisory](https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9).
  Enhancements:
  * feat: Support basic auth and bearer auth login to registry (#3310)
  * add support for ignoring certificates with pkcs11 (#3334)
  * Support ReplaceOp in Signatures (#3315)
  * feat: added ability to get image digest back via triangulate (#3255)
  * feat: add `--only` flag in `cosign copy` to copy sign, att &amp; sbom (#3247)
  * feat: add support attaching a Rekor bundle to a container (#3246)
  * feat: add support outputting rekor response on signing (#3248)
  * feat: improve dockerfile verify subcommand (#3264)
  * Add guard flag for experimental OCI 1.1 verify. (#3272)
  * Deprecate SBOM attachments (#3256)
  * feat: dedent line in cosign copy doc (#3244)
  * feat: add platform flag to cosign copy command (#3234)
  * Add SLSA 1.0 attestation support to cosign. Closes #2860 (#3219)
  * attest: pass OCI remote opts to att resolver. (#3225)
  Bug Fixes:
  * Merge pull request from GHSA-vfp6-jrw2-99g9
  * fix: allow cosign download sbom when image is absent (#3245)
  * ci: add a OCI registry test for referrers support (#3253)
  * Fix ReplaceSignatures (#3292)
  * Stop using deprecated in_toto.ProvenanceStatement (#3243)
  * Fixes #3236, disable SCT checking for a cosign verification when usin… (#3237)
  * fix: update error in `SignedEntity` to be more descriptive (#3233)
  * Fail timestamp verification if no root is provided (#3224)
  Documentation:
  * Add some docs about verifying in an air-gapped environment (#3321)
  * Update CONTRIBUTING.md (#3268)
  * docs: improves the Contribution guidelines (#3257)
  * Remove security policy (#3230)
  Others:
  * Set go to min 1.21 and update dependencies  (#3327)
  * Update contact for code of conduct (#3266)
  * Update .ko.yaml (#3240)</changelog>
  <changelog author="marcos.bjoerkelund@suse.com" date="1702382400">- updated to 2.2.2 (jsc#SLE-23879)
  v2.2.2 adds a new container with a shell,
  gcr.io/projectsigstore/cosign:vx.y.z-dev, in addition to the existing
  container gcr.io/projectsigstore/cosign:vx.y.z without a shell.
  For private deployments, we have also added an alias for
  - -insecure-skip-log, --private-infrastructure.
  Bug Fixes:
  * chore(deps): bump github.com/sigstore/sigstore from 1.7.5 to 1.7.6 (#3411) which fixes a bug with using Azure KMS
  * Don't require CT log keys if using a key/sk (#3415)
  * Fix copy without any flag set (#3409)
  * Update cosign generate cmd to not include newline (#3393)
  * Fix idempotency error with signing (#3371)
  Features:
  * Add --yes flag cosign import-key-pair to skip the overwrite confirmation. (#3383)
  * Use the timeout flag value in verify* commands. (#3391)
  * add --private-infrastructure flag (#3369)
  Container Updates:
  * Bump builder image to use go1.21.4 and add new cosign image tags with shell (#3373)
  Documentation:
  * Update SBOM_SPEC.md (#3358)</changelog>
  <changelog author="meissner@suse.com" date="1706875200">- updated to 2.2.3 (jsc#SLE-23879)
  Bug Fixes:
  * Fix race condition on verification with multiple signatures attached to image (#3486)
  * fix(clean): Fix clean cmd for private registries (#3446)
  * Fixed BYO PKI verification (#3427)
  Features:
  * Allow for option in cosign attest and attest-blob to upload attestation as supported in Rekor (#3466)
  * Add support for OpenVEX predicate type (#3405)
  Documentation:
  * Resolves #3088: `version` sub-command expected behaviour documentation and testing (#3447)
  * add examples for cosign attach signature cmd (#3468)
  Misc:
  * Remove CertSubject function (#3467)
  * Use local rekor and fulcio instances in e2e tests (#3478)
- bumped embedded golang.org/x/crypto/ssh to fix the Terrapin attack CVE-2023-48795 (bsc#1218207)</changelog>
  <changelog author="meissner@suse.com" date="1713182400">- updated to 2.2.4 (jsc#SLE-23879)
  * Bug Fixes
  * Fixes for GHSA-88jx-383q-w4qc and GHSA-95pr-fxf5-86gv (#3661)
  - CVE-2024-29902: Malicious attachments can cause system-wide denial of service (bsc#1222835)
  - CVE-2024-29903: Malicious artifects can cause machine-wide denial of service (bsc#1222837)
  * ErrNoSignaturesFound should be used when there is no signature attached to an image. (#3526)
  * fix semgrep issues for dgryski.semgrep-go ruleset (#3541)
  * Honor creation timestamp for signatures again (#3549)
  * Features
  * Adds Support for Fulcio Client Credentials Flow, and Argument to Set Flow Explicitly (#3578)
  * Documentation
  * add oci bundle spec (#3622)
  * Correct help text of triangulate cmd (#3551)
  * Correct help text of verify-attestation policy argument (#3527)
  * feat: add OVHcloud MPR registry tested with cosign (#3639)</changelog>
</package>
<package pkgid="4e54c2aafc3b5c069f03a59a2b1278eb3c2c4d81c3417ed8f223f4507ed5b5d9" name="cosign" arch="src">
  <version epoch="0" ver="2.2.4" rel="150400.3.20.1"/>
  <changelog author="meissner@suse.com" date="1645444800">- updated to 1.5.2:
  - This release contains fixes for CVE-2022-23649, affecting signature
    validations with Rekor. Only validation is affected, it is not necessary
    to re-sign any artifacts. (bsc#1196239)
- updated to 1.5.1:
  - Bump sigstore/sigstore to pick up oidc login for vault. (#1377)
  - Bump google.golang.org/api from 0.65.0 to 0.66.0 (#1371)
  - expose dafaults fulcio, rekor, oidc issuer urls (#1368)
  - add check to make sure the go modules are in sync (#1369)
  - README: fix link to race conditions (#1367)
  - Bump cloud.google.com/go/storage from 1.18.2 to 1.19.0 (#1365)
  - docs: verify-attestation cue and rego policy doc (#1362)
  - Update verify-blob to support DSSEs (#1355)
  - organize, update select deps (#1358)
  - Bump go-containerregistry to pick up ACR keychain fix (#1357)
  - Bump github.com/go-openapi/runtime from 0.21.0 to 0.21.1 (#1352)
  - sync go modules (#1353)</changelog>
  <changelog author="meissner@suse.com" date="1648814400">- updated to 1.6.0
  - Fix double time import in e2e tests by @saschagrunert in #1388
  - Add --timeout support to sign command by @saschagrunert in #1379
  - Fix comparison in replace option for attestation by @bburky in #1366
  - Add Cosign logo to README by @nsmith5 in #1395
  - Minor refactor to verify SCT and Rekor entry with multiple keys by @haydentherapper in #1396
  - Fix a link of SECURITY.md by @knqyf263 in #1399
  - update cosign and cross-build image for the release job by @cpanato in #1400
  - feat: login command by @developer-guy in #1398
  - TUF: Add root status output by @asraa in #1404
  - Add a newline after password input by @knqyf263 in #1407
  - make imageRef lowercase before parsing by @bobcallaway in #1409
  - Improve error message when image is not found in registry by @imjasonh in #1410
  - Add ability to override the Spiffe socket via environmental variable: by @vaikas in #1421
  - Fix incorrect error check when verifying SCT by @haydentherapper in #1422
  - Skip the ReadWrite test that flakes on Windows. by @dlorenc in #1415
  - Allow PassFunc to be nil by @saschagrunert in #1426
  - Update the cosign keyless documentation to point to the GA release. by @dlorenc in #1427
  - Remove TUF timestamp from OCI signature bundle by @haydentherapper in #1428
  - Add docs on API stability and deprecation table by @priyawadhwa in #1429
  - update cross-build image which adds goimports by @cpanato in #1435
  - feat: enhance clean cmd capability by @developer-guy in #1430
  - use the upstream kubernetes version lib and ldflags by @n3wscott in #1413
  - Improve log lines to match with implementation by @marcofranssen in #1432
  - feat: fig autocomplete feature by @developer-guy in #1360
  - update cross-build to use go 1.17.7 by @cpanato in #1446
  - Fetch verification targets by TUF custom metadata by @haydentherapper in #1423
  - feat: add -buildid= to ldflags by @developer-guy in #1451
  - Streamline SignBlobCmd API with SignCmd by @saschagrunert in #1454
  - convert release cosigned to also generate yaml artifact. by @k4leung4 in #1453
  - Fix tkn link in readme by @Yongxuanzhang in #1459
  - Print message when verifying with old TUF targets by @haydentherapper in #1468
  - fix(sign): refactor unsupported provider log by @Dentrax in #1464
  - tests: /bin/bash -&gt; /usr/bin/env bash by @znewman01 in #1470
  - Double goreleaser timeout by @znewman01 in #1472
  - increase timeout for goreleaser snapshot by @cpanato in #1473
  - fix(sign): kms unspported message by @Dentrax in #1475
  - refactor release cloudbuild job by @cpanato in #1476
  - Fix wording on attach attestation help by @luhring in #1480
  - update go-tuf and simplify TUF client code by @asraa in #1455
  - add initial changelog for 1.5.2 by @cpanato in #1483
  - Fix linter error on main by @priyawadhwa in #1484
  - Update Changelog for Security Advisory by @cpanato in #1485
  - chore(makefile): use kocache, convert publish to build by @developer-guy in #1488
  - Pick up a change to quiet ECR-login logging. by @mattmoor in #1491
  - feat: support other types in copy cmd by @developer-guy in #1493
  - Pick up some of the shared workflows by @mattmoor in #1490
  - feat: nominate Dentrax as codeowner by @developer-guy in #1492
  - add correct layer media type to cosign attach attestation by @spiffcs in #1503
  - This sets up the scaffolding for the cosigned CRD types. by @mattmoor in #1504
  - use v6 api calls in GH action for updating release milestones by @bobcallaway in #1511
  - Add skeleton reconciler for cosigned API CRD. by @mattmoor in #1513
  - bug fix: import ed25519 keys and fix error handling by @asraa in #1518
  - optimize codeql speed by using caching and tracing by @bobcallaway in #1519
  - Add a dummy.go file to allow vendoring config by @jdolitsky in #1520
  - Add CertExtensions func to extract all extensions by @ckotzbauer in #1515
  - chore(ci): add artifact hub support by @Dentrax in #1522
  - Change Fulcio URL default to be fulcio.sigstore.dev by @haydentherapper in #1529
  - Add codecov as github action, set permissions to read content only by @k4leung4 in #1530
  - images: remove --bare flags that conflict with --base-import-paths by @cpanato in #1533
  - Quay OCI Support in README by @sabre1041 in #1539
  - add rpm,deb and apks for cosign packages by @strongjz in #1537
  - Consistent parenthesis use in Makefile by @k4leung4 in #1541
  - add changelog for 1.6.0 by @cpanato in #1535
  - update golang cross image by @cpanato in #1543
  - Add fields in policy CRD by @kkavitha in #1540
  - Disable for now due some issues when downloading the knative module by @cpanato in #1546</changelog>
  <changelog author="meissner@suse.com" date="1650974400">- updated to 1.7.2
  - [Cosigned] Fix publicKey unmarshal by @DennyHoang in #1719
  - fix: add permissions to patch events by @hectorj2f in #1722
  - Make public all types required to use ValidatePolicy by @jdolitsky in #1727
  - Add unit tests for IntotoAttestation verifier. by @vaikas in #1728
  - Remove newline from download sbom output by @ribbybibby in #1732
  - Fix packages name and binary in the packages by @cpanato in #1734
  - Fix fulcioroots test and linter error by @haydentherapper in #1741
  - Support non-ECDSA public keys in certificates by @haydentherapper in #1740
  - bug: remove old fulcio root and fix fallback target code by @asraa in #1738
- updated to 1.7.1
  - pkcs11: fix build instructions by @rgerganov in #1550
  - add definition for artifact hub to verify the ownership by @cpanato in #1563
  - Add example using AWS Key Management Service (KMS) by @davivcgarcia in #1564
  - Start of the necessary pieces to get #1418 and #1419 implemented by @vaikas in #1562
  - Support deletion of ClusterImagePolicy by @vaikas in #1580
  - 1417 policy validations by @kkavitha in #1548
  - Don't lowercase input image refs, just fail by @imjasonh in #1586
  - Fix #1583 #1582. Disallow regex now until implemented. by @vaikas in #1584
  - Fix piping 'cosign verify' using fulcio/rekor by @marcofranssen in #1590
  - Fix #1592 move authorities as siblings of images. by @vaikas in #1593
  - Add ability to inline secrets from SecretRef to configmap. by @vaikas in #1595
  - Fix copy/paste mistake in repo name. by @k4leung4 in #1600
  - Use reusuable release workflow in sigstore/sigstore by @k4leung4 in #1599
  - Add public key validation by @kkavitha in #1598
  - Validate a public key in a secret is valid. by @vaikas in #1602
  - Ensure entry is removed from CM on secret error. by @vaikas in #1605
  - Add two env variables. One for using Rekor public key from OOB and one for fetching it from Rekor server by @vaikas in #1610
  - Init entity from ociremote when signing a digest ref by @puerco in #1616
  - rename ca-key to ca-cert. Fix 1608, 1613 by @vaikas in #1617
  - improve cosigned validation error messages by @cpanato in #1618
  - Use latest knative/pkg's configmap informer by @tcnghia in #1615
  - Included OpenSSF Best Practices Badge by @naveensrinivasan in #1628
  - FUN.md broke when RecordObj changed to HashedRecordObj by @MitchellJThomas in #1633
  - update crane to v0.8.0 release by @cpanato in #1635
  - push latest tag when building a release by @cpanato in #1636
  - Add extra label and change the latest tag to unstable for non tagged releases by @cpanato in #1637
  - Document Elastic container registry support by @mgreau in #1641
  - Validate authority keys by @coyote240 in #1623
  - feat: tree command utility by @developer-guy in #1603
  - fix build date format for version command by @cpanato in #1644
  - Add support for intermediate certificates when verifiying by @haydentherapper in #1631
  - Prompt user before running cosign clean by @priyawadhwa in #1649
  - Use ClusterImagePolicy with Keyless + e2e tests for CIP with kind by @vaikas in #1650
  - KEYLESS.md: Shorten example OAuth URL by @tstromberg in #1661
  - Use syscall.Stdin for input handle. Fixes #1153 by @mdp in #1657
  - Add support for certificate chain to verify certificate by @haydentherapper in #1659
  - First batch of followups to #1650 by @vaikas in #1664
  - Add certificate chain flag for signing by @haydentherapper in #1656
  - [attach]: Add specific suffixes mediaTypes to sboms by @hectorj2f in #1663
  - update font when output the cosign version by @cpanato in #1668
  - feat: add ability to override registry keychain by @noamichael in #1666
  - remove replace directive by @cpanato in #1669
  - Refactor based on discussions in #1650 by @vaikas in #1674
  - Find all valid entries in verify-blob by @priyawadhwa in #1673
  - Fix relative paths in Gitub OIDC blob test by @priyawadhwa in #1677
  - Add support for cert and cert chain flags with PKCS11 tokens by @haydentherapper in #1671
  - Use cosign @ HEAD for Github OIDC sign blob test by @priyawadhwa in #1678
  - Make cosign copy copy metadata attached to child images. by @mattmoor in #1682
  - change file_name_template to PackageName by @strongjz in #1683
  - Update error message for verify/verify attestation by @haydentherapper in #1686
  - cosign clean: Don't log failure if the registry responds with 404 by @imjasonh in #1687
  - verify: add leaf hash verification for tlog entries by @asraa in #1688
  - Fix handling of policy in verify-attestation by @lcarva in #1672
  - Add e2e test for attest / verify-attestation by @vaikas in #1685
  - verify: remove extra calls to rekor for verify and verify-blob by @asraa in #1694
  - Remove the hardcoded sigstore audience by @mattmoor in #1698
  - Use ValidatePubKey from sigstore/sigstore by @haydentherapper in #1676
  - Use the github actions from sigstore/scaffolding. by @vaikas in #1699
  - sign: set the oidc redirect uri by @hectorj2f in #1675
  - add back the go mod proxy by @cpanato in #1701
  - enable 1.23 tests (Test cosigned with ClusterImagePolicy) by @cpanato in #1702
  - Fix incorrect unmarshalling of SCT response by @haydentherapper in #1704
  - Make CLI flag for OIDC client secret take a path by @znewman01 in #1705
  - cosigned: read the public key from the kms authority by @hectorj2f in #1706
  - fix latest tag when running a release job by @cpanato in #1707
  - [Cosigned] Parse and store publicKey data earlier by @DennyHoang in #1681
  - Dont overwrite token set in keyOpts by @puerco in #1709
  - refactor release job by @cpanato in #1710</changelog>
  <changelog author="meissner@suse.com" date="1653134400">- updated to 1.8.0
  - Move the KMS integration imports into the binary entrypoints by @mattmoor in #1744
  - [Cosigned] Convert functions for webhookCIP from v1alpha1 by @DennyHoang in #1736
  - Refactor policy related code, add support for vuln verify by @vaikas in #1747
  - Use bundle log ID to find verification key by @haydentherapper in #1748
  - [cosigned] The webhook name is now configurable via --webhook-name flag by @vpnachev in #1726
  - Add intermediate CA certificate pool for Fulcio by @haydentherapper in #1749
  - test: create fake TUF test root and create test SETs for verification by @asraa in #1750
  - Implement identities, fix bug in webhook validation. by @vaikas in #1759
  - Validate issuer/subject regexp in validate webhook. by @vaikas in #1761
  - chore: add warning when attaching sBOMs by @hectorj2f in #1756
  - Verify embedded SCTs by @haydentherapper in #1731
  - chore: add warning when downloading a sBOM by @hectorj2f in #1763
  - [policy-webhook] The webhooks name is now configurable via --(validating|mutating)-webhook-name flags by @vpnachev in #1757
  - Break the CIP action tests into a sh script. by @vaikas in #1767
  - tuf: add debug info if tuf update fails by @asraa in #1766
  - cosigned: add support for rsa keys by @hectorj2f in #1768
  - Cosigned validate against remote sig src by @DennyHoang in #1754
  - Add Fulcio intermediate CA certificate to intermediate pool by @haydentherapper in #1774
  - fix: more informative error by @ybelMekk in #1778
  - Run update-codegen. by @wlynch in #1789
  - Remove the dependency on v1alpha1.Identity which brings in unnecessary k8s deps. by @vaikas in #1790
  - Refactor fulcio signer to take in KeyOpts. by @wlynch in #1788
  - test: add cue unit tests by @hectorj2f in #1791
  - Attestations + policy in cip. by @vaikas in #1772
  - chore: add rego function to consume modules and evaluate them by @hectorj2f in #1787
  - Add parallelization for processing policies / authorities. by @vaikas in #1795
  - Allow passing keys via environment variables (env:// refs) by @znewman01 in #1794
  - Handle context cancelled properly + tests. by @vaikas in #1796
  - Fix a bug where an error would send duplicate results. by @vaikas in #1797
  - Revert "Refactor fulcio signer to take in KeyOpts. (#1788)" by @wlynch in #1798
  - cosigned: Unify cue data and policy before evaluating it by @hectorj2f in #1793
  - Don't fail open in VerifyBundle by @mtrmac in #1648
  - Load in intermediate cert pool from TUF by @haydentherapper in #1804
  - Support PKCS1 encoded and non-ECDSA CT log public keys by @haydentherapper in #1806</changelog>
  <changelog author="meissner@suse.com" date="1655553600">- updated to 1.9.0
  - Check failure message of policy that fails with issuer mismatch by @vaikas in #1815
  - [Cosigned] Add signature pull secrets by @DennyHoang in #1805
  - feat: add rego policy support by @hectorj2f in #1817
  - Refactor fulcio signer to take in KeyOpts (take 2) by @wlynch in #1818
  - cosigned: Test unsupported KMS providers by @imjasonh in #1820
  - chore(deps): Included dependency review by @naveensrinivasan in #1792
  - Add auth flow option to KeyOpts. by @wlynch in #1827
  - Document Staging instance usage with Keyless by @k4leung4 in #1824
  - New flag --oidc-providers-disable to disable OIDC providers by @puerco in #1832
  - Validate tlog entry when verifying signature via public key. by @wlynch in #1833
  - Add function to explicitly request a certain provider by @priyawadhwa in #1837
  - cosigned: Fix podAntiAffinity labels by @elfotografo007 in #1841
  - remove exclude from go.mod by @cpanato in #1846
  - [Cosigned] Glob matching improvement by @DennyHoang in #1842
  - sget: Enable KMS providers for sget by @imjasonh in #1852
  - Fix piv-tool generate-key command in TOKENS doc by @nealmcb in #1850
  - Add IBM Cloud Container Registry to tested registry list by @bainsy88 in #1856
  - If SBOM ref has .json suffix, assume JSON mediatype by @jdolitsky in #1859
  - Add rekor.0.pub TUF target to unit tests by @priyawadhwa in #1860
  - Normalize certificate flag names by @haydentherapper in #1868
  - Check certificate policy flags with only a certificate by @haydentherapper in #1869
  - Update go to 1.17.10 / cosign image to 1.18.0 and actions setup go by @cpanato in #1861
  - Point git commmit FUN.md to gitsign! by @wlynch in #1874
  - [cosigned] remove regex from the image pattern fields by @hectorj2f in #1873
  - go.mod: format go.mod by @zchee in #1879
  - Remove dependency on deprecated github.com/pkg/errors by @zchee in #1887
  - tree: only report artifacts that are present by @ribbybibby in #1872
  - update README with ebpf modules by @EItanya in #1888
  - Update github.com/google/go-containerregistry/pkg/authn/k8schain module to f1b065c6cb3d by @vpnachev in #1889
  - v1beta1 API for cosigned by @vaikas in #1890
  - tree: support --attachment-tag-prefix by @ribbybibby in #1900
  - [cosigned] Remove undefined apiGroups from policy clusterrole by @vpnachev in #1896
  - GHSA-66x3-6cw3-v5gj: Update go-tuf to v0.3.0 by @janisz in #1894
  - The timeout arg in golangci-lint has been moved to the generic args p… by @dlorenc in #1901
  - [cosigned] Rename cosigned references to policy-controller by @hectorj2f in #1893
  - Move deprecated dependency: google/trillian/merkle to transparency-dev by @cpanato in #1910
  - Add support for "**" in image glob matching by @imjasonh in #1914
  - Add privacy statement for PII storage by @haydentherapper in #1909
  - Do not push to public rekor. by @vaikas in #1931
  - fix: fix fetching updated targets from TUF root by @asraa in #1921
  - fix: fix #1930 for AWS KMS formats by @vaikas in #1946
  - update cross-builder image to use go1.17.11 by @cpanato in #1950
  - remove deprecation from goreleaser, go-fish is not supported anymore by @cpanato in #1952
  - add changelog for v1.9.0 by @cpanato in #1955
  - add parallelism for goreleaser by @cpanato in #1957</changelog>
  <changelog author="meissner@suse.com" date="1658923200">- updated to 1.10.0
  - replace gcr.io/distroless/ to use ghcr.io/distroless/ by @cpanato in #1961
  - Separate RegExp matching of issuer/subject from strict by @vaikas in #1956
  - tuf: improve TUF client concurrency and caching by @asraa in #1953
  - Add Cloudsmith Container Registry to tested registry list by @ciaracarey in #1966
  - feat(fulcioroots): singleton error pattern by @developer-guy in #1965
  - Drop tuf client dependency on GCS client library by @imjasonh in #1967
  - Add spdxjson predicate type for attestations by @jdolitsky in #1974
  - Remove policy-controller now that it lives in sigstore/policy-controller by @vaikas in #1976
  - cleanup: unexport kubernetes.Client method by @imjasonh in #1973
  - cleanup ci job and remove policy-controller references by @cpanato in #1981
  - fix/update post build job by @cpanato in #1983
  - docs: updated Azure kms commands. by @JBrejnholt in #1972
  - Add cyclonedx predicate type for attestations by @jdolitsky in #1977
  - Route deprecated -version to version subcommand by @puerco in #1854
  - docs(readme): add installation steps for container image for cosign binary by @developer-guy in #1986
  - Add --platform flag to cosign sbom download by @puerco in #1975
  - Use pkg/fulcioroots and pkg/tuf from sigstore/sigstore by @imjasonh in #1866
  - Add --oidc-provider flag to specify which provider to use for ambient credentials by @priyawadhwa in #1998
  - encrypt values to create the github action secret by @cpanato in #1990
  - sign-blob: bundle should work independently and respect --output-certificate and --output-signature by @Dentrax in #2016
  - Attempt to clean up pkg/cosign by @imjasonh in #2018
  - public-key: fix command description by @Dentrax in #2024
  - [NFC] specs: fix list formatting on SIGNATURE_SPEC by @woodruffw in #2030
  - feat: cert-extensions verify by @developer-guy in #1626
  - Fix #1378 create new attestation signature in replace mode if not existent by @Syquel in #2014
  - Use cosign.ConfirmPrompt more consistently by @imjasonh in #2039
  - chore: add a note about SIGSTORE_REKOR_PUBLIC_KEY var by @hectorj2f in #2040
  - Fix OIDC test by @cpanato in #2050
  - Add env subcommand. by @wlynch in #2051
  - remove tests with 1.21 k8s cluster because it is deprecated and add v1.23/24 by @cpanato in #2055
  - update ct/otel and etcd by @cpanato in #2054
  - chore(deps): CycloneDX PredicateType changed to use in-toto-golang by @masahiro331 in #2067
  - Remove replace directives in go.mod. by @wlynch in #2070
  - update design doc link by @bobcallaway in #2077
  - Remove hack/tools.go by @imjasonh in #2080
  - fix missing quote by @cpanato in #2090
- removed cosigned and webhook</changelog>
  <changelog author="meissner@suse.com" date="1659700800">- updated to 1.10.1 (jsc#SLE-23879)
  - CVE-2022-35929: Fixed that cosign verify-attestaton --type can
    report a false positive if any attestation exists (GHSA-vjxv-45g9-9296
    (bsc#1202157)
- What else changed:
  - add flag to allow skipping upload to transparency log by @k4leung4 in #2089
  - Improve error message when no sigs/atts are found for an image by @imjasonh in #2101
  - Change Result in Vulnerability Attestation to interface{} by @knqyf263 in #2096
  - Fix field names in the vulnerability attestation by @otms61 in #2099
  - remove style jobs and cleanup makefile gofmt and goimports are running already with golangci-lint by @cpanato in #2105
  - sparkles Enable Scorecard badge by @azeemshaikh38 in #2109
  - Resolves #522 set Created date to time of execution by @Lerentis in #2108
  - Introduce a custom error type to classify errors. by @mattmoor in #2114
  - feat: attach: attestation: allow passing multiple payloads by @Dentrax in #2085
  - update cross-builder to go1.18.5 and cosign image to 1.10.0 by @cpanato in #2119
  - chore: fix documentation and warning on using untrusted rekor key by @asraa in #2124
  - Correct the type used for attest by @mattmoor in #2128</changelog>
  <changelog author="meissner@suse.com" date="1663243200">- updated to 1.12.0 (jsc#SLE-23879)
  - CVE-2022-36056: Fixed verify-blob could successfully verify an artifact when verification should have failed (bsc#1203430)
  - Support non-ECDSA key types for verify-blob by @haydentherapper in #2203
  - feat: integrate Alibaba Cloud Container Registry cred helper by @mozillazg in #2008
  - remove double quotes, looks like it is passing as a single string to cosign and not as an array by @cpanato in #2205
  - Clarify error when KMS provider fails to load by @znewman01 in #2220
  - feat: set annotations to generate additional bash completion information by @dirien in #2221
  - Add deprecation warning for sget CLI and packages by @imjasonh in #2019
  - upgrade setup-ko to point to new repo by @imjasonh in #2225
  - Temp fix for e2e test by @haydentherapper in #2247
  - update kind to use release v0.15.0 and some version comments by @cpanato in #2246
  - Fix e2e test failure, add test for local bundle without rekor bundle by @haydentherapper in #2248
  - fix: fix secret test, non-experimental bundle should pass by @asraa in #2249
- updated to 1.11.1
  - add stale workflow using the workflow template by @cpanato in #2175
  - Update Scorecard action to v2:alpha by @azeemshaikh38 in #2177
  - add release cadence section in the readme by @cpanato in #2179
  - feat: Rework fig autocomplete command by @dirien in #2187
  - fix: fix typo that caused attestation verification failure by @asraa in #2199
- updated to 1.11.0
  - Verify the certificate chain against the Fulcio root trust by default by @wata727 in #2139
  - Add notes to clarify registry use. by @bendory in #2145
  - Use TUF from scaffolding for validating cosign. by @vaikas in #2146
  - docs: clarify wording in spec about usage of certificate chain by @asraa in #2152
  - fix: fix blob verification output with sharded rekor tlogs by @asraa in #2157
  - fix: adds envelope hash to in-toto entries in tlog entry creation by @nkreiger in #2118
  - fix handling of verify-attestation types for URIs by @otms61 in #2159
  - fix oidc post-merge job by @cpanato in #2164
  - Remove third_party by @imjasonh in #2166
  - use updated device flow logic with PKCE by @bobcallaway in #2163
  - fix: rekor get tlog entry with uuid by @asraa in #2058
  - update e2e job to run only when push to main by @cpanato in #2169
  - fix: add env cmd to root by @developer-guy in #2171
  - fix panic when os.Stat returns an error besides ErrNotExists by @dsa0x in #2162</changelog>
  <changelog author="dmueller@suse.com" date="1664280000">- update to 1.12.1:
  * fix: Pulls Fulcio root and intermediate when --certificate-chain is not
    passed into verify-blob command. The v1.12.0 release introduced a
    regression: when COSIGN_EXPERIMENTAL was not set, cosign verify-blob would
    check a --certificate (without a --certificate-chain provided) against the
    operating system root CA bundle. In this release, Cosign checks the
    certificate against Fulcio's CA root instead (restoring the earlier
    behavior).
  * fix: fix cert chain validation for verify-blob in non-experimental mode
  * fix: add COSIGN_EXPERIMENTAL=1 for verify-bloba
  * Fix BYO-root with intermediate to fetch intermediates from annotation
  * fix: fixing breaking changes in rekor v1.12.0 upgrade
- use go-modules service to generate the vendor.tar and use zstd</changelog>
  <changelog author="meissner@suse.com" date="1666094400">- update to 1.13.1:
  * verify-blob-attestation: allow multiple subjects in in_toto attestation (#2341)
  * Nits for #2337 (#2342)
  * Add verify-blob-attestation command and tests (#2337)
  * Update warning when users sign images by tag. (#2313)
  * Remove experimental flags from attest-blob and refactor (#2338)
  * Add --output-attestation flag to attest-blob and remove experimental signing (#2332)
  * Add attest-blob command (#2286)
  * Add '--cert-identity' flag to support subject alternate names for ver… (#2278)
  * Update Dockerfile section of README (#2323)
  * Fix option description: "sign" --&gt; "verify" (#2306)
- update to 1.13.0:
  * feat: use stdin as an input for predicate by @developer-guy in https://github.com/sigstore/cosign/pull/2269
  * feat: improve the verification message by @developer-guy in https://github.com/sigstore/cosign/pull/2268
  * use scaffolding 0.4.8 for tests. by @vaikas in https://github.com/sigstore/cosign/pull/2280
  * fix pivtool generate key touch policy by @cpanato in https://github.com/sigstore/cosign/pull/2282
  * Check error on chain verification failure by @haydentherapper in https://github.com/sigstore/cosign/pull/2284
  * Fix: Remove an extra registry request from verification path. by @mattmoor in https://github.com/sigstore/cosign/pull/2285
  * Fix: Create a static copy of signatures as part of verification. by @mattmoor in https://github.com/sigstore/cosign/pull/2287
  * Data race in FetchSignaturesForReference by @RTann in https://github.com/sigstore/cosign/pull/2283
  * Add support for Fulcio username identity in SAN by @haydentherapper in https://github.com/sigstore/cosign/pull/2291
  * fix: make tlog entry lookups for online verification shard-aware by @asraa in https://github.com/sigstore/cosign/pull/2297
  * Better help text to sign and verify SBOM by @ChristianCiach in https://github.com/sigstore/cosign/pull/2308
  * Adding warning to pin to digest by @ChaosInTheCRD in https://github.com/sigstore/cosign/pull/2311
  * Add annotations for upload blob. by @cldmnky in https://github.com/sigstore/cosign/pull/2188
  * replace deprecate package by @cpanato in https://github.com/sigstore/cosign/pull/2314
  * update release images to use go1.19.2 and cosign v1.12.1 by @cpanato in https://github.com/sigstore/cosign/pull/2315</changelog>
  <changelog author="meissner@suse.com" date="1677499200">- update to 2.0.0 (jsc#SLE-23879)
  Breaking Changes:
  * insecure-skip-tlog-verify: rename and adapt the cert expiration check (#2620)
  * Deprecate --certificate-email flag. Make --certificate-identity and -… (#2411)
  Enhancements:
  * Change go module name to github.com/sigstore/cosign/v2 for Cosign 2.0 (#2544)
  * Allow users to pass in a path for the --identity-token flag (#2538)
  * Breaking change: Respect tlog-upload=false, default to true (#2505)
  * Support outputing a certificate without uploading to the tlog (#2506)
  * Attestation/Blob signing and verification using a RFC3161 time-stamping server (#2464)
  * respect tlog-upload flag with TSA (#2474)
  * Better feedback if specifying incompatible argument on cosign sign --attachment (#2449)
  * Support TSA and Rekor verifications (#2463)
  * add support for tsa signing and verification of images (#2460)
  * cosign policy sign: remove experimental flag and make keyless signing default (#2459)
  * Remove experimental mode from cosign attest and verify-attestation (#2458)
  * Remove experimental mode from sign-blob and verify-blob (#2457)
  * Add --offline flag to force offline verification (#2427)
  * Air gap support (#2299)
  * Breaking change: Change SCT verification behavior to default to enforcement (#2400)
  * Breaking change: remove --force flag from sign and attest and rely on --yes flag to skip confirmation (#2399)
  * Breaking change: replace --no-tlog-upload flag with --tlog-upload flag (#2397)
  * Remove experimental flag from cosign sign and cosign verify (#2387)
  * verify: remove SIGSTORE_TRUST_REKOR_API_PUBLIC_KEY test env var for using a key from rekor's API (#2362)
  * Add warning to use digest instead of tags to other cosign commands (#2650)
  * Fix up UI messages (#2629)
  * Remove hardcoded Fulcio from output (#2621)
  * Fix missing privacy statement, print in multiple locations (#2622)
  * feat: allows custom key names for import-key-pair (#2587)
  * feat: support keyless verification for verify-blob-attestation (#2525)
  * attest-blob: add functionality for keyless signing (#2515)
  * Rego: add support for custom error/warning messages when evaluating rego rules (#2577)
  * feat: add debug information to cert validation error (#2579)
  * Support non-Sigstore TSA requests (#2708)
  * Add COSIGN_OCI_EXPERIMENTAL, push .sig/.sbom using OCI 1.1+ digest tag (#2684)
  * Output certificate in bundle when entry is not uploaded to Rekor (#2715)
  * attach signature and attach sbom must use STDIN to upload raw string (#2637)
  * add generate-key-pair GitHub Enterprise server support (#2676)
  * add in format string for warning (#2699)
  * Support for fetching Fulcio certs with self-managed key (#2532)
  * 2476 predicate type download (#2484)
  Bug Fixes:
  * Fix the file existence check. (#2552)
  * Fix timestamp verification, add verify-blob tests (#2527)
  * Fix(verify): Consolidate certificate expiry logic (#2504)
  * Updates to Timestamp signing and verification (#2499)
  * Fix: removes attestation payload from attest-blob's output &amp; no base64 encoding (#2498)
  * Fix path for e2e-tests badge (#2490)
  * Fix spdx json media type (#2479)
  * Fix sct verificaction (#2426)
  * Fix: panic with unsigned local image (#2656)
  * Make sure a cert passed in via --cert matches the bundle cert (#2652)
  * Fix: fix github oidc post submit test (#2594)
  * Fix: add enhanced error messages for failing verification with TUF targets (#2589)
  * Fix: Add missing schemes to cosign predicate types. (#2717)
  * Fix: Drop the CosignPredicate wrapper around SBOM attestations. (#2718)
  * Fix prompts with Windows line endings (#2674)</changelog>
  <changelog author="dmueller@suse.com" date="1680609600">- fix buildtags
- build against a maintained golang version (upstream uses go1.20)</changelog>
  <changelog author="meissner@suse.com" date="1681732800">- update to 2.0.1 (jsc#SLE-23879)
  Enhancements
  - Add environment variable token provider (#2864)
  - Remove cosign policy command (#2846)
  - Allow customising 'go' executable with GOEXE var (#2841)
  - Consistent tlog warnings during verification (#2840)
  - Add riscv64 arch (#2821)
  - Default generated PEM labels to SIGSTORE (#2735)
  - Update privacy statement and confirmation (#2797)
  - Add exit codes for verify errors (#2766)
  - Add Buildkite provider (#2779)
  - verify-blob-attestation: Loosen arg requirements if --check-claims=false (#2746)
  Bug Fixes
  - PKCS11 sessions are now opened read only (#2853)
  - Makefile: date format of log should not show signatures (#2835)
  - Add missing flags to cosign verify dockerfile/manifest (#2830)
  - Add a warning to remember how to configure a custom Gitlab host (#2816)
  - Remove tag warning message from save/copy commands (#2799)
  - Mark keyless pem files with b64 (#2671)</changelog>
  <changelog author="meissner@suse.com" date="1683460800">- update to 2.0.2 (jsc#SLE-23879)
  Enhancements
  - Update sigstore/sigstore to v1.6.2 to pick up TUF CDN change (#2891)
  - feat: Make cosign copy faster (#2901)
  - remove sget (#2885)
  - Require a payload to be provided with a signature (#2785)
  Bug Fixes
  - cmd: Change error message from KeyParseError to PubKeyParseError for verify-blob. (#2876)
  - Use SOURCE_DATE_EPOCH for OCI CreatedAt times (#2878)
  Documentation
  - Remove experimental warning from Fulcio flags (#2923)
  - add missing oidc provider (#2922)
  - Add zot as a supported registry (#2920)
  - deprecates kms_support docs (#2900)
  - chore(docs) deprecate note for usage docs (#2906)
  - adds note of deprecation for examples.md docs (#2899)</changelog>
  <changelog author="meissner@suse.com" date="1687867200">- updated to 2.1.1 (jsc#SLE-23879)
  - Bug Fixes
  - wait for the workers become available again to continue the execution (#3084)
  - fix help text when in a container (#3082)
- updated to 2.1.0 (jsc#SLE-23879)
  - Breaking Change: The predicate is now a required flag in the attest commands, set via the --type flag.
  - Enhancements
  - Verify sigs and attestations in parallel (#3066)
  - Deep inspect attestations when filtering download (#3031)
  - refactor bundle validation code, add support for DSSE rekor type (#3016)
  - Allow overriding remote options (#3049)
  - feat: adds no cert found on sig exit code (#3038)
  - Make predicate a required flag in attest commands (#3033)
  - Added support for attaching Time stamp authority Response in attach command (#3001)
  - Add sign --sign-container-identity CLI (#2984)
  - Feature: Allow cosign to sign digests before they are uploaded. (#2959)
  - accepts attachment-tag-prefix for cosign copy (#3014)
  - Feature: adds '--allow-insecure-registry' for cosign load (#3000)
  - download attestation: support --platform flag (#2980)
  - Cleanup: Add Digest to the SignedEntity interface. (#2960)
  - verify command: support keyless verification using only a provided certificate chain with non-fulcio roots (#2845)
  - verify: use workers to limit the paralellism when verifying images with --max-workers flag (#3069)
  - Bug Fixes
  - Fix pkg/cosign/errors (#3050)
  - Fix: update doc to refer to github-actions oidc provider (#3040)
  - Fix: prefer GitHub OIDC provider if enabled (#3044)
  - Fix --sig-only in cosign copy (#3074)
  - Documentation
  - Fix links to sigstore/docs in markdown files (#3064)</changelog>
  <changelog author="meissner@suse.com" date="1693569600">- updated to 2.2.0 (jsc#SLE-23879)
  - Enhancements
  * switch to uploading DSSE types to rekor instead of intoto (#3113)
  * add 'cosign sign' command-line parameters for mTLS (#3052)
  * improve error messages around bundle != payload hash (#3146)
  * make VerifyImageAttestation function public (#3156)
  * Switch to cryptoutils function for SANS (#3185)
  * Handle HTTP_1_1_REQUIRED errors in github provider (#3172)
  - Bug Fixes
  * Fix nondeterminsitic timestamps (#3121)
  - Documentation
  * doc: Add example of sign-blob with key in env var (#3152)
  * add deprecation notice for cosign-releases GCS bucket (#3148)
  * update doc links (#3186)</changelog>
  <changelog author="meissner@suse.com" date="1699358400">- updated to 2.2.1 (jsc#SLE-23879)
  This release comes with a fix for
  CVE-2023-46737 / bsc#1216933 described in this [Github Security
  Advisory](https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9).
  Enhancements:
  * feat: Support basic auth and bearer auth login to registry (#3310)
  * add support for ignoring certificates with pkcs11 (#3334)
  * Support ReplaceOp in Signatures (#3315)
  * feat: added ability to get image digest back via triangulate (#3255)
  * feat: add `--only` flag in `cosign copy` to copy sign, att &amp; sbom (#3247)
  * feat: add support attaching a Rekor bundle to a container (#3246)
  * feat: add support outputting rekor response on signing (#3248)
  * feat: improve dockerfile verify subcommand (#3264)
  * Add guard flag for experimental OCI 1.1 verify. (#3272)
  * Deprecate SBOM attachments (#3256)
  * feat: dedent line in cosign copy doc (#3244)
  * feat: add platform flag to cosign copy command (#3234)
  * Add SLSA 1.0 attestation support to cosign. Closes #2860 (#3219)
  * attest: pass OCI remote opts to att resolver. (#3225)
  Bug Fixes:
  * Merge pull request from GHSA-vfp6-jrw2-99g9
  * fix: allow cosign download sbom when image is absent (#3245)
  * ci: add a OCI registry test for referrers support (#3253)
  * Fix ReplaceSignatures (#3292)
  * Stop using deprecated in_toto.ProvenanceStatement (#3243)
  * Fixes #3236, disable SCT checking for a cosign verification when usin… (#3237)
  * fix: update error in `SignedEntity` to be more descriptive (#3233)
  * Fail timestamp verification if no root is provided (#3224)
  Documentation:
  * Add some docs about verifying in an air-gapped environment (#3321)
  * Update CONTRIBUTING.md (#3268)
  * docs: improves the Contribution guidelines (#3257)
  * Remove security policy (#3230)
  Others:
  * Set go to min 1.21 and update dependencies  (#3327)
  * Update contact for code of conduct (#3266)
  * Update .ko.yaml (#3240)</changelog>
  <changelog author="marcos.bjoerkelund@suse.com" date="1702382400">- updated to 2.2.2 (jsc#SLE-23879)
  v2.2.2 adds a new container with a shell,
  gcr.io/projectsigstore/cosign:vx.y.z-dev, in addition to the existing
  container gcr.io/projectsigstore/cosign:vx.y.z without a shell.
  For private deployments, we have also added an alias for
  - -insecure-skip-log, --private-infrastructure.
  Bug Fixes:
  * chore(deps): bump github.com/sigstore/sigstore from 1.7.5 to 1.7.6 (#3411) which fixes a bug with using Azure KMS
  * Don't require CT log keys if using a key/sk (#3415)
  * Fix copy without any flag set (#3409)
  * Update cosign generate cmd to not include newline (#3393)
  * Fix idempotency error with signing (#3371)
  Features:
  * Add --yes flag cosign import-key-pair to skip the overwrite confirmation. (#3383)
  * Use the timeout flag value in verify* commands. (#3391)
  * add --private-infrastructure flag (#3369)
  Container Updates:
  * Bump builder image to use go1.21.4 and add new cosign image tags with shell (#3373)
  Documentation:
  * Update SBOM_SPEC.md (#3358)</changelog>
  <changelog author="meissner@suse.com" date="1706875200">- updated to 2.2.3 (jsc#SLE-23879)
  Bug Fixes:
  * Fix race condition on verification with multiple signatures attached to image (#3486)
  * fix(clean): Fix clean cmd for private registries (#3446)
  * Fixed BYO PKI verification (#3427)
  Features:
  * Allow for option in cosign attest and attest-blob to upload attestation as supported in Rekor (#3466)
  * Add support for OpenVEX predicate type (#3405)
  Documentation:
  * Resolves #3088: `version` sub-command expected behaviour documentation and testing (#3447)
  * add examples for cosign attach signature cmd (#3468)
  Misc:
  * Remove CertSubject function (#3467)
  * Use local rekor and fulcio instances in e2e tests (#3478)
- bumped embedded golang.org/x/crypto/ssh to fix the Terrapin attack CVE-2023-48795 (bsc#1218207)</changelog>
  <changelog author="meissner@suse.com" date="1713182400">- updated to 2.2.4 (jsc#SLE-23879)
  * Bug Fixes
  * Fixes for GHSA-88jx-383q-w4qc and GHSA-95pr-fxf5-86gv (#3661)
  - CVE-2024-29902: Malicious attachments can cause system-wide denial of service (bsc#1222835)
  - CVE-2024-29903: Malicious artifects can cause machine-wide denial of service (bsc#1222837)
  * ErrNoSignaturesFound should be used when there is no signature attached to an image. (#3526)
  * fix semgrep issues for dgryski.semgrep-go ruleset (#3541)
  * Honor creation timestamp for signatures again (#3549)
  * Features
  * Adds Support for Fulcio Client Credentials Flow, and Argument to Set Flow Explicitly (#3578)
  * Documentation
  * add oci bundle spec (#3622)
  * Correct help text of triangulate cmd (#3551)
  * Correct help text of verify-attestation policy argument (#3527)
  * feat: add OVHcloud MPR registry tested with cosign (#3639)</changelog>
</package>
<package pkgid="f2736e9e0da8d050b2ebac20f34e36a194aa4bef0cd94ae9bdb296cfb8857170" name="cosign" arch="x86_64">
  <version epoch="0" ver="2.2.4" rel="150400.3.20.1"/>
  <changelog author="meissner@suse.com" date="1645444800">- updated to 1.5.2:
  - This release contains fixes for CVE-2022-23649, affecting signature
    validations with Rekor. Only validation is affected, it is not necessary
    to re-sign any artifacts. (bsc#1196239)
- updated to 1.5.1:
  - Bump sigstore/sigstore to pick up oidc login for vault. (#1377)
  - Bump google.golang.org/api from 0.65.0 to 0.66.0 (#1371)
  - expose dafaults fulcio, rekor, oidc issuer urls (#1368)
  - add check to make sure the go modules are in sync (#1369)
  - README: fix link to race conditions (#1367)
  - Bump cloud.google.com/go/storage from 1.18.2 to 1.19.0 (#1365)
  - docs: verify-attestation cue and rego policy doc (#1362)
  - Update verify-blob to support DSSEs (#1355)
  - organize, update select deps (#1358)
  - Bump go-containerregistry to pick up ACR keychain fix (#1357)
  - Bump github.com/go-openapi/runtime from 0.21.0 to 0.21.1 (#1352)
  - sync go modules (#1353)</changelog>
  <changelog author="meissner@suse.com" date="1648814400">- updated to 1.6.0
  - Fix double time import in e2e tests by @saschagrunert in #1388
  - Add --timeout support to sign command by @saschagrunert in #1379
  - Fix comparison in replace option for attestation by @bburky in #1366
  - Add Cosign logo to README by @nsmith5 in #1395
  - Minor refactor to verify SCT and Rekor entry with multiple keys by @haydentherapper in #1396
  - Fix a link of SECURITY.md by @knqyf263 in #1399
  - update cosign and cross-build image for the release job by @cpanato in #1400
  - feat: login command by @developer-guy in #1398
  - TUF: Add root status output by @asraa in #1404
  - Add a newline after password input by @knqyf263 in #1407
  - make imageRef lowercase before parsing by @bobcallaway in #1409
  - Improve error message when image is not found in registry by @imjasonh in #1410
  - Add ability to override the Spiffe socket via environmental variable: by @vaikas in #1421
  - Fix incorrect error check when verifying SCT by @haydentherapper in #1422
  - Skip the ReadWrite test that flakes on Windows. by @dlorenc in #1415
  - Allow PassFunc to be nil by @saschagrunert in #1426
  - Update the cosign keyless documentation to point to the GA release. by @dlorenc in #1427
  - Remove TUF timestamp from OCI signature bundle by @haydentherapper in #1428
  - Add docs on API stability and deprecation table by @priyawadhwa in #1429
  - update cross-build image which adds goimports by @cpanato in #1435
  - feat: enhance clean cmd capability by @developer-guy in #1430
  - use the upstream kubernetes version lib and ldflags by @n3wscott in #1413
  - Improve log lines to match with implementation by @marcofranssen in #1432
  - feat: fig autocomplete feature by @developer-guy in #1360
  - update cross-build to use go 1.17.7 by @cpanato in #1446
  - Fetch verification targets by TUF custom metadata by @haydentherapper in #1423
  - feat: add -buildid= to ldflags by @developer-guy in #1451
  - Streamline SignBlobCmd API with SignCmd by @saschagrunert in #1454
  - convert release cosigned to also generate yaml artifact. by @k4leung4 in #1453
  - Fix tkn link in readme by @Yongxuanzhang in #1459
  - Print message when verifying with old TUF targets by @haydentherapper in #1468
  - fix(sign): refactor unsupported provider log by @Dentrax in #1464
  - tests: /bin/bash -&gt; /usr/bin/env bash by @znewman01 in #1470
  - Double goreleaser timeout by @znewman01 in #1472
  - increase timeout for goreleaser snapshot by @cpanato in #1473
  - fix(sign): kms unspported message by @Dentrax in #1475
  - refactor release cloudbuild job by @cpanato in #1476
  - Fix wording on attach attestation help by @luhring in #1480
  - update go-tuf and simplify TUF client code by @asraa in #1455
  - add initial changelog for 1.5.2 by @cpanato in #1483
  - Fix linter error on main by @priyawadhwa in #1484
  - Update Changelog for Security Advisory by @cpanato in #1485
  - chore(makefile): use kocache, convert publish to build by @developer-guy in #1488
  - Pick up a change to quiet ECR-login logging. by @mattmoor in #1491
  - feat: support other types in copy cmd by @developer-guy in #1493
  - Pick up some of the shared workflows by @mattmoor in #1490
  - feat: nominate Dentrax as codeowner by @developer-guy in #1492
  - add correct layer media type to cosign attach attestation by @spiffcs in #1503
  - This sets up the scaffolding for the cosigned CRD types. by @mattmoor in #1504
  - use v6 api calls in GH action for updating release milestones by @bobcallaway in #1511
  - Add skeleton reconciler for cosigned API CRD. by @mattmoor in #1513
  - bug fix: import ed25519 keys and fix error handling by @asraa in #1518
  - optimize codeql speed by using caching and tracing by @bobcallaway in #1519
  - Add a dummy.go file to allow vendoring config by @jdolitsky in #1520
  - Add CertExtensions func to extract all extensions by @ckotzbauer in #1515
  - chore(ci): add artifact hub support by @Dentrax in #1522
  - Change Fulcio URL default to be fulcio.sigstore.dev by @haydentherapper in #1529
  - Add codecov as github action, set permissions to read content only by @k4leung4 in #1530
  - images: remove --bare flags that conflict with --base-import-paths by @cpanato in #1533
  - Quay OCI Support in README by @sabre1041 in #1539
  - add rpm,deb and apks for cosign packages by @strongjz in #1537
  - Consistent parenthesis use in Makefile by @k4leung4 in #1541
  - add changelog for 1.6.0 by @cpanato in #1535
  - update golang cross image by @cpanato in #1543
  - Add fields in policy CRD by @kkavitha in #1540
  - Disable for now due some issues when downloading the knative module by @cpanato in #1546</changelog>
  <changelog author="meissner@suse.com" date="1650974400">- updated to 1.7.2
  - [Cosigned] Fix publicKey unmarshal by @DennyHoang in #1719
  - fix: add permissions to patch events by @hectorj2f in #1722
  - Make public all types required to use ValidatePolicy by @jdolitsky in #1727
  - Add unit tests for IntotoAttestation verifier. by @vaikas in #1728
  - Remove newline from download sbom output by @ribbybibby in #1732
  - Fix packages name and binary in the packages by @cpanato in #1734
  - Fix fulcioroots test and linter error by @haydentherapper in #1741
  - Support non-ECDSA public keys in certificates by @haydentherapper in #1740
  - bug: remove old fulcio root and fix fallback target code by @asraa in #1738
- updated to 1.7.1
  - pkcs11: fix build instructions by @rgerganov in #1550
  - add definition for artifact hub to verify the ownership by @cpanato in #1563
  - Add example using AWS Key Management Service (KMS) by @davivcgarcia in #1564
  - Start of the necessary pieces to get #1418 and #1419 implemented by @vaikas in #1562
  - Support deletion of ClusterImagePolicy by @vaikas in #1580
  - 1417 policy validations by @kkavitha in #1548
  - Don't lowercase input image refs, just fail by @imjasonh in #1586
  - Fix #1583 #1582. Disallow regex now until implemented. by @vaikas in #1584
  - Fix piping 'cosign verify' using fulcio/rekor by @marcofranssen in #1590
  - Fix #1592 move authorities as siblings of images. by @vaikas in #1593
  - Add ability to inline secrets from SecretRef to configmap. by @vaikas in #1595
  - Fix copy/paste mistake in repo name. by @k4leung4 in #1600
  - Use reusuable release workflow in sigstore/sigstore by @k4leung4 in #1599
  - Add public key validation by @kkavitha in #1598
  - Validate a public key in a secret is valid. by @vaikas in #1602
  - Ensure entry is removed from CM on secret error. by @vaikas in #1605
  - Add two env variables. One for using Rekor public key from OOB and one for fetching it from Rekor server by @vaikas in #1610
  - Init entity from ociremote when signing a digest ref by @puerco in #1616
  - rename ca-key to ca-cert. Fix 1608, 1613 by @vaikas in #1617
  - improve cosigned validation error messages by @cpanato in #1618
  - Use latest knative/pkg's configmap informer by @tcnghia in #1615
  - Included OpenSSF Best Practices Badge by @naveensrinivasan in #1628
  - FUN.md broke when RecordObj changed to HashedRecordObj by @MitchellJThomas in #1633
  - update crane to v0.8.0 release by @cpanato in #1635
  - push latest tag when building a release by @cpanato in #1636
  - Add extra label and change the latest tag to unstable for non tagged releases by @cpanato in #1637
  - Document Elastic container registry support by @mgreau in #1641
  - Validate authority keys by @coyote240 in #1623
  - feat: tree command utility by @developer-guy in #1603
  - fix build date format for version command by @cpanato in #1644
  - Add support for intermediate certificates when verifiying by @haydentherapper in #1631
  - Prompt user before running cosign clean by @priyawadhwa in #1649
  - Use ClusterImagePolicy with Keyless + e2e tests for CIP with kind by @vaikas in #1650
  - KEYLESS.md: Shorten example OAuth URL by @tstromberg in #1661
  - Use syscall.Stdin for input handle. Fixes #1153 by @mdp in #1657
  - Add support for certificate chain to verify certificate by @haydentherapper in #1659
  - First batch of followups to #1650 by @vaikas in #1664
  - Add certificate chain flag for signing by @haydentherapper in #1656
  - [attach]: Add specific suffixes mediaTypes to sboms by @hectorj2f in #1663
  - update font when output the cosign version by @cpanato in #1668
  - feat: add ability to override registry keychain by @noamichael in #1666
  - remove replace directive by @cpanato in #1669
  - Refactor based on discussions in #1650 by @vaikas in #1674
  - Find all valid entries in verify-blob by @priyawadhwa in #1673
  - Fix relative paths in Gitub OIDC blob test by @priyawadhwa in #1677
  - Add support for cert and cert chain flags with PKCS11 tokens by @haydentherapper in #1671
  - Use cosign @ HEAD for Github OIDC sign blob test by @priyawadhwa in #1678
  - Make cosign copy copy metadata attached to child images. by @mattmoor in #1682
  - change file_name_template to PackageName by @strongjz in #1683
  - Update error message for verify/verify attestation by @haydentherapper in #1686
  - cosign clean: Don't log failure if the registry responds with 404 by @imjasonh in #1687
  - verify: add leaf hash verification for tlog entries by @asraa in #1688
  - Fix handling of policy in verify-attestation by @lcarva in #1672
  - Add e2e test for attest / verify-attestation by @vaikas in #1685
  - verify: remove extra calls to rekor for verify and verify-blob by @asraa in #1694
  - Remove the hardcoded sigstore audience by @mattmoor in #1698
  - Use ValidatePubKey from sigstore/sigstore by @haydentherapper in #1676
  - Use the github actions from sigstore/scaffolding. by @vaikas in #1699
  - sign: set the oidc redirect uri by @hectorj2f in #1675
  - add back the go mod proxy by @cpanato in #1701
  - enable 1.23 tests (Test cosigned with ClusterImagePolicy) by @cpanato in #1702
  - Fix incorrect unmarshalling of SCT response by @haydentherapper in #1704
  - Make CLI flag for OIDC client secret take a path by @znewman01 in #1705
  - cosigned: read the public key from the kms authority by @hectorj2f in #1706
  - fix latest tag when running a release job by @cpanato in #1707
  - [Cosigned] Parse and store publicKey data earlier by @DennyHoang in #1681
  - Dont overwrite token set in keyOpts by @puerco in #1709
  - refactor release job by @cpanato in #1710</changelog>
  <changelog author="meissner@suse.com" date="1653134400">- updated to 1.8.0
  - Move the KMS integration imports into the binary entrypoints by @mattmoor in #1744
  - [Cosigned] Convert functions for webhookCIP from v1alpha1 by @DennyHoang in #1736
  - Refactor policy related code, add support for vuln verify by @vaikas in #1747
  - Use bundle log ID to find verification key by @haydentherapper in #1748
  - [cosigned] The webhook name is now configurable via --webhook-name flag by @vpnachev in #1726
  - Add intermediate CA certificate pool for Fulcio by @haydentherapper in #1749
  - test: create fake TUF test root and create test SETs for verification by @asraa in #1750
  - Implement identities, fix bug in webhook validation. by @vaikas in #1759
  - Validate issuer/subject regexp in validate webhook. by @vaikas in #1761
  - chore: add warning when attaching sBOMs by @hectorj2f in #1756
  - Verify embedded SCTs by @haydentherapper in #1731
  - chore: add warning when downloading a sBOM by @hectorj2f in #1763
  - [policy-webhook] The webhooks name is now configurable via --(validating|mutating)-webhook-name flags by @vpnachev in #1757
  - Break the CIP action tests into a sh script. by @vaikas in #1767
  - tuf: add debug info if tuf update fails by @asraa in #1766
  - cosigned: add support for rsa keys by @hectorj2f in #1768
  - Cosigned validate against remote sig src by @DennyHoang in #1754
  - Add Fulcio intermediate CA certificate to intermediate pool by @haydentherapper in #1774
  - fix: more informative error by @ybelMekk in #1778
  - Run update-codegen. by @wlynch in #1789
  - Remove the dependency on v1alpha1.Identity which brings in unnecessary k8s deps. by @vaikas in #1790
  - Refactor fulcio signer to take in KeyOpts. by @wlynch in #1788
  - test: add cue unit tests by @hectorj2f in #1791
  - Attestations + policy in cip. by @vaikas in #1772
  - chore: add rego function to consume modules and evaluate them by @hectorj2f in #1787
  - Add parallelization for processing policies / authorities. by @vaikas in #1795
  - Allow passing keys via environment variables (env:// refs) by @znewman01 in #1794
  - Handle context cancelled properly + tests. by @vaikas in #1796
  - Fix a bug where an error would send duplicate results. by @vaikas in #1797
  - Revert "Refactor fulcio signer to take in KeyOpts. (#1788)" by @wlynch in #1798
  - cosigned: Unify cue data and policy before evaluating it by @hectorj2f in #1793
  - Don't fail open in VerifyBundle by @mtrmac in #1648
  - Load in intermediate cert pool from TUF by @haydentherapper in #1804
  - Support PKCS1 encoded and non-ECDSA CT log public keys by @haydentherapper in #1806</changelog>
  <changelog author="meissner@suse.com" date="1655553600">- updated to 1.9.0
  - Check failure message of policy that fails with issuer mismatch by @vaikas in #1815
  - [Cosigned] Add signature pull secrets by @DennyHoang in #1805
  - feat: add rego policy support by @hectorj2f in #1817
  - Refactor fulcio signer to take in KeyOpts (take 2) by @wlynch in #1818
  - cosigned: Test unsupported KMS providers by @imjasonh in #1820
  - chore(deps): Included dependency review by @naveensrinivasan in #1792
  - Add auth flow option to KeyOpts. by @wlynch in #1827
  - Document Staging instance usage with Keyless by @k4leung4 in #1824
  - New flag --oidc-providers-disable to disable OIDC providers by @puerco in #1832
  - Validate tlog entry when verifying signature via public key. by @wlynch in #1833
  - Add function to explicitly request a certain provider by @priyawadhwa in #1837
  - cosigned: Fix podAntiAffinity labels by @elfotografo007 in #1841
  - remove exclude from go.mod by @cpanato in #1846
  - [Cosigned] Glob matching improvement by @DennyHoang in #1842
  - sget: Enable KMS providers for sget by @imjasonh in #1852
  - Fix piv-tool generate-key command in TOKENS doc by @nealmcb in #1850
  - Add IBM Cloud Container Registry to tested registry list by @bainsy88 in #1856
  - If SBOM ref has .json suffix, assume JSON mediatype by @jdolitsky in #1859
  - Add rekor.0.pub TUF target to unit tests by @priyawadhwa in #1860
  - Normalize certificate flag names by @haydentherapper in #1868
  - Check certificate policy flags with only a certificate by @haydentherapper in #1869
  - Update go to 1.17.10 / cosign image to 1.18.0 and actions setup go by @cpanato in #1861
  - Point git commmit FUN.md to gitsign! by @wlynch in #1874
  - [cosigned] remove regex from the image pattern fields by @hectorj2f in #1873
  - go.mod: format go.mod by @zchee in #1879
  - Remove dependency on deprecated github.com/pkg/errors by @zchee in #1887
  - tree: only report artifacts that are present by @ribbybibby in #1872
  - update README with ebpf modules by @EItanya in #1888
  - Update github.com/google/go-containerregistry/pkg/authn/k8schain module to f1b065c6cb3d by @vpnachev in #1889
  - v1beta1 API for cosigned by @vaikas in #1890
  - tree: support --attachment-tag-prefix by @ribbybibby in #1900
  - [cosigned] Remove undefined apiGroups from policy clusterrole by @vpnachev in #1896
  - GHSA-66x3-6cw3-v5gj: Update go-tuf to v0.3.0 by @janisz in #1894
  - The timeout arg in golangci-lint has been moved to the generic args p… by @dlorenc in #1901
  - [cosigned] Rename cosigned references to policy-controller by @hectorj2f in #1893
  - Move deprecated dependency: google/trillian/merkle to transparency-dev by @cpanato in #1910
  - Add support for "**" in image glob matching by @imjasonh in #1914
  - Add privacy statement for PII storage by @haydentherapper in #1909
  - Do not push to public rekor. by @vaikas in #1931
  - fix: fix fetching updated targets from TUF root by @asraa in #1921
  - fix: fix #1930 for AWS KMS formats by @vaikas in #1946
  - update cross-builder image to use go1.17.11 by @cpanato in #1950
  - remove deprecation from goreleaser, go-fish is not supported anymore by @cpanato in #1952
  - add changelog for v1.9.0 by @cpanato in #1955
  - add parallelism for goreleaser by @cpanato in #1957</changelog>
  <changelog author="meissner@suse.com" date="1658923200">- updated to 1.10.0
  - replace gcr.io/distroless/ to use ghcr.io/distroless/ by @cpanato in #1961
  - Separate RegExp matching of issuer/subject from strict by @vaikas in #1956
  - tuf: improve TUF client concurrency and caching by @asraa in #1953
  - Add Cloudsmith Container Registry to tested registry list by @ciaracarey in #1966
  - feat(fulcioroots): singleton error pattern by @developer-guy in #1965
  - Drop tuf client dependency on GCS client library by @imjasonh in #1967
  - Add spdxjson predicate type for attestations by @jdolitsky in #1974
  - Remove policy-controller now that it lives in sigstore/policy-controller by @vaikas in #1976
  - cleanup: unexport kubernetes.Client method by @imjasonh in #1973
  - cleanup ci job and remove policy-controller references by @cpanato in #1981
  - fix/update post build job by @cpanato in #1983
  - docs: updated Azure kms commands. by @JBrejnholt in #1972
  - Add cyclonedx predicate type for attestations by @jdolitsky in #1977
  - Route deprecated -version to version subcommand by @puerco in #1854
  - docs(readme): add installation steps for container image for cosign binary by @developer-guy in #1986
  - Add --platform flag to cosign sbom download by @puerco in #1975
  - Use pkg/fulcioroots and pkg/tuf from sigstore/sigstore by @imjasonh in #1866
  - Add --oidc-provider flag to specify which provider to use for ambient credentials by @priyawadhwa in #1998
  - encrypt values to create the github action secret by @cpanato in #1990
  - sign-blob: bundle should work independently and respect --output-certificate and --output-signature by @Dentrax in #2016
  - Attempt to clean up pkg/cosign by @imjasonh in #2018
  - public-key: fix command description by @Dentrax in #2024
  - [NFC] specs: fix list formatting on SIGNATURE_SPEC by @woodruffw in #2030
  - feat: cert-extensions verify by @developer-guy in #1626
  - Fix #1378 create new attestation signature in replace mode if not existent by @Syquel in #2014
  - Use cosign.ConfirmPrompt more consistently by @imjasonh in #2039
  - chore: add a note about SIGSTORE_REKOR_PUBLIC_KEY var by @hectorj2f in #2040
  - Fix OIDC test by @cpanato in #2050
  - Add env subcommand. by @wlynch in #2051
  - remove tests with 1.21 k8s cluster because it is deprecated and add v1.23/24 by @cpanato in #2055
  - update ct/otel and etcd by @cpanato in #2054
  - chore(deps): CycloneDX PredicateType changed to use in-toto-golang by @masahiro331 in #2067
  - Remove replace directives in go.mod. by @wlynch in #2070
  - update design doc link by @bobcallaway in #2077
  - Remove hack/tools.go by @imjasonh in #2080
  - fix missing quote by @cpanato in #2090
- removed cosigned and webhook</changelog>
  <changelog author="meissner@suse.com" date="1659700800">- updated to 1.10.1 (jsc#SLE-23879)
  - CVE-2022-35929: Fixed that cosign verify-attestaton --type can
    report a false positive if any attestation exists (GHSA-vjxv-45g9-9296
    (bsc#1202157)
- What else changed:
  - add flag to allow skipping upload to transparency log by @k4leung4 in #2089
  - Improve error message when no sigs/atts are found for an image by @imjasonh in #2101
  - Change Result in Vulnerability Attestation to interface{} by @knqyf263 in #2096
  - Fix field names in the vulnerability attestation by @otms61 in #2099
  - remove style jobs and cleanup makefile gofmt and goimports are running already with golangci-lint by @cpanato in #2105
  - sparkles Enable Scorecard badge by @azeemshaikh38 in #2109
  - Resolves #522 set Created date to time of execution by @Lerentis in #2108
  - Introduce a custom error type to classify errors. by @mattmoor in #2114
  - feat: attach: attestation: allow passing multiple payloads by @Dentrax in #2085
  - update cross-builder to go1.18.5 and cosign image to 1.10.0 by @cpanato in #2119
  - chore: fix documentation and warning on using untrusted rekor key by @asraa in #2124
  - Correct the type used for attest by @mattmoor in #2128</changelog>
  <changelog author="meissner@suse.com" date="1663243200">- updated to 1.12.0 (jsc#SLE-23879)
  - CVE-2022-36056: Fixed verify-blob could successfully verify an artifact when verification should have failed (bsc#1203430)
  - Support non-ECDSA key types for verify-blob by @haydentherapper in #2203
  - feat: integrate Alibaba Cloud Container Registry cred helper by @mozillazg in #2008
  - remove double quotes, looks like it is passing as a single string to cosign and not as an array by @cpanato in #2205
  - Clarify error when KMS provider fails to load by @znewman01 in #2220
  - feat: set annotations to generate additional bash completion information by @dirien in #2221
  - Add deprecation warning for sget CLI and packages by @imjasonh in #2019
  - upgrade setup-ko to point to new repo by @imjasonh in #2225
  - Temp fix for e2e test by @haydentherapper in #2247
  - update kind to use release v0.15.0 and some version comments by @cpanato in #2246
  - Fix e2e test failure, add test for local bundle without rekor bundle by @haydentherapper in #2248
  - fix: fix secret test, non-experimental bundle should pass by @asraa in #2249
- updated to 1.11.1
  - add stale workflow using the workflow template by @cpanato in #2175
  - Update Scorecard action to v2:alpha by @azeemshaikh38 in #2177
  - add release cadence section in the readme by @cpanato in #2179
  - feat: Rework fig autocomplete command by @dirien in #2187
  - fix: fix typo that caused attestation verification failure by @asraa in #2199
- updated to 1.11.0
  - Verify the certificate chain against the Fulcio root trust by default by @wata727 in #2139
  - Add notes to clarify registry use. by @bendory in #2145
  - Use TUF from scaffolding for validating cosign. by @vaikas in #2146
  - docs: clarify wording in spec about usage of certificate chain by @asraa in #2152
  - fix: fix blob verification output with sharded rekor tlogs by @asraa in #2157
  - fix: adds envelope hash to in-toto entries in tlog entry creation by @nkreiger in #2118
  - fix handling of verify-attestation types for URIs by @otms61 in #2159
  - fix oidc post-merge job by @cpanato in #2164
  - Remove third_party by @imjasonh in #2166
  - use updated device flow logic with PKCE by @bobcallaway in #2163
  - fix: rekor get tlog entry with uuid by @asraa in #2058
  - update e2e job to run only when push to main by @cpanato in #2169
  - fix: add env cmd to root by @developer-guy in #2171
  - fix panic when os.Stat returns an error besides ErrNotExists by @dsa0x in #2162</changelog>
  <changelog author="dmueller@suse.com" date="1664280000">- update to 1.12.1:
  * fix: Pulls Fulcio root and intermediate when --certificate-chain is not
    passed into verify-blob command. The v1.12.0 release introduced a
    regression: when COSIGN_EXPERIMENTAL was not set, cosign verify-blob would
    check a --certificate (without a --certificate-chain provided) against the
    operating system root CA bundle. In this release, Cosign checks the
    certificate against Fulcio's CA root instead (restoring the earlier
    behavior).
  * fix: fix cert chain validation for verify-blob in non-experimental mode
  * fix: add COSIGN_EXPERIMENTAL=1 for verify-bloba
  * Fix BYO-root with intermediate to fetch intermediates from annotation
  * fix: fixing breaking changes in rekor v1.12.0 upgrade
- use go-modules service to generate the vendor.tar and use zstd</changelog>
  <changelog author="meissner@suse.com" date="1666094400">- update to 1.13.1:
  * verify-blob-attestation: allow multiple subjects in in_toto attestation (#2341)
  * Nits for #2337 (#2342)
  * Add verify-blob-attestation command and tests (#2337)
  * Update warning when users sign images by tag. (#2313)
  * Remove experimental flags from attest-blob and refactor (#2338)
  * Add --output-attestation flag to attest-blob and remove experimental signing (#2332)
  * Add attest-blob command (#2286)
  * Add '--cert-identity' flag to support subject alternate names for ver… (#2278)
  * Update Dockerfile section of README (#2323)
  * Fix option description: "sign" --&gt; "verify" (#2306)
- update to 1.13.0:
  * feat: use stdin as an input for predicate by @developer-guy in https://github.com/sigstore/cosign/pull/2269
  * feat: improve the verification message by @developer-guy in https://github.com/sigstore/cosign/pull/2268
  * use scaffolding 0.4.8 for tests. by @vaikas in https://github.com/sigstore/cosign/pull/2280
  * fix pivtool generate key touch policy by @cpanato in https://github.com/sigstore/cosign/pull/2282
  * Check error on chain verification failure by @haydentherapper in https://github.com/sigstore/cosign/pull/2284
  * Fix: Remove an extra registry request from verification path. by @mattmoor in https://github.com/sigstore/cosign/pull/2285
  * Fix: Create a static copy of signatures as part of verification. by @mattmoor in https://github.com/sigstore/cosign/pull/2287
  * Data race in FetchSignaturesForReference by @RTann in https://github.com/sigstore/cosign/pull/2283
  * Add support for Fulcio username identity in SAN by @haydentherapper in https://github.com/sigstore/cosign/pull/2291
  * fix: make tlog entry lookups for online verification shard-aware by @asraa in https://github.com/sigstore/cosign/pull/2297
  * Better help text to sign and verify SBOM by @ChristianCiach in https://github.com/sigstore/cosign/pull/2308
  * Adding warning to pin to digest by @ChaosInTheCRD in https://github.com/sigstore/cosign/pull/2311
  * Add annotations for upload blob. by @cldmnky in https://github.com/sigstore/cosign/pull/2188
  * replace deprecate package by @cpanato in https://github.com/sigstore/cosign/pull/2314
  * update release images to use go1.19.2 and cosign v1.12.1 by @cpanato in https://github.com/sigstore/cosign/pull/2315</changelog>
  <changelog author="meissner@suse.com" date="1677499200">- update to 2.0.0 (jsc#SLE-23879)
  Breaking Changes:
  * insecure-skip-tlog-verify: rename and adapt the cert expiration check (#2620)
  * Deprecate --certificate-email flag. Make --certificate-identity and -… (#2411)
  Enhancements:
  * Change go module name to github.com/sigstore/cosign/v2 for Cosign 2.0 (#2544)
  * Allow users to pass in a path for the --identity-token flag (#2538)
  * Breaking change: Respect tlog-upload=false, default to true (#2505)
  * Support outputing a certificate without uploading to the tlog (#2506)
  * Attestation/Blob signing and verification using a RFC3161 time-stamping server (#2464)
  * respect tlog-upload flag with TSA (#2474)
  * Better feedback if specifying incompatible argument on cosign sign --attachment (#2449)
  * Support TSA and Rekor verifications (#2463)
  * add support for tsa signing and verification of images (#2460)
  * cosign policy sign: remove experimental flag and make keyless signing default (#2459)
  * Remove experimental mode from cosign attest and verify-attestation (#2458)
  * Remove experimental mode from sign-blob and verify-blob (#2457)
  * Add --offline flag to force offline verification (#2427)
  * Air gap support (#2299)
  * Breaking change: Change SCT verification behavior to default to enforcement (#2400)
  * Breaking change: remove --force flag from sign and attest and rely on --yes flag to skip confirmation (#2399)
  * Breaking change: replace --no-tlog-upload flag with --tlog-upload flag (#2397)
  * Remove experimental flag from cosign sign and cosign verify (#2387)
  * verify: remove SIGSTORE_TRUST_REKOR_API_PUBLIC_KEY test env var for using a key from rekor's API (#2362)
  * Add warning to use digest instead of tags to other cosign commands (#2650)
  * Fix up UI messages (#2629)
  * Remove hardcoded Fulcio from output (#2621)
  * Fix missing privacy statement, print in multiple locations (#2622)
  * feat: allows custom key names for import-key-pair (#2587)
  * feat: support keyless verification for verify-blob-attestation (#2525)
  * attest-blob: add functionality for keyless signing (#2515)
  * Rego: add support for custom error/warning messages when evaluating rego rules (#2577)
  * feat: add debug information to cert validation error (#2579)
  * Support non-Sigstore TSA requests (#2708)
  * Add COSIGN_OCI_EXPERIMENTAL, push .sig/.sbom using OCI 1.1+ digest tag (#2684)
  * Output certificate in bundle when entry is not uploaded to Rekor (#2715)
  * attach signature and attach sbom must use STDIN to upload raw string (#2637)
  * add generate-key-pair GitHub Enterprise server support (#2676)
  * add in format string for warning (#2699)
  * Support for fetching Fulcio certs with self-managed key (#2532)
  * 2476 predicate type download (#2484)
  Bug Fixes:
  * Fix the file existence check. (#2552)
  * Fix timestamp verification, add verify-blob tests (#2527)
  * Fix(verify): Consolidate certificate expiry logic (#2504)
  * Updates to Timestamp signing and verification (#2499)
  * Fix: removes attestation payload from attest-blob's output &amp; no base64 encoding (#2498)
  * Fix path for e2e-tests badge (#2490)
  * Fix spdx json media type (#2479)
  * Fix sct verificaction (#2426)
  * Fix: panic with unsigned local image (#2656)
  * Make sure a cert passed in via --cert matches the bundle cert (#2652)
  * Fix: fix github oidc post submit test (#2594)
  * Fix: add enhanced error messages for failing verification with TUF targets (#2589)
  * Fix: Add missing schemes to cosign predicate types. (#2717)
  * Fix: Drop the CosignPredicate wrapper around SBOM attestations. (#2718)
  * Fix prompts with Windows line endings (#2674)</changelog>
  <changelog author="dmueller@suse.com" date="1680609600">- fix buildtags
- build against a maintained golang version (upstream uses go1.20)</changelog>
  <changelog author="meissner@suse.com" date="1681732800">- update to 2.0.1 (jsc#SLE-23879)
  Enhancements
  - Add environment variable token provider (#2864)
  - Remove cosign policy command (#2846)
  - Allow customising 'go' executable with GOEXE var (#2841)
  - Consistent tlog warnings during verification (#2840)
  - Add riscv64 arch (#2821)
  - Default generated PEM labels to SIGSTORE (#2735)
  - Update privacy statement and confirmation (#2797)
  - Add exit codes for verify errors (#2766)
  - Add Buildkite provider (#2779)
  - verify-blob-attestation: Loosen arg requirements if --check-claims=false (#2746)
  Bug Fixes
  - PKCS11 sessions are now opened read only (#2853)
  - Makefile: date format of log should not show signatures (#2835)
  - Add missing flags to cosign verify dockerfile/manifest (#2830)
  - Add a warning to remember how to configure a custom Gitlab host (#2816)
  - Remove tag warning message from save/copy commands (#2799)
  - Mark keyless pem files with b64 (#2671)</changelog>
  <changelog author="meissner@suse.com" date="1683460800">- update to 2.0.2 (jsc#SLE-23879)
  Enhancements
  - Update sigstore/sigstore to v1.6.2 to pick up TUF CDN change (#2891)
  - feat: Make cosign copy faster (#2901)
  - remove sget (#2885)
  - Require a payload to be provided with a signature (#2785)
  Bug Fixes
  - cmd: Change error message from KeyParseError to PubKeyParseError for verify-blob. (#2876)
  - Use SOURCE_DATE_EPOCH for OCI CreatedAt times (#2878)
  Documentation
  - Remove experimental warning from Fulcio flags (#2923)
  - add missing oidc provider (#2922)
  - Add zot as a supported registry (#2920)
  - deprecates kms_support docs (#2900)
  - chore(docs) deprecate note for usage docs (#2906)
  - adds note of deprecation for examples.md docs (#2899)</changelog>
  <changelog author="meissner@suse.com" date="1687867200">- updated to 2.1.1 (jsc#SLE-23879)
  - Bug Fixes
  - wait for the workers become available again to continue the execution (#3084)
  - fix help text when in a container (#3082)
- updated to 2.1.0 (jsc#SLE-23879)
  - Breaking Change: The predicate is now a required flag in the attest commands, set via the --type flag.
  - Enhancements
  - Verify sigs and attestations in parallel (#3066)
  - Deep inspect attestations when filtering download (#3031)
  - refactor bundle validation code, add support for DSSE rekor type (#3016)
  - Allow overriding remote options (#3049)
  - feat: adds no cert found on sig exit code (#3038)
  - Make predicate a required flag in attest commands (#3033)
  - Added support for attaching Time stamp authority Response in attach command (#3001)
  - Add sign --sign-container-identity CLI (#2984)
  - Feature: Allow cosign to sign digests before they are uploaded. (#2959)
  - accepts attachment-tag-prefix for cosign copy (#3014)
  - Feature: adds '--allow-insecure-registry' for cosign load (#3000)
  - download attestation: support --platform flag (#2980)
  - Cleanup: Add Digest to the SignedEntity interface. (#2960)
  - verify command: support keyless verification using only a provided certificate chain with non-fulcio roots (#2845)
  - verify: use workers to limit the paralellism when verifying images with --max-workers flag (#3069)
  - Bug Fixes
  - Fix pkg/cosign/errors (#3050)
  - Fix: update doc to refer to github-actions oidc provider (#3040)
  - Fix: prefer GitHub OIDC provider if enabled (#3044)
  - Fix --sig-only in cosign copy (#3074)
  - Documentation
  - Fix links to sigstore/docs in markdown files (#3064)</changelog>
  <changelog author="meissner@suse.com" date="1693569600">- updated to 2.2.0 (jsc#SLE-23879)
  - Enhancements
  * switch to uploading DSSE types to rekor instead of intoto (#3113)
  * add 'cosign sign' command-line parameters for mTLS (#3052)
  * improve error messages around bundle != payload hash (#3146)
  * make VerifyImageAttestation function public (#3156)
  * Switch to cryptoutils function for SANS (#3185)
  * Handle HTTP_1_1_REQUIRED errors in github provider (#3172)
  - Bug Fixes
  * Fix nondeterminsitic timestamps (#3121)
  - Documentation
  * doc: Add example of sign-blob with key in env var (#3152)
  * add deprecation notice for cosign-releases GCS bucket (#3148)
  * update doc links (#3186)</changelog>
  <changelog author="meissner@suse.com" date="1699358400">- updated to 2.2.1 (jsc#SLE-23879)
  This release comes with a fix for
  CVE-2023-46737 / bsc#1216933 described in this [Github Security
  Advisory](https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9).
  Enhancements:
  * feat: Support basic auth and bearer auth login to registry (#3310)
  * add support for ignoring certificates with pkcs11 (#3334)
  * Support ReplaceOp in Signatures (#3315)
  * feat: added ability to get image digest back via triangulate (#3255)
  * feat: add `--only` flag in `cosign copy` to copy sign, att &amp; sbom (#3247)
  * feat: add support attaching a Rekor bundle to a container (#3246)
  * feat: add support outputting rekor response on signing (#3248)
  * feat: improve dockerfile verify subcommand (#3264)
  * Add guard flag for experimental OCI 1.1 verify. (#3272)
  * Deprecate SBOM attachments (#3256)
  * feat: dedent line in cosign copy doc (#3244)
  * feat: add platform flag to cosign copy command (#3234)
  * Add SLSA 1.0 attestation support to cosign. Closes #2860 (#3219)
  * attest: pass OCI remote opts to att resolver. (#3225)
  Bug Fixes:
  * Merge pull request from GHSA-vfp6-jrw2-99g9
  * fix: allow cosign download sbom when image is absent (#3245)
  * ci: add a OCI registry test for referrers support (#3253)
  * Fix ReplaceSignatures (#3292)
  * Stop using deprecated in_toto.ProvenanceStatement (#3243)
  * Fixes #3236, disable SCT checking for a cosign verification when usin… (#3237)
  * fix: update error in `SignedEntity` to be more descriptive (#3233)
  * Fail timestamp verification if no root is provided (#3224)
  Documentation:
  * Add some docs about verifying in an air-gapped environment (#3321)
  * Update CONTRIBUTING.md (#3268)
  * docs: improves the Contribution guidelines (#3257)
  * Remove security policy (#3230)
  Others:
  * Set go to min 1.21 and update dependencies  (#3327)
  * Update contact for code of conduct (#3266)
  * Update .ko.yaml (#3240)</changelog>
  <changelog author="marcos.bjoerkelund@suse.com" date="1702382400">- updated to 2.2.2 (jsc#SLE-23879)
  v2.2.2 adds a new container with a shell,
  gcr.io/projectsigstore/cosign:vx.y.z-dev, in addition to the existing
  container gcr.io/projectsigstore/cosign:vx.y.z without a shell.
  For private deployments, we have also added an alias for
  - -insecure-skip-log, --private-infrastructure.
  Bug Fixes:
  * chore(deps): bump github.com/sigstore/sigstore from 1.7.5 to 1.7.6 (#3411) which fixes a bug with using Azure KMS
  * Don't require CT log keys if using a key/sk (#3415)
  * Fix copy without any flag set (#3409)
  * Update cosign generate cmd to not include newline (#3393)
  * Fix idempotency error with signing (#3371)
  Features:
  * Add --yes flag cosign import-key-pair to skip the overwrite confirmation. (#3383)
  * Use the timeout flag value in verify* commands. (#3391)
  * add --private-infrastructure flag (#3369)
  Container Updates:
  * Bump builder image to use go1.21.4 and add new cosign image tags with shell (#3373)
  Documentation:
  * Update SBOM_SPEC.md (#3358)</changelog>
  <changelog author="meissner@suse.com" date="1706875200">- updated to 2.2.3 (jsc#SLE-23879)
  Bug Fixes:
  * Fix race condition on verification with multiple signatures attached to image (#3486)
  * fix(clean): Fix clean cmd for private registries (#3446)
  * Fixed BYO PKI verification (#3427)
  Features:
  * Allow for option in cosign attest and attest-blob to upload attestation as supported in Rekor (#3466)
  * Add support for OpenVEX predicate type (#3405)
  Documentation:
  * Resolves #3088: `version` sub-command expected behaviour documentation and testing (#3447)
  * add examples for cosign attach signature cmd (#3468)
  Misc:
  * Remove CertSubject function (#3467)
  * Use local rekor and fulcio instances in e2e tests (#3478)
- bumped embedded golang.org/x/crypto/ssh to fix the Terrapin attack CVE-2023-48795 (bsc#1218207)</changelog>
  <changelog author="meissner@suse.com" date="1713182400">- updated to 2.2.4 (jsc#SLE-23879)
  * Bug Fixes
  * Fixes for GHSA-88jx-383q-w4qc and GHSA-95pr-fxf5-86gv (#3661)
  - CVE-2024-29902: Malicious attachments can cause system-wide denial of service (bsc#1222835)
  - CVE-2024-29903: Malicious artifects can cause machine-wide denial of service (bsc#1222837)
  * ErrNoSignaturesFound should be used when there is no signature attached to an image. (#3526)
  * fix semgrep issues for dgryski.semgrep-go ruleset (#3541)
  * Honor creation timestamp for signatures again (#3549)
  * Features
  * Adds Support for Fulcio Client Credentials Flow, and Argument to Set Flow Explicitly (#3578)
  * Documentation
  * add oci bundle spec (#3622)
  * Correct help text of triangulate cmd (#3551)
  * Correct help text of verify-attestation policy argument (#3527)
  * feat: add OVHcloud MPR registry tested with cosign (#3639)</changelog>
</package>
<package pkgid="520fca36804cbd45e3e38fca641b2ffbba49cacaded4b11ac88367979776d2c1" name="cpp13" arch="aarch64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="35728c311cd95db4cb670f52cb57d8f9f974a231c1c3ec852d97e397be81ba03" name="cpp13" arch="ppc64le">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="e7c117a6eab0f0e63553b5368e73037d7e1288ac7f2bbfc528f2fe33f3fa0362" name="cpp13" arch="s390x">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="23793fc326af26bead6ea07fa005e15e4c7763987b1eecdbfc0e36f35119b30f" name="cpp13" arch="x86_64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="673584b11bd550de0ca5e4967828c968881d74a820f83e12876098733a7a2735" name="crmsh" arch="noarch">
  <version epoch="0" ver="4.6.0+20240617.88b0c50" rel="150600.3.3.2"/>
  <changelog author="nicholas.yang@suse.com" date="1674475200">- Update to version 4.4.1+20230117.fb8b3c2b:
  * Dev: healthcheck: allow using non-root sudoer for remote access (jsc#PED-290)
  * Dev: bootstrap: implement swapping hacluster's ssh key using non-root sudoer remote access (jsc#PED-290)
  * Dev: utils: Check current user's privilege and give hints to user (jsc#PED-290)
  * Feature: replace root by a custom user with root privileges (jsc#PED-290)</changelog>
  <changelog author="XLiang@suse.com" date="1676635200">- Update to version 4.4.1+20230217.7fe11a5c:
  * Dev: report: Enable crm report for sudoer user
  * Dev: bootstrap: allow the cluster to operate with ssh session under non-root sudoer (jsc#PED-290)
  * Dev: utils: Add sudo for the commands in user hints
  * Fix: hawk fails to parse the slash (bsc#1206217)
  * Fix: extra logs while configuring passwordless (bsc#1207720)</changelog>
  <changelog author="XLiang@suse.com" date="1677240000">- Update to version 4.4.1+20230224.498677ab:
  * Dev: upgradeutil: do upgrade silently (bsc#1208327, bsc#1206183)
  * Fix: bootstrap: `crm cluster join ssh` raises TypeError (bsc#1208327)
  * Dev: utils: Change the way to get pacemaker's version (bsc#1208216)</changelog>
  <changelog author="XLiang@suse.com" date="1677844800">- Update to version 4.4.1+20230302.2b5310b9:
  * Fix: qdevice: Unable to setup qdevice under non-root user (bsc#1208770)</changelog>
  <changelog author="XLiang@suse.com" date="1678449600">- Update to version 4.5.0+20230309.a4c4192d:
  * Dev: version: Bump crmsh version to 4.5.0
  * Fix: report: Fix crm report issue under non-root user
  * Fix: log: Redirect debug messages into stderr (bsc#1208991)</changelog>
  <changelog author="XLiang@suse.com" date="1680177600">- Update to version 4.5.0+20230329.6d95249b:
  * Fix: utils: qdevice initialization should user_pair_for_ssh() to get appreciated users
  * Fix: crm report: sustain if there are offline nodes (bsc#1209480)
  * Fix: validate ssh session when the users is determined by guessing (bsc#1209193)
  * Fix: parallax: Use 'sudo bash -c' when executing commands via sudoer (bsc#1209192)</changelog>
  <changelog author="XLiang@suse.com" date="1682683200">- Update to version 4.5.0+20230427.11d11104:
  * Fix: bootstrap: crm cluster join default behavior change in ssh key handling (bsc#1210693)
  * Fix: help: Long time to load and parse crm.8.adoc (bsc#1210198)
  * Fix: cibconfig: use any existing rsc_defaults set rather than create another one (bsc#1210614)
  * Fix: lock: Join node failed to wait init node finished (bsc#1210332)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1683806400">- Update to version 4.5.0+20230510.847a251:
  * Fix: bootstrap: `init --qnetd-hostname` fails when username is not specified (bsc#1211200)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1688731200">- Update to version 4.5.0+20230705.ea8c76f:
  * Fix: ui_context: wait4dc should assume a subcommand completes successfully if no exceptions are raised (bsc#1212992)
  * Fix: upgradeutil: do not tried to upgrade when the cluster is partially set up (bsc#1211817)
  * Fix: bootstrap: fix the validation of option -N and -c (bsc#1212436)
  * Fix: geo_cluster: the behavior of choosing a default user in geo_join/geo_init_arbitrator is different with `cluster join` (bsc#1211817)
  * Fix: utils: do not use sudoer user to create ssh session unless it is specified explicitly (bsc#1211817)
  * medium: ui_node: fix cib rollback race on node standby
  * Dev: ui_cluster: Use 'CustomAppendAction' instead of 'append' argparse action
  * Dev: bootstrap: Configure ssh key when fetch geo config (bsc#1210709)
  * Dev: cmd_status: Use --output-as option instead of deprecated --as-html and --as-xml options
  * Dev: cmd_status: Append 'with quorum' and 'WITHOUT quorum' to display keyword list
  * Fix: bootstrap: failed to save username for localhost when initializing a cluster with a qnet server
  * Fix: utils: fix `cluster diff --checksum` (bsc#1210709)
  * Dev: geo: implement non-root support for geo_fetch_config() (bsc#1210709)
  * Fix: bootstrap: failed to join when the cluster is initialized with skip_csync2 (bsc#1210709)
  * Dev: prun: implement timeout (bsc#1210709)
  * Dev: prun: add an concurrency limiter (bsc#1210709)
  * Dev: scripts: implement non-root support with crmsh.prun (bsc#1210709)
  * Dev: implement non-root support for crm_pssh with crmsh.prun (bsc#1210709)
  * Dev: refine non-root sudoer support for crmsh.parallax (bsc#1210709)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1690545600">- Update to version 4.5.0+20230725.5d35bb6:
  * Fix: upgradeutil: support the change of path of upgrade_seq in crmsh-4.5 (bsc#1213050)</changelog>
  <changelog author="XLiang@suse.com" date="1691496000">- Update to version 4.5.0+20230809.ddb17a0b:
  * Fix: userdir: Get the effictive user name instead of using getpass.getuser (bsc#1213821)
  * Dev: requirements: remove parallax</changelog>
  <changelog author="XLiang@suse.com" date="1697025600">- Update to version 4.5.0+20231010.65aa0a09:
  * Fix: report: Pick up tarball suffix dynamically (bsc#1215438)
  * Fix: report: Pick 'gzip' as the first compress prog for cross-platform compatibility(bsc#1215438)
  * Fix: constants: Add several resource meta attributes (bsc#1215319)
  * Fix: upgradeutil: reduce the timeout for getting sequence from remote node (bsc#1213797)
  * Dev: corosync: Enable logging.to_logfile</changelog>
  <changelog author="nicholas.yang@suse.com" date="1700827200">- Update to version 4.6.0+20231123.50296e9:
  * Fix: sh: raise AuthorizationError and generate diagnose messages when ClusterShell fails with 255
  * Dev: bootstrap: allow to authenticate interactively in `crm cluster join --use-ssh-agent`
  * Dev: ssh-agent: add informative logging for adding keys to authorized_keys
  * Dev: ssh-agent: add diagnose messages
  * Dev: bootstrap: implement ssh-agent support for geo cluster (jsc#PED-5774)
  * Dev: bootstrap: refine key swap for user `hacluster`
  * Dev: bootstrap: implement ssh-agent support for qdevice (jsc#PED-5774)
  * Dev: bootstrap: implement ssh-agent support (jsc#PED-5774)
  * Dev: cmd_status: Show error correctly for crm status
  * Dev: ui_utils: Supports '=' when setting node/resource attributes
  * Fix: report: Pick up tarball suffix dynamically (bsc#1215438)
  * Fix: report: Pick 'gzip' as the first compress prog for cross-platform compatibility(bsc#1215438)
  * Fix: constants: Add several resource meta attributes (bsc#1215319)
  * Dev: spec: Remove %generate_buildrequires to prevent OBS build failures on SLE15SP5 and Leap15.5
  * Dev: refactor shell calling routines</changelog>
  <changelog author="XLiang@suse.com" date="1701950400">- Update to version 4.6.0+20231206.a903b854:
  * To polish and improve crm report along with PED-5774 (jsc#PED-5774)
  * Fix: bootstrap: fix the owner and permission of file authorized_keys (bsc#1217279)
  * Fix: prun: should not call user_pair_for_ssh() when target host is localhost (bsc#1217094)
  * Fix: utils: Add 'sudo' only when there is a sudoer(bsc#1215549)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1703160000">- Update to version 4.6.0+20231215.4b06740f:
  * Dev: ui_cluster: Move --use-ssh-agent to optional arguments
  * Fix: ui_cluster: Improve the process of 'crm cluster stop' (bsc#1213889)
  * Dev: log: save backtrace of ValueError in logfile and suppress it in console (bsc#1217924)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1704196800">- Update to version 4.6.0+20231228.83bf1514:
  * Dev: ui_corosync: Add a completer for corosync.set to enumerate all current paths
  * Dev: bootstrap: Assign hosts with _context.node_list_in_cluster in join_ssh_merge (bsc#1218331)</changelog>
  <changelog author="XLiang@suse.com" date="1708603200">- Update to version 4.6.0+20240221.58aa13d1:
  * Fix: ui_node: clearstate command needs adjustment (bsc#1219831)
  * Fix: bootstrap: fail to join a cluster with hostname alias
  * Fix: bootstrap: clear stall data about ssh users left possiblely from previous setups (bsc#1219476, bsc#1219535)
  * Fix: report: Escape special characters in pattern (bsc#1220022)
  * Fix: ui_cluster: Can't start cluster with --all option if no cib (bsc#1219052)
  * Fix: bootstrap: ssh key of the init node is duplicated in the authorized_keys files of other node (bsc#1218940)
  * Fix: sh: guide users to setup key-based ssh authentication when non-interactive authentcation fails (bsc#1219045)
  * Fix: report: Unable to gather log files that are in the syslog format (bsc#1218491)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1709553600">- Update to version 4.6.0+20240227.21cbb9ee:
  * Fix: add diagnostic messages when crm report cannot find ssh-agent (bsc#1219538)
  * Fix: crm report hangs in the root passwordless with ssh-agent (bsc#1220170)
  * Fix: report: use ClusterShell for ssh (bsc#1220170)</changelog>
  <changelog author="XLiang@suse.com" date="1713960000">- Update to version 4.6.0+20240422.73eaf02a:
  * Fix: bootstrap: Detect cluster service on init node before saving the canonical hostname (bsc#1222714)
  * Dev: report: Collect quorum/qdevice/qnetd status
  * Fix: utils: set env `CIB_shadow` using `os.environ` (bsc#1205925)
  * Fix: pass env to child process explicitly (bsc#1205925)
  * Fix: term: unset env `COLUMNS` and `ROWS` (bsc#1205925)
  * Fix: sh: pass env to child process explicitly (bsc#1205925)
  * Fix: bootstrap: Remove unused -i option when calling csync2_remote and ssh_remote stage (bsc#1212080)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1718625600">- Update to version 4.6.0+20240617.88b0c50:
  * Fix: upgradeutil: refine error handling (bsc#1226147, bsc#1223371)
  * Dev: ui_resource: Improve completers for 'crm resource' command
  * Fix: cmd_status: call crm_mon without shell (#1429)
  * Dev: log an error when fencing node without stonith device configured and running
  * Fix: healthcheck: KeyError when local nodename not found in cib (bsc#1223438)
  * Dev: utils: Add info when property is newly added
  * Dev: corosync: Show corosync cpg status in `crm corosync status cpg`
  * Dev: ui_context: ignore requirements when option --help is specified
  * Dev: ui_context: Skip querying CIB when in a sublevel or help command
  * Dev: bootstrap: Setup the stage dependency on init and join side (bsc#1175865, bsc#1219940)
  * Dev: bootstrap: Enhance stage validation
  * Dev: bash_completion: Enable complete 'id=' on non-interactive mode</changelog>
</package>
<package pkgid="73e18f238bb78690a5b897fec58a7d4d44d83e5f50db9d121749029d574fe350" name="crmsh" arch="src">
  <version epoch="0" ver="4.6.0+20240617.88b0c50" rel="150600.3.3.2"/>
  <changelog author="nicholas.yang@suse.com" date="1674475200">- Update to version 4.4.1+20230117.fb8b3c2b:
  * Dev: healthcheck: allow using non-root sudoer for remote access (jsc#PED-290)
  * Dev: bootstrap: implement swapping hacluster's ssh key using non-root sudoer remote access (jsc#PED-290)
  * Dev: utils: Check current user's privilege and give hints to user (jsc#PED-290)
  * Feature: replace root by a custom user with root privileges (jsc#PED-290)</changelog>
  <changelog author="XLiang@suse.com" date="1676635200">- Update to version 4.4.1+20230217.7fe11a5c:
  * Dev: report: Enable crm report for sudoer user
  * Dev: bootstrap: allow the cluster to operate with ssh session under non-root sudoer (jsc#PED-290)
  * Dev: utils: Add sudo for the commands in user hints
  * Fix: hawk fails to parse the slash (bsc#1206217)
  * Fix: extra logs while configuring passwordless (bsc#1207720)</changelog>
  <changelog author="XLiang@suse.com" date="1677240000">- Update to version 4.4.1+20230224.498677ab:
  * Dev: upgradeutil: do upgrade silently (bsc#1208327, bsc#1206183)
  * Fix: bootstrap: `crm cluster join ssh` raises TypeError (bsc#1208327)
  * Dev: utils: Change the way to get pacemaker's version (bsc#1208216)</changelog>
  <changelog author="XLiang@suse.com" date="1677844800">- Update to version 4.4.1+20230302.2b5310b9:
  * Fix: qdevice: Unable to setup qdevice under non-root user (bsc#1208770)</changelog>
  <changelog author="XLiang@suse.com" date="1678449600">- Update to version 4.5.0+20230309.a4c4192d:
  * Dev: version: Bump crmsh version to 4.5.0
  * Fix: report: Fix crm report issue under non-root user
  * Fix: log: Redirect debug messages into stderr (bsc#1208991)</changelog>
  <changelog author="XLiang@suse.com" date="1680177600">- Update to version 4.5.0+20230329.6d95249b:
  * Fix: utils: qdevice initialization should user_pair_for_ssh() to get appreciated users
  * Fix: crm report: sustain if there are offline nodes (bsc#1209480)
  * Fix: validate ssh session when the users is determined by guessing (bsc#1209193)
  * Fix: parallax: Use 'sudo bash -c' when executing commands via sudoer (bsc#1209192)</changelog>
  <changelog author="XLiang@suse.com" date="1682683200">- Update to version 4.5.0+20230427.11d11104:
  * Fix: bootstrap: crm cluster join default behavior change in ssh key handling (bsc#1210693)
  * Fix: help: Long time to load and parse crm.8.adoc (bsc#1210198)
  * Fix: cibconfig: use any existing rsc_defaults set rather than create another one (bsc#1210614)
  * Fix: lock: Join node failed to wait init node finished (bsc#1210332)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1683806400">- Update to version 4.5.0+20230510.847a251:
  * Fix: bootstrap: `init --qnetd-hostname` fails when username is not specified (bsc#1211200)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1688731200">- Update to version 4.5.0+20230705.ea8c76f:
  * Fix: ui_context: wait4dc should assume a subcommand completes successfully if no exceptions are raised (bsc#1212992)
  * Fix: upgradeutil: do not tried to upgrade when the cluster is partially set up (bsc#1211817)
  * Fix: bootstrap: fix the validation of option -N and -c (bsc#1212436)
  * Fix: geo_cluster: the behavior of choosing a default user in geo_join/geo_init_arbitrator is different with `cluster join` (bsc#1211817)
  * Fix: utils: do not use sudoer user to create ssh session unless it is specified explicitly (bsc#1211817)
  * medium: ui_node: fix cib rollback race on node standby
  * Dev: ui_cluster: Use 'CustomAppendAction' instead of 'append' argparse action
  * Dev: bootstrap: Configure ssh key when fetch geo config (bsc#1210709)
  * Dev: cmd_status: Use --output-as option instead of deprecated --as-html and --as-xml options
  * Dev: cmd_status: Append 'with quorum' and 'WITHOUT quorum' to display keyword list
  * Fix: bootstrap: failed to save username for localhost when initializing a cluster with a qnet server
  * Fix: utils: fix `cluster diff --checksum` (bsc#1210709)
  * Dev: geo: implement non-root support for geo_fetch_config() (bsc#1210709)
  * Fix: bootstrap: failed to join when the cluster is initialized with skip_csync2 (bsc#1210709)
  * Dev: prun: implement timeout (bsc#1210709)
  * Dev: prun: add an concurrency limiter (bsc#1210709)
  * Dev: scripts: implement non-root support with crmsh.prun (bsc#1210709)
  * Dev: implement non-root support for crm_pssh with crmsh.prun (bsc#1210709)
  * Dev: refine non-root sudoer support for crmsh.parallax (bsc#1210709)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1690545600">- Update to version 4.5.0+20230725.5d35bb6:
  * Fix: upgradeutil: support the change of path of upgrade_seq in crmsh-4.5 (bsc#1213050)</changelog>
  <changelog author="XLiang@suse.com" date="1691496000">- Update to version 4.5.0+20230809.ddb17a0b:
  * Fix: userdir: Get the effictive user name instead of using getpass.getuser (bsc#1213821)
  * Dev: requirements: remove parallax</changelog>
  <changelog author="XLiang@suse.com" date="1697025600">- Update to version 4.5.0+20231010.65aa0a09:
  * Fix: report: Pick up tarball suffix dynamically (bsc#1215438)
  * Fix: report: Pick 'gzip' as the first compress prog for cross-platform compatibility(bsc#1215438)
  * Fix: constants: Add several resource meta attributes (bsc#1215319)
  * Fix: upgradeutil: reduce the timeout for getting sequence from remote node (bsc#1213797)
  * Dev: corosync: Enable logging.to_logfile</changelog>
  <changelog author="nicholas.yang@suse.com" date="1700827200">- Update to version 4.6.0+20231123.50296e9:
  * Fix: sh: raise AuthorizationError and generate diagnose messages when ClusterShell fails with 255
  * Dev: bootstrap: allow to authenticate interactively in `crm cluster join --use-ssh-agent`
  * Dev: ssh-agent: add informative logging for adding keys to authorized_keys
  * Dev: ssh-agent: add diagnose messages
  * Dev: bootstrap: implement ssh-agent support for geo cluster (jsc#PED-5774)
  * Dev: bootstrap: refine key swap for user `hacluster`
  * Dev: bootstrap: implement ssh-agent support for qdevice (jsc#PED-5774)
  * Dev: bootstrap: implement ssh-agent support (jsc#PED-5774)
  * Dev: cmd_status: Show error correctly for crm status
  * Dev: ui_utils: Supports '=' when setting node/resource attributes
  * Fix: report: Pick up tarball suffix dynamically (bsc#1215438)
  * Fix: report: Pick 'gzip' as the first compress prog for cross-platform compatibility(bsc#1215438)
  * Fix: constants: Add several resource meta attributes (bsc#1215319)
  * Dev: spec: Remove %generate_buildrequires to prevent OBS build failures on SLE15SP5 and Leap15.5
  * Dev: refactor shell calling routines</changelog>
  <changelog author="XLiang@suse.com" date="1701950400">- Update to version 4.6.0+20231206.a903b854:
  * To polish and improve crm report along with PED-5774 (jsc#PED-5774)
  * Fix: bootstrap: fix the owner and permission of file authorized_keys (bsc#1217279)
  * Fix: prun: should not call user_pair_for_ssh() when target host is localhost (bsc#1217094)
  * Fix: utils: Add 'sudo' only when there is a sudoer(bsc#1215549)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1703160000">- Update to version 4.6.0+20231215.4b06740f:
  * Dev: ui_cluster: Move --use-ssh-agent to optional arguments
  * Fix: ui_cluster: Improve the process of 'crm cluster stop' (bsc#1213889)
  * Dev: log: save backtrace of ValueError in logfile and suppress it in console (bsc#1217924)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1704196800">- Update to version 4.6.0+20231228.83bf1514:
  * Dev: ui_corosync: Add a completer for corosync.set to enumerate all current paths
  * Dev: bootstrap: Assign hosts with _context.node_list_in_cluster in join_ssh_merge (bsc#1218331)</changelog>
  <changelog author="XLiang@suse.com" date="1708603200">- Update to version 4.6.0+20240221.58aa13d1:
  * Fix: ui_node: clearstate command needs adjustment (bsc#1219831)
  * Fix: bootstrap: fail to join a cluster with hostname alias
  * Fix: bootstrap: clear stall data about ssh users left possiblely from previous setups (bsc#1219476, bsc#1219535)
  * Fix: report: Escape special characters in pattern (bsc#1220022)
  * Fix: ui_cluster: Can't start cluster with --all option if no cib (bsc#1219052)
  * Fix: bootstrap: ssh key of the init node is duplicated in the authorized_keys files of other node (bsc#1218940)
  * Fix: sh: guide users to setup key-based ssh authentication when non-interactive authentcation fails (bsc#1219045)
  * Fix: report: Unable to gather log files that are in the syslog format (bsc#1218491)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1709553600">- Update to version 4.6.0+20240227.21cbb9ee:
  * Fix: add diagnostic messages when crm report cannot find ssh-agent (bsc#1219538)
  * Fix: crm report hangs in the root passwordless with ssh-agent (bsc#1220170)
  * Fix: report: use ClusterShell for ssh (bsc#1220170)</changelog>
  <changelog author="XLiang@suse.com" date="1713960000">- Update to version 4.6.0+20240422.73eaf02a:
  * Fix: bootstrap: Detect cluster service on init node before saving the canonical hostname (bsc#1222714)
  * Dev: report: Collect quorum/qdevice/qnetd status
  * Fix: utils: set env `CIB_shadow` using `os.environ` (bsc#1205925)
  * Fix: pass env to child process explicitly (bsc#1205925)
  * Fix: term: unset env `COLUMNS` and `ROWS` (bsc#1205925)
  * Fix: sh: pass env to child process explicitly (bsc#1205925)
  * Fix: bootstrap: Remove unused -i option when calling csync2_remote and ssh_remote stage (bsc#1212080)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1718625600">- Update to version 4.6.0+20240617.88b0c50:
  * Fix: upgradeutil: refine error handling (bsc#1226147, bsc#1223371)
  * Dev: ui_resource: Improve completers for 'crm resource' command
  * Fix: cmd_status: call crm_mon without shell (#1429)
  * Dev: log an error when fencing node without stonith device configured and running
  * Fix: healthcheck: KeyError when local nodename not found in cib (bsc#1223438)
  * Dev: utils: Add info when property is newly added
  * Dev: corosync: Show corosync cpg status in `crm corosync status cpg`
  * Dev: ui_context: ignore requirements when option --help is specified
  * Dev: ui_context: Skip querying CIB when in a sublevel or help command
  * Dev: bootstrap: Setup the stage dependency on init and join side (bsc#1175865, bsc#1219940)
  * Dev: bootstrap: Enhance stage validation
  * Dev: bash_completion: Enable complete 'id=' on non-interactive mode</changelog>
</package>
<package pkgid="4edb963f72a94454527825d31858f3ac87538681649d570b0cbda4dc95024afe" name="crmsh" arch="noarch">
  <version epoch="0" ver="4.6.0+20240718.c5fa894" rel="150600.3.6.2"/>
  <changelog author="XLiang@suse.com" date="1676635200">- Update to version 4.4.1+20230217.7fe11a5c:
  * Dev: report: Enable crm report for sudoer user
  * Dev: bootstrap: allow the cluster to operate with ssh session under non-root sudoer (jsc#PED-290)
  * Dev: utils: Add sudo for the commands in user hints
  * Fix: hawk fails to parse the slash (bsc#1206217)
  * Fix: extra logs while configuring passwordless (bsc#1207720)</changelog>
  <changelog author="XLiang@suse.com" date="1677240000">- Update to version 4.4.1+20230224.498677ab:
  * Dev: upgradeutil: do upgrade silently (bsc#1208327, bsc#1206183)
  * Fix: bootstrap: `crm cluster join ssh` raises TypeError (bsc#1208327)
  * Dev: utils: Change the way to get pacemaker's version (bsc#1208216)</changelog>
  <changelog author="XLiang@suse.com" date="1677844800">- Update to version 4.4.1+20230302.2b5310b9:
  * Fix: qdevice: Unable to setup qdevice under non-root user (bsc#1208770)</changelog>
  <changelog author="XLiang@suse.com" date="1678449600">- Update to version 4.5.0+20230309.a4c4192d:
  * Dev: version: Bump crmsh version to 4.5.0
  * Fix: report: Fix crm report issue under non-root user
  * Fix: log: Redirect debug messages into stderr (bsc#1208991)</changelog>
  <changelog author="XLiang@suse.com" date="1680177600">- Update to version 4.5.0+20230329.6d95249b:
  * Fix: utils: qdevice initialization should user_pair_for_ssh() to get appreciated users
  * Fix: crm report: sustain if there are offline nodes (bsc#1209480)
  * Fix: validate ssh session when the users is determined by guessing (bsc#1209193)
  * Fix: parallax: Use 'sudo bash -c' when executing commands via sudoer (bsc#1209192)</changelog>
  <changelog author="XLiang@suse.com" date="1682683200">- Update to version 4.5.0+20230427.11d11104:
  * Fix: bootstrap: crm cluster join default behavior change in ssh key handling (bsc#1210693)
  * Fix: help: Long time to load and parse crm.8.adoc (bsc#1210198)
  * Fix: cibconfig: use any existing rsc_defaults set rather than create another one (bsc#1210614)
  * Fix: lock: Join node failed to wait init node finished (bsc#1210332)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1683806400">- Update to version 4.5.0+20230510.847a251:
  * Fix: bootstrap: `init --qnetd-hostname` fails when username is not specified (bsc#1211200)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1688731200">- Update to version 4.5.0+20230705.ea8c76f:
  * Fix: ui_context: wait4dc should assume a subcommand completes successfully if no exceptions are raised (bsc#1212992)
  * Fix: upgradeutil: do not tried to upgrade when the cluster is partially set up (bsc#1211817)
  * Fix: bootstrap: fix the validation of option -N and -c (bsc#1212436)
  * Fix: geo_cluster: the behavior of choosing a default user in geo_join/geo_init_arbitrator is different with `cluster join` (bsc#1211817)
  * Fix: utils: do not use sudoer user to create ssh session unless it is specified explicitly (bsc#1211817)
  * medium: ui_node: fix cib rollback race on node standby
  * Dev: ui_cluster: Use 'CustomAppendAction' instead of 'append' argparse action
  * Dev: bootstrap: Configure ssh key when fetch geo config (bsc#1210709)
  * Dev: cmd_status: Use --output-as option instead of deprecated --as-html and --as-xml options
  * Dev: cmd_status: Append 'with quorum' and 'WITHOUT quorum' to display keyword list
  * Fix: bootstrap: failed to save username for localhost when initializing a cluster with a qnet server
  * Fix: utils: fix `cluster diff --checksum` (bsc#1210709)
  * Dev: geo: implement non-root support for geo_fetch_config() (bsc#1210709)
  * Fix: bootstrap: failed to join when the cluster is initialized with skip_csync2 (bsc#1210709)
  * Dev: prun: implement timeout (bsc#1210709)
  * Dev: prun: add an concurrency limiter (bsc#1210709)
  * Dev: scripts: implement non-root support with crmsh.prun (bsc#1210709)
  * Dev: implement non-root support for crm_pssh with crmsh.prun (bsc#1210709)
  * Dev: refine non-root sudoer support for crmsh.parallax (bsc#1210709)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1690545600">- Update to version 4.5.0+20230725.5d35bb6:
  * Fix: upgradeutil: support the change of path of upgrade_seq in crmsh-4.5 (bsc#1213050)</changelog>
  <changelog author="XLiang@suse.com" date="1691496000">- Update to version 4.5.0+20230809.ddb17a0b:
  * Fix: userdir: Get the effictive user name instead of using getpass.getuser (bsc#1213821)
  * Dev: requirements: remove parallax</changelog>
  <changelog author="XLiang@suse.com" date="1697025600">- Update to version 4.5.0+20231010.65aa0a09:
  * Fix: report: Pick up tarball suffix dynamically (bsc#1215438)
  * Fix: report: Pick 'gzip' as the first compress prog for cross-platform compatibility(bsc#1215438)
  * Fix: constants: Add several resource meta attributes (bsc#1215319)
  * Fix: upgradeutil: reduce the timeout for getting sequence from remote node (bsc#1213797)
  * Dev: corosync: Enable logging.to_logfile</changelog>
  <changelog author="nicholas.yang@suse.com" date="1700827200">- Update to version 4.6.0+20231123.50296e9:
  * Fix: sh: raise AuthorizationError and generate diagnose messages when ClusterShell fails with 255
  * Dev: bootstrap: allow to authenticate interactively in `crm cluster join --use-ssh-agent`
  * Dev: ssh-agent: add informative logging for adding keys to authorized_keys
  * Dev: ssh-agent: add diagnose messages
  * Dev: bootstrap: implement ssh-agent support for geo cluster (jsc#PED-5774)
  * Dev: bootstrap: refine key swap for user `hacluster`
  * Dev: bootstrap: implement ssh-agent support for qdevice (jsc#PED-5774)
  * Dev: bootstrap: implement ssh-agent support (jsc#PED-5774)
  * Dev: cmd_status: Show error correctly for crm status
  * Dev: ui_utils: Supports '=' when setting node/resource attributes
  * Fix: report: Pick up tarball suffix dynamically (bsc#1215438)
  * Fix: report: Pick 'gzip' as the first compress prog for cross-platform compatibility(bsc#1215438)
  * Fix: constants: Add several resource meta attributes (bsc#1215319)
  * Dev: spec: Remove %generate_buildrequires to prevent OBS build failures on SLE15SP5 and Leap15.5
  * Dev: refactor shell calling routines</changelog>
  <changelog author="XLiang@suse.com" date="1701950400">- Update to version 4.6.0+20231206.a903b854:
  * To polish and improve crm report along with PED-5774 (jsc#PED-5774)
  * Fix: bootstrap: fix the owner and permission of file authorized_keys (bsc#1217279)
  * Fix: prun: should not call user_pair_for_ssh() when target host is localhost (bsc#1217094)
  * Fix: utils: Add 'sudo' only when there is a sudoer(bsc#1215549)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1703160000">- Update to version 4.6.0+20231215.4b06740f:
  * Dev: ui_cluster: Move --use-ssh-agent to optional arguments
  * Fix: ui_cluster: Improve the process of 'crm cluster stop' (bsc#1213889)
  * Dev: log: save backtrace of ValueError in logfile and suppress it in console (bsc#1217924)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1704196800">- Update to version 4.6.0+20231228.83bf1514:
  * Dev: ui_corosync: Add a completer for corosync.set to enumerate all current paths
  * Dev: bootstrap: Assign hosts with _context.node_list_in_cluster in join_ssh_merge (bsc#1218331)</changelog>
  <changelog author="XLiang@suse.com" date="1708603200">- Update to version 4.6.0+20240221.58aa13d1:
  * Fix: ui_node: clearstate command needs adjustment (bsc#1219831)
  * Fix: bootstrap: fail to join a cluster with hostname alias
  * Fix: bootstrap: clear stall data about ssh users left possiblely from previous setups (bsc#1219476, bsc#1219535)
  * Fix: report: Escape special characters in pattern (bsc#1220022)
  * Fix: ui_cluster: Can't start cluster with --all option if no cib (bsc#1219052)
  * Fix: bootstrap: ssh key of the init node is duplicated in the authorized_keys files of other node (bsc#1218940)
  * Fix: sh: guide users to setup key-based ssh authentication when non-interactive authentcation fails (bsc#1219045)
  * Fix: report: Unable to gather log files that are in the syslog format (bsc#1218491)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1709553600">- Update to version 4.6.0+20240227.21cbb9ee:
  * Fix: add diagnostic messages when crm report cannot find ssh-agent (bsc#1219538)
  * Fix: crm report hangs in the root passwordless with ssh-agent (bsc#1220170)
  * Fix: report: use ClusterShell for ssh (bsc#1220170)</changelog>
  <changelog author="XLiang@suse.com" date="1713960000">- Update to version 4.6.0+20240422.73eaf02a:
  * Fix: bootstrap: Detect cluster service on init node before saving the canonical hostname (bsc#1222714)
  * Dev: report: Collect quorum/qdevice/qnetd status
  * Fix: utils: set env `CIB_shadow` using `os.environ` (bsc#1205925)
  * Fix: pass env to child process explicitly (bsc#1205925)
  * Fix: term: unset env `COLUMNS` and `ROWS` (bsc#1205925)
  * Fix: sh: pass env to child process explicitly (bsc#1205925)
  * Fix: bootstrap: Remove unused -i option when calling csync2_remote and ssh_remote stage (bsc#1212080)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1718625600">- Update to version 4.6.0+20240617.88b0c50:
  * Fix: upgradeutil: refine error handling (bsc#1226147, bsc#1223371)
  * Dev: ui_resource: Improve completers for 'crm resource' command
  * Fix: cmd_status: call crm_mon without shell (#1429)
  * Dev: log an error when fencing node without stonith device configured and running
  * Fix: healthcheck: KeyError when local nodename not found in cib (bsc#1223438)
  * Dev: utils: Add info when property is newly added
  * Dev: corosync: Show corosync cpg status in `crm corosync status cpg`
  * Dev: ui_context: ignore requirements when option --help is specified
  * Dev: ui_context: Skip querying CIB when in a sublevel or help command
  * Dev: bootstrap: Setup the stage dependency on init and join side (bsc#1175865, bsc#1219940)
  * Dev: bootstrap: Enhance stage validation
  * Dev: bash_completion: Enable complete 'id=' on non-interactive mode</changelog>
  <changelog author="nicholas.yang@suse.com" date="1721390400">- Update to version 4.6.0+20240718.c5fa894:
  * Dev: prun: add more possible libexec PATH for sftp-server
  * Fix: qdevice: config "tls" should accept value "required" (bsc#1227649)
  * Fix: bootstrap: refine the wording in the question asking TLS config for qdevice (bsc#1227649)
  * Fix: qdevice: TLS certs should always be generated for qnetd (bsc#1227649)
  * Fix: cli: loading cib should be a soft depenedency
  * Dev: ui_context: refactor NON_FUNCTIONAL_COMMAND and NON_FUNCTIONAL_OPTIONS
  * Revert changes to `quit` and `up` in ui_context from #1300 (#1466)
  * Fix: cibconfig: do not load cib to check if cib is changed (#1466)
  * Dev: ra: Refine RAInfo.params interface to exclude some completion results
  * Dev: ui_context: Don't append space when completion ends with equal sign
  * Dev: ui_configure: Complete required parameters first
  * Fix: ui_context: crm configure up prompt #1466
  * Fix: ui_context: crm cluster delete autocompletion #1403 #1460
  * Dev: ra: Guess stonith class type when using fence agents
  * Fix: cibconfig: Disable complete advised operation values when adding a rsc_template</changelog>
</package>
<package pkgid="9a620b7fdf080a027c6256d07e0837cf978e9ed0f588e1b1d4f1caae8545f5ce" name="crmsh" arch="src">
  <version epoch="0" ver="4.6.0+20240718.c5fa894" rel="150600.3.6.2"/>
  <changelog author="XLiang@suse.com" date="1676635200">- Update to version 4.4.1+20230217.7fe11a5c:
  * Dev: report: Enable crm report for sudoer user
  * Dev: bootstrap: allow the cluster to operate with ssh session under non-root sudoer (jsc#PED-290)
  * Dev: utils: Add sudo for the commands in user hints
  * Fix: hawk fails to parse the slash (bsc#1206217)
  * Fix: extra logs while configuring passwordless (bsc#1207720)</changelog>
  <changelog author="XLiang@suse.com" date="1677240000">- Update to version 4.4.1+20230224.498677ab:
  * Dev: upgradeutil: do upgrade silently (bsc#1208327, bsc#1206183)
  * Fix: bootstrap: `crm cluster join ssh` raises TypeError (bsc#1208327)
  * Dev: utils: Change the way to get pacemaker's version (bsc#1208216)</changelog>
  <changelog author="XLiang@suse.com" date="1677844800">- Update to version 4.4.1+20230302.2b5310b9:
  * Fix: qdevice: Unable to setup qdevice under non-root user (bsc#1208770)</changelog>
  <changelog author="XLiang@suse.com" date="1678449600">- Update to version 4.5.0+20230309.a4c4192d:
  * Dev: version: Bump crmsh version to 4.5.0
  * Fix: report: Fix crm report issue under non-root user
  * Fix: log: Redirect debug messages into stderr (bsc#1208991)</changelog>
  <changelog author="XLiang@suse.com" date="1680177600">- Update to version 4.5.0+20230329.6d95249b:
  * Fix: utils: qdevice initialization should user_pair_for_ssh() to get appreciated users
  * Fix: crm report: sustain if there are offline nodes (bsc#1209480)
  * Fix: validate ssh session when the users is determined by guessing (bsc#1209193)
  * Fix: parallax: Use 'sudo bash -c' when executing commands via sudoer (bsc#1209192)</changelog>
  <changelog author="XLiang@suse.com" date="1682683200">- Update to version 4.5.0+20230427.11d11104:
  * Fix: bootstrap: crm cluster join default behavior change in ssh key handling (bsc#1210693)
  * Fix: help: Long time to load and parse crm.8.adoc (bsc#1210198)
  * Fix: cibconfig: use any existing rsc_defaults set rather than create another one (bsc#1210614)
  * Fix: lock: Join node failed to wait init node finished (bsc#1210332)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1683806400">- Update to version 4.5.0+20230510.847a251:
  * Fix: bootstrap: `init --qnetd-hostname` fails when username is not specified (bsc#1211200)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1688731200">- Update to version 4.5.0+20230705.ea8c76f:
  * Fix: ui_context: wait4dc should assume a subcommand completes successfully if no exceptions are raised (bsc#1212992)
  * Fix: upgradeutil: do not tried to upgrade when the cluster is partially set up (bsc#1211817)
  * Fix: bootstrap: fix the validation of option -N and -c (bsc#1212436)
  * Fix: geo_cluster: the behavior of choosing a default user in geo_join/geo_init_arbitrator is different with `cluster join` (bsc#1211817)
  * Fix: utils: do not use sudoer user to create ssh session unless it is specified explicitly (bsc#1211817)
  * medium: ui_node: fix cib rollback race on node standby
  * Dev: ui_cluster: Use 'CustomAppendAction' instead of 'append' argparse action
  * Dev: bootstrap: Configure ssh key when fetch geo config (bsc#1210709)
  * Dev: cmd_status: Use --output-as option instead of deprecated --as-html and --as-xml options
  * Dev: cmd_status: Append 'with quorum' and 'WITHOUT quorum' to display keyword list
  * Fix: bootstrap: failed to save username for localhost when initializing a cluster with a qnet server
  * Fix: utils: fix `cluster diff --checksum` (bsc#1210709)
  * Dev: geo: implement non-root support for geo_fetch_config() (bsc#1210709)
  * Fix: bootstrap: failed to join when the cluster is initialized with skip_csync2 (bsc#1210709)
  * Dev: prun: implement timeout (bsc#1210709)
  * Dev: prun: add an concurrency limiter (bsc#1210709)
  * Dev: scripts: implement non-root support with crmsh.prun (bsc#1210709)
  * Dev: implement non-root support for crm_pssh with crmsh.prun (bsc#1210709)
  * Dev: refine non-root sudoer support for crmsh.parallax (bsc#1210709)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1690545600">- Update to version 4.5.0+20230725.5d35bb6:
  * Fix: upgradeutil: support the change of path of upgrade_seq in crmsh-4.5 (bsc#1213050)</changelog>
  <changelog author="XLiang@suse.com" date="1691496000">- Update to version 4.5.0+20230809.ddb17a0b:
  * Fix: userdir: Get the effictive user name instead of using getpass.getuser (bsc#1213821)
  * Dev: requirements: remove parallax</changelog>
  <changelog author="XLiang@suse.com" date="1697025600">- Update to version 4.5.0+20231010.65aa0a09:
  * Fix: report: Pick up tarball suffix dynamically (bsc#1215438)
  * Fix: report: Pick 'gzip' as the first compress prog for cross-platform compatibility(bsc#1215438)
  * Fix: constants: Add several resource meta attributes (bsc#1215319)
  * Fix: upgradeutil: reduce the timeout for getting sequence from remote node (bsc#1213797)
  * Dev: corosync: Enable logging.to_logfile</changelog>
  <changelog author="nicholas.yang@suse.com" date="1700827200">- Update to version 4.6.0+20231123.50296e9:
  * Fix: sh: raise AuthorizationError and generate diagnose messages when ClusterShell fails with 255
  * Dev: bootstrap: allow to authenticate interactively in `crm cluster join --use-ssh-agent`
  * Dev: ssh-agent: add informative logging for adding keys to authorized_keys
  * Dev: ssh-agent: add diagnose messages
  * Dev: bootstrap: implement ssh-agent support for geo cluster (jsc#PED-5774)
  * Dev: bootstrap: refine key swap for user `hacluster`
  * Dev: bootstrap: implement ssh-agent support for qdevice (jsc#PED-5774)
  * Dev: bootstrap: implement ssh-agent support (jsc#PED-5774)
  * Dev: cmd_status: Show error correctly for crm status
  * Dev: ui_utils: Supports '=' when setting node/resource attributes
  * Fix: report: Pick up tarball suffix dynamically (bsc#1215438)
  * Fix: report: Pick 'gzip' as the first compress prog for cross-platform compatibility(bsc#1215438)
  * Fix: constants: Add several resource meta attributes (bsc#1215319)
  * Dev: spec: Remove %generate_buildrequires to prevent OBS build failures on SLE15SP5 and Leap15.5
  * Dev: refactor shell calling routines</changelog>
  <changelog author="XLiang@suse.com" date="1701950400">- Update to version 4.6.0+20231206.a903b854:
  * To polish and improve crm report along with PED-5774 (jsc#PED-5774)
  * Fix: bootstrap: fix the owner and permission of file authorized_keys (bsc#1217279)
  * Fix: prun: should not call user_pair_for_ssh() when target host is localhost (bsc#1217094)
  * Fix: utils: Add 'sudo' only when there is a sudoer(bsc#1215549)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1703160000">- Update to version 4.6.0+20231215.4b06740f:
  * Dev: ui_cluster: Move --use-ssh-agent to optional arguments
  * Fix: ui_cluster: Improve the process of 'crm cluster stop' (bsc#1213889)
  * Dev: log: save backtrace of ValueError in logfile and suppress it in console (bsc#1217924)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1704196800">- Update to version 4.6.0+20231228.83bf1514:
  * Dev: ui_corosync: Add a completer for corosync.set to enumerate all current paths
  * Dev: bootstrap: Assign hosts with _context.node_list_in_cluster in join_ssh_merge (bsc#1218331)</changelog>
  <changelog author="XLiang@suse.com" date="1708603200">- Update to version 4.6.0+20240221.58aa13d1:
  * Fix: ui_node: clearstate command needs adjustment (bsc#1219831)
  * Fix: bootstrap: fail to join a cluster with hostname alias
  * Fix: bootstrap: clear stall data about ssh users left possiblely from previous setups (bsc#1219476, bsc#1219535)
  * Fix: report: Escape special characters in pattern (bsc#1220022)
  * Fix: ui_cluster: Can't start cluster with --all option if no cib (bsc#1219052)
  * Fix: bootstrap: ssh key of the init node is duplicated in the authorized_keys files of other node (bsc#1218940)
  * Fix: sh: guide users to setup key-based ssh authentication when non-interactive authentcation fails (bsc#1219045)
  * Fix: report: Unable to gather log files that are in the syslog format (bsc#1218491)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1709553600">- Update to version 4.6.0+20240227.21cbb9ee:
  * Fix: add diagnostic messages when crm report cannot find ssh-agent (bsc#1219538)
  * Fix: crm report hangs in the root passwordless with ssh-agent (bsc#1220170)
  * Fix: report: use ClusterShell for ssh (bsc#1220170)</changelog>
  <changelog author="XLiang@suse.com" date="1713960000">- Update to version 4.6.0+20240422.73eaf02a:
  * Fix: bootstrap: Detect cluster service on init node before saving the canonical hostname (bsc#1222714)
  * Dev: report: Collect quorum/qdevice/qnetd status
  * Fix: utils: set env `CIB_shadow` using `os.environ` (bsc#1205925)
  * Fix: pass env to child process explicitly (bsc#1205925)
  * Fix: term: unset env `COLUMNS` and `ROWS` (bsc#1205925)
  * Fix: sh: pass env to child process explicitly (bsc#1205925)
  * Fix: bootstrap: Remove unused -i option when calling csync2_remote and ssh_remote stage (bsc#1212080)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1718625600">- Update to version 4.6.0+20240617.88b0c50:
  * Fix: upgradeutil: refine error handling (bsc#1226147, bsc#1223371)
  * Dev: ui_resource: Improve completers for 'crm resource' command
  * Fix: cmd_status: call crm_mon without shell (#1429)
  * Dev: log an error when fencing node without stonith device configured and running
  * Fix: healthcheck: KeyError when local nodename not found in cib (bsc#1223438)
  * Dev: utils: Add info when property is newly added
  * Dev: corosync: Show corosync cpg status in `crm corosync status cpg`
  * Dev: ui_context: ignore requirements when option --help is specified
  * Dev: ui_context: Skip querying CIB when in a sublevel or help command
  * Dev: bootstrap: Setup the stage dependency on init and join side (bsc#1175865, bsc#1219940)
  * Dev: bootstrap: Enhance stage validation
  * Dev: bash_completion: Enable complete 'id=' on non-interactive mode</changelog>
  <changelog author="nicholas.yang@suse.com" date="1721390400">- Update to version 4.6.0+20240718.c5fa894:
  * Dev: prun: add more possible libexec PATH for sftp-server
  * Fix: qdevice: config "tls" should accept value "required" (bsc#1227649)
  * Fix: bootstrap: refine the wording in the question asking TLS config for qdevice (bsc#1227649)
  * Fix: qdevice: TLS certs should always be generated for qnetd (bsc#1227649)
  * Fix: cli: loading cib should be a soft depenedency
  * Dev: ui_context: refactor NON_FUNCTIONAL_COMMAND and NON_FUNCTIONAL_OPTIONS
  * Revert changes to `quit` and `up` in ui_context from #1300 (#1466)
  * Fix: cibconfig: do not load cib to check if cib is changed (#1466)
  * Dev: ra: Refine RAInfo.params interface to exclude some completion results
  * Dev: ui_context: Don't append space when completion ends with equal sign
  * Dev: ui_configure: Complete required parameters first
  * Fix: ui_context: crm configure up prompt #1466
  * Fix: ui_context: crm cluster delete autocompletion #1403 #1460
  * Dev: ra: Guess stonith class type when using fence agents
  * Fix: cibconfig: Disable complete advised operation values when adding a rsc_template</changelog>
</package>
<package pkgid="c5f46d0d8d95dc4b2ee41d419ffd7b6adf867a4fb23e907ae654b95524c979de" name="crmsh-scripts" arch="noarch">
  <version epoch="0" ver="4.6.0+20240617.88b0c50" rel="150600.3.3.2"/>
  <changelog author="nicholas.yang@suse.com" date="1674475200">- Update to version 4.4.1+20230117.fb8b3c2b:
  * Dev: healthcheck: allow using non-root sudoer for remote access (jsc#PED-290)
  * Dev: bootstrap: implement swapping hacluster's ssh key using non-root sudoer remote access (jsc#PED-290)
  * Dev: utils: Check current user's privilege and give hints to user (jsc#PED-290)
  * Feature: replace root by a custom user with root privileges (jsc#PED-290)</changelog>
  <changelog author="XLiang@suse.com" date="1676635200">- Update to version 4.4.1+20230217.7fe11a5c:
  * Dev: report: Enable crm report for sudoer user
  * Dev: bootstrap: allow the cluster to operate with ssh session under non-root sudoer (jsc#PED-290)
  * Dev: utils: Add sudo for the commands in user hints
  * Fix: hawk fails to parse the slash (bsc#1206217)
  * Fix: extra logs while configuring passwordless (bsc#1207720)</changelog>
  <changelog author="XLiang@suse.com" date="1677240000">- Update to version 4.4.1+20230224.498677ab:
  * Dev: upgradeutil: do upgrade silently (bsc#1208327, bsc#1206183)
  * Fix: bootstrap: `crm cluster join ssh` raises TypeError (bsc#1208327)
  * Dev: utils: Change the way to get pacemaker's version (bsc#1208216)</changelog>
  <changelog author="XLiang@suse.com" date="1677844800">- Update to version 4.4.1+20230302.2b5310b9:
  * Fix: qdevice: Unable to setup qdevice under non-root user (bsc#1208770)</changelog>
  <changelog author="XLiang@suse.com" date="1678449600">- Update to version 4.5.0+20230309.a4c4192d:
  * Dev: version: Bump crmsh version to 4.5.0
  * Fix: report: Fix crm report issue under non-root user
  * Fix: log: Redirect debug messages into stderr (bsc#1208991)</changelog>
  <changelog author="XLiang@suse.com" date="1680177600">- Update to version 4.5.0+20230329.6d95249b:
  * Fix: utils: qdevice initialization should user_pair_for_ssh() to get appreciated users
  * Fix: crm report: sustain if there are offline nodes (bsc#1209480)
  * Fix: validate ssh session when the users is determined by guessing (bsc#1209193)
  * Fix: parallax: Use 'sudo bash -c' when executing commands via sudoer (bsc#1209192)</changelog>
  <changelog author="XLiang@suse.com" date="1682683200">- Update to version 4.5.0+20230427.11d11104:
  * Fix: bootstrap: crm cluster join default behavior change in ssh key handling (bsc#1210693)
  * Fix: help: Long time to load and parse crm.8.adoc (bsc#1210198)
  * Fix: cibconfig: use any existing rsc_defaults set rather than create another one (bsc#1210614)
  * Fix: lock: Join node failed to wait init node finished (bsc#1210332)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1683806400">- Update to version 4.5.0+20230510.847a251:
  * Fix: bootstrap: `init --qnetd-hostname` fails when username is not specified (bsc#1211200)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1688731200">- Update to version 4.5.0+20230705.ea8c76f:
  * Fix: ui_context: wait4dc should assume a subcommand completes successfully if no exceptions are raised (bsc#1212992)
  * Fix: upgradeutil: do not tried to upgrade when the cluster is partially set up (bsc#1211817)
  * Fix: bootstrap: fix the validation of option -N and -c (bsc#1212436)
  * Fix: geo_cluster: the behavior of choosing a default user in geo_join/geo_init_arbitrator is different with `cluster join` (bsc#1211817)
  * Fix: utils: do not use sudoer user to create ssh session unless it is specified explicitly (bsc#1211817)
  * medium: ui_node: fix cib rollback race on node standby
  * Dev: ui_cluster: Use 'CustomAppendAction' instead of 'append' argparse action
  * Dev: bootstrap: Configure ssh key when fetch geo config (bsc#1210709)
  * Dev: cmd_status: Use --output-as option instead of deprecated --as-html and --as-xml options
  * Dev: cmd_status: Append 'with quorum' and 'WITHOUT quorum' to display keyword list
  * Fix: bootstrap: failed to save username for localhost when initializing a cluster with a qnet server
  * Fix: utils: fix `cluster diff --checksum` (bsc#1210709)
  * Dev: geo: implement non-root support for geo_fetch_config() (bsc#1210709)
  * Fix: bootstrap: failed to join when the cluster is initialized with skip_csync2 (bsc#1210709)
  * Dev: prun: implement timeout (bsc#1210709)
  * Dev: prun: add an concurrency limiter (bsc#1210709)
  * Dev: scripts: implement non-root support with crmsh.prun (bsc#1210709)
  * Dev: implement non-root support for crm_pssh with crmsh.prun (bsc#1210709)
  * Dev: refine non-root sudoer support for crmsh.parallax (bsc#1210709)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1690545600">- Update to version 4.5.0+20230725.5d35bb6:
  * Fix: upgradeutil: support the change of path of upgrade_seq in crmsh-4.5 (bsc#1213050)</changelog>
  <changelog author="XLiang@suse.com" date="1691496000">- Update to version 4.5.0+20230809.ddb17a0b:
  * Fix: userdir: Get the effictive user name instead of using getpass.getuser (bsc#1213821)
  * Dev: requirements: remove parallax</changelog>
  <changelog author="XLiang@suse.com" date="1697025600">- Update to version 4.5.0+20231010.65aa0a09:
  * Fix: report: Pick up tarball suffix dynamically (bsc#1215438)
  * Fix: report: Pick 'gzip' as the first compress prog for cross-platform compatibility(bsc#1215438)
  * Fix: constants: Add several resource meta attributes (bsc#1215319)
  * Fix: upgradeutil: reduce the timeout for getting sequence from remote node (bsc#1213797)
  * Dev: corosync: Enable logging.to_logfile</changelog>
  <changelog author="nicholas.yang@suse.com" date="1700827200">- Update to version 4.6.0+20231123.50296e9:
  * Fix: sh: raise AuthorizationError and generate diagnose messages when ClusterShell fails with 255
  * Dev: bootstrap: allow to authenticate interactively in `crm cluster join --use-ssh-agent`
  * Dev: ssh-agent: add informative logging for adding keys to authorized_keys
  * Dev: ssh-agent: add diagnose messages
  * Dev: bootstrap: implement ssh-agent support for geo cluster (jsc#PED-5774)
  * Dev: bootstrap: refine key swap for user `hacluster`
  * Dev: bootstrap: implement ssh-agent support for qdevice (jsc#PED-5774)
  * Dev: bootstrap: implement ssh-agent support (jsc#PED-5774)
  * Dev: cmd_status: Show error correctly for crm status
  * Dev: ui_utils: Supports '=' when setting node/resource attributes
  * Fix: report: Pick up tarball suffix dynamically (bsc#1215438)
  * Fix: report: Pick 'gzip' as the first compress prog for cross-platform compatibility(bsc#1215438)
  * Fix: constants: Add several resource meta attributes (bsc#1215319)
  * Dev: spec: Remove %generate_buildrequires to prevent OBS build failures on SLE15SP5 and Leap15.5
  * Dev: refactor shell calling routines</changelog>
  <changelog author="XLiang@suse.com" date="1701950400">- Update to version 4.6.0+20231206.a903b854:
  * To polish and improve crm report along with PED-5774 (jsc#PED-5774)
  * Fix: bootstrap: fix the owner and permission of file authorized_keys (bsc#1217279)
  * Fix: prun: should not call user_pair_for_ssh() when target host is localhost (bsc#1217094)
  * Fix: utils: Add 'sudo' only when there is a sudoer(bsc#1215549)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1703160000">- Update to version 4.6.0+20231215.4b06740f:
  * Dev: ui_cluster: Move --use-ssh-agent to optional arguments
  * Fix: ui_cluster: Improve the process of 'crm cluster stop' (bsc#1213889)
  * Dev: log: save backtrace of ValueError in logfile and suppress it in console (bsc#1217924)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1704196800">- Update to version 4.6.0+20231228.83bf1514:
  * Dev: ui_corosync: Add a completer for corosync.set to enumerate all current paths
  * Dev: bootstrap: Assign hosts with _context.node_list_in_cluster in join_ssh_merge (bsc#1218331)</changelog>
  <changelog author="XLiang@suse.com" date="1708603200">- Update to version 4.6.0+20240221.58aa13d1:
  * Fix: ui_node: clearstate command needs adjustment (bsc#1219831)
  * Fix: bootstrap: fail to join a cluster with hostname alias
  * Fix: bootstrap: clear stall data about ssh users left possiblely from previous setups (bsc#1219476, bsc#1219535)
  * Fix: report: Escape special characters in pattern (bsc#1220022)
  * Fix: ui_cluster: Can't start cluster with --all option if no cib (bsc#1219052)
  * Fix: bootstrap: ssh key of the init node is duplicated in the authorized_keys files of other node (bsc#1218940)
  * Fix: sh: guide users to setup key-based ssh authentication when non-interactive authentcation fails (bsc#1219045)
  * Fix: report: Unable to gather log files that are in the syslog format (bsc#1218491)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1709553600">- Update to version 4.6.0+20240227.21cbb9ee:
  * Fix: add diagnostic messages when crm report cannot find ssh-agent (bsc#1219538)
  * Fix: crm report hangs in the root passwordless with ssh-agent (bsc#1220170)
  * Fix: report: use ClusterShell for ssh (bsc#1220170)</changelog>
  <changelog author="XLiang@suse.com" date="1713960000">- Update to version 4.6.0+20240422.73eaf02a:
  * Fix: bootstrap: Detect cluster service on init node before saving the canonical hostname (bsc#1222714)
  * Dev: report: Collect quorum/qdevice/qnetd status
  * Fix: utils: set env `CIB_shadow` using `os.environ` (bsc#1205925)
  * Fix: pass env to child process explicitly (bsc#1205925)
  * Fix: term: unset env `COLUMNS` and `ROWS` (bsc#1205925)
  * Fix: sh: pass env to child process explicitly (bsc#1205925)
  * Fix: bootstrap: Remove unused -i option when calling csync2_remote and ssh_remote stage (bsc#1212080)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1718625600">- Update to version 4.6.0+20240617.88b0c50:
  * Fix: upgradeutil: refine error handling (bsc#1226147, bsc#1223371)
  * Dev: ui_resource: Improve completers for 'crm resource' command
  * Fix: cmd_status: call crm_mon without shell (#1429)
  * Dev: log an error when fencing node without stonith device configured and running
  * Fix: healthcheck: KeyError when local nodename not found in cib (bsc#1223438)
  * Dev: utils: Add info when property is newly added
  * Dev: corosync: Show corosync cpg status in `crm corosync status cpg`
  * Dev: ui_context: ignore requirements when option --help is specified
  * Dev: ui_context: Skip querying CIB when in a sublevel or help command
  * Dev: bootstrap: Setup the stage dependency on init and join side (bsc#1175865, bsc#1219940)
  * Dev: bootstrap: Enhance stage validation
  * Dev: bash_completion: Enable complete 'id=' on non-interactive mode</changelog>
</package>
<package pkgid="c4942e82080736f4af95fc5453590d58438fffc461371ed128d064884ef66e3c" name="crmsh-scripts" arch="noarch">
  <version epoch="0" ver="4.6.0+20240718.c5fa894" rel="150600.3.6.2"/>
  <changelog author="XLiang@suse.com" date="1676635200">- Update to version 4.4.1+20230217.7fe11a5c:
  * Dev: report: Enable crm report for sudoer user
  * Dev: bootstrap: allow the cluster to operate with ssh session under non-root sudoer (jsc#PED-290)
  * Dev: utils: Add sudo for the commands in user hints
  * Fix: hawk fails to parse the slash (bsc#1206217)
  * Fix: extra logs while configuring passwordless (bsc#1207720)</changelog>
  <changelog author="XLiang@suse.com" date="1677240000">- Update to version 4.4.1+20230224.498677ab:
  * Dev: upgradeutil: do upgrade silently (bsc#1208327, bsc#1206183)
  * Fix: bootstrap: `crm cluster join ssh` raises TypeError (bsc#1208327)
  * Dev: utils: Change the way to get pacemaker's version (bsc#1208216)</changelog>
  <changelog author="XLiang@suse.com" date="1677844800">- Update to version 4.4.1+20230302.2b5310b9:
  * Fix: qdevice: Unable to setup qdevice under non-root user (bsc#1208770)</changelog>
  <changelog author="XLiang@suse.com" date="1678449600">- Update to version 4.5.0+20230309.a4c4192d:
  * Dev: version: Bump crmsh version to 4.5.0
  * Fix: report: Fix crm report issue under non-root user
  * Fix: log: Redirect debug messages into stderr (bsc#1208991)</changelog>
  <changelog author="XLiang@suse.com" date="1680177600">- Update to version 4.5.0+20230329.6d95249b:
  * Fix: utils: qdevice initialization should user_pair_for_ssh() to get appreciated users
  * Fix: crm report: sustain if there are offline nodes (bsc#1209480)
  * Fix: validate ssh session when the users is determined by guessing (bsc#1209193)
  * Fix: parallax: Use 'sudo bash -c' when executing commands via sudoer (bsc#1209192)</changelog>
  <changelog author="XLiang@suse.com" date="1682683200">- Update to version 4.5.0+20230427.11d11104:
  * Fix: bootstrap: crm cluster join default behavior change in ssh key handling (bsc#1210693)
  * Fix: help: Long time to load and parse crm.8.adoc (bsc#1210198)
  * Fix: cibconfig: use any existing rsc_defaults set rather than create another one (bsc#1210614)
  * Fix: lock: Join node failed to wait init node finished (bsc#1210332)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1683806400">- Update to version 4.5.0+20230510.847a251:
  * Fix: bootstrap: `init --qnetd-hostname` fails when username is not specified (bsc#1211200)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1688731200">- Update to version 4.5.0+20230705.ea8c76f:
  * Fix: ui_context: wait4dc should assume a subcommand completes successfully if no exceptions are raised (bsc#1212992)
  * Fix: upgradeutil: do not tried to upgrade when the cluster is partially set up (bsc#1211817)
  * Fix: bootstrap: fix the validation of option -N and -c (bsc#1212436)
  * Fix: geo_cluster: the behavior of choosing a default user in geo_join/geo_init_arbitrator is different with `cluster join` (bsc#1211817)
  * Fix: utils: do not use sudoer user to create ssh session unless it is specified explicitly (bsc#1211817)
  * medium: ui_node: fix cib rollback race on node standby
  * Dev: ui_cluster: Use 'CustomAppendAction' instead of 'append' argparse action
  * Dev: bootstrap: Configure ssh key when fetch geo config (bsc#1210709)
  * Dev: cmd_status: Use --output-as option instead of deprecated --as-html and --as-xml options
  * Dev: cmd_status: Append 'with quorum' and 'WITHOUT quorum' to display keyword list
  * Fix: bootstrap: failed to save username for localhost when initializing a cluster with a qnet server
  * Fix: utils: fix `cluster diff --checksum` (bsc#1210709)
  * Dev: geo: implement non-root support for geo_fetch_config() (bsc#1210709)
  * Fix: bootstrap: failed to join when the cluster is initialized with skip_csync2 (bsc#1210709)
  * Dev: prun: implement timeout (bsc#1210709)
  * Dev: prun: add an concurrency limiter (bsc#1210709)
  * Dev: scripts: implement non-root support with crmsh.prun (bsc#1210709)
  * Dev: implement non-root support for crm_pssh with crmsh.prun (bsc#1210709)
  * Dev: refine non-root sudoer support for crmsh.parallax (bsc#1210709)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1690545600">- Update to version 4.5.0+20230725.5d35bb6:
  * Fix: upgradeutil: support the change of path of upgrade_seq in crmsh-4.5 (bsc#1213050)</changelog>
  <changelog author="XLiang@suse.com" date="1691496000">- Update to version 4.5.0+20230809.ddb17a0b:
  * Fix: userdir: Get the effictive user name instead of using getpass.getuser (bsc#1213821)
  * Dev: requirements: remove parallax</changelog>
  <changelog author="XLiang@suse.com" date="1697025600">- Update to version 4.5.0+20231010.65aa0a09:
  * Fix: report: Pick up tarball suffix dynamically (bsc#1215438)
  * Fix: report: Pick 'gzip' as the first compress prog for cross-platform compatibility(bsc#1215438)
  * Fix: constants: Add several resource meta attributes (bsc#1215319)
  * Fix: upgradeutil: reduce the timeout for getting sequence from remote node (bsc#1213797)
  * Dev: corosync: Enable logging.to_logfile</changelog>
  <changelog author="nicholas.yang@suse.com" date="1700827200">- Update to version 4.6.0+20231123.50296e9:
  * Fix: sh: raise AuthorizationError and generate diagnose messages when ClusterShell fails with 255
  * Dev: bootstrap: allow to authenticate interactively in `crm cluster join --use-ssh-agent`
  * Dev: ssh-agent: add informative logging for adding keys to authorized_keys
  * Dev: ssh-agent: add diagnose messages
  * Dev: bootstrap: implement ssh-agent support for geo cluster (jsc#PED-5774)
  * Dev: bootstrap: refine key swap for user `hacluster`
  * Dev: bootstrap: implement ssh-agent support for qdevice (jsc#PED-5774)
  * Dev: bootstrap: implement ssh-agent support (jsc#PED-5774)
  * Dev: cmd_status: Show error correctly for crm status
  * Dev: ui_utils: Supports '=' when setting node/resource attributes
  * Fix: report: Pick up tarball suffix dynamically (bsc#1215438)
  * Fix: report: Pick 'gzip' as the first compress prog for cross-platform compatibility(bsc#1215438)
  * Fix: constants: Add several resource meta attributes (bsc#1215319)
  * Dev: spec: Remove %generate_buildrequires to prevent OBS build failures on SLE15SP5 and Leap15.5
  * Dev: refactor shell calling routines</changelog>
  <changelog author="XLiang@suse.com" date="1701950400">- Update to version 4.6.0+20231206.a903b854:
  * To polish and improve crm report along with PED-5774 (jsc#PED-5774)
  * Fix: bootstrap: fix the owner and permission of file authorized_keys (bsc#1217279)
  * Fix: prun: should not call user_pair_for_ssh() when target host is localhost (bsc#1217094)
  * Fix: utils: Add 'sudo' only when there is a sudoer(bsc#1215549)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1703160000">- Update to version 4.6.0+20231215.4b06740f:
  * Dev: ui_cluster: Move --use-ssh-agent to optional arguments
  * Fix: ui_cluster: Improve the process of 'crm cluster stop' (bsc#1213889)
  * Dev: log: save backtrace of ValueError in logfile and suppress it in console (bsc#1217924)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1704196800">- Update to version 4.6.0+20231228.83bf1514:
  * Dev: ui_corosync: Add a completer for corosync.set to enumerate all current paths
  * Dev: bootstrap: Assign hosts with _context.node_list_in_cluster in join_ssh_merge (bsc#1218331)</changelog>
  <changelog author="XLiang@suse.com" date="1708603200">- Update to version 4.6.0+20240221.58aa13d1:
  * Fix: ui_node: clearstate command needs adjustment (bsc#1219831)
  * Fix: bootstrap: fail to join a cluster with hostname alias
  * Fix: bootstrap: clear stall data about ssh users left possiblely from previous setups (bsc#1219476, bsc#1219535)
  * Fix: report: Escape special characters in pattern (bsc#1220022)
  * Fix: ui_cluster: Can't start cluster with --all option if no cib (bsc#1219052)
  * Fix: bootstrap: ssh key of the init node is duplicated in the authorized_keys files of other node (bsc#1218940)
  * Fix: sh: guide users to setup key-based ssh authentication when non-interactive authentcation fails (bsc#1219045)
  * Fix: report: Unable to gather log files that are in the syslog format (bsc#1218491)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1709553600">- Update to version 4.6.0+20240227.21cbb9ee:
  * Fix: add diagnostic messages when crm report cannot find ssh-agent (bsc#1219538)
  * Fix: crm report hangs in the root passwordless with ssh-agent (bsc#1220170)
  * Fix: report: use ClusterShell for ssh (bsc#1220170)</changelog>
  <changelog author="XLiang@suse.com" date="1713960000">- Update to version 4.6.0+20240422.73eaf02a:
  * Fix: bootstrap: Detect cluster service on init node before saving the canonical hostname (bsc#1222714)
  * Dev: report: Collect quorum/qdevice/qnetd status
  * Fix: utils: set env `CIB_shadow` using `os.environ` (bsc#1205925)
  * Fix: pass env to child process explicitly (bsc#1205925)
  * Fix: term: unset env `COLUMNS` and `ROWS` (bsc#1205925)
  * Fix: sh: pass env to child process explicitly (bsc#1205925)
  * Fix: bootstrap: Remove unused -i option when calling csync2_remote and ssh_remote stage (bsc#1212080)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1718625600">- Update to version 4.6.0+20240617.88b0c50:
  * Fix: upgradeutil: refine error handling (bsc#1226147, bsc#1223371)
  * Dev: ui_resource: Improve completers for 'crm resource' command
  * Fix: cmd_status: call crm_mon without shell (#1429)
  * Dev: log an error when fencing node without stonith device configured and running
  * Fix: healthcheck: KeyError when local nodename not found in cib (bsc#1223438)
  * Dev: utils: Add info when property is newly added
  * Dev: corosync: Show corosync cpg status in `crm corosync status cpg`
  * Dev: ui_context: ignore requirements when option --help is specified
  * Dev: ui_context: Skip querying CIB when in a sublevel or help command
  * Dev: bootstrap: Setup the stage dependency on init and join side (bsc#1175865, bsc#1219940)
  * Dev: bootstrap: Enhance stage validation
  * Dev: bash_completion: Enable complete 'id=' on non-interactive mode</changelog>
  <changelog author="nicholas.yang@suse.com" date="1721390400">- Update to version 4.6.0+20240718.c5fa894:
  * Dev: prun: add more possible libexec PATH for sftp-server
  * Fix: qdevice: config "tls" should accept value "required" (bsc#1227649)
  * Fix: bootstrap: refine the wording in the question asking TLS config for qdevice (bsc#1227649)
  * Fix: qdevice: TLS certs should always be generated for qnetd (bsc#1227649)
  * Fix: cli: loading cib should be a soft depenedency
  * Dev: ui_context: refactor NON_FUNCTIONAL_COMMAND and NON_FUNCTIONAL_OPTIONS
  * Revert changes to `quit` and `up` in ui_context from #1300 (#1466)
  * Fix: cibconfig: do not load cib to check if cib is changed (#1466)
  * Dev: ra: Refine RAInfo.params interface to exclude some completion results
  * Dev: ui_context: Don't append space when completion ends with equal sign
  * Dev: ui_configure: Complete required parameters first
  * Fix: ui_context: crm configure up prompt #1466
  * Fix: ui_context: crm cluster delete autocompletion #1403 #1460
  * Dev: ra: Guess stonith class type when using fence agents
  * Fix: cibconfig: Disable complete advised operation values when adding a rsc_template</changelog>
</package>
<package pkgid="3d2d60288324dc34d6bac5962c7eb39d7031c87868ef24164f569fc237ca6842" name="crmsh-test" arch="noarch">
  <version epoch="0" ver="4.6.0+20240617.88b0c50" rel="150600.3.3.2"/>
  <changelog author="nicholas.yang@suse.com" date="1674475200">- Update to version 4.4.1+20230117.fb8b3c2b:
  * Dev: healthcheck: allow using non-root sudoer for remote access (jsc#PED-290)
  * Dev: bootstrap: implement swapping hacluster's ssh key using non-root sudoer remote access (jsc#PED-290)
  * Dev: utils: Check current user's privilege and give hints to user (jsc#PED-290)
  * Feature: replace root by a custom user with root privileges (jsc#PED-290)</changelog>
  <changelog author="XLiang@suse.com" date="1676635200">- Update to version 4.4.1+20230217.7fe11a5c:
  * Dev: report: Enable crm report for sudoer user
  * Dev: bootstrap: allow the cluster to operate with ssh session under non-root sudoer (jsc#PED-290)
  * Dev: utils: Add sudo for the commands in user hints
  * Fix: hawk fails to parse the slash (bsc#1206217)
  * Fix: extra logs while configuring passwordless (bsc#1207720)</changelog>
  <changelog author="XLiang@suse.com" date="1677240000">- Update to version 4.4.1+20230224.498677ab:
  * Dev: upgradeutil: do upgrade silently (bsc#1208327, bsc#1206183)
  * Fix: bootstrap: `crm cluster join ssh` raises TypeError (bsc#1208327)
  * Dev: utils: Change the way to get pacemaker's version (bsc#1208216)</changelog>
  <changelog author="XLiang@suse.com" date="1677844800">- Update to version 4.4.1+20230302.2b5310b9:
  * Fix: qdevice: Unable to setup qdevice under non-root user (bsc#1208770)</changelog>
  <changelog author="XLiang@suse.com" date="1678449600">- Update to version 4.5.0+20230309.a4c4192d:
  * Dev: version: Bump crmsh version to 4.5.0
  * Fix: report: Fix crm report issue under non-root user
  * Fix: log: Redirect debug messages into stderr (bsc#1208991)</changelog>
  <changelog author="XLiang@suse.com" date="1680177600">- Update to version 4.5.0+20230329.6d95249b:
  * Fix: utils: qdevice initialization should user_pair_for_ssh() to get appreciated users
  * Fix: crm report: sustain if there are offline nodes (bsc#1209480)
  * Fix: validate ssh session when the users is determined by guessing (bsc#1209193)
  * Fix: parallax: Use 'sudo bash -c' when executing commands via sudoer (bsc#1209192)</changelog>
  <changelog author="XLiang@suse.com" date="1682683200">- Update to version 4.5.0+20230427.11d11104:
  * Fix: bootstrap: crm cluster join default behavior change in ssh key handling (bsc#1210693)
  * Fix: help: Long time to load and parse crm.8.adoc (bsc#1210198)
  * Fix: cibconfig: use any existing rsc_defaults set rather than create another one (bsc#1210614)
  * Fix: lock: Join node failed to wait init node finished (bsc#1210332)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1683806400">- Update to version 4.5.0+20230510.847a251:
  * Fix: bootstrap: `init --qnetd-hostname` fails when username is not specified (bsc#1211200)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1688731200">- Update to version 4.5.0+20230705.ea8c76f:
  * Fix: ui_context: wait4dc should assume a subcommand completes successfully if no exceptions are raised (bsc#1212992)
  * Fix: upgradeutil: do not tried to upgrade when the cluster is partially set up (bsc#1211817)
  * Fix: bootstrap: fix the validation of option -N and -c (bsc#1212436)
  * Fix: geo_cluster: the behavior of choosing a default user in geo_join/geo_init_arbitrator is different with `cluster join` (bsc#1211817)
  * Fix: utils: do not use sudoer user to create ssh session unless it is specified explicitly (bsc#1211817)
  * medium: ui_node: fix cib rollback race on node standby
  * Dev: ui_cluster: Use 'CustomAppendAction' instead of 'append' argparse action
  * Dev: bootstrap: Configure ssh key when fetch geo config (bsc#1210709)
  * Dev: cmd_status: Use --output-as option instead of deprecated --as-html and --as-xml options
  * Dev: cmd_status: Append 'with quorum' and 'WITHOUT quorum' to display keyword list
  * Fix: bootstrap: failed to save username for localhost when initializing a cluster with a qnet server
  * Fix: utils: fix `cluster diff --checksum` (bsc#1210709)
  * Dev: geo: implement non-root support for geo_fetch_config() (bsc#1210709)
  * Fix: bootstrap: failed to join when the cluster is initialized with skip_csync2 (bsc#1210709)
  * Dev: prun: implement timeout (bsc#1210709)
  * Dev: prun: add an concurrency limiter (bsc#1210709)
  * Dev: scripts: implement non-root support with crmsh.prun (bsc#1210709)
  * Dev: implement non-root support for crm_pssh with crmsh.prun (bsc#1210709)
  * Dev: refine non-root sudoer support for crmsh.parallax (bsc#1210709)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1690545600">- Update to version 4.5.0+20230725.5d35bb6:
  * Fix: upgradeutil: support the change of path of upgrade_seq in crmsh-4.5 (bsc#1213050)</changelog>
  <changelog author="XLiang@suse.com" date="1691496000">- Update to version 4.5.0+20230809.ddb17a0b:
  * Fix: userdir: Get the effictive user name instead of using getpass.getuser (bsc#1213821)
  * Dev: requirements: remove parallax</changelog>
  <changelog author="XLiang@suse.com" date="1697025600">- Update to version 4.5.0+20231010.65aa0a09:
  * Fix: report: Pick up tarball suffix dynamically (bsc#1215438)
  * Fix: report: Pick 'gzip' as the first compress prog for cross-platform compatibility(bsc#1215438)
  * Fix: constants: Add several resource meta attributes (bsc#1215319)
  * Fix: upgradeutil: reduce the timeout for getting sequence from remote node (bsc#1213797)
  * Dev: corosync: Enable logging.to_logfile</changelog>
  <changelog author="nicholas.yang@suse.com" date="1700827200">- Update to version 4.6.0+20231123.50296e9:
  * Fix: sh: raise AuthorizationError and generate diagnose messages when ClusterShell fails with 255
  * Dev: bootstrap: allow to authenticate interactively in `crm cluster join --use-ssh-agent`
  * Dev: ssh-agent: add informative logging for adding keys to authorized_keys
  * Dev: ssh-agent: add diagnose messages
  * Dev: bootstrap: implement ssh-agent support for geo cluster (jsc#PED-5774)
  * Dev: bootstrap: refine key swap for user `hacluster`
  * Dev: bootstrap: implement ssh-agent support for qdevice (jsc#PED-5774)
  * Dev: bootstrap: implement ssh-agent support (jsc#PED-5774)
  * Dev: cmd_status: Show error correctly for crm status
  * Dev: ui_utils: Supports '=' when setting node/resource attributes
  * Fix: report: Pick up tarball suffix dynamically (bsc#1215438)
  * Fix: report: Pick 'gzip' as the first compress prog for cross-platform compatibility(bsc#1215438)
  * Fix: constants: Add several resource meta attributes (bsc#1215319)
  * Dev: spec: Remove %generate_buildrequires to prevent OBS build failures on SLE15SP5 and Leap15.5
  * Dev: refactor shell calling routines</changelog>
  <changelog author="XLiang@suse.com" date="1701950400">- Update to version 4.6.0+20231206.a903b854:
  * To polish and improve crm report along with PED-5774 (jsc#PED-5774)
  * Fix: bootstrap: fix the owner and permission of file authorized_keys (bsc#1217279)
  * Fix: prun: should not call user_pair_for_ssh() when target host is localhost (bsc#1217094)
  * Fix: utils: Add 'sudo' only when there is a sudoer(bsc#1215549)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1703160000">- Update to version 4.6.0+20231215.4b06740f:
  * Dev: ui_cluster: Move --use-ssh-agent to optional arguments
  * Fix: ui_cluster: Improve the process of 'crm cluster stop' (bsc#1213889)
  * Dev: log: save backtrace of ValueError in logfile and suppress it in console (bsc#1217924)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1704196800">- Update to version 4.6.0+20231228.83bf1514:
  * Dev: ui_corosync: Add a completer for corosync.set to enumerate all current paths
  * Dev: bootstrap: Assign hosts with _context.node_list_in_cluster in join_ssh_merge (bsc#1218331)</changelog>
  <changelog author="XLiang@suse.com" date="1708603200">- Update to version 4.6.0+20240221.58aa13d1:
  * Fix: ui_node: clearstate command needs adjustment (bsc#1219831)
  * Fix: bootstrap: fail to join a cluster with hostname alias
  * Fix: bootstrap: clear stall data about ssh users left possiblely from previous setups (bsc#1219476, bsc#1219535)
  * Fix: report: Escape special characters in pattern (bsc#1220022)
  * Fix: ui_cluster: Can't start cluster with --all option if no cib (bsc#1219052)
  * Fix: bootstrap: ssh key of the init node is duplicated in the authorized_keys files of other node (bsc#1218940)
  * Fix: sh: guide users to setup key-based ssh authentication when non-interactive authentcation fails (bsc#1219045)
  * Fix: report: Unable to gather log files that are in the syslog format (bsc#1218491)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1709553600">- Update to version 4.6.0+20240227.21cbb9ee:
  * Fix: add diagnostic messages when crm report cannot find ssh-agent (bsc#1219538)
  * Fix: crm report hangs in the root passwordless with ssh-agent (bsc#1220170)
  * Fix: report: use ClusterShell for ssh (bsc#1220170)</changelog>
  <changelog author="XLiang@suse.com" date="1713960000">- Update to version 4.6.0+20240422.73eaf02a:
  * Fix: bootstrap: Detect cluster service on init node before saving the canonical hostname (bsc#1222714)
  * Dev: report: Collect quorum/qdevice/qnetd status
  * Fix: utils: set env `CIB_shadow` using `os.environ` (bsc#1205925)
  * Fix: pass env to child process explicitly (bsc#1205925)
  * Fix: term: unset env `COLUMNS` and `ROWS` (bsc#1205925)
  * Fix: sh: pass env to child process explicitly (bsc#1205925)
  * Fix: bootstrap: Remove unused -i option when calling csync2_remote and ssh_remote stage (bsc#1212080)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1718625600">- Update to version 4.6.0+20240617.88b0c50:
  * Fix: upgradeutil: refine error handling (bsc#1226147, bsc#1223371)
  * Dev: ui_resource: Improve completers for 'crm resource' command
  * Fix: cmd_status: call crm_mon without shell (#1429)
  * Dev: log an error when fencing node without stonith device configured and running
  * Fix: healthcheck: KeyError when local nodename not found in cib (bsc#1223438)
  * Dev: utils: Add info when property is newly added
  * Dev: corosync: Show corosync cpg status in `crm corosync status cpg`
  * Dev: ui_context: ignore requirements when option --help is specified
  * Dev: ui_context: Skip querying CIB when in a sublevel or help command
  * Dev: bootstrap: Setup the stage dependency on init and join side (bsc#1175865, bsc#1219940)
  * Dev: bootstrap: Enhance stage validation
  * Dev: bash_completion: Enable complete 'id=' on non-interactive mode</changelog>
</package>
<package pkgid="cfef954f9cf62d45a640317b124c7cacb8bf10c4ae345bedaad93bdbdf840540" name="crmsh-test" arch="noarch">
  <version epoch="0" ver="4.6.0+20240718.c5fa894" rel="150600.3.6.2"/>
  <changelog author="XLiang@suse.com" date="1676635200">- Update to version 4.4.1+20230217.7fe11a5c:
  * Dev: report: Enable crm report for sudoer user
  * Dev: bootstrap: allow the cluster to operate with ssh session under non-root sudoer (jsc#PED-290)
  * Dev: utils: Add sudo for the commands in user hints
  * Fix: hawk fails to parse the slash (bsc#1206217)
  * Fix: extra logs while configuring passwordless (bsc#1207720)</changelog>
  <changelog author="XLiang@suse.com" date="1677240000">- Update to version 4.4.1+20230224.498677ab:
  * Dev: upgradeutil: do upgrade silently (bsc#1208327, bsc#1206183)
  * Fix: bootstrap: `crm cluster join ssh` raises TypeError (bsc#1208327)
  * Dev: utils: Change the way to get pacemaker's version (bsc#1208216)</changelog>
  <changelog author="XLiang@suse.com" date="1677844800">- Update to version 4.4.1+20230302.2b5310b9:
  * Fix: qdevice: Unable to setup qdevice under non-root user (bsc#1208770)</changelog>
  <changelog author="XLiang@suse.com" date="1678449600">- Update to version 4.5.0+20230309.a4c4192d:
  * Dev: version: Bump crmsh version to 4.5.0
  * Fix: report: Fix crm report issue under non-root user
  * Fix: log: Redirect debug messages into stderr (bsc#1208991)</changelog>
  <changelog author="XLiang@suse.com" date="1680177600">- Update to version 4.5.0+20230329.6d95249b:
  * Fix: utils: qdevice initialization should user_pair_for_ssh() to get appreciated users
  * Fix: crm report: sustain if there are offline nodes (bsc#1209480)
  * Fix: validate ssh session when the users is determined by guessing (bsc#1209193)
  * Fix: parallax: Use 'sudo bash -c' when executing commands via sudoer (bsc#1209192)</changelog>
  <changelog author="XLiang@suse.com" date="1682683200">- Update to version 4.5.0+20230427.11d11104:
  * Fix: bootstrap: crm cluster join default behavior change in ssh key handling (bsc#1210693)
  * Fix: help: Long time to load and parse crm.8.adoc (bsc#1210198)
  * Fix: cibconfig: use any existing rsc_defaults set rather than create another one (bsc#1210614)
  * Fix: lock: Join node failed to wait init node finished (bsc#1210332)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1683806400">- Update to version 4.5.0+20230510.847a251:
  * Fix: bootstrap: `init --qnetd-hostname` fails when username is not specified (bsc#1211200)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1688731200">- Update to version 4.5.0+20230705.ea8c76f:
  * Fix: ui_context: wait4dc should assume a subcommand completes successfully if no exceptions are raised (bsc#1212992)
  * Fix: upgradeutil: do not tried to upgrade when the cluster is partially set up (bsc#1211817)
  * Fix: bootstrap: fix the validation of option -N and -c (bsc#1212436)
  * Fix: geo_cluster: the behavior of choosing a default user in geo_join/geo_init_arbitrator is different with `cluster join` (bsc#1211817)
  * Fix: utils: do not use sudoer user to create ssh session unless it is specified explicitly (bsc#1211817)
  * medium: ui_node: fix cib rollback race on node standby
  * Dev: ui_cluster: Use 'CustomAppendAction' instead of 'append' argparse action
  * Dev: bootstrap: Configure ssh key when fetch geo config (bsc#1210709)
  * Dev: cmd_status: Use --output-as option instead of deprecated --as-html and --as-xml options
  * Dev: cmd_status: Append 'with quorum' and 'WITHOUT quorum' to display keyword list
  * Fix: bootstrap: failed to save username for localhost when initializing a cluster with a qnet server
  * Fix: utils: fix `cluster diff --checksum` (bsc#1210709)
  * Dev: geo: implement non-root support for geo_fetch_config() (bsc#1210709)
  * Fix: bootstrap: failed to join when the cluster is initialized with skip_csync2 (bsc#1210709)
  * Dev: prun: implement timeout (bsc#1210709)
  * Dev: prun: add an concurrency limiter (bsc#1210709)
  * Dev: scripts: implement non-root support with crmsh.prun (bsc#1210709)
  * Dev: implement non-root support for crm_pssh with crmsh.prun (bsc#1210709)
  * Dev: refine non-root sudoer support for crmsh.parallax (bsc#1210709)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1690545600">- Update to version 4.5.0+20230725.5d35bb6:
  * Fix: upgradeutil: support the change of path of upgrade_seq in crmsh-4.5 (bsc#1213050)</changelog>
  <changelog author="XLiang@suse.com" date="1691496000">- Update to version 4.5.0+20230809.ddb17a0b:
  * Fix: userdir: Get the effictive user name instead of using getpass.getuser (bsc#1213821)
  * Dev: requirements: remove parallax</changelog>
  <changelog author="XLiang@suse.com" date="1697025600">- Update to version 4.5.0+20231010.65aa0a09:
  * Fix: report: Pick up tarball suffix dynamically (bsc#1215438)
  * Fix: report: Pick 'gzip' as the first compress prog for cross-platform compatibility(bsc#1215438)
  * Fix: constants: Add several resource meta attributes (bsc#1215319)
  * Fix: upgradeutil: reduce the timeout for getting sequence from remote node (bsc#1213797)
  * Dev: corosync: Enable logging.to_logfile</changelog>
  <changelog author="nicholas.yang@suse.com" date="1700827200">- Update to version 4.6.0+20231123.50296e9:
  * Fix: sh: raise AuthorizationError and generate diagnose messages when ClusterShell fails with 255
  * Dev: bootstrap: allow to authenticate interactively in `crm cluster join --use-ssh-agent`
  * Dev: ssh-agent: add informative logging for adding keys to authorized_keys
  * Dev: ssh-agent: add diagnose messages
  * Dev: bootstrap: implement ssh-agent support for geo cluster (jsc#PED-5774)
  * Dev: bootstrap: refine key swap for user `hacluster`
  * Dev: bootstrap: implement ssh-agent support for qdevice (jsc#PED-5774)
  * Dev: bootstrap: implement ssh-agent support (jsc#PED-5774)
  * Dev: cmd_status: Show error correctly for crm status
  * Dev: ui_utils: Supports '=' when setting node/resource attributes
  * Fix: report: Pick up tarball suffix dynamically (bsc#1215438)
  * Fix: report: Pick 'gzip' as the first compress prog for cross-platform compatibility(bsc#1215438)
  * Fix: constants: Add several resource meta attributes (bsc#1215319)
  * Dev: spec: Remove %generate_buildrequires to prevent OBS build failures on SLE15SP5 and Leap15.5
  * Dev: refactor shell calling routines</changelog>
  <changelog author="XLiang@suse.com" date="1701950400">- Update to version 4.6.0+20231206.a903b854:
  * To polish and improve crm report along with PED-5774 (jsc#PED-5774)
  * Fix: bootstrap: fix the owner and permission of file authorized_keys (bsc#1217279)
  * Fix: prun: should not call user_pair_for_ssh() when target host is localhost (bsc#1217094)
  * Fix: utils: Add 'sudo' only when there is a sudoer(bsc#1215549)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1703160000">- Update to version 4.6.0+20231215.4b06740f:
  * Dev: ui_cluster: Move --use-ssh-agent to optional arguments
  * Fix: ui_cluster: Improve the process of 'crm cluster stop' (bsc#1213889)
  * Dev: log: save backtrace of ValueError in logfile and suppress it in console (bsc#1217924)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1704196800">- Update to version 4.6.0+20231228.83bf1514:
  * Dev: ui_corosync: Add a completer for corosync.set to enumerate all current paths
  * Dev: bootstrap: Assign hosts with _context.node_list_in_cluster in join_ssh_merge (bsc#1218331)</changelog>
  <changelog author="XLiang@suse.com" date="1708603200">- Update to version 4.6.0+20240221.58aa13d1:
  * Fix: ui_node: clearstate command needs adjustment (bsc#1219831)
  * Fix: bootstrap: fail to join a cluster with hostname alias
  * Fix: bootstrap: clear stall data about ssh users left possiblely from previous setups (bsc#1219476, bsc#1219535)
  * Fix: report: Escape special characters in pattern (bsc#1220022)
  * Fix: ui_cluster: Can't start cluster with --all option if no cib (bsc#1219052)
  * Fix: bootstrap: ssh key of the init node is duplicated in the authorized_keys files of other node (bsc#1218940)
  * Fix: sh: guide users to setup key-based ssh authentication when non-interactive authentcation fails (bsc#1219045)
  * Fix: report: Unable to gather log files that are in the syslog format (bsc#1218491)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1709553600">- Update to version 4.6.0+20240227.21cbb9ee:
  * Fix: add diagnostic messages when crm report cannot find ssh-agent (bsc#1219538)
  * Fix: crm report hangs in the root passwordless with ssh-agent (bsc#1220170)
  * Fix: report: use ClusterShell for ssh (bsc#1220170)</changelog>
  <changelog author="XLiang@suse.com" date="1713960000">- Update to version 4.6.0+20240422.73eaf02a:
  * Fix: bootstrap: Detect cluster service on init node before saving the canonical hostname (bsc#1222714)
  * Dev: report: Collect quorum/qdevice/qnetd status
  * Fix: utils: set env `CIB_shadow` using `os.environ` (bsc#1205925)
  * Fix: pass env to child process explicitly (bsc#1205925)
  * Fix: term: unset env `COLUMNS` and `ROWS` (bsc#1205925)
  * Fix: sh: pass env to child process explicitly (bsc#1205925)
  * Fix: bootstrap: Remove unused -i option when calling csync2_remote and ssh_remote stage (bsc#1212080)</changelog>
  <changelog author="nicholas.yang@suse.com" date="1718625600">- Update to version 4.6.0+20240617.88b0c50:
  * Fix: upgradeutil: refine error handling (bsc#1226147, bsc#1223371)
  * Dev: ui_resource: Improve completers for 'crm resource' command
  * Fix: cmd_status: call crm_mon without shell (#1429)
  * Dev: log an error when fencing node without stonith device configured and running
  * Fix: healthcheck: KeyError when local nodename not found in cib (bsc#1223438)
  * Dev: utils: Add info when property is newly added
  * Dev: corosync: Show corosync cpg status in `crm corosync status cpg`
  * Dev: ui_context: ignore requirements when option --help is specified
  * Dev: ui_context: Skip querying CIB when in a sublevel or help command
  * Dev: bootstrap: Setup the stage dependency on init and join side (bsc#1175865, bsc#1219940)
  * Dev: bootstrap: Enhance stage validation
  * Dev: bash_completion: Enable complete 'id=' on non-interactive mode</changelog>
  <changelog author="nicholas.yang@suse.com" date="1721390400">- Update to version 4.6.0+20240718.c5fa894:
  * Dev: prun: add more possible libexec PATH for sftp-server
  * Fix: qdevice: config "tls" should accept value "required" (bsc#1227649)
  * Fix: bootstrap: refine the wording in the question asking TLS config for qdevice (bsc#1227649)
  * Fix: qdevice: TLS certs should always be generated for qnetd (bsc#1227649)
  * Fix: cli: loading cib should be a soft depenedency
  * Dev: ui_context: refactor NON_FUNCTIONAL_COMMAND and NON_FUNCTIONAL_OPTIONS
  * Revert changes to `quit` and `up` in ui_context from #1300 (#1466)
  * Fix: cibconfig: do not load cib to check if cib is changed (#1466)
  * Dev: ra: Refine RAInfo.params interface to exclude some completion results
  * Dev: ui_context: Don't append space when completion ends with equal sign
  * Dev: ui_configure: Complete required parameters first
  * Fix: ui_context: crm configure up prompt #1466
  * Fix: ui_context: crm cluster delete autocompletion #1403 #1460
  * Dev: ra: Guess stonith class type when using fence agents
  * Fix: cibconfig: Disable complete advised operation values when adding a rsc_template</changelog>
</package>
<package pkgid="4d3f6d1a773cc441721c0fb4ab4eb3b6e965fa64f1513d1b31e38a4bfb1fc962" name="cross-aarch64-binutils" arch="ppc64le">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="a964408ef1dea569d1cb42d084b83421fef3f604d5319d9e7ebfce961f0861eb" name="cross-aarch64-binutils" arch="s390x">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="0a97fe114956764d83a1a2c3c27c61e69441aead9157d3cc724ec28dbc09057f" name="cross-aarch64-binutils" arch="src">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="4b89bb43bb4855b456603f36cd13ce33734d16db874ef33b3e1be1625a570b80" name="cross-aarch64-binutils" arch="x86_64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="da745510418c4dd620ad37075604b1907f320a5135c6f89e544471e88b3e4e77" name="cross-aarch64-gcc13-bootstrap" arch="ppc64le">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="5f1cc8e3378e9bf1c461f0edd6965b3c4c27b270a5e6ab65eb10364526a08fa5" name="cross-aarch64-gcc13-bootstrap" arch="s390x">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="83b741a0004632e20d9689d877630b849f718220b04f9c05e11b43b7ff080964" name="cross-aarch64-gcc13-bootstrap" arch="src">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="6a714112f49b8a7446ddd30b1037195bd0c262b03807c6581b38f2b0094ff44b" name="cross-aarch64-gcc13-bootstrap" arch="x86_64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="c8323728decb1b01ef5890d6f6a01b59f904d6b27ab0be9142ca7d420bf3e301" name="cross-arm-binutils" arch="aarch64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="337aafac1096054ea56fb1ce9220c0c8fc0e9d6c4804fe21fe827c12b266b680" name="cross-arm-binutils" arch="ppc64le">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="3bb88993ffee2becfc2b2399b1868356ee7d28bec0602af5ef5c5e38e06c0e24" name="cross-arm-binutils" arch="s390x">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="44c03e29451dbd8dac0441b7fb65fd1795ac8e7d85457f2395ccfdeaa12636a4" name="cross-arm-binutils" arch="src">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="f73cfa6ef9ab93cd182f329ff510f075609eb0a6876cbd788672ce7813e858ea" name="cross-arm-binutils" arch="x86_64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="d68adf394fcc86e410171eee62e212c73d696176bba824e7baf1d94aff523c2a" name="cross-arm-gcc13" arch="aarch64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="8101e85503519fa251ffc120b87b2a63032b8dcd491b89f9b710505cdb2db98f" name="cross-arm-gcc13" arch="ppc64le">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="9581c492c3342d2be87c8e18ec212541a35a6459d607e3b7ddceb45619fa3163" name="cross-arm-gcc13" arch="s390x">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="abe4ffb2425f726ab605083f864b4b292c4e0ae6aba0fafd184ce79e5916c81c" name="cross-arm-gcc13" arch="src">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="1beb84cb1c4491f83f31376fcd7ef2aa51592b94203674e3274467d6c3a6b3a7" name="cross-arm-gcc13" arch="x86_64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="36e7ec3d887b04356095f5bdc20157ff44163a76d451739d65ce2b788a6ffa64" name="cross-arm-gcc13-icecream-backend" arch="aarch64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="e6e241c69d3eba6995ee9d0cc7aa249a638398f69baece0654634d8960970dea" name="cross-arm-gcc13-icecream-backend" arch="ppc64le">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="c623d8d1850b6d3b84ec44cf433f11adaf85e7a6377d3d9de024164a2ad485c8" name="cross-arm-gcc13-icecream-backend" arch="s390x">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="6fff722eb7fe4e6c5a1e578acebf061b9c6e1fd3e7231c0e97a8354ad06246d7" name="cross-arm-gcc13-icecream-backend" arch="x86_64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="6ab50bb57920801c722b3f95d04412d3e7c8b320e96f270d3a314d4c239301fd" name="cross-arm-none-gcc13-bootstrap" arch="aarch64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="3aae686cf726245a70276d40847ed53f67fa4a7f698cc092ac1882373abc58cd" name="cross-arm-none-gcc13-bootstrap" arch="ppc64le">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="8b2c679a36f8a51eb23ac9d3d09c735c46c9c3f4e39d8a94105e3bdf16f7041a" name="cross-arm-none-gcc13-bootstrap" arch="s390x">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="03e973729b99bae1a65af6b2c94b9a6283fc87cf2845f81a2cc3d5617b823c0e" name="cross-arm-none-gcc13-bootstrap" arch="src">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="c8e8388bf380fc204e76ed44985d09576853df6e2f2e9b6b28d12154aa504e30" name="cross-arm-none-gcc13-bootstrap" arch="x86_64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="8c8fe0736c007b7a8671c9c940f5d1232b8fdc685ab5432ce9b04db83ed8521b" name="cross-avr-binutils" arch="aarch64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="0d70a6a78ee83804d820e8e038c4f94df9f99cf7c5971ad8904a92afb951c5a1" name="cross-avr-binutils" arch="ppc64le">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="87efef0cac3ee4f33f6d64bd512f61574a59bf8139ee8eb80126292cf7ac7a87" name="cross-avr-binutils" arch="s390x">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="b343cbc75fcb4848e326585e428df6e8b85115a2a3181b1a14da4fc92d02aa13" name="cross-avr-binutils" arch="src">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="2db9691cb553214fa65307d4858d0cd857405a5b57c2403151405152ef61b8eb" name="cross-avr-binutils" arch="x86_64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="70ae8816db56e30a5b0b15ad001c2a979949cc69830eb0448f47f56108f66e25" name="cross-avr-gcc13-bootstrap" arch="aarch64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="9cf83ed316da0372f41910c51c85ab45bdb9da3c73e68d65d64a855648a24268" name="cross-avr-gcc13-bootstrap" arch="ppc64le">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="5310e23c4488c256eddd886320a38de7d5897e2a1369fbaab52ba51033b6770d" name="cross-avr-gcc13-bootstrap" arch="s390x">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="4be177b241ec9d5d6e0b5378d7171698dafaafa9987d95178ef622fb08ea5217" name="cross-avr-gcc13-bootstrap" arch="src">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="b9512cca7573f8c282e3f357b258a80dd0bd1e5f2bbd7ac19d215ff39843cef7" name="cross-avr-gcc13-bootstrap" arch="x86_64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="23db3ce82d4b0471cf411d90a70c7b224e49ab3a53049d1702e26e9038cfb3c5" name="cross-bpf-binutils" arch="aarch64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="27d3e4a6bb4abd4def3bb5e214e3d997b003fcdae02df945a36b9876a68419db" name="cross-bpf-binutils" arch="ppc64le">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="b730d17da750eb62b7bcf1e0e4b6087b9a11baefb61c623ff786e7c91fd92776" name="cross-bpf-binutils" arch="s390x">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="f49b11ff8fd3c81a854971ce1ba5f26b89500d7fb028fff025bdffd3589e1864" name="cross-bpf-binutils" arch="src">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="3e725e3a0ba4cc643b52c6a6434a478d6f3ffbdf7307ddc31d3cc5347c03e624" name="cross-bpf-binutils" arch="x86_64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="4af5493a4ed66994ecf7fbe65f820ca7ba3a12f473735f580a2789bf7442c1e1" name="cross-bpf-gcc13" arch="aarch64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="7a4d99cd5e1b02a49dd877482d0bfba9531f83076cf687f914ff318a64fc81cf" name="cross-bpf-gcc13" arch="ppc64le">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="e3deeafadf28f758575cc68c7a5574800a0eabde0c30d6be7bcd4a9034bc3de0" name="cross-bpf-gcc13" arch="s390x">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="7241c337a60490078b03df301e2efe2a1a5189211774a1bdf5d6d3c633f06d14" name="cross-bpf-gcc13" arch="src">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="c401938f6994fb8abaeeee53ae2f64ba015b426bcc0af17cdbbcee79fa595ef8" name="cross-bpf-gcc13" arch="x86_64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="489574d18587537e355fc4abcba1e2cbaaf150866342fb811a0029bdec92baaa" name="cross-epiphany-binutils" arch="aarch64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="374f8f90a2bf1114bf1e618764f934eeaf3802adc051363a5b474880efd098d8" name="cross-epiphany-binutils" arch="ppc64le">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="59e6b2149ca4dbeff7fbd8ed3d24fb1cb4b18f52a2ce331788eebc908d0a9f7a" name="cross-epiphany-binutils" arch="s390x">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="01c44023feb6639aec96f72e069a99790c9f495e6154ca935d3830c439a1581d" name="cross-epiphany-binutils" arch="src">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="4d3d081b15d3d8a44e62646c6ec46fa3cee55fd41e3dd242d9be1ce3563122d9" name="cross-epiphany-binutils" arch="x86_64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="ce8cf9d0753ecf30ee9d4ece4384d0d06bf3f3e78a3e5c505397757febc4faf3" name="cross-epiphany-gcc13-bootstrap" arch="aarch64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="77599774004c0da220b0a90e91f67576fb756ac2cc50b2b71cec712b0c804521" name="cross-epiphany-gcc13-bootstrap" arch="ppc64le">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="b49fe9d9e50ed8f744995e76fddb9e6603a4b19f40dc59dc7c2c3325526d510e" name="cross-epiphany-gcc13-bootstrap" arch="s390x">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="c6194cae2daa667a0c6c91fadc751f1341a0340d736e79f0de1809faf32e80b7" name="cross-epiphany-gcc13-bootstrap" arch="src">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="50737fe4bef31408986fd5a917da9c0375efda5b22e08b2146e96e788b59b677" name="cross-epiphany-gcc13-bootstrap" arch="x86_64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="e38cc8778d3f938bd92c3989f27e649bd09bcbf08da165c4b61b0b9a4dfc9e40" name="cross-hppa-binutils" arch="aarch64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="8eb972fd062c14968be122a6fb74c88be0503ed59b7cca37eca0853c84be65d8" name="cross-hppa-binutils" arch="ppc64le">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="a87f1f204c4c2dced442cf732c5823d26923ed5403687936649ec8339248852e" name="cross-hppa-binutils" arch="s390x">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="455245361869654dc07ec116e04939340d057498b0c1cb6a2dddeffd4eba1940" name="cross-hppa-binutils" arch="src">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="b5788a085165b4d42b05b343bb30674fe1d52e79e12392a8a230aed749ecd595" name="cross-hppa-binutils" arch="x86_64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="dadd79cd61286589447059a58ab542aa48e581346ff039f7ceaa46e80d723724" name="cross-hppa-gcc13" arch="aarch64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="d3113dfc695d2b01e02da8a4bbcb5aee4534f9a1de479e0451f2b246ff456192" name="cross-hppa-gcc13" arch="ppc64le">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="9362099fa3ad84019d9665ce5cdf7a271e82cc71cf03835e3ed603deb4e401f4" name="cross-hppa-gcc13" arch="s390x">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="259806670c427358cc5f60461d2e419a6d17d9042b1c7ec6e40af64b6c673832" name="cross-hppa-gcc13" arch="src">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="dfac256499bfd7bc5aaedb9f8485e2b7f98c63813a1504ac20939f4700c5d3c0" name="cross-hppa-gcc13" arch="x86_64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="465d2b670cc655037f363857e8417ae564844d29849b8eb80305c8f0790c77f3" name="cross-hppa-gcc13-bootstrap" arch="aarch64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="8d02832a12df50b8e540f2c36219e0f8be3f0f540b0294cd5d9d2bd0e64520fb" name="cross-hppa-gcc13-bootstrap" arch="ppc64le">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="7fbd3d3e9699f7957244948ba7bc09376397a30e3389580b3c58d7167236d221" name="cross-hppa-gcc13-bootstrap" arch="s390x">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="974280d8e056bf800fe23096da1e56c5416c11d01d5b925e8302e850259af2e4" name="cross-hppa-gcc13-bootstrap" arch="src">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="2b7859c4589e940357bc118f7a57055f024ff92605a704895896023fc7f9d634" name="cross-hppa-gcc13-bootstrap" arch="x86_64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="111525c662944c042a67c108f80609c87b98a0f479f6c8dbe3ef52dae5f869a1" name="cross-hppa-gcc13-icecream-backend" arch="aarch64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="8fcb30b4c191cb258cdb2f0e32d2df1880dbf9223a22769b1de173d4480fc492" name="cross-hppa-gcc13-icecream-backend" arch="ppc64le">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="b6cee3896dff98d92240cbcb55226b0c8f17d8995629397b37669c91add7f493" name="cross-hppa-gcc13-icecream-backend" arch="s390x">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="f52169a2dc9736afc8952a0218ce7ddc3b29fac16fdd06d8760d16b43dc1f897" name="cross-hppa-gcc13-icecream-backend" arch="x86_64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="15f5b7eef7fdf76169f4adbdd5398463939fc383f3b3c68b0506805d49e3633d" name="cross-hppa64-binutils" arch="aarch64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="fc5552f5a7a806529a0124b9cb7ddb1a19727a44033d2aaa6856877a27fd961c" name="cross-hppa64-binutils" arch="ppc64le">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="b057f032aca987d72ca8473d63a6f42f03df011dfcab3545886cbc606488da80" name="cross-hppa64-binutils" arch="s390x">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="10f7be38c915ad93483d0ad85486f1fd8dc1f0c468e06ec63c138b3fafa3aa81" name="cross-hppa64-binutils" arch="src">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="a0c6ca460a42f7a594208d4b5e9f261d215b1da109b02ec21c0c5963a72a142a" name="cross-hppa64-binutils" arch="x86_64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="4891c245bdf582009f412494a879bd6a918ce4d03dbdc7406b8e663f65ee2efc" name="cross-i386-binutils" arch="aarch64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="ae15dc17061e3a86ca4d3f2ede7a86ecdd3845a807e38785fee4cd7b424fad37" name="cross-i386-binutils" arch="ppc64le">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="b1f2e1ea6201dfeb80a56a56b1f0fff14e465b6a568dd242e97f2b6ef4bd76a9" name="cross-i386-binutils" arch="s390x">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="b76fa926767724306b71ec9e5702cc3aeff10ba4937dfb70b1ef2581c6b73a34" name="cross-i386-binutils" arch="src">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="0c96bc587bff3188b76a14c6bfc2b943b3de10addaea12867e392bb87543a74b" name="cross-i386-binutils" arch="x86_64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="9b5b85cfd05ab58233e5362531e128e5499a779d9da76b0171f914e110b44093" name="cross-ia64-binutils" arch="aarch64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="e8d6ad8a35aef33a6d85780ea8e8e9f7e5baadf461a04cc6b05c3784a3540d7c" name="cross-ia64-binutils" arch="ppc64le">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="b9183630a336e9e492f79db6fe0f6dbcc68aa4e926b4a4a03d62a66d3cd5f181" name="cross-ia64-binutils" arch="s390x">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="8a284364081051267d2118aa0b1578196994b6c9dfc4423d5df0bb7279673ae6" name="cross-ia64-binutils" arch="src">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="0b8c4bf6ad2273ffa7e8a3906670b98f710f70511928bed4e99fbd9495152fa7" name="cross-ia64-binutils" arch="x86_64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="932f395c54739c34f8f7ca77086f66e39fe184727aec63098adabb458a87eec2" name="cross-m68k-binutils" arch="aarch64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="b8a7b7ca640dfefcdd9d68eb522949eeff6a63fbc1bdaf8cd0ad61d9b3594181" name="cross-m68k-binutils" arch="ppc64le">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="6e5f7185b399c64f7608f95c7bc4801e02710ef382e0839e8b5e8d53af78e8fb" name="cross-m68k-binutils" arch="s390x">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="2eceadf57d105c41ed9c21a35eeebec769dfa8621b89c6a41fbc0a0d71753233" name="cross-m68k-binutils" arch="src">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="e57d0d71c3d5fd987766d049656b402675fb8acb6761931dd8ca31e312115677" name="cross-m68k-binutils" arch="x86_64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="a774a30ca5c8b88da2d7364477544ba36674d4983d15ff39a83d4fb6bf18c782" name="cross-m68k-gcc13" arch="aarch64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="c412f004275cc22979b585ae6d18496ffafd4abe6f6fe827aa1b3b45b59c7a53" name="cross-m68k-gcc13" arch="ppc64le">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="360eac21e4137cc57a8388c96471dc319f7d4344ad7443165207cc6856e3adca" name="cross-m68k-gcc13" arch="s390x">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="176b80b400f668bca4f33d8bbdb9bd5554e5b84933108458d33d58238a74331c" name="cross-m68k-gcc13" arch="src">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="9fe06f88bfb29a172a24798bf06de9ef3178dcc097c7ea7064138d52f15bb76c" name="cross-m68k-gcc13" arch="x86_64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="b7eae6c0b5649b8fc25906bd68fd534a7ebb3704965e58b21e30e330296c20e9" name="cross-m68k-gcc13-icecream-backend" arch="aarch64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="153c1432541ecc7e8d3b9b5ccfb0419e85e85be6e579dbb29fe23f9abfe6f925" name="cross-m68k-gcc13-icecream-backend" arch="ppc64le">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="df068127ca8965cb5d261af52cad05dcec9e5bff8719a43c0c2ccec9231247bb" name="cross-m68k-gcc13-icecream-backend" arch="s390x">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="78f7b55f71bad19c42aa47a6a6ea53c717e9ee4a3f19d2f1af591bcea627124e" name="cross-m68k-gcc13-icecream-backend" arch="x86_64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="8e9487393f1fcb3c4c6657e85cca5d9b1ba96a2e15f3186d53cf862785c4cc55" name="cross-mips-binutils" arch="aarch64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="81499ad200c50fc32a346883a0fe272e075a9099e937a6fa3a2cfeaab59eecd1" name="cross-mips-binutils" arch="ppc64le">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="3a0baf632e9a879f127fa4518f240d0cab6b3da2afc89b68eb7e491f6b504029" name="cross-mips-binutils" arch="s390x">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="cde86e61a1cf08a09ffde556ce61e9af12fa24d3a831591f40facd74e87ceb08" name="cross-mips-binutils" arch="src">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="0851edfd13cef8b98ba92bb48627a74768a35690e6a27af22bf977a51c203909" name="cross-mips-binutils" arch="x86_64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="4dc0dca34d3683152901b127af087ab767cfc4370a1cb2db1fbe0090b63e8f27" name="cross-mips-gcc13" arch="aarch64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="61b6fa3cb40a42114f88127d3b43ecab40d1b1dd1ad7f255925a5e085944440f" name="cross-mips-gcc13" arch="ppc64le">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="f736a4c8356e10f403399051c6ea22dfc9feeb16138ba1c5c85725da8133b443" name="cross-mips-gcc13" arch="s390x">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="dbd32179bf22cae9bff0f60eb825d7436190fb5362b1f37e842ccd863f8d2dc3" name="cross-mips-gcc13" arch="src">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="c796b284b086d6b402806950d546516cf38c33b9b9def38cce886bcc67e4d800" name="cross-mips-gcc13" arch="x86_64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="b9f6e7fc4fc23893c43cc3668e10dfa1a6f7bdecb68edd249b78b6cc0e3d4836" name="cross-mips-gcc13-icecream-backend" arch="aarch64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="4fea795eb35468fff15e9e66e3af444485b76b939c43470ea35033789c667906" name="cross-mips-gcc13-icecream-backend" arch="ppc64le">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="d5b1c8e2a9a02f4d1244c7c0ad5d0acac424c46efd475861874d14870b72f4ee" name="cross-mips-gcc13-icecream-backend" arch="s390x">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="91a89ba59dc1560cd68bbc7e2e88fb8572936e47d81467a8e73c080b7bd1165a" name="cross-mips-gcc13-icecream-backend" arch="x86_64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="8755c334cc7619f942d80d43cdeaa772c9038e8e2db57eb27102c928035b6b5c" name="cross-nvptx-gcc13" arch="src">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="cfba4817195fedc4fec50e187274a5ae27bcb8ced735cc35559843bba72941ed" name="cross-nvptx-gcc13" arch="x86_64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="d1b4b490dae789c105eeb0b823d4dac9fb969daff8489ef73639f33a4f0581e0" name="cross-nvptx-newlib13-devel" arch="x86_64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="af0fce901aed73d72fb90d4806850606c49f49a59c12ef89877be16ca72d04b3" name="cross-ppc-binutils" arch="aarch64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="ba70794856a2e36654a697fc36acca81aa99a0efdcd4337b76a42c4191118ee3" name="cross-ppc-binutils" arch="ppc64le">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="4aedf4eb2cfa2dfd38ebab526c34f84b1eabbdc36a74bc4c1db326405460641f" name="cross-ppc-binutils" arch="s390x">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="878ba63a0dd75f071f5040b55b1b3abc7f7bc91bd3ea41cbec0483b1a9298220" name="cross-ppc-binutils" arch="src">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="433e643150c704c2a40af1ec66efae302924635137f10ef3de5f1443b0a44125" name="cross-ppc-binutils" arch="x86_64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="ef8414fc28f908ac2338f882c353cc65f68829dc24dd49a477462e6b5c620f70" name="cross-ppc64-binutils" arch="aarch64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="b7441085ca7eff2dc9ac0a69eac75755926b1198f1b4d362ac60a8f7a04ffbac" name="cross-ppc64-binutils" arch="ppc64le">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="57a68d9baf0e48416888abc95e05f1e735723a4e2d7fa6817cbbe252d7117539" name="cross-ppc64-binutils" arch="s390x">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="81efe879c75437537a519d65eaab2ddd7578340bd84106b32a505c92348eba69" name="cross-ppc64-binutils" arch="src">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="609e18ebdb6a79f9a04a352e45e266fc2e9d94167ae4588f3d9c081c83ecd042" name="cross-ppc64-binutils" arch="x86_64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="7407f02058ca7768c0c67ee8859e939766fbe4560008352e7c055d317bc90108" name="cross-ppc64-gcc13" arch="aarch64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="a052d047ef305fe514e1fcd8c07165d353c2cd24b2ac97c6d99eeceb0579265a" name="cross-ppc64-gcc13" arch="ppc64le">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="3a9aee53f11830576a9cc7c792e2300e0e9b59e462ad08811e63bd8f6598e9ab" name="cross-ppc64-gcc13" arch="s390x">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="fa1b4774415cb2e2b9067195e6eae770b8b9e5139ff574363bf6d834e8b287ef" name="cross-ppc64-gcc13" arch="src">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="8a1baed52548e344ec32b297d5273ab90f4b7b7d75d37c3505f79219c6e7c7db" name="cross-ppc64-gcc13" arch="x86_64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="477e9133825046ae296053daf416d005c4ef99ea6370f9fe107e9a6a3ed1c433" name="cross-ppc64-gcc13-icecream-backend" arch="aarch64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="5c2c8b8e77ea0183a4a190d3bac204d8110c2bafed4b890183c0a0127d9cafca" name="cross-ppc64-gcc13-icecream-backend" arch="ppc64le">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="1df79455fe00250fb405f56ee89b51947d8696ee3df0c782f7758b2964501712" name="cross-ppc64-gcc13-icecream-backend" arch="s390x">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="80fd840f544c810f457b01f56ecd1ab86be69cc65d2b7643a538bcff8a6e3a44" name="cross-ppc64-gcc13-icecream-backend" arch="x86_64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="919cf5635619307429757ed781601bbe182fd392a842b0a980224ec9b9814e36" name="cross-ppc64le-binutils" arch="aarch64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="704cc4098cb697f12e6c06d39ddb14a03126016a065d64ac52f1e9855b32cbaa" name="cross-ppc64le-binutils" arch="s390x">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="259d36b823916f8d508464a16003aaf130012fed6435b55065570a0537755f6d" name="cross-ppc64le-binutils" arch="src">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="5fac18c80f8ccb3767ef0deb50ba775e030f10d9308598773b10f5c00c79b05a" name="cross-ppc64le-binutils" arch="x86_64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="941dc8ab0ac4d1063e0183b0a4d3d9b06cd32bb4bf9c9bf09733a35e24a2ac28" name="cross-ppc64le-gcc13-bootstrap" arch="aarch64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="d647c4313db7f34ca0676ecf9c33a386dde6005904d9842dba43f44feb881472" name="cross-ppc64le-gcc13-bootstrap" arch="s390x">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="da0dcb32e1d2869df06374280b6aeedd83b460e5a9c961f6fa76d577689b11b3" name="cross-ppc64le-gcc13-bootstrap" arch="src">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="952a079b29f8df134fc6b127525eb1e54065e8af2a43ce62283cabfac75a48bd" name="cross-ppc64le-gcc13-bootstrap" arch="x86_64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="73054f9515ab1b95683e617d9197acfd42c6cb98c0136e1d4b86a64520942433" name="cross-pru-binutils" arch="aarch64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="291e8a5d60d8361d4a5ac74ad01f191d9cf4b6528d062df6ee92ffdd1a03c5be" name="cross-pru-binutils" arch="ppc64le">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="574ef53d462db74a6c47ce6c92bda29af22519e9133878d006b4297deec95b61" name="cross-pru-binutils" arch="s390x">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="30505ea4d6c8060e8c7cea9559bb563fa0d5dfbb7e231a222dd97a52ac2ea9c3" name="cross-pru-binutils" arch="src">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="1027ef55897bd5ffcc5a4718b3eb059d3e7f04f5ae9195d96b625afcf7ee984e" name="cross-pru-binutils" arch="x86_64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="7a7f25c2a7541414273fc45edfa6a30d403b71a712fcc7126a286f8d373ab2b2" name="cross-pru-gcc13-bootstrap" arch="aarch64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="715cd1c5a1f432cfabc2248ff75efe0d3acd875542cedbe5217a61f201662b4a" name="cross-pru-gcc13-bootstrap" arch="ppc64le">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="a0058dd756a0da84c879294e29432673e243d4ed8849886b97030901aa80b095" name="cross-pru-gcc13-bootstrap" arch="s390x">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="c585f582fdd8c3a4f0512f77892f8c4548e6f196f6bd32814bc44469d3378fb4" name="cross-pru-gcc13-bootstrap" arch="src">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="ff92f6c2a48cfda0e4522c610f93e4f401384c168c1ab6df66cb2b80ca544dce" name="cross-pru-gcc13-bootstrap" arch="x86_64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="0cc8ffd702b8ba056ffc832b62762305a468deeb74d2a1d04cbd893e5572de51" name="cross-riscv64-binutils" arch="aarch64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="d478d5e79abeaabc7baf7fde1c511e7468fd3f53a0b4bf02b70e9fb69ea87538" name="cross-riscv64-binutils" arch="ppc64le">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="3da8c1434640b40fe894c536c6337ff635cf357da610e330c480c98e79232930" name="cross-riscv64-binutils" arch="s390x">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="02e2fbd9cd3f31dc26277f9cf4963ed33f2b674fdecda87e2771ecab162d05e9" name="cross-riscv64-binutils" arch="src">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="7746caa28d3f3ad5aedad2102e7682d433d5c529d8fafad03fe97ad2d6007c41" name="cross-riscv64-binutils" arch="x86_64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="f7cdd9fc3edbe0cf326870ed45e74de36493bdb4a1fef325d5f4aba66c50d634" name="cross-riscv64-elf-gcc13-bootstrap" arch="aarch64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="2c5b47d586d148957a802754b99a8762dc6895f338f2d14588cd09705e5056ab" name="cross-riscv64-elf-gcc13-bootstrap" arch="ppc64le">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="4864085035a65cad15bdec4f0237b9d56fa7c6740437ecd8b2d1fca331737cde" name="cross-riscv64-elf-gcc13-bootstrap" arch="s390x">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="1717f7b42df0085a22fa99f7738dc8c0773692d3652e4689cac2be238fff280b" name="cross-riscv64-elf-gcc13-bootstrap" arch="src">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="ef9c4a993bddcbabc8d8987c4d071807051e7e98a1867aa0a99c64a1d2b8d4b2" name="cross-riscv64-elf-gcc13-bootstrap" arch="x86_64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="0538a34fab8710bcb6e9e91e074c0671d1d8c53400e2660d00f679f68b3867f0" name="cross-riscv64-gcc13-bootstrap" arch="aarch64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="c037a8953e6021459f312db256695af2cba5e111e3cbde4aa152529c9b6b8b5d" name="cross-riscv64-gcc13-bootstrap" arch="ppc64le">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="602214ed7db01c74f152a0ae81f96e10028f47cdfb063c37495a36664693ba7e" name="cross-riscv64-gcc13-bootstrap" arch="s390x">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="95d4abc1e3546267e7125043fd5153d0826b910768859bf13df714f41a168859" name="cross-riscv64-gcc13-bootstrap" arch="src">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="5ccb65c25cf1cb6811c0843fdc561302bd631e005467f8a2bd3b82e83d91db30" name="cross-riscv64-gcc13-bootstrap" arch="x86_64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="a4a5e1cd0413517fa96610da3df70d0c6c0830a81ec1ba22d4650295cd336543" name="cross-rx-binutils" arch="aarch64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="2e212496405e4daa44e00f0509696102edc01bb248675d949bc382c2aba5cfe0" name="cross-rx-binutils" arch="ppc64le">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="376e2aa414c3a37cbe313c856927e128981306064aa142c4f877a9ac868231af" name="cross-rx-binutils" arch="s390x">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="4b63a11cf9b1c3f841fb75161dde47cb474a37798becf4c6c71d4623b181d8d0" name="cross-rx-binutils" arch="src">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="8769967c2401f5bfc7a496c07603df4d5fab2ab2c57c0a8ec04b7cb4bccbfdb6" name="cross-rx-binutils" arch="x86_64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="b8f3f2f6b5ed19dd5bf54020021a6e4ae0fcbc3e2523a1f9292484dae6e98a35" name="cross-rx-gcc13-bootstrap" arch="aarch64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="bde497f0e9ddee4466b8c85d14ada66a07243aef78a091c689a4afbda4ecd888" name="cross-rx-gcc13-bootstrap" arch="ppc64le">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="46b99e8fde6264afd83ea5eee7f70c1bd5cdb0bcb5934b8f87b7150529af3bac" name="cross-rx-gcc13-bootstrap" arch="s390x">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="6924f7f9f68c7157acf73c90619c8136a61584914185d49f09de353b34318218" name="cross-rx-gcc13-bootstrap" arch="src">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="14db3fdc24f70d99469ebdf6400ef351db5ff5ac9f6859650e49be1659c402b3" name="cross-rx-gcc13-bootstrap" arch="x86_64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="4f371c936c35680caa487f5d42fd494162bc1d815b2ba03b395565bae0a028d1" name="cross-s390-binutils" arch="aarch64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="72b58df3992027760ca69938b02c00580615af321579477035712961703de007" name="cross-s390-binutils" arch="ppc64le">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="7945cea579435c13d36e5283e0bc54d35733f8506659d2dc6cc76cf7bc36d803" name="cross-s390-binutils" arch="s390x">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="1f375d4e0ce42a7fbdf28df034d0dfdc1bb8e71c5c3c85663504df0e8f785b3c" name="cross-s390-binutils" arch="src">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="2da7b2ebbcfd8feb6b3595c721f7b860a9440c73ab03dc81557f3107f3d31bbe" name="cross-s390-binutils" arch="x86_64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="9c1888d12d145622ba9f9363e547fea33f8d2323ae0ac792f52b6db86905ffb6" name="cross-s390x-binutils" arch="aarch64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="85d5de61b25d8e4179a24f59a85b3e03ee0b8723c837d3d9673f4c546beaeae0" name="cross-s390x-binutils" arch="ppc64le">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="3c1828b07808a63a901f0623d2bd9616bccdd3bada5f1141e3da26ee5a767881" name="cross-s390x-binutils" arch="src">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="1cdf4c72df9dc92e77533b9ac387bd201f182797a85731d3c8f8ef263ab63d2b" name="cross-s390x-binutils" arch="x86_64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="0ecb61b113f7f69f07a28857f7f2900047ac601a1c932b84f4ef8008a733e078" name="cross-s390x-gcc13-bootstrap" arch="aarch64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="2c279028374a1181f31a55191f0709a0d32ed84a56c08d5de9518c1d72951cb4" name="cross-s390x-gcc13-bootstrap" arch="ppc64le">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="1b1d6f7120b1e34d0b375787d49728c2ecf37e06eba0c216c37d5c3ebd535b3f" name="cross-s390x-gcc13-bootstrap" arch="src">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="f1a5b01b1496e2292f016238d52760ee16a9fdeaf98173b49877d1a856edd46f" name="cross-s390x-gcc13-bootstrap" arch="x86_64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="827e64c37c239a601f0cfc9c45ec7c86b39b537ea8c7090dd2e6ac2111783b17" name="cross-sparc-binutils" arch="aarch64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="1665a3eb8c843de81b1313dfeca5f98cc81f1eaa7338a18575e1a61fa65b0f75" name="cross-sparc-binutils" arch="ppc64le">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="d5ea7e16af0d386075f64149325ca0991a0b6b9b95995fd451ed9f33be36a03c" name="cross-sparc-binutils" arch="s390x">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="cbac2526d0dd7bc775d1341da4ca248d569b4f9779f14f5bd480258ea7d91029" name="cross-sparc-binutils" arch="src">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="9a4de5d6a93f5fcc2db50776179958de66773fe128fa9b0690871eb964d7f3a2" name="cross-sparc-binutils" arch="x86_64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="b1f1c68da1f552d9bbc3b1779324052e5abb96b5e8982ce19a4da3804ffddacc" name="cross-sparc-gcc13" arch="aarch64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="bfe5d1ee525eabfba365b3e84b855810d6cccda4a938736537be0ad27a5fbb82" name="cross-sparc-gcc13" arch="ppc64le">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="763c16d19a4da6767a451f497918f4a2e6e3cd09c5fa7729c069af643615c045" name="cross-sparc-gcc13" arch="s390x">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="0da9cd763ab0a143ace6057a5cc4f4cf602de4ccdf70c62c79a759c625a2c2e8" name="cross-sparc-gcc13" arch="src">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="c4db9227574d51b54cd02c670300f35a33853bdfe31360f7128299cc795abb4b" name="cross-sparc-gcc13" arch="x86_64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="5bb557cf73062201f96d6eed27c7ccaa051e9fcbdeb2c061f5dd708f6ada756b" name="cross-sparc64-binutils" arch="aarch64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="72c1a278868537681024fc59101bc78139200d66af4a73cb637a508a9ee87d39" name="cross-sparc64-binutils" arch="ppc64le">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="9dcd421a63d557f47f937c7b94360552d19d08593f409e1049998ef2f2d487f3" name="cross-sparc64-binutils" arch="s390x">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="a9f335f1f54ebfa99d512b31a1718dfec3067ab439660738c4b441fa834718a3" name="cross-sparc64-binutils" arch="src">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="97f168ece1af231cc8158c579a9a05bfbb6e0e34503a93f28c566c554b07e645" name="cross-sparc64-binutils" arch="x86_64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="76f92bb68788d26e3231ddbe83bcff8da4a7c41da4978a9d98d8a1b68d7aec62" name="cross-sparc64-gcc13" arch="aarch64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="b9db908e2e6e7838968167957cfe8f4500b1e33a0e6ed9f3fa5ec7a463e798fe" name="cross-sparc64-gcc13" arch="ppc64le">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="76c51f10c1b69e17ced7f6649c24bbbefce5dfde6558922cdac9ff256ddd97a4" name="cross-sparc64-gcc13" arch="s390x">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="7e7a3cff6a84f9583980db3baea9f450250c5b13c4144e89538de9cf34d3f1fe" name="cross-sparc64-gcc13" arch="src">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="04d5046a37c2f7dfe0f83c6671a95a319969d4a14f640650beb3ec056a1da0df" name="cross-sparc64-gcc13" arch="x86_64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="0de90d46accf4b8f4b97ebc78cf0df336e4508a052532049411d532c60c1b570" name="cross-sparc64-gcc13-icecream-backend" arch="aarch64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="727ae6fc9e835b07b4d156d7cdedb4794436df203a486c3713b27f541b0566be" name="cross-sparc64-gcc13-icecream-backend" arch="ppc64le">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="948064ea5654320ed316cbab14b6a14f8937230247ad016b3d9cc2f70e75e6c8" name="cross-sparc64-gcc13-icecream-backend" arch="s390x">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="b5a6f4fe000963503dc2adef3c441580e5d447148058980f4cf8a24343a6fffa" name="cross-sparc64-gcc13-icecream-backend" arch="x86_64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="1f560fed1b9a88b044b4605c718822d97c2fde75013e901575b2c0a959ecd8f4" name="cross-sparcv9-gcc13-icecream-backend" arch="aarch64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="43ae41c8a5fbc53c4b7855aa0f75d29a1d87a16d7dda50c19b7b880ec309cdb7" name="cross-sparcv9-gcc13-icecream-backend" arch="ppc64le">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="c661dab8833a30393238c9ceedc5561a77b63848ad6e095e9c757497de8560e4" name="cross-sparcv9-gcc13-icecream-backend" arch="s390x">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="ca00239125348e1f7f988794d9101ba05dc64dc8c62c0f0b42514f87189ef0f2" name="cross-sparcv9-gcc13-icecream-backend" arch="x86_64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="b8d4050c957c583921393668865b4af5585c9dda13706b4db7dbf61ca660bf5d" name="cross-spu-binutils" arch="aarch64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="1b3035182d1ac75ee7b3882815c04c96f559a269950523f675884c7df2bcf0cf" name="cross-spu-binutils" arch="ppc64le">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="bf9aacb29e9db67e138347df04d9659db62a971b01295eebe98f40f16786be16" name="cross-spu-binutils" arch="s390x">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="d32a34b0b1201531e143f15c7ee307eb6692cc2102754d9dd183b0afece2555c" name="cross-spu-binutils" arch="src">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="0d832ccdd8ee4533455b72ff90ea2db6465a53581ce78e5ddfe61d5337642c5e" name="cross-spu-binutils" arch="x86_64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="c488bf8bc9876be68447ebc8caf5efe3b629f314dc50f96e0f1f7f257b679ed8" name="cross-x86_64-binutils" arch="aarch64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="105576667885b5d32c08131f95c67d0fd9076a3641c96b4f6a7c95b690575fba" name="cross-x86_64-binutils" arch="ppc64le">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="f9978b7ba940f476ee6c0de6d3ee26fdc126c37cf38f43a1fe953c5beecb19d4" name="cross-x86_64-binutils" arch="s390x">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="893c93c17aa24e560f4a4a618a0bb8157568549d4838b2e5ecc66466f6063ee2" name="cross-x86_64-binutils" arch="src">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="4bf149037be0c2170282c0ee71170689677e34631e54e698712f8ce1f43582a3" name="cross-x86_64-gcc13" arch="aarch64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="959a0d5fc540c99aa9509704d0550894db66851643000264e305ee49f81b8631" name="cross-x86_64-gcc13" arch="ppc64le">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="fcbd2349ca2253a154e3b2ecd78ef05ff6a48ba0af24c3e5d3f22e9ebb498e2b" name="cross-x86_64-gcc13" arch="s390x">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="c0d155268a8025d43fdddd6cb5246ec3f10b78b1b6d8ffb10fab63a615966346" name="cross-x86_64-gcc13" arch="src">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="9c0c482a6d91be377e739cfd0748b2a78e4021795a395c7c60326d7e0457f465" name="cross-x86_64-gcc13-icecream-backend" arch="aarch64">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="b55a316240e4e55613874feb7a62474e5290d55f086d9374b7a7a4a51adf6da2" name="cross-x86_64-gcc13-icecream-backend" arch="ppc64le">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="bc09ca90e517596dae39e84b1dd51056e71103ee4fb260534433a5ca2a223e50" name="cross-x86_64-gcc13-icecream-backend" arch="s390x">
  <version epoch="0" ver="13.3.0+git8781" rel="150000.1.12.1"/>
  <changelog author="dmueller@suse.com" date="1695384000">- add pr111411.patch (bsc#1215427)</changelog>
  <changelog author="rguenther@suse.com" date="1699358400">- Add gcc13-bsc1216664.patch, works around SAP ASE DB crash during
  C++ standard library initialization.  [bsc#1216664]</changelog>
  <changelog author="rguenther@suse.com" date="1700827200">- Avoid update-alternatives dependency for accelerator crosses.
- Package tool links to llvm in cross-amdgcn-gcc13 rather than in
  cross-amdgcn-newlib13-devel since that also has the dependence.
- Depend on llvmVER instead of llvm with VER equal to
  %product_libs_llvm_ver where available and adjust tool discovery
  accordingly.  This should also properly trigger re-builds when
  the patchlevel version of llvmVER changes, possibly changing
  the binary names we link to.  [bsc#1217450]</changelog>
  <changelog author="rguenther@suse.com" date="1701345600">- Update to gcc-13 branch head, 741743c028dc00f27b9c8b1d5, git8109
  * Includes fix for building mariadb on i686.  [bsc#1217667]
  * Remove pr111411.patch contained in the update.</changelog>
  <changelog author="rguenther@suse.com" date="1704801600">- Update to gcc-13 branch head, 36ddb5230f56a30317630a928, git8205</changelog>
  <changelog author="rguenther@suse.com" date="1705579200">- Package m2rte.so plugin in the gcc13-m2 sub-package rather than
  in gcc13-devel.  [boo#1210959]
- Require libstdc++6-devel-gcc13 from gcc13-m2 as m2 programs
  are linked against libstdc++6.</changelog>
  <changelog author="rguenther@suse.com" date="1705924800">- Add cross-X-newlib-devel requires to newlib cross compilers.
  [boo#1219031]</changelog>
  <changelog author="rguenther@suse.com" date="1706184000">- Update to gcc-13 branch head, fc7d87e0ffadca49bec29b2107, git8250
  * Includes fix for building TVM.  [boo#1218492]</changelog>
  <changelog author="rguenther@suse.com" date="1707134400">- Use %{_target_cpu} to determine host and build.</changelog>
  <changelog author="rguenther@suse.com" date="1707220800">- Update to gcc-13 branch head, 67ac78caf31f7cb3202177e642, git8285
- Add gcc13-pr88345-min-func-alignment.diff to add support for
  - fmin-function-alignment.  [bsc#1214934]</changelog>
  <changelog author="rguenther@suse.com" date="1707393600">- Add gcc13-sanitizer-remove-crypt-interception.patch to remove
  crypt and crypt_r interceptors.  The crypt API change in SLE15 SP3
  breaks them.  [bsc#1219520]</changelog>
  <changelog author="rguenther@suse.com" date="1708603200">- Use %patch -P N instead of %patchN.</changelog>
  <changelog author="rguenther@suse.com" date="1709640000">- Fix libgccjit-devel dependency, a newer shared library is OK.
- Fix libgccjit dependency, the corresponding compiler isn't required.</changelog>
  <changelog author="rguenther@suse.com" date="1710331200">- Revert libgccjit dependency change.  [boo#1220724]</changelog>
  <changelog author="rguenther@suse.com" date="1710936000">- Add gcc13-pr111731.patch to fix unwinding for JIT code.
  [bsc#1221239]</changelog>
  <changelog author="rguenther@suse.com" date="1711540800">- Make requirement to lld version specific to avoid requiring the
  meta-package.</changelog>
  <changelog author="rguenther@suse.com" date="1712232000">- Add gcc13-pr101523.patch to avoid combine spending too much
  compile-time and memory doing nothing on s390x.  [boo#1188441]</changelog>
  <changelog author="rguenther@suse.com" date="1714651200">- Add gcc13-amdgcn-remove-fiji.patch removing Fiji support from
  the GCN offload compiler as that is requiring Code Object version 3
  which is no longer supported by llvm18.</changelog>
  <changelog author="rguenther@suse.com" date="1715342400">- Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
- Removed gcc13-pr111731.patch now included upstream</changelog>
  <changelog author="rguenther@suse.com" date="1716292800">- Update to GCC 13.3 release</changelog>
</package>
<package pkgid="71519f6d1d32cab44087d089af4e75cc84af966f0a6395fb588bfd2a94650a0c" name="cross-xtensa-binutils" arch="aarch64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="98eb30a06252c947286d05cb8f8e7924aee74bf52e0aefae8254b06e703c3747" name="cross-xtensa-binutils" arch="ppc64le">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="2dae5a6c19fbac75408deb7b2926c8d944d22cb961b9ed8024fe8dd4e7ac957d" name="cross-xtensa-binutils" arch="s390x">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="802477eaf7b6912b96df91e176070b0f81944c8d87643a5aabdadd19c5cc0f70" name="cross-xtensa-binutils" arch="src">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="8c59aeb0c1fb8ec5929a53952ed32fdc3979f577a11190809411ae6d5e4b9cf6" name="cross-xtensa-binutils" arch="x86_64">
  <version epoch="0" ver="2.43" rel="150100.7.49.1"/>
  <changelog author="mliska@suse.cz" date="1676980800">- Enable zstd compression algorithm (instead of zlib)
  for debug info sections by default.</changelog>
  <changelog author="mliska@suse.cz" date="1677153600">- Disable ZSTD debug section compress by default.</changelog>
  <changelog author="matz@suse.com" date="1678276800">- Disable packed-relative-relocs for old codestreams.  They generate
  buggy relocations when binutils-revert-rela.diff is active.
  [bsc#1206556]</changelog>
  <changelog author="rguenther@suse.com" date="1678968000">- Enable bpf-none cross target and add bpf-none to the multitarget
  set of supported targets.</changelog>
  <changelog author="mliska@suse.cz" date="1679400000">- Document fixed CVEs:
  * bnc#1208037 aka CVE-2023-25588 aka PR29677
  * bnc#1208038 aka CVE-2023-25587 aka PR29846
  * bnc#1208040 aka CVE-2023-25585 aka PR29892
  * bnc#1208409 aka CVE-2023-0687 aka PR29444</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Rebase branch patch (includes fix for PR30281).</changelog>
  <changelog author="schwab@suse.de" date="1685448000">- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
  ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263</changelog>
  <changelog author="matz@suse.com" date="1689249600">- Add binutils-disable-dt-relr.sh for an compatibility problem
  caused by binutils-revert-rela.diff in SLE codestreams.
  Needed for update of glibc as that would otherwise pick up
  the broken relative relocs support.  [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
  variant in devel:gcc subsumed this in binutils-revert-rela.diff.
  Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.</changelog>
  <changelog author="matz@suse.com" date="1692187200">- Update to version 2.41 [PED-5778]:
  * The MIPS port now supports the Sony Interactive Entertainment Allegrex
  processor, used with the PlayStation Portable, which implements the MIPS
  II ISA along with a single-precision FPU and a few implementation-specific
  integer instructions.
  * Objdump's --private option can now be used on PE format files to display the
  fields in the file header and section headers.
  * New versioned release of libsframe: libsframe.so.1.  This release introduces
  versioned symbols with version node name LIBSFRAME_1.0.  This release also
  updates the ABI in an incompatible way: this includes removal of
  sframe_get_funcdesc_with_addr API, change in the behavior of
  sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
  * SFrame Version 2 is now the default (and only) format version supported by
  gas, ld, readelf and objdump.
  * Add command-line option, --strip-section-headers, to objcopy and strip to
  remove ELF section header from ELF file.
  * The RISC-V port now supports the following new standard extensions:
  - Zicond (conditional zero instructions)
  - Zfa (additional floating-point instructions)
  - Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
    Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
  * The RISC-V port now supports the following vendor-defined extensions:
  - XVentanaCondOps
  * Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
  * A new .insn directive is recognized by x86 gas.
  * Add SME2 support to the AArch64 port.
  * The linker now accepts a command line option of --remap-inputs
  &lt;PATTERN&gt;=&lt;FILE&gt; to relace any input file that matches &lt;PATTERN&gt; with
  &lt;FILE&gt;.  In addition the option --remap-inputs-file=&lt;FILE&gt; can be used to
  specify a file containing any number of these remapping directives.
  * The linker command line option --print-map-locals can be used to include
  local symbols in a linker map.  (ELF targets only).
  * For most ELF based targets, if the --enable-linker-version option is used
  then the version of the linker will be inserted as a string into the .comment
  section.
  * The linker script syntax has a new command for output sections: ASCIZ "string"
  This will insert a zero-terminated string at the current location.
  * Add command-line option, -z nosectionheader, to omit ELF section
  header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
  riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
  extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1209642 aka CVE-2023-1579 aka PR29988
  * bsc#1210297 aka CVE-2023-1972 aka PR30285
  * bsc#1210733 aka CVE-2023-2222 aka PR29936
  * bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
  * bsc#1214565 aka CVE-2020-19726 aka PR26240
  * bsc#1214567 aka CVE-2022-35206 aka PR29290
  * bsc#1214579 aka CVE-2022-35205 aka PR29289
  * bsc#1214580 aka CVE-2022-44840 aka PR29732
  * bsc#1214604 aka CVE-2022-45703 aka PR29799
  * bsc#1214611 aka CVE-2022-48065 aka PR29925
  * bsc#1214619 aka CVE-2022-48064 aka PR29922
  * bsc#1214620 aka CVE-2022-48063 aka PR29924
  * bsc#1214623 aka CVE-2022-47696 aka PR29677
  * bsc#1214624 aka CVE-2022-47695 aka PR29846
  * bsc#1214625 aka CVE-2022-47673 aka PR29876</changelog>
  <changelog author="matz@suse.com" date="1694692800">- Add libzstd-devel to Requires of binutils-devel. (bsc#1215341)</changelog>
  <changelog author="schwab@suse.de" date="1695643200">- riscv-relro.patch: RISC-V: Protect .got with relro</changelog>
  <changelog author="matz@suse.com" date="1699531200">- Add binutils-use-less-memory.diff to be a little nicer to 32bit
  userspace and huge links.  [bsc#1216908]</changelog>
  <changelog author="matz@suse.com" date="1706616000">- Update to version 2.42:
  * Add support for many aarch64 extensions: SVE2.1, SME2.1, B16B16,
  RASv2, LSE128, GCS, CHK, SPECRES2, LRCPC3, THE, ITE, D128, XS and
  flags to enable them: '+fcma', '+jscvt', '+frintts', '+flagm2',
  '+rcpc2' and '+wfxt'
  * Add experimantal support for GAS to synthesize call-frame-info for
  some hand-written asm (--scfi=experimental) on x86-64.
  * Add support for more x86-64 extensions: APX: 32 GPRs, NDD, PUSH2/POP2,
  PUSHP/POPP; USER_MSR, AVX10.1, PBNDKB, SM4, SM3, SHA512, AVX-VNNI-INT16.
  * Add support for more RISC-V extensions: T-Head v2.3.0, CORE-V v1.0,
  SiFive VCIX v1.0.
  * BPF assembler: ';' separates statements now, and does not introduce
  line comments anymore (use '#' or '//' for this).
  * x86-64 ld: Add '-z mark-plt/-z nomark-plt' to mark PLT entries with
  dynamic tags.
  * risc-v ld: Add '--[no-]check-uleb128'.
  * New linker script directive: REVERSE, to be combined with SORT_BY_NAME
  or SORT_BY_INIT_PRIORITY, reverses the generated order.
  * New linker options --warn-execstack-objects (warn only about execstack
  when input object files request it), and --error-execstack plus
  - -error-rxw-segments to convert the existing warnings into errors.
  * objdump: Add -Z/--decompress to be used with -s/--full-contents to
  decompress section contents before displaying.
  * readelf: Add --extra-sym-info to be used with --symbols (currently
  prints section name of references section index).
  * objcopy: Add --set-section-flags for x86_64 to include
  SHF_X86_64_LARGE.
  * s390 disassembly: add target-specific disasm option 'insndesc',
  as in "objdump -M insndesc" to display an instruction description
  as comment along with the disassembly.
- Add binutils-2.42-branch.diff.gz.
- Rebased s390-biarch.diff.
- Adjusted binutils-revert-hlasm-insns.diff,
  binutils-revert-plt32-in-branches.diff and binutils-revert-rela.diff
  for upstream changes.
- Removed binutils-2.41-branch.diff.gz, binutils-2.41.tar.bz2,
  binutils-2.41-branch.diff.gz.
- Removed binutils-use-less-memory.diff, binutils-old-makeinfo.diff
  and riscv-relro.patch (all upstreamed).
- Removed add-ulp-section.diff, we use a different mechanism
  for live patching since a long time.</changelog>
  <changelog author="matz@suse.com" date="1707134400">- Add binutils-disable-code-arch-error.diff to demote an
  error about swapped .arch/.code directives to a warning.
  It happens in the wild.</changelog>
  <changelog author="schwab@suse.de" date="1708516800">- riscv-no-relax.patch: RISC-V: Don't generate branch/jump relocation if
  symbol is local when no-relax</changelog>
  <changelog author="dimstar@opensuse.org" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="bwiedemann@suse.com" date="1714564800">- Allow to disable profiling</changelog>
  <changelog author="schwab@suse.de" date="1718280000">- binutils-pr22868.diff: Remove obsolete patch
- Undefine _FORTIFY_SOURCE when running checks</changelog>
  <changelog author="matz@suse.com" date="1722945600">- Update to version 2.43:
  * new .base64 pseudo-op, allowing base64 encoded data as strings
  * Intel APX: add support for CFCMOV, CCMP, CTEST, zero-upper, NF
    (APX_F now fully supported)
  * x86 Intel syntax now warns about more mnemonic suffixes
  * macros and .irp/.irpc/.rept bodies can use \+ to get at number
    of times the macro/body was executed
  * aarch64: support 'armv9.5-a' for -march, add support for LUT
    and LUT2
  * s390: base register operand in D(X,B) and D(L,B) can now be
    omitted (ala 'D(X,)'); warn when register type doesn't match
    operand type (use option
    'warn-regtype-mismatch=[strict|relaxed|no]' to adjust)
  * riscv: support various extensions: Zacas, Zcmp, Zfbfmin,
    Zvfbfmin, Zvfbfwma, Smcsrind/Sscsrind, XCvMem, XCvBi, XCvElw,
    XSfCease, all at version 1.0;
    remove support for assembly of privileged spec 1.9.1 (linking
    support remains)
  * arm: remove support for some old co-processors: Maverick and FPA
  * mips: '--trap' now causes either trap or breakpoint instructions
    to be emitted as per current ISA, instead of always using trap
    insn and failing when current ISA was incompatible with that
  * LoongArch: accept .option pseudo-op for fine-grained control
    of assembly code options; add support for DT_RELR
  * readelf: now displays RELR relocations in full detail;
    add -j/--display-section to show just those section(s) content
    according to their type
  * objdump/readelf now dump also .eh_frame_hdr (when present) when
    dumping .eh_frame
  * gprofng: add event types for AMD Zen3/Zen4 and Intel Ice Lake
    processors; add minimal support for riscv
  * linker:
  - put .got and .got.plt into relro segment
  - add -z isa-level-report=[none|all|needed|used] to the x86 ELF
    linker to report needed and used x86-64 ISA levels
  - add --rosegment option which changes the -z separate-code
    option so that only one read-only segment is created (instead
    of two)
  - add --section-ordering-file &lt;FILE&gt; option to add extra
    mapping of input sections to output sections
  - add -plugin-save-temps to store plugin intermediate files
    permanently
- Removed binutils-2.42.tar.bz2, binutils-2.42-branch.diff.gz.
- Added binutils-2.43.tar.bz2, binutils-2.43-branch.diff.gz.
- Removed upstream patch riscv-no-relax.patch.
- Rebased ld-relro.diff and binutils-revert-rela.diff.</changelog>
  <changelog author="matz@suse.com" date="1724846400">- Update to current 2.43.1 branch [PED-10474]:
  * PR32109 - fuzzing problem
  * PR32083 - LTO vs overridden common symbols
  * PR32067 - crash with LTO-plugin and --oformat=binary
  * PR31956 - LTO vs wrapper symbols
  * riscv - add Zimop and Zcmop extensions
- Adjusted binutils-2.43-branch.diff.gz.</changelog>
</package>
<package pkgid="82c92a912db8ba2417f7b4806a7bb3095ddbffd098e942eb19c38c462239677c" name="cryptsetup" arch="aarch64">
  <version epoch="0" ver="2.7.0" rel="150600.3.3.1"/>
  <changelog author="dmueller@suse.com" date="1615550400">- move licenses to licensedir</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1615636800">- cryptsetup 2.3.5:
  * Fix partial reads of passphrase from an interactive terminal
  * Fix maximum length of password entered through a terminal
  * integritysetup: support new dm-integrity HMAC recalculation
    options
  * integritysetup: display of recalculating sector in dump command
  * veritysetup: fix verity FEC if stored in the same image with
    hashes
  * veritysetup: run FEC repair check even if root hash fails
  * veritysetup: do not process hash image if hash area is empty
  * veritysetup: store verity hash algorithm in superblock in
    lowercase
  * bitlk: fix a crash if the device disappears during BitLocker
    scan
  * bitlk: show a better error when trying to open an NTFS device
  * bitlk: add support for startup key protected VMKs
  * Fix LUKS1 repair code (regression since version 1.7.x)
  * Fix luksKeyChange for LUKS2 with assigned tokens
  * Fix cryptsetup resize using LUKS2 tokens
  * Print a visible error if device resize is not supported
  * Add error message when suspending wrong non-LUKS device
  * Fix default XTS mode key size in reencryption
  * Rephrase missing locking directory warning and move it to
    debug level
  * Many fixes for the use of cipher_null (empty debug cipher)
  * Fixes for libpasswdqc 2.0.x (optional passphrase quality check)
  * Fixes for problems discovered by various tools for code
    analysis
  * Various fixes to man pages
- silence hmac packaging warnings</changelog>
  <changelog author="lnussel@suse.de" date="1625140800">- cryptsetup 2.3.6:
  * integritysetup: Fix possible dm-integrity mapping table truncation.
  * cryptsetup: Backup header can be used to activate TCRYPT device.
    Use --header option to specify the header.
  * cryptsetup: Avoid LUKS2 decryption without detached header.
    This feature will be added later and is currently not supported.
  * Additional fixes and workarounds for common warnings produced
    by some static analysis tools (like gcc-11 analyzer) and additional
    code hardening.
  * Fix standalone libintl detection for compiled tests.
  * Add Blake2b and Blake2s hash support for crypto backends.
    Kernel and gcrypt crypto backend support all variants.
    OpenSSL supports only Blake2b-512 and Blake2s-256.
    Crypto backend supports kernel notation e.g. "blake2b-512".</changelog>
  <changelog author="fvogt@suse.com" date="1627905600">- Use LUKS2 as default format on Tumbleweed.
  It provides some additional features which other tools
  (e.g. systemd-cryptenroll) rely on. GRUB 2.06 supports unlocking
  LUKS2 volumes meanwhile.</changelog>
  <changelog author="lnussel@suse.de" date="1627905601">- cryptsetup 2.4.0 (jsc#SLE-20275)
  * External LUKS token plugins
  * Experimental SSH token
  * Default LUKS2 PBKDF is now Argon2id
  * Increase minimal memory cost for Argon2 benchmark to 64MiB.
  * Autodetect optimal encryption sector size on LUKS2 format.
  * Use VeraCrypt option by default and add --disable-veracrypt option.
  * Support --hash and --cipher to limit opening time for TCRYPT type
  * Fixed default OpenSSL crypt backend support for OpenSSL3.
  * integritysetup: add integrity-recalculate-reset flag.
  * cryptsetup: retains keyslot number in luksChangeKey for LUKS2.
  * Fix cryptsetup resize using LUKS2 tokens.
  * Add close --deferred and --cancel-deferred options.
  * Rewritten command-line option parsing to avoid libpopt arguments
    memory leaks.
  * Add --test-args option.</changelog>
  <changelog author="lnussel@suse.de" date="1627992000">- need to use PBKDF2 by default for LUKS2 as grub can't decrypt when
  using Argon.</changelog>
  <changelog author="lnussel@suse.de" date="1629892800">- As YaST passes necessary parameters to cryptsetup anyway, we do
  not necessarily need to take grub into consideration. So back to
  Argon2 to see how it goes.</changelog>
  <changelog author="lnussel@suse.de" date="1631793600">- cryptsetup 2.4.1
  * Fix compilation for libc implementations without dlvsym().
  * Fix compilation and tests on systems with non-standard libraries
  * Try to workaround some issues on systems without udev support.
  * Fixes for OpenSSL3 crypto backend (including FIPS mode).
  * Print error message when assigning a token to an inactive keyslot.
  * Fix offset bug in LUKS2 encryption code if --offset option was used.
  * Do not allow LUKS2 decryption for devices with data offset.
  * Fix LUKS1 cryptsetup repair command for some specific problems.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1637236800">- cryptsetup 2.4.2:
  * Fix possible large memory allocation if LUKS2 header size is
    invalid.
  * Fix memory corruption in debug message printing LUKS2
    checksum.
  * veritysetup: remove link to the UUID library for the static
    build.
  * Remove link to pwquality library for integritysetup and
    veritysetup. These tools do not read passphrases.
  * OpenSSL3 backend: avoid remaining deprecated calls in API.
    Crypto backend no longer use API deprecated in OpenSSL 3.0
  * Check if kernel device-mapper create device failed in an early
    phase. This happens when a concurrent creation of device-mapper
    devices meets in the very early state.
  * Do not set compiler optimization flag for Argon2 KDF if the
    memory wipe is implemented in libc.
  * Do not attempt to unload LUKS2 tokens if external tokens are
    disabled. This allows building a static binary with
  - -disable-external-tokens.
  * LUKS convert: also check sysfs for device activity.
    If udev symlink is missing, code fallbacks to sysfs scan to
    prevent data corruption for the active device.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1642161600">- cryptsetup 2.4.3:
  * Fix possible attacks against data confidentiality through
    LUKS2 online reencryption extension crash recovery
    CVE-2021-4122, boo#1194469
  * Add configure option --disable-luks2-reencryption to completely
    disable LUKS2 reencryption code.
  * Improve internal metadata validation code for reencryption
    metadata
  * Add updated documentation for LUKS2 On-Disk Format
    Specification version 1.1.0
  * Fix support for bitlk (BitLocker compatible) startup key with
    new  metadata entry introduced in Windows 11
  * Fix space restriction for LUKS2 reencryption with data shift</changelog>
  <changelog author="lnussel@suse.de" date="1661169600">- cryptsetup 2.5.0:
  * Split manual pages into per-action pages and use AsciiDoc format.
  * Remove cryptsetup-reencrypt tool from the project and move reencryption
    to already existing "cryptsetup reencrypt" command.
    If you need to emulate the old cryptsetup-reencrypt binary, use simple
    wrappers script running "exec cryptsetup reencrypt $@".
  * LUKS2: implement --decryption option that allows LUKS removal.
  * Fix decryption operation with --active-name option and restrict
    it to be used only with LUKS2.
  * Do not refresh reencryption digest when not needed.
    This should speed up the reencryption resume process.
  * Store proper resilience data in LUKS2 reencrypt initialization.
    Resuming reencryption now does not require specification of resilience
    type parameters if these are the same as during initialization.
  * Properly wipe the unused area after reencryption with datashift in
    the forward direction.
  * Check datashift value against larger sector size.
    For example, it could cause an issue if misaligned 4K sector appears
    during decryption.
  * Do not allow sector size increase reencryption in offline mode.
  * Do not allow dangerous sector size change during reencryption.
  * Ask the user for confirmation before resuming reencryption.
  * Do not resume reencryption with conflicting parameters.
  * Add --force-offline-reencrypt option.
  * Do not allow nested encryption in LUKS reencrypt.
  * Support all options allowed with luksFormat with encrypt action.
  * Add resize action to integritysetup.
  * Remove obsolete dracut plugin reencryption example.
  * Fix possible keyslot area size overflow during conversion to LUKS2.
  * Allow use of --header option for cryptsetup close.
  * Fix activation of LUKS2 device with integrity and detached header.
  * Add ZEROOUT IOCTL support for crypt_wipe API call.
  * VERITY: set loopback sector size according to dm-verity block sizes.
  * veritysetup: dump device sizes.
  * LUKS2 token: prefer token PIN query before passphrase in some cases.
    When a user provides --token-type or specific --token-id, a token PIN
    query is preferred to a passphrase query.
  * LUKS2 token: allow tokens to be replaced with --token-replace option
    for cryptsetup token command.
  * LUKS2 token: do not continue operation when interrupted in PIN prompt.
  * Add --progress-json parameter to utilities.
  * Add support for --key-slot option in luksResume action.
- move man pages to separate subpackage
- drop backports handling</changelog>
  <changelog author="luca.boccassi@gmail.com" date="1663070400">- Add virtual provides for 'integritysetup' and 'veritysetup' to match
  package names provided by Fedora/RHEL, to allow the same set of
  dependencies to be used across all RPM distributions.</changelog>
  <changelog author="info@paolostivanin.com" date="1669636800">- cryptsetup 2.6.0:
  * Introduce support for handling macOS FileVault2 devices (FVAULT2).
  * libcryptsetup: no longer use global memory locking through mlockall()
  * libcryptsetup: process priority is increased only for key derivation
    (PBKDF) calls.
  * Add new LUKS keyslot context handling functions and API.
  * The volume key may now be extracted using a passphrase, keyfile, or
    token. For LUKS devices, it also returns the volume key after
    a successful crypt_format call.
  * Fix --disable-luks2-reencryption configuration option.
  * cryptsetup: Print a better error message and warning if the format
    produces an image without space available for data.
  * Print error if anti-forensic LUKS2 hash setting is not available.
    If the specified hash was not available, activation quietly failed.
  * Fix internal crypt segment compare routine if the user
    specified cipher in kernel format (capi: prefix).
  * cryptsetup: Add token unassign action.
    This action allows removing token binding on specific keyslot.
  * veritysetup: add support for --use-tasklets option.
    This option sets try_verify_in_tasklet kernel dm-verity option
    (available since Linux kernel 6.0) to allow some performance
    improvement on specific systems.
  * Provide pkgconfig Require.private settings.
    While we do not completely provide static build on udev systems,
    it helps produce statically linked binaries in certain situations.
  * Always update automake library files if autogen.sh is run.
    For several releases, we distributed older automake scripts by mistake.
  * reencryption: Fix user defined moved segment size in LUKS2 decryption.
    The --hotzone-size argument was ignored in cases where the actual data
    size was less than the original LUKS2 data offset.
  * Delegate FIPS mode detection to configured crypto backend.
    System FIPS mode check no longer depends on /etc/system-fips file.
  * Update documentation, including FAQ and man pages.</changelog>
  <changelog author="lnussel@suse.com" date="1672142400">- Replace transitional %usrmerged macro with regular version check (boo#1206798)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1676203200">- cryptsetup 2.6.1
  * bitlk: Fixes for BitLocker-compatible on-disk metadata parser
  * Fix possible iteration overflow in OpenSSL2 PBKDF2 crypto
    backend
  * portability and compilation fixes
  * verity: Fix possible hash offset setting overflow.
  * bitlk: Fix use of startup BEK key on big-endian platforms.
  * Do not initiate encryption (reencryption command) when the
    header and data devices are the same. If data device reduction
    is not requsted, this leads to data corruption since LUKS
    metadata was written over the data device.
  * Fix possible memory leak if crypt_load() fails.
  * Always use passphrases with a minimal 8 chars length for
    benchmarking, as used in some implementation of FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1686744000">- FIPS: Remove not needed libcryptsetup12-hmac package that contains
  the HMAC checksums for integrity checking for FIPS. [bsc#1185116]
  * Remove the cryptsetup-rpmlintrc file.
  * Remove not needed fipscheck dependency.</changelog>
  <changelog author="pmonreal@suse.com" date="1686744001">- Enable running the regression test suite.
- Force a regeneration of the man pages from AsciiDoc.
- Add LUKS1 and LUKS2 On-Disk Format Specification pdfs to doc.</changelog>
  <changelog author="pmonreal@suse.com" date="1689249600">- luksFormat: Handle system with low memory and no swap space [bsc#1211079]
  * Check for physical memory available also in PBKDF benchmark.
  * Try to avoid OOM killer on low-memory systems without swap.
  * Use only half of detected free memory on systems without swap.
  * Add patches:
  - cryptsetup-Check-for-physical-memory-available-also-in-PBKDF-be.patch
  - cryptsetup-Try-to-avoid-OOM-killer-on-low-memory-systems-withou.patch
  - cryptsetup-Use-only-half-of-detected-free-memory-on-systems-wit.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1706529600">- Update to 2.7.0:
  * Full changelog in:
    mirrors.edge.kernel.org/pub/linux/utils/cryptsetup/v2.7/v2.7.0-ReleaseNotes
  * Introduce support for hardware OPAL disk encryption.
  * plain mode: Set default cipher to aes-xts-plain64 and password hashing
    to sha256.
  * Allow activation (open), luksResume, and luksAddKey to use the volume
    key stored in a keyring.
  * Allow to store volume key to a user-specified keyring in open and
    luksResume commands.
  * Do not flush IO operations if resize grows the device.
    This can help performance in specific cases where the encrypted device
    is extended automatically while running many IO operations.
  * Use only half of detected free memory for Argon2 PBKDF on systems
    without swap (for LUKS2 new keyslot or format operations).
  * Add the possibility to specify a directory for external LUKS2 token
    handlers (plugins).
  * Do not allow reencryption/decryption on LUKS2 devices with
    authenticated encryption or hardware (OPAL) encryption.
  * Do not fail LUKS format if the operation was interrupted on subsequent
    device wipe.
  * Fix the LUKS2 keyslot option to be used while activating the device
    by a token.
  * Properly report if the dm-verity device cannot be activated due to
    the inability to verify the signed root hash (ENOKEY).
  * Fix to check passphrase for selected keyslot only when adding
    new keyslot.
  * Fix to not wipe the keyslot area before in-place overwrite.
  * bitlk: Fix segfaults when attempting to verify the volume key.
  * Add --disable-blkid command line option to avoid blkid device check.
  * Add support for the meson build system.
  * Fix wipe operation that overwrites the whole device if used for LUKS2
    header with no keyslot area.
  * Fix luksErase to work with detached LUKS header.
  * Disallow the use of internal kernel crypto driver names in "capi"
    specification.
  * Fix reencryption to fail early for unknown cipher.
  * tcrypt: Support new Blake2 hash for VeraCrypt.
  * tcrypt: use hash values as substring for limiting KDF check.
  * Add Aria cipher support and block size info.
  * Do not decrease PBKDF parameters if the user forces them.
  * Support OpenSSL 3.2 Argon2 implementation.
  * Add support for Argon2 from libgcrypt
    (requires yet unreleased gcrypt 1.11).
  * Used Argon2 PBKDF implementation is now reported in debug mode
    in the cryptographic backend version. For native support in
    OpenSSL 3.2 or libgcrypt 1.11, "argon2" is displayed.
    If libargon2 is used, "cryptsetup libargon2" (for embedded
    library) or "external libargon2" is displayed.
  * Link only libcrypto from OpenSSL.
  * Disable reencryption for Direct-Access (DAX) devices.
  * Print a warning message if the device is not aligned to sector size.
  * Fix sector size and integrity fields display for non-LUKS2 crypt
    devices for the status command.
  * Fix suspend for LUKS2 with authenticated encryption (also suspend
    dm-integrity device underneath).
  * Update keyring and locking documentation and LUKS2 specification
    for OPAL2 support.
  * Remove patches fixed upstream:
  - cryptsetup-Check-for-physical-memory-available-also-in-PBKDF-be.patch
  - cryptsetup-Try-to-avoid-OOM-killer-on-low-memory-systems-withou.patch
  - cryptsetup-Use-only-half-of-detected-free-memory-on-systems-wit.patch</changelog>
  <changelog author="meissner@suse.com" date="1725019200">- cryptsetup-fips140-3.patch: extend the password for PBKDF2 benchmarking
  to be more than 20 chars to meet FIPS 140-3 requirements (bsc#1229975)</changelog>
</package>
<package pkgid="8dfd584a48fd206859d3e78cc32a89c44181df47fbeb5003c45fcf28fb258954" name="cryptsetup" arch="ppc64le">
  <version epoch="0" ver="2.7.0" rel="150600.3.3.1"/>
  <changelog author="dmueller@suse.com" date="1615550400">- move licenses to licensedir</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1615636800">- cryptsetup 2.3.5:
  * Fix partial reads of passphrase from an interactive terminal
  * Fix maximum length of password entered through a terminal
  * integritysetup: support new dm-integrity HMAC recalculation
    options
  * integritysetup: display of recalculating sector in dump command
  * veritysetup: fix verity FEC if stored in the same image with
    hashes
  * veritysetup: run FEC repair check even if root hash fails
  * veritysetup: do not process hash image if hash area is empty
  * veritysetup: store verity hash algorithm in superblock in
    lowercase
  * bitlk: fix a crash if the device disappears during BitLocker
    scan
  * bitlk: show a better error when trying to open an NTFS device
  * bitlk: add support for startup key protected VMKs
  * Fix LUKS1 repair code (regression since version 1.7.x)
  * Fix luksKeyChange for LUKS2 with assigned tokens
  * Fix cryptsetup resize using LUKS2 tokens
  * Print a visible error if device resize is not supported
  * Add error message when suspending wrong non-LUKS device
  * Fix default XTS mode key size in reencryption
  * Rephrase missing locking directory warning and move it to
    debug level
  * Many fixes for the use of cipher_null (empty debug cipher)
  * Fixes for libpasswdqc 2.0.x (optional passphrase quality check)
  * Fixes for problems discovered by various tools for code
    analysis
  * Various fixes to man pages
- silence hmac packaging warnings</changelog>
  <changelog author="lnussel@suse.de" date="1625140800">- cryptsetup 2.3.6:
  * integritysetup: Fix possible dm-integrity mapping table truncation.
  * cryptsetup: Backup header can be used to activate TCRYPT device.
    Use --header option to specify the header.
  * cryptsetup: Avoid LUKS2 decryption without detached header.
    This feature will be added later and is currently not supported.
  * Additional fixes and workarounds for common warnings produced
    by some static analysis tools (like gcc-11 analyzer) and additional
    code hardening.
  * Fix standalone libintl detection for compiled tests.
  * Add Blake2b and Blake2s hash support for crypto backends.
    Kernel and gcrypt crypto backend support all variants.
    OpenSSL supports only Blake2b-512 and Blake2s-256.
    Crypto backend supports kernel notation e.g. "blake2b-512".</changelog>
  <changelog author="fvogt@suse.com" date="1627905600">- Use LUKS2 as default format on Tumbleweed.
  It provides some additional features which other tools
  (e.g. systemd-cryptenroll) rely on. GRUB 2.06 supports unlocking
  LUKS2 volumes meanwhile.</changelog>
  <changelog author="lnussel@suse.de" date="1627905601">- cryptsetup 2.4.0 (jsc#SLE-20275)
  * External LUKS token plugins
  * Experimental SSH token
  * Default LUKS2 PBKDF is now Argon2id
  * Increase minimal memory cost for Argon2 benchmark to 64MiB.
  * Autodetect optimal encryption sector size on LUKS2 format.
  * Use VeraCrypt option by default and add --disable-veracrypt option.
  * Support --hash and --cipher to limit opening time for TCRYPT type
  * Fixed default OpenSSL crypt backend support for OpenSSL3.
  * integritysetup: add integrity-recalculate-reset flag.
  * cryptsetup: retains keyslot number in luksChangeKey for LUKS2.
  * Fix cryptsetup resize using LUKS2 tokens.
  * Add close --deferred and --cancel-deferred options.
  * Rewritten command-line option parsing to avoid libpopt arguments
    memory leaks.
  * Add --test-args option.</changelog>
  <changelog author="lnussel@suse.de" date="1627992000">- need to use PBKDF2 by default for LUKS2 as grub can't decrypt when
  using Argon.</changelog>
  <changelog author="lnussel@suse.de" date="1629892800">- As YaST passes necessary parameters to cryptsetup anyway, we do
  not necessarily need to take grub into consideration. So back to
  Argon2 to see how it goes.</changelog>
  <changelog author="lnussel@suse.de" date="1631793600">- cryptsetup 2.4.1
  * Fix compilation for libc implementations without dlvsym().
  * Fix compilation and tests on systems with non-standard libraries
  * Try to workaround some issues on systems without udev support.
  * Fixes for OpenSSL3 crypto backend (including FIPS mode).
  * Print error message when assigning a token to an inactive keyslot.
  * Fix offset bug in LUKS2 encryption code if --offset option was used.
  * Do not allow LUKS2 decryption for devices with data offset.
  * Fix LUKS1 cryptsetup repair command for some specific problems.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1637236800">- cryptsetup 2.4.2:
  * Fix possible large memory allocation if LUKS2 header size is
    invalid.
  * Fix memory corruption in debug message printing LUKS2
    checksum.
  * veritysetup: remove link to the UUID library for the static
    build.
  * Remove link to pwquality library for integritysetup and
    veritysetup. These tools do not read passphrases.
  * OpenSSL3 backend: avoid remaining deprecated calls in API.
    Crypto backend no longer use API deprecated in OpenSSL 3.0
  * Check if kernel device-mapper create device failed in an early
    phase. This happens when a concurrent creation of device-mapper
    devices meets in the very early state.
  * Do not set compiler optimization flag for Argon2 KDF if the
    memory wipe is implemented in libc.
  * Do not attempt to unload LUKS2 tokens if external tokens are
    disabled. This allows building a static binary with
  - -disable-external-tokens.
  * LUKS convert: also check sysfs for device activity.
    If udev symlink is missing, code fallbacks to sysfs scan to
    prevent data corruption for the active device.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1642161600">- cryptsetup 2.4.3:
  * Fix possible attacks against data confidentiality through
    LUKS2 online reencryption extension crash recovery
    CVE-2021-4122, boo#1194469
  * Add configure option --disable-luks2-reencryption to completely
    disable LUKS2 reencryption code.
  * Improve internal metadata validation code for reencryption
    metadata
  * Add updated documentation for LUKS2 On-Disk Format
    Specification version 1.1.0
  * Fix support for bitlk (BitLocker compatible) startup key with
    new  metadata entry introduced in Windows 11
  * Fix space restriction for LUKS2 reencryption with data shift</changelog>
  <changelog author="lnussel@suse.de" date="1661169600">- cryptsetup 2.5.0:
  * Split manual pages into per-action pages and use AsciiDoc format.
  * Remove cryptsetup-reencrypt tool from the project and move reencryption
    to already existing "cryptsetup reencrypt" command.
    If you need to emulate the old cryptsetup-reencrypt binary, use simple
    wrappers script running "exec cryptsetup reencrypt $@".
  * LUKS2: implement --decryption option that allows LUKS removal.
  * Fix decryption operation with --active-name option and restrict
    it to be used only with LUKS2.
  * Do not refresh reencryption digest when not needed.
    This should speed up the reencryption resume process.
  * Store proper resilience data in LUKS2 reencrypt initialization.
    Resuming reencryption now does not require specification of resilience
    type parameters if these are the same as during initialization.
  * Properly wipe the unused area after reencryption with datashift in
    the forward direction.
  * Check datashift value against larger sector size.
    For example, it could cause an issue if misaligned 4K sector appears
    during decryption.
  * Do not allow sector size increase reencryption in offline mode.
  * Do not allow dangerous sector size change during reencryption.
  * Ask the user for confirmation before resuming reencryption.
  * Do not resume reencryption with conflicting parameters.
  * Add --force-offline-reencrypt option.
  * Do not allow nested encryption in LUKS reencrypt.
  * Support all options allowed with luksFormat with encrypt action.
  * Add resize action to integritysetup.
  * Remove obsolete dracut plugin reencryption example.
  * Fix possible keyslot area size overflow during conversion to LUKS2.
  * Allow use of --header option for cryptsetup close.
  * Fix activation of LUKS2 device with integrity and detached header.
  * Add ZEROOUT IOCTL support for crypt_wipe API call.
  * VERITY: set loopback sector size according to dm-verity block sizes.
  * veritysetup: dump device sizes.
  * LUKS2 token: prefer token PIN query before passphrase in some cases.
    When a user provides --token-type or specific --token-id, a token PIN
    query is preferred to a passphrase query.
  * LUKS2 token: allow tokens to be replaced with --token-replace option
    for cryptsetup token command.
  * LUKS2 token: do not continue operation when interrupted in PIN prompt.
  * Add --progress-json parameter to utilities.
  * Add support for --key-slot option in luksResume action.
- move man pages to separate subpackage
- drop backports handling</changelog>
  <changelog author="luca.boccassi@gmail.com" date="1663070400">- Add virtual provides for 'integritysetup' and 'veritysetup' to match
  package names provided by Fedora/RHEL, to allow the same set of
  dependencies to be used across all RPM distributions.</changelog>
  <changelog author="info@paolostivanin.com" date="1669636800">- cryptsetup 2.6.0:
  * Introduce support for handling macOS FileVault2 devices (FVAULT2).
  * libcryptsetup: no longer use global memory locking through mlockall()
  * libcryptsetup: process priority is increased only for key derivation
    (PBKDF) calls.
  * Add new LUKS keyslot context handling functions and API.
  * The volume key may now be extracted using a passphrase, keyfile, or
    token. For LUKS devices, it also returns the volume key after
    a successful crypt_format call.
  * Fix --disable-luks2-reencryption configuration option.
  * cryptsetup: Print a better error message and warning if the format
    produces an image without space available for data.
  * Print error if anti-forensic LUKS2 hash setting is not available.
    If the specified hash was not available, activation quietly failed.
  * Fix internal crypt segment compare routine if the user
    specified cipher in kernel format (capi: prefix).
  * cryptsetup: Add token unassign action.
    This action allows removing token binding on specific keyslot.
  * veritysetup: add support for --use-tasklets option.
    This option sets try_verify_in_tasklet kernel dm-verity option
    (available since Linux kernel 6.0) to allow some performance
    improvement on specific systems.
  * Provide pkgconfig Require.private settings.
    While we do not completely provide static build on udev systems,
    it helps produce statically linked binaries in certain situations.
  * Always update automake library files if autogen.sh is run.
    For several releases, we distributed older automake scripts by mistake.
  * reencryption: Fix user defined moved segment size in LUKS2 decryption.
    The --hotzone-size argument was ignored in cases where the actual data
    size was less than the original LUKS2 data offset.
  * Delegate FIPS mode detection to configured crypto backend.
    System FIPS mode check no longer depends on /etc/system-fips file.
  * Update documentation, including FAQ and man pages.</changelog>
  <changelog author="lnussel@suse.com" date="1672142400">- Replace transitional %usrmerged macro with regular version check (boo#1206798)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1676203200">- cryptsetup 2.6.1
  * bitlk: Fixes for BitLocker-compatible on-disk metadata parser
  * Fix possible iteration overflow in OpenSSL2 PBKDF2 crypto
    backend
  * portability and compilation fixes
  * verity: Fix possible hash offset setting overflow.
  * bitlk: Fix use of startup BEK key on big-endian platforms.
  * Do not initiate encryption (reencryption command) when the
    header and data devices are the same. If data device reduction
    is not requsted, this leads to data corruption since LUKS
    metadata was written over the data device.
  * Fix possible memory leak if crypt_load() fails.
  * Always use passphrases with a minimal 8 chars length for
    benchmarking, as used in some implementation of FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1686744000">- FIPS: Remove not needed libcryptsetup12-hmac package that contains
  the HMAC checksums for integrity checking for FIPS. [bsc#1185116]
  * Remove the cryptsetup-rpmlintrc file.
  * Remove not needed fipscheck dependency.</changelog>
  <changelog author="pmonreal@suse.com" date="1686744001">- Enable running the regression test suite.
- Force a regeneration of the man pages from AsciiDoc.
- Add LUKS1 and LUKS2 On-Disk Format Specification pdfs to doc.</changelog>
  <changelog author="pmonreal@suse.com" date="1689249600">- luksFormat: Handle system with low memory and no swap space [bsc#1211079]
  * Check for physical memory available also in PBKDF benchmark.
  * Try to avoid OOM killer on low-memory systems without swap.
  * Use only half of detected free memory on systems without swap.
  * Add patches:
  - cryptsetup-Check-for-physical-memory-available-also-in-PBKDF-be.patch
  - cryptsetup-Try-to-avoid-OOM-killer-on-low-memory-systems-withou.patch
  - cryptsetup-Use-only-half-of-detected-free-memory-on-systems-wit.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1706529600">- Update to 2.7.0:
  * Full changelog in:
    mirrors.edge.kernel.org/pub/linux/utils/cryptsetup/v2.7/v2.7.0-ReleaseNotes
  * Introduce support for hardware OPAL disk encryption.
  * plain mode: Set default cipher to aes-xts-plain64 and password hashing
    to sha256.
  * Allow activation (open), luksResume, and luksAddKey to use the volume
    key stored in a keyring.
  * Allow to store volume key to a user-specified keyring in open and
    luksResume commands.
  * Do not flush IO operations if resize grows the device.
    This can help performance in specific cases where the encrypted device
    is extended automatically while running many IO operations.
  * Use only half of detected free memory for Argon2 PBKDF on systems
    without swap (for LUKS2 new keyslot or format operations).
  * Add the possibility to specify a directory for external LUKS2 token
    handlers (plugins).
  * Do not allow reencryption/decryption on LUKS2 devices with
    authenticated encryption or hardware (OPAL) encryption.
  * Do not fail LUKS format if the operation was interrupted on subsequent
    device wipe.
  * Fix the LUKS2 keyslot option to be used while activating the device
    by a token.
  * Properly report if the dm-verity device cannot be activated due to
    the inability to verify the signed root hash (ENOKEY).
  * Fix to check passphrase for selected keyslot only when adding
    new keyslot.
  * Fix to not wipe the keyslot area before in-place overwrite.
  * bitlk: Fix segfaults when attempting to verify the volume key.
  * Add --disable-blkid command line option to avoid blkid device check.
  * Add support for the meson build system.
  * Fix wipe operation that overwrites the whole device if used for LUKS2
    header with no keyslot area.
  * Fix luksErase to work with detached LUKS header.
  * Disallow the use of internal kernel crypto driver names in "capi"
    specification.
  * Fix reencryption to fail early for unknown cipher.
  * tcrypt: Support new Blake2 hash for VeraCrypt.
  * tcrypt: use hash values as substring for limiting KDF check.
  * Add Aria cipher support and block size info.
  * Do not decrease PBKDF parameters if the user forces them.
  * Support OpenSSL 3.2 Argon2 implementation.
  * Add support for Argon2 from libgcrypt
    (requires yet unreleased gcrypt 1.11).
  * Used Argon2 PBKDF implementation is now reported in debug mode
    in the cryptographic backend version. For native support in
    OpenSSL 3.2 or libgcrypt 1.11, "argon2" is displayed.
    If libargon2 is used, "cryptsetup libargon2" (for embedded
    library) or "external libargon2" is displayed.
  * Link only libcrypto from OpenSSL.
  * Disable reencryption for Direct-Access (DAX) devices.
  * Print a warning message if the device is not aligned to sector size.
  * Fix sector size and integrity fields display for non-LUKS2 crypt
    devices for the status command.
  * Fix suspend for LUKS2 with authenticated encryption (also suspend
    dm-integrity device underneath).
  * Update keyring and locking documentation and LUKS2 specification
    for OPAL2 support.
  * Remove patches fixed upstream:
  - cryptsetup-Check-for-physical-memory-available-also-in-PBKDF-be.patch
  - cryptsetup-Try-to-avoid-OOM-killer-on-low-memory-systems-withou.patch
  - cryptsetup-Use-only-half-of-detected-free-memory-on-systems-wit.patch</changelog>
  <changelog author="meissner@suse.com" date="1725019200">- cryptsetup-fips140-3.patch: extend the password for PBKDF2 benchmarking
  to be more than 20 chars to meet FIPS 140-3 requirements (bsc#1229975)</changelog>
</package>
<package pkgid="1aa3d648dfd47fb4667e80c32b6792d5f0f8d37a8f637222e909dc65ac927b7b" name="cryptsetup" arch="s390x">
  <version epoch="0" ver="2.7.0" rel="150600.3.3.1"/>
  <changelog author="dmueller@suse.com" date="1615550400">- move licenses to licensedir</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1615636800">- cryptsetup 2.3.5:
  * Fix partial reads of passphrase from an interactive terminal
  * Fix maximum length of password entered through a terminal
  * integritysetup: support new dm-integrity HMAC recalculation
    options
  * integritysetup: display of recalculating sector in dump command
  * veritysetup: fix verity FEC if stored in the same image with
    hashes
  * veritysetup: run FEC repair check even if root hash fails
  * veritysetup: do not process hash image if hash area is empty
  * veritysetup: store verity hash algorithm in superblock in
    lowercase
  * bitlk: fix a crash if the device disappears during BitLocker
    scan
  * bitlk: show a better error when trying to open an NTFS device
  * bitlk: add support for startup key protected VMKs
  * Fix LUKS1 repair code (regression since version 1.7.x)
  * Fix luksKeyChange for LUKS2 with assigned tokens
  * Fix cryptsetup resize using LUKS2 tokens
  * Print a visible error if device resize is not supported
  * Add error message when suspending wrong non-LUKS device
  * Fix default XTS mode key size in reencryption
  * Rephrase missing locking directory warning and move it to
    debug level
  * Many fixes for the use of cipher_null (empty debug cipher)
  * Fixes for libpasswdqc 2.0.x (optional passphrase quality check)
  * Fixes for problems discovered by various tools for code
    analysis
  * Various fixes to man pages
- silence hmac packaging warnings</changelog>
  <changelog author="lnussel@suse.de" date="1625140800">- cryptsetup 2.3.6:
  * integritysetup: Fix possible dm-integrity mapping table truncation.
  * cryptsetup: Backup header can be used to activate TCRYPT device.
    Use --header option to specify the header.
  * cryptsetup: Avoid LUKS2 decryption without detached header.
    This feature will be added later and is currently not supported.
  * Additional fixes and workarounds for common warnings produced
    by some static analysis tools (like gcc-11 analyzer) and additional
    code hardening.
  * Fix standalone libintl detection for compiled tests.
  * Add Blake2b and Blake2s hash support for crypto backends.
    Kernel and gcrypt crypto backend support all variants.
    OpenSSL supports only Blake2b-512 and Blake2s-256.
    Crypto backend supports kernel notation e.g. "blake2b-512".</changelog>
  <changelog author="fvogt@suse.com" date="1627905600">- Use LUKS2 as default format on Tumbleweed.
  It provides some additional features which other tools
  (e.g. systemd-cryptenroll) rely on. GRUB 2.06 supports unlocking
  LUKS2 volumes meanwhile.</changelog>
  <changelog author="lnussel@suse.de" date="1627905601">- cryptsetup 2.4.0 (jsc#SLE-20275)
  * External LUKS token plugins
  * Experimental SSH token
  * Default LUKS2 PBKDF is now Argon2id
  * Increase minimal memory cost for Argon2 benchmark to 64MiB.
  * Autodetect optimal encryption sector size on LUKS2 format.
  * Use VeraCrypt option by default and add --disable-veracrypt option.
  * Support --hash and --cipher to limit opening time for TCRYPT type
  * Fixed default OpenSSL crypt backend support for OpenSSL3.
  * integritysetup: add integrity-recalculate-reset flag.
  * cryptsetup: retains keyslot number in luksChangeKey for LUKS2.
  * Fix cryptsetup resize using LUKS2 tokens.
  * Add close --deferred and --cancel-deferred options.
  * Rewritten command-line option parsing to avoid libpopt arguments
    memory leaks.
  * Add --test-args option.</changelog>
  <changelog author="lnussel@suse.de" date="1627992000">- need to use PBKDF2 by default for LUKS2 as grub can't decrypt when
  using Argon.</changelog>
  <changelog author="lnussel@suse.de" date="1629892800">- As YaST passes necessary parameters to cryptsetup anyway, we do
  not necessarily need to take grub into consideration. So back to
  Argon2 to see how it goes.</changelog>
  <changelog author="lnussel@suse.de" date="1631793600">- cryptsetup 2.4.1
  * Fix compilation for libc implementations without dlvsym().
  * Fix compilation and tests on systems with non-standard libraries
  * Try to workaround some issues on systems without udev support.
  * Fixes for OpenSSL3 crypto backend (including FIPS mode).
  * Print error message when assigning a token to an inactive keyslot.
  * Fix offset bug in LUKS2 encryption code if --offset option was used.
  * Do not allow LUKS2 decryption for devices with data offset.
  * Fix LUKS1 cryptsetup repair command for some specific problems.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1637236800">- cryptsetup 2.4.2:
  * Fix possible large memory allocation if LUKS2 header size is
    invalid.
  * Fix memory corruption in debug message printing LUKS2
    checksum.
  * veritysetup: remove link to the UUID library for the static
    build.
  * Remove link to pwquality library for integritysetup and
    veritysetup. These tools do not read passphrases.
  * OpenSSL3 backend: avoid remaining deprecated calls in API.
    Crypto backend no longer use API deprecated in OpenSSL 3.0
  * Check if kernel device-mapper create device failed in an early
    phase. This happens when a concurrent creation of device-mapper
    devices meets in the very early state.
  * Do not set compiler optimization flag for Argon2 KDF if the
    memory wipe is implemented in libc.
  * Do not attempt to unload LUKS2 tokens if external tokens are
    disabled. This allows building a static binary with
  - -disable-external-tokens.
  * LUKS convert: also check sysfs for device activity.
    If udev symlink is missing, code fallbacks to sysfs scan to
    prevent data corruption for the active device.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1642161600">- cryptsetup 2.4.3:
  * Fix possible attacks against data confidentiality through
    LUKS2 online reencryption extension crash recovery
    CVE-2021-4122, boo#1194469
  * Add configure option --disable-luks2-reencryption to completely
    disable LUKS2 reencryption code.
  * Improve internal metadata validation code for reencryption
    metadata
  * Add updated documentation for LUKS2 On-Disk Format
    Specification version 1.1.0
  * Fix support for bitlk (BitLocker compatible) startup key with
    new  metadata entry introduced in Windows 11
  * Fix space restriction for LUKS2 reencryption with data shift</changelog>
  <changelog author="lnussel@suse.de" date="1661169600">- cryptsetup 2.5.0:
  * Split manual pages into per-action pages and use AsciiDoc format.
  * Remove cryptsetup-reencrypt tool from the project and move reencryption
    to already existing "cryptsetup reencrypt" command.
    If you need to emulate the old cryptsetup-reencrypt binary, use simple
    wrappers script running "exec cryptsetup reencrypt $@".
  * LUKS2: implement --decryption option that allows LUKS removal.
  * Fix decryption operation with --active-name option and restrict
    it to be used only with LUKS2.
  * Do not refresh reencryption digest when not needed.
    This should speed up the reencryption resume process.
  * Store proper resilience data in LUKS2 reencrypt initialization.
    Resuming reencryption now does not require specification of resilience
    type parameters if these are the same as during initialization.
  * Properly wipe the unused area after reencryption with datashift in
    the forward direction.
  * Check datashift value against larger sector size.
    For example, it could cause an issue if misaligned 4K sector appears
    during decryption.
  * Do not allow sector size increase reencryption in offline mode.
  * Do not allow dangerous sector size change during reencryption.
  * Ask the user for confirmation before resuming reencryption.
  * Do not resume reencryption with conflicting parameters.
  * Add --force-offline-reencrypt option.
  * Do not allow nested encryption in LUKS reencrypt.
  * Support all options allowed with luksFormat with encrypt action.
  * Add resize action to integritysetup.
  * Remove obsolete dracut plugin reencryption example.
  * Fix possible keyslot area size overflow during conversion to LUKS2.
  * Allow use of --header option for cryptsetup close.
  * Fix activation of LUKS2 device with integrity and detached header.
  * Add ZEROOUT IOCTL support for crypt_wipe API call.
  * VERITY: set loopback sector size according to dm-verity block sizes.
  * veritysetup: dump device sizes.
  * LUKS2 token: prefer token PIN query before passphrase in some cases.
    When a user provides --token-type or specific --token-id, a token PIN
    query is preferred to a passphrase query.
  * LUKS2 token: allow tokens to be replaced with --token-replace option
    for cryptsetup token command.
  * LUKS2 token: do not continue operation when interrupted in PIN prompt.
  * Add --progress-json parameter to utilities.
  * Add support for --key-slot option in luksResume action.
- move man pages to separate subpackage
- drop backports handling</changelog>
  <changelog author="luca.boccassi@gmail.com" date="1663070400">- Add virtual provides for 'integritysetup' and 'veritysetup' to match
  package names provided by Fedora/RHEL, to allow the same set of
  dependencies to be used across all RPM distributions.</changelog>
  <changelog author="info@paolostivanin.com" date="1669636800">- cryptsetup 2.6.0:
  * Introduce support for handling macOS FileVault2 devices (FVAULT2).
  * libcryptsetup: no longer use global memory locking through mlockall()
  * libcryptsetup: process priority is increased only for key derivation
    (PBKDF) calls.
  * Add new LUKS keyslot context handling functions and API.
  * The volume key may now be extracted using a passphrase, keyfile, or
    token. For LUKS devices, it also returns the volume key after
    a successful crypt_format call.
  * Fix --disable-luks2-reencryption configuration option.
  * cryptsetup: Print a better error message and warning if the format
    produces an image without space available for data.
  * Print error if anti-forensic LUKS2 hash setting is not available.
    If the specified hash was not available, activation quietly failed.
  * Fix internal crypt segment compare routine if the user
    specified cipher in kernel format (capi: prefix).
  * cryptsetup: Add token unassign action.
    This action allows removing token binding on specific keyslot.
  * veritysetup: add support for --use-tasklets option.
    This option sets try_verify_in_tasklet kernel dm-verity option
    (available since Linux kernel 6.0) to allow some performance
    improvement on specific systems.
  * Provide pkgconfig Require.private settings.
    While we do not completely provide static build on udev systems,
    it helps produce statically linked binaries in certain situations.
  * Always update automake library files if autogen.sh is run.
    For several releases, we distributed older automake scripts by mistake.
  * reencryption: Fix user defined moved segment size in LUKS2 decryption.
    The --hotzone-size argument was ignored in cases where the actual data
    size was less than the original LUKS2 data offset.
  * Delegate FIPS mode detection to configured crypto backend.
    System FIPS mode check no longer depends on /etc/system-fips file.
  * Update documentation, including FAQ and man pages.</changelog>
  <changelog author="lnussel@suse.com" date="1672142400">- Replace transitional %usrmerged macro with regular version check (boo#1206798)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1676203200">- cryptsetup 2.6.1
  * bitlk: Fixes for BitLocker-compatible on-disk metadata parser
  * Fix possible iteration overflow in OpenSSL2 PBKDF2 crypto
    backend
  * portability and compilation fixes
  * verity: Fix possible hash offset setting overflow.
  * bitlk: Fix use of startup BEK key on big-endian platforms.
  * Do not initiate encryption (reencryption command) when the
    header and data devices are the same. If data device reduction
    is not requsted, this leads to data corruption since LUKS
    metadata was written over the data device.
  * Fix possible memory leak if crypt_load() fails.
  * Always use passphrases with a minimal 8 chars length for
    benchmarking, as used in some implementation of FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1686744000">- FIPS: Remove not needed libcryptsetup12-hmac package that contains
  the HMAC checksums for integrity checking for FIPS. [bsc#1185116]
  * Remove the cryptsetup-rpmlintrc file.
  * Remove not needed fipscheck dependency.</changelog>
  <changelog author="pmonreal@suse.com" date="1686744001">- Enable running the regression test suite.
- Force a regeneration of the man pages from AsciiDoc.
- Add LUKS1 and LUKS2 On-Disk Format Specification pdfs to doc.</changelog>
  <changelog author="pmonreal@suse.com" date="1689249600">- luksFormat: Handle system with low memory and no swap space [bsc#1211079]
  * Check for physical memory available also in PBKDF benchmark.
  * Try to avoid OOM killer on low-memory systems without swap.
  * Use only half of detected free memory on systems without swap.
  * Add patches:
  - cryptsetup-Check-for-physical-memory-available-also-in-PBKDF-be.patch
  - cryptsetup-Try-to-avoid-OOM-killer-on-low-memory-systems-withou.patch
  - cryptsetup-Use-only-half-of-detected-free-memory-on-systems-wit.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1706529600">- Update to 2.7.0:
  * Full changelog in:
    mirrors.edge.kernel.org/pub/linux/utils/cryptsetup/v2.7/v2.7.0-ReleaseNotes
  * Introduce support for hardware OPAL disk encryption.
  * plain mode: Set default cipher to aes-xts-plain64 and password hashing
    to sha256.
  * Allow activation (open), luksResume, and luksAddKey to use the volume
    key stored in a keyring.
  * Allow to store volume key to a user-specified keyring in open and
    luksResume commands.
  * Do not flush IO operations if resize grows the device.
    This can help performance in specific cases where the encrypted device
    is extended automatically while running many IO operations.
  * Use only half of detected free memory for Argon2 PBKDF on systems
    without swap (for LUKS2 new keyslot or format operations).
  * Add the possibility to specify a directory for external LUKS2 token
    handlers (plugins).
  * Do not allow reencryption/decryption on LUKS2 devices with
    authenticated encryption or hardware (OPAL) encryption.
  * Do not fail LUKS format if the operation was interrupted on subsequent
    device wipe.
  * Fix the LUKS2 keyslot option to be used while activating the device
    by a token.
  * Properly report if the dm-verity device cannot be activated due to
    the inability to verify the signed root hash (ENOKEY).
  * Fix to check passphrase for selected keyslot only when adding
    new keyslot.
  * Fix to not wipe the keyslot area before in-place overwrite.
  * bitlk: Fix segfaults when attempting to verify the volume key.
  * Add --disable-blkid command line option to avoid blkid device check.
  * Add support for the meson build system.
  * Fix wipe operation that overwrites the whole device if used for LUKS2
    header with no keyslot area.
  * Fix luksErase to work with detached LUKS header.
  * Disallow the use of internal kernel crypto driver names in "capi"
    specification.
  * Fix reencryption to fail early for unknown cipher.
  * tcrypt: Support new Blake2 hash for VeraCrypt.
  * tcrypt: use hash values as substring for limiting KDF check.
  * Add Aria cipher support and block size info.
  * Do not decrease PBKDF parameters if the user forces them.
  * Support OpenSSL 3.2 Argon2 implementation.
  * Add support for Argon2 from libgcrypt
    (requires yet unreleased gcrypt 1.11).
  * Used Argon2 PBKDF implementation is now reported in debug mode
    in the cryptographic backend version. For native support in
    OpenSSL 3.2 or libgcrypt 1.11, "argon2" is displayed.
    If libargon2 is used, "cryptsetup libargon2" (for embedded
    library) or "external libargon2" is displayed.
  * Link only libcrypto from OpenSSL.
  * Disable reencryption for Direct-Access (DAX) devices.
  * Print a warning message if the device is not aligned to sector size.
  * Fix sector size and integrity fields display for non-LUKS2 crypt
    devices for the status command.
  * Fix suspend for LUKS2 with authenticated encryption (also suspend
    dm-integrity device underneath).
  * Update keyring and locking documentation and LUKS2 specification
    for OPAL2 support.
  * Remove patches fixed upstream:
  - cryptsetup-Check-for-physical-memory-available-also-in-PBKDF-be.patch
  - cryptsetup-Try-to-avoid-OOM-killer-on-low-memory-systems-withou.patch
  - cryptsetup-Use-only-half-of-detected-free-memory-on-systems-wit.patch</changelog>
  <changelog author="meissner@suse.com" date="1725019200">- cryptsetup-fips140-3.patch: extend the password for PBKDF2 benchmarking
  to be more than 20 chars to meet FIPS 140-3 requirements (bsc#1229975)</changelog>
</package>
<package pkgid="1f9ce6de7d21c78d34938585db26e0796377cbe9581315877bf9f11a99fc83ec" name="cryptsetup" arch="src">
  <version epoch="0" ver="2.7.0" rel="150600.3.3.1"/>
  <changelog author="dmueller@suse.com" date="1615550400">- move licenses to licensedir</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1615636800">- cryptsetup 2.3.5:
  * Fix partial reads of passphrase from an interactive terminal
  * Fix maximum length of password entered through a terminal
  * integritysetup: support new dm-integrity HMAC recalculation
    options
  * integritysetup: display of recalculating sector in dump command
  * veritysetup: fix verity FEC if stored in the same image with
    hashes
  * veritysetup: run FEC repair check even if root hash fails
  * veritysetup: do not process hash image if hash area is empty
  * veritysetup: store verity hash algorithm in superblock in
    lowercase
  * bitlk: fix a crash if the device disappears during BitLocker
    scan
  * bitlk: show a better error when trying to open an NTFS device
  * bitlk: add support for startup key protected VMKs
  * Fix LUKS1 repair code (regression since version 1.7.x)
  * Fix luksKeyChange for LUKS2 with assigned tokens
  * Fix cryptsetup resize using LUKS2 tokens
  * Print a visible error if device resize is not supported
  * Add error message when suspending wrong non-LUKS device
  * Fix default XTS mode key size in reencryption
  * Rephrase missing locking directory warning and move it to
    debug level
  * Many fixes for the use of cipher_null (empty debug cipher)
  * Fixes for libpasswdqc 2.0.x (optional passphrase quality check)
  * Fixes for problems discovered by various tools for code
    analysis
  * Various fixes to man pages
- silence hmac packaging warnings</changelog>
  <changelog author="lnussel@suse.de" date="1625140800">- cryptsetup 2.3.6:
  * integritysetup: Fix possible dm-integrity mapping table truncation.
  * cryptsetup: Backup header can be used to activate TCRYPT device.
    Use --header option to specify the header.
  * cryptsetup: Avoid LUKS2 decryption without detached header.
    This feature will be added later and is currently not supported.
  * Additional fixes and workarounds for common warnings produced
    by some static analysis tools (like gcc-11 analyzer) and additional
    code hardening.
  * Fix standalone libintl detection for compiled tests.
  * Add Blake2b and Blake2s hash support for crypto backends.
    Kernel and gcrypt crypto backend support all variants.
    OpenSSL supports only Blake2b-512 and Blake2s-256.
    Crypto backend supports kernel notation e.g. "blake2b-512".</changelog>
  <changelog author="fvogt@suse.com" date="1627905600">- Use LUKS2 as default format on Tumbleweed.
  It provides some additional features which other tools
  (e.g. systemd-cryptenroll) rely on. GRUB 2.06 supports unlocking
  LUKS2 volumes meanwhile.</changelog>
  <changelog author="lnussel@suse.de" date="1627905601">- cryptsetup 2.4.0 (jsc#SLE-20275)
  * External LUKS token plugins
  * Experimental SSH token
  * Default LUKS2 PBKDF is now Argon2id
  * Increase minimal memory cost for Argon2 benchmark to 64MiB.
  * Autodetect optimal encryption sector size on LUKS2 format.
  * Use VeraCrypt option by default and add --disable-veracrypt option.
  * Support --hash and --cipher to limit opening time for TCRYPT type
  * Fixed default OpenSSL crypt backend support for OpenSSL3.
  * integritysetup: add integrity-recalculate-reset flag.
  * cryptsetup: retains keyslot number in luksChangeKey for LUKS2.
  * Fix cryptsetup resize using LUKS2 tokens.
  * Add close --deferred and --cancel-deferred options.
  * Rewritten command-line option parsing to avoid libpopt arguments
    memory leaks.
  * Add --test-args option.</changelog>
  <changelog author="lnussel@suse.de" date="1627992000">- need to use PBKDF2 by default for LUKS2 as grub can't decrypt when
  using Argon.</changelog>
  <changelog author="lnussel@suse.de" date="1629892800">- As YaST passes necessary parameters to cryptsetup anyway, we do
  not necessarily need to take grub into consideration. So back to
  Argon2 to see how it goes.</changelog>
  <changelog author="lnussel@suse.de" date="1631793600">- cryptsetup 2.4.1
  * Fix compilation for libc implementations without dlvsym().
  * Fix compilation and tests on systems with non-standard libraries
  * Try to workaround some issues on systems without udev support.
  * Fixes for OpenSSL3 crypto backend (including FIPS mode).
  * Print error message when assigning a token to an inactive keyslot.
  * Fix offset bug in LUKS2 encryption code if --offset option was used.
  * Do not allow LUKS2 decryption for devices with data offset.
  * Fix LUKS1 cryptsetup repair command for some specific problems.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1637236800">- cryptsetup 2.4.2:
  * Fix possible large memory allocation if LUKS2 header size is
    invalid.
  * Fix memory corruption in debug message printing LUKS2
    checksum.
  * veritysetup: remove link to the UUID library for the static
    build.
  * Remove link to pwquality library for integritysetup and
    veritysetup. These tools do not read passphrases.
  * OpenSSL3 backend: avoid remaining deprecated calls in API.
    Crypto backend no longer use API deprecated in OpenSSL 3.0
  * Check if kernel device-mapper create device failed in an early
    phase. This happens when a concurrent creation of device-mapper
    devices meets in the very early state.
  * Do not set compiler optimization flag for Argon2 KDF if the
    memory wipe is implemented in libc.
  * Do not attempt to unload LUKS2 tokens if external tokens are
    disabled. This allows building a static binary with
  - -disable-external-tokens.
  * LUKS convert: also check sysfs for device activity.
    If udev symlink is missing, code fallbacks to sysfs scan to
    prevent data corruption for the active device.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1642161600">- cryptsetup 2.4.3:
  * Fix possible attacks against data confidentiality through
    LUKS2 online reencryption extension crash recovery
    CVE-2021-4122, boo#1194469
  * Add configure option --disable-luks2-reencryption to completely
    disable LUKS2 reencryption code.
  * Improve internal metadata validation code for reencryption
    metadata
  * Add updated documentation for LUKS2 On-Disk Format
    Specification version 1.1.0
  * Fix support for bitlk (BitLocker compatible) startup key with
    new  metadata entry introduced in Windows 11
  * Fix space restriction for LUKS2 reencryption with data shift</changelog>
  <changelog author="lnussel@suse.de" date="1661169600">- cryptsetup 2.5.0:
  * Split manual pages into per-action pages and use AsciiDoc format.
  * Remove cryptsetup-reencrypt tool from the project and move reencryption
    to already existing "cryptsetup reencrypt" command.
    If you need to emulate the old cryptsetup-reencrypt binary, use simple
    wrappers script running "exec cryptsetup reencrypt $@".
  * LUKS2: implement --decryption option that allows LUKS removal.
  * Fix decryption operation with --active-name option and restrict
    it to be used only with LUKS2.
  * Do not refresh reencryption digest when not needed.
    This should speed up the reencryption resume process.
  * Store proper resilience data in LUKS2 reencrypt initialization.
    Resuming reencryption now does not require specification of resilience
    type parameters if these are the same as during initialization.
  * Properly wipe the unused area after reencryption with datashift in
    the forward direction.
  * Check datashift value against larger sector size.
    For example, it could cause an issue if misaligned 4K sector appears
    during decryption.
  * Do not allow sector size increase reencryption in offline mode.
  * Do not allow dangerous sector size change during reencryption.
  * Ask the user for confirmation before resuming reencryption.
  * Do not resume reencryption with conflicting parameters.
  * Add --force-offline-reencrypt option.
  * Do not allow nested encryption in LUKS reencrypt.
  * Support all options allowed with luksFormat with encrypt action.
  * Add resize action to integritysetup.
  * Remove obsolete dracut plugin reencryption example.
  * Fix possible keyslot area size overflow during conversion to LUKS2.
  * Allow use of --header option for cryptsetup close.
  * Fix activation of LUKS2 device with integrity and detached header.
  * Add ZEROOUT IOCTL support for crypt_wipe API call.
  * VERITY: set loopback sector size according to dm-verity block sizes.
  * veritysetup: dump device sizes.
  * LUKS2 token: prefer token PIN query before passphrase in some cases.
    When a user provides --token-type or specific --token-id, a token PIN
    query is preferred to a passphrase query.
  * LUKS2 token: allow tokens to be replaced with --token-replace option
    for cryptsetup token command.
  * LUKS2 token: do not continue operation when interrupted in PIN prompt.
  * Add --progress-json parameter to utilities.
  * Add support for --key-slot option in luksResume action.
- move man pages to separate subpackage
- drop backports handling</changelog>
  <changelog author="luca.boccassi@gmail.com" date="1663070400">- Add virtual provides for 'integritysetup' and 'veritysetup' to match
  package names provided by Fedora/RHEL, to allow the same set of
  dependencies to be used across all RPM distributions.</changelog>
  <changelog author="info@paolostivanin.com" date="1669636800">- cryptsetup 2.6.0:
  * Introduce support for handling macOS FileVault2 devices (FVAULT2).
  * libcryptsetup: no longer use global memory locking through mlockall()
  * libcryptsetup: process priority is increased only for key derivation
    (PBKDF) calls.
  * Add new LUKS keyslot context handling functions and API.
  * The volume key may now be extracted using a passphrase, keyfile, or
    token. For LUKS devices, it also returns the volume key after
    a successful crypt_format call.
  * Fix --disable-luks2-reencryption configuration option.
  * cryptsetup: Print a better error message and warning if the format
    produces an image without space available for data.
  * Print error if anti-forensic LUKS2 hash setting is not available.
    If the specified hash was not available, activation quietly failed.
  * Fix internal crypt segment compare routine if the user
    specified cipher in kernel format (capi: prefix).
  * cryptsetup: Add token unassign action.
    This action allows removing token binding on specific keyslot.
  * veritysetup: add support for --use-tasklets option.
    This option sets try_verify_in_tasklet kernel dm-verity option
    (available since Linux kernel 6.0) to allow some performance
    improvement on specific systems.
  * Provide pkgconfig Require.private settings.
    While we do not completely provide static build on udev systems,
    it helps produce statically linked binaries in certain situations.
  * Always update automake library files if autogen.sh is run.
    For several releases, we distributed older automake scripts by mistake.
  * reencryption: Fix user defined moved segment size in LUKS2 decryption.
    The --hotzone-size argument was ignored in cases where the actual data
    size was less than the original LUKS2 data offset.
  * Delegate FIPS mode detection to configured crypto backend.
    System FIPS mode check no longer depends on /etc/system-fips file.
  * Update documentation, including FAQ and man pages.</changelog>
  <changelog author="lnussel@suse.com" date="1672142400">- Replace transitional %usrmerged macro with regular version check (boo#1206798)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1676203200">- cryptsetup 2.6.1
  * bitlk: Fixes for BitLocker-compatible on-disk metadata parser
  * Fix possible iteration overflow in OpenSSL2 PBKDF2 crypto
    backend
  * portability and compilation fixes
  * verity: Fix possible hash offset setting overflow.
  * bitlk: Fix use of startup BEK key on big-endian platforms.
  * Do not initiate encryption (reencryption command) when the
    header and data devices are the same. If data device reduction
    is not requsted, this leads to data corruption since LUKS
    metadata was written over the data device.
  * Fix possible memory leak if crypt_load() fails.
  * Always use passphrases with a minimal 8 chars length for
    benchmarking, as used in some implementation of FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1686744000">- FIPS: Remove not needed libcryptsetup12-hmac package that contains
  the HMAC checksums for integrity checking for FIPS. [bsc#1185116]
  * Remove the cryptsetup-rpmlintrc file.
  * Remove not needed fipscheck dependency.</changelog>
  <changelog author="pmonreal@suse.com" date="1686744001">- Enable running the regression test suite.
- Force a regeneration of the man pages from AsciiDoc.
- Add LUKS1 and LUKS2 On-Disk Format Specification pdfs to doc.</changelog>
  <changelog author="pmonreal@suse.com" date="1689249600">- luksFormat: Handle system with low memory and no swap space [bsc#1211079]
  * Check for physical memory available also in PBKDF benchmark.
  * Try to avoid OOM killer on low-memory systems without swap.
  * Use only half of detected free memory on systems without swap.
  * Add patches:
  - cryptsetup-Check-for-physical-memory-available-also-in-PBKDF-be.patch
  - cryptsetup-Try-to-avoid-OOM-killer-on-low-memory-systems-withou.patch
  - cryptsetup-Use-only-half-of-detected-free-memory-on-systems-wit.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1706529600">- Update to 2.7.0:
  * Full changelog in:
    mirrors.edge.kernel.org/pub/linux/utils/cryptsetup/v2.7/v2.7.0-ReleaseNotes
  * Introduce support for hardware OPAL disk encryption.
  * plain mode: Set default cipher to aes-xts-plain64 and password hashing
    to sha256.
  * Allow activation (open), luksResume, and luksAddKey to use the volume
    key stored in a keyring.
  * Allow to store volume key to a user-specified keyring in open and
    luksResume commands.
  * Do not flush IO operations if resize grows the device.
    This can help performance in specific cases where the encrypted device
    is extended automatically while running many IO operations.
  * Use only half of detected free memory for Argon2 PBKDF on systems
    without swap (for LUKS2 new keyslot or format operations).
  * Add the possibility to specify a directory for external LUKS2 token
    handlers (plugins).
  * Do not allow reencryption/decryption on LUKS2 devices with
    authenticated encryption or hardware (OPAL) encryption.
  * Do not fail LUKS format if the operation was interrupted on subsequent
    device wipe.
  * Fix the LUKS2 keyslot option to be used while activating the device
    by a token.
  * Properly report if the dm-verity device cannot be activated due to
    the inability to verify the signed root hash (ENOKEY).
  * Fix to check passphrase for selected keyslot only when adding
    new keyslot.
  * Fix to not wipe the keyslot area before in-place overwrite.
  * bitlk: Fix segfaults when attempting to verify the volume key.
  * Add --disable-blkid command line option to avoid blkid device check.
  * Add support for the meson build system.
  * Fix wipe operation that overwrites the whole device if used for LUKS2
    header with no keyslot area.
  * Fix luksErase to work with detached LUKS header.
  * Disallow the use of internal kernel crypto driver names in "capi"
    specification.
  * Fix reencryption to fail early for unknown cipher.
  * tcrypt: Support new Blake2 hash for VeraCrypt.
  * tcrypt: use hash values as substring for limiting KDF check.
  * Add Aria cipher support and block size info.
  * Do not decrease PBKDF parameters if the user forces them.
  * Support OpenSSL 3.2 Argon2 implementation.
  * Add support for Argon2 from libgcrypt
    (requires yet unreleased gcrypt 1.11).
  * Used Argon2 PBKDF implementation is now reported in debug mode
    in the cryptographic backend version. For native support in
    OpenSSL 3.2 or libgcrypt 1.11, "argon2" is displayed.
    If libargon2 is used, "cryptsetup libargon2" (for embedded
    library) or "external libargon2" is displayed.
  * Link only libcrypto from OpenSSL.
  * Disable reencryption for Direct-Access (DAX) devices.
  * Print a warning message if the device is not aligned to sector size.
  * Fix sector size and integrity fields display for non-LUKS2 crypt
    devices for the status command.
  * Fix suspend for LUKS2 with authenticated encryption (also suspend
    dm-integrity device underneath).
  * Update keyring and locking documentation and LUKS2 specification
    for OPAL2 support.
  * Remove patches fixed upstream:
  - cryptsetup-Check-for-physical-memory-available-also-in-PBKDF-be.patch
  - cryptsetup-Try-to-avoid-OOM-killer-on-low-memory-systems-withou.patch
  - cryptsetup-Use-only-half-of-detected-free-memory-on-systems-wit.patch</changelog>
  <changelog author="meissner@suse.com" date="1725019200">- cryptsetup-fips140-3.patch: extend the password for PBKDF2 benchmarking
  to be more than 20 chars to meet FIPS 140-3 requirements (bsc#1229975)</changelog>
</package>
<package pkgid="6d90665bbb0f4452df5248edd4b77ff436606e91493761db377a4e9a1e5116c1" name="cryptsetup" arch="x86_64">
  <version epoch="0" ver="2.7.0" rel="150600.3.3.1"/>
  <changelog author="dmueller@suse.com" date="1615550400">- move licenses to licensedir</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1615636800">- cryptsetup 2.3.5:
  * Fix partial reads of passphrase from an interactive terminal
  * Fix maximum length of password entered through a terminal
  * integritysetup: support new dm-integrity HMAC recalculation
    options
  * integritysetup: display of recalculating sector in dump command
  * veritysetup: fix verity FEC if stored in the same image with
    hashes
  * veritysetup: run FEC repair check even if root hash fails
  * veritysetup: do not process hash image if hash area is empty
  * veritysetup: store verity hash algorithm in superblock in
    lowercase
  * bitlk: fix a crash if the device disappears during BitLocker
    scan
  * bitlk: show a better error when trying to open an NTFS device
  * bitlk: add support for startup key protected VMKs
  * Fix LUKS1 repair code (regression since version 1.7.x)
  * Fix luksKeyChange for LUKS2 with assigned tokens
  * Fix cryptsetup resize using LUKS2 tokens
  * Print a visible error if device resize is not supported
  * Add error message when suspending wrong non-LUKS device
  * Fix default XTS mode key size in reencryption
  * Rephrase missing locking directory warning and move it to
    debug level
  * Many fixes for the use of cipher_null (empty debug cipher)
  * Fixes for libpasswdqc 2.0.x (optional passphrase quality check)
  * Fixes for problems discovered by various tools for code
    analysis
  * Various fixes to man pages
- silence hmac packaging warnings</changelog>
  <changelog author="lnussel@suse.de" date="1625140800">- cryptsetup 2.3.6:
  * integritysetup: Fix possible dm-integrity mapping table truncation.
  * cryptsetup: Backup header can be used to activate TCRYPT device.
    Use --header option to specify the header.
  * cryptsetup: Avoid LUKS2 decryption without detached header.
    This feature will be added later and is currently not supported.
  * Additional fixes and workarounds for common warnings produced
    by some static analysis tools (like gcc-11 analyzer) and additional
    code hardening.
  * Fix standalone libintl detection for compiled tests.
  * Add Blake2b and Blake2s hash support for crypto backends.
    Kernel and gcrypt crypto backend support all variants.
    OpenSSL supports only Blake2b-512 and Blake2s-256.
    Crypto backend supports kernel notation e.g. "blake2b-512".</changelog>
  <changelog author="fvogt@suse.com" date="1627905600">- Use LUKS2 as default format on Tumbleweed.
  It provides some additional features which other tools
  (e.g. systemd-cryptenroll) rely on. GRUB 2.06 supports unlocking
  LUKS2 volumes meanwhile.</changelog>
  <changelog author="lnussel@suse.de" date="1627905601">- cryptsetup 2.4.0 (jsc#SLE-20275)
  * External LUKS token plugins
  * Experimental SSH token
  * Default LUKS2 PBKDF is now Argon2id
  * Increase minimal memory cost for Argon2 benchmark to 64MiB.
  * Autodetect optimal encryption sector size on LUKS2 format.
  * Use VeraCrypt option by default and add --disable-veracrypt option.
  * Support --hash and --cipher to limit opening time for TCRYPT type
  * Fixed default OpenSSL crypt backend support for OpenSSL3.
  * integritysetup: add integrity-recalculate-reset flag.
  * cryptsetup: retains keyslot number in luksChangeKey for LUKS2.
  * Fix cryptsetup resize using LUKS2 tokens.
  * Add close --deferred and --cancel-deferred options.
  * Rewritten command-line option parsing to avoid libpopt arguments
    memory leaks.
  * Add --test-args option.</changelog>
  <changelog author="lnussel@suse.de" date="1627992000">- need to use PBKDF2 by default for LUKS2 as grub can't decrypt when
  using Argon.</changelog>
  <changelog author="lnussel@suse.de" date="1629892800">- As YaST passes necessary parameters to cryptsetup anyway, we do
  not necessarily need to take grub into consideration. So back to
  Argon2 to see how it goes.</changelog>
  <changelog author="lnussel@suse.de" date="1631793600">- cryptsetup 2.4.1
  * Fix compilation for libc implementations without dlvsym().
  * Fix compilation and tests on systems with non-standard libraries
  * Try to workaround some issues on systems without udev support.
  * Fixes for OpenSSL3 crypto backend (including FIPS mode).
  * Print error message when assigning a token to an inactive keyslot.
  * Fix offset bug in LUKS2 encryption code if --offset option was used.
  * Do not allow LUKS2 decryption for devices with data offset.
  * Fix LUKS1 cryptsetup repair command for some specific problems.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1637236800">- cryptsetup 2.4.2:
  * Fix possible large memory allocation if LUKS2 header size is
    invalid.
  * Fix memory corruption in debug message printing LUKS2
    checksum.
  * veritysetup: remove link to the UUID library for the static
    build.
  * Remove link to pwquality library for integritysetup and
    veritysetup. These tools do not read passphrases.
  * OpenSSL3 backend: avoid remaining deprecated calls in API.
    Crypto backend no longer use API deprecated in OpenSSL 3.0
  * Check if kernel device-mapper create device failed in an early
    phase. This happens when a concurrent creation of device-mapper
    devices meets in the very early state.
  * Do not set compiler optimization flag for Argon2 KDF if the
    memory wipe is implemented in libc.
  * Do not attempt to unload LUKS2 tokens if external tokens are
    disabled. This allows building a static binary with
  - -disable-external-tokens.
  * LUKS convert: also check sysfs for device activity.
    If udev symlink is missing, code fallbacks to sysfs scan to
    prevent data corruption for the active device.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1642161600">- cryptsetup 2.4.3:
  * Fix possible attacks against data confidentiality through
    LUKS2 online reencryption extension crash recovery
    CVE-2021-4122, boo#1194469
  * Add configure option --disable-luks2-reencryption to completely
    disable LUKS2 reencryption code.
  * Improve internal metadata validation code for reencryption
    metadata
  * Add updated documentation for LUKS2 On-Disk Format
    Specification version 1.1.0
  * Fix support for bitlk (BitLocker compatible) startup key with
    new  metadata entry introduced in Windows 11
  * Fix space restriction for LUKS2 reencryption with data shift</changelog>
  <changelog author="lnussel@suse.de" date="1661169600">- cryptsetup 2.5.0:
  * Split manual pages into per-action pages and use AsciiDoc format.
  * Remove cryptsetup-reencrypt tool from the project and move reencryption
    to already existing "cryptsetup reencrypt" command.
    If you need to emulate the old cryptsetup-reencrypt binary, use simple
    wrappers script running "exec cryptsetup reencrypt $@".
  * LUKS2: implement --decryption option that allows LUKS removal.
  * Fix decryption operation with --active-name option and restrict
    it to be used only with LUKS2.
  * Do not refresh reencryption digest when not needed.
    This should speed up the reencryption resume process.
  * Store proper resilience data in LUKS2 reencrypt initialization.
    Resuming reencryption now does not require specification of resilience
    type parameters if these are the same as during initialization.
  * Properly wipe the unused area after reencryption with datashift in
    the forward direction.
  * Check datashift value against larger sector size.
    For example, it could cause an issue if misaligned 4K sector appears
    during decryption.
  * Do not allow sector size increase reencryption in offline mode.
  * Do not allow dangerous sector size change during reencryption.
  * Ask the user for confirmation before resuming reencryption.
  * Do not resume reencryption with conflicting parameters.
  * Add --force-offline-reencrypt option.
  * Do not allow nested encryption in LUKS reencrypt.
  * Support all options allowed with luksFormat with encrypt action.
  * Add resize action to integritysetup.
  * Remove obsolete dracut plugin reencryption example.
  * Fix possible keyslot area size overflow during conversion to LUKS2.
  * Allow use of --header option for cryptsetup close.
  * Fix activation of LUKS2 device with integrity and detached header.
  * Add ZEROOUT IOCTL support for crypt_wipe API call.
  * VERITY: set loopback sector size according to dm-verity block sizes.
  * veritysetup: dump device sizes.
  * LUKS2 token: prefer token PIN query before passphrase in some cases.
    When a user provides --token-type or specific --token-id, a token PIN
    query is preferred to a passphrase query.
  * LUKS2 token: allow tokens to be replaced with --token-replace option
    for cryptsetup token command.
  * LUKS2 token: do not continue operation when interrupted in PIN prompt.
  * Add --progress-json parameter to utilities.
  * Add support for --key-slot option in luksResume action.
- move man pages to separate subpackage
- drop backports handling</changelog>
  <changelog author="luca.boccassi@gmail.com" date="1663070400">- Add virtual provides for 'integritysetup' and 'veritysetup' to match
  package names provided by Fedora/RHEL, to allow the same set of
  dependencies to be used across all RPM distributions.</changelog>
  <changelog author="info@paolostivanin.com" date="1669636800">- cryptsetup 2.6.0:
  * Introduce support for handling macOS FileVault2 devices (FVAULT2).
  * libcryptsetup: no longer use global memory locking through mlockall()
  * libcryptsetup: process priority is increased only for key derivation
    (PBKDF) calls.
  * Add new LUKS keyslot context handling functions and API.
  * The volume key may now be extracted using a passphrase, keyfile, or
    token. For LUKS devices, it also returns the volume key after
    a successful crypt_format call.
  * Fix --disable-luks2-reencryption configuration option.
  * cryptsetup: Print a better error message and warning if the format
    produces an image without space available for data.
  * Print error if anti-forensic LUKS2 hash setting is not available.
    If the specified hash was not available, activation quietly failed.
  * Fix internal crypt segment compare routine if the user
    specified cipher in kernel format (capi: prefix).
  * cryptsetup: Add token unassign action.
    This action allows removing token binding on specific keyslot.
  * veritysetup: add support for --use-tasklets option.
    This option sets try_verify_in_tasklet kernel dm-verity option
    (available since Linux kernel 6.0) to allow some performance
    improvement on specific systems.
  * Provide pkgconfig Require.private settings.
    While we do not completely provide static build on udev systems,
    it helps produce statically linked binaries in certain situations.
  * Always update automake library files if autogen.sh is run.
    For several releases, we distributed older automake scripts by mistake.
  * reencryption: Fix user defined moved segment size in LUKS2 decryption.
    The --hotzone-size argument was ignored in cases where the actual data
    size was less than the original LUKS2 data offset.
  * Delegate FIPS mode detection to configured crypto backend.
    System FIPS mode check no longer depends on /etc/system-fips file.
  * Update documentation, including FAQ and man pages.</changelog>
  <changelog author="lnussel@suse.com" date="1672142400">- Replace transitional %usrmerged macro with regular version check (boo#1206798)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1676203200">- cryptsetup 2.6.1
  * bitlk: Fixes for BitLocker-compatible on-disk metadata parser
  * Fix possible iteration overflow in OpenSSL2 PBKDF2 crypto
    backend
  * portability and compilation fixes
  * verity: Fix possible hash offset setting overflow.
  * bitlk: Fix use of startup BEK key on big-endian platforms.
  * Do not initiate encryption (reencryption command) when the
    header and data devices are the same. If data device reduction
    is not requsted, this leads to data corruption since LUKS
    metadata was written over the data device.
  * Fix possible memory leak if crypt_load() fails.
  * Always use passphrases with a minimal 8 chars length for
    benchmarking, as used in some implementation of FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1686744000">- FIPS: Remove not needed libcryptsetup12-hmac package that contains
  the HMAC checksums for integrity checking for FIPS. [bsc#1185116]
  * Remove the cryptsetup-rpmlintrc file.
  * Remove not needed fipscheck dependency.</changelog>
  <changelog author="pmonreal@suse.com" date="1686744001">- Enable running the regression test suite.
- Force a regeneration of the man pages from AsciiDoc.
- Add LUKS1 and LUKS2 On-Disk Format Specification pdfs to doc.</changelog>
  <changelog author="pmonreal@suse.com" date="1689249600">- luksFormat: Handle system with low memory and no swap space [bsc#1211079]
  * Check for physical memory available also in PBKDF benchmark.
  * Try to avoid OOM killer on low-memory systems without swap.
  * Use only half of detected free memory on systems without swap.
  * Add patches:
  - cryptsetup-Check-for-physical-memory-available-also-in-PBKDF-be.patch
  - cryptsetup-Try-to-avoid-OOM-killer-on-low-memory-systems-withou.patch
  - cryptsetup-Use-only-half-of-detected-free-memory-on-systems-wit.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1706529600">- Update to 2.7.0:
  * Full changelog in:
    mirrors.edge.kernel.org/pub/linux/utils/cryptsetup/v2.7/v2.7.0-ReleaseNotes
  * Introduce support for hardware OPAL disk encryption.
  * plain mode: Set default cipher to aes-xts-plain64 and password hashing
    to sha256.
  * Allow activation (open), luksResume, and luksAddKey to use the volume
    key stored in a keyring.
  * Allow to store volume key to a user-specified keyring in open and
    luksResume commands.
  * Do not flush IO operations if resize grows the device.
    This can help performance in specific cases where the encrypted device
    is extended automatically while running many IO operations.
  * Use only half of detected free memory for Argon2 PBKDF on systems
    without swap (for LUKS2 new keyslot or format operations).
  * Add the possibility to specify a directory for external LUKS2 token
    handlers (plugins).
  * Do not allow reencryption/decryption on LUKS2 devices with
    authenticated encryption or hardware (OPAL) encryption.
  * Do not fail LUKS format if the operation was interrupted on subsequent
    device wipe.
  * Fix the LUKS2 keyslot option to be used while activating the device
    by a token.
  * Properly report if the dm-verity device cannot be activated due to
    the inability to verify the signed root hash (ENOKEY).
  * Fix to check passphrase for selected keyslot only when adding
    new keyslot.
  * Fix to not wipe the keyslot area before in-place overwrite.
  * bitlk: Fix segfaults when attempting to verify the volume key.
  * Add --disable-blkid command line option to avoid blkid device check.
  * Add support for the meson build system.
  * Fix wipe operation that overwrites the whole device if used for LUKS2
    header with no keyslot area.
  * Fix luksErase to work with detached LUKS header.
  * Disallow the use of internal kernel crypto driver names in "capi"
    specification.
  * Fix reencryption to fail early for unknown cipher.
  * tcrypt: Support new Blake2 hash for VeraCrypt.
  * tcrypt: use hash values as substring for limiting KDF check.
  * Add Aria cipher support and block size info.
  * Do not decrease PBKDF parameters if the user forces them.
  * Support OpenSSL 3.2 Argon2 implementation.
  * Add support for Argon2 from libgcrypt
    (requires yet unreleased gcrypt 1.11).
  * Used Argon2 PBKDF implementation is now reported in debug mode
    in the cryptographic backend version. For native support in
    OpenSSL 3.2 or libgcrypt 1.11, "argon2" is displayed.
    If libargon2 is used, "cryptsetup libargon2" (for embedded
    library) or "external libargon2" is displayed.
  * Link only libcrypto from OpenSSL.
  * Disable reencryption for Direct-Access (DAX) devices.
  * Print a warning message if the device is not aligned to sector size.
  * Fix sector size and integrity fields display for non-LUKS2 crypt
    devices for the status command.
  * Fix suspend for LUKS2 with authenticated encryption (also suspend
    dm-integrity device underneath).
  * Update keyring and locking documentation and LUKS2 specification
    for OPAL2 support.
  * Remove patches fixed upstream:
  - cryptsetup-Check-for-physical-memory-available-also-in-PBKDF-be.patch
  - cryptsetup-Try-to-avoid-OOM-killer-on-low-memory-systems-withou.patch
  - cryptsetup-Use-only-half-of-detected-free-memory-on-systems-wit.patch</changelog>
  <changelog author="meissner@suse.com" date="1725019200">- cryptsetup-fips140-3.patch: extend the password for PBKDF2 benchmarking
  to be more than 20 chars to meet FIPS 140-3 requirements (bsc#1229975)</changelog>
</package>
<package pkgid="be9ac614c2761794de397afa97206d6a882e6a9ba845aeeb39b6ccec7e38c9d9" name="cryptsetup-doc" arch="noarch">
  <version epoch="0" ver="2.7.0" rel="150600.3.3.1"/>
  <changelog author="dmueller@suse.com" date="1615550400">- move licenses to licensedir</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1615636800">- cryptsetup 2.3.5:
  * Fix partial reads of passphrase from an interactive terminal
  * Fix maximum length of password entered through a terminal
  * integritysetup: support new dm-integrity HMAC recalculation
    options
  * integritysetup: display of recalculating sector in dump command
  * veritysetup: fix verity FEC if stored in the same image with
    hashes
  * veritysetup: run FEC repair check even if root hash fails
  * veritysetup: do not process hash image if hash area is empty
  * veritysetup: store verity hash algorithm in superblock in
    lowercase
  * bitlk: fix a crash if the device disappears during BitLocker
    scan
  * bitlk: show a better error when trying to open an NTFS device
  * bitlk: add support for startup key protected VMKs
  * Fix LUKS1 repair code (regression since version 1.7.x)
  * Fix luksKeyChange for LUKS2 with assigned tokens
  * Fix cryptsetup resize using LUKS2 tokens
  * Print a visible error if device resize is not supported
  * Add error message when suspending wrong non-LUKS device
  * Fix default XTS mode key size in reencryption
  * Rephrase missing locking directory warning and move it to
    debug level
  * Many fixes for the use of cipher_null (empty debug cipher)
  * Fixes for libpasswdqc 2.0.x (optional passphrase quality check)
  * Fixes for problems discovered by various tools for code
    analysis
  * Various fixes to man pages
- silence hmac packaging warnings</changelog>
  <changelog author="lnussel@suse.de" date="1625140800">- cryptsetup 2.3.6:
  * integritysetup: Fix possible dm-integrity mapping table truncation.
  * cryptsetup: Backup header can be used to activate TCRYPT device.
    Use --header option to specify the header.
  * cryptsetup: Avoid LUKS2 decryption without detached header.
    This feature will be added later and is currently not supported.
  * Additional fixes and workarounds for common warnings produced
    by some static analysis tools (like gcc-11 analyzer) and additional
    code hardening.
  * Fix standalone libintl detection for compiled tests.
  * Add Blake2b and Blake2s hash support for crypto backends.
    Kernel and gcrypt crypto backend support all variants.
    OpenSSL supports only Blake2b-512 and Blake2s-256.
    Crypto backend supports kernel notation e.g. "blake2b-512".</changelog>
  <changelog author="fvogt@suse.com" date="1627905600">- Use LUKS2 as default format on Tumbleweed.
  It provides some additional features which other tools
  (e.g. systemd-cryptenroll) rely on. GRUB 2.06 supports unlocking
  LUKS2 volumes meanwhile.</changelog>
  <changelog author="lnussel@suse.de" date="1627905601">- cryptsetup 2.4.0 (jsc#SLE-20275)
  * External LUKS token plugins
  * Experimental SSH token
  * Default LUKS2 PBKDF is now Argon2id
  * Increase minimal memory cost for Argon2 benchmark to 64MiB.
  * Autodetect optimal encryption sector size on LUKS2 format.
  * Use VeraCrypt option by default and add --disable-veracrypt option.
  * Support --hash and --cipher to limit opening time for TCRYPT type
  * Fixed default OpenSSL crypt backend support for OpenSSL3.
  * integritysetup: add integrity-recalculate-reset flag.
  * cryptsetup: retains keyslot number in luksChangeKey for LUKS2.
  * Fix cryptsetup resize using LUKS2 tokens.
  * Add close --deferred and --cancel-deferred options.
  * Rewritten command-line option parsing to avoid libpopt arguments
    memory leaks.
  * Add --test-args option.</changelog>
  <changelog author="lnussel@suse.de" date="1627992000">- need to use PBKDF2 by default for LUKS2 as grub can't decrypt when
  using Argon.</changelog>
  <changelog author="lnussel@suse.de" date="1629892800">- As YaST passes necessary parameters to cryptsetup anyway, we do
  not necessarily need to take grub into consideration. So back to
  Argon2 to see how it goes.</changelog>
  <changelog author="lnussel@suse.de" date="1631793600">- cryptsetup 2.4.1
  * Fix compilation for libc implementations without dlvsym().
  * Fix compilation and tests on systems with non-standard libraries
  * Try to workaround some issues on systems without udev support.
  * Fixes for OpenSSL3 crypto backend (including FIPS mode).
  * Print error message when assigning a token to an inactive keyslot.
  * Fix offset bug in LUKS2 encryption code if --offset option was used.
  * Do not allow LUKS2 decryption for devices with data offset.
  * Fix LUKS1 cryptsetup repair command for some specific problems.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1637236800">- cryptsetup 2.4.2:
  * Fix possible large memory allocation if LUKS2 header size is
    invalid.
  * Fix memory corruption in debug message printing LUKS2
    checksum.
  * veritysetup: remove link to the UUID library for the static
    build.
  * Remove link to pwquality library for integritysetup and
    veritysetup. These tools do not read passphrases.
  * OpenSSL3 backend: avoid remaining deprecated calls in API.
    Crypto backend no longer use API deprecated in OpenSSL 3.0
  * Check if kernel device-mapper create device failed in an early
    phase. This happens when a concurrent creation of device-mapper
    devices meets in the very early state.
  * Do not set compiler optimization flag for Argon2 KDF if the
    memory wipe is implemented in libc.
  * Do not attempt to unload LUKS2 tokens if external tokens are
    disabled. This allows building a static binary with
  - -disable-external-tokens.
  * LUKS convert: also check sysfs for device activity.
    If udev symlink is missing, code fallbacks to sysfs scan to
    prevent data corruption for the active device.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1642161600">- cryptsetup 2.4.3:
  * Fix possible attacks against data confidentiality through
    LUKS2 online reencryption extension crash recovery
    CVE-2021-4122, boo#1194469
  * Add configure option --disable-luks2-reencryption to completely
    disable LUKS2 reencryption code.
  * Improve internal metadata validation code for reencryption
    metadata
  * Add updated documentation for LUKS2 On-Disk Format
    Specification version 1.1.0
  * Fix support for bitlk (BitLocker compatible) startup key with
    new  metadata entry introduced in Windows 11
  * Fix space restriction for LUKS2 reencryption with data shift</changelog>
  <changelog author="lnussel@suse.de" date="1661169600">- cryptsetup 2.5.0:
  * Split manual pages into per-action pages and use AsciiDoc format.
  * Remove cryptsetup-reencrypt tool from the project and move reencryption
    to already existing "cryptsetup reencrypt" command.
    If you need to emulate the old cryptsetup-reencrypt binary, use simple
    wrappers script running "exec cryptsetup reencrypt $@".
  * LUKS2: implement --decryption option that allows LUKS removal.
  * Fix decryption operation with --active-name option and restrict
    it to be used only with LUKS2.
  * Do not refresh reencryption digest when not needed.
    This should speed up the reencryption resume process.
  * Store proper resilience data in LUKS2 reencrypt initialization.
    Resuming reencryption now does not require specification of resilience
    type parameters if these are the same as during initialization.
  * Properly wipe the unused area after reencryption with datashift in
    the forward direction.
  * Check datashift value against larger sector size.
    For example, it could cause an issue if misaligned 4K sector appears
    during decryption.
  * Do not allow sector size increase reencryption in offline mode.
  * Do not allow dangerous sector size change during reencryption.
  * Ask the user for confirmation before resuming reencryption.
  * Do not resume reencryption with conflicting parameters.
  * Add --force-offline-reencrypt option.
  * Do not allow nested encryption in LUKS reencrypt.
  * Support all options allowed with luksFormat with encrypt action.
  * Add resize action to integritysetup.
  * Remove obsolete dracut plugin reencryption example.
  * Fix possible keyslot area size overflow during conversion to LUKS2.
  * Allow use of --header option for cryptsetup close.
  * Fix activation of LUKS2 device with integrity and detached header.
  * Add ZEROOUT IOCTL support for crypt_wipe API call.
  * VERITY: set loopback sector size according to dm-verity block sizes.
  * veritysetup: dump device sizes.
  * LUKS2 token: prefer token PIN query before passphrase in some cases.
    When a user provides --token-type or specific --token-id, a token PIN
    query is preferred to a passphrase query.
  * LUKS2 token: allow tokens to be replaced with --token-replace option
    for cryptsetup token command.
  * LUKS2 token: do not continue operation when interrupted in PIN prompt.
  * Add --progress-json parameter to utilities.
  * Add support for --key-slot option in luksResume action.
- move man pages to separate subpackage
- drop backports handling</changelog>
  <changelog author="luca.boccassi@gmail.com" date="1663070400">- Add virtual provides for 'integritysetup' and 'veritysetup' to match
  package names provided by Fedora/RHEL, to allow the same set of
  dependencies to be used across all RPM distributions.</changelog>
  <changelog author="info@paolostivanin.com" date="1669636800">- cryptsetup 2.6.0:
  * Introduce support for handling macOS FileVault2 devices (FVAULT2).
  * libcryptsetup: no longer use global memory locking through mlockall()
  * libcryptsetup: process priority is increased only for key derivation
    (PBKDF) calls.
  * Add new LUKS keyslot context handling functions and API.
  * The volume key may now be extracted using a passphrase, keyfile, or
    token. For LUKS devices, it also returns the volume key after
    a successful crypt_format call.
  * Fix --disable-luks2-reencryption configuration option.
  * cryptsetup: Print a better error message and warning if the format
    produces an image without space available for data.
  * Print error if anti-forensic LUKS2 hash setting is not available.
    If the specified hash was not available, activation quietly failed.
  * Fix internal crypt segment compare routine if the user
    specified cipher in kernel format (capi: prefix).
  * cryptsetup: Add token unassign action.
    This action allows removing token binding on specific keyslot.
  * veritysetup: add support for --use-tasklets option.
    This option sets try_verify_in_tasklet kernel dm-verity option
    (available since Linux kernel 6.0) to allow some performance
    improvement on specific systems.
  * Provide pkgconfig Require.private settings.
    While we do not completely provide static build on udev systems,
    it helps produce statically linked binaries in certain situations.
  * Always update automake library files if autogen.sh is run.
    For several releases, we distributed older automake scripts by mistake.
  * reencryption: Fix user defined moved segment size in LUKS2 decryption.
    The --hotzone-size argument was ignored in cases where the actual data
    size was less than the original LUKS2 data offset.
  * Delegate FIPS mode detection to configured crypto backend.
    System FIPS mode check no longer depends on /etc/system-fips file.
  * Update documentation, including FAQ and man pages.</changelog>
  <changelog author="lnussel@suse.com" date="1672142400">- Replace transitional %usrmerged macro with regular version check (boo#1206798)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1676203200">- cryptsetup 2.6.1
  * bitlk: Fixes for BitLocker-compatible on-disk metadata parser
  * Fix possible iteration overflow in OpenSSL2 PBKDF2 crypto
    backend
  * portability and compilation fixes
  * verity: Fix possible hash offset setting overflow.
  * bitlk: Fix use of startup BEK key on big-endian platforms.
  * Do not initiate encryption (reencryption command) when the
    header and data devices are the same. If data device reduction
    is not requsted, this leads to data corruption since LUKS
    metadata was written over the data device.
  * Fix possible memory leak if crypt_load() fails.
  * Always use passphrases with a minimal 8 chars length for
    benchmarking, as used in some implementation of FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1686744000">- FIPS: Remove not needed libcryptsetup12-hmac package that contains
  the HMAC checksums for integrity checking for FIPS. [bsc#1185116]
  * Remove the cryptsetup-rpmlintrc file.
  * Remove not needed fipscheck dependency.</changelog>
  <changelog author="pmonreal@suse.com" date="1686744001">- Enable running the regression test suite.
- Force a regeneration of the man pages from AsciiDoc.
- Add LUKS1 and LUKS2 On-Disk Format Specification pdfs to doc.</changelog>
  <changelog author="pmonreal@suse.com" date="1689249600">- luksFormat: Handle system with low memory and no swap space [bsc#1211079]
  * Check for physical memory available also in PBKDF benchmark.
  * Try to avoid OOM killer on low-memory systems without swap.
  * Use only half of detected free memory on systems without swap.
  * Add patches:
  - cryptsetup-Check-for-physical-memory-available-also-in-PBKDF-be.patch
  - cryptsetup-Try-to-avoid-OOM-killer-on-low-memory-systems-withou.patch
  - cryptsetup-Use-only-half-of-detected-free-memory-on-systems-wit.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1706529600">- Update to 2.7.0:
  * Full changelog in:
    mirrors.edge.kernel.org/pub/linux/utils/cryptsetup/v2.7/v2.7.0-ReleaseNotes
  * Introduce support for hardware OPAL disk encryption.
  * plain mode: Set default cipher to aes-xts-plain64 and password hashing
    to sha256.
  * Allow activation (open), luksResume, and luksAddKey to use the volume
    key stored in a keyring.
  * Allow to store volume key to a user-specified keyring in open and
    luksResume commands.
  * Do not flush IO operations if resize grows the device.
    This can help performance in specific cases where the encrypted device
    is extended automatically while running many IO operations.
  * Use only half of detected free memory for Argon2 PBKDF on systems
    without swap (for LUKS2 new keyslot or format operations).
  * Add the possibility to specify a directory for external LUKS2 token
    handlers (plugins).
  * Do not allow reencryption/decryption on LUKS2 devices with
    authenticated encryption or hardware (OPAL) encryption.
  * Do not fail LUKS format if the operation was interrupted on subsequent
    device wipe.
  * Fix the LUKS2 keyslot option to be used while activating the device
    by a token.
  * Properly report if the dm-verity device cannot be activated due to
    the inability to verify the signed root hash (ENOKEY).
  * Fix to check passphrase for selected keyslot only when adding
    new keyslot.
  * Fix to not wipe the keyslot area before in-place overwrite.
  * bitlk: Fix segfaults when attempting to verify the volume key.
  * Add --disable-blkid command line option to avoid blkid device check.
  * Add support for the meson build system.
  * Fix wipe operation that overwrites the whole device if used for LUKS2
    header with no keyslot area.
  * Fix luksErase to work with detached LUKS header.
  * Disallow the use of internal kernel crypto driver names in "capi"
    specification.
  * Fix reencryption to fail early for unknown cipher.
  * tcrypt: Support new Blake2 hash for VeraCrypt.
  * tcrypt: use hash values as substring for limiting KDF check.
  * Add Aria cipher support and block size info.
  * Do not decrease PBKDF parameters if the user forces them.
  * Support OpenSSL 3.2 Argon2 implementation.
  * Add support for Argon2 from libgcrypt
    (requires yet unreleased gcrypt 1.11).
  * Used Argon2 PBKDF implementation is now reported in debug mode
    in the cryptographic backend version. For native support in
    OpenSSL 3.2 or libgcrypt 1.11, "argon2" is displayed.
    If libargon2 is used, "cryptsetup libargon2" (for embedded
    library) or "external libargon2" is displayed.
  * Link only libcrypto from OpenSSL.
  * Disable reencryption for Direct-Access (DAX) devices.
  * Print a warning message if the device is not aligned to sector size.
  * Fix sector size and integrity fields display for non-LUKS2 crypt
    devices for the status command.
  * Fix suspend for LUKS2 with authenticated encryption (also suspend
    dm-integrity device underneath).
  * Update keyring and locking documentation and LUKS2 specification
    for OPAL2 support.
  * Remove patches fixed upstream:
  - cryptsetup-Check-for-physical-memory-available-also-in-PBKDF-be.patch
  - cryptsetup-Try-to-avoid-OOM-killer-on-low-memory-systems-withou.patch
  - cryptsetup-Use-only-half-of-detected-free-memory-on-systems-wit.patch</changelog>
  <changelog author="meissner@suse.com" date="1725019200">- cryptsetup-fips140-3.patch: extend the password for PBKDF2 benchmarking
  to be more than 20 chars to meet FIPS 140-3 requirements (bsc#1229975)</changelog>
</package>
<package pkgid="df33fd4789f9d1265a2bf9e2e8eb3e29d42d0fb196f435ed66f11a112774c0c5" name="cryptsetup-lang" arch="noarch">
  <version epoch="0" ver="2.7.0" rel="150600.3.3.1"/>
  <changelog author="dmueller@suse.com" date="1615550400">- move licenses to licensedir</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1615636800">- cryptsetup 2.3.5:
  * Fix partial reads of passphrase from an interactive terminal
  * Fix maximum length of password entered through a terminal
  * integritysetup: support new dm-integrity HMAC recalculation
    options
  * integritysetup: display of recalculating sector in dump command
  * veritysetup: fix verity FEC if stored in the same image with
    hashes
  * veritysetup: run FEC repair check even if root hash fails
  * veritysetup: do not process hash image if hash area is empty
  * veritysetup: store verity hash algorithm in superblock in
    lowercase
  * bitlk: fix a crash if the device disappears during BitLocker
    scan
  * bitlk: show a better error when trying to open an NTFS device
  * bitlk: add support for startup key protected VMKs
  * Fix LUKS1 repair code (regression since version 1.7.x)
  * Fix luksKeyChange for LUKS2 with assigned tokens
  * Fix cryptsetup resize using LUKS2 tokens
  * Print a visible error if device resize is not supported
  * Add error message when suspending wrong non-LUKS device
  * Fix default XTS mode key size in reencryption
  * Rephrase missing locking directory warning and move it to
    debug level
  * Many fixes for the use of cipher_null (empty debug cipher)
  * Fixes for libpasswdqc 2.0.x (optional passphrase quality check)
  * Fixes for problems discovered by various tools for code
    analysis
  * Various fixes to man pages
- silence hmac packaging warnings</changelog>
  <changelog author="lnussel@suse.de" date="1625140800">- cryptsetup 2.3.6:
  * integritysetup: Fix possible dm-integrity mapping table truncation.
  * cryptsetup: Backup header can be used to activate TCRYPT device.
    Use --header option to specify the header.
  * cryptsetup: Avoid LUKS2 decryption without detached header.
    This feature will be added later and is currently not supported.
  * Additional fixes and workarounds for common warnings produced
    by some static analysis tools (like gcc-11 analyzer) and additional
    code hardening.
  * Fix standalone libintl detection for compiled tests.
  * Add Blake2b and Blake2s hash support for crypto backends.
    Kernel and gcrypt crypto backend support all variants.
    OpenSSL supports only Blake2b-512 and Blake2s-256.
    Crypto backend supports kernel notation e.g. "blake2b-512".</changelog>
  <changelog author="fvogt@suse.com" date="1627905600">- Use LUKS2 as default format on Tumbleweed.
  It provides some additional features which other tools
  (e.g. systemd-cryptenroll) rely on. GRUB 2.06 supports unlocking
  LUKS2 volumes meanwhile.</changelog>
  <changelog author="lnussel@suse.de" date="1627905601">- cryptsetup 2.4.0 (jsc#SLE-20275)
  * External LUKS token plugins
  * Experimental SSH token
  * Default LUKS2 PBKDF is now Argon2id
  * Increase minimal memory cost for Argon2 benchmark to 64MiB.
  * Autodetect optimal encryption sector size on LUKS2 format.
  * Use VeraCrypt option by default and add --disable-veracrypt option.
  * Support --hash and --cipher to limit opening time for TCRYPT type
  * Fixed default OpenSSL crypt backend support for OpenSSL3.
  * integritysetup: add integrity-recalculate-reset flag.
  * cryptsetup: retains keyslot number in luksChangeKey for LUKS2.
  * Fix cryptsetup resize using LUKS2 tokens.
  * Add close --deferred and --cancel-deferred options.
  * Rewritten command-line option parsing to avoid libpopt arguments
    memory leaks.
  * Add --test-args option.</changelog>
  <changelog author="lnussel@suse.de" date="1627992000">- need to use PBKDF2 by default for LUKS2 as grub can't decrypt when
  using Argon.</changelog>
  <changelog author="lnussel@suse.de" date="1629892800">- As YaST passes necessary parameters to cryptsetup anyway, we do
  not necessarily need to take grub into consideration. So back to
  Argon2 to see how it goes.</changelog>
  <changelog author="lnussel@suse.de" date="1631793600">- cryptsetup 2.4.1
  * Fix compilation for libc implementations without dlvsym().
  * Fix compilation and tests on systems with non-standard libraries
  * Try to workaround some issues on systems without udev support.
  * Fixes for OpenSSL3 crypto backend (including FIPS mode).
  * Print error message when assigning a token to an inactive keyslot.
  * Fix offset bug in LUKS2 encryption code if --offset option was used.
  * Do not allow LUKS2 decryption for devices with data offset.
  * Fix LUKS1 cryptsetup repair command for some specific problems.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1637236800">- cryptsetup 2.4.2:
  * Fix possible large memory allocation if LUKS2 header size is
    invalid.
  * Fix memory corruption in debug message printing LUKS2
    checksum.
  * veritysetup: remove link to the UUID library for the static
    build.
  * Remove link to pwquality library for integritysetup and
    veritysetup. These tools do not read passphrases.
  * OpenSSL3 backend: avoid remaining deprecated calls in API.
    Crypto backend no longer use API deprecated in OpenSSL 3.0
  * Check if kernel device-mapper create device failed in an early
    phase. This happens when a concurrent creation of device-mapper
    devices meets in the very early state.
  * Do not set compiler optimization flag for Argon2 KDF if the
    memory wipe is implemented in libc.
  * Do not attempt to unload LUKS2 tokens if external tokens are
    disabled. This allows building a static binary with
  - -disable-external-tokens.
  * LUKS convert: also check sysfs for device activity.
    If udev symlink is missing, code fallbacks to sysfs scan to
    prevent data corruption for the active device.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1642161600">- cryptsetup 2.4.3:
  * Fix possible attacks against data confidentiality through
    LUKS2 online reencryption extension crash recovery
    CVE-2021-4122, boo#1194469
  * Add configure option --disable-luks2-reencryption to completely
    disable LUKS2 reencryption code.
  * Improve internal metadata validation code for reencryption
    metadata
  * Add updated documentation for LUKS2 On-Disk Format
    Specification version 1.1.0
  * Fix support for bitlk (BitLocker compatible) startup key with
    new  metadata entry introduced in Windows 11
  * Fix space restriction for LUKS2 reencryption with data shift</changelog>
  <changelog author="lnussel@suse.de" date="1661169600">- cryptsetup 2.5.0:
  * Split manual pages into per-action pages and use AsciiDoc format.
  * Remove cryptsetup-reencrypt tool from the project and move reencryption
    to already existing "cryptsetup reencrypt" command.
    If you need to emulate the old cryptsetup-reencrypt binary, use simple
    wrappers script running "exec cryptsetup reencrypt $@".
  * LUKS2: implement --decryption option that allows LUKS removal.
  * Fix decryption operation with --active-name option and restrict
    it to be used only with LUKS2.
  * Do not refresh reencryption digest when not needed.
    This should speed up the reencryption resume process.
  * Store proper resilience data in LUKS2 reencrypt initialization.
    Resuming reencryption now does not require specification of resilience
    type parameters if these are the same as during initialization.
  * Properly wipe the unused area after reencryption with datashift in
    the forward direction.
  * Check datashift value against larger sector size.
    For example, it could cause an issue if misaligned 4K sector appears
    during decryption.
  * Do not allow sector size increase reencryption in offline mode.
  * Do not allow dangerous sector size change during reencryption.
  * Ask the user for confirmation before resuming reencryption.
  * Do not resume reencryption with conflicting parameters.
  * Add --force-offline-reencrypt option.
  * Do not allow nested encryption in LUKS reencrypt.
  * Support all options allowed with luksFormat with encrypt action.
  * Add resize action to integritysetup.
  * Remove obsolete dracut plugin reencryption example.
  * Fix possible keyslot area size overflow during conversion to LUKS2.
  * Allow use of --header option for cryptsetup close.
  * Fix activation of LUKS2 device with integrity and detached header.
  * Add ZEROOUT IOCTL support for crypt_wipe API call.
  * VERITY: set loopback sector size according to dm-verity block sizes.
  * veritysetup: dump device sizes.
  * LUKS2 token: prefer token PIN query before passphrase in some cases.
    When a user provides --token-type or specific --token-id, a token PIN
    query is preferred to a passphrase query.
  * LUKS2 token: allow tokens to be replaced with --token-replace option
    for cryptsetup token command.
  * LUKS2 token: do not continue operation when interrupted in PIN prompt.
  * Add --progress-json parameter to utilities.
  * Add support for --key-slot option in luksResume action.
- move man pages to separate subpackage
- drop backports handling</changelog>
  <changelog author="luca.boccassi@gmail.com" date="1663070400">- Add virtual provides for 'integritysetup' and 'veritysetup' to match
  package names provided by Fedora/RHEL, to allow the same set of
  dependencies to be used across all RPM distributions.</changelog>
  <changelog author="info@paolostivanin.com" date="1669636800">- cryptsetup 2.6.0:
  * Introduce support for handling macOS FileVault2 devices (FVAULT2).
  * libcryptsetup: no longer use global memory locking through mlockall()
  * libcryptsetup: process priority is increased only for key derivation
    (PBKDF) calls.
  * Add new LUKS keyslot context handling functions and API.
  * The volume key may now be extracted using a passphrase, keyfile, or
    token. For LUKS devices, it also returns the volume key after
    a successful crypt_format call.
  * Fix --disable-luks2-reencryption configuration option.
  * cryptsetup: Print a better error message and warning if the format
    produces an image without space available for data.
  * Print error if anti-forensic LUKS2 hash setting is not available.
    If the specified hash was not available, activation quietly failed.
  * Fix internal crypt segment compare routine if the user
    specified cipher in kernel format (capi: prefix).
  * cryptsetup: Add token unassign action.
    This action allows removing token binding on specific keyslot.
  * veritysetup: add support for --use-tasklets option.
    This option sets try_verify_in_tasklet kernel dm-verity option
    (available since Linux kernel 6.0) to allow some performance
    improvement on specific systems.
  * Provide pkgconfig Require.private settings.
    While we do not completely provide static build on udev systems,
    it helps produce statically linked binaries in certain situations.
  * Always update automake library files if autogen.sh is run.
    For several releases, we distributed older automake scripts by mistake.
  * reencryption: Fix user defined moved segment size in LUKS2 decryption.
    The --hotzone-size argument was ignored in cases where the actual data
    size was less than the original LUKS2 data offset.
  * Delegate FIPS mode detection to configured crypto backend.
    System FIPS mode check no longer depends on /etc/system-fips file.
  * Update documentation, including FAQ and man pages.</changelog>
  <changelog author="lnussel@suse.com" date="1672142400">- Replace transitional %usrmerged macro with regular version check (boo#1206798)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1676203200">- cryptsetup 2.6.1
  * bitlk: Fixes for BitLocker-compatible on-disk metadata parser
  * Fix possible iteration overflow in OpenSSL2 PBKDF2 crypto
    backend
  * portability and compilation fixes
  * verity: Fix possible hash offset setting overflow.
  * bitlk: Fix use of startup BEK key on big-endian platforms.
  * Do not initiate encryption (reencryption command) when the
    header and data devices are the same. If data device reduction
    is not requsted, this leads to data corruption since LUKS
    metadata was written over the data device.
  * Fix possible memory leak if crypt_load() fails.
  * Always use passphrases with a minimal 8 chars length for
    benchmarking, as used in some implementation of FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1686744000">- FIPS: Remove not needed libcryptsetup12-hmac package that contains
  the HMAC checksums for integrity checking for FIPS. [bsc#1185116]
  * Remove the cryptsetup-rpmlintrc file.
  * Remove not needed fipscheck dependency.</changelog>
  <changelog author="pmonreal@suse.com" date="1686744001">- Enable running the regression test suite.
- Force a regeneration of the man pages from AsciiDoc.
- Add LUKS1 and LUKS2 On-Disk Format Specification pdfs to doc.</changelog>
  <changelog author="pmonreal@suse.com" date="1689249600">- luksFormat: Handle system with low memory and no swap space [bsc#1211079]
  * Check for physical memory available also in PBKDF benchmark.
  * Try to avoid OOM killer on low-memory systems without swap.
  * Use only half of detected free memory on systems without swap.
  * Add patches:
  - cryptsetup-Check-for-physical-memory-available-also-in-PBKDF-be.patch
  - cryptsetup-Try-to-avoid-OOM-killer-on-low-memory-systems-withou.patch
  - cryptsetup-Use-only-half-of-detected-free-memory-on-systems-wit.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1706529600">- Update to 2.7.0:
  * Full changelog in:
    mirrors.edge.kernel.org/pub/linux/utils/cryptsetup/v2.7/v2.7.0-ReleaseNotes
  * Introduce support for hardware OPAL disk encryption.
  * plain mode: Set default cipher to aes-xts-plain64 and password hashing
    to sha256.
  * Allow activation (open), luksResume, and luksAddKey to use the volume
    key stored in a keyring.
  * Allow to store volume key to a user-specified keyring in open and
    luksResume commands.
  * Do not flush IO operations if resize grows the device.
    This can help performance in specific cases where the encrypted device
    is extended automatically while running many IO operations.
  * Use only half of detected free memory for Argon2 PBKDF on systems
    without swap (for LUKS2 new keyslot or format operations).
  * Add the possibility to specify a directory for external LUKS2 token
    handlers (plugins).
  * Do not allow reencryption/decryption on LUKS2 devices with
    authenticated encryption or hardware (OPAL) encryption.
  * Do not fail LUKS format if the operation was interrupted on subsequent
    device wipe.
  * Fix the LUKS2 keyslot option to be used while activating the device
    by a token.
  * Properly report if the dm-verity device cannot be activated due to
    the inability to verify the signed root hash (ENOKEY).
  * Fix to check passphrase for selected keyslot only when adding
    new keyslot.
  * Fix to not wipe the keyslot area before in-place overwrite.
  * bitlk: Fix segfaults when attempting to verify the volume key.
  * Add --disable-blkid command line option to avoid blkid device check.
  * Add support for the meson build system.
  * Fix wipe operation that overwrites the whole device if used for LUKS2
    header with no keyslot area.
  * Fix luksErase to work with detached LUKS header.
  * Disallow the use of internal kernel crypto driver names in "capi"
    specification.
  * Fix reencryption to fail early for unknown cipher.
  * tcrypt: Support new Blake2 hash for VeraCrypt.
  * tcrypt: use hash values as substring for limiting KDF check.
  * Add Aria cipher support and block size info.
  * Do not decrease PBKDF parameters if the user forces them.
  * Support OpenSSL 3.2 Argon2 implementation.
  * Add support for Argon2 from libgcrypt
    (requires yet unreleased gcrypt 1.11).
  * Used Argon2 PBKDF implementation is now reported in debug mode
    in the cryptographic backend version. For native support in
    OpenSSL 3.2 or libgcrypt 1.11, "argon2" is displayed.
    If libargon2 is used, "cryptsetup libargon2" (for embedded
    library) or "external libargon2" is displayed.
  * Link only libcrypto from OpenSSL.
  * Disable reencryption for Direct-Access (DAX) devices.
  * Print a warning message if the device is not aligned to sector size.
  * Fix sector size and integrity fields display for non-LUKS2 crypt
    devices for the status command.
  * Fix suspend for LUKS2 with authenticated encryption (also suspend
    dm-integrity device underneath).
  * Update keyring and locking documentation and LUKS2 specification
    for OPAL2 support.
  * Remove patches fixed upstream:
  - cryptsetup-Check-for-physical-memory-available-also-in-PBKDF-be.patch
  - cryptsetup-Try-to-avoid-OOM-killer-on-low-memory-systems-withou.patch
  - cryptsetup-Use-only-half-of-detected-free-memory-on-systems-wit.patch</changelog>
  <changelog author="meissner@suse.com" date="1725019200">- cryptsetup-fips140-3.patch: extend the password for PBKDF2 benchmarking
  to be more than 20 chars to meet FIPS 140-3 requirements (bsc#1229975)</changelog>
</package>
<package pkgid="a2823bd22b831d4c100573b16c57b2135c41785fbf5fc76305af7fe50cbc2608" name="cryptsetup-ssh" arch="aarch64">
  <version epoch="0" ver="2.7.0" rel="150600.3.3.1"/>
  <changelog author="dmueller@suse.com" date="1615550400">- move licenses to licensedir</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1615636800">- cryptsetup 2.3.5:
  * Fix partial reads of passphrase from an interactive terminal
  * Fix maximum length of password entered through a terminal
  * integritysetup: support new dm-integrity HMAC recalculation
    options
  * integritysetup: display of recalculating sector in dump command
  * veritysetup: fix verity FEC if stored in the same image with
    hashes
  * veritysetup: run FEC repair check even if root hash fails
  * veritysetup: do not process hash image if hash area is empty
  * veritysetup: store verity hash algorithm in superblock in
    lowercase
  * bitlk: fix a crash if the device disappears during BitLocker
    scan
  * bitlk: show a better error when trying to open an NTFS device
  * bitlk: add support for startup key protected VMKs
  * Fix LUKS1 repair code (regression since version 1.7.x)
  * Fix luksKeyChange for LUKS2 with assigned tokens
  * Fix cryptsetup resize using LUKS2 tokens
  * Print a visible error if device resize is not supported
  * Add error message when suspending wrong non-LUKS device
  * Fix default XTS mode key size in reencryption
  * Rephrase missing locking directory warning and move it to
    debug level
  * Many fixes for the use of cipher_null (empty debug cipher)
  * Fixes for libpasswdqc 2.0.x (optional passphrase quality check)
  * Fixes for problems discovered by various tools for code
    analysis
  * Various fixes to man pages
- silence hmac packaging warnings</changelog>
  <changelog author="lnussel@suse.de" date="1625140800">- cryptsetup 2.3.6:
  * integritysetup: Fix possible dm-integrity mapping table truncation.
  * cryptsetup: Backup header can be used to activate TCRYPT device.
    Use --header option to specify the header.
  * cryptsetup: Avoid LUKS2 decryption without detached header.
    This feature will be added later and is currently not supported.
  * Additional fixes and workarounds for common warnings produced
    by some static analysis tools (like gcc-11 analyzer) and additional
    code hardening.
  * Fix standalone libintl detection for compiled tests.
  * Add Blake2b and Blake2s hash support for crypto backends.
    Kernel and gcrypt crypto backend support all variants.
    OpenSSL supports only Blake2b-512 and Blake2s-256.
    Crypto backend supports kernel notation e.g. "blake2b-512".</changelog>
  <changelog author="fvogt@suse.com" date="1627905600">- Use LUKS2 as default format on Tumbleweed.
  It provides some additional features which other tools
  (e.g. systemd-cryptenroll) rely on. GRUB 2.06 supports unlocking
  LUKS2 volumes meanwhile.</changelog>
  <changelog author="lnussel@suse.de" date="1627905601">- cryptsetup 2.4.0 (jsc#SLE-20275)
  * External LUKS token plugins
  * Experimental SSH token
  * Default LUKS2 PBKDF is now Argon2id
  * Increase minimal memory cost for Argon2 benchmark to 64MiB.
  * Autodetect optimal encryption sector size on LUKS2 format.
  * Use VeraCrypt option by default and add --disable-veracrypt option.
  * Support --hash and --cipher to limit opening time for TCRYPT type
  * Fixed default OpenSSL crypt backend support for OpenSSL3.
  * integritysetup: add integrity-recalculate-reset flag.
  * cryptsetup: retains keyslot number in luksChangeKey for LUKS2.
  * Fix cryptsetup resize using LUKS2 tokens.
  * Add close --deferred and --cancel-deferred options.
  * Rewritten command-line option parsing to avoid libpopt arguments
    memory leaks.
  * Add --test-args option.</changelog>
  <changelog author="lnussel@suse.de" date="1627992000">- need to use PBKDF2 by default for LUKS2 as grub can't decrypt when
  using Argon.</changelog>
  <changelog author="lnussel@suse.de" date="1629892800">- As YaST passes necessary parameters to cryptsetup anyway, we do
  not necessarily need to take grub into consideration. So back to
  Argon2 to see how it goes.</changelog>
  <changelog author="lnussel@suse.de" date="1631793600">- cryptsetup 2.4.1
  * Fix compilation for libc implementations without dlvsym().
  * Fix compilation and tests on systems with non-standard libraries
  * Try to workaround some issues on systems without udev support.
  * Fixes for OpenSSL3 crypto backend (including FIPS mode).
  * Print error message when assigning a token to an inactive keyslot.
  * Fix offset bug in LUKS2 encryption code if --offset option was used.
  * Do not allow LUKS2 decryption for devices with data offset.
  * Fix LUKS1 cryptsetup repair command for some specific problems.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1637236800">- cryptsetup 2.4.2:
  * Fix possible large memory allocation if LUKS2 header size is
    invalid.
  * Fix memory corruption in debug message printing LUKS2
    checksum.
  * veritysetup: remove link to the UUID library for the static
    build.
  * Remove link to pwquality library for integritysetup and
    veritysetup. These tools do not read passphrases.
  * OpenSSL3 backend: avoid remaining deprecated calls in API.
    Crypto backend no longer use API deprecated in OpenSSL 3.0
  * Check if kernel device-mapper create device failed in an early
    phase. This happens when a concurrent creation of device-mapper
    devices meets in the very early state.
  * Do not set compiler optimization flag for Argon2 KDF if the
    memory wipe is implemented in libc.
  * Do not attempt to unload LUKS2 tokens if external tokens are
    disabled. This allows building a static binary with
  - -disable-external-tokens.
  * LUKS convert: also check sysfs for device activity.
    If udev symlink is missing, code fallbacks to sysfs scan to
    prevent data corruption for the active device.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1642161600">- cryptsetup 2.4.3:
  * Fix possible attacks against data confidentiality through
    LUKS2 online reencryption extension crash recovery
    CVE-2021-4122, boo#1194469
  * Add configure option --disable-luks2-reencryption to completely
    disable LUKS2 reencryption code.
  * Improve internal metadata validation code for reencryption
    metadata
  * Add updated documentation for LUKS2 On-Disk Format
    Specification version 1.1.0
  * Fix support for bitlk (BitLocker compatible) startup key with
    new  metadata entry introduced in Windows 11
  * Fix space restriction for LUKS2 reencryption with data shift</changelog>
  <changelog author="lnussel@suse.de" date="1661169600">- cryptsetup 2.5.0:
  * Split manual pages into per-action pages and use AsciiDoc format.
  * Remove cryptsetup-reencrypt tool from the project and move reencryption
    to already existing "cryptsetup reencrypt" command.
    If you need to emulate the old cryptsetup-reencrypt binary, use simple
    wrappers script running "exec cryptsetup reencrypt $@".
  * LUKS2: implement --decryption option that allows LUKS removal.
  * Fix decryption operation with --active-name option and restrict
    it to be used only with LUKS2.
  * Do not refresh reencryption digest when not needed.
    This should speed up the reencryption resume process.
  * Store proper resilience data in LUKS2 reencrypt initialization.
    Resuming reencryption now does not require specification of resilience
    type parameters if these are the same as during initialization.
  * Properly wipe the unused area after reencryption with datashift in
    the forward direction.
  * Check datashift value against larger sector size.
    For example, it could cause an issue if misaligned 4K sector appears
    during decryption.
  * Do not allow sector size increase reencryption in offline mode.
  * Do not allow dangerous sector size change during reencryption.
  * Ask the user for confirmation before resuming reencryption.
  * Do not resume reencryption with conflicting parameters.
  * Add --force-offline-reencrypt option.
  * Do not allow nested encryption in LUKS reencrypt.
  * Support all options allowed with luksFormat with encrypt action.
  * Add resize action to integritysetup.
  * Remove obsolete dracut plugin reencryption example.
  * Fix possible keyslot area size overflow during conversion to LUKS2.
  * Allow use of --header option for cryptsetup close.
  * Fix activation of LUKS2 device with integrity and detached header.
  * Add ZEROOUT IOCTL support for crypt_wipe API call.
  * VERITY: set loopback sector size according to dm-verity block sizes.
  * veritysetup: dump device sizes.
  * LUKS2 token: prefer token PIN query before passphrase in some cases.
    When a user provides --token-type or specific --token-id, a token PIN
    query is preferred to a passphrase query.
  * LUKS2 token: allow tokens to be replaced with --token-replace option
    for cryptsetup token command.
  * LUKS2 token: do not continue operation when interrupted in PIN prompt.
  * Add --progress-json parameter to utilities.
  * Add support for --key-slot option in luksResume action.
- move man pages to separate subpackage
- drop backports handling</changelog>
  <changelog author="luca.boccassi@gmail.com" date="1663070400">- Add virtual provides for 'integritysetup' and 'veritysetup' to match
  package names provided by Fedora/RHEL, to allow the same set of
  dependencies to be used across all RPM distributions.</changelog>
  <changelog author="info@paolostivanin.com" date="1669636800">- cryptsetup 2.6.0:
  * Introduce support for handling macOS FileVault2 devices (FVAULT2).
  * libcryptsetup: no longer use global memory locking through mlockall()
  * libcryptsetup: process priority is increased only for key derivation
    (PBKDF) calls.
  * Add new LUKS keyslot context handling functions and API.
  * The volume key may now be extracted using a passphrase, keyfile, or
    token. For LUKS devices, it also returns the volume key after
    a successful crypt_format call.
  * Fix --disable-luks2-reencryption configuration option.
  * cryptsetup: Print a better error message and warning if the format
    produces an image without space available for data.
  * Print error if anti-forensic LUKS2 hash setting is not available.
    If the specified hash was not available, activation quietly failed.
  * Fix internal crypt segment compare routine if the user
    specified cipher in kernel format (capi: prefix).
  * cryptsetup: Add token unassign action.
    This action allows removing token binding on specific keyslot.
  * veritysetup: add support for --use-tasklets option.
    This option sets try_verify_in_tasklet kernel dm-verity option
    (available since Linux kernel 6.0) to allow some performance
    improvement on specific systems.
  * Provide pkgconfig Require.private settings.
    While we do not completely provide static build on udev systems,
    it helps produce statically linked binaries in certain situations.
  * Always update automake library files if autogen.sh is run.
    For several releases, we distributed older automake scripts by mistake.
  * reencryption: Fix user defined moved segment size in LUKS2 decryption.
    The --hotzone-size argument was ignored in cases where the actual data
    size was less than the original LUKS2 data offset.
  * Delegate FIPS mode detection to configured crypto backend.
    System FIPS mode check no longer depends on /etc/system-fips file.
  * Update documentation, including FAQ and man pages.</changelog>
  <changelog author="lnussel@suse.com" date="1672142400">- Replace transitional %usrmerged macro with regular version check (boo#1206798)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1676203200">- cryptsetup 2.6.1
  * bitlk: Fixes for BitLocker-compatible on-disk metadata parser
  * Fix possible iteration overflow in OpenSSL2 PBKDF2 crypto
    backend
  * portability and compilation fixes
  * verity: Fix possible hash offset setting overflow.
  * bitlk: Fix use of startup BEK key on big-endian platforms.
  * Do not initiate encryption (reencryption command) when the
    header and data devices are the same. If data device reduction
    is not requsted, this leads to data corruption since LUKS
    metadata was written over the data device.
  * Fix possible memory leak if crypt_load() fails.
  * Always use passphrases with a minimal 8 chars length for
    benchmarking, as used in some implementation of FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1686744000">- FIPS: Remove not needed libcryptsetup12-hmac package that contains
  the HMAC checksums for integrity checking for FIPS. [bsc#1185116]
  * Remove the cryptsetup-rpmlintrc file.
  * Remove not needed fipscheck dependency.</changelog>
  <changelog author="pmonreal@suse.com" date="1686744001">- Enable running the regression test suite.
- Force a regeneration of the man pages from AsciiDoc.
- Add LUKS1 and LUKS2 On-Disk Format Specification pdfs to doc.</changelog>
  <changelog author="pmonreal@suse.com" date="1689249600">- luksFormat: Handle system with low memory and no swap space [bsc#1211079]
  * Check for physical memory available also in PBKDF benchmark.
  * Try to avoid OOM killer on low-memory systems without swap.
  * Use only half of detected free memory on systems without swap.
  * Add patches:
  - cryptsetup-Check-for-physical-memory-available-also-in-PBKDF-be.patch
  - cryptsetup-Try-to-avoid-OOM-killer-on-low-memory-systems-withou.patch
  - cryptsetup-Use-only-half-of-detected-free-memory-on-systems-wit.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1706529600">- Update to 2.7.0:
  * Full changelog in:
    mirrors.edge.kernel.org/pub/linux/utils/cryptsetup/v2.7/v2.7.0-ReleaseNotes
  * Introduce support for hardware OPAL disk encryption.
  * plain mode: Set default cipher to aes-xts-plain64 and password hashing
    to sha256.
  * Allow activation (open), luksResume, and luksAddKey to use the volume
    key stored in a keyring.
  * Allow to store volume key to a user-specified keyring in open and
    luksResume commands.
  * Do not flush IO operations if resize grows the device.
    This can help performance in specific cases where the encrypted device
    is extended automatically while running many IO operations.
  * Use only half of detected free memory for Argon2 PBKDF on systems
    without swap (for LUKS2 new keyslot or format operations).
  * Add the possibility to specify a directory for external LUKS2 token
    handlers (plugins).
  * Do not allow reencryption/decryption on LUKS2 devices with
    authenticated encryption or hardware (OPAL) encryption.
  * Do not fail LUKS format if the operation was interrupted on subsequent
    device wipe.
  * Fix the LUKS2 keyslot option to be used while activating the device
    by a token.
  * Properly report if the dm-verity device cannot be activated due to
    the inability to verify the signed root hash (ENOKEY).
  * Fix to check passphrase for selected keyslot only when adding
    new keyslot.
  * Fix to not wipe the keyslot area before in-place overwrite.
  * bitlk: Fix segfaults when attempting to verify the volume key.
  * Add --disable-blkid command line option to avoid blkid device check.
  * Add support for the meson build system.
  * Fix wipe operation that overwrites the whole device if used for LUKS2
    header with no keyslot area.
  * Fix luksErase to work with detached LUKS header.
  * Disallow the use of internal kernel crypto driver names in "capi"
    specification.
  * Fix reencryption to fail early for unknown cipher.
  * tcrypt: Support new Blake2 hash for VeraCrypt.
  * tcrypt: use hash values as substring for limiting KDF check.
  * Add Aria cipher support and block size info.
  * Do not decrease PBKDF parameters if the user forces them.
  * Support OpenSSL 3.2 Argon2 implementation.
  * Add support for Argon2 from libgcrypt
    (requires yet unreleased gcrypt 1.11).
  * Used Argon2 PBKDF implementation is now reported in debug mode
    in the cryptographic backend version. For native support in
    OpenSSL 3.2 or libgcrypt 1.11, "argon2" is displayed.
    If libargon2 is used, "cryptsetup libargon2" (for embedded
    library) or "external libargon2" is displayed.
  * Link only libcrypto from OpenSSL.
  * Disable reencryption for Direct-Access (DAX) devices.
  * Print a warning message if the device is not aligned to sector size.
  * Fix sector size and integrity fields display for non-LUKS2 crypt
    devices for the status command.
  * Fix suspend for LUKS2 with authenticated encryption (also suspend
    dm-integrity device underneath).
  * Update keyring and locking documentation and LUKS2 specification
    for OPAL2 support.
  * Remove patches fixed upstream:
  - cryptsetup-Check-for-physical-memory-available-also-in-PBKDF-be.patch
  - cryptsetup-Try-to-avoid-OOM-killer-on-low-memory-systems-withou.patch
  - cryptsetup-Use-only-half-of-detected-free-memory-on-systems-wit.patch</changelog>
  <changelog author="meissner@suse.com" date="1725019200">- cryptsetup-fips140-3.patch: extend the password for PBKDF2 benchmarking
  to be more than 20 chars to meet FIPS 140-3 requirements (bsc#1229975)</changelog>
</package>
<package pkgid="a66b0a0efa1c1b4fad23c83f2055229667179f9f77c9416358b828d9a1d82042" name="cryptsetup-ssh" arch="ppc64le">
  <version epoch="0" ver="2.7.0" rel="150600.3.3.1"/>
  <changelog author="dmueller@suse.com" date="1615550400">- move licenses to licensedir</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1615636800">- cryptsetup 2.3.5:
  * Fix partial reads of passphrase from an interactive terminal
  * Fix maximum length of password entered through a terminal
  * integritysetup: support new dm-integrity HMAC recalculation
    options
  * integritysetup: display of recalculating sector in dump command
  * veritysetup: fix verity FEC if stored in the same image with
    hashes
  * veritysetup: run FEC repair check even if root hash fails
  * veritysetup: do not process hash image if hash area is empty
  * veritysetup: store verity hash algorithm in superblock in
    lowercase
  * bitlk: fix a crash if the device disappears during BitLocker
    scan
  * bitlk: show a better error when trying to open an NTFS device
  * bitlk: add support for startup key protected VMKs
  * Fix LUKS1 repair code (regression since version 1.7.x)
  * Fix luksKeyChange for LUKS2 with assigned tokens
  * Fix cryptsetup resize using LUKS2 tokens
  * Print a visible error if device resize is not supported
  * Add error message when suspending wrong non-LUKS device
  * Fix default XTS mode key size in reencryption
  * Rephrase missing locking directory warning and move it to
    debug level
  * Many fixes for the use of cipher_null (empty debug cipher)
  * Fixes for libpasswdqc 2.0.x (optional passphrase quality check)
  * Fixes for problems discovered by various tools for code
    analysis
  * Various fixes to man pages
- silence hmac packaging warnings</changelog>
  <changelog author="lnussel@suse.de" date="1625140800">- cryptsetup 2.3.6:
  * integritysetup: Fix possible dm-integrity mapping table truncation.
  * cryptsetup: Backup header can be used to activate TCRYPT device.
    Use --header option to specify the header.
  * cryptsetup: Avoid LUKS2 decryption without detached header.
    This feature will be added later and is currently not supported.
  * Additional fixes and workarounds for common warnings produced
    by some static analysis tools (like gcc-11 analyzer) and additional
    code hardening.
  * Fix standalone libintl detection for compiled tests.
  * Add Blake2b and Blake2s hash support for crypto backends.
    Kernel and gcrypt crypto backend support all variants.
    OpenSSL supports only Blake2b-512 and Blake2s-256.
    Crypto backend supports kernel notation e.g. "blake2b-512".</changelog>
  <changelog author="fvogt@suse.com" date="1627905600">- Use LUKS2 as default format on Tumbleweed.
  It provides some additional features which other tools
  (e.g. systemd-cryptenroll) rely on. GRUB 2.06 supports unlocking
  LUKS2 volumes meanwhile.</changelog>
  <changelog author="lnussel@suse.de" date="1627905601">- cryptsetup 2.4.0 (jsc#SLE-20275)
  * External LUKS token plugins
  * Experimental SSH token
  * Default LUKS2 PBKDF is now Argon2id
  * Increase minimal memory cost for Argon2 benchmark to 64MiB.
  * Autodetect optimal encryption sector size on LUKS2 format.
  * Use VeraCrypt option by default and add --disable-veracrypt option.
  * Support --hash and --cipher to limit opening time for TCRYPT type
  * Fixed default OpenSSL crypt backend support for OpenSSL3.
  * integritysetup: add integrity-recalculate-reset flag.
  * cryptsetup: retains keyslot number in luksChangeKey for LUKS2.
  * Fix cryptsetup resize using LUKS2 tokens.
  * Add close --deferred and --cancel-deferred options.
  * Rewritten command-line option parsing to avoid libpopt arguments
    memory leaks.
  * Add --test-args option.</changelog>
  <changelog author="lnussel@suse.de" date="1627992000">- need to use PBKDF2 by default for LUKS2 as grub can't decrypt when
  using Argon.</changelog>
  <changelog author="lnussel@suse.de" date="1629892800">- As YaST passes necessary parameters to cryptsetup anyway, we do
  not necessarily need to take grub into consideration. So back to
  Argon2 to see how it goes.</changelog>
  <changelog author="lnussel@suse.de" date="1631793600">- cryptsetup 2.4.1
  * Fix compilation for libc implementations without dlvsym().
  * Fix compilation and tests on systems with non-standard libraries
  * Try to workaround some issues on systems without udev support.
  * Fixes for OpenSSL3 crypto backend (including FIPS mode).
  * Print error message when assigning a token to an inactive keyslot.
  * Fix offset bug in LUKS2 encryption code if --offset option was used.
  * Do not allow LUKS2 decryption for devices with data offset.
  * Fix LUKS1 cryptsetup repair command for some specific problems.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1637236800">- cryptsetup 2.4.2:
  * Fix possible large memory allocation if LUKS2 header size is
    invalid.
  * Fix memory corruption in debug message printing LUKS2
    checksum.
  * veritysetup: remove link to the UUID library for the static
    build.
  * Remove link to pwquality library for integritysetup and
    veritysetup. These tools do not read passphrases.
  * OpenSSL3 backend: avoid remaining deprecated calls in API.
    Crypto backend no longer use API deprecated in OpenSSL 3.0
  * Check if kernel device-mapper create device failed in an early
    phase. This happens when a concurrent creation of device-mapper
    devices meets in the very early state.
  * Do not set compiler optimization flag for Argon2 KDF if the
    memory wipe is implemented in libc.
  * Do not attempt to unload LUKS2 tokens if external tokens are
    disabled. This allows building a static binary with
  - -disable-external-tokens.
  * LUKS convert: also check sysfs for device activity.
    If udev symlink is missing, code fallbacks to sysfs scan to
    prevent data corruption for the active device.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1642161600">- cryptsetup 2.4.3:
  * Fix possible attacks against data confidentiality through
    LUKS2 online reencryption extension crash recovery
    CVE-2021-4122, boo#1194469
  * Add configure option --disable-luks2-reencryption to completely
    disable LUKS2 reencryption code.
  * Improve internal metadata validation code for reencryption
    metadata
  * Add updated documentation for LUKS2 On-Disk Format
    Specification version 1.1.0
  * Fix support for bitlk (BitLocker compatible) startup key with
    new  metadata entry introduced in Windows 11
  * Fix space restriction for LUKS2 reencryption with data shift</changelog>
  <changelog author="lnussel@suse.de" date="1661169600">- cryptsetup 2.5.0:
  * Split manual pages into per-action pages and use AsciiDoc format.
  * Remove cryptsetup-reencrypt tool from the project and move reencryption
    to already existing "cryptsetup reencrypt" command.
    If you need to emulate the old cryptsetup-reencrypt binary, use simple
    wrappers script running "exec cryptsetup reencrypt $@".
  * LUKS2: implement --decryption option that allows LUKS removal.
  * Fix decryption operation with --active-name option and restrict
    it to be used only with LUKS2.
  * Do not refresh reencryption digest when not needed.
    This should speed up the reencryption resume process.
  * Store proper resilience data in LUKS2 reencrypt initialization.
    Resuming reencryption now does not require specification of resilience
    type parameters if these are the same as during initialization.
  * Properly wipe the unused area after reencryption with datashift in
    the forward direction.
  * Check datashift value against larger sector size.
    For example, it could cause an issue if misaligned 4K sector appears
    during decryption.
  * Do not allow sector size increase reencryption in offline mode.
  * Do not allow dangerous sector size change during reencryption.
  * Ask the user for confirmation before resuming reencryption.
  * Do not resume reencryption with conflicting parameters.
  * Add --force-offline-reencrypt option.
  * Do not allow nested encryption in LUKS reencrypt.
  * Support all options allowed with luksFormat with encrypt action.
  * Add resize action to integritysetup.
  * Remove obsolete dracut plugin reencryption example.
  * Fix possible keyslot area size overflow during conversion to LUKS2.
  * Allow use of --header option for cryptsetup close.
  * Fix activation of LUKS2 device with integrity and detached header.
  * Add ZEROOUT IOCTL support for crypt_wipe API call.
  * VERITY: set loopback sector size according to dm-verity block sizes.
  * veritysetup: dump device sizes.
  * LUKS2 token: prefer token PIN query before passphrase in some cases.
    When a user provides --token-type or specific --token-id, a token PIN
    query is preferred to a passphrase query.
  * LUKS2 token: allow tokens to be replaced with --token-replace option
    for cryptsetup token command.
  * LUKS2 token: do not continue operation when interrupted in PIN prompt.
  * Add --progress-json parameter to utilities.
  * Add support for --key-slot option in luksResume action.
- move man pages to separate subpackage
- drop backports handling</changelog>
  <changelog author="luca.boccassi@gmail.com" date="1663070400">- Add virtual provides for 'integritysetup' and 'veritysetup' to match
  package names provided by Fedora/RHEL, to allow the same set of
  dependencies to be used across all RPM distributions.</changelog>
  <changelog author="info@paolostivanin.com" date="1669636800">- cryptsetup 2.6.0:
  * Introduce support for handling macOS FileVault2 devices (FVAULT2).
  * libcryptsetup: no longer use global memory locking through mlockall()
  * libcryptsetup: process priority is increased only for key derivation
    (PBKDF) calls.
  * Add new LUKS keyslot context handling functions and API.
  * The volume key may now be extracted using a passphrase, keyfile, or
    token. For LUKS devices, it also returns the volume key after
    a successful crypt_format call.
  * Fix --disable-luks2-reencryption configuration option.
  * cryptsetup: Print a better error message and warning if the format
    produces an image without space available for data.
  * Print error if anti-forensic LUKS2 hash setting is not available.
    If the specified hash was not available, activation quietly failed.
  * Fix internal crypt segment compare routine if the user
    specified cipher in kernel format (capi: prefix).
  * cryptsetup: Add token unassign action.
    This action allows removing token binding on specific keyslot.
  * veritysetup: add support for --use-tasklets option.
    This option sets try_verify_in_tasklet kernel dm-verity option
    (available since Linux kernel 6.0) to allow some performance
    improvement on specific systems.
  * Provide pkgconfig Require.private settings.
    While we do not completely provide static build on udev systems,
    it helps produce statically linked binaries in certain situations.
  * Always update automake library files if autogen.sh is run.
    For several releases, we distributed older automake scripts by mistake.
  * reencryption: Fix user defined moved segment size in LUKS2 decryption.
    The --hotzone-size argument was ignored in cases where the actual data
    size was less than the original LUKS2 data offset.
  * Delegate FIPS mode detection to configured crypto backend.
    System FIPS mode check no longer depends on /etc/system-fips file.
  * Update documentation, including FAQ and man pages.</changelog>
  <changelog author="lnussel@suse.com" date="1672142400">- Replace transitional %usrmerged macro with regular version check (boo#1206798)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1676203200">- cryptsetup 2.6.1
  * bitlk: Fixes for BitLocker-compatible on-disk metadata parser
  * Fix possible iteration overflow in OpenSSL2 PBKDF2 crypto
    backend
  * portability and compilation fixes
  * verity: Fix possible hash offset setting overflow.
  * bitlk: Fix use of startup BEK key on big-endian platforms.
  * Do not initiate encryption (reencryption command) when the
    header and data devices are the same. If data device reduction
    is not requsted, this leads to data corruption since LUKS
    metadata was written over the data device.
  * Fix possible memory leak if crypt_load() fails.
  * Always use passphrases with a minimal 8 chars length for
    benchmarking, as used in some implementation of FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1686744000">- FIPS: Remove not needed libcryptsetup12-hmac package that contains
  the HMAC checksums for integrity checking for FIPS. [bsc#1185116]
  * Remove the cryptsetup-rpmlintrc file.
  * Remove not needed fipscheck dependency.</changelog>
  <changelog author="pmonreal@suse.com" date="1686744001">- Enable running the regression test suite.
- Force a regeneration of the man pages from AsciiDoc.
- Add LUKS1 and LUKS2 On-Disk Format Specification pdfs to doc.</changelog>
  <changelog author="pmonreal@suse.com" date="1689249600">- luksFormat: Handle system with low memory and no swap space [bsc#1211079]
  * Check for physical memory available also in PBKDF benchmark.
  * Try to avoid OOM killer on low-memory systems without swap.
  * Use only half of detected free memory on systems without swap.
  * Add patches:
  - cryptsetup-Check-for-physical-memory-available-also-in-PBKDF-be.patch
  - cryptsetup-Try-to-avoid-OOM-killer-on-low-memory-systems-withou.patch
  - cryptsetup-Use-only-half-of-detected-free-memory-on-systems-wit.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1706529600">- Update to 2.7.0:
  * Full changelog in:
    mirrors.edge.kernel.org/pub/linux/utils/cryptsetup/v2.7/v2.7.0-ReleaseNotes
  * Introduce support for hardware OPAL disk encryption.
  * plain mode: Set default cipher to aes-xts-plain64 and password hashing
    to sha256.
  * Allow activation (open), luksResume, and luksAddKey to use the volume
    key stored in a keyring.
  * Allow to store volume key to a user-specified keyring in open and
    luksResume commands.
  * Do not flush IO operations if resize grows the device.
    This can help performance in specific cases where the encrypted device
    is extended automatically while running many IO operations.
  * Use only half of detected free memory for Argon2 PBKDF on systems
    without swap (for LUKS2 new keyslot or format operations).
  * Add the possibility to specify a directory for external LUKS2 token
    handlers (plugins).
  * Do not allow reencryption/decryption on LUKS2 devices with
    authenticated encryption or hardware (OPAL) encryption.
  * Do not fail LUKS format if the operation was interrupted on subsequent
    device wipe.
  * Fix the LUKS2 keyslot option to be used while activating the device
    by a token.
  * Properly report if the dm-verity device cannot be activated due to
    the inability to verify the signed root hash (ENOKEY).
  * Fix to check passphrase for selected keyslot only when adding
    new keyslot.
  * Fix to not wipe the keyslot area before in-place overwrite.
  * bitlk: Fix segfaults when attempting to verify the volume key.
  * Add --disable-blkid command line option to avoid blkid device check.
  * Add support for the meson build system.
  * Fix wipe operation that overwrites the whole device if used for LUKS2
    header with no keyslot area.
  * Fix luksErase to work with detached LUKS header.
  * Disallow the use of internal kernel crypto driver names in "capi"
    specification.
  * Fix reencryption to fail early for unknown cipher.
  * tcrypt: Support new Blake2 hash for VeraCrypt.
  * tcrypt: use hash values as substring for limiting KDF check.
  * Add Aria cipher support and block size info.
  * Do not decrease PBKDF parameters if the user forces them.
  * Support OpenSSL 3.2 Argon2 implementation.
  * Add support for Argon2 from libgcrypt
    (requires yet unreleased gcrypt 1.11).
  * Used Argon2 PBKDF implementation is now reported in debug mode
    in the cryptographic backend version. For native support in
    OpenSSL 3.2 or libgcrypt 1.11, "argon2" is displayed.
    If libargon2 is used, "cryptsetup libargon2" (for embedded
    library) or "external libargon2" is displayed.
  * Link only libcrypto from OpenSSL.
  * Disable reencryption for Direct-Access (DAX) devices.
  * Print a warning message if the device is not aligned to sector size.
  * Fix sector size and integrity fields display for non-LUKS2 crypt
    devices for the status command.
  * Fix suspend for LUKS2 with authenticated encryption (also suspend
    dm-integrity device underneath).
  * Update keyring and locking documentation and LUKS2 specification
    for OPAL2 support.
  * Remove patches fixed upstream:
  - cryptsetup-Check-for-physical-memory-available-also-in-PBKDF-be.patch
  - cryptsetup-Try-to-avoid-OOM-killer-on-low-memory-systems-withou.patch
  - cryptsetup-Use-only-half-of-detected-free-memory-on-systems-wit.patch</changelog>
  <changelog author="meissner@suse.com" date="1725019200">- cryptsetup-fips140-3.patch: extend the password for PBKDF2 benchmarking
  to be more than 20 chars to meet FIPS 140-3 requirements (bsc#1229975)</changelog>
</package>
<package pkgid="70befce9f8127aeb4379705769a4e0eec8c91113582b30dd431857e12cbb9e4b" name="cryptsetup-ssh" arch="s390x">
  <version epoch="0" ver="2.7.0" rel="150600.3.3.1"/>
  <changelog author="dmueller@suse.com" date="1615550400">- move licenses to licensedir</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1615636800">- cryptsetup 2.3.5:
  * Fix partial reads of passphrase from an interactive terminal
  * Fix maximum length of password entered through a terminal
  * integritysetup: support new dm-integrity HMAC recalculation
    options
  * integritysetup: display of recalculating sector in dump command
  * veritysetup: fix verity FEC if stored in the same image with
    hashes
  * veritysetup: run FEC repair check even if root hash fails
  * veritysetup: do not process hash image if hash area is empty
  * veritysetup: store verity hash algorithm in superblock in
    lowercase
  * bitlk: fix a crash if the device disappears during BitLocker
    scan
  * bitlk: show a better error when trying to open an NTFS device
  * bitlk: add support for startup key protected VMKs
  * Fix LUKS1 repair code (regression since version 1.7.x)
  * Fix luksKeyChange for LUKS2 with assigned tokens
  * Fix cryptsetup resize using LUKS2 tokens
  * Print a visible error if device resize is not supported
  * Add error message when suspending wrong non-LUKS device
  * Fix default XTS mode key size in reencryption
  * Rephrase missing locking directory warning and move it to
    debug level
  * Many fixes for the use of cipher_null (empty debug cipher)
  * Fixes for libpasswdqc 2.0.x (optional passphrase quality check)
  * Fixes for problems discovered by various tools for code
    analysis
  * Various fixes to man pages
- silence hmac packaging warnings</changelog>
  <changelog author="lnussel@suse.de" date="1625140800">- cryptsetup 2.3.6:
  * integritysetup: Fix possible dm-integrity mapping table truncation.
  * cryptsetup: Backup header can be used to activate TCRYPT device.
    Use --header option to specify the header.
  * cryptsetup: Avoid LUKS2 decryption without detached header.
    This feature will be added later and is currently not supported.
  * Additional fixes and workarounds for common warnings produced
    by some static analysis tools (like gcc-11 analyzer) and additional
    code hardening.
  * Fix standalone libintl detection for compiled tests.
  * Add Blake2b and Blake2s hash support for crypto backends.
    Kernel and gcrypt crypto backend support all variants.
    OpenSSL supports only Blake2b-512 and Blake2s-256.
    Crypto backend supports kernel notation e.g. "blake2b-512".</changelog>
  <changelog author="fvogt@suse.com" date="1627905600">- Use LUKS2 as default format on Tumbleweed.
  It provides some additional features which other tools
  (e.g. systemd-cryptenroll) rely on. GRUB 2.06 supports unlocking
  LUKS2 volumes meanwhile.</changelog>
  <changelog author="lnussel@suse.de" date="1627905601">- cryptsetup 2.4.0 (jsc#SLE-20275)
  * External LUKS token plugins
  * Experimental SSH token
  * Default LUKS2 PBKDF is now Argon2id
  * Increase minimal memory cost for Argon2 benchmark to 64MiB.
  * Autodetect optimal encryption sector size on LUKS2 format.
  * Use VeraCrypt option by default and add --disable-veracrypt option.
  * Support --hash and --cipher to limit opening time for TCRYPT type
  * Fixed default OpenSSL crypt backend support for OpenSSL3.
  * integritysetup: add integrity-recalculate-reset flag.
  * cryptsetup: retains keyslot number in luksChangeKey for LUKS2.
  * Fix cryptsetup resize using LUKS2 tokens.
  * Add close --deferred and --cancel-deferred options.
  * Rewritten command-line option parsing to avoid libpopt arguments
    memory leaks.
  * Add --test-args option.</changelog>
  <changelog author="lnussel@suse.de" date="1627992000">- need to use PBKDF2 by default for LUKS2 as grub can't decrypt when
  using Argon.</changelog>
  <changelog author="lnussel@suse.de" date="1629892800">- As YaST passes necessary parameters to cryptsetup anyway, we do
  not necessarily need to take grub into consideration. So back to
  Argon2 to see how it goes.</changelog>
  <changelog author="lnussel@suse.de" date="1631793600">- cryptsetup 2.4.1
  * Fix compilation for libc implementations without dlvsym().
  * Fix compilation and tests on systems with non-standard libraries
  * Try to workaround some issues on systems without udev support.
  * Fixes for OpenSSL3 crypto backend (including FIPS mode).
  * Print error message when assigning a token to an inactive keyslot.
  * Fix offset bug in LUKS2 encryption code if --offset option was used.
  * Do not allow LUKS2 decryption for devices with data offset.
  * Fix LUKS1 cryptsetup repair command for some specific problems.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1637236800">- cryptsetup 2.4.2:
  * Fix possible large memory allocation if LUKS2 header size is
    invalid.
  * Fix memory corruption in debug message printing LUKS2
    checksum.
  * veritysetup: remove link to the UUID library for the static
    build.
  * Remove link to pwquality library for integritysetup and
    veritysetup. These tools do not read passphrases.
  * OpenSSL3 backend: avoid remaining deprecated calls in API.
    Crypto backend no longer use API deprecated in OpenSSL 3.0
  * Check if kernel device-mapper create device failed in an early
    phase. This happens when a concurrent creation of device-mapper
    devices meets in the very early state.
  * Do not set compiler optimization flag for Argon2 KDF if the
    memory wipe is implemented in libc.
  * Do not attempt to unload LUKS2 tokens if external tokens are
    disabled. This allows building a static binary with
  - -disable-external-tokens.
  * LUKS convert: also check sysfs for device activity.
    If udev symlink is missing, code fallbacks to sysfs scan to
    prevent data corruption for the active device.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1642161600">- cryptsetup 2.4.3:
  * Fix possible attacks against data confidentiality through
    LUKS2 online reencryption extension crash recovery
    CVE-2021-4122, boo#1194469
  * Add configure option --disable-luks2-reencryption to completely
    disable LUKS2 reencryption code.
  * Improve internal metadata validation code for reencryption
    metadata
  * Add updated documentation for LUKS2 On-Disk Format
    Specification version 1.1.0
  * Fix support for bitlk (BitLocker compatible) startup key with
    new  metadata entry introduced in Windows 11
  * Fix space restriction for LUKS2 reencryption with data shift</changelog>
  <changelog author="lnussel@suse.de" date="1661169600">- cryptsetup 2.5.0:
  * Split manual pages into per-action pages and use AsciiDoc format.
  * Remove cryptsetup-reencrypt tool from the project and move reencryption
    to already existing "cryptsetup reencrypt" command.
    If you need to emulate the old cryptsetup-reencrypt binary, use simple
    wrappers script running "exec cryptsetup reencrypt $@".
  * LUKS2: implement --decryption option that allows LUKS removal.
  * Fix decryption operation with --active-name option and restrict
    it to be used only with LUKS2.
  * Do not refresh reencryption digest when not needed.
    This should speed up the reencryption resume process.
  * Store proper resilience data in LUKS2 reencrypt initialization.
    Resuming reencryption now does not require specification of resilience
    type parameters if these are the same as during initialization.
  * Properly wipe the unused area after reencryption with datashift in
    the forward direction.
  * Check datashift value against larger sector size.
    For example, it could cause an issue if misaligned 4K sector appears
    during decryption.
  * Do not allow sector size increase reencryption in offline mode.
  * Do not allow dangerous sector size change during reencryption.
  * Ask the user for confirmation before resuming reencryption.
  * Do not resume reencryption with conflicting parameters.
  * Add --force-offline-reencrypt option.
  * Do not allow nested encryption in LUKS reencrypt.
  * Support all options allowed with luksFormat with encrypt action.
  * Add resize action to integritysetup.
  * Remove obsolete dracut plugin reencryption example.
  * Fix possible keyslot area size overflow during conversion to LUKS2.
  * Allow use of --header option for cryptsetup close.
  * Fix activation of LUKS2 device with integrity and detached header.
  * Add ZEROOUT IOCTL support for crypt_wipe API call.
  * VERITY: set loopback sector size according to dm-verity block sizes.
  * veritysetup: dump device sizes.
  * LUKS2 token: prefer token PIN query before passphrase in some cases.
    When a user provides --token-type or specific --token-id, a token PIN
    query is preferred to a passphrase query.
  * LUKS2 token: allow tokens to be replaced with --token-replace option
    for cryptsetup token command.
  * LUKS2 token: do not continue operation when interrupted in PIN prompt.
  * Add --progress-json parameter to utilities.
  * Add support for --key-slot option in luksResume action.
- move man pages to separate subpackage
- drop backports handling</changelog>
  <changelog author="luca.boccassi@gmail.com" date="1663070400">- Add virtual provides for 'integritysetup' and 'veritysetup' to match
  package names provided by Fedora/RHEL, to allow the same set of
  dependencies to be used across all RPM distributions.</changelog>
  <changelog author="info@paolostivanin.com" date="1669636800">- cryptsetup 2.6.0:
  * Introduce support for handling macOS FileVault2 devices (FVAULT2).
  * libcryptsetup: no longer use global memory locking through mlockall()
  * libcryptsetup: process priority is increased only for key derivation
    (PBKDF) calls.
  * Add new LUKS keyslot context handling functions and API.
  * The volume key may now be extracted using a passphrase, keyfile, or
    token. For LUKS devices, it also returns the volume key after
    a successful crypt_format call.
  * Fix --disable-luks2-reencryption configuration option.
  * cryptsetup: Print a better error message and warning if the format
    produces an image without space available for data.
  * Print error if anti-forensic LUKS2 hash setting is not available.
    If the specified hash was not available, activation quietly failed.
  * Fix internal crypt segment compare routine if the user
    specified cipher in kernel format (capi: prefix).
  * cryptsetup: Add token unassign action.
    This action allows removing token binding on specific keyslot.
  * veritysetup: add support for --use-tasklets option.
    This option sets try_verify_in_tasklet kernel dm-verity option
    (available since Linux kernel 6.0) to allow some performance
    improvement on specific systems.
  * Provide pkgconfig Require.private settings.
    While we do not completely provide static build on udev systems,
    it helps produce statically linked binaries in certain situations.
  * Always update automake library files if autogen.sh is run.
    For several releases, we distributed older automake scripts by mistake.
  * reencryption: Fix user defined moved segment size in LUKS2 decryption.
    The --hotzone-size argument was ignored in cases where the actual data
    size was less than the original LUKS2 data offset.
  * Delegate FIPS mode detection to configured crypto backend.
    System FIPS mode check no longer depends on /etc/system-fips file.
  * Update documentation, including FAQ and man pages.</changelog>
  <changelog author="lnussel@suse.com" date="1672142400">- Replace transitional %usrmerged macro with regular version check (boo#1206798)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1676203200">- cryptsetup 2.6.1
  * bitlk: Fixes for BitLocker-compatible on-disk metadata parser
  * Fix possible iteration overflow in OpenSSL2 PBKDF2 crypto
    backend
  * portability and compilation fixes
  * verity: Fix possible hash offset setting overflow.
  * bitlk: Fix use of startup BEK key on big-endian platforms.
  * Do not initiate encryption (reencryption command) when the
    header and data devices are the same. If data device reduction
    is not requsted, this leads to data corruption since LUKS
    metadata was written over the data device.
  * Fix possible memory leak if crypt_load() fails.
  * Always use passphrases with a minimal 8 chars length for
    benchmarking, as used in some implementation of FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1686744000">- FIPS: Remove not needed libcryptsetup12-hmac package that contains
  the HMAC checksums for integrity checking for FIPS. [bsc#1185116]
  * Remove the cryptsetup-rpmlintrc file.
  * Remove not needed fipscheck dependency.</changelog>
  <changelog author="pmonreal@suse.com" date="1686744001">- Enable running the regression test suite.
- Force a regeneration of the man pages from AsciiDoc.
- Add LUKS1 and LUKS2 On-Disk Format Specification pdfs to doc.</changelog>
  <changelog author="pmonreal@suse.com" date="1689249600">- luksFormat: Handle system with low memory and no swap space [bsc#1211079]
  * Check for physical memory available also in PBKDF benchmark.
  * Try to avoid OOM killer on low-memory systems without swap.
  * Use only half of detected free memory on systems without swap.
  * Add patches:
  - cryptsetup-Check-for-physical-memory-available-also-in-PBKDF-be.patch
  - cryptsetup-Try-to-avoid-OOM-killer-on-low-memory-systems-withou.patch
  - cryptsetup-Use-only-half-of-detected-free-memory-on-systems-wit.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1706529600">- Update to 2.7.0:
  * Full changelog in:
    mirrors.edge.kernel.org/pub/linux/utils/cryptsetup/v2.7/v2.7.0-ReleaseNotes
  * Introduce support for hardware OPAL disk encryption.
  * plain mode: Set default cipher to aes-xts-plain64 and password hashing
    to sha256.
  * Allow activation (open), luksResume, and luksAddKey to use the volume
    key stored in a keyring.
  * Allow to store volume key to a user-specified keyring in open and
    luksResume commands.
  * Do not flush IO operations if resize grows the device.
    This can help performance in specific cases where the encrypted device
    is extended automatically while running many IO operations.
  * Use only half of detected free memory for Argon2 PBKDF on systems
    without swap (for LUKS2 new keyslot or format operations).
  * Add the possibility to specify a directory for external LUKS2 token
    handlers (plugins).
  * Do not allow reencryption/decryption on LUKS2 devices with
    authenticated encryption or hardware (OPAL) encryption.
  * Do not fail LUKS format if the operation was interrupted on subsequent
    device wipe.
  * Fix the LUKS2 keyslot option to be used while activating the device
    by a token.
  * Properly report if the dm-verity device cannot be activated due to
    the inability to verify the signed root hash (ENOKEY).
  * Fix to check passphrase for selected keyslot only when adding
    new keyslot.
  * Fix to not wipe the keyslot area before in-place overwrite.
  * bitlk: Fix segfaults when attempting to verify the volume key.
  * Add --disable-blkid command line option to avoid blkid device check.
  * Add support for the meson build system.
  * Fix wipe operation that overwrites the whole device if used for LUKS2
    header with no keyslot area.
  * Fix luksErase to work with detached LUKS header.
  * Disallow the use of internal kernel crypto driver names in "capi"
    specification.
  * Fix reencryption to fail early for unknown cipher.
  * tcrypt: Support new Blake2 hash for VeraCrypt.
  * tcrypt: use hash values as substring for limiting KDF check.
  * Add Aria cipher support and block size info.
  * Do not decrease PBKDF parameters if the user forces them.
  * Support OpenSSL 3.2 Argon2 implementation.
  * Add support for Argon2 from libgcrypt
    (requires yet unreleased gcrypt 1.11).
  * Used Argon2 PBKDF implementation is now reported in debug mode
    in the cryptographic backend version. For native support in
    OpenSSL 3.2 or libgcrypt 1.11, "argon2" is displayed.
    If libargon2 is used, "cryptsetup libargon2" (for embedded
    library) or "external libargon2" is displayed.
  * Link only libcrypto from OpenSSL.
  * Disable reencryption for Direct-Access (DAX) devices.
  * Print a warning message if the device is not aligned to sector size.
  * Fix sector size and integrity fields display for non-LUKS2 crypt
    devices for the status command.
  * Fix suspend for LUKS2 with authenticated encryption (also suspend
    dm-integrity device underneath).
  * Update keyring and locking documentation and LUKS2 specification
    for OPAL2 support.
  * Remove patches fixed upstream:
  - cryptsetup-Check-for-physical-memory-available-also-in-PBKDF-be.patch
  - cryptsetup-Try-to-avoid-OOM-killer-on-low-memory-systems-withou.patch
  - cryptsetup-Use-only-half-of-detected-free-memory-on-systems-wit.patch</changelog>
  <changelog author="meissner@suse.com" date="1725019200">- cryptsetup-fips140-3.patch: extend the password for PBKDF2 benchmarking
  to be more than 20 chars to meet FIPS 140-3 requirements (bsc#1229975)</changelog>
</package>
<package pkgid="178b88c908078acc546affef063723d2106bd70be5bcd4784557ec8d1c4bd1fb" name="cryptsetup-ssh" arch="x86_64">
  <version epoch="0" ver="2.7.0" rel="150600.3.3.1"/>
  <changelog author="dmueller@suse.com" date="1615550400">- move licenses to licensedir</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1615636800">- cryptsetup 2.3.5:
  * Fix partial reads of passphrase from an interactive terminal
  * Fix maximum length of password entered through a terminal
  * integritysetup: support new dm-integrity HMAC recalculation
    options
  * integritysetup: display of recalculating sector in dump command
  * veritysetup: fix verity FEC if stored in the same image with
    hashes
  * veritysetup: run FEC repair check even if root hash fails
  * veritysetup: do not process hash image if hash area is empty
  * veritysetup: store verity hash algorithm in superblock in
    lowercase
  * bitlk: fix a crash if the device disappears during BitLocker
    scan
  * bitlk: show a better error when trying to open an NTFS device
  * bitlk: add support for startup key protected VMKs
  * Fix LUKS1 repair code (regression since version 1.7.x)
  * Fix luksKeyChange for LUKS2 with assigned tokens
  * Fix cryptsetup resize using LUKS2 tokens
  * Print a visible error if device resize is not supported
  * Add error message when suspending wrong non-LUKS device
  * Fix default XTS mode key size in reencryption
  * Rephrase missing locking directory warning and move it to
    debug level
  * Many fixes for the use of cipher_null (empty debug cipher)
  * Fixes for libpasswdqc 2.0.x (optional passphrase quality check)
  * Fixes for problems discovered by various tools for code
    analysis
  * Various fixes to man pages
- silence hmac packaging warnings</changelog>
  <changelog author="lnussel@suse.de" date="1625140800">- cryptsetup 2.3.6:
  * integritysetup: Fix possible dm-integrity mapping table truncation.
  * cryptsetup: Backup header can be used to activate TCRYPT device.
    Use --header option to specify the header.
  * cryptsetup: Avoid LUKS2 decryption without detached header.
    This feature will be added later and is currently not supported.
  * Additional fixes and workarounds for common warnings produced
    by some static analysis tools (like gcc-11 analyzer) and additional
    code hardening.
  * Fix standalone libintl detection for compiled tests.
  * Add Blake2b and Blake2s hash support for crypto backends.
    Kernel and gcrypt crypto backend support all variants.
    OpenSSL supports only Blake2b-512 and Blake2s-256.
    Crypto backend supports kernel notation e.g. "blake2b-512".</changelog>
  <changelog author="fvogt@suse.com" date="1627905600">- Use LUKS2 as default format on Tumbleweed.
  It provides some additional features which other tools
  (e.g. systemd-cryptenroll) rely on. GRUB 2.06 supports unlocking
  LUKS2 volumes meanwhile.</changelog>
  <changelog author="lnussel@suse.de" date="1627905601">- cryptsetup 2.4.0 (jsc#SLE-20275)
  * External LUKS token plugins
  * Experimental SSH token
  * Default LUKS2 PBKDF is now Argon2id
  * Increase minimal memory cost for Argon2 benchmark to 64MiB.
  * Autodetect optimal encryption sector size on LUKS2 format.
  * Use VeraCrypt option by default and add --disable-veracrypt option.
  * Support --hash and --cipher to limit opening time for TCRYPT type
  * Fixed default OpenSSL crypt backend support for OpenSSL3.
  * integritysetup: add integrity-recalculate-reset flag.
  * cryptsetup: retains keyslot number in luksChangeKey for LUKS2.
  * Fix cryptsetup resize using LUKS2 tokens.
  * Add close --deferred and --cancel-deferred options.
  * Rewritten command-line option parsing to avoid libpopt arguments
    memory leaks.
  * Add --test-args option.</changelog>
  <changelog author="lnussel@suse.de" date="1627992000">- need to use PBKDF2 by default for LUKS2 as grub can't decrypt when
  using Argon.</changelog>
  <changelog author="lnussel@suse.de" date="1629892800">- As YaST passes necessary parameters to cryptsetup anyway, we do
  not necessarily need to take grub into consideration. So back to
  Argon2 to see how it goes.</changelog>
  <changelog author="lnussel@suse.de" date="1631793600">- cryptsetup 2.4.1
  * Fix compilation for libc implementations without dlvsym().
  * Fix compilation and tests on systems with non-standard libraries
  * Try to workaround some issues on systems without udev support.
  * Fixes for OpenSSL3 crypto backend (including FIPS mode).
  * Print error message when assigning a token to an inactive keyslot.
  * Fix offset bug in LUKS2 encryption code if --offset option was used.
  * Do not allow LUKS2 decryption for devices with data offset.
  * Fix LUKS1 cryptsetup repair command for some specific problems.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1637236800">- cryptsetup 2.4.2:
  * Fix possible large memory allocation if LUKS2 header size is
    invalid.
  * Fix memory corruption in debug message printing LUKS2
    checksum.
  * veritysetup: remove link to the UUID library for the static
    build.
  * Remove link to pwquality library for integritysetup and
    veritysetup. These tools do not read passphrases.
  * OpenSSL3 backend: avoid remaining deprecated calls in API.
    Crypto backend no longer use API deprecated in OpenSSL 3.0
  * Check if kernel device-mapper create device failed in an early
    phase. This happens when a concurrent creation of device-mapper
    devices meets in the very early state.
  * Do not set compiler optimization flag for Argon2 KDF if the
    memory wipe is implemented in libc.
  * Do not attempt to unload LUKS2 tokens if external tokens are
    disabled. This allows building a static binary with
  - -disable-external-tokens.
  * LUKS convert: also check sysfs for device activity.
    If udev symlink is missing, code fallbacks to sysfs scan to
    prevent data corruption for the active device.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1642161600">- cryptsetup 2.4.3:
  * Fix possible attacks against data confidentiality through
    LUKS2 online reencryption extension crash recovery
    CVE-2021-4122, boo#1194469
  * Add configure option --disable-luks2-reencryption to completely
    disable LUKS2 reencryption code.
  * Improve internal metadata validation code for reencryption
    metadata
  * Add updated documentation for LUKS2 On-Disk Format
    Specification version 1.1.0
  * Fix support for bitlk (BitLocker compatible) startup key with
    new  metadata entry introduced in Windows 11
  * Fix space restriction for LUKS2 reencryption with data shift</changelog>
  <changelog author="lnussel@suse.de" date="1661169600">- cryptsetup 2.5.0:
  * Split manual pages into per-action pages and use AsciiDoc format.
  * Remove cryptsetup-reencrypt tool from the project and move reencryption
    to already existing "cryptsetup reencrypt" command.
    If you need to emulate the old cryptsetup-reencrypt binary, use simple
    wrappers script running "exec cryptsetup reencrypt $@".
  * LUKS2: implement --decryption option that allows LUKS removal.
  * Fix decryption operation with --active-name option and restrict
    it to be used only with LUKS2.
  * Do not refresh reencryption digest when not needed.
    This should speed up the reencryption resume process.
  * Store proper resilience data in LUKS2 reencrypt initialization.
    Resuming reencryption now does not require specification of resilience
    type parameters if these are the same as during initialization.
  * Properly wipe the unused area after reencryption with datashift in
    the forward direction.
  * Check datashift value against larger sector size.
    For example, it could cause an issue if misaligned 4K sector appears
    during decryption.
  * Do not allow sector size increase reencryption in offline mode.
  * Do not allow dangerous sector size change during reencryption.
  * Ask the user for confirmation before resuming reencryption.
  * Do not resume reencryption with conflicting parameters.
  * Add --force-offline-reencrypt option.
  * Do not allow nested encryption in LUKS reencrypt.
  * Support all options allowed with luksFormat with encrypt action.
  * Add resize action to integritysetup.
  * Remove obsolete dracut plugin reencryption example.
  * Fix possible keyslot area size overflow during conversion to LUKS2.
  * Allow use of --header option for cryptsetup close.
  * Fix activation of LUKS2 device with integrity and detached header.
  * Add ZEROOUT IOCTL support for crypt_wipe API call.
  * VERITY: set loopback sector size according to dm-verity block sizes.
  * veritysetup: dump device sizes.
  * LUKS2 token: prefer token PIN query before passphrase in some cases.
    When a user provides --token-type or specific --token-id, a token PIN
    query is preferred to a passphrase query.
  * LUKS2 token: allow tokens to be replaced with --token-replace option
    for cryptsetup token command.
  * LUKS2 token: do not continue operation when interrupted in PIN prompt.
  * Add --progress-json parameter to utilities.
  * Add support for --key-slot option in luksResume action.
- move man pages to separate subpackage
- drop backports handling</changelog>
  <changelog author="luca.boccassi@gmail.com" date="1663070400">- Add virtual provides for 'integritysetup' and 'veritysetup' to match
  package names provided by Fedora/RHEL, to allow the same set of
  dependencies to be used across all RPM distributions.</changelog>
  <changelog author="info@paolostivanin.com" date="1669636800">- cryptsetup 2.6.0:
  * Introduce support for handling macOS FileVault2 devices (FVAULT2).
  * libcryptsetup: no longer use global memory locking through mlockall()
  * libcryptsetup: process priority is increased only for key derivation
    (PBKDF) calls.
  * Add new LUKS keyslot context handling functions and API.
  * The volume key may now be extracted using a passphrase, keyfile, or
    token. For LUKS devices, it also returns the volume key after
    a successful crypt_format call.
  * Fix --disable-luks2-reencryption configuration option.
  * cryptsetup: Print a better error message and warning if the format
    produces an image without space available for data.
  * Print error if anti-forensic LUKS2 hash setting is not available.
    If the specified hash was not available, activation quietly failed.
  * Fix internal crypt segment compare routine if the user
    specified cipher in kernel format (capi: prefix).
  * cryptsetup: Add token unassign action.
    This action allows removing token binding on specific keyslot.
  * veritysetup: add support for --use-tasklets option.
    This option sets try_verify_in_tasklet kernel dm-verity option
    (available since Linux kernel 6.0) to allow some performance
    improvement on specific systems.
  * Provide pkgconfig Require.private settings.
    While we do not completely provide static build on udev systems,
    it helps produce statically linked binaries in certain situations.
  * Always update automake library files if autogen.sh is run.
    For several releases, we distributed older automake scripts by mistake.
  * reencryption: Fix user defined moved segment size in LUKS2 decryption.
    The --hotzone-size argument was ignored in cases where the actual data
    size was less than the original LUKS2 data offset.
  * Delegate FIPS mode detection to configured crypto backend.
    System FIPS mode check no longer depends on /etc/system-fips file.
  * Update documentation, including FAQ and man pages.</changelog>
  <changelog author="lnussel@suse.com" date="1672142400">- Replace transitional %usrmerged macro with regular version check (boo#1206798)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1676203200">- cryptsetup 2.6.1
  * bitlk: Fixes for BitLocker-compatible on-disk metadata parser
  * Fix possible iteration overflow in OpenSSL2 PBKDF2 crypto
    backend
  * portability and compilation fixes
  * verity: Fix possible hash offset setting overflow.
  * bitlk: Fix use of startup BEK key on big-endian platforms.
  * Do not initiate encryption (reencryption command) when the
    header and data devices are the same. If data device reduction
    is not requsted, this leads to data corruption since LUKS
    metadata was written over the data device.
  * Fix possible memory leak if crypt_load() fails.
  * Always use passphrases with a minimal 8 chars length for
    benchmarking, as used in some implementation of FIPS mode</changelog>
  <changelog author="pmonreal@suse.com" date="1686744000">- FIPS: Remove not needed libcryptsetup12-hmac package that contains
  the HMAC checksums for integrity checking for FIPS. [bsc#1185116]
  * Remove the cryptsetup-rpmlintrc file.
  * Remove not needed fipscheck dependency.</changelog>
  <changelog author="pmonreal@suse.com" date="1686744001">- Enable running the regression test suite.
- Force a regeneration of the man pages from AsciiDoc.
- Add LUKS1 and LUKS2 On-Disk Format Specification pdfs to doc.</changelog>
  <changelog author="pmonreal@suse.com" date="1689249600">- luksFormat: Handle system with low memory and no swap space [bsc#1211079]
  * Check for physical memory available also in PBKDF benchmark.
  * Try to avoid OOM killer on low-memory systems without swap.
  * Use only half of detected free memory on systems without swap.
  * Add patches:
  - cryptsetup-Check-for-physical-memory-available-also-in-PBKDF-be.patch
  - cryptsetup-Try-to-avoid-OOM-killer-on-low-memory-systems-withou.patch
  - cryptsetup-Use-only-half-of-detected-free-memory-on-systems-wit.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1706529600">- Update to 2.7.0:
  * Full changelog in:
    mirrors.edge.kernel.org/pub/linux/utils/cryptsetup/v2.7/v2.7.0-ReleaseNotes
  * Introduce support for hardware OPAL disk encryption.
  * plain mode: Set default cipher to aes-xts-plain64 and password hashing
    to sha256.
  * Allow activation (open), luksResume, and luksAddKey to use the volume
    key stored in a keyring.
  * Allow to store volume key to a user-specified keyring in open and
    luksResume commands.
  * Do not flush IO operations if resize grows the device.
    This can help performance in specific cases where the encrypted device
    is extended automatically while running many IO operations.
  * Use only half of detected free memory for Argon2 PBKDF on systems
    without swap (for LUKS2 new keyslot or format operations).
  * Add the possibility to specify a directory for external LUKS2 token
    handlers (plugins).
  * Do not allow reencryption/decryption on LUKS2 devices with
    authenticated encryption or hardware (OPAL) encryption.
  * Do not fail LUKS format if the operation was interrupted on subsequent
    device wipe.
  * Fix the LUKS2 keyslot option to be used while activating the device
    by a token.
  * Properly report if the dm-verity device cannot be activated due to
    the inability to verify the signed root hash (ENOKEY).
  * Fix to check passphrase for selected keyslot only when adding
    new keyslot.
  * Fix to not wipe the keyslot area before in-place overwrite.
  * bitlk: Fix segfaults when attempting to verify the volume key.
  * Add --disable-blkid command line option to avoid blkid device check.
  * Add support for the meson build system.
  * Fix wipe operation that overwrites the whole device if used for LUKS2
    header with no keyslot area.
  * Fix luksErase to work with detached LUKS header.
  * Disallow the use of internal kernel crypto driver names in "capi"
    specification.
  * Fix reencryption to fail early for unknown cipher.
  * tcrypt: Support new Blake2 hash for VeraCrypt.
  * tcrypt: use hash values as substring for limiting KDF check.
  * Add Aria cipher support and block size info.
  * Do not decrease PBKDF parameters if the user forces them.
  * Support OpenSSL 3.2 Argon2 implementation.
  * Add support for Argon2 from libgcrypt
    (requires yet unreleased gcrypt 1.11).
  * Used Argon2 PBKDF implementation is now reported in debug mode
    in the cryptographic backend version. For native support in
    OpenSSL 3.2 or libgcrypt 1.11, "argon2" is displayed.
    If libargon2 is used, "cryptsetup libargon2" (for embedded
    library) or "external libargon2" is displayed.
  * Link only libcrypto from OpenSSL.
  * Disable reencryption for Direct-Access (DAX) devices.
  * Print a warning message if the device is not aligned to sector size.
  * Fix sector size and integrity fields display for non-LUKS2 crypt
    devices for the status command.
  * Fix suspend for LUKS2 with authenticated encryption (also suspend
    dm-integrity device underneath).
  * Update keyring and locking documentation and LUKS2 specification
    for OPAL2 support.
  * Remove patches fixed upstream:
  - cryptsetup-Check-for-physical-memory-available-also-in-PBKDF-be.patch
  - cryptsetup-Try-to-avoid-OOM-killer-on-low-memory-systems-withou.patch
  - cryptsetup-Use-only-half-of-detected-free-memory-on-systems-wit.patch</changelog>
  <changelog author="meissner@suse.com" date="1725019200">- cryptsetup-fips140-3.patch: extend the password for PBKDF2 benchmarking
  to be more than 20 chars to meet FIPS 140-3 requirements (bsc#1229975)</changelog>
</package>
<package pkgid="82f9ad143f3c50d7d34b822f1ca9346c7069465bb4b42aacf476fb09fd8cccc2" name="csp-billing-adapter" arch="src">
  <version epoch="0" ver="0.10.0" rel="150400.9.14.1"/>
  <changelog author="sean.marlow@suse.com" date="1687953600">- Update to version v0.3.0
  + Add new exception type
  + Improved initial metering test exception handling
- Update to version 0.2.0
  + Split up `create_csp_config` into smaller components.
- Update to version 0.1.1
  + Fix retry on exception in the meter billing test.
  + Fix the timestamp in meter billing test call. This is
    a datetime object not a string timestamp.
- Update to version 0.1.0
  + Wait one cycle at startup before checking usage data
  + Dry run metering against API at startup
  + Sleep only for remainder of cycle to account for processing time.
  + Handle multiple errors using error list
  + Use cache and csp config in memory
  + Pass in now timestamp instead of re-generating
  + Save config map and cache once at end of loop
  + Add base product to csp config
  + Add timestamps to log messages
  + Add retry mechanism for functions that may fail randomly
- Update to version 0.0.2
  + Handle no matching dimension found for volume billing
  + Only load testing support plugins in unit tests
  + Add additional logging to core paths
  + Add Initial exception handling
- initial build</changelog>
  <changelog author="rjschwei@suse.com" date="1688385600">- Update to version 0.3.1
  + Add -service subpackage
  + systemd enablement to run the code as a daemon in a VM</changelog>
  <changelog author="sean.marlow@suse.com" date="1690891200">- Update to version 0.4.0
  + Handle status dictionary from meter billing and legacy string response.
  + Implement supported for tiered consumption reporting.</changelog>
  <changelog author="jesus.bv@suse.com" date="1692360000">- Fix python3-csp-billing-adapter dependency for service</changelog>
  <changelog author="rjschwei@suse.com" date="1692360001">- Update to version 0.5.0
  + Integrate log handling and log configuration</changelog>
  <changelog author="jesus.bv@suse.com" date="1695038400">- Update to version 0.6.0
  Update message when records list is empty
  Only sleep at initial deployment
  Skip invalid records
  Log format variables on a const</changelog>
  <changelog author="sean.marlow@suse.com" date="1695211200">- Update to version 0.7.0:
  * Add get version hook spec</changelog>
  <changelog author="sean.marlow@suse.com" date="1697457600">- Update to version 0.8.0:
  * Clear billing status with an empty dictionary</changelog>
  <changelog author="sean.marlow@suse.com" date="1705665600">- Update to version 0.9.0:
  * Add metering archive feature</changelog>
  <changelog author="sean.marlow@suse.com" date="1713873600">- Update to version 0.10.0:
  * Add free trial feature</changelog>
</package>
<package pkgid="d19332d84fe25e772f02223a08d52c9e7534dfa31d6905ac5e239379029af05b" name="csp-billing-adapter-service" arch="noarch">
  <version epoch="0" ver="0.10.0" rel="150400.9.14.1"/>
  <changelog author="sean.marlow@suse.com" date="1687953600">- Update to version v0.3.0
  + Add new exception type
  + Improved initial metering test exception handling
- Update to version 0.2.0
  + Split up `create_csp_config` into smaller components.
- Update to version 0.1.1
  + Fix retry on exception in the meter billing test.
  + Fix the timestamp in meter billing test call. This is
    a datetime object not a string timestamp.
- Update to version 0.1.0
  + Wait one cycle at startup before checking usage data
  + Dry run metering against API at startup
  + Sleep only for remainder of cycle to account for processing time.
  + Handle multiple errors using error list
  + Use cache and csp config in memory
  + Pass in now timestamp instead of re-generating
  + Save config map and cache once at end of loop
  + Add base product to csp config
  + Add timestamps to log messages
  + Add retry mechanism for functions that may fail randomly
- Update to version 0.0.2
  + Handle no matching dimension found for volume billing
  + Only load testing support plugins in unit tests
  + Add additional logging to core paths
  + Add Initial exception handling
- initial build</changelog>
  <changelog author="rjschwei@suse.com" date="1688385600">- Update to version 0.3.1
  + Add -service subpackage
  + systemd enablement to run the code as a daemon in a VM</changelog>
  <changelog author="sean.marlow@suse.com" date="1690891200">- Update to version 0.4.0
  + Handle status dictionary from meter billing and legacy string response.
  + Implement supported for tiered consumption reporting.</changelog>
  <changelog author="jesus.bv@suse.com" date="1692360000">- Fix python3-csp-billing-adapter dependency for service</changelog>
  <changelog author="rjschwei@suse.com" date="1692360001">- Update to version 0.5.0
  + Integrate log handling and log configuration</changelog>
  <changelog author="jesus.bv@suse.com" date="1695038400">- Update to version 0.6.0
  Update message when records list is empty
  Only sleep at initial deployment
  Skip invalid records
  Log format variables on a const</changelog>
  <changelog author="sean.marlow@suse.com" date="1695211200">- Update to version 0.7.0:
  * Add get version hook spec</changelog>
  <changelog author="sean.marlow@suse.com" date="1697457600">- Update to version 0.8.0:
  * Clear billing status with an empty dictionary</changelog>
  <changelog author="sean.marlow@suse.com" date="1705665600">- Update to version 0.9.0:
  * Add metering archive feature</changelog>
  <changelog author="sean.marlow@suse.com" date="1713873600">- Update to version 0.10.0:
  * Add free trial feature</changelog>
</package>
<package pkgid="2f806348ef97fcaf8fc4a8d06d95f374f0db0ec48f9df6d2c3d80917a7b079e2" name="ctdb" arch="aarch64">
  <version epoch="0" ver="4.19.7+git.357.1d7950ebd62" rel="150600.3.3.2"/>
  <changelog author="nopower@suse.com" date="1679745600">- Make (32bit) samba-libs conflict with old samba-ad-dc-libs
  package to satisfy installcheck.</changelog>
  <changelog author="nopower@suse.com" date="1681300800">- Update to 4.17.7
  * CVE-2023-0922: Samba AD DC admin tool samba-tool sends passwords
    in cleartext; (bso#15315); (bsc#1209481).
  * CVE-2023-0225: Samba AD DC "dnsHostname" attribute can be
    deleted by unprivileged authenticated users; (bso#15276);
    (bsc#1209483).
  * CVE-2023-0614: samba: Access controlled AD LDAP attributes can
    be discovered; (bso#15270); (bsc#1209485).
  * large_ldap test is inefficient; (bso#15332).
  * CVE-2020-25720 [SECURITY] Create Child permission should not
    allow full write to all attributes (additional changes);
    (bso#14810).
- Update to 4.17.6
  * streams_xattr is creating unexpected locks on folders;
    (bso#15314).
  * Use of the Azure AD Connect cloud sync tool is now supported
    for password hash synchronisation, allowing Samba AD Domains
    to synchronise passwords with this popular cloud environment;
    (bso#10635).
  * Spotlight doesn't work with latest macOS Ventura;
    (bso#15299).
  * New samba-dcerpc architecture does not scale gracefully;
    (bso#15310).
  * vfs_ceph incorrectly uses fsp_get_io_fd() instead of
    fsp_get_pathref_fd() in close and fstat; (bso#15307).
  * With clustering enabled samba-bgqd can core dump due to use
    after free; (bso#15293).
  * fd_load() function implicitly closes the fd where it should
    not; (bso#15311).
- Update to 4.17.5
  * smbc_getxattr() return value is incorrect; (bso#14808).
  * Compound SMB2 FLUSH+CLOSE requests from MacOSX are not
    handled correctly; (bso#15172).
  * synthetic_pathref AFP_AfpInfo failed errors; (bso#15210).
  * samba-tool gpo listall fails IPv6 only - finddcs() fails to
    find DC when there is only an AAAA record for the DC in DNS;
    (bso#15226).
  * smbd crashes if an FSCTL request is done on a stream handle;
    (bso#15236).
  * DFS links don't work anymore on Mac clients since 4.17;
    (bso#15277).
  * vfs_virusfilter segfault on access, directory edgecase
    (accessing NULL value); (bso#15283).
  * CVE-2022-38023 [SECURITY] Samba should refuse RC4 (aka md5)
    based SChannel on NETLOGON (additional changes); (bso#15240).
  * %U for include directive doesn't work for share listing
    (netshareenum); (bso#15243).
  * Shares missing from netshareenum response in samba 4.17.4;
    (bso#15266).
  * ctdb: use-after-free in run_proc; (bso#15269).
  * irpc_destructor may crash during shutdown; (bso#15280).
  * auth3_generate_session_info_pac leaks wbcAuthUserInfo;
    (bso#15286).
  * smbclient segfaults with use after free on an optimized
    build; (bso#15268).
  * smbstatus leaking files in msg.sock and msg.lock;
    (bso#15282).
  * Leak in wbcCtxPingDc2; (bso#15164).
  * Access based share enum does not work in Samba 4.16+;
    (bso#15265).
  * Crash during share enumeration; (bso#15267).
  * rep_listxattr on FreeBSD does not properly check for reads
    off end of returned buffer; (bso#15271).
  * Avoid relying on C89 features in a few places; (bso#15281).</changelog>
  <changelog author="nopower@suse.com" date="1686830400">- Update to 4.17.8
  * log flood: smbd_calculate_access_mask_fsp: Access denied:
    message level should be lower; (bso#15302).
  * Floating point exception (FPE) via cli_pull_send at
    source3/libsmb/clireadwrite.c; (bso#15306).
  * test_tstream_more_tcp_user_timeout_spin fails intermittently
    on Rackspace GitLab runners; (bso#15328).
  * Reduce flapping of ridalloc test; (bso#15329).
  * large_ldap test is unreliable; (bso#15351).
  * New filename parser doesn't check veto files smb.conf
    parameter; (bso#15143).
  * mdssvc may crash when initializing; (bso#15354).
  * Large directory optimization broken for non-lcomp path
    elements; (bso#15313).
  * streams_depot fails to create streams; (bso#15357).
  * shadow_copy2 and streams_depot don't play well together;
    (bso#15358).
  * wbinfo -u fails on ad dc with &gt;1000 users; (bso#15366).
  * winbindd idmap child contacts the domain controller without a
    need; (bso#15317).
  * idmap_autorid may fail to map sids of trusted domains for the
    first time; (bso#15318).
  * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings;
    (bso#15319).
  * net ads search -P doesn't work against servers in other
    domains; (bso#15323).
  * DS ACEs might be inherited to unrelated object classes;
    (bso#15338).
  * Temporary smbXsrv_tcon_global.tdb can't be parsed;
    (bso#15353).
  * Setting veto files = /.*/ break listing directories;
    (bso#15360); (bsc#1212375).
  * CVE-2020-25720 [SECURITY] Create Child permission should not
    allow full write to all attributes (additional changes);
    (bso#14810).
  * dsgetdcname: assumes local system uses IPv4; (bso#15325).</changelog>
  <changelog author="nopower@suse.com" date="1688644800">- Update to 4.17.9
  * Backport --pidl-developer fixes; (bso#15404).
  * smbd_scavenger crashes when service smbd is stopped;
    (bso#15275).
  * vfs_fruit might cause a failing open for delete; (bso#15378).
  * named crashes on DLZ zone update; (bso#14030).
  * winbind recurses into itself via rpcd_lsad; (bso#15361).
  * cli_list loops 100% CPU against pre-lanman2 servers;
    (bso#15382).
  * smbclient leaks fds with showacls; (bso#15391).
  * aes256 smb3 encryption algorithms are not allowed in
    smb3_sid_parse(); (bso#15374).
  * winbindd gets stuck on NT_STATUS_RPC_SEC_PKG_ERROR;
    (bso#15413).
  * smbget memory leak if failed to download files recursively;
    (bso#15403).</changelog>
  <changelog author="nopower@suse.com" date="1689249600">- CVE-2022-2127: lm_resp_len not checked properly in
  winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174).
- CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite
  Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173).
- CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type
  Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172).
- CVE-2023-34968: Spotlight server-side Share Path Disclosure;
  (bso#15388); (bsc#1213171).
- CVE-2023-3347: Samba doesn't require SMB2+ signing if
  `server signing = mandatory` is set; (bso#15397); (bsc#1213170).</changelog>
  <changelog author="nopower@suse.com" date="1689595200">- secure channel faulty since Windows 10/11 update 07/2023;
  (bso#15418); (bsc#1213384).</changelog>
  <changelog author="scabrero@suse.de" date="1690891200">- net ads lookup with unspecified realm fails; (bso#15384);
  (bsc#1213826);</changelog>
  <changelog author="scabrero@suse.de" date="1691496000">- Move libcluster-samba4.so from samba-libs to samba-client-libs;
  (bsc#1213940);</changelog>
  <changelog author="scabrero@suse.de" date="1692014400">- Fix DFS not working with widelinks enabled; (bsc#1213607);
  (bso#15435);</changelog>
  <changelog author="nopower@suse.com" date="1695729600">- Update to 4.19.0
  * File doesn't show when user doesn't have permission if
    aio_pthread is loaded; (bso#15453).
  * ctdb_killtcp fails to work with --enable-pcap and libpcap ≥
    1.9.1; (bso#15451).
  * Logging to stdout/stderr with DEBUG_SYSLOG_FORMAT_ALWAYS can
    log to syslog; (bso#15460).
  * ‘samba-tool domain level raise’ fails unless given a URL;
    (bso#15458).
  * reply_sesssetup_and_X() can dereference uninitialized tmp
    pointer; (bso#15420).
  * missing return in reply_exit_done(); (bso#15430).
  * TREE_CONNECT without SETUP causes smbd to use uninitialized
    pointer; (bso#15432).
  * Avoid infinite loop in initial user sync with Azure AD
    Connect when synchronising a large Samba AD domain;
    (bso#15401).
  * Samba replication logs show (null) DN; (bso#15407).
  * 2-3min delays at reconnect with
    smb2_validate_sequence_number: bad message_id 2; (bso#15346).
  * DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED can't be parsed;
    (bso#15446).
  * CID 1539212 causes real issue when output contains only
    newlines; (bso#15438).
  * KDC encodes INT64 claims incorrectly; (bso#15452).
  * mdssvc: Do an early talloc_free() in _mdssvc_open();
    (bso#15449).
  * Windows client join fails if a second container CN=System
    exists somewhere; (bso#9959).
  * regression DFS not working with widelinks = true;
    (bso#15435).
  * Heimdal fails to build on 32-bit FreeBSD; (bso#15443).
  * samba-tool ntacl get segfault if aio_pthread appended;
    (bso#15441).
- Update to 4.18.6
  * reply_sesssetup_and_X() can dereference uninitialized tmp pointer;
    (bso#15420);
  * Missing return in reply_exit_done(); (bso#15430);
  * post-exec password redaction for samba-tool is more reliable for fully
    random passwords as it no longer uses regular expressions containing the
    password value itself; (bso#15289);
  * Windows client join fails if a second container CN=System exists somewhere;
    (bso#9959);
  * Spotlight sometimes returns no results on latest macOS; (bso#15342);
  * Renaming results in NT_STATUS_SHARING_VIOLATION if previously attempted to
    remove the destination; (bso#15417);
  * Spotlight results return wrong date in result list; (bso#15427);
  * "net offlinejoin provision" does not work as non-root user; (bso#15414);
  * rpcserver no longer accepts double backslash in dfs pathname; (bso#15400);
  * cm_prepare_connection() calls close(fd) for the second time; (bso#15433);
  * 2-3min delays at reconnect with smb2_validate_sequence_number: bad
    message_id 2; (bso#15346);
  * samba-tool ntacl get segfault if aio_pthread appended; (bso#15441);
  * DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED can't be parsed; (bso#15446);
  * Python tarfile extraction needs change to avoid a warning (CVE-2007-4559
    mitigation); (bso#15390);
  * Regression DFS not working with widelinks = true; (bso#15435);
  * mdssvc: Do an early talloc_free() in _mdssvc_open(); (bso#15449);
- Update to 4.18.5
  * CVE-2022-2127: lm_resp_len not checked properly in
    winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174).
  * CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite
    Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173).
  * CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type
    Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172).
  * CVE-2023-34968: Spotlight server-side Share Path Disclosure;
    (bso#15388); (bsc#1213171).
  * CVE-2023-3347: Samba doesn't require SMB2+ signing if
    `server signing = mandatory` is set; (bso#15397); (bsc#1213170).
  * secure channel faulty since Windows 10/11 update 07/2023;
    (bso#15418); (bsc#1213384).
- Update to 4.18.4
  * Backport --pidl-developer fixes; (bso#15404).
  * Named crashes on DLZ zone update; (bso#14030).
  * smbcacls and smbcquotas do not check // before the server;
    (bso#2312).
  * cli_list loops 100% CPU against pre-lanman2 servers;
    (bso#15382).
  * smbclient leaks fds with showacls; (bso#15391).
  * smbd returns NOT_FOUND when creating files on a r/o
    filesystem; (bso#15402).
  * NSS_WRAPPER_HOSTNAME doesn't match NSS_WRAPPER_HOSTS entry
    and causes test timeouts; (bso#15355).
  * net ads lookup (with unspecified realm) fails; (bso#15384).
  * Register Samba processes with GPFS; (bso#15381).
  * Python tarfile extraction needs change to avoid a warning
    (CVE-2007-4559 mitigation); (bso#15390).
  * The winbind child segfaults when listing users with `winbind
    scan trusted domains = yes`; (bso#15398).
  * Remove comments about deprecated 'write cache size';
    (bso#15383).
  * smbget memory leak if failed to download files recursively;
    (bso#15403).
- Update to 4.18.3
  * Symlinks to files can have random DOS mode information in a
    directory listing; (bso#15375).
  * vfs_fruit might cause a failing open for delete; (bso#15378).
  * winbind recurses into itself via rpcd_lsad; (bso#15361).
  * wbinfo -u fails on ad dc with &gt;1000 users; (bso#15366).
  * DS ACEs might be inherited to unrelated object classes;
    (bso#15338).
  * a lot of messages: get_static_share_mode_data:
    get_static_share_mode_data_fn failed: NT_STATUS_NOT_FOUND;
    (bso#15362).
  * aes256 smb3 encryption algorithms are not allowed in
    smb3_sid_parse(); (bso#15374).
  * Setting veto files = /.*/ break listing directories;
    (bso#15360).
  * "samba-tool domain provision" does not run interactive mode
    if no arguments are given; (bso#15363).
  * dsgetdcname: assumes local system uses IPv4; (bso#15325).
- Update to 4.18.2
  * Log flood: smbd_calculate_access_mask_fsp: Access denied:
    message level should be lower; (bso#15302).
  * Floating point exception (FPE) via cli_pull_send at
    source3/libsmb/clireadwrite.c; (bso#15306).
  * test_tstream_more_tcp_user_timeout_spin fails intermittently
    on Rackspace GitLab runners; (bso#15328).
  * Reduce flapping of ridalloc test; (bso#15329).
  * large_ldap test is unreliable; (bso#15351).
  * New filename parser doesn't check veto files smb.conf
    parameter; (bso#15143).
  * mdssvc may crash when initializing; (bso#15354).
  * large directory optimization broken for non-lcomp path
    elements; (bso#15313).
  * streams_depot fails to create streams; (bso#15357).
  * shadow_copy2 and streams_depot don't play well together;
    (bso#15358).
  * Flapping tests in samba_tool_drs_show_repl.py; (bso#15316).
  * winbindd idmap child contacts the domain controller without a
    need; (bso#15317).
  * idmap_autorid may fail to map sids of trusted domains for the
    first time; (bso#15318).
  * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings;
    (bso#15319).
  * net ads search -P doesn't work against servers in other
    domains; (bso#15323).
  * Temporary smbXsrv_tcon_global.tdb can't be parsed;
    (bso#15353).
  * Tests use depricated and removed methods like
    assertRegexpMatches; (bso#15343).
- Update to 4.18.1
  * CVE-2023-0225: AD DC "dnsHostname" attribute can be
    deleted by unprivileged authenticated users.
    (bso#15276);(bsc#1209483).
  * CVE-2023-0614: Access controlled AD LDAP attributes can be
    discovered  (bso#15270); (bsc#1209485).
  * CVE-2023-0922: Samba AD DC admin tool samba-tool sends
    passwords in cleartext(bso#15315);(bsc#1209481).
  * ldb wildcard matching makes excessive allocations;
    (bso#15331).
  * large_ldap test is inefficient; (bso#15332).
- Update to 4.18.0
  * SMB server performance improvements
  * More succinct samba-tool error messages
  * Color output with samba-tool --color
    The NO_COLOR environment variable will disable colour output
  * New samba-tool dsacl subcommand for deleting ACEs
  * New wbinfo option --change-secret-at
  * Net option to change the NT ACL default location
  * Azure AD / Office365 synchronization improvements</changelog>
  <changelog author="nopower@suse.com" date="1696939200">- CVE-2023-4091: samba: Client can truncate file with read-only
  permissions; (bsc#1215904); (bso#15439).
- CVE-2023-42669: samba: rpcecho, enabled and running in AD DC,
  allows blocking sleep on request; (bso#1215905); (bso#15474).
- CVE-2023-42670: samba:  The procedure number is out of range
  when starting Active Directory Users and Computers;
  (bsc#1215906); (bso#15473).
- CVE-2023-3961: samba: Unsanitized client pipe name passed to
  local_np_connect(); (bsc#1215907); (bso#15422).
- CVE-2023-4154: samba: dirsync allows SYSTEM access with only
  "GUID_DRS_GET_CHANGES" right, not "GUID_DRS_GET_ALL_CHANGES;
  (bsc#1215908); (bso#15424).</changelog>
  <changelog author="nopower@suse.com" date="1697112000">- use systemd-logind rather than utmp for y2038 safety;
  (bsc#1216159).</changelog>
  <changelog author="nopower@suse.com" date="1697457600">- Update to 4.19.2
  * Use-after-free in aio_del_req_from_fsp during smbd shutdown
    after failed IPC FSCTL_PIPE_TRANSCEIVE; (bso#15423).
  * clidfs.c do_connect() missing a "return" after a
    cli_shutdown() call; (bso#15426).
  * macOS mdfind returns only 50 results; (bso#15463).
  * GETREALFILENAME_CACHE can modify incoming new filename with
    previous cache entry value; (bso#15481).
  * libnss_winbind causes memory corruption since samba-4.18,
    impacts sendmail, zabbix, potentially more; (bso#15464).
  * ctdbd: setproctitle not initialized messages flooding logs;
    (bso#15479).
  * CVE-2023-5568 Heap buffer overflow with freshness tokens in
    the Heimdal KDC in Samba 4.19; (bso#15491).
  * The heimdal KDC doesn't detect s4u2self correctly when fast
    is in use; (bso#15477).</changelog>
  <changelog author="dmulder@suse.com" date="1698062400">- packaging: samba-tool domain provision requires python3-Markdown;
  (bsc#1216519).</changelog>
  <changelog author="nopower@suse.com" date="1701086400">- Update to 4.19.3
  * sid_strings test broken by unix epoch &gt; 1700000000;
    (bso#15520).
  * smbd crashes if asked to return full information on close of
    a stream handle with delete on close disposition set;
    (bso#15487).
  * smbd: fix close order of base_fsp and stream_fsp in
    smb_fname_fsp_destructor(); (bso#15521).
  * Improve logging for failover scenarios; (bso#15499).
  * Files without "read attributes" NFS4 ACL permission are not
    listed in directories; (bso#15093).
  * CVE-2018-14628 [SECURITY] Deleted Object tombstones visible
    in AD LDAP to normal users; (bso#13595).
  * Kerberos TGS-REQ with User2User does not work for normal
    accounts; (bso#15492).
  * vfs_gpfs stat calls fail due to file system permissions;
    (bso#15507).
  * Samba doesn't build with Python 3.12; (bso#15513).</changelog>
  <changelog author="nopower@suse.com" date="1704801600">- Update to 4.19.4
  * net changesecretpw cannot set the machine account password if
    secrets.tdb is empty; (bso#13577).
  * For generating doc, take, if defined, env XML_CATALOG_FILES;
    (bso#15540).
  * Trivial C typo in nsswitch/winbind_nss_netbsd.c; (bso#15541).
  * vfs_linux_xfs is incorrectly named; (bso#15542).
  * systemd stumbled over copyright-message at smbd startup;
    (bso#15377).
  * Following intermediate abolute share-local symlinks is
    broken; (bso#15505).
  * ctdb RELEASE_IP causes a crash in release_ip if a connection
    to a non-public address disconnects first; (bso#15523).
  * shadow_copy2 broken when current fileset's directories are
    removed; (bso#15544).
  * smbd does not detect ctdb public ipv6 addresses for
    multichannel exclusion; (bso#15534).
  * 'force user = localunixuser' doesn't work if 'allow trusted
    domains = no' is set; (bso#15469).
  * smbget debug logging doesn't work; (bso#15525).
  * smget: username in the smburl and interactive password entry
    doesn't work; (bso#15532).
  * smbget auth function doesn't set values for password prompt
    correctly; (bso#15538).
  * Unable to copy and write files from clients to Ceph cluster
    via SMB Linux gateway with Ceph VFS module; (bso#15440).
  * Multichannel refresh network information; (bso#15547).</changelog>
  <changelog author="nopower@suse.com" date="1704888000">- Remove -x from bash shebang update-apparmor-samba-profile;
  (bsc#1218431).</changelog>
  <changelog author="nopower@suse.com" date="1708430400">- Update to 4.19.5
  * Windows 2016 fails to restore previous version of a file from
    a shadow_copy2 snapshot; (bso#13688).
  * Symlinks on AIX are broken in 4.19 (and a few version before
    that); (bso#15549).
  * Fake directory create times has no effect; (bso#12421).
  * ctime mixed up with mtime by smbd; (bso#15550).
  * samba-gpupdate --rsop fails if machine is not in a site;
    (bso#15548).
  * gpupdate: The root cert import when NDES is not available is
    broken; (bso#15557).
  * samba-gpupdate should print a useful message if cepces-submit
    can't be found; (bso#15552).
  * samba-gpupdate logging doesn't work; (bso#15558).
  * smbpasswd reset permissions only if not 0600; (bso#15555).</changelog>
  <changelog author="nopower@suse.com" date="1718884800">- Update to 4.19.7
  * ldb qsort might r/w out of bounds with an intransitive
    compare function (ldb 2.8.1 is already released);
    (bso#15569).
  * Many qsort() comparison functions are non-transitive, which
    can lead to out-of-bounds access in some circumstances (ldb
    2.8.1 is already released); (bso#15625).
  * Need to change gitlab-ci.yml tags in all branches to avoid CI
    bill; (bso#15638).
  * netr_LogonSamLogonEx returns NR_STATUS_ACCESS_DENIED with
    SysvolReady=0; (bso#14981).
  * Anonymous smb3 signing/encryption should be allowed (similar
    to Windows Server 2022); (bso#15412).
  * Panic in dreplsrv_op_pull_source_apply_changes_trigger;
    (bso#15573).
  * winbindd, net ads join and other things don't work on an ipv6
    only host; (bso#15642).
  * Smbcacls incorrectly propagates inheritance with Inherit-Only
    flag; (bso#15636).
  * http library doesn't support  'chunked transfer encoding';
    (bso#15611).
- Update to 4.19.6
  * fd_handle_destructor() panics within an smbd_smb2_close() if
    vfs_stat_fsp() fails in fd_close(); (bso#15527).
  * samba-gpupdate: Correctly implement site support;
    (bso#15588).
  * libgpo: Segfault in python bindings; (bso#15599).
  * Packet marshalling push support missing for
    CTDB_CONTROL_TCP_CLIENT_DISCONNECTED and
    CTDB_CONTROL_TCP_CLIENT_PASSED; (bso#15580).</changelog>
  <changelog author="scabrero@suse.de" date="1722513600">- Fix a crash when joining offline and 'kerberos method' includes
  keytab; (bsc#1228732);
- Fix reading the password from STDIN or environment vars if it
  was already given in the command line; (bsc#1228732);</changelog>
</package>
<package pkgid="846e7ee97dadd881f0351fb99ae67a4fbee90898cf9b6af63869b9683ce4179f" name="ctdb" arch="ppc64le">
  <version epoch="0" ver="4.19.7+git.357.1d7950ebd62" rel="150600.3.3.2"/>
  <changelog author="nopower@suse.com" date="1679745600">- Make (32bit) samba-libs conflict with old samba-ad-dc-libs
  package to satisfy installcheck.</changelog>
  <changelog author="nopower@suse.com" date="1681300800">- Update to 4.17.7
  * CVE-2023-0922: Samba AD DC admin tool samba-tool sends passwords
    in cleartext; (bso#15315); (bsc#1209481).
  * CVE-2023-0225: Samba AD DC "dnsHostname" attribute can be
    deleted by unprivileged authenticated users; (bso#15276);
    (bsc#1209483).
  * CVE-2023-0614: samba: Access controlled AD LDAP attributes can
    be discovered; (bso#15270); (bsc#1209485).
  * large_ldap test is inefficient; (bso#15332).
  * CVE-2020-25720 [SECURITY] Create Child permission should not
    allow full write to all attributes (additional changes);
    (bso#14810).
- Update to 4.17.6
  * streams_xattr is creating unexpected locks on folders;
    (bso#15314).
  * Use of the Azure AD Connect cloud sync tool is now supported
    for password hash synchronisation, allowing Samba AD Domains
    to synchronise passwords with this popular cloud environment;
    (bso#10635).
  * Spotlight doesn't work with latest macOS Ventura;
    (bso#15299).
  * New samba-dcerpc architecture does not scale gracefully;
    (bso#15310).
  * vfs_ceph incorrectly uses fsp_get_io_fd() instead of
    fsp_get_pathref_fd() in close and fstat; (bso#15307).
  * With clustering enabled samba-bgqd can core dump due to use
    after free; (bso#15293).
  * fd_load() function implicitly closes the fd where it should
    not; (bso#15311).
- Update to 4.17.5
  * smbc_getxattr() return value is incorrect; (bso#14808).
  * Compound SMB2 FLUSH+CLOSE requests from MacOSX are not
    handled correctly; (bso#15172).
  * synthetic_pathref AFP_AfpInfo failed errors; (bso#15210).
  * samba-tool gpo listall fails IPv6 only - finddcs() fails to
    find DC when there is only an AAAA record for the DC in DNS;
    (bso#15226).
  * smbd crashes if an FSCTL request is done on a stream handle;
    (bso#15236).
  * DFS links don't work anymore on Mac clients since 4.17;
    (bso#15277).
  * vfs_virusfilter segfault on access, directory edgecase
    (accessing NULL value); (bso#15283).
  * CVE-2022-38023 [SECURITY] Samba should refuse RC4 (aka md5)
    based SChannel on NETLOGON (additional changes); (bso#15240).
  * %U for include directive doesn't work for share listing
    (netshareenum); (bso#15243).
  * Shares missing from netshareenum response in samba 4.17.4;
    (bso#15266).
  * ctdb: use-after-free in run_proc; (bso#15269).
  * irpc_destructor may crash during shutdown; (bso#15280).
  * auth3_generate_session_info_pac leaks wbcAuthUserInfo;
    (bso#15286).
  * smbclient segfaults with use after free on an optimized
    build; (bso#15268).
  * smbstatus leaking files in msg.sock and msg.lock;
    (bso#15282).
  * Leak in wbcCtxPingDc2; (bso#15164).
  * Access based share enum does not work in Samba 4.16+;
    (bso#15265).
  * Crash during share enumeration; (bso#15267).
  * rep_listxattr on FreeBSD does not properly check for reads
    off end of returned buffer; (bso#15271).
  * Avoid relying on C89 features in a few places; (bso#15281).</changelog>
  <changelog author="nopower@suse.com" date="1686830400">- Update to 4.17.8
  * log flood: smbd_calculate_access_mask_fsp: Access denied:
    message level should be lower; (bso#15302).
  * Floating point exception (FPE) via cli_pull_send at
    source3/libsmb/clireadwrite.c; (bso#15306).
  * test_tstream_more_tcp_user_timeout_spin fails intermittently
    on Rackspace GitLab runners; (bso#15328).
  * Reduce flapping of ridalloc test; (bso#15329).
  * large_ldap test is unreliable; (bso#15351).
  * New filename parser doesn't check veto files smb.conf
    parameter; (bso#15143).
  * mdssvc may crash when initializing; (bso#15354).
  * Large directory optimization broken for non-lcomp path
    elements; (bso#15313).
  * streams_depot fails to create streams; (bso#15357).
  * shadow_copy2 and streams_depot don't play well together;
    (bso#15358).
  * wbinfo -u fails on ad dc with &gt;1000 users; (bso#15366).
  * winbindd idmap child contacts the domain controller without a
    need; (bso#15317).
  * idmap_autorid may fail to map sids of trusted domains for the
    first time; (bso#15318).
  * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings;
    (bso#15319).
  * net ads search -P doesn't work against servers in other
    domains; (bso#15323).
  * DS ACEs might be inherited to unrelated object classes;
    (bso#15338).
  * Temporary smbXsrv_tcon_global.tdb can't be parsed;
    (bso#15353).
  * Setting veto files = /.*/ break listing directories;
    (bso#15360); (bsc#1212375).
  * CVE-2020-25720 [SECURITY] Create Child permission should not
    allow full write to all attributes (additional changes);
    (bso#14810).
  * dsgetdcname: assumes local system uses IPv4; (bso#15325).</changelog>
  <changelog author="nopower@suse.com" date="1688644800">- Update to 4.17.9
  * Backport --pidl-developer fixes; (bso#15404).
  * smbd_scavenger crashes when service smbd is stopped;
    (bso#15275).
  * vfs_fruit might cause a failing open for delete; (bso#15378).
  * named crashes on DLZ zone update; (bso#14030).
  * winbind recurses into itself via rpcd_lsad; (bso#15361).
  * cli_list loops 100% CPU against pre-lanman2 servers;
    (bso#15382).
  * smbclient leaks fds with showacls; (bso#15391).
  * aes256 smb3 encryption algorithms are not allowed in
    smb3_sid_parse(); (bso#15374).
  * winbindd gets stuck on NT_STATUS_RPC_SEC_PKG_ERROR;
    (bso#15413).
  * smbget memory leak if failed to download files recursively;
    (bso#15403).</changelog>
  <changelog author="nopower@suse.com" date="1689249600">- CVE-2022-2127: lm_resp_len not checked properly in
  winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174).
- CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite
  Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173).
- CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type
  Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172).
- CVE-2023-34968: Spotlight server-side Share Path Disclosure;
  (bso#15388); (bsc#1213171).
- CVE-2023-3347: Samba doesn't require SMB2+ signing if
  `server signing = mandatory` is set; (bso#15397); (bsc#1213170).</changelog>
  <changelog author="nopower@suse.com" date="1689595200">- secure channel faulty since Windows 10/11 update 07/2023;
  (bso#15418); (bsc#1213384).</changelog>
  <changelog author="scabrero@suse.de" date="1690891200">- net ads lookup with unspecified realm fails; (bso#15384);
  (bsc#1213826);</changelog>
  <changelog author="scabrero@suse.de" date="1691496000">- Move libcluster-samba4.so from samba-libs to samba-client-libs;
  (bsc#1213940);</changelog>
  <changelog author="scabrero@suse.de" date="1692014400">- Fix DFS not working with widelinks enabled; (bsc#1213607);
  (bso#15435);</changelog>
  <changelog author="nopower@suse.com" date="1695729600">- Update to 4.19.0
  * File doesn't show when user doesn't have permission if
    aio_pthread is loaded; (bso#15453).
  * ctdb_killtcp fails to work with --enable-pcap and libpcap ≥
    1.9.1; (bso#15451).
  * Logging to stdout/stderr with DEBUG_SYSLOG_FORMAT_ALWAYS can
    log to syslog; (bso#15460).
  * ‘samba-tool domain level raise’ fails unless given a URL;
    (bso#15458).
  * reply_sesssetup_and_X() can dereference uninitialized tmp
    pointer; (bso#15420).
  * missing return in reply_exit_done(); (bso#15430).
  * TREE_CONNECT without SETUP causes smbd to use uninitialized
    pointer; (bso#15432).
  * Avoid infinite loop in initial user sync with Azure AD
    Connect when synchronising a large Samba AD domain;
    (bso#15401).
  * Samba replication logs show (null) DN; (bso#15407).
  * 2-3min delays at reconnect with
    smb2_validate_sequence_number: bad message_id 2; (bso#15346).
  * DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED can't be parsed;
    (bso#15446).
  * CID 1539212 causes real issue when output contains only
    newlines; (bso#15438).
  * KDC encodes INT64 claims incorrectly; (bso#15452).
  * mdssvc: Do an early talloc_free() in _mdssvc_open();
    (bso#15449).
  * Windows client join fails if a second container CN=System
    exists somewhere; (bso#9959).
  * regression DFS not working with widelinks = true;
    (bso#15435).
  * Heimdal fails to build on 32-bit FreeBSD; (bso#15443).
  * samba-tool ntacl get segfault if aio_pthread appended;
    (bso#15441).
- Update to 4.18.6
  * reply_sesssetup_and_X() can dereference uninitialized tmp pointer;
    (bso#15420);
  * Missing return in reply_exit_done(); (bso#15430);
  * post-exec password redaction for samba-tool is more reliable for fully
    random passwords as it no longer uses regular expressions containing the
    password value itself; (bso#15289);
  * Windows client join fails if a second container CN=System exists somewhere;
    (bso#9959);
  * Spotlight sometimes returns no results on latest macOS; (bso#15342);
  * Renaming results in NT_STATUS_SHARING_VIOLATION if previously attempted to
    remove the destination; (bso#15417);
  * Spotlight results return wrong date in result list; (bso#15427);
  * "net offlinejoin provision" does not work as non-root user; (bso#15414);
  * rpcserver no longer accepts double backslash in dfs pathname; (bso#15400);
  * cm_prepare_connection() calls close(fd) for the second time; (bso#15433);
  * 2-3min delays at reconnect with smb2_validate_sequence_number: bad
    message_id 2; (bso#15346);
  * samba-tool ntacl get segfault if aio_pthread appended; (bso#15441);
  * DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED can't be parsed; (bso#15446);
  * Python tarfile extraction needs change to avoid a warning (CVE-2007-4559
    mitigation); (bso#15390);
  * Regression DFS not working with widelinks = true; (bso#15435);
  * mdssvc: Do an early talloc_free() in _mdssvc_open(); (bso#15449);
- Update to 4.18.5
  * CVE-2022-2127: lm_resp_len not checked properly in
    winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174).
  * CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite
    Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173).
  * CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type
    Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172).
  * CVE-2023-34968: Spotlight server-side Share Path Disclosure;
    (bso#15388); (bsc#1213171).
  * CVE-2023-3347: Samba doesn't require SMB2+ signing if
    `server signing = mandatory` is set; (bso#15397); (bsc#1213170).
  * secure channel faulty since Windows 10/11 update 07/2023;
    (bso#15418); (bsc#1213384).
- Update to 4.18.4
  * Backport --pidl-developer fixes; (bso#15404).
  * Named crashes on DLZ zone update; (bso#14030).
  * smbcacls and smbcquotas do not check // before the server;
    (bso#2312).
  * cli_list loops 100% CPU against pre-lanman2 servers;
    (bso#15382).
  * smbclient leaks fds with showacls; (bso#15391).
  * smbd returns NOT_FOUND when creating files on a r/o
    filesystem; (bso#15402).
  * NSS_WRAPPER_HOSTNAME doesn't match NSS_WRAPPER_HOSTS entry
    and causes test timeouts; (bso#15355).
  * net ads lookup (with unspecified realm) fails; (bso#15384).
  * Register Samba processes with GPFS; (bso#15381).
  * Python tarfile extraction needs change to avoid a warning
    (CVE-2007-4559 mitigation); (bso#15390).
  * The winbind child segfaults when listing users with `winbind
    scan trusted domains = yes`; (bso#15398).
  * Remove comments about deprecated 'write cache size';
    (bso#15383).
  * smbget memory leak if failed to download files recursively;
    (bso#15403).
- Update to 4.18.3
  * Symlinks to files can have random DOS mode information in a
    directory listing; (bso#15375).
  * vfs_fruit might cause a failing open for delete; (bso#15378).
  * winbind recurses into itself via rpcd_lsad; (bso#15361).
  * wbinfo -u fails on ad dc with &gt;1000 users; (bso#15366).
  * DS ACEs might be inherited to unrelated object classes;
    (bso#15338).
  * a lot of messages: get_static_share_mode_data:
    get_static_share_mode_data_fn failed: NT_STATUS_NOT_FOUND;
    (bso#15362).
  * aes256 smb3 encryption algorithms are not allowed in
    smb3_sid_parse(); (bso#15374).
  * Setting veto files = /.*/ break listing directories;
    (bso#15360).
  * "samba-tool domain provision" does not run interactive mode
    if no arguments are given; (bso#15363).
  * dsgetdcname: assumes local system uses IPv4; (bso#15325).
- Update to 4.18.2
  * Log flood: smbd_calculate_access_mask_fsp: Access denied:
    message level should be lower; (bso#15302).
  * Floating point exception (FPE) via cli_pull_send at
    source3/libsmb/clireadwrite.c; (bso#15306).
  * test_tstream_more_tcp_user_timeout_spin fails intermittently
    on Rackspace GitLab runners; (bso#15328).
  * Reduce flapping of ridalloc test; (bso#15329).
  * large_ldap test is unreliable; (bso#15351).
  * New filename parser doesn't check veto files smb.conf
    parameter; (bso#15143).
  * mdssvc may crash when initializing; (bso#15354).
  * large directory optimization broken for non-lcomp path
    elements; (bso#15313).
  * streams_depot fails to create streams; (bso#15357).
  * shadow_copy2 and streams_depot don't play well together;
    (bso#15358).
  * Flapping tests in samba_tool_drs_show_repl.py; (bso#15316).
  * winbindd idmap child contacts the domain controller without a
    need; (bso#15317).
  * idmap_autorid may fail to map sids of trusted domains for the
    first time; (bso#15318).
  * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings;
    (bso#15319).
  * net ads search -P doesn't work against servers in other
    domains; (bso#15323).
  * Temporary smbXsrv_tcon_global.tdb can't be parsed;
    (bso#15353).
  * Tests use depricated and removed methods like
    assertRegexpMatches; (bso#15343).
- Update to 4.18.1
  * CVE-2023-0225: AD DC "dnsHostname" attribute can be
    deleted by unprivileged authenticated users.
    (bso#15276);(bsc#1209483).
  * CVE-2023-0614: Access controlled AD LDAP attributes can be
    discovered  (bso#15270); (bsc#1209485).
  * CVE-2023-0922: Samba AD DC admin tool samba-tool sends
    passwords in cleartext(bso#15315);(bsc#1209481).
  * ldb wildcard matching makes excessive allocations;
    (bso#15331).
  * large_ldap test is inefficient; (bso#15332).
- Update to 4.18.0
  * SMB server performance improvements
  * More succinct samba-tool error messages
  * Color output with samba-tool --color
    The NO_COLOR environment variable will disable colour output
  * New samba-tool dsacl subcommand for deleting ACEs
  * New wbinfo option --change-secret-at
  * Net option to change the NT ACL default location
  * Azure AD / Office365 synchronization improvements</changelog>
  <changelog author="nopower@suse.com" date="1696939200">- CVE-2023-4091: samba: Client can truncate file with read-only
  permissions; (bsc#1215904); (bso#15439).
- CVE-2023-42669: samba: rpcecho, enabled and running in AD DC,
  allows blocking sleep on request; (bso#1215905); (bso#15474).
- CVE-2023-42670: samba:  The procedure number is out of range
  when starting Active Directory Users and Computers;
  (bsc#1215906); (bso#15473).
- CVE-2023-3961: samba: Unsanitized client pipe name passed to
  local_np_connect(); (bsc#1215907); (bso#15422).
- CVE-2023-4154: samba: dirsync allows SYSTEM access with only
  "GUID_DRS_GET_CHANGES" right, not "GUID_DRS_GET_ALL_CHANGES;
  (bsc#1215908); (bso#15424).</changelog>
  <changelog author="nopower@suse.com" date="1697112000">- use systemd-logind rather than utmp for y2038 safety;
  (bsc#1216159).</changelog>
  <changelog author="nopower@suse.com" date="1697457600">- Update to 4.19.2
  * Use-after-free in aio_del_req_from_fsp during smbd shutdown
    after failed IPC FSCTL_PIPE_TRANSCEIVE; (bso#15423).
  * clidfs.c do_connect() missing a "return" after a
    cli_shutdown() call; (bso#15426).
  * macOS mdfind returns only 50 results; (bso#15463).
  * GETREALFILENAME_CACHE can modify incoming new filename with
    previous cache entry value; (bso#15481).
  * libnss_winbind causes memory corruption since samba-4.18,
    impacts sendmail, zabbix, potentially more; (bso#15464).
  * ctdbd: setproctitle not initialized messages flooding logs;
    (bso#15479).
  * CVE-2023-5568 Heap buffer overflow with freshness tokens in
    the Heimdal KDC in Samba 4.19; (bso#15491).
  * The heimdal KDC doesn't detect s4u2self correctly when fast
    is in use; (bso#15477).</changelog>
  <changelog author="dmulder@suse.com" date="1698062400">- packaging: samba-tool domain provision requires python3-Markdown;
  (bsc#1216519).</changelog>
  <changelog author="nopower@suse.com" date="1701086400">- Update to 4.19.3
  * sid_strings test broken by unix epoch &gt; 1700000000;
    (bso#15520).
  * smbd crashes if asked to return full information on close of
    a stream handle with delete on close disposition set;
    (bso#15487).
  * smbd: fix close order of base_fsp and stream_fsp in
    smb_fname_fsp_destructor(); (bso#15521).
  * Improve logging for failover scenarios; (bso#15499).
  * Files without "read attributes" NFS4 ACL permission are not
    listed in directories; (bso#15093).
  * CVE-2018-14628 [SECURITY] Deleted Object tombstones visible
    in AD LDAP to normal users; (bso#13595).
  * Kerberos TGS-REQ with User2User does not work for normal
    accounts; (bso#15492).
  * vfs_gpfs stat calls fail due to file system permissions;
    (bso#15507).
  * Samba doesn't build with Python 3.12; (bso#15513).</changelog>
  <changelog author="nopower@suse.com" date="1704801600">- Update to 4.19.4
  * net changesecretpw cannot set the machine account password if
    secrets.tdb is empty; (bso#13577).
  * For generating doc, take, if defined, env XML_CATALOG_FILES;
    (bso#15540).
  * Trivial C typo in nsswitch/winbind_nss_netbsd.c; (bso#15541).
  * vfs_linux_xfs is incorrectly named; (bso#15542).
  * systemd stumbled over copyright-message at smbd startup;
    (bso#15377).
  * Following intermediate abolute share-local symlinks is
    broken; (bso#15505).
  * ctdb RELEASE_IP causes a crash in release_ip if a connection
    to a non-public address disconnects first; (bso#15523).
  * shadow_copy2 broken when current fileset's directories are
    removed; (bso#15544).
  * smbd does not detect ctdb public ipv6 addresses for
    multichannel exclusion; (bso#15534).
  * 'force user = localunixuser' doesn't work if 'allow trusted
    domains = no' is set; (bso#15469).
  * smbget debug logging doesn't work; (bso#15525).
  * smget: username in the smburl and interactive password entry
    doesn't work; (bso#15532).
  * smbget auth function doesn't set values for password prompt
    correctly; (bso#15538).
  * Unable to copy and write files from clients to Ceph cluster
    via SMB Linux gateway with Ceph VFS module; (bso#15440).
  * Multichannel refresh network information; (bso#15547).</changelog>
  <changelog author="nopower@suse.com" date="1704888000">- Remove -x from bash shebang update-apparmor-samba-profile;
  (bsc#1218431).</changelog>
  <changelog author="nopower@suse.com" date="1708430400">- Update to 4.19.5
  * Windows 2016 fails to restore previous version of a file from
    a shadow_copy2 snapshot; (bso#13688).
  * Symlinks on AIX are broken in 4.19 (and a few version before
    that); (bso#15549).
  * Fake directory create times has no effect; (bso#12421).
  * ctime mixed up with mtime by smbd; (bso#15550).
  * samba-gpupdate --rsop fails if machine is not in a site;
    (bso#15548).
  * gpupdate: The root cert import when NDES is not available is
    broken; (bso#15557).
  * samba-gpupdate should print a useful message if cepces-submit
    can't be found; (bso#15552).
  * samba-gpupdate logging doesn't work; (bso#15558).
  * smbpasswd reset permissions only if not 0600; (bso#15555).</changelog>
  <changelog author="nopower@suse.com" date="1718884800">- Update to 4.19.7
  * ldb qsort might r/w out of bounds with an intransitive
    compare function (ldb 2.8.1 is already released);
    (bso#15569).
  * Many qsort() comparison functions are non-transitive, which
    can lead to out-of-bounds access in some circumstances (ldb
    2.8.1 is already released); (bso#15625).
  * Need to change gitlab-ci.yml tags in all branches to avoid CI
    bill; (bso#15638).
  * netr_LogonSamLogonEx returns NR_STATUS_ACCESS_DENIED with
    SysvolReady=0; (bso#14981).
  * Anonymous smb3 signing/encryption should be allowed (similar
    to Windows Server 2022); (bso#15412).
  * Panic in dreplsrv_op_pull_source_apply_changes_trigger;
    (bso#15573).
  * winbindd, net ads join and other things don't work on an ipv6
    only host; (bso#15642).
  * Smbcacls incorrectly propagates inheritance with Inherit-Only
    flag; (bso#15636).
  * http library doesn't support  'chunked transfer encoding';
    (bso#15611).
- Update to 4.19.6
  * fd_handle_destructor() panics within an smbd_smb2_close() if
    vfs_stat_fsp() fails in fd_close(); (bso#15527).
  * samba-gpupdate: Correctly implement site support;
    (bso#15588).
  * libgpo: Segfault in python bindings; (bso#15599).
  * Packet marshalling push support missing for
    CTDB_CONTROL_TCP_CLIENT_DISCONNECTED and
    CTDB_CONTROL_TCP_CLIENT_PASSED; (bso#15580).</changelog>
  <changelog author="scabrero@suse.de" date="1722513600">- Fix a crash when joining offline and 'kerberos method' includes
  keytab; (bsc#1228732);
- Fix reading the password from STDIN or environment vars if it
  was already given in the command line; (bsc#1228732);</changelog>
</package>
<package pkgid="e75c15bcee90e5c823bba958494518b9633d425ff840b8188de71bc435c1d4a9" name="ctdb" arch="s390x">
  <version epoch="0" ver="4.19.7+git.357.1d7950ebd62" rel="150600.3.3.2"/>
  <changelog author="nopower@suse.com" date="1679745600">- Make (32bit) samba-libs conflict with old samba-ad-dc-libs
  package to satisfy installcheck.</changelog>
  <changelog author="nopower@suse.com" date="1681300800">- Update to 4.17.7
  * CVE-2023-0922: Samba AD DC admin tool samba-tool sends passwords
    in cleartext; (bso#15315); (bsc#1209481).
  * CVE-2023-0225: Samba AD DC "dnsHostname" attribute can be
    deleted by unprivileged authenticated users; (bso#15276);
    (bsc#1209483).
  * CVE-2023-0614: samba: Access controlled AD LDAP attributes can
    be discovered; (bso#15270); (bsc#1209485).
  * large_ldap test is inefficient; (bso#15332).
  * CVE-2020-25720 [SECURITY] Create Child permission should not
    allow full write to all attributes (additional changes);
    (bso#14810).
- Update to 4.17.6
  * streams_xattr is creating unexpected locks on folders;
    (bso#15314).
  * Use of the Azure AD Connect cloud sync tool is now supported
    for password hash synchronisation, allowing Samba AD Domains
    to synchronise passwords with this popular cloud environment;
    (bso#10635).
  * Spotlight doesn't work with latest macOS Ventura;
    (bso#15299).
  * New samba-dcerpc architecture does not scale gracefully;
    (bso#15310).
  * vfs_ceph incorrectly uses fsp_get_io_fd() instead of
    fsp_get_pathref_fd() in close and fstat; (bso#15307).
  * With clustering enabled samba-bgqd can core dump due to use
    after free; (bso#15293).
  * fd_load() function implicitly closes the fd where it should
    not; (bso#15311).
- Update to 4.17.5
  * smbc_getxattr() return value is incorrect; (bso#14808).
  * Compound SMB2 FLUSH+CLOSE requests from MacOSX are not
    handled correctly; (bso#15172).
  * synthetic_pathref AFP_AfpInfo failed errors; (bso#15210).
  * samba-tool gpo listall fails IPv6 only - finddcs() fails to
    find DC when there is only an AAAA record for the DC in DNS;
    (bso#15226).
  * smbd crashes if an FSCTL request is done on a stream handle;
    (bso#15236).
  * DFS links don't work anymore on Mac clients since 4.17;
    (bso#15277).
  * vfs_virusfilter segfault on access, directory edgecase
    (accessing NULL value); (bso#15283).
  * CVE-2022-38023 [SECURITY] Samba should refuse RC4 (aka md5)
    based SChannel on NETLOGON (additional changes); (bso#15240).
  * %U for include directive doesn't work for share listing
    (netshareenum); (bso#15243).
  * Shares missing from netshareenum response in samba 4.17.4;
    (bso#15266).
  * ctdb: use-after-free in run_proc; (bso#15269).
  * irpc_destructor may crash during shutdown; (bso#15280).
  * auth3_generate_session_info_pac leaks wbcAuthUserInfo;
    (bso#15286).
  * smbclient segfaults with use after free on an optimized
    build; (bso#15268).
  * smbstatus leaking files in msg.sock and msg.lock;
    (bso#15282).
  * Leak in wbcCtxPingDc2; (bso#15164).
  * Access based share enum does not work in Samba 4.16+;
    (bso#15265).
  * Crash during share enumeration; (bso#15267).
  * rep_listxattr on FreeBSD does not properly check for reads
    off end of returned buffer; (bso#15271).
  * Avoid relying on C89 features in a few places; (bso#15281).</changelog>
  <changelog author="nopower@suse.com" date="1686830400">- Update to 4.17.8
  * log flood: smbd_calculate_access_mask_fsp: Access denied:
    message level should be lower; (bso#15302).
  * Floating point exception (FPE) via cli_pull_send at
    source3/libsmb/clireadwrite.c; (bso#15306).
  * test_tstream_more_tcp_user_timeout_spin fails intermittently
    on Rackspace GitLab runners; (bso#15328).
  * Reduce flapping of ridalloc test; (bso#15329).
  * large_ldap test is unreliable; (bso#15351).
  * New filename parser doesn't check veto files smb.conf
    parameter; (bso#15143).
  * mdssvc may crash when initializing; (bso#15354).
  * Large directory optimization broken for non-lcomp path
    elements; (bso#15313).
  * streams_depot fails to create streams; (bso#15357).
  * shadow_copy2 and streams_depot don't play well together;
    (bso#15358).
  * wbinfo -u fails on ad dc with &gt;1000 users; (bso#15366).
  * winbindd idmap child contacts the domain controller without a
    need; (bso#15317).
  * idmap_autorid may fail to map sids of trusted domains for the
    first time; (bso#15318).
  * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings;
    (bso#15319).
  * net ads search -P doesn't work against servers in other
    domains; (bso#15323).
  * DS ACEs might be inherited to unrelated object classes;
    (bso#15338).
  * Temporary smbXsrv_tcon_global.tdb can't be parsed;
    (bso#15353).
  * Setting veto files = /.*/ break listing directories;
    (bso#15360); (bsc#1212375).
  * CVE-2020-25720 [SECURITY] Create Child permission should not
    allow full write to all attributes (additional changes);
    (bso#14810).
  * dsgetdcname: assumes local system uses IPv4; (bso#15325).</changelog>
  <changelog author="nopower@suse.com" date="1688644800">- Update to 4.17.9
  * Backport --pidl-developer fixes; (bso#15404).
  * smbd_scavenger crashes when service smbd is stopped;
    (bso#15275).
  * vfs_fruit might cause a failing open for delete; (bso#15378).
  * named crashes on DLZ zone update; (bso#14030).
  * winbind recurses into itself via rpcd_lsad; (bso#15361).
  * cli_list loops 100% CPU against pre-lanman2 servers;
    (bso#15382).
  * smbclient leaks fds with showacls; (bso#15391).
  * aes256 smb3 encryption algorithms are not allowed in
    smb3_sid_parse(); (bso#15374).
  * winbindd gets stuck on NT_STATUS_RPC_SEC_PKG_ERROR;
    (bso#15413).
  * smbget memory leak if failed to download files recursively;
    (bso#15403).</changelog>
  <changelog author="nopower@suse.com" date="1689249600">- CVE-2022-2127: lm_resp_len not checked properly in
  winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174).
- CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite
  Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173).
- CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type
  Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172).
- CVE-2023-34968: Spotlight server-side Share Path Disclosure;
  (bso#15388); (bsc#1213171).
- CVE-2023-3347: Samba doesn't require SMB2+ signing if
  `server signing = mandatory` is set; (bso#15397); (bsc#1213170).</changelog>
  <changelog author="nopower@suse.com" date="1689595200">- secure channel faulty since Windows 10/11 update 07/2023;
  (bso#15418); (bsc#1213384).</changelog>
  <changelog author="scabrero@suse.de" date="1690891200">- net ads lookup with unspecified realm fails; (bso#15384);
  (bsc#1213826);</changelog>
  <changelog author="scabrero@suse.de" date="1691496000">- Move libcluster-samba4.so from samba-libs to samba-client-libs;
  (bsc#1213940);</changelog>
  <changelog author="scabrero@suse.de" date="1692014400">- Fix DFS not working with widelinks enabled; (bsc#1213607);
  (bso#15435);</changelog>
  <changelog author="nopower@suse.com" date="1695729600">- Update to 4.19.0
  * File doesn't show when user doesn't have permission if
    aio_pthread is loaded; (bso#15453).
  * ctdb_killtcp fails to work with --enable-pcap and libpcap ≥
    1.9.1; (bso#15451).
  * Logging to stdout/stderr with DEBUG_SYSLOG_FORMAT_ALWAYS can
    log to syslog; (bso#15460).
  * ‘samba-tool domain level raise’ fails unless given a URL;
    (bso#15458).
  * reply_sesssetup_and_X() can dereference uninitialized tmp
    pointer; (bso#15420).
  * missing return in reply_exit_done(); (bso#15430).
  * TREE_CONNECT without SETUP causes smbd to use uninitialized
    pointer; (bso#15432).
  * Avoid infinite loop in initial user sync with Azure AD
    Connect when synchronising a large Samba AD domain;
    (bso#15401).
  * Samba replication logs show (null) DN; (bso#15407).
  * 2-3min delays at reconnect with
    smb2_validate_sequence_number: bad message_id 2; (bso#15346).
  * DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED can't be parsed;
    (bso#15446).
  * CID 1539212 causes real issue when output contains only
    newlines; (bso#15438).
  * KDC encodes INT64 claims incorrectly; (bso#15452).
  * mdssvc: Do an early talloc_free() in _mdssvc_open();
    (bso#15449).
  * Windows client join fails if a second container CN=System
    exists somewhere; (bso#9959).
  * regression DFS not working with widelinks = true;
    (bso#15435).
  * Heimdal fails to build on 32-bit FreeBSD; (bso#15443).
  * samba-tool ntacl get segfault if aio_pthread appended;
    (bso#15441).
- Update to 4.18.6
  * reply_sesssetup_and_X() can dereference uninitialized tmp pointer;
    (bso#15420);
  * Missing return in reply_exit_done(); (bso#15430);
  * post-exec password redaction for samba-tool is more reliable for fully
    random passwords as it no longer uses regular expressions containing the
    password value itself; (bso#15289);
  * Windows client join fails if a second container CN=System exists somewhere;
    (bso#9959);
  * Spotlight sometimes returns no results on latest macOS; (bso#15342);
  * Renaming results in NT_STATUS_SHARING_VIOLATION if previously attempted to
    remove the destination; (bso#15417);
  * Spotlight results return wrong date in result list; (bso#15427);
  * "net offlinejoin provision" does not work as non-root user; (bso#15414);
  * rpcserver no longer accepts double backslash in dfs pathname; (bso#15400);
  * cm_prepare_connection() calls close(fd) for the second time; (bso#15433);
  * 2-3min delays at reconnect with smb2_validate_sequence_number: bad
    message_id 2; (bso#15346);
  * samba-tool ntacl get segfault if aio_pthread appended; (bso#15441);
  * DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED can't be parsed; (bso#15446);
  * Python tarfile extraction needs change to avoid a warning (CVE-2007-4559
    mitigation); (bso#15390);
  * Regression DFS not working with widelinks = true; (bso#15435);
  * mdssvc: Do an early talloc_free() in _mdssvc_open(); (bso#15449);
- Update to 4.18.5
  * CVE-2022-2127: lm_resp_len not checked properly in
    winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174).
  * CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite
    Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173).
  * CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type
    Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172).
  * CVE-2023-34968: Spotlight server-side Share Path Disclosure;
    (bso#15388); (bsc#1213171).
  * CVE-2023-3347: Samba doesn't require SMB2+ signing if
    `server signing = mandatory` is set; (bso#15397); (bsc#1213170).
  * secure channel faulty since Windows 10/11 update 07/2023;
    (bso#15418); (bsc#1213384).
- Update to 4.18.4
  * Backport --pidl-developer fixes; (bso#15404).
  * Named crashes on DLZ zone update; (bso#14030).
  * smbcacls and smbcquotas do not check // before the server;
    (bso#2312).
  * cli_list loops 100% CPU against pre-lanman2 servers;
    (bso#15382).
  * smbclient leaks fds with showacls; (bso#15391).
  * smbd returns NOT_FOUND when creating files on a r/o
    filesystem; (bso#15402).
  * NSS_WRAPPER_HOSTNAME doesn't match NSS_WRAPPER_HOSTS entry
    and causes test timeouts; (bso#15355).
  * net ads lookup (with unspecified realm) fails; (bso#15384).
  * Register Samba processes with GPFS; (bso#15381).
  * Python tarfile extraction needs change to avoid a warning
    (CVE-2007-4559 mitigation); (bso#15390).
  * The winbind child segfaults when listing users with `winbind
    scan trusted domains = yes`; (bso#15398).
  * Remove comments about deprecated 'write cache size';
    (bso#15383).
  * smbget memory leak if failed to download files recursively;
    (bso#15403).
- Update to 4.18.3
  * Symlinks to files can have random DOS mode information in a
    directory listing; (bso#15375).
  * vfs_fruit might cause a failing open for delete; (bso#15378).
  * winbind recurses into itself via rpcd_lsad; (bso#15361).
  * wbinfo -u fails on ad dc with &gt;1000 users; (bso#15366).
  * DS ACEs might be inherited to unrelated object classes;
    (bso#15338).
  * a lot of messages: get_static_share_mode_data:
    get_static_share_mode_data_fn failed: NT_STATUS_NOT_FOUND;
    (bso#15362).
  * aes256 smb3 encryption algorithms are not allowed in
    smb3_sid_parse(); (bso#15374).
  * Setting veto files = /.*/ break listing directories;
    (bso#15360).
  * "samba-tool domain provision" does not run interactive mode
    if no arguments are given; (bso#15363).
  * dsgetdcname: assumes local system uses IPv4; (bso#15325).
- Update to 4.18.2
  * Log flood: smbd_calculate_access_mask_fsp: Access denied:
    message level should be lower; (bso#15302).
  * Floating point exception (FPE) via cli_pull_send at
    source3/libsmb/clireadwrite.c; (bso#15306).
  * test_tstream_more_tcp_user_timeout_spin fails intermittently
    on Rackspace GitLab runners; (bso#15328).
  * Reduce flapping of ridalloc test; (bso#15329).
  * large_ldap test is unreliable; (bso#15351).
  * New filename parser doesn't check veto files smb.conf
    parameter; (bso#15143).
  * mdssvc may crash when initializing; (bso#15354).
  * large directory optimization broken for non-lcomp path
    elements; (bso#15313).
  * streams_depot fails to create streams; (bso#15357).
  * shadow_copy2 and streams_depot don't play well together;
    (bso#15358).
  * Flapping tests in samba_tool_drs_show_repl.py; (bso#15316).
  * winbindd idmap child contacts the domain controller without a
    need; (bso#15317).
  * idmap_autorid may fail to map sids of trusted domains for the
    first time; (bso#15318).
  * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings;
    (bso#15319).
  * net ads search -P doesn't work against servers in other
    domains; (bso#15323).
  * Temporary smbXsrv_tcon_global.tdb can't be parsed;
    (bso#15353).
  * Tests use depricated and removed methods like
    assertRegexpMatches; (bso#15343).
- Update to 4.18.1
  * CVE-2023-0225: AD DC "dnsHostname" attribute can be
    deleted by unprivileged authenticated users.
    (bso#15276);(bsc#1209483).
  * CVE-2023-0614: Access controlled AD LDAP attributes can be
    discovered  (bso#15270); (bsc#1209485).
  * CVE-2023-0922: Samba AD DC admin tool samba-tool sends
    passwords in cleartext(bso#15315);(bsc#1209481).
  * ldb wildcard matching makes excessive allocations;
    (bso#15331).
  * large_ldap test is inefficient; (bso#15332).
- Update to 4.18.0
  * SMB server performance improvements
  * More succinct samba-tool error messages
  * Color output with samba-tool --color
    The NO_COLOR environment variable will disable colour output
  * New samba-tool dsacl subcommand for deleting ACEs
  * New wbinfo option --change-secret-at
  * Net option to change the NT ACL default location
  * Azure AD / Office365 synchronization improvements</changelog>
  <changelog author="nopower@suse.com" date="1696939200">- CVE-2023-4091: samba: Client can truncate file with read-only
  permissions; (bsc#1215904); (bso#15439).
- CVE-2023-42669: samba: rpcecho, enabled and running in AD DC,
  allows blocking sleep on request; (bso#1215905); (bso#15474).
- CVE-2023-42670: samba:  The procedure number is out of range
  when starting Active Directory Users and Computers;
  (bsc#1215906); (bso#15473).
- CVE-2023-3961: samba: Unsanitized client pipe name passed to
  local_np_connect(); (bsc#1215907); (bso#15422).
- CVE-2023-4154: samba: dirsync allows SYSTEM access with only
  "GUID_DRS_GET_CHANGES" right, not "GUID_DRS_GET_ALL_CHANGES;
  (bsc#1215908); (bso#15424).</changelog>
  <changelog author="nopower@suse.com" date="1697112000">- use systemd-logind rather than utmp for y2038 safety;
  (bsc#1216159).</changelog>
  <changelog author="nopower@suse.com" date="1697457600">- Update to 4.19.2
  * Use-after-free in aio_del_req_from_fsp during smbd shutdown
    after failed IPC FSCTL_PIPE_TRANSCEIVE; (bso#15423).
  * clidfs.c do_connect() missing a "return" after a
    cli_shutdown() call; (bso#15426).
  * macOS mdfind returns only 50 results; (bso#15463).
  * GETREALFILENAME_CACHE can modify incoming new filename with
    previous cache entry value; (bso#15481).
  * libnss_winbind causes memory corruption since samba-4.18,
    impacts sendmail, zabbix, potentially more; (bso#15464).
  * ctdbd: setproctitle not initialized messages flooding logs;
    (bso#15479).
  * CVE-2023-5568 Heap buffer overflow with freshness tokens in
    the Heimdal KDC in Samba 4.19; (bso#15491).
  * The heimdal KDC doesn't detect s4u2self correctly when fast
    is in use; (bso#15477).</changelog>
  <changelog author="dmulder@suse.com" date="1698062400">- packaging: samba-tool domain provision requires python3-Markdown;
  (bsc#1216519).</changelog>
  <changelog author="nopower@suse.com" date="1701086400">- Update to 4.19.3
  * sid_strings test broken by unix epoch &gt; 1700000000;
    (bso#15520).
  * smbd crashes if asked to return full information on close of
    a stream handle with delete on close disposition set;
    (bso#15487).
  * smbd: fix close order of base_fsp and stream_fsp in
    smb_fname_fsp_destructor(); (bso#15521).
  * Improve logging for failover scenarios; (bso#15499).
  * Files without "read attributes" NFS4 ACL permission are not
    listed in directories; (bso#15093).
  * CVE-2018-14628 [SECURITY] Deleted Object tombstones visible
    in AD LDAP to normal users; (bso#13595).
  * Kerberos TGS-REQ with User2User does not work for normal
    accounts; (bso#15492).
  * vfs_gpfs stat calls fail due to file system permissions;
    (bso#15507).
  * Samba doesn't build with Python 3.12; (bso#15513).</changelog>
  <changelog author="nopower@suse.com" date="1704801600">- Update to 4.19.4
  * net changesecretpw cannot set the machine account password if
    secrets.tdb is empty; (bso#13577).
  * For generating doc, take, if defined, env XML_CATALOG_FILES;
    (bso#15540).
  * Trivial C typo in nsswitch/winbind_nss_netbsd.c; (bso#15541).
  * vfs_linux_xfs is incorrectly named; (bso#15542).
  * systemd stumbled over copyright-message at smbd startup;
    (bso#15377).
  * Following intermediate abolute share-local symlinks is
    broken; (bso#15505).
  * ctdb RELEASE_IP causes a crash in release_ip if a connection
    to a non-public address disconnects first; (bso#15523).
  * shadow_copy2 broken when current fileset's directories are
    removed; (bso#15544).
  * smbd does not detect ctdb public ipv6 addresses for
    multichannel exclusion; (bso#15534).
  * 'force user = localunixuser' doesn't work if 'allow trusted
    domains = no' is set; (bso#15469).
  * smbget debug logging doesn't work; (bso#15525).
  * smget: username in the smburl and interactive password entry
    doesn't work; (bso#15532).
  * smbget auth function doesn't set values for password prompt
    correctly; (bso#15538).
  * Unable to copy and write files from clients to Ceph cluster
    via SMB Linux gateway with Ceph VFS module; (bso#15440).
  * Multichannel refresh network information; (bso#15547).</changelog>
  <changelog author="nopower@suse.com" date="1704888000">- Remove -x from bash shebang update-apparmor-samba-profile;
  (bsc#1218431).</changelog>
  <changelog author="nopower@suse.com" date="1708430400">- Update to 4.19.5
  * Windows 2016 fails to restore previous version of a file from
    a shadow_copy2 snapshot; (bso#13688).
  * Symlinks on AIX are broken in 4.19 (and a few version before
    that); (bso#15549).
  * Fake directory create times has no effect; (bso#12421).
  * ctime mixed up with mtime by smbd; (bso#15550).
  * samba-gpupdate --rsop fails if machine is not in a site;
    (bso#15548).
  * gpupdate: The root cert import when NDES is not available is
    broken; (bso#15557).
  * samba-gpupdate should print a useful message if cepces-submit
    can't be found; (bso#15552).
  * samba-gpupdate logging doesn't work; (bso#15558).
  * smbpasswd reset permissions only if not 0600; (bso#15555).</changelog>
  <changelog author="nopower@suse.com" date="1718884800">- Update to 4.19.7
  * ldb qsort might r/w out of bounds with an intransitive
    compare function (ldb 2.8.1 is already released);
    (bso#15569).
  * Many qsort() comparison functions are non-transitive, which
    can lead to out-of-bounds access in some circumstances (ldb
    2.8.1 is already released); (bso#15625).
  * Need to change gitlab-ci.yml tags in all branches to avoid CI
    bill; (bso#15638).
  * netr_LogonSamLogonEx returns NR_STATUS_ACCESS_DENIED with
    SysvolReady=0; (bso#14981).
  * Anonymous smb3 signing/encryption should be allowed (similar
    to Windows Server 2022); (bso#15412).
  * Panic in dreplsrv_op_pull_source_apply_changes_trigger;
    (bso#15573).
  * winbindd, net ads join and other things don't work on an ipv6
    only host; (bso#15642).
  * Smbcacls incorrectly propagates inheritance with Inherit-Only
    flag; (bso#15636).
  * http library doesn't support  'chunked transfer encoding';
    (bso#15611).
- Update to 4.19.6
  * fd_handle_destructor() panics within an smbd_smb2_close() if
    vfs_stat_fsp() fails in fd_close(); (bso#15527).
  * samba-gpupdate: Correctly implement site support;
    (bso#15588).
  * libgpo: Segfault in python bindings; (bso#15599).
  * Packet marshalling push support missing for
    CTDB_CONTROL_TCP_CLIENT_DISCONNECTED and
    CTDB_CONTROL_TCP_CLIENT_PASSED; (bso#15580).</changelog>
  <changelog author="scabrero@suse.de" date="1722513600">- Fix a crash when joining offline and 'kerberos method' includes
  keytab; (bsc#1228732);
- Fix reading the password from STDIN or environment vars if it
  was already given in the command line; (bsc#1228732);</changelog>
</package>
<package pkgid="0677e9ebf353df7262099f431a052089d61828f04783ee0e3c1386d88b609e24" name="ctdb" arch="x86_64">
  <version epoch="0" ver="4.19.7+git.357.1d7950ebd62" rel="150600.3.3.2"/>
  <changelog author="nopower@suse.com" date="1679745600">- Make (32bit) samba-libs conflict with old samba-ad-dc-libs
  package to satisfy installcheck.</changelog>
  <changelog author="nopower@suse.com" date="1681300800">- Update to 4.17.7
  * CVE-2023-0922: Samba AD DC admin tool samba-tool sends passwords
    in cleartext; (bso#15315); (bsc#1209481).
  * CVE-2023-0225: Samba AD DC "dnsHostname" attribute can be
    deleted by unprivileged authenticated users; (bso#15276);
    (bsc#1209483).
  * CVE-2023-0614: samba: Access controlled AD LDAP attributes can
    be discovered; (bso#15270); (bsc#1209485).
  * large_ldap test is inefficient; (bso#15332).
  * CVE-2020-25720 [SECURITY] Create Child permission should not
    allow full write to all attributes (additional changes);
    (bso#14810).
- Update to 4.17.6
  * streams_xattr is creating unexpected locks on folders;
    (bso#15314).
  * Use of the Azure AD Connect cloud sync tool is now supported
    for password hash synchronisation, allowing Samba AD Domains
    to synchronise passwords with this popular cloud environment;
    (bso#10635).
  * Spotlight doesn't work with latest macOS Ventura;
    (bso#15299).
  * New samba-dcerpc architecture does not scale gracefully;
    (bso#15310).
  * vfs_ceph incorrectly uses fsp_get_io_fd() instead of
    fsp_get_pathref_fd() in close and fstat; (bso#15307).
  * With clustering enabled samba-bgqd can core dump due to use
    after free; (bso#15293).
  * fd_load() function implicitly closes the fd where it should
    not; (bso#15311).
- Update to 4.17.5
  * smbc_getxattr() return value is incorrect; (bso#14808).
  * Compound SMB2 FLUSH+CLOSE requests from MacOSX are not
    handled correctly; (bso#15172).
  * synthetic_pathref AFP_AfpInfo failed errors; (bso#15210).
  * samba-tool gpo listall fails IPv6 only - finddcs() fails to
    find DC when there is only an AAAA record for the DC in DNS;
    (bso#15226).
  * smbd crashes if an FSCTL request is done on a stream handle;
    (bso#15236).
  * DFS links don't work anymore on Mac clients since 4.17;
    (bso#15277).
  * vfs_virusfilter segfault on access, directory edgecase
    (accessing NULL value); (bso#15283).
  * CVE-2022-38023 [SECURITY] Samba should refuse RC4 (aka md5)
    based SChannel on NETLOGON (additional changes); (bso#15240).
  * %U for include directive doesn't work for share listing
    (netshareenum); (bso#15243).
  * Shares missing from netshareenum response in samba 4.17.4;
    (bso#15266).
  * ctdb: use-after-free in run_proc; (bso#15269).
  * irpc_destructor may crash during shutdown; (bso#15280).
  * auth3_generate_session_info_pac leaks wbcAuthUserInfo;
    (bso#15286).
  * smbclient segfaults with use after free on an optimized
    build; (bso#15268).
  * smbstatus leaking files in msg.sock and msg.lock;
    (bso#15282).
  * Leak in wbcCtxPingDc2; (bso#15164).
  * Access based share enum does not work in Samba 4.16+;
    (bso#15265).
  * Crash during share enumeration; (bso#15267).
  * rep_listxattr on FreeBSD does not properly check for reads
    off end of returned buffer; (bso#15271).
  * Avoid relying on C89 features in a few places; (bso#15281).</changelog>
  <changelog author="nopower@suse.com" date="1686830400">- Update to 4.17.8
  * log flood: smbd_calculate_access_mask_fsp: Access denied:
    message level should be lower; (bso#15302).
  * Floating point exception (FPE) via cli_pull_send at
    source3/libsmb/clireadwrite.c; (bso#15306).
  * test_tstream_more_tcp_user_timeout_spin fails intermittently
    on Rackspace GitLab runners; (bso#15328).
  * Reduce flapping of ridalloc test; (bso#15329).
  * large_ldap test is unreliable; (bso#15351).
  * New filename parser doesn't check veto files smb.conf
    parameter; (bso#15143).
  * mdssvc may crash when initializing; (bso#15354).
  * Large directory optimization broken for non-lcomp path
    elements; (bso#15313).
  * streams_depot fails to create streams; (bso#15357).
  * shadow_copy2 and streams_depot don't play well together;
    (bso#15358).
  * wbinfo -u fails on ad dc with &gt;1000 users; (bso#15366).
  * winbindd idmap child contacts the domain controller without a
    need; (bso#15317).
  * idmap_autorid may fail to map sids of trusted domains for the
    first time; (bso#15318).
  * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings;
    (bso#15319).
  * net ads search -P doesn't work against servers in other
    domains; (bso#15323).
  * DS ACEs might be inherited to unrelated object classes;
    (bso#15338).
  * Temporary smbXsrv_tcon_global.tdb can't be parsed;
    (bso#15353).
  * Setting veto files = /.*/ break listing directories;
    (bso#15360); (bsc#1212375).
  * CVE-2020-25720 [SECURITY] Create Child permission should not
    allow full write to all attributes (additional changes);
    (bso#14810).
  * dsgetdcname: assumes local system uses IPv4; (bso#15325).</changelog>
  <changelog author="nopower@suse.com" date="1688644800">- Update to 4.17.9
  * Backport --pidl-developer fixes; (bso#15404).
  * smbd_scavenger crashes when service smbd is stopped;
    (bso#15275).
  * vfs_fruit might cause a failing open for delete; (bso#15378).
  * named crashes on DLZ zone update; (bso#14030).
  * winbind recurses into itself via rpcd_lsad; (bso#15361).
  * cli_list loops 100% CPU against pre-lanman2 servers;
    (bso#15382).
  * smbclient leaks fds with showacls; (bso#15391).
  * aes256 smb3 encryption algorithms are not allowed in
    smb3_sid_parse(); (bso#15374).
  * winbindd gets stuck on NT_STATUS_RPC_SEC_PKG_ERROR;
    (bso#15413).
  * smbget memory leak if failed to download files recursively;
    (bso#15403).</changelog>
  <changelog author="nopower@suse.com" date="1689249600">- CVE-2022-2127: lm_resp_len not checked properly in
  winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174).
- CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite
  Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173).
- CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type
  Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172).
- CVE-2023-34968: Spotlight server-side Share Path Disclosure;
  (bso#15388); (bsc#1213171).
- CVE-2023-3347: Samba doesn't require SMB2+ signing if
  `server signing = mandatory` is set; (bso#15397); (bsc#1213170).</changelog>
  <changelog author="nopower@suse.com" date="1689595200">- secure channel faulty since Windows 10/11 update 07/2023;
  (bso#15418); (bsc#1213384).</changelog>
  <changelog author="scabrero@suse.de" date="1690891200">- net ads lookup with unspecified realm fails; (bso#15384);
  (bsc#1213826);</changelog>
  <changelog author="scabrero@suse.de" date="1691496000">- Move libcluster-samba4.so from samba-libs to samba-client-libs;
  (bsc#1213940);</changelog>
  <changelog author="scabrero@suse.de" date="1692014400">- Fix DFS not working with widelinks enabled; (bsc#1213607);
  (bso#15435);</changelog>
  <changelog author="nopower@suse.com" date="1695729600">- Update to 4.19.0
  * File doesn't show when user doesn't have permission if
    aio_pthread is loaded; (bso#15453).
  * ctdb_killtcp fails to work with --enable-pcap and libpcap ≥
    1.9.1; (bso#15451).
  * Logging to stdout/stderr with DEBUG_SYSLOG_FORMAT_ALWAYS can
    log to syslog; (bso#15460).
  * ‘samba-tool domain level raise’ fails unless given a URL;
    (bso#15458).
  * reply_sesssetup_and_X() can dereference uninitialized tmp
    pointer; (bso#15420).
  * missing return in reply_exit_done(); (bso#15430).
  * TREE_CONNECT without SETUP causes smbd to use uninitialized
    pointer; (bso#15432).
  * Avoid infinite loop in initial user sync with Azure AD
    Connect when synchronising a large Samba AD domain;
    (bso#15401).
  * Samba replication logs show (null) DN; (bso#15407).
  * 2-3min delays at reconnect with
    smb2_validate_sequence_number: bad message_id 2; (bso#15346).
  * DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED can't be parsed;
    (bso#15446).
  * CID 1539212 causes real issue when output contains only
    newlines; (bso#15438).
  * KDC encodes INT64 claims incorrectly; (bso#15452).
  * mdssvc: Do an early talloc_free() in _mdssvc_open();
    (bso#15449).
  * Windows client join fails if a second container CN=System
    exists somewhere; (bso#9959).
  * regression DFS not working with widelinks = true;
    (bso#15435).
  * Heimdal fails to build on 32-bit FreeBSD; (bso#15443).
  * samba-tool ntacl get segfault if aio_pthread appended;
    (bso#15441).
- Update to 4.18.6
  * reply_sesssetup_and_X() can dereference uninitialized tmp pointer;
    (bso#15420);
  * Missing return in reply_exit_done(); (bso#15430);
  * post-exec password redaction for samba-tool is more reliable for fully
    random passwords as it no longer uses regular expressions containing the
    password value itself; (bso#15289);
  * Windows client join fails if a second container CN=System exists somewhere;
    (bso#9959);
  * Spotlight sometimes returns no results on latest macOS; (bso#15342);
  * Renaming results in NT_STATUS_SHARING_VIOLATION if previously attempted to
    remove the destination; (bso#15417);
  * Spotlight results return wrong date in result list; (bso#15427);
  * "net offlinejoin provision" does not work as non-root user; (bso#15414);
  * rpcserver no longer accepts double backslash in dfs pathname; (bso#15400);
  * cm_prepare_connection() calls close(fd) for the second time; (bso#15433);
  * 2-3min delays at reconnect with smb2_validate_sequence_number: bad
    message_id 2; (bso#15346);
  * samba-tool ntacl get segfault if aio_pthread appended; (bso#15441);
  * DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED can't be parsed; (bso#15446);
  * Python tarfile extraction needs change to avoid a warning (CVE-2007-4559
    mitigation); (bso#15390);
  * Regression DFS not working with widelinks = true; (bso#15435);
  * mdssvc: Do an early talloc_free() in _mdssvc_open(); (bso#15449);
- Update to 4.18.5
  * CVE-2022-2127: lm_resp_len not checked properly in
    winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174).
  * CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite
    Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173).
  * CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type
    Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172).
  * CVE-2023-34968: Spotlight server-side Share Path Disclosure;
    (bso#15388); (bsc#1213171).
  * CVE-2023-3347: Samba doesn't require SMB2+ signing if
    `server signing = mandatory` is set; (bso#15397); (bsc#1213170).
  * secure channel faulty since Windows 10/11 update 07/2023;
    (bso#15418); (bsc#1213384).
- Update to 4.18.4
  * Backport --pidl-developer fixes; (bso#15404).
  * Named crashes on DLZ zone update; (bso#14030).
  * smbcacls and smbcquotas do not check // before the server;
    (bso#2312).
  * cli_list loops 100% CPU against pre-lanman2 servers;
    (bso#15382).
  * smbclient leaks fds with showacls; (bso#15391).
  * smbd returns NOT_FOUND when creating files on a r/o
    filesystem; (bso#15402).
  * NSS_WRAPPER_HOSTNAME doesn't match NSS_WRAPPER_HOSTS entry
    and causes test timeouts; (bso#15355).
  * net ads lookup (with unspecified realm) fails; (bso#15384).
  * Register Samba processes with GPFS; (bso#15381).
  * Python tarfile extraction needs change to avoid a warning
    (CVE-2007-4559 mitigation); (bso#15390).
  * The winbind child segfaults when listing users with `winbind
    scan trusted domains = yes`; (bso#15398).
  * Remove comments about deprecated 'write cache size';
    (bso#15383).
  * smbget memory leak if failed to download files recursively;
    (bso#15403).
- Update to 4.18.3
  * Symlinks to files can have random DOS mode information in a
    directory listing; (bso#15375).
  * vfs_fruit might cause a failing open for delete; (bso#15378).
  * winbind recurses into itself via rpcd_lsad; (bso#15361).
  * wbinfo -u fails on ad dc with &gt;1000 users; (bso#15366).
  * DS ACEs might be inherited to unrelated object classes;
    (bso#15338).
  * a lot of messages: get_static_share_mode_data:
    get_static_share_mode_data_fn failed: NT_STATUS_NOT_FOUND;
    (bso#15362).
  * aes256 smb3 encryption algorithms are not allowed in
    smb3_sid_parse(); (bso#15374).
  * Setting veto files = /.*/ break listing directories;
    (bso#15360).
  * "samba-tool domain provision" does not run interactive mode
    if no arguments are given; (bso#15363).
  * dsgetdcname: assumes local system uses IPv4; (bso#15325).
- Update to 4.18.2
  * Log flood: smbd_calculate_access_mask_fsp: Access denied:
    message level should be lower; (bso#15302).
  * Floating point exception (FPE) via cli_pull_send at
    source3/libsmb/clireadwrite.c; (bso#15306).
  * test_tstream_more_tcp_user_timeout_spin fails intermittently
    on Rackspace GitLab runners; (bso#15328).
  * Reduce flapping of ridalloc test; (bso#15329).
  * large_ldap test is unreliable; (bso#15351).
  * New filename parser doesn't check veto files smb.conf
    parameter; (bso#15143).
  * mdssvc may crash when initializing; (bso#15354).
  * large directory optimization broken for non-lcomp path
    elements; (bso#15313).
  * streams_depot fails to create streams; (bso#15357).
  * shadow_copy2 and streams_depot don't play well together;
    (bso#15358).
  * Flapping tests in samba_tool_drs_show_repl.py; (bso#15316).
  * winbindd idmap child contacts the domain controller without a
    need; (bso#15317).
  * idmap_autorid may fail to map sids of trusted domains for the
    first time; (bso#15318).
  * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings;
    (bso#15319).
  * net ads search -P doesn't work against servers in other
    domains; (bso#15323).
  * Temporary smbXsrv_tcon_global.tdb can't be parsed;
    (bso#15353).
  * Tests use depricated and removed methods like
    assertRegexpMatches; (bso#15343).
- Update to 4.18.1
  * CVE-2023-0225: AD DC "dnsHostname" attribute can be
    deleted by unprivileged authenticated users.
    (bso#15276);(bsc#1209483).
  * CVE-2023-0614: Access controlled AD LDAP attributes can be
    discovered  (bso#15270); (bsc#1209485).
  * CVE-2023-0922: Samba AD DC admin tool samba-tool sends
    passwords in cleartext(bso#15315);(bsc#1209481).
  * ldb wildcard matching makes excessive allocations;
    (bso#15331).
  * large_ldap test is inefficient; (bso#15332).
- Update to 4.18.0
  * SMB server performance improvements
  * More succinct samba-tool error messages
  * Color output with samba-tool --color
    The NO_COLOR environment variable will disable colour output
  * New samba-tool dsacl subcommand for deleting ACEs
  * New wbinfo option --change-secret-at
  * Net option to change the NT ACL default location
  * Azure AD / Office365 synchronization improvements</changelog>
  <changelog author="nopower@suse.com" date="1696939200">- CVE-2023-4091: samba: Client can truncate file with read-only
  permissions; (bsc#1215904); (bso#15439).
- CVE-2023-42669: samba: rpcecho, enabled and running in AD DC,
  allows blocking sleep on request; (bso#1215905); (bso#15474).
- CVE-2023-42670: samba:  The procedure number is out of range
  when starting Active Directory Users and Computers;
  (bsc#1215906); (bso#15473).
- CVE-2023-3961: samba: Unsanitized client pipe name passed to
  local_np_connect(); (bsc#1215907); (bso#15422).
- CVE-2023-4154: samba: dirsync allows SYSTEM access with only
  "GUID_DRS_GET_CHANGES" right, not "GUID_DRS_GET_ALL_CHANGES;
  (bsc#1215908); (bso#15424).</changelog>
  <changelog author="nopower@suse.com" date="1697112000">- use systemd-logind rather than utmp for y2038 safety;
  (bsc#1216159).</changelog>
  <changelog author="nopower@suse.com" date="1697457600">- Update to 4.19.2
  * Use-after-free in aio_del_req_from_fsp during smbd shutdown
    after failed IPC FSCTL_PIPE_TRANSCEIVE; (bso#15423).
  * clidfs.c do_connect() missing a "return" after a
    cli_shutdown() call; (bso#15426).
  * macOS mdfind returns only 50 results; (bso#15463).
  * GETREALFILENAME_CACHE can modify incoming new filename with
    previous cache entry value; (bso#15481).
  * libnss_winbind causes memory corruption since samba-4.18,
    impacts sendmail, zabbix, potentially more; (bso#15464).
  * ctdbd: setproctitle not initialized messages flooding logs;
    (bso#15479).
  * CVE-2023-5568 Heap buffer overflow with freshness tokens in
    the Heimdal KDC in Samba 4.19; (bso#15491).
  * The heimdal KDC doesn't detect s4u2self correctly when fast
    is in use; (bso#15477).</changelog>
  <changelog author="dmulder@suse.com" date="1698062400">- packaging: samba-tool domain provision requires python3-Markdown;
  (bsc#1216519).</changelog>
  <changelog author="nopower@suse.com" date="1701086400">- Update to 4.19.3
  * sid_strings test broken by unix epoch &gt; 1700000000;
    (bso#15520).
  * smbd crashes if asked to return full information on close of
    a stream handle with delete on close disposition set;
    (bso#15487).
  * smbd: fix close order of base_fsp and stream_fsp in
    smb_fname_fsp_destructor(); (bso#15521).
  * Improve logging for failover scenarios; (bso#15499).
  * Files without "read attributes" NFS4 ACL permission are not
    listed in directories; (bso#15093).
  * CVE-2018-14628 [SECURITY] Deleted Object tombstones visible
    in AD LDAP to normal users; (bso#13595).
  * Kerberos TGS-REQ with User2User does not work for normal
    accounts; (bso#15492).
  * vfs_gpfs stat calls fail due to file system permissions;
    (bso#15507).
  * Samba doesn't build with Python 3.12; (bso#15513).</changelog>
  <changelog author="nopower@suse.com" date="1704801600">- Update to 4.19.4
  * net changesecretpw cannot set the machine account password if
    secrets.tdb is empty; (bso#13577).
  * For generating doc, take, if defined, env XML_CATALOG_FILES;
    (bso#15540).
  * Trivial C typo in nsswitch/winbind_nss_netbsd.c; (bso#15541).
  * vfs_linux_xfs is incorrectly named; (bso#15542).
  * systemd stumbled over copyright-message at smbd startup;
    (bso#15377).
  * Following intermediate abolute share-local symlinks is
    broken; (bso#15505).
  * ctdb RELEASE_IP causes a crash in release_ip if a connection
    to a non-public address disconnects first; (bso#15523).
  * shadow_copy2 broken when current fileset's directories are
    removed; (bso#15544).
  * smbd does not detect ctdb public ipv6 addresses for
    multichannel exclusion; (bso#15534).
  * 'force user = localunixuser' doesn't work if 'allow trusted
    domains = no' is set; (bso#15469).
  * smbget debug logging doesn't work; (bso#15525).
  * smget: username in the smburl and interactive password entry
    doesn't work; (bso#15532).
  * smbget auth function doesn't set values for password prompt
    correctly; (bso#15538).
  * Unable to copy and write files from clients to Ceph cluster
    via SMB Linux gateway with Ceph VFS module; (bso#15440).
  * Multichannel refresh network information; (bso#15547).</changelog>
  <changelog author="nopower@suse.com" date="1704888000">- Remove -x from bash shebang update-apparmor-samba-profile;
  (bsc#1218431).</changelog>
  <changelog author="nopower@suse.com" date="1708430400">- Update to 4.19.5
  * Windows 2016 fails to restore previous version of a file from
    a shadow_copy2 snapshot; (bso#13688).
  * Symlinks on AIX are broken in 4.19 (and a few version before
    that); (bso#15549).
  * Fake directory create times has no effect; (bso#12421).
  * ctime mixed up with mtime by smbd; (bso#15550).
  * samba-gpupdate --rsop fails if machine is not in a site;
    (bso#15548).
  * gpupdate: The root cert import when NDES is not available is
    broken; (bso#15557).
  * samba-gpupdate should print a useful message if cepces-submit
    can't be found; (bso#15552).
  * samba-gpupdate logging doesn't work; (bso#15558).
  * smbpasswd reset permissions only if not 0600; (bso#15555).</changelog>
  <changelog author="nopower@suse.com" date="1718884800">- Update to 4.19.7
  * ldb qsort might r/w out of bounds with an intransitive
    compare function (ldb 2.8.1 is already released);
    (bso#15569).
  * Many qsort() comparison functions are non-transitive, which
    can lead to out-of-bounds access in some circumstances (ldb
    2.8.1 is already released); (bso#15625).
  * Need to change gitlab-ci.yml tags in all branches to avoid CI
    bill; (bso#15638).
  * netr_LogonSamLogonEx returns NR_STATUS_ACCESS_DENIED with
    SysvolReady=0; (bso#14981).
  * Anonymous smb3 signing/encryption should be allowed (similar
    to Windows Server 2022); (bso#15412).
  * Panic in dreplsrv_op_pull_source_apply_changes_trigger;
    (bso#15573).
  * winbindd, net ads join and other things don't work on an ipv6
    only host; (bso#15642).
  * Smbcacls incorrectly propagates inheritance with Inherit-Only
    flag; (bso#15636).
  * http library doesn't support  'chunked transfer encoding';
    (bso#15611).
- Update to 4.19.6
  * fd_handle_destructor() panics within an smbd_smb2_close() if
    vfs_stat_fsp() fails in fd_close(); (bso#15527).
  * samba-gpupdate: Correctly implement site support;
    (bso#15588).
  * libgpo: Segfault in python bindings; (bso#15599).
  * Packet marshalling push support missing for
    CTDB_CONTROL_TCP_CLIENT_DISCONNECTED and
    CTDB_CONTROL_TCP_CLIENT_PASSED; (bso#15580).</changelog>
  <changelog author="scabrero@suse.de" date="1722513600">- Fix a crash when joining offline and 'kerberos method' includes
  keytab; (bsc#1228732);
- Fix reading the password from STDIN or environment vars if it
  was already given in the command line; (bsc#1228732);</changelog>
</package>
<package pkgid="42eee542ada5a2fa8b86e05372c73c4546d083d093158c55691a0ed5f4d4933f" name="ctdb-pcp-pmda" arch="aarch64">
  <version epoch="0" ver="4.19.7+git.357.1d7950ebd62" rel="150600.3.3.2"/>
  <changelog author="nopower@suse.com" date="1679745600">- Make (32bit) samba-libs conflict with old samba-ad-dc-libs
  package to satisfy installcheck.</changelog>
  <changelog author="nopower@suse.com" date="1681300800">- Update to 4.17.7
  * CVE-2023-0922: Samba AD DC admin tool samba-tool sends passwords
    in cleartext; (bso#15315); (bsc#1209481).
  * CVE-2023-0225: Samba AD DC "dnsHostname" attribute can be
    deleted by unprivileged authenticated users; (bso#15276);
    (bsc#1209483).
  * CVE-2023-0614: samba: Access controlled AD LDAP attributes can
    be discovered; (bso#15270); (bsc#1209485).
  * large_ldap test is inefficient; (bso#15332).
  * CVE-2020-25720 [SECURITY] Create Child permission should not
    allow full write to all attributes (additional changes);
    (bso#14810).
- Update to 4.17.6
  * streams_xattr is creating unexpected locks on folders;
    (bso#15314).
  * Use of the Azure AD Connect cloud sync tool is now supported
    for password hash synchronisation, allowing Samba AD Domains
    to synchronise passwords with this popular cloud environment;
    (bso#10635).
  * Spotlight doesn't work with latest macOS Ventura;
    (bso#15299).
  * New samba-dcerpc architecture does not scale gracefully;
    (bso#15310).
  * vfs_ceph incorrectly uses fsp_get_io_fd() instead of
    fsp_get_pathref_fd() in close and fstat; (bso#15307).
  * With clustering enabled samba-bgqd can core dump due to use
    after free; (bso#15293).
  * fd_load() function implicitly closes the fd where it should
    not; (bso#15311).
- Update to 4.17.5
  * smbc_getxattr() return value is incorrect; (bso#14808).
  * Compound SMB2 FLUSH+CLOSE requests from MacOSX are not
    handled correctly; (bso#15172).
  * synthetic_pathref AFP_AfpInfo failed errors; (bso#15210).
  * samba-tool gpo listall fails IPv6 only - finddcs() fails to
    find DC when there is only an AAAA record for the DC in DNS;
    (bso#15226).
  * smbd crashes if an FSCTL request is done on a stream handle;
    (bso#15236).
  * DFS links don't work anymore on Mac clients since 4.17;
    (bso#15277).
  * vfs_virusfilter segfault on access, directory edgecase
    (accessing NULL value); (bso#15283).
  * CVE-2022-38023 [SECURITY] Samba should refuse RC4 (aka md5)
    based SChannel on NETLOGON (additional changes); (bso#15240).
  * %U for include directive doesn't work for share listing
    (netshareenum); (bso#15243).
  * Shares missing from netshareenum response in samba 4.17.4;
    (bso#15266).
  * ctdb: use-after-free in run_proc; (bso#15269).
  * irpc_destructor may crash during shutdown; (bso#15280).
  * auth3_generate_session_info_pac leaks wbcAuthUserInfo;
    (bso#15286).
  * smbclient segfaults with use after free on an optimized
    build; (bso#15268).
  * smbstatus leaking files in msg.sock and msg.lock;
    (bso#15282).
  * Leak in wbcCtxPingDc2; (bso#15164).
  * Access based share enum does not work in Samba 4.16+;
    (bso#15265).
  * Crash during share enumeration; (bso#15267).
  * rep_listxattr on FreeBSD does not properly check for reads
    off end of returned buffer; (bso#15271).
  * Avoid relying on C89 features in a few places; (bso#15281).</changelog>
  <changelog author="nopower@suse.com" date="1686830400">- Update to 4.17.8
  * log flood: smbd_calculate_access_mask_fsp: Access denied:
    message level should be lower; (bso#15302).
  * Floating point exception (FPE) via cli_pull_send at
    source3/libsmb/clireadwrite.c; (bso#15306).
  * test_tstream_more_tcp_user_timeout_spin fails intermittently
    on Rackspace GitLab runners; (bso#15328).
  * Reduce flapping of ridalloc test; (bso#15329).
  * large_ldap test is unreliable; (bso#15351).
  * New filename parser doesn't check veto files smb.conf
    parameter; (bso#15143).
  * mdssvc may crash when initializing; (bso#15354).
  * Large directory optimization broken for non-lcomp path
    elements; (bso#15313).
  * streams_depot fails to create streams; (bso#15357).
  * shadow_copy2 and streams_depot don't play well together;
    (bso#15358).
  * wbinfo -u fails on ad dc with &gt;1000 users; (bso#15366).
  * winbindd idmap child contacts the domain controller without a
    need; (bso#15317).
  * idmap_autorid may fail to map sids of trusted domains for the
    first time; (bso#15318).
  * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings;
    (bso#15319).
  * net ads search -P doesn't work against servers in other
    domains; (bso#15323).
  * DS ACEs might be inherited to unrelated object classes;
    (bso#15338).
  * Temporary smbXsrv_tcon_global.tdb can't be parsed;
    (bso#15353).
  * Setting veto files = /.*/ break listing directories;
    (bso#15360); (bsc#1212375).
  * CVE-2020-25720 [SECURITY] Create Child permission should not
    allow full write to all attributes (additional changes);
    (bso#14810).
  * dsgetdcname: assumes local system uses IPv4; (bso#15325).</changelog>
  <changelog author="nopower@suse.com" date="1688644800">- Update to 4.17.9
  * Backport --pidl-developer fixes; (bso#15404).
  * smbd_scavenger crashes when service smbd is stopped;
    (bso#15275).
  * vfs_fruit might cause a failing open for delete; (bso#15378).
  * named crashes on DLZ zone update; (bso#14030).
  * winbind recurses into itself via rpcd_lsad; (bso#15361).
  * cli_list loops 100% CPU against pre-lanman2 servers;
    (bso#15382).
  * smbclient leaks fds with showacls; (bso#15391).
  * aes256 smb3 encryption algorithms are not allowed in
    smb3_sid_parse(); (bso#15374).
  * winbindd gets stuck on NT_STATUS_RPC_SEC_PKG_ERROR;
    (bso#15413).
  * smbget memory leak if failed to download files recursively;
    (bso#15403).</changelog>
  <changelog author="nopower@suse.com" date="1689249600">- CVE-2022-2127: lm_resp_len not checked properly in
  winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174).
- CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite
  Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173).
- CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type
  Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172).
- CVE-2023-34968: Spotlight server-side Share Path Disclosure;
  (bso#15388); (bsc#1213171).
- CVE-2023-3347: Samba doesn't require SMB2+ signing if
  `server signing = mandatory` is set; (bso#15397); (bsc#1213170).</changelog>
  <changelog author="nopower@suse.com" date="1689595200">- secure channel faulty since Windows 10/11 update 07/2023;
  (bso#15418); (bsc#1213384).</changelog>
  <changelog author="scabrero@suse.de" date="1690891200">- net ads lookup with unspecified realm fails; (bso#15384);
  (bsc#1213826);</changelog>
  <changelog author="scabrero@suse.de" date="1691496000">- Move libcluster-samba4.so from samba-libs to samba-client-libs;
  (bsc#1213940);</changelog>
  <changelog author="scabrero@suse.de" date="1692014400">- Fix DFS not working with widelinks enabled; (bsc#1213607);
  (bso#15435);</changelog>
  <changelog author="nopower@suse.com" date="1695729600">- Update to 4.19.0
  * File doesn't show when user doesn't have permission if
    aio_pthread is loaded; (bso#15453).
  * ctdb_killtcp fails to work with --enable-pcap and libpcap ≥
    1.9.1; (bso#15451).
  * Logging to stdout/stderr with DEBUG_SYSLOG_FORMAT_ALWAYS can
    log to syslog; (bso#15460).
  * ‘samba-tool domain level raise’ fails unless given a URL;
    (bso#15458).
  * reply_sesssetup_and_X() can dereference uninitialized tmp
    pointer; (bso#15420).
  * missing return in reply_exit_done(); (bso#15430).
  * TREE_CONNECT without SETUP causes smbd to use uninitialized
    pointer; (bso#15432).
  * Avoid infinite loop in initial user sync with Azure AD
    Connect when synchronising a large Samba AD domain;
    (bso#15401).
  * Samba replication logs show (null) DN; (bso#15407).
  * 2-3min delays at reconnect with
    smb2_validate_sequence_number: bad message_id 2; (bso#15346).
  * DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED can't be parsed;
    (bso#15446).
  * CID 1539212 causes real issue when output contains only
    newlines; (bso#15438).
  * KDC encodes INT64 claims incorrectly; (bso#15452).
  * mdssvc: Do an early talloc_free() in _mdssvc_open();
    (bso#15449).
  * Windows client join fails if a second container CN=System
    exists somewhere; (bso#9959).
  * regression DFS not working with widelinks = true;
    (bso#15435).
  * Heimdal fails to build on 32-bit FreeBSD; (bso#15443).
  * samba-tool ntacl get segfault if aio_pthread appended;
    (bso#15441).
- Update to 4.18.6
  * reply_sesssetup_and_X() can dereference uninitialized tmp pointer;
    (bso#15420);
  * Missing return in reply_exit_done(); (bso#15430);
  * post-exec password redaction for samba-tool is more reliable for fully
    random passwords as it no longer uses regular expressions containing the
    password value itself; (bso#15289);
  * Windows client join fails if a second container CN=System exists somewhere;
    (bso#9959);
  * Spotlight sometimes returns no results on latest macOS; (bso#15342);
  * Renaming results in NT_STATUS_SHARING_VIOLATION if previously attempted to
    remove the destination; (bso#15417);
  * Spotlight results return wrong date in result list; (bso#15427);
  * "net offlinejoin provision" does not work as non-root user; (bso#15414);
  * rpcserver no longer accepts double backslash in dfs pathname; (bso#15400);
  * cm_prepare_connection() calls close(fd) for the second time; (bso#15433);
  * 2-3min delays at reconnect with smb2_validate_sequence_number: bad
    message_id 2; (bso#15346);
  * samba-tool ntacl get segfault if aio_pthread appended; (bso#15441);
  * DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED can't be parsed; (bso#15446);
  * Python tarfile extraction needs change to avoid a warning (CVE-2007-4559
    mitigation); (bso#15390);
  * Regression DFS not working with widelinks = true; (bso#15435);
  * mdssvc: Do an early talloc_free() in _mdssvc_open(); (bso#15449);
- Update to 4.18.5
  * CVE-2022-2127: lm_resp_len not checked properly in
    winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174).
  * CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite
    Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173).
  * CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type
    Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172).
  * CVE-2023-34968: Spotlight server-side Share Path Disclosure;
    (bso#15388); (bsc#1213171).
  * CVE-2023-3347: Samba doesn't require SMB2+ signing if
    `server signing = mandatory` is set; (bso#15397); (bsc#1213170).
  * secure channel faulty since Windows 10/11 update 07/2023;
    (bso#15418); (bsc#1213384).
- Update to 4.18.4
  * Backport --pidl-developer fixes; (bso#15404).
  * Named crashes on DLZ zone update; (bso#14030).
  * smbcacls and smbcquotas do not check // before the server;
    (bso#2312).
  * cli_list loops 100% CPU against pre-lanman2 servers;
    (bso#15382).
  * smbclient leaks fds with showacls; (bso#15391).
  * smbd returns NOT_FOUND when creating files on a r/o
    filesystem; (bso#15402).
  * NSS_WRAPPER_HOSTNAME doesn't match NSS_WRAPPER_HOSTS entry
    and causes test timeouts; (bso#15355).
  * net ads lookup (with unspecified realm) fails; (bso#15384).
  * Register Samba processes with GPFS; (bso#15381).
  * Python tarfile extraction needs change to avoid a warning
    (CVE-2007-4559 mitigation); (bso#15390).
  * The winbind child segfaults when listing users with `winbind
    scan trusted domains = yes`; (bso#15398).
  * Remove comments about deprecated 'write cache size';
    (bso#15383).
  * smbget memory leak if failed to download files recursively;
    (bso#15403).
- Update to 4.18.3
  * Symlinks to files can have random DOS mode information in a
    directory listing; (bso#15375).
  * vfs_fruit might cause a failing open for delete; (bso#15378).
  * winbind recurses into itself via rpcd_lsad; (bso#15361).
  * wbinfo -u fails on ad dc with &gt;1000 users; (bso#15366).
  * DS ACEs might be inherited to unrelated object classes;
    (bso#15338).
  * a lot of messages: get_static_share_mode_data:
    get_static_share_mode_data_fn failed: NT_STATUS_NOT_FOUND;
    (bso#15362).
  * aes256 smb3 encryption algorithms are not allowed in
    smb3_sid_parse(); (bso#15374).
  * Setting veto files = /.*/ break listing directories;
    (bso#15360).
  * "samba-tool domain provision" does not run interactive mode
    if no arguments are given; (bso#15363).
  * dsgetdcname: assumes local system uses IPv4; (bso#15325).
- Update to 4.18.2
  * Log flood: smbd_calculate_access_mask_fsp: Access denied:
    message level should be lower; (bso#15302).
  * Floating point exception (FPE) via cli_pull_send at
    source3/libsmb/clireadwrite.c; (bso#15306).
  * test_tstream_more_tcp_user_timeout_spin fails intermittently
    on Rackspace GitLab runners; (bso#15328).
  * Reduce flapping of ridalloc test; (bso#15329).
  * large_ldap test is unreliable; (bso#15351).
  * New filename parser doesn't check veto files smb.conf
    parameter; (bso#15143).
  * mdssvc may crash when initializing; (bso#15354).
  * large directory optimization broken for non-lcomp path
    elements; (bso#15313).
  * streams_depot fails to create streams; (bso#15357).
  * shadow_copy2 and streams_depot don't play well together;
    (bso#15358).
  * Flapping tests in samba_tool_drs_show_repl.py; (bso#15316).
  * winbindd idmap child contacts the domain controller without a
    need; (bso#15317).
  * idmap_autorid may fail to map sids of trusted domains for the
    first time; (bso#15318).
  * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings;
    (bso#15319).
  * net ads search -P doesn't work against servers in other
    domains; (bso#15323).
  * Temporary smbXsrv_tcon_global.tdb can't be parsed;
    (bso#15353).
  * Tests use depricated and removed methods like
    assertRegexpMatches; (bso#15343).
- Update to 4.18.1
  * CVE-2023-0225: AD DC "dnsHostname" attribute can be
    deleted by unprivileged authenticated users.
    (bso#15276);(bsc#1209483).
  * CVE-2023-0614: Access controlled AD LDAP attributes can be
    discovered  (bso#15270); (bsc#1209485).
  * CVE-2023-0922: Samba AD DC admin tool samba-tool sends
    passwords in cleartext(bso#15315);(bsc#1209481).
  * ldb wildcard matching makes excessive allocations;
    (bso#15331).
  * large_ldap test is inefficient; (bso#15332).
- Update to 4.18.0
  * SMB server performance improvements
  * More succinct samba-tool error messages
  * Color output with samba-tool --color
    The NO_COLOR environment variable will disable colour output
  * New samba-tool dsacl subcommand for deleting ACEs
  * New wbinfo option --change-secret-at
  * Net option to change the NT ACL default location
  * Azure AD / Office365 synchronization improvements</changelog>
  <changelog author="nopower@suse.com" date="1696939200">- CVE-2023-4091: samba: Client can truncate file with read-only
  permissions; (bsc#1215904); (bso#15439).
- CVE-2023-42669: samba: rpcecho, enabled and running in AD DC,
  allows blocking sleep on request; (bso#1215905); (bso#15474).
- CVE-2023-42670: samba:  The procedure number is out of range
  when starting Active Directory Users and Computers;
  (bsc#1215906); (bso#15473).
- CVE-2023-3961: samba: Unsanitized client pipe name passed to
  local_np_connect(); (bsc#1215907); (bso#15422).
- CVE-2023-4154: samba: dirsync allows SYSTEM access with only
  "GUID_DRS_GET_CHANGES" right, not "GUID_DRS_GET_ALL_CHANGES;
  (bsc#1215908); (bso#15424).</changelog>
  <changelog author="nopower@suse.com" date="1697112000">- use systemd-logind rather than utmp for y2038 safety;
  (bsc#1216159).</changelog>
  <changelog author="nopower@suse.com" date="1697457600">- Update to 4.19.2
  * Use-after-free in aio_del_req_from_fsp during smbd shutdown
    after failed IPC FSCTL_PIPE_TRANSCEIVE; (bso#15423).
  * clidfs.c do_connect() missing a "return" after a
    cli_shutdown() call; (bso#15426).
  * macOS mdfind returns only 50 results; (bso#15463).
  * GETREALFILENAME_CACHE can modify incoming new filename with
    previous cache entry value; (bso#15481).
  * libnss_winbind causes memory corruption since samba-4.18,
    impacts sendmail, zabbix, potentially more; (bso#15464).
  * ctdbd: setproctitle not initialized messages flooding logs;
    (bso#15479).
  * CVE-2023-5568 Heap buffer overflow with freshness tokens in
    the Heimdal KDC in Samba 4.19; (bso#15491).
  * The heimdal KDC doesn't detect s4u2self correctly when fast
    is in use; (bso#15477).</changelog>
  <changelog author="dmulder@suse.com" date="1698062400">- packaging: samba-tool domain provision requires python3-Markdown;
  (bsc#1216519).</changelog>
  <changelog author="nopower@suse.com" date="1701086400">- Update to 4.19.3
  * sid_strings test broken by unix epoch &gt; 1700000000;
    (bso#15520).
  * smbd crashes if asked to return full information on close of
    a stream handle with delete on close disposition set;
    (bso#15487).
  * smbd: fix close order of base_fsp and stream_fsp in
    smb_fname_fsp_destructor(); (bso#15521).
  * Improve logging for failover scenarios; (bso#15499).
  * Files without "read attributes" NFS4 ACL permission are not
    listed in directories; (bso#15093).
  * CVE-2018-14628 [SECURITY] Deleted Object tombstones visible
    in AD LDAP to normal users; (bso#13595).
  * Kerberos TGS-REQ with User2User does not work for normal
    accounts; (bso#15492).
  * vfs_gpfs stat calls fail due to file system permissions;
    (bso#15507).
  * Samba doesn't build with Python 3.12; (bso#15513).</changelog>
  <changelog author="nopower@suse.com" date="1704801600">- Update to 4.19.4
  * net changesecretpw cannot set the machine account password if
    secrets.tdb is empty; (bso#13577).
  * For generating doc, take, if defined, env XML_CATALOG_FILES;
    (bso#15540).
  * Trivial C typo in nsswitch/winbind_nss_netbsd.c; (bso#15541).
  * vfs_linux_xfs is incorrectly named; (bso#15542).
  * systemd stumbled over copyright-message at smbd startup;
    (bso#15377).
  * Following intermediate abolute share-local symlinks is
    broken; (bso#15505).
  * ctdb RELEASE_IP causes a crash in release_ip if a connection
    to a non-public address disconnects first; (bso#15523).
  * shadow_copy2 broken when current fileset's directories are
    removed; (bso#15544).
  * smbd does not detect ctdb public ipv6 addresses for
    multichannel exclusion; (bso#15534).
  * 'force user = localunixuser' doesn't work if 'allow trusted
    domains = no' is set; (bso#15469).
  * smbget debug logging doesn't work; (bso#15525).
  * smget: username in the smburl and interactive password entry
    doesn't work; (bso#15532).
  * smbget auth function doesn't set values for password prompt
    correctly; (bso#15538).
  * Unable to copy and write files from clients to Ceph cluster
    via SMB Linux gateway with Ceph VFS module; (bso#15440).
  * Multichannel refresh network information; (bso#15547).</changelog>
  <changelog author="nopower@suse.com" date="1704888000">- Remove -x from bash shebang update-apparmor-samba-profile;
  (bsc#1218431).</changelog>
  <changelog author="nopower@suse.com" date="1708430400">- Update to 4.19.5
  * Windows 2016 fails to restore previous version of a file from
    a shadow_copy2 snapshot; (bso#13688).
  * Symlinks on AIX are broken in 4.19 (and a few version before
    that); (bso#15549).
  * Fake directory create times has no effect; (bso#12421).
  * ctime mixed up with mtime by smbd; (bso#15550).
  * samba-gpupdate --rsop fails if machine is not in a site;
    (bso#15548).
  * gpupdate: The root cert import when NDES is not available is
    broken; (bso#15557).
  * samba-gpupdate should print a useful message if cepces-submit
    can't be found; (bso#15552).
  * samba-gpupdate logging doesn't work; (bso#15558).
  * smbpasswd reset permissions only if not 0600; (bso#15555).</changelog>
  <changelog author="nopower@suse.com" date="1718884800">- Update to 4.19.7
  * ldb qsort might r/w out of bounds with an intransitive
    compare function (ldb 2.8.1 is already released);
    (bso#15569).
  * Many qsort() comparison functions are non-transitive, which
    can lead to out-of-bounds access in some circumstances (ldb
    2.8.1 is already released); (bso#15625).
  * Need to change gitlab-ci.yml tags in all branches to avoid CI
    bill; (bso#15638).
  * netr_LogonSamLogonEx returns NR_STATUS_ACCESS_DENIED with
    SysvolReady=0; (bso#14981).
  * Anonymous smb3 signing/encryption should be allowed (similar
    to Windows Server 2022); (bso#15412).
  * Panic in dreplsrv_op_pull_source_apply_changes_trigger;
    (bso#15573).
  * winbindd, net ads join and other things don't work on an ipv6
    only host; (bso#15642).
  * Smbcacls incorrectly propagates inheritance with Inherit-Only
    flag; (bso#15636).
  * http library doesn't support  'chunked transfer encoding';
    (bso#15611).
- Update to 4.19.6
  * fd_handle_destructor() panics within an smbd_smb2_close() if
    vfs_stat_fsp() fails in fd_close(); (bso#15527).
  * samba-gpupdate: Correctly implement site support;
    (bso#15588).
  * libgpo: Segfault in python bindings; (bso#15599).
  * Packet marshalling push support missing for
    CTDB_CONTROL_TCP_CLIENT_DISCONNECTED and
    CTDB_CONTROL_TCP_CLIENT_PASSED; (bso#15580).</changelog>
  <changelog author="scabrero@suse.de" date="1722513600">- Fix a crash when joining offline and 'kerberos method' includes
  keytab; (bsc#1228732);
- Fix reading the password from STDIN or environment vars if it
  was already given in the command line; (bsc#1228732);</changelog>
</package>
<package pkgid="3d58f9931a56359dcaf9a1ca8b233c8a2631f6c82b52395ee3dfc1c0474c0867" name="ctdb-pcp-pmda" arch="ppc64le">
  <version epoch="0" ver="4.19.7+git.357.1d7950ebd62" rel="150600.3.3.2"/>
  <changelog author="nopower@suse.com" date="1679745600">- Make (32bit) samba-libs conflict with old samba-ad-dc-libs
  package to satisfy installcheck.</changelog>
  <changelog author="nopower@suse.com" date="1681300800">- Update to 4.17.7
  * CVE-2023-0922: Samba AD DC admin tool samba-tool sends passwords
    in cleartext; (bso#15315); (bsc#1209481).
  * CVE-2023-0225: Samba AD DC "dnsHostname" attribute can be
    deleted by unprivileged authenticated users; (bso#15276);
    (bsc#1209483).
  * CVE-2023-0614: samba: Access controlled AD LDAP attributes can
    be discovered; (bso#15270); (bsc#1209485).
  * large_ldap test is inefficient; (bso#15332).
  * CVE-2020-25720 [SECURITY] Create Child permission should not
    allow full write to all attributes (additional changes);
    (bso#14810).
- Update to 4.17.6
  * streams_xattr is creating unexpected locks on folders;
    (bso#15314).
  * Use of the Azure AD Connect cloud sync tool is now supported
    for password hash synchronisation, allowing Samba AD Domains
    to synchronise passwords with this popular cloud environment;
    (bso#10635).
  * Spotlight doesn't work with latest macOS Ventura;
    (bso#15299).
  * New samba-dcerpc architecture does not scale gracefully;
    (bso#15310).
  * vfs_ceph incorrectly uses fsp_get_io_fd() instead of
    fsp_get_pathref_fd() in close and fstat; (bso#15307).
  * With clustering enabled samba-bgqd can core dump due to use
    after free; (bso#15293).
  * fd_load() function implicitly closes the fd where it should
    not; (bso#15311).
- Update to 4.17.5
  * smbc_getxattr() return value is incorrect; (bso#14808).
  * Compound SMB2 FLUSH+CLOSE requests from MacOSX are not
    handled correctly; (bso#15172).
  * synthetic_pathref AFP_AfpInfo failed errors; (bso#15210).
  * samba-tool gpo listall fails IPv6 only - finddcs() fails to
    find DC when there is only an AAAA record for the DC in DNS;
    (bso#15226).
  * smbd crashes if an FSCTL request is done on a stream handle;
    (bso#15236).
  * DFS links don't work anymore on Mac clients since 4.17;
    (bso#15277).
  * vfs_virusfilter segfault on access, directory edgecase
    (accessing NULL value); (bso#15283).
  * CVE-2022-38023 [SECURITY] Samba should refuse RC4 (aka md5)
    based SChannel on NETLOGON (additional changes); (bso#15240).
  * %U for include directive doesn't work for share listing
    (netshareenum); (bso#15243).
  * Shares missing from netshareenum response in samba 4.17.4;
    (bso#15266).
  * ctdb: use-after-free in run_proc; (bso#15269).
  * irpc_destructor may crash during shutdown; (bso#15280).
  * auth3_generate_session_info_pac leaks wbcAuthUserInfo;
    (bso#15286).
  * smbclient segfaults with use after free on an optimized
    build; (bso#15268).
  * smbstatus leaking files in msg.sock and msg.lock;
    (bso#15282).
  * Leak in wbcCtxPingDc2; (bso#15164).
  * Access based share enum does not work in Samba 4.16+;
    (bso#15265).
  * Crash during share enumeration; (bso#15267).
  * rep_listxattr on FreeBSD does not properly check for reads
    off end of returned buffer; (bso#15271).
  * Avoid relying on C89 features in a few places; (bso#15281).</changelog>
  <changelog author="nopower@suse.com" date="1686830400">- Update to 4.17.8
  * log flood: smbd_calculate_access_mask_fsp: Access denied:
    message level should be lower; (bso#15302).
  * Floating point exception (FPE) via cli_pull_send at
    source3/libsmb/clireadwrite.c; (bso#15306).
  * test_tstream_more_tcp_user_timeout_spin fails intermittently
    on Rackspace GitLab runners; (bso#15328).
  * Reduce flapping of ridalloc test; (bso#15329).
  * large_ldap test is unreliable; (bso#15351).
  * New filename parser doesn't check veto files smb.conf
    parameter; (bso#15143).
  * mdssvc may crash when initializing; (bso#15354).
  * Large directory optimization broken for non-lcomp path
    elements; (bso#15313).
  * streams_depot fails to create streams; (bso#15357).
  * shadow_copy2 and streams_depot don't play well together;
    (bso#15358).
  * wbinfo -u fails on ad dc with &gt;1000 users; (bso#15366).
  * winbindd idmap child contacts the domain controller without a
    need; (bso#15317).
  * idmap_autorid may fail to map sids of trusted domains for the
    first time; (bso#15318).
  * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings;
    (bso#15319).
  * net ads search -P doesn't work against servers in other
    domains; (bso#15323).
  * DS ACEs might be inherited to unrelated object classes;
    (bso#15338).
  * Temporary smbXsrv_tcon_global.tdb can't be parsed;
    (bso#15353).
  * Setting veto files = /.*/ break listing directories;
    (bso#15360); (bsc#1212375).
  * CVE-2020-25720 [SECURITY] Create Child permission should not
    allow full write to all attributes (additional changes);
    (bso#14810).
  * dsgetdcname: assumes local system uses IPv4; (bso#15325).</changelog>
  <changelog author="nopower@suse.com" date="1688644800">- Update to 4.17.9
  * Backport --pidl-developer fixes; (bso#15404).
  * smbd_scavenger crashes when service smbd is stopped;
    (bso#15275).
  * vfs_fruit might cause a failing open for delete; (bso#15378).
  * named crashes on DLZ zone update; (bso#14030).
  * winbind recurses into itself via rpcd_lsad; (bso#15361).
  * cli_list loops 100% CPU against pre-lanman2 servers;
    (bso#15382).
  * smbclient leaks fds with showacls; (bso#15391).
  * aes256 smb3 encryption algorithms are not allowed in
    smb3_sid_parse(); (bso#15374).
  * winbindd gets stuck on NT_STATUS_RPC_SEC_PKG_ERROR;
    (bso#15413).
  * smbget memory leak if failed to download files recursively;
    (bso#15403).</changelog>
  <changelog author="nopower@suse.com" date="1689249600">- CVE-2022-2127: lm_resp_len not checked properly in
  winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174).
- CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite
  Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173).
- CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type
  Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172).
- CVE-2023-34968: Spotlight server-side Share Path Disclosure;
  (bso#15388); (bsc#1213171).
- CVE-2023-3347: Samba doesn't require SMB2+ signing if
  `server signing = mandatory` is set; (bso#15397); (bsc#1213170).</changelog>
  <changelog author="nopower@suse.com" date="1689595200">- secure channel faulty since Windows 10/11 update 07/2023;
  (bso#15418); (bsc#1213384).</changelog>
  <changelog author="scabrero@suse.de" date="1690891200">- net ads lookup with unspecified realm fails; (bso#15384);
  (bsc#1213826);</changelog>
  <changelog author="scabrero@suse.de" date="1691496000">- Move libcluster-samba4.so from samba-libs to samba-client-libs;
  (bsc#1213940);</changelog>
  <changelog author="scabrero@suse.de" date="1692014400">- Fix DFS not working with widelinks enabled; (bsc#1213607);
  (bso#15435);</changelog>
  <changelog author="nopower@suse.com" date="1695729600">- Update to 4.19.0
  * File doesn't show when user doesn't have permission if
    aio_pthread is loaded; (bso#15453).
  * ctdb_killtcp fails to work with --enable-pcap and libpcap ≥
    1.9.1; (bso#15451).
  * Logging to stdout/stderr with DEBUG_SYSLOG_FORMAT_ALWAYS can
    log to syslog; (bso#15460).
  * ‘samba-tool domain level raise’ fails unless given a URL;
    (bso#15458).
  * reply_sesssetup_and_X() can dereference uninitialized tmp
    pointer; (bso#15420).
  * missing return in reply_exit_done(); (bso#15430).
  * TREE_CONNECT without SETUP causes smbd to use uninitialized
    pointer; (bso#15432).
  * Avoid infinite loop in initial user sync with Azure AD
    Connect when synchronising a large Samba AD domain;
    (bso#15401).
  * Samba replication logs show (null) DN; (bso#15407).
  * 2-3min delays at reconnect with
    smb2_validate_sequence_number: bad message_id 2; (bso#15346).
  * DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED can't be parsed;
    (bso#15446).
  * CID 1539212 causes real issue when output contains only
    newlines; (bso#15438).
  * KDC encodes INT64 claims incorrectly; (bso#15452).
  * mdssvc: Do an early talloc_free() in _mdssvc_open();
    (bso#15449).
  * Windows client join fails if a second container CN=System
    exists somewhere; (bso#9959).
  * regression DFS not working with widelinks = true;
    (bso#15435).
  * Heimdal fails to build on 32-bit FreeBSD; (bso#15443).
  * samba-tool ntacl get segfault if aio_pthread appended;
    (bso#15441).
- Update to 4.18.6
  * reply_sesssetup_and_X() can dereference uninitialized tmp pointer;
    (bso#15420);
  * Missing return in reply_exit_done(); (bso#15430);
  * post-exec password redaction for samba-tool is more reliable for fully
    random passwords as it no longer uses regular expressions containing the
    password value itself; (bso#15289);
  * Windows client join fails if a second container CN=System exists somewhere;
    (bso#9959);
  * Spotlight sometimes returns no results on latest macOS; (bso#15342);
  * Renaming results in NT_STATUS_SHARING_VIOLATION if previously attempted to
    remove the destination; (bso#15417);
  * Spotlight results return wrong date in result list; (bso#15427);
  * "net offlinejoin provision" does not work as non-root user; (bso#15414);
  * rpcserver no longer accepts double backslash in dfs pathname; (bso#15400);
  * cm_prepare_connection() calls close(fd) for the second time; (bso#15433);
  * 2-3min delays at reconnect with smb2_validate_sequence_number: bad
    message_id 2; (bso#15346);
  * samba-tool ntacl get segfault if aio_pthread appended; (bso#15441);
  * DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED can't be parsed; (bso#15446);
  * Python tarfile extraction needs change to avoid a warning (CVE-2007-4559
    mitigation); (bso#15390);
  * Regression DFS not working with widelinks = true; (bso#15435);
  * mdssvc: Do an early talloc_free() in _mdssvc_open(); (bso#15449);
- Update to 4.18.5
  * CVE-2022-2127: lm_resp_len not checked properly in
    winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174).
  * CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite
    Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173).
  * CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type
    Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172).
  * CVE-2023-34968: Spotlight server-side Share Path Disclosure;
    (bso#15388); (bsc#1213171).
  * CVE-2023-3347: Samba doesn't require SMB2+ signing if
    `server signing = mandatory` is set; (bso#15397); (bsc#1213170).
  * secure channel faulty since Windows 10/11 update 07/2023;
    (bso#15418); (bsc#1213384).
- Update to 4.18.4
  * Backport --pidl-developer fixes; (bso#15404).
  * Named crashes on DLZ zone update; (bso#14030).
  * smbcacls and smbcquotas do not check // before the server;
    (bso#2312).
  * cli_list loops 100% CPU against pre-lanman2 servers;
    (bso#15382).
  * smbclient leaks fds with showacls; (bso#15391).
  * smbd returns NOT_FOUND when creating files on a r/o
    filesystem; (bso#15402).
  * NSS_WRAPPER_HOSTNAME doesn't match NSS_WRAPPER_HOSTS entry
    and causes test timeouts; (bso#15355).
  * net ads lookup (with unspecified realm) fails; (bso#15384).
  * Register Samba processes with GPFS; (bso#15381).
  * Python tarfile extraction needs change to avoid a warning
    (CVE-2007-4559 mitigation); (bso#15390).
  * The winbind child segfaults when listing users with `winbind
    scan trusted domains = yes`; (bso#15398).
  * Remove comments about deprecated 'write cache size';
    (bso#15383).
  * smbget memory leak if failed to download files recursively;
    (bso#15403).
- Update to 4.18.3
  * Symlinks to files can have random DOS mode information in a
    directory listing; (bso#15375).
  * vfs_fruit might cause a failing open for delete; (bso#15378).
  * winbind recurses into itself via rpcd_lsad; (bso#15361).
  * wbinfo -u fails on ad dc with &gt;1000 users; (bso#15366).
  * DS ACEs might be inherited to unrelated object classes;
    (bso#15338).
  * a lot of messages: get_static_share_mode_data:
    get_static_share_mode_data_fn failed: NT_STATUS_NOT_FOUND;
    (bso#15362).
  * aes256 smb3 encryption algorithms are not allowed in
    smb3_sid_parse(); (bso#15374).
  * Setting veto files = /.*/ break listing directories;
    (bso#15360).
  * "samba-tool domain provision" does not run interactive mode
    if no arguments are given; (bso#15363).
  * dsgetdcname: assumes local system uses IPv4; (bso#15325).
- Update to 4.18.2
  * Log flood: smbd_calculate_access_mask_fsp: Access denied:
    message level should be lower; (bso#15302).
  * Floating point exception (FPE) via cli_pull_send at
    source3/libsmb/clireadwrite.c; (bso#15306).
  * test_tstream_more_tcp_user_timeout_spin fails intermittently
    on Rackspace GitLab runners; (bso#15328).
  * Reduce flapping of ridalloc test; (bso#15329).
  * large_ldap test is unreliable; (bso#15351).
  * New filename parser doesn't check veto files smb.conf
    parameter; (bso#15143).
  * mdssvc may crash when initializing; (bso#15354).
  * large directory optimization broken for non-lcomp path
    elements; (bso#15313).
  * streams_depot fails to create streams; (bso#15357).
  * shadow_copy2 and streams_depot don't play well together;
    (bso#15358).
  * Flapping tests in samba_tool_drs_show_repl.py; (bso#15316).
  * winbindd idmap child contacts the domain controller without a
    need; (bso#15317).
  * idmap_autorid may fail to map sids of trusted domains for the
    first time; (bso#15318).
  * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings;
    (bso#15319).
  * net ads search -P doesn't work against servers in other
    domains; (bso#15323).
  * Temporary smbXsrv_tcon_global.tdb can't be parsed;
    (bso#15353).
  * Tests use depricated and removed methods like
    assertRegexpMatches; (bso#15343).
- Update to 4.18.1
  * CVE-2023-0225: AD DC "dnsHostname" attribute can be
    deleted by unprivileged authenticated users.
    (bso#15276);(bsc#1209483).
  * CVE-2023-0614: Access controlled AD LDAP attributes can be
    discovered  (bso#15270); (bsc#1209485).
  * CVE-2023-0922: Samba AD DC admin tool samba-tool sends
    passwords in cleartext(bso#15315);(bsc#1209481).
  * ldb wildcard matching makes excessive allocations;
    (bso#15331).
  * large_ldap test is inefficient; (bso#15332).
- Update to 4.18.0
  * SMB server performance improvements
  * More succinct samba-tool error messages
  * Color output with samba-tool --color
    The NO_COLOR environment variable will disable colour output
  * New samba-tool dsacl subcommand for deleting ACEs
  * New wbinfo option --change-secret-at
  * Net option to change the NT ACL default location
  * Azure AD / Office365 synchronization improvements</changelog>
  <changelog author="nopower@suse.com" date="1696939200">- CVE-2023-4091: samba: Client can truncate file with read-only
  permissions; (bsc#1215904); (bso#15439).
- CVE-2023-42669: samba: rpcecho, enabled and running in AD DC,
  allows blocking sleep on request; (bso#1215905); (bso#15474).
- CVE-2023-42670: samba:  The procedure number is out of range
  when starting Active Directory Users and Computers;
  (bsc#1215906); (bso#15473).
- CVE-2023-3961: samba: Unsanitized client pipe name passed to
  local_np_connect(); (bsc#1215907); (bso#15422).
- CVE-2023-4154: samba: dirsync allows SYSTEM access with only
  "GUID_DRS_GET_CHANGES" right, not "GUID_DRS_GET_ALL_CHANGES;
  (bsc#1215908); (bso#15424).</changelog>
  <changelog author="nopower@suse.com" date="1697112000">- use systemd-logind rather than utmp for y2038 safety;
  (bsc#1216159).</changelog>
  <changelog author="nopower@suse.com" date="1697457600">- Update to 4.19.2
  * Use-after-free in aio_del_req_from_fsp during smbd shutdown
    after failed IPC FSCTL_PIPE_TRANSCEIVE; (bso#15423).
  * clidfs.c do_connect() missing a "return" after a
    cli_shutdown() call; (bso#15426).
  * macOS mdfind returns only 50 results; (bso#15463).
  * GETREALFILENAME_CACHE can modify incoming new filename with
    previous cache entry value; (bso#15481).
  * libnss_winbind causes memory corruption since samba-4.18,
    impacts sendmail, zabbix, potentially more; (bso#15464).
  * ctdbd: setproctitle not initialized messages flooding logs;
    (bso#15479).
  * CVE-2023-5568 Heap buffer overflow with freshness tokens in
    the Heimdal KDC in Samba 4.19; (bso#15491).
  * The heimdal KDC doesn't detect s4u2self correctly when fast
    is in use; (bso#15477).</changelog>
  <changelog author="dmulder@suse.com" date="1698062400">- packaging: samba-tool domain provision requires python3-Markdown;
  (bsc#1216519).</changelog>
  <changelog author="nopower@suse.com" date="1701086400">- Update to 4.19.3
  * sid_strings test broken by unix epoch &gt; 1700000000;
    (bso#15520).
  * smbd crashes if asked to return full information on close of
    a stream handle with delete on close disposition set;
    (bso#15487).
  * smbd: fix close order of base_fsp and stream_fsp in
    smb_fname_fsp_destructor(); (bso#15521).
  * Improve logging for failover scenarios; (bso#15499).
  * Files without "read attributes" NFS4 ACL permission are not
    listed in directories; (bso#15093).
  * CVE-2018-14628 [SECURITY] Deleted Object tombstones visible
    in AD LDAP to normal users; (bso#13595).
  * Kerberos TGS-REQ with User2User does not work for normal
    accounts; (bso#15492).
  * vfs_gpfs stat calls fail due to file system permissions;
    (bso#15507).
  * Samba doesn't build with Python 3.12; (bso#15513).</changelog>
  <changelog author="nopower@suse.com" date="1704801600">- Update to 4.19.4
  * net changesecretpw cannot set the machine account password if
    secrets.tdb is empty; (bso#13577).
  * For generating doc, take, if defined, env XML_CATALOG_FILES;
    (bso#15540).
  * Trivial C typo in nsswitch/winbind_nss_netbsd.c; (bso#15541).
  * vfs_linux_xfs is incorrectly named; (bso#15542).
  * systemd stumbled over copyright-message at smbd startup;
    (bso#15377).
  * Following intermediate abolute share-local symlinks is
    broken; (bso#15505).
  * ctdb RELEASE_IP causes a crash in release_ip if a connection
    to a non-public address disconnects first; (bso#15523).
  * shadow_copy2 broken when current fileset's directories are
    removed; (bso#15544).
  * smbd does not detect ctdb public ipv6 addresses for
    multichannel exclusion; (bso#15534).
  * 'force user = localunixuser' doesn't work if 'allow trusted
    domains = no' is set; (bso#15469).
  * smbget debug logging doesn't work; (bso#15525).
  * smget: username in the smburl and interactive password entry
    doesn't work; (bso#15532).
  * smbget auth function doesn't set values for password prompt
    correctly; (bso#15538).
  * Unable to copy and write files from clients to Ceph cluster
    via SMB Linux gateway with Ceph VFS module; (bso#15440).
  * Multichannel refresh network information; (bso#15547).</changelog>
  <changelog author="nopower@suse.com" date="1704888000">- Remove -x from bash shebang update-apparmor-samba-profile;
  (bsc#1218431).</changelog>
  <changelog author="nopower@suse.com" date="1708430400">- Update to 4.19.5
  * Windows 2016 fails to restore previous version of a file from
    a shadow_copy2 snapshot; (bso#13688).
  * Symlinks on AIX are broken in 4.19 (and a few version before
    that); (bso#15549).
  * Fake directory create times has no effect; (bso#12421).
  * ctime mixed up with mtime by smbd; (bso#15550).
  * samba-gpupdate --rsop fails if machine is not in a site;
    (bso#15548).
  * gpupdate: The root cert import when NDES is not available is
    broken; (bso#15557).
  * samba-gpupdate should print a useful message if cepces-submit
    can't be found; (bso#15552).
  * samba-gpupdate logging doesn't work; (bso#15558).
  * smbpasswd reset permissions only if not 0600; (bso#15555).</changelog>
  <changelog author="nopower@suse.com" date="1718884800">- Update to 4.19.7
  * ldb qsort might r/w out of bounds with an intransitive
    compare function (ldb 2.8.1 is already released);
    (bso#15569).
  * Many qsort() comparison functions are non-transitive, which
    can lead to out-of-bounds access in some circumstances (ldb
    2.8.1 is already released); (bso#15625).
  * Need to change gitlab-ci.yml tags in all branches to avoid CI
    bill; (bso#15638).
  * netr_LogonSamLogonEx returns NR_STATUS_ACCESS_DENIED with
    SysvolReady=0; (bso#14981).
  * Anonymous smb3 signing/encryption should be allowed (similar
    to Windows Server 2022); (bso#15412).
  * Panic in dreplsrv_op_pull_source_apply_changes_trigger;
    (bso#15573).
  * winbindd, net ads join and other things don't work on an ipv6
    only host; (bso#15642).
  * Smbcacls incorrectly propagates inheritance with Inherit-Only
    flag; (bso#15636).
  * http library doesn't support  'chunked transfer encoding';
    (bso#15611).
- Update to 4.19.6
  * fd_handle_destructor() panics within an smbd_smb2_close() if
    vfs_stat_fsp() fails in fd_close(); (bso#15527).
  * samba-gpupdate: Correctly implement site support;
    (bso#15588).
  * libgpo: Segfault in python bindings; (bso#15599).
  * Packet marshalling push support missing for
    CTDB_CONTROL_TCP_CLIENT_DISCONNECTED and
    CTDB_CONTROL_TCP_CLIENT_PASSED; (bso#15580).</changelog>
  <changelog author="scabrero@suse.de" date="1722513600">- Fix a crash when joining offline and 'kerberos method' includes
  keytab; (bsc#1228732);
- Fix reading the password from STDIN or environment vars if it
  was already given in the command line; (bsc#1228732);</changelog>
</package>
<package pkgid="13e174093e23fbe3f34a766a0f4cd8dcef261baa783b543b79b3b0cf4ff39a86" name="ctdb-pcp-pmda" arch="s390x">
  <version epoch="0" ver="4.19.7+git.357.1d7950ebd62" rel="150600.3.3.2"/>
  <changelog author="nopower@suse.com" date="1679745600">- Make (32bit) samba-libs conflict with old samba-ad-dc-libs
  package to satisfy installcheck.</changelog>
  <changelog author="nopower@suse.com" date="1681300800">- Update to 4.17.7
  * CVE-2023-0922: Samba AD DC admin tool samba-tool sends passwords
    in cleartext; (bso#15315); (bsc#1209481).
  * CVE-2023-0225: Samba AD DC "dnsHostname" attribute can be
    deleted by unprivileged authenticated users; (bso#15276);
    (bsc#1209483).
  * CVE-2023-0614: samba: Access controlled AD LDAP attributes can
    be discovered; (bso#15270); (bsc#1209485).
  * large_ldap test is inefficient; (bso#15332).
  * CVE-2020-25720 [SECURITY] Create Child permission should not
    allow full write to all attributes (additional changes);
    (bso#14810).
- Update to 4.17.6
  * streams_xattr is creating unexpected locks on folders;
    (bso#15314).
  * Use of the Azure AD Connect cloud sync tool is now supported
    for password hash synchronisation, allowing Samba AD Domains
    to synchronise passwords with this popular cloud environment;
    (bso#10635).
  * Spotlight doesn't work with latest macOS Ventura;
    (bso#15299).
  * New samba-dcerpc architecture does not scale gracefully;
    (bso#15310).
  * vfs_ceph incorrectly uses fsp_get_io_fd() instead of
    fsp_get_pathref_fd() in close and fstat; (bso#15307).
  * With clustering enabled samba-bgqd can core dump due to use
    after free; (bso#15293).
  * fd_load() function implicitly closes the fd where it should
    not; (bso#15311).
- Update to 4.17.5
  * smbc_getxattr() return value is incorrect; (bso#14808).
  * Compound SMB2 FLUSH+CLOSE requests from MacOSX are not
    handled correctly; (bso#15172).
  * synthetic_pathref AFP_AfpInfo failed errors; (bso#15210).
  * samba-tool gpo listall fails IPv6 only - finddcs() fails to
    find DC when there is only an AAAA record for the DC in DNS;
    (bso#15226).
  * smbd crashes if an FSCTL request is done on a stream handle;
    (bso#15236).
  * DFS links don't work anymore on Mac clients since 4.17;
    (bso#15277).
  * vfs_virusfilter segfault on access, directory edgecase
    (accessing NULL value); (bso#15283).
  * CVE-2022-38023 [SECURITY] Samba should refuse RC4 (aka md5)
    based SChannel on NETLOGON (additional changes); (bso#15240).
  * %U for include directive doesn't work for share listing
    (netshareenum); (bso#15243).
  * Shares missing from netshareenum response in samba 4.17.4;
    (bso#15266).
  * ctdb: use-after-free in run_proc; (bso#15269).
  * irpc_destructor may crash during shutdown; (bso#15280).
  * auth3_generate_session_info_pac leaks wbcAuthUserInfo;
    (bso#15286).
  * smbclient segfaults with use after free on an optimized
    build; (bso#15268).
  * smbstatus leaking files in msg.sock and msg.lock;
    (bso#15282).
  * Leak in wbcCtxPingDc2; (bso#15164).
  * Access based share enum does not work in Samba 4.16+;
    (bso#15265).
  * Crash during share enumeration; (bso#15267).
  * rep_listxattr on FreeBSD does not properly check for reads
    off end of returned buffer; (bso#15271).
  * Avoid relying on C89 features in a few places; (bso#15281).</changelog>
  <changelog author="nopower@suse.com" date="1686830400">- Update to 4.17.8
  * log flood: smbd_calculate_access_mask_fsp: Access denied:
    message level should be lower; (bso#15302).
  * Floating point exception (FPE) via cli_pull_send at
    source3/libsmb/clireadwrite.c; (bso#15306).
  * test_tstream_more_tcp_user_timeout_spin fails intermittently
    on Rackspace GitLab runners; (bso#15328).
  * Reduce flapping of ridalloc test; (bso#15329).
  * large_ldap test is unreliable; (bso#15351).
  * New filename parser doesn't check veto files smb.conf
    parameter; (bso#15143).
  * mdssvc may crash when initializing; (bso#15354).
  * Large directory optimization broken for non-lcomp path
    elements; (bso#15313).
  * streams_depot fails to create streams; (bso#15357).
  * shadow_copy2 and streams_depot don't play well together;
    (bso#15358).
  * wbinfo -u fails on ad dc with &gt;1000 users; (bso#15366).
  * winbindd idmap child contacts the domain controller without a
    need; (bso#15317).
  * idmap_autorid may fail to map sids of trusted domains for the
    first time; (bso#15318).
  * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings;
    (bso#15319).
  * net ads search -P doesn't work against servers in other
    domains; (bso#15323).
  * DS ACEs might be inherited to unrelated object classes;
    (bso#15338).
  * Temporary smbXsrv_tcon_global.tdb can't be parsed;
    (bso#15353).
  * Setting veto files = /.*/ break listing directories;
    (bso#15360); (bsc#1212375).
  * CVE-2020-25720 [SECURITY] Create Child permission should not
    allow full write to all attributes (additional changes);
    (bso#14810).
  * dsgetdcname: assumes local system uses IPv4; (bso#15325).</changelog>
  <changelog author="nopower@suse.com" date="1688644800">- Update to 4.17.9
  * Backport --pidl-developer fixes; (bso#15404).
  * smbd_scavenger crashes when service smbd is stopped;
    (bso#15275).
  * vfs_fruit might cause a failing open for delete; (bso#15378).
  * named crashes on DLZ zone update; (bso#14030).
  * winbind recurses into itself via rpcd_lsad; (bso#15361).
  * cli_list loops 100% CPU against pre-lanman2 servers;
    (bso#15382).
  * smbclient leaks fds with showacls; (bso#15391).
  * aes256 smb3 encryption algorithms are not allowed in
    smb3_sid_parse(); (bso#15374).
  * winbindd gets stuck on NT_STATUS_RPC_SEC_PKG_ERROR;
    (bso#15413).
  * smbget memory leak if failed to download files recursively;
    (bso#15403).</changelog>
  <changelog author="nopower@suse.com" date="1689249600">- CVE-2022-2127: lm_resp_len not checked properly in
  winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174).
- CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite
  Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173).
- CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type
  Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172).
- CVE-2023-34968: Spotlight server-side Share Path Disclosure;
  (bso#15388); (bsc#1213171).
- CVE-2023-3347: Samba doesn't require SMB2+ signing if
  `server signing = mandatory` is set; (bso#15397); (bsc#1213170).</changelog>
  <changelog author="nopower@suse.com" date="1689595200">- secure channel faulty since Windows 10/11 update 07/2023;
  (bso#15418); (bsc#1213384).</changelog>
  <changelog author="scabrero@suse.de" date="1690891200">- net ads lookup with unspecified realm fails; (bso#15384);
  (bsc#1213826);</changelog>
  <changelog author="scabrero@suse.de" date="1691496000">- Move libcluster-samba4.so from samba-libs to samba-client-libs;
  (bsc#1213940);</changelog>
  <changelog author="scabrero@suse.de" date="1692014400">- Fix DFS not working with widelinks enabled; (bsc#1213607);
  (bso#15435);</changelog>
  <changelog author="nopower@suse.com" date="1695729600">- Update to 4.19.0
  * File doesn't show when user doesn't have permission if
    aio_pthread is loaded; (bso#15453).
  * ctdb_killtcp fails to work with --enable-pcap and libpcap ≥
    1.9.1; (bso#15451).
  * Logging to stdout/stderr with DEBUG_SYSLOG_FORMAT_ALWAYS can
    log to syslog; (bso#15460).
  * ‘samba-tool domain level raise’ fails unless given a URL;
    (bso#15458).
  * reply_sesssetup_and_X() can dereference uninitialized tmp
    pointer; (bso#15420).
  * missing return in reply_exit_done(); (bso#15430).
  * TREE_CONNECT without SETUP causes smbd to use uninitialized
    pointer; (bso#15432).
  * Avoid infinite loop in initial user sync with Azure AD
    Connect when synchronising a large Samba AD domain;
    (bso#15401).
  * Samba replication logs show (null) DN; (bso#15407).
  * 2-3min delays at reconnect with
    smb2_validate_sequence_number: bad message_id 2; (bso#15346).
  * DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED can't be parsed;
    (bso#15446).
  * CID 1539212 causes real issue when output contains only
    newlines; (bso#15438).
  * KDC encodes INT64 claims incorrectly; (bso#15452).
  * mdssvc: Do an early talloc_free() in _mdssvc_open();
    (bso#15449).
  * Windows client join fails if a second container CN=System
    exists somewhere; (bso#9959).
  * regression DFS not working with widelinks = true;
    (bso#15435).
  * Heimdal fails to build on 32-bit FreeBSD; (bso#15443).
  * samba-tool ntacl get segfault if aio_pthread appended;
    (bso#15441).
- Update to 4.18.6
  * reply_sesssetup_and_X() can dereference uninitialized tmp pointer;
    (bso#15420);
  * Missing return in reply_exit_done(); (bso#15430);
  * post-exec password redaction for samba-tool is more reliable for fully
    random passwords as it no longer uses regular expressions containing the
    password value itself; (bso#15289);
  * Windows client join fails if a second container CN=System exists somewhere;
    (bso#9959);
  * Spotlight sometimes returns no results on latest macOS; (bso#15342);
  * Renaming results in NT_STATUS_SHARING_VIOLATION if previously attempted to
    remove the destination; (bso#15417);
  * Spotlight results return wrong date in result list; (bso#15427);
  * "net offlinejoin provision" does not work as non-root user; (bso#15414);
  * rpcserver no longer accepts double backslash in dfs pathname; (bso#15400);
  * cm_prepare_connection() calls close(fd) for the second time; (bso#15433);
  * 2-3min delays at reconnect with smb2_validate_sequence_number: bad
    message_id 2; (bso#15346);
  * samba-tool ntacl get segfault if aio_pthread appended; (bso#15441);
  * DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED can't be parsed; (bso#15446);
  * Python tarfile extraction needs change to avoid a warning (CVE-2007-4559
    mitigation); (bso#15390);
  * Regression DFS not working with widelinks = true; (bso#15435);
  * mdssvc: Do an early talloc_free() in _mdssvc_open(); (bso#15449);
- Update to 4.18.5
  * CVE-2022-2127: lm_resp_len not checked properly in
    winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174).
  * CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite
    Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173).
  * CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type
    Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172).
  * CVE-2023-34968: Spotlight server-side Share Path Disclosure;
    (bso#15388); (bsc#1213171).
  * CVE-2023-3347: Samba doesn't require SMB2+ signing if
    `server signing = mandatory` is set; (bso#15397); (bsc#1213170).
  * secure channel faulty since Windows 10/11 update 07/2023;
    (bso#15418); (bsc#1213384).
- Update to 4.18.4
  * Backport --pidl-developer fixes; (bso#15404).
  * Named crashes on DLZ zone update; (bso#14030).
  * smbcacls and smbcquotas do not check // before the server;
    (bso#2312).
  * cli_list loops 100% CPU against pre-lanman2 servers;
    (bso#15382).
  * smbclient leaks fds with showacls; (bso#15391).
  * smbd returns NOT_FOUND when creating files on a r/o
    filesystem; (bso#15402).
  * NSS_WRAPPER_HOSTNAME doesn't match NSS_WRAPPER_HOSTS entry
    and causes test timeouts; (bso#15355).
  * net ads lookup (with unspecified realm) fails; (bso#15384).
  * Register Samba processes with GPFS; (bso#15381).
  * Python tarfile extraction needs change to avoid a warning
    (CVE-2007-4559 mitigation); (bso#15390).
  * The winbind child segfaults when listing users with `winbind
    scan trusted domains = yes`; (bso#15398).
  * Remove comments about deprecated 'write cache size';
    (bso#15383).
  * smbget memory leak if failed to download files recursively;
    (bso#15403).
- Update to 4.18.3
  * Symlinks to files can have random DOS mode information in a
    directory listing; (bso#15375).
  * vfs_fruit might cause a failing open for delete; (bso#15378).
  * winbind recurses into itself via rpcd_lsad; (bso#15361).
  * wbinfo -u fails on ad dc with &gt;1000 users; (bso#15366).
  * DS ACEs might be inherited to unrelated object classes;
    (bso#15338).
  * a lot of messages: get_static_share_mode_data:
    get_static_share_mode_data_fn failed: NT_STATUS_NOT_FOUND;
    (bso#15362).
  * aes256 smb3 encryption algorithms are not allowed in
    smb3_sid_parse(); (bso#15374).
  * Setting veto files = /.*/ break listing directories;
    (bso#15360).
  * "samba-tool domain provision" does not run interactive mode
    if no arguments are given; (bso#15363).
  * dsgetdcname: assumes local system uses IPv4; (bso#15325).
- Update to 4.18.2
  * Log flood: smbd_calculate_access_mask_fsp: Access denied:
    message level should be lower; (bso#15302).
  * Floating point exception (FPE) via cli_pull_send at
    source3/libsmb/clireadwrite.c; (bso#15306).
  * test_tstream_more_tcp_user_timeout_spin fails intermittently
    on Rackspace GitLab runners; (bso#15328).
  * Reduce flapping of ridalloc test; (bso#15329).
  * large_ldap test is unreliable; (bso#15351).
  * New filename parser doesn't check veto files smb.conf
    parameter; (bso#15143).
  * mdssvc may crash when initializing; (bso#15354).
  * large directory optimization broken for non-lcomp path
    elements; (bso#15313).
  * streams_depot fails to create streams; (bso#15357).
  * shadow_copy2 and streams_depot don't play well together;
    (bso#15358).
  * Flapping tests in samba_tool_drs_show_repl.py; (bso#15316).
  * winbindd idmap child contacts the domain controller without a
    need; (bso#15317).
  * idmap_autorid may fail to map sids of trusted domains for the
    first time; (bso#15318).
  * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings;
    (bso#15319).
  * net ads search -P doesn't work against servers in other
    domains; (bso#15323).
  * Temporary smbXsrv_tcon_global.tdb can't be parsed;
    (bso#15353).
  * Tests use depricated and removed methods like
    assertRegexpMatches; (bso#15343).
- Update to 4.18.1
  * CVE-2023-0225: AD DC "dnsHostname" attribute can be
    deleted by unprivileged authenticated users.
    (bso#15276);(bsc#1209483).
  * CVE-2023-0614: Access controlled AD LDAP attributes can be
    discovered  (bso#15270); (bsc#1209485).
  * CVE-2023-0922: Samba AD DC admin tool samba-tool sends
    passwords in cleartext(bso#15315);(bsc#1209481).
  * ldb wildcard matching makes excessive allocations;
    (bso#15331).
  * large_ldap test is inefficient; (bso#15332).
- Update to 4.18.0
  * SMB server performance improvements
  * More succinct samba-tool error messages
  * Color output with samba-tool --color
    The NO_COLOR environment variable will disable colour output
  * New samba-tool dsacl subcommand for deleting ACEs
  * New wbinfo option --change-secret-at
  * Net option to change the NT ACL default location
  * Azure AD / Office365 synchronization improvements</changelog>
  <changelog author="nopower@suse.com" date="1696939200">- CVE-2023-4091: samba: Client can truncate file with read-only
  permissions; (bsc#1215904); (bso#15439).
- CVE-2023-42669: samba: rpcecho, enabled and running in AD DC,
  allows blocking sleep on request; (bso#1215905); (bso#15474).
- CVE-2023-42670: samba:  The procedure number is out of range
  when starting Active Directory Users and Computers;
  (bsc#1215906); (bso#15473).
- CVE-2023-3961: samba: Unsanitized client pipe name passed to
  local_np_connect(); (bsc#1215907); (bso#15422).
- CVE-2023-4154: samba: dirsync allows SYSTEM access with only
  "GUID_DRS_GET_CHANGES" right, not "GUID_DRS_GET_ALL_CHANGES;
  (bsc#1215908); (bso#15424).</changelog>
  <changelog author="nopower@suse.com" date="1697112000">- use systemd-logind rather than utmp for y2038 safety;
  (bsc#1216159).</changelog>
  <changelog author="nopower@suse.com" date="1697457600">- Update to 4.19.2
  * Use-after-free in aio_del_req_from_fsp during smbd shutdown
    after failed IPC FSCTL_PIPE_TRANSCEIVE; (bso#15423).
  * clidfs.c do_connect() missing a "return" after a
    cli_shutdown() call; (bso#15426).
  * macOS mdfind returns only 50 results; (bso#15463).
  * GETREALFILENAME_CACHE can modify incoming new filename with
    previous cache entry value; (bso#15481).
  * libnss_winbind causes memory corruption since samba-4.18,
    impacts sendmail, zabbix, potentially more; (bso#15464).
  * ctdbd: setproctitle not initialized messages flooding logs;
    (bso#15479).
  * CVE-2023-5568 Heap buffer overflow with freshness tokens in
    the Heimdal KDC in Samba 4.19; (bso#15491).
  * The heimdal KDC doesn't detect s4u2self correctly when fast
    is in use; (bso#15477).</changelog>
  <changelog author="dmulder@suse.com" date="1698062400">- packaging: samba-tool domain provision requires python3-Markdown;
  (bsc#1216519).</changelog>
  <changelog author="nopower@suse.com" date="1701086400">- Update to 4.19.3
  * sid_strings test broken by unix epoch &gt; 1700000000;
    (bso#15520).
  * smbd crashes if asked to return full information on close of
    a stream handle with delete on close disposition set;
    (bso#15487).
  * smbd: fix close order of base_fsp and stream_fsp in
    smb_fname_fsp_destructor(); (bso#15521).
  * Improve logging for failover scenarios; (bso#15499).
  * Files without "read attributes" NFS4 ACL permission are not
    listed in directories; (bso#15093).
  * CVE-2018-14628 [SECURITY] Deleted Object tombstones visible
    in AD LDAP to normal users; (bso#13595).
  * Kerberos TGS-REQ with User2User does not work for normal
    accounts; (bso#15492).
  * vfs_gpfs stat calls fail due to file system permissions;
    (bso#15507).
  * Samba doesn't build with Python 3.12; (bso#15513).</changelog>
  <changelog author="nopower@suse.com" date="1704801600">- Update to 4.19.4
  * net changesecretpw cannot set the machine account password if
    secrets.tdb is empty; (bso#13577).
  * For generating doc, take, if defined, env XML_CATALOG_FILES;
    (bso#15540).
  * Trivial C typo in nsswitch/winbind_nss_netbsd.c; (bso#15541).
  * vfs_linux_xfs is incorrectly named; (bso#15542).
  * systemd stumbled over copyright-message at smbd startup;
    (bso#15377).
  * Following intermediate abolute share-local symlinks is
    broken; (bso#15505).
  * ctdb RELEASE_IP causes a crash in release_ip if a connection
    to a non-public address disconnects first; (bso#15523).
  * shadow_copy2 broken when current fileset's directories are
    removed; (bso#15544).
  * smbd does not detect ctdb public ipv6 addresses for
    multichannel exclusion; (bso#15534).
  * 'force user = localunixuser' doesn't work if 'allow trusted
    domains = no' is set; (bso#15469).
  * smbget debug logging doesn't work; (bso#15525).
  * smget: username in the smburl and interactive password entry
    doesn't work; (bso#15532).
  * smbget auth function doesn't set values for password prompt
    correctly; (bso#15538).
  * Unable to copy and write files from clients to Ceph cluster
    via SMB Linux gateway with Ceph VFS module; (bso#15440).
  * Multichannel refresh network information; (bso#15547).</changelog>
  <changelog author="nopower@suse.com" date="1704888000">- Remove -x from bash shebang update-apparmor-samba-profile;
  (bsc#1218431).</changelog>
  <changelog author="nopower@suse.com" date="1708430400">- Update to 4.19.5
  * Windows 2016 fails to restore previous version of a file from
    a shadow_copy2 snapshot; (bso#13688).
  * Symlinks on AIX are broken in 4.19 (and a few version before
    that); (bso#15549).
  * Fake directory create times has no effect; (bso#12421).
  * ctime mixed up with mtime by smbd; (bso#15550).
  * samba-gpupdate --rsop fails if machine is not in a site;
    (bso#15548).
  * gpupdate: The root cert import when NDES is not available is
    broken; (bso#15557).
  * samba-gpupdate should print a useful message if cepces-submit
    can't be found; (bso#15552).
  * samba-gpupdate logging doesn't work; (bso#15558).
  * smbpasswd reset permissions only if not 0600; (bso#15555).</changelog>
  <changelog author="nopower@suse.com" date="1718884800">- Update to 4.19.7
  * ldb qsort might r/w out of bounds with an intransitive
    compare function (ldb 2.8.1 is already released);
    (bso#15569).
  * Many qsort() comparison functions are non-transitive, which
    can lead to out-of-bounds access in some circumstances (ldb
    2.8.1 is already released); (bso#15625).
  * Need to change gitlab-ci.yml tags in all branches to avoid CI
    bill; (bso#15638).
  * netr_LogonSamLogonEx returns NR_STATUS_ACCESS_DENIED with
    SysvolReady=0; (bso#14981).
  * Anonymous smb3 signing/encryption should be allowed (similar
    to Windows Server 2022); (bso#15412).
  * Panic in dreplsrv_op_pull_source_apply_changes_trigger;
    (bso#15573).
  * winbindd, net ads join and other things don't work on an ipv6
    only host; (bso#15642).
  * Smbcacls incorrectly propagates inheritance with Inherit-Only
    flag; (bso#15636).
  * http library doesn't support  'chunked transfer encoding';
    (bso#15611).
- Update to 4.19.6
  * fd_handle_destructor() panics within an smbd_smb2_close() if
    vfs_stat_fsp() fails in fd_close(); (bso#15527).
  * samba-gpupdate: Correctly implement site support;
    (bso#15588).
  * libgpo: Segfault in python bindings; (bso#15599).
  * Packet marshalling push support missing for
    CTDB_CONTROL_TCP_CLIENT_DISCONNECTED and
    CTDB_CONTROL_TCP_CLIENT_PASSED; (bso#15580).</changelog>
  <changelog author="scabrero@suse.de" date="1722513600">- Fix a crash when joining offline and 'kerberos method' includes
  keytab; (bsc#1228732);
- Fix reading the password from STDIN or environment vars if it
  was already given in the command line; (bsc#1228732);</changelog>
</package>
<package pkgid="438e4aff0679c9b74a41683747f405d8ad27349faa33fa53d17db41173aecdb5" name="ctdb-pcp-pmda" arch="x86_64">
  <version epoch="0" ver="4.19.7+git.357.1d7950ebd62" rel="150600.3.3.2"/>
  <changelog author="nopower@suse.com" date="1679745600">- Make (32bit) samba-libs conflict with old samba-ad-dc-libs
  package to satisfy installcheck.</changelog>
  <changelog author="nopower@suse.com" date="1681300800">- Update to 4.17.7
  * CVE-2023-0922: Samba AD DC admin tool samba-tool sends passwords
    in cleartext; (bso#15315); (bsc#1209481).
  * CVE-2023-0225: Samba AD DC "dnsHostname" attribute can be
    deleted by unprivileged authenticated users; (bso#15276);
    (bsc#1209483).
  * CVE-2023-0614: samba: Access controlled AD LDAP attributes can
    be discovered; (bso#15270); (bsc#1209485).
  * large_ldap test is inefficient; (bso#15332).
  * CVE-2020-25720 [SECURITY] Create Child permission should not
    allow full write to all attributes (additional changes);
    (bso#14810).
- Update to 4.17.6
  * streams_xattr is creating unexpected locks on folders;
    (bso#15314).
  * Use of the Azure AD Connect cloud sync tool is now supported
    for password hash synchronisation, allowing Samba AD Domains
    to synchronise passwords with this popular cloud environment;
    (bso#10635).
  * Spotlight doesn't work with latest macOS Ventura;
    (bso#15299).
  * New samba-dcerpc architecture does not scale gracefully;
    (bso#15310).
  * vfs_ceph incorrectly uses fsp_get_io_fd() instead of
    fsp_get_pathref_fd() in close and fstat; (bso#15307).
  * With clustering enabled samba-bgqd can core dump due to use
    after free; (bso#15293).
  * fd_load() function implicitly closes the fd where it should
    not; (bso#15311).
- Update to 4.17.5
  * smbc_getxattr() return value is incorrect; (bso#14808).
  * Compound SMB2 FLUSH+CLOSE requests from MacOSX are not
    handled correctly; (bso#15172).
  * synthetic_pathref AFP_AfpInfo failed errors; (bso#15210).
  * samba-tool gpo listall fails IPv6 only - finddcs() fails to
    find DC when there is only an AAAA record for the DC in DNS;
    (bso#15226).
  * smbd crashes if an FSCTL request is done on a stream handle;
    (bso#15236).
  * DFS links don't work anymore on Mac clients since 4.17;
    (bso#15277).
  * vfs_virusfilter segfault on access, directory edgecase
    (accessing NULL value); (bso#15283).
  * CVE-2022-38023 [SECURITY] Samba should refuse RC4 (aka md5)
    based SChannel on NETLOGON (additional changes); (bso#15240).
  * %U for include directive doesn't work for share listing
    (netshareenum); (bso#15243).
  * Shares missing from netshareenum response in samba 4.17.4;
    (bso#15266).
  * ctdb: use-after-free in run_proc; (bso#15269).
  * irpc_destructor may crash during shutdown; (bso#15280).
  * auth3_generate_session_info_pac leaks wbcAuthUserInfo;
    (bso#15286).
  * smbclient segfaults with use after free on an optimized
    build; (bso#15268).
  * smbstatus leaking files in msg.sock and msg.lock;
    (bso#15282).
  * Leak in wbcCtxPingDc2; (bso#15164).
  * Access based share enum does not work in Samba 4.16+;
    (bso#15265).
  * Crash during share enumeration; (bso#15267).
  * rep_listxattr on FreeBSD does not properly check for reads
    off end of returned buffer; (bso#15271).
  * Avoid relying on C89 features in a few places; (bso#15281).</changelog>
  <changelog author="nopower@suse.com" date="1686830400">- Update to 4.17.8
  * log flood: smbd_calculate_access_mask_fsp: Access denied:
    message level should be lower; (bso#15302).
  * Floating point exception (FPE) via cli_pull_send at
    source3/libsmb/clireadwrite.c; (bso#15306).
  * test_tstream_more_tcp_user_timeout_spin fails intermittently
    on Rackspace GitLab runners; (bso#15328).
  * Reduce flapping of ridalloc test; (bso#15329).
  * large_ldap test is unreliable; (bso#15351).
  * New filename parser doesn't check veto files smb.conf
    parameter; (bso#15143).
  * mdssvc may crash when initializing; (bso#15354).
  * Large directory optimization broken for non-lcomp path
    elements; (bso#15313).
  * streams_depot fails to create streams; (bso#15357).
  * shadow_copy2 and streams_depot don't play well together;
    (bso#15358).
  * wbinfo -u fails on ad dc with &gt;1000 users; (bso#15366).
  * winbindd idmap child contacts the domain controller without a
    need; (bso#15317).
  * idmap_autorid may fail to map sids of trusted domains for the
    first time; (bso#15318).
  * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings;
    (bso#15319).
  * net ads search -P doesn't work against servers in other
    domains; (bso#15323).
  * DS ACEs might be inherited to unrelated object classes;
    (bso#15338).
  * Temporary smbXsrv_tcon_global.tdb can't be parsed;
    (bso#15353).
  * Setting veto files = /.*/ break listing directories;
    (bso#15360); (bsc#1212375).
  * CVE-2020-25720 [SECURITY] Create Child permission should not
    allow full write to all attributes (additional changes);
    (bso#14810).
  * dsgetdcname: assumes local system uses IPv4; (bso#15325).</changelog>
  <changelog author="nopower@suse.com" date="1688644800">- Update to 4.17.9
  * Backport --pidl-developer fixes; (bso#15404).
  * smbd_scavenger crashes when service smbd is stopped;
    (bso#15275).
  * vfs_fruit might cause a failing open for delete; (bso#15378).
  * named crashes on DLZ zone update; (bso#14030).
  * winbind recurses into itself via rpcd_lsad; (bso#15361).
  * cli_list loops 100% CPU against pre-lanman2 servers;
    (bso#15382).
  * smbclient leaks fds with showacls; (bso#15391).
  * aes256 smb3 encryption algorithms are not allowed in
    smb3_sid_parse(); (bso#15374).
  * winbindd gets stuck on NT_STATUS_RPC_SEC_PKG_ERROR;
    (bso#15413).
  * smbget memory leak if failed to download files recursively;
    (bso#15403).</changelog>
  <changelog author="nopower@suse.com" date="1689249600">- CVE-2022-2127: lm_resp_len not checked properly in
  winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174).
- CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite
  Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173).
- CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type
  Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172).
- CVE-2023-34968: Spotlight server-side Share Path Disclosure;
  (bso#15388); (bsc#1213171).
- CVE-2023-3347: Samba doesn't require SMB2+ signing if
  `server signing = mandatory` is set; (bso#15397); (bsc#1213170).</changelog>
  <changelog author="nopower@suse.com" date="1689595200">- secure channel faulty since Windows 10/11 update 07/2023;
  (bso#15418); (bsc#1213384).</changelog>
  <changelog author="scabrero@suse.de" date="1690891200">- net ads lookup with unspecified realm fails; (bso#15384);
  (bsc#1213826);</changelog>
  <changelog author="scabrero@suse.de" date="1691496000">- Move libcluster-samba4.so from samba-libs to samba-client-libs;
  (bsc#1213940);</changelog>
  <changelog author="scabrero@suse.de" date="1692014400">- Fix DFS not working with widelinks enabled; (bsc#1213607);
  (bso#15435);</changelog>
  <changelog author="nopower@suse.com" date="1695729600">- Update to 4.19.0
  * File doesn't show when user doesn't have permission if
    aio_pthread is loaded; (bso#15453).
  * ctdb_killtcp fails to work with --enable-pcap and libpcap ≥
    1.9.1; (bso#15451).
  * Logging to stdout/stderr with DEBUG_SYSLOG_FORMAT_ALWAYS can
    log to syslog; (bso#15460).
  * ‘samba-tool domain level raise’ fails unless given a URL;
    (bso#15458).
  * reply_sesssetup_and_X() can dereference uninitialized tmp
    pointer; (bso#15420).
  * missing return in reply_exit_done(); (bso#15430).
  * TREE_CONNECT without SETUP causes smbd to use uninitialized
    pointer; (bso#15432).
  * Avoid infinite loop in initial user sync with Azure AD
    Connect when synchronising a large Samba AD domain;
    (bso#15401).
  * Samba replication logs show (null) DN; (bso#15407).
  * 2-3min delays at reconnect with
    smb2_validate_sequence_number: bad message_id 2; (bso#15346).
  * DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED can't be parsed;
    (bso#15446).
  * CID 1539212 causes real issue when output contains only
    newlines; (bso#15438).
  * KDC encodes INT64 claims incorrectly; (bso#15452).
  * mdssvc: Do an early talloc_free() in _mdssvc_open();
    (bso#15449).
  * Windows client join fails if a second container CN=System
    exists somewhere; (bso#9959).
  * regression DFS not working with widelinks = true;
    (bso#15435).
  * Heimdal fails to build on 32-bit FreeBSD; (bso#15443).
  * samba-tool ntacl get segfault if aio_pthread appended;
    (bso#15441).
- Update to 4.18.6
  * reply_sesssetup_and_X() can dereference uninitialized tmp pointer;
    (bso#15420);
  * Missing return in reply_exit_done(); (bso#15430);
  * post-exec password redaction for samba-tool is more reliable for fully
    random passwords as it no longer uses regular expressions containing the
    password value itself; (bso#15289);
  * Windows client join fails if a second container CN=System exists somewhere;
    (bso#9959);
  * Spotlight sometimes returns no results on latest macOS; (bso#15342);
  * Renaming results in NT_STATUS_SHARING_VIOLATION if previously attempted to
    remove the destination; (bso#15417);
  * Spotlight results return wrong date in result list; (bso#15427);
  * "net offlinejoin provision" does not work as non-root user; (bso#15414);
  * rpcserver no longer accepts double backslash in dfs pathname; (bso#15400);
  * cm_prepare_connection() calls close(fd) for the second time; (bso#15433);
  * 2-3min delays at reconnect with smb2_validate_sequence_number: bad
    message_id 2; (bso#15346);
  * samba-tool ntacl get segfault if aio_pthread appended; (bso#15441);
  * DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED can't be parsed; (bso#15446);
  * Python tarfile extraction needs change to avoid a warning (CVE-2007-4559
    mitigation); (bso#15390);
  * Regression DFS not working with widelinks = true; (bso#15435);
  * mdssvc: Do an early talloc_free() in _mdssvc_open(); (bso#15449);
- Update to 4.18.5
  * CVE-2022-2127: lm_resp_len not checked properly in
    winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174).
  * CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite
    Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173).
  * CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type
    Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172).
  * CVE-2023-34968: Spotlight server-side Share Path Disclosure;
    (bso#15388); (bsc#1213171).
  * CVE-2023-3347: Samba doesn't require SMB2+ signing if
    `server signing = mandatory` is set; (bso#15397); (bsc#1213170).
  * secure channel faulty since Windows 10/11 update 07/2023;
    (bso#15418); (bsc#1213384).
- Update to 4.18.4
  * Backport --pidl-developer fixes; (bso#15404).
  * Named crashes on DLZ zone update; (bso#14030).
  * smbcacls and smbcquotas do not check // before the server;
    (bso#2312).
  * cli_list loops 100% CPU against pre-lanman2 servers;
    (bso#15382).
  * smbclient leaks fds with showacls; (bso#15391).
  * smbd returns NOT_FOUND when creating files on a r/o
    filesystem; (bso#15402).
  * NSS_WRAPPER_HOSTNAME doesn't match NSS_WRAPPER_HOSTS entry
    and causes test timeouts; (bso#15355).
  * net ads lookup (with unspecified realm) fails; (bso#15384).
  * Register Samba processes with GPFS; (bso#15381).
  * Python tarfile extraction needs change to avoid a warning
    (CVE-2007-4559 mitigation); (bso#15390).
  * The winbind child segfaults when listing users with `winbind
    scan trusted domains = yes`; (bso#15398).
  * Remove comments about deprecated 'write cache size';
    (bso#15383).
  * smbget memory leak if failed to download files recursively;
    (bso#15403).
- Update to 4.18.3
  * Symlinks to files can have random DOS mode information in a
    directory listing; (bso#15375).
  * vfs_fruit might cause a failing open for delete; (bso#15378).
  * winbind recurses into itself via rpcd_lsad; (bso#15361).
  * wbinfo -u fails on ad dc with &gt;1000 users; (bso#15366).
  * DS ACEs might be inherited to unrelated object classes;
    (bso#15338).
  * a lot of messages: get_static_share_mode_data:
    get_static_share_mode_data_fn failed: NT_STATUS_NOT_FOUND;
    (bso#15362).
  * aes256 smb3 encryption algorithms are not allowed in
    smb3_sid_parse(); (bso#15374).
  * Setting veto files = /.*/ break listing directories;
    (bso#15360).
  * "samba-tool domain provision" does not run interactive mode
    if no arguments are given; (bso#15363).
  * dsgetdcname: assumes local system uses IPv4; (bso#15325).
- Update to 4.18.2
  * Log flood: smbd_calculate_access_mask_fsp: Access denied:
    message level should be lower; (bso#15302).
  * Floating point exception (FPE) via cli_pull_send at
    source3/libsmb/clireadwrite.c; (bso#15306).
  * test_tstream_more_tcp_user_timeout_spin fails intermittently
    on Rackspace GitLab runners; (bso#15328).
  * Reduce flapping of ridalloc test; (bso#15329).
  * large_ldap test is unreliable; (bso#15351).
  * New filename parser doesn't check veto files smb.conf
    parameter; (bso#15143).
  * mdssvc may crash when initializing; (bso#15354).
  * large directory optimization broken for non-lcomp path
    elements; (bso#15313).
  * streams_depot fails to create streams; (bso#15357).
  * shadow_copy2 and streams_depot don't play well together;
    (bso#15358).
  * Flapping tests in samba_tool_drs_show_repl.py; (bso#15316).
  * winbindd idmap child contacts the domain controller without a
    need; (bso#15317).
  * idmap_autorid may fail to map sids of trusted domains for the
    first time; (bso#15318).
  * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings;
    (bso#15319).
  * net ads search -P doesn't work against servers in other
    domains; (bso#15323).
  * Temporary smbXsrv_tcon_global.tdb can't be parsed;
    (bso#15353).
  * Tests use depricated and removed methods like
    assertRegexpMatches; (bso#15343).
- Update to 4.18.1
  * CVE-2023-0225: AD DC "dnsHostname" attribute can be
    deleted by unprivileged authenticated users.
    (bso#15276);(bsc#1209483).
  * CVE-2023-0614: Access controlled AD LDAP attributes can be
    discovered  (bso#15270); (bsc#1209485).
  * CVE-2023-0922: Samba AD DC admin tool samba-tool sends
    passwords in cleartext(bso#15315);(bsc#1209481).
  * ldb wildcard matching makes excessive allocations;
    (bso#15331).
  * large_ldap test is inefficient; (bso#15332).
- Update to 4.18.0
  * SMB server performance improvements
  * More succinct samba-tool error messages
  * Color output with samba-tool --color
    The NO_COLOR environment variable will disable colour output
  * New samba-tool dsacl subcommand for deleting ACEs
  * New wbinfo option --change-secret-at
  * Net option to change the NT ACL default location
  * Azure AD / Office365 synchronization improvements</changelog>
  <changelog author="nopower@suse.com" date="1696939200">- CVE-2023-4091: samba: Client can truncate file with read-only
  permissions; (bsc#1215904); (bso#15439).
- CVE-2023-42669: samba: rpcecho, enabled and running in AD DC,
  allows blocking sleep on request; (bso#1215905); (bso#15474).
- CVE-2023-42670: samba:  The procedure number is out of range
  when starting Active Directory Users and Computers;
  (bsc#1215906); (bso#15473).
- CVE-2023-3961: samba: Unsanitized client pipe name passed to
  local_np_connect(); (bsc#1215907); (bso#15422).
- CVE-2023-4154: samba: dirsync allows SYSTEM access with only
  "GUID_DRS_GET_CHANGES" right, not "GUID_DRS_GET_ALL_CHANGES;
  (bsc#1215908); (bso#15424).</changelog>
  <changelog author="nopower@suse.com" date="1697112000">- use systemd-logind rather than utmp for y2038 safety;
  (bsc#1216159).</changelog>
  <changelog author="nopower@suse.com" date="1697457600">- Update to 4.19.2
  * Use-after-free in aio_del_req_from_fsp during smbd shutdown
    after failed IPC FSCTL_PIPE_TRANSCEIVE; (bso#15423).
  * clidfs.c do_connect() missing a "return" after a
    cli_shutdown() call; (bso#15426).
  * macOS mdfind returns only 50 results; (bso#15463).
  * GETREALFILENAME_CACHE can modify incoming new filename with
    previous cache entry value; (bso#15481).
  * libnss_winbind causes memory corruption since samba-4.18,
    impacts sendmail, zabbix, potentially more; (bso#15464).
  * ctdbd: setproctitle not initialized messages flooding logs;
    (bso#15479).
  * CVE-2023-5568 Heap buffer overflow with freshness tokens in
    the Heimdal KDC in Samba 4.19; (bso#15491).
  * The heimdal KDC doesn't detect s4u2self correctly when fast
    is in use; (bso#15477).</changelog>
  <changelog author="dmulder@suse.com" date="1698062400">- packaging: samba-tool domain provision requires python3-Markdown;
  (bsc#1216519).</changelog>
  <changelog author="nopower@suse.com" date="1701086400">- Update to 4.19.3
  * sid_strings test broken by unix epoch &gt; 1700000000;
    (bso#15520).
  * smbd crashes if asked to return full information on close of
    a stream handle with delete on close disposition set;
    (bso#15487).
  * smbd: fix close order of base_fsp and stream_fsp in
    smb_fname_fsp_destructor(); (bso#15521).
  * Improve logging for failover scenarios; (bso#15499).
  * Files without "read attributes" NFS4 ACL permission are not
    listed in directories; (bso#15093).
  * CVE-2018-14628 [SECURITY] Deleted Object tombstones visible
    in AD LDAP to normal users; (bso#13595).
  * Kerberos TGS-REQ with User2User does not work for normal
    accounts; (bso#15492).
  * vfs_gpfs stat calls fail due to file system permissions;
    (bso#15507).
  * Samba doesn't build with Python 3.12; (bso#15513).</changelog>
  <changelog author="nopower@suse.com" date="1704801600">- Update to 4.19.4
  * net changesecretpw cannot set the machine account password if
    secrets.tdb is empty; (bso#13577).
  * For generating doc, take, if defined, env XML_CATALOG_FILES;
    (bso#15540).
  * Trivial C typo in nsswitch/winbind_nss_netbsd.c; (bso#15541).
  * vfs_linux_xfs is incorrectly named; (bso#15542).
  * systemd stumbled over copyright-message at smbd startup;
    (bso#15377).
  * Following intermediate abolute share-local symlinks is
    broken; (bso#15505).
  * ctdb RELEASE_IP causes a crash in release_ip if a connection
    to a non-public address disconnects first; (bso#15523).
  * shadow_copy2 broken when current fileset's directories are
    removed; (bso#15544).
  * smbd does not detect ctdb public ipv6 addresses for
    multichannel exclusion; (bso#15534).
  * 'force user = localunixuser' doesn't work if 'allow trusted
    domains = no' is set; (bso#15469).
  * smbget debug logging doesn't work; (bso#15525).
  * smget: username in the smburl and interactive password entry
    doesn't work; (bso#15532).
  * smbget auth function doesn't set values for password prompt
    correctly; (bso#15538).
  * Unable to copy and write files from clients to Ceph cluster
    via SMB Linux gateway with Ceph VFS module; (bso#15440).
  * Multichannel refresh network information; (bso#15547).</changelog>
  <changelog author="nopower@suse.com" date="1704888000">- Remove -x from bash shebang update-apparmor-samba-profile;
  (bsc#1218431).</changelog>
  <changelog author="nopower@suse.com" date="1708430400">- Update to 4.19.5
  * Windows 2016 fails to restore previous version of a file from
    a shadow_copy2 snapshot; (bso#13688).
  * Symlinks on AIX are broken in 4.19 (and a few version before
    that); (bso#15549).
  * Fake directory create times has no effect; (bso#12421).
  * ctime mixed up with mtime by smbd; (bso#15550).
  * samba-gpupdate --rsop fails if machine is not in a site;
    (bso#15548).
  * gpupdate: The root cert import when NDES is not available is
    broken; (bso#15557).
  * samba-gpupdate should print a useful message if cepces-submit
    can't be found; (bso#15552).
  * samba-gpupdate logging doesn't work; (bso#15558).
  * smbpasswd reset permissions only if not 0600; (bso#15555).</changelog>
  <changelog author="nopower@suse.com" date="1718884800">- Update to 4.19.7
  * ldb qsort might r/w out of bounds with an intransitive
    compare function (ldb 2.8.1 is already released);
    (bso#15569).
  * Many qsort() comparison functions are non-transitive, which
    can lead to out-of-bounds access in some circumstances (ldb
    2.8.1 is already released); (bso#15625).
  * Need to change gitlab-ci.yml tags in all branches to avoid CI
    bill; (bso#15638).
  * netr_LogonSamLogonEx returns NR_STATUS_ACCESS_DENIED with
    SysvolReady=0; (bso#14981).
  * Anonymous smb3 signing/encryption should be allowed (similar
    to Windows Server 2022); (bso#15412).
  * Panic in dreplsrv_op_pull_source_apply_changes_trigger;
    (bso#15573).
  * winbindd, net ads join and other things don't work on an ipv6
    only host; (bso#15642).
  * Smbcacls incorrectly propagates inheritance with Inherit-Only
    flag; (bso#15636).
  * http library doesn't support  'chunked transfer encoding';
    (bso#15611).
- Update to 4.19.6
  * fd_handle_destructor() panics within an smbd_smb2_close() if
    vfs_stat_fsp() fails in fd_close(); (bso#15527).
  * samba-gpupdate: Correctly implement site support;
    (bso#15588).
  * libgpo: Segfault in python bindings; (bso#15599).
  * Packet marshalling push support missing for
    CTDB_CONTROL_TCP_CLIENT_DISCONNECTED and
    CTDB_CONTROL_TCP_CLIENT_PASSED; (bso#15580).</changelog>
  <changelog author="scabrero@suse.de" date="1722513600">- Fix a crash when joining offline and 'kerberos method' includes
  keytab; (bsc#1228732);
- Fix reading the password from STDIN or environment vars if it
  was already given in the command line; (bsc#1228732);</changelog>
</package>
<package pkgid="cab13ddbdb179cda7f2a87228265aac44c38bdf072166923a9a2b030fa8a684c" name="cups" arch="aarch64">
  <version epoch="0" ver="2.2.7" rel="150000.3.59.1"/>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
</package>
<package pkgid="abbeb8d64c6540b7c80cd8ccb2deacb222f7d34e46e4db6a09f234c90e5c5c68" name="cups" arch="ppc64le">
  <version epoch="0" ver="2.2.7" rel="150000.3.59.1"/>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
</package>
<package pkgid="90d0e164c24bcb13905a4231f3c9d7ecbb823b6dc9db5c7fcaf7a9a1c225a122" name="cups" arch="s390x">
  <version epoch="0" ver="2.2.7" rel="150000.3.59.1"/>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
</package>
<package pkgid="f15dc1bc53615d90177635645d45f2f5b9e9afd7168760ff3e554a4ce58ab83d" name="cups" arch="src">
  <version epoch="0" ver="2.2.7" rel="150000.3.59.1"/>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
</package>
<package pkgid="4c45d1354ef7f62d5e44b7404a9edbff6ba9ff667feccc410e8415f274add14a" name="cups" arch="x86_64">
  <version epoch="0" ver="2.2.7" rel="150000.3.59.1"/>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
</package>
<package pkgid="0bb385617e0b502d61f994692340fe1021bba183a0ee1f70232fe2bf7907e77c" name="cups" arch="aarch64">
  <version epoch="0" ver="2.2.7" rel="150000.3.62.1"/>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
  <changelog author="jsmeix@suse.com" date="1720526400">- Require the exact matching version-release of all libcups*
  sub-packages (bsc#1226192)</changelog>
</package>
<package pkgid="ac5814ab6630bc9a8b80ff95d046faca546475a48ed71a114db8c70f1dcf1e3f" name="cups" arch="ppc64le">
  <version epoch="0" ver="2.2.7" rel="150000.3.62.1"/>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
  <changelog author="jsmeix@suse.com" date="1720526400">- Require the exact matching version-release of all libcups*
  sub-packages (bsc#1226192)</changelog>
</package>
<package pkgid="458b233f9fb92b913441a10c8de77bafe508630320a0b8a3042a3f953ec8a807" name="cups" arch="s390x">
  <version epoch="0" ver="2.2.7" rel="150000.3.62.1"/>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
  <changelog author="jsmeix@suse.com" date="1720526400">- Require the exact matching version-release of all libcups*
  sub-packages (bsc#1226192)</changelog>
</package>
<package pkgid="4a2839e4c65ae8982b1dcf7eab4dbbbe80ebd8ca6a8687a6e0f60cd33953cec4" name="cups" arch="src">
  <version epoch="0" ver="2.2.7" rel="150000.3.62.1"/>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
  <changelog author="jsmeix@suse.com" date="1720526400">- Require the exact matching version-release of all libcups*
  sub-packages (bsc#1226192)</changelog>
</package>
<package pkgid="8da1ebbc3a6b5b4d1132a2df35057de63c51828059cf3c0c79b1c732477544e0" name="cups" arch="x86_64">
  <version epoch="0" ver="2.2.7" rel="150000.3.62.1"/>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
  <changelog author="jsmeix@suse.com" date="1720526400">- Require the exact matching version-release of all libcups*
  sub-packages (bsc#1226192)</changelog>
</package>
<package pkgid="1626c51493409f8e5dd2cc48900dafc39fc92b998b36150f3d4c63ab27e88f5e" name="cups" arch="aarch64">
  <version epoch="0" ver="2.2.7" rel="150000.3.65.1"/>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
  <changelog author="jsmeix@suse.com" date="1720526400">- Require the exact matching version-release of all libcups*
  sub-packages (bsc#1226192)</changelog>
  <changelog author="jsmeix@suse.com" date="1724155200">- cups-branch-2.2-commit-b643d6ba92f00752aa5e74ff86ad3974334914c1.diff
  is https://github.com/OpenPrinting/cups/commit/b643d6ba92f00752aa5e74ff86ad3974334914c1
  which was added in CUPS 2.2.8 that
  fixed a parsing bug in cups_auth_find() in cups/auth.c
  which lead to cupsd failing to authenticate users
  when group membership is required by cupsd configuration
  like 'Require user @GROUP' which lead to CUPS related commands
  requesting password from group users even if it is not needed
  (bsc#1226227)
- In cups.changes replaced one place where UTF-8 characters
  were used in the entry dated "Sat Sep 30 08:52:42 UTC 2017"
  for what should be ' - ' by ASCII to avoid RPMLINT warning
  about 'non-break-space' which "can lead to obscure errors".</changelog>
</package>
<package pkgid="cf2b76848fc95f1ab01219b7a9faf646808dcfa438b6160c0110b984bbfe6caf" name="cups" arch="ppc64le">
  <version epoch="0" ver="2.2.7" rel="150000.3.65.1"/>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
  <changelog author="jsmeix@suse.com" date="1720526400">- Require the exact matching version-release of all libcups*
  sub-packages (bsc#1226192)</changelog>
  <changelog author="jsmeix@suse.com" date="1724155200">- cups-branch-2.2-commit-b643d6ba92f00752aa5e74ff86ad3974334914c1.diff
  is https://github.com/OpenPrinting/cups/commit/b643d6ba92f00752aa5e74ff86ad3974334914c1
  which was added in CUPS 2.2.8 that
  fixed a parsing bug in cups_auth_find() in cups/auth.c
  which lead to cupsd failing to authenticate users
  when group membership is required by cupsd configuration
  like 'Require user @GROUP' which lead to CUPS related commands
  requesting password from group users even if it is not needed
  (bsc#1226227)
- In cups.changes replaced one place where UTF-8 characters
  were used in the entry dated "Sat Sep 30 08:52:42 UTC 2017"
  for what should be ' - ' by ASCII to avoid RPMLINT warning
  about 'non-break-space' which "can lead to obscure errors".</changelog>
</package>
<package pkgid="127a8b8bf632a0e8a324d4e911e611d1247a02771e50a28a76c90dd4633d7dfd" name="cups" arch="s390x">
  <version epoch="0" ver="2.2.7" rel="150000.3.65.1"/>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
  <changelog author="jsmeix@suse.com" date="1720526400">- Require the exact matching version-release of all libcups*
  sub-packages (bsc#1226192)</changelog>
  <changelog author="jsmeix@suse.com" date="1724155200">- cups-branch-2.2-commit-b643d6ba92f00752aa5e74ff86ad3974334914c1.diff
  is https://github.com/OpenPrinting/cups/commit/b643d6ba92f00752aa5e74ff86ad3974334914c1
  which was added in CUPS 2.2.8 that
  fixed a parsing bug in cups_auth_find() in cups/auth.c
  which lead to cupsd failing to authenticate users
  when group membership is required by cupsd configuration
  like 'Require user @GROUP' which lead to CUPS related commands
  requesting password from group users even if it is not needed
  (bsc#1226227)
- In cups.changes replaced one place where UTF-8 characters
  were used in the entry dated "Sat Sep 30 08:52:42 UTC 2017"
  for what should be ' - ' by ASCII to avoid RPMLINT warning
  about 'non-break-space' which "can lead to obscure errors".</changelog>
</package>
<package pkgid="32e8fd322e0ec4abd9f3ae595d90200a1b6c138dee718936fd5f717f1129ff66" name="cups" arch="src">
  <version epoch="0" ver="2.2.7" rel="150000.3.65.1"/>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
  <changelog author="jsmeix@suse.com" date="1720526400">- Require the exact matching version-release of all libcups*
  sub-packages (bsc#1226192)</changelog>
  <changelog author="jsmeix@suse.com" date="1724155200">- cups-branch-2.2-commit-b643d6ba92f00752aa5e74ff86ad3974334914c1.diff
  is https://github.com/OpenPrinting/cups/commit/b643d6ba92f00752aa5e74ff86ad3974334914c1
  which was added in CUPS 2.2.8 that
  fixed a parsing bug in cups_auth_find() in cups/auth.c
  which lead to cupsd failing to authenticate users
  when group membership is required by cupsd configuration
  like 'Require user @GROUP' which lead to CUPS related commands
  requesting password from group users even if it is not needed
  (bsc#1226227)
- In cups.changes replaced one place where UTF-8 characters
  were used in the entry dated "Sat Sep 30 08:52:42 UTC 2017"
  for what should be ' - ' by ASCII to avoid RPMLINT warning
  about 'non-break-space' which "can lead to obscure errors".</changelog>
</package>
<package pkgid="9cbc9827b006af036590f5301558ab9eb11f15773f570311c4c07f6ca9e9daab" name="cups" arch="x86_64">
  <version epoch="0" ver="2.2.7" rel="150000.3.65.1"/>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
  <changelog author="jsmeix@suse.com" date="1720526400">- Require the exact matching version-release of all libcups*
  sub-packages (bsc#1226192)</changelog>
  <changelog author="jsmeix@suse.com" date="1724155200">- cups-branch-2.2-commit-b643d6ba92f00752aa5e74ff86ad3974334914c1.diff
  is https://github.com/OpenPrinting/cups/commit/b643d6ba92f00752aa5e74ff86ad3974334914c1
  which was added in CUPS 2.2.8 that
  fixed a parsing bug in cups_auth_find() in cups/auth.c
  which lead to cupsd failing to authenticate users
  when group membership is required by cupsd configuration
  like 'Require user @GROUP' which lead to CUPS related commands
  requesting password from group users even if it is not needed
  (bsc#1226227)
- In cups.changes replaced one place where UTF-8 characters
  were used in the entry dated "Sat Sep 30 08:52:42 UTC 2017"
  for what should be ' - ' by ASCII to avoid RPMLINT warning
  about 'non-break-space' which "can lead to obscure errors".</changelog>
</package>
<package pkgid="14c73dbdcfd91034391f21e0ad3b471037a7b4562a4e6d489edf8a9328ff4608" name="cups-client" arch="aarch64">
  <version epoch="0" ver="2.2.7" rel="150000.3.59.1"/>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
</package>
<package pkgid="07261d231461794784124f4eccb3e0e59f26f2468853291c959ca2ef0a8c617f" name="cups-client" arch="ppc64le">
  <version epoch="0" ver="2.2.7" rel="150000.3.59.1"/>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
</package>
<package pkgid="548c3f1c0f221219691dde1c95e26d44bfe5219fac0d5f048744fae1d8e2d67c" name="cups-client" arch="s390x">
  <version epoch="0" ver="2.2.7" rel="150000.3.59.1"/>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
</package>
<package pkgid="2dfb8cc2bdd2b71d55b590ab76fbce8960ba4d9411ef2f0148dbaeff84573e6f" name="cups-client" arch="x86_64">
  <version epoch="0" ver="2.2.7" rel="150000.3.59.1"/>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
</package>
<package pkgid="886c56b0f2eb25f4a46b19a6681560c49b3532d8370b240c25e5d6bf541e0830" name="cups-client" arch="aarch64">
  <version epoch="0" ver="2.2.7" rel="150000.3.62.1"/>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
  <changelog author="jsmeix@suse.com" date="1720526400">- Require the exact matching version-release of all libcups*
  sub-packages (bsc#1226192)</changelog>
</package>
<package pkgid="af2387f146ed65dd4b964ad7ffed76f7c012abd34ec0c6a1fa05a7278bb6ca7b" name="cups-client" arch="ppc64le">
  <version epoch="0" ver="2.2.7" rel="150000.3.62.1"/>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
  <changelog author="jsmeix@suse.com" date="1720526400">- Require the exact matching version-release of all libcups*
  sub-packages (bsc#1226192)</changelog>
</package>
<package pkgid="200a6686bd987edca5c519e7830ce512c99702fceb8a95b597611c18c6f7af0e" name="cups-client" arch="s390x">
  <version epoch="0" ver="2.2.7" rel="150000.3.62.1"/>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
  <changelog author="jsmeix@suse.com" date="1720526400">- Require the exact matching version-release of all libcups*
  sub-packages (bsc#1226192)</changelog>
</package>
<package pkgid="721d1cb32e7035ab6d4e29cbff42142c9e3d180969ede4d5a4bb335f09e05685" name="cups-client" arch="x86_64">
  <version epoch="0" ver="2.2.7" rel="150000.3.62.1"/>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
  <changelog author="jsmeix@suse.com" date="1720526400">- Require the exact matching version-release of all libcups*
  sub-packages (bsc#1226192)</changelog>
</package>
<package pkgid="02f46b366823b0dd40236f1291b4f9e23cbcf5a3c07334a98d9671b913d80798" name="cups-client" arch="aarch64">
  <version epoch="0" ver="2.2.7" rel="150000.3.65.1"/>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
  <changelog author="jsmeix@suse.com" date="1720526400">- Require the exact matching version-release of all libcups*
  sub-packages (bsc#1226192)</changelog>
  <changelog author="jsmeix@suse.com" date="1724155200">- cups-branch-2.2-commit-b643d6ba92f00752aa5e74ff86ad3974334914c1.diff
  is https://github.com/OpenPrinting/cups/commit/b643d6ba92f00752aa5e74ff86ad3974334914c1
  which was added in CUPS 2.2.8 that
  fixed a parsing bug in cups_auth_find() in cups/auth.c
  which lead to cupsd failing to authenticate users
  when group membership is required by cupsd configuration
  like 'Require user @GROUP' which lead to CUPS related commands
  requesting password from group users even if it is not needed
  (bsc#1226227)
- In cups.changes replaced one place where UTF-8 characters
  were used in the entry dated "Sat Sep 30 08:52:42 UTC 2017"
  for what should be ' - ' by ASCII to avoid RPMLINT warning
  about 'non-break-space' which "can lead to obscure errors".</changelog>
</package>
<package pkgid="c55a91c43690676a858e9e49180f08c130b7386aaedcf9e034b9de0b28dc9dba" name="cups-client" arch="ppc64le">
  <version epoch="0" ver="2.2.7" rel="150000.3.65.1"/>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
  <changelog author="jsmeix@suse.com" date="1720526400">- Require the exact matching version-release of all libcups*
  sub-packages (bsc#1226192)</changelog>
  <changelog author="jsmeix@suse.com" date="1724155200">- cups-branch-2.2-commit-b643d6ba92f00752aa5e74ff86ad3974334914c1.diff
  is https://github.com/OpenPrinting/cups/commit/b643d6ba92f00752aa5e74ff86ad3974334914c1
  which was added in CUPS 2.2.8 that
  fixed a parsing bug in cups_auth_find() in cups/auth.c
  which lead to cupsd failing to authenticate users
  when group membership is required by cupsd configuration
  like 'Require user @GROUP' which lead to CUPS related commands
  requesting password from group users even if it is not needed
  (bsc#1226227)
- In cups.changes replaced one place where UTF-8 characters
  were used in the entry dated "Sat Sep 30 08:52:42 UTC 2017"
  for what should be ' - ' by ASCII to avoid RPMLINT warning
  about 'non-break-space' which "can lead to obscure errors".</changelog>
</package>
<package pkgid="31dc54b8bdfa452effa43157d8c0ba0c309f8a2e7e75e88ad6adb80365fd50f3" name="cups-client" arch="s390x">
  <version epoch="0" ver="2.2.7" rel="150000.3.65.1"/>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
  <changelog author="jsmeix@suse.com" date="1720526400">- Require the exact matching version-release of all libcups*
  sub-packages (bsc#1226192)</changelog>
  <changelog author="jsmeix@suse.com" date="1724155200">- cups-branch-2.2-commit-b643d6ba92f00752aa5e74ff86ad3974334914c1.diff
  is https://github.com/OpenPrinting/cups/commit/b643d6ba92f00752aa5e74ff86ad3974334914c1
  which was added in CUPS 2.2.8 that
  fixed a parsing bug in cups_auth_find() in cups/auth.c
  which lead to cupsd failing to authenticate users
  when group membership is required by cupsd configuration
  like 'Require user @GROUP' which lead to CUPS related commands
  requesting password from group users even if it is not needed
  (bsc#1226227)
- In cups.changes replaced one place where UTF-8 characters
  were used in the entry dated "Sat Sep 30 08:52:42 UTC 2017"
  for what should be ' - ' by ASCII to avoid RPMLINT warning
  about 'non-break-space' which "can lead to obscure errors".</changelog>
</package>
<package pkgid="fc64780f09792fd1ece72cded9df98c87df450b8d4da81a19a5c006732dce5df" name="cups-client" arch="x86_64">
  <version epoch="0" ver="2.2.7" rel="150000.3.65.1"/>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
  <changelog author="jsmeix@suse.com" date="1720526400">- Require the exact matching version-release of all libcups*
  sub-packages (bsc#1226192)</changelog>
  <changelog author="jsmeix@suse.com" date="1724155200">- cups-branch-2.2-commit-b643d6ba92f00752aa5e74ff86ad3974334914c1.diff
  is https://github.com/OpenPrinting/cups/commit/b643d6ba92f00752aa5e74ff86ad3974334914c1
  which was added in CUPS 2.2.8 that
  fixed a parsing bug in cups_auth_find() in cups/auth.c
  which lead to cupsd failing to authenticate users
  when group membership is required by cupsd configuration
  like 'Require user @GROUP' which lead to CUPS related commands
  requesting password from group users even if it is not needed
  (bsc#1226227)
- In cups.changes replaced one place where UTF-8 characters
  were used in the entry dated "Sat Sep 30 08:52:42 UTC 2017"
  for what should be ' - ' by ASCII to avoid RPMLINT warning
  about 'non-break-space' which "can lead to obscure errors".</changelog>
</package>
<package pkgid="af16e93da1941e5201a4d1f96ced71272fb05dd6e458e0e786442f34dbfa7b11" name="cups-config" arch="aarch64">
  <version epoch="0" ver="2.2.7" rel="150000.3.59.1"/>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
</package>
<package pkgid="85615fc634a2f973081396265521de4012cf2dc137fd7396738aec798a4cbe25" name="cups-config" arch="ppc64le">
  <version epoch="0" ver="2.2.7" rel="150000.3.59.1"/>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
</package>
<package pkgid="5a849ee56e6cf9885b31916838c6e6cb87d2b08c4ca7a5b92424cfd40417493d" name="cups-config" arch="s390x">
  <version epoch="0" ver="2.2.7" rel="150000.3.59.1"/>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
</package>
<package pkgid="b057017f02db924ac7c9377191ff2588574938273d5533daf8e17f2238e8d501" name="cups-config" arch="x86_64">
  <version epoch="0" ver="2.2.7" rel="150000.3.59.1"/>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
</package>
<package pkgid="425a24564d9c7c76d60eeda9d4aa34324b5f143366091dd6ac820bf59e9dfbdc" name="cups-config" arch="aarch64">
  <version epoch="0" ver="2.2.7" rel="150000.3.62.1"/>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
  <changelog author="jsmeix@suse.com" date="1720526400">- Require the exact matching version-release of all libcups*
  sub-packages (bsc#1226192)</changelog>
</package>
<package pkgid="b8dc60cb46ca4eb3d4e3366de544bb65d02045921fd804b2f586d98e3be199cf" name="cups-config" arch="ppc64le">
  <version epoch="0" ver="2.2.7" rel="150000.3.62.1"/>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
  <changelog author="jsmeix@suse.com" date="1720526400">- Require the exact matching version-release of all libcups*
  sub-packages (bsc#1226192)</changelog>
</package>
<package pkgid="11de6987d4099ea08667654c6ecbee003ca21a153825318fb57418d266975331" name="cups-config" arch="s390x">
  <version epoch="0" ver="2.2.7" rel="150000.3.62.1"/>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
  <changelog author="jsmeix@suse.com" date="1720526400">- Require the exact matching version-release of all libcups*
  sub-packages (bsc#1226192)</changelog>
</package>
<package pkgid="ac97f81659c354958974a63aa981a7ed4867181c6660d8678ed5edf3917d85d1" name="cups-config" arch="x86_64">
  <version epoch="0" ver="2.2.7" rel="150000.3.62.1"/>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
  <changelog author="jsmeix@suse.com" date="1720526400">- Require the exact matching version-release of all libcups*
  sub-packages (bsc#1226192)</changelog>
</package>
<package pkgid="b41c8c7e939f492d66f1548933545dee574d343187dea7b06585a5d893df5fb7" name="cups-config" arch="aarch64">
  <version epoch="0" ver="2.2.7" rel="150000.3.65.1"/>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
  <changelog author="jsmeix@suse.com" date="1720526400">- Require the exact matching version-release of all libcups*
  sub-packages (bsc#1226192)</changelog>
  <changelog author="jsmeix@suse.com" date="1724155200">- cups-branch-2.2-commit-b643d6ba92f00752aa5e74ff86ad3974334914c1.diff
  is https://github.com/OpenPrinting/cups/commit/b643d6ba92f00752aa5e74ff86ad3974334914c1
  which was added in CUPS 2.2.8 that
  fixed a parsing bug in cups_auth_find() in cups/auth.c
  which lead to cupsd failing to authenticate users
  when group membership is required by cupsd configuration
  like 'Require user @GROUP' which lead to CUPS related commands
  requesting password from group users even if it is not needed
  (bsc#1226227)
- In cups.changes replaced one place where UTF-8 characters
  were used in the entry dated "Sat Sep 30 08:52:42 UTC 2017"
  for what should be ' - ' by ASCII to avoid RPMLINT warning
  about 'non-break-space' which "can lead to obscure errors".</changelog>
</package>
<package pkgid="698027b9ecef7132ffaf0ddd7ce247e5404cc7620f9882836cd7baa5c5ecdf7a" name="cups-config" arch="ppc64le">
  <version epoch="0" ver="2.2.7" rel="150000.3.65.1"/>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
  <changelog author="jsmeix@suse.com" date="1720526400">- Require the exact matching version-release of all libcups*
  sub-packages (bsc#1226192)</changelog>
  <changelog author="jsmeix@suse.com" date="1724155200">- cups-branch-2.2-commit-b643d6ba92f00752aa5e74ff86ad3974334914c1.diff
  is https://github.com/OpenPrinting/cups/commit/b643d6ba92f00752aa5e74ff86ad3974334914c1
  which was added in CUPS 2.2.8 that
  fixed a parsing bug in cups_auth_find() in cups/auth.c
  which lead to cupsd failing to authenticate users
  when group membership is required by cupsd configuration
  like 'Require user @GROUP' which lead to CUPS related commands
  requesting password from group users even if it is not needed
  (bsc#1226227)
- In cups.changes replaced one place where UTF-8 characters
  were used in the entry dated "Sat Sep 30 08:52:42 UTC 2017"
  for what should be ' - ' by ASCII to avoid RPMLINT warning
  about 'non-break-space' which "can lead to obscure errors".</changelog>
</package>
<package pkgid="09ff925da348d29a59158431aa713604068e905f972d3510c9935610d4ff2ed6" name="cups-config" arch="s390x">
  <version epoch="0" ver="2.2.7" rel="150000.3.65.1"/>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
  <changelog author="jsmeix@suse.com" date="1720526400">- Require the exact matching version-release of all libcups*
  sub-packages (bsc#1226192)</changelog>
  <changelog author="jsmeix@suse.com" date="1724155200">- cups-branch-2.2-commit-b643d6ba92f00752aa5e74ff86ad3974334914c1.diff
  is https://github.com/OpenPrinting/cups/commit/b643d6ba92f00752aa5e74ff86ad3974334914c1
  which was added in CUPS 2.2.8 that
  fixed a parsing bug in cups_auth_find() in cups/auth.c
  which lead to cupsd failing to authenticate users
  when group membership is required by cupsd configuration
  like 'Require user @GROUP' which lead to CUPS related commands
  requesting password from group users even if it is not needed
  (bsc#1226227)
- In cups.changes replaced one place where UTF-8 characters
  were used in the entry dated "Sat Sep 30 08:52:42 UTC 2017"
  for what should be ' - ' by ASCII to avoid RPMLINT warning
  about 'non-break-space' which "can lead to obscure errors".</changelog>
</package>
<package pkgid="4114193bf0c3b1fa6c0c1dd86b7c62ca07597a3c57c11ebe5d40865bcccc4e4f" name="cups-config" arch="x86_64">
  <version epoch="0" ver="2.2.7" rel="150000.3.65.1"/>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
  <changelog author="jsmeix@suse.com" date="1720526400">- Require the exact matching version-release of all libcups*
  sub-packages (bsc#1226192)</changelog>
  <changelog author="jsmeix@suse.com" date="1724155200">- cups-branch-2.2-commit-b643d6ba92f00752aa5e74ff86ad3974334914c1.diff
  is https://github.com/OpenPrinting/cups/commit/b643d6ba92f00752aa5e74ff86ad3974334914c1
  which was added in CUPS 2.2.8 that
  fixed a parsing bug in cups_auth_find() in cups/auth.c
  which lead to cupsd failing to authenticate users
  when group membership is required by cupsd configuration
  like 'Require user @GROUP' which lead to CUPS related commands
  requesting password from group users even if it is not needed
  (bsc#1226227)
- In cups.changes replaced one place where UTF-8 characters
  were used in the entry dated "Sat Sep 30 08:52:42 UTC 2017"
  for what should be ' - ' by ASCII to avoid RPMLINT warning
  about 'non-break-space' which "can lead to obscure errors".</changelog>
</package>
<package pkgid="ffa6adca6805ecffa1686f53cc6363da8cef73279782b292166b79b8b01f6578" name="cups-ddk" arch="aarch64">
  <version epoch="0" ver="2.2.7" rel="150000.3.59.1"/>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
</package>
<package pkgid="e5c2cf612b0b5c0e34b02d28721274a12d3b78231d03d35adbe03edb07c50360" name="cups-ddk" arch="ppc64le">
  <version epoch="0" ver="2.2.7" rel="150000.3.59.1"/>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
</package>
<package pkgid="6af6d19379fdf92969298fc0deb7977cb9c7ba41e4d0d57b5b5c370eb4bc8449" name="cups-ddk" arch="s390x">
  <version epoch="0" ver="2.2.7" rel="150000.3.59.1"/>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
</package>
<package pkgid="72c3b499fc2eb8f7dc21064b683412b5924f7a000bf8ea843ea97ec0aeca0773" name="cups-ddk" arch="x86_64">
  <version epoch="0" ver="2.2.7" rel="150000.3.59.1"/>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
</package>
<package pkgid="3de94d82fd1db4a8db28c6c83194d1b4a1cc0a7f3f23f663af59407c82611c3b" name="cups-ddk" arch="aarch64">
  <version epoch="0" ver="2.2.7" rel="150000.3.62.1"/>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
  <changelog author="jsmeix@suse.com" date="1720526400">- Require the exact matching version-release of all libcups*
  sub-packages (bsc#1226192)</changelog>
</package>
<package pkgid="80265f3533080c470293500256e24ea8b6fccb2dd14e5638caca8f7b740e3e3c" name="cups-ddk" arch="ppc64le">
  <version epoch="0" ver="2.2.7" rel="150000.3.62.1"/>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
  <changelog author="jsmeix@suse.com" date="1720526400">- Require the exact matching version-release of all libcups*
  sub-packages (bsc#1226192)</changelog>
</package>
<package pkgid="aabe57036cc0cf1943c9def47e14468ec41a030b4e55f9bd82eec669d242cb04" name="cups-ddk" arch="s390x">
  <version epoch="0" ver="2.2.7" rel="150000.3.62.1"/>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
  <changelog author="jsmeix@suse.com" date="1720526400">- Require the exact matching version-release of all libcups*
  sub-packages (bsc#1226192)</changelog>
</package>
<package pkgid="77976fc3629017a3b2e68c443600e4351472214fc33d9d9a44fc37f011a292ee" name="cups-ddk" arch="x86_64">
  <version epoch="0" ver="2.2.7" rel="150000.3.62.1"/>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
  <changelog author="jsmeix@suse.com" date="1720526400">- Require the exact matching version-release of all libcups*
  sub-packages (bsc#1226192)</changelog>
</package>
<package pkgid="00f1829351799f8afc9e04d86d4f01752918cdd12b6b7555566ab0c247e2a623" name="cups-ddk" arch="aarch64">
  <version epoch="0" ver="2.2.7" rel="150000.3.65.1"/>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
  <changelog author="jsmeix@suse.com" date="1720526400">- Require the exact matching version-release of all libcups*
  sub-packages (bsc#1226192)</changelog>
  <changelog author="jsmeix@suse.com" date="1724155200">- cups-branch-2.2-commit-b643d6ba92f00752aa5e74ff86ad3974334914c1.diff
  is https://github.com/OpenPrinting/cups/commit/b643d6ba92f00752aa5e74ff86ad3974334914c1
  which was added in CUPS 2.2.8 that
  fixed a parsing bug in cups_auth_find() in cups/auth.c
  which lead to cupsd failing to authenticate users
  when group membership is required by cupsd configuration
  like 'Require user @GROUP' which lead to CUPS related commands
  requesting password from group users even if it is not needed
  (bsc#1226227)
- In cups.changes replaced one place where UTF-8 characters
  were used in the entry dated "Sat Sep 30 08:52:42 UTC 2017"
  for what should be ' - ' by ASCII to avoid RPMLINT warning
  about 'non-break-space' which "can lead to obscure errors".</changelog>
</package>
<package pkgid="0fcc7f29d78dc2efba6fb154e649b678f66e842ed7ee6f5bea17334688673dd9" name="cups-ddk" arch="ppc64le">
  <version epoch="0" ver="2.2.7" rel="150000.3.65.1"/>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
  <changelog author="jsmeix@suse.com" date="1720526400">- Require the exact matching version-release of all libcups*
  sub-packages (bsc#1226192)</changelog>
  <changelog author="jsmeix@suse.com" date="1724155200">- cups-branch-2.2-commit-b643d6ba92f00752aa5e74ff86ad3974334914c1.diff
  is https://github.com/OpenPrinting/cups/commit/b643d6ba92f00752aa5e74ff86ad3974334914c1
  which was added in CUPS 2.2.8 that
  fixed a parsing bug in cups_auth_find() in cups/auth.c
  which lead to cupsd failing to authenticate users
  when group membership is required by cupsd configuration
  like 'Require user @GROUP' which lead to CUPS related commands
  requesting password from group users even if it is not needed
  (bsc#1226227)
- In cups.changes replaced one place where UTF-8 characters
  were used in the entry dated "Sat Sep 30 08:52:42 UTC 2017"
  for what should be ' - ' by ASCII to avoid RPMLINT warning
  about 'non-break-space' which "can lead to obscure errors".</changelog>
</package>
<package pkgid="5bcb39ff5390673af2c745f82557f313044f854043e0c916f906103627a6113c" name="cups-ddk" arch="s390x">
  <version epoch="0" ver="2.2.7" rel="150000.3.65.1"/>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
  <changelog author="jsmeix@suse.com" date="1720526400">- Require the exact matching version-release of all libcups*
  sub-packages (bsc#1226192)</changelog>
  <changelog author="jsmeix@suse.com" date="1724155200">- cups-branch-2.2-commit-b643d6ba92f00752aa5e74ff86ad3974334914c1.diff
  is https://github.com/OpenPrinting/cups/commit/b643d6ba92f00752aa5e74ff86ad3974334914c1
  which was added in CUPS 2.2.8 that
  fixed a parsing bug in cups_auth_find() in cups/auth.c
  which lead to cupsd failing to authenticate users
  when group membership is required by cupsd configuration
  like 'Require user @GROUP' which lead to CUPS related commands
  requesting password from group users even if it is not needed
  (bsc#1226227)
- In cups.changes replaced one place where UTF-8 characters
  were used in the entry dated "Sat Sep 30 08:52:42 UTC 2017"
  for what should be ' - ' by ASCII to avoid RPMLINT warning
  about 'non-break-space' which "can lead to obscure errors".</changelog>
</package>
<package pkgid="af66432e28463698645339fbaafcc2827e4cc03cdeb451674019c66049d0601e" name="cups-ddk" arch="x86_64">
  <version epoch="0" ver="2.2.7" rel="150000.3.65.1"/>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
  <changelog author="jsmeix@suse.com" date="1720526400">- Require the exact matching version-release of all libcups*
  sub-packages (bsc#1226192)</changelog>
  <changelog author="jsmeix@suse.com" date="1724155200">- cups-branch-2.2-commit-b643d6ba92f00752aa5e74ff86ad3974334914c1.diff
  is https://github.com/OpenPrinting/cups/commit/b643d6ba92f00752aa5e74ff86ad3974334914c1
  which was added in CUPS 2.2.8 that
  fixed a parsing bug in cups_auth_find() in cups/auth.c
  which lead to cupsd failing to authenticate users
  when group membership is required by cupsd configuration
  like 'Require user @GROUP' which lead to CUPS related commands
  requesting password from group users even if it is not needed
  (bsc#1226227)
- In cups.changes replaced one place where UTF-8 characters
  were used in the entry dated "Sat Sep 30 08:52:42 UTC 2017"
  for what should be ' - ' by ASCII to avoid RPMLINT warning
  about 'non-break-space' which "can lead to obscure errors".</changelog>
</package>
<package pkgid="59358ceb4292ba463aade6e469578968b17f69e4d503bd074ee1c0ca44ae0402" name="cups-devel" arch="aarch64">
  <version epoch="0" ver="2.2.7" rel="150000.3.59.1"/>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
</package>
<package pkgid="1b16d648edbb95bf5f7a5d4f0d6eed7d9cafdee06954c3e0e3774759ddc02a77" name="cups-devel" arch="ppc64le">
  <version epoch="0" ver="2.2.7" rel="150000.3.59.1"/>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
</package>
<package pkgid="278dd2dcb079d4218b45c2b048627e879c85c5923986398b29f720ce88a84d02" name="cups-devel" arch="s390x">
  <version epoch="0" ver="2.2.7" rel="150000.3.59.1"/>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
</package>
<package pkgid="dd55c0e31227341aabdcaef9f661e958a4a77897bda05acfcc0c6057e9b2f2cc" name="cups-devel" arch="x86_64">
  <version epoch="0" ver="2.2.7" rel="150000.3.59.1"/>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
</package>
<package pkgid="6666d23a3be9c08751117f2ff9218aac63e008c3371b41ff2f1f87f0a9d98abe" name="cups-devel" arch="aarch64">
  <version epoch="0" ver="2.2.7" rel="150000.3.62.1"/>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
  <changelog author="jsmeix@suse.com" date="1720526400">- Require the exact matching version-release of all libcups*
  sub-packages (bsc#1226192)</changelog>
</package>
<package pkgid="3030b69abc8850ad67e5d22916c5943df97bd97628fb493123aecd923211d1a9" name="cups-devel" arch="ppc64le">
  <version epoch="0" ver="2.2.7" rel="150000.3.62.1"/>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
  <changelog author="jsmeix@suse.com" date="1720526400">- Require the exact matching version-release of all libcups*
  sub-packages (bsc#1226192)</changelog>
</package>
<package pkgid="172bb9c011eb0b96ec25d3f83b21fe67d90da1d230cfcfe82c73e07a468a1227" name="cups-devel" arch="s390x">
  <version epoch="0" ver="2.2.7" rel="150000.3.62.1"/>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
  <changelog author="jsmeix@suse.com" date="1720526400">- Require the exact matching version-release of all libcups*
  sub-packages (bsc#1226192)</changelog>
</package>
<package pkgid="f9892e170b03c1b024750591d50b9ea3e597a81ad270b2ae98aecf3daa97ea2d" name="cups-devel" arch="x86_64">
  <version epoch="0" ver="2.2.7" rel="150000.3.62.1"/>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
  <changelog author="jsmeix@suse.com" date="1720526400">- Require the exact matching version-release of all libcups*
  sub-packages (bsc#1226192)</changelog>
</package>
<package pkgid="777ac9a9aaebdc0d87636907b9c27fe644dbf18882ab2685a9da1daecf702a0b" name="cups-devel" arch="aarch64">
  <version epoch="0" ver="2.2.7" rel="150000.3.65.1"/>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
  <changelog author="jsmeix@suse.com" date="1720526400">- Require the exact matching version-release of all libcups*
  sub-packages (bsc#1226192)</changelog>
  <changelog author="jsmeix@suse.com" date="1724155200">- cups-branch-2.2-commit-b643d6ba92f00752aa5e74ff86ad3974334914c1.diff
  is https://github.com/OpenPrinting/cups/commit/b643d6ba92f00752aa5e74ff86ad3974334914c1
  which was added in CUPS 2.2.8 that
  fixed a parsing bug in cups_auth_find() in cups/auth.c
  which lead to cupsd failing to authenticate users
  when group membership is required by cupsd configuration
  like 'Require user @GROUP' which lead to CUPS related commands
  requesting password from group users even if it is not needed
  (bsc#1226227)
- In cups.changes replaced one place where UTF-8 characters
  were used in the entry dated "Sat Sep 30 08:52:42 UTC 2017"
  for what should be ' - ' by ASCII to avoid RPMLINT warning
  about 'non-break-space' which "can lead to obscure errors".</changelog>
</package>
<package pkgid="5a992686abec068eab57a942e81a3202614e5b3b2e14dfbe47c456aaba51ad3a" name="cups-devel" arch="ppc64le">
  <version epoch="0" ver="2.2.7" rel="150000.3.65.1"/>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
  <changelog author="jsmeix@suse.com" date="1720526400">- Require the exact matching version-release of all libcups*
  sub-packages (bsc#1226192)</changelog>
  <changelog author="jsmeix@suse.com" date="1724155200">- cups-branch-2.2-commit-b643d6ba92f00752aa5e74ff86ad3974334914c1.diff
  is https://github.com/OpenPrinting/cups/commit/b643d6ba92f00752aa5e74ff86ad3974334914c1
  which was added in CUPS 2.2.8 that
  fixed a parsing bug in cups_auth_find() in cups/auth.c
  which lead to cupsd failing to authenticate users
  when group membership is required by cupsd configuration
  like 'Require user @GROUP' which lead to CUPS related commands
  requesting password from group users even if it is not needed
  (bsc#1226227)
- In cups.changes replaced one place where UTF-8 characters
  were used in the entry dated "Sat Sep 30 08:52:42 UTC 2017"
  for what should be ' - ' by ASCII to avoid RPMLINT warning
  about 'non-break-space' which "can lead to obscure errors".</changelog>
</package>
<package pkgid="ffba4668af4c2426dbde7514310462fc6026de3156d53814f614273fdc680e5f" name="cups-devel" arch="s390x">
  <version epoch="0" ver="2.2.7" rel="150000.3.65.1"/>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
  <changelog author="jsmeix@suse.com" date="1720526400">- Require the exact matching version-release of all libcups*
  sub-packages (bsc#1226192)</changelog>
  <changelog author="jsmeix@suse.com" date="1724155200">- cups-branch-2.2-commit-b643d6ba92f00752aa5e74ff86ad3974334914c1.diff
  is https://github.com/OpenPrinting/cups/commit/b643d6ba92f00752aa5e74ff86ad3974334914c1
  which was added in CUPS 2.2.8 that
  fixed a parsing bug in cups_auth_find() in cups/auth.c
  which lead to cupsd failing to authenticate users
  when group membership is required by cupsd configuration
  like 'Require user @GROUP' which lead to CUPS related commands
  requesting password from group users even if it is not needed
  (bsc#1226227)
- In cups.changes replaced one place where UTF-8 characters
  were used in the entry dated "Sat Sep 30 08:52:42 UTC 2017"
  for what should be ' - ' by ASCII to avoid RPMLINT warning
  about 'non-break-space' which "can lead to obscure errors".</changelog>
</package>
<package pkgid="9cf1d4fe9751ed60eea1290a50d50c871ef15cfa56b821ca309b661a0369517a" name="cups-devel" arch="x86_64">
  <version epoch="0" ver="2.2.7" rel="150000.3.65.1"/>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
  <changelog author="jsmeix@suse.com" date="1720526400">- Require the exact matching version-release of all libcups*
  sub-packages (bsc#1226192)</changelog>
  <changelog author="jsmeix@suse.com" date="1724155200">- cups-branch-2.2-commit-b643d6ba92f00752aa5e74ff86ad3974334914c1.diff
  is https://github.com/OpenPrinting/cups/commit/b643d6ba92f00752aa5e74ff86ad3974334914c1
  which was added in CUPS 2.2.8 that
  fixed a parsing bug in cups_auth_find() in cups/auth.c
  which lead to cupsd failing to authenticate users
  when group membership is required by cupsd configuration
  like 'Require user @GROUP' which lead to CUPS related commands
  requesting password from group users even if it is not needed
  (bsc#1226227)
- In cups.changes replaced one place where UTF-8 characters
  were used in the entry dated "Sat Sep 30 08:52:42 UTC 2017"
  for what should be ' - ' by ASCII to avoid RPMLINT warning
  about 'non-break-space' which "can lead to obscure errors".</changelog>
</package>
<package pkgid="619967f1743076a1f96572d7a6245e4ef4acb53f1e49d7d7816641be24a1e32f" name="cups-devel-32bit" arch="x86_64">
  <version epoch="0" ver="2.2.7" rel="150000.3.59.1"/>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
</package>
<package pkgid="d27f70932f3d4129deb2cae1e6fbb2d1f94d8dc3c926690a88bb2ee5c8feb1d2" name="cups-devel-32bit" arch="x86_64">
  <version epoch="0" ver="2.2.7" rel="150000.3.62.1"/>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
  <changelog author="jsmeix@suse.com" date="1720526400">- Require the exact matching version-release of all libcups*
  sub-packages (bsc#1226192)</changelog>
</package>
<package pkgid="bdb00eb1b493d22aab93cd56bc83a5bfb30d507dd89020f934cba33bffdc93d6" name="cups-devel-32bit" arch="x86_64">
  <version epoch="0" ver="2.2.7" rel="150000.3.65.1"/>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
  <changelog author="jsmeix@suse.com" date="1713528000">- Remove '--enable-debug-printfs' from configure options, see
  https://github.com/OpenPrinting/cups/issues/875
  (bsc#1217119).</changelog>
  <changelog author="nopower@suse.com" date="1715601600">- cups-2.2.7-web-ui-kerberos-authentication.patch, update
  patch to handle local 'Negotiate' authentication response
  for cli clients. (bsc#1223179).</changelog>
  <changelog author="jsmeix@suse.com" date="1716984000">- cups-2.2.7-CVE-2024-35235.patch is derived
  from the upstream patch against master (CUPS 2.5)
  to behave backward compatible for CUPS 2.2.7
  in SLE15 and openSUSE Leap 15 to fix CVE-2024-35235
  "cupsd Listen port arbitrary chmod 0140777"
  without the more secure but backward-incompatible behaviour
  of the upstream patch for CUPS 2.5
  that ignores domain sockets specified in 'Listen' entries
  in /etc/cups/cupsd.conf when cupsd is lauched via systemd
  (in particular when launched on-demand by systemd)
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
  bsc#1225365</changelog>
  <changelog author="jsmeix@suse.com" date="1720526400">- Require the exact matching version-release of all libcups*
  sub-packages (bsc#1226192)</changelog>
  <changelog author="jsmeix@suse.com" date="1724155200">- cups-branch-2.2-commit-b643d6ba92f00752aa5e74ff86ad3974334914c1.diff
  is https://github.com/OpenPrinting/cups/commit/b643d6ba92f00752aa5e74ff86ad3974334914c1
  which was added in CUPS 2.2.8 that
  fixed a parsing bug in cups_auth_find() in cups/auth.c
  which lead to cupsd failing to authenticate users
  when group membership is required by cupsd configuration
  like 'Require user @GROUP' which lead to CUPS related commands
  requesting password from group users even if it is not needed
  (bsc#1226227)
- In cups.changes replaced one place where UTF-8 characters
  were used in the entry dated "Sat Sep 30 08:52:42 UTC 2017"
  for what should be ' - ' by ASCII to avoid RPMLINT warning
  about 'non-break-space' which "can lead to obscure errors".</changelog>
</package>
<package pkgid="98be6d4e2251abaa890e975f49c9a6e7121b56435227d9049ac8ec3f9e41eb3f" name="cups-filters" arch="aarch64">
  <version epoch="0" ver="1.25.0" rel="150200.3.12.3"/>
  <changelog author="jsmeix@suse.de" date="1522843200">- Version upgrade to 1.20.1
  to provide upstream bugfixes also for SLE15 / Leap15
  and be also already prepared for SLE12 (fate#323676).
  This is a bug fix release fixing several issues
  on the Braille support and other bugs, in particular
  (for details see the NEWS file):
  * libcupsfilters: Silenced warning when using CUPS &lt; 2.x
    by eliminating the use of a recently introduced
    CUPS library function, see
    https://bugs.linuxfoundation.org/show_bug.cgi?id=1421
  * cups-browsed: Fixed crash when CUPS reports a print queue
    without "device-uri" attribute when cups-browsed polls a
    list of local CUPS queues, see
    https://github.com/OpenPrinting/cups-filters/issues/16
- fix_upstream_bug_1421.patch is no longer needed because
  it is now fixed in the upstream sources
  (see the "libcupsfilters ... bug ... 1421" entry above).</changelog>
  <changelog author="jsmeix@suse.de" date="1523361600">- Version upgrade to 1.20.2
  to provide upstream bugfixes also for SLE15 / Leap15
  and be also already prepared for SLE12 (fate#323676).
  This is a bug fix release fixing the recognition
  of remote CUPS queues by cups-browsed, the behavior
  of cups-browsed when one creates a queue with the
  same name of a cups-browsed-generated queue overwriting
  it, and other bug fixes (for details see the NEWS file).</changelog>
  <changelog author="luizluca@gmail.com" date="1525262400">- Version upgrade to 1.20.3
  to fix regression from 1.20.2 that ignores printers published
  using legacy CUPS broadcast</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1531224000">- Add pdftoopvp_Silence-compiler-warning.patch: pdftoopvp: Silence
  compiler warning.</changelog>
  <changelog author="alarrosa@suse.com" date="1531828800">- Version upgrade to 1.20.4
  - gstoraster: Removed unneeded "if"s (Ghostscript bug #692705).
  - cups-browsed: When checking whether there is already a local
    print queue with the same URI as the one of the discovered
    printer, consider also as equal URI if the URIs only differ
    by use of IPP or IPPS and/or use of HTTPS port 443 instead
    of IPP port 631.
  - cups-browsed: Also upgrade from ipp: to ipps: when the ipps:
    URI is on HTTPS port 443 instead of IPP port 631. This is
    common on IPP network printers.
  - pdftopdf: Removed support for hardware-implemented reversing
    of page order in PostScript printers. It was once not
    correctly implemented in cups-filters and second, such
    printers are extremely rare, and on Gutenprint PPDs with
    pseudo OutputOrder option hardware reversing was even
    wrongly assumed (Issue #47).
  - pdftopdf: Accept option "output-order=normal/reverse" for
    reversing page order (Issue #47) and also "page-delivery=
    same-order/reverse-order" (CUPS Issue #5340).
  - libcupsfilters: Let the PPD generator add "*PageStackOrder
    ..."  lines to the choices of the "OutputBin" option, to
    mark which output bins need the pages printed in reverse
    order (Issue #47).
  - libcupsfilters: Let the PPD generator correctly create a
    "*DefaultOutputOrder: ..."  entry, depending on whether the
    paper is put out face-up or face-down in the default output
    bin (Issue #47).
  - libcupsfilters: Fixed human-readable name of the OutputBin
    option in the PPD generator.
  - pdftoopvp: Silence compiler warning (Issue #42).
  - cups-browsed: If the user modifies/overwrites a print queue
    created by cups-browsed, it will now not only be
    automatically released from the control of cups-browsed, but
    we also create a replacement for our generated local queue
    under a new name.
  - cups-browsed: Make URIS for using the implicitclass backend
    correctly working also with queue names containing an '@'
    character.
  - braille: Strengthen error checking (Pull request #41).
  - braille: Index: Replace bogus characters with space (Pull
    request #41).
  - braille: Add print and braille page number options (Pull
    request #41).
  - braille: Index: Use standard duplex cups option (Pull
    request #41).
  - cups-browsed: Moved auto-generation of PPD file for IPP
    network printers from create_remote_printer_entry()
    function to update_cups_queues(). This allows re-creating
    accidentally removed or overwritten local queues without
    losing the PPD file.
  - braille: Add option to pick hyphenation rule according to
    current locale and make it the default for second
    translation table. (Pull request #38 and #39).
  - braille: Remove generated defs on "make clean". (Pull request #38).
  - braille: Turn non-breakable spaces to spaces. (Pull request
    [#38] and #39).
  - braille: Fix character encoding when extracting text. When
    extracing text from a zip file or a pdf, the resulting text
    is always utf-8 independently of the original locale, so we
    need to force that. (Pull request #38).
  - braille: Warn when no text translation was selected in case
    the user didn't notice. (Pull request #37).
  - braille: Fix spurious spacing after last Form-Feed (Pull
    request #45).
- Drop pdftoopvp_Silence-compiler-warning.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1535630400">- Do not diferentiate for service location, it is in sbindir
  on all systems we support now
- Use license for license install
- Version update to 1.21.1:
  - foomatic-rip: Fixed segmentation fault caused by wrong
    Coverity Scan issue fix (Issue #57, Debian bug #907026).
  - Build system: Require QPDF 8.1.0 or later as it is needed by
    bannertopdf (Issue #56).
  - libcupsfilters, cups-browsed, driverless, foomatic-rip,
    parallel: Silenced warnings from newest gcc.
  - libcupsfilters: When generating a PPD for driverless
    printing on a remote IPP printer, make pdftopdf not being
    run by the local queue if the remote queue is a CUPS queue
    to avoid running pdftopdf twice (CUPS Issue #5361).
  - libcupsfilters, cups-browsed, driverless, bannertopdf,
    foomatic-rip, pdftops, pdftoraster, rastertops,
    rastertoescpx, sys5ippprinter, beh: Fixed Coverity Scan
    issues. Thanks to Zdenek Dohnal (zdohnal at redhat dot com)
    for the tests and the patches.
  - bannertopdf: Switched over from using Poppler to using QPDF
    for generating the PDF pages. With Poppler unstable APIs
    were used which were subject to change. Thanks to Sahil
    Arora for this project in the Google Summer of Code 2018
    (Pull request #25).
  - cups-browsed: Manually defined clusters ("Cluster" directive
    in cups-browsed.conf) caused cups-browsed to crash.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1543406400">- Update to version 1.21.4:
  * cups-browsed: cups-browsed: Limit the number of retries for
    creating a print queue when it comes to HTTP timeouts. Number
    of retries given by HttpMaxRetries directive in
    cups-browsed.conf.
  * cups-browsed: Read out current time right before setting the
    timeouts.
  * libcupsfilters: In the PPD generator for driverless IPP
    printing let "*cupsManualCopies: true" lines get added to
    the PPD if printing is done in a raster format as then
    pdftopdf needs to generate the copies.
  * pdftoraster, pdftoopvp, pdftoijs: Fix build with
    Poppler &gt;= 0.70
  * pdftopdf: Fixed printing multiple copies on driverless IPP
    printers. When printing collated copies the multiple copies
    got applied twice, resulting in n*n instead of n copies.
  * pdftoraster, pdftoopvp, pdftoijs: Poppler removed memCheck
    and gMemReport functions, remove appropriate calls.
- Changes from version 1.21.3:
  * foomatic-rip: Reset stdin after replacing the underlying file
    descriptor.
- Changes from version 1.21.2:
  * cups-browsed: Fixed freeing of literal string caused by
    Coverity Scan issue fix.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1545134400">- Update to version 1.21.6:
  * Bug fix release, mainly for cups-browsed to avoid crashes and
    infinite printer removal/re-creation loops and spurious local
    queues for local CUPS printers. Also expanded PostScript
    interpreter bug workaround to more Apple LaserWriter models.
  * cups-browsed: To find out whether a DNS-SD-discovered printer
    is from the local machine, use not only the flags in the Avahi
    lookup result but also check the host name.
  * cups-browsed: When a local CUPS queue pointing to a remote CUPS
    printer was removed and re-created to make it a permanent
    queue, on_printer_deleted() was triggered by cupsd's
    notification to re-create a lost queue. Now
    on_printer_deleted() checks whether the queue is really gone
    and only re-creates then.
  * cups-browsed: When updating the CUPS queues, also removed and
    unregistered queues and not only created queues got checked for
    HTTP timeouts, which caused crashes on shutdown.
  * pdftops: Use the PS interpreter of Poppler for all Apple
    LaserWriter 16/600, 4/600, 12/640, 12/600, 12/660 as they all
    seem to not work with Ghostscript's PS output.
  * cups-browsed: On shutdown queues got removed even if they still
    had jobs.
- Changes from version 1.21.5:
  * Bug fix release, to build with Poppler 0.71 and with
    cups-browsed converting temporary CUPS queues reliably to
    permanent queues.
  * cups-browsed: We cannot reliably determine whether a CUPS queue
    is temporary, so we apply the procedure to make a temporary
    queue permanent to any unshared queue.
  * pdftoraster, pdftopdf, pdftoijs, pdftoopvp: Do not use the
    Poppler-specific "GBool", "gFalse", "gTrue" any more, as
    Poppler has switched to standard "bool", "false", "true" in
    version 0.71.0.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1546084800">- Fix building with Poppler 0.72
  Add 0001-Raise-minimum-poppler-version-from-0.18-to-0.19.patch
  Add 0002-Adapt-code-for-SplashXPathScanner-state-handling-sin.patch
  Add 0003-Support-some-more-methods-returning-const.patch
  Add 0004-Support-GooString-c_str-introduced-by-poppler-0.72.patch
  See https://github.com/OpenPrinting/cups-filters/pull/83</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1548676800">- Update to version 1.22.0:
  * From this release on the pdftopdf filter flattens interactive
    PDF forms and annotations internally, using QPDF, instead of
    calling external utilities. This especially eliminates slowing
    factors as additional piping of the data and unneeded use of
    PDF interpreters. Using external utilities for flattening is
    still possible in case of problems. In addition, a crash bug in
    cups-browsed got fixed and compatibility of the filters with
    Poppler 0.72 assured.
- Drop upstream fixed patches:
  * 0001-Raise-minimum-poppler-version-from-0.18-to-0.19.patch
  * 0002-Adapt-code-for-SplashXPathScanner-state-handling-sin.patch
  * 0003-Support-some-more-methods-returning-const.patch
  * 0004-Support-GooString-c_str-introduced-by-poppler-0.72.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550664000">- Update to version 1.22.1:
  * braille: Use sort command with LC_ALL=C for reproducibility
    of the genrated files, needed for distribution packaging.
  * cups-browsed, driverless: When polling the printer's
    capabilities via get-printer-attributes IPP request for
    driverless printing, use the attributes "all" and
    "media-col-database". Without "all" some printers do not report
    "urf-supported" and without "media-col-database" not all paper
    size and marging info gets reported.
  * braille: Document how to rework output before embossing.</changelog>
  <changelog author="jsmeix@suse.de" date="1554724800">- Version upgrade to 1.22.5
  * foomatic-rip: Changed Ghostscript call to count pages in a
    PDF file to use "runpdfbegin" and not the undocumented
    Ghostscript internal "pdfdict", so that it works with
    Ghostscript 9.27 and later (Debian bug #926576,
    Arch Linux bug #62251, openSUSE boo#1131771,
    cups@cups.org mailing list thread
    https://lists.cups.org/pipermail/cups/2019-April/074563.html).
- Version upgrade to 1.22.4
  * cups-browsed: Fix broken trailing space removal on
    "NickName" (Pull request #103).
  * pdftops: Emit PostScript Level 2 instead of Level 3 for
    Brother PostScript printers as at least some of them
    report to support level 3 but ontly work with Level 2
    (Ubuntu bug #1306849, comment #42).
  * bannertopdf: When multiplying the page for N-up or Duplex
    printing one page too much was generated (Issue #102).
- Version upgrade to 1.22.3
  * libcupsfilters: Added error checks for processing GIF, to
    avoid crashes or hangs on broken GIF files (Issues #81, #82,
    Pull request #100).
  * cups-browsed: Added hint to the man page and configuration
    file that with "DebugLogging stderr" the logging output goes
    to journal or syslog if cups-browsed is running as system
    service (Issue #28).
- Version upgrade to 1.22.2
  * cups-browsed: Let distribution of jobs sent to queues with
    "implicitclass" backend (usually clusters) be done by a
    "job-state" CUPS notification and not by
    "printer-state-changed" any more. The "job-state"
    notification already contains the job ID. Before we had to
    poll the job ID from CUPS via IPP which was sometimes
    unreliable (Issue #97).
  * imagetopdf, imagetoraster, pdftopdf, libcupsfilters: Added
    new page scaling options: "fill" scales the input page
    (typically a photo) so that the output page (typically with
    different aspect ratio) gets completely filled, aloowing for
    some content of the input page getting lost. "crop-to-fit"
    allows for easy printing of documents on slightly different
    output page sizes (A4 &lt;-&gt; Letter) maintaining the size and
    centering and cropping into the destination page. Thanks to
    Dheeraj Yadav (dhirajyadav135 at gmail dot com) for the
    patch (Pull request #92).
  * cups-browsed: Do not do IPP request for printer-is-shared
    option for remote cups queues with CUPS 2.2.x and newer
    (Pull request #91).
  * cups-browsed: Fix crash bug when reading "Cluster"
    directive from configuration file (Issue #94).
  * driverless: Updated man page as now also Mopria and
    Wi-Fi Direct printers are supported. Mentioned also
    ippusbxd.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559304000">- Update to version 1.23.0:
  * This release adds support for the "print-scaling" IPP attribute
    and has the code for the support of MuPDF as PDF renderer
    vastly simplified.
  * pdftops, mupdftoraster: Let pdftops call mutool directly and so
    that it directly outputs PostScript, eliminating the need to
    call the mupdftoraster and rastertops filters.
  * mupdftoraster: Reduced the use of temporary files from 3 to
    just one.
  * imagetopdf, imagetoraster, pdftopdf: Add support for
    print-scaling option.
- Changes from version 1.22.6:
  * Bug fix release, to address a further issue of cups-browsed
    removing user-created print queues, to make
    grayscale/monochrome PostScript jobs of colored input file
    actually output grayscale/monochrome files, to fix several bugs
    when using MuPDF as PDF renderer, and to silence compiler
    warnings.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559908800">- Update to version 1.25.0:
  * pdftoijs, pdftoopvp: Removed these deprecated filters
    completely as there is no demand for them any more. They also
    used unstable, undocumented APIs of Poppler.
  * pdftoraster: Changed from using unstable, undocumented APIs of
    Poppler to stable, documented ones, to improve maintainability
    of this filter, and with it of the cups-filters package.
  * libcupsfilters: Added support for color spaces CMY and RGBW
    when using filters without PPD file (mainly for development and
    debugging, option "print-color-mode" with values "cmy-XX" and
    "rgbw-XX" with XX being the number of bits per color).
- Changes from version 1.24.0:
  * cups-browsed: Integration of Deepak Patankar's Google Summer of
    Code 2018 project with the main goal of clustering different
    printers and automatically selecting the destination printers
    by job content and option/attribute settings.
  * cups-browsed, implicitclass: Support for mixed clusters of
    remote CUPS queues and IPP network printers. For this PPD files
    of remote CUPS queues are generated by cups-browsed based on
    IPP queries, as for native IPP printers, the number of jobs for
    load balancing is polled in a way that it works also with
    native IPP printers, the implicitclass backend sends jobs
    directly to the printer instead of re-queueing them via CUPS.
  * cups-browsed: Merge IPP attributes of several printers to
    combined attributes for the cluster to generate the cluster's
    PPD file, including PPD constraints for option combinations not
    fulfillable by any of the member printers, and finding
    reasonable, non-conflicting default settings.
  * cups-browsed: Selection algorithm for the destination printer
    for a job sent to the cluster. Based on the job settings
    requested such as page size, media type, print quality, the
    best most suitable printer in the cluster for the job will be
    selected.
  * cups-browsed, implicitclass: Filter jobs to clusters already
    locally. Due to the fact that a cluster's member printers are
    not exclusively non-raw CUPS queues with the complete filtering
    framework on the remote server, but also native IPP printers,
    we need to support generic driverless printers as destination.
    So we cannot pass on the input data unfiltered but need to
    filter locally. We let the cluster's PPD file emulate a PDF
    printer, letting the local CUPS queue of the cluster run
    pdftopdf and any pre-filters to turn the input into PDF and we
    let the implicitclass backend turn PDF into a format understood
    by the destination printer, supporting the 4 formats of
    driverless IPP printing: PDF, PWG Raster, Apple Raster, PCLm.
- Drop libpoppler-cpp0, libpoppler-devel and libpoppler-glib-devel
  BuildRequires.
- Add pkgconfig(poppler-cpp) BuildRequires following upstream
  changes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1560340800">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut the build queues by allowing usage of systemd-mini</changelog>
  <changelog author="idonmez@suse.com" date="1567512000">- Add add-cstring-include.patch to include cstring for memcpy
  and strcmp</changelog>
  <changelog author="jsmeix@suse.de" date="1618488000">- fix_upstream_issue348.patch fixes
  https://github.com/OpenPrinting/cups-filters/issues/348
  foomatic-rip segfaults with 'job-sheets=none,none'
  but works with 'job-sheets=none'
  (bsc#1182893)</changelog>
  <changelog author="jsmeix@suse.com" date="1684152000">- cups-filters-1.25.0-0001-beh-backend-Use-execv-instead-of-system-CVE-2023-24805.patch
  cups-filters-1.25.0-0002-beh-backend-Extra-checks-against-odd-forged-input-CVE-2023-24805.patch
  cups-filters-1.25.0-0003-beh-backend-Further-improvements-CVE-2023-24805.patch
  are the upstream
  0001-beh-backend-Use-execv-instead-of-system-CVE-2023-24805.patch
  0002-beh-backend-Extra-checks-against-odd-forged-input-CVE-2023-24805.patch
  0003-beh-backend-Further-improvements-CVE-2023-24805.patch
  backpported to cups-filters-1.25.0
  to fix CVE-2023-24805: RCE in cups-filters, beh CUPS backend
  (bsc#1211340)</changelog>
  <changelog author="tabraham@suse.com" date="1684756800">- gstoraster-gstopdf-Make-number-of-copies-as-embedded.patch fixes
  https://github.com/OpenPrinting/cups-filters/issues/255
  Printing multiple copies prints only 1 (pstopdf vs gstopdf)
  (bsc#1211401) (boo#1173345)</changelog>
  <changelog author="jsmeix@suse.com" date="1720008000">- bsc1225040.patch fixes bsc#1225040
  "cups-filters: Poppler for color PDF as grayscale via PS level 1:
  huge output makes printing slow"
  see https://github.com/OpenPrinting/cups-filters/issues/169
  Poppler for color PDF as grayscale via PS level 1 was introduced
  in cups-filters 1.22.6 via
  https://github.com/OpenPrinting/cups-filters/commit/48f9f994322c808ba2e9d0db6f3ff81caf8c0b72
  and disabled in cups-filters 1.25.12 via
  https://github.com/OpenPrinting/cups-filters/commit/0818ee322a6139be11d21fc76db345de1e979339</changelog>
</package>
<package pkgid="ff8f1663fe36d4832d76f4c6751a0411f6c36de4ba4c68fe9a81c645cc0d92ab" name="cups-filters" arch="ppc64le">
  <version epoch="0" ver="1.25.0" rel="150200.3.12.3"/>
  <changelog author="jsmeix@suse.de" date="1522843200">- Version upgrade to 1.20.1
  to provide upstream bugfixes also for SLE15 / Leap15
  and be also already prepared for SLE12 (fate#323676).
  This is a bug fix release fixing several issues
  on the Braille support and other bugs, in particular
  (for details see the NEWS file):
  * libcupsfilters: Silenced warning when using CUPS &lt; 2.x
    by eliminating the use of a recently introduced
    CUPS library function, see
    https://bugs.linuxfoundation.org/show_bug.cgi?id=1421
  * cups-browsed: Fixed crash when CUPS reports a print queue
    without "device-uri" attribute when cups-browsed polls a
    list of local CUPS queues, see
    https://github.com/OpenPrinting/cups-filters/issues/16
- fix_upstream_bug_1421.patch is no longer needed because
  it is now fixed in the upstream sources
  (see the "libcupsfilters ... bug ... 1421" entry above).</changelog>
  <changelog author="jsmeix@suse.de" date="1523361600">- Version upgrade to 1.20.2
  to provide upstream bugfixes also for SLE15 / Leap15
  and be also already prepared for SLE12 (fate#323676).
  This is a bug fix release fixing the recognition
  of remote CUPS queues by cups-browsed, the behavior
  of cups-browsed when one creates a queue with the
  same name of a cups-browsed-generated queue overwriting
  it, and other bug fixes (for details see the NEWS file).</changelog>
  <changelog author="luizluca@gmail.com" date="1525262400">- Version upgrade to 1.20.3
  to fix regression from 1.20.2 that ignores printers published
  using legacy CUPS broadcast</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1531224000">- Add pdftoopvp_Silence-compiler-warning.patch: pdftoopvp: Silence
  compiler warning.</changelog>
  <changelog author="alarrosa@suse.com" date="1531828800">- Version upgrade to 1.20.4
  - gstoraster: Removed unneeded "if"s (Ghostscript bug #692705).
  - cups-browsed: When checking whether there is already a local
    print queue with the same URI as the one of the discovered
    printer, consider also as equal URI if the URIs only differ
    by use of IPP or IPPS and/or use of HTTPS port 443 instead
    of IPP port 631.
  - cups-browsed: Also upgrade from ipp: to ipps: when the ipps:
    URI is on HTTPS port 443 instead of IPP port 631. This is
    common on IPP network printers.
  - pdftopdf: Removed support for hardware-implemented reversing
    of page order in PostScript printers. It was once not
    correctly implemented in cups-filters and second, such
    printers are extremely rare, and on Gutenprint PPDs with
    pseudo OutputOrder option hardware reversing was even
    wrongly assumed (Issue #47).
  - pdftopdf: Accept option "output-order=normal/reverse" for
    reversing page order (Issue #47) and also "page-delivery=
    same-order/reverse-order" (CUPS Issue #5340).
  - libcupsfilters: Let the PPD generator add "*PageStackOrder
    ..."  lines to the choices of the "OutputBin" option, to
    mark which output bins need the pages printed in reverse
    order (Issue #47).
  - libcupsfilters: Let the PPD generator correctly create a
    "*DefaultOutputOrder: ..."  entry, depending on whether the
    paper is put out face-up or face-down in the default output
    bin (Issue #47).
  - libcupsfilters: Fixed human-readable name of the OutputBin
    option in the PPD generator.
  - pdftoopvp: Silence compiler warning (Issue #42).
  - cups-browsed: If the user modifies/overwrites a print queue
    created by cups-browsed, it will now not only be
    automatically released from the control of cups-browsed, but
    we also create a replacement for our generated local queue
    under a new name.
  - cups-browsed: Make URIS for using the implicitclass backend
    correctly working also with queue names containing an '@'
    character.
  - braille: Strengthen error checking (Pull request #41).
  - braille: Index: Replace bogus characters with space (Pull
    request #41).
  - braille: Add print and braille page number options (Pull
    request #41).
  - braille: Index: Use standard duplex cups option (Pull
    request #41).
  - cups-browsed: Moved auto-generation of PPD file for IPP
    network printers from create_remote_printer_entry()
    function to update_cups_queues(). This allows re-creating
    accidentally removed or overwritten local queues without
    losing the PPD file.
  - braille: Add option to pick hyphenation rule according to
    current locale and make it the default for second
    translation table. (Pull request #38 and #39).
  - braille: Remove generated defs on "make clean". (Pull request #38).
  - braille: Turn non-breakable spaces to spaces. (Pull request
    [#38] and #39).
  - braille: Fix character encoding when extracting text. When
    extracing text from a zip file or a pdf, the resulting text
    is always utf-8 independently of the original locale, so we
    need to force that. (Pull request #38).
  - braille: Warn when no text translation was selected in case
    the user didn't notice. (Pull request #37).
  - braille: Fix spurious spacing after last Form-Feed (Pull
    request #45).
- Drop pdftoopvp_Silence-compiler-warning.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1535630400">- Do not diferentiate for service location, it is in sbindir
  on all systems we support now
- Use license for license install
- Version update to 1.21.1:
  - foomatic-rip: Fixed segmentation fault caused by wrong
    Coverity Scan issue fix (Issue #57, Debian bug #907026).
  - Build system: Require QPDF 8.1.0 or later as it is needed by
    bannertopdf (Issue #56).
  - libcupsfilters, cups-browsed, driverless, foomatic-rip,
    parallel: Silenced warnings from newest gcc.
  - libcupsfilters: When generating a PPD for driverless
    printing on a remote IPP printer, make pdftopdf not being
    run by the local queue if the remote queue is a CUPS queue
    to avoid running pdftopdf twice (CUPS Issue #5361).
  - libcupsfilters, cups-browsed, driverless, bannertopdf,
    foomatic-rip, pdftops, pdftoraster, rastertops,
    rastertoescpx, sys5ippprinter, beh: Fixed Coverity Scan
    issues. Thanks to Zdenek Dohnal (zdohnal at redhat dot com)
    for the tests and the patches.
  - bannertopdf: Switched over from using Poppler to using QPDF
    for generating the PDF pages. With Poppler unstable APIs
    were used which were subject to change. Thanks to Sahil
    Arora for this project in the Google Summer of Code 2018
    (Pull request #25).
  - cups-browsed: Manually defined clusters ("Cluster" directive
    in cups-browsed.conf) caused cups-browsed to crash.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1543406400">- Update to version 1.21.4:
  * cups-browsed: cups-browsed: Limit the number of retries for
    creating a print queue when it comes to HTTP timeouts. Number
    of retries given by HttpMaxRetries directive in
    cups-browsed.conf.
  * cups-browsed: Read out current time right before setting the
    timeouts.
  * libcupsfilters: In the PPD generator for driverless IPP
    printing let "*cupsManualCopies: true" lines get added to
    the PPD if printing is done in a raster format as then
    pdftopdf needs to generate the copies.
  * pdftoraster, pdftoopvp, pdftoijs: Fix build with
    Poppler &gt;= 0.70
  * pdftopdf: Fixed printing multiple copies on driverless IPP
    printers. When printing collated copies the multiple copies
    got applied twice, resulting in n*n instead of n copies.
  * pdftoraster, pdftoopvp, pdftoijs: Poppler removed memCheck
    and gMemReport functions, remove appropriate calls.
- Changes from version 1.21.3:
  * foomatic-rip: Reset stdin after replacing the underlying file
    descriptor.
- Changes from version 1.21.2:
  * cups-browsed: Fixed freeing of literal string caused by
    Coverity Scan issue fix.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1545134400">- Update to version 1.21.6:
  * Bug fix release, mainly for cups-browsed to avoid crashes and
    infinite printer removal/re-creation loops and spurious local
    queues for local CUPS printers. Also expanded PostScript
    interpreter bug workaround to more Apple LaserWriter models.
  * cups-browsed: To find out whether a DNS-SD-discovered printer
    is from the local machine, use not only the flags in the Avahi
    lookup result but also check the host name.
  * cups-browsed: When a local CUPS queue pointing to a remote CUPS
    printer was removed and re-created to make it a permanent
    queue, on_printer_deleted() was triggered by cupsd's
    notification to re-create a lost queue. Now
    on_printer_deleted() checks whether the queue is really gone
    and only re-creates then.
  * cups-browsed: When updating the CUPS queues, also removed and
    unregistered queues and not only created queues got checked for
    HTTP timeouts, which caused crashes on shutdown.
  * pdftops: Use the PS interpreter of Poppler for all Apple
    LaserWriter 16/600, 4/600, 12/640, 12/600, 12/660 as they all
    seem to not work with Ghostscript's PS output.
  * cups-browsed: On shutdown queues got removed even if they still
    had jobs.
- Changes from version 1.21.5:
  * Bug fix release, to build with Poppler 0.71 and with
    cups-browsed converting temporary CUPS queues reliably to
    permanent queues.
  * cups-browsed: We cannot reliably determine whether a CUPS queue
    is temporary, so we apply the procedure to make a temporary
    queue permanent to any unshared queue.
  * pdftoraster, pdftopdf, pdftoijs, pdftoopvp: Do not use the
    Poppler-specific "GBool", "gFalse", "gTrue" any more, as
    Poppler has switched to standard "bool", "false", "true" in
    version 0.71.0.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1546084800">- Fix building with Poppler 0.72
  Add 0001-Raise-minimum-poppler-version-from-0.18-to-0.19.patch
  Add 0002-Adapt-code-for-SplashXPathScanner-state-handling-sin.patch
  Add 0003-Support-some-more-methods-returning-const.patch
  Add 0004-Support-GooString-c_str-introduced-by-poppler-0.72.patch
  See https://github.com/OpenPrinting/cups-filters/pull/83</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1548676800">- Update to version 1.22.0:
  * From this release on the pdftopdf filter flattens interactive
    PDF forms and annotations internally, using QPDF, instead of
    calling external utilities. This especially eliminates slowing
    factors as additional piping of the data and unneeded use of
    PDF interpreters. Using external utilities for flattening is
    still possible in case of problems. In addition, a crash bug in
    cups-browsed got fixed and compatibility of the filters with
    Poppler 0.72 assured.
- Drop upstream fixed patches:
  * 0001-Raise-minimum-poppler-version-from-0.18-to-0.19.patch
  * 0002-Adapt-code-for-SplashXPathScanner-state-handling-sin.patch
  * 0003-Support-some-more-methods-returning-const.patch
  * 0004-Support-GooString-c_str-introduced-by-poppler-0.72.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550664000">- Update to version 1.22.1:
  * braille: Use sort command with LC_ALL=C for reproducibility
    of the genrated files, needed for distribution packaging.
  * cups-browsed, driverless: When polling the printer's
    capabilities via get-printer-attributes IPP request for
    driverless printing, use the attributes "all" and
    "media-col-database". Without "all" some printers do not report
    "urf-supported" and without "media-col-database" not all paper
    size and marging info gets reported.
  * braille: Document how to rework output before embossing.</changelog>
  <changelog author="jsmeix@suse.de" date="1554724800">- Version upgrade to 1.22.5
  * foomatic-rip: Changed Ghostscript call to count pages in a
    PDF file to use "runpdfbegin" and not the undocumented
    Ghostscript internal "pdfdict", so that it works with
    Ghostscript 9.27 and later (Debian bug #926576,
    Arch Linux bug #62251, openSUSE boo#1131771,
    cups@cups.org mailing list thread
    https://lists.cups.org/pipermail/cups/2019-April/074563.html).
- Version upgrade to 1.22.4
  * cups-browsed: Fix broken trailing space removal on
    "NickName" (Pull request #103).
  * pdftops: Emit PostScript Level 2 instead of Level 3 for
    Brother PostScript printers as at least some of them
    report to support level 3 but ontly work with Level 2
    (Ubuntu bug #1306849, comment #42).
  * bannertopdf: When multiplying the page for N-up or Duplex
    printing one page too much was generated (Issue #102).
- Version upgrade to 1.22.3
  * libcupsfilters: Added error checks for processing GIF, to
    avoid crashes or hangs on broken GIF files (Issues #81, #82,
    Pull request #100).
  * cups-browsed: Added hint to the man page and configuration
    file that with "DebugLogging stderr" the logging output goes
    to journal or syslog if cups-browsed is running as system
    service (Issue #28).
- Version upgrade to 1.22.2
  * cups-browsed: Let distribution of jobs sent to queues with
    "implicitclass" backend (usually clusters) be done by a
    "job-state" CUPS notification and not by
    "printer-state-changed" any more. The "job-state"
    notification already contains the job ID. Before we had to
    poll the job ID from CUPS via IPP which was sometimes
    unreliable (Issue #97).
  * imagetopdf, imagetoraster, pdftopdf, libcupsfilters: Added
    new page scaling options: "fill" scales the input page
    (typically a photo) so that the output page (typically with
    different aspect ratio) gets completely filled, aloowing for
    some content of the input page getting lost. "crop-to-fit"
    allows for easy printing of documents on slightly different
    output page sizes (A4 &lt;-&gt; Letter) maintaining the size and
    centering and cropping into the destination page. Thanks to
    Dheeraj Yadav (dhirajyadav135 at gmail dot com) for the
    patch (Pull request #92).
  * cups-browsed: Do not do IPP request for printer-is-shared
    option for remote cups queues with CUPS 2.2.x and newer
    (Pull request #91).
  * cups-browsed: Fix crash bug when reading "Cluster"
    directive from configuration file (Issue #94).
  * driverless: Updated man page as now also Mopria and
    Wi-Fi Direct printers are supported. Mentioned also
    ippusbxd.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559304000">- Update to version 1.23.0:
  * This release adds support for the "print-scaling" IPP attribute
    and has the code for the support of MuPDF as PDF renderer
    vastly simplified.
  * pdftops, mupdftoraster: Let pdftops call mutool directly and so
    that it directly outputs PostScript, eliminating the need to
    call the mupdftoraster and rastertops filters.
  * mupdftoraster: Reduced the use of temporary files from 3 to
    just one.
  * imagetopdf, imagetoraster, pdftopdf: Add support for
    print-scaling option.
- Changes from version 1.22.6:
  * Bug fix release, to address a further issue of cups-browsed
    removing user-created print queues, to make
    grayscale/monochrome PostScript jobs of colored input file
    actually output grayscale/monochrome files, to fix several bugs
    when using MuPDF as PDF renderer, and to silence compiler
    warnings.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559908800">- Update to version 1.25.0:
  * pdftoijs, pdftoopvp: Removed these deprecated filters
    completely as there is no demand for them any more. They also
    used unstable, undocumented APIs of Poppler.
  * pdftoraster: Changed from using unstable, undocumented APIs of
    Poppler to stable, documented ones, to improve maintainability
    of this filter, and with it of the cups-filters package.
  * libcupsfilters: Added support for color spaces CMY and RGBW
    when using filters without PPD file (mainly for development and
    debugging, option "print-color-mode" with values "cmy-XX" and
    "rgbw-XX" with XX being the number of bits per color).
- Changes from version 1.24.0:
  * cups-browsed: Integration of Deepak Patankar's Google Summer of
    Code 2018 project with the main goal of clustering different
    printers and automatically selecting the destination printers
    by job content and option/attribute settings.
  * cups-browsed, implicitclass: Support for mixed clusters of
    remote CUPS queues and IPP network printers. For this PPD files
    of remote CUPS queues are generated by cups-browsed based on
    IPP queries, as for native IPP printers, the number of jobs for
    load balancing is polled in a way that it works also with
    native IPP printers, the implicitclass backend sends jobs
    directly to the printer instead of re-queueing them via CUPS.
  * cups-browsed: Merge IPP attributes of several printers to
    combined attributes for the cluster to generate the cluster's
    PPD file, including PPD constraints for option combinations not
    fulfillable by any of the member printers, and finding
    reasonable, non-conflicting default settings.
  * cups-browsed: Selection algorithm for the destination printer
    for a job sent to the cluster. Based on the job settings
    requested such as page size, media type, print quality, the
    best most suitable printer in the cluster for the job will be
    selected.
  * cups-browsed, implicitclass: Filter jobs to clusters already
    locally. Due to the fact that a cluster's member printers are
    not exclusively non-raw CUPS queues with the complete filtering
    framework on the remote server, but also native IPP printers,
    we need to support generic driverless printers as destination.
    So we cannot pass on the input data unfiltered but need to
    filter locally. We let the cluster's PPD file emulate a PDF
    printer, letting the local CUPS queue of the cluster run
    pdftopdf and any pre-filters to turn the input into PDF and we
    let the implicitclass backend turn PDF into a format understood
    by the destination printer, supporting the 4 formats of
    driverless IPP printing: PDF, PWG Raster, Apple Raster, PCLm.
- Drop libpoppler-cpp0, libpoppler-devel and libpoppler-glib-devel
  BuildRequires.
- Add pkgconfig(poppler-cpp) BuildRequires following upstream
  changes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1560340800">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut the build queues by allowing usage of systemd-mini</changelog>
  <changelog author="idonmez@suse.com" date="1567512000">- Add add-cstring-include.patch to include cstring for memcpy
  and strcmp</changelog>
  <changelog author="jsmeix@suse.de" date="1618488000">- fix_upstream_issue348.patch fixes
  https://github.com/OpenPrinting/cups-filters/issues/348
  foomatic-rip segfaults with 'job-sheets=none,none'
  but works with 'job-sheets=none'
  (bsc#1182893)</changelog>
  <changelog author="jsmeix@suse.com" date="1684152000">- cups-filters-1.25.0-0001-beh-backend-Use-execv-instead-of-system-CVE-2023-24805.patch
  cups-filters-1.25.0-0002-beh-backend-Extra-checks-against-odd-forged-input-CVE-2023-24805.patch
  cups-filters-1.25.0-0003-beh-backend-Further-improvements-CVE-2023-24805.patch
  are the upstream
  0001-beh-backend-Use-execv-instead-of-system-CVE-2023-24805.patch
  0002-beh-backend-Extra-checks-against-odd-forged-input-CVE-2023-24805.patch
  0003-beh-backend-Further-improvements-CVE-2023-24805.patch
  backpported to cups-filters-1.25.0
  to fix CVE-2023-24805: RCE in cups-filters, beh CUPS backend
  (bsc#1211340)</changelog>
  <changelog author="tabraham@suse.com" date="1684756800">- gstoraster-gstopdf-Make-number-of-copies-as-embedded.patch fixes
  https://github.com/OpenPrinting/cups-filters/issues/255
  Printing multiple copies prints only 1 (pstopdf vs gstopdf)
  (bsc#1211401) (boo#1173345)</changelog>
  <changelog author="jsmeix@suse.com" date="1720008000">- bsc1225040.patch fixes bsc#1225040
  "cups-filters: Poppler for color PDF as grayscale via PS level 1:
  huge output makes printing slow"
  see https://github.com/OpenPrinting/cups-filters/issues/169
  Poppler for color PDF as grayscale via PS level 1 was introduced
  in cups-filters 1.22.6 via
  https://github.com/OpenPrinting/cups-filters/commit/48f9f994322c808ba2e9d0db6f3ff81caf8c0b72
  and disabled in cups-filters 1.25.12 via
  https://github.com/OpenPrinting/cups-filters/commit/0818ee322a6139be11d21fc76db345de1e979339</changelog>
</package>
<package pkgid="6375c8ee69851c82e111bf0a386c2676c3b90ae7fad6de0543fae167b2e7b41a" name="cups-filters" arch="s390x">
  <version epoch="0" ver="1.25.0" rel="150200.3.12.3"/>
  <changelog author="jsmeix@suse.de" date="1522843200">- Version upgrade to 1.20.1
  to provide upstream bugfixes also for SLE15 / Leap15
  and be also already prepared for SLE12 (fate#323676).
  This is a bug fix release fixing several issues
  on the Braille support and other bugs, in particular
  (for details see the NEWS file):
  * libcupsfilters: Silenced warning when using CUPS &lt; 2.x
    by eliminating the use of a recently introduced
    CUPS library function, see
    https://bugs.linuxfoundation.org/show_bug.cgi?id=1421
  * cups-browsed: Fixed crash when CUPS reports a print queue
    without "device-uri" attribute when cups-browsed polls a
    list of local CUPS queues, see
    https://github.com/OpenPrinting/cups-filters/issues/16
- fix_upstream_bug_1421.patch is no longer needed because
  it is now fixed in the upstream sources
  (see the "libcupsfilters ... bug ... 1421" entry above).</changelog>
  <changelog author="jsmeix@suse.de" date="1523361600">- Version upgrade to 1.20.2
  to provide upstream bugfixes also for SLE15 / Leap15
  and be also already prepared for SLE12 (fate#323676).
  This is a bug fix release fixing the recognition
  of remote CUPS queues by cups-browsed, the behavior
  of cups-browsed when one creates a queue with the
  same name of a cups-browsed-generated queue overwriting
  it, and other bug fixes (for details see the NEWS file).</changelog>
  <changelog author="luizluca@gmail.com" date="1525262400">- Version upgrade to 1.20.3
  to fix regression from 1.20.2 that ignores printers published
  using legacy CUPS broadcast</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1531224000">- Add pdftoopvp_Silence-compiler-warning.patch: pdftoopvp: Silence
  compiler warning.</changelog>
  <changelog author="alarrosa@suse.com" date="1531828800">- Version upgrade to 1.20.4
  - gstoraster: Removed unneeded "if"s (Ghostscript bug #692705).
  - cups-browsed: When checking whether there is already a local
    print queue with the same URI as the one of the discovered
    printer, consider also as equal URI if the URIs only differ
    by use of IPP or IPPS and/or use of HTTPS port 443 instead
    of IPP port 631.
  - cups-browsed: Also upgrade from ipp: to ipps: when the ipps:
    URI is on HTTPS port 443 instead of IPP port 631. This is
    common on IPP network printers.
  - pdftopdf: Removed support for hardware-implemented reversing
    of page order in PostScript printers. It was once not
    correctly implemented in cups-filters and second, such
    printers are extremely rare, and on Gutenprint PPDs with
    pseudo OutputOrder option hardware reversing was even
    wrongly assumed (Issue #47).
  - pdftopdf: Accept option "output-order=normal/reverse" for
    reversing page order (Issue #47) and also "page-delivery=
    same-order/reverse-order" (CUPS Issue #5340).
  - libcupsfilters: Let the PPD generator add "*PageStackOrder
    ..."  lines to the choices of the "OutputBin" option, to
    mark which output bins need the pages printed in reverse
    order (Issue #47).
  - libcupsfilters: Let the PPD generator correctly create a
    "*DefaultOutputOrder: ..."  entry, depending on whether the
    paper is put out face-up or face-down in the default output
    bin (Issue #47).
  - libcupsfilters: Fixed human-readable name of the OutputBin
    option in the PPD generator.
  - pdftoopvp: Silence compiler warning (Issue #42).
  - cups-browsed: If the user modifies/overwrites a print queue
    created by cups-browsed, it will now not only be
    automatically released from the control of cups-browsed, but
    we also create a replacement for our generated local queue
    under a new name.
  - cups-browsed: Make URIS for using the implicitclass backend
    correctly working also with queue names containing an '@'
    character.
  - braille: Strengthen error checking (Pull request #41).
  - braille: Index: Replace bogus characters with space (Pull
    request #41).
  - braille: Add print and braille page number options (Pull
    request #41).
  - braille: Index: Use standard duplex cups option (Pull
    request #41).
  - cups-browsed: Moved auto-generation of PPD file for IPP
    network printers from create_remote_printer_entry()
    function to update_cups_queues(). This allows re-creating
    accidentally removed or overwritten local queues without
    losing the PPD file.
  - braille: Add option to pick hyphenation rule according to
    current locale and make it the default for second
    translation table. (Pull request #38 and #39).
  - braille: Remove generated defs on "make clean". (Pull request #38).
  - braille: Turn non-breakable spaces to spaces. (Pull request
    [#38] and #39).
  - braille: Fix character encoding when extracting text. When
    extracing text from a zip file or a pdf, the resulting text
    is always utf-8 independently of the original locale, so we
    need to force that. (Pull request #38).
  - braille: Warn when no text translation was selected in case
    the user didn't notice. (Pull request #37).
  - braille: Fix spurious spacing after last Form-Feed (Pull
    request #45).
- Drop pdftoopvp_Silence-compiler-warning.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1535630400">- Do not diferentiate for service location, it is in sbindir
  on all systems we support now
- Use license for license install
- Version update to 1.21.1:
  - foomatic-rip: Fixed segmentation fault caused by wrong
    Coverity Scan issue fix (Issue #57, Debian bug #907026).
  - Build system: Require QPDF 8.1.0 or later as it is needed by
    bannertopdf (Issue #56).
  - libcupsfilters, cups-browsed, driverless, foomatic-rip,
    parallel: Silenced warnings from newest gcc.
  - libcupsfilters: When generating a PPD for driverless
    printing on a remote IPP printer, make pdftopdf not being
    run by the local queue if the remote queue is a CUPS queue
    to avoid running pdftopdf twice (CUPS Issue #5361).
  - libcupsfilters, cups-browsed, driverless, bannertopdf,
    foomatic-rip, pdftops, pdftoraster, rastertops,
    rastertoescpx, sys5ippprinter, beh: Fixed Coverity Scan
    issues. Thanks to Zdenek Dohnal (zdohnal at redhat dot com)
    for the tests and the patches.
  - bannertopdf: Switched over from using Poppler to using QPDF
    for generating the PDF pages. With Poppler unstable APIs
    were used which were subject to change. Thanks to Sahil
    Arora for this project in the Google Summer of Code 2018
    (Pull request #25).
  - cups-browsed: Manually defined clusters ("Cluster" directive
    in cups-browsed.conf) caused cups-browsed to crash.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1543406400">- Update to version 1.21.4:
  * cups-browsed: cups-browsed: Limit the number of retries for
    creating a print queue when it comes to HTTP timeouts. Number
    of retries given by HttpMaxRetries directive in
    cups-browsed.conf.
  * cups-browsed: Read out current time right before setting the
    timeouts.
  * libcupsfilters: In the PPD generator for driverless IPP
    printing let "*cupsManualCopies: true" lines get added to
    the PPD if printing is done in a raster format as then
    pdftopdf needs to generate the copies.
  * pdftoraster, pdftoopvp, pdftoijs: Fix build with
    Poppler &gt;= 0.70
  * pdftopdf: Fixed printing multiple copies on driverless IPP
    printers. When printing collated copies the multiple copies
    got applied twice, resulting in n*n instead of n copies.
  * pdftoraster, pdftoopvp, pdftoijs: Poppler removed memCheck
    and gMemReport functions, remove appropriate calls.
- Changes from version 1.21.3:
  * foomatic-rip: Reset stdin after replacing the underlying file
    descriptor.
- Changes from version 1.21.2:
  * cups-browsed: Fixed freeing of literal string caused by
    Coverity Scan issue fix.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1545134400">- Update to version 1.21.6:
  * Bug fix release, mainly for cups-browsed to avoid crashes and
    infinite printer removal/re-creation loops and spurious local
    queues for local CUPS printers. Also expanded PostScript
    interpreter bug workaround to more Apple LaserWriter models.
  * cups-browsed: To find out whether a DNS-SD-discovered printer
    is from the local machine, use not only the flags in the Avahi
    lookup result but also check the host name.
  * cups-browsed: When a local CUPS queue pointing to a remote CUPS
    printer was removed and re-created to make it a permanent
    queue, on_printer_deleted() was triggered by cupsd's
    notification to re-create a lost queue. Now
    on_printer_deleted() checks whether the queue is really gone
    and only re-creates then.
  * cups-browsed: When updating the CUPS queues, also removed and
    unregistered queues and not only created queues got checked for
    HTTP timeouts, which caused crashes on shutdown.
  * pdftops: Use the PS interpreter of Poppler for all Apple
    LaserWriter 16/600, 4/600, 12/640, 12/600, 12/660 as they all
    seem to not work with Ghostscript's PS output.
  * cups-browsed: On shutdown queues got removed even if they still
    had jobs.
- Changes from version 1.21.5:
  * Bug fix release, to build with Poppler 0.71 and with
    cups-browsed converting temporary CUPS queues reliably to
    permanent queues.
  * cups-browsed: We cannot reliably determine whether a CUPS queue
    is temporary, so we apply the procedure to make a temporary
    queue permanent to any unshared queue.
  * pdftoraster, pdftopdf, pdftoijs, pdftoopvp: Do not use the
    Poppler-specific "GBool", "gFalse", "gTrue" any more, as
    Poppler has switched to standard "bool", "false", "true" in
    version 0.71.0.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1546084800">- Fix building with Poppler 0.72
  Add 0001-Raise-minimum-poppler-version-from-0.18-to-0.19.patch
  Add 0002-Adapt-code-for-SplashXPathScanner-state-handling-sin.patch
  Add 0003-Support-some-more-methods-returning-const.patch
  Add 0004-Support-GooString-c_str-introduced-by-poppler-0.72.patch
  See https://github.com/OpenPrinting/cups-filters/pull/83</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1548676800">- Update to version 1.22.0:
  * From this release on the pdftopdf filter flattens interactive
    PDF forms and annotations internally, using QPDF, instead of
    calling external utilities. This especially eliminates slowing
    factors as additional piping of the data and unneeded use of
    PDF interpreters. Using external utilities for flattening is
    still possible in case of problems. In addition, a crash bug in
    cups-browsed got fixed and compatibility of the filters with
    Poppler 0.72 assured.
- Drop upstream fixed patches:
  * 0001-Raise-minimum-poppler-version-from-0.18-to-0.19.patch
  * 0002-Adapt-code-for-SplashXPathScanner-state-handling-sin.patch
  * 0003-Support-some-more-methods-returning-const.patch
  * 0004-Support-GooString-c_str-introduced-by-poppler-0.72.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550664000">- Update to version 1.22.1:
  * braille: Use sort command with LC_ALL=C for reproducibility
    of the genrated files, needed for distribution packaging.
  * cups-browsed, driverless: When polling the printer's
    capabilities via get-printer-attributes IPP request for
    driverless printing, use the attributes "all" and
    "media-col-database". Without "all" some printers do not report
    "urf-supported" and without "media-col-database" not all paper
    size and marging info gets reported.
  * braille: Document how to rework output before embossing.</changelog>
  <changelog author="jsmeix@suse.de" date="1554724800">- Version upgrade to 1.22.5
  * foomatic-rip: Changed Ghostscript call to count pages in a
    PDF file to use "runpdfbegin" and not the undocumented
    Ghostscript internal "pdfdict", so that it works with
    Ghostscript 9.27 and later (Debian bug #926576,
    Arch Linux bug #62251, openSUSE boo#1131771,
    cups@cups.org mailing list thread
    https://lists.cups.org/pipermail/cups/2019-April/074563.html).
- Version upgrade to 1.22.4
  * cups-browsed: Fix broken trailing space removal on
    "NickName" (Pull request #103).
  * pdftops: Emit PostScript Level 2 instead of Level 3 for
    Brother PostScript printers as at least some of them
    report to support level 3 but ontly work with Level 2
    (Ubuntu bug #1306849, comment #42).
  * bannertopdf: When multiplying the page for N-up or Duplex
    printing one page too much was generated (Issue #102).
- Version upgrade to 1.22.3
  * libcupsfilters: Added error checks for processing GIF, to
    avoid crashes or hangs on broken GIF files (Issues #81, #82,
    Pull request #100).
  * cups-browsed: Added hint to the man page and configuration
    file that with "DebugLogging stderr" the logging output goes
    to journal or syslog if cups-browsed is running as system
    service (Issue #28).
- Version upgrade to 1.22.2
  * cups-browsed: Let distribution of jobs sent to queues with
    "implicitclass" backend (usually clusters) be done by a
    "job-state" CUPS notification and not by
    "printer-state-changed" any more. The "job-state"
    notification already contains the job ID. Before we had to
    poll the job ID from CUPS via IPP which was sometimes
    unreliable (Issue #97).
  * imagetopdf, imagetoraster, pdftopdf, libcupsfilters: Added
    new page scaling options: "fill" scales the input page
    (typically a photo) so that the output page (typically with
    different aspect ratio) gets completely filled, aloowing for
    some content of the input page getting lost. "crop-to-fit"
    allows for easy printing of documents on slightly different
    output page sizes (A4 &lt;-&gt; Letter) maintaining the size and
    centering and cropping into the destination page. Thanks to
    Dheeraj Yadav (dhirajyadav135 at gmail dot com) for the
    patch (Pull request #92).
  * cups-browsed: Do not do IPP request for printer-is-shared
    option for remote cups queues with CUPS 2.2.x and newer
    (Pull request #91).
  * cups-browsed: Fix crash bug when reading "Cluster"
    directive from configuration file (Issue #94).
  * driverless: Updated man page as now also Mopria and
    Wi-Fi Direct printers are supported. Mentioned also
    ippusbxd.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559304000">- Update to version 1.23.0:
  * This release adds support for the "print-scaling" IPP attribute
    and has the code for the support of MuPDF as PDF renderer
    vastly simplified.
  * pdftops, mupdftoraster: Let pdftops call mutool directly and so
    that it directly outputs PostScript, eliminating the need to
    call the mupdftoraster and rastertops filters.
  * mupdftoraster: Reduced the use of temporary files from 3 to
    just one.
  * imagetopdf, imagetoraster, pdftopdf: Add support for
    print-scaling option.
- Changes from version 1.22.6:
  * Bug fix release, to address a further issue of cups-browsed
    removing user-created print queues, to make
    grayscale/monochrome PostScript jobs of colored input file
    actually output grayscale/monochrome files, to fix several bugs
    when using MuPDF as PDF renderer, and to silence compiler
    warnings.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559908800">- Update to version 1.25.0:
  * pdftoijs, pdftoopvp: Removed these deprecated filters
    completely as there is no demand for them any more. They also
    used unstable, undocumented APIs of Poppler.
  * pdftoraster: Changed from using unstable, undocumented APIs of
    Poppler to stable, documented ones, to improve maintainability
    of this filter, and with it of the cups-filters package.
  * libcupsfilters: Added support for color spaces CMY and RGBW
    when using filters without PPD file (mainly for development and
    debugging, option "print-color-mode" with values "cmy-XX" and
    "rgbw-XX" with XX being the number of bits per color).
- Changes from version 1.24.0:
  * cups-browsed: Integration of Deepak Patankar's Google Summer of
    Code 2018 project with the main goal of clustering different
    printers and automatically selecting the destination printers
    by job content and option/attribute settings.
  * cups-browsed, implicitclass: Support for mixed clusters of
    remote CUPS queues and IPP network printers. For this PPD files
    of remote CUPS queues are generated by cups-browsed based on
    IPP queries, as for native IPP printers, the number of jobs for
    load balancing is polled in a way that it works also with
    native IPP printers, the implicitclass backend sends jobs
    directly to the printer instead of re-queueing them via CUPS.
  * cups-browsed: Merge IPP attributes of several printers to
    combined attributes for the cluster to generate the cluster's
    PPD file, including PPD constraints for option combinations not
    fulfillable by any of the member printers, and finding
    reasonable, non-conflicting default settings.
  * cups-browsed: Selection algorithm for the destination printer
    for a job sent to the cluster. Based on the job settings
    requested such as page size, media type, print quality, the
    best most suitable printer in the cluster for the job will be
    selected.
  * cups-browsed, implicitclass: Filter jobs to clusters already
    locally. Due to the fact that a cluster's member printers are
    not exclusively non-raw CUPS queues with the complete filtering
    framework on the remote server, but also native IPP printers,
    we need to support generic driverless printers as destination.
    So we cannot pass on the input data unfiltered but need to
    filter locally. We let the cluster's PPD file emulate a PDF
    printer, letting the local CUPS queue of the cluster run
    pdftopdf and any pre-filters to turn the input into PDF and we
    let the implicitclass backend turn PDF into a format understood
    by the destination printer, supporting the 4 formats of
    driverless IPP printing: PDF, PWG Raster, Apple Raster, PCLm.
- Drop libpoppler-cpp0, libpoppler-devel and libpoppler-glib-devel
  BuildRequires.
- Add pkgconfig(poppler-cpp) BuildRequires following upstream
  changes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1560340800">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut the build queues by allowing usage of systemd-mini</changelog>
  <changelog author="idonmez@suse.com" date="1567512000">- Add add-cstring-include.patch to include cstring for memcpy
  and strcmp</changelog>
  <changelog author="jsmeix@suse.de" date="1618488000">- fix_upstream_issue348.patch fixes
  https://github.com/OpenPrinting/cups-filters/issues/348
  foomatic-rip segfaults with 'job-sheets=none,none'
  but works with 'job-sheets=none'
  (bsc#1182893)</changelog>
  <changelog author="jsmeix@suse.com" date="1684152000">- cups-filters-1.25.0-0001-beh-backend-Use-execv-instead-of-system-CVE-2023-24805.patch
  cups-filters-1.25.0-0002-beh-backend-Extra-checks-against-odd-forged-input-CVE-2023-24805.patch
  cups-filters-1.25.0-0003-beh-backend-Further-improvements-CVE-2023-24805.patch
  are the upstream
  0001-beh-backend-Use-execv-instead-of-system-CVE-2023-24805.patch
  0002-beh-backend-Extra-checks-against-odd-forged-input-CVE-2023-24805.patch
  0003-beh-backend-Further-improvements-CVE-2023-24805.patch
  backpported to cups-filters-1.25.0
  to fix CVE-2023-24805: RCE in cups-filters, beh CUPS backend
  (bsc#1211340)</changelog>
  <changelog author="tabraham@suse.com" date="1684756800">- gstoraster-gstopdf-Make-number-of-copies-as-embedded.patch fixes
  https://github.com/OpenPrinting/cups-filters/issues/255
  Printing multiple copies prints only 1 (pstopdf vs gstopdf)
  (bsc#1211401) (boo#1173345)</changelog>
  <changelog author="jsmeix@suse.com" date="1720008000">- bsc1225040.patch fixes bsc#1225040
  "cups-filters: Poppler for color PDF as grayscale via PS level 1:
  huge output makes printing slow"
  see https://github.com/OpenPrinting/cups-filters/issues/169
  Poppler for color PDF as grayscale via PS level 1 was introduced
  in cups-filters 1.22.6 via
  https://github.com/OpenPrinting/cups-filters/commit/48f9f994322c808ba2e9d0db6f3ff81caf8c0b72
  and disabled in cups-filters 1.25.12 via
  https://github.com/OpenPrinting/cups-filters/commit/0818ee322a6139be11d21fc76db345de1e979339</changelog>
</package>
<package pkgid="219f930a70f01adf56cabbf7671c64852a4d393b2b8b2a8f601a25455b0b06a0" name="cups-filters" arch="src">
  <version epoch="0" ver="1.25.0" rel="150200.3.12.3"/>
  <changelog author="jsmeix@suse.de" date="1522843200">- Version upgrade to 1.20.1
  to provide upstream bugfixes also for SLE15 / Leap15
  and be also already prepared for SLE12 (fate#323676).
  This is a bug fix release fixing several issues
  on the Braille support and other bugs, in particular
  (for details see the NEWS file):
  * libcupsfilters: Silenced warning when using CUPS &lt; 2.x
    by eliminating the use of a recently introduced
    CUPS library function, see
    https://bugs.linuxfoundation.org/show_bug.cgi?id=1421
  * cups-browsed: Fixed crash when CUPS reports a print queue
    without "device-uri" attribute when cups-browsed polls a
    list of local CUPS queues, see
    https://github.com/OpenPrinting/cups-filters/issues/16
- fix_upstream_bug_1421.patch is no longer needed because
  it is now fixed in the upstream sources
  (see the "libcupsfilters ... bug ... 1421" entry above).</changelog>
  <changelog author="jsmeix@suse.de" date="1523361600">- Version upgrade to 1.20.2
  to provide upstream bugfixes also for SLE15 / Leap15
  and be also already prepared for SLE12 (fate#323676).
  This is a bug fix release fixing the recognition
  of remote CUPS queues by cups-browsed, the behavior
  of cups-browsed when one creates a queue with the
  same name of a cups-browsed-generated queue overwriting
  it, and other bug fixes (for details see the NEWS file).</changelog>
  <changelog author="luizluca@gmail.com" date="1525262400">- Version upgrade to 1.20.3
  to fix regression from 1.20.2 that ignores printers published
  using legacy CUPS broadcast</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1531224000">- Add pdftoopvp_Silence-compiler-warning.patch: pdftoopvp: Silence
  compiler warning.</changelog>
  <changelog author="alarrosa@suse.com" date="1531828800">- Version upgrade to 1.20.4
  - gstoraster: Removed unneeded "if"s (Ghostscript bug #692705).
  - cups-browsed: When checking whether there is already a local
    print queue with the same URI as the one of the discovered
    printer, consider also as equal URI if the URIs only differ
    by use of IPP or IPPS and/or use of HTTPS port 443 instead
    of IPP port 631.
  - cups-browsed: Also upgrade from ipp: to ipps: when the ipps:
    URI is on HTTPS port 443 instead of IPP port 631. This is
    common on IPP network printers.
  - pdftopdf: Removed support for hardware-implemented reversing
    of page order in PostScript printers. It was once not
    correctly implemented in cups-filters and second, such
    printers are extremely rare, and on Gutenprint PPDs with
    pseudo OutputOrder option hardware reversing was even
    wrongly assumed (Issue #47).
  - pdftopdf: Accept option "output-order=normal/reverse" for
    reversing page order (Issue #47) and also "page-delivery=
    same-order/reverse-order" (CUPS Issue #5340).
  - libcupsfilters: Let the PPD generator add "*PageStackOrder
    ..."  lines to the choices of the "OutputBin" option, to
    mark which output bins need the pages printed in reverse
    order (Issue #47).
  - libcupsfilters: Let the PPD generator correctly create a
    "*DefaultOutputOrder: ..."  entry, depending on whether the
    paper is put out face-up or face-down in the default output
    bin (Issue #47).
  - libcupsfilters: Fixed human-readable name of the OutputBin
    option in the PPD generator.
  - pdftoopvp: Silence compiler warning (Issue #42).
  - cups-browsed: If the user modifies/overwrites a print queue
    created by cups-browsed, it will now not only be
    automatically released from the control of cups-browsed, but
    we also create a replacement for our generated local queue
    under a new name.
  - cups-browsed: Make URIS for using the implicitclass backend
    correctly working also with queue names containing an '@'
    character.
  - braille: Strengthen error checking (Pull request #41).
  - braille: Index: Replace bogus characters with space (Pull
    request #41).
  - braille: Add print and braille page number options (Pull
    request #41).
  - braille: Index: Use standard duplex cups option (Pull
    request #41).
  - cups-browsed: Moved auto-generation of PPD file for IPP
    network printers from create_remote_printer_entry()
    function to update_cups_queues(). This allows re-creating
    accidentally removed or overwritten local queues without
    losing the PPD file.
  - braille: Add option to pick hyphenation rule according to
    current locale and make it the default for second
    translation table. (Pull request #38 and #39).
  - braille: Remove generated defs on "make clean". (Pull request #38).
  - braille: Turn non-breakable spaces to spaces. (Pull request
    [#38] and #39).
  - braille: Fix character encoding when extracting text. When
    extracing text from a zip file or a pdf, the resulting text
    is always utf-8 independently of the original locale, so we
    need to force that. (Pull request #38).
  - braille: Warn when no text translation was selected in case
    the user didn't notice. (Pull request #37).
  - braille: Fix spurious spacing after last Form-Feed (Pull
    request #45).
- Drop pdftoopvp_Silence-compiler-warning.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1535630400">- Do not diferentiate for service location, it is in sbindir
  on all systems we support now
- Use license for license install
- Version update to 1.21.1:
  - foomatic-rip: Fixed segmentation fault caused by wrong
    Coverity Scan issue fix (Issue #57, Debian bug #907026).
  - Build system: Require QPDF 8.1.0 or later as it is needed by
    bannertopdf (Issue #56).
  - libcupsfilters, cups-browsed, driverless, foomatic-rip,
    parallel: Silenced warnings from newest gcc.
  - libcupsfilters: When generating a PPD for driverless
    printing on a remote IPP printer, make pdftopdf not being
    run by the local queue if the remote queue is a CUPS queue
    to avoid running pdftopdf twice (CUPS Issue #5361).
  - libcupsfilters, cups-browsed, driverless, bannertopdf,
    foomatic-rip, pdftops, pdftoraster, rastertops,
    rastertoescpx, sys5ippprinter, beh: Fixed Coverity Scan
    issues. Thanks to Zdenek Dohnal (zdohnal at redhat dot com)
    for the tests and the patches.
  - bannertopdf: Switched over from using Poppler to using QPDF
    for generating the PDF pages. With Poppler unstable APIs
    were used which were subject to change. Thanks to Sahil
    Arora for this project in the Google Summer of Code 2018
    (Pull request #25).
  - cups-browsed: Manually defined clusters ("Cluster" directive
    in cups-browsed.conf) caused cups-browsed to crash.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1543406400">- Update to version 1.21.4:
  * cups-browsed: cups-browsed: Limit the number of retries for
    creating a print queue when it comes to HTTP timeouts. Number
    of retries given by HttpMaxRetries directive in
    cups-browsed.conf.
  * cups-browsed: Read out current time right before setting the
    timeouts.
  * libcupsfilters: In the PPD generator for driverless IPP
    printing let "*cupsManualCopies: true" lines get added to
    the PPD if printing is done in a raster format as then
    pdftopdf needs to generate the copies.
  * pdftoraster, pdftoopvp, pdftoijs: Fix build with
    Poppler &gt;= 0.70
  * pdftopdf: Fixed printing multiple copies on driverless IPP
    printers. When printing collated copies the multiple copies
    got applied twice, resulting in n*n instead of n copies.
  * pdftoraster, pdftoopvp, pdftoijs: Poppler removed memCheck
    and gMemReport functions, remove appropriate calls.
- Changes from version 1.21.3:
  * foomatic-rip: Reset stdin after replacing the underlying file
    descriptor.
- Changes from version 1.21.2:
  * cups-browsed: Fixed freeing of literal string caused by
    Coverity Scan issue fix.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1545134400">- Update to version 1.21.6:
  * Bug fix release, mainly for cups-browsed to avoid crashes and
    infinite printer removal/re-creation loops and spurious local
    queues for local CUPS printers. Also expanded PostScript
    interpreter bug workaround to more Apple LaserWriter models.
  * cups-browsed: To find out whether a DNS-SD-discovered printer
    is from the local machine, use not only the flags in the Avahi
    lookup result but also check the host name.
  * cups-browsed: When a local CUPS queue pointing to a remote CUPS
    printer was removed and re-created to make it a permanent
    queue, on_printer_deleted() was triggered by cupsd's
    notification to re-create a lost queue. Now
    on_printer_deleted() checks whether the queue is really gone
    and only re-creates then.
  * cups-browsed: When updating the CUPS queues, also removed and
    unregistered queues and not only created queues got checked for
    HTTP timeouts, which caused crashes on shutdown.
  * pdftops: Use the PS interpreter of Poppler for all Apple
    LaserWriter 16/600, 4/600, 12/640, 12/600, 12/660 as they all
    seem to not work with Ghostscript's PS output.
  * cups-browsed: On shutdown queues got removed even if they still
    had jobs.
- Changes from version 1.21.5:
  * Bug fix release, to build with Poppler 0.71 and with
    cups-browsed converting temporary CUPS queues reliably to
    permanent queues.
  * cups-browsed: We cannot reliably determine whether a CUPS queue
    is temporary, so we apply the procedure to make a temporary
    queue permanent to any unshared queue.
  * pdftoraster, pdftopdf, pdftoijs, pdftoopvp: Do not use the
    Poppler-specific "GBool", "gFalse", "gTrue" any more, as
    Poppler has switched to standard "bool", "false", "true" in
    version 0.71.0.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1546084800">- Fix building with Poppler 0.72
  Add 0001-Raise-minimum-poppler-version-from-0.18-to-0.19.patch
  Add 0002-Adapt-code-for-SplashXPathScanner-state-handling-sin.patch
  Add 0003-Support-some-more-methods-returning-const.patch
  Add 0004-Support-GooString-c_str-introduced-by-poppler-0.72.patch
  See https://github.com/OpenPrinting/cups-filters/pull/83</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1548676800">- Update to version 1.22.0:
  * From this release on the pdftopdf filter flattens interactive
    PDF forms and annotations internally, using QPDF, instead of
    calling external utilities. This especially eliminates slowing
    factors as additional piping of the data and unneeded use of
    PDF interpreters. Using external utilities for flattening is
    still possible in case of problems. In addition, a crash bug in
    cups-browsed got fixed and compatibility of the filters with
    Poppler 0.72 assured.
- Drop upstream fixed patches:
  * 0001-Raise-minimum-poppler-version-from-0.18-to-0.19.patch
  * 0002-Adapt-code-for-SplashXPathScanner-state-handling-sin.patch
  * 0003-Support-some-more-methods-returning-const.patch
  * 0004-Support-GooString-c_str-introduced-by-poppler-0.72.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550664000">- Update to version 1.22.1:
  * braille: Use sort command with LC_ALL=C for reproducibility
    of the genrated files, needed for distribution packaging.
  * cups-browsed, driverless: When polling the printer's
    capabilities via get-printer-attributes IPP request for
    driverless printing, use the attributes "all" and
    "media-col-database". Without "all" some printers do not report
    "urf-supported" and without "media-col-database" not all paper
    size and marging info gets reported.
  * braille: Document how to rework output before embossing.</changelog>
  <changelog author="jsmeix@suse.de" date="1554724800">- Version upgrade to 1.22.5
  * foomatic-rip: Changed Ghostscript call to count pages in a
    PDF file to use "runpdfbegin" and not the undocumented
    Ghostscript internal "pdfdict", so that it works with
    Ghostscript 9.27 and later (Debian bug #926576,
    Arch Linux bug #62251, openSUSE boo#1131771,
    cups@cups.org mailing list thread
    https://lists.cups.org/pipermail/cups/2019-April/074563.html).
- Version upgrade to 1.22.4
  * cups-browsed: Fix broken trailing space removal on
    "NickName" (Pull request #103).
  * pdftops: Emit PostScript Level 2 instead of Level 3 for
    Brother PostScript printers as at least some of them
    report to support level 3 but ontly work with Level 2
    (Ubuntu bug #1306849, comment #42).
  * bannertopdf: When multiplying the page for N-up or Duplex
    printing one page too much was generated (Issue #102).
- Version upgrade to 1.22.3
  * libcupsfilters: Added error checks for processing GIF, to
    avoid crashes or hangs on broken GIF files (Issues #81, #82,
    Pull request #100).
  * cups-browsed: Added hint to the man page and configuration
    file that with "DebugLogging stderr" the logging output goes
    to journal or syslog if cups-browsed is running as system
    service (Issue #28).
- Version upgrade to 1.22.2
  * cups-browsed: Let distribution of jobs sent to queues with
    "implicitclass" backend (usually clusters) be done by a
    "job-state" CUPS notification and not by
    "printer-state-changed" any more. The "job-state"
    notification already contains the job ID. Before we had to
    poll the job ID from CUPS via IPP which was sometimes
    unreliable (Issue #97).
  * imagetopdf, imagetoraster, pdftopdf, libcupsfilters: Added
    new page scaling options: "fill" scales the input page
    (typically a photo) so that the output page (typically with
    different aspect ratio) gets completely filled, aloowing for
    some content of the input page getting lost. "crop-to-fit"
    allows for easy printing of documents on slightly different
    output page sizes (A4 &lt;-&gt; Letter) maintaining the size and
    centering and cropping into the destination page. Thanks to
    Dheeraj Yadav (dhirajyadav135 at gmail dot com) for the
    patch (Pull request #92).
  * cups-browsed: Do not do IPP request for printer-is-shared
    option for remote cups queues with CUPS 2.2.x and newer
    (Pull request #91).
  * cups-browsed: Fix crash bug when reading "Cluster"
    directive from configuration file (Issue #94).
  * driverless: Updated man page as now also Mopria and
    Wi-Fi Direct printers are supported. Mentioned also
    ippusbxd.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559304000">- Update to version 1.23.0:
  * This release adds support for the "print-scaling" IPP attribute
    and has the code for the support of MuPDF as PDF renderer
    vastly simplified.
  * pdftops, mupdftoraster: Let pdftops call mutool directly and so
    that it directly outputs PostScript, eliminating the need to
    call the mupdftoraster and rastertops filters.
  * mupdftoraster: Reduced the use of temporary files from 3 to
    just one.
  * imagetopdf, imagetoraster, pdftopdf: Add support for
    print-scaling option.
- Changes from version 1.22.6:
  * Bug fix release, to address a further issue of cups-browsed
    removing user-created print queues, to make
    grayscale/monochrome PostScript jobs of colored input file
    actually output grayscale/monochrome files, to fix several bugs
    when using MuPDF as PDF renderer, and to silence compiler
    warnings.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559908800">- Update to version 1.25.0:
  * pdftoijs, pdftoopvp: Removed these deprecated filters
    completely as there is no demand for them any more. They also
    used unstable, undocumented APIs of Poppler.
  * pdftoraster: Changed from using unstable, undocumented APIs of
    Poppler to stable, documented ones, to improve maintainability
    of this filter, and with it of the cups-filters package.
  * libcupsfilters: Added support for color spaces CMY and RGBW
    when using filters without PPD file (mainly for development and
    debugging, option "print-color-mode" with values "cmy-XX" and
    "rgbw-XX" with XX being the number of bits per color).
- Changes from version 1.24.0:
  * cups-browsed: Integration of Deepak Patankar's Google Summer of
    Code 2018 project with the main goal of clustering different
    printers and automatically selecting the destination printers
    by job content and option/attribute settings.
  * cups-browsed, implicitclass: Support for mixed clusters of
    remote CUPS queues and IPP network printers. For this PPD files
    of remote CUPS queues are generated by cups-browsed based on
    IPP queries, as for native IPP printers, the number of jobs for
    load balancing is polled in a way that it works also with
    native IPP printers, the implicitclass backend sends jobs
    directly to the printer instead of re-queueing them via CUPS.
  * cups-browsed: Merge IPP attributes of several printers to
    combined attributes for the cluster to generate the cluster's
    PPD file, including PPD constraints for option combinations not
    fulfillable by any of the member printers, and finding
    reasonable, non-conflicting default settings.
  * cups-browsed: Selection algorithm for the destination printer
    for a job sent to the cluster. Based on the job settings
    requested such as page size, media type, print quality, the
    best most suitable printer in the cluster for the job will be
    selected.
  * cups-browsed, implicitclass: Filter jobs to clusters already
    locally. Due to the fact that a cluster's member printers are
    not exclusively non-raw CUPS queues with the complete filtering
    framework on the remote server, but also native IPP printers,
    we need to support generic driverless printers as destination.
    So we cannot pass on the input data unfiltered but need to
    filter locally. We let the cluster's PPD file emulate a PDF
    printer, letting the local CUPS queue of the cluster run
    pdftopdf and any pre-filters to turn the input into PDF and we
    let the implicitclass backend turn PDF into a format understood
    by the destination printer, supporting the 4 formats of
    driverless IPP printing: PDF, PWG Raster, Apple Raster, PCLm.
- Drop libpoppler-cpp0, libpoppler-devel and libpoppler-glib-devel
  BuildRequires.
- Add pkgconfig(poppler-cpp) BuildRequires following upstream
  changes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1560340800">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut the build queues by allowing usage of systemd-mini</changelog>
  <changelog author="idonmez@suse.com" date="1567512000">- Add add-cstring-include.patch to include cstring for memcpy
  and strcmp</changelog>
  <changelog author="jsmeix@suse.de" date="1618488000">- fix_upstream_issue348.patch fixes
  https://github.com/OpenPrinting/cups-filters/issues/348
  foomatic-rip segfaults with 'job-sheets=none,none'
  but works with 'job-sheets=none'
  (bsc#1182893)</changelog>
  <changelog author="jsmeix@suse.com" date="1684152000">- cups-filters-1.25.0-0001-beh-backend-Use-execv-instead-of-system-CVE-2023-24805.patch
  cups-filters-1.25.0-0002-beh-backend-Extra-checks-against-odd-forged-input-CVE-2023-24805.patch
  cups-filters-1.25.0-0003-beh-backend-Further-improvements-CVE-2023-24805.patch
  are the upstream
  0001-beh-backend-Use-execv-instead-of-system-CVE-2023-24805.patch
  0002-beh-backend-Extra-checks-against-odd-forged-input-CVE-2023-24805.patch
  0003-beh-backend-Further-improvements-CVE-2023-24805.patch
  backpported to cups-filters-1.25.0
  to fix CVE-2023-24805: RCE in cups-filters, beh CUPS backend
  (bsc#1211340)</changelog>
  <changelog author="tabraham@suse.com" date="1684756800">- gstoraster-gstopdf-Make-number-of-copies-as-embedded.patch fixes
  https://github.com/OpenPrinting/cups-filters/issues/255
  Printing multiple copies prints only 1 (pstopdf vs gstopdf)
  (bsc#1211401) (boo#1173345)</changelog>
  <changelog author="jsmeix@suse.com" date="1720008000">- bsc1225040.patch fixes bsc#1225040
  "cups-filters: Poppler for color PDF as grayscale via PS level 1:
  huge output makes printing slow"
  see https://github.com/OpenPrinting/cups-filters/issues/169
  Poppler for color PDF as grayscale via PS level 1 was introduced
  in cups-filters 1.22.6 via
  https://github.com/OpenPrinting/cups-filters/commit/48f9f994322c808ba2e9d0db6f3ff81caf8c0b72
  and disabled in cups-filters 1.25.12 via
  https://github.com/OpenPrinting/cups-filters/commit/0818ee322a6139be11d21fc76db345de1e979339</changelog>
</package>
<package pkgid="3e77bb38d67eca3b820324a284741eb0c49618a6acb4915305d95d1e65a84f32" name="cups-filters" arch="x86_64">
  <version epoch="0" ver="1.25.0" rel="150200.3.12.3"/>
  <changelog author="jsmeix@suse.de" date="1522843200">- Version upgrade to 1.20.1
  to provide upstream bugfixes also for SLE15 / Leap15
  and be also already prepared for SLE12 (fate#323676).
  This is a bug fix release fixing several issues
  on the Braille support and other bugs, in particular
  (for details see the NEWS file):
  * libcupsfilters: Silenced warning when using CUPS &lt; 2.x
    by eliminating the use of a recently introduced
    CUPS library function, see
    https://bugs.linuxfoundation.org/show_bug.cgi?id=1421
  * cups-browsed: Fixed crash when CUPS reports a print queue
    without "device-uri" attribute when cups-browsed polls a
    list of local CUPS queues, see
    https://github.com/OpenPrinting/cups-filters/issues/16
- fix_upstream_bug_1421.patch is no longer needed because
  it is now fixed in the upstream sources
  (see the "libcupsfilters ... bug ... 1421" entry above).</changelog>
  <changelog author="jsmeix@suse.de" date="1523361600">- Version upgrade to 1.20.2
  to provide upstream bugfixes also for SLE15 / Leap15
  and be also already prepared for SLE12 (fate#323676).
  This is a bug fix release fixing the recognition
  of remote CUPS queues by cups-browsed, the behavior
  of cups-browsed when one creates a queue with the
  same name of a cups-browsed-generated queue overwriting
  it, and other bug fixes (for details see the NEWS file).</changelog>
  <changelog author="luizluca@gmail.com" date="1525262400">- Version upgrade to 1.20.3
  to fix regression from 1.20.2 that ignores printers published
  using legacy CUPS broadcast</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1531224000">- Add pdftoopvp_Silence-compiler-warning.patch: pdftoopvp: Silence
  compiler warning.</changelog>
  <changelog author="alarrosa@suse.com" date="1531828800">- Version upgrade to 1.20.4
  - gstoraster: Removed unneeded "if"s (Ghostscript bug #692705).
  - cups-browsed: When checking whether there is already a local
    print queue with the same URI as the one of the discovered
    printer, consider also as equal URI if the URIs only differ
    by use of IPP or IPPS and/or use of HTTPS port 443 instead
    of IPP port 631.
  - cups-browsed: Also upgrade from ipp: to ipps: when the ipps:
    URI is on HTTPS port 443 instead of IPP port 631. This is
    common on IPP network printers.
  - pdftopdf: Removed support for hardware-implemented reversing
    of page order in PostScript printers. It was once not
    correctly implemented in cups-filters and second, such
    printers are extremely rare, and on Gutenprint PPDs with
    pseudo OutputOrder option hardware reversing was even
    wrongly assumed (Issue #47).
  - pdftopdf: Accept option "output-order=normal/reverse" for
    reversing page order (Issue #47) and also "page-delivery=
    same-order/reverse-order" (CUPS Issue #5340).
  - libcupsfilters: Let the PPD generator add "*PageStackOrder
    ..."  lines to the choices of the "OutputBin" option, to
    mark which output bins need the pages printed in reverse
    order (Issue #47).
  - libcupsfilters: Let the PPD generator correctly create a
    "*DefaultOutputOrder: ..."  entry, depending on whether the
    paper is put out face-up or face-down in the default output
    bin (Issue #47).
  - libcupsfilters: Fixed human-readable name of the OutputBin
    option in the PPD generator.
  - pdftoopvp: Silence compiler warning (Issue #42).
  - cups-browsed: If the user modifies/overwrites a print queue
    created by cups-browsed, it will now not only be
    automatically released from the control of cups-browsed, but
    we also create a replacement for our generated local queue
    under a new name.
  - cups-browsed: Make URIS for using the implicitclass backend
    correctly working also with queue names containing an '@'
    character.
  - braille: Strengthen error checking (Pull request #41).
  - braille: Index: Replace bogus characters with space (Pull
    request #41).
  - braille: Add print and braille page number options (Pull
    request #41).
  - braille: Index: Use standard duplex cups option (Pull
    request #41).
  - cups-browsed: Moved auto-generation of PPD file for IPP
    network printers from create_remote_printer_entry()
    function to update_cups_queues(). This allows re-creating
    accidentally removed or overwritten local queues without
    losing the PPD file.
  - braille: Add option to pick hyphenation rule according to
    current locale and make it the default for second
    translation table. (Pull request #38 and #39).
  - braille: Remove generated defs on "make clean". (Pull request #38).
  - braille: Turn non-breakable spaces to spaces. (Pull request
    [#38] and #39).
  - braille: Fix character encoding when extracting text. When
    extracing text from a zip file or a pdf, the resulting text
    is always utf-8 independently of the original locale, so we
    need to force that. (Pull request #38).
  - braille: Warn when no text translation was selected in case
    the user didn't notice. (Pull request #37).
  - braille: Fix spurious spacing after last Form-Feed (Pull
    request #45).
- Drop pdftoopvp_Silence-compiler-warning.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1535630400">- Do not diferentiate for service location, it is in sbindir
  on all systems we support now
- Use license for license install
- Version update to 1.21.1:
  - foomatic-rip: Fixed segmentation fault caused by wrong
    Coverity Scan issue fix (Issue #57, Debian bug #907026).
  - Build system: Require QPDF 8.1.0 or later as it is needed by
    bannertopdf (Issue #56).
  - libcupsfilters, cups-browsed, driverless, foomatic-rip,
    parallel: Silenced warnings from newest gcc.
  - libcupsfilters: When generating a PPD for driverless
    printing on a remote IPP printer, make pdftopdf not being
    run by the local queue if the remote queue is a CUPS queue
    to avoid running pdftopdf twice (CUPS Issue #5361).
  - libcupsfilters, cups-browsed, driverless, bannertopdf,
    foomatic-rip, pdftops, pdftoraster, rastertops,
    rastertoescpx, sys5ippprinter, beh: Fixed Coverity Scan
    issues. Thanks to Zdenek Dohnal (zdohnal at redhat dot com)
    for the tests and the patches.
  - bannertopdf: Switched over from using Poppler to using QPDF
    for generating the PDF pages. With Poppler unstable APIs
    were used which were subject to change. Thanks to Sahil
    Arora for this project in the Google Summer of Code 2018
    (Pull request #25).
  - cups-browsed: Manually defined clusters ("Cluster" directive
    in cups-browsed.conf) caused cups-browsed to crash.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1543406400">- Update to version 1.21.4:
  * cups-browsed: cups-browsed: Limit the number of retries for
    creating a print queue when it comes to HTTP timeouts. Number
    of retries given by HttpMaxRetries directive in
    cups-browsed.conf.
  * cups-browsed: Read out current time right before setting the
    timeouts.
  * libcupsfilters: In the PPD generator for driverless IPP
    printing let "*cupsManualCopies: true" lines get added to
    the PPD if printing is done in a raster format as then
    pdftopdf needs to generate the copies.
  * pdftoraster, pdftoopvp, pdftoijs: Fix build with
    Poppler &gt;= 0.70
  * pdftopdf: Fixed printing multiple copies on driverless IPP
    printers. When printing collated copies the multiple copies
    got applied twice, resulting in n*n instead of n copies.
  * pdftoraster, pdftoopvp, pdftoijs: Poppler removed memCheck
    and gMemReport functions, remove appropriate calls.
- Changes from version 1.21.3:
  * foomatic-rip: Reset stdin after replacing the underlying file
    descriptor.
- Changes from version 1.21.2:
  * cups-browsed: Fixed freeing of literal string caused by
    Coverity Scan issue fix.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1545134400">- Update to version 1.21.6:
  * Bug fix release, mainly for cups-browsed to avoid crashes and
    infinite printer removal/re-creation loops and spurious local
    queues for local CUPS printers. Also expanded PostScript
    interpreter bug workaround to more Apple LaserWriter models.
  * cups-browsed: To find out whether a DNS-SD-discovered printer
    is from the local machine, use not only the flags in the Avahi
    lookup result but also check the host name.
  * cups-browsed: When a local CUPS queue pointing to a remote CUPS
    printer was removed and re-created to make it a permanent
    queue, on_printer_deleted() was triggered by cupsd's
    notification to re-create a lost queue. Now
    on_printer_deleted() checks whether the queue is really gone
    and only re-creates then.
  * cups-browsed: When updating the CUPS queues, also removed and
    unregistered queues and not only created queues got checked for
    HTTP timeouts, which caused crashes on shutdown.
  * pdftops: Use the PS interpreter of Poppler for all Apple
    LaserWriter 16/600, 4/600, 12/640, 12/600, 12/660 as they all
    seem to not work with Ghostscript's PS output.
  * cups-browsed: On shutdown queues got removed even if they still
    had jobs.
- Changes from version 1.21.5:
  * Bug fix release, to build with Poppler 0.71 and with
    cups-browsed converting temporary CUPS queues reliably to
    permanent queues.
  * cups-browsed: We cannot reliably determine whether a CUPS queue
    is temporary, so we apply the procedure to make a temporary
    queue permanent to any unshared queue.
  * pdftoraster, pdftopdf, pdftoijs, pdftoopvp: Do not use the
    Poppler-specific "GBool", "gFalse", "gTrue" any more, as
    Poppler has switched to standard "bool", "false", "true" in
    version 0.71.0.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1546084800">- Fix building with Poppler 0.72
  Add 0001-Raise-minimum-poppler-version-from-0.18-to-0.19.patch
  Add 0002-Adapt-code-for-SplashXPathScanner-state-handling-sin.patch
  Add 0003-Support-some-more-methods-returning-const.patch
  Add 0004-Support-GooString-c_str-introduced-by-poppler-0.72.patch
  See https://github.com/OpenPrinting/cups-filters/pull/83</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1548676800">- Update to version 1.22.0:
  * From this release on the pdftopdf filter flattens interactive
    PDF forms and annotations internally, using QPDF, instead of
    calling external utilities. This especially eliminates slowing
    factors as additional piping of the data and unneeded use of
    PDF interpreters. Using external utilities for flattening is
    still possible in case of problems. In addition, a crash bug in
    cups-browsed got fixed and compatibility of the filters with
    Poppler 0.72 assured.
- Drop upstream fixed patches:
  * 0001-Raise-minimum-poppler-version-from-0.18-to-0.19.patch
  * 0002-Adapt-code-for-SplashXPathScanner-state-handling-sin.patch
  * 0003-Support-some-more-methods-returning-const.patch
  * 0004-Support-GooString-c_str-introduced-by-poppler-0.72.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550664000">- Update to version 1.22.1:
  * braille: Use sort command with LC_ALL=C for reproducibility
    of the genrated files, needed for distribution packaging.
  * cups-browsed, driverless: When polling the printer's
    capabilities via get-printer-attributes IPP request for
    driverless printing, use the attributes "all" and
    "media-col-database". Without "all" some printers do not report
    "urf-supported" and without "media-col-database" not all paper
    size and marging info gets reported.
  * braille: Document how to rework output before embossing.</changelog>
  <changelog author="jsmeix@suse.de" date="1554724800">- Version upgrade to 1.22.5
  * foomatic-rip: Changed Ghostscript call to count pages in a
    PDF file to use "runpdfbegin" and not the undocumented
    Ghostscript internal "pdfdict", so that it works with
    Ghostscript 9.27 and later (Debian bug #926576,
    Arch Linux bug #62251, openSUSE boo#1131771,
    cups@cups.org mailing list thread
    https://lists.cups.org/pipermail/cups/2019-April/074563.html).
- Version upgrade to 1.22.4
  * cups-browsed: Fix broken trailing space removal on
    "NickName" (Pull request #103).
  * pdftops: Emit PostScript Level 2 instead of Level 3 for
    Brother PostScript printers as at least some of them
    report to support level 3 but ontly work with Level 2
    (Ubuntu bug #1306849, comment #42).
  * bannertopdf: When multiplying the page for N-up or Duplex
    printing one page too much was generated (Issue #102).
- Version upgrade to 1.22.3
  * libcupsfilters: Added error checks for processing GIF, to
    avoid crashes or hangs on broken GIF files (Issues #81, #82,
    Pull request #100).
  * cups-browsed: Added hint to the man page and configuration
    file that with "DebugLogging stderr" the logging output goes
    to journal or syslog if cups-browsed is running as system
    service (Issue #28).
- Version upgrade to 1.22.2
  * cups-browsed: Let distribution of jobs sent to queues with
    "implicitclass" backend (usually clusters) be done by a
    "job-state" CUPS notification and not by
    "printer-state-changed" any more. The "job-state"
    notification already contains the job ID. Before we had to
    poll the job ID from CUPS via IPP which was sometimes
    unreliable (Issue #97).
  * imagetopdf, imagetoraster, pdftopdf, libcupsfilters: Added
    new page scaling options: "fill" scales the input page
    (typically a photo) so that the output page (typically with
    different aspect ratio) gets completely filled, aloowing for
    some content of the input page getting lost. "crop-to-fit"
    allows for easy printing of documents on slightly different
    output page sizes (A4 &lt;-&gt; Letter) maintaining the size and
    centering and cropping into the destination page. Thanks to
    Dheeraj Yadav (dhirajyadav135 at gmail dot com) for the
    patch (Pull request #92).
  * cups-browsed: Do not do IPP request for printer-is-shared
    option for remote cups queues with CUPS 2.2.x and newer
    (Pull request #91).
  * cups-browsed: Fix crash bug when reading "Cluster"
    directive from configuration file (Issue #94).
  * driverless: Updated man page as now also Mopria and
    Wi-Fi Direct printers are supported. Mentioned also
    ippusbxd.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559304000">- Update to version 1.23.0:
  * This release adds support for the "print-scaling" IPP attribute
    and has the code for the support of MuPDF as PDF renderer
    vastly simplified.
  * pdftops, mupdftoraster: Let pdftops call mutool directly and so
    that it directly outputs PostScript, eliminating the need to
    call the mupdftoraster and rastertops filters.
  * mupdftoraster: Reduced the use of temporary files from 3 to
    just one.
  * imagetopdf, imagetoraster, pdftopdf: Add support for
    print-scaling option.
- Changes from version 1.22.6:
  * Bug fix release, to address a further issue of cups-browsed
    removing user-created print queues, to make
    grayscale/monochrome PostScript jobs of colored input file
    actually output grayscale/monochrome files, to fix several bugs
    when using MuPDF as PDF renderer, and to silence compiler
    warnings.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559908800">- Update to version 1.25.0:
  * pdftoijs, pdftoopvp: Removed these deprecated filters
    completely as there is no demand for them any more. They also
    used unstable, undocumented APIs of Poppler.
  * pdftoraster: Changed from using unstable, undocumented APIs of
    Poppler to stable, documented ones, to improve maintainability
    of this filter, and with it of the cups-filters package.
  * libcupsfilters: Added support for color spaces CMY and RGBW
    when using filters without PPD file (mainly for development and
    debugging, option "print-color-mode" with values "cmy-XX" and
    "rgbw-XX" with XX being the number of bits per color).
- Changes from version 1.24.0:
  * cups-browsed: Integration of Deepak Patankar's Google Summer of
    Code 2018 project with the main goal of clustering different
    printers and automatically selecting the destination printers
    by job content and option/attribute settings.
  * cups-browsed, implicitclass: Support for mixed clusters of
    remote CUPS queues and IPP network printers. For this PPD files
    of remote CUPS queues are generated by cups-browsed based on
    IPP queries, as for native IPP printers, the number of jobs for
    load balancing is polled in a way that it works also with
    native IPP printers, the implicitclass backend sends jobs
    directly to the printer instead of re-queueing them via CUPS.
  * cups-browsed: Merge IPP attributes of several printers to
    combined attributes for the cluster to generate the cluster's
    PPD file, including PPD constraints for option combinations not
    fulfillable by any of the member printers, and finding
    reasonable, non-conflicting default settings.
  * cups-browsed: Selection algorithm for the destination printer
    for a job sent to the cluster. Based on the job settings
    requested such as page size, media type, print quality, the
    best most suitable printer in the cluster for the job will be
    selected.
  * cups-browsed, implicitclass: Filter jobs to clusters already
    locally. Due to the fact that a cluster's member printers are
    not exclusively non-raw CUPS queues with the complete filtering
    framework on the remote server, but also native IPP printers,
    we need to support generic driverless printers as destination.
    So we cannot pass on the input data unfiltered but need to
    filter locally. We let the cluster's PPD file emulate a PDF
    printer, letting the local CUPS queue of the cluster run
    pdftopdf and any pre-filters to turn the input into PDF and we
    let the implicitclass backend turn PDF into a format understood
    by the destination printer, supporting the 4 formats of
    driverless IPP printing: PDF, PWG Raster, Apple Raster, PCLm.
- Drop libpoppler-cpp0, libpoppler-devel and libpoppler-glib-devel
  BuildRequires.
- Add pkgconfig(poppler-cpp) BuildRequires following upstream
  changes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1560340800">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut the build queues by allowing usage of systemd-mini</changelog>
  <changelog author="idonmez@suse.com" date="1567512000">- Add add-cstring-include.patch to include cstring for memcpy
  and strcmp</changelog>
  <changelog author="jsmeix@suse.de" date="1618488000">- fix_upstream_issue348.patch fixes
  https://github.com/OpenPrinting/cups-filters/issues/348
  foomatic-rip segfaults with 'job-sheets=none,none'
  but works with 'job-sheets=none'
  (bsc#1182893)</changelog>
  <changelog author="jsmeix@suse.com" date="1684152000">- cups-filters-1.25.0-0001-beh-backend-Use-execv-instead-of-system-CVE-2023-24805.patch
  cups-filters-1.25.0-0002-beh-backend-Extra-checks-against-odd-forged-input-CVE-2023-24805.patch
  cups-filters-1.25.0-0003-beh-backend-Further-improvements-CVE-2023-24805.patch
  are the upstream
  0001-beh-backend-Use-execv-instead-of-system-CVE-2023-24805.patch
  0002-beh-backend-Extra-checks-against-odd-forged-input-CVE-2023-24805.patch
  0003-beh-backend-Further-improvements-CVE-2023-24805.patch
  backpported to cups-filters-1.25.0
  to fix CVE-2023-24805: RCE in cups-filters, beh CUPS backend
  (bsc#1211340)</changelog>
  <changelog author="tabraham@suse.com" date="1684756800">- gstoraster-gstopdf-Make-number-of-copies-as-embedded.patch fixes
  https://github.com/OpenPrinting/cups-filters/issues/255
  Printing multiple copies prints only 1 (pstopdf vs gstopdf)
  (bsc#1211401) (boo#1173345)</changelog>
  <changelog author="jsmeix@suse.com" date="1720008000">- bsc1225040.patch fixes bsc#1225040
  "cups-filters: Poppler for color PDF as grayscale via PS level 1:
  huge output makes printing slow"
  see https://github.com/OpenPrinting/cups-filters/issues/169
  Poppler for color PDF as grayscale via PS level 1 was introduced
  in cups-filters 1.22.6 via
  https://github.com/OpenPrinting/cups-filters/commit/48f9f994322c808ba2e9d0db6f3ff81caf8c0b72
  and disabled in cups-filters 1.25.12 via
  https://github.com/OpenPrinting/cups-filters/commit/0818ee322a6139be11d21fc76db345de1e979339</changelog>
</package>
<package pkgid="276362bfcbf671c2029782d05ada9654c014edbdd493291412e5d6ef3fb80de3" name="cups-filters-devel" arch="aarch64">
  <version epoch="0" ver="1.25.0" rel="150200.3.12.3"/>
  <changelog author="jsmeix@suse.de" date="1522843200">- Version upgrade to 1.20.1
  to provide upstream bugfixes also for SLE15 / Leap15
  and be also already prepared for SLE12 (fate#323676).
  This is a bug fix release fixing several issues
  on the Braille support and other bugs, in particular
  (for details see the NEWS file):
  * libcupsfilters: Silenced warning when using CUPS &lt; 2.x
    by eliminating the use of a recently introduced
    CUPS library function, see
    https://bugs.linuxfoundation.org/show_bug.cgi?id=1421
  * cups-browsed: Fixed crash when CUPS reports a print queue
    without "device-uri" attribute when cups-browsed polls a
    list of local CUPS queues, see
    https://github.com/OpenPrinting/cups-filters/issues/16
- fix_upstream_bug_1421.patch is no longer needed because
  it is now fixed in the upstream sources
  (see the "libcupsfilters ... bug ... 1421" entry above).</changelog>
  <changelog author="jsmeix@suse.de" date="1523361600">- Version upgrade to 1.20.2
  to provide upstream bugfixes also for SLE15 / Leap15
  and be also already prepared for SLE12 (fate#323676).
  This is a bug fix release fixing the recognition
  of remote CUPS queues by cups-browsed, the behavior
  of cups-browsed when one creates a queue with the
  same name of a cups-browsed-generated queue overwriting
  it, and other bug fixes (for details see the NEWS file).</changelog>
  <changelog author="luizluca@gmail.com" date="1525262400">- Version upgrade to 1.20.3
  to fix regression from 1.20.2 that ignores printers published
  using legacy CUPS broadcast</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1531224000">- Add pdftoopvp_Silence-compiler-warning.patch: pdftoopvp: Silence
  compiler warning.</changelog>
  <changelog author="alarrosa@suse.com" date="1531828800">- Version upgrade to 1.20.4
  - gstoraster: Removed unneeded "if"s (Ghostscript bug #692705).
  - cups-browsed: When checking whether there is already a local
    print queue with the same URI as the one of the discovered
    printer, consider also as equal URI if the URIs only differ
    by use of IPP or IPPS and/or use of HTTPS port 443 instead
    of IPP port 631.
  - cups-browsed: Also upgrade from ipp: to ipps: when the ipps:
    URI is on HTTPS port 443 instead of IPP port 631. This is
    common on IPP network printers.
  - pdftopdf: Removed support for hardware-implemented reversing
    of page order in PostScript printers. It was once not
    correctly implemented in cups-filters and second, such
    printers are extremely rare, and on Gutenprint PPDs with
    pseudo OutputOrder option hardware reversing was even
    wrongly assumed (Issue #47).
  - pdftopdf: Accept option "output-order=normal/reverse" for
    reversing page order (Issue #47) and also "page-delivery=
    same-order/reverse-order" (CUPS Issue #5340).
  - libcupsfilters: Let the PPD generator add "*PageStackOrder
    ..."  lines to the choices of the "OutputBin" option, to
    mark which output bins need the pages printed in reverse
    order (Issue #47).
  - libcupsfilters: Let the PPD generator correctly create a
    "*DefaultOutputOrder: ..."  entry, depending on whether the
    paper is put out face-up or face-down in the default output
    bin (Issue #47).
  - libcupsfilters: Fixed human-readable name of the OutputBin
    option in the PPD generator.
  - pdftoopvp: Silence compiler warning (Issue #42).
  - cups-browsed: If the user modifies/overwrites a print queue
    created by cups-browsed, it will now not only be
    automatically released from the control of cups-browsed, but
    we also create a replacement for our generated local queue
    under a new name.
  - cups-browsed: Make URIS for using the implicitclass backend
    correctly working also with queue names containing an '@'
    character.
  - braille: Strengthen error checking (Pull request #41).
  - braille: Index: Replace bogus characters with space (Pull
    request #41).
  - braille: Add print and braille page number options (Pull
    request #41).
  - braille: Index: Use standard duplex cups option (Pull
    request #41).
  - cups-browsed: Moved auto-generation of PPD file for IPP
    network printers from create_remote_printer_entry()
    function to update_cups_queues(). This allows re-creating
    accidentally removed or overwritten local queues without
    losing the PPD file.
  - braille: Add option to pick hyphenation rule according to
    current locale and make it the default for second
    translation table. (Pull request #38 and #39).
  - braille: Remove generated defs on "make clean". (Pull request #38).
  - braille: Turn non-breakable spaces to spaces. (Pull request
    [#38] and #39).
  - braille: Fix character encoding when extracting text. When
    extracing text from a zip file or a pdf, the resulting text
    is always utf-8 independently of the original locale, so we
    need to force that. (Pull request #38).
  - braille: Warn when no text translation was selected in case
    the user didn't notice. (Pull request #37).
  - braille: Fix spurious spacing after last Form-Feed (Pull
    request #45).
- Drop pdftoopvp_Silence-compiler-warning.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1535630400">- Do not diferentiate for service location, it is in sbindir
  on all systems we support now
- Use license for license install
- Version update to 1.21.1:
  - foomatic-rip: Fixed segmentation fault caused by wrong
    Coverity Scan issue fix (Issue #57, Debian bug #907026).
  - Build system: Require QPDF 8.1.0 or later as it is needed by
    bannertopdf (Issue #56).
  - libcupsfilters, cups-browsed, driverless, foomatic-rip,
    parallel: Silenced warnings from newest gcc.
  - libcupsfilters: When generating a PPD for driverless
    printing on a remote IPP printer, make pdftopdf not being
    run by the local queue if the remote queue is a CUPS queue
    to avoid running pdftopdf twice (CUPS Issue #5361).
  - libcupsfilters, cups-browsed, driverless, bannertopdf,
    foomatic-rip, pdftops, pdftoraster, rastertops,
    rastertoescpx, sys5ippprinter, beh: Fixed Coverity Scan
    issues. Thanks to Zdenek Dohnal (zdohnal at redhat dot com)
    for the tests and the patches.
  - bannertopdf: Switched over from using Poppler to using QPDF
    for generating the PDF pages. With Poppler unstable APIs
    were used which were subject to change. Thanks to Sahil
    Arora for this project in the Google Summer of Code 2018
    (Pull request #25).
  - cups-browsed: Manually defined clusters ("Cluster" directive
    in cups-browsed.conf) caused cups-browsed to crash.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1543406400">- Update to version 1.21.4:
  * cups-browsed: cups-browsed: Limit the number of retries for
    creating a print queue when it comes to HTTP timeouts. Number
    of retries given by HttpMaxRetries directive in
    cups-browsed.conf.
  * cups-browsed: Read out current time right before setting the
    timeouts.
  * libcupsfilters: In the PPD generator for driverless IPP
    printing let "*cupsManualCopies: true" lines get added to
    the PPD if printing is done in a raster format as then
    pdftopdf needs to generate the copies.
  * pdftoraster, pdftoopvp, pdftoijs: Fix build with
    Poppler &gt;= 0.70
  * pdftopdf: Fixed printing multiple copies on driverless IPP
    printers. When printing collated copies the multiple copies
    got applied twice, resulting in n*n instead of n copies.
  * pdftoraster, pdftoopvp, pdftoijs: Poppler removed memCheck
    and gMemReport functions, remove appropriate calls.
- Changes from version 1.21.3:
  * foomatic-rip: Reset stdin after replacing the underlying file
    descriptor.
- Changes from version 1.21.2:
  * cups-browsed: Fixed freeing of literal string caused by
    Coverity Scan issue fix.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1545134400">- Update to version 1.21.6:
  * Bug fix release, mainly for cups-browsed to avoid crashes and
    infinite printer removal/re-creation loops and spurious local
    queues for local CUPS printers. Also expanded PostScript
    interpreter bug workaround to more Apple LaserWriter models.
  * cups-browsed: To find out whether a DNS-SD-discovered printer
    is from the local machine, use not only the flags in the Avahi
    lookup result but also check the host name.
  * cups-browsed: When a local CUPS queue pointing to a remote CUPS
    printer was removed and re-created to make it a permanent
    queue, on_printer_deleted() was triggered by cupsd's
    notification to re-create a lost queue. Now
    on_printer_deleted() checks whether the queue is really gone
    and only re-creates then.
  * cups-browsed: When updating the CUPS queues, also removed and
    unregistered queues and not only created queues got checked for
    HTTP timeouts, which caused crashes on shutdown.
  * pdftops: Use the PS interpreter of Poppler for all Apple
    LaserWriter 16/600, 4/600, 12/640, 12/600, 12/660 as they all
    seem to not work with Ghostscript's PS output.
  * cups-browsed: On shutdown queues got removed even if they still
    had jobs.
- Changes from version 1.21.5:
  * Bug fix release, to build with Poppler 0.71 and with
    cups-browsed converting temporary CUPS queues reliably to
    permanent queues.
  * cups-browsed: We cannot reliably determine whether a CUPS queue
    is temporary, so we apply the procedure to make a temporary
    queue permanent to any unshared queue.
  * pdftoraster, pdftopdf, pdftoijs, pdftoopvp: Do not use the
    Poppler-specific "GBool", "gFalse", "gTrue" any more, as
    Poppler has switched to standard "bool", "false", "true" in
    version 0.71.0.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1546084800">- Fix building with Poppler 0.72
  Add 0001-Raise-minimum-poppler-version-from-0.18-to-0.19.patch
  Add 0002-Adapt-code-for-SplashXPathScanner-state-handling-sin.patch
  Add 0003-Support-some-more-methods-returning-const.patch
  Add 0004-Support-GooString-c_str-introduced-by-poppler-0.72.patch
  See https://github.com/OpenPrinting/cups-filters/pull/83</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1548676800">- Update to version 1.22.0:
  * From this release on the pdftopdf filter flattens interactive
    PDF forms and annotations internally, using QPDF, instead of
    calling external utilities. This especially eliminates slowing
    factors as additional piping of the data and unneeded use of
    PDF interpreters. Using external utilities for flattening is
    still possible in case of problems. In addition, a crash bug in
    cups-browsed got fixed and compatibility of the filters with
    Poppler 0.72 assured.
- Drop upstream fixed patches:
  * 0001-Raise-minimum-poppler-version-from-0.18-to-0.19.patch
  * 0002-Adapt-code-for-SplashXPathScanner-state-handling-sin.patch
  * 0003-Support-some-more-methods-returning-const.patch
  * 0004-Support-GooString-c_str-introduced-by-poppler-0.72.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550664000">- Update to version 1.22.1:
  * braille: Use sort command with LC_ALL=C for reproducibility
    of the genrated files, needed for distribution packaging.
  * cups-browsed, driverless: When polling the printer's
    capabilities via get-printer-attributes IPP request for
    driverless printing, use the attributes "all" and
    "media-col-database". Without "all" some printers do not report
    "urf-supported" and without "media-col-database" not all paper
    size and marging info gets reported.
  * braille: Document how to rework output before embossing.</changelog>
  <changelog author="jsmeix@suse.de" date="1554724800">- Version upgrade to 1.22.5
  * foomatic-rip: Changed Ghostscript call to count pages in a
    PDF file to use "runpdfbegin" and not the undocumented
    Ghostscript internal "pdfdict", so that it works with
    Ghostscript 9.27 and later (Debian bug #926576,
    Arch Linux bug #62251, openSUSE boo#1131771,
    cups@cups.org mailing list thread
    https://lists.cups.org/pipermail/cups/2019-April/074563.html).
- Version upgrade to 1.22.4
  * cups-browsed: Fix broken trailing space removal on
    "NickName" (Pull request #103).
  * pdftops: Emit PostScript Level 2 instead of Level 3 for
    Brother PostScript printers as at least some of them
    report to support level 3 but ontly work with Level 2
    (Ubuntu bug #1306849, comment #42).
  * bannertopdf: When multiplying the page for N-up or Duplex
    printing one page too much was generated (Issue #102).
- Version upgrade to 1.22.3
  * libcupsfilters: Added error checks for processing GIF, to
    avoid crashes or hangs on broken GIF files (Issues #81, #82,
    Pull request #100).
  * cups-browsed: Added hint to the man page and configuration
    file that with "DebugLogging stderr" the logging output goes
    to journal or syslog if cups-browsed is running as system
    service (Issue #28).
- Version upgrade to 1.22.2
  * cups-browsed: Let distribution of jobs sent to queues with
    "implicitclass" backend (usually clusters) be done by a
    "job-state" CUPS notification and not by
    "printer-state-changed" any more. The "job-state"
    notification already contains the job ID. Before we had to
    poll the job ID from CUPS via IPP which was sometimes
    unreliable (Issue #97).
  * imagetopdf, imagetoraster, pdftopdf, libcupsfilters: Added
    new page scaling options: "fill" scales the input page
    (typically a photo) so that the output page (typically with
    different aspect ratio) gets completely filled, aloowing for
    some content of the input page getting lost. "crop-to-fit"
    allows for easy printing of documents on slightly different
    output page sizes (A4 &lt;-&gt; Letter) maintaining the size and
    centering and cropping into the destination page. Thanks to
    Dheeraj Yadav (dhirajyadav135 at gmail dot com) for the
    patch (Pull request #92).
  * cups-browsed: Do not do IPP request for printer-is-shared
    option for remote cups queues with CUPS 2.2.x and newer
    (Pull request #91).
  * cups-browsed: Fix crash bug when reading "Cluster"
    directive from configuration file (Issue #94).
  * driverless: Updated man page as now also Mopria and
    Wi-Fi Direct printers are supported. Mentioned also
    ippusbxd.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559304000">- Update to version 1.23.0:
  * This release adds support for the "print-scaling" IPP attribute
    and has the code for the support of MuPDF as PDF renderer
    vastly simplified.
  * pdftops, mupdftoraster: Let pdftops call mutool directly and so
    that it directly outputs PostScript, eliminating the need to
    call the mupdftoraster and rastertops filters.
  * mupdftoraster: Reduced the use of temporary files from 3 to
    just one.
  * imagetopdf, imagetoraster, pdftopdf: Add support for
    print-scaling option.
- Changes from version 1.22.6:
  * Bug fix release, to address a further issue of cups-browsed
    removing user-created print queues, to make
    grayscale/monochrome PostScript jobs of colored input file
    actually output grayscale/monochrome files, to fix several bugs
    when using MuPDF as PDF renderer, and to silence compiler
    warnings.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559908800">- Update to version 1.25.0:
  * pdftoijs, pdftoopvp: Removed these deprecated filters
    completely as there is no demand for them any more. They also
    used unstable, undocumented APIs of Poppler.
  * pdftoraster: Changed from using unstable, undocumented APIs of
    Poppler to stable, documented ones, to improve maintainability
    of this filter, and with it of the cups-filters package.
  * libcupsfilters: Added support for color spaces CMY and RGBW
    when using filters without PPD file (mainly for development and
    debugging, option "print-color-mode" with values "cmy-XX" and
    "rgbw-XX" with XX being the number of bits per color).
- Changes from version 1.24.0:
  * cups-browsed: Integration of Deepak Patankar's Google Summer of
    Code 2018 project with the main goal of clustering different
    printers and automatically selecting the destination printers
    by job content and option/attribute settings.
  * cups-browsed, implicitclass: Support for mixed clusters of
    remote CUPS queues and IPP network printers. For this PPD files
    of remote CUPS queues are generated by cups-browsed based on
    IPP queries, as for native IPP printers, the number of jobs for
    load balancing is polled in a way that it works also with
    native IPP printers, the implicitclass backend sends jobs
    directly to the printer instead of re-queueing them via CUPS.
  * cups-browsed: Merge IPP attributes of several printers to
    combined attributes for the cluster to generate the cluster's
    PPD file, including PPD constraints for option combinations not
    fulfillable by any of the member printers, and finding
    reasonable, non-conflicting default settings.
  * cups-browsed: Selection algorithm for the destination printer
    for a job sent to the cluster. Based on the job settings
    requested such as page size, media type, print quality, the
    best most suitable printer in the cluster for the job will be
    selected.
  * cups-browsed, implicitclass: Filter jobs to clusters already
    locally. Due to the fact that a cluster's member printers are
    not exclusively non-raw CUPS queues with the complete filtering
    framework on the remote server, but also native IPP printers,
    we need to support generic driverless printers as destination.
    So we cannot pass on the input data unfiltered but need to
    filter locally. We let the cluster's PPD file emulate a PDF
    printer, letting the local CUPS queue of the cluster run
    pdftopdf and any pre-filters to turn the input into PDF and we
    let the implicitclass backend turn PDF into a format understood
    by the destination printer, supporting the 4 formats of
    driverless IPP printing: PDF, PWG Raster, Apple Raster, PCLm.
- Drop libpoppler-cpp0, libpoppler-devel and libpoppler-glib-devel
  BuildRequires.
- Add pkgconfig(poppler-cpp) BuildRequires following upstream
  changes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1560340800">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut the build queues by allowing usage of systemd-mini</changelog>
  <changelog author="idonmez@suse.com" date="1567512000">- Add add-cstring-include.patch to include cstring for memcpy
  and strcmp</changelog>
  <changelog author="jsmeix@suse.de" date="1618488000">- fix_upstream_issue348.patch fixes
  https://github.com/OpenPrinting/cups-filters/issues/348
  foomatic-rip segfaults with 'job-sheets=none,none'
  but works with 'job-sheets=none'
  (bsc#1182893)</changelog>
  <changelog author="jsmeix@suse.com" date="1684152000">- cups-filters-1.25.0-0001-beh-backend-Use-execv-instead-of-system-CVE-2023-24805.patch
  cups-filters-1.25.0-0002-beh-backend-Extra-checks-against-odd-forged-input-CVE-2023-24805.patch
  cups-filters-1.25.0-0003-beh-backend-Further-improvements-CVE-2023-24805.patch
  are the upstream
  0001-beh-backend-Use-execv-instead-of-system-CVE-2023-24805.patch
  0002-beh-backend-Extra-checks-against-odd-forged-input-CVE-2023-24805.patch
  0003-beh-backend-Further-improvements-CVE-2023-24805.patch
  backpported to cups-filters-1.25.0
  to fix CVE-2023-24805: RCE in cups-filters, beh CUPS backend
  (bsc#1211340)</changelog>
  <changelog author="tabraham@suse.com" date="1684756800">- gstoraster-gstopdf-Make-number-of-copies-as-embedded.patch fixes
  https://github.com/OpenPrinting/cups-filters/issues/255
  Printing multiple copies prints only 1 (pstopdf vs gstopdf)
  (bsc#1211401) (boo#1173345)</changelog>
  <changelog author="jsmeix@suse.com" date="1720008000">- bsc1225040.patch fixes bsc#1225040
  "cups-filters: Poppler for color PDF as grayscale via PS level 1:
  huge output makes printing slow"
  see https://github.com/OpenPrinting/cups-filters/issues/169
  Poppler for color PDF as grayscale via PS level 1 was introduced
  in cups-filters 1.22.6 via
  https://github.com/OpenPrinting/cups-filters/commit/48f9f994322c808ba2e9d0db6f3ff81caf8c0b72
  and disabled in cups-filters 1.25.12 via
  https://github.com/OpenPrinting/cups-filters/commit/0818ee322a6139be11d21fc76db345de1e979339</changelog>
</package>
<package pkgid="9faa5edd8c8fbc45995c3205559f3df9238cdabefae1d6650ce40ec899ce69f4" name="cups-filters-devel" arch="ppc64le">
  <version epoch="0" ver="1.25.0" rel="150200.3.12.3"/>
  <changelog author="jsmeix@suse.de" date="1522843200">- Version upgrade to 1.20.1
  to provide upstream bugfixes also for SLE15 / Leap15
  and be also already prepared for SLE12 (fate#323676).
  This is a bug fix release fixing several issues
  on the Braille support and other bugs, in particular
  (for details see the NEWS file):
  * libcupsfilters: Silenced warning when using CUPS &lt; 2.x
    by eliminating the use of a recently introduced
    CUPS library function, see
    https://bugs.linuxfoundation.org/show_bug.cgi?id=1421
  * cups-browsed: Fixed crash when CUPS reports a print queue
    without "device-uri" attribute when cups-browsed polls a
    list of local CUPS queues, see
    https://github.com/OpenPrinting/cups-filters/issues/16
- fix_upstream_bug_1421.patch is no longer needed because
  it is now fixed in the upstream sources
  (see the "libcupsfilters ... bug ... 1421" entry above).</changelog>
  <changelog author="jsmeix@suse.de" date="1523361600">- Version upgrade to 1.20.2
  to provide upstream bugfixes also for SLE15 / Leap15
  and be also already prepared for SLE12 (fate#323676).
  This is a bug fix release fixing the recognition
  of remote CUPS queues by cups-browsed, the behavior
  of cups-browsed when one creates a queue with the
  same name of a cups-browsed-generated queue overwriting
  it, and other bug fixes (for details see the NEWS file).</changelog>
  <changelog author="luizluca@gmail.com" date="1525262400">- Version upgrade to 1.20.3
  to fix regression from 1.20.2 that ignores printers published
  using legacy CUPS broadcast</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1531224000">- Add pdftoopvp_Silence-compiler-warning.patch: pdftoopvp: Silence
  compiler warning.</changelog>
  <changelog author="alarrosa@suse.com" date="1531828800">- Version upgrade to 1.20.4
  - gstoraster: Removed unneeded "if"s (Ghostscript bug #692705).
  - cups-browsed: When checking whether there is already a local
    print queue with the same URI as the one of the discovered
    printer, consider also as equal URI if the URIs only differ
    by use of IPP or IPPS and/or use of HTTPS port 443 instead
    of IPP port 631.
  - cups-browsed: Also upgrade from ipp: to ipps: when the ipps:
    URI is on HTTPS port 443 instead of IPP port 631. This is
    common on IPP network printers.
  - pdftopdf: Removed support for hardware-implemented reversing
    of page order in PostScript printers. It was once not
    correctly implemented in cups-filters and second, such
    printers are extremely rare, and on Gutenprint PPDs with
    pseudo OutputOrder option hardware reversing was even
    wrongly assumed (Issue #47).
  - pdftopdf: Accept option "output-order=normal/reverse" for
    reversing page order (Issue #47) and also "page-delivery=
    same-order/reverse-order" (CUPS Issue #5340).
  - libcupsfilters: Let the PPD generator add "*PageStackOrder
    ..."  lines to the choices of the "OutputBin" option, to
    mark which output bins need the pages printed in reverse
    order (Issue #47).
  - libcupsfilters: Let the PPD generator correctly create a
    "*DefaultOutputOrder: ..."  entry, depending on whether the
    paper is put out face-up or face-down in the default output
    bin (Issue #47).
  - libcupsfilters: Fixed human-readable name of the OutputBin
    option in the PPD generator.
  - pdftoopvp: Silence compiler warning (Issue #42).
  - cups-browsed: If the user modifies/overwrites a print queue
    created by cups-browsed, it will now not only be
    automatically released from the control of cups-browsed, but
    we also create a replacement for our generated local queue
    under a new name.
  - cups-browsed: Make URIS for using the implicitclass backend
    correctly working also with queue names containing an '@'
    character.
  - braille: Strengthen error checking (Pull request #41).
  - braille: Index: Replace bogus characters with space (Pull
    request #41).
  - braille: Add print and braille page number options (Pull
    request #41).
  - braille: Index: Use standard duplex cups option (Pull
    request #41).
  - cups-browsed: Moved auto-generation of PPD file for IPP
    network printers from create_remote_printer_entry()
    function to update_cups_queues(). This allows re-creating
    accidentally removed or overwritten local queues without
    losing the PPD file.
  - braille: Add option to pick hyphenation rule according to
    current locale and make it the default for second
    translation table. (Pull request #38 and #39).
  - braille: Remove generated defs on "make clean". (Pull request #38).
  - braille: Turn non-breakable spaces to spaces. (Pull request
    [#38] and #39).
  - braille: Fix character encoding when extracting text. When
    extracing text from a zip file or a pdf, the resulting text
    is always utf-8 independently of the original locale, so we
    need to force that. (Pull request #38).
  - braille: Warn when no text translation was selected in case
    the user didn't notice. (Pull request #37).
  - braille: Fix spurious spacing after last Form-Feed (Pull
    request #45).
- Drop pdftoopvp_Silence-compiler-warning.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1535630400">- Do not diferentiate for service location, it is in sbindir
  on all systems we support now
- Use license for license install
- Version update to 1.21.1:
  - foomatic-rip: Fixed segmentation fault caused by wrong
    Coverity Scan issue fix (Issue #57, Debian bug #907026).
  - Build system: Require QPDF 8.1.0 or later as it is needed by
    bannertopdf (Issue #56).
  - libcupsfilters, cups-browsed, driverless, foomatic-rip,
    parallel: Silenced warnings from newest gcc.
  - libcupsfilters: When generating a PPD for driverless
    printing on a remote IPP printer, make pdftopdf not being
    run by the local queue if the remote queue is a CUPS queue
    to avoid running pdftopdf twice (CUPS Issue #5361).
  - libcupsfilters, cups-browsed, driverless, bannertopdf,
    foomatic-rip, pdftops, pdftoraster, rastertops,
    rastertoescpx, sys5ippprinter, beh: Fixed Coverity Scan
    issues. Thanks to Zdenek Dohnal (zdohnal at redhat dot com)
    for the tests and the patches.
  - bannertopdf: Switched over from using Poppler to using QPDF
    for generating the PDF pages. With Poppler unstable APIs
    were used which were subject to change. Thanks to Sahil
    Arora for this project in the Google Summer of Code 2018
    (Pull request #25).
  - cups-browsed: Manually defined clusters ("Cluster" directive
    in cups-browsed.conf) caused cups-browsed to crash.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1543406400">- Update to version 1.21.4:
  * cups-browsed: cups-browsed: Limit the number of retries for
    creating a print queue when it comes to HTTP timeouts. Number
    of retries given by HttpMaxRetries directive in
    cups-browsed.conf.
  * cups-browsed: Read out current time right before setting the
    timeouts.
  * libcupsfilters: In the PPD generator for driverless IPP
    printing let "*cupsManualCopies: true" lines get added to
    the PPD if printing is done in a raster format as then
    pdftopdf needs to generate the copies.
  * pdftoraster, pdftoopvp, pdftoijs: Fix build with
    Poppler &gt;= 0.70
  * pdftopdf: Fixed printing multiple copies on driverless IPP
    printers. When printing collated copies the multiple copies
    got applied twice, resulting in n*n instead of n copies.
  * pdftoraster, pdftoopvp, pdftoijs: Poppler removed memCheck
    and gMemReport functions, remove appropriate calls.
- Changes from version 1.21.3:
  * foomatic-rip: Reset stdin after replacing the underlying file
    descriptor.
- Changes from version 1.21.2:
  * cups-browsed: Fixed freeing of literal string caused by
    Coverity Scan issue fix.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1545134400">- Update to version 1.21.6:
  * Bug fix release, mainly for cups-browsed to avoid crashes and
    infinite printer removal/re-creation loops and spurious local
    queues for local CUPS printers. Also expanded PostScript
    interpreter bug workaround to more Apple LaserWriter models.
  * cups-browsed: To find out whether a DNS-SD-discovered printer
    is from the local machine, use not only the flags in the Avahi
    lookup result but also check the host name.
  * cups-browsed: When a local CUPS queue pointing to a remote CUPS
    printer was removed and re-created to make it a permanent
    queue, on_printer_deleted() was triggered by cupsd's
    notification to re-create a lost queue. Now
    on_printer_deleted() checks whether the queue is really gone
    and only re-creates then.
  * cups-browsed: When updating the CUPS queues, also removed and
    unregistered queues and not only created queues got checked for
    HTTP timeouts, which caused crashes on shutdown.
  * pdftops: Use the PS interpreter of Poppler for all Apple
    LaserWriter 16/600, 4/600, 12/640, 12/600, 12/660 as they all
    seem to not work with Ghostscript's PS output.
  * cups-browsed: On shutdown queues got removed even if they still
    had jobs.
- Changes from version 1.21.5:
  * Bug fix release, to build with Poppler 0.71 and with
    cups-browsed converting temporary CUPS queues reliably to
    permanent queues.
  * cups-browsed: We cannot reliably determine whether a CUPS queue
    is temporary, so we apply the procedure to make a temporary
    queue permanent to any unshared queue.
  * pdftoraster, pdftopdf, pdftoijs, pdftoopvp: Do not use the
    Poppler-specific "GBool", "gFalse", "gTrue" any more, as
    Poppler has switched to standard "bool", "false", "true" in
    version 0.71.0.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1546084800">- Fix building with Poppler 0.72
  Add 0001-Raise-minimum-poppler-version-from-0.18-to-0.19.patch
  Add 0002-Adapt-code-for-SplashXPathScanner-state-handling-sin.patch
  Add 0003-Support-some-more-methods-returning-const.patch
  Add 0004-Support-GooString-c_str-introduced-by-poppler-0.72.patch
  See https://github.com/OpenPrinting/cups-filters/pull/83</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1548676800">- Update to version 1.22.0:
  * From this release on the pdftopdf filter flattens interactive
    PDF forms and annotations internally, using QPDF, instead of
    calling external utilities. This especially eliminates slowing
    factors as additional piping of the data and unneeded use of
    PDF interpreters. Using external utilities for flattening is
    still possible in case of problems. In addition, a crash bug in
    cups-browsed got fixed and compatibility of the filters with
    Poppler 0.72 assured.
- Drop upstream fixed patches:
  * 0001-Raise-minimum-poppler-version-from-0.18-to-0.19.patch
  * 0002-Adapt-code-for-SplashXPathScanner-state-handling-sin.patch
  * 0003-Support-some-more-methods-returning-const.patch
  * 0004-Support-GooString-c_str-introduced-by-poppler-0.72.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550664000">- Update to version 1.22.1:
  * braille: Use sort command with LC_ALL=C for reproducibility
    of the genrated files, needed for distribution packaging.
  * cups-browsed, driverless: When polling the printer's
    capabilities via get-printer-attributes IPP request for
    driverless printing, use the attributes "all" and
    "media-col-database". Without "all" some printers do not report
    "urf-supported" and without "media-col-database" not all paper
    size and marging info gets reported.
  * braille: Document how to rework output before embossing.</changelog>
  <changelog author="jsmeix@suse.de" date="1554724800">- Version upgrade to 1.22.5
  * foomatic-rip: Changed Ghostscript call to count pages in a
    PDF file to use "runpdfbegin" and not the undocumented
    Ghostscript internal "pdfdict", so that it works with
    Ghostscript 9.27 and later (Debian bug #926576,
    Arch Linux bug #62251, openSUSE boo#1131771,
    cups@cups.org mailing list thread
    https://lists.cups.org/pipermail/cups/2019-April/074563.html).
- Version upgrade to 1.22.4
  * cups-browsed: Fix broken trailing space removal on
    "NickName" (Pull request #103).
  * pdftops: Emit PostScript Level 2 instead of Level 3 for
    Brother PostScript printers as at least some of them
    report to support level 3 but ontly work with Level 2
    (Ubuntu bug #1306849, comment #42).
  * bannertopdf: When multiplying the page for N-up or Duplex
    printing one page too much was generated (Issue #102).
- Version upgrade to 1.22.3
  * libcupsfilters: Added error checks for processing GIF, to
    avoid crashes or hangs on broken GIF files (Issues #81, #82,
    Pull request #100).
  * cups-browsed: Added hint to the man page and configuration
    file that with "DebugLogging stderr" the logging output goes
    to journal or syslog if cups-browsed is running as system
    service (Issue #28).
- Version upgrade to 1.22.2
  * cups-browsed: Let distribution of jobs sent to queues with
    "implicitclass" backend (usually clusters) be done by a
    "job-state" CUPS notification and not by
    "printer-state-changed" any more. The "job-state"
    notification already contains the job ID. Before we had to
    poll the job ID from CUPS via IPP which was sometimes
    unreliable (Issue #97).
  * imagetopdf, imagetoraster, pdftopdf, libcupsfilters: Added
    new page scaling options: "fill" scales the input page
    (typically a photo) so that the output page (typically with
    different aspect ratio) gets completely filled, aloowing for
    some content of the input page getting lost. "crop-to-fit"
    allows for easy printing of documents on slightly different
    output page sizes (A4 &lt;-&gt; Letter) maintaining the size and
    centering and cropping into the destination page. Thanks to
    Dheeraj Yadav (dhirajyadav135 at gmail dot com) for the
    patch (Pull request #92).
  * cups-browsed: Do not do IPP request for printer-is-shared
    option for remote cups queues with CUPS 2.2.x and newer
    (Pull request #91).
  * cups-browsed: Fix crash bug when reading "Cluster"
    directive from configuration file (Issue #94).
  * driverless: Updated man page as now also Mopria and
    Wi-Fi Direct printers are supported. Mentioned also
    ippusbxd.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559304000">- Update to version 1.23.0:
  * This release adds support for the "print-scaling" IPP attribute
    and has the code for the support of MuPDF as PDF renderer
    vastly simplified.
  * pdftops, mupdftoraster: Let pdftops call mutool directly and so
    that it directly outputs PostScript, eliminating the need to
    call the mupdftoraster and rastertops filters.
  * mupdftoraster: Reduced the use of temporary files from 3 to
    just one.
  * imagetopdf, imagetoraster, pdftopdf: Add support for
    print-scaling option.
- Changes from version 1.22.6:
  * Bug fix release, to address a further issue of cups-browsed
    removing user-created print queues, to make
    grayscale/monochrome PostScript jobs of colored input file
    actually output grayscale/monochrome files, to fix several bugs
    when using MuPDF as PDF renderer, and to silence compiler
    warnings.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559908800">- Update to version 1.25.0:
  * pdftoijs, pdftoopvp: Removed these deprecated filters
    completely as there is no demand for them any more. They also
    used unstable, undocumented APIs of Poppler.
  * pdftoraster: Changed from using unstable, undocumented APIs of
    Poppler to stable, documented ones, to improve maintainability
    of this filter, and with it of the cups-filters package.
  * libcupsfilters: Added support for color spaces CMY and RGBW
    when using filters without PPD file (mainly for development and
    debugging, option "print-color-mode" with values "cmy-XX" and
    "rgbw-XX" with XX being the number of bits per color).
- Changes from version 1.24.0:
  * cups-browsed: Integration of Deepak Patankar's Google Summer of
    Code 2018 project with the main goal of clustering different
    printers and automatically selecting the destination printers
    by job content and option/attribute settings.
  * cups-browsed, implicitclass: Support for mixed clusters of
    remote CUPS queues and IPP network printers. For this PPD files
    of remote CUPS queues are generated by cups-browsed based on
    IPP queries, as for native IPP printers, the number of jobs for
    load balancing is polled in a way that it works also with
    native IPP printers, the implicitclass backend sends jobs
    directly to the printer instead of re-queueing them via CUPS.
  * cups-browsed: Merge IPP attributes of several printers to
    combined attributes for the cluster to generate the cluster's
    PPD file, including PPD constraints for option combinations not
    fulfillable by any of the member printers, and finding
    reasonable, non-conflicting default settings.
  * cups-browsed: Selection algorithm for the destination printer
    for a job sent to the cluster. Based on the job settings
    requested such as page size, media type, print quality, the
    best most suitable printer in the cluster for the job will be
    selected.
  * cups-browsed, implicitclass: Filter jobs to clusters already
    locally. Due to the fact that a cluster's member printers are
    not exclusively non-raw CUPS queues with the complete filtering
    framework on the remote server, but also native IPP printers,
    we need to support generic driverless printers as destination.
    So we cannot pass on the input data unfiltered but need to
    filter locally. We let the cluster's PPD file emulate a PDF
    printer, letting the local CUPS queue of the cluster run
    pdftopdf and any pre-filters to turn the input into PDF and we
    let the implicitclass backend turn PDF into a format understood
    by the destination printer, supporting the 4 formats of
    driverless IPP printing: PDF, PWG Raster, Apple Raster, PCLm.
- Drop libpoppler-cpp0, libpoppler-devel and libpoppler-glib-devel
  BuildRequires.
- Add pkgconfig(poppler-cpp) BuildRequires following upstream
  changes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1560340800">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut the build queues by allowing usage of systemd-mini</changelog>
  <changelog author="idonmez@suse.com" date="1567512000">- Add add-cstring-include.patch to include cstring for memcpy
  and strcmp</changelog>
  <changelog author="jsmeix@suse.de" date="1618488000">- fix_upstream_issue348.patch fixes
  https://github.com/OpenPrinting/cups-filters/issues/348
  foomatic-rip segfaults with 'job-sheets=none,none'
  but works with 'job-sheets=none'
  (bsc#1182893)</changelog>
  <changelog author="jsmeix@suse.com" date="1684152000">- cups-filters-1.25.0-0001-beh-backend-Use-execv-instead-of-system-CVE-2023-24805.patch
  cups-filters-1.25.0-0002-beh-backend-Extra-checks-against-odd-forged-input-CVE-2023-24805.patch
  cups-filters-1.25.0-0003-beh-backend-Further-improvements-CVE-2023-24805.patch
  are the upstream
  0001-beh-backend-Use-execv-instead-of-system-CVE-2023-24805.patch
  0002-beh-backend-Extra-checks-against-odd-forged-input-CVE-2023-24805.patch
  0003-beh-backend-Further-improvements-CVE-2023-24805.patch
  backpported to cups-filters-1.25.0
  to fix CVE-2023-24805: RCE in cups-filters, beh CUPS backend
  (bsc#1211340)</changelog>
  <changelog author="tabraham@suse.com" date="1684756800">- gstoraster-gstopdf-Make-number-of-copies-as-embedded.patch fixes
  https://github.com/OpenPrinting/cups-filters/issues/255
  Printing multiple copies prints only 1 (pstopdf vs gstopdf)
  (bsc#1211401) (boo#1173345)</changelog>
  <changelog author="jsmeix@suse.com" date="1720008000">- bsc1225040.patch fixes bsc#1225040
  "cups-filters: Poppler for color PDF as grayscale via PS level 1:
  huge output makes printing slow"
  see https://github.com/OpenPrinting/cups-filters/issues/169
  Poppler for color PDF as grayscale via PS level 1 was introduced
  in cups-filters 1.22.6 via
  https://github.com/OpenPrinting/cups-filters/commit/48f9f994322c808ba2e9d0db6f3ff81caf8c0b72
  and disabled in cups-filters 1.25.12 via
  https://github.com/OpenPrinting/cups-filters/commit/0818ee322a6139be11d21fc76db345de1e979339</changelog>
</package>
<package pkgid="fcfd4099a58902b6aafcfaac77d56d5971cb727c16e3bc6bc2d4d62202f4b399" name="cups-filters-devel" arch="s390x">
  <version epoch="0" ver="1.25.0" rel="150200.3.12.3"/>
  <changelog author="jsmeix@suse.de" date="1522843200">- Version upgrade to 1.20.1
  to provide upstream bugfixes also for SLE15 / Leap15
  and be also already prepared for SLE12 (fate#323676).
  This is a bug fix release fixing several issues
  on the Braille support and other bugs, in particular
  (for details see the NEWS file):
  * libcupsfilters: Silenced warning when using CUPS &lt; 2.x
    by eliminating the use of a recently introduced
    CUPS library function, see
    https://bugs.linuxfoundation.org/show_bug.cgi?id=1421
  * cups-browsed: Fixed crash when CUPS reports a print queue
    without "device-uri" attribute when cups-browsed polls a
    list of local CUPS queues, see
    https://github.com/OpenPrinting/cups-filters/issues/16
- fix_upstream_bug_1421.patch is no longer needed because
  it is now fixed in the upstream sources
  (see the "libcupsfilters ... bug ... 1421" entry above).</changelog>
  <changelog author="jsmeix@suse.de" date="1523361600">- Version upgrade to 1.20.2
  to provide upstream bugfixes also for SLE15 / Leap15
  and be also already prepared for SLE12 (fate#323676).
  This is a bug fix release fixing the recognition
  of remote CUPS queues by cups-browsed, the behavior
  of cups-browsed when one creates a queue with the
  same name of a cups-browsed-generated queue overwriting
  it, and other bug fixes (for details see the NEWS file).</changelog>
  <changelog author="luizluca@gmail.com" date="1525262400">- Version upgrade to 1.20.3
  to fix regression from 1.20.2 that ignores printers published
  using legacy CUPS broadcast</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1531224000">- Add pdftoopvp_Silence-compiler-warning.patch: pdftoopvp: Silence
  compiler warning.</changelog>
  <changelog author="alarrosa@suse.com" date="1531828800">- Version upgrade to 1.20.4
  - gstoraster: Removed unneeded "if"s (Ghostscript bug #692705).
  - cups-browsed: When checking whether there is already a local
    print queue with the same URI as the one of the discovered
    printer, consider also as equal URI if the URIs only differ
    by use of IPP or IPPS and/or use of HTTPS port 443 instead
    of IPP port 631.
  - cups-browsed: Also upgrade from ipp: to ipps: when the ipps:
    URI is on HTTPS port 443 instead of IPP port 631. This is
    common on IPP network printers.
  - pdftopdf: Removed support for hardware-implemented reversing
    of page order in PostScript printers. It was once not
    correctly implemented in cups-filters and second, such
    printers are extremely rare, and on Gutenprint PPDs with
    pseudo OutputOrder option hardware reversing was even
    wrongly assumed (Issue #47).
  - pdftopdf: Accept option "output-order=normal/reverse" for
    reversing page order (Issue #47) and also "page-delivery=
    same-order/reverse-order" (CUPS Issue #5340).
  - libcupsfilters: Let the PPD generator add "*PageStackOrder
    ..."  lines to the choices of the "OutputBin" option, to
    mark which output bins need the pages printed in reverse
    order (Issue #47).
  - libcupsfilters: Let the PPD generator correctly create a
    "*DefaultOutputOrder: ..."  entry, depending on whether the
    paper is put out face-up or face-down in the default output
    bin (Issue #47).
  - libcupsfilters: Fixed human-readable name of the OutputBin
    option in the PPD generator.
  - pdftoopvp: Silence compiler warning (Issue #42).
  - cups-browsed: If the user modifies/overwrites a print queue
    created by cups-browsed, it will now not only be
    automatically released from the control of cups-browsed, but
    we also create a replacement for our generated local queue
    under a new name.
  - cups-browsed: Make URIS for using the implicitclass backend
    correctly working also with queue names containing an '@'
    character.
  - braille: Strengthen error checking (Pull request #41).
  - braille: Index: Replace bogus characters with space (Pull
    request #41).
  - braille: Add print and braille page number options (Pull
    request #41).
  - braille: Index: Use standard duplex cups option (Pull
    request #41).
  - cups-browsed: Moved auto-generation of PPD file for IPP
    network printers from create_remote_printer_entry()
    function to update_cups_queues(). This allows re-creating
    accidentally removed or overwritten local queues without
    losing the PPD file.
  - braille: Add option to pick hyphenation rule according to
    current locale and make it the default for second
    translation table. (Pull request #38 and #39).
  - braille: Remove generated defs on "make clean". (Pull request #38).
  - braille: Turn non-breakable spaces to spaces. (Pull request
    [#38] and #39).
  - braille: Fix character encoding when extracting text. When
    extracing text from a zip file or a pdf, the resulting text
    is always utf-8 independently of the original locale, so we
    need to force that. (Pull request #38).
  - braille: Warn when no text translation was selected in case
    the user didn't notice. (Pull request #37).
  - braille: Fix spurious spacing after last Form-Feed (Pull
    request #45).
- Drop pdftoopvp_Silence-compiler-warning.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1535630400">- Do not diferentiate for service location, it is in sbindir
  on all systems we support now
- Use license for license install
- Version update to 1.21.1:
  - foomatic-rip: Fixed segmentation fault caused by wrong
    Coverity Scan issue fix (Issue #57, Debian bug #907026).
  - Build system: Require QPDF 8.1.0 or later as it is needed by
    bannertopdf (Issue #56).
  - libcupsfilters, cups-browsed, driverless, foomatic-rip,
    parallel: Silenced warnings from newest gcc.
  - libcupsfilters: When generating a PPD for driverless
    printing on a remote IPP printer, make pdftopdf not being
    run by the local queue if the remote queue is a CUPS queue
    to avoid running pdftopdf twice (CUPS Issue #5361).
  - libcupsfilters, cups-browsed, driverless, bannertopdf,
    foomatic-rip, pdftops, pdftoraster, rastertops,
    rastertoescpx, sys5ippprinter, beh: Fixed Coverity Scan
    issues. Thanks to Zdenek Dohnal (zdohnal at redhat dot com)
    for the tests and the patches.
  - bannertopdf: Switched over from using Poppler to using QPDF
    for generating the PDF pages. With Poppler unstable APIs
    were used which were subject to change. Thanks to Sahil
    Arora for this project in the Google Summer of Code 2018
    (Pull request #25).
  - cups-browsed: Manually defined clusters ("Cluster" directive
    in cups-browsed.conf) caused cups-browsed to crash.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1543406400">- Update to version 1.21.4:
  * cups-browsed: cups-browsed: Limit the number of retries for
    creating a print queue when it comes to HTTP timeouts. Number
    of retries given by HttpMaxRetries directive in
    cups-browsed.conf.
  * cups-browsed: Read out current time right before setting the
    timeouts.
  * libcupsfilters: In the PPD generator for driverless IPP
    printing let "*cupsManualCopies: true" lines get added to
    the PPD if printing is done in a raster format as then
    pdftopdf needs to generate the copies.
  * pdftoraster, pdftoopvp, pdftoijs: Fix build with
    Poppler &gt;= 0.70
  * pdftopdf: Fixed printing multiple copies on driverless IPP
    printers. When printing collated copies the multiple copies
    got applied twice, resulting in n*n instead of n copies.
  * pdftoraster, pdftoopvp, pdftoijs: Poppler removed memCheck
    and gMemReport functions, remove appropriate calls.
- Changes from version 1.21.3:
  * foomatic-rip: Reset stdin after replacing the underlying file
    descriptor.
- Changes from version 1.21.2:
  * cups-browsed: Fixed freeing of literal string caused by
    Coverity Scan issue fix.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1545134400">- Update to version 1.21.6:
  * Bug fix release, mainly for cups-browsed to avoid crashes and
    infinite printer removal/re-creation loops and spurious local
    queues for local CUPS printers. Also expanded PostScript
    interpreter bug workaround to more Apple LaserWriter models.
  * cups-browsed: To find out whether a DNS-SD-discovered printer
    is from the local machine, use not only the flags in the Avahi
    lookup result but also check the host name.
  * cups-browsed: When a local CUPS queue pointing to a remote CUPS
    printer was removed and re-created to make it a permanent
    queue, on_printer_deleted() was triggered by cupsd's
    notification to re-create a lost queue. Now
    on_printer_deleted() checks whether the queue is really gone
    and only re-creates then.
  * cups-browsed: When updating the CUPS queues, also removed and
    unregistered queues and not only created queues got checked for
    HTTP timeouts, which caused crashes on shutdown.
  * pdftops: Use the PS interpreter of Poppler for all Apple
    LaserWriter 16/600, 4/600, 12/640, 12/600, 12/660 as they all
    seem to not work with Ghostscript's PS output.
  * cups-browsed: On shutdown queues got removed even if they still
    had jobs.
- Changes from version 1.21.5:
  * Bug fix release, to build with Poppler 0.71 and with
    cups-browsed converting temporary CUPS queues reliably to
    permanent queues.
  * cups-browsed: We cannot reliably determine whether a CUPS queue
    is temporary, so we apply the procedure to make a temporary
    queue permanent to any unshared queue.
  * pdftoraster, pdftopdf, pdftoijs, pdftoopvp: Do not use the
    Poppler-specific "GBool", "gFalse", "gTrue" any more, as
    Poppler has switched to standard "bool", "false", "true" in
    version 0.71.0.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1546084800">- Fix building with Poppler 0.72
  Add 0001-Raise-minimum-poppler-version-from-0.18-to-0.19.patch
  Add 0002-Adapt-code-for-SplashXPathScanner-state-handling-sin.patch
  Add 0003-Support-some-more-methods-returning-const.patch
  Add 0004-Support-GooString-c_str-introduced-by-poppler-0.72.patch
  See https://github.com/OpenPrinting/cups-filters/pull/83</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1548676800">- Update to version 1.22.0:
  * From this release on the pdftopdf filter flattens interactive
    PDF forms and annotations internally, using QPDF, instead of
    calling external utilities. This especially eliminates slowing
    factors as additional piping of the data and unneeded use of
    PDF interpreters. Using external utilities for flattening is
    still possible in case of problems. In addition, a crash bug in
    cups-browsed got fixed and compatibility of the filters with
    Poppler 0.72 assured.
- Drop upstream fixed patches:
  * 0001-Raise-minimum-poppler-version-from-0.18-to-0.19.patch
  * 0002-Adapt-code-for-SplashXPathScanner-state-handling-sin.patch
  * 0003-Support-some-more-methods-returning-const.patch
  * 0004-Support-GooString-c_str-introduced-by-poppler-0.72.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550664000">- Update to version 1.22.1:
  * braille: Use sort command with LC_ALL=C for reproducibility
    of the genrated files, needed for distribution packaging.
  * cups-browsed, driverless: When polling the printer's
    capabilities via get-printer-attributes IPP request for
    driverless printing, use the attributes "all" and
    "media-col-database". Without "all" some printers do not report
    "urf-supported" and without "media-col-database" not all paper
    size and marging info gets reported.
  * braille: Document how to rework output before embossing.</changelog>
  <changelog author="jsmeix@suse.de" date="1554724800">- Version upgrade to 1.22.5
  * foomatic-rip: Changed Ghostscript call to count pages in a
    PDF file to use "runpdfbegin" and not the undocumented
    Ghostscript internal "pdfdict", so that it works with
    Ghostscript 9.27 and later (Debian bug #926576,
    Arch Linux bug #62251, openSUSE boo#1131771,
    cups@cups.org mailing list thread
    https://lists.cups.org/pipermail/cups/2019-April/074563.html).
- Version upgrade to 1.22.4
  * cups-browsed: Fix broken trailing space removal on
    "NickName" (Pull request #103).
  * pdftops: Emit PostScript Level 2 instead of Level 3 for
    Brother PostScript printers as at least some of them
    report to support level 3 but ontly work with Level 2
    (Ubuntu bug #1306849, comment #42).
  * bannertopdf: When multiplying the page for N-up or Duplex
    printing one page too much was generated (Issue #102).
- Version upgrade to 1.22.3
  * libcupsfilters: Added error checks for processing GIF, to
    avoid crashes or hangs on broken GIF files (Issues #81, #82,
    Pull request #100).
  * cups-browsed: Added hint to the man page and configuration
    file that with "DebugLogging stderr" the logging output goes
    to journal or syslog if cups-browsed is running as system
    service (Issue #28).
- Version upgrade to 1.22.2
  * cups-browsed: Let distribution of jobs sent to queues with
    "implicitclass" backend (usually clusters) be done by a
    "job-state" CUPS notification and not by
    "printer-state-changed" any more. The "job-state"
    notification already contains the job ID. Before we had to
    poll the job ID from CUPS via IPP which was sometimes
    unreliable (Issue #97).
  * imagetopdf, imagetoraster, pdftopdf, libcupsfilters: Added
    new page scaling options: "fill" scales the input page
    (typically a photo) so that the output page (typically with
    different aspect ratio) gets completely filled, aloowing for
    some content of the input page getting lost. "crop-to-fit"
    allows for easy printing of documents on slightly different
    output page sizes (A4 &lt;-&gt; Letter) maintaining the size and
    centering and cropping into the destination page. Thanks to
    Dheeraj Yadav (dhirajyadav135 at gmail dot com) for the
    patch (Pull request #92).
  * cups-browsed: Do not do IPP request for printer-is-shared
    option for remote cups queues with CUPS 2.2.x and newer
    (Pull request #91).
  * cups-browsed: Fix crash bug when reading "Cluster"
    directive from configuration file (Issue #94).
  * driverless: Updated man page as now also Mopria and
    Wi-Fi Direct printers are supported. Mentioned also
    ippusbxd.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559304000">- Update to version 1.23.0:
  * This release adds support for the "print-scaling" IPP attribute
    and has the code for the support of MuPDF as PDF renderer
    vastly simplified.
  * pdftops, mupdftoraster: Let pdftops call mutool directly and so
    that it directly outputs PostScript, eliminating the need to
    call the mupdftoraster and rastertops filters.
  * mupdftoraster: Reduced the use of temporary files from 3 to
    just one.
  * imagetopdf, imagetoraster, pdftopdf: Add support for
    print-scaling option.
- Changes from version 1.22.6:
  * Bug fix release, to address a further issue of cups-browsed
    removing user-created print queues, to make
    grayscale/monochrome PostScript jobs of colored input file
    actually output grayscale/monochrome files, to fix several bugs
    when using MuPDF as PDF renderer, and to silence compiler
    warnings.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559908800">- Update to version 1.25.0:
  * pdftoijs, pdftoopvp: Removed these deprecated filters
    completely as there is no demand for them any more. They also
    used unstable, undocumented APIs of Poppler.
  * pdftoraster: Changed from using unstable, undocumented APIs of
    Poppler to stable, documented ones, to improve maintainability
    of this filter, and with it of the cups-filters package.
  * libcupsfilters: Added support for color spaces CMY and RGBW
    when using filters without PPD file (mainly for development and
    debugging, option "print-color-mode" with values "cmy-XX" and
    "rgbw-XX" with XX being the number of bits per color).
- Changes from version 1.24.0:
  * cups-browsed: Integration of Deepak Patankar's Google Summer of
    Code 2018 project with the main goal of clustering different
    printers and automatically selecting the destination printers
    by job content and option/attribute settings.
  * cups-browsed, implicitclass: Support for mixed clusters of
    remote CUPS queues and IPP network printers. For this PPD files
    of remote CUPS queues are generated by cups-browsed based on
    IPP queries, as for native IPP printers, the number of jobs for
    load balancing is polled in a way that it works also with
    native IPP printers, the implicitclass backend sends jobs
    directly to the printer instead of re-queueing them via CUPS.
  * cups-browsed: Merge IPP attributes of several printers to
    combined attributes for the cluster to generate the cluster's
    PPD file, including PPD constraints for option combinations not
    fulfillable by any of the member printers, and finding
    reasonable, non-conflicting default settings.
  * cups-browsed: Selection algorithm for the destination printer
    for a job sent to the cluster. Based on the job settings
    requested such as page size, media type, print quality, the
    best most suitable printer in the cluster for the job will be
    selected.
  * cups-browsed, implicitclass: Filter jobs to clusters already
    locally. Due to the fact that a cluster's member printers are
    not exclusively non-raw CUPS queues with the complete filtering
    framework on the remote server, but also native IPP printers,
    we need to support generic driverless printers as destination.
    So we cannot pass on the input data unfiltered but need to
    filter locally. We let the cluster's PPD file emulate a PDF
    printer, letting the local CUPS queue of the cluster run
    pdftopdf and any pre-filters to turn the input into PDF and we
    let the implicitclass backend turn PDF into a format understood
    by the destination printer, supporting the 4 formats of
    driverless IPP printing: PDF, PWG Raster, Apple Raster, PCLm.
- Drop libpoppler-cpp0, libpoppler-devel and libpoppler-glib-devel
  BuildRequires.
- Add pkgconfig(poppler-cpp) BuildRequires following upstream
  changes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1560340800">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut the build queues by allowing usage of systemd-mini</changelog>
  <changelog author="idonmez@suse.com" date="1567512000">- Add add-cstring-include.patch to include cstring for memcpy
  and strcmp</changelog>
  <changelog author="jsmeix@suse.de" date="1618488000">- fix_upstream_issue348.patch fixes
  https://github.com/OpenPrinting/cups-filters/issues/348
  foomatic-rip segfaults with 'job-sheets=none,none'
  but works with 'job-sheets=none'
  (bsc#1182893)</changelog>
  <changelog author="jsmeix@suse.com" date="1684152000">- cups-filters-1.25.0-0001-beh-backend-Use-execv-instead-of-system-CVE-2023-24805.patch
  cups-filters-1.25.0-0002-beh-backend-Extra-checks-against-odd-forged-input-CVE-2023-24805.patch
  cups-filters-1.25.0-0003-beh-backend-Further-improvements-CVE-2023-24805.patch
  are the upstream
  0001-beh-backend-Use-execv-instead-of-system-CVE-2023-24805.patch
  0002-beh-backend-Extra-checks-against-odd-forged-input-CVE-2023-24805.patch
  0003-beh-backend-Further-improvements-CVE-2023-24805.patch
  backpported to cups-filters-1.25.0
  to fix CVE-2023-24805: RCE in cups-filters, beh CUPS backend
  (bsc#1211340)</changelog>
  <changelog author="tabraham@suse.com" date="1684756800">- gstoraster-gstopdf-Make-number-of-copies-as-embedded.patch fixes
  https://github.com/OpenPrinting/cups-filters/issues/255
  Printing multiple copies prints only 1 (pstopdf vs gstopdf)
  (bsc#1211401) (boo#1173345)</changelog>
  <changelog author="jsmeix@suse.com" date="1720008000">- bsc1225040.patch fixes bsc#1225040
  "cups-filters: Poppler for color PDF as grayscale via PS level 1:
  huge output makes printing slow"
  see https://github.com/OpenPrinting/cups-filters/issues/169
  Poppler for color PDF as grayscale via PS level 1 was introduced
  in cups-filters 1.22.6 via
  https://github.com/OpenPrinting/cups-filters/commit/48f9f994322c808ba2e9d0db6f3ff81caf8c0b72
  and disabled in cups-filters 1.25.12 via
  https://github.com/OpenPrinting/cups-filters/commit/0818ee322a6139be11d21fc76db345de1e979339</changelog>
</package>
<package pkgid="628253eec542bfff8241284e77c248207d3b2a9b4ddc20c5b187f42aa550f626" name="cups-filters-devel" arch="x86_64">
  <version epoch="0" ver="1.25.0" rel="150200.3.12.3"/>
  <changelog author="jsmeix@suse.de" date="1522843200">- Version upgrade to 1.20.1
  to provide upstream bugfixes also for SLE15 / Leap15
  and be also already prepared for SLE12 (fate#323676).
  This is a bug fix release fixing several issues
  on the Braille support and other bugs, in particular
  (for details see the NEWS file):
  * libcupsfilters: Silenced warning when using CUPS &lt; 2.x
    by eliminating the use of a recently introduced
    CUPS library function, see
    https://bugs.linuxfoundation.org/show_bug.cgi?id=1421
  * cups-browsed: Fixed crash when CUPS reports a print queue
    without "device-uri" attribute when cups-browsed polls a
    list of local CUPS queues, see
    https://github.com/OpenPrinting/cups-filters/issues/16
- fix_upstream_bug_1421.patch is no longer needed because
  it is now fixed in the upstream sources
  (see the "libcupsfilters ... bug ... 1421" entry above).</changelog>
  <changelog author="jsmeix@suse.de" date="1523361600">- Version upgrade to 1.20.2
  to provide upstream bugfixes also for SLE15 / Leap15
  and be also already prepared for SLE12 (fate#323676).
  This is a bug fix release fixing the recognition
  of remote CUPS queues by cups-browsed, the behavior
  of cups-browsed when one creates a queue with the
  same name of a cups-browsed-generated queue overwriting
  it, and other bug fixes (for details see the NEWS file).</changelog>
  <changelog author="luizluca@gmail.com" date="1525262400">- Version upgrade to 1.20.3
  to fix regression from 1.20.2 that ignores printers published
  using legacy CUPS broadcast</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1531224000">- Add pdftoopvp_Silence-compiler-warning.patch: pdftoopvp: Silence
  compiler warning.</changelog>
  <changelog author="alarrosa@suse.com" date="1531828800">- Version upgrade to 1.20.4
  - gstoraster: Removed unneeded "if"s (Ghostscript bug #692705).
  - cups-browsed: When checking whether there is already a local
    print queue with the same URI as the one of the discovered
    printer, consider also as equal URI if the URIs only differ
    by use of IPP or IPPS and/or use of HTTPS port 443 instead
    of IPP port 631.
  - cups-browsed: Also upgrade from ipp: to ipps: when the ipps:
    URI is on HTTPS port 443 instead of IPP port 631. This is
    common on IPP network printers.
  - pdftopdf: Removed support for hardware-implemented reversing
    of page order in PostScript printers. It was once not
    correctly implemented in cups-filters and second, such
    printers are extremely rare, and on Gutenprint PPDs with
    pseudo OutputOrder option hardware reversing was even
    wrongly assumed (Issue #47).
  - pdftopdf: Accept option "output-order=normal/reverse" for
    reversing page order (Issue #47) and also "page-delivery=
    same-order/reverse-order" (CUPS Issue #5340).
  - libcupsfilters: Let the PPD generator add "*PageStackOrder
    ..."  lines to the choices of the "OutputBin" option, to
    mark which output bins need the pages printed in reverse
    order (Issue #47).
  - libcupsfilters: Let the PPD generator correctly create a
    "*DefaultOutputOrder: ..."  entry, depending on whether the
    paper is put out face-up or face-down in the default output
    bin (Issue #47).
  - libcupsfilters: Fixed human-readable name of the OutputBin
    option in the PPD generator.
  - pdftoopvp: Silence compiler warning (Issue #42).
  - cups-browsed: If the user modifies/overwrites a print queue
    created by cups-browsed, it will now not only be
    automatically released from the control of cups-browsed, but
    we also create a replacement for our generated local queue
    under a new name.
  - cups-browsed: Make URIS for using the implicitclass backend
    correctly working also with queue names containing an '@'
    character.
  - braille: Strengthen error checking (Pull request #41).
  - braille: Index: Replace bogus characters with space (Pull
    request #41).
  - braille: Add print and braille page number options (Pull
    request #41).
  - braille: Index: Use standard duplex cups option (Pull
    request #41).
  - cups-browsed: Moved auto-generation of PPD file for IPP
    network printers from create_remote_printer_entry()
    function to update_cups_queues(). This allows re-creating
    accidentally removed or overwritten local queues without
    losing the PPD file.
  - braille: Add option to pick hyphenation rule according to
    current locale and make it the default for second
    translation table. (Pull request #38 and #39).
  - braille: Remove generated defs on "make clean". (Pull request #38).
  - braille: Turn non-breakable spaces to spaces. (Pull request
    [#38] and #39).
  - braille: Fix character encoding when extracting text. When
    extracing text from a zip file or a pdf, the resulting text
    is always utf-8 independently of the original locale, so we
    need to force that. (Pull request #38).
  - braille: Warn when no text translation was selected in case
    the user didn't notice. (Pull request #37).
  - braille: Fix spurious spacing after last Form-Feed (Pull
    request #45).
- Drop pdftoopvp_Silence-compiler-warning.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1535630400">- Do not diferentiate for service location, it is in sbindir
  on all systems we support now
- Use license for license install
- Version update to 1.21.1:
  - foomatic-rip: Fixed segmentation fault caused by wrong
    Coverity Scan issue fix (Issue #57, Debian bug #907026).
  - Build system: Require QPDF 8.1.0 or later as it is needed by
    bannertopdf (Issue #56).
  - libcupsfilters, cups-browsed, driverless, foomatic-rip,
    parallel: Silenced warnings from newest gcc.
  - libcupsfilters: When generating a PPD for driverless
    printing on a remote IPP printer, make pdftopdf not being
    run by the local queue if the remote queue is a CUPS queue
    to avoid running pdftopdf twice (CUPS Issue #5361).
  - libcupsfilters, cups-browsed, driverless, bannertopdf,
    foomatic-rip, pdftops, pdftoraster, rastertops,
    rastertoescpx, sys5ippprinter, beh: Fixed Coverity Scan
    issues. Thanks to Zdenek Dohnal (zdohnal at redhat dot com)
    for the tests and the patches.
  - bannertopdf: Switched over from using Poppler to using QPDF
    for generating the PDF pages. With Poppler unstable APIs
    were used which were subject to change. Thanks to Sahil
    Arora for this project in the Google Summer of Code 2018
    (Pull request #25).
  - cups-browsed: Manually defined clusters ("Cluster" directive
    in cups-browsed.conf) caused cups-browsed to crash.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1543406400">- Update to version 1.21.4:
  * cups-browsed: cups-browsed: Limit the number of retries for
    creating a print queue when it comes to HTTP timeouts. Number
    of retries given by HttpMaxRetries directive in
    cups-browsed.conf.
  * cups-browsed: Read out current time right before setting the
    timeouts.
  * libcupsfilters: In the PPD generator for driverless IPP
    printing let "*cupsManualCopies: true" lines get added to
    the PPD if printing is done in a raster format as then
    pdftopdf needs to generate the copies.
  * pdftoraster, pdftoopvp, pdftoijs: Fix build with
    Poppler &gt;= 0.70
  * pdftopdf: Fixed printing multiple copies on driverless IPP
    printers. When printing collated copies the multiple copies
    got applied twice, resulting in n*n instead of n copies.
  * pdftoraster, pdftoopvp, pdftoijs: Poppler removed memCheck
    and gMemReport functions, remove appropriate calls.
- Changes from version 1.21.3:
  * foomatic-rip: Reset stdin after replacing the underlying file
    descriptor.
- Changes from version 1.21.2:
  * cups-browsed: Fixed freeing of literal string caused by
    Coverity Scan issue fix.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1545134400">- Update to version 1.21.6:
  * Bug fix release, mainly for cups-browsed to avoid crashes and
    infinite printer removal/re-creation loops and spurious local
    queues for local CUPS printers. Also expanded PostScript
    interpreter bug workaround to more Apple LaserWriter models.
  * cups-browsed: To find out whether a DNS-SD-discovered printer
    is from the local machine, use not only the flags in the Avahi
    lookup result but also check the host name.
  * cups-browsed: When a local CUPS queue pointing to a remote CUPS
    printer was removed and re-created to make it a permanent
    queue, on_printer_deleted() was triggered by cupsd's
    notification to re-create a lost queue. Now
    on_printer_deleted() checks whether the queue is really gone
    and only re-creates then.
  * cups-browsed: When updating the CUPS queues, also removed and
    unregistered queues and not only created queues got checked for
    HTTP timeouts, which caused crashes on shutdown.
  * pdftops: Use the PS interpreter of Poppler for all Apple
    LaserWriter 16/600, 4/600, 12/640, 12/600, 12/660 as they all
    seem to not work with Ghostscript's PS output.
  * cups-browsed: On shutdown queues got removed even if they still
    had jobs.
- Changes from version 1.21.5:
  * Bug fix release, to build with Poppler 0.71 and with
    cups-browsed converting temporary CUPS queues reliably to
    permanent queues.
  * cups-browsed: We cannot reliably determine whether a CUPS queue
    is temporary, so we apply the procedure to make a temporary
    queue permanent to any unshared queue.
  * pdftoraster, pdftopdf, pdftoijs, pdftoopvp: Do not use the
    Poppler-specific "GBool", "gFalse", "gTrue" any more, as
    Poppler has switched to standard "bool", "false", "true" in
    version 0.71.0.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1546084800">- Fix building with Poppler 0.72
  Add 0001-Raise-minimum-poppler-version-from-0.18-to-0.19.patch
  Add 0002-Adapt-code-for-SplashXPathScanner-state-handling-sin.patch
  Add 0003-Support-some-more-methods-returning-const.patch
  Add 0004-Support-GooString-c_str-introduced-by-poppler-0.72.patch
  See https://github.com/OpenPrinting/cups-filters/pull/83</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1548676800">- Update to version 1.22.0:
  * From this release on the pdftopdf filter flattens interactive
    PDF forms and annotations internally, using QPDF, instead of
    calling external utilities. This especially eliminates slowing
    factors as additional piping of the data and unneeded use of
    PDF interpreters. Using external utilities for flattening is
    still possible in case of problems. In addition, a crash bug in
    cups-browsed got fixed and compatibility of the filters with
    Poppler 0.72 assured.
- Drop upstream fixed patches:
  * 0001-Raise-minimum-poppler-version-from-0.18-to-0.19.patch
  * 0002-Adapt-code-for-SplashXPathScanner-state-handling-sin.patch
  * 0003-Support-some-more-methods-returning-const.patch
  * 0004-Support-GooString-c_str-introduced-by-poppler-0.72.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550664000">- Update to version 1.22.1:
  * braille: Use sort command with LC_ALL=C for reproducibility
    of the genrated files, needed for distribution packaging.
  * cups-browsed, driverless: When polling the printer's
    capabilities via get-printer-attributes IPP request for
    driverless printing, use the attributes "all" and
    "media-col-database". Without "all" some printers do not report
    "urf-supported" and without "media-col-database" not all paper
    size and marging info gets reported.
  * braille: Document how to rework output before embossing.</changelog>
  <changelog author="jsmeix@suse.de" date="1554724800">- Version upgrade to 1.22.5
  * foomatic-rip: Changed Ghostscript call to count pages in a
    PDF file to use "runpdfbegin" and not the undocumented
    Ghostscript internal "pdfdict", so that it works with
    Ghostscript 9.27 and later (Debian bug #926576,
    Arch Linux bug #62251, openSUSE boo#1131771,
    cups@cups.org mailing list thread
    https://lists.cups.org/pipermail/cups/2019-April/074563.html).
- Version upgrade to 1.22.4
  * cups-browsed: Fix broken trailing space removal on
    "NickName" (Pull request #103).
  * pdftops: Emit PostScript Level 2 instead of Level 3 for
    Brother PostScript printers as at least some of them
    report to support level 3 but ontly work with Level 2
    (Ubuntu bug #1306849, comment #42).
  * bannertopdf: When multiplying the page for N-up or Duplex
    printing one page too much was generated (Issue #102).
- Version upgrade to 1.22.3
  * libcupsfilters: Added error checks for processing GIF, to
    avoid crashes or hangs on broken GIF files (Issues #81, #82,
    Pull request #100).
  * cups-browsed: Added hint to the man page and configuration
    file that with "DebugLogging stderr" the logging output goes
    to journal or syslog if cups-browsed is running as system
    service (Issue #28).
- Version upgrade to 1.22.2
  * cups-browsed: Let distribution of jobs sent to queues with
    "implicitclass" backend (usually clusters) be done by a
    "job-state" CUPS notification and not by
    "printer-state-changed" any more. The "job-state"
    notification already contains the job ID. Before we had to
    poll the job ID from CUPS via IPP which was sometimes
    unreliable (Issue #97).
  * imagetopdf, imagetoraster, pdftopdf, libcupsfilters: Added
    new page scaling options: "fill" scales the input page
    (typically a photo) so that the output page (typically with
    different aspect ratio) gets completely filled, aloowing for
    some content of the input page getting lost. "crop-to-fit"
    allows for easy printing of documents on slightly different
    output page sizes (A4 &lt;-&gt; Letter) maintaining the size and
    centering and cropping into the destination page. Thanks to
    Dheeraj Yadav (dhirajyadav135 at gmail dot com) for the
    patch (Pull request #92).
  * cups-browsed: Do not do IPP request for printer-is-shared
    option for remote cups queues with CUPS 2.2.x and newer
    (Pull request #91).
  * cups-browsed: Fix crash bug when reading "Cluster"
    directive from configuration file (Issue #94).
  * driverless: Updated man page as now also Mopria and
    Wi-Fi Direct printers are supported. Mentioned also
    ippusbxd.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559304000">- Update to version 1.23.0:
  * This release adds support for the "print-scaling" IPP attribute
    and has the code for the support of MuPDF as PDF renderer
    vastly simplified.
  * pdftops, mupdftoraster: Let pdftops call mutool directly and so
    that it directly outputs PostScript, eliminating the need to
    call the mupdftoraster and rastertops filters.
  * mupdftoraster: Reduced the use of temporary files from 3 to
    just one.
  * imagetopdf, imagetoraster, pdftopdf: Add support for
    print-scaling option.
- Changes from version 1.22.6:
  * Bug fix release, to address a further issue of cups-browsed
    removing user-created print queues, to make
    grayscale/monochrome PostScript jobs of colored input file
    actually output grayscale/monochrome files, to fix several bugs
    when using MuPDF as PDF renderer, and to silence compiler
    warnings.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559908800">- Update to version 1.25.0:
  * pdftoijs, pdftoopvp: Removed these deprecated filters
    completely as there is no demand for them any more. They also
    used unstable, undocumented APIs of Poppler.
  * pdftoraster: Changed from using unstable, undocumented APIs of
    Poppler to stable, documented ones, to improve maintainability
    of this filter, and with it of the cups-filters package.
  * libcupsfilters: Added support for color spaces CMY and RGBW
    when using filters without PPD file (mainly for development and
    debugging, option "print-color-mode" with values "cmy-XX" and
    "rgbw-XX" with XX being the number of bits per color).
- Changes from version 1.24.0:
  * cups-browsed: Integration of Deepak Patankar's Google Summer of
    Code 2018 project with the main goal of clustering different
    printers and automatically selecting the destination printers
    by job content and option/attribute settings.
  * cups-browsed, implicitclass: Support for mixed clusters of
    remote CUPS queues and IPP network printers. For this PPD files
    of remote CUPS queues are generated by cups-browsed based on
    IPP queries, as for native IPP printers, the number of jobs for
    load balancing is polled in a way that it works also with
    native IPP printers, the implicitclass backend sends jobs
    directly to the printer instead of re-queueing them via CUPS.
  * cups-browsed: Merge IPP attributes of several printers to
    combined attributes for the cluster to generate the cluster's
    PPD file, including PPD constraints for option combinations not
    fulfillable by any of the member printers, and finding
    reasonable, non-conflicting default settings.
  * cups-browsed: Selection algorithm for the destination printer
    for a job sent to the cluster. Based on the job settings
    requested such as page size, media type, print quality, the
    best most suitable printer in the cluster for the job will be
    selected.
  * cups-browsed, implicitclass: Filter jobs to clusters already
    locally. Due to the fact that a cluster's member printers are
    not exclusively non-raw CUPS queues with the complete filtering
    framework on the remote server, but also native IPP printers,
    we need to support generic driverless printers as destination.
    So we cannot pass on the input data unfiltered but need to
    filter locally. We let the cluster's PPD file emulate a PDF
    printer, letting the local CUPS queue of the cluster run
    pdftopdf and any pre-filters to turn the input into PDF and we
    let the implicitclass backend turn PDF into a format understood
    by the destination printer, supporting the 4 formats of
    driverless IPP printing: PDF, PWG Raster, Apple Raster, PCLm.
- Drop libpoppler-cpp0, libpoppler-devel and libpoppler-glib-devel
  BuildRequires.
- Add pkgconfig(poppler-cpp) BuildRequires following upstream
  changes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1560340800">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut the build queues by allowing usage of systemd-mini</changelog>
  <changelog author="idonmez@suse.com" date="1567512000">- Add add-cstring-include.patch to include cstring for memcpy
  and strcmp</changelog>
  <changelog author="jsmeix@suse.de" date="1618488000">- fix_upstream_issue348.patch fixes
  https://github.com/OpenPrinting/cups-filters/issues/348
  foomatic-rip segfaults with 'job-sheets=none,none'
  but works with 'job-sheets=none'
  (bsc#1182893)</changelog>
  <changelog author="jsmeix@suse.com" date="1684152000">- cups-filters-1.25.0-0001-beh-backend-Use-execv-instead-of-system-CVE-2023-24805.patch
  cups-filters-1.25.0-0002-beh-backend-Extra-checks-against-odd-forged-input-CVE-2023-24805.patch
  cups-filters-1.25.0-0003-beh-backend-Further-improvements-CVE-2023-24805.patch
  are the upstream
  0001-beh-backend-Use-execv-instead-of-system-CVE-2023-24805.patch
  0002-beh-backend-Extra-checks-against-odd-forged-input-CVE-2023-24805.patch
  0003-beh-backend-Further-improvements-CVE-2023-24805.patch
  backpported to cups-filters-1.25.0
  to fix CVE-2023-24805: RCE in cups-filters, beh CUPS backend
  (bsc#1211340)</changelog>
  <changelog author="tabraham@suse.com" date="1684756800">- gstoraster-gstopdf-Make-number-of-copies-as-embedded.patch fixes
  https://github.com/OpenPrinting/cups-filters/issues/255
  Printing multiple copies prints only 1 (pstopdf vs gstopdf)
  (bsc#1211401) (boo#1173345)</changelog>
  <changelog author="jsmeix@suse.com" date="1720008000">- bsc1225040.patch fixes bsc#1225040
  "cups-filters: Poppler for color PDF as grayscale via PS level 1:
  huge output makes printing slow"
  see https://github.com/OpenPrinting/cups-filters/issues/169
  Poppler for color PDF as grayscale via PS level 1 was introduced
  in cups-filters 1.22.6 via
  https://github.com/OpenPrinting/cups-filters/commit/48f9f994322c808ba2e9d0db6f3ff81caf8c0b72
  and disabled in cups-filters 1.25.12 via
  https://github.com/OpenPrinting/cups-filters/commit/0818ee322a6139be11d21fc76db345de1e979339</changelog>
</package>
<package pkgid="118837e8cbd1ea1d6d57d2780f9ebbfcf3d5894fcfcca4ec16963486283ab782" name="curl" arch="aarch64">
  <version epoch="0" ver="8.6.0" rel="150600.4.3.1"/>
  <changelog author="pmonreal@suse.com" date="1679313600">- Update to 8.0.0:
  * Security fixes:
  - TELNET option IAC injection [bsc#1209209, CVE-2023-27533]
  - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534]
  - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535]
  - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536]
  - HSTS double-free [bsc#1209213, CVE-2023-27537]
  - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538]
  * Changes:
  - build: remove support for curl_off_t &lt; 8 bytes
  * Bugfixes:
  - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3
  - BINDINGS: add Fortran binding
  - cf-socket: use port 80 when resolving name for local bind
  - cookie: don't load cookies again when flushing
  - curl_path: create the new path with dynbuf
  - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe
  - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure
  - ftp: active mode with SSL, add the filter
  - hostip: avoid sscanf and extra buffer copies
  - http2: fix for http2-prior-knowledge when reusing connections
  - http2: fix handling of RST and GOAWAY to recognize partial transfers
  - http: don't send 100-continue for short PUT requests
  - http: fix unix domain socket use in https connects
  - libssh: use dynbuf instead of realloc
  - ngtcp2-gnutls.yml: bump to gnutls 3.8.0
  - sectransp: make read_cert() use a dynbuf when loading
  - telnet: only accept option arguments in ascii
  - telnet: parse telnet options without sscanf
  - url: fix the SSH connection reuse check
  - url: only reuse connections with same GSS delegation
  - urlapi: '%' is illegal in host names
  - ws: keep the socket non-blocking
  * Rebase libcurl-ocloexec.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1679400000">- Update to 8.0.1:
  * Bugfixes:
  - fix crash in curl_easy_cleanup</changelog>
  <changelog author="david.anes@suse.com" date="1684324800">- Update to 8.1.0:
  * Security fixes:
  - UAF in SSH sha256 fingerprint [bsc#1211230, CVE-2023-28319]
  - siglongjmp race condition [bsc#1211231, CVE-2023-28320]
  - IDN wildcard match [bsc#1211232, CVE-2023-28321]
  - POST-after-PUT confusion [bsc#1211233, CVE-2023-28322]
  - See also: https://curl.se/docs/security.html
  * Changes:
  - curl: add --proxy-http2
  - CURLPROXY_HTTPS2: for HTTPS proxy that may speak HTTP/2
  - hostip: refuse to resolve the .onion TLD
  - tool_writeout: add URL component variables
  * Bugfixes:
  - See full changelog here: https://curl.se/changes.html#8_1_0</changelog>
  <changelog author="pmonreal@suse.com" date="1684843200">- Update to 8.1.1:
  * Bugfixes:
  - cf-socket: completely remove the disabled
    USE_RECV_BEFORE_SEND_WORKAROUND
  - checksrc: disallow spaces before labels
  - curl_easy_getinfo: clarify on return data types
  - docs: document that curl_url_cleanup(NULL) is a safe no-op
  - hostip: move easy_lock.h include above curl_memory.h
  - http2: double http request parser max line length
  - http2: increase stream window size to 10 MB
  - lib: rename struct 'http_req' to 'httpreq'
  - ngtcp2: proper handling of uint64_t when adjusting send buffer
  - sectransp.c: make the code c89 compatible
  - select: avoid returning an error on EINTR from select() or poll()
  - url: provide better error message when URLs fail to parse
  - urlapi: allow numerical parts in the host name</changelog>
  <changelog author="pmonreal@suse.com" date="1685448000">- Update to 8.1.2:
  * Bugfixes:
  - configure: quote the assignments for run-compiler
  - configure: without pkg-config and no custom path, use -lnghttp2
  - curl: cache the --trace-time value for a second
  - http2: fix EOF handling on uploads with auth negotiation
  - http3: send EOF indicator early as possible
  - lib1560: verify more scheme guessing
  - lib: remove unused functions, make single-use static
  - libcurl.m4: remove trailing 'dnl' that causes this to break autoconf
  - libssh: when keyboard-interactive auth fails, try password
  - misc: fix spelling mistakes
  - page-header: mention curl version and how to figure out current release
  - page-header: minor wording polish in the URL segment
  - scripts/singleuse.pl: add more API calls
  - urlapi: remove superfluous host name check</changelog>
  <changelog author="pmonreal@suse.com" date="1689768000">- Update to 8.2.0 [bsc#1213237, CVE-2023-32001]
  * Security fix:
  - CVE-2023-32001: fopen race condition
  * Changes:
  - curl: add --ca-native and --proxy-ca-native
  - curl: add --trace-ids
  - CURLOPT_MAIL_RCPT_ALLOWFAILS: replace CURLOPT_MAIL_RCPT_ALLLOWFAILS
  - haproxy: add --haproxy-clientip flag to set client IPs
  - lib: add CURLINFO_CONN_ID and CURLINFO_XFER_ID
  * Bugfixes:
  - cf-socket: don't bypass fclosesocket callback if cancelled before connect
  - cf-socket: skip getpeername()/getsockname for TFTP
  - curl: count uploaded data to stop at the originally given size
  - curl: return error when asked to use an unsupported HTTP version
  - http2: fix crash in handling stream weights
  - http2: send HEADER &amp; DATA together if possible
  - http3/ngtcp2: upload EAGAIN handling
  - http: rectify the outgoing Cookie: header field size check
  - hyper: fix EOF handling on input
  - imap: Provide method to disable SASL if it is advertised
  - libssh2: provide error message when setting host key type fails
  - libssh2: use custom memory functions
  - ngtcp2: assigning timeout, but value is overwritten before used
  - quiche: avoid NULL deref in debug logging
  - sectransp: fix EOF handling
  - system.h: remove __IBMC__/__IBMCPP__ guards and apply to all z/OS compiles
  - timeval: use CLOCK_MONOTONIC_RAW if available
  - tls13-ciphers.d: include Schannel
  - tool_easysrc.h: correct `easysrc_perform` for `CURL_DISABLE_LIBCURL_OPTION`
  - tool_operate: allow cookie lines up to 8200 bytes
  - tool_parsecfg: accept line lengths up to 10M
  - tool_writeout_json: fix encoding of control characters
  - transfer: clear credentials when redirecting to absolute URL
  - urlapi: have *set(PATH) prepend a slash if one is missing
  - urlapi: scheme must start with alpha
  - vtls: avoid memory leak if sha256 call fails
  - websocket-cb: example doing WebSocket download using callback
  - ws: make the curl_ws_meta() return pointer a const</changelog>
  <changelog author="pmonreal@suse.com" date="1690545600">- Update to 8.2.1:
  * Bugfixes:
  - cfilters: rename close/connect functions to avoid clashes
  - ciphers.d: put URL in first column
  - cmake: add 'libcurlu'/'libcurltool' for unit tests
  - cmake: update ngtcp2 detection
  - configure: check for nghttp2_session_get_stream_local_window_size
  - docs: mark two TLS options for TLS, not SSL
  - docs: provide more see also for cipher options
  - hostip: return IPv6 first for localhost resolves
  - http2: fix regression on upload EOF handling
  - http: VLH, very large header test and fixes
  - libcurl-errors.3: add CURLUE_OK
  - os400: correct EXPECTED_STRING_LASTZEROTERMINATED
  - quiche: fix lookup of transfer at multi
  - quiche: fix segfault and other things
  - rustls: update rustls-ffi 0.10.0
  - socks: print ipv6 address within brackets
  - src/mkhelp: strip off escape sequences
  - tool: fix tool_seek_cb build when SIZEOF_CURL_OFF_T &gt; SIZEOF_OFF_T
  - transfer: do not clear the credentials on redirect to absolute URL
  - unittest: remove unneeded *_LDADD
  - websocket: rename arguments/variables to match docs</changelog>
  <changelog author="pmonreal@suse.com" date="1694606400">- Update to 8.3.0: [bsc#1215026, CVE-2023-38039]
  * Changes:
  - curl: make %output{} in -w specify a file to write to
  - gskit: remove
  - lib: --disable-bindlocal builds curl without local binding support
  - nss: remove support for this TLS library
  - tool: add "variable" support
  - trace: make tracing available in non-debug builds
  - url: change default value for CURLOPT_MAXREDIRS to 30
  - urlapi: CURLU_PUNY2IDN - convert from punycode to IDN name
  * Bugfixes:
  - altsvc: accept and parse IPv6 addresses in response headers
  - asyn-ares: reduce timeout to 2000ms
  - aws-sigv4: canonicalize the query
  - aws-sigv4: fix having date header twice in some cases
  - aws-sigv4: handle no-value user header entries
  - c-hyper: adjust the hyper to curlcode conversion
  - c-hyper: fix memory leaks in `Curl_http`
  - cf-haproxy: make CURLOPT_HAPROXY_CLIENT_IP set the *source* IP
  - cf-socket: log successful interface bind
  - cmake: add GnuTLS option
  - cmake: add support for `CURL_DEFAULT_SSL_BACKEND`
  - cmake: detect `SSL_set0_wbio` in OpenSSL
  - configure: trust pkg-config when it's used for zlib
  - configure: use the pkg-config --libs-only-l flag for libssh2
  - connect: stop halving the remaining timeout when less than 600 ms left
  - crypto: ensure crypto initialization works
  - digest: Use hostname to generate spn instead of realm
  - ftp: fix temp write of ipv6 address
  - headers: accept leading whitespaces on first response header
  - http2: fix in h2 proxy tunnel: progress in ingress on sending
  - http3/ngtcp2: shorten handshake, trace cleanup
  - http3: quiche, handshake optimization, trace cleanup
  - http: close the connection after a late 417 is received
  - http: fix sending of large requests
  - http: return error when receiving too large header set
  - lib: fix null ptr derefs and uninitialized vars (h2/h3)
  - lib: move mimepost data from -&gt;req.p.http to -&gt;state
  - list-only.d: mention SFTP as supported protocol
  - ngtcp2: fix handling of large requests
  - openssl: auto-detect `SSL_R_TLSV13_ALERT_CERTIFICATE_REQUIRED`
  - openssl: clear error queue after SSL_shutdown
  - openssl: make aws-lc version support OCSP
  - openssl: Support async cert verify callback
  - openssl: switch to modern init for LibreSSL 2.7.0+
  - openssl: when CURLOPT_SSL_CTX_FUNCTION is registered, init x509 store before
  - quic: don't set SNI if hostname is an IP address
  - quiche: adjust quiche `QUIC_IDLE_TIMEOUT` to 60s
  - quiche: enable quiche to handle timeout events
  - resolve: use PF_INET6 family lookups when CURL_IPRESOLVE_V6 is set
  - schannel: verify hostname independent of verify cert
  - tool_filetime: make -z work with file dates before 1970
  - tool_operate: allow both SSL_CERT_FILE and SSL_CERT_DIR
  - tool_operate: make aws-sigv4 not require TLS to be used
  - transfer: also stop the sending on closed connection
  - urlapi: fix heap buffer overflow
  - urlapi: setting a blank URL ("") is not an ok URL</changelog>
  <changelog author="pmonreal@suse.com" date="1697025600">- Update to 8.4.0:
  * Security fixes:
  - SOCKS5 heap buffer overflow [bsc#1215888, CVE-2023-38545]
  - cookie injection with none file [bsc#1215889, CVE-2023-38546]
  * Changes:
  - curl: add support for the IPFS protocols via HTTP gateway
  - curl_multi_get_handles: get easy handles from a multi handle
  - mingw: delete support for legacy mingw.org toolchain
  * Bugfixes:
  - base64: also build for curl
  - cf-socket: simulate slow/blocked receives in debug
  - configure: check for the capath by default
  - connect: expire the timeout when trying next
  - connect: only start the happy eyeballs timer when needed
  - cookie: do not store the expire or max-age strings
  - cookie: remove unnecessary struct fields
  - cookie: set -&gt;running in cookie_init even if data is NULL
  - create-dirs.d: clarify it also uses --output-dirs
  - http2: refused stream handling for retry
  - http: h1/h2 proxy unification
  - http: use per-request counter to check too large headers
  - idn: if idn2_check_version returns NULL, return error
  - lib: enable hmac for digest as well
  - lib: let the max filesize option stop too big transfers too
  - lib: move handling of 'data-&gt;req.writer_stack' into Curl_client_write()
  - lib: provide and use Curl_hexencode
  - lib: use wrapper for curl_mime_data fseek callback
  - libssh2: fix error message on failed pubkey-from-file
  - libssh: cap SFTP packet size sent
  - MQTT: improve receive of ACKs
  - multi: do CURLM_CALL_MULTI_PERFORM at two more places
  - multi: round the timeout up to prevent early wakeups
  - openssl: improve ssl shutdown handling
  - openssl: use X509_ALGOR_get0 instead of reaching into X509_ALGOR
  - pytest: exclude test_03_goaway in CI runs due to timing dependency
  - quic: set ciphers/curves the same way regular TLS does
  - quiche: fix build error with --with-ca-fallback
  - socks: return error if hostname too long for remote resolve
  - tftpd: always use curl's own tftp.h
  - tool_getparam: accept variable expansion on file names too
  - upload-file.d: describe the file name slash/backslash handling
  - url: fall back to http/https proxy env-variable if ws/wss not set
  - url: fix netrc info message
  - wolfssh: do cleanup in Curl_ssh_cleanup
  - wolfssl: allow capath with CURLOPT_CAINFO_BLOB
  - wolfssl: if CURLOPT_CAINFO_BLOB is set, ignore the CA files
  - wolfssl: ignore errors in CA path
  * Rebase libcurl-ocloexec.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1701864000">- Update to 8.5.0:
  * Security fixes:
  - [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass
  - [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents
  * Changes:
  - gnutls: support CURLSSLOPT_NATIVE_CA
  - HTTP3: ngtcp2 builds are no longer experimental
  * Bugfixes:
  - asyn-thread: use pipe instead of socketpair for IPC when available
  - cmake: fix OpenSSL quic detection in quiche builds
  - conncache: use the closure handle when disconnecting surplus connections
  - content_encoding: make Curl_all_content_encodings allocless
  - cookie: lowercase the domain names before PSL checks
  - Curl_http_body: cleanup properly when Curl_getformdata errors
  - CURLMOPT_MAX_CONCURRENT_STREAMS: make sure the set value is within range
  - doh: provide better return code for responses w/o addresses
  - doh: use PIPEWAIT when HTTP/2 is attempted
  - duphandle: also free 'outcurl-&gt;cookies' in error path
  - duphandle: make dupset() not return with pointers to old alloced data
  - duphandle: use strdup to clone *COPYPOSTFIELDS if size is not set
  - easy: in duphandle, init the cookies for the new handle
  - easy_lock: add a pthread_mutex_t fallback
  - fopen: create new file using old file's mode
  - fopen: create short(er) temporary file name
  - getenv: PlayStation doesn't have getenv()
  - hostip: show the list of IPs when resolving is done
  - hsts: skip single-dot hostname
  - HTTP/2, HTTP/3: handle detach of onoing transfers
  - http: allow longer HTTP/2 request method names
  - hyper: temporarily remove HTTP/2 support
  - IPFS: fix IPFS_PATH and file parsing
  - multi: during ratelimit multi_getsock should return no sockets
  - multi: use pipe instead of socketpair to *wakeup()
  - ngtcp2: fix races in stream handling
  - ntlm_wb: use pipe instead of socketpair when possible
  - openssl: avoid BN_num_bits() NULL pointer derefs
  - openssl: fix building with v3 `no-deprecated` + add CI test
  - openssl: fix infof() to avoid compiler warning for %s with null
  - openssl: identify the "quictls" backend correctly
  - openssl: include SIG and KEM algorithms in verbose
  - openssl: two multi pointer checks should probably rather be asserts
  - openssl: when a session-ID is reused, skip OCSP stapling
  - quic: make eyeballers connect retries stop at weird replies
  - quic: manage connection idle timeouts
  - setopt: check CURLOPT_TFTP_BLKSIZE range on set
  - socks: better buffer size checks for socks4a user and hostname
  - socks: make SOCKS5 use the CURLOPT_IPRESOLVE choice
  - tool: fix --capath when proxy support is disabled
  - tool_getparam: limit --rate to be smaller than number of ms
  - transfer: abort pause send when connection is marked for closing
  - transfer: avoid calling the read callback again after EOF
  - transfer: only reset the FTP wildcard engine in CLEAR state
  - url: don't touch the multi handle when closing internal handles
  - urlapi: avoid null deref if setting blank host to url encode
  - urlapi: skip appending NULL pointer query
  - urlapi: when URL encoding the fragment, pass in the right length
  - vtls: cleanup SSL config management
  - vtls: consistently use typedef names for OpenSSL structs
  - vtls: late clone of connection ssl config
  - vtls: use ALPN "http/1.1" for HTTP/1.x, including HTTP/1.0
  * Rebase curl-secure-getenv.patch
  * Add curl-tests-errorcodes.patch</changelog>
  <changelog author="pujos.michael@gmail.com" date="1704456000">- Added curl-adjust-pollset-fix.patch to fix broken MPD http streaming:
  https://github.com/curl/curl/issues/12632</changelog>
  <changelog author="pmonreal@suse.com" date="1706702400">- Update to 8.6.0: [bsc#1219149, CVE-2024-0853]
  * Security fixes:
  - CVE-2024-0853: OCSP verification bypass with TLS session reuse
  * Changes:
  - add CURLE_TOO_LARGE, CURLINFO_QUEUE_TIME_T
  * Bugfixes:
  - altsvc: free 'as' when returning error
  - asyn-ares: with modern c-ares, use its default timeout
  - cf-socket: show errno in tcpkeepalive error messages
  - cmdline-opts: update availability for the *-ca-native options
  - configure: when enabling QUIC, check that TLS supports QUIC
  - content_encoding: change return code to typedef'ed enum
  - curl: show ipfs and ipns as supported "protocols"
  - CURLINFO_REFERER.3: clarify that it is the *request* header
  - dist: add tests/errorcodes.pl to the tarball
  - gen.pl: support ## for doing .IP in table-like lists
  - GHA: bump ngtcp2, gnutls, mod_h2, quiche
  - hostip: return error immediately when Curl_ip2addr() fails
  - http3/quiche: fix result code on a stream reset
  - http3: initial support for OpenSSL 3.2 QUIC stack
  - http: check for "Host:" case insensitively
  - http: fix off-by-one error in request method length check
  - http: only act on 101 responses when they are HTTP/1.1
  - lib: add debug log outputs for CURLE_BAD_FUNCTION_ARGUMENT
  - lib: error out on multissl + http3
  - lib: fix variable undeclared error caused by `infof` changes
  - lib: rename Curl_strndup to Curl_memdup0 to avoid misunderstanding
  - lib: strndup/memdup instead of malloc, memcpy and null-terminate
  - libssh2: use `libssh2_session_callback_set2()` with v1.11.1
  - ngtcp2: put h3 at the front of alpn
  - openldap: fix an LDAP crash
  - openldap: fix STARTTLS
  - openssl: re-match LibreSSL deinit with init
  - rtsp: deal with borked server responses
  - sasl: make login option string override http auth
  - tool: prepend output_dir in header callback
  - tool_getparam: stop supporting `@filename` style for --cookie
  - transfer: fix upload rate limiting, add test cases
  - url: don't set default CA paths for Secure Transport backend
  - url: for disabled protocols, mention if found in redirect
  - vquic: extract TLS setup into own source
  - websockets: check for negative payload lengths
  * Remove patches fixed upstream:
  - curl-adjust-pollset-fix.patch
  - curl-tests-errorcodes.patch
  * Rebase dont-mess-with-rpmoptflags.patch</changelog>
  <changelog author="fvogt@suse.com" date="1707393600">- Add patch to fix various TLS related issues including FTP over SSL
  transmission timeouts:
  * 0001-vtls-revert-receive-max-buffer-add-test-case.patch
- Switch to %autosetup</changelog>
  <changelog author="pmonreal@suse.com" date="1710244800">- Remove the nghttp2 version requirement as a version guard around
  the nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation
  function was added in curl 8.0.1.
  * Upstream commit: https://github.com/curl/curl/commit/744dcf22</changelog>
  <changelog author="pmonreal@suse.com" date="1711022400">- Security fix: [bsc#1221667, CVE-2024-2398]
  * curl: HTTP/2 push headers memory-leak
  * Add curl-CVE-2024-2398.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1711108800">- Security fix: [bsc#1221665, CVE-2024-2004]
  * Usage of disabled protocol
  * Add curl-CVE-2024-2004.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1711540800">- Security fix: [bsc#1221668, CVE-2024-2466]
  * curl: TLS certificate check bypass with mbedTLS
  * Add curl-CVE-2024-2466.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1711540801">- Security fix: [bsc#1221666, CVE-2024-2379]
  * curl: QUIC certificate check bypass with wolfSSL
  * Add curl-CVE-2024-2379.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1721131200">- Security fix: [bsc#1227888, CVE-2024-6197]
  * Freeing stack buffer in utf8asn1str
  * x509asn1: remove superfluous free()
  * Add curl-CVE-2024-6197.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1722427200">- Security fix: [bsc#1228535, CVE-2024-7264]
  * curl: ASN.1 date parser overread
  * Add curl-CVE-2024-7264.patch</changelog>
</package>
<package pkgid="caec84e5e38a4eb05c9b82868aa9dad0a91a49af412f20f17ddaef69f7df039f" name="curl" arch="ppc64le">
  <version epoch="0" ver="8.6.0" rel="150600.4.3.1"/>
  <changelog author="pmonreal@suse.com" date="1679313600">- Update to 8.0.0:
  * Security fixes:
  - TELNET option IAC injection [bsc#1209209, CVE-2023-27533]
  - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534]
  - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535]
  - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536]
  - HSTS double-free [bsc#1209213, CVE-2023-27537]
  - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538]
  * Changes:
  - build: remove support for curl_off_t &lt; 8 bytes
  * Bugfixes:
  - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3
  - BINDINGS: add Fortran binding
  - cf-socket: use port 80 when resolving name for local bind
  - cookie: don't load cookies again when flushing
  - curl_path: create the new path with dynbuf
  - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe
  - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure
  - ftp: active mode with SSL, add the filter
  - hostip: avoid sscanf and extra buffer copies
  - http2: fix for http2-prior-knowledge when reusing connections
  - http2: fix handling of RST and GOAWAY to recognize partial transfers
  - http: don't send 100-continue for short PUT requests
  - http: fix unix domain socket use in https connects
  - libssh: use dynbuf instead of realloc
  - ngtcp2-gnutls.yml: bump to gnutls 3.8.0
  - sectransp: make read_cert() use a dynbuf when loading
  - telnet: only accept option arguments in ascii
  - telnet: parse telnet options without sscanf
  - url: fix the SSH connection reuse check
  - url: only reuse connections with same GSS delegation
  - urlapi: '%' is illegal in host names
  - ws: keep the socket non-blocking
  * Rebase libcurl-ocloexec.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1679400000">- Update to 8.0.1:
  * Bugfixes:
  - fix crash in curl_easy_cleanup</changelog>
  <changelog author="david.anes@suse.com" date="1684324800">- Update to 8.1.0:
  * Security fixes:
  - UAF in SSH sha256 fingerprint [bsc#1211230, CVE-2023-28319]
  - siglongjmp race condition [bsc#1211231, CVE-2023-28320]
  - IDN wildcard match [bsc#1211232, CVE-2023-28321]
  - POST-after-PUT confusion [bsc#1211233, CVE-2023-28322]
  - See also: https://curl.se/docs/security.html
  * Changes:
  - curl: add --proxy-http2
  - CURLPROXY_HTTPS2: for HTTPS proxy that may speak HTTP/2
  - hostip: refuse to resolve the .onion TLD
  - tool_writeout: add URL component variables
  * Bugfixes:
  - See full changelog here: https://curl.se/changes.html#8_1_0</changelog>
  <changelog author="pmonreal@suse.com" date="1684843200">- Update to 8.1.1:
  * Bugfixes:
  - cf-socket: completely remove the disabled
    USE_RECV_BEFORE_SEND_WORKAROUND
  - checksrc: disallow spaces before labels
  - curl_easy_getinfo: clarify on return data types
  - docs: document that curl_url_cleanup(NULL) is a safe no-op
  - hostip: move easy_lock.h include above curl_memory.h
  - http2: double http request parser max line length
  - http2: increase stream window size to 10 MB
  - lib: rename struct 'http_req' to 'httpreq'
  - ngtcp2: proper handling of uint64_t when adjusting send buffer
  - sectransp.c: make the code c89 compatible
  - select: avoid returning an error on EINTR from select() or poll()
  - url: provide better error message when URLs fail to parse
  - urlapi: allow numerical parts in the host name</changelog>
  <changelog author="pmonreal@suse.com" date="1685448000">- Update to 8.1.2:
  * Bugfixes:
  - configure: quote the assignments for run-compiler
  - configure: without pkg-config and no custom path, use -lnghttp2
  - curl: cache the --trace-time value for a second
  - http2: fix EOF handling on uploads with auth negotiation
  - http3: send EOF indicator early as possible
  - lib1560: verify more scheme guessing
  - lib: remove unused functions, make single-use static
  - libcurl.m4: remove trailing 'dnl' that causes this to break autoconf
  - libssh: when keyboard-interactive auth fails, try password
  - misc: fix spelling mistakes
  - page-header: mention curl version and how to figure out current release
  - page-header: minor wording polish in the URL segment
  - scripts/singleuse.pl: add more API calls
  - urlapi: remove superfluous host name check</changelog>
  <changelog author="pmonreal@suse.com" date="1689768000">- Update to 8.2.0 [bsc#1213237, CVE-2023-32001]
  * Security fix:
  - CVE-2023-32001: fopen race condition
  * Changes:
  - curl: add --ca-native and --proxy-ca-native
  - curl: add --trace-ids
  - CURLOPT_MAIL_RCPT_ALLOWFAILS: replace CURLOPT_MAIL_RCPT_ALLLOWFAILS
  - haproxy: add --haproxy-clientip flag to set client IPs
  - lib: add CURLINFO_CONN_ID and CURLINFO_XFER_ID
  * Bugfixes:
  - cf-socket: don't bypass fclosesocket callback if cancelled before connect
  - cf-socket: skip getpeername()/getsockname for TFTP
  - curl: count uploaded data to stop at the originally given size
  - curl: return error when asked to use an unsupported HTTP version
  - http2: fix crash in handling stream weights
  - http2: send HEADER &amp; DATA together if possible
  - http3/ngtcp2: upload EAGAIN handling
  - http: rectify the outgoing Cookie: header field size check
  - hyper: fix EOF handling on input
  - imap: Provide method to disable SASL if it is advertised
  - libssh2: provide error message when setting host key type fails
  - libssh2: use custom memory functions
  - ngtcp2: assigning timeout, but value is overwritten before used
  - quiche: avoid NULL deref in debug logging
  - sectransp: fix EOF handling
  - system.h: remove __IBMC__/__IBMCPP__ guards and apply to all z/OS compiles
  - timeval: use CLOCK_MONOTONIC_RAW if available
  - tls13-ciphers.d: include Schannel
  - tool_easysrc.h: correct `easysrc_perform` for `CURL_DISABLE_LIBCURL_OPTION`
  - tool_operate: allow cookie lines up to 8200 bytes
  - tool_parsecfg: accept line lengths up to 10M
  - tool_writeout_json: fix encoding of control characters
  - transfer: clear credentials when redirecting to absolute URL
  - urlapi: have *set(PATH) prepend a slash if one is missing
  - urlapi: scheme must start with alpha
  - vtls: avoid memory leak if sha256 call fails
  - websocket-cb: example doing WebSocket download using callback
  - ws: make the curl_ws_meta() return pointer a const</changelog>
  <changelog author="pmonreal@suse.com" date="1690545600">- Update to 8.2.1:
  * Bugfixes:
  - cfilters: rename close/connect functions to avoid clashes
  - ciphers.d: put URL in first column
  - cmake: add 'libcurlu'/'libcurltool' for unit tests
  - cmake: update ngtcp2 detection
  - configure: check for nghttp2_session_get_stream_local_window_size
  - docs: mark two TLS options for TLS, not SSL
  - docs: provide more see also for cipher options
  - hostip: return IPv6 first for localhost resolves
  - http2: fix regression on upload EOF handling
  - http: VLH, very large header test and fixes
  - libcurl-errors.3: add CURLUE_OK
  - os400: correct EXPECTED_STRING_LASTZEROTERMINATED
  - quiche: fix lookup of transfer at multi
  - quiche: fix segfault and other things
  - rustls: update rustls-ffi 0.10.0
  - socks: print ipv6 address within brackets
  - src/mkhelp: strip off escape sequences
  - tool: fix tool_seek_cb build when SIZEOF_CURL_OFF_T &gt; SIZEOF_OFF_T
  - transfer: do not clear the credentials on redirect to absolute URL
  - unittest: remove unneeded *_LDADD
  - websocket: rename arguments/variables to match docs</changelog>
  <changelog author="pmonreal@suse.com" date="1694606400">- Update to 8.3.0: [bsc#1215026, CVE-2023-38039]
  * Changes:
  - curl: make %output{} in -w specify a file to write to
  - gskit: remove
  - lib: --disable-bindlocal builds curl without local binding support
  - nss: remove support for this TLS library
  - tool: add "variable" support
  - trace: make tracing available in non-debug builds
  - url: change default value for CURLOPT_MAXREDIRS to 30
  - urlapi: CURLU_PUNY2IDN - convert from punycode to IDN name
  * Bugfixes:
  - altsvc: accept and parse IPv6 addresses in response headers
  - asyn-ares: reduce timeout to 2000ms
  - aws-sigv4: canonicalize the query
  - aws-sigv4: fix having date header twice in some cases
  - aws-sigv4: handle no-value user header entries
  - c-hyper: adjust the hyper to curlcode conversion
  - c-hyper: fix memory leaks in `Curl_http`
  - cf-haproxy: make CURLOPT_HAPROXY_CLIENT_IP set the *source* IP
  - cf-socket: log successful interface bind
  - cmake: add GnuTLS option
  - cmake: add support for `CURL_DEFAULT_SSL_BACKEND`
  - cmake: detect `SSL_set0_wbio` in OpenSSL
  - configure: trust pkg-config when it's used for zlib
  - configure: use the pkg-config --libs-only-l flag for libssh2
  - connect: stop halving the remaining timeout when less than 600 ms left
  - crypto: ensure crypto initialization works
  - digest: Use hostname to generate spn instead of realm
  - ftp: fix temp write of ipv6 address
  - headers: accept leading whitespaces on first response header
  - http2: fix in h2 proxy tunnel: progress in ingress on sending
  - http3/ngtcp2: shorten handshake, trace cleanup
  - http3: quiche, handshake optimization, trace cleanup
  - http: close the connection after a late 417 is received
  - http: fix sending of large requests
  - http: return error when receiving too large header set
  - lib: fix null ptr derefs and uninitialized vars (h2/h3)
  - lib: move mimepost data from -&gt;req.p.http to -&gt;state
  - list-only.d: mention SFTP as supported protocol
  - ngtcp2: fix handling of large requests
  - openssl: auto-detect `SSL_R_TLSV13_ALERT_CERTIFICATE_REQUIRED`
  - openssl: clear error queue after SSL_shutdown
  - openssl: make aws-lc version support OCSP
  - openssl: Support async cert verify callback
  - openssl: switch to modern init for LibreSSL 2.7.0+
  - openssl: when CURLOPT_SSL_CTX_FUNCTION is registered, init x509 store before
  - quic: don't set SNI if hostname is an IP address
  - quiche: adjust quiche `QUIC_IDLE_TIMEOUT` to 60s
  - quiche: enable quiche to handle timeout events
  - resolve: use PF_INET6 family lookups when CURL_IPRESOLVE_V6 is set
  - schannel: verify hostname independent of verify cert
  - tool_filetime: make -z work with file dates before 1970
  - tool_operate: allow both SSL_CERT_FILE and SSL_CERT_DIR
  - tool_operate: make aws-sigv4 not require TLS to be used
  - transfer: also stop the sending on closed connection
  - urlapi: fix heap buffer overflow
  - urlapi: setting a blank URL ("") is not an ok URL</changelog>
  <changelog author="pmonreal@suse.com" date="1697025600">- Update to 8.4.0:
  * Security fixes:
  - SOCKS5 heap buffer overflow [bsc#1215888, CVE-2023-38545]
  - cookie injection with none file [bsc#1215889, CVE-2023-38546]
  * Changes:
  - curl: add support for the IPFS protocols via HTTP gateway
  - curl_multi_get_handles: get easy handles from a multi handle
  - mingw: delete support for legacy mingw.org toolchain
  * Bugfixes:
  - base64: also build for curl
  - cf-socket: simulate slow/blocked receives in debug
  - configure: check for the capath by default
  - connect: expire the timeout when trying next
  - connect: only start the happy eyeballs timer when needed
  - cookie: do not store the expire or max-age strings
  - cookie: remove unnecessary struct fields
  - cookie: set -&gt;running in cookie_init even if data is NULL
  - create-dirs.d: clarify it also uses --output-dirs
  - http2: refused stream handling for retry
  - http: h1/h2 proxy unification
  - http: use per-request counter to check too large headers
  - idn: if idn2_check_version returns NULL, return error
  - lib: enable hmac for digest as well
  - lib: let the max filesize option stop too big transfers too
  - lib: move handling of 'data-&gt;req.writer_stack' into Curl_client_write()
  - lib: provide and use Curl_hexencode
  - lib: use wrapper for curl_mime_data fseek callback
  - libssh2: fix error message on failed pubkey-from-file
  - libssh: cap SFTP packet size sent
  - MQTT: improve receive of ACKs
  - multi: do CURLM_CALL_MULTI_PERFORM at two more places
  - multi: round the timeout up to prevent early wakeups
  - openssl: improve ssl shutdown handling
  - openssl: use X509_ALGOR_get0 instead of reaching into X509_ALGOR
  - pytest: exclude test_03_goaway in CI runs due to timing dependency
  - quic: set ciphers/curves the same way regular TLS does
  - quiche: fix build error with --with-ca-fallback
  - socks: return error if hostname too long for remote resolve
  - tftpd: always use curl's own tftp.h
  - tool_getparam: accept variable expansion on file names too
  - upload-file.d: describe the file name slash/backslash handling
  - url: fall back to http/https proxy env-variable if ws/wss not set
  - url: fix netrc info message
  - wolfssh: do cleanup in Curl_ssh_cleanup
  - wolfssl: allow capath with CURLOPT_CAINFO_BLOB
  - wolfssl: if CURLOPT_CAINFO_BLOB is set, ignore the CA files
  - wolfssl: ignore errors in CA path
  * Rebase libcurl-ocloexec.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1701864000">- Update to 8.5.0:
  * Security fixes:
  - [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass
  - [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents
  * Changes:
  - gnutls: support CURLSSLOPT_NATIVE_CA
  - HTTP3: ngtcp2 builds are no longer experimental
  * Bugfixes:
  - asyn-thread: use pipe instead of socketpair for IPC when available
  - cmake: fix OpenSSL quic detection in quiche builds
  - conncache: use the closure handle when disconnecting surplus connections
  - content_encoding: make Curl_all_content_encodings allocless
  - cookie: lowercase the domain names before PSL checks
  - Curl_http_body: cleanup properly when Curl_getformdata errors
  - CURLMOPT_MAX_CONCURRENT_STREAMS: make sure the set value is within range
  - doh: provide better return code for responses w/o addresses
  - doh: use PIPEWAIT when HTTP/2 is attempted
  - duphandle: also free 'outcurl-&gt;cookies' in error path
  - duphandle: make dupset() not return with pointers to old alloced data
  - duphandle: use strdup to clone *COPYPOSTFIELDS if size is not set
  - easy: in duphandle, init the cookies for the new handle
  - easy_lock: add a pthread_mutex_t fallback
  - fopen: create new file using old file's mode
  - fopen: create short(er) temporary file name
  - getenv: PlayStation doesn't have getenv()
  - hostip: show the list of IPs when resolving is done
  - hsts: skip single-dot hostname
  - HTTP/2, HTTP/3: handle detach of onoing transfers
  - http: allow longer HTTP/2 request method names
  - hyper: temporarily remove HTTP/2 support
  - IPFS: fix IPFS_PATH and file parsing
  - multi: during ratelimit multi_getsock should return no sockets
  - multi: use pipe instead of socketpair to *wakeup()
  - ngtcp2: fix races in stream handling
  - ntlm_wb: use pipe instead of socketpair when possible
  - openssl: avoid BN_num_bits() NULL pointer derefs
  - openssl: fix building with v3 `no-deprecated` + add CI test
  - openssl: fix infof() to avoid compiler warning for %s with null
  - openssl: identify the "quictls" backend correctly
  - openssl: include SIG and KEM algorithms in verbose
  - openssl: two multi pointer checks should probably rather be asserts
  - openssl: when a session-ID is reused, skip OCSP stapling
  - quic: make eyeballers connect retries stop at weird replies
  - quic: manage connection idle timeouts
  - setopt: check CURLOPT_TFTP_BLKSIZE range on set
  - socks: better buffer size checks for socks4a user and hostname
  - socks: make SOCKS5 use the CURLOPT_IPRESOLVE choice
  - tool: fix --capath when proxy support is disabled
  - tool_getparam: limit --rate to be smaller than number of ms
  - transfer: abort pause send when connection is marked for closing
  - transfer: avoid calling the read callback again after EOF
  - transfer: only reset the FTP wildcard engine in CLEAR state
  - url: don't touch the multi handle when closing internal handles
  - urlapi: avoid null deref if setting blank host to url encode
  - urlapi: skip appending NULL pointer query
  - urlapi: when URL encoding the fragment, pass in the right length
  - vtls: cleanup SSL config management
  - vtls: consistently use typedef names for OpenSSL structs
  - vtls: late clone of connection ssl config
  - vtls: use ALPN "http/1.1" for HTTP/1.x, including HTTP/1.0
  * Rebase curl-secure-getenv.patch
  * Add curl-tests-errorcodes.patch</changelog>
  <changelog author="pujos.michael@gmail.com" date="1704456000">- Added curl-adjust-pollset-fix.patch to fix broken MPD http streaming:
  https://github.com/curl/curl/issues/12632</changelog>
  <changelog author="pmonreal@suse.com" date="1706702400">- Update to 8.6.0: [bsc#1219149, CVE-2024-0853]
  * Security fixes:
  - CVE-2024-0853: OCSP verification bypass with TLS session reuse
  * Changes:
  - add CURLE_TOO_LARGE, CURLINFO_QUEUE_TIME_T
  * Bugfixes:
  - altsvc: free 'as' when returning error
  - asyn-ares: with modern c-ares, use its default timeout
  - cf-socket: show errno in tcpkeepalive error messages
  - cmdline-opts: update availability for the *-ca-native options
  - configure: when enabling QUIC, check that TLS supports QUIC
  - content_encoding: change return code to typedef'ed enum
  - curl: show ipfs and ipns as supported "protocols"
  - CURLINFO_REFERER.3: clarify that it is the *request* header
  - dist: add tests/errorcodes.pl to the tarball
  - gen.pl: support ## for doing .IP in table-like lists
  - GHA: bump ngtcp2, gnutls, mod_h2, quiche
  - hostip: return error immediately when Curl_ip2addr() fails
  - http3/quiche: fix result code on a stream reset
  - http3: initial support for OpenSSL 3.2 QUIC stack
  - http: check for "Host:" case insensitively
  - http: fix off-by-one error in request method length check
  - http: only act on 101 responses when they are HTTP/1.1
  - lib: add debug log outputs for CURLE_BAD_FUNCTION_ARGUMENT
  - lib: error out on multissl + http3
  - lib: fix variable undeclared error caused by `infof` changes
  - lib: rename Curl_strndup to Curl_memdup0 to avoid misunderstanding
  - lib: strndup/memdup instead of malloc, memcpy and null-terminate
  - libssh2: use `libssh2_session_callback_set2()` with v1.11.1
  - ngtcp2: put h3 at the front of alpn
  - openldap: fix an LDAP crash
  - openldap: fix STARTTLS
  - openssl: re-match LibreSSL deinit with init
  - rtsp: deal with borked server responses
  - sasl: make login option string override http auth
  - tool: prepend output_dir in header callback
  - tool_getparam: stop supporting `@filename` style for --cookie
  - transfer: fix upload rate limiting, add test cases
  - url: don't set default CA paths for Secure Transport backend
  - url: for disabled protocols, mention if found in redirect
  - vquic: extract TLS setup into own source
  - websockets: check for negative payload lengths
  * Remove patches fixed upstream:
  - curl-adjust-pollset-fix.patch
  - curl-tests-errorcodes.patch
  * Rebase dont-mess-with-rpmoptflags.patch</changelog>
  <changelog author="fvogt@suse.com" date="1707393600">- Add patch to fix various TLS related issues including FTP over SSL
  transmission timeouts:
  * 0001-vtls-revert-receive-max-buffer-add-test-case.patch
- Switch to %autosetup</changelog>
  <changelog author="pmonreal@suse.com" date="1710244800">- Remove the nghttp2 version requirement as a version guard around
  the nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation
  function was added in curl 8.0.1.
  * Upstream commit: https://github.com/curl/curl/commit/744dcf22</changelog>
  <changelog author="pmonreal@suse.com" date="1711022400">- Security fix: [bsc#1221667, CVE-2024-2398]
  * curl: HTTP/2 push headers memory-leak
  * Add curl-CVE-2024-2398.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1711108800">- Security fix: [bsc#1221665, CVE-2024-2004]
  * Usage of disabled protocol
  * Add curl-CVE-2024-2004.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1711540800">- Security fix: [bsc#1221668, CVE-2024-2466]
  * curl: TLS certificate check bypass with mbedTLS
  * Add curl-CVE-2024-2466.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1711540801">- Security fix: [bsc#1221666, CVE-2024-2379]
  * curl: QUIC certificate check bypass with wolfSSL
  * Add curl-CVE-2024-2379.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1721131200">- Security fix: [bsc#1227888, CVE-2024-6197]
  * Freeing stack buffer in utf8asn1str
  * x509asn1: remove superfluous free()
  * Add curl-CVE-2024-6197.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1722427200">- Security fix: [bsc#1228535, CVE-2024-7264]
  * curl: ASN.1 date parser overread
  * Add curl-CVE-2024-7264.patch</changelog>
</package>
<package pkgid="bd67bfe8900226f50278cc05a0419658729589a9c020d4318f1b1aed07d33cc5" name="curl" arch="s390x">
  <version epoch="0" ver="8.6.0" rel="150600.4.3.1"/>
  <changelog author="pmonreal@suse.com" date="1679313600">- Update to 8.0.0:
  * Security fixes:
  - TELNET option IAC injection [bsc#1209209, CVE-2023-27533]
  - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534]
  - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535]
  - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536]
  - HSTS double-free [bsc#1209213, CVE-2023-27537]
  - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538]
  * Changes:
  - build: remove support for curl_off_t &lt; 8 bytes
  * Bugfixes:
  - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3
  - BINDINGS: add Fortran binding
  - cf-socket: use port 80 when resolving name for local bind
  - cookie: don't load cookies again when flushing
  - curl_path: create the new path with dynbuf
  - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe
  - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure
  - ftp: active mode with SSL, add the filter
  - hostip: avoid sscanf and extra buffer copies
  - http2: fix for http2-prior-knowledge when reusing connections
  - http2: fix handling of RST and GOAWAY to recognize partial transfers
  - http: don't send 100-continue for short PUT requests
  - http: fix unix domain socket use in https connects
  - libssh: use dynbuf instead of realloc
  - ngtcp2-gnutls.yml: bump to gnutls 3.8.0
  - sectransp: make read_cert() use a dynbuf when loading
  - telnet: only accept option arguments in ascii
  - telnet: parse telnet options without sscanf
  - url: fix the SSH connection reuse check
  - url: only reuse connections with same GSS delegation
  - urlapi: '%' is illegal in host names
  - ws: keep the socket non-blocking
  * Rebase libcurl-ocloexec.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1679400000">- Update to 8.0.1:
  * Bugfixes:
  - fix crash in curl_easy_cleanup</changelog>
  <changelog author="david.anes@suse.com" date="1684324800">- Update to 8.1.0:
  * Security fixes:
  - UAF in SSH sha256 fingerprint [bsc#1211230, CVE-2023-28319]
  - siglongjmp race condition [bsc#1211231, CVE-2023-28320]
  - IDN wildcard match [bsc#1211232, CVE-2023-28321]
  - POST-after-PUT confusion [bsc#1211233, CVE-2023-28322]
  - See also: https://curl.se/docs/security.html
  * Changes:
  - curl: add --proxy-http2
  - CURLPROXY_HTTPS2: for HTTPS proxy that may speak HTTP/2
  - hostip: refuse to resolve the .onion TLD
  - tool_writeout: add URL component variables
  * Bugfixes:
  - See full changelog here: https://curl.se/changes.html#8_1_0</changelog>
  <changelog author="pmonreal@suse.com" date="1684843200">- Update to 8.1.1:
  * Bugfixes:
  - cf-socket: completely remove the disabled
    USE_RECV_BEFORE_SEND_WORKAROUND
  - checksrc: disallow spaces before labels
  - curl_easy_getinfo: clarify on return data types
  - docs: document that curl_url_cleanup(NULL) is a safe no-op
  - hostip: move easy_lock.h include above curl_memory.h
  - http2: double http request parser max line length
  - http2: increase stream window size to 10 MB
  - lib: rename struct 'http_req' to 'httpreq'
  - ngtcp2: proper handling of uint64_t when adjusting send buffer
  - sectransp.c: make the code c89 compatible
  - select: avoid returning an error on EINTR from select() or poll()
  - url: provide better error message when URLs fail to parse
  - urlapi: allow numerical parts in the host name</changelog>
  <changelog author="pmonreal@suse.com" date="1685448000">- Update to 8.1.2:
  * Bugfixes:
  - configure: quote the assignments for run-compiler
  - configure: without pkg-config and no custom path, use -lnghttp2
  - curl: cache the --trace-time value for a second
  - http2: fix EOF handling on uploads with auth negotiation
  - http3: send EOF indicator early as possible
  - lib1560: verify more scheme guessing
  - lib: remove unused functions, make single-use static
  - libcurl.m4: remove trailing 'dnl' that causes this to break autoconf
  - libssh: when keyboard-interactive auth fails, try password
  - misc: fix spelling mistakes
  - page-header: mention curl version and how to figure out current release
  - page-header: minor wording polish in the URL segment
  - scripts/singleuse.pl: add more API calls
  - urlapi: remove superfluous host name check</changelog>
  <changelog author="pmonreal@suse.com" date="1689768000">- Update to 8.2.0 [bsc#1213237, CVE-2023-32001]
  * Security fix:
  - CVE-2023-32001: fopen race condition
  * Changes:
  - curl: add --ca-native and --proxy-ca-native
  - curl: add --trace-ids
  - CURLOPT_MAIL_RCPT_ALLOWFAILS: replace CURLOPT_MAIL_RCPT_ALLLOWFAILS
  - haproxy: add --haproxy-clientip flag to set client IPs
  - lib: add CURLINFO_CONN_ID and CURLINFO_XFER_ID
  * Bugfixes:
  - cf-socket: don't bypass fclosesocket callback if cancelled before connect
  - cf-socket: skip getpeername()/getsockname for TFTP
  - curl: count uploaded data to stop at the originally given size
  - curl: return error when asked to use an unsupported HTTP version
  - http2: fix crash in handling stream weights
  - http2: send HEADER &amp; DATA together if possible
  - http3/ngtcp2: upload EAGAIN handling
  - http: rectify the outgoing Cookie: header field size check
  - hyper: fix EOF handling on input
  - imap: Provide method to disable SASL if it is advertised
  - libssh2: provide error message when setting host key type fails
  - libssh2: use custom memory functions
  - ngtcp2: assigning timeout, but value is overwritten before used
  - quiche: avoid NULL deref in debug logging
  - sectransp: fix EOF handling
  - system.h: remove __IBMC__/__IBMCPP__ guards and apply to all z/OS compiles
  - timeval: use CLOCK_MONOTONIC_RAW if available
  - tls13-ciphers.d: include Schannel
  - tool_easysrc.h: correct `easysrc_perform` for `CURL_DISABLE_LIBCURL_OPTION`
  - tool_operate: allow cookie lines up to 8200 bytes
  - tool_parsecfg: accept line lengths up to 10M
  - tool_writeout_json: fix encoding of control characters
  - transfer: clear credentials when redirecting to absolute URL
  - urlapi: have *set(PATH) prepend a slash if one is missing
  - urlapi: scheme must start with alpha
  - vtls: avoid memory leak if sha256 call fails
  - websocket-cb: example doing WebSocket download using callback
  - ws: make the curl_ws_meta() return pointer a const</changelog>
  <changelog author="pmonreal@suse.com" date="1690545600">- Update to 8.2.1:
  * Bugfixes:
  - cfilters: rename close/connect functions to avoid clashes
  - ciphers.d: put URL in first column
  - cmake: add 'libcurlu'/'libcurltool' for unit tests
  - cmake: update ngtcp2 detection
  - configure: check for nghttp2_session_get_stream_local_window_size
  - docs: mark two TLS options for TLS, not SSL
  - docs: provide more see also for cipher options
  - hostip: return IPv6 first for localhost resolves
  - http2: fix regression on upload EOF handling
  - http: VLH, very large header test and fixes
  - libcurl-errors.3: add CURLUE_OK
  - os400: correct EXPECTED_STRING_LASTZEROTERMINATED
  - quiche: fix lookup of transfer at multi
  - quiche: fix segfault and other things
  - rustls: update rustls-ffi 0.10.0
  - socks: print ipv6 address within brackets
  - src/mkhelp: strip off escape sequences
  - tool: fix tool_seek_cb build when SIZEOF_CURL_OFF_T &gt; SIZEOF_OFF_T
  - transfer: do not clear the credentials on redirect to absolute URL
  - unittest: remove unneeded *_LDADD
  - websocket: rename arguments/variables to match docs</changelog>
  <changelog author="pmonreal@suse.com" date="1694606400">- Update to 8.3.0: [bsc#1215026, CVE-2023-38039]
  * Changes:
  - curl: make %output{} in -w specify a file to write to
  - gskit: remove
  - lib: --disable-bindlocal builds curl without local binding support
  - nss: remove support for this TLS library
  - tool: add "variable" support
  - trace: make tracing available in non-debug builds
  - url: change default value for CURLOPT_MAXREDIRS to 30
  - urlapi: CURLU_PUNY2IDN - convert from punycode to IDN name
  * Bugfixes:
  - altsvc: accept and parse IPv6 addresses in response headers
  - asyn-ares: reduce timeout to 2000ms
  - aws-sigv4: canonicalize the query
  - aws-sigv4: fix having date header twice in some cases
  - aws-sigv4: handle no-value user header entries
  - c-hyper: adjust the hyper to curlcode conversion
  - c-hyper: fix memory leaks in `Curl_http`
  - cf-haproxy: make CURLOPT_HAPROXY_CLIENT_IP set the *source* IP
  - cf-socket: log successful interface bind
  - cmake: add GnuTLS option
  - cmake: add support for `CURL_DEFAULT_SSL_BACKEND`
  - cmake: detect `SSL_set0_wbio` in OpenSSL
  - configure: trust pkg-config when it's used for zlib
  - configure: use the pkg-config --libs-only-l flag for libssh2
  - connect: stop halving the remaining timeout when less than 600 ms left
  - crypto: ensure crypto initialization works
  - digest: Use hostname to generate spn instead of realm
  - ftp: fix temp write of ipv6 address
  - headers: accept leading whitespaces on first response header
  - http2: fix in h2 proxy tunnel: progress in ingress on sending
  - http3/ngtcp2: shorten handshake, trace cleanup
  - http3: quiche, handshake optimization, trace cleanup
  - http: close the connection after a late 417 is received
  - http: fix sending of large requests
  - http: return error when receiving too large header set
  - lib: fix null ptr derefs and uninitialized vars (h2/h3)
  - lib: move mimepost data from -&gt;req.p.http to -&gt;state
  - list-only.d: mention SFTP as supported protocol
  - ngtcp2: fix handling of large requests
  - openssl: auto-detect `SSL_R_TLSV13_ALERT_CERTIFICATE_REQUIRED`
  - openssl: clear error queue after SSL_shutdown
  - openssl: make aws-lc version support OCSP
  - openssl: Support async cert verify callback
  - openssl: switch to modern init for LibreSSL 2.7.0+
  - openssl: when CURLOPT_SSL_CTX_FUNCTION is registered, init x509 store before
  - quic: don't set SNI if hostname is an IP address
  - quiche: adjust quiche `QUIC_IDLE_TIMEOUT` to 60s
  - quiche: enable quiche to handle timeout events
  - resolve: use PF_INET6 family lookups when CURL_IPRESOLVE_V6 is set
  - schannel: verify hostname independent of verify cert
  - tool_filetime: make -z work with file dates before 1970
  - tool_operate: allow both SSL_CERT_FILE and SSL_CERT_DIR
  - tool_operate: make aws-sigv4 not require TLS to be used
  - transfer: also stop the sending on closed connection
  - urlapi: fix heap buffer overflow
  - urlapi: setting a blank URL ("") is not an ok URL</changelog>
  <changelog author="pmonreal@suse.com" date="1697025600">- Update to 8.4.0:
  * Security fixes:
  - SOCKS5 heap buffer overflow [bsc#1215888, CVE-2023-38545]
  - cookie injection with none file [bsc#1215889, CVE-2023-38546]
  * Changes:
  - curl: add support for the IPFS protocols via HTTP gateway
  - curl_multi_get_handles: get easy handles from a multi handle
  - mingw: delete support for legacy mingw.org toolchain
  * Bugfixes:
  - base64: also build for curl
  - cf-socket: simulate slow/blocked receives in debug
  - configure: check for the capath by default
  - connect: expire the timeout when trying next
  - connect: only start the happy eyeballs timer when needed
  - cookie: do not store the expire or max-age strings
  - cookie: remove unnecessary struct fields
  - cookie: set -&gt;running in cookie_init even if data is NULL
  - create-dirs.d: clarify it also uses --output-dirs
  - http2: refused stream handling for retry
  - http: h1/h2 proxy unification
  - http: use per-request counter to check too large headers
  - idn: if idn2_check_version returns NULL, return error
  - lib: enable hmac for digest as well
  - lib: let the max filesize option stop too big transfers too
  - lib: move handling of 'data-&gt;req.writer_stack' into Curl_client_write()
  - lib: provide and use Curl_hexencode
  - lib: use wrapper for curl_mime_data fseek callback
  - libssh2: fix error message on failed pubkey-from-file
  - libssh: cap SFTP packet size sent
  - MQTT: improve receive of ACKs
  - multi: do CURLM_CALL_MULTI_PERFORM at two more places
  - multi: round the timeout up to prevent early wakeups
  - openssl: improve ssl shutdown handling
  - openssl: use X509_ALGOR_get0 instead of reaching into X509_ALGOR
  - pytest: exclude test_03_goaway in CI runs due to timing dependency
  - quic: set ciphers/curves the same way regular TLS does
  - quiche: fix build error with --with-ca-fallback
  - socks: return error if hostname too long for remote resolve
  - tftpd: always use curl's own tftp.h
  - tool_getparam: accept variable expansion on file names too
  - upload-file.d: describe the file name slash/backslash handling
  - url: fall back to http/https proxy env-variable if ws/wss not set
  - url: fix netrc info message
  - wolfssh: do cleanup in Curl_ssh_cleanup
  - wolfssl: allow capath with CURLOPT_CAINFO_BLOB
  - wolfssl: if CURLOPT_CAINFO_BLOB is set, ignore the CA files
  - wolfssl: ignore errors in CA path
  * Rebase libcurl-ocloexec.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1701864000">- Update to 8.5.0:
  * Security fixes:
  - [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass
  - [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents
  * Changes:
  - gnutls: support CURLSSLOPT_NATIVE_CA
  - HTTP3: ngtcp2 builds are no longer experimental
  * Bugfixes:
  - asyn-thread: use pipe instead of socketpair for IPC when available
  - cmake: fix OpenSSL quic detection in quiche builds
  - conncache: use the closure handle when disconnecting surplus connections
  - content_encoding: make Curl_all_content_encodings allocless
  - cookie: lowercase the domain names before PSL checks
  - Curl_http_body: cleanup properly when Curl_getformdata errors
  - CURLMOPT_MAX_CONCURRENT_STREAMS: make sure the set value is within range
  - doh: provide better return code for responses w/o addresses
  - doh: use PIPEWAIT when HTTP/2 is attempted
  - duphandle: also free 'outcurl-&gt;cookies' in error path
  - duphandle: make dupset() not return with pointers to old alloced data
  - duphandle: use strdup to clone *COPYPOSTFIELDS if size is not set
  - easy: in duphandle, init the cookies for the new handle
  - easy_lock: add a pthread_mutex_t fallback
  - fopen: create new file using old file's mode
  - fopen: create short(er) temporary file name
  - getenv: PlayStation doesn't have getenv()
  - hostip: show the list of IPs when resolving is done
  - hsts: skip single-dot hostname
  - HTTP/2, HTTP/3: handle detach of onoing transfers
  - http: allow longer HTTP/2 request method names
  - hyper: temporarily remove HTTP/2 support
  - IPFS: fix IPFS_PATH and file parsing
  - multi: during ratelimit multi_getsock should return no sockets
  - multi: use pipe instead of socketpair to *wakeup()
  - ngtcp2: fix races in stream handling
  - ntlm_wb: use pipe instead of socketpair when possible
  - openssl: avoid BN_num_bits() NULL pointer derefs
  - openssl: fix building with v3 `no-deprecated` + add CI test
  - openssl: fix infof() to avoid compiler warning for %s with null
  - openssl: identify the "quictls" backend correctly
  - openssl: include SIG and KEM algorithms in verbose
  - openssl: two multi pointer checks should probably rather be asserts
  - openssl: when a session-ID is reused, skip OCSP stapling
  - quic: make eyeballers connect retries stop at weird replies
  - quic: manage connection idle timeouts
  - setopt: check CURLOPT_TFTP_BLKSIZE range on set
  - socks: better buffer size checks for socks4a user and hostname
  - socks: make SOCKS5 use the CURLOPT_IPRESOLVE choice
  - tool: fix --capath when proxy support is disabled
  - tool_getparam: limit --rate to be smaller than number of ms
  - transfer: abort pause send when connection is marked for closing
  - transfer: avoid calling the read callback again after EOF
  - transfer: only reset the FTP wildcard engine in CLEAR state
  - url: don't touch the multi handle when closing internal handles
  - urlapi: avoid null deref if setting blank host to url encode
  - urlapi: skip appending NULL pointer query
  - urlapi: when URL encoding the fragment, pass in the right length
  - vtls: cleanup SSL config management
  - vtls: consistently use typedef names for OpenSSL structs
  - vtls: late clone of connection ssl config
  - vtls: use ALPN "http/1.1" for HTTP/1.x, including HTTP/1.0
  * Rebase curl-secure-getenv.patch
  * Add curl-tests-errorcodes.patch</changelog>
  <changelog author="pujos.michael@gmail.com" date="1704456000">- Added curl-adjust-pollset-fix.patch to fix broken MPD http streaming:
  https://github.com/curl/curl/issues/12632</changelog>
  <changelog author="pmonreal@suse.com" date="1706702400">- Update to 8.6.0: [bsc#1219149, CVE-2024-0853]
  * Security fixes:
  - CVE-2024-0853: OCSP verification bypass with TLS session reuse
  * Changes:
  - add CURLE_TOO_LARGE, CURLINFO_QUEUE_TIME_T
  * Bugfixes:
  - altsvc: free 'as' when returning error
  - asyn-ares: with modern c-ares, use its default timeout
  - cf-socket: show errno in tcpkeepalive error messages
  - cmdline-opts: update availability for the *-ca-native options
  - configure: when enabling QUIC, check that TLS supports QUIC
  - content_encoding: change return code to typedef'ed enum
  - curl: show ipfs and ipns as supported "protocols"
  - CURLINFO_REFERER.3: clarify that it is the *request* header
  - dist: add tests/errorcodes.pl to the tarball
  - gen.pl: support ## for doing .IP in table-like lists
  - GHA: bump ngtcp2, gnutls, mod_h2, quiche
  - hostip: return error immediately when Curl_ip2addr() fails
  - http3/quiche: fix result code on a stream reset
  - http3: initial support for OpenSSL 3.2 QUIC stack
  - http: check for "Host:" case insensitively
  - http: fix off-by-one error in request method length check
  - http: only act on 101 responses when they are HTTP/1.1
  - lib: add debug log outputs for CURLE_BAD_FUNCTION_ARGUMENT
  - lib: error out on multissl + http3
  - lib: fix variable undeclared error caused by `infof` changes
  - lib: rename Curl_strndup to Curl_memdup0 to avoid misunderstanding
  - lib: strndup/memdup instead of malloc, memcpy and null-terminate
  - libssh2: use `libssh2_session_callback_set2()` with v1.11.1
  - ngtcp2: put h3 at the front of alpn
  - openldap: fix an LDAP crash
  - openldap: fix STARTTLS
  - openssl: re-match LibreSSL deinit with init
  - rtsp: deal with borked server responses
  - sasl: make login option string override http auth
  - tool: prepend output_dir in header callback
  - tool_getparam: stop supporting `@filename` style for --cookie
  - transfer: fix upload rate limiting, add test cases
  - url: don't set default CA paths for Secure Transport backend
  - url: for disabled protocols, mention if found in redirect
  - vquic: extract TLS setup into own source
  - websockets: check for negative payload lengths
  * Remove patches fixed upstream:
  - curl-adjust-pollset-fix.patch
  - curl-tests-errorcodes.patch
  * Rebase dont-mess-with-rpmoptflags.patch</changelog>
  <changelog author="fvogt@suse.com" date="1707393600">- Add patch to fix various TLS related issues including FTP over SSL
  transmission timeouts:
  * 0001-vtls-revert-receive-max-buffer-add-test-case.patch
- Switch to %autosetup</changelog>
  <changelog author="pmonreal@suse.com" date="1710244800">- Remove the nghttp2 version requirement as a version guard around
  the nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation
  function was added in curl 8.0.1.
  * Upstream commit: https://github.com/curl/curl/commit/744dcf22</changelog>
  <changelog author="pmonreal@suse.com" date="1711022400">- Security fix: [bsc#1221667, CVE-2024-2398]
  * curl: HTTP/2 push headers memory-leak
  * Add curl-CVE-2024-2398.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1711108800">- Security fix: [bsc#1221665, CVE-2024-2004]
  * Usage of disabled protocol
  * Add curl-CVE-2024-2004.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1711540800">- Security fix: [bsc#1221668, CVE-2024-2466]
  * curl: TLS certificate check bypass with mbedTLS
  * Add curl-CVE-2024-2466.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1711540801">- Security fix: [bsc#1221666, CVE-2024-2379]
  * curl: QUIC certificate check bypass with wolfSSL
  * Add curl-CVE-2024-2379.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1721131200">- Security fix: [bsc#1227888, CVE-2024-6197]
  * Freeing stack buffer in utf8asn1str
  * x509asn1: remove superfluous free()
  * Add curl-CVE-2024-6197.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1722427200">- Security fix: [bsc#1228535, CVE-2024-7264]
  * curl: ASN.1 date parser overread
  * Add curl-CVE-2024-7264.patch</changelog>
</package>
<package pkgid="589a6e6911b451f0f66a819603bdf75639da667dfbf8c70cd9d8f9173337ef59" name="curl" arch="src">
  <version epoch="0" ver="8.6.0" rel="150600.4.3.1"/>
  <changelog author="pmonreal@suse.com" date="1679313600">- Update to 8.0.0:
  * Security fixes:
  - TELNET option IAC injection [bsc#1209209, CVE-2023-27533]
  - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534]
  - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535]
  - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536]
  - HSTS double-free [bsc#1209213, CVE-2023-27537]
  - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538]
  * Changes:
  - build: remove support for curl_off_t &lt; 8 bytes
  * Bugfixes:
  - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3
  - BINDINGS: add Fortran binding
  - cf-socket: use port 80 when resolving name for local bind
  - cookie: don't load cookies again when flushing
  - curl_path: create the new path with dynbuf
  - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe
  - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure
  - ftp: active mode with SSL, add the filter
  - hostip: avoid sscanf and extra buffer copies
  - http2: fix for http2-prior-knowledge when reusing connections
  - http2: fix handling of RST and GOAWAY to recognize partial transfers
  - http: don't send 100-continue for short PUT requests
  - http: fix unix domain socket use in https connects
  - libssh: use dynbuf instead of realloc
  - ngtcp2-gnutls.yml: bump to gnutls 3.8.0
  - sectransp: make read_cert() use a dynbuf when loading
  - telnet: only accept option arguments in ascii
  - telnet: parse telnet options without sscanf
  - url: fix the SSH connection reuse check
  - url: only reuse connections with same GSS delegation
  - urlapi: '%' is illegal in host names
  - ws: keep the socket non-blocking
  * Rebase libcurl-ocloexec.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1679400000">- Update to 8.0.1:
  * Bugfixes:
  - fix crash in curl_easy_cleanup</changelog>
  <changelog author="david.anes@suse.com" date="1684324800">- Update to 8.1.0:
  * Security fixes:
  - UAF in SSH sha256 fingerprint [bsc#1211230, CVE-2023-28319]
  - siglongjmp race condition [bsc#1211231, CVE-2023-28320]
  - IDN wildcard match [bsc#1211232, CVE-2023-28321]
  - POST-after-PUT confusion [bsc#1211233, CVE-2023-28322]
  - See also: https://curl.se/docs/security.html
  * Changes:
  - curl: add --proxy-http2
  - CURLPROXY_HTTPS2: for HTTPS proxy that may speak HTTP/2
  - hostip: refuse to resolve the .onion TLD
  - tool_writeout: add URL component variables
  * Bugfixes:
  - See full changelog here: https://curl.se/changes.html#8_1_0</changelog>
  <changelog author="pmonreal@suse.com" date="1684843200">- Update to 8.1.1:
  * Bugfixes:
  - cf-socket: completely remove the disabled
    USE_RECV_BEFORE_SEND_WORKAROUND
  - checksrc: disallow spaces before labels
  - curl_easy_getinfo: clarify on return data types
  - docs: document that curl_url_cleanup(NULL) is a safe no-op
  - hostip: move easy_lock.h include above curl_memory.h
  - http2: double http request parser max line length
  - http2: increase stream window size to 10 MB
  - lib: rename struct 'http_req' to 'httpreq'
  - ngtcp2: proper handling of uint64_t when adjusting send buffer
  - sectransp.c: make the code c89 compatible
  - select: avoid returning an error on EINTR from select() or poll()
  - url: provide better error message when URLs fail to parse
  - urlapi: allow numerical parts in the host name</changelog>
  <changelog author="pmonreal@suse.com" date="1685448000">- Update to 8.1.2:
  * Bugfixes:
  - configure: quote the assignments for run-compiler
  - configure: without pkg-config and no custom path, use -lnghttp2
  - curl: cache the --trace-time value for a second
  - http2: fix EOF handling on uploads with auth negotiation
  - http3: send EOF indicator early as possible
  - lib1560: verify more scheme guessing
  - lib: remove unused functions, make single-use static
  - libcurl.m4: remove trailing 'dnl' that causes this to break autoconf
  - libssh: when keyboard-interactive auth fails, try password
  - misc: fix spelling mistakes
  - page-header: mention curl version and how to figure out current release
  - page-header: minor wording polish in the URL segment
  - scripts/singleuse.pl: add more API calls
  - urlapi: remove superfluous host name check</changelog>
  <changelog author="pmonreal@suse.com" date="1689768000">- Update to 8.2.0 [bsc#1213237, CVE-2023-32001]
  * Security fix:
  - CVE-2023-32001: fopen race condition
  * Changes:
  - curl: add --ca-native and --proxy-ca-native
  - curl: add --trace-ids
  - CURLOPT_MAIL_RCPT_ALLOWFAILS: replace CURLOPT_MAIL_RCPT_ALLLOWFAILS
  - haproxy: add --haproxy-clientip flag to set client IPs
  - lib: add CURLINFO_CONN_ID and CURLINFO_XFER_ID
  * Bugfixes:
  - cf-socket: don't bypass fclosesocket callback if cancelled before connect
  - cf-socket: skip getpeername()/getsockname for TFTP
  - curl: count uploaded data to stop at the originally given size
  - curl: return error when asked to use an unsupported HTTP version
  - http2: fix crash in handling stream weights
  - http2: send HEADER &amp; DATA together if possible
  - http3/ngtcp2: upload EAGAIN handling
  - http: rectify the outgoing Cookie: header field size check
  - hyper: fix EOF handling on input
  - imap: Provide method to disable SASL if it is advertised
  - libssh2: provide error message when setting host key type fails
  - libssh2: use custom memory functions
  - ngtcp2: assigning timeout, but value is overwritten before used
  - quiche: avoid NULL deref in debug logging
  - sectransp: fix EOF handling
  - system.h: remove __IBMC__/__IBMCPP__ guards and apply to all z/OS compiles
  - timeval: use CLOCK_MONOTONIC_RAW if available
  - tls13-ciphers.d: include Schannel
  - tool_easysrc.h: correct `easysrc_perform` for `CURL_DISABLE_LIBCURL_OPTION`
  - tool_operate: allow cookie lines up to 8200 bytes
  - tool_parsecfg: accept line lengths up to 10M
  - tool_writeout_json: fix encoding of control characters
  - transfer: clear credentials when redirecting to absolute URL
  - urlapi: have *set(PATH) prepend a slash if one is missing
  - urlapi: scheme must start with alpha
  - vtls: avoid memory leak if sha256 call fails
  - websocket-cb: example doing WebSocket download using callback
  - ws: make the curl_ws_meta() return pointer a const</changelog>
  <changelog author="pmonreal@suse.com" date="1690545600">- Update to 8.2.1:
  * Bugfixes:
  - cfilters: rename close/connect functions to avoid clashes
  - ciphers.d: put URL in first column
  - cmake: add 'libcurlu'/'libcurltool' for unit tests
  - cmake: update ngtcp2 detection
  - configure: check for nghttp2_session_get_stream_local_window_size
  - docs: mark two TLS options for TLS, not SSL
  - docs: provide more see also for cipher options
  - hostip: return IPv6 first for localhost resolves
  - http2: fix regression on upload EOF handling
  - http: VLH, very large header test and fixes
  - libcurl-errors.3: add CURLUE_OK
  - os400: correct EXPECTED_STRING_LASTZEROTERMINATED
  - quiche: fix lookup of transfer at multi
  - quiche: fix segfault and other things
  - rustls: update rustls-ffi 0.10.0
  - socks: print ipv6 address within brackets
  - src/mkhelp: strip off escape sequences
  - tool: fix tool_seek_cb build when SIZEOF_CURL_OFF_T &gt; SIZEOF_OFF_T
  - transfer: do not clear the credentials on redirect to absolute URL
  - unittest: remove unneeded *_LDADD
  - websocket: rename arguments/variables to match docs</changelog>
  <changelog author="pmonreal@suse.com" date="1694606400">- Update to 8.3.0: [bsc#1215026, CVE-2023-38039]
  * Changes:
  - curl: make %output{} in -w specify a file to write to
  - gskit: remove
  - lib: --disable-bindlocal builds curl without local binding support
  - nss: remove support for this TLS library
  - tool: add "variable" support
  - trace: make tracing available in non-debug builds
  - url: change default value for CURLOPT_MAXREDIRS to 30
  - urlapi: CURLU_PUNY2IDN - convert from punycode to IDN name
  * Bugfixes:
  - altsvc: accept and parse IPv6 addresses in response headers
  - asyn-ares: reduce timeout to 2000ms
  - aws-sigv4: canonicalize the query
  - aws-sigv4: fix having date header twice in some cases
  - aws-sigv4: handle no-value user header entries
  - c-hyper: adjust the hyper to curlcode conversion
  - c-hyper: fix memory leaks in `Curl_http`
  - cf-haproxy: make CURLOPT_HAPROXY_CLIENT_IP set the *source* IP
  - cf-socket: log successful interface bind
  - cmake: add GnuTLS option
  - cmake: add support for `CURL_DEFAULT_SSL_BACKEND`
  - cmake: detect `SSL_set0_wbio` in OpenSSL
  - configure: trust pkg-config when it's used for zlib
  - configure: use the pkg-config --libs-only-l flag for libssh2
  - connect: stop halving the remaining timeout when less than 600 ms left
  - crypto: ensure crypto initialization works
  - digest: Use hostname to generate spn instead of realm
  - ftp: fix temp write of ipv6 address
  - headers: accept leading whitespaces on first response header
  - http2: fix in h2 proxy tunnel: progress in ingress on sending
  - http3/ngtcp2: shorten handshake, trace cleanup
  - http3: quiche, handshake optimization, trace cleanup
  - http: close the connection after a late 417 is received
  - http: fix sending of large requests
  - http: return error when receiving too large header set
  - lib: fix null ptr derefs and uninitialized vars (h2/h3)
  - lib: move mimepost data from -&gt;req.p.http to -&gt;state
  - list-only.d: mention SFTP as supported protocol
  - ngtcp2: fix handling of large requests
  - openssl: auto-detect `SSL_R_TLSV13_ALERT_CERTIFICATE_REQUIRED`
  - openssl: clear error queue after SSL_shutdown
  - openssl: make aws-lc version support OCSP
  - openssl: Support async cert verify callback
  - openssl: switch to modern init for LibreSSL 2.7.0+
  - openssl: when CURLOPT_SSL_CTX_FUNCTION is registered, init x509 store before
  - quic: don't set SNI if hostname is an IP address
  - quiche: adjust quiche `QUIC_IDLE_TIMEOUT` to 60s
  - quiche: enable quiche to handle timeout events
  - resolve: use PF_INET6 family lookups when CURL_IPRESOLVE_V6 is set
  - schannel: verify hostname independent of verify cert
  - tool_filetime: make -z work with file dates before 1970
  - tool_operate: allow both SSL_CERT_FILE and SSL_CERT_DIR
  - tool_operate: make aws-sigv4 not require TLS to be used
  - transfer: also stop the sending on closed connection
  - urlapi: fix heap buffer overflow
  - urlapi: setting a blank URL ("") is not an ok URL</changelog>
  <changelog author="pmonreal@suse.com" date="1697025600">- Update to 8.4.0:
  * Security fixes:
  - SOCKS5 heap buffer overflow [bsc#1215888, CVE-2023-38545]
  - cookie injection with none file [bsc#1215889, CVE-2023-38546]
  * Changes:
  - curl: add support for the IPFS protocols via HTTP gateway
  - curl_multi_get_handles: get easy handles from a multi handle
  - mingw: delete support for legacy mingw.org toolchain
  * Bugfixes:
  - base64: also build for curl
  - cf-socket: simulate slow/blocked receives in debug
  - configure: check for the capath by default
  - connect: expire the timeout when trying next
  - connect: only start the happy eyeballs timer when needed
  - cookie: do not store the expire or max-age strings
  - cookie: remove unnecessary struct fields
  - cookie: set -&gt;running in cookie_init even if data is NULL
  - create-dirs.d: clarify it also uses --output-dirs
  - http2: refused stream handling for retry
  - http: h1/h2 proxy unification
  - http: use per-request counter to check too large headers
  - idn: if idn2_check_version returns NULL, return error
  - lib: enable hmac for digest as well
  - lib: let the max filesize option stop too big transfers too
  - lib: move handling of 'data-&gt;req.writer_stack' into Curl_client_write()
  - lib: provide and use Curl_hexencode
  - lib: use wrapper for curl_mime_data fseek callback
  - libssh2: fix error message on failed pubkey-from-file
  - libssh: cap SFTP packet size sent
  - MQTT: improve receive of ACKs
  - multi: do CURLM_CALL_MULTI_PERFORM at two more places
  - multi: round the timeout up to prevent early wakeups
  - openssl: improve ssl shutdown handling
  - openssl: use X509_ALGOR_get0 instead of reaching into X509_ALGOR
  - pytest: exclude test_03_goaway in CI runs due to timing dependency
  - quic: set ciphers/curves the same way regular TLS does
  - quiche: fix build error with --with-ca-fallback
  - socks: return error if hostname too long for remote resolve
  - tftpd: always use curl's own tftp.h
  - tool_getparam: accept variable expansion on file names too
  - upload-file.d: describe the file name slash/backslash handling
  - url: fall back to http/https proxy env-variable if ws/wss not set
  - url: fix netrc info message
  - wolfssh: do cleanup in Curl_ssh_cleanup
  - wolfssl: allow capath with CURLOPT_CAINFO_BLOB
  - wolfssl: if CURLOPT_CAINFO_BLOB is set, ignore the CA files
  - wolfssl: ignore errors in CA path
  * Rebase libcurl-ocloexec.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1701864000">- Update to 8.5.0:
  * Security fixes:
  - [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass
  - [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents
  * Changes:
  - gnutls: support CURLSSLOPT_NATIVE_CA
  - HTTP3: ngtcp2 builds are no longer experimental
  * Bugfixes:
  - asyn-thread: use pipe instead of socketpair for IPC when available
  - cmake: fix OpenSSL quic detection in quiche builds
  - conncache: use the closure handle when disconnecting surplus connections
  - content_encoding: make Curl_all_content_encodings allocless
  - cookie: lowercase the domain names before PSL checks
  - Curl_http_body: cleanup properly when Curl_getformdata errors
  - CURLMOPT_MAX_CONCURRENT_STREAMS: make sure the set value is within range
  - doh: provide better return code for responses w/o addresses
  - doh: use PIPEWAIT when HTTP/2 is attempted
  - duphandle: also free 'outcurl-&gt;cookies' in error path
  - duphandle: make dupset() not return with pointers to old alloced data
  - duphandle: use strdup to clone *COPYPOSTFIELDS if size is not set
  - easy: in duphandle, init the cookies for the new handle
  - easy_lock: add a pthread_mutex_t fallback
  - fopen: create new file using old file's mode
  - fopen: create short(er) temporary file name
  - getenv: PlayStation doesn't have getenv()
  - hostip: show the list of IPs when resolving is done
  - hsts: skip single-dot hostname
  - HTTP/2, HTTP/3: handle detach of onoing transfers
  - http: allow longer HTTP/2 request method names
  - hyper: temporarily remove HTTP/2 support
  - IPFS: fix IPFS_PATH and file parsing
  - multi: during ratelimit multi_getsock should return no sockets
  - multi: use pipe instead of socketpair to *wakeup()
  - ngtcp2: fix races in stream handling
  - ntlm_wb: use pipe instead of socketpair when possible
  - openssl: avoid BN_num_bits() NULL pointer derefs
  - openssl: fix building with v3 `no-deprecated` + add CI test
  - openssl: fix infof() to avoid compiler warning for %s with null
  - openssl: identify the "quictls" backend correctly
  - openssl: include SIG and KEM algorithms in verbose
  - openssl: two multi pointer checks should probably rather be asserts
  - openssl: when a session-ID is reused, skip OCSP stapling
  - quic: make eyeballers connect retries stop at weird replies
  - quic: manage connection idle timeouts
  - setopt: check CURLOPT_TFTP_BLKSIZE range on set
  - socks: better buffer size checks for socks4a user and hostname
  - socks: make SOCKS5 use the CURLOPT_IPRESOLVE choice
  - tool: fix --capath when proxy support is disabled
  - tool_getparam: limit --rate to be smaller than number of ms
  - transfer: abort pause send when connection is marked for closing
  - transfer: avoid calling the read callback again after EOF
  - transfer: only reset the FTP wildcard engine in CLEAR state
  - url: don't touch the multi handle when closing internal handles
  - urlapi: avoid null deref if setting blank host to url encode
  - urlapi: skip appending NULL pointer query
  - urlapi: when URL encoding the fragment, pass in the right length
  - vtls: cleanup SSL config management
  - vtls: consistently use typedef names for OpenSSL structs
  - vtls: late clone of connection ssl config
  - vtls: use ALPN "http/1.1" for HTTP/1.x, including HTTP/1.0
  * Rebase curl-secure-getenv.patch
  * Add curl-tests-errorcodes.patch</changelog>
  <changelog author="pujos.michael@gmail.com" date="1704456000">- Added curl-adjust-pollset-fix.patch to fix broken MPD http streaming:
  https://github.com/curl/curl/issues/12632</changelog>
  <changelog author="pmonreal@suse.com" date="1706702400">- Update to 8.6.0: [bsc#1219149, CVE-2024-0853]
  * Security fixes:
  - CVE-2024-0853: OCSP verification bypass with TLS session reuse
  * Changes:
  - add CURLE_TOO_LARGE, CURLINFO_QUEUE_TIME_T
  * Bugfixes:
  - altsvc: free 'as' when returning error
  - asyn-ares: with modern c-ares, use its default timeout
  - cf-socket: show errno in tcpkeepalive error messages
  - cmdline-opts: update availability for the *-ca-native options
  - configure: when enabling QUIC, check that TLS supports QUIC
  - content_encoding: change return code to typedef'ed enum
  - curl: show ipfs and ipns as supported "protocols"
  - CURLINFO_REFERER.3: clarify that it is the *request* header
  - dist: add tests/errorcodes.pl to the tarball
  - gen.pl: support ## for doing .IP in table-like lists
  - GHA: bump ngtcp2, gnutls, mod_h2, quiche
  - hostip: return error immediately when Curl_ip2addr() fails
  - http3/quiche: fix result code on a stream reset
  - http3: initial support for OpenSSL 3.2 QUIC stack
  - http: check for "Host:" case insensitively
  - http: fix off-by-one error in request method length check
  - http: only act on 101 responses when they are HTTP/1.1
  - lib: add debug log outputs for CURLE_BAD_FUNCTION_ARGUMENT
  - lib: error out on multissl + http3
  - lib: fix variable undeclared error caused by `infof` changes
  - lib: rename Curl_strndup to Curl_memdup0 to avoid misunderstanding
  - lib: strndup/memdup instead of malloc, memcpy and null-terminate
  - libssh2: use `libssh2_session_callback_set2()` with v1.11.1
  - ngtcp2: put h3 at the front of alpn
  - openldap: fix an LDAP crash
  - openldap: fix STARTTLS
  - openssl: re-match LibreSSL deinit with init
  - rtsp: deal with borked server responses
  - sasl: make login option string override http auth
  - tool: prepend output_dir in header callback
  - tool_getparam: stop supporting `@filename` style for --cookie
  - transfer: fix upload rate limiting, add test cases
  - url: don't set default CA paths for Secure Transport backend
  - url: for disabled protocols, mention if found in redirect
  - vquic: extract TLS setup into own source
  - websockets: check for negative payload lengths
  * Remove patches fixed upstream:
  - curl-adjust-pollset-fix.patch
  - curl-tests-errorcodes.patch
  * Rebase dont-mess-with-rpmoptflags.patch</changelog>
  <changelog author="fvogt@suse.com" date="1707393600">- Add patch to fix various TLS related issues including FTP over SSL
  transmission timeouts:
  * 0001-vtls-revert-receive-max-buffer-add-test-case.patch
- Switch to %autosetup</changelog>
  <changelog author="pmonreal@suse.com" date="1710244800">- Remove the nghttp2 version requirement as a version guard around
  the nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation
  function was added in curl 8.0.1.
  * Upstream commit: https://github.com/curl/curl/commit/744dcf22</changelog>
  <changelog author="pmonreal@suse.com" date="1711022400">- Security fix: [bsc#1221667, CVE-2024-2398]
  * curl: HTTP/2 push headers memory-leak
  * Add curl-CVE-2024-2398.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1711108800">- Security fix: [bsc#1221665, CVE-2024-2004]
  * Usage of disabled protocol
  * Add curl-CVE-2024-2004.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1711540800">- Security fix: [bsc#1221668, CVE-2024-2466]
  * curl: TLS certificate check bypass with mbedTLS
  * Add curl-CVE-2024-2466.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1711540801">- Security fix: [bsc#1221666, CVE-2024-2379]
  * curl: QUIC certificate check bypass with wolfSSL
  * Add curl-CVE-2024-2379.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1721131200">- Security fix: [bsc#1227888, CVE-2024-6197]
  * Freeing stack buffer in utf8asn1str
  * x509asn1: remove superfluous free()
  * Add curl-CVE-2024-6197.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1722427200">- Security fix: [bsc#1228535, CVE-2024-7264]
  * curl: ASN.1 date parser overread
  * Add curl-CVE-2024-7264.patch</changelog>
</package>
<package pkgid="0731735b0c90e89c9ecb51bf3369f02f9f537207ff129da61d3fd17d46daa89a" name="curl" arch="x86_64">
  <version epoch="0" ver="8.6.0" rel="150600.4.3.1"/>
  <changelog author="pmonreal@suse.com" date="1679313600">- Update to 8.0.0:
  * Security fixes:
  - TELNET option IAC injection [bsc#1209209, CVE-2023-27533]
  - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534]
  - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535]
  - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536]
  - HSTS double-free [bsc#1209213, CVE-2023-27537]
  - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538]
  * Changes:
  - build: remove support for curl_off_t &lt; 8 bytes
  * Bugfixes:
  - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3
  - BINDINGS: add Fortran binding
  - cf-socket: use port 80 when resolving name for local bind
  - cookie: don't load cookies again when flushing
  - curl_path: create the new path with dynbuf
  - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe
  - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure
  - ftp: active mode with SSL, add the filter
  - hostip: avoid sscanf and extra buffer copies
  - http2: fix for http2-prior-knowledge when reusing connections
  - http2: fix handling of RST and GOAWAY to recognize partial transfers
  - http: don't send 100-continue for short PUT requests
  - http: fix unix domain socket use in https connects
  - libssh: use dynbuf instead of realloc
  - ngtcp2-gnutls.yml: bump to gnutls 3.8.0
  - sectransp: make read_cert() use a dynbuf when loading
  - telnet: only accept option arguments in ascii
  - telnet: parse telnet options without sscanf
  - url: fix the SSH connection reuse check
  - url: only reuse connections with same GSS delegation
  - urlapi: '%' is illegal in host names
  - ws: keep the socket non-blocking
  * Rebase libcurl-ocloexec.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1679400000">- Update to 8.0.1:
  * Bugfixes:
  - fix crash in curl_easy_cleanup</changelog>
  <changelog author="david.anes@suse.com" date="1684324800">- Update to 8.1.0:
  * Security fixes:
  - UAF in SSH sha256 fingerprint [bsc#1211230, CVE-2023-28319]
  - siglongjmp race condition [bsc#1211231, CVE-2023-28320]
  - IDN wildcard match [bsc#1211232, CVE-2023-28321]
  - POST-after-PUT confusion [bsc#1211233, CVE-2023-28322]
  - See also: https://curl.se/docs/security.html
  * Changes:
  - curl: add --proxy-http2
  - CURLPROXY_HTTPS2: for HTTPS proxy that may speak HTTP/2
  - hostip: refuse to resolve the .onion TLD
  - tool_writeout: add URL component variables
  * Bugfixes:
  - See full changelog here: https://curl.se/changes.html#8_1_0</changelog>
  <changelog author="pmonreal@suse.com" date="1684843200">- Update to 8.1.1:
  * Bugfixes:
  - cf-socket: completely remove the disabled
    USE_RECV_BEFORE_SEND_WORKAROUND
  - checksrc: disallow spaces before labels
  - curl_easy_getinfo: clarify on return data types
  - docs: document that curl_url_cleanup(NULL) is a safe no-op
  - hostip: move easy_lock.h include above curl_memory.h
  - http2: double http request parser max line length
  - http2: increase stream window size to 10 MB
  - lib: rename struct 'http_req' to 'httpreq'
  - ngtcp2: proper handling of uint64_t when adjusting send buffer
  - sectransp.c: make the code c89 compatible
  - select: avoid returning an error on EINTR from select() or poll()
  - url: provide better error message when URLs fail to parse
  - urlapi: allow numerical parts in the host name</changelog>
  <changelog author="pmonreal@suse.com" date="1685448000">- Update to 8.1.2:
  * Bugfixes:
  - configure: quote the assignments for run-compiler
  - configure: without pkg-config and no custom path, use -lnghttp2
  - curl: cache the --trace-time value for a second
  - http2: fix EOF handling on uploads with auth negotiation
  - http3: send EOF indicator early as possible
  - lib1560: verify more scheme guessing
  - lib: remove unused functions, make single-use static
  - libcurl.m4: remove trailing 'dnl' that causes this to break autoconf
  - libssh: when keyboard-interactive auth fails, try password
  - misc: fix spelling mistakes
  - page-header: mention curl version and how to figure out current release
  - page-header: minor wording polish in the URL segment
  - scripts/singleuse.pl: add more API calls
  - urlapi: remove superfluous host name check</changelog>
  <changelog author="pmonreal@suse.com" date="1689768000">- Update to 8.2.0 [bsc#1213237, CVE-2023-32001]
  * Security fix:
  - CVE-2023-32001: fopen race condition
  * Changes:
  - curl: add --ca-native and --proxy-ca-native
  - curl: add --trace-ids
  - CURLOPT_MAIL_RCPT_ALLOWFAILS: replace CURLOPT_MAIL_RCPT_ALLLOWFAILS
  - haproxy: add --haproxy-clientip flag to set client IPs
  - lib: add CURLINFO_CONN_ID and CURLINFO_XFER_ID
  * Bugfixes:
  - cf-socket: don't bypass fclosesocket callback if cancelled before connect
  - cf-socket: skip getpeername()/getsockname for TFTP
  - curl: count uploaded data to stop at the originally given size
  - curl: return error when asked to use an unsupported HTTP version
  - http2: fix crash in handling stream weights
  - http2: send HEADER &amp; DATA together if possible
  - http3/ngtcp2: upload EAGAIN handling
  - http: rectify the outgoing Cookie: header field size check
  - hyper: fix EOF handling on input
  - imap: Provide method to disable SASL if it is advertised
  - libssh2: provide error message when setting host key type fails
  - libssh2: use custom memory functions
  - ngtcp2: assigning timeout, but value is overwritten before used
  - quiche: avoid NULL deref in debug logging
  - sectransp: fix EOF handling
  - system.h: remove __IBMC__/__IBMCPP__ guards and apply to all z/OS compiles
  - timeval: use CLOCK_MONOTONIC_RAW if available
  - tls13-ciphers.d: include Schannel
  - tool_easysrc.h: correct `easysrc_perform` for `CURL_DISABLE_LIBCURL_OPTION`
  - tool_operate: allow cookie lines up to 8200 bytes
  - tool_parsecfg: accept line lengths up to 10M
  - tool_writeout_json: fix encoding of control characters
  - transfer: clear credentials when redirecting to absolute URL
  - urlapi: have *set(PATH) prepend a slash if one is missing
  - urlapi: scheme must start with alpha
  - vtls: avoid memory leak if sha256 call fails
  - websocket-cb: example doing WebSocket download using callback
  - ws: make the curl_ws_meta() return pointer a const</changelog>
  <changelog author="pmonreal@suse.com" date="1690545600">- Update to 8.2.1:
  * Bugfixes:
  - cfilters: rename close/connect functions to avoid clashes
  - ciphers.d: put URL in first column
  - cmake: add 'libcurlu'/'libcurltool' for unit tests
  - cmake: update ngtcp2 detection
  - configure: check for nghttp2_session_get_stream_local_window_size
  - docs: mark two TLS options for TLS, not SSL
  - docs: provide more see also for cipher options
  - hostip: return IPv6 first for localhost resolves
  - http2: fix regression on upload EOF handling
  - http: VLH, very large header test and fixes
  - libcurl-errors.3: add CURLUE_OK
  - os400: correct EXPECTED_STRING_LASTZEROTERMINATED
  - quiche: fix lookup of transfer at multi
  - quiche: fix segfault and other things
  - rustls: update rustls-ffi 0.10.0
  - socks: print ipv6 address within brackets
  - src/mkhelp: strip off escape sequences
  - tool: fix tool_seek_cb build when SIZEOF_CURL_OFF_T &gt; SIZEOF_OFF_T
  - transfer: do not clear the credentials on redirect to absolute URL
  - unittest: remove unneeded *_LDADD
  - websocket: rename arguments/variables to match docs</changelog>
  <changelog author="pmonreal@suse.com" date="1694606400">- Update to 8.3.0: [bsc#1215026, CVE-2023-38039]
  * Changes:
  - curl: make %output{} in -w specify a file to write to
  - gskit: remove
  - lib: --disable-bindlocal builds curl without local binding support
  - nss: remove support for this TLS library
  - tool: add "variable" support
  - trace: make tracing available in non-debug builds
  - url: change default value for CURLOPT_MAXREDIRS to 30
  - urlapi: CURLU_PUNY2IDN - convert from punycode to IDN name
  * Bugfixes:
  - altsvc: accept and parse IPv6 addresses in response headers
  - asyn-ares: reduce timeout to 2000ms
  - aws-sigv4: canonicalize the query
  - aws-sigv4: fix having date header twice in some cases
  - aws-sigv4: handle no-value user header entries
  - c-hyper: adjust the hyper to curlcode conversion
  - c-hyper: fix memory leaks in `Curl_http`
  - cf-haproxy: make CURLOPT_HAPROXY_CLIENT_IP set the *source* IP
  - cf-socket: log successful interface bind
  - cmake: add GnuTLS option
  - cmake: add support for `CURL_DEFAULT_SSL_BACKEND`
  - cmake: detect `SSL_set0_wbio` in OpenSSL
  - configure: trust pkg-config when it's used for zlib
  - configure: use the pkg-config --libs-only-l flag for libssh2
  - connect: stop halving the remaining timeout when less than 600 ms left
  - crypto: ensure crypto initialization works
  - digest: Use hostname to generate spn instead of realm
  - ftp: fix temp write of ipv6 address
  - headers: accept leading whitespaces on first response header
  - http2: fix in h2 proxy tunnel: progress in ingress on sending
  - http3/ngtcp2: shorten handshake, trace cleanup
  - http3: quiche, handshake optimization, trace cleanup
  - http: close the connection after a late 417 is received
  - http: fix sending of large requests
  - http: return error when receiving too large header set
  - lib: fix null ptr derefs and uninitialized vars (h2/h3)
  - lib: move mimepost data from -&gt;req.p.http to -&gt;state
  - list-only.d: mention SFTP as supported protocol
  - ngtcp2: fix handling of large requests
  - openssl: auto-detect `SSL_R_TLSV13_ALERT_CERTIFICATE_REQUIRED`
  - openssl: clear error queue after SSL_shutdown
  - openssl: make aws-lc version support OCSP
  - openssl: Support async cert verify callback
  - openssl: switch to modern init for LibreSSL 2.7.0+
  - openssl: when CURLOPT_SSL_CTX_FUNCTION is registered, init x509 store before
  - quic: don't set SNI if hostname is an IP address
  - quiche: adjust quiche `QUIC_IDLE_TIMEOUT` to 60s
  - quiche: enable quiche to handle timeout events
  - resolve: use PF_INET6 family lookups when CURL_IPRESOLVE_V6 is set
  - schannel: verify hostname independent of verify cert
  - tool_filetime: make -z work with file dates before 1970
  - tool_operate: allow both SSL_CERT_FILE and SSL_CERT_DIR
  - tool_operate: make aws-sigv4 not require TLS to be used
  - transfer: also stop the sending on closed connection
  - urlapi: fix heap buffer overflow
  - urlapi: setting a blank URL ("") is not an ok URL</changelog>
  <changelog author="pmonreal@suse.com" date="1697025600">- Update to 8.4.0:
  * Security fixes:
  - SOCKS5 heap buffer overflow [bsc#1215888, CVE-2023-38545]
  - cookie injection with none file [bsc#1215889, CVE-2023-38546]
  * Changes:
  - curl: add support for the IPFS protocols via HTTP gateway
  - curl_multi_get_handles: get easy handles from a multi handle
  - mingw: delete support for legacy mingw.org toolchain
  * Bugfixes:
  - base64: also build for curl
  - cf-socket: simulate slow/blocked receives in debug
  - configure: check for the capath by default
  - connect: expire the timeout when trying next
  - connect: only start the happy eyeballs timer when needed
  - cookie: do not store the expire or max-age strings
  - cookie: remove unnecessary struct fields
  - cookie: set -&gt;running in cookie_init even if data is NULL
  - create-dirs.d: clarify it also uses --output-dirs
  - http2: refused stream handling for retry
  - http: h1/h2 proxy unification
  - http: use per-request counter to check too large headers
  - idn: if idn2_check_version returns NULL, return error
  - lib: enable hmac for digest as well
  - lib: let the max filesize option stop too big transfers too
  - lib: move handling of 'data-&gt;req.writer_stack' into Curl_client_write()
  - lib: provide and use Curl_hexencode
  - lib: use wrapper for curl_mime_data fseek callback
  - libssh2: fix error message on failed pubkey-from-file
  - libssh: cap SFTP packet size sent
  - MQTT: improve receive of ACKs
  - multi: do CURLM_CALL_MULTI_PERFORM at two more places
  - multi: round the timeout up to prevent early wakeups
  - openssl: improve ssl shutdown handling
  - openssl: use X509_ALGOR_get0 instead of reaching into X509_ALGOR
  - pytest: exclude test_03_goaway in CI runs due to timing dependency
  - quic: set ciphers/curves the same way regular TLS does
  - quiche: fix build error with --with-ca-fallback
  - socks: return error if hostname too long for remote resolve
  - tftpd: always use curl's own tftp.h
  - tool_getparam: accept variable expansion on file names too
  - upload-file.d: describe the file name slash/backslash handling
  - url: fall back to http/https proxy env-variable if ws/wss not set
  - url: fix netrc info message
  - wolfssh: do cleanup in Curl_ssh_cleanup
  - wolfssl: allow capath with CURLOPT_CAINFO_BLOB
  - wolfssl: if CURLOPT_CAINFO_BLOB is set, ignore the CA files
  - wolfssl: ignore errors in CA path
  * Rebase libcurl-ocloexec.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1701864000">- Update to 8.5.0:
  * Security fixes:
  - [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass
  - [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents
  * Changes:
  - gnutls: support CURLSSLOPT_NATIVE_CA
  - HTTP3: ngtcp2 builds are no longer experimental
  * Bugfixes:
  - asyn-thread: use pipe instead of socketpair for IPC when available
  - cmake: fix OpenSSL quic detection in quiche builds
  - conncache: use the closure handle when disconnecting surplus connections
  - content_encoding: make Curl_all_content_encodings allocless
  - cookie: lowercase the domain names before PSL checks
  - Curl_http_body: cleanup properly when Curl_getformdata errors
  - CURLMOPT_MAX_CONCURRENT_STREAMS: make sure the set value is within range
  - doh: provide better return code for responses w/o addresses
  - doh: use PIPEWAIT when HTTP/2 is attempted
  - duphandle: also free 'outcurl-&gt;cookies' in error path
  - duphandle: make dupset() not return with pointers to old alloced data
  - duphandle: use strdup to clone *COPYPOSTFIELDS if size is not set
  - easy: in duphandle, init the cookies for the new handle
  - easy_lock: add a pthread_mutex_t fallback
  - fopen: create new file using old file's mode
  - fopen: create short(er) temporary file name
  - getenv: PlayStation doesn't have getenv()
  - hostip: show the list of IPs when resolving is done
  - hsts: skip single-dot hostname
  - HTTP/2, HTTP/3: handle detach of onoing transfers
  - http: allow longer HTTP/2 request method names
  - hyper: temporarily remove HTTP/2 support
  - IPFS: fix IPFS_PATH and file parsing
  - multi: during ratelimit multi_getsock should return no sockets
  - multi: use pipe instead of socketpair to *wakeup()
  - ngtcp2: fix races in stream handling
  - ntlm_wb: use pipe instead of socketpair when possible
  - openssl: avoid BN_num_bits() NULL pointer derefs
  - openssl: fix building with v3 `no-deprecated` + add CI test
  - openssl: fix infof() to avoid compiler warning for %s with null
  - openssl: identify the "quictls" backend correctly
  - openssl: include SIG and KEM algorithms in verbose
  - openssl: two multi pointer checks should probably rather be asserts
  - openssl: when a session-ID is reused, skip OCSP stapling
  - quic: make eyeballers connect retries stop at weird replies
  - quic: manage connection idle timeouts
  - setopt: check CURLOPT_TFTP_BLKSIZE range on set
  - socks: better buffer size checks for socks4a user and hostname
  - socks: make SOCKS5 use the CURLOPT_IPRESOLVE choice
  - tool: fix --capath when proxy support is disabled
  - tool_getparam: limit --rate to be smaller than number of ms
  - transfer: abort pause send when connection is marked for closing
  - transfer: avoid calling the read callback again after EOF
  - transfer: only reset the FTP wildcard engine in CLEAR state
  - url: don't touch the multi handle when closing internal handles
  - urlapi: avoid null deref if setting blank host to url encode
  - urlapi: skip appending NULL pointer query
  - urlapi: when URL encoding the fragment, pass in the right length
  - vtls: cleanup SSL config management
  - vtls: consistently use typedef names for OpenSSL structs
  - vtls: late clone of connection ssl config
  - vtls: use ALPN "http/1.1" for HTTP/1.x, including HTTP/1.0
  * Rebase curl-secure-getenv.patch
  * Add curl-tests-errorcodes.patch</changelog>
  <changelog author="pujos.michael@gmail.com" date="1704456000">- Added curl-adjust-pollset-fix.patch to fix broken MPD http streaming:
  https://github.com/curl/curl/issues/12632</changelog>
  <changelog author="pmonreal@suse.com" date="1706702400">- Update to 8.6.0: [bsc#1219149, CVE-2024-0853]
  * Security fixes:
  - CVE-2024-0853: OCSP verification bypass with TLS session reuse
  * Changes:
  - add CURLE_TOO_LARGE, CURLINFO_QUEUE_TIME_T
  * Bugfixes:
  - altsvc: free 'as' when returning error
  - asyn-ares: with modern c-ares, use its default timeout
  - cf-socket: show errno in tcpkeepalive error messages
  - cmdline-opts: update availability for the *-ca-native options
  - configure: when enabling QUIC, check that TLS supports QUIC
  - content_encoding: change return code to typedef'ed enum
  - curl: show ipfs and ipns as supported "protocols"
  - CURLINFO_REFERER.3: clarify that it is the *request* header
  - dist: add tests/errorcodes.pl to the tarball
  - gen.pl: support ## for doing .IP in table-like lists
  - GHA: bump ngtcp2, gnutls, mod_h2, quiche
  - hostip: return error immediately when Curl_ip2addr() fails
  - http3/quiche: fix result code on a stream reset
  - http3: initial support for OpenSSL 3.2 QUIC stack
  - http: check for "Host:" case insensitively
  - http: fix off-by-one error in request method length check
  - http: only act on 101 responses when they are HTTP/1.1
  - lib: add debug log outputs for CURLE_BAD_FUNCTION_ARGUMENT
  - lib: error out on multissl + http3
  - lib: fix variable undeclared error caused by `infof` changes
  - lib: rename Curl_strndup to Curl_memdup0 to avoid misunderstanding
  - lib: strndup/memdup instead of malloc, memcpy and null-terminate
  - libssh2: use `libssh2_session_callback_set2()` with v1.11.1
  - ngtcp2: put h3 at the front of alpn
  - openldap: fix an LDAP crash
  - openldap: fix STARTTLS
  - openssl: re-match LibreSSL deinit with init
  - rtsp: deal with borked server responses
  - sasl: make login option string override http auth
  - tool: prepend output_dir in header callback
  - tool_getparam: stop supporting `@filename` style for --cookie
  - transfer: fix upload rate limiting, add test cases
  - url: don't set default CA paths for Secure Transport backend
  - url: for disabled protocols, mention if found in redirect
  - vquic: extract TLS setup into own source
  - websockets: check for negative payload lengths
  * Remove patches fixed upstream:
  - curl-adjust-pollset-fix.patch
  - curl-tests-errorcodes.patch
  * Rebase dont-mess-with-rpmoptflags.patch</changelog>
  <changelog author="fvogt@suse.com" date="1707393600">- Add patch to fix various TLS related issues including FTP over SSL
  transmission timeouts:
  * 0001-vtls-revert-receive-max-buffer-add-test-case.patch
- Switch to %autosetup</changelog>
  <changelog author="pmonreal@suse.com" date="1710244800">- Remove the nghttp2 version requirement as a version guard around
  the nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation
  function was added in curl 8.0.1.
  * Upstream commit: https://github.com/curl/curl/commit/744dcf22</changelog>
  <changelog author="pmonreal@suse.com" date="1711022400">- Security fix: [bsc#1221667, CVE-2024-2398]
  * curl: HTTP/2 push headers memory-leak
  * Add curl-CVE-2024-2398.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1711108800">- Security fix: [bsc#1221665, CVE-2024-2004]
  * Usage of disabled protocol
  * Add curl-CVE-2024-2004.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1711540800">- Security fix: [bsc#1221668, CVE-2024-2466]
  * curl: TLS certificate check bypass with mbedTLS
  * Add curl-CVE-2024-2466.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1711540801">- Security fix: [bsc#1221666, CVE-2024-2379]
  * curl: QUIC certificate check bypass with wolfSSL
  * Add curl-CVE-2024-2379.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1721131200">- Security fix: [bsc#1227888, CVE-2024-6197]
  * Freeing stack buffer in utf8asn1str
  * x509asn1: remove superfluous free()
  * Add curl-CVE-2024-6197.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1722427200">- Security fix: [bsc#1228535, CVE-2024-7264]
  * curl: ASN.1 date parser overread
  * Add curl-CVE-2024-7264.patch</changelog>
</package>
<package pkgid="2abb85252a5d41f29d1f6d460bb4c1aa8391b8908aea6859bf3309e9fb7facb5" name="curl" arch="aarch64">
  <version epoch="0" ver="8.6.0" rel="150600.4.6.1"/>
  <changelog author="pmonreal@suse.com" date="1679400000">- Update to 8.0.1:
  * Bugfixes:
  - fix crash in curl_easy_cleanup</changelog>
  <changelog author="david.anes@suse.com" date="1684324800">- Update to 8.1.0:
  * Security fixes:
  - UAF in SSH sha256 fingerprint [bsc#1211230, CVE-2023-28319]
  - siglongjmp race condition [bsc#1211231, CVE-2023-28320]
  - IDN wildcard match [bsc#1211232, CVE-2023-28321]
  - POST-after-PUT confusion [bsc#1211233, CVE-2023-28322]
  - See also: https://curl.se/docs/security.html
  * Changes:
  - curl: add --proxy-http2
  - CURLPROXY_HTTPS2: for HTTPS proxy that may speak HTTP/2
  - hostip: refuse to resolve the .onion TLD
  - tool_writeout: add URL component variables
  * Bugfixes:
  - See full changelog here: https://curl.se/changes.html#8_1_0</changelog>
  <changelog author="pmonreal@suse.com" date="1684843200">- Update to 8.1.1:
  * Bugfixes:
  - cf-socket: completely remove the disabled
    USE_RECV_BEFORE_SEND_WORKAROUND
  - checksrc: disallow spaces before labels
  - curl_easy_getinfo: clarify on return data types
  - docs: document that curl_url_cleanup(NULL) is a safe no-op
  - hostip: move easy_lock.h include above curl_memory.h
  - http2: double http request parser max line length
  - http2: increase stream window size to 10 MB
  - lib: rename struct 'http_req' to 'httpreq'
  - ngtcp2: proper handling of uint64_t when adjusting send buffer
  - sectransp.c: make the code c89 compatible
  - select: avoid returning an error on EINTR from select() or poll()
  - url: provide better error message when URLs fail to parse
  - urlapi: allow numerical parts in the host name</changelog>
  <changelog author="pmonreal@suse.com" date="1685448000">- Update to 8.1.2:
  * Bugfixes:
  - configure: quote the assignments for run-compiler
  - configure: without pkg-config and no custom path, use -lnghttp2
  - curl: cache the --trace-time value for a second
  - http2: fix EOF handling on uploads with auth negotiation
  - http3: send EOF indicator early as possible
  - lib1560: verify more scheme guessing
  - lib: remove unused functions, make single-use static
  - libcurl.m4: remove trailing 'dnl' that causes this to break autoconf
  - libssh: when keyboard-interactive auth fails, try password
  - misc: fix spelling mistakes
  - page-header: mention curl version and how to figure out current release
  - page-header: minor wording polish in the URL segment
  - scripts/singleuse.pl: add more API calls
  - urlapi: remove superfluous host name check</changelog>
  <changelog author="pmonreal@suse.com" date="1689768000">- Update to 8.2.0 [bsc#1213237, CVE-2023-32001]
  * Security fix:
  - CVE-2023-32001: fopen race condition
  * Changes:
  - curl: add --ca-native and --proxy-ca-native
  - curl: add --trace-ids
  - CURLOPT_MAIL_RCPT_ALLOWFAILS: replace CURLOPT_MAIL_RCPT_ALLLOWFAILS
  - haproxy: add --haproxy-clientip flag to set client IPs
  - lib: add CURLINFO_CONN_ID and CURLINFO_XFER_ID
  * Bugfixes:
  - cf-socket: don't bypass fclosesocket callback if cancelled before connect
  - cf-socket: skip getpeername()/getsockname for TFTP
  - curl: count uploaded data to stop at the originally given size
  - curl: return error when asked to use an unsupported HTTP version
  - http2: fix crash in handling stream weights
  - http2: send HEADER &amp; DATA together if possible
  - http3/ngtcp2: upload EAGAIN handling
  - http: rectify the outgoing Cookie: header field size check
  - hyper: fix EOF handling on input
  - imap: Provide method to disable SASL if it is advertised
  - libssh2: provide error message when setting host key type fails
  - libssh2: use custom memory functions
  - ngtcp2: assigning timeout, but value is overwritten before used
  - quiche: avoid NULL deref in debug logging
  - sectransp: fix EOF handling
  - system.h: remove __IBMC__/__IBMCPP__ guards and apply to all z/OS compiles
  - timeval: use CLOCK_MONOTONIC_RAW if available
  - tls13-ciphers.d: include Schannel
  - tool_easysrc.h: correct `easysrc_perform` for `CURL_DISABLE_LIBCURL_OPTION`
  - tool_operate: allow cookie lines up to 8200 bytes
  - tool_parsecfg: accept line lengths up to 10M
  - tool_writeout_json: fix encoding of control characters
  - transfer: clear credentials when redirecting to absolute URL
  - urlapi: have *set(PATH) prepend a slash if one is missing
  - urlapi: scheme must start with alpha
  - vtls: avoid memory leak if sha256 call fails
  - websocket-cb: example doing WebSocket download using callback
  - ws: make the curl_ws_meta() return pointer a const</changelog>
  <changelog author="pmonreal@suse.com" date="1690545600">- Update to 8.2.1:
  * Bugfixes:
  - cfilters: rename close/connect functions to avoid clashes
  - ciphers.d: put URL in first column
  - cmake: add 'libcurlu'/'libcurltool' for unit tests
  - cmake: update ngtcp2 detection
  - configure: check for nghttp2_session_get_stream_local_window_size
  - docs: mark two TLS options for TLS, not SSL
  - docs: provide more see also for cipher options
  - hostip: return IPv6 first for localhost resolves
  - http2: fix regression on upload EOF handling
  - http: VLH, very large header test and fixes
  - libcurl-errors.3: add CURLUE_OK
  - os400: correct EXPECTED_STRING_LASTZEROTERMINATED
  - quiche: fix lookup of transfer at multi
  - quiche: fix segfault and other things
  - rustls: update rustls-ffi 0.10.0
  - socks: print ipv6 address within brackets
  - src/mkhelp: strip off escape sequences
  - tool: fix tool_seek_cb build when SIZEOF_CURL_OFF_T &gt; SIZEOF_OFF_T
  - transfer: do not clear the credentials on redirect to absolute URL
  - unittest: remove unneeded *_LDADD
  - websocket: rename arguments/variables to match docs</changelog>
  <changelog author="pmonreal@suse.com" date="1694606400">- Update to 8.3.0: [bsc#1215026, CVE-2023-38039]
  * Changes:
  - curl: make %output{} in -w specify a file to write to
  - gskit: remove
  - lib: --disable-bindlocal builds curl without local binding support
  - nss: remove support for this TLS library
  - tool: add "variable" support
  - trace: make tracing available in non-debug builds
  - url: change default value for CURLOPT_MAXREDIRS to 30
  - urlapi: CURLU_PUNY2IDN - convert from punycode to IDN name
  * Bugfixes:
  - altsvc: accept and parse IPv6 addresses in response headers
  - asyn-ares: reduce timeout to 2000ms
  - aws-sigv4: canonicalize the query
  - aws-sigv4: fix having date header twice in some cases
  - aws-sigv4: handle no-value user header entries
  - c-hyper: adjust the hyper to curlcode conversion
  - c-hyper: fix memory leaks in `Curl_http`
  - cf-haproxy: make CURLOPT_HAPROXY_CLIENT_IP set the *source* IP
  - cf-socket: log successful interface bind
  - cmake: add GnuTLS option
  - cmake: add support for `CURL_DEFAULT_SSL_BACKEND`
  - cmake: detect `SSL_set0_wbio` in OpenSSL
  - configure: trust pkg-config when it's used for zlib
  - configure: use the pkg-config --libs-only-l flag for libssh2
  - connect: stop halving the remaining timeout when less than 600 ms left
  - crypto: ensure crypto initialization works
  - digest: Use hostname to generate spn instead of realm
  - ftp: fix temp write of ipv6 address
  - headers: accept leading whitespaces on first response header
  - http2: fix in h2 proxy tunnel: progress in ingress on sending
  - http3/ngtcp2: shorten handshake, trace cleanup
  - http3: quiche, handshake optimization, trace cleanup
  - http: close the connection after a late 417 is received
  - http: fix sending of large requests
  - http: return error when receiving too large header set
  - lib: fix null ptr derefs and uninitialized vars (h2/h3)
  - lib: move mimepost data from -&gt;req.p.http to -&gt;state
  - list-only.d: mention SFTP as supported protocol
  - ngtcp2: fix handling of large requests
  - openssl: auto-detect `SSL_R_TLSV13_ALERT_CERTIFICATE_REQUIRED`
  - openssl: clear error queue after SSL_shutdown
  - openssl: make aws-lc version support OCSP
  - openssl: Support async cert verify callback
  - openssl: switch to modern init for LibreSSL 2.7.0+
  - openssl: when CURLOPT_SSL_CTX_FUNCTION is registered, init x509 store before
  - quic: don't set SNI if hostname is an IP address
  - quiche: adjust quiche `QUIC_IDLE_TIMEOUT` to 60s
  - quiche: enable quiche to handle timeout events
  - resolve: use PF_INET6 family lookups when CURL_IPRESOLVE_V6 is set
  - schannel: verify hostname independent of verify cert
  - tool_filetime: make -z work with file dates before 1970
  - tool_operate: allow both SSL_CERT_FILE and SSL_CERT_DIR
  - tool_operate: make aws-sigv4 not require TLS to be used
  - transfer: also stop the sending on closed connection
  - urlapi: fix heap buffer overflow
  - urlapi: setting a blank URL ("") is not an ok URL</changelog>
  <changelog author="pmonreal@suse.com" date="1697025600">- Update to 8.4.0:
  * Security fixes:
  - SOCKS5 heap buffer overflow [bsc#1215888, CVE-2023-38545]
  - cookie injection with none file [bsc#1215889, CVE-2023-38546]
  * Changes:
  - curl: add support for the IPFS protocols via HTTP gateway
  - curl_multi_get_handles: get easy handles from a multi handle
  - mingw: delete support for legacy mingw.org toolchain
  * Bugfixes:
  - base64: also build for curl
  - cf-socket: simulate slow/blocked receives in debug
  - configure: check for the capath by default
  - connect: expire the timeout when trying next
  - connect: only start the happy eyeballs timer when needed
  - cookie: do not store the expire or max-age strings
  - cookie: remove unnecessary struct fields
  - cookie: set -&gt;running in cookie_init even if data is NULL
  - create-dirs.d: clarify it also uses --output-dirs
  - http2: refused stream handling for retry
  - http: h1/h2 proxy unification
  - http: use per-request counter to check too large headers
  - idn: if idn2_check_version returns NULL, return error
  - lib: enable hmac for digest as well
  - lib: let the max filesize option stop too big transfers too
  - lib: move handling of 'data-&gt;req.writer_stack' into Curl_client_write()
  - lib: provide and use Curl_hexencode
  - lib: use wrapper for curl_mime_data fseek callback
  - libssh2: fix error message on failed pubkey-from-file
  - libssh: cap SFTP packet size sent
  - MQTT: improve receive of ACKs
  - multi: do CURLM_CALL_MULTI_PERFORM at two more places
  - multi: round the timeout up to prevent early wakeups
  - openssl: improve ssl shutdown handling
  - openssl: use X509_ALGOR_get0 instead of reaching into X509_ALGOR
  - pytest: exclude test_03_goaway in CI runs due to timing dependency
  - quic: set ciphers/curves the same way regular TLS does
  - quiche: fix build error with --with-ca-fallback
  - socks: return error if hostname too long for remote resolve
  - tftpd: always use curl's own tftp.h
  - tool_getparam: accept variable expansion on file names too
  - upload-file.d: describe the file name slash/backslash handling
  - url: fall back to http/https proxy env-variable if ws/wss not set
  - url: fix netrc info message
  - wolfssh: do cleanup in Curl_ssh_cleanup
  - wolfssl: allow capath with CURLOPT_CAINFO_BLOB
  - wolfssl: if CURLOPT_CAINFO_BLOB is set, ignore the CA files
  - wolfssl: ignore errors in CA path
  * Rebase libcurl-ocloexec.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1701864000">- Update to 8.5.0:
  * Security fixes:
  - [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass
  - [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents
  * Changes:
  - gnutls: support CURLSSLOPT_NATIVE_CA
  - HTTP3: ngtcp2 builds are no longer experimental
  * Bugfixes:
  - asyn-thread: use pipe instead of socketpair for IPC when available
  - cmake: fix OpenSSL quic detection in quiche builds
  - conncache: use the closure handle when disconnecting surplus connections
  - content_encoding: make Curl_all_content_encodings allocless
  - cookie: lowercase the domain names before PSL checks
  - Curl_http_body: cleanup properly when Curl_getformdata errors
  - CURLMOPT_MAX_CONCURRENT_STREAMS: make sure the set value is within range
  - doh: provide better return code for responses w/o addresses
  - doh: use PIPEWAIT when HTTP/2 is attempted
  - duphandle: also free 'outcurl-&gt;cookies' in error path
  - duphandle: make dupset() not return with pointers to old alloced data
  - duphandle: use strdup to clone *COPYPOSTFIELDS if size is not set
  - easy: in duphandle, init the cookies for the new handle
  - easy_lock: add a pthread_mutex_t fallback
  - fopen: create new file using old file's mode
  - fopen: create short(er) temporary file name
  - getenv: PlayStation doesn't have getenv()
  - hostip: show the list of IPs when resolving is done
  - hsts: skip single-dot hostname
  - HTTP/2, HTTP/3: handle detach of onoing transfers
  - http: allow longer HTTP/2 request method names
  - hyper: temporarily remove HTTP/2 support
  - IPFS: fix IPFS_PATH and file parsing
  - multi: during ratelimit multi_getsock should return no sockets
  - multi: use pipe instead of socketpair to *wakeup()
  - ngtcp2: fix races in stream handling
  - ntlm_wb: use pipe instead of socketpair when possible
  - openssl: avoid BN_num_bits() NULL pointer derefs
  - openssl: fix building with v3 `no-deprecated` + add CI test
  - openssl: fix infof() to avoid compiler warning for %s with null
  - openssl: identify the "quictls" backend correctly
  - openssl: include SIG and KEM algorithms in verbose
  - openssl: two multi pointer checks should probably rather be asserts
  - openssl: when a session-ID is reused, skip OCSP stapling
  - quic: make eyeballers connect retries stop at weird replies
  - quic: manage connection idle timeouts
  - setopt: check CURLOPT_TFTP_BLKSIZE range on set
  - socks: better buffer size checks for socks4a user and hostname
  - socks: make SOCKS5 use the CURLOPT_IPRESOLVE choice
  - tool: fix --capath when proxy support is disabled
  - tool_getparam: limit --rate to be smaller than number of ms
  - transfer: abort pause send when connection is marked for closing
  - transfer: avoid calling the read callback again after EOF
  - transfer: only reset the FTP wildcard engine in CLEAR state
  - url: don't touch the multi handle when closing internal handles
  - urlapi: avoid null deref if setting blank host to url encode
  - urlapi: skip appending NULL pointer query
  - urlapi: when URL encoding the fragment, pass in the right length
  - vtls: cleanup SSL config management
  - vtls: consistently use typedef names for OpenSSL structs
  - vtls: late clone of connection ssl config
  - vtls: use ALPN "http/1.1" for HTTP/1.x, including HTTP/1.0
  * Rebase curl-secure-getenv.patch
  * Add curl-tests-errorcodes.patch</changelog>
  <changelog author="pujos.michael@gmail.com" date="1704456000">- Added curl-adjust-pollset-fix.patch to fix broken MPD http streaming:
  https://github.com/curl/curl/issues/12632</changelog>
  <changelog author="pmonreal@suse.com" date="1706702400">- Update to 8.6.0: [bsc#1219149, CVE-2024-0853]
  * Security fixes:
  - CVE-2024-0853: OCSP verification bypass with TLS session reuse
  * Changes:
  - add CURLE_TOO_LARGE, CURLINFO_QUEUE_TIME_T
  * Bugfixes:
  - altsvc: free 'as' when returning error
  - asyn-ares: with modern c-ares, use its default timeout
  - cf-socket: show errno in tcpkeepalive error messages
  - cmdline-opts: update availability for the *-ca-native options
  - configure: when enabling QUIC, check that TLS supports QUIC
  - content_encoding: change return code to typedef'ed enum
  - curl: show ipfs and ipns as supported "protocols"
  - CURLINFO_REFERER.3: clarify that it is the *request* header
  - dist: add tests/errorcodes.pl to the tarball
  - gen.pl: support ## for doing .IP in table-like lists
  - GHA: bump ngtcp2, gnutls, mod_h2, quiche
  - hostip: return error immediately when Curl_ip2addr() fails
  - http3/quiche: fix result code on a stream reset
  - http3: initial support for OpenSSL 3.2 QUIC stack
  - http: check for "Host:" case insensitively
  - http: fix off-by-one error in request method length check
  - http: only act on 101 responses when they are HTTP/1.1
  - lib: add debug log outputs for CURLE_BAD_FUNCTION_ARGUMENT
  - lib: error out on multissl + http3
  - lib: fix variable undeclared error caused by `infof` changes
  - lib: rename Curl_strndup to Curl_memdup0 to avoid misunderstanding
  - lib: strndup/memdup instead of malloc, memcpy and null-terminate
  - libssh2: use `libssh2_session_callback_set2()` with v1.11.1
  - ngtcp2: put h3 at the front of alpn
  - openldap: fix an LDAP crash
  - openldap: fix STARTTLS
  - openssl: re-match LibreSSL deinit with init
  - rtsp: deal with borked server responses
  - sasl: make login option string override http auth
  - tool: prepend output_dir in header callback
  - tool_getparam: stop supporting `@filename` style for --cookie
  - transfer: fix upload rate limiting, add test cases
  - url: don't set default CA paths for Secure Transport backend
  - url: for disabled protocols, mention if found in redirect
  - vquic: extract TLS setup into own source
  - websockets: check for negative payload lengths
  * Remove patches fixed upstream:
  - curl-adjust-pollset-fix.patch
  - curl-tests-errorcodes.patch
  * Rebase dont-mess-with-rpmoptflags.patch</changelog>
  <changelog author="fvogt@suse.com" date="1707393600">- Add patch to fix various TLS related issues including FTP over SSL
  transmission timeouts:
  * 0001-vtls-revert-receive-max-buffer-add-test-case.patch
- Switch to %autosetup</changelog>
  <changelog author="pmonreal@suse.com" date="1710244800">- Remove the nghttp2 version requirement as a version guard around
  the nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation
  function was added in curl 8.0.1.
  * Upstream commit: https://github.com/curl/curl/commit/744dcf22</changelog>
  <changelog author="pmonreal@suse.com" date="1711022400">- Security fix: [bsc#1221667, CVE-2024-2398]
  * curl: HTTP/2 push headers memory-leak
  * Add curl-CVE-2024-2398.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1711108800">- Security fix: [bsc#1221665, CVE-2024-2004]
  * Usage of disabled protocol
  * Add curl-CVE-2024-2004.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1711540800">- Security fix: [bsc#1221668, CVE-2024-2466]
  * curl: TLS certificate check bypass with mbedTLS
  * Add curl-CVE-2024-2466.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1711540801">- Security fix: [bsc#1221666, CVE-2024-2379]
  * curl: QUIC certificate check bypass with wolfSSL
  * Add curl-CVE-2024-2379.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1721131200">- Security fix: [bsc#1227888, CVE-2024-6197]
  * Freeing stack buffer in utf8asn1str
  * x509asn1: remove superfluous free()
  * Add curl-CVE-2024-6197.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1722427200">- Security fix: [bsc#1228535, CVE-2024-7264]
  * curl: ASN.1 date parser overread
  * Add curl-CVE-2024-7264.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1725451200">- Security fix: [bsc#1230093, CVE-2024-8096]
  * curl: OCSP stapling bypass with GnuTLS
  * Add curl-CVE-2024-8096.patch</changelog>
</package>
<package pkgid="c5083abd623fabcc8e6b8b18f7eb8ad7da7f8aa81f38db6a4f5c9e17dcab4633" name="curl" arch="ppc64le">
  <version epoch="0" ver="8.6.0" rel="150600.4.6.1"/>
  <changelog author="pmonreal@suse.com" date="1679400000">- Update to 8.0.1:
  * Bugfixes:
  - fix crash in curl_easy_cleanup</changelog>
  <changelog author="david.anes@suse.com" date="1684324800">- Update to 8.1.0:
  * Security fixes:
  - UAF in SSH sha256 fingerprint [bsc#1211230, CVE-2023-28319]
  - siglongjmp race condition [bsc#1211231, CVE-2023-28320]
  - IDN wildcard match [bsc#1211232, CVE-2023-28321]
  - POST-after-PUT confusion [bsc#1211233, CVE-2023-28322]
  - See also: https://curl.se/docs/security.html
  * Changes:
  - curl: add --proxy-http2
  - CURLPROXY_HTTPS2: for HTTPS proxy that may speak HTTP/2
  - hostip: refuse to resolve the .onion TLD
  - tool_writeout: add URL component variables
  * Bugfixes:
  - See full changelog here: https://curl.se/changes.html#8_1_0</changelog>
  <changelog author="pmonreal@suse.com" date="1684843200">- Update to 8.1.1:
  * Bugfixes:
  - cf-socket: completely remove the disabled
    USE_RECV_BEFORE_SEND_WORKAROUND
  - checksrc: disallow spaces before labels
  - curl_easy_getinfo: clarify on return data types
  - docs: document that curl_url_cleanup(NULL) is a safe no-op
  - hostip: move easy_lock.h include above curl_memory.h
  - http2: double http request parser max line length
  - http2: increase stream window size to 10 MB
  - lib: rename struct 'http_req' to 'httpreq'
  - ngtcp2: proper handling of uint64_t when adjusting send buffer
  - sectransp.c: make the code c89 compatible
  - select: avoid returning an error on EINTR from select() or poll()
  - url: provide better error message when URLs fail to parse
  - urlapi: allow numerical parts in the host name</changelog>
  <changelog author="pmonreal@suse.com" date="1685448000">- Update to 8.1.2:
  * Bugfixes:
  - configure: quote the assignments for run-compiler
  - configure: without pkg-config and no custom path, use -lnghttp2
  - curl: cache the --trace-time value for a second
  - http2: fix EOF handling on uploads with auth negotiation
  - http3: send EOF indicator early as possible
  - lib1560: verify more scheme guessing
  - lib: remove unused functions, make single-use static
  - libcurl.m4: remove trailing 'dnl' that causes this to break autoconf
  - libssh: when keyboard-interactive auth fails, try password
  - misc: fix spelling mistakes
  - page-header: mention curl version and how to figure out current release
  - page-header: minor wording polish in the URL segment
  - scripts/singleuse.pl: add more API calls
  - urlapi: remove superfluous host name check</changelog>
  <changelog author="pmonreal@suse.com" date="1689768000">- Update to 8.2.0 [bsc#1213237, CVE-2023-32001]
  * Security fix:
  - CVE-2023-32001: fopen race condition
  * Changes:
  - curl: add --ca-native and --proxy-ca-native
  - curl: add --trace-ids
  - CURLOPT_MAIL_RCPT_ALLOWFAILS: replace CURLOPT_MAIL_RCPT_ALLLOWFAILS
  - haproxy: add --haproxy-clientip flag to set client IPs
  - lib: add CURLINFO_CONN_ID and CURLINFO_XFER_ID
  * Bugfixes:
  - cf-socket: don't bypass fclosesocket callback if cancelled before connect
  - cf-socket: skip getpeername()/getsockname for TFTP
  - curl: count uploaded data to stop at the originally given size
  - curl: return error when asked to use an unsupported HTTP version
  - http2: fix crash in handling stream weights
  - http2: send HEADER &amp; DATA together if possible
  - http3/ngtcp2: upload EAGAIN handling
  - http: rectify the outgoing Cookie: header field size check
  - hyper: fix EOF handling on input
  - imap: Provide method to disable SASL if it is advertised
  - libssh2: provide error message when setting host key type fails
  - libssh2: use custom memory functions
  - ngtcp2: assigning timeout, but value is overwritten before used
  - quiche: avoid NULL deref in debug logging
  - sectransp: fix EOF handling
  - system.h: remove __IBMC__/__IBMCPP__ guards and apply to all z/OS compiles
  - timeval: use CLOCK_MONOTONIC_RAW if available
  - tls13-ciphers.d: include Schannel
  - tool_easysrc.h: correct `easysrc_perform` for `CURL_DISABLE_LIBCURL_OPTION`
  - tool_operate: allow cookie lines up to 8200 bytes
  - tool_parsecfg: accept line lengths up to 10M
  - tool_writeout_json: fix encoding of control characters
  - transfer: clear credentials when redirecting to absolute URL
  - urlapi: have *set(PATH) prepend a slash if one is missing
  - urlapi: scheme must start with alpha
  - vtls: avoid memory leak if sha256 call fails
  - websocket-cb: example doing WebSocket download using callback
  - ws: make the curl_ws_meta() return pointer a const</changelog>
  <changelog author="pmonreal@suse.com" date="1690545600">- Update to 8.2.1:
  * Bugfixes:
  - cfilters: rename close/connect functions to avoid clashes
  - ciphers.d: put URL in first column
  - cmake: add 'libcurlu'/'libcurltool' for unit tests
  - cmake: update ngtcp2 detection
  - configure: check for nghttp2_session_get_stream_local_window_size
  - docs: mark two TLS options for TLS, not SSL
  - docs: provide more see also for cipher options
  - hostip: return IPv6 first for localhost resolves
  - http2: fix regression on upload EOF handling
  - http: VLH, very large header test and fixes
  - libcurl-errors.3: add CURLUE_OK
  - os400: correct EXPECTED_STRING_LASTZEROTERMINATED
  - quiche: fix lookup of transfer at multi
  - quiche: fix segfault and other things
  - rustls: update rustls-ffi 0.10.0
  - socks: print ipv6 address within brackets
  - src/mkhelp: strip off escape sequences
  - tool: fix tool_seek_cb build when SIZEOF_CURL_OFF_T &gt; SIZEOF_OFF_T
  - transfer: do not clear the credentials on redirect to absolute URL
  - unittest: remove unneeded *_LDADD
  - websocket: rename arguments/variables to match docs</changelog>
  <changelog author="pmonreal@suse.com" date="1694606400">- Update to 8.3.0: [bsc#1215026, CVE-2023-38039]
  * Changes:
  - curl: make %output{} in -w specify a file to write to
  - gskit: remove
  - lib: --disable-bindlocal builds curl without local binding support
  - nss: remove support for this TLS library
  - tool: add "variable" support
  - trace: make tracing available in non-debug builds
  - url: change default value for CURLOPT_MAXREDIRS to 30
  - urlapi: CURLU_PUNY2IDN - convert from punycode to IDN name
  * Bugfixes:
  - altsvc: accept and parse IPv6 addresses in response headers
  - asyn-ares: reduce timeout to 2000ms
  - aws-sigv4: canonicalize the query
  - aws-sigv4: fix having date header twice in some cases
  - aws-sigv4: handle no-value user header entries
  - c-hyper: adjust the hyper to curlcode conversion
  - c-hyper: fix memory leaks in `Curl_http`
  - cf-haproxy: make CURLOPT_HAPROXY_CLIENT_IP set the *source* IP
  - cf-socket: log successful interface bind
  - cmake: add GnuTLS option
  - cmake: add support for `CURL_DEFAULT_SSL_BACKEND`
  - cmake: detect `SSL_set0_wbio` in OpenSSL
  - configure: trust pkg-config when it's used for zlib
  - configure: use the pkg-config --libs-only-l flag for libssh2
  - connect: stop halving the remaining timeout when less than 600 ms left
  - crypto: ensure crypto initialization works
  - digest: Use hostname to generate spn instead of realm
  - ftp: fix temp write of ipv6 address
  - headers: accept leading whitespaces on first response header
  - http2: fix in h2 proxy tunnel: progress in ingress on sending
  - http3/ngtcp2: shorten handshake, trace cleanup
  - http3: quiche, handshake optimization, trace cleanup
  - http: close the connection after a late 417 is received
  - http: fix sending of large requests
  - http: return error when receiving too large header set
  - lib: fix null ptr derefs and uninitialized vars (h2/h3)
  - lib: move mimepost data from -&gt;req.p.http to -&gt;state
  - list-only.d: mention SFTP as supported protocol
  - ngtcp2: fix handling of large requests
  - openssl: auto-detect `SSL_R_TLSV13_ALERT_CERTIFICATE_REQUIRED`
  - openssl: clear error queue after SSL_shutdown
  - openssl: make aws-lc version support OCSP
  - openssl: Support async cert verify callback
  - openssl: switch to modern init for LibreSSL 2.7.0+
  - openssl: when CURLOPT_SSL_CTX_FUNCTION is registered, init x509 store before
  - quic: don't set SNI if hostname is an IP address
  - quiche: adjust quiche `QUIC_IDLE_TIMEOUT` to 60s
  - quiche: enable quiche to handle timeout events
  - resolve: use PF_INET6 family lookups when CURL_IPRESOLVE_V6 is set
  - schannel: verify hostname independent of verify cert
  - tool_filetime: make -z work with file dates before 1970
  - tool_operate: allow both SSL_CERT_FILE and SSL_CERT_DIR
  - tool_operate: make aws-sigv4 not require TLS to be used
  - transfer: also stop the sending on closed connection
  - urlapi: fix heap buffer overflow
  - urlapi: setting a blank URL ("") is not an ok URL</changelog>
  <changelog author="pmonreal@suse.com" date="1697025600">- Update to 8.4.0:
  * Security fixes:
  - SOCKS5 heap buffer overflow [bsc#1215888, CVE-2023-38545]
  - cookie injection with none file [bsc#1215889, CVE-2023-38546]
  * Changes:
  - curl: add support for the IPFS protocols via HTTP gateway
  - curl_multi_get_handles: get easy handles from a multi handle
  - mingw: delete support for legacy mingw.org toolchain
  * Bugfixes:
  - base64: also build for curl
  - cf-socket: simulate slow/blocked receives in debug
  - configure: check for the capath by default
  - connect: expire the timeout when trying next
  - connect: only start the happy eyeballs timer when needed
  - cookie: do not store the expire or max-age strings
  - cookie: remove unnecessary struct fields
  - cookie: set -&gt;running in cookie_init even if data is NULL
  - create-dirs.d: clarify it also uses --output-dirs
  - http2: refused stream handling for retry
  - http: h1/h2 proxy unification
  - http: use per-request counter to check too large headers
  - idn: if idn2_check_version returns NULL, return error
  - lib: enable hmac for digest as well
  - lib: let the max filesize option stop too big transfers too
  - lib: move handling of 'data-&gt;req.writer_stack' into Curl_client_write()
  - lib: provide and use Curl_hexencode
  - lib: use wrapper for curl_mime_data fseek callback
  - libssh2: fix error message on failed pubkey-from-file
  - libssh: cap SFTP packet size sent
  - MQTT: improve receive of ACKs
  - multi: do CURLM_CALL_MULTI_PERFORM at two more places
  - multi: round the timeout up to prevent early wakeups
  - openssl: improve ssl shutdown handling
  - openssl: use X509_ALGOR_get0 instead of reaching into X509_ALGOR
  - pytest: exclude test_03_goaway in CI runs due to timing dependency
  - quic: set ciphers/curves the same way regular TLS does
  - quiche: fix build error with --with-ca-fallback
  - socks: return error if hostname too long for remote resolve
  - tftpd: always use curl's own tftp.h
  - tool_getparam: accept variable expansion on file names too
  - upload-file.d: describe the file name slash/backslash handling
  - url: fall back to http/https proxy env-variable if ws/wss not set
  - url: fix netrc info message
  - wolfssh: do cleanup in Curl_ssh_cleanup
  - wolfssl: allow capath with CURLOPT_CAINFO_BLOB
  - wolfssl: if CURLOPT_CAINFO_BLOB is set, ignore the CA files
  - wolfssl: ignore errors in CA path
  * Rebase libcurl-ocloexec.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1701864000">- Update to 8.5.0:
  * Security fixes:
  - [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass
  - [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents
  * Changes:
  - gnutls: support CURLSSLOPT_NATIVE_CA
  - HTTP3: ngtcp2 builds are no longer experimental
  * Bugfixes:
  - asyn-thread: use pipe instead of socketpair for IPC when available
  - cmake: fix OpenSSL quic detection in quiche builds
  - conncache: use the closure handle when disconnecting surplus connections
  - content_encoding: make Curl_all_content_encodings allocless
  - cookie: lowercase the domain names before PSL checks
  - Curl_http_body: cleanup properly when Curl_getformdata errors
  - CURLMOPT_MAX_CONCURRENT_STREAMS: make sure the set value is within range
  - doh: provide better return code for responses w/o addresses
  - doh: use PIPEWAIT when HTTP/2 is attempted
  - duphandle: also free 'outcurl-&gt;cookies' in error path
  - duphandle: make dupset() not return with pointers to old alloced data
  - duphandle: use strdup to clone *COPYPOSTFIELDS if size is not set
  - easy: in duphandle, init the cookies for the new handle
  - easy_lock: add a pthread_mutex_t fallback
  - fopen: create new file using old file's mode
  - fopen: create short(er) temporary file name
  - getenv: PlayStation doesn't have getenv()
  - hostip: show the list of IPs when resolving is done
  - hsts: skip single-dot hostname
  - HTTP/2, HTTP/3: handle detach of onoing transfers
  - http: allow longer HTTP/2 request method names
  - hyper: temporarily remove HTTP/2 support
  - IPFS: fix IPFS_PATH and file parsing
  - multi: during ratelimit multi_getsock should return no sockets
  - multi: use pipe instead of socketpair to *wakeup()
  - ngtcp2: fix races in stream handling
  - ntlm_wb: use pipe instead of socketpair when possible
  - openssl: avoid BN_num_bits() NULL pointer derefs
  - openssl: fix building with v3 `no-deprecated` + add CI test
  - openssl: fix infof() to avoid compiler warning for %s with null
  - openssl: identify the "quictls" backend correctly
  - openssl: include SIG and KEM algorithms in verbose
  - openssl: two multi pointer checks should probably rather be asserts
  - openssl: when a session-ID is reused, skip OCSP stapling
  - quic: make eyeballers connect retries stop at weird replies
  - quic: manage connection idle timeouts
  - setopt: check CURLOPT_TFTP_BLKSIZE range on set
  - socks: better buffer size checks for socks4a user and hostname
  - socks: make SOCKS5 use the CURLOPT_IPRESOLVE choice
  - tool: fix --capath when proxy support is disabled
  - tool_getparam: limit --rate to be smaller than number of ms
  - transfer: abort pause send when connection is marked for closing
  - transfer: avoid calling the read callback again after EOF
  - transfer: only reset the FTP wildcard engine in CLEAR state
  - url: don't touch the multi handle when closing internal handles
  - urlapi: avoid null deref if setting blank host to url encode
  - urlapi: skip appending NULL pointer query
  - urlapi: when URL encoding the fragment, pass in the right length
  - vtls: cleanup SSL config management
  - vtls: consistently use typedef names for OpenSSL structs
  - vtls: late clone of connection ssl config
  - vtls: use ALPN "http/1.1" for HTTP/1.x, including HTTP/1.0
  * Rebase curl-secure-getenv.patch
  * Add curl-tests-errorcodes.patch</changelog>
  <changelog author="pujos.michael@gmail.com" date="1704456000">- Added curl-adjust-pollset-fix.patch to fix broken MPD http streaming:
  https://github.com/curl/curl/issues/12632</changelog>
  <changelog author="pmonreal@suse.com" date="1706702400">- Update to 8.6.0: [bsc#1219149, CVE-2024-0853]
  * Security fixes:
  - CVE-2024-0853: OCSP verification bypass with TLS session reuse
  * Changes:
  - add CURLE_TOO_LARGE, CURLINFO_QUEUE_TIME_T
  * Bugfixes:
  - altsvc: free 'as' when returning error
  - asyn-ares: with modern c-ares, use its default timeout
  - cf-socket: show errno in tcpkeepalive error messages
  - cmdline-opts: update availability for the *-ca-native options
  - configure: when enabling QUIC, check that TLS supports QUIC
  - content_encoding: change return code to typedef'ed enum
  - curl: show ipfs and ipns as supported "protocols"
  - CURLINFO_REFERER.3: clarify that it is the *request* header
  - dist: add tests/errorcodes.pl to the tarball
  - gen.pl: support ## for doing .IP in table-like lists
  - GHA: bump ngtcp2, gnutls, mod_h2, quiche
  - hostip: return error immediately when Curl_ip2addr() fails
  - http3/quiche: fix result code on a stream reset
  - http3: initial support for OpenSSL 3.2 QUIC stack
  - http: check for "Host:" case insensitively
  - http: fix off-by-one error in request method length check
  - http: only act on 101 responses when they are HTTP/1.1
  - lib: add debug log outputs for CURLE_BAD_FUNCTION_ARGUMENT
  - lib: error out on multissl + http3
  - lib: fix variable undeclared error caused by `infof` changes
  - lib: rename Curl_strndup to Curl_memdup0 to avoid misunderstanding
  - lib: strndup/memdup instead of malloc, memcpy and null-terminate
  - libssh2: use `libssh2_session_callback_set2()` with v1.11.1
  - ngtcp2: put h3 at the front of alpn
  - openldap: fix an LDAP crash
  - openldap: fix STARTTLS
  - openssl: re-match LibreSSL deinit with init
  - rtsp: deal with borked server responses
  - sasl: make login option string override http auth
  - tool: prepend output_dir in header callback
  - tool_getparam: stop supporting `@filename` style for --cookie
  - transfer: fix upload rate limiting, add test cases
  - url: don't set default CA paths for Secure Transport backend
  - url: for disabled protocols, mention if found in redirect
  - vquic: extract TLS setup into own source
  - websockets: check for negative payload lengths
  * Remove patches fixed upstream:
  - curl-adjust-pollset-fix.patch
  - curl-tests-errorcodes.patch
  * Rebase dont-mess-with-rpmoptflags.patch</changelog>
  <changelog author="fvogt@suse.com" date="1707393600">- Add patch to fix various TLS related issues including FTP over SSL
  transmission timeouts:
  * 0001-vtls-revert-receive-max-buffer-add-test-case.patch
- Switch to %autosetup</changelog>
  <changelog author="pmonreal@suse.com" date="1710244800">- Remove the nghttp2 version requirement as a version guard around
  the nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation
  function was added in curl 8.0.1.
  * Upstream commit: https://github.com/curl/curl/commit/744dcf22</changelog>
  <changelog author="pmonreal@suse.com" date="1711022400">- Security fix: [bsc#1221667, CVE-2024-2398]
  * curl: HTTP/2 push headers memory-leak
  * Add curl-CVE-2024-2398.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1711108800">- Security fix: [bsc#1221665, CVE-2024-2004]
  * Usage of disabled protocol
  * Add curl-CVE-2024-2004.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1711540800">- Security fix: [bsc#1221668, CVE-2024-2466]
  * curl: TLS certificate check bypass with mbedTLS
  * Add curl-CVE-2024-2466.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1711540801">- Security fix: [bsc#1221666, CVE-2024-2379]
  * curl: QUIC certificate check bypass with wolfSSL
  * Add curl-CVE-2024-2379.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1721131200">- Security fix: [bsc#1227888, CVE-2024-6197]
  * Freeing stack buffer in utf8asn1str
  * x509asn1: remove superfluous free()
  * Add curl-CVE-2024-6197.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1722427200">- Security fix: [bsc#1228535, CVE-2024-7264]
  * curl: ASN.1 date parser overread
  * Add curl-CVE-2024-7264.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1725451200">- Security fix: [bsc#1230093, CVE-2024-8096]
  * curl: OCSP stapling bypass with GnuTLS
  * Add curl-CVE-2024-8096.patch</changelog>
</package>
<package pkgid="dc82db1f82cb7920639c97c6cdc822df3ba1dd3c917ba1f7e8977c7add402595" name="curl" arch="s390x">
  <version epoch="0" ver="8.6.0" rel="150600.4.6.1"/>
  <changelog author="pmonreal@suse.com" date="1679400000">- Update to 8.0.1:
  * Bugfixes:
  - fix crash in curl_easy_cleanup</changelog>
  <changelog author="david.anes@suse.com" date="1684324800">- Update to 8.1.0:
  * Security fixes:
  - UAF in SSH sha256 fingerprint [bsc#1211230, CVE-2023-28319]
  - siglongjmp race condition [bsc#1211231, CVE-2023-28320]
  - IDN wildcard match [bsc#1211232, CVE-2023-28321]
  - POST-after-PUT confusion [bsc#1211233, CVE-2023-28322]
  - See also: https://curl.se/docs/security.html
  * Changes:
  - curl: add --proxy-http2
  - CURLPROXY_HTTPS2: for HTTPS proxy that may speak HTTP/2
  - hostip: refuse to resolve the .onion TLD
  - tool_writeout: add URL component variables
  * Bugfixes:
  - See full changelog here: https://curl.se/changes.html#8_1_0</changelog>
  <changelog author="pmonreal@suse.com" date="1684843200">- Update to 8.1.1:
  * Bugfixes:
  - cf-socket: completely remove the disabled
    USE_RECV_BEFORE_SEND_WORKAROUND
  - checksrc: disallow spaces before labels
  - curl_easy_getinfo: clarify on return data types
  - docs: document that curl_url_cleanup(NULL) is a safe no-op
  - hostip: move easy_lock.h include above curl_memory.h
  - http2: double http request parser max line length
  - http2: increase stream window size to 10 MB
  - lib: rename struct 'http_req' to 'httpreq'
  - ngtcp2: proper handling of uint64_t when adjusting send buffer
  - sectransp.c: make the code c89 compatible
  - select: avoid returning an error on EINTR from select() or poll()
  - url: provide better error message when URLs fail to parse
  - urlapi: allow numerical parts in the host name</changelog>
  <changelog author="pmonreal@suse.com" date="1685448000">- Update to 8.1.2:
  * Bugfixes:
  - configure: quote the assignments for run-compiler
  - configure: without pkg-config and no custom path, use -lnghttp2
  - curl: cache the --trace-time value for a second
  - http2: fix EOF handling on uploads with auth negotiation
  - http3: send EOF indicator early as possible
  - lib1560: verify more scheme guessing
  - lib: remove unused functions, make single-use static
  - libcurl.m4: remove trailing 'dnl' that causes this to break autoconf
  - libssh: when keyboard-interactive auth fails, try password
  - misc: fix spelling mistakes
  - page-header: mention curl version and how to figure out current release
  - page-header: minor wording polish in the URL segment
  - scripts/singleuse.pl: add more API calls
  - urlapi: remove superfluous host name check</changelog>
  <changelog author="pmonreal@suse.com" date="1689768000">- Update to 8.2.0 [bsc#1213237, CVE-2023-32001]
  * Security fix:
  - CVE-2023-32001: fopen race condition
  * Changes:
  - curl: add --ca-native and --proxy-ca-native
  - curl: add --trace-ids
  - CURLOPT_MAIL_RCPT_ALLOWFAILS: replace CURLOPT_MAIL_RCPT_ALLLOWFAILS
  - haproxy: add --haproxy-clientip flag to set client IPs
  - lib: add CURLINFO_CONN_ID and CURLINFO_XFER_ID
  * Bugfixes:
  - cf-socket: don't bypass fclosesocket callback if cancelled before connect
  - cf-socket: skip getpeername()/getsockname for TFTP
  - curl: count uploaded data to stop at the originally given size
  - curl: return error when asked to use an unsupported HTTP version
  - http2: fix crash in handling stream weights
  - http2: send HEADER &amp; DATA together if possible
  - http3/ngtcp2: upload EAGAIN handling
  - http: rectify the outgoing Cookie: header field size check
  - hyper: fix EOF handling on input
  - imap: Provide method to disable SASL if it is advertised
  - libssh2: provide error message when setting host key type fails
  - libssh2: use custom memory functions
  - ngtcp2: assigning timeout, but value is overwritten before used
  - quiche: avoid NULL deref in debug logging
  - sectransp: fix EOF handling
  - system.h: remove __IBMC__/__IBMCPP__ guards and apply to all z/OS compiles
  - timeval: use CLOCK_MONOTONIC_RAW if available
  - tls13-ciphers.d: include Schannel
  - tool_easysrc.h: correct `easysrc_perform` for `CURL_DISABLE_LIBCURL_OPTION`
  - tool_operate: allow cookie lines up to 8200 bytes
  - tool_parsecfg: accept line lengths up to 10M
  - tool_writeout_json: fix encoding of control characters
  - transfer: clear credentials when redirecting to absolute URL
  - urlapi: have *set(PATH) prepend a slash if one is missing
  - urlapi: scheme must start with alpha
  - vtls: avoid memory leak if sha256 call fails
  - websocket-cb: example doing WebSocket download using callback
  - ws: make the curl_ws_meta() return pointer a const</changelog>
  <changelog author="pmonreal@suse.com" date="1690545600">- Update to 8.2.1:
  * Bugfixes:
  - cfilters: rename close/connect functions to avoid clashes
  - ciphers.d: put URL in first column
  - cmake: add 'libcurlu'/'libcurltool' for unit tests
  - cmake: update ngtcp2 detection
  - configure: check for nghttp2_session_get_stream_local_window_size
  - docs: mark two TLS options for TLS, not SSL
  - docs: provide more see also for cipher options
  - hostip: return IPv6 first for localhost resolves
  - http2: fix regression on upload EOF handling
  - http: VLH, very large header test and fixes
  - libcurl-errors.3: add CURLUE_OK
  - os400: correct EXPECTED_STRING_LASTZEROTERMINATED
  - quiche: fix lookup of transfer at multi
  - quiche: fix segfault and other things
  - rustls: update rustls-ffi 0.10.0
  - socks: print ipv6 address within brackets
  - src/mkhelp: strip off escape sequences
  - tool: fix tool_seek_cb build when SIZEOF_CURL_OFF_T &gt; SIZEOF_OFF_T
  - transfer: do not clear the credentials on redirect to absolute URL
  - unittest: remove unneeded *_LDADD
  - websocket: rename arguments/variables to match docs</changelog>
  <changelog author="pmonreal@suse.com" date="1694606400">- Update to 8.3.0: [bsc#1215026, CVE-2023-38039]
  * Changes:
  - curl: make %output{} in -w specify a file to write to
  - gskit: remove
  - lib: --disable-bindlocal builds curl without local binding support
  - nss: remove support for this TLS library
  - tool: add "variable" support
  - trace: make tracing available in non-debug builds
  - url: change default value for CURLOPT_MAXREDIRS to 30
  - urlapi: CURLU_PUNY2IDN - convert from punycode to IDN name
  * Bugfixes:
  - altsvc: accept and parse IPv6 addresses in response headers
  - asyn-ares: reduce timeout to 2000ms
  - aws-sigv4: canonicalize the query
  - aws-sigv4: fix having date header twice in some cases
  - aws-sigv4: handle no-value user header entries
  - c-hyper: adjust the hyper to curlcode conversion
  - c-hyper: fix memory leaks in `Curl_http`
  - cf-haproxy: make CURLOPT_HAPROXY_CLIENT_IP set the *source* IP
  - cf-socket: log successful interface bind
  - cmake: add GnuTLS option
  - cmake: add support for `CURL_DEFAULT_SSL_BACKEND`
  - cmake: detect `SSL_set0_wbio` in OpenSSL
  - configure: trust pkg-config when it's used for zlib
  - configure: use the pkg-config --libs-only-l flag for libssh2
  - connect: stop halving the remaining timeout when less than 600 ms left
  - crypto: ensure crypto initialization works
  - digest: Use hostname to generate spn instead of realm
  - ftp: fix temp write of ipv6 address
  - headers: accept leading whitespaces on first response header
  - http2: fix in h2 proxy tunnel: progress in ingress on sending
  - http3/ngtcp2: shorten handshake, trace cleanup
  - http3: quiche, handshake optimization, trace cleanup
  - http: close the connection after a late 417 is received
  - http: fix sending of large requests
  - http: return error when receiving too large header set
  - lib: fix null ptr derefs and uninitialized vars (h2/h3)
  - lib: move mimepost data from -&gt;req.p.http to -&gt;state
  - list-only.d: mention SFTP as supported protocol
  - ngtcp2: fix handling of large requests
  - openssl: auto-detect `SSL_R_TLSV13_ALERT_CERTIFICATE_REQUIRED`
  - openssl: clear error queue after SSL_shutdown
  - openssl: make aws-lc version support OCSP
  - openssl: Support async cert verify callback
  - openssl: switch to modern init for LibreSSL 2.7.0+
  - openssl: when CURLOPT_SSL_CTX_FUNCTION is registered, init x509 store before
  - quic: don't set SNI if hostname is an IP address
  - quiche: adjust quiche `QUIC_IDLE_TIMEOUT` to 60s
  - quiche: enable quiche to handle timeout events
  - resolve: use PF_INET6 family lookups when CURL_IPRESOLVE_V6 is set
  - schannel: verify hostname independent of verify cert
  - tool_filetime: make -z work with file dates before 1970
  - tool_operate: allow both SSL_CERT_FILE and SSL_CERT_DIR
  - tool_operate: make aws-sigv4 not require TLS to be used
  - transfer: also stop the sending on closed connection
  - urlapi: fix heap buffer overflow
  - urlapi: setting a blank URL ("") is not an ok URL</changelog>
  <changelog author="pmonreal@suse.com" date="1697025600">- Update to 8.4.0:
  * Security fixes:
  - SOCKS5 heap buffer overflow [bsc#1215888, CVE-2023-38545]
  - cookie injection with none file [bsc#1215889, CVE-2023-38546]
  * Changes:
  - curl: add support for the IPFS protocols via HTTP gateway
  - curl_multi_get_handles: get easy handles from a multi handle
  - mingw: delete support for legacy mingw.org toolchain
  * Bugfixes:
  - base64: also build for curl
  - cf-socket: simulate slow/blocked receives in debug
  - configure: check for the capath by default
  - connect: expire the timeout when trying next
  - connect: only start the happy eyeballs timer when needed
  - cookie: do not store the expire or max-age strings
  - cookie: remove unnecessary struct fields
  - cookie: set -&gt;running in cookie_init even if data is NULL
  - create-dirs.d: clarify it also uses --output-dirs
  - http2: refused stream handling for retry
  - http: h1/h2 proxy unification
  - http: use per-request counter to check too large headers
  - idn: if idn2_check_version returns NULL, return error
  - lib: enable hmac for digest as well
  - lib: let the max filesize option stop too big transfers too
  - lib: move handling of 'data-&gt;req.writer_stack' into Curl_client_write()
  - lib: provide and use Curl_hexencode
  - lib: use wrapper for curl_mime_data fseek callback
  - libssh2: fix error message on failed pubkey-from-file
  - libssh: cap SFTP packet size sent
  - MQTT: improve receive of ACKs
  - multi: do CURLM_CALL_MULTI_PERFORM at two more places
  - multi: round the timeout up to prevent early wakeups
  - openssl: improve ssl shutdown handling
  - openssl: use X509_ALGOR_get0 instead of reaching into X509_ALGOR
  - pytest: exclude test_03_goaway in CI runs due to timing dependency
  - quic: set ciphers/curves the same way regular TLS does
  - quiche: fix build error with --with-ca-fallback
  - socks: return error if hostname too long for remote resolve
  - tftpd: always use curl's own tftp.h
  - tool_getparam: accept variable expansion on file names too
  - upload-file.d: describe the file name slash/backslash handling
  - url: fall back to http/https proxy env-variable if ws/wss not set
  - url: fix netrc info message
  - wolfssh: do cleanup in Curl_ssh_cleanup
  - wolfssl: allow capath with CURLOPT_CAINFO_BLOB
  - wolfssl: if CURLOPT_CAINFO_BLOB is set, ignore the CA files
  - wolfssl: ignore errors in CA path
  * Rebase libcurl-ocloexec.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1701864000">- Update to 8.5.0:
  * Security fixes:
  - [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass
  - [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents
  * Changes:
  - gnutls: support CURLSSLOPT_NATIVE_CA
  - HTTP3: ngtcp2 builds are no longer experimental
  * Bugfixes:
  - asyn-thread: use pipe instead of socketpair for IPC when available
  - cmake: fix OpenSSL quic detection in quiche builds
  - conncache: use the closure handle when disconnecting surplus connections
  - content_encoding: make Curl_all_content_encodings allocless
  - cookie: lowercase the domain names before PSL checks
  - Curl_http_body: cleanup properly when Curl_getformdata errors
  - CURLMOPT_MAX_CONCURRENT_STREAMS: make sure the set value is within range
  - doh: provide better return code for responses w/o addresses
  - doh: use PIPEWAIT when HTTP/2 is attempted
  - duphandle: also free 'outcurl-&gt;cookies' in error path
  - duphandle: make dupset() not return with pointers to old alloced data
  - duphandle: use strdup to clone *COPYPOSTFIELDS if size is not set
  - easy: in duphandle, init the cookies for the new handle
  - easy_lock: add a pthread_mutex_t fallback
  - fopen: create new file using old file's mode
  - fopen: create short(er) temporary file name
  - getenv: PlayStation doesn't have getenv()
  - hostip: show the list of IPs when resolving is done
  - hsts: skip single-dot hostname
  - HTTP/2, HTTP/3: handle detach of onoing transfers
  - http: allow longer HTTP/2 request method names
  - hyper: temporarily remove HTTP/2 support
  - IPFS: fix IPFS_PATH and file parsing
  - multi: during ratelimit multi_getsock should return no sockets
  - multi: use pipe instead of socketpair to *wakeup()
  - ngtcp2: fix races in stream handling
  - ntlm_wb: use pipe instead of socketpair when possible
  - openssl: avoid BN_num_bits() NULL pointer derefs
  - openssl: fix building with v3 `no-deprecated` + add CI test
  - openssl: fix infof() to avoid compiler warning for %s with null
  - openssl: identify the "quictls" backend correctly
  - openssl: include SIG and KEM algorithms in verbose
  - openssl: two multi pointer checks should probably rather be asserts
  - openssl: when a session-ID is reused, skip OCSP stapling
  - quic: make eyeballers connect retries stop at weird replies
  - quic: manage connection idle timeouts
  - setopt: check CURLOPT_TFTP_BLKSIZE range on set
  - socks: better buffer size checks for socks4a user and hostname
  - socks: make SOCKS5 use the CURLOPT_IPRESOLVE choice
  - tool: fix --capath when proxy support is disabled
  - tool_getparam: limit --rate to be smaller than number of ms
  - transfer: abort pause send when connection is marked for closing
  - transfer: avoid calling the read callback again after EOF
  - transfer: only reset the FTP wildcard engine in CLEAR state
  - url: don't touch the multi handle when closing internal handles
  - urlapi: avoid null deref if setting blank host to url encode
  - urlapi: skip appending NULL pointer query
  - urlapi: when URL encoding the fragment, pass in the right length
  - vtls: cleanup SSL config management
  - vtls: consistently use typedef names for OpenSSL structs
  - vtls: late clone of connection ssl config
  - vtls: use ALPN "http/1.1" for HTTP/1.x, including HTTP/1.0
  * Rebase curl-secure-getenv.patch
  * Add curl-tests-errorcodes.patch</changelog>
  <changelog author="pujos.michael@gmail.com" date="1704456000">- Added curl-adjust-pollset-fix.patch to fix broken MPD http streaming:
  https://github.com/curl/curl/issues/12632</changelog>
  <changelog author="pmonreal@suse.com" date="1706702400">- Update to 8.6.0: [bsc#1219149, CVE-2024-0853]
  * Security fixes:
  - CVE-2024-0853: OCSP verification bypass with TLS session reuse
  * Changes:
  - add CURLE_TOO_LARGE, CURLINFO_QUEUE_TIME_T
  * Bugfixes:
  - altsvc: free 'as' when returning error
  - asyn-ares: with modern c-ares, use its default timeout
  - cf-socket: show errno in tcpkeepalive error messages
  - cmdline-opts: update availability for the *-ca-native options
  - configure: when enabling QUIC, check that TLS supports QUIC
  - content_encoding: change return code to typedef'ed enum
  - curl: show ipfs and ipns as supported "protocols"
  - CURLINFO_REFERER.3: clarify that it is the *request* header
  - dist: add tests/errorcodes.pl to the tarball
  - gen.pl: support ## for doing .IP in table-like lists
  - GHA: bump ngtcp2, gnutls, mod_h2, quiche
  - hostip: return error immediately when Curl_ip2addr() fails
  - http3/quiche: fix result code on a stream reset
  - http3: initial support for OpenSSL 3.2 QUIC stack
  - http: check for "Host:" case insensitively
  - http: fix off-by-one error in request method length check
  - http: only act on 101 responses when they are HTTP/1.1
  - lib: add debug log outputs for CURLE_BAD_FUNCTION_ARGUMENT
  - lib: error out on multissl + http3
  - lib: fix variable undeclared error caused by `infof` changes
  - lib: rename Curl_strndup to Curl_memdup0 to avoid misunderstanding
  - lib: strndup/memdup instead of malloc, memcpy and null-terminate
  - libssh2: use `libssh2_session_callback_set2()` with v1.11.1
  - ngtcp2: put h3 at the front of alpn
  - openldap: fix an LDAP crash
  - openldap: fix STARTTLS
  - openssl: re-match LibreSSL deinit with init
  - rtsp: deal with borked server responses
  - sasl: make login option string override http auth
  - tool: prepend output_dir in header callback
  - tool_getparam: stop supporting `@filename` style for --cookie
  - transfer: fix upload rate limiting, add test cases
  - url: don't set default CA paths for Secure Transport backend
  - url: for disabled protocols, mention if found in redirect
  - vquic: extract TLS setup into own source
  - websockets: check for negative payload lengths
  * Remove patches fixed upstream:
  - curl-adjust-pollset-fix.patch
  - curl-tests-errorcodes.patch
  * Rebase dont-mess-with-rpmoptflags.patch</changelog>
  <changelog author="fvogt@suse.com" date="1707393600">- Add patch to fix various TLS related issues including FTP over SSL
  transmission timeouts:
  * 0001-vtls-revert-receive-max-buffer-add-test-case.patch
- Switch to %autosetup</changelog>
  <changelog author="pmonreal@suse.com" date="1710244800">- Remove the nghttp2 version requirement as a version guard around
  the nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation
  function was added in curl 8.0.1.
  * Upstream commit: https://github.com/curl/curl/commit/744dcf22</changelog>
  <changelog author="pmonreal@suse.com" date="1711022400">- Security fix: [bsc#1221667, CVE-2024-2398]
  * curl: HTTP/2 push headers memory-leak
  * Add curl-CVE-2024-2398.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1711108800">- Security fix: [bsc#1221665, CVE-2024-2004]
  * Usage of disabled protocol
  * Add curl-CVE-2024-2004.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1711540800">- Security fix: [bsc#1221668, CVE-2024-2466]
  * curl: TLS certificate check bypass with mbedTLS
  * Add curl-CVE-2024-2466.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1711540801">- Security fix: [bsc#1221666, CVE-2024-2379]
  * curl: QUIC certificate check bypass with wolfSSL
  * Add curl-CVE-2024-2379.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1721131200">- Security fix: [bsc#1227888, CVE-2024-6197]
  * Freeing stack buffer in utf8asn1str
  * x509asn1: remove superfluous free()
  * Add curl-CVE-2024-6197.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1722427200">- Security fix: [bsc#1228535, CVE-2024-7264]
  * curl: ASN.1 date parser overread
  * Add curl-CVE-2024-7264.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1725451200">- Security fix: [bsc#1230093, CVE-2024-8096]
  * curl: OCSP stapling bypass with GnuTLS
  * Add curl-CVE-2024-8096.patch</changelog>
</package>
<package pkgid="3aef38e57b6d9d32f74d35abaec42667c7dddd230ea45b2c9a70bfd642291fd7" name="curl" arch="src">
  <version epoch="0" ver="8.6.0" rel="150600.4.6.1"/>
  <changelog author="pmonreal@suse.com" date="1679400000">- Update to 8.0.1:
  * Bugfixes:
  - fix crash in curl_easy_cleanup</changelog>
  <changelog author="david.anes@suse.com" date="1684324800">- Update to 8.1.0:
  * Security fixes:
  - UAF in SSH sha256 fingerprint [bsc#1211230, CVE-2023-28319]
  - siglongjmp race condition [bsc#1211231, CVE-2023-28320]
  - IDN wildcard match [bsc#1211232, CVE-2023-28321]
  - POST-after-PUT confusion [bsc#1211233, CVE-2023-28322]
  - See also: https://curl.se/docs/security.html
  * Changes:
  - curl: add --proxy-http2
  - CURLPROXY_HTTPS2: for HTTPS proxy that may speak HTTP/2
  - hostip: refuse to resolve the .onion TLD
  - tool_writeout: add URL component variables
  * Bugfixes:
  - See full changelog here: https://curl.se/changes.html#8_1_0</changelog>
  <changelog author="pmonreal@suse.com" date="1684843200">- Update to 8.1.1:
  * Bugfixes:
  - cf-socket: completely remove the disabled
    USE_RECV_BEFORE_SEND_WORKAROUND
  - checksrc: disallow spaces before labels
  - curl_easy_getinfo: clarify on return data types
  - docs: document that curl_url_cleanup(NULL) is a safe no-op
  - hostip: move easy_lock.h include above curl_memory.h
  - http2: double http request parser max line length
  - http2: increase stream window size to 10 MB
  - lib: rename struct 'http_req' to 'httpreq'
  - ngtcp2: proper handling of uint64_t when adjusting send buffer
  - sectransp.c: make the code c89 compatible
  - select: avoid returning an error on EINTR from select() or poll()
  - url: provide better error message when URLs fail to parse
  - urlapi: allow numerical parts in the host name</changelog>
  <changelog author="pmonreal@suse.com" date="1685448000">- Update to 8.1.2:
  * Bugfixes:
  - configure: quote the assignments for run-compiler
  - configure: without pkg-config and no custom path, use -lnghttp2
  - curl: cache the --trace-time value for a second
  - http2: fix EOF handling on uploads with auth negotiation
  - http3: send EOF indicator early as possible
  - lib1560: verify more scheme guessing
  - lib: remove unused functions, make single-use static
  - libcurl.m4: remove trailing 'dnl' that causes this to break autoconf
  - libssh: when keyboard-interactive auth fails, try password
  - misc: fix spelling mistakes
  - page-header: mention curl version and how to figure out current release
  - page-header: minor wording polish in the URL segment
  - scripts/singleuse.pl: add more API calls
  - urlapi: remove superfluous host name check</changelog>
  <changelog author="pmonreal@suse.com" date="1689768000">- Update to 8.2.0 [bsc#1213237, CVE-2023-32001]
  * Security fix:
  - CVE-2023-32001: fopen race condition
  * Changes:
  - curl: add --ca-native and --proxy-ca-native
  - curl: add --trace-ids
  - CURLOPT_MAIL_RCPT_ALLOWFAILS: replace CURLOPT_MAIL_RCPT_ALLLOWFAILS
  - haproxy: add --haproxy-clientip flag to set client IPs
  - lib: add CURLINFO_CONN_ID and CURLINFO_XFER_ID
  * Bugfixes:
  - cf-socket: don't bypass fclosesocket callback if cancelled before connect
  - cf-socket: skip getpeername()/getsockname for TFTP
  - curl: count uploaded data to stop at the originally given size
  - curl: return error when asked to use an unsupported HTTP version
  - http2: fix crash in handling stream weights
  - http2: send HEADER &amp; DATA together if possible
  - http3/ngtcp2: upload EAGAIN handling
  - http: rectify the outgoing Cookie: header field size check
  - hyper: fix EOF handling on input
  - imap: Provide method to disable SASL if it is advertised
  - libssh2: provide error message when setting host key type fails
  - libssh2: use custom memory functions
  - ngtcp2: assigning timeout, but value is overwritten before used
  - quiche: avoid NULL deref in debug logging
  - sectransp: fix EOF handling
  - system.h: remove __IBMC__/__IBMCPP__ guards and apply to all z/OS compiles
  - timeval: use CLOCK_MONOTONIC_RAW if available
  - tls13-ciphers.d: include Schannel
  - tool_easysrc.h: correct `easysrc_perform` for `CURL_DISABLE_LIBCURL_OPTION`
  - tool_operate: allow cookie lines up to 8200 bytes
  - tool_parsecfg: accept line lengths up to 10M
  - tool_writeout_json: fix encoding of control characters
  - transfer: clear credentials when redirecting to absolute URL
  - urlapi: have *set(PATH) prepend a slash if one is missing
  - urlapi: scheme must start with alpha
  - vtls: avoid memory leak if sha256 call fails
  - websocket-cb: example doing WebSocket download using callback
  - ws: make the curl_ws_meta() return pointer a const</changelog>
  <changelog author="pmonreal@suse.com" date="1690545600">- Update to 8.2.1:
  * Bugfixes:
  - cfilters: rename close/connect functions to avoid clashes
  - ciphers.d: put URL in first column
  - cmake: add 'libcurlu'/'libcurltool' for unit tests
  - cmake: update ngtcp2 detection
  - configure: check for nghttp2_session_get_stream_local_window_size
  - docs: mark two TLS options for TLS, not SSL
  - docs: provide more see also for cipher options
  - hostip: return IPv6 first for localhost resolves
  - http2: fix regression on upload EOF handling
  - http: VLH, very large header test and fixes
  - libcurl-errors.3: add CURLUE_OK
  - os400: correct EXPECTED_STRING_LASTZEROTERMINATED
  - quiche: fix lookup of transfer at multi
  - quiche: fix segfault and other things
  - rustls: update rustls-ffi 0.10.0
  - socks: print ipv6 address within brackets
  - src/mkhelp: strip off escape sequences
  - tool: fix tool_seek_cb build when SIZEOF_CURL_OFF_T &gt; SIZEOF_OFF_T
  - transfer: do not clear the credentials on redirect to absolute URL
  - unittest: remove unneeded *_LDADD
  - websocket: rename arguments/variables to match docs</changelog>
  <changelog author="pmonreal@suse.com" date="1694606400">- Update to 8.3.0: [bsc#1215026, CVE-2023-38039]
  * Changes:
  - curl: make %output{} in -w specify a file to write to
  - gskit: remove
  - lib: --disable-bindlocal builds curl without local binding support
  - nss: remove support for this TLS library
  - tool: add "variable" support
  - trace: make tracing available in non-debug builds
  - url: change default value for CURLOPT_MAXREDIRS to 30
  - urlapi: CURLU_PUNY2IDN - convert from punycode to IDN name
  * Bugfixes:
  - altsvc: accept and parse IPv6 addresses in response headers
  - asyn-ares: reduce timeout to 2000ms
  - aws-sigv4: canonicalize the query
  - aws-sigv4: fix having date header twice in some cases
  - aws-sigv4: handle no-value user header entries
  - c-hyper: adjust the hyper to curlcode conversion
  - c-hyper: fix memory leaks in `Curl_http`
  - cf-haproxy: make CURLOPT_HAPROXY_CLIENT_IP set the *source* IP
  - cf-socket: log successful interface bind
  - cmake: add GnuTLS option
  - cmake: add support for `CURL_DEFAULT_SSL_BACKEND`
  - cmake: detect `SSL_set0_wbio` in OpenSSL
  - configure: trust pkg-config when it's used for zlib
  - configure: use the pkg-config --libs-only-l flag for libssh2
  - connect: stop halving the remaining timeout when less than 600 ms left
  - crypto: ensure crypto initialization works
  - digest: Use hostname to generate spn instead of realm
  - ftp: fix temp write of ipv6 address
  - headers: accept leading whitespaces on first response header
  - http2: fix in h2 proxy tunnel: progress in ingress on sending
  - http3/ngtcp2: shorten handshake, trace cleanup
  - http3: quiche, handshake optimization, trace cleanup
  - http: close the connection after a late 417 is received
  - http: fix sending of large requests
  - http: return error when receiving too large header set
  - lib: fix null ptr derefs and uninitialized vars (h2/h3)
  - lib: move mimepost data from -&gt;req.p.http to -&gt;state
  - list-only.d: mention SFTP as supported protocol
  - ngtcp2: fix handling of large requests
  - openssl: auto-detect `SSL_R_TLSV13_ALERT_CERTIFICATE_REQUIRED`
  - openssl: clear error queue after SSL_shutdown
  - openssl: make aws-lc version support OCSP
  - openssl: Support async cert verify callback
  - openssl: switch to modern init for LibreSSL 2.7.0+
  - openssl: when CURLOPT_SSL_CTX_FUNCTION is registered, init x509 store before
  - quic: don't set SNI if hostname is an IP address
  - quiche: adjust quiche `QUIC_IDLE_TIMEOUT` to 60s
  - quiche: enable quiche to handle timeout events
  - resolve: use PF_INET6 family lookups when CURL_IPRESOLVE_V6 is set
  - schannel: verify hostname independent of verify cert
  - tool_filetime: make -z work with file dates before 1970
  - tool_operate: allow both SSL_CERT_FILE and SSL_CERT_DIR
  - tool_operate: make aws-sigv4 not require TLS to be used
  - transfer: also stop the sending on closed connection
  - urlapi: fix heap buffer overflow
  - urlapi: setting a blank URL ("") is not an ok URL</changelog>
  <changelog author="pmonreal@suse.com" date="1697025600">- Update to 8.4.0:
  * Security fixes:
  - SOCKS5 heap buffer overflow [bsc#1215888, CVE-2023-38545]
  - cookie injection with none file [bsc#1215889, CVE-2023-38546]
  * Changes:
  - curl: add support for the IPFS protocols via HTTP gateway
  - curl_multi_get_handles: get easy handles from a multi handle
  - mingw: delete support for legacy mingw.org toolchain
  * Bugfixes:
  - base64: also build for curl
  - cf-socket: simulate slow/blocked receives in debug
  - configure: check for the capath by default
  - connect: expire the timeout when trying next
  - connect: only start the happy eyeballs timer when needed
  - cookie: do not store the expire or max-age strings
  - cookie: remove unnecessary struct fields
  - cookie: set -&gt;running in cookie_init even if data is NULL
  - create-dirs.d: clarify it also uses --output-dirs
  - http2: refused stream handling for retry
  - http: h1/h2 proxy unification
  - http: use per-request counter to check too large headers
  - idn: if idn2_check_version returns NULL, return error
  - lib: enable hmac for digest as well
  - lib: let the max filesize option stop too big transfers too
  - lib: move handling of 'data-&gt;req.writer_stack' into Curl_client_write()
  - lib: provide and use Curl_hexencode
  - lib: use wrapper for curl_mime_data fseek callback
  - libssh2: fix error message on failed pubkey-from-file
  - libssh: cap SFTP packet size sent
  - MQTT: improve receive of ACKs
  - multi: do CURLM_CALL_MULTI_PERFORM at two more places
  - multi: round the timeout up to prevent early wakeups
  - openssl: improve ssl shutdown handling
  - openssl: use X509_ALGOR_get0 instead of reaching into X509_ALGOR
  - pytest: exclude test_03_goaway in CI runs due to timing dependency
  - quic: set ciphers/curves the same way regular TLS does
  - quiche: fix build error with --with-ca-fallback
  - socks: return error if hostname too long for remote resolve
  - tftpd: always use curl's own tftp.h
  - tool_getparam: accept variable expansion on file names too
  - upload-file.d: describe the file name slash/backslash handling
  - url: fall back to http/https proxy env-variable if ws/wss not set
  - url: fix netrc info message
  - wolfssh: do cleanup in Curl_ssh_cleanup
  - wolfssl: allow capath with CURLOPT_CAINFO_BLOB
  - wolfssl: if CURLOPT_CAINFO_BLOB is set, ignore the CA files
  - wolfssl: ignore errors in CA path
  * Rebase libcurl-ocloexec.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1701864000">- Update to 8.5.0:
  * Security fixes:
  - [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass
  - [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents
  * Changes:
  - gnutls: support CURLSSLOPT_NATIVE_CA
  - HTTP3: ngtcp2 builds are no longer experimental
  * Bugfixes:
  - asyn-thread: use pipe instead of socketpair for IPC when available
  - cmake: fix OpenSSL quic detection in quiche builds
  - conncache: use the closure handle when disconnecting surplus connections
  - content_encoding: make Curl_all_content_encodings allocless
  - cookie: lowercase the domain names before PSL checks
  - Curl_http_body: cleanup properly when Curl_getformdata errors
  - CURLMOPT_MAX_CONCURRENT_STREAMS: make sure the set value is within range
  - doh: provide better return code for responses w/o addresses
  - doh: use PIPEWAIT when HTTP/2 is attempted
  - duphandle: also free 'outcurl-&gt;cookies' in error path
  - duphandle: make dupset() not return with pointers to old alloced data
  - duphandle: use strdup to clone *COPYPOSTFIELDS if size is not set
  - easy: in duphandle, init the cookies for the new handle
  - easy_lock: add a pthread_mutex_t fallback
  - fopen: create new file using old file's mode
  - fopen: create short(er) temporary file name
  - getenv: PlayStation doesn't have getenv()
  - hostip: show the list of IPs when resolving is done
  - hsts: skip single-dot hostname
  - HTTP/2, HTTP/3: handle detach of onoing transfers
  - http: allow longer HTTP/2 request method names
  - hyper: temporarily remove HTTP/2 support
  - IPFS: fix IPFS_PATH and file parsing
  - multi: during ratelimit multi_getsock should return no sockets
  - multi: use pipe instead of socketpair to *wakeup()
  - ngtcp2: fix races in stream handling
  - ntlm_wb: use pipe instead of socketpair when possible
  - openssl: avoid BN_num_bits() NULL pointer derefs
  - openssl: fix building with v3 `no-deprecated` + add CI test
  - openssl: fix infof() to avoid compiler warning for %s with null
  - openssl: identify the "quictls" backend correctly
  - openssl: include SIG and KEM algorithms in verbose
  - openssl: two multi pointer checks should probably rather be asserts
  - openssl: when a session-ID is reused, skip OCSP stapling
  - quic: make eyeballers connect retries stop at weird replies
  - quic: manage connection idle timeouts
  - setopt: check CURLOPT_TFTP_BLKSIZE range on set
  - socks: better buffer size checks for socks4a user and hostname
  - socks: make SOCKS5 use the CURLOPT_IPRESOLVE choice
  - tool: fix --capath when proxy support is disabled
  - tool_getparam: limit --rate to be smaller than number of ms
  - transfer: abort pause send when connection is marked for closing
  - transfer: avoid calling the read callback again after EOF
  - transfer: only reset the FTP wildcard engine in CLEAR state
  - url: don't touch the multi handle when closing internal handles
  - urlapi: avoid null deref if setting blank host to url encode
  - urlapi: skip appending NULL pointer query
  - urlapi: when URL encoding the fragment, pass in the right length
  - vtls: cleanup SSL config management
  - vtls: consistently use typedef names for OpenSSL structs
  - vtls: late clone of connection ssl config
  - vtls: use ALPN "http/1.1" for HTTP/1.x, including HTTP/1.0
  * Rebase curl-secure-getenv.patch
  * Add curl-tests-errorcodes.patch</changelog>
  <changelog author="pujos.michael@gmail.com" date="1704456000">- Added curl-adjust-pollset-fix.patch to fix broken MPD http streaming:
  https://github.com/curl/curl/issues/12632</changelog>
  <changelog author="pmonreal@suse.com" date="1706702400">- Update to 8.6.0: [bsc#1219149, CVE-2024-0853]
  * Security fixes:
  - CVE-2024-0853: OCSP verification bypass with TLS session reuse
  * Changes:
  - add CURLE_TOO_LARGE, CURLINFO_QUEUE_TIME_T
  * Bugfixes:
  - altsvc: free 'as' when returning error
  - asyn-ares: with modern c-ares, use its default timeout
  - cf-socket: show errno in tcpkeepalive error messages
  - cmdline-opts: update availability for the *-ca-native options
  - configure: when enabling QUIC, check that TLS supports QUIC
  - content_encoding: change return code to typedef'ed enum
  - curl: show ipfs and ipns as supported "protocols"
  - CURLINFO_REFERER.3: clarify that it is the *request* header
  - dist: add tests/errorcodes.pl to the tarball
  - gen.pl: support ## for doing .IP in table-like lists
  - GHA: bump ngtcp2, gnutls, mod_h2, quiche
  - hostip: return error immediately when Curl_ip2addr() fails
  - http3/quiche: fix result code on a stream reset
  - http3: initial support for OpenSSL 3.2 QUIC stack
  - http: check for "Host:" case insensitively
  - http: fix off-by-one error in request method length check
  - http: only act on 101 responses when they are HTTP/1.1
  - lib: add debug log outputs for CURLE_BAD_FUNCTION_ARGUMENT
  - lib: error out on multissl + http3
  - lib: fix variable undeclared error caused by `infof` changes
  - lib: rename Curl_strndup to Curl_memdup0 to avoid misunderstanding
  - lib: strndup/memdup instead of malloc, memcpy and null-terminate
  - libssh2: use `libssh2_session_callback_set2()` with v1.11.1
  - ngtcp2: put h3 at the front of alpn
  - openldap: fix an LDAP crash
  - openldap: fix STARTTLS
  - openssl: re-match LibreSSL deinit with init
  - rtsp: deal with borked server responses
  - sasl: make login option string override http auth
  - tool: prepend output_dir in header callback
  - tool_getparam: stop supporting `@filename` style for --cookie
  - transfer: fix upload rate limiting, add test cases
  - url: don't set default CA paths for Secure Transport backend
  - url: for disabled protocols, mention if found in redirect
  - vquic: extract TLS setup into own source
  - websockets: check for negative payload lengths
  * Remove patches fixed upstream:
  - curl-adjust-pollset-fix.patch
  - curl-tests-errorcodes.patch
  * Rebase dont-mess-with-rpmoptflags.patch</changelog>
  <changelog author="fvogt@suse.com" date="1707393600">- Add patch to fix various TLS related issues including FTP over SSL
  transmission timeouts:
  * 0001-vtls-revert-receive-max-buffer-add-test-case.patch
- Switch to %autosetup</changelog>
  <changelog author="pmonreal@suse.com" date="1710244800">- Remove the nghttp2 version requirement as a version guard around
  the nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation
  function was added in curl 8.0.1.
  * Upstream commit: https://github.com/curl/curl/commit/744dcf22</changelog>
  <changelog author="pmonreal@suse.com" date="1711022400">- Security fix: [bsc#1221667, CVE-2024-2398]
  * curl: HTTP/2 push headers memory-leak
  * Add curl-CVE-2024-2398.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1711108800">- Security fix: [bsc#1221665, CVE-2024-2004]
  * Usage of disabled protocol
  * Add curl-CVE-2024-2004.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1711540800">- Security fix: [bsc#1221668, CVE-2024-2466]
  * curl: TLS certificate check bypass with mbedTLS
  * Add curl-CVE-2024-2466.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1711540801">- Security fix: [bsc#1221666, CVE-2024-2379]
  * curl: QUIC certificate check bypass with wolfSSL
  * Add curl-CVE-2024-2379.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1721131200">- Security fix: [bsc#1227888, CVE-2024-6197]
  * Freeing stack buffer in utf8asn1str
  * x509asn1: remove superfluous free()
  * Add curl-CVE-2024-6197.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1722427200">- Security fix: [bsc#1228535, CVE-2024-7264]
  * curl: ASN.1 date parser overread
  * Add curl-CVE-2024-7264.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1725451200">- Security fix: [bsc#1230093, CVE-2024-8096]
  * curl: OCSP stapling bypass with GnuTLS
  * Add curl-CVE-2024-8096.patch</changelog>
</package>
<package pkgid="097f2408886d0dadd311e713c8c7740fe6b4152458cfde6d3e03386ebcbd6fa1" name="curl" arch="x86_64">
  <version epoch="0" ver="8.6.0" rel="150600.4.6.1"/>
  <changelog author="pmonreal@suse.com" date="1679400000">- Update to 8.0.1:
  * Bugfixes:
  - fix crash in curl_easy_cleanup</changelog>
  <changelog author="david.anes@suse.com" date="1684324800">- Update to 8.1.0:
  * Security fixes:
  - UAF in SSH sha256 fingerprint [bsc#1211230, CVE-2023-28319]
  - siglongjmp race condition [bsc#1211231, CVE-2023-28320]
  - IDN wildcard match [bsc#1211232, CVE-2023-28321]
  - POST-after-PUT confusion [bsc#1211233, CVE-2023-28322]
  - See also: https://curl.se/docs/security.html
  * Changes:
  - curl: add --proxy-http2
  - CURLPROXY_HTTPS2: for HTTPS proxy that may speak HTTP/2
  - hostip: refuse to resolve the .onion TLD
  - tool_writeout: add URL component variables
  * Bugfixes:
  - See full changelog here: https://curl.se/changes.html#8_1_0</changelog>
  <changelog author="pmonreal@suse.com" date="1684843200">- Update to 8.1.1:
  * Bugfixes:
  - cf-socket: completely remove the disabled
    USE_RECV_BEFORE_SEND_WORKAROUND
  - checksrc: disallow spaces before labels
  - curl_easy_getinfo: clarify on return data types
  - docs: document that curl_url_cleanup(NULL) is a safe no-op
  - hostip: move easy_lock.h include above curl_memory.h
  - http2: double http request parser max line length
  - http2: increase stream window size to 10 MB
  - lib: rename struct 'http_req' to 'httpreq'
  - ngtcp2: proper handling of uint64_t when adjusting send buffer
  - sectransp.c: make the code c89 compatible
  - select: avoid returning an error on EINTR from select() or poll()
  - url: provide better error message when URLs fail to parse
  - urlapi: allow numerical parts in the host name</changelog>
  <changelog author="pmonreal@suse.com" date="1685448000">- Update to 8.1.2:
  * Bugfixes:
  - configure: quote the assignments for run-compiler
  - configure: without pkg-config and no custom path, use -lnghttp2
  - curl: cache the --trace-time value for a second
  - http2: fix EOF handling on uploads with auth negotiation
  - http3: send EOF indicator early as possible
  - lib1560: verify more scheme guessing
  - lib: remove unused functions, make single-use static
  - libcurl.m4: remove trailing 'dnl' that causes this to break autoconf
  - libssh: when keyboard-interactive auth fails, try password
  - misc: fix spelling mistakes
  - page-header: mention curl version and how to figure out current release
  - page-header: minor wording polish in the URL segment
  - scripts/singleuse.pl: add more API calls
  - urlapi: remove superfluous host name check</changelog>
  <changelog author="pmonreal@suse.com" date="1689768000">- Update to 8.2.0 [bsc#1213237, CVE-2023-32001]
  * Security fix:
  - CVE-2023-32001: fopen race condition
  * Changes:
  - curl: add --ca-native and --proxy-ca-native
  - curl: add --trace-ids
  - CURLOPT_MAIL_RCPT_ALLOWFAILS: replace CURLOPT_MAIL_RCPT_ALLLOWFAILS
  - haproxy: add --haproxy-clientip flag to set client IPs
  - lib: add CURLINFO_CONN_ID and CURLINFO_XFER_ID
  * Bugfixes:
  - cf-socket: don't bypass fclosesocket callback if cancelled before connect
  - cf-socket: skip getpeername()/getsockname for TFTP
  - curl: count uploaded data to stop at the originally given size
  - curl: return error when asked to use an unsupported HTTP version
  - http2: fix crash in handling stream weights
  - http2: send HEADER &amp; DATA together if possible
  - http3/ngtcp2: upload EAGAIN handling
  - http: rectify the outgoing Cookie: header field size check
  - hyper: fix EOF handling on input
  - imap: Provide method to disable SASL if it is advertised
  - libssh2: provide error message when setting host key type fails
  - libssh2: use custom memory functions
  - ngtcp2: assigning timeout, but value is overwritten before used
  - quiche: avoid NULL deref in debug logging
  - sectransp: fix EOF handling
  - system.h: remove __IBMC__/__IBMCPP__ guards and apply to all z/OS compiles
  - timeval: use CLOCK_MONOTONIC_RAW if available
  - tls13-ciphers.d: include Schannel
  - tool_easysrc.h: correct `easysrc_perform` for `CURL_DISABLE_LIBCURL_OPTION`
  - tool_operate: allow cookie lines up to 8200 bytes
  - tool_parsecfg: accept line lengths up to 10M
  - tool_writeout_json: fix encoding of control characters
  - transfer: clear credentials when redirecting to absolute URL
  - urlapi: have *set(PATH) prepend a slash if one is missing
  - urlapi: scheme must start with alpha
  - vtls: avoid memory leak if sha256 call fails
  - websocket-cb: example doing WebSocket download using callback
  - ws: make the curl_ws_meta() return pointer a const</changelog>
  <changelog author="pmonreal@suse.com" date="1690545600">- Update to 8.2.1:
  * Bugfixes:
  - cfilters: rename close/connect functions to avoid clashes
  - ciphers.d: put URL in first column
  - cmake: add 'libcurlu'/'libcurltool' for unit tests
  - cmake: update ngtcp2 detection
  - configure: check for nghttp2_session_get_stream_local_window_size
  - docs: mark two TLS options for TLS, not SSL
  - docs: provide more see also for cipher options
  - hostip: return IPv6 first for localhost resolves
  - http2: fix regression on upload EOF handling
  - http: VLH, very large header test and fixes
  - libcurl-errors.3: add CURLUE_OK
  - os400: correct EXPECTED_STRING_LASTZEROTERMINATED
  - quiche: fix lookup of transfer at multi
  - quiche: fix segfault and other things
  - rustls: update rustls-ffi 0.10.0
  - socks: print ipv6 address within brackets
  - src/mkhelp: strip off escape sequences
  - tool: fix tool_seek_cb build when SIZEOF_CURL_OFF_T &gt; SIZEOF_OFF_T
  - transfer: do not clear the credentials on redirect to absolute URL
  - unittest: remove unneeded *_LDADD
  - websocket: rename arguments/variables to match docs</changelog>
  <changelog author="pmonreal@suse.com" date="1694606400">- Update to 8.3.0: [bsc#1215026, CVE-2023-38039]
  * Changes:
  - curl: make %output{} in -w specify a file to write to
  - gskit: remove
  - lib: --disable-bindlocal builds curl without local binding support
  - nss: remove support for this TLS library
  - tool: add "variable" support
  - trace: make tracing available in non-debug builds
  - url: change default value for CURLOPT_MAXREDIRS to 30
  - urlapi: CURLU_PUNY2IDN - convert from punycode to IDN name
  * Bugfixes:
  - altsvc: accept and parse IPv6 addresses in response headers
  - asyn-ares: reduce timeout to 2000ms
  - aws-sigv4: canonicalize the query
  - aws-sigv4: fix having date header twice in some cases
  - aws-sigv4: handle no-value user header entries
  - c-hyper: adjust the hyper to curlcode conversion
  - c-hyper: fix memory leaks in `Curl_http`
  - cf-haproxy: make CURLOPT_HAPROXY_CLIENT_IP set the *source* IP
  - cf-socket: log successful interface bind
  - cmake: add GnuTLS option
  - cmake: add support for `CURL_DEFAULT_SSL_BACKEND`
  - cmake: detect `SSL_set0_wbio` in OpenSSL
  - configure: trust pkg-config when it's used for zlib
  - configure: use the pkg-config --libs-only-l flag for libssh2
  - connect: stop halving the remaining timeout when less than 600 ms left
  - crypto: ensure crypto initialization works
  - digest: Use hostname to generate spn instead of realm
  - ftp: fix temp write of ipv6 address
  - headers: accept leading whitespaces on first response header
  - http2: fix in h2 proxy tunnel: progress in ingress on sending
  - http3/ngtcp2: shorten handshake, trace cleanup
  - http3: quiche, handshake optimization, trace cleanup
  - http: close the connection after a late 417 is received
  - http: fix sending of large requests
  - http: return error when receiving too large header set
  - lib: fix null ptr derefs and uninitialized vars (h2/h3)
  - lib: move mimepost data from -&gt;req.p.http to -&gt;state
  - list-only.d: mention SFTP as supported protocol
  - ngtcp2: fix handling of large requests
  - openssl: auto-detect `SSL_R_TLSV13_ALERT_CERTIFICATE_REQUIRED`
  - openssl: clear error queue after SSL_shutdown
  - openssl: make aws-lc version support OCSP
  - openssl: Support async cert verify callback
  - openssl: switch to modern init for LibreSSL 2.7.0+
  - openssl: when CURLOPT_SSL_CTX_FUNCTION is registered, init x509 store before
  - quic: don't set SNI if hostname is an IP address
  - quiche: adjust quiche `QUIC_IDLE_TIMEOUT` to 60s
  - quiche: enable quiche to handle timeout events
  - resolve: use PF_INET6 family lookups when CURL_IPRESOLVE_V6 is set
  - schannel: verify hostname independent of verify cert
  - tool_filetime: make -z work with file dates before 1970
  - tool_operate: allow both SSL_CERT_FILE and SSL_CERT_DIR
  - tool_operate: make aws-sigv4 not require TLS to be used
  - transfer: also stop the sending on closed connection
  - urlapi: fix heap buffer overflow
  - urlapi: setting a blank URL ("") is not an ok URL</changelog>
  <changelog author="pmonreal@suse.com" date="1697025600">- Update to 8.4.0:
  * Security fixes:
  - SOCKS5 heap buffer overflow [bsc#1215888, CVE-2023-38545]
  - cookie injection with none file [bsc#1215889, CVE-2023-38546]
  * Changes:
  - curl: add support for the IPFS protocols via HTTP gateway
  - curl_multi_get_handles: get easy handles from a multi handle
  - mingw: delete support for legacy mingw.org toolchain
  * Bugfixes:
  - base64: also build for curl
  - cf-socket: simulate slow/blocked receives in debug
  - configure: check for the capath by default
  - connect: expire the timeout when trying next
  - connect: only start the happy eyeballs timer when needed
  - cookie: do not store the expire or max-age strings
  - cookie: remove unnecessary struct fields
  - cookie: set -&gt;running in cookie_init even if data is NULL
  - create-dirs.d: clarify it also uses --output-dirs
  - http2: refused stream handling for retry
  - http: h1/h2 proxy unification
  - http: use per-request counter to check too large headers
  - idn: if idn2_check_version returns NULL, return error
  - lib: enable hmac for digest as well
  - lib: let the max filesize option stop too big transfers too
  - lib: move handling of 'data-&gt;req.writer_stack' into Curl_client_write()
  - lib: provide and use Curl_hexencode
  - lib: use wrapper for curl_mime_data fseek callback
  - libssh2: fix error message on failed pubkey-from-file
  - libssh: cap SFTP packet size sent
  - MQTT: improve receive of ACKs
  - multi: do CURLM_CALL_MULTI_PERFORM at two more places
  - multi: round the timeout up to prevent early wakeups
  - openssl: improve ssl shutdown handling
  - openssl: use X509_ALGOR_get0 instead of reaching into X509_ALGOR
  - pytest: exclude test_03_goaway in CI runs due to timing dependency
  - quic: set ciphers/curves the same way regular TLS does
  - quiche: fix build error with --with-ca-fallback
  - socks: return error if hostname too long for remote resolve
  - tftpd: always use curl's own tftp.h
  - tool_getparam: accept variable expansion on file names too
  - upload-file.d: describe the file name slash/backslash handling
  - url: fall back to http/https proxy env-variable if ws/wss not set
  - url: fix netrc info message
  - wolfssh: do cleanup in Curl_ssh_cleanup
  - wolfssl: allow capath with CURLOPT_CAINFO_BLOB
  - wolfssl: if CURLOPT_CAINFO_BLOB is set, ignore the CA files
  - wolfssl: ignore errors in CA path
  * Rebase libcurl-ocloexec.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1701864000">- Update to 8.5.0:
  * Security fixes:
  - [bsc#1217573, CVE-2023-46218] cookie mixed case PSL bypass
  - [bsc#1217574, CVE-2023-46219] HSTS long file name clears contents
  * Changes:
  - gnutls: support CURLSSLOPT_NATIVE_CA
  - HTTP3: ngtcp2 builds are no longer experimental
  * Bugfixes:
  - asyn-thread: use pipe instead of socketpair for IPC when available
  - cmake: fix OpenSSL quic detection in quiche builds
  - conncache: use the closure handle when disconnecting surplus connections
  - content_encoding: make Curl_all_content_encodings allocless
  - cookie: lowercase the domain names before PSL checks
  - Curl_http_body: cleanup properly when Curl_getformdata errors
  - CURLMOPT_MAX_CONCURRENT_STREAMS: make sure the set value is within range
  - doh: provide better return code for responses w/o addresses
  - doh: use PIPEWAIT when HTTP/2 is attempted
  - duphandle: also free 'outcurl-&gt;cookies' in error path
  - duphandle: make dupset() not return with pointers to old alloced data
  - duphandle: use strdup to clone *COPYPOSTFIELDS if size is not set
  - easy: in duphandle, init the cookies for the new handle
  - easy_lock: add a pthread_mutex_t fallback
  - fopen: create new file using old file's mode
  - fopen: create short(er) temporary file name
  - getenv: PlayStation doesn't have getenv()
  - hostip: show the list of IPs when resolving is done
  - hsts: skip single-dot hostname
  - HTTP/2, HTTP/3: handle detach of onoing transfers
  - http: allow longer HTTP/2 request method names
  - hyper: temporarily remove HTTP/2 support
  - IPFS: fix IPFS_PATH and file parsing
  - multi: during ratelimit multi_getsock should return no sockets
  - multi: use pipe instead of socketpair to *wakeup()
  - ngtcp2: fix races in stream handling
  - ntlm_wb: use pipe instead of socketpair when possible
  - openssl: avoid BN_num_bits() NULL pointer derefs
  - openssl: fix building with v3 `no-deprecated` + add CI test
  - openssl: fix infof() to avoid compiler warning for %s with null
  - openssl: identify the "quictls" backend correctly
  - openssl: include SIG and KEM algorithms in verbose
  - openssl: two multi pointer checks should probably rather be asserts
  - openssl: when a session-ID is reused, skip OCSP stapling
  - quic: make eyeballers connect retries stop at weird replies
  - quic: manage connection idle timeouts
  - setopt: check CURLOPT_TFTP_BLKSIZE range on set
  - socks: better buffer size checks for socks4a user and hostname
  - socks: make SOCKS5 use the CURLOPT_IPRESOLVE choice
  - tool: fix --capath when proxy support is disabled
  - tool_getparam: limit --rate to be smaller than number of ms
  - transfer: abort pause send when connection is marked for closing
  - transfer: avoid calling the read callback again after EOF
  - transfer: only reset the FTP wildcard engine in CLEAR state
  - url: don't touch the multi handle when closing internal handles
  - urlapi: avoid null deref if setting blank host to url encode
  - urlapi: skip appending NULL pointer query
  - urlapi: when URL encoding the fragment, pass in the right length
  - vtls: cleanup SSL config management
  - vtls: consistently use typedef names for OpenSSL structs
  - vtls: late clone of connection ssl config
  - vtls: use ALPN "http/1.1" for HTTP/1.x, including HTTP/1.0
  * Rebase curl-secure-getenv.patch
  * Add curl-tests-errorcodes.patch</changelog>
  <changelog author="pujos.michael@gmail.com" date="1704456000">- Added curl-adjust-pollset-fix.patch to fix broken MPD http streaming:
  https://github.com/curl/curl/issues/12632</changelog>
  <changelog author="pmonreal@suse.com" date="1706702400">- Update to 8.6.0: [bsc#1219149, CVE-2024-0853]
  * Security fixes:
  - CVE-2024-0853: OCSP verification bypass with TLS session reuse
  * Changes:
  - add CURLE_TOO_LARGE, CURLINFO_QUEUE_TIME_T
  * Bugfixes:
  - altsvc: free 'as' when returning error
  - asyn-ares: with modern c-ares, use its default timeout
  - cf-socket: show errno in tcpkeepalive error messages
  - cmdline-opts: update availability for the *-ca-native options
  - configure: when enabling QUIC, check that TLS supports QUIC
  - content_encoding: change return code to typedef'ed enum
  - curl: show ipfs and ipns as supported "protocols"
  - CURLINFO_REFERER.3: clarify that it is the *request* header
  - dist: add tests/errorcodes.pl to the tarball
  - gen.pl: support ## for doing .IP in table-like lists
  - GHA: bump ngtcp2, gnutls, mod_h2, quiche
  - hostip: return error immediately when Curl_ip2addr() fails
  - http3/quiche: fix result code on a stream reset
  - http3: initial support for OpenSSL 3.2 QUIC stack
  - http: check for "Host:" case insensitively
  - http: fix off-by-one error in request method length check
  - http: only act on 101 responses when they are HTTP/1.1
  - lib: add debug log outputs for CURLE_BAD_FUNCTION_ARGUMENT
  - lib: error out on multissl + http3
  - lib: fix variable undeclared error caused by `infof` changes
  - lib: rename Curl_strndup to Curl_memdup0 to avoid misunderstanding
  - lib: strndup/memdup instead of malloc, memcpy and null-terminate
  - libssh2: use `libssh2_session_callback_set2()` with v1.11.1
  - ngtcp2: put h3 at the front of alpn
  - openldap: fix an LDAP crash
  - openldap: fix STARTTLS
  - openssl: re-match LibreSSL deinit with init
  - rtsp: deal with borked server responses
  - sasl: make login option string override http auth
  - tool: prepend output_dir in header callback
  - tool_getparam: stop supporting `@filename` style for --cookie
  - transfer: fix upload rate limiting, add test cases
  - url: don't set default CA paths for Secure Transport backend
  - url: for disabled protocols, mention if found in redirect
  - vquic: extract TLS setup into own source
  - websockets: check for negative payload lengths
  * Remove patches fixed upstream:
  - curl-adjust-pollset-fix.patch
  - curl-tests-errorcodes.patch
  * Rebase dont-mess-with-rpmoptflags.patch</changelog>
  <changelog author="fvogt@suse.com" date="1707393600">- Add patch to fix various TLS related issues including FTP over SSL
  transmission timeouts:
  * 0001-vtls-revert-receive-max-buffer-add-test-case.patch
- Switch to %autosetup</changelog>
  <changelog author="pmonreal@suse.com" date="1710244800">- Remove the nghttp2 version requirement as a version guard around
  the nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation
  function was added in curl 8.0.1.
  * Upstream commit: https://github.com/curl/curl/commit/744dcf22</changelog>
  <changelog author="pmonreal@suse.com" date="1711022400">- Security fix: [bsc#1221667, CVE-2024-2398]
  * curl: HTTP/2 push headers memory-leak
  * Add curl-CVE-2024-2398.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1711108800">- Security fix: [bsc#1221665, CVE-2024-2004]
  * Usage of disabled protocol
  * Add curl-CVE-2024-2004.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1711540800">- Security fix: [bsc#1221668, CVE-2024-2466]
  * curl: TLS certificate check bypass with mbedTLS
  * Add curl-CVE-2024-2466.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1711540801">- Security fix: [bsc#1221666, CVE-2024-2379]
  * curl: QUIC certificate check bypass with wolfSSL
  * Add curl-CVE-2024-2379.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1721131200">- Security fix: [bsc#1227888, CVE-2024-6197]
  * Freeing stack buffer in utf8asn1str
  * x509asn1: remove superfluous free()
  * Add curl-CVE-2024-6197.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1722427200">- Security fix: [bsc#1228535, CVE-2024-7264]
  * curl: ASN.1 date parser overread
  * Add curl-CVE-2024-7264.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1725451200">- Security fix: [bsc#1230093, CVE-2024-8096]
  * curl: OCSP stapling bypass with GnuTLS
  * Add curl-CVE-2024-8096.patch</changelog>
</package>
<package pkgid="ff8757acdffc50392b818c8d862ea98bc6c9dfb4544b7d320254e0103b1dac30" name="dbus-1-glib" arch="src">
  <version epoch="0" ver="0.112" rel="150600.3.2.1"/>
  <changelog author="vuntz@opensuse.org" date="1311249600">- Add dbus-1-glib-fix-marshalling-regression.patch: this fixes a
  regression causing issues in NetworkManager; taken from git.</changelog>
  <changelog author="jengelh@medozas.de" date="1316347200">- Remove redundant tags/sections from specfile
  (cf. packaging guidelines)
- Add dbus-1-glib-devel to baselibs</changelog>
  <changelog author="uli@suse.com" date="1317384000">- cross-build fix: use host's dbus-binding-tool</changelog>
  <changelog author="vuntz@opensuse.org" date="1318420800">- Update to version 0.98:
  + Fix the documentation, a lot. We have nearly 100% coverage now.
    (fdo#37793)
  + In specialized collection iterators, check that the type is
    correct; g_critical and return harmlessly, rather than
    crashing, if not
  + If library users register specialized GTypes, warn if their
    vtables have missing callbacks which would cause accessors to
    crash
  + Fix production of documentation out-of-tree with newer gtk-doc
  + Simplify invoke_object_method() and OOM handling in
    dbus-gobject (fdo#35767)
- Changes from version 0.96:
  + Fix a regression in marshalling GObject instances as object
    paths, which broke NetworkManager (fdo#37852, deb#628890)
  + Fix crashes when sending a message when disconnected from D-Bus
    but still working through our backlog of incoming messages,
    similar to fdo#12675 (fdo#38406)
  + Cope more gracefully, with a critical warning instead of a
    memory leak, if programmer error causes G_VALUE_COLLECT to fail
    (fdo#38406, nokia#86280, nokia#180486)
  + Avoid an assertion failure when unregistering a proxy if
    GetNameOwner failed (fdo#38408, nokia#116862)
  + Don't report various programmer errors as "out of memory";
    raise suitable critical warnings instead, and don't leak memory
    (fdo#35767, fdo#35766)
  + If a remote process sends a wrong method call on the Properties
    interface, send back an error reply, instead of warning on
    stderr and not replying (fdo#35766)
  + Show a warning if dbus_g_method_return fails to marshal
    something (fdo#29884, nokia#180486)
  + Remove remnants of i18n (fdo#36428)
  + Remove dead code (nokia#180486)
- Drop dbus-1-glib-fix-marshalling-regression.patch: fixed
  upstream.</changelog>
  <changelog author="cfarrell@suse.com" date="1327492800">- license update: AFL-2.1 or GPL-2.0+
  License is a dual license choice of either Academic Free License 2.1 or
  GNU GPL 2+. This is the SPDX format for that license</changelog>
  <changelog author="thoenig@suse.de" date="1334836800">- Fix and loosen dependency towards dbus-1. Reported by Andreas
  Jaeger &lt;aj@suse.de&gt;.</changelog>
  <changelog author="thoenig@suse.de" date="1334836801">- Further dependency changes: Let dbus-1-glib-devel require
  dbus-1-devel (implicitly pulls dbus-1).</changelog>
  <changelog author="vuntz@opensuse.org" date="1347624000">- Update to version 0.100:
  + Enhancements:
  - Support building on Android with androgenizer
    (fdo#42532)
  - Respect NOCONFIGURE=1 in autogen.sh
  + Fixes:
  - Fix several GVariant reference leaks in
    dbus_g_value_parse_variant (fdo#41125)
  - Don't crash if an error code is out of range for its domain
    or has a negative code (fdo#40151)
  - Fix compilation with -Werror=format-security
  - Don't crash if dbus_g_proxy_new_for_peer() is used to talk to
    the dbus-daemon (fdo#41126)</changelog>
  <changelog author="dimstar@opensuse.org" date="1361275200">- Update to version 0.100.1:
  + dbus-gproxy: Verify sender of NameOwnerChanged signals to be
    o.f.DBus (CVE-2013-0292, bnc#804392).
  + Some cleanups.
  + Other bugs fixed: fdo#23633, fdo#40711, fdo#55729, fdo#55730.</changelog>
  <changelog author="zaitor@opensuse.org" date="1364212800">- Update to version 0.100.2:
  + Respin tarball.</changelog>
  <changelog author="zaitor@opensuse.org" date="1392552000">- Update to version 0.102:
  + Enhancements:
  - Add dbus_g_method_invocation_get_connection (fdo#55729).
  - Add dbus_g_connection_open_private (fdo#55730).
  - Better regression tests (fdo#23633, fdo#40711, fdo#41129,
    fdo#51511, fdo#68603).
  - Get rid of more dead code (fdo#40711).
  - dbus-binding-tool: check validity of names (fdo#7909).
  + Bugs fixed:
  - dbus_g_value_build_g_variant: treat GValues containing
    (G_TYPE_STRING, NULL) or (G_TYPE_STRV, NULL) as empty string
    or empty array instead of asserting (fdo#71811).
  - Upload documentation correctly.
  - Fix under-linking (fdo#68601).
- Remove the exacutable bit from dbus-bash-completion.sh.</changelog>
  <changelog author="zaitor@opensuse.org" date="1432987200">- Update to version 0.104:
  + Deprecations: Document the entire library as deprecated.
  + Dependencies:
  - libdbus 1.8 is required.
  - GLib 2.32 is required.
  + Enhancements:
  - The libdbus 1.8 dependency means we can now document that
    dbus_g_thread_init() is idempotent and thread-safe
    (fdo#54770).
  - Use g_cclosure_marshal_generic for all marshalling
    (fdo#64214).
  + Fixes:
  - Allow timeouts to be migrated from one main context to
    another without an assertion failure (fdo#30574).
  - Don't trip a libdbus fatal warning if a Unix fd or other
    unsupported type is encountered in a message (fdo#80557).
  - Make the tests pass with newer GLib by not removing removed
    sources (fdo#83530).
  - Fix some typos in the documentation (fdo#45686).
  - Make the Autotools setup less awful (fdo#58698).</changelog>
  <changelog author="zaitor@opensuse.org" date="1476273600">- Update to version 0.108:
  + Use dbus-run-session instead of dbus-launch for tests.
- Changes from version 0.106:
  + Stop testing G_HAVE_INLINE, which ceased to work in GLib 2.47.2
    and wasn't meant to be API anyway. Instead, rely on "static
    inline" doing the right thing. On pre-C99 compilers, this
    relies on &lt;glib.h&gt; defining inline to __inline, __inline__ or
    the empty string if the compiler requires it, which it has done
    since 2000. (fdo#93513).
  + Stop calling g_mem_profile() in the tests, which no longer does
    anything and caused the tests to fail by issuing a warning.
  + Slightly modernize build system, and remove a weird
    cross-directory dependency which was breaking distcheck.
  + Stop distributing generated marshallers in the tarball.
- Run spec-clean, modernize spec-file macros and also drop a no
  longer conditional dbus-1-glib-64bit Obsoletes.</changelog>
  <changelog author="zaitor@opensuse.org" date="1476964800">- Split out dbus-binding-tool in own sub-package.</changelog>
  <changelog author="meissner@suse.com" date="1497009600">- remove CFLAGS setting, -fstack-protector is default and -fPIC
  will be auto-selected.</changelog>
  <changelog author="elimat@opensuse.org" date="1594382400">- Update to version 0.110:
  Dependencies:
  + GLib 2.40 is required
  Enhancements:
  + The GLib main-loop glue, "dbus-gmain", is now available as a separate
    subproject (the dbus-gmain branch in dbus-glib's git repository) for
    embedding in larger projects like dbus-glib and dbus-python via the
    `git subtree` or `git submodule` commands. This removes dbus-python's
    dependency on the rest of dbus-glib.
  Fixes:
  + autogen.sh can now detect gtk-doc &gt;= 1.26.
  + More files have per-file copyright information.
- Run spec-cleaner</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1637755200">- Update to version 0.112:
  + Dependencies:
  - dbus 1.8 was already required, but is more strongly required
    now: the workarounds that were used to run continuous
    integration with dbus 1.6 on Ubuntu 14.04 'trusty' have been
    removed. (Note that dbus 1.8 has already reached end-of-life
    for security support, and newer dbus stable branches are
    strongly recommended.)
  - pkg-config 0.28 is required when building from git.
  + Enhancements:
  - Rewrite CONTRIBUTING.md document, based on Wayland's
    equivalent.
  - A generated ChangeLog file, which made up a significant
    proportion of the size of source tarball releases, is no
    longer included.
  - Improve man page.
  - Add test coverage for fdo#80557
  - Use more modern GLib assertions in unit tests.
  - Improve continuous integration to be run by GitLab in
    addition to Travis-CI.
  - Add clearer license information using
    SPDX-License-Identifier.
  + Fixes:
  - Allow glib-genmarshal to be overridden with
    `./configure GLIB_GENMARSHAL=/path/to/glib-genmarshal`, for
    cross-compilation.
  - Avoid a double-free in dbus-binding-tool for certain inputs,
    possibly involving nested introspection data structures.
  - Report a better error for excessive recursion depth or
    unsupported data types.
  - Map the 15 most-recently-added DBusGError members to their
    corresponding D-Bus error names.
  - Mark all documented symbols as deprecated.
  - Fix unit test failures during distcheck by enabling
    assertions.
  - Fix a core dump during installed-tests by not attempting to
    close a shared DBusConnection.
- Package COPYING as license, CONTRIBUTING.md and NEWS as docs.
- Add explicit pkgconfig BuildRequires.
- Replace dbus-1-devel and glib2-devel with pkgconfig variants that
  configure checks for: pkgconfig(dbus-1), pkgconfig(glib-2.0),
  pkgconfig(gobject-2.0) and pkgconfig(gio-2.0) BuildRequires.
- Drop hard Requires and BuildRequires that are not needed as they
  are added automatically.
- Split out bash-completion sub-package.
- Split out shared library into own sub-package, and Require it
  from the devel package, and add to the baselibs.conf. Following
  the SLPP standard. Add Provides and Obsoletes for the no longer
  existing main package.
- Use ldconfig_scriptlets for post(un) handling.
- Add soname define, ease future updates.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1638360000">- Add signature and keyring as sources, verify tarball with gpg.</changelog>
  <changelog author="dimstar@opensuse.org" date="1638964800">- Add relevant dbus-1-glib-&lt;targettype&gt; provides/obsoletes also in
  baselibs.conf (boo#1193502).</changelog>
  <changelog author="dimstar@opensuse.org" date="1667390400">- Try to guard against incomplete update stacks (boo#1202241):
  + Add split-provides to libdbus-1-glib and bash-completion
    sub-package.
  + Add explicit conflict to bash-completion subpackage against
    dbus-1-glib &lt; 0.112 (when the package split happened)
  + Ensure dbus-1-glib-tool gets the correct library version
    installed.</changelog>
</package>
<package pkgid="992cc80564df5fde51c411b49f6f23800c4f07d29f4f1dc8713a95599ad910f0" name="dbus-1-glib-bash-completion" arch="aarch64">
  <version epoch="0" ver="0.112" rel="150600.3.2.1"/>
  <changelog author="zaitor@opensuse.org" date="1392552000">- Update to version 0.102:
  + Enhancements:
  - Add dbus_g_method_invocation_get_connection (fdo#55729).
  - Add dbus_g_connection_open_private (fdo#55730).
  - Better regression tests (fdo#23633, fdo#40711, fdo#41129,
    fdo#51511, fdo#68603).
  - Get rid of more dead code (fdo#40711).
  - dbus-binding-tool: check validity of names (fdo#7909).
  + Bugs fixed:
  - dbus_g_value_build_g_variant: treat GValues containing
    (G_TYPE_STRING, NULL) or (G_TYPE_STRV, NULL) as empty string
    or empty array instead of asserting (fdo#71811).
  - Upload documentation correctly.
  - Fix under-linking (fdo#68601).
- Remove the exacutable bit from dbus-bash-completion.sh.</changelog>
  <changelog author="zaitor@opensuse.org" date="1432987200">- Update to version 0.104:
  + Deprecations: Document the entire library as deprecated.
  + Dependencies:
  - libdbus 1.8 is required.
  - GLib 2.32 is required.
  + Enhancements:
  - The libdbus 1.8 dependency means we can now document that
    dbus_g_thread_init() is idempotent and thread-safe
    (fdo#54770).
  - Use g_cclosure_marshal_generic for all marshalling
    (fdo#64214).
  + Fixes:
  - Allow timeouts to be migrated from one main context to
    another without an assertion failure (fdo#30574).
  - Don't trip a libdbus fatal warning if a Unix fd or other
    unsupported type is encountered in a message (fdo#80557).
  - Make the tests pass with newer GLib by not removing removed
    sources (fdo#83530).
  - Fix some typos in the documentation (fdo#45686).
  - Make the Autotools setup less awful (fdo#58698).</changelog>
  <changelog author="zaitor@opensuse.org" date="1476273600">- Update to version 0.108:
  + Use dbus-run-session instead of dbus-launch for tests.
- Changes from version 0.106:
  + Stop testing G_HAVE_INLINE, which ceased to work in GLib 2.47.2
    and wasn't meant to be API anyway. Instead, rely on "static
    inline" doing the right thing. On pre-C99 compilers, this
    relies on &lt;glib.h&gt; defining inline to __inline, __inline__ or
    the empty string if the compiler requires it, which it has done
    since 2000. (fdo#93513).
  + Stop calling g_mem_profile() in the tests, which no longer does
    anything and caused the tests to fail by issuing a warning.
  + Slightly modernize build system, and remove a weird
    cross-directory dependency which was breaking distcheck.
  + Stop distributing generated marshallers in the tarball.
- Run spec-clean, modernize spec-file macros and also drop a no
  longer conditional dbus-1-glib-64bit Obsoletes.</changelog>
  <changelog author="zaitor@opensuse.org" date="1476964800">- Split out dbus-binding-tool in own sub-package.</changelog>
  <changelog author="meissner@suse.com" date="1497009600">- remove CFLAGS setting, -fstack-protector is default and -fPIC
  will be auto-selected.</changelog>
  <changelog author="elimat@opensuse.org" date="1594382400">- Update to version 0.110:
  Dependencies:
  + GLib 2.40 is required
  Enhancements:
  + The GLib main-loop glue, "dbus-gmain", is now available as a separate
    subproject (the dbus-gmain branch in dbus-glib's git repository) for
    embedding in larger projects like dbus-glib and dbus-python via the
    `git subtree` or `git submodule` commands. This removes dbus-python's
    dependency on the rest of dbus-glib.
  Fixes:
  + autogen.sh can now detect gtk-doc &gt;= 1.26.
  + More files have per-file copyright information.
- Run spec-cleaner</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1637755200">- Update to version 0.112:
  + Dependencies:
  - dbus 1.8 was already required, but is more strongly required
    now: the workarounds that were used to run continuous
    integration with dbus 1.6 on Ubuntu 14.04 'trusty' have been
    removed. (Note that dbus 1.8 has already reached end-of-life
    for security support, and newer dbus stable branches are
    strongly recommended.)
  - pkg-config 0.28 is required when building from git.
  + Enhancements:
  - Rewrite CONTRIBUTING.md document, based on Wayland's
    equivalent.
  - A generated ChangeLog file, which made up a significant
    proportion of the size of source tarball releases, is no
    longer included.
  - Improve man page.
  - Add test coverage for fdo#80557
  - Use more modern GLib assertions in unit tests.
  - Improve continuous integration to be run by GitLab in
    addition to Travis-CI.
  - Add clearer license information using
    SPDX-License-Identifier.
  + Fixes:
  - Allow glib-genmarshal to be overridden with
    `./configure GLIB_GENMARSHAL=/path/to/glib-genmarshal`, for
    cross-compilation.
  - Avoid a double-free in dbus-binding-tool for certain inputs,
    possibly involving nested introspection data structures.
  - Report a better error for excessive recursion depth or
    unsupported data types.
  - Map the 15 most-recently-added DBusGError members to their
    corresponding D-Bus error names.
  - Mark all documented symbols as deprecated.
  - Fix unit test failures during distcheck by enabling
    assertions.
  - Fix a core dump during installed-tests by not attempting to
    close a shared DBusConnection.
- Package COPYING as license, CONTRIBUTING.md and NEWS as docs.
- Add explicit pkgconfig BuildRequires.
- Replace dbus-1-devel and glib2-devel with pkgconfig variants that
  configure checks for: pkgconfig(dbus-1), pkgconfig(glib-2.0),
  pkgconfig(gobject-2.0) and pkgconfig(gio-2.0) BuildRequires.
- Drop hard Requires and BuildRequires that are not needed as they
  are added automatically.
- Split out bash-completion sub-package.
- Split out shared library into own sub-package, and Require it
  from the devel package, and add to the baselibs.conf. Following
  the SLPP standard. Add Provides and Obsoletes for the no longer
  existing main package.
- Use ldconfig_scriptlets for post(un) handling.
- Add soname define, ease future updates.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1638360000">- Add signature and keyring as sources, verify tarball with gpg.</changelog>
  <changelog author="dimstar@opensuse.org" date="1638964800">- Add relevant dbus-1-glib-&lt;targettype&gt; provides/obsoletes also in
  baselibs.conf (boo#1193502).</changelog>
  <changelog author="dimstar@opensuse.org" date="1667390400">- Try to guard against incomplete update stacks (boo#1202241):
  + Add split-provides to libdbus-1-glib and bash-completion
    sub-package.
  + Add explicit conflict to bash-completion subpackage against
    dbus-1-glib &lt; 0.112 (when the package split happened)
  + Ensure dbus-1-glib-tool gets the correct library version
    installed.</changelog>
</package>
<package pkgid="6e35ae19c11ed58295fad9002bfc8912558cd34d6fe00ddd1b0d53589e31b160" name="dbus-1-glib-bash-completion" arch="ppc64le">
  <version epoch="0" ver="0.112" rel="150600.3.2.1"/>
  <changelog author="zaitor@opensuse.org" date="1392552000">- Update to version 0.102:
  + Enhancements:
  - Add dbus_g_method_invocation_get_connection (fdo#55729).
  - Add dbus_g_connection_open_private (fdo#55730).
  - Better regression tests (fdo#23633, fdo#40711, fdo#41129,
    fdo#51511, fdo#68603).
  - Get rid of more dead code (fdo#40711).
  - dbus-binding-tool: check validity of names (fdo#7909).
  + Bugs fixed:
  - dbus_g_value_build_g_variant: treat GValues containing
    (G_TYPE_STRING, NULL) or (G_TYPE_STRV, NULL) as empty string
    or empty array instead of asserting (fdo#71811).
  - Upload documentation correctly.
  - Fix under-linking (fdo#68601).
- Remove the exacutable bit from dbus-bash-completion.sh.</changelog>
  <changelog author="zaitor@opensuse.org" date="1432987200">- Update to version 0.104:
  + Deprecations: Document the entire library as deprecated.
  + Dependencies:
  - libdbus 1.8 is required.
  - GLib 2.32 is required.
  + Enhancements:
  - The libdbus 1.8 dependency means we can now document that
    dbus_g_thread_init() is idempotent and thread-safe
    (fdo#54770).
  - Use g_cclosure_marshal_generic for all marshalling
    (fdo#64214).
  + Fixes:
  - Allow timeouts to be migrated from one main context to
    another without an assertion failure (fdo#30574).
  - Don't trip a libdbus fatal warning if a Unix fd or other
    unsupported type is encountered in a message (fdo#80557).
  - Make the tests pass with newer GLib by not removing removed
    sources (fdo#83530).
  - Fix some typos in the documentation (fdo#45686).
  - Make the Autotools setup less awful (fdo#58698).</changelog>
  <changelog author="zaitor@opensuse.org" date="1476273600">- Update to version 0.108:
  + Use dbus-run-session instead of dbus-launch for tests.
- Changes from version 0.106:
  + Stop testing G_HAVE_INLINE, which ceased to work in GLib 2.47.2
    and wasn't meant to be API anyway. Instead, rely on "static
    inline" doing the right thing. On pre-C99 compilers, this
    relies on &lt;glib.h&gt; defining inline to __inline, __inline__ or
    the empty string if the compiler requires it, which it has done
    since 2000. (fdo#93513).
  + Stop calling g_mem_profile() in the tests, which no longer does
    anything and caused the tests to fail by issuing a warning.
  + Slightly modernize build system, and remove a weird
    cross-directory dependency which was breaking distcheck.
  + Stop distributing generated marshallers in the tarball.
- Run spec-clean, modernize spec-file macros and also drop a no
  longer conditional dbus-1-glib-64bit Obsoletes.</changelog>
  <changelog author="zaitor@opensuse.org" date="1476964800">- Split out dbus-binding-tool in own sub-package.</changelog>
  <changelog author="meissner@suse.com" date="1497009600">- remove CFLAGS setting, -fstack-protector is default and -fPIC
  will be auto-selected.</changelog>
  <changelog author="elimat@opensuse.org" date="1594382400">- Update to version 0.110:
  Dependencies:
  + GLib 2.40 is required
  Enhancements:
  + The GLib main-loop glue, "dbus-gmain", is now available as a separate
    subproject (the dbus-gmain branch in dbus-glib's git repository) for
    embedding in larger projects like dbus-glib and dbus-python via the
    `git subtree` or `git submodule` commands. This removes dbus-python's
    dependency on the rest of dbus-glib.
  Fixes:
  + autogen.sh can now detect gtk-doc &gt;= 1.26.
  + More files have per-file copyright information.
- Run spec-cleaner</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1637755200">- Update to version 0.112:
  + Dependencies:
  - dbus 1.8 was already required, but is more strongly required
    now: the workarounds that were used to run continuous
    integration with dbus 1.6 on Ubuntu 14.04 'trusty' have been
    removed. (Note that dbus 1.8 has already reached end-of-life
    for security support, and newer dbus stable branches are
    strongly recommended.)
  - pkg-config 0.28 is required when building from git.
  + Enhancements:
  - Rewrite CONTRIBUTING.md document, based on Wayland's
    equivalent.
  - A generated ChangeLog file, which made up a significant
    proportion of the size of source tarball releases, is no
    longer included.
  - Improve man page.
  - Add test coverage for fdo#80557
  - Use more modern GLib assertions in unit tests.
  - Improve continuous integration to be run by GitLab in
    addition to Travis-CI.
  - Add clearer license information using
    SPDX-License-Identifier.
  + Fixes:
  - Allow glib-genmarshal to be overridden with
    `./configure GLIB_GENMARSHAL=/path/to/glib-genmarshal`, for
    cross-compilation.
  - Avoid a double-free in dbus-binding-tool for certain inputs,
    possibly involving nested introspection data structures.
  - Report a better error for excessive recursion depth or
    unsupported data types.
  - Map the 15 most-recently-added DBusGError members to their
    corresponding D-Bus error names.
  - Mark all documented symbols as deprecated.
  - Fix unit test failures during distcheck by enabling
    assertions.
  - Fix a core dump during installed-tests by not attempting to
    close a shared DBusConnection.
- Package COPYING as license, CONTRIBUTING.md and NEWS as docs.
- Add explicit pkgconfig BuildRequires.
- Replace dbus-1-devel and glib2-devel with pkgconfig variants that
  configure checks for: pkgconfig(dbus-1), pkgconfig(glib-2.0),
  pkgconfig(gobject-2.0) and pkgconfig(gio-2.0) BuildRequires.
- Drop hard Requires and BuildRequires that are not needed as they
  are added automatically.
- Split out bash-completion sub-package.
- Split out shared library into own sub-package, and Require it
  from the devel package, and add to the baselibs.conf. Following
  the SLPP standard. Add Provides and Obsoletes for the no longer
  existing main package.
- Use ldconfig_scriptlets for post(un) handling.
- Add soname define, ease future updates.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1638360000">- Add signature and keyring as sources, verify tarball with gpg.</changelog>
  <changelog author="dimstar@opensuse.org" date="1638964800">- Add relevant dbus-1-glib-&lt;targettype&gt; provides/obsoletes also in
  baselibs.conf (boo#1193502).</changelog>
  <changelog author="dimstar@opensuse.org" date="1667390400">- Try to guard against incomplete update stacks (boo#1202241):
  + Add split-provides to libdbus-1-glib and bash-completion
    sub-package.
  + Add explicit conflict to bash-completion subpackage against
    dbus-1-glib &lt; 0.112 (when the package split happened)
  + Ensure dbus-1-glib-tool gets the correct library version
    installed.</changelog>
</package>
<package pkgid="932f014a158d7ffd191a90a5fc4af2292bb630699a418856afe2836192e3ac8f" name="dbus-1-glib-bash-completion" arch="s390x">
  <version epoch="0" ver="0.112" rel="150600.3.2.1"/>
  <changelog author="zaitor@opensuse.org" date="1392552000">- Update to version 0.102:
  + Enhancements:
  - Add dbus_g_method_invocation_get_connection (fdo#55729).
  - Add dbus_g_connection_open_private (fdo#55730).
  - Better regression tests (fdo#23633, fdo#40711, fdo#41129,
    fdo#51511, fdo#68603).
  - Get rid of more dead code (fdo#40711).
  - dbus-binding-tool: check validity of names (fdo#7909).
  + Bugs fixed:
  - dbus_g_value_build_g_variant: treat GValues containing
    (G_TYPE_STRING, NULL) or (G_TYPE_STRV, NULL) as empty string
    or empty array instead of asserting (fdo#71811).
  - Upload documentation correctly.
  - Fix under-linking (fdo#68601).
- Remove the exacutable bit from dbus-bash-completion.sh.</changelog>
  <changelog author="zaitor@opensuse.org" date="1432987200">- Update to version 0.104:
  + Deprecations: Document the entire library as deprecated.
  + Dependencies:
  - libdbus 1.8 is required.
  - GLib 2.32 is required.
  + Enhancements:
  - The libdbus 1.8 dependency means we can now document that
    dbus_g_thread_init() is idempotent and thread-safe
    (fdo#54770).
  - Use g_cclosure_marshal_generic for all marshalling
    (fdo#64214).
  + Fixes:
  - Allow timeouts to be migrated from one main context to
    another without an assertion failure (fdo#30574).
  - Don't trip a libdbus fatal warning if a Unix fd or other
    unsupported type is encountered in a message (fdo#80557).
  - Make the tests pass with newer GLib by not removing removed
    sources (fdo#83530).
  - Fix some typos in the documentation (fdo#45686).
  - Make the Autotools setup less awful (fdo#58698).</changelog>
  <changelog author="zaitor@opensuse.org" date="1476273600">- Update to version 0.108:
  + Use dbus-run-session instead of dbus-launch for tests.
- Changes from version 0.106:
  + Stop testing G_HAVE_INLINE, which ceased to work in GLib 2.47.2
    and wasn't meant to be API anyway. Instead, rely on "static
    inline" doing the right thing. On pre-C99 compilers, this
    relies on &lt;glib.h&gt; defining inline to __inline, __inline__ or
    the empty string if the compiler requires it, which it has done
    since 2000. (fdo#93513).
  + Stop calling g_mem_profile() in the tests, which no longer does
    anything and caused the tests to fail by issuing a warning.
  + Slightly modernize build system, and remove a weird
    cross-directory dependency which was breaking distcheck.
  + Stop distributing generated marshallers in the tarball.
- Run spec-clean, modernize spec-file macros and also drop a no
  longer conditional dbus-1-glib-64bit Obsoletes.</changelog>
  <changelog author="zaitor@opensuse.org" date="1476964800">- Split out dbus-binding-tool in own sub-package.</changelog>
  <changelog author="meissner@suse.com" date="1497009600">- remove CFLAGS setting, -fstack-protector is default and -fPIC
  will be auto-selected.</changelog>
  <changelog author="elimat@opensuse.org" date="1594382400">- Update to version 0.110:
  Dependencies:
  + GLib 2.40 is required
  Enhancements:
  + The GLib main-loop glue, "dbus-gmain", is now available as a separate
    subproject (the dbus-gmain branch in dbus-glib's git repository) for
    embedding in larger projects like dbus-glib and dbus-python via the
    `git subtree` or `git submodule` commands. This removes dbus-python's
    dependency on the rest of dbus-glib.
  Fixes:
  + autogen.sh can now detect gtk-doc &gt;= 1.26.
  + More files have per-file copyright information.
- Run spec-cleaner</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1637755200">- Update to version 0.112:
  + Dependencies:
  - dbus 1.8 was already required, but is more strongly required
    now: the workarounds that were used to run continuous
    integration with dbus 1.6 on Ubuntu 14.04 'trusty' have been
    removed. (Note that dbus 1.8 has already reached end-of-life
    for security support, and newer dbus stable branches are
    strongly recommended.)
  - pkg-config 0.28 is required when building from git.
  + Enhancements:
  - Rewrite CONTRIBUTING.md document, based on Wayland's
    equivalent.
  - A generated ChangeLog file, which made up a significant
    proportion of the size of source tarball releases, is no
    longer included.
  - Improve man page.
  - Add test coverage for fdo#80557
  - Use more modern GLib assertions in unit tests.
  - Improve continuous integration to be run by GitLab in
    addition to Travis-CI.
  - Add clearer license information using
    SPDX-License-Identifier.
  + Fixes:
  - Allow glib-genmarshal to be overridden with
    `./configure GLIB_GENMARSHAL=/path/to/glib-genmarshal`, for
    cross-compilation.
  - Avoid a double-free in dbus-binding-tool for certain inputs,
    possibly involving nested introspection data structures.
  - Report a better error for excessive recursion depth or
    unsupported data types.
  - Map the 15 most-recently-added DBusGError members to their
    corresponding D-Bus error names.
  - Mark all documented symbols as deprecated.
  - Fix unit test failures during distcheck by enabling
    assertions.
  - Fix a core dump during installed-tests by not attempting to
    close a shared DBusConnection.
- Package COPYING as license, CONTRIBUTING.md and NEWS as docs.
- Add explicit pkgconfig BuildRequires.
- Replace dbus-1-devel and glib2-devel with pkgconfig variants that
  configure checks for: pkgconfig(dbus-1), pkgconfig(glib-2.0),
  pkgconfig(gobject-2.0) and pkgconfig(gio-2.0) BuildRequires.
- Drop hard Requires and BuildRequires that are not needed as they
  are added automatically.
- Split out bash-completion sub-package.
- Split out shared library into own sub-package, and Require it
  from the devel package, and add to the baselibs.conf. Following
  the SLPP standard. Add Provides and Obsoletes for the no longer
  existing main package.
- Use ldconfig_scriptlets for post(un) handling.
- Add soname define, ease future updates.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1638360000">- Add signature and keyring as sources, verify tarball with gpg.</changelog>
  <changelog author="dimstar@opensuse.org" date="1638964800">- Add relevant dbus-1-glib-&lt;targettype&gt; provides/obsoletes also in
  baselibs.conf (boo#1193502).</changelog>
  <changelog author="dimstar@opensuse.org" date="1667390400">- Try to guard against incomplete update stacks (boo#1202241):
  + Add split-provides to libdbus-1-glib and bash-completion
    sub-package.
  + Add explicit conflict to bash-completion subpackage against
    dbus-1-glib &lt; 0.112 (when the package split happened)
  + Ensure dbus-1-glib-tool gets the correct library version
    installed.</changelog>
</package>
<package pkgid="62ee285b45e83519cacaacfa1489204a1b4093d3f134a1ae96d6f4e931f10e9d" name="dbus-1-glib-bash-completion" arch="x86_64">
  <version epoch="0" ver="0.112" rel="150600.3.2.1"/>
  <changelog author="zaitor@opensuse.org" date="1392552000">- Update to version 0.102:
  + Enhancements:
  - Add dbus_g_method_invocation_get_connection (fdo#55729).
  - Add dbus_g_connection_open_private (fdo#55730).
  - Better regression tests (fdo#23633, fdo#40711, fdo#41129,
    fdo#51511, fdo#68603).
  - Get rid of more dead code (fdo#40711).
  - dbus-binding-tool: check validity of names (fdo#7909).
  + Bugs fixed:
  - dbus_g_value_build_g_variant: treat GValues containing
    (G_TYPE_STRING, NULL) or (G_TYPE_STRV, NULL) as empty string
    or empty array instead of asserting (fdo#71811).
  - Upload documentation correctly.
  - Fix under-linking (fdo#68601).
- Remove the exacutable bit from dbus-bash-completion.sh.</changelog>
  <changelog author="zaitor@opensuse.org" date="1432987200">- Update to version 0.104:
  + Deprecations: Document the entire library as deprecated.
  + Dependencies:
  - libdbus 1.8 is required.
  - GLib 2.32 is required.
  + Enhancements:
  - The libdbus 1.8 dependency means we can now document that
    dbus_g_thread_init() is idempotent and thread-safe
    (fdo#54770).
  - Use g_cclosure_marshal_generic for all marshalling
    (fdo#64214).
  + Fixes:
  - Allow timeouts to be migrated from one main context to
    another without an assertion failure (fdo#30574).
  - Don't trip a libdbus fatal warning if a Unix fd or other
    unsupported type is encountered in a message (fdo#80557).
  - Make the tests pass with newer GLib by not removing removed
    sources (fdo#83530).
  - Fix some typos in the documentation (fdo#45686).
  - Make the Autotools setup less awful (fdo#58698).</changelog>
  <changelog author="zaitor@opensuse.org" date="1476273600">- Update to version 0.108:
  + Use dbus-run-session instead of dbus-launch for tests.
- Changes from version 0.106:
  + Stop testing G_HAVE_INLINE, which ceased to work in GLib 2.47.2
    and wasn't meant to be API anyway. Instead, rely on "static
    inline" doing the right thing. On pre-C99 compilers, this
    relies on &lt;glib.h&gt; defining inline to __inline, __inline__ or
    the empty string if the compiler requires it, which it has done
    since 2000. (fdo#93513).
  + Stop calling g_mem_profile() in the tests, which no longer does
    anything and caused the tests to fail by issuing a warning.
  + Slightly modernize build system, and remove a weird
    cross-directory dependency which was breaking distcheck.
  + Stop distributing generated marshallers in the tarball.
- Run spec-clean, modernize spec-file macros and also drop a no
  longer conditional dbus-1-glib-64bit Obsoletes.</changelog>
  <changelog author="zaitor@opensuse.org" date="1476964800">- Split out dbus-binding-tool in own sub-package.</changelog>
  <changelog author="meissner@suse.com" date="1497009600">- remove CFLAGS setting, -fstack-protector is default and -fPIC
  will be auto-selected.</changelog>
  <changelog author="elimat@opensuse.org" date="1594382400">- Update to version 0.110:
  Dependencies:
  + GLib 2.40 is required
  Enhancements:
  + The GLib main-loop glue, "dbus-gmain", is now available as a separate
    subproject (the dbus-gmain branch in dbus-glib's git repository) for
    embedding in larger projects like dbus-glib and dbus-python via the
    `git subtree` or `git submodule` commands. This removes dbus-python's
    dependency on the rest of dbus-glib.
  Fixes:
  + autogen.sh can now detect gtk-doc &gt;= 1.26.
  + More files have per-file copyright information.
- Run spec-cleaner</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1637755200">- Update to version 0.112:
  + Dependencies:
  - dbus 1.8 was already required, but is more strongly required
    now: the workarounds that were used to run continuous
    integration with dbus 1.6 on Ubuntu 14.04 'trusty' have been
    removed. (Note that dbus 1.8 has already reached end-of-life
    for security support, and newer dbus stable branches are
    strongly recommended.)
  - pkg-config 0.28 is required when building from git.
  + Enhancements:
  - Rewrite CONTRIBUTING.md document, based on Wayland's
    equivalent.
  - A generated ChangeLog file, which made up a significant
    proportion of the size of source tarball releases, is no
    longer included.
  - Improve man page.
  - Add test coverage for fdo#80557
  - Use more modern GLib assertions in unit tests.
  - Improve continuous integration to be run by GitLab in
    addition to Travis-CI.
  - Add clearer license information using
    SPDX-License-Identifier.
  + Fixes:
  - Allow glib-genmarshal to be overridden with
    `./configure GLIB_GENMARSHAL=/path/to/glib-genmarshal`, for
    cross-compilation.
  - Avoid a double-free in dbus-binding-tool for certain inputs,
    possibly involving nested introspection data structures.
  - Report a better error for excessive recursion depth or
    unsupported data types.
  - Map the 15 most-recently-added DBusGError members to their
    corresponding D-Bus error names.
  - Mark all documented symbols as deprecated.
  - Fix unit test failures during distcheck by enabling
    assertions.
  - Fix a core dump during installed-tests by not attempting to
    close a shared DBusConnection.
- Package COPYING as license, CONTRIBUTING.md and NEWS as docs.
- Add explicit pkgconfig BuildRequires.
- Replace dbus-1-devel and glib2-devel with pkgconfig variants that
  configure checks for: pkgconfig(dbus-1), pkgconfig(glib-2.0),
  pkgconfig(gobject-2.0) and pkgconfig(gio-2.0) BuildRequires.
- Drop hard Requires and BuildRequires that are not needed as they
  are added automatically.
- Split out bash-completion sub-package.
- Split out shared library into own sub-package, and Require it
  from the devel package, and add to the baselibs.conf. Following
  the SLPP standard. Add Provides and Obsoletes for the no longer
  existing main package.
- Use ldconfig_scriptlets for post(un) handling.
- Add soname define, ease future updates.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1638360000">- Add signature and keyring as sources, verify tarball with gpg.</changelog>
  <changelog author="dimstar@opensuse.org" date="1638964800">- Add relevant dbus-1-glib-&lt;targettype&gt; provides/obsoletes also in
  baselibs.conf (boo#1193502).</changelog>
  <changelog author="dimstar@opensuse.org" date="1667390400">- Try to guard against incomplete update stacks (boo#1202241):
  + Add split-provides to libdbus-1-glib and bash-completion
    sub-package.
  + Add explicit conflict to bash-completion subpackage against
    dbus-1-glib &lt; 0.112 (when the package split happened)
  + Ensure dbus-1-glib-tool gets the correct library version
    installed.</changelog>
</package>
<package pkgid="ae443e7a37e7a2d98d0a149233e990b78df7fddab27f24b296c6de4956466b60" name="dbus-1-glib-devel" arch="aarch64">
  <version epoch="0" ver="0.112" rel="150600.3.2.1"/>
  <changelog author="zaitor@opensuse.org" date="1392552000">- Update to version 0.102:
  + Enhancements:
  - Add dbus_g_method_invocation_get_connection (fdo#55729).
  - Add dbus_g_connection_open_private (fdo#55730).
  - Better regression tests (fdo#23633, fdo#40711, fdo#41129,
    fdo#51511, fdo#68603).
  - Get rid of more dead code (fdo#40711).
  - dbus-binding-tool: check validity of names (fdo#7909).
  + Bugs fixed:
  - dbus_g_value_build_g_variant: treat GValues containing
    (G_TYPE_STRING, NULL) or (G_TYPE_STRV, NULL) as empty string
    or empty array instead of asserting (fdo#71811).
  - Upload documentation correctly.
  - Fix under-linking (fdo#68601).
- Remove the exacutable bit from dbus-bash-completion.sh.</changelog>
  <changelog author="zaitor@opensuse.org" date="1432987200">- Update to version 0.104:
  + Deprecations: Document the entire library as deprecated.
  + Dependencies:
  - libdbus 1.8 is required.
  - GLib 2.32 is required.
  + Enhancements:
  - The libdbus 1.8 dependency means we can now document that
    dbus_g_thread_init() is idempotent and thread-safe
    (fdo#54770).
  - Use g_cclosure_marshal_generic for all marshalling
    (fdo#64214).
  + Fixes:
  - Allow timeouts to be migrated from one main context to
    another without an assertion failure (fdo#30574).
  - Don't trip a libdbus fatal warning if a Unix fd or other
    unsupported type is encountered in a message (fdo#80557).
  - Make the tests pass with newer GLib by not removing removed
    sources (fdo#83530).
  - Fix some typos in the documentation (fdo#45686).
  - Make the Autotools setup less awful (fdo#58698).</changelog>
  <changelog author="zaitor@opensuse.org" date="1476273600">- Update to version 0.108:
  + Use dbus-run-session instead of dbus-launch for tests.
- Changes from version 0.106:
  + Stop testing G_HAVE_INLINE, which ceased to work in GLib 2.47.2
    and wasn't meant to be API anyway. Instead, rely on "static
    inline" doing the right thing. On pre-C99 compilers, this
    relies on &lt;glib.h&gt; defining inline to __inline, __inline__ or
    the empty string if the compiler requires it, which it has done
    since 2000. (fdo#93513).
  + Stop calling g_mem_profile() in the tests, which no longer does
    anything and caused the tests to fail by issuing a warning.
  + Slightly modernize build system, and remove a weird
    cross-directory dependency which was breaking distcheck.
  + Stop distributing generated marshallers in the tarball.
- Run spec-clean, modernize spec-file macros and also drop a no
  longer conditional dbus-1-glib-64bit Obsoletes.</changelog>
  <changelog author="zaitor@opensuse.org" date="1476964800">- Split out dbus-binding-tool in own sub-package.</changelog>
  <changelog author="meissner@suse.com" date="1497009600">- remove CFLAGS setting, -fstack-protector is default and -fPIC
  will be auto-selected.</changelog>
  <changelog author="elimat@opensuse.org" date="1594382400">- Update to version 0.110:
  Dependencies:
  + GLib 2.40 is required
  Enhancements:
  + The GLib main-loop glue, "dbus-gmain", is now available as a separate
    subproject (the dbus-gmain branch in dbus-glib's git repository) for
    embedding in larger projects like dbus-glib and dbus-python via the
    `git subtree` or `git submodule` commands. This removes dbus-python's
    dependency on the rest of dbus-glib.
  Fixes:
  + autogen.sh can now detect gtk-doc &gt;= 1.26.
  + More files have per-file copyright information.
- Run spec-cleaner</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1637755200">- Update to version 0.112:
  + Dependencies:
  - dbus 1.8 was already required, but is more strongly required
    now: the workarounds that were used to run continuous
    integration with dbus 1.6 on Ubuntu 14.04 'trusty' have been
    removed. (Note that dbus 1.8 has already reached end-of-life
    for security support, and newer dbus stable branches are
    strongly recommended.)
  - pkg-config 0.28 is required when building from git.
  + Enhancements:
  - Rewrite CONTRIBUTING.md document, based on Wayland's
    equivalent.
  - A generated ChangeLog file, which made up a significant
    proportion of the size of source tarball releases, is no
    longer included.
  - Improve man page.
  - Add test coverage for fdo#80557
  - Use more modern GLib assertions in unit tests.
  - Improve continuous integration to be run by GitLab in
    addition to Travis-CI.
  - Add clearer license information using
    SPDX-License-Identifier.
  + Fixes:
  - Allow glib-genmarshal to be overridden with
    `./configure GLIB_GENMARSHAL=/path/to/glib-genmarshal`, for
    cross-compilation.
  - Avoid a double-free in dbus-binding-tool for certain inputs,
    possibly involving nested introspection data structures.
  - Report a better error for excessive recursion depth or
    unsupported data types.
  - Map the 15 most-recently-added DBusGError members to their
    corresponding D-Bus error names.
  - Mark all documented symbols as deprecated.
  - Fix unit test failures during distcheck by enabling
    assertions.
  - Fix a core dump during installed-tests by not attempting to
    close a shared DBusConnection.
- Package COPYING as license, CONTRIBUTING.md and NEWS as docs.
- Add explicit pkgconfig BuildRequires.
- Replace dbus-1-devel and glib2-devel with pkgconfig variants that
  configure checks for: pkgconfig(dbus-1), pkgconfig(glib-2.0),
  pkgconfig(gobject-2.0) and pkgconfig(gio-2.0) BuildRequires.
- Drop hard Requires and BuildRequires that are not needed as they
  are added automatically.
- Split out bash-completion sub-package.
- Split out shared library into own sub-package, and Require it
  from the devel package, and add to the baselibs.conf. Following
  the SLPP standard. Add Provides and Obsoletes for the no longer
  existing main package.
- Use ldconfig_scriptlets for post(un) handling.
- Add soname define, ease future updates.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1638360000">- Add signature and keyring as sources, verify tarball with gpg.</changelog>
  <changelog author="dimstar@opensuse.org" date="1638964800">- Add relevant dbus-1-glib-&lt;targettype&gt; provides/obsoletes also in
  baselibs.conf (boo#1193502).</changelog>
  <changelog author="dimstar@opensuse.org" date="1667390400">- Try to guard against incomplete update stacks (boo#1202241):
  + Add split-provides to libdbus-1-glib and bash-completion
    sub-package.
  + Add explicit conflict to bash-completion subpackage against
    dbus-1-glib &lt; 0.112 (when the package split happened)
  + Ensure dbus-1-glib-tool gets the correct library version
    installed.</changelog>
</package>
<package pkgid="d826c46790e87b7329e33e991c5128714d41866c59d0cb6381fc48ef55618200" name="dbus-1-glib-devel" arch="ppc64le">
  <version epoch="0" ver="0.112" rel="150600.3.2.1"/>
  <changelog author="zaitor@opensuse.org" date="1392552000">- Update to version 0.102:
  + Enhancements:
  - Add dbus_g_method_invocation_get_connection (fdo#55729).
  - Add dbus_g_connection_open_private (fdo#55730).
  - Better regression tests (fdo#23633, fdo#40711, fdo#41129,
    fdo#51511, fdo#68603).
  - Get rid of more dead code (fdo#40711).
  - dbus-binding-tool: check validity of names (fdo#7909).
  + Bugs fixed:
  - dbus_g_value_build_g_variant: treat GValues containing
    (G_TYPE_STRING, NULL) or (G_TYPE_STRV, NULL) as empty string
    or empty array instead of asserting (fdo#71811).
  - Upload documentation correctly.
  - Fix under-linking (fdo#68601).
- Remove the exacutable bit from dbus-bash-completion.sh.</changelog>
  <changelog author="zaitor@opensuse.org" date="1432987200">- Update to version 0.104:
  + Deprecations: Document the entire library as deprecated.
  + Dependencies:
  - libdbus 1.8 is required.
  - GLib 2.32 is required.
  + Enhancements:
  - The libdbus 1.8 dependency means we can now document that
    dbus_g_thread_init() is idempotent and thread-safe
    (fdo#54770).
  - Use g_cclosure_marshal_generic for all marshalling
    (fdo#64214).
  + Fixes:
  - Allow timeouts to be migrated from one main context to
    another without an assertion failure (fdo#30574).
  - Don't trip a libdbus fatal warning if a Unix fd or other
    unsupported type is encountered in a message (fdo#80557).
  - Make the tests pass with newer GLib by not removing removed
    sources (fdo#83530).
  - Fix some typos in the documentation (fdo#45686).
  - Make the Autotools setup less awful (fdo#58698).</changelog>
  <changelog author="zaitor@opensuse.org" date="1476273600">- Update to version 0.108:
  + Use dbus-run-session instead of dbus-launch for tests.
- Changes from version 0.106:
  + Stop testing G_HAVE_INLINE, which ceased to work in GLib 2.47.2
    and wasn't meant to be API anyway. Instead, rely on "static
    inline" doing the right thing. On pre-C99 compilers, this
    relies on &lt;glib.h&gt; defining inline to __inline, __inline__ or
    the empty string if the compiler requires it, which it has done
    since 2000. (fdo#93513).
  + Stop calling g_mem_profile() in the tests, which no longer does
    anything and caused the tests to fail by issuing a warning.
  + Slightly modernize build system, and remove a weird
    cross-directory dependency which was breaking distcheck.
  + Stop distributing generated marshallers in the tarball.
- Run spec-clean, modernize spec-file macros and also drop a no
  longer conditional dbus-1-glib-64bit Obsoletes.</changelog>
  <changelog author="zaitor@opensuse.org" date="1476964800">- Split out dbus-binding-tool in own sub-package.</changelog>
  <changelog author="meissner@suse.com" date="1497009600">- remove CFLAGS setting, -fstack-protector is default and -fPIC
  will be auto-selected.</changelog>
  <changelog author="elimat@opensuse.org" date="1594382400">- Update to version 0.110:
  Dependencies:
  + GLib 2.40 is required
  Enhancements:
  + The GLib main-loop glue, "dbus-gmain", is now available as a separate
    subproject (the dbus-gmain branch in dbus-glib's git repository) for
    embedding in larger projects like dbus-glib and dbus-python via the
    `git subtree` or `git submodule` commands. This removes dbus-python's
    dependency on the rest of dbus-glib.
  Fixes:
  + autogen.sh can now detect gtk-doc &gt;= 1.26.
  + More files have per-file copyright information.
- Run spec-cleaner</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1637755200">- Update to version 0.112:
  + Dependencies:
  - dbus 1.8 was already required, but is more strongly required
    now: the workarounds that were used to run continuous
    integration with dbus 1.6 on Ubuntu 14.04 'trusty' have been
    removed. (Note that dbus 1.8 has already reached end-of-life
    for security support, and newer dbus stable branches are
    strongly recommended.)
  - pkg-config 0.28 is required when building from git.
  + Enhancements:
  - Rewrite CONTRIBUTING.md document, based on Wayland's
    equivalent.
  - A generated ChangeLog file, which made up a significant
    proportion of the size of source tarball releases, is no
    longer included.
  - Improve man page.
  - Add test coverage for fdo#80557
  - Use more modern GLib assertions in unit tests.
  - Improve continuous integration to be run by GitLab in
    addition to Travis-CI.
  - Add clearer license information using
    SPDX-License-Identifier.
  + Fixes:
  - Allow glib-genmarshal to be overridden with
    `./configure GLIB_GENMARSHAL=/path/to/glib-genmarshal`, for
    cross-compilation.
  - Avoid a double-free in dbus-binding-tool for certain inputs,
    possibly involving nested introspection data structures.
  - Report a better error for excessive recursion depth or
    unsupported data types.
  - Map the 15 most-recently-added DBusGError members to their
    corresponding D-Bus error names.
  - Mark all documented symbols as deprecated.
  - Fix unit test failures during distcheck by enabling
    assertions.
  - Fix a core dump during installed-tests by not attempting to
    close a shared DBusConnection.
- Package COPYING as license, CONTRIBUTING.md and NEWS as docs.
- Add explicit pkgconfig BuildRequires.
- Replace dbus-1-devel and glib2-devel with pkgconfig variants that
  configure checks for: pkgconfig(dbus-1), pkgconfig(glib-2.0),
  pkgconfig(gobject-2.0) and pkgconfig(gio-2.0) BuildRequires.
- Drop hard Requires and BuildRequires that are not needed as they
  are added automatically.
- Split out bash-completion sub-package.
- Split out shared library into own sub-package, and Require it
  from the devel package, and add to the baselibs.conf. Following
  the SLPP standard. Add Provides and Obsoletes for the no longer
  existing main package.
- Use ldconfig_scriptlets for post(un) handling.
- Add soname define, ease future updates.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1638360000">- Add signature and keyring as sources, verify tarball with gpg.</changelog>
  <changelog author="dimstar@opensuse.org" date="1638964800">- Add relevant dbus-1-glib-&lt;targettype&gt; provides/obsoletes also in
  baselibs.conf (boo#1193502).</changelog>
  <changelog author="dimstar@opensuse.org" date="1667390400">- Try to guard against incomplete update stacks (boo#1202241):
  + Add split-provides to libdbus-1-glib and bash-completion
    sub-package.
  + Add explicit conflict to bash-completion subpackage against
    dbus-1-glib &lt; 0.112 (when the package split happened)
  + Ensure dbus-1-glib-tool gets the correct library version
    installed.</changelog>
</package>
<package pkgid="aa5a6cef542b51c14cc232062f2b372eaf7d92c387dd2a0b1c7de66b3ad39dad" name="dbus-1-glib-devel" arch="s390x">
  <version epoch="0" ver="0.112" rel="150600.3.2.1"/>
  <changelog author="zaitor@opensuse.org" date="1392552000">- Update to version 0.102:
  + Enhancements:
  - Add dbus_g_method_invocation_get_connection (fdo#55729).
  - Add dbus_g_connection_open_private (fdo#55730).
  - Better regression tests (fdo#23633, fdo#40711, fdo#41129,
    fdo#51511, fdo#68603).
  - Get rid of more dead code (fdo#40711).
  - dbus-binding-tool: check validity of names (fdo#7909).
  + Bugs fixed:
  - dbus_g_value_build_g_variant: treat GValues containing
    (G_TYPE_STRING, NULL) or (G_TYPE_STRV, NULL) as empty string
    or empty array instead of asserting (fdo#71811).
  - Upload documentation correctly.
  - Fix under-linking (fdo#68601).
- Remove the exacutable bit from dbus-bash-completion.sh.</changelog>
  <changelog author="zaitor@opensuse.org" date="1432987200">- Update to version 0.104:
  + Deprecations: Document the entire library as deprecated.
  + Dependencies:
  - libdbus 1.8 is required.
  - GLib 2.32 is required.
  + Enhancements:
  - The libdbus 1.8 dependency means we can now document that
    dbus_g_thread_init() is idempotent and thread-safe
    (fdo#54770).
  - Use g_cclosure_marshal_generic for all marshalling
    (fdo#64214).
  + Fixes:
  - Allow timeouts to be migrated from one main context to
    another without an assertion failure (fdo#30574).
  - Don't trip a libdbus fatal warning if a Unix fd or other
    unsupported type is encountered in a message (fdo#80557).
  - Make the tests pass with newer GLib by not removing removed
    sources (fdo#83530).
  - Fix some typos in the documentation (fdo#45686).
  - Make the Autotools setup less awful (fdo#58698).</changelog>
  <changelog author="zaitor@opensuse.org" date="1476273600">- Update to version 0.108:
  + Use dbus-run-session instead of dbus-launch for tests.
- Changes from version 0.106:
  + Stop testing G_HAVE_INLINE, which ceased to work in GLib 2.47.2
    and wasn't meant to be API anyway. Instead, rely on "static
    inline" doing the right thing. On pre-C99 compilers, this
    relies on &lt;glib.h&gt; defining inline to __inline, __inline__ or
    the empty string if the compiler requires it, which it has done
    since 2000. (fdo#93513).
  + Stop calling g_mem_profile() in the tests, which no longer does
    anything and caused the tests to fail by issuing a warning.
  + Slightly modernize build system, and remove a weird
    cross-directory dependency which was breaking distcheck.
  + Stop distributing generated marshallers in the tarball.
- Run spec-clean, modernize spec-file macros and also drop a no
  longer conditional dbus-1-glib-64bit Obsoletes.</changelog>
  <changelog author="zaitor@opensuse.org" date="1476964800">- Split out dbus-binding-tool in own sub-package.</changelog>
  <changelog author="meissner@suse.com" date="1497009600">- remove CFLAGS setting, -fstack-protector is default and -fPIC
  will be auto-selected.</changelog>
  <changelog author="elimat@opensuse.org" date="1594382400">- Update to version 0.110:
  Dependencies:
  + GLib 2.40 is required
  Enhancements:
  + The GLib main-loop glue, "dbus-gmain", is now available as a separate
    subproject (the dbus-gmain branch in dbus-glib's git repository) for
    embedding in larger projects like dbus-glib and dbus-python via the
    `git subtree` or `git submodule` commands. This removes dbus-python's
    dependency on the rest of dbus-glib.
  Fixes:
  + autogen.sh can now detect gtk-doc &gt;= 1.26.
  + More files have per-file copyright information.
- Run spec-cleaner</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1637755200">- Update to version 0.112:
  + Dependencies:
  - dbus 1.8 was already required, but is more strongly required
    now: the workarounds that were used to run continuous
    integration with dbus 1.6 on Ubuntu 14.04 'trusty' have been
    removed. (Note that dbus 1.8 has already reached end-of-life
    for security support, and newer dbus stable branches are
    strongly recommended.)
  - pkg-config 0.28 is required when building from git.
  + Enhancements:
  - Rewrite CONTRIBUTING.md document, based on Wayland's
    equivalent.
  - A generated ChangeLog file, which made up a significant
    proportion of the size of source tarball releases, is no
    longer included.
  - Improve man page.
  - Add test coverage for fdo#80557
  - Use more modern GLib assertions in unit tests.
  - Improve continuous integration to be run by GitLab in
    addition to Travis-CI.
  - Add clearer license information using
    SPDX-License-Identifier.
  + Fixes:
  - Allow glib-genmarshal to be overridden with
    `./configure GLIB_GENMARSHAL=/path/to/glib-genmarshal`, for
    cross-compilation.
  - Avoid a double-free in dbus-binding-tool for certain inputs,
    possibly involving nested introspection data structures.
  - Report a better error for excessive recursion depth or
    unsupported data types.
  - Map the 15 most-recently-added DBusGError members to their
    corresponding D-Bus error names.
  - Mark all documented symbols as deprecated.
  - Fix unit test failures during distcheck by enabling
    assertions.
  - Fix a core dump during installed-tests by not attempting to
    close a shared DBusConnection.
- Package COPYING as license, CONTRIBUTING.md and NEWS as docs.
- Add explicit pkgconfig BuildRequires.
- Replace dbus-1-devel and glib2-devel with pkgconfig variants that
  configure checks for: pkgconfig(dbus-1), pkgconfig(glib-2.0),
  pkgconfig(gobject-2.0) and pkgconfig(gio-2.0) BuildRequires.
- Drop hard Requires and BuildRequires that are not needed as they
  are added automatically.
- Split out bash-completion sub-package.
- Split out shared library into own sub-package, and Require it
  from the devel package, and add to the baselibs.conf. Following
  the SLPP standard. Add Provides and Obsoletes for the no longer
  existing main package.
- Use ldconfig_scriptlets for post(un) handling.
- Add soname define, ease future updates.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1638360000">- Add signature and keyring as sources, verify tarball with gpg.</changelog>
  <changelog author="dimstar@opensuse.org" date="1638964800">- Add relevant dbus-1-glib-&lt;targettype&gt; provides/obsoletes also in
  baselibs.conf (boo#1193502).</changelog>
  <changelog author="dimstar@opensuse.org" date="1667390400">- Try to guard against incomplete update stacks (boo#1202241):
  + Add split-provides to libdbus-1-glib and bash-completion
    sub-package.
  + Add explicit conflict to bash-completion subpackage against
    dbus-1-glib &lt; 0.112 (when the package split happened)
  + Ensure dbus-1-glib-tool gets the correct library version
    installed.</changelog>
</package>
<package pkgid="95416a6b170b886604a820712f768c1b5df13413a0b16797630586275e1cd633" name="dbus-1-glib-devel" arch="x86_64">
  <version epoch="0" ver="0.112" rel="150600.3.2.1"/>
  <changelog author="zaitor@opensuse.org" date="1392552000">- Update to version 0.102:
  + Enhancements:
  - Add dbus_g_method_invocation_get_connection (fdo#55729).
  - Add dbus_g_connection_open_private (fdo#55730).
  - Better regression tests (fdo#23633, fdo#40711, fdo#41129,
    fdo#51511, fdo#68603).
  - Get rid of more dead code (fdo#40711).
  - dbus-binding-tool: check validity of names (fdo#7909).
  + Bugs fixed:
  - dbus_g_value_build_g_variant: treat GValues containing
    (G_TYPE_STRING, NULL) or (G_TYPE_STRV, NULL) as empty string
    or empty array instead of asserting (fdo#71811).
  - Upload documentation correctly.
  - Fix under-linking (fdo#68601).
- Remove the exacutable bit from dbus-bash-completion.sh.</changelog>
  <changelog author="zaitor@opensuse.org" date="1432987200">- Update to version 0.104:
  + Deprecations: Document the entire library as deprecated.
  + Dependencies:
  - libdbus 1.8 is required.
  - GLib 2.32 is required.
  + Enhancements:
  - The libdbus 1.8 dependency means we can now document that
    dbus_g_thread_init() is idempotent and thread-safe
    (fdo#54770).
  - Use g_cclosure_marshal_generic for all marshalling
    (fdo#64214).
  + Fixes:
  - Allow timeouts to be migrated from one main context to
    another without an assertion failure (fdo#30574).
  - Don't trip a libdbus fatal warning if a Unix fd or other
    unsupported type is encountered in a message (fdo#80557).
  - Make the tests pass with newer GLib by not removing removed
    sources (fdo#83530).
  - Fix some typos in the documentation (fdo#45686).
  - Make the Autotools setup less awful (fdo#58698).</changelog>
  <changelog author="zaitor@opensuse.org" date="1476273600">- Update to version 0.108:
  + Use dbus-run-session instead of dbus-launch for tests.
- Changes from version 0.106:
  + Stop testing G_HAVE_INLINE, which ceased to work in GLib 2.47.2
    and wasn't meant to be API anyway. Instead, rely on "static
    inline" doing the right thing. On pre-C99 compilers, this
    relies on &lt;glib.h&gt; defining inline to __inline, __inline__ or
    the empty string if the compiler requires it, which it has done
    since 2000. (fdo#93513).
  + Stop calling g_mem_profile() in the tests, which no longer does
    anything and caused the tests to fail by issuing a warning.
  + Slightly modernize build system, and remove a weird
    cross-directory dependency which was breaking distcheck.
  + Stop distributing generated marshallers in the tarball.
- Run spec-clean, modernize spec-file macros and also drop a no
  longer conditional dbus-1-glib-64bit Obsoletes.</changelog>
  <changelog author="zaitor@opensuse.org" date="1476964800">- Split out dbus-binding-tool in own sub-package.</changelog>
  <changelog author="meissner@suse.com" date="1497009600">- remove CFLAGS setting, -fstack-protector is default and -fPIC
  will be auto-selected.</changelog>
  <changelog author="elimat@opensuse.org" date="1594382400">- Update to version 0.110:
  Dependencies:
  + GLib 2.40 is required
  Enhancements:
  + The GLib main-loop glue, "dbus-gmain", is now available as a separate
    subproject (the dbus-gmain branch in dbus-glib's git repository) for
    embedding in larger projects like dbus-glib and dbus-python via the
    `git subtree` or `git submodule` commands. This removes dbus-python's
    dependency on the rest of dbus-glib.
  Fixes:
  + autogen.sh can now detect gtk-doc &gt;= 1.26.
  + More files have per-file copyright information.
- Run spec-cleaner</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1637755200">- Update to version 0.112:
  + Dependencies:
  - dbus 1.8 was already required, but is more strongly required
    now: the workarounds that were used to run continuous
    integration with dbus 1.6 on Ubuntu 14.04 'trusty' have been
    removed. (Note that dbus 1.8 has already reached end-of-life
    for security support, and newer dbus stable branches are
    strongly recommended.)
  - pkg-config 0.28 is required when building from git.
  + Enhancements:
  - Rewrite CONTRIBUTING.md document, based on Wayland's
    equivalent.
  - A generated ChangeLog file, which made up a significant
    proportion of the size of source tarball releases, is no
    longer included.
  - Improve man page.
  - Add test coverage for fdo#80557
  - Use more modern GLib assertions in unit tests.
  - Improve continuous integration to be run by GitLab in
    addition to Travis-CI.
  - Add clearer license information using
    SPDX-License-Identifier.
  + Fixes:
  - Allow glib-genmarshal to be overridden with
    `./configure GLIB_GENMARSHAL=/path/to/glib-genmarshal`, for
    cross-compilation.
  - Avoid a double-free in dbus-binding-tool for certain inputs,
    possibly involving nested introspection data structures.
  - Report a better error for excessive recursion depth or
    unsupported data types.
  - Map the 15 most-recently-added DBusGError members to their
    corresponding D-Bus error names.
  - Mark all documented symbols as deprecated.
  - Fix unit test failures during distcheck by enabling
    assertions.
  - Fix a core dump during installed-tests by not attempting to
    close a shared DBusConnection.
- Package COPYING as license, CONTRIBUTING.md and NEWS as docs.
- Add explicit pkgconfig BuildRequires.
- Replace dbus-1-devel and glib2-devel with pkgconfig variants that
  configure checks for: pkgconfig(dbus-1), pkgconfig(glib-2.0),
  pkgconfig(gobject-2.0) and pkgconfig(gio-2.0) BuildRequires.
- Drop hard Requires and BuildRequires that are not needed as they
  are added automatically.
- Split out bash-completion sub-package.
- Split out shared library into own sub-package, and Require it
  from the devel package, and add to the baselibs.conf. Following
  the SLPP standard. Add Provides and Obsoletes for the no longer
  existing main package.
- Use ldconfig_scriptlets for post(un) handling.
- Add soname define, ease future updates.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1638360000">- Add signature and keyring as sources, verify tarball with gpg.</changelog>
  <changelog author="dimstar@opensuse.org" date="1638964800">- Add relevant dbus-1-glib-&lt;targettype&gt; provides/obsoletes also in
  baselibs.conf (boo#1193502).</changelog>
  <changelog author="dimstar@opensuse.org" date="1667390400">- Try to guard against incomplete update stacks (boo#1202241):
  + Add split-provides to libdbus-1-glib and bash-completion
    sub-package.
  + Add explicit conflict to bash-completion subpackage against
    dbus-1-glib &lt; 0.112 (when the package split happened)
  + Ensure dbus-1-glib-tool gets the correct library version
    installed.</changelog>
</package>
<package pkgid="e4aceb69ce1dea96dd42419c9c160983ad54bb823eaa07e936ecdef563225f51" name="dbus-1-glib-devel-32bit" arch="x86_64">
  <version epoch="0" ver="0.112" rel="150600.3.2.1"/>
  <changelog author="zaitor@opensuse.org" date="1392552000">- Update to version 0.102:
  + Enhancements:
  - Add dbus_g_method_invocation_get_connection (fdo#55729).
  - Add dbus_g_connection_open_private (fdo#55730).
  - Better regression tests (fdo#23633, fdo#40711, fdo#41129,
    fdo#51511, fdo#68603).
  - Get rid of more dead code (fdo#40711).
  - dbus-binding-tool: check validity of names (fdo#7909).
  + Bugs fixed:
  - dbus_g_value_build_g_variant: treat GValues containing
    (G_TYPE_STRING, NULL) or (G_TYPE_STRV, NULL) as empty string
    or empty array instead of asserting (fdo#71811).
  - Upload documentation correctly.
  - Fix under-linking (fdo#68601).
- Remove the exacutable bit from dbus-bash-completion.sh.</changelog>
  <changelog author="zaitor@opensuse.org" date="1432987200">- Update to version 0.104:
  + Deprecations: Document the entire library as deprecated.
  + Dependencies:
  - libdbus 1.8 is required.
  - GLib 2.32 is required.
  + Enhancements:
  - The libdbus 1.8 dependency means we can now document that
    dbus_g_thread_init() is idempotent and thread-safe
    (fdo#54770).
  - Use g_cclosure_marshal_generic for all marshalling
    (fdo#64214).
  + Fixes:
  - Allow timeouts to be migrated from one main context to
    another without an assertion failure (fdo#30574).
  - Don't trip a libdbus fatal warning if a Unix fd or other
    unsupported type is encountered in a message (fdo#80557).
  - Make the tests pass with newer GLib by not removing removed
    sources (fdo#83530).
  - Fix some typos in the documentation (fdo#45686).
  - Make the Autotools setup less awful (fdo#58698).</changelog>
  <changelog author="zaitor@opensuse.org" date="1476273600">- Update to version 0.108:
  + Use dbus-run-session instead of dbus-launch for tests.
- Changes from version 0.106:
  + Stop testing G_HAVE_INLINE, which ceased to work in GLib 2.47.2
    and wasn't meant to be API anyway. Instead, rely on "static
    inline" doing the right thing. On pre-C99 compilers, this
    relies on &lt;glib.h&gt; defining inline to __inline, __inline__ or
    the empty string if the compiler requires it, which it has done
    since 2000. (fdo#93513).
  + Stop calling g_mem_profile() in the tests, which no longer does
    anything and caused the tests to fail by issuing a warning.
  + Slightly modernize build system, and remove a weird
    cross-directory dependency which was breaking distcheck.
  + Stop distributing generated marshallers in the tarball.
- Run spec-clean, modernize spec-file macros and also drop a no
  longer conditional dbus-1-glib-64bit Obsoletes.</changelog>
  <changelog author="zaitor@opensuse.org" date="1476964800">- Split out dbus-binding-tool in own sub-package.</changelog>
  <changelog author="meissner@suse.com" date="1497009600">- remove CFLAGS setting, -fstack-protector is default and -fPIC
  will be auto-selected.</changelog>
  <changelog author="elimat@opensuse.org" date="1594382400">- Update to version 0.110:
  Dependencies:
  + GLib 2.40 is required
  Enhancements:
  + The GLib main-loop glue, "dbus-gmain", is now available as a separate
    subproject (the dbus-gmain branch in dbus-glib's git repository) for
    embedding in larger projects like dbus-glib and dbus-python via the
    `git subtree` or `git submodule` commands. This removes dbus-python's
    dependency on the rest of dbus-glib.
  Fixes:
  + autogen.sh can now detect gtk-doc &gt;= 1.26.
  + More files have per-file copyright information.
- Run spec-cleaner</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1637755200">- Update to version 0.112:
  + Dependencies:
  - dbus 1.8 was already required, but is more strongly required
    now: the workarounds that were used to run continuous
    integration with dbus 1.6 on Ubuntu 14.04 'trusty' have been
    removed. (Note that dbus 1.8 has already reached end-of-life
    for security support, and newer dbus stable branches are
    strongly recommended.)
  - pkg-config 0.28 is required when building from git.
  + Enhancements:
  - Rewrite CONTRIBUTING.md document, based on Wayland's
    equivalent.
  - A generated ChangeLog file, which made up a significant
    proportion of the size of source tarball releases, is no
    longer included.
  - Improve man page.
  - Add test coverage for fdo#80557
  - Use more modern GLib assertions in unit tests.
  - Improve continuous integration to be run by GitLab in
    addition to Travis-CI.
  - Add clearer license information using
    SPDX-License-Identifier.
  + Fixes:
  - Allow glib-genmarshal to be overridden with
    `./configure GLIB_GENMARSHAL=/path/to/glib-genmarshal`, for
    cross-compilation.
  - Avoid a double-free in dbus-binding-tool for certain inputs,
    possibly involving nested introspection data structures.
  - Report a better error for excessive recursion depth or
    unsupported data types.
  - Map the 15 most-recently-added DBusGError members to their
    corresponding D-Bus error names.
  - Mark all documented symbols as deprecated.
  - Fix unit test failures during distcheck by enabling
    assertions.
  - Fix a core dump during installed-tests by not attempting to
    close a shared DBusConnection.
- Package COPYING as license, CONTRIBUTING.md and NEWS as docs.
- Add explicit pkgconfig BuildRequires.
- Replace dbus-1-devel and glib2-devel with pkgconfig variants that
  configure checks for: pkgconfig(dbus-1), pkgconfig(glib-2.0),
  pkgconfig(gobject-2.0) and pkgconfig(gio-2.0) BuildRequires.
- Drop hard Requires and BuildRequires that are not needed as they
  are added automatically.
- Split out bash-completion sub-package.
- Split out shared library into own sub-package, and Require it
  from the devel package, and add to the baselibs.conf. Following
  the SLPP standard. Add Provides and Obsoletes for the no longer
  existing main package.
- Use ldconfig_scriptlets for post(un) handling.
- Add soname define, ease future updates.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1638360000">- Add signature and keyring as sources, verify tarball with gpg.</changelog>
  <changelog author="dimstar@opensuse.org" date="1638964800">- Add relevant dbus-1-glib-&lt;targettype&gt; provides/obsoletes also in
  baselibs.conf (boo#1193502).</changelog>
  <changelog author="dimstar@opensuse.org" date="1667390400">- Try to guard against incomplete update stacks (boo#1202241):
  + Add split-provides to libdbus-1-glib and bash-completion
    sub-package.
  + Add explicit conflict to bash-completion subpackage against
    dbus-1-glib &lt; 0.112 (when the package split happened)
  + Ensure dbus-1-glib-tool gets the correct library version
    installed.</changelog>
</package>
<package pkgid="6139e1ec307b05f802157ec91e931617b4e6c9a636dcb9f4d36bfc8920e995bc" name="dbus-1-glib-doc" arch="noarch">
  <version epoch="0" ver="0.112" rel="150600.3.2.1"/>
  <changelog author="zaitor@opensuse.org" date="1392552000">- Update to version 0.102:
  + Enhancements:
  - Add dbus_g_method_invocation_get_connection (fdo#55729).
  - Add dbus_g_connection_open_private (fdo#55730).
  - Better regression tests (fdo#23633, fdo#40711, fdo#41129,
    fdo#51511, fdo#68603).
  - Get rid of more dead code (fdo#40711).
  - dbus-binding-tool: check validity of names (fdo#7909).
  + Bugs fixed:
  - dbus_g_value_build_g_variant: treat GValues containing
    (G_TYPE_STRING, NULL) or (G_TYPE_STRV, NULL) as empty string
    or empty array instead of asserting (fdo#71811).
  - Upload documentation correctly.
  - Fix under-linking (fdo#68601).
- Remove the exacutable bit from dbus-bash-completion.sh.</changelog>
  <changelog author="zaitor@opensuse.org" date="1432987200">- Update to version 0.104:
  + Deprecations: Document the entire library as deprecated.
  + Dependencies:
  - libdbus 1.8 is required.
  - GLib 2.32 is required.
  + Enhancements:
  - The libdbus 1.8 dependency means we can now document that
    dbus_g_thread_init() is idempotent and thread-safe
    (fdo#54770).
  - Use g_cclosure_marshal_generic for all marshalling
    (fdo#64214).
  + Fixes:
  - Allow timeouts to be migrated from one main context to
    another without an assertion failure (fdo#30574).
  - Don't trip a libdbus fatal warning if a Unix fd or other
    unsupported type is encountered in a message (fdo#80557).
  - Make the tests pass with newer GLib by not removing removed
    sources (fdo#83530).
  - Fix some typos in the documentation (fdo#45686).
  - Make the Autotools setup less awful (fdo#58698).</changelog>
  <changelog author="zaitor@opensuse.org" date="1476273600">- Update to version 0.108:
  + Use dbus-run-session instead of dbus-launch for tests.
- Changes from version 0.106:
  + Stop testing G_HAVE_INLINE, which ceased to work in GLib 2.47.2
    and wasn't meant to be API anyway. Instead, rely on "static
    inline" doing the right thing. On pre-C99 compilers, this
    relies on &lt;glib.h&gt; defining inline to __inline, __inline__ or
    the empty string if the compiler requires it, which it has done
    since 2000. (fdo#93513).
  + Stop calling g_mem_profile() in the tests, which no longer does
    anything and caused the tests to fail by issuing a warning.
  + Slightly modernize build system, and remove a weird
    cross-directory dependency which was breaking distcheck.
  + Stop distributing generated marshallers in the tarball.
- Run spec-clean, modernize spec-file macros and also drop a no
  longer conditional dbus-1-glib-64bit Obsoletes.</changelog>
  <changelog author="zaitor@opensuse.org" date="1476964800">- Split out dbus-binding-tool in own sub-package.</changelog>
  <changelog author="meissner@suse.com" date="1497009600">- remove CFLAGS setting, -fstack-protector is default and -fPIC
  will be auto-selected.</changelog>
  <changelog author="elimat@opensuse.org" date="1594382400">- Update to version 0.110:
  Dependencies:
  + GLib 2.40 is required
  Enhancements:
  + The GLib main-loop glue, "dbus-gmain", is now available as a separate
    subproject (the dbus-gmain branch in dbus-glib's git repository) for
    embedding in larger projects like dbus-glib and dbus-python via the
    `git subtree` or `git submodule` commands. This removes dbus-python's
    dependency on the rest of dbus-glib.
  Fixes:
  + autogen.sh can now detect gtk-doc &gt;= 1.26.
  + More files have per-file copyright information.
- Run spec-cleaner</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1637755200">- Update to version 0.112:
  + Dependencies:
  - dbus 1.8 was already required, but is more strongly required
    now: the workarounds that were used to run continuous
    integration with dbus 1.6 on Ubuntu 14.04 'trusty' have been
    removed. (Note that dbus 1.8 has already reached end-of-life
    for security support, and newer dbus stable branches are
    strongly recommended.)
  - pkg-config 0.28 is required when building from git.
  + Enhancements:
  - Rewrite CONTRIBUTING.md document, based on Wayland's
    equivalent.
  - A generated ChangeLog file, which made up a significant
    proportion of the size of source tarball releases, is no
    longer included.
  - Improve man page.
  - Add test coverage for fdo#80557
  - Use more modern GLib assertions in unit tests.
  - Improve continuous integration to be run by GitLab in
    addition to Travis-CI.
  - Add clearer license information using
    SPDX-License-Identifier.
  + Fixes:
  - Allow glib-genmarshal to be overridden with
    `./configure GLIB_GENMARSHAL=/path/to/glib-genmarshal`, for
    cross-compilation.
  - Avoid a double-free in dbus-binding-tool for certain inputs,
    possibly involving nested introspection data structures.
  - Report a better error for excessive recursion depth or
    unsupported data types.
  - Map the 15 most-recently-added DBusGError members to their
    corresponding D-Bus error names.
  - Mark all documented symbols as deprecated.
  - Fix unit test failures during distcheck by enabling
    assertions.
  - Fix a core dump during installed-tests by not attempting to
    close a shared DBusConnection.
- Package COPYING as license, CONTRIBUTING.md and NEWS as docs.
- Add explicit pkgconfig BuildRequires.
- Replace dbus-1-devel and glib2-devel with pkgconfig variants that
  configure checks for: pkgconfig(dbus-1), pkgconfig(glib-2.0),
  pkgconfig(gobject-2.0) and pkgconfig(gio-2.0) BuildRequires.
- Drop hard Requires and BuildRequires that are not needed as they
  are added automatically.
- Split out bash-completion sub-package.
- Split out shared library into own sub-package, and Require it
  from the devel package, and add to the baselibs.conf. Following
  the SLPP standard. Add Provides and Obsoletes for the no longer
  existing main package.
- Use ldconfig_scriptlets for post(un) handling.
- Add soname define, ease future updates.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1638360000">- Add signature and keyring as sources, verify tarball with gpg.</changelog>
  <changelog author="dimstar@opensuse.org" date="1638964800">- Add relevant dbus-1-glib-&lt;targettype&gt; provides/obsoletes also in
  baselibs.conf (boo#1193502).</changelog>
  <changelog author="dimstar@opensuse.org" date="1667390400">- Try to guard against incomplete update stacks (boo#1202241):
  + Add split-provides to libdbus-1-glib and bash-completion
    sub-package.
  + Add explicit conflict to bash-completion subpackage against
    dbus-1-glib &lt; 0.112 (when the package split happened)
  + Ensure dbus-1-glib-tool gets the correct library version
    installed.</changelog>
</package>
<package pkgid="bda4eb60d2e43f6c56626fda581587b99e0e2d3714a326cf0cbc80415d6ee6cf" name="dbus-1-glib-tool" arch="aarch64">
  <version epoch="0" ver="0.112" rel="150600.3.2.1"/>
  <changelog author="zaitor@opensuse.org" date="1392552000">- Update to version 0.102:
  + Enhancements:
  - Add dbus_g_method_invocation_get_connection (fdo#55729).
  - Add dbus_g_connection_open_private (fdo#55730).
  - Better regression tests (fdo#23633, fdo#40711, fdo#41129,
    fdo#51511, fdo#68603).
  - Get rid of more dead code (fdo#40711).
  - dbus-binding-tool: check validity of names (fdo#7909).
  + Bugs fixed:
  - dbus_g_value_build_g_variant: treat GValues containing
    (G_TYPE_STRING, NULL) or (G_TYPE_STRV, NULL) as empty string
    or empty array instead of asserting (fdo#71811).
  - Upload documentation correctly.
  - Fix under-linking (fdo#68601).
- Remove the exacutable bit from dbus-bash-completion.sh.</changelog>
  <changelog author="zaitor@opensuse.org" date="1432987200">- Update to version 0.104:
  + Deprecations: Document the entire library as deprecated.
  + Dependencies:
  - libdbus 1.8 is required.
  - GLib 2.32 is required.
  + Enhancements:
  - The libdbus 1.8 dependency means we can now document that
    dbus_g_thread_init() is idempotent and thread-safe
    (fdo#54770).
  - Use g_cclosure_marshal_generic for all marshalling
    (fdo#64214).
  + Fixes:
  - Allow timeouts to be migrated from one main context to
    another without an assertion failure (fdo#30574).
  - Don't trip a libdbus fatal warning if a Unix fd or other
    unsupported type is encountered in a message (fdo#80557).
  - Make the tests pass with newer GLib by not removing removed
    sources (fdo#83530).
  - Fix some typos in the documentation (fdo#45686).
  - Make the Autotools setup less awful (fdo#58698).</changelog>
  <changelog author="zaitor@opensuse.org" date="1476273600">- Update to version 0.108:
  + Use dbus-run-session instead of dbus-launch for tests.
- Changes from version 0.106:
  + Stop testing G_HAVE_INLINE, which ceased to work in GLib 2.47.2
    and wasn't meant to be API anyway. Instead, rely on "static
    inline" doing the right thing. On pre-C99 compilers, this
    relies on &lt;glib.h&gt; defining inline to __inline, __inline__ or
    the empty string if the compiler requires it, which it has done
    since 2000. (fdo#93513).
  + Stop calling g_mem_profile() in the tests, which no longer does
    anything and caused the tests to fail by issuing a warning.
  + Slightly modernize build system, and remove a weird
    cross-directory dependency which was breaking distcheck.
  + Stop distributing generated marshallers in the tarball.
- Run spec-clean, modernize spec-file macros and also drop a no
  longer conditional dbus-1-glib-64bit Obsoletes.</changelog>
  <changelog author="zaitor@opensuse.org" date="1476964800">- Split out dbus-binding-tool in own sub-package.</changelog>
  <changelog author="meissner@suse.com" date="1497009600">- remove CFLAGS setting, -fstack-protector is default and -fPIC
  will be auto-selected.</changelog>
  <changelog author="elimat@opensuse.org" date="1594382400">- Update to version 0.110:
  Dependencies:
  + GLib 2.40 is required
  Enhancements:
  + The GLib main-loop glue, "dbus-gmain", is now available as a separate
    subproject (the dbus-gmain branch in dbus-glib's git repository) for
    embedding in larger projects like dbus-glib and dbus-python via the
    `git subtree` or `git submodule` commands. This removes dbus-python's
    dependency on the rest of dbus-glib.
  Fixes:
  + autogen.sh can now detect gtk-doc &gt;= 1.26.
  + More files have per-file copyright information.
- Run spec-cleaner</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1637755200">- Update to version 0.112:
  + Dependencies:
  - dbus 1.8 was already required, but is more strongly required
    now: the workarounds that were used to run continuous
    integration with dbus 1.6 on Ubuntu 14.04 'trusty' have been
    removed. (Note that dbus 1.8 has already reached end-of-life
    for security support, and newer dbus stable branches are
    strongly recommended.)
  - pkg-config 0.28 is required when building from git.
  + Enhancements:
  - Rewrite CONTRIBUTING.md document, based on Wayland's
    equivalent.
  - A generated ChangeLog file, which made up a significant
    proportion of the size of source tarball releases, is no
    longer included.
  - Improve man page.
  - Add test coverage for fdo#80557
  - Use more modern GLib assertions in unit tests.
  - Improve continuous integration to be run by GitLab in
    addition to Travis-CI.
  - Add clearer license information using
    SPDX-License-Identifier.
  + Fixes:
  - Allow glib-genmarshal to be overridden with
    `./configure GLIB_GENMARSHAL=/path/to/glib-genmarshal`, for
    cross-compilation.
  - Avoid a double-free in dbus-binding-tool for certain inputs,
    possibly involving nested introspection data structures.
  - Report a better error for excessive recursion depth or
    unsupported data types.
  - Map the 15 most-recently-added DBusGError members to their
    corresponding D-Bus error names.
  - Mark all documented symbols as deprecated.
  - Fix unit test failures during distcheck by enabling
    assertions.
  - Fix a core dump during installed-tests by not attempting to
    close a shared DBusConnection.
- Package COPYING as license, CONTRIBUTING.md and NEWS as docs.
- Add explicit pkgconfig BuildRequires.
- Replace dbus-1-devel and glib2-devel with pkgconfig variants that
  configure checks for: pkgconfig(dbus-1), pkgconfig(glib-2.0),
  pkgconfig(gobject-2.0) and pkgconfig(gio-2.0) BuildRequires.
- Drop hard Requires and BuildRequires that are not needed as they
  are added automatically.
- Split out bash-completion sub-package.
- Split out shared library into own sub-package, and Require it
  from the devel package, and add to the baselibs.conf. Following
  the SLPP standard. Add Provides and Obsoletes for the no longer
  existing main package.
- Use ldconfig_scriptlets for post(un) handling.
- Add soname define, ease future updates.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1638360000">- Add signature and keyring as sources, verify tarball with gpg.</changelog>
  <changelog author="dimstar@opensuse.org" date="1638964800">- Add relevant dbus-1-glib-&lt;targettype&gt; provides/obsoletes also in
  baselibs.conf (boo#1193502).</changelog>
  <changelog author="dimstar@opensuse.org" date="1667390400">- Try to guard against incomplete update stacks (boo#1202241):
  + Add split-provides to libdbus-1-glib and bash-completion
    sub-package.
  + Add explicit conflict to bash-completion subpackage against
    dbus-1-glib &lt; 0.112 (when the package split happened)
  + Ensure dbus-1-glib-tool gets the correct library version
    installed.</changelog>
</package>
<package pkgid="c20fee89f781c7212c5c2b756772155d9230c9241e88ddc9711a52615ec716ac" name="dbus-1-glib-tool" arch="ppc64le">
  <version epoch="0" ver="0.112" rel="150600.3.2.1"/>
  <changelog author="zaitor@opensuse.org" date="1392552000">- Update to version 0.102:
  + Enhancements:
  - Add dbus_g_method_invocation_get_connection (fdo#55729).
  - Add dbus_g_connection_open_private (fdo#55730).
  - Better regression tests (fdo#23633, fdo#40711, fdo#41129,
    fdo#51511, fdo#68603).
  - Get rid of more dead code (fdo#40711).
  - dbus-binding-tool: check validity of names (fdo#7909).
  + Bugs fixed:
  - dbus_g_value_build_g_variant: treat GValues containing
    (G_TYPE_STRING, NULL) or (G_TYPE_STRV, NULL) as empty string
    or empty array instead of asserting (fdo#71811).
  - Upload documentation correctly.
  - Fix under-linking (fdo#68601).
- Remove the exacutable bit from dbus-bash-completion.sh.</changelog>
  <changelog author="zaitor@opensuse.org" date="1432987200">- Update to version 0.104:
  + Deprecations: Document the entire library as deprecated.
  + Dependencies:
  - libdbus 1.8 is required.
  - GLib 2.32 is required.
  + Enhancements:
  - The libdbus 1.8 dependency means we can now document that
    dbus_g_thread_init() is idempotent and thread-safe
    (fdo#54770).
  - Use g_cclosure_marshal_generic for all marshalling
    (fdo#64214).
  + Fixes:
  - Allow timeouts to be migrated from one main context to
    another without an assertion failure (fdo#30574).
  - Don't trip a libdbus fatal warning if a Unix fd or other
    unsupported type is encountered in a message (fdo#80557).
  - Make the tests pass with newer GLib by not removing removed
    sources (fdo#83530).
  - Fix some typos in the documentation (fdo#45686).
  - Make the Autotools setup less awful (fdo#58698).</changelog>
  <changelog author="zaitor@opensuse.org" date="1476273600">- Update to version 0.108:
  + Use dbus-run-session instead of dbus-launch for tests.
- Changes from version 0.106:
  + Stop testing G_HAVE_INLINE, which ceased to work in GLib 2.47.2
    and wasn't meant to be API anyway. Instead, rely on "static
    inline" doing the right thing. On pre-C99 compilers, this
    relies on &lt;glib.h&gt; defining inline to __inline, __inline__ or
    the empty string if the compiler requires it, which it has done
    since 2000. (fdo#93513).
  + Stop calling g_mem_profile() in the tests, which no longer does
    anything and caused the tests to fail by issuing a warning.
  + Slightly modernize build system, and remove a weird
    cross-directory dependency which was breaking distcheck.
  + Stop distributing generated marshallers in the tarball.
- Run spec-clean, modernize spec-file macros and also drop a no
  longer conditional dbus-1-glib-64bit Obsoletes.</changelog>
  <changelog author="zaitor@opensuse.org" date="1476964800">- Split out dbus-binding-tool in own sub-package.</changelog>
  <changelog author="meissner@suse.com" date="1497009600">- remove CFLAGS setting, -fstack-protector is default and -fPIC
  will be auto-selected.</changelog>
  <changelog author="elimat@opensuse.org" date="1594382400">- Update to version 0.110:
  Dependencies:
  + GLib 2.40 is required
  Enhancements:
  + The GLib main-loop glue, "dbus-gmain", is now available as a separate
    subproject (the dbus-gmain branch in dbus-glib's git repository) for
    embedding in larger projects like dbus-glib and dbus-python via the
    `git subtree` or `git submodule` commands. This removes dbus-python's
    dependency on the rest of dbus-glib.
  Fixes:
  + autogen.sh can now detect gtk-doc &gt;= 1.26.
  + More files have per-file copyright information.
- Run spec-cleaner</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1637755200">- Update to version 0.112:
  + Dependencies:
  - dbus 1.8 was already required, but is more strongly required
    now: the workarounds that were used to run continuous
    integration with dbus 1.6 on Ubuntu 14.04 'trusty' have been
    removed. (Note that dbus 1.8 has already reached end-of-life
    for security support, and newer dbus stable branches are
    strongly recommended.)
  - pkg-config 0.28 is required when building from git.
  + Enhancements:
  - Rewrite CONTRIBUTING.md document, based on Wayland's
    equivalent.
  - A generated ChangeLog file, which made up a significant
    proportion of the size of source tarball releases, is no
    longer included.
  - Improve man page.
  - Add test coverage for fdo#80557
  - Use more modern GLib assertions in unit tests.
  - Improve continuous integration to be run by GitLab in
    addition to Travis-CI.
  - Add clearer license information using
    SPDX-License-Identifier.
  + Fixes:
  - Allow glib-genmarshal to be overridden with
    `./configure GLIB_GENMARSHAL=/path/to/glib-genmarshal`, for
    cross-compilation.
  - Avoid a double-free in dbus-binding-tool for certain inputs,
    possibly involving nested introspection data structures.
  - Report a better error for excessive recursion depth or
    unsupported data types.
  - Map the 15 most-recently-added DBusGError members to their
    corresponding D-Bus error names.
  - Mark all documented symbols as deprecated.
  - Fix unit test failures during distcheck by enabling
    assertions.
  - Fix a core dump during installed-tests by not attempting to
    close a shared DBusConnection.
- Package COPYING as license, CONTRIBUTING.md and NEWS as docs.
- Add explicit pkgconfig BuildRequires.
- Replace dbus-1-devel and glib2-devel with pkgconfig variants that
  configure checks for: pkgconfig(dbus-1), pkgconfig(glib-2.0),
  pkgconfig(gobject-2.0) and pkgconfig(gio-2.0) BuildRequires.
- Drop hard Requires and BuildRequires that are not needed as they
  are added automatically.
- Split out bash-completion sub-package.
- Split out shared library into own sub-package, and Require it
  from the devel package, and add to the baselibs.conf. Following
  the SLPP standard. Add Provides and Obsoletes for the no longer
  existing main package.
- Use ldconfig_scriptlets for post(un) handling.
- Add soname define, ease future updates.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1638360000">- Add signature and keyring as sources, verify tarball with gpg.</changelog>
  <changelog author="dimstar@opensuse.org" date="1638964800">- Add relevant dbus-1-glib-&lt;targettype&gt; provides/obsoletes also in
  baselibs.conf (boo#1193502).</changelog>
  <changelog author="dimstar@opensuse.org" date="1667390400">- Try to guard against incomplete update stacks (boo#1202241):
  + Add split-provides to libdbus-1-glib and bash-completion
    sub-package.
  + Add explicit conflict to bash-completion subpackage against
    dbus-1-glib &lt; 0.112 (when the package split happened)
  + Ensure dbus-1-glib-tool gets the correct library version
    installed.</changelog>
</package>
<package pkgid="58e6e4639251bd91ed633362f10a9a27ec0d052c1ab3f8b4ed9bab0c4a07d850" name="dbus-1-glib-tool" arch="s390x">
  <version epoch="0" ver="0.112" rel="150600.3.2.1"/>
  <changelog author="zaitor@opensuse.org" date="1392552000">- Update to version 0.102:
  + Enhancements:
  - Add dbus_g_method_invocation_get_connection (fdo#55729).
  - Add dbus_g_connection_open_private (fdo#55730).
  - Better regression tests (fdo#23633, fdo#40711, fdo#41129,
    fdo#51511, fdo#68603).
  - Get rid of more dead code (fdo#40711).
  - dbus-binding-tool: check validity of names (fdo#7909).
  + Bugs fixed:
  - dbus_g_value_build_g_variant: treat GValues containing
    (G_TYPE_STRING, NULL) or (G_TYPE_STRV, NULL) as empty string
    or empty array instead of asserting (fdo#71811).
  - Upload documentation correctly.
  - Fix under-linking (fdo#68601).
- Remove the exacutable bit from dbus-bash-completion.sh.</changelog>
  <changelog author="zaitor@opensuse.org" date="1432987200">- Update to version 0.104:
  + Deprecations: Document the entire library as deprecated.
  + Dependencies:
  - libdbus 1.8 is required.
  - GLib 2.32 is required.
  + Enhancements:
  - The libdbus 1.8 dependency means we can now document that
    dbus_g_thread_init() is idempotent and thread-safe
    (fdo#54770).
  - Use g_cclosure_marshal_generic for all marshalling
    (fdo#64214).
  + Fixes:
  - Allow timeouts to be migrated from one main context to
    another without an assertion failure (fdo#30574).
  - Don't trip a libdbus fatal warning if a Unix fd or other
    unsupported type is encountered in a message (fdo#80557).
  - Make the tests pass with newer GLib by not removing removed
    sources (fdo#83530).
  - Fix some typos in the documentation (fdo#45686).
  - Make the Autotools setup less awful (fdo#58698).</changelog>
  <changelog author="zaitor@opensuse.org" date="1476273600">- Update to version 0.108:
  + Use dbus-run-session instead of dbus-launch for tests.
- Changes from version 0.106:
  + Stop testing G_HAVE_INLINE, which ceased to work in GLib 2.47.2
    and wasn't meant to be API anyway. Instead, rely on "static
    inline" doing the right thing. On pre-C99 compilers, this
    relies on &lt;glib.h&gt; defining inline to __inline, __inline__ or
    the empty string if the compiler requires it, which it has done
    since 2000. (fdo#93513).
  + Stop calling g_mem_profile() in the tests, which no longer does
    anything and caused the tests to fail by issuing a warning.
  + Slightly modernize build system, and remove a weird
    cross-directory dependency which was breaking distcheck.
  + Stop distributing generated marshallers in the tarball.
- Run spec-clean, modernize spec-file macros and also drop a no
  longer conditional dbus-1-glib-64bit Obsoletes.</changelog>
  <changelog author="zaitor@opensuse.org" date="1476964800">- Split out dbus-binding-tool in own sub-package.</changelog>
  <changelog author="meissner@suse.com" date="1497009600">- remove CFLAGS setting, -fstack-protector is default and -fPIC
  will be auto-selected.</changelog>
  <changelog author="elimat@opensuse.org" date="1594382400">- Update to version 0.110:
  Dependencies:
  + GLib 2.40 is required
  Enhancements:
  + The GLib main-loop glue, "dbus-gmain", is now available as a separate
    subproject (the dbus-gmain branch in dbus-glib's git repository) for
    embedding in larger projects like dbus-glib and dbus-python via the
    `git subtree` or `git submodule` commands. This removes dbus-python's
    dependency on the rest of dbus-glib.
  Fixes:
  + autogen.sh can now detect gtk-doc &gt;= 1.26.
  + More files have per-file copyright information.
- Run spec-cleaner</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1637755200">- Update to version 0.112:
  + Dependencies:
  - dbus 1.8 was already required, but is more strongly required
    now: the workarounds that were used to run continuous
    integration with dbus 1.6 on Ubuntu 14.04 'trusty' have been
    removed. (Note that dbus 1.8 has already reached end-of-life
    for security support, and newer dbus stable branches are
    strongly recommended.)
  - pkg-config 0.28 is required when building from git.
  + Enhancements:
  - Rewrite CONTRIBUTING.md document, based on Wayland's
    equivalent.
  - A generated ChangeLog file, which made up a significant
    proportion of the size of source tarball releases, is no
    longer included.
  - Improve man page.
  - Add test coverage for fdo#80557
  - Use more modern GLib assertions in unit tests.
  - Improve continuous integration to be run by GitLab in
    addition to Travis-CI.
  - Add clearer license information using
    SPDX-License-Identifier.
  + Fixes:
  - Allow glib-genmarshal to be overridden with
    `./configure GLIB_GENMARSHAL=/path/to/glib-genmarshal`, for
    cross-compilation.
  - Avoid a double-free in dbus-binding-tool for certain inputs,
    possibly involving nested introspection data structures.
  - Report a better error for excessive recursion depth or
    unsupported data types.
  - Map the 15 most-recently-added DBusGError members to their
    corresponding D-Bus error names.
  - Mark all documented symbols as deprecated.
  - Fix unit test failures during distcheck by enabling
    assertions.
  - Fix a core dump during installed-tests by not attempting to
    close a shared DBusConnection.
- Package COPYING as license, CONTRIBUTING.md and NEWS as docs.
- Add explicit pkgconfig BuildRequires.
- Replace dbus-1-devel and glib2-devel with pkgconfig variants that
  configure checks for: pkgconfig(dbus-1), pkgconfig(glib-2.0),
  pkgconfig(gobject-2.0) and pkgconfig(gio-2.0) BuildRequires.
- Drop hard Requires and BuildRequires that are not needed as they
  are added automatically.
- Split out bash-completion sub-package.
- Split out shared library into own sub-package, and Require it
  from the devel package, and add to the baselibs.conf. Following
  the SLPP standard. Add Provides and Obsoletes for the no longer
  existing main package.
- Use ldconfig_scriptlets for post(un) handling.
- Add soname define, ease future updates.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1638360000">- Add signature and keyring as sources, verify tarball with gpg.</changelog>
  <changelog author="dimstar@opensuse.org" date="1638964800">- Add relevant dbus-1-glib-&lt;targettype&gt; provides/obsoletes also in
  baselibs.conf (boo#1193502).</changelog>
  <changelog author="dimstar@opensuse.org" date="1667390400">- Try to guard against incomplete update stacks (boo#1202241):
  + Add split-provides to libdbus-1-glib and bash-completion
    sub-package.
  + Add explicit conflict to bash-completion subpackage against
    dbus-1-glib &lt; 0.112 (when the package split happened)
  + Ensure dbus-1-glib-tool gets the correct library version
    installed.</changelog>
</package>
<package pkgid="adcbcae9625022726d02e209ef0a5f2761ce49ecd102aeef83e9d8b504f23166" name="dbus-1-glib-tool" arch="x86_64">
  <version epoch="0" ver="0.112" rel="150600.3.2.1"/>
  <changelog author="zaitor@opensuse.org" date="1392552000">- Update to version 0.102:
  + Enhancements:
  - Add dbus_g_method_invocation_get_connection (fdo#55729).
  - Add dbus_g_connection_open_private (fdo#55730).
  - Better regression tests (fdo#23633, fdo#40711, fdo#41129,
    fdo#51511, fdo#68603).
  - Get rid of more dead code (fdo#40711).
  - dbus-binding-tool: check validity of names (fdo#7909).
  + Bugs fixed:
  - dbus_g_value_build_g_variant: treat GValues containing
    (G_TYPE_STRING, NULL) or (G_TYPE_STRV, NULL) as empty string
    or empty array instead of asserting (fdo#71811).
  - Upload documentation correctly.
  - Fix under-linking (fdo#68601).
- Remove the exacutable bit from dbus-bash-completion.sh.</changelog>
  <changelog author="zaitor@opensuse.org" date="1432987200">- Update to version 0.104:
  + Deprecations: Document the entire library as deprecated.
  + Dependencies:
  - libdbus 1.8 is required.
  - GLib 2.32 is required.
  + Enhancements:
  - The libdbus 1.8 dependency means we can now document that
    dbus_g_thread_init() is idempotent and thread-safe
    (fdo#54770).
  - Use g_cclosure_marshal_generic for all marshalling
    (fdo#64214).
  + Fixes:
  - Allow timeouts to be migrated from one main context to
    another without an assertion failure (fdo#30574).
  - Don't trip a libdbus fatal warning if a Unix fd or other
    unsupported type is encountered in a message (fdo#80557).
  - Make the tests pass with newer GLib by not removing removed
    sources (fdo#83530).
  - Fix some typos in the documentation (fdo#45686).
  - Make the Autotools setup less awful (fdo#58698).</changelog>
  <changelog author="zaitor@opensuse.org" date="1476273600">- Update to version 0.108:
  + Use dbus-run-session instead of dbus-launch for tests.
- Changes from version 0.106:
  + Stop testing G_HAVE_INLINE, which ceased to work in GLib 2.47.2
    and wasn't meant to be API anyway. Instead, rely on "static
    inline" doing the right thing. On pre-C99 compilers, this
    relies on &lt;glib.h&gt; defining inline to __inline, __inline__ or
    the empty string if the compiler requires it, which it has done
    since 2000. (fdo#93513).
  + Stop calling g_mem_profile() in the tests, which no longer does
    anything and caused the tests to fail by issuing a warning.
  + Slightly modernize build system, and remove a weird
    cross-directory dependency which was breaking distcheck.
  + Stop distributing generated marshallers in the tarball.
- Run spec-clean, modernize spec-file macros and also drop a no
  longer conditional dbus-1-glib-64bit Obsoletes.</changelog>
  <changelog author="zaitor@opensuse.org" date="1476964800">- Split out dbus-binding-tool in own sub-package.</changelog>
  <changelog author="meissner@suse.com" date="1497009600">- remove CFLAGS setting, -fstack-protector is default and -fPIC
  will be auto-selected.</changelog>
  <changelog author="elimat@opensuse.org" date="1594382400">- Update to version 0.110:
  Dependencies:
  + GLib 2.40 is required
  Enhancements:
  + The GLib main-loop glue, "dbus-gmain", is now available as a separate
    subproject (the dbus-gmain branch in dbus-glib's git repository) for
    embedding in larger projects like dbus-glib and dbus-python via the
    `git subtree` or `git submodule` commands. This removes dbus-python's
    dependency on the rest of dbus-glib.
  Fixes:
  + autogen.sh can now detect gtk-doc &gt;= 1.26.
  + More files have per-file copyright information.
- Run spec-cleaner</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1637755200">- Update to version 0.112:
  + Dependencies:
  - dbus 1.8 was already required, but is more strongly required
    now: the workarounds that were used to run continuous
    integration with dbus 1.6 on Ubuntu 14.04 'trusty' have been
    removed. (Note that dbus 1.8 has already reached end-of-life
    for security support, and newer dbus stable branches are
    strongly recommended.)
  - pkg-config 0.28 is required when building from git.
  + Enhancements:
  - Rewrite CONTRIBUTING.md document, based on Wayland's
    equivalent.
  - A generated ChangeLog file, which made up a significant
    proportion of the size of source tarball releases, is no
    longer included.
  - Improve man page.
  - Add test coverage for fdo#80557
  - Use more modern GLib assertions in unit tests.
  - Improve continuous integration to be run by GitLab in
    addition to Travis-CI.
  - Add clearer license information using
    SPDX-License-Identifier.
  + Fixes:
  - Allow glib-genmarshal to be overridden with
    `./configure GLIB_GENMARSHAL=/path/to/glib-genmarshal`, for
    cross-compilation.
  - Avoid a double-free in dbus-binding-tool for certain inputs,
    possibly involving nested introspection data structures.
  - Report a better error for excessive recursion depth or
    unsupported data types.
  - Map the 15 most-recently-added DBusGError members to their
    corresponding D-Bus error names.
  - Mark all documented symbols as deprecated.
  - Fix unit test failures during distcheck by enabling
    assertions.
  - Fix a core dump during installed-tests by not attempting to
    close a shared DBusConnection.
- Package COPYING as license, CONTRIBUTING.md and NEWS as docs.
- Add explicit pkgconfig BuildRequires.
- Replace dbus-1-devel and glib2-devel with pkgconfig variants that
  configure checks for: pkgconfig(dbus-1), pkgconfig(glib-2.0),
  pkgconfig(gobject-2.0) and pkgconfig(gio-2.0) BuildRequires.
- Drop hard Requires and BuildRequires that are not needed as they
  are added automatically.
- Split out bash-completion sub-package.
- Split out shared library into own sub-package, and Require it
  from the devel package, and add to the baselibs.conf. Following
  the SLPP standard. Add Provides and Obsoletes for the no longer
  existing main package.
- Use ldconfig_scriptlets for post(un) handling.
- Add soname define, ease future updates.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1638360000">- Add signature and keyring as sources, verify tarball with gpg.</changelog>
  <changelog author="dimstar@opensuse.org" date="1638964800">- Add relevant dbus-1-glib-&lt;targettype&gt; provides/obsoletes also in
  baselibs.conf (boo#1193502).</changelog>
  <changelog author="dimstar@opensuse.org" date="1667390400">- Try to guard against incomplete update stacks (boo#1202241):
  + Add split-provides to libdbus-1-glib and bash-completion
    sub-package.
  + Add explicit conflict to bash-completion subpackage against
    dbus-1-glib &lt; 0.112 (when the package split happened)
  + Ensure dbus-1-glib-tool gets the correct library version
    installed.</changelog>
</package>
<package pkgid="f16e6ca26f4d9ead07962ca0798e05ef521af54077a105d22a7b4add8f8eccb8" name="ddclient" arch="noarch">
  <version epoch="0" ver="3.10.0" rel="150000.3.10.3"/>
  <changelog author="josef.moellers@suse.com" date="1486123200">- Upgrade to ddclient-3.8.3.
  * added Alpine Linux init scritp - patch send by @Tal on github.
  * adding support for nsupdate - patch send by @droe on github
  * allow log username-password combinations - patch send by @dirdi on github
  * adding support for cloudflare - patch send by @roberthawdon on github
  * adding support for duckdns - patch send by @gkranis</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="projects@localside.net" date="1536840000">- Upgrade to ddclient-3.9.0
  * Support IPv6 for CloudFlare
  * name cheap support https now
  * Use JSON::PP instead of the (deprecated) JSON::Any
  * Specify port number properly to 'nsupdate'
  * Adding support for freemyip.com</changelog>
  <changelog author="obs@botter.cc" date="1538395200">- Require perl-Data-Validate-IP</changelog>
  <changelog author="jengelh@inai.de" date="1550318400">- Ensure neutrality of description.
- Do not ignore errors from useradd.
- Avoid %__-type macro indirection.</changelog>
  <changelog author="chris@computersalat.de" date="1577793600">- fix for boo#1127387
  * systemd-tmpfiles need updating from /var/run/* to /run/*</changelog>
  <changelog author="mmanu84@outlook.de" date="1579867200">- Upgrade to ddclient-3.9.1
  * added support for Yandex.Mail for Domain DNS service
  * added support for NearlyFreeSpeech.net
  * added support for DNS Made Easy
  * added systemd instructions
  * added support for dondominio.com
  * updated perl instruction
  * updated fritzbox instructions
  * fixed multidomain support for namecheap
  * fixed support for Yandex</changelog>
  <changelog author="kukuk@suse.com" date="1580644800">- Replace pwdutils with shadow, former is gone long time ago</changelog>
  <changelog author="tchvatal@suse.com" date="1580731200">- Use properly tmpfiles-create
- Remove the systemd conditional
- Fixup download url</changelog>
  <changelog author="dimstar@opensuse.org" date="1597838400">- Use %{_tmpfilesdir} instead of abusing %{_libexecdir}.</changelog>
  <changelog author="josef.moellers@suse.com" date="1619006400">- /var/run is deprecated, replaced by /run in ddclient-tmpfiles.conf
  [ddclient-tmpfiles.conf, bsc#1185069]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619092800">- In the (sample) /etc/ddclient.conf, also replace /var/run with /run.
  [ddclient-replace-varrun-with-run.patch, bsc#1185069]</changelog>
  <changelog author="josef.moellers@suse.com" date="1620820800">- Use an extended regular expression in sed to change (/var)?/run.</changelog>
  <changelog author="josef.moellers@suse.com" date="1621339200">- Systemd expects the PID file to exist as soon as the main process
  exists. However, it takes quite a while until the pid file is
  created by the daemon process, so we delay the main process
  for 1 second before exit()ing.
  This gets rid of an annoying warning message in "systemctl
  status".
  [ddclient, ddclient-delay-main-process-for-systemd.patch]</changelog>
  <changelog author="jsegitz@suse.com" date="1630497600">- Added hardening to systemd service(s). Modified:
  * ddclient.service</changelog>
  <changelog author="alarrosa@suse.com" date="1640347200">- Modify the systemd service file so ddclient is run After
  network-online.target instead of just network.target, since
  running ddclient without being online is pointless.
- Added a Wants statement for the same systemd targets as in After</changelog>
  <changelog author="chris@computersalat.de" date="1657627200">- fix for boo#1191885
  add SupplementaryGroups=maildrop to service file
- rename ddclient-3.8.1-config.patch to ddclient-config.patch
- rebase patch
  * ddclient-delay-main-process-for-systemd.patch (p0)
- update ddclient-config.patch
  * fix PID file path
- merge ddclient-replace-varrun-with-run.patch into
  ddclient-config.patc
- merge changes file with SLES Maintained pkg
- update Source to %{name}-%{version}</changelog>
  <changelog author="info@paolostivanin.com" date="1672142400">- Update to 3.10.0:
  * Added support for domaindiscount24.com
  * Added support for njal.la
  * Added support for Cloudflare API tokens
  * Added support for OVH DynHost.
  * Added support for ClouDNS.
  * Added support for dinahosting.
  * Added support for Gandi LiveDNS.
  * The freedns protocol (for https://freedns.afraid.org) now supports IPv6
    addresses.
  * New ssl_ca_dir and ssl_ca_file options to specify the location of CA
    certificates.
  * New built-in IP discovery service shorthands:
    + googledomains from https://domains.google
    + he from https://he.net
    ip+4only.me, ip6only.me from http://whatismyv6.com
    + ipify-ipv4 and ipify-ipv6 from https://www.ipify.org
    + myonlineportal from https://myonlineportal.net
    + noip-ipv4 and noip-ipv6 from https://www.noip.com
    + nsupdate.info-ipv4 and nsupdate.info-ipv6 from
    + https://www.nsupdate.info
    + zoneedit from https://www.zoneedit.com
  * Added option -curl to access network with system Curl command instead
    of the Perl built-in IO::Socket classes.
  * Added option -{no}web-ssl-validate and -{no}fw-ssl-validateto provide
    option to disable SSL certificate validation. Note that these only apply for
    network access when obtaining an IP address with use=web or use=fw
    (any firewall). Network access to Dynamic DNS servers to set or retrieve
    IP address will always require certificate validation.
  * The fw-banlocal option is deprecated and no longer does anything.
  * The if-skip option is deprecated and no longer does anything.
  * The default server for the dslreports1 protocol changed from
    members.dyndns.org to www.dslreports.com.
  * Removed support for defunct dnsspark service
  * Removed support for defunct dtdns service
  * Removed support for defunct Hammernode service
- Add fix-configure_ac.patch
- Add disable-ip-test.patch
- Rebase ddclient-config.patch
- Rebase ddclient-delay-main-process-for-systemd.patch</changelog>
  <changelog author="munix9@googlemail.com" date="1672574400">- Add curl as BuildRequires/Requires to be able to use the '-curl'
  option (eg. in DDCLIENT_OPTIONS in /etc/sysconfig/ddclient).</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1702900800">- Remove buildRequires to perl(HTTP::Message::PSGI) not available and needed
  only for tests.</changelog>
</package>
<package pkgid="7c8c418c633193c340a5f3d2aa103ab3198544bc1504d4a428d1f3f2b69e2f8c" name="ddclient" arch="src">
  <version epoch="0" ver="3.10.0" rel="150000.3.10.3"/>
  <changelog author="josef.moellers@suse.com" date="1486123200">- Upgrade to ddclient-3.8.3.
  * added Alpine Linux init scritp - patch send by @Tal on github.
  * adding support for nsupdate - patch send by @droe on github
  * allow log username-password combinations - patch send by @dirdi on github
  * adding support for cloudflare - patch send by @roberthawdon on github
  * adding support for duckdns - patch send by @gkranis</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="projects@localside.net" date="1536840000">- Upgrade to ddclient-3.9.0
  * Support IPv6 for CloudFlare
  * name cheap support https now
  * Use JSON::PP instead of the (deprecated) JSON::Any
  * Specify port number properly to 'nsupdate'
  * Adding support for freemyip.com</changelog>
  <changelog author="obs@botter.cc" date="1538395200">- Require perl-Data-Validate-IP</changelog>
  <changelog author="jengelh@inai.de" date="1550318400">- Ensure neutrality of description.
- Do not ignore errors from useradd.
- Avoid %__-type macro indirection.</changelog>
  <changelog author="chris@computersalat.de" date="1577793600">- fix for boo#1127387
  * systemd-tmpfiles need updating from /var/run/* to /run/*</changelog>
  <changelog author="mmanu84@outlook.de" date="1579867200">- Upgrade to ddclient-3.9.1
  * added support for Yandex.Mail for Domain DNS service
  * added support for NearlyFreeSpeech.net
  * added support for DNS Made Easy
  * added systemd instructions
  * added support for dondominio.com
  * updated perl instruction
  * updated fritzbox instructions
  * fixed multidomain support for namecheap
  * fixed support for Yandex</changelog>
  <changelog author="kukuk@suse.com" date="1580644800">- Replace pwdutils with shadow, former is gone long time ago</changelog>
  <changelog author="tchvatal@suse.com" date="1580731200">- Use properly tmpfiles-create
- Remove the systemd conditional
- Fixup download url</changelog>
  <changelog author="dimstar@opensuse.org" date="1597838400">- Use %{_tmpfilesdir} instead of abusing %{_libexecdir}.</changelog>
  <changelog author="josef.moellers@suse.com" date="1619006400">- /var/run is deprecated, replaced by /run in ddclient-tmpfiles.conf
  [ddclient-tmpfiles.conf, bsc#1185069]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619092800">- In the (sample) /etc/ddclient.conf, also replace /var/run with /run.
  [ddclient-replace-varrun-with-run.patch, bsc#1185069]</changelog>
  <changelog author="josef.moellers@suse.com" date="1620820800">- Use an extended regular expression in sed to change (/var)?/run.</changelog>
  <changelog author="josef.moellers@suse.com" date="1621339200">- Systemd expects the PID file to exist as soon as the main process
  exists. However, it takes quite a while until the pid file is
  created by the daemon process, so we delay the main process
  for 1 second before exit()ing.
  This gets rid of an annoying warning message in "systemctl
  status".
  [ddclient, ddclient-delay-main-process-for-systemd.patch]</changelog>
  <changelog author="jsegitz@suse.com" date="1630497600">- Added hardening to systemd service(s). Modified:
  * ddclient.service</changelog>
  <changelog author="alarrosa@suse.com" date="1640347200">- Modify the systemd service file so ddclient is run After
  network-online.target instead of just network.target, since
  running ddclient without being online is pointless.
- Added a Wants statement for the same systemd targets as in After</changelog>
  <changelog author="chris@computersalat.de" date="1657627200">- fix for boo#1191885
  add SupplementaryGroups=maildrop to service file
- rename ddclient-3.8.1-config.patch to ddclient-config.patch
- rebase patch
  * ddclient-delay-main-process-for-systemd.patch (p0)
- update ddclient-config.patch
  * fix PID file path
- merge ddclient-replace-varrun-with-run.patch into
  ddclient-config.patc
- merge changes file with SLES Maintained pkg
- update Source to %{name}-%{version}</changelog>
  <changelog author="info@paolostivanin.com" date="1672142400">- Update to 3.10.0:
  * Added support for domaindiscount24.com
  * Added support for njal.la
  * Added support for Cloudflare API tokens
  * Added support for OVH DynHost.
  * Added support for ClouDNS.
  * Added support for dinahosting.
  * Added support for Gandi LiveDNS.
  * The freedns protocol (for https://freedns.afraid.org) now supports IPv6
    addresses.
  * New ssl_ca_dir and ssl_ca_file options to specify the location of CA
    certificates.
  * New built-in IP discovery service shorthands:
    + googledomains from https://domains.google
    + he from https://he.net
    ip+4only.me, ip6only.me from http://whatismyv6.com
    + ipify-ipv4 and ipify-ipv6 from https://www.ipify.org
    + myonlineportal from https://myonlineportal.net
    + noip-ipv4 and noip-ipv6 from https://www.noip.com
    + nsupdate.info-ipv4 and nsupdate.info-ipv6 from
    + https://www.nsupdate.info
    + zoneedit from https://www.zoneedit.com
  * Added option -curl to access network with system Curl command instead
    of the Perl built-in IO::Socket classes.
  * Added option -{no}web-ssl-validate and -{no}fw-ssl-validateto provide
    option to disable SSL certificate validation. Note that these only apply for
    network access when obtaining an IP address with use=web or use=fw
    (any firewall). Network access to Dynamic DNS servers to set or retrieve
    IP address will always require certificate validation.
  * The fw-banlocal option is deprecated and no longer does anything.
  * The if-skip option is deprecated and no longer does anything.
  * The default server for the dslreports1 protocol changed from
    members.dyndns.org to www.dslreports.com.
  * Removed support for defunct dnsspark service
  * Removed support for defunct dtdns service
  * Removed support for defunct Hammernode service
- Add fix-configure_ac.patch
- Add disable-ip-test.patch
- Rebase ddclient-config.patch
- Rebase ddclient-delay-main-process-for-systemd.patch</changelog>
  <changelog author="munix9@googlemail.com" date="1672574400">- Add curl as BuildRequires/Requires to be able to use the '-curl'
  option (eg. in DDCLIENT_OPTIONS in /etc/sysconfig/ddclient).</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1702900800">- Remove buildRequires to perl(HTTP::Message::PSGI) not available and needed
  only for tests.</changelog>
</package>
<package pkgid="855909a50e77a97a322f6b73ad723dd6927ac137cb362b0e52e2842e6c914c21" name="deltarpm" arch="aarch64">
  <version epoch="0" ver="3.6.4" rel="150000.5.3.2"/>
  <changelog author="mls@suse.de" date="1370865600">- update to deltarpm-3.6
  * fixes failing applydeltarpm with gzip -9 compression
  * adds a couple of manpages</changelog>
  <changelog author="ro@suse.de" date="1448366400">- update to version 3.6.1
  - remove upstreamed patch deltarpm-zlibcppflags.diff
  - fix off-by-one error in delta generation code (bnc#948504)
    This could lead to a segfault in rare circumstances.
  - Return error rather than crashing if we can't allocate memory
  - add newline in missing prelink error
  - do not finish applydeltarpm jobs when in the middle of a request
  - fix zlibcppflags typo</changelog>
  <changelog author="mpluskal@suse.com" date="1510056000">- Build python3 bindings as well
- Rename python2 subpackage to name consistent with current python
  packaging
- Drop patch.sles8 - there does not seem to be any reason for it</changelog>
  <changelog author="mpluskal@suse.com" date="1510315200">- Correct provides/obsoletes for python2 subpackage</changelog>
  <changelog author="tchvatal@suse.com" date="1515153600">- Make python2 and python3 conditional to ensure we can build with
  python3 only</changelog>
  <changelog author="mls@suse.de" date="1560427200">- update to deltarpm-3.6.2
  * support for zstd compression</changelog>
  <changelog author="ngompa13@gmail.com" date="1561204800">- Actually enable zstd compression</changelog>
  <changelog author="mls@suse.de" date="1635508800">- update to deltarpm-3.6.3
  * support for threaded zstd compression</changelog>
  <changelog author="meissner@suse.com" date="1649851200">- deltarpm-b7987f6aa4211df3df03dcfc55a00b2ce7472e0a.patch: fixed
  some C bugs ( incorrect sized memset() , memcpy instead of strcpy,
  unsigned int)</changelog>
  <changelog author="mls@suse.de" date="1723032000">- update to deltarpm-3.6.4
  * support for threaded zstd
  * use a tmp file instead of memory to hold the incore data
    [bsc#1228948]
- dropped patches:
  * deltarpm-b7987f6aa4211df3df03dcfc55a00b2ce7472e0a.patch</changelog>
</package>
<package pkgid="93ae199feb140f8a2f58a1cf64115e2f1b36b68653562e3199e235167a6e87f1" name="deltarpm" arch="ppc64le">
  <version epoch="0" ver="3.6.4" rel="150000.5.3.2"/>
  <changelog author="mls@suse.de" date="1370865600">- update to deltarpm-3.6
  * fixes failing applydeltarpm with gzip -9 compression
  * adds a couple of manpages</changelog>
  <changelog author="ro@suse.de" date="1448366400">- update to version 3.6.1
  - remove upstreamed patch deltarpm-zlibcppflags.diff
  - fix off-by-one error in delta generation code (bnc#948504)
    This could lead to a segfault in rare circumstances.
  - Return error rather than crashing if we can't allocate memory
  - add newline in missing prelink error
  - do not finish applydeltarpm jobs when in the middle of a request
  - fix zlibcppflags typo</changelog>
  <changelog author="mpluskal@suse.com" date="1510056000">- Build python3 bindings as well
- Rename python2 subpackage to name consistent with current python
  packaging
- Drop patch.sles8 - there does not seem to be any reason for it</changelog>
  <changelog author="mpluskal@suse.com" date="1510315200">- Correct provides/obsoletes for python2 subpackage</changelog>
  <changelog author="tchvatal@suse.com" date="1515153600">- Make python2 and python3 conditional to ensure we can build with
  python3 only</changelog>
  <changelog author="mls@suse.de" date="1560427200">- update to deltarpm-3.6.2
  * support for zstd compression</changelog>
  <changelog author="ngompa13@gmail.com" date="1561204800">- Actually enable zstd compression</changelog>
  <changelog author="mls@suse.de" date="1635508800">- update to deltarpm-3.6.3
  * support for threaded zstd compression</changelog>
  <changelog author="meissner@suse.com" date="1649851200">- deltarpm-b7987f6aa4211df3df03dcfc55a00b2ce7472e0a.patch: fixed
  some C bugs ( incorrect sized memset() , memcpy instead of strcpy,
  unsigned int)</changelog>
  <changelog author="mls@suse.de" date="1723032000">- update to deltarpm-3.6.4
  * support for threaded zstd
  * use a tmp file instead of memory to hold the incore data
    [bsc#1228948]
- dropped patches:
  * deltarpm-b7987f6aa4211df3df03dcfc55a00b2ce7472e0a.patch</changelog>
</package>
<package pkgid="d0a78980f430fa59e607c5e370841c015d82ec295b84fb62ff935f06d7c1fceb" name="deltarpm" arch="s390x">
  <version epoch="0" ver="3.6.4" rel="150000.5.3.2"/>
  <changelog author="mls@suse.de" date="1370865600">- update to deltarpm-3.6
  * fixes failing applydeltarpm with gzip -9 compression
  * adds a couple of manpages</changelog>
  <changelog author="ro@suse.de" date="1448366400">- update to version 3.6.1
  - remove upstreamed patch deltarpm-zlibcppflags.diff
  - fix off-by-one error in delta generation code (bnc#948504)
    This could lead to a segfault in rare circumstances.
  - Return error rather than crashing if we can't allocate memory
  - add newline in missing prelink error
  - do not finish applydeltarpm jobs when in the middle of a request
  - fix zlibcppflags typo</changelog>
  <changelog author="mpluskal@suse.com" date="1510056000">- Build python3 bindings as well
- Rename python2 subpackage to name consistent with current python
  packaging
- Drop patch.sles8 - there does not seem to be any reason for it</changelog>
  <changelog author="mpluskal@suse.com" date="1510315200">- Correct provides/obsoletes for python2 subpackage</changelog>
  <changelog author="tchvatal@suse.com" date="1515153600">- Make python2 and python3 conditional to ensure we can build with
  python3 only</changelog>
  <changelog author="mls@suse.de" date="1560427200">- update to deltarpm-3.6.2
  * support for zstd compression</changelog>
  <changelog author="ngompa13@gmail.com" date="1561204800">- Actually enable zstd compression</changelog>
  <changelog author="mls@suse.de" date="1635508800">- update to deltarpm-3.6.3
  * support for threaded zstd compression</changelog>
  <changelog author="meissner@suse.com" date="1649851200">- deltarpm-b7987f6aa4211df3df03dcfc55a00b2ce7472e0a.patch: fixed
  some C bugs ( incorrect sized memset() , memcpy instead of strcpy,
  unsigned int)</changelog>
  <changelog author="mls@suse.de" date="1723032000">- update to deltarpm-3.6.4
  * support for threaded zstd
  * use a tmp file instead of memory to hold the incore data
    [bsc#1228948]
- dropped patches:
  * deltarpm-b7987f6aa4211df3df03dcfc55a00b2ce7472e0a.patch</changelog>
</package>
<package pkgid="651a0398aece5a91f7e29afcca8b9fbbc1def630bc3d2506994428b3f7eba625" name="deltarpm" arch="src">
  <version epoch="0" ver="3.6.4" rel="150000.5.3.2"/>
  <changelog author="mls@suse.de" date="1222948800">- fix typo in makedeltarpm [bnc#431509]</changelog>
  <changelog author="mls@suse.de" date="1224676800">- add lzma and bzip2 devel packages to the buildrequires</changelog>
  <changelog author="coolo@suse.de" date="1234785600">- adapt to xz-devel API changes (could only test makedeltarpm as
  our old deltas can not be applied anymore - resulting md5 is different)</changelog>
  <changelog author="mls@suse.de" date="1251115200">- update to version 3.5
- no changes, just patch integration</changelog>
  <changelog author="mls@suse.de" date="1252497600">- adapt to rpm-4.7 lzma level change</changelog>
  <changelog author="mls@suse.de" date="1287144000">- update to current git to get support for the '-m' option,
  which limits memory consumption</changelog>
  <changelog author="jengelh@medozas.de" date="1316347200">- Remove redundant tags/sections from specfile
  (cf. packaging guidelines)
- Use %_smp_mflags for parallel build</changelog>
  <changelog author="uli@suse.com" date="1317384000">- cross-build fix: use %__cc macro</changelog>
  <changelog author="saschpe@suse.de" date="1327320000">- Run spec-cleaner
- Add python-deltarpm subpackage</changelog>
  <changelog author="saschpe@suse.de" date="1327492800">- Package binary Python module, python-deltarpm isn't noarch any more</changelog>
  <changelog author="mls@suse.de" date="1370865600">- update to deltarpm-3.6
  * fixes failing applydeltarpm with gzip -9 compression
  * adds a couple of manpages</changelog>
  <changelog author="ro@suse.de" date="1448366400">- update to version 3.6.1
  - remove upstreamed patch deltarpm-zlibcppflags.diff
  - fix off-by-one error in delta generation code (bnc#948504)
    This could lead to a segfault in rare circumstances.
  - Return error rather than crashing if we can't allocate memory
  - add newline in missing prelink error
  - do not finish applydeltarpm jobs when in the middle of a request
  - fix zlibcppflags typo</changelog>
  <changelog author="mpluskal@suse.com" date="1510056000">- Build python3 bindings as well
- Rename python2 subpackage to name consistent with current python
  packaging
- Drop patch.sles8 - there does not seem to be any reason for it</changelog>
  <changelog author="mpluskal@suse.com" date="1510315200">- Correct provides/obsoletes for python2 subpackage</changelog>
  <changelog author="tchvatal@suse.com" date="1515153600">- Make python2 and python3 conditional to ensure we can build with
  python3 only</changelog>
  <changelog author="mls@suse.de" date="1560427200">- update to deltarpm-3.6.2
  * support for zstd compression</changelog>
  <changelog author="ngompa13@gmail.com" date="1561204800">- Actually enable zstd compression</changelog>
  <changelog author="mls@suse.de" date="1635508800">- update to deltarpm-3.6.3
  * support for threaded zstd compression</changelog>
  <changelog author="meissner@suse.com" date="1649851200">- deltarpm-b7987f6aa4211df3df03dcfc55a00b2ce7472e0a.patch: fixed
  some C bugs ( incorrect sized memset() , memcpy instead of strcpy,
  unsigned int)</changelog>
  <changelog author="mls@suse.de" date="1723032000">- update to deltarpm-3.6.4
  * support for threaded zstd
  * use a tmp file instead of memory to hold the incore data
    [bsc#1228948]
- dropped patches:
  * deltarpm-b7987f6aa4211df3df03dcfc55a00b2ce7472e0a.patch</changelog>
</package>
<package pkgid="e4403bab62747bdce6ff9d2ccb956c5fcdcc00fa816f883d45acbf260175c971" name="deltarpm" arch="x86_64">
  <version epoch="0" ver="3.6.4" rel="150000.5.3.2"/>
  <changelog author="mls@suse.de" date="1370865600">- update to deltarpm-3.6
  * fixes failing applydeltarpm with gzip -9 compression
  * adds a couple of manpages</changelog>
  <changelog author="ro@suse.de" date="1448366400">- update to version 3.6.1
  - remove upstreamed patch deltarpm-zlibcppflags.diff
  - fix off-by-one error in delta generation code (bnc#948504)
    This could lead to a segfault in rare circumstances.
  - Return error rather than crashing if we can't allocate memory
  - add newline in missing prelink error
  - do not finish applydeltarpm jobs when in the middle of a request
  - fix zlibcppflags typo</changelog>
  <changelog author="mpluskal@suse.com" date="1510056000">- Build python3 bindings as well
- Rename python2 subpackage to name consistent with current python
  packaging
- Drop patch.sles8 - there does not seem to be any reason for it</changelog>
  <changelog author="mpluskal@suse.com" date="1510315200">- Correct provides/obsoletes for python2 subpackage</changelog>
  <changelog author="tchvatal@suse.com" date="1515153600">- Make python2 and python3 conditional to ensure we can build with
  python3 only</changelog>
  <changelog author="mls@suse.de" date="1560427200">- update to deltarpm-3.6.2
  * support for zstd compression</changelog>
  <changelog author="ngompa13@gmail.com" date="1561204800">- Actually enable zstd compression</changelog>
  <changelog author="mls@suse.de" date="1635508800">- update to deltarpm-3.6.3
  * support for threaded zstd compression</changelog>
  <changelog author="meissner@suse.com" date="1649851200">- deltarpm-b7987f6aa4211df3df03dcfc55a00b2ce7472e0a.patch: fixed
  some C bugs ( incorrect sized memset() , memcpy instead of strcpy,
  unsigned int)</changelog>
  <changelog author="mls@suse.de" date="1723032000">- update to deltarpm-3.6.4
  * support for threaded zstd
  * use a tmp file instead of memory to hold the incore data
    [bsc#1228948]
- dropped patches:
  * deltarpm-b7987f6aa4211df3df03dcfc55a00b2ce7472e0a.patch</changelog>
</package>
<package pkgid="08aaedc563d30c61fd088e7f19c4fe7461faedeafa50275c02473adbfd199774" name="desktop-data-SLE" arch="noarch">
  <version epoch="0" ver="15" rel="150000.4.3.11"/>
  <changelog author="coolo@suse.com" date="1366804800">- bump version to 13.1</changelog>
  <changelog author="coolo@suse.com" date="1378123200">- remove supplements and move it to the patterns. Supplements
  are rather intransparent</changelog>
  <changelog author="fcrozat@suse.com" date="1392638400">- Initial package for SLE, based on openSUSE version.</changelog>
  <changelog author="alarrosa@suse.com" date="1455710400">- Upgrade package from upstream sources
  (commit 78d352e589c4867e4c66e6e48f31b86de861db9f).
  * Add package_edutainment.png icon which is used by
  Yast's software management module as Education package group icon
  (bnc#953027)
  * Remove package-manager.desktop, yast2-packager now provides
  yast2-packager.desktop which handles rpm files again
- Remove the update_rpm script and replace it with a proper
  obs source service (disabled by default). Use xz compression
  instead of bz2.
- Update the spec file accordingly.</changelog>
  <changelog author="UTC - qzhao@suse.com" date="1455796800">- Disable "Novell" branding in wallpaper, FATE# 320506 Disable
  "Novell" branding in wallpaper</changelog>
  <changelog author="qzhao@suse.com" date="1504612800">- Update desktop-data-SLE.spec: Correct a path error on removing
  curvy2.png to accomplish FATE#320506 completely(bsc#1058231).</changelog>
  <changelog author="fcrozat@suse.com" date="1505908800">- Version update for SLE15.</changelog>
  <changelog author="rbrown@suse.com" date="1517227200">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="fcrozat@suse.com" date="1517227201">- Remove very old obsoletes/provides.
- Kill %%post code for migrating from KDE3.
- Remove calls to icon_theme_cache macros, this is handled by
  file-triggers now.</changelog>
  <changelog author="mgorse@suse.com" date="1712577600">- Fix typo in the desktop files for some of the wallpapers
  (bsc#1222146).</changelog>
</package>
<package pkgid="4d60af3f78a1a12c4a4629a7f4e681c034cb270367f0174b022d4cef50d6d175" name="desktop-data-SLE" arch="src">
  <version epoch="0" ver="15" rel="150000.4.3.11"/>
  <changelog author="vuntz@opensuse.org" date="1316606400">- Update openSUSE-default-static.xml to reference the new filename
  for default wallpapers.</changelog>
  <changelog author="coolo@suse.com" date="1316692800">- wallpaper moved out of here, so require it</changelog>
  <changelog author="vuntz@opensuse.org" date="1316692801">- Drop the bits related to creating the XML file used by GNOME for
  the default wallpaper, including the alternatives handling. This
  all moves to branding-openSUSE now.</changelog>
  <changelog author="vuntz@opensuse.org" date="1317038400">- Remove update-alternatives Requires(post)/Requires(postun) since
  we don't use this anymore (moved to wallpaper-branding-openSUSE).</changelog>
  <changelog author="vuntz@opensuse.org" date="1318334400">- Add back Hidden.directory and a mention of it in
  applications.menu to help KDE 3 (bnc#686786).
- Drop hidden-fix.diff: the updated fix is now in git.</changelog>
  <changelog author="coolo@suse.com" date="1318939200">- desktop-data is fine with any wallpaper branding for 12.1</changelog>
  <changelog author="coolo@suse.com" date="1322654400">- bump version to 12.2</changelog>
  <changelog author="coolo@suse.com" date="1355140800">- bump version to 12.3</changelog>
  <changelog author="wstephenson@suse.com" date="1358769600">- Update for changes to XDG menu spec (bnc#443364):
  * Edutainment is now two top level menus, Education and Science
  * All additional categories allowed for Education are now
    permitted for Science
  * Monitor additional category is permitted for System and Network
  * Spirituality, Maps, Feed, NetworkService, Shooter additional
    categories were added</changelog>
  <changelog author="wstephenson@suse.com" date="1359460800">- Fix Audio players show up in Video Player submenun (bnc#788628)
- Fix application menu schema warning from kbuildsycoca (bnc#789456)</changelog>
  <changelog author="coolo@suse.com" date="1366804800">- bump version to 13.1</changelog>
  <changelog author="coolo@suse.com" date="1378123200">- remove supplements and move it to the patterns. Supplements
  are rather intransparent</changelog>
  <changelog author="fcrozat@suse.com" date="1392638400">- Initial package for SLE, based on openSUSE version.</changelog>
  <changelog author="alarrosa@suse.com" date="1455710400">- Upgrade package from upstream sources
  (commit 78d352e589c4867e4c66e6e48f31b86de861db9f).
  * Add package_edutainment.png icon which is used by
  Yast's software management module as Education package group icon
  (bnc#953027)
  * Remove package-manager.desktop, yast2-packager now provides
  yast2-packager.desktop which handles rpm files again
- Remove the update_rpm script and replace it with a proper
  obs source service (disabled by default). Use xz compression
  instead of bz2.
- Update the spec file accordingly.</changelog>
  <changelog author="UTC - qzhao@suse.com" date="1455796800">- Disable "Novell" branding in wallpaper, FATE# 320506 Disable
  "Novell" branding in wallpaper</changelog>
  <changelog author="qzhao@suse.com" date="1504612800">- Update desktop-data-SLE.spec: Correct a path error on removing
  curvy2.png to accomplish FATE#320506 completely(bsc#1058231).</changelog>
  <changelog author="fcrozat@suse.com" date="1505908800">- Version update for SLE15.</changelog>
  <changelog author="rbrown@suse.com" date="1517227200">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="fcrozat@suse.com" date="1517227201">- Remove very old obsoletes/provides.
- Kill %%post code for migrating from KDE3.
- Remove calls to icon_theme_cache macros, this is handled by
  file-triggers now.</changelog>
  <changelog author="mgorse@suse.com" date="1712577600">- Fix typo in the desktop files for some of the wallpapers
  (bsc#1222146).</changelog>
</package>
<package pkgid="6a3449ede84ee667baaebffb8e195f4d9c609034aa9835a41bcee08fbf7ae579" name="desktop-data-SLE-extra" arch="noarch">
  <version epoch="0" ver="15" rel="150000.4.3.11"/>
  <changelog author="coolo@suse.com" date="1366804800">- bump version to 13.1</changelog>
  <changelog author="coolo@suse.com" date="1378123200">- remove supplements and move it to the patterns. Supplements
  are rather intransparent</changelog>
  <changelog author="fcrozat@suse.com" date="1392638400">- Initial package for SLE, based on openSUSE version.</changelog>
  <changelog author="alarrosa@suse.com" date="1455710400">- Upgrade package from upstream sources
  (commit 78d352e589c4867e4c66e6e48f31b86de861db9f).
  * Add package_edutainment.png icon which is used by
  Yast's software management module as Education package group icon
  (bnc#953027)
  * Remove package-manager.desktop, yast2-packager now provides
  yast2-packager.desktop which handles rpm files again
- Remove the update_rpm script and replace it with a proper
  obs source service (disabled by default). Use xz compression
  instead of bz2.
- Update the spec file accordingly.</changelog>
  <changelog author="UTC - qzhao@suse.com" date="1455796800">- Disable "Novell" branding in wallpaper, FATE# 320506 Disable
  "Novell" branding in wallpaper</changelog>
  <changelog author="qzhao@suse.com" date="1504612800">- Update desktop-data-SLE.spec: Correct a path error on removing
  curvy2.png to accomplish FATE#320506 completely(bsc#1058231).</changelog>
  <changelog author="fcrozat@suse.com" date="1505908800">- Version update for SLE15.</changelog>
  <changelog author="rbrown@suse.com" date="1517227200">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="fcrozat@suse.com" date="1517227201">- Remove very old obsoletes/provides.
- Kill %%post code for migrating from KDE3.
- Remove calls to icon_theme_cache macros, this is handled by
  file-triggers now.</changelog>
  <changelog author="mgorse@suse.com" date="1712577600">- Fix typo in the desktop files for some of the wallpapers
  (bsc#1222146).</changelog>
</package>
<package pkgid="45de15b70f7bc4317c51baa5eb07937d0399e6ba96dd593cdf797beb6501ff46" name="dhcp-tools" arch="aarch64">
  <version epoch="0" ver="1.6" rel="150000.3.3.2"/>
  <changelog author="poeml@suse.de" date="998654400">- update dhcpdump to 1.2 and dhcping to 1.1</changelog>
  <changelog author="poeml@suse.de" date="1059048000">- update dhcpdump to 1.5. Rephrased changelog:
  - better input checking regarding validity of the header of the UDP packet
  - Added some DHCP options from the INIA website (not all are parsed yet)
  - added chaddr filter, contributed by Peter Apian-Bennewitz
  - client-identifier is now printed as long as it is.
  - autoconfiscated
- update dhcping to 1.2 (no significant changes)
- install CHANGES and other accompanying files
- use %defattr
- re-create man pages</changelog>
  <changelog author="poeml@suse.de" date="1078315200">- update dhcpdump to 1.5
  - Option 82, submitted by Phil Pennock &lt;pdp@nl.demon.net&gt;
  - Add fflush(), submitted by Gary Colman &lt;gary@colmans.net&gt;
  - Fix problem with padding, they were not handled properly
    and caused old memory to be reused.
- compile with -fno-strict-aliasing</changelog>
  <changelog author="poeml@suse.de" date="1084190400">- fix parsing of IP header for output of tcpdump-3.8.1 [#38528]</changelog>
  <changelog author="poeml@suse.de" date="1094731200">- fix parsing of IP header and data packages for output of
  tcpdump-3.8.[23] [#44946], and apply the fix on 9.2 or newer
- apply previous patch on 9.1 or newer</changelog>
  <changelog author="dmueller@suse.de" date="1128513600">- add norootforbuild</changelog>
  <changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
  <changelog author="jengelh@medozas.de" date="1316347200">- Remove redundant tags/sections from specfile
  (cf. packaging guidelines)
- Use %_smp_mflags for parallel build</changelog>
  <changelog author="coolo@suse.com" date="1322827200">- add automake as buildrequire to avoid implicit dependency</changelog>
  <changelog author="varkoly@suse.com" date="1709726400">- Adapt license</changelog>
</package>
<package pkgid="07765be7e4809913f22dce13453f2152d06ece3a9187fe0883a872bcd6880c4e" name="dhcp-tools" arch="ppc64le">
  <version epoch="0" ver="1.6" rel="150000.3.3.2"/>
  <changelog author="poeml@suse.de" date="998654400">- update dhcpdump to 1.2 and dhcping to 1.1</changelog>
  <changelog author="poeml@suse.de" date="1059048000">- update dhcpdump to 1.5. Rephrased changelog:
  - better input checking regarding validity of the header of the UDP packet
  - Added some DHCP options from the INIA website (not all are parsed yet)
  - added chaddr filter, contributed by Peter Apian-Bennewitz
  - client-identifier is now printed as long as it is.
  - autoconfiscated
- update dhcping to 1.2 (no significant changes)
- install CHANGES and other accompanying files
- use %defattr
- re-create man pages</changelog>
  <changelog author="poeml@suse.de" date="1078315200">- update dhcpdump to 1.5
  - Option 82, submitted by Phil Pennock &lt;pdp@nl.demon.net&gt;
  - Add fflush(), submitted by Gary Colman &lt;gary@colmans.net&gt;
  - Fix problem with padding, they were not handled properly
    and caused old memory to be reused.
- compile with -fno-strict-aliasing</changelog>
  <changelog author="poeml@suse.de" date="1084190400">- fix parsing of IP header for output of tcpdump-3.8.1 [#38528]</changelog>
  <changelog author="poeml@suse.de" date="1094731200">- fix parsing of IP header and data packages for output of
  tcpdump-3.8.[23] [#44946], and apply the fix on 9.2 or newer
- apply previous patch on 9.1 or newer</changelog>
  <changelog author="dmueller@suse.de" date="1128513600">- add norootforbuild</changelog>
  <changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
  <changelog author="jengelh@medozas.de" date="1316347200">- Remove redundant tags/sections from specfile
  (cf. packaging guidelines)
- Use %_smp_mflags for parallel build</changelog>
  <changelog author="coolo@suse.com" date="1322827200">- add automake as buildrequire to avoid implicit dependency</changelog>
  <changelog author="varkoly@suse.com" date="1709726400">- Adapt license</changelog>
</package>
<package pkgid="76ea91d86fc371fad2d11e1c058dcce2e6f2ff01d1d0733b5d39499146d8a889" name="dhcp-tools" arch="s390x">
  <version epoch="0" ver="1.6" rel="150000.3.3.2"/>
  <changelog author="poeml@suse.de" date="998654400">- update dhcpdump to 1.2 and dhcping to 1.1</changelog>
  <changelog author="poeml@suse.de" date="1059048000">- update dhcpdump to 1.5. Rephrased changelog:
  - better input checking regarding validity of the header of the UDP packet
  - Added some DHCP options from the INIA website (not all are parsed yet)
  - added chaddr filter, contributed by Peter Apian-Bennewitz
  - client-identifier is now printed as long as it is.
  - autoconfiscated
- update dhcping to 1.2 (no significant changes)
- install CHANGES and other accompanying files
- use %defattr
- re-create man pages</changelog>
  <changelog author="poeml@suse.de" date="1078315200">- update dhcpdump to 1.5
  - Option 82, submitted by Phil Pennock &lt;pdp@nl.demon.net&gt;
  - Add fflush(), submitted by Gary Colman &lt;gary@colmans.net&gt;
  - Fix problem with padding, they were not handled properly
    and caused old memory to be reused.
- compile with -fno-strict-aliasing</changelog>
  <changelog author="poeml@suse.de" date="1084190400">- fix parsing of IP header for output of tcpdump-3.8.1 [#38528]</changelog>
  <changelog author="poeml@suse.de" date="1094731200">- fix parsing of IP header and data packages for output of
  tcpdump-3.8.[23] [#44946], and apply the fix on 9.2 or newer
- apply previous patch on 9.1 or newer</changelog>
  <changelog author="dmueller@suse.de" date="1128513600">- add norootforbuild</changelog>
  <changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
  <changelog author="jengelh@medozas.de" date="1316347200">- Remove redundant tags/sections from specfile
  (cf. packaging guidelines)
- Use %_smp_mflags for parallel build</changelog>
  <changelog author="coolo@suse.com" date="1322827200">- add automake as buildrequire to avoid implicit dependency</changelog>
  <changelog author="varkoly@suse.com" date="1709726400">- Adapt license</changelog>
</package>
<package pkgid="a8694e0f389fe01e4a7976ea7d4056b0346587baf6cb1b38c05e9357ec592767" name="dhcp-tools" arch="src">
  <version epoch="0" ver="1.6" rel="150000.3.3.2"/>
  <changelog author="poeml@suse.de" date="985176000">- new package</changelog>
  <changelog author="poeml@suse.de" date="998654400">- update dhcpdump to 1.2 and dhcping to 1.1</changelog>
  <changelog author="poeml@suse.de" date="1059048000">- update dhcpdump to 1.5. Rephrased changelog:
  - better input checking regarding validity of the header of the UDP packet
  - Added some DHCP options from the INIA website (not all are parsed yet)
  - added chaddr filter, contributed by Peter Apian-Bennewitz
  - client-identifier is now printed as long as it is.
  - autoconfiscated
- update dhcping to 1.2 (no significant changes)
- install CHANGES and other accompanying files
- use %defattr
- re-create man pages</changelog>
  <changelog author="poeml@suse.de" date="1078315200">- update dhcpdump to 1.5
  - Option 82, submitted by Phil Pennock &lt;pdp@nl.demon.net&gt;
  - Add fflush(), submitted by Gary Colman &lt;gary@colmans.net&gt;
  - Fix problem with padding, they were not handled properly
    and caused old memory to be reused.
- compile with -fno-strict-aliasing</changelog>
  <changelog author="poeml@suse.de" date="1084190400">- fix parsing of IP header for output of tcpdump-3.8.1 [#38528]</changelog>
  <changelog author="poeml@suse.de" date="1094731200">- fix parsing of IP header and data packages for output of
  tcpdump-3.8.[23] [#44946], and apply the fix on 9.2 or newer
- apply previous patch on 9.1 or newer</changelog>
  <changelog author="dmueller@suse.de" date="1128513600">- add norootforbuild</changelog>
  <changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
  <changelog author="jengelh@medozas.de" date="1316347200">- Remove redundant tags/sections from specfile
  (cf. packaging guidelines)
- Use %_smp_mflags for parallel build</changelog>
  <changelog author="coolo@suse.com" date="1322827200">- add automake as buildrequire to avoid implicit dependency</changelog>
  <changelog author="varkoly@suse.com" date="1709726400">- Adapt license</changelog>
</package>
<package pkgid="2acad7449741a52acc95476af4a7002a774fa019cc98054ecfc6f3efb88d636a" name="dhcp-tools" arch="x86_64">
  <version epoch="0" ver="1.6" rel="150000.3.3.2"/>
  <changelog author="poeml@suse.de" date="998654400">- update dhcpdump to 1.2 and dhcping to 1.1</changelog>
  <changelog author="poeml@suse.de" date="1059048000">- update dhcpdump to 1.5. Rephrased changelog:
  - better input checking regarding validity of the header of the UDP packet
  - Added some DHCP options from the INIA website (not all are parsed yet)
  - added chaddr filter, contributed by Peter Apian-Bennewitz
  - client-identifier is now printed as long as it is.
  - autoconfiscated
- update dhcping to 1.2 (no significant changes)
- install CHANGES and other accompanying files
- use %defattr
- re-create man pages</changelog>
  <changelog author="poeml@suse.de" date="1078315200">- update dhcpdump to 1.5
  - Option 82, submitted by Phil Pennock &lt;pdp@nl.demon.net&gt;
  - Add fflush(), submitted by Gary Colman &lt;gary@colmans.net&gt;
  - Fix problem with padding, they were not handled properly
    and caused old memory to be reused.
- compile with -fno-strict-aliasing</changelog>
  <changelog author="poeml@suse.de" date="1084190400">- fix parsing of IP header for output of tcpdump-3.8.1 [#38528]</changelog>
  <changelog author="poeml@suse.de" date="1094731200">- fix parsing of IP header and data packages for output of
  tcpdump-3.8.[23] [#44946], and apply the fix on 9.2 or newer
- apply previous patch on 9.1 or newer</changelog>
  <changelog author="dmueller@suse.de" date="1128513600">- add norootforbuild</changelog>
  <changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
  <changelog author="jengelh@medozas.de" date="1316347200">- Remove redundant tags/sections from specfile
  (cf. packaging guidelines)
- Use %_smp_mflags for parallel build</changelog>
  <changelog author="coolo@suse.com" date="1322827200">- add automake as buildrequire to avoid implicit dependency</changelog>
  <changelog author="varkoly@suse.com" date="1709726400">- Adapt license</changelog>
</package>
<package pkgid="b8ade41487087ae0ceff3206f1a9e8b2a7761aa4ccf2809a35a61bb31d95334e" name="dlm-kmp-64kb" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.14.1"/>
  <changelog author="tiwai@suse.de" date="1719662400">- gpiolib: cdev: Disallow reconfiguration without direction
  (uAPI v1) (git-fixes).
- gpio: davinci: Validate the obtained number of IRQs (git-fixes).
- commit 919ebd1</changelog>
  <changelog author="tiwai@suse.de" date="1719748800">- i2c: testunit: discard write requests while old command is
  running (git-fixes).
- i2c: testunit: don't erase registers after STOP (git-fixes).
- mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
  (git-fixes).
- mmc: sdhci: Do not invert write-protect twice (git-fixes).
- mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
  (git-fixes).
- mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
  (git-fixes).
- commit 448487d</changelog>
  <changelog author="tiwai@suse.de" date="1719748801">- crypto: iaa - Account for cpu-less numa nodes (bsc#1227190).
- commit cd600aa</changelog>
  <changelog author="tiwai@suse.de" date="1719748802">- crypto: deflate - Add aliases to deflate (bsc#1227190).
- commit 27ffd92</changelog>
  <changelog author="tiwai@suse.de" date="1719835200">- ata: ahci: Clean up sysfs file on error (git-fixes).
- ata: libata-core: Fix double free on error (git-fixes).
- ata,scsi: libata-core: Do not leak memory for ata_port struct
  members (git-fixes).
- ata: libata-core: Fix null pointer dereference on error
  (git-fixes).
- kbuild: Fix build target deb-pkg: ln: failed to create hard link
  (git-fixes).
- kbuild: doc: Update default INSTALL_MOD_DIR from extra to
  updates (git-fixes).
- kbuild: Install dtb files as 0644 in Makefile.dtbinst
  (git-fixes).
- counter: ti-eqep: enable clock at probe (git-fixes).
- iio: chemical: bme680: Fix sensor data read operation
  (git-fixes).
- iio: chemical: bme680: Fix overflows in compensate() functions
  (git-fixes).
- iio: chemical: bme680: Fix calibration data variable
  (git-fixes).
- iio: chemical: bme680: Fix pressure value output (git-fixes).
- iio: accel: fxls8962af: select IIO_BUFFER &amp; IIO_KFIFO_BUF
  (git-fixes).
- iio: adc: ad7266: Fix variable checking bug (git-fixes).
- iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
  (git-fixes).
- serial: bcm63xx-uart: fix tx after conversion to
  uart_port_tx_limited() (git-fixes).
- serial: core: introduce uart_port_tx_limited_flags()
  (git-fixes).
- Revert "serial: core: only stop transmit when HW fifo is empty"
  (git-fixes).
- tty: mcf: MCF54418 has 10 UARTS (git-fixes).
- usb: gadget: aspeed_udc: fix device address configuration
  (git-fixes).
- usb: dwc3: core: remove lock of otg mode during gadget
  suspend/resume to avoid deadlock (git-fixes).
- usb: typec: ucsi: glink: fix child node release in probe
  function (git-fixes).
- usb: musb: da8xx: fix a resource leak in probe() (git-fixes).
- usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  (git-fixes).
- usb: gadget: printer: fix races against disable (git-fixes).
- PCI/MSI: Fix UAF in msi_capability_init (git-fixes).
- commit a2ea5a9</changelog>
  <changelog author="ptesarik@suse.com" date="1719835201">- net: ena: Fix redundant device NUMA node override
  (jsc#PED-8688).
- commit 6ad6684</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835202">- tcp: do not accept ACK of bytes we never sent (CVE-2023-52881
  bsc#1225611).
- commit 16404a6</changelog>
  <changelog author="mhocko@suse.com" date="1719835203">- Update
  patches.suse/1352-drm-amdgpu-Fix-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52883
  bsc#1226630).
- Update
  patches.suse/9p-add-missing-locking-around-taking-dentry-fid-list.patch
  (git-fixes CVE-2024-39463 bsc#1227090).
- Update
  patches.suse/ALSA-Fix-deadlocks-with-kctl-removals-at-disconnecti.patch
  (stable-fixes CVE-2024-38600 bsc#1226864).
- Update
  patches.suse/ALSA-core-Fix-NULL-module-pointer-assignment-at-card.patch
  (git-fixes CVE-2024-38605 bsc#1226740).
- Update
  patches.suse/ALSA-hda-Fix-possible-null-ptr-deref-when-assigning-.patch
  (git-fixes CVE-2023-52806 bsc#1225554).
- Update
  patches.suse/ALSA-hda-cs_dsp_ctl-Use-private_free-for-control-cle.patch
  (git-fixes CVE-2024-38388 bsc#1226890).
- Update
  patches.suse/ALSA-timer-Set-lower-bound-of-start-tick-time.patch
  (stable-fixes git-fixes CVE-2024-38618 bsc#1226754).
- Update
  patches.suse/ASoC-kirkwood-Fix-potential-NULL-dereference.patch
  (git-fixes CVE-2024-38550 bsc#1226633).
- Update
  patches.suse/ASoC-mediatek-Assign-dummy-when-codec-not-specified-.patch
  (git-fixes CVE-2024-38551 bsc#1226761).
- Update
  patches.suse/Bluetooth-btusb-Add-date-evt_skb-is-NULL-check.patch
  (git-fixes CVE-2023-52833 bsc#1225595).
- Update
  patches.suse/Bluetooth-hci_core-Fix-possible-buffer-overflow.patch
  (git-fixes CVE-2024-26889).
- Update
  patches.suse/HID-uclogic-Fix-user-memory-access-bug-in-uclogic_pa.patch
  (git-fixes CVE-2023-52866 bsc#1225120).
- Update
  patches.suse/IB-mlx5-Fix-init-stage-error-handling-to-avoid-doubl.patch
  (jsc#PED-6864 CVE-2023-52851 bsc#1225587).
- Update
  patches.suse/Input-cyapa-add-missing-input-core-locking-to-suspen.patch
  (git-fixes CVE-2023-52884 bsc#1226764).
- Update
  patches.suse/Input-synaptics-rmi4-fix-use-after-free-in-rmi_unreg.patch
  (git-fixes CVE-2023-52840 bsc#1224928).
- Update
  patches.suse/KEYS-trusted-Do-not-use-WARN-when-encode-fails.patch
  (git-fixes CVE-2024-36975 bsc#1226520).
- Update
  patches.suse/KEYS-trusted-Fix-memory-leak-in-tpm2_key_encode.patch
  (git-fixes CVE-2024-36967 bsc#1226131).
- Update
  patches.suse/RDMA-cma-Fix-kmemleak-in-rdma_core-observed-during-b.patch
  (git-fixes CVE-2024-38539 bsc#1226608).
- Update patches.suse/RDMA-hns-Fix-UAF-for-cq-async-event.patch
  (git-fixes CVE-2024-38545 bsc#1226595).
- Update
  patches.suse/RDMA-hns-Fix-deadlock-on-SRQ-async-events.patch
  (git-fixes CVE-2024-38591 bsc#1226738).
- Update
  patches.suse/RDMA-hns-Modify-the-print-level-of-CQE-error.patch
  (git-fixes CVE-2024-38590 bsc#1226839).
- Update
  patches.suse/RDMA-rxe-Fix-seg-fault-in-rxe_comp_queue_pkt.patch
  (git-fixes CVE-2024-38544 bsc#1226597).
- Update
  patches.suse/SUNRPC-Fix-RPC-client-cleaned-up-the-freed-pipefs-de.patch
  (git-fixes CVE-2023-52803 bsc#1225008).
- Update patches.suse/af_unix-Clear-stale-u-oob_skb.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-35970 bsc#1224584).
- Update
  patches.suse/af_unix-Drop-oob_skb-ref-before-purging-queue-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26750 bsc#1222617).
- Update
  patches.suse/af_unix-Fix-task-hung-while-purging-oob_skb-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26780 bsc#1222588).
- Update
  patches.suse/af_unix-Update-unix_sk-sk-oob_skb-under-sk_receive_queue-lock.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-36972 bsc#1226163).
- Update
  patches.suse/arm64-Restrict-CPU_BIG_ENDIAN-to-GNU-as-or-LLVM-IAS-.patch
  (git-fixes CVE-2023-52750 bsc#1225485).
- Update
  patches.suse/atl1c-Work-around-the-DMA-RX-overflow-issue.patch
  (git-fixes CVE-2023-52834 bsc#1225599).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issue-of-net_device.patch
  (git-fixes CVE-2024-38554 bsc#1226742).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issues-of-ax25_dev.patch
  (git-fixes CVE-2024-38602 bsc#1226613).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-reorder-of-WRITE-lqueued.patch
  (bsc#1225605 CVE-2024-38384 bsc#1226938).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-resetting-io-stat.patch
  (bsc#1225605 CVE-2024-38663 bsc#1226939).
- Update
  patches.suse/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch
  (git-fixes CVE-2024-38540 bsc#1226582).
- Update
  patches.suse/bonding-stop-the-device-in-bond_setup_by_slave.patch
  (git-fixes CVE-2023-52784 bsc#1224946).
- Update
  patches.suse/can-dev-can_put_echo_skb-don-t-crash-kernel-if-can_p.patch
  (git-fixes CVE-2023-52878 bsc#1225000).
- Update
  patches.suse/clk-mediatek-clk-mt2701-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52875 bsc#1225096).
- Update
  patches.suse/clk-mediatek-clk-mt6765-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52870 bsc#1224937).
- Update
  patches.suse/clk-mediatek-clk-mt6779-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52873 bsc#1225589).
- Update
  patches.suse/clk-mediatek-clk-mt6797-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52865 bsc#1225086).
- Update
  patches.suse/clk-mediatek-clk-mt7629-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52858 bsc#1225566).
- Update
  patches.suse/clk-mediatek-clk-mt7629-eth-Add-check-for-mtk_alloc_.patch
  (git-fixes CVE-2023-52876 bsc#1225036).
- Update
  patches.suse/cppc_cpufreq-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38573 bsc#1226739).
- Update patches.suse/cpufreq-exit-callback-is-optional.patch
  (git-fixes CVE-2024-38615 bsc#1226592).
- Update patches.suse/crypto-bcm-Fix-pointer-arithmetic.patch
  (git-fixes CVE-2024-38579 bsc#1226637).
- Update
  patches.suse/crypto-pcrypt-Fix-hungtask-for-PADATA_RESET.patch
  (git-fixes CVE-2023-52813 bsc#1225527).
- Update patches.suse/cxl-mem-Fix-shutdown-order.patch (git-fixes
  CVE-2023-52849 bsc#1224949).
- Update
  patches.suse/cxl-region-Do-not-try-to-cleanup-after-cxl_region_se.patch
  (git-fixes CVE-2023-52792 bsc#1225477).
- Update patches.suse/cxl-region-Fix-cxlr_pmem-leaks.patch
  (git-fixes CVE-2024-38391 bsc#1226894).
- Update
  patches.suse/dma-buf-sw-sync-don-t-enable-IRQ-from-sync_print_obj.patch
  (git-fixes CVE-2024-38780 bsc#1226886).
- Update
  patches.suse/dma-mapping-benchmark-fix-node-id-validation.patch
  (git-fixes CVE-2024-34777 bsc#1226796).
- Update
  patches.suse/dma-mapping-benchmark-handle-NUMA_NO_NODE-correctly.patch
  (git-fixes CVE-2024-39277 bsc#1226909).
- Update
  patches.suse/dmaengine-idxd-Avoid-unnecessary-destruction-of-file.patch
  (git-fixes CVE-2024-38629 bsc#1226905).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Pola.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52819
  bsc#1225532).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-SMU7.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52818
  bsc#1225530).
- Update
  patches.suse/drm-amd-check-num-of-link-levels-when-update-pcie-pa.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52812
  bsc#1225564).
- Update
  patches.suse/drm-amd-display-Avoid-NULL-dereference-of-timing-gen.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52753
  bsc#1225478).
- Update
  patches.suse/drm-amd-display-Fix-division-by-zero-in-setup_dsc_co.patch
  (stable-fixes CVE-2024-36969 bsc#1226155).
- Update
  patches.suse/drm-amd-display-Fix-null-pointer-dereference-in-erro.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52862
  bsc#1225015).
- Update
  patches.suse/drm-amd-display-Fix-potential-index-out-of-bounds-in.patch
  (git-fixes CVE-2024-38552 bsc#1226767).
- Update
  patches.suse/drm-amd-display-fix-a-NULL-pointer-dereference-in-am.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52773
  bsc#1225041).
- Update
  patches.suse/drm-amd-display-fixed-integer-types-and-null-check-l.patch
  (git-fixes CVE-2024-26767).
- Update
  patches.suse/drm-amdgpu-Fix-a-null-pointer-access-when-the-smc_rr.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52817
  bsc#1225569).
- Update
  patches.suse/drm-amdgpu-Fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch
  (git-fixes CVE-2024-39291 bsc#1226934).
- Update
  patches.suse/drm-amdgpu-Fix-potential-null-pointer-derefernce.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52814
  bsc#1225565).
- Update
  patches.suse/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch
  (stable-fixes CVE-2024-39471 bsc#1227096).
- Update
  patches.suse/drm-amdgpu-mes-fix-use-after-free-issue.patch
  (stable-fixes CVE-2024-38581 bsc#1226657).
- Update
  patches.suse/drm-amdgpu-vkms-fix-a-possible-null-pointer-derefere.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52815
  bsc#1225568).
- Update
  patches.suse/drm-amdkfd-Fix-a-race-condition-of-vram-buffer-unref.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52825
  bsc#1225076).
- Update
  patches.suse/drm-amdkfd-Fix-shift-out-of-bounds-issue.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52816
  bsc#1225529).
- Update
  patches.suse/drm-bridge-cdns-mhdp8546-Fix-possible-null-pointer-d.patch
  (git-fixes CVE-2024-38548).
- Update
  patches.suse/drm-bridge-it66121-Fix-invalid-connector-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52861
  bsc#1224941).
- Update
  patches.suse/drm-bridge-lt8912b-Fix-crash-on-bridge-detach.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52856
  bsc#1224932).
- Update
  patches.suse/drm-mediatek-Add-0-size-check-to-mtk_drm_gem_obj.patch
  (git-fixes CVE-2024-38549 bsc#1226735).
- Update
  patches.suse/drm-mediatek-Fix-coverity-issue-with-unintentional-i.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52857
  bsc#1225581).
- Update
  patches.suse/drm-mediatek-Init-ddp_comp-with-devm_kcalloc.patch
  (git-fixes CVE-2024-38592 bsc#1226844).
- Update
  patches.suse/drm-msm-a6xx-Avoid-a-nullptr-dereference-when-speedb.patch
  (git-fixes CVE-2024-38390 bsc#1226891).
- Update
  patches.suse/drm-msm-dpu-Add-callback-function-pointer-check-befo.patch
  (git-fixes CVE-2024-38622 bsc#1226856).
- Update
  patches.suse/drm-panel-fix-a-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52821
  bsc#1225022).
- Update
  patches.suse/drm-panel-panel-tpo-tpg110-fix-a-possible-null-point.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52826
  bsc#1225077).
- Update patches.suse/drm-radeon-possible-buffer-overflow.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52867
  bsc#1225009).
- Update
  patches.suse/drm-vc4-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38546 bsc#1226593).
- Update
  patches.suse/drm-vmwgfx-Fix-invalid-reads-in-fence-signaled-event.patch
  (git-fixes CVE-2024-36960 bsc#1225872).
- Update
  patches.suse/drm-zynqmp_dpsub-Always-register-bridge.patch
  (git-fixes CVE-2024-38664 bsc#1226941).
- Update
  patches.suse/e1000e-change-usleep_range-to-udelay-in-PHY-mdic-acc.patch
  (CVE-2024-39296 bsc#1226989 CVE-2024-36887 bsc#1225731).
- Update
  patches.suse/ecryptfs-Fix-buffer-size-for-tag-66-packet.patch
  (git-fixes CVE-2024-38578 bsc#1226634).
- Update
  patches.suse/efi-libstub-only-free-priv.runtime_map-when-allocate.patch
  (git-fixes CVE-2024-33619 bsc#1226768).
- Update
  patches.suse/fbdev-imsttfb-fix-a-resource-leak-in-probe.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52838
  bsc#1225031).
- Update
  patches.suse/fs-9p-only-translate-RWX-permissions-for-plain-9P200.patch
  (git-fixes CVE-2024-36964 bsc#1225866).
- Update
  patches.suse/fs-jfs-Add-check-for-negative-db_l2nbperpage.patch
  (git-fixes CVE-2023-52810 bsc#1225557).
- Update
  patches.suse/fs-jfs-Add-validity-check-for-db_maxag-and-db_agpref.patch
  (git-fixes CVE-2023-52804 bsc#1225550).
- Update
  patches.suse/ftrace-Fix-possible-use-after-free-issue-in-ftrace_location.patch
  (git-fixes CVE-2024-38588 bsc#1226837).
- Update
  patches.suse/genirq-irqdesc-Prevent-use-after-free-in-irq_find_at.patch
  (git-fixes CVE-2024-38385 bsc#1227085).
- Update patches.suse/gfs2-ignore-negated-quota-changes.patch
  (git-fixes CVE-2023-52759 bsc#1225560).
- Update
  patches.suse/hid-cp2112-Fix-duplicate-workqueue-initialization.patch
  (git-fixes CVE-2023-52853 bsc#1224988).
- Update
  patches.suse/hwmon-axi-fan-control-Fix-possible-NULL-pointer-dere.patch
  (git-fixes CVE-2023-52863 bsc#1225586).
- Update
  patches.suse/i2c-acpi-Unbind-mux-adapters-before-delete.patch
  (git-fixes CVE-2024-39362 bsc#1226995).
- Update
  patches.suse/i2c-core-Run-atomic-i2c-xfer-when-preemptible.patch
  (git-fixes CVE-2023-52791 bsc#1225108).
- Update
  patches.suse/i3c-master-mipi-i3c-hci-Fix-a-kernel-panic-for-acces.patch
  (git-fixes CVE-2023-52763 bsc#1225570).
- Update
  patches.suse/i3c-mipi-i3c-hci-Fix-out-of-bounds-access-in-hci_dma.patch
  (git-fixes CVE-2023-52766).
- Update
  patches.suse/i915-perf-Fix-NULL-deref-bugs-with-drm_dbg-calls.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52788
  bsc#1225106).
- Update
  patches.suse/igb-Fix-string-truncation-warnings-in-igb_set_fw_ver.patch
  (git-fixes CVE-2024-36010 bsc#1225594).
- Update
  patches.suse/iommu-vt-d-Fix-WARN_ON-in-iommu-probe-path.patch
  (git-fixes CVE-2024-35957 bsc#1224673).
- Update
  patches.suse/iommufd-Fix-missing-update-of-domains_itree-after-splitting-iopt
  (jsc#PED-7779 jsc#PED-7780 CVE-2023-52801 bsc#1225006).
- Update
  patches.suse/ipvlan-add-ipvlan_route_v6_outbound-helper.patch
  (git-fixes CVE-2023-52796 bsc#1224930).
- Update
  patches.suse/jffs2-prevent-xattr-node-from-overflowing-the-eraseblock.patch
  (git-fixes CVE-2024-38599 bsc#1226848).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-dbFindLeaf.patch
  (git-fixes CVE-2023-52799 bsc#1225472).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-diAlloc.patch
  (git-fixes CVE-2023-52805 bsc#1225553).
- Update
  patches.suse/kunit-fortify-Fix-mismatched-kvalloc-vfree-usage.patch
  (git-fixes CVE-2024-38617 bsc#1226859).
- Update
  patches.suse/lib-generic-radix-tree.c-Don-t-overflow-in-peek.patch
  (git-fixes CVE-2021-47432 bsc#1225391).
- Update
  patches.suse/lib-test_hmm.c-handle-src_pfns-and-dst_pfns-allocati.patch
  (git-fixes CVE-2024-38543 bsc#1226594).
- Update
  patches.suse/locking-ww_mutex-test-Fix-potential-workqueue-corrup.patch
  (bsc#1219953 CVE-2023-52836 bsc#1225609).
- Update
  patches.suse/md-Don-t-ignore-suspended-array-in-md_check_recovery-1baa.patch
  (bsc#1219596 CVE-2024-26758).
- Update
  patches.suse/media-atomisp-ssh_css-Fix-a-null-pointer-dereference.patch
  (git-fixes CVE-2024-38547 bsc#1226632).
- Update
  patches.suse/media-bttv-fix-use-after-free-error-due-to-btv-timeo.patch
  (git-fixes CVE-2023-52847 bsc#1225588).
- Update
  patches.suse/media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch
  (git-fixes CVE-2023-52764 bsc#1225571).
- Update
  patches.suse/media-hantro-Check-whether-reset-op-is-defined-befor.patch
  (git-fixes CVE-2023-52850 bsc#1225014).
- Update
  patches.suse/media-i2c-et8ek8-Don-t-strip-remove-function-when-dr.patch
  (git-fixes CVE-2024-38611 bsc#1226760).
- Update
  patches.suse/media-imon-fix-access-to-invalid-resource-for-the-se.patch
  (git-fixes CVE-2023-52754 bsc#1225490).
- Update
  patches.suse/media-lgdt3306a-Add-a-check-against-null-pointer-def.patch
  (stable-fixes CVE-2022-48772 bsc#1226976).
- Update
  patches.suse/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch
  (git-fixes CVE-2024-38621 bsc#1226895).
- Update
  patches.suse/media-vidtv-mux-Add-check-and-kfree-for-kstrdup.patch
  (git-fixes CVE-2023-52841 bsc#1225592).
- Update patches.suse/media-vidtv-psi-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52844 bsc#1225590).
- Update
  patches.suse/mfd-qcom-spmi-pmic-Fix-revid-implementation.patch
  (git-fixes CVE-2023-52765 bsc#1225029).
- Update
  patches.suse/misc-microchip-pci1xxxx-fix-double-free-in-the-error.patch
  (git-fixes CVE-2024-36973 bsc#1226457).
- Update
  patches.suse/net-hns3-fix-out-of-bounds-access-may-occur-when-coa.patch
  (git-fixes CVE-2023-52807 bsc#1225097).
- Update
  patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch
  (git-fixes CVE-2024-36962 bsc#1225827).
- Update
  patches.suse/net-mlx5-Fix-peer-devlink-set-for-SF-representor-dev.patch
  (git-fixes CVE-2024-38595 bsc#1226741).
- Update
  patches.suse/net-mlx5e-Track-xmit-submission-to-PTP-WQ-after-popu.patch
  (jsc#PED-3311 CVE-2023-52782 bsc#1225103).
- Update
  patches.suse/net-mvneta-fix-calls-to-page_pool_get_stats.patch
  (git-fixes CVE-2023-52780 bsc#1224933).
- Update
  patches.suse/net-wangxun-fix-kernel-panic-due-to-null-pointer.patch
  (git-fixes CVE-2023-52783 bsc#1225104).
- Update
  patches.suse/netfilter-complete-validation-of-user-input.patch
  (git-fixes CVE-2024-35896 bsc#1224662 CVE-2024-35962
  bsc#1224583).
- Update
  patches.suse/nfc-nci-Fix-uninit-value-in-nci_rx_work.patch
  (git-fixes CVE-2024-38381 bsc#1226878).
- Update
  patches.suse/nilfs2-fix-nilfs_empty_dir-misjudgment-and-long-loop.patch
  (git-fixes CVE-2024-39469 bsc#1226992).
- Update
  patches.suse/nilfs2-fix-potential-hang-in-nilfs_detach_log_writer.patch
  (git-fixes CVE-2024-38582 bsc#1226658).
- Update
  patches.suse/nilfs2-fix-use-after-free-of-timer-for-log-writer-th.patch
  (git-fixes CVE-2024-38583 bsc#1226777).
- Update
  patches.suse/of-module-add-buffer-overflow-check-in-of_modalias.patch
  (git-fixes CVE-2024-38541 bsc#1226587).
- Update
  patches.suse/padata-Fix-refcnt-handling-in-padata_free_shell.patch
  (git-fixes CVE-2023-52854 bsc#1225584).
- Update
  patches.suse/perf-core-Bail-out-early-if-the-request-AUX-area-is-out-of-bound.patch
  (git-fixes CVE-2023-52835 bsc#1225602).
- Update
  patches.suse/platform-x86-wmi-Fix-opening-of-char-device.patch
  (git-fixes CVE-2023-52864 bsc#1225132).
- Update
  patches.suse/powerpc-pseries-iommu-LPAR-panics-during-boot-up-wit.patch
  (bsc#1222011 ltc#205900 CVE-2024-36926 bsc#1225829).
- Update patches.suse/pstore-platform-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52869 bsc#1225050).
- Update
  patches.suse/remoteproc-mediatek-Make-sure-IPI-buffer-fits-in-L2T.patch
  (git-fixes CVE-2024-36965 bsc#1226149).
- Update
  patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch
  (git-fixes CVE-2024-38601 bsc#1226876).
- Update
  patches.suse/s390-dasd-protect-device-queue-against-concurrent-access.patch
  (git-fixes bsc#1217481 CVE-2023-52774 bsc#1225572).
- Update
  patches.suse/scsi-hisi_sas-Set-debugfs_dir-pointer-to-NULL-after-removing-debugfs.patch
  (git-fixes CVE-2023-52808 bsc#1225555).
- Update
  patches.suse/scsi-ibmvfc-Remove-BUG_ON-in-the-case-of-an-empty-ev.patch
  (bsc#1209834 ltc#202097 CVE-2023-52811 bsc#1225559).
- Update
  patches.suse/scsi-libfc-Fix-potential-NULL-pointer-dereference-in-fc_lport_ptp_setup.patch
  (git-fixes CVE-2023-52809 bsc#1225556).
- Update
  patches.suse/scsi-lpfc-Move-NPIV-s-transport-unregistration-to-af.patch
  (bsc#1221777 CVE-2024-36952 bsc#1225898).
- Update
  patches.suse/scsi-lpfc-Release-hbalock-before-calling-lpfc_worker.patch
  (bsc#1221777 CVE-2024-36924 bsc#1225820).
- Update
  patches.suse/serial-max3100-Lock-port-lock-when-calling-uart_hand.patch
  (git-fixes CVE-2024-38634 bsc#1226868).
- Update
  patches.suse/serial-max3100-Update-uart_driver_registered-on-driv.patch
  (git-fixes CVE-2024-38633 bsc#1226867).
- Update
  patches.suse/soc-qcom-llcc-Handle-a-second-device-without-data-co.patch
  (git-fixes CVE-2023-52871 bsc#1225534).
- Update
  patches.suse/soundwire-cadence-fix-invalid-PDI-offset.patch
  (stable-fixes CVE-2024-38635 bsc#1226863).
- Update patches.suse/speakup-Fix-sizeof-vs-ARRAY_SIZE-bug.patch
  (git-fixes CVE-2024-38587 bsc#1226780).
- Update patches.suse/spi-Fix-null-dereference-on-suspend.patch
  (git-fixes CVE-2023-52749 bsc#1225476).
- Update
  patches.suse/thermal-core-prevent-potential-string-overflow.patch
  (git-fixes CVE-2023-52868 bsc#1225044).
- Update
  patches.suse/thermal-drivers-qcom-lmh-Check-for-SCM-availability-.patch
  (git-fixes CVE-2024-39466 bsc#1227089).
- Update
  patches.suse/thermal-drivers-tsens-Fix-null-pointer-dereference.patch
  (git-fixes CVE-2024-38571 bsc#1226737).
- Update
  patches.suse/thermal-intel-powerclamp-fix-mismatch-in-get-functio.patch
  (git-fixes CVE-2023-52794 bsc#1225028).
- Update
  patches.suse/tls-fix-NULL-deref-on-tls_sw_splice_eof-with-empty-r.patch
  (jsc#PED-6831 CVE-2023-52767 bsc#1224998).
- Update
  patches.suse/tpm_tis_spi-Account-for-SPI-header-when-allocating-T.patch
  (git-fixes CVE-2024-36477 bsc#1226840).
- Update
  patches.suse/tracing-Have-trace_event_file-have-ref-counters.patch
  (git-fixes CVE-2023-52879 bsc#1225101).
- Update
  patches.suse/tracing-trigger-Fix-to-return-error-if-failed-to-alloc-snapshot.patch
  (git-fixes CVE-2024-26920).
- Update
  patches.suse/tty-n_gsm-fix-race-condition-in-status-line-change-o.patch
  (git-fixes CVE-2023-52872 bsc#1225591).
- Update
  patches.suse/tty-n_gsm-require-CAP_NET_ADMIN-to-attach-N_GSM0710-.patch
  (bsc#1222619 CVE-2023-52880).
- Update
  patches.suse/tty-vcc-Add-check-for-kstrdup-in-vcc_probe.patch
  (git-fixes CVE-2023-52789 bsc#1225180).
- Update
  patches.suse/usb-config-fix-iteration-issue-in-usb_get_bos_descri.patch
  (git-fixes CVE-2023-52781 bsc#1225092).
- Update
  patches.suse/usb-dwc3-Wait-unconditionally-after-issuing-EndXfer-.patch
  (git-fixes CVE-2024-36977 bsc#1226513).
- Update
  patches.suse/usb-gadget-u_audio-Fix-race-condition-use-of-control.patch
  (git-fixes CVE-2024-38628 bsc#1226911).
- Update
  patches.suse/usb-storage-alauda-Check-whether-the-media-is-initia.patch
  (git-fixes CVE-2024-38619 bsc#1226861).
- Update
  patches.suse/usb-typec-tcpm-Fix-NULL-pointer-dereference-in-tcpm_.patch
  (git-fixes CVE-2023-52877 bsc#1224944).
- Update
  patches.suse/vhost-vdpa-fix-use-after-free-in-vhost_vdpa_probe.patch
  (jsc#PED-3311 CVE-2023-52795 bsc#1225085).
- Update
  patches.suse/virtio-blk-fix-implicit-overflow-on-virtio_max_dma_s.patch
  (git-fixes CVE-2023-52762 bsc#1225573).
- Update
  patches.suse/virtio-vsock-Fix-uninit-value-in-virtio_transport_re.patch
  (jsc#PED-5505 CVE-2023-52842 bsc#1225025).
- Update
  patches.suse/watchdog-cpu5wdt.c-Fix-use-after-free-bug-caused-by-.patch
  (git-fixes CVE-2024-38630 bsc#1226908).
- Update
  patches.suse/wifi-ar5523-enable-proper-endpoint-verification.patch
  (git-fixes CVE-2024-38565 bsc#1226747).
- Update
  patches.suse/wifi-ath11k-fix-dfs-radar-event-locking.patch
  (git-fixes CVE-2023-52798 bsc#1224947).
- Update
  patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch
  (git-fixes CVE-2023-52777 bsc#1224992).
- Update patches.suse/wifi-ath11k-fix-htt-pktlog-locking.patch
  (git-fixes CVE-2023-52800).
- Update
  patches.suse/wifi-ath12k-fix-dfs-radar-and-temperature-event-lock.patch
  (git-fixes CVE-2023-52776 bsc#1225090).
- Update
  patches.suse/wifi-ath12k-fix-htt-mlo-offset-event-locking.patch
  (git-fixes CVE-2023-52769 bsc#1225001).
- Update
  patches.suse/wifi-ath12k-fix-out-of-bound-access-of-qmi_invoke_ha.patch
  (git-fixes CVE-2024-38572 bsc#1226776).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-read-in-ath12k.patch
  (git-fixes CVE-2023-52827 bsc#1225078).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-write-in-ath12.patch
  (git-fixes CVE-2023-52829 bsc#1225081).
- Update
  patches.suse/wifi-brcmfmac-pcie-handle-randbuf-allocation-failure.patch
  (git-fixes CVE-2024-38575 bsc#1226612).
- Update
  patches.suse/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch
  (git-fixes CVE-2024-38567 bsc#1226769).
- Update
  patches.suse/wifi-carl9170-re-fix-fortified-memset-warning.patch
  (git-fixes CVE-2024-38616 bsc#1226852).
- Update
  patches.suse/wifi-mac80211-don-t-return-unset-power-in-ieee80211_.patch
  (git-fixes CVE-2023-52832 bsc#1225577).
- Update
  patches.suse/wifi-nl80211-Avoid-address-calculations-via-out-of-b.patch
  (git-fixes CVE-2024-38562 bsc#1226788).
- Update
  patches.suse/wifi-wilc1000-use-vmm_table-as-array-in-wilc-struct.patch
  (git-fixes CVE-2023-52768 bsc#1225004).
- Update
  patches.suse/x86-tdx-Zero-out-the-missing-RSI-in-TDX_HYPERCALL-macro.patch
  (jsc#PED-5824 CVE-2023-52874 bsc#1225049).
- commit 33efdc4</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835204">- tcp: Use refcount_inc_not_zero() in tcp_twsk_unique()
  (CVE-2024-36904 bsc#1225732).
- commit d578dcc</changelog>
  <changelog author="heming.zhao@suse.com" date="1719921600">- gfs2: Fix potential glock use-after-free on unmount (bsc#1226775
  CVE-2024-38570).
- gfs2: Rename sd_{ glock =&gt; kill }_wait (bsc#1226775
  CVE-2024-38570).
- commit f3adbca</changelog>
  <changelog author="tiwai@suse.de" date="1719921601">- Correct SCSI patch references (bsc#1225767 CVE-2024-36919 bsc#1226785 CVE-2024-38559)
- commit e8ea587</changelog>
  <changelog author="tiwai@suse.de" date="1719921602">- mtd: rawnand: rockchip: ensure NVDDR timings are rejected
  (git-fixes).
- mtd: rawnand: Bypass a couple of sanity checks during NAND
  identification (git-fixes).
- mtd: rawnand: Fix the nand_read_data_op() early check
  (git-fixes).
- mtd: rawnand: Ensure ECC configuration is propagated to upper
  layers (git-fixes).
- commit e545951</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1719921603">- kernel-doc: fix struct_group_tagged() parsing (git-fixes).
- commit e3a2a2e</changelog>
  <changelog author="fdmanana@suse.com" date="1719921604">- btrfs: fix crash on racing fsync and size-extending write into
  prealloc (bsc#1227101 CVE-2024-37354).
- commit 1d355af</changelog>
  <changelog author="vbabka@suse.cz" date="1719921605">- virt: acrn: stop using follow_pfn (CVE-2024-38610 bsc#1226758).
- commit c2ea51b</changelog>
  <changelog author="vbabka@suse.cz" date="1719921606">- drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
  (CVE-2024-38610 bsc#1226758).
- commit 7069ac2</changelog>
  <changelog author="rhopkins@suse.de" date="1719921607">- hsr: Prevent use after free in prp_create_tagged_frame()
  (CVE-2023-52846 bsc#1225098).
- commit cf63988</changelog>
  <changelog author="krisman@suse.de" date="1719921608">- io_uring: Fix io_cqring_wait() not restoring sigmask on
  get_timespec64() failure (git-fixes).
- commit e640a65</changelog>
  <changelog author="krisman@suse.de" date="1719921609">- io_uring: check for non-NULL file pointer in io_file_can_poll()
  (bsc#1226990 CVE-2024-39371).
- io_uring/io-wq: Use set_bit() and test_bit() at worker-&gt;flags
  (git-fixes).
- io_uring/sqpoll: work around a potential audit memory leak
  (git-fixes).
- commit 24603fc</changelog>
  <changelog author="krisman@suse.de" date="1719921610">- io_uring/rsrc: fix incorrect assignment of iter-&gt;nr_segs in
  io_import_fixed (git-fixes).
- io_uring/rsrc: don't lock while !TASK_RUNNING (git-fixes).
- io_uring/io-wq: avoid garbage value of 'match' in
  io_wq_enqueue() (git-fixes).
- commit 7d3e252</changelog>
</package>
<package pkgid="09b66a401067a361bd58676091dd3b6941468e39c53f531c74a7c11e5824e353" name="dlm-kmp-64kb" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.17.1"/>
  <changelog author="tiwai@suse.de" date="1722081600">- auxdisplay: ht16k33: Drop reference after LED registration
  (git-fixes).
- ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
  on unprepare (git-fixes).
- ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
- ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
  reachable (git-fixes).
- ASoC: sof: amd: fix for firmware reload failure in Vangogh
  platform (git-fixes).
- ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
- ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
  (git-fixes).
- ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
- ALSA: ump: Don't update FB name for static blocks (git-fixes).
- drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
- drm/i915/gt: Do not consider preemption during execlists_dequeue
  for gen8 (git-fixes).
- drm/i915/dp: Don't switch the LTTPR mode on an active link
  (git-fixes).
- commit d7e2deb</changelog>
  <changelog author="tiwai@suse.de" date="1722081601">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
</package>
<package pkgid="4481a6676992b9292330b003e6b5a67ab0f7fb606a027b4fb7f72f0ccee74899" name="dlm-kmp-64kb" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.7.3"/>
  <changelog author="mkubecek@suse.cz" date="1717416000">- netfilter: nf_tables: release mutex after nft_gc_seq_end from
  abort path (CVE-2024-26925 bsc#1223390).
- commit 578a709</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717416001">- Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
  The L3 bsc#1225765 was created seperately since our customer requires
  PTF.
- Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
- Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
- Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
- Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
- commit 054635e</changelog>
  <changelog author="msuchanek@suse.de" date="1717416002">- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
- powerpc/uaccess: Fix build errors seen with GCC 13/14
  (bsc#1194869).
- commit 46b5d84</changelog>
  <changelog author="msuchanek@suse.de" date="1717416003">- blacklist.conf: PPC fsl_msi is not used
- commit ae6590d</changelog>
  <changelog author="msuchanek@suse.de" date="1717416004">- powerpc/pseries/lparcfg: drop error message from guest name
  lookup (bsc#1187716 ltc#193451 git-fixes).
- commit ceab637</changelog>
  <changelog author="mfranc@suse.cz" date="1717416005">- Update
  patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
  (git-fixes CVE-2024-36955).
- Update
  patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
  (git-fixes bsc#1225715 CVE-2024-36906).
- Update
  patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
  (git-fixes bsc#1225579 CVE-2024-36011).
- Update
  patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
  (git-fixes bsc#1225578 CVE-2024-36013).
- Update
  patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
  (git-fixes bsc#1225502 CVE-2024-36012).
- Update
  patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
  (git-fixes bsc#1225722 CVE-2024-36880).
- Update
  patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
  (git-fixes CVE-2024-36942).
- Update
  patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
  (git-fixes bsc#1225720 CVE-2024-36032).
- Update
  patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
  (git-fixes bsc#1223749 CVE-2024-26990).
- Update
  patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
  (git-fixes bsc#1223692 CVE-2024-26992).
- Update
  patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
  (stable-fixes CVE-2024-36944).
- Update
  patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
  (git-fixes bsc#1225734 CVE-2024-36896).
- Update
  patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
  (stable-fixes CVE-2024-36949).
- Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
  (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
- Update
  patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
  (git-fixes bsc#1225692 CVE-2023-52882).
- Update
  patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
  (git-fixes CVE-2024-26761).
- Update
  patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
  (stable-fixes bsc#1225735 CVE-2024-36897).
- Update
  patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
  (stable-fixes bsc#1225705 CVE-2024-36026).
- Update
  patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
  (stable-fixes CVE-2024-36951).
- Update
  patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
  (git-fixes bsc#1225593 CVE-2024-36014).
- Update
  patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
  (stable-fixes bsc#1225728 CVE-2024-36885).
- Update
  patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
  (git-fixes bsc#1225773 CVE-2024-36936).
- Update
  patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
  (stable-fixes CVE-2024-36950).
- Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
  (git-fixes bsc#1225736 CVE-2024-36898).
- Update
  patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
  (git-fixes bsc#1225698 CVE-2024-36020).
- Update
  patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
  (git-fixes bsc#1225710 CVE-2024-36891).
- Update
  patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
  (git-fixes bsc#1225714 CVE-2024-36890).
- Update
  patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
  (git-fixes bsc#1225708 CVE-2024-36029).
- Update
  patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
  (git-fixes bsc#1225699 CVE-2024-36021).
- Update
  patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
  (git-fixes CVE-2024-26943).
- Update
  patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
  (git-fixes bsc#1225694 CVE-2024-36018).
- Update
  patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
  (git-fixes CVE-2024-36940).
- Update
  patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
  (git-fixes CVE-2024-36959).
- Update
  patches.suse/ppdev-Add-an-error-check-in-register_device.patch
  (git-fixes bsc#1225640 CVE-2024-36015).
- Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
  CVE-2024-36947).
- Update
  patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
  (git-fixes bsc#1225695 CVE-2024-36019).
- Update
  patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
  (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
- Update
  patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
  (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
- Update
  patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
  (git-fixes bsc#1225704 CVE-2024-36025).
- Update
  patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
  (git-fixes CVE-2024-36930).
- Update
  patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
  (bsc#1224331 bsc#1224602 CVE-2024-35814).
- Update
  patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
  (git-fixes bsc#1225642 CVE-2024-36016).
- Update
  patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
  (git-fixes bsc#1225749 CVE-2024-36894).
- Update
  patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
  (git-fixes bsc#1225750 CVE-2024-36895).
- Update
  patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
  (git-fixes bsc#1225748 CVE-2024-36893).
- Update
  patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
  (stable-fixes bsc#1225769 CVE-2024-36921).
- Update
  patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
  (stable-fixes CVE-2024-36922).
- Update
  patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
  (git-fixes CVE-2024-36941).
- Update
  patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
  (git-fixes bsc#1224742 CVE-2024-35803).
- commit 539780f</changelog>
  <changelog author="dwagner@suse.de" date="1717416006">- nvmet: fix ns enable/disable possible hang (git-fixes).
- nvme-multipath: fix io accounting on failover (git-fixes).
- nvme: fix multipath batched completion accounting (git-fixes).
- commit ed3b392</changelog>
  <changelog author="dwagner@suse.de" date="1717416007">- scsi: lpfc: Copyright updates for 14.4.0.2 patches
  (bsc#1225842).
- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
  (bsc#1225842).
  Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
  (bsc#1225842).
- scsi: lpfc: Clear deferred RSCN processing flag when driver
  is unloading (bsc#1225842).
- scsi: lpfc: Update logging of protection type for T10 DIF I/O
  (bsc#1225842).
- scsi: lpfc: Change default logging level for unsolicited CT
  MIB commands (bsc#1225842).
- commit 5a56384</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416008">- smb: client: fix mount when dns_resolver key is not available
  (git-fixes, bsc#1225172).
- commit 28edb5c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416009">- cifs: fix leak of iface for primary channel (git-fixes,
  bsc#1225172).
- commit b7eb8e8</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416010">- Revert "cifs: reconnect work should have reference on server
  struct" (git-fixes, bsc#1225172).
- commit 3ca4c0c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416011">- smb: client: fix parsing of SMB3.1.1 POSIX create context
  (git-fixes, bsc#1225172).
- commit 5f27f69</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416012">- cifs: failure to add channel on iface should bump up weight
  (git-fixes, bsc#1225172).
- commit 007b237</changelog>
  <changelog author="tonyj@suse.de" date="1717416013">- perf/x86: Fix out of range data (git-fixes).
- perf/x86/intel/ds: Don't clear -&gt;pebs_data_cfg for the last
  PEBS event (git-fixes).
- perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
- commit 664d77f</changelog>
  <changelog author="dsterba@suse.com" date="1717588800">- blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
- Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
  Quoting bsc#1225945#c11:
  "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
  transaction for every subvol create")
  ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
  unwritten extent buffer after snapshotting a new subvolume") was never
  backported."
- commit d947258</changelog>
  <changelog author="tonyj@suse.de" date="1717588801">- perf pmu: Count sys and cpuid JSON events separately (git
  fixes).
- perf stat: Don't display metric header for non-leader uncore
  events (git-fixes).
- perf daemon: Fix file leak in daemon_session__control
  (git-fixes).
- perf symbols: Fix ownership of string in dso__load_vmlinux()
  (git-fixes).
- perf thread: Fixes to thread__new() related to initializing comm
  (git-fixes).
- perf report: Avoid SEGV in report__setup_sample_type()
  (git-fixes).
- perf ui browser: Don't save pointer to stack memory (git-fixes).
- perf bench internals inject-build-id: Fix trap divide when
  collecting just one DSO (git-fixes).
- perf intel-pt: Fix unassigned instruction op (discovered by
  MemorySanitizer) (git-fixes).
- perf test shell arm_coresight: Increase buffer size for
  Coresight basic tests (git-fixes).
- perf docs: Document bpf event modifier (git-fixes).
- perf bench uprobe: Remove lib64 from libc.so.6 binary path
  (git-fixes).
- perf record: Fix debug message placement for test consumption
  (git-fixes).
- perf tests: Apply attributes to all events in object code
  reading test (git-fixes).
- perf tests: Make "test data symbol" more robust on Neoverse N1
  (git-fixes).
- perf annotate: Fix annotation_calc_lines() to pass correct
  address to get_srcline() (git-fixes).
- perf stat: Do not fail on metrics on s390 z/VM systems
  (git-fixes).
- perf sched timehist: Fix -g/--call-graph option failure
  (git-fixes).
- perf annotate: Get rid of duplicate --group option item
  (git-fixes).
- perf probe: Add missing libgen.h header needed for using
  basename() (git-fixes).
- perf record: Delete session after stopping sideband thread
  (git-fixes).
- perf auxtrace: Fix multiple use of --itrace option (git-fixes).
- perf script: Show also errors for --insn-trace option
  (git-fixes).
- perf lock contention: Add a missing NULL check (git-fixes).
- perf vendor events amd: Fix Zen 4 cache latency events
  (git-fixes).
- libperf evlist: Avoid out-of-bounds access (git-fixes).
- perf pmu: Fix a potential memory leak in perf_pmu__lookup()
  (git-fixes).
- perf print-events: make is_event_supported() more robust
  (git-fixes).
- perf list: fix short description for some cache events
  (git-fixes).
- perf metric: Don't remove scale from counts (git-fixes).
- perf stat: Avoid metric-only segv (git-fixes).
- perf expr: Fix "has_event" function for metric style events
  (git-fixes).
- perf srcline: Add missed addr2line closes (git-fixes).
- perf thread_map: Free strlist on normal path in
  thread_map__new_by_tid_str() (git-fixes).
- perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
- perf jevents: Drop or simplify small integer values (git-fixes).
- perf evsel: Fix duplicate initialization of data-&gt;id in
  evsel__parse_sample() (git-fixes).
- perf pmu: Treat the msr pmu as software (git-fixes).
- perf record: Check conflict between '--timestamp-filename'
  option and pipe mode before recording (git-fixes).
- perf record: Fix possible incorrect free in
  record__switch_output() (git-fixes).
- perf vendor events amd: Add Zen 4 memory controller events
  (git-fixes).
- perf top: Uniform the event name for the hybrid machine
  (git-fixes).
- perf top: Use evsel's cpus to replace user_requested_cpus
  (git-fixes).
- commit a1f9340</changelog>
  <changelog author="tonyj@suse.de" date="1717675200">- perf ui browser: Avoid SEGV on title (git fixes).
- commit 1578c22</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675201">- inet: inet_defrag: prevent sk release while still in use
  (CVE-2024-26921 bsc#1223138).
- commit 2016faf</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675202">- net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
- commit 7bf5961</changelog>
  <changelog author="tiwai@suse.de" date="1718366400">- Temporarily drop KVM patch that caused a regression (bsc#1226158)
  Delete patches.suse/KVM-x86-pmu-Prioritize-VMX-interception-over-GP-on-R.patch
- commit 33f31da</changelog>
</package>
<package pkgid="4ea8c30e84951784582619f9a24d8b43a5da6b6f8d6c5e75a01fc38f5863f09f" name="dlm-kmp-azure" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.8.11.1"/>
  <changelog author="lhenriques@suse.de" date="1725019200">- virtiofs: forbid newlines in tags (bsc#1229940).
- commit 61514ce</changelog>
  <changelog author="lhenriques@suse.de" date="1725019201">- blacklist.conf: add 053fc4f755ad fuse: fix UAF in rcu pathwalks
  This commit breaks kABI and the data structure has no free room for the
  extra field, i.e. memcpy would fail to copy the additional member added by
  this patch.
- commit 941b81c</changelog>
  <changelog author="vkarasulli@suse.de" date="1725019202">- iommufd/device: Fix hwpt at err_unresv in
  iommufd_device_do_replace() (git-fixes).
- commit bbc9a65</changelog>
  <changelog author="vkarasulli@suse.de" date="1725019203">- iommu/vt-d: Fix identity map bounds in si_domain_init()
  (git-fixes).
- commit b4d27e5</changelog>
  <changelog author="lduncan@suse.com" date="1725019204">- scsi: lpfc: Fix a possible null pointer dereference (bsc#1229315
  CVE-2024-43821).
- commit eb73e94</changelog>
  <changelog author="vkarasulli@suse.de" date="1725019205">- iommu/amd: Convert comma to semicolon (git-fixes).
- commit 2714d8b</changelog>
  <changelog author="mkoutny@suse.com" date="1725019206">- Update
  patches.suse/0001-net-rds-fix-possible-cp-null-dereference.patch
  (git-fixes CVE-2024-35902 bsc#1224496).
- Update
  patches.suse/ASoC-TAS2781-Fix-tasdev_load_calibrated_data.patch
  (git-fixes CVE-2024-42278 bsc#1229403).
- Update
  patches.suse/ASoC-amd-Adjust-error-handling-in-case-of-absent-cod.patch
  (git-fixes CVE-2024-43818 bsc#1229296).
- Update
  patches.suse/ASoC-fsl-fsl_qmc_audio-Check-devm_kasprintf-returned.patch
  (git-fixes CVE-2024-42298 bsc#1229369).
- Update
  patches.suse/Bluetooth-MGMT-Add-error-handling-to-pair_device.patch
  (git-fixes CVE-2024-43884 bsc#1229739).
- Update
  patches.suse/KVM-Always-flush-async-PF-workqueue-when-vCPU-is-bei.patch
  (git-fixes CVE-2024-26976 bsc#1223635).
- Update
  patches.suse/PCI-DPC-Fix-use-after-free-on-concurrent-DPC-and-hot.patch
  (git-fixes CVE-2024-42302 bsc#1229366).
- Update
  patches.suse/PCI-endpoint-Clean-up-error-handling-in-vpci_scan_bu.patch
  (git-fixes CVE-2024-43875 bsc#1229486).
- Update
  patches.suse/PCI-endpoint-pci-epf-test-Make-use-of-cached-epc_fea.patch
  (git-fixes CVE-2024-43824 bsc#1229320).
- Update
  patches.suse/PCI-keystone-Fix-NULL-pointer-dereference-in-case-of.patch
  (git-fixes CVE-2024-43823 bsc#1229303).
- Update
  patches.suse/PCI-rcar-Demote-WARN-to-dev_warn_ratelimited-in-rcar.patch
  (git-fixes CVE-2024-43876 bsc#1229485).
- Update
  patches.suse/RDMA-hns-Fix-soft-lockup-under-heavy-CEQE-load.patch
  (git-fixes CVE-2024-43872 bsc#1229489).
- Update
  patches.suse/RDMA-iwcm-Fix-a-use-after-free-related-to-destroying.patch
  (git-fixes CVE-2024-42285 bsc#1229381).
- Update
  patches.suse/Revert-ALSA-firewire-lib-operate-for-period-elapse-e.patch
  (bsc#1208783 CVE-2024-42274 bsc#1229417).
- Update
  patches.suse/SUNRPC-add-a-missing-rpc_stat-for-TCP-TLS.patch
  (git-fixes CVE-2024-36907 bsc#1225751).
- Update
  patches.suse/bpf-arm64-Fix-trampoline-for-BPF_TRAMP_F_CALL_ORIG.patch
  (git-fixes CVE-2024-43840 bsc#1229344).
- Update
  patches.suse/btrfs-fix-double-inode-unlock-for-direct-IO-sync-wri.patch
  (git-fixes CVE-2024-43885 bsc#1229747).
- Update
  patches.suse/btrfs-fix-extent-map-use-after-free-when-adding-page.patch
  (git-fixes CVE-2024-42314 bsc#1229355).
- Update
  patches.suse/cgroup-cpuset-Prevent-UAF-in-proc_cpuset_show.patch
  (bsc#1228801 CVE-2024-43853 bsc#1229292).
- Update
  patches.suse/crypto-ccp-Fix-null-pointer-dereference-in-__sev_snp.patch
  (git-fixes CVE-2024-43874 bsc#1229487).
- Update
  patches.suse/devres-Fix-memory-leakage-caused-by-driver-API-devm_.patch
  (git-fixes CVE-2024-43871 bsc#1229490).
- Update
  patches.suse/dma-fix-call-order-in-dmam_free_coherent.patch
  (git-fixes CVE-2024-43856 bsc#1229346).
- Update
  patches.suse/drm-admgpu-fix-dereferencing-null-pointer-context.patch
  (stable-fixes CVE-2024-43906 bsc#1229785).
- Update
  patches.suse/drm-amd-display-Add-NULL-check-for-afb-before-derefe.patch
  (stable-fixes CVE-2024-43903 bsc#1229781).
- Update
  patches.suse/drm-amd-display-Add-null-checker-before-passing-vari.patch
  (stable-fixes CVE-2024-43902 bsc#1229767).
- Update
  patches.suse/drm-amd-display-Skip-Recompute-DSC-Params-if-no-Stre.patch
  (stable-fixes CVE-2024-43895 bsc#1229755).
- Update
  patches.suse/drm-amd-pm-Fix-the-null-pointer-dereference-for-vega.patch
  (stable-fixes CVE-2024-43905 bsc#1229784).
- Update
  patches.suse/drm-amdgpu-Fix-the-null-pointer-dereference-to-ras_m.patch
  (stable-fixes CVE-2024-43908 bsc#1229788).
- Update
  patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-for-s.patch
  (stable-fixes CVE-2024-43909 bsc#1229789).
- Update
  patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-in-ap.patch
  (stable-fixes CVE-2024-43907 bsc#1229787).
- Update
  patches.suse/drm-client-fix-null-pointer-dereference-in-drm_clien.patch
  (git-fixes CVE-2024-43894 bsc#1229746).
- Update
  patches.suse/drm-gma500-fix-null-pointer-dereference-in-cdv_intel.patch
  (git-fixes CVE-2024-42310 bsc#1229358).
- Update
  patches.suse/drm-gma500-fix-null-pointer-dereference-in-psb_intel.patch
  (git-fixes CVE-2024-42309 bsc#1229359).
- Update
  patches.suse/drm-nouveau-prime-fix-refcount-underflow.patch
  (git-fixes CVE-2024-43867 bsc#1229493).
- Update patches.suse/drm-qxl-Add-check-for-drm_cvt_mode.patch
  (git-fixes CVE-2024-43829 bsc#1229341).
- Update
  patches.suse/drm-vmwgfx-Fix-a-deadlock-in-dma-buf-fence-polling.patch
  (git-fixes CVE-2024-43863 bsc#1229497).
- Update
  patches.suse/exfat-fix-potential-deadlock-on-__exfat_get_dentry_set.patch
  (git-fixes CVE-2024-42315 bsc#1229354).
- Update
  patches.suse/gpio-prevent-potential-speculation-leaks-in-gpio_dev.patch
  (stable-fixes CVE-2024-44931 bsc#1229837).
- Update
  patches.suse/hfs-fix-to-initialize-fields-of-hfs_inode_info-after-hfs_alloc_inode.patch
  (git-fixes CVE-2024-42311 bsc#1229413).
- Update
  patches.suse/iio-Fix-the-sorting-functionality-in-iio_gts_build_a.patch
  (git-fixes CVE-2024-43825 bsc#1229298).
- Update
  patches.suse/jfs-Fix-array-index-out-of-bounds-in-diFree.patch
  (git-fixes CVE-2024-43858 bsc#1229414).
- Update
  patches.suse/jfs-Fix-shift-out-of-bounds-in-dbDiscardAG.patch
  (git-fixes CVE-2024-44938 bsc#1229792).
- Update
  patches.suse/jfs-fix-null-ptr-deref-in-dtInsertEntry.patch
  (git-fixes CVE-2024-44939 bsc#1229820).
- Update
  patches.suse/kobject_uevent-Fix-OOB-access-within-zap_modalias_en.patch
  (git-fixes CVE-2024-42292 bsc#1229373).
- Update
  patches.suse/kvm-s390-Reject-memory-region-operations-for-ucontrol-VMs.patch
  (git-fixes bsc#1229168 CVE-2024-43819 bsc#1229290).
- Update
  patches.suse/leds-trigger-Unregister-sysfs-attributes-before-call.patch
  (git-fixes CVE-2024-43830 bsc#1229305).
- Update
  patches.suse/lib-objagg-Fix-general-protection-fault.patch
  (git-fixes CVE-2024-43846 bsc#1229360).
- Update
  patches.suse/libbpf-Use-OPTS_SET-macro-in-bpf_xdp_query.patch
  (git-fixes CVE-2024-27050 bsc#1223767).
- Update
  patches.suse/mISDN-Fix-a-use-after-free-in-hfcmulti_tx.patch
  (git-fixes CVE-2024-42280 bsc#1229388).
- Update
  patches.suse/mailbox-mtk-cmdq-Move-devm_mbox_controller_register-.patch
  (git-fixes CVE-2024-42319 bsc#1229350).
- Update
  patches.suse/md-raid5-fix-deadlock-that-raid5d-wait-for-itself-to-clear-MD_SB_CHANGE_PENDING-151f.patch
  (git-fixes CVE-2024-39476 bsc#1227437).
- Update
  patches.suse/media-imx-pxp-Fix-ERR_PTR-dereference-in-pxp_probe.patch
  (git-fixes CVE-2024-42303 bsc#1229365).
- Update
  patches.suse/media-pci-ivtv-Add-check-for-DMA-map-result.patch
  (git-fixes CVE-2024-43877 bsc#1229484).
- Update
  patches.suse/media-v4l-async-Fix-NULL-pointer-dereference-in-addi.patch
  (git-fixes CVE-2024-43833 bsc#1229299).
- Update
  patches.suse/media-venus-fix-use-after-free-in-vdec_close.patch
  (git-fixes CVE-2024-42313 bsc#1229356).
- Update
  patches.suse/media-xc2028-avoid-use-after-free-in-load_firmware_c.patch
  (stable-fixes CVE-2024-43900 bsc#1229756).
- Update
  patches.suse/memcg-protect-concurrent-access-to-mem_cgroup_idr.patch
  (git-fixes CVE-2024-43892 bsc#1229761).
- Update
  patches.suse/net-drop-bad-gso-csum_start-and-offset-in-virtio_net.patch
  (git-fixes CVE-2024-43897 bsc#1229752).
- Update
  patches.suse/net-iucv-fix-use-after-free-in-iucv_sock_close.patch
  (bsc#1228973 CVE-2024-42271 bsc#1229400).
- Update patches.suse/net-missing-check-virtio.patch (git-fixes
  CVE-2024-43817 bsc#1229312).
- Update
  patches.suse/net-usb-qmi_wwan-fix-memory-leak-for-not-ip-packets.patch
  (git-fixes CVE-2024-43861 bsc#1229500).
- Update
  patches.suse/nfs-pass-explicit-offset-count-to-trace-events.patch
  (git-fixes CVE-2024-43826 bsc#1229294).
- Update
  patches.suse/nvme-pci-add-missing-condition-check-for-existence-o.patch
  (git-fixes CVE-2024-42276 bsc#1229410).
- Update
  patches.suse/padata-Fix-possible-divide-by-0-panic-in-padata_mt_h.patch
  (git-fixes CVE-2024-43889 bsc#1229743).
- Update
  patches.suse/remoteproc-imx_rproc-Skip-over-memory-region-when-no.patch
  (git-fixes CVE-2024-43860 bsc#1229319).
- Update
  patches.suse/s390-dasd-fix-error-checks-in-dasd_copy_pair_store.patch
  (git-fixes bsc#1229173 CVE-2024-42320 bsc#1229349).
- Update
  patches.suse/scsi-lpfc-Revise-lpfc_prep_embed_io-routine-with-pro.patch
  (bsc#1228857 CVE-2024-43816 bsc#1229318).
- Update
  patches.suse/scsi-qla2xxx-Complete-command-early-within-lock.patch
  (bsc#1228850 CVE-2024-42287 bsc#1229392).
- Update
  patches.suse/scsi-qla2xxx-During-vport-delete-send-async-logout-e.patch
  (bsc#1228850 CVE-2024-42289 bsc#1229399).
- Update
  patches.suse/scsi-qla2xxx-Fix-for-possible-memory-corruption.patch
  (bsc#1228850 CVE-2024-42288 bsc#1229398).
- Update
  patches.suse/scsi-qla2xxx-validate-nvme_local_port-correctly.patch
  (bsc#1228850 CVE-2024-42286 bsc#1229395).
- Update
  patches.suse/serial-core-check-uartclk-for-zero-to-avoid-divide-b.patch
  (stable-fixes CVE-2024-43893 bsc#1229759).
- Update
  patches.suse/soc-qcom-pdr-protect-locator_addr-with-the-main-mute.patch
  (git-fixes CVE-2024-43849 bsc#1229307).
- Update
  patches.suse/soc-xilinx-rename-cpu_number1-to-dummy_cpu_number.patch
  (git-fixes CVE-2024-43851 bsc#1229313).
- Update
  patches.suse/spi-microchip-core-ensure-TX-and-RX-FIFOs-are-empty-.patch
  (git-fixes CVE-2024-42279 bsc#1229390).
- Update
  patches.suse/usb-vhci-hcd-Do-not-drop-references-before-new-refer.patch
  (stable-fixes CVE-2024-43883 bsc#1229707).
- Update
  patches.suse/vhost-vsock-always-initialize-seqpacket_allow.patch
  (git-fixes CVE-2024-43873 bsc#1229488).
- Update
  patches.suse/wifi-ath12k-change-DMA-direction-while-mapping-reinj.patch
  (git-fixes CVE-2024-43881 bsc#1229480).
- Update
  patches.suse/wifi-ath12k-fix-invalid-memory-access-while-processi.patch
  (git-fixes CVE-2024-43847 bsc#1229291).
- Update
  patches.suse/wifi-cfg80211-handle-2x996-RU-allocation-in-cfg80211.patch
  (git-fixes CVE-2024-43879 bsc#1229482).
- Update
  patches.suse/wifi-nl80211-disallow-setting-special-AP-channel-wid.patch
  (stable-fixes CVE-2024-43912 bsc#1229830).
- Update
  patches.suse/wifi-rtw89-Fix-array-index-mistake-in-rtw89_sta_info.patch
  (git-fixes CVE-2024-43842 bsc#1229317).
- Update
  patches.suse/wifi-virt_wifi-avoid-reporting-connection-success-wi.patch
  (git-fixes CVE-2024-43841 bsc#1229304).
- commit 140ec33</changelog>
  <changelog author="tiwai@suse.de" date="1725105600">- dmaengine: dw: Add memory bus width verification (git-fixes).
- dmaengine: dw: Add peripheral bus width verification
  (git-fixes).
- soundwire: stream: fix programming slave ports for non-continous
  port maps (git-fixes).
- commit b7e9784</changelog>
  <changelog author="tiwai@suse.de" date="1725192000">- usb: cdnsp: fix for Link TRB with TC (git-fixes).
- usb: dwc3: st: add missing depopulate in probe error path
  (git-fixes).
- usb: dwc3: st: fix probed platform device ref count on probe
  error path (git-fixes).
- usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in
  remove_power_attributes() (git-fixes).
- usb: typec: fsa4480: Relax CHIP_ID check (git-fixes).
- usb: dwc3: omap: add missing depopulate in probe error path
  (git-fixes).
- usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function
  (git-fixes).
- soc: qcom: pmic_glink: Actually communicate when remote goes
  down (git-fixes).
- soc: qcom: cmd-db: Map shared memory as WC, not WB (git-fixes).
- commit 7121142</changelog>
  <changelog author="ailiop@suse.com" date="1725192001">- xfs: Fix the owner setting issue for rmap query in xfs fsmap
  (git-fixes).
- commit 49b5eec</changelog>
  <changelog author="ailiop@suse.com" date="1725192002">- xfs: use XFS_BUF_DADDR_NULL for daddrs in getfsmap code
  (git-fixes).
- commit 288ad9b</changelog>
  <changelog author="ailiop@suse.com" date="1725192003">- xfs: Fix missing interval for missing_owner in xfs fsmap
  (git-fixes).
- commit 5448ab5</changelog>
  <changelog author="ohering@suse.de" date="1725278400">- net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response (git-fixes).
- commit 4dc1da1</changelog>
  <changelog author="osalvador@suse.de" date="1725278401">- mm/sparsemem: fix race in accessing memory_section-&gt;usage
  (bsc#1221326 CVE-2023-52489).
- commit 6aa8957</changelog>
  <changelog author="osalvador@suse.de" date="1725278402">- mm, kmsan: fix infinite recursion due to RCU critical section
  (git-fixes).
- commit 16ad73a</changelog>
  <changelog author="osalvador@suse.de" date="1725278403">- mm: prevent derefencing NULL ptr in pfn_section_valid()
  (git-fixes).
- commit 35f619d</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1725278404">- bluetooth/l2cap: sync sock recv cb and release (bsc#1228576
  CVE-2024-41062).
- commit 6553526</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1725278405">- Bluetooth: L2CAP: Fix deadlock (git-fixes).
- commit 13aba13</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1725278406">- Bluetooth: Fix usage of __hci_cmd_sync_status (git-fixes).
- commit 1bec58d</changelog>
  <changelog author="lhenriques@suse.de" date="1725278407">- ceph: periodically flush the cap releases (bsc#1230056).
- commit e22b6e0</changelog>
</package>
<package pkgid="a190d7cbe84844857f1b49a0dcdfbc21988f9ac789bd615bff940aae0b22c12e" name="dlm-kmp-azure" arch="x86_64">
  <version epoch="0" ver="6.4.0" rel="150600.8.11.1"/>
  <changelog author="lhenriques@suse.de" date="1725019200">- virtiofs: forbid newlines in tags (bsc#1229940).
- commit 61514ce</changelog>
  <changelog author="lhenriques@suse.de" date="1725019201">- blacklist.conf: add 053fc4f755ad fuse: fix UAF in rcu pathwalks
  This commit breaks kABI and the data structure has no free room for the
  extra field, i.e. memcpy would fail to copy the additional member added by
  this patch.
- commit 941b81c</changelog>
  <changelog author="vkarasulli@suse.de" date="1725019202">- iommufd/device: Fix hwpt at err_unresv in
  iommufd_device_do_replace() (git-fixes).
- commit bbc9a65</changelog>
  <changelog author="vkarasulli@suse.de" date="1725019203">- iommu/vt-d: Fix identity map bounds in si_domain_init()
  (git-fixes).
- commit b4d27e5</changelog>
  <changelog author="lduncan@suse.com" date="1725019204">- scsi: lpfc: Fix a possible null pointer dereference (bsc#1229315
  CVE-2024-43821).
- commit eb73e94</changelog>
  <changelog author="vkarasulli@suse.de" date="1725019205">- iommu/amd: Convert comma to semicolon (git-fixes).
- commit 2714d8b</changelog>
  <changelog author="mkoutny@suse.com" date="1725019206">- Update
  patches.suse/0001-net-rds-fix-possible-cp-null-dereference.patch
  (git-fixes CVE-2024-35902 bsc#1224496).
- Update
  patches.suse/ASoC-TAS2781-Fix-tasdev_load_calibrated_data.patch
  (git-fixes CVE-2024-42278 bsc#1229403).
- Update
  patches.suse/ASoC-amd-Adjust-error-handling-in-case-of-absent-cod.patch
  (git-fixes CVE-2024-43818 bsc#1229296).
- Update
  patches.suse/ASoC-fsl-fsl_qmc_audio-Check-devm_kasprintf-returned.patch
  (git-fixes CVE-2024-42298 bsc#1229369).
- Update
  patches.suse/Bluetooth-MGMT-Add-error-handling-to-pair_device.patch
  (git-fixes CVE-2024-43884 bsc#1229739).
- Update
  patches.suse/KVM-Always-flush-async-PF-workqueue-when-vCPU-is-bei.patch
  (git-fixes CVE-2024-26976 bsc#1223635).
- Update
  patches.suse/PCI-DPC-Fix-use-after-free-on-concurrent-DPC-and-hot.patch
  (git-fixes CVE-2024-42302 bsc#1229366).
- Update
  patches.suse/PCI-endpoint-Clean-up-error-handling-in-vpci_scan_bu.patch
  (git-fixes CVE-2024-43875 bsc#1229486).
- Update
  patches.suse/PCI-endpoint-pci-epf-test-Make-use-of-cached-epc_fea.patch
  (git-fixes CVE-2024-43824 bsc#1229320).
- Update
  patches.suse/PCI-keystone-Fix-NULL-pointer-dereference-in-case-of.patch
  (git-fixes CVE-2024-43823 bsc#1229303).
- Update
  patches.suse/PCI-rcar-Demote-WARN-to-dev_warn_ratelimited-in-rcar.patch
  (git-fixes CVE-2024-43876 bsc#1229485).
- Update
  patches.suse/RDMA-hns-Fix-soft-lockup-under-heavy-CEQE-load.patch
  (git-fixes CVE-2024-43872 bsc#1229489).
- Update
  patches.suse/RDMA-iwcm-Fix-a-use-after-free-related-to-destroying.patch
  (git-fixes CVE-2024-42285 bsc#1229381).
- Update
  patches.suse/Revert-ALSA-firewire-lib-operate-for-period-elapse-e.patch
  (bsc#1208783 CVE-2024-42274 bsc#1229417).
- Update
  patches.suse/SUNRPC-add-a-missing-rpc_stat-for-TCP-TLS.patch
  (git-fixes CVE-2024-36907 bsc#1225751).
- Update
  patches.suse/bpf-arm64-Fix-trampoline-for-BPF_TRAMP_F_CALL_ORIG.patch
  (git-fixes CVE-2024-43840 bsc#1229344).
- Update
  patches.suse/btrfs-fix-double-inode-unlock-for-direct-IO-sync-wri.patch
  (git-fixes CVE-2024-43885 bsc#1229747).
- Update
  patches.suse/btrfs-fix-extent-map-use-after-free-when-adding-page.patch
  (git-fixes CVE-2024-42314 bsc#1229355).
- Update
  patches.suse/cgroup-cpuset-Prevent-UAF-in-proc_cpuset_show.patch
  (bsc#1228801 CVE-2024-43853 bsc#1229292).
- Update
  patches.suse/crypto-ccp-Fix-null-pointer-dereference-in-__sev_snp.patch
  (git-fixes CVE-2024-43874 bsc#1229487).
- Update
  patches.suse/devres-Fix-memory-leakage-caused-by-driver-API-devm_.patch
  (git-fixes CVE-2024-43871 bsc#1229490).
- Update
  patches.suse/dma-fix-call-order-in-dmam_free_coherent.patch
  (git-fixes CVE-2024-43856 bsc#1229346).
- Update
  patches.suse/drm-admgpu-fix-dereferencing-null-pointer-context.patch
  (stable-fixes CVE-2024-43906 bsc#1229785).
- Update
  patches.suse/drm-amd-display-Add-NULL-check-for-afb-before-derefe.patch
  (stable-fixes CVE-2024-43903 bsc#1229781).
- Update
  patches.suse/drm-amd-display-Add-null-checker-before-passing-vari.patch
  (stable-fixes CVE-2024-43902 bsc#1229767).
- Update
  patches.suse/drm-amd-display-Skip-Recompute-DSC-Params-if-no-Stre.patch
  (stable-fixes CVE-2024-43895 bsc#1229755).
- Update
  patches.suse/drm-amd-pm-Fix-the-null-pointer-dereference-for-vega.patch
  (stable-fixes CVE-2024-43905 bsc#1229784).
- Update
  patches.suse/drm-amdgpu-Fix-the-null-pointer-dereference-to-ras_m.patch
  (stable-fixes CVE-2024-43908 bsc#1229788).
- Update
  patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-for-s.patch
  (stable-fixes CVE-2024-43909 bsc#1229789).
- Update
  patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-in-ap.patch
  (stable-fixes CVE-2024-43907 bsc#1229787).
- Update
  patches.suse/drm-client-fix-null-pointer-dereference-in-drm_clien.patch
  (git-fixes CVE-2024-43894 bsc#1229746).
- Update
  patches.suse/drm-gma500-fix-null-pointer-dereference-in-cdv_intel.patch
  (git-fixes CVE-2024-42310 bsc#1229358).
- Update
  patches.suse/drm-gma500-fix-null-pointer-dereference-in-psb_intel.patch
  (git-fixes CVE-2024-42309 bsc#1229359).
- Update
  patches.suse/drm-nouveau-prime-fix-refcount-underflow.patch
  (git-fixes CVE-2024-43867 bsc#1229493).
- Update patches.suse/drm-qxl-Add-check-for-drm_cvt_mode.patch
  (git-fixes CVE-2024-43829 bsc#1229341).
- Update
  patches.suse/drm-vmwgfx-Fix-a-deadlock-in-dma-buf-fence-polling.patch
  (git-fixes CVE-2024-43863 bsc#1229497).
- Update
  patches.suse/exfat-fix-potential-deadlock-on-__exfat_get_dentry_set.patch
  (git-fixes CVE-2024-42315 bsc#1229354).
- Update
  patches.suse/gpio-prevent-potential-speculation-leaks-in-gpio_dev.patch
  (stable-fixes CVE-2024-44931 bsc#1229837).
- Update
  patches.suse/hfs-fix-to-initialize-fields-of-hfs_inode_info-after-hfs_alloc_inode.patch
  (git-fixes CVE-2024-42311 bsc#1229413).
- Update
  patches.suse/iio-Fix-the-sorting-functionality-in-iio_gts_build_a.patch
  (git-fixes CVE-2024-43825 bsc#1229298).
- Update
  patches.suse/jfs-Fix-array-index-out-of-bounds-in-diFree.patch
  (git-fixes CVE-2024-43858 bsc#1229414).
- Update
  patches.suse/jfs-Fix-shift-out-of-bounds-in-dbDiscardAG.patch
  (git-fixes CVE-2024-44938 bsc#1229792).
- Update
  patches.suse/jfs-fix-null-ptr-deref-in-dtInsertEntry.patch
  (git-fixes CVE-2024-44939 bsc#1229820).
- Update
  patches.suse/kobject_uevent-Fix-OOB-access-within-zap_modalias_en.patch
  (git-fixes CVE-2024-42292 bsc#1229373).
- Update
  patches.suse/kvm-s390-Reject-memory-region-operations-for-ucontrol-VMs.patch
  (git-fixes bsc#1229168 CVE-2024-43819 bsc#1229290).
- Update
  patches.suse/leds-trigger-Unregister-sysfs-attributes-before-call.patch
  (git-fixes CVE-2024-43830 bsc#1229305).
- Update
  patches.suse/lib-objagg-Fix-general-protection-fault.patch
  (git-fixes CVE-2024-43846 bsc#1229360).
- Update
  patches.suse/libbpf-Use-OPTS_SET-macro-in-bpf_xdp_query.patch
  (git-fixes CVE-2024-27050 bsc#1223767).
- Update
  patches.suse/mISDN-Fix-a-use-after-free-in-hfcmulti_tx.patch
  (git-fixes CVE-2024-42280 bsc#1229388).
- Update
  patches.suse/mailbox-mtk-cmdq-Move-devm_mbox_controller_register-.patch
  (git-fixes CVE-2024-42319 bsc#1229350).
- Update
  patches.suse/md-raid5-fix-deadlock-that-raid5d-wait-for-itself-to-clear-MD_SB_CHANGE_PENDING-151f.patch
  (git-fixes CVE-2024-39476 bsc#1227437).
- Update
  patches.suse/media-imx-pxp-Fix-ERR_PTR-dereference-in-pxp_probe.patch
  (git-fixes CVE-2024-42303 bsc#1229365).
- Update
  patches.suse/media-pci-ivtv-Add-check-for-DMA-map-result.patch
  (git-fixes CVE-2024-43877 bsc#1229484).
- Update
  patches.suse/media-v4l-async-Fix-NULL-pointer-dereference-in-addi.patch
  (git-fixes CVE-2024-43833 bsc#1229299).
- Update
  patches.suse/media-venus-fix-use-after-free-in-vdec_close.patch
  (git-fixes CVE-2024-42313 bsc#1229356).
- Update
  patches.suse/media-xc2028-avoid-use-after-free-in-load_firmware_c.patch
  (stable-fixes CVE-2024-43900 bsc#1229756).
- Update
  patches.suse/memcg-protect-concurrent-access-to-mem_cgroup_idr.patch
  (git-fixes CVE-2024-43892 bsc#1229761).
- Update
  patches.suse/net-drop-bad-gso-csum_start-and-offset-in-virtio_net.patch
  (git-fixes CVE-2024-43897 bsc#1229752).
- Update
  patches.suse/net-iucv-fix-use-after-free-in-iucv_sock_close.patch
  (bsc#1228973 CVE-2024-42271 bsc#1229400).
- Update patches.suse/net-missing-check-virtio.patch (git-fixes
  CVE-2024-43817 bsc#1229312).
- Update
  patches.suse/net-usb-qmi_wwan-fix-memory-leak-for-not-ip-packets.patch
  (git-fixes CVE-2024-43861 bsc#1229500).
- Update
  patches.suse/nfs-pass-explicit-offset-count-to-trace-events.patch
  (git-fixes CVE-2024-43826 bsc#1229294).
- Update
  patches.suse/nvme-pci-add-missing-condition-check-for-existence-o.patch
  (git-fixes CVE-2024-42276 bsc#1229410).
- Update
  patches.suse/padata-Fix-possible-divide-by-0-panic-in-padata_mt_h.patch
  (git-fixes CVE-2024-43889 bsc#1229743).
- Update
  patches.suse/remoteproc-imx_rproc-Skip-over-memory-region-when-no.patch
  (git-fixes CVE-2024-43860 bsc#1229319).
- Update
  patches.suse/s390-dasd-fix-error-checks-in-dasd_copy_pair_store.patch
  (git-fixes bsc#1229173 CVE-2024-42320 bsc#1229349).
- Update
  patches.suse/scsi-lpfc-Revise-lpfc_prep_embed_io-routine-with-pro.patch
  (bsc#1228857 CVE-2024-43816 bsc#1229318).
- Update
  patches.suse/scsi-qla2xxx-Complete-command-early-within-lock.patch
  (bsc#1228850 CVE-2024-42287 bsc#1229392).
- Update
  patches.suse/scsi-qla2xxx-During-vport-delete-send-async-logout-e.patch
  (bsc#1228850 CVE-2024-42289 bsc#1229399).
- Update
  patches.suse/scsi-qla2xxx-Fix-for-possible-memory-corruption.patch
  (bsc#1228850 CVE-2024-42288 bsc#1229398).
- Update
  patches.suse/scsi-qla2xxx-validate-nvme_local_port-correctly.patch
  (bsc#1228850 CVE-2024-42286 bsc#1229395).
- Update
  patches.suse/serial-core-check-uartclk-for-zero-to-avoid-divide-b.patch
  (stable-fixes CVE-2024-43893 bsc#1229759).
- Update
  patches.suse/soc-qcom-pdr-protect-locator_addr-with-the-main-mute.patch
  (git-fixes CVE-2024-43849 bsc#1229307).
- Update
  patches.suse/soc-xilinx-rename-cpu_number1-to-dummy_cpu_number.patch
  (git-fixes CVE-2024-43851 bsc#1229313).
- Update
  patches.suse/spi-microchip-core-ensure-TX-and-RX-FIFOs-are-empty-.patch
  (git-fixes CVE-2024-42279 bsc#1229390).
- Update
  patches.suse/usb-vhci-hcd-Do-not-drop-references-before-new-refer.patch
  (stable-fixes CVE-2024-43883 bsc#1229707).
- Update
  patches.suse/vhost-vsock-always-initialize-seqpacket_allow.patch
  (git-fixes CVE-2024-43873 bsc#1229488).
- Update
  patches.suse/wifi-ath12k-change-DMA-direction-while-mapping-reinj.patch
  (git-fixes CVE-2024-43881 bsc#1229480).
- Update
  patches.suse/wifi-ath12k-fix-invalid-memory-access-while-processi.patch
  (git-fixes CVE-2024-43847 bsc#1229291).
- Update
  patches.suse/wifi-cfg80211-handle-2x996-RU-allocation-in-cfg80211.patch
  (git-fixes CVE-2024-43879 bsc#1229482).
- Update
  patches.suse/wifi-nl80211-disallow-setting-special-AP-channel-wid.patch
  (stable-fixes CVE-2024-43912 bsc#1229830).
- Update
  patches.suse/wifi-rtw89-Fix-array-index-mistake-in-rtw89_sta_info.patch
  (git-fixes CVE-2024-43842 bsc#1229317).
- Update
  patches.suse/wifi-virt_wifi-avoid-reporting-connection-success-wi.patch
  (git-fixes CVE-2024-43841 bsc#1229304).
- commit 140ec33</changelog>
  <changelog author="tiwai@suse.de" date="1725105600">- dmaengine: dw: Add memory bus width verification (git-fixes).
- dmaengine: dw: Add peripheral bus width verification
  (git-fixes).
- soundwire: stream: fix programming slave ports for non-continous
  port maps (git-fixes).
- commit b7e9784</changelog>
  <changelog author="tiwai@suse.de" date="1725192000">- usb: cdnsp: fix for Link TRB with TC (git-fixes).
- usb: dwc3: st: add missing depopulate in probe error path
  (git-fixes).
- usb: dwc3: st: fix probed platform device ref count on probe
  error path (git-fixes).
- usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in
  remove_power_attributes() (git-fixes).
- usb: typec: fsa4480: Relax CHIP_ID check (git-fixes).
- usb: dwc3: omap: add missing depopulate in probe error path
  (git-fixes).
- usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function
  (git-fixes).
- soc: qcom: pmic_glink: Actually communicate when remote goes
  down (git-fixes).
- soc: qcom: cmd-db: Map shared memory as WC, not WB (git-fixes).
- commit 7121142</changelog>
  <changelog author="ailiop@suse.com" date="1725192001">- xfs: Fix the owner setting issue for rmap query in xfs fsmap
  (git-fixes).
- commit 49b5eec</changelog>
  <changelog author="ailiop@suse.com" date="1725192002">- xfs: use XFS_BUF_DADDR_NULL for daddrs in getfsmap code
  (git-fixes).
- commit 288ad9b</changelog>
  <changelog author="ailiop@suse.com" date="1725192003">- xfs: Fix missing interval for missing_owner in xfs fsmap
  (git-fixes).
- commit 5448ab5</changelog>
  <changelog author="ohering@suse.de" date="1725278400">- net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response (git-fixes).
- commit 4dc1da1</changelog>
  <changelog author="osalvador@suse.de" date="1725278401">- mm/sparsemem: fix race in accessing memory_section-&gt;usage
  (bsc#1221326 CVE-2023-52489).
- commit 6aa8957</changelog>
  <changelog author="osalvador@suse.de" date="1725278402">- mm, kmsan: fix infinite recursion due to RCU critical section
  (git-fixes).
- commit 16ad73a</changelog>
  <changelog author="osalvador@suse.de" date="1725278403">- mm: prevent derefencing NULL ptr in pfn_section_valid()
  (git-fixes).
- commit 35f619d</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1725278404">- bluetooth/l2cap: sync sock recv cb and release (bsc#1228576
  CVE-2024-41062).
- commit 6553526</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1725278405">- Bluetooth: L2CAP: Fix deadlock (git-fixes).
- commit 13aba13</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1725278406">- Bluetooth: Fix usage of __hci_cmd_sync_status (git-fixes).
- commit 1bec58d</changelog>
  <changelog author="lhenriques@suse.de" date="1725278407">- ceph: periodically flush the cap releases (bsc#1230056).
- commit e22b6e0</changelog>
</package>
<package pkgid="d6944a4b9ddc78510819bb163fc91dbcbec1076a412d183aec5b475cf5908294" name="dlm-kmp-azure" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.8.5.4"/>
  <changelog author="mkubecek@suse.cz" date="1717416000">- series.conf: cleanup
  Fix subsection header to silence series_insert error.
- commit 4628dc3</changelog>
  <changelog author="mkubecek@suse.cz" date="1717416001">- netfilter: nf_tables: release mutex after nft_gc_seq_end from
  abort path (CVE-2024-26925 bsc#1223390).
- commit 578a709</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717416002">- Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
  The L3 bsc#1225765 was created seperately since our customer requires
  PTF.
- Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
- Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
- Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
- Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
- commit 054635e</changelog>
  <changelog author="msuchanek@suse.de" date="1717416003">- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
- powerpc/uaccess: Fix build errors seen with GCC 13/14
  (bsc#1194869).
- commit 46b5d84</changelog>
  <changelog author="msuchanek@suse.de" date="1717416004">- blacklist.conf: PPC fsl_msi is not used
- commit ae6590d</changelog>
  <changelog author="msuchanek@suse.de" date="1717416005">- powerpc/pseries/lparcfg: drop error message from guest name
  lookup (bsc#1187716 ltc#193451 git-fixes).
- commit ceab637</changelog>
  <changelog author="mfranc@suse.cz" date="1717416006">- Update
  patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
  (git-fixes CVE-2024-36955).
- Update
  patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
  (git-fixes bsc#1225715 CVE-2024-36906).
- Update
  patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
  (git-fixes bsc#1225579 CVE-2024-36011).
- Update
  patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
  (git-fixes bsc#1225578 CVE-2024-36013).
- Update
  patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
  (git-fixes bsc#1225502 CVE-2024-36012).
- Update
  patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
  (git-fixes bsc#1225722 CVE-2024-36880).
- Update
  patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
  (git-fixes CVE-2024-36942).
- Update
  patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
  (git-fixes bsc#1225720 CVE-2024-36032).
- Update
  patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
  (git-fixes bsc#1223749 CVE-2024-26990).
- Update
  patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
  (git-fixes bsc#1223692 CVE-2024-26992).
- Update
  patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
  (stable-fixes CVE-2024-36944).
- Update
  patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
  (git-fixes bsc#1225734 CVE-2024-36896).
- Update
  patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
  (stable-fixes CVE-2024-36949).
- Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
  (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
- Update
  patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
  (git-fixes bsc#1225692 CVE-2023-52882).
- Update
  patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
  (git-fixes CVE-2024-26761).
- Update
  patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
  (stable-fixes bsc#1225735 CVE-2024-36897).
- Update
  patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
  (stable-fixes bsc#1225705 CVE-2024-36026).
- Update
  patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
  (stable-fixes CVE-2024-36951).
- Update
  patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
  (git-fixes bsc#1225593 CVE-2024-36014).
- Update
  patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
  (stable-fixes bsc#1225728 CVE-2024-36885).
- Update
  patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
  (git-fixes bsc#1225773 CVE-2024-36936).
- Update
  patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
  (stable-fixes CVE-2024-36950).
- Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
  (git-fixes bsc#1225736 CVE-2024-36898).
- Update
  patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
  (git-fixes bsc#1225698 CVE-2024-36020).
- Update
  patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
  (git-fixes bsc#1225710 CVE-2024-36891).
- Update
  patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
  (git-fixes bsc#1225714 CVE-2024-36890).
- Update
  patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
  (git-fixes bsc#1225708 CVE-2024-36029).
- Update
  patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
  (git-fixes bsc#1225699 CVE-2024-36021).
- Update
  patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
  (git-fixes CVE-2024-26943).
- Update
  patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
  (git-fixes bsc#1225694 CVE-2024-36018).
- Update
  patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
  (git-fixes CVE-2024-36940).
- Update
  patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
  (git-fixes CVE-2024-36959).
- Update
  patches.suse/ppdev-Add-an-error-check-in-register_device.patch
  (git-fixes bsc#1225640 CVE-2024-36015).
- Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
  CVE-2024-36947).
- Update
  patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
  (git-fixes bsc#1225695 CVE-2024-36019).
- Update
  patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
  (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
- Update
  patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
  (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
- Update
  patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
  (git-fixes bsc#1225704 CVE-2024-36025).
- Update
  patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
  (git-fixes CVE-2024-36930).
- Update
  patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
  (bsc#1224331 bsc#1224602 CVE-2024-35814).
- Update
  patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
  (git-fixes bsc#1225642 CVE-2024-36016).
- Update
  patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
  (git-fixes bsc#1225749 CVE-2024-36894).
- Update
  patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
  (git-fixes bsc#1225750 CVE-2024-36895).
- Update
  patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
  (git-fixes bsc#1225748 CVE-2024-36893).
- Update
  patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
  (stable-fixes bsc#1225769 CVE-2024-36921).
- Update
  patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
  (stable-fixes CVE-2024-36922).
- Update
  patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
  (git-fixes CVE-2024-36941).
- Update
  patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
  (git-fixes bsc#1224742 CVE-2024-35803).
- commit 539780f</changelog>
  <changelog author="dwagner@suse.de" date="1717416007">- nvmet: fix ns enable/disable possible hang (git-fixes).
- nvme-multipath: fix io accounting on failover (git-fixes).
- nvme: fix multipath batched completion accounting (git-fixes).
- commit ed3b392</changelog>
  <changelog author="dwagner@suse.de" date="1717416008">- scsi: lpfc: Copyright updates for 14.4.0.2 patches
  (bsc#1225842).
- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
  (bsc#1225842).
  Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
  (bsc#1225842).
- scsi: lpfc: Clear deferred RSCN processing flag when driver
  is unloading (bsc#1225842).
- scsi: lpfc: Update logging of protection type for T10 DIF I/O
  (bsc#1225842).
- scsi: lpfc: Change default logging level for unsolicited CT
  MIB commands (bsc#1225842).
- commit 5a56384</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416009">- smb: client: fix mount when dns_resolver key is not available
  (git-fixes, bsc#1225172).
- commit 28edb5c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416010">- cifs: fix leak of iface for primary channel (git-fixes,
  bsc#1225172).
- commit b7eb8e8</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416011">- Revert "cifs: reconnect work should have reference on server
  struct" (git-fixes, bsc#1225172).
- commit 3ca4c0c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416012">- smb: client: fix parsing of SMB3.1.1 POSIX create context
  (git-fixes, bsc#1225172).
- commit 5f27f69</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416013">- cifs: failure to add channel on iface should bump up weight
  (git-fixes, bsc#1225172).
- commit 007b237</changelog>
  <changelog author="tonyj@suse.de" date="1717416014">- perf/x86: Fix out of range data (git-fixes).
- perf/x86/intel/ds: Don't clear -&gt;pebs_data_cfg for the last
  PEBS event (git-fixes).
- perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
- commit 664d77f</changelog>
  <changelog author="dsterba@suse.com" date="1717588800">- blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
- Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
  Quoting bsc#1225945#c11:
  "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
  transaction for every subvol create")
  ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
  unwritten extent buffer after snapshotting a new subvolume") was never
  backported."
- commit d947258</changelog>
  <changelog author="tonyj@suse.de" date="1717588801">- perf pmu: Count sys and cpuid JSON events separately (git
  fixes).
- perf stat: Don't display metric header for non-leader uncore
  events (git-fixes).
- perf daemon: Fix file leak in daemon_session__control
  (git-fixes).
- perf symbols: Fix ownership of string in dso__load_vmlinux()
  (git-fixes).
- perf thread: Fixes to thread__new() related to initializing comm
  (git-fixes).
- perf report: Avoid SEGV in report__setup_sample_type()
  (git-fixes).
- perf ui browser: Don't save pointer to stack memory (git-fixes).
- perf bench internals inject-build-id: Fix trap divide when
  collecting just one DSO (git-fixes).
- perf intel-pt: Fix unassigned instruction op (discovered by
  MemorySanitizer) (git-fixes).
- perf test shell arm_coresight: Increase buffer size for
  Coresight basic tests (git-fixes).
- perf docs: Document bpf event modifier (git-fixes).
- perf bench uprobe: Remove lib64 from libc.so.6 binary path
  (git-fixes).
- perf record: Fix debug message placement for test consumption
  (git-fixes).
- perf tests: Apply attributes to all events in object code
  reading test (git-fixes).
- perf tests: Make "test data symbol" more robust on Neoverse N1
  (git-fixes).
- perf annotate: Fix annotation_calc_lines() to pass correct
  address to get_srcline() (git-fixes).
- perf stat: Do not fail on metrics on s390 z/VM systems
  (git-fixes).
- perf sched timehist: Fix -g/--call-graph option failure
  (git-fixes).
- perf annotate: Get rid of duplicate --group option item
  (git-fixes).
- perf probe: Add missing libgen.h header needed for using
  basename() (git-fixes).
- perf record: Delete session after stopping sideband thread
  (git-fixes).
- perf auxtrace: Fix multiple use of --itrace option (git-fixes).
- perf script: Show also errors for --insn-trace option
  (git-fixes).
- perf lock contention: Add a missing NULL check (git-fixes).
- perf vendor events amd: Fix Zen 4 cache latency events
  (git-fixes).
- libperf evlist: Avoid out-of-bounds access (git-fixes).
- perf pmu: Fix a potential memory leak in perf_pmu__lookup()
  (git-fixes).
- perf print-events: make is_event_supported() more robust
  (git-fixes).
- perf list: fix short description for some cache events
  (git-fixes).
- perf metric: Don't remove scale from counts (git-fixes).
- perf stat: Avoid metric-only segv (git-fixes).
- perf expr: Fix "has_event" function for metric style events
  (git-fixes).
- perf srcline: Add missed addr2line closes (git-fixes).
- perf thread_map: Free strlist on normal path in
  thread_map__new_by_tid_str() (git-fixes).
- perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
- perf jevents: Drop or simplify small integer values (git-fixes).
- perf evsel: Fix duplicate initialization of data-&gt;id in
  evsel__parse_sample() (git-fixes).
- perf pmu: Treat the msr pmu as software (git-fixes).
- perf record: Check conflict between '--timestamp-filename'
  option and pipe mode before recording (git-fixes).
- perf record: Fix possible incorrect free in
  record__switch_output() (git-fixes).
- perf vendor events amd: Add Zen 4 memory controller events
  (git-fixes).
- perf top: Uniform the event name for the hybrid machine
  (git-fixes).
- perf top: Use evsel's cpus to replace user_requested_cpus
  (git-fixes).
- commit a1f9340</changelog>
  <changelog author="tonyj@suse.de" date="1717675200">- perf ui browser: Avoid SEGV on title (git fixes).
- commit 1578c22</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675201">- inet: inet_defrag: prevent sk release while still in use
  (CVE-2024-26921 bsc#1223138).
- commit 2016faf</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675202">- net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
- commit 7bf5961</changelog>
</package>
<package pkgid="342270ffea9d627cfa1651a43653cdae6230a609d3a185354362ec206066f158" name="dlm-kmp-azure" arch="x86_64">
  <version epoch="0" ver="6.4.0" rel="150600.8.5.4"/>
  <changelog author="mkubecek@suse.cz" date="1717416000">- series.conf: cleanup
  Fix subsection header to silence series_insert error.
- commit 4628dc3</changelog>
  <changelog author="mkubecek@suse.cz" date="1717416001">- netfilter: nf_tables: release mutex after nft_gc_seq_end from
  abort path (CVE-2024-26925 bsc#1223390).
- commit 578a709</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717416002">- Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
  The L3 bsc#1225765 was created seperately since our customer requires
  PTF.
- Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
- Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
- Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
- Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
- commit 054635e</changelog>
  <changelog author="msuchanek@suse.de" date="1717416003">- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
- powerpc/uaccess: Fix build errors seen with GCC 13/14
  (bsc#1194869).
- commit 46b5d84</changelog>
  <changelog author="msuchanek@suse.de" date="1717416004">- blacklist.conf: PPC fsl_msi is not used
- commit ae6590d</changelog>
  <changelog author="msuchanek@suse.de" date="1717416005">- powerpc/pseries/lparcfg: drop error message from guest name
  lookup (bsc#1187716 ltc#193451 git-fixes).
- commit ceab637</changelog>
  <changelog author="mfranc@suse.cz" date="1717416006">- Update
  patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
  (git-fixes CVE-2024-36955).
- Update
  patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
  (git-fixes bsc#1225715 CVE-2024-36906).
- Update
  patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
  (git-fixes bsc#1225579 CVE-2024-36011).
- Update
  patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
  (git-fixes bsc#1225578 CVE-2024-36013).
- Update
  patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
  (git-fixes bsc#1225502 CVE-2024-36012).
- Update
  patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
  (git-fixes bsc#1225722 CVE-2024-36880).
- Update
  patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
  (git-fixes CVE-2024-36942).
- Update
  patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
  (git-fixes bsc#1225720 CVE-2024-36032).
- Update
  patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
  (git-fixes bsc#1223749 CVE-2024-26990).
- Update
  patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
  (git-fixes bsc#1223692 CVE-2024-26992).
- Update
  patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
  (stable-fixes CVE-2024-36944).
- Update
  patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
  (git-fixes bsc#1225734 CVE-2024-36896).
- Update
  patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
  (stable-fixes CVE-2024-36949).
- Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
  (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
- Update
  patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
  (git-fixes bsc#1225692 CVE-2023-52882).
- Update
  patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
  (git-fixes CVE-2024-26761).
- Update
  patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
  (stable-fixes bsc#1225735 CVE-2024-36897).
- Update
  patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
  (stable-fixes bsc#1225705 CVE-2024-36026).
- Update
  patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
  (stable-fixes CVE-2024-36951).
- Update
  patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
  (git-fixes bsc#1225593 CVE-2024-36014).
- Update
  patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
  (stable-fixes bsc#1225728 CVE-2024-36885).
- Update
  patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
  (git-fixes bsc#1225773 CVE-2024-36936).
- Update
  patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
  (stable-fixes CVE-2024-36950).
- Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
  (git-fixes bsc#1225736 CVE-2024-36898).
- Update
  patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
  (git-fixes bsc#1225698 CVE-2024-36020).
- Update
  patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
  (git-fixes bsc#1225710 CVE-2024-36891).
- Update
  patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
  (git-fixes bsc#1225714 CVE-2024-36890).
- Update
  patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
  (git-fixes bsc#1225708 CVE-2024-36029).
- Update
  patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
  (git-fixes bsc#1225699 CVE-2024-36021).
- Update
  patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
  (git-fixes CVE-2024-26943).
- Update
  patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
  (git-fixes bsc#1225694 CVE-2024-36018).
- Update
  patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
  (git-fixes CVE-2024-36940).
- Update
  patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
  (git-fixes CVE-2024-36959).
- Update
  patches.suse/ppdev-Add-an-error-check-in-register_device.patch
  (git-fixes bsc#1225640 CVE-2024-36015).
- Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
  CVE-2024-36947).
- Update
  patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
  (git-fixes bsc#1225695 CVE-2024-36019).
- Update
  patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
  (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
- Update
  patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
  (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
- Update
  patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
  (git-fixes bsc#1225704 CVE-2024-36025).
- Update
  patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
  (git-fixes CVE-2024-36930).
- Update
  patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
  (bsc#1224331 bsc#1224602 CVE-2024-35814).
- Update
  patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
  (git-fixes bsc#1225642 CVE-2024-36016).
- Update
  patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
  (git-fixes bsc#1225749 CVE-2024-36894).
- Update
  patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
  (git-fixes bsc#1225750 CVE-2024-36895).
- Update
  patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
  (git-fixes bsc#1225748 CVE-2024-36893).
- Update
  patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
  (stable-fixes bsc#1225769 CVE-2024-36921).
- Update
  patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
  (stable-fixes CVE-2024-36922).
- Update
  patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
  (git-fixes CVE-2024-36941).
- Update
  patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
  (git-fixes bsc#1224742 CVE-2024-35803).
- commit 539780f</changelog>
  <changelog author="dwagner@suse.de" date="1717416007">- nvmet: fix ns enable/disable possible hang (git-fixes).
- nvme-multipath: fix io accounting on failover (git-fixes).
- nvme: fix multipath batched completion accounting (git-fixes).
- commit ed3b392</changelog>
  <changelog author="dwagner@suse.de" date="1717416008">- scsi: lpfc: Copyright updates for 14.4.0.2 patches
  (bsc#1225842).
- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
  (bsc#1225842).
  Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
  (bsc#1225842).
- scsi: lpfc: Clear deferred RSCN processing flag when driver
  is unloading (bsc#1225842).
- scsi: lpfc: Update logging of protection type for T10 DIF I/O
  (bsc#1225842).
- scsi: lpfc: Change default logging level for unsolicited CT
  MIB commands (bsc#1225842).
- commit 5a56384</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416009">- smb: client: fix mount when dns_resolver key is not available
  (git-fixes, bsc#1225172).
- commit 28edb5c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416010">- cifs: fix leak of iface for primary channel (git-fixes,
  bsc#1225172).
- commit b7eb8e8</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416011">- Revert "cifs: reconnect work should have reference on server
  struct" (git-fixes, bsc#1225172).
- commit 3ca4c0c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416012">- smb: client: fix parsing of SMB3.1.1 POSIX create context
  (git-fixes, bsc#1225172).
- commit 5f27f69</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416013">- cifs: failure to add channel on iface should bump up weight
  (git-fixes, bsc#1225172).
- commit 007b237</changelog>
  <changelog author="tonyj@suse.de" date="1717416014">- perf/x86: Fix out of range data (git-fixes).
- perf/x86/intel/ds: Don't clear -&gt;pebs_data_cfg for the last
  PEBS event (git-fixes).
- perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
- commit 664d77f</changelog>
  <changelog author="dsterba@suse.com" date="1717588800">- blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
- Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
  Quoting bsc#1225945#c11:
  "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
  transaction for every subvol create")
  ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
  unwritten extent buffer after snapshotting a new subvolume") was never
  backported."
- commit d947258</changelog>
  <changelog author="tonyj@suse.de" date="1717588801">- perf pmu: Count sys and cpuid JSON events separately (git
  fixes).
- perf stat: Don't display metric header for non-leader uncore
  events (git-fixes).
- perf daemon: Fix file leak in daemon_session__control
  (git-fixes).
- perf symbols: Fix ownership of string in dso__load_vmlinux()
  (git-fixes).
- perf thread: Fixes to thread__new() related to initializing comm
  (git-fixes).
- perf report: Avoid SEGV in report__setup_sample_type()
  (git-fixes).
- perf ui browser: Don't save pointer to stack memory (git-fixes).
- perf bench internals inject-build-id: Fix trap divide when
  collecting just one DSO (git-fixes).
- perf intel-pt: Fix unassigned instruction op (discovered by
  MemorySanitizer) (git-fixes).
- perf test shell arm_coresight: Increase buffer size for
  Coresight basic tests (git-fixes).
- perf docs: Document bpf event modifier (git-fixes).
- perf bench uprobe: Remove lib64 from libc.so.6 binary path
  (git-fixes).
- perf record: Fix debug message placement for test consumption
  (git-fixes).
- perf tests: Apply attributes to all events in object code
  reading test (git-fixes).
- perf tests: Make "test data symbol" more robust on Neoverse N1
  (git-fixes).
- perf annotate: Fix annotation_calc_lines() to pass correct
  address to get_srcline() (git-fixes).
- perf stat: Do not fail on metrics on s390 z/VM systems
  (git-fixes).
- perf sched timehist: Fix -g/--call-graph option failure
  (git-fixes).
- perf annotate: Get rid of duplicate --group option item
  (git-fixes).
- perf probe: Add missing libgen.h header needed for using
  basename() (git-fixes).
- perf record: Delete session after stopping sideband thread
  (git-fixes).
- perf auxtrace: Fix multiple use of --itrace option (git-fixes).
- perf script: Show also errors for --insn-trace option
  (git-fixes).
- perf lock contention: Add a missing NULL check (git-fixes).
- perf vendor events amd: Fix Zen 4 cache latency events
  (git-fixes).
- libperf evlist: Avoid out-of-bounds access (git-fixes).
- perf pmu: Fix a potential memory leak in perf_pmu__lookup()
  (git-fixes).
- perf print-events: make is_event_supported() more robust
  (git-fixes).
- perf list: fix short description for some cache events
  (git-fixes).
- perf metric: Don't remove scale from counts (git-fixes).
- perf stat: Avoid metric-only segv (git-fixes).
- perf expr: Fix "has_event" function for metric style events
  (git-fixes).
- perf srcline: Add missed addr2line closes (git-fixes).
- perf thread_map: Free strlist on normal path in
  thread_map__new_by_tid_str() (git-fixes).
- perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
- perf jevents: Drop or simplify small integer values (git-fixes).
- perf evsel: Fix duplicate initialization of data-&gt;id in
  evsel__parse_sample() (git-fixes).
- perf pmu: Treat the msr pmu as software (git-fixes).
- perf record: Check conflict between '--timestamp-filename'
  option and pipe mode before recording (git-fixes).
- perf record: Fix possible incorrect free in
  record__switch_output() (git-fixes).
- perf vendor events amd: Add Zen 4 memory controller events
  (git-fixes).
- perf top: Uniform the event name for the hybrid machine
  (git-fixes).
- perf top: Use evsel's cpus to replace user_requested_cpus
  (git-fixes).
- commit a1f9340</changelog>
  <changelog author="tonyj@suse.de" date="1717675200">- perf ui browser: Avoid SEGV on title (git fixes).
- commit 1578c22</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675201">- inet: inet_defrag: prevent sk release while still in use
  (CVE-2024-26921 bsc#1223138).
- commit 2016faf</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675202">- net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
- commit 7bf5961</changelog>
</package>
<package pkgid="71305cacf7fedfbc513f5daee712f744b6368846b2ab6e5eb8fec2d925e8d3c7" name="dlm-kmp-azure" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.8.8.2"/>
  <changelog author="tiwai@suse.de" date="1722081600">- auxdisplay: ht16k33: Drop reference after LED registration
  (git-fixes).
- ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
  on unprepare (git-fixes).
- ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
- ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
  reachable (git-fixes).
- ASoC: sof: amd: fix for firmware reload failure in Vangogh
  platform (git-fixes).
- ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
- ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
  (git-fixes).
- ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
- ALSA: ump: Don't update FB name for static blocks (git-fixes).
- drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
- drm/i915/gt: Do not consider preemption during execlists_dequeue
  for gen8 (git-fixes).
- drm/i915/dp: Don't switch the LTTPR mode on an active link
  (git-fixes).
- commit d7e2deb</changelog>
  <changelog author="tiwai@suse.de" date="1722081601">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
</package>
<package pkgid="89096d2ef5d6dad94ba0c62f301fa59aa7a8008f804f43b75efa39a8114e9513" name="dlm-kmp-azure" arch="x86_64">
  <version epoch="0" ver="6.4.0" rel="150600.8.8.2"/>
  <changelog author="tiwai@suse.de" date="1722081600">- auxdisplay: ht16k33: Drop reference after LED registration
  (git-fixes).
- ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
  on unprepare (git-fixes).
- ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
- ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
  reachable (git-fixes).
- ASoC: sof: amd: fix for firmware reload failure in Vangogh
  platform (git-fixes).
- ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
- ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
  (git-fixes).
- ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
- ALSA: ump: Don't update FB name for static blocks (git-fixes).
- drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
- drm/i915/gt: Do not consider preemption during execlists_dequeue
  for gen8 (git-fixes).
- drm/i915/dp: Don't switch the LTTPR mode on an active link
  (git-fixes).
- commit d7e2deb</changelog>
  <changelog author="tiwai@suse.de" date="1722081601">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
</package>
<package pkgid="6373db17e03e88609d192e141eaf84c999babee95b802bf35b48399e05a3f7e2" name="dlm-kmp-default" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.14.2"/>
  <changelog author="tiwai@suse.de" date="1719662400">- gpiolib: cdev: Disallow reconfiguration without direction
  (uAPI v1) (git-fixes).
- gpio: davinci: Validate the obtained number of IRQs (git-fixes).
- commit 919ebd1</changelog>
  <changelog author="tiwai@suse.de" date="1719748800">- i2c: testunit: discard write requests while old command is
  running (git-fixes).
- i2c: testunit: don't erase registers after STOP (git-fixes).
- mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
  (git-fixes).
- mmc: sdhci: Do not invert write-protect twice (git-fixes).
- mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
  (git-fixes).
- mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
  (git-fixes).
- commit 448487d</changelog>
  <changelog author="tiwai@suse.de" date="1719748801">- crypto: iaa - Account for cpu-less numa nodes (bsc#1227190).
- commit cd600aa</changelog>
  <changelog author="tiwai@suse.de" date="1719748802">- crypto: deflate - Add aliases to deflate (bsc#1227190).
- commit 27ffd92</changelog>
  <changelog author="tiwai@suse.de" date="1719835200">- ata: ahci: Clean up sysfs file on error (git-fixes).
- ata: libata-core: Fix double free on error (git-fixes).
- ata,scsi: libata-core: Do not leak memory for ata_port struct
  members (git-fixes).
- ata: libata-core: Fix null pointer dereference on error
  (git-fixes).
- kbuild: Fix build target deb-pkg: ln: failed to create hard link
  (git-fixes).
- kbuild: doc: Update default INSTALL_MOD_DIR from extra to
  updates (git-fixes).
- kbuild: Install dtb files as 0644 in Makefile.dtbinst
  (git-fixes).
- counter: ti-eqep: enable clock at probe (git-fixes).
- iio: chemical: bme680: Fix sensor data read operation
  (git-fixes).
- iio: chemical: bme680: Fix overflows in compensate() functions
  (git-fixes).
- iio: chemical: bme680: Fix calibration data variable
  (git-fixes).
- iio: chemical: bme680: Fix pressure value output (git-fixes).
- iio: accel: fxls8962af: select IIO_BUFFER &amp; IIO_KFIFO_BUF
  (git-fixes).
- iio: adc: ad7266: Fix variable checking bug (git-fixes).
- iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
  (git-fixes).
- serial: bcm63xx-uart: fix tx after conversion to
  uart_port_tx_limited() (git-fixes).
- serial: core: introduce uart_port_tx_limited_flags()
  (git-fixes).
- Revert "serial: core: only stop transmit when HW fifo is empty"
  (git-fixes).
- tty: mcf: MCF54418 has 10 UARTS (git-fixes).
- usb: gadget: aspeed_udc: fix device address configuration
  (git-fixes).
- usb: dwc3: core: remove lock of otg mode during gadget
  suspend/resume to avoid deadlock (git-fixes).
- usb: typec: ucsi: glink: fix child node release in probe
  function (git-fixes).
- usb: musb: da8xx: fix a resource leak in probe() (git-fixes).
- usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  (git-fixes).
- usb: gadget: printer: fix races against disable (git-fixes).
- PCI/MSI: Fix UAF in msi_capability_init (git-fixes).
- commit a2ea5a9</changelog>
  <changelog author="ptesarik@suse.com" date="1719835201">- net: ena: Fix redundant device NUMA node override
  (jsc#PED-8688).
- commit 6ad6684</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835202">- tcp: do not accept ACK of bytes we never sent (CVE-2023-52881
  bsc#1225611).
- commit 16404a6</changelog>
  <changelog author="mhocko@suse.com" date="1719835203">- Update
  patches.suse/1352-drm-amdgpu-Fix-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52883
  bsc#1226630).
- Update
  patches.suse/9p-add-missing-locking-around-taking-dentry-fid-list.patch
  (git-fixes CVE-2024-39463 bsc#1227090).
- Update
  patches.suse/ALSA-Fix-deadlocks-with-kctl-removals-at-disconnecti.patch
  (stable-fixes CVE-2024-38600 bsc#1226864).
- Update
  patches.suse/ALSA-core-Fix-NULL-module-pointer-assignment-at-card.patch
  (git-fixes CVE-2024-38605 bsc#1226740).
- Update
  patches.suse/ALSA-hda-Fix-possible-null-ptr-deref-when-assigning-.patch
  (git-fixes CVE-2023-52806 bsc#1225554).
- Update
  patches.suse/ALSA-hda-cs_dsp_ctl-Use-private_free-for-control-cle.patch
  (git-fixes CVE-2024-38388 bsc#1226890).
- Update
  patches.suse/ALSA-timer-Set-lower-bound-of-start-tick-time.patch
  (stable-fixes git-fixes CVE-2024-38618 bsc#1226754).
- Update
  patches.suse/ASoC-kirkwood-Fix-potential-NULL-dereference.patch
  (git-fixes CVE-2024-38550 bsc#1226633).
- Update
  patches.suse/ASoC-mediatek-Assign-dummy-when-codec-not-specified-.patch
  (git-fixes CVE-2024-38551 bsc#1226761).
- Update
  patches.suse/Bluetooth-btusb-Add-date-evt_skb-is-NULL-check.patch
  (git-fixes CVE-2023-52833 bsc#1225595).
- Update
  patches.suse/Bluetooth-hci_core-Fix-possible-buffer-overflow.patch
  (git-fixes CVE-2024-26889).
- Update
  patches.suse/HID-uclogic-Fix-user-memory-access-bug-in-uclogic_pa.patch
  (git-fixes CVE-2023-52866 bsc#1225120).
- Update
  patches.suse/IB-mlx5-Fix-init-stage-error-handling-to-avoid-doubl.patch
  (jsc#PED-6864 CVE-2023-52851 bsc#1225587).
- Update
  patches.suse/Input-cyapa-add-missing-input-core-locking-to-suspen.patch
  (git-fixes CVE-2023-52884 bsc#1226764).
- Update
  patches.suse/Input-synaptics-rmi4-fix-use-after-free-in-rmi_unreg.patch
  (git-fixes CVE-2023-52840 bsc#1224928).
- Update
  patches.suse/KEYS-trusted-Do-not-use-WARN-when-encode-fails.patch
  (git-fixes CVE-2024-36975 bsc#1226520).
- Update
  patches.suse/KEYS-trusted-Fix-memory-leak-in-tpm2_key_encode.patch
  (git-fixes CVE-2024-36967 bsc#1226131).
- Update
  patches.suse/RDMA-cma-Fix-kmemleak-in-rdma_core-observed-during-b.patch
  (git-fixes CVE-2024-38539 bsc#1226608).
- Update patches.suse/RDMA-hns-Fix-UAF-for-cq-async-event.patch
  (git-fixes CVE-2024-38545 bsc#1226595).
- Update
  patches.suse/RDMA-hns-Fix-deadlock-on-SRQ-async-events.patch
  (git-fixes CVE-2024-38591 bsc#1226738).
- Update
  patches.suse/RDMA-hns-Modify-the-print-level-of-CQE-error.patch
  (git-fixes CVE-2024-38590 bsc#1226839).
- Update
  patches.suse/RDMA-rxe-Fix-seg-fault-in-rxe_comp_queue_pkt.patch
  (git-fixes CVE-2024-38544 bsc#1226597).
- Update
  patches.suse/SUNRPC-Fix-RPC-client-cleaned-up-the-freed-pipefs-de.patch
  (git-fixes CVE-2023-52803 bsc#1225008).
- Update patches.suse/af_unix-Clear-stale-u-oob_skb.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-35970 bsc#1224584).
- Update
  patches.suse/af_unix-Drop-oob_skb-ref-before-purging-queue-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26750 bsc#1222617).
- Update
  patches.suse/af_unix-Fix-task-hung-while-purging-oob_skb-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26780 bsc#1222588).
- Update
  patches.suse/af_unix-Update-unix_sk-sk-oob_skb-under-sk_receive_queue-lock.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-36972 bsc#1226163).
- Update
  patches.suse/arm64-Restrict-CPU_BIG_ENDIAN-to-GNU-as-or-LLVM-IAS-.patch
  (git-fixes CVE-2023-52750 bsc#1225485).
- Update
  patches.suse/atl1c-Work-around-the-DMA-RX-overflow-issue.patch
  (git-fixes CVE-2023-52834 bsc#1225599).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issue-of-net_device.patch
  (git-fixes CVE-2024-38554 bsc#1226742).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issues-of-ax25_dev.patch
  (git-fixes CVE-2024-38602 bsc#1226613).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-reorder-of-WRITE-lqueued.patch
  (bsc#1225605 CVE-2024-38384 bsc#1226938).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-resetting-io-stat.patch
  (bsc#1225605 CVE-2024-38663 bsc#1226939).
- Update
  patches.suse/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch
  (git-fixes CVE-2024-38540 bsc#1226582).
- Update
  patches.suse/bonding-stop-the-device-in-bond_setup_by_slave.patch
  (git-fixes CVE-2023-52784 bsc#1224946).
- Update
  patches.suse/can-dev-can_put_echo_skb-don-t-crash-kernel-if-can_p.patch
  (git-fixes CVE-2023-52878 bsc#1225000).
- Update
  patches.suse/clk-mediatek-clk-mt2701-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52875 bsc#1225096).
- Update
  patches.suse/clk-mediatek-clk-mt6765-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52870 bsc#1224937).
- Update
  patches.suse/clk-mediatek-clk-mt6779-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52873 bsc#1225589).
- Update
  patches.suse/clk-mediatek-clk-mt6797-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52865 bsc#1225086).
- Update
  patches.suse/clk-mediatek-clk-mt7629-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52858 bsc#1225566).
- Update
  patches.suse/clk-mediatek-clk-mt7629-eth-Add-check-for-mtk_alloc_.patch
  (git-fixes CVE-2023-52876 bsc#1225036).
- Update
  patches.suse/cppc_cpufreq-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38573 bsc#1226739).
- Update patches.suse/cpufreq-exit-callback-is-optional.patch
  (git-fixes CVE-2024-38615 bsc#1226592).
- Update patches.suse/crypto-bcm-Fix-pointer-arithmetic.patch
  (git-fixes CVE-2024-38579 bsc#1226637).
- Update
  patches.suse/crypto-pcrypt-Fix-hungtask-for-PADATA_RESET.patch
  (git-fixes CVE-2023-52813 bsc#1225527).
- Update patches.suse/cxl-mem-Fix-shutdown-order.patch (git-fixes
  CVE-2023-52849 bsc#1224949).
- Update
  patches.suse/cxl-region-Do-not-try-to-cleanup-after-cxl_region_se.patch
  (git-fixes CVE-2023-52792 bsc#1225477).
- Update patches.suse/cxl-region-Fix-cxlr_pmem-leaks.patch
  (git-fixes CVE-2024-38391 bsc#1226894).
- Update
  patches.suse/dma-buf-sw-sync-don-t-enable-IRQ-from-sync_print_obj.patch
  (git-fixes CVE-2024-38780 bsc#1226886).
- Update
  patches.suse/dma-mapping-benchmark-fix-node-id-validation.patch
  (git-fixes CVE-2024-34777 bsc#1226796).
- Update
  patches.suse/dma-mapping-benchmark-handle-NUMA_NO_NODE-correctly.patch
  (git-fixes CVE-2024-39277 bsc#1226909).
- Update
  patches.suse/dmaengine-idxd-Avoid-unnecessary-destruction-of-file.patch
  (git-fixes CVE-2024-38629 bsc#1226905).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Pola.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52819
  bsc#1225532).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-SMU7.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52818
  bsc#1225530).
- Update
  patches.suse/drm-amd-check-num-of-link-levels-when-update-pcie-pa.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52812
  bsc#1225564).
- Update
  patches.suse/drm-amd-display-Avoid-NULL-dereference-of-timing-gen.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52753
  bsc#1225478).
- Update
  patches.suse/drm-amd-display-Fix-division-by-zero-in-setup_dsc_co.patch
  (stable-fixes CVE-2024-36969 bsc#1226155).
- Update
  patches.suse/drm-amd-display-Fix-null-pointer-dereference-in-erro.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52862
  bsc#1225015).
- Update
  patches.suse/drm-amd-display-Fix-potential-index-out-of-bounds-in.patch
  (git-fixes CVE-2024-38552 bsc#1226767).
- Update
  patches.suse/drm-amd-display-fix-a-NULL-pointer-dereference-in-am.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52773
  bsc#1225041).
- Update
  patches.suse/drm-amd-display-fixed-integer-types-and-null-check-l.patch
  (git-fixes CVE-2024-26767).
- Update
  patches.suse/drm-amdgpu-Fix-a-null-pointer-access-when-the-smc_rr.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52817
  bsc#1225569).
- Update
  patches.suse/drm-amdgpu-Fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch
  (git-fixes CVE-2024-39291 bsc#1226934).
- Update
  patches.suse/drm-amdgpu-Fix-potential-null-pointer-derefernce.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52814
  bsc#1225565).
- Update
  patches.suse/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch
  (stable-fixes CVE-2024-39471 bsc#1227096).
- Update
  patches.suse/drm-amdgpu-mes-fix-use-after-free-issue.patch
  (stable-fixes CVE-2024-38581 bsc#1226657).
- Update
  patches.suse/drm-amdgpu-vkms-fix-a-possible-null-pointer-derefere.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52815
  bsc#1225568).
- Update
  patches.suse/drm-amdkfd-Fix-a-race-condition-of-vram-buffer-unref.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52825
  bsc#1225076).
- Update
  patches.suse/drm-amdkfd-Fix-shift-out-of-bounds-issue.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52816
  bsc#1225529).
- Update
  patches.suse/drm-bridge-cdns-mhdp8546-Fix-possible-null-pointer-d.patch
  (git-fixes CVE-2024-38548).
- Update
  patches.suse/drm-bridge-it66121-Fix-invalid-connector-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52861
  bsc#1224941).
- Update
  patches.suse/drm-bridge-lt8912b-Fix-crash-on-bridge-detach.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52856
  bsc#1224932).
- Update
  patches.suse/drm-mediatek-Add-0-size-check-to-mtk_drm_gem_obj.patch
  (git-fixes CVE-2024-38549 bsc#1226735).
- Update
  patches.suse/drm-mediatek-Fix-coverity-issue-with-unintentional-i.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52857
  bsc#1225581).
- Update
  patches.suse/drm-mediatek-Init-ddp_comp-with-devm_kcalloc.patch
  (git-fixes CVE-2024-38592 bsc#1226844).
- Update
  patches.suse/drm-msm-a6xx-Avoid-a-nullptr-dereference-when-speedb.patch
  (git-fixes CVE-2024-38390 bsc#1226891).
- Update
  patches.suse/drm-msm-dpu-Add-callback-function-pointer-check-befo.patch
  (git-fixes CVE-2024-38622 bsc#1226856).
- Update
  patches.suse/drm-panel-fix-a-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52821
  bsc#1225022).
- Update
  patches.suse/drm-panel-panel-tpo-tpg110-fix-a-possible-null-point.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52826
  bsc#1225077).
- Update patches.suse/drm-radeon-possible-buffer-overflow.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52867
  bsc#1225009).
- Update
  patches.suse/drm-vc4-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38546 bsc#1226593).
- Update
  patches.suse/drm-vmwgfx-Fix-invalid-reads-in-fence-signaled-event.patch
  (git-fixes CVE-2024-36960 bsc#1225872).
- Update
  patches.suse/drm-zynqmp_dpsub-Always-register-bridge.patch
  (git-fixes CVE-2024-38664 bsc#1226941).
- Update
  patches.suse/e1000e-change-usleep_range-to-udelay-in-PHY-mdic-acc.patch
  (CVE-2024-39296 bsc#1226989 CVE-2024-36887 bsc#1225731).
- Update
  patches.suse/ecryptfs-Fix-buffer-size-for-tag-66-packet.patch
  (git-fixes CVE-2024-38578 bsc#1226634).
- Update
  patches.suse/efi-libstub-only-free-priv.runtime_map-when-allocate.patch
  (git-fixes CVE-2024-33619 bsc#1226768).
- Update
  patches.suse/fbdev-imsttfb-fix-a-resource-leak-in-probe.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52838
  bsc#1225031).
- Update
  patches.suse/fs-9p-only-translate-RWX-permissions-for-plain-9P200.patch
  (git-fixes CVE-2024-36964 bsc#1225866).
- Update
  patches.suse/fs-jfs-Add-check-for-negative-db_l2nbperpage.patch
  (git-fixes CVE-2023-52810 bsc#1225557).
- Update
  patches.suse/fs-jfs-Add-validity-check-for-db_maxag-and-db_agpref.patch
  (git-fixes CVE-2023-52804 bsc#1225550).
- Update
  patches.suse/ftrace-Fix-possible-use-after-free-issue-in-ftrace_location.patch
  (git-fixes CVE-2024-38588 bsc#1226837).
- Update
  patches.suse/genirq-irqdesc-Prevent-use-after-free-in-irq_find_at.patch
  (git-fixes CVE-2024-38385 bsc#1227085).
- Update patches.suse/gfs2-ignore-negated-quota-changes.patch
  (git-fixes CVE-2023-52759 bsc#1225560).
- Update
  patches.suse/hid-cp2112-Fix-duplicate-workqueue-initialization.patch
  (git-fixes CVE-2023-52853 bsc#1224988).
- Update
  patches.suse/hwmon-axi-fan-control-Fix-possible-NULL-pointer-dere.patch
  (git-fixes CVE-2023-52863 bsc#1225586).
- Update
  patches.suse/i2c-acpi-Unbind-mux-adapters-before-delete.patch
  (git-fixes CVE-2024-39362 bsc#1226995).
- Update
  patches.suse/i2c-core-Run-atomic-i2c-xfer-when-preemptible.patch
  (git-fixes CVE-2023-52791 bsc#1225108).
- Update
  patches.suse/i3c-master-mipi-i3c-hci-Fix-a-kernel-panic-for-acces.patch
  (git-fixes CVE-2023-52763 bsc#1225570).
- Update
  patches.suse/i3c-mipi-i3c-hci-Fix-out-of-bounds-access-in-hci_dma.patch
  (git-fixes CVE-2023-52766).
- Update
  patches.suse/i915-perf-Fix-NULL-deref-bugs-with-drm_dbg-calls.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52788
  bsc#1225106).
- Update
  patches.suse/igb-Fix-string-truncation-warnings-in-igb_set_fw_ver.patch
  (git-fixes CVE-2024-36010 bsc#1225594).
- Update
  patches.suse/iommu-vt-d-Fix-WARN_ON-in-iommu-probe-path.patch
  (git-fixes CVE-2024-35957 bsc#1224673).
- Update
  patches.suse/iommufd-Fix-missing-update-of-domains_itree-after-splitting-iopt
  (jsc#PED-7779 jsc#PED-7780 CVE-2023-52801 bsc#1225006).
- Update
  patches.suse/ipvlan-add-ipvlan_route_v6_outbound-helper.patch
  (git-fixes CVE-2023-52796 bsc#1224930).
- Update
  patches.suse/jffs2-prevent-xattr-node-from-overflowing-the-eraseblock.patch
  (git-fixes CVE-2024-38599 bsc#1226848).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-dbFindLeaf.patch
  (git-fixes CVE-2023-52799 bsc#1225472).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-diAlloc.patch
  (git-fixes CVE-2023-52805 bsc#1225553).
- Update
  patches.suse/kunit-fortify-Fix-mismatched-kvalloc-vfree-usage.patch
  (git-fixes CVE-2024-38617 bsc#1226859).
- Update
  patches.suse/lib-generic-radix-tree.c-Don-t-overflow-in-peek.patch
  (git-fixes CVE-2021-47432 bsc#1225391).
- Update
  patches.suse/lib-test_hmm.c-handle-src_pfns-and-dst_pfns-allocati.patch
  (git-fixes CVE-2024-38543 bsc#1226594).
- Update
  patches.suse/locking-ww_mutex-test-Fix-potential-workqueue-corrup.patch
  (bsc#1219953 CVE-2023-52836 bsc#1225609).
- Update
  patches.suse/md-Don-t-ignore-suspended-array-in-md_check_recovery-1baa.patch
  (bsc#1219596 CVE-2024-26758).
- Update
  patches.suse/media-atomisp-ssh_css-Fix-a-null-pointer-dereference.patch
  (git-fixes CVE-2024-38547 bsc#1226632).
- Update
  patches.suse/media-bttv-fix-use-after-free-error-due-to-btv-timeo.patch
  (git-fixes CVE-2023-52847 bsc#1225588).
- Update
  patches.suse/media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch
  (git-fixes CVE-2023-52764 bsc#1225571).
- Update
  patches.suse/media-hantro-Check-whether-reset-op-is-defined-befor.patch
  (git-fixes CVE-2023-52850 bsc#1225014).
- Update
  patches.suse/media-i2c-et8ek8-Don-t-strip-remove-function-when-dr.patch
  (git-fixes CVE-2024-38611 bsc#1226760).
- Update
  patches.suse/media-imon-fix-access-to-invalid-resource-for-the-se.patch
  (git-fixes CVE-2023-52754 bsc#1225490).
- Update
  patches.suse/media-lgdt3306a-Add-a-check-against-null-pointer-def.patch
  (stable-fixes CVE-2022-48772 bsc#1226976).
- Update
  patches.suse/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch
  (git-fixes CVE-2024-38621 bsc#1226895).
- Update
  patches.suse/media-vidtv-mux-Add-check-and-kfree-for-kstrdup.patch
  (git-fixes CVE-2023-52841 bsc#1225592).
- Update patches.suse/media-vidtv-psi-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52844 bsc#1225590).
- Update
  patches.suse/mfd-qcom-spmi-pmic-Fix-revid-implementation.patch
  (git-fixes CVE-2023-52765 bsc#1225029).
- Update
  patches.suse/misc-microchip-pci1xxxx-fix-double-free-in-the-error.patch
  (git-fixes CVE-2024-36973 bsc#1226457).
- Update
  patches.suse/net-hns3-fix-out-of-bounds-access-may-occur-when-coa.patch
  (git-fixes CVE-2023-52807 bsc#1225097).
- Update
  patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch
  (git-fixes CVE-2024-36962 bsc#1225827).
- Update
  patches.suse/net-mlx5-Fix-peer-devlink-set-for-SF-representor-dev.patch
  (git-fixes CVE-2024-38595 bsc#1226741).
- Update
  patches.suse/net-mlx5e-Track-xmit-submission-to-PTP-WQ-after-popu.patch
  (jsc#PED-3311 CVE-2023-52782 bsc#1225103).
- Update
  patches.suse/net-mvneta-fix-calls-to-page_pool_get_stats.patch
  (git-fixes CVE-2023-52780 bsc#1224933).
- Update
  patches.suse/net-wangxun-fix-kernel-panic-due-to-null-pointer.patch
  (git-fixes CVE-2023-52783 bsc#1225104).
- Update
  patches.suse/netfilter-complete-validation-of-user-input.patch
  (git-fixes CVE-2024-35896 bsc#1224662 CVE-2024-35962
  bsc#1224583).
- Update
  patches.suse/nfc-nci-Fix-uninit-value-in-nci_rx_work.patch
  (git-fixes CVE-2024-38381 bsc#1226878).
- Update
  patches.suse/nilfs2-fix-nilfs_empty_dir-misjudgment-and-long-loop.patch
  (git-fixes CVE-2024-39469 bsc#1226992).
- Update
  patches.suse/nilfs2-fix-potential-hang-in-nilfs_detach_log_writer.patch
  (git-fixes CVE-2024-38582 bsc#1226658).
- Update
  patches.suse/nilfs2-fix-use-after-free-of-timer-for-log-writer-th.patch
  (git-fixes CVE-2024-38583 bsc#1226777).
- Update
  patches.suse/of-module-add-buffer-overflow-check-in-of_modalias.patch
  (git-fixes CVE-2024-38541 bsc#1226587).
- Update
  patches.suse/padata-Fix-refcnt-handling-in-padata_free_shell.patch
  (git-fixes CVE-2023-52854 bsc#1225584).
- Update
  patches.suse/perf-core-Bail-out-early-if-the-request-AUX-area-is-out-of-bound.patch
  (git-fixes CVE-2023-52835 bsc#1225602).
- Update
  patches.suse/platform-x86-wmi-Fix-opening-of-char-device.patch
  (git-fixes CVE-2023-52864 bsc#1225132).
- Update
  patches.suse/powerpc-pseries-iommu-LPAR-panics-during-boot-up-wit.patch
  (bsc#1222011 ltc#205900 CVE-2024-36926 bsc#1225829).
- Update patches.suse/pstore-platform-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52869 bsc#1225050).
- Update
  patches.suse/remoteproc-mediatek-Make-sure-IPI-buffer-fits-in-L2T.patch
  (git-fixes CVE-2024-36965 bsc#1226149).
- Update
  patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch
  (git-fixes CVE-2024-38601 bsc#1226876).
- Update
  patches.suse/s390-dasd-protect-device-queue-against-concurrent-access.patch
  (git-fixes bsc#1217481 CVE-2023-52774 bsc#1225572).
- Update
  patches.suse/scsi-hisi_sas-Set-debugfs_dir-pointer-to-NULL-after-removing-debugfs.patch
  (git-fixes CVE-2023-52808 bsc#1225555).
- Update
  patches.suse/scsi-ibmvfc-Remove-BUG_ON-in-the-case-of-an-empty-ev.patch
  (bsc#1209834 ltc#202097 CVE-2023-52811 bsc#1225559).
- Update
  patches.suse/scsi-libfc-Fix-potential-NULL-pointer-dereference-in-fc_lport_ptp_setup.patch
  (git-fixes CVE-2023-52809 bsc#1225556).
- Update
  patches.suse/scsi-lpfc-Move-NPIV-s-transport-unregistration-to-af.patch
  (bsc#1221777 CVE-2024-36952 bsc#1225898).
- Update
  patches.suse/scsi-lpfc-Release-hbalock-before-calling-lpfc_worker.patch
  (bsc#1221777 CVE-2024-36924 bsc#1225820).
- Update
  patches.suse/serial-max3100-Lock-port-lock-when-calling-uart_hand.patch
  (git-fixes CVE-2024-38634 bsc#1226868).
- Update
  patches.suse/serial-max3100-Update-uart_driver_registered-on-driv.patch
  (git-fixes CVE-2024-38633 bsc#1226867).
- Update
  patches.suse/soc-qcom-llcc-Handle-a-second-device-without-data-co.patch
  (git-fixes CVE-2023-52871 bsc#1225534).
- Update
  patches.suse/soundwire-cadence-fix-invalid-PDI-offset.patch
  (stable-fixes CVE-2024-38635 bsc#1226863).
- Update patches.suse/speakup-Fix-sizeof-vs-ARRAY_SIZE-bug.patch
  (git-fixes CVE-2024-38587 bsc#1226780).
- Update patches.suse/spi-Fix-null-dereference-on-suspend.patch
  (git-fixes CVE-2023-52749 bsc#1225476).
- Update
  patches.suse/thermal-core-prevent-potential-string-overflow.patch
  (git-fixes CVE-2023-52868 bsc#1225044).
- Update
  patches.suse/thermal-drivers-qcom-lmh-Check-for-SCM-availability-.patch
  (git-fixes CVE-2024-39466 bsc#1227089).
- Update
  patches.suse/thermal-drivers-tsens-Fix-null-pointer-dereference.patch
  (git-fixes CVE-2024-38571 bsc#1226737).
- Update
  patches.suse/thermal-intel-powerclamp-fix-mismatch-in-get-functio.patch
  (git-fixes CVE-2023-52794 bsc#1225028).
- Update
  patches.suse/tls-fix-NULL-deref-on-tls_sw_splice_eof-with-empty-r.patch
  (jsc#PED-6831 CVE-2023-52767 bsc#1224998).
- Update
  patches.suse/tpm_tis_spi-Account-for-SPI-header-when-allocating-T.patch
  (git-fixes CVE-2024-36477 bsc#1226840).
- Update
  patches.suse/tracing-Have-trace_event_file-have-ref-counters.patch
  (git-fixes CVE-2023-52879 bsc#1225101).
- Update
  patches.suse/tracing-trigger-Fix-to-return-error-if-failed-to-alloc-snapshot.patch
  (git-fixes CVE-2024-26920).
- Update
  patches.suse/tty-n_gsm-fix-race-condition-in-status-line-change-o.patch
  (git-fixes CVE-2023-52872 bsc#1225591).
- Update
  patches.suse/tty-n_gsm-require-CAP_NET_ADMIN-to-attach-N_GSM0710-.patch
  (bsc#1222619 CVE-2023-52880).
- Update
  patches.suse/tty-vcc-Add-check-for-kstrdup-in-vcc_probe.patch
  (git-fixes CVE-2023-52789 bsc#1225180).
- Update
  patches.suse/usb-config-fix-iteration-issue-in-usb_get_bos_descri.patch
  (git-fixes CVE-2023-52781 bsc#1225092).
- Update
  patches.suse/usb-dwc3-Wait-unconditionally-after-issuing-EndXfer-.patch
  (git-fixes CVE-2024-36977 bsc#1226513).
- Update
  patches.suse/usb-gadget-u_audio-Fix-race-condition-use-of-control.patch
  (git-fixes CVE-2024-38628 bsc#1226911).
- Update
  patches.suse/usb-storage-alauda-Check-whether-the-media-is-initia.patch
  (git-fixes CVE-2024-38619 bsc#1226861).
- Update
  patches.suse/usb-typec-tcpm-Fix-NULL-pointer-dereference-in-tcpm_.patch
  (git-fixes CVE-2023-52877 bsc#1224944).
- Update
  patches.suse/vhost-vdpa-fix-use-after-free-in-vhost_vdpa_probe.patch
  (jsc#PED-3311 CVE-2023-52795 bsc#1225085).
- Update
  patches.suse/virtio-blk-fix-implicit-overflow-on-virtio_max_dma_s.patch
  (git-fixes CVE-2023-52762 bsc#1225573).
- Update
  patches.suse/virtio-vsock-Fix-uninit-value-in-virtio_transport_re.patch
  (jsc#PED-5505 CVE-2023-52842 bsc#1225025).
- Update
  patches.suse/watchdog-cpu5wdt.c-Fix-use-after-free-bug-caused-by-.patch
  (git-fixes CVE-2024-38630 bsc#1226908).
- Update
  patches.suse/wifi-ar5523-enable-proper-endpoint-verification.patch
  (git-fixes CVE-2024-38565 bsc#1226747).
- Update
  patches.suse/wifi-ath11k-fix-dfs-radar-event-locking.patch
  (git-fixes CVE-2023-52798 bsc#1224947).
- Update
  patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch
  (git-fixes CVE-2023-52777 bsc#1224992).
- Update patches.suse/wifi-ath11k-fix-htt-pktlog-locking.patch
  (git-fixes CVE-2023-52800).
- Update
  patches.suse/wifi-ath12k-fix-dfs-radar-and-temperature-event-lock.patch
  (git-fixes CVE-2023-52776 bsc#1225090).
- Update
  patches.suse/wifi-ath12k-fix-htt-mlo-offset-event-locking.patch
  (git-fixes CVE-2023-52769 bsc#1225001).
- Update
  patches.suse/wifi-ath12k-fix-out-of-bound-access-of-qmi_invoke_ha.patch
  (git-fixes CVE-2024-38572 bsc#1226776).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-read-in-ath12k.patch
  (git-fixes CVE-2023-52827 bsc#1225078).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-write-in-ath12.patch
  (git-fixes CVE-2023-52829 bsc#1225081).
- Update
  patches.suse/wifi-brcmfmac-pcie-handle-randbuf-allocation-failure.patch
  (git-fixes CVE-2024-38575 bsc#1226612).
- Update
  patches.suse/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch
  (git-fixes CVE-2024-38567 bsc#1226769).
- Update
  patches.suse/wifi-carl9170-re-fix-fortified-memset-warning.patch
  (git-fixes CVE-2024-38616 bsc#1226852).
- Update
  patches.suse/wifi-mac80211-don-t-return-unset-power-in-ieee80211_.patch
  (git-fixes CVE-2023-52832 bsc#1225577).
- Update
  patches.suse/wifi-nl80211-Avoid-address-calculations-via-out-of-b.patch
  (git-fixes CVE-2024-38562 bsc#1226788).
- Update
  patches.suse/wifi-wilc1000-use-vmm_table-as-array-in-wilc-struct.patch
  (git-fixes CVE-2023-52768 bsc#1225004).
- Update
  patches.suse/x86-tdx-Zero-out-the-missing-RSI-in-TDX_HYPERCALL-macro.patch
  (jsc#PED-5824 CVE-2023-52874 bsc#1225049).
- commit 33efdc4</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835204">- tcp: Use refcount_inc_not_zero() in tcp_twsk_unique()
  (CVE-2024-36904 bsc#1225732).
- commit d578dcc</changelog>
  <changelog author="heming.zhao@suse.com" date="1719921600">- gfs2: Fix potential glock use-after-free on unmount (bsc#1226775
  CVE-2024-38570).
- gfs2: Rename sd_{ glock =&gt; kill }_wait (bsc#1226775
  CVE-2024-38570).
- commit f3adbca</changelog>
  <changelog author="tiwai@suse.de" date="1719921601">- Correct SCSI patch references (bsc#1225767 CVE-2024-36919 bsc#1226785 CVE-2024-38559)
- commit e8ea587</changelog>
  <changelog author="tiwai@suse.de" date="1719921602">- mtd: rawnand: rockchip: ensure NVDDR timings are rejected
  (git-fixes).
- mtd: rawnand: Bypass a couple of sanity checks during NAND
  identification (git-fixes).
- mtd: rawnand: Fix the nand_read_data_op() early check
  (git-fixes).
- mtd: rawnand: Ensure ECC configuration is propagated to upper
  layers (git-fixes).
- commit e545951</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1719921603">- kernel-doc: fix struct_group_tagged() parsing (git-fixes).
- commit e3a2a2e</changelog>
  <changelog author="fdmanana@suse.com" date="1719921604">- btrfs: fix crash on racing fsync and size-extending write into
  prealloc (bsc#1227101 CVE-2024-37354).
- commit 1d355af</changelog>
  <changelog author="vbabka@suse.cz" date="1719921605">- virt: acrn: stop using follow_pfn (CVE-2024-38610 bsc#1226758).
- commit c2ea51b</changelog>
  <changelog author="vbabka@suse.cz" date="1719921606">- drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
  (CVE-2024-38610 bsc#1226758).
- commit 7069ac2</changelog>
  <changelog author="rhopkins@suse.de" date="1719921607">- hsr: Prevent use after free in prp_create_tagged_frame()
  (CVE-2023-52846 bsc#1225098).
- commit cf63988</changelog>
  <changelog author="krisman@suse.de" date="1719921608">- io_uring: Fix io_cqring_wait() not restoring sigmask on
  get_timespec64() failure (git-fixes).
- commit e640a65</changelog>
  <changelog author="krisman@suse.de" date="1719921609">- io_uring: check for non-NULL file pointer in io_file_can_poll()
  (bsc#1226990 CVE-2024-39371).
- io_uring/io-wq: Use set_bit() and test_bit() at worker-&gt;flags
  (git-fixes).
- io_uring/sqpoll: work around a potential audit memory leak
  (git-fixes).
- commit 24603fc</changelog>
  <changelog author="krisman@suse.de" date="1719921610">- io_uring/rsrc: fix incorrect assignment of iter-&gt;nr_segs in
  io_import_fixed (git-fixes).
- io_uring/rsrc: don't lock while !TASK_RUNNING (git-fixes).
- io_uring/io-wq: avoid garbage value of 'match' in
  io_wq_enqueue() (git-fixes).
- commit 7d3e252</changelog>
</package>
<package pkgid="936dad8f61571a10f95f4e16e81481d28a3a564ef67a8c2d7bff67492ca3f316" name="dlm-kmp-default" arch="ppc64le">
  <version epoch="0" ver="6.4.0" rel="150600.23.14.2"/>
  <changelog author="tiwai@suse.de" date="1719662400">- gpiolib: cdev: Disallow reconfiguration without direction
  (uAPI v1) (git-fixes).
- gpio: davinci: Validate the obtained number of IRQs (git-fixes).
- commit 919ebd1</changelog>
  <changelog author="tiwai@suse.de" date="1719748800">- i2c: testunit: discard write requests while old command is
  running (git-fixes).
- i2c: testunit: don't erase registers after STOP (git-fixes).
- mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
  (git-fixes).
- mmc: sdhci: Do not invert write-protect twice (git-fixes).
- mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
  (git-fixes).
- mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
  (git-fixes).
- commit 448487d</changelog>
  <changelog author="tiwai@suse.de" date="1719748801">- crypto: iaa - Account for cpu-less numa nodes (bsc#1227190).
- commit cd600aa</changelog>
  <changelog author="tiwai@suse.de" date="1719748802">- crypto: deflate - Add aliases to deflate (bsc#1227190).
- commit 27ffd92</changelog>
  <changelog author="tiwai@suse.de" date="1719835200">- ata: ahci: Clean up sysfs file on error (git-fixes).
- ata: libata-core: Fix double free on error (git-fixes).
- ata,scsi: libata-core: Do not leak memory for ata_port struct
  members (git-fixes).
- ata: libata-core: Fix null pointer dereference on error
  (git-fixes).
- kbuild: Fix build target deb-pkg: ln: failed to create hard link
  (git-fixes).
- kbuild: doc: Update default INSTALL_MOD_DIR from extra to
  updates (git-fixes).
- kbuild: Install dtb files as 0644 in Makefile.dtbinst
  (git-fixes).
- counter: ti-eqep: enable clock at probe (git-fixes).
- iio: chemical: bme680: Fix sensor data read operation
  (git-fixes).
- iio: chemical: bme680: Fix overflows in compensate() functions
  (git-fixes).
- iio: chemical: bme680: Fix calibration data variable
  (git-fixes).
- iio: chemical: bme680: Fix pressure value output (git-fixes).
- iio: accel: fxls8962af: select IIO_BUFFER &amp; IIO_KFIFO_BUF
  (git-fixes).
- iio: adc: ad7266: Fix variable checking bug (git-fixes).
- iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
  (git-fixes).
- serial: bcm63xx-uart: fix tx after conversion to
  uart_port_tx_limited() (git-fixes).
- serial: core: introduce uart_port_tx_limited_flags()
  (git-fixes).
- Revert "serial: core: only stop transmit when HW fifo is empty"
  (git-fixes).
- tty: mcf: MCF54418 has 10 UARTS (git-fixes).
- usb: gadget: aspeed_udc: fix device address configuration
  (git-fixes).
- usb: dwc3: core: remove lock of otg mode during gadget
  suspend/resume to avoid deadlock (git-fixes).
- usb: typec: ucsi: glink: fix child node release in probe
  function (git-fixes).
- usb: musb: da8xx: fix a resource leak in probe() (git-fixes).
- usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  (git-fixes).
- usb: gadget: printer: fix races against disable (git-fixes).
- PCI/MSI: Fix UAF in msi_capability_init (git-fixes).
- commit a2ea5a9</changelog>
  <changelog author="ptesarik@suse.com" date="1719835201">- net: ena: Fix redundant device NUMA node override
  (jsc#PED-8688).
- commit 6ad6684</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835202">- tcp: do not accept ACK of bytes we never sent (CVE-2023-52881
  bsc#1225611).
- commit 16404a6</changelog>
  <changelog author="mhocko@suse.com" date="1719835203">- Update
  patches.suse/1352-drm-amdgpu-Fix-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52883
  bsc#1226630).
- Update
  patches.suse/9p-add-missing-locking-around-taking-dentry-fid-list.patch
  (git-fixes CVE-2024-39463 bsc#1227090).
- Update
  patches.suse/ALSA-Fix-deadlocks-with-kctl-removals-at-disconnecti.patch
  (stable-fixes CVE-2024-38600 bsc#1226864).
- Update
  patches.suse/ALSA-core-Fix-NULL-module-pointer-assignment-at-card.patch
  (git-fixes CVE-2024-38605 bsc#1226740).
- Update
  patches.suse/ALSA-hda-Fix-possible-null-ptr-deref-when-assigning-.patch
  (git-fixes CVE-2023-52806 bsc#1225554).
- Update
  patches.suse/ALSA-hda-cs_dsp_ctl-Use-private_free-for-control-cle.patch
  (git-fixes CVE-2024-38388 bsc#1226890).
- Update
  patches.suse/ALSA-timer-Set-lower-bound-of-start-tick-time.patch
  (stable-fixes git-fixes CVE-2024-38618 bsc#1226754).
- Update
  patches.suse/ASoC-kirkwood-Fix-potential-NULL-dereference.patch
  (git-fixes CVE-2024-38550 bsc#1226633).
- Update
  patches.suse/ASoC-mediatek-Assign-dummy-when-codec-not-specified-.patch
  (git-fixes CVE-2024-38551 bsc#1226761).
- Update
  patches.suse/Bluetooth-btusb-Add-date-evt_skb-is-NULL-check.patch
  (git-fixes CVE-2023-52833 bsc#1225595).
- Update
  patches.suse/Bluetooth-hci_core-Fix-possible-buffer-overflow.patch
  (git-fixes CVE-2024-26889).
- Update
  patches.suse/HID-uclogic-Fix-user-memory-access-bug-in-uclogic_pa.patch
  (git-fixes CVE-2023-52866 bsc#1225120).
- Update
  patches.suse/IB-mlx5-Fix-init-stage-error-handling-to-avoid-doubl.patch
  (jsc#PED-6864 CVE-2023-52851 bsc#1225587).
- Update
  patches.suse/Input-cyapa-add-missing-input-core-locking-to-suspen.patch
  (git-fixes CVE-2023-52884 bsc#1226764).
- Update
  patches.suse/Input-synaptics-rmi4-fix-use-after-free-in-rmi_unreg.patch
  (git-fixes CVE-2023-52840 bsc#1224928).
- Update
  patches.suse/KEYS-trusted-Do-not-use-WARN-when-encode-fails.patch
  (git-fixes CVE-2024-36975 bsc#1226520).
- Update
  patches.suse/KEYS-trusted-Fix-memory-leak-in-tpm2_key_encode.patch
  (git-fixes CVE-2024-36967 bsc#1226131).
- Update
  patches.suse/RDMA-cma-Fix-kmemleak-in-rdma_core-observed-during-b.patch
  (git-fixes CVE-2024-38539 bsc#1226608).
- Update patches.suse/RDMA-hns-Fix-UAF-for-cq-async-event.patch
  (git-fixes CVE-2024-38545 bsc#1226595).
- Update
  patches.suse/RDMA-hns-Fix-deadlock-on-SRQ-async-events.patch
  (git-fixes CVE-2024-38591 bsc#1226738).
- Update
  patches.suse/RDMA-hns-Modify-the-print-level-of-CQE-error.patch
  (git-fixes CVE-2024-38590 bsc#1226839).
- Update
  patches.suse/RDMA-rxe-Fix-seg-fault-in-rxe_comp_queue_pkt.patch
  (git-fixes CVE-2024-38544 bsc#1226597).
- Update
  patches.suse/SUNRPC-Fix-RPC-client-cleaned-up-the-freed-pipefs-de.patch
  (git-fixes CVE-2023-52803 bsc#1225008).
- Update patches.suse/af_unix-Clear-stale-u-oob_skb.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-35970 bsc#1224584).
- Update
  patches.suse/af_unix-Drop-oob_skb-ref-before-purging-queue-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26750 bsc#1222617).
- Update
  patches.suse/af_unix-Fix-task-hung-while-purging-oob_skb-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26780 bsc#1222588).
- Update
  patches.suse/af_unix-Update-unix_sk-sk-oob_skb-under-sk_receive_queue-lock.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-36972 bsc#1226163).
- Update
  patches.suse/arm64-Restrict-CPU_BIG_ENDIAN-to-GNU-as-or-LLVM-IAS-.patch
  (git-fixes CVE-2023-52750 bsc#1225485).
- Update
  patches.suse/atl1c-Work-around-the-DMA-RX-overflow-issue.patch
  (git-fixes CVE-2023-52834 bsc#1225599).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issue-of-net_device.patch
  (git-fixes CVE-2024-38554 bsc#1226742).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issues-of-ax25_dev.patch
  (git-fixes CVE-2024-38602 bsc#1226613).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-reorder-of-WRITE-lqueued.patch
  (bsc#1225605 CVE-2024-38384 bsc#1226938).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-resetting-io-stat.patch
  (bsc#1225605 CVE-2024-38663 bsc#1226939).
- Update
  patches.suse/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch
  (git-fixes CVE-2024-38540 bsc#1226582).
- Update
  patches.suse/bonding-stop-the-device-in-bond_setup_by_slave.patch
  (git-fixes CVE-2023-52784 bsc#1224946).
- Update
  patches.suse/can-dev-can_put_echo_skb-don-t-crash-kernel-if-can_p.patch
  (git-fixes CVE-2023-52878 bsc#1225000).
- Update
  patches.suse/clk-mediatek-clk-mt2701-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52875 bsc#1225096).
- Update
  patches.suse/clk-mediatek-clk-mt6765-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52870 bsc#1224937).
- Update
  patches.suse/clk-mediatek-clk-mt6779-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52873 bsc#1225589).
- Update
  patches.suse/clk-mediatek-clk-mt6797-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52865 bsc#1225086).
- Update
  patches.suse/clk-mediatek-clk-mt7629-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52858 bsc#1225566).
- Update
  patches.suse/clk-mediatek-clk-mt7629-eth-Add-check-for-mtk_alloc_.patch
  (git-fixes CVE-2023-52876 bsc#1225036).
- Update
  patches.suse/cppc_cpufreq-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38573 bsc#1226739).
- Update patches.suse/cpufreq-exit-callback-is-optional.patch
  (git-fixes CVE-2024-38615 bsc#1226592).
- Update patches.suse/crypto-bcm-Fix-pointer-arithmetic.patch
  (git-fixes CVE-2024-38579 bsc#1226637).
- Update
  patches.suse/crypto-pcrypt-Fix-hungtask-for-PADATA_RESET.patch
  (git-fixes CVE-2023-52813 bsc#1225527).
- Update patches.suse/cxl-mem-Fix-shutdown-order.patch (git-fixes
  CVE-2023-52849 bsc#1224949).
- Update
  patches.suse/cxl-region-Do-not-try-to-cleanup-after-cxl_region_se.patch
  (git-fixes CVE-2023-52792 bsc#1225477).
- Update patches.suse/cxl-region-Fix-cxlr_pmem-leaks.patch
  (git-fixes CVE-2024-38391 bsc#1226894).
- Update
  patches.suse/dma-buf-sw-sync-don-t-enable-IRQ-from-sync_print_obj.patch
  (git-fixes CVE-2024-38780 bsc#1226886).
- Update
  patches.suse/dma-mapping-benchmark-fix-node-id-validation.patch
  (git-fixes CVE-2024-34777 bsc#1226796).
- Update
  patches.suse/dma-mapping-benchmark-handle-NUMA_NO_NODE-correctly.patch
  (git-fixes CVE-2024-39277 bsc#1226909).
- Update
  patches.suse/dmaengine-idxd-Avoid-unnecessary-destruction-of-file.patch
  (git-fixes CVE-2024-38629 bsc#1226905).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Pola.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52819
  bsc#1225532).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-SMU7.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52818
  bsc#1225530).
- Update
  patches.suse/drm-amd-check-num-of-link-levels-when-update-pcie-pa.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52812
  bsc#1225564).
- Update
  patches.suse/drm-amd-display-Avoid-NULL-dereference-of-timing-gen.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52753
  bsc#1225478).
- Update
  patches.suse/drm-amd-display-Fix-division-by-zero-in-setup_dsc_co.patch
  (stable-fixes CVE-2024-36969 bsc#1226155).
- Update
  patches.suse/drm-amd-display-Fix-null-pointer-dereference-in-erro.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52862
  bsc#1225015).
- Update
  patches.suse/drm-amd-display-Fix-potential-index-out-of-bounds-in.patch
  (git-fixes CVE-2024-38552 bsc#1226767).
- Update
  patches.suse/drm-amd-display-fix-a-NULL-pointer-dereference-in-am.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52773
  bsc#1225041).
- Update
  patches.suse/drm-amd-display-fixed-integer-types-and-null-check-l.patch
  (git-fixes CVE-2024-26767).
- Update
  patches.suse/drm-amdgpu-Fix-a-null-pointer-access-when-the-smc_rr.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52817
  bsc#1225569).
- Update
  patches.suse/drm-amdgpu-Fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch
  (git-fixes CVE-2024-39291 bsc#1226934).
- Update
  patches.suse/drm-amdgpu-Fix-potential-null-pointer-derefernce.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52814
  bsc#1225565).
- Update
  patches.suse/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch
  (stable-fixes CVE-2024-39471 bsc#1227096).
- Update
  patches.suse/drm-amdgpu-mes-fix-use-after-free-issue.patch
  (stable-fixes CVE-2024-38581 bsc#1226657).
- Update
  patches.suse/drm-amdgpu-vkms-fix-a-possible-null-pointer-derefere.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52815
  bsc#1225568).
- Update
  patches.suse/drm-amdkfd-Fix-a-race-condition-of-vram-buffer-unref.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52825
  bsc#1225076).
- Update
  patches.suse/drm-amdkfd-Fix-shift-out-of-bounds-issue.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52816
  bsc#1225529).
- Update
  patches.suse/drm-bridge-cdns-mhdp8546-Fix-possible-null-pointer-d.patch
  (git-fixes CVE-2024-38548).
- Update
  patches.suse/drm-bridge-it66121-Fix-invalid-connector-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52861
  bsc#1224941).
- Update
  patches.suse/drm-bridge-lt8912b-Fix-crash-on-bridge-detach.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52856
  bsc#1224932).
- Update
  patches.suse/drm-mediatek-Add-0-size-check-to-mtk_drm_gem_obj.patch
  (git-fixes CVE-2024-38549 bsc#1226735).
- Update
  patches.suse/drm-mediatek-Fix-coverity-issue-with-unintentional-i.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52857
  bsc#1225581).
- Update
  patches.suse/drm-mediatek-Init-ddp_comp-with-devm_kcalloc.patch
  (git-fixes CVE-2024-38592 bsc#1226844).
- Update
  patches.suse/drm-msm-a6xx-Avoid-a-nullptr-dereference-when-speedb.patch
  (git-fixes CVE-2024-38390 bsc#1226891).
- Update
  patches.suse/drm-msm-dpu-Add-callback-function-pointer-check-befo.patch
  (git-fixes CVE-2024-38622 bsc#1226856).
- Update
  patches.suse/drm-panel-fix-a-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52821
  bsc#1225022).
- Update
  patches.suse/drm-panel-panel-tpo-tpg110-fix-a-possible-null-point.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52826
  bsc#1225077).
- Update patches.suse/drm-radeon-possible-buffer-overflow.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52867
  bsc#1225009).
- Update
  patches.suse/drm-vc4-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38546 bsc#1226593).
- Update
  patches.suse/drm-vmwgfx-Fix-invalid-reads-in-fence-signaled-event.patch
  (git-fixes CVE-2024-36960 bsc#1225872).
- Update
  patches.suse/drm-zynqmp_dpsub-Always-register-bridge.patch
  (git-fixes CVE-2024-38664 bsc#1226941).
- Update
  patches.suse/e1000e-change-usleep_range-to-udelay-in-PHY-mdic-acc.patch
  (CVE-2024-39296 bsc#1226989 CVE-2024-36887 bsc#1225731).
- Update
  patches.suse/ecryptfs-Fix-buffer-size-for-tag-66-packet.patch
  (git-fixes CVE-2024-38578 bsc#1226634).
- Update
  patches.suse/efi-libstub-only-free-priv.runtime_map-when-allocate.patch
  (git-fixes CVE-2024-33619 bsc#1226768).
- Update
  patches.suse/fbdev-imsttfb-fix-a-resource-leak-in-probe.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52838
  bsc#1225031).
- Update
  patches.suse/fs-9p-only-translate-RWX-permissions-for-plain-9P200.patch
  (git-fixes CVE-2024-36964 bsc#1225866).
- Update
  patches.suse/fs-jfs-Add-check-for-negative-db_l2nbperpage.patch
  (git-fixes CVE-2023-52810 bsc#1225557).
- Update
  patches.suse/fs-jfs-Add-validity-check-for-db_maxag-and-db_agpref.patch
  (git-fixes CVE-2023-52804 bsc#1225550).
- Update
  patches.suse/ftrace-Fix-possible-use-after-free-issue-in-ftrace_location.patch
  (git-fixes CVE-2024-38588 bsc#1226837).
- Update
  patches.suse/genirq-irqdesc-Prevent-use-after-free-in-irq_find_at.patch
  (git-fixes CVE-2024-38385 bsc#1227085).
- Update patches.suse/gfs2-ignore-negated-quota-changes.patch
  (git-fixes CVE-2023-52759 bsc#1225560).
- Update
  patches.suse/hid-cp2112-Fix-duplicate-workqueue-initialization.patch
  (git-fixes CVE-2023-52853 bsc#1224988).
- Update
  patches.suse/hwmon-axi-fan-control-Fix-possible-NULL-pointer-dere.patch
  (git-fixes CVE-2023-52863 bsc#1225586).
- Update
  patches.suse/i2c-acpi-Unbind-mux-adapters-before-delete.patch
  (git-fixes CVE-2024-39362 bsc#1226995).
- Update
  patches.suse/i2c-core-Run-atomic-i2c-xfer-when-preemptible.patch
  (git-fixes CVE-2023-52791 bsc#1225108).
- Update
  patches.suse/i3c-master-mipi-i3c-hci-Fix-a-kernel-panic-for-acces.patch
  (git-fixes CVE-2023-52763 bsc#1225570).
- Update
  patches.suse/i3c-mipi-i3c-hci-Fix-out-of-bounds-access-in-hci_dma.patch
  (git-fixes CVE-2023-52766).
- Update
  patches.suse/i915-perf-Fix-NULL-deref-bugs-with-drm_dbg-calls.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52788
  bsc#1225106).
- Update
  patches.suse/igb-Fix-string-truncation-warnings-in-igb_set_fw_ver.patch
  (git-fixes CVE-2024-36010 bsc#1225594).
- Update
  patches.suse/iommu-vt-d-Fix-WARN_ON-in-iommu-probe-path.patch
  (git-fixes CVE-2024-35957 bsc#1224673).
- Update
  patches.suse/iommufd-Fix-missing-update-of-domains_itree-after-splitting-iopt
  (jsc#PED-7779 jsc#PED-7780 CVE-2023-52801 bsc#1225006).
- Update
  patches.suse/ipvlan-add-ipvlan_route_v6_outbound-helper.patch
  (git-fixes CVE-2023-52796 bsc#1224930).
- Update
  patches.suse/jffs2-prevent-xattr-node-from-overflowing-the-eraseblock.patch
  (git-fixes CVE-2024-38599 bsc#1226848).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-dbFindLeaf.patch
  (git-fixes CVE-2023-52799 bsc#1225472).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-diAlloc.patch
  (git-fixes CVE-2023-52805 bsc#1225553).
- Update
  patches.suse/kunit-fortify-Fix-mismatched-kvalloc-vfree-usage.patch
  (git-fixes CVE-2024-38617 bsc#1226859).
- Update
  patches.suse/lib-generic-radix-tree.c-Don-t-overflow-in-peek.patch
  (git-fixes CVE-2021-47432 bsc#1225391).
- Update
  patches.suse/lib-test_hmm.c-handle-src_pfns-and-dst_pfns-allocati.patch
  (git-fixes CVE-2024-38543 bsc#1226594).
- Update
  patches.suse/locking-ww_mutex-test-Fix-potential-workqueue-corrup.patch
  (bsc#1219953 CVE-2023-52836 bsc#1225609).
- Update
  patches.suse/md-Don-t-ignore-suspended-array-in-md_check_recovery-1baa.patch
  (bsc#1219596 CVE-2024-26758).
- Update
  patches.suse/media-atomisp-ssh_css-Fix-a-null-pointer-dereference.patch
  (git-fixes CVE-2024-38547 bsc#1226632).
- Update
  patches.suse/media-bttv-fix-use-after-free-error-due-to-btv-timeo.patch
  (git-fixes CVE-2023-52847 bsc#1225588).
- Update
  patches.suse/media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch
  (git-fixes CVE-2023-52764 bsc#1225571).
- Update
  patches.suse/media-hantro-Check-whether-reset-op-is-defined-befor.patch
  (git-fixes CVE-2023-52850 bsc#1225014).
- Update
  patches.suse/media-i2c-et8ek8-Don-t-strip-remove-function-when-dr.patch
  (git-fixes CVE-2024-38611 bsc#1226760).
- Update
  patches.suse/media-imon-fix-access-to-invalid-resource-for-the-se.patch
  (git-fixes CVE-2023-52754 bsc#1225490).
- Update
  patches.suse/media-lgdt3306a-Add-a-check-against-null-pointer-def.patch
  (stable-fixes CVE-2022-48772 bsc#1226976).
- Update
  patches.suse/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch
  (git-fixes CVE-2024-38621 bsc#1226895).
- Update
  patches.suse/media-vidtv-mux-Add-check-and-kfree-for-kstrdup.patch
  (git-fixes CVE-2023-52841 bsc#1225592).
- Update patches.suse/media-vidtv-psi-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52844 bsc#1225590).
- Update
  patches.suse/mfd-qcom-spmi-pmic-Fix-revid-implementation.patch
  (git-fixes CVE-2023-52765 bsc#1225029).
- Update
  patches.suse/misc-microchip-pci1xxxx-fix-double-free-in-the-error.patch
  (git-fixes CVE-2024-36973 bsc#1226457).
- Update
  patches.suse/net-hns3-fix-out-of-bounds-access-may-occur-when-coa.patch
  (git-fixes CVE-2023-52807 bsc#1225097).
- Update
  patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch
  (git-fixes CVE-2024-36962 bsc#1225827).
- Update
  patches.suse/net-mlx5-Fix-peer-devlink-set-for-SF-representor-dev.patch
  (git-fixes CVE-2024-38595 bsc#1226741).
- Update
  patches.suse/net-mlx5e-Track-xmit-submission-to-PTP-WQ-after-popu.patch
  (jsc#PED-3311 CVE-2023-52782 bsc#1225103).
- Update
  patches.suse/net-mvneta-fix-calls-to-page_pool_get_stats.patch
  (git-fixes CVE-2023-52780 bsc#1224933).
- Update
  patches.suse/net-wangxun-fix-kernel-panic-due-to-null-pointer.patch
  (git-fixes CVE-2023-52783 bsc#1225104).
- Update
  patches.suse/netfilter-complete-validation-of-user-input.patch
  (git-fixes CVE-2024-35896 bsc#1224662 CVE-2024-35962
  bsc#1224583).
- Update
  patches.suse/nfc-nci-Fix-uninit-value-in-nci_rx_work.patch
  (git-fixes CVE-2024-38381 bsc#1226878).
- Update
  patches.suse/nilfs2-fix-nilfs_empty_dir-misjudgment-and-long-loop.patch
  (git-fixes CVE-2024-39469 bsc#1226992).
- Update
  patches.suse/nilfs2-fix-potential-hang-in-nilfs_detach_log_writer.patch
  (git-fixes CVE-2024-38582 bsc#1226658).
- Update
  patches.suse/nilfs2-fix-use-after-free-of-timer-for-log-writer-th.patch
  (git-fixes CVE-2024-38583 bsc#1226777).
- Update
  patches.suse/of-module-add-buffer-overflow-check-in-of_modalias.patch
  (git-fixes CVE-2024-38541 bsc#1226587).
- Update
  patches.suse/padata-Fix-refcnt-handling-in-padata_free_shell.patch
  (git-fixes CVE-2023-52854 bsc#1225584).
- Update
  patches.suse/perf-core-Bail-out-early-if-the-request-AUX-area-is-out-of-bound.patch
  (git-fixes CVE-2023-52835 bsc#1225602).
- Update
  patches.suse/platform-x86-wmi-Fix-opening-of-char-device.patch
  (git-fixes CVE-2023-52864 bsc#1225132).
- Update
  patches.suse/powerpc-pseries-iommu-LPAR-panics-during-boot-up-wit.patch
  (bsc#1222011 ltc#205900 CVE-2024-36926 bsc#1225829).
- Update patches.suse/pstore-platform-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52869 bsc#1225050).
- Update
  patches.suse/remoteproc-mediatek-Make-sure-IPI-buffer-fits-in-L2T.patch
  (git-fixes CVE-2024-36965 bsc#1226149).
- Update
  patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch
  (git-fixes CVE-2024-38601 bsc#1226876).
- Update
  patches.suse/s390-dasd-protect-device-queue-against-concurrent-access.patch
  (git-fixes bsc#1217481 CVE-2023-52774 bsc#1225572).
- Update
  patches.suse/scsi-hisi_sas-Set-debugfs_dir-pointer-to-NULL-after-removing-debugfs.patch
  (git-fixes CVE-2023-52808 bsc#1225555).
- Update
  patches.suse/scsi-ibmvfc-Remove-BUG_ON-in-the-case-of-an-empty-ev.patch
  (bsc#1209834 ltc#202097 CVE-2023-52811 bsc#1225559).
- Update
  patches.suse/scsi-libfc-Fix-potential-NULL-pointer-dereference-in-fc_lport_ptp_setup.patch
  (git-fixes CVE-2023-52809 bsc#1225556).
- Update
  patches.suse/scsi-lpfc-Move-NPIV-s-transport-unregistration-to-af.patch
  (bsc#1221777 CVE-2024-36952 bsc#1225898).
- Update
  patches.suse/scsi-lpfc-Release-hbalock-before-calling-lpfc_worker.patch
  (bsc#1221777 CVE-2024-36924 bsc#1225820).
- Update
  patches.suse/serial-max3100-Lock-port-lock-when-calling-uart_hand.patch
  (git-fixes CVE-2024-38634 bsc#1226868).
- Update
  patches.suse/serial-max3100-Update-uart_driver_registered-on-driv.patch
  (git-fixes CVE-2024-38633 bsc#1226867).
- Update
  patches.suse/soc-qcom-llcc-Handle-a-second-device-without-data-co.patch
  (git-fixes CVE-2023-52871 bsc#1225534).
- Update
  patches.suse/soundwire-cadence-fix-invalid-PDI-offset.patch
  (stable-fixes CVE-2024-38635 bsc#1226863).
- Update patches.suse/speakup-Fix-sizeof-vs-ARRAY_SIZE-bug.patch
  (git-fixes CVE-2024-38587 bsc#1226780).
- Update patches.suse/spi-Fix-null-dereference-on-suspend.patch
  (git-fixes CVE-2023-52749 bsc#1225476).
- Update
  patches.suse/thermal-core-prevent-potential-string-overflow.patch
  (git-fixes CVE-2023-52868 bsc#1225044).
- Update
  patches.suse/thermal-drivers-qcom-lmh-Check-for-SCM-availability-.patch
  (git-fixes CVE-2024-39466 bsc#1227089).
- Update
  patches.suse/thermal-drivers-tsens-Fix-null-pointer-dereference.patch
  (git-fixes CVE-2024-38571 bsc#1226737).
- Update
  patches.suse/thermal-intel-powerclamp-fix-mismatch-in-get-functio.patch
  (git-fixes CVE-2023-52794 bsc#1225028).
- Update
  patches.suse/tls-fix-NULL-deref-on-tls_sw_splice_eof-with-empty-r.patch
  (jsc#PED-6831 CVE-2023-52767 bsc#1224998).
- Update
  patches.suse/tpm_tis_spi-Account-for-SPI-header-when-allocating-T.patch
  (git-fixes CVE-2024-36477 bsc#1226840).
- Update
  patches.suse/tracing-Have-trace_event_file-have-ref-counters.patch
  (git-fixes CVE-2023-52879 bsc#1225101).
- Update
  patches.suse/tracing-trigger-Fix-to-return-error-if-failed-to-alloc-snapshot.patch
  (git-fixes CVE-2024-26920).
- Update
  patches.suse/tty-n_gsm-fix-race-condition-in-status-line-change-o.patch
  (git-fixes CVE-2023-52872 bsc#1225591).
- Update
  patches.suse/tty-n_gsm-require-CAP_NET_ADMIN-to-attach-N_GSM0710-.patch
  (bsc#1222619 CVE-2023-52880).
- Update
  patches.suse/tty-vcc-Add-check-for-kstrdup-in-vcc_probe.patch
  (git-fixes CVE-2023-52789 bsc#1225180).
- Update
  patches.suse/usb-config-fix-iteration-issue-in-usb_get_bos_descri.patch
  (git-fixes CVE-2023-52781 bsc#1225092).
- Update
  patches.suse/usb-dwc3-Wait-unconditionally-after-issuing-EndXfer-.patch
  (git-fixes CVE-2024-36977 bsc#1226513).
- Update
  patches.suse/usb-gadget-u_audio-Fix-race-condition-use-of-control.patch
  (git-fixes CVE-2024-38628 bsc#1226911).
- Update
  patches.suse/usb-storage-alauda-Check-whether-the-media-is-initia.patch
  (git-fixes CVE-2024-38619 bsc#1226861).
- Update
  patches.suse/usb-typec-tcpm-Fix-NULL-pointer-dereference-in-tcpm_.patch
  (git-fixes CVE-2023-52877 bsc#1224944).
- Update
  patches.suse/vhost-vdpa-fix-use-after-free-in-vhost_vdpa_probe.patch
  (jsc#PED-3311 CVE-2023-52795 bsc#1225085).
- Update
  patches.suse/virtio-blk-fix-implicit-overflow-on-virtio_max_dma_s.patch
  (git-fixes CVE-2023-52762 bsc#1225573).
- Update
  patches.suse/virtio-vsock-Fix-uninit-value-in-virtio_transport_re.patch
  (jsc#PED-5505 CVE-2023-52842 bsc#1225025).
- Update
  patches.suse/watchdog-cpu5wdt.c-Fix-use-after-free-bug-caused-by-.patch
  (git-fixes CVE-2024-38630 bsc#1226908).
- Update
  patches.suse/wifi-ar5523-enable-proper-endpoint-verification.patch
  (git-fixes CVE-2024-38565 bsc#1226747).
- Update
  patches.suse/wifi-ath11k-fix-dfs-radar-event-locking.patch
  (git-fixes CVE-2023-52798 bsc#1224947).
- Update
  patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch
  (git-fixes CVE-2023-52777 bsc#1224992).
- Update patches.suse/wifi-ath11k-fix-htt-pktlog-locking.patch
  (git-fixes CVE-2023-52800).
- Update
  patches.suse/wifi-ath12k-fix-dfs-radar-and-temperature-event-lock.patch
  (git-fixes CVE-2023-52776 bsc#1225090).
- Update
  patches.suse/wifi-ath12k-fix-htt-mlo-offset-event-locking.patch
  (git-fixes CVE-2023-52769 bsc#1225001).
- Update
  patches.suse/wifi-ath12k-fix-out-of-bound-access-of-qmi_invoke_ha.patch
  (git-fixes CVE-2024-38572 bsc#1226776).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-read-in-ath12k.patch
  (git-fixes CVE-2023-52827 bsc#1225078).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-write-in-ath12.patch
  (git-fixes CVE-2023-52829 bsc#1225081).
- Update
  patches.suse/wifi-brcmfmac-pcie-handle-randbuf-allocation-failure.patch
  (git-fixes CVE-2024-38575 bsc#1226612).
- Update
  patches.suse/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch
  (git-fixes CVE-2024-38567 bsc#1226769).
- Update
  patches.suse/wifi-carl9170-re-fix-fortified-memset-warning.patch
  (git-fixes CVE-2024-38616 bsc#1226852).
- Update
  patches.suse/wifi-mac80211-don-t-return-unset-power-in-ieee80211_.patch
  (git-fixes CVE-2023-52832 bsc#1225577).
- Update
  patches.suse/wifi-nl80211-Avoid-address-calculations-via-out-of-b.patch
  (git-fixes CVE-2024-38562 bsc#1226788).
- Update
  patches.suse/wifi-wilc1000-use-vmm_table-as-array-in-wilc-struct.patch
  (git-fixes CVE-2023-52768 bsc#1225004).
- Update
  patches.suse/x86-tdx-Zero-out-the-missing-RSI-in-TDX_HYPERCALL-macro.patch
  (jsc#PED-5824 CVE-2023-52874 bsc#1225049).
- commit 33efdc4</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835204">- tcp: Use refcount_inc_not_zero() in tcp_twsk_unique()
  (CVE-2024-36904 bsc#1225732).
- commit d578dcc</changelog>
  <changelog author="heming.zhao@suse.com" date="1719921600">- gfs2: Fix potential glock use-after-free on unmount (bsc#1226775
  CVE-2024-38570).
- gfs2: Rename sd_{ glock =&gt; kill }_wait (bsc#1226775
  CVE-2024-38570).
- commit f3adbca</changelog>
  <changelog author="tiwai@suse.de" date="1719921601">- Correct SCSI patch references (bsc#1225767 CVE-2024-36919 bsc#1226785 CVE-2024-38559)
- commit e8ea587</changelog>
  <changelog author="tiwai@suse.de" date="1719921602">- mtd: rawnand: rockchip: ensure NVDDR timings are rejected
  (git-fixes).
- mtd: rawnand: Bypass a couple of sanity checks during NAND
  identification (git-fixes).
- mtd: rawnand: Fix the nand_read_data_op() early check
  (git-fixes).
- mtd: rawnand: Ensure ECC configuration is propagated to upper
  layers (git-fixes).
- commit e545951</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1719921603">- kernel-doc: fix struct_group_tagged() parsing (git-fixes).
- commit e3a2a2e</changelog>
  <changelog author="fdmanana@suse.com" date="1719921604">- btrfs: fix crash on racing fsync and size-extending write into
  prealloc (bsc#1227101 CVE-2024-37354).
- commit 1d355af</changelog>
  <changelog author="vbabka@suse.cz" date="1719921605">- virt: acrn: stop using follow_pfn (CVE-2024-38610 bsc#1226758).
- commit c2ea51b</changelog>
  <changelog author="vbabka@suse.cz" date="1719921606">- drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
  (CVE-2024-38610 bsc#1226758).
- commit 7069ac2</changelog>
  <changelog author="rhopkins@suse.de" date="1719921607">- hsr: Prevent use after free in prp_create_tagged_frame()
  (CVE-2023-52846 bsc#1225098).
- commit cf63988</changelog>
  <changelog author="krisman@suse.de" date="1719921608">- io_uring: Fix io_cqring_wait() not restoring sigmask on
  get_timespec64() failure (git-fixes).
- commit e640a65</changelog>
  <changelog author="krisman@suse.de" date="1719921609">- io_uring: check for non-NULL file pointer in io_file_can_poll()
  (bsc#1226990 CVE-2024-39371).
- io_uring/io-wq: Use set_bit() and test_bit() at worker-&gt;flags
  (git-fixes).
- io_uring/sqpoll: work around a potential audit memory leak
  (git-fixes).
- commit 24603fc</changelog>
  <changelog author="krisman@suse.de" date="1719921610">- io_uring/rsrc: fix incorrect assignment of iter-&gt;nr_segs in
  io_import_fixed (git-fixes).
- io_uring/rsrc: don't lock while !TASK_RUNNING (git-fixes).
- io_uring/io-wq: avoid garbage value of 'match' in
  io_wq_enqueue() (git-fixes).
- commit 7d3e252</changelog>
</package>
<package pkgid="0a635f767aa17a63e1e39f213b60b9b3e5561a247fec9251882250c261902abf" name="dlm-kmp-default" arch="s390x">
  <version epoch="0" ver="6.4.0" rel="150600.23.14.2"/>
  <changelog author="tiwai@suse.de" date="1719662400">- gpiolib: cdev: Disallow reconfiguration without direction
  (uAPI v1) (git-fixes).
- gpio: davinci: Validate the obtained number of IRQs (git-fixes).
- commit 919ebd1</changelog>
  <changelog author="tiwai@suse.de" date="1719748800">- i2c: testunit: discard write requests while old command is
  running (git-fixes).
- i2c: testunit: don't erase registers after STOP (git-fixes).
- mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
  (git-fixes).
- mmc: sdhci: Do not invert write-protect twice (git-fixes).
- mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
  (git-fixes).
- mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
  (git-fixes).
- commit 448487d</changelog>
  <changelog author="tiwai@suse.de" date="1719748801">- crypto: iaa - Account for cpu-less numa nodes (bsc#1227190).
- commit cd600aa</changelog>
  <changelog author="tiwai@suse.de" date="1719748802">- crypto: deflate - Add aliases to deflate (bsc#1227190).
- commit 27ffd92</changelog>
  <changelog author="tiwai@suse.de" date="1719835200">- ata: ahci: Clean up sysfs file on error (git-fixes).
- ata: libata-core: Fix double free on error (git-fixes).
- ata,scsi: libata-core: Do not leak memory for ata_port struct
  members (git-fixes).
- ata: libata-core: Fix null pointer dereference on error
  (git-fixes).
- kbuild: Fix build target deb-pkg: ln: failed to create hard link
  (git-fixes).
- kbuild: doc: Update default INSTALL_MOD_DIR from extra to
  updates (git-fixes).
- kbuild: Install dtb files as 0644 in Makefile.dtbinst
  (git-fixes).
- counter: ti-eqep: enable clock at probe (git-fixes).
- iio: chemical: bme680: Fix sensor data read operation
  (git-fixes).
- iio: chemical: bme680: Fix overflows in compensate() functions
  (git-fixes).
- iio: chemical: bme680: Fix calibration data variable
  (git-fixes).
- iio: chemical: bme680: Fix pressure value output (git-fixes).
- iio: accel: fxls8962af: select IIO_BUFFER &amp; IIO_KFIFO_BUF
  (git-fixes).
- iio: adc: ad7266: Fix variable checking bug (git-fixes).
- iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
  (git-fixes).
- serial: bcm63xx-uart: fix tx after conversion to
  uart_port_tx_limited() (git-fixes).
- serial: core: introduce uart_port_tx_limited_flags()
  (git-fixes).
- Revert "serial: core: only stop transmit when HW fifo is empty"
  (git-fixes).
- tty: mcf: MCF54418 has 10 UARTS (git-fixes).
- usb: gadget: aspeed_udc: fix device address configuration
  (git-fixes).
- usb: dwc3: core: remove lock of otg mode during gadget
  suspend/resume to avoid deadlock (git-fixes).
- usb: typec: ucsi: glink: fix child node release in probe
  function (git-fixes).
- usb: musb: da8xx: fix a resource leak in probe() (git-fixes).
- usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  (git-fixes).
- usb: gadget: printer: fix races against disable (git-fixes).
- PCI/MSI: Fix UAF in msi_capability_init (git-fixes).
- commit a2ea5a9</changelog>
  <changelog author="ptesarik@suse.com" date="1719835201">- net: ena: Fix redundant device NUMA node override
  (jsc#PED-8688).
- commit 6ad6684</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835202">- tcp: do not accept ACK of bytes we never sent (CVE-2023-52881
  bsc#1225611).
- commit 16404a6</changelog>
  <changelog author="mhocko@suse.com" date="1719835203">- Update
  patches.suse/1352-drm-amdgpu-Fix-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52883
  bsc#1226630).
- Update
  patches.suse/9p-add-missing-locking-around-taking-dentry-fid-list.patch
  (git-fixes CVE-2024-39463 bsc#1227090).
- Update
  patches.suse/ALSA-Fix-deadlocks-with-kctl-removals-at-disconnecti.patch
  (stable-fixes CVE-2024-38600 bsc#1226864).
- Update
  patches.suse/ALSA-core-Fix-NULL-module-pointer-assignment-at-card.patch
  (git-fixes CVE-2024-38605 bsc#1226740).
- Update
  patches.suse/ALSA-hda-Fix-possible-null-ptr-deref-when-assigning-.patch
  (git-fixes CVE-2023-52806 bsc#1225554).
- Update
  patches.suse/ALSA-hda-cs_dsp_ctl-Use-private_free-for-control-cle.patch
  (git-fixes CVE-2024-38388 bsc#1226890).
- Update
  patches.suse/ALSA-timer-Set-lower-bound-of-start-tick-time.patch
  (stable-fixes git-fixes CVE-2024-38618 bsc#1226754).
- Update
  patches.suse/ASoC-kirkwood-Fix-potential-NULL-dereference.patch
  (git-fixes CVE-2024-38550 bsc#1226633).
- Update
  patches.suse/ASoC-mediatek-Assign-dummy-when-codec-not-specified-.patch
  (git-fixes CVE-2024-38551 bsc#1226761).
- Update
  patches.suse/Bluetooth-btusb-Add-date-evt_skb-is-NULL-check.patch
  (git-fixes CVE-2023-52833 bsc#1225595).
- Update
  patches.suse/Bluetooth-hci_core-Fix-possible-buffer-overflow.patch
  (git-fixes CVE-2024-26889).
- Update
  patches.suse/HID-uclogic-Fix-user-memory-access-bug-in-uclogic_pa.patch
  (git-fixes CVE-2023-52866 bsc#1225120).
- Update
  patches.suse/IB-mlx5-Fix-init-stage-error-handling-to-avoid-doubl.patch
  (jsc#PED-6864 CVE-2023-52851 bsc#1225587).
- Update
  patches.suse/Input-cyapa-add-missing-input-core-locking-to-suspen.patch
  (git-fixes CVE-2023-52884 bsc#1226764).
- Update
  patches.suse/Input-synaptics-rmi4-fix-use-after-free-in-rmi_unreg.patch
  (git-fixes CVE-2023-52840 bsc#1224928).
- Update
  patches.suse/KEYS-trusted-Do-not-use-WARN-when-encode-fails.patch
  (git-fixes CVE-2024-36975 bsc#1226520).
- Update
  patches.suse/KEYS-trusted-Fix-memory-leak-in-tpm2_key_encode.patch
  (git-fixes CVE-2024-36967 bsc#1226131).
- Update
  patches.suse/RDMA-cma-Fix-kmemleak-in-rdma_core-observed-during-b.patch
  (git-fixes CVE-2024-38539 bsc#1226608).
- Update patches.suse/RDMA-hns-Fix-UAF-for-cq-async-event.patch
  (git-fixes CVE-2024-38545 bsc#1226595).
- Update
  patches.suse/RDMA-hns-Fix-deadlock-on-SRQ-async-events.patch
  (git-fixes CVE-2024-38591 bsc#1226738).
- Update
  patches.suse/RDMA-hns-Modify-the-print-level-of-CQE-error.patch
  (git-fixes CVE-2024-38590 bsc#1226839).
- Update
  patches.suse/RDMA-rxe-Fix-seg-fault-in-rxe_comp_queue_pkt.patch
  (git-fixes CVE-2024-38544 bsc#1226597).
- Update
  patches.suse/SUNRPC-Fix-RPC-client-cleaned-up-the-freed-pipefs-de.patch
  (git-fixes CVE-2023-52803 bsc#1225008).
- Update patches.suse/af_unix-Clear-stale-u-oob_skb.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-35970 bsc#1224584).
- Update
  patches.suse/af_unix-Drop-oob_skb-ref-before-purging-queue-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26750 bsc#1222617).
- Update
  patches.suse/af_unix-Fix-task-hung-while-purging-oob_skb-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26780 bsc#1222588).
- Update
  patches.suse/af_unix-Update-unix_sk-sk-oob_skb-under-sk_receive_queue-lock.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-36972 bsc#1226163).
- Update
  patches.suse/arm64-Restrict-CPU_BIG_ENDIAN-to-GNU-as-or-LLVM-IAS-.patch
  (git-fixes CVE-2023-52750 bsc#1225485).
- Update
  patches.suse/atl1c-Work-around-the-DMA-RX-overflow-issue.patch
  (git-fixes CVE-2023-52834 bsc#1225599).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issue-of-net_device.patch
  (git-fixes CVE-2024-38554 bsc#1226742).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issues-of-ax25_dev.patch
  (git-fixes CVE-2024-38602 bsc#1226613).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-reorder-of-WRITE-lqueued.patch
  (bsc#1225605 CVE-2024-38384 bsc#1226938).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-resetting-io-stat.patch
  (bsc#1225605 CVE-2024-38663 bsc#1226939).
- Update
  patches.suse/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch
  (git-fixes CVE-2024-38540 bsc#1226582).
- Update
  patches.suse/bonding-stop-the-device-in-bond_setup_by_slave.patch
  (git-fixes CVE-2023-52784 bsc#1224946).
- Update
  patches.suse/can-dev-can_put_echo_skb-don-t-crash-kernel-if-can_p.patch
  (git-fixes CVE-2023-52878 bsc#1225000).
- Update
  patches.suse/clk-mediatek-clk-mt2701-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52875 bsc#1225096).
- Update
  patches.suse/clk-mediatek-clk-mt6765-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52870 bsc#1224937).
- Update
  patches.suse/clk-mediatek-clk-mt6779-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52873 bsc#1225589).
- Update
  patches.suse/clk-mediatek-clk-mt6797-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52865 bsc#1225086).
- Update
  patches.suse/clk-mediatek-clk-mt7629-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52858 bsc#1225566).
- Update
  patches.suse/clk-mediatek-clk-mt7629-eth-Add-check-for-mtk_alloc_.patch
  (git-fixes CVE-2023-52876 bsc#1225036).
- Update
  patches.suse/cppc_cpufreq-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38573 bsc#1226739).
- Update patches.suse/cpufreq-exit-callback-is-optional.patch
  (git-fixes CVE-2024-38615 bsc#1226592).
- Update patches.suse/crypto-bcm-Fix-pointer-arithmetic.patch
  (git-fixes CVE-2024-38579 bsc#1226637).
- Update
  patches.suse/crypto-pcrypt-Fix-hungtask-for-PADATA_RESET.patch
  (git-fixes CVE-2023-52813 bsc#1225527).
- Update patches.suse/cxl-mem-Fix-shutdown-order.patch (git-fixes
  CVE-2023-52849 bsc#1224949).
- Update
  patches.suse/cxl-region-Do-not-try-to-cleanup-after-cxl_region_se.patch
  (git-fixes CVE-2023-52792 bsc#1225477).
- Update patches.suse/cxl-region-Fix-cxlr_pmem-leaks.patch
  (git-fixes CVE-2024-38391 bsc#1226894).
- Update
  patches.suse/dma-buf-sw-sync-don-t-enable-IRQ-from-sync_print_obj.patch
  (git-fixes CVE-2024-38780 bsc#1226886).
- Update
  patches.suse/dma-mapping-benchmark-fix-node-id-validation.patch
  (git-fixes CVE-2024-34777 bsc#1226796).
- Update
  patches.suse/dma-mapping-benchmark-handle-NUMA_NO_NODE-correctly.patch
  (git-fixes CVE-2024-39277 bsc#1226909).
- Update
  patches.suse/dmaengine-idxd-Avoid-unnecessary-destruction-of-file.patch
  (git-fixes CVE-2024-38629 bsc#1226905).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Pola.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52819
  bsc#1225532).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-SMU7.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52818
  bsc#1225530).
- Update
  patches.suse/drm-amd-check-num-of-link-levels-when-update-pcie-pa.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52812
  bsc#1225564).
- Update
  patches.suse/drm-amd-display-Avoid-NULL-dereference-of-timing-gen.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52753
  bsc#1225478).
- Update
  patches.suse/drm-amd-display-Fix-division-by-zero-in-setup_dsc_co.patch
  (stable-fixes CVE-2024-36969 bsc#1226155).
- Update
  patches.suse/drm-amd-display-Fix-null-pointer-dereference-in-erro.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52862
  bsc#1225015).
- Update
  patches.suse/drm-amd-display-Fix-potential-index-out-of-bounds-in.patch
  (git-fixes CVE-2024-38552 bsc#1226767).
- Update
  patches.suse/drm-amd-display-fix-a-NULL-pointer-dereference-in-am.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52773
  bsc#1225041).
- Update
  patches.suse/drm-amd-display-fixed-integer-types-and-null-check-l.patch
  (git-fixes CVE-2024-26767).
- Update
  patches.suse/drm-amdgpu-Fix-a-null-pointer-access-when-the-smc_rr.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52817
  bsc#1225569).
- Update
  patches.suse/drm-amdgpu-Fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch
  (git-fixes CVE-2024-39291 bsc#1226934).
- Update
  patches.suse/drm-amdgpu-Fix-potential-null-pointer-derefernce.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52814
  bsc#1225565).
- Update
  patches.suse/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch
  (stable-fixes CVE-2024-39471 bsc#1227096).
- Update
  patches.suse/drm-amdgpu-mes-fix-use-after-free-issue.patch
  (stable-fixes CVE-2024-38581 bsc#1226657).
- Update
  patches.suse/drm-amdgpu-vkms-fix-a-possible-null-pointer-derefere.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52815
  bsc#1225568).
- Update
  patches.suse/drm-amdkfd-Fix-a-race-condition-of-vram-buffer-unref.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52825
  bsc#1225076).
- Update
  patches.suse/drm-amdkfd-Fix-shift-out-of-bounds-issue.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52816
  bsc#1225529).
- Update
  patches.suse/drm-bridge-cdns-mhdp8546-Fix-possible-null-pointer-d.patch
  (git-fixes CVE-2024-38548).
- Update
  patches.suse/drm-bridge-it66121-Fix-invalid-connector-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52861
  bsc#1224941).
- Update
  patches.suse/drm-bridge-lt8912b-Fix-crash-on-bridge-detach.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52856
  bsc#1224932).
- Update
  patches.suse/drm-mediatek-Add-0-size-check-to-mtk_drm_gem_obj.patch
  (git-fixes CVE-2024-38549 bsc#1226735).
- Update
  patches.suse/drm-mediatek-Fix-coverity-issue-with-unintentional-i.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52857
  bsc#1225581).
- Update
  patches.suse/drm-mediatek-Init-ddp_comp-with-devm_kcalloc.patch
  (git-fixes CVE-2024-38592 bsc#1226844).
- Update
  patches.suse/drm-msm-a6xx-Avoid-a-nullptr-dereference-when-speedb.patch
  (git-fixes CVE-2024-38390 bsc#1226891).
- Update
  patches.suse/drm-msm-dpu-Add-callback-function-pointer-check-befo.patch
  (git-fixes CVE-2024-38622 bsc#1226856).
- Update
  patches.suse/drm-panel-fix-a-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52821
  bsc#1225022).
- Update
  patches.suse/drm-panel-panel-tpo-tpg110-fix-a-possible-null-point.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52826
  bsc#1225077).
- Update patches.suse/drm-radeon-possible-buffer-overflow.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52867
  bsc#1225009).
- Update
  patches.suse/drm-vc4-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38546 bsc#1226593).
- Update
  patches.suse/drm-vmwgfx-Fix-invalid-reads-in-fence-signaled-event.patch
  (git-fixes CVE-2024-36960 bsc#1225872).
- Update
  patches.suse/drm-zynqmp_dpsub-Always-register-bridge.patch
  (git-fixes CVE-2024-38664 bsc#1226941).
- Update
  patches.suse/e1000e-change-usleep_range-to-udelay-in-PHY-mdic-acc.patch
  (CVE-2024-39296 bsc#1226989 CVE-2024-36887 bsc#1225731).
- Update
  patches.suse/ecryptfs-Fix-buffer-size-for-tag-66-packet.patch
  (git-fixes CVE-2024-38578 bsc#1226634).
- Update
  patches.suse/efi-libstub-only-free-priv.runtime_map-when-allocate.patch
  (git-fixes CVE-2024-33619 bsc#1226768).
- Update
  patches.suse/fbdev-imsttfb-fix-a-resource-leak-in-probe.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52838
  bsc#1225031).
- Update
  patches.suse/fs-9p-only-translate-RWX-permissions-for-plain-9P200.patch
  (git-fixes CVE-2024-36964 bsc#1225866).
- Update
  patches.suse/fs-jfs-Add-check-for-negative-db_l2nbperpage.patch
  (git-fixes CVE-2023-52810 bsc#1225557).
- Update
  patches.suse/fs-jfs-Add-validity-check-for-db_maxag-and-db_agpref.patch
  (git-fixes CVE-2023-52804 bsc#1225550).
- Update
  patches.suse/ftrace-Fix-possible-use-after-free-issue-in-ftrace_location.patch
  (git-fixes CVE-2024-38588 bsc#1226837).
- Update
  patches.suse/genirq-irqdesc-Prevent-use-after-free-in-irq_find_at.patch
  (git-fixes CVE-2024-38385 bsc#1227085).
- Update patches.suse/gfs2-ignore-negated-quota-changes.patch
  (git-fixes CVE-2023-52759 bsc#1225560).
- Update
  patches.suse/hid-cp2112-Fix-duplicate-workqueue-initialization.patch
  (git-fixes CVE-2023-52853 bsc#1224988).
- Update
  patches.suse/hwmon-axi-fan-control-Fix-possible-NULL-pointer-dere.patch
  (git-fixes CVE-2023-52863 bsc#1225586).
- Update
  patches.suse/i2c-acpi-Unbind-mux-adapters-before-delete.patch
  (git-fixes CVE-2024-39362 bsc#1226995).
- Update
  patches.suse/i2c-core-Run-atomic-i2c-xfer-when-preemptible.patch
  (git-fixes CVE-2023-52791 bsc#1225108).
- Update
  patches.suse/i3c-master-mipi-i3c-hci-Fix-a-kernel-panic-for-acces.patch
  (git-fixes CVE-2023-52763 bsc#1225570).
- Update
  patches.suse/i3c-mipi-i3c-hci-Fix-out-of-bounds-access-in-hci_dma.patch
  (git-fixes CVE-2023-52766).
- Update
  patches.suse/i915-perf-Fix-NULL-deref-bugs-with-drm_dbg-calls.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52788
  bsc#1225106).
- Update
  patches.suse/igb-Fix-string-truncation-warnings-in-igb_set_fw_ver.patch
  (git-fixes CVE-2024-36010 bsc#1225594).
- Update
  patches.suse/iommu-vt-d-Fix-WARN_ON-in-iommu-probe-path.patch
  (git-fixes CVE-2024-35957 bsc#1224673).
- Update
  patches.suse/iommufd-Fix-missing-update-of-domains_itree-after-splitting-iopt
  (jsc#PED-7779 jsc#PED-7780 CVE-2023-52801 bsc#1225006).
- Update
  patches.suse/ipvlan-add-ipvlan_route_v6_outbound-helper.patch
  (git-fixes CVE-2023-52796 bsc#1224930).
- Update
  patches.suse/jffs2-prevent-xattr-node-from-overflowing-the-eraseblock.patch
  (git-fixes CVE-2024-38599 bsc#1226848).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-dbFindLeaf.patch
  (git-fixes CVE-2023-52799 bsc#1225472).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-diAlloc.patch
  (git-fixes CVE-2023-52805 bsc#1225553).
- Update
  patches.suse/kunit-fortify-Fix-mismatched-kvalloc-vfree-usage.patch
  (git-fixes CVE-2024-38617 bsc#1226859).
- Update
  patches.suse/lib-generic-radix-tree.c-Don-t-overflow-in-peek.patch
  (git-fixes CVE-2021-47432 bsc#1225391).
- Update
  patches.suse/lib-test_hmm.c-handle-src_pfns-and-dst_pfns-allocati.patch
  (git-fixes CVE-2024-38543 bsc#1226594).
- Update
  patches.suse/locking-ww_mutex-test-Fix-potential-workqueue-corrup.patch
  (bsc#1219953 CVE-2023-52836 bsc#1225609).
- Update
  patches.suse/md-Don-t-ignore-suspended-array-in-md_check_recovery-1baa.patch
  (bsc#1219596 CVE-2024-26758).
- Update
  patches.suse/media-atomisp-ssh_css-Fix-a-null-pointer-dereference.patch
  (git-fixes CVE-2024-38547 bsc#1226632).
- Update
  patches.suse/media-bttv-fix-use-after-free-error-due-to-btv-timeo.patch
  (git-fixes CVE-2023-52847 bsc#1225588).
- Update
  patches.suse/media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch
  (git-fixes CVE-2023-52764 bsc#1225571).
- Update
  patches.suse/media-hantro-Check-whether-reset-op-is-defined-befor.patch
  (git-fixes CVE-2023-52850 bsc#1225014).
- Update
  patches.suse/media-i2c-et8ek8-Don-t-strip-remove-function-when-dr.patch
  (git-fixes CVE-2024-38611 bsc#1226760).
- Update
  patches.suse/media-imon-fix-access-to-invalid-resource-for-the-se.patch
  (git-fixes CVE-2023-52754 bsc#1225490).
- Update
  patches.suse/media-lgdt3306a-Add-a-check-against-null-pointer-def.patch
  (stable-fixes CVE-2022-48772 bsc#1226976).
- Update
  patches.suse/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch
  (git-fixes CVE-2024-38621 bsc#1226895).
- Update
  patches.suse/media-vidtv-mux-Add-check-and-kfree-for-kstrdup.patch
  (git-fixes CVE-2023-52841 bsc#1225592).
- Update patches.suse/media-vidtv-psi-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52844 bsc#1225590).
- Update
  patches.suse/mfd-qcom-spmi-pmic-Fix-revid-implementation.patch
  (git-fixes CVE-2023-52765 bsc#1225029).
- Update
  patches.suse/misc-microchip-pci1xxxx-fix-double-free-in-the-error.patch
  (git-fixes CVE-2024-36973 bsc#1226457).
- Update
  patches.suse/net-hns3-fix-out-of-bounds-access-may-occur-when-coa.patch
  (git-fixes CVE-2023-52807 bsc#1225097).
- Update
  patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch
  (git-fixes CVE-2024-36962 bsc#1225827).
- Update
  patches.suse/net-mlx5-Fix-peer-devlink-set-for-SF-representor-dev.patch
  (git-fixes CVE-2024-38595 bsc#1226741).
- Update
  patches.suse/net-mlx5e-Track-xmit-submission-to-PTP-WQ-after-popu.patch
  (jsc#PED-3311 CVE-2023-52782 bsc#1225103).
- Update
  patches.suse/net-mvneta-fix-calls-to-page_pool_get_stats.patch
  (git-fixes CVE-2023-52780 bsc#1224933).
- Update
  patches.suse/net-wangxun-fix-kernel-panic-due-to-null-pointer.patch
  (git-fixes CVE-2023-52783 bsc#1225104).
- Update
  patches.suse/netfilter-complete-validation-of-user-input.patch
  (git-fixes CVE-2024-35896 bsc#1224662 CVE-2024-35962
  bsc#1224583).
- Update
  patches.suse/nfc-nci-Fix-uninit-value-in-nci_rx_work.patch
  (git-fixes CVE-2024-38381 bsc#1226878).
- Update
  patches.suse/nilfs2-fix-nilfs_empty_dir-misjudgment-and-long-loop.patch
  (git-fixes CVE-2024-39469 bsc#1226992).
- Update
  patches.suse/nilfs2-fix-potential-hang-in-nilfs_detach_log_writer.patch
  (git-fixes CVE-2024-38582 bsc#1226658).
- Update
  patches.suse/nilfs2-fix-use-after-free-of-timer-for-log-writer-th.patch
  (git-fixes CVE-2024-38583 bsc#1226777).
- Update
  patches.suse/of-module-add-buffer-overflow-check-in-of_modalias.patch
  (git-fixes CVE-2024-38541 bsc#1226587).
- Update
  patches.suse/padata-Fix-refcnt-handling-in-padata_free_shell.patch
  (git-fixes CVE-2023-52854 bsc#1225584).
- Update
  patches.suse/perf-core-Bail-out-early-if-the-request-AUX-area-is-out-of-bound.patch
  (git-fixes CVE-2023-52835 bsc#1225602).
- Update
  patches.suse/platform-x86-wmi-Fix-opening-of-char-device.patch
  (git-fixes CVE-2023-52864 bsc#1225132).
- Update
  patches.suse/powerpc-pseries-iommu-LPAR-panics-during-boot-up-wit.patch
  (bsc#1222011 ltc#205900 CVE-2024-36926 bsc#1225829).
- Update patches.suse/pstore-platform-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52869 bsc#1225050).
- Update
  patches.suse/remoteproc-mediatek-Make-sure-IPI-buffer-fits-in-L2T.patch
  (git-fixes CVE-2024-36965 bsc#1226149).
- Update
  patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch
  (git-fixes CVE-2024-38601 bsc#1226876).
- Update
  patches.suse/s390-dasd-protect-device-queue-against-concurrent-access.patch
  (git-fixes bsc#1217481 CVE-2023-52774 bsc#1225572).
- Update
  patches.suse/scsi-hisi_sas-Set-debugfs_dir-pointer-to-NULL-after-removing-debugfs.patch
  (git-fixes CVE-2023-52808 bsc#1225555).
- Update
  patches.suse/scsi-ibmvfc-Remove-BUG_ON-in-the-case-of-an-empty-ev.patch
  (bsc#1209834 ltc#202097 CVE-2023-52811 bsc#1225559).
- Update
  patches.suse/scsi-libfc-Fix-potential-NULL-pointer-dereference-in-fc_lport_ptp_setup.patch
  (git-fixes CVE-2023-52809 bsc#1225556).
- Update
  patches.suse/scsi-lpfc-Move-NPIV-s-transport-unregistration-to-af.patch
  (bsc#1221777 CVE-2024-36952 bsc#1225898).
- Update
  patches.suse/scsi-lpfc-Release-hbalock-before-calling-lpfc_worker.patch
  (bsc#1221777 CVE-2024-36924 bsc#1225820).
- Update
  patches.suse/serial-max3100-Lock-port-lock-when-calling-uart_hand.patch
  (git-fixes CVE-2024-38634 bsc#1226868).
- Update
  patches.suse/serial-max3100-Update-uart_driver_registered-on-driv.patch
  (git-fixes CVE-2024-38633 bsc#1226867).
- Update
  patches.suse/soc-qcom-llcc-Handle-a-second-device-without-data-co.patch
  (git-fixes CVE-2023-52871 bsc#1225534).
- Update
  patches.suse/soundwire-cadence-fix-invalid-PDI-offset.patch
  (stable-fixes CVE-2024-38635 bsc#1226863).
- Update patches.suse/speakup-Fix-sizeof-vs-ARRAY_SIZE-bug.patch
  (git-fixes CVE-2024-38587 bsc#1226780).
- Update patches.suse/spi-Fix-null-dereference-on-suspend.patch
  (git-fixes CVE-2023-52749 bsc#1225476).
- Update
  patches.suse/thermal-core-prevent-potential-string-overflow.patch
  (git-fixes CVE-2023-52868 bsc#1225044).
- Update
  patches.suse/thermal-drivers-qcom-lmh-Check-for-SCM-availability-.patch
  (git-fixes CVE-2024-39466 bsc#1227089).
- Update
  patches.suse/thermal-drivers-tsens-Fix-null-pointer-dereference.patch
  (git-fixes CVE-2024-38571 bsc#1226737).
- Update
  patches.suse/thermal-intel-powerclamp-fix-mismatch-in-get-functio.patch
  (git-fixes CVE-2023-52794 bsc#1225028).
- Update
  patches.suse/tls-fix-NULL-deref-on-tls_sw_splice_eof-with-empty-r.patch
  (jsc#PED-6831 CVE-2023-52767 bsc#1224998).
- Update
  patches.suse/tpm_tis_spi-Account-for-SPI-header-when-allocating-T.patch
  (git-fixes CVE-2024-36477 bsc#1226840).
- Update
  patches.suse/tracing-Have-trace_event_file-have-ref-counters.patch
  (git-fixes CVE-2023-52879 bsc#1225101).
- Update
  patches.suse/tracing-trigger-Fix-to-return-error-if-failed-to-alloc-snapshot.patch
  (git-fixes CVE-2024-26920).
- Update
  patches.suse/tty-n_gsm-fix-race-condition-in-status-line-change-o.patch
  (git-fixes CVE-2023-52872 bsc#1225591).
- Update
  patches.suse/tty-n_gsm-require-CAP_NET_ADMIN-to-attach-N_GSM0710-.patch
  (bsc#1222619 CVE-2023-52880).
- Update
  patches.suse/tty-vcc-Add-check-for-kstrdup-in-vcc_probe.patch
  (git-fixes CVE-2023-52789 bsc#1225180).
- Update
  patches.suse/usb-config-fix-iteration-issue-in-usb_get_bos_descri.patch
  (git-fixes CVE-2023-52781 bsc#1225092).
- Update
  patches.suse/usb-dwc3-Wait-unconditionally-after-issuing-EndXfer-.patch
  (git-fixes CVE-2024-36977 bsc#1226513).
- Update
  patches.suse/usb-gadget-u_audio-Fix-race-condition-use-of-control.patch
  (git-fixes CVE-2024-38628 bsc#1226911).
- Update
  patches.suse/usb-storage-alauda-Check-whether-the-media-is-initia.patch
  (git-fixes CVE-2024-38619 bsc#1226861).
- Update
  patches.suse/usb-typec-tcpm-Fix-NULL-pointer-dereference-in-tcpm_.patch
  (git-fixes CVE-2023-52877 bsc#1224944).
- Update
  patches.suse/vhost-vdpa-fix-use-after-free-in-vhost_vdpa_probe.patch
  (jsc#PED-3311 CVE-2023-52795 bsc#1225085).
- Update
  patches.suse/virtio-blk-fix-implicit-overflow-on-virtio_max_dma_s.patch
  (git-fixes CVE-2023-52762 bsc#1225573).
- Update
  patches.suse/virtio-vsock-Fix-uninit-value-in-virtio_transport_re.patch
  (jsc#PED-5505 CVE-2023-52842 bsc#1225025).
- Update
  patches.suse/watchdog-cpu5wdt.c-Fix-use-after-free-bug-caused-by-.patch
  (git-fixes CVE-2024-38630 bsc#1226908).
- Update
  patches.suse/wifi-ar5523-enable-proper-endpoint-verification.patch
  (git-fixes CVE-2024-38565 bsc#1226747).
- Update
  patches.suse/wifi-ath11k-fix-dfs-radar-event-locking.patch
  (git-fixes CVE-2023-52798 bsc#1224947).
- Update
  patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch
  (git-fixes CVE-2023-52777 bsc#1224992).
- Update patches.suse/wifi-ath11k-fix-htt-pktlog-locking.patch
  (git-fixes CVE-2023-52800).
- Update
  patches.suse/wifi-ath12k-fix-dfs-radar-and-temperature-event-lock.patch
  (git-fixes CVE-2023-52776 bsc#1225090).
- Update
  patches.suse/wifi-ath12k-fix-htt-mlo-offset-event-locking.patch
  (git-fixes CVE-2023-52769 bsc#1225001).
- Update
  patches.suse/wifi-ath12k-fix-out-of-bound-access-of-qmi_invoke_ha.patch
  (git-fixes CVE-2024-38572 bsc#1226776).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-read-in-ath12k.patch
  (git-fixes CVE-2023-52827 bsc#1225078).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-write-in-ath12.patch
  (git-fixes CVE-2023-52829 bsc#1225081).
- Update
  patches.suse/wifi-brcmfmac-pcie-handle-randbuf-allocation-failure.patch
  (git-fixes CVE-2024-38575 bsc#1226612).
- Update
  patches.suse/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch
  (git-fixes CVE-2024-38567 bsc#1226769).
- Update
  patches.suse/wifi-carl9170-re-fix-fortified-memset-warning.patch
  (git-fixes CVE-2024-38616 bsc#1226852).
- Update
  patches.suse/wifi-mac80211-don-t-return-unset-power-in-ieee80211_.patch
  (git-fixes CVE-2023-52832 bsc#1225577).
- Update
  patches.suse/wifi-nl80211-Avoid-address-calculations-via-out-of-b.patch
  (git-fixes CVE-2024-38562 bsc#1226788).
- Update
  patches.suse/wifi-wilc1000-use-vmm_table-as-array-in-wilc-struct.patch
  (git-fixes CVE-2023-52768 bsc#1225004).
- Update
  patches.suse/x86-tdx-Zero-out-the-missing-RSI-in-TDX_HYPERCALL-macro.patch
  (jsc#PED-5824 CVE-2023-52874 bsc#1225049).
- commit 33efdc4</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835204">- tcp: Use refcount_inc_not_zero() in tcp_twsk_unique()
  (CVE-2024-36904 bsc#1225732).
- commit d578dcc</changelog>
  <changelog author="heming.zhao@suse.com" date="1719921600">- gfs2: Fix potential glock use-after-free on unmount (bsc#1226775
  CVE-2024-38570).
- gfs2: Rename sd_{ glock =&gt; kill }_wait (bsc#1226775
  CVE-2024-38570).
- commit f3adbca</changelog>
  <changelog author="tiwai@suse.de" date="1719921601">- Correct SCSI patch references (bsc#1225767 CVE-2024-36919 bsc#1226785 CVE-2024-38559)
- commit e8ea587</changelog>
  <changelog author="tiwai@suse.de" date="1719921602">- mtd: rawnand: rockchip: ensure NVDDR timings are rejected
  (git-fixes).
- mtd: rawnand: Bypass a couple of sanity checks during NAND
  identification (git-fixes).
- mtd: rawnand: Fix the nand_read_data_op() early check
  (git-fixes).
- mtd: rawnand: Ensure ECC configuration is propagated to upper
  layers (git-fixes).
- commit e545951</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1719921603">- kernel-doc: fix struct_group_tagged() parsing (git-fixes).
- commit e3a2a2e</changelog>
  <changelog author="fdmanana@suse.com" date="1719921604">- btrfs: fix crash on racing fsync and size-extending write into
  prealloc (bsc#1227101 CVE-2024-37354).
- commit 1d355af</changelog>
  <changelog author="vbabka@suse.cz" date="1719921605">- virt: acrn: stop using follow_pfn (CVE-2024-38610 bsc#1226758).
- commit c2ea51b</changelog>
  <changelog author="vbabka@suse.cz" date="1719921606">- drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
  (CVE-2024-38610 bsc#1226758).
- commit 7069ac2</changelog>
  <changelog author="rhopkins@suse.de" date="1719921607">- hsr: Prevent use after free in prp_create_tagged_frame()
  (CVE-2023-52846 bsc#1225098).
- commit cf63988</changelog>
  <changelog author="krisman@suse.de" date="1719921608">- io_uring: Fix io_cqring_wait() not restoring sigmask on
  get_timespec64() failure (git-fixes).
- commit e640a65</changelog>
  <changelog author="krisman@suse.de" date="1719921609">- io_uring: check for non-NULL file pointer in io_file_can_poll()
  (bsc#1226990 CVE-2024-39371).
- io_uring/io-wq: Use set_bit() and test_bit() at worker-&gt;flags
  (git-fixes).
- io_uring/sqpoll: work around a potential audit memory leak
  (git-fixes).
- commit 24603fc</changelog>
  <changelog author="krisman@suse.de" date="1719921610">- io_uring/rsrc: fix incorrect assignment of iter-&gt;nr_segs in
  io_import_fixed (git-fixes).
- io_uring/rsrc: don't lock while !TASK_RUNNING (git-fixes).
- io_uring/io-wq: avoid garbage value of 'match' in
  io_wq_enqueue() (git-fixes).
- commit 7d3e252</changelog>
</package>
<package pkgid="b74ae0308b9ffb176b6f3192c15bfa01550ac490157937fc56565027eb292d33" name="dlm-kmp-default" arch="x86_64">
  <version epoch="0" ver="6.4.0" rel="150600.23.14.2"/>
  <changelog author="tiwai@suse.de" date="1719662400">- gpiolib: cdev: Disallow reconfiguration without direction
  (uAPI v1) (git-fixes).
- gpio: davinci: Validate the obtained number of IRQs (git-fixes).
- commit 919ebd1</changelog>
  <changelog author="tiwai@suse.de" date="1719748800">- i2c: testunit: discard write requests while old command is
  running (git-fixes).
- i2c: testunit: don't erase registers after STOP (git-fixes).
- mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
  (git-fixes).
- mmc: sdhci: Do not invert write-protect twice (git-fixes).
- mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
  (git-fixes).
- mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
  (git-fixes).
- commit 448487d</changelog>
  <changelog author="tiwai@suse.de" date="1719748801">- crypto: iaa - Account for cpu-less numa nodes (bsc#1227190).
- commit cd600aa</changelog>
  <changelog author="tiwai@suse.de" date="1719748802">- crypto: deflate - Add aliases to deflate (bsc#1227190).
- commit 27ffd92</changelog>
  <changelog author="tiwai@suse.de" date="1719835200">- ata: ahci: Clean up sysfs file on error (git-fixes).
- ata: libata-core: Fix double free on error (git-fixes).
- ata,scsi: libata-core: Do not leak memory for ata_port struct
  members (git-fixes).
- ata: libata-core: Fix null pointer dereference on error
  (git-fixes).
- kbuild: Fix build target deb-pkg: ln: failed to create hard link
  (git-fixes).
- kbuild: doc: Update default INSTALL_MOD_DIR from extra to
  updates (git-fixes).
- kbuild: Install dtb files as 0644 in Makefile.dtbinst
  (git-fixes).
- counter: ti-eqep: enable clock at probe (git-fixes).
- iio: chemical: bme680: Fix sensor data read operation
  (git-fixes).
- iio: chemical: bme680: Fix overflows in compensate() functions
  (git-fixes).
- iio: chemical: bme680: Fix calibration data variable
  (git-fixes).
- iio: chemical: bme680: Fix pressure value output (git-fixes).
- iio: accel: fxls8962af: select IIO_BUFFER &amp; IIO_KFIFO_BUF
  (git-fixes).
- iio: adc: ad7266: Fix variable checking bug (git-fixes).
- iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
  (git-fixes).
- serial: bcm63xx-uart: fix tx after conversion to
  uart_port_tx_limited() (git-fixes).
- serial: core: introduce uart_port_tx_limited_flags()
  (git-fixes).
- Revert "serial: core: only stop transmit when HW fifo is empty"
  (git-fixes).
- tty: mcf: MCF54418 has 10 UARTS (git-fixes).
- usb: gadget: aspeed_udc: fix device address configuration
  (git-fixes).
- usb: dwc3: core: remove lock of otg mode during gadget
  suspend/resume to avoid deadlock (git-fixes).
- usb: typec: ucsi: glink: fix child node release in probe
  function (git-fixes).
- usb: musb: da8xx: fix a resource leak in probe() (git-fixes).
- usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  (git-fixes).
- usb: gadget: printer: fix races against disable (git-fixes).
- PCI/MSI: Fix UAF in msi_capability_init (git-fixes).
- commit a2ea5a9</changelog>
  <changelog author="ptesarik@suse.com" date="1719835201">- net: ena: Fix redundant device NUMA node override
  (jsc#PED-8688).
- commit 6ad6684</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835202">- tcp: do not accept ACK of bytes we never sent (CVE-2023-52881
  bsc#1225611).
- commit 16404a6</changelog>
  <changelog author="mhocko@suse.com" date="1719835203">- Update
  patches.suse/1352-drm-amdgpu-Fix-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52883
  bsc#1226630).
- Update
  patches.suse/9p-add-missing-locking-around-taking-dentry-fid-list.patch
  (git-fixes CVE-2024-39463 bsc#1227090).
- Update
  patches.suse/ALSA-Fix-deadlocks-with-kctl-removals-at-disconnecti.patch
  (stable-fixes CVE-2024-38600 bsc#1226864).
- Update
  patches.suse/ALSA-core-Fix-NULL-module-pointer-assignment-at-card.patch
  (git-fixes CVE-2024-38605 bsc#1226740).
- Update
  patches.suse/ALSA-hda-Fix-possible-null-ptr-deref-when-assigning-.patch
  (git-fixes CVE-2023-52806 bsc#1225554).
- Update
  patches.suse/ALSA-hda-cs_dsp_ctl-Use-private_free-for-control-cle.patch
  (git-fixes CVE-2024-38388 bsc#1226890).
- Update
  patches.suse/ALSA-timer-Set-lower-bound-of-start-tick-time.patch
  (stable-fixes git-fixes CVE-2024-38618 bsc#1226754).
- Update
  patches.suse/ASoC-kirkwood-Fix-potential-NULL-dereference.patch
  (git-fixes CVE-2024-38550 bsc#1226633).
- Update
  patches.suse/ASoC-mediatek-Assign-dummy-when-codec-not-specified-.patch
  (git-fixes CVE-2024-38551 bsc#1226761).
- Update
  patches.suse/Bluetooth-btusb-Add-date-evt_skb-is-NULL-check.patch
  (git-fixes CVE-2023-52833 bsc#1225595).
- Update
  patches.suse/Bluetooth-hci_core-Fix-possible-buffer-overflow.patch
  (git-fixes CVE-2024-26889).
- Update
  patches.suse/HID-uclogic-Fix-user-memory-access-bug-in-uclogic_pa.patch
  (git-fixes CVE-2023-52866 bsc#1225120).
- Update
  patches.suse/IB-mlx5-Fix-init-stage-error-handling-to-avoid-doubl.patch
  (jsc#PED-6864 CVE-2023-52851 bsc#1225587).
- Update
  patches.suse/Input-cyapa-add-missing-input-core-locking-to-suspen.patch
  (git-fixes CVE-2023-52884 bsc#1226764).
- Update
  patches.suse/Input-synaptics-rmi4-fix-use-after-free-in-rmi_unreg.patch
  (git-fixes CVE-2023-52840 bsc#1224928).
- Update
  patches.suse/KEYS-trusted-Do-not-use-WARN-when-encode-fails.patch
  (git-fixes CVE-2024-36975 bsc#1226520).
- Update
  patches.suse/KEYS-trusted-Fix-memory-leak-in-tpm2_key_encode.patch
  (git-fixes CVE-2024-36967 bsc#1226131).
- Update
  patches.suse/RDMA-cma-Fix-kmemleak-in-rdma_core-observed-during-b.patch
  (git-fixes CVE-2024-38539 bsc#1226608).
- Update patches.suse/RDMA-hns-Fix-UAF-for-cq-async-event.patch
  (git-fixes CVE-2024-38545 bsc#1226595).
- Update
  patches.suse/RDMA-hns-Fix-deadlock-on-SRQ-async-events.patch
  (git-fixes CVE-2024-38591 bsc#1226738).
- Update
  patches.suse/RDMA-hns-Modify-the-print-level-of-CQE-error.patch
  (git-fixes CVE-2024-38590 bsc#1226839).
- Update
  patches.suse/RDMA-rxe-Fix-seg-fault-in-rxe_comp_queue_pkt.patch
  (git-fixes CVE-2024-38544 bsc#1226597).
- Update
  patches.suse/SUNRPC-Fix-RPC-client-cleaned-up-the-freed-pipefs-de.patch
  (git-fixes CVE-2023-52803 bsc#1225008).
- Update patches.suse/af_unix-Clear-stale-u-oob_skb.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-35970 bsc#1224584).
- Update
  patches.suse/af_unix-Drop-oob_skb-ref-before-purging-queue-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26750 bsc#1222617).
- Update
  patches.suse/af_unix-Fix-task-hung-while-purging-oob_skb-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26780 bsc#1222588).
- Update
  patches.suse/af_unix-Update-unix_sk-sk-oob_skb-under-sk_receive_queue-lock.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-36972 bsc#1226163).
- Update
  patches.suse/arm64-Restrict-CPU_BIG_ENDIAN-to-GNU-as-or-LLVM-IAS-.patch
  (git-fixes CVE-2023-52750 bsc#1225485).
- Update
  patches.suse/atl1c-Work-around-the-DMA-RX-overflow-issue.patch
  (git-fixes CVE-2023-52834 bsc#1225599).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issue-of-net_device.patch
  (git-fixes CVE-2024-38554 bsc#1226742).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issues-of-ax25_dev.patch
  (git-fixes CVE-2024-38602 bsc#1226613).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-reorder-of-WRITE-lqueued.patch
  (bsc#1225605 CVE-2024-38384 bsc#1226938).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-resetting-io-stat.patch
  (bsc#1225605 CVE-2024-38663 bsc#1226939).
- Update
  patches.suse/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch
  (git-fixes CVE-2024-38540 bsc#1226582).
- Update
  patches.suse/bonding-stop-the-device-in-bond_setup_by_slave.patch
  (git-fixes CVE-2023-52784 bsc#1224946).
- Update
  patches.suse/can-dev-can_put_echo_skb-don-t-crash-kernel-if-can_p.patch
  (git-fixes CVE-2023-52878 bsc#1225000).
- Update
  patches.suse/clk-mediatek-clk-mt2701-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52875 bsc#1225096).
- Update
  patches.suse/clk-mediatek-clk-mt6765-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52870 bsc#1224937).
- Update
  patches.suse/clk-mediatek-clk-mt6779-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52873 bsc#1225589).
- Update
  patches.suse/clk-mediatek-clk-mt6797-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52865 bsc#1225086).
- Update
  patches.suse/clk-mediatek-clk-mt7629-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52858 bsc#1225566).
- Update
  patches.suse/clk-mediatek-clk-mt7629-eth-Add-check-for-mtk_alloc_.patch
  (git-fixes CVE-2023-52876 bsc#1225036).
- Update
  patches.suse/cppc_cpufreq-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38573 bsc#1226739).
- Update patches.suse/cpufreq-exit-callback-is-optional.patch
  (git-fixes CVE-2024-38615 bsc#1226592).
- Update patches.suse/crypto-bcm-Fix-pointer-arithmetic.patch
  (git-fixes CVE-2024-38579 bsc#1226637).
- Update
  patches.suse/crypto-pcrypt-Fix-hungtask-for-PADATA_RESET.patch
  (git-fixes CVE-2023-52813 bsc#1225527).
- Update patches.suse/cxl-mem-Fix-shutdown-order.patch (git-fixes
  CVE-2023-52849 bsc#1224949).
- Update
  patches.suse/cxl-region-Do-not-try-to-cleanup-after-cxl_region_se.patch
  (git-fixes CVE-2023-52792 bsc#1225477).
- Update patches.suse/cxl-region-Fix-cxlr_pmem-leaks.patch
  (git-fixes CVE-2024-38391 bsc#1226894).
- Update
  patches.suse/dma-buf-sw-sync-don-t-enable-IRQ-from-sync_print_obj.patch
  (git-fixes CVE-2024-38780 bsc#1226886).
- Update
  patches.suse/dma-mapping-benchmark-fix-node-id-validation.patch
  (git-fixes CVE-2024-34777 bsc#1226796).
- Update
  patches.suse/dma-mapping-benchmark-handle-NUMA_NO_NODE-correctly.patch
  (git-fixes CVE-2024-39277 bsc#1226909).
- Update
  patches.suse/dmaengine-idxd-Avoid-unnecessary-destruction-of-file.patch
  (git-fixes CVE-2024-38629 bsc#1226905).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Pola.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52819
  bsc#1225532).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-SMU7.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52818
  bsc#1225530).
- Update
  patches.suse/drm-amd-check-num-of-link-levels-when-update-pcie-pa.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52812
  bsc#1225564).
- Update
  patches.suse/drm-amd-display-Avoid-NULL-dereference-of-timing-gen.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52753
  bsc#1225478).
- Update
  patches.suse/drm-amd-display-Fix-division-by-zero-in-setup_dsc_co.patch
  (stable-fixes CVE-2024-36969 bsc#1226155).
- Update
  patches.suse/drm-amd-display-Fix-null-pointer-dereference-in-erro.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52862
  bsc#1225015).
- Update
  patches.suse/drm-amd-display-Fix-potential-index-out-of-bounds-in.patch
  (git-fixes CVE-2024-38552 bsc#1226767).
- Update
  patches.suse/drm-amd-display-fix-a-NULL-pointer-dereference-in-am.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52773
  bsc#1225041).
- Update
  patches.suse/drm-amd-display-fixed-integer-types-and-null-check-l.patch
  (git-fixes CVE-2024-26767).
- Update
  patches.suse/drm-amdgpu-Fix-a-null-pointer-access-when-the-smc_rr.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52817
  bsc#1225569).
- Update
  patches.suse/drm-amdgpu-Fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch
  (git-fixes CVE-2024-39291 bsc#1226934).
- Update
  patches.suse/drm-amdgpu-Fix-potential-null-pointer-derefernce.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52814
  bsc#1225565).
- Update
  patches.suse/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch
  (stable-fixes CVE-2024-39471 bsc#1227096).
- Update
  patches.suse/drm-amdgpu-mes-fix-use-after-free-issue.patch
  (stable-fixes CVE-2024-38581 bsc#1226657).
- Update
  patches.suse/drm-amdgpu-vkms-fix-a-possible-null-pointer-derefere.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52815
  bsc#1225568).
- Update
  patches.suse/drm-amdkfd-Fix-a-race-condition-of-vram-buffer-unref.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52825
  bsc#1225076).
- Update
  patches.suse/drm-amdkfd-Fix-shift-out-of-bounds-issue.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52816
  bsc#1225529).
- Update
  patches.suse/drm-bridge-cdns-mhdp8546-Fix-possible-null-pointer-d.patch
  (git-fixes CVE-2024-38548).
- Update
  patches.suse/drm-bridge-it66121-Fix-invalid-connector-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52861
  bsc#1224941).
- Update
  patches.suse/drm-bridge-lt8912b-Fix-crash-on-bridge-detach.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52856
  bsc#1224932).
- Update
  patches.suse/drm-mediatek-Add-0-size-check-to-mtk_drm_gem_obj.patch
  (git-fixes CVE-2024-38549 bsc#1226735).
- Update
  patches.suse/drm-mediatek-Fix-coverity-issue-with-unintentional-i.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52857
  bsc#1225581).
- Update
  patches.suse/drm-mediatek-Init-ddp_comp-with-devm_kcalloc.patch
  (git-fixes CVE-2024-38592 bsc#1226844).
- Update
  patches.suse/drm-msm-a6xx-Avoid-a-nullptr-dereference-when-speedb.patch
  (git-fixes CVE-2024-38390 bsc#1226891).
- Update
  patches.suse/drm-msm-dpu-Add-callback-function-pointer-check-befo.patch
  (git-fixes CVE-2024-38622 bsc#1226856).
- Update
  patches.suse/drm-panel-fix-a-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52821
  bsc#1225022).
- Update
  patches.suse/drm-panel-panel-tpo-tpg110-fix-a-possible-null-point.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52826
  bsc#1225077).
- Update patches.suse/drm-radeon-possible-buffer-overflow.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52867
  bsc#1225009).
- Update
  patches.suse/drm-vc4-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38546 bsc#1226593).
- Update
  patches.suse/drm-vmwgfx-Fix-invalid-reads-in-fence-signaled-event.patch
  (git-fixes CVE-2024-36960 bsc#1225872).
- Update
  patches.suse/drm-zynqmp_dpsub-Always-register-bridge.patch
  (git-fixes CVE-2024-38664 bsc#1226941).
- Update
  patches.suse/e1000e-change-usleep_range-to-udelay-in-PHY-mdic-acc.patch
  (CVE-2024-39296 bsc#1226989 CVE-2024-36887 bsc#1225731).
- Update
  patches.suse/ecryptfs-Fix-buffer-size-for-tag-66-packet.patch
  (git-fixes CVE-2024-38578 bsc#1226634).
- Update
  patches.suse/efi-libstub-only-free-priv.runtime_map-when-allocate.patch
  (git-fixes CVE-2024-33619 bsc#1226768).
- Update
  patches.suse/fbdev-imsttfb-fix-a-resource-leak-in-probe.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52838
  bsc#1225031).
- Update
  patches.suse/fs-9p-only-translate-RWX-permissions-for-plain-9P200.patch
  (git-fixes CVE-2024-36964 bsc#1225866).
- Update
  patches.suse/fs-jfs-Add-check-for-negative-db_l2nbperpage.patch
  (git-fixes CVE-2023-52810 bsc#1225557).
- Update
  patches.suse/fs-jfs-Add-validity-check-for-db_maxag-and-db_agpref.patch
  (git-fixes CVE-2023-52804 bsc#1225550).
- Update
  patches.suse/ftrace-Fix-possible-use-after-free-issue-in-ftrace_location.patch
  (git-fixes CVE-2024-38588 bsc#1226837).
- Update
  patches.suse/genirq-irqdesc-Prevent-use-after-free-in-irq_find_at.patch
  (git-fixes CVE-2024-38385 bsc#1227085).
- Update patches.suse/gfs2-ignore-negated-quota-changes.patch
  (git-fixes CVE-2023-52759 bsc#1225560).
- Update
  patches.suse/hid-cp2112-Fix-duplicate-workqueue-initialization.patch
  (git-fixes CVE-2023-52853 bsc#1224988).
- Update
  patches.suse/hwmon-axi-fan-control-Fix-possible-NULL-pointer-dere.patch
  (git-fixes CVE-2023-52863 bsc#1225586).
- Update
  patches.suse/i2c-acpi-Unbind-mux-adapters-before-delete.patch
  (git-fixes CVE-2024-39362 bsc#1226995).
- Update
  patches.suse/i2c-core-Run-atomic-i2c-xfer-when-preemptible.patch
  (git-fixes CVE-2023-52791 bsc#1225108).
- Update
  patches.suse/i3c-master-mipi-i3c-hci-Fix-a-kernel-panic-for-acces.patch
  (git-fixes CVE-2023-52763 bsc#1225570).
- Update
  patches.suse/i3c-mipi-i3c-hci-Fix-out-of-bounds-access-in-hci_dma.patch
  (git-fixes CVE-2023-52766).
- Update
  patches.suse/i915-perf-Fix-NULL-deref-bugs-with-drm_dbg-calls.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52788
  bsc#1225106).
- Update
  patches.suse/igb-Fix-string-truncation-warnings-in-igb_set_fw_ver.patch
  (git-fixes CVE-2024-36010 bsc#1225594).
- Update
  patches.suse/iommu-vt-d-Fix-WARN_ON-in-iommu-probe-path.patch
  (git-fixes CVE-2024-35957 bsc#1224673).
- Update
  patches.suse/iommufd-Fix-missing-update-of-domains_itree-after-splitting-iopt
  (jsc#PED-7779 jsc#PED-7780 CVE-2023-52801 bsc#1225006).
- Update
  patches.suse/ipvlan-add-ipvlan_route_v6_outbound-helper.patch
  (git-fixes CVE-2023-52796 bsc#1224930).
- Update
  patches.suse/jffs2-prevent-xattr-node-from-overflowing-the-eraseblock.patch
  (git-fixes CVE-2024-38599 bsc#1226848).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-dbFindLeaf.patch
  (git-fixes CVE-2023-52799 bsc#1225472).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-diAlloc.patch
  (git-fixes CVE-2023-52805 bsc#1225553).
- Update
  patches.suse/kunit-fortify-Fix-mismatched-kvalloc-vfree-usage.patch
  (git-fixes CVE-2024-38617 bsc#1226859).
- Update
  patches.suse/lib-generic-radix-tree.c-Don-t-overflow-in-peek.patch
  (git-fixes CVE-2021-47432 bsc#1225391).
- Update
  patches.suse/lib-test_hmm.c-handle-src_pfns-and-dst_pfns-allocati.patch
  (git-fixes CVE-2024-38543 bsc#1226594).
- Update
  patches.suse/locking-ww_mutex-test-Fix-potential-workqueue-corrup.patch
  (bsc#1219953 CVE-2023-52836 bsc#1225609).
- Update
  patches.suse/md-Don-t-ignore-suspended-array-in-md_check_recovery-1baa.patch
  (bsc#1219596 CVE-2024-26758).
- Update
  patches.suse/media-atomisp-ssh_css-Fix-a-null-pointer-dereference.patch
  (git-fixes CVE-2024-38547 bsc#1226632).
- Update
  patches.suse/media-bttv-fix-use-after-free-error-due-to-btv-timeo.patch
  (git-fixes CVE-2023-52847 bsc#1225588).
- Update
  patches.suse/media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch
  (git-fixes CVE-2023-52764 bsc#1225571).
- Update
  patches.suse/media-hantro-Check-whether-reset-op-is-defined-befor.patch
  (git-fixes CVE-2023-52850 bsc#1225014).
- Update
  patches.suse/media-i2c-et8ek8-Don-t-strip-remove-function-when-dr.patch
  (git-fixes CVE-2024-38611 bsc#1226760).
- Update
  patches.suse/media-imon-fix-access-to-invalid-resource-for-the-se.patch
  (git-fixes CVE-2023-52754 bsc#1225490).
- Update
  patches.suse/media-lgdt3306a-Add-a-check-against-null-pointer-def.patch
  (stable-fixes CVE-2022-48772 bsc#1226976).
- Update
  patches.suse/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch
  (git-fixes CVE-2024-38621 bsc#1226895).
- Update
  patches.suse/media-vidtv-mux-Add-check-and-kfree-for-kstrdup.patch
  (git-fixes CVE-2023-52841 bsc#1225592).
- Update patches.suse/media-vidtv-psi-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52844 bsc#1225590).
- Update
  patches.suse/mfd-qcom-spmi-pmic-Fix-revid-implementation.patch
  (git-fixes CVE-2023-52765 bsc#1225029).
- Update
  patches.suse/misc-microchip-pci1xxxx-fix-double-free-in-the-error.patch
  (git-fixes CVE-2024-36973 bsc#1226457).
- Update
  patches.suse/net-hns3-fix-out-of-bounds-access-may-occur-when-coa.patch
  (git-fixes CVE-2023-52807 bsc#1225097).
- Update
  patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch
  (git-fixes CVE-2024-36962 bsc#1225827).
- Update
  patches.suse/net-mlx5-Fix-peer-devlink-set-for-SF-representor-dev.patch
  (git-fixes CVE-2024-38595 bsc#1226741).
- Update
  patches.suse/net-mlx5e-Track-xmit-submission-to-PTP-WQ-after-popu.patch
  (jsc#PED-3311 CVE-2023-52782 bsc#1225103).
- Update
  patches.suse/net-mvneta-fix-calls-to-page_pool_get_stats.patch
  (git-fixes CVE-2023-52780 bsc#1224933).
- Update
  patches.suse/net-wangxun-fix-kernel-panic-due-to-null-pointer.patch
  (git-fixes CVE-2023-52783 bsc#1225104).
- Update
  patches.suse/netfilter-complete-validation-of-user-input.patch
  (git-fixes CVE-2024-35896 bsc#1224662 CVE-2024-35962
  bsc#1224583).
- Update
  patches.suse/nfc-nci-Fix-uninit-value-in-nci_rx_work.patch
  (git-fixes CVE-2024-38381 bsc#1226878).
- Update
  patches.suse/nilfs2-fix-nilfs_empty_dir-misjudgment-and-long-loop.patch
  (git-fixes CVE-2024-39469 bsc#1226992).
- Update
  patches.suse/nilfs2-fix-potential-hang-in-nilfs_detach_log_writer.patch
  (git-fixes CVE-2024-38582 bsc#1226658).
- Update
  patches.suse/nilfs2-fix-use-after-free-of-timer-for-log-writer-th.patch
  (git-fixes CVE-2024-38583 bsc#1226777).
- Update
  patches.suse/of-module-add-buffer-overflow-check-in-of_modalias.patch
  (git-fixes CVE-2024-38541 bsc#1226587).
- Update
  patches.suse/padata-Fix-refcnt-handling-in-padata_free_shell.patch
  (git-fixes CVE-2023-52854 bsc#1225584).
- Update
  patches.suse/perf-core-Bail-out-early-if-the-request-AUX-area-is-out-of-bound.patch
  (git-fixes CVE-2023-52835 bsc#1225602).
- Update
  patches.suse/platform-x86-wmi-Fix-opening-of-char-device.patch
  (git-fixes CVE-2023-52864 bsc#1225132).
- Update
  patches.suse/powerpc-pseries-iommu-LPAR-panics-during-boot-up-wit.patch
  (bsc#1222011 ltc#205900 CVE-2024-36926 bsc#1225829).
- Update patches.suse/pstore-platform-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52869 bsc#1225050).
- Update
  patches.suse/remoteproc-mediatek-Make-sure-IPI-buffer-fits-in-L2T.patch
  (git-fixes CVE-2024-36965 bsc#1226149).
- Update
  patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch
  (git-fixes CVE-2024-38601 bsc#1226876).
- Update
  patches.suse/s390-dasd-protect-device-queue-against-concurrent-access.patch
  (git-fixes bsc#1217481 CVE-2023-52774 bsc#1225572).
- Update
  patches.suse/scsi-hisi_sas-Set-debugfs_dir-pointer-to-NULL-after-removing-debugfs.patch
  (git-fixes CVE-2023-52808 bsc#1225555).
- Update
  patches.suse/scsi-ibmvfc-Remove-BUG_ON-in-the-case-of-an-empty-ev.patch
  (bsc#1209834 ltc#202097 CVE-2023-52811 bsc#1225559).
- Update
  patches.suse/scsi-libfc-Fix-potential-NULL-pointer-dereference-in-fc_lport_ptp_setup.patch
  (git-fixes CVE-2023-52809 bsc#1225556).
- Update
  patches.suse/scsi-lpfc-Move-NPIV-s-transport-unregistration-to-af.patch
  (bsc#1221777 CVE-2024-36952 bsc#1225898).
- Update
  patches.suse/scsi-lpfc-Release-hbalock-before-calling-lpfc_worker.patch
  (bsc#1221777 CVE-2024-36924 bsc#1225820).
- Update
  patches.suse/serial-max3100-Lock-port-lock-when-calling-uart_hand.patch
  (git-fixes CVE-2024-38634 bsc#1226868).
- Update
  patches.suse/serial-max3100-Update-uart_driver_registered-on-driv.patch
  (git-fixes CVE-2024-38633 bsc#1226867).
- Update
  patches.suse/soc-qcom-llcc-Handle-a-second-device-without-data-co.patch
  (git-fixes CVE-2023-52871 bsc#1225534).
- Update
  patches.suse/soundwire-cadence-fix-invalid-PDI-offset.patch
  (stable-fixes CVE-2024-38635 bsc#1226863).
- Update patches.suse/speakup-Fix-sizeof-vs-ARRAY_SIZE-bug.patch
  (git-fixes CVE-2024-38587 bsc#1226780).
- Update patches.suse/spi-Fix-null-dereference-on-suspend.patch
  (git-fixes CVE-2023-52749 bsc#1225476).
- Update
  patches.suse/thermal-core-prevent-potential-string-overflow.patch
  (git-fixes CVE-2023-52868 bsc#1225044).
- Update
  patches.suse/thermal-drivers-qcom-lmh-Check-for-SCM-availability-.patch
  (git-fixes CVE-2024-39466 bsc#1227089).
- Update
  patches.suse/thermal-drivers-tsens-Fix-null-pointer-dereference.patch
  (git-fixes CVE-2024-38571 bsc#1226737).
- Update
  patches.suse/thermal-intel-powerclamp-fix-mismatch-in-get-functio.patch
  (git-fixes CVE-2023-52794 bsc#1225028).
- Update
  patches.suse/tls-fix-NULL-deref-on-tls_sw_splice_eof-with-empty-r.patch
  (jsc#PED-6831 CVE-2023-52767 bsc#1224998).
- Update
  patches.suse/tpm_tis_spi-Account-for-SPI-header-when-allocating-T.patch
  (git-fixes CVE-2024-36477 bsc#1226840).
- Update
  patches.suse/tracing-Have-trace_event_file-have-ref-counters.patch
  (git-fixes CVE-2023-52879 bsc#1225101).
- Update
  patches.suse/tracing-trigger-Fix-to-return-error-if-failed-to-alloc-snapshot.patch
  (git-fixes CVE-2024-26920).
- Update
  patches.suse/tty-n_gsm-fix-race-condition-in-status-line-change-o.patch
  (git-fixes CVE-2023-52872 bsc#1225591).
- Update
  patches.suse/tty-n_gsm-require-CAP_NET_ADMIN-to-attach-N_GSM0710-.patch
  (bsc#1222619 CVE-2023-52880).
- Update
  patches.suse/tty-vcc-Add-check-for-kstrdup-in-vcc_probe.patch
  (git-fixes CVE-2023-52789 bsc#1225180).
- Update
  patches.suse/usb-config-fix-iteration-issue-in-usb_get_bos_descri.patch
  (git-fixes CVE-2023-52781 bsc#1225092).
- Update
  patches.suse/usb-dwc3-Wait-unconditionally-after-issuing-EndXfer-.patch
  (git-fixes CVE-2024-36977 bsc#1226513).
- Update
  patches.suse/usb-gadget-u_audio-Fix-race-condition-use-of-control.patch
  (git-fixes CVE-2024-38628 bsc#1226911).
- Update
  patches.suse/usb-storage-alauda-Check-whether-the-media-is-initia.patch
  (git-fixes CVE-2024-38619 bsc#1226861).
- Update
  patches.suse/usb-typec-tcpm-Fix-NULL-pointer-dereference-in-tcpm_.patch
  (git-fixes CVE-2023-52877 bsc#1224944).
- Update
  patches.suse/vhost-vdpa-fix-use-after-free-in-vhost_vdpa_probe.patch
  (jsc#PED-3311 CVE-2023-52795 bsc#1225085).
- Update
  patches.suse/virtio-blk-fix-implicit-overflow-on-virtio_max_dma_s.patch
  (git-fixes CVE-2023-52762 bsc#1225573).
- Update
  patches.suse/virtio-vsock-Fix-uninit-value-in-virtio_transport_re.patch
  (jsc#PED-5505 CVE-2023-52842 bsc#1225025).
- Update
  patches.suse/watchdog-cpu5wdt.c-Fix-use-after-free-bug-caused-by-.patch
  (git-fixes CVE-2024-38630 bsc#1226908).
- Update
  patches.suse/wifi-ar5523-enable-proper-endpoint-verification.patch
  (git-fixes CVE-2024-38565 bsc#1226747).
- Update
  patches.suse/wifi-ath11k-fix-dfs-radar-event-locking.patch
  (git-fixes CVE-2023-52798 bsc#1224947).
- Update
  patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch
  (git-fixes CVE-2023-52777 bsc#1224992).
- Update patches.suse/wifi-ath11k-fix-htt-pktlog-locking.patch
  (git-fixes CVE-2023-52800).
- Update
  patches.suse/wifi-ath12k-fix-dfs-radar-and-temperature-event-lock.patch
  (git-fixes CVE-2023-52776 bsc#1225090).
- Update
  patches.suse/wifi-ath12k-fix-htt-mlo-offset-event-locking.patch
  (git-fixes CVE-2023-52769 bsc#1225001).
- Update
  patches.suse/wifi-ath12k-fix-out-of-bound-access-of-qmi_invoke_ha.patch
  (git-fixes CVE-2024-38572 bsc#1226776).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-read-in-ath12k.patch
  (git-fixes CVE-2023-52827 bsc#1225078).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-write-in-ath12.patch
  (git-fixes CVE-2023-52829 bsc#1225081).
- Update
  patches.suse/wifi-brcmfmac-pcie-handle-randbuf-allocation-failure.patch
  (git-fixes CVE-2024-38575 bsc#1226612).
- Update
  patches.suse/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch
  (git-fixes CVE-2024-38567 bsc#1226769).
- Update
  patches.suse/wifi-carl9170-re-fix-fortified-memset-warning.patch
  (git-fixes CVE-2024-38616 bsc#1226852).
- Update
  patches.suse/wifi-mac80211-don-t-return-unset-power-in-ieee80211_.patch
  (git-fixes CVE-2023-52832 bsc#1225577).
- Update
  patches.suse/wifi-nl80211-Avoid-address-calculations-via-out-of-b.patch
  (git-fixes CVE-2024-38562 bsc#1226788).
- Update
  patches.suse/wifi-wilc1000-use-vmm_table-as-array-in-wilc-struct.patch
  (git-fixes CVE-2023-52768 bsc#1225004).
- Update
  patches.suse/x86-tdx-Zero-out-the-missing-RSI-in-TDX_HYPERCALL-macro.patch
  (jsc#PED-5824 CVE-2023-52874 bsc#1225049).
- commit 33efdc4</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835204">- tcp: Use refcount_inc_not_zero() in tcp_twsk_unique()
  (CVE-2024-36904 bsc#1225732).
- commit d578dcc</changelog>
  <changelog author="heming.zhao@suse.com" date="1719921600">- gfs2: Fix potential glock use-after-free on unmount (bsc#1226775
  CVE-2024-38570).
- gfs2: Rename sd_{ glock =&gt; kill }_wait (bsc#1226775
  CVE-2024-38570).
- commit f3adbca</changelog>
  <changelog author="tiwai@suse.de" date="1719921601">- Correct SCSI patch references (bsc#1225767 CVE-2024-36919 bsc#1226785 CVE-2024-38559)
- commit e8ea587</changelog>
  <changelog author="tiwai@suse.de" date="1719921602">- mtd: rawnand: rockchip: ensure NVDDR timings are rejected
  (git-fixes).
- mtd: rawnand: Bypass a couple of sanity checks during NAND
  identification (git-fixes).
- mtd: rawnand: Fix the nand_read_data_op() early check
  (git-fixes).
- mtd: rawnand: Ensure ECC configuration is propagated to upper
  layers (git-fixes).
- commit e545951</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1719921603">- kernel-doc: fix struct_group_tagged() parsing (git-fixes).
- commit e3a2a2e</changelog>
  <changelog author="fdmanana@suse.com" date="1719921604">- btrfs: fix crash on racing fsync and size-extending write into
  prealloc (bsc#1227101 CVE-2024-37354).
- commit 1d355af</changelog>
  <changelog author="vbabka@suse.cz" date="1719921605">- virt: acrn: stop using follow_pfn (CVE-2024-38610 bsc#1226758).
- commit c2ea51b</changelog>
  <changelog author="vbabka@suse.cz" date="1719921606">- drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
  (CVE-2024-38610 bsc#1226758).
- commit 7069ac2</changelog>
  <changelog author="rhopkins@suse.de" date="1719921607">- hsr: Prevent use after free in prp_create_tagged_frame()
  (CVE-2023-52846 bsc#1225098).
- commit cf63988</changelog>
  <changelog author="krisman@suse.de" date="1719921608">- io_uring: Fix io_cqring_wait() not restoring sigmask on
  get_timespec64() failure (git-fixes).
- commit e640a65</changelog>
  <changelog author="krisman@suse.de" date="1719921609">- io_uring: check for non-NULL file pointer in io_file_can_poll()
  (bsc#1226990 CVE-2024-39371).
- io_uring/io-wq: Use set_bit() and test_bit() at worker-&gt;flags
  (git-fixes).
- io_uring/sqpoll: work around a potential audit memory leak
  (git-fixes).
- commit 24603fc</changelog>
  <changelog author="krisman@suse.de" date="1719921610">- io_uring/rsrc: fix incorrect assignment of iter-&gt;nr_segs in
  io_import_fixed (git-fixes).
- io_uring/rsrc: don't lock while !TASK_RUNNING (git-fixes).
- io_uring/io-wq: avoid garbage value of 'match' in
  io_wq_enqueue() (git-fixes).
- commit 7d3e252</changelog>
</package>
<package pkgid="40599d447d2d0d35a40d5f9bf405a38abddf5acb910b144568feb915edfaffdb" name="dlm-kmp-default" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.17.1"/>
  <changelog author="tiwai@suse.de" date="1722081600">- auxdisplay: ht16k33: Drop reference after LED registration
  (git-fixes).
- ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
  on unprepare (git-fixes).
- ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
- ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
  reachable (git-fixes).
- ASoC: sof: amd: fix for firmware reload failure in Vangogh
  platform (git-fixes).
- ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
- ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
  (git-fixes).
- ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
- ALSA: ump: Don't update FB name for static blocks (git-fixes).
- drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
- drm/i915/gt: Do not consider preemption during execlists_dequeue
  for gen8 (git-fixes).
- drm/i915/dp: Don't switch the LTTPR mode on an active link
  (git-fixes).
- commit d7e2deb</changelog>
  <changelog author="tiwai@suse.de" date="1722081601">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
</package>
<package pkgid="56e6bf74542960f1cdc59fd2a12f30c2d10d706a848ab396f805ebd3e0e57951" name="dlm-kmp-default" arch="ppc64le">
  <version epoch="0" ver="6.4.0" rel="150600.23.17.1"/>
  <changelog author="tiwai@suse.de" date="1722081600">- auxdisplay: ht16k33: Drop reference after LED registration
  (git-fixes).
- ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
  on unprepare (git-fixes).
- ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
- ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
  reachable (git-fixes).
- ASoC: sof: amd: fix for firmware reload failure in Vangogh
  platform (git-fixes).
- ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
- ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
  (git-fixes).
- ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
- ALSA: ump: Don't update FB name for static blocks (git-fixes).
- drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
- drm/i915/gt: Do not consider preemption during execlists_dequeue
  for gen8 (git-fixes).
- drm/i915/dp: Don't switch the LTTPR mode on an active link
  (git-fixes).
- commit d7e2deb</changelog>
  <changelog author="tiwai@suse.de" date="1722081601">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
</package>
<package pkgid="381bc24ca181ed059f35ed4e999e711f3b01e7e55a96f87d83e639621fc2d9dc" name="dlm-kmp-default" arch="s390x">
  <version epoch="0" ver="6.4.0" rel="150600.23.17.1"/>
  <changelog author="tiwai@suse.de" date="1722081600">- auxdisplay: ht16k33: Drop reference after LED registration
  (git-fixes).
- ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
  on unprepare (git-fixes).
- ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
- ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
  reachable (git-fixes).
- ASoC: sof: amd: fix for firmware reload failure in Vangogh
  platform (git-fixes).
- ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
- ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
  (git-fixes).
- ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
- ALSA: ump: Don't update FB name for static blocks (git-fixes).
- drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
- drm/i915/gt: Do not consider preemption during execlists_dequeue
  for gen8 (git-fixes).
- drm/i915/dp: Don't switch the LTTPR mode on an active link
  (git-fixes).
- commit d7e2deb</changelog>
  <changelog author="tiwai@suse.de" date="1722081601">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
</package>
<package pkgid="80ea6736f0c37791c109328fffe6d6cd976717ee8977889333c69d08c7975dc4" name="dlm-kmp-default" arch="x86_64">
  <version epoch="0" ver="6.4.0" rel="150600.23.17.1"/>
  <changelog author="tiwai@suse.de" date="1722081600">- auxdisplay: ht16k33: Drop reference after LED registration
  (git-fixes).
- ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
  on unprepare (git-fixes).
- ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
- ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
  reachable (git-fixes).
- ASoC: sof: amd: fix for firmware reload failure in Vangogh
  platform (git-fixes).
- ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
- ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
  (git-fixes).
- ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
- ALSA: ump: Don't update FB name for static blocks (git-fixes).
- drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
- drm/i915/gt: Do not consider preemption during execlists_dequeue
  for gen8 (git-fixes).
- drm/i915/dp: Don't switch the LTTPR mode on an active link
  (git-fixes).
- commit d7e2deb</changelog>
  <changelog author="tiwai@suse.de" date="1722081601">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
</package>
<package pkgid="2b4c8c46782a50b4946d7b79c3fb0da195ea8ab27af24f801f8c0aea7ce37468" name="dlm-kmp-default" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.7.3"/>
  <changelog author="mkubecek@suse.cz" date="1717416000">- netfilter: nf_tables: release mutex after nft_gc_seq_end from
  abort path (CVE-2024-26925 bsc#1223390).
- commit 578a709</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717416001">- Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
  The L3 bsc#1225765 was created seperately since our customer requires
  PTF.
- Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
- Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
- Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
- Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
- commit 054635e</changelog>
  <changelog author="msuchanek@suse.de" date="1717416002">- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
- powerpc/uaccess: Fix build errors seen with GCC 13/14
  (bsc#1194869).
- commit 46b5d84</changelog>
  <changelog author="msuchanek@suse.de" date="1717416003">- blacklist.conf: PPC fsl_msi is not used
- commit ae6590d</changelog>
  <changelog author="msuchanek@suse.de" date="1717416004">- powerpc/pseries/lparcfg: drop error message from guest name
  lookup (bsc#1187716 ltc#193451 git-fixes).
- commit ceab637</changelog>
  <changelog author="mfranc@suse.cz" date="1717416005">- Update
  patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
  (git-fixes CVE-2024-36955).
- Update
  patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
  (git-fixes bsc#1225715 CVE-2024-36906).
- Update
  patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
  (git-fixes bsc#1225579 CVE-2024-36011).
- Update
  patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
  (git-fixes bsc#1225578 CVE-2024-36013).
- Update
  patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
  (git-fixes bsc#1225502 CVE-2024-36012).
- Update
  patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
  (git-fixes bsc#1225722 CVE-2024-36880).
- Update
  patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
  (git-fixes CVE-2024-36942).
- Update
  patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
  (git-fixes bsc#1225720 CVE-2024-36032).
- Update
  patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
  (git-fixes bsc#1223749 CVE-2024-26990).
- Update
  patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
  (git-fixes bsc#1223692 CVE-2024-26992).
- Update
  patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
  (stable-fixes CVE-2024-36944).
- Update
  patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
  (git-fixes bsc#1225734 CVE-2024-36896).
- Update
  patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
  (stable-fixes CVE-2024-36949).
- Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
  (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
- Update
  patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
  (git-fixes bsc#1225692 CVE-2023-52882).
- Update
  patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
  (git-fixes CVE-2024-26761).
- Update
  patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
  (stable-fixes bsc#1225735 CVE-2024-36897).
- Update
  patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
  (stable-fixes bsc#1225705 CVE-2024-36026).
- Update
  patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
  (stable-fixes CVE-2024-36951).
- Update
  patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
  (git-fixes bsc#1225593 CVE-2024-36014).
- Update
  patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
  (stable-fixes bsc#1225728 CVE-2024-36885).
- Update
  patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
  (git-fixes bsc#1225773 CVE-2024-36936).
- Update
  patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
  (stable-fixes CVE-2024-36950).
- Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
  (git-fixes bsc#1225736 CVE-2024-36898).
- Update
  patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
  (git-fixes bsc#1225698 CVE-2024-36020).
- Update
  patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
  (git-fixes bsc#1225710 CVE-2024-36891).
- Update
  patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
  (git-fixes bsc#1225714 CVE-2024-36890).
- Update
  patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
  (git-fixes bsc#1225708 CVE-2024-36029).
- Update
  patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
  (git-fixes bsc#1225699 CVE-2024-36021).
- Update
  patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
  (git-fixes CVE-2024-26943).
- Update
  patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
  (git-fixes bsc#1225694 CVE-2024-36018).
- Update
  patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
  (git-fixes CVE-2024-36940).
- Update
  patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
  (git-fixes CVE-2024-36959).
- Update
  patches.suse/ppdev-Add-an-error-check-in-register_device.patch
  (git-fixes bsc#1225640 CVE-2024-36015).
- Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
  CVE-2024-36947).
- Update
  patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
  (git-fixes bsc#1225695 CVE-2024-36019).
- Update
  patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
  (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
- Update
  patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
  (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
- Update
  patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
  (git-fixes bsc#1225704 CVE-2024-36025).
- Update
  patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
  (git-fixes CVE-2024-36930).
- Update
  patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
  (bsc#1224331 bsc#1224602 CVE-2024-35814).
- Update
  patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
  (git-fixes bsc#1225642 CVE-2024-36016).
- Update
  patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
  (git-fixes bsc#1225749 CVE-2024-36894).
- Update
  patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
  (git-fixes bsc#1225750 CVE-2024-36895).
- Update
  patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
  (git-fixes bsc#1225748 CVE-2024-36893).
- Update
  patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
  (stable-fixes bsc#1225769 CVE-2024-36921).
- Update
  patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
  (stable-fixes CVE-2024-36922).
- Update
  patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
  (git-fixes CVE-2024-36941).
- Update
  patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
  (git-fixes bsc#1224742 CVE-2024-35803).
- commit 539780f</changelog>
  <changelog author="dwagner@suse.de" date="1717416006">- nvmet: fix ns enable/disable possible hang (git-fixes).
- nvme-multipath: fix io accounting on failover (git-fixes).
- nvme: fix multipath batched completion accounting (git-fixes).
- commit ed3b392</changelog>
  <changelog author="dwagner@suse.de" date="1717416007">- scsi: lpfc: Copyright updates for 14.4.0.2 patches
  (bsc#1225842).
- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
  (bsc#1225842).
  Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
  (bsc#1225842).
- scsi: lpfc: Clear deferred RSCN processing flag when driver
  is unloading (bsc#1225842).
- scsi: lpfc: Update logging of protection type for T10 DIF I/O
  (bsc#1225842).
- scsi: lpfc: Change default logging level for unsolicited CT
  MIB commands (bsc#1225842).
- commit 5a56384</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416008">- smb: client: fix mount when dns_resolver key is not available
  (git-fixes, bsc#1225172).
- commit 28edb5c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416009">- cifs: fix leak of iface for primary channel (git-fixes,
  bsc#1225172).
- commit b7eb8e8</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416010">- Revert "cifs: reconnect work should have reference on server
  struct" (git-fixes, bsc#1225172).
- commit 3ca4c0c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416011">- smb: client: fix parsing of SMB3.1.1 POSIX create context
  (git-fixes, bsc#1225172).
- commit 5f27f69</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416012">- cifs: failure to add channel on iface should bump up weight
  (git-fixes, bsc#1225172).
- commit 007b237</changelog>
  <changelog author="tonyj@suse.de" date="1717416013">- perf/x86: Fix out of range data (git-fixes).
- perf/x86/intel/ds: Don't clear -&gt;pebs_data_cfg for the last
  PEBS event (git-fixes).
- perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
- commit 664d77f</changelog>
  <changelog author="dsterba@suse.com" date="1717588800">- blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
- Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
  Quoting bsc#1225945#c11:
  "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
  transaction for every subvol create")
  ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
  unwritten extent buffer after snapshotting a new subvolume") was never
  backported."
- commit d947258</changelog>
  <changelog author="tonyj@suse.de" date="1717588801">- perf pmu: Count sys and cpuid JSON events separately (git
  fixes).
- perf stat: Don't display metric header for non-leader uncore
  events (git-fixes).
- perf daemon: Fix file leak in daemon_session__control
  (git-fixes).
- perf symbols: Fix ownership of string in dso__load_vmlinux()
  (git-fixes).
- perf thread: Fixes to thread__new() related to initializing comm
  (git-fixes).
- perf report: Avoid SEGV in report__setup_sample_type()
  (git-fixes).
- perf ui browser: Don't save pointer to stack memory (git-fixes).
- perf bench internals inject-build-id: Fix trap divide when
  collecting just one DSO (git-fixes).
- perf intel-pt: Fix unassigned instruction op (discovered by
  MemorySanitizer) (git-fixes).
- perf test shell arm_coresight: Increase buffer size for
  Coresight basic tests (git-fixes).
- perf docs: Document bpf event modifier (git-fixes).
- perf bench uprobe: Remove lib64 from libc.so.6 binary path
  (git-fixes).
- perf record: Fix debug message placement for test consumption
  (git-fixes).
- perf tests: Apply attributes to all events in object code
  reading test (git-fixes).
- perf tests: Make "test data symbol" more robust on Neoverse N1
  (git-fixes).
- perf annotate: Fix annotation_calc_lines() to pass correct
  address to get_srcline() (git-fixes).
- perf stat: Do not fail on metrics on s390 z/VM systems
  (git-fixes).
- perf sched timehist: Fix -g/--call-graph option failure
  (git-fixes).
- perf annotate: Get rid of duplicate --group option item
  (git-fixes).
- perf probe: Add missing libgen.h header needed for using
  basename() (git-fixes).
- perf record: Delete session after stopping sideband thread
  (git-fixes).
- perf auxtrace: Fix multiple use of --itrace option (git-fixes).
- perf script: Show also errors for --insn-trace option
  (git-fixes).
- perf lock contention: Add a missing NULL check (git-fixes).
- perf vendor events amd: Fix Zen 4 cache latency events
  (git-fixes).
- libperf evlist: Avoid out-of-bounds access (git-fixes).
- perf pmu: Fix a potential memory leak in perf_pmu__lookup()
  (git-fixes).
- perf print-events: make is_event_supported() more robust
  (git-fixes).
- perf list: fix short description for some cache events
  (git-fixes).
- perf metric: Don't remove scale from counts (git-fixes).
- perf stat: Avoid metric-only segv (git-fixes).
- perf expr: Fix "has_event" function for metric style events
  (git-fixes).
- perf srcline: Add missed addr2line closes (git-fixes).
- perf thread_map: Free strlist on normal path in
  thread_map__new_by_tid_str() (git-fixes).
- perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
- perf jevents: Drop or simplify small integer values (git-fixes).
- perf evsel: Fix duplicate initialization of data-&gt;id in
  evsel__parse_sample() (git-fixes).
- perf pmu: Treat the msr pmu as software (git-fixes).
- perf record: Check conflict between '--timestamp-filename'
  option and pipe mode before recording (git-fixes).
- perf record: Fix possible incorrect free in
  record__switch_output() (git-fixes).
- perf vendor events amd: Add Zen 4 memory controller events
  (git-fixes).
- perf top: Uniform the event name for the hybrid machine
  (git-fixes).
- perf top: Use evsel's cpus to replace user_requested_cpus
  (git-fixes).
- commit a1f9340</changelog>
  <changelog author="tonyj@suse.de" date="1717675200">- perf ui browser: Avoid SEGV on title (git fixes).
- commit 1578c22</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675201">- inet: inet_defrag: prevent sk release while still in use
  (CVE-2024-26921 bsc#1223138).
- commit 2016faf</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675202">- net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
- commit 7bf5961</changelog>
  <changelog author="tiwai@suse.de" date="1718366400">- Temporarily drop KVM patch that caused a regression (bsc#1226158)
  Delete patches.suse/KVM-x86-pmu-Prioritize-VMX-interception-over-GP-on-R.patch
- commit 33f31da</changelog>
</package>
<package pkgid="6d407f147a5aa6ff2ae0c586440487232436164750c19063666222a2e5e19cb4" name="dlm-kmp-default" arch="ppc64le">
  <version epoch="0" ver="6.4.0" rel="150600.23.7.3"/>
  <changelog author="mkubecek@suse.cz" date="1717416000">- netfilter: nf_tables: release mutex after nft_gc_seq_end from
  abort path (CVE-2024-26925 bsc#1223390).
- commit 578a709</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717416001">- Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
  The L3 bsc#1225765 was created seperately since our customer requires
  PTF.
- Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
- Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
- Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
- Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
- commit 054635e</changelog>
  <changelog author="msuchanek@suse.de" date="1717416002">- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
- powerpc/uaccess: Fix build errors seen with GCC 13/14
  (bsc#1194869).
- commit 46b5d84</changelog>
  <changelog author="msuchanek@suse.de" date="1717416003">- blacklist.conf: PPC fsl_msi is not used
- commit ae6590d</changelog>
  <changelog author="msuchanek@suse.de" date="1717416004">- powerpc/pseries/lparcfg: drop error message from guest name
  lookup (bsc#1187716 ltc#193451 git-fixes).
- commit ceab637</changelog>
  <changelog author="mfranc@suse.cz" date="1717416005">- Update
  patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
  (git-fixes CVE-2024-36955).
- Update
  patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
  (git-fixes bsc#1225715 CVE-2024-36906).
- Update
  patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
  (git-fixes bsc#1225579 CVE-2024-36011).
- Update
  patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
  (git-fixes bsc#1225578 CVE-2024-36013).
- Update
  patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
  (git-fixes bsc#1225502 CVE-2024-36012).
- Update
  patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
  (git-fixes bsc#1225722 CVE-2024-36880).
- Update
  patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
  (git-fixes CVE-2024-36942).
- Update
  patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
  (git-fixes bsc#1225720 CVE-2024-36032).
- Update
  patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
  (git-fixes bsc#1223749 CVE-2024-26990).
- Update
  patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
  (git-fixes bsc#1223692 CVE-2024-26992).
- Update
  patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
  (stable-fixes CVE-2024-36944).
- Update
  patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
  (git-fixes bsc#1225734 CVE-2024-36896).
- Update
  patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
  (stable-fixes CVE-2024-36949).
- Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
  (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
- Update
  patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
  (git-fixes bsc#1225692 CVE-2023-52882).
- Update
  patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
  (git-fixes CVE-2024-26761).
- Update
  patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
  (stable-fixes bsc#1225735 CVE-2024-36897).
- Update
  patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
  (stable-fixes bsc#1225705 CVE-2024-36026).
- Update
  patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
  (stable-fixes CVE-2024-36951).
- Update
  patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
  (git-fixes bsc#1225593 CVE-2024-36014).
- Update
  patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
  (stable-fixes bsc#1225728 CVE-2024-36885).
- Update
  patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
  (git-fixes bsc#1225773 CVE-2024-36936).
- Update
  patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
  (stable-fixes CVE-2024-36950).
- Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
  (git-fixes bsc#1225736 CVE-2024-36898).
- Update
  patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
  (git-fixes bsc#1225698 CVE-2024-36020).
- Update
  patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
  (git-fixes bsc#1225710 CVE-2024-36891).
- Update
  patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
  (git-fixes bsc#1225714 CVE-2024-36890).
- Update
  patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
  (git-fixes bsc#1225708 CVE-2024-36029).
- Update
  patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
  (git-fixes bsc#1225699 CVE-2024-36021).
- Update
  patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
  (git-fixes CVE-2024-26943).
- Update
  patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
  (git-fixes bsc#1225694 CVE-2024-36018).
- Update
  patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
  (git-fixes CVE-2024-36940).
- Update
  patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
  (git-fixes CVE-2024-36959).
- Update
  patches.suse/ppdev-Add-an-error-check-in-register_device.patch
  (git-fixes bsc#1225640 CVE-2024-36015).
- Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
  CVE-2024-36947).
- Update
  patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
  (git-fixes bsc#1225695 CVE-2024-36019).
- Update
  patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
  (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
- Update
  patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
  (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
- Update
  patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
  (git-fixes bsc#1225704 CVE-2024-36025).
- Update
  patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
  (git-fixes CVE-2024-36930).
- Update
  patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
  (bsc#1224331 bsc#1224602 CVE-2024-35814).
- Update
  patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
  (git-fixes bsc#1225642 CVE-2024-36016).
- Update
  patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
  (git-fixes bsc#1225749 CVE-2024-36894).
- Update
  patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
  (git-fixes bsc#1225750 CVE-2024-36895).
- Update
  patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
  (git-fixes bsc#1225748 CVE-2024-36893).
- Update
  patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
  (stable-fixes bsc#1225769 CVE-2024-36921).
- Update
  patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
  (stable-fixes CVE-2024-36922).
- Update
  patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
  (git-fixes CVE-2024-36941).
- Update
  patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
  (git-fixes bsc#1224742 CVE-2024-35803).
- commit 539780f</changelog>
  <changelog author="dwagner@suse.de" date="1717416006">- nvmet: fix ns enable/disable possible hang (git-fixes).
- nvme-multipath: fix io accounting on failover (git-fixes).
- nvme: fix multipath batched completion accounting (git-fixes).
- commit ed3b392</changelog>
  <changelog author="dwagner@suse.de" date="1717416007">- scsi: lpfc: Copyright updates for 14.4.0.2 patches
  (bsc#1225842).
- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
  (bsc#1225842).
  Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
  (bsc#1225842).
- scsi: lpfc: Clear deferred RSCN processing flag when driver
  is unloading (bsc#1225842).
- scsi: lpfc: Update logging of protection type for T10 DIF I/O
  (bsc#1225842).
- scsi: lpfc: Change default logging level for unsolicited CT
  MIB commands (bsc#1225842).
- commit 5a56384</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416008">- smb: client: fix mount when dns_resolver key is not available
  (git-fixes, bsc#1225172).
- commit 28edb5c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416009">- cifs: fix leak of iface for primary channel (git-fixes,
  bsc#1225172).
- commit b7eb8e8</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416010">- Revert "cifs: reconnect work should have reference on server
  struct" (git-fixes, bsc#1225172).
- commit 3ca4c0c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416011">- smb: client: fix parsing of SMB3.1.1 POSIX create context
  (git-fixes, bsc#1225172).
- commit 5f27f69</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416012">- cifs: failure to add channel on iface should bump up weight
  (git-fixes, bsc#1225172).
- commit 007b237</changelog>
  <changelog author="tonyj@suse.de" date="1717416013">- perf/x86: Fix out of range data (git-fixes).
- perf/x86/intel/ds: Don't clear -&gt;pebs_data_cfg for the last
  PEBS event (git-fixes).
- perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
- commit 664d77f</changelog>
  <changelog author="dsterba@suse.com" date="1717588800">- blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
- Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
  Quoting bsc#1225945#c11:
  "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
  transaction for every subvol create")
  ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
  unwritten extent buffer after snapshotting a new subvolume") was never
  backported."
- commit d947258</changelog>
  <changelog author="tonyj@suse.de" date="1717588801">- perf pmu: Count sys and cpuid JSON events separately (git
  fixes).
- perf stat: Don't display metric header for non-leader uncore
  events (git-fixes).
- perf daemon: Fix file leak in daemon_session__control
  (git-fixes).
- perf symbols: Fix ownership of string in dso__load_vmlinux()
  (git-fixes).
- perf thread: Fixes to thread__new() related to initializing comm
  (git-fixes).
- perf report: Avoid SEGV in report__setup_sample_type()
  (git-fixes).
- perf ui browser: Don't save pointer to stack memory (git-fixes).
- perf bench internals inject-build-id: Fix trap divide when
  collecting just one DSO (git-fixes).
- perf intel-pt: Fix unassigned instruction op (discovered by
  MemorySanitizer) (git-fixes).
- perf test shell arm_coresight: Increase buffer size for
  Coresight basic tests (git-fixes).
- perf docs: Document bpf event modifier (git-fixes).
- perf bench uprobe: Remove lib64 from libc.so.6 binary path
  (git-fixes).
- perf record: Fix debug message placement for test consumption
  (git-fixes).
- perf tests: Apply attributes to all events in object code
  reading test (git-fixes).
- perf tests: Make "test data symbol" more robust on Neoverse N1
  (git-fixes).
- perf annotate: Fix annotation_calc_lines() to pass correct
  address to get_srcline() (git-fixes).
- perf stat: Do not fail on metrics on s390 z/VM systems
  (git-fixes).
- perf sched timehist: Fix -g/--call-graph option failure
  (git-fixes).
- perf annotate: Get rid of duplicate --group option item
  (git-fixes).
- perf probe: Add missing libgen.h header needed for using
  basename() (git-fixes).
- perf record: Delete session after stopping sideband thread
  (git-fixes).
- perf auxtrace: Fix multiple use of --itrace option (git-fixes).
- perf script: Show also errors for --insn-trace option
  (git-fixes).
- perf lock contention: Add a missing NULL check (git-fixes).
- perf vendor events amd: Fix Zen 4 cache latency events
  (git-fixes).
- libperf evlist: Avoid out-of-bounds access (git-fixes).
- perf pmu: Fix a potential memory leak in perf_pmu__lookup()
  (git-fixes).
- perf print-events: make is_event_supported() more robust
  (git-fixes).
- perf list: fix short description for some cache events
  (git-fixes).
- perf metric: Don't remove scale from counts (git-fixes).
- perf stat: Avoid metric-only segv (git-fixes).
- perf expr: Fix "has_event" function for metric style events
  (git-fixes).
- perf srcline: Add missed addr2line closes (git-fixes).
- perf thread_map: Free strlist on normal path in
  thread_map__new_by_tid_str() (git-fixes).
- perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
- perf jevents: Drop or simplify small integer values (git-fixes).
- perf evsel: Fix duplicate initialization of data-&gt;id in
  evsel__parse_sample() (git-fixes).
- perf pmu: Treat the msr pmu as software (git-fixes).
- perf record: Check conflict between '--timestamp-filename'
  option and pipe mode before recording (git-fixes).
- perf record: Fix possible incorrect free in
  record__switch_output() (git-fixes).
- perf vendor events amd: Add Zen 4 memory controller events
  (git-fixes).
- perf top: Uniform the event name for the hybrid machine
  (git-fixes).
- perf top: Use evsel's cpus to replace user_requested_cpus
  (git-fixes).
- commit a1f9340</changelog>
  <changelog author="tonyj@suse.de" date="1717675200">- perf ui browser: Avoid SEGV on title (git fixes).
- commit 1578c22</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675201">- inet: inet_defrag: prevent sk release while still in use
  (CVE-2024-26921 bsc#1223138).
- commit 2016faf</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675202">- net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
- commit 7bf5961</changelog>
  <changelog author="tiwai@suse.de" date="1718366400">- Temporarily drop KVM patch that caused a regression (bsc#1226158)
  Delete patches.suse/KVM-x86-pmu-Prioritize-VMX-interception-over-GP-on-R.patch
- commit 33f31da</changelog>
</package>
<package pkgid="ea0395195960ad0ff32f2186a03d8a127194c79401331455c0e61e6f15ba1e4b" name="dlm-kmp-default" arch="s390x">
  <version epoch="0" ver="6.4.0" rel="150600.23.7.3"/>
  <changelog author="mkubecek@suse.cz" date="1717416000">- netfilter: nf_tables: release mutex after nft_gc_seq_end from
  abort path (CVE-2024-26925 bsc#1223390).
- commit 578a709</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717416001">- Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
  The L3 bsc#1225765 was created seperately since our customer requires
  PTF.
- Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
- Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
- Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
- Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
- commit 054635e</changelog>
  <changelog author="msuchanek@suse.de" date="1717416002">- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
- powerpc/uaccess: Fix build errors seen with GCC 13/14
  (bsc#1194869).
- commit 46b5d84</changelog>
  <changelog author="msuchanek@suse.de" date="1717416003">- blacklist.conf: PPC fsl_msi is not used
- commit ae6590d</changelog>
  <changelog author="msuchanek@suse.de" date="1717416004">- powerpc/pseries/lparcfg: drop error message from guest name
  lookup (bsc#1187716 ltc#193451 git-fixes).
- commit ceab637</changelog>
  <changelog author="mfranc@suse.cz" date="1717416005">- Update
  patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
  (git-fixes CVE-2024-36955).
- Update
  patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
  (git-fixes bsc#1225715 CVE-2024-36906).
- Update
  patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
  (git-fixes bsc#1225579 CVE-2024-36011).
- Update
  patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
  (git-fixes bsc#1225578 CVE-2024-36013).
- Update
  patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
  (git-fixes bsc#1225502 CVE-2024-36012).
- Update
  patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
  (git-fixes bsc#1225722 CVE-2024-36880).
- Update
  patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
  (git-fixes CVE-2024-36942).
- Update
  patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
  (git-fixes bsc#1225720 CVE-2024-36032).
- Update
  patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
  (git-fixes bsc#1223749 CVE-2024-26990).
- Update
  patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
  (git-fixes bsc#1223692 CVE-2024-26992).
- Update
  patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
  (stable-fixes CVE-2024-36944).
- Update
  patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
  (git-fixes bsc#1225734 CVE-2024-36896).
- Update
  patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
  (stable-fixes CVE-2024-36949).
- Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
  (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
- Update
  patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
  (git-fixes bsc#1225692 CVE-2023-52882).
- Update
  patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
  (git-fixes CVE-2024-26761).
- Update
  patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
  (stable-fixes bsc#1225735 CVE-2024-36897).
- Update
  patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
  (stable-fixes bsc#1225705 CVE-2024-36026).
- Update
  patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
  (stable-fixes CVE-2024-36951).
- Update
  patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
  (git-fixes bsc#1225593 CVE-2024-36014).
- Update
  patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
  (stable-fixes bsc#1225728 CVE-2024-36885).
- Update
  patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
  (git-fixes bsc#1225773 CVE-2024-36936).
- Update
  patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
  (stable-fixes CVE-2024-36950).
- Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
  (git-fixes bsc#1225736 CVE-2024-36898).
- Update
  patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
  (git-fixes bsc#1225698 CVE-2024-36020).
- Update
  patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
  (git-fixes bsc#1225710 CVE-2024-36891).
- Update
  patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
  (git-fixes bsc#1225714 CVE-2024-36890).
- Update
  patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
  (git-fixes bsc#1225708 CVE-2024-36029).
- Update
  patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
  (git-fixes bsc#1225699 CVE-2024-36021).
- Update
  patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
  (git-fixes CVE-2024-26943).
- Update
  patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
  (git-fixes bsc#1225694 CVE-2024-36018).
- Update
  patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
  (git-fixes CVE-2024-36940).
- Update
  patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
  (git-fixes CVE-2024-36959).
- Update
  patches.suse/ppdev-Add-an-error-check-in-register_device.patch
  (git-fixes bsc#1225640 CVE-2024-36015).
- Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
  CVE-2024-36947).
- Update
  patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
  (git-fixes bsc#1225695 CVE-2024-36019).
- Update
  patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
  (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
- Update
  patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
  (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
- Update
  patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
  (git-fixes bsc#1225704 CVE-2024-36025).
- Update
  patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
  (git-fixes CVE-2024-36930).
- Update
  patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
  (bsc#1224331 bsc#1224602 CVE-2024-35814).
- Update
  patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
  (git-fixes bsc#1225642 CVE-2024-36016).
- Update
  patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
  (git-fixes bsc#1225749 CVE-2024-36894).
- Update
  patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
  (git-fixes bsc#1225750 CVE-2024-36895).
- Update
  patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
  (git-fixes bsc#1225748 CVE-2024-36893).
- Update
  patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
  (stable-fixes bsc#1225769 CVE-2024-36921).
- Update
  patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
  (stable-fixes CVE-2024-36922).
- Update
  patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
  (git-fixes CVE-2024-36941).
- Update
  patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
  (git-fixes bsc#1224742 CVE-2024-35803).
- commit 539780f</changelog>
  <changelog author="dwagner@suse.de" date="1717416006">- nvmet: fix ns enable/disable possible hang (git-fixes).
- nvme-multipath: fix io accounting on failover (git-fixes).
- nvme: fix multipath batched completion accounting (git-fixes).
- commit ed3b392</changelog>
  <changelog author="dwagner@suse.de" date="1717416007">- scsi: lpfc: Copyright updates for 14.4.0.2 patches
  (bsc#1225842).
- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
  (bsc#1225842).
  Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
  (bsc#1225842).
- scsi: lpfc: Clear deferred RSCN processing flag when driver
  is unloading (bsc#1225842).
- scsi: lpfc: Update logging of protection type for T10 DIF I/O
  (bsc#1225842).
- scsi: lpfc: Change default logging level for unsolicited CT
  MIB commands (bsc#1225842).
- commit 5a56384</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416008">- smb: client: fix mount when dns_resolver key is not available
  (git-fixes, bsc#1225172).
- commit 28edb5c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416009">- cifs: fix leak of iface for primary channel (git-fixes,
  bsc#1225172).
- commit b7eb8e8</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416010">- Revert "cifs: reconnect work should have reference on server
  struct" (git-fixes, bsc#1225172).
- commit 3ca4c0c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416011">- smb: client: fix parsing of SMB3.1.1 POSIX create context
  (git-fixes, bsc#1225172).
- commit 5f27f69</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416012">- cifs: failure to add channel on iface should bump up weight
  (git-fixes, bsc#1225172).
- commit 007b237</changelog>
  <changelog author="tonyj@suse.de" date="1717416013">- perf/x86: Fix out of range data (git-fixes).
- perf/x86/intel/ds: Don't clear -&gt;pebs_data_cfg for the last
  PEBS event (git-fixes).
- perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
- commit 664d77f</changelog>
  <changelog author="dsterba@suse.com" date="1717588800">- blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
- Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
  Quoting bsc#1225945#c11:
  "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
  transaction for every subvol create")
  ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
  unwritten extent buffer after snapshotting a new subvolume") was never
  backported."
- commit d947258</changelog>
  <changelog author="tonyj@suse.de" date="1717588801">- perf pmu: Count sys and cpuid JSON events separately (git
  fixes).
- perf stat: Don't display metric header for non-leader uncore
  events (git-fixes).
- perf daemon: Fix file leak in daemon_session__control
  (git-fixes).
- perf symbols: Fix ownership of string in dso__load_vmlinux()
  (git-fixes).
- perf thread: Fixes to thread__new() related to initializing comm
  (git-fixes).
- perf report: Avoid SEGV in report__setup_sample_type()
  (git-fixes).
- perf ui browser: Don't save pointer to stack memory (git-fixes).
- perf bench internals inject-build-id: Fix trap divide when
  collecting just one DSO (git-fixes).
- perf intel-pt: Fix unassigned instruction op (discovered by
  MemorySanitizer) (git-fixes).
- perf test shell arm_coresight: Increase buffer size for
  Coresight basic tests (git-fixes).
- perf docs: Document bpf event modifier (git-fixes).
- perf bench uprobe: Remove lib64 from libc.so.6 binary path
  (git-fixes).
- perf record: Fix debug message placement for test consumption
  (git-fixes).
- perf tests: Apply attributes to all events in object code
  reading test (git-fixes).
- perf tests: Make "test data symbol" more robust on Neoverse N1
  (git-fixes).
- perf annotate: Fix annotation_calc_lines() to pass correct
  address to get_srcline() (git-fixes).
- perf stat: Do not fail on metrics on s390 z/VM systems
  (git-fixes).
- perf sched timehist: Fix -g/--call-graph option failure
  (git-fixes).
- perf annotate: Get rid of duplicate --group option item
  (git-fixes).
- perf probe: Add missing libgen.h header needed for using
  basename() (git-fixes).
- perf record: Delete session after stopping sideband thread
  (git-fixes).
- perf auxtrace: Fix multiple use of --itrace option (git-fixes).
- perf script: Show also errors for --insn-trace option
  (git-fixes).
- perf lock contention: Add a missing NULL check (git-fixes).
- perf vendor events amd: Fix Zen 4 cache latency events
  (git-fixes).
- libperf evlist: Avoid out-of-bounds access (git-fixes).
- perf pmu: Fix a potential memory leak in perf_pmu__lookup()
  (git-fixes).
- perf print-events: make is_event_supported() more robust
  (git-fixes).
- perf list: fix short description for some cache events
  (git-fixes).
- perf metric: Don't remove scale from counts (git-fixes).
- perf stat: Avoid metric-only segv (git-fixes).
- perf expr: Fix "has_event" function for metric style events
  (git-fixes).
- perf srcline: Add missed addr2line closes (git-fixes).
- perf thread_map: Free strlist on normal path in
  thread_map__new_by_tid_str() (git-fixes).
- perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
- perf jevents: Drop or simplify small integer values (git-fixes).
- perf evsel: Fix duplicate initialization of data-&gt;id in
  evsel__parse_sample() (git-fixes).
- perf pmu: Treat the msr pmu as software (git-fixes).
- perf record: Check conflict between '--timestamp-filename'
  option and pipe mode before recording (git-fixes).
- perf record: Fix possible incorrect free in
  record__switch_output() (git-fixes).
- perf vendor events amd: Add Zen 4 memory controller events
  (git-fixes).
- perf top: Uniform the event name for the hybrid machine
  (git-fixes).
- perf top: Use evsel's cpus to replace user_requested_cpus
  (git-fixes).
- commit a1f9340</changelog>
  <changelog author="tonyj@suse.de" date="1717675200">- perf ui browser: Avoid SEGV on title (git fixes).
- commit 1578c22</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675201">- inet: inet_defrag: prevent sk release while still in use
  (CVE-2024-26921 bsc#1223138).
- commit 2016faf</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675202">- net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
- commit 7bf5961</changelog>
  <changelog author="tiwai@suse.de" date="1718366400">- Temporarily drop KVM patch that caused a regression (bsc#1226158)
  Delete patches.suse/KVM-x86-pmu-Prioritize-VMX-interception-over-GP-on-R.patch
- commit 33f31da</changelog>
</package>
<package pkgid="fe9664c014bd869bb6a1cfd44ae7db54d373b81d736e308fede5ca13fb5dfb8e" name="dlm-kmp-default" arch="x86_64">
  <version epoch="0" ver="6.4.0" rel="150600.23.7.3"/>
  <changelog author="mkubecek@suse.cz" date="1717416000">- netfilter: nf_tables: release mutex after nft_gc_seq_end from
  abort path (CVE-2024-26925 bsc#1223390).
- commit 578a709</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717416001">- Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
  The L3 bsc#1225765 was created seperately since our customer requires
  PTF.
- Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
- Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
- Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
- Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
- commit 054635e</changelog>
  <changelog author="msuchanek@suse.de" date="1717416002">- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
- powerpc/uaccess: Fix build errors seen with GCC 13/14
  (bsc#1194869).
- commit 46b5d84</changelog>
  <changelog author="msuchanek@suse.de" date="1717416003">- blacklist.conf: PPC fsl_msi is not used
- commit ae6590d</changelog>
  <changelog author="msuchanek@suse.de" date="1717416004">- powerpc/pseries/lparcfg: drop error message from guest name
  lookup (bsc#1187716 ltc#193451 git-fixes).
- commit ceab637</changelog>
  <changelog author="mfranc@suse.cz" date="1717416005">- Update
  patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
  (git-fixes CVE-2024-36955).
- Update
  patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
  (git-fixes bsc#1225715 CVE-2024-36906).
- Update
  patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
  (git-fixes bsc#1225579 CVE-2024-36011).
- Update
  patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
  (git-fixes bsc#1225578 CVE-2024-36013).
- Update
  patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
  (git-fixes bsc#1225502 CVE-2024-36012).
- Update
  patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
  (git-fixes bsc#1225722 CVE-2024-36880).
- Update
  patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
  (git-fixes CVE-2024-36942).
- Update
  patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
  (git-fixes bsc#1225720 CVE-2024-36032).
- Update
  patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
  (git-fixes bsc#1223749 CVE-2024-26990).
- Update
  patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
  (git-fixes bsc#1223692 CVE-2024-26992).
- Update
  patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
  (stable-fixes CVE-2024-36944).
- Update
  patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
  (git-fixes bsc#1225734 CVE-2024-36896).
- Update
  patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
  (stable-fixes CVE-2024-36949).
- Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
  (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
- Update
  patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
  (git-fixes bsc#1225692 CVE-2023-52882).
- Update
  patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
  (git-fixes CVE-2024-26761).
- Update
  patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
  (stable-fixes bsc#1225735 CVE-2024-36897).
- Update
  patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
  (stable-fixes bsc#1225705 CVE-2024-36026).
- Update
  patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
  (stable-fixes CVE-2024-36951).
- Update
  patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
  (git-fixes bsc#1225593 CVE-2024-36014).
- Update
  patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
  (stable-fixes bsc#1225728 CVE-2024-36885).
- Update
  patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
  (git-fixes bsc#1225773 CVE-2024-36936).
- Update
  patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
  (stable-fixes CVE-2024-36950).
- Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
  (git-fixes bsc#1225736 CVE-2024-36898).
- Update
  patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
  (git-fixes bsc#1225698 CVE-2024-36020).
- Update
  patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
  (git-fixes bsc#1225710 CVE-2024-36891).
- Update
  patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
  (git-fixes bsc#1225714 CVE-2024-36890).
- Update
  patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
  (git-fixes bsc#1225708 CVE-2024-36029).
- Update
  patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
  (git-fixes bsc#1225699 CVE-2024-36021).
- Update
  patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
  (git-fixes CVE-2024-26943).
- Update
  patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
  (git-fixes bsc#1225694 CVE-2024-36018).
- Update
  patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
  (git-fixes CVE-2024-36940).
- Update
  patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
  (git-fixes CVE-2024-36959).
- Update
  patches.suse/ppdev-Add-an-error-check-in-register_device.patch
  (git-fixes bsc#1225640 CVE-2024-36015).
- Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
  CVE-2024-36947).
- Update
  patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
  (git-fixes bsc#1225695 CVE-2024-36019).
- Update
  patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
  (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
- Update
  patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
  (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
- Update
  patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
  (git-fixes bsc#1225704 CVE-2024-36025).
- Update
  patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
  (git-fixes CVE-2024-36930).
- Update
  patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
  (bsc#1224331 bsc#1224602 CVE-2024-35814).
- Update
  patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
  (git-fixes bsc#1225642 CVE-2024-36016).
- Update
  patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
  (git-fixes bsc#1225749 CVE-2024-36894).
- Update
  patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
  (git-fixes bsc#1225750 CVE-2024-36895).
- Update
  patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
  (git-fixes bsc#1225748 CVE-2024-36893).
- Update
  patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
  (stable-fixes bsc#1225769 CVE-2024-36921).
- Update
  patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
  (stable-fixes CVE-2024-36922).
- Update
  patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
  (git-fixes CVE-2024-36941).
- Update
  patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
  (git-fixes bsc#1224742 CVE-2024-35803).
- commit 539780f</changelog>
  <changelog author="dwagner@suse.de" date="1717416006">- nvmet: fix ns enable/disable possible hang (git-fixes).
- nvme-multipath: fix io accounting on failover (git-fixes).
- nvme: fix multipath batched completion accounting (git-fixes).
- commit ed3b392</changelog>
  <changelog author="dwagner@suse.de" date="1717416007">- scsi: lpfc: Copyright updates for 14.4.0.2 patches
  (bsc#1225842).
- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
  (bsc#1225842).
  Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
  (bsc#1225842).
- scsi: lpfc: Clear deferred RSCN processing flag when driver
  is unloading (bsc#1225842).
- scsi: lpfc: Update logging of protection type for T10 DIF I/O
  (bsc#1225842).
- scsi: lpfc: Change default logging level for unsolicited CT
  MIB commands (bsc#1225842).
- commit 5a56384</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416008">- smb: client: fix mount when dns_resolver key is not available
  (git-fixes, bsc#1225172).
- commit 28edb5c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416009">- cifs: fix leak of iface for primary channel (git-fixes,
  bsc#1225172).
- commit b7eb8e8</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416010">- Revert "cifs: reconnect work should have reference on server
  struct" (git-fixes, bsc#1225172).
- commit 3ca4c0c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416011">- smb: client: fix parsing of SMB3.1.1 POSIX create context
  (git-fixes, bsc#1225172).
- commit 5f27f69</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416012">- cifs: failure to add channel on iface should bump up weight
  (git-fixes, bsc#1225172).
- commit 007b237</changelog>
  <changelog author="tonyj@suse.de" date="1717416013">- perf/x86: Fix out of range data (git-fixes).
- perf/x86/intel/ds: Don't clear -&gt;pebs_data_cfg for the last
  PEBS event (git-fixes).
- perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
- commit 664d77f</changelog>
  <changelog author="dsterba@suse.com" date="1717588800">- blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
- Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
  Quoting bsc#1225945#c11:
  "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
  transaction for every subvol create")
  ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
  unwritten extent buffer after snapshotting a new subvolume") was never
  backported."
- commit d947258</changelog>
  <changelog author="tonyj@suse.de" date="1717588801">- perf pmu: Count sys and cpuid JSON events separately (git
  fixes).
- perf stat: Don't display metric header for non-leader uncore
  events (git-fixes).
- perf daemon: Fix file leak in daemon_session__control
  (git-fixes).
- perf symbols: Fix ownership of string in dso__load_vmlinux()
  (git-fixes).
- perf thread: Fixes to thread__new() related to initializing comm
  (git-fixes).
- perf report: Avoid SEGV in report__setup_sample_type()
  (git-fixes).
- perf ui browser: Don't save pointer to stack memory (git-fixes).
- perf bench internals inject-build-id: Fix trap divide when
  collecting just one DSO (git-fixes).
- perf intel-pt: Fix unassigned instruction op (discovered by
  MemorySanitizer) (git-fixes).
- perf test shell arm_coresight: Increase buffer size for
  Coresight basic tests (git-fixes).
- perf docs: Document bpf event modifier (git-fixes).
- perf bench uprobe: Remove lib64 from libc.so.6 binary path
  (git-fixes).
- perf record: Fix debug message placement for test consumption
  (git-fixes).
- perf tests: Apply attributes to all events in object code
  reading test (git-fixes).
- perf tests: Make "test data symbol" more robust on Neoverse N1
  (git-fixes).
- perf annotate: Fix annotation_calc_lines() to pass correct
  address to get_srcline() (git-fixes).
- perf stat: Do not fail on metrics on s390 z/VM systems
  (git-fixes).
- perf sched timehist: Fix -g/--call-graph option failure
  (git-fixes).
- perf annotate: Get rid of duplicate --group option item
  (git-fixes).
- perf probe: Add missing libgen.h header needed for using
  basename() (git-fixes).
- perf record: Delete session after stopping sideband thread
  (git-fixes).
- perf auxtrace: Fix multiple use of --itrace option (git-fixes).
- perf script: Show also errors for --insn-trace option
  (git-fixes).
- perf lock contention: Add a missing NULL check (git-fixes).
- perf vendor events amd: Fix Zen 4 cache latency events
  (git-fixes).
- libperf evlist: Avoid out-of-bounds access (git-fixes).
- perf pmu: Fix a potential memory leak in perf_pmu__lookup()
  (git-fixes).
- perf print-events: make is_event_supported() more robust
  (git-fixes).
- perf list: fix short description for some cache events
  (git-fixes).
- perf metric: Don't remove scale from counts (git-fixes).
- perf stat: Avoid metric-only segv (git-fixes).
- perf expr: Fix "has_event" function for metric style events
  (git-fixes).
- perf srcline: Add missed addr2line closes (git-fixes).
- perf thread_map: Free strlist on normal path in
  thread_map__new_by_tid_str() (git-fixes).
- perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
- perf jevents: Drop or simplify small integer values (git-fixes).
- perf evsel: Fix duplicate initialization of data-&gt;id in
  evsel__parse_sample() (git-fixes).
- perf pmu: Treat the msr pmu as software (git-fixes).
- perf record: Check conflict between '--timestamp-filename'
  option and pipe mode before recording (git-fixes).
- perf record: Fix possible incorrect free in
  record__switch_output() (git-fixes).
- perf vendor events amd: Add Zen 4 memory controller events
  (git-fixes).
- perf top: Uniform the event name for the hybrid machine
  (git-fixes).
- perf top: Use evsel's cpus to replace user_requested_cpus
  (git-fixes).
- commit a1f9340</changelog>
  <changelog author="tonyj@suse.de" date="1717675200">- perf ui browser: Avoid SEGV on title (git fixes).
- commit 1578c22</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675201">- inet: inet_defrag: prevent sk release while still in use
  (CVE-2024-26921 bsc#1223138).
- commit 2016faf</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675202">- net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
- commit 7bf5961</changelog>
  <changelog author="tiwai@suse.de" date="1718366400">- Temporarily drop KVM patch that caused a regression (bsc#1226158)
  Delete patches.suse/KVM-x86-pmu-Prioritize-VMX-interception-over-GP-on-R.patch
- commit 33f31da</changelog>
</package>
<package pkgid="6cbe301551dfca2302441f66daedb386d20c23cab1e1205d71c944c8cc4f83b4" name="dlm-kmp-rt" arch="x86_64">
  <version epoch="0" ver="6.4.0" rel="150600.10.5.1"/>
  <changelog author="tiwai@suse.de" date="1722081600">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
  <changelog author="pmladek@suse.com" date="1723204800">- blacklist.conf: printk/sysctl: breaks kernel without pre-requisite
  patches (bsc#1229025)
- Delete
  patches.suse/printk-Remove-the-now-superfluous-sentinel-elements-from-ctl_table-array.patch.
- commit db77a25</changelog>
</package>
<package pkgid="3cf5518f1b29ed33cbebfcd58ea2c6d9be00181bd9d633dd791714fb0cb030d4" name="dlm-kmp-rt" arch="x86_64">
  <version epoch="0" ver="6.4.0" rel="150600.10.8.3"/>
  <changelog author="lhenriques@suse.de" date="1725019200">- virtiofs: forbid newlines in tags (bsc#1229940).
- commit 61514ce</changelog>
  <changelog author="lhenriques@suse.de" date="1725019201">- blacklist.conf: add 053fc4f755ad fuse: fix UAF in rcu pathwalks
  This commit breaks kABI and the data structure has no free room for the
  extra field, i.e. memcpy would fail to copy the additional member added by
  this patch.
- commit 941b81c</changelog>
  <changelog author="vkarasulli@suse.de" date="1725019202">- iommufd/device: Fix hwpt at err_unresv in
  iommufd_device_do_replace() (git-fixes).
- commit bbc9a65</changelog>
  <changelog author="vkarasulli@suse.de" date="1725019203">- iommu/vt-d: Fix identity map bounds in si_domain_init()
  (git-fixes).
- commit b4d27e5</changelog>
  <changelog author="lduncan@suse.com" date="1725019204">- scsi: lpfc: Fix a possible null pointer dereference (bsc#1229315
  CVE-2024-43821).
- commit eb73e94</changelog>
  <changelog author="vkarasulli@suse.de" date="1725019205">- iommu/amd: Convert comma to semicolon (git-fixes).
- commit 2714d8b</changelog>
  <changelog author="mkoutny@suse.com" date="1725019206">- Update
  patches.suse/0001-net-rds-fix-possible-cp-null-dereference.patch
  (git-fixes CVE-2024-35902 bsc#1224496).
- Update
  patches.suse/ASoC-TAS2781-Fix-tasdev_load_calibrated_data.patch
  (git-fixes CVE-2024-42278 bsc#1229403).
- Update
  patches.suse/ASoC-amd-Adjust-error-handling-in-case-of-absent-cod.patch
  (git-fixes CVE-2024-43818 bsc#1229296).
- Update
  patches.suse/ASoC-fsl-fsl_qmc_audio-Check-devm_kasprintf-returned.patch
  (git-fixes CVE-2024-42298 bsc#1229369).
- Update
  patches.suse/Bluetooth-MGMT-Add-error-handling-to-pair_device.patch
  (git-fixes CVE-2024-43884 bsc#1229739).
- Update
  patches.suse/KVM-Always-flush-async-PF-workqueue-when-vCPU-is-bei.patch
  (git-fixes CVE-2024-26976 bsc#1223635).
- Update
  patches.suse/PCI-DPC-Fix-use-after-free-on-concurrent-DPC-and-hot.patch
  (git-fixes CVE-2024-42302 bsc#1229366).
- Update
  patches.suse/PCI-endpoint-Clean-up-error-handling-in-vpci_scan_bu.patch
  (git-fixes CVE-2024-43875 bsc#1229486).
- Update
  patches.suse/PCI-endpoint-pci-epf-test-Make-use-of-cached-epc_fea.patch
  (git-fixes CVE-2024-43824 bsc#1229320).
- Update
  patches.suse/PCI-keystone-Fix-NULL-pointer-dereference-in-case-of.patch
  (git-fixes CVE-2024-43823 bsc#1229303).
- Update
  patches.suse/PCI-rcar-Demote-WARN-to-dev_warn_ratelimited-in-rcar.patch
  (git-fixes CVE-2024-43876 bsc#1229485).
- Update
  patches.suse/RDMA-hns-Fix-soft-lockup-under-heavy-CEQE-load.patch
  (git-fixes CVE-2024-43872 bsc#1229489).
- Update
  patches.suse/RDMA-iwcm-Fix-a-use-after-free-related-to-destroying.patch
  (git-fixes CVE-2024-42285 bsc#1229381).
- Update
  patches.suse/Revert-ALSA-firewire-lib-operate-for-period-elapse-e.patch
  (bsc#1208783 CVE-2024-42274 bsc#1229417).
- Update
  patches.suse/SUNRPC-add-a-missing-rpc_stat-for-TCP-TLS.patch
  (git-fixes CVE-2024-36907 bsc#1225751).
- Update
  patches.suse/bpf-arm64-Fix-trampoline-for-BPF_TRAMP_F_CALL_ORIG.patch
  (git-fixes CVE-2024-43840 bsc#1229344).
- Update
  patches.suse/btrfs-fix-double-inode-unlock-for-direct-IO-sync-wri.patch
  (git-fixes CVE-2024-43885 bsc#1229747).
- Update
  patches.suse/btrfs-fix-extent-map-use-after-free-when-adding-page.patch
  (git-fixes CVE-2024-42314 bsc#1229355).
- Update
  patches.suse/cgroup-cpuset-Prevent-UAF-in-proc_cpuset_show.patch
  (bsc#1228801 CVE-2024-43853 bsc#1229292).
- Update
  patches.suse/crypto-ccp-Fix-null-pointer-dereference-in-__sev_snp.patch
  (git-fixes CVE-2024-43874 bsc#1229487).
- Update
  patches.suse/devres-Fix-memory-leakage-caused-by-driver-API-devm_.patch
  (git-fixes CVE-2024-43871 bsc#1229490).
- Update
  patches.suse/dma-fix-call-order-in-dmam_free_coherent.patch
  (git-fixes CVE-2024-43856 bsc#1229346).
- Update
  patches.suse/drm-admgpu-fix-dereferencing-null-pointer-context.patch
  (stable-fixes CVE-2024-43906 bsc#1229785).
- Update
  patches.suse/drm-amd-display-Add-NULL-check-for-afb-before-derefe.patch
  (stable-fixes CVE-2024-43903 bsc#1229781).
- Update
  patches.suse/drm-amd-display-Add-null-checker-before-passing-vari.patch
  (stable-fixes CVE-2024-43902 bsc#1229767).
- Update
  patches.suse/drm-amd-display-Skip-Recompute-DSC-Params-if-no-Stre.patch
  (stable-fixes CVE-2024-43895 bsc#1229755).
- Update
  patches.suse/drm-amd-pm-Fix-the-null-pointer-dereference-for-vega.patch
  (stable-fixes CVE-2024-43905 bsc#1229784).
- Update
  patches.suse/drm-amdgpu-Fix-the-null-pointer-dereference-to-ras_m.patch
  (stable-fixes CVE-2024-43908 bsc#1229788).
- Update
  patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-for-s.patch
  (stable-fixes CVE-2024-43909 bsc#1229789).
- Update
  patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-in-ap.patch
  (stable-fixes CVE-2024-43907 bsc#1229787).
- Update
  patches.suse/drm-client-fix-null-pointer-dereference-in-drm_clien.patch
  (git-fixes CVE-2024-43894 bsc#1229746).
- Update
  patches.suse/drm-gma500-fix-null-pointer-dereference-in-cdv_intel.patch
  (git-fixes CVE-2024-42310 bsc#1229358).
- Update
  patches.suse/drm-gma500-fix-null-pointer-dereference-in-psb_intel.patch
  (git-fixes CVE-2024-42309 bsc#1229359).
- Update
  patches.suse/drm-nouveau-prime-fix-refcount-underflow.patch
  (git-fixes CVE-2024-43867 bsc#1229493).
- Update patches.suse/drm-qxl-Add-check-for-drm_cvt_mode.patch
  (git-fixes CVE-2024-43829 bsc#1229341).
- Update
  patches.suse/drm-vmwgfx-Fix-a-deadlock-in-dma-buf-fence-polling.patch
  (git-fixes CVE-2024-43863 bsc#1229497).
- Update
  patches.suse/exfat-fix-potential-deadlock-on-__exfat_get_dentry_set.patch
  (git-fixes CVE-2024-42315 bsc#1229354).
- Update
  patches.suse/gpio-prevent-potential-speculation-leaks-in-gpio_dev.patch
  (stable-fixes CVE-2024-44931 bsc#1229837).
- Update
  patches.suse/hfs-fix-to-initialize-fields-of-hfs_inode_info-after-hfs_alloc_inode.patch
  (git-fixes CVE-2024-42311 bsc#1229413).
- Update
  patches.suse/iio-Fix-the-sorting-functionality-in-iio_gts_build_a.patch
  (git-fixes CVE-2024-43825 bsc#1229298).
- Update
  patches.suse/jfs-Fix-array-index-out-of-bounds-in-diFree.patch
  (git-fixes CVE-2024-43858 bsc#1229414).
- Update
  patches.suse/jfs-Fix-shift-out-of-bounds-in-dbDiscardAG.patch
  (git-fixes CVE-2024-44938 bsc#1229792).
- Update
  patches.suse/jfs-fix-null-ptr-deref-in-dtInsertEntry.patch
  (git-fixes CVE-2024-44939 bsc#1229820).
- Update
  patches.suse/kobject_uevent-Fix-OOB-access-within-zap_modalias_en.patch
  (git-fixes CVE-2024-42292 bsc#1229373).
- Update
  patches.suse/kvm-s390-Reject-memory-region-operations-for-ucontrol-VMs.patch
  (git-fixes bsc#1229168 CVE-2024-43819 bsc#1229290).
- Update
  patches.suse/leds-trigger-Unregister-sysfs-attributes-before-call.patch
  (git-fixes CVE-2024-43830 bsc#1229305).
- Update
  patches.suse/lib-objagg-Fix-general-protection-fault.patch
  (git-fixes CVE-2024-43846 bsc#1229360).
- Update
  patches.suse/libbpf-Use-OPTS_SET-macro-in-bpf_xdp_query.patch
  (git-fixes CVE-2024-27050 bsc#1223767).
- Update
  patches.suse/mISDN-Fix-a-use-after-free-in-hfcmulti_tx.patch
  (git-fixes CVE-2024-42280 bsc#1229388).
- Update
  patches.suse/mailbox-mtk-cmdq-Move-devm_mbox_controller_register-.patch
  (git-fixes CVE-2024-42319 bsc#1229350).
- Update
  patches.suse/md-raid5-fix-deadlock-that-raid5d-wait-for-itself-to-clear-MD_SB_CHANGE_PENDING-151f.patch
  (git-fixes CVE-2024-39476 bsc#1227437).
- Update
  patches.suse/media-imx-pxp-Fix-ERR_PTR-dereference-in-pxp_probe.patch
  (git-fixes CVE-2024-42303 bsc#1229365).
- Update
  patches.suse/media-pci-ivtv-Add-check-for-DMA-map-result.patch
  (git-fixes CVE-2024-43877 bsc#1229484).
- Update
  patches.suse/media-v4l-async-Fix-NULL-pointer-dereference-in-addi.patch
  (git-fixes CVE-2024-43833 bsc#1229299).
- Update
  patches.suse/media-venus-fix-use-after-free-in-vdec_close.patch
  (git-fixes CVE-2024-42313 bsc#1229356).
- Update
  patches.suse/media-xc2028-avoid-use-after-free-in-load_firmware_c.patch
  (stable-fixes CVE-2024-43900 bsc#1229756).
- Update
  patches.suse/memcg-protect-concurrent-access-to-mem_cgroup_idr.patch
  (git-fixes CVE-2024-43892 bsc#1229761).
- Update
  patches.suse/net-drop-bad-gso-csum_start-and-offset-in-virtio_net.patch
  (git-fixes CVE-2024-43897 bsc#1229752).
- Update
  patches.suse/net-iucv-fix-use-after-free-in-iucv_sock_close.patch
  (bsc#1228973 CVE-2024-42271 bsc#1229400).
- Update patches.suse/net-missing-check-virtio.patch (git-fixes
  CVE-2024-43817 bsc#1229312).
- Update
  patches.suse/net-usb-qmi_wwan-fix-memory-leak-for-not-ip-packets.patch
  (git-fixes CVE-2024-43861 bsc#1229500).
- Update
  patches.suse/nfs-pass-explicit-offset-count-to-trace-events.patch
  (git-fixes CVE-2024-43826 bsc#1229294).
- Update
  patches.suse/nvme-pci-add-missing-condition-check-for-existence-o.patch
  (git-fixes CVE-2024-42276 bsc#1229410).
- Update
  patches.suse/padata-Fix-possible-divide-by-0-panic-in-padata_mt_h.patch
  (git-fixes CVE-2024-43889 bsc#1229743).
- Update
  patches.suse/remoteproc-imx_rproc-Skip-over-memory-region-when-no.patch
  (git-fixes CVE-2024-43860 bsc#1229319).
- Update
  patches.suse/s390-dasd-fix-error-checks-in-dasd_copy_pair_store.patch
  (git-fixes bsc#1229173 CVE-2024-42320 bsc#1229349).
- Update
  patches.suse/scsi-lpfc-Revise-lpfc_prep_embed_io-routine-with-pro.patch
  (bsc#1228857 CVE-2024-43816 bsc#1229318).
- Update
  patches.suse/scsi-qla2xxx-Complete-command-early-within-lock.patch
  (bsc#1228850 CVE-2024-42287 bsc#1229392).
- Update
  patches.suse/scsi-qla2xxx-During-vport-delete-send-async-logout-e.patch
  (bsc#1228850 CVE-2024-42289 bsc#1229399).
- Update
  patches.suse/scsi-qla2xxx-Fix-for-possible-memory-corruption.patch
  (bsc#1228850 CVE-2024-42288 bsc#1229398).
- Update
  patches.suse/scsi-qla2xxx-validate-nvme_local_port-correctly.patch
  (bsc#1228850 CVE-2024-42286 bsc#1229395).
- Update
  patches.suse/serial-core-check-uartclk-for-zero-to-avoid-divide-b.patch
  (stable-fixes CVE-2024-43893 bsc#1229759).
- Update
  patches.suse/soc-qcom-pdr-protect-locator_addr-with-the-main-mute.patch
  (git-fixes CVE-2024-43849 bsc#1229307).
- Update
  patches.suse/soc-xilinx-rename-cpu_number1-to-dummy_cpu_number.patch
  (git-fixes CVE-2024-43851 bsc#1229313).
- Update
  patches.suse/spi-microchip-core-ensure-TX-and-RX-FIFOs-are-empty-.patch
  (git-fixes CVE-2024-42279 bsc#1229390).
- Update
  patches.suse/usb-vhci-hcd-Do-not-drop-references-before-new-refer.patch
  (stable-fixes CVE-2024-43883 bsc#1229707).
- Update
  patches.suse/vhost-vsock-always-initialize-seqpacket_allow.patch
  (git-fixes CVE-2024-43873 bsc#1229488).
- Update
  patches.suse/wifi-ath12k-change-DMA-direction-while-mapping-reinj.patch
  (git-fixes CVE-2024-43881 bsc#1229480).
- Update
  patches.suse/wifi-ath12k-fix-invalid-memory-access-while-processi.patch
  (git-fixes CVE-2024-43847 bsc#1229291).
- Update
  patches.suse/wifi-cfg80211-handle-2x996-RU-allocation-in-cfg80211.patch
  (git-fixes CVE-2024-43879 bsc#1229482).
- Update
  patches.suse/wifi-nl80211-disallow-setting-special-AP-channel-wid.patch
  (stable-fixes CVE-2024-43912 bsc#1229830).
- Update
  patches.suse/wifi-rtw89-Fix-array-index-mistake-in-rtw89_sta_info.patch
  (git-fixes CVE-2024-43842 bsc#1229317).
- Update
  patches.suse/wifi-virt_wifi-avoid-reporting-connection-success-wi.patch
  (git-fixes CVE-2024-43841 bsc#1229304).
- commit 140ec33</changelog>
  <changelog author="tiwai@suse.de" date="1725105600">- dmaengine: dw: Add memory bus width verification (git-fixes).
- dmaengine: dw: Add peripheral bus width verification
  (git-fixes).
- soundwire: stream: fix programming slave ports for non-continous
  port maps (git-fixes).
- commit b7e9784</changelog>
  <changelog author="tiwai@suse.de" date="1725192000">- usb: cdnsp: fix for Link TRB with TC (git-fixes).
- usb: dwc3: st: add missing depopulate in probe error path
  (git-fixes).
- usb: dwc3: st: fix probed platform device ref count on probe
  error path (git-fixes).
- usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in
  remove_power_attributes() (git-fixes).
- usb: typec: fsa4480: Relax CHIP_ID check (git-fixes).
- usb: dwc3: omap: add missing depopulate in probe error path
  (git-fixes).
- usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function
  (git-fixes).
- soc: qcom: pmic_glink: Actually communicate when remote goes
  down (git-fixes).
- soc: qcom: cmd-db: Map shared memory as WC, not WB (git-fixes).
- commit 7121142</changelog>
  <changelog author="ailiop@suse.com" date="1725192001">- xfs: Fix the owner setting issue for rmap query in xfs fsmap
  (git-fixes).
- commit 49b5eec</changelog>
  <changelog author="ailiop@suse.com" date="1725192002">- xfs: use XFS_BUF_DADDR_NULL for daddrs in getfsmap code
  (git-fixes).
- commit 288ad9b</changelog>
  <changelog author="ailiop@suse.com" date="1725192003">- xfs: Fix missing interval for missing_owner in xfs fsmap
  (git-fixes).
- commit 5448ab5</changelog>
  <changelog author="ohering@suse.de" date="1725278400">- net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response (git-fixes).
- commit 4dc1da1</changelog>
  <changelog author="osalvador@suse.de" date="1725278401">- mm/sparsemem: fix race in accessing memory_section-&gt;usage
  (bsc#1221326 CVE-2023-52489).
- commit 6aa8957</changelog>
  <changelog author="osalvador@suse.de" date="1725278402">- mm, kmsan: fix infinite recursion due to RCU critical section
  (git-fixes).
- commit 16ad73a</changelog>
  <changelog author="osalvador@suse.de" date="1725278403">- mm: prevent derefencing NULL ptr in pfn_section_valid()
  (git-fixes).
- commit 35f619d</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1725278404">- bluetooth/l2cap: sync sock recv cb and release (bsc#1228576
  CVE-2024-41062).
- commit 6553526</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1725278405">- Bluetooth: L2CAP: Fix deadlock (git-fixes).
- commit 13aba13</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1725278406">- Bluetooth: Fix usage of __hci_cmd_sync_status (git-fixes).
- commit 1bec58d</changelog>
  <changelog author="lhenriques@suse.de" date="1725278407">- ceph: periodically flush the cap releases (bsc#1230056).
- commit e22b6e0</changelog>
</package>
<package pkgid="0f6731a9915fe8946e8740fe47a7c52605470792a90526aeca34a512009f8a8e" name="dmidecode" arch="aarch64">
  <version epoch="0" ver="3.6" rel="150400.16.11.2"/>
  <changelog author="mpluskal@suse.com" date="1424433600">- Cleanup spec file with spec-cleaner
- Add gpg signature</changelog>
  <changelog author="meissner@suse.com" date="1424606400">- dmidecode.keyring was empty, reference the savannah keyring.
  but the tarball is signed by someone unknown without gpg signatures,
  so no keyring for now.</changelog>
  <changelog author="jdelvare@suse.de" date="1441281600">- Update to upstream version 3.0 (FATE#320746, FATE#320773):
  * Adds support for SMBIOS 3.0. This includes a new (64-bit) entry
    point format and new enumerated values for recent hardware.
  * Adds support for the new kernel interface (as of Linux v4.2) as
    an alternative to relying on /dev/mem to access the entry point
    and DMI table.
  * Adds decoding of Acer-specific DMI type 170 and HP-specific DMI
    types 212, 219 and 233.
  * Obsoletes dmidecode-1.173-drop-cast.patch,
    dmidecode-1.175-fix-SMBIOS-2.8.0.patch,
    dmidecode-1.176-SMBIOS-2.8-is-supported.patch,
    dmidecode-1.177-decode-pcie3-slot-id.patch,
    dmidecode-1.181-decode-CPUID-recent-AMD.patch, and
    dmidecode-1.182-decode-ddr4-memory-type.patch.
  * Various minor fixes and clean-ups.
  * Skip the SMBIOS version comparison in quiet mode (bsc#974862).</changelog>
  <changelog author="jdelvare@suse.de" date="1462276800">- dmidecode-01-add-no-sysfs-option-description-to-h-output.patch:
  Add "--no-sysfs" option description to -h output.
- dmidecode-02-fix-no-smbios-nor-dmi-entry-point-found-on-smbios3.patch:
  Fix 'No SMBIOS nor DMI entry point found' on SMBIOS3.
- dmidecode-03-let-read_file-return-the-actual-data-size.patch:
  Let read_file return the actual data size.
- dmidecode-04-use-read_file-to-read-the-dmi-table-from-sysfs.patch:
  Use read_file() to read the DMI table from sysfs.
  https://savannah.nongnu.org/bugs/?46176
- dmidecode-05-use-dword-for-structure-table-maximum-size-in-smbios3.patch:
  Use DWORD for Structure table maximum size in SMBIOS3.
- dmidecode-06-hide-irrelevant-fixup-message.patch:
  Hide irrelevant fixup message.
  http://savannah.nongnu.org/support/?109024</changelog>
  <changelog author="jdelvare@suse.de" date="1484913600">- dmidecode-07-only-decode-one-dmi-table.patch: Only decode one
  DMI table.
  https://savannah.nongnu.org/bugs/?50022</changelog>
  <changelog author="jdelvare@suse.de" date="1495627200">- Update to upstream version 3.1:
  * Support for SMBIOS 3.1.0 and 3.1.1. This includes new chassis
    types, new processor family names, new processor family upgrade
    names, and new slot types, as well as support of larger BIOS
    ROM sizes and cache sizes, and a new structure type (43, TPM
    Device.)
  * A new command line option to query OEM strings.
  * All error messages are now printed on stderr (#47274, #48158.)
  * Fixes a crash with SIGBUS (#46066.)
  * Various minor fixes, improvements and cleanups.
  * Obsoletes dmidecode-01-add-no-sysfs-option-description-to-h-output.patch,
    dmidecode-02-fix-no-smbios-nor-dmi-entry-point-found-on-smbios3.patch,
    dmidecode-03-let-read_file-return-the-actual-data-size.patch,
    dmidecode-04-use-read_file-to-read-the-dmi-table-from-sysfs.patch,
    dmidecode-05-use-dword-for-structure-table-maximum-size-in-smbios3.patch,
    dmidecode-06-hide-irrelevant-fixup-message.patch, and
    dmidecode-07-only-decode-one-dmi-table.patch.</changelog>
  <changelog author="jdelvare@suse.de" date="1500292800">- Add missing bug numbers and FATE references in changes file
  (bsc#1041670).</changelog>
  <changelog author="jdelvare@suse.de" date="1523966400">- dmioem-reflect-hpe-new-company-name.patch: Reflect HPE's new
  company name.
- dmidecode-fix-tpm-device-firmware-version.patch: Fix firmware
  version of TPM device.
- dmioem-fix-hpe-type-219-uefi-flag.patch: Fix the reporting of
  HP/HPE UEFI feature.</changelog>
  <changelog author="jdelvare@suse.de" date="1537185600">- Update to upstream version 3.2 (FATE#326044):
  * [COMPATIBILITY] The UUID is now displayed using lowercase
    letters, per RFC 4122 (#53569). You must ensure that any code
    parsing it is case-insensitive.
  * Support for SMBIOS 3.2.0. This includes new processor names,
    new socket and port connector types, new system slot state and
    property, and support for non-volatile memory (NVDIMM).
  * Support for Redfish management controllers.
  * A new command line option to query a specific structure by its
    handle.
  * A new command line option to query the system family string.
  * Support for 3 ThinkPad-specific structures (patch #9642).
  * Support for HPE's new company name.
  * Support UEFI on FreeBSD.
  * Important bug fixes:
    Fix firmware version of TPM device
    Fix the HPE UEFI feature flag check
  * (biosdecode) A new command line option to fully decode PIR
    information (support request #109339).
  * Obsoletes dmioem-reflect-hpe-new-company-name.patch,
    dmidecode-fix-tpm-device-firmware-version.patch, and
    dmioem-fix-hpe-type-219-uefi-flag.patch.
  * CHANGELOG is gone, package more compact NEWS file instead.
- Reenable signature checking.
- Use %license for LICENSE file.</changelog>
  <changelog author="jdelvare@suse.de" date="1540209600">- dmidecode-fix-redfish-hostname-print-length.patch: Fix Redfish
  Hostname print length (bsc#1112755).</changelog>
  <changelog author="jdelvare@suse.de" date="1547467200">- Don't overwrite the path of license (boo#1121851).</changelog>
  <changelog author="jdelvare@suse.de" date="1547640000">- dmidecode-add-logical-non-volatile-device.patch: Add "Logical
  non-volatile device" to the memory device types (bsc#1120149).
- Use %doc directly on files instead of installing them explicitly.</changelog>
  <changelog author="jdelvare@suse.de" date="1576670400">Partial support for SMBIOS 3.3.0:
- dmidecode-add-enumerated-values-from-smbios-3.3.0.patch: Add
  enumerated values from SMBIOS 3.3.0 (bsc#1153533 bsc#1158833
  jsc#SLE-10875).
  3 recommended fixes from upstream:
- dmidecode-only-scan-dev-mem-for-entry-point-on-x86.patch: Only
  scan /dev/mem for entry point on x86 (fixes reboot on ARM64).
- dmidecode-fix-formatting-of-tpm-table-output.patch: Fix
  formatting of TPM table output (missing newlines).
- dmidecode-fix-system-slot-information-for-pcie-ssd.patch: Fix
  System Slot Information for PCIe SSD.</changelog>
  <changelog author="jdelvare@suse.de" date="1604059200">Partial support for SMBIOS 3.4.0:
- dmidecode-add-memory-device-types-from-smbios-3.4.0.patch,
  dmidecode-add-processor-characteristics-bits-from-smbios-3.4.0.patch,
  dmidecode-add-processor-upgrades-from-smbios-3.4.0.patch,
  dmidecode-add-slot-characteristics2-from-smbios-3.4.0.patch,
  dmidecode-add-system-slot-types-from-smbios-3.4.0.patch: Add
  enumerated values from SMBIOS 3.4.0 (bsc#1174257).
  1 presentation fix from upstream:
- dmidecode-skip-details-of-uninstalled-memory-modules.patch:
  Skip details of uninstalled memory modules (bsc#1174257).</changelog>
  <changelog author="jdelvare@suse.de" date="1607601600">1 recommended fix from upstream:
- dmidecode-missing-commas.patch: Two missing commas in data arrays
  cause off-by-one or mangling during index resolution
  (bsc#1174257).</changelog>
  <changelog author="jdelvare@suse.de" date="1663070400">- Update to upstream version 3.4:
  * This update implements jsc#SLE-24502 and jsc#PED-1466.
  * [COMPATIBILITY] Document how the UUID fields are interpreted.
  * [PORTABILITY] Don't use memcpy on /dev/mem on arm64.
  * Support for SMBIOS 3.4.0. This includes new memory device types, new
    processor upgrades, new slot types and characteristics, decoding of memory
    module extended speed, new system slot types, new processor characteristics
    and new format of Processor ID.
  * Support for SMBIOS 3.5.0. This includes new processor upgrades, BIOS
    characteristics, new slot characteristics, new on-board device types, new
    pointing device interface types, and a new record type (type 45 -
    Firmware Inventory Information).
  * Decode HPE OEM records 194, 199, 203, 236, 237, 238 ans 240.
  * Bug fixes:
    Fix OEM vendor name matching
  * Minor improvements:
    Add bios-revision, firmware-revision and system-sku-number to -s option
    Use the most appropriate unit for cache size
    Decode system slot base bus width and peers
    Skip details of uninstalled memory modules
    Don't display the raw CPU ID in quiet mode
    Improve the formatting of the manual pages
  * Obsoletes dmidecode-add-enumerated-values-from-smbios-3.3.0.patch,
    dmidecode-add-logical-non-volatile-device.patch,
    dmidecode-add-memory-device-types-from-smbios-3.4.0.patch,
    dmidecode-add-processor-characteristics-bits-from-smbios-3.4.0.patch,
    dmidecode-add-processor-upgrades-from-smbios-3.4.0.patch,
    dmidecode-add-slot-characteristics2-from-smbios-3.4.0.patch,
    dmidecode-add-system-slot-types-from-smbios-3.4.0.patch,
    dmidecode-fix-formatting-of-tpm-table-output.patch,
    dmidecode-fix-redfish-hostname-print-length.patch,
    dmidecode-fix-system-slot-information-for-pcie-ssd.patch,
    dmidecode-missing-commas.patch,
    dmidecode-only-scan-dev-mem-for-entry-point-on-x86.patch and
    dmidecode-skip-details-of-uninstalled-memory-modules.patch.</changelog>
  <changelog author="jdelvare@suse.de" date="1663070401">2 recommended fixes from upstream:
- news-fix-typo.patch: We ship the NEWS file so avoid including a
  typo in it.
- dmioem-fix-segmentation-fault-in-dmi_hp_240_attr.patch: Passing
  NULL to a %s printf conversion specifier is illegal, and can
  result in a segmentation fault. Current version of glibc doesn't
  mind, but alternative, past or future libc implementations could
  crash, so let's fix it.</changelog>
  <changelog author="jdelvare@suse.de" date="1681473600">Security fixes (CVE-2023-30630)
- dmidecode-split-table-fetching-from-decoding.patch: dmidecode:
  Clean up function dmi_table so that it does only one thing
  (bsc#1210418).
- dmidecode-write-the-whole-dump-file-at-once.patch: When option
  - -dump-bin is used, write the whole dump file at once, instead of
  opening and closing the file separately for the table and then
  for the entry point (bsc#1210418).
- dmidecode-do-not-let-dump-bin-overwrite-an-existing-file.patch:
  Make sure that the file passed to option --dump-bin does not
  already exist (bsc#1210418).
- ensure-dev-mem-is-a-character-device-file.patch: Add a safety
  check on the type of the mem device file we are asked to read
  from, if we are root (bsc#1210418).
  3 recommended fixes from upstream:
- dmioem-typo-fix-virutal-virtual.patch: Simple typo fix in a
  user-visible string.
- dmidecode-fortify-entry-point-length-checks.patch: Ensure that
  the SMBIOS entry point is long enough to include all the fields
  we need.
- dmioem-hpe-oem-record-237-firmware-change.patch: Properly decode
  the last field of HPE OEM record type 237.</changelog>
  <changelog author="jdelvare@suse.de" date="1681905600">- use-read_file-to-read-from-dump.patch: Fix an old harmless bug
  which would prevent root from using the --from-dump option since
  the latest security fixes (bsc#1210418).</changelog>
  <changelog author="jdelvare@suse.de" date="1721390400">- Update to upstream version 3.6 (jsc#PED-8574):
  * Support for SMBIOS 3.6.0. This includes new memory device types, new
    processor upgrades, and Loongarch support.
  * Support for SMBIOS 3.7.0. This includes new port types, new processor
    upgrades, new slot characteristics and new fields for memory modules.
  * Add bash completion.
  * Decode HPE OEM records 197, 216, 224, 230, 238, 239, 242 and 245.
  * Implement options --list-strings and --list-types.
  * Update HPE OEM records 203, 212, 216, 221, 233 and 236.
  * Update Redfish support.
  * Bug fixes:
    Fix enabled slot characteristics not being printed
  * Minor improvements:
    Print slot width on its own line
    Use standard strings for slot width
  * Add a --no-quirks option.
  * Drop the CPUID exception list.
  * Obsoletes dmidecode-do-not-let-dump-bin-overwrite-an-existing-file.patch,
    dmidecode-fortify-entry-point-length-checks.patch,
    dmidecode-split-table-fetching-from-decoding.patch,
    dmidecode-write-the-whole-dump-file-at-once.patch,
    dmioem-fix-segmentation-fault-in-dmi_hp_240_attr.patch,
    dmioem-hpe-oem-record-237-firmware-change.patch,
    dmioem-typo-fix-virutal-virtual.patch,
    ensure-dev-mem-is-a-character-device-file.patch,
    news-fix-typo.patch and
    use-read_file-to-read-from-dump.patch.
  Update for HPE servers from upstream:
- dmioem-update-hpe-oem-type-238.patch: Decode PCI bus segment in
  HPE type 238 records.</changelog>
</package>
<package pkgid="0bfd382009627bfa511e2c78aaa7bdc4dd0e8c8f085c3ad3c9cf9b0e8c41cfcd" name="dmidecode" arch="src">
  <version epoch="0" ver="3.6" rel="150400.16.11.2"/>
  <changelog author="mpluskal@suse.com" date="1424433600">- Cleanup spec file with spec-cleaner
- Add gpg signature</changelog>
  <changelog author="meissner@suse.com" date="1424606400">- dmidecode.keyring was empty, reference the savannah keyring.
  but the tarball is signed by someone unknown without gpg signatures,
  so no keyring for now.</changelog>
  <changelog author="jdelvare@suse.de" date="1441281600">- Update to upstream version 3.0 (FATE#320746, FATE#320773):
  * Adds support for SMBIOS 3.0. This includes a new (64-bit) entry
    point format and new enumerated values for recent hardware.
  * Adds support for the new kernel interface (as of Linux v4.2) as
    an alternative to relying on /dev/mem to access the entry point
    and DMI table.
  * Adds decoding of Acer-specific DMI type 170 and HP-specific DMI
    types 212, 219 and 233.
  * Obsoletes dmidecode-1.173-drop-cast.patch,
    dmidecode-1.175-fix-SMBIOS-2.8.0.patch,
    dmidecode-1.176-SMBIOS-2.8-is-supported.patch,
    dmidecode-1.177-decode-pcie3-slot-id.patch,
    dmidecode-1.181-decode-CPUID-recent-AMD.patch, and
    dmidecode-1.182-decode-ddr4-memory-type.patch.
  * Various minor fixes and clean-ups.
  * Skip the SMBIOS version comparison in quiet mode (bsc#974862).</changelog>
  <changelog author="jdelvare@suse.de" date="1462276800">- dmidecode-01-add-no-sysfs-option-description-to-h-output.patch:
  Add "--no-sysfs" option description to -h output.
- dmidecode-02-fix-no-smbios-nor-dmi-entry-point-found-on-smbios3.patch:
  Fix 'No SMBIOS nor DMI entry point found' on SMBIOS3.
- dmidecode-03-let-read_file-return-the-actual-data-size.patch:
  Let read_file return the actual data size.
- dmidecode-04-use-read_file-to-read-the-dmi-table-from-sysfs.patch:
  Use read_file() to read the DMI table from sysfs.
  https://savannah.nongnu.org/bugs/?46176
- dmidecode-05-use-dword-for-structure-table-maximum-size-in-smbios3.patch:
  Use DWORD for Structure table maximum size in SMBIOS3.
- dmidecode-06-hide-irrelevant-fixup-message.patch:
  Hide irrelevant fixup message.
  http://savannah.nongnu.org/support/?109024</changelog>
  <changelog author="jdelvare@suse.de" date="1484913600">- dmidecode-07-only-decode-one-dmi-table.patch: Only decode one
  DMI table.
  https://savannah.nongnu.org/bugs/?50022</changelog>
  <changelog author="jdelvare@suse.de" date="1495627200">- Update to upstream version 3.1:
  * Support for SMBIOS 3.1.0 and 3.1.1. This includes new chassis
    types, new processor family names, new processor family upgrade
    names, and new slot types, as well as support of larger BIOS
    ROM sizes and cache sizes, and a new structure type (43, TPM
    Device.)
  * A new command line option to query OEM strings.
  * All error messages are now printed on stderr (#47274, #48158.)
  * Fixes a crash with SIGBUS (#46066.)
  * Various minor fixes, improvements and cleanups.
  * Obsoletes dmidecode-01-add-no-sysfs-option-description-to-h-output.patch,
    dmidecode-02-fix-no-smbios-nor-dmi-entry-point-found-on-smbios3.patch,
    dmidecode-03-let-read_file-return-the-actual-data-size.patch,
    dmidecode-04-use-read_file-to-read-the-dmi-table-from-sysfs.patch,
    dmidecode-05-use-dword-for-structure-table-maximum-size-in-smbios3.patch,
    dmidecode-06-hide-irrelevant-fixup-message.patch, and
    dmidecode-07-only-decode-one-dmi-table.patch.</changelog>
  <changelog author="jdelvare@suse.de" date="1500292800">- Add missing bug numbers and FATE references in changes file
  (bsc#1041670).</changelog>
  <changelog author="jdelvare@suse.de" date="1523966400">- dmioem-reflect-hpe-new-company-name.patch: Reflect HPE's new
  company name.
- dmidecode-fix-tpm-device-firmware-version.patch: Fix firmware
  version of TPM device.
- dmioem-fix-hpe-type-219-uefi-flag.patch: Fix the reporting of
  HP/HPE UEFI feature.</changelog>
  <changelog author="jdelvare@suse.de" date="1537185600">- Update to upstream version 3.2 (FATE#326044):
  * [COMPATIBILITY] The UUID is now displayed using lowercase
    letters, per RFC 4122 (#53569). You must ensure that any code
    parsing it is case-insensitive.
  * Support for SMBIOS 3.2.0. This includes new processor names,
    new socket and port connector types, new system slot state and
    property, and support for non-volatile memory (NVDIMM).
  * Support for Redfish management controllers.
  * A new command line option to query a specific structure by its
    handle.
  * A new command line option to query the system family string.
  * Support for 3 ThinkPad-specific structures (patch #9642).
  * Support for HPE's new company name.
  * Support UEFI on FreeBSD.
  * Important bug fixes:
    Fix firmware version of TPM device
    Fix the HPE UEFI feature flag check
  * (biosdecode) A new command line option to fully decode PIR
    information (support request #109339).
  * Obsoletes dmioem-reflect-hpe-new-company-name.patch,
    dmidecode-fix-tpm-device-firmware-version.patch, and
    dmioem-fix-hpe-type-219-uefi-flag.patch.
  * CHANGELOG is gone, package more compact NEWS file instead.
- Reenable signature checking.
- Use %license for LICENSE file.</changelog>
  <changelog author="jdelvare@suse.de" date="1540209600">- dmidecode-fix-redfish-hostname-print-length.patch: Fix Redfish
  Hostname print length (bsc#1112755).</changelog>
  <changelog author="jdelvare@suse.de" date="1547467200">- Don't overwrite the path of license (boo#1121851).</changelog>
  <changelog author="jdelvare@suse.de" date="1547640000">- dmidecode-add-logical-non-volatile-device.patch: Add "Logical
  non-volatile device" to the memory device types (bsc#1120149).
- Use %doc directly on files instead of installing them explicitly.</changelog>
  <changelog author="jdelvare@suse.de" date="1576670400">Partial support for SMBIOS 3.3.0:
- dmidecode-add-enumerated-values-from-smbios-3.3.0.patch: Add
  enumerated values from SMBIOS 3.3.0 (bsc#1153533 bsc#1158833
  jsc#SLE-10875).
  3 recommended fixes from upstream:
- dmidecode-only-scan-dev-mem-for-entry-point-on-x86.patch: Only
  scan /dev/mem for entry point on x86 (fixes reboot on ARM64).
- dmidecode-fix-formatting-of-tpm-table-output.patch: Fix
  formatting of TPM table output (missing newlines).
- dmidecode-fix-system-slot-information-for-pcie-ssd.patch: Fix
  System Slot Information for PCIe SSD.</changelog>
  <changelog author="jdelvare@suse.de" date="1604059200">Partial support for SMBIOS 3.4.0:
- dmidecode-add-memory-device-types-from-smbios-3.4.0.patch,
  dmidecode-add-processor-characteristics-bits-from-smbios-3.4.0.patch,
  dmidecode-add-processor-upgrades-from-smbios-3.4.0.patch,
  dmidecode-add-slot-characteristics2-from-smbios-3.4.0.patch,
  dmidecode-add-system-slot-types-from-smbios-3.4.0.patch: Add
  enumerated values from SMBIOS 3.4.0 (bsc#1174257).
  1 presentation fix from upstream:
- dmidecode-skip-details-of-uninstalled-memory-modules.patch:
  Skip details of uninstalled memory modules (bsc#1174257).</changelog>
  <changelog author="jdelvare@suse.de" date="1607601600">1 recommended fix from upstream:
- dmidecode-missing-commas.patch: Two missing commas in data arrays
  cause off-by-one or mangling during index resolution
  (bsc#1174257).</changelog>
  <changelog author="jdelvare@suse.de" date="1663070400">- Update to upstream version 3.4:
  * This update implements jsc#SLE-24502 and jsc#PED-1466.
  * [COMPATIBILITY] Document how the UUID fields are interpreted.
  * [PORTABILITY] Don't use memcpy on /dev/mem on arm64.
  * Support for SMBIOS 3.4.0. This includes new memory device types, new
    processor upgrades, new slot types and characteristics, decoding of memory
    module extended speed, new system slot types, new processor characteristics
    and new format of Processor ID.
  * Support for SMBIOS 3.5.0. This includes new processor upgrades, BIOS
    characteristics, new slot characteristics, new on-board device types, new
    pointing device interface types, and a new record type (type 45 -
    Firmware Inventory Information).
  * Decode HPE OEM records 194, 199, 203, 236, 237, 238 ans 240.
  * Bug fixes:
    Fix OEM vendor name matching
  * Minor improvements:
    Add bios-revision, firmware-revision and system-sku-number to -s option
    Use the most appropriate unit for cache size
    Decode system slot base bus width and peers
    Skip details of uninstalled memory modules
    Don't display the raw CPU ID in quiet mode
    Improve the formatting of the manual pages
  * Obsoletes dmidecode-add-enumerated-values-from-smbios-3.3.0.patch,
    dmidecode-add-logical-non-volatile-device.patch,
    dmidecode-add-memory-device-types-from-smbios-3.4.0.patch,
    dmidecode-add-processor-characteristics-bits-from-smbios-3.4.0.patch,
    dmidecode-add-processor-upgrades-from-smbios-3.4.0.patch,
    dmidecode-add-slot-characteristics2-from-smbios-3.4.0.patch,
    dmidecode-add-system-slot-types-from-smbios-3.4.0.patch,
    dmidecode-fix-formatting-of-tpm-table-output.patch,
    dmidecode-fix-redfish-hostname-print-length.patch,
    dmidecode-fix-system-slot-information-for-pcie-ssd.patch,
    dmidecode-missing-commas.patch,
    dmidecode-only-scan-dev-mem-for-entry-point-on-x86.patch and
    dmidecode-skip-details-of-uninstalled-memory-modules.patch.</changelog>
  <changelog author="jdelvare@suse.de" date="1663070401">2 recommended fixes from upstream:
- news-fix-typo.patch: We ship the NEWS file so avoid including a
  typo in it.
- dmioem-fix-segmentation-fault-in-dmi_hp_240_attr.patch: Passing
  NULL to a %s printf conversion specifier is illegal, and can
  result in a segmentation fault. Current version of glibc doesn't
  mind, but alternative, past or future libc implementations could
  crash, so let's fix it.</changelog>
  <changelog author="jdelvare@suse.de" date="1681473600">Security fixes (CVE-2023-30630)
- dmidecode-split-table-fetching-from-decoding.patch: dmidecode:
  Clean up function dmi_table so that it does only one thing
  (bsc#1210418).
- dmidecode-write-the-whole-dump-file-at-once.patch: When option
  - -dump-bin is used, write the whole dump file at once, instead of
  opening and closing the file separately for the table and then
  for the entry point (bsc#1210418).
- dmidecode-do-not-let-dump-bin-overwrite-an-existing-file.patch:
  Make sure that the file passed to option --dump-bin does not
  already exist (bsc#1210418).
- ensure-dev-mem-is-a-character-device-file.patch: Add a safety
  check on the type of the mem device file we are asked to read
  from, if we are root (bsc#1210418).
  3 recommended fixes from upstream:
- dmioem-typo-fix-virutal-virtual.patch: Simple typo fix in a
  user-visible string.
- dmidecode-fortify-entry-point-length-checks.patch: Ensure that
  the SMBIOS entry point is long enough to include all the fields
  we need.
- dmioem-hpe-oem-record-237-firmware-change.patch: Properly decode
  the last field of HPE OEM record type 237.</changelog>
  <changelog author="jdelvare@suse.de" date="1681905600">- use-read_file-to-read-from-dump.patch: Fix an old harmless bug
  which would prevent root from using the --from-dump option since
  the latest security fixes (bsc#1210418).</changelog>
  <changelog author="jdelvare@suse.de" date="1721390400">- Update to upstream version 3.6 (jsc#PED-8574):
  * Support for SMBIOS 3.6.0. This includes new memory device types, new
    processor upgrades, and Loongarch support.
  * Support for SMBIOS 3.7.0. This includes new port types, new processor
    upgrades, new slot characteristics and new fields for memory modules.
  * Add bash completion.
  * Decode HPE OEM records 197, 216, 224, 230, 238, 239, 242 and 245.
  * Implement options --list-strings and --list-types.
  * Update HPE OEM records 203, 212, 216, 221, 233 and 236.
  * Update Redfish support.
  * Bug fixes:
    Fix enabled slot characteristics not being printed
  * Minor improvements:
    Print slot width on its own line
    Use standard strings for slot width
  * Add a --no-quirks option.
  * Drop the CPUID exception list.
  * Obsoletes dmidecode-do-not-let-dump-bin-overwrite-an-existing-file.patch,
    dmidecode-fortify-entry-point-length-checks.patch,
    dmidecode-split-table-fetching-from-decoding.patch,
    dmidecode-write-the-whole-dump-file-at-once.patch,
    dmioem-fix-segmentation-fault-in-dmi_hp_240_attr.patch,
    dmioem-hpe-oem-record-237-firmware-change.patch,
    dmioem-typo-fix-virutal-virtual.patch,
    ensure-dev-mem-is-a-character-device-file.patch,
    news-fix-typo.patch and
    use-read_file-to-read-from-dump.patch.
  Update for HPE servers from upstream:
- dmioem-update-hpe-oem-type-238.patch: Decode PCI bus segment in
  HPE type 238 records.</changelog>
</package>
<package pkgid="0691bbc5b410067483ac77217792e28f084e5e66b44e8240e5c11c5bf3ad9266" name="dmidecode" arch="x86_64">
  <version epoch="0" ver="3.6" rel="150400.16.11.2"/>
  <changelog author="mpluskal@suse.com" date="1424433600">- Cleanup spec file with spec-cleaner
- Add gpg signature</changelog>
  <changelog author="meissner@suse.com" date="1424606400">- dmidecode.keyring was empty, reference the savannah keyring.
  but the tarball is signed by someone unknown without gpg signatures,
  so no keyring for now.</changelog>
  <changelog author="jdelvare@suse.de" date="1441281600">- Update to upstream version 3.0 (FATE#320746, FATE#320773):
  * Adds support for SMBIOS 3.0. This includes a new (64-bit) entry
    point format and new enumerated values for recent hardware.
  * Adds support for the new kernel interface (as of Linux v4.2) as
    an alternative to relying on /dev/mem to access the entry point
    and DMI table.
  * Adds decoding of Acer-specific DMI type 170 and HP-specific DMI
    types 212, 219 and 233.
  * Obsoletes dmidecode-1.173-drop-cast.patch,
    dmidecode-1.175-fix-SMBIOS-2.8.0.patch,
    dmidecode-1.176-SMBIOS-2.8-is-supported.patch,
    dmidecode-1.177-decode-pcie3-slot-id.patch,
    dmidecode-1.181-decode-CPUID-recent-AMD.patch, and
    dmidecode-1.182-decode-ddr4-memory-type.patch.
  * Various minor fixes and clean-ups.
  * Skip the SMBIOS version comparison in quiet mode (bsc#974862).</changelog>
  <changelog author="jdelvare@suse.de" date="1462276800">- dmidecode-01-add-no-sysfs-option-description-to-h-output.patch:
  Add "--no-sysfs" option description to -h output.
- dmidecode-02-fix-no-smbios-nor-dmi-entry-point-found-on-smbios3.patch:
  Fix 'No SMBIOS nor DMI entry point found' on SMBIOS3.
- dmidecode-03-let-read_file-return-the-actual-data-size.patch:
  Let read_file return the actual data size.
- dmidecode-04-use-read_file-to-read-the-dmi-table-from-sysfs.patch:
  Use read_file() to read the DMI table from sysfs.
  https://savannah.nongnu.org/bugs/?46176
- dmidecode-05-use-dword-for-structure-table-maximum-size-in-smbios3.patch:
  Use DWORD for Structure table maximum size in SMBIOS3.
- dmidecode-06-hide-irrelevant-fixup-message.patch:
  Hide irrelevant fixup message.
  http://savannah.nongnu.org/support/?109024</changelog>
  <changelog author="jdelvare@suse.de" date="1484913600">- dmidecode-07-only-decode-one-dmi-table.patch: Only decode one
  DMI table.
  https://savannah.nongnu.org/bugs/?50022</changelog>
  <changelog author="jdelvare@suse.de" date="1495627200">- Update to upstream version 3.1:
  * Support for SMBIOS 3.1.0 and 3.1.1. This includes new chassis
    types, new processor family names, new processor family upgrade
    names, and new slot types, as well as support of larger BIOS
    ROM sizes and cache sizes, and a new structure type (43, TPM
    Device.)
  * A new command line option to query OEM strings.
  * All error messages are now printed on stderr (#47274, #48158.)
  * Fixes a crash with SIGBUS (#46066.)
  * Various minor fixes, improvements and cleanups.
  * Obsoletes dmidecode-01-add-no-sysfs-option-description-to-h-output.patch,
    dmidecode-02-fix-no-smbios-nor-dmi-entry-point-found-on-smbios3.patch,
    dmidecode-03-let-read_file-return-the-actual-data-size.patch,
    dmidecode-04-use-read_file-to-read-the-dmi-table-from-sysfs.patch,
    dmidecode-05-use-dword-for-structure-table-maximum-size-in-smbios3.patch,
    dmidecode-06-hide-irrelevant-fixup-message.patch, and
    dmidecode-07-only-decode-one-dmi-table.patch.</changelog>
  <changelog author="jdelvare@suse.de" date="1500292800">- Add missing bug numbers and FATE references in changes file
  (bsc#1041670).</changelog>
  <changelog author="jdelvare@suse.de" date="1523966400">- dmioem-reflect-hpe-new-company-name.patch: Reflect HPE's new
  company name.
- dmidecode-fix-tpm-device-firmware-version.patch: Fix firmware
  version of TPM device.
- dmioem-fix-hpe-type-219-uefi-flag.patch: Fix the reporting of
  HP/HPE UEFI feature.</changelog>
  <changelog author="jdelvare@suse.de" date="1537185600">- Update to upstream version 3.2 (FATE#326044):
  * [COMPATIBILITY] The UUID is now displayed using lowercase
    letters, per RFC 4122 (#53569). You must ensure that any code
    parsing it is case-insensitive.
  * Support for SMBIOS 3.2.0. This includes new processor names,
    new socket and port connector types, new system slot state and
    property, and support for non-volatile memory (NVDIMM).
  * Support for Redfish management controllers.
  * A new command line option to query a specific structure by its
    handle.
  * A new command line option to query the system family string.
  * Support for 3 ThinkPad-specific structures (patch #9642).
  * Support for HPE's new company name.
  * Support UEFI on FreeBSD.
  * Important bug fixes:
    Fix firmware version of TPM device
    Fix the HPE UEFI feature flag check
  * (biosdecode) A new command line option to fully decode PIR
    information (support request #109339).
  * Obsoletes dmioem-reflect-hpe-new-company-name.patch,
    dmidecode-fix-tpm-device-firmware-version.patch, and
    dmioem-fix-hpe-type-219-uefi-flag.patch.
  * CHANGELOG is gone, package more compact NEWS file instead.
- Reenable signature checking.
- Use %license for LICENSE file.</changelog>
  <changelog author="jdelvare@suse.de" date="1540209600">- dmidecode-fix-redfish-hostname-print-length.patch: Fix Redfish
  Hostname print length (bsc#1112755).</changelog>
  <changelog author="jdelvare@suse.de" date="1547467200">- Don't overwrite the path of license (boo#1121851).</changelog>
  <changelog author="jdelvare@suse.de" date="1547640000">- dmidecode-add-logical-non-volatile-device.patch: Add "Logical
  non-volatile device" to the memory device types (bsc#1120149).
- Use %doc directly on files instead of installing them explicitly.</changelog>
  <changelog author="jdelvare@suse.de" date="1576670400">Partial support for SMBIOS 3.3.0:
- dmidecode-add-enumerated-values-from-smbios-3.3.0.patch: Add
  enumerated values from SMBIOS 3.3.0 (bsc#1153533 bsc#1158833
  jsc#SLE-10875).
  3 recommended fixes from upstream:
- dmidecode-only-scan-dev-mem-for-entry-point-on-x86.patch: Only
  scan /dev/mem for entry point on x86 (fixes reboot on ARM64).
- dmidecode-fix-formatting-of-tpm-table-output.patch: Fix
  formatting of TPM table output (missing newlines).
- dmidecode-fix-system-slot-information-for-pcie-ssd.patch: Fix
  System Slot Information for PCIe SSD.</changelog>
  <changelog author="jdelvare@suse.de" date="1604059200">Partial support for SMBIOS 3.4.0:
- dmidecode-add-memory-device-types-from-smbios-3.4.0.patch,
  dmidecode-add-processor-characteristics-bits-from-smbios-3.4.0.patch,
  dmidecode-add-processor-upgrades-from-smbios-3.4.0.patch,
  dmidecode-add-slot-characteristics2-from-smbios-3.4.0.patch,
  dmidecode-add-system-slot-types-from-smbios-3.4.0.patch: Add
  enumerated values from SMBIOS 3.4.0 (bsc#1174257).
  1 presentation fix from upstream:
- dmidecode-skip-details-of-uninstalled-memory-modules.patch:
  Skip details of uninstalled memory modules (bsc#1174257).</changelog>
  <changelog author="jdelvare@suse.de" date="1607601600">1 recommended fix from upstream:
- dmidecode-missing-commas.patch: Two missing commas in data arrays
  cause off-by-one or mangling during index resolution
  (bsc#1174257).</changelog>
  <changelog author="jdelvare@suse.de" date="1663070400">- Update to upstream version 3.4:
  * This update implements jsc#SLE-24502 and jsc#PED-1466.
  * [COMPATIBILITY] Document how the UUID fields are interpreted.
  * [PORTABILITY] Don't use memcpy on /dev/mem on arm64.
  * Support for SMBIOS 3.4.0. This includes new memory device types, new
    processor upgrades, new slot types and characteristics, decoding of memory
    module extended speed, new system slot types, new processor characteristics
    and new format of Processor ID.
  * Support for SMBIOS 3.5.0. This includes new processor upgrades, BIOS
    characteristics, new slot characteristics, new on-board device types, new
    pointing device interface types, and a new record type (type 45 -
    Firmware Inventory Information).
  * Decode HPE OEM records 194, 199, 203, 236, 237, 238 ans 240.
  * Bug fixes:
    Fix OEM vendor name matching
  * Minor improvements:
    Add bios-revision, firmware-revision and system-sku-number to -s option
    Use the most appropriate unit for cache size
    Decode system slot base bus width and peers
    Skip details of uninstalled memory modules
    Don't display the raw CPU ID in quiet mode
    Improve the formatting of the manual pages
  * Obsoletes dmidecode-add-enumerated-values-from-smbios-3.3.0.patch,
    dmidecode-add-logical-non-volatile-device.patch,
    dmidecode-add-memory-device-types-from-smbios-3.4.0.patch,
    dmidecode-add-processor-characteristics-bits-from-smbios-3.4.0.patch,
    dmidecode-add-processor-upgrades-from-smbios-3.4.0.patch,
    dmidecode-add-slot-characteristics2-from-smbios-3.4.0.patch,
    dmidecode-add-system-slot-types-from-smbios-3.4.0.patch,
    dmidecode-fix-formatting-of-tpm-table-output.patch,
    dmidecode-fix-redfish-hostname-print-length.patch,
    dmidecode-fix-system-slot-information-for-pcie-ssd.patch,
    dmidecode-missing-commas.patch,
    dmidecode-only-scan-dev-mem-for-entry-point-on-x86.patch and
    dmidecode-skip-details-of-uninstalled-memory-modules.patch.</changelog>
  <changelog author="jdelvare@suse.de" date="1663070401">2 recommended fixes from upstream:
- news-fix-typo.patch: We ship the NEWS file so avoid including a
  typo in it.
- dmioem-fix-segmentation-fault-in-dmi_hp_240_attr.patch: Passing
  NULL to a %s printf conversion specifier is illegal, and can
  result in a segmentation fault. Current version of glibc doesn't
  mind, but alternative, past or future libc implementations could
  crash, so let's fix it.</changelog>
  <changelog author="jdelvare@suse.de" date="1681473600">Security fixes (CVE-2023-30630)
- dmidecode-split-table-fetching-from-decoding.patch: dmidecode:
  Clean up function dmi_table so that it does only one thing
  (bsc#1210418).
- dmidecode-write-the-whole-dump-file-at-once.patch: When option
  - -dump-bin is used, write the whole dump file at once, instead of
  opening and closing the file separately for the table and then
  for the entry point (bsc#1210418).
- dmidecode-do-not-let-dump-bin-overwrite-an-existing-file.patch:
  Make sure that the file passed to option --dump-bin does not
  already exist (bsc#1210418).
- ensure-dev-mem-is-a-character-device-file.patch: Add a safety
  check on the type of the mem device file we are asked to read
  from, if we are root (bsc#1210418).
  3 recommended fixes from upstream:
- dmioem-typo-fix-virutal-virtual.patch: Simple typo fix in a
  user-visible string.
- dmidecode-fortify-entry-point-length-checks.patch: Ensure that
  the SMBIOS entry point is long enough to include all the fields
  we need.
- dmioem-hpe-oem-record-237-firmware-change.patch: Properly decode
  the last field of HPE OEM record type 237.</changelog>
  <changelog author="jdelvare@suse.de" date="1681905600">- use-read_file-to-read-from-dump.patch: Fix an old harmless bug
  which would prevent root from using the --from-dump option since
  the latest security fixes (bsc#1210418).</changelog>
  <changelog author="jdelvare@suse.de" date="1721390400">- Update to upstream version 3.6 (jsc#PED-8574):
  * Support for SMBIOS 3.6.0. This includes new memory device types, new
    processor upgrades, and Loongarch support.
  * Support for SMBIOS 3.7.0. This includes new port types, new processor
    upgrades, new slot characteristics and new fields for memory modules.
  * Add bash completion.
  * Decode HPE OEM records 197, 216, 224, 230, 238, 239, 242 and 245.
  * Implement options --list-strings and --list-types.
  * Update HPE OEM records 203, 212, 216, 221, 233 and 236.
  * Update Redfish support.
  * Bug fixes:
    Fix enabled slot characteristics not being printed
  * Minor improvements:
    Print slot width on its own line
    Use standard strings for slot width
  * Add a --no-quirks option.
  * Drop the CPUID exception list.
  * Obsoletes dmidecode-do-not-let-dump-bin-overwrite-an-existing-file.patch,
    dmidecode-fortify-entry-point-length-checks.patch,
    dmidecode-split-table-fetching-from-decoding.patch,
    dmidecode-write-the-whole-dump-file-at-once.patch,
    dmioem-fix-segmentation-fault-in-dmi_hp_240_attr.patch,
    dmioem-hpe-oem-record-237-firmware-change.patch,
    dmioem-typo-fix-virutal-virtual.patch,
    ensure-dev-mem-is-a-character-device-file.patch,
    news-fix-typo.patch and
    use-read_file-to-read-from-dump.patch.
  Update for HPE servers from upstream:
- dmioem-update-hpe-oem-type-238.patch: Decode PCI bus segment in
  HPE type 238 records.</changelog>
</package>
<package pkgid="a81b19ce6be81bc19018e66c8678e7bcbacfee36db1e3a6e34795c7e2162a74e" name="docker" arch="aarch64">
  <version epoch="0" ver="25.0.6_ce" rel="150000.203.1"/>
  <changelog author="dmueller@suse.com" date="1675252800">- update to 20.10.23-ce.
  * see upstream changelog at https://docs.docker.com/engine/release-notes/#201023
- drop kubic flavor as kubic is EOL. this removes:
  kubelet.env docker-kubic-service.conf 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch</changelog>
  <changelog author="asarai@suse.com" date="1682510400">- Update to Docker 23.0.4-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2304&gt;. bsc#1208074
- Fixes:
  * bsc#1214107 - CVE-2023-28840
  * bsc#1214108 - CVE-2023-28841
  * bsc#1214109 - CVE-2023-28842
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Renumbered patches:
  - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Remove upstreamed patches:
  - 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  - 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch
  - 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch
- Backport &lt;https://github.com/docker/cli/pull/4228&gt; to allow man pages to be
  built without internet access in OBS.
  + cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1682596800">- Update to Docker 23.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2305&gt;.
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to Docker 23.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2306&gt;. bsc#1211578
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Re-unify packaging for SLE-12 and SLE-15.
- Add patch to fix build on SLE-12 by switching back to libbtrfs-devel headers
  (the uapi headers in SLE-12 are too old).
  + 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
- Re-numbered patches:
  - 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch`</changelog>
  <changelog author="asarai@suse.com" date="1686744000">- Update to Docker 24.0.2-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2402&gt;. bsc#1212368
  * Includes the upstreamed fix for the mount table pollution issue.
    bsc#1210797
- Add Recommends for docker-buildx, and add /usr/lib/docker/cli-plugins as
  being provided by this package.
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1687262400">- Add docker-rootless-extras subpackage
  (https://docs.docker.com/engine/security/rootless)</changelog>
  <changelog author="danish.prakash@suse.com" date="1688040000">- Recommend docker-rootless-extras instead of Require(ing) it, given
  it's an additional functionality and not inherently required for
  docker to function.</changelog>
  <changelog author="asarai@suse.com" date="1688731200">- Update to Docker 24.0.3-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2403&gt;. bsc#1213120
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1688731201">- Update to Docker 24.0.4-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2404&gt;. bsc#1213500</changelog>
  <changelog author="dmueller@suse.com" date="1690286400">- Update to Docker 24.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2405&gt;. bsc#1213229</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to Docker 24.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2406&gt;. bsc#1215323
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Switch from disabledrun to manualrun in _service.
- Add a docker.socket unit file, but with socket activation effectively
  disabled to ensure that Docker will always run even if you start the socket
  individually. Users should probably just ignore this unit file. bsc#1210141</changelog>
  <changelog author="asarai@suse.com" date="1697025600">- Add a patch to fix apparmor on SLE-12, reverting the upstream removal of
  version-specific templating for the default apparmor profile. bsc#1213500
  + 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to Docker 24.0.7-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2407&gt;. bsc#1217513
  * Deny containers access to /sys/devices/virtual/powercap by default.
  - CVE-2020-8694 bsc#1170415
  - CVE-2020-8695 bsc#1170446
  - CVE-2020-12912 bsc#1178760
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="dcermak@suse.com" date="1707912000">- Vendor latest buildkit v0.11:
  Add patch 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch that
  vendors in the latest v0.11 buildkit branch including bugfixes for the following:
  * bsc#1219438: CVE-2024-23653
  * bsc#1219268: CVE-2024-23652
  * bsc#1219267: CVE-2024-23651
- rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- switch from %patchN to %patch -PN syntax
- remove unused rpmlint filters and add filters to silence pointless bash &amp; zsh
  completion warnings</changelog>
  <changelog author="danish.prakash@suse.com" date="1708171200">- Update to Docker 25.0.3-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2503&gt;
- Fixes:
  * bsc#1219267 - CVE-2024-23651
  * bsc#1219268 - CVE-2024-23652
  * bsc#1219438 - CVE-2024-23653
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Remove upstreamed patches:
  - 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1709899200">[NOTE: This update was only ever released in SLES and Leap.]
- Add patch to fix bsc#1220339
  * 0007-daemon-overlay2-remove-world-writable-permission-fro.patch
- rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch</changelog>
  <changelog author="asarai@suse.com" date="1711368000">[NOTE: This update was only ever released in SLES and Leap.]
- Update to Docker 25.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2505&gt; bsc#1223409
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Remove upstreamed patches:
  - 0007-daemon-overlay2-remove-world-writable-permission-fro.patch
- Update --add-runtime to point to correct binary path.</changelog>
  <changelog author="asarai@suse.com" date="1719230400">- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- Fix BuildKit's symlink resolution logic to correctly handle non-lexical
  symlinks. Backport of &lt;https://github.com/moby/buildkit/pull/4896&gt; and
  &lt;https://github.com/moby/buildkit/pull/5060&gt;. bsc#1221916
  + 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
- Write volume options atomically so sudden system crashes won't result in
  future Docker starts failing due to empty files. Backport of
  &lt;https://github.com/moby/moby/pull/48034&gt;. bsc#1214855
  + 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch</changelog>
  <changelog author="asarai@suse.com" date="1722427200">[NOTE: This update was only ever released in SLES and Leap.]
- Update to Docker 25.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2506&gt;
- This update includes a fix for CVE-2024-41110. bsc#1228324
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
  * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch</changelog>
</package>
<package pkgid="ed263841eb98fee92af0a4cc57f5cda2b77f3ad6b27e1dc72f7eaabb39949fe7" name="docker" arch="ppc64le">
  <version epoch="0" ver="25.0.6_ce" rel="150000.203.1"/>
  <changelog author="dmueller@suse.com" date="1675252800">- update to 20.10.23-ce.
  * see upstream changelog at https://docs.docker.com/engine/release-notes/#201023
- drop kubic flavor as kubic is EOL. this removes:
  kubelet.env docker-kubic-service.conf 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch</changelog>
  <changelog author="asarai@suse.com" date="1682510400">- Update to Docker 23.0.4-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2304&gt;. bsc#1208074
- Fixes:
  * bsc#1214107 - CVE-2023-28840
  * bsc#1214108 - CVE-2023-28841
  * bsc#1214109 - CVE-2023-28842
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Renumbered patches:
  - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Remove upstreamed patches:
  - 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  - 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch
  - 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch
- Backport &lt;https://github.com/docker/cli/pull/4228&gt; to allow man pages to be
  built without internet access in OBS.
  + cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1682596800">- Update to Docker 23.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2305&gt;.
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to Docker 23.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2306&gt;. bsc#1211578
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Re-unify packaging for SLE-12 and SLE-15.
- Add patch to fix build on SLE-12 by switching back to libbtrfs-devel headers
  (the uapi headers in SLE-12 are too old).
  + 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
- Re-numbered patches:
  - 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch`</changelog>
  <changelog author="asarai@suse.com" date="1686744000">- Update to Docker 24.0.2-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2402&gt;. bsc#1212368
  * Includes the upstreamed fix for the mount table pollution issue.
    bsc#1210797
- Add Recommends for docker-buildx, and add /usr/lib/docker/cli-plugins as
  being provided by this package.
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1687262400">- Add docker-rootless-extras subpackage
  (https://docs.docker.com/engine/security/rootless)</changelog>
  <changelog author="danish.prakash@suse.com" date="1688040000">- Recommend docker-rootless-extras instead of Require(ing) it, given
  it's an additional functionality and not inherently required for
  docker to function.</changelog>
  <changelog author="asarai@suse.com" date="1688731200">- Update to Docker 24.0.3-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2403&gt;. bsc#1213120
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1688731201">- Update to Docker 24.0.4-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2404&gt;. bsc#1213500</changelog>
  <changelog author="dmueller@suse.com" date="1690286400">- Update to Docker 24.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2405&gt;. bsc#1213229</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to Docker 24.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2406&gt;. bsc#1215323
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Switch from disabledrun to manualrun in _service.
- Add a docker.socket unit file, but with socket activation effectively
  disabled to ensure that Docker will always run even if you start the socket
  individually. Users should probably just ignore this unit file. bsc#1210141</changelog>
  <changelog author="asarai@suse.com" date="1697025600">- Add a patch to fix apparmor on SLE-12, reverting the upstream removal of
  version-specific templating for the default apparmor profile. bsc#1213500
  + 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to Docker 24.0.7-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2407&gt;. bsc#1217513
  * Deny containers access to /sys/devices/virtual/powercap by default.
  - CVE-2020-8694 bsc#1170415
  - CVE-2020-8695 bsc#1170446
  - CVE-2020-12912 bsc#1178760
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="dcermak@suse.com" date="1707912000">- Vendor latest buildkit v0.11:
  Add patch 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch that
  vendors in the latest v0.11 buildkit branch including bugfixes for the following:
  * bsc#1219438: CVE-2024-23653
  * bsc#1219268: CVE-2024-23652
  * bsc#1219267: CVE-2024-23651
- rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- switch from %patchN to %patch -PN syntax
- remove unused rpmlint filters and add filters to silence pointless bash &amp; zsh
  completion warnings</changelog>
  <changelog author="danish.prakash@suse.com" date="1708171200">- Update to Docker 25.0.3-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2503&gt;
- Fixes:
  * bsc#1219267 - CVE-2024-23651
  * bsc#1219268 - CVE-2024-23652
  * bsc#1219438 - CVE-2024-23653
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Remove upstreamed patches:
  - 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1709899200">[NOTE: This update was only ever released in SLES and Leap.]
- Add patch to fix bsc#1220339
  * 0007-daemon-overlay2-remove-world-writable-permission-fro.patch
- rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch</changelog>
  <changelog author="asarai@suse.com" date="1711368000">[NOTE: This update was only ever released in SLES and Leap.]
- Update to Docker 25.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2505&gt; bsc#1223409
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Remove upstreamed patches:
  - 0007-daemon-overlay2-remove-world-writable-permission-fro.patch
- Update --add-runtime to point to correct binary path.</changelog>
  <changelog author="asarai@suse.com" date="1719230400">- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- Fix BuildKit's symlink resolution logic to correctly handle non-lexical
  symlinks. Backport of &lt;https://github.com/moby/buildkit/pull/4896&gt; and
  &lt;https://github.com/moby/buildkit/pull/5060&gt;. bsc#1221916
  + 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
- Write volume options atomically so sudden system crashes won't result in
  future Docker starts failing due to empty files. Backport of
  &lt;https://github.com/moby/moby/pull/48034&gt;. bsc#1214855
  + 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch</changelog>
  <changelog author="asarai@suse.com" date="1722427200">[NOTE: This update was only ever released in SLES and Leap.]
- Update to Docker 25.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2506&gt;
- This update includes a fix for CVE-2024-41110. bsc#1228324
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
  * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch</changelog>
</package>
<package pkgid="7688a163d5718cad64e1ed0ca9f218b5563f01e3fb49ef0e9a69028d843fde91" name="docker" arch="s390x">
  <version epoch="0" ver="25.0.6_ce" rel="150000.203.1"/>
  <changelog author="dmueller@suse.com" date="1675252800">- update to 20.10.23-ce.
  * see upstream changelog at https://docs.docker.com/engine/release-notes/#201023
- drop kubic flavor as kubic is EOL. this removes:
  kubelet.env docker-kubic-service.conf 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch</changelog>
  <changelog author="asarai@suse.com" date="1682510400">- Update to Docker 23.0.4-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2304&gt;. bsc#1208074
- Fixes:
  * bsc#1214107 - CVE-2023-28840
  * bsc#1214108 - CVE-2023-28841
  * bsc#1214109 - CVE-2023-28842
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Renumbered patches:
  - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Remove upstreamed patches:
  - 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  - 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch
  - 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch
- Backport &lt;https://github.com/docker/cli/pull/4228&gt; to allow man pages to be
  built without internet access in OBS.
  + cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1682596800">- Update to Docker 23.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2305&gt;.
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to Docker 23.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2306&gt;. bsc#1211578
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Re-unify packaging for SLE-12 and SLE-15.
- Add patch to fix build on SLE-12 by switching back to libbtrfs-devel headers
  (the uapi headers in SLE-12 are too old).
  + 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
- Re-numbered patches:
  - 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch`</changelog>
  <changelog author="asarai@suse.com" date="1686744000">- Update to Docker 24.0.2-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2402&gt;. bsc#1212368
  * Includes the upstreamed fix for the mount table pollution issue.
    bsc#1210797
- Add Recommends for docker-buildx, and add /usr/lib/docker/cli-plugins as
  being provided by this package.
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1687262400">- Add docker-rootless-extras subpackage
  (https://docs.docker.com/engine/security/rootless)</changelog>
  <changelog author="danish.prakash@suse.com" date="1688040000">- Recommend docker-rootless-extras instead of Require(ing) it, given
  it's an additional functionality and not inherently required for
  docker to function.</changelog>
  <changelog author="asarai@suse.com" date="1688731200">- Update to Docker 24.0.3-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2403&gt;. bsc#1213120
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1688731201">- Update to Docker 24.0.4-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2404&gt;. bsc#1213500</changelog>
  <changelog author="dmueller@suse.com" date="1690286400">- Update to Docker 24.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2405&gt;. bsc#1213229</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to Docker 24.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2406&gt;. bsc#1215323
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Switch from disabledrun to manualrun in _service.
- Add a docker.socket unit file, but with socket activation effectively
  disabled to ensure that Docker will always run even if you start the socket
  individually. Users should probably just ignore this unit file. bsc#1210141</changelog>
  <changelog author="asarai@suse.com" date="1697025600">- Add a patch to fix apparmor on SLE-12, reverting the upstream removal of
  version-specific templating for the default apparmor profile. bsc#1213500
  + 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to Docker 24.0.7-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2407&gt;. bsc#1217513
  * Deny containers access to /sys/devices/virtual/powercap by default.
  - CVE-2020-8694 bsc#1170415
  - CVE-2020-8695 bsc#1170446
  - CVE-2020-12912 bsc#1178760
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="dcermak@suse.com" date="1707912000">- Vendor latest buildkit v0.11:
  Add patch 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch that
  vendors in the latest v0.11 buildkit branch including bugfixes for the following:
  * bsc#1219438: CVE-2024-23653
  * bsc#1219268: CVE-2024-23652
  * bsc#1219267: CVE-2024-23651
- rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- switch from %patchN to %patch -PN syntax
- remove unused rpmlint filters and add filters to silence pointless bash &amp; zsh
  completion warnings</changelog>
  <changelog author="danish.prakash@suse.com" date="1708171200">- Update to Docker 25.0.3-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2503&gt;
- Fixes:
  * bsc#1219267 - CVE-2024-23651
  * bsc#1219268 - CVE-2024-23652
  * bsc#1219438 - CVE-2024-23653
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Remove upstreamed patches:
  - 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1709899200">[NOTE: This update was only ever released in SLES and Leap.]
- Add patch to fix bsc#1220339
  * 0007-daemon-overlay2-remove-world-writable-permission-fro.patch
- rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch</changelog>
  <changelog author="asarai@suse.com" date="1711368000">[NOTE: This update was only ever released in SLES and Leap.]
- Update to Docker 25.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2505&gt; bsc#1223409
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Remove upstreamed patches:
  - 0007-daemon-overlay2-remove-world-writable-permission-fro.patch
- Update --add-runtime to point to correct binary path.</changelog>
  <changelog author="asarai@suse.com" date="1719230400">- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- Fix BuildKit's symlink resolution logic to correctly handle non-lexical
  symlinks. Backport of &lt;https://github.com/moby/buildkit/pull/4896&gt; and
  &lt;https://github.com/moby/buildkit/pull/5060&gt;. bsc#1221916
  + 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
- Write volume options atomically so sudden system crashes won't result in
  future Docker starts failing due to empty files. Backport of
  &lt;https://github.com/moby/moby/pull/48034&gt;. bsc#1214855
  + 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch</changelog>
  <changelog author="asarai@suse.com" date="1722427200">[NOTE: This update was only ever released in SLES and Leap.]
- Update to Docker 25.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2506&gt;
- This update includes a fix for CVE-2024-41110. bsc#1228324
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
  * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch</changelog>
</package>
<package pkgid="caf4def74854647ff0b5f2e542e3a56a3b608a83daae4c30e071a5ae7852d9b3" name="docker" arch="src">
  <version epoch="0" ver="25.0.6_ce" rel="150000.203.1"/>
  <changelog author="dmueller@suse.com" date="1675252800">- update to 20.10.23-ce.
  * see upstream changelog at https://docs.docker.com/engine/release-notes/#201023
- drop kubic flavor as kubic is EOL. this removes:
  kubelet.env docker-kubic-service.conf 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch</changelog>
  <changelog author="asarai@suse.com" date="1682510400">- Update to Docker 23.0.4-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2304&gt;. bsc#1208074
- Fixes:
  * bsc#1214107 - CVE-2023-28840
  * bsc#1214108 - CVE-2023-28841
  * bsc#1214109 - CVE-2023-28842
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Renumbered patches:
  - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Remove upstreamed patches:
  - 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  - 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch
  - 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch
- Backport &lt;https://github.com/docker/cli/pull/4228&gt; to allow man pages to be
  built without internet access in OBS.
  + cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1682596800">- Update to Docker 23.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2305&gt;.
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to Docker 23.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2306&gt;. bsc#1211578
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Re-unify packaging for SLE-12 and SLE-15.
- Add patch to fix build on SLE-12 by switching back to libbtrfs-devel headers
  (the uapi headers in SLE-12 are too old).
  + 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
- Re-numbered patches:
  - 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch`</changelog>
  <changelog author="asarai@suse.com" date="1686744000">- Update to Docker 24.0.2-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2402&gt;. bsc#1212368
  * Includes the upstreamed fix for the mount table pollution issue.
    bsc#1210797
- Add Recommends for docker-buildx, and add /usr/lib/docker/cli-plugins as
  being provided by this package.
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1687262400">- Add docker-rootless-extras subpackage
  (https://docs.docker.com/engine/security/rootless)</changelog>
  <changelog author="danish.prakash@suse.com" date="1688040000">- Recommend docker-rootless-extras instead of Require(ing) it, given
  it's an additional functionality and not inherently required for
  docker to function.</changelog>
  <changelog author="asarai@suse.com" date="1688731200">- Update to Docker 24.0.3-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2403&gt;. bsc#1213120
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1688731201">- Update to Docker 24.0.4-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2404&gt;. bsc#1213500</changelog>
  <changelog author="dmueller@suse.com" date="1690286400">- Update to Docker 24.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2405&gt;. bsc#1213229</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to Docker 24.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2406&gt;. bsc#1215323
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Switch from disabledrun to manualrun in _service.
- Add a docker.socket unit file, but with socket activation effectively
  disabled to ensure that Docker will always run even if you start the socket
  individually. Users should probably just ignore this unit file. bsc#1210141</changelog>
  <changelog author="asarai@suse.com" date="1697025600">- Add a patch to fix apparmor on SLE-12, reverting the upstream removal of
  version-specific templating for the default apparmor profile. bsc#1213500
  + 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to Docker 24.0.7-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2407&gt;. bsc#1217513
  * Deny containers access to /sys/devices/virtual/powercap by default.
  - CVE-2020-8694 bsc#1170415
  - CVE-2020-8695 bsc#1170446
  - CVE-2020-12912 bsc#1178760
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="dcermak@suse.com" date="1707912000">- Vendor latest buildkit v0.11:
  Add patch 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch that
  vendors in the latest v0.11 buildkit branch including bugfixes for the following:
  * bsc#1219438: CVE-2024-23653
  * bsc#1219268: CVE-2024-23652
  * bsc#1219267: CVE-2024-23651
- rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- switch from %patchN to %patch -PN syntax
- remove unused rpmlint filters and add filters to silence pointless bash &amp; zsh
  completion warnings</changelog>
  <changelog author="danish.prakash@suse.com" date="1708171200">- Update to Docker 25.0.3-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2503&gt;
- Fixes:
  * bsc#1219267 - CVE-2024-23651
  * bsc#1219268 - CVE-2024-23652
  * bsc#1219438 - CVE-2024-23653
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Remove upstreamed patches:
  - 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1709899200">[NOTE: This update was only ever released in SLES and Leap.]
- Add patch to fix bsc#1220339
  * 0007-daemon-overlay2-remove-world-writable-permission-fro.patch
- rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch</changelog>
  <changelog author="asarai@suse.com" date="1711368000">[NOTE: This update was only ever released in SLES and Leap.]
- Update to Docker 25.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2505&gt; bsc#1223409
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Remove upstreamed patches:
  - 0007-daemon-overlay2-remove-world-writable-permission-fro.patch
- Update --add-runtime to point to correct binary path.</changelog>
  <changelog author="asarai@suse.com" date="1719230400">- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- Fix BuildKit's symlink resolution logic to correctly handle non-lexical
  symlinks. Backport of &lt;https://github.com/moby/buildkit/pull/4896&gt; and
  &lt;https://github.com/moby/buildkit/pull/5060&gt;. bsc#1221916
  + 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
- Write volume options atomically so sudden system crashes won't result in
  future Docker starts failing due to empty files. Backport of
  &lt;https://github.com/moby/moby/pull/48034&gt;. bsc#1214855
  + 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch</changelog>
  <changelog author="asarai@suse.com" date="1722427200">[NOTE: This update was only ever released in SLES and Leap.]
- Update to Docker 25.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2506&gt;
- This update includes a fix for CVE-2024-41110. bsc#1228324
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
  * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch</changelog>
</package>
<package pkgid="8149fa1d8cc7a2fd1e49672b1c33d7d22b1e1fd7559a9278bff197a142bcef01" name="docker" arch="x86_64">
  <version epoch="0" ver="25.0.6_ce" rel="150000.203.1"/>
  <changelog author="dmueller@suse.com" date="1675252800">- update to 20.10.23-ce.
  * see upstream changelog at https://docs.docker.com/engine/release-notes/#201023
- drop kubic flavor as kubic is EOL. this removes:
  kubelet.env docker-kubic-service.conf 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch</changelog>
  <changelog author="asarai@suse.com" date="1682510400">- Update to Docker 23.0.4-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2304&gt;. bsc#1208074
- Fixes:
  * bsc#1214107 - CVE-2023-28840
  * bsc#1214108 - CVE-2023-28841
  * bsc#1214109 - CVE-2023-28842
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Renumbered patches:
  - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Remove upstreamed patches:
  - 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  - 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch
  - 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch
- Backport &lt;https://github.com/docker/cli/pull/4228&gt; to allow man pages to be
  built without internet access in OBS.
  + cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1682596800">- Update to Docker 23.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2305&gt;.
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to Docker 23.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2306&gt;. bsc#1211578
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Re-unify packaging for SLE-12 and SLE-15.
- Add patch to fix build on SLE-12 by switching back to libbtrfs-devel headers
  (the uapi headers in SLE-12 are too old).
  + 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
- Re-numbered patches:
  - 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch`</changelog>
  <changelog author="asarai@suse.com" date="1686744000">- Update to Docker 24.0.2-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2402&gt;. bsc#1212368
  * Includes the upstreamed fix for the mount table pollution issue.
    bsc#1210797
- Add Recommends for docker-buildx, and add /usr/lib/docker/cli-plugins as
  being provided by this package.
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1687262400">- Add docker-rootless-extras subpackage
  (https://docs.docker.com/engine/security/rootless)</changelog>
  <changelog author="danish.prakash@suse.com" date="1688040000">- Recommend docker-rootless-extras instead of Require(ing) it, given
  it's an additional functionality and not inherently required for
  docker to function.</changelog>
  <changelog author="asarai@suse.com" date="1688731200">- Update to Docker 24.0.3-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2403&gt;. bsc#1213120
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1688731201">- Update to Docker 24.0.4-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2404&gt;. bsc#1213500</changelog>
  <changelog author="dmueller@suse.com" date="1690286400">- Update to Docker 24.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2405&gt;. bsc#1213229</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to Docker 24.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2406&gt;. bsc#1215323
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Switch from disabledrun to manualrun in _service.
- Add a docker.socket unit file, but with socket activation effectively
  disabled to ensure that Docker will always run even if you start the socket
  individually. Users should probably just ignore this unit file. bsc#1210141</changelog>
  <changelog author="asarai@suse.com" date="1697025600">- Add a patch to fix apparmor on SLE-12, reverting the upstream removal of
  version-specific templating for the default apparmor profile. bsc#1213500
  + 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to Docker 24.0.7-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2407&gt;. bsc#1217513
  * Deny containers access to /sys/devices/virtual/powercap by default.
  - CVE-2020-8694 bsc#1170415
  - CVE-2020-8695 bsc#1170446
  - CVE-2020-12912 bsc#1178760
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="dcermak@suse.com" date="1707912000">- Vendor latest buildkit v0.11:
  Add patch 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch that
  vendors in the latest v0.11 buildkit branch including bugfixes for the following:
  * bsc#1219438: CVE-2024-23653
  * bsc#1219268: CVE-2024-23652
  * bsc#1219267: CVE-2024-23651
- rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- switch from %patchN to %patch -PN syntax
- remove unused rpmlint filters and add filters to silence pointless bash &amp; zsh
  completion warnings</changelog>
  <changelog author="danish.prakash@suse.com" date="1708171200">- Update to Docker 25.0.3-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2503&gt;
- Fixes:
  * bsc#1219267 - CVE-2024-23651
  * bsc#1219268 - CVE-2024-23652
  * bsc#1219438 - CVE-2024-23653
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Remove upstreamed patches:
  - 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1709899200">[NOTE: This update was only ever released in SLES and Leap.]
- Add patch to fix bsc#1220339
  * 0007-daemon-overlay2-remove-world-writable-permission-fro.patch
- rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch</changelog>
  <changelog author="asarai@suse.com" date="1711368000">[NOTE: This update was only ever released in SLES and Leap.]
- Update to Docker 25.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2505&gt; bsc#1223409
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Remove upstreamed patches:
  - 0007-daemon-overlay2-remove-world-writable-permission-fro.patch
- Update --add-runtime to point to correct binary path.</changelog>
  <changelog author="asarai@suse.com" date="1719230400">- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- Fix BuildKit's symlink resolution logic to correctly handle non-lexical
  symlinks. Backport of &lt;https://github.com/moby/buildkit/pull/4896&gt; and
  &lt;https://github.com/moby/buildkit/pull/5060&gt;. bsc#1221916
  + 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
- Write volume options atomically so sudden system crashes won't result in
  future Docker starts failing due to empty files. Backport of
  &lt;https://github.com/moby/moby/pull/48034&gt;. bsc#1214855
  + 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch</changelog>
  <changelog author="asarai@suse.com" date="1722427200">[NOTE: This update was only ever released in SLES and Leap.]
- Update to Docker 25.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2506&gt;
- This update includes a fix for CVE-2024-41110. bsc#1228324
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
  * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch</changelog>
</package>
<package pkgid="fdafc70213d9ba4aabf7a8ffa1610eb288945a7719f6b70704214cac2e53ed7d" name="docker" arch="aarch64">
  <version epoch="0" ver="25.0.6_ce" rel="150000.207.1"/>
  <changelog author="dmueller@suse.com" date="1675252800">- update to 20.10.23-ce.
  * see upstream changelog at https://docs.docker.com/engine/release-notes/#201023
- drop kubic flavor as kubic is EOL. this removes:
  kubelet.env docker-kubic-service.conf 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch</changelog>
  <changelog author="asarai@suse.com" date="1682510400">- Update to Docker 23.0.4-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2304&gt;. bsc#1208074
- Fixes:
  * bsc#1214107 - CVE-2023-28840
  * bsc#1214108 - CVE-2023-28841
  * bsc#1214109 - CVE-2023-28842
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Renumbered patches:
  - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Remove upstreamed patches:
  - 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  - 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch
  - 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch
- Backport &lt;https://github.com/docker/cli/pull/4228&gt; to allow man pages to be
  built without internet access in OBS.
  + cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1682596800">- Update to Docker 23.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2305&gt;.
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to Docker 23.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2306&gt;. bsc#1211578
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Re-unify packaging for SLE-12 and SLE-15.
- Add patch to fix build on SLE-12 by switching back to libbtrfs-devel headers
  (the uapi headers in SLE-12 are too old).
  + 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
- Re-numbered patches:
  - 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch`</changelog>
  <changelog author="asarai@suse.com" date="1686744000">- Update to Docker 24.0.2-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2402&gt;. bsc#1212368
  * Includes the upstreamed fix for the mount table pollution issue.
    bsc#1210797
- Add Recommends for docker-buildx, and add /usr/lib/docker/cli-plugins as
  being provided by this package.
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1687262400">- Add docker-rootless-extras subpackage
  (https://docs.docker.com/engine/security/rootless)</changelog>
  <changelog author="danish.prakash@suse.com" date="1688040000">- Recommend docker-rootless-extras instead of Require(ing) it, given
  it's an additional functionality and not inherently required for
  docker to function.</changelog>
  <changelog author="asarai@suse.com" date="1688731200">- Update to Docker 24.0.3-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2403&gt;. bsc#1213120
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1688731201">- Update to Docker 24.0.4-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2404&gt;. bsc#1213500</changelog>
  <changelog author="dmueller@suse.com" date="1690286400">- Update to Docker 24.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2405&gt;. bsc#1213229</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to Docker 24.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2406&gt;. bsc#1215323
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Switch from disabledrun to manualrun in _service.
- Add a docker.socket unit file, but with socket activation effectively
  disabled to ensure that Docker will always run even if you start the socket
  individually. Users should probably just ignore this unit file. bsc#1210141</changelog>
  <changelog author="asarai@suse.com" date="1697025600">- Add a patch to fix apparmor on SLE-12, reverting the upstream removal of
  version-specific templating for the default apparmor profile. bsc#1213500
  + 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to Docker 24.0.7-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2407&gt;. bsc#1217513
  * Deny containers access to /sys/devices/virtual/powercap by default.
  - CVE-2020-8694 bsc#1170415
  - CVE-2020-8695 bsc#1170446
  - CVE-2020-12912 bsc#1178760
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="dcermak@suse.com" date="1707912000">- Vendor latest buildkit v0.11:
  Add patch 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch that
  vendors in the latest v0.11 buildkit branch including bugfixes for the following:
  * bsc#1219438: CVE-2024-23653
  * bsc#1219268: CVE-2024-23652
  * bsc#1219267: CVE-2024-23651
- rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- switch from %patchN to %patch -PN syntax
- remove unused rpmlint filters and add filters to silence pointless bash &amp; zsh
  completion warnings</changelog>
  <changelog author="danish.prakash@suse.com" date="1708171200">- Update to Docker 25.0.3-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2503&gt;
- Fixes:
  * bsc#1219267 - CVE-2024-23651
  * bsc#1219268 - CVE-2024-23652
  * bsc#1219438 - CVE-2024-23653
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Remove upstreamed patches:
  - 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1709899200">[NOTE: This update was only ever released in SLES and Leap.]
- Add patch to fix bsc#1220339
  * 0007-daemon-overlay2-remove-world-writable-permission-fro.patch
- rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch</changelog>
  <changelog author="asarai@suse.com" date="1711368000">[NOTE: This update was only ever released in SLES and Leap.]
- Update to Docker 25.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2505&gt; bsc#1223409
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Remove upstreamed patches:
  - 0007-daemon-overlay2-remove-world-writable-permission-fro.patch
- Update --add-runtime to point to correct binary path.</changelog>
  <changelog author="asarai@suse.com" date="1719230400">- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- Fix BuildKit's symlink resolution logic to correctly handle non-lexical
  symlinks. Backport of &lt;https://github.com/moby/buildkit/pull/4896&gt; and
  &lt;https://github.com/moby/buildkit/pull/5060&gt;. bsc#1221916
  + 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
- Write volume options atomically so sudden system crashes won't result in
  future Docker starts failing due to empty files. Backport of
  &lt;https://github.com/moby/moby/pull/48034&gt;. bsc#1214855
  + 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch</changelog>
  <changelog author="asarai@suse.com" date="1722427200">[NOTE: This update was only ever released in SLES and Leap.]
- Update to Docker 25.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2506&gt;
- This update includes a fix for CVE-2024-41110. bsc#1228324
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
  * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch</changelog>
</package>
<package pkgid="42a43dbeeffbf013034c55aa902c29b0615f66c19f45d42d3936f913359a6f31" name="docker" arch="ppc64le">
  <version epoch="0" ver="25.0.6_ce" rel="150000.207.1"/>
  <changelog author="dmueller@suse.com" date="1675252800">- update to 20.10.23-ce.
  * see upstream changelog at https://docs.docker.com/engine/release-notes/#201023
- drop kubic flavor as kubic is EOL. this removes:
  kubelet.env docker-kubic-service.conf 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch</changelog>
  <changelog author="asarai@suse.com" date="1682510400">- Update to Docker 23.0.4-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2304&gt;. bsc#1208074
- Fixes:
  * bsc#1214107 - CVE-2023-28840
  * bsc#1214108 - CVE-2023-28841
  * bsc#1214109 - CVE-2023-28842
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Renumbered patches:
  - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Remove upstreamed patches:
  - 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  - 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch
  - 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch
- Backport &lt;https://github.com/docker/cli/pull/4228&gt; to allow man pages to be
  built without internet access in OBS.
  + cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1682596800">- Update to Docker 23.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2305&gt;.
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to Docker 23.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2306&gt;. bsc#1211578
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Re-unify packaging for SLE-12 and SLE-15.
- Add patch to fix build on SLE-12 by switching back to libbtrfs-devel headers
  (the uapi headers in SLE-12 are too old).
  + 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
- Re-numbered patches:
  - 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch`</changelog>
  <changelog author="asarai@suse.com" date="1686744000">- Update to Docker 24.0.2-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2402&gt;. bsc#1212368
  * Includes the upstreamed fix for the mount table pollution issue.
    bsc#1210797
- Add Recommends for docker-buildx, and add /usr/lib/docker/cli-plugins as
  being provided by this package.
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1687262400">- Add docker-rootless-extras subpackage
  (https://docs.docker.com/engine/security/rootless)</changelog>
  <changelog author="danish.prakash@suse.com" date="1688040000">- Recommend docker-rootless-extras instead of Require(ing) it, given
  it's an additional functionality and not inherently required for
  docker to function.</changelog>
  <changelog author="asarai@suse.com" date="1688731200">- Update to Docker 24.0.3-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2403&gt;. bsc#1213120
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1688731201">- Update to Docker 24.0.4-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2404&gt;. bsc#1213500</changelog>
  <changelog author="dmueller@suse.com" date="1690286400">- Update to Docker 24.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2405&gt;. bsc#1213229</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to Docker 24.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2406&gt;. bsc#1215323
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Switch from disabledrun to manualrun in _service.
- Add a docker.socket unit file, but with socket activation effectively
  disabled to ensure that Docker will always run even if you start the socket
  individually. Users should probably just ignore this unit file. bsc#1210141</changelog>
  <changelog author="asarai@suse.com" date="1697025600">- Add a patch to fix apparmor on SLE-12, reverting the upstream removal of
  version-specific templating for the default apparmor profile. bsc#1213500
  + 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to Docker 24.0.7-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2407&gt;. bsc#1217513
  * Deny containers access to /sys/devices/virtual/powercap by default.
  - CVE-2020-8694 bsc#1170415
  - CVE-2020-8695 bsc#1170446
  - CVE-2020-12912 bsc#1178760
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="dcermak@suse.com" date="1707912000">- Vendor latest buildkit v0.11:
  Add patch 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch that
  vendors in the latest v0.11 buildkit branch including bugfixes for the following:
  * bsc#1219438: CVE-2024-23653
  * bsc#1219268: CVE-2024-23652
  * bsc#1219267: CVE-2024-23651
- rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- switch from %patchN to %patch -PN syntax
- remove unused rpmlint filters and add filters to silence pointless bash &amp; zsh
  completion warnings</changelog>
  <changelog author="danish.prakash@suse.com" date="1708171200">- Update to Docker 25.0.3-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2503&gt;
- Fixes:
  * bsc#1219267 - CVE-2024-23651
  * bsc#1219268 - CVE-2024-23652
  * bsc#1219438 - CVE-2024-23653
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Remove upstreamed patches:
  - 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1709899200">[NOTE: This update was only ever released in SLES and Leap.]
- Add patch to fix bsc#1220339
  * 0007-daemon-overlay2-remove-world-writable-permission-fro.patch
- rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch</changelog>
  <changelog author="asarai@suse.com" date="1711368000">[NOTE: This update was only ever released in SLES and Leap.]
- Update to Docker 25.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2505&gt; bsc#1223409
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Remove upstreamed patches:
  - 0007-daemon-overlay2-remove-world-writable-permission-fro.patch
- Update --add-runtime to point to correct binary path.</changelog>
  <changelog author="asarai@suse.com" date="1719230400">- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- Fix BuildKit's symlink resolution logic to correctly handle non-lexical
  symlinks. Backport of &lt;https://github.com/moby/buildkit/pull/4896&gt; and
  &lt;https://github.com/moby/buildkit/pull/5060&gt;. bsc#1221916
  + 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
- Write volume options atomically so sudden system crashes won't result in
  future Docker starts failing due to empty files. Backport of
  &lt;https://github.com/moby/moby/pull/48034&gt;. bsc#1214855
  + 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch</changelog>
  <changelog author="asarai@suse.com" date="1722427200">[NOTE: This update was only ever released in SLES and Leap.]
- Update to Docker 25.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2506&gt;
- This update includes a fix for CVE-2024-41110. bsc#1228324
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
  * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch</changelog>
</package>
<package pkgid="b6cc4d488bfcc3ecd56d05d57d5dff2a27fa9653e64b91a07712d45ae825b4c6" name="docker" arch="s390x">
  <version epoch="0" ver="25.0.6_ce" rel="150000.207.1"/>
  <changelog author="dmueller@suse.com" date="1675252800">- update to 20.10.23-ce.
  * see upstream changelog at https://docs.docker.com/engine/release-notes/#201023
- drop kubic flavor as kubic is EOL. this removes:
  kubelet.env docker-kubic-service.conf 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch</changelog>
  <changelog author="asarai@suse.com" date="1682510400">- Update to Docker 23.0.4-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2304&gt;. bsc#1208074
- Fixes:
  * bsc#1214107 - CVE-2023-28840
  * bsc#1214108 - CVE-2023-28841
  * bsc#1214109 - CVE-2023-28842
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Renumbered patches:
  - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Remove upstreamed patches:
  - 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  - 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch
  - 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch
- Backport &lt;https://github.com/docker/cli/pull/4228&gt; to allow man pages to be
  built without internet access in OBS.
  + cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1682596800">- Update to Docker 23.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2305&gt;.
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to Docker 23.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2306&gt;. bsc#1211578
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Re-unify packaging for SLE-12 and SLE-15.
- Add patch to fix build on SLE-12 by switching back to libbtrfs-devel headers
  (the uapi headers in SLE-12 are too old).
  + 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
- Re-numbered patches:
  - 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch`</changelog>
  <changelog author="asarai@suse.com" date="1686744000">- Update to Docker 24.0.2-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2402&gt;. bsc#1212368
  * Includes the upstreamed fix for the mount table pollution issue.
    bsc#1210797
- Add Recommends for docker-buildx, and add /usr/lib/docker/cli-plugins as
  being provided by this package.
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1687262400">- Add docker-rootless-extras subpackage
  (https://docs.docker.com/engine/security/rootless)</changelog>
  <changelog author="danish.prakash@suse.com" date="1688040000">- Recommend docker-rootless-extras instead of Require(ing) it, given
  it's an additional functionality and not inherently required for
  docker to function.</changelog>
  <changelog author="asarai@suse.com" date="1688731200">- Update to Docker 24.0.3-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2403&gt;. bsc#1213120
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1688731201">- Update to Docker 24.0.4-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2404&gt;. bsc#1213500</changelog>
  <changelog author="dmueller@suse.com" date="1690286400">- Update to Docker 24.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2405&gt;. bsc#1213229</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to Docker 24.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2406&gt;. bsc#1215323
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Switch from disabledrun to manualrun in _service.
- Add a docker.socket unit file, but with socket activation effectively
  disabled to ensure that Docker will always run even if you start the socket
  individually. Users should probably just ignore this unit file. bsc#1210141</changelog>
  <changelog author="asarai@suse.com" date="1697025600">- Add a patch to fix apparmor on SLE-12, reverting the upstream removal of
  version-specific templating for the default apparmor profile. bsc#1213500
  + 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to Docker 24.0.7-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2407&gt;. bsc#1217513
  * Deny containers access to /sys/devices/virtual/powercap by default.
  - CVE-2020-8694 bsc#1170415
  - CVE-2020-8695 bsc#1170446
  - CVE-2020-12912 bsc#1178760
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="dcermak@suse.com" date="1707912000">- Vendor latest buildkit v0.11:
  Add patch 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch that
  vendors in the latest v0.11 buildkit branch including bugfixes for the following:
  * bsc#1219438: CVE-2024-23653
  * bsc#1219268: CVE-2024-23652
  * bsc#1219267: CVE-2024-23651
- rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- switch from %patchN to %patch -PN syntax
- remove unused rpmlint filters and add filters to silence pointless bash &amp; zsh
  completion warnings</changelog>
  <changelog author="danish.prakash@suse.com" date="1708171200">- Update to Docker 25.0.3-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2503&gt;
- Fixes:
  * bsc#1219267 - CVE-2024-23651
  * bsc#1219268 - CVE-2024-23652
  * bsc#1219438 - CVE-2024-23653
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Remove upstreamed patches:
  - 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1709899200">[NOTE: This update was only ever released in SLES and Leap.]
- Add patch to fix bsc#1220339
  * 0007-daemon-overlay2-remove-world-writable-permission-fro.patch
- rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch</changelog>
  <changelog author="asarai@suse.com" date="1711368000">[NOTE: This update was only ever released in SLES and Leap.]
- Update to Docker 25.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2505&gt; bsc#1223409
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Remove upstreamed patches:
  - 0007-daemon-overlay2-remove-world-writable-permission-fro.patch
- Update --add-runtime to point to correct binary path.</changelog>
  <changelog author="asarai@suse.com" date="1719230400">- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- Fix BuildKit's symlink resolution logic to correctly handle non-lexical
  symlinks. Backport of &lt;https://github.com/moby/buildkit/pull/4896&gt; and
  &lt;https://github.com/moby/buildkit/pull/5060&gt;. bsc#1221916
  + 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
- Write volume options atomically so sudden system crashes won't result in
  future Docker starts failing due to empty files. Backport of
  &lt;https://github.com/moby/moby/pull/48034&gt;. bsc#1214855
  + 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch</changelog>
  <changelog author="asarai@suse.com" date="1722427200">[NOTE: This update was only ever released in SLES and Leap.]
- Update to Docker 25.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2506&gt;
- This update includes a fix for CVE-2024-41110. bsc#1228324
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
  * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch</changelog>
</package>
<package pkgid="be5f7c96a050c9da13852da37ad43ca3b21d3e43b6d2193a5cb7bff2bc5105fa" name="docker" arch="src">
  <version epoch="0" ver="25.0.6_ce" rel="150000.207.1"/>
  <changelog author="dmueller@suse.com" date="1675252800">- update to 20.10.23-ce.
  * see upstream changelog at https://docs.docker.com/engine/release-notes/#201023
- drop kubic flavor as kubic is EOL. this removes:
  kubelet.env docker-kubic-service.conf 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch</changelog>
  <changelog author="asarai@suse.com" date="1682510400">- Update to Docker 23.0.4-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2304&gt;. bsc#1208074
- Fixes:
  * bsc#1214107 - CVE-2023-28840
  * bsc#1214108 - CVE-2023-28841
  * bsc#1214109 - CVE-2023-28842
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Renumbered patches:
  - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Remove upstreamed patches:
  - 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  - 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch
  - 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch
- Backport &lt;https://github.com/docker/cli/pull/4228&gt; to allow man pages to be
  built without internet access in OBS.
  + cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1682596800">- Update to Docker 23.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2305&gt;.
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to Docker 23.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2306&gt;. bsc#1211578
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Re-unify packaging for SLE-12 and SLE-15.
- Add patch to fix build on SLE-12 by switching back to libbtrfs-devel headers
  (the uapi headers in SLE-12 are too old).
  + 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
- Re-numbered patches:
  - 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch`</changelog>
  <changelog author="asarai@suse.com" date="1686744000">- Update to Docker 24.0.2-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2402&gt;. bsc#1212368
  * Includes the upstreamed fix for the mount table pollution issue.
    bsc#1210797
- Add Recommends for docker-buildx, and add /usr/lib/docker/cli-plugins as
  being provided by this package.
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1687262400">- Add docker-rootless-extras subpackage
  (https://docs.docker.com/engine/security/rootless)</changelog>
  <changelog author="danish.prakash@suse.com" date="1688040000">- Recommend docker-rootless-extras instead of Require(ing) it, given
  it's an additional functionality and not inherently required for
  docker to function.</changelog>
  <changelog author="asarai@suse.com" date="1688731200">- Update to Docker 24.0.3-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2403&gt;. bsc#1213120
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1688731201">- Update to Docker 24.0.4-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2404&gt;. bsc#1213500</changelog>
  <changelog author="dmueller@suse.com" date="1690286400">- Update to Docker 24.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2405&gt;. bsc#1213229</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to Docker 24.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2406&gt;. bsc#1215323
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Switch from disabledrun to manualrun in _service.
- Add a docker.socket unit file, but with socket activation effectively
  disabled to ensure that Docker will always run even if you start the socket
  individually. Users should probably just ignore this unit file. bsc#1210141</changelog>
  <changelog author="asarai@suse.com" date="1697025600">- Add a patch to fix apparmor on SLE-12, reverting the upstream removal of
  version-specific templating for the default apparmor profile. bsc#1213500
  + 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to Docker 24.0.7-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2407&gt;. bsc#1217513
  * Deny containers access to /sys/devices/virtual/powercap by default.
  - CVE-2020-8694 bsc#1170415
  - CVE-2020-8695 bsc#1170446
  - CVE-2020-12912 bsc#1178760
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="dcermak@suse.com" date="1707912000">- Vendor latest buildkit v0.11:
  Add patch 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch that
  vendors in the latest v0.11 buildkit branch including bugfixes for the following:
  * bsc#1219438: CVE-2024-23653
  * bsc#1219268: CVE-2024-23652
  * bsc#1219267: CVE-2024-23651
- rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- switch from %patchN to %patch -PN syntax
- remove unused rpmlint filters and add filters to silence pointless bash &amp; zsh
  completion warnings</changelog>
  <changelog author="danish.prakash@suse.com" date="1708171200">- Update to Docker 25.0.3-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2503&gt;
- Fixes:
  * bsc#1219267 - CVE-2024-23651
  * bsc#1219268 - CVE-2024-23652
  * bsc#1219438 - CVE-2024-23653
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Remove upstreamed patches:
  - 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1709899200">[NOTE: This update was only ever released in SLES and Leap.]
- Add patch to fix bsc#1220339
  * 0007-daemon-overlay2-remove-world-writable-permission-fro.patch
- rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch</changelog>
  <changelog author="asarai@suse.com" date="1711368000">[NOTE: This update was only ever released in SLES and Leap.]
- Update to Docker 25.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2505&gt; bsc#1223409
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Remove upstreamed patches:
  - 0007-daemon-overlay2-remove-world-writable-permission-fro.patch
- Update --add-runtime to point to correct binary path.</changelog>
  <changelog author="asarai@suse.com" date="1719230400">- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- Fix BuildKit's symlink resolution logic to correctly handle non-lexical
  symlinks. Backport of &lt;https://github.com/moby/buildkit/pull/4896&gt; and
  &lt;https://github.com/moby/buildkit/pull/5060&gt;. bsc#1221916
  + 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
- Write volume options atomically so sudden system crashes won't result in
  future Docker starts failing due to empty files. Backport of
  &lt;https://github.com/moby/moby/pull/48034&gt;. bsc#1214855
  + 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch</changelog>
  <changelog author="asarai@suse.com" date="1722427200">[NOTE: This update was only ever released in SLES and Leap.]
- Update to Docker 25.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2506&gt;
- This update includes a fix for CVE-2024-41110. bsc#1228324
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
  * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch</changelog>
</package>
<package pkgid="7fbc4cdc4d54e28fe8a5a48d0cbbc29b5d1630291e68f7c3586d7078b235dfa6" name="docker" arch="x86_64">
  <version epoch="0" ver="25.0.6_ce" rel="150000.207.1"/>
  <changelog author="dmueller@suse.com" date="1675252800">- update to 20.10.23-ce.
  * see upstream changelog at https://docs.docker.com/engine/release-notes/#201023
- drop kubic flavor as kubic is EOL. this removes:
  kubelet.env docker-kubic-service.conf 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch</changelog>
  <changelog author="asarai@suse.com" date="1682510400">- Update to Docker 23.0.4-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2304&gt;. bsc#1208074
- Fixes:
  * bsc#1214107 - CVE-2023-28840
  * bsc#1214108 - CVE-2023-28841
  * bsc#1214109 - CVE-2023-28842
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Renumbered patches:
  - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Remove upstreamed patches:
  - 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  - 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch
  - 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch
- Backport &lt;https://github.com/docker/cli/pull/4228&gt; to allow man pages to be
  built without internet access in OBS.
  + cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1682596800">- Update to Docker 23.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2305&gt;.
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to Docker 23.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2306&gt;. bsc#1211578
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Re-unify packaging for SLE-12 and SLE-15.
- Add patch to fix build on SLE-12 by switching back to libbtrfs-devel headers
  (the uapi headers in SLE-12 are too old).
  + 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
- Re-numbered patches:
  - 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch`</changelog>
  <changelog author="asarai@suse.com" date="1686744000">- Update to Docker 24.0.2-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2402&gt;. bsc#1212368
  * Includes the upstreamed fix for the mount table pollution issue.
    bsc#1210797
- Add Recommends for docker-buildx, and add /usr/lib/docker/cli-plugins as
  being provided by this package.
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1687262400">- Add docker-rootless-extras subpackage
  (https://docs.docker.com/engine/security/rootless)</changelog>
  <changelog author="danish.prakash@suse.com" date="1688040000">- Recommend docker-rootless-extras instead of Require(ing) it, given
  it's an additional functionality and not inherently required for
  docker to function.</changelog>
  <changelog author="asarai@suse.com" date="1688731200">- Update to Docker 24.0.3-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2403&gt;. bsc#1213120
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1688731201">- Update to Docker 24.0.4-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2404&gt;. bsc#1213500</changelog>
  <changelog author="dmueller@suse.com" date="1690286400">- Update to Docker 24.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2405&gt;. bsc#1213229</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to Docker 24.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2406&gt;. bsc#1215323
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Switch from disabledrun to manualrun in _service.
- Add a docker.socket unit file, but with socket activation effectively
  disabled to ensure that Docker will always run even if you start the socket
  individually. Users should probably just ignore this unit file. bsc#1210141</changelog>
  <changelog author="asarai@suse.com" date="1697025600">- Add a patch to fix apparmor on SLE-12, reverting the upstream removal of
  version-specific templating for the default apparmor profile. bsc#1213500
  + 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to Docker 24.0.7-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2407&gt;. bsc#1217513
  * Deny containers access to /sys/devices/virtual/powercap by default.
  - CVE-2020-8694 bsc#1170415
  - CVE-2020-8695 bsc#1170446
  - CVE-2020-12912 bsc#1178760
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="dcermak@suse.com" date="1707912000">- Vendor latest buildkit v0.11:
  Add patch 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch that
  vendors in the latest v0.11 buildkit branch including bugfixes for the following:
  * bsc#1219438: CVE-2024-23653
  * bsc#1219268: CVE-2024-23652
  * bsc#1219267: CVE-2024-23651
- rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- switch from %patchN to %patch -PN syntax
- remove unused rpmlint filters and add filters to silence pointless bash &amp; zsh
  completion warnings</changelog>
  <changelog author="danish.prakash@suse.com" date="1708171200">- Update to Docker 25.0.3-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2503&gt;
- Fixes:
  * bsc#1219267 - CVE-2024-23651
  * bsc#1219268 - CVE-2024-23652
  * bsc#1219438 - CVE-2024-23653
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Remove upstreamed patches:
  - 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1709899200">[NOTE: This update was only ever released in SLES and Leap.]
- Add patch to fix bsc#1220339
  * 0007-daemon-overlay2-remove-world-writable-permission-fro.patch
- rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch</changelog>
  <changelog author="asarai@suse.com" date="1711368000">[NOTE: This update was only ever released in SLES and Leap.]
- Update to Docker 25.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2505&gt; bsc#1223409
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Remove upstreamed patches:
  - 0007-daemon-overlay2-remove-world-writable-permission-fro.patch
- Update --add-runtime to point to correct binary path.</changelog>
  <changelog author="asarai@suse.com" date="1719230400">- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- Fix BuildKit's symlink resolution logic to correctly handle non-lexical
  symlinks. Backport of &lt;https://github.com/moby/buildkit/pull/4896&gt; and
  &lt;https://github.com/moby/buildkit/pull/5060&gt;. bsc#1221916
  + 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
- Write volume options atomically so sudden system crashes won't result in
  future Docker starts failing due to empty files. Backport of
  &lt;https://github.com/moby/moby/pull/48034&gt;. bsc#1214855
  + 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch</changelog>
  <changelog author="asarai@suse.com" date="1722427200">[NOTE: This update was only ever released in SLES and Leap.]
- Update to Docker 25.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2506&gt;
- This update includes a fix for CVE-2024-41110. bsc#1228324
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
  * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch</changelog>
</package>
<package pkgid="720972a4d506d11c95fc70ac383a038b9b82f91839c0dea13aa632af7bc49e38" name="docker-bash-completion" arch="noarch">
  <version epoch="0" ver="25.0.6_ce" rel="150000.203.1"/>
  <changelog author="dmueller@suse.com" date="1675252800">- update to 20.10.23-ce.
  * see upstream changelog at https://docs.docker.com/engine/release-notes/#201023
- drop kubic flavor as kubic is EOL. this removes:
  kubelet.env docker-kubic-service.conf 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch</changelog>
  <changelog author="asarai@suse.com" date="1682510400">- Update to Docker 23.0.4-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2304&gt;. bsc#1208074
- Fixes:
  * bsc#1214107 - CVE-2023-28840
  * bsc#1214108 - CVE-2023-28841
  * bsc#1214109 - CVE-2023-28842
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Renumbered patches:
  - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Remove upstreamed patches:
  - 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  - 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch
  - 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch
- Backport &lt;https://github.com/docker/cli/pull/4228&gt; to allow man pages to be
  built without internet access in OBS.
  + cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1682596800">- Update to Docker 23.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2305&gt;.
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to Docker 23.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2306&gt;. bsc#1211578
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Re-unify packaging for SLE-12 and SLE-15.
- Add patch to fix build on SLE-12 by switching back to libbtrfs-devel headers
  (the uapi headers in SLE-12 are too old).
  + 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
- Re-numbered patches:
  - 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch`</changelog>
  <changelog author="asarai@suse.com" date="1686744000">- Update to Docker 24.0.2-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2402&gt;. bsc#1212368
  * Includes the upstreamed fix for the mount table pollution issue.
    bsc#1210797
- Add Recommends for docker-buildx, and add /usr/lib/docker/cli-plugins as
  being provided by this package.
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1687262400">- Add docker-rootless-extras subpackage
  (https://docs.docker.com/engine/security/rootless)</changelog>
  <changelog author="danish.prakash@suse.com" date="1688040000">- Recommend docker-rootless-extras instead of Require(ing) it, given
  it's an additional functionality and not inherently required for
  docker to function.</changelog>
  <changelog author="asarai@suse.com" date="1688731200">- Update to Docker 24.0.3-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2403&gt;. bsc#1213120
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1688731201">- Update to Docker 24.0.4-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2404&gt;. bsc#1213500</changelog>
  <changelog author="dmueller@suse.com" date="1690286400">- Update to Docker 24.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2405&gt;. bsc#1213229</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to Docker 24.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2406&gt;. bsc#1215323
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Switch from disabledrun to manualrun in _service.
- Add a docker.socket unit file, but with socket activation effectively
  disabled to ensure that Docker will always run even if you start the socket
  individually. Users should probably just ignore this unit file. bsc#1210141</changelog>
  <changelog author="asarai@suse.com" date="1697025600">- Add a patch to fix apparmor on SLE-12, reverting the upstream removal of
  version-specific templating for the default apparmor profile. bsc#1213500
  + 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to Docker 24.0.7-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2407&gt;. bsc#1217513
  * Deny containers access to /sys/devices/virtual/powercap by default.
  - CVE-2020-8694 bsc#1170415
  - CVE-2020-8695 bsc#1170446
  - CVE-2020-12912 bsc#1178760
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="dcermak@suse.com" date="1707912000">- Vendor latest buildkit v0.11:
  Add patch 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch that
  vendors in the latest v0.11 buildkit branch including bugfixes for the following:
  * bsc#1219438: CVE-2024-23653
  * bsc#1219268: CVE-2024-23652
  * bsc#1219267: CVE-2024-23651
- rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- switch from %patchN to %patch -PN syntax
- remove unused rpmlint filters and add filters to silence pointless bash &amp; zsh
  completion warnings</changelog>
  <changelog author="danish.prakash@suse.com" date="1708171200">- Update to Docker 25.0.3-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2503&gt;
- Fixes:
  * bsc#1219267 - CVE-2024-23651
  * bsc#1219268 - CVE-2024-23652
  * bsc#1219438 - CVE-2024-23653
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Remove upstreamed patches:
  - 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1709899200">[NOTE: This update was only ever released in SLES and Leap.]
- Add patch to fix bsc#1220339
  * 0007-daemon-overlay2-remove-world-writable-permission-fro.patch
- rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch</changelog>
  <changelog author="asarai@suse.com" date="1711368000">[NOTE: This update was only ever released in SLES and Leap.]
- Update to Docker 25.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2505&gt; bsc#1223409
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Remove upstreamed patches:
  - 0007-daemon-overlay2-remove-world-writable-permission-fro.patch
- Update --add-runtime to point to correct binary path.</changelog>
  <changelog author="asarai@suse.com" date="1719230400">- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- Fix BuildKit's symlink resolution logic to correctly handle non-lexical
  symlinks. Backport of &lt;https://github.com/moby/buildkit/pull/4896&gt; and
  &lt;https://github.com/moby/buildkit/pull/5060&gt;. bsc#1221916
  + 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
- Write volume options atomically so sudden system crashes won't result in
  future Docker starts failing due to empty files. Backport of
  &lt;https://github.com/moby/moby/pull/48034&gt;. bsc#1214855
  + 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch</changelog>
  <changelog author="asarai@suse.com" date="1722427200">[NOTE: This update was only ever released in SLES and Leap.]
- Update to Docker 25.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2506&gt;
- This update includes a fix for CVE-2024-41110. bsc#1228324
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
  * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch</changelog>
</package>
<package pkgid="b6ea5f1c57d51e6c82a0afbdb405f8b76be749f75644d11f47d2f6821e98142f" name="docker-bash-completion" arch="noarch">
  <version epoch="0" ver="25.0.6_ce" rel="150000.207.1"/>
  <changelog author="dmueller@suse.com" date="1675252800">- update to 20.10.23-ce.
  * see upstream changelog at https://docs.docker.com/engine/release-notes/#201023
- drop kubic flavor as kubic is EOL. this removes:
  kubelet.env docker-kubic-service.conf 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch</changelog>
  <changelog author="asarai@suse.com" date="1682510400">- Update to Docker 23.0.4-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2304&gt;. bsc#1208074
- Fixes:
  * bsc#1214107 - CVE-2023-28840
  * bsc#1214108 - CVE-2023-28841
  * bsc#1214109 - CVE-2023-28842
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Renumbered patches:
  - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Remove upstreamed patches:
  - 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  - 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch
  - 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch
- Backport &lt;https://github.com/docker/cli/pull/4228&gt; to allow man pages to be
  built without internet access in OBS.
  + cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1682596800">- Update to Docker 23.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2305&gt;.
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to Docker 23.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2306&gt;. bsc#1211578
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Re-unify packaging for SLE-12 and SLE-15.
- Add patch to fix build on SLE-12 by switching back to libbtrfs-devel headers
  (the uapi headers in SLE-12 are too old).
  + 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
- Re-numbered patches:
  - 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch`</changelog>
  <changelog author="asarai@suse.com" date="1686744000">- Update to Docker 24.0.2-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2402&gt;. bsc#1212368
  * Includes the upstreamed fix for the mount table pollution issue.
    bsc#1210797
- Add Recommends for docker-buildx, and add /usr/lib/docker/cli-plugins as
  being provided by this package.
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1687262400">- Add docker-rootless-extras subpackage
  (https://docs.docker.com/engine/security/rootless)</changelog>
  <changelog author="danish.prakash@suse.com" date="1688040000">- Recommend docker-rootless-extras instead of Require(ing) it, given
  it's an additional functionality and not inherently required for
  docker to function.</changelog>
  <changelog author="asarai@suse.com" date="1688731200">- Update to Docker 24.0.3-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2403&gt;. bsc#1213120
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1688731201">- Update to Docker 24.0.4-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2404&gt;. bsc#1213500</changelog>
  <changelog author="dmueller@suse.com" date="1690286400">- Update to Docker 24.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2405&gt;. bsc#1213229</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to Docker 24.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2406&gt;. bsc#1215323
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Switch from disabledrun to manualrun in _service.
- Add a docker.socket unit file, but with socket activation effectively
  disabled to ensure that Docker will always run even if you start the socket
  individually. Users should probably just ignore this unit file. bsc#1210141</changelog>
  <changelog author="asarai@suse.com" date="1697025600">- Add a patch to fix apparmor on SLE-12, reverting the upstream removal of
  version-specific templating for the default apparmor profile. bsc#1213500
  + 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to Docker 24.0.7-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2407&gt;. bsc#1217513
  * Deny containers access to /sys/devices/virtual/powercap by default.
  - CVE-2020-8694 bsc#1170415
  - CVE-2020-8695 bsc#1170446
  - CVE-2020-12912 bsc#1178760
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="dcermak@suse.com" date="1707912000">- Vendor latest buildkit v0.11:
  Add patch 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch that
  vendors in the latest v0.11 buildkit branch including bugfixes for the following:
  * bsc#1219438: CVE-2024-23653
  * bsc#1219268: CVE-2024-23652
  * bsc#1219267: CVE-2024-23651
- rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- switch from %patchN to %patch -PN syntax
- remove unused rpmlint filters and add filters to silence pointless bash &amp; zsh
  completion warnings</changelog>
  <changelog author="danish.prakash@suse.com" date="1708171200">- Update to Docker 25.0.3-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2503&gt;
- Fixes:
  * bsc#1219267 - CVE-2024-23651
  * bsc#1219268 - CVE-2024-23652
  * bsc#1219438 - CVE-2024-23653
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Remove upstreamed patches:
  - 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1709899200">[NOTE: This update was only ever released in SLES and Leap.]
- Add patch to fix bsc#1220339
  * 0007-daemon-overlay2-remove-world-writable-permission-fro.patch
- rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch</changelog>
  <changelog author="asarai@suse.com" date="1711368000">[NOTE: This update was only ever released in SLES and Leap.]
- Update to Docker 25.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2505&gt; bsc#1223409
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Remove upstreamed patches:
  - 0007-daemon-overlay2-remove-world-writable-permission-fro.patch
- Update --add-runtime to point to correct binary path.</changelog>
  <changelog author="asarai@suse.com" date="1719230400">- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- Fix BuildKit's symlink resolution logic to correctly handle non-lexical
  symlinks. Backport of &lt;https://github.com/moby/buildkit/pull/4896&gt; and
  &lt;https://github.com/moby/buildkit/pull/5060&gt;. bsc#1221916
  + 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
- Write volume options atomically so sudden system crashes won't result in
  future Docker starts failing due to empty files. Backport of
  &lt;https://github.com/moby/moby/pull/48034&gt;. bsc#1214855
  + 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch</changelog>
  <changelog author="asarai@suse.com" date="1722427200">[NOTE: This update was only ever released in SLES and Leap.]
- Update to Docker 25.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2506&gt;
- This update includes a fix for CVE-2024-41110. bsc#1228324
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
  * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch</changelog>
</package>
<package pkgid="9c33f38077fd407e712250311943acf38869a3de86e2285cb8e41aea2166d963" name="docker-fish-completion" arch="noarch">
  <version epoch="0" ver="25.0.6_ce" rel="150000.203.1"/>
  <changelog author="dmueller@suse.com" date="1675252800">- update to 20.10.23-ce.
  * see upstream changelog at https://docs.docker.com/engine/release-notes/#201023
- drop kubic flavor as kubic is EOL. this removes:
  kubelet.env docker-kubic-service.conf 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch</changelog>
  <changelog author="asarai@suse.com" date="1682510400">- Update to Docker 23.0.4-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2304&gt;. bsc#1208074
- Fixes:
  * bsc#1214107 - CVE-2023-28840
  * bsc#1214108 - CVE-2023-28841
  * bsc#1214109 - CVE-2023-28842
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Renumbered patches:
  - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Remove upstreamed patches:
  - 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  - 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch
  - 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch
- Backport &lt;https://github.com/docker/cli/pull/4228&gt; to allow man pages to be
  built without internet access in OBS.
  + cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1682596800">- Update to Docker 23.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2305&gt;.
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to Docker 23.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2306&gt;. bsc#1211578
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Re-unify packaging for SLE-12 and SLE-15.
- Add patch to fix build on SLE-12 by switching back to libbtrfs-devel headers
  (the uapi headers in SLE-12 are too old).
  + 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
- Re-numbered patches:
  - 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch`</changelog>
  <changelog author="asarai@suse.com" date="1686744000">- Update to Docker 24.0.2-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2402&gt;. bsc#1212368
  * Includes the upstreamed fix for the mount table pollution issue.
    bsc#1210797
- Add Recommends for docker-buildx, and add /usr/lib/docker/cli-plugins as
  being provided by this package.
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1687262400">- Add docker-rootless-extras subpackage
  (https://docs.docker.com/engine/security/rootless)</changelog>
  <changelog author="danish.prakash@suse.com" date="1688040000">- Recommend docker-rootless-extras instead of Require(ing) it, given
  it's an additional functionality and not inherently required for
  docker to function.</changelog>
  <changelog author="asarai@suse.com" date="1688731200">- Update to Docker 24.0.3-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2403&gt;. bsc#1213120
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1688731201">- Update to Docker 24.0.4-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2404&gt;. bsc#1213500</changelog>
  <changelog author="dmueller@suse.com" date="1690286400">- Update to Docker 24.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2405&gt;. bsc#1213229</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to Docker 24.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2406&gt;. bsc#1215323
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Switch from disabledrun to manualrun in _service.
- Add a docker.socket unit file, but with socket activation effectively
  disabled to ensure that Docker will always run even if you start the socket
  individually. Users should probably just ignore this unit file. bsc#1210141</changelog>
  <changelog author="asarai@suse.com" date="1697025600">- Add a patch to fix apparmor on SLE-12, reverting the upstream removal of
  version-specific templating for the default apparmor profile. bsc#1213500
  + 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to Docker 24.0.7-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2407&gt;. bsc#1217513
  * Deny containers access to /sys/devices/virtual/powercap by default.
  - CVE-2020-8694 bsc#1170415
  - CVE-2020-8695 bsc#1170446
  - CVE-2020-12912 bsc#1178760
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="dcermak@suse.com" date="1707912000">- Vendor latest buildkit v0.11:
  Add patch 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch that
  vendors in the latest v0.11 buildkit branch including bugfixes for the following:
  * bsc#1219438: CVE-2024-23653
  * bsc#1219268: CVE-2024-23652
  * bsc#1219267: CVE-2024-23651
- rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- switch from %patchN to %patch -PN syntax
- remove unused rpmlint filters and add filters to silence pointless bash &amp; zsh
  completion warnings</changelog>
  <changelog author="danish.prakash@suse.com" date="1708171200">- Update to Docker 25.0.3-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2503&gt;
- Fixes:
  * bsc#1219267 - CVE-2024-23651
  * bsc#1219268 - CVE-2024-23652
  * bsc#1219438 - CVE-2024-23653
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Remove upstreamed patches:
  - 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1709899200">[NOTE: This update was only ever released in SLES and Leap.]
- Add patch to fix bsc#1220339
  * 0007-daemon-overlay2-remove-world-writable-permission-fro.patch
- rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch</changelog>
  <changelog author="asarai@suse.com" date="1711368000">[NOTE: This update was only ever released in SLES and Leap.]
- Update to Docker 25.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2505&gt; bsc#1223409
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Remove upstreamed patches:
  - 0007-daemon-overlay2-remove-world-writable-permission-fro.patch
- Update --add-runtime to point to correct binary path.</changelog>
  <changelog author="asarai@suse.com" date="1719230400">- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- Fix BuildKit's symlink resolution logic to correctly handle non-lexical
  symlinks. Backport of &lt;https://github.com/moby/buildkit/pull/4896&gt; and
  &lt;https://github.com/moby/buildkit/pull/5060&gt;. bsc#1221916
  + 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
- Write volume options atomically so sudden system crashes won't result in
  future Docker starts failing due to empty files. Backport of
  &lt;https://github.com/moby/moby/pull/48034&gt;. bsc#1214855
  + 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch</changelog>
  <changelog author="asarai@suse.com" date="1722427200">[NOTE: This update was only ever released in SLES and Leap.]
- Update to Docker 25.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2506&gt;
- This update includes a fix for CVE-2024-41110. bsc#1228324
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
  * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch</changelog>
</package>
<package pkgid="0b515f6ea37aedbd9332397cdfbcd411f159872a212d46c0bb33c1c3102244a5" name="docker-fish-completion" arch="noarch">
  <version epoch="0" ver="25.0.6_ce" rel="150000.207.1"/>
  <changelog author="dmueller@suse.com" date="1675252800">- update to 20.10.23-ce.
  * see upstream changelog at https://docs.docker.com/engine/release-notes/#201023
- drop kubic flavor as kubic is EOL. this removes:
  kubelet.env docker-kubic-service.conf 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch</changelog>
  <changelog author="asarai@suse.com" date="1682510400">- Update to Docker 23.0.4-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2304&gt;. bsc#1208074
- Fixes:
  * bsc#1214107 - CVE-2023-28840
  * bsc#1214108 - CVE-2023-28841
  * bsc#1214109 - CVE-2023-28842
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Renumbered patches:
  - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Remove upstreamed patches:
  - 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  - 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch
  - 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch
- Backport &lt;https://github.com/docker/cli/pull/4228&gt; to allow man pages to be
  built without internet access in OBS.
  + cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1682596800">- Update to Docker 23.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2305&gt;.
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to Docker 23.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2306&gt;. bsc#1211578
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Re-unify packaging for SLE-12 and SLE-15.
- Add patch to fix build on SLE-12 by switching back to libbtrfs-devel headers
  (the uapi headers in SLE-12 are too old).
  + 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
- Re-numbered patches:
  - 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch`</changelog>
  <changelog author="asarai@suse.com" date="1686744000">- Update to Docker 24.0.2-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2402&gt;. bsc#1212368
  * Includes the upstreamed fix for the mount table pollution issue.
    bsc#1210797
- Add Recommends for docker-buildx, and add /usr/lib/docker/cli-plugins as
  being provided by this package.
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1687262400">- Add docker-rootless-extras subpackage
  (https://docs.docker.com/engine/security/rootless)</changelog>
  <changelog author="danish.prakash@suse.com" date="1688040000">- Recommend docker-rootless-extras instead of Require(ing) it, given
  it's an additional functionality and not inherently required for
  docker to function.</changelog>
  <changelog author="asarai@suse.com" date="1688731200">- Update to Docker 24.0.3-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2403&gt;. bsc#1213120
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1688731201">- Update to Docker 24.0.4-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2404&gt;. bsc#1213500</changelog>
  <changelog author="dmueller@suse.com" date="1690286400">- Update to Docker 24.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2405&gt;. bsc#1213229</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to Docker 24.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2406&gt;. bsc#1215323
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Switch from disabledrun to manualrun in _service.
- Add a docker.socket unit file, but with socket activation effectively
  disabled to ensure that Docker will always run even if you start the socket
  individually. Users should probably just ignore this unit file. bsc#1210141</changelog>
  <changelog author="asarai@suse.com" date="1697025600">- Add a patch to fix apparmor on SLE-12, reverting the upstream removal of
  version-specific templating for the default apparmor profile. bsc#1213500
  + 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to Docker 24.0.7-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2407&gt;. bsc#1217513
  * Deny containers access to /sys/devices/virtual/powercap by default.
  - CVE-2020-8694 bsc#1170415
  - CVE-2020-8695 bsc#1170446
  - CVE-2020-12912 bsc#1178760
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="dcermak@suse.com" date="1707912000">- Vendor latest buildkit v0.11:
  Add patch 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch that
  vendors in the latest v0.11 buildkit branch including bugfixes for the following:
  * bsc#1219438: CVE-2024-23653
  * bsc#1219268: CVE-2024-23652
  * bsc#1219267: CVE-2024-23651
- rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- switch from %patchN to %patch -PN syntax
- remove unused rpmlint filters and add filters to silence pointless bash &amp; zsh
  completion warnings</changelog>
  <changelog author="danish.prakash@suse.com" date="1708171200">- Update to Docker 25.0.3-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2503&gt;
- Fixes:
  * bsc#1219267 - CVE-2024-23651
  * bsc#1219268 - CVE-2024-23652
  * bsc#1219438 - CVE-2024-23653
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Remove upstreamed patches:
  - 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1709899200">[NOTE: This update was only ever released in SLES and Leap.]
- Add patch to fix bsc#1220339
  * 0007-daemon-overlay2-remove-world-writable-permission-fro.patch
- rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch</changelog>
  <changelog author="asarai@suse.com" date="1711368000">[NOTE: This update was only ever released in SLES and Leap.]
- Update to Docker 25.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2505&gt; bsc#1223409
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Remove upstreamed patches:
  - 0007-daemon-overlay2-remove-world-writable-permission-fro.patch
- Update --add-runtime to point to correct binary path.</changelog>
  <changelog author="asarai@suse.com" date="1719230400">- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- Fix BuildKit's symlink resolution logic to correctly handle non-lexical
  symlinks. Backport of &lt;https://github.com/moby/buildkit/pull/4896&gt; and
  &lt;https://github.com/moby/buildkit/pull/5060&gt;. bsc#1221916
  + 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
- Write volume options atomically so sudden system crashes won't result in
  future Docker starts failing due to empty files. Backport of
  &lt;https://github.com/moby/moby/pull/48034&gt;. bsc#1214855
  + 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch</changelog>
  <changelog author="asarai@suse.com" date="1722427200">[NOTE: This update was only ever released in SLES and Leap.]
- Update to Docker 25.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2506&gt;
- This update includes a fix for CVE-2024-41110. bsc#1228324
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
  * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch</changelog>
</package>
<package pkgid="596530241b978029f32a69ad885e20dd2ff6d646ed18c0d4f023414203a20e50" name="docker-rootless-extras" arch="noarch">
  <version epoch="0" ver="25.0.6_ce" rel="150000.203.1"/>
  <changelog author="dmueller@suse.com" date="1675252800">- update to 20.10.23-ce.
  * see upstream changelog at https://docs.docker.com/engine/release-notes/#201023
- drop kubic flavor as kubic is EOL. this removes:
  kubelet.env docker-kubic-service.conf 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch</changelog>
  <changelog author="asarai@suse.com" date="1682510400">- Update to Docker 23.0.4-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2304&gt;. bsc#1208074
- Fixes:
  * bsc#1214107 - CVE-2023-28840
  * bsc#1214108 - CVE-2023-28841
  * bsc#1214109 - CVE-2023-28842
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Renumbered patches:
  - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Remove upstreamed patches:
  - 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  - 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch
  - 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch
- Backport &lt;https://github.com/docker/cli/pull/4228&gt; to allow man pages to be
  built without internet access in OBS.
  + cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1682596800">- Update to Docker 23.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2305&gt;.
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to Docker 23.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2306&gt;. bsc#1211578
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Re-unify packaging for SLE-12 and SLE-15.
- Add patch to fix build on SLE-12 by switching back to libbtrfs-devel headers
  (the uapi headers in SLE-12 are too old).
  + 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
- Re-numbered patches:
  - 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch`</changelog>
  <changelog author="asarai@suse.com" date="1686744000">- Update to Docker 24.0.2-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2402&gt;. bsc#1212368
  * Includes the upstreamed fix for the mount table pollution issue.
    bsc#1210797
- Add Recommends for docker-buildx, and add /usr/lib/docker/cli-plugins as
  being provided by this package.
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1687262400">- Add docker-rootless-extras subpackage
  (https://docs.docker.com/engine/security/rootless)</changelog>
  <changelog author="danish.prakash@suse.com" date="1688040000">- Recommend docker-rootless-extras instead of Require(ing) it, given
  it's an additional functionality and not inherently required for
  docker to function.</changelog>
  <changelog author="asarai@suse.com" date="1688731200">- Update to Docker 24.0.3-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2403&gt;. bsc#1213120
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1688731201">- Update to Docker 24.0.4-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2404&gt;. bsc#1213500</changelog>
  <changelog author="dmueller@suse.com" date="1690286400">- Update to Docker 24.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2405&gt;. bsc#1213229</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to Docker 24.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2406&gt;. bsc#1215323
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Switch from disabledrun to manualrun in _service.
- Add a docker.socket unit file, but with socket activation effectively
  disabled to ensure that Docker will always run even if you start the socket
  individually. Users should probably just ignore this unit file. bsc#1210141</changelog>
  <changelog author="asarai@suse.com" date="1697025600">- Add a patch to fix apparmor on SLE-12, reverting the upstream removal of
  version-specific templating for the default apparmor profile. bsc#1213500
  + 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to Docker 24.0.7-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2407&gt;. bsc#1217513
  * Deny containers access to /sys/devices/virtual/powercap by default.
  - CVE-2020-8694 bsc#1170415
  - CVE-2020-8695 bsc#1170446
  - CVE-2020-12912 bsc#1178760
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="dcermak@suse.com" date="1707912000">- Vendor latest buildkit v0.11:
  Add patch 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch that
  vendors in the latest v0.11 buildkit branch including bugfixes for the following:
  * bsc#1219438: CVE-2024-23653
  * bsc#1219268: CVE-2024-23652
  * bsc#1219267: CVE-2024-23651
- rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- switch from %patchN to %patch -PN syntax
- remove unused rpmlint filters and add filters to silence pointless bash &amp; zsh
  completion warnings</changelog>
  <changelog author="danish.prakash@suse.com" date="1708171200">- Update to Docker 25.0.3-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2503&gt;
- Fixes:
  * bsc#1219267 - CVE-2024-23651
  * bsc#1219268 - CVE-2024-23652
  * bsc#1219438 - CVE-2024-23653
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Remove upstreamed patches:
  - 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1709899200">[NOTE: This update was only ever released in SLES and Leap.]
- Add patch to fix bsc#1220339
  * 0007-daemon-overlay2-remove-world-writable-permission-fro.patch
- rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch</changelog>
  <changelog author="asarai@suse.com" date="1711368000">[NOTE: This update was only ever released in SLES and Leap.]
- Update to Docker 25.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2505&gt; bsc#1223409
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Remove upstreamed patches:
  - 0007-daemon-overlay2-remove-world-writable-permission-fro.patch
- Update --add-runtime to point to correct binary path.</changelog>
  <changelog author="asarai@suse.com" date="1719230400">- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- Fix BuildKit's symlink resolution logic to correctly handle non-lexical
  symlinks. Backport of &lt;https://github.com/moby/buildkit/pull/4896&gt; and
  &lt;https://github.com/moby/buildkit/pull/5060&gt;. bsc#1221916
  + 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
- Write volume options atomically so sudden system crashes won't result in
  future Docker starts failing due to empty files. Backport of
  &lt;https://github.com/moby/moby/pull/48034&gt;. bsc#1214855
  + 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch</changelog>
  <changelog author="asarai@suse.com" date="1722427200">[NOTE: This update was only ever released in SLES and Leap.]
- Update to Docker 25.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2506&gt;
- This update includes a fix for CVE-2024-41110. bsc#1228324
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
  * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch</changelog>
</package>
<package pkgid="ffbd3da1702882aff36030d812474cd4ffc8f81680a91f456a517d93b3b8b53a" name="docker-rootless-extras" arch="noarch">
  <version epoch="0" ver="25.0.6_ce" rel="150000.207.1"/>
  <changelog author="dmueller@suse.com" date="1675252800">- update to 20.10.23-ce.
  * see upstream changelog at https://docs.docker.com/engine/release-notes/#201023
- drop kubic flavor as kubic is EOL. this removes:
  kubelet.env docker-kubic-service.conf 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch</changelog>
  <changelog author="asarai@suse.com" date="1682510400">- Update to Docker 23.0.4-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2304&gt;. bsc#1208074
- Fixes:
  * bsc#1214107 - CVE-2023-28840
  * bsc#1214108 - CVE-2023-28841
  * bsc#1214109 - CVE-2023-28842
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Renumbered patches:
  - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Remove upstreamed patches:
  - 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  - 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch
  - 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch
- Backport &lt;https://github.com/docker/cli/pull/4228&gt; to allow man pages to be
  built without internet access in OBS.
  + cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1682596800">- Update to Docker 23.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2305&gt;.
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to Docker 23.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2306&gt;. bsc#1211578
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Re-unify packaging for SLE-12 and SLE-15.
- Add patch to fix build on SLE-12 by switching back to libbtrfs-devel headers
  (the uapi headers in SLE-12 are too old).
  + 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
- Re-numbered patches:
  - 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch`</changelog>
  <changelog author="asarai@suse.com" date="1686744000">- Update to Docker 24.0.2-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2402&gt;. bsc#1212368
  * Includes the upstreamed fix for the mount table pollution issue.
    bsc#1210797
- Add Recommends for docker-buildx, and add /usr/lib/docker/cli-plugins as
  being provided by this package.
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1687262400">- Add docker-rootless-extras subpackage
  (https://docs.docker.com/engine/security/rootless)</changelog>
  <changelog author="danish.prakash@suse.com" date="1688040000">- Recommend docker-rootless-extras instead of Require(ing) it, given
  it's an additional functionality and not inherently required for
  docker to function.</changelog>
  <changelog author="asarai@suse.com" date="1688731200">- Update to Docker 24.0.3-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2403&gt;. bsc#1213120
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1688731201">- Update to Docker 24.0.4-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2404&gt;. bsc#1213500</changelog>
  <changelog author="dmueller@suse.com" date="1690286400">- Update to Docker 24.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2405&gt;. bsc#1213229</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to Docker 24.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2406&gt;. bsc#1215323
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Switch from disabledrun to manualrun in _service.
- Add a docker.socket unit file, but with socket activation effectively
  disabled to ensure that Docker will always run even if you start the socket
  individually. Users should probably just ignore this unit file. bsc#1210141</changelog>
  <changelog author="asarai@suse.com" date="1697025600">- Add a patch to fix apparmor on SLE-12, reverting the upstream removal of
  version-specific templating for the default apparmor profile. bsc#1213500
  + 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to Docker 24.0.7-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2407&gt;. bsc#1217513
  * Deny containers access to /sys/devices/virtual/powercap by default.
  - CVE-2020-8694 bsc#1170415
  - CVE-2020-8695 bsc#1170446
  - CVE-2020-12912 bsc#1178760
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="dcermak@suse.com" date="1707912000">- Vendor latest buildkit v0.11:
  Add patch 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch that
  vendors in the latest v0.11 buildkit branch including bugfixes for the following:
  * bsc#1219438: CVE-2024-23653
  * bsc#1219268: CVE-2024-23652
  * bsc#1219267: CVE-2024-23651
- rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- switch from %patchN to %patch -PN syntax
- remove unused rpmlint filters and add filters to silence pointless bash &amp; zsh
  completion warnings</changelog>
  <changelog author="danish.prakash@suse.com" date="1708171200">- Update to Docker 25.0.3-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2503&gt;
- Fixes:
  * bsc#1219267 - CVE-2024-23651
  * bsc#1219268 - CVE-2024-23652
  * bsc#1219438 - CVE-2024-23653
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Remove upstreamed patches:
  - 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1709899200">[NOTE: This update was only ever released in SLES and Leap.]
- Add patch to fix bsc#1220339
  * 0007-daemon-overlay2-remove-world-writable-permission-fro.patch
- rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch</changelog>
  <changelog author="asarai@suse.com" date="1711368000">[NOTE: This update was only ever released in SLES and Leap.]
- Update to Docker 25.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2505&gt; bsc#1223409
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Remove upstreamed patches:
  - 0007-daemon-overlay2-remove-world-writable-permission-fro.patch
- Update --add-runtime to point to correct binary path.</changelog>
  <changelog author="asarai@suse.com" date="1719230400">- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- Fix BuildKit's symlink resolution logic to correctly handle non-lexical
  symlinks. Backport of &lt;https://github.com/moby/buildkit/pull/4896&gt; and
  &lt;https://github.com/moby/buildkit/pull/5060&gt;. bsc#1221916
  + 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
- Write volume options atomically so sudden system crashes won't result in
  future Docker starts failing due to empty files. Backport of
  &lt;https://github.com/moby/moby/pull/48034&gt;. bsc#1214855
  + 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch</changelog>
  <changelog author="asarai@suse.com" date="1722427200">[NOTE: This update was only ever released in SLES and Leap.]
- Update to Docker 25.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2506&gt;
- This update includes a fix for CVE-2024-41110. bsc#1228324
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
  * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch</changelog>
</package>
<package pkgid="5279c94dd2855f47f529fd8fe1fec22d390b7f4e5eab6adaa2b4fa200873532d" name="docker-zsh-completion" arch="noarch">
  <version epoch="0" ver="25.0.6_ce" rel="150000.203.1"/>
  <changelog author="dmueller@suse.com" date="1675252800">- update to 20.10.23-ce.
  * see upstream changelog at https://docs.docker.com/engine/release-notes/#201023
- drop kubic flavor as kubic is EOL. this removes:
  kubelet.env docker-kubic-service.conf 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch</changelog>
  <changelog author="asarai@suse.com" date="1682510400">- Update to Docker 23.0.4-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2304&gt;. bsc#1208074
- Fixes:
  * bsc#1214107 - CVE-2023-28840
  * bsc#1214108 - CVE-2023-28841
  * bsc#1214109 - CVE-2023-28842
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Renumbered patches:
  - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Remove upstreamed patches:
  - 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  - 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch
  - 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch
- Backport &lt;https://github.com/docker/cli/pull/4228&gt; to allow man pages to be
  built without internet access in OBS.
  + cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1682596800">- Update to Docker 23.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2305&gt;.
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to Docker 23.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2306&gt;. bsc#1211578
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Re-unify packaging for SLE-12 and SLE-15.
- Add patch to fix build on SLE-12 by switching back to libbtrfs-devel headers
  (the uapi headers in SLE-12 are too old).
  + 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
- Re-numbered patches:
  - 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch`</changelog>
  <changelog author="asarai@suse.com" date="1686744000">- Update to Docker 24.0.2-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2402&gt;. bsc#1212368
  * Includes the upstreamed fix for the mount table pollution issue.
    bsc#1210797
- Add Recommends for docker-buildx, and add /usr/lib/docker/cli-plugins as
  being provided by this package.
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1687262400">- Add docker-rootless-extras subpackage
  (https://docs.docker.com/engine/security/rootless)</changelog>
  <changelog author="danish.prakash@suse.com" date="1688040000">- Recommend docker-rootless-extras instead of Require(ing) it, given
  it's an additional functionality and not inherently required for
  docker to function.</changelog>
  <changelog author="asarai@suse.com" date="1688731200">- Update to Docker 24.0.3-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2403&gt;. bsc#1213120
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1688731201">- Update to Docker 24.0.4-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2404&gt;. bsc#1213500</changelog>
  <changelog author="dmueller@suse.com" date="1690286400">- Update to Docker 24.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2405&gt;. bsc#1213229</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to Docker 24.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2406&gt;. bsc#1215323
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Switch from disabledrun to manualrun in _service.
- Add a docker.socket unit file, but with socket activation effectively
  disabled to ensure that Docker will always run even if you start the socket
  individually. Users should probably just ignore this unit file. bsc#1210141</changelog>
  <changelog author="asarai@suse.com" date="1697025600">- Add a patch to fix apparmor on SLE-12, reverting the upstream removal of
  version-specific templating for the default apparmor profile. bsc#1213500
  + 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to Docker 24.0.7-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2407&gt;. bsc#1217513
  * Deny containers access to /sys/devices/virtual/powercap by default.
  - CVE-2020-8694 bsc#1170415
  - CVE-2020-8695 bsc#1170446
  - CVE-2020-12912 bsc#1178760
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="dcermak@suse.com" date="1707912000">- Vendor latest buildkit v0.11:
  Add patch 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch that
  vendors in the latest v0.11 buildkit branch including bugfixes for the following:
  * bsc#1219438: CVE-2024-23653
  * bsc#1219268: CVE-2024-23652
  * bsc#1219267: CVE-2024-23651
- rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- switch from %patchN to %patch -PN syntax
- remove unused rpmlint filters and add filters to silence pointless bash &amp; zsh
  completion warnings</changelog>
  <changelog author="danish.prakash@suse.com" date="1708171200">- Update to Docker 25.0.3-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2503&gt;
- Fixes:
  * bsc#1219267 - CVE-2024-23651
  * bsc#1219268 - CVE-2024-23652
  * bsc#1219438 - CVE-2024-23653
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Remove upstreamed patches:
  - 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1709899200">[NOTE: This update was only ever released in SLES and Leap.]
- Add patch to fix bsc#1220339
  * 0007-daemon-overlay2-remove-world-writable-permission-fro.patch
- rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch</changelog>
  <changelog author="asarai@suse.com" date="1711368000">[NOTE: This update was only ever released in SLES and Leap.]
- Update to Docker 25.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2505&gt; bsc#1223409
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Remove upstreamed patches:
  - 0007-daemon-overlay2-remove-world-writable-permission-fro.patch
- Update --add-runtime to point to correct binary path.</changelog>
  <changelog author="asarai@suse.com" date="1719230400">- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- Fix BuildKit's symlink resolution logic to correctly handle non-lexical
  symlinks. Backport of &lt;https://github.com/moby/buildkit/pull/4896&gt; and
  &lt;https://github.com/moby/buildkit/pull/5060&gt;. bsc#1221916
  + 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
- Write volume options atomically so sudden system crashes won't result in
  future Docker starts failing due to empty files. Backport of
  &lt;https://github.com/moby/moby/pull/48034&gt;. bsc#1214855
  + 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch</changelog>
  <changelog author="asarai@suse.com" date="1722427200">[NOTE: This update was only ever released in SLES and Leap.]
- Update to Docker 25.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2506&gt;
- This update includes a fix for CVE-2024-41110. bsc#1228324
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
  * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch</changelog>
</package>
<package pkgid="55d9ea1cb0bc6fad4c4f5c912a0a02ca6fe3ed4c8c3670a977abc6dd8ccdf34a" name="docker-zsh-completion" arch="noarch">
  <version epoch="0" ver="25.0.6_ce" rel="150000.207.1"/>
  <changelog author="dmueller@suse.com" date="1675252800">- update to 20.10.23-ce.
  * see upstream changelog at https://docs.docker.com/engine/release-notes/#201023
- drop kubic flavor as kubic is EOL. this removes:
  kubelet.env docker-kubic-service.conf 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch</changelog>
  <changelog author="asarai@suse.com" date="1682510400">- Update to Docker 23.0.4-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2304&gt;. bsc#1208074
- Fixes:
  * bsc#1214107 - CVE-2023-28840
  * bsc#1214108 - CVE-2023-28841
  * bsc#1214109 - CVE-2023-28842
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Renumbered patches:
  - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Remove upstreamed patches:
  - 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  - 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch
  - 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch
- Backport &lt;https://github.com/docker/cli/pull/4228&gt; to allow man pages to be
  built without internet access in OBS.
  + cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1682596800">- Update to Docker 23.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2305&gt;.
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to Docker 23.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/23.0/#2306&gt;. bsc#1211578
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Re-unify packaging for SLE-12 and SLE-15.
- Add patch to fix build on SLE-12 by switching back to libbtrfs-devel headers
  (the uapi headers in SLE-12 are too old).
  + 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
- Re-numbered patches:
  - 0003-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch`</changelog>
  <changelog author="asarai@suse.com" date="1686744000">- Update to Docker 24.0.2-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2402&gt;. bsc#1212368
  * Includes the upstreamed fix for the mount table pollution issue.
    bsc#1210797
- Add Recommends for docker-buildx, and add /usr/lib/docker/cli-plugins as
  being provided by this package.
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="danish.prakash@suse.com" date="1687262400">- Add docker-rootless-extras subpackage
  (https://docs.docker.com/engine/security/rootless)</changelog>
  <changelog author="danish.prakash@suse.com" date="1688040000">- Recommend docker-rootless-extras instead of Require(ing) it, given
  it's an additional functionality and not inherently required for
  docker to function.</changelog>
  <changelog author="asarai@suse.com" date="1688731200">- Update to Docker 24.0.3-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2403&gt;. bsc#1213120
- Rebase patches:
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="asarai@suse.com" date="1688731201">- Update to Docker 24.0.4-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2404&gt;. bsc#1213500</changelog>
  <changelog author="dmueller@suse.com" date="1690286400">- Update to Docker 24.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2405&gt;. bsc#1213229</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to Docker 24.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2406&gt;. bsc#1215323
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Switch from disabledrun to manualrun in _service.
- Add a docker.socket unit file, but with socket activation effectively
  disabled to ensure that Docker will always run even if you start the socket
  individually. Users should probably just ignore this unit file. bsc#1210141</changelog>
  <changelog author="asarai@suse.com" date="1697025600">- Add a patch to fix apparmor on SLE-12, reverting the upstream removal of
  version-specific templating for the default apparmor profile. bsc#1213500
  + 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1698408000">- Update to Docker 24.0.7-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/24.0/#2407&gt;. bsc#1217513
  * Deny containers access to /sys/devices/virtual/powercap by default.
  - CVE-2020-8694 bsc#1170415
  - CVE-2020-8695 bsc#1170446
  - CVE-2020-12912 bsc#1178760
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch</changelog>
  <changelog author="dcermak@suse.com" date="1707912000">- Vendor latest buildkit v0.11:
  Add patch 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch that
  vendors in the latest v0.11 buildkit branch including bugfixes for the following:
  * bsc#1219438: CVE-2024-23653
  * bsc#1219268: CVE-2024-23652
  * bsc#1219267: CVE-2024-23651
- rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- switch from %patchN to %patch -PN syntax
- remove unused rpmlint filters and add filters to silence pointless bash &amp; zsh
  completion warnings</changelog>
  <changelog author="danish.prakash@suse.com" date="1708171200">- Update to Docker 25.0.3-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2503&gt;
- Fixes:
  * bsc#1219267 - CVE-2024-23651
  * bsc#1219268 - CVE-2024-23652
  * bsc#1219438 - CVE-2024-23653
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Remove upstreamed patches:
  - 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch</changelog>
  <changelog author="kukuk@suse.com" date="1708603200">- Allow to disable apparmor support (ALP supports only SELinux)</changelog>
  <changelog author="dcermak@suse.com" date="1709899200">[NOTE: This update was only ever released in SLES and Leap.]
- Add patch to fix bsc#1220339
  * 0007-daemon-overlay2-remove-world-writable-permission-fro.patch
- rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch</changelog>
  <changelog author="asarai@suse.com" date="1711368000">[NOTE: This update was only ever released in SLES and Leap.]
- Update to Docker 25.0.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2505&gt; bsc#1223409
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-docs-include-required-tools-in-source-tree.patch
- Remove upstreamed patches:
  - 0007-daemon-overlay2-remove-world-writable-permission-fro.patch
- Update --add-runtime to point to correct binary path.</changelog>
  <changelog author="asarai@suse.com" date="1719230400">- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- Fix BuildKit's symlink resolution logic to correctly handle non-lexical
  symlinks. Backport of &lt;https://github.com/moby/buildkit/pull/4896&gt; and
  &lt;https://github.com/moby/buildkit/pull/5060&gt;. bsc#1221916
  + 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
- Write volume options atomically so sudden system crashes won't result in
  future Docker starts failing due to empty files. Backport of
  &lt;https://github.com/moby/moby/pull/48034&gt;. bsc#1214855
  + 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch</changelog>
  <changelog author="asarai@suse.com" date="1722427200">[NOTE: This update was only ever released in SLES and Leap.]
- Update to Docker 25.0.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/25.0/#2506&gt;
- This update includes a fix for CVE-2024-41110. bsc#1228324
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
  * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch</changelog>
</package>
<package pkgid="91f9d75e372e58b9268e50aac5b7b7df2933ca0a933b0b39432e02772d0583f7" name="dom4j" arch="noarch">
  <version epoch="0" ver="2.1.4" rel="150200.12.10.2"/>
  <changelog author="tchvatal@suse.com" date="1426680000">- Fix build with new javapackages-tools</changelog>
  <changelog author="mpluskal@suse.com" date="1495195200">- Update dependencies</changelog>
  <changelog author="fstrba@suse.com" date="1504872000">- Added patch:
  * dom4j-sourcetarget.patch
    + Use java source and target level 1.6 in order to allow
    building with jdk9</changelog>
  <changelog author="fstrba@suse.com" date="1526472000">- Modified patch:
  * dom4j-sourcetarget.patch
    + Build with source and target 8 to prepare for a possible
    removal of 1.6 compatibility</changelog>
  <changelog author="fstrba@suse.com" date="1531224000">- Added patch:
  * dom4j-javadoc.patch
    + Don't load urls while building javadoc in environment without
    connectivity</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1537272000">- Security fix: [bsc#1105443, CVE-2018-1000632]
  * Version prior to version 2.1.1 contains a CWE-91: XML
    Injectionvulnerability in Class: Element. Methods: addElement,
    addAttribute that canresult in an attacker tampering with XML
    documents through.
  * Added dom4j-CVE-2018-1000632.patch</changelog>
  <changelog author="cbosdonnat@suse.com" date="1548417600">- Build STAXEventReader, STAXEventWriter and the data types.
  [bsc#1123158]
  * Added patch dom4j-enable-stax-datatypes.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1587124800">- Security fix: [bsc#1169760, CVE-2020-10683]
  * External Entity vulnerability in default SAX parser
  * Add dom4j-CVE-2020-10683.patch</changelog>
  <changelog author="fstrba@suse.com" date="1647518400">- Add jaxb-api dependency for relevant distribution versions so that
  we can build with JDKs that do not include the JavaEE modules</changelog>
  <changelog author="fstrba@suse.com" date="1648468800">- Add alias to the new artifact coordinates org.dom4j:dom4j
- Simplify the spec file a bit</changelog>
  <changelog author="fstrba@suse.com" date="1648641600">- Build against the standalone JavaEE modules unconditionally</changelog>
  <changelog author="fstrba@suse.com" date="1690200000">- Do not depend on jtidy, since it is not used during build</changelog>
  <changelog author="fstrba@suse.com" date="1692878400">- Upgrade to upstream version 2.1.4
  * Improvements and potentially breaking changes
    + Added new factory method
    org.dom4j.io.SAXReader.createDefault(). It has more secure
    defaults than new SAXReader(), which uses system
    XMLReaderFactory.createXMLReader() or
    SAXParserFactory.newInstance().newSAXParser().
    + If you use some optional dependency of dom4j (for example
    Jaxen, xsdlib etc.), you need to specify an explicit
    dependency on it in your project. They are no longer marked as
    a mandatory transitive dependency by dom4j.
    + Following SAX parser features are disabled by default in
    DocumentHelper.parse() for security reasons (they were enabled
    in previous versions):
    ° http://xml.org/sax/properties/external-general-entities
    ° http://xml.org/sax/properties/external-parameter-entities
  * Other changes:
    + updated pull-parser version
    + Reuse the writeAttribute method in writeAttributes
    + support build on OS with non-UTF8 as default charset
    + Gradle: add an automatic module name
    + Use Correct License Name "Plexus"
    + Possible vulnerability of DocumentHelper.parseText() to XML
    injection
    + CVS directories left in the source tree
    + XMLWriter does not escape supplementary unicode characters
    correctly
    + writer.writeOpen(x) doesn't write namespaces
    + concurrency problem with QNameCache
    + all dependencies are optional
    + SAXReader: hardcoded namespace features
    + validate QNames
    + StringIndexOutOfBoundsException in
    XMLWriter.writeElementContent()
    + TreeNode has grown some generics
    + QName serialization fix
    + DocumentException initialize with nested exception
    + Accidentally occurring error in a multi-threaded test
    + compatibility with W3C DOM Level 3
    + use Java generics
- Removed patches:
  * dom4j-1.6.1-bug1618750.patch
  * dom4j-CVE-2018-1000632.patch
  * dom4j-CVE-2020-10683.patch
  * dom4j-enable-stax-datatypes.patch
  * dom4j-javadoc.patch
  * dom4j-sourcetarget.patch
    + not needed with this version</changelog>
  <changelog author="fstrba@suse.com" date="1692878401">- Make a separate flavour for a minimal dom4j-bootstrap package
  used to build jaxen and full dom4j
- Added patch:
  * 0001-no-jaxen-dom4.patch
  * for the bootstrap package, patch out the code that requires
    jaxen with dom4j support to build</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1698926400">- JPMS: Add the Automatic-Module-Name attribute to the manifest.</changelog>
  <changelog author="fstrba@suse.com" date="1707998400">- The license is actually Plexus</changelog>
  <changelog author="gus.kenion@suse.com" date="1708516800">- Use %patch -P N instead of deprecated %patchN.</changelog>
</package>
<package pkgid="07ccbd26e4787f563f0b3735d2c56ac2fb7480777e60a8183a181e3f772db974" name="dom4j" arch="src">
  <version epoch="0" ver="2.1.4" rel="150200.12.10.2"/>
  <changelog author="mvyskocil@suse.com" date="1377691200">- use add_maven_depmap from javapackages-tools
- drop repolib part (never built)
- drop pointless jarjar
- unversioned javadoc</changelog>
  <changelog author="tchvatal@suse.com" date="1378728000">- Move from jpackage-utils to javapackage-tools</changelog>
  <changelog author="tchvatal@suse.com" date="1404820800">- Do not depend on ant-trax and run spec-cleaner.</changelog>
  <changelog author="tchvatal@suse.com" date="1426680000">- Fix build with new javapackages-tools</changelog>
  <changelog author="mpluskal@suse.com" date="1495195200">- Update dependencies</changelog>
  <changelog author="fstrba@suse.com" date="1504872000">- Added patch:
  * dom4j-sourcetarget.patch
    + Use java source and target level 1.6 in order to allow
    building with jdk9</changelog>
  <changelog author="fstrba@suse.com" date="1526472000">- Modified patch:
  * dom4j-sourcetarget.patch
    + Build with source and target 8 to prepare for a possible
    removal of 1.6 compatibility</changelog>
  <changelog author="fstrba@suse.com" date="1531224000">- Added patch:
  * dom4j-javadoc.patch
    + Don't load urls while building javadoc in environment without
    connectivity</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1537272000">- Security fix: [bsc#1105443, CVE-2018-1000632]
  * Version prior to version 2.1.1 contains a CWE-91: XML
    Injectionvulnerability in Class: Element. Methods: addElement,
    addAttribute that canresult in an attacker tampering with XML
    documents through.
  * Added dom4j-CVE-2018-1000632.patch</changelog>
  <changelog author="cbosdonnat@suse.com" date="1548417600">- Build STAXEventReader, STAXEventWriter and the data types.
  [bsc#1123158]
  * Added patch dom4j-enable-stax-datatypes.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1587124800">- Security fix: [bsc#1169760, CVE-2020-10683]
  * External Entity vulnerability in default SAX parser
  * Add dom4j-CVE-2020-10683.patch</changelog>
  <changelog author="fstrba@suse.com" date="1647518400">- Add jaxb-api dependency for relevant distribution versions so that
  we can build with JDKs that do not include the JavaEE modules</changelog>
  <changelog author="fstrba@suse.com" date="1648468800">- Add alias to the new artifact coordinates org.dom4j:dom4j
- Simplify the spec file a bit</changelog>
  <changelog author="fstrba@suse.com" date="1648641600">- Build against the standalone JavaEE modules unconditionally</changelog>
  <changelog author="fstrba@suse.com" date="1690200000">- Do not depend on jtidy, since it is not used during build</changelog>
  <changelog author="fstrba@suse.com" date="1692878400">- Upgrade to upstream version 2.1.4
  * Improvements and potentially breaking changes
    + Added new factory method
    org.dom4j.io.SAXReader.createDefault(). It has more secure
    defaults than new SAXReader(), which uses system
    XMLReaderFactory.createXMLReader() or
    SAXParserFactory.newInstance().newSAXParser().
    + If you use some optional dependency of dom4j (for example
    Jaxen, xsdlib etc.), you need to specify an explicit
    dependency on it in your project. They are no longer marked as
    a mandatory transitive dependency by dom4j.
    + Following SAX parser features are disabled by default in
    DocumentHelper.parse() for security reasons (they were enabled
    in previous versions):
    ° http://xml.org/sax/properties/external-general-entities
    ° http://xml.org/sax/properties/external-parameter-entities
  * Other changes:
    + updated pull-parser version
    + Reuse the writeAttribute method in writeAttributes
    + support build on OS with non-UTF8 as default charset
    + Gradle: add an automatic module name
    + Use Correct License Name "Plexus"
    + Possible vulnerability of DocumentHelper.parseText() to XML
    injection
    + CVS directories left in the source tree
    + XMLWriter does not escape supplementary unicode characters
    correctly
    + writer.writeOpen(x) doesn't write namespaces
    + concurrency problem with QNameCache
    + all dependencies are optional
    + SAXReader: hardcoded namespace features
    + validate QNames
    + StringIndexOutOfBoundsException in
    XMLWriter.writeElementContent()
    + TreeNode has grown some generics
    + QName serialization fix
    + DocumentException initialize with nested exception
    + Accidentally occurring error in a multi-threaded test
    + compatibility with W3C DOM Level 3
    + use Java generics
- Removed patches:
  * dom4j-1.6.1-bug1618750.patch
  * dom4j-CVE-2018-1000632.patch
  * dom4j-CVE-2020-10683.patch
  * dom4j-enable-stax-datatypes.patch
  * dom4j-javadoc.patch
  * dom4j-sourcetarget.patch
    + not needed with this version</changelog>
  <changelog author="fstrba@suse.com" date="1692878401">- Make a separate flavour for a minimal dom4j-bootstrap package
  used to build jaxen and full dom4j
- Added patch:
  * 0001-no-jaxen-dom4.patch
  * for the bootstrap package, patch out the code that requires
    jaxen with dom4j support to build</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1698926400">- JPMS: Add the Automatic-Module-Name attribute to the manifest.</changelog>
  <changelog author="fstrba@suse.com" date="1707998400">- The license is actually Plexus</changelog>
  <changelog author="gus.kenion@suse.com" date="1708516800">- Use %patch -P N instead of deprecated %patchN.</changelog>
</package>
<package pkgid="44135ee0037543bdd456241afbd5065a038a2f0c327d74b4346ff0428fd07b82" name="dom4j-demo" arch="noarch">
  <version epoch="0" ver="2.1.4" rel="150200.12.10.2"/>
  <changelog author="tchvatal@suse.com" date="1426680000">- Fix build with new javapackages-tools</changelog>
  <changelog author="mpluskal@suse.com" date="1495195200">- Update dependencies</changelog>
  <changelog author="fstrba@suse.com" date="1504872000">- Added patch:
  * dom4j-sourcetarget.patch
    + Use java source and target level 1.6 in order to allow
    building with jdk9</changelog>
  <changelog author="fstrba@suse.com" date="1526472000">- Modified patch:
  * dom4j-sourcetarget.patch
    + Build with source and target 8 to prepare for a possible
    removal of 1.6 compatibility</changelog>
  <changelog author="fstrba@suse.com" date="1531224000">- Added patch:
  * dom4j-javadoc.patch
    + Don't load urls while building javadoc in environment without
    connectivity</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1537272000">- Security fix: [bsc#1105443, CVE-2018-1000632]
  * Version prior to version 2.1.1 contains a CWE-91: XML
    Injectionvulnerability in Class: Element. Methods: addElement,
    addAttribute that canresult in an attacker tampering with XML
    documents through.
  * Added dom4j-CVE-2018-1000632.patch</changelog>
  <changelog author="cbosdonnat@suse.com" date="1548417600">- Build STAXEventReader, STAXEventWriter and the data types.
  [bsc#1123158]
  * Added patch dom4j-enable-stax-datatypes.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1587124800">- Security fix: [bsc#1169760, CVE-2020-10683]
  * External Entity vulnerability in default SAX parser
  * Add dom4j-CVE-2020-10683.patch</changelog>
  <changelog author="fstrba@suse.com" date="1647518400">- Add jaxb-api dependency for relevant distribution versions so that
  we can build with JDKs that do not include the JavaEE modules</changelog>
  <changelog author="fstrba@suse.com" date="1648468800">- Add alias to the new artifact coordinates org.dom4j:dom4j
- Simplify the spec file a bit</changelog>
  <changelog author="fstrba@suse.com" date="1648641600">- Build against the standalone JavaEE modules unconditionally</changelog>
  <changelog author="fstrba@suse.com" date="1690200000">- Do not depend on jtidy, since it is not used during build</changelog>
  <changelog author="fstrba@suse.com" date="1692878400">- Upgrade to upstream version 2.1.4
  * Improvements and potentially breaking changes
    + Added new factory method
    org.dom4j.io.SAXReader.createDefault(). It has more secure
    defaults than new SAXReader(), which uses system
    XMLReaderFactory.createXMLReader() or
    SAXParserFactory.newInstance().newSAXParser().
    + If you use some optional dependency of dom4j (for example
    Jaxen, xsdlib etc.), you need to specify an explicit
    dependency on it in your project. They are no longer marked as
    a mandatory transitive dependency by dom4j.
    + Following SAX parser features are disabled by default in
    DocumentHelper.parse() for security reasons (they were enabled
    in previous versions):
    ° http://xml.org/sax/properties/external-general-entities
    ° http://xml.org/sax/properties/external-parameter-entities
  * Other changes:
    + updated pull-parser version
    + Reuse the writeAttribute method in writeAttributes
    + support build on OS with non-UTF8 as default charset
    + Gradle: add an automatic module name
    + Use Correct License Name "Plexus"
    + Possible vulnerability of DocumentHelper.parseText() to XML
    injection
    + CVS directories left in the source tree
    + XMLWriter does not escape supplementary unicode characters
    correctly
    + writer.writeOpen(x) doesn't write namespaces
    + concurrency problem with QNameCache
    + all dependencies are optional
    + SAXReader: hardcoded namespace features
    + validate QNames
    + StringIndexOutOfBoundsException in
    XMLWriter.writeElementContent()
    + TreeNode has grown some generics
    + QName serialization fix
    + DocumentException initialize with nested exception
    + Accidentally occurring error in a multi-threaded test
    + compatibility with W3C DOM Level 3
    + use Java generics
- Removed patches:
  * dom4j-1.6.1-bug1618750.patch
  * dom4j-CVE-2018-1000632.patch
  * dom4j-CVE-2020-10683.patch
  * dom4j-enable-stax-datatypes.patch
  * dom4j-javadoc.patch
  * dom4j-sourcetarget.patch
    + not needed with this version</changelog>
  <changelog author="fstrba@suse.com" date="1692878401">- Make a separate flavour for a minimal dom4j-bootstrap package
  used to build jaxen and full dom4j
- Added patch:
  * 0001-no-jaxen-dom4.patch
  * for the bootstrap package, patch out the code that requires
    jaxen with dom4j support to build</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1698926400">- JPMS: Add the Automatic-Module-Name attribute to the manifest.</changelog>
  <changelog author="fstrba@suse.com" date="1707998400">- The license is actually Plexus</changelog>
  <changelog author="gus.kenion@suse.com" date="1708516800">- Use %patch -P N instead of deprecated %patchN.</changelog>
</package>
<package pkgid="690def763b1ab0ffc876c06e1e0c7ed2db848736a95dc9c1f0795d4421baa1d3" name="dom4j-javadoc" arch="noarch">
  <version epoch="0" ver="2.1.4" rel="150200.12.10.2"/>
  <changelog author="tchvatal@suse.com" date="1426680000">- Fix build with new javapackages-tools</changelog>
  <changelog author="mpluskal@suse.com" date="1495195200">- Update dependencies</changelog>
  <changelog author="fstrba@suse.com" date="1504872000">- Added patch:
  * dom4j-sourcetarget.patch
    + Use java source and target level 1.6 in order to allow
    building with jdk9</changelog>
  <changelog author="fstrba@suse.com" date="1526472000">- Modified patch:
  * dom4j-sourcetarget.patch
    + Build with source and target 8 to prepare for a possible
    removal of 1.6 compatibility</changelog>
  <changelog author="fstrba@suse.com" date="1531224000">- Added patch:
  * dom4j-javadoc.patch
    + Don't load urls while building javadoc in environment without
    connectivity</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1537272000">- Security fix: [bsc#1105443, CVE-2018-1000632]
  * Version prior to version 2.1.1 contains a CWE-91: XML
    Injectionvulnerability in Class: Element. Methods: addElement,
    addAttribute that canresult in an attacker tampering with XML
    documents through.
  * Added dom4j-CVE-2018-1000632.patch</changelog>
  <changelog author="cbosdonnat@suse.com" date="1548417600">- Build STAXEventReader, STAXEventWriter and the data types.
  [bsc#1123158]
  * Added patch dom4j-enable-stax-datatypes.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1587124800">- Security fix: [bsc#1169760, CVE-2020-10683]
  * External Entity vulnerability in default SAX parser
  * Add dom4j-CVE-2020-10683.patch</changelog>
  <changelog author="fstrba@suse.com" date="1647518400">- Add jaxb-api dependency for relevant distribution versions so that
  we can build with JDKs that do not include the JavaEE modules</changelog>
  <changelog author="fstrba@suse.com" date="1648468800">- Add alias to the new artifact coordinates org.dom4j:dom4j
- Simplify the spec file a bit</changelog>
  <changelog author="fstrba@suse.com" date="1648641600">- Build against the standalone JavaEE modules unconditionally</changelog>
  <changelog author="fstrba@suse.com" date="1690200000">- Do not depend on jtidy, since it is not used during build</changelog>
  <changelog author="fstrba@suse.com" date="1692878400">- Upgrade to upstream version 2.1.4
  * Improvements and potentially breaking changes
    + Added new factory method
    org.dom4j.io.SAXReader.createDefault(). It has more secure
    defaults than new SAXReader(), which uses system
    XMLReaderFactory.createXMLReader() or
    SAXParserFactory.newInstance().newSAXParser().
    + If you use some optional dependency of dom4j (for example
    Jaxen, xsdlib etc.), you need to specify an explicit
    dependency on it in your project. They are no longer marked as
    a mandatory transitive dependency by dom4j.
    + Following SAX parser features are disabled by default in
    DocumentHelper.parse() for security reasons (they were enabled
    in previous versions):
    ° http://xml.org/sax/properties/external-general-entities
    ° http://xml.org/sax/properties/external-parameter-entities
  * Other changes:
    + updated pull-parser version
    + Reuse the writeAttribute method in writeAttributes
    + support build on OS with non-UTF8 as default charset
    + Gradle: add an automatic module name
    + Use Correct License Name "Plexus"
    + Possible vulnerability of DocumentHelper.parseText() to XML
    injection
    + CVS directories left in the source tree
    + XMLWriter does not escape supplementary unicode characters
    correctly
    + writer.writeOpen(x) doesn't write namespaces
    + concurrency problem with QNameCache
    + all dependencies are optional
    + SAXReader: hardcoded namespace features
    + validate QNames
    + StringIndexOutOfBoundsException in
    XMLWriter.writeElementContent()
    + TreeNode has grown some generics
    + QName serialization fix
    + DocumentException initialize with nested exception
    + Accidentally occurring error in a multi-threaded test
    + compatibility with W3C DOM Level 3
    + use Java generics
- Removed patches:
  * dom4j-1.6.1-bug1618750.patch
  * dom4j-CVE-2018-1000632.patch
  * dom4j-CVE-2020-10683.patch
  * dom4j-enable-stax-datatypes.patch
  * dom4j-javadoc.patch
  * dom4j-sourcetarget.patch
    + not needed with this version</changelog>
  <changelog author="fstrba@suse.com" date="1692878401">- Make a separate flavour for a minimal dom4j-bootstrap package
  used to build jaxen and full dom4j
- Added patch:
  * 0001-no-jaxen-dom4.patch
  * for the bootstrap package, patch out the code that requires
    jaxen with dom4j support to build</changelog>
  <changelog author="shvetz.anton@gmail.com" date="1698926400">- JPMS: Add the Automatic-Module-Name attribute to the manifest.</changelog>
  <changelog author="fstrba@suse.com" date="1707998400">- The license is actually Plexus</changelog>
  <changelog author="gus.kenion@suse.com" date="1708516800">- Use %patch -P N instead of deprecated %patchN.</changelog>
</package>
<package pkgid="5166d8f40d1dc182eff73a786a14c738bc985748c931f109c3c489f07de1fc7a" name="dovecot23" arch="aarch64">
  <version epoch="0" ver="2.3.15" rel="150200.65.1"/>
  <changelog author="mrueckert@suse.de" date="1520424000">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
   instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1657195200">- VUL-0: CVE-2022-30550: dovecot22,dovecot23: Privilege escalation
  possible in dovecot when similar master and non-master passdbs are used (bsc#1201267).
  o Apply upstream patch:
    CVE-2022-30550.patch</changelog>
  <changelog author="varkoly@suse.com" date="1723723200">- Fix CVE-2024-23185: dovecot22,dovecot23: large headers can cause resource exhaustion when parsing message
  (bsc#1229183)
- Fix VUL-0: CVE-2024-23184: dovecot22,dovecot23: parsing of messages containing many address headers (From, To, Cc, Bcc, etc.) could be excessively CPU intensive
  (bsc#1229184)
  o Apply upstream patches:
    0001-lib-mail-message-header-parser-Limit-header-block-to-10MB.patch
    0001-lib-test-llist-Fix-dllist2-test-name.patch</changelog>
</package>
<package pkgid="4ff875f7847bad3b4f83bed29300be971bdd0ca6b3d3fc42a8e5966a4b4e9ed1" name="dovecot23" arch="ppc64le">
  <version epoch="0" ver="2.3.15" rel="150200.65.1"/>
  <changelog author="mrueckert@suse.de" date="1520424000">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
   instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1657195200">- VUL-0: CVE-2022-30550: dovecot22,dovecot23: Privilege escalation
  possible in dovecot when similar master and non-master passdbs are used (bsc#1201267).
  o Apply upstream patch:
    CVE-2022-30550.patch</changelog>
  <changelog author="varkoly@suse.com" date="1723723200">- Fix CVE-2024-23185: dovecot22,dovecot23: large headers can cause resource exhaustion when parsing message
  (bsc#1229183)
- Fix VUL-0: CVE-2024-23184: dovecot22,dovecot23: parsing of messages containing many address headers (From, To, Cc, Bcc, etc.) could be excessively CPU intensive
  (bsc#1229184)
  o Apply upstream patches:
    0001-lib-mail-message-header-parser-Limit-header-block-to-10MB.patch
    0001-lib-test-llist-Fix-dllist2-test-name.patch</changelog>
</package>
<package pkgid="14b295325e728d9b14864349b942a80a8cee0d641f50d96f305ebec60dafabd3" name="dovecot23" arch="s390x">
  <version epoch="0" ver="2.3.15" rel="150200.65.1"/>
  <changelog author="mrueckert@suse.de" date="1520424000">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
   instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1657195200">- VUL-0: CVE-2022-30550: dovecot22,dovecot23: Privilege escalation
  possible in dovecot when similar master and non-master passdbs are used (bsc#1201267).
  o Apply upstream patch:
    CVE-2022-30550.patch</changelog>
  <changelog author="varkoly@suse.com" date="1723723200">- Fix CVE-2024-23185: dovecot22,dovecot23: large headers can cause resource exhaustion when parsing message
  (bsc#1229183)
- Fix VUL-0: CVE-2024-23184: dovecot22,dovecot23: parsing of messages containing many address headers (From, To, Cc, Bcc, etc.) could be excessively CPU intensive
  (bsc#1229184)
  o Apply upstream patches:
    0001-lib-mail-message-header-parser-Limit-header-block-to-10MB.patch
    0001-lib-test-llist-Fix-dllist2-test-name.patch</changelog>
</package>
<package pkgid="3b5a0ef91f246df177354299049ab9166f0aad9c9355d89874ceeecda665148d" name="dovecot23" arch="src">
  <version epoch="0" ver="2.3.15" rel="150200.65.1"/>
  <changelog author="mrueckert@suse.de" date="1520424000">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
   instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1657195200">- VUL-0: CVE-2022-30550: dovecot22,dovecot23: Privilege escalation
  possible in dovecot when similar master and non-master passdbs are used (bsc#1201267).
  o Apply upstream patch:
    CVE-2022-30550.patch</changelog>
  <changelog author="varkoly@suse.com" date="1723723200">- Fix CVE-2024-23185: dovecot22,dovecot23: large headers can cause resource exhaustion when parsing message
  (bsc#1229183)
- Fix VUL-0: CVE-2024-23184: dovecot22,dovecot23: parsing of messages containing many address headers (From, To, Cc, Bcc, etc.) could be excessively CPU intensive
  (bsc#1229184)
  o Apply upstream patches:
    0001-lib-mail-message-header-parser-Limit-header-block-to-10MB.patch
    0001-lib-test-llist-Fix-dllist2-test-name.patch</changelog>
</package>
<package pkgid="c22e2e467c9fd5fad54ba93083e533ed4a382ecf275fdc0e0f454d6a8b7bfc3d" name="dovecot23" arch="x86_64">
  <version epoch="0" ver="2.3.15" rel="150200.65.1"/>
  <changelog author="mrueckert@suse.de" date="1520424000">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
   instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1657195200">- VUL-0: CVE-2022-30550: dovecot22,dovecot23: Privilege escalation
  possible in dovecot when similar master and non-master passdbs are used (bsc#1201267).
  o Apply upstream patch:
    CVE-2022-30550.patch</changelog>
  <changelog author="varkoly@suse.com" date="1723723200">- Fix CVE-2024-23185: dovecot22,dovecot23: large headers can cause resource exhaustion when parsing message
  (bsc#1229183)
- Fix VUL-0: CVE-2024-23184: dovecot22,dovecot23: parsing of messages containing many address headers (From, To, Cc, Bcc, etc.) could be excessively CPU intensive
  (bsc#1229184)
  o Apply upstream patches:
    0001-lib-mail-message-header-parser-Limit-header-block-to-10MB.patch
    0001-lib-test-llist-Fix-dllist2-test-name.patch</changelog>
</package>
<package pkgid="cfdfb895f2e1be0aa7606ea11e905c694c9ae4bca387eb44360f5c039d7528c1" name="dovecot23-backend-mysql" arch="aarch64">
  <version epoch="0" ver="2.3.15" rel="150200.65.1"/>
  <changelog author="mrueckert@suse.de" date="1520424000">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
   instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1657195200">- VUL-0: CVE-2022-30550: dovecot22,dovecot23: Privilege escalation
  possible in dovecot when similar master and non-master passdbs are used (bsc#1201267).
  o Apply upstream patch:
    CVE-2022-30550.patch</changelog>
  <changelog author="varkoly@suse.com" date="1723723200">- Fix CVE-2024-23185: dovecot22,dovecot23: large headers can cause resource exhaustion when parsing message
  (bsc#1229183)
- Fix VUL-0: CVE-2024-23184: dovecot22,dovecot23: parsing of messages containing many address headers (From, To, Cc, Bcc, etc.) could be excessively CPU intensive
  (bsc#1229184)
  o Apply upstream patches:
    0001-lib-mail-message-header-parser-Limit-header-block-to-10MB.patch
    0001-lib-test-llist-Fix-dllist2-test-name.patch</changelog>
</package>
<package pkgid="0a56bfbd11f4421aa2615158dd95dc71d65aedc9477aa6ac8cf4140d77bde56a" name="dovecot23-backend-mysql" arch="ppc64le">
  <version epoch="0" ver="2.3.15" rel="150200.65.1"/>
  <changelog author="mrueckert@suse.de" date="1520424000">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
   instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1657195200">- VUL-0: CVE-2022-30550: dovecot22,dovecot23: Privilege escalation
  possible in dovecot when similar master and non-master passdbs are used (bsc#1201267).
  o Apply upstream patch:
    CVE-2022-30550.patch</changelog>
  <changelog author="varkoly@suse.com" date="1723723200">- Fix CVE-2024-23185: dovecot22,dovecot23: large headers can cause resource exhaustion when parsing message
  (bsc#1229183)
- Fix VUL-0: CVE-2024-23184: dovecot22,dovecot23: parsing of messages containing many address headers (From, To, Cc, Bcc, etc.) could be excessively CPU intensive
  (bsc#1229184)
  o Apply upstream patches:
    0001-lib-mail-message-header-parser-Limit-header-block-to-10MB.patch
    0001-lib-test-llist-Fix-dllist2-test-name.patch</changelog>
</package>
<package pkgid="5cb0205e26adc96615cfcb6a6e9e9eb372055cac02321effaf49a5676e9047e4" name="dovecot23-backend-mysql" arch="s390x">
  <version epoch="0" ver="2.3.15" rel="150200.65.1"/>
  <changelog author="mrueckert@suse.de" date="1520424000">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
   instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1657195200">- VUL-0: CVE-2022-30550: dovecot22,dovecot23: Privilege escalation
  possible in dovecot when similar master and non-master passdbs are used (bsc#1201267).
  o Apply upstream patch:
    CVE-2022-30550.patch</changelog>
  <changelog author="varkoly@suse.com" date="1723723200">- Fix CVE-2024-23185: dovecot22,dovecot23: large headers can cause resource exhaustion when parsing message
  (bsc#1229183)
- Fix VUL-0: CVE-2024-23184: dovecot22,dovecot23: parsing of messages containing many address headers (From, To, Cc, Bcc, etc.) could be excessively CPU intensive
  (bsc#1229184)
  o Apply upstream patches:
    0001-lib-mail-message-header-parser-Limit-header-block-to-10MB.patch
    0001-lib-test-llist-Fix-dllist2-test-name.patch</changelog>
</package>
<package pkgid="9769a73194220b3b8d47328db31c28d00a4344536cda018a6b89f5c6e7944e7f" name="dovecot23-backend-mysql" arch="x86_64">
  <version epoch="0" ver="2.3.15" rel="150200.65.1"/>
  <changelog author="mrueckert@suse.de" date="1520424000">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
   instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1657195200">- VUL-0: CVE-2022-30550: dovecot22,dovecot23: Privilege escalation
  possible in dovecot when similar master and non-master passdbs are used (bsc#1201267).
  o Apply upstream patch:
    CVE-2022-30550.patch</changelog>
  <changelog author="varkoly@suse.com" date="1723723200">- Fix CVE-2024-23185: dovecot22,dovecot23: large headers can cause resource exhaustion when parsing message
  (bsc#1229183)
- Fix VUL-0: CVE-2024-23184: dovecot22,dovecot23: parsing of messages containing many address headers (From, To, Cc, Bcc, etc.) could be excessively CPU intensive
  (bsc#1229184)
  o Apply upstream patches:
    0001-lib-mail-message-header-parser-Limit-header-block-to-10MB.patch
    0001-lib-test-llist-Fix-dllist2-test-name.patch</changelog>
</package>
<package pkgid="c5660498392713d1acb893b7c7b5dc360bd7fee5948275512fa373315300428c" name="dovecot23-backend-pgsql" arch="aarch64">
  <version epoch="0" ver="2.3.15" rel="150200.65.1"/>
  <changelog author="mrueckert@suse.de" date="1520424000">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
   instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1657195200">- VUL-0: CVE-2022-30550: dovecot22,dovecot23: Privilege escalation
  possible in dovecot when similar master and non-master passdbs are used (bsc#1201267).
  o Apply upstream patch:
    CVE-2022-30550.patch</changelog>
  <changelog author="varkoly@suse.com" date="1723723200">- Fix CVE-2024-23185: dovecot22,dovecot23: large headers can cause resource exhaustion when parsing message
  (bsc#1229183)
- Fix VUL-0: CVE-2024-23184: dovecot22,dovecot23: parsing of messages containing many address headers (From, To, Cc, Bcc, etc.) could be excessively CPU intensive
  (bsc#1229184)
  o Apply upstream patches:
    0001-lib-mail-message-header-parser-Limit-header-block-to-10MB.patch
    0001-lib-test-llist-Fix-dllist2-test-name.patch</changelog>
</package>
<package pkgid="2c302394f34d574378afec72dc4816b37e1b758258f6f45e873c1d13a638a253" name="dovecot23-backend-pgsql" arch="ppc64le">
  <version epoch="0" ver="2.3.15" rel="150200.65.1"/>
  <changelog author="mrueckert@suse.de" date="1520424000">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
   instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1657195200">- VUL-0: CVE-2022-30550: dovecot22,dovecot23: Privilege escalation
  possible in dovecot when similar master and non-master passdbs are used (bsc#1201267).
  o Apply upstream patch:
    CVE-2022-30550.patch</changelog>
  <changelog author="varkoly@suse.com" date="1723723200">- Fix CVE-2024-23185: dovecot22,dovecot23: large headers can cause resource exhaustion when parsing message
  (bsc#1229183)
- Fix VUL-0: CVE-2024-23184: dovecot22,dovecot23: parsing of messages containing many address headers (From, To, Cc, Bcc, etc.) could be excessively CPU intensive
  (bsc#1229184)
  o Apply upstream patches:
    0001-lib-mail-message-header-parser-Limit-header-block-to-10MB.patch
    0001-lib-test-llist-Fix-dllist2-test-name.patch</changelog>
</package>
<package pkgid="9ce3680acadd29406eca87810a20428fc578a38feff0ffc551ef080f0a6706b6" name="dovecot23-backend-pgsql" arch="s390x">
  <version epoch="0" ver="2.3.15" rel="150200.65.1"/>
  <changelog author="mrueckert@suse.de" date="1520424000">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
   instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1657195200">- VUL-0: CVE-2022-30550: dovecot22,dovecot23: Privilege escalation
  possible in dovecot when similar master and non-master passdbs are used (bsc#1201267).
  o Apply upstream patch:
    CVE-2022-30550.patch</changelog>
  <changelog author="varkoly@suse.com" date="1723723200">- Fix CVE-2024-23185: dovecot22,dovecot23: large headers can cause resource exhaustion when parsing message
  (bsc#1229183)
- Fix VUL-0: CVE-2024-23184: dovecot22,dovecot23: parsing of messages containing many address headers (From, To, Cc, Bcc, etc.) could be excessively CPU intensive
  (bsc#1229184)
  o Apply upstream patches:
    0001-lib-mail-message-header-parser-Limit-header-block-to-10MB.patch
    0001-lib-test-llist-Fix-dllist2-test-name.patch</changelog>
</package>
<package pkgid="30821fba2cbe4b628606883cb53b4744990db5d51d9229f39d89d25142cb42cd" name="dovecot23-backend-pgsql" arch="x86_64">
  <version epoch="0" ver="2.3.15" rel="150200.65.1"/>
  <changelog author="mrueckert@suse.de" date="1520424000">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
   instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1657195200">- VUL-0: CVE-2022-30550: dovecot22,dovecot23: Privilege escalation
  possible in dovecot when similar master and non-master passdbs are used (bsc#1201267).
  o Apply upstream patch:
    CVE-2022-30550.patch</changelog>
  <changelog author="varkoly@suse.com" date="1723723200">- Fix CVE-2024-23185: dovecot22,dovecot23: large headers can cause resource exhaustion when parsing message
  (bsc#1229183)
- Fix VUL-0: CVE-2024-23184: dovecot22,dovecot23: parsing of messages containing many address headers (From, To, Cc, Bcc, etc.) could be excessively CPU intensive
  (bsc#1229184)
  o Apply upstream patches:
    0001-lib-mail-message-header-parser-Limit-header-block-to-10MB.patch
    0001-lib-test-llist-Fix-dllist2-test-name.patch</changelog>
</package>
<package pkgid="28f452aa7727689018c05bbd6ecc09be7b7c74288252f35488ac86b3c2a98f37" name="dovecot23-backend-sqlite" arch="aarch64">
  <version epoch="0" ver="2.3.15" rel="150200.65.1"/>
  <changelog author="mrueckert@suse.de" date="1520424000">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
   instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1657195200">- VUL-0: CVE-2022-30550: dovecot22,dovecot23: Privilege escalation
  possible in dovecot when similar master and non-master passdbs are used (bsc#1201267).
  o Apply upstream patch:
    CVE-2022-30550.patch</changelog>
  <changelog author="varkoly@suse.com" date="1723723200">- Fix CVE-2024-23185: dovecot22,dovecot23: large headers can cause resource exhaustion when parsing message
  (bsc#1229183)
- Fix VUL-0: CVE-2024-23184: dovecot22,dovecot23: parsing of messages containing many address headers (From, To, Cc, Bcc, etc.) could be excessively CPU intensive
  (bsc#1229184)
  o Apply upstream patches:
    0001-lib-mail-message-header-parser-Limit-header-block-to-10MB.patch
    0001-lib-test-llist-Fix-dllist2-test-name.patch</changelog>
</package>
<package pkgid="dc1bf6b9a74d305de2f165173e6c97b5cc709598333c1e79dd92a4ee6d3ebdf5" name="dovecot23-backend-sqlite" arch="ppc64le">
  <version epoch="0" ver="2.3.15" rel="150200.65.1"/>
  <changelog author="mrueckert@suse.de" date="1520424000">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
   instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1657195200">- VUL-0: CVE-2022-30550: dovecot22,dovecot23: Privilege escalation
  possible in dovecot when similar master and non-master passdbs are used (bsc#1201267).
  o Apply upstream patch:
    CVE-2022-30550.patch</changelog>
  <changelog author="varkoly@suse.com" date="1723723200">- Fix CVE-2024-23185: dovecot22,dovecot23: large headers can cause resource exhaustion when parsing message
  (bsc#1229183)
- Fix VUL-0: CVE-2024-23184: dovecot22,dovecot23: parsing of messages containing many address headers (From, To, Cc, Bcc, etc.) could be excessively CPU intensive
  (bsc#1229184)
  o Apply upstream patches:
    0001-lib-mail-message-header-parser-Limit-header-block-to-10MB.patch
    0001-lib-test-llist-Fix-dllist2-test-name.patch</changelog>
</package>
<package pkgid="e770d584fedc9939ce65522a35c5b7d02464d55c859da5ab61ed4a28c03daf7e" name="dovecot23-backend-sqlite" arch="s390x">
  <version epoch="0" ver="2.3.15" rel="150200.65.1"/>
  <changelog author="mrueckert@suse.de" date="1520424000">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
   instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1657195200">- VUL-0: CVE-2022-30550: dovecot22,dovecot23: Privilege escalation
  possible in dovecot when similar master and non-master passdbs are used (bsc#1201267).
  o Apply upstream patch:
    CVE-2022-30550.patch</changelog>
  <changelog author="varkoly@suse.com" date="1723723200">- Fix CVE-2024-23185: dovecot22,dovecot23: large headers can cause resource exhaustion when parsing message
  (bsc#1229183)
- Fix VUL-0: CVE-2024-23184: dovecot22,dovecot23: parsing of messages containing many address headers (From, To, Cc, Bcc, etc.) could be excessively CPU intensive
  (bsc#1229184)
  o Apply upstream patches:
    0001-lib-mail-message-header-parser-Limit-header-block-to-10MB.patch
    0001-lib-test-llist-Fix-dllist2-test-name.patch</changelog>
</package>
<package pkgid="5d5ca88f00730ac77da56a086743cd26382812caa99025d8eb795a7abded876b" name="dovecot23-backend-sqlite" arch="x86_64">
  <version epoch="0" ver="2.3.15" rel="150200.65.1"/>
  <changelog author="mrueckert@suse.de" date="1520424000">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
   instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1657195200">- VUL-0: CVE-2022-30550: dovecot22,dovecot23: Privilege escalation
  possible in dovecot when similar master and non-master passdbs are used (bsc#1201267).
  o Apply upstream patch:
    CVE-2022-30550.patch</changelog>
  <changelog author="varkoly@suse.com" date="1723723200">- Fix CVE-2024-23185: dovecot22,dovecot23: large headers can cause resource exhaustion when parsing message
  (bsc#1229183)
- Fix VUL-0: CVE-2024-23184: dovecot22,dovecot23: parsing of messages containing many address headers (From, To, Cc, Bcc, etc.) could be excessively CPU intensive
  (bsc#1229184)
  o Apply upstream patches:
    0001-lib-mail-message-header-parser-Limit-header-block-to-10MB.patch
    0001-lib-test-llist-Fix-dllist2-test-name.patch</changelog>
</package>
<package pkgid="7b48d58ac41860208b37c10e8d3b2812e3a73bbf9ef075d7c37ff53a22d6f8f6" name="dovecot23-devel" arch="aarch64">
  <version epoch="0" ver="2.3.15" rel="150200.65.1"/>
  <changelog author="mrueckert@suse.de" date="1520424000">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
   instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1657195200">- VUL-0: CVE-2022-30550: dovecot22,dovecot23: Privilege escalation
  possible in dovecot when similar master and non-master passdbs are used (bsc#1201267).
  o Apply upstream patch:
    CVE-2022-30550.patch</changelog>
  <changelog author="varkoly@suse.com" date="1723723200">- Fix CVE-2024-23185: dovecot22,dovecot23: large headers can cause resource exhaustion when parsing message
  (bsc#1229183)
- Fix VUL-0: CVE-2024-23184: dovecot22,dovecot23: parsing of messages containing many address headers (From, To, Cc, Bcc, etc.) could be excessively CPU intensive
  (bsc#1229184)
  o Apply upstream patches:
    0001-lib-mail-message-header-parser-Limit-header-block-to-10MB.patch
    0001-lib-test-llist-Fix-dllist2-test-name.patch</changelog>
</package>
<package pkgid="1a2552dff2472b19db7641b997d7b5395777101e6ea379730f25e047a1c6f980" name="dovecot23-devel" arch="ppc64le">
  <version epoch="0" ver="2.3.15" rel="150200.65.1"/>
  <changelog author="mrueckert@suse.de" date="1520424000">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
   instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1657195200">- VUL-0: CVE-2022-30550: dovecot22,dovecot23: Privilege escalation
  possible in dovecot when similar master and non-master passdbs are used (bsc#1201267).
  o Apply upstream patch:
    CVE-2022-30550.patch</changelog>
  <changelog author="varkoly@suse.com" date="1723723200">- Fix CVE-2024-23185: dovecot22,dovecot23: large headers can cause resource exhaustion when parsing message
  (bsc#1229183)
- Fix VUL-0: CVE-2024-23184: dovecot22,dovecot23: parsing of messages containing many address headers (From, To, Cc, Bcc, etc.) could be excessively CPU intensive
  (bsc#1229184)
  o Apply upstream patches:
    0001-lib-mail-message-header-parser-Limit-header-block-to-10MB.patch
    0001-lib-test-llist-Fix-dllist2-test-name.patch</changelog>
</package>
<package pkgid="abb0620d78ded14c307e252bbcec1ff80693b01a3f93a33adc891b7c5f901906" name="dovecot23-devel" arch="s390x">
  <version epoch="0" ver="2.3.15" rel="150200.65.1"/>
  <changelog author="mrueckert@suse.de" date="1520424000">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
   instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1657195200">- VUL-0: CVE-2022-30550: dovecot22,dovecot23: Privilege escalation
  possible in dovecot when similar master and non-master passdbs are used (bsc#1201267).
  o Apply upstream patch:
    CVE-2022-30550.patch</changelog>
  <changelog author="varkoly@suse.com" date="1723723200">- Fix CVE-2024-23185: dovecot22,dovecot23: large headers can cause resource exhaustion when parsing message
  (bsc#1229183)
- Fix VUL-0: CVE-2024-23184: dovecot22,dovecot23: parsing of messages containing many address headers (From, To, Cc, Bcc, etc.) could be excessively CPU intensive
  (bsc#1229184)
  o Apply upstream patches:
    0001-lib-mail-message-header-parser-Limit-header-block-to-10MB.patch
    0001-lib-test-llist-Fix-dllist2-test-name.patch</changelog>
</package>
<package pkgid="27e81b9581496c4d516b7d2b5612482fe468c3da4b6620f7b081dba9fa4d3362" name="dovecot23-devel" arch="x86_64">
  <version epoch="0" ver="2.3.15" rel="150200.65.1"/>
  <changelog author="mrueckert@suse.de" date="1520424000">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
   instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1657195200">- VUL-0: CVE-2022-30550: dovecot22,dovecot23: Privilege escalation
  possible in dovecot when similar master and non-master passdbs are used (bsc#1201267).
  o Apply upstream patch:
    CVE-2022-30550.patch</changelog>
  <changelog author="varkoly@suse.com" date="1723723200">- Fix CVE-2024-23185: dovecot22,dovecot23: large headers can cause resource exhaustion when parsing message
  (bsc#1229183)
- Fix VUL-0: CVE-2024-23184: dovecot22,dovecot23: parsing of messages containing many address headers (From, To, Cc, Bcc, etc.) could be excessively CPU intensive
  (bsc#1229184)
  o Apply upstream patches:
    0001-lib-mail-message-header-parser-Limit-header-block-to-10MB.patch
    0001-lib-test-llist-Fix-dllist2-test-name.patch</changelog>
</package>
<package pkgid="2a84dad6f9aa8d3b876966335bbfc7c5290d6a1b3638d7f799790a2f0ae4cdc8" name="dovecot23-fts" arch="aarch64">
  <version epoch="0" ver="2.3.15" rel="150200.65.1"/>
  <changelog author="mrueckert@suse.de" date="1520424000">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
   instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1657195200">- VUL-0: CVE-2022-30550: dovecot22,dovecot23: Privilege escalation
  possible in dovecot when similar master and non-master passdbs are used (bsc#1201267).
  o Apply upstream patch:
    CVE-2022-30550.patch</changelog>
  <changelog author="varkoly@suse.com" date="1723723200">- Fix CVE-2024-23185: dovecot22,dovecot23: large headers can cause resource exhaustion when parsing message
  (bsc#1229183)
- Fix VUL-0: CVE-2024-23184: dovecot22,dovecot23: parsing of messages containing many address headers (From, To, Cc, Bcc, etc.) could be excessively CPU intensive
  (bsc#1229184)
  o Apply upstream patches:
    0001-lib-mail-message-header-parser-Limit-header-block-to-10MB.patch
    0001-lib-test-llist-Fix-dllist2-test-name.patch</changelog>
</package>
<package pkgid="7f0f9ab57c93cae08ecf34c339e28fc9ce573e281e6aedeb975c075a3fa3c489" name="dovecot23-fts" arch="ppc64le">
  <version epoch="0" ver="2.3.15" rel="150200.65.1"/>
  <changelog author="mrueckert@suse.de" date="1520424000">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
   instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1657195200">- VUL-0: CVE-2022-30550: dovecot22,dovecot23: Privilege escalation
  possible in dovecot when similar master and non-master passdbs are used (bsc#1201267).
  o Apply upstream patch:
    CVE-2022-30550.patch</changelog>
  <changelog author="varkoly@suse.com" date="1723723200">- Fix CVE-2024-23185: dovecot22,dovecot23: large headers can cause resource exhaustion when parsing message
  (bsc#1229183)
- Fix VUL-0: CVE-2024-23184: dovecot22,dovecot23: parsing of messages containing many address headers (From, To, Cc, Bcc, etc.) could be excessively CPU intensive
  (bsc#1229184)
  o Apply upstream patches:
    0001-lib-mail-message-header-parser-Limit-header-block-to-10MB.patch
    0001-lib-test-llist-Fix-dllist2-test-name.patch</changelog>
</package>
<package pkgid="37d577eb563b4568a8c38c0aa311bb29cf5b91ca0c8d5135f6f2d56ed641446e" name="dovecot23-fts" arch="s390x">
  <version epoch="0" ver="2.3.15" rel="150200.65.1"/>
  <changelog author="mrueckert@suse.de" date="1520424000">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
   instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1657195200">- VUL-0: CVE-2022-30550: dovecot22,dovecot23: Privilege escalation
  possible in dovecot when similar master and non-master passdbs are used (bsc#1201267).
  o Apply upstream patch:
    CVE-2022-30550.patch</changelog>
  <changelog author="varkoly@suse.com" date="1723723200">- Fix CVE-2024-23185: dovecot22,dovecot23: large headers can cause resource exhaustion when parsing message
  (bsc#1229183)
- Fix VUL-0: CVE-2024-23184: dovecot22,dovecot23: parsing of messages containing many address headers (From, To, Cc, Bcc, etc.) could be excessively CPU intensive
  (bsc#1229184)
  o Apply upstream patches:
    0001-lib-mail-message-header-parser-Limit-header-block-to-10MB.patch
    0001-lib-test-llist-Fix-dllist2-test-name.patch</changelog>
</package>
<package pkgid="c0fb5340a5c6a5b5b6a2ba8713008d2e4f688abbc3e613ba908acab0e8df8cc8" name="dovecot23-fts" arch="x86_64">
  <version epoch="0" ver="2.3.15" rel="150200.65.1"/>
  <changelog author="mrueckert@suse.de" date="1520424000">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
   instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1657195200">- VUL-0: CVE-2022-30550: dovecot22,dovecot23: Privilege escalation
  possible in dovecot when similar master and non-master passdbs are used (bsc#1201267).
  o Apply upstream patch:
    CVE-2022-30550.patch</changelog>
  <changelog author="varkoly@suse.com" date="1723723200">- Fix CVE-2024-23185: dovecot22,dovecot23: large headers can cause resource exhaustion when parsing message
  (bsc#1229183)
- Fix VUL-0: CVE-2024-23184: dovecot22,dovecot23: parsing of messages containing many address headers (From, To, Cc, Bcc, etc.) could be excessively CPU intensive
  (bsc#1229184)
  o Apply upstream patches:
    0001-lib-mail-message-header-parser-Limit-header-block-to-10MB.patch
    0001-lib-test-llist-Fix-dllist2-test-name.patch</changelog>
</package>
<package pkgid="1501e8e9be27d2da1524fce002479571c34d754eb15d73b13b797cd3d4f7f03f" name="dovecot23-fts-lucene" arch="aarch64">
  <version epoch="0" ver="2.3.15" rel="150200.65.1"/>
  <changelog author="mrueckert@suse.de" date="1520424000">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
   instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1657195200">- VUL-0: CVE-2022-30550: dovecot22,dovecot23: Privilege escalation
  possible in dovecot when similar master and non-master passdbs are used (bsc#1201267).
  o Apply upstream patch:
    CVE-2022-30550.patch</changelog>
  <changelog author="varkoly@suse.com" date="1723723200">- Fix CVE-2024-23185: dovecot22,dovecot23: large headers can cause resource exhaustion when parsing message
  (bsc#1229183)
- Fix VUL-0: CVE-2024-23184: dovecot22,dovecot23: parsing of messages containing many address headers (From, To, Cc, Bcc, etc.) could be excessively CPU intensive
  (bsc#1229184)
  o Apply upstream patches:
    0001-lib-mail-message-header-parser-Limit-header-block-to-10MB.patch
    0001-lib-test-llist-Fix-dllist2-test-name.patch</changelog>
</package>
<package pkgid="2c3113028f99320a46324cf52636a27fb435b4bb2db417ec998346c4861a0efc" name="dovecot23-fts-lucene" arch="ppc64le">
  <version epoch="0" ver="2.3.15" rel="150200.65.1"/>
  <changelog author="mrueckert@suse.de" date="1520424000">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
   instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1657195200">- VUL-0: CVE-2022-30550: dovecot22,dovecot23: Privilege escalation
  possible in dovecot when similar master and non-master passdbs are used (bsc#1201267).
  o Apply upstream patch:
    CVE-2022-30550.patch</changelog>
  <changelog author="varkoly@suse.com" date="1723723200">- Fix CVE-2024-23185: dovecot22,dovecot23: large headers can cause resource exhaustion when parsing message
  (bsc#1229183)
- Fix VUL-0: CVE-2024-23184: dovecot22,dovecot23: parsing of messages containing many address headers (From, To, Cc, Bcc, etc.) could be excessively CPU intensive
  (bsc#1229184)
  o Apply upstream patches:
    0001-lib-mail-message-header-parser-Limit-header-block-to-10MB.patch
    0001-lib-test-llist-Fix-dllist2-test-name.patch</changelog>
</package>
<package pkgid="611f5cbfd78b070c2b6360235f9b3f42d836d1d75d8a6270e849ef92a6f56118" name="dovecot23-fts-lucene" arch="s390x">
  <version epoch="0" ver="2.3.15" rel="150200.65.1"/>
  <changelog author="mrueckert@suse.de" date="1520424000">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
   instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1657195200">- VUL-0: CVE-2022-30550: dovecot22,dovecot23: Privilege escalation
  possible in dovecot when similar master and non-master passdbs are used (bsc#1201267).
  o Apply upstream patch:
    CVE-2022-30550.patch</changelog>
  <changelog author="varkoly@suse.com" date="1723723200">- Fix CVE-2024-23185: dovecot22,dovecot23: large headers can cause resource exhaustion when parsing message
  (bsc#1229183)
- Fix VUL-0: CVE-2024-23184: dovecot22,dovecot23: parsing of messages containing many address headers (From, To, Cc, Bcc, etc.) could be excessively CPU intensive
  (bsc#1229184)
  o Apply upstream patches:
    0001-lib-mail-message-header-parser-Limit-header-block-to-10MB.patch
    0001-lib-test-llist-Fix-dllist2-test-name.patch</changelog>
</package>
<package pkgid="638586c651c6d0f87789e3907b949d76b73d45d7eb2ec3db331d8575757b5d88" name="dovecot23-fts-lucene" arch="x86_64">
  <version epoch="0" ver="2.3.15" rel="150200.65.1"/>
  <changelog author="mrueckert@suse.de" date="1520424000">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
   instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1657195200">- VUL-0: CVE-2022-30550: dovecot22,dovecot23: Privilege escalation
  possible in dovecot when similar master and non-master passdbs are used (bsc#1201267).
  o Apply upstream patch:
    CVE-2022-30550.patch</changelog>
  <changelog author="varkoly@suse.com" date="1723723200">- Fix CVE-2024-23185: dovecot22,dovecot23: large headers can cause resource exhaustion when parsing message
  (bsc#1229183)
- Fix VUL-0: CVE-2024-23184: dovecot22,dovecot23: parsing of messages containing many address headers (From, To, Cc, Bcc, etc.) could be excessively CPU intensive
  (bsc#1229184)
  o Apply upstream patches:
    0001-lib-mail-message-header-parser-Limit-header-block-to-10MB.patch
    0001-lib-test-llist-Fix-dllist2-test-name.patch</changelog>
</package>
<package pkgid="e059a575fc6e7c6d48197bcf1903368b404492ed92116efd3f859d309a3b35ba" name="dovecot23-fts-solr" arch="aarch64">
  <version epoch="0" ver="2.3.15" rel="150200.65.1"/>
  <changelog author="mrueckert@suse.de" date="1520424000">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
   instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1657195200">- VUL-0: CVE-2022-30550: dovecot22,dovecot23: Privilege escalation
  possible in dovecot when similar master and non-master passdbs are used (bsc#1201267).
  o Apply upstream patch:
    CVE-2022-30550.patch</changelog>
  <changelog author="varkoly@suse.com" date="1723723200">- Fix CVE-2024-23185: dovecot22,dovecot23: large headers can cause resource exhaustion when parsing message
  (bsc#1229183)
- Fix VUL-0: CVE-2024-23184: dovecot22,dovecot23: parsing of messages containing many address headers (From, To, Cc, Bcc, etc.) could be excessively CPU intensive
  (bsc#1229184)
  o Apply upstream patches:
    0001-lib-mail-message-header-parser-Limit-header-block-to-10MB.patch
    0001-lib-test-llist-Fix-dllist2-test-name.patch</changelog>
</package>
<package pkgid="e39cf7b355be93f109a0ec7dceca7c8a400e37c4234a15c915310b56991a5a74" name="dovecot23-fts-solr" arch="ppc64le">
  <version epoch="0" ver="2.3.15" rel="150200.65.1"/>
  <changelog author="mrueckert@suse.de" date="1520424000">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
   instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1657195200">- VUL-0: CVE-2022-30550: dovecot22,dovecot23: Privilege escalation
  possible in dovecot when similar master and non-master passdbs are used (bsc#1201267).
  o Apply upstream patch:
    CVE-2022-30550.patch</changelog>
  <changelog author="varkoly@suse.com" date="1723723200">- Fix CVE-2024-23185: dovecot22,dovecot23: large headers can cause resource exhaustion when parsing message
  (bsc#1229183)
- Fix VUL-0: CVE-2024-23184: dovecot22,dovecot23: parsing of messages containing many address headers (From, To, Cc, Bcc, etc.) could be excessively CPU intensive
  (bsc#1229184)
  o Apply upstream patches:
    0001-lib-mail-message-header-parser-Limit-header-block-to-10MB.patch
    0001-lib-test-llist-Fix-dllist2-test-name.patch</changelog>
</package>
<package pkgid="1229bc37921cbcccd3cbcb4c5c7f7b7232bdbd558132114a5669fabc70371e74" name="dovecot23-fts-solr" arch="s390x">
  <version epoch="0" ver="2.3.15" rel="150200.65.1"/>
  <changelog author="mrueckert@suse.de" date="1520424000">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
   instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1657195200">- VUL-0: CVE-2022-30550: dovecot22,dovecot23: Privilege escalation
  possible in dovecot when similar master and non-master passdbs are used (bsc#1201267).
  o Apply upstream patch:
    CVE-2022-30550.patch</changelog>
  <changelog author="varkoly@suse.com" date="1723723200">- Fix CVE-2024-23185: dovecot22,dovecot23: large headers can cause resource exhaustion when parsing message
  (bsc#1229183)
- Fix VUL-0: CVE-2024-23184: dovecot22,dovecot23: parsing of messages containing many address headers (From, To, Cc, Bcc, etc.) could be excessively CPU intensive
  (bsc#1229184)
  o Apply upstream patches:
    0001-lib-mail-message-header-parser-Limit-header-block-to-10MB.patch
    0001-lib-test-llist-Fix-dllist2-test-name.patch</changelog>
</package>
<package pkgid="19b08df4737a4375ca11b3b18b0f1b5a229aa89c1616760df979e0e86d594735" name="dovecot23-fts-solr" arch="x86_64">
  <version epoch="0" ver="2.3.15" rel="150200.65.1"/>
  <changelog author="mrueckert@suse.de" date="1520424000">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
   instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1657195200">- VUL-0: CVE-2022-30550: dovecot22,dovecot23: Privilege escalation
  possible in dovecot when similar master and non-master passdbs are used (bsc#1201267).
  o Apply upstream patch:
    CVE-2022-30550.patch</changelog>
  <changelog author="varkoly@suse.com" date="1723723200">- Fix CVE-2024-23185: dovecot22,dovecot23: large headers can cause resource exhaustion when parsing message
  (bsc#1229183)
- Fix VUL-0: CVE-2024-23184: dovecot22,dovecot23: parsing of messages containing many address headers (From, To, Cc, Bcc, etc.) could be excessively CPU intensive
  (bsc#1229184)
  o Apply upstream patches:
    0001-lib-mail-message-header-parser-Limit-header-block-to-10MB.patch
    0001-lib-test-llist-Fix-dllist2-test-name.patch</changelog>
</package>
<package pkgid="b95bade349fa8ddc364a9365ce319fe41e9dd0e5c03c385b9a4b2e86722743f0" name="dovecot23-fts-squat" arch="aarch64">
  <version epoch="0" ver="2.3.15" rel="150200.65.1"/>
  <changelog author="mrueckert@suse.de" date="1520424000">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
   instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1657195200">- VUL-0: CVE-2022-30550: dovecot22,dovecot23: Privilege escalation
  possible in dovecot when similar master and non-master passdbs are used (bsc#1201267).
  o Apply upstream patch:
    CVE-2022-30550.patch</changelog>
  <changelog author="varkoly@suse.com" date="1723723200">- Fix CVE-2024-23185: dovecot22,dovecot23: large headers can cause resource exhaustion when parsing message
  (bsc#1229183)
- Fix VUL-0: CVE-2024-23184: dovecot22,dovecot23: parsing of messages containing many address headers (From, To, Cc, Bcc, etc.) could be excessively CPU intensive
  (bsc#1229184)
  o Apply upstream patches:
    0001-lib-mail-message-header-parser-Limit-header-block-to-10MB.patch
    0001-lib-test-llist-Fix-dllist2-test-name.patch</changelog>
</package>
<package pkgid="607cb0a8e241705d8c19b66040598cce7c4fbd187d8899188dd19dd896a9a84c" name="dovecot23-fts-squat" arch="ppc64le">
  <version epoch="0" ver="2.3.15" rel="150200.65.1"/>
  <changelog author="mrueckert@suse.de" date="1520424000">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
   instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1657195200">- VUL-0: CVE-2022-30550: dovecot22,dovecot23: Privilege escalation
  possible in dovecot when similar master and non-master passdbs are used (bsc#1201267).
  o Apply upstream patch:
    CVE-2022-30550.patch</changelog>
  <changelog author="varkoly@suse.com" date="1723723200">- Fix CVE-2024-23185: dovecot22,dovecot23: large headers can cause resource exhaustion when parsing message
  (bsc#1229183)
- Fix VUL-0: CVE-2024-23184: dovecot22,dovecot23: parsing of messages containing many address headers (From, To, Cc, Bcc, etc.) could be excessively CPU intensive
  (bsc#1229184)
  o Apply upstream patches:
    0001-lib-mail-message-header-parser-Limit-header-block-to-10MB.patch
    0001-lib-test-llist-Fix-dllist2-test-name.patch</changelog>
</package>
<package pkgid="07f59a95a916e6baacc8c06d0f7c59ffe10f8bc2a4ddfd7a13f8b55c53d980d4" name="dovecot23-fts-squat" arch="s390x">
  <version epoch="0" ver="2.3.15" rel="150200.65.1"/>
  <changelog author="mrueckert@suse.de" date="1520424000">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
   instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1657195200">- VUL-0: CVE-2022-30550: dovecot22,dovecot23: Privilege escalation
  possible in dovecot when similar master and non-master passdbs are used (bsc#1201267).
  o Apply upstream patch:
    CVE-2022-30550.patch</changelog>
  <changelog author="varkoly@suse.com" date="1723723200">- Fix CVE-2024-23185: dovecot22,dovecot23: large headers can cause resource exhaustion when parsing message
  (bsc#1229183)
- Fix VUL-0: CVE-2024-23184: dovecot22,dovecot23: parsing of messages containing many address headers (From, To, Cc, Bcc, etc.) could be excessively CPU intensive
  (bsc#1229184)
  o Apply upstream patches:
    0001-lib-mail-message-header-parser-Limit-header-block-to-10MB.patch
    0001-lib-test-llist-Fix-dllist2-test-name.patch</changelog>
</package>
<package pkgid="4cc74c505d7517056c89287f5552c3b43e97f719b3313ccae669e19dbcb42d6e" name="dovecot23-fts-squat" arch="x86_64">
  <version epoch="0" ver="2.3.15" rel="150200.65.1"/>
  <changelog author="mrueckert@suse.de" date="1520424000">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
   instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1657195200">- VUL-0: CVE-2022-30550: dovecot22,dovecot23: Privilege escalation
  possible in dovecot when similar master and non-master passdbs are used (bsc#1201267).
  o Apply upstream patch:
    CVE-2022-30550.patch</changelog>
  <changelog author="varkoly@suse.com" date="1723723200">- Fix CVE-2024-23185: dovecot22,dovecot23: large headers can cause resource exhaustion when parsing message
  (bsc#1229183)
- Fix VUL-0: CVE-2024-23184: dovecot22,dovecot23: parsing of messages containing many address headers (From, To, Cc, Bcc, etc.) could be excessively CPU intensive
  (bsc#1229184)
  o Apply upstream patches:
    0001-lib-mail-message-header-parser-Limit-header-block-to-10MB.patch
    0001-lib-test-llist-Fix-dllist2-test-name.patch</changelog>
</package>
<package pkgid="c6158fdef22034504f4c609fb371685607fa0af55f4951ef05947d1dc2fd5b2f" name="dpdk" arch="aarch64">
  <version epoch="0" ver="22.11.1" rel="150600.3.3.2"/>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="c9e6d70dab6c381cc35411e77ce6ff73e0b6578780237bd16b749e9eebf38619" name="dpdk" arch="ppc64le">
  <version epoch="0" ver="22.11.1" rel="150600.3.3.2"/>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="94e75bb0ad963fe5d65eaefc498f955b781468c8d7e6b069471e2a1c5c634c57" name="dpdk" arch="src">
  <version epoch="0" ver="22.11.1" rel="150600.3.3.2"/>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="bce3776bf40784fee72d7e1bc4a63ebf96db7932992e602c7abfca76ca827f1e" name="dpdk" arch="x86_64">
  <version epoch="0" ver="22.11.1" rel="150600.3.3.2"/>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="c49e7643b6f645ee1b50bcd752063f511bc9b25d2dc55678893024f117309ba2" name="dpdk" arch="aarch64">
  <version epoch="0" ver="22.11.1" rel="150600.3.6.1"/>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1724328000">- Fix [bsc#1214724], SUSE provided DPDK modules taint the kernel as unsupported
  + Add kernel support flag for rte_kni.ko</changelog>
</package>
<package pkgid="c0af601c2455e57b44f48fe058a3693f15e42822f3bfb7a6173be6cecc61c931" name="dpdk" arch="ppc64le">
  <version epoch="0" ver="22.11.1" rel="150600.3.6.1"/>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1724328000">- Fix [bsc#1214724], SUSE provided DPDK modules taint the kernel as unsupported
  + Add kernel support flag for rte_kni.ko</changelog>
</package>
<package pkgid="0db4be4ef3f93d52adae60188edca2ee05e0b01334f6f6b1fee3c78c3d6ed9de" name="dpdk" arch="src">
  <version epoch="0" ver="22.11.1" rel="150600.3.6.1"/>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1724328000">- Fix [bsc#1214724], SUSE provided DPDK modules taint the kernel as unsupported
  + Add kernel support flag for rte_kni.ko</changelog>
</package>
<package pkgid="b89a637436dacbeddc7cbc65a3d150a64942cf46602f4be68dfb239c580d5911" name="dpdk" arch="x86_64">
  <version epoch="0" ver="22.11.1" rel="150600.3.6.1"/>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1724328000">- Fix [bsc#1214724], SUSE provided DPDK modules taint the kernel as unsupported
  + Add kernel support flag for rte_kni.ko</changelog>
</package>
<package pkgid="e9eb9c921c1f572a28e4e4386467cf92d8bd9e1af65ba0a834455db78b066d87" name="dpdk-devel" arch="aarch64">
  <version epoch="0" ver="22.11.1" rel="150600.3.3.2"/>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="d84e635891dd8db0e1af6dcc0215aa50fbaa278822841b12bbfeed0b1d793e97" name="dpdk-devel" arch="ppc64le">
  <version epoch="0" ver="22.11.1" rel="150600.3.3.2"/>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="895cd0d219c7066273d19113d02fe24205bf85c074eb758f9b0ca5666dd066a3" name="dpdk-devel" arch="x86_64">
  <version epoch="0" ver="22.11.1" rel="150600.3.3.2"/>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="c086c6783383dc98e5d3b777a03cc564244fa69fdf18b0fd8884f4803e9cab76" name="dpdk-devel" arch="aarch64">
  <version epoch="0" ver="22.11.1" rel="150600.3.6.1"/>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1724328000">- Fix [bsc#1214724], SUSE provided DPDK modules taint the kernel as unsupported
  + Add kernel support flag for rte_kni.ko</changelog>
</package>
<package pkgid="e0c172d55bc00d02988d0155a64dfb9625249e88ba97b801a9dade528a5fd602" name="dpdk-devel" arch="ppc64le">
  <version epoch="0" ver="22.11.1" rel="150600.3.6.1"/>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1724328000">- Fix [bsc#1214724], SUSE provided DPDK modules taint the kernel as unsupported
  + Add kernel support flag for rte_kni.ko</changelog>
</package>
<package pkgid="5aae9ac9e72b5b5f5531f4f79c0b767d6fadde370386bd213ae924373b59cbd7" name="dpdk-devel" arch="x86_64">
  <version epoch="0" ver="22.11.1" rel="150600.3.6.1"/>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1724328000">- Fix [bsc#1214724], SUSE provided DPDK modules taint the kernel as unsupported
  + Add kernel support flag for rte_kni.ko</changelog>
</package>
<package pkgid="8905f34fd315b5744958a281e6d9c1e9a651cb8268b4bc2c18a7e139cf0e4766" name="dpdk-devel-static" arch="aarch64">
  <version epoch="0" ver="22.11.1" rel="150600.3.3.2"/>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="a08eed19715e9f7070c842031738453c2b27589f059a21f9ca5ba5189eb2182f" name="dpdk-devel-static" arch="ppc64le">
  <version epoch="0" ver="22.11.1" rel="150600.3.3.2"/>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="1bae6c5f8bae124b1f5261e672bef311945a1b4ddf9fae920dd5ca21d3e9ca4f" name="dpdk-devel-static" arch="x86_64">
  <version epoch="0" ver="22.11.1" rel="150600.3.3.2"/>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="9950cdc39ab25e8e84eab97f89d3f6b3d353384f058317660d76ae158da20ab2" name="dpdk-devel-static" arch="aarch64">
  <version epoch="0" ver="22.11.1" rel="150600.3.6.1"/>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1724328000">- Fix [bsc#1214724], SUSE provided DPDK modules taint the kernel as unsupported
  + Add kernel support flag for rte_kni.ko</changelog>
</package>
<package pkgid="c175051ad8d0eaf7886b9d7cf5368352fe82f708a6995d9a1d2b9b6535cf8c98" name="dpdk-devel-static" arch="ppc64le">
  <version epoch="0" ver="22.11.1" rel="150600.3.6.1"/>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1724328000">- Fix [bsc#1214724], SUSE provided DPDK modules taint the kernel as unsupported
  + Add kernel support flag for rte_kni.ko</changelog>
</package>
<package pkgid="257afecfc57ccece819f7bb7828ba225a6573cd771c4857947aea55d15c8101c" name="dpdk-devel-static" arch="x86_64">
  <version epoch="0" ver="22.11.1" rel="150600.3.6.1"/>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1724328000">- Fix [bsc#1214724], SUSE provided DPDK modules taint the kernel as unsupported
  + Add kernel support flag for rte_kni.ko</changelog>
</package>
<package pkgid="713d28e1e0e240cea127e21cb7cd4103851c5acd53b05bf03c01271ae9006c4c" name="dpdk-doc" arch="noarch">
  <version epoch="0" ver="22.11.1" rel="150600.3.3.2"/>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="f7349aa7d071ef182228c19a022c357ea99e8350cdd8f61aa2085db918e9dbee" name="dpdk-doc" arch="noarch">
  <version epoch="0" ver="22.11.1" rel="150600.3.6.1"/>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1724328000">- Fix [bsc#1214724], SUSE provided DPDK modules taint the kernel as unsupported
  + Add kernel support flag for rte_kni.ko</changelog>
</package>
<package pkgid="3ed969c01a2855e63d40683133ef355357f7dd3955d32bcf21a6fdfb2d440a1e" name="dpdk-examples" arch="aarch64">
  <version epoch="0" ver="22.11.1" rel="150600.3.3.2"/>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="dc1dede770475dcf881d0062333db2f3e8b6fba81b9caf9ce1d9ff2097c3748d" name="dpdk-examples" arch="ppc64le">
  <version epoch="0" ver="22.11.1" rel="150600.3.3.2"/>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="54c3409e15eaef5aef63402b0645b1119507768f5ae7f9ab0a9216700b1b65ce" name="dpdk-examples" arch="x86_64">
  <version epoch="0" ver="22.11.1" rel="150600.3.3.2"/>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="2e6c3a2eed917acbd937c33b26ce97614aad7a7b7b623ef0a44f559720ce87aa" name="dpdk-examples" arch="aarch64">
  <version epoch="0" ver="22.11.1" rel="150600.3.6.1"/>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1724328000">- Fix [bsc#1214724], SUSE provided DPDK modules taint the kernel as unsupported
  + Add kernel support flag for rte_kni.ko</changelog>
</package>
<package pkgid="1b9c6c945ee7e28c17430f6cd89dc4bed39457ef626b1ea7a3d3d86c63f12bbb" name="dpdk-examples" arch="ppc64le">
  <version epoch="0" ver="22.11.1" rel="150600.3.6.1"/>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1724328000">- Fix [bsc#1214724], SUSE provided DPDK modules taint the kernel as unsupported
  + Add kernel support flag for rte_kni.ko</changelog>
</package>
<package pkgid="ba84c5f7520d761f75edf8b62aa7f870b9625c31e9bf9d2567ef74866b8b1ec4" name="dpdk-examples" arch="x86_64">
  <version epoch="0" ver="22.11.1" rel="150600.3.6.1"/>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1724328000">- Fix [bsc#1214724], SUSE provided DPDK modules taint the kernel as unsupported
  + Add kernel support flag for rte_kni.ko</changelog>
</package>
<package pkgid="9bb7abc9cb08edb705df5554426ba3dc12324ae88bfb0fe055ccbc34a77047c8" name="dpdk-kmp-default" arch="aarch64">
  <version epoch="0" ver="22.11.1_k6.4.0_150600.23.17" rel="150600.3.6.1"/>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1724328000">- Fix [bsc#1214724], SUSE provided DPDK modules taint the kernel as unsupported
  + Add kernel support flag for rte_kni.ko</changelog>
</package>
<package pkgid="b0080f26af85aa2c1d3d3a5702f53b7e7b429a1efb0afb8333b7c69730566497" name="dpdk-kmp-default" arch="ppc64le">
  <version epoch="0" ver="22.11.1_k6.4.0_150600.23.17" rel="150600.3.6.1"/>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1724328000">- Fix [bsc#1214724], SUSE provided DPDK modules taint the kernel as unsupported
  + Add kernel support flag for rte_kni.ko</changelog>
</package>
<package pkgid="54797389cb63ee31add960383975b2151c849eb7a72a9763d295c4bcd3990960" name="dpdk-kmp-default" arch="x86_64">
  <version epoch="0" ver="22.11.1_k6.4.0_150600.23.17" rel="150600.3.6.1"/>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1724328000">- Fix [bsc#1214724], SUSE provided DPDK modules taint the kernel as unsupported
  + Add kernel support flag for rte_kni.ko</changelog>
</package>
<package pkgid="49d59b88304da60b1b4d9e5ff506bfe1848077d2ba159baae08bcc5ee6df4aa9" name="dpdk-kmp-default" arch="aarch64">
  <version epoch="0" ver="22.11.1_k6.4.0_150600.23.7" rel="150600.3.3.2"/>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="2235d1f5a85bdb154fe495ce05abadb9f8d84d8857e10c7321181ce994fd13d2" name="dpdk-kmp-default" arch="ppc64le">
  <version epoch="0" ver="22.11.1_k6.4.0_150600.23.7" rel="150600.3.3.2"/>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="5b1c07c52ffa425bb27e4b76f3e60bc1c5fcde5ae6a819ed965e049ba2c97fd8" name="dpdk-kmp-default" arch="x86_64">
  <version epoch="0" ver="22.11.1_k6.4.0_150600.23.7" rel="150600.3.3.2"/>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="ef0a4615f5bd19e9085662de3c64c1f0de20857cd794ec1bf15a42a648d8a791" name="dpdk-thunderx" arch="aarch64">
  <version epoch="0" ver="22.11.1" rel="150600.3.3.2"/>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="aec18c90b886ab4f0962c2e45a98c748002b04cbb568a3275be97d2fa2bd0929" name="dpdk-thunderx" arch="src">
  <version epoch="0" ver="22.11.1" rel="150600.3.3.2"/>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="8eda7e57e78a41d0b6c7732f2ddb76a32482a69bc8b89aeaeca9d181a958210c" name="dpdk-thunderx" arch="aarch64">
  <version epoch="0" ver="22.11.1" rel="150600.3.6.1"/>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1724328000">- Fix [bsc#1214724], SUSE provided DPDK modules taint the kernel as unsupported
  + Add kernel support flag for rte_kni.ko</changelog>
</package>
<package pkgid="89939d6d99a3d465401538d7db8a0533f136fac35feed320b9403bb394569e23" name="dpdk-thunderx" arch="src">
  <version epoch="0" ver="22.11.1" rel="150600.3.6.1"/>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1724328000">- Fix [bsc#1214724], SUSE provided DPDK modules taint the kernel as unsupported
  + Add kernel support flag for rte_kni.ko</changelog>
</package>
<package pkgid="a79582a889b204a367584a0b853103e3c68ed59746acbc213a24c54520b808e7" name="dpdk-thunderx-devel" arch="aarch64">
  <version epoch="0" ver="22.11.1" rel="150600.3.3.2"/>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="ac7c93b0d17d988c742508ff70ceafd261ecbb0d974b8a48b0533d0e77d45203" name="dpdk-thunderx-devel" arch="aarch64">
  <version epoch="0" ver="22.11.1" rel="150600.3.6.1"/>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1724328000">- Fix [bsc#1214724], SUSE provided DPDK modules taint the kernel as unsupported
  + Add kernel support flag for rte_kni.ko</changelog>
</package>
<package pkgid="ddce2f2b097bfad7388b8b7060e33d9fb846cc7307e391587a8509ae37e6425e" name="dpdk-thunderx-devel-static" arch="aarch64">
  <version epoch="0" ver="22.11.1" rel="150600.3.3.2"/>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="0f4925b30d6752b23465e182b21d6d2803b957b8224bc42cfaecf5b18131ae3e" name="dpdk-thunderx-devel-static" arch="aarch64">
  <version epoch="0" ver="22.11.1" rel="150600.3.6.1"/>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1724328000">- Fix [bsc#1214724], SUSE provided DPDK modules taint the kernel as unsupported
  + Add kernel support flag for rte_kni.ko</changelog>
</package>
<package pkgid="a092e6120937349d6d77cfc68e914003be00d96217b5ac51b7aab207511ecbfc" name="dpdk-thunderx-doc" arch="noarch">
  <version epoch="0" ver="22.11.1" rel="150600.3.3.2"/>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="a52c4627de5c027ae574cfbb6eb8e734139cb91d356dc0da08bb27a619f1b757" name="dpdk-thunderx-doc" arch="noarch">
  <version epoch="0" ver="22.11.1" rel="150600.3.6.1"/>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1724328000">- Fix [bsc#1214724], SUSE provided DPDK modules taint the kernel as unsupported
  + Add kernel support flag for rte_kni.ko</changelog>
</package>
<package pkgid="26018ac14f1b20b8c01536dc875694a4516073f5a539276fabff630859c04365" name="dpdk-thunderx-examples" arch="aarch64">
  <version epoch="0" ver="22.11.1" rel="150600.3.3.2"/>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="4ce054f84ead084cf9ebd029ea80a557ddced8c361bd4999688a9800124ff627" name="dpdk-thunderx-examples" arch="aarch64">
  <version epoch="0" ver="22.11.1" rel="150600.3.6.1"/>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1724328000">- Fix [bsc#1214724], SUSE provided DPDK modules taint the kernel as unsupported
  + Add kernel support flag for rte_kni.ko</changelog>
</package>
<package pkgid="292b0080bdbd36e2963fe2ec791e788cdb56c828681fa968beca1c11ee8f7a14" name="dpdk-thunderx-kmp-default" arch="aarch64">
  <version epoch="0" ver="22.11.1_k6.4.0_150600.23.17" rel="150600.3.6.1"/>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1724328000">- Fix [bsc#1214724], SUSE provided DPDK modules taint the kernel as unsupported
  + Add kernel support flag for rte_kni.ko</changelog>
</package>
<package pkgid="6163dd750ca0904b8e9361006316a707f06dcd7d1ce0baee3cdfdbb40e01bac6" name="dpdk-thunderx-kmp-default" arch="aarch64">
  <version epoch="0" ver="22.11.1_k6.4.0_150600.23.7" rel="150600.3.3.2"/>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="e7f799d8074f2534e0719f8c7054df0f25b732ba466fdb6944b8099d3c1f3d16" name="dpdk-thunderx-tools" arch="aarch64">
  <version epoch="0" ver="22.11.1" rel="150600.3.3.2"/>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="b323a6348d62043eb403c99d738f19e64e7593071ac2741b409359c9cc4ca619" name="dpdk-thunderx-tools" arch="aarch64">
  <version epoch="0" ver="22.11.1" rel="150600.3.6.1"/>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1724328000">- Fix [bsc#1214724], SUSE provided DPDK modules taint the kernel as unsupported
  + Add kernel support flag for rte_kni.ko</changelog>
</package>
<package pkgid="351bf33da5cad1de533731af53870f685706cbb8bf58372539aed20c2ad74a09" name="dpdk-tools" arch="aarch64">
  <version epoch="0" ver="22.11.1" rel="150600.3.3.2"/>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="37b403e0a159619c98a944e0589c419f5d08d5c6f14fd368267d7e527d2d85bb" name="dpdk-tools" arch="ppc64le">
  <version epoch="0" ver="22.11.1" rel="150600.3.3.2"/>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="b71d8c9be75eb05d6b218128e08d68670496dee6fe9d7334ccc97abc3af86e13" name="dpdk-tools" arch="x86_64">
  <version epoch="0" ver="22.11.1" rel="150600.3.3.2"/>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="9bfab501e736dfdd215cbe4436decedf85e6a1e9ce10119a07d36bf7f30f3b66" name="dpdk-tools" arch="aarch64">
  <version epoch="0" ver="22.11.1" rel="150600.3.6.1"/>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1724328000">- Fix [bsc#1214724], SUSE provided DPDK modules taint the kernel as unsupported
  + Add kernel support flag for rte_kni.ko</changelog>
</package>
<package pkgid="794d7d86d5b13a8c614eda909f4c0f5ddd2943b231a92e50448a69404452ec0d" name="dpdk-tools" arch="ppc64le">
  <version epoch="0" ver="22.11.1" rel="150600.3.6.1"/>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1724328000">- Fix [bsc#1214724], SUSE provided DPDK modules taint the kernel as unsupported
  + Add kernel support flag for rte_kni.ko</changelog>
</package>
<package pkgid="3a829da1cf7872bec8b10d49da1b70f9bfd521c17bf448dc1f23ba3f03face7d" name="dpdk-tools" arch="x86_64">
  <version epoch="0" ver="22.11.1" rel="150600.3.6.1"/>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1630584000">- Add BuildRequires kernel-syms and modutils for proper
  dependencies to be inserted in the resulting binary RPM, as
  pointed by rpmlint</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1635163200">- - Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch
- rename
  dpdk-fallthrough-comment-fixes.patch
  to
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1645876800">- Update to LTS version 21.11.
  21.11 should be supported for at least two years, the new major
  ABI version is 22. New Features:
  * General
  * hugetlbfs subdirectories
  * AddressSanitizer (ASan) integration for debug
  * mempool flag for non-IO usages
  * device class for DMA accelerators and drivers for
  * HiSilicon, Intel DSA, Intel IOAT, Marvell CNXK and NXP DPAA
  * device class for GPU devices and driver for NVIDIA CUDA
  * Toeplitz hash using Galois Fields New Instructions (GFNI)
  * Networking
  * MTU handling rework
  * get all MAC addresses of a port
  * RSS based on L3/L4 checksum fields
  * flow match on L2TPv2 and PPP
  * flow flex parser for custom header
  * control delivery of HW Rx metadata
  * transfer flows API rework
  * shared Rx queue
  * driver for NXP ENETFEC
  * vDPA driver for Xilinx devices
  * virtio RSS
  * vhost power monitor wakeup
  * testpmd multi-process
  * pcapng library and dumpcap tool
  * API/ABI
  * API namespace improvements and cleanups
  * API internals hidden
  * flags check for future ABI compatibility
  * More details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_21_11.html
- Update to LTS version 20.11.0, new features:
  * General
  * mbuf dynamic area increased from 16 to 36 bytes
  * ring zero cop
  * SIMD bitwidth limit API
  * moved igb_uio to dpdk-kmods/linux
  * removed Python 2 support
  * removed Make support, meson + pkg-config files are
    now used to build applications
  * Networking
  * FEC AP
  * Rx buffer split
  * thread safety in flow API
  * shared action in flow API
  * flow sampling and mirroring
  * tunnel offload API
  * multi-port hairpin
  * Solarflare EF100 architecture
  * Wangxun txgbe driver
  * vhost-vDPA backend in virtio-user
  * removed vhost dequeue zero-copy
  * removed legacy ethdev filtering
  * SWX pipeline aligned with P4
  * Baseband
  * Intel ACC100 driver
  * Cryptography
  * raw datapath API
  * Broadcom BCMFS symmetric crypto driver
  * RegEx
  * Marvell OCTEON TX2 regex driver
  * Others
  * Intel DLB/DLB2 drivers
  * Intel DSA support in IOAT driver
  * Full changes and more details in the release notes:
    https://doc.dpdk.org/guides/rel_notes/release_20_11.html
- Rebased 0002-SLE15-SP3-compatibility-patch-for-kni.patch
- Drop outdated 0001-fix-cpu-compatibility.patch
- Drop outdated 0003-dpdk-fallthrough-comment-fixes.patch
- Added 0001-build-try-to-get-kernel-version-from-kernel-source.patch
  Allow host system to have a different kernel than the target
  system, fixes kernel module installation path for such case.
  Submitted upstream 2022-02-26
- Added fix-buildsystem-python36.patch for Leap as the buildsystem
  uses python syntax introduced with python37, but Leap still
  sticks with 3.6, so this backports it for the old python version.</changelog>
  <changelog author="rpm@fthiessen.de" date="1651060800">- Update to version 21.11.1
  * acl: add missing C++ guards
  * app/compress-perf: Various bug fixes
  * app/dumpcap: check for failure to set promiscuous
  * app/fib: fix division by zero
  * app/pdump: abort on multi-core capture limit
  * app/regex: fix number of matches
  * app/testpmd: Various bug fixes
  * baseband/acc100: avoid out-of-bounds access
  * bpf: add missing C++ guards
  * bus/pci: assign driver pointer before mapping
  * common/cnxk: Various bug fixes
  * common/mlx5: Various bug fixes
  * common/sfc_efx/base: fix recirculation ID set in outer rules
  * compressdev: fix missing space in log macro
  * eal/linux:
  * fix device monitor stop return
  * fix illegal memory access in uevent handler
  * log hugepage create errors with filename
  * Full change log can be found online:
    http://doc.dpdk.org/guides-21.11/rel_notes/release_21_11.html#fixes
- Rebased 0001-build-try-to-get-kernel-version-from-kernel-source.patch
- Dropped upstream fixed fix-buildsystem-python36.patch
- fixes CVE-2022-0669 [bsc#1198964], CVE-2021-3839 [bsc#1198963</changelog>
  <changelog author="jslaby@suse.cz" date="1653480000">- add kni-fix-build-with-Linux-5.18.patch to fix build with kernel
  5.18</changelog>
  <changelog author="dmueller@suse.com" date="1655812800">- also strip meson generated runpaths when installing examples
  manually (bsc#1200620)</changelog>
  <changelog author="bwiedemann@suse.com" date="1677067200">- Cleanup Sphinx build leftovers for reproducible builds</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1680696000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
    http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
  0001-build-try-to-get-kernel-version-from-kernel-source.patch
  kni-fix-build-with-Linux-5.18.patch
  * Added Patches:
    0001-fix-cpu-compatibility.patch
  * Rebased patches:
    0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1682510400">- add 0001-kni-fix-build-with-Linux-6.3.patch to fix build against
  kernel 6.3.</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="jslaby@suse.cz" date="1694433600">- add 0001-kni-fix-build-with-Linux-6.5.patch to fix build against
  kernel 6.5.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1707220800">- Update legacy DPDK package to newer DPDK v22.11 [jsc#PED-6170]
- Build dpdk with python in the system [bsc#1218856]
- Fix dpdk build on SLES-15-SP6 kernel [bsc#1214818]
- Fix dpdk build on SLES-15-SP5 kernel [bsc#1203845]
- Fixed issues in upstream, [bsc#1195172] [bsc#1198873] [bsc#1202903] [bsc#1202956]
- Added patches,
    + 0001-kni-fix-build-with-Linux-6.3.patch
    + 0001-kni-fix-build-with-Linux-6.5.patch
- Removed the patches as fixed in upstream,
  - 0001-kni-allow-configuring-thread-granularity.patch
  - 0001-usertools-read-PCI-device-name-as-UTF-8.patch
  - 0004-kni-update-kernel-API-to-set-random-MAC-address.patch
  - 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  - 0006-kni-use-dedicated-function-to-set-MAC-address.patch
  - 0007-igb-uio-remove_wrapper_api.patch: Removed igb_uio driver in Upstream
  - 0003-dpdk-fallthrough-comment-fixes.patch: Removed igb_uio driver in Upstream
  - 0008-SLE15-SP6-compatibility-patch-for-kni.patch: Fixed in 0001-kni-fix-build-with-Linux-6.5.patch
  - dpdk-CVE-2021-3839.patch
  - dpdk-CVE-2022-0669.patch
  - dpdk-CVE-2022-2132.patch
  - dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1720612800">- Fix [bsc#1219990][PED-8465] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1724328000">- Fix [bsc#1214724], SUSE provided DPDK modules taint the kernel as unsupported
  + Add kernel support flag for rte_kni.ko</changelog>
</package>
<package pkgid="0d4b8ded7c092e5cdac91fed578031ab9145a70711da8a1a57a6a9289fabdbf2" name="dpdk22" arch="aarch64">
  <version epoch="0" ver="22.11.1" rel="150500.5.5.3"/>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="sweiberg@suse.com" date="1631275200">- Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651147200">- security update
- added patches
  fix CVE-2021-3839 [bsc#1198963], dpdk: OOB write irelated to vhost communication n vhost_user_set_inflight_fd()
  + dpdk-CVE-2021-3839.patch
  fix CVE-2022-0669 [bsc#1198964], dpdk: DoS by exhausting available fd in vhost-user slave process
  + dpdk-CVE-2022-0669.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1658145600">- aabdallah@suse.com:
  Fix for SG#63176, bsc#1198873: Read PCI device name as UTF strings.
- tabraham@suse.com:
  kni: allow configuring thread granularity (bsc#1195172)
- added patches
  + 0001-kni-allow-configuring-thread-granularity.patch
  + 0001-usertools-read-PCI-device-name-as-UTF-8.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1664366400">- added patch to fix build issue with 15 SP5 kernel (bsc#1203845)
  + 0004-kni-update-kernel-API-to-set-random-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664452800">- fix build with SLE15-SP5 kernel [bsc#1203845]
- added patches
  + 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  + 0006-kni-use-dedicated-function-to-set-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1668772800">- security update
- added patches
  fix CVE-2022-2132 [bsc#1202903], DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs
  + dpdk-CVE-2022-2132.patch
  fix CVE-2022-28199 [bsc#1202956], buffer overflow in the vhost code
  + dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1677240000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
  http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
    0001-kni-allow-configuring-thread-granularity.patch
    0001-usertools-read-PCI-device-name-as-UTF-8.patch
    0003-dpdk-fallthrough-comment-fixes.patch
    0004-kni-update-kernel-API-to-set-random-MAC-address.patch
    0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
    0006-kni-use-dedicated-function-to-set-MAC-address.patch
    dpdk-CVE-2021-3839.patch
    dpdk-CVE-2022-0669.patch
    dpdk-CVE-2022-2132.patch
    dpdk-CVE-2022-28199.patch
  * Rebased patches:
    0001-fix-cpu-compatibility.patch
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678276800">- Updated package name:dpdk22 for DPDK version 22.11.1 as legacy DPDK version(v19.11.10) also needs to be supported.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678449600">- Remove redundant obsoletes and unnecessary provides
- Remove obsoleting old dpdk package changes and let user decide.
- Add conflict for the KMP module in preamble</changelog>
  <changelog author="gyribeiro@suse.com" date="1681128000">- Rename name_tag to package_name_tag to avoid conflict with name_tag
  used multibuild</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1716379200">- Fix [bsc#1219990] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="8acd9c6c1841ecf24cbf898bf282c6cc6bb915a97d092f8591807610fee2ab34" name="dpdk22" arch="ppc64le">
  <version epoch="0" ver="22.11.1" rel="150500.5.5.3"/>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="sweiberg@suse.com" date="1631275200">- Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651147200">- security update
- added patches
  fix CVE-2021-3839 [bsc#1198963], dpdk: OOB write irelated to vhost communication n vhost_user_set_inflight_fd()
  + dpdk-CVE-2021-3839.patch
  fix CVE-2022-0669 [bsc#1198964], dpdk: DoS by exhausting available fd in vhost-user slave process
  + dpdk-CVE-2022-0669.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1658145600">- aabdallah@suse.com:
  Fix for SG#63176, bsc#1198873: Read PCI device name as UTF strings.
- tabraham@suse.com:
  kni: allow configuring thread granularity (bsc#1195172)
- added patches
  + 0001-kni-allow-configuring-thread-granularity.patch
  + 0001-usertools-read-PCI-device-name-as-UTF-8.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1664366400">- added patch to fix build issue with 15 SP5 kernel (bsc#1203845)
  + 0004-kni-update-kernel-API-to-set-random-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664452800">- fix build with SLE15-SP5 kernel [bsc#1203845]
- added patches
  + 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  + 0006-kni-use-dedicated-function-to-set-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1668772800">- security update
- added patches
  fix CVE-2022-2132 [bsc#1202903], DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs
  + dpdk-CVE-2022-2132.patch
  fix CVE-2022-28199 [bsc#1202956], buffer overflow in the vhost code
  + dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1677240000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
  http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
    0001-kni-allow-configuring-thread-granularity.patch
    0001-usertools-read-PCI-device-name-as-UTF-8.patch
    0003-dpdk-fallthrough-comment-fixes.patch
    0004-kni-update-kernel-API-to-set-random-MAC-address.patch
    0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
    0006-kni-use-dedicated-function-to-set-MAC-address.patch
    dpdk-CVE-2021-3839.patch
    dpdk-CVE-2022-0669.patch
    dpdk-CVE-2022-2132.patch
    dpdk-CVE-2022-28199.patch
  * Rebased patches:
    0001-fix-cpu-compatibility.patch
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678276800">- Updated package name:dpdk22 for DPDK version 22.11.1 as legacy DPDK version(v19.11.10) also needs to be supported.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678449600">- Remove redundant obsoletes and unnecessary provides
- Remove obsoleting old dpdk package changes and let user decide.
- Add conflict for the KMP module in preamble</changelog>
  <changelog author="gyribeiro@suse.com" date="1681128000">- Rename name_tag to package_name_tag to avoid conflict with name_tag
  used multibuild</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1716379200">- Fix [bsc#1219990] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="4b0693353773d33f619b1d617b2b32569d33ba15c877df9da4040800b1b68cd1" name="dpdk22" arch="src">
  <version epoch="0" ver="22.11.1" rel="150500.5.5.3"/>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="sweiberg@suse.com" date="1631275200">- Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651147200">- security update
- added patches
  fix CVE-2021-3839 [bsc#1198963], dpdk: OOB write irelated to vhost communication n vhost_user_set_inflight_fd()
  + dpdk-CVE-2021-3839.patch
  fix CVE-2022-0669 [bsc#1198964], dpdk: DoS by exhausting available fd in vhost-user slave process
  + dpdk-CVE-2022-0669.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1658145600">- aabdallah@suse.com:
  Fix for SG#63176, bsc#1198873: Read PCI device name as UTF strings.
- tabraham@suse.com:
  kni: allow configuring thread granularity (bsc#1195172)
- added patches
  + 0001-kni-allow-configuring-thread-granularity.patch
  + 0001-usertools-read-PCI-device-name-as-UTF-8.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1664366400">- added patch to fix build issue with 15 SP5 kernel (bsc#1203845)
  + 0004-kni-update-kernel-API-to-set-random-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664452800">- fix build with SLE15-SP5 kernel [bsc#1203845]
- added patches
  + 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  + 0006-kni-use-dedicated-function-to-set-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1668772800">- security update
- added patches
  fix CVE-2022-2132 [bsc#1202903], DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs
  + dpdk-CVE-2022-2132.patch
  fix CVE-2022-28199 [bsc#1202956], buffer overflow in the vhost code
  + dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1677240000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
  http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
    0001-kni-allow-configuring-thread-granularity.patch
    0001-usertools-read-PCI-device-name-as-UTF-8.patch
    0003-dpdk-fallthrough-comment-fixes.patch
    0004-kni-update-kernel-API-to-set-random-MAC-address.patch
    0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
    0006-kni-use-dedicated-function-to-set-MAC-address.patch
    dpdk-CVE-2021-3839.patch
    dpdk-CVE-2022-0669.patch
    dpdk-CVE-2022-2132.patch
    dpdk-CVE-2022-28199.patch
  * Rebased patches:
    0001-fix-cpu-compatibility.patch
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678276800">- Updated package name:dpdk22 for DPDK version 22.11.1 as legacy DPDK version(v19.11.10) also needs to be supported.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678449600">- Remove redundant obsoletes and unnecessary provides
- Remove obsoleting old dpdk package changes and let user decide.
- Add conflict for the KMP module in preamble</changelog>
  <changelog author="gyribeiro@suse.com" date="1681128000">- Rename name_tag to package_name_tag to avoid conflict with name_tag
  used multibuild</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1716379200">- Fix [bsc#1219990] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="492c129074a913714809acff906cf4d427c20469b542fbad233546e24f509e7e" name="dpdk22" arch="x86_64">
  <version epoch="0" ver="22.11.1" rel="150500.5.5.3"/>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="sweiberg@suse.com" date="1631275200">- Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651147200">- security update
- added patches
  fix CVE-2021-3839 [bsc#1198963], dpdk: OOB write irelated to vhost communication n vhost_user_set_inflight_fd()
  + dpdk-CVE-2021-3839.patch
  fix CVE-2022-0669 [bsc#1198964], dpdk: DoS by exhausting available fd in vhost-user slave process
  + dpdk-CVE-2022-0669.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1658145600">- aabdallah@suse.com:
  Fix for SG#63176, bsc#1198873: Read PCI device name as UTF strings.
- tabraham@suse.com:
  kni: allow configuring thread granularity (bsc#1195172)
- added patches
  + 0001-kni-allow-configuring-thread-granularity.patch
  + 0001-usertools-read-PCI-device-name-as-UTF-8.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1664366400">- added patch to fix build issue with 15 SP5 kernel (bsc#1203845)
  + 0004-kni-update-kernel-API-to-set-random-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664452800">- fix build with SLE15-SP5 kernel [bsc#1203845]
- added patches
  + 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  + 0006-kni-use-dedicated-function-to-set-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1668772800">- security update
- added patches
  fix CVE-2022-2132 [bsc#1202903], DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs
  + dpdk-CVE-2022-2132.patch
  fix CVE-2022-28199 [bsc#1202956], buffer overflow in the vhost code
  + dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1677240000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
  http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
    0001-kni-allow-configuring-thread-granularity.patch
    0001-usertools-read-PCI-device-name-as-UTF-8.patch
    0003-dpdk-fallthrough-comment-fixes.patch
    0004-kni-update-kernel-API-to-set-random-MAC-address.patch
    0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
    0006-kni-use-dedicated-function-to-set-MAC-address.patch
    dpdk-CVE-2021-3839.patch
    dpdk-CVE-2022-0669.patch
    dpdk-CVE-2022-2132.patch
    dpdk-CVE-2022-28199.patch
  * Rebased patches:
    0001-fix-cpu-compatibility.patch
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678276800">- Updated package name:dpdk22 for DPDK version 22.11.1 as legacy DPDK version(v19.11.10) also needs to be supported.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678449600">- Remove redundant obsoletes and unnecessary provides
- Remove obsoleting old dpdk package changes and let user decide.
- Add conflict for the KMP module in preamble</changelog>
  <changelog author="gyribeiro@suse.com" date="1681128000">- Rename name_tag to package_name_tag to avoid conflict with name_tag
  used multibuild</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1716379200">- Fix [bsc#1219990] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="d384137158c37546efacca06b3d66441dd28bb26c76ce1bda53fc1028846f713" name="dpdk22-devel" arch="aarch64">
  <version epoch="0" ver="22.11.1" rel="150500.5.5.3"/>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="sweiberg@suse.com" date="1631275200">- Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651147200">- security update
- added patches
  fix CVE-2021-3839 [bsc#1198963], dpdk: OOB write irelated to vhost communication n vhost_user_set_inflight_fd()
  + dpdk-CVE-2021-3839.patch
  fix CVE-2022-0669 [bsc#1198964], dpdk: DoS by exhausting available fd in vhost-user slave process
  + dpdk-CVE-2022-0669.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1658145600">- aabdallah@suse.com:
  Fix for SG#63176, bsc#1198873: Read PCI device name as UTF strings.
- tabraham@suse.com:
  kni: allow configuring thread granularity (bsc#1195172)
- added patches
  + 0001-kni-allow-configuring-thread-granularity.patch
  + 0001-usertools-read-PCI-device-name-as-UTF-8.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1664366400">- added patch to fix build issue with 15 SP5 kernel (bsc#1203845)
  + 0004-kni-update-kernel-API-to-set-random-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664452800">- fix build with SLE15-SP5 kernel [bsc#1203845]
- added patches
  + 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  + 0006-kni-use-dedicated-function-to-set-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1668772800">- security update
- added patches
  fix CVE-2022-2132 [bsc#1202903], DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs
  + dpdk-CVE-2022-2132.patch
  fix CVE-2022-28199 [bsc#1202956], buffer overflow in the vhost code
  + dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1677240000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
  http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
    0001-kni-allow-configuring-thread-granularity.patch
    0001-usertools-read-PCI-device-name-as-UTF-8.patch
    0003-dpdk-fallthrough-comment-fixes.patch
    0004-kni-update-kernel-API-to-set-random-MAC-address.patch
    0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
    0006-kni-use-dedicated-function-to-set-MAC-address.patch
    dpdk-CVE-2021-3839.patch
    dpdk-CVE-2022-0669.patch
    dpdk-CVE-2022-2132.patch
    dpdk-CVE-2022-28199.patch
  * Rebased patches:
    0001-fix-cpu-compatibility.patch
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678276800">- Updated package name:dpdk22 for DPDK version 22.11.1 as legacy DPDK version(v19.11.10) also needs to be supported.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678449600">- Remove redundant obsoletes and unnecessary provides
- Remove obsoleting old dpdk package changes and let user decide.
- Add conflict for the KMP module in preamble</changelog>
  <changelog author="gyribeiro@suse.com" date="1681128000">- Rename name_tag to package_name_tag to avoid conflict with name_tag
  used multibuild</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1716379200">- Fix [bsc#1219990] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="55709be4059d5b4982c465fbcb600b374a909a10a721b811f4e37a8b8df9e448" name="dpdk22-devel" arch="ppc64le">
  <version epoch="0" ver="22.11.1" rel="150500.5.5.3"/>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="sweiberg@suse.com" date="1631275200">- Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651147200">- security update
- added patches
  fix CVE-2021-3839 [bsc#1198963], dpdk: OOB write irelated to vhost communication n vhost_user_set_inflight_fd()
  + dpdk-CVE-2021-3839.patch
  fix CVE-2022-0669 [bsc#1198964], dpdk: DoS by exhausting available fd in vhost-user slave process
  + dpdk-CVE-2022-0669.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1658145600">- aabdallah@suse.com:
  Fix for SG#63176, bsc#1198873: Read PCI device name as UTF strings.
- tabraham@suse.com:
  kni: allow configuring thread granularity (bsc#1195172)
- added patches
  + 0001-kni-allow-configuring-thread-granularity.patch
  + 0001-usertools-read-PCI-device-name-as-UTF-8.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1664366400">- added patch to fix build issue with 15 SP5 kernel (bsc#1203845)
  + 0004-kni-update-kernel-API-to-set-random-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664452800">- fix build with SLE15-SP5 kernel [bsc#1203845]
- added patches
  + 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  + 0006-kni-use-dedicated-function-to-set-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1668772800">- security update
- added patches
  fix CVE-2022-2132 [bsc#1202903], DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs
  + dpdk-CVE-2022-2132.patch
  fix CVE-2022-28199 [bsc#1202956], buffer overflow in the vhost code
  + dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1677240000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
  http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
    0001-kni-allow-configuring-thread-granularity.patch
    0001-usertools-read-PCI-device-name-as-UTF-8.patch
    0003-dpdk-fallthrough-comment-fixes.patch
    0004-kni-update-kernel-API-to-set-random-MAC-address.patch
    0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
    0006-kni-use-dedicated-function-to-set-MAC-address.patch
    dpdk-CVE-2021-3839.patch
    dpdk-CVE-2022-0669.patch
    dpdk-CVE-2022-2132.patch
    dpdk-CVE-2022-28199.patch
  * Rebased patches:
    0001-fix-cpu-compatibility.patch
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678276800">- Updated package name:dpdk22 for DPDK version 22.11.1 as legacy DPDK version(v19.11.10) also needs to be supported.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678449600">- Remove redundant obsoletes and unnecessary provides
- Remove obsoleting old dpdk package changes and let user decide.
- Add conflict for the KMP module in preamble</changelog>
  <changelog author="gyribeiro@suse.com" date="1681128000">- Rename name_tag to package_name_tag to avoid conflict with name_tag
  used multibuild</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1716379200">- Fix [bsc#1219990] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="6660e359a789fba3ac7261dcecae5272ffbc29d6eb40baace708a35208c03521" name="dpdk22-devel" arch="x86_64">
  <version epoch="0" ver="22.11.1" rel="150500.5.5.3"/>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="sweiberg@suse.com" date="1631275200">- Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651147200">- security update
- added patches
  fix CVE-2021-3839 [bsc#1198963], dpdk: OOB write irelated to vhost communication n vhost_user_set_inflight_fd()
  + dpdk-CVE-2021-3839.patch
  fix CVE-2022-0669 [bsc#1198964], dpdk: DoS by exhausting available fd in vhost-user slave process
  + dpdk-CVE-2022-0669.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1658145600">- aabdallah@suse.com:
  Fix for SG#63176, bsc#1198873: Read PCI device name as UTF strings.
- tabraham@suse.com:
  kni: allow configuring thread granularity (bsc#1195172)
- added patches
  + 0001-kni-allow-configuring-thread-granularity.patch
  + 0001-usertools-read-PCI-device-name-as-UTF-8.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1664366400">- added patch to fix build issue with 15 SP5 kernel (bsc#1203845)
  + 0004-kni-update-kernel-API-to-set-random-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664452800">- fix build with SLE15-SP5 kernel [bsc#1203845]
- added patches
  + 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  + 0006-kni-use-dedicated-function-to-set-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1668772800">- security update
- added patches
  fix CVE-2022-2132 [bsc#1202903], DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs
  + dpdk-CVE-2022-2132.patch
  fix CVE-2022-28199 [bsc#1202956], buffer overflow in the vhost code
  + dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1677240000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
  http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
    0001-kni-allow-configuring-thread-granularity.patch
    0001-usertools-read-PCI-device-name-as-UTF-8.patch
    0003-dpdk-fallthrough-comment-fixes.patch
    0004-kni-update-kernel-API-to-set-random-MAC-address.patch
    0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
    0006-kni-use-dedicated-function-to-set-MAC-address.patch
    dpdk-CVE-2021-3839.patch
    dpdk-CVE-2022-0669.patch
    dpdk-CVE-2022-2132.patch
    dpdk-CVE-2022-28199.patch
  * Rebased patches:
    0001-fix-cpu-compatibility.patch
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678276800">- Updated package name:dpdk22 for DPDK version 22.11.1 as legacy DPDK version(v19.11.10) also needs to be supported.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678449600">- Remove redundant obsoletes and unnecessary provides
- Remove obsoleting old dpdk package changes and let user decide.
- Add conflict for the KMP module in preamble</changelog>
  <changelog author="gyribeiro@suse.com" date="1681128000">- Rename name_tag to package_name_tag to avoid conflict with name_tag
  used multibuild</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1716379200">- Fix [bsc#1219990] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="04f2d5e0eee4ecf6e0b2eedd066c7e86e3464ce162be22f56f57636077d17f14" name="dpdk22-devel-static" arch="aarch64">
  <version epoch="0" ver="22.11.1" rel="150500.5.5.3"/>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="sweiberg@suse.com" date="1631275200">- Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651147200">- security update
- added patches
  fix CVE-2021-3839 [bsc#1198963], dpdk: OOB write irelated to vhost communication n vhost_user_set_inflight_fd()
  + dpdk-CVE-2021-3839.patch
  fix CVE-2022-0669 [bsc#1198964], dpdk: DoS by exhausting available fd in vhost-user slave process
  + dpdk-CVE-2022-0669.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1658145600">- aabdallah@suse.com:
  Fix for SG#63176, bsc#1198873: Read PCI device name as UTF strings.
- tabraham@suse.com:
  kni: allow configuring thread granularity (bsc#1195172)
- added patches
  + 0001-kni-allow-configuring-thread-granularity.patch
  + 0001-usertools-read-PCI-device-name-as-UTF-8.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1664366400">- added patch to fix build issue with 15 SP5 kernel (bsc#1203845)
  + 0004-kni-update-kernel-API-to-set-random-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664452800">- fix build with SLE15-SP5 kernel [bsc#1203845]
- added patches
  + 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  + 0006-kni-use-dedicated-function-to-set-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1668772800">- security update
- added patches
  fix CVE-2022-2132 [bsc#1202903], DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs
  + dpdk-CVE-2022-2132.patch
  fix CVE-2022-28199 [bsc#1202956], buffer overflow in the vhost code
  + dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1677240000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
  http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
    0001-kni-allow-configuring-thread-granularity.patch
    0001-usertools-read-PCI-device-name-as-UTF-8.patch
    0003-dpdk-fallthrough-comment-fixes.patch
    0004-kni-update-kernel-API-to-set-random-MAC-address.patch
    0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
    0006-kni-use-dedicated-function-to-set-MAC-address.patch
    dpdk-CVE-2021-3839.patch
    dpdk-CVE-2022-0669.patch
    dpdk-CVE-2022-2132.patch
    dpdk-CVE-2022-28199.patch
  * Rebased patches:
    0001-fix-cpu-compatibility.patch
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678276800">- Updated package name:dpdk22 for DPDK version 22.11.1 as legacy DPDK version(v19.11.10) also needs to be supported.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678449600">- Remove redundant obsoletes and unnecessary provides
- Remove obsoleting old dpdk package changes and let user decide.
- Add conflict for the KMP module in preamble</changelog>
  <changelog author="gyribeiro@suse.com" date="1681128000">- Rename name_tag to package_name_tag to avoid conflict with name_tag
  used multibuild</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1716379200">- Fix [bsc#1219990] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="b8509a375b49d58cb6a556ecb8e5ce8f6995ffb4ec6e3176b7ab8dbd3a068ca5" name="dpdk22-devel-static" arch="ppc64le">
  <version epoch="0" ver="22.11.1" rel="150500.5.5.3"/>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="sweiberg@suse.com" date="1631275200">- Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651147200">- security update
- added patches
  fix CVE-2021-3839 [bsc#1198963], dpdk: OOB write irelated to vhost communication n vhost_user_set_inflight_fd()
  + dpdk-CVE-2021-3839.patch
  fix CVE-2022-0669 [bsc#1198964], dpdk: DoS by exhausting available fd in vhost-user slave process
  + dpdk-CVE-2022-0669.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1658145600">- aabdallah@suse.com:
  Fix for SG#63176, bsc#1198873: Read PCI device name as UTF strings.
- tabraham@suse.com:
  kni: allow configuring thread granularity (bsc#1195172)
- added patches
  + 0001-kni-allow-configuring-thread-granularity.patch
  + 0001-usertools-read-PCI-device-name-as-UTF-8.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1664366400">- added patch to fix build issue with 15 SP5 kernel (bsc#1203845)
  + 0004-kni-update-kernel-API-to-set-random-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664452800">- fix build with SLE15-SP5 kernel [bsc#1203845]
- added patches
  + 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  + 0006-kni-use-dedicated-function-to-set-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1668772800">- security update
- added patches
  fix CVE-2022-2132 [bsc#1202903], DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs
  + dpdk-CVE-2022-2132.patch
  fix CVE-2022-28199 [bsc#1202956], buffer overflow in the vhost code
  + dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1677240000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
  http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
    0001-kni-allow-configuring-thread-granularity.patch
    0001-usertools-read-PCI-device-name-as-UTF-8.patch
    0003-dpdk-fallthrough-comment-fixes.patch
    0004-kni-update-kernel-API-to-set-random-MAC-address.patch
    0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
    0006-kni-use-dedicated-function-to-set-MAC-address.patch
    dpdk-CVE-2021-3839.patch
    dpdk-CVE-2022-0669.patch
    dpdk-CVE-2022-2132.patch
    dpdk-CVE-2022-28199.patch
  * Rebased patches:
    0001-fix-cpu-compatibility.patch
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678276800">- Updated package name:dpdk22 for DPDK version 22.11.1 as legacy DPDK version(v19.11.10) also needs to be supported.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678449600">- Remove redundant obsoletes and unnecessary provides
- Remove obsoleting old dpdk package changes and let user decide.
- Add conflict for the KMP module in preamble</changelog>
  <changelog author="gyribeiro@suse.com" date="1681128000">- Rename name_tag to package_name_tag to avoid conflict with name_tag
  used multibuild</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1716379200">- Fix [bsc#1219990] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="df586b03823071291cd9dce08aee23175feed2c4824f7fb58e91ae8f04e08799" name="dpdk22-devel-static" arch="x86_64">
  <version epoch="0" ver="22.11.1" rel="150500.5.5.3"/>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="sweiberg@suse.com" date="1631275200">- Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651147200">- security update
- added patches
  fix CVE-2021-3839 [bsc#1198963], dpdk: OOB write irelated to vhost communication n vhost_user_set_inflight_fd()
  + dpdk-CVE-2021-3839.patch
  fix CVE-2022-0669 [bsc#1198964], dpdk: DoS by exhausting available fd in vhost-user slave process
  + dpdk-CVE-2022-0669.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1658145600">- aabdallah@suse.com:
  Fix for SG#63176, bsc#1198873: Read PCI device name as UTF strings.
- tabraham@suse.com:
  kni: allow configuring thread granularity (bsc#1195172)
- added patches
  + 0001-kni-allow-configuring-thread-granularity.patch
  + 0001-usertools-read-PCI-device-name-as-UTF-8.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1664366400">- added patch to fix build issue with 15 SP5 kernel (bsc#1203845)
  + 0004-kni-update-kernel-API-to-set-random-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664452800">- fix build with SLE15-SP5 kernel [bsc#1203845]
- added patches
  + 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  + 0006-kni-use-dedicated-function-to-set-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1668772800">- security update
- added patches
  fix CVE-2022-2132 [bsc#1202903], DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs
  + dpdk-CVE-2022-2132.patch
  fix CVE-2022-28199 [bsc#1202956], buffer overflow in the vhost code
  + dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1677240000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
  http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
    0001-kni-allow-configuring-thread-granularity.patch
    0001-usertools-read-PCI-device-name-as-UTF-8.patch
    0003-dpdk-fallthrough-comment-fixes.patch
    0004-kni-update-kernel-API-to-set-random-MAC-address.patch
    0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
    0006-kni-use-dedicated-function-to-set-MAC-address.patch
    dpdk-CVE-2021-3839.patch
    dpdk-CVE-2022-0669.patch
    dpdk-CVE-2022-2132.patch
    dpdk-CVE-2022-28199.patch
  * Rebased patches:
    0001-fix-cpu-compatibility.patch
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678276800">- Updated package name:dpdk22 for DPDK version 22.11.1 as legacy DPDK version(v19.11.10) also needs to be supported.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678449600">- Remove redundant obsoletes and unnecessary provides
- Remove obsoleting old dpdk package changes and let user decide.
- Add conflict for the KMP module in preamble</changelog>
  <changelog author="gyribeiro@suse.com" date="1681128000">- Rename name_tag to package_name_tag to avoid conflict with name_tag
  used multibuild</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1716379200">- Fix [bsc#1219990] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="2b984dc7202a343ef293a247cdba8ee1b0d41d8ba2704417289647d1309deda3" name="dpdk22-doc" arch="noarch">
  <version epoch="0" ver="22.11.1" rel="150500.5.5.3"/>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="sweiberg@suse.com" date="1631275200">- Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651147200">- security update
- added patches
  fix CVE-2021-3839 [bsc#1198963], dpdk: OOB write irelated to vhost communication n vhost_user_set_inflight_fd()
  + dpdk-CVE-2021-3839.patch
  fix CVE-2022-0669 [bsc#1198964], dpdk: DoS by exhausting available fd in vhost-user slave process
  + dpdk-CVE-2022-0669.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1658145600">- aabdallah@suse.com:
  Fix for SG#63176, bsc#1198873: Read PCI device name as UTF strings.
- tabraham@suse.com:
  kni: allow configuring thread granularity (bsc#1195172)
- added patches
  + 0001-kni-allow-configuring-thread-granularity.patch
  + 0001-usertools-read-PCI-device-name-as-UTF-8.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1664366400">- added patch to fix build issue with 15 SP5 kernel (bsc#1203845)
  + 0004-kni-update-kernel-API-to-set-random-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664452800">- fix build with SLE15-SP5 kernel [bsc#1203845]
- added patches
  + 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  + 0006-kni-use-dedicated-function-to-set-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1668772800">- security update
- added patches
  fix CVE-2022-2132 [bsc#1202903], DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs
  + dpdk-CVE-2022-2132.patch
  fix CVE-2022-28199 [bsc#1202956], buffer overflow in the vhost code
  + dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1677240000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
  http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
    0001-kni-allow-configuring-thread-granularity.patch
    0001-usertools-read-PCI-device-name-as-UTF-8.patch
    0003-dpdk-fallthrough-comment-fixes.patch
    0004-kni-update-kernel-API-to-set-random-MAC-address.patch
    0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
    0006-kni-use-dedicated-function-to-set-MAC-address.patch
    dpdk-CVE-2021-3839.patch
    dpdk-CVE-2022-0669.patch
    dpdk-CVE-2022-2132.patch
    dpdk-CVE-2022-28199.patch
  * Rebased patches:
    0001-fix-cpu-compatibility.patch
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678276800">- Updated package name:dpdk22 for DPDK version 22.11.1 as legacy DPDK version(v19.11.10) also needs to be supported.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678449600">- Remove redundant obsoletes and unnecessary provides
- Remove obsoleting old dpdk package changes and let user decide.
- Add conflict for the KMP module in preamble</changelog>
  <changelog author="gyribeiro@suse.com" date="1681128000">- Rename name_tag to package_name_tag to avoid conflict with name_tag
  used multibuild</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1716379200">- Fix [bsc#1219990] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="739cf6e9451ab2961e8137a24e9f901436b6a87e8dfad0049aa7005707921a83" name="dpdk22-examples" arch="aarch64">
  <version epoch="0" ver="22.11.1" rel="150500.5.5.3"/>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="sweiberg@suse.com" date="1631275200">- Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651147200">- security update
- added patches
  fix CVE-2021-3839 [bsc#1198963], dpdk: OOB write irelated to vhost communication n vhost_user_set_inflight_fd()
  + dpdk-CVE-2021-3839.patch
  fix CVE-2022-0669 [bsc#1198964], dpdk: DoS by exhausting available fd in vhost-user slave process
  + dpdk-CVE-2022-0669.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1658145600">- aabdallah@suse.com:
  Fix for SG#63176, bsc#1198873: Read PCI device name as UTF strings.
- tabraham@suse.com:
  kni: allow configuring thread granularity (bsc#1195172)
- added patches
  + 0001-kni-allow-configuring-thread-granularity.patch
  + 0001-usertools-read-PCI-device-name-as-UTF-8.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1664366400">- added patch to fix build issue with 15 SP5 kernel (bsc#1203845)
  + 0004-kni-update-kernel-API-to-set-random-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664452800">- fix build with SLE15-SP5 kernel [bsc#1203845]
- added patches
  + 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  + 0006-kni-use-dedicated-function-to-set-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1668772800">- security update
- added patches
  fix CVE-2022-2132 [bsc#1202903], DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs
  + dpdk-CVE-2022-2132.patch
  fix CVE-2022-28199 [bsc#1202956], buffer overflow in the vhost code
  + dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1677240000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
  http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
    0001-kni-allow-configuring-thread-granularity.patch
    0001-usertools-read-PCI-device-name-as-UTF-8.patch
    0003-dpdk-fallthrough-comment-fixes.patch
    0004-kni-update-kernel-API-to-set-random-MAC-address.patch
    0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
    0006-kni-use-dedicated-function-to-set-MAC-address.patch
    dpdk-CVE-2021-3839.patch
    dpdk-CVE-2022-0669.patch
    dpdk-CVE-2022-2132.patch
    dpdk-CVE-2022-28199.patch
  * Rebased patches:
    0001-fix-cpu-compatibility.patch
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678276800">- Updated package name:dpdk22 for DPDK version 22.11.1 as legacy DPDK version(v19.11.10) also needs to be supported.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678449600">- Remove redundant obsoletes and unnecessary provides
- Remove obsoleting old dpdk package changes and let user decide.
- Add conflict for the KMP module in preamble</changelog>
  <changelog author="gyribeiro@suse.com" date="1681128000">- Rename name_tag to package_name_tag to avoid conflict with name_tag
  used multibuild</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1716379200">- Fix [bsc#1219990] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="6603d622aaf90a0a5109d74172e233ba3568716dfa26d065898e63c6f001cfb3" name="dpdk22-examples" arch="ppc64le">
  <version epoch="0" ver="22.11.1" rel="150500.5.5.3"/>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="sweiberg@suse.com" date="1631275200">- Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651147200">- security update
- added patches
  fix CVE-2021-3839 [bsc#1198963], dpdk: OOB write irelated to vhost communication n vhost_user_set_inflight_fd()
  + dpdk-CVE-2021-3839.patch
  fix CVE-2022-0669 [bsc#1198964], dpdk: DoS by exhausting available fd in vhost-user slave process
  + dpdk-CVE-2022-0669.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1658145600">- aabdallah@suse.com:
  Fix for SG#63176, bsc#1198873: Read PCI device name as UTF strings.
- tabraham@suse.com:
  kni: allow configuring thread granularity (bsc#1195172)
- added patches
  + 0001-kni-allow-configuring-thread-granularity.patch
  + 0001-usertools-read-PCI-device-name-as-UTF-8.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1664366400">- added patch to fix build issue with 15 SP5 kernel (bsc#1203845)
  + 0004-kni-update-kernel-API-to-set-random-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664452800">- fix build with SLE15-SP5 kernel [bsc#1203845]
- added patches
  + 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  + 0006-kni-use-dedicated-function-to-set-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1668772800">- security update
- added patches
  fix CVE-2022-2132 [bsc#1202903], DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs
  + dpdk-CVE-2022-2132.patch
  fix CVE-2022-28199 [bsc#1202956], buffer overflow in the vhost code
  + dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1677240000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
  http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
    0001-kni-allow-configuring-thread-granularity.patch
    0001-usertools-read-PCI-device-name-as-UTF-8.patch
    0003-dpdk-fallthrough-comment-fixes.patch
    0004-kni-update-kernel-API-to-set-random-MAC-address.patch
    0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
    0006-kni-use-dedicated-function-to-set-MAC-address.patch
    dpdk-CVE-2021-3839.patch
    dpdk-CVE-2022-0669.patch
    dpdk-CVE-2022-2132.patch
    dpdk-CVE-2022-28199.patch
  * Rebased patches:
    0001-fix-cpu-compatibility.patch
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678276800">- Updated package name:dpdk22 for DPDK version 22.11.1 as legacy DPDK version(v19.11.10) also needs to be supported.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678449600">- Remove redundant obsoletes and unnecessary provides
- Remove obsoleting old dpdk package changes and let user decide.
- Add conflict for the KMP module in preamble</changelog>
  <changelog author="gyribeiro@suse.com" date="1681128000">- Rename name_tag to package_name_tag to avoid conflict with name_tag
  used multibuild</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1716379200">- Fix [bsc#1219990] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="372a87b4546527d80204e5a9d6d9013990db5fdb313670483054806925c09663" name="dpdk22-examples" arch="x86_64">
  <version epoch="0" ver="22.11.1" rel="150500.5.5.3"/>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="sweiberg@suse.com" date="1631275200">- Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651147200">- security update
- added patches
  fix CVE-2021-3839 [bsc#1198963], dpdk: OOB write irelated to vhost communication n vhost_user_set_inflight_fd()
  + dpdk-CVE-2021-3839.patch
  fix CVE-2022-0669 [bsc#1198964], dpdk: DoS by exhausting available fd in vhost-user slave process
  + dpdk-CVE-2022-0669.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1658145600">- aabdallah@suse.com:
  Fix for SG#63176, bsc#1198873: Read PCI device name as UTF strings.
- tabraham@suse.com:
  kni: allow configuring thread granularity (bsc#1195172)
- added patches
  + 0001-kni-allow-configuring-thread-granularity.patch
  + 0001-usertools-read-PCI-device-name-as-UTF-8.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1664366400">- added patch to fix build issue with 15 SP5 kernel (bsc#1203845)
  + 0004-kni-update-kernel-API-to-set-random-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664452800">- fix build with SLE15-SP5 kernel [bsc#1203845]
- added patches
  + 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  + 0006-kni-use-dedicated-function-to-set-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1668772800">- security update
- added patches
  fix CVE-2022-2132 [bsc#1202903], DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs
  + dpdk-CVE-2022-2132.patch
  fix CVE-2022-28199 [bsc#1202956], buffer overflow in the vhost code
  + dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1677240000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
  http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
    0001-kni-allow-configuring-thread-granularity.patch
    0001-usertools-read-PCI-device-name-as-UTF-8.patch
    0003-dpdk-fallthrough-comment-fixes.patch
    0004-kni-update-kernel-API-to-set-random-MAC-address.patch
    0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
    0006-kni-use-dedicated-function-to-set-MAC-address.patch
    dpdk-CVE-2021-3839.patch
    dpdk-CVE-2022-0669.patch
    dpdk-CVE-2022-2132.patch
    dpdk-CVE-2022-28199.patch
  * Rebased patches:
    0001-fix-cpu-compatibility.patch
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678276800">- Updated package name:dpdk22 for DPDK version 22.11.1 as legacy DPDK version(v19.11.10) also needs to be supported.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678449600">- Remove redundant obsoletes and unnecessary provides
- Remove obsoleting old dpdk package changes and let user decide.
- Add conflict for the KMP module in preamble</changelog>
  <changelog author="gyribeiro@suse.com" date="1681128000">- Rename name_tag to package_name_tag to avoid conflict with name_tag
  used multibuild</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1716379200">- Fix [bsc#1219990] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="2df09383c8aa3de486cb881be3725c965f9d126117b19a2e64009d450ab48e76" name="dpdk22-kmp-default" arch="aarch64">
  <version epoch="0" ver="22.11.1_k5.14.21_150500.55.62" rel="150500.5.5.3"/>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="sweiberg@suse.com" date="1631275200">- Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651147200">- security update
- added patches
  fix CVE-2021-3839 [bsc#1198963], dpdk: OOB write irelated to vhost communication n vhost_user_set_inflight_fd()
  + dpdk-CVE-2021-3839.patch
  fix CVE-2022-0669 [bsc#1198964], dpdk: DoS by exhausting available fd in vhost-user slave process
  + dpdk-CVE-2022-0669.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1658145600">- aabdallah@suse.com:
  Fix for SG#63176, bsc#1198873: Read PCI device name as UTF strings.
- tabraham@suse.com:
  kni: allow configuring thread granularity (bsc#1195172)
- added patches
  + 0001-kni-allow-configuring-thread-granularity.patch
  + 0001-usertools-read-PCI-device-name-as-UTF-8.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1664366400">- added patch to fix build issue with 15 SP5 kernel (bsc#1203845)
  + 0004-kni-update-kernel-API-to-set-random-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664452800">- fix build with SLE15-SP5 kernel [bsc#1203845]
- added patches
  + 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  + 0006-kni-use-dedicated-function-to-set-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1668772800">- security update
- added patches
  fix CVE-2022-2132 [bsc#1202903], DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs
  + dpdk-CVE-2022-2132.patch
  fix CVE-2022-28199 [bsc#1202956], buffer overflow in the vhost code
  + dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1677240000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
  http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
    0001-kni-allow-configuring-thread-granularity.patch
    0001-usertools-read-PCI-device-name-as-UTF-8.patch
    0003-dpdk-fallthrough-comment-fixes.patch
    0004-kni-update-kernel-API-to-set-random-MAC-address.patch
    0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
    0006-kni-use-dedicated-function-to-set-MAC-address.patch
    dpdk-CVE-2021-3839.patch
    dpdk-CVE-2022-0669.patch
    dpdk-CVE-2022-2132.patch
    dpdk-CVE-2022-28199.patch
  * Rebased patches:
    0001-fix-cpu-compatibility.patch
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678276800">- Updated package name:dpdk22 for DPDK version 22.11.1 as legacy DPDK version(v19.11.10) also needs to be supported.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678449600">- Remove redundant obsoletes and unnecessary provides
- Remove obsoleting old dpdk package changes and let user decide.
- Add conflict for the KMP module in preamble</changelog>
  <changelog author="gyribeiro@suse.com" date="1681128000">- Rename name_tag to package_name_tag to avoid conflict with name_tag
  used multibuild</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1716379200">- Fix [bsc#1219990] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="a79643de3acdbb96f04758a84634a22f71a9eb2fff55b06ef32a02ae90252796" name="dpdk22-kmp-default" arch="ppc64le">
  <version epoch="0" ver="22.11.1_k5.14.21_150500.55.62" rel="150500.5.5.3"/>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="sweiberg@suse.com" date="1631275200">- Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651147200">- security update
- added patches
  fix CVE-2021-3839 [bsc#1198963], dpdk: OOB write irelated to vhost communication n vhost_user_set_inflight_fd()
  + dpdk-CVE-2021-3839.patch
  fix CVE-2022-0669 [bsc#1198964], dpdk: DoS by exhausting available fd in vhost-user slave process
  + dpdk-CVE-2022-0669.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1658145600">- aabdallah@suse.com:
  Fix for SG#63176, bsc#1198873: Read PCI device name as UTF strings.
- tabraham@suse.com:
  kni: allow configuring thread granularity (bsc#1195172)
- added patches
  + 0001-kni-allow-configuring-thread-granularity.patch
  + 0001-usertools-read-PCI-device-name-as-UTF-8.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1664366400">- added patch to fix build issue with 15 SP5 kernel (bsc#1203845)
  + 0004-kni-update-kernel-API-to-set-random-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664452800">- fix build with SLE15-SP5 kernel [bsc#1203845]
- added patches
  + 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  + 0006-kni-use-dedicated-function-to-set-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1668772800">- security update
- added patches
  fix CVE-2022-2132 [bsc#1202903], DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs
  + dpdk-CVE-2022-2132.patch
  fix CVE-2022-28199 [bsc#1202956], buffer overflow in the vhost code
  + dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1677240000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
  http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
    0001-kni-allow-configuring-thread-granularity.patch
    0001-usertools-read-PCI-device-name-as-UTF-8.patch
    0003-dpdk-fallthrough-comment-fixes.patch
    0004-kni-update-kernel-API-to-set-random-MAC-address.patch
    0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
    0006-kni-use-dedicated-function-to-set-MAC-address.patch
    dpdk-CVE-2021-3839.patch
    dpdk-CVE-2022-0669.patch
    dpdk-CVE-2022-2132.patch
    dpdk-CVE-2022-28199.patch
  * Rebased patches:
    0001-fix-cpu-compatibility.patch
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678276800">- Updated package name:dpdk22 for DPDK version 22.11.1 as legacy DPDK version(v19.11.10) also needs to be supported.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678449600">- Remove redundant obsoletes and unnecessary provides
- Remove obsoleting old dpdk package changes and let user decide.
- Add conflict for the KMP module in preamble</changelog>
  <changelog author="gyribeiro@suse.com" date="1681128000">- Rename name_tag to package_name_tag to avoid conflict with name_tag
  used multibuild</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1716379200">- Fix [bsc#1219990] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="01b93c896dfd2d6a3261bb3ee730690a7816103d1d7ef6fd320b15c87723b918" name="dpdk22-kmp-default" arch="x86_64">
  <version epoch="0" ver="22.11.1_k5.14.21_150500.55.62" rel="150500.5.5.3"/>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="sweiberg@suse.com" date="1631275200">- Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651147200">- security update
- added patches
  fix CVE-2021-3839 [bsc#1198963], dpdk: OOB write irelated to vhost communication n vhost_user_set_inflight_fd()
  + dpdk-CVE-2021-3839.patch
  fix CVE-2022-0669 [bsc#1198964], dpdk: DoS by exhausting available fd in vhost-user slave process
  + dpdk-CVE-2022-0669.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1658145600">- aabdallah@suse.com:
  Fix for SG#63176, bsc#1198873: Read PCI device name as UTF strings.
- tabraham@suse.com:
  kni: allow configuring thread granularity (bsc#1195172)
- added patches
  + 0001-kni-allow-configuring-thread-granularity.patch
  + 0001-usertools-read-PCI-device-name-as-UTF-8.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1664366400">- added patch to fix build issue with 15 SP5 kernel (bsc#1203845)
  + 0004-kni-update-kernel-API-to-set-random-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664452800">- fix build with SLE15-SP5 kernel [bsc#1203845]
- added patches
  + 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  + 0006-kni-use-dedicated-function-to-set-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1668772800">- security update
- added patches
  fix CVE-2022-2132 [bsc#1202903], DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs
  + dpdk-CVE-2022-2132.patch
  fix CVE-2022-28199 [bsc#1202956], buffer overflow in the vhost code
  + dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1677240000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
  http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
    0001-kni-allow-configuring-thread-granularity.patch
    0001-usertools-read-PCI-device-name-as-UTF-8.patch
    0003-dpdk-fallthrough-comment-fixes.patch
    0004-kni-update-kernel-API-to-set-random-MAC-address.patch
    0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
    0006-kni-use-dedicated-function-to-set-MAC-address.patch
    dpdk-CVE-2021-3839.patch
    dpdk-CVE-2022-0669.patch
    dpdk-CVE-2022-2132.patch
    dpdk-CVE-2022-28199.patch
  * Rebased patches:
    0001-fix-cpu-compatibility.patch
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678276800">- Updated package name:dpdk22 for DPDK version 22.11.1 as legacy DPDK version(v19.11.10) also needs to be supported.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678449600">- Remove redundant obsoletes and unnecessary provides
- Remove obsoleting old dpdk package changes and let user decide.
- Add conflict for the KMP module in preamble</changelog>
  <changelog author="gyribeiro@suse.com" date="1681128000">- Rename name_tag to package_name_tag to avoid conflict with name_tag
  used multibuild</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1716379200">- Fix [bsc#1219990] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="56cef3c0b663fb3fc45543912932531b782d0f2bbe7a391bc5340ad3273a782b" name="dpdk22-thunderx" arch="aarch64">
  <version epoch="0" ver="22.11.1" rel="150500.5.5.3"/>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="sweiberg@suse.com" date="1631275200">- Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651147200">- security update
- added patches
  fix CVE-2021-3839 [bsc#1198963], dpdk: OOB write irelated to vhost communication n vhost_user_set_inflight_fd()
  + dpdk-CVE-2021-3839.patch
  fix CVE-2022-0669 [bsc#1198964], dpdk: DoS by exhausting available fd in vhost-user slave process
  + dpdk-CVE-2022-0669.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1658145600">- aabdallah@suse.com:
  Fix for SG#63176, bsc#1198873: Read PCI device name as UTF strings.
- tabraham@suse.com:
  kni: allow configuring thread granularity (bsc#1195172)
- added patches
  + 0001-kni-allow-configuring-thread-granularity.patch
  + 0001-usertools-read-PCI-device-name-as-UTF-8.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1664366400">- added patch to fix build issue with 15 SP5 kernel (bsc#1203845)
  + 0004-kni-update-kernel-API-to-set-random-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664452800">- fix build with SLE15-SP5 kernel [bsc#1203845]
- added patches
  + 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  + 0006-kni-use-dedicated-function-to-set-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1668772800">- security update
- added patches
  fix CVE-2022-2132 [bsc#1202903], DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs
  + dpdk-CVE-2022-2132.patch
  fix CVE-2022-28199 [bsc#1202956], buffer overflow in the vhost code
  + dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1677240000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
  http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
    0001-kni-allow-configuring-thread-granularity.patch
    0001-usertools-read-PCI-device-name-as-UTF-8.patch
    0003-dpdk-fallthrough-comment-fixes.patch
    0004-kni-update-kernel-API-to-set-random-MAC-address.patch
    0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
    0006-kni-use-dedicated-function-to-set-MAC-address.patch
    dpdk-CVE-2021-3839.patch
    dpdk-CVE-2022-0669.patch
    dpdk-CVE-2022-2132.patch
    dpdk-CVE-2022-28199.patch
  * Rebased patches:
    0001-fix-cpu-compatibility.patch
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678276800">- Updated package name:dpdk22 for DPDK version 22.11.1 as legacy DPDK version(v19.11.10) also needs to be supported.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678449600">- Remove redundant obsoletes and unnecessary provides
- Remove obsoleting old dpdk package changes and let user decide.
- Add conflict for the KMP module in preamble</changelog>
  <changelog author="gyribeiro@suse.com" date="1681128000">- Rename name_tag to package_name_tag to avoid conflict with name_tag
  used multibuild</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1716379200">- Fix [bsc#1219990] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="e3315db9aa40cec0ffbab70ee3edca7100c5dffbcfc4f5f6becd83d7b1e49319" name="dpdk22-thunderx" arch="src">
  <version epoch="0" ver="22.11.1" rel="150500.5.5.3"/>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="sweiberg@suse.com" date="1631275200">- Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651147200">- security update
- added patches
  fix CVE-2021-3839 [bsc#1198963], dpdk: OOB write irelated to vhost communication n vhost_user_set_inflight_fd()
  + dpdk-CVE-2021-3839.patch
  fix CVE-2022-0669 [bsc#1198964], dpdk: DoS by exhausting available fd in vhost-user slave process
  + dpdk-CVE-2022-0669.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1658145600">- aabdallah@suse.com:
  Fix for SG#63176, bsc#1198873: Read PCI device name as UTF strings.
- tabraham@suse.com:
  kni: allow configuring thread granularity (bsc#1195172)
- added patches
  + 0001-kni-allow-configuring-thread-granularity.patch
  + 0001-usertools-read-PCI-device-name-as-UTF-8.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1664366400">- added patch to fix build issue with 15 SP5 kernel (bsc#1203845)
  + 0004-kni-update-kernel-API-to-set-random-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664452800">- fix build with SLE15-SP5 kernel [bsc#1203845]
- added patches
  + 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  + 0006-kni-use-dedicated-function-to-set-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1668772800">- security update
- added patches
  fix CVE-2022-2132 [bsc#1202903], DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs
  + dpdk-CVE-2022-2132.patch
  fix CVE-2022-28199 [bsc#1202956], buffer overflow in the vhost code
  + dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1677240000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
  http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
    0001-kni-allow-configuring-thread-granularity.patch
    0001-usertools-read-PCI-device-name-as-UTF-8.patch
    0003-dpdk-fallthrough-comment-fixes.patch
    0004-kni-update-kernel-API-to-set-random-MAC-address.patch
    0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
    0006-kni-use-dedicated-function-to-set-MAC-address.patch
    dpdk-CVE-2021-3839.patch
    dpdk-CVE-2022-0669.patch
    dpdk-CVE-2022-2132.patch
    dpdk-CVE-2022-28199.patch
  * Rebased patches:
    0001-fix-cpu-compatibility.patch
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678276800">- Updated package name:dpdk22 for DPDK version 22.11.1 as legacy DPDK version(v19.11.10) also needs to be supported.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678449600">- Remove redundant obsoletes and unnecessary provides
- Remove obsoleting old dpdk package changes and let user decide.
- Add conflict for the KMP module in preamble</changelog>
  <changelog author="gyribeiro@suse.com" date="1681128000">- Rename name_tag to package_name_tag to avoid conflict with name_tag
  used multibuild</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1716379200">- Fix [bsc#1219990] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="cfd6376c9d64744c2c601e8a170ea2b4aa02e8c1662d5ef63a786e86648e70d1" name="dpdk22-thunderx-devel" arch="aarch64">
  <version epoch="0" ver="22.11.1" rel="150500.5.5.3"/>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="sweiberg@suse.com" date="1631275200">- Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651147200">- security update
- added patches
  fix CVE-2021-3839 [bsc#1198963], dpdk: OOB write irelated to vhost communication n vhost_user_set_inflight_fd()
  + dpdk-CVE-2021-3839.patch
  fix CVE-2022-0669 [bsc#1198964], dpdk: DoS by exhausting available fd in vhost-user slave process
  + dpdk-CVE-2022-0669.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1658145600">- aabdallah@suse.com:
  Fix for SG#63176, bsc#1198873: Read PCI device name as UTF strings.
- tabraham@suse.com:
  kni: allow configuring thread granularity (bsc#1195172)
- added patches
  + 0001-kni-allow-configuring-thread-granularity.patch
  + 0001-usertools-read-PCI-device-name-as-UTF-8.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1664366400">- added patch to fix build issue with 15 SP5 kernel (bsc#1203845)
  + 0004-kni-update-kernel-API-to-set-random-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664452800">- fix build with SLE15-SP5 kernel [bsc#1203845]
- added patches
  + 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  + 0006-kni-use-dedicated-function-to-set-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1668772800">- security update
- added patches
  fix CVE-2022-2132 [bsc#1202903], DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs
  + dpdk-CVE-2022-2132.patch
  fix CVE-2022-28199 [bsc#1202956], buffer overflow in the vhost code
  + dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1677240000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
  http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
    0001-kni-allow-configuring-thread-granularity.patch
    0001-usertools-read-PCI-device-name-as-UTF-8.patch
    0003-dpdk-fallthrough-comment-fixes.patch
    0004-kni-update-kernel-API-to-set-random-MAC-address.patch
    0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
    0006-kni-use-dedicated-function-to-set-MAC-address.patch
    dpdk-CVE-2021-3839.patch
    dpdk-CVE-2022-0669.patch
    dpdk-CVE-2022-2132.patch
    dpdk-CVE-2022-28199.patch
  * Rebased patches:
    0001-fix-cpu-compatibility.patch
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678276800">- Updated package name:dpdk22 for DPDK version 22.11.1 as legacy DPDK version(v19.11.10) also needs to be supported.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678449600">- Remove redundant obsoletes and unnecessary provides
- Remove obsoleting old dpdk package changes and let user decide.
- Add conflict for the KMP module in preamble</changelog>
  <changelog author="gyribeiro@suse.com" date="1681128000">- Rename name_tag to package_name_tag to avoid conflict with name_tag
  used multibuild</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1716379200">- Fix [bsc#1219990] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="2723858e0b3249e6178236a9522aa21d760a8703267adacfc2641b929e14cca4" name="dpdk22-thunderx-devel-static" arch="aarch64">
  <version epoch="0" ver="22.11.1" rel="150500.5.5.3"/>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="sweiberg@suse.com" date="1631275200">- Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651147200">- security update
- added patches
  fix CVE-2021-3839 [bsc#1198963], dpdk: OOB write irelated to vhost communication n vhost_user_set_inflight_fd()
  + dpdk-CVE-2021-3839.patch
  fix CVE-2022-0669 [bsc#1198964], dpdk: DoS by exhausting available fd in vhost-user slave process
  + dpdk-CVE-2022-0669.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1658145600">- aabdallah@suse.com:
  Fix for SG#63176, bsc#1198873: Read PCI device name as UTF strings.
- tabraham@suse.com:
  kni: allow configuring thread granularity (bsc#1195172)
- added patches
  + 0001-kni-allow-configuring-thread-granularity.patch
  + 0001-usertools-read-PCI-device-name-as-UTF-8.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1664366400">- added patch to fix build issue with 15 SP5 kernel (bsc#1203845)
  + 0004-kni-update-kernel-API-to-set-random-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664452800">- fix build with SLE15-SP5 kernel [bsc#1203845]
- added patches
  + 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  + 0006-kni-use-dedicated-function-to-set-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1668772800">- security update
- added patches
  fix CVE-2022-2132 [bsc#1202903], DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs
  + dpdk-CVE-2022-2132.patch
  fix CVE-2022-28199 [bsc#1202956], buffer overflow in the vhost code
  + dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1677240000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
  http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
    0001-kni-allow-configuring-thread-granularity.patch
    0001-usertools-read-PCI-device-name-as-UTF-8.patch
    0003-dpdk-fallthrough-comment-fixes.patch
    0004-kni-update-kernel-API-to-set-random-MAC-address.patch
    0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
    0006-kni-use-dedicated-function-to-set-MAC-address.patch
    dpdk-CVE-2021-3839.patch
    dpdk-CVE-2022-0669.patch
    dpdk-CVE-2022-2132.patch
    dpdk-CVE-2022-28199.patch
  * Rebased patches:
    0001-fix-cpu-compatibility.patch
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678276800">- Updated package name:dpdk22 for DPDK version 22.11.1 as legacy DPDK version(v19.11.10) also needs to be supported.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678449600">- Remove redundant obsoletes and unnecessary provides
- Remove obsoleting old dpdk package changes and let user decide.
- Add conflict for the KMP module in preamble</changelog>
  <changelog author="gyribeiro@suse.com" date="1681128000">- Rename name_tag to package_name_tag to avoid conflict with name_tag
  used multibuild</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1716379200">- Fix [bsc#1219990] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="f9d1341622784bf30a3034eaa861c5493ea2b9964bad67ba967e500e9290118b" name="dpdk22-thunderx-doc" arch="noarch">
  <version epoch="0" ver="22.11.1" rel="150500.5.5.3"/>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="sweiberg@suse.com" date="1631275200">- Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651147200">- security update
- added patches
  fix CVE-2021-3839 [bsc#1198963], dpdk: OOB write irelated to vhost communication n vhost_user_set_inflight_fd()
  + dpdk-CVE-2021-3839.patch
  fix CVE-2022-0669 [bsc#1198964], dpdk: DoS by exhausting available fd in vhost-user slave process
  + dpdk-CVE-2022-0669.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1658145600">- aabdallah@suse.com:
  Fix for SG#63176, bsc#1198873: Read PCI device name as UTF strings.
- tabraham@suse.com:
  kni: allow configuring thread granularity (bsc#1195172)
- added patches
  + 0001-kni-allow-configuring-thread-granularity.patch
  + 0001-usertools-read-PCI-device-name-as-UTF-8.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1664366400">- added patch to fix build issue with 15 SP5 kernel (bsc#1203845)
  + 0004-kni-update-kernel-API-to-set-random-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664452800">- fix build with SLE15-SP5 kernel [bsc#1203845]
- added patches
  + 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  + 0006-kni-use-dedicated-function-to-set-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1668772800">- security update
- added patches
  fix CVE-2022-2132 [bsc#1202903], DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs
  + dpdk-CVE-2022-2132.patch
  fix CVE-2022-28199 [bsc#1202956], buffer overflow in the vhost code
  + dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1677240000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
  http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
    0001-kni-allow-configuring-thread-granularity.patch
    0001-usertools-read-PCI-device-name-as-UTF-8.patch
    0003-dpdk-fallthrough-comment-fixes.patch
    0004-kni-update-kernel-API-to-set-random-MAC-address.patch
    0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
    0006-kni-use-dedicated-function-to-set-MAC-address.patch
    dpdk-CVE-2021-3839.patch
    dpdk-CVE-2022-0669.patch
    dpdk-CVE-2022-2132.patch
    dpdk-CVE-2022-28199.patch
  * Rebased patches:
    0001-fix-cpu-compatibility.patch
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678276800">- Updated package name:dpdk22 for DPDK version 22.11.1 as legacy DPDK version(v19.11.10) also needs to be supported.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678449600">- Remove redundant obsoletes and unnecessary provides
- Remove obsoleting old dpdk package changes and let user decide.
- Add conflict for the KMP module in preamble</changelog>
  <changelog author="gyribeiro@suse.com" date="1681128000">- Rename name_tag to package_name_tag to avoid conflict with name_tag
  used multibuild</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1716379200">- Fix [bsc#1219990] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="a7697e012011c635bc492fb984c272363d3685b21c401b36e8d70b2b5d03ac75" name="dpdk22-thunderx-examples" arch="aarch64">
  <version epoch="0" ver="22.11.1" rel="150500.5.5.3"/>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="sweiberg@suse.com" date="1631275200">- Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651147200">- security update
- added patches
  fix CVE-2021-3839 [bsc#1198963], dpdk: OOB write irelated to vhost communication n vhost_user_set_inflight_fd()
  + dpdk-CVE-2021-3839.patch
  fix CVE-2022-0669 [bsc#1198964], dpdk: DoS by exhausting available fd in vhost-user slave process
  + dpdk-CVE-2022-0669.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1658145600">- aabdallah@suse.com:
  Fix for SG#63176, bsc#1198873: Read PCI device name as UTF strings.
- tabraham@suse.com:
  kni: allow configuring thread granularity (bsc#1195172)
- added patches
  + 0001-kni-allow-configuring-thread-granularity.patch
  + 0001-usertools-read-PCI-device-name-as-UTF-8.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1664366400">- added patch to fix build issue with 15 SP5 kernel (bsc#1203845)
  + 0004-kni-update-kernel-API-to-set-random-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664452800">- fix build with SLE15-SP5 kernel [bsc#1203845]
- added patches
  + 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  + 0006-kni-use-dedicated-function-to-set-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1668772800">- security update
- added patches
  fix CVE-2022-2132 [bsc#1202903], DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs
  + dpdk-CVE-2022-2132.patch
  fix CVE-2022-28199 [bsc#1202956], buffer overflow in the vhost code
  + dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1677240000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
  http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
    0001-kni-allow-configuring-thread-granularity.patch
    0001-usertools-read-PCI-device-name-as-UTF-8.patch
    0003-dpdk-fallthrough-comment-fixes.patch
    0004-kni-update-kernel-API-to-set-random-MAC-address.patch
    0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
    0006-kni-use-dedicated-function-to-set-MAC-address.patch
    dpdk-CVE-2021-3839.patch
    dpdk-CVE-2022-0669.patch
    dpdk-CVE-2022-2132.patch
    dpdk-CVE-2022-28199.patch
  * Rebased patches:
    0001-fix-cpu-compatibility.patch
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678276800">- Updated package name:dpdk22 for DPDK version 22.11.1 as legacy DPDK version(v19.11.10) also needs to be supported.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678449600">- Remove redundant obsoletes and unnecessary provides
- Remove obsoleting old dpdk package changes and let user decide.
- Add conflict for the KMP module in preamble</changelog>
  <changelog author="gyribeiro@suse.com" date="1681128000">- Rename name_tag to package_name_tag to avoid conflict with name_tag
  used multibuild</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1716379200">- Fix [bsc#1219990] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="bbe21c74ea7fb631967fb3e3bbf7cdd4255d340d1e2535c6d7f05356aeb8fe3c" name="dpdk22-thunderx-kmp-default" arch="aarch64">
  <version epoch="0" ver="22.11.1_k5.14.21_150500.55.62" rel="150500.5.5.3"/>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="sweiberg@suse.com" date="1631275200">- Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651147200">- security update
- added patches
  fix CVE-2021-3839 [bsc#1198963], dpdk: OOB write irelated to vhost communication n vhost_user_set_inflight_fd()
  + dpdk-CVE-2021-3839.patch
  fix CVE-2022-0669 [bsc#1198964], dpdk: DoS by exhausting available fd in vhost-user slave process
  + dpdk-CVE-2022-0669.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1658145600">- aabdallah@suse.com:
  Fix for SG#63176, bsc#1198873: Read PCI device name as UTF strings.
- tabraham@suse.com:
  kni: allow configuring thread granularity (bsc#1195172)
- added patches
  + 0001-kni-allow-configuring-thread-granularity.patch
  + 0001-usertools-read-PCI-device-name-as-UTF-8.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1664366400">- added patch to fix build issue with 15 SP5 kernel (bsc#1203845)
  + 0004-kni-update-kernel-API-to-set-random-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664452800">- fix build with SLE15-SP5 kernel [bsc#1203845]
- added patches
  + 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  + 0006-kni-use-dedicated-function-to-set-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1668772800">- security update
- added patches
  fix CVE-2022-2132 [bsc#1202903], DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs
  + dpdk-CVE-2022-2132.patch
  fix CVE-2022-28199 [bsc#1202956], buffer overflow in the vhost code
  + dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1677240000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
  http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
    0001-kni-allow-configuring-thread-granularity.patch
    0001-usertools-read-PCI-device-name-as-UTF-8.patch
    0003-dpdk-fallthrough-comment-fixes.patch
    0004-kni-update-kernel-API-to-set-random-MAC-address.patch
    0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
    0006-kni-use-dedicated-function-to-set-MAC-address.patch
    dpdk-CVE-2021-3839.patch
    dpdk-CVE-2022-0669.patch
    dpdk-CVE-2022-2132.patch
    dpdk-CVE-2022-28199.patch
  * Rebased patches:
    0001-fix-cpu-compatibility.patch
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678276800">- Updated package name:dpdk22 for DPDK version 22.11.1 as legacy DPDK version(v19.11.10) also needs to be supported.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678449600">- Remove redundant obsoletes and unnecessary provides
- Remove obsoleting old dpdk package changes and let user decide.
- Add conflict for the KMP module in preamble</changelog>
  <changelog author="gyribeiro@suse.com" date="1681128000">- Rename name_tag to package_name_tag to avoid conflict with name_tag
  used multibuild</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1716379200">- Fix [bsc#1219990] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="1362ead2637db86014c4ae84d97a2023339c2b9779c30b17ff033f38b3162c69" name="dpdk22-thunderx-tools" arch="aarch64">
  <version epoch="0" ver="22.11.1" rel="150500.5.5.3"/>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="sweiberg@suse.com" date="1631275200">- Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651147200">- security update
- added patches
  fix CVE-2021-3839 [bsc#1198963], dpdk: OOB write irelated to vhost communication n vhost_user_set_inflight_fd()
  + dpdk-CVE-2021-3839.patch
  fix CVE-2022-0669 [bsc#1198964], dpdk: DoS by exhausting available fd in vhost-user slave process
  + dpdk-CVE-2022-0669.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1658145600">- aabdallah@suse.com:
  Fix for SG#63176, bsc#1198873: Read PCI device name as UTF strings.
- tabraham@suse.com:
  kni: allow configuring thread granularity (bsc#1195172)
- added patches
  + 0001-kni-allow-configuring-thread-granularity.patch
  + 0001-usertools-read-PCI-device-name-as-UTF-8.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1664366400">- added patch to fix build issue with 15 SP5 kernel (bsc#1203845)
  + 0004-kni-update-kernel-API-to-set-random-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664452800">- fix build with SLE15-SP5 kernel [bsc#1203845]
- added patches
  + 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  + 0006-kni-use-dedicated-function-to-set-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1668772800">- security update
- added patches
  fix CVE-2022-2132 [bsc#1202903], DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs
  + dpdk-CVE-2022-2132.patch
  fix CVE-2022-28199 [bsc#1202956], buffer overflow in the vhost code
  + dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1677240000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
  http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
    0001-kni-allow-configuring-thread-granularity.patch
    0001-usertools-read-PCI-device-name-as-UTF-8.patch
    0003-dpdk-fallthrough-comment-fixes.patch
    0004-kni-update-kernel-API-to-set-random-MAC-address.patch
    0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
    0006-kni-use-dedicated-function-to-set-MAC-address.patch
    dpdk-CVE-2021-3839.patch
    dpdk-CVE-2022-0669.patch
    dpdk-CVE-2022-2132.patch
    dpdk-CVE-2022-28199.patch
  * Rebased patches:
    0001-fix-cpu-compatibility.patch
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678276800">- Updated package name:dpdk22 for DPDK version 22.11.1 as legacy DPDK version(v19.11.10) also needs to be supported.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678449600">- Remove redundant obsoletes and unnecessary provides
- Remove obsoleting old dpdk package changes and let user decide.
- Add conflict for the KMP module in preamble</changelog>
  <changelog author="gyribeiro@suse.com" date="1681128000">- Rename name_tag to package_name_tag to avoid conflict with name_tag
  used multibuild</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1716379200">- Fix [bsc#1219990] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="14a897accb69dee858af3b1ffc9159433358434c920e47b2c6b2cf42fa2e4f5e" name="dpdk22-tools" arch="aarch64">
  <version epoch="0" ver="22.11.1" rel="150500.5.5.3"/>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="sweiberg@suse.com" date="1631275200">- Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651147200">- security update
- added patches
  fix CVE-2021-3839 [bsc#1198963], dpdk: OOB write irelated to vhost communication n vhost_user_set_inflight_fd()
  + dpdk-CVE-2021-3839.patch
  fix CVE-2022-0669 [bsc#1198964], dpdk: DoS by exhausting available fd in vhost-user slave process
  + dpdk-CVE-2022-0669.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1658145600">- aabdallah@suse.com:
  Fix for SG#63176, bsc#1198873: Read PCI device name as UTF strings.
- tabraham@suse.com:
  kni: allow configuring thread granularity (bsc#1195172)
- added patches
  + 0001-kni-allow-configuring-thread-granularity.patch
  + 0001-usertools-read-PCI-device-name-as-UTF-8.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1664366400">- added patch to fix build issue with 15 SP5 kernel (bsc#1203845)
  + 0004-kni-update-kernel-API-to-set-random-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664452800">- fix build with SLE15-SP5 kernel [bsc#1203845]
- added patches
  + 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  + 0006-kni-use-dedicated-function-to-set-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1668772800">- security update
- added patches
  fix CVE-2022-2132 [bsc#1202903], DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs
  + dpdk-CVE-2022-2132.patch
  fix CVE-2022-28199 [bsc#1202956], buffer overflow in the vhost code
  + dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1677240000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
  http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
    0001-kni-allow-configuring-thread-granularity.patch
    0001-usertools-read-PCI-device-name-as-UTF-8.patch
    0003-dpdk-fallthrough-comment-fixes.patch
    0004-kni-update-kernel-API-to-set-random-MAC-address.patch
    0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
    0006-kni-use-dedicated-function-to-set-MAC-address.patch
    dpdk-CVE-2021-3839.patch
    dpdk-CVE-2022-0669.patch
    dpdk-CVE-2022-2132.patch
    dpdk-CVE-2022-28199.patch
  * Rebased patches:
    0001-fix-cpu-compatibility.patch
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678276800">- Updated package name:dpdk22 for DPDK version 22.11.1 as legacy DPDK version(v19.11.10) also needs to be supported.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678449600">- Remove redundant obsoletes and unnecessary provides
- Remove obsoleting old dpdk package changes and let user decide.
- Add conflict for the KMP module in preamble</changelog>
  <changelog author="gyribeiro@suse.com" date="1681128000">- Rename name_tag to package_name_tag to avoid conflict with name_tag
  used multibuild</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1716379200">- Fix [bsc#1219990] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="fc9b681e2a9506e7c97e2f52d0ffbe8e3d6fcfafc1324e5acb64291cc3181c22" name="dpdk22-tools" arch="ppc64le">
  <version epoch="0" ver="22.11.1" rel="150500.5.5.3"/>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="sweiberg@suse.com" date="1631275200">- Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651147200">- security update
- added patches
  fix CVE-2021-3839 [bsc#1198963], dpdk: OOB write irelated to vhost communication n vhost_user_set_inflight_fd()
  + dpdk-CVE-2021-3839.patch
  fix CVE-2022-0669 [bsc#1198964], dpdk: DoS by exhausting available fd in vhost-user slave process
  + dpdk-CVE-2022-0669.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1658145600">- aabdallah@suse.com:
  Fix for SG#63176, bsc#1198873: Read PCI device name as UTF strings.
- tabraham@suse.com:
  kni: allow configuring thread granularity (bsc#1195172)
- added patches
  + 0001-kni-allow-configuring-thread-granularity.patch
  + 0001-usertools-read-PCI-device-name-as-UTF-8.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1664366400">- added patch to fix build issue with 15 SP5 kernel (bsc#1203845)
  + 0004-kni-update-kernel-API-to-set-random-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664452800">- fix build with SLE15-SP5 kernel [bsc#1203845]
- added patches
  + 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  + 0006-kni-use-dedicated-function-to-set-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1668772800">- security update
- added patches
  fix CVE-2022-2132 [bsc#1202903], DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs
  + dpdk-CVE-2022-2132.patch
  fix CVE-2022-28199 [bsc#1202956], buffer overflow in the vhost code
  + dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1677240000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
  http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
    0001-kni-allow-configuring-thread-granularity.patch
    0001-usertools-read-PCI-device-name-as-UTF-8.patch
    0003-dpdk-fallthrough-comment-fixes.patch
    0004-kni-update-kernel-API-to-set-random-MAC-address.patch
    0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
    0006-kni-use-dedicated-function-to-set-MAC-address.patch
    dpdk-CVE-2021-3839.patch
    dpdk-CVE-2022-0669.patch
    dpdk-CVE-2022-2132.patch
    dpdk-CVE-2022-28199.patch
  * Rebased patches:
    0001-fix-cpu-compatibility.patch
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678276800">- Updated package name:dpdk22 for DPDK version 22.11.1 as legacy DPDK version(v19.11.10) also needs to be supported.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678449600">- Remove redundant obsoletes and unnecessary provides
- Remove obsoleting old dpdk package changes and let user decide.
- Add conflict for the KMP module in preamble</changelog>
  <changelog author="gyribeiro@suse.com" date="1681128000">- Rename name_tag to package_name_tag to avoid conflict with name_tag
  used multibuild</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1716379200">- Fix [bsc#1219990] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="3f1a6bee315aa64d1545671f8c7a68506051433fc416895e0a90ed1b7df18d0d" name="dpdk22-tools" arch="x86_64">
  <version epoch="0" ver="22.11.1" rel="150500.5.5.3"/>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert “common/qat: fix GEN3 marketing name”
    Revert “net/bnxt: fix number of TQM ring”
    Revert “net/bnxt: fix TQM ring context memory size”
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- add 0001-kni-fix-build-with-Linux-5.9.patch: fixes the build against kernel
  &gt;= 5.9. Also see here:
  http://inbox.dpdk.org/users/CAJFAV8w8ozEkdSKdBHEHXJDxpChorGa1jUsNEcPMptG30bWykw@mail.gmail.com/T</changelog>
  <changelog author="rpm@fthiessen.de" date="1620993600">- Update LTS version to maintenance release 19.11.8
  * vhost/crypto: fix data length check (CVE-2020-14374)
  * vhost/crypto: fix incorrect descriptor deduction (CVE-2020-14378)
  * vhost/crypto: fix incorrect write back source
  * vhost/crypto: fix missed request check for copy mode
    (CVE-2020-14376 CVE-2020-14377)
  * vhost/crypto: fix pool allocation
  * vhost/crypto: fix possible TOCTOU attack (CVE-2020-14375)
  * Changes from 19.11.6:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id14
  * Changes from 19.11.7:
    https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id18
- Drop security patches, fixed with 19.11.5
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch
- Drop 0001-kni-fix-build-with-Linux-5.9.patch, fixed with 19.11.6
- Updated 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="steven.kowalik@suse.com" date="1626955200">- Normalize all Python script shebangs to use Python 3.</changelog>
  <changelog author="sweiberg@suse.com" date="1631275200">- Update LTS version to maintenance release 19.11.10
  * app/crypto-perf: fix out-of-place mempool allocation
  * app/test: fix IPv6 header initialization
  * app/testpmd: change port link speed without stopping all
  * app/testpmd: fix help string for port reset
  * app/testpmd: fix IPv4 checksum
  * app/testpmd: fix MAC address after port reset
  * app/testpmd: fix offloads for newly attached port
  * app/testpmd: fix Tx checksum calculation for tunnel
  * bitmap: fix buffer overrun in bitmap init
  * bus: clarify log for non-NUMA-aware devices
  * bus/dpaa: fix freeing in FMAN interface destructor
  * common/mlx5: fix compatibility with OFED port query API
  * common/mlx5: fix Netlink port name padding in probing
  * common/mlx5: use new port query API if available
  * cryptodev: fix freeing after device release
  * crypto/mvsam: fix AES-GCM session parameters
  * crypto/mvsam: fix capabilities
  * crypto/mvsam: fix options parsing
  * crypto/mvsam: fix session data reset
  * crypto/octeontx: fix freeing after device release
  * crypto/qat: fix Arm build with special memcpy
  * devtools: fix file listing in maintainers check
  * distributor: fix 128-bit write alignment
  * doc: add limitation for ConnectX-4 with L2 in mlx5 guide
  * doc: announce common prefix for ethdev
  * doc: fix default burst size in testpmd
  * doc: fix spelling
  * drivers/net: fix memzone allocations for DMA memory
  * ethdev: fix doc of flow action
  * eventdev: fix event port setup in tx adapter
  * flow_classify: fix leaking rules on delete
  * (github-cpaelzer-stable/19.11) telemetry: fix race in telemetry control thread creation
  * ipc: stop mp control thread on cleanup
  * kni: fix crash on userspace VA for segmented packets
  * kni: fix mbuf allocation for kernel side use
  * mempool/octeontx2: fix shift calculation
  * net/bnxt: check access to possible null pointer
  * net/bnxt: cleanup code
  * net/bnxt: clear cached statistics
  * net/bnxt: detect bad opaque in Rx completion
  * net/bnxt: fix auto-negotiation on Whitney+
  * net/bnxt: fix check for PTP support in FW
  * net/bnxt: fix error handling in VNIC prepare
  * net/bnxt: fix error messages in VNIC prepare
  * net/bnxt: fix missing barriers in completion handling
  * net/bnxt: fix nested lock during bonding
  * net/bnxt: fix ring and context memory allocation
  * net/bnxt: fix Rx burst size constraint
  * net/bnxt: fix Rx interrupt setting
  * net/bnxt: fix scalar Tx completion handling
  * net/bnxt: fix Tx descriptor status implementation
  * net/bnxt: fix typo in log message
  * net/bnxt: improve probing log message
  * net/bnxt: invoke device removal event on recovery failure
  * net/bnxt: remove unnecessary code
  * net/bnxt: remove unnecessary comment
  * net/bnxt: set flow error after tunnel redirection free
  * net/bnxt: set flow error when free filter not available
  * net/bnxt: use common function to free VNIC resource
  * net/bnxt: workaround spurious zero stats in Thor
  * net/bonding: check flow setting
  * net/bonding: fix error message on flow verify
  * net/ena: enable multi-segment in Tx offload flags
  * net/ena: trigger reset on Tx prepare failure
  * net/hinic/base: fix LRO
  * net/hinic: increase protection of the VLAN
  * net/hns3: fix delay for waiting to stop Rx/Tx
  * net/hns3: fix filter parsing comment
  * net/hns3: fix Tx prepare after stop
  * net/hns3: fix VLAN strip log
  * net/hns3: increase VF reset retry maximum
  * net/i40e: fix descriptor scan on Arm
  * net/i40e: fix multi-process shared data
  * net/iavf: fix RSS key access out of bound
  * net/iavf: fix Tx threshold check
  * net/ice/base: fix first profile mask
  * net/ice/base: revert change of first profile mask
  * net/ice: fix default RSS key generation
  * net/ice: fix memzone leak when firmware is missing
  * net/ixgbe: fix flow entry access after freeing
  * net/mlx5: fix incorrect r/w lock usage in DMA unmap
  * net/mlx5: fix IPIP multi-tunnel validation
  * net/mlx5: fix match MPLS over GRE with key
  * net/mlx5: fix MPLS RSS expansion
  * net/mlx5: fix overflow in mempool argument
  * net/mlx5: fix representor interrupt handler
  * net/mlx5: fix RoCE LAG bond device probing
  * net/mlx5: fix RSS flow item expansion for GRE key
  * net/mlx5: fix Rx/Tx queue checks
  * net/mlx5: fix switchdev mode recognition
  * net/mlx5: fix typo in vectorized Rx comments
  * net/mlx5: limit implicit MPLS RSS expansion over GRE
  * net/mlx5: limit inner RSS expansion for MPLS
  * net/mlx5: remove redundant operations in NEON Rx
  * net/mlx5: remove unsupported flow item MPLS over IP
  * net/mlx5: workaround drop action with old kernel
  * net/mvpp2: fix configured state dependency
  * net/mvpp2: fix port speed overflow
  * net/octeontx2: fix default MCAM allocation size
  * net/octeontx2: fix flow creation limit on CN98xx
  * net/octeontx2: use runtime LSO format indices
  * net/octeontx/base: fix debug build with clang
  * net/pfe: remove unnecessary null check
  * net/sfc: fix MAC stats lock in xstats query by ID
  * net/sfc: fix MAC stats update for stopped device
  * net/sfc: fix reading adapter state without locking
  * net/sfc: fix xstats query by ID according to ethdev
  * net/sfc: fix xstats query by unsorted list of IDs
  * net/softnic: fix connection memory leak
  * net/softnic: fix memory leak as profile is freed
  * net/virtio: fix aarch32 build
  * net/virtio: fix refill order in packed ring datapath
  * net/virtio: report maximum MTU in device info
  * power: fix namespace for internal struct
  * rib: fix max depth IPv6 lookup
  * test/crypto: fix mbuf reset after null check
  * test/crypto: fix mempool size for session-less
  * test/crypto: fix typo in AES case
  * test/crypto: fix typo in ESN case
  * test/mbuf: fix virtual address conversion
  * tests/eal: fix memory leak
  * vhost/crypto: check request pointer before dereference
  * vhost: fix crash on reconnect
  * vhost: fix missing guest pages table NUMA realloc
  * vhost: fix missing memory table NUMA realloc
  * vhost: utilize dynamic memory allocator
  * Changes from 19.11.9:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id25
- rename
  0001-SLE15-SP3-compatibility-patch-for-kni.patch
  to
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- Fix build error with SLE15-SP4 kernel (bsc#1190362):
  0003-dpdk-fallthrough-comment-fixes.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1651147200">- security update
- added patches
  fix CVE-2021-3839 [bsc#1198963], dpdk: OOB write irelated to vhost communication n vhost_user_set_inflight_fd()
  + dpdk-CVE-2021-3839.patch
  fix CVE-2022-0669 [bsc#1198964], dpdk: DoS by exhausting available fd in vhost-user slave process
  + dpdk-CVE-2022-0669.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1658145600">- aabdallah@suse.com:
  Fix for SG#63176, bsc#1198873: Read PCI device name as UTF strings.
- tabraham@suse.com:
  kni: allow configuring thread granularity (bsc#1195172)
- added patches
  + 0001-kni-allow-configuring-thread-granularity.patch
  + 0001-usertools-read-PCI-device-name-as-UTF-8.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1664366400">- added patch to fix build issue with 15 SP5 kernel (bsc#1203845)
  + 0004-kni-update-kernel-API-to-set-random-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1664452800">- fix build with SLE15-SP5 kernel [bsc#1203845]
- added patches
  + 0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
  + 0006-kni-use-dedicated-function-to-set-MAC-address.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1668772800">- security update
- added patches
  fix CVE-2022-2132 [bsc#1202903], DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs
  + dpdk-CVE-2022-2132.patch
  fix CVE-2022-28199 [bsc#1202956], buffer overflow in the vhost code
  + dpdk-CVE-2022-28199.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1677240000">-- Update to LTS release version v22.11.1
  Some of the new features are,
  * Added initial LoongArch architecture support.
  * Added support for multiple mbuf pools per ethdev Rx queue.
  * Added support for congestion management in ethdev.
  * Added protocol header based buffer split.
  * Added proactive error handling mode for ethdev.
  * Added ethdev Rx/Tx descriptor dump API.
  * Added ethdev hairpin memory configuration options.
  * Added new configuration flags for hairpin queues in rte_eth_hairpin_conf:
  * Added strict queue to pre-configuration flow hints.
  * Added configuration for asynchronous flow connection tracking.
  * Added support for queue-based async query in flow API.
  * Added new function rte_flow_async_action_handle_query() to query the action asynchronously.
  * Extended metering and marking support in the flow API.
  * Added flow offload action to route packets to kernel.
  * Updated AF_XDP driver.
  * Updated AMD Pensando ionic driver.
  * Added GVE net PMD.
  * Updated Intel iavf driver.
  * Updated Intel ice driver.
  * Added Intel idpf driver.
  * Updated Marvell cnxk driver.
  * Added Microsoft mana driver.
  * Updated Netronome nfp driver.
  * Added flow API support:
  * Updated NVIDIA mlx5 driver.
  * Updated NXP dpaa2 driver.
  * Updated Wangxun ngbe driver.
  * Added DMA vChannel unconfiguration for async vhost.
  * Added non-blocking notify API to vhost library.
  * Added support for MACsec in rte_security.
  * Added new algorithms to cryptodev.
  * Updated Intel QuickAssist Technology (QAT) crypto driver.
  * Updated Marvell cnxk crypto driver.
  * Updated aesni_mb crypto driver.
  * Updated ipsec_mb crypto driver.
  * Added UADK crypto driver.
  * Added bbdev operation for FFT processing.
  * Added Intel ACC200 bbdev driver.
  * Added eventdev adapter instance get API.
  * Added eventdev Tx adapter queue start/stop API.
  * Added event crypto adapter vectorization support.
  * Added NitroSketch in membership library.
  * Added Intel uncore frequency control API to the power library.
  * Added security performance test application.
  * Updated IPsec sample application.
  * Updated FIPS validation sample application.
  * Rewrote pmdinfo script.
  * More details can be found in
  http://doc.dpdk.org/guides/rel_notes/release_22_11.html
  * Removed the patches as fixed in upstream
    0001-kni-allow-configuring-thread-granularity.patch
    0001-usertools-read-PCI-device-name-as-UTF-8.patch
    0003-dpdk-fallthrough-comment-fixes.patch
    0004-kni-update-kernel-API-to-set-random-MAC-address.patch
    0005-kni-use-dedicated-function-to-set-random-MAC-address.patch
    0006-kni-use-dedicated-function-to-set-MAC-address.patch
    dpdk-CVE-2021-3839.patch
    dpdk-CVE-2022-0669.patch
    dpdk-CVE-2022-2132.patch
    dpdk-CVE-2022-28199.patch
  * Rebased patches:
    0001-fix-cpu-compatibility.patch
  0002-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678276800">- Updated package name:dpdk22 for DPDK version 22.11.1 as legacy DPDK version(v19.11.10) also needs to be supported.</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1678449600">- Remove redundant obsoletes and unnecessary provides
- Remove obsoleting old dpdk package changes and let user decide.
- Add conflict for the KMP module in preamble</changelog>
  <changelog author="gyribeiro@suse.com" date="1681128000">- Rename name_tag to package_name_tag to avoid conflict with name_tag
  used multibuild</changelog>
  <changelog author="dmueller@suse.com" date="1682596800">- raise constraints to 8GB to cover SLE15 builds as well</changelog>
  <changelog author="Duraisankar.pitchumani@suse.com" date="1716379200">- Fix [bsc#1219990] - dpdk_nic_bind ‘python’: No such file or directory
  * Add requires for "which" as dpdk-tools has its dependency</changelog>
</package>
<package pkgid="2f79ea51f1b1b174d3cfd425367da53d43ded32c916d1b9e03afc41d7a422879" name="dracut" arch="aarch64">
  <version epoch="0" ver="059+suse.527.g7870f083" rel="150600.3.3.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
</package>
<package pkgid="6a8181e9ff50ff12dc98177dcc78edfa850671067e030b455f28c27808454cc9" name="dracut" arch="ppc64le">
  <version epoch="0" ver="059+suse.527.g7870f083" rel="150600.3.3.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
</package>
<package pkgid="04613d34513ab82099577cb0b35adf1ee16bc04ac7cd18d6268833c29262e7ed" name="dracut" arch="s390x">
  <version epoch="0" ver="059+suse.527.g7870f083" rel="150600.3.3.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
</package>
<package pkgid="fcac292734542cc52a66f6dfa0c62458cea2278812d449fc0b6171554b15dbf5" name="dracut" arch="src">
  <version epoch="0" ver="059+suse.527.g7870f083" rel="150600.3.3.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
</package>
<package pkgid="2808899c4353bd8a8e3f88c1a2ff3d396078517c25bc5b916988ca8938229548" name="dracut" arch="x86_64">
  <version epoch="0" ver="059+suse.527.g7870f083" rel="150600.3.3.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
</package>
<package pkgid="fac07e9637400cb8824672d1e14edc26659cdc0330e1696fb576f4c7723b9c78" name="dracut" arch="aarch64">
  <version epoch="0" ver="059+suse.531.g48487c31" rel="150600.3.6.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1724414400">- Update to version 059+suse.531.g48487c31:
  * feat(systemd*): include systemd config files from /usr/lib/systemd (bsc#1228398)
  * fix(convertfs): error in conditional expressions (bsc#1228847)</changelog>
</package>
<package pkgid="0aa4131f38655b5a6a2a1ba3101f51915e9232788d240661f7199a509e58e273" name="dracut" arch="ppc64le">
  <version epoch="0" ver="059+suse.531.g48487c31" rel="150600.3.6.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1724414400">- Update to version 059+suse.531.g48487c31:
  * feat(systemd*): include systemd config files from /usr/lib/systemd (bsc#1228398)
  * fix(convertfs): error in conditional expressions (bsc#1228847)</changelog>
</package>
<package pkgid="ad84f59b26ca6ef7ba50e53b7eae935830b8357b296c3493aba835d7bf320eff" name="dracut" arch="s390x">
  <version epoch="0" ver="059+suse.531.g48487c31" rel="150600.3.6.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1724414400">- Update to version 059+suse.531.g48487c31:
  * feat(systemd*): include systemd config files from /usr/lib/systemd (bsc#1228398)
  * fix(convertfs): error in conditional expressions (bsc#1228847)</changelog>
</package>
<package pkgid="74e9e371674feb93a58d91abb1b61c15ad9d329962e204ba597f77ce13f8360e" name="dracut" arch="src">
  <version epoch="0" ver="059+suse.531.g48487c31" rel="150600.3.6.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1724414400">- Update to version 059+suse.531.g48487c31:
  * feat(systemd*): include systemd config files from /usr/lib/systemd (bsc#1228398)
  * fix(convertfs): error in conditional expressions (bsc#1228847)</changelog>
</package>
<package pkgid="036160728ef48f13b3d9ebed7ba25c9102aa490f35859f347b95e07120e09698" name="dracut" arch="x86_64">
  <version epoch="0" ver="059+suse.531.g48487c31" rel="150600.3.6.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1724414400">- Update to version 059+suse.531.g48487c31:
  * feat(systemd*): include systemd config files from /usr/lib/systemd (bsc#1228398)
  * fix(convertfs): error in conditional expressions (bsc#1228847)</changelog>
</package>
<package pkgid="d60245dfd1e1c9282b203a878d146038bc71ff966f7da4bb8fc3a864c1546ec7" name="dracut-extra" arch="aarch64">
  <version epoch="0" ver="059+suse.527.g7870f083" rel="150600.3.3.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
</package>
<package pkgid="2d1eb584aeaed9224757e5d3a2fb752c59c15dd5c945faf17664179d37634a9b" name="dracut-extra" arch="ppc64le">
  <version epoch="0" ver="059+suse.527.g7870f083" rel="150600.3.3.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
</package>
<package pkgid="544e2e7854a831c6ed1525d822938d0ff65587ac583b11ca022ad2fa3db55118" name="dracut-extra" arch="s390x">
  <version epoch="0" ver="059+suse.527.g7870f083" rel="150600.3.3.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
</package>
<package pkgid="ef4d35891ec39f5e7b76bf3c681d0940c2c28e1d1a2aa7e61b8cf752f439a8e2" name="dracut-extra" arch="x86_64">
  <version epoch="0" ver="059+suse.527.g7870f083" rel="150600.3.3.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
</package>
<package pkgid="89066044387980e0a464fc423be94378d763fe613eb3a5f3d9a31946200813b1" name="dracut-extra" arch="aarch64">
  <version epoch="0" ver="059+suse.531.g48487c31" rel="150600.3.6.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1724414400">- Update to version 059+suse.531.g48487c31:
  * feat(systemd*): include systemd config files from /usr/lib/systemd (bsc#1228398)
  * fix(convertfs): error in conditional expressions (bsc#1228847)</changelog>
</package>
<package pkgid="5a68f7247e34c7032310801dd7011b6d33582acce008d8855efce9b2ea6d83e0" name="dracut-extra" arch="ppc64le">
  <version epoch="0" ver="059+suse.531.g48487c31" rel="150600.3.6.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1724414400">- Update to version 059+suse.531.g48487c31:
  * feat(systemd*): include systemd config files from /usr/lib/systemd (bsc#1228398)
  * fix(convertfs): error in conditional expressions (bsc#1228847)</changelog>
</package>
<package pkgid="deb9cc518b7299431926a87318a4b0f56a96b687f148c2a5a34b21b4d2f275bc" name="dracut-extra" arch="s390x">
  <version epoch="0" ver="059+suse.531.g48487c31" rel="150600.3.6.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1724414400">- Update to version 059+suse.531.g48487c31:
  * feat(systemd*): include systemd config files from /usr/lib/systemd (bsc#1228398)
  * fix(convertfs): error in conditional expressions (bsc#1228847)</changelog>
</package>
<package pkgid="1310833a7dfdedb836af42e026c1755cfa8bb8af16beae35b9197e28a764630b" name="dracut-extra" arch="x86_64">
  <version epoch="0" ver="059+suse.531.g48487c31" rel="150600.3.6.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1724414400">- Update to version 059+suse.531.g48487c31:
  * feat(systemd*): include systemd config files from /usr/lib/systemd (bsc#1228398)
  * fix(convertfs): error in conditional expressions (bsc#1228847)</changelog>
</package>
<package pkgid="96eb16c67f57a3a615bebe12bfaee94fefd4204b68bde23412772829ab495500" name="dracut-fips" arch="aarch64">
  <version epoch="0" ver="059+suse.527.g7870f083" rel="150600.3.3.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
</package>
<package pkgid="08baf07b6c47514614c1a6797ac405eef4c9b7fcf83c247e81e2696183505d1a" name="dracut-fips" arch="ppc64le">
  <version epoch="0" ver="059+suse.527.g7870f083" rel="150600.3.3.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
</package>
<package pkgid="a3fac1aa7f733df4e25f45fd0115eb012136a8c63a87a04c9cf233f02653c3b6" name="dracut-fips" arch="s390x">
  <version epoch="0" ver="059+suse.527.g7870f083" rel="150600.3.3.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
</package>
<package pkgid="389b70dec92cff02f143854f350cc9f8858a24f8efd6949feeed0dce9129bd0a" name="dracut-fips" arch="x86_64">
  <version epoch="0" ver="059+suse.527.g7870f083" rel="150600.3.3.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
</package>
<package pkgid="38ecf75040c889bafb353f42fc86e85d3f99cf39a6b0791e38ff815339c2b0e3" name="dracut-fips" arch="aarch64">
  <version epoch="0" ver="059+suse.531.g48487c31" rel="150600.3.6.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1724414400">- Update to version 059+suse.531.g48487c31:
  * feat(systemd*): include systemd config files from /usr/lib/systemd (bsc#1228398)
  * fix(convertfs): error in conditional expressions (bsc#1228847)</changelog>
</package>
<package pkgid="7a55568661f3ab170c7246391b736dffe85022ffb4fc79516b0865de04522f7d" name="dracut-fips" arch="ppc64le">
  <version epoch="0" ver="059+suse.531.g48487c31" rel="150600.3.6.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1724414400">- Update to version 059+suse.531.g48487c31:
  * feat(systemd*): include systemd config files from /usr/lib/systemd (bsc#1228398)
  * fix(convertfs): error in conditional expressions (bsc#1228847)</changelog>
</package>
<package pkgid="96748c759456523fa254c6d705b6a64bc9800d638454f804c7bb3eb0ebf34587" name="dracut-fips" arch="s390x">
  <version epoch="0" ver="059+suse.531.g48487c31" rel="150600.3.6.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1724414400">- Update to version 059+suse.531.g48487c31:
  * feat(systemd*): include systemd config files from /usr/lib/systemd (bsc#1228398)
  * fix(convertfs): error in conditional expressions (bsc#1228847)</changelog>
</package>
<package pkgid="799d2e4eb8759cb79c0767c98532b0b76477f914d379e41521aaf717eff9d782" name="dracut-fips" arch="x86_64">
  <version epoch="0" ver="059+suse.531.g48487c31" rel="150600.3.6.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1724414400">- Update to version 059+suse.531.g48487c31:
  * feat(systemd*): include systemd config files from /usr/lib/systemd (bsc#1228398)
  * fix(convertfs): error in conditional expressions (bsc#1228847)</changelog>
</package>
<package pkgid="080dd3ee7ed427b87dfe4c6f856dfce6ace38a89fbf6007e384d6c7d9307936c" name="dracut-ima" arch="aarch64">
  <version epoch="0" ver="059+suse.527.g7870f083" rel="150600.3.3.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
</package>
<package pkgid="815182acd92b756b319a9f5b9657cc027ad0074eef0c2bb9abe579b58a4fca03" name="dracut-ima" arch="ppc64le">
  <version epoch="0" ver="059+suse.527.g7870f083" rel="150600.3.3.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
</package>
<package pkgid="7de7909645f2b68da4178342cda0a48fce28d843be60838e3250baebc4235b4e" name="dracut-ima" arch="s390x">
  <version epoch="0" ver="059+suse.527.g7870f083" rel="150600.3.3.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
</package>
<package pkgid="ab1b3c0b03bd752ba31020ddf3243e05fd9a82cd7d21fc514c162241294c6a55" name="dracut-ima" arch="x86_64">
  <version epoch="0" ver="059+suse.527.g7870f083" rel="150600.3.3.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
</package>
<package pkgid="5c78caaf4325a99c61228dd07bef49fb14d7400900ca10ead58bd709b98ce2ef" name="dracut-ima" arch="aarch64">
  <version epoch="0" ver="059+suse.531.g48487c31" rel="150600.3.6.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1724414400">- Update to version 059+suse.531.g48487c31:
  * feat(systemd*): include systemd config files from /usr/lib/systemd (bsc#1228398)
  * fix(convertfs): error in conditional expressions (bsc#1228847)</changelog>
</package>
<package pkgid="bb6a35419f9ebd39d0106f18642f0961cd310f89d010a7320f2e0b4030d7b95a" name="dracut-ima" arch="ppc64le">
  <version epoch="0" ver="059+suse.531.g48487c31" rel="150600.3.6.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1724414400">- Update to version 059+suse.531.g48487c31:
  * feat(systemd*): include systemd config files from /usr/lib/systemd (bsc#1228398)
  * fix(convertfs): error in conditional expressions (bsc#1228847)</changelog>
</package>
<package pkgid="90813a1fd70d972f728c45affc76a928cc9be6009f80901ae7338acc7817409f" name="dracut-ima" arch="s390x">
  <version epoch="0" ver="059+suse.531.g48487c31" rel="150600.3.6.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1724414400">- Update to version 059+suse.531.g48487c31:
  * feat(systemd*): include systemd config files from /usr/lib/systemd (bsc#1228398)
  * fix(convertfs): error in conditional expressions (bsc#1228847)</changelog>
</package>
<package pkgid="ff768dfb874ad0b5ab467d96eb1eff113b0e9b1061e314cb7e936ed96448e07e" name="dracut-ima" arch="x86_64">
  <version epoch="0" ver="059+suse.531.g48487c31" rel="150600.3.6.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1724414400">- Update to version 059+suse.531.g48487c31:
  * feat(systemd*): include systemd config files from /usr/lib/systemd (bsc#1228398)
  * fix(convertfs): error in conditional expressions (bsc#1228847)</changelog>
</package>
<package pkgid="6e0a1582549b8a5c9ccc0a30525646aea2956b3176538ef799641e0d80bcc8b9" name="dracut-kiwi-lib" arch="aarch64">
  <version epoch="0" ver="9.24.43" rel="150100.3.81.1"/>
  <changelog author="dcassany@suse.com" date="1681300800">- Adding a comment to explain the s390 specific path
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1688472000">- Add alternative re-reading of the partition table
  To inform the kernel about disk geometry changes, kiwi uses
  partprobe as a primary tool. However it is provided by parted
  and not necessarily available due to the package requirements
  on the dracut module. A second attempt via blockdev which
  is expected to exist is therefore made by this commit
  Part of bsc#1216465
  (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7)</changelog>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698321600">- Create live persistent storage without busy state
  With the former logic the live ISO was already mounted when an
  eventual persistent storage partition was created. This leads
  to an issue on re-reading the partition table, not for all but
  several tools. This commit changes the order of tasks such that
  the setup of the persistent write storage is performed prior
  mounting the live ISO. In addition to this change an alternative
  method using blockdev to re-read the partition was added in case
  partprobe is not present. This also allows to get rid of the
  parted dependency which provides partprobe
  Part of bsc#1216465
  (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698408000">- Change partprobe fallback to partx
  Informing the kernel about a new partition geometry can be done in a
  busy state and is also effective for new devices and new mounts based
  on the new geometry. busy state mounts of course will not see it until
  swap of the busy state but a complete refuse of operation like it
  happens with blockdev is imho not required. Just as partprobe, partx
  is less restrictive on the busy state. That's why this commit changes
  the partprobe fallback to use partx instead of blockdev
  Part of bsc#1216465
  (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698840000">- Add partx to module-setup of kiwi-lib too
  Part of bsc#1216465
  (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1700654400">- Allow install disk overwrite from cmdline
  Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device
  that should be used in an OEM installation. This overwrites any
  other oem device setting, e.g device filter or maxdisk and just
  continues the installation on the given device. However, the
  device must exist and must be a block special.
  This Fixes jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704369600">- Fix overwrite of kiwi_oemunattended
  In case rd.kiwi.oem.installdevice is set, there is an overwrite
  of the kiwi_oemunattended setting. However the variable was set
  in local scope of a function and therefore the change was not
  effective in other methods which also evaluates this variable.
  This commit fixes it such that the overwrite happens in the early
  initialize method which provides the environment for all code
  running in the dracut module. This is related to jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1705579200">- Fixed grub terminal setup
  The grub terminal setup is divided into the setting for the output
  and the input console. For both settings different parameters exists.
  So far kiwi did not differentiate between the two parts of the
  console setup and that could lead to a wrong setting if only one
  value is provided in kiwi's console= attribute which lead to the
  grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm
  grub takes this for both input and output and it's obviously
  wrong for the input. To make this less error prune the kiwi code
  changes with this commit to set GRUB_TERMINAL_INPUT and
  GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity
  checks on the provided values if they are applicable. The information
  for setting up the console in the schema stays untouched though.
  That's because it's used for all bootloaders and also because grub
  supports multiple values for the console in/out setting in one
  GRUB_TERMINAL variable even though kiwi does no longer use it.
  To make this clear for the users also the documentation for the
  console attribute setup has been updated. If we want to wish two
  distinct attributes for input and output console settings a schema
  change and also differentiation between bootloaders is needed and
  that I only see for the kiwi-10 branch if at all. This Fixes #2419
  and Fixes bsc#1218095</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1710849600">- Fixup cleanup of zipl templates
  Make sure temporary modifications to the zipl template
  and config file are not effective in the later system.
  This Fixes bsc#1221469</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1711368000">- Live ISO Wait for udev events after repart
  Make sure to wait for the event queue to become empty after
  the creation of the write partition. When kiwi calls the
  code to create the write partition this emits new udev events.
  It's important to wait for the event queue to become empty
  to avoid a potential regression on the use of the device nodes.
  In the processing of the events it can happen that a device
  gets removed and re-added. If we don't want for udev
  to process the entire queue it can happen that the
  wrong block device is used. This wrong selection is only
  possible because the way how hybrid ISOs are designed exposes
  both, the disk and the partition for the root device with
  the same label. This Fixes bsc#1213595</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1712232000">- Set default output console to gfxterm for grub
  If no console setting is done in the image description for grub
  the default output console is set to: gfxterm and the default
  input console is set to: console. This Fixes bsc#1219074</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427200">- Add rd.kiwi.oem.force_resize boot option
  Forces the disk resize process on an OEM disk image.
  If set, no sanity check for unpartitioned/free space
  is performed and also an eventually configured
  &lt;oem-resize-once&gt; configuration from the image description
  will not be taken into account. This Fixes bsc#1224389</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427201">- Do not exclude the .profile env file by default
  kiwi's initrd modules read a .profile file which gets included
  into the initrd produced at build time. To allow rebuild of a
  host-only initrd from the booted system this information should
  be present such that it is possible to re-use kiwi initrd code.
  This is related to bsc#1228118</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1722427202">- Fix kiwi-repart restrictions
  The kiwi repart dracut module reads a profile file and if it
  does not exists it dies in the initrd. However, that profile
  file is not mandatory for the main resize functionality. Thus
  this commit turns this into a warning message. In addition
  the module-setup for 90kiwi-repart makes sure to include
  the required and optional profile files.
  This Fixes bsc#1228118</changelog>
</package>
<package pkgid="0b9500ddb1976a154d0fc41306f793bb144e9381705ea5a5c4ab78ff79a5de14" name="dracut-kiwi-lib" arch="ppc64le">
  <version epoch="0" ver="9.24.43" rel="150100.3.81.1"/>
  <changelog author="dcassany@suse.com" date="1681300800">- Adding a comment to explain the s390 specific path
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1688472000">- Add alternative re-reading of the partition table
  To inform the kernel about disk geometry changes, kiwi uses
  partprobe as a primary tool. However it is provided by parted
  and not necessarily available due to the package requirements
  on the dracut module. A second attempt via blockdev which
  is expected to exist is therefore made by this commit
  Part of bsc#1216465
  (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7)</changelog>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698321600">- Create live persistent storage without busy state
  With the former logic the live ISO was already mounted when an
  eventual persistent storage partition was created. This leads
  to an issue on re-reading the partition table, not for all but
  several tools. This commit changes the order of tasks such that
  the setup of the persistent write storage is performed prior
  mounting the live ISO. In addition to this change an alternative
  method using blockdev to re-read the partition was added in case
  partprobe is not present. This also allows to get rid of the
  parted dependency which provides partprobe
  Part of bsc#1216465
  (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698408000">- Change partprobe fallback to partx
  Informing the kernel about a new partition geometry can be done in a
  busy state and is also effective for new devices and new mounts based
  on the new geometry. busy state mounts of course will not see it until
  swap of the busy state but a complete refuse of operation like it
  happens with blockdev is imho not required. Just as partprobe, partx
  is less restrictive on the busy state. That's why this commit changes
  the partprobe fallback to use partx instead of blockdev
  Part of bsc#1216465
  (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698840000">- Add partx to module-setup of kiwi-lib too
  Part of bsc#1216465
  (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1700654400">- Allow install disk overwrite from cmdline
  Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device
  that should be used in an OEM installation. This overwrites any
  other oem device setting, e.g device filter or maxdisk and just
  continues the installation on the given device. However, the
  device must exist and must be a block special.
  This Fixes jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704369600">- Fix overwrite of kiwi_oemunattended
  In case rd.kiwi.oem.installdevice is set, there is an overwrite
  of the kiwi_oemunattended setting. However the variable was set
  in local scope of a function and therefore the change was not
  effective in other methods which also evaluates this variable.
  This commit fixes it such that the overwrite happens in the early
  initialize method which provides the environment for all code
  running in the dracut module. This is related to jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1705579200">- Fixed grub terminal setup
  The grub terminal setup is divided into the setting for the output
  and the input console. For both settings different parameters exists.
  So far kiwi did not differentiate between the two parts of the
  console setup and that could lead to a wrong setting if only one
  value is provided in kiwi's console= attribute which lead to the
  grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm
  grub takes this for both input and output and it's obviously
  wrong for the input. To make this less error prune the kiwi code
  changes with this commit to set GRUB_TERMINAL_INPUT and
  GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity
  checks on the provided values if they are applicable. The information
  for setting up the console in the schema stays untouched though.
  That's because it's used for all bootloaders and also because grub
  supports multiple values for the console in/out setting in one
  GRUB_TERMINAL variable even though kiwi does no longer use it.
  To make this clear for the users also the documentation for the
  console attribute setup has been updated. If we want to wish two
  distinct attributes for input and output console settings a schema
  change and also differentiation between bootloaders is needed and
  that I only see for the kiwi-10 branch if at all. This Fixes #2419
  and Fixes bsc#1218095</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1710849600">- Fixup cleanup of zipl templates
  Make sure temporary modifications to the zipl template
  and config file are not effective in the later system.
  This Fixes bsc#1221469</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1711368000">- Live ISO Wait for udev events after repart
  Make sure to wait for the event queue to become empty after
  the creation of the write partition. When kiwi calls the
  code to create the write partition this emits new udev events.
  It's important to wait for the event queue to become empty
  to avoid a potential regression on the use of the device nodes.
  In the processing of the events it can happen that a device
  gets removed and re-added. If we don't want for udev
  to process the entire queue it can happen that the
  wrong block device is used. This wrong selection is only
  possible because the way how hybrid ISOs are designed exposes
  both, the disk and the partition for the root device with
  the same label. This Fixes bsc#1213595</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1712232000">- Set default output console to gfxterm for grub
  If no console setting is done in the image description for grub
  the default output console is set to: gfxterm and the default
  input console is set to: console. This Fixes bsc#1219074</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427200">- Add rd.kiwi.oem.force_resize boot option
  Forces the disk resize process on an OEM disk image.
  If set, no sanity check for unpartitioned/free space
  is performed and also an eventually configured
  &lt;oem-resize-once&gt; configuration from the image description
  will not be taken into account. This Fixes bsc#1224389</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427201">- Do not exclude the .profile env file by default
  kiwi's initrd modules read a .profile file which gets included
  into the initrd produced at build time. To allow rebuild of a
  host-only initrd from the booted system this information should
  be present such that it is possible to re-use kiwi initrd code.
  This is related to bsc#1228118</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1722427202">- Fix kiwi-repart restrictions
  The kiwi repart dracut module reads a profile file and if it
  does not exists it dies in the initrd. However, that profile
  file is not mandatory for the main resize functionality. Thus
  this commit turns this into a warning message. In addition
  the module-setup for 90kiwi-repart makes sure to include
  the required and optional profile files.
  This Fixes bsc#1228118</changelog>
</package>
<package pkgid="8c217080c6bad199a9e5ca77c8e28a3cbc2717939c394341b8510ddfee14c65c" name="dracut-kiwi-lib" arch="s390x">
  <version epoch="0" ver="9.24.43" rel="150100.3.81.1"/>
  <changelog author="dcassany@suse.com" date="1681300800">- Adding a comment to explain the s390 specific path
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1688472000">- Add alternative re-reading of the partition table
  To inform the kernel about disk geometry changes, kiwi uses
  partprobe as a primary tool. However it is provided by parted
  and not necessarily available due to the package requirements
  on the dracut module. A second attempt via blockdev which
  is expected to exist is therefore made by this commit
  Part of bsc#1216465
  (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7)</changelog>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698321600">- Create live persistent storage without busy state
  With the former logic the live ISO was already mounted when an
  eventual persistent storage partition was created. This leads
  to an issue on re-reading the partition table, not for all but
  several tools. This commit changes the order of tasks such that
  the setup of the persistent write storage is performed prior
  mounting the live ISO. In addition to this change an alternative
  method using blockdev to re-read the partition was added in case
  partprobe is not present. This also allows to get rid of the
  parted dependency which provides partprobe
  Part of bsc#1216465
  (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698408000">- Change partprobe fallback to partx
  Informing the kernel about a new partition geometry can be done in a
  busy state and is also effective for new devices and new mounts based
  on the new geometry. busy state mounts of course will not see it until
  swap of the busy state but a complete refuse of operation like it
  happens with blockdev is imho not required. Just as partprobe, partx
  is less restrictive on the busy state. That's why this commit changes
  the partprobe fallback to use partx instead of blockdev
  Part of bsc#1216465
  (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698840000">- Add partx to module-setup of kiwi-lib too
  Part of bsc#1216465
  (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1700654400">- Allow install disk overwrite from cmdline
  Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device
  that should be used in an OEM installation. This overwrites any
  other oem device setting, e.g device filter or maxdisk and just
  continues the installation on the given device. However, the
  device must exist and must be a block special.
  This Fixes jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704369600">- Fix overwrite of kiwi_oemunattended
  In case rd.kiwi.oem.installdevice is set, there is an overwrite
  of the kiwi_oemunattended setting. However the variable was set
  in local scope of a function and therefore the change was not
  effective in other methods which also evaluates this variable.
  This commit fixes it such that the overwrite happens in the early
  initialize method which provides the environment for all code
  running in the dracut module. This is related to jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1705579200">- Fixed grub terminal setup
  The grub terminal setup is divided into the setting for the output
  and the input console. For both settings different parameters exists.
  So far kiwi did not differentiate between the two parts of the
  console setup and that could lead to a wrong setting if only one
  value is provided in kiwi's console= attribute which lead to the
  grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm
  grub takes this for both input and output and it's obviously
  wrong for the input. To make this less error prune the kiwi code
  changes with this commit to set GRUB_TERMINAL_INPUT and
  GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity
  checks on the provided values if they are applicable. The information
  for setting up the console in the schema stays untouched though.
  That's because it's used for all bootloaders and also because grub
  supports multiple values for the console in/out setting in one
  GRUB_TERMINAL variable even though kiwi does no longer use it.
  To make this clear for the users also the documentation for the
  console attribute setup has been updated. If we want to wish two
  distinct attributes for input and output console settings a schema
  change and also differentiation between bootloaders is needed and
  that I only see for the kiwi-10 branch if at all. This Fixes #2419
  and Fixes bsc#1218095</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1710849600">- Fixup cleanup of zipl templates
  Make sure temporary modifications to the zipl template
  and config file are not effective in the later system.
  This Fixes bsc#1221469</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1711368000">- Live ISO Wait for udev events after repart
  Make sure to wait for the event queue to become empty after
  the creation of the write partition. When kiwi calls the
  code to create the write partition this emits new udev events.
  It's important to wait for the event queue to become empty
  to avoid a potential regression on the use of the device nodes.
  In the processing of the events it can happen that a device
  gets removed and re-added. If we don't want for udev
  to process the entire queue it can happen that the
  wrong block device is used. This wrong selection is only
  possible because the way how hybrid ISOs are designed exposes
  both, the disk and the partition for the root device with
  the same label. This Fixes bsc#1213595</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1712232000">- Set default output console to gfxterm for grub
  If no console setting is done in the image description for grub
  the default output console is set to: gfxterm and the default
  input console is set to: console. This Fixes bsc#1219074</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427200">- Add rd.kiwi.oem.force_resize boot option
  Forces the disk resize process on an OEM disk image.
  If set, no sanity check for unpartitioned/free space
  is performed and also an eventually configured
  &lt;oem-resize-once&gt; configuration from the image description
  will not be taken into account. This Fixes bsc#1224389</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427201">- Do not exclude the .profile env file by default
  kiwi's initrd modules read a .profile file which gets included
  into the initrd produced at build time. To allow rebuild of a
  host-only initrd from the booted system this information should
  be present such that it is possible to re-use kiwi initrd code.
  This is related to bsc#1228118</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1722427202">- Fix kiwi-repart restrictions
  The kiwi repart dracut module reads a profile file and if it
  does not exists it dies in the initrd. However, that profile
  file is not mandatory for the main resize functionality. Thus
  this commit turns this into a warning message. In addition
  the module-setup for 90kiwi-repart makes sure to include
  the required and optional profile files.
  This Fixes bsc#1228118</changelog>
</package>
<package pkgid="e695b277768c401210fa72349ab30ab189993a36b06dd9bc3ca52cf314b57b84" name="dracut-kiwi-lib" arch="x86_64">
  <version epoch="0" ver="9.24.43" rel="150100.3.81.1"/>
  <changelog author="dcassany@suse.com" date="1681300800">- Adding a comment to explain the s390 specific path
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1688472000">- Add alternative re-reading of the partition table
  To inform the kernel about disk geometry changes, kiwi uses
  partprobe as a primary tool. However it is provided by parted
  and not necessarily available due to the package requirements
  on the dracut module. A second attempt via blockdev which
  is expected to exist is therefore made by this commit
  Part of bsc#1216465
  (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7)</changelog>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698321600">- Create live persistent storage without busy state
  With the former logic the live ISO was already mounted when an
  eventual persistent storage partition was created. This leads
  to an issue on re-reading the partition table, not for all but
  several tools. This commit changes the order of tasks such that
  the setup of the persistent write storage is performed prior
  mounting the live ISO. In addition to this change an alternative
  method using blockdev to re-read the partition was added in case
  partprobe is not present. This also allows to get rid of the
  parted dependency which provides partprobe
  Part of bsc#1216465
  (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698408000">- Change partprobe fallback to partx
  Informing the kernel about a new partition geometry can be done in a
  busy state and is also effective for new devices and new mounts based
  on the new geometry. busy state mounts of course will not see it until
  swap of the busy state but a complete refuse of operation like it
  happens with blockdev is imho not required. Just as partprobe, partx
  is less restrictive on the busy state. That's why this commit changes
  the partprobe fallback to use partx instead of blockdev
  Part of bsc#1216465
  (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698840000">- Add partx to module-setup of kiwi-lib too
  Part of bsc#1216465
  (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1700654400">- Allow install disk overwrite from cmdline
  Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device
  that should be used in an OEM installation. This overwrites any
  other oem device setting, e.g device filter or maxdisk and just
  continues the installation on the given device. However, the
  device must exist and must be a block special.
  This Fixes jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704369600">- Fix overwrite of kiwi_oemunattended
  In case rd.kiwi.oem.installdevice is set, there is an overwrite
  of the kiwi_oemunattended setting. However the variable was set
  in local scope of a function and therefore the change was not
  effective in other methods which also evaluates this variable.
  This commit fixes it such that the overwrite happens in the early
  initialize method which provides the environment for all code
  running in the dracut module. This is related to jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1705579200">- Fixed grub terminal setup
  The grub terminal setup is divided into the setting for the output
  and the input console. For both settings different parameters exists.
  So far kiwi did not differentiate between the two parts of the
  console setup and that could lead to a wrong setting if only one
  value is provided in kiwi's console= attribute which lead to the
  grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm
  grub takes this for both input and output and it's obviously
  wrong for the input. To make this less error prune the kiwi code
  changes with this commit to set GRUB_TERMINAL_INPUT and
  GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity
  checks on the provided values if they are applicable. The information
  for setting up the console in the schema stays untouched though.
  That's because it's used for all bootloaders and also because grub
  supports multiple values for the console in/out setting in one
  GRUB_TERMINAL variable even though kiwi does no longer use it.
  To make this clear for the users also the documentation for the
  console attribute setup has been updated. If we want to wish two
  distinct attributes for input and output console settings a schema
  change and also differentiation between bootloaders is needed and
  that I only see for the kiwi-10 branch if at all. This Fixes #2419
  and Fixes bsc#1218095</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1710849600">- Fixup cleanup of zipl templates
  Make sure temporary modifications to the zipl template
  and config file are not effective in the later system.
  This Fixes bsc#1221469</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1711368000">- Live ISO Wait for udev events after repart
  Make sure to wait for the event queue to become empty after
  the creation of the write partition. When kiwi calls the
  code to create the write partition this emits new udev events.
  It's important to wait for the event queue to become empty
  to avoid a potential regression on the use of the device nodes.
  In the processing of the events it can happen that a device
  gets removed and re-added. If we don't want for udev
  to process the entire queue it can happen that the
  wrong block device is used. This wrong selection is only
  possible because the way how hybrid ISOs are designed exposes
  both, the disk and the partition for the root device with
  the same label. This Fixes bsc#1213595</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1712232000">- Set default output console to gfxterm for grub
  If no console setting is done in the image description for grub
  the default output console is set to: gfxterm and the default
  input console is set to: console. This Fixes bsc#1219074</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427200">- Add rd.kiwi.oem.force_resize boot option
  Forces the disk resize process on an OEM disk image.
  If set, no sanity check for unpartitioned/free space
  is performed and also an eventually configured
  &lt;oem-resize-once&gt; configuration from the image description
  will not be taken into account. This Fixes bsc#1224389</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427201">- Do not exclude the .profile env file by default
  kiwi's initrd modules read a .profile file which gets included
  into the initrd produced at build time. To allow rebuild of a
  host-only initrd from the booted system this information should
  be present such that it is possible to re-use kiwi initrd code.
  This is related to bsc#1228118</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1722427202">- Fix kiwi-repart restrictions
  The kiwi repart dracut module reads a profile file and if it
  does not exists it dies in the initrd. However, that profile
  file is not mandatory for the main resize functionality. Thus
  this commit turns this into a warning message. In addition
  the module-setup for 90kiwi-repart makes sure to include
  the required and optional profile files.
  This Fixes bsc#1228118</changelog>
</package>
<package pkgid="fbe524d219ddc909d6c73aad24a088435adeb75f59f2b91c79d8a9f5a970d667" name="dracut-kiwi-lib" arch="aarch64">
  <version epoch="0" ver="9.24.43" rel="150100.3.84.1"/>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698321600">- Create live persistent storage without busy state
  With the former logic the live ISO was already mounted when an
  eventual persistent storage partition was created. This leads
  to an issue on re-reading the partition table, not for all but
  several tools. This commit changes the order of tasks such that
  the setup of the persistent write storage is performed prior
  mounting the live ISO. In addition to this change an alternative
  method using blockdev to re-read the partition was added in case
  partprobe is not present. This also allows to get rid of the
  parted dependency which provides partprobe
  Part of bsc#1216465
  (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698408000">- Change partprobe fallback to partx
  Informing the kernel about a new partition geometry can be done in a
  busy state and is also effective for new devices and new mounts based
  on the new geometry. busy state mounts of course will not see it until
  swap of the busy state but a complete refuse of operation like it
  happens with blockdev is imho not required. Just as partprobe, partx
  is less restrictive on the busy state. That's why this commit changes
  the partprobe fallback to use partx instead of blockdev
  Part of bsc#1216465
  (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698840000">- Add partx to module-setup of kiwi-lib too
  Part of bsc#1216465
  (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1700654400">- Allow install disk overwrite from cmdline
  Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device
  that should be used in an OEM installation. This overwrites any
  other oem device setting, e.g device filter or maxdisk and just
  continues the installation on the given device. However, the
  device must exist and must be a block special.
  This Fixes jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704369600">- Fix overwrite of kiwi_oemunattended
  In case rd.kiwi.oem.installdevice is set, there is an overwrite
  of the kiwi_oemunattended setting. However the variable was set
  in local scope of a function and therefore the change was not
  effective in other methods which also evaluates this variable.
  This commit fixes it such that the overwrite happens in the early
  initialize method which provides the environment for all code
  running in the dracut module. This is related to jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704801600">- Fixed regression in GRUB_SERIAL_COMMAND setup
  The condition to write the serial line setup was broken.
  This commit fixes it. Related to Issue #2419 and
  Fixes bsc#1228808</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1705579200">- Fixed grub terminal setup
  The grub terminal setup is divided into the setting for the output
  and the input console. For both settings different parameters exists.
  So far kiwi did not differentiate between the two parts of the
  console setup and that could lead to a wrong setting if only one
  value is provided in kiwi's console= attribute which lead to the
  grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm
  grub takes this for both input and output and it's obviously
  wrong for the input. To make this less error prune the kiwi code
  changes with this commit to set GRUB_TERMINAL_INPUT and
  GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity
  checks on the provided values if they are applicable. The information
  for setting up the console in the schema stays untouched though.
  That's because it's used for all bootloaders and also because grub
  supports multiple values for the console in/out setting in one
  GRUB_TERMINAL variable even though kiwi does no longer use it.
  To make this clear for the users also the documentation for the
  console attribute setup has been updated. If we want to wish two
  distinct attributes for input and output console settings a schema
  change and also differentiation between bootloaders is needed and
  that I only see for the kiwi-10 branch if at all. This Fixes #2419
  and Fixes bsc#1218095</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1710849600">- Fixup cleanup of zipl templates
  Make sure temporary modifications to the zipl template
  and config file are not effective in the later system.
  This Fixes bsc#1221469</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1711368000">- Live ISO Wait for udev events after repart
  Make sure to wait for the event queue to become empty after
  the creation of the write partition. When kiwi calls the
  code to create the write partition this emits new udev events.
  It's important to wait for the event queue to become empty
  to avoid a potential regression on the use of the device nodes.
  In the processing of the events it can happen that a device
  gets removed and re-added. If we don't want for udev
  to process the entire queue it can happen that the
  wrong block device is used. This wrong selection is only
  possible because the way how hybrid ISOs are designed exposes
  both, the disk and the partition for the root device with
  the same label. This Fixes bsc#1213595</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1712232000">- Set default output console to gfxterm for grub
  If no console setting is done in the image description for grub
  the default output console is set to: gfxterm and the default
  input console is set to: console. This Fixes bsc#1219074</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427200">- Add rd.kiwi.oem.force_resize boot option
  Forces the disk resize process on an OEM disk image.
  If set, no sanity check for unpartitioned/free space
  is performed and also an eventually configured
  &lt;oem-resize-once&gt; configuration from the image description
  will not be taken into account. This Fixes bsc#1224389</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427201">- Do not exclude the .profile env file by default
  kiwi's initrd modules read a .profile file which gets included
  into the initrd produced at build time. To allow rebuild of a
  host-only initrd from the booted system this information should
  be present such that it is possible to re-use kiwi initrd code.
  This is related to bsc#1228118</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1722427202">- Fix kiwi-repart restrictions
  The kiwi repart dracut module reads a profile file and if it
  does not exists it dies in the initrd. However, that profile
  file is not mandatory for the main resize functionality. Thus
  this commit turns this into a warning message. In addition
  the module-setup for 90kiwi-repart makes sure to include
  the required and optional profile files.
  This Fixes bsc#1228118</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1723118400">- Update virtualenv setup
  types-pkg_resources got dropped from PyPI</changelog>
</package>
<package pkgid="f67c5c1d706b4a8cb48058931b32388918cc60abfa1ba86e39310e5c9f736307" name="dracut-kiwi-lib" arch="ppc64le">
  <version epoch="0" ver="9.24.43" rel="150100.3.84.1"/>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698321600">- Create live persistent storage without busy state
  With the former logic the live ISO was already mounted when an
  eventual persistent storage partition was created. This leads
  to an issue on re-reading the partition table, not for all but
  several tools. This commit changes the order of tasks such that
  the setup of the persistent write storage is performed prior
  mounting the live ISO. In addition to this change an alternative
  method using blockdev to re-read the partition was added in case
  partprobe is not present. This also allows to get rid of the
  parted dependency which provides partprobe
  Part of bsc#1216465
  (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698408000">- Change partprobe fallback to partx
  Informing the kernel about a new partition geometry can be done in a
  busy state and is also effective for new devices and new mounts based
  on the new geometry. busy state mounts of course will not see it until
  swap of the busy state but a complete refuse of operation like it
  happens with blockdev is imho not required. Just as partprobe, partx
  is less restrictive on the busy state. That's why this commit changes
  the partprobe fallback to use partx instead of blockdev
  Part of bsc#1216465
  (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698840000">- Add partx to module-setup of kiwi-lib too
  Part of bsc#1216465
  (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1700654400">- Allow install disk overwrite from cmdline
  Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device
  that should be used in an OEM installation. This overwrites any
  other oem device setting, e.g device filter or maxdisk and just
  continues the installation on the given device. However, the
  device must exist and must be a block special.
  This Fixes jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704369600">- Fix overwrite of kiwi_oemunattended
  In case rd.kiwi.oem.installdevice is set, there is an overwrite
  of the kiwi_oemunattended setting. However the variable was set
  in local scope of a function and therefore the change was not
  effective in other methods which also evaluates this variable.
  This commit fixes it such that the overwrite happens in the early
  initialize method which provides the environment for all code
  running in the dracut module. This is related to jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704801600">- Fixed regression in GRUB_SERIAL_COMMAND setup
  The condition to write the serial line setup was broken.
  This commit fixes it. Related to Issue #2419 and
  Fixes bsc#1228808</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1705579200">- Fixed grub terminal setup
  The grub terminal setup is divided into the setting for the output
  and the input console. For both settings different parameters exists.
  So far kiwi did not differentiate between the two parts of the
  console setup and that could lead to a wrong setting if only one
  value is provided in kiwi's console= attribute which lead to the
  grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm
  grub takes this for both input and output and it's obviously
  wrong for the input. To make this less error prune the kiwi code
  changes with this commit to set GRUB_TERMINAL_INPUT and
  GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity
  checks on the provided values if they are applicable. The information
  for setting up the console in the schema stays untouched though.
  That's because it's used for all bootloaders and also because grub
  supports multiple values for the console in/out setting in one
  GRUB_TERMINAL variable even though kiwi does no longer use it.
  To make this clear for the users also the documentation for the
  console attribute setup has been updated. If we want to wish two
  distinct attributes for input and output console settings a schema
  change and also differentiation between bootloaders is needed and
  that I only see for the kiwi-10 branch if at all. This Fixes #2419
  and Fixes bsc#1218095</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1710849600">- Fixup cleanup of zipl templates
  Make sure temporary modifications to the zipl template
  and config file are not effective in the later system.
  This Fixes bsc#1221469</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1711368000">- Live ISO Wait for udev events after repart
  Make sure to wait for the event queue to become empty after
  the creation of the write partition. When kiwi calls the
  code to create the write partition this emits new udev events.
  It's important to wait for the event queue to become empty
  to avoid a potential regression on the use of the device nodes.
  In the processing of the events it can happen that a device
  gets removed and re-added. If we don't want for udev
  to process the entire queue it can happen that the
  wrong block device is used. This wrong selection is only
  possible because the way how hybrid ISOs are designed exposes
  both, the disk and the partition for the root device with
  the same label. This Fixes bsc#1213595</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1712232000">- Set default output console to gfxterm for grub
  If no console setting is done in the image description for grub
  the default output console is set to: gfxterm and the default
  input console is set to: console. This Fixes bsc#1219074</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427200">- Add rd.kiwi.oem.force_resize boot option
  Forces the disk resize process on an OEM disk image.
  If set, no sanity check for unpartitioned/free space
  is performed and also an eventually configured
  &lt;oem-resize-once&gt; configuration from the image description
  will not be taken into account. This Fixes bsc#1224389</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427201">- Do not exclude the .profile env file by default
  kiwi's initrd modules read a .profile file which gets included
  into the initrd produced at build time. To allow rebuild of a
  host-only initrd from the booted system this information should
  be present such that it is possible to re-use kiwi initrd code.
  This is related to bsc#1228118</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1722427202">- Fix kiwi-repart restrictions
  The kiwi repart dracut module reads a profile file and if it
  does not exists it dies in the initrd. However, that profile
  file is not mandatory for the main resize functionality. Thus
  this commit turns this into a warning message. In addition
  the module-setup for 90kiwi-repart makes sure to include
  the required and optional profile files.
  This Fixes bsc#1228118</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1723118400">- Update virtualenv setup
  types-pkg_resources got dropped from PyPI</changelog>
</package>
<package pkgid="5eb81919be3c34b30adc824c0ed5b47e387d31a41d74bfa2bd8333b860f05463" name="dracut-kiwi-lib" arch="s390x">
  <version epoch="0" ver="9.24.43" rel="150100.3.84.1"/>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698321600">- Create live persistent storage without busy state
  With the former logic the live ISO was already mounted when an
  eventual persistent storage partition was created. This leads
  to an issue on re-reading the partition table, not for all but
  several tools. This commit changes the order of tasks such that
  the setup of the persistent write storage is performed prior
  mounting the live ISO. In addition to this change an alternative
  method using blockdev to re-read the partition was added in case
  partprobe is not present. This also allows to get rid of the
  parted dependency which provides partprobe
  Part of bsc#1216465
  (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698408000">- Change partprobe fallback to partx
  Informing the kernel about a new partition geometry can be done in a
  busy state and is also effective for new devices and new mounts based
  on the new geometry. busy state mounts of course will not see it until
  swap of the busy state but a complete refuse of operation like it
  happens with blockdev is imho not required. Just as partprobe, partx
  is less restrictive on the busy state. That's why this commit changes
  the partprobe fallback to use partx instead of blockdev
  Part of bsc#1216465
  (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698840000">- Add partx to module-setup of kiwi-lib too
  Part of bsc#1216465
  (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1700654400">- Allow install disk overwrite from cmdline
  Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device
  that should be used in an OEM installation. This overwrites any
  other oem device setting, e.g device filter or maxdisk and just
  continues the installation on the given device. However, the
  device must exist and must be a block special.
  This Fixes jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704369600">- Fix overwrite of kiwi_oemunattended
  In case rd.kiwi.oem.installdevice is set, there is an overwrite
  of the kiwi_oemunattended setting. However the variable was set
  in local scope of a function and therefore the change was not
  effective in other methods which also evaluates this variable.
  This commit fixes it such that the overwrite happens in the early
  initialize method which provides the environment for all code
  running in the dracut module. This is related to jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704801600">- Fixed regression in GRUB_SERIAL_COMMAND setup
  The condition to write the serial line setup was broken.
  This commit fixes it. Related to Issue #2419 and
  Fixes bsc#1228808</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1705579200">- Fixed grub terminal setup
  The grub terminal setup is divided into the setting for the output
  and the input console. For both settings different parameters exists.
  So far kiwi did not differentiate between the two parts of the
  console setup and that could lead to a wrong setting if only one
  value is provided in kiwi's console= attribute which lead to the
  grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm
  grub takes this for both input and output and it's obviously
  wrong for the input. To make this less error prune the kiwi code
  changes with this commit to set GRUB_TERMINAL_INPUT and
  GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity
  checks on the provided values if they are applicable. The information
  for setting up the console in the schema stays untouched though.
  That's because it's used for all bootloaders and also because grub
  supports multiple values for the console in/out setting in one
  GRUB_TERMINAL variable even though kiwi does no longer use it.
  To make this clear for the users also the documentation for the
  console attribute setup has been updated. If we want to wish two
  distinct attributes for input and output console settings a schema
  change and also differentiation between bootloaders is needed and
  that I only see for the kiwi-10 branch if at all. This Fixes #2419
  and Fixes bsc#1218095</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1710849600">- Fixup cleanup of zipl templates
  Make sure temporary modifications to the zipl template
  and config file are not effective in the later system.
  This Fixes bsc#1221469</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1711368000">- Live ISO Wait for udev events after repart
  Make sure to wait for the event queue to become empty after
  the creation of the write partition. When kiwi calls the
  code to create the write partition this emits new udev events.
  It's important to wait for the event queue to become empty
  to avoid a potential regression on the use of the device nodes.
  In the processing of the events it can happen that a device
  gets removed and re-added. If we don't want for udev
  to process the entire queue it can happen that the
  wrong block device is used. This wrong selection is only
  possible because the way how hybrid ISOs are designed exposes
  both, the disk and the partition for the root device with
  the same label. This Fixes bsc#1213595</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1712232000">- Set default output console to gfxterm for grub
  If no console setting is done in the image description for grub
  the default output console is set to: gfxterm and the default
  input console is set to: console. This Fixes bsc#1219074</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427200">- Add rd.kiwi.oem.force_resize boot option
  Forces the disk resize process on an OEM disk image.
  If set, no sanity check for unpartitioned/free space
  is performed and also an eventually configured
  &lt;oem-resize-once&gt; configuration from the image description
  will not be taken into account. This Fixes bsc#1224389</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427201">- Do not exclude the .profile env file by default
  kiwi's initrd modules read a .profile file which gets included
  into the initrd produced at build time. To allow rebuild of a
  host-only initrd from the booted system this information should
  be present such that it is possible to re-use kiwi initrd code.
  This is related to bsc#1228118</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1722427202">- Fix kiwi-repart restrictions
  The kiwi repart dracut module reads a profile file and if it
  does not exists it dies in the initrd. However, that profile
  file is not mandatory for the main resize functionality. Thus
  this commit turns this into a warning message. In addition
  the module-setup for 90kiwi-repart makes sure to include
  the required and optional profile files.
  This Fixes bsc#1228118</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1723118400">- Update virtualenv setup
  types-pkg_resources got dropped from PyPI</changelog>
</package>
<package pkgid="560647ac6c9e76d985af005e55c7e6c3ae95bb83fb29273ecbb8fc3f2a425d3d" name="dracut-kiwi-lib" arch="x86_64">
  <version epoch="0" ver="9.24.43" rel="150100.3.84.1"/>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698321600">- Create live persistent storage without busy state
  With the former logic the live ISO was already mounted when an
  eventual persistent storage partition was created. This leads
  to an issue on re-reading the partition table, not for all but
  several tools. This commit changes the order of tasks such that
  the setup of the persistent write storage is performed prior
  mounting the live ISO. In addition to this change an alternative
  method using blockdev to re-read the partition was added in case
  partprobe is not present. This also allows to get rid of the
  parted dependency which provides partprobe
  Part of bsc#1216465
  (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698408000">- Change partprobe fallback to partx
  Informing the kernel about a new partition geometry can be done in a
  busy state and is also effective for new devices and new mounts based
  on the new geometry. busy state mounts of course will not see it until
  swap of the busy state but a complete refuse of operation like it
  happens with blockdev is imho not required. Just as partprobe, partx
  is less restrictive on the busy state. That's why this commit changes
  the partprobe fallback to use partx instead of blockdev
  Part of bsc#1216465
  (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698840000">- Add partx to module-setup of kiwi-lib too
  Part of bsc#1216465
  (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1700654400">- Allow install disk overwrite from cmdline
  Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device
  that should be used in an OEM installation. This overwrites any
  other oem device setting, e.g device filter or maxdisk and just
  continues the installation on the given device. However, the
  device must exist and must be a block special.
  This Fixes jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704369600">- Fix overwrite of kiwi_oemunattended
  In case rd.kiwi.oem.installdevice is set, there is an overwrite
  of the kiwi_oemunattended setting. However the variable was set
  in local scope of a function and therefore the change was not
  effective in other methods which also evaluates this variable.
  This commit fixes it such that the overwrite happens in the early
  initialize method which provides the environment for all code
  running in the dracut module. This is related to jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704801600">- Fixed regression in GRUB_SERIAL_COMMAND setup
  The condition to write the serial line setup was broken.
  This commit fixes it. Related to Issue #2419 and
  Fixes bsc#1228808</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1705579200">- Fixed grub terminal setup
  The grub terminal setup is divided into the setting for the output
  and the input console. For both settings different parameters exists.
  So far kiwi did not differentiate between the two parts of the
  console setup and that could lead to a wrong setting if only one
  value is provided in kiwi's console= attribute which lead to the
  grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm
  grub takes this for both input and output and it's obviously
  wrong for the input. To make this less error prune the kiwi code
  changes with this commit to set GRUB_TERMINAL_INPUT and
  GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity
  checks on the provided values if they are applicable. The information
  for setting up the console in the schema stays untouched though.
  That's because it's used for all bootloaders and also because grub
  supports multiple values for the console in/out setting in one
  GRUB_TERMINAL variable even though kiwi does no longer use it.
  To make this clear for the users also the documentation for the
  console attribute setup has been updated. If we want to wish two
  distinct attributes for input and output console settings a schema
  change and also differentiation between bootloaders is needed and
  that I only see for the kiwi-10 branch if at all. This Fixes #2419
  and Fixes bsc#1218095</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1710849600">- Fixup cleanup of zipl templates
  Make sure temporary modifications to the zipl template
  and config file are not effective in the later system.
  This Fixes bsc#1221469</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1711368000">- Live ISO Wait for udev events after repart
  Make sure to wait for the event queue to become empty after
  the creation of the write partition. When kiwi calls the
  code to create the write partition this emits new udev events.
  It's important to wait for the event queue to become empty
  to avoid a potential regression on the use of the device nodes.
  In the processing of the events it can happen that a device
  gets removed and re-added. If we don't want for udev
  to process the entire queue it can happen that the
  wrong block device is used. This wrong selection is only
  possible because the way how hybrid ISOs are designed exposes
  both, the disk and the partition for the root device with
  the same label. This Fixes bsc#1213595</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1712232000">- Set default output console to gfxterm for grub
  If no console setting is done in the image description for grub
  the default output console is set to: gfxterm and the default
  input console is set to: console. This Fixes bsc#1219074</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427200">- Add rd.kiwi.oem.force_resize boot option
  Forces the disk resize process on an OEM disk image.
  If set, no sanity check for unpartitioned/free space
  is performed and also an eventually configured
  &lt;oem-resize-once&gt; configuration from the image description
  will not be taken into account. This Fixes bsc#1224389</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427201">- Do not exclude the .profile env file by default
  kiwi's initrd modules read a .profile file which gets included
  into the initrd produced at build time. To allow rebuild of a
  host-only initrd from the booted system this information should
  be present such that it is possible to re-use kiwi initrd code.
  This is related to bsc#1228118</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1722427202">- Fix kiwi-repart restrictions
  The kiwi repart dracut module reads a profile file and if it
  does not exists it dies in the initrd. However, that profile
  file is not mandatory for the main resize functionality. Thus
  this commit turns this into a warning message. In addition
  the module-setup for 90kiwi-repart makes sure to include
  the required and optional profile files.
  This Fixes bsc#1228118</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1723118400">- Update virtualenv setup
  types-pkg_resources got dropped from PyPI</changelog>
</package>
<package pkgid="5d1fc339f8639b9fdb8e52a04533a27896c1a2a83a2cc1627942a48ccdcabcbd" name="dracut-kiwi-live" arch="aarch64">
  <version epoch="0" ver="9.24.43" rel="150100.3.81.1"/>
  <changelog author="dcassany@suse.com" date="1681300800">- Adding a comment to explain the s390 specific path
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1688472000">- Add alternative re-reading of the partition table
  To inform the kernel about disk geometry changes, kiwi uses
  partprobe as a primary tool. However it is provided by parted
  and not necessarily available due to the package requirements
  on the dracut module. A second attempt via blockdev which
  is expected to exist is therefore made by this commit
  Part of bsc#1216465
  (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7)</changelog>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698321600">- Create live persistent storage without busy state
  With the former logic the live ISO was already mounted when an
  eventual persistent storage partition was created. This leads
  to an issue on re-reading the partition table, not for all but
  several tools. This commit changes the order of tasks such that
  the setup of the persistent write storage is performed prior
  mounting the live ISO. In addition to this change an alternative
  method using blockdev to re-read the partition was added in case
  partprobe is not present. This also allows to get rid of the
  parted dependency which provides partprobe
  Part of bsc#1216465
  (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698408000">- Change partprobe fallback to partx
  Informing the kernel about a new partition geometry can be done in a
  busy state and is also effective for new devices and new mounts based
  on the new geometry. busy state mounts of course will not see it until
  swap of the busy state but a complete refuse of operation like it
  happens with blockdev is imho not required. Just as partprobe, partx
  is less restrictive on the busy state. That's why this commit changes
  the partprobe fallback to use partx instead of blockdev
  Part of bsc#1216465
  (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698840000">- Add partx to module-setup of kiwi-lib too
  Part of bsc#1216465
  (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1700654400">- Allow install disk overwrite from cmdline
  Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device
  that should be used in an OEM installation. This overwrites any
  other oem device setting, e.g device filter or maxdisk and just
  continues the installation on the given device. However, the
  device must exist and must be a block special.
  This Fixes jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704369600">- Fix overwrite of kiwi_oemunattended
  In case rd.kiwi.oem.installdevice is set, there is an overwrite
  of the kiwi_oemunattended setting. However the variable was set
  in local scope of a function and therefore the change was not
  effective in other methods which also evaluates this variable.
  This commit fixes it such that the overwrite happens in the early
  initialize method which provides the environment for all code
  running in the dracut module. This is related to jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1705579200">- Fixed grub terminal setup
  The grub terminal setup is divided into the setting for the output
  and the input console. For both settings different parameters exists.
  So far kiwi did not differentiate between the two parts of the
  console setup and that could lead to a wrong setting if only one
  value is provided in kiwi's console= attribute which lead to the
  grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm
  grub takes this for both input and output and it's obviously
  wrong for the input. To make this less error prune the kiwi code
  changes with this commit to set GRUB_TERMINAL_INPUT and
  GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity
  checks on the provided values if they are applicable. The information
  for setting up the console in the schema stays untouched though.
  That's because it's used for all bootloaders and also because grub
  supports multiple values for the console in/out setting in one
  GRUB_TERMINAL variable even though kiwi does no longer use it.
  To make this clear for the users also the documentation for the
  console attribute setup has been updated. If we want to wish two
  distinct attributes for input and output console settings a schema
  change and also differentiation between bootloaders is needed and
  that I only see for the kiwi-10 branch if at all. This Fixes #2419
  and Fixes bsc#1218095</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1710849600">- Fixup cleanup of zipl templates
  Make sure temporary modifications to the zipl template
  and config file are not effective in the later system.
  This Fixes bsc#1221469</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1711368000">- Live ISO Wait for udev events after repart
  Make sure to wait for the event queue to become empty after
  the creation of the write partition. When kiwi calls the
  code to create the write partition this emits new udev events.
  It's important to wait for the event queue to become empty
  to avoid a potential regression on the use of the device nodes.
  In the processing of the events it can happen that a device
  gets removed and re-added. If we don't want for udev
  to process the entire queue it can happen that the
  wrong block device is used. This wrong selection is only
  possible because the way how hybrid ISOs are designed exposes
  both, the disk and the partition for the root device with
  the same label. This Fixes bsc#1213595</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1712232000">- Set default output console to gfxterm for grub
  If no console setting is done in the image description for grub
  the default output console is set to: gfxterm and the default
  input console is set to: console. This Fixes bsc#1219074</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427200">- Add rd.kiwi.oem.force_resize boot option
  Forces the disk resize process on an OEM disk image.
  If set, no sanity check for unpartitioned/free space
  is performed and also an eventually configured
  &lt;oem-resize-once&gt; configuration from the image description
  will not be taken into account. This Fixes bsc#1224389</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427201">- Do not exclude the .profile env file by default
  kiwi's initrd modules read a .profile file which gets included
  into the initrd produced at build time. To allow rebuild of a
  host-only initrd from the booted system this information should
  be present such that it is possible to re-use kiwi initrd code.
  This is related to bsc#1228118</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1722427202">- Fix kiwi-repart restrictions
  The kiwi repart dracut module reads a profile file and if it
  does not exists it dies in the initrd. However, that profile
  file is not mandatory for the main resize functionality. Thus
  this commit turns this into a warning message. In addition
  the module-setup for 90kiwi-repart makes sure to include
  the required and optional profile files.
  This Fixes bsc#1228118</changelog>
</package>
<package pkgid="ab6ef3c45df7c13baf561ef64168009f4fd502b63243af9b20bb18125ddaa593" name="dracut-kiwi-live" arch="ppc64le">
  <version epoch="0" ver="9.24.43" rel="150100.3.81.1"/>
  <changelog author="dcassany@suse.com" date="1681300800">- Adding a comment to explain the s390 specific path
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1688472000">- Add alternative re-reading of the partition table
  To inform the kernel about disk geometry changes, kiwi uses
  partprobe as a primary tool. However it is provided by parted
  and not necessarily available due to the package requirements
  on the dracut module. A second attempt via blockdev which
  is expected to exist is therefore made by this commit
  Part of bsc#1216465
  (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7)</changelog>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698321600">- Create live persistent storage without busy state
  With the former logic the live ISO was already mounted when an
  eventual persistent storage partition was created. This leads
  to an issue on re-reading the partition table, not for all but
  several tools. This commit changes the order of tasks such that
  the setup of the persistent write storage is performed prior
  mounting the live ISO. In addition to this change an alternative
  method using blockdev to re-read the partition was added in case
  partprobe is not present. This also allows to get rid of the
  parted dependency which provides partprobe
  Part of bsc#1216465
  (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698408000">- Change partprobe fallback to partx
  Informing the kernel about a new partition geometry can be done in a
  busy state and is also effective for new devices and new mounts based
  on the new geometry. busy state mounts of course will not see it until
  swap of the busy state but a complete refuse of operation like it
  happens with blockdev is imho not required. Just as partprobe, partx
  is less restrictive on the busy state. That's why this commit changes
  the partprobe fallback to use partx instead of blockdev
  Part of bsc#1216465
  (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698840000">- Add partx to module-setup of kiwi-lib too
  Part of bsc#1216465
  (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1700654400">- Allow install disk overwrite from cmdline
  Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device
  that should be used in an OEM installation. This overwrites any
  other oem device setting, e.g device filter or maxdisk and just
  continues the installation on the given device. However, the
  device must exist and must be a block special.
  This Fixes jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704369600">- Fix overwrite of kiwi_oemunattended
  In case rd.kiwi.oem.installdevice is set, there is an overwrite
  of the kiwi_oemunattended setting. However the variable was set
  in local scope of a function and therefore the change was not
  effective in other methods which also evaluates this variable.
  This commit fixes it such that the overwrite happens in the early
  initialize method which provides the environment for all code
  running in the dracut module. This is related to jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1705579200">- Fixed grub terminal setup
  The grub terminal setup is divided into the setting for the output
  and the input console. For both settings different parameters exists.
  So far kiwi did not differentiate between the two parts of the
  console setup and that could lead to a wrong setting if only one
  value is provided in kiwi's console= attribute which lead to the
  grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm
  grub takes this for both input and output and it's obviously
  wrong for the input. To make this less error prune the kiwi code
  changes with this commit to set GRUB_TERMINAL_INPUT and
  GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity
  checks on the provided values if they are applicable. The information
  for setting up the console in the schema stays untouched though.
  That's because it's used for all bootloaders and also because grub
  supports multiple values for the console in/out setting in one
  GRUB_TERMINAL variable even though kiwi does no longer use it.
  To make this clear for the users also the documentation for the
  console attribute setup has been updated. If we want to wish two
  distinct attributes for input and output console settings a schema
  change and also differentiation between bootloaders is needed and
  that I only see for the kiwi-10 branch if at all. This Fixes #2419
  and Fixes bsc#1218095</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1710849600">- Fixup cleanup of zipl templates
  Make sure temporary modifications to the zipl template
  and config file are not effective in the later system.
  This Fixes bsc#1221469</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1711368000">- Live ISO Wait for udev events after repart
  Make sure to wait for the event queue to become empty after
  the creation of the write partition. When kiwi calls the
  code to create the write partition this emits new udev events.
  It's important to wait for the event queue to become empty
  to avoid a potential regression on the use of the device nodes.
  In the processing of the events it can happen that a device
  gets removed and re-added. If we don't want for udev
  to process the entire queue it can happen that the
  wrong block device is used. This wrong selection is only
  possible because the way how hybrid ISOs are designed exposes
  both, the disk and the partition for the root device with
  the same label. This Fixes bsc#1213595</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1712232000">- Set default output console to gfxterm for grub
  If no console setting is done in the image description for grub
  the default output console is set to: gfxterm and the default
  input console is set to: console. This Fixes bsc#1219074</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427200">- Add rd.kiwi.oem.force_resize boot option
  Forces the disk resize process on an OEM disk image.
  If set, no sanity check for unpartitioned/free space
  is performed and also an eventually configured
  &lt;oem-resize-once&gt; configuration from the image description
  will not be taken into account. This Fixes bsc#1224389</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427201">- Do not exclude the .profile env file by default
  kiwi's initrd modules read a .profile file which gets included
  into the initrd produced at build time. To allow rebuild of a
  host-only initrd from the booted system this information should
  be present such that it is possible to re-use kiwi initrd code.
  This is related to bsc#1228118</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1722427202">- Fix kiwi-repart restrictions
  The kiwi repart dracut module reads a profile file and if it
  does not exists it dies in the initrd. However, that profile
  file is not mandatory for the main resize functionality. Thus
  this commit turns this into a warning message. In addition
  the module-setup for 90kiwi-repart makes sure to include
  the required and optional profile files.
  This Fixes bsc#1228118</changelog>
</package>
<package pkgid="df722523d6da573e2b7272e04498b91e4828727d3c7e75c6f785e916bbd7798e" name="dracut-kiwi-live" arch="s390x">
  <version epoch="0" ver="9.24.43" rel="150100.3.81.1"/>
  <changelog author="dcassany@suse.com" date="1681300800">- Adding a comment to explain the s390 specific path
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1688472000">- Add alternative re-reading of the partition table
  To inform the kernel about disk geometry changes, kiwi uses
  partprobe as a primary tool. However it is provided by parted
  and not necessarily available due to the package requirements
  on the dracut module. A second attempt via blockdev which
  is expected to exist is therefore made by this commit
  Part of bsc#1216465
  (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7)</changelog>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698321600">- Create live persistent storage without busy state
  With the former logic the live ISO was already mounted when an
  eventual persistent storage partition was created. This leads
  to an issue on re-reading the partition table, not for all but
  several tools. This commit changes the order of tasks such that
  the setup of the persistent write storage is performed prior
  mounting the live ISO. In addition to this change an alternative
  method using blockdev to re-read the partition was added in case
  partprobe is not present. This also allows to get rid of the
  parted dependency which provides partprobe
  Part of bsc#1216465
  (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698408000">- Change partprobe fallback to partx
  Informing the kernel about a new partition geometry can be done in a
  busy state and is also effective for new devices and new mounts based
  on the new geometry. busy state mounts of course will not see it until
  swap of the busy state but a complete refuse of operation like it
  happens with blockdev is imho not required. Just as partprobe, partx
  is less restrictive on the busy state. That's why this commit changes
  the partprobe fallback to use partx instead of blockdev
  Part of bsc#1216465
  (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698840000">- Add partx to module-setup of kiwi-lib too
  Part of bsc#1216465
  (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1700654400">- Allow install disk overwrite from cmdline
  Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device
  that should be used in an OEM installation. This overwrites any
  other oem device setting, e.g device filter or maxdisk and just
  continues the installation on the given device. However, the
  device must exist and must be a block special.
  This Fixes jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704369600">- Fix overwrite of kiwi_oemunattended
  In case rd.kiwi.oem.installdevice is set, there is an overwrite
  of the kiwi_oemunattended setting. However the variable was set
  in local scope of a function and therefore the change was not
  effective in other methods which also evaluates this variable.
  This commit fixes it such that the overwrite happens in the early
  initialize method which provides the environment for all code
  running in the dracut module. This is related to jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1705579200">- Fixed grub terminal setup
  The grub terminal setup is divided into the setting for the output
  and the input console. For both settings different parameters exists.
  So far kiwi did not differentiate between the two parts of the
  console setup and that could lead to a wrong setting if only one
  value is provided in kiwi's console= attribute which lead to the
  grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm
  grub takes this for both input and output and it's obviously
  wrong for the input. To make this less error prune the kiwi code
  changes with this commit to set GRUB_TERMINAL_INPUT and
  GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity
  checks on the provided values if they are applicable. The information
  for setting up the console in the schema stays untouched though.
  That's because it's used for all bootloaders and also because grub
  supports multiple values for the console in/out setting in one
  GRUB_TERMINAL variable even though kiwi does no longer use it.
  To make this clear for the users also the documentation for the
  console attribute setup has been updated. If we want to wish two
  distinct attributes for input and output console settings a schema
  change and also differentiation between bootloaders is needed and
  that I only see for the kiwi-10 branch if at all. This Fixes #2419
  and Fixes bsc#1218095</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1710849600">- Fixup cleanup of zipl templates
  Make sure temporary modifications to the zipl template
  and config file are not effective in the later system.
  This Fixes bsc#1221469</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1711368000">- Live ISO Wait for udev events after repart
  Make sure to wait for the event queue to become empty after
  the creation of the write partition. When kiwi calls the
  code to create the write partition this emits new udev events.
  It's important to wait for the event queue to become empty
  to avoid a potential regression on the use of the device nodes.
  In the processing of the events it can happen that a device
  gets removed and re-added. If we don't want for udev
  to process the entire queue it can happen that the
  wrong block device is used. This wrong selection is only
  possible because the way how hybrid ISOs are designed exposes
  both, the disk and the partition for the root device with
  the same label. This Fixes bsc#1213595</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1712232000">- Set default output console to gfxterm for grub
  If no console setting is done in the image description for grub
  the default output console is set to: gfxterm and the default
  input console is set to: console. This Fixes bsc#1219074</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427200">- Add rd.kiwi.oem.force_resize boot option
  Forces the disk resize process on an OEM disk image.
  If set, no sanity check for unpartitioned/free space
  is performed and also an eventually configured
  &lt;oem-resize-once&gt; configuration from the image description
  will not be taken into account. This Fixes bsc#1224389</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427201">- Do not exclude the .profile env file by default
  kiwi's initrd modules read a .profile file which gets included
  into the initrd produced at build time. To allow rebuild of a
  host-only initrd from the booted system this information should
  be present such that it is possible to re-use kiwi initrd code.
  This is related to bsc#1228118</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1722427202">- Fix kiwi-repart restrictions
  The kiwi repart dracut module reads a profile file and if it
  does not exists it dies in the initrd. However, that profile
  file is not mandatory for the main resize functionality. Thus
  this commit turns this into a warning message. In addition
  the module-setup for 90kiwi-repart makes sure to include
  the required and optional profile files.
  This Fixes bsc#1228118</changelog>
</package>
<package pkgid="8a29bc1506eb5e6b7ff74ccf8327520099b3f9942dfd8f4e11f5651eb83efb61" name="dracut-kiwi-live" arch="x86_64">
  <version epoch="0" ver="9.24.43" rel="150100.3.81.1"/>
  <changelog author="dcassany@suse.com" date="1681300800">- Adding a comment to explain the s390 specific path
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1688472000">- Add alternative re-reading of the partition table
  To inform the kernel about disk geometry changes, kiwi uses
  partprobe as a primary tool. However it is provided by parted
  and not necessarily available due to the package requirements
  on the dracut module. A second attempt via blockdev which
  is expected to exist is therefore made by this commit
  Part of bsc#1216465
  (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7)</changelog>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698321600">- Create live persistent storage without busy state
  With the former logic the live ISO was already mounted when an
  eventual persistent storage partition was created. This leads
  to an issue on re-reading the partition table, not for all but
  several tools. This commit changes the order of tasks such that
  the setup of the persistent write storage is performed prior
  mounting the live ISO. In addition to this change an alternative
  method using blockdev to re-read the partition was added in case
  partprobe is not present. This also allows to get rid of the
  parted dependency which provides partprobe
  Part of bsc#1216465
  (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698408000">- Change partprobe fallback to partx
  Informing the kernel about a new partition geometry can be done in a
  busy state and is also effective for new devices and new mounts based
  on the new geometry. busy state mounts of course will not see it until
  swap of the busy state but a complete refuse of operation like it
  happens with blockdev is imho not required. Just as partprobe, partx
  is less restrictive on the busy state. That's why this commit changes
  the partprobe fallback to use partx instead of blockdev
  Part of bsc#1216465
  (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698840000">- Add partx to module-setup of kiwi-lib too
  Part of bsc#1216465
  (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1700654400">- Allow install disk overwrite from cmdline
  Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device
  that should be used in an OEM installation. This overwrites any
  other oem device setting, e.g device filter or maxdisk and just
  continues the installation on the given device. However, the
  device must exist and must be a block special.
  This Fixes jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704369600">- Fix overwrite of kiwi_oemunattended
  In case rd.kiwi.oem.installdevice is set, there is an overwrite
  of the kiwi_oemunattended setting. However the variable was set
  in local scope of a function and therefore the change was not
  effective in other methods which also evaluates this variable.
  This commit fixes it such that the overwrite happens in the early
  initialize method which provides the environment for all code
  running in the dracut module. This is related to jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1705579200">- Fixed grub terminal setup
  The grub terminal setup is divided into the setting for the output
  and the input console. For both settings different parameters exists.
  So far kiwi did not differentiate between the two parts of the
  console setup and that could lead to a wrong setting if only one
  value is provided in kiwi's console= attribute which lead to the
  grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm
  grub takes this for both input and output and it's obviously
  wrong for the input. To make this less error prune the kiwi code
  changes with this commit to set GRUB_TERMINAL_INPUT and
  GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity
  checks on the provided values if they are applicable. The information
  for setting up the console in the schema stays untouched though.
  That's because it's used for all bootloaders and also because grub
  supports multiple values for the console in/out setting in one
  GRUB_TERMINAL variable even though kiwi does no longer use it.
  To make this clear for the users also the documentation for the
  console attribute setup has been updated. If we want to wish two
  distinct attributes for input and output console settings a schema
  change and also differentiation between bootloaders is needed and
  that I only see for the kiwi-10 branch if at all. This Fixes #2419
  and Fixes bsc#1218095</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1710849600">- Fixup cleanup of zipl templates
  Make sure temporary modifications to the zipl template
  and config file are not effective in the later system.
  This Fixes bsc#1221469</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1711368000">- Live ISO Wait for udev events after repart
  Make sure to wait for the event queue to become empty after
  the creation of the write partition. When kiwi calls the
  code to create the write partition this emits new udev events.
  It's important to wait for the event queue to become empty
  to avoid a potential regression on the use of the device nodes.
  In the processing of the events it can happen that a device
  gets removed and re-added. If we don't want for udev
  to process the entire queue it can happen that the
  wrong block device is used. This wrong selection is only
  possible because the way how hybrid ISOs are designed exposes
  both, the disk and the partition for the root device with
  the same label. This Fixes bsc#1213595</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1712232000">- Set default output console to gfxterm for grub
  If no console setting is done in the image description for grub
  the default output console is set to: gfxterm and the default
  input console is set to: console. This Fixes bsc#1219074</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427200">- Add rd.kiwi.oem.force_resize boot option
  Forces the disk resize process on an OEM disk image.
  If set, no sanity check for unpartitioned/free space
  is performed and also an eventually configured
  &lt;oem-resize-once&gt; configuration from the image description
  will not be taken into account. This Fixes bsc#1224389</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427201">- Do not exclude the .profile env file by default
  kiwi's initrd modules read a .profile file which gets included
  into the initrd produced at build time. To allow rebuild of a
  host-only initrd from the booted system this information should
  be present such that it is possible to re-use kiwi initrd code.
  This is related to bsc#1228118</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1722427202">- Fix kiwi-repart restrictions
  The kiwi repart dracut module reads a profile file and if it
  does not exists it dies in the initrd. However, that profile
  file is not mandatory for the main resize functionality. Thus
  this commit turns this into a warning message. In addition
  the module-setup for 90kiwi-repart makes sure to include
  the required and optional profile files.
  This Fixes bsc#1228118</changelog>
</package>
<package pkgid="698aeaae33b69faec39f9878b67df8273f19eca04046a3858bb3d9f50890bdd9" name="dracut-kiwi-live" arch="aarch64">
  <version epoch="0" ver="9.24.43" rel="150100.3.84.1"/>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698321600">- Create live persistent storage without busy state
  With the former logic the live ISO was already mounted when an
  eventual persistent storage partition was created. This leads
  to an issue on re-reading the partition table, not for all but
  several tools. This commit changes the order of tasks such that
  the setup of the persistent write storage is performed prior
  mounting the live ISO. In addition to this change an alternative
  method using blockdev to re-read the partition was added in case
  partprobe is not present. This also allows to get rid of the
  parted dependency which provides partprobe
  Part of bsc#1216465
  (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698408000">- Change partprobe fallback to partx
  Informing the kernel about a new partition geometry can be done in a
  busy state and is also effective for new devices and new mounts based
  on the new geometry. busy state mounts of course will not see it until
  swap of the busy state but a complete refuse of operation like it
  happens with blockdev is imho not required. Just as partprobe, partx
  is less restrictive on the busy state. That's why this commit changes
  the partprobe fallback to use partx instead of blockdev
  Part of bsc#1216465
  (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698840000">- Add partx to module-setup of kiwi-lib too
  Part of bsc#1216465
  (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1700654400">- Allow install disk overwrite from cmdline
  Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device
  that should be used in an OEM installation. This overwrites any
  other oem device setting, e.g device filter or maxdisk and just
  continues the installation on the given device. However, the
  device must exist and must be a block special.
  This Fixes jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704369600">- Fix overwrite of kiwi_oemunattended
  In case rd.kiwi.oem.installdevice is set, there is an overwrite
  of the kiwi_oemunattended setting. However the variable was set
  in local scope of a function and therefore the change was not
  effective in other methods which also evaluates this variable.
  This commit fixes it such that the overwrite happens in the early
  initialize method which provides the environment for all code
  running in the dracut module. This is related to jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704801600">- Fixed regression in GRUB_SERIAL_COMMAND setup
  The condition to write the serial line setup was broken.
  This commit fixes it. Related to Issue #2419 and
  Fixes bsc#1228808</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1705579200">- Fixed grub terminal setup
  The grub terminal setup is divided into the setting for the output
  and the input console. For both settings different parameters exists.
  So far kiwi did not differentiate between the two parts of the
  console setup and that could lead to a wrong setting if only one
  value is provided in kiwi's console= attribute which lead to the
  grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm
  grub takes this for both input and output and it's obviously
  wrong for the input. To make this less error prune the kiwi code
  changes with this commit to set GRUB_TERMINAL_INPUT and
  GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity
  checks on the provided values if they are applicable. The information
  for setting up the console in the schema stays untouched though.
  That's because it's used for all bootloaders and also because grub
  supports multiple values for the console in/out setting in one
  GRUB_TERMINAL variable even though kiwi does no longer use it.
  To make this clear for the users also the documentation for the
  console attribute setup has been updated. If we want to wish two
  distinct attributes for input and output console settings a schema
  change and also differentiation between bootloaders is needed and
  that I only see for the kiwi-10 branch if at all. This Fixes #2419
  and Fixes bsc#1218095</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1710849600">- Fixup cleanup of zipl templates
  Make sure temporary modifications to the zipl template
  and config file are not effective in the later system.
  This Fixes bsc#1221469</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1711368000">- Live ISO Wait for udev events after repart
  Make sure to wait for the event queue to become empty after
  the creation of the write partition. When kiwi calls the
  code to create the write partition this emits new udev events.
  It's important to wait for the event queue to become empty
  to avoid a potential regression on the use of the device nodes.
  In the processing of the events it can happen that a device
  gets removed and re-added. If we don't want for udev
  to process the entire queue it can happen that the
  wrong block device is used. This wrong selection is only
  possible because the way how hybrid ISOs are designed exposes
  both, the disk and the partition for the root device with
  the same label. This Fixes bsc#1213595</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1712232000">- Set default output console to gfxterm for grub
  If no console setting is done in the image description for grub
  the default output console is set to: gfxterm and the default
  input console is set to: console. This Fixes bsc#1219074</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427200">- Add rd.kiwi.oem.force_resize boot option
  Forces the disk resize process on an OEM disk image.
  If set, no sanity check for unpartitioned/free space
  is performed and also an eventually configured
  &lt;oem-resize-once&gt; configuration from the image description
  will not be taken into account. This Fixes bsc#1224389</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427201">- Do not exclude the .profile env file by default
  kiwi's initrd modules read a .profile file which gets included
  into the initrd produced at build time. To allow rebuild of a
  host-only initrd from the booted system this information should
  be present such that it is possible to re-use kiwi initrd code.
  This is related to bsc#1228118</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1722427202">- Fix kiwi-repart restrictions
  The kiwi repart dracut module reads a profile file and if it
  does not exists it dies in the initrd. However, that profile
  file is not mandatory for the main resize functionality. Thus
  this commit turns this into a warning message. In addition
  the module-setup for 90kiwi-repart makes sure to include
  the required and optional profile files.
  This Fixes bsc#1228118</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1723118400">- Update virtualenv setup
  types-pkg_resources got dropped from PyPI</changelog>
</package>
<package pkgid="eec869015c62aae84d81c0bd24f02bec1920afd377447896772a3a0bf11a9aa5" name="dracut-kiwi-live" arch="ppc64le">
  <version epoch="0" ver="9.24.43" rel="150100.3.84.1"/>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698321600">- Create live persistent storage without busy state
  With the former logic the live ISO was already mounted when an
  eventual persistent storage partition was created. This leads
  to an issue on re-reading the partition table, not for all but
  several tools. This commit changes the order of tasks such that
  the setup of the persistent write storage is performed prior
  mounting the live ISO. In addition to this change an alternative
  method using blockdev to re-read the partition was added in case
  partprobe is not present. This also allows to get rid of the
  parted dependency which provides partprobe
  Part of bsc#1216465
  (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698408000">- Change partprobe fallback to partx
  Informing the kernel about a new partition geometry can be done in a
  busy state and is also effective for new devices and new mounts based
  on the new geometry. busy state mounts of course will not see it until
  swap of the busy state but a complete refuse of operation like it
  happens with blockdev is imho not required. Just as partprobe, partx
  is less restrictive on the busy state. That's why this commit changes
  the partprobe fallback to use partx instead of blockdev
  Part of bsc#1216465
  (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698840000">- Add partx to module-setup of kiwi-lib too
  Part of bsc#1216465
  (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1700654400">- Allow install disk overwrite from cmdline
  Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device
  that should be used in an OEM installation. This overwrites any
  other oem device setting, e.g device filter or maxdisk and just
  continues the installation on the given device. However, the
  device must exist and must be a block special.
  This Fixes jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704369600">- Fix overwrite of kiwi_oemunattended
  In case rd.kiwi.oem.installdevice is set, there is an overwrite
  of the kiwi_oemunattended setting. However the variable was set
  in local scope of a function and therefore the change was not
  effective in other methods which also evaluates this variable.
  This commit fixes it such that the overwrite happens in the early
  initialize method which provides the environment for all code
  running in the dracut module. This is related to jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704801600">- Fixed regression in GRUB_SERIAL_COMMAND setup
  The condition to write the serial line setup was broken.
  This commit fixes it. Related to Issue #2419 and
  Fixes bsc#1228808</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1705579200">- Fixed grub terminal setup
  The grub terminal setup is divided into the setting for the output
  and the input console. For both settings different parameters exists.
  So far kiwi did not differentiate between the two parts of the
  console setup and that could lead to a wrong setting if only one
  value is provided in kiwi's console= attribute which lead to the
  grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm
  grub takes this for both input and output and it's obviously
  wrong for the input. To make this less error prune the kiwi code
  changes with this commit to set GRUB_TERMINAL_INPUT and
  GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity
  checks on the provided values if they are applicable. The information
  for setting up the console in the schema stays untouched though.
  That's because it's used for all bootloaders and also because grub
  supports multiple values for the console in/out setting in one
  GRUB_TERMINAL variable even though kiwi does no longer use it.
  To make this clear for the users also the documentation for the
  console attribute setup has been updated. If we want to wish two
  distinct attributes for input and output console settings a schema
  change and also differentiation between bootloaders is needed and
  that I only see for the kiwi-10 branch if at all. This Fixes #2419
  and Fixes bsc#1218095</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1710849600">- Fixup cleanup of zipl templates
  Make sure temporary modifications to the zipl template
  and config file are not effective in the later system.
  This Fixes bsc#1221469</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1711368000">- Live ISO Wait for udev events after repart
  Make sure to wait for the event queue to become empty after
  the creation of the write partition. When kiwi calls the
  code to create the write partition this emits new udev events.
  It's important to wait for the event queue to become empty
  to avoid a potential regression on the use of the device nodes.
  In the processing of the events it can happen that a device
  gets removed and re-added. If we don't want for udev
  to process the entire queue it can happen that the
  wrong block device is used. This wrong selection is only
  possible because the way how hybrid ISOs are designed exposes
  both, the disk and the partition for the root device with
  the same label. This Fixes bsc#1213595</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1712232000">- Set default output console to gfxterm for grub
  If no console setting is done in the image description for grub
  the default output console is set to: gfxterm and the default
  input console is set to: console. This Fixes bsc#1219074</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427200">- Add rd.kiwi.oem.force_resize boot option
  Forces the disk resize process on an OEM disk image.
  If set, no sanity check for unpartitioned/free space
  is performed and also an eventually configured
  &lt;oem-resize-once&gt; configuration from the image description
  will not be taken into account. This Fixes bsc#1224389</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427201">- Do not exclude the .profile env file by default
  kiwi's initrd modules read a .profile file which gets included
  into the initrd produced at build time. To allow rebuild of a
  host-only initrd from the booted system this information should
  be present such that it is possible to re-use kiwi initrd code.
  This is related to bsc#1228118</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1722427202">- Fix kiwi-repart restrictions
  The kiwi repart dracut module reads a profile file and if it
  does not exists it dies in the initrd. However, that profile
  file is not mandatory for the main resize functionality. Thus
  this commit turns this into a warning message. In addition
  the module-setup for 90kiwi-repart makes sure to include
  the required and optional profile files.
  This Fixes bsc#1228118</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1723118400">- Update virtualenv setup
  types-pkg_resources got dropped from PyPI</changelog>
</package>
<package pkgid="e0a3402902d5fea8bc5637bd3b5fed6bc91b2c2a82a7982f3ed907eea04694fb" name="dracut-kiwi-live" arch="s390x">
  <version epoch="0" ver="9.24.43" rel="150100.3.84.1"/>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698321600">- Create live persistent storage without busy state
  With the former logic the live ISO was already mounted when an
  eventual persistent storage partition was created. This leads
  to an issue on re-reading the partition table, not for all but
  several tools. This commit changes the order of tasks such that
  the setup of the persistent write storage is performed prior
  mounting the live ISO. In addition to this change an alternative
  method using blockdev to re-read the partition was added in case
  partprobe is not present. This also allows to get rid of the
  parted dependency which provides partprobe
  Part of bsc#1216465
  (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698408000">- Change partprobe fallback to partx
  Informing the kernel about a new partition geometry can be done in a
  busy state and is also effective for new devices and new mounts based
  on the new geometry. busy state mounts of course will not see it until
  swap of the busy state but a complete refuse of operation like it
  happens with blockdev is imho not required. Just as partprobe, partx
  is less restrictive on the busy state. That's why this commit changes
  the partprobe fallback to use partx instead of blockdev
  Part of bsc#1216465
  (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698840000">- Add partx to module-setup of kiwi-lib too
  Part of bsc#1216465
  (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1700654400">- Allow install disk overwrite from cmdline
  Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device
  that should be used in an OEM installation. This overwrites any
  other oem device setting, e.g device filter or maxdisk and just
  continues the installation on the given device. However, the
  device must exist and must be a block special.
  This Fixes jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704369600">- Fix overwrite of kiwi_oemunattended
  In case rd.kiwi.oem.installdevice is set, there is an overwrite
  of the kiwi_oemunattended setting. However the variable was set
  in local scope of a function and therefore the change was not
  effective in other methods which also evaluates this variable.
  This commit fixes it such that the overwrite happens in the early
  initialize method which provides the environment for all code
  running in the dracut module. This is related to jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704801600">- Fixed regression in GRUB_SERIAL_COMMAND setup
  The condition to write the serial line setup was broken.
  This commit fixes it. Related to Issue #2419 and
  Fixes bsc#1228808</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1705579200">- Fixed grub terminal setup
  The grub terminal setup is divided into the setting for the output
  and the input console. For both settings different parameters exists.
  So far kiwi did not differentiate between the two parts of the
  console setup and that could lead to a wrong setting if only one
  value is provided in kiwi's console= attribute which lead to the
  grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm
  grub takes this for both input and output and it's obviously
  wrong for the input. To make this less error prune the kiwi code
  changes with this commit to set GRUB_TERMINAL_INPUT and
  GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity
  checks on the provided values if they are applicable. The information
  for setting up the console in the schema stays untouched though.
  That's because it's used for all bootloaders and also because grub
  supports multiple values for the console in/out setting in one
  GRUB_TERMINAL variable even though kiwi does no longer use it.
  To make this clear for the users also the documentation for the
  console attribute setup has been updated. If we want to wish two
  distinct attributes for input and output console settings a schema
  change and also differentiation between bootloaders is needed and
  that I only see for the kiwi-10 branch if at all. This Fixes #2419
  and Fixes bsc#1218095</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1710849600">- Fixup cleanup of zipl templates
  Make sure temporary modifications to the zipl template
  and config file are not effective in the later system.
  This Fixes bsc#1221469</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1711368000">- Live ISO Wait for udev events after repart
  Make sure to wait for the event queue to become empty after
  the creation of the write partition. When kiwi calls the
  code to create the write partition this emits new udev events.
  It's important to wait for the event queue to become empty
  to avoid a potential regression on the use of the device nodes.
  In the processing of the events it can happen that a device
  gets removed and re-added. If we don't want for udev
  to process the entire queue it can happen that the
  wrong block device is used. This wrong selection is only
  possible because the way how hybrid ISOs are designed exposes
  both, the disk and the partition for the root device with
  the same label. This Fixes bsc#1213595</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1712232000">- Set default output console to gfxterm for grub
  If no console setting is done in the image description for grub
  the default output console is set to: gfxterm and the default
  input console is set to: console. This Fixes bsc#1219074</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427200">- Add rd.kiwi.oem.force_resize boot option
  Forces the disk resize process on an OEM disk image.
  If set, no sanity check for unpartitioned/free space
  is performed and also an eventually configured
  &lt;oem-resize-once&gt; configuration from the image description
  will not be taken into account. This Fixes bsc#1224389</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427201">- Do not exclude the .profile env file by default
  kiwi's initrd modules read a .profile file which gets included
  into the initrd produced at build time. To allow rebuild of a
  host-only initrd from the booted system this information should
  be present such that it is possible to re-use kiwi initrd code.
  This is related to bsc#1228118</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1722427202">- Fix kiwi-repart restrictions
  The kiwi repart dracut module reads a profile file and if it
  does not exists it dies in the initrd. However, that profile
  file is not mandatory for the main resize functionality. Thus
  this commit turns this into a warning message. In addition
  the module-setup for 90kiwi-repart makes sure to include
  the required and optional profile files.
  This Fixes bsc#1228118</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1723118400">- Update virtualenv setup
  types-pkg_resources got dropped from PyPI</changelog>
</package>
<package pkgid="6890ca7aa8272218a62b4f053ba14311474b0ac9d8b4c0a0edd0813f221c533e" name="dracut-kiwi-live" arch="x86_64">
  <version epoch="0" ver="9.24.43" rel="150100.3.84.1"/>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698321600">- Create live persistent storage without busy state
  With the former logic the live ISO was already mounted when an
  eventual persistent storage partition was created. This leads
  to an issue on re-reading the partition table, not for all but
  several tools. This commit changes the order of tasks such that
  the setup of the persistent write storage is performed prior
  mounting the live ISO. In addition to this change an alternative
  method using blockdev to re-read the partition was added in case
  partprobe is not present. This also allows to get rid of the
  parted dependency which provides partprobe
  Part of bsc#1216465
  (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698408000">- Change partprobe fallback to partx
  Informing the kernel about a new partition geometry can be done in a
  busy state and is also effective for new devices and new mounts based
  on the new geometry. busy state mounts of course will not see it until
  swap of the busy state but a complete refuse of operation like it
  happens with blockdev is imho not required. Just as partprobe, partx
  is less restrictive on the busy state. That's why this commit changes
  the partprobe fallback to use partx instead of blockdev
  Part of bsc#1216465
  (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698840000">- Add partx to module-setup of kiwi-lib too
  Part of bsc#1216465
  (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1700654400">- Allow install disk overwrite from cmdline
  Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device
  that should be used in an OEM installation. This overwrites any
  other oem device setting, e.g device filter or maxdisk and just
  continues the installation on the given device. However, the
  device must exist and must be a block special.
  This Fixes jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704369600">- Fix overwrite of kiwi_oemunattended
  In case rd.kiwi.oem.installdevice is set, there is an overwrite
  of the kiwi_oemunattended setting. However the variable was set
  in local scope of a function and therefore the change was not
  effective in other methods which also evaluates this variable.
  This commit fixes it such that the overwrite happens in the early
  initialize method which provides the environment for all code
  running in the dracut module. This is related to jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704801600">- Fixed regression in GRUB_SERIAL_COMMAND setup
  The condition to write the serial line setup was broken.
  This commit fixes it. Related to Issue #2419 and
  Fixes bsc#1228808</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1705579200">- Fixed grub terminal setup
  The grub terminal setup is divided into the setting for the output
  and the input console. For both settings different parameters exists.
  So far kiwi did not differentiate between the two parts of the
  console setup and that could lead to a wrong setting if only one
  value is provided in kiwi's console= attribute which lead to the
  grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm
  grub takes this for both input and output and it's obviously
  wrong for the input. To make this less error prune the kiwi code
  changes with this commit to set GRUB_TERMINAL_INPUT and
  GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity
  checks on the provided values if they are applicable. The information
  for setting up the console in the schema stays untouched though.
  That's because it's used for all bootloaders and also because grub
  supports multiple values for the console in/out setting in one
  GRUB_TERMINAL variable even though kiwi does no longer use it.
  To make this clear for the users also the documentation for the
  console attribute setup has been updated. If we want to wish two
  distinct attributes for input and output console settings a schema
  change and also differentiation between bootloaders is needed and
  that I only see for the kiwi-10 branch if at all. This Fixes #2419
  and Fixes bsc#1218095</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1710849600">- Fixup cleanup of zipl templates
  Make sure temporary modifications to the zipl template
  and config file are not effective in the later system.
  This Fixes bsc#1221469</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1711368000">- Live ISO Wait for udev events after repart
  Make sure to wait for the event queue to become empty after
  the creation of the write partition. When kiwi calls the
  code to create the write partition this emits new udev events.
  It's important to wait for the event queue to become empty
  to avoid a potential regression on the use of the device nodes.
  In the processing of the events it can happen that a device
  gets removed and re-added. If we don't want for udev
  to process the entire queue it can happen that the
  wrong block device is used. This wrong selection is only
  possible because the way how hybrid ISOs are designed exposes
  both, the disk and the partition for the root device with
  the same label. This Fixes bsc#1213595</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1712232000">- Set default output console to gfxterm for grub
  If no console setting is done in the image description for grub
  the default output console is set to: gfxterm and the default
  input console is set to: console. This Fixes bsc#1219074</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427200">- Add rd.kiwi.oem.force_resize boot option
  Forces the disk resize process on an OEM disk image.
  If set, no sanity check for unpartitioned/free space
  is performed and also an eventually configured
  &lt;oem-resize-once&gt; configuration from the image description
  will not be taken into account. This Fixes bsc#1224389</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427201">- Do not exclude the .profile env file by default
  kiwi's initrd modules read a .profile file which gets included
  into the initrd produced at build time. To allow rebuild of a
  host-only initrd from the booted system this information should
  be present such that it is possible to re-use kiwi initrd code.
  This is related to bsc#1228118</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1722427202">- Fix kiwi-repart restrictions
  The kiwi repart dracut module reads a profile file and if it
  does not exists it dies in the initrd. However, that profile
  file is not mandatory for the main resize functionality. Thus
  this commit turns this into a warning message. In addition
  the module-setup for 90kiwi-repart makes sure to include
  the required and optional profile files.
  This Fixes bsc#1228118</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1723118400">- Update virtualenv setup
  types-pkg_resources got dropped from PyPI</changelog>
</package>
<package pkgid="fc81a33ef4b7f5fae432521728247b3c3cd815e843c6ece0df833b01f16629d8" name="dracut-kiwi-oem-dump" arch="aarch64">
  <version epoch="0" ver="9.24.43" rel="150100.3.81.1"/>
  <changelog author="dcassany@suse.com" date="1681300800">- Adding a comment to explain the s390 specific path
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1688472000">- Add alternative re-reading of the partition table
  To inform the kernel about disk geometry changes, kiwi uses
  partprobe as a primary tool. However it is provided by parted
  and not necessarily available due to the package requirements
  on the dracut module. A second attempt via blockdev which
  is expected to exist is therefore made by this commit
  Part of bsc#1216465
  (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7)</changelog>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698321600">- Create live persistent storage without busy state
  With the former logic the live ISO was already mounted when an
  eventual persistent storage partition was created. This leads
  to an issue on re-reading the partition table, not for all but
  several tools. This commit changes the order of tasks such that
  the setup of the persistent write storage is performed prior
  mounting the live ISO. In addition to this change an alternative
  method using blockdev to re-read the partition was added in case
  partprobe is not present. This also allows to get rid of the
  parted dependency which provides partprobe
  Part of bsc#1216465
  (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698408000">- Change partprobe fallback to partx
  Informing the kernel about a new partition geometry can be done in a
  busy state and is also effective for new devices and new mounts based
  on the new geometry. busy state mounts of course will not see it until
  swap of the busy state but a complete refuse of operation like it
  happens with blockdev is imho not required. Just as partprobe, partx
  is less restrictive on the busy state. That's why this commit changes
  the partprobe fallback to use partx instead of blockdev
  Part of bsc#1216465
  (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698840000">- Add partx to module-setup of kiwi-lib too
  Part of bsc#1216465
  (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1700654400">- Allow install disk overwrite from cmdline
  Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device
  that should be used in an OEM installation. This overwrites any
  other oem device setting, e.g device filter or maxdisk and just
  continues the installation on the given device. However, the
  device must exist and must be a block special.
  This Fixes jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704369600">- Fix overwrite of kiwi_oemunattended
  In case rd.kiwi.oem.installdevice is set, there is an overwrite
  of the kiwi_oemunattended setting. However the variable was set
  in local scope of a function and therefore the change was not
  effective in other methods which also evaluates this variable.
  This commit fixes it such that the overwrite happens in the early
  initialize method which provides the environment for all code
  running in the dracut module. This is related to jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1705579200">- Fixed grub terminal setup
  The grub terminal setup is divided into the setting for the output
  and the input console. For both settings different parameters exists.
  So far kiwi did not differentiate between the two parts of the
  console setup and that could lead to a wrong setting if only one
  value is provided in kiwi's console= attribute which lead to the
  grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm
  grub takes this for both input and output and it's obviously
  wrong for the input. To make this less error prune the kiwi code
  changes with this commit to set GRUB_TERMINAL_INPUT and
  GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity
  checks on the provided values if they are applicable. The information
  for setting up the console in the schema stays untouched though.
  That's because it's used for all bootloaders and also because grub
  supports multiple values for the console in/out setting in one
  GRUB_TERMINAL variable even though kiwi does no longer use it.
  To make this clear for the users also the documentation for the
  console attribute setup has been updated. If we want to wish two
  distinct attributes for input and output console settings a schema
  change and also differentiation between bootloaders is needed and
  that I only see for the kiwi-10 branch if at all. This Fixes #2419
  and Fixes bsc#1218095</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1710849600">- Fixup cleanup of zipl templates
  Make sure temporary modifications to the zipl template
  and config file are not effective in the later system.
  This Fixes bsc#1221469</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1711368000">- Live ISO Wait for udev events after repart
  Make sure to wait for the event queue to become empty after
  the creation of the write partition. When kiwi calls the
  code to create the write partition this emits new udev events.
  It's important to wait for the event queue to become empty
  to avoid a potential regression on the use of the device nodes.
  In the processing of the events it can happen that a device
  gets removed and re-added. If we don't want for udev
  to process the entire queue it can happen that the
  wrong block device is used. This wrong selection is only
  possible because the way how hybrid ISOs are designed exposes
  both, the disk and the partition for the root device with
  the same label. This Fixes bsc#1213595</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1712232000">- Set default output console to gfxterm for grub
  If no console setting is done in the image description for grub
  the default output console is set to: gfxterm and the default
  input console is set to: console. This Fixes bsc#1219074</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427200">- Add rd.kiwi.oem.force_resize boot option
  Forces the disk resize process on an OEM disk image.
  If set, no sanity check for unpartitioned/free space
  is performed and also an eventually configured
  &lt;oem-resize-once&gt; configuration from the image description
  will not be taken into account. This Fixes bsc#1224389</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427201">- Do not exclude the .profile env file by default
  kiwi's initrd modules read a .profile file which gets included
  into the initrd produced at build time. To allow rebuild of a
  host-only initrd from the booted system this information should
  be present such that it is possible to re-use kiwi initrd code.
  This is related to bsc#1228118</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1722427202">- Fix kiwi-repart restrictions
  The kiwi repart dracut module reads a profile file and if it
  does not exists it dies in the initrd. However, that profile
  file is not mandatory for the main resize functionality. Thus
  this commit turns this into a warning message. In addition
  the module-setup for 90kiwi-repart makes sure to include
  the required and optional profile files.
  This Fixes bsc#1228118</changelog>
</package>
<package pkgid="b3286cc6a778702c19219171ccb1c1b5189fc44e3214c8daea3b3ad772abf9d2" name="dracut-kiwi-oem-dump" arch="ppc64le">
  <version epoch="0" ver="9.24.43" rel="150100.3.81.1"/>
  <changelog author="dcassany@suse.com" date="1681300800">- Adding a comment to explain the s390 specific path
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1688472000">- Add alternative re-reading of the partition table
  To inform the kernel about disk geometry changes, kiwi uses
  partprobe as a primary tool. However it is provided by parted
  and not necessarily available due to the package requirements
  on the dracut module. A second attempt via blockdev which
  is expected to exist is therefore made by this commit
  Part of bsc#1216465
  (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7)</changelog>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698321600">- Create live persistent storage without busy state
  With the former logic the live ISO was already mounted when an
  eventual persistent storage partition was created. This leads
  to an issue on re-reading the partition table, not for all but
  several tools. This commit changes the order of tasks such that
  the setup of the persistent write storage is performed prior
  mounting the live ISO. In addition to this change an alternative
  method using blockdev to re-read the partition was added in case
  partprobe is not present. This also allows to get rid of the
  parted dependency which provides partprobe
  Part of bsc#1216465
  (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698408000">- Change partprobe fallback to partx
  Informing the kernel about a new partition geometry can be done in a
  busy state and is also effective for new devices and new mounts based
  on the new geometry. busy state mounts of course will not see it until
  swap of the busy state but a complete refuse of operation like it
  happens with blockdev is imho not required. Just as partprobe, partx
  is less restrictive on the busy state. That's why this commit changes
  the partprobe fallback to use partx instead of blockdev
  Part of bsc#1216465
  (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698840000">- Add partx to module-setup of kiwi-lib too
  Part of bsc#1216465
  (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1700654400">- Allow install disk overwrite from cmdline
  Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device
  that should be used in an OEM installation. This overwrites any
  other oem device setting, e.g device filter or maxdisk and just
  continues the installation on the given device. However, the
  device must exist and must be a block special.
  This Fixes jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704369600">- Fix overwrite of kiwi_oemunattended
  In case rd.kiwi.oem.installdevice is set, there is an overwrite
  of the kiwi_oemunattended setting. However the variable was set
  in local scope of a function and therefore the change was not
  effective in other methods which also evaluates this variable.
  This commit fixes it such that the overwrite happens in the early
  initialize method which provides the environment for all code
  running in the dracut module. This is related to jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1705579200">- Fixed grub terminal setup
  The grub terminal setup is divided into the setting for the output
  and the input console. For both settings different parameters exists.
  So far kiwi did not differentiate between the two parts of the
  console setup and that could lead to a wrong setting if only one
  value is provided in kiwi's console= attribute which lead to the
  grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm
  grub takes this for both input and output and it's obviously
  wrong for the input. To make this less error prune the kiwi code
  changes with this commit to set GRUB_TERMINAL_INPUT and
  GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity
  checks on the provided values if they are applicable. The information
  for setting up the console in the schema stays untouched though.
  That's because it's used for all bootloaders and also because grub
  supports multiple values for the console in/out setting in one
  GRUB_TERMINAL variable even though kiwi does no longer use it.
  To make this clear for the users also the documentation for the
  console attribute setup has been updated. If we want to wish two
  distinct attributes for input and output console settings a schema
  change and also differentiation between bootloaders is needed and
  that I only see for the kiwi-10 branch if at all. This Fixes #2419
  and Fixes bsc#1218095</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1710849600">- Fixup cleanup of zipl templates
  Make sure temporary modifications to the zipl template
  and config file are not effective in the later system.
  This Fixes bsc#1221469</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1711368000">- Live ISO Wait for udev events after repart
  Make sure to wait for the event queue to become empty after
  the creation of the write partition. When kiwi calls the
  code to create the write partition this emits new udev events.
  It's important to wait for the event queue to become empty
  to avoid a potential regression on the use of the device nodes.
  In the processing of the events it can happen that a device
  gets removed and re-added. If we don't want for udev
  to process the entire queue it can happen that the
  wrong block device is used. This wrong selection is only
  possible because the way how hybrid ISOs are designed exposes
  both, the disk and the partition for the root device with
  the same label. This Fixes bsc#1213595</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1712232000">- Set default output console to gfxterm for grub
  If no console setting is done in the image description for grub
  the default output console is set to: gfxterm and the default
  input console is set to: console. This Fixes bsc#1219074</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427200">- Add rd.kiwi.oem.force_resize boot option
  Forces the disk resize process on an OEM disk image.
  If set, no sanity check for unpartitioned/free space
  is performed and also an eventually configured
  &lt;oem-resize-once&gt; configuration from the image description
  will not be taken into account. This Fixes bsc#1224389</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427201">- Do not exclude the .profile env file by default
  kiwi's initrd modules read a .profile file which gets included
  into the initrd produced at build time. To allow rebuild of a
  host-only initrd from the booted system this information should
  be present such that it is possible to re-use kiwi initrd code.
  This is related to bsc#1228118</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1722427202">- Fix kiwi-repart restrictions
  The kiwi repart dracut module reads a profile file and if it
  does not exists it dies in the initrd. However, that profile
  file is not mandatory for the main resize functionality. Thus
  this commit turns this into a warning message. In addition
  the module-setup for 90kiwi-repart makes sure to include
  the required and optional profile files.
  This Fixes bsc#1228118</changelog>
</package>
<package pkgid="9c719205a66ad4f9f6f1960dbdf892f2820ed89406bcf87109b8015509842c19" name="dracut-kiwi-oem-dump" arch="s390x">
  <version epoch="0" ver="9.24.43" rel="150100.3.81.1"/>
  <changelog author="dcassany@suse.com" date="1681300800">- Adding a comment to explain the s390 specific path
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1688472000">- Add alternative re-reading of the partition table
  To inform the kernel about disk geometry changes, kiwi uses
  partprobe as a primary tool. However it is provided by parted
  and not necessarily available due to the package requirements
  on the dracut module. A second attempt via blockdev which
  is expected to exist is therefore made by this commit
  Part of bsc#1216465
  (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7)</changelog>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698321600">- Create live persistent storage without busy state
  With the former logic the live ISO was already mounted when an
  eventual persistent storage partition was created. This leads
  to an issue on re-reading the partition table, not for all but
  several tools. This commit changes the order of tasks such that
  the setup of the persistent write storage is performed prior
  mounting the live ISO. In addition to this change an alternative
  method using blockdev to re-read the partition was added in case
  partprobe is not present. This also allows to get rid of the
  parted dependency which provides partprobe
  Part of bsc#1216465
  (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698408000">- Change partprobe fallback to partx
  Informing the kernel about a new partition geometry can be done in a
  busy state and is also effective for new devices and new mounts based
  on the new geometry. busy state mounts of course will not see it until
  swap of the busy state but a complete refuse of operation like it
  happens with blockdev is imho not required. Just as partprobe, partx
  is less restrictive on the busy state. That's why this commit changes
  the partprobe fallback to use partx instead of blockdev
  Part of bsc#1216465
  (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698840000">- Add partx to module-setup of kiwi-lib too
  Part of bsc#1216465
  (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1700654400">- Allow install disk overwrite from cmdline
  Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device
  that should be used in an OEM installation. This overwrites any
  other oem device setting, e.g device filter or maxdisk and just
  continues the installation on the given device. However, the
  device must exist and must be a block special.
  This Fixes jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704369600">- Fix overwrite of kiwi_oemunattended
  In case rd.kiwi.oem.installdevice is set, there is an overwrite
  of the kiwi_oemunattended setting. However the variable was set
  in local scope of a function and therefore the change was not
  effective in other methods which also evaluates this variable.
  This commit fixes it such that the overwrite happens in the early
  initialize method which provides the environment for all code
  running in the dracut module. This is related to jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1705579200">- Fixed grub terminal setup
  The grub terminal setup is divided into the setting for the output
  and the input console. For both settings different parameters exists.
  So far kiwi did not differentiate between the two parts of the
  console setup and that could lead to a wrong setting if only one
  value is provided in kiwi's console= attribute which lead to the
  grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm
  grub takes this for both input and output and it's obviously
  wrong for the input. To make this less error prune the kiwi code
  changes with this commit to set GRUB_TERMINAL_INPUT and
  GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity
  checks on the provided values if they are applicable. The information
  for setting up the console in the schema stays untouched though.
  That's because it's used for all bootloaders and also because grub
  supports multiple values for the console in/out setting in one
  GRUB_TERMINAL variable even though kiwi does no longer use it.
  To make this clear for the users also the documentation for the
  console attribute setup has been updated. If we want to wish two
  distinct attributes for input and output console settings a schema
  change and also differentiation between bootloaders is needed and
  that I only see for the kiwi-10 branch if at all. This Fixes #2419
  and Fixes bsc#1218095</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1710849600">- Fixup cleanup of zipl templates
  Make sure temporary modifications to the zipl template
  and config file are not effective in the later system.
  This Fixes bsc#1221469</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1711368000">- Live ISO Wait for udev events after repart
  Make sure to wait for the event queue to become empty after
  the creation of the write partition. When kiwi calls the
  code to create the write partition this emits new udev events.
  It's important to wait for the event queue to become empty
  to avoid a potential regression on the use of the device nodes.
  In the processing of the events it can happen that a device
  gets removed and re-added. If we don't want for udev
  to process the entire queue it can happen that the
  wrong block device is used. This wrong selection is only
  possible because the way how hybrid ISOs are designed exposes
  both, the disk and the partition for the root device with
  the same label. This Fixes bsc#1213595</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1712232000">- Set default output console to gfxterm for grub
  If no console setting is done in the image description for grub
  the default output console is set to: gfxterm and the default
  input console is set to: console. This Fixes bsc#1219074</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427200">- Add rd.kiwi.oem.force_resize boot option
  Forces the disk resize process on an OEM disk image.
  If set, no sanity check for unpartitioned/free space
  is performed and also an eventually configured
  &lt;oem-resize-once&gt; configuration from the image description
  will not be taken into account. This Fixes bsc#1224389</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427201">- Do not exclude the .profile env file by default
  kiwi's initrd modules read a .profile file which gets included
  into the initrd produced at build time. To allow rebuild of a
  host-only initrd from the booted system this information should
  be present such that it is possible to re-use kiwi initrd code.
  This is related to bsc#1228118</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1722427202">- Fix kiwi-repart restrictions
  The kiwi repart dracut module reads a profile file and if it
  does not exists it dies in the initrd. However, that profile
  file is not mandatory for the main resize functionality. Thus
  this commit turns this into a warning message. In addition
  the module-setup for 90kiwi-repart makes sure to include
  the required and optional profile files.
  This Fixes bsc#1228118</changelog>
</package>
<package pkgid="16e35629d25249ecef97b51f8a95d1d444c00eadaf6b6c6a21db74004e89b1fc" name="dracut-kiwi-oem-dump" arch="x86_64">
  <version epoch="0" ver="9.24.43" rel="150100.3.81.1"/>
  <changelog author="dcassany@suse.com" date="1681300800">- Adding a comment to explain the s390 specific path
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1688472000">- Add alternative re-reading of the partition table
  To inform the kernel about disk geometry changes, kiwi uses
  partprobe as a primary tool. However it is provided by parted
  and not necessarily available due to the package requirements
  on the dracut module. A second attempt via blockdev which
  is expected to exist is therefore made by this commit
  Part of bsc#1216465
  (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7)</changelog>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698321600">- Create live persistent storage without busy state
  With the former logic the live ISO was already mounted when an
  eventual persistent storage partition was created. This leads
  to an issue on re-reading the partition table, not for all but
  several tools. This commit changes the order of tasks such that
  the setup of the persistent write storage is performed prior
  mounting the live ISO. In addition to this change an alternative
  method using blockdev to re-read the partition was added in case
  partprobe is not present. This also allows to get rid of the
  parted dependency which provides partprobe
  Part of bsc#1216465
  (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698408000">- Change partprobe fallback to partx
  Informing the kernel about a new partition geometry can be done in a
  busy state and is also effective for new devices and new mounts based
  on the new geometry. busy state mounts of course will not see it until
  swap of the busy state but a complete refuse of operation like it
  happens with blockdev is imho not required. Just as partprobe, partx
  is less restrictive on the busy state. That's why this commit changes
  the partprobe fallback to use partx instead of blockdev
  Part of bsc#1216465
  (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698840000">- Add partx to module-setup of kiwi-lib too
  Part of bsc#1216465
  (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1700654400">- Allow install disk overwrite from cmdline
  Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device
  that should be used in an OEM installation. This overwrites any
  other oem device setting, e.g device filter or maxdisk and just
  continues the installation on the given device. However, the
  device must exist and must be a block special.
  This Fixes jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704369600">- Fix overwrite of kiwi_oemunattended
  In case rd.kiwi.oem.installdevice is set, there is an overwrite
  of the kiwi_oemunattended setting. However the variable was set
  in local scope of a function and therefore the change was not
  effective in other methods which also evaluates this variable.
  This commit fixes it such that the overwrite happens in the early
  initialize method which provides the environment for all code
  running in the dracut module. This is related to jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1705579200">- Fixed grub terminal setup
  The grub terminal setup is divided into the setting for the output
  and the input console. For both settings different parameters exists.
  So far kiwi did not differentiate between the two parts of the
  console setup and that could lead to a wrong setting if only one
  value is provided in kiwi's console= attribute which lead to the
  grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm
  grub takes this for both input and output and it's obviously
  wrong for the input. To make this less error prune the kiwi code
  changes with this commit to set GRUB_TERMINAL_INPUT and
  GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity
  checks on the provided values if they are applicable. The information
  for setting up the console in the schema stays untouched though.
  That's because it's used for all bootloaders and also because grub
  supports multiple values for the console in/out setting in one
  GRUB_TERMINAL variable even though kiwi does no longer use it.
  To make this clear for the users also the documentation for the
  console attribute setup has been updated. If we want to wish two
  distinct attributes for input and output console settings a schema
  change and also differentiation between bootloaders is needed and
  that I only see for the kiwi-10 branch if at all. This Fixes #2419
  and Fixes bsc#1218095</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1710849600">- Fixup cleanup of zipl templates
  Make sure temporary modifications to the zipl template
  and config file are not effective in the later system.
  This Fixes bsc#1221469</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1711368000">- Live ISO Wait for udev events after repart
  Make sure to wait for the event queue to become empty after
  the creation of the write partition. When kiwi calls the
  code to create the write partition this emits new udev events.
  It's important to wait for the event queue to become empty
  to avoid a potential regression on the use of the device nodes.
  In the processing of the events it can happen that a device
  gets removed and re-added. If we don't want for udev
  to process the entire queue it can happen that the
  wrong block device is used. This wrong selection is only
  possible because the way how hybrid ISOs are designed exposes
  both, the disk and the partition for the root device with
  the same label. This Fixes bsc#1213595</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1712232000">- Set default output console to gfxterm for grub
  If no console setting is done in the image description for grub
  the default output console is set to: gfxterm and the default
  input console is set to: console. This Fixes bsc#1219074</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427200">- Add rd.kiwi.oem.force_resize boot option
  Forces the disk resize process on an OEM disk image.
  If set, no sanity check for unpartitioned/free space
  is performed and also an eventually configured
  &lt;oem-resize-once&gt; configuration from the image description
  will not be taken into account. This Fixes bsc#1224389</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427201">- Do not exclude the .profile env file by default
  kiwi's initrd modules read a .profile file which gets included
  into the initrd produced at build time. To allow rebuild of a
  host-only initrd from the booted system this information should
  be present such that it is possible to re-use kiwi initrd code.
  This is related to bsc#1228118</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1722427202">- Fix kiwi-repart restrictions
  The kiwi repart dracut module reads a profile file and if it
  does not exists it dies in the initrd. However, that profile
  file is not mandatory for the main resize functionality. Thus
  this commit turns this into a warning message. In addition
  the module-setup for 90kiwi-repart makes sure to include
  the required and optional profile files.
  This Fixes bsc#1228118</changelog>
</package>
<package pkgid="8fed2e3940c2b5a1fdc7343241f3e7439678b3e531d09e41a08f92c5d5360c21" name="dracut-kiwi-oem-dump" arch="aarch64">
  <version epoch="0" ver="9.24.43" rel="150100.3.84.1"/>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698321600">- Create live persistent storage without busy state
  With the former logic the live ISO was already mounted when an
  eventual persistent storage partition was created. This leads
  to an issue on re-reading the partition table, not for all but
  several tools. This commit changes the order of tasks such that
  the setup of the persistent write storage is performed prior
  mounting the live ISO. In addition to this change an alternative
  method using blockdev to re-read the partition was added in case
  partprobe is not present. This also allows to get rid of the
  parted dependency which provides partprobe
  Part of bsc#1216465
  (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698408000">- Change partprobe fallback to partx
  Informing the kernel about a new partition geometry can be done in a
  busy state and is also effective for new devices and new mounts based
  on the new geometry. busy state mounts of course will not see it until
  swap of the busy state but a complete refuse of operation like it
  happens with blockdev is imho not required. Just as partprobe, partx
  is less restrictive on the busy state. That's why this commit changes
  the partprobe fallback to use partx instead of blockdev
  Part of bsc#1216465
  (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698840000">- Add partx to module-setup of kiwi-lib too
  Part of bsc#1216465
  (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1700654400">- Allow install disk overwrite from cmdline
  Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device
  that should be used in an OEM installation. This overwrites any
  other oem device setting, e.g device filter or maxdisk and just
  continues the installation on the given device. However, the
  device must exist and must be a block special.
  This Fixes jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704369600">- Fix overwrite of kiwi_oemunattended
  In case rd.kiwi.oem.installdevice is set, there is an overwrite
  of the kiwi_oemunattended setting. However the variable was set
  in local scope of a function and therefore the change was not
  effective in other methods which also evaluates this variable.
  This commit fixes it such that the overwrite happens in the early
  initialize method which provides the environment for all code
  running in the dracut module. This is related to jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704801600">- Fixed regression in GRUB_SERIAL_COMMAND setup
  The condition to write the serial line setup was broken.
  This commit fixes it. Related to Issue #2419 and
  Fixes bsc#1228808</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1705579200">- Fixed grub terminal setup
  The grub terminal setup is divided into the setting for the output
  and the input console. For both settings different parameters exists.
  So far kiwi did not differentiate between the two parts of the
  console setup and that could lead to a wrong setting if only one
  value is provided in kiwi's console= attribute which lead to the
  grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm
  grub takes this for both input and output and it's obviously
  wrong for the input. To make this less error prune the kiwi code
  changes with this commit to set GRUB_TERMINAL_INPUT and
  GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity
  checks on the provided values if they are applicable. The information
  for setting up the console in the schema stays untouched though.
  That's because it's used for all bootloaders and also because grub
  supports multiple values for the console in/out setting in one
  GRUB_TERMINAL variable even though kiwi does no longer use it.
  To make this clear for the users also the documentation for the
  console attribute setup has been updated. If we want to wish two
  distinct attributes for input and output console settings a schema
  change and also differentiation between bootloaders is needed and
  that I only see for the kiwi-10 branch if at all. This Fixes #2419
  and Fixes bsc#1218095</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1710849600">- Fixup cleanup of zipl templates
  Make sure temporary modifications to the zipl template
  and config file are not effective in the later system.
  This Fixes bsc#1221469</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1711368000">- Live ISO Wait for udev events after repart
  Make sure to wait for the event queue to become empty after
  the creation of the write partition. When kiwi calls the
  code to create the write partition this emits new udev events.
  It's important to wait for the event queue to become empty
  to avoid a potential regression on the use of the device nodes.
  In the processing of the events it can happen that a device
  gets removed and re-added. If we don't want for udev
  to process the entire queue it can happen that the
  wrong block device is used. This wrong selection is only
  possible because the way how hybrid ISOs are designed exposes
  both, the disk and the partition for the root device with
  the same label. This Fixes bsc#1213595</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1712232000">- Set default output console to gfxterm for grub
  If no console setting is done in the image description for grub
  the default output console is set to: gfxterm and the default
  input console is set to: console. This Fixes bsc#1219074</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427200">- Add rd.kiwi.oem.force_resize boot option
  Forces the disk resize process on an OEM disk image.
  If set, no sanity check for unpartitioned/free space
  is performed and also an eventually configured
  &lt;oem-resize-once&gt; configuration from the image description
  will not be taken into account. This Fixes bsc#1224389</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427201">- Do not exclude the .profile env file by default
  kiwi's initrd modules read a .profile file which gets included
  into the initrd produced at build time. To allow rebuild of a
  host-only initrd from the booted system this information should
  be present such that it is possible to re-use kiwi initrd code.
  This is related to bsc#1228118</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1722427202">- Fix kiwi-repart restrictions
  The kiwi repart dracut module reads a profile file and if it
  does not exists it dies in the initrd. However, that profile
  file is not mandatory for the main resize functionality. Thus
  this commit turns this into a warning message. In addition
  the module-setup for 90kiwi-repart makes sure to include
  the required and optional profile files.
  This Fixes bsc#1228118</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1723118400">- Update virtualenv setup
  types-pkg_resources got dropped from PyPI</changelog>
</package>
<package pkgid="de3a065ac123bd2e0664c76be86cf209a0a5dcba244220475d745a1050c1d198" name="dracut-kiwi-oem-dump" arch="ppc64le">
  <version epoch="0" ver="9.24.43" rel="150100.3.84.1"/>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698321600">- Create live persistent storage without busy state
  With the former logic the live ISO was already mounted when an
  eventual persistent storage partition was created. This leads
  to an issue on re-reading the partition table, not for all but
  several tools. This commit changes the order of tasks such that
  the setup of the persistent write storage is performed prior
  mounting the live ISO. In addition to this change an alternative
  method using blockdev to re-read the partition was added in case
  partprobe is not present. This also allows to get rid of the
  parted dependency which provides partprobe
  Part of bsc#1216465
  (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698408000">- Change partprobe fallback to partx
  Informing the kernel about a new partition geometry can be done in a
  busy state and is also effective for new devices and new mounts based
  on the new geometry. busy state mounts of course will not see it until
  swap of the busy state but a complete refuse of operation like it
  happens with blockdev is imho not required. Just as partprobe, partx
  is less restrictive on the busy state. That's why this commit changes
  the partprobe fallback to use partx instead of blockdev
  Part of bsc#1216465
  (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698840000">- Add partx to module-setup of kiwi-lib too
  Part of bsc#1216465
  (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1700654400">- Allow install disk overwrite from cmdline
  Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device
  that should be used in an OEM installation. This overwrites any
  other oem device setting, e.g device filter or maxdisk and just
  continues the installation on the given device. However, the
  device must exist and must be a block special.
  This Fixes jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704369600">- Fix overwrite of kiwi_oemunattended
  In case rd.kiwi.oem.installdevice is set, there is an overwrite
  of the kiwi_oemunattended setting. However the variable was set
  in local scope of a function and therefore the change was not
  effective in other methods which also evaluates this variable.
  This commit fixes it such that the overwrite happens in the early
  initialize method which provides the environment for all code
  running in the dracut module. This is related to jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704801600">- Fixed regression in GRUB_SERIAL_COMMAND setup
  The condition to write the serial line setup was broken.
  This commit fixes it. Related to Issue #2419 and
  Fixes bsc#1228808</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1705579200">- Fixed grub terminal setup
  The grub terminal setup is divided into the setting for the output
  and the input console. For both settings different parameters exists.
  So far kiwi did not differentiate between the two parts of the
  console setup and that could lead to a wrong setting if only one
  value is provided in kiwi's console= attribute which lead to the
  grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm
  grub takes this for both input and output and it's obviously
  wrong for the input. To make this less error prune the kiwi code
  changes with this commit to set GRUB_TERMINAL_INPUT and
  GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity
  checks on the provided values if they are applicable. The information
  for setting up the console in the schema stays untouched though.
  That's because it's used for all bootloaders and also because grub
  supports multiple values for the console in/out setting in one
  GRUB_TERMINAL variable even though kiwi does no longer use it.
  To make this clear for the users also the documentation for the
  console attribute setup has been updated. If we want to wish two
  distinct attributes for input and output console settings a schema
  change and also differentiation between bootloaders is needed and
  that I only see for the kiwi-10 branch if at all. This Fixes #2419
  and Fixes bsc#1218095</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1710849600">- Fixup cleanup of zipl templates
  Make sure temporary modifications to the zipl template
  and config file are not effective in the later system.
  This Fixes bsc#1221469</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1711368000">- Live ISO Wait for udev events after repart
  Make sure to wait for the event queue to become empty after
  the creation of the write partition. When kiwi calls the
  code to create the write partition this emits new udev events.
  It's important to wait for the event queue to become empty
  to avoid a potential regression on the use of the device nodes.
  In the processing of the events it can happen that a device
  gets removed and re-added. If we don't want for udev
  to process the entire queue it can happen that the
  wrong block device is used. This wrong selection is only
  possible because the way how hybrid ISOs are designed exposes
  both, the disk and the partition for the root device with
  the same label. This Fixes bsc#1213595</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1712232000">- Set default output console to gfxterm for grub
  If no console setting is done in the image description for grub
  the default output console is set to: gfxterm and the default
  input console is set to: console. This Fixes bsc#1219074</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427200">- Add rd.kiwi.oem.force_resize boot option
  Forces the disk resize process on an OEM disk image.
  If set, no sanity check for unpartitioned/free space
  is performed and also an eventually configured
  &lt;oem-resize-once&gt; configuration from the image description
  will not be taken into account. This Fixes bsc#1224389</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427201">- Do not exclude the .profile env file by default
  kiwi's initrd modules read a .profile file which gets included
  into the initrd produced at build time. To allow rebuild of a
  host-only initrd from the booted system this information should
  be present such that it is possible to re-use kiwi initrd code.
  This is related to bsc#1228118</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1722427202">- Fix kiwi-repart restrictions
  The kiwi repart dracut module reads a profile file and if it
  does not exists it dies in the initrd. However, that profile
  file is not mandatory for the main resize functionality. Thus
  this commit turns this into a warning message. In addition
  the module-setup for 90kiwi-repart makes sure to include
  the required and optional profile files.
  This Fixes bsc#1228118</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1723118400">- Update virtualenv setup
  types-pkg_resources got dropped from PyPI</changelog>
</package>
<package pkgid="1b8914a0f6de239a9dffa00d3f559dd0534da0ae8e08d6653d46870831c15e13" name="dracut-kiwi-oem-dump" arch="s390x">
  <version epoch="0" ver="9.24.43" rel="150100.3.84.1"/>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698321600">- Create live persistent storage without busy state
  With the former logic the live ISO was already mounted when an
  eventual persistent storage partition was created. This leads
  to an issue on re-reading the partition table, not for all but
  several tools. This commit changes the order of tasks such that
  the setup of the persistent write storage is performed prior
  mounting the live ISO. In addition to this change an alternative
  method using blockdev to re-read the partition was added in case
  partprobe is not present. This also allows to get rid of the
  parted dependency which provides partprobe
  Part of bsc#1216465
  (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698408000">- Change partprobe fallback to partx
  Informing the kernel about a new partition geometry can be done in a
  busy state and is also effective for new devices and new mounts based
  on the new geometry. busy state mounts of course will not see it until
  swap of the busy state but a complete refuse of operation like it
  happens with blockdev is imho not required. Just as partprobe, partx
  is less restrictive on the busy state. That's why this commit changes
  the partprobe fallback to use partx instead of blockdev
  Part of bsc#1216465
  (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698840000">- Add partx to module-setup of kiwi-lib too
  Part of bsc#1216465
  (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1700654400">- Allow install disk overwrite from cmdline
  Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device
  that should be used in an OEM installation. This overwrites any
  other oem device setting, e.g device filter or maxdisk and just
  continues the installation on the given device. However, the
  device must exist and must be a block special.
  This Fixes jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704369600">- Fix overwrite of kiwi_oemunattended
  In case rd.kiwi.oem.installdevice is set, there is an overwrite
  of the kiwi_oemunattended setting. However the variable was set
  in local scope of a function and therefore the change was not
  effective in other methods which also evaluates this variable.
  This commit fixes it such that the overwrite happens in the early
  initialize method which provides the environment for all code
  running in the dracut module. This is related to jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704801600">- Fixed regression in GRUB_SERIAL_COMMAND setup
  The condition to write the serial line setup was broken.
  This commit fixes it. Related to Issue #2419 and
  Fixes bsc#1228808</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1705579200">- Fixed grub terminal setup
  The grub terminal setup is divided into the setting for the output
  and the input console. For both settings different parameters exists.
  So far kiwi did not differentiate between the two parts of the
  console setup and that could lead to a wrong setting if only one
  value is provided in kiwi's console= attribute which lead to the
  grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm
  grub takes this for both input and output and it's obviously
  wrong for the input. To make this less error prune the kiwi code
  changes with this commit to set GRUB_TERMINAL_INPUT and
  GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity
  checks on the provided values if they are applicable. The information
  for setting up the console in the schema stays untouched though.
  That's because it's used for all bootloaders and also because grub
  supports multiple values for the console in/out setting in one
  GRUB_TERMINAL variable even though kiwi does no longer use it.
  To make this clear for the users also the documentation for the
  console attribute setup has been updated. If we want to wish two
  distinct attributes for input and output console settings a schema
  change and also differentiation between bootloaders is needed and
  that I only see for the kiwi-10 branch if at all. This Fixes #2419
  and Fixes bsc#1218095</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1710849600">- Fixup cleanup of zipl templates
  Make sure temporary modifications to the zipl template
  and config file are not effective in the later system.
  This Fixes bsc#1221469</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1711368000">- Live ISO Wait for udev events after repart
  Make sure to wait for the event queue to become empty after
  the creation of the write partition. When kiwi calls the
  code to create the write partition this emits new udev events.
  It's important to wait for the event queue to become empty
  to avoid a potential regression on the use of the device nodes.
  In the processing of the events it can happen that a device
  gets removed and re-added. If we don't want for udev
  to process the entire queue it can happen that the
  wrong block device is used. This wrong selection is only
  possible because the way how hybrid ISOs are designed exposes
  both, the disk and the partition for the root device with
  the same label. This Fixes bsc#1213595</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1712232000">- Set default output console to gfxterm for grub
  If no console setting is done in the image description for grub
  the default output console is set to: gfxterm and the default
  input console is set to: console. This Fixes bsc#1219074</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427200">- Add rd.kiwi.oem.force_resize boot option
  Forces the disk resize process on an OEM disk image.
  If set, no sanity check for unpartitioned/free space
  is performed and also an eventually configured
  &lt;oem-resize-once&gt; configuration from the image description
  will not be taken into account. This Fixes bsc#1224389</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427201">- Do not exclude the .profile env file by default
  kiwi's initrd modules read a .profile file which gets included
  into the initrd produced at build time. To allow rebuild of a
  host-only initrd from the booted system this information should
  be present such that it is possible to re-use kiwi initrd code.
  This is related to bsc#1228118</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1722427202">- Fix kiwi-repart restrictions
  The kiwi repart dracut module reads a profile file and if it
  does not exists it dies in the initrd. However, that profile
  file is not mandatory for the main resize functionality. Thus
  this commit turns this into a warning message. In addition
  the module-setup for 90kiwi-repart makes sure to include
  the required and optional profile files.
  This Fixes bsc#1228118</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1723118400">- Update virtualenv setup
  types-pkg_resources got dropped from PyPI</changelog>
</package>
<package pkgid="47189cd60eb308384d456f7a89babd97f110fdb3a83140bb1bfed6d961139184" name="dracut-kiwi-oem-dump" arch="x86_64">
  <version epoch="0" ver="9.24.43" rel="150100.3.84.1"/>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698321600">- Create live persistent storage without busy state
  With the former logic the live ISO was already mounted when an
  eventual persistent storage partition was created. This leads
  to an issue on re-reading the partition table, not for all but
  several tools. This commit changes the order of tasks such that
  the setup of the persistent write storage is performed prior
  mounting the live ISO. In addition to this change an alternative
  method using blockdev to re-read the partition was added in case
  partprobe is not present. This also allows to get rid of the
  parted dependency which provides partprobe
  Part of bsc#1216465
  (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698408000">- Change partprobe fallback to partx
  Informing the kernel about a new partition geometry can be done in a
  busy state and is also effective for new devices and new mounts based
  on the new geometry. busy state mounts of course will not see it until
  swap of the busy state but a complete refuse of operation like it
  happens with blockdev is imho not required. Just as partprobe, partx
  is less restrictive on the busy state. That's why this commit changes
  the partprobe fallback to use partx instead of blockdev
  Part of bsc#1216465
  (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698840000">- Add partx to module-setup of kiwi-lib too
  Part of bsc#1216465
  (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1700654400">- Allow install disk overwrite from cmdline
  Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device
  that should be used in an OEM installation. This overwrites any
  other oem device setting, e.g device filter or maxdisk and just
  continues the installation on the given device. However, the
  device must exist and must be a block special.
  This Fixes jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704369600">- Fix overwrite of kiwi_oemunattended
  In case rd.kiwi.oem.installdevice is set, there is an overwrite
  of the kiwi_oemunattended setting. However the variable was set
  in local scope of a function and therefore the change was not
  effective in other methods which also evaluates this variable.
  This commit fixes it such that the overwrite happens in the early
  initialize method which provides the environment for all code
  running in the dracut module. This is related to jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704801600">- Fixed regression in GRUB_SERIAL_COMMAND setup
  The condition to write the serial line setup was broken.
  This commit fixes it. Related to Issue #2419 and
  Fixes bsc#1228808</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1705579200">- Fixed grub terminal setup
  The grub terminal setup is divided into the setting for the output
  and the input console. For both settings different parameters exists.
  So far kiwi did not differentiate between the two parts of the
  console setup and that could lead to a wrong setting if only one
  value is provided in kiwi's console= attribute which lead to the
  grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm
  grub takes this for both input and output and it's obviously
  wrong for the input. To make this less error prune the kiwi code
  changes with this commit to set GRUB_TERMINAL_INPUT and
  GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity
  checks on the provided values if they are applicable. The information
  for setting up the console in the schema stays untouched though.
  That's because it's used for all bootloaders and also because grub
  supports multiple values for the console in/out setting in one
  GRUB_TERMINAL variable even though kiwi does no longer use it.
  To make this clear for the users also the documentation for the
  console attribute setup has been updated. If we want to wish two
  distinct attributes for input and output console settings a schema
  change and also differentiation between bootloaders is needed and
  that I only see for the kiwi-10 branch if at all. This Fixes #2419
  and Fixes bsc#1218095</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1710849600">- Fixup cleanup of zipl templates
  Make sure temporary modifications to the zipl template
  and config file are not effective in the later system.
  This Fixes bsc#1221469</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1711368000">- Live ISO Wait for udev events after repart
  Make sure to wait for the event queue to become empty after
  the creation of the write partition. When kiwi calls the
  code to create the write partition this emits new udev events.
  It's important to wait for the event queue to become empty
  to avoid a potential regression on the use of the device nodes.
  In the processing of the events it can happen that a device
  gets removed and re-added. If we don't want for udev
  to process the entire queue it can happen that the
  wrong block device is used. This wrong selection is only
  possible because the way how hybrid ISOs are designed exposes
  both, the disk and the partition for the root device with
  the same label. This Fixes bsc#1213595</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1712232000">- Set default output console to gfxterm for grub
  If no console setting is done in the image description for grub
  the default output console is set to: gfxterm and the default
  input console is set to: console. This Fixes bsc#1219074</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427200">- Add rd.kiwi.oem.force_resize boot option
  Forces the disk resize process on an OEM disk image.
  If set, no sanity check for unpartitioned/free space
  is performed and also an eventually configured
  &lt;oem-resize-once&gt; configuration from the image description
  will not be taken into account. This Fixes bsc#1224389</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427201">- Do not exclude the .profile env file by default
  kiwi's initrd modules read a .profile file which gets included
  into the initrd produced at build time. To allow rebuild of a
  host-only initrd from the booted system this information should
  be present such that it is possible to re-use kiwi initrd code.
  This is related to bsc#1228118</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1722427202">- Fix kiwi-repart restrictions
  The kiwi repart dracut module reads a profile file and if it
  does not exists it dies in the initrd. However, that profile
  file is not mandatory for the main resize functionality. Thus
  this commit turns this into a warning message. In addition
  the module-setup for 90kiwi-repart makes sure to include
  the required and optional profile files.
  This Fixes bsc#1228118</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1723118400">- Update virtualenv setup
  types-pkg_resources got dropped from PyPI</changelog>
</package>
<package pkgid="3cdef7842bccabffa052e6abe0c8bd2f9dbb023b8b10b677130a84f77a97f5ea" name="dracut-kiwi-oem-repart" arch="aarch64">
  <version epoch="0" ver="9.24.43" rel="150100.3.81.1"/>
  <changelog author="dcassany@suse.com" date="1681300800">- Adding a comment to explain the s390 specific path
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1688472000">- Add alternative re-reading of the partition table
  To inform the kernel about disk geometry changes, kiwi uses
  partprobe as a primary tool. However it is provided by parted
  and not necessarily available due to the package requirements
  on the dracut module. A second attempt via blockdev which
  is expected to exist is therefore made by this commit
  Part of bsc#1216465
  (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7)</changelog>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698321600">- Create live persistent storage without busy state
  With the former logic the live ISO was already mounted when an
  eventual persistent storage partition was created. This leads
  to an issue on re-reading the partition table, not for all but
  several tools. This commit changes the order of tasks such that
  the setup of the persistent write storage is performed prior
  mounting the live ISO. In addition to this change an alternative
  method using blockdev to re-read the partition was added in case
  partprobe is not present. This also allows to get rid of the
  parted dependency which provides partprobe
  Part of bsc#1216465
  (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698408000">- Change partprobe fallback to partx
  Informing the kernel about a new partition geometry can be done in a
  busy state and is also effective for new devices and new mounts based
  on the new geometry. busy state mounts of course will not see it until
  swap of the busy state but a complete refuse of operation like it
  happens with blockdev is imho not required. Just as partprobe, partx
  is less restrictive on the busy state. That's why this commit changes
  the partprobe fallback to use partx instead of blockdev
  Part of bsc#1216465
  (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698840000">- Add partx to module-setup of kiwi-lib too
  Part of bsc#1216465
  (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1700654400">- Allow install disk overwrite from cmdline
  Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device
  that should be used in an OEM installation. This overwrites any
  other oem device setting, e.g device filter or maxdisk and just
  continues the installation on the given device. However, the
  device must exist and must be a block special.
  This Fixes jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704369600">- Fix overwrite of kiwi_oemunattended
  In case rd.kiwi.oem.installdevice is set, there is an overwrite
  of the kiwi_oemunattended setting. However the variable was set
  in local scope of a function and therefore the change was not
  effective in other methods which also evaluates this variable.
  This commit fixes it such that the overwrite happens in the early
  initialize method which provides the environment for all code
  running in the dracut module. This is related to jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1705579200">- Fixed grub terminal setup
  The grub terminal setup is divided into the setting for the output
  and the input console. For both settings different parameters exists.
  So far kiwi did not differentiate between the two parts of the
  console setup and that could lead to a wrong setting if only one
  value is provided in kiwi's console= attribute which lead to the
  grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm
  grub takes this for both input and output and it's obviously
  wrong for the input. To make this less error prune the kiwi code
  changes with this commit to set GRUB_TERMINAL_INPUT and
  GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity
  checks on the provided values if they are applicable. The information
  for setting up the console in the schema stays untouched though.
  That's because it's used for all bootloaders and also because grub
  supports multiple values for the console in/out setting in one
  GRUB_TERMINAL variable even though kiwi does no longer use it.
  To make this clear for the users also the documentation for the
  console attribute setup has been updated. If we want to wish two
  distinct attributes for input and output console settings a schema
  change and also differentiation between bootloaders is needed and
  that I only see for the kiwi-10 branch if at all. This Fixes #2419
  and Fixes bsc#1218095</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1710849600">- Fixup cleanup of zipl templates
  Make sure temporary modifications to the zipl template
  and config file are not effective in the later system.
  This Fixes bsc#1221469</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1711368000">- Live ISO Wait for udev events after repart
  Make sure to wait for the event queue to become empty after
  the creation of the write partition. When kiwi calls the
  code to create the write partition this emits new udev events.
  It's important to wait for the event queue to become empty
  to avoid a potential regression on the use of the device nodes.
  In the processing of the events it can happen that a device
  gets removed and re-added. If we don't want for udev
  to process the entire queue it can happen that the
  wrong block device is used. This wrong selection is only
  possible because the way how hybrid ISOs are designed exposes
  both, the disk and the partition for the root device with
  the same label. This Fixes bsc#1213595</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1712232000">- Set default output console to gfxterm for grub
  If no console setting is done in the image description for grub
  the default output console is set to: gfxterm and the default
  input console is set to: console. This Fixes bsc#1219074</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427200">- Add rd.kiwi.oem.force_resize boot option
  Forces the disk resize process on an OEM disk image.
  If set, no sanity check for unpartitioned/free space
  is performed and also an eventually configured
  &lt;oem-resize-once&gt; configuration from the image description
  will not be taken into account. This Fixes bsc#1224389</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427201">- Do not exclude the .profile env file by default
  kiwi's initrd modules read a .profile file which gets included
  into the initrd produced at build time. To allow rebuild of a
  host-only initrd from the booted system this information should
  be present such that it is possible to re-use kiwi initrd code.
  This is related to bsc#1228118</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1722427202">- Fix kiwi-repart restrictions
  The kiwi repart dracut module reads a profile file and if it
  does not exists it dies in the initrd. However, that profile
  file is not mandatory for the main resize functionality. Thus
  this commit turns this into a warning message. In addition
  the module-setup for 90kiwi-repart makes sure to include
  the required and optional profile files.
  This Fixes bsc#1228118</changelog>
</package>
<package pkgid="47919da3792a7eba6973c64d31126c2f1e8dfb3e1a706d659d0eb0ea7b80b562" name="dracut-kiwi-oem-repart" arch="ppc64le">
  <version epoch="0" ver="9.24.43" rel="150100.3.81.1"/>
  <changelog author="dcassany@suse.com" date="1681300800">- Adding a comment to explain the s390 specific path
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1688472000">- Add alternative re-reading of the partition table
  To inform the kernel about disk geometry changes, kiwi uses
  partprobe as a primary tool. However it is provided by parted
  and not necessarily available due to the package requirements
  on the dracut module. A second attempt via blockdev which
  is expected to exist is therefore made by this commit
  Part of bsc#1216465
  (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7)</changelog>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698321600">- Create live persistent storage without busy state
  With the former logic the live ISO was already mounted when an
  eventual persistent storage partition was created. This leads
  to an issue on re-reading the partition table, not for all but
  several tools. This commit changes the order of tasks such that
  the setup of the persistent write storage is performed prior
  mounting the live ISO. In addition to this change an alternative
  method using blockdev to re-read the partition was added in case
  partprobe is not present. This also allows to get rid of the
  parted dependency which provides partprobe
  Part of bsc#1216465
  (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698408000">- Change partprobe fallback to partx
  Informing the kernel about a new partition geometry can be done in a
  busy state and is also effective for new devices and new mounts based
  on the new geometry. busy state mounts of course will not see it until
  swap of the busy state but a complete refuse of operation like it
  happens with blockdev is imho not required. Just as partprobe, partx
  is less restrictive on the busy state. That's why this commit changes
  the partprobe fallback to use partx instead of blockdev
  Part of bsc#1216465
  (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698840000">- Add partx to module-setup of kiwi-lib too
  Part of bsc#1216465
  (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1700654400">- Allow install disk overwrite from cmdline
  Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device
  that should be used in an OEM installation. This overwrites any
  other oem device setting, e.g device filter or maxdisk and just
  continues the installation on the given device. However, the
  device must exist and must be a block special.
  This Fixes jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704369600">- Fix overwrite of kiwi_oemunattended
  In case rd.kiwi.oem.installdevice is set, there is an overwrite
  of the kiwi_oemunattended setting. However the variable was set
  in local scope of a function and therefore the change was not
  effective in other methods which also evaluates this variable.
  This commit fixes it such that the overwrite happens in the early
  initialize method which provides the environment for all code
  running in the dracut module. This is related to jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1705579200">- Fixed grub terminal setup
  The grub terminal setup is divided into the setting for the output
  and the input console. For both settings different parameters exists.
  So far kiwi did not differentiate between the two parts of the
  console setup and that could lead to a wrong setting if only one
  value is provided in kiwi's console= attribute which lead to the
  grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm
  grub takes this for both input and output and it's obviously
  wrong for the input. To make this less error prune the kiwi code
  changes with this commit to set GRUB_TERMINAL_INPUT and
  GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity
  checks on the provided values if they are applicable. The information
  for setting up the console in the schema stays untouched though.
  That's because it's used for all bootloaders and also because grub
  supports multiple values for the console in/out setting in one
  GRUB_TERMINAL variable even though kiwi does no longer use it.
  To make this clear for the users also the documentation for the
  console attribute setup has been updated. If we want to wish two
  distinct attributes for input and output console settings a schema
  change and also differentiation between bootloaders is needed and
  that I only see for the kiwi-10 branch if at all. This Fixes #2419
  and Fixes bsc#1218095</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1710849600">- Fixup cleanup of zipl templates
  Make sure temporary modifications to the zipl template
  and config file are not effective in the later system.
  This Fixes bsc#1221469</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1711368000">- Live ISO Wait for udev events after repart
  Make sure to wait for the event queue to become empty after
  the creation of the write partition. When kiwi calls the
  code to create the write partition this emits new udev events.
  It's important to wait for the event queue to become empty
  to avoid a potential regression on the use of the device nodes.
  In the processing of the events it can happen that a device
  gets removed and re-added. If we don't want for udev
  to process the entire queue it can happen that the
  wrong block device is used. This wrong selection is only
  possible because the way how hybrid ISOs are designed exposes
  both, the disk and the partition for the root device with
  the same label. This Fixes bsc#1213595</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1712232000">- Set default output console to gfxterm for grub
  If no console setting is done in the image description for grub
  the default output console is set to: gfxterm and the default
  input console is set to: console. This Fixes bsc#1219074</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427200">- Add rd.kiwi.oem.force_resize boot option
  Forces the disk resize process on an OEM disk image.
  If set, no sanity check for unpartitioned/free space
  is performed and also an eventually configured
  &lt;oem-resize-once&gt; configuration from the image description
  will not be taken into account. This Fixes bsc#1224389</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427201">- Do not exclude the .profile env file by default
  kiwi's initrd modules read a .profile file which gets included
  into the initrd produced at build time. To allow rebuild of a
  host-only initrd from the booted system this information should
  be present such that it is possible to re-use kiwi initrd code.
  This is related to bsc#1228118</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1722427202">- Fix kiwi-repart restrictions
  The kiwi repart dracut module reads a profile file and if it
  does not exists it dies in the initrd. However, that profile
  file is not mandatory for the main resize functionality. Thus
  this commit turns this into a warning message. In addition
  the module-setup for 90kiwi-repart makes sure to include
  the required and optional profile files.
  This Fixes bsc#1228118</changelog>
</package>
<package pkgid="71223d479860600badf2240719e7118665a3e4ee606ce890b5367dfaaaa053bc" name="dracut-kiwi-oem-repart" arch="s390x">
  <version epoch="0" ver="9.24.43" rel="150100.3.81.1"/>
  <changelog author="dcassany@suse.com" date="1681300800">- Adding a comment to explain the s390 specific path
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1688472000">- Add alternative re-reading of the partition table
  To inform the kernel about disk geometry changes, kiwi uses
  partprobe as a primary tool. However it is provided by parted
  and not necessarily available due to the package requirements
  on the dracut module. A second attempt via blockdev which
  is expected to exist is therefore made by this commit
  Part of bsc#1216465
  (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7)</changelog>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698321600">- Create live persistent storage without busy state
  With the former logic the live ISO was already mounted when an
  eventual persistent storage partition was created. This leads
  to an issue on re-reading the partition table, not for all but
  several tools. This commit changes the order of tasks such that
  the setup of the persistent write storage is performed prior
  mounting the live ISO. In addition to this change an alternative
  method using blockdev to re-read the partition was added in case
  partprobe is not present. This also allows to get rid of the
  parted dependency which provides partprobe
  Part of bsc#1216465
  (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698408000">- Change partprobe fallback to partx
  Informing the kernel about a new partition geometry can be done in a
  busy state and is also effective for new devices and new mounts based
  on the new geometry. busy state mounts of course will not see it until
  swap of the busy state but a complete refuse of operation like it
  happens with blockdev is imho not required. Just as partprobe, partx
  is less restrictive on the busy state. That's why this commit changes
  the partprobe fallback to use partx instead of blockdev
  Part of bsc#1216465
  (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698840000">- Add partx to module-setup of kiwi-lib too
  Part of bsc#1216465
  (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1700654400">- Allow install disk overwrite from cmdline
  Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device
  that should be used in an OEM installation. This overwrites any
  other oem device setting, e.g device filter or maxdisk and just
  continues the installation on the given device. However, the
  device must exist and must be a block special.
  This Fixes jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704369600">- Fix overwrite of kiwi_oemunattended
  In case rd.kiwi.oem.installdevice is set, there is an overwrite
  of the kiwi_oemunattended setting. However the variable was set
  in local scope of a function and therefore the change was not
  effective in other methods which also evaluates this variable.
  This commit fixes it such that the overwrite happens in the early
  initialize method which provides the environment for all code
  running in the dracut module. This is related to jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1705579200">- Fixed grub terminal setup
  The grub terminal setup is divided into the setting for the output
  and the input console. For both settings different parameters exists.
  So far kiwi did not differentiate between the two parts of the
  console setup and that could lead to a wrong setting if only one
  value is provided in kiwi's console= attribute which lead to the
  grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm
  grub takes this for both input and output and it's obviously
  wrong for the input. To make this less error prune the kiwi code
  changes with this commit to set GRUB_TERMINAL_INPUT and
  GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity
  checks on the provided values if they are applicable. The information
  for setting up the console in the schema stays untouched though.
  That's because it's used for all bootloaders and also because grub
  supports multiple values for the console in/out setting in one
  GRUB_TERMINAL variable even though kiwi does no longer use it.
  To make this clear for the users also the documentation for the
  console attribute setup has been updated. If we want to wish two
  distinct attributes for input and output console settings a schema
  change and also differentiation between bootloaders is needed and
  that I only see for the kiwi-10 branch if at all. This Fixes #2419
  and Fixes bsc#1218095</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1710849600">- Fixup cleanup of zipl templates
  Make sure temporary modifications to the zipl template
  and config file are not effective in the later system.
  This Fixes bsc#1221469</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1711368000">- Live ISO Wait for udev events after repart
  Make sure to wait for the event queue to become empty after
  the creation of the write partition. When kiwi calls the
  code to create the write partition this emits new udev events.
  It's important to wait for the event queue to become empty
  to avoid a potential regression on the use of the device nodes.
  In the processing of the events it can happen that a device
  gets removed and re-added. If we don't want for udev
  to process the entire queue it can happen that the
  wrong block device is used. This wrong selection is only
  possible because the way how hybrid ISOs are designed exposes
  both, the disk and the partition for the root device with
  the same label. This Fixes bsc#1213595</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1712232000">- Set default output console to gfxterm for grub
  If no console setting is done in the image description for grub
  the default output console is set to: gfxterm and the default
  input console is set to: console. This Fixes bsc#1219074</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427200">- Add rd.kiwi.oem.force_resize boot option
  Forces the disk resize process on an OEM disk image.
  If set, no sanity check for unpartitioned/free space
  is performed and also an eventually configured
  &lt;oem-resize-once&gt; configuration from the image description
  will not be taken into account. This Fixes bsc#1224389</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427201">- Do not exclude the .profile env file by default
  kiwi's initrd modules read a .profile file which gets included
  into the initrd produced at build time. To allow rebuild of a
  host-only initrd from the booted system this information should
  be present such that it is possible to re-use kiwi initrd code.
  This is related to bsc#1228118</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1722427202">- Fix kiwi-repart restrictions
  The kiwi repart dracut module reads a profile file and if it
  does not exists it dies in the initrd. However, that profile
  file is not mandatory for the main resize functionality. Thus
  this commit turns this into a warning message. In addition
  the module-setup for 90kiwi-repart makes sure to include
  the required and optional profile files.
  This Fixes bsc#1228118</changelog>
</package>
<package pkgid="393d5682d00e554f92580e55f5b67d5302142d2cca2c1b568333ac08e0900a04" name="dracut-kiwi-oem-repart" arch="x86_64">
  <version epoch="0" ver="9.24.43" rel="150100.3.81.1"/>
  <changelog author="dcassany@suse.com" date="1681300800">- Adding a comment to explain the s390 specific path
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1688472000">- Add alternative re-reading of the partition table
  To inform the kernel about disk geometry changes, kiwi uses
  partprobe as a primary tool. However it is provided by parted
  and not necessarily available due to the package requirements
  on the dracut module. A second attempt via blockdev which
  is expected to exist is therefore made by this commit
  Part of bsc#1216465
  (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7)</changelog>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698321600">- Create live persistent storage without busy state
  With the former logic the live ISO was already mounted when an
  eventual persistent storage partition was created. This leads
  to an issue on re-reading the partition table, not for all but
  several tools. This commit changes the order of tasks such that
  the setup of the persistent write storage is performed prior
  mounting the live ISO. In addition to this change an alternative
  method using blockdev to re-read the partition was added in case
  partprobe is not present. This also allows to get rid of the
  parted dependency which provides partprobe
  Part of bsc#1216465
  (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698408000">- Change partprobe fallback to partx
  Informing the kernel about a new partition geometry can be done in a
  busy state and is also effective for new devices and new mounts based
  on the new geometry. busy state mounts of course will not see it until
  swap of the busy state but a complete refuse of operation like it
  happens with blockdev is imho not required. Just as partprobe, partx
  is less restrictive on the busy state. That's why this commit changes
  the partprobe fallback to use partx instead of blockdev
  Part of bsc#1216465
  (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698840000">- Add partx to module-setup of kiwi-lib too
  Part of bsc#1216465
  (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1700654400">- Allow install disk overwrite from cmdline
  Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device
  that should be used in an OEM installation. This overwrites any
  other oem device setting, e.g device filter or maxdisk and just
  continues the installation on the given device. However, the
  device must exist and must be a block special.
  This Fixes jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704369600">- Fix overwrite of kiwi_oemunattended
  In case rd.kiwi.oem.installdevice is set, there is an overwrite
  of the kiwi_oemunattended setting. However the variable was set
  in local scope of a function and therefore the change was not
  effective in other methods which also evaluates this variable.
  This commit fixes it such that the overwrite happens in the early
  initialize method which provides the environment for all code
  running in the dracut module. This is related to jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1705579200">- Fixed grub terminal setup
  The grub terminal setup is divided into the setting for the output
  and the input console. For both settings different parameters exists.
  So far kiwi did not differentiate between the two parts of the
  console setup and that could lead to a wrong setting if only one
  value is provided in kiwi's console= attribute which lead to the
  grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm
  grub takes this for both input and output and it's obviously
  wrong for the input. To make this less error prune the kiwi code
  changes with this commit to set GRUB_TERMINAL_INPUT and
  GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity
  checks on the provided values if they are applicable. The information
  for setting up the console in the schema stays untouched though.
  That's because it's used for all bootloaders and also because grub
  supports multiple values for the console in/out setting in one
  GRUB_TERMINAL variable even though kiwi does no longer use it.
  To make this clear for the users also the documentation for the
  console attribute setup has been updated. If we want to wish two
  distinct attributes for input and output console settings a schema
  change and also differentiation between bootloaders is needed and
  that I only see for the kiwi-10 branch if at all. This Fixes #2419
  and Fixes bsc#1218095</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1710849600">- Fixup cleanup of zipl templates
  Make sure temporary modifications to the zipl template
  and config file are not effective in the later system.
  This Fixes bsc#1221469</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1711368000">- Live ISO Wait for udev events after repart
  Make sure to wait for the event queue to become empty after
  the creation of the write partition. When kiwi calls the
  code to create the write partition this emits new udev events.
  It's important to wait for the event queue to become empty
  to avoid a potential regression on the use of the device nodes.
  In the processing of the events it can happen that a device
  gets removed and re-added. If we don't want for udev
  to process the entire queue it can happen that the
  wrong block device is used. This wrong selection is only
  possible because the way how hybrid ISOs are designed exposes
  both, the disk and the partition for the root device with
  the same label. This Fixes bsc#1213595</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1712232000">- Set default output console to gfxterm for grub
  If no console setting is done in the image description for grub
  the default output console is set to: gfxterm and the default
  input console is set to: console. This Fixes bsc#1219074</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427200">- Add rd.kiwi.oem.force_resize boot option
  Forces the disk resize process on an OEM disk image.
  If set, no sanity check for unpartitioned/free space
  is performed and also an eventually configured
  &lt;oem-resize-once&gt; configuration from the image description
  will not be taken into account. This Fixes bsc#1224389</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427201">- Do not exclude the .profile env file by default
  kiwi's initrd modules read a .profile file which gets included
  into the initrd produced at build time. To allow rebuild of a
  host-only initrd from the booted system this information should
  be present such that it is possible to re-use kiwi initrd code.
  This is related to bsc#1228118</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1722427202">- Fix kiwi-repart restrictions
  The kiwi repart dracut module reads a profile file and if it
  does not exists it dies in the initrd. However, that profile
  file is not mandatory for the main resize functionality. Thus
  this commit turns this into a warning message. In addition
  the module-setup for 90kiwi-repart makes sure to include
  the required and optional profile files.
  This Fixes bsc#1228118</changelog>
</package>
<package pkgid="6e29954702cc399979d375daa2d8860a6ea29ea8013a5e4d24bee29932559f8d" name="dracut-kiwi-oem-repart" arch="aarch64">
  <version epoch="0" ver="9.24.43" rel="150100.3.84.1"/>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698321600">- Create live persistent storage without busy state
  With the former logic the live ISO was already mounted when an
  eventual persistent storage partition was created. This leads
  to an issue on re-reading the partition table, not for all but
  several tools. This commit changes the order of tasks such that
  the setup of the persistent write storage is performed prior
  mounting the live ISO. In addition to this change an alternative
  method using blockdev to re-read the partition was added in case
  partprobe is not present. This also allows to get rid of the
  parted dependency which provides partprobe
  Part of bsc#1216465
  (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698408000">- Change partprobe fallback to partx
  Informing the kernel about a new partition geometry can be done in a
  busy state and is also effective for new devices and new mounts based
  on the new geometry. busy state mounts of course will not see it until
  swap of the busy state but a complete refuse of operation like it
  happens with blockdev is imho not required. Just as partprobe, partx
  is less restrictive on the busy state. That's why this commit changes
  the partprobe fallback to use partx instead of blockdev
  Part of bsc#1216465
  (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698840000">- Add partx to module-setup of kiwi-lib too
  Part of bsc#1216465
  (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1700654400">- Allow install disk overwrite from cmdline
  Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device
  that should be used in an OEM installation. This overwrites any
  other oem device setting, e.g device filter or maxdisk and just
  continues the installation on the given device. However, the
  device must exist and must be a block special.
  This Fixes jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704369600">- Fix overwrite of kiwi_oemunattended
  In case rd.kiwi.oem.installdevice is set, there is an overwrite
  of the kiwi_oemunattended setting. However the variable was set
  in local scope of a function and therefore the change was not
  effective in other methods which also evaluates this variable.
  This commit fixes it such that the overwrite happens in the early
  initialize method which provides the environment for all code
  running in the dracut module. This is related to jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704801600">- Fixed regression in GRUB_SERIAL_COMMAND setup
  The condition to write the serial line setup was broken.
  This commit fixes it. Related to Issue #2419 and
  Fixes bsc#1228808</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1705579200">- Fixed grub terminal setup
  The grub terminal setup is divided into the setting for the output
  and the input console. For both settings different parameters exists.
  So far kiwi did not differentiate between the two parts of the
  console setup and that could lead to a wrong setting if only one
  value is provided in kiwi's console= attribute which lead to the
  grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm
  grub takes this for both input and output and it's obviously
  wrong for the input. To make this less error prune the kiwi code
  changes with this commit to set GRUB_TERMINAL_INPUT and
  GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity
  checks on the provided values if they are applicable. The information
  for setting up the console in the schema stays untouched though.
  That's because it's used for all bootloaders and also because grub
  supports multiple values for the console in/out setting in one
  GRUB_TERMINAL variable even though kiwi does no longer use it.
  To make this clear for the users also the documentation for the
  console attribute setup has been updated. If we want to wish two
  distinct attributes for input and output console settings a schema
  change and also differentiation between bootloaders is needed and
  that I only see for the kiwi-10 branch if at all. This Fixes #2419
  and Fixes bsc#1218095</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1710849600">- Fixup cleanup of zipl templates
  Make sure temporary modifications to the zipl template
  and config file are not effective in the later system.
  This Fixes bsc#1221469</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1711368000">- Live ISO Wait for udev events after repart
  Make sure to wait for the event queue to become empty after
  the creation of the write partition. When kiwi calls the
  code to create the write partition this emits new udev events.
  It's important to wait for the event queue to become empty
  to avoid a potential regression on the use of the device nodes.
  In the processing of the events it can happen that a device
  gets removed and re-added. If we don't want for udev
  to process the entire queue it can happen that the
  wrong block device is used. This wrong selection is only
  possible because the way how hybrid ISOs are designed exposes
  both, the disk and the partition for the root device with
  the same label. This Fixes bsc#1213595</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1712232000">- Set default output console to gfxterm for grub
  If no console setting is done in the image description for grub
  the default output console is set to: gfxterm and the default
  input console is set to: console. This Fixes bsc#1219074</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427200">- Add rd.kiwi.oem.force_resize boot option
  Forces the disk resize process on an OEM disk image.
  If set, no sanity check for unpartitioned/free space
  is performed and also an eventually configured
  &lt;oem-resize-once&gt; configuration from the image description
  will not be taken into account. This Fixes bsc#1224389</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427201">- Do not exclude the .profile env file by default
  kiwi's initrd modules read a .profile file which gets included
  into the initrd produced at build time. To allow rebuild of a
  host-only initrd from the booted system this information should
  be present such that it is possible to re-use kiwi initrd code.
  This is related to bsc#1228118</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1722427202">- Fix kiwi-repart restrictions
  The kiwi repart dracut module reads a profile file and if it
  does not exists it dies in the initrd. However, that profile
  file is not mandatory for the main resize functionality. Thus
  this commit turns this into a warning message. In addition
  the module-setup for 90kiwi-repart makes sure to include
  the required and optional profile files.
  This Fixes bsc#1228118</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1723118400">- Update virtualenv setup
  types-pkg_resources got dropped from PyPI</changelog>
</package>
<package pkgid="f76871d10634e1c80e074ec8632ba83e8526b1caf6ad339604e1bda53008e29b" name="dracut-kiwi-oem-repart" arch="ppc64le">
  <version epoch="0" ver="9.24.43" rel="150100.3.84.1"/>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698321600">- Create live persistent storage without busy state
  With the former logic the live ISO was already mounted when an
  eventual persistent storage partition was created. This leads
  to an issue on re-reading the partition table, not for all but
  several tools. This commit changes the order of tasks such that
  the setup of the persistent write storage is performed prior
  mounting the live ISO. In addition to this change an alternative
  method using blockdev to re-read the partition was added in case
  partprobe is not present. This also allows to get rid of the
  parted dependency which provides partprobe
  Part of bsc#1216465
  (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698408000">- Change partprobe fallback to partx
  Informing the kernel about a new partition geometry can be done in a
  busy state and is also effective for new devices and new mounts based
  on the new geometry. busy state mounts of course will not see it until
  swap of the busy state but a complete refuse of operation like it
  happens with blockdev is imho not required. Just as partprobe, partx
  is less restrictive on the busy state. That's why this commit changes
  the partprobe fallback to use partx instead of blockdev
  Part of bsc#1216465
  (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698840000">- Add partx to module-setup of kiwi-lib too
  Part of bsc#1216465
  (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1700654400">- Allow install disk overwrite from cmdline
  Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device
  that should be used in an OEM installation. This overwrites any
  other oem device setting, e.g device filter or maxdisk and just
  continues the installation on the given device. However, the
  device must exist and must be a block special.
  This Fixes jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704369600">- Fix overwrite of kiwi_oemunattended
  In case rd.kiwi.oem.installdevice is set, there is an overwrite
  of the kiwi_oemunattended setting. However the variable was set
  in local scope of a function and therefore the change was not
  effective in other methods which also evaluates this variable.
  This commit fixes it such that the overwrite happens in the early
  initialize method which provides the environment for all code
  running in the dracut module. This is related to jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704801600">- Fixed regression in GRUB_SERIAL_COMMAND setup
  The condition to write the serial line setup was broken.
  This commit fixes it. Related to Issue #2419 and
  Fixes bsc#1228808</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1705579200">- Fixed grub terminal setup
  The grub terminal setup is divided into the setting for the output
  and the input console. For both settings different parameters exists.
  So far kiwi did not differentiate between the two parts of the
  console setup and that could lead to a wrong setting if only one
  value is provided in kiwi's console= attribute which lead to the
  grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm
  grub takes this for both input and output and it's obviously
  wrong for the input. To make this less error prune the kiwi code
  changes with this commit to set GRUB_TERMINAL_INPUT and
  GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity
  checks on the provided values if they are applicable. The information
  for setting up the console in the schema stays untouched though.
  That's because it's used for all bootloaders and also because grub
  supports multiple values for the console in/out setting in one
  GRUB_TERMINAL variable even though kiwi does no longer use it.
  To make this clear for the users also the documentation for the
  console attribute setup has been updated. If we want to wish two
  distinct attributes for input and output console settings a schema
  change and also differentiation between bootloaders is needed and
  that I only see for the kiwi-10 branch if at all. This Fixes #2419
  and Fixes bsc#1218095</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1710849600">- Fixup cleanup of zipl templates
  Make sure temporary modifications to the zipl template
  and config file are not effective in the later system.
  This Fixes bsc#1221469</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1711368000">- Live ISO Wait for udev events after repart
  Make sure to wait for the event queue to become empty after
  the creation of the write partition. When kiwi calls the
  code to create the write partition this emits new udev events.
  It's important to wait for the event queue to become empty
  to avoid a potential regression on the use of the device nodes.
  In the processing of the events it can happen that a device
  gets removed and re-added. If we don't want for udev
  to process the entire queue it can happen that the
  wrong block device is used. This wrong selection is only
  possible because the way how hybrid ISOs are designed exposes
  both, the disk and the partition for the root device with
  the same label. This Fixes bsc#1213595</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1712232000">- Set default output console to gfxterm for grub
  If no console setting is done in the image description for grub
  the default output console is set to: gfxterm and the default
  input console is set to: console. This Fixes bsc#1219074</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427200">- Add rd.kiwi.oem.force_resize boot option
  Forces the disk resize process on an OEM disk image.
  If set, no sanity check for unpartitioned/free space
  is performed and also an eventually configured
  &lt;oem-resize-once&gt; configuration from the image description
  will not be taken into account. This Fixes bsc#1224389</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427201">- Do not exclude the .profile env file by default
  kiwi's initrd modules read a .profile file which gets included
  into the initrd produced at build time. To allow rebuild of a
  host-only initrd from the booted system this information should
  be present such that it is possible to re-use kiwi initrd code.
  This is related to bsc#1228118</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1722427202">- Fix kiwi-repart restrictions
  The kiwi repart dracut module reads a profile file and if it
  does not exists it dies in the initrd. However, that profile
  file is not mandatory for the main resize functionality. Thus
  this commit turns this into a warning message. In addition
  the module-setup for 90kiwi-repart makes sure to include
  the required and optional profile files.
  This Fixes bsc#1228118</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1723118400">- Update virtualenv setup
  types-pkg_resources got dropped from PyPI</changelog>
</package>
<package pkgid="ba34c2c95385d03acfe4ab3e6cc37a1bc8afd88156060634382f2284b4e58d59" name="dracut-kiwi-oem-repart" arch="s390x">
  <version epoch="0" ver="9.24.43" rel="150100.3.84.1"/>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698321600">- Create live persistent storage without busy state
  With the former logic the live ISO was already mounted when an
  eventual persistent storage partition was created. This leads
  to an issue on re-reading the partition table, not for all but
  several tools. This commit changes the order of tasks such that
  the setup of the persistent write storage is performed prior
  mounting the live ISO. In addition to this change an alternative
  method using blockdev to re-read the partition was added in case
  partprobe is not present. This also allows to get rid of the
  parted dependency which provides partprobe
  Part of bsc#1216465
  (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698408000">- Change partprobe fallback to partx
  Informing the kernel about a new partition geometry can be done in a
  busy state and is also effective for new devices and new mounts based
  on the new geometry. busy state mounts of course will not see it until
  swap of the busy state but a complete refuse of operation like it
  happens with blockdev is imho not required. Just as partprobe, partx
  is less restrictive on the busy state. That's why this commit changes
  the partprobe fallback to use partx instead of blockdev
  Part of bsc#1216465
  (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698840000">- Add partx to module-setup of kiwi-lib too
  Part of bsc#1216465
  (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1700654400">- Allow install disk overwrite from cmdline
  Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device
  that should be used in an OEM installation. This overwrites any
  other oem device setting, e.g device filter or maxdisk and just
  continues the installation on the given device. However, the
  device must exist and must be a block special.
  This Fixes jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704369600">- Fix overwrite of kiwi_oemunattended
  In case rd.kiwi.oem.installdevice is set, there is an overwrite
  of the kiwi_oemunattended setting. However the variable was set
  in local scope of a function and therefore the change was not
  effective in other methods which also evaluates this variable.
  This commit fixes it such that the overwrite happens in the early
  initialize method which provides the environment for all code
  running in the dracut module. This is related to jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704801600">- Fixed regression in GRUB_SERIAL_COMMAND setup
  The condition to write the serial line setup was broken.
  This commit fixes it. Related to Issue #2419 and
  Fixes bsc#1228808</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1705579200">- Fixed grub terminal setup
  The grub terminal setup is divided into the setting for the output
  and the input console. For both settings different parameters exists.
  So far kiwi did not differentiate between the two parts of the
  console setup and that could lead to a wrong setting if only one
  value is provided in kiwi's console= attribute which lead to the
  grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm
  grub takes this for both input and output and it's obviously
  wrong for the input. To make this less error prune the kiwi code
  changes with this commit to set GRUB_TERMINAL_INPUT and
  GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity
  checks on the provided values if they are applicable. The information
  for setting up the console in the schema stays untouched though.
  That's because it's used for all bootloaders and also because grub
  supports multiple values for the console in/out setting in one
  GRUB_TERMINAL variable even though kiwi does no longer use it.
  To make this clear for the users also the documentation for the
  console attribute setup has been updated. If we want to wish two
  distinct attributes for input and output console settings a schema
  change and also differentiation between bootloaders is needed and
  that I only see for the kiwi-10 branch if at all. This Fixes #2419
  and Fixes bsc#1218095</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1710849600">- Fixup cleanup of zipl templates
  Make sure temporary modifications to the zipl template
  and config file are not effective in the later system.
  This Fixes bsc#1221469</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1711368000">- Live ISO Wait for udev events after repart
  Make sure to wait for the event queue to become empty after
  the creation of the write partition. When kiwi calls the
  code to create the write partition this emits new udev events.
  It's important to wait for the event queue to become empty
  to avoid a potential regression on the use of the device nodes.
  In the processing of the events it can happen that a device
  gets removed and re-added. If we don't want for udev
  to process the entire queue it can happen that the
  wrong block device is used. This wrong selection is only
  possible because the way how hybrid ISOs are designed exposes
  both, the disk and the partition for the root device with
  the same label. This Fixes bsc#1213595</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1712232000">- Set default output console to gfxterm for grub
  If no console setting is done in the image description for grub
  the default output console is set to: gfxterm and the default
  input console is set to: console. This Fixes bsc#1219074</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427200">- Add rd.kiwi.oem.force_resize boot option
  Forces the disk resize process on an OEM disk image.
  If set, no sanity check for unpartitioned/free space
  is performed and also an eventually configured
  &lt;oem-resize-once&gt; configuration from the image description
  will not be taken into account. This Fixes bsc#1224389</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427201">- Do not exclude the .profile env file by default
  kiwi's initrd modules read a .profile file which gets included
  into the initrd produced at build time. To allow rebuild of a
  host-only initrd from the booted system this information should
  be present such that it is possible to re-use kiwi initrd code.
  This is related to bsc#1228118</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1722427202">- Fix kiwi-repart restrictions
  The kiwi repart dracut module reads a profile file and if it
  does not exists it dies in the initrd. However, that profile
  file is not mandatory for the main resize functionality. Thus
  this commit turns this into a warning message. In addition
  the module-setup for 90kiwi-repart makes sure to include
  the required and optional profile files.
  This Fixes bsc#1228118</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1723118400">- Update virtualenv setup
  types-pkg_resources got dropped from PyPI</changelog>
</package>
<package pkgid="86497d9482e4c2acc0c337097ee7af939cf2b9f59efecea3e57899a005527568" name="dracut-kiwi-oem-repart" arch="x86_64">
  <version epoch="0" ver="9.24.43" rel="150100.3.84.1"/>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698321600">- Create live persistent storage without busy state
  With the former logic the live ISO was already mounted when an
  eventual persistent storage partition was created. This leads
  to an issue on re-reading the partition table, not for all but
  several tools. This commit changes the order of tasks such that
  the setup of the persistent write storage is performed prior
  mounting the live ISO. In addition to this change an alternative
  method using blockdev to re-read the partition was added in case
  partprobe is not present. This also allows to get rid of the
  parted dependency which provides partprobe
  Part of bsc#1216465
  (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698408000">- Change partprobe fallback to partx
  Informing the kernel about a new partition geometry can be done in a
  busy state and is also effective for new devices and new mounts based
  on the new geometry. busy state mounts of course will not see it until
  swap of the busy state but a complete refuse of operation like it
  happens with blockdev is imho not required. Just as partprobe, partx
  is less restrictive on the busy state. That's why this commit changes
  the partprobe fallback to use partx instead of blockdev
  Part of bsc#1216465
  (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698840000">- Add partx to module-setup of kiwi-lib too
  Part of bsc#1216465
  (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1700654400">- Allow install disk overwrite from cmdline
  Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device
  that should be used in an OEM installation. This overwrites any
  other oem device setting, e.g device filter or maxdisk and just
  continues the installation on the given device. However, the
  device must exist and must be a block special.
  This Fixes jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704369600">- Fix overwrite of kiwi_oemunattended
  In case rd.kiwi.oem.installdevice is set, there is an overwrite
  of the kiwi_oemunattended setting. However the variable was set
  in local scope of a function and therefore the change was not
  effective in other methods which also evaluates this variable.
  This commit fixes it such that the overwrite happens in the early
  initialize method which provides the environment for all code
  running in the dracut module. This is related to jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704801600">- Fixed regression in GRUB_SERIAL_COMMAND setup
  The condition to write the serial line setup was broken.
  This commit fixes it. Related to Issue #2419 and
  Fixes bsc#1228808</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1705579200">- Fixed grub terminal setup
  The grub terminal setup is divided into the setting for the output
  and the input console. For both settings different parameters exists.
  So far kiwi did not differentiate between the two parts of the
  console setup and that could lead to a wrong setting if only one
  value is provided in kiwi's console= attribute which lead to the
  grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm
  grub takes this for both input and output and it's obviously
  wrong for the input. To make this less error prune the kiwi code
  changes with this commit to set GRUB_TERMINAL_INPUT and
  GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity
  checks on the provided values if they are applicable. The information
  for setting up the console in the schema stays untouched though.
  That's because it's used for all bootloaders and also because grub
  supports multiple values for the console in/out setting in one
  GRUB_TERMINAL variable even though kiwi does no longer use it.
  To make this clear for the users also the documentation for the
  console attribute setup has been updated. If we want to wish two
  distinct attributes for input and output console settings a schema
  change and also differentiation between bootloaders is needed and
  that I only see for the kiwi-10 branch if at all. This Fixes #2419
  and Fixes bsc#1218095</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1710849600">- Fixup cleanup of zipl templates
  Make sure temporary modifications to the zipl template
  and config file are not effective in the later system.
  This Fixes bsc#1221469</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1711368000">- Live ISO Wait for udev events after repart
  Make sure to wait for the event queue to become empty after
  the creation of the write partition. When kiwi calls the
  code to create the write partition this emits new udev events.
  It's important to wait for the event queue to become empty
  to avoid a potential regression on the use of the device nodes.
  In the processing of the events it can happen that a device
  gets removed and re-added. If we don't want for udev
  to process the entire queue it can happen that the
  wrong block device is used. This wrong selection is only
  possible because the way how hybrid ISOs are designed exposes
  both, the disk and the partition for the root device with
  the same label. This Fixes bsc#1213595</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1712232000">- Set default output console to gfxterm for grub
  If no console setting is done in the image description for grub
  the default output console is set to: gfxterm and the default
  input console is set to: console. This Fixes bsc#1219074</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427200">- Add rd.kiwi.oem.force_resize boot option
  Forces the disk resize process on an OEM disk image.
  If set, no sanity check for unpartitioned/free space
  is performed and also an eventually configured
  &lt;oem-resize-once&gt; configuration from the image description
  will not be taken into account. This Fixes bsc#1224389</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427201">- Do not exclude the .profile env file by default
  kiwi's initrd modules read a .profile file which gets included
  into the initrd produced at build time. To allow rebuild of a
  host-only initrd from the booted system this information should
  be present such that it is possible to re-use kiwi initrd code.
  This is related to bsc#1228118</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1722427202">- Fix kiwi-repart restrictions
  The kiwi repart dracut module reads a profile file and if it
  does not exists it dies in the initrd. However, that profile
  file is not mandatory for the main resize functionality. Thus
  this commit turns this into a warning message. In addition
  the module-setup for 90kiwi-repart makes sure to include
  the required and optional profile files.
  This Fixes bsc#1228118</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1723118400">- Update virtualenv setup
  types-pkg_resources got dropped from PyPI</changelog>
</package>
<package pkgid="d27ec1f3e1a67a9ca4594e249177cae0945b8c6d0d4f0dcb8da0c453c9aaf862" name="dracut-kiwi-overlay" arch="aarch64">
  <version epoch="0" ver="9.24.43" rel="150100.3.81.1"/>
  <changelog author="dcassany@suse.com" date="1681300800">- Adding a comment to explain the s390 specific path
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1688472000">- Add alternative re-reading of the partition table
  To inform the kernel about disk geometry changes, kiwi uses
  partprobe as a primary tool. However it is provided by parted
  and not necessarily available due to the package requirements
  on the dracut module. A second attempt via blockdev which
  is expected to exist is therefore made by this commit
  Part of bsc#1216465
  (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7)</changelog>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698321600">- Create live persistent storage without busy state
  With the former logic the live ISO was already mounted when an
  eventual persistent storage partition was created. This leads
  to an issue on re-reading the partition table, not for all but
  several tools. This commit changes the order of tasks such that
  the setup of the persistent write storage is performed prior
  mounting the live ISO. In addition to this change an alternative
  method using blockdev to re-read the partition was added in case
  partprobe is not present. This also allows to get rid of the
  parted dependency which provides partprobe
  Part of bsc#1216465
  (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698408000">- Change partprobe fallback to partx
  Informing the kernel about a new partition geometry can be done in a
  busy state and is also effective for new devices and new mounts based
  on the new geometry. busy state mounts of course will not see it until
  swap of the busy state but a complete refuse of operation like it
  happens with blockdev is imho not required. Just as partprobe, partx
  is less restrictive on the busy state. That's why this commit changes
  the partprobe fallback to use partx instead of blockdev
  Part of bsc#1216465
  (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698840000">- Add partx to module-setup of kiwi-lib too
  Part of bsc#1216465
  (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1700654400">- Allow install disk overwrite from cmdline
  Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device
  that should be used in an OEM installation. This overwrites any
  other oem device setting, e.g device filter or maxdisk and just
  continues the installation on the given device. However, the
  device must exist and must be a block special.
  This Fixes jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704369600">- Fix overwrite of kiwi_oemunattended
  In case rd.kiwi.oem.installdevice is set, there is an overwrite
  of the kiwi_oemunattended setting. However the variable was set
  in local scope of a function and therefore the change was not
  effective in other methods which also evaluates this variable.
  This commit fixes it such that the overwrite happens in the early
  initialize method which provides the environment for all code
  running in the dracut module. This is related to jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1705579200">- Fixed grub terminal setup
  The grub terminal setup is divided into the setting for the output
  and the input console. For both settings different parameters exists.
  So far kiwi did not differentiate between the two parts of the
  console setup and that could lead to a wrong setting if only one
  value is provided in kiwi's console= attribute which lead to the
  grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm
  grub takes this for both input and output and it's obviously
  wrong for the input. To make this less error prune the kiwi code
  changes with this commit to set GRUB_TERMINAL_INPUT and
  GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity
  checks on the provided values if they are applicable. The information
  for setting up the console in the schema stays untouched though.
  That's because it's used for all bootloaders and also because grub
  supports multiple values for the console in/out setting in one
  GRUB_TERMINAL variable even though kiwi does no longer use it.
  To make this clear for the users also the documentation for the
  console attribute setup has been updated. If we want to wish two
  distinct attributes for input and output console settings a schema
  change and also differentiation between bootloaders is needed and
  that I only see for the kiwi-10 branch if at all. This Fixes #2419
  and Fixes bsc#1218095</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1710849600">- Fixup cleanup of zipl templates
  Make sure temporary modifications to the zipl template
  and config file are not effective in the later system.
  This Fixes bsc#1221469</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1711368000">- Live ISO Wait for udev events after repart
  Make sure to wait for the event queue to become empty after
  the creation of the write partition. When kiwi calls the
  code to create the write partition this emits new udev events.
  It's important to wait for the event queue to become empty
  to avoid a potential regression on the use of the device nodes.
  In the processing of the events it can happen that a device
  gets removed and re-added. If we don't want for udev
  to process the entire queue it can happen that the
  wrong block device is used. This wrong selection is only
  possible because the way how hybrid ISOs are designed exposes
  both, the disk and the partition for the root device with
  the same label. This Fixes bsc#1213595</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1712232000">- Set default output console to gfxterm for grub
  If no console setting is done in the image description for grub
  the default output console is set to: gfxterm and the default
  input console is set to: console. This Fixes bsc#1219074</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427200">- Add rd.kiwi.oem.force_resize boot option
  Forces the disk resize process on an OEM disk image.
  If set, no sanity check for unpartitioned/free space
  is performed and also an eventually configured
  &lt;oem-resize-once&gt; configuration from the image description
  will not be taken into account. This Fixes bsc#1224389</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427201">- Do not exclude the .profile env file by default
  kiwi's initrd modules read a .profile file which gets included
  into the initrd produced at build time. To allow rebuild of a
  host-only initrd from the booted system this information should
  be present such that it is possible to re-use kiwi initrd code.
  This is related to bsc#1228118</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1722427202">- Fix kiwi-repart restrictions
  The kiwi repart dracut module reads a profile file and if it
  does not exists it dies in the initrd. However, that profile
  file is not mandatory for the main resize functionality. Thus
  this commit turns this into a warning message. In addition
  the module-setup for 90kiwi-repart makes sure to include
  the required and optional profile files.
  This Fixes bsc#1228118</changelog>
</package>
<package pkgid="f4d85cab6a48617f9cb0d78bcda014cf833755db3149b5b5865933bda97cc791" name="dracut-kiwi-overlay" arch="ppc64le">
  <version epoch="0" ver="9.24.43" rel="150100.3.81.1"/>
  <changelog author="dcassany@suse.com" date="1681300800">- Adding a comment to explain the s390 specific path
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1688472000">- Add alternative re-reading of the partition table
  To inform the kernel about disk geometry changes, kiwi uses
  partprobe as a primary tool. However it is provided by parted
  and not necessarily available due to the package requirements
  on the dracut module. A second attempt via blockdev which
  is expected to exist is therefore made by this commit
  Part of bsc#1216465
  (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7)</changelog>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698321600">- Create live persistent storage without busy state
  With the former logic the live ISO was already mounted when an
  eventual persistent storage partition was created. This leads
  to an issue on re-reading the partition table, not for all but
  several tools. This commit changes the order of tasks such that
  the setup of the persistent write storage is performed prior
  mounting the live ISO. In addition to this change an alternative
  method using blockdev to re-read the partition was added in case
  partprobe is not present. This also allows to get rid of the
  parted dependency which provides partprobe
  Part of bsc#1216465
  (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698408000">- Change partprobe fallback to partx
  Informing the kernel about a new partition geometry can be done in a
  busy state and is also effective for new devices and new mounts based
  on the new geometry. busy state mounts of course will not see it until
  swap of the busy state but a complete refuse of operation like it
  happens with blockdev is imho not required. Just as partprobe, partx
  is less restrictive on the busy state. That's why this commit changes
  the partprobe fallback to use partx instead of blockdev
  Part of bsc#1216465
  (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698840000">- Add partx to module-setup of kiwi-lib too
  Part of bsc#1216465
  (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1700654400">- Allow install disk overwrite from cmdline
  Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device
  that should be used in an OEM installation. This overwrites any
  other oem device setting, e.g device filter or maxdisk and just
  continues the installation on the given device. However, the
  device must exist and must be a block special.
  This Fixes jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704369600">- Fix overwrite of kiwi_oemunattended
  In case rd.kiwi.oem.installdevice is set, there is an overwrite
  of the kiwi_oemunattended setting. However the variable was set
  in local scope of a function and therefore the change was not
  effective in other methods which also evaluates this variable.
  This commit fixes it such that the overwrite happens in the early
  initialize method which provides the environment for all code
  running in the dracut module. This is related to jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1705579200">- Fixed grub terminal setup
  The grub terminal setup is divided into the setting for the output
  and the input console. For both settings different parameters exists.
  So far kiwi did not differentiate between the two parts of the
  console setup and that could lead to a wrong setting if only one
  value is provided in kiwi's console= attribute which lead to the
  grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm
  grub takes this for both input and output and it's obviously
  wrong for the input. To make this less error prune the kiwi code
  changes with this commit to set GRUB_TERMINAL_INPUT and
  GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity
  checks on the provided values if they are applicable. The information
  for setting up the console in the schema stays untouched though.
  That's because it's used for all bootloaders and also because grub
  supports multiple values for the console in/out setting in one
  GRUB_TERMINAL variable even though kiwi does no longer use it.
  To make this clear for the users also the documentation for the
  console attribute setup has been updated. If we want to wish two
  distinct attributes for input and output console settings a schema
  change and also differentiation between bootloaders is needed and
  that I only see for the kiwi-10 branch if at all. This Fixes #2419
  and Fixes bsc#1218095</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1710849600">- Fixup cleanup of zipl templates
  Make sure temporary modifications to the zipl template
  and config file are not effective in the later system.
  This Fixes bsc#1221469</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1711368000">- Live ISO Wait for udev events after repart
  Make sure to wait for the event queue to become empty after
  the creation of the write partition. When kiwi calls the
  code to create the write partition this emits new udev events.
  It's important to wait for the event queue to become empty
  to avoid a potential regression on the use of the device nodes.
  In the processing of the events it can happen that a device
  gets removed and re-added. If we don't want for udev
  to process the entire queue it can happen that the
  wrong block device is used. This wrong selection is only
  possible because the way how hybrid ISOs are designed exposes
  both, the disk and the partition for the root device with
  the same label. This Fixes bsc#1213595</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1712232000">- Set default output console to gfxterm for grub
  If no console setting is done in the image description for grub
  the default output console is set to: gfxterm and the default
  input console is set to: console. This Fixes bsc#1219074</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427200">- Add rd.kiwi.oem.force_resize boot option
  Forces the disk resize process on an OEM disk image.
  If set, no sanity check for unpartitioned/free space
  is performed and also an eventually configured
  &lt;oem-resize-once&gt; configuration from the image description
  will not be taken into account. This Fixes bsc#1224389</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427201">- Do not exclude the .profile env file by default
  kiwi's initrd modules read a .profile file which gets included
  into the initrd produced at build time. To allow rebuild of a
  host-only initrd from the booted system this information should
  be present such that it is possible to re-use kiwi initrd code.
  This is related to bsc#1228118</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1722427202">- Fix kiwi-repart restrictions
  The kiwi repart dracut module reads a profile file and if it
  does not exists it dies in the initrd. However, that profile
  file is not mandatory for the main resize functionality. Thus
  this commit turns this into a warning message. In addition
  the module-setup for 90kiwi-repart makes sure to include
  the required and optional profile files.
  This Fixes bsc#1228118</changelog>
</package>
<package pkgid="dcfc11bd0c32d9a3b9506d81c5cf35a5d8c850e4ad46eb2cfde243009e53175a" name="dracut-kiwi-overlay" arch="s390x">
  <version epoch="0" ver="9.24.43" rel="150100.3.81.1"/>
  <changelog author="dcassany@suse.com" date="1681300800">- Adding a comment to explain the s390 specific path
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1688472000">- Add alternative re-reading of the partition table
  To inform the kernel about disk geometry changes, kiwi uses
  partprobe as a primary tool. However it is provided by parted
  and not necessarily available due to the package requirements
  on the dracut module. A second attempt via blockdev which
  is expected to exist is therefore made by this commit
  Part of bsc#1216465
  (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7)</changelog>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698321600">- Create live persistent storage without busy state
  With the former logic the live ISO was already mounted when an
  eventual persistent storage partition was created. This leads
  to an issue on re-reading the partition table, not for all but
  several tools. This commit changes the order of tasks such that
  the setup of the persistent write storage is performed prior
  mounting the live ISO. In addition to this change an alternative
  method using blockdev to re-read the partition was added in case
  partprobe is not present. This also allows to get rid of the
  parted dependency which provides partprobe
  Part of bsc#1216465
  (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698408000">- Change partprobe fallback to partx
  Informing the kernel about a new partition geometry can be done in a
  busy state and is also effective for new devices and new mounts based
  on the new geometry. busy state mounts of course will not see it until
  swap of the busy state but a complete refuse of operation like it
  happens with blockdev is imho not required. Just as partprobe, partx
  is less restrictive on the busy state. That's why this commit changes
  the partprobe fallback to use partx instead of blockdev
  Part of bsc#1216465
  (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698840000">- Add partx to module-setup of kiwi-lib too
  Part of bsc#1216465
  (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1700654400">- Allow install disk overwrite from cmdline
  Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device
  that should be used in an OEM installation. This overwrites any
  other oem device setting, e.g device filter or maxdisk and just
  continues the installation on the given device. However, the
  device must exist and must be a block special.
  This Fixes jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704369600">- Fix overwrite of kiwi_oemunattended
  In case rd.kiwi.oem.installdevice is set, there is an overwrite
  of the kiwi_oemunattended setting. However the variable was set
  in local scope of a function and therefore the change was not
  effective in other methods which also evaluates this variable.
  This commit fixes it such that the overwrite happens in the early
  initialize method which provides the environment for all code
  running in the dracut module. This is related to jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1705579200">- Fixed grub terminal setup
  The grub terminal setup is divided into the setting for the output
  and the input console. For both settings different parameters exists.
  So far kiwi did not differentiate between the two parts of the
  console setup and that could lead to a wrong setting if only one
  value is provided in kiwi's console= attribute which lead to the
  grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm
  grub takes this for both input and output and it's obviously
  wrong for the input. To make this less error prune the kiwi code
  changes with this commit to set GRUB_TERMINAL_INPUT and
  GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity
  checks on the provided values if they are applicable. The information
  for setting up the console in the schema stays untouched though.
  That's because it's used for all bootloaders and also because grub
  supports multiple values for the console in/out setting in one
  GRUB_TERMINAL variable even though kiwi does no longer use it.
  To make this clear for the users also the documentation for the
  console attribute setup has been updated. If we want to wish two
  distinct attributes for input and output console settings a schema
  change and also differentiation between bootloaders is needed and
  that I only see for the kiwi-10 branch if at all. This Fixes #2419
  and Fixes bsc#1218095</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1710849600">- Fixup cleanup of zipl templates
  Make sure temporary modifications to the zipl template
  and config file are not effective in the later system.
  This Fixes bsc#1221469</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1711368000">- Live ISO Wait for udev events after repart
  Make sure to wait for the event queue to become empty after
  the creation of the write partition. When kiwi calls the
  code to create the write partition this emits new udev events.
  It's important to wait for the event queue to become empty
  to avoid a potential regression on the use of the device nodes.
  In the processing of the events it can happen that a device
  gets removed and re-added. If we don't want for udev
  to process the entire queue it can happen that the
  wrong block device is used. This wrong selection is only
  possible because the way how hybrid ISOs are designed exposes
  both, the disk and the partition for the root device with
  the same label. This Fixes bsc#1213595</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1712232000">- Set default output console to gfxterm for grub
  If no console setting is done in the image description for grub
  the default output console is set to: gfxterm and the default
  input console is set to: console. This Fixes bsc#1219074</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427200">- Add rd.kiwi.oem.force_resize boot option
  Forces the disk resize process on an OEM disk image.
  If set, no sanity check for unpartitioned/free space
  is performed and also an eventually configured
  &lt;oem-resize-once&gt; configuration from the image description
  will not be taken into account. This Fixes bsc#1224389</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427201">- Do not exclude the .profile env file by default
  kiwi's initrd modules read a .profile file which gets included
  into the initrd produced at build time. To allow rebuild of a
  host-only initrd from the booted system this information should
  be present such that it is possible to re-use kiwi initrd code.
  This is related to bsc#1228118</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1722427202">- Fix kiwi-repart restrictions
  The kiwi repart dracut module reads a profile file and if it
  does not exists it dies in the initrd. However, that profile
  file is not mandatory for the main resize functionality. Thus
  this commit turns this into a warning message. In addition
  the module-setup for 90kiwi-repart makes sure to include
  the required and optional profile files.
  This Fixes bsc#1228118</changelog>
</package>
<package pkgid="c8121ca5bb52768b1c17cb46c1a3a0a972d8dbc86d8473cd09a55d3c3f3736b3" name="dracut-kiwi-overlay" arch="x86_64">
  <version epoch="0" ver="9.24.43" rel="150100.3.81.1"/>
  <changelog author="dcassany@suse.com" date="1681300800">- Adding a comment to explain the s390 specific path
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1688472000">- Add alternative re-reading of the partition table
  To inform the kernel about disk geometry changes, kiwi uses
  partprobe as a primary tool. However it is provided by parted
  and not necessarily available due to the package requirements
  on the dracut module. A second attempt via blockdev which
  is expected to exist is therefore made by this commit
  Part of bsc#1216465
  (cherry picked from commit 4ab089ac5244c1d867be850ec99bc81814466bf7)</changelog>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698321600">- Create live persistent storage without busy state
  With the former logic the live ISO was already mounted when an
  eventual persistent storage partition was created. This leads
  to an issue on re-reading the partition table, not for all but
  several tools. This commit changes the order of tasks such that
  the setup of the persistent write storage is performed prior
  mounting the live ISO. In addition to this change an alternative
  method using blockdev to re-read the partition was added in case
  partprobe is not present. This also allows to get rid of the
  parted dependency which provides partprobe
  Part of bsc#1216465
  (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698408000">- Change partprobe fallback to partx
  Informing the kernel about a new partition geometry can be done in a
  busy state and is also effective for new devices and new mounts based
  on the new geometry. busy state mounts of course will not see it until
  swap of the busy state but a complete refuse of operation like it
  happens with blockdev is imho not required. Just as partprobe, partx
  is less restrictive on the busy state. That's why this commit changes
  the partprobe fallback to use partx instead of blockdev
  Part of bsc#1216465
  (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698840000">- Add partx to module-setup of kiwi-lib too
  Part of bsc#1216465
  (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1700654400">- Allow install disk overwrite from cmdline
  Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device
  that should be used in an OEM installation. This overwrites any
  other oem device setting, e.g device filter or maxdisk and just
  continues the installation on the given device. However, the
  device must exist and must be a block special.
  This Fixes jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704369600">- Fix overwrite of kiwi_oemunattended
  In case rd.kiwi.oem.installdevice is set, there is an overwrite
  of the kiwi_oemunattended setting. However the variable was set
  in local scope of a function and therefore the change was not
  effective in other methods which also evaluates this variable.
  This commit fixes it such that the overwrite happens in the early
  initialize method which provides the environment for all code
  running in the dracut module. This is related to jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1705579200">- Fixed grub terminal setup
  The grub terminal setup is divided into the setting for the output
  and the input console. For both settings different parameters exists.
  So far kiwi did not differentiate between the two parts of the
  console setup and that could lead to a wrong setting if only one
  value is provided in kiwi's console= attribute which lead to the
  grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm
  grub takes this for both input and output and it's obviously
  wrong for the input. To make this less error prune the kiwi code
  changes with this commit to set GRUB_TERMINAL_INPUT and
  GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity
  checks on the provided values if they are applicable. The information
  for setting up the console in the schema stays untouched though.
  That's because it's used for all bootloaders and also because grub
  supports multiple values for the console in/out setting in one
  GRUB_TERMINAL variable even though kiwi does no longer use it.
  To make this clear for the users also the documentation for the
  console attribute setup has been updated. If we want to wish two
  distinct attributes for input and output console settings a schema
  change and also differentiation between bootloaders is needed and
  that I only see for the kiwi-10 branch if at all. This Fixes #2419
  and Fixes bsc#1218095</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1710849600">- Fixup cleanup of zipl templates
  Make sure temporary modifications to the zipl template
  and config file are not effective in the later system.
  This Fixes bsc#1221469</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1711368000">- Live ISO Wait for udev events after repart
  Make sure to wait for the event queue to become empty after
  the creation of the write partition. When kiwi calls the
  code to create the write partition this emits new udev events.
  It's important to wait for the event queue to become empty
  to avoid a potential regression on the use of the device nodes.
  In the processing of the events it can happen that a device
  gets removed and re-added. If we don't want for udev
  to process the entire queue it can happen that the
  wrong block device is used. This wrong selection is only
  possible because the way how hybrid ISOs are designed exposes
  both, the disk and the partition for the root device with
  the same label. This Fixes bsc#1213595</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1712232000">- Set default output console to gfxterm for grub
  If no console setting is done in the image description for grub
  the default output console is set to: gfxterm and the default
  input console is set to: console. This Fixes bsc#1219074</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427200">- Add rd.kiwi.oem.force_resize boot option
  Forces the disk resize process on an OEM disk image.
  If set, no sanity check for unpartitioned/free space
  is performed and also an eventually configured
  &lt;oem-resize-once&gt; configuration from the image description
  will not be taken into account. This Fixes bsc#1224389</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427201">- Do not exclude the .profile env file by default
  kiwi's initrd modules read a .profile file which gets included
  into the initrd produced at build time. To allow rebuild of a
  host-only initrd from the booted system this information should
  be present such that it is possible to re-use kiwi initrd code.
  This is related to bsc#1228118</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1722427202">- Fix kiwi-repart restrictions
  The kiwi repart dracut module reads a profile file and if it
  does not exists it dies in the initrd. However, that profile
  file is not mandatory for the main resize functionality. Thus
  this commit turns this into a warning message. In addition
  the module-setup for 90kiwi-repart makes sure to include
  the required and optional profile files.
  This Fixes bsc#1228118</changelog>
</package>
<package pkgid="1275f33fb85fab3e0c62d6a4b8e0624cd2158f4caf53c86eecc619089303f5b4" name="dracut-kiwi-overlay" arch="aarch64">
  <version epoch="0" ver="9.24.43" rel="150100.3.84.1"/>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698321600">- Create live persistent storage without busy state
  With the former logic the live ISO was already mounted when an
  eventual persistent storage partition was created. This leads
  to an issue on re-reading the partition table, not for all but
  several tools. This commit changes the order of tasks such that
  the setup of the persistent write storage is performed prior
  mounting the live ISO. In addition to this change an alternative
  method using blockdev to re-read the partition was added in case
  partprobe is not present. This also allows to get rid of the
  parted dependency which provides partprobe
  Part of bsc#1216465
  (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698408000">- Change partprobe fallback to partx
  Informing the kernel about a new partition geometry can be done in a
  busy state and is also effective for new devices and new mounts based
  on the new geometry. busy state mounts of course will not see it until
  swap of the busy state but a complete refuse of operation like it
  happens with blockdev is imho not required. Just as partprobe, partx
  is less restrictive on the busy state. That's why this commit changes
  the partprobe fallback to use partx instead of blockdev
  Part of bsc#1216465
  (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698840000">- Add partx to module-setup of kiwi-lib too
  Part of bsc#1216465
  (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1700654400">- Allow install disk overwrite from cmdline
  Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device
  that should be used in an OEM installation. This overwrites any
  other oem device setting, e.g device filter or maxdisk and just
  continues the installation on the given device. However, the
  device must exist and must be a block special.
  This Fixes jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704369600">- Fix overwrite of kiwi_oemunattended
  In case rd.kiwi.oem.installdevice is set, there is an overwrite
  of the kiwi_oemunattended setting. However the variable was set
  in local scope of a function and therefore the change was not
  effective in other methods which also evaluates this variable.
  This commit fixes it such that the overwrite happens in the early
  initialize method which provides the environment for all code
  running in the dracut module. This is related to jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704801600">- Fixed regression in GRUB_SERIAL_COMMAND setup
  The condition to write the serial line setup was broken.
  This commit fixes it. Related to Issue #2419 and
  Fixes bsc#1228808</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1705579200">- Fixed grub terminal setup
  The grub terminal setup is divided into the setting for the output
  and the input console. For both settings different parameters exists.
  So far kiwi did not differentiate between the two parts of the
  console setup and that could lead to a wrong setting if only one
  value is provided in kiwi's console= attribute which lead to the
  grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm
  grub takes this for both input and output and it's obviously
  wrong for the input. To make this less error prune the kiwi code
  changes with this commit to set GRUB_TERMINAL_INPUT and
  GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity
  checks on the provided values if they are applicable. The information
  for setting up the console in the schema stays untouched though.
  That's because it's used for all bootloaders and also because grub
  supports multiple values for the console in/out setting in one
  GRUB_TERMINAL variable even though kiwi does no longer use it.
  To make this clear for the users also the documentation for the
  console attribute setup has been updated. If we want to wish two
  distinct attributes for input and output console settings a schema
  change and also differentiation between bootloaders is needed and
  that I only see for the kiwi-10 branch if at all. This Fixes #2419
  and Fixes bsc#1218095</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1710849600">- Fixup cleanup of zipl templates
  Make sure temporary modifications to the zipl template
  and config file are not effective in the later system.
  This Fixes bsc#1221469</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1711368000">- Live ISO Wait for udev events after repart
  Make sure to wait for the event queue to become empty after
  the creation of the write partition. When kiwi calls the
  code to create the write partition this emits new udev events.
  It's important to wait for the event queue to become empty
  to avoid a potential regression on the use of the device nodes.
  In the processing of the events it can happen that a device
  gets removed and re-added. If we don't want for udev
  to process the entire queue it can happen that the
  wrong block device is used. This wrong selection is only
  possible because the way how hybrid ISOs are designed exposes
  both, the disk and the partition for the root device with
  the same label. This Fixes bsc#1213595</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1712232000">- Set default output console to gfxterm for grub
  If no console setting is done in the image description for grub
  the default output console is set to: gfxterm and the default
  input console is set to: console. This Fixes bsc#1219074</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427200">- Add rd.kiwi.oem.force_resize boot option
  Forces the disk resize process on an OEM disk image.
  If set, no sanity check for unpartitioned/free space
  is performed and also an eventually configured
  &lt;oem-resize-once&gt; configuration from the image description
  will not be taken into account. This Fixes bsc#1224389</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427201">- Do not exclude the .profile env file by default
  kiwi's initrd modules read a .profile file which gets included
  into the initrd produced at build time. To allow rebuild of a
  host-only initrd from the booted system this information should
  be present such that it is possible to re-use kiwi initrd code.
  This is related to bsc#1228118</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1722427202">- Fix kiwi-repart restrictions
  The kiwi repart dracut module reads a profile file and if it
  does not exists it dies in the initrd. However, that profile
  file is not mandatory for the main resize functionality. Thus
  this commit turns this into a warning message. In addition
  the module-setup for 90kiwi-repart makes sure to include
  the required and optional profile files.
  This Fixes bsc#1228118</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1723118400">- Update virtualenv setup
  types-pkg_resources got dropped from PyPI</changelog>
</package>
<package pkgid="10d75bb1ea725aa84f88fe516448ab503908d3f78ca170bcc75668c59c88077f" name="dracut-kiwi-overlay" arch="ppc64le">
  <version epoch="0" ver="9.24.43" rel="150100.3.84.1"/>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698321600">- Create live persistent storage without busy state
  With the former logic the live ISO was already mounted when an
  eventual persistent storage partition was created. This leads
  to an issue on re-reading the partition table, not for all but
  several tools. This commit changes the order of tasks such that
  the setup of the persistent write storage is performed prior
  mounting the live ISO. In addition to this change an alternative
  method using blockdev to re-read the partition was added in case
  partprobe is not present. This also allows to get rid of the
  parted dependency which provides partprobe
  Part of bsc#1216465
  (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698408000">- Change partprobe fallback to partx
  Informing the kernel about a new partition geometry can be done in a
  busy state and is also effective for new devices and new mounts based
  on the new geometry. busy state mounts of course will not see it until
  swap of the busy state but a complete refuse of operation like it
  happens with blockdev is imho not required. Just as partprobe, partx
  is less restrictive on the busy state. That's why this commit changes
  the partprobe fallback to use partx instead of blockdev
  Part of bsc#1216465
  (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698840000">- Add partx to module-setup of kiwi-lib too
  Part of bsc#1216465
  (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1700654400">- Allow install disk overwrite from cmdline
  Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device
  that should be used in an OEM installation. This overwrites any
  other oem device setting, e.g device filter or maxdisk and just
  continues the installation on the given device. However, the
  device must exist and must be a block special.
  This Fixes jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704369600">- Fix overwrite of kiwi_oemunattended
  In case rd.kiwi.oem.installdevice is set, there is an overwrite
  of the kiwi_oemunattended setting. However the variable was set
  in local scope of a function and therefore the change was not
  effective in other methods which also evaluates this variable.
  This commit fixes it such that the overwrite happens in the early
  initialize method which provides the environment for all code
  running in the dracut module. This is related to jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704801600">- Fixed regression in GRUB_SERIAL_COMMAND setup
  The condition to write the serial line setup was broken.
  This commit fixes it. Related to Issue #2419 and
  Fixes bsc#1228808</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1705579200">- Fixed grub terminal setup
  The grub terminal setup is divided into the setting for the output
  and the input console. For both settings different parameters exists.
  So far kiwi did not differentiate between the two parts of the
  console setup and that could lead to a wrong setting if only one
  value is provided in kiwi's console= attribute which lead to the
  grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm
  grub takes this for both input and output and it's obviously
  wrong for the input. To make this less error prune the kiwi code
  changes with this commit to set GRUB_TERMINAL_INPUT and
  GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity
  checks on the provided values if they are applicable. The information
  for setting up the console in the schema stays untouched though.
  That's because it's used for all bootloaders and also because grub
  supports multiple values for the console in/out setting in one
  GRUB_TERMINAL variable even though kiwi does no longer use it.
  To make this clear for the users also the documentation for the
  console attribute setup has been updated. If we want to wish two
  distinct attributes for input and output console settings a schema
  change and also differentiation between bootloaders is needed and
  that I only see for the kiwi-10 branch if at all. This Fixes #2419
  and Fixes bsc#1218095</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1710849600">- Fixup cleanup of zipl templates
  Make sure temporary modifications to the zipl template
  and config file are not effective in the later system.
  This Fixes bsc#1221469</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1711368000">- Live ISO Wait for udev events after repart
  Make sure to wait for the event queue to become empty after
  the creation of the write partition. When kiwi calls the
  code to create the write partition this emits new udev events.
  It's important to wait for the event queue to become empty
  to avoid a potential regression on the use of the device nodes.
  In the processing of the events it can happen that a device
  gets removed and re-added. If we don't want for udev
  to process the entire queue it can happen that the
  wrong block device is used. This wrong selection is only
  possible because the way how hybrid ISOs are designed exposes
  both, the disk and the partition for the root device with
  the same label. This Fixes bsc#1213595</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1712232000">- Set default output console to gfxterm for grub
  If no console setting is done in the image description for grub
  the default output console is set to: gfxterm and the default
  input console is set to: console. This Fixes bsc#1219074</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427200">- Add rd.kiwi.oem.force_resize boot option
  Forces the disk resize process on an OEM disk image.
  If set, no sanity check for unpartitioned/free space
  is performed and also an eventually configured
  &lt;oem-resize-once&gt; configuration from the image description
  will not be taken into account. This Fixes bsc#1224389</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427201">- Do not exclude the .profile env file by default
  kiwi's initrd modules read a .profile file which gets included
  into the initrd produced at build time. To allow rebuild of a
  host-only initrd from the booted system this information should
  be present such that it is possible to re-use kiwi initrd code.
  This is related to bsc#1228118</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1722427202">- Fix kiwi-repart restrictions
  The kiwi repart dracut module reads a profile file and if it
  does not exists it dies in the initrd. However, that profile
  file is not mandatory for the main resize functionality. Thus
  this commit turns this into a warning message. In addition
  the module-setup for 90kiwi-repart makes sure to include
  the required and optional profile files.
  This Fixes bsc#1228118</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1723118400">- Update virtualenv setup
  types-pkg_resources got dropped from PyPI</changelog>
</package>
<package pkgid="a52906bcc1c5495f3b7a530408d0dec1c80e003a822332ad5cbf368e354ccd48" name="dracut-kiwi-overlay" arch="s390x">
  <version epoch="0" ver="9.24.43" rel="150100.3.84.1"/>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698321600">- Create live persistent storage without busy state
  With the former logic the live ISO was already mounted when an
  eventual persistent storage partition was created. This leads
  to an issue on re-reading the partition table, not for all but
  several tools. This commit changes the order of tasks such that
  the setup of the persistent write storage is performed prior
  mounting the live ISO. In addition to this change an alternative
  method using blockdev to re-read the partition was added in case
  partprobe is not present. This also allows to get rid of the
  parted dependency which provides partprobe
  Part of bsc#1216465
  (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698408000">- Change partprobe fallback to partx
  Informing the kernel about a new partition geometry can be done in a
  busy state and is also effective for new devices and new mounts based
  on the new geometry. busy state mounts of course will not see it until
  swap of the busy state but a complete refuse of operation like it
  happens with blockdev is imho not required. Just as partprobe, partx
  is less restrictive on the busy state. That's why this commit changes
  the partprobe fallback to use partx instead of blockdev
  Part of bsc#1216465
  (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698840000">- Add partx to module-setup of kiwi-lib too
  Part of bsc#1216465
  (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1700654400">- Allow install disk overwrite from cmdline
  Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device
  that should be used in an OEM installation. This overwrites any
  other oem device setting, e.g device filter or maxdisk and just
  continues the installation on the given device. However, the
  device must exist and must be a block special.
  This Fixes jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704369600">- Fix overwrite of kiwi_oemunattended
  In case rd.kiwi.oem.installdevice is set, there is an overwrite
  of the kiwi_oemunattended setting. However the variable was set
  in local scope of a function and therefore the change was not
  effective in other methods which also evaluates this variable.
  This commit fixes it such that the overwrite happens in the early
  initialize method which provides the environment for all code
  running in the dracut module. This is related to jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704801600">- Fixed regression in GRUB_SERIAL_COMMAND setup
  The condition to write the serial line setup was broken.
  This commit fixes it. Related to Issue #2419 and
  Fixes bsc#1228808</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1705579200">- Fixed grub terminal setup
  The grub terminal setup is divided into the setting for the output
  and the input console. For both settings different parameters exists.
  So far kiwi did not differentiate between the two parts of the
  console setup and that could lead to a wrong setting if only one
  value is provided in kiwi's console= attribute which lead to the
  grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm
  grub takes this for both input and output and it's obviously
  wrong for the input. To make this less error prune the kiwi code
  changes with this commit to set GRUB_TERMINAL_INPUT and
  GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity
  checks on the provided values if they are applicable. The information
  for setting up the console in the schema stays untouched though.
  That's because it's used for all bootloaders and also because grub
  supports multiple values for the console in/out setting in one
  GRUB_TERMINAL variable even though kiwi does no longer use it.
  To make this clear for the users also the documentation for the
  console attribute setup has been updated. If we want to wish two
  distinct attributes for input and output console settings a schema
  change and also differentiation between bootloaders is needed and
  that I only see for the kiwi-10 branch if at all. This Fixes #2419
  and Fixes bsc#1218095</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1710849600">- Fixup cleanup of zipl templates
  Make sure temporary modifications to the zipl template
  and config file are not effective in the later system.
  This Fixes bsc#1221469</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1711368000">- Live ISO Wait for udev events after repart
  Make sure to wait for the event queue to become empty after
  the creation of the write partition. When kiwi calls the
  code to create the write partition this emits new udev events.
  It's important to wait for the event queue to become empty
  to avoid a potential regression on the use of the device nodes.
  In the processing of the events it can happen that a device
  gets removed and re-added. If we don't want for udev
  to process the entire queue it can happen that the
  wrong block device is used. This wrong selection is only
  possible because the way how hybrid ISOs are designed exposes
  both, the disk and the partition for the root device with
  the same label. This Fixes bsc#1213595</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1712232000">- Set default output console to gfxterm for grub
  If no console setting is done in the image description for grub
  the default output console is set to: gfxterm and the default
  input console is set to: console. This Fixes bsc#1219074</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427200">- Add rd.kiwi.oem.force_resize boot option
  Forces the disk resize process on an OEM disk image.
  If set, no sanity check for unpartitioned/free space
  is performed and also an eventually configured
  &lt;oem-resize-once&gt; configuration from the image description
  will not be taken into account. This Fixes bsc#1224389</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427201">- Do not exclude the .profile env file by default
  kiwi's initrd modules read a .profile file which gets included
  into the initrd produced at build time. To allow rebuild of a
  host-only initrd from the booted system this information should
  be present such that it is possible to re-use kiwi initrd code.
  This is related to bsc#1228118</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1722427202">- Fix kiwi-repart restrictions
  The kiwi repart dracut module reads a profile file and if it
  does not exists it dies in the initrd. However, that profile
  file is not mandatory for the main resize functionality. Thus
  this commit turns this into a warning message. In addition
  the module-setup for 90kiwi-repart makes sure to include
  the required and optional profile files.
  This Fixes bsc#1228118</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1723118400">- Update virtualenv setup
  types-pkg_resources got dropped from PyPI</changelog>
</package>
<package pkgid="fb6fefed6c014dccd154f0da7b2af5c6f3f5916eaf9a3638541443e87a70763d" name="dracut-kiwi-overlay" arch="x86_64">
  <version epoch="0" ver="9.24.43" rel="150100.3.84.1"/>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698321600">- Create live persistent storage without busy state
  With the former logic the live ISO was already mounted when an
  eventual persistent storage partition was created. This leads
  to an issue on re-reading the partition table, not for all but
  several tools. This commit changes the order of tasks such that
  the setup of the persistent write storage is performed prior
  mounting the live ISO. In addition to this change an alternative
  method using blockdev to re-read the partition was added in case
  partprobe is not present. This also allows to get rid of the
  parted dependency which provides partprobe
  Part of bsc#1216465
  (cherry picked from commit 53ddc4ecbedd6dc98294e4d0387370908f0bc657)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698408000">- Change partprobe fallback to partx
  Informing the kernel about a new partition geometry can be done in a
  busy state and is also effective for new devices and new mounts based
  on the new geometry. busy state mounts of course will not see it until
  swap of the busy state but a complete refuse of operation like it
  happens with blockdev is imho not required. Just as partprobe, partx
  is less restrictive on the busy state. That's why this commit changes
  the partprobe fallback to use partx instead of blockdev
  Part of bsc#1216465
  (cherry picked from commit db9042af8ed36ede0dfe9572d9fe2c546c25b901)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1698840000">- Add partx to module-setup of kiwi-lib too
  Part of bsc#1216465
  (cherry picked from commit cf125437776b07e77900b6a53aeb065cd1572367)</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1700654400">- Allow install disk overwrite from cmdline
  Add rd.kiwi.oem.installdevice=DEVICE. Configures the disk device
  that should be used in an OEM installation. This overwrites any
  other oem device setting, e.g device filter or maxdisk and just
  continues the installation on the given device. However, the
  device must exist and must be a block special.
  This Fixes jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704369600">- Fix overwrite of kiwi_oemunattended
  In case rd.kiwi.oem.installdevice is set, there is an overwrite
  of the kiwi_oemunattended setting. However the variable was set
  in local scope of a function and therefore the change was not
  effective in other methods which also evaluates this variable.
  This commit fixes it such that the overwrite happens in the early
  initialize method which provides the environment for all code
  running in the dracut module. This is related to jira#PED-7180</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1704801600">- Fixed regression in GRUB_SERIAL_COMMAND setup
  The condition to write the serial line setup was broken.
  This commit fixes it. Related to Issue #2419 and
  Fixes bsc#1228808</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1705579200">- Fixed grub terminal setup
  The grub terminal setup is divided into the setting for the output
  and the input console. For both settings different parameters exists.
  So far kiwi did not differentiate between the two parts of the
  console setup and that could lead to a wrong setting if only one
  value is provided in kiwi's console= attribute which lead to the
  grub setting, GRUB_TERMINAL=value. If value is set to e.g gfxterm
  grub takes this for both input and output and it's obviously
  wrong for the input. To make this less error prune the kiwi code
  changes with this commit to set GRUB_TERMINAL_INPUT and
  GRUB_TERMINAL_OUTPUT rather than GRUB_TERMINAL and also runs sanity
  checks on the provided values if they are applicable. The information
  for setting up the console in the schema stays untouched though.
  That's because it's used for all bootloaders and also because grub
  supports multiple values for the console in/out setting in one
  GRUB_TERMINAL variable even though kiwi does no longer use it.
  To make this clear for the users also the documentation for the
  console attribute setup has been updated. If we want to wish two
  distinct attributes for input and output console settings a schema
  change and also differentiation between bootloaders is needed and
  that I only see for the kiwi-10 branch if at all. This Fixes #2419
  and Fixes bsc#1218095</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1710849600">- Fixup cleanup of zipl templates
  Make sure temporary modifications to the zipl template
  and config file are not effective in the later system.
  This Fixes bsc#1221469</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1711368000">- Live ISO Wait for udev events after repart
  Make sure to wait for the event queue to become empty after
  the creation of the write partition. When kiwi calls the
  code to create the write partition this emits new udev events.
  It's important to wait for the event queue to become empty
  to avoid a potential regression on the use of the device nodes.
  In the processing of the events it can happen that a device
  gets removed and re-added. If we don't want for udev
  to process the entire queue it can happen that the
  wrong block device is used. This wrong selection is only
  possible because the way how hybrid ISOs are designed exposes
  both, the disk and the partition for the root device with
  the same label. This Fixes bsc#1213595</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1712232000">- Set default output console to gfxterm for grub
  If no console setting is done in the image description for grub
  the default output console is set to: gfxterm and the default
  input console is set to: console. This Fixes bsc#1219074</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427200">- Add rd.kiwi.oem.force_resize boot option
  Forces the disk resize process on an OEM disk image.
  If set, no sanity check for unpartitioned/free space
  is performed and also an eventually configured
  &lt;oem-resize-once&gt; configuration from the image description
  will not be taken into account. This Fixes bsc#1224389</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1722427201">- Do not exclude the .profile env file by default
  kiwi's initrd modules read a .profile file which gets included
  into the initrd produced at build time. To allow rebuild of a
  host-only initrd from the booted system this information should
  be present such that it is possible to re-use kiwi initrd code.
  This is related to bsc#1228118</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1722427202">- Fix kiwi-repart restrictions
  The kiwi repart dracut module reads a profile file and if it
  does not exists it dies in the initrd. However, that profile
  file is not mandatory for the main resize functionality. Thus
  this commit turns this into a warning message. In addition
  the module-setup for 90kiwi-repart makes sure to include
  the required and optional profile files.
  This Fixes bsc#1228118</changelog>
  <changelog author="marcus.schaefer@suse.com" date="1723118400">- Update virtualenv setup
  types-pkg_resources got dropped from PyPI</changelog>
</package>
<package pkgid="2a866590ab3ddd44c5325b7e626d29c530347e72f492590204137f96e683e085" name="dracut-mkinitrd-deprecated" arch="aarch64">
  <version epoch="0" ver="059+suse.527.g7870f083" rel="150600.3.3.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
</package>
<package pkgid="24889c662a5d39ca61f1f437d6e55cc24ca6195426f120b0376795690bdb61c9" name="dracut-mkinitrd-deprecated" arch="ppc64le">
  <version epoch="0" ver="059+suse.527.g7870f083" rel="150600.3.3.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
</package>
<package pkgid="5b6364cf0d9306df49367ae177e660c039bceec28e25af1c67e9b466739fbc5c" name="dracut-mkinitrd-deprecated" arch="s390x">
  <version epoch="0" ver="059+suse.527.g7870f083" rel="150600.3.3.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
</package>
<package pkgid="7cdcc9e1901cb7546c2b12132c0198b42842e6b17210e0333a39608ee5ea7021" name="dracut-mkinitrd-deprecated" arch="x86_64">
  <version epoch="0" ver="059+suse.527.g7870f083" rel="150600.3.3.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
</package>
<package pkgid="bad67f7ca64b7d30eab4f2cad3db0218e03c38085168ccb0d61a91c619af0364" name="dracut-mkinitrd-deprecated" arch="aarch64">
  <version epoch="0" ver="059+suse.531.g48487c31" rel="150600.3.6.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1724414400">- Update to version 059+suse.531.g48487c31:
  * feat(systemd*): include systemd config files from /usr/lib/systemd (bsc#1228398)
  * fix(convertfs): error in conditional expressions (bsc#1228847)</changelog>
</package>
<package pkgid="3d50d9cf08c27bae9065bbff8f803563bff3681692d49277c84eea0b4a493250" name="dracut-mkinitrd-deprecated" arch="ppc64le">
  <version epoch="0" ver="059+suse.531.g48487c31" rel="150600.3.6.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1724414400">- Update to version 059+suse.531.g48487c31:
  * feat(systemd*): include systemd config files from /usr/lib/systemd (bsc#1228398)
  * fix(convertfs): error in conditional expressions (bsc#1228847)</changelog>
</package>
<package pkgid="38d8fb79cedbfdaa94126d7344447a06d6e5688eec2b1e6e9b0fffa20e09653a" name="dracut-mkinitrd-deprecated" arch="s390x">
  <version epoch="0" ver="059+suse.531.g48487c31" rel="150600.3.6.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1724414400">- Update to version 059+suse.531.g48487c31:
  * feat(systemd*): include systemd config files from /usr/lib/systemd (bsc#1228398)
  * fix(convertfs): error in conditional expressions (bsc#1228847)</changelog>
</package>
<package pkgid="6082fb3cd639110f1bcb7ed9e75b61137329729f9af1a0924759f454339d0545" name="dracut-mkinitrd-deprecated" arch="x86_64">
  <version epoch="0" ver="059+suse.531.g48487c31" rel="150600.3.6.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1724414400">- Update to version 059+suse.531.g48487c31:
  * feat(systemd*): include systemd config files from /usr/lib/systemd (bsc#1228398)
  * fix(convertfs): error in conditional expressions (bsc#1228847)</changelog>
</package>
<package pkgid="eb06a48b84213fb6a86cd0c468c4666039a6482fb1ddb50ec3b670b0ece53b08" name="dracut-tools" arch="aarch64">
  <version epoch="0" ver="059+suse.527.g7870f083" rel="150600.3.3.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
</package>
<package pkgid="4a08095e726303134a4fdd55141f054bc4b4e544cd6a1fbff8657cd7dc685c6e" name="dracut-tools" arch="ppc64le">
  <version epoch="0" ver="059+suse.527.g7870f083" rel="150600.3.3.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
</package>
<package pkgid="41b2a34417e73beb90a9de137d46bbf4a3af57debead1476213c7c4ee6b5432c" name="dracut-tools" arch="s390x">
  <version epoch="0" ver="059+suse.527.g7870f083" rel="150600.3.3.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
</package>
<package pkgid="9cc94061667a720e6afdca2bd8153a6f4700ba07775c60ac0e74dfb050cc9592" name="dracut-tools" arch="x86_64">
  <version epoch="0" ver="059+suse.527.g7870f083" rel="150600.3.3.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
</package>
<package pkgid="b896a09fc69d65842896955197bf4a215869fcaea2007f8eb7a526c058e4a23a" name="dracut-tools" arch="aarch64">
  <version epoch="0" ver="059+suse.531.g48487c31" rel="150600.3.6.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1724414400">- Update to version 059+suse.531.g48487c31:
  * feat(systemd*): include systemd config files from /usr/lib/systemd (bsc#1228398)
  * fix(convertfs): error in conditional expressions (bsc#1228847)</changelog>
</package>
<package pkgid="af42f00e1f7ba4e2f4c6ada1ef747a44e545cd59cd1d3fa05f99fa3e311b8542" name="dracut-tools" arch="ppc64le">
  <version epoch="0" ver="059+suse.531.g48487c31" rel="150600.3.6.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1724414400">- Update to version 059+suse.531.g48487c31:
  * feat(systemd*): include systemd config files from /usr/lib/systemd (bsc#1228398)
  * fix(convertfs): error in conditional expressions (bsc#1228847)</changelog>
</package>
<package pkgid="9d47bbc18e2b868d9dc6929bf25771c167f9cf4101c1c52730456185e8604df5" name="dracut-tools" arch="s390x">
  <version epoch="0" ver="059+suse.531.g48487c31" rel="150600.3.6.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1724414400">- Update to version 059+suse.531.g48487c31:
  * feat(systemd*): include systemd config files from /usr/lib/systemd (bsc#1228398)
  * fix(convertfs): error in conditional expressions (bsc#1228847)</changelog>
</package>
<package pkgid="75fff3b587806f8754b77e41e88182a31733cebca583fb10ad944a61c4f43c32" name="dracut-tools" arch="x86_64">
  <version epoch="0" ver="059+suse.531.g48487c31" rel="150600.3.6.2"/>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792000">- Update to version 059+suse.494.g2ed56105:
  Update to current upstream version (059+backports) (jsc#PED-4884)
  Upstream backports not included in 059:
  Features:
  * feat(network-wicked): remove module
  * feat(systemd-rfkill): remove module
  * feat(livenet): add memory size check depending on live image size
  * feat(nvmf): add code for parsing the NBFT
  * chore(shfmt): update to pass with shfmt v3.5.1
  * feat(dracut-init.sh): do not print by default if an udev rule is skipped
  * feat(lsinitrd): notify user on missing compressor
  * feat(dracut): use log level indicator in console output
  * feat(kernel-modules): driver support for macbook keyboards
  * feat(dracut-init.sh): specify if a module cannot be found or cannot be installed
  Fixes:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)
  * fix(systemd-udevd): add missing override paths
  * fix(systemd-journald): add systemd-sysusers dependency
  * fix(base): correct handling of quiet in loginit
  * fix(integrity): do not require ls
  * fix(dracut-init.sh): `module_check` method ignores `forced` option
  * fix(man): add missing initrd-root-device.target to flow chart
  * fix(dracut-init.sh): use the local _ret variable
  * chore(suse): require gawk instead of awk
  * fix(dracut.sh): use gawk for strtonum
  * fix(man): remove duplicate entry
  * fix(systemd-sysext): handle confexts and correct extensions search path
  * fix(modsign): load keys to correct keyring
  * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known
  * fix(fs-lib): remove quoting form the first argument of the e2fsck call
  * fix(Makefile): remove leftover rpm build rules
  * fix(Makefile): no longer upload to kernel.org
  * fix(nvmf): support /etc/nvme/config.json
  * fix(install.d): respect even more kernel-install vars, plus style fixes
  * fix(install.d): respect more kernel-install env variables
  * fix(dracut.sh): also prevent fsfreeze for tmpfs
  * fix(dmsquash-live): allow other fstypes
  * fix(bluetooth): make bluetooth rules more strict
  * fix(bluetooth): add missing files
  * fix(bluetooth): include it if Appearance matches the value assigned for keyboard
  * fix(btrfs): do not require module via cmdline when --no-kernel
  * fix(btrfs): add missing cmdline function
  * fix(multipath): explicitly check if `hostonly_cmdline` is `yes`
  * fix(systemd-timedated): correct typo in override path
  * fix(systemd-resolved): correct typo in override path
  * fix(systemd-networkd): correct typos in override paths
  * fix(dracut-init.sh): correct check in `is_qemu_virtualized` function
  * fix(Makefile): execute command -v instead of which
  * fix(network-legacy): typo
  * fix(network,dbus): improve dependency checking
  * fix(systemd-pcrphase): only include systemd-pcrphase-initrd.service
  * fix(systemd-tmpfiles): do not include systemd-tmpfiles-clean.timer
  * fix(systemd-journald): do not include systemd-journal-flush.service
  * fix(systemd): do not include systemd-random-seed.service
  * fix(kernel-modules): add interconnect drivers
  * fix(dracut-lib.sh): remove successful finished initqueue scripts
  * fix(udev-rules): remove firmware.rules
  * fix(dracut.sh): silence the output of hardlinking files by default
  * fix(virtiofs): add virtio_pci kernel module to virtiofs
  * fix(dracut-systemd): rootfs-generator cannot write outside of generator dir
  * fix(dracut-systemd): check and create generator dir outside of inner function
  * fix(dracut-systemd): do not hardcode the systemd generator directory
  * fix(dracut-functions): avoid calling grep with PCRE (-P)
  * fix(dracut-initramfs-restore.sh): handle /etc/machine-id empty or uninitialized
  * fix(lsinitrd.sh): handle /etc/machine-id empty or uninitialized
  * fix(dracut.sh): handle /etc/machine-id empty or uninitialized
  * fix(systemd-networkd): add missing conf files and services
  * fix(dracut-functions.sh): convert mmcblk to the real kernel module name
  * fix(multipath): remove dependency on multipathd.socket
  * fix(99base): adjust to allow mksh as initrd shell
  * fix(base): do not quote $CLINE in the `set` command
  * fix(systemd-ac-power): correct systemd-ac-power binary path
  * fix(dracut.sh): use dynamically uefi's sections offset
  * fix(lvmthinpool-monitor): activate lvm thin pool before extend its size
  * fix(dmsquash-live): restore compatibility with earlier releases
  * fix(dracut.sh): kmoddir does not handle trailing /
  * fix(udev-rules): remove old eudev specific rule
  * fix(udev-rules): remove old redhat specific rule
  * fix(udev-rules): remove old edd_id extra rules
  * fix(udev-rules): remove old debian specific rules
  * fix(kernel-modules): add UFS drivers
  * fix(kernel-modules): use modalias info in get_dev_module()
  * fix(crypt): add missing libraries
  * revert(network-manager): avoid restarting NetworkManager
  * fix(dracut.sh): handle sbsign errors for UEFI builds
  * fix(dracut.sh): handle out of space error for UEFI builds
  * fix(plymouth): remove /etc/system-release dependency
  * fix(network-manager): add "After" dependency on dbus.service
  * fix(fido2): libfido2.so depends on libz.so
  * fix: make iso-scan trigger udev events
  * fix(install): do not undef _FILE_OFFSET_BITS
  * fix(dracut.sh): --sysroot option broken if global variables not set in conf
  * fix(lsinitrd.sh): handle filenames with special characters
  * fix(dracut-systemd): remove unused argument
  * fix(dracut-init.sh): correct typo in comment
  * fix(dracut.sh): correct --help and --version exit codes
  * fix(crypt-gpg): do not use always --card-status
  * fix(dmsquash-live): live:/dev/*
  * fix(load_fstype): avoid false positive searchs
  * fix: shellcheck 0.8.0
  Other:
  * refactor(install): log about missing firmware only once
  * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints
  * refactor(virtiofs): remove exit after die
  * build: remove rpm spec file and build rules
  * docs: remove rd.lvm.snapsize and rd.lvm.snapshot
  * chore(gentoo.conf): remove examples to avoid confusion
  * chore: remove git2spec.pl, it is no longer used
  * chore(suse): update url in spec
  Bugs between 056 and 059 not referenced yet:
  * fix(fips): add libkcapi fipscheck also with the libexec location (bsc#1207892)
  * revert(multipath): install multipathd.socket (bsc#1207524)
  * fix(dracut-initramfs-restore.sh): hide unpack errors (bsc#1199341)
  * fix(suse-initrd): always check that MACHINE_ID is not empty (bsc#1201780)
  * fix(i18n): add required includes for keymaps (bsc#1200950)
  * fix(integrity): do not enable EVM if there is no key (bsc#1200718)
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(lvm): add missing grep requirement (bsc#1198271)
  * fix(dracut-initramfs-restore.sh): unpack uncompressed initrd as last option (bsc#1197195)
  For more details on the changes included with 056, 057, 058 and 059 see:
  * https://github.com/dracutdevs/dracut/releases/tag/059
  * https://github.com/dracutdevs/dracut/releases/tag/058
  * https://github.com/dracutdevs/dracut/releases/tag/057
  * https://github.com/dracutdevs/dracut/releases/tag/056</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692792001">- Update to version 059+suse.495.g55462f85:
  * chore(suse): fix invalid license</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1694174400">- Update to version 059+suse.497.g6a2c5f83:
  * chore(suse): fix systemd-sysvinit dependency (bsc#1215132)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1697716800">- Update to version 059+suse.499.g2976c52f:
  * fix(dracut.spec): do not require libgcrypt20-hmac for dracut-fips (bsc#1216059)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1698062400">- Update to version 059+suse.502.g92237883:
  * fix(systemd): add new systemd-tmpfiles-setup-dev-early.service
  * revert(suse): fix systemd-sysvinit dependency</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1699876800">- Update to version 059+suse.506.gd33b6bef:
  * fix(dracut.sh): remove microcode check based on CONFIG_MICROCODE_[AMD|INTEL] (bsc#1217031)
  * fix(network): correct network device naming (bsc#1192986)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1710849600">- Update to version 059+suse.515.g83296e6f:
  * fix(dracut): correct regression with multiple `rd.break=` options (bsc#1221675)
  * fix(dracut-util): do not call `strcmp` if the `value` argument is NULL (bsc#1219841)
  * fix(i18n): handle symlinked keymap (bsc#1221193)
  * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485)
  * fix(dracut.sh): skip README for AMD microcode generation (bsc#1217083)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714478400">- Update to version 059+suse.519.g3edf43b4:
  * chore(suse): remove obsolete fillup template (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1714737600">- Update to version 059+suse.521.g8412a1c0:
  * fix(suse-initrd): clean return of installkernel() (bsc#1223467)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1720440000">- Update to version 059+suse.527.g7870f083:
  * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
  * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
  * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1724414400">- Update to version 059+suse.531.g48487c31:
  * feat(systemd*): include systemd config files from /usr/lib/systemd (bsc#1228398)
  * fix(convertfs): error in conditional expressions (bsc#1228847)</changelog>
</package>
<package pkgid="c16d6449d7522b4845362732c3d9e3edc8286031c691807bff7e487a49ae5a14" name="dri3proto" arch="src">
  <version epoch="0" ver="1.2" rel="150100.6.3.1"/>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1398340800">- Created package dri3proto with initial version 1.0</changelog>
  <changelog author="jengelh@inai.de" date="1411041600">- Update description and other metadata
- Use full %configure for build, and remove CFLAGS (nothing is
  compiled)
- Make file list more compact</changelog>
  <changelog author="sndirsch@suse.com" date="1526990400">- n_dri3proto-1.2-2018.4.patch
  * update to version 1.2 (patch generated from
    xorgproto-2018.4 sources)</changelog>
  <changelog author="sndirsch@suse.com" date="1717588800">- n_dri3proto-1.4-2024.1.patch
  * update to version 1.4 (patch generated from
    xorgproto-2024.1 sources)</changelog>
</package>
<package pkgid="769af24fa26563cb05d63db4fa2cb5f85de830a87d64c68e2246fa0f75cc6998" name="dri3proto-devel" arch="aarch64">
  <version epoch="0" ver="1.2" rel="150100.6.3.1"/>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1398340800">- Created package dri3proto with initial version 1.0</changelog>
  <changelog author="jengelh@inai.de" date="1411041600">- Update description and other metadata
- Use full %configure for build, and remove CFLAGS (nothing is
  compiled)
- Make file list more compact</changelog>
  <changelog author="sndirsch@suse.com" date="1526990400">- n_dri3proto-1.2-2018.4.patch
  * update to version 1.2 (patch generated from
    xorgproto-2018.4 sources)</changelog>
  <changelog author="sndirsch@suse.com" date="1717588800">- n_dri3proto-1.4-2024.1.patch
  * update to version 1.4 (patch generated from
    xorgproto-2024.1 sources)</changelog>
</package>
<package pkgid="48b320a38721372c8ec2817a6c285e12fb5df9720c47ffd48e890d71077fdc52" name="dri3proto-devel" arch="ppc64le">
  <version epoch="0" ver="1.2" rel="150100.6.3.1"/>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1398340800">- Created package dri3proto with initial version 1.0</changelog>
  <changelog author="jengelh@inai.de" date="1411041600">- Update description and other metadata
- Use full %configure for build, and remove CFLAGS (nothing is
  compiled)
- Make file list more compact</changelog>
  <changelog author="sndirsch@suse.com" date="1526990400">- n_dri3proto-1.2-2018.4.patch
  * update to version 1.2 (patch generated from
    xorgproto-2018.4 sources)</changelog>
  <changelog author="sndirsch@suse.com" date="1717588800">- n_dri3proto-1.4-2024.1.patch
  * update to version 1.4 (patch generated from
    xorgproto-2024.1 sources)</changelog>
</package>
<package pkgid="5b7a0d76158f781400c8f2199562852a5ca34c704bc0edde50376f0745eb7e64" name="dri3proto-devel" arch="s390x">
  <version epoch="0" ver="1.2" rel="150100.6.3.1"/>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1398340800">- Created package dri3proto with initial version 1.0</changelog>
  <changelog author="jengelh@inai.de" date="1411041600">- Update description and other metadata
- Use full %configure for build, and remove CFLAGS (nothing is
  compiled)
- Make file list more compact</changelog>
  <changelog author="sndirsch@suse.com" date="1526990400">- n_dri3proto-1.2-2018.4.patch
  * update to version 1.2 (patch generated from
    xorgproto-2018.4 sources)</changelog>
  <changelog author="sndirsch@suse.com" date="1717588800">- n_dri3proto-1.4-2024.1.patch
  * update to version 1.4 (patch generated from
    xorgproto-2024.1 sources)</changelog>
</package>
<package pkgid="54018f946dffcde97f5585f2fe7679c049df65fbc6e6b10d441ddd921548204f" name="dri3proto-devel" arch="x86_64">
  <version epoch="0" ver="1.2" rel="150100.6.3.1"/>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1398340800">- Created package dri3proto with initial version 1.0</changelog>
  <changelog author="jengelh@inai.de" date="1411041600">- Update description and other metadata
- Use full %configure for build, and remove CFLAGS (nothing is
  compiled)
- Make file list more compact</changelog>
  <changelog author="sndirsch@suse.com" date="1526990400">- n_dri3proto-1.2-2018.4.patch
  * update to version 1.2 (patch generated from
    xorgproto-2018.4 sources)</changelog>
  <changelog author="sndirsch@suse.com" date="1717588800">- n_dri3proto-1.4-2024.1.patch
  * update to version 1.4 (patch generated from
    xorgproto-2024.1 sources)</changelog>
</package>
<package pkgid="66f1bea8def65633db2763b4c79c0879ba070e309d36052949a415aa41162a5f" name="dtb-aarch64" arch="src">
  <version epoch="0" ver="6.4.0" rel="150600.23.14.1"/>
  <changelog author="tiwai@suse.de" date="1719662400">- gpiolib: cdev: Disallow reconfiguration without direction
  (uAPI v1) (git-fixes).
- gpio: davinci: Validate the obtained number of IRQs (git-fixes).
- commit 919ebd1</changelog>
  <changelog author="tiwai@suse.de" date="1719748800">- i2c: testunit: discard write requests while old command is
  running (git-fixes).
- i2c: testunit: don't erase registers after STOP (git-fixes).
- mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
  (git-fixes).
- mmc: sdhci: Do not invert write-protect twice (git-fixes).
- mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
  (git-fixes).
- mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
  (git-fixes).
- commit 448487d</changelog>
  <changelog author="tiwai@suse.de" date="1719748801">- crypto: iaa - Account for cpu-less numa nodes (bsc#1227190).
- commit cd600aa</changelog>
  <changelog author="tiwai@suse.de" date="1719748802">- crypto: deflate - Add aliases to deflate (bsc#1227190).
- commit 27ffd92</changelog>
  <changelog author="tiwai@suse.de" date="1719835200">- ata: ahci: Clean up sysfs file on error (git-fixes).
- ata: libata-core: Fix double free on error (git-fixes).
- ata,scsi: libata-core: Do not leak memory for ata_port struct
  members (git-fixes).
- ata: libata-core: Fix null pointer dereference on error
  (git-fixes).
- kbuild: Fix build target deb-pkg: ln: failed to create hard link
  (git-fixes).
- kbuild: doc: Update default INSTALL_MOD_DIR from extra to
  updates (git-fixes).
- kbuild: Install dtb files as 0644 in Makefile.dtbinst
  (git-fixes).
- counter: ti-eqep: enable clock at probe (git-fixes).
- iio: chemical: bme680: Fix sensor data read operation
  (git-fixes).
- iio: chemical: bme680: Fix overflows in compensate() functions
  (git-fixes).
- iio: chemical: bme680: Fix calibration data variable
  (git-fixes).
- iio: chemical: bme680: Fix pressure value output (git-fixes).
- iio: accel: fxls8962af: select IIO_BUFFER &amp; IIO_KFIFO_BUF
  (git-fixes).
- iio: adc: ad7266: Fix variable checking bug (git-fixes).
- iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
  (git-fixes).
- serial: bcm63xx-uart: fix tx after conversion to
  uart_port_tx_limited() (git-fixes).
- serial: core: introduce uart_port_tx_limited_flags()
  (git-fixes).
- Revert "serial: core: only stop transmit when HW fifo is empty"
  (git-fixes).
- tty: mcf: MCF54418 has 10 UARTS (git-fixes).
- usb: gadget: aspeed_udc: fix device address configuration
  (git-fixes).
- usb: dwc3: core: remove lock of otg mode during gadget
  suspend/resume to avoid deadlock (git-fixes).
- usb: typec: ucsi: glink: fix child node release in probe
  function (git-fixes).
- usb: musb: da8xx: fix a resource leak in probe() (git-fixes).
- usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  (git-fixes).
- usb: gadget: printer: fix races against disable (git-fixes).
- PCI/MSI: Fix UAF in msi_capability_init (git-fixes).
- commit a2ea5a9</changelog>
  <changelog author="ptesarik@suse.com" date="1719835201">- net: ena: Fix redundant device NUMA node override
  (jsc#PED-8688).
- commit 6ad6684</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835202">- tcp: do not accept ACK of bytes we never sent (CVE-2023-52881
  bsc#1225611).
- commit 16404a6</changelog>
  <changelog author="mhocko@suse.com" date="1719835203">- Update
  patches.suse/1352-drm-amdgpu-Fix-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52883
  bsc#1226630).
- Update
  patches.suse/9p-add-missing-locking-around-taking-dentry-fid-list.patch
  (git-fixes CVE-2024-39463 bsc#1227090).
- Update
  patches.suse/ALSA-Fix-deadlocks-with-kctl-removals-at-disconnecti.patch
  (stable-fixes CVE-2024-38600 bsc#1226864).
- Update
  patches.suse/ALSA-core-Fix-NULL-module-pointer-assignment-at-card.patch
  (git-fixes CVE-2024-38605 bsc#1226740).
- Update
  patches.suse/ALSA-hda-Fix-possible-null-ptr-deref-when-assigning-.patch
  (git-fixes CVE-2023-52806 bsc#1225554).
- Update
  patches.suse/ALSA-hda-cs_dsp_ctl-Use-private_free-for-control-cle.patch
  (git-fixes CVE-2024-38388 bsc#1226890).
- Update
  patches.suse/ALSA-timer-Set-lower-bound-of-start-tick-time.patch
  (stable-fixes git-fixes CVE-2024-38618 bsc#1226754).
- Update
  patches.suse/ASoC-kirkwood-Fix-potential-NULL-dereference.patch
  (git-fixes CVE-2024-38550 bsc#1226633).
- Update
  patches.suse/ASoC-mediatek-Assign-dummy-when-codec-not-specified-.patch
  (git-fixes CVE-2024-38551 bsc#1226761).
- Update
  patches.suse/Bluetooth-btusb-Add-date-evt_skb-is-NULL-check.patch
  (git-fixes CVE-2023-52833 bsc#1225595).
- Update
  patches.suse/Bluetooth-hci_core-Fix-possible-buffer-overflow.patch
  (git-fixes CVE-2024-26889).
- Update
  patches.suse/HID-uclogic-Fix-user-memory-access-bug-in-uclogic_pa.patch
  (git-fixes CVE-2023-52866 bsc#1225120).
- Update
  patches.suse/IB-mlx5-Fix-init-stage-error-handling-to-avoid-doubl.patch
  (jsc#PED-6864 CVE-2023-52851 bsc#1225587).
- Update
  patches.suse/Input-cyapa-add-missing-input-core-locking-to-suspen.patch
  (git-fixes CVE-2023-52884 bsc#1226764).
- Update
  patches.suse/Input-synaptics-rmi4-fix-use-after-free-in-rmi_unreg.patch
  (git-fixes CVE-2023-52840 bsc#1224928).
- Update
  patches.suse/KEYS-trusted-Do-not-use-WARN-when-encode-fails.patch
  (git-fixes CVE-2024-36975 bsc#1226520).
- Update
  patches.suse/KEYS-trusted-Fix-memory-leak-in-tpm2_key_encode.patch
  (git-fixes CVE-2024-36967 bsc#1226131).
- Update
  patches.suse/RDMA-cma-Fix-kmemleak-in-rdma_core-observed-during-b.patch
  (git-fixes CVE-2024-38539 bsc#1226608).
- Update patches.suse/RDMA-hns-Fix-UAF-for-cq-async-event.patch
  (git-fixes CVE-2024-38545 bsc#1226595).
- Update
  patches.suse/RDMA-hns-Fix-deadlock-on-SRQ-async-events.patch
  (git-fixes CVE-2024-38591 bsc#1226738).
- Update
  patches.suse/RDMA-hns-Modify-the-print-level-of-CQE-error.patch
  (git-fixes CVE-2024-38590 bsc#1226839).
- Update
  patches.suse/RDMA-rxe-Fix-seg-fault-in-rxe_comp_queue_pkt.patch
  (git-fixes CVE-2024-38544 bsc#1226597).
- Update
  patches.suse/SUNRPC-Fix-RPC-client-cleaned-up-the-freed-pipefs-de.patch
  (git-fixes CVE-2023-52803 bsc#1225008).
- Update patches.suse/af_unix-Clear-stale-u-oob_skb.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-35970 bsc#1224584).
- Update
  patches.suse/af_unix-Drop-oob_skb-ref-before-purging-queue-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26750 bsc#1222617).
- Update
  patches.suse/af_unix-Fix-task-hung-while-purging-oob_skb-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26780 bsc#1222588).
- Update
  patches.suse/af_unix-Update-unix_sk-sk-oob_skb-under-sk_receive_queue-lock.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-36972 bsc#1226163).
- Update
  patches.suse/arm64-Restrict-CPU_BIG_ENDIAN-to-GNU-as-or-LLVM-IAS-.patch
  (git-fixes CVE-2023-52750 bsc#1225485).
- Update
  patches.suse/atl1c-Work-around-the-DMA-RX-overflow-issue.patch
  (git-fixes CVE-2023-52834 bsc#1225599).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issue-of-net_device.patch
  (git-fixes CVE-2024-38554 bsc#1226742).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issues-of-ax25_dev.patch
  (git-fixes CVE-2024-38602 bsc#1226613).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-reorder-of-WRITE-lqueued.patch
  (bsc#1225605 CVE-2024-38384 bsc#1226938).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-resetting-io-stat.patch
  (bsc#1225605 CVE-2024-38663 bsc#1226939).
- Update
  patches.suse/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch
  (git-fixes CVE-2024-38540 bsc#1226582).
- Update
  patches.suse/bonding-stop-the-device-in-bond_setup_by_slave.patch
  (git-fixes CVE-2023-52784 bsc#1224946).
- Update
  patches.suse/can-dev-can_put_echo_skb-don-t-crash-kernel-if-can_p.patch
  (git-fixes CVE-2023-52878 bsc#1225000).
- Update
  patches.suse/clk-mediatek-clk-mt2701-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52875 bsc#1225096).
- Update
  patches.suse/clk-mediatek-clk-mt6765-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52870 bsc#1224937).
- Update
  patches.suse/clk-mediatek-clk-mt6779-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52873 bsc#1225589).
- Update
  patches.suse/clk-mediatek-clk-mt6797-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52865 bsc#1225086).
- Update
  patches.suse/clk-mediatek-clk-mt7629-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52858 bsc#1225566).
- Update
  patches.suse/clk-mediatek-clk-mt7629-eth-Add-check-for-mtk_alloc_.patch
  (git-fixes CVE-2023-52876 bsc#1225036).
- Update
  patches.suse/cppc_cpufreq-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38573 bsc#1226739).
- Update patches.suse/cpufreq-exit-callback-is-optional.patch
  (git-fixes CVE-2024-38615 bsc#1226592).
- Update patches.suse/crypto-bcm-Fix-pointer-arithmetic.patch
  (git-fixes CVE-2024-38579 bsc#1226637).
- Update
  patches.suse/crypto-pcrypt-Fix-hungtask-for-PADATA_RESET.patch
  (git-fixes CVE-2023-52813 bsc#1225527).
- Update patches.suse/cxl-mem-Fix-shutdown-order.patch (git-fixes
  CVE-2023-52849 bsc#1224949).
- Update
  patches.suse/cxl-region-Do-not-try-to-cleanup-after-cxl_region_se.patch
  (git-fixes CVE-2023-52792 bsc#1225477).
- Update patches.suse/cxl-region-Fix-cxlr_pmem-leaks.patch
  (git-fixes CVE-2024-38391 bsc#1226894).
- Update
  patches.suse/dma-buf-sw-sync-don-t-enable-IRQ-from-sync_print_obj.patch
  (git-fixes CVE-2024-38780 bsc#1226886).
- Update
  patches.suse/dma-mapping-benchmark-fix-node-id-validation.patch
  (git-fixes CVE-2024-34777 bsc#1226796).
- Update
  patches.suse/dma-mapping-benchmark-handle-NUMA_NO_NODE-correctly.patch
  (git-fixes CVE-2024-39277 bsc#1226909).
- Update
  patches.suse/dmaengine-idxd-Avoid-unnecessary-destruction-of-file.patch
  (git-fixes CVE-2024-38629 bsc#1226905).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Pola.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52819
  bsc#1225532).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-SMU7.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52818
  bsc#1225530).
- Update
  patches.suse/drm-amd-check-num-of-link-levels-when-update-pcie-pa.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52812
  bsc#1225564).
- Update
  patches.suse/drm-amd-display-Avoid-NULL-dereference-of-timing-gen.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52753
  bsc#1225478).
- Update
  patches.suse/drm-amd-display-Fix-division-by-zero-in-setup_dsc_co.patch
  (stable-fixes CVE-2024-36969 bsc#1226155).
- Update
  patches.suse/drm-amd-display-Fix-null-pointer-dereference-in-erro.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52862
  bsc#1225015).
- Update
  patches.suse/drm-amd-display-Fix-potential-index-out-of-bounds-in.patch
  (git-fixes CVE-2024-38552 bsc#1226767).
- Update
  patches.suse/drm-amd-display-fix-a-NULL-pointer-dereference-in-am.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52773
  bsc#1225041).
- Update
  patches.suse/drm-amd-display-fixed-integer-types-and-null-check-l.patch
  (git-fixes CVE-2024-26767).
- Update
  patches.suse/drm-amdgpu-Fix-a-null-pointer-access-when-the-smc_rr.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52817
  bsc#1225569).
- Update
  patches.suse/drm-amdgpu-Fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch
  (git-fixes CVE-2024-39291 bsc#1226934).
- Update
  patches.suse/drm-amdgpu-Fix-potential-null-pointer-derefernce.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52814
  bsc#1225565).
- Update
  patches.suse/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch
  (stable-fixes CVE-2024-39471 bsc#1227096).
- Update
  patches.suse/drm-amdgpu-mes-fix-use-after-free-issue.patch
  (stable-fixes CVE-2024-38581 bsc#1226657).
- Update
  patches.suse/drm-amdgpu-vkms-fix-a-possible-null-pointer-derefere.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52815
  bsc#1225568).
- Update
  patches.suse/drm-amdkfd-Fix-a-race-condition-of-vram-buffer-unref.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52825
  bsc#1225076).
- Update
  patches.suse/drm-amdkfd-Fix-shift-out-of-bounds-issue.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52816
  bsc#1225529).
- Update
  patches.suse/drm-bridge-cdns-mhdp8546-Fix-possible-null-pointer-d.patch
  (git-fixes CVE-2024-38548).
- Update
  patches.suse/drm-bridge-it66121-Fix-invalid-connector-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52861
  bsc#1224941).
- Update
  patches.suse/drm-bridge-lt8912b-Fix-crash-on-bridge-detach.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52856
  bsc#1224932).
- Update
  patches.suse/drm-mediatek-Add-0-size-check-to-mtk_drm_gem_obj.patch
  (git-fixes CVE-2024-38549 bsc#1226735).
- Update
  patches.suse/drm-mediatek-Fix-coverity-issue-with-unintentional-i.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52857
  bsc#1225581).
- Update
  patches.suse/drm-mediatek-Init-ddp_comp-with-devm_kcalloc.patch
  (git-fixes CVE-2024-38592 bsc#1226844).
- Update
  patches.suse/drm-msm-a6xx-Avoid-a-nullptr-dereference-when-speedb.patch
  (git-fixes CVE-2024-38390 bsc#1226891).
- Update
  patches.suse/drm-msm-dpu-Add-callback-function-pointer-check-befo.patch
  (git-fixes CVE-2024-38622 bsc#1226856).
- Update
  patches.suse/drm-panel-fix-a-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52821
  bsc#1225022).
- Update
  patches.suse/drm-panel-panel-tpo-tpg110-fix-a-possible-null-point.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52826
  bsc#1225077).
- Update patches.suse/drm-radeon-possible-buffer-overflow.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52867
  bsc#1225009).
- Update
  patches.suse/drm-vc4-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38546 bsc#1226593).
- Update
  patches.suse/drm-vmwgfx-Fix-invalid-reads-in-fence-signaled-event.patch
  (git-fixes CVE-2024-36960 bsc#1225872).
- Update
  patches.suse/drm-zynqmp_dpsub-Always-register-bridge.patch
  (git-fixes CVE-2024-38664 bsc#1226941).
- Update
  patches.suse/e1000e-change-usleep_range-to-udelay-in-PHY-mdic-acc.patch
  (CVE-2024-39296 bsc#1226989 CVE-2024-36887 bsc#1225731).
- Update
  patches.suse/ecryptfs-Fix-buffer-size-for-tag-66-packet.patch
  (git-fixes CVE-2024-38578 bsc#1226634).
- Update
  patches.suse/efi-libstub-only-free-priv.runtime_map-when-allocate.patch
  (git-fixes CVE-2024-33619 bsc#1226768).
- Update
  patches.suse/fbdev-imsttfb-fix-a-resource-leak-in-probe.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52838
  bsc#1225031).
- Update
  patches.suse/fs-9p-only-translate-RWX-permissions-for-plain-9P200.patch
  (git-fixes CVE-2024-36964 bsc#1225866).
- Update
  patches.suse/fs-jfs-Add-check-for-negative-db_l2nbperpage.patch
  (git-fixes CVE-2023-52810 bsc#1225557).
- Update
  patches.suse/fs-jfs-Add-validity-check-for-db_maxag-and-db_agpref.patch
  (git-fixes CVE-2023-52804 bsc#1225550).
- Update
  patches.suse/ftrace-Fix-possible-use-after-free-issue-in-ftrace_location.patch
  (git-fixes CVE-2024-38588 bsc#1226837).
- Update
  patches.suse/genirq-irqdesc-Prevent-use-after-free-in-irq_find_at.patch
  (git-fixes CVE-2024-38385 bsc#1227085).
- Update patches.suse/gfs2-ignore-negated-quota-changes.patch
  (git-fixes CVE-2023-52759 bsc#1225560).
- Update
  patches.suse/hid-cp2112-Fix-duplicate-workqueue-initialization.patch
  (git-fixes CVE-2023-52853 bsc#1224988).
- Update
  patches.suse/hwmon-axi-fan-control-Fix-possible-NULL-pointer-dere.patch
  (git-fixes CVE-2023-52863 bsc#1225586).
- Update
  patches.suse/i2c-acpi-Unbind-mux-adapters-before-delete.patch
  (git-fixes CVE-2024-39362 bsc#1226995).
- Update
  patches.suse/i2c-core-Run-atomic-i2c-xfer-when-preemptible.patch
  (git-fixes CVE-2023-52791 bsc#1225108).
- Update
  patches.suse/i3c-master-mipi-i3c-hci-Fix-a-kernel-panic-for-acces.patch
  (git-fixes CVE-2023-52763 bsc#1225570).
- Update
  patches.suse/i3c-mipi-i3c-hci-Fix-out-of-bounds-access-in-hci_dma.patch
  (git-fixes CVE-2023-52766).
- Update
  patches.suse/i915-perf-Fix-NULL-deref-bugs-with-drm_dbg-calls.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52788
  bsc#1225106).
- Update
  patches.suse/igb-Fix-string-truncation-warnings-in-igb_set_fw_ver.patch
  (git-fixes CVE-2024-36010 bsc#1225594).
- Update
  patches.suse/iommu-vt-d-Fix-WARN_ON-in-iommu-probe-path.patch
  (git-fixes CVE-2024-35957 bsc#1224673).
- Update
  patches.suse/iommufd-Fix-missing-update-of-domains_itree-after-splitting-iopt
  (jsc#PED-7779 jsc#PED-7780 CVE-2023-52801 bsc#1225006).
- Update
  patches.suse/ipvlan-add-ipvlan_route_v6_outbound-helper.patch
  (git-fixes CVE-2023-52796 bsc#1224930).
- Update
  patches.suse/jffs2-prevent-xattr-node-from-overflowing-the-eraseblock.patch
  (git-fixes CVE-2024-38599 bsc#1226848).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-dbFindLeaf.patch
  (git-fixes CVE-2023-52799 bsc#1225472).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-diAlloc.patch
  (git-fixes CVE-2023-52805 bsc#1225553).
- Update
  patches.suse/kunit-fortify-Fix-mismatched-kvalloc-vfree-usage.patch
  (git-fixes CVE-2024-38617 bsc#1226859).
- Update
  patches.suse/lib-generic-radix-tree.c-Don-t-overflow-in-peek.patch
  (git-fixes CVE-2021-47432 bsc#1225391).
- Update
  patches.suse/lib-test_hmm.c-handle-src_pfns-and-dst_pfns-allocati.patch
  (git-fixes CVE-2024-38543 bsc#1226594).
- Update
  patches.suse/locking-ww_mutex-test-Fix-potential-workqueue-corrup.patch
  (bsc#1219953 CVE-2023-52836 bsc#1225609).
- Update
  patches.suse/md-Don-t-ignore-suspended-array-in-md_check_recovery-1baa.patch
  (bsc#1219596 CVE-2024-26758).
- Update
  patches.suse/media-atomisp-ssh_css-Fix-a-null-pointer-dereference.patch
  (git-fixes CVE-2024-38547 bsc#1226632).
- Update
  patches.suse/media-bttv-fix-use-after-free-error-due-to-btv-timeo.patch
  (git-fixes CVE-2023-52847 bsc#1225588).
- Update
  patches.suse/media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch
  (git-fixes CVE-2023-52764 bsc#1225571).
- Update
  patches.suse/media-hantro-Check-whether-reset-op-is-defined-befor.patch
  (git-fixes CVE-2023-52850 bsc#1225014).
- Update
  patches.suse/media-i2c-et8ek8-Don-t-strip-remove-function-when-dr.patch
  (git-fixes CVE-2024-38611 bsc#1226760).
- Update
  patches.suse/media-imon-fix-access-to-invalid-resource-for-the-se.patch
  (git-fixes CVE-2023-52754 bsc#1225490).
- Update
  patches.suse/media-lgdt3306a-Add-a-check-against-null-pointer-def.patch
  (stable-fixes CVE-2022-48772 bsc#1226976).
- Update
  patches.suse/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch
  (git-fixes CVE-2024-38621 bsc#1226895).
- Update
  patches.suse/media-vidtv-mux-Add-check-and-kfree-for-kstrdup.patch
  (git-fixes CVE-2023-52841 bsc#1225592).
- Update patches.suse/media-vidtv-psi-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52844 bsc#1225590).
- Update
  patches.suse/mfd-qcom-spmi-pmic-Fix-revid-implementation.patch
  (git-fixes CVE-2023-52765 bsc#1225029).
- Update
  patches.suse/misc-microchip-pci1xxxx-fix-double-free-in-the-error.patch
  (git-fixes CVE-2024-36973 bsc#1226457).
- Update
  patches.suse/net-hns3-fix-out-of-bounds-access-may-occur-when-coa.patch
  (git-fixes CVE-2023-52807 bsc#1225097).
- Update
  patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch
  (git-fixes CVE-2024-36962 bsc#1225827).
- Update
  patches.suse/net-mlx5-Fix-peer-devlink-set-for-SF-representor-dev.patch
  (git-fixes CVE-2024-38595 bsc#1226741).
- Update
  patches.suse/net-mlx5e-Track-xmit-submission-to-PTP-WQ-after-popu.patch
  (jsc#PED-3311 CVE-2023-52782 bsc#1225103).
- Update
  patches.suse/net-mvneta-fix-calls-to-page_pool_get_stats.patch
  (git-fixes CVE-2023-52780 bsc#1224933).
- Update
  patches.suse/net-wangxun-fix-kernel-panic-due-to-null-pointer.patch
  (git-fixes CVE-2023-52783 bsc#1225104).
- Update
  patches.suse/netfilter-complete-validation-of-user-input.patch
  (git-fixes CVE-2024-35896 bsc#1224662 CVE-2024-35962
  bsc#1224583).
- Update
  patches.suse/nfc-nci-Fix-uninit-value-in-nci_rx_work.patch
  (git-fixes CVE-2024-38381 bsc#1226878).
- Update
  patches.suse/nilfs2-fix-nilfs_empty_dir-misjudgment-and-long-loop.patch
  (git-fixes CVE-2024-39469 bsc#1226992).
- Update
  patches.suse/nilfs2-fix-potential-hang-in-nilfs_detach_log_writer.patch
  (git-fixes CVE-2024-38582 bsc#1226658).
- Update
  patches.suse/nilfs2-fix-use-after-free-of-timer-for-log-writer-th.patch
  (git-fixes CVE-2024-38583 bsc#1226777).
- Update
  patches.suse/of-module-add-buffer-overflow-check-in-of_modalias.patch
  (git-fixes CVE-2024-38541 bsc#1226587).
- Update
  patches.suse/padata-Fix-refcnt-handling-in-padata_free_shell.patch
  (git-fixes CVE-2023-52854 bsc#1225584).
- Update
  patches.suse/perf-core-Bail-out-early-if-the-request-AUX-area-is-out-of-bound.patch
  (git-fixes CVE-2023-52835 bsc#1225602).
- Update
  patches.suse/platform-x86-wmi-Fix-opening-of-char-device.patch
  (git-fixes CVE-2023-52864 bsc#1225132).
- Update
  patches.suse/powerpc-pseries-iommu-LPAR-panics-during-boot-up-wit.patch
  (bsc#1222011 ltc#205900 CVE-2024-36926 bsc#1225829).
- Update patches.suse/pstore-platform-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52869 bsc#1225050).
- Update
  patches.suse/remoteproc-mediatek-Make-sure-IPI-buffer-fits-in-L2T.patch
  (git-fixes CVE-2024-36965 bsc#1226149).
- Update
  patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch
  (git-fixes CVE-2024-38601 bsc#1226876).
- Update
  patches.suse/s390-dasd-protect-device-queue-against-concurrent-access.patch
  (git-fixes bsc#1217481 CVE-2023-52774 bsc#1225572).
- Update
  patches.suse/scsi-hisi_sas-Set-debugfs_dir-pointer-to-NULL-after-removing-debugfs.patch
  (git-fixes CVE-2023-52808 bsc#1225555).
- Update
  patches.suse/scsi-ibmvfc-Remove-BUG_ON-in-the-case-of-an-empty-ev.patch
  (bsc#1209834 ltc#202097 CVE-2023-52811 bsc#1225559).
- Update
  patches.suse/scsi-libfc-Fix-potential-NULL-pointer-dereference-in-fc_lport_ptp_setup.patch
  (git-fixes CVE-2023-52809 bsc#1225556).
- Update
  patches.suse/scsi-lpfc-Move-NPIV-s-transport-unregistration-to-af.patch
  (bsc#1221777 CVE-2024-36952 bsc#1225898).
- Update
  patches.suse/scsi-lpfc-Release-hbalock-before-calling-lpfc_worker.patch
  (bsc#1221777 CVE-2024-36924 bsc#1225820).
- Update
  patches.suse/serial-max3100-Lock-port-lock-when-calling-uart_hand.patch
  (git-fixes CVE-2024-38634 bsc#1226868).
- Update
  patches.suse/serial-max3100-Update-uart_driver_registered-on-driv.patch
  (git-fixes CVE-2024-38633 bsc#1226867).
- Update
  patches.suse/soc-qcom-llcc-Handle-a-second-device-without-data-co.patch
  (git-fixes CVE-2023-52871 bsc#1225534).
- Update
  patches.suse/soundwire-cadence-fix-invalid-PDI-offset.patch
  (stable-fixes CVE-2024-38635 bsc#1226863).
- Update patches.suse/speakup-Fix-sizeof-vs-ARRAY_SIZE-bug.patch
  (git-fixes CVE-2024-38587 bsc#1226780).
- Update patches.suse/spi-Fix-null-dereference-on-suspend.patch
  (git-fixes CVE-2023-52749 bsc#1225476).
- Update
  patches.suse/thermal-core-prevent-potential-string-overflow.patch
  (git-fixes CVE-2023-52868 bsc#1225044).
- Update
  patches.suse/thermal-drivers-qcom-lmh-Check-for-SCM-availability-.patch
  (git-fixes CVE-2024-39466 bsc#1227089).
- Update
  patches.suse/thermal-drivers-tsens-Fix-null-pointer-dereference.patch
  (git-fixes CVE-2024-38571 bsc#1226737).
- Update
  patches.suse/thermal-intel-powerclamp-fix-mismatch-in-get-functio.patch
  (git-fixes CVE-2023-52794 bsc#1225028).
- Update
  patches.suse/tls-fix-NULL-deref-on-tls_sw_splice_eof-with-empty-r.patch
  (jsc#PED-6831 CVE-2023-52767 bsc#1224998).
- Update
  patches.suse/tpm_tis_spi-Account-for-SPI-header-when-allocating-T.patch
  (git-fixes CVE-2024-36477 bsc#1226840).
- Update
  patches.suse/tracing-Have-trace_event_file-have-ref-counters.patch
  (git-fixes CVE-2023-52879 bsc#1225101).
- Update
  patches.suse/tracing-trigger-Fix-to-return-error-if-failed-to-alloc-snapshot.patch
  (git-fixes CVE-2024-26920).
- Update
  patches.suse/tty-n_gsm-fix-race-condition-in-status-line-change-o.patch
  (git-fixes CVE-2023-52872 bsc#1225591).
- Update
  patches.suse/tty-n_gsm-require-CAP_NET_ADMIN-to-attach-N_GSM0710-.patch
  (bsc#1222619 CVE-2023-52880).
- Update
  patches.suse/tty-vcc-Add-check-for-kstrdup-in-vcc_probe.patch
  (git-fixes CVE-2023-52789 bsc#1225180).
- Update
  patches.suse/usb-config-fix-iteration-issue-in-usb_get_bos_descri.patch
  (git-fixes CVE-2023-52781 bsc#1225092).
- Update
  patches.suse/usb-dwc3-Wait-unconditionally-after-issuing-EndXfer-.patch
  (git-fixes CVE-2024-36977 bsc#1226513).
- Update
  patches.suse/usb-gadget-u_audio-Fix-race-condition-use-of-control.patch
  (git-fixes CVE-2024-38628 bsc#1226911).
- Update
  patches.suse/usb-storage-alauda-Check-whether-the-media-is-initia.patch
  (git-fixes CVE-2024-38619 bsc#1226861).
- Update
  patches.suse/usb-typec-tcpm-Fix-NULL-pointer-dereference-in-tcpm_.patch
  (git-fixes CVE-2023-52877 bsc#1224944).
- Update
  patches.suse/vhost-vdpa-fix-use-after-free-in-vhost_vdpa_probe.patch
  (jsc#PED-3311 CVE-2023-52795 bsc#1225085).
- Update
  patches.suse/virtio-blk-fix-implicit-overflow-on-virtio_max_dma_s.patch
  (git-fixes CVE-2023-52762 bsc#1225573).
- Update
  patches.suse/virtio-vsock-Fix-uninit-value-in-virtio_transport_re.patch
  (jsc#PED-5505 CVE-2023-52842 bsc#1225025).
- Update
  patches.suse/watchdog-cpu5wdt.c-Fix-use-after-free-bug-caused-by-.patch
  (git-fixes CVE-2024-38630 bsc#1226908).
- Update
  patches.suse/wifi-ar5523-enable-proper-endpoint-verification.patch
  (git-fixes CVE-2024-38565 bsc#1226747).
- Update
  patches.suse/wifi-ath11k-fix-dfs-radar-event-locking.patch
  (git-fixes CVE-2023-52798 bsc#1224947).
- Update
  patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch
  (git-fixes CVE-2023-52777 bsc#1224992).
- Update patches.suse/wifi-ath11k-fix-htt-pktlog-locking.patch
  (git-fixes CVE-2023-52800).
- Update
  patches.suse/wifi-ath12k-fix-dfs-radar-and-temperature-event-lock.patch
  (git-fixes CVE-2023-52776 bsc#1225090).
- Update
  patches.suse/wifi-ath12k-fix-htt-mlo-offset-event-locking.patch
  (git-fixes CVE-2023-52769 bsc#1225001).
- Update
  patches.suse/wifi-ath12k-fix-out-of-bound-access-of-qmi_invoke_ha.patch
  (git-fixes CVE-2024-38572 bsc#1226776).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-read-in-ath12k.patch
  (git-fixes CVE-2023-52827 bsc#1225078).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-write-in-ath12.patch
  (git-fixes CVE-2023-52829 bsc#1225081).
- Update
  patches.suse/wifi-brcmfmac-pcie-handle-randbuf-allocation-failure.patch
  (git-fixes CVE-2024-38575 bsc#1226612).
- Update
  patches.suse/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch
  (git-fixes CVE-2024-38567 bsc#1226769).
- Update
  patches.suse/wifi-carl9170-re-fix-fortified-memset-warning.patch
  (git-fixes CVE-2024-38616 bsc#1226852).
- Update
  patches.suse/wifi-mac80211-don-t-return-unset-power-in-ieee80211_.patch
  (git-fixes CVE-2023-52832 bsc#1225577).
- Update
  patches.suse/wifi-nl80211-Avoid-address-calculations-via-out-of-b.patch
  (git-fixes CVE-2024-38562 bsc#1226788).
- Update
  patches.suse/wifi-wilc1000-use-vmm_table-as-array-in-wilc-struct.patch
  (git-fixes CVE-2023-52768 bsc#1225004).
- Update
  patches.suse/x86-tdx-Zero-out-the-missing-RSI-in-TDX_HYPERCALL-macro.patch
  (jsc#PED-5824 CVE-2023-52874 bsc#1225049).
- commit 33efdc4</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835204">- tcp: Use refcount_inc_not_zero() in tcp_twsk_unique()
  (CVE-2024-36904 bsc#1225732).
- commit d578dcc</changelog>
  <changelog author="heming.zhao@suse.com" date="1719921600">- gfs2: Fix potential glock use-after-free on unmount (bsc#1226775
  CVE-2024-38570).
- gfs2: Rename sd_{ glock =&gt; kill }_wait (bsc#1226775
  CVE-2024-38570).
- commit f3adbca</changelog>
  <changelog author="tiwai@suse.de" date="1719921601">- Correct SCSI patch references (bsc#1225767 CVE-2024-36919 bsc#1226785 CVE-2024-38559)
- commit e8ea587</changelog>
  <changelog author="tiwai@suse.de" date="1719921602">- mtd: rawnand: rockchip: ensure NVDDR timings are rejected
  (git-fixes).
- mtd: rawnand: Bypass a couple of sanity checks during NAND
  identification (git-fixes).
- mtd: rawnand: Fix the nand_read_data_op() early check
  (git-fixes).
- mtd: rawnand: Ensure ECC configuration is propagated to upper
  layers (git-fixes).
- commit e545951</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1719921603">- kernel-doc: fix struct_group_tagged() parsing (git-fixes).
- commit e3a2a2e</changelog>
  <changelog author="fdmanana@suse.com" date="1719921604">- btrfs: fix crash on racing fsync and size-extending write into
  prealloc (bsc#1227101 CVE-2024-37354).
- commit 1d355af</changelog>
  <changelog author="vbabka@suse.cz" date="1719921605">- virt: acrn: stop using follow_pfn (CVE-2024-38610 bsc#1226758).
- commit c2ea51b</changelog>
  <changelog author="vbabka@suse.cz" date="1719921606">- drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
  (CVE-2024-38610 bsc#1226758).
- commit 7069ac2</changelog>
  <changelog author="rhopkins@suse.de" date="1719921607">- hsr: Prevent use after free in prp_create_tagged_frame()
  (CVE-2023-52846 bsc#1225098).
- commit cf63988</changelog>
  <changelog author="krisman@suse.de" date="1719921608">- io_uring: Fix io_cqring_wait() not restoring sigmask on
  get_timespec64() failure (git-fixes).
- commit e640a65</changelog>
  <changelog author="krisman@suse.de" date="1719921609">- io_uring: check for non-NULL file pointer in io_file_can_poll()
  (bsc#1226990 CVE-2024-39371).
- io_uring/io-wq: Use set_bit() and test_bit() at worker-&gt;flags
  (git-fixes).
- io_uring/sqpoll: work around a potential audit memory leak
  (git-fixes).
- commit 24603fc</changelog>
  <changelog author="krisman@suse.de" date="1719921610">- io_uring/rsrc: fix incorrect assignment of iter-&gt;nr_segs in
  io_import_fixed (git-fixes).
- io_uring/rsrc: don't lock while !TASK_RUNNING (git-fixes).
- io_uring/io-wq: avoid garbage value of 'match' in
  io_wq_enqueue() (git-fixes).
- commit 7d3e252</changelog>
</package>
<package pkgid="a1e4701db25a575da677a5e0131f59e25bc375ce82026696371db34ced534718" name="dtb-aarch64" arch="src">
  <version epoch="0" ver="6.4.0" rel="150600.23.17.1"/>
  <changelog author="tiwai@suse.de" date="1722081600">- auxdisplay: ht16k33: Drop reference after LED registration
  (git-fixes).
- ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
  on unprepare (git-fixes).
- ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
- ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
  reachable (git-fixes).
- ASoC: sof: amd: fix for firmware reload failure in Vangogh
  platform (git-fixes).
- ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
- ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
  (git-fixes).
- ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
- ALSA: ump: Don't update FB name for static blocks (git-fixes).
- drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
- drm/i915/gt: Do not consider preemption during execlists_dequeue
  for gen8 (git-fixes).
- drm/i915/dp: Don't switch the LTTPR mode on an active link
  (git-fixes).
- commit d7e2deb</changelog>
  <changelog author="tiwai@suse.de" date="1722081601">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
</package>
<package pkgid="5d7121984a41875501aed2ad728e62fc3fb7c0097d695e89195559360f8d242c" name="dtb-aarch64" arch="src">
  <version epoch="0" ver="6.4.0" rel="150600.23.7.1"/>
  <changelog author="mkubecek@suse.cz" date="1717416000">- netfilter: nf_tables: release mutex after nft_gc_seq_end from
  abort path (CVE-2024-26925 bsc#1223390).
- commit 578a709</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717416001">- Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
  The L3 bsc#1225765 was created seperately since our customer requires
  PTF.
- Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
- Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
- Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
- Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
- commit 054635e</changelog>
  <changelog author="msuchanek@suse.de" date="1717416002">- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
- powerpc/uaccess: Fix build errors seen with GCC 13/14
  (bsc#1194869).
- commit 46b5d84</changelog>
  <changelog author="msuchanek@suse.de" date="1717416003">- blacklist.conf: PPC fsl_msi is not used
- commit ae6590d</changelog>
  <changelog author="msuchanek@suse.de" date="1717416004">- powerpc/pseries/lparcfg: drop error message from guest name
  lookup (bsc#1187716 ltc#193451 git-fixes).
- commit ceab637</changelog>
  <changelog author="mfranc@suse.cz" date="1717416005">- Update
  patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
  (git-fixes CVE-2024-36955).
- Update
  patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
  (git-fixes bsc#1225715 CVE-2024-36906).
- Update
  patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
  (git-fixes bsc#1225579 CVE-2024-36011).
- Update
  patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
  (git-fixes bsc#1225578 CVE-2024-36013).
- Update
  patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
  (git-fixes bsc#1225502 CVE-2024-36012).
- Update
  patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
  (git-fixes bsc#1225722 CVE-2024-36880).
- Update
  patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
  (git-fixes CVE-2024-36942).
- Update
  patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
  (git-fixes bsc#1225720 CVE-2024-36032).
- Update
  patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
  (git-fixes bsc#1223749 CVE-2024-26990).
- Update
  patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
  (git-fixes bsc#1223692 CVE-2024-26992).
- Update
  patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
  (stable-fixes CVE-2024-36944).
- Update
  patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
  (git-fixes bsc#1225734 CVE-2024-36896).
- Update
  patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
  (stable-fixes CVE-2024-36949).
- Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
  (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
- Update
  patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
  (git-fixes bsc#1225692 CVE-2023-52882).
- Update
  patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
  (git-fixes CVE-2024-26761).
- Update
  patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
  (stable-fixes bsc#1225735 CVE-2024-36897).
- Update
  patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
  (stable-fixes bsc#1225705 CVE-2024-36026).
- Update
  patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
  (stable-fixes CVE-2024-36951).
- Update
  patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
  (git-fixes bsc#1225593 CVE-2024-36014).
- Update
  patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
  (stable-fixes bsc#1225728 CVE-2024-36885).
- Update
  patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
  (git-fixes bsc#1225773 CVE-2024-36936).
- Update
  patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
  (stable-fixes CVE-2024-36950).
- Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
  (git-fixes bsc#1225736 CVE-2024-36898).
- Update
  patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
  (git-fixes bsc#1225698 CVE-2024-36020).
- Update
  patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
  (git-fixes bsc#1225710 CVE-2024-36891).
- Update
  patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
  (git-fixes bsc#1225714 CVE-2024-36890).
- Update
  patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
  (git-fixes bsc#1225708 CVE-2024-36029).
- Update
  patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
  (git-fixes bsc#1225699 CVE-2024-36021).
- Update
  patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
  (git-fixes CVE-2024-26943).
- Update
  patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
  (git-fixes bsc#1225694 CVE-2024-36018).
- Update
  patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
  (git-fixes CVE-2024-36940).
- Update
  patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
  (git-fixes CVE-2024-36959).
- Update
  patches.suse/ppdev-Add-an-error-check-in-register_device.patch
  (git-fixes bsc#1225640 CVE-2024-36015).
- Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
  CVE-2024-36947).
- Update
  patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
  (git-fixes bsc#1225695 CVE-2024-36019).
- Update
  patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
  (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
- Update
  patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
  (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
- Update
  patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
  (git-fixes bsc#1225704 CVE-2024-36025).
- Update
  patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
  (git-fixes CVE-2024-36930).
- Update
  patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
  (bsc#1224331 bsc#1224602 CVE-2024-35814).
- Update
  patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
  (git-fixes bsc#1225642 CVE-2024-36016).
- Update
  patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
  (git-fixes bsc#1225749 CVE-2024-36894).
- Update
  patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
  (git-fixes bsc#1225750 CVE-2024-36895).
- Update
  patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
  (git-fixes bsc#1225748 CVE-2024-36893).
- Update
  patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
  (stable-fixes bsc#1225769 CVE-2024-36921).
- Update
  patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
  (stable-fixes CVE-2024-36922).
- Update
  patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
  (git-fixes CVE-2024-36941).
- Update
  patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
  (git-fixes bsc#1224742 CVE-2024-35803).
- commit 539780f</changelog>
  <changelog author="dwagner@suse.de" date="1717416006">- nvmet: fix ns enable/disable possible hang (git-fixes).
- nvme-multipath: fix io accounting on failover (git-fixes).
- nvme: fix multipath batched completion accounting (git-fixes).
- commit ed3b392</changelog>
  <changelog author="dwagner@suse.de" date="1717416007">- scsi: lpfc: Copyright updates for 14.4.0.2 patches
  (bsc#1225842).
- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
  (bsc#1225842).
  Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
  (bsc#1225842).
- scsi: lpfc: Clear deferred RSCN processing flag when driver
  is unloading (bsc#1225842).
- scsi: lpfc: Update logging of protection type for T10 DIF I/O
  (bsc#1225842).
- scsi: lpfc: Change default logging level for unsolicited CT
  MIB commands (bsc#1225842).
- commit 5a56384</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416008">- smb: client: fix mount when dns_resolver key is not available
  (git-fixes, bsc#1225172).
- commit 28edb5c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416009">- cifs: fix leak of iface for primary channel (git-fixes,
  bsc#1225172).
- commit b7eb8e8</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416010">- Revert "cifs: reconnect work should have reference on server
  struct" (git-fixes, bsc#1225172).
- commit 3ca4c0c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416011">- smb: client: fix parsing of SMB3.1.1 POSIX create context
  (git-fixes, bsc#1225172).
- commit 5f27f69</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416012">- cifs: failure to add channel on iface should bump up weight
  (git-fixes, bsc#1225172).
- commit 007b237</changelog>
  <changelog author="tonyj@suse.de" date="1717416013">- perf/x86: Fix out of range data (git-fixes).
- perf/x86/intel/ds: Don't clear -&gt;pebs_data_cfg for the last
  PEBS event (git-fixes).
- perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
- commit 664d77f</changelog>
  <changelog author="dsterba@suse.com" date="1717588800">- blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
- Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
  Quoting bsc#1225945#c11:
  "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
  transaction for every subvol create")
  ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
  unwritten extent buffer after snapshotting a new subvolume") was never
  backported."
- commit d947258</changelog>
  <changelog author="tonyj@suse.de" date="1717588801">- perf pmu: Count sys and cpuid JSON events separately (git
  fixes).
- perf stat: Don't display metric header for non-leader uncore
  events (git-fixes).
- perf daemon: Fix file leak in daemon_session__control
  (git-fixes).
- perf symbols: Fix ownership of string in dso__load_vmlinux()
  (git-fixes).
- perf thread: Fixes to thread__new() related to initializing comm
  (git-fixes).
- perf report: Avoid SEGV in report__setup_sample_type()
  (git-fixes).
- perf ui browser: Don't save pointer to stack memory (git-fixes).
- perf bench internals inject-build-id: Fix trap divide when
  collecting just one DSO (git-fixes).
- perf intel-pt: Fix unassigned instruction op (discovered by
  MemorySanitizer) (git-fixes).
- perf test shell arm_coresight: Increase buffer size for
  Coresight basic tests (git-fixes).
- perf docs: Document bpf event modifier (git-fixes).
- perf bench uprobe: Remove lib64 from libc.so.6 binary path
  (git-fixes).
- perf record: Fix debug message placement for test consumption
  (git-fixes).
- perf tests: Apply attributes to all events in object code
  reading test (git-fixes).
- perf tests: Make "test data symbol" more robust on Neoverse N1
  (git-fixes).
- perf annotate: Fix annotation_calc_lines() to pass correct
  address to get_srcline() (git-fixes).
- perf stat: Do not fail on metrics on s390 z/VM systems
  (git-fixes).
- perf sched timehist: Fix -g/--call-graph option failure
  (git-fixes).
- perf annotate: Get rid of duplicate --group option item
  (git-fixes).
- perf probe: Add missing libgen.h header needed for using
  basename() (git-fixes).
- perf record: Delete session after stopping sideband thread
  (git-fixes).
- perf auxtrace: Fix multiple use of --itrace option (git-fixes).
- perf script: Show also errors for --insn-trace option
  (git-fixes).
- perf lock contention: Add a missing NULL check (git-fixes).
- perf vendor events amd: Fix Zen 4 cache latency events
  (git-fixes).
- libperf evlist: Avoid out-of-bounds access (git-fixes).
- perf pmu: Fix a potential memory leak in perf_pmu__lookup()
  (git-fixes).
- perf print-events: make is_event_supported() more robust
  (git-fixes).
- perf list: fix short description for some cache events
  (git-fixes).
- perf metric: Don't remove scale from counts (git-fixes).
- perf stat: Avoid metric-only segv (git-fixes).
- perf expr: Fix "has_event" function for metric style events
  (git-fixes).
- perf srcline: Add missed addr2line closes (git-fixes).
- perf thread_map: Free strlist on normal path in
  thread_map__new_by_tid_str() (git-fixes).
- perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
- perf jevents: Drop or simplify small integer values (git-fixes).
- perf evsel: Fix duplicate initialization of data-&gt;id in
  evsel__parse_sample() (git-fixes).
- perf pmu: Treat the msr pmu as software (git-fixes).
- perf record: Check conflict between '--timestamp-filename'
  option and pipe mode before recording (git-fixes).
- perf record: Fix possible incorrect free in
  record__switch_output() (git-fixes).
- perf vendor events amd: Add Zen 4 memory controller events
  (git-fixes).
- perf top: Uniform the event name for the hybrid machine
  (git-fixes).
- perf top: Use evsel's cpus to replace user_requested_cpus
  (git-fixes).
- commit a1f9340</changelog>
  <changelog author="tonyj@suse.de" date="1717675200">- perf ui browser: Avoid SEGV on title (git fixes).
- commit 1578c22</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675201">- inet: inet_defrag: prevent sk release while still in use
  (CVE-2024-26921 bsc#1223138).
- commit 2016faf</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675202">- net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
- commit 7bf5961</changelog>
  <changelog author="tiwai@suse.de" date="1718366400">- Temporarily drop KVM patch that caused a regression (bsc#1226158)
  Delete patches.suse/KVM-x86-pmu-Prioritize-VMX-interception-over-GP-on-R.patch
- commit 33f31da</changelog>
</package>
<package pkgid="58bbb7d2a1866efbc88f47001520ac5d0da505c57560665343cab76a3dbd4142" name="dtb-allwinner" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.14.1"/>
  <changelog author="tiwai@suse.de" date="1719662400">- gpiolib: cdev: Disallow reconfiguration without direction
  (uAPI v1) (git-fixes).
- gpio: davinci: Validate the obtained number of IRQs (git-fixes).
- commit 919ebd1</changelog>
  <changelog author="tiwai@suse.de" date="1719748800">- i2c: testunit: discard write requests while old command is
  running (git-fixes).
- i2c: testunit: don't erase registers after STOP (git-fixes).
- mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
  (git-fixes).
- mmc: sdhci: Do not invert write-protect twice (git-fixes).
- mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
  (git-fixes).
- mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
  (git-fixes).
- commit 448487d</changelog>
  <changelog author="tiwai@suse.de" date="1719748801">- crypto: iaa - Account for cpu-less numa nodes (bsc#1227190).
- commit cd600aa</changelog>
  <changelog author="tiwai@suse.de" date="1719748802">- crypto: deflate - Add aliases to deflate (bsc#1227190).
- commit 27ffd92</changelog>
  <changelog author="tiwai@suse.de" date="1719835200">- ata: ahci: Clean up sysfs file on error (git-fixes).
- ata: libata-core: Fix double free on error (git-fixes).
- ata,scsi: libata-core: Do not leak memory for ata_port struct
  members (git-fixes).
- ata: libata-core: Fix null pointer dereference on error
  (git-fixes).
- kbuild: Fix build target deb-pkg: ln: failed to create hard link
  (git-fixes).
- kbuild: doc: Update default INSTALL_MOD_DIR from extra to
  updates (git-fixes).
- kbuild: Install dtb files as 0644 in Makefile.dtbinst
  (git-fixes).
- counter: ti-eqep: enable clock at probe (git-fixes).
- iio: chemical: bme680: Fix sensor data read operation
  (git-fixes).
- iio: chemical: bme680: Fix overflows in compensate() functions
  (git-fixes).
- iio: chemical: bme680: Fix calibration data variable
  (git-fixes).
- iio: chemical: bme680: Fix pressure value output (git-fixes).
- iio: accel: fxls8962af: select IIO_BUFFER &amp; IIO_KFIFO_BUF
  (git-fixes).
- iio: adc: ad7266: Fix variable checking bug (git-fixes).
- iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
  (git-fixes).
- serial: bcm63xx-uart: fix tx after conversion to
  uart_port_tx_limited() (git-fixes).
- serial: core: introduce uart_port_tx_limited_flags()
  (git-fixes).
- Revert "serial: core: only stop transmit when HW fifo is empty"
  (git-fixes).
- tty: mcf: MCF54418 has 10 UARTS (git-fixes).
- usb: gadget: aspeed_udc: fix device address configuration
  (git-fixes).
- usb: dwc3: core: remove lock of otg mode during gadget
  suspend/resume to avoid deadlock (git-fixes).
- usb: typec: ucsi: glink: fix child node release in probe
  function (git-fixes).
- usb: musb: da8xx: fix a resource leak in probe() (git-fixes).
- usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  (git-fixes).
- usb: gadget: printer: fix races against disable (git-fixes).
- PCI/MSI: Fix UAF in msi_capability_init (git-fixes).
- commit a2ea5a9</changelog>
  <changelog author="ptesarik@suse.com" date="1719835201">- net: ena: Fix redundant device NUMA node override
  (jsc#PED-8688).
- commit 6ad6684</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835202">- tcp: do not accept ACK of bytes we never sent (CVE-2023-52881
  bsc#1225611).
- commit 16404a6</changelog>
  <changelog author="mhocko@suse.com" date="1719835203">- Update
  patches.suse/1352-drm-amdgpu-Fix-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52883
  bsc#1226630).
- Update
  patches.suse/9p-add-missing-locking-around-taking-dentry-fid-list.patch
  (git-fixes CVE-2024-39463 bsc#1227090).
- Update
  patches.suse/ALSA-Fix-deadlocks-with-kctl-removals-at-disconnecti.patch
  (stable-fixes CVE-2024-38600 bsc#1226864).
- Update
  patches.suse/ALSA-core-Fix-NULL-module-pointer-assignment-at-card.patch
  (git-fixes CVE-2024-38605 bsc#1226740).
- Update
  patches.suse/ALSA-hda-Fix-possible-null-ptr-deref-when-assigning-.patch
  (git-fixes CVE-2023-52806 bsc#1225554).
- Update
  patches.suse/ALSA-hda-cs_dsp_ctl-Use-private_free-for-control-cle.patch
  (git-fixes CVE-2024-38388 bsc#1226890).
- Update
  patches.suse/ALSA-timer-Set-lower-bound-of-start-tick-time.patch
  (stable-fixes git-fixes CVE-2024-38618 bsc#1226754).
- Update
  patches.suse/ASoC-kirkwood-Fix-potential-NULL-dereference.patch
  (git-fixes CVE-2024-38550 bsc#1226633).
- Update
  patches.suse/ASoC-mediatek-Assign-dummy-when-codec-not-specified-.patch
  (git-fixes CVE-2024-38551 bsc#1226761).
- Update
  patches.suse/Bluetooth-btusb-Add-date-evt_skb-is-NULL-check.patch
  (git-fixes CVE-2023-52833 bsc#1225595).
- Update
  patches.suse/Bluetooth-hci_core-Fix-possible-buffer-overflow.patch
  (git-fixes CVE-2024-26889).
- Update
  patches.suse/HID-uclogic-Fix-user-memory-access-bug-in-uclogic_pa.patch
  (git-fixes CVE-2023-52866 bsc#1225120).
- Update
  patches.suse/IB-mlx5-Fix-init-stage-error-handling-to-avoid-doubl.patch
  (jsc#PED-6864 CVE-2023-52851 bsc#1225587).
- Update
  patches.suse/Input-cyapa-add-missing-input-core-locking-to-suspen.patch
  (git-fixes CVE-2023-52884 bsc#1226764).
- Update
  patches.suse/Input-synaptics-rmi4-fix-use-after-free-in-rmi_unreg.patch
  (git-fixes CVE-2023-52840 bsc#1224928).
- Update
  patches.suse/KEYS-trusted-Do-not-use-WARN-when-encode-fails.patch
  (git-fixes CVE-2024-36975 bsc#1226520).
- Update
  patches.suse/KEYS-trusted-Fix-memory-leak-in-tpm2_key_encode.patch
  (git-fixes CVE-2024-36967 bsc#1226131).
- Update
  patches.suse/RDMA-cma-Fix-kmemleak-in-rdma_core-observed-during-b.patch
  (git-fixes CVE-2024-38539 bsc#1226608).
- Update patches.suse/RDMA-hns-Fix-UAF-for-cq-async-event.patch
  (git-fixes CVE-2024-38545 bsc#1226595).
- Update
  patches.suse/RDMA-hns-Fix-deadlock-on-SRQ-async-events.patch
  (git-fixes CVE-2024-38591 bsc#1226738).
- Update
  patches.suse/RDMA-hns-Modify-the-print-level-of-CQE-error.patch
  (git-fixes CVE-2024-38590 bsc#1226839).
- Update
  patches.suse/RDMA-rxe-Fix-seg-fault-in-rxe_comp_queue_pkt.patch
  (git-fixes CVE-2024-38544 bsc#1226597).
- Update
  patches.suse/SUNRPC-Fix-RPC-client-cleaned-up-the-freed-pipefs-de.patch
  (git-fixes CVE-2023-52803 bsc#1225008).
- Update patches.suse/af_unix-Clear-stale-u-oob_skb.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-35970 bsc#1224584).
- Update
  patches.suse/af_unix-Drop-oob_skb-ref-before-purging-queue-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26750 bsc#1222617).
- Update
  patches.suse/af_unix-Fix-task-hung-while-purging-oob_skb-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26780 bsc#1222588).
- Update
  patches.suse/af_unix-Update-unix_sk-sk-oob_skb-under-sk_receive_queue-lock.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-36972 bsc#1226163).
- Update
  patches.suse/arm64-Restrict-CPU_BIG_ENDIAN-to-GNU-as-or-LLVM-IAS-.patch
  (git-fixes CVE-2023-52750 bsc#1225485).
- Update
  patches.suse/atl1c-Work-around-the-DMA-RX-overflow-issue.patch
  (git-fixes CVE-2023-52834 bsc#1225599).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issue-of-net_device.patch
  (git-fixes CVE-2024-38554 bsc#1226742).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issues-of-ax25_dev.patch
  (git-fixes CVE-2024-38602 bsc#1226613).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-reorder-of-WRITE-lqueued.patch
  (bsc#1225605 CVE-2024-38384 bsc#1226938).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-resetting-io-stat.patch
  (bsc#1225605 CVE-2024-38663 bsc#1226939).
- Update
  patches.suse/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch
  (git-fixes CVE-2024-38540 bsc#1226582).
- Update
  patches.suse/bonding-stop-the-device-in-bond_setup_by_slave.patch
  (git-fixes CVE-2023-52784 bsc#1224946).
- Update
  patches.suse/can-dev-can_put_echo_skb-don-t-crash-kernel-if-can_p.patch
  (git-fixes CVE-2023-52878 bsc#1225000).
- Update
  patches.suse/clk-mediatek-clk-mt2701-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52875 bsc#1225096).
- Update
  patches.suse/clk-mediatek-clk-mt6765-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52870 bsc#1224937).
- Update
  patches.suse/clk-mediatek-clk-mt6779-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52873 bsc#1225589).
- Update
  patches.suse/clk-mediatek-clk-mt6797-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52865 bsc#1225086).
- Update
  patches.suse/clk-mediatek-clk-mt7629-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52858 bsc#1225566).
- Update
  patches.suse/clk-mediatek-clk-mt7629-eth-Add-check-for-mtk_alloc_.patch
  (git-fixes CVE-2023-52876 bsc#1225036).
- Update
  patches.suse/cppc_cpufreq-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38573 bsc#1226739).
- Update patches.suse/cpufreq-exit-callback-is-optional.patch
  (git-fixes CVE-2024-38615 bsc#1226592).
- Update patches.suse/crypto-bcm-Fix-pointer-arithmetic.patch
  (git-fixes CVE-2024-38579 bsc#1226637).
- Update
  patches.suse/crypto-pcrypt-Fix-hungtask-for-PADATA_RESET.patch
  (git-fixes CVE-2023-52813 bsc#1225527).
- Update patches.suse/cxl-mem-Fix-shutdown-order.patch (git-fixes
  CVE-2023-52849 bsc#1224949).
- Update
  patches.suse/cxl-region-Do-not-try-to-cleanup-after-cxl_region_se.patch
  (git-fixes CVE-2023-52792 bsc#1225477).
- Update patches.suse/cxl-region-Fix-cxlr_pmem-leaks.patch
  (git-fixes CVE-2024-38391 bsc#1226894).
- Update
  patches.suse/dma-buf-sw-sync-don-t-enable-IRQ-from-sync_print_obj.patch
  (git-fixes CVE-2024-38780 bsc#1226886).
- Update
  patches.suse/dma-mapping-benchmark-fix-node-id-validation.patch
  (git-fixes CVE-2024-34777 bsc#1226796).
- Update
  patches.suse/dma-mapping-benchmark-handle-NUMA_NO_NODE-correctly.patch
  (git-fixes CVE-2024-39277 bsc#1226909).
- Update
  patches.suse/dmaengine-idxd-Avoid-unnecessary-destruction-of-file.patch
  (git-fixes CVE-2024-38629 bsc#1226905).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Pola.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52819
  bsc#1225532).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-SMU7.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52818
  bsc#1225530).
- Update
  patches.suse/drm-amd-check-num-of-link-levels-when-update-pcie-pa.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52812
  bsc#1225564).
- Update
  patches.suse/drm-amd-display-Avoid-NULL-dereference-of-timing-gen.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52753
  bsc#1225478).
- Update
  patches.suse/drm-amd-display-Fix-division-by-zero-in-setup_dsc_co.patch
  (stable-fixes CVE-2024-36969 bsc#1226155).
- Update
  patches.suse/drm-amd-display-Fix-null-pointer-dereference-in-erro.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52862
  bsc#1225015).
- Update
  patches.suse/drm-amd-display-Fix-potential-index-out-of-bounds-in.patch
  (git-fixes CVE-2024-38552 bsc#1226767).
- Update
  patches.suse/drm-amd-display-fix-a-NULL-pointer-dereference-in-am.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52773
  bsc#1225041).
- Update
  patches.suse/drm-amd-display-fixed-integer-types-and-null-check-l.patch
  (git-fixes CVE-2024-26767).
- Update
  patches.suse/drm-amdgpu-Fix-a-null-pointer-access-when-the-smc_rr.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52817
  bsc#1225569).
- Update
  patches.suse/drm-amdgpu-Fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch
  (git-fixes CVE-2024-39291 bsc#1226934).
- Update
  patches.suse/drm-amdgpu-Fix-potential-null-pointer-derefernce.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52814
  bsc#1225565).
- Update
  patches.suse/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch
  (stable-fixes CVE-2024-39471 bsc#1227096).
- Update
  patches.suse/drm-amdgpu-mes-fix-use-after-free-issue.patch
  (stable-fixes CVE-2024-38581 bsc#1226657).
- Update
  patches.suse/drm-amdgpu-vkms-fix-a-possible-null-pointer-derefere.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52815
  bsc#1225568).
- Update
  patches.suse/drm-amdkfd-Fix-a-race-condition-of-vram-buffer-unref.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52825
  bsc#1225076).
- Update
  patches.suse/drm-amdkfd-Fix-shift-out-of-bounds-issue.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52816
  bsc#1225529).
- Update
  patches.suse/drm-bridge-cdns-mhdp8546-Fix-possible-null-pointer-d.patch
  (git-fixes CVE-2024-38548).
- Update
  patches.suse/drm-bridge-it66121-Fix-invalid-connector-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52861
  bsc#1224941).
- Update
  patches.suse/drm-bridge-lt8912b-Fix-crash-on-bridge-detach.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52856
  bsc#1224932).
- Update
  patches.suse/drm-mediatek-Add-0-size-check-to-mtk_drm_gem_obj.patch
  (git-fixes CVE-2024-38549 bsc#1226735).
- Update
  patches.suse/drm-mediatek-Fix-coverity-issue-with-unintentional-i.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52857
  bsc#1225581).
- Update
  patches.suse/drm-mediatek-Init-ddp_comp-with-devm_kcalloc.patch
  (git-fixes CVE-2024-38592 bsc#1226844).
- Update
  patches.suse/drm-msm-a6xx-Avoid-a-nullptr-dereference-when-speedb.patch
  (git-fixes CVE-2024-38390 bsc#1226891).
- Update
  patches.suse/drm-msm-dpu-Add-callback-function-pointer-check-befo.patch
  (git-fixes CVE-2024-38622 bsc#1226856).
- Update
  patches.suse/drm-panel-fix-a-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52821
  bsc#1225022).
- Update
  patches.suse/drm-panel-panel-tpo-tpg110-fix-a-possible-null-point.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52826
  bsc#1225077).
- Update patches.suse/drm-radeon-possible-buffer-overflow.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52867
  bsc#1225009).
- Update
  patches.suse/drm-vc4-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38546 bsc#1226593).
- Update
  patches.suse/drm-vmwgfx-Fix-invalid-reads-in-fence-signaled-event.patch
  (git-fixes CVE-2024-36960 bsc#1225872).
- Update
  patches.suse/drm-zynqmp_dpsub-Always-register-bridge.patch
  (git-fixes CVE-2024-38664 bsc#1226941).
- Update
  patches.suse/e1000e-change-usleep_range-to-udelay-in-PHY-mdic-acc.patch
  (CVE-2024-39296 bsc#1226989 CVE-2024-36887 bsc#1225731).
- Update
  patches.suse/ecryptfs-Fix-buffer-size-for-tag-66-packet.patch
  (git-fixes CVE-2024-38578 bsc#1226634).
- Update
  patches.suse/efi-libstub-only-free-priv.runtime_map-when-allocate.patch
  (git-fixes CVE-2024-33619 bsc#1226768).
- Update
  patches.suse/fbdev-imsttfb-fix-a-resource-leak-in-probe.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52838
  bsc#1225031).
- Update
  patches.suse/fs-9p-only-translate-RWX-permissions-for-plain-9P200.patch
  (git-fixes CVE-2024-36964 bsc#1225866).
- Update
  patches.suse/fs-jfs-Add-check-for-negative-db_l2nbperpage.patch
  (git-fixes CVE-2023-52810 bsc#1225557).
- Update
  patches.suse/fs-jfs-Add-validity-check-for-db_maxag-and-db_agpref.patch
  (git-fixes CVE-2023-52804 bsc#1225550).
- Update
  patches.suse/ftrace-Fix-possible-use-after-free-issue-in-ftrace_location.patch
  (git-fixes CVE-2024-38588 bsc#1226837).
- Update
  patches.suse/genirq-irqdesc-Prevent-use-after-free-in-irq_find_at.patch
  (git-fixes CVE-2024-38385 bsc#1227085).
- Update patches.suse/gfs2-ignore-negated-quota-changes.patch
  (git-fixes CVE-2023-52759 bsc#1225560).
- Update
  patches.suse/hid-cp2112-Fix-duplicate-workqueue-initialization.patch
  (git-fixes CVE-2023-52853 bsc#1224988).
- Update
  patches.suse/hwmon-axi-fan-control-Fix-possible-NULL-pointer-dere.patch
  (git-fixes CVE-2023-52863 bsc#1225586).
- Update
  patches.suse/i2c-acpi-Unbind-mux-adapters-before-delete.patch
  (git-fixes CVE-2024-39362 bsc#1226995).
- Update
  patches.suse/i2c-core-Run-atomic-i2c-xfer-when-preemptible.patch
  (git-fixes CVE-2023-52791 bsc#1225108).
- Update
  patches.suse/i3c-master-mipi-i3c-hci-Fix-a-kernel-panic-for-acces.patch
  (git-fixes CVE-2023-52763 bsc#1225570).
- Update
  patches.suse/i3c-mipi-i3c-hci-Fix-out-of-bounds-access-in-hci_dma.patch
  (git-fixes CVE-2023-52766).
- Update
  patches.suse/i915-perf-Fix-NULL-deref-bugs-with-drm_dbg-calls.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52788
  bsc#1225106).
- Update
  patches.suse/igb-Fix-string-truncation-warnings-in-igb_set_fw_ver.patch
  (git-fixes CVE-2024-36010 bsc#1225594).
- Update
  patches.suse/iommu-vt-d-Fix-WARN_ON-in-iommu-probe-path.patch
  (git-fixes CVE-2024-35957 bsc#1224673).
- Update
  patches.suse/iommufd-Fix-missing-update-of-domains_itree-after-splitting-iopt
  (jsc#PED-7779 jsc#PED-7780 CVE-2023-52801 bsc#1225006).
- Update
  patches.suse/ipvlan-add-ipvlan_route_v6_outbound-helper.patch
  (git-fixes CVE-2023-52796 bsc#1224930).
- Update
  patches.suse/jffs2-prevent-xattr-node-from-overflowing-the-eraseblock.patch
  (git-fixes CVE-2024-38599 bsc#1226848).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-dbFindLeaf.patch
  (git-fixes CVE-2023-52799 bsc#1225472).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-diAlloc.patch
  (git-fixes CVE-2023-52805 bsc#1225553).
- Update
  patches.suse/kunit-fortify-Fix-mismatched-kvalloc-vfree-usage.patch
  (git-fixes CVE-2024-38617 bsc#1226859).
- Update
  patches.suse/lib-generic-radix-tree.c-Don-t-overflow-in-peek.patch
  (git-fixes CVE-2021-47432 bsc#1225391).
- Update
  patches.suse/lib-test_hmm.c-handle-src_pfns-and-dst_pfns-allocati.patch
  (git-fixes CVE-2024-38543 bsc#1226594).
- Update
  patches.suse/locking-ww_mutex-test-Fix-potential-workqueue-corrup.patch
  (bsc#1219953 CVE-2023-52836 bsc#1225609).
- Update
  patches.suse/md-Don-t-ignore-suspended-array-in-md_check_recovery-1baa.patch
  (bsc#1219596 CVE-2024-26758).
- Update
  patches.suse/media-atomisp-ssh_css-Fix-a-null-pointer-dereference.patch
  (git-fixes CVE-2024-38547 bsc#1226632).
- Update
  patches.suse/media-bttv-fix-use-after-free-error-due-to-btv-timeo.patch
  (git-fixes CVE-2023-52847 bsc#1225588).
- Update
  patches.suse/media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch
  (git-fixes CVE-2023-52764 bsc#1225571).
- Update
  patches.suse/media-hantro-Check-whether-reset-op-is-defined-befor.patch
  (git-fixes CVE-2023-52850 bsc#1225014).
- Update
  patches.suse/media-i2c-et8ek8-Don-t-strip-remove-function-when-dr.patch
  (git-fixes CVE-2024-38611 bsc#1226760).
- Update
  patches.suse/media-imon-fix-access-to-invalid-resource-for-the-se.patch
  (git-fixes CVE-2023-52754 bsc#1225490).
- Update
  patches.suse/media-lgdt3306a-Add-a-check-against-null-pointer-def.patch
  (stable-fixes CVE-2022-48772 bsc#1226976).
- Update
  patches.suse/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch
  (git-fixes CVE-2024-38621 bsc#1226895).
- Update
  patches.suse/media-vidtv-mux-Add-check-and-kfree-for-kstrdup.patch
  (git-fixes CVE-2023-52841 bsc#1225592).
- Update patches.suse/media-vidtv-psi-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52844 bsc#1225590).
- Update
  patches.suse/mfd-qcom-spmi-pmic-Fix-revid-implementation.patch
  (git-fixes CVE-2023-52765 bsc#1225029).
- Update
  patches.suse/misc-microchip-pci1xxxx-fix-double-free-in-the-error.patch
  (git-fixes CVE-2024-36973 bsc#1226457).
- Update
  patches.suse/net-hns3-fix-out-of-bounds-access-may-occur-when-coa.patch
  (git-fixes CVE-2023-52807 bsc#1225097).
- Update
  patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch
  (git-fixes CVE-2024-36962 bsc#1225827).
- Update
  patches.suse/net-mlx5-Fix-peer-devlink-set-for-SF-representor-dev.patch
  (git-fixes CVE-2024-38595 bsc#1226741).
- Update
  patches.suse/net-mlx5e-Track-xmit-submission-to-PTP-WQ-after-popu.patch
  (jsc#PED-3311 CVE-2023-52782 bsc#1225103).
- Update
  patches.suse/net-mvneta-fix-calls-to-page_pool_get_stats.patch
  (git-fixes CVE-2023-52780 bsc#1224933).
- Update
  patches.suse/net-wangxun-fix-kernel-panic-due-to-null-pointer.patch
  (git-fixes CVE-2023-52783 bsc#1225104).
- Update
  patches.suse/netfilter-complete-validation-of-user-input.patch
  (git-fixes CVE-2024-35896 bsc#1224662 CVE-2024-35962
  bsc#1224583).
- Update
  patches.suse/nfc-nci-Fix-uninit-value-in-nci_rx_work.patch
  (git-fixes CVE-2024-38381 bsc#1226878).
- Update
  patches.suse/nilfs2-fix-nilfs_empty_dir-misjudgment-and-long-loop.patch
  (git-fixes CVE-2024-39469 bsc#1226992).
- Update
  patches.suse/nilfs2-fix-potential-hang-in-nilfs_detach_log_writer.patch
  (git-fixes CVE-2024-38582 bsc#1226658).
- Update
  patches.suse/nilfs2-fix-use-after-free-of-timer-for-log-writer-th.patch
  (git-fixes CVE-2024-38583 bsc#1226777).
- Update
  patches.suse/of-module-add-buffer-overflow-check-in-of_modalias.patch
  (git-fixes CVE-2024-38541 bsc#1226587).
- Update
  patches.suse/padata-Fix-refcnt-handling-in-padata_free_shell.patch
  (git-fixes CVE-2023-52854 bsc#1225584).
- Update
  patches.suse/perf-core-Bail-out-early-if-the-request-AUX-area-is-out-of-bound.patch
  (git-fixes CVE-2023-52835 bsc#1225602).
- Update
  patches.suse/platform-x86-wmi-Fix-opening-of-char-device.patch
  (git-fixes CVE-2023-52864 bsc#1225132).
- Update
  patches.suse/powerpc-pseries-iommu-LPAR-panics-during-boot-up-wit.patch
  (bsc#1222011 ltc#205900 CVE-2024-36926 bsc#1225829).
- Update patches.suse/pstore-platform-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52869 bsc#1225050).
- Update
  patches.suse/remoteproc-mediatek-Make-sure-IPI-buffer-fits-in-L2T.patch
  (git-fixes CVE-2024-36965 bsc#1226149).
- Update
  patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch
  (git-fixes CVE-2024-38601 bsc#1226876).
- Update
  patches.suse/s390-dasd-protect-device-queue-against-concurrent-access.patch
  (git-fixes bsc#1217481 CVE-2023-52774 bsc#1225572).
- Update
  patches.suse/scsi-hisi_sas-Set-debugfs_dir-pointer-to-NULL-after-removing-debugfs.patch
  (git-fixes CVE-2023-52808 bsc#1225555).
- Update
  patches.suse/scsi-ibmvfc-Remove-BUG_ON-in-the-case-of-an-empty-ev.patch
  (bsc#1209834 ltc#202097 CVE-2023-52811 bsc#1225559).
- Update
  patches.suse/scsi-libfc-Fix-potential-NULL-pointer-dereference-in-fc_lport_ptp_setup.patch
  (git-fixes CVE-2023-52809 bsc#1225556).
- Update
  patches.suse/scsi-lpfc-Move-NPIV-s-transport-unregistration-to-af.patch
  (bsc#1221777 CVE-2024-36952 bsc#1225898).
- Update
  patches.suse/scsi-lpfc-Release-hbalock-before-calling-lpfc_worker.patch
  (bsc#1221777 CVE-2024-36924 bsc#1225820).
- Update
  patches.suse/serial-max3100-Lock-port-lock-when-calling-uart_hand.patch
  (git-fixes CVE-2024-38634 bsc#1226868).
- Update
  patches.suse/serial-max3100-Update-uart_driver_registered-on-driv.patch
  (git-fixes CVE-2024-38633 bsc#1226867).
- Update
  patches.suse/soc-qcom-llcc-Handle-a-second-device-without-data-co.patch
  (git-fixes CVE-2023-52871 bsc#1225534).
- Update
  patches.suse/soundwire-cadence-fix-invalid-PDI-offset.patch
  (stable-fixes CVE-2024-38635 bsc#1226863).
- Update patches.suse/speakup-Fix-sizeof-vs-ARRAY_SIZE-bug.patch
  (git-fixes CVE-2024-38587 bsc#1226780).
- Update patches.suse/spi-Fix-null-dereference-on-suspend.patch
  (git-fixes CVE-2023-52749 bsc#1225476).
- Update
  patches.suse/thermal-core-prevent-potential-string-overflow.patch
  (git-fixes CVE-2023-52868 bsc#1225044).
- Update
  patches.suse/thermal-drivers-qcom-lmh-Check-for-SCM-availability-.patch
  (git-fixes CVE-2024-39466 bsc#1227089).
- Update
  patches.suse/thermal-drivers-tsens-Fix-null-pointer-dereference.patch
  (git-fixes CVE-2024-38571 bsc#1226737).
- Update
  patches.suse/thermal-intel-powerclamp-fix-mismatch-in-get-functio.patch
  (git-fixes CVE-2023-52794 bsc#1225028).
- Update
  patches.suse/tls-fix-NULL-deref-on-tls_sw_splice_eof-with-empty-r.patch
  (jsc#PED-6831 CVE-2023-52767 bsc#1224998).
- Update
  patches.suse/tpm_tis_spi-Account-for-SPI-header-when-allocating-T.patch
  (git-fixes CVE-2024-36477 bsc#1226840).
- Update
  patches.suse/tracing-Have-trace_event_file-have-ref-counters.patch
  (git-fixes CVE-2023-52879 bsc#1225101).
- Update
  patches.suse/tracing-trigger-Fix-to-return-error-if-failed-to-alloc-snapshot.patch
  (git-fixes CVE-2024-26920).
- Update
  patches.suse/tty-n_gsm-fix-race-condition-in-status-line-change-o.patch
  (git-fixes CVE-2023-52872 bsc#1225591).
- Update
  patches.suse/tty-n_gsm-require-CAP_NET_ADMIN-to-attach-N_GSM0710-.patch
  (bsc#1222619 CVE-2023-52880).
- Update
  patches.suse/tty-vcc-Add-check-for-kstrdup-in-vcc_probe.patch
  (git-fixes CVE-2023-52789 bsc#1225180).
- Update
  patches.suse/usb-config-fix-iteration-issue-in-usb_get_bos_descri.patch
  (git-fixes CVE-2023-52781 bsc#1225092).
- Update
  patches.suse/usb-dwc3-Wait-unconditionally-after-issuing-EndXfer-.patch
  (git-fixes CVE-2024-36977 bsc#1226513).
- Update
  patches.suse/usb-gadget-u_audio-Fix-race-condition-use-of-control.patch
  (git-fixes CVE-2024-38628 bsc#1226911).
- Update
  patches.suse/usb-storage-alauda-Check-whether-the-media-is-initia.patch
  (git-fixes CVE-2024-38619 bsc#1226861).
- Update
  patches.suse/usb-typec-tcpm-Fix-NULL-pointer-dereference-in-tcpm_.patch
  (git-fixes CVE-2023-52877 bsc#1224944).
- Update
  patches.suse/vhost-vdpa-fix-use-after-free-in-vhost_vdpa_probe.patch
  (jsc#PED-3311 CVE-2023-52795 bsc#1225085).
- Update
  patches.suse/virtio-blk-fix-implicit-overflow-on-virtio_max_dma_s.patch
  (git-fixes CVE-2023-52762 bsc#1225573).
- Update
  patches.suse/virtio-vsock-Fix-uninit-value-in-virtio_transport_re.patch
  (jsc#PED-5505 CVE-2023-52842 bsc#1225025).
- Update
  patches.suse/watchdog-cpu5wdt.c-Fix-use-after-free-bug-caused-by-.patch
  (git-fixes CVE-2024-38630 bsc#1226908).
- Update
  patches.suse/wifi-ar5523-enable-proper-endpoint-verification.patch
  (git-fixes CVE-2024-38565 bsc#1226747).
- Update
  patches.suse/wifi-ath11k-fix-dfs-radar-event-locking.patch
  (git-fixes CVE-2023-52798 bsc#1224947).
- Update
  patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch
  (git-fixes CVE-2023-52777 bsc#1224992).
- Update patches.suse/wifi-ath11k-fix-htt-pktlog-locking.patch
  (git-fixes CVE-2023-52800).
- Update
  patches.suse/wifi-ath12k-fix-dfs-radar-and-temperature-event-lock.patch
  (git-fixes CVE-2023-52776 bsc#1225090).
- Update
  patches.suse/wifi-ath12k-fix-htt-mlo-offset-event-locking.patch
  (git-fixes CVE-2023-52769 bsc#1225001).
- Update
  patches.suse/wifi-ath12k-fix-out-of-bound-access-of-qmi_invoke_ha.patch
  (git-fixes CVE-2024-38572 bsc#1226776).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-read-in-ath12k.patch
  (git-fixes CVE-2023-52827 bsc#1225078).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-write-in-ath12.patch
  (git-fixes CVE-2023-52829 bsc#1225081).
- Update
  patches.suse/wifi-brcmfmac-pcie-handle-randbuf-allocation-failure.patch
  (git-fixes CVE-2024-38575 bsc#1226612).
- Update
  patches.suse/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch
  (git-fixes CVE-2024-38567 bsc#1226769).
- Update
  patches.suse/wifi-carl9170-re-fix-fortified-memset-warning.patch
  (git-fixes CVE-2024-38616 bsc#1226852).
- Update
  patches.suse/wifi-mac80211-don-t-return-unset-power-in-ieee80211_.patch
  (git-fixes CVE-2023-52832 bsc#1225577).
- Update
  patches.suse/wifi-nl80211-Avoid-address-calculations-via-out-of-b.patch
  (git-fixes CVE-2024-38562 bsc#1226788).
- Update
  patches.suse/wifi-wilc1000-use-vmm_table-as-array-in-wilc-struct.patch
  (git-fixes CVE-2023-52768 bsc#1225004).
- Update
  patches.suse/x86-tdx-Zero-out-the-missing-RSI-in-TDX_HYPERCALL-macro.patch
  (jsc#PED-5824 CVE-2023-52874 bsc#1225049).
- commit 33efdc4</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835204">- tcp: Use refcount_inc_not_zero() in tcp_twsk_unique()
  (CVE-2024-36904 bsc#1225732).
- commit d578dcc</changelog>
  <changelog author="heming.zhao@suse.com" date="1719921600">- gfs2: Fix potential glock use-after-free on unmount (bsc#1226775
  CVE-2024-38570).
- gfs2: Rename sd_{ glock =&gt; kill }_wait (bsc#1226775
  CVE-2024-38570).
- commit f3adbca</changelog>
  <changelog author="tiwai@suse.de" date="1719921601">- Correct SCSI patch references (bsc#1225767 CVE-2024-36919 bsc#1226785 CVE-2024-38559)
- commit e8ea587</changelog>
  <changelog author="tiwai@suse.de" date="1719921602">- mtd: rawnand: rockchip: ensure NVDDR timings are rejected
  (git-fixes).
- mtd: rawnand: Bypass a couple of sanity checks during NAND
  identification (git-fixes).
- mtd: rawnand: Fix the nand_read_data_op() early check
  (git-fixes).
- mtd: rawnand: Ensure ECC configuration is propagated to upper
  layers (git-fixes).
- commit e545951</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1719921603">- kernel-doc: fix struct_group_tagged() parsing (git-fixes).
- commit e3a2a2e</changelog>
  <changelog author="fdmanana@suse.com" date="1719921604">- btrfs: fix crash on racing fsync and size-extending write into
  prealloc (bsc#1227101 CVE-2024-37354).
- commit 1d355af</changelog>
  <changelog author="vbabka@suse.cz" date="1719921605">- virt: acrn: stop using follow_pfn (CVE-2024-38610 bsc#1226758).
- commit c2ea51b</changelog>
  <changelog author="vbabka@suse.cz" date="1719921606">- drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
  (CVE-2024-38610 bsc#1226758).
- commit 7069ac2</changelog>
  <changelog author="rhopkins@suse.de" date="1719921607">- hsr: Prevent use after free in prp_create_tagged_frame()
  (CVE-2023-52846 bsc#1225098).
- commit cf63988</changelog>
  <changelog author="krisman@suse.de" date="1719921608">- io_uring: Fix io_cqring_wait() not restoring sigmask on
  get_timespec64() failure (git-fixes).
- commit e640a65</changelog>
  <changelog author="krisman@suse.de" date="1719921609">- io_uring: check for non-NULL file pointer in io_file_can_poll()
  (bsc#1226990 CVE-2024-39371).
- io_uring/io-wq: Use set_bit() and test_bit() at worker-&gt;flags
  (git-fixes).
- io_uring/sqpoll: work around a potential audit memory leak
  (git-fixes).
- commit 24603fc</changelog>
  <changelog author="krisman@suse.de" date="1719921610">- io_uring/rsrc: fix incorrect assignment of iter-&gt;nr_segs in
  io_import_fixed (git-fixes).
- io_uring/rsrc: don't lock while !TASK_RUNNING (git-fixes).
- io_uring/io-wq: avoid garbage value of 'match' in
  io_wq_enqueue() (git-fixes).
- commit 7d3e252</changelog>
</package>
<package pkgid="d38ce0f0106896cc9df24a8a1f7f3d5d73aa5bd53ce6ab8b31af7d14b17d7e78" name="dtb-allwinner" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.17.1"/>
  <changelog author="tiwai@suse.de" date="1722081600">- auxdisplay: ht16k33: Drop reference after LED registration
  (git-fixes).
- ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
  on unprepare (git-fixes).
- ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
- ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
  reachable (git-fixes).
- ASoC: sof: amd: fix for firmware reload failure in Vangogh
  platform (git-fixes).
- ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
- ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
  (git-fixes).
- ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
- ALSA: ump: Don't update FB name for static blocks (git-fixes).
- drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
- drm/i915/gt: Do not consider preemption during execlists_dequeue
  for gen8 (git-fixes).
- drm/i915/dp: Don't switch the LTTPR mode on an active link
  (git-fixes).
- commit d7e2deb</changelog>
  <changelog author="tiwai@suse.de" date="1722081601">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
</package>
<package pkgid="77fd7366ef87690f306b3e4680c7d539b1edde5250b524bd74fe1adf046ca88b" name="dtb-allwinner" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.7.1"/>
  <changelog author="mkubecek@suse.cz" date="1717416000">- netfilter: nf_tables: release mutex after nft_gc_seq_end from
  abort path (CVE-2024-26925 bsc#1223390).
- commit 578a709</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717416001">- Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
  The L3 bsc#1225765 was created seperately since our customer requires
  PTF.
- Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
- Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
- Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
- Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
- commit 054635e</changelog>
  <changelog author="msuchanek@suse.de" date="1717416002">- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
- powerpc/uaccess: Fix build errors seen with GCC 13/14
  (bsc#1194869).
- commit 46b5d84</changelog>
  <changelog author="msuchanek@suse.de" date="1717416003">- blacklist.conf: PPC fsl_msi is not used
- commit ae6590d</changelog>
  <changelog author="msuchanek@suse.de" date="1717416004">- powerpc/pseries/lparcfg: drop error message from guest name
  lookup (bsc#1187716 ltc#193451 git-fixes).
- commit ceab637</changelog>
  <changelog author="mfranc@suse.cz" date="1717416005">- Update
  patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
  (git-fixes CVE-2024-36955).
- Update
  patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
  (git-fixes bsc#1225715 CVE-2024-36906).
- Update
  patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
  (git-fixes bsc#1225579 CVE-2024-36011).
- Update
  patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
  (git-fixes bsc#1225578 CVE-2024-36013).
- Update
  patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
  (git-fixes bsc#1225502 CVE-2024-36012).
- Update
  patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
  (git-fixes bsc#1225722 CVE-2024-36880).
- Update
  patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
  (git-fixes CVE-2024-36942).
- Update
  patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
  (git-fixes bsc#1225720 CVE-2024-36032).
- Update
  patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
  (git-fixes bsc#1223749 CVE-2024-26990).
- Update
  patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
  (git-fixes bsc#1223692 CVE-2024-26992).
- Update
  patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
  (stable-fixes CVE-2024-36944).
- Update
  patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
  (git-fixes bsc#1225734 CVE-2024-36896).
- Update
  patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
  (stable-fixes CVE-2024-36949).
- Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
  (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
- Update
  patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
  (git-fixes bsc#1225692 CVE-2023-52882).
- Update
  patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
  (git-fixes CVE-2024-26761).
- Update
  patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
  (stable-fixes bsc#1225735 CVE-2024-36897).
- Update
  patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
  (stable-fixes bsc#1225705 CVE-2024-36026).
- Update
  patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
  (stable-fixes CVE-2024-36951).
- Update
  patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
  (git-fixes bsc#1225593 CVE-2024-36014).
- Update
  patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
  (stable-fixes bsc#1225728 CVE-2024-36885).
- Update
  patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
  (git-fixes bsc#1225773 CVE-2024-36936).
- Update
  patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
  (stable-fixes CVE-2024-36950).
- Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
  (git-fixes bsc#1225736 CVE-2024-36898).
- Update
  patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
  (git-fixes bsc#1225698 CVE-2024-36020).
- Update
  patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
  (git-fixes bsc#1225710 CVE-2024-36891).
- Update
  patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
  (git-fixes bsc#1225714 CVE-2024-36890).
- Update
  patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
  (git-fixes bsc#1225708 CVE-2024-36029).
- Update
  patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
  (git-fixes bsc#1225699 CVE-2024-36021).
- Update
  patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
  (git-fixes CVE-2024-26943).
- Update
  patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
  (git-fixes bsc#1225694 CVE-2024-36018).
- Update
  patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
  (git-fixes CVE-2024-36940).
- Update
  patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
  (git-fixes CVE-2024-36959).
- Update
  patches.suse/ppdev-Add-an-error-check-in-register_device.patch
  (git-fixes bsc#1225640 CVE-2024-36015).
- Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
  CVE-2024-36947).
- Update
  patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
  (git-fixes bsc#1225695 CVE-2024-36019).
- Update
  patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
  (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
- Update
  patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
  (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
- Update
  patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
  (git-fixes bsc#1225704 CVE-2024-36025).
- Update
  patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
  (git-fixes CVE-2024-36930).
- Update
  patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
  (bsc#1224331 bsc#1224602 CVE-2024-35814).
- Update
  patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
  (git-fixes bsc#1225642 CVE-2024-36016).
- Update
  patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
  (git-fixes bsc#1225749 CVE-2024-36894).
- Update
  patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
  (git-fixes bsc#1225750 CVE-2024-36895).
- Update
  patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
  (git-fixes bsc#1225748 CVE-2024-36893).
- Update
  patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
  (stable-fixes bsc#1225769 CVE-2024-36921).
- Update
  patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
  (stable-fixes CVE-2024-36922).
- Update
  patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
  (git-fixes CVE-2024-36941).
- Update
  patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
  (git-fixes bsc#1224742 CVE-2024-35803).
- commit 539780f</changelog>
  <changelog author="dwagner@suse.de" date="1717416006">- nvmet: fix ns enable/disable possible hang (git-fixes).
- nvme-multipath: fix io accounting on failover (git-fixes).
- nvme: fix multipath batched completion accounting (git-fixes).
- commit ed3b392</changelog>
  <changelog author="dwagner@suse.de" date="1717416007">- scsi: lpfc: Copyright updates for 14.4.0.2 patches
  (bsc#1225842).
- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
  (bsc#1225842).
  Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
  (bsc#1225842).
- scsi: lpfc: Clear deferred RSCN processing flag when driver
  is unloading (bsc#1225842).
- scsi: lpfc: Update logging of protection type for T10 DIF I/O
  (bsc#1225842).
- scsi: lpfc: Change default logging level for unsolicited CT
  MIB commands (bsc#1225842).
- commit 5a56384</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416008">- smb: client: fix mount when dns_resolver key is not available
  (git-fixes, bsc#1225172).
- commit 28edb5c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416009">- cifs: fix leak of iface for primary channel (git-fixes,
  bsc#1225172).
- commit b7eb8e8</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416010">- Revert "cifs: reconnect work should have reference on server
  struct" (git-fixes, bsc#1225172).
- commit 3ca4c0c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416011">- smb: client: fix parsing of SMB3.1.1 POSIX create context
  (git-fixes, bsc#1225172).
- commit 5f27f69</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416012">- cifs: failure to add channel on iface should bump up weight
  (git-fixes, bsc#1225172).
- commit 007b237</changelog>
  <changelog author="tonyj@suse.de" date="1717416013">- perf/x86: Fix out of range data (git-fixes).
- perf/x86/intel/ds: Don't clear -&gt;pebs_data_cfg for the last
  PEBS event (git-fixes).
- perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
- commit 664d77f</changelog>
  <changelog author="dsterba@suse.com" date="1717588800">- blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
- Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
  Quoting bsc#1225945#c11:
  "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
  transaction for every subvol create")
  ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
  unwritten extent buffer after snapshotting a new subvolume") was never
  backported."
- commit d947258</changelog>
  <changelog author="tonyj@suse.de" date="1717588801">- perf pmu: Count sys and cpuid JSON events separately (git
  fixes).
- perf stat: Don't display metric header for non-leader uncore
  events (git-fixes).
- perf daemon: Fix file leak in daemon_session__control
  (git-fixes).
- perf symbols: Fix ownership of string in dso__load_vmlinux()
  (git-fixes).
- perf thread: Fixes to thread__new() related to initializing comm
  (git-fixes).
- perf report: Avoid SEGV in report__setup_sample_type()
  (git-fixes).
- perf ui browser: Don't save pointer to stack memory (git-fixes).
- perf bench internals inject-build-id: Fix trap divide when
  collecting just one DSO (git-fixes).
- perf intel-pt: Fix unassigned instruction op (discovered by
  MemorySanitizer) (git-fixes).
- perf test shell arm_coresight: Increase buffer size for
  Coresight basic tests (git-fixes).
- perf docs: Document bpf event modifier (git-fixes).
- perf bench uprobe: Remove lib64 from libc.so.6 binary path
  (git-fixes).
- perf record: Fix debug message placement for test consumption
  (git-fixes).
- perf tests: Apply attributes to all events in object code
  reading test (git-fixes).
- perf tests: Make "test data symbol" more robust on Neoverse N1
  (git-fixes).
- perf annotate: Fix annotation_calc_lines() to pass correct
  address to get_srcline() (git-fixes).
- perf stat: Do not fail on metrics on s390 z/VM systems
  (git-fixes).
- perf sched timehist: Fix -g/--call-graph option failure
  (git-fixes).
- perf annotate: Get rid of duplicate --group option item
  (git-fixes).
- perf probe: Add missing libgen.h header needed for using
  basename() (git-fixes).
- perf record: Delete session after stopping sideband thread
  (git-fixes).
- perf auxtrace: Fix multiple use of --itrace option (git-fixes).
- perf script: Show also errors for --insn-trace option
  (git-fixes).
- perf lock contention: Add a missing NULL check (git-fixes).
- perf vendor events amd: Fix Zen 4 cache latency events
  (git-fixes).
- libperf evlist: Avoid out-of-bounds access (git-fixes).
- perf pmu: Fix a potential memory leak in perf_pmu__lookup()
  (git-fixes).
- perf print-events: make is_event_supported() more robust
  (git-fixes).
- perf list: fix short description for some cache events
  (git-fixes).
- perf metric: Don't remove scale from counts (git-fixes).
- perf stat: Avoid metric-only segv (git-fixes).
- perf expr: Fix "has_event" function for metric style events
  (git-fixes).
- perf srcline: Add missed addr2line closes (git-fixes).
- perf thread_map: Free strlist on normal path in
  thread_map__new_by_tid_str() (git-fixes).
- perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
- perf jevents: Drop or simplify small integer values (git-fixes).
- perf evsel: Fix duplicate initialization of data-&gt;id in
  evsel__parse_sample() (git-fixes).
- perf pmu: Treat the msr pmu as software (git-fixes).
- perf record: Check conflict between '--timestamp-filename'
  option and pipe mode before recording (git-fixes).
- perf record: Fix possible incorrect free in
  record__switch_output() (git-fixes).
- perf vendor events amd: Add Zen 4 memory controller events
  (git-fixes).
- perf top: Uniform the event name for the hybrid machine
  (git-fixes).
- perf top: Use evsel's cpus to replace user_requested_cpus
  (git-fixes).
- commit a1f9340</changelog>
  <changelog author="tonyj@suse.de" date="1717675200">- perf ui browser: Avoid SEGV on title (git fixes).
- commit 1578c22</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675201">- inet: inet_defrag: prevent sk release while still in use
  (CVE-2024-26921 bsc#1223138).
- commit 2016faf</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675202">- net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
- commit 7bf5961</changelog>
  <changelog author="tiwai@suse.de" date="1718366400">- Temporarily drop KVM patch that caused a regression (bsc#1226158)
  Delete patches.suse/KVM-x86-pmu-Prioritize-VMX-interception-over-GP-on-R.patch
- commit 33f31da</changelog>
</package>
<package pkgid="3972eb7e4f5ecb8e94cc698a76d3424bc1035bca9a7956aafcfa106954202218" name="dtb-altera" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.14.1"/>
  <changelog author="tiwai@suse.de" date="1719662400">- gpiolib: cdev: Disallow reconfiguration without direction
  (uAPI v1) (git-fixes).
- gpio: davinci: Validate the obtained number of IRQs (git-fixes).
- commit 919ebd1</changelog>
  <changelog author="tiwai@suse.de" date="1719748800">- i2c: testunit: discard write requests while old command is
  running (git-fixes).
- i2c: testunit: don't erase registers after STOP (git-fixes).
- mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
  (git-fixes).
- mmc: sdhci: Do not invert write-protect twice (git-fixes).
- mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
  (git-fixes).
- mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
  (git-fixes).
- commit 448487d</changelog>
  <changelog author="tiwai@suse.de" date="1719748801">- crypto: iaa - Account for cpu-less numa nodes (bsc#1227190).
- commit cd600aa</changelog>
  <changelog author="tiwai@suse.de" date="1719748802">- crypto: deflate - Add aliases to deflate (bsc#1227190).
- commit 27ffd92</changelog>
  <changelog author="tiwai@suse.de" date="1719835200">- ata: ahci: Clean up sysfs file on error (git-fixes).
- ata: libata-core: Fix double free on error (git-fixes).
- ata,scsi: libata-core: Do not leak memory for ata_port struct
  members (git-fixes).
- ata: libata-core: Fix null pointer dereference on error
  (git-fixes).
- kbuild: Fix build target deb-pkg: ln: failed to create hard link
  (git-fixes).
- kbuild: doc: Update default INSTALL_MOD_DIR from extra to
  updates (git-fixes).
- kbuild: Install dtb files as 0644 in Makefile.dtbinst
  (git-fixes).
- counter: ti-eqep: enable clock at probe (git-fixes).
- iio: chemical: bme680: Fix sensor data read operation
  (git-fixes).
- iio: chemical: bme680: Fix overflows in compensate() functions
  (git-fixes).
- iio: chemical: bme680: Fix calibration data variable
  (git-fixes).
- iio: chemical: bme680: Fix pressure value output (git-fixes).
- iio: accel: fxls8962af: select IIO_BUFFER &amp; IIO_KFIFO_BUF
  (git-fixes).
- iio: adc: ad7266: Fix variable checking bug (git-fixes).
- iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
  (git-fixes).
- serial: bcm63xx-uart: fix tx after conversion to
  uart_port_tx_limited() (git-fixes).
- serial: core: introduce uart_port_tx_limited_flags()
  (git-fixes).
- Revert "serial: core: only stop transmit when HW fifo is empty"
  (git-fixes).
- tty: mcf: MCF54418 has 10 UARTS (git-fixes).
- usb: gadget: aspeed_udc: fix device address configuration
  (git-fixes).
- usb: dwc3: core: remove lock of otg mode during gadget
  suspend/resume to avoid deadlock (git-fixes).
- usb: typec: ucsi: glink: fix child node release in probe
  function (git-fixes).
- usb: musb: da8xx: fix a resource leak in probe() (git-fixes).
- usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  (git-fixes).
- usb: gadget: printer: fix races against disable (git-fixes).
- PCI/MSI: Fix UAF in msi_capability_init (git-fixes).
- commit a2ea5a9</changelog>
  <changelog author="ptesarik@suse.com" date="1719835201">- net: ena: Fix redundant device NUMA node override
  (jsc#PED-8688).
- commit 6ad6684</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835202">- tcp: do not accept ACK of bytes we never sent (CVE-2023-52881
  bsc#1225611).
- commit 16404a6</changelog>
  <changelog author="mhocko@suse.com" date="1719835203">- Update
  patches.suse/1352-drm-amdgpu-Fix-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52883
  bsc#1226630).
- Update
  patches.suse/9p-add-missing-locking-around-taking-dentry-fid-list.patch
  (git-fixes CVE-2024-39463 bsc#1227090).
- Update
  patches.suse/ALSA-Fix-deadlocks-with-kctl-removals-at-disconnecti.patch
  (stable-fixes CVE-2024-38600 bsc#1226864).
- Update
  patches.suse/ALSA-core-Fix-NULL-module-pointer-assignment-at-card.patch
  (git-fixes CVE-2024-38605 bsc#1226740).
- Update
  patches.suse/ALSA-hda-Fix-possible-null-ptr-deref-when-assigning-.patch
  (git-fixes CVE-2023-52806 bsc#1225554).
- Update
  patches.suse/ALSA-hda-cs_dsp_ctl-Use-private_free-for-control-cle.patch
  (git-fixes CVE-2024-38388 bsc#1226890).
- Update
  patches.suse/ALSA-timer-Set-lower-bound-of-start-tick-time.patch
  (stable-fixes git-fixes CVE-2024-38618 bsc#1226754).
- Update
  patches.suse/ASoC-kirkwood-Fix-potential-NULL-dereference.patch
  (git-fixes CVE-2024-38550 bsc#1226633).
- Update
  patches.suse/ASoC-mediatek-Assign-dummy-when-codec-not-specified-.patch
  (git-fixes CVE-2024-38551 bsc#1226761).
- Update
  patches.suse/Bluetooth-btusb-Add-date-evt_skb-is-NULL-check.patch
  (git-fixes CVE-2023-52833 bsc#1225595).
- Update
  patches.suse/Bluetooth-hci_core-Fix-possible-buffer-overflow.patch
  (git-fixes CVE-2024-26889).
- Update
  patches.suse/HID-uclogic-Fix-user-memory-access-bug-in-uclogic_pa.patch
  (git-fixes CVE-2023-52866 bsc#1225120).
- Update
  patches.suse/IB-mlx5-Fix-init-stage-error-handling-to-avoid-doubl.patch
  (jsc#PED-6864 CVE-2023-52851 bsc#1225587).
- Update
  patches.suse/Input-cyapa-add-missing-input-core-locking-to-suspen.patch
  (git-fixes CVE-2023-52884 bsc#1226764).
- Update
  patches.suse/Input-synaptics-rmi4-fix-use-after-free-in-rmi_unreg.patch
  (git-fixes CVE-2023-52840 bsc#1224928).
- Update
  patches.suse/KEYS-trusted-Do-not-use-WARN-when-encode-fails.patch
  (git-fixes CVE-2024-36975 bsc#1226520).
- Update
  patches.suse/KEYS-trusted-Fix-memory-leak-in-tpm2_key_encode.patch
  (git-fixes CVE-2024-36967 bsc#1226131).
- Update
  patches.suse/RDMA-cma-Fix-kmemleak-in-rdma_core-observed-during-b.patch
  (git-fixes CVE-2024-38539 bsc#1226608).
- Update patches.suse/RDMA-hns-Fix-UAF-for-cq-async-event.patch
  (git-fixes CVE-2024-38545 bsc#1226595).
- Update
  patches.suse/RDMA-hns-Fix-deadlock-on-SRQ-async-events.patch
  (git-fixes CVE-2024-38591 bsc#1226738).
- Update
  patches.suse/RDMA-hns-Modify-the-print-level-of-CQE-error.patch
  (git-fixes CVE-2024-38590 bsc#1226839).
- Update
  patches.suse/RDMA-rxe-Fix-seg-fault-in-rxe_comp_queue_pkt.patch
  (git-fixes CVE-2024-38544 bsc#1226597).
- Update
  patches.suse/SUNRPC-Fix-RPC-client-cleaned-up-the-freed-pipefs-de.patch
  (git-fixes CVE-2023-52803 bsc#1225008).
- Update patches.suse/af_unix-Clear-stale-u-oob_skb.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-35970 bsc#1224584).
- Update
  patches.suse/af_unix-Drop-oob_skb-ref-before-purging-queue-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26750 bsc#1222617).
- Update
  patches.suse/af_unix-Fix-task-hung-while-purging-oob_skb-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26780 bsc#1222588).
- Update
  patches.suse/af_unix-Update-unix_sk-sk-oob_skb-under-sk_receive_queue-lock.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-36972 bsc#1226163).
- Update
  patches.suse/arm64-Restrict-CPU_BIG_ENDIAN-to-GNU-as-or-LLVM-IAS-.patch
  (git-fixes CVE-2023-52750 bsc#1225485).
- Update
  patches.suse/atl1c-Work-around-the-DMA-RX-overflow-issue.patch
  (git-fixes CVE-2023-52834 bsc#1225599).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issue-of-net_device.patch
  (git-fixes CVE-2024-38554 bsc#1226742).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issues-of-ax25_dev.patch
  (git-fixes CVE-2024-38602 bsc#1226613).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-reorder-of-WRITE-lqueued.patch
  (bsc#1225605 CVE-2024-38384 bsc#1226938).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-resetting-io-stat.patch
  (bsc#1225605 CVE-2024-38663 bsc#1226939).
- Update
  patches.suse/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch
  (git-fixes CVE-2024-38540 bsc#1226582).
- Update
  patches.suse/bonding-stop-the-device-in-bond_setup_by_slave.patch
  (git-fixes CVE-2023-52784 bsc#1224946).
- Update
  patches.suse/can-dev-can_put_echo_skb-don-t-crash-kernel-if-can_p.patch
  (git-fixes CVE-2023-52878 bsc#1225000).
- Update
  patches.suse/clk-mediatek-clk-mt2701-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52875 bsc#1225096).
- Update
  patches.suse/clk-mediatek-clk-mt6765-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52870 bsc#1224937).
- Update
  patches.suse/clk-mediatek-clk-mt6779-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52873 bsc#1225589).
- Update
  patches.suse/clk-mediatek-clk-mt6797-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52865 bsc#1225086).
- Update
  patches.suse/clk-mediatek-clk-mt7629-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52858 bsc#1225566).
- Update
  patches.suse/clk-mediatek-clk-mt7629-eth-Add-check-for-mtk_alloc_.patch
  (git-fixes CVE-2023-52876 bsc#1225036).
- Update
  patches.suse/cppc_cpufreq-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38573 bsc#1226739).
- Update patches.suse/cpufreq-exit-callback-is-optional.patch
  (git-fixes CVE-2024-38615 bsc#1226592).
- Update patches.suse/crypto-bcm-Fix-pointer-arithmetic.patch
  (git-fixes CVE-2024-38579 bsc#1226637).
- Update
  patches.suse/crypto-pcrypt-Fix-hungtask-for-PADATA_RESET.patch
  (git-fixes CVE-2023-52813 bsc#1225527).
- Update patches.suse/cxl-mem-Fix-shutdown-order.patch (git-fixes
  CVE-2023-52849 bsc#1224949).
- Update
  patches.suse/cxl-region-Do-not-try-to-cleanup-after-cxl_region_se.patch
  (git-fixes CVE-2023-52792 bsc#1225477).
- Update patches.suse/cxl-region-Fix-cxlr_pmem-leaks.patch
  (git-fixes CVE-2024-38391 bsc#1226894).
- Update
  patches.suse/dma-buf-sw-sync-don-t-enable-IRQ-from-sync_print_obj.patch
  (git-fixes CVE-2024-38780 bsc#1226886).
- Update
  patches.suse/dma-mapping-benchmark-fix-node-id-validation.patch
  (git-fixes CVE-2024-34777 bsc#1226796).
- Update
  patches.suse/dma-mapping-benchmark-handle-NUMA_NO_NODE-correctly.patch
  (git-fixes CVE-2024-39277 bsc#1226909).
- Update
  patches.suse/dmaengine-idxd-Avoid-unnecessary-destruction-of-file.patch
  (git-fixes CVE-2024-38629 bsc#1226905).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Pola.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52819
  bsc#1225532).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-SMU7.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52818
  bsc#1225530).
- Update
  patches.suse/drm-amd-check-num-of-link-levels-when-update-pcie-pa.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52812
  bsc#1225564).
- Update
  patches.suse/drm-amd-display-Avoid-NULL-dereference-of-timing-gen.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52753
  bsc#1225478).
- Update
  patches.suse/drm-amd-display-Fix-division-by-zero-in-setup_dsc_co.patch
  (stable-fixes CVE-2024-36969 bsc#1226155).
- Update
  patches.suse/drm-amd-display-Fix-null-pointer-dereference-in-erro.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52862
  bsc#1225015).
- Update
  patches.suse/drm-amd-display-Fix-potential-index-out-of-bounds-in.patch
  (git-fixes CVE-2024-38552 bsc#1226767).
- Update
  patches.suse/drm-amd-display-fix-a-NULL-pointer-dereference-in-am.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52773
  bsc#1225041).
- Update
  patches.suse/drm-amd-display-fixed-integer-types-and-null-check-l.patch
  (git-fixes CVE-2024-26767).
- Update
  patches.suse/drm-amdgpu-Fix-a-null-pointer-access-when-the-smc_rr.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52817
  bsc#1225569).
- Update
  patches.suse/drm-amdgpu-Fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch
  (git-fixes CVE-2024-39291 bsc#1226934).
- Update
  patches.suse/drm-amdgpu-Fix-potential-null-pointer-derefernce.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52814
  bsc#1225565).
- Update
  patches.suse/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch
  (stable-fixes CVE-2024-39471 bsc#1227096).
- Update
  patches.suse/drm-amdgpu-mes-fix-use-after-free-issue.patch
  (stable-fixes CVE-2024-38581 bsc#1226657).
- Update
  patches.suse/drm-amdgpu-vkms-fix-a-possible-null-pointer-derefere.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52815
  bsc#1225568).
- Update
  patches.suse/drm-amdkfd-Fix-a-race-condition-of-vram-buffer-unref.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52825
  bsc#1225076).
- Update
  patches.suse/drm-amdkfd-Fix-shift-out-of-bounds-issue.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52816
  bsc#1225529).
- Update
  patches.suse/drm-bridge-cdns-mhdp8546-Fix-possible-null-pointer-d.patch
  (git-fixes CVE-2024-38548).
- Update
  patches.suse/drm-bridge-it66121-Fix-invalid-connector-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52861
  bsc#1224941).
- Update
  patches.suse/drm-bridge-lt8912b-Fix-crash-on-bridge-detach.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52856
  bsc#1224932).
- Update
  patches.suse/drm-mediatek-Add-0-size-check-to-mtk_drm_gem_obj.patch
  (git-fixes CVE-2024-38549 bsc#1226735).
- Update
  patches.suse/drm-mediatek-Fix-coverity-issue-with-unintentional-i.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52857
  bsc#1225581).
- Update
  patches.suse/drm-mediatek-Init-ddp_comp-with-devm_kcalloc.patch
  (git-fixes CVE-2024-38592 bsc#1226844).
- Update
  patches.suse/drm-msm-a6xx-Avoid-a-nullptr-dereference-when-speedb.patch
  (git-fixes CVE-2024-38390 bsc#1226891).
- Update
  patches.suse/drm-msm-dpu-Add-callback-function-pointer-check-befo.patch
  (git-fixes CVE-2024-38622 bsc#1226856).
- Update
  patches.suse/drm-panel-fix-a-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52821
  bsc#1225022).
- Update
  patches.suse/drm-panel-panel-tpo-tpg110-fix-a-possible-null-point.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52826
  bsc#1225077).
- Update patches.suse/drm-radeon-possible-buffer-overflow.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52867
  bsc#1225009).
- Update
  patches.suse/drm-vc4-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38546 bsc#1226593).
- Update
  patches.suse/drm-vmwgfx-Fix-invalid-reads-in-fence-signaled-event.patch
  (git-fixes CVE-2024-36960 bsc#1225872).
- Update
  patches.suse/drm-zynqmp_dpsub-Always-register-bridge.patch
  (git-fixes CVE-2024-38664 bsc#1226941).
- Update
  patches.suse/e1000e-change-usleep_range-to-udelay-in-PHY-mdic-acc.patch
  (CVE-2024-39296 bsc#1226989 CVE-2024-36887 bsc#1225731).
- Update
  patches.suse/ecryptfs-Fix-buffer-size-for-tag-66-packet.patch
  (git-fixes CVE-2024-38578 bsc#1226634).
- Update
  patches.suse/efi-libstub-only-free-priv.runtime_map-when-allocate.patch
  (git-fixes CVE-2024-33619 bsc#1226768).
- Update
  patches.suse/fbdev-imsttfb-fix-a-resource-leak-in-probe.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52838
  bsc#1225031).
- Update
  patches.suse/fs-9p-only-translate-RWX-permissions-for-plain-9P200.patch
  (git-fixes CVE-2024-36964 bsc#1225866).
- Update
  patches.suse/fs-jfs-Add-check-for-negative-db_l2nbperpage.patch
  (git-fixes CVE-2023-52810 bsc#1225557).
- Update
  patches.suse/fs-jfs-Add-validity-check-for-db_maxag-and-db_agpref.patch
  (git-fixes CVE-2023-52804 bsc#1225550).
- Update
  patches.suse/ftrace-Fix-possible-use-after-free-issue-in-ftrace_location.patch
  (git-fixes CVE-2024-38588 bsc#1226837).
- Update
  patches.suse/genirq-irqdesc-Prevent-use-after-free-in-irq_find_at.patch
  (git-fixes CVE-2024-38385 bsc#1227085).
- Update patches.suse/gfs2-ignore-negated-quota-changes.patch
  (git-fixes CVE-2023-52759 bsc#1225560).
- Update
  patches.suse/hid-cp2112-Fix-duplicate-workqueue-initialization.patch
  (git-fixes CVE-2023-52853 bsc#1224988).
- Update
  patches.suse/hwmon-axi-fan-control-Fix-possible-NULL-pointer-dere.patch
  (git-fixes CVE-2023-52863 bsc#1225586).
- Update
  patches.suse/i2c-acpi-Unbind-mux-adapters-before-delete.patch
  (git-fixes CVE-2024-39362 bsc#1226995).
- Update
  patches.suse/i2c-core-Run-atomic-i2c-xfer-when-preemptible.patch
  (git-fixes CVE-2023-52791 bsc#1225108).
- Update
  patches.suse/i3c-master-mipi-i3c-hci-Fix-a-kernel-panic-for-acces.patch
  (git-fixes CVE-2023-52763 bsc#1225570).
- Update
  patches.suse/i3c-mipi-i3c-hci-Fix-out-of-bounds-access-in-hci_dma.patch
  (git-fixes CVE-2023-52766).
- Update
  patches.suse/i915-perf-Fix-NULL-deref-bugs-with-drm_dbg-calls.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52788
  bsc#1225106).
- Update
  patches.suse/igb-Fix-string-truncation-warnings-in-igb_set_fw_ver.patch
  (git-fixes CVE-2024-36010 bsc#1225594).
- Update
  patches.suse/iommu-vt-d-Fix-WARN_ON-in-iommu-probe-path.patch
  (git-fixes CVE-2024-35957 bsc#1224673).
- Update
  patches.suse/iommufd-Fix-missing-update-of-domains_itree-after-splitting-iopt
  (jsc#PED-7779 jsc#PED-7780 CVE-2023-52801 bsc#1225006).
- Update
  patches.suse/ipvlan-add-ipvlan_route_v6_outbound-helper.patch
  (git-fixes CVE-2023-52796 bsc#1224930).
- Update
  patches.suse/jffs2-prevent-xattr-node-from-overflowing-the-eraseblock.patch
  (git-fixes CVE-2024-38599 bsc#1226848).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-dbFindLeaf.patch
  (git-fixes CVE-2023-52799 bsc#1225472).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-diAlloc.patch
  (git-fixes CVE-2023-52805 bsc#1225553).
- Update
  patches.suse/kunit-fortify-Fix-mismatched-kvalloc-vfree-usage.patch
  (git-fixes CVE-2024-38617 bsc#1226859).
- Update
  patches.suse/lib-generic-radix-tree.c-Don-t-overflow-in-peek.patch
  (git-fixes CVE-2021-47432 bsc#1225391).
- Update
  patches.suse/lib-test_hmm.c-handle-src_pfns-and-dst_pfns-allocati.patch
  (git-fixes CVE-2024-38543 bsc#1226594).
- Update
  patches.suse/locking-ww_mutex-test-Fix-potential-workqueue-corrup.patch
  (bsc#1219953 CVE-2023-52836 bsc#1225609).
- Update
  patches.suse/md-Don-t-ignore-suspended-array-in-md_check_recovery-1baa.patch
  (bsc#1219596 CVE-2024-26758).
- Update
  patches.suse/media-atomisp-ssh_css-Fix-a-null-pointer-dereference.patch
  (git-fixes CVE-2024-38547 bsc#1226632).
- Update
  patches.suse/media-bttv-fix-use-after-free-error-due-to-btv-timeo.patch
  (git-fixes CVE-2023-52847 bsc#1225588).
- Update
  patches.suse/media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch
  (git-fixes CVE-2023-52764 bsc#1225571).
- Update
  patches.suse/media-hantro-Check-whether-reset-op-is-defined-befor.patch
  (git-fixes CVE-2023-52850 bsc#1225014).
- Update
  patches.suse/media-i2c-et8ek8-Don-t-strip-remove-function-when-dr.patch
  (git-fixes CVE-2024-38611 bsc#1226760).
- Update
  patches.suse/media-imon-fix-access-to-invalid-resource-for-the-se.patch
  (git-fixes CVE-2023-52754 bsc#1225490).
- Update
  patches.suse/media-lgdt3306a-Add-a-check-against-null-pointer-def.patch
  (stable-fixes CVE-2022-48772 bsc#1226976).
- Update
  patches.suse/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch
  (git-fixes CVE-2024-38621 bsc#1226895).
- Update
  patches.suse/media-vidtv-mux-Add-check-and-kfree-for-kstrdup.patch
  (git-fixes CVE-2023-52841 bsc#1225592).
- Update patches.suse/media-vidtv-psi-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52844 bsc#1225590).
- Update
  patches.suse/mfd-qcom-spmi-pmic-Fix-revid-implementation.patch
  (git-fixes CVE-2023-52765 bsc#1225029).
- Update
  patches.suse/misc-microchip-pci1xxxx-fix-double-free-in-the-error.patch
  (git-fixes CVE-2024-36973 bsc#1226457).
- Update
  patches.suse/net-hns3-fix-out-of-bounds-access-may-occur-when-coa.patch
  (git-fixes CVE-2023-52807 bsc#1225097).
- Update
  patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch
  (git-fixes CVE-2024-36962 bsc#1225827).
- Update
  patches.suse/net-mlx5-Fix-peer-devlink-set-for-SF-representor-dev.patch
  (git-fixes CVE-2024-38595 bsc#1226741).
- Update
  patches.suse/net-mlx5e-Track-xmit-submission-to-PTP-WQ-after-popu.patch
  (jsc#PED-3311 CVE-2023-52782 bsc#1225103).
- Update
  patches.suse/net-mvneta-fix-calls-to-page_pool_get_stats.patch
  (git-fixes CVE-2023-52780 bsc#1224933).
- Update
  patches.suse/net-wangxun-fix-kernel-panic-due-to-null-pointer.patch
  (git-fixes CVE-2023-52783 bsc#1225104).
- Update
  patches.suse/netfilter-complete-validation-of-user-input.patch
  (git-fixes CVE-2024-35896 bsc#1224662 CVE-2024-35962
  bsc#1224583).
- Update
  patches.suse/nfc-nci-Fix-uninit-value-in-nci_rx_work.patch
  (git-fixes CVE-2024-38381 bsc#1226878).
- Update
  patches.suse/nilfs2-fix-nilfs_empty_dir-misjudgment-and-long-loop.patch
  (git-fixes CVE-2024-39469 bsc#1226992).
- Update
  patches.suse/nilfs2-fix-potential-hang-in-nilfs_detach_log_writer.patch
  (git-fixes CVE-2024-38582 bsc#1226658).
- Update
  patches.suse/nilfs2-fix-use-after-free-of-timer-for-log-writer-th.patch
  (git-fixes CVE-2024-38583 bsc#1226777).
- Update
  patches.suse/of-module-add-buffer-overflow-check-in-of_modalias.patch
  (git-fixes CVE-2024-38541 bsc#1226587).
- Update
  patches.suse/padata-Fix-refcnt-handling-in-padata_free_shell.patch
  (git-fixes CVE-2023-52854 bsc#1225584).
- Update
  patches.suse/perf-core-Bail-out-early-if-the-request-AUX-area-is-out-of-bound.patch
  (git-fixes CVE-2023-52835 bsc#1225602).
- Update
  patches.suse/platform-x86-wmi-Fix-opening-of-char-device.patch
  (git-fixes CVE-2023-52864 bsc#1225132).
- Update
  patches.suse/powerpc-pseries-iommu-LPAR-panics-during-boot-up-wit.patch
  (bsc#1222011 ltc#205900 CVE-2024-36926 bsc#1225829).
- Update patches.suse/pstore-platform-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52869 bsc#1225050).
- Update
  patches.suse/remoteproc-mediatek-Make-sure-IPI-buffer-fits-in-L2T.patch
  (git-fixes CVE-2024-36965 bsc#1226149).
- Update
  patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch
  (git-fixes CVE-2024-38601 bsc#1226876).
- Update
  patches.suse/s390-dasd-protect-device-queue-against-concurrent-access.patch
  (git-fixes bsc#1217481 CVE-2023-52774 bsc#1225572).
- Update
  patches.suse/scsi-hisi_sas-Set-debugfs_dir-pointer-to-NULL-after-removing-debugfs.patch
  (git-fixes CVE-2023-52808 bsc#1225555).
- Update
  patches.suse/scsi-ibmvfc-Remove-BUG_ON-in-the-case-of-an-empty-ev.patch
  (bsc#1209834 ltc#202097 CVE-2023-52811 bsc#1225559).
- Update
  patches.suse/scsi-libfc-Fix-potential-NULL-pointer-dereference-in-fc_lport_ptp_setup.patch
  (git-fixes CVE-2023-52809 bsc#1225556).
- Update
  patches.suse/scsi-lpfc-Move-NPIV-s-transport-unregistration-to-af.patch
  (bsc#1221777 CVE-2024-36952 bsc#1225898).
- Update
  patches.suse/scsi-lpfc-Release-hbalock-before-calling-lpfc_worker.patch
  (bsc#1221777 CVE-2024-36924 bsc#1225820).
- Update
  patches.suse/serial-max3100-Lock-port-lock-when-calling-uart_hand.patch
  (git-fixes CVE-2024-38634 bsc#1226868).
- Update
  patches.suse/serial-max3100-Update-uart_driver_registered-on-driv.patch
  (git-fixes CVE-2024-38633 bsc#1226867).
- Update
  patches.suse/soc-qcom-llcc-Handle-a-second-device-without-data-co.patch
  (git-fixes CVE-2023-52871 bsc#1225534).
- Update
  patches.suse/soundwire-cadence-fix-invalid-PDI-offset.patch
  (stable-fixes CVE-2024-38635 bsc#1226863).
- Update patches.suse/speakup-Fix-sizeof-vs-ARRAY_SIZE-bug.patch
  (git-fixes CVE-2024-38587 bsc#1226780).
- Update patches.suse/spi-Fix-null-dereference-on-suspend.patch
  (git-fixes CVE-2023-52749 bsc#1225476).
- Update
  patches.suse/thermal-core-prevent-potential-string-overflow.patch
  (git-fixes CVE-2023-52868 bsc#1225044).
- Update
  patches.suse/thermal-drivers-qcom-lmh-Check-for-SCM-availability-.patch
  (git-fixes CVE-2024-39466 bsc#1227089).
- Update
  patches.suse/thermal-drivers-tsens-Fix-null-pointer-dereference.patch
  (git-fixes CVE-2024-38571 bsc#1226737).
- Update
  patches.suse/thermal-intel-powerclamp-fix-mismatch-in-get-functio.patch
  (git-fixes CVE-2023-52794 bsc#1225028).
- Update
  patches.suse/tls-fix-NULL-deref-on-tls_sw_splice_eof-with-empty-r.patch
  (jsc#PED-6831 CVE-2023-52767 bsc#1224998).
- Update
  patches.suse/tpm_tis_spi-Account-for-SPI-header-when-allocating-T.patch
  (git-fixes CVE-2024-36477 bsc#1226840).
- Update
  patches.suse/tracing-Have-trace_event_file-have-ref-counters.patch
  (git-fixes CVE-2023-52879 bsc#1225101).
- Update
  patches.suse/tracing-trigger-Fix-to-return-error-if-failed-to-alloc-snapshot.patch
  (git-fixes CVE-2024-26920).
- Update
  patches.suse/tty-n_gsm-fix-race-condition-in-status-line-change-o.patch
  (git-fixes CVE-2023-52872 bsc#1225591).
- Update
  patches.suse/tty-n_gsm-require-CAP_NET_ADMIN-to-attach-N_GSM0710-.patch
  (bsc#1222619 CVE-2023-52880).
- Update
  patches.suse/tty-vcc-Add-check-for-kstrdup-in-vcc_probe.patch
  (git-fixes CVE-2023-52789 bsc#1225180).
- Update
  patches.suse/usb-config-fix-iteration-issue-in-usb_get_bos_descri.patch
  (git-fixes CVE-2023-52781 bsc#1225092).
- Update
  patches.suse/usb-dwc3-Wait-unconditionally-after-issuing-EndXfer-.patch
  (git-fixes CVE-2024-36977 bsc#1226513).
- Update
  patches.suse/usb-gadget-u_audio-Fix-race-condition-use-of-control.patch
  (git-fixes CVE-2024-38628 bsc#1226911).
- Update
  patches.suse/usb-storage-alauda-Check-whether-the-media-is-initia.patch
  (git-fixes CVE-2024-38619 bsc#1226861).
- Update
  patches.suse/usb-typec-tcpm-Fix-NULL-pointer-dereference-in-tcpm_.patch
  (git-fixes CVE-2023-52877 bsc#1224944).
- Update
  patches.suse/vhost-vdpa-fix-use-after-free-in-vhost_vdpa_probe.patch
  (jsc#PED-3311 CVE-2023-52795 bsc#1225085).
- Update
  patches.suse/virtio-blk-fix-implicit-overflow-on-virtio_max_dma_s.patch
  (git-fixes CVE-2023-52762 bsc#1225573).
- Update
  patches.suse/virtio-vsock-Fix-uninit-value-in-virtio_transport_re.patch
  (jsc#PED-5505 CVE-2023-52842 bsc#1225025).
- Update
  patches.suse/watchdog-cpu5wdt.c-Fix-use-after-free-bug-caused-by-.patch
  (git-fixes CVE-2024-38630 bsc#1226908).
- Update
  patches.suse/wifi-ar5523-enable-proper-endpoint-verification.patch
  (git-fixes CVE-2024-38565 bsc#1226747).
- Update
  patches.suse/wifi-ath11k-fix-dfs-radar-event-locking.patch
  (git-fixes CVE-2023-52798 bsc#1224947).
- Update
  patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch
  (git-fixes CVE-2023-52777 bsc#1224992).
- Update patches.suse/wifi-ath11k-fix-htt-pktlog-locking.patch
  (git-fixes CVE-2023-52800).
- Update
  patches.suse/wifi-ath12k-fix-dfs-radar-and-temperature-event-lock.patch
  (git-fixes CVE-2023-52776 bsc#1225090).
- Update
  patches.suse/wifi-ath12k-fix-htt-mlo-offset-event-locking.patch
  (git-fixes CVE-2023-52769 bsc#1225001).
- Update
  patches.suse/wifi-ath12k-fix-out-of-bound-access-of-qmi_invoke_ha.patch
  (git-fixes CVE-2024-38572 bsc#1226776).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-read-in-ath12k.patch
  (git-fixes CVE-2023-52827 bsc#1225078).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-write-in-ath12.patch
  (git-fixes CVE-2023-52829 bsc#1225081).
- Update
  patches.suse/wifi-brcmfmac-pcie-handle-randbuf-allocation-failure.patch
  (git-fixes CVE-2024-38575 bsc#1226612).
- Update
  patches.suse/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch
  (git-fixes CVE-2024-38567 bsc#1226769).
- Update
  patches.suse/wifi-carl9170-re-fix-fortified-memset-warning.patch
  (git-fixes CVE-2024-38616 bsc#1226852).
- Update
  patches.suse/wifi-mac80211-don-t-return-unset-power-in-ieee80211_.patch
  (git-fixes CVE-2023-52832 bsc#1225577).
- Update
  patches.suse/wifi-nl80211-Avoid-address-calculations-via-out-of-b.patch
  (git-fixes CVE-2024-38562 bsc#1226788).
- Update
  patches.suse/wifi-wilc1000-use-vmm_table-as-array-in-wilc-struct.patch
  (git-fixes CVE-2023-52768 bsc#1225004).
- Update
  patches.suse/x86-tdx-Zero-out-the-missing-RSI-in-TDX_HYPERCALL-macro.patch
  (jsc#PED-5824 CVE-2023-52874 bsc#1225049).
- commit 33efdc4</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835204">- tcp: Use refcount_inc_not_zero() in tcp_twsk_unique()
  (CVE-2024-36904 bsc#1225732).
- commit d578dcc</changelog>
  <changelog author="heming.zhao@suse.com" date="1719921600">- gfs2: Fix potential glock use-after-free on unmount (bsc#1226775
  CVE-2024-38570).
- gfs2: Rename sd_{ glock =&gt; kill }_wait (bsc#1226775
  CVE-2024-38570).
- commit f3adbca</changelog>
  <changelog author="tiwai@suse.de" date="1719921601">- Correct SCSI patch references (bsc#1225767 CVE-2024-36919 bsc#1226785 CVE-2024-38559)
- commit e8ea587</changelog>
  <changelog author="tiwai@suse.de" date="1719921602">- mtd: rawnand: rockchip: ensure NVDDR timings are rejected
  (git-fixes).
- mtd: rawnand: Bypass a couple of sanity checks during NAND
  identification (git-fixes).
- mtd: rawnand: Fix the nand_read_data_op() early check
  (git-fixes).
- mtd: rawnand: Ensure ECC configuration is propagated to upper
  layers (git-fixes).
- commit e545951</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1719921603">- kernel-doc: fix struct_group_tagged() parsing (git-fixes).
- commit e3a2a2e</changelog>
  <changelog author="fdmanana@suse.com" date="1719921604">- btrfs: fix crash on racing fsync and size-extending write into
  prealloc (bsc#1227101 CVE-2024-37354).
- commit 1d355af</changelog>
  <changelog author="vbabka@suse.cz" date="1719921605">- virt: acrn: stop using follow_pfn (CVE-2024-38610 bsc#1226758).
- commit c2ea51b</changelog>
  <changelog author="vbabka@suse.cz" date="1719921606">- drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
  (CVE-2024-38610 bsc#1226758).
- commit 7069ac2</changelog>
  <changelog author="rhopkins@suse.de" date="1719921607">- hsr: Prevent use after free in prp_create_tagged_frame()
  (CVE-2023-52846 bsc#1225098).
- commit cf63988</changelog>
  <changelog author="krisman@suse.de" date="1719921608">- io_uring: Fix io_cqring_wait() not restoring sigmask on
  get_timespec64() failure (git-fixes).
- commit e640a65</changelog>
  <changelog author="krisman@suse.de" date="1719921609">- io_uring: check for non-NULL file pointer in io_file_can_poll()
  (bsc#1226990 CVE-2024-39371).
- io_uring/io-wq: Use set_bit() and test_bit() at worker-&gt;flags
  (git-fixes).
- io_uring/sqpoll: work around a potential audit memory leak
  (git-fixes).
- commit 24603fc</changelog>
  <changelog author="krisman@suse.de" date="1719921610">- io_uring/rsrc: fix incorrect assignment of iter-&gt;nr_segs in
  io_import_fixed (git-fixes).
- io_uring/rsrc: don't lock while !TASK_RUNNING (git-fixes).
- io_uring/io-wq: avoid garbage value of 'match' in
  io_wq_enqueue() (git-fixes).
- commit 7d3e252</changelog>
</package>
<package pkgid="3b8046e561d03b9ff2ada91d2a82ab3b38105bfdd2fa46732b45a51a7bb4210a" name="dtb-altera" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.17.1"/>
  <changelog author="tiwai@suse.de" date="1722081600">- auxdisplay: ht16k33: Drop reference after LED registration
  (git-fixes).
- ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
  on unprepare (git-fixes).
- ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
- ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
  reachable (git-fixes).
- ASoC: sof: amd: fix for firmware reload failure in Vangogh
  platform (git-fixes).
- ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
- ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
  (git-fixes).
- ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
- ALSA: ump: Don't update FB name for static blocks (git-fixes).
- drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
- drm/i915/gt: Do not consider preemption during execlists_dequeue
  for gen8 (git-fixes).
- drm/i915/dp: Don't switch the LTTPR mode on an active link
  (git-fixes).
- commit d7e2deb</changelog>
  <changelog author="tiwai@suse.de" date="1722081601">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
</package>
<package pkgid="db2ac24f521da79ae4a77ae8a9f1de889434d45d455cf18295ced16dfdf570ca" name="dtb-altera" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.7.1"/>
  <changelog author="mkubecek@suse.cz" date="1717416000">- netfilter: nf_tables: release mutex after nft_gc_seq_end from
  abort path (CVE-2024-26925 bsc#1223390).
- commit 578a709</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717416001">- Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
  The L3 bsc#1225765 was created seperately since our customer requires
  PTF.
- Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
- Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
- Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
- Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
- commit 054635e</changelog>
  <changelog author="msuchanek@suse.de" date="1717416002">- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
- powerpc/uaccess: Fix build errors seen with GCC 13/14
  (bsc#1194869).
- commit 46b5d84</changelog>
  <changelog author="msuchanek@suse.de" date="1717416003">- blacklist.conf: PPC fsl_msi is not used
- commit ae6590d</changelog>
  <changelog author="msuchanek@suse.de" date="1717416004">- powerpc/pseries/lparcfg: drop error message from guest name
  lookup (bsc#1187716 ltc#193451 git-fixes).
- commit ceab637</changelog>
  <changelog author="mfranc@suse.cz" date="1717416005">- Update
  patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
  (git-fixes CVE-2024-36955).
- Update
  patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
  (git-fixes bsc#1225715 CVE-2024-36906).
- Update
  patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
  (git-fixes bsc#1225579 CVE-2024-36011).
- Update
  patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
  (git-fixes bsc#1225578 CVE-2024-36013).
- Update
  patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
  (git-fixes bsc#1225502 CVE-2024-36012).
- Update
  patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
  (git-fixes bsc#1225722 CVE-2024-36880).
- Update
  patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
  (git-fixes CVE-2024-36942).
- Update
  patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
  (git-fixes bsc#1225720 CVE-2024-36032).
- Update
  patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
  (git-fixes bsc#1223749 CVE-2024-26990).
- Update
  patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
  (git-fixes bsc#1223692 CVE-2024-26992).
- Update
  patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
  (stable-fixes CVE-2024-36944).
- Update
  patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
  (git-fixes bsc#1225734 CVE-2024-36896).
- Update
  patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
  (stable-fixes CVE-2024-36949).
- Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
  (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
- Update
  patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
  (git-fixes bsc#1225692 CVE-2023-52882).
- Update
  patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
  (git-fixes CVE-2024-26761).
- Update
  patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
  (stable-fixes bsc#1225735 CVE-2024-36897).
- Update
  patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
  (stable-fixes bsc#1225705 CVE-2024-36026).
- Update
  patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
  (stable-fixes CVE-2024-36951).
- Update
  patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
  (git-fixes bsc#1225593 CVE-2024-36014).
- Update
  patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
  (stable-fixes bsc#1225728 CVE-2024-36885).
- Update
  patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
  (git-fixes bsc#1225773 CVE-2024-36936).
- Update
  patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
  (stable-fixes CVE-2024-36950).
- Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
  (git-fixes bsc#1225736 CVE-2024-36898).
- Update
  patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
  (git-fixes bsc#1225698 CVE-2024-36020).
- Update
  patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
  (git-fixes bsc#1225710 CVE-2024-36891).
- Update
  patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
  (git-fixes bsc#1225714 CVE-2024-36890).
- Update
  patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
  (git-fixes bsc#1225708 CVE-2024-36029).
- Update
  patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
  (git-fixes bsc#1225699 CVE-2024-36021).
- Update
  patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
  (git-fixes CVE-2024-26943).
- Update
  patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
  (git-fixes bsc#1225694 CVE-2024-36018).
- Update
  patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
  (git-fixes CVE-2024-36940).
- Update
  patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
  (git-fixes CVE-2024-36959).
- Update
  patches.suse/ppdev-Add-an-error-check-in-register_device.patch
  (git-fixes bsc#1225640 CVE-2024-36015).
- Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
  CVE-2024-36947).
- Update
  patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
  (git-fixes bsc#1225695 CVE-2024-36019).
- Update
  patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
  (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
- Update
  patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
  (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
- Update
  patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
  (git-fixes bsc#1225704 CVE-2024-36025).
- Update
  patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
  (git-fixes CVE-2024-36930).
- Update
  patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
  (bsc#1224331 bsc#1224602 CVE-2024-35814).
- Update
  patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
  (git-fixes bsc#1225642 CVE-2024-36016).
- Update
  patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
  (git-fixes bsc#1225749 CVE-2024-36894).
- Update
  patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
  (git-fixes bsc#1225750 CVE-2024-36895).
- Update
  patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
  (git-fixes bsc#1225748 CVE-2024-36893).
- Update
  patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
  (stable-fixes bsc#1225769 CVE-2024-36921).
- Update
  patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
  (stable-fixes CVE-2024-36922).
- Update
  patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
  (git-fixes CVE-2024-36941).
- Update
  patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
  (git-fixes bsc#1224742 CVE-2024-35803).
- commit 539780f</changelog>
  <changelog author="dwagner@suse.de" date="1717416006">- nvmet: fix ns enable/disable possible hang (git-fixes).
- nvme-multipath: fix io accounting on failover (git-fixes).
- nvme: fix multipath batched completion accounting (git-fixes).
- commit ed3b392</changelog>
  <changelog author="dwagner@suse.de" date="1717416007">- scsi: lpfc: Copyright updates for 14.4.0.2 patches
  (bsc#1225842).
- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
  (bsc#1225842).
  Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
  (bsc#1225842).
- scsi: lpfc: Clear deferred RSCN processing flag when driver
  is unloading (bsc#1225842).
- scsi: lpfc: Update logging of protection type for T10 DIF I/O
  (bsc#1225842).
- scsi: lpfc: Change default logging level for unsolicited CT
  MIB commands (bsc#1225842).
- commit 5a56384</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416008">- smb: client: fix mount when dns_resolver key is not available
  (git-fixes, bsc#1225172).
- commit 28edb5c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416009">- cifs: fix leak of iface for primary channel (git-fixes,
  bsc#1225172).
- commit b7eb8e8</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416010">- Revert "cifs: reconnect work should have reference on server
  struct" (git-fixes, bsc#1225172).
- commit 3ca4c0c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416011">- smb: client: fix parsing of SMB3.1.1 POSIX create context
  (git-fixes, bsc#1225172).
- commit 5f27f69</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416012">- cifs: failure to add channel on iface should bump up weight
  (git-fixes, bsc#1225172).
- commit 007b237</changelog>
  <changelog author="tonyj@suse.de" date="1717416013">- perf/x86: Fix out of range data (git-fixes).
- perf/x86/intel/ds: Don't clear -&gt;pebs_data_cfg for the last
  PEBS event (git-fixes).
- perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
- commit 664d77f</changelog>
  <changelog author="dsterba@suse.com" date="1717588800">- blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
- Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
  Quoting bsc#1225945#c11:
  "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
  transaction for every subvol create")
  ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
  unwritten extent buffer after snapshotting a new subvolume") was never
  backported."
- commit d947258</changelog>
  <changelog author="tonyj@suse.de" date="1717588801">- perf pmu: Count sys and cpuid JSON events separately (git
  fixes).
- perf stat: Don't display metric header for non-leader uncore
  events (git-fixes).
- perf daemon: Fix file leak in daemon_session__control
  (git-fixes).
- perf symbols: Fix ownership of string in dso__load_vmlinux()
  (git-fixes).
- perf thread: Fixes to thread__new() related to initializing comm
  (git-fixes).
- perf report: Avoid SEGV in report__setup_sample_type()
  (git-fixes).
- perf ui browser: Don't save pointer to stack memory (git-fixes).
- perf bench internals inject-build-id: Fix trap divide when
  collecting just one DSO (git-fixes).
- perf intel-pt: Fix unassigned instruction op (discovered by
  MemorySanitizer) (git-fixes).
- perf test shell arm_coresight: Increase buffer size for
  Coresight basic tests (git-fixes).
- perf docs: Document bpf event modifier (git-fixes).
- perf bench uprobe: Remove lib64 from libc.so.6 binary path
  (git-fixes).
- perf record: Fix debug message placement for test consumption
  (git-fixes).
- perf tests: Apply attributes to all events in object code
  reading test (git-fixes).
- perf tests: Make "test data symbol" more robust on Neoverse N1
  (git-fixes).
- perf annotate: Fix annotation_calc_lines() to pass correct
  address to get_srcline() (git-fixes).
- perf stat: Do not fail on metrics on s390 z/VM systems
  (git-fixes).
- perf sched timehist: Fix -g/--call-graph option failure
  (git-fixes).
- perf annotate: Get rid of duplicate --group option item
  (git-fixes).
- perf probe: Add missing libgen.h header needed for using
  basename() (git-fixes).
- perf record: Delete session after stopping sideband thread
  (git-fixes).
- perf auxtrace: Fix multiple use of --itrace option (git-fixes).
- perf script: Show also errors for --insn-trace option
  (git-fixes).
- perf lock contention: Add a missing NULL check (git-fixes).
- perf vendor events amd: Fix Zen 4 cache latency events
  (git-fixes).
- libperf evlist: Avoid out-of-bounds access (git-fixes).
- perf pmu: Fix a potential memory leak in perf_pmu__lookup()
  (git-fixes).
- perf print-events: make is_event_supported() more robust
  (git-fixes).
- perf list: fix short description for some cache events
  (git-fixes).
- perf metric: Don't remove scale from counts (git-fixes).
- perf stat: Avoid metric-only segv (git-fixes).
- perf expr: Fix "has_event" function for metric style events
  (git-fixes).
- perf srcline: Add missed addr2line closes (git-fixes).
- perf thread_map: Free strlist on normal path in
  thread_map__new_by_tid_str() (git-fixes).
- perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
- perf jevents: Drop or simplify small integer values (git-fixes).
- perf evsel: Fix duplicate initialization of data-&gt;id in
  evsel__parse_sample() (git-fixes).
- perf pmu: Treat the msr pmu as software (git-fixes).
- perf record: Check conflict between '--timestamp-filename'
  option and pipe mode before recording (git-fixes).
- perf record: Fix possible incorrect free in
  record__switch_output() (git-fixes).
- perf vendor events amd: Add Zen 4 memory controller events
  (git-fixes).
- perf top: Uniform the event name for the hybrid machine
  (git-fixes).
- perf top: Use evsel's cpus to replace user_requested_cpus
  (git-fixes).
- commit a1f9340</changelog>
  <changelog author="tonyj@suse.de" date="1717675200">- perf ui browser: Avoid SEGV on title (git fixes).
- commit 1578c22</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675201">- inet: inet_defrag: prevent sk release while still in use
  (CVE-2024-26921 bsc#1223138).
- commit 2016faf</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675202">- net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
- commit 7bf5961</changelog>
  <changelog author="tiwai@suse.de" date="1718366400">- Temporarily drop KVM patch that caused a regression (bsc#1226158)
  Delete patches.suse/KVM-x86-pmu-Prioritize-VMX-interception-over-GP-on-R.patch
- commit 33f31da</changelog>
</package>
<package pkgid="b88910bd0a21a57c726a023ed7c92fb202e2e191b5d2d03a50f038ac55495587" name="dtb-amazon" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.14.1"/>
  <changelog author="tiwai@suse.de" date="1719662400">- gpiolib: cdev: Disallow reconfiguration without direction
  (uAPI v1) (git-fixes).
- gpio: davinci: Validate the obtained number of IRQs (git-fixes).
- commit 919ebd1</changelog>
  <changelog author="tiwai@suse.de" date="1719748800">- i2c: testunit: discard write requests while old command is
  running (git-fixes).
- i2c: testunit: don't erase registers after STOP (git-fixes).
- mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
  (git-fixes).
- mmc: sdhci: Do not invert write-protect twice (git-fixes).
- mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
  (git-fixes).
- mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
  (git-fixes).
- commit 448487d</changelog>
  <changelog author="tiwai@suse.de" date="1719748801">- crypto: iaa - Account for cpu-less numa nodes (bsc#1227190).
- commit cd600aa</changelog>
  <changelog author="tiwai@suse.de" date="1719748802">- crypto: deflate - Add aliases to deflate (bsc#1227190).
- commit 27ffd92</changelog>
  <changelog author="tiwai@suse.de" date="1719835200">- ata: ahci: Clean up sysfs file on error (git-fixes).
- ata: libata-core: Fix double free on error (git-fixes).
- ata,scsi: libata-core: Do not leak memory for ata_port struct
  members (git-fixes).
- ata: libata-core: Fix null pointer dereference on error
  (git-fixes).
- kbuild: Fix build target deb-pkg: ln: failed to create hard link
  (git-fixes).
- kbuild: doc: Update default INSTALL_MOD_DIR from extra to
  updates (git-fixes).
- kbuild: Install dtb files as 0644 in Makefile.dtbinst
  (git-fixes).
- counter: ti-eqep: enable clock at probe (git-fixes).
- iio: chemical: bme680: Fix sensor data read operation
  (git-fixes).
- iio: chemical: bme680: Fix overflows in compensate() functions
  (git-fixes).
- iio: chemical: bme680: Fix calibration data variable
  (git-fixes).
- iio: chemical: bme680: Fix pressure value output (git-fixes).
- iio: accel: fxls8962af: select IIO_BUFFER &amp; IIO_KFIFO_BUF
  (git-fixes).
- iio: adc: ad7266: Fix variable checking bug (git-fixes).
- iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
  (git-fixes).
- serial: bcm63xx-uart: fix tx after conversion to
  uart_port_tx_limited() (git-fixes).
- serial: core: introduce uart_port_tx_limited_flags()
  (git-fixes).
- Revert "serial: core: only stop transmit when HW fifo is empty"
  (git-fixes).
- tty: mcf: MCF54418 has 10 UARTS (git-fixes).
- usb: gadget: aspeed_udc: fix device address configuration
  (git-fixes).
- usb: dwc3: core: remove lock of otg mode during gadget
  suspend/resume to avoid deadlock (git-fixes).
- usb: typec: ucsi: glink: fix child node release in probe
  function (git-fixes).
- usb: musb: da8xx: fix a resource leak in probe() (git-fixes).
- usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  (git-fixes).
- usb: gadget: printer: fix races against disable (git-fixes).
- PCI/MSI: Fix UAF in msi_capability_init (git-fixes).
- commit a2ea5a9</changelog>
  <changelog author="ptesarik@suse.com" date="1719835201">- net: ena: Fix redundant device NUMA node override
  (jsc#PED-8688).
- commit 6ad6684</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835202">- tcp: do not accept ACK of bytes we never sent (CVE-2023-52881
  bsc#1225611).
- commit 16404a6</changelog>
  <changelog author="mhocko@suse.com" date="1719835203">- Update
  patches.suse/1352-drm-amdgpu-Fix-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52883
  bsc#1226630).
- Update
  patches.suse/9p-add-missing-locking-around-taking-dentry-fid-list.patch
  (git-fixes CVE-2024-39463 bsc#1227090).
- Update
  patches.suse/ALSA-Fix-deadlocks-with-kctl-removals-at-disconnecti.patch
  (stable-fixes CVE-2024-38600 bsc#1226864).
- Update
  patches.suse/ALSA-core-Fix-NULL-module-pointer-assignment-at-card.patch
  (git-fixes CVE-2024-38605 bsc#1226740).
- Update
  patches.suse/ALSA-hda-Fix-possible-null-ptr-deref-when-assigning-.patch
  (git-fixes CVE-2023-52806 bsc#1225554).
- Update
  patches.suse/ALSA-hda-cs_dsp_ctl-Use-private_free-for-control-cle.patch
  (git-fixes CVE-2024-38388 bsc#1226890).
- Update
  patches.suse/ALSA-timer-Set-lower-bound-of-start-tick-time.patch
  (stable-fixes git-fixes CVE-2024-38618 bsc#1226754).
- Update
  patches.suse/ASoC-kirkwood-Fix-potential-NULL-dereference.patch
  (git-fixes CVE-2024-38550 bsc#1226633).
- Update
  patches.suse/ASoC-mediatek-Assign-dummy-when-codec-not-specified-.patch
  (git-fixes CVE-2024-38551 bsc#1226761).
- Update
  patches.suse/Bluetooth-btusb-Add-date-evt_skb-is-NULL-check.patch
  (git-fixes CVE-2023-52833 bsc#1225595).
- Update
  patches.suse/Bluetooth-hci_core-Fix-possible-buffer-overflow.patch
  (git-fixes CVE-2024-26889).
- Update
  patches.suse/HID-uclogic-Fix-user-memory-access-bug-in-uclogic_pa.patch
  (git-fixes CVE-2023-52866 bsc#1225120).
- Update
  patches.suse/IB-mlx5-Fix-init-stage-error-handling-to-avoid-doubl.patch
  (jsc#PED-6864 CVE-2023-52851 bsc#1225587).
- Update
  patches.suse/Input-cyapa-add-missing-input-core-locking-to-suspen.patch
  (git-fixes CVE-2023-52884 bsc#1226764).
- Update
  patches.suse/Input-synaptics-rmi4-fix-use-after-free-in-rmi_unreg.patch
  (git-fixes CVE-2023-52840 bsc#1224928).
- Update
  patches.suse/KEYS-trusted-Do-not-use-WARN-when-encode-fails.patch
  (git-fixes CVE-2024-36975 bsc#1226520).
- Update
  patches.suse/KEYS-trusted-Fix-memory-leak-in-tpm2_key_encode.patch
  (git-fixes CVE-2024-36967 bsc#1226131).
- Update
  patches.suse/RDMA-cma-Fix-kmemleak-in-rdma_core-observed-during-b.patch
  (git-fixes CVE-2024-38539 bsc#1226608).
- Update patches.suse/RDMA-hns-Fix-UAF-for-cq-async-event.patch
  (git-fixes CVE-2024-38545 bsc#1226595).
- Update
  patches.suse/RDMA-hns-Fix-deadlock-on-SRQ-async-events.patch
  (git-fixes CVE-2024-38591 bsc#1226738).
- Update
  patches.suse/RDMA-hns-Modify-the-print-level-of-CQE-error.patch
  (git-fixes CVE-2024-38590 bsc#1226839).
- Update
  patches.suse/RDMA-rxe-Fix-seg-fault-in-rxe_comp_queue_pkt.patch
  (git-fixes CVE-2024-38544 bsc#1226597).
- Update
  patches.suse/SUNRPC-Fix-RPC-client-cleaned-up-the-freed-pipefs-de.patch
  (git-fixes CVE-2023-52803 bsc#1225008).
- Update patches.suse/af_unix-Clear-stale-u-oob_skb.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-35970 bsc#1224584).
- Update
  patches.suse/af_unix-Drop-oob_skb-ref-before-purging-queue-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26750 bsc#1222617).
- Update
  patches.suse/af_unix-Fix-task-hung-while-purging-oob_skb-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26780 bsc#1222588).
- Update
  patches.suse/af_unix-Update-unix_sk-sk-oob_skb-under-sk_receive_queue-lock.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-36972 bsc#1226163).
- Update
  patches.suse/arm64-Restrict-CPU_BIG_ENDIAN-to-GNU-as-or-LLVM-IAS-.patch
  (git-fixes CVE-2023-52750 bsc#1225485).
- Update
  patches.suse/atl1c-Work-around-the-DMA-RX-overflow-issue.patch
  (git-fixes CVE-2023-52834 bsc#1225599).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issue-of-net_device.patch
  (git-fixes CVE-2024-38554 bsc#1226742).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issues-of-ax25_dev.patch
  (git-fixes CVE-2024-38602 bsc#1226613).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-reorder-of-WRITE-lqueued.patch
  (bsc#1225605 CVE-2024-38384 bsc#1226938).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-resetting-io-stat.patch
  (bsc#1225605 CVE-2024-38663 bsc#1226939).
- Update
  patches.suse/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch
  (git-fixes CVE-2024-38540 bsc#1226582).
- Update
  patches.suse/bonding-stop-the-device-in-bond_setup_by_slave.patch
  (git-fixes CVE-2023-52784 bsc#1224946).
- Update
  patches.suse/can-dev-can_put_echo_skb-don-t-crash-kernel-if-can_p.patch
  (git-fixes CVE-2023-52878 bsc#1225000).
- Update
  patches.suse/clk-mediatek-clk-mt2701-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52875 bsc#1225096).
- Update
  patches.suse/clk-mediatek-clk-mt6765-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52870 bsc#1224937).
- Update
  patches.suse/clk-mediatek-clk-mt6779-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52873 bsc#1225589).
- Update
  patches.suse/clk-mediatek-clk-mt6797-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52865 bsc#1225086).
- Update
  patches.suse/clk-mediatek-clk-mt7629-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52858 bsc#1225566).
- Update
  patches.suse/clk-mediatek-clk-mt7629-eth-Add-check-for-mtk_alloc_.patch
  (git-fixes CVE-2023-52876 bsc#1225036).
- Update
  patches.suse/cppc_cpufreq-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38573 bsc#1226739).
- Update patches.suse/cpufreq-exit-callback-is-optional.patch
  (git-fixes CVE-2024-38615 bsc#1226592).
- Update patches.suse/crypto-bcm-Fix-pointer-arithmetic.patch
  (git-fixes CVE-2024-38579 bsc#1226637).
- Update
  patches.suse/crypto-pcrypt-Fix-hungtask-for-PADATA_RESET.patch
  (git-fixes CVE-2023-52813 bsc#1225527).
- Update patches.suse/cxl-mem-Fix-shutdown-order.patch (git-fixes
  CVE-2023-52849 bsc#1224949).
- Update
  patches.suse/cxl-region-Do-not-try-to-cleanup-after-cxl_region_se.patch
  (git-fixes CVE-2023-52792 bsc#1225477).
- Update patches.suse/cxl-region-Fix-cxlr_pmem-leaks.patch
  (git-fixes CVE-2024-38391 bsc#1226894).
- Update
  patches.suse/dma-buf-sw-sync-don-t-enable-IRQ-from-sync_print_obj.patch
  (git-fixes CVE-2024-38780 bsc#1226886).
- Update
  patches.suse/dma-mapping-benchmark-fix-node-id-validation.patch
  (git-fixes CVE-2024-34777 bsc#1226796).
- Update
  patches.suse/dma-mapping-benchmark-handle-NUMA_NO_NODE-correctly.patch
  (git-fixes CVE-2024-39277 bsc#1226909).
- Update
  patches.suse/dmaengine-idxd-Avoid-unnecessary-destruction-of-file.patch
  (git-fixes CVE-2024-38629 bsc#1226905).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Pola.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52819
  bsc#1225532).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-SMU7.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52818
  bsc#1225530).
- Update
  patches.suse/drm-amd-check-num-of-link-levels-when-update-pcie-pa.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52812
  bsc#1225564).
- Update
  patches.suse/drm-amd-display-Avoid-NULL-dereference-of-timing-gen.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52753
  bsc#1225478).
- Update
  patches.suse/drm-amd-display-Fix-division-by-zero-in-setup_dsc_co.patch
  (stable-fixes CVE-2024-36969 bsc#1226155).
- Update
  patches.suse/drm-amd-display-Fix-null-pointer-dereference-in-erro.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52862
  bsc#1225015).
- Update
  patches.suse/drm-amd-display-Fix-potential-index-out-of-bounds-in.patch
  (git-fixes CVE-2024-38552 bsc#1226767).
- Update
  patches.suse/drm-amd-display-fix-a-NULL-pointer-dereference-in-am.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52773
  bsc#1225041).
- Update
  patches.suse/drm-amd-display-fixed-integer-types-and-null-check-l.patch
  (git-fixes CVE-2024-26767).
- Update
  patches.suse/drm-amdgpu-Fix-a-null-pointer-access-when-the-smc_rr.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52817
  bsc#1225569).
- Update
  patches.suse/drm-amdgpu-Fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch
  (git-fixes CVE-2024-39291 bsc#1226934).
- Update
  patches.suse/drm-amdgpu-Fix-potential-null-pointer-derefernce.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52814
  bsc#1225565).
- Update
  patches.suse/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch
  (stable-fixes CVE-2024-39471 bsc#1227096).
- Update
  patches.suse/drm-amdgpu-mes-fix-use-after-free-issue.patch
  (stable-fixes CVE-2024-38581 bsc#1226657).
- Update
  patches.suse/drm-amdgpu-vkms-fix-a-possible-null-pointer-derefere.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52815
  bsc#1225568).
- Update
  patches.suse/drm-amdkfd-Fix-a-race-condition-of-vram-buffer-unref.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52825
  bsc#1225076).
- Update
  patches.suse/drm-amdkfd-Fix-shift-out-of-bounds-issue.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52816
  bsc#1225529).
- Update
  patches.suse/drm-bridge-cdns-mhdp8546-Fix-possible-null-pointer-d.patch
  (git-fixes CVE-2024-38548).
- Update
  patches.suse/drm-bridge-it66121-Fix-invalid-connector-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52861
  bsc#1224941).
- Update
  patches.suse/drm-bridge-lt8912b-Fix-crash-on-bridge-detach.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52856
  bsc#1224932).
- Update
  patches.suse/drm-mediatek-Add-0-size-check-to-mtk_drm_gem_obj.patch
  (git-fixes CVE-2024-38549 bsc#1226735).
- Update
  patches.suse/drm-mediatek-Fix-coverity-issue-with-unintentional-i.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52857
  bsc#1225581).
- Update
  patches.suse/drm-mediatek-Init-ddp_comp-with-devm_kcalloc.patch
  (git-fixes CVE-2024-38592 bsc#1226844).
- Update
  patches.suse/drm-msm-a6xx-Avoid-a-nullptr-dereference-when-speedb.patch
  (git-fixes CVE-2024-38390 bsc#1226891).
- Update
  patches.suse/drm-msm-dpu-Add-callback-function-pointer-check-befo.patch
  (git-fixes CVE-2024-38622 bsc#1226856).
- Update
  patches.suse/drm-panel-fix-a-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52821
  bsc#1225022).
- Update
  patches.suse/drm-panel-panel-tpo-tpg110-fix-a-possible-null-point.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52826
  bsc#1225077).
- Update patches.suse/drm-radeon-possible-buffer-overflow.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52867
  bsc#1225009).
- Update
  patches.suse/drm-vc4-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38546 bsc#1226593).
- Update
  patches.suse/drm-vmwgfx-Fix-invalid-reads-in-fence-signaled-event.patch
  (git-fixes CVE-2024-36960 bsc#1225872).
- Update
  patches.suse/drm-zynqmp_dpsub-Always-register-bridge.patch
  (git-fixes CVE-2024-38664 bsc#1226941).
- Update
  patches.suse/e1000e-change-usleep_range-to-udelay-in-PHY-mdic-acc.patch
  (CVE-2024-39296 bsc#1226989 CVE-2024-36887 bsc#1225731).
- Update
  patches.suse/ecryptfs-Fix-buffer-size-for-tag-66-packet.patch
  (git-fixes CVE-2024-38578 bsc#1226634).
- Update
  patches.suse/efi-libstub-only-free-priv.runtime_map-when-allocate.patch
  (git-fixes CVE-2024-33619 bsc#1226768).
- Update
  patches.suse/fbdev-imsttfb-fix-a-resource-leak-in-probe.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52838
  bsc#1225031).
- Update
  patches.suse/fs-9p-only-translate-RWX-permissions-for-plain-9P200.patch
  (git-fixes CVE-2024-36964 bsc#1225866).
- Update
  patches.suse/fs-jfs-Add-check-for-negative-db_l2nbperpage.patch
  (git-fixes CVE-2023-52810 bsc#1225557).
- Update
  patches.suse/fs-jfs-Add-validity-check-for-db_maxag-and-db_agpref.patch
  (git-fixes CVE-2023-52804 bsc#1225550).
- Update
  patches.suse/ftrace-Fix-possible-use-after-free-issue-in-ftrace_location.patch
  (git-fixes CVE-2024-38588 bsc#1226837).
- Update
  patches.suse/genirq-irqdesc-Prevent-use-after-free-in-irq_find_at.patch
  (git-fixes CVE-2024-38385 bsc#1227085).
- Update patches.suse/gfs2-ignore-negated-quota-changes.patch
  (git-fixes CVE-2023-52759 bsc#1225560).
- Update
  patches.suse/hid-cp2112-Fix-duplicate-workqueue-initialization.patch
  (git-fixes CVE-2023-52853 bsc#1224988).
- Update
  patches.suse/hwmon-axi-fan-control-Fix-possible-NULL-pointer-dere.patch
  (git-fixes CVE-2023-52863 bsc#1225586).
- Update
  patches.suse/i2c-acpi-Unbind-mux-adapters-before-delete.patch
  (git-fixes CVE-2024-39362 bsc#1226995).
- Update
  patches.suse/i2c-core-Run-atomic-i2c-xfer-when-preemptible.patch
  (git-fixes CVE-2023-52791 bsc#1225108).
- Update
  patches.suse/i3c-master-mipi-i3c-hci-Fix-a-kernel-panic-for-acces.patch
  (git-fixes CVE-2023-52763 bsc#1225570).
- Update
  patches.suse/i3c-mipi-i3c-hci-Fix-out-of-bounds-access-in-hci_dma.patch
  (git-fixes CVE-2023-52766).
- Update
  patches.suse/i915-perf-Fix-NULL-deref-bugs-with-drm_dbg-calls.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52788
  bsc#1225106).
- Update
  patches.suse/igb-Fix-string-truncation-warnings-in-igb_set_fw_ver.patch
  (git-fixes CVE-2024-36010 bsc#1225594).
- Update
  patches.suse/iommu-vt-d-Fix-WARN_ON-in-iommu-probe-path.patch
  (git-fixes CVE-2024-35957 bsc#1224673).
- Update
  patches.suse/iommufd-Fix-missing-update-of-domains_itree-after-splitting-iopt
  (jsc#PED-7779 jsc#PED-7780 CVE-2023-52801 bsc#1225006).
- Update
  patches.suse/ipvlan-add-ipvlan_route_v6_outbound-helper.patch
  (git-fixes CVE-2023-52796 bsc#1224930).
- Update
  patches.suse/jffs2-prevent-xattr-node-from-overflowing-the-eraseblock.patch
  (git-fixes CVE-2024-38599 bsc#1226848).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-dbFindLeaf.patch
  (git-fixes CVE-2023-52799 bsc#1225472).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-diAlloc.patch
  (git-fixes CVE-2023-52805 bsc#1225553).
- Update
  patches.suse/kunit-fortify-Fix-mismatched-kvalloc-vfree-usage.patch
  (git-fixes CVE-2024-38617 bsc#1226859).
- Update
  patches.suse/lib-generic-radix-tree.c-Don-t-overflow-in-peek.patch
  (git-fixes CVE-2021-47432 bsc#1225391).
- Update
  patches.suse/lib-test_hmm.c-handle-src_pfns-and-dst_pfns-allocati.patch
  (git-fixes CVE-2024-38543 bsc#1226594).
- Update
  patches.suse/locking-ww_mutex-test-Fix-potential-workqueue-corrup.patch
  (bsc#1219953 CVE-2023-52836 bsc#1225609).
- Update
  patches.suse/md-Don-t-ignore-suspended-array-in-md_check_recovery-1baa.patch
  (bsc#1219596 CVE-2024-26758).
- Update
  patches.suse/media-atomisp-ssh_css-Fix-a-null-pointer-dereference.patch
  (git-fixes CVE-2024-38547 bsc#1226632).
- Update
  patches.suse/media-bttv-fix-use-after-free-error-due-to-btv-timeo.patch
  (git-fixes CVE-2023-52847 bsc#1225588).
- Update
  patches.suse/media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch
  (git-fixes CVE-2023-52764 bsc#1225571).
- Update
  patches.suse/media-hantro-Check-whether-reset-op-is-defined-befor.patch
  (git-fixes CVE-2023-52850 bsc#1225014).
- Update
  patches.suse/media-i2c-et8ek8-Don-t-strip-remove-function-when-dr.patch
  (git-fixes CVE-2024-38611 bsc#1226760).
- Update
  patches.suse/media-imon-fix-access-to-invalid-resource-for-the-se.patch
  (git-fixes CVE-2023-52754 bsc#1225490).
- Update
  patches.suse/media-lgdt3306a-Add-a-check-against-null-pointer-def.patch
  (stable-fixes CVE-2022-48772 bsc#1226976).
- Update
  patches.suse/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch
  (git-fixes CVE-2024-38621 bsc#1226895).
- Update
  patches.suse/media-vidtv-mux-Add-check-and-kfree-for-kstrdup.patch
  (git-fixes CVE-2023-52841 bsc#1225592).
- Update patches.suse/media-vidtv-psi-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52844 bsc#1225590).
- Update
  patches.suse/mfd-qcom-spmi-pmic-Fix-revid-implementation.patch
  (git-fixes CVE-2023-52765 bsc#1225029).
- Update
  patches.suse/misc-microchip-pci1xxxx-fix-double-free-in-the-error.patch
  (git-fixes CVE-2024-36973 bsc#1226457).
- Update
  patches.suse/net-hns3-fix-out-of-bounds-access-may-occur-when-coa.patch
  (git-fixes CVE-2023-52807 bsc#1225097).
- Update
  patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch
  (git-fixes CVE-2024-36962 bsc#1225827).
- Update
  patches.suse/net-mlx5-Fix-peer-devlink-set-for-SF-representor-dev.patch
  (git-fixes CVE-2024-38595 bsc#1226741).
- Update
  patches.suse/net-mlx5e-Track-xmit-submission-to-PTP-WQ-after-popu.patch
  (jsc#PED-3311 CVE-2023-52782 bsc#1225103).
- Update
  patches.suse/net-mvneta-fix-calls-to-page_pool_get_stats.patch
  (git-fixes CVE-2023-52780 bsc#1224933).
- Update
  patches.suse/net-wangxun-fix-kernel-panic-due-to-null-pointer.patch
  (git-fixes CVE-2023-52783 bsc#1225104).
- Update
  patches.suse/netfilter-complete-validation-of-user-input.patch
  (git-fixes CVE-2024-35896 bsc#1224662 CVE-2024-35962
  bsc#1224583).
- Update
  patches.suse/nfc-nci-Fix-uninit-value-in-nci_rx_work.patch
  (git-fixes CVE-2024-38381 bsc#1226878).
- Update
  patches.suse/nilfs2-fix-nilfs_empty_dir-misjudgment-and-long-loop.patch
  (git-fixes CVE-2024-39469 bsc#1226992).
- Update
  patches.suse/nilfs2-fix-potential-hang-in-nilfs_detach_log_writer.patch
  (git-fixes CVE-2024-38582 bsc#1226658).
- Update
  patches.suse/nilfs2-fix-use-after-free-of-timer-for-log-writer-th.patch
  (git-fixes CVE-2024-38583 bsc#1226777).
- Update
  patches.suse/of-module-add-buffer-overflow-check-in-of_modalias.patch
  (git-fixes CVE-2024-38541 bsc#1226587).
- Update
  patches.suse/padata-Fix-refcnt-handling-in-padata_free_shell.patch
  (git-fixes CVE-2023-52854 bsc#1225584).
- Update
  patches.suse/perf-core-Bail-out-early-if-the-request-AUX-area-is-out-of-bound.patch
  (git-fixes CVE-2023-52835 bsc#1225602).
- Update
  patches.suse/platform-x86-wmi-Fix-opening-of-char-device.patch
  (git-fixes CVE-2023-52864 bsc#1225132).
- Update
  patches.suse/powerpc-pseries-iommu-LPAR-panics-during-boot-up-wit.patch
  (bsc#1222011 ltc#205900 CVE-2024-36926 bsc#1225829).
- Update patches.suse/pstore-platform-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52869 bsc#1225050).
- Update
  patches.suse/remoteproc-mediatek-Make-sure-IPI-buffer-fits-in-L2T.patch
  (git-fixes CVE-2024-36965 bsc#1226149).
- Update
  patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch
  (git-fixes CVE-2024-38601 bsc#1226876).
- Update
  patches.suse/s390-dasd-protect-device-queue-against-concurrent-access.patch
  (git-fixes bsc#1217481 CVE-2023-52774 bsc#1225572).
- Update
  patches.suse/scsi-hisi_sas-Set-debugfs_dir-pointer-to-NULL-after-removing-debugfs.patch
  (git-fixes CVE-2023-52808 bsc#1225555).
- Update
  patches.suse/scsi-ibmvfc-Remove-BUG_ON-in-the-case-of-an-empty-ev.patch
  (bsc#1209834 ltc#202097 CVE-2023-52811 bsc#1225559).
- Update
  patches.suse/scsi-libfc-Fix-potential-NULL-pointer-dereference-in-fc_lport_ptp_setup.patch
  (git-fixes CVE-2023-52809 bsc#1225556).
- Update
  patches.suse/scsi-lpfc-Move-NPIV-s-transport-unregistration-to-af.patch
  (bsc#1221777 CVE-2024-36952 bsc#1225898).
- Update
  patches.suse/scsi-lpfc-Release-hbalock-before-calling-lpfc_worker.patch
  (bsc#1221777 CVE-2024-36924 bsc#1225820).
- Update
  patches.suse/serial-max3100-Lock-port-lock-when-calling-uart_hand.patch
  (git-fixes CVE-2024-38634 bsc#1226868).
- Update
  patches.suse/serial-max3100-Update-uart_driver_registered-on-driv.patch
  (git-fixes CVE-2024-38633 bsc#1226867).
- Update
  patches.suse/soc-qcom-llcc-Handle-a-second-device-without-data-co.patch
  (git-fixes CVE-2023-52871 bsc#1225534).
- Update
  patches.suse/soundwire-cadence-fix-invalid-PDI-offset.patch
  (stable-fixes CVE-2024-38635 bsc#1226863).
- Update patches.suse/speakup-Fix-sizeof-vs-ARRAY_SIZE-bug.patch
  (git-fixes CVE-2024-38587 bsc#1226780).
- Update patches.suse/spi-Fix-null-dereference-on-suspend.patch
  (git-fixes CVE-2023-52749 bsc#1225476).
- Update
  patches.suse/thermal-core-prevent-potential-string-overflow.patch
  (git-fixes CVE-2023-52868 bsc#1225044).
- Update
  patches.suse/thermal-drivers-qcom-lmh-Check-for-SCM-availability-.patch
  (git-fixes CVE-2024-39466 bsc#1227089).
- Update
  patches.suse/thermal-drivers-tsens-Fix-null-pointer-dereference.patch
  (git-fixes CVE-2024-38571 bsc#1226737).
- Update
  patches.suse/thermal-intel-powerclamp-fix-mismatch-in-get-functio.patch
  (git-fixes CVE-2023-52794 bsc#1225028).
- Update
  patches.suse/tls-fix-NULL-deref-on-tls_sw_splice_eof-with-empty-r.patch
  (jsc#PED-6831 CVE-2023-52767 bsc#1224998).
- Update
  patches.suse/tpm_tis_spi-Account-for-SPI-header-when-allocating-T.patch
  (git-fixes CVE-2024-36477 bsc#1226840).
- Update
  patches.suse/tracing-Have-trace_event_file-have-ref-counters.patch
  (git-fixes CVE-2023-52879 bsc#1225101).
- Update
  patches.suse/tracing-trigger-Fix-to-return-error-if-failed-to-alloc-snapshot.patch
  (git-fixes CVE-2024-26920).
- Update
  patches.suse/tty-n_gsm-fix-race-condition-in-status-line-change-o.patch
  (git-fixes CVE-2023-52872 bsc#1225591).
- Update
  patches.suse/tty-n_gsm-require-CAP_NET_ADMIN-to-attach-N_GSM0710-.patch
  (bsc#1222619 CVE-2023-52880).
- Update
  patches.suse/tty-vcc-Add-check-for-kstrdup-in-vcc_probe.patch
  (git-fixes CVE-2023-52789 bsc#1225180).
- Update
  patches.suse/usb-config-fix-iteration-issue-in-usb_get_bos_descri.patch
  (git-fixes CVE-2023-52781 bsc#1225092).
- Update
  patches.suse/usb-dwc3-Wait-unconditionally-after-issuing-EndXfer-.patch
  (git-fixes CVE-2024-36977 bsc#1226513).
- Update
  patches.suse/usb-gadget-u_audio-Fix-race-condition-use-of-control.patch
  (git-fixes CVE-2024-38628 bsc#1226911).
- Update
  patches.suse/usb-storage-alauda-Check-whether-the-media-is-initia.patch
  (git-fixes CVE-2024-38619 bsc#1226861).
- Update
  patches.suse/usb-typec-tcpm-Fix-NULL-pointer-dereference-in-tcpm_.patch
  (git-fixes CVE-2023-52877 bsc#1224944).
- Update
  patches.suse/vhost-vdpa-fix-use-after-free-in-vhost_vdpa_probe.patch
  (jsc#PED-3311 CVE-2023-52795 bsc#1225085).
- Update
  patches.suse/virtio-blk-fix-implicit-overflow-on-virtio_max_dma_s.patch
  (git-fixes CVE-2023-52762 bsc#1225573).
- Update
  patches.suse/virtio-vsock-Fix-uninit-value-in-virtio_transport_re.patch
  (jsc#PED-5505 CVE-2023-52842 bsc#1225025).
- Update
  patches.suse/watchdog-cpu5wdt.c-Fix-use-after-free-bug-caused-by-.patch
  (git-fixes CVE-2024-38630 bsc#1226908).
- Update
  patches.suse/wifi-ar5523-enable-proper-endpoint-verification.patch
  (git-fixes CVE-2024-38565 bsc#1226747).
- Update
  patches.suse/wifi-ath11k-fix-dfs-radar-event-locking.patch
  (git-fixes CVE-2023-52798 bsc#1224947).
- Update
  patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch
  (git-fixes CVE-2023-52777 bsc#1224992).
- Update patches.suse/wifi-ath11k-fix-htt-pktlog-locking.patch
  (git-fixes CVE-2023-52800).
- Update
  patches.suse/wifi-ath12k-fix-dfs-radar-and-temperature-event-lock.patch
  (git-fixes CVE-2023-52776 bsc#1225090).
- Update
  patches.suse/wifi-ath12k-fix-htt-mlo-offset-event-locking.patch
  (git-fixes CVE-2023-52769 bsc#1225001).
- Update
  patches.suse/wifi-ath12k-fix-out-of-bound-access-of-qmi_invoke_ha.patch
  (git-fixes CVE-2024-38572 bsc#1226776).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-read-in-ath12k.patch
  (git-fixes CVE-2023-52827 bsc#1225078).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-write-in-ath12.patch
  (git-fixes CVE-2023-52829 bsc#1225081).
- Update
  patches.suse/wifi-brcmfmac-pcie-handle-randbuf-allocation-failure.patch
  (git-fixes CVE-2024-38575 bsc#1226612).
- Update
  patches.suse/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch
  (git-fixes CVE-2024-38567 bsc#1226769).
- Update
  patches.suse/wifi-carl9170-re-fix-fortified-memset-warning.patch
  (git-fixes CVE-2024-38616 bsc#1226852).
- Update
  patches.suse/wifi-mac80211-don-t-return-unset-power-in-ieee80211_.patch
  (git-fixes CVE-2023-52832 bsc#1225577).
- Update
  patches.suse/wifi-nl80211-Avoid-address-calculations-via-out-of-b.patch
  (git-fixes CVE-2024-38562 bsc#1226788).
- Update
  patches.suse/wifi-wilc1000-use-vmm_table-as-array-in-wilc-struct.patch
  (git-fixes CVE-2023-52768 bsc#1225004).
- Update
  patches.suse/x86-tdx-Zero-out-the-missing-RSI-in-TDX_HYPERCALL-macro.patch
  (jsc#PED-5824 CVE-2023-52874 bsc#1225049).
- commit 33efdc4</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835204">- tcp: Use refcount_inc_not_zero() in tcp_twsk_unique()
  (CVE-2024-36904 bsc#1225732).
- commit d578dcc</changelog>
  <changelog author="heming.zhao@suse.com" date="1719921600">- gfs2: Fix potential glock use-after-free on unmount (bsc#1226775
  CVE-2024-38570).
- gfs2: Rename sd_{ glock =&gt; kill }_wait (bsc#1226775
  CVE-2024-38570).
- commit f3adbca</changelog>
  <changelog author="tiwai@suse.de" date="1719921601">- Correct SCSI patch references (bsc#1225767 CVE-2024-36919 bsc#1226785 CVE-2024-38559)
- commit e8ea587</changelog>
  <changelog author="tiwai@suse.de" date="1719921602">- mtd: rawnand: rockchip: ensure NVDDR timings are rejected
  (git-fixes).
- mtd: rawnand: Bypass a couple of sanity checks during NAND
  identification (git-fixes).
- mtd: rawnand: Fix the nand_read_data_op() early check
  (git-fixes).
- mtd: rawnand: Ensure ECC configuration is propagated to upper
  layers (git-fixes).
- commit e545951</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1719921603">- kernel-doc: fix struct_group_tagged() parsing (git-fixes).
- commit e3a2a2e</changelog>
  <changelog author="fdmanana@suse.com" date="1719921604">- btrfs: fix crash on racing fsync and size-extending write into
  prealloc (bsc#1227101 CVE-2024-37354).
- commit 1d355af</changelog>
  <changelog author="vbabka@suse.cz" date="1719921605">- virt: acrn: stop using follow_pfn (CVE-2024-38610 bsc#1226758).
- commit c2ea51b</changelog>
  <changelog author="vbabka@suse.cz" date="1719921606">- drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
  (CVE-2024-38610 bsc#1226758).
- commit 7069ac2</changelog>
  <changelog author="rhopkins@suse.de" date="1719921607">- hsr: Prevent use after free in prp_create_tagged_frame()
  (CVE-2023-52846 bsc#1225098).
- commit cf63988</changelog>
  <changelog author="krisman@suse.de" date="1719921608">- io_uring: Fix io_cqring_wait() not restoring sigmask on
  get_timespec64() failure (git-fixes).
- commit e640a65</changelog>
  <changelog author="krisman@suse.de" date="1719921609">- io_uring: check for non-NULL file pointer in io_file_can_poll()
  (bsc#1226990 CVE-2024-39371).
- io_uring/io-wq: Use set_bit() and test_bit() at worker-&gt;flags
  (git-fixes).
- io_uring/sqpoll: work around a potential audit memory leak
  (git-fixes).
- commit 24603fc</changelog>
  <changelog author="krisman@suse.de" date="1719921610">- io_uring/rsrc: fix incorrect assignment of iter-&gt;nr_segs in
  io_import_fixed (git-fixes).
- io_uring/rsrc: don't lock while !TASK_RUNNING (git-fixes).
- io_uring/io-wq: avoid garbage value of 'match' in
  io_wq_enqueue() (git-fixes).
- commit 7d3e252</changelog>
</package>
<package pkgid="14d7b832fe22a578924292183f9843f8884c48e92425629e71f771118fcfcfcc" name="dtb-amazon" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.17.1"/>
  <changelog author="tiwai@suse.de" date="1722081600">- auxdisplay: ht16k33: Drop reference after LED registration
  (git-fixes).
- ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
  on unprepare (git-fixes).
- ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
- ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
  reachable (git-fixes).
- ASoC: sof: amd: fix for firmware reload failure in Vangogh
  platform (git-fixes).
- ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
- ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
  (git-fixes).
- ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
- ALSA: ump: Don't update FB name for static blocks (git-fixes).
- drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
- drm/i915/gt: Do not consider preemption during execlists_dequeue
  for gen8 (git-fixes).
- drm/i915/dp: Don't switch the LTTPR mode on an active link
  (git-fixes).
- commit d7e2deb</changelog>
  <changelog author="tiwai@suse.de" date="1722081601">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
</package>
<package pkgid="5ae85141f0c2d5dfdbfc52e0365dbfdcd8e7fe3c368f428686753de1ee7a1d07" name="dtb-amazon" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.7.1"/>
  <changelog author="mkubecek@suse.cz" date="1717416000">- netfilter: nf_tables: release mutex after nft_gc_seq_end from
  abort path (CVE-2024-26925 bsc#1223390).
- commit 578a709</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717416001">- Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
  The L3 bsc#1225765 was created seperately since our customer requires
  PTF.
- Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
- Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
- Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
- Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
- commit 054635e</changelog>
  <changelog author="msuchanek@suse.de" date="1717416002">- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
- powerpc/uaccess: Fix build errors seen with GCC 13/14
  (bsc#1194869).
- commit 46b5d84</changelog>
  <changelog author="msuchanek@suse.de" date="1717416003">- blacklist.conf: PPC fsl_msi is not used
- commit ae6590d</changelog>
  <changelog author="msuchanek@suse.de" date="1717416004">- powerpc/pseries/lparcfg: drop error message from guest name
  lookup (bsc#1187716 ltc#193451 git-fixes).
- commit ceab637</changelog>
  <changelog author="mfranc@suse.cz" date="1717416005">- Update
  patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
  (git-fixes CVE-2024-36955).
- Update
  patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
  (git-fixes bsc#1225715 CVE-2024-36906).
- Update
  patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
  (git-fixes bsc#1225579 CVE-2024-36011).
- Update
  patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
  (git-fixes bsc#1225578 CVE-2024-36013).
- Update
  patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
  (git-fixes bsc#1225502 CVE-2024-36012).
- Update
  patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
  (git-fixes bsc#1225722 CVE-2024-36880).
- Update
  patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
  (git-fixes CVE-2024-36942).
- Update
  patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
  (git-fixes bsc#1225720 CVE-2024-36032).
- Update
  patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
  (git-fixes bsc#1223749 CVE-2024-26990).
- Update
  patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
  (git-fixes bsc#1223692 CVE-2024-26992).
- Update
  patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
  (stable-fixes CVE-2024-36944).
- Update
  patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
  (git-fixes bsc#1225734 CVE-2024-36896).
- Update
  patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
  (stable-fixes CVE-2024-36949).
- Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
  (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
- Update
  patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
  (git-fixes bsc#1225692 CVE-2023-52882).
- Update
  patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
  (git-fixes CVE-2024-26761).
- Update
  patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
  (stable-fixes bsc#1225735 CVE-2024-36897).
- Update
  patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
  (stable-fixes bsc#1225705 CVE-2024-36026).
- Update
  patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
  (stable-fixes CVE-2024-36951).
- Update
  patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
  (git-fixes bsc#1225593 CVE-2024-36014).
- Update
  patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
  (stable-fixes bsc#1225728 CVE-2024-36885).
- Update
  patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
  (git-fixes bsc#1225773 CVE-2024-36936).
- Update
  patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
  (stable-fixes CVE-2024-36950).
- Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
  (git-fixes bsc#1225736 CVE-2024-36898).
- Update
  patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
  (git-fixes bsc#1225698 CVE-2024-36020).
- Update
  patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
  (git-fixes bsc#1225710 CVE-2024-36891).
- Update
  patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
  (git-fixes bsc#1225714 CVE-2024-36890).
- Update
  patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
  (git-fixes bsc#1225708 CVE-2024-36029).
- Update
  patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
  (git-fixes bsc#1225699 CVE-2024-36021).
- Update
  patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
  (git-fixes CVE-2024-26943).
- Update
  patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
  (git-fixes bsc#1225694 CVE-2024-36018).
- Update
  patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
  (git-fixes CVE-2024-36940).
- Update
  patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
  (git-fixes CVE-2024-36959).
- Update
  patches.suse/ppdev-Add-an-error-check-in-register_device.patch
  (git-fixes bsc#1225640 CVE-2024-36015).
- Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
  CVE-2024-36947).
- Update
  patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
  (git-fixes bsc#1225695 CVE-2024-36019).
- Update
  patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
  (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
- Update
  patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
  (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
- Update
  patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
  (git-fixes bsc#1225704 CVE-2024-36025).
- Update
  patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
  (git-fixes CVE-2024-36930).
- Update
  patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
  (bsc#1224331 bsc#1224602 CVE-2024-35814).
- Update
  patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
  (git-fixes bsc#1225642 CVE-2024-36016).
- Update
  patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
  (git-fixes bsc#1225749 CVE-2024-36894).
- Update
  patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
  (git-fixes bsc#1225750 CVE-2024-36895).
- Update
  patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
  (git-fixes bsc#1225748 CVE-2024-36893).
- Update
  patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
  (stable-fixes bsc#1225769 CVE-2024-36921).
- Update
  patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
  (stable-fixes CVE-2024-36922).
- Update
  patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
  (git-fixes CVE-2024-36941).
- Update
  patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
  (git-fixes bsc#1224742 CVE-2024-35803).
- commit 539780f</changelog>
  <changelog author="dwagner@suse.de" date="1717416006">- nvmet: fix ns enable/disable possible hang (git-fixes).
- nvme-multipath: fix io accounting on failover (git-fixes).
- nvme: fix multipath batched completion accounting (git-fixes).
- commit ed3b392</changelog>
  <changelog author="dwagner@suse.de" date="1717416007">- scsi: lpfc: Copyright updates for 14.4.0.2 patches
  (bsc#1225842).
- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
  (bsc#1225842).
  Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
  (bsc#1225842).
- scsi: lpfc: Clear deferred RSCN processing flag when driver
  is unloading (bsc#1225842).
- scsi: lpfc: Update logging of protection type for T10 DIF I/O
  (bsc#1225842).
- scsi: lpfc: Change default logging level for unsolicited CT
  MIB commands (bsc#1225842).
- commit 5a56384</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416008">- smb: client: fix mount when dns_resolver key is not available
  (git-fixes, bsc#1225172).
- commit 28edb5c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416009">- cifs: fix leak of iface for primary channel (git-fixes,
  bsc#1225172).
- commit b7eb8e8</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416010">- Revert "cifs: reconnect work should have reference on server
  struct" (git-fixes, bsc#1225172).
- commit 3ca4c0c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416011">- smb: client: fix parsing of SMB3.1.1 POSIX create context
  (git-fixes, bsc#1225172).
- commit 5f27f69</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416012">- cifs: failure to add channel on iface should bump up weight
  (git-fixes, bsc#1225172).
- commit 007b237</changelog>
  <changelog author="tonyj@suse.de" date="1717416013">- perf/x86: Fix out of range data (git-fixes).
- perf/x86/intel/ds: Don't clear -&gt;pebs_data_cfg for the last
  PEBS event (git-fixes).
- perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
- commit 664d77f</changelog>
  <changelog author="dsterba@suse.com" date="1717588800">- blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
- Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
  Quoting bsc#1225945#c11:
  "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
  transaction for every subvol create")
  ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
  unwritten extent buffer after snapshotting a new subvolume") was never
  backported."
- commit d947258</changelog>
  <changelog author="tonyj@suse.de" date="1717588801">- perf pmu: Count sys and cpuid JSON events separately (git
  fixes).
- perf stat: Don't display metric header for non-leader uncore
  events (git-fixes).
- perf daemon: Fix file leak in daemon_session__control
  (git-fixes).
- perf symbols: Fix ownership of string in dso__load_vmlinux()
  (git-fixes).
- perf thread: Fixes to thread__new() related to initializing comm
  (git-fixes).
- perf report: Avoid SEGV in report__setup_sample_type()
  (git-fixes).
- perf ui browser: Don't save pointer to stack memory (git-fixes).
- perf bench internals inject-build-id: Fix trap divide when
  collecting just one DSO (git-fixes).
- perf intel-pt: Fix unassigned instruction op (discovered by
  MemorySanitizer) (git-fixes).
- perf test shell arm_coresight: Increase buffer size for
  Coresight basic tests (git-fixes).
- perf docs: Document bpf event modifier (git-fixes).
- perf bench uprobe: Remove lib64 from libc.so.6 binary path
  (git-fixes).
- perf record: Fix debug message placement for test consumption
  (git-fixes).
- perf tests: Apply attributes to all events in object code
  reading test (git-fixes).
- perf tests: Make "test data symbol" more robust on Neoverse N1
  (git-fixes).
- perf annotate: Fix annotation_calc_lines() to pass correct
  address to get_srcline() (git-fixes).
- perf stat: Do not fail on metrics on s390 z/VM systems
  (git-fixes).
- perf sched timehist: Fix -g/--call-graph option failure
  (git-fixes).
- perf annotate: Get rid of duplicate --group option item
  (git-fixes).
- perf probe: Add missing libgen.h header needed for using
  basename() (git-fixes).
- perf record: Delete session after stopping sideband thread
  (git-fixes).
- perf auxtrace: Fix multiple use of --itrace option (git-fixes).
- perf script: Show also errors for --insn-trace option
  (git-fixes).
- perf lock contention: Add a missing NULL check (git-fixes).
- perf vendor events amd: Fix Zen 4 cache latency events
  (git-fixes).
- libperf evlist: Avoid out-of-bounds access (git-fixes).
- perf pmu: Fix a potential memory leak in perf_pmu__lookup()
  (git-fixes).
- perf print-events: make is_event_supported() more robust
  (git-fixes).
- perf list: fix short description for some cache events
  (git-fixes).
- perf metric: Don't remove scale from counts (git-fixes).
- perf stat: Avoid metric-only segv (git-fixes).
- perf expr: Fix "has_event" function for metric style events
  (git-fixes).
- perf srcline: Add missed addr2line closes (git-fixes).
- perf thread_map: Free strlist on normal path in
  thread_map__new_by_tid_str() (git-fixes).
- perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
- perf jevents: Drop or simplify small integer values (git-fixes).
- perf evsel: Fix duplicate initialization of data-&gt;id in
  evsel__parse_sample() (git-fixes).
- perf pmu: Treat the msr pmu as software (git-fixes).
- perf record: Check conflict between '--timestamp-filename'
  option and pipe mode before recording (git-fixes).
- perf record: Fix possible incorrect free in
  record__switch_output() (git-fixes).
- perf vendor events amd: Add Zen 4 memory controller events
  (git-fixes).
- perf top: Uniform the event name for the hybrid machine
  (git-fixes).
- perf top: Use evsel's cpus to replace user_requested_cpus
  (git-fixes).
- commit a1f9340</changelog>
  <changelog author="tonyj@suse.de" date="1717675200">- perf ui browser: Avoid SEGV on title (git fixes).
- commit 1578c22</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675201">- inet: inet_defrag: prevent sk release while still in use
  (CVE-2024-26921 bsc#1223138).
- commit 2016faf</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675202">- net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
- commit 7bf5961</changelog>
  <changelog author="tiwai@suse.de" date="1718366400">- Temporarily drop KVM patch that caused a regression (bsc#1226158)
  Delete patches.suse/KVM-x86-pmu-Prioritize-VMX-interception-over-GP-on-R.patch
- commit 33f31da</changelog>
</package>
<package pkgid="ba199a5a6b5f2769b4c356d45a7fb7c4a0a72eb4b45fcfe558f9602880d67aca" name="dtb-amd" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.14.1"/>
  <changelog author="tiwai@suse.de" date="1719662400">- gpiolib: cdev: Disallow reconfiguration without direction
  (uAPI v1) (git-fixes).
- gpio: davinci: Validate the obtained number of IRQs (git-fixes).
- commit 919ebd1</changelog>
  <changelog author="tiwai@suse.de" date="1719748800">- i2c: testunit: discard write requests while old command is
  running (git-fixes).
- i2c: testunit: don't erase registers after STOP (git-fixes).
- mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
  (git-fixes).
- mmc: sdhci: Do not invert write-protect twice (git-fixes).
- mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
  (git-fixes).
- mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
  (git-fixes).
- commit 448487d</changelog>
  <changelog author="tiwai@suse.de" date="1719748801">- crypto: iaa - Account for cpu-less numa nodes (bsc#1227190).
- commit cd600aa</changelog>
  <changelog author="tiwai@suse.de" date="1719748802">- crypto: deflate - Add aliases to deflate (bsc#1227190).
- commit 27ffd92</changelog>
  <changelog author="tiwai@suse.de" date="1719835200">- ata: ahci: Clean up sysfs file on error (git-fixes).
- ata: libata-core: Fix double free on error (git-fixes).
- ata,scsi: libata-core: Do not leak memory for ata_port struct
  members (git-fixes).
- ata: libata-core: Fix null pointer dereference on error
  (git-fixes).
- kbuild: Fix build target deb-pkg: ln: failed to create hard link
  (git-fixes).
- kbuild: doc: Update default INSTALL_MOD_DIR from extra to
  updates (git-fixes).
- kbuild: Install dtb files as 0644 in Makefile.dtbinst
  (git-fixes).
- counter: ti-eqep: enable clock at probe (git-fixes).
- iio: chemical: bme680: Fix sensor data read operation
  (git-fixes).
- iio: chemical: bme680: Fix overflows in compensate() functions
  (git-fixes).
- iio: chemical: bme680: Fix calibration data variable
  (git-fixes).
- iio: chemical: bme680: Fix pressure value output (git-fixes).
- iio: accel: fxls8962af: select IIO_BUFFER &amp; IIO_KFIFO_BUF
  (git-fixes).
- iio: adc: ad7266: Fix variable checking bug (git-fixes).
- iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
  (git-fixes).
- serial: bcm63xx-uart: fix tx after conversion to
  uart_port_tx_limited() (git-fixes).
- serial: core: introduce uart_port_tx_limited_flags()
  (git-fixes).
- Revert "serial: core: only stop transmit when HW fifo is empty"
  (git-fixes).
- tty: mcf: MCF54418 has 10 UARTS (git-fixes).
- usb: gadget: aspeed_udc: fix device address configuration
  (git-fixes).
- usb: dwc3: core: remove lock of otg mode during gadget
  suspend/resume to avoid deadlock (git-fixes).
- usb: typec: ucsi: glink: fix child node release in probe
  function (git-fixes).
- usb: musb: da8xx: fix a resource leak in probe() (git-fixes).
- usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  (git-fixes).
- usb: gadget: printer: fix races against disable (git-fixes).
- PCI/MSI: Fix UAF in msi_capability_init (git-fixes).
- commit a2ea5a9</changelog>
  <changelog author="ptesarik@suse.com" date="1719835201">- net: ena: Fix redundant device NUMA node override
  (jsc#PED-8688).
- commit 6ad6684</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835202">- tcp: do not accept ACK of bytes we never sent (CVE-2023-52881
  bsc#1225611).
- commit 16404a6</changelog>
  <changelog author="mhocko@suse.com" date="1719835203">- Update
  patches.suse/1352-drm-amdgpu-Fix-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52883
  bsc#1226630).
- Update
  patches.suse/9p-add-missing-locking-around-taking-dentry-fid-list.patch
  (git-fixes CVE-2024-39463 bsc#1227090).
- Update
  patches.suse/ALSA-Fix-deadlocks-with-kctl-removals-at-disconnecti.patch
  (stable-fixes CVE-2024-38600 bsc#1226864).
- Update
  patches.suse/ALSA-core-Fix-NULL-module-pointer-assignment-at-card.patch
  (git-fixes CVE-2024-38605 bsc#1226740).
- Update
  patches.suse/ALSA-hda-Fix-possible-null-ptr-deref-when-assigning-.patch
  (git-fixes CVE-2023-52806 bsc#1225554).
- Update
  patches.suse/ALSA-hda-cs_dsp_ctl-Use-private_free-for-control-cle.patch
  (git-fixes CVE-2024-38388 bsc#1226890).
- Update
  patches.suse/ALSA-timer-Set-lower-bound-of-start-tick-time.patch
  (stable-fixes git-fixes CVE-2024-38618 bsc#1226754).
- Update
  patches.suse/ASoC-kirkwood-Fix-potential-NULL-dereference.patch
  (git-fixes CVE-2024-38550 bsc#1226633).
- Update
  patches.suse/ASoC-mediatek-Assign-dummy-when-codec-not-specified-.patch
  (git-fixes CVE-2024-38551 bsc#1226761).
- Update
  patches.suse/Bluetooth-btusb-Add-date-evt_skb-is-NULL-check.patch
  (git-fixes CVE-2023-52833 bsc#1225595).
- Update
  patches.suse/Bluetooth-hci_core-Fix-possible-buffer-overflow.patch
  (git-fixes CVE-2024-26889).
- Update
  patches.suse/HID-uclogic-Fix-user-memory-access-bug-in-uclogic_pa.patch
  (git-fixes CVE-2023-52866 bsc#1225120).
- Update
  patches.suse/IB-mlx5-Fix-init-stage-error-handling-to-avoid-doubl.patch
  (jsc#PED-6864 CVE-2023-52851 bsc#1225587).
- Update
  patches.suse/Input-cyapa-add-missing-input-core-locking-to-suspen.patch
  (git-fixes CVE-2023-52884 bsc#1226764).
- Update
  patches.suse/Input-synaptics-rmi4-fix-use-after-free-in-rmi_unreg.patch
  (git-fixes CVE-2023-52840 bsc#1224928).
- Update
  patches.suse/KEYS-trusted-Do-not-use-WARN-when-encode-fails.patch
  (git-fixes CVE-2024-36975 bsc#1226520).
- Update
  patches.suse/KEYS-trusted-Fix-memory-leak-in-tpm2_key_encode.patch
  (git-fixes CVE-2024-36967 bsc#1226131).
- Update
  patches.suse/RDMA-cma-Fix-kmemleak-in-rdma_core-observed-during-b.patch
  (git-fixes CVE-2024-38539 bsc#1226608).
- Update patches.suse/RDMA-hns-Fix-UAF-for-cq-async-event.patch
  (git-fixes CVE-2024-38545 bsc#1226595).
- Update
  patches.suse/RDMA-hns-Fix-deadlock-on-SRQ-async-events.patch
  (git-fixes CVE-2024-38591 bsc#1226738).
- Update
  patches.suse/RDMA-hns-Modify-the-print-level-of-CQE-error.patch
  (git-fixes CVE-2024-38590 bsc#1226839).
- Update
  patches.suse/RDMA-rxe-Fix-seg-fault-in-rxe_comp_queue_pkt.patch
  (git-fixes CVE-2024-38544 bsc#1226597).
- Update
  patches.suse/SUNRPC-Fix-RPC-client-cleaned-up-the-freed-pipefs-de.patch
  (git-fixes CVE-2023-52803 bsc#1225008).
- Update patches.suse/af_unix-Clear-stale-u-oob_skb.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-35970 bsc#1224584).
- Update
  patches.suse/af_unix-Drop-oob_skb-ref-before-purging-queue-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26750 bsc#1222617).
- Update
  patches.suse/af_unix-Fix-task-hung-while-purging-oob_skb-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26780 bsc#1222588).
- Update
  patches.suse/af_unix-Update-unix_sk-sk-oob_skb-under-sk_receive_queue-lock.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-36972 bsc#1226163).
- Update
  patches.suse/arm64-Restrict-CPU_BIG_ENDIAN-to-GNU-as-or-LLVM-IAS-.patch
  (git-fixes CVE-2023-52750 bsc#1225485).
- Update
  patches.suse/atl1c-Work-around-the-DMA-RX-overflow-issue.patch
  (git-fixes CVE-2023-52834 bsc#1225599).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issue-of-net_device.patch
  (git-fixes CVE-2024-38554 bsc#1226742).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issues-of-ax25_dev.patch
  (git-fixes CVE-2024-38602 bsc#1226613).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-reorder-of-WRITE-lqueued.patch
  (bsc#1225605 CVE-2024-38384 bsc#1226938).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-resetting-io-stat.patch
  (bsc#1225605 CVE-2024-38663 bsc#1226939).
- Update
  patches.suse/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch
  (git-fixes CVE-2024-38540 bsc#1226582).
- Update
  patches.suse/bonding-stop-the-device-in-bond_setup_by_slave.patch
  (git-fixes CVE-2023-52784 bsc#1224946).
- Update
  patches.suse/can-dev-can_put_echo_skb-don-t-crash-kernel-if-can_p.patch
  (git-fixes CVE-2023-52878 bsc#1225000).
- Update
  patches.suse/clk-mediatek-clk-mt2701-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52875 bsc#1225096).
- Update
  patches.suse/clk-mediatek-clk-mt6765-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52870 bsc#1224937).
- Update
  patches.suse/clk-mediatek-clk-mt6779-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52873 bsc#1225589).
- Update
  patches.suse/clk-mediatek-clk-mt6797-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52865 bsc#1225086).
- Update
  patches.suse/clk-mediatek-clk-mt7629-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52858 bsc#1225566).
- Update
  patches.suse/clk-mediatek-clk-mt7629-eth-Add-check-for-mtk_alloc_.patch
  (git-fixes CVE-2023-52876 bsc#1225036).
- Update
  patches.suse/cppc_cpufreq-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38573 bsc#1226739).
- Update patches.suse/cpufreq-exit-callback-is-optional.patch
  (git-fixes CVE-2024-38615 bsc#1226592).
- Update patches.suse/crypto-bcm-Fix-pointer-arithmetic.patch
  (git-fixes CVE-2024-38579 bsc#1226637).
- Update
  patches.suse/crypto-pcrypt-Fix-hungtask-for-PADATA_RESET.patch
  (git-fixes CVE-2023-52813 bsc#1225527).
- Update patches.suse/cxl-mem-Fix-shutdown-order.patch (git-fixes
  CVE-2023-52849 bsc#1224949).
- Update
  patches.suse/cxl-region-Do-not-try-to-cleanup-after-cxl_region_se.patch
  (git-fixes CVE-2023-52792 bsc#1225477).
- Update patches.suse/cxl-region-Fix-cxlr_pmem-leaks.patch
  (git-fixes CVE-2024-38391 bsc#1226894).
- Update
  patches.suse/dma-buf-sw-sync-don-t-enable-IRQ-from-sync_print_obj.patch
  (git-fixes CVE-2024-38780 bsc#1226886).
- Update
  patches.suse/dma-mapping-benchmark-fix-node-id-validation.patch
  (git-fixes CVE-2024-34777 bsc#1226796).
- Update
  patches.suse/dma-mapping-benchmark-handle-NUMA_NO_NODE-correctly.patch
  (git-fixes CVE-2024-39277 bsc#1226909).
- Update
  patches.suse/dmaengine-idxd-Avoid-unnecessary-destruction-of-file.patch
  (git-fixes CVE-2024-38629 bsc#1226905).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Pola.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52819
  bsc#1225532).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-SMU7.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52818
  bsc#1225530).
- Update
  patches.suse/drm-amd-check-num-of-link-levels-when-update-pcie-pa.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52812
  bsc#1225564).
- Update
  patches.suse/drm-amd-display-Avoid-NULL-dereference-of-timing-gen.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52753
  bsc#1225478).
- Update
  patches.suse/drm-amd-display-Fix-division-by-zero-in-setup_dsc_co.patch
  (stable-fixes CVE-2024-36969 bsc#1226155).
- Update
  patches.suse/drm-amd-display-Fix-null-pointer-dereference-in-erro.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52862
  bsc#1225015).
- Update
  patches.suse/drm-amd-display-Fix-potential-index-out-of-bounds-in.patch
  (git-fixes CVE-2024-38552 bsc#1226767).
- Update
  patches.suse/drm-amd-display-fix-a-NULL-pointer-dereference-in-am.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52773
  bsc#1225041).
- Update
  patches.suse/drm-amd-display-fixed-integer-types-and-null-check-l.patch
  (git-fixes CVE-2024-26767).
- Update
  patches.suse/drm-amdgpu-Fix-a-null-pointer-access-when-the-smc_rr.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52817
  bsc#1225569).
- Update
  patches.suse/drm-amdgpu-Fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch
  (git-fixes CVE-2024-39291 bsc#1226934).
- Update
  patches.suse/drm-amdgpu-Fix-potential-null-pointer-derefernce.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52814
  bsc#1225565).
- Update
  patches.suse/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch
  (stable-fixes CVE-2024-39471 bsc#1227096).
- Update
  patches.suse/drm-amdgpu-mes-fix-use-after-free-issue.patch
  (stable-fixes CVE-2024-38581 bsc#1226657).
- Update
  patches.suse/drm-amdgpu-vkms-fix-a-possible-null-pointer-derefere.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52815
  bsc#1225568).
- Update
  patches.suse/drm-amdkfd-Fix-a-race-condition-of-vram-buffer-unref.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52825
  bsc#1225076).
- Update
  patches.suse/drm-amdkfd-Fix-shift-out-of-bounds-issue.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52816
  bsc#1225529).
- Update
  patches.suse/drm-bridge-cdns-mhdp8546-Fix-possible-null-pointer-d.patch
  (git-fixes CVE-2024-38548).
- Update
  patches.suse/drm-bridge-it66121-Fix-invalid-connector-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52861
  bsc#1224941).
- Update
  patches.suse/drm-bridge-lt8912b-Fix-crash-on-bridge-detach.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52856
  bsc#1224932).
- Update
  patches.suse/drm-mediatek-Add-0-size-check-to-mtk_drm_gem_obj.patch
  (git-fixes CVE-2024-38549 bsc#1226735).
- Update
  patches.suse/drm-mediatek-Fix-coverity-issue-with-unintentional-i.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52857
  bsc#1225581).
- Update
  patches.suse/drm-mediatek-Init-ddp_comp-with-devm_kcalloc.patch
  (git-fixes CVE-2024-38592 bsc#1226844).
- Update
  patches.suse/drm-msm-a6xx-Avoid-a-nullptr-dereference-when-speedb.patch
  (git-fixes CVE-2024-38390 bsc#1226891).
- Update
  patches.suse/drm-msm-dpu-Add-callback-function-pointer-check-befo.patch
  (git-fixes CVE-2024-38622 bsc#1226856).
- Update
  patches.suse/drm-panel-fix-a-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52821
  bsc#1225022).
- Update
  patches.suse/drm-panel-panel-tpo-tpg110-fix-a-possible-null-point.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52826
  bsc#1225077).
- Update patches.suse/drm-radeon-possible-buffer-overflow.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52867
  bsc#1225009).
- Update
  patches.suse/drm-vc4-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38546 bsc#1226593).
- Update
  patches.suse/drm-vmwgfx-Fix-invalid-reads-in-fence-signaled-event.patch
  (git-fixes CVE-2024-36960 bsc#1225872).
- Update
  patches.suse/drm-zynqmp_dpsub-Always-register-bridge.patch
  (git-fixes CVE-2024-38664 bsc#1226941).
- Update
  patches.suse/e1000e-change-usleep_range-to-udelay-in-PHY-mdic-acc.patch
  (CVE-2024-39296 bsc#1226989 CVE-2024-36887 bsc#1225731).
- Update
  patches.suse/ecryptfs-Fix-buffer-size-for-tag-66-packet.patch
  (git-fixes CVE-2024-38578 bsc#1226634).
- Update
  patches.suse/efi-libstub-only-free-priv.runtime_map-when-allocate.patch
  (git-fixes CVE-2024-33619 bsc#1226768).
- Update
  patches.suse/fbdev-imsttfb-fix-a-resource-leak-in-probe.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52838
  bsc#1225031).
- Update
  patches.suse/fs-9p-only-translate-RWX-permissions-for-plain-9P200.patch
  (git-fixes CVE-2024-36964 bsc#1225866).
- Update
  patches.suse/fs-jfs-Add-check-for-negative-db_l2nbperpage.patch
  (git-fixes CVE-2023-52810 bsc#1225557).
- Update
  patches.suse/fs-jfs-Add-validity-check-for-db_maxag-and-db_agpref.patch
  (git-fixes CVE-2023-52804 bsc#1225550).
- Update
  patches.suse/ftrace-Fix-possible-use-after-free-issue-in-ftrace_location.patch
  (git-fixes CVE-2024-38588 bsc#1226837).
- Update
  patches.suse/genirq-irqdesc-Prevent-use-after-free-in-irq_find_at.patch
  (git-fixes CVE-2024-38385 bsc#1227085).
- Update patches.suse/gfs2-ignore-negated-quota-changes.patch
  (git-fixes CVE-2023-52759 bsc#1225560).
- Update
  patches.suse/hid-cp2112-Fix-duplicate-workqueue-initialization.patch
  (git-fixes CVE-2023-52853 bsc#1224988).
- Update
  patches.suse/hwmon-axi-fan-control-Fix-possible-NULL-pointer-dere.patch
  (git-fixes CVE-2023-52863 bsc#1225586).
- Update
  patches.suse/i2c-acpi-Unbind-mux-adapters-before-delete.patch
  (git-fixes CVE-2024-39362 bsc#1226995).
- Update
  patches.suse/i2c-core-Run-atomic-i2c-xfer-when-preemptible.patch
  (git-fixes CVE-2023-52791 bsc#1225108).
- Update
  patches.suse/i3c-master-mipi-i3c-hci-Fix-a-kernel-panic-for-acces.patch
  (git-fixes CVE-2023-52763 bsc#1225570).
- Update
  patches.suse/i3c-mipi-i3c-hci-Fix-out-of-bounds-access-in-hci_dma.patch
  (git-fixes CVE-2023-52766).
- Update
  patches.suse/i915-perf-Fix-NULL-deref-bugs-with-drm_dbg-calls.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52788
  bsc#1225106).
- Update
  patches.suse/igb-Fix-string-truncation-warnings-in-igb_set_fw_ver.patch
  (git-fixes CVE-2024-36010 bsc#1225594).
- Update
  patches.suse/iommu-vt-d-Fix-WARN_ON-in-iommu-probe-path.patch
  (git-fixes CVE-2024-35957 bsc#1224673).
- Update
  patches.suse/iommufd-Fix-missing-update-of-domains_itree-after-splitting-iopt
  (jsc#PED-7779 jsc#PED-7780 CVE-2023-52801 bsc#1225006).
- Update
  patches.suse/ipvlan-add-ipvlan_route_v6_outbound-helper.patch
  (git-fixes CVE-2023-52796 bsc#1224930).
- Update
  patches.suse/jffs2-prevent-xattr-node-from-overflowing-the-eraseblock.patch
  (git-fixes CVE-2024-38599 bsc#1226848).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-dbFindLeaf.patch
  (git-fixes CVE-2023-52799 bsc#1225472).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-diAlloc.patch
  (git-fixes CVE-2023-52805 bsc#1225553).
- Update
  patches.suse/kunit-fortify-Fix-mismatched-kvalloc-vfree-usage.patch
  (git-fixes CVE-2024-38617 bsc#1226859).
- Update
  patches.suse/lib-generic-radix-tree.c-Don-t-overflow-in-peek.patch
  (git-fixes CVE-2021-47432 bsc#1225391).
- Update
  patches.suse/lib-test_hmm.c-handle-src_pfns-and-dst_pfns-allocati.patch
  (git-fixes CVE-2024-38543 bsc#1226594).
- Update
  patches.suse/locking-ww_mutex-test-Fix-potential-workqueue-corrup.patch
  (bsc#1219953 CVE-2023-52836 bsc#1225609).
- Update
  patches.suse/md-Don-t-ignore-suspended-array-in-md_check_recovery-1baa.patch
  (bsc#1219596 CVE-2024-26758).
- Update
  patches.suse/media-atomisp-ssh_css-Fix-a-null-pointer-dereference.patch
  (git-fixes CVE-2024-38547 bsc#1226632).
- Update
  patches.suse/media-bttv-fix-use-after-free-error-due-to-btv-timeo.patch
  (git-fixes CVE-2023-52847 bsc#1225588).
- Update
  patches.suse/media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch
  (git-fixes CVE-2023-52764 bsc#1225571).
- Update
  patches.suse/media-hantro-Check-whether-reset-op-is-defined-befor.patch
  (git-fixes CVE-2023-52850 bsc#1225014).
- Update
  patches.suse/media-i2c-et8ek8-Don-t-strip-remove-function-when-dr.patch
  (git-fixes CVE-2024-38611 bsc#1226760).
- Update
  patches.suse/media-imon-fix-access-to-invalid-resource-for-the-se.patch
  (git-fixes CVE-2023-52754 bsc#1225490).
- Update
  patches.suse/media-lgdt3306a-Add-a-check-against-null-pointer-def.patch
  (stable-fixes CVE-2022-48772 bsc#1226976).
- Update
  patches.suse/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch
  (git-fixes CVE-2024-38621 bsc#1226895).
- Update
  patches.suse/media-vidtv-mux-Add-check-and-kfree-for-kstrdup.patch
  (git-fixes CVE-2023-52841 bsc#1225592).
- Update patches.suse/media-vidtv-psi-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52844 bsc#1225590).
- Update
  patches.suse/mfd-qcom-spmi-pmic-Fix-revid-implementation.patch
  (git-fixes CVE-2023-52765 bsc#1225029).
- Update
  patches.suse/misc-microchip-pci1xxxx-fix-double-free-in-the-error.patch
  (git-fixes CVE-2024-36973 bsc#1226457).
- Update
  patches.suse/net-hns3-fix-out-of-bounds-access-may-occur-when-coa.patch
  (git-fixes CVE-2023-52807 bsc#1225097).
- Update
  patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch
  (git-fixes CVE-2024-36962 bsc#1225827).
- Update
  patches.suse/net-mlx5-Fix-peer-devlink-set-for-SF-representor-dev.patch
  (git-fixes CVE-2024-38595 bsc#1226741).
- Update
  patches.suse/net-mlx5e-Track-xmit-submission-to-PTP-WQ-after-popu.patch
  (jsc#PED-3311 CVE-2023-52782 bsc#1225103).
- Update
  patches.suse/net-mvneta-fix-calls-to-page_pool_get_stats.patch
  (git-fixes CVE-2023-52780 bsc#1224933).
- Update
  patches.suse/net-wangxun-fix-kernel-panic-due-to-null-pointer.patch
  (git-fixes CVE-2023-52783 bsc#1225104).
- Update
  patches.suse/netfilter-complete-validation-of-user-input.patch
  (git-fixes CVE-2024-35896 bsc#1224662 CVE-2024-35962
  bsc#1224583).
- Update
  patches.suse/nfc-nci-Fix-uninit-value-in-nci_rx_work.patch
  (git-fixes CVE-2024-38381 bsc#1226878).
- Update
  patches.suse/nilfs2-fix-nilfs_empty_dir-misjudgment-and-long-loop.patch
  (git-fixes CVE-2024-39469 bsc#1226992).
- Update
  patches.suse/nilfs2-fix-potential-hang-in-nilfs_detach_log_writer.patch
  (git-fixes CVE-2024-38582 bsc#1226658).
- Update
  patches.suse/nilfs2-fix-use-after-free-of-timer-for-log-writer-th.patch
  (git-fixes CVE-2024-38583 bsc#1226777).
- Update
  patches.suse/of-module-add-buffer-overflow-check-in-of_modalias.patch
  (git-fixes CVE-2024-38541 bsc#1226587).
- Update
  patches.suse/padata-Fix-refcnt-handling-in-padata_free_shell.patch
  (git-fixes CVE-2023-52854 bsc#1225584).
- Update
  patches.suse/perf-core-Bail-out-early-if-the-request-AUX-area-is-out-of-bound.patch
  (git-fixes CVE-2023-52835 bsc#1225602).
- Update
  patches.suse/platform-x86-wmi-Fix-opening-of-char-device.patch
  (git-fixes CVE-2023-52864 bsc#1225132).
- Update
  patches.suse/powerpc-pseries-iommu-LPAR-panics-during-boot-up-wit.patch
  (bsc#1222011 ltc#205900 CVE-2024-36926 bsc#1225829).
- Update patches.suse/pstore-platform-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52869 bsc#1225050).
- Update
  patches.suse/remoteproc-mediatek-Make-sure-IPI-buffer-fits-in-L2T.patch
  (git-fixes CVE-2024-36965 bsc#1226149).
- Update
  patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch
  (git-fixes CVE-2024-38601 bsc#1226876).
- Update
  patches.suse/s390-dasd-protect-device-queue-against-concurrent-access.patch
  (git-fixes bsc#1217481 CVE-2023-52774 bsc#1225572).
- Update
  patches.suse/scsi-hisi_sas-Set-debugfs_dir-pointer-to-NULL-after-removing-debugfs.patch
  (git-fixes CVE-2023-52808 bsc#1225555).
- Update
  patches.suse/scsi-ibmvfc-Remove-BUG_ON-in-the-case-of-an-empty-ev.patch
  (bsc#1209834 ltc#202097 CVE-2023-52811 bsc#1225559).
- Update
  patches.suse/scsi-libfc-Fix-potential-NULL-pointer-dereference-in-fc_lport_ptp_setup.patch
  (git-fixes CVE-2023-52809 bsc#1225556).
- Update
  patches.suse/scsi-lpfc-Move-NPIV-s-transport-unregistration-to-af.patch
  (bsc#1221777 CVE-2024-36952 bsc#1225898).
- Update
  patches.suse/scsi-lpfc-Release-hbalock-before-calling-lpfc_worker.patch
  (bsc#1221777 CVE-2024-36924 bsc#1225820).
- Update
  patches.suse/serial-max3100-Lock-port-lock-when-calling-uart_hand.patch
  (git-fixes CVE-2024-38634 bsc#1226868).
- Update
  patches.suse/serial-max3100-Update-uart_driver_registered-on-driv.patch
  (git-fixes CVE-2024-38633 bsc#1226867).
- Update
  patches.suse/soc-qcom-llcc-Handle-a-second-device-without-data-co.patch
  (git-fixes CVE-2023-52871 bsc#1225534).
- Update
  patches.suse/soundwire-cadence-fix-invalid-PDI-offset.patch
  (stable-fixes CVE-2024-38635 bsc#1226863).
- Update patches.suse/speakup-Fix-sizeof-vs-ARRAY_SIZE-bug.patch
  (git-fixes CVE-2024-38587 bsc#1226780).
- Update patches.suse/spi-Fix-null-dereference-on-suspend.patch
  (git-fixes CVE-2023-52749 bsc#1225476).
- Update
  patches.suse/thermal-core-prevent-potential-string-overflow.patch
  (git-fixes CVE-2023-52868 bsc#1225044).
- Update
  patches.suse/thermal-drivers-qcom-lmh-Check-for-SCM-availability-.patch
  (git-fixes CVE-2024-39466 bsc#1227089).
- Update
  patches.suse/thermal-drivers-tsens-Fix-null-pointer-dereference.patch
  (git-fixes CVE-2024-38571 bsc#1226737).
- Update
  patches.suse/thermal-intel-powerclamp-fix-mismatch-in-get-functio.patch
  (git-fixes CVE-2023-52794 bsc#1225028).
- Update
  patches.suse/tls-fix-NULL-deref-on-tls_sw_splice_eof-with-empty-r.patch
  (jsc#PED-6831 CVE-2023-52767 bsc#1224998).
- Update
  patches.suse/tpm_tis_spi-Account-for-SPI-header-when-allocating-T.patch
  (git-fixes CVE-2024-36477 bsc#1226840).
- Update
  patches.suse/tracing-Have-trace_event_file-have-ref-counters.patch
  (git-fixes CVE-2023-52879 bsc#1225101).
- Update
  patches.suse/tracing-trigger-Fix-to-return-error-if-failed-to-alloc-snapshot.patch
  (git-fixes CVE-2024-26920).
- Update
  patches.suse/tty-n_gsm-fix-race-condition-in-status-line-change-o.patch
  (git-fixes CVE-2023-52872 bsc#1225591).
- Update
  patches.suse/tty-n_gsm-require-CAP_NET_ADMIN-to-attach-N_GSM0710-.patch
  (bsc#1222619 CVE-2023-52880).
- Update
  patches.suse/tty-vcc-Add-check-for-kstrdup-in-vcc_probe.patch
  (git-fixes CVE-2023-52789 bsc#1225180).
- Update
  patches.suse/usb-config-fix-iteration-issue-in-usb_get_bos_descri.patch
  (git-fixes CVE-2023-52781 bsc#1225092).
- Update
  patches.suse/usb-dwc3-Wait-unconditionally-after-issuing-EndXfer-.patch
  (git-fixes CVE-2024-36977 bsc#1226513).
- Update
  patches.suse/usb-gadget-u_audio-Fix-race-condition-use-of-control.patch
  (git-fixes CVE-2024-38628 bsc#1226911).
- Update
  patches.suse/usb-storage-alauda-Check-whether-the-media-is-initia.patch
  (git-fixes CVE-2024-38619 bsc#1226861).
- Update
  patches.suse/usb-typec-tcpm-Fix-NULL-pointer-dereference-in-tcpm_.patch
  (git-fixes CVE-2023-52877 bsc#1224944).
- Update
  patches.suse/vhost-vdpa-fix-use-after-free-in-vhost_vdpa_probe.patch
  (jsc#PED-3311 CVE-2023-52795 bsc#1225085).
- Update
  patches.suse/virtio-blk-fix-implicit-overflow-on-virtio_max_dma_s.patch
  (git-fixes CVE-2023-52762 bsc#1225573).
- Update
  patches.suse/virtio-vsock-Fix-uninit-value-in-virtio_transport_re.patch
  (jsc#PED-5505 CVE-2023-52842 bsc#1225025).
- Update
  patches.suse/watchdog-cpu5wdt.c-Fix-use-after-free-bug-caused-by-.patch
  (git-fixes CVE-2024-38630 bsc#1226908).
- Update
  patches.suse/wifi-ar5523-enable-proper-endpoint-verification.patch
  (git-fixes CVE-2024-38565 bsc#1226747).
- Update
  patches.suse/wifi-ath11k-fix-dfs-radar-event-locking.patch
  (git-fixes CVE-2023-52798 bsc#1224947).
- Update
  patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch
  (git-fixes CVE-2023-52777 bsc#1224992).
- Update patches.suse/wifi-ath11k-fix-htt-pktlog-locking.patch
  (git-fixes CVE-2023-52800).
- Update
  patches.suse/wifi-ath12k-fix-dfs-radar-and-temperature-event-lock.patch
  (git-fixes CVE-2023-52776 bsc#1225090).
- Update
  patches.suse/wifi-ath12k-fix-htt-mlo-offset-event-locking.patch
  (git-fixes CVE-2023-52769 bsc#1225001).
- Update
  patches.suse/wifi-ath12k-fix-out-of-bound-access-of-qmi_invoke_ha.patch
  (git-fixes CVE-2024-38572 bsc#1226776).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-read-in-ath12k.patch
  (git-fixes CVE-2023-52827 bsc#1225078).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-write-in-ath12.patch
  (git-fixes CVE-2023-52829 bsc#1225081).
- Update
  patches.suse/wifi-brcmfmac-pcie-handle-randbuf-allocation-failure.patch
  (git-fixes CVE-2024-38575 bsc#1226612).
- Update
  patches.suse/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch
  (git-fixes CVE-2024-38567 bsc#1226769).
- Update
  patches.suse/wifi-carl9170-re-fix-fortified-memset-warning.patch
  (git-fixes CVE-2024-38616 bsc#1226852).
- Update
  patches.suse/wifi-mac80211-don-t-return-unset-power-in-ieee80211_.patch
  (git-fixes CVE-2023-52832 bsc#1225577).
- Update
  patches.suse/wifi-nl80211-Avoid-address-calculations-via-out-of-b.patch
  (git-fixes CVE-2024-38562 bsc#1226788).
- Update
  patches.suse/wifi-wilc1000-use-vmm_table-as-array-in-wilc-struct.patch
  (git-fixes CVE-2023-52768 bsc#1225004).
- Update
  patches.suse/x86-tdx-Zero-out-the-missing-RSI-in-TDX_HYPERCALL-macro.patch
  (jsc#PED-5824 CVE-2023-52874 bsc#1225049).
- commit 33efdc4</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835204">- tcp: Use refcount_inc_not_zero() in tcp_twsk_unique()
  (CVE-2024-36904 bsc#1225732).
- commit d578dcc</changelog>
  <changelog author="heming.zhao@suse.com" date="1719921600">- gfs2: Fix potential glock use-after-free on unmount (bsc#1226775
  CVE-2024-38570).
- gfs2: Rename sd_{ glock =&gt; kill }_wait (bsc#1226775
  CVE-2024-38570).
- commit f3adbca</changelog>
  <changelog author="tiwai@suse.de" date="1719921601">- Correct SCSI patch references (bsc#1225767 CVE-2024-36919 bsc#1226785 CVE-2024-38559)
- commit e8ea587</changelog>
  <changelog author="tiwai@suse.de" date="1719921602">- mtd: rawnand: rockchip: ensure NVDDR timings are rejected
  (git-fixes).
- mtd: rawnand: Bypass a couple of sanity checks during NAND
  identification (git-fixes).
- mtd: rawnand: Fix the nand_read_data_op() early check
  (git-fixes).
- mtd: rawnand: Ensure ECC configuration is propagated to upper
  layers (git-fixes).
- commit e545951</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1719921603">- kernel-doc: fix struct_group_tagged() parsing (git-fixes).
- commit e3a2a2e</changelog>
  <changelog author="fdmanana@suse.com" date="1719921604">- btrfs: fix crash on racing fsync and size-extending write into
  prealloc (bsc#1227101 CVE-2024-37354).
- commit 1d355af</changelog>
  <changelog author="vbabka@suse.cz" date="1719921605">- virt: acrn: stop using follow_pfn (CVE-2024-38610 bsc#1226758).
- commit c2ea51b</changelog>
  <changelog author="vbabka@suse.cz" date="1719921606">- drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
  (CVE-2024-38610 bsc#1226758).
- commit 7069ac2</changelog>
  <changelog author="rhopkins@suse.de" date="1719921607">- hsr: Prevent use after free in prp_create_tagged_frame()
  (CVE-2023-52846 bsc#1225098).
- commit cf63988</changelog>
  <changelog author="krisman@suse.de" date="1719921608">- io_uring: Fix io_cqring_wait() not restoring sigmask on
  get_timespec64() failure (git-fixes).
- commit e640a65</changelog>
  <changelog author="krisman@suse.de" date="1719921609">- io_uring: check for non-NULL file pointer in io_file_can_poll()
  (bsc#1226990 CVE-2024-39371).
- io_uring/io-wq: Use set_bit() and test_bit() at worker-&gt;flags
  (git-fixes).
- io_uring/sqpoll: work around a potential audit memory leak
  (git-fixes).
- commit 24603fc</changelog>
  <changelog author="krisman@suse.de" date="1719921610">- io_uring/rsrc: fix incorrect assignment of iter-&gt;nr_segs in
  io_import_fixed (git-fixes).
- io_uring/rsrc: don't lock while !TASK_RUNNING (git-fixes).
- io_uring/io-wq: avoid garbage value of 'match' in
  io_wq_enqueue() (git-fixes).
- commit 7d3e252</changelog>
</package>
<package pkgid="f7a32b28a29b44331081a7b076d8a2751897053a2e31f8ef4960edbe94c46413" name="dtb-amd" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.17.1"/>
  <changelog author="tiwai@suse.de" date="1722081600">- auxdisplay: ht16k33: Drop reference after LED registration
  (git-fixes).
- ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
  on unprepare (git-fixes).
- ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
- ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
  reachable (git-fixes).
- ASoC: sof: amd: fix for firmware reload failure in Vangogh
  platform (git-fixes).
- ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
- ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
  (git-fixes).
- ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
- ALSA: ump: Don't update FB name for static blocks (git-fixes).
- drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
- drm/i915/gt: Do not consider preemption during execlists_dequeue
  for gen8 (git-fixes).
- drm/i915/dp: Don't switch the LTTPR mode on an active link
  (git-fixes).
- commit d7e2deb</changelog>
  <changelog author="tiwai@suse.de" date="1722081601">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
</package>
<package pkgid="021365decfaaef01205810547856a441255b52cc995dee3b81a43ce71e1b5c80" name="dtb-amd" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.7.1"/>
  <changelog author="mkubecek@suse.cz" date="1717416000">- netfilter: nf_tables: release mutex after nft_gc_seq_end from
  abort path (CVE-2024-26925 bsc#1223390).
- commit 578a709</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717416001">- Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
  The L3 bsc#1225765 was created seperately since our customer requires
  PTF.
- Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
- Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
- Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
- Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
- commit 054635e</changelog>
  <changelog author="msuchanek@suse.de" date="1717416002">- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
- powerpc/uaccess: Fix build errors seen with GCC 13/14
  (bsc#1194869).
- commit 46b5d84</changelog>
  <changelog author="msuchanek@suse.de" date="1717416003">- blacklist.conf: PPC fsl_msi is not used
- commit ae6590d</changelog>
  <changelog author="msuchanek@suse.de" date="1717416004">- powerpc/pseries/lparcfg: drop error message from guest name
  lookup (bsc#1187716 ltc#193451 git-fixes).
- commit ceab637</changelog>
  <changelog author="mfranc@suse.cz" date="1717416005">- Update
  patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
  (git-fixes CVE-2024-36955).
- Update
  patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
  (git-fixes bsc#1225715 CVE-2024-36906).
- Update
  patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
  (git-fixes bsc#1225579 CVE-2024-36011).
- Update
  patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
  (git-fixes bsc#1225578 CVE-2024-36013).
- Update
  patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
  (git-fixes bsc#1225502 CVE-2024-36012).
- Update
  patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
  (git-fixes bsc#1225722 CVE-2024-36880).
- Update
  patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
  (git-fixes CVE-2024-36942).
- Update
  patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
  (git-fixes bsc#1225720 CVE-2024-36032).
- Update
  patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
  (git-fixes bsc#1223749 CVE-2024-26990).
- Update
  patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
  (git-fixes bsc#1223692 CVE-2024-26992).
- Update
  patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
  (stable-fixes CVE-2024-36944).
- Update
  patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
  (git-fixes bsc#1225734 CVE-2024-36896).
- Update
  patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
  (stable-fixes CVE-2024-36949).
- Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
  (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
- Update
  patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
  (git-fixes bsc#1225692 CVE-2023-52882).
- Update
  patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
  (git-fixes CVE-2024-26761).
- Update
  patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
  (stable-fixes bsc#1225735 CVE-2024-36897).
- Update
  patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
  (stable-fixes bsc#1225705 CVE-2024-36026).
- Update
  patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
  (stable-fixes CVE-2024-36951).
- Update
  patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
  (git-fixes bsc#1225593 CVE-2024-36014).
- Update
  patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
  (stable-fixes bsc#1225728 CVE-2024-36885).
- Update
  patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
  (git-fixes bsc#1225773 CVE-2024-36936).
- Update
  patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
  (stable-fixes CVE-2024-36950).
- Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
  (git-fixes bsc#1225736 CVE-2024-36898).
- Update
  patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
  (git-fixes bsc#1225698 CVE-2024-36020).
- Update
  patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
  (git-fixes bsc#1225710 CVE-2024-36891).
- Update
  patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
  (git-fixes bsc#1225714 CVE-2024-36890).
- Update
  patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
  (git-fixes bsc#1225708 CVE-2024-36029).
- Update
  patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
  (git-fixes bsc#1225699 CVE-2024-36021).
- Update
  patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
  (git-fixes CVE-2024-26943).
- Update
  patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
  (git-fixes bsc#1225694 CVE-2024-36018).
- Update
  patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
  (git-fixes CVE-2024-36940).
- Update
  patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
  (git-fixes CVE-2024-36959).
- Update
  patches.suse/ppdev-Add-an-error-check-in-register_device.patch
  (git-fixes bsc#1225640 CVE-2024-36015).
- Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
  CVE-2024-36947).
- Update
  patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
  (git-fixes bsc#1225695 CVE-2024-36019).
- Update
  patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
  (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
- Update
  patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
  (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
- Update
  patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
  (git-fixes bsc#1225704 CVE-2024-36025).
- Update
  patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
  (git-fixes CVE-2024-36930).
- Update
  patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
  (bsc#1224331 bsc#1224602 CVE-2024-35814).
- Update
  patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
  (git-fixes bsc#1225642 CVE-2024-36016).
- Update
  patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
  (git-fixes bsc#1225749 CVE-2024-36894).
- Update
  patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
  (git-fixes bsc#1225750 CVE-2024-36895).
- Update
  patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
  (git-fixes bsc#1225748 CVE-2024-36893).
- Update
  patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
  (stable-fixes bsc#1225769 CVE-2024-36921).
- Update
  patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
  (stable-fixes CVE-2024-36922).
- Update
  patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
  (git-fixes CVE-2024-36941).
- Update
  patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
  (git-fixes bsc#1224742 CVE-2024-35803).
- commit 539780f</changelog>
  <changelog author="dwagner@suse.de" date="1717416006">- nvmet: fix ns enable/disable possible hang (git-fixes).
- nvme-multipath: fix io accounting on failover (git-fixes).
- nvme: fix multipath batched completion accounting (git-fixes).
- commit ed3b392</changelog>
  <changelog author="dwagner@suse.de" date="1717416007">- scsi: lpfc: Copyright updates for 14.4.0.2 patches
  (bsc#1225842).
- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
  (bsc#1225842).
  Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
  (bsc#1225842).
- scsi: lpfc: Clear deferred RSCN processing flag when driver
  is unloading (bsc#1225842).
- scsi: lpfc: Update logging of protection type for T10 DIF I/O
  (bsc#1225842).
- scsi: lpfc: Change default logging level for unsolicited CT
  MIB commands (bsc#1225842).
- commit 5a56384</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416008">- smb: client: fix mount when dns_resolver key is not available
  (git-fixes, bsc#1225172).
- commit 28edb5c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416009">- cifs: fix leak of iface for primary channel (git-fixes,
  bsc#1225172).
- commit b7eb8e8</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416010">- Revert "cifs: reconnect work should have reference on server
  struct" (git-fixes, bsc#1225172).
- commit 3ca4c0c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416011">- smb: client: fix parsing of SMB3.1.1 POSIX create context
  (git-fixes, bsc#1225172).
- commit 5f27f69</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416012">- cifs: failure to add channel on iface should bump up weight
  (git-fixes, bsc#1225172).
- commit 007b237</changelog>
  <changelog author="tonyj@suse.de" date="1717416013">- perf/x86: Fix out of range data (git-fixes).
- perf/x86/intel/ds: Don't clear -&gt;pebs_data_cfg for the last
  PEBS event (git-fixes).
- perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
- commit 664d77f</changelog>
  <changelog author="dsterba@suse.com" date="1717588800">- blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
- Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
  Quoting bsc#1225945#c11:
  "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
  transaction for every subvol create")
  ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
  unwritten extent buffer after snapshotting a new subvolume") was never
  backported."
- commit d947258</changelog>
  <changelog author="tonyj@suse.de" date="1717588801">- perf pmu: Count sys and cpuid JSON events separately (git
  fixes).
- perf stat: Don't display metric header for non-leader uncore
  events (git-fixes).
- perf daemon: Fix file leak in daemon_session__control
  (git-fixes).
- perf symbols: Fix ownership of string in dso__load_vmlinux()
  (git-fixes).
- perf thread: Fixes to thread__new() related to initializing comm
  (git-fixes).
- perf report: Avoid SEGV in report__setup_sample_type()
  (git-fixes).
- perf ui browser: Don't save pointer to stack memory (git-fixes).
- perf bench internals inject-build-id: Fix trap divide when
  collecting just one DSO (git-fixes).
- perf intel-pt: Fix unassigned instruction op (discovered by
  MemorySanitizer) (git-fixes).
- perf test shell arm_coresight: Increase buffer size for
  Coresight basic tests (git-fixes).
- perf docs: Document bpf event modifier (git-fixes).
- perf bench uprobe: Remove lib64 from libc.so.6 binary path
  (git-fixes).
- perf record: Fix debug message placement for test consumption
  (git-fixes).
- perf tests: Apply attributes to all events in object code
  reading test (git-fixes).
- perf tests: Make "test data symbol" more robust on Neoverse N1
  (git-fixes).
- perf annotate: Fix annotation_calc_lines() to pass correct
  address to get_srcline() (git-fixes).
- perf stat: Do not fail on metrics on s390 z/VM systems
  (git-fixes).
- perf sched timehist: Fix -g/--call-graph option failure
  (git-fixes).
- perf annotate: Get rid of duplicate --group option item
  (git-fixes).
- perf probe: Add missing libgen.h header needed for using
  basename() (git-fixes).
- perf record: Delete session after stopping sideband thread
  (git-fixes).
- perf auxtrace: Fix multiple use of --itrace option (git-fixes).
- perf script: Show also errors for --insn-trace option
  (git-fixes).
- perf lock contention: Add a missing NULL check (git-fixes).
- perf vendor events amd: Fix Zen 4 cache latency events
  (git-fixes).
- libperf evlist: Avoid out-of-bounds access (git-fixes).
- perf pmu: Fix a potential memory leak in perf_pmu__lookup()
  (git-fixes).
- perf print-events: make is_event_supported() more robust
  (git-fixes).
- perf list: fix short description for some cache events
  (git-fixes).
- perf metric: Don't remove scale from counts (git-fixes).
- perf stat: Avoid metric-only segv (git-fixes).
- perf expr: Fix "has_event" function for metric style events
  (git-fixes).
- perf srcline: Add missed addr2line closes (git-fixes).
- perf thread_map: Free strlist on normal path in
  thread_map__new_by_tid_str() (git-fixes).
- perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
- perf jevents: Drop or simplify small integer values (git-fixes).
- perf evsel: Fix duplicate initialization of data-&gt;id in
  evsel__parse_sample() (git-fixes).
- perf pmu: Treat the msr pmu as software (git-fixes).
- perf record: Check conflict between '--timestamp-filename'
  option and pipe mode before recording (git-fixes).
- perf record: Fix possible incorrect free in
  record__switch_output() (git-fixes).
- perf vendor events amd: Add Zen 4 memory controller events
  (git-fixes).
- perf top: Uniform the event name for the hybrid machine
  (git-fixes).
- perf top: Use evsel's cpus to replace user_requested_cpus
  (git-fixes).
- commit a1f9340</changelog>
  <changelog author="tonyj@suse.de" date="1717675200">- perf ui browser: Avoid SEGV on title (git fixes).
- commit 1578c22</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675201">- inet: inet_defrag: prevent sk release while still in use
  (CVE-2024-26921 bsc#1223138).
- commit 2016faf</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675202">- net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
- commit 7bf5961</changelog>
  <changelog author="tiwai@suse.de" date="1718366400">- Temporarily drop KVM patch that caused a regression (bsc#1226158)
  Delete patches.suse/KVM-x86-pmu-Prioritize-VMX-interception-over-GP-on-R.patch
- commit 33f31da</changelog>
</package>
<package pkgid="9d0cdf45d3f2d2124af4823d4856cbc32a3bf3085a9ebea3d19e09f79b02a7f7" name="dtb-amlogic" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.14.1"/>
  <changelog author="tiwai@suse.de" date="1719662400">- gpiolib: cdev: Disallow reconfiguration without direction
  (uAPI v1) (git-fixes).
- gpio: davinci: Validate the obtained number of IRQs (git-fixes).
- commit 919ebd1</changelog>
  <changelog author="tiwai@suse.de" date="1719748800">- i2c: testunit: discard write requests while old command is
  running (git-fixes).
- i2c: testunit: don't erase registers after STOP (git-fixes).
- mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
  (git-fixes).
- mmc: sdhci: Do not invert write-protect twice (git-fixes).
- mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
  (git-fixes).
- mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
  (git-fixes).
- commit 448487d</changelog>
  <changelog author="tiwai@suse.de" date="1719748801">- crypto: iaa - Account for cpu-less numa nodes (bsc#1227190).
- commit cd600aa</changelog>
  <changelog author="tiwai@suse.de" date="1719748802">- crypto: deflate - Add aliases to deflate (bsc#1227190).
- commit 27ffd92</changelog>
  <changelog author="tiwai@suse.de" date="1719835200">- ata: ahci: Clean up sysfs file on error (git-fixes).
- ata: libata-core: Fix double free on error (git-fixes).
- ata,scsi: libata-core: Do not leak memory for ata_port struct
  members (git-fixes).
- ata: libata-core: Fix null pointer dereference on error
  (git-fixes).
- kbuild: Fix build target deb-pkg: ln: failed to create hard link
  (git-fixes).
- kbuild: doc: Update default INSTALL_MOD_DIR from extra to
  updates (git-fixes).
- kbuild: Install dtb files as 0644 in Makefile.dtbinst
  (git-fixes).
- counter: ti-eqep: enable clock at probe (git-fixes).
- iio: chemical: bme680: Fix sensor data read operation
  (git-fixes).
- iio: chemical: bme680: Fix overflows in compensate() functions
  (git-fixes).
- iio: chemical: bme680: Fix calibration data variable
  (git-fixes).
- iio: chemical: bme680: Fix pressure value output (git-fixes).
- iio: accel: fxls8962af: select IIO_BUFFER &amp; IIO_KFIFO_BUF
  (git-fixes).
- iio: adc: ad7266: Fix variable checking bug (git-fixes).
- iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
  (git-fixes).
- serial: bcm63xx-uart: fix tx after conversion to
  uart_port_tx_limited() (git-fixes).
- serial: core: introduce uart_port_tx_limited_flags()
  (git-fixes).
- Revert "serial: core: only stop transmit when HW fifo is empty"
  (git-fixes).
- tty: mcf: MCF54418 has 10 UARTS (git-fixes).
- usb: gadget: aspeed_udc: fix device address configuration
  (git-fixes).
- usb: dwc3: core: remove lock of otg mode during gadget
  suspend/resume to avoid deadlock (git-fixes).
- usb: typec: ucsi: glink: fix child node release in probe
  function (git-fixes).
- usb: musb: da8xx: fix a resource leak in probe() (git-fixes).
- usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  (git-fixes).
- usb: gadget: printer: fix races against disable (git-fixes).
- PCI/MSI: Fix UAF in msi_capability_init (git-fixes).
- commit a2ea5a9</changelog>
  <changelog author="ptesarik@suse.com" date="1719835201">- net: ena: Fix redundant device NUMA node override
  (jsc#PED-8688).
- commit 6ad6684</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835202">- tcp: do not accept ACK of bytes we never sent (CVE-2023-52881
  bsc#1225611).
- commit 16404a6</changelog>
  <changelog author="mhocko@suse.com" date="1719835203">- Update
  patches.suse/1352-drm-amdgpu-Fix-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52883
  bsc#1226630).
- Update
  patches.suse/9p-add-missing-locking-around-taking-dentry-fid-list.patch
  (git-fixes CVE-2024-39463 bsc#1227090).
- Update
  patches.suse/ALSA-Fix-deadlocks-with-kctl-removals-at-disconnecti.patch
  (stable-fixes CVE-2024-38600 bsc#1226864).
- Update
  patches.suse/ALSA-core-Fix-NULL-module-pointer-assignment-at-card.patch
  (git-fixes CVE-2024-38605 bsc#1226740).
- Update
  patches.suse/ALSA-hda-Fix-possible-null-ptr-deref-when-assigning-.patch
  (git-fixes CVE-2023-52806 bsc#1225554).
- Update
  patches.suse/ALSA-hda-cs_dsp_ctl-Use-private_free-for-control-cle.patch
  (git-fixes CVE-2024-38388 bsc#1226890).
- Update
  patches.suse/ALSA-timer-Set-lower-bound-of-start-tick-time.patch
  (stable-fixes git-fixes CVE-2024-38618 bsc#1226754).
- Update
  patches.suse/ASoC-kirkwood-Fix-potential-NULL-dereference.patch
  (git-fixes CVE-2024-38550 bsc#1226633).
- Update
  patches.suse/ASoC-mediatek-Assign-dummy-when-codec-not-specified-.patch
  (git-fixes CVE-2024-38551 bsc#1226761).
- Update
  patches.suse/Bluetooth-btusb-Add-date-evt_skb-is-NULL-check.patch
  (git-fixes CVE-2023-52833 bsc#1225595).
- Update
  patches.suse/Bluetooth-hci_core-Fix-possible-buffer-overflow.patch
  (git-fixes CVE-2024-26889).
- Update
  patches.suse/HID-uclogic-Fix-user-memory-access-bug-in-uclogic_pa.patch
  (git-fixes CVE-2023-52866 bsc#1225120).
- Update
  patches.suse/IB-mlx5-Fix-init-stage-error-handling-to-avoid-doubl.patch
  (jsc#PED-6864 CVE-2023-52851 bsc#1225587).
- Update
  patches.suse/Input-cyapa-add-missing-input-core-locking-to-suspen.patch
  (git-fixes CVE-2023-52884 bsc#1226764).
- Update
  patches.suse/Input-synaptics-rmi4-fix-use-after-free-in-rmi_unreg.patch
  (git-fixes CVE-2023-52840 bsc#1224928).
- Update
  patches.suse/KEYS-trusted-Do-not-use-WARN-when-encode-fails.patch
  (git-fixes CVE-2024-36975 bsc#1226520).
- Update
  patches.suse/KEYS-trusted-Fix-memory-leak-in-tpm2_key_encode.patch
  (git-fixes CVE-2024-36967 bsc#1226131).
- Update
  patches.suse/RDMA-cma-Fix-kmemleak-in-rdma_core-observed-during-b.patch
  (git-fixes CVE-2024-38539 bsc#1226608).
- Update patches.suse/RDMA-hns-Fix-UAF-for-cq-async-event.patch
  (git-fixes CVE-2024-38545 bsc#1226595).
- Update
  patches.suse/RDMA-hns-Fix-deadlock-on-SRQ-async-events.patch
  (git-fixes CVE-2024-38591 bsc#1226738).
- Update
  patches.suse/RDMA-hns-Modify-the-print-level-of-CQE-error.patch
  (git-fixes CVE-2024-38590 bsc#1226839).
- Update
  patches.suse/RDMA-rxe-Fix-seg-fault-in-rxe_comp_queue_pkt.patch
  (git-fixes CVE-2024-38544 bsc#1226597).
- Update
  patches.suse/SUNRPC-Fix-RPC-client-cleaned-up-the-freed-pipefs-de.patch
  (git-fixes CVE-2023-52803 bsc#1225008).
- Update patches.suse/af_unix-Clear-stale-u-oob_skb.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-35970 bsc#1224584).
- Update
  patches.suse/af_unix-Drop-oob_skb-ref-before-purging-queue-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26750 bsc#1222617).
- Update
  patches.suse/af_unix-Fix-task-hung-while-purging-oob_skb-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26780 bsc#1222588).
- Update
  patches.suse/af_unix-Update-unix_sk-sk-oob_skb-under-sk_receive_queue-lock.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-36972 bsc#1226163).
- Update
  patches.suse/arm64-Restrict-CPU_BIG_ENDIAN-to-GNU-as-or-LLVM-IAS-.patch
  (git-fixes CVE-2023-52750 bsc#1225485).
- Update
  patches.suse/atl1c-Work-around-the-DMA-RX-overflow-issue.patch
  (git-fixes CVE-2023-52834 bsc#1225599).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issue-of-net_device.patch
  (git-fixes CVE-2024-38554 bsc#1226742).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issues-of-ax25_dev.patch
  (git-fixes CVE-2024-38602 bsc#1226613).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-reorder-of-WRITE-lqueued.patch
  (bsc#1225605 CVE-2024-38384 bsc#1226938).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-resetting-io-stat.patch
  (bsc#1225605 CVE-2024-38663 bsc#1226939).
- Update
  patches.suse/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch
  (git-fixes CVE-2024-38540 bsc#1226582).
- Update
  patches.suse/bonding-stop-the-device-in-bond_setup_by_slave.patch
  (git-fixes CVE-2023-52784 bsc#1224946).
- Update
  patches.suse/can-dev-can_put_echo_skb-don-t-crash-kernel-if-can_p.patch
  (git-fixes CVE-2023-52878 bsc#1225000).
- Update
  patches.suse/clk-mediatek-clk-mt2701-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52875 bsc#1225096).
- Update
  patches.suse/clk-mediatek-clk-mt6765-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52870 bsc#1224937).
- Update
  patches.suse/clk-mediatek-clk-mt6779-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52873 bsc#1225589).
- Update
  patches.suse/clk-mediatek-clk-mt6797-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52865 bsc#1225086).
- Update
  patches.suse/clk-mediatek-clk-mt7629-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52858 bsc#1225566).
- Update
  patches.suse/clk-mediatek-clk-mt7629-eth-Add-check-for-mtk_alloc_.patch
  (git-fixes CVE-2023-52876 bsc#1225036).
- Update
  patches.suse/cppc_cpufreq-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38573 bsc#1226739).
- Update patches.suse/cpufreq-exit-callback-is-optional.patch
  (git-fixes CVE-2024-38615 bsc#1226592).
- Update patches.suse/crypto-bcm-Fix-pointer-arithmetic.patch
  (git-fixes CVE-2024-38579 bsc#1226637).
- Update
  patches.suse/crypto-pcrypt-Fix-hungtask-for-PADATA_RESET.patch
  (git-fixes CVE-2023-52813 bsc#1225527).
- Update patches.suse/cxl-mem-Fix-shutdown-order.patch (git-fixes
  CVE-2023-52849 bsc#1224949).
- Update
  patches.suse/cxl-region-Do-not-try-to-cleanup-after-cxl_region_se.patch
  (git-fixes CVE-2023-52792 bsc#1225477).
- Update patches.suse/cxl-region-Fix-cxlr_pmem-leaks.patch
  (git-fixes CVE-2024-38391 bsc#1226894).
- Update
  patches.suse/dma-buf-sw-sync-don-t-enable-IRQ-from-sync_print_obj.patch
  (git-fixes CVE-2024-38780 bsc#1226886).
- Update
  patches.suse/dma-mapping-benchmark-fix-node-id-validation.patch
  (git-fixes CVE-2024-34777 bsc#1226796).
- Update
  patches.suse/dma-mapping-benchmark-handle-NUMA_NO_NODE-correctly.patch
  (git-fixes CVE-2024-39277 bsc#1226909).
- Update
  patches.suse/dmaengine-idxd-Avoid-unnecessary-destruction-of-file.patch
  (git-fixes CVE-2024-38629 bsc#1226905).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Pola.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52819
  bsc#1225532).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-SMU7.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52818
  bsc#1225530).
- Update
  patches.suse/drm-amd-check-num-of-link-levels-when-update-pcie-pa.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52812
  bsc#1225564).
- Update
  patches.suse/drm-amd-display-Avoid-NULL-dereference-of-timing-gen.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52753
  bsc#1225478).
- Update
  patches.suse/drm-amd-display-Fix-division-by-zero-in-setup_dsc_co.patch
  (stable-fixes CVE-2024-36969 bsc#1226155).
- Update
  patches.suse/drm-amd-display-Fix-null-pointer-dereference-in-erro.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52862
  bsc#1225015).
- Update
  patches.suse/drm-amd-display-Fix-potential-index-out-of-bounds-in.patch
  (git-fixes CVE-2024-38552 bsc#1226767).
- Update
  patches.suse/drm-amd-display-fix-a-NULL-pointer-dereference-in-am.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52773
  bsc#1225041).
- Update
  patches.suse/drm-amd-display-fixed-integer-types-and-null-check-l.patch
  (git-fixes CVE-2024-26767).
- Update
  patches.suse/drm-amdgpu-Fix-a-null-pointer-access-when-the-smc_rr.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52817
  bsc#1225569).
- Update
  patches.suse/drm-amdgpu-Fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch
  (git-fixes CVE-2024-39291 bsc#1226934).
- Update
  patches.suse/drm-amdgpu-Fix-potential-null-pointer-derefernce.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52814
  bsc#1225565).
- Update
  patches.suse/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch
  (stable-fixes CVE-2024-39471 bsc#1227096).
- Update
  patches.suse/drm-amdgpu-mes-fix-use-after-free-issue.patch
  (stable-fixes CVE-2024-38581 bsc#1226657).
- Update
  patches.suse/drm-amdgpu-vkms-fix-a-possible-null-pointer-derefere.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52815
  bsc#1225568).
- Update
  patches.suse/drm-amdkfd-Fix-a-race-condition-of-vram-buffer-unref.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52825
  bsc#1225076).
- Update
  patches.suse/drm-amdkfd-Fix-shift-out-of-bounds-issue.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52816
  bsc#1225529).
- Update
  patches.suse/drm-bridge-cdns-mhdp8546-Fix-possible-null-pointer-d.patch
  (git-fixes CVE-2024-38548).
- Update
  patches.suse/drm-bridge-it66121-Fix-invalid-connector-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52861
  bsc#1224941).
- Update
  patches.suse/drm-bridge-lt8912b-Fix-crash-on-bridge-detach.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52856
  bsc#1224932).
- Update
  patches.suse/drm-mediatek-Add-0-size-check-to-mtk_drm_gem_obj.patch
  (git-fixes CVE-2024-38549 bsc#1226735).
- Update
  patches.suse/drm-mediatek-Fix-coverity-issue-with-unintentional-i.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52857
  bsc#1225581).
- Update
  patches.suse/drm-mediatek-Init-ddp_comp-with-devm_kcalloc.patch
  (git-fixes CVE-2024-38592 bsc#1226844).
- Update
  patches.suse/drm-msm-a6xx-Avoid-a-nullptr-dereference-when-speedb.patch
  (git-fixes CVE-2024-38390 bsc#1226891).
- Update
  patches.suse/drm-msm-dpu-Add-callback-function-pointer-check-befo.patch
  (git-fixes CVE-2024-38622 bsc#1226856).
- Update
  patches.suse/drm-panel-fix-a-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52821
  bsc#1225022).
- Update
  patches.suse/drm-panel-panel-tpo-tpg110-fix-a-possible-null-point.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52826
  bsc#1225077).
- Update patches.suse/drm-radeon-possible-buffer-overflow.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52867
  bsc#1225009).
- Update
  patches.suse/drm-vc4-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38546 bsc#1226593).
- Update
  patches.suse/drm-vmwgfx-Fix-invalid-reads-in-fence-signaled-event.patch
  (git-fixes CVE-2024-36960 bsc#1225872).
- Update
  patches.suse/drm-zynqmp_dpsub-Always-register-bridge.patch
  (git-fixes CVE-2024-38664 bsc#1226941).
- Update
  patches.suse/e1000e-change-usleep_range-to-udelay-in-PHY-mdic-acc.patch
  (CVE-2024-39296 bsc#1226989 CVE-2024-36887 bsc#1225731).
- Update
  patches.suse/ecryptfs-Fix-buffer-size-for-tag-66-packet.patch
  (git-fixes CVE-2024-38578 bsc#1226634).
- Update
  patches.suse/efi-libstub-only-free-priv.runtime_map-when-allocate.patch
  (git-fixes CVE-2024-33619 bsc#1226768).
- Update
  patches.suse/fbdev-imsttfb-fix-a-resource-leak-in-probe.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52838
  bsc#1225031).
- Update
  patches.suse/fs-9p-only-translate-RWX-permissions-for-plain-9P200.patch
  (git-fixes CVE-2024-36964 bsc#1225866).
- Update
  patches.suse/fs-jfs-Add-check-for-negative-db_l2nbperpage.patch
  (git-fixes CVE-2023-52810 bsc#1225557).
- Update
  patches.suse/fs-jfs-Add-validity-check-for-db_maxag-and-db_agpref.patch
  (git-fixes CVE-2023-52804 bsc#1225550).
- Update
  patches.suse/ftrace-Fix-possible-use-after-free-issue-in-ftrace_location.patch
  (git-fixes CVE-2024-38588 bsc#1226837).
- Update
  patches.suse/genirq-irqdesc-Prevent-use-after-free-in-irq_find_at.patch
  (git-fixes CVE-2024-38385 bsc#1227085).
- Update patches.suse/gfs2-ignore-negated-quota-changes.patch
  (git-fixes CVE-2023-52759 bsc#1225560).
- Update
  patches.suse/hid-cp2112-Fix-duplicate-workqueue-initialization.patch
  (git-fixes CVE-2023-52853 bsc#1224988).
- Update
  patches.suse/hwmon-axi-fan-control-Fix-possible-NULL-pointer-dere.patch
  (git-fixes CVE-2023-52863 bsc#1225586).
- Update
  patches.suse/i2c-acpi-Unbind-mux-adapters-before-delete.patch
  (git-fixes CVE-2024-39362 bsc#1226995).
- Update
  patches.suse/i2c-core-Run-atomic-i2c-xfer-when-preemptible.patch
  (git-fixes CVE-2023-52791 bsc#1225108).
- Update
  patches.suse/i3c-master-mipi-i3c-hci-Fix-a-kernel-panic-for-acces.patch
  (git-fixes CVE-2023-52763 bsc#1225570).
- Update
  patches.suse/i3c-mipi-i3c-hci-Fix-out-of-bounds-access-in-hci_dma.patch
  (git-fixes CVE-2023-52766).
- Update
  patches.suse/i915-perf-Fix-NULL-deref-bugs-with-drm_dbg-calls.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52788
  bsc#1225106).
- Update
  patches.suse/igb-Fix-string-truncation-warnings-in-igb_set_fw_ver.patch
  (git-fixes CVE-2024-36010 bsc#1225594).
- Update
  patches.suse/iommu-vt-d-Fix-WARN_ON-in-iommu-probe-path.patch
  (git-fixes CVE-2024-35957 bsc#1224673).
- Update
  patches.suse/iommufd-Fix-missing-update-of-domains_itree-after-splitting-iopt
  (jsc#PED-7779 jsc#PED-7780 CVE-2023-52801 bsc#1225006).
- Update
  patches.suse/ipvlan-add-ipvlan_route_v6_outbound-helper.patch
  (git-fixes CVE-2023-52796 bsc#1224930).
- Update
  patches.suse/jffs2-prevent-xattr-node-from-overflowing-the-eraseblock.patch
  (git-fixes CVE-2024-38599 bsc#1226848).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-dbFindLeaf.patch
  (git-fixes CVE-2023-52799 bsc#1225472).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-diAlloc.patch
  (git-fixes CVE-2023-52805 bsc#1225553).
- Update
  patches.suse/kunit-fortify-Fix-mismatched-kvalloc-vfree-usage.patch
  (git-fixes CVE-2024-38617 bsc#1226859).
- Update
  patches.suse/lib-generic-radix-tree.c-Don-t-overflow-in-peek.patch
  (git-fixes CVE-2021-47432 bsc#1225391).
- Update
  patches.suse/lib-test_hmm.c-handle-src_pfns-and-dst_pfns-allocati.patch
  (git-fixes CVE-2024-38543 bsc#1226594).
- Update
  patches.suse/locking-ww_mutex-test-Fix-potential-workqueue-corrup.patch
  (bsc#1219953 CVE-2023-52836 bsc#1225609).
- Update
  patches.suse/md-Don-t-ignore-suspended-array-in-md_check_recovery-1baa.patch
  (bsc#1219596 CVE-2024-26758).
- Update
  patches.suse/media-atomisp-ssh_css-Fix-a-null-pointer-dereference.patch
  (git-fixes CVE-2024-38547 bsc#1226632).
- Update
  patches.suse/media-bttv-fix-use-after-free-error-due-to-btv-timeo.patch
  (git-fixes CVE-2023-52847 bsc#1225588).
- Update
  patches.suse/media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch
  (git-fixes CVE-2023-52764 bsc#1225571).
- Update
  patches.suse/media-hantro-Check-whether-reset-op-is-defined-befor.patch
  (git-fixes CVE-2023-52850 bsc#1225014).
- Update
  patches.suse/media-i2c-et8ek8-Don-t-strip-remove-function-when-dr.patch
  (git-fixes CVE-2024-38611 bsc#1226760).
- Update
  patches.suse/media-imon-fix-access-to-invalid-resource-for-the-se.patch
  (git-fixes CVE-2023-52754 bsc#1225490).
- Update
  patches.suse/media-lgdt3306a-Add-a-check-against-null-pointer-def.patch
  (stable-fixes CVE-2022-48772 bsc#1226976).
- Update
  patches.suse/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch
  (git-fixes CVE-2024-38621 bsc#1226895).
- Update
  patches.suse/media-vidtv-mux-Add-check-and-kfree-for-kstrdup.patch
  (git-fixes CVE-2023-52841 bsc#1225592).
- Update patches.suse/media-vidtv-psi-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52844 bsc#1225590).
- Update
  patches.suse/mfd-qcom-spmi-pmic-Fix-revid-implementation.patch
  (git-fixes CVE-2023-52765 bsc#1225029).
- Update
  patches.suse/misc-microchip-pci1xxxx-fix-double-free-in-the-error.patch
  (git-fixes CVE-2024-36973 bsc#1226457).
- Update
  patches.suse/net-hns3-fix-out-of-bounds-access-may-occur-when-coa.patch
  (git-fixes CVE-2023-52807 bsc#1225097).
- Update
  patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch
  (git-fixes CVE-2024-36962 bsc#1225827).
- Update
  patches.suse/net-mlx5-Fix-peer-devlink-set-for-SF-representor-dev.patch
  (git-fixes CVE-2024-38595 bsc#1226741).
- Update
  patches.suse/net-mlx5e-Track-xmit-submission-to-PTP-WQ-after-popu.patch
  (jsc#PED-3311 CVE-2023-52782 bsc#1225103).
- Update
  patches.suse/net-mvneta-fix-calls-to-page_pool_get_stats.patch
  (git-fixes CVE-2023-52780 bsc#1224933).
- Update
  patches.suse/net-wangxun-fix-kernel-panic-due-to-null-pointer.patch
  (git-fixes CVE-2023-52783 bsc#1225104).
- Update
  patches.suse/netfilter-complete-validation-of-user-input.patch
  (git-fixes CVE-2024-35896 bsc#1224662 CVE-2024-35962
  bsc#1224583).
- Update
  patches.suse/nfc-nci-Fix-uninit-value-in-nci_rx_work.patch
  (git-fixes CVE-2024-38381 bsc#1226878).
- Update
  patches.suse/nilfs2-fix-nilfs_empty_dir-misjudgment-and-long-loop.patch
  (git-fixes CVE-2024-39469 bsc#1226992).
- Update
  patches.suse/nilfs2-fix-potential-hang-in-nilfs_detach_log_writer.patch
  (git-fixes CVE-2024-38582 bsc#1226658).
- Update
  patches.suse/nilfs2-fix-use-after-free-of-timer-for-log-writer-th.patch
  (git-fixes CVE-2024-38583 bsc#1226777).
- Update
  patches.suse/of-module-add-buffer-overflow-check-in-of_modalias.patch
  (git-fixes CVE-2024-38541 bsc#1226587).
- Update
  patches.suse/padata-Fix-refcnt-handling-in-padata_free_shell.patch
  (git-fixes CVE-2023-52854 bsc#1225584).
- Update
  patches.suse/perf-core-Bail-out-early-if-the-request-AUX-area-is-out-of-bound.patch
  (git-fixes CVE-2023-52835 bsc#1225602).
- Update
  patches.suse/platform-x86-wmi-Fix-opening-of-char-device.patch
  (git-fixes CVE-2023-52864 bsc#1225132).
- Update
  patches.suse/powerpc-pseries-iommu-LPAR-panics-during-boot-up-wit.patch
  (bsc#1222011 ltc#205900 CVE-2024-36926 bsc#1225829).
- Update patches.suse/pstore-platform-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52869 bsc#1225050).
- Update
  patches.suse/remoteproc-mediatek-Make-sure-IPI-buffer-fits-in-L2T.patch
  (git-fixes CVE-2024-36965 bsc#1226149).
- Update
  patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch
  (git-fixes CVE-2024-38601 bsc#1226876).
- Update
  patches.suse/s390-dasd-protect-device-queue-against-concurrent-access.patch
  (git-fixes bsc#1217481 CVE-2023-52774 bsc#1225572).
- Update
  patches.suse/scsi-hisi_sas-Set-debugfs_dir-pointer-to-NULL-after-removing-debugfs.patch
  (git-fixes CVE-2023-52808 bsc#1225555).
- Update
  patches.suse/scsi-ibmvfc-Remove-BUG_ON-in-the-case-of-an-empty-ev.patch
  (bsc#1209834 ltc#202097 CVE-2023-52811 bsc#1225559).
- Update
  patches.suse/scsi-libfc-Fix-potential-NULL-pointer-dereference-in-fc_lport_ptp_setup.patch
  (git-fixes CVE-2023-52809 bsc#1225556).
- Update
  patches.suse/scsi-lpfc-Move-NPIV-s-transport-unregistration-to-af.patch
  (bsc#1221777 CVE-2024-36952 bsc#1225898).
- Update
  patches.suse/scsi-lpfc-Release-hbalock-before-calling-lpfc_worker.patch
  (bsc#1221777 CVE-2024-36924 bsc#1225820).
- Update
  patches.suse/serial-max3100-Lock-port-lock-when-calling-uart_hand.patch
  (git-fixes CVE-2024-38634 bsc#1226868).
- Update
  patches.suse/serial-max3100-Update-uart_driver_registered-on-driv.patch
  (git-fixes CVE-2024-38633 bsc#1226867).
- Update
  patches.suse/soc-qcom-llcc-Handle-a-second-device-without-data-co.patch
  (git-fixes CVE-2023-52871 bsc#1225534).
- Update
  patches.suse/soundwire-cadence-fix-invalid-PDI-offset.patch
  (stable-fixes CVE-2024-38635 bsc#1226863).
- Update patches.suse/speakup-Fix-sizeof-vs-ARRAY_SIZE-bug.patch
  (git-fixes CVE-2024-38587 bsc#1226780).
- Update patches.suse/spi-Fix-null-dereference-on-suspend.patch
  (git-fixes CVE-2023-52749 bsc#1225476).
- Update
  patches.suse/thermal-core-prevent-potential-string-overflow.patch
  (git-fixes CVE-2023-52868 bsc#1225044).
- Update
  patches.suse/thermal-drivers-qcom-lmh-Check-for-SCM-availability-.patch
  (git-fixes CVE-2024-39466 bsc#1227089).
- Update
  patches.suse/thermal-drivers-tsens-Fix-null-pointer-dereference.patch
  (git-fixes CVE-2024-38571 bsc#1226737).
- Update
  patches.suse/thermal-intel-powerclamp-fix-mismatch-in-get-functio.patch
  (git-fixes CVE-2023-52794 bsc#1225028).
- Update
  patches.suse/tls-fix-NULL-deref-on-tls_sw_splice_eof-with-empty-r.patch
  (jsc#PED-6831 CVE-2023-52767 bsc#1224998).
- Update
  patches.suse/tpm_tis_spi-Account-for-SPI-header-when-allocating-T.patch
  (git-fixes CVE-2024-36477 bsc#1226840).
- Update
  patches.suse/tracing-Have-trace_event_file-have-ref-counters.patch
  (git-fixes CVE-2023-52879 bsc#1225101).
- Update
  patches.suse/tracing-trigger-Fix-to-return-error-if-failed-to-alloc-snapshot.patch
  (git-fixes CVE-2024-26920).
- Update
  patches.suse/tty-n_gsm-fix-race-condition-in-status-line-change-o.patch
  (git-fixes CVE-2023-52872 bsc#1225591).
- Update
  patches.suse/tty-n_gsm-require-CAP_NET_ADMIN-to-attach-N_GSM0710-.patch
  (bsc#1222619 CVE-2023-52880).
- Update
  patches.suse/tty-vcc-Add-check-for-kstrdup-in-vcc_probe.patch
  (git-fixes CVE-2023-52789 bsc#1225180).
- Update
  patches.suse/usb-config-fix-iteration-issue-in-usb_get_bos_descri.patch
  (git-fixes CVE-2023-52781 bsc#1225092).
- Update
  patches.suse/usb-dwc3-Wait-unconditionally-after-issuing-EndXfer-.patch
  (git-fixes CVE-2024-36977 bsc#1226513).
- Update
  patches.suse/usb-gadget-u_audio-Fix-race-condition-use-of-control.patch
  (git-fixes CVE-2024-38628 bsc#1226911).
- Update
  patches.suse/usb-storage-alauda-Check-whether-the-media-is-initia.patch
  (git-fixes CVE-2024-38619 bsc#1226861).
- Update
  patches.suse/usb-typec-tcpm-Fix-NULL-pointer-dereference-in-tcpm_.patch
  (git-fixes CVE-2023-52877 bsc#1224944).
- Update
  patches.suse/vhost-vdpa-fix-use-after-free-in-vhost_vdpa_probe.patch
  (jsc#PED-3311 CVE-2023-52795 bsc#1225085).
- Update
  patches.suse/virtio-blk-fix-implicit-overflow-on-virtio_max_dma_s.patch
  (git-fixes CVE-2023-52762 bsc#1225573).
- Update
  patches.suse/virtio-vsock-Fix-uninit-value-in-virtio_transport_re.patch
  (jsc#PED-5505 CVE-2023-52842 bsc#1225025).
- Update
  patches.suse/watchdog-cpu5wdt.c-Fix-use-after-free-bug-caused-by-.patch
  (git-fixes CVE-2024-38630 bsc#1226908).
- Update
  patches.suse/wifi-ar5523-enable-proper-endpoint-verification.patch
  (git-fixes CVE-2024-38565 bsc#1226747).
- Update
  patches.suse/wifi-ath11k-fix-dfs-radar-event-locking.patch
  (git-fixes CVE-2023-52798 bsc#1224947).
- Update
  patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch
  (git-fixes CVE-2023-52777 bsc#1224992).
- Update patches.suse/wifi-ath11k-fix-htt-pktlog-locking.patch
  (git-fixes CVE-2023-52800).
- Update
  patches.suse/wifi-ath12k-fix-dfs-radar-and-temperature-event-lock.patch
  (git-fixes CVE-2023-52776 bsc#1225090).
- Update
  patches.suse/wifi-ath12k-fix-htt-mlo-offset-event-locking.patch
  (git-fixes CVE-2023-52769 bsc#1225001).
- Update
  patches.suse/wifi-ath12k-fix-out-of-bound-access-of-qmi_invoke_ha.patch
  (git-fixes CVE-2024-38572 bsc#1226776).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-read-in-ath12k.patch
  (git-fixes CVE-2023-52827 bsc#1225078).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-write-in-ath12.patch
  (git-fixes CVE-2023-52829 bsc#1225081).
- Update
  patches.suse/wifi-brcmfmac-pcie-handle-randbuf-allocation-failure.patch
  (git-fixes CVE-2024-38575 bsc#1226612).
- Update
  patches.suse/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch
  (git-fixes CVE-2024-38567 bsc#1226769).
- Update
  patches.suse/wifi-carl9170-re-fix-fortified-memset-warning.patch
  (git-fixes CVE-2024-38616 bsc#1226852).
- Update
  patches.suse/wifi-mac80211-don-t-return-unset-power-in-ieee80211_.patch
  (git-fixes CVE-2023-52832 bsc#1225577).
- Update
  patches.suse/wifi-nl80211-Avoid-address-calculations-via-out-of-b.patch
  (git-fixes CVE-2024-38562 bsc#1226788).
- Update
  patches.suse/wifi-wilc1000-use-vmm_table-as-array-in-wilc-struct.patch
  (git-fixes CVE-2023-52768 bsc#1225004).
- Update
  patches.suse/x86-tdx-Zero-out-the-missing-RSI-in-TDX_HYPERCALL-macro.patch
  (jsc#PED-5824 CVE-2023-52874 bsc#1225049).
- commit 33efdc4</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835204">- tcp: Use refcount_inc_not_zero() in tcp_twsk_unique()
  (CVE-2024-36904 bsc#1225732).
- commit d578dcc</changelog>
  <changelog author="heming.zhao@suse.com" date="1719921600">- gfs2: Fix potential glock use-after-free on unmount (bsc#1226775
  CVE-2024-38570).
- gfs2: Rename sd_{ glock =&gt; kill }_wait (bsc#1226775
  CVE-2024-38570).
- commit f3adbca</changelog>
  <changelog author="tiwai@suse.de" date="1719921601">- Correct SCSI patch references (bsc#1225767 CVE-2024-36919 bsc#1226785 CVE-2024-38559)
- commit e8ea587</changelog>
  <changelog author="tiwai@suse.de" date="1719921602">- mtd: rawnand: rockchip: ensure NVDDR timings are rejected
  (git-fixes).
- mtd: rawnand: Bypass a couple of sanity checks during NAND
  identification (git-fixes).
- mtd: rawnand: Fix the nand_read_data_op() early check
  (git-fixes).
- mtd: rawnand: Ensure ECC configuration is propagated to upper
  layers (git-fixes).
- commit e545951</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1719921603">- kernel-doc: fix struct_group_tagged() parsing (git-fixes).
- commit e3a2a2e</changelog>
  <changelog author="fdmanana@suse.com" date="1719921604">- btrfs: fix crash on racing fsync and size-extending write into
  prealloc (bsc#1227101 CVE-2024-37354).
- commit 1d355af</changelog>
  <changelog author="vbabka@suse.cz" date="1719921605">- virt: acrn: stop using follow_pfn (CVE-2024-38610 bsc#1226758).
- commit c2ea51b</changelog>
  <changelog author="vbabka@suse.cz" date="1719921606">- drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
  (CVE-2024-38610 bsc#1226758).
- commit 7069ac2</changelog>
  <changelog author="rhopkins@suse.de" date="1719921607">- hsr: Prevent use after free in prp_create_tagged_frame()
  (CVE-2023-52846 bsc#1225098).
- commit cf63988</changelog>
  <changelog author="krisman@suse.de" date="1719921608">- io_uring: Fix io_cqring_wait() not restoring sigmask on
  get_timespec64() failure (git-fixes).
- commit e640a65</changelog>
  <changelog author="krisman@suse.de" date="1719921609">- io_uring: check for non-NULL file pointer in io_file_can_poll()
  (bsc#1226990 CVE-2024-39371).
- io_uring/io-wq: Use set_bit() and test_bit() at worker-&gt;flags
  (git-fixes).
- io_uring/sqpoll: work around a potential audit memory leak
  (git-fixes).
- commit 24603fc</changelog>
  <changelog author="krisman@suse.de" date="1719921610">- io_uring/rsrc: fix incorrect assignment of iter-&gt;nr_segs in
  io_import_fixed (git-fixes).
- io_uring/rsrc: don't lock while !TASK_RUNNING (git-fixes).
- io_uring/io-wq: avoid garbage value of 'match' in
  io_wq_enqueue() (git-fixes).
- commit 7d3e252</changelog>
</package>
<package pkgid="2eeea1322976b5acdc37641c3269b2e43bb8b5c60eca65f7e0d80a930bdc9705" name="dtb-amlogic" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.17.1"/>
  <changelog author="tiwai@suse.de" date="1722081600">- auxdisplay: ht16k33: Drop reference after LED registration
  (git-fixes).
- ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
  on unprepare (git-fixes).
- ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
- ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
  reachable (git-fixes).
- ASoC: sof: amd: fix for firmware reload failure in Vangogh
  platform (git-fixes).
- ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
- ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
  (git-fixes).
- ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
- ALSA: ump: Don't update FB name for static blocks (git-fixes).
- drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
- drm/i915/gt: Do not consider preemption during execlists_dequeue
  for gen8 (git-fixes).
- drm/i915/dp: Don't switch the LTTPR mode on an active link
  (git-fixes).
- commit d7e2deb</changelog>
  <changelog author="tiwai@suse.de" date="1722081601">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
</package>
<package pkgid="eb94aea4597766ef932552fe65cbd2d3c508f3dd37ba5c9a2fb62be99f73b8a8" name="dtb-amlogic" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.7.1"/>
  <changelog author="mkubecek@suse.cz" date="1717416000">- netfilter: nf_tables: release mutex after nft_gc_seq_end from
  abort path (CVE-2024-26925 bsc#1223390).
- commit 578a709</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717416001">- Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
  The L3 bsc#1225765 was created seperately since our customer requires
  PTF.
- Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
- Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
- Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
- Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
- commit 054635e</changelog>
  <changelog author="msuchanek@suse.de" date="1717416002">- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
- powerpc/uaccess: Fix build errors seen with GCC 13/14
  (bsc#1194869).
- commit 46b5d84</changelog>
  <changelog author="msuchanek@suse.de" date="1717416003">- blacklist.conf: PPC fsl_msi is not used
- commit ae6590d</changelog>
  <changelog author="msuchanek@suse.de" date="1717416004">- powerpc/pseries/lparcfg: drop error message from guest name
  lookup (bsc#1187716 ltc#193451 git-fixes).
- commit ceab637</changelog>
  <changelog author="mfranc@suse.cz" date="1717416005">- Update
  patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
  (git-fixes CVE-2024-36955).
- Update
  patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
  (git-fixes bsc#1225715 CVE-2024-36906).
- Update
  patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
  (git-fixes bsc#1225579 CVE-2024-36011).
- Update
  patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
  (git-fixes bsc#1225578 CVE-2024-36013).
- Update
  patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
  (git-fixes bsc#1225502 CVE-2024-36012).
- Update
  patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
  (git-fixes bsc#1225722 CVE-2024-36880).
- Update
  patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
  (git-fixes CVE-2024-36942).
- Update
  patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
  (git-fixes bsc#1225720 CVE-2024-36032).
- Update
  patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
  (git-fixes bsc#1223749 CVE-2024-26990).
- Update
  patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
  (git-fixes bsc#1223692 CVE-2024-26992).
- Update
  patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
  (stable-fixes CVE-2024-36944).
- Update
  patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
  (git-fixes bsc#1225734 CVE-2024-36896).
- Update
  patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
  (stable-fixes CVE-2024-36949).
- Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
  (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
- Update
  patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
  (git-fixes bsc#1225692 CVE-2023-52882).
- Update
  patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
  (git-fixes CVE-2024-26761).
- Update
  patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
  (stable-fixes bsc#1225735 CVE-2024-36897).
- Update
  patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
  (stable-fixes bsc#1225705 CVE-2024-36026).
- Update
  patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
  (stable-fixes CVE-2024-36951).
- Update
  patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
  (git-fixes bsc#1225593 CVE-2024-36014).
- Update
  patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
  (stable-fixes bsc#1225728 CVE-2024-36885).
- Update
  patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
  (git-fixes bsc#1225773 CVE-2024-36936).
- Update
  patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
  (stable-fixes CVE-2024-36950).
- Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
  (git-fixes bsc#1225736 CVE-2024-36898).
- Update
  patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
  (git-fixes bsc#1225698 CVE-2024-36020).
- Update
  patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
  (git-fixes bsc#1225710 CVE-2024-36891).
- Update
  patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
  (git-fixes bsc#1225714 CVE-2024-36890).
- Update
  patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
  (git-fixes bsc#1225708 CVE-2024-36029).
- Update
  patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
  (git-fixes bsc#1225699 CVE-2024-36021).
- Update
  patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
  (git-fixes CVE-2024-26943).
- Update
  patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
  (git-fixes bsc#1225694 CVE-2024-36018).
- Update
  patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
  (git-fixes CVE-2024-36940).
- Update
  patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
  (git-fixes CVE-2024-36959).
- Update
  patches.suse/ppdev-Add-an-error-check-in-register_device.patch
  (git-fixes bsc#1225640 CVE-2024-36015).
- Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
  CVE-2024-36947).
- Update
  patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
  (git-fixes bsc#1225695 CVE-2024-36019).
- Update
  patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
  (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
- Update
  patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
  (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
- Update
  patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
  (git-fixes bsc#1225704 CVE-2024-36025).
- Update
  patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
  (git-fixes CVE-2024-36930).
- Update
  patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
  (bsc#1224331 bsc#1224602 CVE-2024-35814).
- Update
  patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
  (git-fixes bsc#1225642 CVE-2024-36016).
- Update
  patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
  (git-fixes bsc#1225749 CVE-2024-36894).
- Update
  patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
  (git-fixes bsc#1225750 CVE-2024-36895).
- Update
  patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
  (git-fixes bsc#1225748 CVE-2024-36893).
- Update
  patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
  (stable-fixes bsc#1225769 CVE-2024-36921).
- Update
  patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
  (stable-fixes CVE-2024-36922).
- Update
  patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
  (git-fixes CVE-2024-36941).
- Update
  patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
  (git-fixes bsc#1224742 CVE-2024-35803).
- commit 539780f</changelog>
  <changelog author="dwagner@suse.de" date="1717416006">- nvmet: fix ns enable/disable possible hang (git-fixes).
- nvme-multipath: fix io accounting on failover (git-fixes).
- nvme: fix multipath batched completion accounting (git-fixes).
- commit ed3b392</changelog>
  <changelog author="dwagner@suse.de" date="1717416007">- scsi: lpfc: Copyright updates for 14.4.0.2 patches
  (bsc#1225842).
- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
  (bsc#1225842).
  Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
  (bsc#1225842).
- scsi: lpfc: Clear deferred RSCN processing flag when driver
  is unloading (bsc#1225842).
- scsi: lpfc: Update logging of protection type for T10 DIF I/O
  (bsc#1225842).
- scsi: lpfc: Change default logging level for unsolicited CT
  MIB commands (bsc#1225842).
- commit 5a56384</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416008">- smb: client: fix mount when dns_resolver key is not available
  (git-fixes, bsc#1225172).
- commit 28edb5c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416009">- cifs: fix leak of iface for primary channel (git-fixes,
  bsc#1225172).
- commit b7eb8e8</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416010">- Revert "cifs: reconnect work should have reference on server
  struct" (git-fixes, bsc#1225172).
- commit 3ca4c0c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416011">- smb: client: fix parsing of SMB3.1.1 POSIX create context
  (git-fixes, bsc#1225172).
- commit 5f27f69</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416012">- cifs: failure to add channel on iface should bump up weight
  (git-fixes, bsc#1225172).
- commit 007b237</changelog>
  <changelog author="tonyj@suse.de" date="1717416013">- perf/x86: Fix out of range data (git-fixes).
- perf/x86/intel/ds: Don't clear -&gt;pebs_data_cfg for the last
  PEBS event (git-fixes).
- perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
- commit 664d77f</changelog>
  <changelog author="dsterba@suse.com" date="1717588800">- blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
- Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
  Quoting bsc#1225945#c11:
  "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
  transaction for every subvol create")
  ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
  unwritten extent buffer after snapshotting a new subvolume") was never
  backported."
- commit d947258</changelog>
  <changelog author="tonyj@suse.de" date="1717588801">- perf pmu: Count sys and cpuid JSON events separately (git
  fixes).
- perf stat: Don't display metric header for non-leader uncore
  events (git-fixes).
- perf daemon: Fix file leak in daemon_session__control
  (git-fixes).
- perf symbols: Fix ownership of string in dso__load_vmlinux()
  (git-fixes).
- perf thread: Fixes to thread__new() related to initializing comm
  (git-fixes).
- perf report: Avoid SEGV in report__setup_sample_type()
  (git-fixes).
- perf ui browser: Don't save pointer to stack memory (git-fixes).
- perf bench internals inject-build-id: Fix trap divide when
  collecting just one DSO (git-fixes).
- perf intel-pt: Fix unassigned instruction op (discovered by
  MemorySanitizer) (git-fixes).
- perf test shell arm_coresight: Increase buffer size for
  Coresight basic tests (git-fixes).
- perf docs: Document bpf event modifier (git-fixes).
- perf bench uprobe: Remove lib64 from libc.so.6 binary path
  (git-fixes).
- perf record: Fix debug message placement for test consumption
  (git-fixes).
- perf tests: Apply attributes to all events in object code
  reading test (git-fixes).
- perf tests: Make "test data symbol" more robust on Neoverse N1
  (git-fixes).
- perf annotate: Fix annotation_calc_lines() to pass correct
  address to get_srcline() (git-fixes).
- perf stat: Do not fail on metrics on s390 z/VM systems
  (git-fixes).
- perf sched timehist: Fix -g/--call-graph option failure
  (git-fixes).
- perf annotate: Get rid of duplicate --group option item
  (git-fixes).
- perf probe: Add missing libgen.h header needed for using
  basename() (git-fixes).
- perf record: Delete session after stopping sideband thread
  (git-fixes).
- perf auxtrace: Fix multiple use of --itrace option (git-fixes).
- perf script: Show also errors for --insn-trace option
  (git-fixes).
- perf lock contention: Add a missing NULL check (git-fixes).
- perf vendor events amd: Fix Zen 4 cache latency events
  (git-fixes).
- libperf evlist: Avoid out-of-bounds access (git-fixes).
- perf pmu: Fix a potential memory leak in perf_pmu__lookup()
  (git-fixes).
- perf print-events: make is_event_supported() more robust
  (git-fixes).
- perf list: fix short description for some cache events
  (git-fixes).
- perf metric: Don't remove scale from counts (git-fixes).
- perf stat: Avoid metric-only segv (git-fixes).
- perf expr: Fix "has_event" function for metric style events
  (git-fixes).
- perf srcline: Add missed addr2line closes (git-fixes).
- perf thread_map: Free strlist on normal path in
  thread_map__new_by_tid_str() (git-fixes).
- perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
- perf jevents: Drop or simplify small integer values (git-fixes).
- perf evsel: Fix duplicate initialization of data-&gt;id in
  evsel__parse_sample() (git-fixes).
- perf pmu: Treat the msr pmu as software (git-fixes).
- perf record: Check conflict between '--timestamp-filename'
  option and pipe mode before recording (git-fixes).
- perf record: Fix possible incorrect free in
  record__switch_output() (git-fixes).
- perf vendor events amd: Add Zen 4 memory controller events
  (git-fixes).
- perf top: Uniform the event name for the hybrid machine
  (git-fixes).
- perf top: Use evsel's cpus to replace user_requested_cpus
  (git-fixes).
- commit a1f9340</changelog>
  <changelog author="tonyj@suse.de" date="1717675200">- perf ui browser: Avoid SEGV on title (git fixes).
- commit 1578c22</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675201">- inet: inet_defrag: prevent sk release while still in use
  (CVE-2024-26921 bsc#1223138).
- commit 2016faf</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675202">- net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
- commit 7bf5961</changelog>
  <changelog author="tiwai@suse.de" date="1718366400">- Temporarily drop KVM patch that caused a regression (bsc#1226158)
  Delete patches.suse/KVM-x86-pmu-Prioritize-VMX-interception-over-GP-on-R.patch
- commit 33f31da</changelog>
</package>
<package pkgid="bcda51a4a322f1e61f5772f4140fc90f8128b0f09b64f1f2ba0098360c7f12d0" name="dtb-apm" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.14.1"/>
  <changelog author="tiwai@suse.de" date="1719662400">- gpiolib: cdev: Disallow reconfiguration without direction
  (uAPI v1) (git-fixes).
- gpio: davinci: Validate the obtained number of IRQs (git-fixes).
- commit 919ebd1</changelog>
  <changelog author="tiwai@suse.de" date="1719748800">- i2c: testunit: discard write requests while old command is
  running (git-fixes).
- i2c: testunit: don't erase registers after STOP (git-fixes).
- mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
  (git-fixes).
- mmc: sdhci: Do not invert write-protect twice (git-fixes).
- mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
  (git-fixes).
- mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
  (git-fixes).
- commit 448487d</changelog>
  <changelog author="tiwai@suse.de" date="1719748801">- crypto: iaa - Account for cpu-less numa nodes (bsc#1227190).
- commit cd600aa</changelog>
  <changelog author="tiwai@suse.de" date="1719748802">- crypto: deflate - Add aliases to deflate (bsc#1227190).
- commit 27ffd92</changelog>
  <changelog author="tiwai@suse.de" date="1719835200">- ata: ahci: Clean up sysfs file on error (git-fixes).
- ata: libata-core: Fix double free on error (git-fixes).
- ata,scsi: libata-core: Do not leak memory for ata_port struct
  members (git-fixes).
- ata: libata-core: Fix null pointer dereference on error
  (git-fixes).
- kbuild: Fix build target deb-pkg: ln: failed to create hard link
  (git-fixes).
- kbuild: doc: Update default INSTALL_MOD_DIR from extra to
  updates (git-fixes).
- kbuild: Install dtb files as 0644 in Makefile.dtbinst
  (git-fixes).
- counter: ti-eqep: enable clock at probe (git-fixes).
- iio: chemical: bme680: Fix sensor data read operation
  (git-fixes).
- iio: chemical: bme680: Fix overflows in compensate() functions
  (git-fixes).
- iio: chemical: bme680: Fix calibration data variable
  (git-fixes).
- iio: chemical: bme680: Fix pressure value output (git-fixes).
- iio: accel: fxls8962af: select IIO_BUFFER &amp; IIO_KFIFO_BUF
  (git-fixes).
- iio: adc: ad7266: Fix variable checking bug (git-fixes).
- iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
  (git-fixes).
- serial: bcm63xx-uart: fix tx after conversion to
  uart_port_tx_limited() (git-fixes).
- serial: core: introduce uart_port_tx_limited_flags()
  (git-fixes).
- Revert "serial: core: only stop transmit when HW fifo is empty"
  (git-fixes).
- tty: mcf: MCF54418 has 10 UARTS (git-fixes).
- usb: gadget: aspeed_udc: fix device address configuration
  (git-fixes).
- usb: dwc3: core: remove lock of otg mode during gadget
  suspend/resume to avoid deadlock (git-fixes).
- usb: typec: ucsi: glink: fix child node release in probe
  function (git-fixes).
- usb: musb: da8xx: fix a resource leak in probe() (git-fixes).
- usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  (git-fixes).
- usb: gadget: printer: fix races against disable (git-fixes).
- PCI/MSI: Fix UAF in msi_capability_init (git-fixes).
- commit a2ea5a9</changelog>
  <changelog author="ptesarik@suse.com" date="1719835201">- net: ena: Fix redundant device NUMA node override
  (jsc#PED-8688).
- commit 6ad6684</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835202">- tcp: do not accept ACK of bytes we never sent (CVE-2023-52881
  bsc#1225611).
- commit 16404a6</changelog>
  <changelog author="mhocko@suse.com" date="1719835203">- Update
  patches.suse/1352-drm-amdgpu-Fix-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52883
  bsc#1226630).
- Update
  patches.suse/9p-add-missing-locking-around-taking-dentry-fid-list.patch
  (git-fixes CVE-2024-39463 bsc#1227090).
- Update
  patches.suse/ALSA-Fix-deadlocks-with-kctl-removals-at-disconnecti.patch
  (stable-fixes CVE-2024-38600 bsc#1226864).
- Update
  patches.suse/ALSA-core-Fix-NULL-module-pointer-assignment-at-card.patch
  (git-fixes CVE-2024-38605 bsc#1226740).
- Update
  patches.suse/ALSA-hda-Fix-possible-null-ptr-deref-when-assigning-.patch
  (git-fixes CVE-2023-52806 bsc#1225554).
- Update
  patches.suse/ALSA-hda-cs_dsp_ctl-Use-private_free-for-control-cle.patch
  (git-fixes CVE-2024-38388 bsc#1226890).
- Update
  patches.suse/ALSA-timer-Set-lower-bound-of-start-tick-time.patch
  (stable-fixes git-fixes CVE-2024-38618 bsc#1226754).
- Update
  patches.suse/ASoC-kirkwood-Fix-potential-NULL-dereference.patch
  (git-fixes CVE-2024-38550 bsc#1226633).
- Update
  patches.suse/ASoC-mediatek-Assign-dummy-when-codec-not-specified-.patch
  (git-fixes CVE-2024-38551 bsc#1226761).
- Update
  patches.suse/Bluetooth-btusb-Add-date-evt_skb-is-NULL-check.patch
  (git-fixes CVE-2023-52833 bsc#1225595).
- Update
  patches.suse/Bluetooth-hci_core-Fix-possible-buffer-overflow.patch
  (git-fixes CVE-2024-26889).
- Update
  patches.suse/HID-uclogic-Fix-user-memory-access-bug-in-uclogic_pa.patch
  (git-fixes CVE-2023-52866 bsc#1225120).
- Update
  patches.suse/IB-mlx5-Fix-init-stage-error-handling-to-avoid-doubl.patch
  (jsc#PED-6864 CVE-2023-52851 bsc#1225587).
- Update
  patches.suse/Input-cyapa-add-missing-input-core-locking-to-suspen.patch
  (git-fixes CVE-2023-52884 bsc#1226764).
- Update
  patches.suse/Input-synaptics-rmi4-fix-use-after-free-in-rmi_unreg.patch
  (git-fixes CVE-2023-52840 bsc#1224928).
- Update
  patches.suse/KEYS-trusted-Do-not-use-WARN-when-encode-fails.patch
  (git-fixes CVE-2024-36975 bsc#1226520).
- Update
  patches.suse/KEYS-trusted-Fix-memory-leak-in-tpm2_key_encode.patch
  (git-fixes CVE-2024-36967 bsc#1226131).
- Update
  patches.suse/RDMA-cma-Fix-kmemleak-in-rdma_core-observed-during-b.patch
  (git-fixes CVE-2024-38539 bsc#1226608).
- Update patches.suse/RDMA-hns-Fix-UAF-for-cq-async-event.patch
  (git-fixes CVE-2024-38545 bsc#1226595).
- Update
  patches.suse/RDMA-hns-Fix-deadlock-on-SRQ-async-events.patch
  (git-fixes CVE-2024-38591 bsc#1226738).
- Update
  patches.suse/RDMA-hns-Modify-the-print-level-of-CQE-error.patch
  (git-fixes CVE-2024-38590 bsc#1226839).
- Update
  patches.suse/RDMA-rxe-Fix-seg-fault-in-rxe_comp_queue_pkt.patch
  (git-fixes CVE-2024-38544 bsc#1226597).
- Update
  patches.suse/SUNRPC-Fix-RPC-client-cleaned-up-the-freed-pipefs-de.patch
  (git-fixes CVE-2023-52803 bsc#1225008).
- Update patches.suse/af_unix-Clear-stale-u-oob_skb.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-35970 bsc#1224584).
- Update
  patches.suse/af_unix-Drop-oob_skb-ref-before-purging-queue-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26750 bsc#1222617).
- Update
  patches.suse/af_unix-Fix-task-hung-while-purging-oob_skb-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26780 bsc#1222588).
- Update
  patches.suse/af_unix-Update-unix_sk-sk-oob_skb-under-sk_receive_queue-lock.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-36972 bsc#1226163).
- Update
  patches.suse/arm64-Restrict-CPU_BIG_ENDIAN-to-GNU-as-or-LLVM-IAS-.patch
  (git-fixes CVE-2023-52750 bsc#1225485).
- Update
  patches.suse/atl1c-Work-around-the-DMA-RX-overflow-issue.patch
  (git-fixes CVE-2023-52834 bsc#1225599).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issue-of-net_device.patch
  (git-fixes CVE-2024-38554 bsc#1226742).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issues-of-ax25_dev.patch
  (git-fixes CVE-2024-38602 bsc#1226613).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-reorder-of-WRITE-lqueued.patch
  (bsc#1225605 CVE-2024-38384 bsc#1226938).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-resetting-io-stat.patch
  (bsc#1225605 CVE-2024-38663 bsc#1226939).
- Update
  patches.suse/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch
  (git-fixes CVE-2024-38540 bsc#1226582).
- Update
  patches.suse/bonding-stop-the-device-in-bond_setup_by_slave.patch
  (git-fixes CVE-2023-52784 bsc#1224946).
- Update
  patches.suse/can-dev-can_put_echo_skb-don-t-crash-kernel-if-can_p.patch
  (git-fixes CVE-2023-52878 bsc#1225000).
- Update
  patches.suse/clk-mediatek-clk-mt2701-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52875 bsc#1225096).
- Update
  patches.suse/clk-mediatek-clk-mt6765-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52870 bsc#1224937).
- Update
  patches.suse/clk-mediatek-clk-mt6779-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52873 bsc#1225589).
- Update
  patches.suse/clk-mediatek-clk-mt6797-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52865 bsc#1225086).
- Update
  patches.suse/clk-mediatek-clk-mt7629-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52858 bsc#1225566).
- Update
  patches.suse/clk-mediatek-clk-mt7629-eth-Add-check-for-mtk_alloc_.patch
  (git-fixes CVE-2023-52876 bsc#1225036).
- Update
  patches.suse/cppc_cpufreq-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38573 bsc#1226739).
- Update patches.suse/cpufreq-exit-callback-is-optional.patch
  (git-fixes CVE-2024-38615 bsc#1226592).
- Update patches.suse/crypto-bcm-Fix-pointer-arithmetic.patch
  (git-fixes CVE-2024-38579 bsc#1226637).
- Update
  patches.suse/crypto-pcrypt-Fix-hungtask-for-PADATA_RESET.patch
  (git-fixes CVE-2023-52813 bsc#1225527).
- Update patches.suse/cxl-mem-Fix-shutdown-order.patch (git-fixes
  CVE-2023-52849 bsc#1224949).
- Update
  patches.suse/cxl-region-Do-not-try-to-cleanup-after-cxl_region_se.patch
  (git-fixes CVE-2023-52792 bsc#1225477).
- Update patches.suse/cxl-region-Fix-cxlr_pmem-leaks.patch
  (git-fixes CVE-2024-38391 bsc#1226894).
- Update
  patches.suse/dma-buf-sw-sync-don-t-enable-IRQ-from-sync_print_obj.patch
  (git-fixes CVE-2024-38780 bsc#1226886).
- Update
  patches.suse/dma-mapping-benchmark-fix-node-id-validation.patch
  (git-fixes CVE-2024-34777 bsc#1226796).
- Update
  patches.suse/dma-mapping-benchmark-handle-NUMA_NO_NODE-correctly.patch
  (git-fixes CVE-2024-39277 bsc#1226909).
- Update
  patches.suse/dmaengine-idxd-Avoid-unnecessary-destruction-of-file.patch
  (git-fixes CVE-2024-38629 bsc#1226905).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Pola.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52819
  bsc#1225532).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-SMU7.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52818
  bsc#1225530).
- Update
  patches.suse/drm-amd-check-num-of-link-levels-when-update-pcie-pa.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52812
  bsc#1225564).
- Update
  patches.suse/drm-amd-display-Avoid-NULL-dereference-of-timing-gen.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52753
  bsc#1225478).
- Update
  patches.suse/drm-amd-display-Fix-division-by-zero-in-setup_dsc_co.patch
  (stable-fixes CVE-2024-36969 bsc#1226155).
- Update
  patches.suse/drm-amd-display-Fix-null-pointer-dereference-in-erro.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52862
  bsc#1225015).
- Update
  patches.suse/drm-amd-display-Fix-potential-index-out-of-bounds-in.patch
  (git-fixes CVE-2024-38552 bsc#1226767).
- Update
  patches.suse/drm-amd-display-fix-a-NULL-pointer-dereference-in-am.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52773
  bsc#1225041).
- Update
  patches.suse/drm-amd-display-fixed-integer-types-and-null-check-l.patch
  (git-fixes CVE-2024-26767).
- Update
  patches.suse/drm-amdgpu-Fix-a-null-pointer-access-when-the-smc_rr.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52817
  bsc#1225569).
- Update
  patches.suse/drm-amdgpu-Fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch
  (git-fixes CVE-2024-39291 bsc#1226934).
- Update
  patches.suse/drm-amdgpu-Fix-potential-null-pointer-derefernce.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52814
  bsc#1225565).
- Update
  patches.suse/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch
  (stable-fixes CVE-2024-39471 bsc#1227096).
- Update
  patches.suse/drm-amdgpu-mes-fix-use-after-free-issue.patch
  (stable-fixes CVE-2024-38581 bsc#1226657).
- Update
  patches.suse/drm-amdgpu-vkms-fix-a-possible-null-pointer-derefere.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52815
  bsc#1225568).
- Update
  patches.suse/drm-amdkfd-Fix-a-race-condition-of-vram-buffer-unref.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52825
  bsc#1225076).
- Update
  patches.suse/drm-amdkfd-Fix-shift-out-of-bounds-issue.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52816
  bsc#1225529).
- Update
  patches.suse/drm-bridge-cdns-mhdp8546-Fix-possible-null-pointer-d.patch
  (git-fixes CVE-2024-38548).
- Update
  patches.suse/drm-bridge-it66121-Fix-invalid-connector-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52861
  bsc#1224941).
- Update
  patches.suse/drm-bridge-lt8912b-Fix-crash-on-bridge-detach.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52856
  bsc#1224932).
- Update
  patches.suse/drm-mediatek-Add-0-size-check-to-mtk_drm_gem_obj.patch
  (git-fixes CVE-2024-38549 bsc#1226735).
- Update
  patches.suse/drm-mediatek-Fix-coverity-issue-with-unintentional-i.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52857
  bsc#1225581).
- Update
  patches.suse/drm-mediatek-Init-ddp_comp-with-devm_kcalloc.patch
  (git-fixes CVE-2024-38592 bsc#1226844).
- Update
  patches.suse/drm-msm-a6xx-Avoid-a-nullptr-dereference-when-speedb.patch
  (git-fixes CVE-2024-38390 bsc#1226891).
- Update
  patches.suse/drm-msm-dpu-Add-callback-function-pointer-check-befo.patch
  (git-fixes CVE-2024-38622 bsc#1226856).
- Update
  patches.suse/drm-panel-fix-a-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52821
  bsc#1225022).
- Update
  patches.suse/drm-panel-panel-tpo-tpg110-fix-a-possible-null-point.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52826
  bsc#1225077).
- Update patches.suse/drm-radeon-possible-buffer-overflow.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52867
  bsc#1225009).
- Update
  patches.suse/drm-vc4-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38546 bsc#1226593).
- Update
  patches.suse/drm-vmwgfx-Fix-invalid-reads-in-fence-signaled-event.patch
  (git-fixes CVE-2024-36960 bsc#1225872).
- Update
  patches.suse/drm-zynqmp_dpsub-Always-register-bridge.patch
  (git-fixes CVE-2024-38664 bsc#1226941).
- Update
  patches.suse/e1000e-change-usleep_range-to-udelay-in-PHY-mdic-acc.patch
  (CVE-2024-39296 bsc#1226989 CVE-2024-36887 bsc#1225731).
- Update
  patches.suse/ecryptfs-Fix-buffer-size-for-tag-66-packet.patch
  (git-fixes CVE-2024-38578 bsc#1226634).
- Update
  patches.suse/efi-libstub-only-free-priv.runtime_map-when-allocate.patch
  (git-fixes CVE-2024-33619 bsc#1226768).
- Update
  patches.suse/fbdev-imsttfb-fix-a-resource-leak-in-probe.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52838
  bsc#1225031).
- Update
  patches.suse/fs-9p-only-translate-RWX-permissions-for-plain-9P200.patch
  (git-fixes CVE-2024-36964 bsc#1225866).
- Update
  patches.suse/fs-jfs-Add-check-for-negative-db_l2nbperpage.patch
  (git-fixes CVE-2023-52810 bsc#1225557).
- Update
  patches.suse/fs-jfs-Add-validity-check-for-db_maxag-and-db_agpref.patch
  (git-fixes CVE-2023-52804 bsc#1225550).
- Update
  patches.suse/ftrace-Fix-possible-use-after-free-issue-in-ftrace_location.patch
  (git-fixes CVE-2024-38588 bsc#1226837).
- Update
  patches.suse/genirq-irqdesc-Prevent-use-after-free-in-irq_find_at.patch
  (git-fixes CVE-2024-38385 bsc#1227085).
- Update patches.suse/gfs2-ignore-negated-quota-changes.patch
  (git-fixes CVE-2023-52759 bsc#1225560).
- Update
  patches.suse/hid-cp2112-Fix-duplicate-workqueue-initialization.patch
  (git-fixes CVE-2023-52853 bsc#1224988).
- Update
  patches.suse/hwmon-axi-fan-control-Fix-possible-NULL-pointer-dere.patch
  (git-fixes CVE-2023-52863 bsc#1225586).
- Update
  patches.suse/i2c-acpi-Unbind-mux-adapters-before-delete.patch
  (git-fixes CVE-2024-39362 bsc#1226995).
- Update
  patches.suse/i2c-core-Run-atomic-i2c-xfer-when-preemptible.patch
  (git-fixes CVE-2023-52791 bsc#1225108).
- Update
  patches.suse/i3c-master-mipi-i3c-hci-Fix-a-kernel-panic-for-acces.patch
  (git-fixes CVE-2023-52763 bsc#1225570).
- Update
  patches.suse/i3c-mipi-i3c-hci-Fix-out-of-bounds-access-in-hci_dma.patch
  (git-fixes CVE-2023-52766).
- Update
  patches.suse/i915-perf-Fix-NULL-deref-bugs-with-drm_dbg-calls.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52788
  bsc#1225106).
- Update
  patches.suse/igb-Fix-string-truncation-warnings-in-igb_set_fw_ver.patch
  (git-fixes CVE-2024-36010 bsc#1225594).
- Update
  patches.suse/iommu-vt-d-Fix-WARN_ON-in-iommu-probe-path.patch
  (git-fixes CVE-2024-35957 bsc#1224673).
- Update
  patches.suse/iommufd-Fix-missing-update-of-domains_itree-after-splitting-iopt
  (jsc#PED-7779 jsc#PED-7780 CVE-2023-52801 bsc#1225006).
- Update
  patches.suse/ipvlan-add-ipvlan_route_v6_outbound-helper.patch
  (git-fixes CVE-2023-52796 bsc#1224930).
- Update
  patches.suse/jffs2-prevent-xattr-node-from-overflowing-the-eraseblock.patch
  (git-fixes CVE-2024-38599 bsc#1226848).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-dbFindLeaf.patch
  (git-fixes CVE-2023-52799 bsc#1225472).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-diAlloc.patch
  (git-fixes CVE-2023-52805 bsc#1225553).
- Update
  patches.suse/kunit-fortify-Fix-mismatched-kvalloc-vfree-usage.patch
  (git-fixes CVE-2024-38617 bsc#1226859).
- Update
  patches.suse/lib-generic-radix-tree.c-Don-t-overflow-in-peek.patch
  (git-fixes CVE-2021-47432 bsc#1225391).
- Update
  patches.suse/lib-test_hmm.c-handle-src_pfns-and-dst_pfns-allocati.patch
  (git-fixes CVE-2024-38543 bsc#1226594).
- Update
  patches.suse/locking-ww_mutex-test-Fix-potential-workqueue-corrup.patch
  (bsc#1219953 CVE-2023-52836 bsc#1225609).
- Update
  patches.suse/md-Don-t-ignore-suspended-array-in-md_check_recovery-1baa.patch
  (bsc#1219596 CVE-2024-26758).
- Update
  patches.suse/media-atomisp-ssh_css-Fix-a-null-pointer-dereference.patch
  (git-fixes CVE-2024-38547 bsc#1226632).
- Update
  patches.suse/media-bttv-fix-use-after-free-error-due-to-btv-timeo.patch
  (git-fixes CVE-2023-52847 bsc#1225588).
- Update
  patches.suse/media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch
  (git-fixes CVE-2023-52764 bsc#1225571).
- Update
  patches.suse/media-hantro-Check-whether-reset-op-is-defined-befor.patch
  (git-fixes CVE-2023-52850 bsc#1225014).
- Update
  patches.suse/media-i2c-et8ek8-Don-t-strip-remove-function-when-dr.patch
  (git-fixes CVE-2024-38611 bsc#1226760).
- Update
  patches.suse/media-imon-fix-access-to-invalid-resource-for-the-se.patch
  (git-fixes CVE-2023-52754 bsc#1225490).
- Update
  patches.suse/media-lgdt3306a-Add-a-check-against-null-pointer-def.patch
  (stable-fixes CVE-2022-48772 bsc#1226976).
- Update
  patches.suse/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch
  (git-fixes CVE-2024-38621 bsc#1226895).
- Update
  patches.suse/media-vidtv-mux-Add-check-and-kfree-for-kstrdup.patch
  (git-fixes CVE-2023-52841 bsc#1225592).
- Update patches.suse/media-vidtv-psi-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52844 bsc#1225590).
- Update
  patches.suse/mfd-qcom-spmi-pmic-Fix-revid-implementation.patch
  (git-fixes CVE-2023-52765 bsc#1225029).
- Update
  patches.suse/misc-microchip-pci1xxxx-fix-double-free-in-the-error.patch
  (git-fixes CVE-2024-36973 bsc#1226457).
- Update
  patches.suse/net-hns3-fix-out-of-bounds-access-may-occur-when-coa.patch
  (git-fixes CVE-2023-52807 bsc#1225097).
- Update
  patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch
  (git-fixes CVE-2024-36962 bsc#1225827).
- Update
  patches.suse/net-mlx5-Fix-peer-devlink-set-for-SF-representor-dev.patch
  (git-fixes CVE-2024-38595 bsc#1226741).
- Update
  patches.suse/net-mlx5e-Track-xmit-submission-to-PTP-WQ-after-popu.patch
  (jsc#PED-3311 CVE-2023-52782 bsc#1225103).
- Update
  patches.suse/net-mvneta-fix-calls-to-page_pool_get_stats.patch
  (git-fixes CVE-2023-52780 bsc#1224933).
- Update
  patches.suse/net-wangxun-fix-kernel-panic-due-to-null-pointer.patch
  (git-fixes CVE-2023-52783 bsc#1225104).
- Update
  patches.suse/netfilter-complete-validation-of-user-input.patch
  (git-fixes CVE-2024-35896 bsc#1224662 CVE-2024-35962
  bsc#1224583).
- Update
  patches.suse/nfc-nci-Fix-uninit-value-in-nci_rx_work.patch
  (git-fixes CVE-2024-38381 bsc#1226878).
- Update
  patches.suse/nilfs2-fix-nilfs_empty_dir-misjudgment-and-long-loop.patch
  (git-fixes CVE-2024-39469 bsc#1226992).
- Update
  patches.suse/nilfs2-fix-potential-hang-in-nilfs_detach_log_writer.patch
  (git-fixes CVE-2024-38582 bsc#1226658).
- Update
  patches.suse/nilfs2-fix-use-after-free-of-timer-for-log-writer-th.patch
  (git-fixes CVE-2024-38583 bsc#1226777).
- Update
  patches.suse/of-module-add-buffer-overflow-check-in-of_modalias.patch
  (git-fixes CVE-2024-38541 bsc#1226587).
- Update
  patches.suse/padata-Fix-refcnt-handling-in-padata_free_shell.patch
  (git-fixes CVE-2023-52854 bsc#1225584).
- Update
  patches.suse/perf-core-Bail-out-early-if-the-request-AUX-area-is-out-of-bound.patch
  (git-fixes CVE-2023-52835 bsc#1225602).
- Update
  patches.suse/platform-x86-wmi-Fix-opening-of-char-device.patch
  (git-fixes CVE-2023-52864 bsc#1225132).
- Update
  patches.suse/powerpc-pseries-iommu-LPAR-panics-during-boot-up-wit.patch
  (bsc#1222011 ltc#205900 CVE-2024-36926 bsc#1225829).
- Update patches.suse/pstore-platform-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52869 bsc#1225050).
- Update
  patches.suse/remoteproc-mediatek-Make-sure-IPI-buffer-fits-in-L2T.patch
  (git-fixes CVE-2024-36965 bsc#1226149).
- Update
  patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch
  (git-fixes CVE-2024-38601 bsc#1226876).
- Update
  patches.suse/s390-dasd-protect-device-queue-against-concurrent-access.patch
  (git-fixes bsc#1217481 CVE-2023-52774 bsc#1225572).
- Update
  patches.suse/scsi-hisi_sas-Set-debugfs_dir-pointer-to-NULL-after-removing-debugfs.patch
  (git-fixes CVE-2023-52808 bsc#1225555).
- Update
  patches.suse/scsi-ibmvfc-Remove-BUG_ON-in-the-case-of-an-empty-ev.patch
  (bsc#1209834 ltc#202097 CVE-2023-52811 bsc#1225559).
- Update
  patches.suse/scsi-libfc-Fix-potential-NULL-pointer-dereference-in-fc_lport_ptp_setup.patch
  (git-fixes CVE-2023-52809 bsc#1225556).
- Update
  patches.suse/scsi-lpfc-Move-NPIV-s-transport-unregistration-to-af.patch
  (bsc#1221777 CVE-2024-36952 bsc#1225898).
- Update
  patches.suse/scsi-lpfc-Release-hbalock-before-calling-lpfc_worker.patch
  (bsc#1221777 CVE-2024-36924 bsc#1225820).
- Update
  patches.suse/serial-max3100-Lock-port-lock-when-calling-uart_hand.patch
  (git-fixes CVE-2024-38634 bsc#1226868).
- Update
  patches.suse/serial-max3100-Update-uart_driver_registered-on-driv.patch
  (git-fixes CVE-2024-38633 bsc#1226867).
- Update
  patches.suse/soc-qcom-llcc-Handle-a-second-device-without-data-co.patch
  (git-fixes CVE-2023-52871 bsc#1225534).
- Update
  patches.suse/soundwire-cadence-fix-invalid-PDI-offset.patch
  (stable-fixes CVE-2024-38635 bsc#1226863).
- Update patches.suse/speakup-Fix-sizeof-vs-ARRAY_SIZE-bug.patch
  (git-fixes CVE-2024-38587 bsc#1226780).
- Update patches.suse/spi-Fix-null-dereference-on-suspend.patch
  (git-fixes CVE-2023-52749 bsc#1225476).
- Update
  patches.suse/thermal-core-prevent-potential-string-overflow.patch
  (git-fixes CVE-2023-52868 bsc#1225044).
- Update
  patches.suse/thermal-drivers-qcom-lmh-Check-for-SCM-availability-.patch
  (git-fixes CVE-2024-39466 bsc#1227089).
- Update
  patches.suse/thermal-drivers-tsens-Fix-null-pointer-dereference.patch
  (git-fixes CVE-2024-38571 bsc#1226737).
- Update
  patches.suse/thermal-intel-powerclamp-fix-mismatch-in-get-functio.patch
  (git-fixes CVE-2023-52794 bsc#1225028).
- Update
  patches.suse/tls-fix-NULL-deref-on-tls_sw_splice_eof-with-empty-r.patch
  (jsc#PED-6831 CVE-2023-52767 bsc#1224998).
- Update
  patches.suse/tpm_tis_spi-Account-for-SPI-header-when-allocating-T.patch
  (git-fixes CVE-2024-36477 bsc#1226840).
- Update
  patches.suse/tracing-Have-trace_event_file-have-ref-counters.patch
  (git-fixes CVE-2023-52879 bsc#1225101).
- Update
  patches.suse/tracing-trigger-Fix-to-return-error-if-failed-to-alloc-snapshot.patch
  (git-fixes CVE-2024-26920).
- Update
  patches.suse/tty-n_gsm-fix-race-condition-in-status-line-change-o.patch
  (git-fixes CVE-2023-52872 bsc#1225591).
- Update
  patches.suse/tty-n_gsm-require-CAP_NET_ADMIN-to-attach-N_GSM0710-.patch
  (bsc#1222619 CVE-2023-52880).
- Update
  patches.suse/tty-vcc-Add-check-for-kstrdup-in-vcc_probe.patch
  (git-fixes CVE-2023-52789 bsc#1225180).
- Update
  patches.suse/usb-config-fix-iteration-issue-in-usb_get_bos_descri.patch
  (git-fixes CVE-2023-52781 bsc#1225092).
- Update
  patches.suse/usb-dwc3-Wait-unconditionally-after-issuing-EndXfer-.patch
  (git-fixes CVE-2024-36977 bsc#1226513).
- Update
  patches.suse/usb-gadget-u_audio-Fix-race-condition-use-of-control.patch
  (git-fixes CVE-2024-38628 bsc#1226911).
- Update
  patches.suse/usb-storage-alauda-Check-whether-the-media-is-initia.patch
  (git-fixes CVE-2024-38619 bsc#1226861).
- Update
  patches.suse/usb-typec-tcpm-Fix-NULL-pointer-dereference-in-tcpm_.patch
  (git-fixes CVE-2023-52877 bsc#1224944).
- Update
  patches.suse/vhost-vdpa-fix-use-after-free-in-vhost_vdpa_probe.patch
  (jsc#PED-3311 CVE-2023-52795 bsc#1225085).
- Update
  patches.suse/virtio-blk-fix-implicit-overflow-on-virtio_max_dma_s.patch
  (git-fixes CVE-2023-52762 bsc#1225573).
- Update
  patches.suse/virtio-vsock-Fix-uninit-value-in-virtio_transport_re.patch
  (jsc#PED-5505 CVE-2023-52842 bsc#1225025).
- Update
  patches.suse/watchdog-cpu5wdt.c-Fix-use-after-free-bug-caused-by-.patch
  (git-fixes CVE-2024-38630 bsc#1226908).
- Update
  patches.suse/wifi-ar5523-enable-proper-endpoint-verification.patch
  (git-fixes CVE-2024-38565 bsc#1226747).
- Update
  patches.suse/wifi-ath11k-fix-dfs-radar-event-locking.patch
  (git-fixes CVE-2023-52798 bsc#1224947).
- Update
  patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch
  (git-fixes CVE-2023-52777 bsc#1224992).
- Update patches.suse/wifi-ath11k-fix-htt-pktlog-locking.patch
  (git-fixes CVE-2023-52800).
- Update
  patches.suse/wifi-ath12k-fix-dfs-radar-and-temperature-event-lock.patch
  (git-fixes CVE-2023-52776 bsc#1225090).
- Update
  patches.suse/wifi-ath12k-fix-htt-mlo-offset-event-locking.patch
  (git-fixes CVE-2023-52769 bsc#1225001).
- Update
  patches.suse/wifi-ath12k-fix-out-of-bound-access-of-qmi_invoke_ha.patch
  (git-fixes CVE-2024-38572 bsc#1226776).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-read-in-ath12k.patch
  (git-fixes CVE-2023-52827 bsc#1225078).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-write-in-ath12.patch
  (git-fixes CVE-2023-52829 bsc#1225081).
- Update
  patches.suse/wifi-brcmfmac-pcie-handle-randbuf-allocation-failure.patch
  (git-fixes CVE-2024-38575 bsc#1226612).
- Update
  patches.suse/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch
  (git-fixes CVE-2024-38567 bsc#1226769).
- Update
  patches.suse/wifi-carl9170-re-fix-fortified-memset-warning.patch
  (git-fixes CVE-2024-38616 bsc#1226852).
- Update
  patches.suse/wifi-mac80211-don-t-return-unset-power-in-ieee80211_.patch
  (git-fixes CVE-2023-52832 bsc#1225577).
- Update
  patches.suse/wifi-nl80211-Avoid-address-calculations-via-out-of-b.patch
  (git-fixes CVE-2024-38562 bsc#1226788).
- Update
  patches.suse/wifi-wilc1000-use-vmm_table-as-array-in-wilc-struct.patch
  (git-fixes CVE-2023-52768 bsc#1225004).
- Update
  patches.suse/x86-tdx-Zero-out-the-missing-RSI-in-TDX_HYPERCALL-macro.patch
  (jsc#PED-5824 CVE-2023-52874 bsc#1225049).
- commit 33efdc4</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835204">- tcp: Use refcount_inc_not_zero() in tcp_twsk_unique()
  (CVE-2024-36904 bsc#1225732).
- commit d578dcc</changelog>
  <changelog author="heming.zhao@suse.com" date="1719921600">- gfs2: Fix potential glock use-after-free on unmount (bsc#1226775
  CVE-2024-38570).
- gfs2: Rename sd_{ glock =&gt; kill }_wait (bsc#1226775
  CVE-2024-38570).
- commit f3adbca</changelog>
  <changelog author="tiwai@suse.de" date="1719921601">- Correct SCSI patch references (bsc#1225767 CVE-2024-36919 bsc#1226785 CVE-2024-38559)
- commit e8ea587</changelog>
  <changelog author="tiwai@suse.de" date="1719921602">- mtd: rawnand: rockchip: ensure NVDDR timings are rejected
  (git-fixes).
- mtd: rawnand: Bypass a couple of sanity checks during NAND
  identification (git-fixes).
- mtd: rawnand: Fix the nand_read_data_op() early check
  (git-fixes).
- mtd: rawnand: Ensure ECC configuration is propagated to upper
  layers (git-fixes).
- commit e545951</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1719921603">- kernel-doc: fix struct_group_tagged() parsing (git-fixes).
- commit e3a2a2e</changelog>
  <changelog author="fdmanana@suse.com" date="1719921604">- btrfs: fix crash on racing fsync and size-extending write into
  prealloc (bsc#1227101 CVE-2024-37354).
- commit 1d355af</changelog>
  <changelog author="vbabka@suse.cz" date="1719921605">- virt: acrn: stop using follow_pfn (CVE-2024-38610 bsc#1226758).
- commit c2ea51b</changelog>
  <changelog author="vbabka@suse.cz" date="1719921606">- drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
  (CVE-2024-38610 bsc#1226758).
- commit 7069ac2</changelog>
  <changelog author="rhopkins@suse.de" date="1719921607">- hsr: Prevent use after free in prp_create_tagged_frame()
  (CVE-2023-52846 bsc#1225098).
- commit cf63988</changelog>
  <changelog author="krisman@suse.de" date="1719921608">- io_uring: Fix io_cqring_wait() not restoring sigmask on
  get_timespec64() failure (git-fixes).
- commit e640a65</changelog>
  <changelog author="krisman@suse.de" date="1719921609">- io_uring: check for non-NULL file pointer in io_file_can_poll()
  (bsc#1226990 CVE-2024-39371).
- io_uring/io-wq: Use set_bit() and test_bit() at worker-&gt;flags
  (git-fixes).
- io_uring/sqpoll: work around a potential audit memory leak
  (git-fixes).
- commit 24603fc</changelog>
  <changelog author="krisman@suse.de" date="1719921610">- io_uring/rsrc: fix incorrect assignment of iter-&gt;nr_segs in
  io_import_fixed (git-fixes).
- io_uring/rsrc: don't lock while !TASK_RUNNING (git-fixes).
- io_uring/io-wq: avoid garbage value of 'match' in
  io_wq_enqueue() (git-fixes).
- commit 7d3e252</changelog>
</package>
<package pkgid="f5c8d72dcb5cbf270d1cb7e1f1d1188a976dd372dff523dfd296df90985f17c7" name="dtb-apm" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.17.1"/>
  <changelog author="tiwai@suse.de" date="1722081600">- auxdisplay: ht16k33: Drop reference after LED registration
  (git-fixes).
- ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
  on unprepare (git-fixes).
- ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
- ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
  reachable (git-fixes).
- ASoC: sof: amd: fix for firmware reload failure in Vangogh
  platform (git-fixes).
- ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
- ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
  (git-fixes).
- ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
- ALSA: ump: Don't update FB name for static blocks (git-fixes).
- drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
- drm/i915/gt: Do not consider preemption during execlists_dequeue
  for gen8 (git-fixes).
- drm/i915/dp: Don't switch the LTTPR mode on an active link
  (git-fixes).
- commit d7e2deb</changelog>
  <changelog author="tiwai@suse.de" date="1722081601">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
</package>
<package pkgid="2e4b4f4cd86ac22c20f5d411d13d7e0ad0105b9e0c99533a29a5f0b6b195a2e7" name="dtb-apm" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.7.1"/>
  <changelog author="mkubecek@suse.cz" date="1717416000">- netfilter: nf_tables: release mutex after nft_gc_seq_end from
  abort path (CVE-2024-26925 bsc#1223390).
- commit 578a709</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717416001">- Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
  The L3 bsc#1225765 was created seperately since our customer requires
  PTF.
- Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
- Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
- Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
- Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
- commit 054635e</changelog>
  <changelog author="msuchanek@suse.de" date="1717416002">- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
- powerpc/uaccess: Fix build errors seen with GCC 13/14
  (bsc#1194869).
- commit 46b5d84</changelog>
  <changelog author="msuchanek@suse.de" date="1717416003">- blacklist.conf: PPC fsl_msi is not used
- commit ae6590d</changelog>
  <changelog author="msuchanek@suse.de" date="1717416004">- powerpc/pseries/lparcfg: drop error message from guest name
  lookup (bsc#1187716 ltc#193451 git-fixes).
- commit ceab637</changelog>
  <changelog author="mfranc@suse.cz" date="1717416005">- Update
  patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
  (git-fixes CVE-2024-36955).
- Update
  patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
  (git-fixes bsc#1225715 CVE-2024-36906).
- Update
  patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
  (git-fixes bsc#1225579 CVE-2024-36011).
- Update
  patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
  (git-fixes bsc#1225578 CVE-2024-36013).
- Update
  patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
  (git-fixes bsc#1225502 CVE-2024-36012).
- Update
  patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
  (git-fixes bsc#1225722 CVE-2024-36880).
- Update
  patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
  (git-fixes CVE-2024-36942).
- Update
  patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
  (git-fixes bsc#1225720 CVE-2024-36032).
- Update
  patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
  (git-fixes bsc#1223749 CVE-2024-26990).
- Update
  patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
  (git-fixes bsc#1223692 CVE-2024-26992).
- Update
  patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
  (stable-fixes CVE-2024-36944).
- Update
  patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
  (git-fixes bsc#1225734 CVE-2024-36896).
- Update
  patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
  (stable-fixes CVE-2024-36949).
- Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
  (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
- Update
  patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
  (git-fixes bsc#1225692 CVE-2023-52882).
- Update
  patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
  (git-fixes CVE-2024-26761).
- Update
  patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
  (stable-fixes bsc#1225735 CVE-2024-36897).
- Update
  patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
  (stable-fixes bsc#1225705 CVE-2024-36026).
- Update
  patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
  (stable-fixes CVE-2024-36951).
- Update
  patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
  (git-fixes bsc#1225593 CVE-2024-36014).
- Update
  patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
  (stable-fixes bsc#1225728 CVE-2024-36885).
- Update
  patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
  (git-fixes bsc#1225773 CVE-2024-36936).
- Update
  patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
  (stable-fixes CVE-2024-36950).
- Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
  (git-fixes bsc#1225736 CVE-2024-36898).
- Update
  patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
  (git-fixes bsc#1225698 CVE-2024-36020).
- Update
  patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
  (git-fixes bsc#1225710 CVE-2024-36891).
- Update
  patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
  (git-fixes bsc#1225714 CVE-2024-36890).
- Update
  patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
  (git-fixes bsc#1225708 CVE-2024-36029).
- Update
  patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
  (git-fixes bsc#1225699 CVE-2024-36021).
- Update
  patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
  (git-fixes CVE-2024-26943).
- Update
  patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
  (git-fixes bsc#1225694 CVE-2024-36018).
- Update
  patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
  (git-fixes CVE-2024-36940).
- Update
  patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
  (git-fixes CVE-2024-36959).
- Update
  patches.suse/ppdev-Add-an-error-check-in-register_device.patch
  (git-fixes bsc#1225640 CVE-2024-36015).
- Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
  CVE-2024-36947).
- Update
  patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
  (git-fixes bsc#1225695 CVE-2024-36019).
- Update
  patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
  (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
- Update
  patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
  (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
- Update
  patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
  (git-fixes bsc#1225704 CVE-2024-36025).
- Update
  patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
  (git-fixes CVE-2024-36930).
- Update
  patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
  (bsc#1224331 bsc#1224602 CVE-2024-35814).
- Update
  patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
  (git-fixes bsc#1225642 CVE-2024-36016).
- Update
  patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
  (git-fixes bsc#1225749 CVE-2024-36894).
- Update
  patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
  (git-fixes bsc#1225750 CVE-2024-36895).
- Update
  patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
  (git-fixes bsc#1225748 CVE-2024-36893).
- Update
  patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
  (stable-fixes bsc#1225769 CVE-2024-36921).
- Update
  patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
  (stable-fixes CVE-2024-36922).
- Update
  patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
  (git-fixes CVE-2024-36941).
- Update
  patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
  (git-fixes bsc#1224742 CVE-2024-35803).
- commit 539780f</changelog>
  <changelog author="dwagner@suse.de" date="1717416006">- nvmet: fix ns enable/disable possible hang (git-fixes).
- nvme-multipath: fix io accounting on failover (git-fixes).
- nvme: fix multipath batched completion accounting (git-fixes).
- commit ed3b392</changelog>
  <changelog author="dwagner@suse.de" date="1717416007">- scsi: lpfc: Copyright updates for 14.4.0.2 patches
  (bsc#1225842).
- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
  (bsc#1225842).
  Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
  (bsc#1225842).
- scsi: lpfc: Clear deferred RSCN processing flag when driver
  is unloading (bsc#1225842).
- scsi: lpfc: Update logging of protection type for T10 DIF I/O
  (bsc#1225842).
- scsi: lpfc: Change default logging level for unsolicited CT
  MIB commands (bsc#1225842).
- commit 5a56384</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416008">- smb: client: fix mount when dns_resolver key is not available
  (git-fixes, bsc#1225172).
- commit 28edb5c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416009">- cifs: fix leak of iface for primary channel (git-fixes,
  bsc#1225172).
- commit b7eb8e8</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416010">- Revert "cifs: reconnect work should have reference on server
  struct" (git-fixes, bsc#1225172).
- commit 3ca4c0c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416011">- smb: client: fix parsing of SMB3.1.1 POSIX create context
  (git-fixes, bsc#1225172).
- commit 5f27f69</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416012">- cifs: failure to add channel on iface should bump up weight
  (git-fixes, bsc#1225172).
- commit 007b237</changelog>
  <changelog author="tonyj@suse.de" date="1717416013">- perf/x86: Fix out of range data (git-fixes).
- perf/x86/intel/ds: Don't clear -&gt;pebs_data_cfg for the last
  PEBS event (git-fixes).
- perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
- commit 664d77f</changelog>
  <changelog author="dsterba@suse.com" date="1717588800">- blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
- Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
  Quoting bsc#1225945#c11:
  "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
  transaction for every subvol create")
  ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
  unwritten extent buffer after snapshotting a new subvolume") was never
  backported."
- commit d947258</changelog>
  <changelog author="tonyj@suse.de" date="1717588801">- perf pmu: Count sys and cpuid JSON events separately (git
  fixes).
- perf stat: Don't display metric header for non-leader uncore
  events (git-fixes).
- perf daemon: Fix file leak in daemon_session__control
  (git-fixes).
- perf symbols: Fix ownership of string in dso__load_vmlinux()
  (git-fixes).
- perf thread: Fixes to thread__new() related to initializing comm
  (git-fixes).
- perf report: Avoid SEGV in report__setup_sample_type()
  (git-fixes).
- perf ui browser: Don't save pointer to stack memory (git-fixes).
- perf bench internals inject-build-id: Fix trap divide when
  collecting just one DSO (git-fixes).
- perf intel-pt: Fix unassigned instruction op (discovered by
  MemorySanitizer) (git-fixes).
- perf test shell arm_coresight: Increase buffer size for
  Coresight basic tests (git-fixes).
- perf docs: Document bpf event modifier (git-fixes).
- perf bench uprobe: Remove lib64 from libc.so.6 binary path
  (git-fixes).
- perf record: Fix debug message placement for test consumption
  (git-fixes).
- perf tests: Apply attributes to all events in object code
  reading test (git-fixes).
- perf tests: Make "test data symbol" more robust on Neoverse N1
  (git-fixes).
- perf annotate: Fix annotation_calc_lines() to pass correct
  address to get_srcline() (git-fixes).
- perf stat: Do not fail on metrics on s390 z/VM systems
  (git-fixes).
- perf sched timehist: Fix -g/--call-graph option failure
  (git-fixes).
- perf annotate: Get rid of duplicate --group option item
  (git-fixes).
- perf probe: Add missing libgen.h header needed for using
  basename() (git-fixes).
- perf record: Delete session after stopping sideband thread
  (git-fixes).
- perf auxtrace: Fix multiple use of --itrace option (git-fixes).
- perf script: Show also errors for --insn-trace option
  (git-fixes).
- perf lock contention: Add a missing NULL check (git-fixes).
- perf vendor events amd: Fix Zen 4 cache latency events
  (git-fixes).
- libperf evlist: Avoid out-of-bounds access (git-fixes).
- perf pmu: Fix a potential memory leak in perf_pmu__lookup()
  (git-fixes).
- perf print-events: make is_event_supported() more robust
  (git-fixes).
- perf list: fix short description for some cache events
  (git-fixes).
- perf metric: Don't remove scale from counts (git-fixes).
- perf stat: Avoid metric-only segv (git-fixes).
- perf expr: Fix "has_event" function for metric style events
  (git-fixes).
- perf srcline: Add missed addr2line closes (git-fixes).
- perf thread_map: Free strlist on normal path in
  thread_map__new_by_tid_str() (git-fixes).
- perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
- perf jevents: Drop or simplify small integer values (git-fixes).
- perf evsel: Fix duplicate initialization of data-&gt;id in
  evsel__parse_sample() (git-fixes).
- perf pmu: Treat the msr pmu as software (git-fixes).
- perf record: Check conflict between '--timestamp-filename'
  option and pipe mode before recording (git-fixes).
- perf record: Fix possible incorrect free in
  record__switch_output() (git-fixes).
- perf vendor events amd: Add Zen 4 memory controller events
  (git-fixes).
- perf top: Uniform the event name for the hybrid machine
  (git-fixes).
- perf top: Use evsel's cpus to replace user_requested_cpus
  (git-fixes).
- commit a1f9340</changelog>
  <changelog author="tonyj@suse.de" date="1717675200">- perf ui browser: Avoid SEGV on title (git fixes).
- commit 1578c22</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675201">- inet: inet_defrag: prevent sk release while still in use
  (CVE-2024-26921 bsc#1223138).
- commit 2016faf</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675202">- net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
- commit 7bf5961</changelog>
  <changelog author="tiwai@suse.de" date="1718366400">- Temporarily drop KVM patch that caused a regression (bsc#1226158)
  Delete patches.suse/KVM-x86-pmu-Prioritize-VMX-interception-over-GP-on-R.patch
- commit 33f31da</changelog>
</package>
<package pkgid="6e45d3721fb99f14ef33d5fe3bd617146ccaf92c854c2ebe9d3cea7f70ea100d" name="dtb-apple" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.14.1"/>
  <changelog author="tiwai@suse.de" date="1719662400">- gpiolib: cdev: Disallow reconfiguration without direction
  (uAPI v1) (git-fixes).
- gpio: davinci: Validate the obtained number of IRQs (git-fixes).
- commit 919ebd1</changelog>
  <changelog author="tiwai@suse.de" date="1719748800">- i2c: testunit: discard write requests while old command is
  running (git-fixes).
- i2c: testunit: don't erase registers after STOP (git-fixes).
- mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
  (git-fixes).
- mmc: sdhci: Do not invert write-protect twice (git-fixes).
- mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
  (git-fixes).
- mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
  (git-fixes).
- commit 448487d</changelog>
  <changelog author="tiwai@suse.de" date="1719748801">- crypto: iaa - Account for cpu-less numa nodes (bsc#1227190).
- commit cd600aa</changelog>
  <changelog author="tiwai@suse.de" date="1719748802">- crypto: deflate - Add aliases to deflate (bsc#1227190).
- commit 27ffd92</changelog>
  <changelog author="tiwai@suse.de" date="1719835200">- ata: ahci: Clean up sysfs file on error (git-fixes).
- ata: libata-core: Fix double free on error (git-fixes).
- ata,scsi: libata-core: Do not leak memory for ata_port struct
  members (git-fixes).
- ata: libata-core: Fix null pointer dereference on error
  (git-fixes).
- kbuild: Fix build target deb-pkg: ln: failed to create hard link
  (git-fixes).
- kbuild: doc: Update default INSTALL_MOD_DIR from extra to
  updates (git-fixes).
- kbuild: Install dtb files as 0644 in Makefile.dtbinst
  (git-fixes).
- counter: ti-eqep: enable clock at probe (git-fixes).
- iio: chemical: bme680: Fix sensor data read operation
  (git-fixes).
- iio: chemical: bme680: Fix overflows in compensate() functions
  (git-fixes).
- iio: chemical: bme680: Fix calibration data variable
  (git-fixes).
- iio: chemical: bme680: Fix pressure value output (git-fixes).
- iio: accel: fxls8962af: select IIO_BUFFER &amp; IIO_KFIFO_BUF
  (git-fixes).
- iio: adc: ad7266: Fix variable checking bug (git-fixes).
- iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
  (git-fixes).
- serial: bcm63xx-uart: fix tx after conversion to
  uart_port_tx_limited() (git-fixes).
- serial: core: introduce uart_port_tx_limited_flags()
  (git-fixes).
- Revert "serial: core: only stop transmit when HW fifo is empty"
  (git-fixes).
- tty: mcf: MCF54418 has 10 UARTS (git-fixes).
- usb: gadget: aspeed_udc: fix device address configuration
  (git-fixes).
- usb: dwc3: core: remove lock of otg mode during gadget
  suspend/resume to avoid deadlock (git-fixes).
- usb: typec: ucsi: glink: fix child node release in probe
  function (git-fixes).
- usb: musb: da8xx: fix a resource leak in probe() (git-fixes).
- usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  (git-fixes).
- usb: gadget: printer: fix races against disable (git-fixes).
- PCI/MSI: Fix UAF in msi_capability_init (git-fixes).
- commit a2ea5a9</changelog>
  <changelog author="ptesarik@suse.com" date="1719835201">- net: ena: Fix redundant device NUMA node override
  (jsc#PED-8688).
- commit 6ad6684</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835202">- tcp: do not accept ACK of bytes we never sent (CVE-2023-52881
  bsc#1225611).
- commit 16404a6</changelog>
  <changelog author="mhocko@suse.com" date="1719835203">- Update
  patches.suse/1352-drm-amdgpu-Fix-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52883
  bsc#1226630).
- Update
  patches.suse/9p-add-missing-locking-around-taking-dentry-fid-list.patch
  (git-fixes CVE-2024-39463 bsc#1227090).
- Update
  patches.suse/ALSA-Fix-deadlocks-with-kctl-removals-at-disconnecti.patch
  (stable-fixes CVE-2024-38600 bsc#1226864).
- Update
  patches.suse/ALSA-core-Fix-NULL-module-pointer-assignment-at-card.patch
  (git-fixes CVE-2024-38605 bsc#1226740).
- Update
  patches.suse/ALSA-hda-Fix-possible-null-ptr-deref-when-assigning-.patch
  (git-fixes CVE-2023-52806 bsc#1225554).
- Update
  patches.suse/ALSA-hda-cs_dsp_ctl-Use-private_free-for-control-cle.patch
  (git-fixes CVE-2024-38388 bsc#1226890).
- Update
  patches.suse/ALSA-timer-Set-lower-bound-of-start-tick-time.patch
  (stable-fixes git-fixes CVE-2024-38618 bsc#1226754).
- Update
  patches.suse/ASoC-kirkwood-Fix-potential-NULL-dereference.patch
  (git-fixes CVE-2024-38550 bsc#1226633).
- Update
  patches.suse/ASoC-mediatek-Assign-dummy-when-codec-not-specified-.patch
  (git-fixes CVE-2024-38551 bsc#1226761).
- Update
  patches.suse/Bluetooth-btusb-Add-date-evt_skb-is-NULL-check.patch
  (git-fixes CVE-2023-52833 bsc#1225595).
- Update
  patches.suse/Bluetooth-hci_core-Fix-possible-buffer-overflow.patch
  (git-fixes CVE-2024-26889).
- Update
  patches.suse/HID-uclogic-Fix-user-memory-access-bug-in-uclogic_pa.patch
  (git-fixes CVE-2023-52866 bsc#1225120).
- Update
  patches.suse/IB-mlx5-Fix-init-stage-error-handling-to-avoid-doubl.patch
  (jsc#PED-6864 CVE-2023-52851 bsc#1225587).
- Update
  patches.suse/Input-cyapa-add-missing-input-core-locking-to-suspen.patch
  (git-fixes CVE-2023-52884 bsc#1226764).
- Update
  patches.suse/Input-synaptics-rmi4-fix-use-after-free-in-rmi_unreg.patch
  (git-fixes CVE-2023-52840 bsc#1224928).
- Update
  patches.suse/KEYS-trusted-Do-not-use-WARN-when-encode-fails.patch
  (git-fixes CVE-2024-36975 bsc#1226520).
- Update
  patches.suse/KEYS-trusted-Fix-memory-leak-in-tpm2_key_encode.patch
  (git-fixes CVE-2024-36967 bsc#1226131).
- Update
  patches.suse/RDMA-cma-Fix-kmemleak-in-rdma_core-observed-during-b.patch
  (git-fixes CVE-2024-38539 bsc#1226608).
- Update patches.suse/RDMA-hns-Fix-UAF-for-cq-async-event.patch
  (git-fixes CVE-2024-38545 bsc#1226595).
- Update
  patches.suse/RDMA-hns-Fix-deadlock-on-SRQ-async-events.patch
  (git-fixes CVE-2024-38591 bsc#1226738).
- Update
  patches.suse/RDMA-hns-Modify-the-print-level-of-CQE-error.patch
  (git-fixes CVE-2024-38590 bsc#1226839).
- Update
  patches.suse/RDMA-rxe-Fix-seg-fault-in-rxe_comp_queue_pkt.patch
  (git-fixes CVE-2024-38544 bsc#1226597).
- Update
  patches.suse/SUNRPC-Fix-RPC-client-cleaned-up-the-freed-pipefs-de.patch
  (git-fixes CVE-2023-52803 bsc#1225008).
- Update patches.suse/af_unix-Clear-stale-u-oob_skb.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-35970 bsc#1224584).
- Update
  patches.suse/af_unix-Drop-oob_skb-ref-before-purging-queue-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26750 bsc#1222617).
- Update
  patches.suse/af_unix-Fix-task-hung-while-purging-oob_skb-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26780 bsc#1222588).
- Update
  patches.suse/af_unix-Update-unix_sk-sk-oob_skb-under-sk_receive_queue-lock.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-36972 bsc#1226163).
- Update
  patches.suse/arm64-Restrict-CPU_BIG_ENDIAN-to-GNU-as-or-LLVM-IAS-.patch
  (git-fixes CVE-2023-52750 bsc#1225485).
- Update
  patches.suse/atl1c-Work-around-the-DMA-RX-overflow-issue.patch
  (git-fixes CVE-2023-52834 bsc#1225599).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issue-of-net_device.patch
  (git-fixes CVE-2024-38554 bsc#1226742).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issues-of-ax25_dev.patch
  (git-fixes CVE-2024-38602 bsc#1226613).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-reorder-of-WRITE-lqueued.patch
  (bsc#1225605 CVE-2024-38384 bsc#1226938).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-resetting-io-stat.patch
  (bsc#1225605 CVE-2024-38663 bsc#1226939).
- Update
  patches.suse/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch
  (git-fixes CVE-2024-38540 bsc#1226582).
- Update
  patches.suse/bonding-stop-the-device-in-bond_setup_by_slave.patch
  (git-fixes CVE-2023-52784 bsc#1224946).
- Update
  patches.suse/can-dev-can_put_echo_skb-don-t-crash-kernel-if-can_p.patch
  (git-fixes CVE-2023-52878 bsc#1225000).
- Update
  patches.suse/clk-mediatek-clk-mt2701-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52875 bsc#1225096).
- Update
  patches.suse/clk-mediatek-clk-mt6765-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52870 bsc#1224937).
- Update
  patches.suse/clk-mediatek-clk-mt6779-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52873 bsc#1225589).
- Update
  patches.suse/clk-mediatek-clk-mt6797-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52865 bsc#1225086).
- Update
  patches.suse/clk-mediatek-clk-mt7629-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52858 bsc#1225566).
- Update
  patches.suse/clk-mediatek-clk-mt7629-eth-Add-check-for-mtk_alloc_.patch
  (git-fixes CVE-2023-52876 bsc#1225036).
- Update
  patches.suse/cppc_cpufreq-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38573 bsc#1226739).
- Update patches.suse/cpufreq-exit-callback-is-optional.patch
  (git-fixes CVE-2024-38615 bsc#1226592).
- Update patches.suse/crypto-bcm-Fix-pointer-arithmetic.patch
  (git-fixes CVE-2024-38579 bsc#1226637).
- Update
  patches.suse/crypto-pcrypt-Fix-hungtask-for-PADATA_RESET.patch
  (git-fixes CVE-2023-52813 bsc#1225527).
- Update patches.suse/cxl-mem-Fix-shutdown-order.patch (git-fixes
  CVE-2023-52849 bsc#1224949).
- Update
  patches.suse/cxl-region-Do-not-try-to-cleanup-after-cxl_region_se.patch
  (git-fixes CVE-2023-52792 bsc#1225477).
- Update patches.suse/cxl-region-Fix-cxlr_pmem-leaks.patch
  (git-fixes CVE-2024-38391 bsc#1226894).
- Update
  patches.suse/dma-buf-sw-sync-don-t-enable-IRQ-from-sync_print_obj.patch
  (git-fixes CVE-2024-38780 bsc#1226886).
- Update
  patches.suse/dma-mapping-benchmark-fix-node-id-validation.patch
  (git-fixes CVE-2024-34777 bsc#1226796).
- Update
  patches.suse/dma-mapping-benchmark-handle-NUMA_NO_NODE-correctly.patch
  (git-fixes CVE-2024-39277 bsc#1226909).
- Update
  patches.suse/dmaengine-idxd-Avoid-unnecessary-destruction-of-file.patch
  (git-fixes CVE-2024-38629 bsc#1226905).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Pola.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52819
  bsc#1225532).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-SMU7.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52818
  bsc#1225530).
- Update
  patches.suse/drm-amd-check-num-of-link-levels-when-update-pcie-pa.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52812
  bsc#1225564).
- Update
  patches.suse/drm-amd-display-Avoid-NULL-dereference-of-timing-gen.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52753
  bsc#1225478).
- Update
  patches.suse/drm-amd-display-Fix-division-by-zero-in-setup_dsc_co.patch
  (stable-fixes CVE-2024-36969 bsc#1226155).
- Update
  patches.suse/drm-amd-display-Fix-null-pointer-dereference-in-erro.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52862
  bsc#1225015).
- Update
  patches.suse/drm-amd-display-Fix-potential-index-out-of-bounds-in.patch
  (git-fixes CVE-2024-38552 bsc#1226767).
- Update
  patches.suse/drm-amd-display-fix-a-NULL-pointer-dereference-in-am.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52773
  bsc#1225041).
- Update
  patches.suse/drm-amd-display-fixed-integer-types-and-null-check-l.patch
  (git-fixes CVE-2024-26767).
- Update
  patches.suse/drm-amdgpu-Fix-a-null-pointer-access-when-the-smc_rr.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52817
  bsc#1225569).
- Update
  patches.suse/drm-amdgpu-Fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch
  (git-fixes CVE-2024-39291 bsc#1226934).
- Update
  patches.suse/drm-amdgpu-Fix-potential-null-pointer-derefernce.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52814
  bsc#1225565).
- Update
  patches.suse/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch
  (stable-fixes CVE-2024-39471 bsc#1227096).
- Update
  patches.suse/drm-amdgpu-mes-fix-use-after-free-issue.patch
  (stable-fixes CVE-2024-38581 bsc#1226657).
- Update
  patches.suse/drm-amdgpu-vkms-fix-a-possible-null-pointer-derefere.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52815
  bsc#1225568).
- Update
  patches.suse/drm-amdkfd-Fix-a-race-condition-of-vram-buffer-unref.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52825
  bsc#1225076).
- Update
  patches.suse/drm-amdkfd-Fix-shift-out-of-bounds-issue.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52816
  bsc#1225529).
- Update
  patches.suse/drm-bridge-cdns-mhdp8546-Fix-possible-null-pointer-d.patch
  (git-fixes CVE-2024-38548).
- Update
  patches.suse/drm-bridge-it66121-Fix-invalid-connector-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52861
  bsc#1224941).
- Update
  patches.suse/drm-bridge-lt8912b-Fix-crash-on-bridge-detach.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52856
  bsc#1224932).
- Update
  patches.suse/drm-mediatek-Add-0-size-check-to-mtk_drm_gem_obj.patch
  (git-fixes CVE-2024-38549 bsc#1226735).
- Update
  patches.suse/drm-mediatek-Fix-coverity-issue-with-unintentional-i.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52857
  bsc#1225581).
- Update
  patches.suse/drm-mediatek-Init-ddp_comp-with-devm_kcalloc.patch
  (git-fixes CVE-2024-38592 bsc#1226844).
- Update
  patches.suse/drm-msm-a6xx-Avoid-a-nullptr-dereference-when-speedb.patch
  (git-fixes CVE-2024-38390 bsc#1226891).
- Update
  patches.suse/drm-msm-dpu-Add-callback-function-pointer-check-befo.patch
  (git-fixes CVE-2024-38622 bsc#1226856).
- Update
  patches.suse/drm-panel-fix-a-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52821
  bsc#1225022).
- Update
  patches.suse/drm-panel-panel-tpo-tpg110-fix-a-possible-null-point.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52826
  bsc#1225077).
- Update patches.suse/drm-radeon-possible-buffer-overflow.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52867
  bsc#1225009).
- Update
  patches.suse/drm-vc4-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38546 bsc#1226593).
- Update
  patches.suse/drm-vmwgfx-Fix-invalid-reads-in-fence-signaled-event.patch
  (git-fixes CVE-2024-36960 bsc#1225872).
- Update
  patches.suse/drm-zynqmp_dpsub-Always-register-bridge.patch
  (git-fixes CVE-2024-38664 bsc#1226941).
- Update
  patches.suse/e1000e-change-usleep_range-to-udelay-in-PHY-mdic-acc.patch
  (CVE-2024-39296 bsc#1226989 CVE-2024-36887 bsc#1225731).
- Update
  patches.suse/ecryptfs-Fix-buffer-size-for-tag-66-packet.patch
  (git-fixes CVE-2024-38578 bsc#1226634).
- Update
  patches.suse/efi-libstub-only-free-priv.runtime_map-when-allocate.patch
  (git-fixes CVE-2024-33619 bsc#1226768).
- Update
  patches.suse/fbdev-imsttfb-fix-a-resource-leak-in-probe.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52838
  bsc#1225031).
- Update
  patches.suse/fs-9p-only-translate-RWX-permissions-for-plain-9P200.patch
  (git-fixes CVE-2024-36964 bsc#1225866).
- Update
  patches.suse/fs-jfs-Add-check-for-negative-db_l2nbperpage.patch
  (git-fixes CVE-2023-52810 bsc#1225557).
- Update
  patches.suse/fs-jfs-Add-validity-check-for-db_maxag-and-db_agpref.patch
  (git-fixes CVE-2023-52804 bsc#1225550).
- Update
  patches.suse/ftrace-Fix-possible-use-after-free-issue-in-ftrace_location.patch
  (git-fixes CVE-2024-38588 bsc#1226837).
- Update
  patches.suse/genirq-irqdesc-Prevent-use-after-free-in-irq_find_at.patch
  (git-fixes CVE-2024-38385 bsc#1227085).
- Update patches.suse/gfs2-ignore-negated-quota-changes.patch
  (git-fixes CVE-2023-52759 bsc#1225560).
- Update
  patches.suse/hid-cp2112-Fix-duplicate-workqueue-initialization.patch
  (git-fixes CVE-2023-52853 bsc#1224988).
- Update
  patches.suse/hwmon-axi-fan-control-Fix-possible-NULL-pointer-dere.patch
  (git-fixes CVE-2023-52863 bsc#1225586).
- Update
  patches.suse/i2c-acpi-Unbind-mux-adapters-before-delete.patch
  (git-fixes CVE-2024-39362 bsc#1226995).
- Update
  patches.suse/i2c-core-Run-atomic-i2c-xfer-when-preemptible.patch
  (git-fixes CVE-2023-52791 bsc#1225108).
- Update
  patches.suse/i3c-master-mipi-i3c-hci-Fix-a-kernel-panic-for-acces.patch
  (git-fixes CVE-2023-52763 bsc#1225570).
- Update
  patches.suse/i3c-mipi-i3c-hci-Fix-out-of-bounds-access-in-hci_dma.patch
  (git-fixes CVE-2023-52766).
- Update
  patches.suse/i915-perf-Fix-NULL-deref-bugs-with-drm_dbg-calls.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52788
  bsc#1225106).
- Update
  patches.suse/igb-Fix-string-truncation-warnings-in-igb_set_fw_ver.patch
  (git-fixes CVE-2024-36010 bsc#1225594).
- Update
  patches.suse/iommu-vt-d-Fix-WARN_ON-in-iommu-probe-path.patch
  (git-fixes CVE-2024-35957 bsc#1224673).
- Update
  patches.suse/iommufd-Fix-missing-update-of-domains_itree-after-splitting-iopt
  (jsc#PED-7779 jsc#PED-7780 CVE-2023-52801 bsc#1225006).
- Update
  patches.suse/ipvlan-add-ipvlan_route_v6_outbound-helper.patch
  (git-fixes CVE-2023-52796 bsc#1224930).
- Update
  patches.suse/jffs2-prevent-xattr-node-from-overflowing-the-eraseblock.patch
  (git-fixes CVE-2024-38599 bsc#1226848).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-dbFindLeaf.patch
  (git-fixes CVE-2023-52799 bsc#1225472).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-diAlloc.patch
  (git-fixes CVE-2023-52805 bsc#1225553).
- Update
  patches.suse/kunit-fortify-Fix-mismatched-kvalloc-vfree-usage.patch
  (git-fixes CVE-2024-38617 bsc#1226859).
- Update
  patches.suse/lib-generic-radix-tree.c-Don-t-overflow-in-peek.patch
  (git-fixes CVE-2021-47432 bsc#1225391).
- Update
  patches.suse/lib-test_hmm.c-handle-src_pfns-and-dst_pfns-allocati.patch
  (git-fixes CVE-2024-38543 bsc#1226594).
- Update
  patches.suse/locking-ww_mutex-test-Fix-potential-workqueue-corrup.patch
  (bsc#1219953 CVE-2023-52836 bsc#1225609).
- Update
  patches.suse/md-Don-t-ignore-suspended-array-in-md_check_recovery-1baa.patch
  (bsc#1219596 CVE-2024-26758).
- Update
  patches.suse/media-atomisp-ssh_css-Fix-a-null-pointer-dereference.patch
  (git-fixes CVE-2024-38547 bsc#1226632).
- Update
  patches.suse/media-bttv-fix-use-after-free-error-due-to-btv-timeo.patch
  (git-fixes CVE-2023-52847 bsc#1225588).
- Update
  patches.suse/media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch
  (git-fixes CVE-2023-52764 bsc#1225571).
- Update
  patches.suse/media-hantro-Check-whether-reset-op-is-defined-befor.patch
  (git-fixes CVE-2023-52850 bsc#1225014).
- Update
  patches.suse/media-i2c-et8ek8-Don-t-strip-remove-function-when-dr.patch
  (git-fixes CVE-2024-38611 bsc#1226760).
- Update
  patches.suse/media-imon-fix-access-to-invalid-resource-for-the-se.patch
  (git-fixes CVE-2023-52754 bsc#1225490).
- Update
  patches.suse/media-lgdt3306a-Add-a-check-against-null-pointer-def.patch
  (stable-fixes CVE-2022-48772 bsc#1226976).
- Update
  patches.suse/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch
  (git-fixes CVE-2024-38621 bsc#1226895).
- Update
  patches.suse/media-vidtv-mux-Add-check-and-kfree-for-kstrdup.patch
  (git-fixes CVE-2023-52841 bsc#1225592).
- Update patches.suse/media-vidtv-psi-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52844 bsc#1225590).
- Update
  patches.suse/mfd-qcom-spmi-pmic-Fix-revid-implementation.patch
  (git-fixes CVE-2023-52765 bsc#1225029).
- Update
  patches.suse/misc-microchip-pci1xxxx-fix-double-free-in-the-error.patch
  (git-fixes CVE-2024-36973 bsc#1226457).
- Update
  patches.suse/net-hns3-fix-out-of-bounds-access-may-occur-when-coa.patch
  (git-fixes CVE-2023-52807 bsc#1225097).
- Update
  patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch
  (git-fixes CVE-2024-36962 bsc#1225827).
- Update
  patches.suse/net-mlx5-Fix-peer-devlink-set-for-SF-representor-dev.patch
  (git-fixes CVE-2024-38595 bsc#1226741).
- Update
  patches.suse/net-mlx5e-Track-xmit-submission-to-PTP-WQ-after-popu.patch
  (jsc#PED-3311 CVE-2023-52782 bsc#1225103).
- Update
  patches.suse/net-mvneta-fix-calls-to-page_pool_get_stats.patch
  (git-fixes CVE-2023-52780 bsc#1224933).
- Update
  patches.suse/net-wangxun-fix-kernel-panic-due-to-null-pointer.patch
  (git-fixes CVE-2023-52783 bsc#1225104).
- Update
  patches.suse/netfilter-complete-validation-of-user-input.patch
  (git-fixes CVE-2024-35896 bsc#1224662 CVE-2024-35962
  bsc#1224583).
- Update
  patches.suse/nfc-nci-Fix-uninit-value-in-nci_rx_work.patch
  (git-fixes CVE-2024-38381 bsc#1226878).
- Update
  patches.suse/nilfs2-fix-nilfs_empty_dir-misjudgment-and-long-loop.patch
  (git-fixes CVE-2024-39469 bsc#1226992).
- Update
  patches.suse/nilfs2-fix-potential-hang-in-nilfs_detach_log_writer.patch
  (git-fixes CVE-2024-38582 bsc#1226658).
- Update
  patches.suse/nilfs2-fix-use-after-free-of-timer-for-log-writer-th.patch
  (git-fixes CVE-2024-38583 bsc#1226777).
- Update
  patches.suse/of-module-add-buffer-overflow-check-in-of_modalias.patch
  (git-fixes CVE-2024-38541 bsc#1226587).
- Update
  patches.suse/padata-Fix-refcnt-handling-in-padata_free_shell.patch
  (git-fixes CVE-2023-52854 bsc#1225584).
- Update
  patches.suse/perf-core-Bail-out-early-if-the-request-AUX-area-is-out-of-bound.patch
  (git-fixes CVE-2023-52835 bsc#1225602).
- Update
  patches.suse/platform-x86-wmi-Fix-opening-of-char-device.patch
  (git-fixes CVE-2023-52864 bsc#1225132).
- Update
  patches.suse/powerpc-pseries-iommu-LPAR-panics-during-boot-up-wit.patch
  (bsc#1222011 ltc#205900 CVE-2024-36926 bsc#1225829).
- Update patches.suse/pstore-platform-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52869 bsc#1225050).
- Update
  patches.suse/remoteproc-mediatek-Make-sure-IPI-buffer-fits-in-L2T.patch
  (git-fixes CVE-2024-36965 bsc#1226149).
- Update
  patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch
  (git-fixes CVE-2024-38601 bsc#1226876).
- Update
  patches.suse/s390-dasd-protect-device-queue-against-concurrent-access.patch
  (git-fixes bsc#1217481 CVE-2023-52774 bsc#1225572).
- Update
  patches.suse/scsi-hisi_sas-Set-debugfs_dir-pointer-to-NULL-after-removing-debugfs.patch
  (git-fixes CVE-2023-52808 bsc#1225555).
- Update
  patches.suse/scsi-ibmvfc-Remove-BUG_ON-in-the-case-of-an-empty-ev.patch
  (bsc#1209834 ltc#202097 CVE-2023-52811 bsc#1225559).
- Update
  patches.suse/scsi-libfc-Fix-potential-NULL-pointer-dereference-in-fc_lport_ptp_setup.patch
  (git-fixes CVE-2023-52809 bsc#1225556).
- Update
  patches.suse/scsi-lpfc-Move-NPIV-s-transport-unregistration-to-af.patch
  (bsc#1221777 CVE-2024-36952 bsc#1225898).
- Update
  patches.suse/scsi-lpfc-Release-hbalock-before-calling-lpfc_worker.patch
  (bsc#1221777 CVE-2024-36924 bsc#1225820).
- Update
  patches.suse/serial-max3100-Lock-port-lock-when-calling-uart_hand.patch
  (git-fixes CVE-2024-38634 bsc#1226868).
- Update
  patches.suse/serial-max3100-Update-uart_driver_registered-on-driv.patch
  (git-fixes CVE-2024-38633 bsc#1226867).
- Update
  patches.suse/soc-qcom-llcc-Handle-a-second-device-without-data-co.patch
  (git-fixes CVE-2023-52871 bsc#1225534).
- Update
  patches.suse/soundwire-cadence-fix-invalid-PDI-offset.patch
  (stable-fixes CVE-2024-38635 bsc#1226863).
- Update patches.suse/speakup-Fix-sizeof-vs-ARRAY_SIZE-bug.patch
  (git-fixes CVE-2024-38587 bsc#1226780).
- Update patches.suse/spi-Fix-null-dereference-on-suspend.patch
  (git-fixes CVE-2023-52749 bsc#1225476).
- Update
  patches.suse/thermal-core-prevent-potential-string-overflow.patch
  (git-fixes CVE-2023-52868 bsc#1225044).
- Update
  patches.suse/thermal-drivers-qcom-lmh-Check-for-SCM-availability-.patch
  (git-fixes CVE-2024-39466 bsc#1227089).
- Update
  patches.suse/thermal-drivers-tsens-Fix-null-pointer-dereference.patch
  (git-fixes CVE-2024-38571 bsc#1226737).
- Update
  patches.suse/thermal-intel-powerclamp-fix-mismatch-in-get-functio.patch
  (git-fixes CVE-2023-52794 bsc#1225028).
- Update
  patches.suse/tls-fix-NULL-deref-on-tls_sw_splice_eof-with-empty-r.patch
  (jsc#PED-6831 CVE-2023-52767 bsc#1224998).
- Update
  patches.suse/tpm_tis_spi-Account-for-SPI-header-when-allocating-T.patch
  (git-fixes CVE-2024-36477 bsc#1226840).
- Update
  patches.suse/tracing-Have-trace_event_file-have-ref-counters.patch
  (git-fixes CVE-2023-52879 bsc#1225101).
- Update
  patches.suse/tracing-trigger-Fix-to-return-error-if-failed-to-alloc-snapshot.patch
  (git-fixes CVE-2024-26920).
- Update
  patches.suse/tty-n_gsm-fix-race-condition-in-status-line-change-o.patch
  (git-fixes CVE-2023-52872 bsc#1225591).
- Update
  patches.suse/tty-n_gsm-require-CAP_NET_ADMIN-to-attach-N_GSM0710-.patch
  (bsc#1222619 CVE-2023-52880).
- Update
  patches.suse/tty-vcc-Add-check-for-kstrdup-in-vcc_probe.patch
  (git-fixes CVE-2023-52789 bsc#1225180).
- Update
  patches.suse/usb-config-fix-iteration-issue-in-usb_get_bos_descri.patch
  (git-fixes CVE-2023-52781 bsc#1225092).
- Update
  patches.suse/usb-dwc3-Wait-unconditionally-after-issuing-EndXfer-.patch
  (git-fixes CVE-2024-36977 bsc#1226513).
- Update
  patches.suse/usb-gadget-u_audio-Fix-race-condition-use-of-control.patch
  (git-fixes CVE-2024-38628 bsc#1226911).
- Update
  patches.suse/usb-storage-alauda-Check-whether-the-media-is-initia.patch
  (git-fixes CVE-2024-38619 bsc#1226861).
- Update
  patches.suse/usb-typec-tcpm-Fix-NULL-pointer-dereference-in-tcpm_.patch
  (git-fixes CVE-2023-52877 bsc#1224944).
- Update
  patches.suse/vhost-vdpa-fix-use-after-free-in-vhost_vdpa_probe.patch
  (jsc#PED-3311 CVE-2023-52795 bsc#1225085).
- Update
  patches.suse/virtio-blk-fix-implicit-overflow-on-virtio_max_dma_s.patch
  (git-fixes CVE-2023-52762 bsc#1225573).
- Update
  patches.suse/virtio-vsock-Fix-uninit-value-in-virtio_transport_re.patch
  (jsc#PED-5505 CVE-2023-52842 bsc#1225025).
- Update
  patches.suse/watchdog-cpu5wdt.c-Fix-use-after-free-bug-caused-by-.patch
  (git-fixes CVE-2024-38630 bsc#1226908).
- Update
  patches.suse/wifi-ar5523-enable-proper-endpoint-verification.patch
  (git-fixes CVE-2024-38565 bsc#1226747).
- Update
  patches.suse/wifi-ath11k-fix-dfs-radar-event-locking.patch
  (git-fixes CVE-2023-52798 bsc#1224947).
- Update
  patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch
  (git-fixes CVE-2023-52777 bsc#1224992).
- Update patches.suse/wifi-ath11k-fix-htt-pktlog-locking.patch
  (git-fixes CVE-2023-52800).
- Update
  patches.suse/wifi-ath12k-fix-dfs-radar-and-temperature-event-lock.patch
  (git-fixes CVE-2023-52776 bsc#1225090).
- Update
  patches.suse/wifi-ath12k-fix-htt-mlo-offset-event-locking.patch
  (git-fixes CVE-2023-52769 bsc#1225001).
- Update
  patches.suse/wifi-ath12k-fix-out-of-bound-access-of-qmi_invoke_ha.patch
  (git-fixes CVE-2024-38572 bsc#1226776).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-read-in-ath12k.patch
  (git-fixes CVE-2023-52827 bsc#1225078).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-write-in-ath12.patch
  (git-fixes CVE-2023-52829 bsc#1225081).
- Update
  patches.suse/wifi-brcmfmac-pcie-handle-randbuf-allocation-failure.patch
  (git-fixes CVE-2024-38575 bsc#1226612).
- Update
  patches.suse/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch
  (git-fixes CVE-2024-38567 bsc#1226769).
- Update
  patches.suse/wifi-carl9170-re-fix-fortified-memset-warning.patch
  (git-fixes CVE-2024-38616 bsc#1226852).
- Update
  patches.suse/wifi-mac80211-don-t-return-unset-power-in-ieee80211_.patch
  (git-fixes CVE-2023-52832 bsc#1225577).
- Update
  patches.suse/wifi-nl80211-Avoid-address-calculations-via-out-of-b.patch
  (git-fixes CVE-2024-38562 bsc#1226788).
- Update
  patches.suse/wifi-wilc1000-use-vmm_table-as-array-in-wilc-struct.patch
  (git-fixes CVE-2023-52768 bsc#1225004).
- Update
  patches.suse/x86-tdx-Zero-out-the-missing-RSI-in-TDX_HYPERCALL-macro.patch
  (jsc#PED-5824 CVE-2023-52874 bsc#1225049).
- commit 33efdc4</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835204">- tcp: Use refcount_inc_not_zero() in tcp_twsk_unique()
  (CVE-2024-36904 bsc#1225732).
- commit d578dcc</changelog>
  <changelog author="heming.zhao@suse.com" date="1719921600">- gfs2: Fix potential glock use-after-free on unmount (bsc#1226775
  CVE-2024-38570).
- gfs2: Rename sd_{ glock =&gt; kill }_wait (bsc#1226775
  CVE-2024-38570).
- commit f3adbca</changelog>
  <changelog author="tiwai@suse.de" date="1719921601">- Correct SCSI patch references (bsc#1225767 CVE-2024-36919 bsc#1226785 CVE-2024-38559)
- commit e8ea587</changelog>
  <changelog author="tiwai@suse.de" date="1719921602">- mtd: rawnand: rockchip: ensure NVDDR timings are rejected
  (git-fixes).
- mtd: rawnand: Bypass a couple of sanity checks during NAND
  identification (git-fixes).
- mtd: rawnand: Fix the nand_read_data_op() early check
  (git-fixes).
- mtd: rawnand: Ensure ECC configuration is propagated to upper
  layers (git-fixes).
- commit e545951</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1719921603">- kernel-doc: fix struct_group_tagged() parsing (git-fixes).
- commit e3a2a2e</changelog>
  <changelog author="fdmanana@suse.com" date="1719921604">- btrfs: fix crash on racing fsync and size-extending write into
  prealloc (bsc#1227101 CVE-2024-37354).
- commit 1d355af</changelog>
  <changelog author="vbabka@suse.cz" date="1719921605">- virt: acrn: stop using follow_pfn (CVE-2024-38610 bsc#1226758).
- commit c2ea51b</changelog>
  <changelog author="vbabka@suse.cz" date="1719921606">- drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
  (CVE-2024-38610 bsc#1226758).
- commit 7069ac2</changelog>
  <changelog author="rhopkins@suse.de" date="1719921607">- hsr: Prevent use after free in prp_create_tagged_frame()
  (CVE-2023-52846 bsc#1225098).
- commit cf63988</changelog>
  <changelog author="krisman@suse.de" date="1719921608">- io_uring: Fix io_cqring_wait() not restoring sigmask on
  get_timespec64() failure (git-fixes).
- commit e640a65</changelog>
  <changelog author="krisman@suse.de" date="1719921609">- io_uring: check for non-NULL file pointer in io_file_can_poll()
  (bsc#1226990 CVE-2024-39371).
- io_uring/io-wq: Use set_bit() and test_bit() at worker-&gt;flags
  (git-fixes).
- io_uring/sqpoll: work around a potential audit memory leak
  (git-fixes).
- commit 24603fc</changelog>
  <changelog author="krisman@suse.de" date="1719921610">- io_uring/rsrc: fix incorrect assignment of iter-&gt;nr_segs in
  io_import_fixed (git-fixes).
- io_uring/rsrc: don't lock while !TASK_RUNNING (git-fixes).
- io_uring/io-wq: avoid garbage value of 'match' in
  io_wq_enqueue() (git-fixes).
- commit 7d3e252</changelog>
</package>
<package pkgid="662c55c18fe2eec05e4a7160f47dfb50b513903e0b1be43b62aaaf16672fb6f2" name="dtb-apple" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.17.1"/>
  <changelog author="tiwai@suse.de" date="1722081600">- auxdisplay: ht16k33: Drop reference after LED registration
  (git-fixes).
- ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
  on unprepare (git-fixes).
- ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
- ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
  reachable (git-fixes).
- ASoC: sof: amd: fix for firmware reload failure in Vangogh
  platform (git-fixes).
- ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
- ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
  (git-fixes).
- ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
- ALSA: ump: Don't update FB name for static blocks (git-fixes).
- drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
- drm/i915/gt: Do not consider preemption during execlists_dequeue
  for gen8 (git-fixes).
- drm/i915/dp: Don't switch the LTTPR mode on an active link
  (git-fixes).
- commit d7e2deb</changelog>
  <changelog author="tiwai@suse.de" date="1722081601">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
</package>
<package pkgid="feaf56d9e308501c5b304d86d1db36a56b536e98b3c1198eebd52209fe3e2cd5" name="dtb-apple" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.7.1"/>
  <changelog author="mkubecek@suse.cz" date="1717416000">- netfilter: nf_tables: release mutex after nft_gc_seq_end from
  abort path (CVE-2024-26925 bsc#1223390).
- commit 578a709</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717416001">- Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
  The L3 bsc#1225765 was created seperately since our customer requires
  PTF.
- Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
- Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
- Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
- Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
- commit 054635e</changelog>
  <changelog author="msuchanek@suse.de" date="1717416002">- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
- powerpc/uaccess: Fix build errors seen with GCC 13/14
  (bsc#1194869).
- commit 46b5d84</changelog>
  <changelog author="msuchanek@suse.de" date="1717416003">- blacklist.conf: PPC fsl_msi is not used
- commit ae6590d</changelog>
  <changelog author="msuchanek@suse.de" date="1717416004">- powerpc/pseries/lparcfg: drop error message from guest name
  lookup (bsc#1187716 ltc#193451 git-fixes).
- commit ceab637</changelog>
  <changelog author="mfranc@suse.cz" date="1717416005">- Update
  patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
  (git-fixes CVE-2024-36955).
- Update
  patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
  (git-fixes bsc#1225715 CVE-2024-36906).
- Update
  patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
  (git-fixes bsc#1225579 CVE-2024-36011).
- Update
  patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
  (git-fixes bsc#1225578 CVE-2024-36013).
- Update
  patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
  (git-fixes bsc#1225502 CVE-2024-36012).
- Update
  patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
  (git-fixes bsc#1225722 CVE-2024-36880).
- Update
  patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
  (git-fixes CVE-2024-36942).
- Update
  patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
  (git-fixes bsc#1225720 CVE-2024-36032).
- Update
  patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
  (git-fixes bsc#1223749 CVE-2024-26990).
- Update
  patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
  (git-fixes bsc#1223692 CVE-2024-26992).
- Update
  patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
  (stable-fixes CVE-2024-36944).
- Update
  patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
  (git-fixes bsc#1225734 CVE-2024-36896).
- Update
  patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
  (stable-fixes CVE-2024-36949).
- Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
  (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
- Update
  patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
  (git-fixes bsc#1225692 CVE-2023-52882).
- Update
  patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
  (git-fixes CVE-2024-26761).
- Update
  patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
  (stable-fixes bsc#1225735 CVE-2024-36897).
- Update
  patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
  (stable-fixes bsc#1225705 CVE-2024-36026).
- Update
  patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
  (stable-fixes CVE-2024-36951).
- Update
  patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
  (git-fixes bsc#1225593 CVE-2024-36014).
- Update
  patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
  (stable-fixes bsc#1225728 CVE-2024-36885).
- Update
  patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
  (git-fixes bsc#1225773 CVE-2024-36936).
- Update
  patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
  (stable-fixes CVE-2024-36950).
- Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
  (git-fixes bsc#1225736 CVE-2024-36898).
- Update
  patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
  (git-fixes bsc#1225698 CVE-2024-36020).
- Update
  patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
  (git-fixes bsc#1225710 CVE-2024-36891).
- Update
  patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
  (git-fixes bsc#1225714 CVE-2024-36890).
- Update
  patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
  (git-fixes bsc#1225708 CVE-2024-36029).
- Update
  patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
  (git-fixes bsc#1225699 CVE-2024-36021).
- Update
  patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
  (git-fixes CVE-2024-26943).
- Update
  patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
  (git-fixes bsc#1225694 CVE-2024-36018).
- Update
  patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
  (git-fixes CVE-2024-36940).
- Update
  patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
  (git-fixes CVE-2024-36959).
- Update
  patches.suse/ppdev-Add-an-error-check-in-register_device.patch
  (git-fixes bsc#1225640 CVE-2024-36015).
- Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
  CVE-2024-36947).
- Update
  patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
  (git-fixes bsc#1225695 CVE-2024-36019).
- Update
  patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
  (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
- Update
  patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
  (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
- Update
  patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
  (git-fixes bsc#1225704 CVE-2024-36025).
- Update
  patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
  (git-fixes CVE-2024-36930).
- Update
  patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
  (bsc#1224331 bsc#1224602 CVE-2024-35814).
- Update
  patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
  (git-fixes bsc#1225642 CVE-2024-36016).
- Update
  patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
  (git-fixes bsc#1225749 CVE-2024-36894).
- Update
  patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
  (git-fixes bsc#1225750 CVE-2024-36895).
- Update
  patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
  (git-fixes bsc#1225748 CVE-2024-36893).
- Update
  patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
  (stable-fixes bsc#1225769 CVE-2024-36921).
- Update
  patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
  (stable-fixes CVE-2024-36922).
- Update
  patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
  (git-fixes CVE-2024-36941).
- Update
  patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
  (git-fixes bsc#1224742 CVE-2024-35803).
- commit 539780f</changelog>
  <changelog author="dwagner@suse.de" date="1717416006">- nvmet: fix ns enable/disable possible hang (git-fixes).
- nvme-multipath: fix io accounting on failover (git-fixes).
- nvme: fix multipath batched completion accounting (git-fixes).
- commit ed3b392</changelog>
  <changelog author="dwagner@suse.de" date="1717416007">- scsi: lpfc: Copyright updates for 14.4.0.2 patches
  (bsc#1225842).
- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
  (bsc#1225842).
  Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
  (bsc#1225842).
- scsi: lpfc: Clear deferred RSCN processing flag when driver
  is unloading (bsc#1225842).
- scsi: lpfc: Update logging of protection type for T10 DIF I/O
  (bsc#1225842).
- scsi: lpfc: Change default logging level for unsolicited CT
  MIB commands (bsc#1225842).
- commit 5a56384</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416008">- smb: client: fix mount when dns_resolver key is not available
  (git-fixes, bsc#1225172).
- commit 28edb5c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416009">- cifs: fix leak of iface for primary channel (git-fixes,
  bsc#1225172).
- commit b7eb8e8</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416010">- Revert "cifs: reconnect work should have reference on server
  struct" (git-fixes, bsc#1225172).
- commit 3ca4c0c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416011">- smb: client: fix parsing of SMB3.1.1 POSIX create context
  (git-fixes, bsc#1225172).
- commit 5f27f69</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416012">- cifs: failure to add channel on iface should bump up weight
  (git-fixes, bsc#1225172).
- commit 007b237</changelog>
  <changelog author="tonyj@suse.de" date="1717416013">- perf/x86: Fix out of range data (git-fixes).
- perf/x86/intel/ds: Don't clear -&gt;pebs_data_cfg for the last
  PEBS event (git-fixes).
- perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
- commit 664d77f</changelog>
  <changelog author="dsterba@suse.com" date="1717588800">- blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
- Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
  Quoting bsc#1225945#c11:
  "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
  transaction for every subvol create")
  ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
  unwritten extent buffer after snapshotting a new subvolume") was never
  backported."
- commit d947258</changelog>
  <changelog author="tonyj@suse.de" date="1717588801">- perf pmu: Count sys and cpuid JSON events separately (git
  fixes).
- perf stat: Don't display metric header for non-leader uncore
  events (git-fixes).
- perf daemon: Fix file leak in daemon_session__control
  (git-fixes).
- perf symbols: Fix ownership of string in dso__load_vmlinux()
  (git-fixes).
- perf thread: Fixes to thread__new() related to initializing comm
  (git-fixes).
- perf report: Avoid SEGV in report__setup_sample_type()
  (git-fixes).
- perf ui browser: Don't save pointer to stack memory (git-fixes).
- perf bench internals inject-build-id: Fix trap divide when
  collecting just one DSO (git-fixes).
- perf intel-pt: Fix unassigned instruction op (discovered by
  MemorySanitizer) (git-fixes).
- perf test shell arm_coresight: Increase buffer size for
  Coresight basic tests (git-fixes).
- perf docs: Document bpf event modifier (git-fixes).
- perf bench uprobe: Remove lib64 from libc.so.6 binary path
  (git-fixes).
- perf record: Fix debug message placement for test consumption
  (git-fixes).
- perf tests: Apply attributes to all events in object code
  reading test (git-fixes).
- perf tests: Make "test data symbol" more robust on Neoverse N1
  (git-fixes).
- perf annotate: Fix annotation_calc_lines() to pass correct
  address to get_srcline() (git-fixes).
- perf stat: Do not fail on metrics on s390 z/VM systems
  (git-fixes).
- perf sched timehist: Fix -g/--call-graph option failure
  (git-fixes).
- perf annotate: Get rid of duplicate --group option item
  (git-fixes).
- perf probe: Add missing libgen.h header needed for using
  basename() (git-fixes).
- perf record: Delete session after stopping sideband thread
  (git-fixes).
- perf auxtrace: Fix multiple use of --itrace option (git-fixes).
- perf script: Show also errors for --insn-trace option
  (git-fixes).
- perf lock contention: Add a missing NULL check (git-fixes).
- perf vendor events amd: Fix Zen 4 cache latency events
  (git-fixes).
- libperf evlist: Avoid out-of-bounds access (git-fixes).
- perf pmu: Fix a potential memory leak in perf_pmu__lookup()
  (git-fixes).
- perf print-events: make is_event_supported() more robust
  (git-fixes).
- perf list: fix short description for some cache events
  (git-fixes).
- perf metric: Don't remove scale from counts (git-fixes).
- perf stat: Avoid metric-only segv (git-fixes).
- perf expr: Fix "has_event" function for metric style events
  (git-fixes).
- perf srcline: Add missed addr2line closes (git-fixes).
- perf thread_map: Free strlist on normal path in
  thread_map__new_by_tid_str() (git-fixes).
- perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
- perf jevents: Drop or simplify small integer values (git-fixes).
- perf evsel: Fix duplicate initialization of data-&gt;id in
  evsel__parse_sample() (git-fixes).
- perf pmu: Treat the msr pmu as software (git-fixes).
- perf record: Check conflict between '--timestamp-filename'
  option and pipe mode before recording (git-fixes).
- perf record: Fix possible incorrect free in
  record__switch_output() (git-fixes).
- perf vendor events amd: Add Zen 4 memory controller events
  (git-fixes).
- perf top: Uniform the event name for the hybrid machine
  (git-fixes).
- perf top: Use evsel's cpus to replace user_requested_cpus
  (git-fixes).
- commit a1f9340</changelog>
  <changelog author="tonyj@suse.de" date="1717675200">- perf ui browser: Avoid SEGV on title (git fixes).
- commit 1578c22</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675201">- inet: inet_defrag: prevent sk release while still in use
  (CVE-2024-26921 bsc#1223138).
- commit 2016faf</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675202">- net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
- commit 7bf5961</changelog>
  <changelog author="tiwai@suse.de" date="1718366400">- Temporarily drop KVM patch that caused a regression (bsc#1226158)
  Delete patches.suse/KVM-x86-pmu-Prioritize-VMX-interception-over-GP-on-R.patch
- commit 33f31da</changelog>
</package>
<package pkgid="febe09ae98593641b64ef0547324db0ce0a5243988ee86656c1920d2cf8046d4" name="dtb-arm" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.14.1"/>
  <changelog author="tiwai@suse.de" date="1719662400">- gpiolib: cdev: Disallow reconfiguration without direction
  (uAPI v1) (git-fixes).
- gpio: davinci: Validate the obtained number of IRQs (git-fixes).
- commit 919ebd1</changelog>
  <changelog author="tiwai@suse.de" date="1719748800">- i2c: testunit: discard write requests while old command is
  running (git-fixes).
- i2c: testunit: don't erase registers after STOP (git-fixes).
- mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
  (git-fixes).
- mmc: sdhci: Do not invert write-protect twice (git-fixes).
- mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
  (git-fixes).
- mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
  (git-fixes).
- commit 448487d</changelog>
  <changelog author="tiwai@suse.de" date="1719748801">- crypto: iaa - Account for cpu-less numa nodes (bsc#1227190).
- commit cd600aa</changelog>
  <changelog author="tiwai@suse.de" date="1719748802">- crypto: deflate - Add aliases to deflate (bsc#1227190).
- commit 27ffd92</changelog>
  <changelog author="tiwai@suse.de" date="1719835200">- ata: ahci: Clean up sysfs file on error (git-fixes).
- ata: libata-core: Fix double free on error (git-fixes).
- ata,scsi: libata-core: Do not leak memory for ata_port struct
  members (git-fixes).
- ata: libata-core: Fix null pointer dereference on error
  (git-fixes).
- kbuild: Fix build target deb-pkg: ln: failed to create hard link
  (git-fixes).
- kbuild: doc: Update default INSTALL_MOD_DIR from extra to
  updates (git-fixes).
- kbuild: Install dtb files as 0644 in Makefile.dtbinst
  (git-fixes).
- counter: ti-eqep: enable clock at probe (git-fixes).
- iio: chemical: bme680: Fix sensor data read operation
  (git-fixes).
- iio: chemical: bme680: Fix overflows in compensate() functions
  (git-fixes).
- iio: chemical: bme680: Fix calibration data variable
  (git-fixes).
- iio: chemical: bme680: Fix pressure value output (git-fixes).
- iio: accel: fxls8962af: select IIO_BUFFER &amp; IIO_KFIFO_BUF
  (git-fixes).
- iio: adc: ad7266: Fix variable checking bug (git-fixes).
- iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
  (git-fixes).
- serial: bcm63xx-uart: fix tx after conversion to
  uart_port_tx_limited() (git-fixes).
- serial: core: introduce uart_port_tx_limited_flags()
  (git-fixes).
- Revert "serial: core: only stop transmit when HW fifo is empty"
  (git-fixes).
- tty: mcf: MCF54418 has 10 UARTS (git-fixes).
- usb: gadget: aspeed_udc: fix device address configuration
  (git-fixes).
- usb: dwc3: core: remove lock of otg mode during gadget
  suspend/resume to avoid deadlock (git-fixes).
- usb: typec: ucsi: glink: fix child node release in probe
  function (git-fixes).
- usb: musb: da8xx: fix a resource leak in probe() (git-fixes).
- usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  (git-fixes).
- usb: gadget: printer: fix races against disable (git-fixes).
- PCI/MSI: Fix UAF in msi_capability_init (git-fixes).
- commit a2ea5a9</changelog>
  <changelog author="ptesarik@suse.com" date="1719835201">- net: ena: Fix redundant device NUMA node override
  (jsc#PED-8688).
- commit 6ad6684</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835202">- tcp: do not accept ACK of bytes we never sent (CVE-2023-52881
  bsc#1225611).
- commit 16404a6</changelog>
  <changelog author="mhocko@suse.com" date="1719835203">- Update
  patches.suse/1352-drm-amdgpu-Fix-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52883
  bsc#1226630).
- Update
  patches.suse/9p-add-missing-locking-around-taking-dentry-fid-list.patch
  (git-fixes CVE-2024-39463 bsc#1227090).
- Update
  patches.suse/ALSA-Fix-deadlocks-with-kctl-removals-at-disconnecti.patch
  (stable-fixes CVE-2024-38600 bsc#1226864).
- Update
  patches.suse/ALSA-core-Fix-NULL-module-pointer-assignment-at-card.patch
  (git-fixes CVE-2024-38605 bsc#1226740).
- Update
  patches.suse/ALSA-hda-Fix-possible-null-ptr-deref-when-assigning-.patch
  (git-fixes CVE-2023-52806 bsc#1225554).
- Update
  patches.suse/ALSA-hda-cs_dsp_ctl-Use-private_free-for-control-cle.patch
  (git-fixes CVE-2024-38388 bsc#1226890).
- Update
  patches.suse/ALSA-timer-Set-lower-bound-of-start-tick-time.patch
  (stable-fixes git-fixes CVE-2024-38618 bsc#1226754).
- Update
  patches.suse/ASoC-kirkwood-Fix-potential-NULL-dereference.patch
  (git-fixes CVE-2024-38550 bsc#1226633).
- Update
  patches.suse/ASoC-mediatek-Assign-dummy-when-codec-not-specified-.patch
  (git-fixes CVE-2024-38551 bsc#1226761).
- Update
  patches.suse/Bluetooth-btusb-Add-date-evt_skb-is-NULL-check.patch
  (git-fixes CVE-2023-52833 bsc#1225595).
- Update
  patches.suse/Bluetooth-hci_core-Fix-possible-buffer-overflow.patch
  (git-fixes CVE-2024-26889).
- Update
  patches.suse/HID-uclogic-Fix-user-memory-access-bug-in-uclogic_pa.patch
  (git-fixes CVE-2023-52866 bsc#1225120).
- Update
  patches.suse/IB-mlx5-Fix-init-stage-error-handling-to-avoid-doubl.patch
  (jsc#PED-6864 CVE-2023-52851 bsc#1225587).
- Update
  patches.suse/Input-cyapa-add-missing-input-core-locking-to-suspen.patch
  (git-fixes CVE-2023-52884 bsc#1226764).
- Update
  patches.suse/Input-synaptics-rmi4-fix-use-after-free-in-rmi_unreg.patch
  (git-fixes CVE-2023-52840 bsc#1224928).
- Update
  patches.suse/KEYS-trusted-Do-not-use-WARN-when-encode-fails.patch
  (git-fixes CVE-2024-36975 bsc#1226520).
- Update
  patches.suse/KEYS-trusted-Fix-memory-leak-in-tpm2_key_encode.patch
  (git-fixes CVE-2024-36967 bsc#1226131).
- Update
  patches.suse/RDMA-cma-Fix-kmemleak-in-rdma_core-observed-during-b.patch
  (git-fixes CVE-2024-38539 bsc#1226608).
- Update patches.suse/RDMA-hns-Fix-UAF-for-cq-async-event.patch
  (git-fixes CVE-2024-38545 bsc#1226595).
- Update
  patches.suse/RDMA-hns-Fix-deadlock-on-SRQ-async-events.patch
  (git-fixes CVE-2024-38591 bsc#1226738).
- Update
  patches.suse/RDMA-hns-Modify-the-print-level-of-CQE-error.patch
  (git-fixes CVE-2024-38590 bsc#1226839).
- Update
  patches.suse/RDMA-rxe-Fix-seg-fault-in-rxe_comp_queue_pkt.patch
  (git-fixes CVE-2024-38544 bsc#1226597).
- Update
  patches.suse/SUNRPC-Fix-RPC-client-cleaned-up-the-freed-pipefs-de.patch
  (git-fixes CVE-2023-52803 bsc#1225008).
- Update patches.suse/af_unix-Clear-stale-u-oob_skb.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-35970 bsc#1224584).
- Update
  patches.suse/af_unix-Drop-oob_skb-ref-before-purging-queue-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26750 bsc#1222617).
- Update
  patches.suse/af_unix-Fix-task-hung-while-purging-oob_skb-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26780 bsc#1222588).
- Update
  patches.suse/af_unix-Update-unix_sk-sk-oob_skb-under-sk_receive_queue-lock.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-36972 bsc#1226163).
- Update
  patches.suse/arm64-Restrict-CPU_BIG_ENDIAN-to-GNU-as-or-LLVM-IAS-.patch
  (git-fixes CVE-2023-52750 bsc#1225485).
- Update
  patches.suse/atl1c-Work-around-the-DMA-RX-overflow-issue.patch
  (git-fixes CVE-2023-52834 bsc#1225599).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issue-of-net_device.patch
  (git-fixes CVE-2024-38554 bsc#1226742).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issues-of-ax25_dev.patch
  (git-fixes CVE-2024-38602 bsc#1226613).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-reorder-of-WRITE-lqueued.patch
  (bsc#1225605 CVE-2024-38384 bsc#1226938).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-resetting-io-stat.patch
  (bsc#1225605 CVE-2024-38663 bsc#1226939).
- Update
  patches.suse/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch
  (git-fixes CVE-2024-38540 bsc#1226582).
- Update
  patches.suse/bonding-stop-the-device-in-bond_setup_by_slave.patch
  (git-fixes CVE-2023-52784 bsc#1224946).
- Update
  patches.suse/can-dev-can_put_echo_skb-don-t-crash-kernel-if-can_p.patch
  (git-fixes CVE-2023-52878 bsc#1225000).
- Update
  patches.suse/clk-mediatek-clk-mt2701-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52875 bsc#1225096).
- Update
  patches.suse/clk-mediatek-clk-mt6765-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52870 bsc#1224937).
- Update
  patches.suse/clk-mediatek-clk-mt6779-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52873 bsc#1225589).
- Update
  patches.suse/clk-mediatek-clk-mt6797-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52865 bsc#1225086).
- Update
  patches.suse/clk-mediatek-clk-mt7629-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52858 bsc#1225566).
- Update
  patches.suse/clk-mediatek-clk-mt7629-eth-Add-check-for-mtk_alloc_.patch
  (git-fixes CVE-2023-52876 bsc#1225036).
- Update
  patches.suse/cppc_cpufreq-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38573 bsc#1226739).
- Update patches.suse/cpufreq-exit-callback-is-optional.patch
  (git-fixes CVE-2024-38615 bsc#1226592).
- Update patches.suse/crypto-bcm-Fix-pointer-arithmetic.patch
  (git-fixes CVE-2024-38579 bsc#1226637).
- Update
  patches.suse/crypto-pcrypt-Fix-hungtask-for-PADATA_RESET.patch
  (git-fixes CVE-2023-52813 bsc#1225527).
- Update patches.suse/cxl-mem-Fix-shutdown-order.patch (git-fixes
  CVE-2023-52849 bsc#1224949).
- Update
  patches.suse/cxl-region-Do-not-try-to-cleanup-after-cxl_region_se.patch
  (git-fixes CVE-2023-52792 bsc#1225477).
- Update patches.suse/cxl-region-Fix-cxlr_pmem-leaks.patch
  (git-fixes CVE-2024-38391 bsc#1226894).
- Update
  patches.suse/dma-buf-sw-sync-don-t-enable-IRQ-from-sync_print_obj.patch
  (git-fixes CVE-2024-38780 bsc#1226886).
- Update
  patches.suse/dma-mapping-benchmark-fix-node-id-validation.patch
  (git-fixes CVE-2024-34777 bsc#1226796).
- Update
  patches.suse/dma-mapping-benchmark-handle-NUMA_NO_NODE-correctly.patch
  (git-fixes CVE-2024-39277 bsc#1226909).
- Update
  patches.suse/dmaengine-idxd-Avoid-unnecessary-destruction-of-file.patch
  (git-fixes CVE-2024-38629 bsc#1226905).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Pola.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52819
  bsc#1225532).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-SMU7.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52818
  bsc#1225530).
- Update
  patches.suse/drm-amd-check-num-of-link-levels-when-update-pcie-pa.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52812
  bsc#1225564).
- Update
  patches.suse/drm-amd-display-Avoid-NULL-dereference-of-timing-gen.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52753
  bsc#1225478).
- Update
  patches.suse/drm-amd-display-Fix-division-by-zero-in-setup_dsc_co.patch
  (stable-fixes CVE-2024-36969 bsc#1226155).
- Update
  patches.suse/drm-amd-display-Fix-null-pointer-dereference-in-erro.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52862
  bsc#1225015).
- Update
  patches.suse/drm-amd-display-Fix-potential-index-out-of-bounds-in.patch
  (git-fixes CVE-2024-38552 bsc#1226767).
- Update
  patches.suse/drm-amd-display-fix-a-NULL-pointer-dereference-in-am.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52773
  bsc#1225041).
- Update
  patches.suse/drm-amd-display-fixed-integer-types-and-null-check-l.patch
  (git-fixes CVE-2024-26767).
- Update
  patches.suse/drm-amdgpu-Fix-a-null-pointer-access-when-the-smc_rr.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52817
  bsc#1225569).
- Update
  patches.suse/drm-amdgpu-Fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch
  (git-fixes CVE-2024-39291 bsc#1226934).
- Update
  patches.suse/drm-amdgpu-Fix-potential-null-pointer-derefernce.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52814
  bsc#1225565).
- Update
  patches.suse/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch
  (stable-fixes CVE-2024-39471 bsc#1227096).
- Update
  patches.suse/drm-amdgpu-mes-fix-use-after-free-issue.patch
  (stable-fixes CVE-2024-38581 bsc#1226657).
- Update
  patches.suse/drm-amdgpu-vkms-fix-a-possible-null-pointer-derefere.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52815
  bsc#1225568).
- Update
  patches.suse/drm-amdkfd-Fix-a-race-condition-of-vram-buffer-unref.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52825
  bsc#1225076).
- Update
  patches.suse/drm-amdkfd-Fix-shift-out-of-bounds-issue.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52816
  bsc#1225529).
- Update
  patches.suse/drm-bridge-cdns-mhdp8546-Fix-possible-null-pointer-d.patch
  (git-fixes CVE-2024-38548).
- Update
  patches.suse/drm-bridge-it66121-Fix-invalid-connector-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52861
  bsc#1224941).
- Update
  patches.suse/drm-bridge-lt8912b-Fix-crash-on-bridge-detach.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52856
  bsc#1224932).
- Update
  patches.suse/drm-mediatek-Add-0-size-check-to-mtk_drm_gem_obj.patch
  (git-fixes CVE-2024-38549 bsc#1226735).
- Update
  patches.suse/drm-mediatek-Fix-coverity-issue-with-unintentional-i.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52857
  bsc#1225581).
- Update
  patches.suse/drm-mediatek-Init-ddp_comp-with-devm_kcalloc.patch
  (git-fixes CVE-2024-38592 bsc#1226844).
- Update
  patches.suse/drm-msm-a6xx-Avoid-a-nullptr-dereference-when-speedb.patch
  (git-fixes CVE-2024-38390 bsc#1226891).
- Update
  patches.suse/drm-msm-dpu-Add-callback-function-pointer-check-befo.patch
  (git-fixes CVE-2024-38622 bsc#1226856).
- Update
  patches.suse/drm-panel-fix-a-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52821
  bsc#1225022).
- Update
  patches.suse/drm-panel-panel-tpo-tpg110-fix-a-possible-null-point.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52826
  bsc#1225077).
- Update patches.suse/drm-radeon-possible-buffer-overflow.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52867
  bsc#1225009).
- Update
  patches.suse/drm-vc4-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38546 bsc#1226593).
- Update
  patches.suse/drm-vmwgfx-Fix-invalid-reads-in-fence-signaled-event.patch
  (git-fixes CVE-2024-36960 bsc#1225872).
- Update
  patches.suse/drm-zynqmp_dpsub-Always-register-bridge.patch
  (git-fixes CVE-2024-38664 bsc#1226941).
- Update
  patches.suse/e1000e-change-usleep_range-to-udelay-in-PHY-mdic-acc.patch
  (CVE-2024-39296 bsc#1226989 CVE-2024-36887 bsc#1225731).
- Update
  patches.suse/ecryptfs-Fix-buffer-size-for-tag-66-packet.patch
  (git-fixes CVE-2024-38578 bsc#1226634).
- Update
  patches.suse/efi-libstub-only-free-priv.runtime_map-when-allocate.patch
  (git-fixes CVE-2024-33619 bsc#1226768).
- Update
  patches.suse/fbdev-imsttfb-fix-a-resource-leak-in-probe.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52838
  bsc#1225031).
- Update
  patches.suse/fs-9p-only-translate-RWX-permissions-for-plain-9P200.patch
  (git-fixes CVE-2024-36964 bsc#1225866).
- Update
  patches.suse/fs-jfs-Add-check-for-negative-db_l2nbperpage.patch
  (git-fixes CVE-2023-52810 bsc#1225557).
- Update
  patches.suse/fs-jfs-Add-validity-check-for-db_maxag-and-db_agpref.patch
  (git-fixes CVE-2023-52804 bsc#1225550).
- Update
  patches.suse/ftrace-Fix-possible-use-after-free-issue-in-ftrace_location.patch
  (git-fixes CVE-2024-38588 bsc#1226837).
- Update
  patches.suse/genirq-irqdesc-Prevent-use-after-free-in-irq_find_at.patch
  (git-fixes CVE-2024-38385 bsc#1227085).
- Update patches.suse/gfs2-ignore-negated-quota-changes.patch
  (git-fixes CVE-2023-52759 bsc#1225560).
- Update
  patches.suse/hid-cp2112-Fix-duplicate-workqueue-initialization.patch
  (git-fixes CVE-2023-52853 bsc#1224988).
- Update
  patches.suse/hwmon-axi-fan-control-Fix-possible-NULL-pointer-dere.patch
  (git-fixes CVE-2023-52863 bsc#1225586).
- Update
  patches.suse/i2c-acpi-Unbind-mux-adapters-before-delete.patch
  (git-fixes CVE-2024-39362 bsc#1226995).
- Update
  patches.suse/i2c-core-Run-atomic-i2c-xfer-when-preemptible.patch
  (git-fixes CVE-2023-52791 bsc#1225108).
- Update
  patches.suse/i3c-master-mipi-i3c-hci-Fix-a-kernel-panic-for-acces.patch
  (git-fixes CVE-2023-52763 bsc#1225570).
- Update
  patches.suse/i3c-mipi-i3c-hci-Fix-out-of-bounds-access-in-hci_dma.patch
  (git-fixes CVE-2023-52766).
- Update
  patches.suse/i915-perf-Fix-NULL-deref-bugs-with-drm_dbg-calls.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52788
  bsc#1225106).
- Update
  patches.suse/igb-Fix-string-truncation-warnings-in-igb_set_fw_ver.patch
  (git-fixes CVE-2024-36010 bsc#1225594).
- Update
  patches.suse/iommu-vt-d-Fix-WARN_ON-in-iommu-probe-path.patch
  (git-fixes CVE-2024-35957 bsc#1224673).
- Update
  patches.suse/iommufd-Fix-missing-update-of-domains_itree-after-splitting-iopt
  (jsc#PED-7779 jsc#PED-7780 CVE-2023-52801 bsc#1225006).
- Update
  patches.suse/ipvlan-add-ipvlan_route_v6_outbound-helper.patch
  (git-fixes CVE-2023-52796 bsc#1224930).
- Update
  patches.suse/jffs2-prevent-xattr-node-from-overflowing-the-eraseblock.patch
  (git-fixes CVE-2024-38599 bsc#1226848).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-dbFindLeaf.patch
  (git-fixes CVE-2023-52799 bsc#1225472).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-diAlloc.patch
  (git-fixes CVE-2023-52805 bsc#1225553).
- Update
  patches.suse/kunit-fortify-Fix-mismatched-kvalloc-vfree-usage.patch
  (git-fixes CVE-2024-38617 bsc#1226859).
- Update
  patches.suse/lib-generic-radix-tree.c-Don-t-overflow-in-peek.patch
  (git-fixes CVE-2021-47432 bsc#1225391).
- Update
  patches.suse/lib-test_hmm.c-handle-src_pfns-and-dst_pfns-allocati.patch
  (git-fixes CVE-2024-38543 bsc#1226594).
- Update
  patches.suse/locking-ww_mutex-test-Fix-potential-workqueue-corrup.patch
  (bsc#1219953 CVE-2023-52836 bsc#1225609).
- Update
  patches.suse/md-Don-t-ignore-suspended-array-in-md_check_recovery-1baa.patch
  (bsc#1219596 CVE-2024-26758).
- Update
  patches.suse/media-atomisp-ssh_css-Fix-a-null-pointer-dereference.patch
  (git-fixes CVE-2024-38547 bsc#1226632).
- Update
  patches.suse/media-bttv-fix-use-after-free-error-due-to-btv-timeo.patch
  (git-fixes CVE-2023-52847 bsc#1225588).
- Update
  patches.suse/media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch
  (git-fixes CVE-2023-52764 bsc#1225571).
- Update
  patches.suse/media-hantro-Check-whether-reset-op-is-defined-befor.patch
  (git-fixes CVE-2023-52850 bsc#1225014).
- Update
  patches.suse/media-i2c-et8ek8-Don-t-strip-remove-function-when-dr.patch
  (git-fixes CVE-2024-38611 bsc#1226760).
- Update
  patches.suse/media-imon-fix-access-to-invalid-resource-for-the-se.patch
  (git-fixes CVE-2023-52754 bsc#1225490).
- Update
  patches.suse/media-lgdt3306a-Add-a-check-against-null-pointer-def.patch
  (stable-fixes CVE-2022-48772 bsc#1226976).
- Update
  patches.suse/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch
  (git-fixes CVE-2024-38621 bsc#1226895).
- Update
  patches.suse/media-vidtv-mux-Add-check-and-kfree-for-kstrdup.patch
  (git-fixes CVE-2023-52841 bsc#1225592).
- Update patches.suse/media-vidtv-psi-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52844 bsc#1225590).
- Update
  patches.suse/mfd-qcom-spmi-pmic-Fix-revid-implementation.patch
  (git-fixes CVE-2023-52765 bsc#1225029).
- Update
  patches.suse/misc-microchip-pci1xxxx-fix-double-free-in-the-error.patch
  (git-fixes CVE-2024-36973 bsc#1226457).
- Update
  patches.suse/net-hns3-fix-out-of-bounds-access-may-occur-when-coa.patch
  (git-fixes CVE-2023-52807 bsc#1225097).
- Update
  patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch
  (git-fixes CVE-2024-36962 bsc#1225827).
- Update
  patches.suse/net-mlx5-Fix-peer-devlink-set-for-SF-representor-dev.patch
  (git-fixes CVE-2024-38595 bsc#1226741).
- Update
  patches.suse/net-mlx5e-Track-xmit-submission-to-PTP-WQ-after-popu.patch
  (jsc#PED-3311 CVE-2023-52782 bsc#1225103).
- Update
  patches.suse/net-mvneta-fix-calls-to-page_pool_get_stats.patch
  (git-fixes CVE-2023-52780 bsc#1224933).
- Update
  patches.suse/net-wangxun-fix-kernel-panic-due-to-null-pointer.patch
  (git-fixes CVE-2023-52783 bsc#1225104).
- Update
  patches.suse/netfilter-complete-validation-of-user-input.patch
  (git-fixes CVE-2024-35896 bsc#1224662 CVE-2024-35962
  bsc#1224583).
- Update
  patches.suse/nfc-nci-Fix-uninit-value-in-nci_rx_work.patch
  (git-fixes CVE-2024-38381 bsc#1226878).
- Update
  patches.suse/nilfs2-fix-nilfs_empty_dir-misjudgment-and-long-loop.patch
  (git-fixes CVE-2024-39469 bsc#1226992).
- Update
  patches.suse/nilfs2-fix-potential-hang-in-nilfs_detach_log_writer.patch
  (git-fixes CVE-2024-38582 bsc#1226658).
- Update
  patches.suse/nilfs2-fix-use-after-free-of-timer-for-log-writer-th.patch
  (git-fixes CVE-2024-38583 bsc#1226777).
- Update
  patches.suse/of-module-add-buffer-overflow-check-in-of_modalias.patch
  (git-fixes CVE-2024-38541 bsc#1226587).
- Update
  patches.suse/padata-Fix-refcnt-handling-in-padata_free_shell.patch
  (git-fixes CVE-2023-52854 bsc#1225584).
- Update
  patches.suse/perf-core-Bail-out-early-if-the-request-AUX-area-is-out-of-bound.patch
  (git-fixes CVE-2023-52835 bsc#1225602).
- Update
  patches.suse/platform-x86-wmi-Fix-opening-of-char-device.patch
  (git-fixes CVE-2023-52864 bsc#1225132).
- Update
  patches.suse/powerpc-pseries-iommu-LPAR-panics-during-boot-up-wit.patch
  (bsc#1222011 ltc#205900 CVE-2024-36926 bsc#1225829).
- Update patches.suse/pstore-platform-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52869 bsc#1225050).
- Update
  patches.suse/remoteproc-mediatek-Make-sure-IPI-buffer-fits-in-L2T.patch
  (git-fixes CVE-2024-36965 bsc#1226149).
- Update
  patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch
  (git-fixes CVE-2024-38601 bsc#1226876).
- Update
  patches.suse/s390-dasd-protect-device-queue-against-concurrent-access.patch
  (git-fixes bsc#1217481 CVE-2023-52774 bsc#1225572).
- Update
  patches.suse/scsi-hisi_sas-Set-debugfs_dir-pointer-to-NULL-after-removing-debugfs.patch
  (git-fixes CVE-2023-52808 bsc#1225555).
- Update
  patches.suse/scsi-ibmvfc-Remove-BUG_ON-in-the-case-of-an-empty-ev.patch
  (bsc#1209834 ltc#202097 CVE-2023-52811 bsc#1225559).
- Update
  patches.suse/scsi-libfc-Fix-potential-NULL-pointer-dereference-in-fc_lport_ptp_setup.patch
  (git-fixes CVE-2023-52809 bsc#1225556).
- Update
  patches.suse/scsi-lpfc-Move-NPIV-s-transport-unregistration-to-af.patch
  (bsc#1221777 CVE-2024-36952 bsc#1225898).
- Update
  patches.suse/scsi-lpfc-Release-hbalock-before-calling-lpfc_worker.patch
  (bsc#1221777 CVE-2024-36924 bsc#1225820).
- Update
  patches.suse/serial-max3100-Lock-port-lock-when-calling-uart_hand.patch
  (git-fixes CVE-2024-38634 bsc#1226868).
- Update
  patches.suse/serial-max3100-Update-uart_driver_registered-on-driv.patch
  (git-fixes CVE-2024-38633 bsc#1226867).
- Update
  patches.suse/soc-qcom-llcc-Handle-a-second-device-without-data-co.patch
  (git-fixes CVE-2023-52871 bsc#1225534).
- Update
  patches.suse/soundwire-cadence-fix-invalid-PDI-offset.patch
  (stable-fixes CVE-2024-38635 bsc#1226863).
- Update patches.suse/speakup-Fix-sizeof-vs-ARRAY_SIZE-bug.patch
  (git-fixes CVE-2024-38587 bsc#1226780).
- Update patches.suse/spi-Fix-null-dereference-on-suspend.patch
  (git-fixes CVE-2023-52749 bsc#1225476).
- Update
  patches.suse/thermal-core-prevent-potential-string-overflow.patch
  (git-fixes CVE-2023-52868 bsc#1225044).
- Update
  patches.suse/thermal-drivers-qcom-lmh-Check-for-SCM-availability-.patch
  (git-fixes CVE-2024-39466 bsc#1227089).
- Update
  patches.suse/thermal-drivers-tsens-Fix-null-pointer-dereference.patch
  (git-fixes CVE-2024-38571 bsc#1226737).
- Update
  patches.suse/thermal-intel-powerclamp-fix-mismatch-in-get-functio.patch
  (git-fixes CVE-2023-52794 bsc#1225028).
- Update
  patches.suse/tls-fix-NULL-deref-on-tls_sw_splice_eof-with-empty-r.patch
  (jsc#PED-6831 CVE-2023-52767 bsc#1224998).
- Update
  patches.suse/tpm_tis_spi-Account-for-SPI-header-when-allocating-T.patch
  (git-fixes CVE-2024-36477 bsc#1226840).
- Update
  patches.suse/tracing-Have-trace_event_file-have-ref-counters.patch
  (git-fixes CVE-2023-52879 bsc#1225101).
- Update
  patches.suse/tracing-trigger-Fix-to-return-error-if-failed-to-alloc-snapshot.patch
  (git-fixes CVE-2024-26920).
- Update
  patches.suse/tty-n_gsm-fix-race-condition-in-status-line-change-o.patch
  (git-fixes CVE-2023-52872 bsc#1225591).
- Update
  patches.suse/tty-n_gsm-require-CAP_NET_ADMIN-to-attach-N_GSM0710-.patch
  (bsc#1222619 CVE-2023-52880).
- Update
  patches.suse/tty-vcc-Add-check-for-kstrdup-in-vcc_probe.patch
  (git-fixes CVE-2023-52789 bsc#1225180).
- Update
  patches.suse/usb-config-fix-iteration-issue-in-usb_get_bos_descri.patch
  (git-fixes CVE-2023-52781 bsc#1225092).
- Update
  patches.suse/usb-dwc3-Wait-unconditionally-after-issuing-EndXfer-.patch
  (git-fixes CVE-2024-36977 bsc#1226513).
- Update
  patches.suse/usb-gadget-u_audio-Fix-race-condition-use-of-control.patch
  (git-fixes CVE-2024-38628 bsc#1226911).
- Update
  patches.suse/usb-storage-alauda-Check-whether-the-media-is-initia.patch
  (git-fixes CVE-2024-38619 bsc#1226861).
- Update
  patches.suse/usb-typec-tcpm-Fix-NULL-pointer-dereference-in-tcpm_.patch
  (git-fixes CVE-2023-52877 bsc#1224944).
- Update
  patches.suse/vhost-vdpa-fix-use-after-free-in-vhost_vdpa_probe.patch
  (jsc#PED-3311 CVE-2023-52795 bsc#1225085).
- Update
  patches.suse/virtio-blk-fix-implicit-overflow-on-virtio_max_dma_s.patch
  (git-fixes CVE-2023-52762 bsc#1225573).
- Update
  patches.suse/virtio-vsock-Fix-uninit-value-in-virtio_transport_re.patch
  (jsc#PED-5505 CVE-2023-52842 bsc#1225025).
- Update
  patches.suse/watchdog-cpu5wdt.c-Fix-use-after-free-bug-caused-by-.patch
  (git-fixes CVE-2024-38630 bsc#1226908).
- Update
  patches.suse/wifi-ar5523-enable-proper-endpoint-verification.patch
  (git-fixes CVE-2024-38565 bsc#1226747).
- Update
  patches.suse/wifi-ath11k-fix-dfs-radar-event-locking.patch
  (git-fixes CVE-2023-52798 bsc#1224947).
- Update
  patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch
  (git-fixes CVE-2023-52777 bsc#1224992).
- Update patches.suse/wifi-ath11k-fix-htt-pktlog-locking.patch
  (git-fixes CVE-2023-52800).
- Update
  patches.suse/wifi-ath12k-fix-dfs-radar-and-temperature-event-lock.patch
  (git-fixes CVE-2023-52776 bsc#1225090).
- Update
  patches.suse/wifi-ath12k-fix-htt-mlo-offset-event-locking.patch
  (git-fixes CVE-2023-52769 bsc#1225001).
- Update
  patches.suse/wifi-ath12k-fix-out-of-bound-access-of-qmi_invoke_ha.patch
  (git-fixes CVE-2024-38572 bsc#1226776).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-read-in-ath12k.patch
  (git-fixes CVE-2023-52827 bsc#1225078).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-write-in-ath12.patch
  (git-fixes CVE-2023-52829 bsc#1225081).
- Update
  patches.suse/wifi-brcmfmac-pcie-handle-randbuf-allocation-failure.patch
  (git-fixes CVE-2024-38575 bsc#1226612).
- Update
  patches.suse/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch
  (git-fixes CVE-2024-38567 bsc#1226769).
- Update
  patches.suse/wifi-carl9170-re-fix-fortified-memset-warning.patch
  (git-fixes CVE-2024-38616 bsc#1226852).
- Update
  patches.suse/wifi-mac80211-don-t-return-unset-power-in-ieee80211_.patch
  (git-fixes CVE-2023-52832 bsc#1225577).
- Update
  patches.suse/wifi-nl80211-Avoid-address-calculations-via-out-of-b.patch
  (git-fixes CVE-2024-38562 bsc#1226788).
- Update
  patches.suse/wifi-wilc1000-use-vmm_table-as-array-in-wilc-struct.patch
  (git-fixes CVE-2023-52768 bsc#1225004).
- Update
  patches.suse/x86-tdx-Zero-out-the-missing-RSI-in-TDX_HYPERCALL-macro.patch
  (jsc#PED-5824 CVE-2023-52874 bsc#1225049).
- commit 33efdc4</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835204">- tcp: Use refcount_inc_not_zero() in tcp_twsk_unique()
  (CVE-2024-36904 bsc#1225732).
- commit d578dcc</changelog>
  <changelog author="heming.zhao@suse.com" date="1719921600">- gfs2: Fix potential glock use-after-free on unmount (bsc#1226775
  CVE-2024-38570).
- gfs2: Rename sd_{ glock =&gt; kill }_wait (bsc#1226775
  CVE-2024-38570).
- commit f3adbca</changelog>
  <changelog author="tiwai@suse.de" date="1719921601">- Correct SCSI patch references (bsc#1225767 CVE-2024-36919 bsc#1226785 CVE-2024-38559)
- commit e8ea587</changelog>
  <changelog author="tiwai@suse.de" date="1719921602">- mtd: rawnand: rockchip: ensure NVDDR timings are rejected
  (git-fixes).
- mtd: rawnand: Bypass a couple of sanity checks during NAND
  identification (git-fixes).
- mtd: rawnand: Fix the nand_read_data_op() early check
  (git-fixes).
- mtd: rawnand: Ensure ECC configuration is propagated to upper
  layers (git-fixes).
- commit e545951</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1719921603">- kernel-doc: fix struct_group_tagged() parsing (git-fixes).
- commit e3a2a2e</changelog>
  <changelog author="fdmanana@suse.com" date="1719921604">- btrfs: fix crash on racing fsync and size-extending write into
  prealloc (bsc#1227101 CVE-2024-37354).
- commit 1d355af</changelog>
  <changelog author="vbabka@suse.cz" date="1719921605">- virt: acrn: stop using follow_pfn (CVE-2024-38610 bsc#1226758).
- commit c2ea51b</changelog>
  <changelog author="vbabka@suse.cz" date="1719921606">- drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
  (CVE-2024-38610 bsc#1226758).
- commit 7069ac2</changelog>
  <changelog author="rhopkins@suse.de" date="1719921607">- hsr: Prevent use after free in prp_create_tagged_frame()
  (CVE-2023-52846 bsc#1225098).
- commit cf63988</changelog>
  <changelog author="krisman@suse.de" date="1719921608">- io_uring: Fix io_cqring_wait() not restoring sigmask on
  get_timespec64() failure (git-fixes).
- commit e640a65</changelog>
  <changelog author="krisman@suse.de" date="1719921609">- io_uring: check for non-NULL file pointer in io_file_can_poll()
  (bsc#1226990 CVE-2024-39371).
- io_uring/io-wq: Use set_bit() and test_bit() at worker-&gt;flags
  (git-fixes).
- io_uring/sqpoll: work around a potential audit memory leak
  (git-fixes).
- commit 24603fc</changelog>
  <changelog author="krisman@suse.de" date="1719921610">- io_uring/rsrc: fix incorrect assignment of iter-&gt;nr_segs in
  io_import_fixed (git-fixes).
- io_uring/rsrc: don't lock while !TASK_RUNNING (git-fixes).
- io_uring/io-wq: avoid garbage value of 'match' in
  io_wq_enqueue() (git-fixes).
- commit 7d3e252</changelog>
</package>
<package pkgid="a9dea316df768b0f4ece14afe9ce162b6622347a22780d932654709c302ab147" name="dtb-arm" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.17.1"/>
  <changelog author="tiwai@suse.de" date="1722081600">- auxdisplay: ht16k33: Drop reference after LED registration
  (git-fixes).
- ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
  on unprepare (git-fixes).
- ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
- ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
  reachable (git-fixes).
- ASoC: sof: amd: fix for firmware reload failure in Vangogh
  platform (git-fixes).
- ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
- ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
  (git-fixes).
- ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
- ALSA: ump: Don't update FB name for static blocks (git-fixes).
- drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
- drm/i915/gt: Do not consider preemption during execlists_dequeue
  for gen8 (git-fixes).
- drm/i915/dp: Don't switch the LTTPR mode on an active link
  (git-fixes).
- commit d7e2deb</changelog>
  <changelog author="tiwai@suse.de" date="1722081601">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
</package>
<package pkgid="ac156b00743f2c9f84da0fdb1bd0d79639a2512dc87f58b58a0e170edad96e89" name="dtb-arm" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.7.1"/>
  <changelog author="mkubecek@suse.cz" date="1717416000">- netfilter: nf_tables: release mutex after nft_gc_seq_end from
  abort path (CVE-2024-26925 bsc#1223390).
- commit 578a709</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717416001">- Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
  The L3 bsc#1225765 was created seperately since our customer requires
  PTF.
- Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
- Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
- Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
- Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
- commit 054635e</changelog>
  <changelog author="msuchanek@suse.de" date="1717416002">- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
- powerpc/uaccess: Fix build errors seen with GCC 13/14
  (bsc#1194869).
- commit 46b5d84</changelog>
  <changelog author="msuchanek@suse.de" date="1717416003">- blacklist.conf: PPC fsl_msi is not used
- commit ae6590d</changelog>
  <changelog author="msuchanek@suse.de" date="1717416004">- powerpc/pseries/lparcfg: drop error message from guest name
  lookup (bsc#1187716 ltc#193451 git-fixes).
- commit ceab637</changelog>
  <changelog author="mfranc@suse.cz" date="1717416005">- Update
  patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
  (git-fixes CVE-2024-36955).
- Update
  patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
  (git-fixes bsc#1225715 CVE-2024-36906).
- Update
  patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
  (git-fixes bsc#1225579 CVE-2024-36011).
- Update
  patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
  (git-fixes bsc#1225578 CVE-2024-36013).
- Update
  patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
  (git-fixes bsc#1225502 CVE-2024-36012).
- Update
  patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
  (git-fixes bsc#1225722 CVE-2024-36880).
- Update
  patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
  (git-fixes CVE-2024-36942).
- Update
  patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
  (git-fixes bsc#1225720 CVE-2024-36032).
- Update
  patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
  (git-fixes bsc#1223749 CVE-2024-26990).
- Update
  patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
  (git-fixes bsc#1223692 CVE-2024-26992).
- Update
  patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
  (stable-fixes CVE-2024-36944).
- Update
  patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
  (git-fixes bsc#1225734 CVE-2024-36896).
- Update
  patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
  (stable-fixes CVE-2024-36949).
- Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
  (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
- Update
  patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
  (git-fixes bsc#1225692 CVE-2023-52882).
- Update
  patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
  (git-fixes CVE-2024-26761).
- Update
  patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
  (stable-fixes bsc#1225735 CVE-2024-36897).
- Update
  patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
  (stable-fixes bsc#1225705 CVE-2024-36026).
- Update
  patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
  (stable-fixes CVE-2024-36951).
- Update
  patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
  (git-fixes bsc#1225593 CVE-2024-36014).
- Update
  patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
  (stable-fixes bsc#1225728 CVE-2024-36885).
- Update
  patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
  (git-fixes bsc#1225773 CVE-2024-36936).
- Update
  patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
  (stable-fixes CVE-2024-36950).
- Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
  (git-fixes bsc#1225736 CVE-2024-36898).
- Update
  patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
  (git-fixes bsc#1225698 CVE-2024-36020).
- Update
  patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
  (git-fixes bsc#1225710 CVE-2024-36891).
- Update
  patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
  (git-fixes bsc#1225714 CVE-2024-36890).
- Update
  patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
  (git-fixes bsc#1225708 CVE-2024-36029).
- Update
  patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
  (git-fixes bsc#1225699 CVE-2024-36021).
- Update
  patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
  (git-fixes CVE-2024-26943).
- Update
  patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
  (git-fixes bsc#1225694 CVE-2024-36018).
- Update
  patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
  (git-fixes CVE-2024-36940).
- Update
  patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
  (git-fixes CVE-2024-36959).
- Update
  patches.suse/ppdev-Add-an-error-check-in-register_device.patch
  (git-fixes bsc#1225640 CVE-2024-36015).
- Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
  CVE-2024-36947).
- Update
  patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
  (git-fixes bsc#1225695 CVE-2024-36019).
- Update
  patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
  (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
- Update
  patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
  (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
- Update
  patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
  (git-fixes bsc#1225704 CVE-2024-36025).
- Update
  patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
  (git-fixes CVE-2024-36930).
- Update
  patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
  (bsc#1224331 bsc#1224602 CVE-2024-35814).
- Update
  patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
  (git-fixes bsc#1225642 CVE-2024-36016).
- Update
  patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
  (git-fixes bsc#1225749 CVE-2024-36894).
- Update
  patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
  (git-fixes bsc#1225750 CVE-2024-36895).
- Update
  patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
  (git-fixes bsc#1225748 CVE-2024-36893).
- Update
  patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
  (stable-fixes bsc#1225769 CVE-2024-36921).
- Update
  patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
  (stable-fixes CVE-2024-36922).
- Update
  patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
  (git-fixes CVE-2024-36941).
- Update
  patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
  (git-fixes bsc#1224742 CVE-2024-35803).
- commit 539780f</changelog>
  <changelog author="dwagner@suse.de" date="1717416006">- nvmet: fix ns enable/disable possible hang (git-fixes).
- nvme-multipath: fix io accounting on failover (git-fixes).
- nvme: fix multipath batched completion accounting (git-fixes).
- commit ed3b392</changelog>
  <changelog author="dwagner@suse.de" date="1717416007">- scsi: lpfc: Copyright updates for 14.4.0.2 patches
  (bsc#1225842).
- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
  (bsc#1225842).
  Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
  (bsc#1225842).
- scsi: lpfc: Clear deferred RSCN processing flag when driver
  is unloading (bsc#1225842).
- scsi: lpfc: Update logging of protection type for T10 DIF I/O
  (bsc#1225842).
- scsi: lpfc: Change default logging level for unsolicited CT
  MIB commands (bsc#1225842).
- commit 5a56384</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416008">- smb: client: fix mount when dns_resolver key is not available
  (git-fixes, bsc#1225172).
- commit 28edb5c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416009">- cifs: fix leak of iface for primary channel (git-fixes,
  bsc#1225172).
- commit b7eb8e8</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416010">- Revert "cifs: reconnect work should have reference on server
  struct" (git-fixes, bsc#1225172).
- commit 3ca4c0c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416011">- smb: client: fix parsing of SMB3.1.1 POSIX create context
  (git-fixes, bsc#1225172).
- commit 5f27f69</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416012">- cifs: failure to add channel on iface should bump up weight
  (git-fixes, bsc#1225172).
- commit 007b237</changelog>
  <changelog author="tonyj@suse.de" date="1717416013">- perf/x86: Fix out of range data (git-fixes).
- perf/x86/intel/ds: Don't clear -&gt;pebs_data_cfg for the last
  PEBS event (git-fixes).
- perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
- commit 664d77f</changelog>
  <changelog author="dsterba@suse.com" date="1717588800">- blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
- Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
  Quoting bsc#1225945#c11:
  "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
  transaction for every subvol create")
  ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
  unwritten extent buffer after snapshotting a new subvolume") was never
  backported."
- commit d947258</changelog>
  <changelog author="tonyj@suse.de" date="1717588801">- perf pmu: Count sys and cpuid JSON events separately (git
  fixes).
- perf stat: Don't display metric header for non-leader uncore
  events (git-fixes).
- perf daemon: Fix file leak in daemon_session__control
  (git-fixes).
- perf symbols: Fix ownership of string in dso__load_vmlinux()
  (git-fixes).
- perf thread: Fixes to thread__new() related to initializing comm
  (git-fixes).
- perf report: Avoid SEGV in report__setup_sample_type()
  (git-fixes).
- perf ui browser: Don't save pointer to stack memory (git-fixes).
- perf bench internals inject-build-id: Fix trap divide when
  collecting just one DSO (git-fixes).
- perf intel-pt: Fix unassigned instruction op (discovered by
  MemorySanitizer) (git-fixes).
- perf test shell arm_coresight: Increase buffer size for
  Coresight basic tests (git-fixes).
- perf docs: Document bpf event modifier (git-fixes).
- perf bench uprobe: Remove lib64 from libc.so.6 binary path
  (git-fixes).
- perf record: Fix debug message placement for test consumption
  (git-fixes).
- perf tests: Apply attributes to all events in object code
  reading test (git-fixes).
- perf tests: Make "test data symbol" more robust on Neoverse N1
  (git-fixes).
- perf annotate: Fix annotation_calc_lines() to pass correct
  address to get_srcline() (git-fixes).
- perf stat: Do not fail on metrics on s390 z/VM systems
  (git-fixes).
- perf sched timehist: Fix -g/--call-graph option failure
  (git-fixes).
- perf annotate: Get rid of duplicate --group option item
  (git-fixes).
- perf probe: Add missing libgen.h header needed for using
  basename() (git-fixes).
- perf record: Delete session after stopping sideband thread
  (git-fixes).
- perf auxtrace: Fix multiple use of --itrace option (git-fixes).
- perf script: Show also errors for --insn-trace option
  (git-fixes).
- perf lock contention: Add a missing NULL check (git-fixes).
- perf vendor events amd: Fix Zen 4 cache latency events
  (git-fixes).
- libperf evlist: Avoid out-of-bounds access (git-fixes).
- perf pmu: Fix a potential memory leak in perf_pmu__lookup()
  (git-fixes).
- perf print-events: make is_event_supported() more robust
  (git-fixes).
- perf list: fix short description for some cache events
  (git-fixes).
- perf metric: Don't remove scale from counts (git-fixes).
- perf stat: Avoid metric-only segv (git-fixes).
- perf expr: Fix "has_event" function for metric style events
  (git-fixes).
- perf srcline: Add missed addr2line closes (git-fixes).
- perf thread_map: Free strlist on normal path in
  thread_map__new_by_tid_str() (git-fixes).
- perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
- perf jevents: Drop or simplify small integer values (git-fixes).
- perf evsel: Fix duplicate initialization of data-&gt;id in
  evsel__parse_sample() (git-fixes).
- perf pmu: Treat the msr pmu as software (git-fixes).
- perf record: Check conflict between '--timestamp-filename'
  option and pipe mode before recording (git-fixes).
- perf record: Fix possible incorrect free in
  record__switch_output() (git-fixes).
- perf vendor events amd: Add Zen 4 memory controller events
  (git-fixes).
- perf top: Uniform the event name for the hybrid machine
  (git-fixes).
- perf top: Use evsel's cpus to replace user_requested_cpus
  (git-fixes).
- commit a1f9340</changelog>
  <changelog author="tonyj@suse.de" date="1717675200">- perf ui browser: Avoid SEGV on title (git fixes).
- commit 1578c22</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675201">- inet: inet_defrag: prevent sk release while still in use
  (CVE-2024-26921 bsc#1223138).
- commit 2016faf</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675202">- net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
- commit 7bf5961</changelog>
  <changelog author="tiwai@suse.de" date="1718366400">- Temporarily drop KVM patch that caused a regression (bsc#1226158)
  Delete patches.suse/KVM-x86-pmu-Prioritize-VMX-interception-over-GP-on-R.patch
- commit 33f31da</changelog>
</package>
<package pkgid="d437dd63544d931d9856188c7f43b65f85552b9d550db4e49d39b532a1e9f8a3" name="dtb-broadcom" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.14.1"/>
  <changelog author="tiwai@suse.de" date="1719662400">- gpiolib: cdev: Disallow reconfiguration without direction
  (uAPI v1) (git-fixes).
- gpio: davinci: Validate the obtained number of IRQs (git-fixes).
- commit 919ebd1</changelog>
  <changelog author="tiwai@suse.de" date="1719748800">- i2c: testunit: discard write requests while old command is
  running (git-fixes).
- i2c: testunit: don't erase registers after STOP (git-fixes).
- mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
  (git-fixes).
- mmc: sdhci: Do not invert write-protect twice (git-fixes).
- mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
  (git-fixes).
- mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
  (git-fixes).
- commit 448487d</changelog>
  <changelog author="tiwai@suse.de" date="1719748801">- crypto: iaa - Account for cpu-less numa nodes (bsc#1227190).
- commit cd600aa</changelog>
  <changelog author="tiwai@suse.de" date="1719748802">- crypto: deflate - Add aliases to deflate (bsc#1227190).
- commit 27ffd92</changelog>
  <changelog author="tiwai@suse.de" date="1719835200">- ata: ahci: Clean up sysfs file on error (git-fixes).
- ata: libata-core: Fix double free on error (git-fixes).
- ata,scsi: libata-core: Do not leak memory for ata_port struct
  members (git-fixes).
- ata: libata-core: Fix null pointer dereference on error
  (git-fixes).
- kbuild: Fix build target deb-pkg: ln: failed to create hard link
  (git-fixes).
- kbuild: doc: Update default INSTALL_MOD_DIR from extra to
  updates (git-fixes).
- kbuild: Install dtb files as 0644 in Makefile.dtbinst
  (git-fixes).
- counter: ti-eqep: enable clock at probe (git-fixes).
- iio: chemical: bme680: Fix sensor data read operation
  (git-fixes).
- iio: chemical: bme680: Fix overflows in compensate() functions
  (git-fixes).
- iio: chemical: bme680: Fix calibration data variable
  (git-fixes).
- iio: chemical: bme680: Fix pressure value output (git-fixes).
- iio: accel: fxls8962af: select IIO_BUFFER &amp; IIO_KFIFO_BUF
  (git-fixes).
- iio: adc: ad7266: Fix variable checking bug (git-fixes).
- iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
  (git-fixes).
- serial: bcm63xx-uart: fix tx after conversion to
  uart_port_tx_limited() (git-fixes).
- serial: core: introduce uart_port_tx_limited_flags()
  (git-fixes).
- Revert "serial: core: only stop transmit when HW fifo is empty"
  (git-fixes).
- tty: mcf: MCF54418 has 10 UARTS (git-fixes).
- usb: gadget: aspeed_udc: fix device address configuration
  (git-fixes).
- usb: dwc3: core: remove lock of otg mode during gadget
  suspend/resume to avoid deadlock (git-fixes).
- usb: typec: ucsi: glink: fix child node release in probe
  function (git-fixes).
- usb: musb: da8xx: fix a resource leak in probe() (git-fixes).
- usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  (git-fixes).
- usb: gadget: printer: fix races against disable (git-fixes).
- PCI/MSI: Fix UAF in msi_capability_init (git-fixes).
- commit a2ea5a9</changelog>
  <changelog author="ptesarik@suse.com" date="1719835201">- net: ena: Fix redundant device NUMA node override
  (jsc#PED-8688).
- commit 6ad6684</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835202">- tcp: do not accept ACK of bytes we never sent (CVE-2023-52881
  bsc#1225611).
- commit 16404a6</changelog>
  <changelog author="mhocko@suse.com" date="1719835203">- Update
  patches.suse/1352-drm-amdgpu-Fix-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52883
  bsc#1226630).
- Update
  patches.suse/9p-add-missing-locking-around-taking-dentry-fid-list.patch
  (git-fixes CVE-2024-39463 bsc#1227090).
- Update
  patches.suse/ALSA-Fix-deadlocks-with-kctl-removals-at-disconnecti.patch
  (stable-fixes CVE-2024-38600 bsc#1226864).
- Update
  patches.suse/ALSA-core-Fix-NULL-module-pointer-assignment-at-card.patch
  (git-fixes CVE-2024-38605 bsc#1226740).
- Update
  patches.suse/ALSA-hda-Fix-possible-null-ptr-deref-when-assigning-.patch
  (git-fixes CVE-2023-52806 bsc#1225554).
- Update
  patches.suse/ALSA-hda-cs_dsp_ctl-Use-private_free-for-control-cle.patch
  (git-fixes CVE-2024-38388 bsc#1226890).
- Update
  patches.suse/ALSA-timer-Set-lower-bound-of-start-tick-time.patch
  (stable-fixes git-fixes CVE-2024-38618 bsc#1226754).
- Update
  patches.suse/ASoC-kirkwood-Fix-potential-NULL-dereference.patch
  (git-fixes CVE-2024-38550 bsc#1226633).
- Update
  patches.suse/ASoC-mediatek-Assign-dummy-when-codec-not-specified-.patch
  (git-fixes CVE-2024-38551 bsc#1226761).
- Update
  patches.suse/Bluetooth-btusb-Add-date-evt_skb-is-NULL-check.patch
  (git-fixes CVE-2023-52833 bsc#1225595).
- Update
  patches.suse/Bluetooth-hci_core-Fix-possible-buffer-overflow.patch
  (git-fixes CVE-2024-26889).
- Update
  patches.suse/HID-uclogic-Fix-user-memory-access-bug-in-uclogic_pa.patch
  (git-fixes CVE-2023-52866 bsc#1225120).
- Update
  patches.suse/IB-mlx5-Fix-init-stage-error-handling-to-avoid-doubl.patch
  (jsc#PED-6864 CVE-2023-52851 bsc#1225587).
- Update
  patches.suse/Input-cyapa-add-missing-input-core-locking-to-suspen.patch
  (git-fixes CVE-2023-52884 bsc#1226764).
- Update
  patches.suse/Input-synaptics-rmi4-fix-use-after-free-in-rmi_unreg.patch
  (git-fixes CVE-2023-52840 bsc#1224928).
- Update
  patches.suse/KEYS-trusted-Do-not-use-WARN-when-encode-fails.patch
  (git-fixes CVE-2024-36975 bsc#1226520).
- Update
  patches.suse/KEYS-trusted-Fix-memory-leak-in-tpm2_key_encode.patch
  (git-fixes CVE-2024-36967 bsc#1226131).
- Update
  patches.suse/RDMA-cma-Fix-kmemleak-in-rdma_core-observed-during-b.patch
  (git-fixes CVE-2024-38539 bsc#1226608).
- Update patches.suse/RDMA-hns-Fix-UAF-for-cq-async-event.patch
  (git-fixes CVE-2024-38545 bsc#1226595).
- Update
  patches.suse/RDMA-hns-Fix-deadlock-on-SRQ-async-events.patch
  (git-fixes CVE-2024-38591 bsc#1226738).
- Update
  patches.suse/RDMA-hns-Modify-the-print-level-of-CQE-error.patch
  (git-fixes CVE-2024-38590 bsc#1226839).
- Update
  patches.suse/RDMA-rxe-Fix-seg-fault-in-rxe_comp_queue_pkt.patch
  (git-fixes CVE-2024-38544 bsc#1226597).
- Update
  patches.suse/SUNRPC-Fix-RPC-client-cleaned-up-the-freed-pipefs-de.patch
  (git-fixes CVE-2023-52803 bsc#1225008).
- Update patches.suse/af_unix-Clear-stale-u-oob_skb.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-35970 bsc#1224584).
- Update
  patches.suse/af_unix-Drop-oob_skb-ref-before-purging-queue-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26750 bsc#1222617).
- Update
  patches.suse/af_unix-Fix-task-hung-while-purging-oob_skb-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26780 bsc#1222588).
- Update
  patches.suse/af_unix-Update-unix_sk-sk-oob_skb-under-sk_receive_queue-lock.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-36972 bsc#1226163).
- Update
  patches.suse/arm64-Restrict-CPU_BIG_ENDIAN-to-GNU-as-or-LLVM-IAS-.patch
  (git-fixes CVE-2023-52750 bsc#1225485).
- Update
  patches.suse/atl1c-Work-around-the-DMA-RX-overflow-issue.patch
  (git-fixes CVE-2023-52834 bsc#1225599).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issue-of-net_device.patch
  (git-fixes CVE-2024-38554 bsc#1226742).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issues-of-ax25_dev.patch
  (git-fixes CVE-2024-38602 bsc#1226613).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-reorder-of-WRITE-lqueued.patch
  (bsc#1225605 CVE-2024-38384 bsc#1226938).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-resetting-io-stat.patch
  (bsc#1225605 CVE-2024-38663 bsc#1226939).
- Update
  patches.suse/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch
  (git-fixes CVE-2024-38540 bsc#1226582).
- Update
  patches.suse/bonding-stop-the-device-in-bond_setup_by_slave.patch
  (git-fixes CVE-2023-52784 bsc#1224946).
- Update
  patches.suse/can-dev-can_put_echo_skb-don-t-crash-kernel-if-can_p.patch
  (git-fixes CVE-2023-52878 bsc#1225000).
- Update
  patches.suse/clk-mediatek-clk-mt2701-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52875 bsc#1225096).
- Update
  patches.suse/clk-mediatek-clk-mt6765-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52870 bsc#1224937).
- Update
  patches.suse/clk-mediatek-clk-mt6779-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52873 bsc#1225589).
- Update
  patches.suse/clk-mediatek-clk-mt6797-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52865 bsc#1225086).
- Update
  patches.suse/clk-mediatek-clk-mt7629-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52858 bsc#1225566).
- Update
  patches.suse/clk-mediatek-clk-mt7629-eth-Add-check-for-mtk_alloc_.patch
  (git-fixes CVE-2023-52876 bsc#1225036).
- Update
  patches.suse/cppc_cpufreq-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38573 bsc#1226739).
- Update patches.suse/cpufreq-exit-callback-is-optional.patch
  (git-fixes CVE-2024-38615 bsc#1226592).
- Update patches.suse/crypto-bcm-Fix-pointer-arithmetic.patch
  (git-fixes CVE-2024-38579 bsc#1226637).
- Update
  patches.suse/crypto-pcrypt-Fix-hungtask-for-PADATA_RESET.patch
  (git-fixes CVE-2023-52813 bsc#1225527).
- Update patches.suse/cxl-mem-Fix-shutdown-order.patch (git-fixes
  CVE-2023-52849 bsc#1224949).
- Update
  patches.suse/cxl-region-Do-not-try-to-cleanup-after-cxl_region_se.patch
  (git-fixes CVE-2023-52792 bsc#1225477).
- Update patches.suse/cxl-region-Fix-cxlr_pmem-leaks.patch
  (git-fixes CVE-2024-38391 bsc#1226894).
- Update
  patches.suse/dma-buf-sw-sync-don-t-enable-IRQ-from-sync_print_obj.patch
  (git-fixes CVE-2024-38780 bsc#1226886).
- Update
  patches.suse/dma-mapping-benchmark-fix-node-id-validation.patch
  (git-fixes CVE-2024-34777 bsc#1226796).
- Update
  patches.suse/dma-mapping-benchmark-handle-NUMA_NO_NODE-correctly.patch
  (git-fixes CVE-2024-39277 bsc#1226909).
- Update
  patches.suse/dmaengine-idxd-Avoid-unnecessary-destruction-of-file.patch
  (git-fixes CVE-2024-38629 bsc#1226905).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Pola.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52819
  bsc#1225532).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-SMU7.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52818
  bsc#1225530).
- Update
  patches.suse/drm-amd-check-num-of-link-levels-when-update-pcie-pa.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52812
  bsc#1225564).
- Update
  patches.suse/drm-amd-display-Avoid-NULL-dereference-of-timing-gen.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52753
  bsc#1225478).
- Update
  patches.suse/drm-amd-display-Fix-division-by-zero-in-setup_dsc_co.patch
  (stable-fixes CVE-2024-36969 bsc#1226155).
- Update
  patches.suse/drm-amd-display-Fix-null-pointer-dereference-in-erro.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52862
  bsc#1225015).
- Update
  patches.suse/drm-amd-display-Fix-potential-index-out-of-bounds-in.patch
  (git-fixes CVE-2024-38552 bsc#1226767).
- Update
  patches.suse/drm-amd-display-fix-a-NULL-pointer-dereference-in-am.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52773
  bsc#1225041).
- Update
  patches.suse/drm-amd-display-fixed-integer-types-and-null-check-l.patch
  (git-fixes CVE-2024-26767).
- Update
  patches.suse/drm-amdgpu-Fix-a-null-pointer-access-when-the-smc_rr.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52817
  bsc#1225569).
- Update
  patches.suse/drm-amdgpu-Fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch
  (git-fixes CVE-2024-39291 bsc#1226934).
- Update
  patches.suse/drm-amdgpu-Fix-potential-null-pointer-derefernce.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52814
  bsc#1225565).
- Update
  patches.suse/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch
  (stable-fixes CVE-2024-39471 bsc#1227096).
- Update
  patches.suse/drm-amdgpu-mes-fix-use-after-free-issue.patch
  (stable-fixes CVE-2024-38581 bsc#1226657).
- Update
  patches.suse/drm-amdgpu-vkms-fix-a-possible-null-pointer-derefere.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52815
  bsc#1225568).
- Update
  patches.suse/drm-amdkfd-Fix-a-race-condition-of-vram-buffer-unref.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52825
  bsc#1225076).
- Update
  patches.suse/drm-amdkfd-Fix-shift-out-of-bounds-issue.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52816
  bsc#1225529).
- Update
  patches.suse/drm-bridge-cdns-mhdp8546-Fix-possible-null-pointer-d.patch
  (git-fixes CVE-2024-38548).
- Update
  patches.suse/drm-bridge-it66121-Fix-invalid-connector-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52861
  bsc#1224941).
- Update
  patches.suse/drm-bridge-lt8912b-Fix-crash-on-bridge-detach.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52856
  bsc#1224932).
- Update
  patches.suse/drm-mediatek-Add-0-size-check-to-mtk_drm_gem_obj.patch
  (git-fixes CVE-2024-38549 bsc#1226735).
- Update
  patches.suse/drm-mediatek-Fix-coverity-issue-with-unintentional-i.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52857
  bsc#1225581).
- Update
  patches.suse/drm-mediatek-Init-ddp_comp-with-devm_kcalloc.patch
  (git-fixes CVE-2024-38592 bsc#1226844).
- Update
  patches.suse/drm-msm-a6xx-Avoid-a-nullptr-dereference-when-speedb.patch
  (git-fixes CVE-2024-38390 bsc#1226891).
- Update
  patches.suse/drm-msm-dpu-Add-callback-function-pointer-check-befo.patch
  (git-fixes CVE-2024-38622 bsc#1226856).
- Update
  patches.suse/drm-panel-fix-a-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52821
  bsc#1225022).
- Update
  patches.suse/drm-panel-panel-tpo-tpg110-fix-a-possible-null-point.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52826
  bsc#1225077).
- Update patches.suse/drm-radeon-possible-buffer-overflow.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52867
  bsc#1225009).
- Update
  patches.suse/drm-vc4-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38546 bsc#1226593).
- Update
  patches.suse/drm-vmwgfx-Fix-invalid-reads-in-fence-signaled-event.patch
  (git-fixes CVE-2024-36960 bsc#1225872).
- Update
  patches.suse/drm-zynqmp_dpsub-Always-register-bridge.patch
  (git-fixes CVE-2024-38664 bsc#1226941).
- Update
  patches.suse/e1000e-change-usleep_range-to-udelay-in-PHY-mdic-acc.patch
  (CVE-2024-39296 bsc#1226989 CVE-2024-36887 bsc#1225731).
- Update
  patches.suse/ecryptfs-Fix-buffer-size-for-tag-66-packet.patch
  (git-fixes CVE-2024-38578 bsc#1226634).
- Update
  patches.suse/efi-libstub-only-free-priv.runtime_map-when-allocate.patch
  (git-fixes CVE-2024-33619 bsc#1226768).
- Update
  patches.suse/fbdev-imsttfb-fix-a-resource-leak-in-probe.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52838
  bsc#1225031).
- Update
  patches.suse/fs-9p-only-translate-RWX-permissions-for-plain-9P200.patch
  (git-fixes CVE-2024-36964 bsc#1225866).
- Update
  patches.suse/fs-jfs-Add-check-for-negative-db_l2nbperpage.patch
  (git-fixes CVE-2023-52810 bsc#1225557).
- Update
  patches.suse/fs-jfs-Add-validity-check-for-db_maxag-and-db_agpref.patch
  (git-fixes CVE-2023-52804 bsc#1225550).
- Update
  patches.suse/ftrace-Fix-possible-use-after-free-issue-in-ftrace_location.patch
  (git-fixes CVE-2024-38588 bsc#1226837).
- Update
  patches.suse/genirq-irqdesc-Prevent-use-after-free-in-irq_find_at.patch
  (git-fixes CVE-2024-38385 bsc#1227085).
- Update patches.suse/gfs2-ignore-negated-quota-changes.patch
  (git-fixes CVE-2023-52759 bsc#1225560).
- Update
  patches.suse/hid-cp2112-Fix-duplicate-workqueue-initialization.patch
  (git-fixes CVE-2023-52853 bsc#1224988).
- Update
  patches.suse/hwmon-axi-fan-control-Fix-possible-NULL-pointer-dere.patch
  (git-fixes CVE-2023-52863 bsc#1225586).
- Update
  patches.suse/i2c-acpi-Unbind-mux-adapters-before-delete.patch
  (git-fixes CVE-2024-39362 bsc#1226995).
- Update
  patches.suse/i2c-core-Run-atomic-i2c-xfer-when-preemptible.patch
  (git-fixes CVE-2023-52791 bsc#1225108).
- Update
  patches.suse/i3c-master-mipi-i3c-hci-Fix-a-kernel-panic-for-acces.patch
  (git-fixes CVE-2023-52763 bsc#1225570).
- Update
  patches.suse/i3c-mipi-i3c-hci-Fix-out-of-bounds-access-in-hci_dma.patch
  (git-fixes CVE-2023-52766).
- Update
  patches.suse/i915-perf-Fix-NULL-deref-bugs-with-drm_dbg-calls.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52788
  bsc#1225106).
- Update
  patches.suse/igb-Fix-string-truncation-warnings-in-igb_set_fw_ver.patch
  (git-fixes CVE-2024-36010 bsc#1225594).
- Update
  patches.suse/iommu-vt-d-Fix-WARN_ON-in-iommu-probe-path.patch
  (git-fixes CVE-2024-35957 bsc#1224673).
- Update
  patches.suse/iommufd-Fix-missing-update-of-domains_itree-after-splitting-iopt
  (jsc#PED-7779 jsc#PED-7780 CVE-2023-52801 bsc#1225006).
- Update
  patches.suse/ipvlan-add-ipvlan_route_v6_outbound-helper.patch
  (git-fixes CVE-2023-52796 bsc#1224930).
- Update
  patches.suse/jffs2-prevent-xattr-node-from-overflowing-the-eraseblock.patch
  (git-fixes CVE-2024-38599 bsc#1226848).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-dbFindLeaf.patch
  (git-fixes CVE-2023-52799 bsc#1225472).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-diAlloc.patch
  (git-fixes CVE-2023-52805 bsc#1225553).
- Update
  patches.suse/kunit-fortify-Fix-mismatched-kvalloc-vfree-usage.patch
  (git-fixes CVE-2024-38617 bsc#1226859).
- Update
  patches.suse/lib-generic-radix-tree.c-Don-t-overflow-in-peek.patch
  (git-fixes CVE-2021-47432 bsc#1225391).
- Update
  patches.suse/lib-test_hmm.c-handle-src_pfns-and-dst_pfns-allocati.patch
  (git-fixes CVE-2024-38543 bsc#1226594).
- Update
  patches.suse/locking-ww_mutex-test-Fix-potential-workqueue-corrup.patch
  (bsc#1219953 CVE-2023-52836 bsc#1225609).
- Update
  patches.suse/md-Don-t-ignore-suspended-array-in-md_check_recovery-1baa.patch
  (bsc#1219596 CVE-2024-26758).
- Update
  patches.suse/media-atomisp-ssh_css-Fix-a-null-pointer-dereference.patch
  (git-fixes CVE-2024-38547 bsc#1226632).
- Update
  patches.suse/media-bttv-fix-use-after-free-error-due-to-btv-timeo.patch
  (git-fixes CVE-2023-52847 bsc#1225588).
- Update
  patches.suse/media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch
  (git-fixes CVE-2023-52764 bsc#1225571).
- Update
  patches.suse/media-hantro-Check-whether-reset-op-is-defined-befor.patch
  (git-fixes CVE-2023-52850 bsc#1225014).
- Update
  patches.suse/media-i2c-et8ek8-Don-t-strip-remove-function-when-dr.patch
  (git-fixes CVE-2024-38611 bsc#1226760).
- Update
  patches.suse/media-imon-fix-access-to-invalid-resource-for-the-se.patch
  (git-fixes CVE-2023-52754 bsc#1225490).
- Update
  patches.suse/media-lgdt3306a-Add-a-check-against-null-pointer-def.patch
  (stable-fixes CVE-2022-48772 bsc#1226976).
- Update
  patches.suse/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch
  (git-fixes CVE-2024-38621 bsc#1226895).
- Update
  patches.suse/media-vidtv-mux-Add-check-and-kfree-for-kstrdup.patch
  (git-fixes CVE-2023-52841 bsc#1225592).
- Update patches.suse/media-vidtv-psi-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52844 bsc#1225590).
- Update
  patches.suse/mfd-qcom-spmi-pmic-Fix-revid-implementation.patch
  (git-fixes CVE-2023-52765 bsc#1225029).
- Update
  patches.suse/misc-microchip-pci1xxxx-fix-double-free-in-the-error.patch
  (git-fixes CVE-2024-36973 bsc#1226457).
- Update
  patches.suse/net-hns3-fix-out-of-bounds-access-may-occur-when-coa.patch
  (git-fixes CVE-2023-52807 bsc#1225097).
- Update
  patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch
  (git-fixes CVE-2024-36962 bsc#1225827).
- Update
  patches.suse/net-mlx5-Fix-peer-devlink-set-for-SF-representor-dev.patch
  (git-fixes CVE-2024-38595 bsc#1226741).
- Update
  patches.suse/net-mlx5e-Track-xmit-submission-to-PTP-WQ-after-popu.patch
  (jsc#PED-3311 CVE-2023-52782 bsc#1225103).
- Update
  patches.suse/net-mvneta-fix-calls-to-page_pool_get_stats.patch
  (git-fixes CVE-2023-52780 bsc#1224933).
- Update
  patches.suse/net-wangxun-fix-kernel-panic-due-to-null-pointer.patch
  (git-fixes CVE-2023-52783 bsc#1225104).
- Update
  patches.suse/netfilter-complete-validation-of-user-input.patch
  (git-fixes CVE-2024-35896 bsc#1224662 CVE-2024-35962
  bsc#1224583).
- Update
  patches.suse/nfc-nci-Fix-uninit-value-in-nci_rx_work.patch
  (git-fixes CVE-2024-38381 bsc#1226878).
- Update
  patches.suse/nilfs2-fix-nilfs_empty_dir-misjudgment-and-long-loop.patch
  (git-fixes CVE-2024-39469 bsc#1226992).
- Update
  patches.suse/nilfs2-fix-potential-hang-in-nilfs_detach_log_writer.patch
  (git-fixes CVE-2024-38582 bsc#1226658).
- Update
  patches.suse/nilfs2-fix-use-after-free-of-timer-for-log-writer-th.patch
  (git-fixes CVE-2024-38583 bsc#1226777).
- Update
  patches.suse/of-module-add-buffer-overflow-check-in-of_modalias.patch
  (git-fixes CVE-2024-38541 bsc#1226587).
- Update
  patches.suse/padata-Fix-refcnt-handling-in-padata_free_shell.patch
  (git-fixes CVE-2023-52854 bsc#1225584).
- Update
  patches.suse/perf-core-Bail-out-early-if-the-request-AUX-area-is-out-of-bound.patch
  (git-fixes CVE-2023-52835 bsc#1225602).
- Update
  patches.suse/platform-x86-wmi-Fix-opening-of-char-device.patch
  (git-fixes CVE-2023-52864 bsc#1225132).
- Update
  patches.suse/powerpc-pseries-iommu-LPAR-panics-during-boot-up-wit.patch
  (bsc#1222011 ltc#205900 CVE-2024-36926 bsc#1225829).
- Update patches.suse/pstore-platform-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52869 bsc#1225050).
- Update
  patches.suse/remoteproc-mediatek-Make-sure-IPI-buffer-fits-in-L2T.patch
  (git-fixes CVE-2024-36965 bsc#1226149).
- Update
  patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch
  (git-fixes CVE-2024-38601 bsc#1226876).
- Update
  patches.suse/s390-dasd-protect-device-queue-against-concurrent-access.patch
  (git-fixes bsc#1217481 CVE-2023-52774 bsc#1225572).
- Update
  patches.suse/scsi-hisi_sas-Set-debugfs_dir-pointer-to-NULL-after-removing-debugfs.patch
  (git-fixes CVE-2023-52808 bsc#1225555).
- Update
  patches.suse/scsi-ibmvfc-Remove-BUG_ON-in-the-case-of-an-empty-ev.patch
  (bsc#1209834 ltc#202097 CVE-2023-52811 bsc#1225559).
- Update
  patches.suse/scsi-libfc-Fix-potential-NULL-pointer-dereference-in-fc_lport_ptp_setup.patch
  (git-fixes CVE-2023-52809 bsc#1225556).
- Update
  patches.suse/scsi-lpfc-Move-NPIV-s-transport-unregistration-to-af.patch
  (bsc#1221777 CVE-2024-36952 bsc#1225898).
- Update
  patches.suse/scsi-lpfc-Release-hbalock-before-calling-lpfc_worker.patch
  (bsc#1221777 CVE-2024-36924 bsc#1225820).
- Update
  patches.suse/serial-max3100-Lock-port-lock-when-calling-uart_hand.patch
  (git-fixes CVE-2024-38634 bsc#1226868).
- Update
  patches.suse/serial-max3100-Update-uart_driver_registered-on-driv.patch
  (git-fixes CVE-2024-38633 bsc#1226867).
- Update
  patches.suse/soc-qcom-llcc-Handle-a-second-device-without-data-co.patch
  (git-fixes CVE-2023-52871 bsc#1225534).
- Update
  patches.suse/soundwire-cadence-fix-invalid-PDI-offset.patch
  (stable-fixes CVE-2024-38635 bsc#1226863).
- Update patches.suse/speakup-Fix-sizeof-vs-ARRAY_SIZE-bug.patch
  (git-fixes CVE-2024-38587 bsc#1226780).
- Update patches.suse/spi-Fix-null-dereference-on-suspend.patch
  (git-fixes CVE-2023-52749 bsc#1225476).
- Update
  patches.suse/thermal-core-prevent-potential-string-overflow.patch
  (git-fixes CVE-2023-52868 bsc#1225044).
- Update
  patches.suse/thermal-drivers-qcom-lmh-Check-for-SCM-availability-.patch
  (git-fixes CVE-2024-39466 bsc#1227089).
- Update
  patches.suse/thermal-drivers-tsens-Fix-null-pointer-dereference.patch
  (git-fixes CVE-2024-38571 bsc#1226737).
- Update
  patches.suse/thermal-intel-powerclamp-fix-mismatch-in-get-functio.patch
  (git-fixes CVE-2023-52794 bsc#1225028).
- Update
  patches.suse/tls-fix-NULL-deref-on-tls_sw_splice_eof-with-empty-r.patch
  (jsc#PED-6831 CVE-2023-52767 bsc#1224998).
- Update
  patches.suse/tpm_tis_spi-Account-for-SPI-header-when-allocating-T.patch
  (git-fixes CVE-2024-36477 bsc#1226840).
- Update
  patches.suse/tracing-Have-trace_event_file-have-ref-counters.patch
  (git-fixes CVE-2023-52879 bsc#1225101).
- Update
  patches.suse/tracing-trigger-Fix-to-return-error-if-failed-to-alloc-snapshot.patch
  (git-fixes CVE-2024-26920).
- Update
  patches.suse/tty-n_gsm-fix-race-condition-in-status-line-change-o.patch
  (git-fixes CVE-2023-52872 bsc#1225591).
- Update
  patches.suse/tty-n_gsm-require-CAP_NET_ADMIN-to-attach-N_GSM0710-.patch
  (bsc#1222619 CVE-2023-52880).
- Update
  patches.suse/tty-vcc-Add-check-for-kstrdup-in-vcc_probe.patch
  (git-fixes CVE-2023-52789 bsc#1225180).
- Update
  patches.suse/usb-config-fix-iteration-issue-in-usb_get_bos_descri.patch
  (git-fixes CVE-2023-52781 bsc#1225092).
- Update
  patches.suse/usb-dwc3-Wait-unconditionally-after-issuing-EndXfer-.patch
  (git-fixes CVE-2024-36977 bsc#1226513).
- Update
  patches.suse/usb-gadget-u_audio-Fix-race-condition-use-of-control.patch
  (git-fixes CVE-2024-38628 bsc#1226911).
- Update
  patches.suse/usb-storage-alauda-Check-whether-the-media-is-initia.patch
  (git-fixes CVE-2024-38619 bsc#1226861).
- Update
  patches.suse/usb-typec-tcpm-Fix-NULL-pointer-dereference-in-tcpm_.patch
  (git-fixes CVE-2023-52877 bsc#1224944).
- Update
  patches.suse/vhost-vdpa-fix-use-after-free-in-vhost_vdpa_probe.patch
  (jsc#PED-3311 CVE-2023-52795 bsc#1225085).
- Update
  patches.suse/virtio-blk-fix-implicit-overflow-on-virtio_max_dma_s.patch
  (git-fixes CVE-2023-52762 bsc#1225573).
- Update
  patches.suse/virtio-vsock-Fix-uninit-value-in-virtio_transport_re.patch
  (jsc#PED-5505 CVE-2023-52842 bsc#1225025).
- Update
  patches.suse/watchdog-cpu5wdt.c-Fix-use-after-free-bug-caused-by-.patch
  (git-fixes CVE-2024-38630 bsc#1226908).
- Update
  patches.suse/wifi-ar5523-enable-proper-endpoint-verification.patch
  (git-fixes CVE-2024-38565 bsc#1226747).
- Update
  patches.suse/wifi-ath11k-fix-dfs-radar-event-locking.patch
  (git-fixes CVE-2023-52798 bsc#1224947).
- Update
  patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch
  (git-fixes CVE-2023-52777 bsc#1224992).
- Update patches.suse/wifi-ath11k-fix-htt-pktlog-locking.patch
  (git-fixes CVE-2023-52800).
- Update
  patches.suse/wifi-ath12k-fix-dfs-radar-and-temperature-event-lock.patch
  (git-fixes CVE-2023-52776 bsc#1225090).
- Update
  patches.suse/wifi-ath12k-fix-htt-mlo-offset-event-locking.patch
  (git-fixes CVE-2023-52769 bsc#1225001).
- Update
  patches.suse/wifi-ath12k-fix-out-of-bound-access-of-qmi_invoke_ha.patch
  (git-fixes CVE-2024-38572 bsc#1226776).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-read-in-ath12k.patch
  (git-fixes CVE-2023-52827 bsc#1225078).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-write-in-ath12.patch
  (git-fixes CVE-2023-52829 bsc#1225081).
- Update
  patches.suse/wifi-brcmfmac-pcie-handle-randbuf-allocation-failure.patch
  (git-fixes CVE-2024-38575 bsc#1226612).
- Update
  patches.suse/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch
  (git-fixes CVE-2024-38567 bsc#1226769).
- Update
  patches.suse/wifi-carl9170-re-fix-fortified-memset-warning.patch
  (git-fixes CVE-2024-38616 bsc#1226852).
- Update
  patches.suse/wifi-mac80211-don-t-return-unset-power-in-ieee80211_.patch
  (git-fixes CVE-2023-52832 bsc#1225577).
- Update
  patches.suse/wifi-nl80211-Avoid-address-calculations-via-out-of-b.patch
  (git-fixes CVE-2024-38562 bsc#1226788).
- Update
  patches.suse/wifi-wilc1000-use-vmm_table-as-array-in-wilc-struct.patch
  (git-fixes CVE-2023-52768 bsc#1225004).
- Update
  patches.suse/x86-tdx-Zero-out-the-missing-RSI-in-TDX_HYPERCALL-macro.patch
  (jsc#PED-5824 CVE-2023-52874 bsc#1225049).
- commit 33efdc4</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835204">- tcp: Use refcount_inc_not_zero() in tcp_twsk_unique()
  (CVE-2024-36904 bsc#1225732).
- commit d578dcc</changelog>
  <changelog author="heming.zhao@suse.com" date="1719921600">- gfs2: Fix potential glock use-after-free on unmount (bsc#1226775
  CVE-2024-38570).
- gfs2: Rename sd_{ glock =&gt; kill }_wait (bsc#1226775
  CVE-2024-38570).
- commit f3adbca</changelog>
  <changelog author="tiwai@suse.de" date="1719921601">- Correct SCSI patch references (bsc#1225767 CVE-2024-36919 bsc#1226785 CVE-2024-38559)
- commit e8ea587</changelog>
  <changelog author="tiwai@suse.de" date="1719921602">- mtd: rawnand: rockchip: ensure NVDDR timings are rejected
  (git-fixes).
- mtd: rawnand: Bypass a couple of sanity checks during NAND
  identification (git-fixes).
- mtd: rawnand: Fix the nand_read_data_op() early check
  (git-fixes).
- mtd: rawnand: Ensure ECC configuration is propagated to upper
  layers (git-fixes).
- commit e545951</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1719921603">- kernel-doc: fix struct_group_tagged() parsing (git-fixes).
- commit e3a2a2e</changelog>
  <changelog author="fdmanana@suse.com" date="1719921604">- btrfs: fix crash on racing fsync and size-extending write into
  prealloc (bsc#1227101 CVE-2024-37354).
- commit 1d355af</changelog>
  <changelog author="vbabka@suse.cz" date="1719921605">- virt: acrn: stop using follow_pfn (CVE-2024-38610 bsc#1226758).
- commit c2ea51b</changelog>
  <changelog author="vbabka@suse.cz" date="1719921606">- drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
  (CVE-2024-38610 bsc#1226758).
- commit 7069ac2</changelog>
  <changelog author="rhopkins@suse.de" date="1719921607">- hsr: Prevent use after free in prp_create_tagged_frame()
  (CVE-2023-52846 bsc#1225098).
- commit cf63988</changelog>
  <changelog author="krisman@suse.de" date="1719921608">- io_uring: Fix io_cqring_wait() not restoring sigmask on
  get_timespec64() failure (git-fixes).
- commit e640a65</changelog>
  <changelog author="krisman@suse.de" date="1719921609">- io_uring: check for non-NULL file pointer in io_file_can_poll()
  (bsc#1226990 CVE-2024-39371).
- io_uring/io-wq: Use set_bit() and test_bit() at worker-&gt;flags
  (git-fixes).
- io_uring/sqpoll: work around a potential audit memory leak
  (git-fixes).
- commit 24603fc</changelog>
  <changelog author="krisman@suse.de" date="1719921610">- io_uring/rsrc: fix incorrect assignment of iter-&gt;nr_segs in
  io_import_fixed (git-fixes).
- io_uring/rsrc: don't lock while !TASK_RUNNING (git-fixes).
- io_uring/io-wq: avoid garbage value of 'match' in
  io_wq_enqueue() (git-fixes).
- commit 7d3e252</changelog>
</package>
<package pkgid="43046174572ffea49db6cd54de94b3e49c0fa7e077efd1d0a6c4d9a945f9923c" name="dtb-broadcom" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.17.1"/>
  <changelog author="tiwai@suse.de" date="1722081600">- auxdisplay: ht16k33: Drop reference after LED registration
  (git-fixes).
- ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
  on unprepare (git-fixes).
- ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
- ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
  reachable (git-fixes).
- ASoC: sof: amd: fix for firmware reload failure in Vangogh
  platform (git-fixes).
- ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
- ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
  (git-fixes).
- ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
- ALSA: ump: Don't update FB name for static blocks (git-fixes).
- drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
- drm/i915/gt: Do not consider preemption during execlists_dequeue
  for gen8 (git-fixes).
- drm/i915/dp: Don't switch the LTTPR mode on an active link
  (git-fixes).
- commit d7e2deb</changelog>
  <changelog author="tiwai@suse.de" date="1722081601">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
</package>
<package pkgid="7e4f0ec71b16c5f14d99216924ae30f1fceb14e2f24869a876c015b9bf63f211" name="dtb-broadcom" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.7.1"/>
  <changelog author="mkubecek@suse.cz" date="1717416000">- netfilter: nf_tables: release mutex after nft_gc_seq_end from
  abort path (CVE-2024-26925 bsc#1223390).
- commit 578a709</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717416001">- Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
  The L3 bsc#1225765 was created seperately since our customer requires
  PTF.
- Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
- Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
- Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
- Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
- commit 054635e</changelog>
  <changelog author="msuchanek@suse.de" date="1717416002">- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
- powerpc/uaccess: Fix build errors seen with GCC 13/14
  (bsc#1194869).
- commit 46b5d84</changelog>
  <changelog author="msuchanek@suse.de" date="1717416003">- blacklist.conf: PPC fsl_msi is not used
- commit ae6590d</changelog>
  <changelog author="msuchanek@suse.de" date="1717416004">- powerpc/pseries/lparcfg: drop error message from guest name
  lookup (bsc#1187716 ltc#193451 git-fixes).
- commit ceab637</changelog>
  <changelog author="mfranc@suse.cz" date="1717416005">- Update
  patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
  (git-fixes CVE-2024-36955).
- Update
  patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
  (git-fixes bsc#1225715 CVE-2024-36906).
- Update
  patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
  (git-fixes bsc#1225579 CVE-2024-36011).
- Update
  patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
  (git-fixes bsc#1225578 CVE-2024-36013).
- Update
  patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
  (git-fixes bsc#1225502 CVE-2024-36012).
- Update
  patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
  (git-fixes bsc#1225722 CVE-2024-36880).
- Update
  patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
  (git-fixes CVE-2024-36942).
- Update
  patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
  (git-fixes bsc#1225720 CVE-2024-36032).
- Update
  patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
  (git-fixes bsc#1223749 CVE-2024-26990).
- Update
  patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
  (git-fixes bsc#1223692 CVE-2024-26992).
- Update
  patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
  (stable-fixes CVE-2024-36944).
- Update
  patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
  (git-fixes bsc#1225734 CVE-2024-36896).
- Update
  patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
  (stable-fixes CVE-2024-36949).
- Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
  (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
- Update
  patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
  (git-fixes bsc#1225692 CVE-2023-52882).
- Update
  patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
  (git-fixes CVE-2024-26761).
- Update
  patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
  (stable-fixes bsc#1225735 CVE-2024-36897).
- Update
  patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
  (stable-fixes bsc#1225705 CVE-2024-36026).
- Update
  patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
  (stable-fixes CVE-2024-36951).
- Update
  patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
  (git-fixes bsc#1225593 CVE-2024-36014).
- Update
  patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
  (stable-fixes bsc#1225728 CVE-2024-36885).
- Update
  patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
  (git-fixes bsc#1225773 CVE-2024-36936).
- Update
  patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
  (stable-fixes CVE-2024-36950).
- Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
  (git-fixes bsc#1225736 CVE-2024-36898).
- Update
  patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
  (git-fixes bsc#1225698 CVE-2024-36020).
- Update
  patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
  (git-fixes bsc#1225710 CVE-2024-36891).
- Update
  patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
  (git-fixes bsc#1225714 CVE-2024-36890).
- Update
  patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
  (git-fixes bsc#1225708 CVE-2024-36029).
- Update
  patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
  (git-fixes bsc#1225699 CVE-2024-36021).
- Update
  patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
  (git-fixes CVE-2024-26943).
- Update
  patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
  (git-fixes bsc#1225694 CVE-2024-36018).
- Update
  patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
  (git-fixes CVE-2024-36940).
- Update
  patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
  (git-fixes CVE-2024-36959).
- Update
  patches.suse/ppdev-Add-an-error-check-in-register_device.patch
  (git-fixes bsc#1225640 CVE-2024-36015).
- Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
  CVE-2024-36947).
- Update
  patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
  (git-fixes bsc#1225695 CVE-2024-36019).
- Update
  patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
  (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
- Update
  patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
  (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
- Update
  patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
  (git-fixes bsc#1225704 CVE-2024-36025).
- Update
  patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
  (git-fixes CVE-2024-36930).
- Update
  patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
  (bsc#1224331 bsc#1224602 CVE-2024-35814).
- Update
  patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
  (git-fixes bsc#1225642 CVE-2024-36016).
- Update
  patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
  (git-fixes bsc#1225749 CVE-2024-36894).
- Update
  patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
  (git-fixes bsc#1225750 CVE-2024-36895).
- Update
  patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
  (git-fixes bsc#1225748 CVE-2024-36893).
- Update
  patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
  (stable-fixes bsc#1225769 CVE-2024-36921).
- Update
  patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
  (stable-fixes CVE-2024-36922).
- Update
  patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
  (git-fixes CVE-2024-36941).
- Update
  patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
  (git-fixes bsc#1224742 CVE-2024-35803).
- commit 539780f</changelog>
  <changelog author="dwagner@suse.de" date="1717416006">- nvmet: fix ns enable/disable possible hang (git-fixes).
- nvme-multipath: fix io accounting on failover (git-fixes).
- nvme: fix multipath batched completion accounting (git-fixes).
- commit ed3b392</changelog>
  <changelog author="dwagner@suse.de" date="1717416007">- scsi: lpfc: Copyright updates for 14.4.0.2 patches
  (bsc#1225842).
- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
  (bsc#1225842).
  Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
  (bsc#1225842).
- scsi: lpfc: Clear deferred RSCN processing flag when driver
  is unloading (bsc#1225842).
- scsi: lpfc: Update logging of protection type for T10 DIF I/O
  (bsc#1225842).
- scsi: lpfc: Change default logging level for unsolicited CT
  MIB commands (bsc#1225842).
- commit 5a56384</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416008">- smb: client: fix mount when dns_resolver key is not available
  (git-fixes, bsc#1225172).
- commit 28edb5c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416009">- cifs: fix leak of iface for primary channel (git-fixes,
  bsc#1225172).
- commit b7eb8e8</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416010">- Revert "cifs: reconnect work should have reference on server
  struct" (git-fixes, bsc#1225172).
- commit 3ca4c0c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416011">- smb: client: fix parsing of SMB3.1.1 POSIX create context
  (git-fixes, bsc#1225172).
- commit 5f27f69</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416012">- cifs: failure to add channel on iface should bump up weight
  (git-fixes, bsc#1225172).
- commit 007b237</changelog>
  <changelog author="tonyj@suse.de" date="1717416013">- perf/x86: Fix out of range data (git-fixes).
- perf/x86/intel/ds: Don't clear -&gt;pebs_data_cfg for the last
  PEBS event (git-fixes).
- perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
- commit 664d77f</changelog>
  <changelog author="dsterba@suse.com" date="1717588800">- blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
- Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
  Quoting bsc#1225945#c11:
  "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
  transaction for every subvol create")
  ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
  unwritten extent buffer after snapshotting a new subvolume") was never
  backported."
- commit d947258</changelog>
  <changelog author="tonyj@suse.de" date="1717588801">- perf pmu: Count sys and cpuid JSON events separately (git
  fixes).
- perf stat: Don't display metric header for non-leader uncore
  events (git-fixes).
- perf daemon: Fix file leak in daemon_session__control
  (git-fixes).
- perf symbols: Fix ownership of string in dso__load_vmlinux()
  (git-fixes).
- perf thread: Fixes to thread__new() related to initializing comm
  (git-fixes).
- perf report: Avoid SEGV in report__setup_sample_type()
  (git-fixes).
- perf ui browser: Don't save pointer to stack memory (git-fixes).
- perf bench internals inject-build-id: Fix trap divide when
  collecting just one DSO (git-fixes).
- perf intel-pt: Fix unassigned instruction op (discovered by
  MemorySanitizer) (git-fixes).
- perf test shell arm_coresight: Increase buffer size for
  Coresight basic tests (git-fixes).
- perf docs: Document bpf event modifier (git-fixes).
- perf bench uprobe: Remove lib64 from libc.so.6 binary path
  (git-fixes).
- perf record: Fix debug message placement for test consumption
  (git-fixes).
- perf tests: Apply attributes to all events in object code
  reading test (git-fixes).
- perf tests: Make "test data symbol" more robust on Neoverse N1
  (git-fixes).
- perf annotate: Fix annotation_calc_lines() to pass correct
  address to get_srcline() (git-fixes).
- perf stat: Do not fail on metrics on s390 z/VM systems
  (git-fixes).
- perf sched timehist: Fix -g/--call-graph option failure
  (git-fixes).
- perf annotate: Get rid of duplicate --group option item
  (git-fixes).
- perf probe: Add missing libgen.h header needed for using
  basename() (git-fixes).
- perf record: Delete session after stopping sideband thread
  (git-fixes).
- perf auxtrace: Fix multiple use of --itrace option (git-fixes).
- perf script: Show also errors for --insn-trace option
  (git-fixes).
- perf lock contention: Add a missing NULL check (git-fixes).
- perf vendor events amd: Fix Zen 4 cache latency events
  (git-fixes).
- libperf evlist: Avoid out-of-bounds access (git-fixes).
- perf pmu: Fix a potential memory leak in perf_pmu__lookup()
  (git-fixes).
- perf print-events: make is_event_supported() more robust
  (git-fixes).
- perf list: fix short description for some cache events
  (git-fixes).
- perf metric: Don't remove scale from counts (git-fixes).
- perf stat: Avoid metric-only segv (git-fixes).
- perf expr: Fix "has_event" function for metric style events
  (git-fixes).
- perf srcline: Add missed addr2line closes (git-fixes).
- perf thread_map: Free strlist on normal path in
  thread_map__new_by_tid_str() (git-fixes).
- perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
- perf jevents: Drop or simplify small integer values (git-fixes).
- perf evsel: Fix duplicate initialization of data-&gt;id in
  evsel__parse_sample() (git-fixes).
- perf pmu: Treat the msr pmu as software (git-fixes).
- perf record: Check conflict between '--timestamp-filename'
  option and pipe mode before recording (git-fixes).
- perf record: Fix possible incorrect free in
  record__switch_output() (git-fixes).
- perf vendor events amd: Add Zen 4 memory controller events
  (git-fixes).
- perf top: Uniform the event name for the hybrid machine
  (git-fixes).
- perf top: Use evsel's cpus to replace user_requested_cpus
  (git-fixes).
- commit a1f9340</changelog>
  <changelog author="tonyj@suse.de" date="1717675200">- perf ui browser: Avoid SEGV on title (git fixes).
- commit 1578c22</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675201">- inet: inet_defrag: prevent sk release while still in use
  (CVE-2024-26921 bsc#1223138).
- commit 2016faf</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675202">- net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
- commit 7bf5961</changelog>
  <changelog author="tiwai@suse.de" date="1718366400">- Temporarily drop KVM patch that caused a regression (bsc#1226158)
  Delete patches.suse/KVM-x86-pmu-Prioritize-VMX-interception-over-GP-on-R.patch
- commit 33f31da</changelog>
</package>
<package pkgid="3755a02d2cdb25d1274a6d25c0910dd3030d53773748a290071f24e3f67a43da" name="dtb-cavium" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.14.1"/>
  <changelog author="tiwai@suse.de" date="1719662400">- gpiolib: cdev: Disallow reconfiguration without direction
  (uAPI v1) (git-fixes).
- gpio: davinci: Validate the obtained number of IRQs (git-fixes).
- commit 919ebd1</changelog>
  <changelog author="tiwai@suse.de" date="1719748800">- i2c: testunit: discard write requests while old command is
  running (git-fixes).
- i2c: testunit: don't erase registers after STOP (git-fixes).
- mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
  (git-fixes).
- mmc: sdhci: Do not invert write-protect twice (git-fixes).
- mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
  (git-fixes).
- mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
  (git-fixes).
- commit 448487d</changelog>
  <changelog author="tiwai@suse.de" date="1719748801">- crypto: iaa - Account for cpu-less numa nodes (bsc#1227190).
- commit cd600aa</changelog>
  <changelog author="tiwai@suse.de" date="1719748802">- crypto: deflate - Add aliases to deflate (bsc#1227190).
- commit 27ffd92</changelog>
  <changelog author="tiwai@suse.de" date="1719835200">- ata: ahci: Clean up sysfs file on error (git-fixes).
- ata: libata-core: Fix double free on error (git-fixes).
- ata,scsi: libata-core: Do not leak memory for ata_port struct
  members (git-fixes).
- ata: libata-core: Fix null pointer dereference on error
  (git-fixes).
- kbuild: Fix build target deb-pkg: ln: failed to create hard link
  (git-fixes).
- kbuild: doc: Update default INSTALL_MOD_DIR from extra to
  updates (git-fixes).
- kbuild: Install dtb files as 0644 in Makefile.dtbinst
  (git-fixes).
- counter: ti-eqep: enable clock at probe (git-fixes).
- iio: chemical: bme680: Fix sensor data read operation
  (git-fixes).
- iio: chemical: bme680: Fix overflows in compensate() functions
  (git-fixes).
- iio: chemical: bme680: Fix calibration data variable
  (git-fixes).
- iio: chemical: bme680: Fix pressure value output (git-fixes).
- iio: accel: fxls8962af: select IIO_BUFFER &amp; IIO_KFIFO_BUF
  (git-fixes).
- iio: adc: ad7266: Fix variable checking bug (git-fixes).
- iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
  (git-fixes).
- serial: bcm63xx-uart: fix tx after conversion to
  uart_port_tx_limited() (git-fixes).
- serial: core: introduce uart_port_tx_limited_flags()
  (git-fixes).
- Revert "serial: core: only stop transmit when HW fifo is empty"
  (git-fixes).
- tty: mcf: MCF54418 has 10 UARTS (git-fixes).
- usb: gadget: aspeed_udc: fix device address configuration
  (git-fixes).
- usb: dwc3: core: remove lock of otg mode during gadget
  suspend/resume to avoid deadlock (git-fixes).
- usb: typec: ucsi: glink: fix child node release in probe
  function (git-fixes).
- usb: musb: da8xx: fix a resource leak in probe() (git-fixes).
- usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  (git-fixes).
- usb: gadget: printer: fix races against disable (git-fixes).
- PCI/MSI: Fix UAF in msi_capability_init (git-fixes).
- commit a2ea5a9</changelog>
  <changelog author="ptesarik@suse.com" date="1719835201">- net: ena: Fix redundant device NUMA node override
  (jsc#PED-8688).
- commit 6ad6684</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835202">- tcp: do not accept ACK of bytes we never sent (CVE-2023-52881
  bsc#1225611).
- commit 16404a6</changelog>
  <changelog author="mhocko@suse.com" date="1719835203">- Update
  patches.suse/1352-drm-amdgpu-Fix-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52883
  bsc#1226630).
- Update
  patches.suse/9p-add-missing-locking-around-taking-dentry-fid-list.patch
  (git-fixes CVE-2024-39463 bsc#1227090).
- Update
  patches.suse/ALSA-Fix-deadlocks-with-kctl-removals-at-disconnecti.patch
  (stable-fixes CVE-2024-38600 bsc#1226864).
- Update
  patches.suse/ALSA-core-Fix-NULL-module-pointer-assignment-at-card.patch
  (git-fixes CVE-2024-38605 bsc#1226740).
- Update
  patches.suse/ALSA-hda-Fix-possible-null-ptr-deref-when-assigning-.patch
  (git-fixes CVE-2023-52806 bsc#1225554).
- Update
  patches.suse/ALSA-hda-cs_dsp_ctl-Use-private_free-for-control-cle.patch
  (git-fixes CVE-2024-38388 bsc#1226890).
- Update
  patches.suse/ALSA-timer-Set-lower-bound-of-start-tick-time.patch
  (stable-fixes git-fixes CVE-2024-38618 bsc#1226754).
- Update
  patches.suse/ASoC-kirkwood-Fix-potential-NULL-dereference.patch
  (git-fixes CVE-2024-38550 bsc#1226633).
- Update
  patches.suse/ASoC-mediatek-Assign-dummy-when-codec-not-specified-.patch
  (git-fixes CVE-2024-38551 bsc#1226761).
- Update
  patches.suse/Bluetooth-btusb-Add-date-evt_skb-is-NULL-check.patch
  (git-fixes CVE-2023-52833 bsc#1225595).
- Update
  patches.suse/Bluetooth-hci_core-Fix-possible-buffer-overflow.patch
  (git-fixes CVE-2024-26889).
- Update
  patches.suse/HID-uclogic-Fix-user-memory-access-bug-in-uclogic_pa.patch
  (git-fixes CVE-2023-52866 bsc#1225120).
- Update
  patches.suse/IB-mlx5-Fix-init-stage-error-handling-to-avoid-doubl.patch
  (jsc#PED-6864 CVE-2023-52851 bsc#1225587).
- Update
  patches.suse/Input-cyapa-add-missing-input-core-locking-to-suspen.patch
  (git-fixes CVE-2023-52884 bsc#1226764).
- Update
  patches.suse/Input-synaptics-rmi4-fix-use-after-free-in-rmi_unreg.patch
  (git-fixes CVE-2023-52840 bsc#1224928).
- Update
  patches.suse/KEYS-trusted-Do-not-use-WARN-when-encode-fails.patch
  (git-fixes CVE-2024-36975 bsc#1226520).
- Update
  patches.suse/KEYS-trusted-Fix-memory-leak-in-tpm2_key_encode.patch
  (git-fixes CVE-2024-36967 bsc#1226131).
- Update
  patches.suse/RDMA-cma-Fix-kmemleak-in-rdma_core-observed-during-b.patch
  (git-fixes CVE-2024-38539 bsc#1226608).
- Update patches.suse/RDMA-hns-Fix-UAF-for-cq-async-event.patch
  (git-fixes CVE-2024-38545 bsc#1226595).
- Update
  patches.suse/RDMA-hns-Fix-deadlock-on-SRQ-async-events.patch
  (git-fixes CVE-2024-38591 bsc#1226738).
- Update
  patches.suse/RDMA-hns-Modify-the-print-level-of-CQE-error.patch
  (git-fixes CVE-2024-38590 bsc#1226839).
- Update
  patches.suse/RDMA-rxe-Fix-seg-fault-in-rxe_comp_queue_pkt.patch
  (git-fixes CVE-2024-38544 bsc#1226597).
- Update
  patches.suse/SUNRPC-Fix-RPC-client-cleaned-up-the-freed-pipefs-de.patch
  (git-fixes CVE-2023-52803 bsc#1225008).
- Update patches.suse/af_unix-Clear-stale-u-oob_skb.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-35970 bsc#1224584).
- Update
  patches.suse/af_unix-Drop-oob_skb-ref-before-purging-queue-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26750 bsc#1222617).
- Update
  patches.suse/af_unix-Fix-task-hung-while-purging-oob_skb-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26780 bsc#1222588).
- Update
  patches.suse/af_unix-Update-unix_sk-sk-oob_skb-under-sk_receive_queue-lock.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-36972 bsc#1226163).
- Update
  patches.suse/arm64-Restrict-CPU_BIG_ENDIAN-to-GNU-as-or-LLVM-IAS-.patch
  (git-fixes CVE-2023-52750 bsc#1225485).
- Update
  patches.suse/atl1c-Work-around-the-DMA-RX-overflow-issue.patch
  (git-fixes CVE-2023-52834 bsc#1225599).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issue-of-net_device.patch
  (git-fixes CVE-2024-38554 bsc#1226742).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issues-of-ax25_dev.patch
  (git-fixes CVE-2024-38602 bsc#1226613).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-reorder-of-WRITE-lqueued.patch
  (bsc#1225605 CVE-2024-38384 bsc#1226938).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-resetting-io-stat.patch
  (bsc#1225605 CVE-2024-38663 bsc#1226939).
- Update
  patches.suse/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch
  (git-fixes CVE-2024-38540 bsc#1226582).
- Update
  patches.suse/bonding-stop-the-device-in-bond_setup_by_slave.patch
  (git-fixes CVE-2023-52784 bsc#1224946).
- Update
  patches.suse/can-dev-can_put_echo_skb-don-t-crash-kernel-if-can_p.patch
  (git-fixes CVE-2023-52878 bsc#1225000).
- Update
  patches.suse/clk-mediatek-clk-mt2701-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52875 bsc#1225096).
- Update
  patches.suse/clk-mediatek-clk-mt6765-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52870 bsc#1224937).
- Update
  patches.suse/clk-mediatek-clk-mt6779-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52873 bsc#1225589).
- Update
  patches.suse/clk-mediatek-clk-mt6797-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52865 bsc#1225086).
- Update
  patches.suse/clk-mediatek-clk-mt7629-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52858 bsc#1225566).
- Update
  patches.suse/clk-mediatek-clk-mt7629-eth-Add-check-for-mtk_alloc_.patch
  (git-fixes CVE-2023-52876 bsc#1225036).
- Update
  patches.suse/cppc_cpufreq-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38573 bsc#1226739).
- Update patches.suse/cpufreq-exit-callback-is-optional.patch
  (git-fixes CVE-2024-38615 bsc#1226592).
- Update patches.suse/crypto-bcm-Fix-pointer-arithmetic.patch
  (git-fixes CVE-2024-38579 bsc#1226637).
- Update
  patches.suse/crypto-pcrypt-Fix-hungtask-for-PADATA_RESET.patch
  (git-fixes CVE-2023-52813 bsc#1225527).
- Update patches.suse/cxl-mem-Fix-shutdown-order.patch (git-fixes
  CVE-2023-52849 bsc#1224949).
- Update
  patches.suse/cxl-region-Do-not-try-to-cleanup-after-cxl_region_se.patch
  (git-fixes CVE-2023-52792 bsc#1225477).
- Update patches.suse/cxl-region-Fix-cxlr_pmem-leaks.patch
  (git-fixes CVE-2024-38391 bsc#1226894).
- Update
  patches.suse/dma-buf-sw-sync-don-t-enable-IRQ-from-sync_print_obj.patch
  (git-fixes CVE-2024-38780 bsc#1226886).
- Update
  patches.suse/dma-mapping-benchmark-fix-node-id-validation.patch
  (git-fixes CVE-2024-34777 bsc#1226796).
- Update
  patches.suse/dma-mapping-benchmark-handle-NUMA_NO_NODE-correctly.patch
  (git-fixes CVE-2024-39277 bsc#1226909).
- Update
  patches.suse/dmaengine-idxd-Avoid-unnecessary-destruction-of-file.patch
  (git-fixes CVE-2024-38629 bsc#1226905).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Pola.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52819
  bsc#1225532).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-SMU7.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52818
  bsc#1225530).
- Update
  patches.suse/drm-amd-check-num-of-link-levels-when-update-pcie-pa.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52812
  bsc#1225564).
- Update
  patches.suse/drm-amd-display-Avoid-NULL-dereference-of-timing-gen.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52753
  bsc#1225478).
- Update
  patches.suse/drm-amd-display-Fix-division-by-zero-in-setup_dsc_co.patch
  (stable-fixes CVE-2024-36969 bsc#1226155).
- Update
  patches.suse/drm-amd-display-Fix-null-pointer-dereference-in-erro.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52862
  bsc#1225015).
- Update
  patches.suse/drm-amd-display-Fix-potential-index-out-of-bounds-in.patch
  (git-fixes CVE-2024-38552 bsc#1226767).
- Update
  patches.suse/drm-amd-display-fix-a-NULL-pointer-dereference-in-am.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52773
  bsc#1225041).
- Update
  patches.suse/drm-amd-display-fixed-integer-types-and-null-check-l.patch
  (git-fixes CVE-2024-26767).
- Update
  patches.suse/drm-amdgpu-Fix-a-null-pointer-access-when-the-smc_rr.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52817
  bsc#1225569).
- Update
  patches.suse/drm-amdgpu-Fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch
  (git-fixes CVE-2024-39291 bsc#1226934).
- Update
  patches.suse/drm-amdgpu-Fix-potential-null-pointer-derefernce.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52814
  bsc#1225565).
- Update
  patches.suse/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch
  (stable-fixes CVE-2024-39471 bsc#1227096).
- Update
  patches.suse/drm-amdgpu-mes-fix-use-after-free-issue.patch
  (stable-fixes CVE-2024-38581 bsc#1226657).
- Update
  patches.suse/drm-amdgpu-vkms-fix-a-possible-null-pointer-derefere.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52815
  bsc#1225568).
- Update
  patches.suse/drm-amdkfd-Fix-a-race-condition-of-vram-buffer-unref.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52825
  bsc#1225076).
- Update
  patches.suse/drm-amdkfd-Fix-shift-out-of-bounds-issue.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52816
  bsc#1225529).
- Update
  patches.suse/drm-bridge-cdns-mhdp8546-Fix-possible-null-pointer-d.patch
  (git-fixes CVE-2024-38548).
- Update
  patches.suse/drm-bridge-it66121-Fix-invalid-connector-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52861
  bsc#1224941).
- Update
  patches.suse/drm-bridge-lt8912b-Fix-crash-on-bridge-detach.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52856
  bsc#1224932).
- Update
  patches.suse/drm-mediatek-Add-0-size-check-to-mtk_drm_gem_obj.patch
  (git-fixes CVE-2024-38549 bsc#1226735).
- Update
  patches.suse/drm-mediatek-Fix-coverity-issue-with-unintentional-i.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52857
  bsc#1225581).
- Update
  patches.suse/drm-mediatek-Init-ddp_comp-with-devm_kcalloc.patch
  (git-fixes CVE-2024-38592 bsc#1226844).
- Update
  patches.suse/drm-msm-a6xx-Avoid-a-nullptr-dereference-when-speedb.patch
  (git-fixes CVE-2024-38390 bsc#1226891).
- Update
  patches.suse/drm-msm-dpu-Add-callback-function-pointer-check-befo.patch
  (git-fixes CVE-2024-38622 bsc#1226856).
- Update
  patches.suse/drm-panel-fix-a-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52821
  bsc#1225022).
- Update
  patches.suse/drm-panel-panel-tpo-tpg110-fix-a-possible-null-point.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52826
  bsc#1225077).
- Update patches.suse/drm-radeon-possible-buffer-overflow.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52867
  bsc#1225009).
- Update
  patches.suse/drm-vc4-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38546 bsc#1226593).
- Update
  patches.suse/drm-vmwgfx-Fix-invalid-reads-in-fence-signaled-event.patch
  (git-fixes CVE-2024-36960 bsc#1225872).
- Update
  patches.suse/drm-zynqmp_dpsub-Always-register-bridge.patch
  (git-fixes CVE-2024-38664 bsc#1226941).
- Update
  patches.suse/e1000e-change-usleep_range-to-udelay-in-PHY-mdic-acc.patch
  (CVE-2024-39296 bsc#1226989 CVE-2024-36887 bsc#1225731).
- Update
  patches.suse/ecryptfs-Fix-buffer-size-for-tag-66-packet.patch
  (git-fixes CVE-2024-38578 bsc#1226634).
- Update
  patches.suse/efi-libstub-only-free-priv.runtime_map-when-allocate.patch
  (git-fixes CVE-2024-33619 bsc#1226768).
- Update
  patches.suse/fbdev-imsttfb-fix-a-resource-leak-in-probe.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52838
  bsc#1225031).
- Update
  patches.suse/fs-9p-only-translate-RWX-permissions-for-plain-9P200.patch
  (git-fixes CVE-2024-36964 bsc#1225866).
- Update
  patches.suse/fs-jfs-Add-check-for-negative-db_l2nbperpage.patch
  (git-fixes CVE-2023-52810 bsc#1225557).
- Update
  patches.suse/fs-jfs-Add-validity-check-for-db_maxag-and-db_agpref.patch
  (git-fixes CVE-2023-52804 bsc#1225550).
- Update
  patches.suse/ftrace-Fix-possible-use-after-free-issue-in-ftrace_location.patch
  (git-fixes CVE-2024-38588 bsc#1226837).
- Update
  patches.suse/genirq-irqdesc-Prevent-use-after-free-in-irq_find_at.patch
  (git-fixes CVE-2024-38385 bsc#1227085).
- Update patches.suse/gfs2-ignore-negated-quota-changes.patch
  (git-fixes CVE-2023-52759 bsc#1225560).
- Update
  patches.suse/hid-cp2112-Fix-duplicate-workqueue-initialization.patch
  (git-fixes CVE-2023-52853 bsc#1224988).
- Update
  patches.suse/hwmon-axi-fan-control-Fix-possible-NULL-pointer-dere.patch
  (git-fixes CVE-2023-52863 bsc#1225586).
- Update
  patches.suse/i2c-acpi-Unbind-mux-adapters-before-delete.patch
  (git-fixes CVE-2024-39362 bsc#1226995).
- Update
  patches.suse/i2c-core-Run-atomic-i2c-xfer-when-preemptible.patch
  (git-fixes CVE-2023-52791 bsc#1225108).
- Update
  patches.suse/i3c-master-mipi-i3c-hci-Fix-a-kernel-panic-for-acces.patch
  (git-fixes CVE-2023-52763 bsc#1225570).
- Update
  patches.suse/i3c-mipi-i3c-hci-Fix-out-of-bounds-access-in-hci_dma.patch
  (git-fixes CVE-2023-52766).
- Update
  patches.suse/i915-perf-Fix-NULL-deref-bugs-with-drm_dbg-calls.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52788
  bsc#1225106).
- Update
  patches.suse/igb-Fix-string-truncation-warnings-in-igb_set_fw_ver.patch
  (git-fixes CVE-2024-36010 bsc#1225594).
- Update
  patches.suse/iommu-vt-d-Fix-WARN_ON-in-iommu-probe-path.patch
  (git-fixes CVE-2024-35957 bsc#1224673).
- Update
  patches.suse/iommufd-Fix-missing-update-of-domains_itree-after-splitting-iopt
  (jsc#PED-7779 jsc#PED-7780 CVE-2023-52801 bsc#1225006).
- Update
  patches.suse/ipvlan-add-ipvlan_route_v6_outbound-helper.patch
  (git-fixes CVE-2023-52796 bsc#1224930).
- Update
  patches.suse/jffs2-prevent-xattr-node-from-overflowing-the-eraseblock.patch
  (git-fixes CVE-2024-38599 bsc#1226848).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-dbFindLeaf.patch
  (git-fixes CVE-2023-52799 bsc#1225472).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-diAlloc.patch
  (git-fixes CVE-2023-52805 bsc#1225553).
- Update
  patches.suse/kunit-fortify-Fix-mismatched-kvalloc-vfree-usage.patch
  (git-fixes CVE-2024-38617 bsc#1226859).
- Update
  patches.suse/lib-generic-radix-tree.c-Don-t-overflow-in-peek.patch
  (git-fixes CVE-2021-47432 bsc#1225391).
- Update
  patches.suse/lib-test_hmm.c-handle-src_pfns-and-dst_pfns-allocati.patch
  (git-fixes CVE-2024-38543 bsc#1226594).
- Update
  patches.suse/locking-ww_mutex-test-Fix-potential-workqueue-corrup.patch
  (bsc#1219953 CVE-2023-52836 bsc#1225609).
- Update
  patches.suse/md-Don-t-ignore-suspended-array-in-md_check_recovery-1baa.patch
  (bsc#1219596 CVE-2024-26758).
- Update
  patches.suse/media-atomisp-ssh_css-Fix-a-null-pointer-dereference.patch
  (git-fixes CVE-2024-38547 bsc#1226632).
- Update
  patches.suse/media-bttv-fix-use-after-free-error-due-to-btv-timeo.patch
  (git-fixes CVE-2023-52847 bsc#1225588).
- Update
  patches.suse/media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch
  (git-fixes CVE-2023-52764 bsc#1225571).
- Update
  patches.suse/media-hantro-Check-whether-reset-op-is-defined-befor.patch
  (git-fixes CVE-2023-52850 bsc#1225014).
- Update
  patches.suse/media-i2c-et8ek8-Don-t-strip-remove-function-when-dr.patch
  (git-fixes CVE-2024-38611 bsc#1226760).
- Update
  patches.suse/media-imon-fix-access-to-invalid-resource-for-the-se.patch
  (git-fixes CVE-2023-52754 bsc#1225490).
- Update
  patches.suse/media-lgdt3306a-Add-a-check-against-null-pointer-def.patch
  (stable-fixes CVE-2022-48772 bsc#1226976).
- Update
  patches.suse/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch
  (git-fixes CVE-2024-38621 bsc#1226895).
- Update
  patches.suse/media-vidtv-mux-Add-check-and-kfree-for-kstrdup.patch
  (git-fixes CVE-2023-52841 bsc#1225592).
- Update patches.suse/media-vidtv-psi-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52844 bsc#1225590).
- Update
  patches.suse/mfd-qcom-spmi-pmic-Fix-revid-implementation.patch
  (git-fixes CVE-2023-52765 bsc#1225029).
- Update
  patches.suse/misc-microchip-pci1xxxx-fix-double-free-in-the-error.patch
  (git-fixes CVE-2024-36973 bsc#1226457).
- Update
  patches.suse/net-hns3-fix-out-of-bounds-access-may-occur-when-coa.patch
  (git-fixes CVE-2023-52807 bsc#1225097).
- Update
  patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch
  (git-fixes CVE-2024-36962 bsc#1225827).
- Update
  patches.suse/net-mlx5-Fix-peer-devlink-set-for-SF-representor-dev.patch
  (git-fixes CVE-2024-38595 bsc#1226741).
- Update
  patches.suse/net-mlx5e-Track-xmit-submission-to-PTP-WQ-after-popu.patch
  (jsc#PED-3311 CVE-2023-52782 bsc#1225103).
- Update
  patches.suse/net-mvneta-fix-calls-to-page_pool_get_stats.patch
  (git-fixes CVE-2023-52780 bsc#1224933).
- Update
  patches.suse/net-wangxun-fix-kernel-panic-due-to-null-pointer.patch
  (git-fixes CVE-2023-52783 bsc#1225104).
- Update
  patches.suse/netfilter-complete-validation-of-user-input.patch
  (git-fixes CVE-2024-35896 bsc#1224662 CVE-2024-35962
  bsc#1224583).
- Update
  patches.suse/nfc-nci-Fix-uninit-value-in-nci_rx_work.patch
  (git-fixes CVE-2024-38381 bsc#1226878).
- Update
  patches.suse/nilfs2-fix-nilfs_empty_dir-misjudgment-and-long-loop.patch
  (git-fixes CVE-2024-39469 bsc#1226992).
- Update
  patches.suse/nilfs2-fix-potential-hang-in-nilfs_detach_log_writer.patch
  (git-fixes CVE-2024-38582 bsc#1226658).
- Update
  patches.suse/nilfs2-fix-use-after-free-of-timer-for-log-writer-th.patch
  (git-fixes CVE-2024-38583 bsc#1226777).
- Update
  patches.suse/of-module-add-buffer-overflow-check-in-of_modalias.patch
  (git-fixes CVE-2024-38541 bsc#1226587).
- Update
  patches.suse/padata-Fix-refcnt-handling-in-padata_free_shell.patch
  (git-fixes CVE-2023-52854 bsc#1225584).
- Update
  patches.suse/perf-core-Bail-out-early-if-the-request-AUX-area-is-out-of-bound.patch
  (git-fixes CVE-2023-52835 bsc#1225602).
- Update
  patches.suse/platform-x86-wmi-Fix-opening-of-char-device.patch
  (git-fixes CVE-2023-52864 bsc#1225132).
- Update
  patches.suse/powerpc-pseries-iommu-LPAR-panics-during-boot-up-wit.patch
  (bsc#1222011 ltc#205900 CVE-2024-36926 bsc#1225829).
- Update patches.suse/pstore-platform-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52869 bsc#1225050).
- Update
  patches.suse/remoteproc-mediatek-Make-sure-IPI-buffer-fits-in-L2T.patch
  (git-fixes CVE-2024-36965 bsc#1226149).
- Update
  patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch
  (git-fixes CVE-2024-38601 bsc#1226876).
- Update
  patches.suse/s390-dasd-protect-device-queue-against-concurrent-access.patch
  (git-fixes bsc#1217481 CVE-2023-52774 bsc#1225572).
- Update
  patches.suse/scsi-hisi_sas-Set-debugfs_dir-pointer-to-NULL-after-removing-debugfs.patch
  (git-fixes CVE-2023-52808 bsc#1225555).
- Update
  patches.suse/scsi-ibmvfc-Remove-BUG_ON-in-the-case-of-an-empty-ev.patch
  (bsc#1209834 ltc#202097 CVE-2023-52811 bsc#1225559).
- Update
  patches.suse/scsi-libfc-Fix-potential-NULL-pointer-dereference-in-fc_lport_ptp_setup.patch
  (git-fixes CVE-2023-52809 bsc#1225556).
- Update
  patches.suse/scsi-lpfc-Move-NPIV-s-transport-unregistration-to-af.patch
  (bsc#1221777 CVE-2024-36952 bsc#1225898).
- Update
  patches.suse/scsi-lpfc-Release-hbalock-before-calling-lpfc_worker.patch
  (bsc#1221777 CVE-2024-36924 bsc#1225820).
- Update
  patches.suse/serial-max3100-Lock-port-lock-when-calling-uart_hand.patch
  (git-fixes CVE-2024-38634 bsc#1226868).
- Update
  patches.suse/serial-max3100-Update-uart_driver_registered-on-driv.patch
  (git-fixes CVE-2024-38633 bsc#1226867).
- Update
  patches.suse/soc-qcom-llcc-Handle-a-second-device-without-data-co.patch
  (git-fixes CVE-2023-52871 bsc#1225534).
- Update
  patches.suse/soundwire-cadence-fix-invalid-PDI-offset.patch
  (stable-fixes CVE-2024-38635 bsc#1226863).
- Update patches.suse/speakup-Fix-sizeof-vs-ARRAY_SIZE-bug.patch
  (git-fixes CVE-2024-38587 bsc#1226780).
- Update patches.suse/spi-Fix-null-dereference-on-suspend.patch
  (git-fixes CVE-2023-52749 bsc#1225476).
- Update
  patches.suse/thermal-core-prevent-potential-string-overflow.patch
  (git-fixes CVE-2023-52868 bsc#1225044).
- Update
  patches.suse/thermal-drivers-qcom-lmh-Check-for-SCM-availability-.patch
  (git-fixes CVE-2024-39466 bsc#1227089).
- Update
  patches.suse/thermal-drivers-tsens-Fix-null-pointer-dereference.patch
  (git-fixes CVE-2024-38571 bsc#1226737).
- Update
  patches.suse/thermal-intel-powerclamp-fix-mismatch-in-get-functio.patch
  (git-fixes CVE-2023-52794 bsc#1225028).
- Update
  patches.suse/tls-fix-NULL-deref-on-tls_sw_splice_eof-with-empty-r.patch
  (jsc#PED-6831 CVE-2023-52767 bsc#1224998).
- Update
  patches.suse/tpm_tis_spi-Account-for-SPI-header-when-allocating-T.patch
  (git-fixes CVE-2024-36477 bsc#1226840).
- Update
  patches.suse/tracing-Have-trace_event_file-have-ref-counters.patch
  (git-fixes CVE-2023-52879 bsc#1225101).
- Update
  patches.suse/tracing-trigger-Fix-to-return-error-if-failed-to-alloc-snapshot.patch
  (git-fixes CVE-2024-26920).
- Update
  patches.suse/tty-n_gsm-fix-race-condition-in-status-line-change-o.patch
  (git-fixes CVE-2023-52872 bsc#1225591).
- Update
  patches.suse/tty-n_gsm-require-CAP_NET_ADMIN-to-attach-N_GSM0710-.patch
  (bsc#1222619 CVE-2023-52880).
- Update
  patches.suse/tty-vcc-Add-check-for-kstrdup-in-vcc_probe.patch
  (git-fixes CVE-2023-52789 bsc#1225180).
- Update
  patches.suse/usb-config-fix-iteration-issue-in-usb_get_bos_descri.patch
  (git-fixes CVE-2023-52781 bsc#1225092).
- Update
  patches.suse/usb-dwc3-Wait-unconditionally-after-issuing-EndXfer-.patch
  (git-fixes CVE-2024-36977 bsc#1226513).
- Update
  patches.suse/usb-gadget-u_audio-Fix-race-condition-use-of-control.patch
  (git-fixes CVE-2024-38628 bsc#1226911).
- Update
  patches.suse/usb-storage-alauda-Check-whether-the-media-is-initia.patch
  (git-fixes CVE-2024-38619 bsc#1226861).
- Update
  patches.suse/usb-typec-tcpm-Fix-NULL-pointer-dereference-in-tcpm_.patch
  (git-fixes CVE-2023-52877 bsc#1224944).
- Update
  patches.suse/vhost-vdpa-fix-use-after-free-in-vhost_vdpa_probe.patch
  (jsc#PED-3311 CVE-2023-52795 bsc#1225085).
- Update
  patches.suse/virtio-blk-fix-implicit-overflow-on-virtio_max_dma_s.patch
  (git-fixes CVE-2023-52762 bsc#1225573).
- Update
  patches.suse/virtio-vsock-Fix-uninit-value-in-virtio_transport_re.patch
  (jsc#PED-5505 CVE-2023-52842 bsc#1225025).
- Update
  patches.suse/watchdog-cpu5wdt.c-Fix-use-after-free-bug-caused-by-.patch
  (git-fixes CVE-2024-38630 bsc#1226908).
- Update
  patches.suse/wifi-ar5523-enable-proper-endpoint-verification.patch
  (git-fixes CVE-2024-38565 bsc#1226747).
- Update
  patches.suse/wifi-ath11k-fix-dfs-radar-event-locking.patch
  (git-fixes CVE-2023-52798 bsc#1224947).
- Update
  patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch
  (git-fixes CVE-2023-52777 bsc#1224992).
- Update patches.suse/wifi-ath11k-fix-htt-pktlog-locking.patch
  (git-fixes CVE-2023-52800).
- Update
  patches.suse/wifi-ath12k-fix-dfs-radar-and-temperature-event-lock.patch
  (git-fixes CVE-2023-52776 bsc#1225090).
- Update
  patches.suse/wifi-ath12k-fix-htt-mlo-offset-event-locking.patch
  (git-fixes CVE-2023-52769 bsc#1225001).
- Update
  patches.suse/wifi-ath12k-fix-out-of-bound-access-of-qmi_invoke_ha.patch
  (git-fixes CVE-2024-38572 bsc#1226776).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-read-in-ath12k.patch
  (git-fixes CVE-2023-52827 bsc#1225078).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-write-in-ath12.patch
  (git-fixes CVE-2023-52829 bsc#1225081).
- Update
  patches.suse/wifi-brcmfmac-pcie-handle-randbuf-allocation-failure.patch
  (git-fixes CVE-2024-38575 bsc#1226612).
- Update
  patches.suse/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch
  (git-fixes CVE-2024-38567 bsc#1226769).
- Update
  patches.suse/wifi-carl9170-re-fix-fortified-memset-warning.patch
  (git-fixes CVE-2024-38616 bsc#1226852).
- Update
  patches.suse/wifi-mac80211-don-t-return-unset-power-in-ieee80211_.patch
  (git-fixes CVE-2023-52832 bsc#1225577).
- Update
  patches.suse/wifi-nl80211-Avoid-address-calculations-via-out-of-b.patch
  (git-fixes CVE-2024-38562 bsc#1226788).
- Update
  patches.suse/wifi-wilc1000-use-vmm_table-as-array-in-wilc-struct.patch
  (git-fixes CVE-2023-52768 bsc#1225004).
- Update
  patches.suse/x86-tdx-Zero-out-the-missing-RSI-in-TDX_HYPERCALL-macro.patch
  (jsc#PED-5824 CVE-2023-52874 bsc#1225049).
- commit 33efdc4</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835204">- tcp: Use refcount_inc_not_zero() in tcp_twsk_unique()
  (CVE-2024-36904 bsc#1225732).
- commit d578dcc</changelog>
  <changelog author="heming.zhao@suse.com" date="1719921600">- gfs2: Fix potential glock use-after-free on unmount (bsc#1226775
  CVE-2024-38570).
- gfs2: Rename sd_{ glock =&gt; kill }_wait (bsc#1226775
  CVE-2024-38570).
- commit f3adbca</changelog>
  <changelog author="tiwai@suse.de" date="1719921601">- Correct SCSI patch references (bsc#1225767 CVE-2024-36919 bsc#1226785 CVE-2024-38559)
- commit e8ea587</changelog>
  <changelog author="tiwai@suse.de" date="1719921602">- mtd: rawnand: rockchip: ensure NVDDR timings are rejected
  (git-fixes).
- mtd: rawnand: Bypass a couple of sanity checks during NAND
  identification (git-fixes).
- mtd: rawnand: Fix the nand_read_data_op() early check
  (git-fixes).
- mtd: rawnand: Ensure ECC configuration is propagated to upper
  layers (git-fixes).
- commit e545951</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1719921603">- kernel-doc: fix struct_group_tagged() parsing (git-fixes).
- commit e3a2a2e</changelog>
  <changelog author="fdmanana@suse.com" date="1719921604">- btrfs: fix crash on racing fsync and size-extending write into
  prealloc (bsc#1227101 CVE-2024-37354).
- commit 1d355af</changelog>
  <changelog author="vbabka@suse.cz" date="1719921605">- virt: acrn: stop using follow_pfn (CVE-2024-38610 bsc#1226758).
- commit c2ea51b</changelog>
  <changelog author="vbabka@suse.cz" date="1719921606">- drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
  (CVE-2024-38610 bsc#1226758).
- commit 7069ac2</changelog>
  <changelog author="rhopkins@suse.de" date="1719921607">- hsr: Prevent use after free in prp_create_tagged_frame()
  (CVE-2023-52846 bsc#1225098).
- commit cf63988</changelog>
  <changelog author="krisman@suse.de" date="1719921608">- io_uring: Fix io_cqring_wait() not restoring sigmask on
  get_timespec64() failure (git-fixes).
- commit e640a65</changelog>
  <changelog author="krisman@suse.de" date="1719921609">- io_uring: check for non-NULL file pointer in io_file_can_poll()
  (bsc#1226990 CVE-2024-39371).
- io_uring/io-wq: Use set_bit() and test_bit() at worker-&gt;flags
  (git-fixes).
- io_uring/sqpoll: work around a potential audit memory leak
  (git-fixes).
- commit 24603fc</changelog>
  <changelog author="krisman@suse.de" date="1719921610">- io_uring/rsrc: fix incorrect assignment of iter-&gt;nr_segs in
  io_import_fixed (git-fixes).
- io_uring/rsrc: don't lock while !TASK_RUNNING (git-fixes).
- io_uring/io-wq: avoid garbage value of 'match' in
  io_wq_enqueue() (git-fixes).
- commit 7d3e252</changelog>
</package>
<package pkgid="6a808b4ce3f7aded5a3fd676c036c1d92bc0b3844cdccac1cc6444da4be71c08" name="dtb-cavium" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.17.1"/>
  <changelog author="tiwai@suse.de" date="1722081600">- auxdisplay: ht16k33: Drop reference after LED registration
  (git-fixes).
- ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
  on unprepare (git-fixes).
- ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
- ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
  reachable (git-fixes).
- ASoC: sof: amd: fix for firmware reload failure in Vangogh
  platform (git-fixes).
- ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
- ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
  (git-fixes).
- ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
- ALSA: ump: Don't update FB name for static blocks (git-fixes).
- drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
- drm/i915/gt: Do not consider preemption during execlists_dequeue
  for gen8 (git-fixes).
- drm/i915/dp: Don't switch the LTTPR mode on an active link
  (git-fixes).
- commit d7e2deb</changelog>
  <changelog author="tiwai@suse.de" date="1722081601">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
</package>
<package pkgid="cdf0fc6ff640763f19677037c76d71949a9ff992711fa914e20916c09b7c6fb3" name="dtb-cavium" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.7.1"/>
  <changelog author="mkubecek@suse.cz" date="1717416000">- netfilter: nf_tables: release mutex after nft_gc_seq_end from
  abort path (CVE-2024-26925 bsc#1223390).
- commit 578a709</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717416001">- Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
  The L3 bsc#1225765 was created seperately since our customer requires
  PTF.
- Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
- Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
- Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
- Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
- commit 054635e</changelog>
  <changelog author="msuchanek@suse.de" date="1717416002">- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
- powerpc/uaccess: Fix build errors seen with GCC 13/14
  (bsc#1194869).
- commit 46b5d84</changelog>
  <changelog author="msuchanek@suse.de" date="1717416003">- blacklist.conf: PPC fsl_msi is not used
- commit ae6590d</changelog>
  <changelog author="msuchanek@suse.de" date="1717416004">- powerpc/pseries/lparcfg: drop error message from guest name
  lookup (bsc#1187716 ltc#193451 git-fixes).
- commit ceab637</changelog>
  <changelog author="mfranc@suse.cz" date="1717416005">- Update
  patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
  (git-fixes CVE-2024-36955).
- Update
  patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
  (git-fixes bsc#1225715 CVE-2024-36906).
- Update
  patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
  (git-fixes bsc#1225579 CVE-2024-36011).
- Update
  patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
  (git-fixes bsc#1225578 CVE-2024-36013).
- Update
  patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
  (git-fixes bsc#1225502 CVE-2024-36012).
- Update
  patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
  (git-fixes bsc#1225722 CVE-2024-36880).
- Update
  patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
  (git-fixes CVE-2024-36942).
- Update
  patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
  (git-fixes bsc#1225720 CVE-2024-36032).
- Update
  patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
  (git-fixes bsc#1223749 CVE-2024-26990).
- Update
  patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
  (git-fixes bsc#1223692 CVE-2024-26992).
- Update
  patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
  (stable-fixes CVE-2024-36944).
- Update
  patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
  (git-fixes bsc#1225734 CVE-2024-36896).
- Update
  patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
  (stable-fixes CVE-2024-36949).
- Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
  (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
- Update
  patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
  (git-fixes bsc#1225692 CVE-2023-52882).
- Update
  patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
  (git-fixes CVE-2024-26761).
- Update
  patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
  (stable-fixes bsc#1225735 CVE-2024-36897).
- Update
  patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
  (stable-fixes bsc#1225705 CVE-2024-36026).
- Update
  patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
  (stable-fixes CVE-2024-36951).
- Update
  patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
  (git-fixes bsc#1225593 CVE-2024-36014).
- Update
  patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
  (stable-fixes bsc#1225728 CVE-2024-36885).
- Update
  patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
  (git-fixes bsc#1225773 CVE-2024-36936).
- Update
  patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
  (stable-fixes CVE-2024-36950).
- Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
  (git-fixes bsc#1225736 CVE-2024-36898).
- Update
  patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
  (git-fixes bsc#1225698 CVE-2024-36020).
- Update
  patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
  (git-fixes bsc#1225710 CVE-2024-36891).
- Update
  patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
  (git-fixes bsc#1225714 CVE-2024-36890).
- Update
  patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
  (git-fixes bsc#1225708 CVE-2024-36029).
- Update
  patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
  (git-fixes bsc#1225699 CVE-2024-36021).
- Update
  patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
  (git-fixes CVE-2024-26943).
- Update
  patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
  (git-fixes bsc#1225694 CVE-2024-36018).
- Update
  patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
  (git-fixes CVE-2024-36940).
- Update
  patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
  (git-fixes CVE-2024-36959).
- Update
  patches.suse/ppdev-Add-an-error-check-in-register_device.patch
  (git-fixes bsc#1225640 CVE-2024-36015).
- Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
  CVE-2024-36947).
- Update
  patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
  (git-fixes bsc#1225695 CVE-2024-36019).
- Update
  patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
  (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
- Update
  patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
  (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
- Update
  patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
  (git-fixes bsc#1225704 CVE-2024-36025).
- Update
  patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
  (git-fixes CVE-2024-36930).
- Update
  patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
  (bsc#1224331 bsc#1224602 CVE-2024-35814).
- Update
  patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
  (git-fixes bsc#1225642 CVE-2024-36016).
- Update
  patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
  (git-fixes bsc#1225749 CVE-2024-36894).
- Update
  patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
  (git-fixes bsc#1225750 CVE-2024-36895).
- Update
  patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
  (git-fixes bsc#1225748 CVE-2024-36893).
- Update
  patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
  (stable-fixes bsc#1225769 CVE-2024-36921).
- Update
  patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
  (stable-fixes CVE-2024-36922).
- Update
  patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
  (git-fixes CVE-2024-36941).
- Update
  patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
  (git-fixes bsc#1224742 CVE-2024-35803).
- commit 539780f</changelog>
  <changelog author="dwagner@suse.de" date="1717416006">- nvmet: fix ns enable/disable possible hang (git-fixes).
- nvme-multipath: fix io accounting on failover (git-fixes).
- nvme: fix multipath batched completion accounting (git-fixes).
- commit ed3b392</changelog>
  <changelog author="dwagner@suse.de" date="1717416007">- scsi: lpfc: Copyright updates for 14.4.0.2 patches
  (bsc#1225842).
- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
  (bsc#1225842).
  Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
  (bsc#1225842).
- scsi: lpfc: Clear deferred RSCN processing flag when driver
  is unloading (bsc#1225842).
- scsi: lpfc: Update logging of protection type for T10 DIF I/O
  (bsc#1225842).
- scsi: lpfc: Change default logging level for unsolicited CT
  MIB commands (bsc#1225842).
- commit 5a56384</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416008">- smb: client: fix mount when dns_resolver key is not available
  (git-fixes, bsc#1225172).
- commit 28edb5c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416009">- cifs: fix leak of iface for primary channel (git-fixes,
  bsc#1225172).
- commit b7eb8e8</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416010">- Revert "cifs: reconnect work should have reference on server
  struct" (git-fixes, bsc#1225172).
- commit 3ca4c0c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416011">- smb: client: fix parsing of SMB3.1.1 POSIX create context
  (git-fixes, bsc#1225172).
- commit 5f27f69</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416012">- cifs: failure to add channel on iface should bump up weight
  (git-fixes, bsc#1225172).
- commit 007b237</changelog>
  <changelog author="tonyj@suse.de" date="1717416013">- perf/x86: Fix out of range data (git-fixes).
- perf/x86/intel/ds: Don't clear -&gt;pebs_data_cfg for the last
  PEBS event (git-fixes).
- perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
- commit 664d77f</changelog>
  <changelog author="dsterba@suse.com" date="1717588800">- blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
- Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
  Quoting bsc#1225945#c11:
  "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
  transaction for every subvol create")
  ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
  unwritten extent buffer after snapshotting a new subvolume") was never
  backported."
- commit d947258</changelog>
  <changelog author="tonyj@suse.de" date="1717588801">- perf pmu: Count sys and cpuid JSON events separately (git
  fixes).
- perf stat: Don't display metric header for non-leader uncore
  events (git-fixes).
- perf daemon: Fix file leak in daemon_session__control
  (git-fixes).
- perf symbols: Fix ownership of string in dso__load_vmlinux()
  (git-fixes).
- perf thread: Fixes to thread__new() related to initializing comm
  (git-fixes).
- perf report: Avoid SEGV in report__setup_sample_type()
  (git-fixes).
- perf ui browser: Don't save pointer to stack memory (git-fixes).
- perf bench internals inject-build-id: Fix trap divide when
  collecting just one DSO (git-fixes).
- perf intel-pt: Fix unassigned instruction op (discovered by
  MemorySanitizer) (git-fixes).
- perf test shell arm_coresight: Increase buffer size for
  Coresight basic tests (git-fixes).
- perf docs: Document bpf event modifier (git-fixes).
- perf bench uprobe: Remove lib64 from libc.so.6 binary path
  (git-fixes).
- perf record: Fix debug message placement for test consumption
  (git-fixes).
- perf tests: Apply attributes to all events in object code
  reading test (git-fixes).
- perf tests: Make "test data symbol" more robust on Neoverse N1
  (git-fixes).
- perf annotate: Fix annotation_calc_lines() to pass correct
  address to get_srcline() (git-fixes).
- perf stat: Do not fail on metrics on s390 z/VM systems
  (git-fixes).
- perf sched timehist: Fix -g/--call-graph option failure
  (git-fixes).
- perf annotate: Get rid of duplicate --group option item
  (git-fixes).
- perf probe: Add missing libgen.h header needed for using
  basename() (git-fixes).
- perf record: Delete session after stopping sideband thread
  (git-fixes).
- perf auxtrace: Fix multiple use of --itrace option (git-fixes).
- perf script: Show also errors for --insn-trace option
  (git-fixes).
- perf lock contention: Add a missing NULL check (git-fixes).
- perf vendor events amd: Fix Zen 4 cache latency events
  (git-fixes).
- libperf evlist: Avoid out-of-bounds access (git-fixes).
- perf pmu: Fix a potential memory leak in perf_pmu__lookup()
  (git-fixes).
- perf print-events: make is_event_supported() more robust
  (git-fixes).
- perf list: fix short description for some cache events
  (git-fixes).
- perf metric: Don't remove scale from counts (git-fixes).
- perf stat: Avoid metric-only segv (git-fixes).
- perf expr: Fix "has_event" function for metric style events
  (git-fixes).
- perf srcline: Add missed addr2line closes (git-fixes).
- perf thread_map: Free strlist on normal path in
  thread_map__new_by_tid_str() (git-fixes).
- perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
- perf jevents: Drop or simplify small integer values (git-fixes).
- perf evsel: Fix duplicate initialization of data-&gt;id in
  evsel__parse_sample() (git-fixes).
- perf pmu: Treat the msr pmu as software (git-fixes).
- perf record: Check conflict between '--timestamp-filename'
  option and pipe mode before recording (git-fixes).
- perf record: Fix possible incorrect free in
  record__switch_output() (git-fixes).
- perf vendor events amd: Add Zen 4 memory controller events
  (git-fixes).
- perf top: Uniform the event name for the hybrid machine
  (git-fixes).
- perf top: Use evsel's cpus to replace user_requested_cpus
  (git-fixes).
- commit a1f9340</changelog>
  <changelog author="tonyj@suse.de" date="1717675200">- perf ui browser: Avoid SEGV on title (git fixes).
- commit 1578c22</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675201">- inet: inet_defrag: prevent sk release while still in use
  (CVE-2024-26921 bsc#1223138).
- commit 2016faf</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675202">- net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
- commit 7bf5961</changelog>
  <changelog author="tiwai@suse.de" date="1718366400">- Temporarily drop KVM patch that caused a regression (bsc#1226158)
  Delete patches.suse/KVM-x86-pmu-Prioritize-VMX-interception-over-GP-on-R.patch
- commit 33f31da</changelog>
</package>
<package pkgid="bf012aecd6bbddff3d3e330c75a00649eb823aa92afbc8e545848c84e917fdad" name="dtb-exynos" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.14.1"/>
  <changelog author="tiwai@suse.de" date="1719662400">- gpiolib: cdev: Disallow reconfiguration without direction
  (uAPI v1) (git-fixes).
- gpio: davinci: Validate the obtained number of IRQs (git-fixes).
- commit 919ebd1</changelog>
  <changelog author="tiwai@suse.de" date="1719748800">- i2c: testunit: discard write requests while old command is
  running (git-fixes).
- i2c: testunit: don't erase registers after STOP (git-fixes).
- mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
  (git-fixes).
- mmc: sdhci: Do not invert write-protect twice (git-fixes).
- mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
  (git-fixes).
- mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
  (git-fixes).
- commit 448487d</changelog>
  <changelog author="tiwai@suse.de" date="1719748801">- crypto: iaa - Account for cpu-less numa nodes (bsc#1227190).
- commit cd600aa</changelog>
  <changelog author="tiwai@suse.de" date="1719748802">- crypto: deflate - Add aliases to deflate (bsc#1227190).
- commit 27ffd92</changelog>
  <changelog author="tiwai@suse.de" date="1719835200">- ata: ahci: Clean up sysfs file on error (git-fixes).
- ata: libata-core: Fix double free on error (git-fixes).
- ata,scsi: libata-core: Do not leak memory for ata_port struct
  members (git-fixes).
- ata: libata-core: Fix null pointer dereference on error
  (git-fixes).
- kbuild: Fix build target deb-pkg: ln: failed to create hard link
  (git-fixes).
- kbuild: doc: Update default INSTALL_MOD_DIR from extra to
  updates (git-fixes).
- kbuild: Install dtb files as 0644 in Makefile.dtbinst
  (git-fixes).
- counter: ti-eqep: enable clock at probe (git-fixes).
- iio: chemical: bme680: Fix sensor data read operation
  (git-fixes).
- iio: chemical: bme680: Fix overflows in compensate() functions
  (git-fixes).
- iio: chemical: bme680: Fix calibration data variable
  (git-fixes).
- iio: chemical: bme680: Fix pressure value output (git-fixes).
- iio: accel: fxls8962af: select IIO_BUFFER &amp; IIO_KFIFO_BUF
  (git-fixes).
- iio: adc: ad7266: Fix variable checking bug (git-fixes).
- iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
  (git-fixes).
- serial: bcm63xx-uart: fix tx after conversion to
  uart_port_tx_limited() (git-fixes).
- serial: core: introduce uart_port_tx_limited_flags()
  (git-fixes).
- Revert "serial: core: only stop transmit when HW fifo is empty"
  (git-fixes).
- tty: mcf: MCF54418 has 10 UARTS (git-fixes).
- usb: gadget: aspeed_udc: fix device address configuration
  (git-fixes).
- usb: dwc3: core: remove lock of otg mode during gadget
  suspend/resume to avoid deadlock (git-fixes).
- usb: typec: ucsi: glink: fix child node release in probe
  function (git-fixes).
- usb: musb: da8xx: fix a resource leak in probe() (git-fixes).
- usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  (git-fixes).
- usb: gadget: printer: fix races against disable (git-fixes).
- PCI/MSI: Fix UAF in msi_capability_init (git-fixes).
- commit a2ea5a9</changelog>
  <changelog author="ptesarik@suse.com" date="1719835201">- net: ena: Fix redundant device NUMA node override
  (jsc#PED-8688).
- commit 6ad6684</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835202">- tcp: do not accept ACK of bytes we never sent (CVE-2023-52881
  bsc#1225611).
- commit 16404a6</changelog>
  <changelog author="mhocko@suse.com" date="1719835203">- Update
  patches.suse/1352-drm-amdgpu-Fix-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52883
  bsc#1226630).
- Update
  patches.suse/9p-add-missing-locking-around-taking-dentry-fid-list.patch
  (git-fixes CVE-2024-39463 bsc#1227090).
- Update
  patches.suse/ALSA-Fix-deadlocks-with-kctl-removals-at-disconnecti.patch
  (stable-fixes CVE-2024-38600 bsc#1226864).
- Update
  patches.suse/ALSA-core-Fix-NULL-module-pointer-assignment-at-card.patch
  (git-fixes CVE-2024-38605 bsc#1226740).
- Update
  patches.suse/ALSA-hda-Fix-possible-null-ptr-deref-when-assigning-.patch
  (git-fixes CVE-2023-52806 bsc#1225554).
- Update
  patches.suse/ALSA-hda-cs_dsp_ctl-Use-private_free-for-control-cle.patch
  (git-fixes CVE-2024-38388 bsc#1226890).
- Update
  patches.suse/ALSA-timer-Set-lower-bound-of-start-tick-time.patch
  (stable-fixes git-fixes CVE-2024-38618 bsc#1226754).
- Update
  patches.suse/ASoC-kirkwood-Fix-potential-NULL-dereference.patch
  (git-fixes CVE-2024-38550 bsc#1226633).
- Update
  patches.suse/ASoC-mediatek-Assign-dummy-when-codec-not-specified-.patch
  (git-fixes CVE-2024-38551 bsc#1226761).
- Update
  patches.suse/Bluetooth-btusb-Add-date-evt_skb-is-NULL-check.patch
  (git-fixes CVE-2023-52833 bsc#1225595).
- Update
  patches.suse/Bluetooth-hci_core-Fix-possible-buffer-overflow.patch
  (git-fixes CVE-2024-26889).
- Update
  patches.suse/HID-uclogic-Fix-user-memory-access-bug-in-uclogic_pa.patch
  (git-fixes CVE-2023-52866 bsc#1225120).
- Update
  patches.suse/IB-mlx5-Fix-init-stage-error-handling-to-avoid-doubl.patch
  (jsc#PED-6864 CVE-2023-52851 bsc#1225587).
- Update
  patches.suse/Input-cyapa-add-missing-input-core-locking-to-suspen.patch
  (git-fixes CVE-2023-52884 bsc#1226764).
- Update
  patches.suse/Input-synaptics-rmi4-fix-use-after-free-in-rmi_unreg.patch
  (git-fixes CVE-2023-52840 bsc#1224928).
- Update
  patches.suse/KEYS-trusted-Do-not-use-WARN-when-encode-fails.patch
  (git-fixes CVE-2024-36975 bsc#1226520).
- Update
  patches.suse/KEYS-trusted-Fix-memory-leak-in-tpm2_key_encode.patch
  (git-fixes CVE-2024-36967 bsc#1226131).
- Update
  patches.suse/RDMA-cma-Fix-kmemleak-in-rdma_core-observed-during-b.patch
  (git-fixes CVE-2024-38539 bsc#1226608).
- Update patches.suse/RDMA-hns-Fix-UAF-for-cq-async-event.patch
  (git-fixes CVE-2024-38545 bsc#1226595).
- Update
  patches.suse/RDMA-hns-Fix-deadlock-on-SRQ-async-events.patch
  (git-fixes CVE-2024-38591 bsc#1226738).
- Update
  patches.suse/RDMA-hns-Modify-the-print-level-of-CQE-error.patch
  (git-fixes CVE-2024-38590 bsc#1226839).
- Update
  patches.suse/RDMA-rxe-Fix-seg-fault-in-rxe_comp_queue_pkt.patch
  (git-fixes CVE-2024-38544 bsc#1226597).
- Update
  patches.suse/SUNRPC-Fix-RPC-client-cleaned-up-the-freed-pipefs-de.patch
  (git-fixes CVE-2023-52803 bsc#1225008).
- Update patches.suse/af_unix-Clear-stale-u-oob_skb.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-35970 bsc#1224584).
- Update
  patches.suse/af_unix-Drop-oob_skb-ref-before-purging-queue-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26750 bsc#1222617).
- Update
  patches.suse/af_unix-Fix-task-hung-while-purging-oob_skb-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26780 bsc#1222588).
- Update
  patches.suse/af_unix-Update-unix_sk-sk-oob_skb-under-sk_receive_queue-lock.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-36972 bsc#1226163).
- Update
  patches.suse/arm64-Restrict-CPU_BIG_ENDIAN-to-GNU-as-or-LLVM-IAS-.patch
  (git-fixes CVE-2023-52750 bsc#1225485).
- Update
  patches.suse/atl1c-Work-around-the-DMA-RX-overflow-issue.patch
  (git-fixes CVE-2023-52834 bsc#1225599).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issue-of-net_device.patch
  (git-fixes CVE-2024-38554 bsc#1226742).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issues-of-ax25_dev.patch
  (git-fixes CVE-2024-38602 bsc#1226613).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-reorder-of-WRITE-lqueued.patch
  (bsc#1225605 CVE-2024-38384 bsc#1226938).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-resetting-io-stat.patch
  (bsc#1225605 CVE-2024-38663 bsc#1226939).
- Update
  patches.suse/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch
  (git-fixes CVE-2024-38540 bsc#1226582).
- Update
  patches.suse/bonding-stop-the-device-in-bond_setup_by_slave.patch
  (git-fixes CVE-2023-52784 bsc#1224946).
- Update
  patches.suse/can-dev-can_put_echo_skb-don-t-crash-kernel-if-can_p.patch
  (git-fixes CVE-2023-52878 bsc#1225000).
- Update
  patches.suse/clk-mediatek-clk-mt2701-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52875 bsc#1225096).
- Update
  patches.suse/clk-mediatek-clk-mt6765-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52870 bsc#1224937).
- Update
  patches.suse/clk-mediatek-clk-mt6779-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52873 bsc#1225589).
- Update
  patches.suse/clk-mediatek-clk-mt6797-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52865 bsc#1225086).
- Update
  patches.suse/clk-mediatek-clk-mt7629-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52858 bsc#1225566).
- Update
  patches.suse/clk-mediatek-clk-mt7629-eth-Add-check-for-mtk_alloc_.patch
  (git-fixes CVE-2023-52876 bsc#1225036).
- Update
  patches.suse/cppc_cpufreq-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38573 bsc#1226739).
- Update patches.suse/cpufreq-exit-callback-is-optional.patch
  (git-fixes CVE-2024-38615 bsc#1226592).
- Update patches.suse/crypto-bcm-Fix-pointer-arithmetic.patch
  (git-fixes CVE-2024-38579 bsc#1226637).
- Update
  patches.suse/crypto-pcrypt-Fix-hungtask-for-PADATA_RESET.patch
  (git-fixes CVE-2023-52813 bsc#1225527).
- Update patches.suse/cxl-mem-Fix-shutdown-order.patch (git-fixes
  CVE-2023-52849 bsc#1224949).
- Update
  patches.suse/cxl-region-Do-not-try-to-cleanup-after-cxl_region_se.patch
  (git-fixes CVE-2023-52792 bsc#1225477).
- Update patches.suse/cxl-region-Fix-cxlr_pmem-leaks.patch
  (git-fixes CVE-2024-38391 bsc#1226894).
- Update
  patches.suse/dma-buf-sw-sync-don-t-enable-IRQ-from-sync_print_obj.patch
  (git-fixes CVE-2024-38780 bsc#1226886).
- Update
  patches.suse/dma-mapping-benchmark-fix-node-id-validation.patch
  (git-fixes CVE-2024-34777 bsc#1226796).
- Update
  patches.suse/dma-mapping-benchmark-handle-NUMA_NO_NODE-correctly.patch
  (git-fixes CVE-2024-39277 bsc#1226909).
- Update
  patches.suse/dmaengine-idxd-Avoid-unnecessary-destruction-of-file.patch
  (git-fixes CVE-2024-38629 bsc#1226905).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Pola.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52819
  bsc#1225532).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-SMU7.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52818
  bsc#1225530).
- Update
  patches.suse/drm-amd-check-num-of-link-levels-when-update-pcie-pa.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52812
  bsc#1225564).
- Update
  patches.suse/drm-amd-display-Avoid-NULL-dereference-of-timing-gen.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52753
  bsc#1225478).
- Update
  patches.suse/drm-amd-display-Fix-division-by-zero-in-setup_dsc_co.patch
  (stable-fixes CVE-2024-36969 bsc#1226155).
- Update
  patches.suse/drm-amd-display-Fix-null-pointer-dereference-in-erro.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52862
  bsc#1225015).
- Update
  patches.suse/drm-amd-display-Fix-potential-index-out-of-bounds-in.patch
  (git-fixes CVE-2024-38552 bsc#1226767).
- Update
  patches.suse/drm-amd-display-fix-a-NULL-pointer-dereference-in-am.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52773
  bsc#1225041).
- Update
  patches.suse/drm-amd-display-fixed-integer-types-and-null-check-l.patch
  (git-fixes CVE-2024-26767).
- Update
  patches.suse/drm-amdgpu-Fix-a-null-pointer-access-when-the-smc_rr.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52817
  bsc#1225569).
- Update
  patches.suse/drm-amdgpu-Fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch
  (git-fixes CVE-2024-39291 bsc#1226934).
- Update
  patches.suse/drm-amdgpu-Fix-potential-null-pointer-derefernce.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52814
  bsc#1225565).
- Update
  patches.suse/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch
  (stable-fixes CVE-2024-39471 bsc#1227096).
- Update
  patches.suse/drm-amdgpu-mes-fix-use-after-free-issue.patch
  (stable-fixes CVE-2024-38581 bsc#1226657).
- Update
  patches.suse/drm-amdgpu-vkms-fix-a-possible-null-pointer-derefere.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52815
  bsc#1225568).
- Update
  patches.suse/drm-amdkfd-Fix-a-race-condition-of-vram-buffer-unref.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52825
  bsc#1225076).
- Update
  patches.suse/drm-amdkfd-Fix-shift-out-of-bounds-issue.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52816
  bsc#1225529).
- Update
  patches.suse/drm-bridge-cdns-mhdp8546-Fix-possible-null-pointer-d.patch
  (git-fixes CVE-2024-38548).
- Update
  patches.suse/drm-bridge-it66121-Fix-invalid-connector-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52861
  bsc#1224941).
- Update
  patches.suse/drm-bridge-lt8912b-Fix-crash-on-bridge-detach.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52856
  bsc#1224932).
- Update
  patches.suse/drm-mediatek-Add-0-size-check-to-mtk_drm_gem_obj.patch
  (git-fixes CVE-2024-38549 bsc#1226735).
- Update
  patches.suse/drm-mediatek-Fix-coverity-issue-with-unintentional-i.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52857
  bsc#1225581).
- Update
  patches.suse/drm-mediatek-Init-ddp_comp-with-devm_kcalloc.patch
  (git-fixes CVE-2024-38592 bsc#1226844).
- Update
  patches.suse/drm-msm-a6xx-Avoid-a-nullptr-dereference-when-speedb.patch
  (git-fixes CVE-2024-38390 bsc#1226891).
- Update
  patches.suse/drm-msm-dpu-Add-callback-function-pointer-check-befo.patch
  (git-fixes CVE-2024-38622 bsc#1226856).
- Update
  patches.suse/drm-panel-fix-a-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52821
  bsc#1225022).
- Update
  patches.suse/drm-panel-panel-tpo-tpg110-fix-a-possible-null-point.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52826
  bsc#1225077).
- Update patches.suse/drm-radeon-possible-buffer-overflow.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52867
  bsc#1225009).
- Update
  patches.suse/drm-vc4-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38546 bsc#1226593).
- Update
  patches.suse/drm-vmwgfx-Fix-invalid-reads-in-fence-signaled-event.patch
  (git-fixes CVE-2024-36960 bsc#1225872).
- Update
  patches.suse/drm-zynqmp_dpsub-Always-register-bridge.patch
  (git-fixes CVE-2024-38664 bsc#1226941).
- Update
  patches.suse/e1000e-change-usleep_range-to-udelay-in-PHY-mdic-acc.patch
  (CVE-2024-39296 bsc#1226989 CVE-2024-36887 bsc#1225731).
- Update
  patches.suse/ecryptfs-Fix-buffer-size-for-tag-66-packet.patch
  (git-fixes CVE-2024-38578 bsc#1226634).
- Update
  patches.suse/efi-libstub-only-free-priv.runtime_map-when-allocate.patch
  (git-fixes CVE-2024-33619 bsc#1226768).
- Update
  patches.suse/fbdev-imsttfb-fix-a-resource-leak-in-probe.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52838
  bsc#1225031).
- Update
  patches.suse/fs-9p-only-translate-RWX-permissions-for-plain-9P200.patch
  (git-fixes CVE-2024-36964 bsc#1225866).
- Update
  patches.suse/fs-jfs-Add-check-for-negative-db_l2nbperpage.patch
  (git-fixes CVE-2023-52810 bsc#1225557).
- Update
  patches.suse/fs-jfs-Add-validity-check-for-db_maxag-and-db_agpref.patch
  (git-fixes CVE-2023-52804 bsc#1225550).
- Update
  patches.suse/ftrace-Fix-possible-use-after-free-issue-in-ftrace_location.patch
  (git-fixes CVE-2024-38588 bsc#1226837).
- Update
  patches.suse/genirq-irqdesc-Prevent-use-after-free-in-irq_find_at.patch
  (git-fixes CVE-2024-38385 bsc#1227085).
- Update patches.suse/gfs2-ignore-negated-quota-changes.patch
  (git-fixes CVE-2023-52759 bsc#1225560).
- Update
  patches.suse/hid-cp2112-Fix-duplicate-workqueue-initialization.patch
  (git-fixes CVE-2023-52853 bsc#1224988).
- Update
  patches.suse/hwmon-axi-fan-control-Fix-possible-NULL-pointer-dere.patch
  (git-fixes CVE-2023-52863 bsc#1225586).
- Update
  patches.suse/i2c-acpi-Unbind-mux-adapters-before-delete.patch
  (git-fixes CVE-2024-39362 bsc#1226995).
- Update
  patches.suse/i2c-core-Run-atomic-i2c-xfer-when-preemptible.patch
  (git-fixes CVE-2023-52791 bsc#1225108).
- Update
  patches.suse/i3c-master-mipi-i3c-hci-Fix-a-kernel-panic-for-acces.patch
  (git-fixes CVE-2023-52763 bsc#1225570).
- Update
  patches.suse/i3c-mipi-i3c-hci-Fix-out-of-bounds-access-in-hci_dma.patch
  (git-fixes CVE-2023-52766).
- Update
  patches.suse/i915-perf-Fix-NULL-deref-bugs-with-drm_dbg-calls.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52788
  bsc#1225106).
- Update
  patches.suse/igb-Fix-string-truncation-warnings-in-igb_set_fw_ver.patch
  (git-fixes CVE-2024-36010 bsc#1225594).
- Update
  patches.suse/iommu-vt-d-Fix-WARN_ON-in-iommu-probe-path.patch
  (git-fixes CVE-2024-35957 bsc#1224673).
- Update
  patches.suse/iommufd-Fix-missing-update-of-domains_itree-after-splitting-iopt
  (jsc#PED-7779 jsc#PED-7780 CVE-2023-52801 bsc#1225006).
- Update
  patches.suse/ipvlan-add-ipvlan_route_v6_outbound-helper.patch
  (git-fixes CVE-2023-52796 bsc#1224930).
- Update
  patches.suse/jffs2-prevent-xattr-node-from-overflowing-the-eraseblock.patch
  (git-fixes CVE-2024-38599 bsc#1226848).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-dbFindLeaf.patch
  (git-fixes CVE-2023-52799 bsc#1225472).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-diAlloc.patch
  (git-fixes CVE-2023-52805 bsc#1225553).
- Update
  patches.suse/kunit-fortify-Fix-mismatched-kvalloc-vfree-usage.patch
  (git-fixes CVE-2024-38617 bsc#1226859).
- Update
  patches.suse/lib-generic-radix-tree.c-Don-t-overflow-in-peek.patch
  (git-fixes CVE-2021-47432 bsc#1225391).
- Update
  patches.suse/lib-test_hmm.c-handle-src_pfns-and-dst_pfns-allocati.patch
  (git-fixes CVE-2024-38543 bsc#1226594).
- Update
  patches.suse/locking-ww_mutex-test-Fix-potential-workqueue-corrup.patch
  (bsc#1219953 CVE-2023-52836 bsc#1225609).
- Update
  patches.suse/md-Don-t-ignore-suspended-array-in-md_check_recovery-1baa.patch
  (bsc#1219596 CVE-2024-26758).
- Update
  patches.suse/media-atomisp-ssh_css-Fix-a-null-pointer-dereference.patch
  (git-fixes CVE-2024-38547 bsc#1226632).
- Update
  patches.suse/media-bttv-fix-use-after-free-error-due-to-btv-timeo.patch
  (git-fixes CVE-2023-52847 bsc#1225588).
- Update
  patches.suse/media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch
  (git-fixes CVE-2023-52764 bsc#1225571).
- Update
  patches.suse/media-hantro-Check-whether-reset-op-is-defined-befor.patch
  (git-fixes CVE-2023-52850 bsc#1225014).
- Update
  patches.suse/media-i2c-et8ek8-Don-t-strip-remove-function-when-dr.patch
  (git-fixes CVE-2024-38611 bsc#1226760).
- Update
  patches.suse/media-imon-fix-access-to-invalid-resource-for-the-se.patch
  (git-fixes CVE-2023-52754 bsc#1225490).
- Update
  patches.suse/media-lgdt3306a-Add-a-check-against-null-pointer-def.patch
  (stable-fixes CVE-2022-48772 bsc#1226976).
- Update
  patches.suse/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch
  (git-fixes CVE-2024-38621 bsc#1226895).
- Update
  patches.suse/media-vidtv-mux-Add-check-and-kfree-for-kstrdup.patch
  (git-fixes CVE-2023-52841 bsc#1225592).
- Update patches.suse/media-vidtv-psi-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52844 bsc#1225590).
- Update
  patches.suse/mfd-qcom-spmi-pmic-Fix-revid-implementation.patch
  (git-fixes CVE-2023-52765 bsc#1225029).
- Update
  patches.suse/misc-microchip-pci1xxxx-fix-double-free-in-the-error.patch
  (git-fixes CVE-2024-36973 bsc#1226457).
- Update
  patches.suse/net-hns3-fix-out-of-bounds-access-may-occur-when-coa.patch
  (git-fixes CVE-2023-52807 bsc#1225097).
- Update
  patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch
  (git-fixes CVE-2024-36962 bsc#1225827).
- Update
  patches.suse/net-mlx5-Fix-peer-devlink-set-for-SF-representor-dev.patch
  (git-fixes CVE-2024-38595 bsc#1226741).
- Update
  patches.suse/net-mlx5e-Track-xmit-submission-to-PTP-WQ-after-popu.patch
  (jsc#PED-3311 CVE-2023-52782 bsc#1225103).
- Update
  patches.suse/net-mvneta-fix-calls-to-page_pool_get_stats.patch
  (git-fixes CVE-2023-52780 bsc#1224933).
- Update
  patches.suse/net-wangxun-fix-kernel-panic-due-to-null-pointer.patch
  (git-fixes CVE-2023-52783 bsc#1225104).
- Update
  patches.suse/netfilter-complete-validation-of-user-input.patch
  (git-fixes CVE-2024-35896 bsc#1224662 CVE-2024-35962
  bsc#1224583).
- Update
  patches.suse/nfc-nci-Fix-uninit-value-in-nci_rx_work.patch
  (git-fixes CVE-2024-38381 bsc#1226878).
- Update
  patches.suse/nilfs2-fix-nilfs_empty_dir-misjudgment-and-long-loop.patch
  (git-fixes CVE-2024-39469 bsc#1226992).
- Update
  patches.suse/nilfs2-fix-potential-hang-in-nilfs_detach_log_writer.patch
  (git-fixes CVE-2024-38582 bsc#1226658).
- Update
  patches.suse/nilfs2-fix-use-after-free-of-timer-for-log-writer-th.patch
  (git-fixes CVE-2024-38583 bsc#1226777).
- Update
  patches.suse/of-module-add-buffer-overflow-check-in-of_modalias.patch
  (git-fixes CVE-2024-38541 bsc#1226587).
- Update
  patches.suse/padata-Fix-refcnt-handling-in-padata_free_shell.patch
  (git-fixes CVE-2023-52854 bsc#1225584).
- Update
  patches.suse/perf-core-Bail-out-early-if-the-request-AUX-area-is-out-of-bound.patch
  (git-fixes CVE-2023-52835 bsc#1225602).
- Update
  patches.suse/platform-x86-wmi-Fix-opening-of-char-device.patch
  (git-fixes CVE-2023-52864 bsc#1225132).
- Update
  patches.suse/powerpc-pseries-iommu-LPAR-panics-during-boot-up-wit.patch
  (bsc#1222011 ltc#205900 CVE-2024-36926 bsc#1225829).
- Update patches.suse/pstore-platform-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52869 bsc#1225050).
- Update
  patches.suse/remoteproc-mediatek-Make-sure-IPI-buffer-fits-in-L2T.patch
  (git-fixes CVE-2024-36965 bsc#1226149).
- Update
  patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch
  (git-fixes CVE-2024-38601 bsc#1226876).
- Update
  patches.suse/s390-dasd-protect-device-queue-against-concurrent-access.patch
  (git-fixes bsc#1217481 CVE-2023-52774 bsc#1225572).
- Update
  patches.suse/scsi-hisi_sas-Set-debugfs_dir-pointer-to-NULL-after-removing-debugfs.patch
  (git-fixes CVE-2023-52808 bsc#1225555).
- Update
  patches.suse/scsi-ibmvfc-Remove-BUG_ON-in-the-case-of-an-empty-ev.patch
  (bsc#1209834 ltc#202097 CVE-2023-52811 bsc#1225559).
- Update
  patches.suse/scsi-libfc-Fix-potential-NULL-pointer-dereference-in-fc_lport_ptp_setup.patch
  (git-fixes CVE-2023-52809 bsc#1225556).
- Update
  patches.suse/scsi-lpfc-Move-NPIV-s-transport-unregistration-to-af.patch
  (bsc#1221777 CVE-2024-36952 bsc#1225898).
- Update
  patches.suse/scsi-lpfc-Release-hbalock-before-calling-lpfc_worker.patch
  (bsc#1221777 CVE-2024-36924 bsc#1225820).
- Update
  patches.suse/serial-max3100-Lock-port-lock-when-calling-uart_hand.patch
  (git-fixes CVE-2024-38634 bsc#1226868).
- Update
  patches.suse/serial-max3100-Update-uart_driver_registered-on-driv.patch
  (git-fixes CVE-2024-38633 bsc#1226867).
- Update
  patches.suse/soc-qcom-llcc-Handle-a-second-device-without-data-co.patch
  (git-fixes CVE-2023-52871 bsc#1225534).
- Update
  patches.suse/soundwire-cadence-fix-invalid-PDI-offset.patch
  (stable-fixes CVE-2024-38635 bsc#1226863).
- Update patches.suse/speakup-Fix-sizeof-vs-ARRAY_SIZE-bug.patch
  (git-fixes CVE-2024-38587 bsc#1226780).
- Update patches.suse/spi-Fix-null-dereference-on-suspend.patch
  (git-fixes CVE-2023-52749 bsc#1225476).
- Update
  patches.suse/thermal-core-prevent-potential-string-overflow.patch
  (git-fixes CVE-2023-52868 bsc#1225044).
- Update
  patches.suse/thermal-drivers-qcom-lmh-Check-for-SCM-availability-.patch
  (git-fixes CVE-2024-39466 bsc#1227089).
- Update
  patches.suse/thermal-drivers-tsens-Fix-null-pointer-dereference.patch
  (git-fixes CVE-2024-38571 bsc#1226737).
- Update
  patches.suse/thermal-intel-powerclamp-fix-mismatch-in-get-functio.patch
  (git-fixes CVE-2023-52794 bsc#1225028).
- Update
  patches.suse/tls-fix-NULL-deref-on-tls_sw_splice_eof-with-empty-r.patch
  (jsc#PED-6831 CVE-2023-52767 bsc#1224998).
- Update
  patches.suse/tpm_tis_spi-Account-for-SPI-header-when-allocating-T.patch
  (git-fixes CVE-2024-36477 bsc#1226840).
- Update
  patches.suse/tracing-Have-trace_event_file-have-ref-counters.patch
  (git-fixes CVE-2023-52879 bsc#1225101).
- Update
  patches.suse/tracing-trigger-Fix-to-return-error-if-failed-to-alloc-snapshot.patch
  (git-fixes CVE-2024-26920).
- Update
  patches.suse/tty-n_gsm-fix-race-condition-in-status-line-change-o.patch
  (git-fixes CVE-2023-52872 bsc#1225591).
- Update
  patches.suse/tty-n_gsm-require-CAP_NET_ADMIN-to-attach-N_GSM0710-.patch
  (bsc#1222619 CVE-2023-52880).
- Update
  patches.suse/tty-vcc-Add-check-for-kstrdup-in-vcc_probe.patch
  (git-fixes CVE-2023-52789 bsc#1225180).
- Update
  patches.suse/usb-config-fix-iteration-issue-in-usb_get_bos_descri.patch
  (git-fixes CVE-2023-52781 bsc#1225092).
- Update
  patches.suse/usb-dwc3-Wait-unconditionally-after-issuing-EndXfer-.patch
  (git-fixes CVE-2024-36977 bsc#1226513).
- Update
  patches.suse/usb-gadget-u_audio-Fix-race-condition-use-of-control.patch
  (git-fixes CVE-2024-38628 bsc#1226911).
- Update
  patches.suse/usb-storage-alauda-Check-whether-the-media-is-initia.patch
  (git-fixes CVE-2024-38619 bsc#1226861).
- Update
  patches.suse/usb-typec-tcpm-Fix-NULL-pointer-dereference-in-tcpm_.patch
  (git-fixes CVE-2023-52877 bsc#1224944).
- Update
  patches.suse/vhost-vdpa-fix-use-after-free-in-vhost_vdpa_probe.patch
  (jsc#PED-3311 CVE-2023-52795 bsc#1225085).
- Update
  patches.suse/virtio-blk-fix-implicit-overflow-on-virtio_max_dma_s.patch
  (git-fixes CVE-2023-52762 bsc#1225573).
- Update
  patches.suse/virtio-vsock-Fix-uninit-value-in-virtio_transport_re.patch
  (jsc#PED-5505 CVE-2023-52842 bsc#1225025).
- Update
  patches.suse/watchdog-cpu5wdt.c-Fix-use-after-free-bug-caused-by-.patch
  (git-fixes CVE-2024-38630 bsc#1226908).
- Update
  patches.suse/wifi-ar5523-enable-proper-endpoint-verification.patch
  (git-fixes CVE-2024-38565 bsc#1226747).
- Update
  patches.suse/wifi-ath11k-fix-dfs-radar-event-locking.patch
  (git-fixes CVE-2023-52798 bsc#1224947).
- Update
  patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch
  (git-fixes CVE-2023-52777 bsc#1224992).
- Update patches.suse/wifi-ath11k-fix-htt-pktlog-locking.patch
  (git-fixes CVE-2023-52800).
- Update
  patches.suse/wifi-ath12k-fix-dfs-radar-and-temperature-event-lock.patch
  (git-fixes CVE-2023-52776 bsc#1225090).
- Update
  patches.suse/wifi-ath12k-fix-htt-mlo-offset-event-locking.patch
  (git-fixes CVE-2023-52769 bsc#1225001).
- Update
  patches.suse/wifi-ath12k-fix-out-of-bound-access-of-qmi_invoke_ha.patch
  (git-fixes CVE-2024-38572 bsc#1226776).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-read-in-ath12k.patch
  (git-fixes CVE-2023-52827 bsc#1225078).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-write-in-ath12.patch
  (git-fixes CVE-2023-52829 bsc#1225081).
- Update
  patches.suse/wifi-brcmfmac-pcie-handle-randbuf-allocation-failure.patch
  (git-fixes CVE-2024-38575 bsc#1226612).
- Update
  patches.suse/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch
  (git-fixes CVE-2024-38567 bsc#1226769).
- Update
  patches.suse/wifi-carl9170-re-fix-fortified-memset-warning.patch
  (git-fixes CVE-2024-38616 bsc#1226852).
- Update
  patches.suse/wifi-mac80211-don-t-return-unset-power-in-ieee80211_.patch
  (git-fixes CVE-2023-52832 bsc#1225577).
- Update
  patches.suse/wifi-nl80211-Avoid-address-calculations-via-out-of-b.patch
  (git-fixes CVE-2024-38562 bsc#1226788).
- Update
  patches.suse/wifi-wilc1000-use-vmm_table-as-array-in-wilc-struct.patch
  (git-fixes CVE-2023-52768 bsc#1225004).
- Update
  patches.suse/x86-tdx-Zero-out-the-missing-RSI-in-TDX_HYPERCALL-macro.patch
  (jsc#PED-5824 CVE-2023-52874 bsc#1225049).
- commit 33efdc4</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835204">- tcp: Use refcount_inc_not_zero() in tcp_twsk_unique()
  (CVE-2024-36904 bsc#1225732).
- commit d578dcc</changelog>
  <changelog author="heming.zhao@suse.com" date="1719921600">- gfs2: Fix potential glock use-after-free on unmount (bsc#1226775
  CVE-2024-38570).
- gfs2: Rename sd_{ glock =&gt; kill }_wait (bsc#1226775
  CVE-2024-38570).
- commit f3adbca</changelog>
  <changelog author="tiwai@suse.de" date="1719921601">- Correct SCSI patch references (bsc#1225767 CVE-2024-36919 bsc#1226785 CVE-2024-38559)
- commit e8ea587</changelog>
  <changelog author="tiwai@suse.de" date="1719921602">- mtd: rawnand: rockchip: ensure NVDDR timings are rejected
  (git-fixes).
- mtd: rawnand: Bypass a couple of sanity checks during NAND
  identification (git-fixes).
- mtd: rawnand: Fix the nand_read_data_op() early check
  (git-fixes).
- mtd: rawnand: Ensure ECC configuration is propagated to upper
  layers (git-fixes).
- commit e545951</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1719921603">- kernel-doc: fix struct_group_tagged() parsing (git-fixes).
- commit e3a2a2e</changelog>
  <changelog author="fdmanana@suse.com" date="1719921604">- btrfs: fix crash on racing fsync and size-extending write into
  prealloc (bsc#1227101 CVE-2024-37354).
- commit 1d355af</changelog>
  <changelog author="vbabka@suse.cz" date="1719921605">- virt: acrn: stop using follow_pfn (CVE-2024-38610 bsc#1226758).
- commit c2ea51b</changelog>
  <changelog author="vbabka@suse.cz" date="1719921606">- drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
  (CVE-2024-38610 bsc#1226758).
- commit 7069ac2</changelog>
  <changelog author="rhopkins@suse.de" date="1719921607">- hsr: Prevent use after free in prp_create_tagged_frame()
  (CVE-2023-52846 bsc#1225098).
- commit cf63988</changelog>
  <changelog author="krisman@suse.de" date="1719921608">- io_uring: Fix io_cqring_wait() not restoring sigmask on
  get_timespec64() failure (git-fixes).
- commit e640a65</changelog>
  <changelog author="krisman@suse.de" date="1719921609">- io_uring: check for non-NULL file pointer in io_file_can_poll()
  (bsc#1226990 CVE-2024-39371).
- io_uring/io-wq: Use set_bit() and test_bit() at worker-&gt;flags
  (git-fixes).
- io_uring/sqpoll: work around a potential audit memory leak
  (git-fixes).
- commit 24603fc</changelog>
  <changelog author="krisman@suse.de" date="1719921610">- io_uring/rsrc: fix incorrect assignment of iter-&gt;nr_segs in
  io_import_fixed (git-fixes).
- io_uring/rsrc: don't lock while !TASK_RUNNING (git-fixes).
- io_uring/io-wq: avoid garbage value of 'match' in
  io_wq_enqueue() (git-fixes).
- commit 7d3e252</changelog>
</package>
<package pkgid="3bcde35311fd7fdc8b1e5c57397eeb6b9b61f4da2aa22cb9b164102165c5b4a6" name="dtb-exynos" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.17.1"/>
  <changelog author="tiwai@suse.de" date="1722081600">- auxdisplay: ht16k33: Drop reference after LED registration
  (git-fixes).
- ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
  on unprepare (git-fixes).
- ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
- ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
  reachable (git-fixes).
- ASoC: sof: amd: fix for firmware reload failure in Vangogh
  platform (git-fixes).
- ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
- ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
  (git-fixes).
- ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
- ALSA: ump: Don't update FB name for static blocks (git-fixes).
- drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
- drm/i915/gt: Do not consider preemption during execlists_dequeue
  for gen8 (git-fixes).
- drm/i915/dp: Don't switch the LTTPR mode on an active link
  (git-fixes).
- commit d7e2deb</changelog>
  <changelog author="tiwai@suse.de" date="1722081601">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
</package>
<package pkgid="cce4f8538043d4fdc2ff563e78d9e5a3f4581050d7c768e05fb49812e0f9ce63" name="dtb-exynos" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.7.1"/>
  <changelog author="mkubecek@suse.cz" date="1717416000">- netfilter: nf_tables: release mutex after nft_gc_seq_end from
  abort path (CVE-2024-26925 bsc#1223390).
- commit 578a709</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717416001">- Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
  The L3 bsc#1225765 was created seperately since our customer requires
  PTF.
- Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
- Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
- Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
- Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
- commit 054635e</changelog>
  <changelog author="msuchanek@suse.de" date="1717416002">- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
- powerpc/uaccess: Fix build errors seen with GCC 13/14
  (bsc#1194869).
- commit 46b5d84</changelog>
  <changelog author="msuchanek@suse.de" date="1717416003">- blacklist.conf: PPC fsl_msi is not used
- commit ae6590d</changelog>
  <changelog author="msuchanek@suse.de" date="1717416004">- powerpc/pseries/lparcfg: drop error message from guest name
  lookup (bsc#1187716 ltc#193451 git-fixes).
- commit ceab637</changelog>
  <changelog author="mfranc@suse.cz" date="1717416005">- Update
  patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
  (git-fixes CVE-2024-36955).
- Update
  patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
  (git-fixes bsc#1225715 CVE-2024-36906).
- Update
  patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
  (git-fixes bsc#1225579 CVE-2024-36011).
- Update
  patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
  (git-fixes bsc#1225578 CVE-2024-36013).
- Update
  patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
  (git-fixes bsc#1225502 CVE-2024-36012).
- Update
  patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
  (git-fixes bsc#1225722 CVE-2024-36880).
- Update
  patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
  (git-fixes CVE-2024-36942).
- Update
  patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
  (git-fixes bsc#1225720 CVE-2024-36032).
- Update
  patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
  (git-fixes bsc#1223749 CVE-2024-26990).
- Update
  patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
  (git-fixes bsc#1223692 CVE-2024-26992).
- Update
  patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
  (stable-fixes CVE-2024-36944).
- Update
  patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
  (git-fixes bsc#1225734 CVE-2024-36896).
- Update
  patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
  (stable-fixes CVE-2024-36949).
- Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
  (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
- Update
  patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
  (git-fixes bsc#1225692 CVE-2023-52882).
- Update
  patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
  (git-fixes CVE-2024-26761).
- Update
  patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
  (stable-fixes bsc#1225735 CVE-2024-36897).
- Update
  patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
  (stable-fixes bsc#1225705 CVE-2024-36026).
- Update
  patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
  (stable-fixes CVE-2024-36951).
- Update
  patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
  (git-fixes bsc#1225593 CVE-2024-36014).
- Update
  patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
  (stable-fixes bsc#1225728 CVE-2024-36885).
- Update
  patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
  (git-fixes bsc#1225773 CVE-2024-36936).
- Update
  patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
  (stable-fixes CVE-2024-36950).
- Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
  (git-fixes bsc#1225736 CVE-2024-36898).
- Update
  patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
  (git-fixes bsc#1225698 CVE-2024-36020).
- Update
  patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
  (git-fixes bsc#1225710 CVE-2024-36891).
- Update
  patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
  (git-fixes bsc#1225714 CVE-2024-36890).
- Update
  patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
  (git-fixes bsc#1225708 CVE-2024-36029).
- Update
  patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
  (git-fixes bsc#1225699 CVE-2024-36021).
- Update
  patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
  (git-fixes CVE-2024-26943).
- Update
  patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
  (git-fixes bsc#1225694 CVE-2024-36018).
- Update
  patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
  (git-fixes CVE-2024-36940).
- Update
  patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
  (git-fixes CVE-2024-36959).
- Update
  patches.suse/ppdev-Add-an-error-check-in-register_device.patch
  (git-fixes bsc#1225640 CVE-2024-36015).
- Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
  CVE-2024-36947).
- Update
  patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
  (git-fixes bsc#1225695 CVE-2024-36019).
- Update
  patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
  (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
- Update
  patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
  (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
- Update
  patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
  (git-fixes bsc#1225704 CVE-2024-36025).
- Update
  patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
  (git-fixes CVE-2024-36930).
- Update
  patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
  (bsc#1224331 bsc#1224602 CVE-2024-35814).
- Update
  patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
  (git-fixes bsc#1225642 CVE-2024-36016).
- Update
  patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
  (git-fixes bsc#1225749 CVE-2024-36894).
- Update
  patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
  (git-fixes bsc#1225750 CVE-2024-36895).
- Update
  patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
  (git-fixes bsc#1225748 CVE-2024-36893).
- Update
  patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
  (stable-fixes bsc#1225769 CVE-2024-36921).
- Update
  patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
  (stable-fixes CVE-2024-36922).
- Update
  patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
  (git-fixes CVE-2024-36941).
- Update
  patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
  (git-fixes bsc#1224742 CVE-2024-35803).
- commit 539780f</changelog>
  <changelog author="dwagner@suse.de" date="1717416006">- nvmet: fix ns enable/disable possible hang (git-fixes).
- nvme-multipath: fix io accounting on failover (git-fixes).
- nvme: fix multipath batched completion accounting (git-fixes).
- commit ed3b392</changelog>
  <changelog author="dwagner@suse.de" date="1717416007">- scsi: lpfc: Copyright updates for 14.4.0.2 patches
  (bsc#1225842).
- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
  (bsc#1225842).
  Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
  (bsc#1225842).
- scsi: lpfc: Clear deferred RSCN processing flag when driver
  is unloading (bsc#1225842).
- scsi: lpfc: Update logging of protection type for T10 DIF I/O
  (bsc#1225842).
- scsi: lpfc: Change default logging level for unsolicited CT
  MIB commands (bsc#1225842).
- commit 5a56384</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416008">- smb: client: fix mount when dns_resolver key is not available
  (git-fixes, bsc#1225172).
- commit 28edb5c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416009">- cifs: fix leak of iface for primary channel (git-fixes,
  bsc#1225172).
- commit b7eb8e8</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416010">- Revert "cifs: reconnect work should have reference on server
  struct" (git-fixes, bsc#1225172).
- commit 3ca4c0c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416011">- smb: client: fix parsing of SMB3.1.1 POSIX create context
  (git-fixes, bsc#1225172).
- commit 5f27f69</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416012">- cifs: failure to add channel on iface should bump up weight
  (git-fixes, bsc#1225172).
- commit 007b237</changelog>
  <changelog author="tonyj@suse.de" date="1717416013">- perf/x86: Fix out of range data (git-fixes).
- perf/x86/intel/ds: Don't clear -&gt;pebs_data_cfg for the last
  PEBS event (git-fixes).
- perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
- commit 664d77f</changelog>
  <changelog author="dsterba@suse.com" date="1717588800">- blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
- Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
  Quoting bsc#1225945#c11:
  "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
  transaction for every subvol create")
  ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
  unwritten extent buffer after snapshotting a new subvolume") was never
  backported."
- commit d947258</changelog>
  <changelog author="tonyj@suse.de" date="1717588801">- perf pmu: Count sys and cpuid JSON events separately (git
  fixes).
- perf stat: Don't display metric header for non-leader uncore
  events (git-fixes).
- perf daemon: Fix file leak in daemon_session__control
  (git-fixes).
- perf symbols: Fix ownership of string in dso__load_vmlinux()
  (git-fixes).
- perf thread: Fixes to thread__new() related to initializing comm
  (git-fixes).
- perf report: Avoid SEGV in report__setup_sample_type()
  (git-fixes).
- perf ui browser: Don't save pointer to stack memory (git-fixes).
- perf bench internals inject-build-id: Fix trap divide when
  collecting just one DSO (git-fixes).
- perf intel-pt: Fix unassigned instruction op (discovered by
  MemorySanitizer) (git-fixes).
- perf test shell arm_coresight: Increase buffer size for
  Coresight basic tests (git-fixes).
- perf docs: Document bpf event modifier (git-fixes).
- perf bench uprobe: Remove lib64 from libc.so.6 binary path
  (git-fixes).
- perf record: Fix debug message placement for test consumption
  (git-fixes).
- perf tests: Apply attributes to all events in object code
  reading test (git-fixes).
- perf tests: Make "test data symbol" more robust on Neoverse N1
  (git-fixes).
- perf annotate: Fix annotation_calc_lines() to pass correct
  address to get_srcline() (git-fixes).
- perf stat: Do not fail on metrics on s390 z/VM systems
  (git-fixes).
- perf sched timehist: Fix -g/--call-graph option failure
  (git-fixes).
- perf annotate: Get rid of duplicate --group option item
  (git-fixes).
- perf probe: Add missing libgen.h header needed for using
  basename() (git-fixes).
- perf record: Delete session after stopping sideband thread
  (git-fixes).
- perf auxtrace: Fix multiple use of --itrace option (git-fixes).
- perf script: Show also errors for --insn-trace option
  (git-fixes).
- perf lock contention: Add a missing NULL check (git-fixes).
- perf vendor events amd: Fix Zen 4 cache latency events
  (git-fixes).
- libperf evlist: Avoid out-of-bounds access (git-fixes).
- perf pmu: Fix a potential memory leak in perf_pmu__lookup()
  (git-fixes).
- perf print-events: make is_event_supported() more robust
  (git-fixes).
- perf list: fix short description for some cache events
  (git-fixes).
- perf metric: Don't remove scale from counts (git-fixes).
- perf stat: Avoid metric-only segv (git-fixes).
- perf expr: Fix "has_event" function for metric style events
  (git-fixes).
- perf srcline: Add missed addr2line closes (git-fixes).
- perf thread_map: Free strlist on normal path in
  thread_map__new_by_tid_str() (git-fixes).
- perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
- perf jevents: Drop or simplify small integer values (git-fixes).
- perf evsel: Fix duplicate initialization of data-&gt;id in
  evsel__parse_sample() (git-fixes).
- perf pmu: Treat the msr pmu as software (git-fixes).
- perf record: Check conflict between '--timestamp-filename'
  option and pipe mode before recording (git-fixes).
- perf record: Fix possible incorrect free in
  record__switch_output() (git-fixes).
- perf vendor events amd: Add Zen 4 memory controller events
  (git-fixes).
- perf top: Uniform the event name for the hybrid machine
  (git-fixes).
- perf top: Use evsel's cpus to replace user_requested_cpus
  (git-fixes).
- commit a1f9340</changelog>
  <changelog author="tonyj@suse.de" date="1717675200">- perf ui browser: Avoid SEGV on title (git fixes).
- commit 1578c22</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675201">- inet: inet_defrag: prevent sk release while still in use
  (CVE-2024-26921 bsc#1223138).
- commit 2016faf</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675202">- net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
- commit 7bf5961</changelog>
  <changelog author="tiwai@suse.de" date="1718366400">- Temporarily drop KVM patch that caused a regression (bsc#1226158)
  Delete patches.suse/KVM-x86-pmu-Prioritize-VMX-interception-over-GP-on-R.patch
- commit 33f31da</changelog>
</package>
<package pkgid="b1e7f75c840707d3056e06b140e33b60e0248e2b8f00f13b3312ae78e0340dea" name="dtb-freescale" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.14.1"/>
  <changelog author="tiwai@suse.de" date="1719662400">- gpiolib: cdev: Disallow reconfiguration without direction
  (uAPI v1) (git-fixes).
- gpio: davinci: Validate the obtained number of IRQs (git-fixes).
- commit 919ebd1</changelog>
  <changelog author="tiwai@suse.de" date="1719748800">- i2c: testunit: discard write requests while old command is
  running (git-fixes).
- i2c: testunit: don't erase registers after STOP (git-fixes).
- mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
  (git-fixes).
- mmc: sdhci: Do not invert write-protect twice (git-fixes).
- mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
  (git-fixes).
- mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
  (git-fixes).
- commit 448487d</changelog>
  <changelog author="tiwai@suse.de" date="1719748801">- crypto: iaa - Account for cpu-less numa nodes (bsc#1227190).
- commit cd600aa</changelog>
  <changelog author="tiwai@suse.de" date="1719748802">- crypto: deflate - Add aliases to deflate (bsc#1227190).
- commit 27ffd92</changelog>
  <changelog author="tiwai@suse.de" date="1719835200">- ata: ahci: Clean up sysfs file on error (git-fixes).
- ata: libata-core: Fix double free on error (git-fixes).
- ata,scsi: libata-core: Do not leak memory for ata_port struct
  members (git-fixes).
- ata: libata-core: Fix null pointer dereference on error
  (git-fixes).
- kbuild: Fix build target deb-pkg: ln: failed to create hard link
  (git-fixes).
- kbuild: doc: Update default INSTALL_MOD_DIR from extra to
  updates (git-fixes).
- kbuild: Install dtb files as 0644 in Makefile.dtbinst
  (git-fixes).
- counter: ti-eqep: enable clock at probe (git-fixes).
- iio: chemical: bme680: Fix sensor data read operation
  (git-fixes).
- iio: chemical: bme680: Fix overflows in compensate() functions
  (git-fixes).
- iio: chemical: bme680: Fix calibration data variable
  (git-fixes).
- iio: chemical: bme680: Fix pressure value output (git-fixes).
- iio: accel: fxls8962af: select IIO_BUFFER &amp; IIO_KFIFO_BUF
  (git-fixes).
- iio: adc: ad7266: Fix variable checking bug (git-fixes).
- iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
  (git-fixes).
- serial: bcm63xx-uart: fix tx after conversion to
  uart_port_tx_limited() (git-fixes).
- serial: core: introduce uart_port_tx_limited_flags()
  (git-fixes).
- Revert "serial: core: only stop transmit when HW fifo is empty"
  (git-fixes).
- tty: mcf: MCF54418 has 10 UARTS (git-fixes).
- usb: gadget: aspeed_udc: fix device address configuration
  (git-fixes).
- usb: dwc3: core: remove lock of otg mode during gadget
  suspend/resume to avoid deadlock (git-fixes).
- usb: typec: ucsi: glink: fix child node release in probe
  function (git-fixes).
- usb: musb: da8xx: fix a resource leak in probe() (git-fixes).
- usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  (git-fixes).
- usb: gadget: printer: fix races against disable (git-fixes).
- PCI/MSI: Fix UAF in msi_capability_init (git-fixes).
- commit a2ea5a9</changelog>
  <changelog author="ptesarik@suse.com" date="1719835201">- net: ena: Fix redundant device NUMA node override
  (jsc#PED-8688).
- commit 6ad6684</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835202">- tcp: do not accept ACK of bytes we never sent (CVE-2023-52881
  bsc#1225611).
- commit 16404a6</changelog>
  <changelog author="mhocko@suse.com" date="1719835203">- Update
  patches.suse/1352-drm-amdgpu-Fix-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52883
  bsc#1226630).
- Update
  patches.suse/9p-add-missing-locking-around-taking-dentry-fid-list.patch
  (git-fixes CVE-2024-39463 bsc#1227090).
- Update
  patches.suse/ALSA-Fix-deadlocks-with-kctl-removals-at-disconnecti.patch
  (stable-fixes CVE-2024-38600 bsc#1226864).
- Update
  patches.suse/ALSA-core-Fix-NULL-module-pointer-assignment-at-card.patch
  (git-fixes CVE-2024-38605 bsc#1226740).
- Update
  patches.suse/ALSA-hda-Fix-possible-null-ptr-deref-when-assigning-.patch
  (git-fixes CVE-2023-52806 bsc#1225554).
- Update
  patches.suse/ALSA-hda-cs_dsp_ctl-Use-private_free-for-control-cle.patch
  (git-fixes CVE-2024-38388 bsc#1226890).
- Update
  patches.suse/ALSA-timer-Set-lower-bound-of-start-tick-time.patch
  (stable-fixes git-fixes CVE-2024-38618 bsc#1226754).
- Update
  patches.suse/ASoC-kirkwood-Fix-potential-NULL-dereference.patch
  (git-fixes CVE-2024-38550 bsc#1226633).
- Update
  patches.suse/ASoC-mediatek-Assign-dummy-when-codec-not-specified-.patch
  (git-fixes CVE-2024-38551 bsc#1226761).
- Update
  patches.suse/Bluetooth-btusb-Add-date-evt_skb-is-NULL-check.patch
  (git-fixes CVE-2023-52833 bsc#1225595).
- Update
  patches.suse/Bluetooth-hci_core-Fix-possible-buffer-overflow.patch
  (git-fixes CVE-2024-26889).
- Update
  patches.suse/HID-uclogic-Fix-user-memory-access-bug-in-uclogic_pa.patch
  (git-fixes CVE-2023-52866 bsc#1225120).
- Update
  patches.suse/IB-mlx5-Fix-init-stage-error-handling-to-avoid-doubl.patch
  (jsc#PED-6864 CVE-2023-52851 bsc#1225587).
- Update
  patches.suse/Input-cyapa-add-missing-input-core-locking-to-suspen.patch
  (git-fixes CVE-2023-52884 bsc#1226764).
- Update
  patches.suse/Input-synaptics-rmi4-fix-use-after-free-in-rmi_unreg.patch
  (git-fixes CVE-2023-52840 bsc#1224928).
- Update
  patches.suse/KEYS-trusted-Do-not-use-WARN-when-encode-fails.patch
  (git-fixes CVE-2024-36975 bsc#1226520).
- Update
  patches.suse/KEYS-trusted-Fix-memory-leak-in-tpm2_key_encode.patch
  (git-fixes CVE-2024-36967 bsc#1226131).
- Update
  patches.suse/RDMA-cma-Fix-kmemleak-in-rdma_core-observed-during-b.patch
  (git-fixes CVE-2024-38539 bsc#1226608).
- Update patches.suse/RDMA-hns-Fix-UAF-for-cq-async-event.patch
  (git-fixes CVE-2024-38545 bsc#1226595).
- Update
  patches.suse/RDMA-hns-Fix-deadlock-on-SRQ-async-events.patch
  (git-fixes CVE-2024-38591 bsc#1226738).
- Update
  patches.suse/RDMA-hns-Modify-the-print-level-of-CQE-error.patch
  (git-fixes CVE-2024-38590 bsc#1226839).
- Update
  patches.suse/RDMA-rxe-Fix-seg-fault-in-rxe_comp_queue_pkt.patch
  (git-fixes CVE-2024-38544 bsc#1226597).
- Update
  patches.suse/SUNRPC-Fix-RPC-client-cleaned-up-the-freed-pipefs-de.patch
  (git-fixes CVE-2023-52803 bsc#1225008).
- Update patches.suse/af_unix-Clear-stale-u-oob_skb.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-35970 bsc#1224584).
- Update
  patches.suse/af_unix-Drop-oob_skb-ref-before-purging-queue-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26750 bsc#1222617).
- Update
  patches.suse/af_unix-Fix-task-hung-while-purging-oob_skb-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26780 bsc#1222588).
- Update
  patches.suse/af_unix-Update-unix_sk-sk-oob_skb-under-sk_receive_queue-lock.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-36972 bsc#1226163).
- Update
  patches.suse/arm64-Restrict-CPU_BIG_ENDIAN-to-GNU-as-or-LLVM-IAS-.patch
  (git-fixes CVE-2023-52750 bsc#1225485).
- Update
  patches.suse/atl1c-Work-around-the-DMA-RX-overflow-issue.patch
  (git-fixes CVE-2023-52834 bsc#1225599).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issue-of-net_device.patch
  (git-fixes CVE-2024-38554 bsc#1226742).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issues-of-ax25_dev.patch
  (git-fixes CVE-2024-38602 bsc#1226613).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-reorder-of-WRITE-lqueued.patch
  (bsc#1225605 CVE-2024-38384 bsc#1226938).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-resetting-io-stat.patch
  (bsc#1225605 CVE-2024-38663 bsc#1226939).
- Update
  patches.suse/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch
  (git-fixes CVE-2024-38540 bsc#1226582).
- Update
  patches.suse/bonding-stop-the-device-in-bond_setup_by_slave.patch
  (git-fixes CVE-2023-52784 bsc#1224946).
- Update
  patches.suse/can-dev-can_put_echo_skb-don-t-crash-kernel-if-can_p.patch
  (git-fixes CVE-2023-52878 bsc#1225000).
- Update
  patches.suse/clk-mediatek-clk-mt2701-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52875 bsc#1225096).
- Update
  patches.suse/clk-mediatek-clk-mt6765-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52870 bsc#1224937).
- Update
  patches.suse/clk-mediatek-clk-mt6779-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52873 bsc#1225589).
- Update
  patches.suse/clk-mediatek-clk-mt6797-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52865 bsc#1225086).
- Update
  patches.suse/clk-mediatek-clk-mt7629-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52858 bsc#1225566).
- Update
  patches.suse/clk-mediatek-clk-mt7629-eth-Add-check-for-mtk_alloc_.patch
  (git-fixes CVE-2023-52876 bsc#1225036).
- Update
  patches.suse/cppc_cpufreq-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38573 bsc#1226739).
- Update patches.suse/cpufreq-exit-callback-is-optional.patch
  (git-fixes CVE-2024-38615 bsc#1226592).
- Update patches.suse/crypto-bcm-Fix-pointer-arithmetic.patch
  (git-fixes CVE-2024-38579 bsc#1226637).
- Update
  patches.suse/crypto-pcrypt-Fix-hungtask-for-PADATA_RESET.patch
  (git-fixes CVE-2023-52813 bsc#1225527).
- Update patches.suse/cxl-mem-Fix-shutdown-order.patch (git-fixes
  CVE-2023-52849 bsc#1224949).
- Update
  patches.suse/cxl-region-Do-not-try-to-cleanup-after-cxl_region_se.patch
  (git-fixes CVE-2023-52792 bsc#1225477).
- Update patches.suse/cxl-region-Fix-cxlr_pmem-leaks.patch
  (git-fixes CVE-2024-38391 bsc#1226894).
- Update
  patches.suse/dma-buf-sw-sync-don-t-enable-IRQ-from-sync_print_obj.patch
  (git-fixes CVE-2024-38780 bsc#1226886).
- Update
  patches.suse/dma-mapping-benchmark-fix-node-id-validation.patch
  (git-fixes CVE-2024-34777 bsc#1226796).
- Update
  patches.suse/dma-mapping-benchmark-handle-NUMA_NO_NODE-correctly.patch
  (git-fixes CVE-2024-39277 bsc#1226909).
- Update
  patches.suse/dmaengine-idxd-Avoid-unnecessary-destruction-of-file.patch
  (git-fixes CVE-2024-38629 bsc#1226905).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Pola.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52819
  bsc#1225532).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-SMU7.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52818
  bsc#1225530).
- Update
  patches.suse/drm-amd-check-num-of-link-levels-when-update-pcie-pa.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52812
  bsc#1225564).
- Update
  patches.suse/drm-amd-display-Avoid-NULL-dereference-of-timing-gen.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52753
  bsc#1225478).
- Update
  patches.suse/drm-amd-display-Fix-division-by-zero-in-setup_dsc_co.patch
  (stable-fixes CVE-2024-36969 bsc#1226155).
- Update
  patches.suse/drm-amd-display-Fix-null-pointer-dereference-in-erro.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52862
  bsc#1225015).
- Update
  patches.suse/drm-amd-display-Fix-potential-index-out-of-bounds-in.patch
  (git-fixes CVE-2024-38552 bsc#1226767).
- Update
  patches.suse/drm-amd-display-fix-a-NULL-pointer-dereference-in-am.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52773
  bsc#1225041).
- Update
  patches.suse/drm-amd-display-fixed-integer-types-and-null-check-l.patch
  (git-fixes CVE-2024-26767).
- Update
  patches.suse/drm-amdgpu-Fix-a-null-pointer-access-when-the-smc_rr.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52817
  bsc#1225569).
- Update
  patches.suse/drm-amdgpu-Fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch
  (git-fixes CVE-2024-39291 bsc#1226934).
- Update
  patches.suse/drm-amdgpu-Fix-potential-null-pointer-derefernce.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52814
  bsc#1225565).
- Update
  patches.suse/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch
  (stable-fixes CVE-2024-39471 bsc#1227096).
- Update
  patches.suse/drm-amdgpu-mes-fix-use-after-free-issue.patch
  (stable-fixes CVE-2024-38581 bsc#1226657).
- Update
  patches.suse/drm-amdgpu-vkms-fix-a-possible-null-pointer-derefere.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52815
  bsc#1225568).
- Update
  patches.suse/drm-amdkfd-Fix-a-race-condition-of-vram-buffer-unref.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52825
  bsc#1225076).
- Update
  patches.suse/drm-amdkfd-Fix-shift-out-of-bounds-issue.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52816
  bsc#1225529).
- Update
  patches.suse/drm-bridge-cdns-mhdp8546-Fix-possible-null-pointer-d.patch
  (git-fixes CVE-2024-38548).
- Update
  patches.suse/drm-bridge-it66121-Fix-invalid-connector-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52861
  bsc#1224941).
- Update
  patches.suse/drm-bridge-lt8912b-Fix-crash-on-bridge-detach.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52856
  bsc#1224932).
- Update
  patches.suse/drm-mediatek-Add-0-size-check-to-mtk_drm_gem_obj.patch
  (git-fixes CVE-2024-38549 bsc#1226735).
- Update
  patches.suse/drm-mediatek-Fix-coverity-issue-with-unintentional-i.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52857
  bsc#1225581).
- Update
  patches.suse/drm-mediatek-Init-ddp_comp-with-devm_kcalloc.patch
  (git-fixes CVE-2024-38592 bsc#1226844).
- Update
  patches.suse/drm-msm-a6xx-Avoid-a-nullptr-dereference-when-speedb.patch
  (git-fixes CVE-2024-38390 bsc#1226891).
- Update
  patches.suse/drm-msm-dpu-Add-callback-function-pointer-check-befo.patch
  (git-fixes CVE-2024-38622 bsc#1226856).
- Update
  patches.suse/drm-panel-fix-a-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52821
  bsc#1225022).
- Update
  patches.suse/drm-panel-panel-tpo-tpg110-fix-a-possible-null-point.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52826
  bsc#1225077).
- Update patches.suse/drm-radeon-possible-buffer-overflow.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52867
  bsc#1225009).
- Update
  patches.suse/drm-vc4-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38546 bsc#1226593).
- Update
  patches.suse/drm-vmwgfx-Fix-invalid-reads-in-fence-signaled-event.patch
  (git-fixes CVE-2024-36960 bsc#1225872).
- Update
  patches.suse/drm-zynqmp_dpsub-Always-register-bridge.patch
  (git-fixes CVE-2024-38664 bsc#1226941).
- Update
  patches.suse/e1000e-change-usleep_range-to-udelay-in-PHY-mdic-acc.patch
  (CVE-2024-39296 bsc#1226989 CVE-2024-36887 bsc#1225731).
- Update
  patches.suse/ecryptfs-Fix-buffer-size-for-tag-66-packet.patch
  (git-fixes CVE-2024-38578 bsc#1226634).
- Update
  patches.suse/efi-libstub-only-free-priv.runtime_map-when-allocate.patch
  (git-fixes CVE-2024-33619 bsc#1226768).
- Update
  patches.suse/fbdev-imsttfb-fix-a-resource-leak-in-probe.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52838
  bsc#1225031).
- Update
  patches.suse/fs-9p-only-translate-RWX-permissions-for-plain-9P200.patch
  (git-fixes CVE-2024-36964 bsc#1225866).
- Update
  patches.suse/fs-jfs-Add-check-for-negative-db_l2nbperpage.patch
  (git-fixes CVE-2023-52810 bsc#1225557).
- Update
  patches.suse/fs-jfs-Add-validity-check-for-db_maxag-and-db_agpref.patch
  (git-fixes CVE-2023-52804 bsc#1225550).
- Update
  patches.suse/ftrace-Fix-possible-use-after-free-issue-in-ftrace_location.patch
  (git-fixes CVE-2024-38588 bsc#1226837).
- Update
  patches.suse/genirq-irqdesc-Prevent-use-after-free-in-irq_find_at.patch
  (git-fixes CVE-2024-38385 bsc#1227085).
- Update patches.suse/gfs2-ignore-negated-quota-changes.patch
  (git-fixes CVE-2023-52759 bsc#1225560).
- Update
  patches.suse/hid-cp2112-Fix-duplicate-workqueue-initialization.patch
  (git-fixes CVE-2023-52853 bsc#1224988).
- Update
  patches.suse/hwmon-axi-fan-control-Fix-possible-NULL-pointer-dere.patch
  (git-fixes CVE-2023-52863 bsc#1225586).
- Update
  patches.suse/i2c-acpi-Unbind-mux-adapters-before-delete.patch
  (git-fixes CVE-2024-39362 bsc#1226995).
- Update
  patches.suse/i2c-core-Run-atomic-i2c-xfer-when-preemptible.patch
  (git-fixes CVE-2023-52791 bsc#1225108).
- Update
  patches.suse/i3c-master-mipi-i3c-hci-Fix-a-kernel-panic-for-acces.patch
  (git-fixes CVE-2023-52763 bsc#1225570).
- Update
  patches.suse/i3c-mipi-i3c-hci-Fix-out-of-bounds-access-in-hci_dma.patch
  (git-fixes CVE-2023-52766).
- Update
  patches.suse/i915-perf-Fix-NULL-deref-bugs-with-drm_dbg-calls.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52788
  bsc#1225106).
- Update
  patches.suse/igb-Fix-string-truncation-warnings-in-igb_set_fw_ver.patch
  (git-fixes CVE-2024-36010 bsc#1225594).
- Update
  patches.suse/iommu-vt-d-Fix-WARN_ON-in-iommu-probe-path.patch
  (git-fixes CVE-2024-35957 bsc#1224673).
- Update
  patches.suse/iommufd-Fix-missing-update-of-domains_itree-after-splitting-iopt
  (jsc#PED-7779 jsc#PED-7780 CVE-2023-52801 bsc#1225006).
- Update
  patches.suse/ipvlan-add-ipvlan_route_v6_outbound-helper.patch
  (git-fixes CVE-2023-52796 bsc#1224930).
- Update
  patches.suse/jffs2-prevent-xattr-node-from-overflowing-the-eraseblock.patch
  (git-fixes CVE-2024-38599 bsc#1226848).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-dbFindLeaf.patch
  (git-fixes CVE-2023-52799 bsc#1225472).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-diAlloc.patch
  (git-fixes CVE-2023-52805 bsc#1225553).
- Update
  patches.suse/kunit-fortify-Fix-mismatched-kvalloc-vfree-usage.patch
  (git-fixes CVE-2024-38617 bsc#1226859).
- Update
  patches.suse/lib-generic-radix-tree.c-Don-t-overflow-in-peek.patch
  (git-fixes CVE-2021-47432 bsc#1225391).
- Update
  patches.suse/lib-test_hmm.c-handle-src_pfns-and-dst_pfns-allocati.patch
  (git-fixes CVE-2024-38543 bsc#1226594).
- Update
  patches.suse/locking-ww_mutex-test-Fix-potential-workqueue-corrup.patch
  (bsc#1219953 CVE-2023-52836 bsc#1225609).
- Update
  patches.suse/md-Don-t-ignore-suspended-array-in-md_check_recovery-1baa.patch
  (bsc#1219596 CVE-2024-26758).
- Update
  patches.suse/media-atomisp-ssh_css-Fix-a-null-pointer-dereference.patch
  (git-fixes CVE-2024-38547 bsc#1226632).
- Update
  patches.suse/media-bttv-fix-use-after-free-error-due-to-btv-timeo.patch
  (git-fixes CVE-2023-52847 bsc#1225588).
- Update
  patches.suse/media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch
  (git-fixes CVE-2023-52764 bsc#1225571).
- Update
  patches.suse/media-hantro-Check-whether-reset-op-is-defined-befor.patch
  (git-fixes CVE-2023-52850 bsc#1225014).
- Update
  patches.suse/media-i2c-et8ek8-Don-t-strip-remove-function-when-dr.patch
  (git-fixes CVE-2024-38611 bsc#1226760).
- Update
  patches.suse/media-imon-fix-access-to-invalid-resource-for-the-se.patch
  (git-fixes CVE-2023-52754 bsc#1225490).
- Update
  patches.suse/media-lgdt3306a-Add-a-check-against-null-pointer-def.patch
  (stable-fixes CVE-2022-48772 bsc#1226976).
- Update
  patches.suse/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch
  (git-fixes CVE-2024-38621 bsc#1226895).
- Update
  patches.suse/media-vidtv-mux-Add-check-and-kfree-for-kstrdup.patch
  (git-fixes CVE-2023-52841 bsc#1225592).
- Update patches.suse/media-vidtv-psi-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52844 bsc#1225590).
- Update
  patches.suse/mfd-qcom-spmi-pmic-Fix-revid-implementation.patch
  (git-fixes CVE-2023-52765 bsc#1225029).
- Update
  patches.suse/misc-microchip-pci1xxxx-fix-double-free-in-the-error.patch
  (git-fixes CVE-2024-36973 bsc#1226457).
- Update
  patches.suse/net-hns3-fix-out-of-bounds-access-may-occur-when-coa.patch
  (git-fixes CVE-2023-52807 bsc#1225097).
- Update
  patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch
  (git-fixes CVE-2024-36962 bsc#1225827).
- Update
  patches.suse/net-mlx5-Fix-peer-devlink-set-for-SF-representor-dev.patch
  (git-fixes CVE-2024-38595 bsc#1226741).
- Update
  patches.suse/net-mlx5e-Track-xmit-submission-to-PTP-WQ-after-popu.patch
  (jsc#PED-3311 CVE-2023-52782 bsc#1225103).
- Update
  patches.suse/net-mvneta-fix-calls-to-page_pool_get_stats.patch
  (git-fixes CVE-2023-52780 bsc#1224933).
- Update
  patches.suse/net-wangxun-fix-kernel-panic-due-to-null-pointer.patch
  (git-fixes CVE-2023-52783 bsc#1225104).
- Update
  patches.suse/netfilter-complete-validation-of-user-input.patch
  (git-fixes CVE-2024-35896 bsc#1224662 CVE-2024-35962
  bsc#1224583).
- Update
  patches.suse/nfc-nci-Fix-uninit-value-in-nci_rx_work.patch
  (git-fixes CVE-2024-38381 bsc#1226878).
- Update
  patches.suse/nilfs2-fix-nilfs_empty_dir-misjudgment-and-long-loop.patch
  (git-fixes CVE-2024-39469 bsc#1226992).
- Update
  patches.suse/nilfs2-fix-potential-hang-in-nilfs_detach_log_writer.patch
  (git-fixes CVE-2024-38582 bsc#1226658).
- Update
  patches.suse/nilfs2-fix-use-after-free-of-timer-for-log-writer-th.patch
  (git-fixes CVE-2024-38583 bsc#1226777).
- Update
  patches.suse/of-module-add-buffer-overflow-check-in-of_modalias.patch
  (git-fixes CVE-2024-38541 bsc#1226587).
- Update
  patches.suse/padata-Fix-refcnt-handling-in-padata_free_shell.patch
  (git-fixes CVE-2023-52854 bsc#1225584).
- Update
  patches.suse/perf-core-Bail-out-early-if-the-request-AUX-area-is-out-of-bound.patch
  (git-fixes CVE-2023-52835 bsc#1225602).
- Update
  patches.suse/platform-x86-wmi-Fix-opening-of-char-device.patch
  (git-fixes CVE-2023-52864 bsc#1225132).
- Update
  patches.suse/powerpc-pseries-iommu-LPAR-panics-during-boot-up-wit.patch
  (bsc#1222011 ltc#205900 CVE-2024-36926 bsc#1225829).
- Update patches.suse/pstore-platform-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52869 bsc#1225050).
- Update
  patches.suse/remoteproc-mediatek-Make-sure-IPI-buffer-fits-in-L2T.patch
  (git-fixes CVE-2024-36965 bsc#1226149).
- Update
  patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch
  (git-fixes CVE-2024-38601 bsc#1226876).
- Update
  patches.suse/s390-dasd-protect-device-queue-against-concurrent-access.patch
  (git-fixes bsc#1217481 CVE-2023-52774 bsc#1225572).
- Update
  patches.suse/scsi-hisi_sas-Set-debugfs_dir-pointer-to-NULL-after-removing-debugfs.patch
  (git-fixes CVE-2023-52808 bsc#1225555).
- Update
  patches.suse/scsi-ibmvfc-Remove-BUG_ON-in-the-case-of-an-empty-ev.patch
  (bsc#1209834 ltc#202097 CVE-2023-52811 bsc#1225559).
- Update
  patches.suse/scsi-libfc-Fix-potential-NULL-pointer-dereference-in-fc_lport_ptp_setup.patch
  (git-fixes CVE-2023-52809 bsc#1225556).
- Update
  patches.suse/scsi-lpfc-Move-NPIV-s-transport-unregistration-to-af.patch
  (bsc#1221777 CVE-2024-36952 bsc#1225898).
- Update
  patches.suse/scsi-lpfc-Release-hbalock-before-calling-lpfc_worker.patch
  (bsc#1221777 CVE-2024-36924 bsc#1225820).
- Update
  patches.suse/serial-max3100-Lock-port-lock-when-calling-uart_hand.patch
  (git-fixes CVE-2024-38634 bsc#1226868).
- Update
  patches.suse/serial-max3100-Update-uart_driver_registered-on-driv.patch
  (git-fixes CVE-2024-38633 bsc#1226867).
- Update
  patches.suse/soc-qcom-llcc-Handle-a-second-device-without-data-co.patch
  (git-fixes CVE-2023-52871 bsc#1225534).
- Update
  patches.suse/soundwire-cadence-fix-invalid-PDI-offset.patch
  (stable-fixes CVE-2024-38635 bsc#1226863).
- Update patches.suse/speakup-Fix-sizeof-vs-ARRAY_SIZE-bug.patch
  (git-fixes CVE-2024-38587 bsc#1226780).
- Update patches.suse/spi-Fix-null-dereference-on-suspend.patch
  (git-fixes CVE-2023-52749 bsc#1225476).
- Update
  patches.suse/thermal-core-prevent-potential-string-overflow.patch
  (git-fixes CVE-2023-52868 bsc#1225044).
- Update
  patches.suse/thermal-drivers-qcom-lmh-Check-for-SCM-availability-.patch
  (git-fixes CVE-2024-39466 bsc#1227089).
- Update
  patches.suse/thermal-drivers-tsens-Fix-null-pointer-dereference.patch
  (git-fixes CVE-2024-38571 bsc#1226737).
- Update
  patches.suse/thermal-intel-powerclamp-fix-mismatch-in-get-functio.patch
  (git-fixes CVE-2023-52794 bsc#1225028).
- Update
  patches.suse/tls-fix-NULL-deref-on-tls_sw_splice_eof-with-empty-r.patch
  (jsc#PED-6831 CVE-2023-52767 bsc#1224998).
- Update
  patches.suse/tpm_tis_spi-Account-for-SPI-header-when-allocating-T.patch
  (git-fixes CVE-2024-36477 bsc#1226840).
- Update
  patches.suse/tracing-Have-trace_event_file-have-ref-counters.patch
  (git-fixes CVE-2023-52879 bsc#1225101).
- Update
  patches.suse/tracing-trigger-Fix-to-return-error-if-failed-to-alloc-snapshot.patch
  (git-fixes CVE-2024-26920).
- Update
  patches.suse/tty-n_gsm-fix-race-condition-in-status-line-change-o.patch
  (git-fixes CVE-2023-52872 bsc#1225591).
- Update
  patches.suse/tty-n_gsm-require-CAP_NET_ADMIN-to-attach-N_GSM0710-.patch
  (bsc#1222619 CVE-2023-52880).
- Update
  patches.suse/tty-vcc-Add-check-for-kstrdup-in-vcc_probe.patch
  (git-fixes CVE-2023-52789 bsc#1225180).
- Update
  patches.suse/usb-config-fix-iteration-issue-in-usb_get_bos_descri.patch
  (git-fixes CVE-2023-52781 bsc#1225092).
- Update
  patches.suse/usb-dwc3-Wait-unconditionally-after-issuing-EndXfer-.patch
  (git-fixes CVE-2024-36977 bsc#1226513).
- Update
  patches.suse/usb-gadget-u_audio-Fix-race-condition-use-of-control.patch
  (git-fixes CVE-2024-38628 bsc#1226911).
- Update
  patches.suse/usb-storage-alauda-Check-whether-the-media-is-initia.patch
  (git-fixes CVE-2024-38619 bsc#1226861).
- Update
  patches.suse/usb-typec-tcpm-Fix-NULL-pointer-dereference-in-tcpm_.patch
  (git-fixes CVE-2023-52877 bsc#1224944).
- Update
  patches.suse/vhost-vdpa-fix-use-after-free-in-vhost_vdpa_probe.patch
  (jsc#PED-3311 CVE-2023-52795 bsc#1225085).
- Update
  patches.suse/virtio-blk-fix-implicit-overflow-on-virtio_max_dma_s.patch
  (git-fixes CVE-2023-52762 bsc#1225573).
- Update
  patches.suse/virtio-vsock-Fix-uninit-value-in-virtio_transport_re.patch
  (jsc#PED-5505 CVE-2023-52842 bsc#1225025).
- Update
  patches.suse/watchdog-cpu5wdt.c-Fix-use-after-free-bug-caused-by-.patch
  (git-fixes CVE-2024-38630 bsc#1226908).
- Update
  patches.suse/wifi-ar5523-enable-proper-endpoint-verification.patch
  (git-fixes CVE-2024-38565 bsc#1226747).
- Update
  patches.suse/wifi-ath11k-fix-dfs-radar-event-locking.patch
  (git-fixes CVE-2023-52798 bsc#1224947).
- Update
  patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch
  (git-fixes CVE-2023-52777 bsc#1224992).
- Update patches.suse/wifi-ath11k-fix-htt-pktlog-locking.patch
  (git-fixes CVE-2023-52800).
- Update
  patches.suse/wifi-ath12k-fix-dfs-radar-and-temperature-event-lock.patch
  (git-fixes CVE-2023-52776 bsc#1225090).
- Update
  patches.suse/wifi-ath12k-fix-htt-mlo-offset-event-locking.patch
  (git-fixes CVE-2023-52769 bsc#1225001).
- Update
  patches.suse/wifi-ath12k-fix-out-of-bound-access-of-qmi_invoke_ha.patch
  (git-fixes CVE-2024-38572 bsc#1226776).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-read-in-ath12k.patch
  (git-fixes CVE-2023-52827 bsc#1225078).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-write-in-ath12.patch
  (git-fixes CVE-2023-52829 bsc#1225081).
- Update
  patches.suse/wifi-brcmfmac-pcie-handle-randbuf-allocation-failure.patch
  (git-fixes CVE-2024-38575 bsc#1226612).
- Update
  patches.suse/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch
  (git-fixes CVE-2024-38567 bsc#1226769).
- Update
  patches.suse/wifi-carl9170-re-fix-fortified-memset-warning.patch
  (git-fixes CVE-2024-38616 bsc#1226852).
- Update
  patches.suse/wifi-mac80211-don-t-return-unset-power-in-ieee80211_.patch
  (git-fixes CVE-2023-52832 bsc#1225577).
- Update
  patches.suse/wifi-nl80211-Avoid-address-calculations-via-out-of-b.patch
  (git-fixes CVE-2024-38562 bsc#1226788).
- Update
  patches.suse/wifi-wilc1000-use-vmm_table-as-array-in-wilc-struct.patch
  (git-fixes CVE-2023-52768 bsc#1225004).
- Update
  patches.suse/x86-tdx-Zero-out-the-missing-RSI-in-TDX_HYPERCALL-macro.patch
  (jsc#PED-5824 CVE-2023-52874 bsc#1225049).
- commit 33efdc4</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835204">- tcp: Use refcount_inc_not_zero() in tcp_twsk_unique()
  (CVE-2024-36904 bsc#1225732).
- commit d578dcc</changelog>
  <changelog author="heming.zhao@suse.com" date="1719921600">- gfs2: Fix potential glock use-after-free on unmount (bsc#1226775
  CVE-2024-38570).
- gfs2: Rename sd_{ glock =&gt; kill }_wait (bsc#1226775
  CVE-2024-38570).
- commit f3adbca</changelog>
  <changelog author="tiwai@suse.de" date="1719921601">- Correct SCSI patch references (bsc#1225767 CVE-2024-36919 bsc#1226785 CVE-2024-38559)
- commit e8ea587</changelog>
  <changelog author="tiwai@suse.de" date="1719921602">- mtd: rawnand: rockchip: ensure NVDDR timings are rejected
  (git-fixes).
- mtd: rawnand: Bypass a couple of sanity checks during NAND
  identification (git-fixes).
- mtd: rawnand: Fix the nand_read_data_op() early check
  (git-fixes).
- mtd: rawnand: Ensure ECC configuration is propagated to upper
  layers (git-fixes).
- commit e545951</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1719921603">- kernel-doc: fix struct_group_tagged() parsing (git-fixes).
- commit e3a2a2e</changelog>
  <changelog author="fdmanana@suse.com" date="1719921604">- btrfs: fix crash on racing fsync and size-extending write into
  prealloc (bsc#1227101 CVE-2024-37354).
- commit 1d355af</changelog>
  <changelog author="vbabka@suse.cz" date="1719921605">- virt: acrn: stop using follow_pfn (CVE-2024-38610 bsc#1226758).
- commit c2ea51b</changelog>
  <changelog author="vbabka@suse.cz" date="1719921606">- drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
  (CVE-2024-38610 bsc#1226758).
- commit 7069ac2</changelog>
  <changelog author="rhopkins@suse.de" date="1719921607">- hsr: Prevent use after free in prp_create_tagged_frame()
  (CVE-2023-52846 bsc#1225098).
- commit cf63988</changelog>
  <changelog author="krisman@suse.de" date="1719921608">- io_uring: Fix io_cqring_wait() not restoring sigmask on
  get_timespec64() failure (git-fixes).
- commit e640a65</changelog>
  <changelog author="krisman@suse.de" date="1719921609">- io_uring: check for non-NULL file pointer in io_file_can_poll()
  (bsc#1226990 CVE-2024-39371).
- io_uring/io-wq: Use set_bit() and test_bit() at worker-&gt;flags
  (git-fixes).
- io_uring/sqpoll: work around a potential audit memory leak
  (git-fixes).
- commit 24603fc</changelog>
  <changelog author="krisman@suse.de" date="1719921610">- io_uring/rsrc: fix incorrect assignment of iter-&gt;nr_segs in
  io_import_fixed (git-fixes).
- io_uring/rsrc: don't lock while !TASK_RUNNING (git-fixes).
- io_uring/io-wq: avoid garbage value of 'match' in
  io_wq_enqueue() (git-fixes).
- commit 7d3e252</changelog>
</package>
<package pkgid="7aa460126355d06f93db99d71ac641465d8d0b9c201ad44a590417f45611f32d" name="dtb-freescale" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.17.1"/>
  <changelog author="tiwai@suse.de" date="1722081600">- auxdisplay: ht16k33: Drop reference after LED registration
  (git-fixes).
- ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
  on unprepare (git-fixes).
- ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
- ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
  reachable (git-fixes).
- ASoC: sof: amd: fix for firmware reload failure in Vangogh
  platform (git-fixes).
- ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
- ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
  (git-fixes).
- ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
- ALSA: ump: Don't update FB name for static blocks (git-fixes).
- drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
- drm/i915/gt: Do not consider preemption during execlists_dequeue
  for gen8 (git-fixes).
- drm/i915/dp: Don't switch the LTTPR mode on an active link
  (git-fixes).
- commit d7e2deb</changelog>
  <changelog author="tiwai@suse.de" date="1722081601">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
</package>
<package pkgid="32d7b88ff0a8955d03e87012f8ddb5cc7ef68ea869e0561600a20be5012e2636" name="dtb-freescale" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.7.1"/>
  <changelog author="mkubecek@suse.cz" date="1717416000">- netfilter: nf_tables: release mutex after nft_gc_seq_end from
  abort path (CVE-2024-26925 bsc#1223390).
- commit 578a709</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717416001">- Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
  The L3 bsc#1225765 was created seperately since our customer requires
  PTF.
- Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
- Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
- Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
- Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
- commit 054635e</changelog>
  <changelog author="msuchanek@suse.de" date="1717416002">- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
- powerpc/uaccess: Fix build errors seen with GCC 13/14
  (bsc#1194869).
- commit 46b5d84</changelog>
  <changelog author="msuchanek@suse.de" date="1717416003">- blacklist.conf: PPC fsl_msi is not used
- commit ae6590d</changelog>
  <changelog author="msuchanek@suse.de" date="1717416004">- powerpc/pseries/lparcfg: drop error message from guest name
  lookup (bsc#1187716 ltc#193451 git-fixes).
- commit ceab637</changelog>
  <changelog author="mfranc@suse.cz" date="1717416005">- Update
  patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
  (git-fixes CVE-2024-36955).
- Update
  patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
  (git-fixes bsc#1225715 CVE-2024-36906).
- Update
  patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
  (git-fixes bsc#1225579 CVE-2024-36011).
- Update
  patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
  (git-fixes bsc#1225578 CVE-2024-36013).
- Update
  patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
  (git-fixes bsc#1225502 CVE-2024-36012).
- Update
  patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
  (git-fixes bsc#1225722 CVE-2024-36880).
- Update
  patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
  (git-fixes CVE-2024-36942).
- Update
  patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
  (git-fixes bsc#1225720 CVE-2024-36032).
- Update
  patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
  (git-fixes bsc#1223749 CVE-2024-26990).
- Update
  patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
  (git-fixes bsc#1223692 CVE-2024-26992).
- Update
  patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
  (stable-fixes CVE-2024-36944).
- Update
  patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
  (git-fixes bsc#1225734 CVE-2024-36896).
- Update
  patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
  (stable-fixes CVE-2024-36949).
- Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
  (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
- Update
  patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
  (git-fixes bsc#1225692 CVE-2023-52882).
- Update
  patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
  (git-fixes CVE-2024-26761).
- Update
  patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
  (stable-fixes bsc#1225735 CVE-2024-36897).
- Update
  patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
  (stable-fixes bsc#1225705 CVE-2024-36026).
- Update
  patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
  (stable-fixes CVE-2024-36951).
- Update
  patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
  (git-fixes bsc#1225593 CVE-2024-36014).
- Update
  patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
  (stable-fixes bsc#1225728 CVE-2024-36885).
- Update
  patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
  (git-fixes bsc#1225773 CVE-2024-36936).
- Update
  patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
  (stable-fixes CVE-2024-36950).
- Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
  (git-fixes bsc#1225736 CVE-2024-36898).
- Update
  patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
  (git-fixes bsc#1225698 CVE-2024-36020).
- Update
  patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
  (git-fixes bsc#1225710 CVE-2024-36891).
- Update
  patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
  (git-fixes bsc#1225714 CVE-2024-36890).
- Update
  patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
  (git-fixes bsc#1225708 CVE-2024-36029).
- Update
  patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
  (git-fixes bsc#1225699 CVE-2024-36021).
- Update
  patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
  (git-fixes CVE-2024-26943).
- Update
  patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
  (git-fixes bsc#1225694 CVE-2024-36018).
- Update
  patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
  (git-fixes CVE-2024-36940).
- Update
  patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
  (git-fixes CVE-2024-36959).
- Update
  patches.suse/ppdev-Add-an-error-check-in-register_device.patch
  (git-fixes bsc#1225640 CVE-2024-36015).
- Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
  CVE-2024-36947).
- Update
  patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
  (git-fixes bsc#1225695 CVE-2024-36019).
- Update
  patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
  (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
- Update
  patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
  (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
- Update
  patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
  (git-fixes bsc#1225704 CVE-2024-36025).
- Update
  patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
  (git-fixes CVE-2024-36930).
- Update
  patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
  (bsc#1224331 bsc#1224602 CVE-2024-35814).
- Update
  patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
  (git-fixes bsc#1225642 CVE-2024-36016).
- Update
  patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
  (git-fixes bsc#1225749 CVE-2024-36894).
- Update
  patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
  (git-fixes bsc#1225750 CVE-2024-36895).
- Update
  patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
  (git-fixes bsc#1225748 CVE-2024-36893).
- Update
  patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
  (stable-fixes bsc#1225769 CVE-2024-36921).
- Update
  patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
  (stable-fixes CVE-2024-36922).
- Update
  patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
  (git-fixes CVE-2024-36941).
- Update
  patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
  (git-fixes bsc#1224742 CVE-2024-35803).
- commit 539780f</changelog>
  <changelog author="dwagner@suse.de" date="1717416006">- nvmet: fix ns enable/disable possible hang (git-fixes).
- nvme-multipath: fix io accounting on failover (git-fixes).
- nvme: fix multipath batched completion accounting (git-fixes).
- commit ed3b392</changelog>
  <changelog author="dwagner@suse.de" date="1717416007">- scsi: lpfc: Copyright updates for 14.4.0.2 patches
  (bsc#1225842).
- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
  (bsc#1225842).
  Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
  (bsc#1225842).
- scsi: lpfc: Clear deferred RSCN processing flag when driver
  is unloading (bsc#1225842).
- scsi: lpfc: Update logging of protection type for T10 DIF I/O
  (bsc#1225842).
- scsi: lpfc: Change default logging level for unsolicited CT
  MIB commands (bsc#1225842).
- commit 5a56384</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416008">- smb: client: fix mount when dns_resolver key is not available
  (git-fixes, bsc#1225172).
- commit 28edb5c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416009">- cifs: fix leak of iface for primary channel (git-fixes,
  bsc#1225172).
- commit b7eb8e8</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416010">- Revert "cifs: reconnect work should have reference on server
  struct" (git-fixes, bsc#1225172).
- commit 3ca4c0c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416011">- smb: client: fix parsing of SMB3.1.1 POSIX create context
  (git-fixes, bsc#1225172).
- commit 5f27f69</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416012">- cifs: failure to add channel on iface should bump up weight
  (git-fixes, bsc#1225172).
- commit 007b237</changelog>
  <changelog author="tonyj@suse.de" date="1717416013">- perf/x86: Fix out of range data (git-fixes).
- perf/x86/intel/ds: Don't clear -&gt;pebs_data_cfg for the last
  PEBS event (git-fixes).
- perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
- commit 664d77f</changelog>
  <changelog author="dsterba@suse.com" date="1717588800">- blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
- Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
  Quoting bsc#1225945#c11:
  "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
  transaction for every subvol create")
  ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
  unwritten extent buffer after snapshotting a new subvolume") was never
  backported."
- commit d947258</changelog>
  <changelog author="tonyj@suse.de" date="1717588801">- perf pmu: Count sys and cpuid JSON events separately (git
  fixes).
- perf stat: Don't display metric header for non-leader uncore
  events (git-fixes).
- perf daemon: Fix file leak in daemon_session__control
  (git-fixes).
- perf symbols: Fix ownership of string in dso__load_vmlinux()
  (git-fixes).
- perf thread: Fixes to thread__new() related to initializing comm
  (git-fixes).
- perf report: Avoid SEGV in report__setup_sample_type()
  (git-fixes).
- perf ui browser: Don't save pointer to stack memory (git-fixes).
- perf bench internals inject-build-id: Fix trap divide when
  collecting just one DSO (git-fixes).
- perf intel-pt: Fix unassigned instruction op (discovered by
  MemorySanitizer) (git-fixes).
- perf test shell arm_coresight: Increase buffer size for
  Coresight basic tests (git-fixes).
- perf docs: Document bpf event modifier (git-fixes).
- perf bench uprobe: Remove lib64 from libc.so.6 binary path
  (git-fixes).
- perf record: Fix debug message placement for test consumption
  (git-fixes).
- perf tests: Apply attributes to all events in object code
  reading test (git-fixes).
- perf tests: Make "test data symbol" more robust on Neoverse N1
  (git-fixes).
- perf annotate: Fix annotation_calc_lines() to pass correct
  address to get_srcline() (git-fixes).
- perf stat: Do not fail on metrics on s390 z/VM systems
  (git-fixes).
- perf sched timehist: Fix -g/--call-graph option failure
  (git-fixes).
- perf annotate: Get rid of duplicate --group option item
  (git-fixes).
- perf probe: Add missing libgen.h header needed for using
  basename() (git-fixes).
- perf record: Delete session after stopping sideband thread
  (git-fixes).
- perf auxtrace: Fix multiple use of --itrace option (git-fixes).
- perf script: Show also errors for --insn-trace option
  (git-fixes).
- perf lock contention: Add a missing NULL check (git-fixes).
- perf vendor events amd: Fix Zen 4 cache latency events
  (git-fixes).
- libperf evlist: Avoid out-of-bounds access (git-fixes).
- perf pmu: Fix a potential memory leak in perf_pmu__lookup()
  (git-fixes).
- perf print-events: make is_event_supported() more robust
  (git-fixes).
- perf list: fix short description for some cache events
  (git-fixes).
- perf metric: Don't remove scale from counts (git-fixes).
- perf stat: Avoid metric-only segv (git-fixes).
- perf expr: Fix "has_event" function for metric style events
  (git-fixes).
- perf srcline: Add missed addr2line closes (git-fixes).
- perf thread_map: Free strlist on normal path in
  thread_map__new_by_tid_str() (git-fixes).
- perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
- perf jevents: Drop or simplify small integer values (git-fixes).
- perf evsel: Fix duplicate initialization of data-&gt;id in
  evsel__parse_sample() (git-fixes).
- perf pmu: Treat the msr pmu as software (git-fixes).
- perf record: Check conflict between '--timestamp-filename'
  option and pipe mode before recording (git-fixes).
- perf record: Fix possible incorrect free in
  record__switch_output() (git-fixes).
- perf vendor events amd: Add Zen 4 memory controller events
  (git-fixes).
- perf top: Uniform the event name for the hybrid machine
  (git-fixes).
- perf top: Use evsel's cpus to replace user_requested_cpus
  (git-fixes).
- commit a1f9340</changelog>
  <changelog author="tonyj@suse.de" date="1717675200">- perf ui browser: Avoid SEGV on title (git fixes).
- commit 1578c22</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675201">- inet: inet_defrag: prevent sk release while still in use
  (CVE-2024-26921 bsc#1223138).
- commit 2016faf</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675202">- net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
- commit 7bf5961</changelog>
  <changelog author="tiwai@suse.de" date="1718366400">- Temporarily drop KVM patch that caused a regression (bsc#1226158)
  Delete patches.suse/KVM-x86-pmu-Prioritize-VMX-interception-over-GP-on-R.patch
- commit 33f31da</changelog>
</package>
<package pkgid="527d630669f5e3708338c36e556b7f92023a37fabd25670c5880ef4935a26a3e" name="dtb-hisilicon" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.14.1"/>
  <changelog author="tiwai@suse.de" date="1719662400">- gpiolib: cdev: Disallow reconfiguration without direction
  (uAPI v1) (git-fixes).
- gpio: davinci: Validate the obtained number of IRQs (git-fixes).
- commit 919ebd1</changelog>
  <changelog author="tiwai@suse.de" date="1719748800">- i2c: testunit: discard write requests while old command is
  running (git-fixes).
- i2c: testunit: don't erase registers after STOP (git-fixes).
- mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
  (git-fixes).
- mmc: sdhci: Do not invert write-protect twice (git-fixes).
- mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
  (git-fixes).
- mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
  (git-fixes).
- commit 448487d</changelog>
  <changelog author="tiwai@suse.de" date="1719748801">- crypto: iaa - Account for cpu-less numa nodes (bsc#1227190).
- commit cd600aa</changelog>
  <changelog author="tiwai@suse.de" date="1719748802">- crypto: deflate - Add aliases to deflate (bsc#1227190).
- commit 27ffd92</changelog>
  <changelog author="tiwai@suse.de" date="1719835200">- ata: ahci: Clean up sysfs file on error (git-fixes).
- ata: libata-core: Fix double free on error (git-fixes).
- ata,scsi: libata-core: Do not leak memory for ata_port struct
  members (git-fixes).
- ata: libata-core: Fix null pointer dereference on error
  (git-fixes).
- kbuild: Fix build target deb-pkg: ln: failed to create hard link
  (git-fixes).
- kbuild: doc: Update default INSTALL_MOD_DIR from extra to
  updates (git-fixes).
- kbuild: Install dtb files as 0644 in Makefile.dtbinst
  (git-fixes).
- counter: ti-eqep: enable clock at probe (git-fixes).
- iio: chemical: bme680: Fix sensor data read operation
  (git-fixes).
- iio: chemical: bme680: Fix overflows in compensate() functions
  (git-fixes).
- iio: chemical: bme680: Fix calibration data variable
  (git-fixes).
- iio: chemical: bme680: Fix pressure value output (git-fixes).
- iio: accel: fxls8962af: select IIO_BUFFER &amp; IIO_KFIFO_BUF
  (git-fixes).
- iio: adc: ad7266: Fix variable checking bug (git-fixes).
- iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
  (git-fixes).
- serial: bcm63xx-uart: fix tx after conversion to
  uart_port_tx_limited() (git-fixes).
- serial: core: introduce uart_port_tx_limited_flags()
  (git-fixes).
- Revert "serial: core: only stop transmit when HW fifo is empty"
  (git-fixes).
- tty: mcf: MCF54418 has 10 UARTS (git-fixes).
- usb: gadget: aspeed_udc: fix device address configuration
  (git-fixes).
- usb: dwc3: core: remove lock of otg mode during gadget
  suspend/resume to avoid deadlock (git-fixes).
- usb: typec: ucsi: glink: fix child node release in probe
  function (git-fixes).
- usb: musb: da8xx: fix a resource leak in probe() (git-fixes).
- usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  (git-fixes).
- usb: gadget: printer: fix races against disable (git-fixes).
- PCI/MSI: Fix UAF in msi_capability_init (git-fixes).
- commit a2ea5a9</changelog>
  <changelog author="ptesarik@suse.com" date="1719835201">- net: ena: Fix redundant device NUMA node override
  (jsc#PED-8688).
- commit 6ad6684</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835202">- tcp: do not accept ACK of bytes we never sent (CVE-2023-52881
  bsc#1225611).
- commit 16404a6</changelog>
  <changelog author="mhocko@suse.com" date="1719835203">- Update
  patches.suse/1352-drm-amdgpu-Fix-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52883
  bsc#1226630).
- Update
  patches.suse/9p-add-missing-locking-around-taking-dentry-fid-list.patch
  (git-fixes CVE-2024-39463 bsc#1227090).
- Update
  patches.suse/ALSA-Fix-deadlocks-with-kctl-removals-at-disconnecti.patch
  (stable-fixes CVE-2024-38600 bsc#1226864).
- Update
  patches.suse/ALSA-core-Fix-NULL-module-pointer-assignment-at-card.patch
  (git-fixes CVE-2024-38605 bsc#1226740).
- Update
  patches.suse/ALSA-hda-Fix-possible-null-ptr-deref-when-assigning-.patch
  (git-fixes CVE-2023-52806 bsc#1225554).
- Update
  patches.suse/ALSA-hda-cs_dsp_ctl-Use-private_free-for-control-cle.patch
  (git-fixes CVE-2024-38388 bsc#1226890).
- Update
  patches.suse/ALSA-timer-Set-lower-bound-of-start-tick-time.patch
  (stable-fixes git-fixes CVE-2024-38618 bsc#1226754).
- Update
  patches.suse/ASoC-kirkwood-Fix-potential-NULL-dereference.patch
  (git-fixes CVE-2024-38550 bsc#1226633).
- Update
  patches.suse/ASoC-mediatek-Assign-dummy-when-codec-not-specified-.patch
  (git-fixes CVE-2024-38551 bsc#1226761).
- Update
  patches.suse/Bluetooth-btusb-Add-date-evt_skb-is-NULL-check.patch
  (git-fixes CVE-2023-52833 bsc#1225595).
- Update
  patches.suse/Bluetooth-hci_core-Fix-possible-buffer-overflow.patch
  (git-fixes CVE-2024-26889).
- Update
  patches.suse/HID-uclogic-Fix-user-memory-access-bug-in-uclogic_pa.patch
  (git-fixes CVE-2023-52866 bsc#1225120).
- Update
  patches.suse/IB-mlx5-Fix-init-stage-error-handling-to-avoid-doubl.patch
  (jsc#PED-6864 CVE-2023-52851 bsc#1225587).
- Update
  patches.suse/Input-cyapa-add-missing-input-core-locking-to-suspen.patch
  (git-fixes CVE-2023-52884 bsc#1226764).
- Update
  patches.suse/Input-synaptics-rmi4-fix-use-after-free-in-rmi_unreg.patch
  (git-fixes CVE-2023-52840 bsc#1224928).
- Update
  patches.suse/KEYS-trusted-Do-not-use-WARN-when-encode-fails.patch
  (git-fixes CVE-2024-36975 bsc#1226520).
- Update
  patches.suse/KEYS-trusted-Fix-memory-leak-in-tpm2_key_encode.patch
  (git-fixes CVE-2024-36967 bsc#1226131).
- Update
  patches.suse/RDMA-cma-Fix-kmemleak-in-rdma_core-observed-during-b.patch
  (git-fixes CVE-2024-38539 bsc#1226608).
- Update patches.suse/RDMA-hns-Fix-UAF-for-cq-async-event.patch
  (git-fixes CVE-2024-38545 bsc#1226595).
- Update
  patches.suse/RDMA-hns-Fix-deadlock-on-SRQ-async-events.patch
  (git-fixes CVE-2024-38591 bsc#1226738).
- Update
  patches.suse/RDMA-hns-Modify-the-print-level-of-CQE-error.patch
  (git-fixes CVE-2024-38590 bsc#1226839).
- Update
  patches.suse/RDMA-rxe-Fix-seg-fault-in-rxe_comp_queue_pkt.patch
  (git-fixes CVE-2024-38544 bsc#1226597).
- Update
  patches.suse/SUNRPC-Fix-RPC-client-cleaned-up-the-freed-pipefs-de.patch
  (git-fixes CVE-2023-52803 bsc#1225008).
- Update patches.suse/af_unix-Clear-stale-u-oob_skb.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-35970 bsc#1224584).
- Update
  patches.suse/af_unix-Drop-oob_skb-ref-before-purging-queue-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26750 bsc#1222617).
- Update
  patches.suse/af_unix-Fix-task-hung-while-purging-oob_skb-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26780 bsc#1222588).
- Update
  patches.suse/af_unix-Update-unix_sk-sk-oob_skb-under-sk_receive_queue-lock.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-36972 bsc#1226163).
- Update
  patches.suse/arm64-Restrict-CPU_BIG_ENDIAN-to-GNU-as-or-LLVM-IAS-.patch
  (git-fixes CVE-2023-52750 bsc#1225485).
- Update
  patches.suse/atl1c-Work-around-the-DMA-RX-overflow-issue.patch
  (git-fixes CVE-2023-52834 bsc#1225599).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issue-of-net_device.patch
  (git-fixes CVE-2024-38554 bsc#1226742).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issues-of-ax25_dev.patch
  (git-fixes CVE-2024-38602 bsc#1226613).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-reorder-of-WRITE-lqueued.patch
  (bsc#1225605 CVE-2024-38384 bsc#1226938).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-resetting-io-stat.patch
  (bsc#1225605 CVE-2024-38663 bsc#1226939).
- Update
  patches.suse/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch
  (git-fixes CVE-2024-38540 bsc#1226582).
- Update
  patches.suse/bonding-stop-the-device-in-bond_setup_by_slave.patch
  (git-fixes CVE-2023-52784 bsc#1224946).
- Update
  patches.suse/can-dev-can_put_echo_skb-don-t-crash-kernel-if-can_p.patch
  (git-fixes CVE-2023-52878 bsc#1225000).
- Update
  patches.suse/clk-mediatek-clk-mt2701-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52875 bsc#1225096).
- Update
  patches.suse/clk-mediatek-clk-mt6765-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52870 bsc#1224937).
- Update
  patches.suse/clk-mediatek-clk-mt6779-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52873 bsc#1225589).
- Update
  patches.suse/clk-mediatek-clk-mt6797-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52865 bsc#1225086).
- Update
  patches.suse/clk-mediatek-clk-mt7629-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52858 bsc#1225566).
- Update
  patches.suse/clk-mediatek-clk-mt7629-eth-Add-check-for-mtk_alloc_.patch
  (git-fixes CVE-2023-52876 bsc#1225036).
- Update
  patches.suse/cppc_cpufreq-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38573 bsc#1226739).
- Update patches.suse/cpufreq-exit-callback-is-optional.patch
  (git-fixes CVE-2024-38615 bsc#1226592).
- Update patches.suse/crypto-bcm-Fix-pointer-arithmetic.patch
  (git-fixes CVE-2024-38579 bsc#1226637).
- Update
  patches.suse/crypto-pcrypt-Fix-hungtask-for-PADATA_RESET.patch
  (git-fixes CVE-2023-52813 bsc#1225527).
- Update patches.suse/cxl-mem-Fix-shutdown-order.patch (git-fixes
  CVE-2023-52849 bsc#1224949).
- Update
  patches.suse/cxl-region-Do-not-try-to-cleanup-after-cxl_region_se.patch
  (git-fixes CVE-2023-52792 bsc#1225477).
- Update patches.suse/cxl-region-Fix-cxlr_pmem-leaks.patch
  (git-fixes CVE-2024-38391 bsc#1226894).
- Update
  patches.suse/dma-buf-sw-sync-don-t-enable-IRQ-from-sync_print_obj.patch
  (git-fixes CVE-2024-38780 bsc#1226886).
- Update
  patches.suse/dma-mapping-benchmark-fix-node-id-validation.patch
  (git-fixes CVE-2024-34777 bsc#1226796).
- Update
  patches.suse/dma-mapping-benchmark-handle-NUMA_NO_NODE-correctly.patch
  (git-fixes CVE-2024-39277 bsc#1226909).
- Update
  patches.suse/dmaengine-idxd-Avoid-unnecessary-destruction-of-file.patch
  (git-fixes CVE-2024-38629 bsc#1226905).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Pola.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52819
  bsc#1225532).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-SMU7.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52818
  bsc#1225530).
- Update
  patches.suse/drm-amd-check-num-of-link-levels-when-update-pcie-pa.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52812
  bsc#1225564).
- Update
  patches.suse/drm-amd-display-Avoid-NULL-dereference-of-timing-gen.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52753
  bsc#1225478).
- Update
  patches.suse/drm-amd-display-Fix-division-by-zero-in-setup_dsc_co.patch
  (stable-fixes CVE-2024-36969 bsc#1226155).
- Update
  patches.suse/drm-amd-display-Fix-null-pointer-dereference-in-erro.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52862
  bsc#1225015).
- Update
  patches.suse/drm-amd-display-Fix-potential-index-out-of-bounds-in.patch
  (git-fixes CVE-2024-38552 bsc#1226767).
- Update
  patches.suse/drm-amd-display-fix-a-NULL-pointer-dereference-in-am.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52773
  bsc#1225041).
- Update
  patches.suse/drm-amd-display-fixed-integer-types-and-null-check-l.patch
  (git-fixes CVE-2024-26767).
- Update
  patches.suse/drm-amdgpu-Fix-a-null-pointer-access-when-the-smc_rr.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52817
  bsc#1225569).
- Update
  patches.suse/drm-amdgpu-Fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch
  (git-fixes CVE-2024-39291 bsc#1226934).
- Update
  patches.suse/drm-amdgpu-Fix-potential-null-pointer-derefernce.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52814
  bsc#1225565).
- Update
  patches.suse/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch
  (stable-fixes CVE-2024-39471 bsc#1227096).
- Update
  patches.suse/drm-amdgpu-mes-fix-use-after-free-issue.patch
  (stable-fixes CVE-2024-38581 bsc#1226657).
- Update
  patches.suse/drm-amdgpu-vkms-fix-a-possible-null-pointer-derefere.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52815
  bsc#1225568).
- Update
  patches.suse/drm-amdkfd-Fix-a-race-condition-of-vram-buffer-unref.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52825
  bsc#1225076).
- Update
  patches.suse/drm-amdkfd-Fix-shift-out-of-bounds-issue.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52816
  bsc#1225529).
- Update
  patches.suse/drm-bridge-cdns-mhdp8546-Fix-possible-null-pointer-d.patch
  (git-fixes CVE-2024-38548).
- Update
  patches.suse/drm-bridge-it66121-Fix-invalid-connector-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52861
  bsc#1224941).
- Update
  patches.suse/drm-bridge-lt8912b-Fix-crash-on-bridge-detach.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52856
  bsc#1224932).
- Update
  patches.suse/drm-mediatek-Add-0-size-check-to-mtk_drm_gem_obj.patch
  (git-fixes CVE-2024-38549 bsc#1226735).
- Update
  patches.suse/drm-mediatek-Fix-coverity-issue-with-unintentional-i.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52857
  bsc#1225581).
- Update
  patches.suse/drm-mediatek-Init-ddp_comp-with-devm_kcalloc.patch
  (git-fixes CVE-2024-38592 bsc#1226844).
- Update
  patches.suse/drm-msm-a6xx-Avoid-a-nullptr-dereference-when-speedb.patch
  (git-fixes CVE-2024-38390 bsc#1226891).
- Update
  patches.suse/drm-msm-dpu-Add-callback-function-pointer-check-befo.patch
  (git-fixes CVE-2024-38622 bsc#1226856).
- Update
  patches.suse/drm-panel-fix-a-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52821
  bsc#1225022).
- Update
  patches.suse/drm-panel-panel-tpo-tpg110-fix-a-possible-null-point.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52826
  bsc#1225077).
- Update patches.suse/drm-radeon-possible-buffer-overflow.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52867
  bsc#1225009).
- Update
  patches.suse/drm-vc4-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38546 bsc#1226593).
- Update
  patches.suse/drm-vmwgfx-Fix-invalid-reads-in-fence-signaled-event.patch
  (git-fixes CVE-2024-36960 bsc#1225872).
- Update
  patches.suse/drm-zynqmp_dpsub-Always-register-bridge.patch
  (git-fixes CVE-2024-38664 bsc#1226941).
- Update
  patches.suse/e1000e-change-usleep_range-to-udelay-in-PHY-mdic-acc.patch
  (CVE-2024-39296 bsc#1226989 CVE-2024-36887 bsc#1225731).
- Update
  patches.suse/ecryptfs-Fix-buffer-size-for-tag-66-packet.patch
  (git-fixes CVE-2024-38578 bsc#1226634).
- Update
  patches.suse/efi-libstub-only-free-priv.runtime_map-when-allocate.patch
  (git-fixes CVE-2024-33619 bsc#1226768).
- Update
  patches.suse/fbdev-imsttfb-fix-a-resource-leak-in-probe.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52838
  bsc#1225031).
- Update
  patches.suse/fs-9p-only-translate-RWX-permissions-for-plain-9P200.patch
  (git-fixes CVE-2024-36964 bsc#1225866).
- Update
  patches.suse/fs-jfs-Add-check-for-negative-db_l2nbperpage.patch
  (git-fixes CVE-2023-52810 bsc#1225557).
- Update
  patches.suse/fs-jfs-Add-validity-check-for-db_maxag-and-db_agpref.patch
  (git-fixes CVE-2023-52804 bsc#1225550).
- Update
  patches.suse/ftrace-Fix-possible-use-after-free-issue-in-ftrace_location.patch
  (git-fixes CVE-2024-38588 bsc#1226837).
- Update
  patches.suse/genirq-irqdesc-Prevent-use-after-free-in-irq_find_at.patch
  (git-fixes CVE-2024-38385 bsc#1227085).
- Update patches.suse/gfs2-ignore-negated-quota-changes.patch
  (git-fixes CVE-2023-52759 bsc#1225560).
- Update
  patches.suse/hid-cp2112-Fix-duplicate-workqueue-initialization.patch
  (git-fixes CVE-2023-52853 bsc#1224988).
- Update
  patches.suse/hwmon-axi-fan-control-Fix-possible-NULL-pointer-dere.patch
  (git-fixes CVE-2023-52863 bsc#1225586).
- Update
  patches.suse/i2c-acpi-Unbind-mux-adapters-before-delete.patch
  (git-fixes CVE-2024-39362 bsc#1226995).
- Update
  patches.suse/i2c-core-Run-atomic-i2c-xfer-when-preemptible.patch
  (git-fixes CVE-2023-52791 bsc#1225108).
- Update
  patches.suse/i3c-master-mipi-i3c-hci-Fix-a-kernel-panic-for-acces.patch
  (git-fixes CVE-2023-52763 bsc#1225570).
- Update
  patches.suse/i3c-mipi-i3c-hci-Fix-out-of-bounds-access-in-hci_dma.patch
  (git-fixes CVE-2023-52766).
- Update
  patches.suse/i915-perf-Fix-NULL-deref-bugs-with-drm_dbg-calls.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52788
  bsc#1225106).
- Update
  patches.suse/igb-Fix-string-truncation-warnings-in-igb_set_fw_ver.patch
  (git-fixes CVE-2024-36010 bsc#1225594).
- Update
  patches.suse/iommu-vt-d-Fix-WARN_ON-in-iommu-probe-path.patch
  (git-fixes CVE-2024-35957 bsc#1224673).
- Update
  patches.suse/iommufd-Fix-missing-update-of-domains_itree-after-splitting-iopt
  (jsc#PED-7779 jsc#PED-7780 CVE-2023-52801 bsc#1225006).
- Update
  patches.suse/ipvlan-add-ipvlan_route_v6_outbound-helper.patch
  (git-fixes CVE-2023-52796 bsc#1224930).
- Update
  patches.suse/jffs2-prevent-xattr-node-from-overflowing-the-eraseblock.patch
  (git-fixes CVE-2024-38599 bsc#1226848).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-dbFindLeaf.patch
  (git-fixes CVE-2023-52799 bsc#1225472).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-diAlloc.patch
  (git-fixes CVE-2023-52805 bsc#1225553).
- Update
  patches.suse/kunit-fortify-Fix-mismatched-kvalloc-vfree-usage.patch
  (git-fixes CVE-2024-38617 bsc#1226859).
- Update
  patches.suse/lib-generic-radix-tree.c-Don-t-overflow-in-peek.patch
  (git-fixes CVE-2021-47432 bsc#1225391).
- Update
  patches.suse/lib-test_hmm.c-handle-src_pfns-and-dst_pfns-allocati.patch
  (git-fixes CVE-2024-38543 bsc#1226594).
- Update
  patches.suse/locking-ww_mutex-test-Fix-potential-workqueue-corrup.patch
  (bsc#1219953 CVE-2023-52836 bsc#1225609).
- Update
  patches.suse/md-Don-t-ignore-suspended-array-in-md_check_recovery-1baa.patch
  (bsc#1219596 CVE-2024-26758).
- Update
  patches.suse/media-atomisp-ssh_css-Fix-a-null-pointer-dereference.patch
  (git-fixes CVE-2024-38547 bsc#1226632).
- Update
  patches.suse/media-bttv-fix-use-after-free-error-due-to-btv-timeo.patch
  (git-fixes CVE-2023-52847 bsc#1225588).
- Update
  patches.suse/media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch
  (git-fixes CVE-2023-52764 bsc#1225571).
- Update
  patches.suse/media-hantro-Check-whether-reset-op-is-defined-befor.patch
  (git-fixes CVE-2023-52850 bsc#1225014).
- Update
  patches.suse/media-i2c-et8ek8-Don-t-strip-remove-function-when-dr.patch
  (git-fixes CVE-2024-38611 bsc#1226760).
- Update
  patches.suse/media-imon-fix-access-to-invalid-resource-for-the-se.patch
  (git-fixes CVE-2023-52754 bsc#1225490).
- Update
  patches.suse/media-lgdt3306a-Add-a-check-against-null-pointer-def.patch
  (stable-fixes CVE-2022-48772 bsc#1226976).
- Update
  patches.suse/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch
  (git-fixes CVE-2024-38621 bsc#1226895).
- Update
  patches.suse/media-vidtv-mux-Add-check-and-kfree-for-kstrdup.patch
  (git-fixes CVE-2023-52841 bsc#1225592).
- Update patches.suse/media-vidtv-psi-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52844 bsc#1225590).
- Update
  patches.suse/mfd-qcom-spmi-pmic-Fix-revid-implementation.patch
  (git-fixes CVE-2023-52765 bsc#1225029).
- Update
  patches.suse/misc-microchip-pci1xxxx-fix-double-free-in-the-error.patch
  (git-fixes CVE-2024-36973 bsc#1226457).
- Update
  patches.suse/net-hns3-fix-out-of-bounds-access-may-occur-when-coa.patch
  (git-fixes CVE-2023-52807 bsc#1225097).
- Update
  patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch
  (git-fixes CVE-2024-36962 bsc#1225827).
- Update
  patches.suse/net-mlx5-Fix-peer-devlink-set-for-SF-representor-dev.patch
  (git-fixes CVE-2024-38595 bsc#1226741).
- Update
  patches.suse/net-mlx5e-Track-xmit-submission-to-PTP-WQ-after-popu.patch
  (jsc#PED-3311 CVE-2023-52782 bsc#1225103).
- Update
  patches.suse/net-mvneta-fix-calls-to-page_pool_get_stats.patch
  (git-fixes CVE-2023-52780 bsc#1224933).
- Update
  patches.suse/net-wangxun-fix-kernel-panic-due-to-null-pointer.patch
  (git-fixes CVE-2023-52783 bsc#1225104).
- Update
  patches.suse/netfilter-complete-validation-of-user-input.patch
  (git-fixes CVE-2024-35896 bsc#1224662 CVE-2024-35962
  bsc#1224583).
- Update
  patches.suse/nfc-nci-Fix-uninit-value-in-nci_rx_work.patch
  (git-fixes CVE-2024-38381 bsc#1226878).
- Update
  patches.suse/nilfs2-fix-nilfs_empty_dir-misjudgment-and-long-loop.patch
  (git-fixes CVE-2024-39469 bsc#1226992).
- Update
  patches.suse/nilfs2-fix-potential-hang-in-nilfs_detach_log_writer.patch
  (git-fixes CVE-2024-38582 bsc#1226658).
- Update
  patches.suse/nilfs2-fix-use-after-free-of-timer-for-log-writer-th.patch
  (git-fixes CVE-2024-38583 bsc#1226777).
- Update
  patches.suse/of-module-add-buffer-overflow-check-in-of_modalias.patch
  (git-fixes CVE-2024-38541 bsc#1226587).
- Update
  patches.suse/padata-Fix-refcnt-handling-in-padata_free_shell.patch
  (git-fixes CVE-2023-52854 bsc#1225584).
- Update
  patches.suse/perf-core-Bail-out-early-if-the-request-AUX-area-is-out-of-bound.patch
  (git-fixes CVE-2023-52835 bsc#1225602).
- Update
  patches.suse/platform-x86-wmi-Fix-opening-of-char-device.patch
  (git-fixes CVE-2023-52864 bsc#1225132).
- Update
  patches.suse/powerpc-pseries-iommu-LPAR-panics-during-boot-up-wit.patch
  (bsc#1222011 ltc#205900 CVE-2024-36926 bsc#1225829).
- Update patches.suse/pstore-platform-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52869 bsc#1225050).
- Update
  patches.suse/remoteproc-mediatek-Make-sure-IPI-buffer-fits-in-L2T.patch
  (git-fixes CVE-2024-36965 bsc#1226149).
- Update
  patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch
  (git-fixes CVE-2024-38601 bsc#1226876).
- Update
  patches.suse/s390-dasd-protect-device-queue-against-concurrent-access.patch
  (git-fixes bsc#1217481 CVE-2023-52774 bsc#1225572).
- Update
  patches.suse/scsi-hisi_sas-Set-debugfs_dir-pointer-to-NULL-after-removing-debugfs.patch
  (git-fixes CVE-2023-52808 bsc#1225555).
- Update
  patches.suse/scsi-ibmvfc-Remove-BUG_ON-in-the-case-of-an-empty-ev.patch
  (bsc#1209834 ltc#202097 CVE-2023-52811 bsc#1225559).
- Update
  patches.suse/scsi-libfc-Fix-potential-NULL-pointer-dereference-in-fc_lport_ptp_setup.patch
  (git-fixes CVE-2023-52809 bsc#1225556).
- Update
  patches.suse/scsi-lpfc-Move-NPIV-s-transport-unregistration-to-af.patch
  (bsc#1221777 CVE-2024-36952 bsc#1225898).
- Update
  patches.suse/scsi-lpfc-Release-hbalock-before-calling-lpfc_worker.patch
  (bsc#1221777 CVE-2024-36924 bsc#1225820).
- Update
  patches.suse/serial-max3100-Lock-port-lock-when-calling-uart_hand.patch
  (git-fixes CVE-2024-38634 bsc#1226868).
- Update
  patches.suse/serial-max3100-Update-uart_driver_registered-on-driv.patch
  (git-fixes CVE-2024-38633 bsc#1226867).
- Update
  patches.suse/soc-qcom-llcc-Handle-a-second-device-without-data-co.patch
  (git-fixes CVE-2023-52871 bsc#1225534).
- Update
  patches.suse/soundwire-cadence-fix-invalid-PDI-offset.patch
  (stable-fixes CVE-2024-38635 bsc#1226863).
- Update patches.suse/speakup-Fix-sizeof-vs-ARRAY_SIZE-bug.patch
  (git-fixes CVE-2024-38587 bsc#1226780).
- Update patches.suse/spi-Fix-null-dereference-on-suspend.patch
  (git-fixes CVE-2023-52749 bsc#1225476).
- Update
  patches.suse/thermal-core-prevent-potential-string-overflow.patch
  (git-fixes CVE-2023-52868 bsc#1225044).
- Update
  patches.suse/thermal-drivers-qcom-lmh-Check-for-SCM-availability-.patch
  (git-fixes CVE-2024-39466 bsc#1227089).
- Update
  patches.suse/thermal-drivers-tsens-Fix-null-pointer-dereference.patch
  (git-fixes CVE-2024-38571 bsc#1226737).
- Update
  patches.suse/thermal-intel-powerclamp-fix-mismatch-in-get-functio.patch
  (git-fixes CVE-2023-52794 bsc#1225028).
- Update
  patches.suse/tls-fix-NULL-deref-on-tls_sw_splice_eof-with-empty-r.patch
  (jsc#PED-6831 CVE-2023-52767 bsc#1224998).
- Update
  patches.suse/tpm_tis_spi-Account-for-SPI-header-when-allocating-T.patch
  (git-fixes CVE-2024-36477 bsc#1226840).
- Update
  patches.suse/tracing-Have-trace_event_file-have-ref-counters.patch
  (git-fixes CVE-2023-52879 bsc#1225101).
- Update
  patches.suse/tracing-trigger-Fix-to-return-error-if-failed-to-alloc-snapshot.patch
  (git-fixes CVE-2024-26920).
- Update
  patches.suse/tty-n_gsm-fix-race-condition-in-status-line-change-o.patch
  (git-fixes CVE-2023-52872 bsc#1225591).
- Update
  patches.suse/tty-n_gsm-require-CAP_NET_ADMIN-to-attach-N_GSM0710-.patch
  (bsc#1222619 CVE-2023-52880).
- Update
  patches.suse/tty-vcc-Add-check-for-kstrdup-in-vcc_probe.patch
  (git-fixes CVE-2023-52789 bsc#1225180).
- Update
  patches.suse/usb-config-fix-iteration-issue-in-usb_get_bos_descri.patch
  (git-fixes CVE-2023-52781 bsc#1225092).
- Update
  patches.suse/usb-dwc3-Wait-unconditionally-after-issuing-EndXfer-.patch
  (git-fixes CVE-2024-36977 bsc#1226513).
- Update
  patches.suse/usb-gadget-u_audio-Fix-race-condition-use-of-control.patch
  (git-fixes CVE-2024-38628 bsc#1226911).
- Update
  patches.suse/usb-storage-alauda-Check-whether-the-media-is-initia.patch
  (git-fixes CVE-2024-38619 bsc#1226861).
- Update
  patches.suse/usb-typec-tcpm-Fix-NULL-pointer-dereference-in-tcpm_.patch
  (git-fixes CVE-2023-52877 bsc#1224944).
- Update
  patches.suse/vhost-vdpa-fix-use-after-free-in-vhost_vdpa_probe.patch
  (jsc#PED-3311 CVE-2023-52795 bsc#1225085).
- Update
  patches.suse/virtio-blk-fix-implicit-overflow-on-virtio_max_dma_s.patch
  (git-fixes CVE-2023-52762 bsc#1225573).
- Update
  patches.suse/virtio-vsock-Fix-uninit-value-in-virtio_transport_re.patch
  (jsc#PED-5505 CVE-2023-52842 bsc#1225025).
- Update
  patches.suse/watchdog-cpu5wdt.c-Fix-use-after-free-bug-caused-by-.patch
  (git-fixes CVE-2024-38630 bsc#1226908).
- Update
  patches.suse/wifi-ar5523-enable-proper-endpoint-verification.patch
  (git-fixes CVE-2024-38565 bsc#1226747).
- Update
  patches.suse/wifi-ath11k-fix-dfs-radar-event-locking.patch
  (git-fixes CVE-2023-52798 bsc#1224947).
- Update
  patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch
  (git-fixes CVE-2023-52777 bsc#1224992).
- Update patches.suse/wifi-ath11k-fix-htt-pktlog-locking.patch
  (git-fixes CVE-2023-52800).
- Update
  patches.suse/wifi-ath12k-fix-dfs-radar-and-temperature-event-lock.patch
  (git-fixes CVE-2023-52776 bsc#1225090).
- Update
  patches.suse/wifi-ath12k-fix-htt-mlo-offset-event-locking.patch
  (git-fixes CVE-2023-52769 bsc#1225001).
- Update
  patches.suse/wifi-ath12k-fix-out-of-bound-access-of-qmi_invoke_ha.patch
  (git-fixes CVE-2024-38572 bsc#1226776).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-read-in-ath12k.patch
  (git-fixes CVE-2023-52827 bsc#1225078).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-write-in-ath12.patch
  (git-fixes CVE-2023-52829 bsc#1225081).
- Update
  patches.suse/wifi-brcmfmac-pcie-handle-randbuf-allocation-failure.patch
  (git-fixes CVE-2024-38575 bsc#1226612).
- Update
  patches.suse/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch
  (git-fixes CVE-2024-38567 bsc#1226769).
- Update
  patches.suse/wifi-carl9170-re-fix-fortified-memset-warning.patch
  (git-fixes CVE-2024-38616 bsc#1226852).
- Update
  patches.suse/wifi-mac80211-don-t-return-unset-power-in-ieee80211_.patch
  (git-fixes CVE-2023-52832 bsc#1225577).
- Update
  patches.suse/wifi-nl80211-Avoid-address-calculations-via-out-of-b.patch
  (git-fixes CVE-2024-38562 bsc#1226788).
- Update
  patches.suse/wifi-wilc1000-use-vmm_table-as-array-in-wilc-struct.patch
  (git-fixes CVE-2023-52768 bsc#1225004).
- Update
  patches.suse/x86-tdx-Zero-out-the-missing-RSI-in-TDX_HYPERCALL-macro.patch
  (jsc#PED-5824 CVE-2023-52874 bsc#1225049).
- commit 33efdc4</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835204">- tcp: Use refcount_inc_not_zero() in tcp_twsk_unique()
  (CVE-2024-36904 bsc#1225732).
- commit d578dcc</changelog>
  <changelog author="heming.zhao@suse.com" date="1719921600">- gfs2: Fix potential glock use-after-free on unmount (bsc#1226775
  CVE-2024-38570).
- gfs2: Rename sd_{ glock =&gt; kill }_wait (bsc#1226775
  CVE-2024-38570).
- commit f3adbca</changelog>
  <changelog author="tiwai@suse.de" date="1719921601">- Correct SCSI patch references (bsc#1225767 CVE-2024-36919 bsc#1226785 CVE-2024-38559)
- commit e8ea587</changelog>
  <changelog author="tiwai@suse.de" date="1719921602">- mtd: rawnand: rockchip: ensure NVDDR timings are rejected
  (git-fixes).
- mtd: rawnand: Bypass a couple of sanity checks during NAND
  identification (git-fixes).
- mtd: rawnand: Fix the nand_read_data_op() early check
  (git-fixes).
- mtd: rawnand: Ensure ECC configuration is propagated to upper
  layers (git-fixes).
- commit e545951</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1719921603">- kernel-doc: fix struct_group_tagged() parsing (git-fixes).
- commit e3a2a2e</changelog>
  <changelog author="fdmanana@suse.com" date="1719921604">- btrfs: fix crash on racing fsync and size-extending write into
  prealloc (bsc#1227101 CVE-2024-37354).
- commit 1d355af</changelog>
  <changelog author="vbabka@suse.cz" date="1719921605">- virt: acrn: stop using follow_pfn (CVE-2024-38610 bsc#1226758).
- commit c2ea51b</changelog>
  <changelog author="vbabka@suse.cz" date="1719921606">- drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
  (CVE-2024-38610 bsc#1226758).
- commit 7069ac2</changelog>
  <changelog author="rhopkins@suse.de" date="1719921607">- hsr: Prevent use after free in prp_create_tagged_frame()
  (CVE-2023-52846 bsc#1225098).
- commit cf63988</changelog>
  <changelog author="krisman@suse.de" date="1719921608">- io_uring: Fix io_cqring_wait() not restoring sigmask on
  get_timespec64() failure (git-fixes).
- commit e640a65</changelog>
  <changelog author="krisman@suse.de" date="1719921609">- io_uring: check for non-NULL file pointer in io_file_can_poll()
  (bsc#1226990 CVE-2024-39371).
- io_uring/io-wq: Use set_bit() and test_bit() at worker-&gt;flags
  (git-fixes).
- io_uring/sqpoll: work around a potential audit memory leak
  (git-fixes).
- commit 24603fc</changelog>
  <changelog author="krisman@suse.de" date="1719921610">- io_uring/rsrc: fix incorrect assignment of iter-&gt;nr_segs in
  io_import_fixed (git-fixes).
- io_uring/rsrc: don't lock while !TASK_RUNNING (git-fixes).
- io_uring/io-wq: avoid garbage value of 'match' in
  io_wq_enqueue() (git-fixes).
- commit 7d3e252</changelog>
</package>
<package pkgid="e46b7c5da15e4f08a6652a219bb0cdb7dd0016bc6778225cbf1a167124668e14" name="dtb-hisilicon" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.17.1"/>
  <changelog author="tiwai@suse.de" date="1722081600">- auxdisplay: ht16k33: Drop reference after LED registration
  (git-fixes).
- ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
  on unprepare (git-fixes).
- ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
- ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
  reachable (git-fixes).
- ASoC: sof: amd: fix for firmware reload failure in Vangogh
  platform (git-fixes).
- ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
- ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
  (git-fixes).
- ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
- ALSA: ump: Don't update FB name for static blocks (git-fixes).
- drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
- drm/i915/gt: Do not consider preemption during execlists_dequeue
  for gen8 (git-fixes).
- drm/i915/dp: Don't switch the LTTPR mode on an active link
  (git-fixes).
- commit d7e2deb</changelog>
  <changelog author="tiwai@suse.de" date="1722081601">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
</package>
<package pkgid="564db685bf27fbb64924398b4acfb1c559f11332e04e648d59ea88187f5de84f" name="dtb-hisilicon" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.7.1"/>
  <changelog author="mkubecek@suse.cz" date="1717416000">- netfilter: nf_tables: release mutex after nft_gc_seq_end from
  abort path (CVE-2024-26925 bsc#1223390).
- commit 578a709</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717416001">- Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
  The L3 bsc#1225765 was created seperately since our customer requires
  PTF.
- Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
- Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
- Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
- Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
- commit 054635e</changelog>
  <changelog author="msuchanek@suse.de" date="1717416002">- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
- powerpc/uaccess: Fix build errors seen with GCC 13/14
  (bsc#1194869).
- commit 46b5d84</changelog>
  <changelog author="msuchanek@suse.de" date="1717416003">- blacklist.conf: PPC fsl_msi is not used
- commit ae6590d</changelog>
  <changelog author="msuchanek@suse.de" date="1717416004">- powerpc/pseries/lparcfg: drop error message from guest name
  lookup (bsc#1187716 ltc#193451 git-fixes).
- commit ceab637</changelog>
  <changelog author="mfranc@suse.cz" date="1717416005">- Update
  patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
  (git-fixes CVE-2024-36955).
- Update
  patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
  (git-fixes bsc#1225715 CVE-2024-36906).
- Update
  patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
  (git-fixes bsc#1225579 CVE-2024-36011).
- Update
  patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
  (git-fixes bsc#1225578 CVE-2024-36013).
- Update
  patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
  (git-fixes bsc#1225502 CVE-2024-36012).
- Update
  patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
  (git-fixes bsc#1225722 CVE-2024-36880).
- Update
  patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
  (git-fixes CVE-2024-36942).
- Update
  patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
  (git-fixes bsc#1225720 CVE-2024-36032).
- Update
  patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
  (git-fixes bsc#1223749 CVE-2024-26990).
- Update
  patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
  (git-fixes bsc#1223692 CVE-2024-26992).
- Update
  patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
  (stable-fixes CVE-2024-36944).
- Update
  patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
  (git-fixes bsc#1225734 CVE-2024-36896).
- Update
  patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
  (stable-fixes CVE-2024-36949).
- Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
  (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
- Update
  patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
  (git-fixes bsc#1225692 CVE-2023-52882).
- Update
  patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
  (git-fixes CVE-2024-26761).
- Update
  patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
  (stable-fixes bsc#1225735 CVE-2024-36897).
- Update
  patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
  (stable-fixes bsc#1225705 CVE-2024-36026).
- Update
  patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
  (stable-fixes CVE-2024-36951).
- Update
  patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
  (git-fixes bsc#1225593 CVE-2024-36014).
- Update
  patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
  (stable-fixes bsc#1225728 CVE-2024-36885).
- Update
  patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
  (git-fixes bsc#1225773 CVE-2024-36936).
- Update
  patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
  (stable-fixes CVE-2024-36950).
- Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
  (git-fixes bsc#1225736 CVE-2024-36898).
- Update
  patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
  (git-fixes bsc#1225698 CVE-2024-36020).
- Update
  patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
  (git-fixes bsc#1225710 CVE-2024-36891).
- Update
  patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
  (git-fixes bsc#1225714 CVE-2024-36890).
- Update
  patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
  (git-fixes bsc#1225708 CVE-2024-36029).
- Update
  patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
  (git-fixes bsc#1225699 CVE-2024-36021).
- Update
  patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
  (git-fixes CVE-2024-26943).
- Update
  patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
  (git-fixes bsc#1225694 CVE-2024-36018).
- Update
  patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
  (git-fixes CVE-2024-36940).
- Update
  patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
  (git-fixes CVE-2024-36959).
- Update
  patches.suse/ppdev-Add-an-error-check-in-register_device.patch
  (git-fixes bsc#1225640 CVE-2024-36015).
- Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
  CVE-2024-36947).
- Update
  patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
  (git-fixes bsc#1225695 CVE-2024-36019).
- Update
  patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
  (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
- Update
  patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
  (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
- Update
  patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
  (git-fixes bsc#1225704 CVE-2024-36025).
- Update
  patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
  (git-fixes CVE-2024-36930).
- Update
  patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
  (bsc#1224331 bsc#1224602 CVE-2024-35814).
- Update
  patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
  (git-fixes bsc#1225642 CVE-2024-36016).
- Update
  patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
  (git-fixes bsc#1225749 CVE-2024-36894).
- Update
  patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
  (git-fixes bsc#1225750 CVE-2024-36895).
- Update
  patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
  (git-fixes bsc#1225748 CVE-2024-36893).
- Update
  patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
  (stable-fixes bsc#1225769 CVE-2024-36921).
- Update
  patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
  (stable-fixes CVE-2024-36922).
- Update
  patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
  (git-fixes CVE-2024-36941).
- Update
  patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
  (git-fixes bsc#1224742 CVE-2024-35803).
- commit 539780f</changelog>
  <changelog author="dwagner@suse.de" date="1717416006">- nvmet: fix ns enable/disable possible hang (git-fixes).
- nvme-multipath: fix io accounting on failover (git-fixes).
- nvme: fix multipath batched completion accounting (git-fixes).
- commit ed3b392</changelog>
  <changelog author="dwagner@suse.de" date="1717416007">- scsi: lpfc: Copyright updates for 14.4.0.2 patches
  (bsc#1225842).
- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
  (bsc#1225842).
  Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
  (bsc#1225842).
- scsi: lpfc: Clear deferred RSCN processing flag when driver
  is unloading (bsc#1225842).
- scsi: lpfc: Update logging of protection type for T10 DIF I/O
  (bsc#1225842).
- scsi: lpfc: Change default logging level for unsolicited CT
  MIB commands (bsc#1225842).
- commit 5a56384</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416008">- smb: client: fix mount when dns_resolver key is not available
  (git-fixes, bsc#1225172).
- commit 28edb5c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416009">- cifs: fix leak of iface for primary channel (git-fixes,
  bsc#1225172).
- commit b7eb8e8</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416010">- Revert "cifs: reconnect work should have reference on server
  struct" (git-fixes, bsc#1225172).
- commit 3ca4c0c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416011">- smb: client: fix parsing of SMB3.1.1 POSIX create context
  (git-fixes, bsc#1225172).
- commit 5f27f69</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416012">- cifs: failure to add channel on iface should bump up weight
  (git-fixes, bsc#1225172).
- commit 007b237</changelog>
  <changelog author="tonyj@suse.de" date="1717416013">- perf/x86: Fix out of range data (git-fixes).
- perf/x86/intel/ds: Don't clear -&gt;pebs_data_cfg for the last
  PEBS event (git-fixes).
- perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
- commit 664d77f</changelog>
  <changelog author="dsterba@suse.com" date="1717588800">- blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
- Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
  Quoting bsc#1225945#c11:
  "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
  transaction for every subvol create")
  ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
  unwritten extent buffer after snapshotting a new subvolume") was never
  backported."
- commit d947258</changelog>
  <changelog author="tonyj@suse.de" date="1717588801">- perf pmu: Count sys and cpuid JSON events separately (git
  fixes).
- perf stat: Don't display metric header for non-leader uncore
  events (git-fixes).
- perf daemon: Fix file leak in daemon_session__control
  (git-fixes).
- perf symbols: Fix ownership of string in dso__load_vmlinux()
  (git-fixes).
- perf thread: Fixes to thread__new() related to initializing comm
  (git-fixes).
- perf report: Avoid SEGV in report__setup_sample_type()
  (git-fixes).
- perf ui browser: Don't save pointer to stack memory (git-fixes).
- perf bench internals inject-build-id: Fix trap divide when
  collecting just one DSO (git-fixes).
- perf intel-pt: Fix unassigned instruction op (discovered by
  MemorySanitizer) (git-fixes).
- perf test shell arm_coresight: Increase buffer size for
  Coresight basic tests (git-fixes).
- perf docs: Document bpf event modifier (git-fixes).
- perf bench uprobe: Remove lib64 from libc.so.6 binary path
  (git-fixes).
- perf record: Fix debug message placement for test consumption
  (git-fixes).
- perf tests: Apply attributes to all events in object code
  reading test (git-fixes).
- perf tests: Make "test data symbol" more robust on Neoverse N1
  (git-fixes).
- perf annotate: Fix annotation_calc_lines() to pass correct
  address to get_srcline() (git-fixes).
- perf stat: Do not fail on metrics on s390 z/VM systems
  (git-fixes).
- perf sched timehist: Fix -g/--call-graph option failure
  (git-fixes).
- perf annotate: Get rid of duplicate --group option item
  (git-fixes).
- perf probe: Add missing libgen.h header needed for using
  basename() (git-fixes).
- perf record: Delete session after stopping sideband thread
  (git-fixes).
- perf auxtrace: Fix multiple use of --itrace option (git-fixes).
- perf script: Show also errors for --insn-trace option
  (git-fixes).
- perf lock contention: Add a missing NULL check (git-fixes).
- perf vendor events amd: Fix Zen 4 cache latency events
  (git-fixes).
- libperf evlist: Avoid out-of-bounds access (git-fixes).
- perf pmu: Fix a potential memory leak in perf_pmu__lookup()
  (git-fixes).
- perf print-events: make is_event_supported() more robust
  (git-fixes).
- perf list: fix short description for some cache events
  (git-fixes).
- perf metric: Don't remove scale from counts (git-fixes).
- perf stat: Avoid metric-only segv (git-fixes).
- perf expr: Fix "has_event" function for metric style events
  (git-fixes).
- perf srcline: Add missed addr2line closes (git-fixes).
- perf thread_map: Free strlist on normal path in
  thread_map__new_by_tid_str() (git-fixes).
- perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
- perf jevents: Drop or simplify small integer values (git-fixes).
- perf evsel: Fix duplicate initialization of data-&gt;id in
  evsel__parse_sample() (git-fixes).
- perf pmu: Treat the msr pmu as software (git-fixes).
- perf record: Check conflict between '--timestamp-filename'
  option and pipe mode before recording (git-fixes).
- perf record: Fix possible incorrect free in
  record__switch_output() (git-fixes).
- perf vendor events amd: Add Zen 4 memory controller events
  (git-fixes).
- perf top: Uniform the event name for the hybrid machine
  (git-fixes).
- perf top: Use evsel's cpus to replace user_requested_cpus
  (git-fixes).
- commit a1f9340</changelog>
  <changelog author="tonyj@suse.de" date="1717675200">- perf ui browser: Avoid SEGV on title (git fixes).
- commit 1578c22</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675201">- inet: inet_defrag: prevent sk release while still in use
  (CVE-2024-26921 bsc#1223138).
- commit 2016faf</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675202">- net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
- commit 7bf5961</changelog>
  <changelog author="tiwai@suse.de" date="1718366400">- Temporarily drop KVM patch that caused a regression (bsc#1226158)
  Delete patches.suse/KVM-x86-pmu-Prioritize-VMX-interception-over-GP-on-R.patch
- commit 33f31da</changelog>
</package>
<package pkgid="c70cee7a05a254db7a2fd9515782e061291bcf83e912a437f743d5f60c4cd308" name="dtb-lg" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.14.1"/>
  <changelog author="tiwai@suse.de" date="1719662400">- gpiolib: cdev: Disallow reconfiguration without direction
  (uAPI v1) (git-fixes).
- gpio: davinci: Validate the obtained number of IRQs (git-fixes).
- commit 919ebd1</changelog>
  <changelog author="tiwai@suse.de" date="1719748800">- i2c: testunit: discard write requests while old command is
  running (git-fixes).
- i2c: testunit: don't erase registers after STOP (git-fixes).
- mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
  (git-fixes).
- mmc: sdhci: Do not invert write-protect twice (git-fixes).
- mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
  (git-fixes).
- mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
  (git-fixes).
- commit 448487d</changelog>
  <changelog author="tiwai@suse.de" date="1719748801">- crypto: iaa - Account for cpu-less numa nodes (bsc#1227190).
- commit cd600aa</changelog>
  <changelog author="tiwai@suse.de" date="1719748802">- crypto: deflate - Add aliases to deflate (bsc#1227190).
- commit 27ffd92</changelog>
  <changelog author="tiwai@suse.de" date="1719835200">- ata: ahci: Clean up sysfs file on error (git-fixes).
- ata: libata-core: Fix double free on error (git-fixes).
- ata,scsi: libata-core: Do not leak memory for ata_port struct
  members (git-fixes).
- ata: libata-core: Fix null pointer dereference on error
  (git-fixes).
- kbuild: Fix build target deb-pkg: ln: failed to create hard link
  (git-fixes).
- kbuild: doc: Update default INSTALL_MOD_DIR from extra to
  updates (git-fixes).
- kbuild: Install dtb files as 0644 in Makefile.dtbinst
  (git-fixes).
- counter: ti-eqep: enable clock at probe (git-fixes).
- iio: chemical: bme680: Fix sensor data read operation
  (git-fixes).
- iio: chemical: bme680: Fix overflows in compensate() functions
  (git-fixes).
- iio: chemical: bme680: Fix calibration data variable
  (git-fixes).
- iio: chemical: bme680: Fix pressure value output (git-fixes).
- iio: accel: fxls8962af: select IIO_BUFFER &amp; IIO_KFIFO_BUF
  (git-fixes).
- iio: adc: ad7266: Fix variable checking bug (git-fixes).
- iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
  (git-fixes).
- serial: bcm63xx-uart: fix tx after conversion to
  uart_port_tx_limited() (git-fixes).
- serial: core: introduce uart_port_tx_limited_flags()
  (git-fixes).
- Revert "serial: core: only stop transmit when HW fifo is empty"
  (git-fixes).
- tty: mcf: MCF54418 has 10 UARTS (git-fixes).
- usb: gadget: aspeed_udc: fix device address configuration
  (git-fixes).
- usb: dwc3: core: remove lock of otg mode during gadget
  suspend/resume to avoid deadlock (git-fixes).
- usb: typec: ucsi: glink: fix child node release in probe
  function (git-fixes).
- usb: musb: da8xx: fix a resource leak in probe() (git-fixes).
- usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  (git-fixes).
- usb: gadget: printer: fix races against disable (git-fixes).
- PCI/MSI: Fix UAF in msi_capability_init (git-fixes).
- commit a2ea5a9</changelog>
  <changelog author="ptesarik@suse.com" date="1719835201">- net: ena: Fix redundant device NUMA node override
  (jsc#PED-8688).
- commit 6ad6684</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835202">- tcp: do not accept ACK of bytes we never sent (CVE-2023-52881
  bsc#1225611).
- commit 16404a6</changelog>
  <changelog author="mhocko@suse.com" date="1719835203">- Update
  patches.suse/1352-drm-amdgpu-Fix-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52883
  bsc#1226630).
- Update
  patches.suse/9p-add-missing-locking-around-taking-dentry-fid-list.patch
  (git-fixes CVE-2024-39463 bsc#1227090).
- Update
  patches.suse/ALSA-Fix-deadlocks-with-kctl-removals-at-disconnecti.patch
  (stable-fixes CVE-2024-38600 bsc#1226864).
- Update
  patches.suse/ALSA-core-Fix-NULL-module-pointer-assignment-at-card.patch
  (git-fixes CVE-2024-38605 bsc#1226740).
- Update
  patches.suse/ALSA-hda-Fix-possible-null-ptr-deref-when-assigning-.patch
  (git-fixes CVE-2023-52806 bsc#1225554).
- Update
  patches.suse/ALSA-hda-cs_dsp_ctl-Use-private_free-for-control-cle.patch
  (git-fixes CVE-2024-38388 bsc#1226890).
- Update
  patches.suse/ALSA-timer-Set-lower-bound-of-start-tick-time.patch
  (stable-fixes git-fixes CVE-2024-38618 bsc#1226754).
- Update
  patches.suse/ASoC-kirkwood-Fix-potential-NULL-dereference.patch
  (git-fixes CVE-2024-38550 bsc#1226633).
- Update
  patches.suse/ASoC-mediatek-Assign-dummy-when-codec-not-specified-.patch
  (git-fixes CVE-2024-38551 bsc#1226761).
- Update
  patches.suse/Bluetooth-btusb-Add-date-evt_skb-is-NULL-check.patch
  (git-fixes CVE-2023-52833 bsc#1225595).
- Update
  patches.suse/Bluetooth-hci_core-Fix-possible-buffer-overflow.patch
  (git-fixes CVE-2024-26889).
- Update
  patches.suse/HID-uclogic-Fix-user-memory-access-bug-in-uclogic_pa.patch
  (git-fixes CVE-2023-52866 bsc#1225120).
- Update
  patches.suse/IB-mlx5-Fix-init-stage-error-handling-to-avoid-doubl.patch
  (jsc#PED-6864 CVE-2023-52851 bsc#1225587).
- Update
  patches.suse/Input-cyapa-add-missing-input-core-locking-to-suspen.patch
  (git-fixes CVE-2023-52884 bsc#1226764).
- Update
  patches.suse/Input-synaptics-rmi4-fix-use-after-free-in-rmi_unreg.patch
  (git-fixes CVE-2023-52840 bsc#1224928).
- Update
  patches.suse/KEYS-trusted-Do-not-use-WARN-when-encode-fails.patch
  (git-fixes CVE-2024-36975 bsc#1226520).
- Update
  patches.suse/KEYS-trusted-Fix-memory-leak-in-tpm2_key_encode.patch
  (git-fixes CVE-2024-36967 bsc#1226131).
- Update
  patches.suse/RDMA-cma-Fix-kmemleak-in-rdma_core-observed-during-b.patch
  (git-fixes CVE-2024-38539 bsc#1226608).
- Update patches.suse/RDMA-hns-Fix-UAF-for-cq-async-event.patch
  (git-fixes CVE-2024-38545 bsc#1226595).
- Update
  patches.suse/RDMA-hns-Fix-deadlock-on-SRQ-async-events.patch
  (git-fixes CVE-2024-38591 bsc#1226738).
- Update
  patches.suse/RDMA-hns-Modify-the-print-level-of-CQE-error.patch
  (git-fixes CVE-2024-38590 bsc#1226839).
- Update
  patches.suse/RDMA-rxe-Fix-seg-fault-in-rxe_comp_queue_pkt.patch
  (git-fixes CVE-2024-38544 bsc#1226597).
- Update
  patches.suse/SUNRPC-Fix-RPC-client-cleaned-up-the-freed-pipefs-de.patch
  (git-fixes CVE-2023-52803 bsc#1225008).
- Update patches.suse/af_unix-Clear-stale-u-oob_skb.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-35970 bsc#1224584).
- Update
  patches.suse/af_unix-Drop-oob_skb-ref-before-purging-queue-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26750 bsc#1222617).
- Update
  patches.suse/af_unix-Fix-task-hung-while-purging-oob_skb-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26780 bsc#1222588).
- Update
  patches.suse/af_unix-Update-unix_sk-sk-oob_skb-under-sk_receive_queue-lock.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-36972 bsc#1226163).
- Update
  patches.suse/arm64-Restrict-CPU_BIG_ENDIAN-to-GNU-as-or-LLVM-IAS-.patch
  (git-fixes CVE-2023-52750 bsc#1225485).
- Update
  patches.suse/atl1c-Work-around-the-DMA-RX-overflow-issue.patch
  (git-fixes CVE-2023-52834 bsc#1225599).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issue-of-net_device.patch
  (git-fixes CVE-2024-38554 bsc#1226742).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issues-of-ax25_dev.patch
  (git-fixes CVE-2024-38602 bsc#1226613).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-reorder-of-WRITE-lqueued.patch
  (bsc#1225605 CVE-2024-38384 bsc#1226938).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-resetting-io-stat.patch
  (bsc#1225605 CVE-2024-38663 bsc#1226939).
- Update
  patches.suse/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch
  (git-fixes CVE-2024-38540 bsc#1226582).
- Update
  patches.suse/bonding-stop-the-device-in-bond_setup_by_slave.patch
  (git-fixes CVE-2023-52784 bsc#1224946).
- Update
  patches.suse/can-dev-can_put_echo_skb-don-t-crash-kernel-if-can_p.patch
  (git-fixes CVE-2023-52878 bsc#1225000).
- Update
  patches.suse/clk-mediatek-clk-mt2701-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52875 bsc#1225096).
- Update
  patches.suse/clk-mediatek-clk-mt6765-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52870 bsc#1224937).
- Update
  patches.suse/clk-mediatek-clk-mt6779-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52873 bsc#1225589).
- Update
  patches.suse/clk-mediatek-clk-mt6797-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52865 bsc#1225086).
- Update
  patches.suse/clk-mediatek-clk-mt7629-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52858 bsc#1225566).
- Update
  patches.suse/clk-mediatek-clk-mt7629-eth-Add-check-for-mtk_alloc_.patch
  (git-fixes CVE-2023-52876 bsc#1225036).
- Update
  patches.suse/cppc_cpufreq-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38573 bsc#1226739).
- Update patches.suse/cpufreq-exit-callback-is-optional.patch
  (git-fixes CVE-2024-38615 bsc#1226592).
- Update patches.suse/crypto-bcm-Fix-pointer-arithmetic.patch
  (git-fixes CVE-2024-38579 bsc#1226637).
- Update
  patches.suse/crypto-pcrypt-Fix-hungtask-for-PADATA_RESET.patch
  (git-fixes CVE-2023-52813 bsc#1225527).
- Update patches.suse/cxl-mem-Fix-shutdown-order.patch (git-fixes
  CVE-2023-52849 bsc#1224949).
- Update
  patches.suse/cxl-region-Do-not-try-to-cleanup-after-cxl_region_se.patch
  (git-fixes CVE-2023-52792 bsc#1225477).
- Update patches.suse/cxl-region-Fix-cxlr_pmem-leaks.patch
  (git-fixes CVE-2024-38391 bsc#1226894).
- Update
  patches.suse/dma-buf-sw-sync-don-t-enable-IRQ-from-sync_print_obj.patch
  (git-fixes CVE-2024-38780 bsc#1226886).
- Update
  patches.suse/dma-mapping-benchmark-fix-node-id-validation.patch
  (git-fixes CVE-2024-34777 bsc#1226796).
- Update
  patches.suse/dma-mapping-benchmark-handle-NUMA_NO_NODE-correctly.patch
  (git-fixes CVE-2024-39277 bsc#1226909).
- Update
  patches.suse/dmaengine-idxd-Avoid-unnecessary-destruction-of-file.patch
  (git-fixes CVE-2024-38629 bsc#1226905).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Pola.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52819
  bsc#1225532).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-SMU7.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52818
  bsc#1225530).
- Update
  patches.suse/drm-amd-check-num-of-link-levels-when-update-pcie-pa.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52812
  bsc#1225564).
- Update
  patches.suse/drm-amd-display-Avoid-NULL-dereference-of-timing-gen.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52753
  bsc#1225478).
- Update
  patches.suse/drm-amd-display-Fix-division-by-zero-in-setup_dsc_co.patch
  (stable-fixes CVE-2024-36969 bsc#1226155).
- Update
  patches.suse/drm-amd-display-Fix-null-pointer-dereference-in-erro.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52862
  bsc#1225015).
- Update
  patches.suse/drm-amd-display-Fix-potential-index-out-of-bounds-in.patch
  (git-fixes CVE-2024-38552 bsc#1226767).
- Update
  patches.suse/drm-amd-display-fix-a-NULL-pointer-dereference-in-am.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52773
  bsc#1225041).
- Update
  patches.suse/drm-amd-display-fixed-integer-types-and-null-check-l.patch
  (git-fixes CVE-2024-26767).
- Update
  patches.suse/drm-amdgpu-Fix-a-null-pointer-access-when-the-smc_rr.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52817
  bsc#1225569).
- Update
  patches.suse/drm-amdgpu-Fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch
  (git-fixes CVE-2024-39291 bsc#1226934).
- Update
  patches.suse/drm-amdgpu-Fix-potential-null-pointer-derefernce.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52814
  bsc#1225565).
- Update
  patches.suse/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch
  (stable-fixes CVE-2024-39471 bsc#1227096).
- Update
  patches.suse/drm-amdgpu-mes-fix-use-after-free-issue.patch
  (stable-fixes CVE-2024-38581 bsc#1226657).
- Update
  patches.suse/drm-amdgpu-vkms-fix-a-possible-null-pointer-derefere.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52815
  bsc#1225568).
- Update
  patches.suse/drm-amdkfd-Fix-a-race-condition-of-vram-buffer-unref.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52825
  bsc#1225076).
- Update
  patches.suse/drm-amdkfd-Fix-shift-out-of-bounds-issue.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52816
  bsc#1225529).
- Update
  patches.suse/drm-bridge-cdns-mhdp8546-Fix-possible-null-pointer-d.patch
  (git-fixes CVE-2024-38548).
- Update
  patches.suse/drm-bridge-it66121-Fix-invalid-connector-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52861
  bsc#1224941).
- Update
  patches.suse/drm-bridge-lt8912b-Fix-crash-on-bridge-detach.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52856
  bsc#1224932).
- Update
  patches.suse/drm-mediatek-Add-0-size-check-to-mtk_drm_gem_obj.patch
  (git-fixes CVE-2024-38549 bsc#1226735).
- Update
  patches.suse/drm-mediatek-Fix-coverity-issue-with-unintentional-i.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52857
  bsc#1225581).
- Update
  patches.suse/drm-mediatek-Init-ddp_comp-with-devm_kcalloc.patch
  (git-fixes CVE-2024-38592 bsc#1226844).
- Update
  patches.suse/drm-msm-a6xx-Avoid-a-nullptr-dereference-when-speedb.patch
  (git-fixes CVE-2024-38390 bsc#1226891).
- Update
  patches.suse/drm-msm-dpu-Add-callback-function-pointer-check-befo.patch
  (git-fixes CVE-2024-38622 bsc#1226856).
- Update
  patches.suse/drm-panel-fix-a-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52821
  bsc#1225022).
- Update
  patches.suse/drm-panel-panel-tpo-tpg110-fix-a-possible-null-point.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52826
  bsc#1225077).
- Update patches.suse/drm-radeon-possible-buffer-overflow.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52867
  bsc#1225009).
- Update
  patches.suse/drm-vc4-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38546 bsc#1226593).
- Update
  patches.suse/drm-vmwgfx-Fix-invalid-reads-in-fence-signaled-event.patch
  (git-fixes CVE-2024-36960 bsc#1225872).
- Update
  patches.suse/drm-zynqmp_dpsub-Always-register-bridge.patch
  (git-fixes CVE-2024-38664 bsc#1226941).
- Update
  patches.suse/e1000e-change-usleep_range-to-udelay-in-PHY-mdic-acc.patch
  (CVE-2024-39296 bsc#1226989 CVE-2024-36887 bsc#1225731).
- Update
  patches.suse/ecryptfs-Fix-buffer-size-for-tag-66-packet.patch
  (git-fixes CVE-2024-38578 bsc#1226634).
- Update
  patches.suse/efi-libstub-only-free-priv.runtime_map-when-allocate.patch
  (git-fixes CVE-2024-33619 bsc#1226768).
- Update
  patches.suse/fbdev-imsttfb-fix-a-resource-leak-in-probe.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52838
  bsc#1225031).
- Update
  patches.suse/fs-9p-only-translate-RWX-permissions-for-plain-9P200.patch
  (git-fixes CVE-2024-36964 bsc#1225866).
- Update
  patches.suse/fs-jfs-Add-check-for-negative-db_l2nbperpage.patch
  (git-fixes CVE-2023-52810 bsc#1225557).
- Update
  patches.suse/fs-jfs-Add-validity-check-for-db_maxag-and-db_agpref.patch
  (git-fixes CVE-2023-52804 bsc#1225550).
- Update
  patches.suse/ftrace-Fix-possible-use-after-free-issue-in-ftrace_location.patch
  (git-fixes CVE-2024-38588 bsc#1226837).
- Update
  patches.suse/genirq-irqdesc-Prevent-use-after-free-in-irq_find_at.patch
  (git-fixes CVE-2024-38385 bsc#1227085).
- Update patches.suse/gfs2-ignore-negated-quota-changes.patch
  (git-fixes CVE-2023-52759 bsc#1225560).
- Update
  patches.suse/hid-cp2112-Fix-duplicate-workqueue-initialization.patch
  (git-fixes CVE-2023-52853 bsc#1224988).
- Update
  patches.suse/hwmon-axi-fan-control-Fix-possible-NULL-pointer-dere.patch
  (git-fixes CVE-2023-52863 bsc#1225586).
- Update
  patches.suse/i2c-acpi-Unbind-mux-adapters-before-delete.patch
  (git-fixes CVE-2024-39362 bsc#1226995).
- Update
  patches.suse/i2c-core-Run-atomic-i2c-xfer-when-preemptible.patch
  (git-fixes CVE-2023-52791 bsc#1225108).
- Update
  patches.suse/i3c-master-mipi-i3c-hci-Fix-a-kernel-panic-for-acces.patch
  (git-fixes CVE-2023-52763 bsc#1225570).
- Update
  patches.suse/i3c-mipi-i3c-hci-Fix-out-of-bounds-access-in-hci_dma.patch
  (git-fixes CVE-2023-52766).
- Update
  patches.suse/i915-perf-Fix-NULL-deref-bugs-with-drm_dbg-calls.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52788
  bsc#1225106).
- Update
  patches.suse/igb-Fix-string-truncation-warnings-in-igb_set_fw_ver.patch
  (git-fixes CVE-2024-36010 bsc#1225594).
- Update
  patches.suse/iommu-vt-d-Fix-WARN_ON-in-iommu-probe-path.patch
  (git-fixes CVE-2024-35957 bsc#1224673).
- Update
  patches.suse/iommufd-Fix-missing-update-of-domains_itree-after-splitting-iopt
  (jsc#PED-7779 jsc#PED-7780 CVE-2023-52801 bsc#1225006).
- Update
  patches.suse/ipvlan-add-ipvlan_route_v6_outbound-helper.patch
  (git-fixes CVE-2023-52796 bsc#1224930).
- Update
  patches.suse/jffs2-prevent-xattr-node-from-overflowing-the-eraseblock.patch
  (git-fixes CVE-2024-38599 bsc#1226848).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-dbFindLeaf.patch
  (git-fixes CVE-2023-52799 bsc#1225472).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-diAlloc.patch
  (git-fixes CVE-2023-52805 bsc#1225553).
- Update
  patches.suse/kunit-fortify-Fix-mismatched-kvalloc-vfree-usage.patch
  (git-fixes CVE-2024-38617 bsc#1226859).
- Update
  patches.suse/lib-generic-radix-tree.c-Don-t-overflow-in-peek.patch
  (git-fixes CVE-2021-47432 bsc#1225391).
- Update
  patches.suse/lib-test_hmm.c-handle-src_pfns-and-dst_pfns-allocati.patch
  (git-fixes CVE-2024-38543 bsc#1226594).
- Update
  patches.suse/locking-ww_mutex-test-Fix-potential-workqueue-corrup.patch
  (bsc#1219953 CVE-2023-52836 bsc#1225609).
- Update
  patches.suse/md-Don-t-ignore-suspended-array-in-md_check_recovery-1baa.patch
  (bsc#1219596 CVE-2024-26758).
- Update
  patches.suse/media-atomisp-ssh_css-Fix-a-null-pointer-dereference.patch
  (git-fixes CVE-2024-38547 bsc#1226632).
- Update
  patches.suse/media-bttv-fix-use-after-free-error-due-to-btv-timeo.patch
  (git-fixes CVE-2023-52847 bsc#1225588).
- Update
  patches.suse/media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch
  (git-fixes CVE-2023-52764 bsc#1225571).
- Update
  patches.suse/media-hantro-Check-whether-reset-op-is-defined-befor.patch
  (git-fixes CVE-2023-52850 bsc#1225014).
- Update
  patches.suse/media-i2c-et8ek8-Don-t-strip-remove-function-when-dr.patch
  (git-fixes CVE-2024-38611 bsc#1226760).
- Update
  patches.suse/media-imon-fix-access-to-invalid-resource-for-the-se.patch
  (git-fixes CVE-2023-52754 bsc#1225490).
- Update
  patches.suse/media-lgdt3306a-Add-a-check-against-null-pointer-def.patch
  (stable-fixes CVE-2022-48772 bsc#1226976).
- Update
  patches.suse/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch
  (git-fixes CVE-2024-38621 bsc#1226895).
- Update
  patches.suse/media-vidtv-mux-Add-check-and-kfree-for-kstrdup.patch
  (git-fixes CVE-2023-52841 bsc#1225592).
- Update patches.suse/media-vidtv-psi-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52844 bsc#1225590).
- Update
  patches.suse/mfd-qcom-spmi-pmic-Fix-revid-implementation.patch
  (git-fixes CVE-2023-52765 bsc#1225029).
- Update
  patches.suse/misc-microchip-pci1xxxx-fix-double-free-in-the-error.patch
  (git-fixes CVE-2024-36973 bsc#1226457).
- Update
  patches.suse/net-hns3-fix-out-of-bounds-access-may-occur-when-coa.patch
  (git-fixes CVE-2023-52807 bsc#1225097).
- Update
  patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch
  (git-fixes CVE-2024-36962 bsc#1225827).
- Update
  patches.suse/net-mlx5-Fix-peer-devlink-set-for-SF-representor-dev.patch
  (git-fixes CVE-2024-38595 bsc#1226741).
- Update
  patches.suse/net-mlx5e-Track-xmit-submission-to-PTP-WQ-after-popu.patch
  (jsc#PED-3311 CVE-2023-52782 bsc#1225103).
- Update
  patches.suse/net-mvneta-fix-calls-to-page_pool_get_stats.patch
  (git-fixes CVE-2023-52780 bsc#1224933).
- Update
  patches.suse/net-wangxun-fix-kernel-panic-due-to-null-pointer.patch
  (git-fixes CVE-2023-52783 bsc#1225104).
- Update
  patches.suse/netfilter-complete-validation-of-user-input.patch
  (git-fixes CVE-2024-35896 bsc#1224662 CVE-2024-35962
  bsc#1224583).
- Update
  patches.suse/nfc-nci-Fix-uninit-value-in-nci_rx_work.patch
  (git-fixes CVE-2024-38381 bsc#1226878).
- Update
  patches.suse/nilfs2-fix-nilfs_empty_dir-misjudgment-and-long-loop.patch
  (git-fixes CVE-2024-39469 bsc#1226992).
- Update
  patches.suse/nilfs2-fix-potential-hang-in-nilfs_detach_log_writer.patch
  (git-fixes CVE-2024-38582 bsc#1226658).
- Update
  patches.suse/nilfs2-fix-use-after-free-of-timer-for-log-writer-th.patch
  (git-fixes CVE-2024-38583 bsc#1226777).
- Update
  patches.suse/of-module-add-buffer-overflow-check-in-of_modalias.patch
  (git-fixes CVE-2024-38541 bsc#1226587).
- Update
  patches.suse/padata-Fix-refcnt-handling-in-padata_free_shell.patch
  (git-fixes CVE-2023-52854 bsc#1225584).
- Update
  patches.suse/perf-core-Bail-out-early-if-the-request-AUX-area-is-out-of-bound.patch
  (git-fixes CVE-2023-52835 bsc#1225602).
- Update
  patches.suse/platform-x86-wmi-Fix-opening-of-char-device.patch
  (git-fixes CVE-2023-52864 bsc#1225132).
- Update
  patches.suse/powerpc-pseries-iommu-LPAR-panics-during-boot-up-wit.patch
  (bsc#1222011 ltc#205900 CVE-2024-36926 bsc#1225829).
- Update patches.suse/pstore-platform-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52869 bsc#1225050).
- Update
  patches.suse/remoteproc-mediatek-Make-sure-IPI-buffer-fits-in-L2T.patch
  (git-fixes CVE-2024-36965 bsc#1226149).
- Update
  patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch
  (git-fixes CVE-2024-38601 bsc#1226876).
- Update
  patches.suse/s390-dasd-protect-device-queue-against-concurrent-access.patch
  (git-fixes bsc#1217481 CVE-2023-52774 bsc#1225572).
- Update
  patches.suse/scsi-hisi_sas-Set-debugfs_dir-pointer-to-NULL-after-removing-debugfs.patch
  (git-fixes CVE-2023-52808 bsc#1225555).
- Update
  patches.suse/scsi-ibmvfc-Remove-BUG_ON-in-the-case-of-an-empty-ev.patch
  (bsc#1209834 ltc#202097 CVE-2023-52811 bsc#1225559).
- Update
  patches.suse/scsi-libfc-Fix-potential-NULL-pointer-dereference-in-fc_lport_ptp_setup.patch
  (git-fixes CVE-2023-52809 bsc#1225556).
- Update
  patches.suse/scsi-lpfc-Move-NPIV-s-transport-unregistration-to-af.patch
  (bsc#1221777 CVE-2024-36952 bsc#1225898).
- Update
  patches.suse/scsi-lpfc-Release-hbalock-before-calling-lpfc_worker.patch
  (bsc#1221777 CVE-2024-36924 bsc#1225820).
- Update
  patches.suse/serial-max3100-Lock-port-lock-when-calling-uart_hand.patch
  (git-fixes CVE-2024-38634 bsc#1226868).
- Update
  patches.suse/serial-max3100-Update-uart_driver_registered-on-driv.patch
  (git-fixes CVE-2024-38633 bsc#1226867).
- Update
  patches.suse/soc-qcom-llcc-Handle-a-second-device-without-data-co.patch
  (git-fixes CVE-2023-52871 bsc#1225534).
- Update
  patches.suse/soundwire-cadence-fix-invalid-PDI-offset.patch
  (stable-fixes CVE-2024-38635 bsc#1226863).
- Update patches.suse/speakup-Fix-sizeof-vs-ARRAY_SIZE-bug.patch
  (git-fixes CVE-2024-38587 bsc#1226780).
- Update patches.suse/spi-Fix-null-dereference-on-suspend.patch
  (git-fixes CVE-2023-52749 bsc#1225476).
- Update
  patches.suse/thermal-core-prevent-potential-string-overflow.patch
  (git-fixes CVE-2023-52868 bsc#1225044).
- Update
  patches.suse/thermal-drivers-qcom-lmh-Check-for-SCM-availability-.patch
  (git-fixes CVE-2024-39466 bsc#1227089).
- Update
  patches.suse/thermal-drivers-tsens-Fix-null-pointer-dereference.patch
  (git-fixes CVE-2024-38571 bsc#1226737).
- Update
  patches.suse/thermal-intel-powerclamp-fix-mismatch-in-get-functio.patch
  (git-fixes CVE-2023-52794 bsc#1225028).
- Update
  patches.suse/tls-fix-NULL-deref-on-tls_sw_splice_eof-with-empty-r.patch
  (jsc#PED-6831 CVE-2023-52767 bsc#1224998).
- Update
  patches.suse/tpm_tis_spi-Account-for-SPI-header-when-allocating-T.patch
  (git-fixes CVE-2024-36477 bsc#1226840).
- Update
  patches.suse/tracing-Have-trace_event_file-have-ref-counters.patch
  (git-fixes CVE-2023-52879 bsc#1225101).
- Update
  patches.suse/tracing-trigger-Fix-to-return-error-if-failed-to-alloc-snapshot.patch
  (git-fixes CVE-2024-26920).
- Update
  patches.suse/tty-n_gsm-fix-race-condition-in-status-line-change-o.patch
  (git-fixes CVE-2023-52872 bsc#1225591).
- Update
  patches.suse/tty-n_gsm-require-CAP_NET_ADMIN-to-attach-N_GSM0710-.patch
  (bsc#1222619 CVE-2023-52880).
- Update
  patches.suse/tty-vcc-Add-check-for-kstrdup-in-vcc_probe.patch
  (git-fixes CVE-2023-52789 bsc#1225180).
- Update
  patches.suse/usb-config-fix-iteration-issue-in-usb_get_bos_descri.patch
  (git-fixes CVE-2023-52781 bsc#1225092).
- Update
  patches.suse/usb-dwc3-Wait-unconditionally-after-issuing-EndXfer-.patch
  (git-fixes CVE-2024-36977 bsc#1226513).
- Update
  patches.suse/usb-gadget-u_audio-Fix-race-condition-use-of-control.patch
  (git-fixes CVE-2024-38628 bsc#1226911).
- Update
  patches.suse/usb-storage-alauda-Check-whether-the-media-is-initia.patch
  (git-fixes CVE-2024-38619 bsc#1226861).
- Update
  patches.suse/usb-typec-tcpm-Fix-NULL-pointer-dereference-in-tcpm_.patch
  (git-fixes CVE-2023-52877 bsc#1224944).
- Update
  patches.suse/vhost-vdpa-fix-use-after-free-in-vhost_vdpa_probe.patch
  (jsc#PED-3311 CVE-2023-52795 bsc#1225085).
- Update
  patches.suse/virtio-blk-fix-implicit-overflow-on-virtio_max_dma_s.patch
  (git-fixes CVE-2023-52762 bsc#1225573).
- Update
  patches.suse/virtio-vsock-Fix-uninit-value-in-virtio_transport_re.patch
  (jsc#PED-5505 CVE-2023-52842 bsc#1225025).
- Update
  patches.suse/watchdog-cpu5wdt.c-Fix-use-after-free-bug-caused-by-.patch
  (git-fixes CVE-2024-38630 bsc#1226908).
- Update
  patches.suse/wifi-ar5523-enable-proper-endpoint-verification.patch
  (git-fixes CVE-2024-38565 bsc#1226747).
- Update
  patches.suse/wifi-ath11k-fix-dfs-radar-event-locking.patch
  (git-fixes CVE-2023-52798 bsc#1224947).
- Update
  patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch
  (git-fixes CVE-2023-52777 bsc#1224992).
- Update patches.suse/wifi-ath11k-fix-htt-pktlog-locking.patch
  (git-fixes CVE-2023-52800).
- Update
  patches.suse/wifi-ath12k-fix-dfs-radar-and-temperature-event-lock.patch
  (git-fixes CVE-2023-52776 bsc#1225090).
- Update
  patches.suse/wifi-ath12k-fix-htt-mlo-offset-event-locking.patch
  (git-fixes CVE-2023-52769 bsc#1225001).
- Update
  patches.suse/wifi-ath12k-fix-out-of-bound-access-of-qmi_invoke_ha.patch
  (git-fixes CVE-2024-38572 bsc#1226776).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-read-in-ath12k.patch
  (git-fixes CVE-2023-52827 bsc#1225078).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-write-in-ath12.patch
  (git-fixes CVE-2023-52829 bsc#1225081).
- Update
  patches.suse/wifi-brcmfmac-pcie-handle-randbuf-allocation-failure.patch
  (git-fixes CVE-2024-38575 bsc#1226612).
- Update
  patches.suse/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch
  (git-fixes CVE-2024-38567 bsc#1226769).
- Update
  patches.suse/wifi-carl9170-re-fix-fortified-memset-warning.patch
  (git-fixes CVE-2024-38616 bsc#1226852).
- Update
  patches.suse/wifi-mac80211-don-t-return-unset-power-in-ieee80211_.patch
  (git-fixes CVE-2023-52832 bsc#1225577).
- Update
  patches.suse/wifi-nl80211-Avoid-address-calculations-via-out-of-b.patch
  (git-fixes CVE-2024-38562 bsc#1226788).
- Update
  patches.suse/wifi-wilc1000-use-vmm_table-as-array-in-wilc-struct.patch
  (git-fixes CVE-2023-52768 bsc#1225004).
- Update
  patches.suse/x86-tdx-Zero-out-the-missing-RSI-in-TDX_HYPERCALL-macro.patch
  (jsc#PED-5824 CVE-2023-52874 bsc#1225049).
- commit 33efdc4</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835204">- tcp: Use refcount_inc_not_zero() in tcp_twsk_unique()
  (CVE-2024-36904 bsc#1225732).
- commit d578dcc</changelog>
  <changelog author="heming.zhao@suse.com" date="1719921600">- gfs2: Fix potential glock use-after-free on unmount (bsc#1226775
  CVE-2024-38570).
- gfs2: Rename sd_{ glock =&gt; kill }_wait (bsc#1226775
  CVE-2024-38570).
- commit f3adbca</changelog>
  <changelog author="tiwai@suse.de" date="1719921601">- Correct SCSI patch references (bsc#1225767 CVE-2024-36919 bsc#1226785 CVE-2024-38559)
- commit e8ea587</changelog>
  <changelog author="tiwai@suse.de" date="1719921602">- mtd: rawnand: rockchip: ensure NVDDR timings are rejected
  (git-fixes).
- mtd: rawnand: Bypass a couple of sanity checks during NAND
  identification (git-fixes).
- mtd: rawnand: Fix the nand_read_data_op() early check
  (git-fixes).
- mtd: rawnand: Ensure ECC configuration is propagated to upper
  layers (git-fixes).
- commit e545951</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1719921603">- kernel-doc: fix struct_group_tagged() parsing (git-fixes).
- commit e3a2a2e</changelog>
  <changelog author="fdmanana@suse.com" date="1719921604">- btrfs: fix crash on racing fsync and size-extending write into
  prealloc (bsc#1227101 CVE-2024-37354).
- commit 1d355af</changelog>
  <changelog author="vbabka@suse.cz" date="1719921605">- virt: acrn: stop using follow_pfn (CVE-2024-38610 bsc#1226758).
- commit c2ea51b</changelog>
  <changelog author="vbabka@suse.cz" date="1719921606">- drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
  (CVE-2024-38610 bsc#1226758).
- commit 7069ac2</changelog>
  <changelog author="rhopkins@suse.de" date="1719921607">- hsr: Prevent use after free in prp_create_tagged_frame()
  (CVE-2023-52846 bsc#1225098).
- commit cf63988</changelog>
  <changelog author="krisman@suse.de" date="1719921608">- io_uring: Fix io_cqring_wait() not restoring sigmask on
  get_timespec64() failure (git-fixes).
- commit e640a65</changelog>
  <changelog author="krisman@suse.de" date="1719921609">- io_uring: check for non-NULL file pointer in io_file_can_poll()
  (bsc#1226990 CVE-2024-39371).
- io_uring/io-wq: Use set_bit() and test_bit() at worker-&gt;flags
  (git-fixes).
- io_uring/sqpoll: work around a potential audit memory leak
  (git-fixes).
- commit 24603fc</changelog>
  <changelog author="krisman@suse.de" date="1719921610">- io_uring/rsrc: fix incorrect assignment of iter-&gt;nr_segs in
  io_import_fixed (git-fixes).
- io_uring/rsrc: don't lock while !TASK_RUNNING (git-fixes).
- io_uring/io-wq: avoid garbage value of 'match' in
  io_wq_enqueue() (git-fixes).
- commit 7d3e252</changelog>
</package>
<package pkgid="3540ce37d98f85fdc1679fb3b0d0ba502a6958991ab796daab386e5b0c721119" name="dtb-lg" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.17.1"/>
  <changelog author="tiwai@suse.de" date="1722081600">- auxdisplay: ht16k33: Drop reference after LED registration
  (git-fixes).
- ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
  on unprepare (git-fixes).
- ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
- ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
  reachable (git-fixes).
- ASoC: sof: amd: fix for firmware reload failure in Vangogh
  platform (git-fixes).
- ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
- ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
  (git-fixes).
- ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
- ALSA: ump: Don't update FB name for static blocks (git-fixes).
- drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
- drm/i915/gt: Do not consider preemption during execlists_dequeue
  for gen8 (git-fixes).
- drm/i915/dp: Don't switch the LTTPR mode on an active link
  (git-fixes).
- commit d7e2deb</changelog>
  <changelog author="tiwai@suse.de" date="1722081601">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
</package>
<package pkgid="789f46bb4ab750d10132d9e80ecb58928759632ad8a6bbfd285a6408bfa42a64" name="dtb-lg" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.7.1"/>
  <changelog author="mkubecek@suse.cz" date="1717416000">- netfilter: nf_tables: release mutex after nft_gc_seq_end from
  abort path (CVE-2024-26925 bsc#1223390).
- commit 578a709</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717416001">- Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
  The L3 bsc#1225765 was created seperately since our customer requires
  PTF.
- Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
- Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
- Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
- Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
- commit 054635e</changelog>
  <changelog author="msuchanek@suse.de" date="1717416002">- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
- powerpc/uaccess: Fix build errors seen with GCC 13/14
  (bsc#1194869).
- commit 46b5d84</changelog>
  <changelog author="msuchanek@suse.de" date="1717416003">- blacklist.conf: PPC fsl_msi is not used
- commit ae6590d</changelog>
  <changelog author="msuchanek@suse.de" date="1717416004">- powerpc/pseries/lparcfg: drop error message from guest name
  lookup (bsc#1187716 ltc#193451 git-fixes).
- commit ceab637</changelog>
  <changelog author="mfranc@suse.cz" date="1717416005">- Update
  patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
  (git-fixes CVE-2024-36955).
- Update
  patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
  (git-fixes bsc#1225715 CVE-2024-36906).
- Update
  patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
  (git-fixes bsc#1225579 CVE-2024-36011).
- Update
  patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
  (git-fixes bsc#1225578 CVE-2024-36013).
- Update
  patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
  (git-fixes bsc#1225502 CVE-2024-36012).
- Update
  patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
  (git-fixes bsc#1225722 CVE-2024-36880).
- Update
  patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
  (git-fixes CVE-2024-36942).
- Update
  patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
  (git-fixes bsc#1225720 CVE-2024-36032).
- Update
  patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
  (git-fixes bsc#1223749 CVE-2024-26990).
- Update
  patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
  (git-fixes bsc#1223692 CVE-2024-26992).
- Update
  patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
  (stable-fixes CVE-2024-36944).
- Update
  patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
  (git-fixes bsc#1225734 CVE-2024-36896).
- Update
  patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
  (stable-fixes CVE-2024-36949).
- Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
  (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
- Update
  patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
  (git-fixes bsc#1225692 CVE-2023-52882).
- Update
  patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
  (git-fixes CVE-2024-26761).
- Update
  patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
  (stable-fixes bsc#1225735 CVE-2024-36897).
- Update
  patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
  (stable-fixes bsc#1225705 CVE-2024-36026).
- Update
  patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
  (stable-fixes CVE-2024-36951).
- Update
  patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
  (git-fixes bsc#1225593 CVE-2024-36014).
- Update
  patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
  (stable-fixes bsc#1225728 CVE-2024-36885).
- Update
  patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
  (git-fixes bsc#1225773 CVE-2024-36936).
- Update
  patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
  (stable-fixes CVE-2024-36950).
- Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
  (git-fixes bsc#1225736 CVE-2024-36898).
- Update
  patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
  (git-fixes bsc#1225698 CVE-2024-36020).
- Update
  patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
  (git-fixes bsc#1225710 CVE-2024-36891).
- Update
  patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
  (git-fixes bsc#1225714 CVE-2024-36890).
- Update
  patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
  (git-fixes bsc#1225708 CVE-2024-36029).
- Update
  patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
  (git-fixes bsc#1225699 CVE-2024-36021).
- Update
  patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
  (git-fixes CVE-2024-26943).
- Update
  patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
  (git-fixes bsc#1225694 CVE-2024-36018).
- Update
  patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
  (git-fixes CVE-2024-36940).
- Update
  patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
  (git-fixes CVE-2024-36959).
- Update
  patches.suse/ppdev-Add-an-error-check-in-register_device.patch
  (git-fixes bsc#1225640 CVE-2024-36015).
- Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
  CVE-2024-36947).
- Update
  patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
  (git-fixes bsc#1225695 CVE-2024-36019).
- Update
  patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
  (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
- Update
  patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
  (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
- Update
  patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
  (git-fixes bsc#1225704 CVE-2024-36025).
- Update
  patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
  (git-fixes CVE-2024-36930).
- Update
  patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
  (bsc#1224331 bsc#1224602 CVE-2024-35814).
- Update
  patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
  (git-fixes bsc#1225642 CVE-2024-36016).
- Update
  patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
  (git-fixes bsc#1225749 CVE-2024-36894).
- Update
  patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
  (git-fixes bsc#1225750 CVE-2024-36895).
- Update
  patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
  (git-fixes bsc#1225748 CVE-2024-36893).
- Update
  patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
  (stable-fixes bsc#1225769 CVE-2024-36921).
- Update
  patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
  (stable-fixes CVE-2024-36922).
- Update
  patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
  (git-fixes CVE-2024-36941).
- Update
  patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
  (git-fixes bsc#1224742 CVE-2024-35803).
- commit 539780f</changelog>
  <changelog author="dwagner@suse.de" date="1717416006">- nvmet: fix ns enable/disable possible hang (git-fixes).
- nvme-multipath: fix io accounting on failover (git-fixes).
- nvme: fix multipath batched completion accounting (git-fixes).
- commit ed3b392</changelog>
  <changelog author="dwagner@suse.de" date="1717416007">- scsi: lpfc: Copyright updates for 14.4.0.2 patches
  (bsc#1225842).
- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
  (bsc#1225842).
  Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
  (bsc#1225842).
- scsi: lpfc: Clear deferred RSCN processing flag when driver
  is unloading (bsc#1225842).
- scsi: lpfc: Update logging of protection type for T10 DIF I/O
  (bsc#1225842).
- scsi: lpfc: Change default logging level for unsolicited CT
  MIB commands (bsc#1225842).
- commit 5a56384</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416008">- smb: client: fix mount when dns_resolver key is not available
  (git-fixes, bsc#1225172).
- commit 28edb5c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416009">- cifs: fix leak of iface for primary channel (git-fixes,
  bsc#1225172).
- commit b7eb8e8</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416010">- Revert "cifs: reconnect work should have reference on server
  struct" (git-fixes, bsc#1225172).
- commit 3ca4c0c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416011">- smb: client: fix parsing of SMB3.1.1 POSIX create context
  (git-fixes, bsc#1225172).
- commit 5f27f69</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416012">- cifs: failure to add channel on iface should bump up weight
  (git-fixes, bsc#1225172).
- commit 007b237</changelog>
  <changelog author="tonyj@suse.de" date="1717416013">- perf/x86: Fix out of range data (git-fixes).
- perf/x86/intel/ds: Don't clear -&gt;pebs_data_cfg for the last
  PEBS event (git-fixes).
- perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
- commit 664d77f</changelog>
  <changelog author="dsterba@suse.com" date="1717588800">- blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
- Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
  Quoting bsc#1225945#c11:
  "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
  transaction for every subvol create")
  ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
  unwritten extent buffer after snapshotting a new subvolume") was never
  backported."
- commit d947258</changelog>
  <changelog author="tonyj@suse.de" date="1717588801">- perf pmu: Count sys and cpuid JSON events separately (git
  fixes).
- perf stat: Don't display metric header for non-leader uncore
  events (git-fixes).
- perf daemon: Fix file leak in daemon_session__control
  (git-fixes).
- perf symbols: Fix ownership of string in dso__load_vmlinux()
  (git-fixes).
- perf thread: Fixes to thread__new() related to initializing comm
  (git-fixes).
- perf report: Avoid SEGV in report__setup_sample_type()
  (git-fixes).
- perf ui browser: Don't save pointer to stack memory (git-fixes).
- perf bench internals inject-build-id: Fix trap divide when
  collecting just one DSO (git-fixes).
- perf intel-pt: Fix unassigned instruction op (discovered by
  MemorySanitizer) (git-fixes).
- perf test shell arm_coresight: Increase buffer size for
  Coresight basic tests (git-fixes).
- perf docs: Document bpf event modifier (git-fixes).
- perf bench uprobe: Remove lib64 from libc.so.6 binary path
  (git-fixes).
- perf record: Fix debug message placement for test consumption
  (git-fixes).
- perf tests: Apply attributes to all events in object code
  reading test (git-fixes).
- perf tests: Make "test data symbol" more robust on Neoverse N1
  (git-fixes).
- perf annotate: Fix annotation_calc_lines() to pass correct
  address to get_srcline() (git-fixes).
- perf stat: Do not fail on metrics on s390 z/VM systems
  (git-fixes).
- perf sched timehist: Fix -g/--call-graph option failure
  (git-fixes).
- perf annotate: Get rid of duplicate --group option item
  (git-fixes).
- perf probe: Add missing libgen.h header needed for using
  basename() (git-fixes).
- perf record: Delete session after stopping sideband thread
  (git-fixes).
- perf auxtrace: Fix multiple use of --itrace option (git-fixes).
- perf script: Show also errors for --insn-trace option
  (git-fixes).
- perf lock contention: Add a missing NULL check (git-fixes).
- perf vendor events amd: Fix Zen 4 cache latency events
  (git-fixes).
- libperf evlist: Avoid out-of-bounds access (git-fixes).
- perf pmu: Fix a potential memory leak in perf_pmu__lookup()
  (git-fixes).
- perf print-events: make is_event_supported() more robust
  (git-fixes).
- perf list: fix short description for some cache events
  (git-fixes).
- perf metric: Don't remove scale from counts (git-fixes).
- perf stat: Avoid metric-only segv (git-fixes).
- perf expr: Fix "has_event" function for metric style events
  (git-fixes).
- perf srcline: Add missed addr2line closes (git-fixes).
- perf thread_map: Free strlist on normal path in
  thread_map__new_by_tid_str() (git-fixes).
- perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
- perf jevents: Drop or simplify small integer values (git-fixes).
- perf evsel: Fix duplicate initialization of data-&gt;id in
  evsel__parse_sample() (git-fixes).
- perf pmu: Treat the msr pmu as software (git-fixes).
- perf record: Check conflict between '--timestamp-filename'
  option and pipe mode before recording (git-fixes).
- perf record: Fix possible incorrect free in
  record__switch_output() (git-fixes).
- perf vendor events amd: Add Zen 4 memory controller events
  (git-fixes).
- perf top: Uniform the event name for the hybrid machine
  (git-fixes).
- perf top: Use evsel's cpus to replace user_requested_cpus
  (git-fixes).
- commit a1f9340</changelog>
  <changelog author="tonyj@suse.de" date="1717675200">- perf ui browser: Avoid SEGV on title (git fixes).
- commit 1578c22</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675201">- inet: inet_defrag: prevent sk release while still in use
  (CVE-2024-26921 bsc#1223138).
- commit 2016faf</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675202">- net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
- commit 7bf5961</changelog>
  <changelog author="tiwai@suse.de" date="1718366400">- Temporarily drop KVM patch that caused a regression (bsc#1226158)
  Delete patches.suse/KVM-x86-pmu-Prioritize-VMX-interception-over-GP-on-R.patch
- commit 33f31da</changelog>
</package>
<package pkgid="df587565bab04a8fcd890cd333736c7786466bb0806f5beca799ad2b31909023" name="dtb-marvell" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.14.1"/>
  <changelog author="tiwai@suse.de" date="1719662400">- gpiolib: cdev: Disallow reconfiguration without direction
  (uAPI v1) (git-fixes).
- gpio: davinci: Validate the obtained number of IRQs (git-fixes).
- commit 919ebd1</changelog>
  <changelog author="tiwai@suse.de" date="1719748800">- i2c: testunit: discard write requests while old command is
  running (git-fixes).
- i2c: testunit: don't erase registers after STOP (git-fixes).
- mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
  (git-fixes).
- mmc: sdhci: Do not invert write-protect twice (git-fixes).
- mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
  (git-fixes).
- mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
  (git-fixes).
- commit 448487d</changelog>
  <changelog author="tiwai@suse.de" date="1719748801">- crypto: iaa - Account for cpu-less numa nodes (bsc#1227190).
- commit cd600aa</changelog>
  <changelog author="tiwai@suse.de" date="1719748802">- crypto: deflate - Add aliases to deflate (bsc#1227190).
- commit 27ffd92</changelog>
  <changelog author="tiwai@suse.de" date="1719835200">- ata: ahci: Clean up sysfs file on error (git-fixes).
- ata: libata-core: Fix double free on error (git-fixes).
- ata,scsi: libata-core: Do not leak memory for ata_port struct
  members (git-fixes).
- ata: libata-core: Fix null pointer dereference on error
  (git-fixes).
- kbuild: Fix build target deb-pkg: ln: failed to create hard link
  (git-fixes).
- kbuild: doc: Update default INSTALL_MOD_DIR from extra to
  updates (git-fixes).
- kbuild: Install dtb files as 0644 in Makefile.dtbinst
  (git-fixes).
- counter: ti-eqep: enable clock at probe (git-fixes).
- iio: chemical: bme680: Fix sensor data read operation
  (git-fixes).
- iio: chemical: bme680: Fix overflows in compensate() functions
  (git-fixes).
- iio: chemical: bme680: Fix calibration data variable
  (git-fixes).
- iio: chemical: bme680: Fix pressure value output (git-fixes).
- iio: accel: fxls8962af: select IIO_BUFFER &amp; IIO_KFIFO_BUF
  (git-fixes).
- iio: adc: ad7266: Fix variable checking bug (git-fixes).
- iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
  (git-fixes).
- serial: bcm63xx-uart: fix tx after conversion to
  uart_port_tx_limited() (git-fixes).
- serial: core: introduce uart_port_tx_limited_flags()
  (git-fixes).
- Revert "serial: core: only stop transmit when HW fifo is empty"
  (git-fixes).
- tty: mcf: MCF54418 has 10 UARTS (git-fixes).
- usb: gadget: aspeed_udc: fix device address configuration
  (git-fixes).
- usb: dwc3: core: remove lock of otg mode during gadget
  suspend/resume to avoid deadlock (git-fixes).
- usb: typec: ucsi: glink: fix child node release in probe
  function (git-fixes).
- usb: musb: da8xx: fix a resource leak in probe() (git-fixes).
- usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  (git-fixes).
- usb: gadget: printer: fix races against disable (git-fixes).
- PCI/MSI: Fix UAF in msi_capability_init (git-fixes).
- commit a2ea5a9</changelog>
  <changelog author="ptesarik@suse.com" date="1719835201">- net: ena: Fix redundant device NUMA node override
  (jsc#PED-8688).
- commit 6ad6684</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835202">- tcp: do not accept ACK of bytes we never sent (CVE-2023-52881
  bsc#1225611).
- commit 16404a6</changelog>
  <changelog author="mhocko@suse.com" date="1719835203">- Update
  patches.suse/1352-drm-amdgpu-Fix-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52883
  bsc#1226630).
- Update
  patches.suse/9p-add-missing-locking-around-taking-dentry-fid-list.patch
  (git-fixes CVE-2024-39463 bsc#1227090).
- Update
  patches.suse/ALSA-Fix-deadlocks-with-kctl-removals-at-disconnecti.patch
  (stable-fixes CVE-2024-38600 bsc#1226864).
- Update
  patches.suse/ALSA-core-Fix-NULL-module-pointer-assignment-at-card.patch
  (git-fixes CVE-2024-38605 bsc#1226740).
- Update
  patches.suse/ALSA-hda-Fix-possible-null-ptr-deref-when-assigning-.patch
  (git-fixes CVE-2023-52806 bsc#1225554).
- Update
  patches.suse/ALSA-hda-cs_dsp_ctl-Use-private_free-for-control-cle.patch
  (git-fixes CVE-2024-38388 bsc#1226890).
- Update
  patches.suse/ALSA-timer-Set-lower-bound-of-start-tick-time.patch
  (stable-fixes git-fixes CVE-2024-38618 bsc#1226754).
- Update
  patches.suse/ASoC-kirkwood-Fix-potential-NULL-dereference.patch
  (git-fixes CVE-2024-38550 bsc#1226633).
- Update
  patches.suse/ASoC-mediatek-Assign-dummy-when-codec-not-specified-.patch
  (git-fixes CVE-2024-38551 bsc#1226761).
- Update
  patches.suse/Bluetooth-btusb-Add-date-evt_skb-is-NULL-check.patch
  (git-fixes CVE-2023-52833 bsc#1225595).
- Update
  patches.suse/Bluetooth-hci_core-Fix-possible-buffer-overflow.patch
  (git-fixes CVE-2024-26889).
- Update
  patches.suse/HID-uclogic-Fix-user-memory-access-bug-in-uclogic_pa.patch
  (git-fixes CVE-2023-52866 bsc#1225120).
- Update
  patches.suse/IB-mlx5-Fix-init-stage-error-handling-to-avoid-doubl.patch
  (jsc#PED-6864 CVE-2023-52851 bsc#1225587).
- Update
  patches.suse/Input-cyapa-add-missing-input-core-locking-to-suspen.patch
  (git-fixes CVE-2023-52884 bsc#1226764).
- Update
  patches.suse/Input-synaptics-rmi4-fix-use-after-free-in-rmi_unreg.patch
  (git-fixes CVE-2023-52840 bsc#1224928).
- Update
  patches.suse/KEYS-trusted-Do-not-use-WARN-when-encode-fails.patch
  (git-fixes CVE-2024-36975 bsc#1226520).
- Update
  patches.suse/KEYS-trusted-Fix-memory-leak-in-tpm2_key_encode.patch
  (git-fixes CVE-2024-36967 bsc#1226131).
- Update
  patches.suse/RDMA-cma-Fix-kmemleak-in-rdma_core-observed-during-b.patch
  (git-fixes CVE-2024-38539 bsc#1226608).
- Update patches.suse/RDMA-hns-Fix-UAF-for-cq-async-event.patch
  (git-fixes CVE-2024-38545 bsc#1226595).
- Update
  patches.suse/RDMA-hns-Fix-deadlock-on-SRQ-async-events.patch
  (git-fixes CVE-2024-38591 bsc#1226738).
- Update
  patches.suse/RDMA-hns-Modify-the-print-level-of-CQE-error.patch
  (git-fixes CVE-2024-38590 bsc#1226839).
- Update
  patches.suse/RDMA-rxe-Fix-seg-fault-in-rxe_comp_queue_pkt.patch
  (git-fixes CVE-2024-38544 bsc#1226597).
- Update
  patches.suse/SUNRPC-Fix-RPC-client-cleaned-up-the-freed-pipefs-de.patch
  (git-fixes CVE-2023-52803 bsc#1225008).
- Update patches.suse/af_unix-Clear-stale-u-oob_skb.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-35970 bsc#1224584).
- Update
  patches.suse/af_unix-Drop-oob_skb-ref-before-purging-queue-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26750 bsc#1222617).
- Update
  patches.suse/af_unix-Fix-task-hung-while-purging-oob_skb-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26780 bsc#1222588).
- Update
  patches.suse/af_unix-Update-unix_sk-sk-oob_skb-under-sk_receive_queue-lock.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-36972 bsc#1226163).
- Update
  patches.suse/arm64-Restrict-CPU_BIG_ENDIAN-to-GNU-as-or-LLVM-IAS-.patch
  (git-fixes CVE-2023-52750 bsc#1225485).
- Update
  patches.suse/atl1c-Work-around-the-DMA-RX-overflow-issue.patch
  (git-fixes CVE-2023-52834 bsc#1225599).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issue-of-net_device.patch
  (git-fixes CVE-2024-38554 bsc#1226742).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issues-of-ax25_dev.patch
  (git-fixes CVE-2024-38602 bsc#1226613).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-reorder-of-WRITE-lqueued.patch
  (bsc#1225605 CVE-2024-38384 bsc#1226938).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-resetting-io-stat.patch
  (bsc#1225605 CVE-2024-38663 bsc#1226939).
- Update
  patches.suse/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch
  (git-fixes CVE-2024-38540 bsc#1226582).
- Update
  patches.suse/bonding-stop-the-device-in-bond_setup_by_slave.patch
  (git-fixes CVE-2023-52784 bsc#1224946).
- Update
  patches.suse/can-dev-can_put_echo_skb-don-t-crash-kernel-if-can_p.patch
  (git-fixes CVE-2023-52878 bsc#1225000).
- Update
  patches.suse/clk-mediatek-clk-mt2701-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52875 bsc#1225096).
- Update
  patches.suse/clk-mediatek-clk-mt6765-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52870 bsc#1224937).
- Update
  patches.suse/clk-mediatek-clk-mt6779-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52873 bsc#1225589).
- Update
  patches.suse/clk-mediatek-clk-mt6797-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52865 bsc#1225086).
- Update
  patches.suse/clk-mediatek-clk-mt7629-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52858 bsc#1225566).
- Update
  patches.suse/clk-mediatek-clk-mt7629-eth-Add-check-for-mtk_alloc_.patch
  (git-fixes CVE-2023-52876 bsc#1225036).
- Update
  patches.suse/cppc_cpufreq-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38573 bsc#1226739).
- Update patches.suse/cpufreq-exit-callback-is-optional.patch
  (git-fixes CVE-2024-38615 bsc#1226592).
- Update patches.suse/crypto-bcm-Fix-pointer-arithmetic.patch
  (git-fixes CVE-2024-38579 bsc#1226637).
- Update
  patches.suse/crypto-pcrypt-Fix-hungtask-for-PADATA_RESET.patch
  (git-fixes CVE-2023-52813 bsc#1225527).
- Update patches.suse/cxl-mem-Fix-shutdown-order.patch (git-fixes
  CVE-2023-52849 bsc#1224949).
- Update
  patches.suse/cxl-region-Do-not-try-to-cleanup-after-cxl_region_se.patch
  (git-fixes CVE-2023-52792 bsc#1225477).
- Update patches.suse/cxl-region-Fix-cxlr_pmem-leaks.patch
  (git-fixes CVE-2024-38391 bsc#1226894).
- Update
  patches.suse/dma-buf-sw-sync-don-t-enable-IRQ-from-sync_print_obj.patch
  (git-fixes CVE-2024-38780 bsc#1226886).
- Update
  patches.suse/dma-mapping-benchmark-fix-node-id-validation.patch
  (git-fixes CVE-2024-34777 bsc#1226796).
- Update
  patches.suse/dma-mapping-benchmark-handle-NUMA_NO_NODE-correctly.patch
  (git-fixes CVE-2024-39277 bsc#1226909).
- Update
  patches.suse/dmaengine-idxd-Avoid-unnecessary-destruction-of-file.patch
  (git-fixes CVE-2024-38629 bsc#1226905).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Pola.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52819
  bsc#1225532).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-SMU7.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52818
  bsc#1225530).
- Update
  patches.suse/drm-amd-check-num-of-link-levels-when-update-pcie-pa.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52812
  bsc#1225564).
- Update
  patches.suse/drm-amd-display-Avoid-NULL-dereference-of-timing-gen.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52753
  bsc#1225478).
- Update
  patches.suse/drm-amd-display-Fix-division-by-zero-in-setup_dsc_co.patch
  (stable-fixes CVE-2024-36969 bsc#1226155).
- Update
  patches.suse/drm-amd-display-Fix-null-pointer-dereference-in-erro.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52862
  bsc#1225015).
- Update
  patches.suse/drm-amd-display-Fix-potential-index-out-of-bounds-in.patch
  (git-fixes CVE-2024-38552 bsc#1226767).
- Update
  patches.suse/drm-amd-display-fix-a-NULL-pointer-dereference-in-am.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52773
  bsc#1225041).
- Update
  patches.suse/drm-amd-display-fixed-integer-types-and-null-check-l.patch
  (git-fixes CVE-2024-26767).
- Update
  patches.suse/drm-amdgpu-Fix-a-null-pointer-access-when-the-smc_rr.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52817
  bsc#1225569).
- Update
  patches.suse/drm-amdgpu-Fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch
  (git-fixes CVE-2024-39291 bsc#1226934).
- Update
  patches.suse/drm-amdgpu-Fix-potential-null-pointer-derefernce.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52814
  bsc#1225565).
- Update
  patches.suse/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch
  (stable-fixes CVE-2024-39471 bsc#1227096).
- Update
  patches.suse/drm-amdgpu-mes-fix-use-after-free-issue.patch
  (stable-fixes CVE-2024-38581 bsc#1226657).
- Update
  patches.suse/drm-amdgpu-vkms-fix-a-possible-null-pointer-derefere.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52815
  bsc#1225568).
- Update
  patches.suse/drm-amdkfd-Fix-a-race-condition-of-vram-buffer-unref.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52825
  bsc#1225076).
- Update
  patches.suse/drm-amdkfd-Fix-shift-out-of-bounds-issue.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52816
  bsc#1225529).
- Update
  patches.suse/drm-bridge-cdns-mhdp8546-Fix-possible-null-pointer-d.patch
  (git-fixes CVE-2024-38548).
- Update
  patches.suse/drm-bridge-it66121-Fix-invalid-connector-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52861
  bsc#1224941).
- Update
  patches.suse/drm-bridge-lt8912b-Fix-crash-on-bridge-detach.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52856
  bsc#1224932).
- Update
  patches.suse/drm-mediatek-Add-0-size-check-to-mtk_drm_gem_obj.patch
  (git-fixes CVE-2024-38549 bsc#1226735).
- Update
  patches.suse/drm-mediatek-Fix-coverity-issue-with-unintentional-i.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52857
  bsc#1225581).
- Update
  patches.suse/drm-mediatek-Init-ddp_comp-with-devm_kcalloc.patch
  (git-fixes CVE-2024-38592 bsc#1226844).
- Update
  patches.suse/drm-msm-a6xx-Avoid-a-nullptr-dereference-when-speedb.patch
  (git-fixes CVE-2024-38390 bsc#1226891).
- Update
  patches.suse/drm-msm-dpu-Add-callback-function-pointer-check-befo.patch
  (git-fixes CVE-2024-38622 bsc#1226856).
- Update
  patches.suse/drm-panel-fix-a-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52821
  bsc#1225022).
- Update
  patches.suse/drm-panel-panel-tpo-tpg110-fix-a-possible-null-point.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52826
  bsc#1225077).
- Update patches.suse/drm-radeon-possible-buffer-overflow.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52867
  bsc#1225009).
- Update
  patches.suse/drm-vc4-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38546 bsc#1226593).
- Update
  patches.suse/drm-vmwgfx-Fix-invalid-reads-in-fence-signaled-event.patch
  (git-fixes CVE-2024-36960 bsc#1225872).
- Update
  patches.suse/drm-zynqmp_dpsub-Always-register-bridge.patch
  (git-fixes CVE-2024-38664 bsc#1226941).
- Update
  patches.suse/e1000e-change-usleep_range-to-udelay-in-PHY-mdic-acc.patch
  (CVE-2024-39296 bsc#1226989 CVE-2024-36887 bsc#1225731).
- Update
  patches.suse/ecryptfs-Fix-buffer-size-for-tag-66-packet.patch
  (git-fixes CVE-2024-38578 bsc#1226634).
- Update
  patches.suse/efi-libstub-only-free-priv.runtime_map-when-allocate.patch
  (git-fixes CVE-2024-33619 bsc#1226768).
- Update
  patches.suse/fbdev-imsttfb-fix-a-resource-leak-in-probe.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52838
  bsc#1225031).
- Update
  patches.suse/fs-9p-only-translate-RWX-permissions-for-plain-9P200.patch
  (git-fixes CVE-2024-36964 bsc#1225866).
- Update
  patches.suse/fs-jfs-Add-check-for-negative-db_l2nbperpage.patch
  (git-fixes CVE-2023-52810 bsc#1225557).
- Update
  patches.suse/fs-jfs-Add-validity-check-for-db_maxag-and-db_agpref.patch
  (git-fixes CVE-2023-52804 bsc#1225550).
- Update
  patches.suse/ftrace-Fix-possible-use-after-free-issue-in-ftrace_location.patch
  (git-fixes CVE-2024-38588 bsc#1226837).
- Update
  patches.suse/genirq-irqdesc-Prevent-use-after-free-in-irq_find_at.patch
  (git-fixes CVE-2024-38385 bsc#1227085).
- Update patches.suse/gfs2-ignore-negated-quota-changes.patch
  (git-fixes CVE-2023-52759 bsc#1225560).
- Update
  patches.suse/hid-cp2112-Fix-duplicate-workqueue-initialization.patch
  (git-fixes CVE-2023-52853 bsc#1224988).
- Update
  patches.suse/hwmon-axi-fan-control-Fix-possible-NULL-pointer-dere.patch
  (git-fixes CVE-2023-52863 bsc#1225586).
- Update
  patches.suse/i2c-acpi-Unbind-mux-adapters-before-delete.patch
  (git-fixes CVE-2024-39362 bsc#1226995).
- Update
  patches.suse/i2c-core-Run-atomic-i2c-xfer-when-preemptible.patch
  (git-fixes CVE-2023-52791 bsc#1225108).
- Update
  patches.suse/i3c-master-mipi-i3c-hci-Fix-a-kernel-panic-for-acces.patch
  (git-fixes CVE-2023-52763 bsc#1225570).
- Update
  patches.suse/i3c-mipi-i3c-hci-Fix-out-of-bounds-access-in-hci_dma.patch
  (git-fixes CVE-2023-52766).
- Update
  patches.suse/i915-perf-Fix-NULL-deref-bugs-with-drm_dbg-calls.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52788
  bsc#1225106).
- Update
  patches.suse/igb-Fix-string-truncation-warnings-in-igb_set_fw_ver.patch
  (git-fixes CVE-2024-36010 bsc#1225594).
- Update
  patches.suse/iommu-vt-d-Fix-WARN_ON-in-iommu-probe-path.patch
  (git-fixes CVE-2024-35957 bsc#1224673).
- Update
  patches.suse/iommufd-Fix-missing-update-of-domains_itree-after-splitting-iopt
  (jsc#PED-7779 jsc#PED-7780 CVE-2023-52801 bsc#1225006).
- Update
  patches.suse/ipvlan-add-ipvlan_route_v6_outbound-helper.patch
  (git-fixes CVE-2023-52796 bsc#1224930).
- Update
  patches.suse/jffs2-prevent-xattr-node-from-overflowing-the-eraseblock.patch
  (git-fixes CVE-2024-38599 bsc#1226848).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-dbFindLeaf.patch
  (git-fixes CVE-2023-52799 bsc#1225472).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-diAlloc.patch
  (git-fixes CVE-2023-52805 bsc#1225553).
- Update
  patches.suse/kunit-fortify-Fix-mismatched-kvalloc-vfree-usage.patch
  (git-fixes CVE-2024-38617 bsc#1226859).
- Update
  patches.suse/lib-generic-radix-tree.c-Don-t-overflow-in-peek.patch
  (git-fixes CVE-2021-47432 bsc#1225391).
- Update
  patches.suse/lib-test_hmm.c-handle-src_pfns-and-dst_pfns-allocati.patch
  (git-fixes CVE-2024-38543 bsc#1226594).
- Update
  patches.suse/locking-ww_mutex-test-Fix-potential-workqueue-corrup.patch
  (bsc#1219953 CVE-2023-52836 bsc#1225609).
- Update
  patches.suse/md-Don-t-ignore-suspended-array-in-md_check_recovery-1baa.patch
  (bsc#1219596 CVE-2024-26758).
- Update
  patches.suse/media-atomisp-ssh_css-Fix-a-null-pointer-dereference.patch
  (git-fixes CVE-2024-38547 bsc#1226632).
- Update
  patches.suse/media-bttv-fix-use-after-free-error-due-to-btv-timeo.patch
  (git-fixes CVE-2023-52847 bsc#1225588).
- Update
  patches.suse/media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch
  (git-fixes CVE-2023-52764 bsc#1225571).
- Update
  patches.suse/media-hantro-Check-whether-reset-op-is-defined-befor.patch
  (git-fixes CVE-2023-52850 bsc#1225014).
- Update
  patches.suse/media-i2c-et8ek8-Don-t-strip-remove-function-when-dr.patch
  (git-fixes CVE-2024-38611 bsc#1226760).
- Update
  patches.suse/media-imon-fix-access-to-invalid-resource-for-the-se.patch
  (git-fixes CVE-2023-52754 bsc#1225490).
- Update
  patches.suse/media-lgdt3306a-Add-a-check-against-null-pointer-def.patch
  (stable-fixes CVE-2022-48772 bsc#1226976).
- Update
  patches.suse/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch
  (git-fixes CVE-2024-38621 bsc#1226895).
- Update
  patches.suse/media-vidtv-mux-Add-check-and-kfree-for-kstrdup.patch
  (git-fixes CVE-2023-52841 bsc#1225592).
- Update patches.suse/media-vidtv-psi-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52844 bsc#1225590).
- Update
  patches.suse/mfd-qcom-spmi-pmic-Fix-revid-implementation.patch
  (git-fixes CVE-2023-52765 bsc#1225029).
- Update
  patches.suse/misc-microchip-pci1xxxx-fix-double-free-in-the-error.patch
  (git-fixes CVE-2024-36973 bsc#1226457).
- Update
  patches.suse/net-hns3-fix-out-of-bounds-access-may-occur-when-coa.patch
  (git-fixes CVE-2023-52807 bsc#1225097).
- Update
  patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch
  (git-fixes CVE-2024-36962 bsc#1225827).
- Update
  patches.suse/net-mlx5-Fix-peer-devlink-set-for-SF-representor-dev.patch
  (git-fixes CVE-2024-38595 bsc#1226741).
- Update
  patches.suse/net-mlx5e-Track-xmit-submission-to-PTP-WQ-after-popu.patch
  (jsc#PED-3311 CVE-2023-52782 bsc#1225103).
- Update
  patches.suse/net-mvneta-fix-calls-to-page_pool_get_stats.patch
  (git-fixes CVE-2023-52780 bsc#1224933).
- Update
  patches.suse/net-wangxun-fix-kernel-panic-due-to-null-pointer.patch
  (git-fixes CVE-2023-52783 bsc#1225104).
- Update
  patches.suse/netfilter-complete-validation-of-user-input.patch
  (git-fixes CVE-2024-35896 bsc#1224662 CVE-2024-35962
  bsc#1224583).
- Update
  patches.suse/nfc-nci-Fix-uninit-value-in-nci_rx_work.patch
  (git-fixes CVE-2024-38381 bsc#1226878).
- Update
  patches.suse/nilfs2-fix-nilfs_empty_dir-misjudgment-and-long-loop.patch
  (git-fixes CVE-2024-39469 bsc#1226992).
- Update
  patches.suse/nilfs2-fix-potential-hang-in-nilfs_detach_log_writer.patch
  (git-fixes CVE-2024-38582 bsc#1226658).
- Update
  patches.suse/nilfs2-fix-use-after-free-of-timer-for-log-writer-th.patch
  (git-fixes CVE-2024-38583 bsc#1226777).
- Update
  patches.suse/of-module-add-buffer-overflow-check-in-of_modalias.patch
  (git-fixes CVE-2024-38541 bsc#1226587).
- Update
  patches.suse/padata-Fix-refcnt-handling-in-padata_free_shell.patch
  (git-fixes CVE-2023-52854 bsc#1225584).
- Update
  patches.suse/perf-core-Bail-out-early-if-the-request-AUX-area-is-out-of-bound.patch
  (git-fixes CVE-2023-52835 bsc#1225602).
- Update
  patches.suse/platform-x86-wmi-Fix-opening-of-char-device.patch
  (git-fixes CVE-2023-52864 bsc#1225132).
- Update
  patches.suse/powerpc-pseries-iommu-LPAR-panics-during-boot-up-wit.patch
  (bsc#1222011 ltc#205900 CVE-2024-36926 bsc#1225829).
- Update patches.suse/pstore-platform-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52869 bsc#1225050).
- Update
  patches.suse/remoteproc-mediatek-Make-sure-IPI-buffer-fits-in-L2T.patch
  (git-fixes CVE-2024-36965 bsc#1226149).
- Update
  patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch
  (git-fixes CVE-2024-38601 bsc#1226876).
- Update
  patches.suse/s390-dasd-protect-device-queue-against-concurrent-access.patch
  (git-fixes bsc#1217481 CVE-2023-52774 bsc#1225572).
- Update
  patches.suse/scsi-hisi_sas-Set-debugfs_dir-pointer-to-NULL-after-removing-debugfs.patch
  (git-fixes CVE-2023-52808 bsc#1225555).
- Update
  patches.suse/scsi-ibmvfc-Remove-BUG_ON-in-the-case-of-an-empty-ev.patch
  (bsc#1209834 ltc#202097 CVE-2023-52811 bsc#1225559).
- Update
  patches.suse/scsi-libfc-Fix-potential-NULL-pointer-dereference-in-fc_lport_ptp_setup.patch
  (git-fixes CVE-2023-52809 bsc#1225556).
- Update
  patches.suse/scsi-lpfc-Move-NPIV-s-transport-unregistration-to-af.patch
  (bsc#1221777 CVE-2024-36952 bsc#1225898).
- Update
  patches.suse/scsi-lpfc-Release-hbalock-before-calling-lpfc_worker.patch
  (bsc#1221777 CVE-2024-36924 bsc#1225820).
- Update
  patches.suse/serial-max3100-Lock-port-lock-when-calling-uart_hand.patch
  (git-fixes CVE-2024-38634 bsc#1226868).
- Update
  patches.suse/serial-max3100-Update-uart_driver_registered-on-driv.patch
  (git-fixes CVE-2024-38633 bsc#1226867).
- Update
  patches.suse/soc-qcom-llcc-Handle-a-second-device-without-data-co.patch
  (git-fixes CVE-2023-52871 bsc#1225534).
- Update
  patches.suse/soundwire-cadence-fix-invalid-PDI-offset.patch
  (stable-fixes CVE-2024-38635 bsc#1226863).
- Update patches.suse/speakup-Fix-sizeof-vs-ARRAY_SIZE-bug.patch
  (git-fixes CVE-2024-38587 bsc#1226780).
- Update patches.suse/spi-Fix-null-dereference-on-suspend.patch
  (git-fixes CVE-2023-52749 bsc#1225476).
- Update
  patches.suse/thermal-core-prevent-potential-string-overflow.patch
  (git-fixes CVE-2023-52868 bsc#1225044).
- Update
  patches.suse/thermal-drivers-qcom-lmh-Check-for-SCM-availability-.patch
  (git-fixes CVE-2024-39466 bsc#1227089).
- Update
  patches.suse/thermal-drivers-tsens-Fix-null-pointer-dereference.patch
  (git-fixes CVE-2024-38571 bsc#1226737).
- Update
  patches.suse/thermal-intel-powerclamp-fix-mismatch-in-get-functio.patch
  (git-fixes CVE-2023-52794 bsc#1225028).
- Update
  patches.suse/tls-fix-NULL-deref-on-tls_sw_splice_eof-with-empty-r.patch
  (jsc#PED-6831 CVE-2023-52767 bsc#1224998).
- Update
  patches.suse/tpm_tis_spi-Account-for-SPI-header-when-allocating-T.patch
  (git-fixes CVE-2024-36477 bsc#1226840).
- Update
  patches.suse/tracing-Have-trace_event_file-have-ref-counters.patch
  (git-fixes CVE-2023-52879 bsc#1225101).
- Update
  patches.suse/tracing-trigger-Fix-to-return-error-if-failed-to-alloc-snapshot.patch
  (git-fixes CVE-2024-26920).
- Update
  patches.suse/tty-n_gsm-fix-race-condition-in-status-line-change-o.patch
  (git-fixes CVE-2023-52872 bsc#1225591).
- Update
  patches.suse/tty-n_gsm-require-CAP_NET_ADMIN-to-attach-N_GSM0710-.patch
  (bsc#1222619 CVE-2023-52880).
- Update
  patches.suse/tty-vcc-Add-check-for-kstrdup-in-vcc_probe.patch
  (git-fixes CVE-2023-52789 bsc#1225180).
- Update
  patches.suse/usb-config-fix-iteration-issue-in-usb_get_bos_descri.patch
  (git-fixes CVE-2023-52781 bsc#1225092).
- Update
  patches.suse/usb-dwc3-Wait-unconditionally-after-issuing-EndXfer-.patch
  (git-fixes CVE-2024-36977 bsc#1226513).
- Update
  patches.suse/usb-gadget-u_audio-Fix-race-condition-use-of-control.patch
  (git-fixes CVE-2024-38628 bsc#1226911).
- Update
  patches.suse/usb-storage-alauda-Check-whether-the-media-is-initia.patch
  (git-fixes CVE-2024-38619 bsc#1226861).
- Update
  patches.suse/usb-typec-tcpm-Fix-NULL-pointer-dereference-in-tcpm_.patch
  (git-fixes CVE-2023-52877 bsc#1224944).
- Update
  patches.suse/vhost-vdpa-fix-use-after-free-in-vhost_vdpa_probe.patch
  (jsc#PED-3311 CVE-2023-52795 bsc#1225085).
- Update
  patches.suse/virtio-blk-fix-implicit-overflow-on-virtio_max_dma_s.patch
  (git-fixes CVE-2023-52762 bsc#1225573).
- Update
  patches.suse/virtio-vsock-Fix-uninit-value-in-virtio_transport_re.patch
  (jsc#PED-5505 CVE-2023-52842 bsc#1225025).
- Update
  patches.suse/watchdog-cpu5wdt.c-Fix-use-after-free-bug-caused-by-.patch
  (git-fixes CVE-2024-38630 bsc#1226908).
- Update
  patches.suse/wifi-ar5523-enable-proper-endpoint-verification.patch
  (git-fixes CVE-2024-38565 bsc#1226747).
- Update
  patches.suse/wifi-ath11k-fix-dfs-radar-event-locking.patch
  (git-fixes CVE-2023-52798 bsc#1224947).
- Update
  patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch
  (git-fixes CVE-2023-52777 bsc#1224992).
- Update patches.suse/wifi-ath11k-fix-htt-pktlog-locking.patch
  (git-fixes CVE-2023-52800).
- Update
  patches.suse/wifi-ath12k-fix-dfs-radar-and-temperature-event-lock.patch
  (git-fixes CVE-2023-52776 bsc#1225090).
- Update
  patches.suse/wifi-ath12k-fix-htt-mlo-offset-event-locking.patch
  (git-fixes CVE-2023-52769 bsc#1225001).
- Update
  patches.suse/wifi-ath12k-fix-out-of-bound-access-of-qmi_invoke_ha.patch
  (git-fixes CVE-2024-38572 bsc#1226776).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-read-in-ath12k.patch
  (git-fixes CVE-2023-52827 bsc#1225078).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-write-in-ath12.patch
  (git-fixes CVE-2023-52829 bsc#1225081).
- Update
  patches.suse/wifi-brcmfmac-pcie-handle-randbuf-allocation-failure.patch
  (git-fixes CVE-2024-38575 bsc#1226612).
- Update
  patches.suse/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch
  (git-fixes CVE-2024-38567 bsc#1226769).
- Update
  patches.suse/wifi-carl9170-re-fix-fortified-memset-warning.patch
  (git-fixes CVE-2024-38616 bsc#1226852).
- Update
  patches.suse/wifi-mac80211-don-t-return-unset-power-in-ieee80211_.patch
  (git-fixes CVE-2023-52832 bsc#1225577).
- Update
  patches.suse/wifi-nl80211-Avoid-address-calculations-via-out-of-b.patch
  (git-fixes CVE-2024-38562 bsc#1226788).
- Update
  patches.suse/wifi-wilc1000-use-vmm_table-as-array-in-wilc-struct.patch
  (git-fixes CVE-2023-52768 bsc#1225004).
- Update
  patches.suse/x86-tdx-Zero-out-the-missing-RSI-in-TDX_HYPERCALL-macro.patch
  (jsc#PED-5824 CVE-2023-52874 bsc#1225049).
- commit 33efdc4</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835204">- tcp: Use refcount_inc_not_zero() in tcp_twsk_unique()
  (CVE-2024-36904 bsc#1225732).
- commit d578dcc</changelog>
  <changelog author="heming.zhao@suse.com" date="1719921600">- gfs2: Fix potential glock use-after-free on unmount (bsc#1226775
  CVE-2024-38570).
- gfs2: Rename sd_{ glock =&gt; kill }_wait (bsc#1226775
  CVE-2024-38570).
- commit f3adbca</changelog>
  <changelog author="tiwai@suse.de" date="1719921601">- Correct SCSI patch references (bsc#1225767 CVE-2024-36919 bsc#1226785 CVE-2024-38559)
- commit e8ea587</changelog>
  <changelog author="tiwai@suse.de" date="1719921602">- mtd: rawnand: rockchip: ensure NVDDR timings are rejected
  (git-fixes).
- mtd: rawnand: Bypass a couple of sanity checks during NAND
  identification (git-fixes).
- mtd: rawnand: Fix the nand_read_data_op() early check
  (git-fixes).
- mtd: rawnand: Ensure ECC configuration is propagated to upper
  layers (git-fixes).
- commit e545951</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1719921603">- kernel-doc: fix struct_group_tagged() parsing (git-fixes).
- commit e3a2a2e</changelog>
  <changelog author="fdmanana@suse.com" date="1719921604">- btrfs: fix crash on racing fsync and size-extending write into
  prealloc (bsc#1227101 CVE-2024-37354).
- commit 1d355af</changelog>
  <changelog author="vbabka@suse.cz" date="1719921605">- virt: acrn: stop using follow_pfn (CVE-2024-38610 bsc#1226758).
- commit c2ea51b</changelog>
  <changelog author="vbabka@suse.cz" date="1719921606">- drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
  (CVE-2024-38610 bsc#1226758).
- commit 7069ac2</changelog>
  <changelog author="rhopkins@suse.de" date="1719921607">- hsr: Prevent use after free in prp_create_tagged_frame()
  (CVE-2023-52846 bsc#1225098).
- commit cf63988</changelog>
  <changelog author="krisman@suse.de" date="1719921608">- io_uring: Fix io_cqring_wait() not restoring sigmask on
  get_timespec64() failure (git-fixes).
- commit e640a65</changelog>
  <changelog author="krisman@suse.de" date="1719921609">- io_uring: check for non-NULL file pointer in io_file_can_poll()
  (bsc#1226990 CVE-2024-39371).
- io_uring/io-wq: Use set_bit() and test_bit() at worker-&gt;flags
  (git-fixes).
- io_uring/sqpoll: work around a potential audit memory leak
  (git-fixes).
- commit 24603fc</changelog>
  <changelog author="krisman@suse.de" date="1719921610">- io_uring/rsrc: fix incorrect assignment of iter-&gt;nr_segs in
  io_import_fixed (git-fixes).
- io_uring/rsrc: don't lock while !TASK_RUNNING (git-fixes).
- io_uring/io-wq: avoid garbage value of 'match' in
  io_wq_enqueue() (git-fixes).
- commit 7d3e252</changelog>
</package>
<package pkgid="71983d36b381db1c26e12cb2081be0d87b32d5d38db757834a7ae823eea179b5" name="dtb-marvell" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.17.1"/>
  <changelog author="tiwai@suse.de" date="1722081600">- auxdisplay: ht16k33: Drop reference after LED registration
  (git-fixes).
- ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
  on unprepare (git-fixes).
- ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
- ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
  reachable (git-fixes).
- ASoC: sof: amd: fix for firmware reload failure in Vangogh
  platform (git-fixes).
- ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
- ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
  (git-fixes).
- ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
- ALSA: ump: Don't update FB name for static blocks (git-fixes).
- drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
- drm/i915/gt: Do not consider preemption during execlists_dequeue
  for gen8 (git-fixes).
- drm/i915/dp: Don't switch the LTTPR mode on an active link
  (git-fixes).
- commit d7e2deb</changelog>
  <changelog author="tiwai@suse.de" date="1722081601">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
</package>
<package pkgid="5046d8b77c558edb1af89e1f7f2f9f18e5a50570d9d48ede13d36cec59aa437d" name="dtb-marvell" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.7.1"/>
  <changelog author="mkubecek@suse.cz" date="1717416000">- netfilter: nf_tables: release mutex after nft_gc_seq_end from
  abort path (CVE-2024-26925 bsc#1223390).
- commit 578a709</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717416001">- Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
  The L3 bsc#1225765 was created seperately since our customer requires
  PTF.
- Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
- Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
- Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
- Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
- commit 054635e</changelog>
  <changelog author="msuchanek@suse.de" date="1717416002">- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
- powerpc/uaccess: Fix build errors seen with GCC 13/14
  (bsc#1194869).
- commit 46b5d84</changelog>
  <changelog author="msuchanek@suse.de" date="1717416003">- blacklist.conf: PPC fsl_msi is not used
- commit ae6590d</changelog>
  <changelog author="msuchanek@suse.de" date="1717416004">- powerpc/pseries/lparcfg: drop error message from guest name
  lookup (bsc#1187716 ltc#193451 git-fixes).
- commit ceab637</changelog>
  <changelog author="mfranc@suse.cz" date="1717416005">- Update
  patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
  (git-fixes CVE-2024-36955).
- Update
  patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
  (git-fixes bsc#1225715 CVE-2024-36906).
- Update
  patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
  (git-fixes bsc#1225579 CVE-2024-36011).
- Update
  patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
  (git-fixes bsc#1225578 CVE-2024-36013).
- Update
  patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
  (git-fixes bsc#1225502 CVE-2024-36012).
- Update
  patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
  (git-fixes bsc#1225722 CVE-2024-36880).
- Update
  patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
  (git-fixes CVE-2024-36942).
- Update
  patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
  (git-fixes bsc#1225720 CVE-2024-36032).
- Update
  patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
  (git-fixes bsc#1223749 CVE-2024-26990).
- Update
  patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
  (git-fixes bsc#1223692 CVE-2024-26992).
- Update
  patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
  (stable-fixes CVE-2024-36944).
- Update
  patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
  (git-fixes bsc#1225734 CVE-2024-36896).
- Update
  patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
  (stable-fixes CVE-2024-36949).
- Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
  (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
- Update
  patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
  (git-fixes bsc#1225692 CVE-2023-52882).
- Update
  patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
  (git-fixes CVE-2024-26761).
- Update
  patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
  (stable-fixes bsc#1225735 CVE-2024-36897).
- Update
  patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
  (stable-fixes bsc#1225705 CVE-2024-36026).
- Update
  patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
  (stable-fixes CVE-2024-36951).
- Update
  patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
  (git-fixes bsc#1225593 CVE-2024-36014).
- Update
  patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
  (stable-fixes bsc#1225728 CVE-2024-36885).
- Update
  patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
  (git-fixes bsc#1225773 CVE-2024-36936).
- Update
  patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
  (stable-fixes CVE-2024-36950).
- Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
  (git-fixes bsc#1225736 CVE-2024-36898).
- Update
  patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
  (git-fixes bsc#1225698 CVE-2024-36020).
- Update
  patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
  (git-fixes bsc#1225710 CVE-2024-36891).
- Update
  patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
  (git-fixes bsc#1225714 CVE-2024-36890).
- Update
  patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
  (git-fixes bsc#1225708 CVE-2024-36029).
- Update
  patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
  (git-fixes bsc#1225699 CVE-2024-36021).
- Update
  patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
  (git-fixes CVE-2024-26943).
- Update
  patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
  (git-fixes bsc#1225694 CVE-2024-36018).
- Update
  patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
  (git-fixes CVE-2024-36940).
- Update
  patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
  (git-fixes CVE-2024-36959).
- Update
  patches.suse/ppdev-Add-an-error-check-in-register_device.patch
  (git-fixes bsc#1225640 CVE-2024-36015).
- Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
  CVE-2024-36947).
- Update
  patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
  (git-fixes bsc#1225695 CVE-2024-36019).
- Update
  patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
  (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
- Update
  patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
  (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
- Update
  patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
  (git-fixes bsc#1225704 CVE-2024-36025).
- Update
  patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
  (git-fixes CVE-2024-36930).
- Update
  patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
  (bsc#1224331 bsc#1224602 CVE-2024-35814).
- Update
  patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
  (git-fixes bsc#1225642 CVE-2024-36016).
- Update
  patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
  (git-fixes bsc#1225749 CVE-2024-36894).
- Update
  patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
  (git-fixes bsc#1225750 CVE-2024-36895).
- Update
  patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
  (git-fixes bsc#1225748 CVE-2024-36893).
- Update
  patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
  (stable-fixes bsc#1225769 CVE-2024-36921).
- Update
  patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
  (stable-fixes CVE-2024-36922).
- Update
  patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
  (git-fixes CVE-2024-36941).
- Update
  patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
  (git-fixes bsc#1224742 CVE-2024-35803).
- commit 539780f</changelog>
  <changelog author="dwagner@suse.de" date="1717416006">- nvmet: fix ns enable/disable possible hang (git-fixes).
- nvme-multipath: fix io accounting on failover (git-fixes).
- nvme: fix multipath batched completion accounting (git-fixes).
- commit ed3b392</changelog>
  <changelog author="dwagner@suse.de" date="1717416007">- scsi: lpfc: Copyright updates for 14.4.0.2 patches
  (bsc#1225842).
- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
  (bsc#1225842).
  Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
  (bsc#1225842).
- scsi: lpfc: Clear deferred RSCN processing flag when driver
  is unloading (bsc#1225842).
- scsi: lpfc: Update logging of protection type for T10 DIF I/O
  (bsc#1225842).
- scsi: lpfc: Change default logging level for unsolicited CT
  MIB commands (bsc#1225842).
- commit 5a56384</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416008">- smb: client: fix mount when dns_resolver key is not available
  (git-fixes, bsc#1225172).
- commit 28edb5c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416009">- cifs: fix leak of iface for primary channel (git-fixes,
  bsc#1225172).
- commit b7eb8e8</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416010">- Revert "cifs: reconnect work should have reference on server
  struct" (git-fixes, bsc#1225172).
- commit 3ca4c0c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416011">- smb: client: fix parsing of SMB3.1.1 POSIX create context
  (git-fixes, bsc#1225172).
- commit 5f27f69</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416012">- cifs: failure to add channel on iface should bump up weight
  (git-fixes, bsc#1225172).
- commit 007b237</changelog>
  <changelog author="tonyj@suse.de" date="1717416013">- perf/x86: Fix out of range data (git-fixes).
- perf/x86/intel/ds: Don't clear -&gt;pebs_data_cfg for the last
  PEBS event (git-fixes).
- perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
- commit 664d77f</changelog>
  <changelog author="dsterba@suse.com" date="1717588800">- blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
- Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
  Quoting bsc#1225945#c11:
  "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
  transaction for every subvol create")
  ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
  unwritten extent buffer after snapshotting a new subvolume") was never
  backported."
- commit d947258</changelog>
  <changelog author="tonyj@suse.de" date="1717588801">- perf pmu: Count sys and cpuid JSON events separately (git
  fixes).
- perf stat: Don't display metric header for non-leader uncore
  events (git-fixes).
- perf daemon: Fix file leak in daemon_session__control
  (git-fixes).
- perf symbols: Fix ownership of string in dso__load_vmlinux()
  (git-fixes).
- perf thread: Fixes to thread__new() related to initializing comm
  (git-fixes).
- perf report: Avoid SEGV in report__setup_sample_type()
  (git-fixes).
- perf ui browser: Don't save pointer to stack memory (git-fixes).
- perf bench internals inject-build-id: Fix trap divide when
  collecting just one DSO (git-fixes).
- perf intel-pt: Fix unassigned instruction op (discovered by
  MemorySanitizer) (git-fixes).
- perf test shell arm_coresight: Increase buffer size for
  Coresight basic tests (git-fixes).
- perf docs: Document bpf event modifier (git-fixes).
- perf bench uprobe: Remove lib64 from libc.so.6 binary path
  (git-fixes).
- perf record: Fix debug message placement for test consumption
  (git-fixes).
- perf tests: Apply attributes to all events in object code
  reading test (git-fixes).
- perf tests: Make "test data symbol" more robust on Neoverse N1
  (git-fixes).
- perf annotate: Fix annotation_calc_lines() to pass correct
  address to get_srcline() (git-fixes).
- perf stat: Do not fail on metrics on s390 z/VM systems
  (git-fixes).
- perf sched timehist: Fix -g/--call-graph option failure
  (git-fixes).
- perf annotate: Get rid of duplicate --group option item
  (git-fixes).
- perf probe: Add missing libgen.h header needed for using
  basename() (git-fixes).
- perf record: Delete session after stopping sideband thread
  (git-fixes).
- perf auxtrace: Fix multiple use of --itrace option (git-fixes).
- perf script: Show also errors for --insn-trace option
  (git-fixes).
- perf lock contention: Add a missing NULL check (git-fixes).
- perf vendor events amd: Fix Zen 4 cache latency events
  (git-fixes).
- libperf evlist: Avoid out-of-bounds access (git-fixes).
- perf pmu: Fix a potential memory leak in perf_pmu__lookup()
  (git-fixes).
- perf print-events: make is_event_supported() more robust
  (git-fixes).
- perf list: fix short description for some cache events
  (git-fixes).
- perf metric: Don't remove scale from counts (git-fixes).
- perf stat: Avoid metric-only segv (git-fixes).
- perf expr: Fix "has_event" function for metric style events
  (git-fixes).
- perf srcline: Add missed addr2line closes (git-fixes).
- perf thread_map: Free strlist on normal path in
  thread_map__new_by_tid_str() (git-fixes).
- perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
- perf jevents: Drop or simplify small integer values (git-fixes).
- perf evsel: Fix duplicate initialization of data-&gt;id in
  evsel__parse_sample() (git-fixes).
- perf pmu: Treat the msr pmu as software (git-fixes).
- perf record: Check conflict between '--timestamp-filename'
  option and pipe mode before recording (git-fixes).
- perf record: Fix possible incorrect free in
  record__switch_output() (git-fixes).
- perf vendor events amd: Add Zen 4 memory controller events
  (git-fixes).
- perf top: Uniform the event name for the hybrid machine
  (git-fixes).
- perf top: Use evsel's cpus to replace user_requested_cpus
  (git-fixes).
- commit a1f9340</changelog>
  <changelog author="tonyj@suse.de" date="1717675200">- perf ui browser: Avoid SEGV on title (git fixes).
- commit 1578c22</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675201">- inet: inet_defrag: prevent sk release while still in use
  (CVE-2024-26921 bsc#1223138).
- commit 2016faf</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675202">- net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
- commit 7bf5961</changelog>
  <changelog author="tiwai@suse.de" date="1718366400">- Temporarily drop KVM patch that caused a regression (bsc#1226158)
  Delete patches.suse/KVM-x86-pmu-Prioritize-VMX-interception-over-GP-on-R.patch
- commit 33f31da</changelog>
</package>
<package pkgid="f9a352396cd933ef0619ec9294b43819bc000ad8f39a4eed535a24c8fb8be4ef" name="dtb-mediatek" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.14.1"/>
  <changelog author="tiwai@suse.de" date="1719662400">- gpiolib: cdev: Disallow reconfiguration without direction
  (uAPI v1) (git-fixes).
- gpio: davinci: Validate the obtained number of IRQs (git-fixes).
- commit 919ebd1</changelog>
  <changelog author="tiwai@suse.de" date="1719748800">- i2c: testunit: discard write requests while old command is
  running (git-fixes).
- i2c: testunit: don't erase registers after STOP (git-fixes).
- mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
  (git-fixes).
- mmc: sdhci: Do not invert write-protect twice (git-fixes).
- mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
  (git-fixes).
- mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
  (git-fixes).
- commit 448487d</changelog>
  <changelog author="tiwai@suse.de" date="1719748801">- crypto: iaa - Account for cpu-less numa nodes (bsc#1227190).
- commit cd600aa</changelog>
  <changelog author="tiwai@suse.de" date="1719748802">- crypto: deflate - Add aliases to deflate (bsc#1227190).
- commit 27ffd92</changelog>
  <changelog author="tiwai@suse.de" date="1719835200">- ata: ahci: Clean up sysfs file on error (git-fixes).
- ata: libata-core: Fix double free on error (git-fixes).
- ata,scsi: libata-core: Do not leak memory for ata_port struct
  members (git-fixes).
- ata: libata-core: Fix null pointer dereference on error
  (git-fixes).
- kbuild: Fix build target deb-pkg: ln: failed to create hard link
  (git-fixes).
- kbuild: doc: Update default INSTALL_MOD_DIR from extra to
  updates (git-fixes).
- kbuild: Install dtb files as 0644 in Makefile.dtbinst
  (git-fixes).
- counter: ti-eqep: enable clock at probe (git-fixes).
- iio: chemical: bme680: Fix sensor data read operation
  (git-fixes).
- iio: chemical: bme680: Fix overflows in compensate() functions
  (git-fixes).
- iio: chemical: bme680: Fix calibration data variable
  (git-fixes).
- iio: chemical: bme680: Fix pressure value output (git-fixes).
- iio: accel: fxls8962af: select IIO_BUFFER &amp; IIO_KFIFO_BUF
  (git-fixes).
- iio: adc: ad7266: Fix variable checking bug (git-fixes).
- iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
  (git-fixes).
- serial: bcm63xx-uart: fix tx after conversion to
  uart_port_tx_limited() (git-fixes).
- serial: core: introduce uart_port_tx_limited_flags()
  (git-fixes).
- Revert "serial: core: only stop transmit when HW fifo is empty"
  (git-fixes).
- tty: mcf: MCF54418 has 10 UARTS (git-fixes).
- usb: gadget: aspeed_udc: fix device address configuration
  (git-fixes).
- usb: dwc3: core: remove lock of otg mode during gadget
  suspend/resume to avoid deadlock (git-fixes).
- usb: typec: ucsi: glink: fix child node release in probe
  function (git-fixes).
- usb: musb: da8xx: fix a resource leak in probe() (git-fixes).
- usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  (git-fixes).
- usb: gadget: printer: fix races against disable (git-fixes).
- PCI/MSI: Fix UAF in msi_capability_init (git-fixes).
- commit a2ea5a9</changelog>
  <changelog author="ptesarik@suse.com" date="1719835201">- net: ena: Fix redundant device NUMA node override
  (jsc#PED-8688).
- commit 6ad6684</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835202">- tcp: do not accept ACK of bytes we never sent (CVE-2023-52881
  bsc#1225611).
- commit 16404a6</changelog>
  <changelog author="mhocko@suse.com" date="1719835203">- Update
  patches.suse/1352-drm-amdgpu-Fix-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52883
  bsc#1226630).
- Update
  patches.suse/9p-add-missing-locking-around-taking-dentry-fid-list.patch
  (git-fixes CVE-2024-39463 bsc#1227090).
- Update
  patches.suse/ALSA-Fix-deadlocks-with-kctl-removals-at-disconnecti.patch
  (stable-fixes CVE-2024-38600 bsc#1226864).
- Update
  patches.suse/ALSA-core-Fix-NULL-module-pointer-assignment-at-card.patch
  (git-fixes CVE-2024-38605 bsc#1226740).
- Update
  patches.suse/ALSA-hda-Fix-possible-null-ptr-deref-when-assigning-.patch
  (git-fixes CVE-2023-52806 bsc#1225554).
- Update
  patches.suse/ALSA-hda-cs_dsp_ctl-Use-private_free-for-control-cle.patch
  (git-fixes CVE-2024-38388 bsc#1226890).
- Update
  patches.suse/ALSA-timer-Set-lower-bound-of-start-tick-time.patch
  (stable-fixes git-fixes CVE-2024-38618 bsc#1226754).
- Update
  patches.suse/ASoC-kirkwood-Fix-potential-NULL-dereference.patch
  (git-fixes CVE-2024-38550 bsc#1226633).
- Update
  patches.suse/ASoC-mediatek-Assign-dummy-when-codec-not-specified-.patch
  (git-fixes CVE-2024-38551 bsc#1226761).
- Update
  patches.suse/Bluetooth-btusb-Add-date-evt_skb-is-NULL-check.patch
  (git-fixes CVE-2023-52833 bsc#1225595).
- Update
  patches.suse/Bluetooth-hci_core-Fix-possible-buffer-overflow.patch
  (git-fixes CVE-2024-26889).
- Update
  patches.suse/HID-uclogic-Fix-user-memory-access-bug-in-uclogic_pa.patch
  (git-fixes CVE-2023-52866 bsc#1225120).
- Update
  patches.suse/IB-mlx5-Fix-init-stage-error-handling-to-avoid-doubl.patch
  (jsc#PED-6864 CVE-2023-52851 bsc#1225587).
- Update
  patches.suse/Input-cyapa-add-missing-input-core-locking-to-suspen.patch
  (git-fixes CVE-2023-52884 bsc#1226764).
- Update
  patches.suse/Input-synaptics-rmi4-fix-use-after-free-in-rmi_unreg.patch
  (git-fixes CVE-2023-52840 bsc#1224928).
- Update
  patches.suse/KEYS-trusted-Do-not-use-WARN-when-encode-fails.patch
  (git-fixes CVE-2024-36975 bsc#1226520).
- Update
  patches.suse/KEYS-trusted-Fix-memory-leak-in-tpm2_key_encode.patch
  (git-fixes CVE-2024-36967 bsc#1226131).
- Update
  patches.suse/RDMA-cma-Fix-kmemleak-in-rdma_core-observed-during-b.patch
  (git-fixes CVE-2024-38539 bsc#1226608).
- Update patches.suse/RDMA-hns-Fix-UAF-for-cq-async-event.patch
  (git-fixes CVE-2024-38545 bsc#1226595).
- Update
  patches.suse/RDMA-hns-Fix-deadlock-on-SRQ-async-events.patch
  (git-fixes CVE-2024-38591 bsc#1226738).
- Update
  patches.suse/RDMA-hns-Modify-the-print-level-of-CQE-error.patch
  (git-fixes CVE-2024-38590 bsc#1226839).
- Update
  patches.suse/RDMA-rxe-Fix-seg-fault-in-rxe_comp_queue_pkt.patch
  (git-fixes CVE-2024-38544 bsc#1226597).
- Update
  patches.suse/SUNRPC-Fix-RPC-client-cleaned-up-the-freed-pipefs-de.patch
  (git-fixes CVE-2023-52803 bsc#1225008).
- Update patches.suse/af_unix-Clear-stale-u-oob_skb.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-35970 bsc#1224584).
- Update
  patches.suse/af_unix-Drop-oob_skb-ref-before-purging-queue-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26750 bsc#1222617).
- Update
  patches.suse/af_unix-Fix-task-hung-while-purging-oob_skb-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26780 bsc#1222588).
- Update
  patches.suse/af_unix-Update-unix_sk-sk-oob_skb-under-sk_receive_queue-lock.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-36972 bsc#1226163).
- Update
  patches.suse/arm64-Restrict-CPU_BIG_ENDIAN-to-GNU-as-or-LLVM-IAS-.patch
  (git-fixes CVE-2023-52750 bsc#1225485).
- Update
  patches.suse/atl1c-Work-around-the-DMA-RX-overflow-issue.patch
  (git-fixes CVE-2023-52834 bsc#1225599).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issue-of-net_device.patch
  (git-fixes CVE-2024-38554 bsc#1226742).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issues-of-ax25_dev.patch
  (git-fixes CVE-2024-38602 bsc#1226613).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-reorder-of-WRITE-lqueued.patch
  (bsc#1225605 CVE-2024-38384 bsc#1226938).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-resetting-io-stat.patch
  (bsc#1225605 CVE-2024-38663 bsc#1226939).
- Update
  patches.suse/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch
  (git-fixes CVE-2024-38540 bsc#1226582).
- Update
  patches.suse/bonding-stop-the-device-in-bond_setup_by_slave.patch
  (git-fixes CVE-2023-52784 bsc#1224946).
- Update
  patches.suse/can-dev-can_put_echo_skb-don-t-crash-kernel-if-can_p.patch
  (git-fixes CVE-2023-52878 bsc#1225000).
- Update
  patches.suse/clk-mediatek-clk-mt2701-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52875 bsc#1225096).
- Update
  patches.suse/clk-mediatek-clk-mt6765-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52870 bsc#1224937).
- Update
  patches.suse/clk-mediatek-clk-mt6779-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52873 bsc#1225589).
- Update
  patches.suse/clk-mediatek-clk-mt6797-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52865 bsc#1225086).
- Update
  patches.suse/clk-mediatek-clk-mt7629-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52858 bsc#1225566).
- Update
  patches.suse/clk-mediatek-clk-mt7629-eth-Add-check-for-mtk_alloc_.patch
  (git-fixes CVE-2023-52876 bsc#1225036).
- Update
  patches.suse/cppc_cpufreq-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38573 bsc#1226739).
- Update patches.suse/cpufreq-exit-callback-is-optional.patch
  (git-fixes CVE-2024-38615 bsc#1226592).
- Update patches.suse/crypto-bcm-Fix-pointer-arithmetic.patch
  (git-fixes CVE-2024-38579 bsc#1226637).
- Update
  patches.suse/crypto-pcrypt-Fix-hungtask-for-PADATA_RESET.patch
  (git-fixes CVE-2023-52813 bsc#1225527).
- Update patches.suse/cxl-mem-Fix-shutdown-order.patch (git-fixes
  CVE-2023-52849 bsc#1224949).
- Update
  patches.suse/cxl-region-Do-not-try-to-cleanup-after-cxl_region_se.patch
  (git-fixes CVE-2023-52792 bsc#1225477).
- Update patches.suse/cxl-region-Fix-cxlr_pmem-leaks.patch
  (git-fixes CVE-2024-38391 bsc#1226894).
- Update
  patches.suse/dma-buf-sw-sync-don-t-enable-IRQ-from-sync_print_obj.patch
  (git-fixes CVE-2024-38780 bsc#1226886).
- Update
  patches.suse/dma-mapping-benchmark-fix-node-id-validation.patch
  (git-fixes CVE-2024-34777 bsc#1226796).
- Update
  patches.suse/dma-mapping-benchmark-handle-NUMA_NO_NODE-correctly.patch
  (git-fixes CVE-2024-39277 bsc#1226909).
- Update
  patches.suse/dmaengine-idxd-Avoid-unnecessary-destruction-of-file.patch
  (git-fixes CVE-2024-38629 bsc#1226905).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Pola.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52819
  bsc#1225532).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-SMU7.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52818
  bsc#1225530).
- Update
  patches.suse/drm-amd-check-num-of-link-levels-when-update-pcie-pa.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52812
  bsc#1225564).
- Update
  patches.suse/drm-amd-display-Avoid-NULL-dereference-of-timing-gen.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52753
  bsc#1225478).
- Update
  patches.suse/drm-amd-display-Fix-division-by-zero-in-setup_dsc_co.patch
  (stable-fixes CVE-2024-36969 bsc#1226155).
- Update
  patches.suse/drm-amd-display-Fix-null-pointer-dereference-in-erro.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52862
  bsc#1225015).
- Update
  patches.suse/drm-amd-display-Fix-potential-index-out-of-bounds-in.patch
  (git-fixes CVE-2024-38552 bsc#1226767).
- Update
  patches.suse/drm-amd-display-fix-a-NULL-pointer-dereference-in-am.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52773
  bsc#1225041).
- Update
  patches.suse/drm-amd-display-fixed-integer-types-and-null-check-l.patch
  (git-fixes CVE-2024-26767).
- Update
  patches.suse/drm-amdgpu-Fix-a-null-pointer-access-when-the-smc_rr.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52817
  bsc#1225569).
- Update
  patches.suse/drm-amdgpu-Fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch
  (git-fixes CVE-2024-39291 bsc#1226934).
- Update
  patches.suse/drm-amdgpu-Fix-potential-null-pointer-derefernce.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52814
  bsc#1225565).
- Update
  patches.suse/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch
  (stable-fixes CVE-2024-39471 bsc#1227096).
- Update
  patches.suse/drm-amdgpu-mes-fix-use-after-free-issue.patch
  (stable-fixes CVE-2024-38581 bsc#1226657).
- Update
  patches.suse/drm-amdgpu-vkms-fix-a-possible-null-pointer-derefere.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52815
  bsc#1225568).
- Update
  patches.suse/drm-amdkfd-Fix-a-race-condition-of-vram-buffer-unref.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52825
  bsc#1225076).
- Update
  patches.suse/drm-amdkfd-Fix-shift-out-of-bounds-issue.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52816
  bsc#1225529).
- Update
  patches.suse/drm-bridge-cdns-mhdp8546-Fix-possible-null-pointer-d.patch
  (git-fixes CVE-2024-38548).
- Update
  patches.suse/drm-bridge-it66121-Fix-invalid-connector-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52861
  bsc#1224941).
- Update
  patches.suse/drm-bridge-lt8912b-Fix-crash-on-bridge-detach.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52856
  bsc#1224932).
- Update
  patches.suse/drm-mediatek-Add-0-size-check-to-mtk_drm_gem_obj.patch
  (git-fixes CVE-2024-38549 bsc#1226735).
- Update
  patches.suse/drm-mediatek-Fix-coverity-issue-with-unintentional-i.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52857
  bsc#1225581).
- Update
  patches.suse/drm-mediatek-Init-ddp_comp-with-devm_kcalloc.patch
  (git-fixes CVE-2024-38592 bsc#1226844).
- Update
  patches.suse/drm-msm-a6xx-Avoid-a-nullptr-dereference-when-speedb.patch
  (git-fixes CVE-2024-38390 bsc#1226891).
- Update
  patches.suse/drm-msm-dpu-Add-callback-function-pointer-check-befo.patch
  (git-fixes CVE-2024-38622 bsc#1226856).
- Update
  patches.suse/drm-panel-fix-a-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52821
  bsc#1225022).
- Update
  patches.suse/drm-panel-panel-tpo-tpg110-fix-a-possible-null-point.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52826
  bsc#1225077).
- Update patches.suse/drm-radeon-possible-buffer-overflow.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52867
  bsc#1225009).
- Update
  patches.suse/drm-vc4-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38546 bsc#1226593).
- Update
  patches.suse/drm-vmwgfx-Fix-invalid-reads-in-fence-signaled-event.patch
  (git-fixes CVE-2024-36960 bsc#1225872).
- Update
  patches.suse/drm-zynqmp_dpsub-Always-register-bridge.patch
  (git-fixes CVE-2024-38664 bsc#1226941).
- Update
  patches.suse/e1000e-change-usleep_range-to-udelay-in-PHY-mdic-acc.patch
  (CVE-2024-39296 bsc#1226989 CVE-2024-36887 bsc#1225731).
- Update
  patches.suse/ecryptfs-Fix-buffer-size-for-tag-66-packet.patch
  (git-fixes CVE-2024-38578 bsc#1226634).
- Update
  patches.suse/efi-libstub-only-free-priv.runtime_map-when-allocate.patch
  (git-fixes CVE-2024-33619 bsc#1226768).
- Update
  patches.suse/fbdev-imsttfb-fix-a-resource-leak-in-probe.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52838
  bsc#1225031).
- Update
  patches.suse/fs-9p-only-translate-RWX-permissions-for-plain-9P200.patch
  (git-fixes CVE-2024-36964 bsc#1225866).
- Update
  patches.suse/fs-jfs-Add-check-for-negative-db_l2nbperpage.patch
  (git-fixes CVE-2023-52810 bsc#1225557).
- Update
  patches.suse/fs-jfs-Add-validity-check-for-db_maxag-and-db_agpref.patch
  (git-fixes CVE-2023-52804 bsc#1225550).
- Update
  patches.suse/ftrace-Fix-possible-use-after-free-issue-in-ftrace_location.patch
  (git-fixes CVE-2024-38588 bsc#1226837).
- Update
  patches.suse/genirq-irqdesc-Prevent-use-after-free-in-irq_find_at.patch
  (git-fixes CVE-2024-38385 bsc#1227085).
- Update patches.suse/gfs2-ignore-negated-quota-changes.patch
  (git-fixes CVE-2023-52759 bsc#1225560).
- Update
  patches.suse/hid-cp2112-Fix-duplicate-workqueue-initialization.patch
  (git-fixes CVE-2023-52853 bsc#1224988).
- Update
  patches.suse/hwmon-axi-fan-control-Fix-possible-NULL-pointer-dere.patch
  (git-fixes CVE-2023-52863 bsc#1225586).
- Update
  patches.suse/i2c-acpi-Unbind-mux-adapters-before-delete.patch
  (git-fixes CVE-2024-39362 bsc#1226995).
- Update
  patches.suse/i2c-core-Run-atomic-i2c-xfer-when-preemptible.patch
  (git-fixes CVE-2023-52791 bsc#1225108).
- Update
  patches.suse/i3c-master-mipi-i3c-hci-Fix-a-kernel-panic-for-acces.patch
  (git-fixes CVE-2023-52763 bsc#1225570).
- Update
  patches.suse/i3c-mipi-i3c-hci-Fix-out-of-bounds-access-in-hci_dma.patch
  (git-fixes CVE-2023-52766).
- Update
  patches.suse/i915-perf-Fix-NULL-deref-bugs-with-drm_dbg-calls.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52788
  bsc#1225106).
- Update
  patches.suse/igb-Fix-string-truncation-warnings-in-igb_set_fw_ver.patch
  (git-fixes CVE-2024-36010 bsc#1225594).
- Update
  patches.suse/iommu-vt-d-Fix-WARN_ON-in-iommu-probe-path.patch
  (git-fixes CVE-2024-35957 bsc#1224673).
- Update
  patches.suse/iommufd-Fix-missing-update-of-domains_itree-after-splitting-iopt
  (jsc#PED-7779 jsc#PED-7780 CVE-2023-52801 bsc#1225006).
- Update
  patches.suse/ipvlan-add-ipvlan_route_v6_outbound-helper.patch
  (git-fixes CVE-2023-52796 bsc#1224930).
- Update
  patches.suse/jffs2-prevent-xattr-node-from-overflowing-the-eraseblock.patch
  (git-fixes CVE-2024-38599 bsc#1226848).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-dbFindLeaf.patch
  (git-fixes CVE-2023-52799 bsc#1225472).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-diAlloc.patch
  (git-fixes CVE-2023-52805 bsc#1225553).
- Update
  patches.suse/kunit-fortify-Fix-mismatched-kvalloc-vfree-usage.patch
  (git-fixes CVE-2024-38617 bsc#1226859).
- Update
  patches.suse/lib-generic-radix-tree.c-Don-t-overflow-in-peek.patch
  (git-fixes CVE-2021-47432 bsc#1225391).
- Update
  patches.suse/lib-test_hmm.c-handle-src_pfns-and-dst_pfns-allocati.patch
  (git-fixes CVE-2024-38543 bsc#1226594).
- Update
  patches.suse/locking-ww_mutex-test-Fix-potential-workqueue-corrup.patch
  (bsc#1219953 CVE-2023-52836 bsc#1225609).
- Update
  patches.suse/md-Don-t-ignore-suspended-array-in-md_check_recovery-1baa.patch
  (bsc#1219596 CVE-2024-26758).
- Update
  patches.suse/media-atomisp-ssh_css-Fix-a-null-pointer-dereference.patch
  (git-fixes CVE-2024-38547 bsc#1226632).
- Update
  patches.suse/media-bttv-fix-use-after-free-error-due-to-btv-timeo.patch
  (git-fixes CVE-2023-52847 bsc#1225588).
- Update
  patches.suse/media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch
  (git-fixes CVE-2023-52764 bsc#1225571).
- Update
  patches.suse/media-hantro-Check-whether-reset-op-is-defined-befor.patch
  (git-fixes CVE-2023-52850 bsc#1225014).
- Update
  patches.suse/media-i2c-et8ek8-Don-t-strip-remove-function-when-dr.patch
  (git-fixes CVE-2024-38611 bsc#1226760).
- Update
  patches.suse/media-imon-fix-access-to-invalid-resource-for-the-se.patch
  (git-fixes CVE-2023-52754 bsc#1225490).
- Update
  patches.suse/media-lgdt3306a-Add-a-check-against-null-pointer-def.patch
  (stable-fixes CVE-2022-48772 bsc#1226976).
- Update
  patches.suse/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch
  (git-fixes CVE-2024-38621 bsc#1226895).
- Update
  patches.suse/media-vidtv-mux-Add-check-and-kfree-for-kstrdup.patch
  (git-fixes CVE-2023-52841 bsc#1225592).
- Update patches.suse/media-vidtv-psi-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52844 bsc#1225590).
- Update
  patches.suse/mfd-qcom-spmi-pmic-Fix-revid-implementation.patch
  (git-fixes CVE-2023-52765 bsc#1225029).
- Update
  patches.suse/misc-microchip-pci1xxxx-fix-double-free-in-the-error.patch
  (git-fixes CVE-2024-36973 bsc#1226457).
- Update
  patches.suse/net-hns3-fix-out-of-bounds-access-may-occur-when-coa.patch
  (git-fixes CVE-2023-52807 bsc#1225097).
- Update
  patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch
  (git-fixes CVE-2024-36962 bsc#1225827).
- Update
  patches.suse/net-mlx5-Fix-peer-devlink-set-for-SF-representor-dev.patch
  (git-fixes CVE-2024-38595 bsc#1226741).
- Update
  patches.suse/net-mlx5e-Track-xmit-submission-to-PTP-WQ-after-popu.patch
  (jsc#PED-3311 CVE-2023-52782 bsc#1225103).
- Update
  patches.suse/net-mvneta-fix-calls-to-page_pool_get_stats.patch
  (git-fixes CVE-2023-52780 bsc#1224933).
- Update
  patches.suse/net-wangxun-fix-kernel-panic-due-to-null-pointer.patch
  (git-fixes CVE-2023-52783 bsc#1225104).
- Update
  patches.suse/netfilter-complete-validation-of-user-input.patch
  (git-fixes CVE-2024-35896 bsc#1224662 CVE-2024-35962
  bsc#1224583).
- Update
  patches.suse/nfc-nci-Fix-uninit-value-in-nci_rx_work.patch
  (git-fixes CVE-2024-38381 bsc#1226878).
- Update
  patches.suse/nilfs2-fix-nilfs_empty_dir-misjudgment-and-long-loop.patch
  (git-fixes CVE-2024-39469 bsc#1226992).
- Update
  patches.suse/nilfs2-fix-potential-hang-in-nilfs_detach_log_writer.patch
  (git-fixes CVE-2024-38582 bsc#1226658).
- Update
  patches.suse/nilfs2-fix-use-after-free-of-timer-for-log-writer-th.patch
  (git-fixes CVE-2024-38583 bsc#1226777).
- Update
  patches.suse/of-module-add-buffer-overflow-check-in-of_modalias.patch
  (git-fixes CVE-2024-38541 bsc#1226587).
- Update
  patches.suse/padata-Fix-refcnt-handling-in-padata_free_shell.patch
  (git-fixes CVE-2023-52854 bsc#1225584).
- Update
  patches.suse/perf-core-Bail-out-early-if-the-request-AUX-area-is-out-of-bound.patch
  (git-fixes CVE-2023-52835 bsc#1225602).
- Update
  patches.suse/platform-x86-wmi-Fix-opening-of-char-device.patch
  (git-fixes CVE-2023-52864 bsc#1225132).
- Update
  patches.suse/powerpc-pseries-iommu-LPAR-panics-during-boot-up-wit.patch
  (bsc#1222011 ltc#205900 CVE-2024-36926 bsc#1225829).
- Update patches.suse/pstore-platform-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52869 bsc#1225050).
- Update
  patches.suse/remoteproc-mediatek-Make-sure-IPI-buffer-fits-in-L2T.patch
  (git-fixes CVE-2024-36965 bsc#1226149).
- Update
  patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch
  (git-fixes CVE-2024-38601 bsc#1226876).
- Update
  patches.suse/s390-dasd-protect-device-queue-against-concurrent-access.patch
  (git-fixes bsc#1217481 CVE-2023-52774 bsc#1225572).
- Update
  patches.suse/scsi-hisi_sas-Set-debugfs_dir-pointer-to-NULL-after-removing-debugfs.patch
  (git-fixes CVE-2023-52808 bsc#1225555).
- Update
  patches.suse/scsi-ibmvfc-Remove-BUG_ON-in-the-case-of-an-empty-ev.patch
  (bsc#1209834 ltc#202097 CVE-2023-52811 bsc#1225559).
- Update
  patches.suse/scsi-libfc-Fix-potential-NULL-pointer-dereference-in-fc_lport_ptp_setup.patch
  (git-fixes CVE-2023-52809 bsc#1225556).
- Update
  patches.suse/scsi-lpfc-Move-NPIV-s-transport-unregistration-to-af.patch
  (bsc#1221777 CVE-2024-36952 bsc#1225898).
- Update
  patches.suse/scsi-lpfc-Release-hbalock-before-calling-lpfc_worker.patch
  (bsc#1221777 CVE-2024-36924 bsc#1225820).
- Update
  patches.suse/serial-max3100-Lock-port-lock-when-calling-uart_hand.patch
  (git-fixes CVE-2024-38634 bsc#1226868).
- Update
  patches.suse/serial-max3100-Update-uart_driver_registered-on-driv.patch
  (git-fixes CVE-2024-38633 bsc#1226867).
- Update
  patches.suse/soc-qcom-llcc-Handle-a-second-device-without-data-co.patch
  (git-fixes CVE-2023-52871 bsc#1225534).
- Update
  patches.suse/soundwire-cadence-fix-invalid-PDI-offset.patch
  (stable-fixes CVE-2024-38635 bsc#1226863).
- Update patches.suse/speakup-Fix-sizeof-vs-ARRAY_SIZE-bug.patch
  (git-fixes CVE-2024-38587 bsc#1226780).
- Update patches.suse/spi-Fix-null-dereference-on-suspend.patch
  (git-fixes CVE-2023-52749 bsc#1225476).
- Update
  patches.suse/thermal-core-prevent-potential-string-overflow.patch
  (git-fixes CVE-2023-52868 bsc#1225044).
- Update
  patches.suse/thermal-drivers-qcom-lmh-Check-for-SCM-availability-.patch
  (git-fixes CVE-2024-39466 bsc#1227089).
- Update
  patches.suse/thermal-drivers-tsens-Fix-null-pointer-dereference.patch
  (git-fixes CVE-2024-38571 bsc#1226737).
- Update
  patches.suse/thermal-intel-powerclamp-fix-mismatch-in-get-functio.patch
  (git-fixes CVE-2023-52794 bsc#1225028).
- Update
  patches.suse/tls-fix-NULL-deref-on-tls_sw_splice_eof-with-empty-r.patch
  (jsc#PED-6831 CVE-2023-52767 bsc#1224998).
- Update
  patches.suse/tpm_tis_spi-Account-for-SPI-header-when-allocating-T.patch
  (git-fixes CVE-2024-36477 bsc#1226840).
- Update
  patches.suse/tracing-Have-trace_event_file-have-ref-counters.patch
  (git-fixes CVE-2023-52879 bsc#1225101).
- Update
  patches.suse/tracing-trigger-Fix-to-return-error-if-failed-to-alloc-snapshot.patch
  (git-fixes CVE-2024-26920).
- Update
  patches.suse/tty-n_gsm-fix-race-condition-in-status-line-change-o.patch
  (git-fixes CVE-2023-52872 bsc#1225591).
- Update
  patches.suse/tty-n_gsm-require-CAP_NET_ADMIN-to-attach-N_GSM0710-.patch
  (bsc#1222619 CVE-2023-52880).
- Update
  patches.suse/tty-vcc-Add-check-for-kstrdup-in-vcc_probe.patch
  (git-fixes CVE-2023-52789 bsc#1225180).
- Update
  patches.suse/usb-config-fix-iteration-issue-in-usb_get_bos_descri.patch
  (git-fixes CVE-2023-52781 bsc#1225092).
- Update
  patches.suse/usb-dwc3-Wait-unconditionally-after-issuing-EndXfer-.patch
  (git-fixes CVE-2024-36977 bsc#1226513).
- Update
  patches.suse/usb-gadget-u_audio-Fix-race-condition-use-of-control.patch
  (git-fixes CVE-2024-38628 bsc#1226911).
- Update
  patches.suse/usb-storage-alauda-Check-whether-the-media-is-initia.patch
  (git-fixes CVE-2024-38619 bsc#1226861).
- Update
  patches.suse/usb-typec-tcpm-Fix-NULL-pointer-dereference-in-tcpm_.patch
  (git-fixes CVE-2023-52877 bsc#1224944).
- Update
  patches.suse/vhost-vdpa-fix-use-after-free-in-vhost_vdpa_probe.patch
  (jsc#PED-3311 CVE-2023-52795 bsc#1225085).
- Update
  patches.suse/virtio-blk-fix-implicit-overflow-on-virtio_max_dma_s.patch
  (git-fixes CVE-2023-52762 bsc#1225573).
- Update
  patches.suse/virtio-vsock-Fix-uninit-value-in-virtio_transport_re.patch
  (jsc#PED-5505 CVE-2023-52842 bsc#1225025).
- Update
  patches.suse/watchdog-cpu5wdt.c-Fix-use-after-free-bug-caused-by-.patch
  (git-fixes CVE-2024-38630 bsc#1226908).
- Update
  patches.suse/wifi-ar5523-enable-proper-endpoint-verification.patch
  (git-fixes CVE-2024-38565 bsc#1226747).
- Update
  patches.suse/wifi-ath11k-fix-dfs-radar-event-locking.patch
  (git-fixes CVE-2023-52798 bsc#1224947).
- Update
  patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch
  (git-fixes CVE-2023-52777 bsc#1224992).
- Update patches.suse/wifi-ath11k-fix-htt-pktlog-locking.patch
  (git-fixes CVE-2023-52800).
- Update
  patches.suse/wifi-ath12k-fix-dfs-radar-and-temperature-event-lock.patch
  (git-fixes CVE-2023-52776 bsc#1225090).
- Update
  patches.suse/wifi-ath12k-fix-htt-mlo-offset-event-locking.patch
  (git-fixes CVE-2023-52769 bsc#1225001).
- Update
  patches.suse/wifi-ath12k-fix-out-of-bound-access-of-qmi_invoke_ha.patch
  (git-fixes CVE-2024-38572 bsc#1226776).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-read-in-ath12k.patch
  (git-fixes CVE-2023-52827 bsc#1225078).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-write-in-ath12.patch
  (git-fixes CVE-2023-52829 bsc#1225081).
- Update
  patches.suse/wifi-brcmfmac-pcie-handle-randbuf-allocation-failure.patch
  (git-fixes CVE-2024-38575 bsc#1226612).
- Update
  patches.suse/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch
  (git-fixes CVE-2024-38567 bsc#1226769).
- Update
  patches.suse/wifi-carl9170-re-fix-fortified-memset-warning.patch
  (git-fixes CVE-2024-38616 bsc#1226852).
- Update
  patches.suse/wifi-mac80211-don-t-return-unset-power-in-ieee80211_.patch
  (git-fixes CVE-2023-52832 bsc#1225577).
- Update
  patches.suse/wifi-nl80211-Avoid-address-calculations-via-out-of-b.patch
  (git-fixes CVE-2024-38562 bsc#1226788).
- Update
  patches.suse/wifi-wilc1000-use-vmm_table-as-array-in-wilc-struct.patch
  (git-fixes CVE-2023-52768 bsc#1225004).
- Update
  patches.suse/x86-tdx-Zero-out-the-missing-RSI-in-TDX_HYPERCALL-macro.patch
  (jsc#PED-5824 CVE-2023-52874 bsc#1225049).
- commit 33efdc4</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835204">- tcp: Use refcount_inc_not_zero() in tcp_twsk_unique()
  (CVE-2024-36904 bsc#1225732).
- commit d578dcc</changelog>
  <changelog author="heming.zhao@suse.com" date="1719921600">- gfs2: Fix potential glock use-after-free on unmount (bsc#1226775
  CVE-2024-38570).
- gfs2: Rename sd_{ glock =&gt; kill }_wait (bsc#1226775
  CVE-2024-38570).
- commit f3adbca</changelog>
  <changelog author="tiwai@suse.de" date="1719921601">- Correct SCSI patch references (bsc#1225767 CVE-2024-36919 bsc#1226785 CVE-2024-38559)
- commit e8ea587</changelog>
  <changelog author="tiwai@suse.de" date="1719921602">- mtd: rawnand: rockchip: ensure NVDDR timings are rejected
  (git-fixes).
- mtd: rawnand: Bypass a couple of sanity checks during NAND
  identification (git-fixes).
- mtd: rawnand: Fix the nand_read_data_op() early check
  (git-fixes).
- mtd: rawnand: Ensure ECC configuration is propagated to upper
  layers (git-fixes).
- commit e545951</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1719921603">- kernel-doc: fix struct_group_tagged() parsing (git-fixes).
- commit e3a2a2e</changelog>
  <changelog author="fdmanana@suse.com" date="1719921604">- btrfs: fix crash on racing fsync and size-extending write into
  prealloc (bsc#1227101 CVE-2024-37354).
- commit 1d355af</changelog>
  <changelog author="vbabka@suse.cz" date="1719921605">- virt: acrn: stop using follow_pfn (CVE-2024-38610 bsc#1226758).
- commit c2ea51b</changelog>
  <changelog author="vbabka@suse.cz" date="1719921606">- drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
  (CVE-2024-38610 bsc#1226758).
- commit 7069ac2</changelog>
  <changelog author="rhopkins@suse.de" date="1719921607">- hsr: Prevent use after free in prp_create_tagged_frame()
  (CVE-2023-52846 bsc#1225098).
- commit cf63988</changelog>
  <changelog author="krisman@suse.de" date="1719921608">- io_uring: Fix io_cqring_wait() not restoring sigmask on
  get_timespec64() failure (git-fixes).
- commit e640a65</changelog>
  <changelog author="krisman@suse.de" date="1719921609">- io_uring: check for non-NULL file pointer in io_file_can_poll()
  (bsc#1226990 CVE-2024-39371).
- io_uring/io-wq: Use set_bit() and test_bit() at worker-&gt;flags
  (git-fixes).
- io_uring/sqpoll: work around a potential audit memory leak
  (git-fixes).
- commit 24603fc</changelog>
  <changelog author="krisman@suse.de" date="1719921610">- io_uring/rsrc: fix incorrect assignment of iter-&gt;nr_segs in
  io_import_fixed (git-fixes).
- io_uring/rsrc: don't lock while !TASK_RUNNING (git-fixes).
- io_uring/io-wq: avoid garbage value of 'match' in
  io_wq_enqueue() (git-fixes).
- commit 7d3e252</changelog>
</package>
<package pkgid="ca2694a63d0a27ee6010ee4037603b1617d0cfcc3961d2c1723ec2017c03861d" name="dtb-mediatek" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.17.1"/>
  <changelog author="tiwai@suse.de" date="1722081600">- auxdisplay: ht16k33: Drop reference after LED registration
  (git-fixes).
- ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
  on unprepare (git-fixes).
- ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
- ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
  reachable (git-fixes).
- ASoC: sof: amd: fix for firmware reload failure in Vangogh
  platform (git-fixes).
- ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
- ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
  (git-fixes).
- ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
- ALSA: ump: Don't update FB name for static blocks (git-fixes).
- drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
- drm/i915/gt: Do not consider preemption during execlists_dequeue
  for gen8 (git-fixes).
- drm/i915/dp: Don't switch the LTTPR mode on an active link
  (git-fixes).
- commit d7e2deb</changelog>
  <changelog author="tiwai@suse.de" date="1722081601">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
</package>
<package pkgid="307ef99f8a212d9a66becb3f81194d56db398051d25207d2cdd332e2ab76c2c2" name="dtb-mediatek" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.7.1"/>
  <changelog author="mkubecek@suse.cz" date="1717416000">- netfilter: nf_tables: release mutex after nft_gc_seq_end from
  abort path (CVE-2024-26925 bsc#1223390).
- commit 578a709</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717416001">- Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
  The L3 bsc#1225765 was created seperately since our customer requires
  PTF.
- Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
- Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
- Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
- Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
- commit 054635e</changelog>
  <changelog author="msuchanek@suse.de" date="1717416002">- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
- powerpc/uaccess: Fix build errors seen with GCC 13/14
  (bsc#1194869).
- commit 46b5d84</changelog>
  <changelog author="msuchanek@suse.de" date="1717416003">- blacklist.conf: PPC fsl_msi is not used
- commit ae6590d</changelog>
  <changelog author="msuchanek@suse.de" date="1717416004">- powerpc/pseries/lparcfg: drop error message from guest name
  lookup (bsc#1187716 ltc#193451 git-fixes).
- commit ceab637</changelog>
  <changelog author="mfranc@suse.cz" date="1717416005">- Update
  patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
  (git-fixes CVE-2024-36955).
- Update
  patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
  (git-fixes bsc#1225715 CVE-2024-36906).
- Update
  patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
  (git-fixes bsc#1225579 CVE-2024-36011).
- Update
  patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
  (git-fixes bsc#1225578 CVE-2024-36013).
- Update
  patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
  (git-fixes bsc#1225502 CVE-2024-36012).
- Update
  patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
  (git-fixes bsc#1225722 CVE-2024-36880).
- Update
  patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
  (git-fixes CVE-2024-36942).
- Update
  patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
  (git-fixes bsc#1225720 CVE-2024-36032).
- Update
  patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
  (git-fixes bsc#1223749 CVE-2024-26990).
- Update
  patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
  (git-fixes bsc#1223692 CVE-2024-26992).
- Update
  patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
  (stable-fixes CVE-2024-36944).
- Update
  patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
  (git-fixes bsc#1225734 CVE-2024-36896).
- Update
  patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
  (stable-fixes CVE-2024-36949).
- Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
  (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
- Update
  patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
  (git-fixes bsc#1225692 CVE-2023-52882).
- Update
  patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
  (git-fixes CVE-2024-26761).
- Update
  patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
  (stable-fixes bsc#1225735 CVE-2024-36897).
- Update
  patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
  (stable-fixes bsc#1225705 CVE-2024-36026).
- Update
  patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
  (stable-fixes CVE-2024-36951).
- Update
  patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
  (git-fixes bsc#1225593 CVE-2024-36014).
- Update
  patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
  (stable-fixes bsc#1225728 CVE-2024-36885).
- Update
  patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
  (git-fixes bsc#1225773 CVE-2024-36936).
- Update
  patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
  (stable-fixes CVE-2024-36950).
- Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
  (git-fixes bsc#1225736 CVE-2024-36898).
- Update
  patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
  (git-fixes bsc#1225698 CVE-2024-36020).
- Update
  patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
  (git-fixes bsc#1225710 CVE-2024-36891).
- Update
  patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
  (git-fixes bsc#1225714 CVE-2024-36890).
- Update
  patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
  (git-fixes bsc#1225708 CVE-2024-36029).
- Update
  patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
  (git-fixes bsc#1225699 CVE-2024-36021).
- Update
  patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
  (git-fixes CVE-2024-26943).
- Update
  patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
  (git-fixes bsc#1225694 CVE-2024-36018).
- Update
  patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
  (git-fixes CVE-2024-36940).
- Update
  patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
  (git-fixes CVE-2024-36959).
- Update
  patches.suse/ppdev-Add-an-error-check-in-register_device.patch
  (git-fixes bsc#1225640 CVE-2024-36015).
- Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
  CVE-2024-36947).
- Update
  patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
  (git-fixes bsc#1225695 CVE-2024-36019).
- Update
  patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
  (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
- Update
  patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
  (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
- Update
  patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
  (git-fixes bsc#1225704 CVE-2024-36025).
- Update
  patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
  (git-fixes CVE-2024-36930).
- Update
  patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
  (bsc#1224331 bsc#1224602 CVE-2024-35814).
- Update
  patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
  (git-fixes bsc#1225642 CVE-2024-36016).
- Update
  patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
  (git-fixes bsc#1225749 CVE-2024-36894).
- Update
  patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
  (git-fixes bsc#1225750 CVE-2024-36895).
- Update
  patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
  (git-fixes bsc#1225748 CVE-2024-36893).
- Update
  patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
  (stable-fixes bsc#1225769 CVE-2024-36921).
- Update
  patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
  (stable-fixes CVE-2024-36922).
- Update
  patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
  (git-fixes CVE-2024-36941).
- Update
  patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
  (git-fixes bsc#1224742 CVE-2024-35803).
- commit 539780f</changelog>
  <changelog author="dwagner@suse.de" date="1717416006">- nvmet: fix ns enable/disable possible hang (git-fixes).
- nvme-multipath: fix io accounting on failover (git-fixes).
- nvme: fix multipath batched completion accounting (git-fixes).
- commit ed3b392</changelog>
  <changelog author="dwagner@suse.de" date="1717416007">- scsi: lpfc: Copyright updates for 14.4.0.2 patches
  (bsc#1225842).
- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
  (bsc#1225842).
  Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
  (bsc#1225842).
- scsi: lpfc: Clear deferred RSCN processing flag when driver
  is unloading (bsc#1225842).
- scsi: lpfc: Update logging of protection type for T10 DIF I/O
  (bsc#1225842).
- scsi: lpfc: Change default logging level for unsolicited CT
  MIB commands (bsc#1225842).
- commit 5a56384</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416008">- smb: client: fix mount when dns_resolver key is not available
  (git-fixes, bsc#1225172).
- commit 28edb5c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416009">- cifs: fix leak of iface for primary channel (git-fixes,
  bsc#1225172).
- commit b7eb8e8</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416010">- Revert "cifs: reconnect work should have reference on server
  struct" (git-fixes, bsc#1225172).
- commit 3ca4c0c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416011">- smb: client: fix parsing of SMB3.1.1 POSIX create context
  (git-fixes, bsc#1225172).
- commit 5f27f69</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416012">- cifs: failure to add channel on iface should bump up weight
  (git-fixes, bsc#1225172).
- commit 007b237</changelog>
  <changelog author="tonyj@suse.de" date="1717416013">- perf/x86: Fix out of range data (git-fixes).
- perf/x86/intel/ds: Don't clear -&gt;pebs_data_cfg for the last
  PEBS event (git-fixes).
- perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
- commit 664d77f</changelog>
  <changelog author="dsterba@suse.com" date="1717588800">- blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
- Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
  Quoting bsc#1225945#c11:
  "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
  transaction for every subvol create")
  ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
  unwritten extent buffer after snapshotting a new subvolume") was never
  backported."
- commit d947258</changelog>
  <changelog author="tonyj@suse.de" date="1717588801">- perf pmu: Count sys and cpuid JSON events separately (git
  fixes).
- perf stat: Don't display metric header for non-leader uncore
  events (git-fixes).
- perf daemon: Fix file leak in daemon_session__control
  (git-fixes).
- perf symbols: Fix ownership of string in dso__load_vmlinux()
  (git-fixes).
- perf thread: Fixes to thread__new() related to initializing comm
  (git-fixes).
- perf report: Avoid SEGV in report__setup_sample_type()
  (git-fixes).
- perf ui browser: Don't save pointer to stack memory (git-fixes).
- perf bench internals inject-build-id: Fix trap divide when
  collecting just one DSO (git-fixes).
- perf intel-pt: Fix unassigned instruction op (discovered by
  MemorySanitizer) (git-fixes).
- perf test shell arm_coresight: Increase buffer size for
  Coresight basic tests (git-fixes).
- perf docs: Document bpf event modifier (git-fixes).
- perf bench uprobe: Remove lib64 from libc.so.6 binary path
  (git-fixes).
- perf record: Fix debug message placement for test consumption
  (git-fixes).
- perf tests: Apply attributes to all events in object code
  reading test (git-fixes).
- perf tests: Make "test data symbol" more robust on Neoverse N1
  (git-fixes).
- perf annotate: Fix annotation_calc_lines() to pass correct
  address to get_srcline() (git-fixes).
- perf stat: Do not fail on metrics on s390 z/VM systems
  (git-fixes).
- perf sched timehist: Fix -g/--call-graph option failure
  (git-fixes).
- perf annotate: Get rid of duplicate --group option item
  (git-fixes).
- perf probe: Add missing libgen.h header needed for using
  basename() (git-fixes).
- perf record: Delete session after stopping sideband thread
  (git-fixes).
- perf auxtrace: Fix multiple use of --itrace option (git-fixes).
- perf script: Show also errors for --insn-trace option
  (git-fixes).
- perf lock contention: Add a missing NULL check (git-fixes).
- perf vendor events amd: Fix Zen 4 cache latency events
  (git-fixes).
- libperf evlist: Avoid out-of-bounds access (git-fixes).
- perf pmu: Fix a potential memory leak in perf_pmu__lookup()
  (git-fixes).
- perf print-events: make is_event_supported() more robust
  (git-fixes).
- perf list: fix short description for some cache events
  (git-fixes).
- perf metric: Don't remove scale from counts (git-fixes).
- perf stat: Avoid metric-only segv (git-fixes).
- perf expr: Fix "has_event" function for metric style events
  (git-fixes).
- perf srcline: Add missed addr2line closes (git-fixes).
- perf thread_map: Free strlist on normal path in
  thread_map__new_by_tid_str() (git-fixes).
- perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
- perf jevents: Drop or simplify small integer values (git-fixes).
- perf evsel: Fix duplicate initialization of data-&gt;id in
  evsel__parse_sample() (git-fixes).
- perf pmu: Treat the msr pmu as software (git-fixes).
- perf record: Check conflict between '--timestamp-filename'
  option and pipe mode before recording (git-fixes).
- perf record: Fix possible incorrect free in
  record__switch_output() (git-fixes).
- perf vendor events amd: Add Zen 4 memory controller events
  (git-fixes).
- perf top: Uniform the event name for the hybrid machine
  (git-fixes).
- perf top: Use evsel's cpus to replace user_requested_cpus
  (git-fixes).
- commit a1f9340</changelog>
  <changelog author="tonyj@suse.de" date="1717675200">- perf ui browser: Avoid SEGV on title (git fixes).
- commit 1578c22</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675201">- inet: inet_defrag: prevent sk release while still in use
  (CVE-2024-26921 bsc#1223138).
- commit 2016faf</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675202">- net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
- commit 7bf5961</changelog>
  <changelog author="tiwai@suse.de" date="1718366400">- Temporarily drop KVM patch that caused a regression (bsc#1226158)
  Delete patches.suse/KVM-x86-pmu-Prioritize-VMX-interception-over-GP-on-R.patch
- commit 33f31da</changelog>
</package>
<package pkgid="d2223836ae8a769ed3fa80564dfae2cebc8df388c8df1ff00f1e6f9e683fb7fa" name="dtb-nvidia" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.14.1"/>
  <changelog author="tiwai@suse.de" date="1719662400">- gpiolib: cdev: Disallow reconfiguration without direction
  (uAPI v1) (git-fixes).
- gpio: davinci: Validate the obtained number of IRQs (git-fixes).
- commit 919ebd1</changelog>
  <changelog author="tiwai@suse.de" date="1719748800">- i2c: testunit: discard write requests while old command is
  running (git-fixes).
- i2c: testunit: don't erase registers after STOP (git-fixes).
- mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
  (git-fixes).
- mmc: sdhci: Do not invert write-protect twice (git-fixes).
- mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
  (git-fixes).
- mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
  (git-fixes).
- commit 448487d</changelog>
  <changelog author="tiwai@suse.de" date="1719748801">- crypto: iaa - Account for cpu-less numa nodes (bsc#1227190).
- commit cd600aa</changelog>
  <changelog author="tiwai@suse.de" date="1719748802">- crypto: deflate - Add aliases to deflate (bsc#1227190).
- commit 27ffd92</changelog>
  <changelog author="tiwai@suse.de" date="1719835200">- ata: ahci: Clean up sysfs file on error (git-fixes).
- ata: libata-core: Fix double free on error (git-fixes).
- ata,scsi: libata-core: Do not leak memory for ata_port struct
  members (git-fixes).
- ata: libata-core: Fix null pointer dereference on error
  (git-fixes).
- kbuild: Fix build target deb-pkg: ln: failed to create hard link
  (git-fixes).
- kbuild: doc: Update default INSTALL_MOD_DIR from extra to
  updates (git-fixes).
- kbuild: Install dtb files as 0644 in Makefile.dtbinst
  (git-fixes).
- counter: ti-eqep: enable clock at probe (git-fixes).
- iio: chemical: bme680: Fix sensor data read operation
  (git-fixes).
- iio: chemical: bme680: Fix overflows in compensate() functions
  (git-fixes).
- iio: chemical: bme680: Fix calibration data variable
  (git-fixes).
- iio: chemical: bme680: Fix pressure value output (git-fixes).
- iio: accel: fxls8962af: select IIO_BUFFER &amp; IIO_KFIFO_BUF
  (git-fixes).
- iio: adc: ad7266: Fix variable checking bug (git-fixes).
- iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
  (git-fixes).
- serial: bcm63xx-uart: fix tx after conversion to
  uart_port_tx_limited() (git-fixes).
- serial: core: introduce uart_port_tx_limited_flags()
  (git-fixes).
- Revert "serial: core: only stop transmit when HW fifo is empty"
  (git-fixes).
- tty: mcf: MCF54418 has 10 UARTS (git-fixes).
- usb: gadget: aspeed_udc: fix device address configuration
  (git-fixes).
- usb: dwc3: core: remove lock of otg mode during gadget
  suspend/resume to avoid deadlock (git-fixes).
- usb: typec: ucsi: glink: fix child node release in probe
  function (git-fixes).
- usb: musb: da8xx: fix a resource leak in probe() (git-fixes).
- usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  (git-fixes).
- usb: gadget: printer: fix races against disable (git-fixes).
- PCI/MSI: Fix UAF in msi_capability_init (git-fixes).
- commit a2ea5a9</changelog>
  <changelog author="ptesarik@suse.com" date="1719835201">- net: ena: Fix redundant device NUMA node override
  (jsc#PED-8688).
- commit 6ad6684</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835202">- tcp: do not accept ACK of bytes we never sent (CVE-2023-52881
  bsc#1225611).
- commit 16404a6</changelog>
  <changelog author="mhocko@suse.com" date="1719835203">- Update
  patches.suse/1352-drm-amdgpu-Fix-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52883
  bsc#1226630).
- Update
  patches.suse/9p-add-missing-locking-around-taking-dentry-fid-list.patch
  (git-fixes CVE-2024-39463 bsc#1227090).
- Update
  patches.suse/ALSA-Fix-deadlocks-with-kctl-removals-at-disconnecti.patch
  (stable-fixes CVE-2024-38600 bsc#1226864).
- Update
  patches.suse/ALSA-core-Fix-NULL-module-pointer-assignment-at-card.patch
  (git-fixes CVE-2024-38605 bsc#1226740).
- Update
  patches.suse/ALSA-hda-Fix-possible-null-ptr-deref-when-assigning-.patch
  (git-fixes CVE-2023-52806 bsc#1225554).
- Update
  patches.suse/ALSA-hda-cs_dsp_ctl-Use-private_free-for-control-cle.patch
  (git-fixes CVE-2024-38388 bsc#1226890).
- Update
  patches.suse/ALSA-timer-Set-lower-bound-of-start-tick-time.patch
  (stable-fixes git-fixes CVE-2024-38618 bsc#1226754).
- Update
  patches.suse/ASoC-kirkwood-Fix-potential-NULL-dereference.patch
  (git-fixes CVE-2024-38550 bsc#1226633).
- Update
  patches.suse/ASoC-mediatek-Assign-dummy-when-codec-not-specified-.patch
  (git-fixes CVE-2024-38551 bsc#1226761).
- Update
  patches.suse/Bluetooth-btusb-Add-date-evt_skb-is-NULL-check.patch
  (git-fixes CVE-2023-52833 bsc#1225595).
- Update
  patches.suse/Bluetooth-hci_core-Fix-possible-buffer-overflow.patch
  (git-fixes CVE-2024-26889).
- Update
  patches.suse/HID-uclogic-Fix-user-memory-access-bug-in-uclogic_pa.patch
  (git-fixes CVE-2023-52866 bsc#1225120).
- Update
  patches.suse/IB-mlx5-Fix-init-stage-error-handling-to-avoid-doubl.patch
  (jsc#PED-6864 CVE-2023-52851 bsc#1225587).
- Update
  patches.suse/Input-cyapa-add-missing-input-core-locking-to-suspen.patch
  (git-fixes CVE-2023-52884 bsc#1226764).
- Update
  patches.suse/Input-synaptics-rmi4-fix-use-after-free-in-rmi_unreg.patch
  (git-fixes CVE-2023-52840 bsc#1224928).
- Update
  patches.suse/KEYS-trusted-Do-not-use-WARN-when-encode-fails.patch
  (git-fixes CVE-2024-36975 bsc#1226520).
- Update
  patches.suse/KEYS-trusted-Fix-memory-leak-in-tpm2_key_encode.patch
  (git-fixes CVE-2024-36967 bsc#1226131).
- Update
  patches.suse/RDMA-cma-Fix-kmemleak-in-rdma_core-observed-during-b.patch
  (git-fixes CVE-2024-38539 bsc#1226608).
- Update patches.suse/RDMA-hns-Fix-UAF-for-cq-async-event.patch
  (git-fixes CVE-2024-38545 bsc#1226595).
- Update
  patches.suse/RDMA-hns-Fix-deadlock-on-SRQ-async-events.patch
  (git-fixes CVE-2024-38591 bsc#1226738).
- Update
  patches.suse/RDMA-hns-Modify-the-print-level-of-CQE-error.patch
  (git-fixes CVE-2024-38590 bsc#1226839).
- Update
  patches.suse/RDMA-rxe-Fix-seg-fault-in-rxe_comp_queue_pkt.patch
  (git-fixes CVE-2024-38544 bsc#1226597).
- Update
  patches.suse/SUNRPC-Fix-RPC-client-cleaned-up-the-freed-pipefs-de.patch
  (git-fixes CVE-2023-52803 bsc#1225008).
- Update patches.suse/af_unix-Clear-stale-u-oob_skb.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-35970 bsc#1224584).
- Update
  patches.suse/af_unix-Drop-oob_skb-ref-before-purging-queue-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26750 bsc#1222617).
- Update
  patches.suse/af_unix-Fix-task-hung-while-purging-oob_skb-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26780 bsc#1222588).
- Update
  patches.suse/af_unix-Update-unix_sk-sk-oob_skb-under-sk_receive_queue-lock.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-36972 bsc#1226163).
- Update
  patches.suse/arm64-Restrict-CPU_BIG_ENDIAN-to-GNU-as-or-LLVM-IAS-.patch
  (git-fixes CVE-2023-52750 bsc#1225485).
- Update
  patches.suse/atl1c-Work-around-the-DMA-RX-overflow-issue.patch
  (git-fixes CVE-2023-52834 bsc#1225599).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issue-of-net_device.patch
  (git-fixes CVE-2024-38554 bsc#1226742).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issues-of-ax25_dev.patch
  (git-fixes CVE-2024-38602 bsc#1226613).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-reorder-of-WRITE-lqueued.patch
  (bsc#1225605 CVE-2024-38384 bsc#1226938).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-resetting-io-stat.patch
  (bsc#1225605 CVE-2024-38663 bsc#1226939).
- Update
  patches.suse/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch
  (git-fixes CVE-2024-38540 bsc#1226582).
- Update
  patches.suse/bonding-stop-the-device-in-bond_setup_by_slave.patch
  (git-fixes CVE-2023-52784 bsc#1224946).
- Update
  patches.suse/can-dev-can_put_echo_skb-don-t-crash-kernel-if-can_p.patch
  (git-fixes CVE-2023-52878 bsc#1225000).
- Update
  patches.suse/clk-mediatek-clk-mt2701-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52875 bsc#1225096).
- Update
  patches.suse/clk-mediatek-clk-mt6765-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52870 bsc#1224937).
- Update
  patches.suse/clk-mediatek-clk-mt6779-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52873 bsc#1225589).
- Update
  patches.suse/clk-mediatek-clk-mt6797-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52865 bsc#1225086).
- Update
  patches.suse/clk-mediatek-clk-mt7629-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52858 bsc#1225566).
- Update
  patches.suse/clk-mediatek-clk-mt7629-eth-Add-check-for-mtk_alloc_.patch
  (git-fixes CVE-2023-52876 bsc#1225036).
- Update
  patches.suse/cppc_cpufreq-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38573 bsc#1226739).
- Update patches.suse/cpufreq-exit-callback-is-optional.patch
  (git-fixes CVE-2024-38615 bsc#1226592).
- Update patches.suse/crypto-bcm-Fix-pointer-arithmetic.patch
  (git-fixes CVE-2024-38579 bsc#1226637).
- Update
  patches.suse/crypto-pcrypt-Fix-hungtask-for-PADATA_RESET.patch
  (git-fixes CVE-2023-52813 bsc#1225527).
- Update patches.suse/cxl-mem-Fix-shutdown-order.patch (git-fixes
  CVE-2023-52849 bsc#1224949).
- Update
  patches.suse/cxl-region-Do-not-try-to-cleanup-after-cxl_region_se.patch
  (git-fixes CVE-2023-52792 bsc#1225477).
- Update patches.suse/cxl-region-Fix-cxlr_pmem-leaks.patch
  (git-fixes CVE-2024-38391 bsc#1226894).
- Update
  patches.suse/dma-buf-sw-sync-don-t-enable-IRQ-from-sync_print_obj.patch
  (git-fixes CVE-2024-38780 bsc#1226886).
- Update
  patches.suse/dma-mapping-benchmark-fix-node-id-validation.patch
  (git-fixes CVE-2024-34777 bsc#1226796).
- Update
  patches.suse/dma-mapping-benchmark-handle-NUMA_NO_NODE-correctly.patch
  (git-fixes CVE-2024-39277 bsc#1226909).
- Update
  patches.suse/dmaengine-idxd-Avoid-unnecessary-destruction-of-file.patch
  (git-fixes CVE-2024-38629 bsc#1226905).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Pola.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52819
  bsc#1225532).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-SMU7.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52818
  bsc#1225530).
- Update
  patches.suse/drm-amd-check-num-of-link-levels-when-update-pcie-pa.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52812
  bsc#1225564).
- Update
  patches.suse/drm-amd-display-Avoid-NULL-dereference-of-timing-gen.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52753
  bsc#1225478).
- Update
  patches.suse/drm-amd-display-Fix-division-by-zero-in-setup_dsc_co.patch
  (stable-fixes CVE-2024-36969 bsc#1226155).
- Update
  patches.suse/drm-amd-display-Fix-null-pointer-dereference-in-erro.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52862
  bsc#1225015).
- Update
  patches.suse/drm-amd-display-Fix-potential-index-out-of-bounds-in.patch
  (git-fixes CVE-2024-38552 bsc#1226767).
- Update
  patches.suse/drm-amd-display-fix-a-NULL-pointer-dereference-in-am.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52773
  bsc#1225041).
- Update
  patches.suse/drm-amd-display-fixed-integer-types-and-null-check-l.patch
  (git-fixes CVE-2024-26767).
- Update
  patches.suse/drm-amdgpu-Fix-a-null-pointer-access-when-the-smc_rr.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52817
  bsc#1225569).
- Update
  patches.suse/drm-amdgpu-Fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch
  (git-fixes CVE-2024-39291 bsc#1226934).
- Update
  patches.suse/drm-amdgpu-Fix-potential-null-pointer-derefernce.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52814
  bsc#1225565).
- Update
  patches.suse/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch
  (stable-fixes CVE-2024-39471 bsc#1227096).
- Update
  patches.suse/drm-amdgpu-mes-fix-use-after-free-issue.patch
  (stable-fixes CVE-2024-38581 bsc#1226657).
- Update
  patches.suse/drm-amdgpu-vkms-fix-a-possible-null-pointer-derefere.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52815
  bsc#1225568).
- Update
  patches.suse/drm-amdkfd-Fix-a-race-condition-of-vram-buffer-unref.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52825
  bsc#1225076).
- Update
  patches.suse/drm-amdkfd-Fix-shift-out-of-bounds-issue.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52816
  bsc#1225529).
- Update
  patches.suse/drm-bridge-cdns-mhdp8546-Fix-possible-null-pointer-d.patch
  (git-fixes CVE-2024-38548).
- Update
  patches.suse/drm-bridge-it66121-Fix-invalid-connector-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52861
  bsc#1224941).
- Update
  patches.suse/drm-bridge-lt8912b-Fix-crash-on-bridge-detach.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52856
  bsc#1224932).
- Update
  patches.suse/drm-mediatek-Add-0-size-check-to-mtk_drm_gem_obj.patch
  (git-fixes CVE-2024-38549 bsc#1226735).
- Update
  patches.suse/drm-mediatek-Fix-coverity-issue-with-unintentional-i.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52857
  bsc#1225581).
- Update
  patches.suse/drm-mediatek-Init-ddp_comp-with-devm_kcalloc.patch
  (git-fixes CVE-2024-38592 bsc#1226844).
- Update
  patches.suse/drm-msm-a6xx-Avoid-a-nullptr-dereference-when-speedb.patch
  (git-fixes CVE-2024-38390 bsc#1226891).
- Update
  patches.suse/drm-msm-dpu-Add-callback-function-pointer-check-befo.patch
  (git-fixes CVE-2024-38622 bsc#1226856).
- Update
  patches.suse/drm-panel-fix-a-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52821
  bsc#1225022).
- Update
  patches.suse/drm-panel-panel-tpo-tpg110-fix-a-possible-null-point.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52826
  bsc#1225077).
- Update patches.suse/drm-radeon-possible-buffer-overflow.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52867
  bsc#1225009).
- Update
  patches.suse/drm-vc4-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38546 bsc#1226593).
- Update
  patches.suse/drm-vmwgfx-Fix-invalid-reads-in-fence-signaled-event.patch
  (git-fixes CVE-2024-36960 bsc#1225872).
- Update
  patches.suse/drm-zynqmp_dpsub-Always-register-bridge.patch
  (git-fixes CVE-2024-38664 bsc#1226941).
- Update
  patches.suse/e1000e-change-usleep_range-to-udelay-in-PHY-mdic-acc.patch
  (CVE-2024-39296 bsc#1226989 CVE-2024-36887 bsc#1225731).
- Update
  patches.suse/ecryptfs-Fix-buffer-size-for-tag-66-packet.patch
  (git-fixes CVE-2024-38578 bsc#1226634).
- Update
  patches.suse/efi-libstub-only-free-priv.runtime_map-when-allocate.patch
  (git-fixes CVE-2024-33619 bsc#1226768).
- Update
  patches.suse/fbdev-imsttfb-fix-a-resource-leak-in-probe.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52838
  bsc#1225031).
- Update
  patches.suse/fs-9p-only-translate-RWX-permissions-for-plain-9P200.patch
  (git-fixes CVE-2024-36964 bsc#1225866).
- Update
  patches.suse/fs-jfs-Add-check-for-negative-db_l2nbperpage.patch
  (git-fixes CVE-2023-52810 bsc#1225557).
- Update
  patches.suse/fs-jfs-Add-validity-check-for-db_maxag-and-db_agpref.patch
  (git-fixes CVE-2023-52804 bsc#1225550).
- Update
  patches.suse/ftrace-Fix-possible-use-after-free-issue-in-ftrace_location.patch
  (git-fixes CVE-2024-38588 bsc#1226837).
- Update
  patches.suse/genirq-irqdesc-Prevent-use-after-free-in-irq_find_at.patch
  (git-fixes CVE-2024-38385 bsc#1227085).
- Update patches.suse/gfs2-ignore-negated-quota-changes.patch
  (git-fixes CVE-2023-52759 bsc#1225560).
- Update
  patches.suse/hid-cp2112-Fix-duplicate-workqueue-initialization.patch
  (git-fixes CVE-2023-52853 bsc#1224988).
- Update
  patches.suse/hwmon-axi-fan-control-Fix-possible-NULL-pointer-dere.patch
  (git-fixes CVE-2023-52863 bsc#1225586).
- Update
  patches.suse/i2c-acpi-Unbind-mux-adapters-before-delete.patch
  (git-fixes CVE-2024-39362 bsc#1226995).
- Update
  patches.suse/i2c-core-Run-atomic-i2c-xfer-when-preemptible.patch
  (git-fixes CVE-2023-52791 bsc#1225108).
- Update
  patches.suse/i3c-master-mipi-i3c-hci-Fix-a-kernel-panic-for-acces.patch
  (git-fixes CVE-2023-52763 bsc#1225570).
- Update
  patches.suse/i3c-mipi-i3c-hci-Fix-out-of-bounds-access-in-hci_dma.patch
  (git-fixes CVE-2023-52766).
- Update
  patches.suse/i915-perf-Fix-NULL-deref-bugs-with-drm_dbg-calls.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52788
  bsc#1225106).
- Update
  patches.suse/igb-Fix-string-truncation-warnings-in-igb_set_fw_ver.patch
  (git-fixes CVE-2024-36010 bsc#1225594).
- Update
  patches.suse/iommu-vt-d-Fix-WARN_ON-in-iommu-probe-path.patch
  (git-fixes CVE-2024-35957 bsc#1224673).
- Update
  patches.suse/iommufd-Fix-missing-update-of-domains_itree-after-splitting-iopt
  (jsc#PED-7779 jsc#PED-7780 CVE-2023-52801 bsc#1225006).
- Update
  patches.suse/ipvlan-add-ipvlan_route_v6_outbound-helper.patch
  (git-fixes CVE-2023-52796 bsc#1224930).
- Update
  patches.suse/jffs2-prevent-xattr-node-from-overflowing-the-eraseblock.patch
  (git-fixes CVE-2024-38599 bsc#1226848).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-dbFindLeaf.patch
  (git-fixes CVE-2023-52799 bsc#1225472).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-diAlloc.patch
  (git-fixes CVE-2023-52805 bsc#1225553).
- Update
  patches.suse/kunit-fortify-Fix-mismatched-kvalloc-vfree-usage.patch
  (git-fixes CVE-2024-38617 bsc#1226859).
- Update
  patches.suse/lib-generic-radix-tree.c-Don-t-overflow-in-peek.patch
  (git-fixes CVE-2021-47432 bsc#1225391).
- Update
  patches.suse/lib-test_hmm.c-handle-src_pfns-and-dst_pfns-allocati.patch
  (git-fixes CVE-2024-38543 bsc#1226594).
- Update
  patches.suse/locking-ww_mutex-test-Fix-potential-workqueue-corrup.patch
  (bsc#1219953 CVE-2023-52836 bsc#1225609).
- Update
  patches.suse/md-Don-t-ignore-suspended-array-in-md_check_recovery-1baa.patch
  (bsc#1219596 CVE-2024-26758).
- Update
  patches.suse/media-atomisp-ssh_css-Fix-a-null-pointer-dereference.patch
  (git-fixes CVE-2024-38547 bsc#1226632).
- Update
  patches.suse/media-bttv-fix-use-after-free-error-due-to-btv-timeo.patch
  (git-fixes CVE-2023-52847 bsc#1225588).
- Update
  patches.suse/media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch
  (git-fixes CVE-2023-52764 bsc#1225571).
- Update
  patches.suse/media-hantro-Check-whether-reset-op-is-defined-befor.patch
  (git-fixes CVE-2023-52850 bsc#1225014).
- Update
  patches.suse/media-i2c-et8ek8-Don-t-strip-remove-function-when-dr.patch
  (git-fixes CVE-2024-38611 bsc#1226760).
- Update
  patches.suse/media-imon-fix-access-to-invalid-resource-for-the-se.patch
  (git-fixes CVE-2023-52754 bsc#1225490).
- Update
  patches.suse/media-lgdt3306a-Add-a-check-against-null-pointer-def.patch
  (stable-fixes CVE-2022-48772 bsc#1226976).
- Update
  patches.suse/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch
  (git-fixes CVE-2024-38621 bsc#1226895).
- Update
  patches.suse/media-vidtv-mux-Add-check-and-kfree-for-kstrdup.patch
  (git-fixes CVE-2023-52841 bsc#1225592).
- Update patches.suse/media-vidtv-psi-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52844 bsc#1225590).
- Update
  patches.suse/mfd-qcom-spmi-pmic-Fix-revid-implementation.patch
  (git-fixes CVE-2023-52765 bsc#1225029).
- Update
  patches.suse/misc-microchip-pci1xxxx-fix-double-free-in-the-error.patch
  (git-fixes CVE-2024-36973 bsc#1226457).
- Update
  patches.suse/net-hns3-fix-out-of-bounds-access-may-occur-when-coa.patch
  (git-fixes CVE-2023-52807 bsc#1225097).
- Update
  patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch
  (git-fixes CVE-2024-36962 bsc#1225827).
- Update
  patches.suse/net-mlx5-Fix-peer-devlink-set-for-SF-representor-dev.patch
  (git-fixes CVE-2024-38595 bsc#1226741).
- Update
  patches.suse/net-mlx5e-Track-xmit-submission-to-PTP-WQ-after-popu.patch
  (jsc#PED-3311 CVE-2023-52782 bsc#1225103).
- Update
  patches.suse/net-mvneta-fix-calls-to-page_pool_get_stats.patch
  (git-fixes CVE-2023-52780 bsc#1224933).
- Update
  patches.suse/net-wangxun-fix-kernel-panic-due-to-null-pointer.patch
  (git-fixes CVE-2023-52783 bsc#1225104).
- Update
  patches.suse/netfilter-complete-validation-of-user-input.patch
  (git-fixes CVE-2024-35896 bsc#1224662 CVE-2024-35962
  bsc#1224583).
- Update
  patches.suse/nfc-nci-Fix-uninit-value-in-nci_rx_work.patch
  (git-fixes CVE-2024-38381 bsc#1226878).
- Update
  patches.suse/nilfs2-fix-nilfs_empty_dir-misjudgment-and-long-loop.patch
  (git-fixes CVE-2024-39469 bsc#1226992).
- Update
  patches.suse/nilfs2-fix-potential-hang-in-nilfs_detach_log_writer.patch
  (git-fixes CVE-2024-38582 bsc#1226658).
- Update
  patches.suse/nilfs2-fix-use-after-free-of-timer-for-log-writer-th.patch
  (git-fixes CVE-2024-38583 bsc#1226777).
- Update
  patches.suse/of-module-add-buffer-overflow-check-in-of_modalias.patch
  (git-fixes CVE-2024-38541 bsc#1226587).
- Update
  patches.suse/padata-Fix-refcnt-handling-in-padata_free_shell.patch
  (git-fixes CVE-2023-52854 bsc#1225584).
- Update
  patches.suse/perf-core-Bail-out-early-if-the-request-AUX-area-is-out-of-bound.patch
  (git-fixes CVE-2023-52835 bsc#1225602).
- Update
  patches.suse/platform-x86-wmi-Fix-opening-of-char-device.patch
  (git-fixes CVE-2023-52864 bsc#1225132).
- Update
  patches.suse/powerpc-pseries-iommu-LPAR-panics-during-boot-up-wit.patch
  (bsc#1222011 ltc#205900 CVE-2024-36926 bsc#1225829).
- Update patches.suse/pstore-platform-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52869 bsc#1225050).
- Update
  patches.suse/remoteproc-mediatek-Make-sure-IPI-buffer-fits-in-L2T.patch
  (git-fixes CVE-2024-36965 bsc#1226149).
- Update
  patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch
  (git-fixes CVE-2024-38601 bsc#1226876).
- Update
  patches.suse/s390-dasd-protect-device-queue-against-concurrent-access.patch
  (git-fixes bsc#1217481 CVE-2023-52774 bsc#1225572).
- Update
  patches.suse/scsi-hisi_sas-Set-debugfs_dir-pointer-to-NULL-after-removing-debugfs.patch
  (git-fixes CVE-2023-52808 bsc#1225555).
- Update
  patches.suse/scsi-ibmvfc-Remove-BUG_ON-in-the-case-of-an-empty-ev.patch
  (bsc#1209834 ltc#202097 CVE-2023-52811 bsc#1225559).
- Update
  patches.suse/scsi-libfc-Fix-potential-NULL-pointer-dereference-in-fc_lport_ptp_setup.patch
  (git-fixes CVE-2023-52809 bsc#1225556).
- Update
  patches.suse/scsi-lpfc-Move-NPIV-s-transport-unregistration-to-af.patch
  (bsc#1221777 CVE-2024-36952 bsc#1225898).
- Update
  patches.suse/scsi-lpfc-Release-hbalock-before-calling-lpfc_worker.patch
  (bsc#1221777 CVE-2024-36924 bsc#1225820).
- Update
  patches.suse/serial-max3100-Lock-port-lock-when-calling-uart_hand.patch
  (git-fixes CVE-2024-38634 bsc#1226868).
- Update
  patches.suse/serial-max3100-Update-uart_driver_registered-on-driv.patch
  (git-fixes CVE-2024-38633 bsc#1226867).
- Update
  patches.suse/soc-qcom-llcc-Handle-a-second-device-without-data-co.patch
  (git-fixes CVE-2023-52871 bsc#1225534).
- Update
  patches.suse/soundwire-cadence-fix-invalid-PDI-offset.patch
  (stable-fixes CVE-2024-38635 bsc#1226863).
- Update patches.suse/speakup-Fix-sizeof-vs-ARRAY_SIZE-bug.patch
  (git-fixes CVE-2024-38587 bsc#1226780).
- Update patches.suse/spi-Fix-null-dereference-on-suspend.patch
  (git-fixes CVE-2023-52749 bsc#1225476).
- Update
  patches.suse/thermal-core-prevent-potential-string-overflow.patch
  (git-fixes CVE-2023-52868 bsc#1225044).
- Update
  patches.suse/thermal-drivers-qcom-lmh-Check-for-SCM-availability-.patch
  (git-fixes CVE-2024-39466 bsc#1227089).
- Update
  patches.suse/thermal-drivers-tsens-Fix-null-pointer-dereference.patch
  (git-fixes CVE-2024-38571 bsc#1226737).
- Update
  patches.suse/thermal-intel-powerclamp-fix-mismatch-in-get-functio.patch
  (git-fixes CVE-2023-52794 bsc#1225028).
- Update
  patches.suse/tls-fix-NULL-deref-on-tls_sw_splice_eof-with-empty-r.patch
  (jsc#PED-6831 CVE-2023-52767 bsc#1224998).
- Update
  patches.suse/tpm_tis_spi-Account-for-SPI-header-when-allocating-T.patch
  (git-fixes CVE-2024-36477 bsc#1226840).
- Update
  patches.suse/tracing-Have-trace_event_file-have-ref-counters.patch
  (git-fixes CVE-2023-52879 bsc#1225101).
- Update
  patches.suse/tracing-trigger-Fix-to-return-error-if-failed-to-alloc-snapshot.patch
  (git-fixes CVE-2024-26920).
- Update
  patches.suse/tty-n_gsm-fix-race-condition-in-status-line-change-o.patch
  (git-fixes CVE-2023-52872 bsc#1225591).
- Update
  patches.suse/tty-n_gsm-require-CAP_NET_ADMIN-to-attach-N_GSM0710-.patch
  (bsc#1222619 CVE-2023-52880).
- Update
  patches.suse/tty-vcc-Add-check-for-kstrdup-in-vcc_probe.patch
  (git-fixes CVE-2023-52789 bsc#1225180).
- Update
  patches.suse/usb-config-fix-iteration-issue-in-usb_get_bos_descri.patch
  (git-fixes CVE-2023-52781 bsc#1225092).
- Update
  patches.suse/usb-dwc3-Wait-unconditionally-after-issuing-EndXfer-.patch
  (git-fixes CVE-2024-36977 bsc#1226513).
- Update
  patches.suse/usb-gadget-u_audio-Fix-race-condition-use-of-control.patch
  (git-fixes CVE-2024-38628 bsc#1226911).
- Update
  patches.suse/usb-storage-alauda-Check-whether-the-media-is-initia.patch
  (git-fixes CVE-2024-38619 bsc#1226861).
- Update
  patches.suse/usb-typec-tcpm-Fix-NULL-pointer-dereference-in-tcpm_.patch
  (git-fixes CVE-2023-52877 bsc#1224944).
- Update
  patches.suse/vhost-vdpa-fix-use-after-free-in-vhost_vdpa_probe.patch
  (jsc#PED-3311 CVE-2023-52795 bsc#1225085).
- Update
  patches.suse/virtio-blk-fix-implicit-overflow-on-virtio_max_dma_s.patch
  (git-fixes CVE-2023-52762 bsc#1225573).
- Update
  patches.suse/virtio-vsock-Fix-uninit-value-in-virtio_transport_re.patch
  (jsc#PED-5505 CVE-2023-52842 bsc#1225025).
- Update
  patches.suse/watchdog-cpu5wdt.c-Fix-use-after-free-bug-caused-by-.patch
  (git-fixes CVE-2024-38630 bsc#1226908).
- Update
  patches.suse/wifi-ar5523-enable-proper-endpoint-verification.patch
  (git-fixes CVE-2024-38565 bsc#1226747).
- Update
  patches.suse/wifi-ath11k-fix-dfs-radar-event-locking.patch
  (git-fixes CVE-2023-52798 bsc#1224947).
- Update
  patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch
  (git-fixes CVE-2023-52777 bsc#1224992).
- Update patches.suse/wifi-ath11k-fix-htt-pktlog-locking.patch
  (git-fixes CVE-2023-52800).
- Update
  patches.suse/wifi-ath12k-fix-dfs-radar-and-temperature-event-lock.patch
  (git-fixes CVE-2023-52776 bsc#1225090).
- Update
  patches.suse/wifi-ath12k-fix-htt-mlo-offset-event-locking.patch
  (git-fixes CVE-2023-52769 bsc#1225001).
- Update
  patches.suse/wifi-ath12k-fix-out-of-bound-access-of-qmi_invoke_ha.patch
  (git-fixes CVE-2024-38572 bsc#1226776).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-read-in-ath12k.patch
  (git-fixes CVE-2023-52827 bsc#1225078).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-write-in-ath12.patch
  (git-fixes CVE-2023-52829 bsc#1225081).
- Update
  patches.suse/wifi-brcmfmac-pcie-handle-randbuf-allocation-failure.patch
  (git-fixes CVE-2024-38575 bsc#1226612).
- Update
  patches.suse/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch
  (git-fixes CVE-2024-38567 bsc#1226769).
- Update
  patches.suse/wifi-carl9170-re-fix-fortified-memset-warning.patch
  (git-fixes CVE-2024-38616 bsc#1226852).
- Update
  patches.suse/wifi-mac80211-don-t-return-unset-power-in-ieee80211_.patch
  (git-fixes CVE-2023-52832 bsc#1225577).
- Update
  patches.suse/wifi-nl80211-Avoid-address-calculations-via-out-of-b.patch
  (git-fixes CVE-2024-38562 bsc#1226788).
- Update
  patches.suse/wifi-wilc1000-use-vmm_table-as-array-in-wilc-struct.patch
  (git-fixes CVE-2023-52768 bsc#1225004).
- Update
  patches.suse/x86-tdx-Zero-out-the-missing-RSI-in-TDX_HYPERCALL-macro.patch
  (jsc#PED-5824 CVE-2023-52874 bsc#1225049).
- commit 33efdc4</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835204">- tcp: Use refcount_inc_not_zero() in tcp_twsk_unique()
  (CVE-2024-36904 bsc#1225732).
- commit d578dcc</changelog>
  <changelog author="heming.zhao@suse.com" date="1719921600">- gfs2: Fix potential glock use-after-free on unmount (bsc#1226775
  CVE-2024-38570).
- gfs2: Rename sd_{ glock =&gt; kill }_wait (bsc#1226775
  CVE-2024-38570).
- commit f3adbca</changelog>
  <changelog author="tiwai@suse.de" date="1719921601">- Correct SCSI patch references (bsc#1225767 CVE-2024-36919 bsc#1226785 CVE-2024-38559)
- commit e8ea587</changelog>
  <changelog author="tiwai@suse.de" date="1719921602">- mtd: rawnand: rockchip: ensure NVDDR timings are rejected
  (git-fixes).
- mtd: rawnand: Bypass a couple of sanity checks during NAND
  identification (git-fixes).
- mtd: rawnand: Fix the nand_read_data_op() early check
  (git-fixes).
- mtd: rawnand: Ensure ECC configuration is propagated to upper
  layers (git-fixes).
- commit e545951</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1719921603">- kernel-doc: fix struct_group_tagged() parsing (git-fixes).
- commit e3a2a2e</changelog>
  <changelog author="fdmanana@suse.com" date="1719921604">- btrfs: fix crash on racing fsync and size-extending write into
  prealloc (bsc#1227101 CVE-2024-37354).
- commit 1d355af</changelog>
  <changelog author="vbabka@suse.cz" date="1719921605">- virt: acrn: stop using follow_pfn (CVE-2024-38610 bsc#1226758).
- commit c2ea51b</changelog>
  <changelog author="vbabka@suse.cz" date="1719921606">- drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
  (CVE-2024-38610 bsc#1226758).
- commit 7069ac2</changelog>
  <changelog author="rhopkins@suse.de" date="1719921607">- hsr: Prevent use after free in prp_create_tagged_frame()
  (CVE-2023-52846 bsc#1225098).
- commit cf63988</changelog>
  <changelog author="krisman@suse.de" date="1719921608">- io_uring: Fix io_cqring_wait() not restoring sigmask on
  get_timespec64() failure (git-fixes).
- commit e640a65</changelog>
  <changelog author="krisman@suse.de" date="1719921609">- io_uring: check for non-NULL file pointer in io_file_can_poll()
  (bsc#1226990 CVE-2024-39371).
- io_uring/io-wq: Use set_bit() and test_bit() at worker-&gt;flags
  (git-fixes).
- io_uring/sqpoll: work around a potential audit memory leak
  (git-fixes).
- commit 24603fc</changelog>
  <changelog author="krisman@suse.de" date="1719921610">- io_uring/rsrc: fix incorrect assignment of iter-&gt;nr_segs in
  io_import_fixed (git-fixes).
- io_uring/rsrc: don't lock while !TASK_RUNNING (git-fixes).
- io_uring/io-wq: avoid garbage value of 'match' in
  io_wq_enqueue() (git-fixes).
- commit 7d3e252</changelog>
</package>
<package pkgid="43d434f54cbf7b961dc2ea627bb16a03fbf77cc2020c65669a1867b47a1b73d3" name="dtb-nvidia" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.17.1"/>
  <changelog author="tiwai@suse.de" date="1722081600">- auxdisplay: ht16k33: Drop reference after LED registration
  (git-fixes).
- ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
  on unprepare (git-fixes).
- ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
- ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
  reachable (git-fixes).
- ASoC: sof: amd: fix for firmware reload failure in Vangogh
  platform (git-fixes).
- ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
- ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
  (git-fixes).
- ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
- ALSA: ump: Don't update FB name for static blocks (git-fixes).
- drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
- drm/i915/gt: Do not consider preemption during execlists_dequeue
  for gen8 (git-fixes).
- drm/i915/dp: Don't switch the LTTPR mode on an active link
  (git-fixes).
- commit d7e2deb</changelog>
  <changelog author="tiwai@suse.de" date="1722081601">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
</package>
<package pkgid="e812b5fe5ff9ca4985373ea15b98b83bbe771b90f30579a607df0829e0fe2e56" name="dtb-nvidia" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.7.1"/>
  <changelog author="mkubecek@suse.cz" date="1717416000">- netfilter: nf_tables: release mutex after nft_gc_seq_end from
  abort path (CVE-2024-26925 bsc#1223390).
- commit 578a709</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717416001">- Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
  The L3 bsc#1225765 was created seperately since our customer requires
  PTF.
- Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
- Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
- Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
- Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
- commit 054635e</changelog>
  <changelog author="msuchanek@suse.de" date="1717416002">- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
- powerpc/uaccess: Fix build errors seen with GCC 13/14
  (bsc#1194869).
- commit 46b5d84</changelog>
  <changelog author="msuchanek@suse.de" date="1717416003">- blacklist.conf: PPC fsl_msi is not used
- commit ae6590d</changelog>
  <changelog author="msuchanek@suse.de" date="1717416004">- powerpc/pseries/lparcfg: drop error message from guest name
  lookup (bsc#1187716 ltc#193451 git-fixes).
- commit ceab637</changelog>
  <changelog author="mfranc@suse.cz" date="1717416005">- Update
  patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
  (git-fixes CVE-2024-36955).
- Update
  patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
  (git-fixes bsc#1225715 CVE-2024-36906).
- Update
  patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
  (git-fixes bsc#1225579 CVE-2024-36011).
- Update
  patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
  (git-fixes bsc#1225578 CVE-2024-36013).
- Update
  patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
  (git-fixes bsc#1225502 CVE-2024-36012).
- Update
  patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
  (git-fixes bsc#1225722 CVE-2024-36880).
- Update
  patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
  (git-fixes CVE-2024-36942).
- Update
  patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
  (git-fixes bsc#1225720 CVE-2024-36032).
- Update
  patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
  (git-fixes bsc#1223749 CVE-2024-26990).
- Update
  patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
  (git-fixes bsc#1223692 CVE-2024-26992).
- Update
  patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
  (stable-fixes CVE-2024-36944).
- Update
  patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
  (git-fixes bsc#1225734 CVE-2024-36896).
- Update
  patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
  (stable-fixes CVE-2024-36949).
- Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
  (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
- Update
  patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
  (git-fixes bsc#1225692 CVE-2023-52882).
- Update
  patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
  (git-fixes CVE-2024-26761).
- Update
  patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
  (stable-fixes bsc#1225735 CVE-2024-36897).
- Update
  patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
  (stable-fixes bsc#1225705 CVE-2024-36026).
- Update
  patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
  (stable-fixes CVE-2024-36951).
- Update
  patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
  (git-fixes bsc#1225593 CVE-2024-36014).
- Update
  patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
  (stable-fixes bsc#1225728 CVE-2024-36885).
- Update
  patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
  (git-fixes bsc#1225773 CVE-2024-36936).
- Update
  patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
  (stable-fixes CVE-2024-36950).
- Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
  (git-fixes bsc#1225736 CVE-2024-36898).
- Update
  patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
  (git-fixes bsc#1225698 CVE-2024-36020).
- Update
  patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
  (git-fixes bsc#1225710 CVE-2024-36891).
- Update
  patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
  (git-fixes bsc#1225714 CVE-2024-36890).
- Update
  patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
  (git-fixes bsc#1225708 CVE-2024-36029).
- Update
  patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
  (git-fixes bsc#1225699 CVE-2024-36021).
- Update
  patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
  (git-fixes CVE-2024-26943).
- Update
  patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
  (git-fixes bsc#1225694 CVE-2024-36018).
- Update
  patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
  (git-fixes CVE-2024-36940).
- Update
  patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
  (git-fixes CVE-2024-36959).
- Update
  patches.suse/ppdev-Add-an-error-check-in-register_device.patch
  (git-fixes bsc#1225640 CVE-2024-36015).
- Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
  CVE-2024-36947).
- Update
  patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
  (git-fixes bsc#1225695 CVE-2024-36019).
- Update
  patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
  (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
- Update
  patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
  (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
- Update
  patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
  (git-fixes bsc#1225704 CVE-2024-36025).
- Update
  patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
  (git-fixes CVE-2024-36930).
- Update
  patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
  (bsc#1224331 bsc#1224602 CVE-2024-35814).
- Update
  patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
  (git-fixes bsc#1225642 CVE-2024-36016).
- Update
  patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
  (git-fixes bsc#1225749 CVE-2024-36894).
- Update
  patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
  (git-fixes bsc#1225750 CVE-2024-36895).
- Update
  patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
  (git-fixes bsc#1225748 CVE-2024-36893).
- Update
  patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
  (stable-fixes bsc#1225769 CVE-2024-36921).
- Update
  patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
  (stable-fixes CVE-2024-36922).
- Update
  patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
  (git-fixes CVE-2024-36941).
- Update
  patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
  (git-fixes bsc#1224742 CVE-2024-35803).
- commit 539780f</changelog>
  <changelog author="dwagner@suse.de" date="1717416006">- nvmet: fix ns enable/disable possible hang (git-fixes).
- nvme-multipath: fix io accounting on failover (git-fixes).
- nvme: fix multipath batched completion accounting (git-fixes).
- commit ed3b392</changelog>
  <changelog author="dwagner@suse.de" date="1717416007">- scsi: lpfc: Copyright updates for 14.4.0.2 patches
  (bsc#1225842).
- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
  (bsc#1225842).
  Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
  (bsc#1225842).
- scsi: lpfc: Clear deferred RSCN processing flag when driver
  is unloading (bsc#1225842).
- scsi: lpfc: Update logging of protection type for T10 DIF I/O
  (bsc#1225842).
- scsi: lpfc: Change default logging level for unsolicited CT
  MIB commands (bsc#1225842).
- commit 5a56384</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416008">- smb: client: fix mount when dns_resolver key is not available
  (git-fixes, bsc#1225172).
- commit 28edb5c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416009">- cifs: fix leak of iface for primary channel (git-fixes,
  bsc#1225172).
- commit b7eb8e8</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416010">- Revert "cifs: reconnect work should have reference on server
  struct" (git-fixes, bsc#1225172).
- commit 3ca4c0c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416011">- smb: client: fix parsing of SMB3.1.1 POSIX create context
  (git-fixes, bsc#1225172).
- commit 5f27f69</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416012">- cifs: failure to add channel on iface should bump up weight
  (git-fixes, bsc#1225172).
- commit 007b237</changelog>
  <changelog author="tonyj@suse.de" date="1717416013">- perf/x86: Fix out of range data (git-fixes).
- perf/x86/intel/ds: Don't clear -&gt;pebs_data_cfg for the last
  PEBS event (git-fixes).
- perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
- commit 664d77f</changelog>
  <changelog author="dsterba@suse.com" date="1717588800">- blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
- Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
  Quoting bsc#1225945#c11:
  "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
  transaction for every subvol create")
  ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
  unwritten extent buffer after snapshotting a new subvolume") was never
  backported."
- commit d947258</changelog>
  <changelog author="tonyj@suse.de" date="1717588801">- perf pmu: Count sys and cpuid JSON events separately (git
  fixes).
- perf stat: Don't display metric header for non-leader uncore
  events (git-fixes).
- perf daemon: Fix file leak in daemon_session__control
  (git-fixes).
- perf symbols: Fix ownership of string in dso__load_vmlinux()
  (git-fixes).
- perf thread: Fixes to thread__new() related to initializing comm
  (git-fixes).
- perf report: Avoid SEGV in report__setup_sample_type()
  (git-fixes).
- perf ui browser: Don't save pointer to stack memory (git-fixes).
- perf bench internals inject-build-id: Fix trap divide when
  collecting just one DSO (git-fixes).
- perf intel-pt: Fix unassigned instruction op (discovered by
  MemorySanitizer) (git-fixes).
- perf test shell arm_coresight: Increase buffer size for
  Coresight basic tests (git-fixes).
- perf docs: Document bpf event modifier (git-fixes).
- perf bench uprobe: Remove lib64 from libc.so.6 binary path
  (git-fixes).
- perf record: Fix debug message placement for test consumption
  (git-fixes).
- perf tests: Apply attributes to all events in object code
  reading test (git-fixes).
- perf tests: Make "test data symbol" more robust on Neoverse N1
  (git-fixes).
- perf annotate: Fix annotation_calc_lines() to pass correct
  address to get_srcline() (git-fixes).
- perf stat: Do not fail on metrics on s390 z/VM systems
  (git-fixes).
- perf sched timehist: Fix -g/--call-graph option failure
  (git-fixes).
- perf annotate: Get rid of duplicate --group option item
  (git-fixes).
- perf probe: Add missing libgen.h header needed for using
  basename() (git-fixes).
- perf record: Delete session after stopping sideband thread
  (git-fixes).
- perf auxtrace: Fix multiple use of --itrace option (git-fixes).
- perf script: Show also errors for --insn-trace option
  (git-fixes).
- perf lock contention: Add a missing NULL check (git-fixes).
- perf vendor events amd: Fix Zen 4 cache latency events
  (git-fixes).
- libperf evlist: Avoid out-of-bounds access (git-fixes).
- perf pmu: Fix a potential memory leak in perf_pmu__lookup()
  (git-fixes).
- perf print-events: make is_event_supported() more robust
  (git-fixes).
- perf list: fix short description for some cache events
  (git-fixes).
- perf metric: Don't remove scale from counts (git-fixes).
- perf stat: Avoid metric-only segv (git-fixes).
- perf expr: Fix "has_event" function for metric style events
  (git-fixes).
- perf srcline: Add missed addr2line closes (git-fixes).
- perf thread_map: Free strlist on normal path in
  thread_map__new_by_tid_str() (git-fixes).
- perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
- perf jevents: Drop or simplify small integer values (git-fixes).
- perf evsel: Fix duplicate initialization of data-&gt;id in
  evsel__parse_sample() (git-fixes).
- perf pmu: Treat the msr pmu as software (git-fixes).
- perf record: Check conflict between '--timestamp-filename'
  option and pipe mode before recording (git-fixes).
- perf record: Fix possible incorrect free in
  record__switch_output() (git-fixes).
- perf vendor events amd: Add Zen 4 memory controller events
  (git-fixes).
- perf top: Uniform the event name for the hybrid machine
  (git-fixes).
- perf top: Use evsel's cpus to replace user_requested_cpus
  (git-fixes).
- commit a1f9340</changelog>
  <changelog author="tonyj@suse.de" date="1717675200">- perf ui browser: Avoid SEGV on title (git fixes).
- commit 1578c22</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675201">- inet: inet_defrag: prevent sk release while still in use
  (CVE-2024-26921 bsc#1223138).
- commit 2016faf</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675202">- net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
- commit 7bf5961</changelog>
  <changelog author="tiwai@suse.de" date="1718366400">- Temporarily drop KVM patch that caused a regression (bsc#1226158)
  Delete patches.suse/KVM-x86-pmu-Prioritize-VMX-interception-over-GP-on-R.patch
- commit 33f31da</changelog>
</package>
<package pkgid="368499907e54ad091c38e2ff0e17a39c6a049186f1e6d5300c6215bfac2672d9" name="dtb-qcom" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.14.1"/>
  <changelog author="tiwai@suse.de" date="1719662400">- gpiolib: cdev: Disallow reconfiguration without direction
  (uAPI v1) (git-fixes).
- gpio: davinci: Validate the obtained number of IRQs (git-fixes).
- commit 919ebd1</changelog>
  <changelog author="tiwai@suse.de" date="1719748800">- i2c: testunit: discard write requests while old command is
  running (git-fixes).
- i2c: testunit: don't erase registers after STOP (git-fixes).
- mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
  (git-fixes).
- mmc: sdhci: Do not invert write-protect twice (git-fixes).
- mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
  (git-fixes).
- mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
  (git-fixes).
- commit 448487d</changelog>
  <changelog author="tiwai@suse.de" date="1719748801">- crypto: iaa - Account for cpu-less numa nodes (bsc#1227190).
- commit cd600aa</changelog>
  <changelog author="tiwai@suse.de" date="1719748802">- crypto: deflate - Add aliases to deflate (bsc#1227190).
- commit 27ffd92</changelog>
  <changelog author="tiwai@suse.de" date="1719835200">- ata: ahci: Clean up sysfs file on error (git-fixes).
- ata: libata-core: Fix double free on error (git-fixes).
- ata,scsi: libata-core: Do not leak memory for ata_port struct
  members (git-fixes).
- ata: libata-core: Fix null pointer dereference on error
  (git-fixes).
- kbuild: Fix build target deb-pkg: ln: failed to create hard link
  (git-fixes).
- kbuild: doc: Update default INSTALL_MOD_DIR from extra to
  updates (git-fixes).
- kbuild: Install dtb files as 0644 in Makefile.dtbinst
  (git-fixes).
- counter: ti-eqep: enable clock at probe (git-fixes).
- iio: chemical: bme680: Fix sensor data read operation
  (git-fixes).
- iio: chemical: bme680: Fix overflows in compensate() functions
  (git-fixes).
- iio: chemical: bme680: Fix calibration data variable
  (git-fixes).
- iio: chemical: bme680: Fix pressure value output (git-fixes).
- iio: accel: fxls8962af: select IIO_BUFFER &amp; IIO_KFIFO_BUF
  (git-fixes).
- iio: adc: ad7266: Fix variable checking bug (git-fixes).
- iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
  (git-fixes).
- serial: bcm63xx-uart: fix tx after conversion to
  uart_port_tx_limited() (git-fixes).
- serial: core: introduce uart_port_tx_limited_flags()
  (git-fixes).
- Revert "serial: core: only stop transmit when HW fifo is empty"
  (git-fixes).
- tty: mcf: MCF54418 has 10 UARTS (git-fixes).
- usb: gadget: aspeed_udc: fix device address configuration
  (git-fixes).
- usb: dwc3: core: remove lock of otg mode during gadget
  suspend/resume to avoid deadlock (git-fixes).
- usb: typec: ucsi: glink: fix child node release in probe
  function (git-fixes).
- usb: musb: da8xx: fix a resource leak in probe() (git-fixes).
- usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  (git-fixes).
- usb: gadget: printer: fix races against disable (git-fixes).
- PCI/MSI: Fix UAF in msi_capability_init (git-fixes).
- commit a2ea5a9</changelog>
  <changelog author="ptesarik@suse.com" date="1719835201">- net: ena: Fix redundant device NUMA node override
  (jsc#PED-8688).
- commit 6ad6684</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835202">- tcp: do not accept ACK of bytes we never sent (CVE-2023-52881
  bsc#1225611).
- commit 16404a6</changelog>
  <changelog author="mhocko@suse.com" date="1719835203">- Update
  patches.suse/1352-drm-amdgpu-Fix-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52883
  bsc#1226630).
- Update
  patches.suse/9p-add-missing-locking-around-taking-dentry-fid-list.patch
  (git-fixes CVE-2024-39463 bsc#1227090).
- Update
  patches.suse/ALSA-Fix-deadlocks-with-kctl-removals-at-disconnecti.patch
  (stable-fixes CVE-2024-38600 bsc#1226864).
- Update
  patches.suse/ALSA-core-Fix-NULL-module-pointer-assignment-at-card.patch
  (git-fixes CVE-2024-38605 bsc#1226740).
- Update
  patches.suse/ALSA-hda-Fix-possible-null-ptr-deref-when-assigning-.patch
  (git-fixes CVE-2023-52806 bsc#1225554).
- Update
  patches.suse/ALSA-hda-cs_dsp_ctl-Use-private_free-for-control-cle.patch
  (git-fixes CVE-2024-38388 bsc#1226890).
- Update
  patches.suse/ALSA-timer-Set-lower-bound-of-start-tick-time.patch
  (stable-fixes git-fixes CVE-2024-38618 bsc#1226754).
- Update
  patches.suse/ASoC-kirkwood-Fix-potential-NULL-dereference.patch
  (git-fixes CVE-2024-38550 bsc#1226633).
- Update
  patches.suse/ASoC-mediatek-Assign-dummy-when-codec-not-specified-.patch
  (git-fixes CVE-2024-38551 bsc#1226761).
- Update
  patches.suse/Bluetooth-btusb-Add-date-evt_skb-is-NULL-check.patch
  (git-fixes CVE-2023-52833 bsc#1225595).
- Update
  patches.suse/Bluetooth-hci_core-Fix-possible-buffer-overflow.patch
  (git-fixes CVE-2024-26889).
- Update
  patches.suse/HID-uclogic-Fix-user-memory-access-bug-in-uclogic_pa.patch
  (git-fixes CVE-2023-52866 bsc#1225120).
- Update
  patches.suse/IB-mlx5-Fix-init-stage-error-handling-to-avoid-doubl.patch
  (jsc#PED-6864 CVE-2023-52851 bsc#1225587).
- Update
  patches.suse/Input-cyapa-add-missing-input-core-locking-to-suspen.patch
  (git-fixes CVE-2023-52884 bsc#1226764).
- Update
  patches.suse/Input-synaptics-rmi4-fix-use-after-free-in-rmi_unreg.patch
  (git-fixes CVE-2023-52840 bsc#1224928).
- Update
  patches.suse/KEYS-trusted-Do-not-use-WARN-when-encode-fails.patch
  (git-fixes CVE-2024-36975 bsc#1226520).
- Update
  patches.suse/KEYS-trusted-Fix-memory-leak-in-tpm2_key_encode.patch
  (git-fixes CVE-2024-36967 bsc#1226131).
- Update
  patches.suse/RDMA-cma-Fix-kmemleak-in-rdma_core-observed-during-b.patch
  (git-fixes CVE-2024-38539 bsc#1226608).
- Update patches.suse/RDMA-hns-Fix-UAF-for-cq-async-event.patch
  (git-fixes CVE-2024-38545 bsc#1226595).
- Update
  patches.suse/RDMA-hns-Fix-deadlock-on-SRQ-async-events.patch
  (git-fixes CVE-2024-38591 bsc#1226738).
- Update
  patches.suse/RDMA-hns-Modify-the-print-level-of-CQE-error.patch
  (git-fixes CVE-2024-38590 bsc#1226839).
- Update
  patches.suse/RDMA-rxe-Fix-seg-fault-in-rxe_comp_queue_pkt.patch
  (git-fixes CVE-2024-38544 bsc#1226597).
- Update
  patches.suse/SUNRPC-Fix-RPC-client-cleaned-up-the-freed-pipefs-de.patch
  (git-fixes CVE-2023-52803 bsc#1225008).
- Update patches.suse/af_unix-Clear-stale-u-oob_skb.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-35970 bsc#1224584).
- Update
  patches.suse/af_unix-Drop-oob_skb-ref-before-purging-queue-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26750 bsc#1222617).
- Update
  patches.suse/af_unix-Fix-task-hung-while-purging-oob_skb-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26780 bsc#1222588).
- Update
  patches.suse/af_unix-Update-unix_sk-sk-oob_skb-under-sk_receive_queue-lock.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-36972 bsc#1226163).
- Update
  patches.suse/arm64-Restrict-CPU_BIG_ENDIAN-to-GNU-as-or-LLVM-IAS-.patch
  (git-fixes CVE-2023-52750 bsc#1225485).
- Update
  patches.suse/atl1c-Work-around-the-DMA-RX-overflow-issue.patch
  (git-fixes CVE-2023-52834 bsc#1225599).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issue-of-net_device.patch
  (git-fixes CVE-2024-38554 bsc#1226742).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issues-of-ax25_dev.patch
  (git-fixes CVE-2024-38602 bsc#1226613).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-reorder-of-WRITE-lqueued.patch
  (bsc#1225605 CVE-2024-38384 bsc#1226938).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-resetting-io-stat.patch
  (bsc#1225605 CVE-2024-38663 bsc#1226939).
- Update
  patches.suse/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch
  (git-fixes CVE-2024-38540 bsc#1226582).
- Update
  patches.suse/bonding-stop-the-device-in-bond_setup_by_slave.patch
  (git-fixes CVE-2023-52784 bsc#1224946).
- Update
  patches.suse/can-dev-can_put_echo_skb-don-t-crash-kernel-if-can_p.patch
  (git-fixes CVE-2023-52878 bsc#1225000).
- Update
  patches.suse/clk-mediatek-clk-mt2701-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52875 bsc#1225096).
- Update
  patches.suse/clk-mediatek-clk-mt6765-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52870 bsc#1224937).
- Update
  patches.suse/clk-mediatek-clk-mt6779-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52873 bsc#1225589).
- Update
  patches.suse/clk-mediatek-clk-mt6797-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52865 bsc#1225086).
- Update
  patches.suse/clk-mediatek-clk-mt7629-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52858 bsc#1225566).
- Update
  patches.suse/clk-mediatek-clk-mt7629-eth-Add-check-for-mtk_alloc_.patch
  (git-fixes CVE-2023-52876 bsc#1225036).
- Update
  patches.suse/cppc_cpufreq-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38573 bsc#1226739).
- Update patches.suse/cpufreq-exit-callback-is-optional.patch
  (git-fixes CVE-2024-38615 bsc#1226592).
- Update patches.suse/crypto-bcm-Fix-pointer-arithmetic.patch
  (git-fixes CVE-2024-38579 bsc#1226637).
- Update
  patches.suse/crypto-pcrypt-Fix-hungtask-for-PADATA_RESET.patch
  (git-fixes CVE-2023-52813 bsc#1225527).
- Update patches.suse/cxl-mem-Fix-shutdown-order.patch (git-fixes
  CVE-2023-52849 bsc#1224949).
- Update
  patches.suse/cxl-region-Do-not-try-to-cleanup-after-cxl_region_se.patch
  (git-fixes CVE-2023-52792 bsc#1225477).
- Update patches.suse/cxl-region-Fix-cxlr_pmem-leaks.patch
  (git-fixes CVE-2024-38391 bsc#1226894).
- Update
  patches.suse/dma-buf-sw-sync-don-t-enable-IRQ-from-sync_print_obj.patch
  (git-fixes CVE-2024-38780 bsc#1226886).
- Update
  patches.suse/dma-mapping-benchmark-fix-node-id-validation.patch
  (git-fixes CVE-2024-34777 bsc#1226796).
- Update
  patches.suse/dma-mapping-benchmark-handle-NUMA_NO_NODE-correctly.patch
  (git-fixes CVE-2024-39277 bsc#1226909).
- Update
  patches.suse/dmaengine-idxd-Avoid-unnecessary-destruction-of-file.patch
  (git-fixes CVE-2024-38629 bsc#1226905).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Pola.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52819
  bsc#1225532).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-SMU7.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52818
  bsc#1225530).
- Update
  patches.suse/drm-amd-check-num-of-link-levels-when-update-pcie-pa.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52812
  bsc#1225564).
- Update
  patches.suse/drm-amd-display-Avoid-NULL-dereference-of-timing-gen.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52753
  bsc#1225478).
- Update
  patches.suse/drm-amd-display-Fix-division-by-zero-in-setup_dsc_co.patch
  (stable-fixes CVE-2024-36969 bsc#1226155).
- Update
  patches.suse/drm-amd-display-Fix-null-pointer-dereference-in-erro.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52862
  bsc#1225015).
- Update
  patches.suse/drm-amd-display-Fix-potential-index-out-of-bounds-in.patch
  (git-fixes CVE-2024-38552 bsc#1226767).
- Update
  patches.suse/drm-amd-display-fix-a-NULL-pointer-dereference-in-am.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52773
  bsc#1225041).
- Update
  patches.suse/drm-amd-display-fixed-integer-types-and-null-check-l.patch
  (git-fixes CVE-2024-26767).
- Update
  patches.suse/drm-amdgpu-Fix-a-null-pointer-access-when-the-smc_rr.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52817
  bsc#1225569).
- Update
  patches.suse/drm-amdgpu-Fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch
  (git-fixes CVE-2024-39291 bsc#1226934).
- Update
  patches.suse/drm-amdgpu-Fix-potential-null-pointer-derefernce.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52814
  bsc#1225565).
- Update
  patches.suse/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch
  (stable-fixes CVE-2024-39471 bsc#1227096).
- Update
  patches.suse/drm-amdgpu-mes-fix-use-after-free-issue.patch
  (stable-fixes CVE-2024-38581 bsc#1226657).
- Update
  patches.suse/drm-amdgpu-vkms-fix-a-possible-null-pointer-derefere.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52815
  bsc#1225568).
- Update
  patches.suse/drm-amdkfd-Fix-a-race-condition-of-vram-buffer-unref.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52825
  bsc#1225076).
- Update
  patches.suse/drm-amdkfd-Fix-shift-out-of-bounds-issue.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52816
  bsc#1225529).
- Update
  patches.suse/drm-bridge-cdns-mhdp8546-Fix-possible-null-pointer-d.patch
  (git-fixes CVE-2024-38548).
- Update
  patches.suse/drm-bridge-it66121-Fix-invalid-connector-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52861
  bsc#1224941).
- Update
  patches.suse/drm-bridge-lt8912b-Fix-crash-on-bridge-detach.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52856
  bsc#1224932).
- Update
  patches.suse/drm-mediatek-Add-0-size-check-to-mtk_drm_gem_obj.patch
  (git-fixes CVE-2024-38549 bsc#1226735).
- Update
  patches.suse/drm-mediatek-Fix-coverity-issue-with-unintentional-i.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52857
  bsc#1225581).
- Update
  patches.suse/drm-mediatek-Init-ddp_comp-with-devm_kcalloc.patch
  (git-fixes CVE-2024-38592 bsc#1226844).
- Update
  patches.suse/drm-msm-a6xx-Avoid-a-nullptr-dereference-when-speedb.patch
  (git-fixes CVE-2024-38390 bsc#1226891).
- Update
  patches.suse/drm-msm-dpu-Add-callback-function-pointer-check-befo.patch
  (git-fixes CVE-2024-38622 bsc#1226856).
- Update
  patches.suse/drm-panel-fix-a-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52821
  bsc#1225022).
- Update
  patches.suse/drm-panel-panel-tpo-tpg110-fix-a-possible-null-point.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52826
  bsc#1225077).
- Update patches.suse/drm-radeon-possible-buffer-overflow.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52867
  bsc#1225009).
- Update
  patches.suse/drm-vc4-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38546 bsc#1226593).
- Update
  patches.suse/drm-vmwgfx-Fix-invalid-reads-in-fence-signaled-event.patch
  (git-fixes CVE-2024-36960 bsc#1225872).
- Update
  patches.suse/drm-zynqmp_dpsub-Always-register-bridge.patch
  (git-fixes CVE-2024-38664 bsc#1226941).
- Update
  patches.suse/e1000e-change-usleep_range-to-udelay-in-PHY-mdic-acc.patch
  (CVE-2024-39296 bsc#1226989 CVE-2024-36887 bsc#1225731).
- Update
  patches.suse/ecryptfs-Fix-buffer-size-for-tag-66-packet.patch
  (git-fixes CVE-2024-38578 bsc#1226634).
- Update
  patches.suse/efi-libstub-only-free-priv.runtime_map-when-allocate.patch
  (git-fixes CVE-2024-33619 bsc#1226768).
- Update
  patches.suse/fbdev-imsttfb-fix-a-resource-leak-in-probe.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52838
  bsc#1225031).
- Update
  patches.suse/fs-9p-only-translate-RWX-permissions-for-plain-9P200.patch
  (git-fixes CVE-2024-36964 bsc#1225866).
- Update
  patches.suse/fs-jfs-Add-check-for-negative-db_l2nbperpage.patch
  (git-fixes CVE-2023-52810 bsc#1225557).
- Update
  patches.suse/fs-jfs-Add-validity-check-for-db_maxag-and-db_agpref.patch
  (git-fixes CVE-2023-52804 bsc#1225550).
- Update
  patches.suse/ftrace-Fix-possible-use-after-free-issue-in-ftrace_location.patch
  (git-fixes CVE-2024-38588 bsc#1226837).
- Update
  patches.suse/genirq-irqdesc-Prevent-use-after-free-in-irq_find_at.patch
  (git-fixes CVE-2024-38385 bsc#1227085).
- Update patches.suse/gfs2-ignore-negated-quota-changes.patch
  (git-fixes CVE-2023-52759 bsc#1225560).
- Update
  patches.suse/hid-cp2112-Fix-duplicate-workqueue-initialization.patch
  (git-fixes CVE-2023-52853 bsc#1224988).
- Update
  patches.suse/hwmon-axi-fan-control-Fix-possible-NULL-pointer-dere.patch
  (git-fixes CVE-2023-52863 bsc#1225586).
- Update
  patches.suse/i2c-acpi-Unbind-mux-adapters-before-delete.patch
  (git-fixes CVE-2024-39362 bsc#1226995).
- Update
  patches.suse/i2c-core-Run-atomic-i2c-xfer-when-preemptible.patch
  (git-fixes CVE-2023-52791 bsc#1225108).
- Update
  patches.suse/i3c-master-mipi-i3c-hci-Fix-a-kernel-panic-for-acces.patch
  (git-fixes CVE-2023-52763 bsc#1225570).
- Update
  patches.suse/i3c-mipi-i3c-hci-Fix-out-of-bounds-access-in-hci_dma.patch
  (git-fixes CVE-2023-52766).
- Update
  patches.suse/i915-perf-Fix-NULL-deref-bugs-with-drm_dbg-calls.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52788
  bsc#1225106).
- Update
  patches.suse/igb-Fix-string-truncation-warnings-in-igb_set_fw_ver.patch
  (git-fixes CVE-2024-36010 bsc#1225594).
- Update
  patches.suse/iommu-vt-d-Fix-WARN_ON-in-iommu-probe-path.patch
  (git-fixes CVE-2024-35957 bsc#1224673).
- Update
  patches.suse/iommufd-Fix-missing-update-of-domains_itree-after-splitting-iopt
  (jsc#PED-7779 jsc#PED-7780 CVE-2023-52801 bsc#1225006).
- Update
  patches.suse/ipvlan-add-ipvlan_route_v6_outbound-helper.patch
  (git-fixes CVE-2023-52796 bsc#1224930).
- Update
  patches.suse/jffs2-prevent-xattr-node-from-overflowing-the-eraseblock.patch
  (git-fixes CVE-2024-38599 bsc#1226848).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-dbFindLeaf.patch
  (git-fixes CVE-2023-52799 bsc#1225472).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-diAlloc.patch
  (git-fixes CVE-2023-52805 bsc#1225553).
- Update
  patches.suse/kunit-fortify-Fix-mismatched-kvalloc-vfree-usage.patch
  (git-fixes CVE-2024-38617 bsc#1226859).
- Update
  patches.suse/lib-generic-radix-tree.c-Don-t-overflow-in-peek.patch
  (git-fixes CVE-2021-47432 bsc#1225391).
- Update
  patches.suse/lib-test_hmm.c-handle-src_pfns-and-dst_pfns-allocati.patch
  (git-fixes CVE-2024-38543 bsc#1226594).
- Update
  patches.suse/locking-ww_mutex-test-Fix-potential-workqueue-corrup.patch
  (bsc#1219953 CVE-2023-52836 bsc#1225609).
- Update
  patches.suse/md-Don-t-ignore-suspended-array-in-md_check_recovery-1baa.patch
  (bsc#1219596 CVE-2024-26758).
- Update
  patches.suse/media-atomisp-ssh_css-Fix-a-null-pointer-dereference.patch
  (git-fixes CVE-2024-38547 bsc#1226632).
- Update
  patches.suse/media-bttv-fix-use-after-free-error-due-to-btv-timeo.patch
  (git-fixes CVE-2023-52847 bsc#1225588).
- Update
  patches.suse/media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch
  (git-fixes CVE-2023-52764 bsc#1225571).
- Update
  patches.suse/media-hantro-Check-whether-reset-op-is-defined-befor.patch
  (git-fixes CVE-2023-52850 bsc#1225014).
- Update
  patches.suse/media-i2c-et8ek8-Don-t-strip-remove-function-when-dr.patch
  (git-fixes CVE-2024-38611 bsc#1226760).
- Update
  patches.suse/media-imon-fix-access-to-invalid-resource-for-the-se.patch
  (git-fixes CVE-2023-52754 bsc#1225490).
- Update
  patches.suse/media-lgdt3306a-Add-a-check-against-null-pointer-def.patch
  (stable-fixes CVE-2022-48772 bsc#1226976).
- Update
  patches.suse/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch
  (git-fixes CVE-2024-38621 bsc#1226895).
- Update
  patches.suse/media-vidtv-mux-Add-check-and-kfree-for-kstrdup.patch
  (git-fixes CVE-2023-52841 bsc#1225592).
- Update patches.suse/media-vidtv-psi-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52844 bsc#1225590).
- Update
  patches.suse/mfd-qcom-spmi-pmic-Fix-revid-implementation.patch
  (git-fixes CVE-2023-52765 bsc#1225029).
- Update
  patches.suse/misc-microchip-pci1xxxx-fix-double-free-in-the-error.patch
  (git-fixes CVE-2024-36973 bsc#1226457).
- Update
  patches.suse/net-hns3-fix-out-of-bounds-access-may-occur-when-coa.patch
  (git-fixes CVE-2023-52807 bsc#1225097).
- Update
  patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch
  (git-fixes CVE-2024-36962 bsc#1225827).
- Update
  patches.suse/net-mlx5-Fix-peer-devlink-set-for-SF-representor-dev.patch
  (git-fixes CVE-2024-38595 bsc#1226741).
- Update
  patches.suse/net-mlx5e-Track-xmit-submission-to-PTP-WQ-after-popu.patch
  (jsc#PED-3311 CVE-2023-52782 bsc#1225103).
- Update
  patches.suse/net-mvneta-fix-calls-to-page_pool_get_stats.patch
  (git-fixes CVE-2023-52780 bsc#1224933).
- Update
  patches.suse/net-wangxun-fix-kernel-panic-due-to-null-pointer.patch
  (git-fixes CVE-2023-52783 bsc#1225104).
- Update
  patches.suse/netfilter-complete-validation-of-user-input.patch
  (git-fixes CVE-2024-35896 bsc#1224662 CVE-2024-35962
  bsc#1224583).
- Update
  patches.suse/nfc-nci-Fix-uninit-value-in-nci_rx_work.patch
  (git-fixes CVE-2024-38381 bsc#1226878).
- Update
  patches.suse/nilfs2-fix-nilfs_empty_dir-misjudgment-and-long-loop.patch
  (git-fixes CVE-2024-39469 bsc#1226992).
- Update
  patches.suse/nilfs2-fix-potential-hang-in-nilfs_detach_log_writer.patch
  (git-fixes CVE-2024-38582 bsc#1226658).
- Update
  patches.suse/nilfs2-fix-use-after-free-of-timer-for-log-writer-th.patch
  (git-fixes CVE-2024-38583 bsc#1226777).
- Update
  patches.suse/of-module-add-buffer-overflow-check-in-of_modalias.patch
  (git-fixes CVE-2024-38541 bsc#1226587).
- Update
  patches.suse/padata-Fix-refcnt-handling-in-padata_free_shell.patch
  (git-fixes CVE-2023-52854 bsc#1225584).
- Update
  patches.suse/perf-core-Bail-out-early-if-the-request-AUX-area-is-out-of-bound.patch
  (git-fixes CVE-2023-52835 bsc#1225602).
- Update
  patches.suse/platform-x86-wmi-Fix-opening-of-char-device.patch
  (git-fixes CVE-2023-52864 bsc#1225132).
- Update
  patches.suse/powerpc-pseries-iommu-LPAR-panics-during-boot-up-wit.patch
  (bsc#1222011 ltc#205900 CVE-2024-36926 bsc#1225829).
- Update patches.suse/pstore-platform-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52869 bsc#1225050).
- Update
  patches.suse/remoteproc-mediatek-Make-sure-IPI-buffer-fits-in-L2T.patch
  (git-fixes CVE-2024-36965 bsc#1226149).
- Update
  patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch
  (git-fixes CVE-2024-38601 bsc#1226876).
- Update
  patches.suse/s390-dasd-protect-device-queue-against-concurrent-access.patch
  (git-fixes bsc#1217481 CVE-2023-52774 bsc#1225572).
- Update
  patches.suse/scsi-hisi_sas-Set-debugfs_dir-pointer-to-NULL-after-removing-debugfs.patch
  (git-fixes CVE-2023-52808 bsc#1225555).
- Update
  patches.suse/scsi-ibmvfc-Remove-BUG_ON-in-the-case-of-an-empty-ev.patch
  (bsc#1209834 ltc#202097 CVE-2023-52811 bsc#1225559).
- Update
  patches.suse/scsi-libfc-Fix-potential-NULL-pointer-dereference-in-fc_lport_ptp_setup.patch
  (git-fixes CVE-2023-52809 bsc#1225556).
- Update
  patches.suse/scsi-lpfc-Move-NPIV-s-transport-unregistration-to-af.patch
  (bsc#1221777 CVE-2024-36952 bsc#1225898).
- Update
  patches.suse/scsi-lpfc-Release-hbalock-before-calling-lpfc_worker.patch
  (bsc#1221777 CVE-2024-36924 bsc#1225820).
- Update
  patches.suse/serial-max3100-Lock-port-lock-when-calling-uart_hand.patch
  (git-fixes CVE-2024-38634 bsc#1226868).
- Update
  patches.suse/serial-max3100-Update-uart_driver_registered-on-driv.patch
  (git-fixes CVE-2024-38633 bsc#1226867).
- Update
  patches.suse/soc-qcom-llcc-Handle-a-second-device-without-data-co.patch
  (git-fixes CVE-2023-52871 bsc#1225534).
- Update
  patches.suse/soundwire-cadence-fix-invalid-PDI-offset.patch
  (stable-fixes CVE-2024-38635 bsc#1226863).
- Update patches.suse/speakup-Fix-sizeof-vs-ARRAY_SIZE-bug.patch
  (git-fixes CVE-2024-38587 bsc#1226780).
- Update patches.suse/spi-Fix-null-dereference-on-suspend.patch
  (git-fixes CVE-2023-52749 bsc#1225476).
- Update
  patches.suse/thermal-core-prevent-potential-string-overflow.patch
  (git-fixes CVE-2023-52868 bsc#1225044).
- Update
  patches.suse/thermal-drivers-qcom-lmh-Check-for-SCM-availability-.patch
  (git-fixes CVE-2024-39466 bsc#1227089).
- Update
  patches.suse/thermal-drivers-tsens-Fix-null-pointer-dereference.patch
  (git-fixes CVE-2024-38571 bsc#1226737).
- Update
  patches.suse/thermal-intel-powerclamp-fix-mismatch-in-get-functio.patch
  (git-fixes CVE-2023-52794 bsc#1225028).
- Update
  patches.suse/tls-fix-NULL-deref-on-tls_sw_splice_eof-with-empty-r.patch
  (jsc#PED-6831 CVE-2023-52767 bsc#1224998).
- Update
  patches.suse/tpm_tis_spi-Account-for-SPI-header-when-allocating-T.patch
  (git-fixes CVE-2024-36477 bsc#1226840).
- Update
  patches.suse/tracing-Have-trace_event_file-have-ref-counters.patch
  (git-fixes CVE-2023-52879 bsc#1225101).
- Update
  patches.suse/tracing-trigger-Fix-to-return-error-if-failed-to-alloc-snapshot.patch
  (git-fixes CVE-2024-26920).
- Update
  patches.suse/tty-n_gsm-fix-race-condition-in-status-line-change-o.patch
  (git-fixes CVE-2023-52872 bsc#1225591).
- Update
  patches.suse/tty-n_gsm-require-CAP_NET_ADMIN-to-attach-N_GSM0710-.patch
  (bsc#1222619 CVE-2023-52880).
- Update
  patches.suse/tty-vcc-Add-check-for-kstrdup-in-vcc_probe.patch
  (git-fixes CVE-2023-52789 bsc#1225180).
- Update
  patches.suse/usb-config-fix-iteration-issue-in-usb_get_bos_descri.patch
  (git-fixes CVE-2023-52781 bsc#1225092).
- Update
  patches.suse/usb-dwc3-Wait-unconditionally-after-issuing-EndXfer-.patch
  (git-fixes CVE-2024-36977 bsc#1226513).
- Update
  patches.suse/usb-gadget-u_audio-Fix-race-condition-use-of-control.patch
  (git-fixes CVE-2024-38628 bsc#1226911).
- Update
  patches.suse/usb-storage-alauda-Check-whether-the-media-is-initia.patch
  (git-fixes CVE-2024-38619 bsc#1226861).
- Update
  patches.suse/usb-typec-tcpm-Fix-NULL-pointer-dereference-in-tcpm_.patch
  (git-fixes CVE-2023-52877 bsc#1224944).
- Update
  patches.suse/vhost-vdpa-fix-use-after-free-in-vhost_vdpa_probe.patch
  (jsc#PED-3311 CVE-2023-52795 bsc#1225085).
- Update
  patches.suse/virtio-blk-fix-implicit-overflow-on-virtio_max_dma_s.patch
  (git-fixes CVE-2023-52762 bsc#1225573).
- Update
  patches.suse/virtio-vsock-Fix-uninit-value-in-virtio_transport_re.patch
  (jsc#PED-5505 CVE-2023-52842 bsc#1225025).
- Update
  patches.suse/watchdog-cpu5wdt.c-Fix-use-after-free-bug-caused-by-.patch
  (git-fixes CVE-2024-38630 bsc#1226908).
- Update
  patches.suse/wifi-ar5523-enable-proper-endpoint-verification.patch
  (git-fixes CVE-2024-38565 bsc#1226747).
- Update
  patches.suse/wifi-ath11k-fix-dfs-radar-event-locking.patch
  (git-fixes CVE-2023-52798 bsc#1224947).
- Update
  patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch
  (git-fixes CVE-2023-52777 bsc#1224992).
- Update patches.suse/wifi-ath11k-fix-htt-pktlog-locking.patch
  (git-fixes CVE-2023-52800).
- Update
  patches.suse/wifi-ath12k-fix-dfs-radar-and-temperature-event-lock.patch
  (git-fixes CVE-2023-52776 bsc#1225090).
- Update
  patches.suse/wifi-ath12k-fix-htt-mlo-offset-event-locking.patch
  (git-fixes CVE-2023-52769 bsc#1225001).
- Update
  patches.suse/wifi-ath12k-fix-out-of-bound-access-of-qmi_invoke_ha.patch
  (git-fixes CVE-2024-38572 bsc#1226776).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-read-in-ath12k.patch
  (git-fixes CVE-2023-52827 bsc#1225078).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-write-in-ath12.patch
  (git-fixes CVE-2023-52829 bsc#1225081).
- Update
  patches.suse/wifi-brcmfmac-pcie-handle-randbuf-allocation-failure.patch
  (git-fixes CVE-2024-38575 bsc#1226612).
- Update
  patches.suse/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch
  (git-fixes CVE-2024-38567 bsc#1226769).
- Update
  patches.suse/wifi-carl9170-re-fix-fortified-memset-warning.patch
  (git-fixes CVE-2024-38616 bsc#1226852).
- Update
  patches.suse/wifi-mac80211-don-t-return-unset-power-in-ieee80211_.patch
  (git-fixes CVE-2023-52832 bsc#1225577).
- Update
  patches.suse/wifi-nl80211-Avoid-address-calculations-via-out-of-b.patch
  (git-fixes CVE-2024-38562 bsc#1226788).
- Update
  patches.suse/wifi-wilc1000-use-vmm_table-as-array-in-wilc-struct.patch
  (git-fixes CVE-2023-52768 bsc#1225004).
- Update
  patches.suse/x86-tdx-Zero-out-the-missing-RSI-in-TDX_HYPERCALL-macro.patch
  (jsc#PED-5824 CVE-2023-52874 bsc#1225049).
- commit 33efdc4</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835204">- tcp: Use refcount_inc_not_zero() in tcp_twsk_unique()
  (CVE-2024-36904 bsc#1225732).
- commit d578dcc</changelog>
  <changelog author="heming.zhao@suse.com" date="1719921600">- gfs2: Fix potential glock use-after-free on unmount (bsc#1226775
  CVE-2024-38570).
- gfs2: Rename sd_{ glock =&gt; kill }_wait (bsc#1226775
  CVE-2024-38570).
- commit f3adbca</changelog>
  <changelog author="tiwai@suse.de" date="1719921601">- Correct SCSI patch references (bsc#1225767 CVE-2024-36919 bsc#1226785 CVE-2024-38559)
- commit e8ea587</changelog>
  <changelog author="tiwai@suse.de" date="1719921602">- mtd: rawnand: rockchip: ensure NVDDR timings are rejected
  (git-fixes).
- mtd: rawnand: Bypass a couple of sanity checks during NAND
  identification (git-fixes).
- mtd: rawnand: Fix the nand_read_data_op() early check
  (git-fixes).
- mtd: rawnand: Ensure ECC configuration is propagated to upper
  layers (git-fixes).
- commit e545951</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1719921603">- kernel-doc: fix struct_group_tagged() parsing (git-fixes).
- commit e3a2a2e</changelog>
  <changelog author="fdmanana@suse.com" date="1719921604">- btrfs: fix crash on racing fsync and size-extending write into
  prealloc (bsc#1227101 CVE-2024-37354).
- commit 1d355af</changelog>
  <changelog author="vbabka@suse.cz" date="1719921605">- virt: acrn: stop using follow_pfn (CVE-2024-38610 bsc#1226758).
- commit c2ea51b</changelog>
  <changelog author="vbabka@suse.cz" date="1719921606">- drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
  (CVE-2024-38610 bsc#1226758).
- commit 7069ac2</changelog>
  <changelog author="rhopkins@suse.de" date="1719921607">- hsr: Prevent use after free in prp_create_tagged_frame()
  (CVE-2023-52846 bsc#1225098).
- commit cf63988</changelog>
  <changelog author="krisman@suse.de" date="1719921608">- io_uring: Fix io_cqring_wait() not restoring sigmask on
  get_timespec64() failure (git-fixes).
- commit e640a65</changelog>
  <changelog author="krisman@suse.de" date="1719921609">- io_uring: check for non-NULL file pointer in io_file_can_poll()
  (bsc#1226990 CVE-2024-39371).
- io_uring/io-wq: Use set_bit() and test_bit() at worker-&gt;flags
  (git-fixes).
- io_uring/sqpoll: work around a potential audit memory leak
  (git-fixes).
- commit 24603fc</changelog>
  <changelog author="krisman@suse.de" date="1719921610">- io_uring/rsrc: fix incorrect assignment of iter-&gt;nr_segs in
  io_import_fixed (git-fixes).
- io_uring/rsrc: don't lock while !TASK_RUNNING (git-fixes).
- io_uring/io-wq: avoid garbage value of 'match' in
  io_wq_enqueue() (git-fixes).
- commit 7d3e252</changelog>
</package>
<package pkgid="4f5d295e1449a9f97d7591d011ffd2c404d5eee765cc30f228bd2ad45b6fe341" name="dtb-qcom" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.17.1"/>
  <changelog author="tiwai@suse.de" date="1722081600">- auxdisplay: ht16k33: Drop reference after LED registration
  (git-fixes).
- ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
  on unprepare (git-fixes).
- ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
- ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
  reachable (git-fixes).
- ASoC: sof: amd: fix for firmware reload failure in Vangogh
  platform (git-fixes).
- ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
- ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
  (git-fixes).
- ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
- ALSA: ump: Don't update FB name for static blocks (git-fixes).
- drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
- drm/i915/gt: Do not consider preemption during execlists_dequeue
  for gen8 (git-fixes).
- drm/i915/dp: Don't switch the LTTPR mode on an active link
  (git-fixes).
- commit d7e2deb</changelog>
  <changelog author="tiwai@suse.de" date="1722081601">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
</package>
<package pkgid="1d0ef18548d212634da0053e9908f47b68fc66dc8f357164a7f73a4b875b9842" name="dtb-qcom" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.7.1"/>
  <changelog author="mkubecek@suse.cz" date="1717416000">- netfilter: nf_tables: release mutex after nft_gc_seq_end from
  abort path (CVE-2024-26925 bsc#1223390).
- commit 578a709</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717416001">- Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
  The L3 bsc#1225765 was created seperately since our customer requires
  PTF.
- Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
- Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
- Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
- Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
- commit 054635e</changelog>
  <changelog author="msuchanek@suse.de" date="1717416002">- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
- powerpc/uaccess: Fix build errors seen with GCC 13/14
  (bsc#1194869).
- commit 46b5d84</changelog>
  <changelog author="msuchanek@suse.de" date="1717416003">- blacklist.conf: PPC fsl_msi is not used
- commit ae6590d</changelog>
  <changelog author="msuchanek@suse.de" date="1717416004">- powerpc/pseries/lparcfg: drop error message from guest name
  lookup (bsc#1187716 ltc#193451 git-fixes).
- commit ceab637</changelog>
  <changelog author="mfranc@suse.cz" date="1717416005">- Update
  patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
  (git-fixes CVE-2024-36955).
- Update
  patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
  (git-fixes bsc#1225715 CVE-2024-36906).
- Update
  patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
  (git-fixes bsc#1225579 CVE-2024-36011).
- Update
  patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
  (git-fixes bsc#1225578 CVE-2024-36013).
- Update
  patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
  (git-fixes bsc#1225502 CVE-2024-36012).
- Update
  patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
  (git-fixes bsc#1225722 CVE-2024-36880).
- Update
  patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
  (git-fixes CVE-2024-36942).
- Update
  patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
  (git-fixes bsc#1225720 CVE-2024-36032).
- Update
  patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
  (git-fixes bsc#1223749 CVE-2024-26990).
- Update
  patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
  (git-fixes bsc#1223692 CVE-2024-26992).
- Update
  patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
  (stable-fixes CVE-2024-36944).
- Update
  patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
  (git-fixes bsc#1225734 CVE-2024-36896).
- Update
  patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
  (stable-fixes CVE-2024-36949).
- Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
  (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
- Update
  patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
  (git-fixes bsc#1225692 CVE-2023-52882).
- Update
  patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
  (git-fixes CVE-2024-26761).
- Update
  patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
  (stable-fixes bsc#1225735 CVE-2024-36897).
- Update
  patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
  (stable-fixes bsc#1225705 CVE-2024-36026).
- Update
  patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
  (stable-fixes CVE-2024-36951).
- Update
  patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
  (git-fixes bsc#1225593 CVE-2024-36014).
- Update
  patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
  (stable-fixes bsc#1225728 CVE-2024-36885).
- Update
  patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
  (git-fixes bsc#1225773 CVE-2024-36936).
- Update
  patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
  (stable-fixes CVE-2024-36950).
- Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
  (git-fixes bsc#1225736 CVE-2024-36898).
- Update
  patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
  (git-fixes bsc#1225698 CVE-2024-36020).
- Update
  patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
  (git-fixes bsc#1225710 CVE-2024-36891).
- Update
  patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
  (git-fixes bsc#1225714 CVE-2024-36890).
- Update
  patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
  (git-fixes bsc#1225708 CVE-2024-36029).
- Update
  patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
  (git-fixes bsc#1225699 CVE-2024-36021).
- Update
  patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
  (git-fixes CVE-2024-26943).
- Update
  patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
  (git-fixes bsc#1225694 CVE-2024-36018).
- Update
  patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
  (git-fixes CVE-2024-36940).
- Update
  patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
  (git-fixes CVE-2024-36959).
- Update
  patches.suse/ppdev-Add-an-error-check-in-register_device.patch
  (git-fixes bsc#1225640 CVE-2024-36015).
- Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
  CVE-2024-36947).
- Update
  patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
  (git-fixes bsc#1225695 CVE-2024-36019).
- Update
  patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
  (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
- Update
  patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
  (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
- Update
  patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
  (git-fixes bsc#1225704 CVE-2024-36025).
- Update
  patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
  (git-fixes CVE-2024-36930).
- Update
  patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
  (bsc#1224331 bsc#1224602 CVE-2024-35814).
- Update
  patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
  (git-fixes bsc#1225642 CVE-2024-36016).
- Update
  patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
  (git-fixes bsc#1225749 CVE-2024-36894).
- Update
  patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
  (git-fixes bsc#1225750 CVE-2024-36895).
- Update
  patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
  (git-fixes bsc#1225748 CVE-2024-36893).
- Update
  patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
  (stable-fixes bsc#1225769 CVE-2024-36921).
- Update
  patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
  (stable-fixes CVE-2024-36922).
- Update
  patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
  (git-fixes CVE-2024-36941).
- Update
  patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
  (git-fixes bsc#1224742 CVE-2024-35803).
- commit 539780f</changelog>
  <changelog author="dwagner@suse.de" date="1717416006">- nvmet: fix ns enable/disable possible hang (git-fixes).
- nvme-multipath: fix io accounting on failover (git-fixes).
- nvme: fix multipath batched completion accounting (git-fixes).
- commit ed3b392</changelog>
  <changelog author="dwagner@suse.de" date="1717416007">- scsi: lpfc: Copyright updates for 14.4.0.2 patches
  (bsc#1225842).
- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
  (bsc#1225842).
  Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
  (bsc#1225842).
- scsi: lpfc: Clear deferred RSCN processing flag when driver
  is unloading (bsc#1225842).
- scsi: lpfc: Update logging of protection type for T10 DIF I/O
  (bsc#1225842).
- scsi: lpfc: Change default logging level for unsolicited CT
  MIB commands (bsc#1225842).
- commit 5a56384</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416008">- smb: client: fix mount when dns_resolver key is not available
  (git-fixes, bsc#1225172).
- commit 28edb5c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416009">- cifs: fix leak of iface for primary channel (git-fixes,
  bsc#1225172).
- commit b7eb8e8</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416010">- Revert "cifs: reconnect work should have reference on server
  struct" (git-fixes, bsc#1225172).
- commit 3ca4c0c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416011">- smb: client: fix parsing of SMB3.1.1 POSIX create context
  (git-fixes, bsc#1225172).
- commit 5f27f69</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416012">- cifs: failure to add channel on iface should bump up weight
  (git-fixes, bsc#1225172).
- commit 007b237</changelog>
  <changelog author="tonyj@suse.de" date="1717416013">- perf/x86: Fix out of range data (git-fixes).
- perf/x86/intel/ds: Don't clear -&gt;pebs_data_cfg for the last
  PEBS event (git-fixes).
- perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
- commit 664d77f</changelog>
  <changelog author="dsterba@suse.com" date="1717588800">- blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
- Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
  Quoting bsc#1225945#c11:
  "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
  transaction for every subvol create")
  ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
  unwritten extent buffer after snapshotting a new subvolume") was never
  backported."
- commit d947258</changelog>
  <changelog author="tonyj@suse.de" date="1717588801">- perf pmu: Count sys and cpuid JSON events separately (git
  fixes).
- perf stat: Don't display metric header for non-leader uncore
  events (git-fixes).
- perf daemon: Fix file leak in daemon_session__control
  (git-fixes).
- perf symbols: Fix ownership of string in dso__load_vmlinux()
  (git-fixes).
- perf thread: Fixes to thread__new() related to initializing comm
  (git-fixes).
- perf report: Avoid SEGV in report__setup_sample_type()
  (git-fixes).
- perf ui browser: Don't save pointer to stack memory (git-fixes).
- perf bench internals inject-build-id: Fix trap divide when
  collecting just one DSO (git-fixes).
- perf intel-pt: Fix unassigned instruction op (discovered by
  MemorySanitizer) (git-fixes).
- perf test shell arm_coresight: Increase buffer size for
  Coresight basic tests (git-fixes).
- perf docs: Document bpf event modifier (git-fixes).
- perf bench uprobe: Remove lib64 from libc.so.6 binary path
  (git-fixes).
- perf record: Fix debug message placement for test consumption
  (git-fixes).
- perf tests: Apply attributes to all events in object code
  reading test (git-fixes).
- perf tests: Make "test data symbol" more robust on Neoverse N1
  (git-fixes).
- perf annotate: Fix annotation_calc_lines() to pass correct
  address to get_srcline() (git-fixes).
- perf stat: Do not fail on metrics on s390 z/VM systems
  (git-fixes).
- perf sched timehist: Fix -g/--call-graph option failure
  (git-fixes).
- perf annotate: Get rid of duplicate --group option item
  (git-fixes).
- perf probe: Add missing libgen.h header needed for using
  basename() (git-fixes).
- perf record: Delete session after stopping sideband thread
  (git-fixes).
- perf auxtrace: Fix multiple use of --itrace option (git-fixes).
- perf script: Show also errors for --insn-trace option
  (git-fixes).
- perf lock contention: Add a missing NULL check (git-fixes).
- perf vendor events amd: Fix Zen 4 cache latency events
  (git-fixes).
- libperf evlist: Avoid out-of-bounds access (git-fixes).
- perf pmu: Fix a potential memory leak in perf_pmu__lookup()
  (git-fixes).
- perf print-events: make is_event_supported() more robust
  (git-fixes).
- perf list: fix short description for some cache events
  (git-fixes).
- perf metric: Don't remove scale from counts (git-fixes).
- perf stat: Avoid metric-only segv (git-fixes).
- perf expr: Fix "has_event" function for metric style events
  (git-fixes).
- perf srcline: Add missed addr2line closes (git-fixes).
- perf thread_map: Free strlist on normal path in
  thread_map__new_by_tid_str() (git-fixes).
- perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
- perf jevents: Drop or simplify small integer values (git-fixes).
- perf evsel: Fix duplicate initialization of data-&gt;id in
  evsel__parse_sample() (git-fixes).
- perf pmu: Treat the msr pmu as software (git-fixes).
- perf record: Check conflict between '--timestamp-filename'
  option and pipe mode before recording (git-fixes).
- perf record: Fix possible incorrect free in
  record__switch_output() (git-fixes).
- perf vendor events amd: Add Zen 4 memory controller events
  (git-fixes).
- perf top: Uniform the event name for the hybrid machine
  (git-fixes).
- perf top: Use evsel's cpus to replace user_requested_cpus
  (git-fixes).
- commit a1f9340</changelog>
  <changelog author="tonyj@suse.de" date="1717675200">- perf ui browser: Avoid SEGV on title (git fixes).
- commit 1578c22</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675201">- inet: inet_defrag: prevent sk release while still in use
  (CVE-2024-26921 bsc#1223138).
- commit 2016faf</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675202">- net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
- commit 7bf5961</changelog>
  <changelog author="tiwai@suse.de" date="1718366400">- Temporarily drop KVM patch that caused a regression (bsc#1226158)
  Delete patches.suse/KVM-x86-pmu-Prioritize-VMX-interception-over-GP-on-R.patch
- commit 33f31da</changelog>
</package>
<package pkgid="071a89786cd403f70136efd65b6fc6f267e6c9f2bed1a7c614f2cadfc3b2dae3" name="dtb-renesas" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.14.1"/>
  <changelog author="tiwai@suse.de" date="1719662400">- gpiolib: cdev: Disallow reconfiguration without direction
  (uAPI v1) (git-fixes).
- gpio: davinci: Validate the obtained number of IRQs (git-fixes).
- commit 919ebd1</changelog>
  <changelog author="tiwai@suse.de" date="1719748800">- i2c: testunit: discard write requests while old command is
  running (git-fixes).
- i2c: testunit: don't erase registers after STOP (git-fixes).
- mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
  (git-fixes).
- mmc: sdhci: Do not invert write-protect twice (git-fixes).
- mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
  (git-fixes).
- mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
  (git-fixes).
- commit 448487d</changelog>
  <changelog author="tiwai@suse.de" date="1719748801">- crypto: iaa - Account for cpu-less numa nodes (bsc#1227190).
- commit cd600aa</changelog>
  <changelog author="tiwai@suse.de" date="1719748802">- crypto: deflate - Add aliases to deflate (bsc#1227190).
- commit 27ffd92</changelog>
  <changelog author="tiwai@suse.de" date="1719835200">- ata: ahci: Clean up sysfs file on error (git-fixes).
- ata: libata-core: Fix double free on error (git-fixes).
- ata,scsi: libata-core: Do not leak memory for ata_port struct
  members (git-fixes).
- ata: libata-core: Fix null pointer dereference on error
  (git-fixes).
- kbuild: Fix build target deb-pkg: ln: failed to create hard link
  (git-fixes).
- kbuild: doc: Update default INSTALL_MOD_DIR from extra to
  updates (git-fixes).
- kbuild: Install dtb files as 0644 in Makefile.dtbinst
  (git-fixes).
- counter: ti-eqep: enable clock at probe (git-fixes).
- iio: chemical: bme680: Fix sensor data read operation
  (git-fixes).
- iio: chemical: bme680: Fix overflows in compensate() functions
  (git-fixes).
- iio: chemical: bme680: Fix calibration data variable
  (git-fixes).
- iio: chemical: bme680: Fix pressure value output (git-fixes).
- iio: accel: fxls8962af: select IIO_BUFFER &amp; IIO_KFIFO_BUF
  (git-fixes).
- iio: adc: ad7266: Fix variable checking bug (git-fixes).
- iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
  (git-fixes).
- serial: bcm63xx-uart: fix tx after conversion to
  uart_port_tx_limited() (git-fixes).
- serial: core: introduce uart_port_tx_limited_flags()
  (git-fixes).
- Revert "serial: core: only stop transmit when HW fifo is empty"
  (git-fixes).
- tty: mcf: MCF54418 has 10 UARTS (git-fixes).
- usb: gadget: aspeed_udc: fix device address configuration
  (git-fixes).
- usb: dwc3: core: remove lock of otg mode during gadget
  suspend/resume to avoid deadlock (git-fixes).
- usb: typec: ucsi: glink: fix child node release in probe
  function (git-fixes).
- usb: musb: da8xx: fix a resource leak in probe() (git-fixes).
- usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  (git-fixes).
- usb: gadget: printer: fix races against disable (git-fixes).
- PCI/MSI: Fix UAF in msi_capability_init (git-fixes).
- commit a2ea5a9</changelog>
  <changelog author="ptesarik@suse.com" date="1719835201">- net: ena: Fix redundant device NUMA node override
  (jsc#PED-8688).
- commit 6ad6684</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835202">- tcp: do not accept ACK of bytes we never sent (CVE-2023-52881
  bsc#1225611).
- commit 16404a6</changelog>
  <changelog author="mhocko@suse.com" date="1719835203">- Update
  patches.suse/1352-drm-amdgpu-Fix-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52883
  bsc#1226630).
- Update
  patches.suse/9p-add-missing-locking-around-taking-dentry-fid-list.patch
  (git-fixes CVE-2024-39463 bsc#1227090).
- Update
  patches.suse/ALSA-Fix-deadlocks-with-kctl-removals-at-disconnecti.patch
  (stable-fixes CVE-2024-38600 bsc#1226864).
- Update
  patches.suse/ALSA-core-Fix-NULL-module-pointer-assignment-at-card.patch
  (git-fixes CVE-2024-38605 bsc#1226740).
- Update
  patches.suse/ALSA-hda-Fix-possible-null-ptr-deref-when-assigning-.patch
  (git-fixes CVE-2023-52806 bsc#1225554).
- Update
  patches.suse/ALSA-hda-cs_dsp_ctl-Use-private_free-for-control-cle.patch
  (git-fixes CVE-2024-38388 bsc#1226890).
- Update
  patches.suse/ALSA-timer-Set-lower-bound-of-start-tick-time.patch
  (stable-fixes git-fixes CVE-2024-38618 bsc#1226754).
- Update
  patches.suse/ASoC-kirkwood-Fix-potential-NULL-dereference.patch
  (git-fixes CVE-2024-38550 bsc#1226633).
- Update
  patches.suse/ASoC-mediatek-Assign-dummy-when-codec-not-specified-.patch
  (git-fixes CVE-2024-38551 bsc#1226761).
- Update
  patches.suse/Bluetooth-btusb-Add-date-evt_skb-is-NULL-check.patch
  (git-fixes CVE-2023-52833 bsc#1225595).
- Update
  patches.suse/Bluetooth-hci_core-Fix-possible-buffer-overflow.patch
  (git-fixes CVE-2024-26889).
- Update
  patches.suse/HID-uclogic-Fix-user-memory-access-bug-in-uclogic_pa.patch
  (git-fixes CVE-2023-52866 bsc#1225120).
- Update
  patches.suse/IB-mlx5-Fix-init-stage-error-handling-to-avoid-doubl.patch
  (jsc#PED-6864 CVE-2023-52851 bsc#1225587).
- Update
  patches.suse/Input-cyapa-add-missing-input-core-locking-to-suspen.patch
  (git-fixes CVE-2023-52884 bsc#1226764).
- Update
  patches.suse/Input-synaptics-rmi4-fix-use-after-free-in-rmi_unreg.patch
  (git-fixes CVE-2023-52840 bsc#1224928).
- Update
  patches.suse/KEYS-trusted-Do-not-use-WARN-when-encode-fails.patch
  (git-fixes CVE-2024-36975 bsc#1226520).
- Update
  patches.suse/KEYS-trusted-Fix-memory-leak-in-tpm2_key_encode.patch
  (git-fixes CVE-2024-36967 bsc#1226131).
- Update
  patches.suse/RDMA-cma-Fix-kmemleak-in-rdma_core-observed-during-b.patch
  (git-fixes CVE-2024-38539 bsc#1226608).
- Update patches.suse/RDMA-hns-Fix-UAF-for-cq-async-event.patch
  (git-fixes CVE-2024-38545 bsc#1226595).
- Update
  patches.suse/RDMA-hns-Fix-deadlock-on-SRQ-async-events.patch
  (git-fixes CVE-2024-38591 bsc#1226738).
- Update
  patches.suse/RDMA-hns-Modify-the-print-level-of-CQE-error.patch
  (git-fixes CVE-2024-38590 bsc#1226839).
- Update
  patches.suse/RDMA-rxe-Fix-seg-fault-in-rxe_comp_queue_pkt.patch
  (git-fixes CVE-2024-38544 bsc#1226597).
- Update
  patches.suse/SUNRPC-Fix-RPC-client-cleaned-up-the-freed-pipefs-de.patch
  (git-fixes CVE-2023-52803 bsc#1225008).
- Update patches.suse/af_unix-Clear-stale-u-oob_skb.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-35970 bsc#1224584).
- Update
  patches.suse/af_unix-Drop-oob_skb-ref-before-purging-queue-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26750 bsc#1222617).
- Update
  patches.suse/af_unix-Fix-task-hung-while-purging-oob_skb-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26780 bsc#1222588).
- Update
  patches.suse/af_unix-Update-unix_sk-sk-oob_skb-under-sk_receive_queue-lock.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-36972 bsc#1226163).
- Update
  patches.suse/arm64-Restrict-CPU_BIG_ENDIAN-to-GNU-as-or-LLVM-IAS-.patch
  (git-fixes CVE-2023-52750 bsc#1225485).
- Update
  patches.suse/atl1c-Work-around-the-DMA-RX-overflow-issue.patch
  (git-fixes CVE-2023-52834 bsc#1225599).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issue-of-net_device.patch
  (git-fixes CVE-2024-38554 bsc#1226742).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issues-of-ax25_dev.patch
  (git-fixes CVE-2024-38602 bsc#1226613).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-reorder-of-WRITE-lqueued.patch
  (bsc#1225605 CVE-2024-38384 bsc#1226938).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-resetting-io-stat.patch
  (bsc#1225605 CVE-2024-38663 bsc#1226939).
- Update
  patches.suse/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch
  (git-fixes CVE-2024-38540 bsc#1226582).
- Update
  patches.suse/bonding-stop-the-device-in-bond_setup_by_slave.patch
  (git-fixes CVE-2023-52784 bsc#1224946).
- Update
  patches.suse/can-dev-can_put_echo_skb-don-t-crash-kernel-if-can_p.patch
  (git-fixes CVE-2023-52878 bsc#1225000).
- Update
  patches.suse/clk-mediatek-clk-mt2701-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52875 bsc#1225096).
- Update
  patches.suse/clk-mediatek-clk-mt6765-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52870 bsc#1224937).
- Update
  patches.suse/clk-mediatek-clk-mt6779-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52873 bsc#1225589).
- Update
  patches.suse/clk-mediatek-clk-mt6797-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52865 bsc#1225086).
- Update
  patches.suse/clk-mediatek-clk-mt7629-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52858 bsc#1225566).
- Update
  patches.suse/clk-mediatek-clk-mt7629-eth-Add-check-for-mtk_alloc_.patch
  (git-fixes CVE-2023-52876 bsc#1225036).
- Update
  patches.suse/cppc_cpufreq-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38573 bsc#1226739).
- Update patches.suse/cpufreq-exit-callback-is-optional.patch
  (git-fixes CVE-2024-38615 bsc#1226592).
- Update patches.suse/crypto-bcm-Fix-pointer-arithmetic.patch
  (git-fixes CVE-2024-38579 bsc#1226637).
- Update
  patches.suse/crypto-pcrypt-Fix-hungtask-for-PADATA_RESET.patch
  (git-fixes CVE-2023-52813 bsc#1225527).
- Update patches.suse/cxl-mem-Fix-shutdown-order.patch (git-fixes
  CVE-2023-52849 bsc#1224949).
- Update
  patches.suse/cxl-region-Do-not-try-to-cleanup-after-cxl_region_se.patch
  (git-fixes CVE-2023-52792 bsc#1225477).
- Update patches.suse/cxl-region-Fix-cxlr_pmem-leaks.patch
  (git-fixes CVE-2024-38391 bsc#1226894).
- Update
  patches.suse/dma-buf-sw-sync-don-t-enable-IRQ-from-sync_print_obj.patch
  (git-fixes CVE-2024-38780 bsc#1226886).
- Update
  patches.suse/dma-mapping-benchmark-fix-node-id-validation.patch
  (git-fixes CVE-2024-34777 bsc#1226796).
- Update
  patches.suse/dma-mapping-benchmark-handle-NUMA_NO_NODE-correctly.patch
  (git-fixes CVE-2024-39277 bsc#1226909).
- Update
  patches.suse/dmaengine-idxd-Avoid-unnecessary-destruction-of-file.patch
  (git-fixes CVE-2024-38629 bsc#1226905).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Pola.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52819
  bsc#1225532).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-SMU7.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52818
  bsc#1225530).
- Update
  patches.suse/drm-amd-check-num-of-link-levels-when-update-pcie-pa.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52812
  bsc#1225564).
- Update
  patches.suse/drm-amd-display-Avoid-NULL-dereference-of-timing-gen.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52753
  bsc#1225478).
- Update
  patches.suse/drm-amd-display-Fix-division-by-zero-in-setup_dsc_co.patch
  (stable-fixes CVE-2024-36969 bsc#1226155).
- Update
  patches.suse/drm-amd-display-Fix-null-pointer-dereference-in-erro.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52862
  bsc#1225015).
- Update
  patches.suse/drm-amd-display-Fix-potential-index-out-of-bounds-in.patch
  (git-fixes CVE-2024-38552 bsc#1226767).
- Update
  patches.suse/drm-amd-display-fix-a-NULL-pointer-dereference-in-am.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52773
  bsc#1225041).
- Update
  patches.suse/drm-amd-display-fixed-integer-types-and-null-check-l.patch
  (git-fixes CVE-2024-26767).
- Update
  patches.suse/drm-amdgpu-Fix-a-null-pointer-access-when-the-smc_rr.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52817
  bsc#1225569).
- Update
  patches.suse/drm-amdgpu-Fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch
  (git-fixes CVE-2024-39291 bsc#1226934).
- Update
  patches.suse/drm-amdgpu-Fix-potential-null-pointer-derefernce.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52814
  bsc#1225565).
- Update
  patches.suse/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch
  (stable-fixes CVE-2024-39471 bsc#1227096).
- Update
  patches.suse/drm-amdgpu-mes-fix-use-after-free-issue.patch
  (stable-fixes CVE-2024-38581 bsc#1226657).
- Update
  patches.suse/drm-amdgpu-vkms-fix-a-possible-null-pointer-derefere.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52815
  bsc#1225568).
- Update
  patches.suse/drm-amdkfd-Fix-a-race-condition-of-vram-buffer-unref.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52825
  bsc#1225076).
- Update
  patches.suse/drm-amdkfd-Fix-shift-out-of-bounds-issue.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52816
  bsc#1225529).
- Update
  patches.suse/drm-bridge-cdns-mhdp8546-Fix-possible-null-pointer-d.patch
  (git-fixes CVE-2024-38548).
- Update
  patches.suse/drm-bridge-it66121-Fix-invalid-connector-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52861
  bsc#1224941).
- Update
  patches.suse/drm-bridge-lt8912b-Fix-crash-on-bridge-detach.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52856
  bsc#1224932).
- Update
  patches.suse/drm-mediatek-Add-0-size-check-to-mtk_drm_gem_obj.patch
  (git-fixes CVE-2024-38549 bsc#1226735).
- Update
  patches.suse/drm-mediatek-Fix-coverity-issue-with-unintentional-i.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52857
  bsc#1225581).
- Update
  patches.suse/drm-mediatek-Init-ddp_comp-with-devm_kcalloc.patch
  (git-fixes CVE-2024-38592 bsc#1226844).
- Update
  patches.suse/drm-msm-a6xx-Avoid-a-nullptr-dereference-when-speedb.patch
  (git-fixes CVE-2024-38390 bsc#1226891).
- Update
  patches.suse/drm-msm-dpu-Add-callback-function-pointer-check-befo.patch
  (git-fixes CVE-2024-38622 bsc#1226856).
- Update
  patches.suse/drm-panel-fix-a-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52821
  bsc#1225022).
- Update
  patches.suse/drm-panel-panel-tpo-tpg110-fix-a-possible-null-point.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52826
  bsc#1225077).
- Update patches.suse/drm-radeon-possible-buffer-overflow.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52867
  bsc#1225009).
- Update
  patches.suse/drm-vc4-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38546 bsc#1226593).
- Update
  patches.suse/drm-vmwgfx-Fix-invalid-reads-in-fence-signaled-event.patch
  (git-fixes CVE-2024-36960 bsc#1225872).
- Update
  patches.suse/drm-zynqmp_dpsub-Always-register-bridge.patch
  (git-fixes CVE-2024-38664 bsc#1226941).
- Update
  patches.suse/e1000e-change-usleep_range-to-udelay-in-PHY-mdic-acc.patch
  (CVE-2024-39296 bsc#1226989 CVE-2024-36887 bsc#1225731).
- Update
  patches.suse/ecryptfs-Fix-buffer-size-for-tag-66-packet.patch
  (git-fixes CVE-2024-38578 bsc#1226634).
- Update
  patches.suse/efi-libstub-only-free-priv.runtime_map-when-allocate.patch
  (git-fixes CVE-2024-33619 bsc#1226768).
- Update
  patches.suse/fbdev-imsttfb-fix-a-resource-leak-in-probe.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52838
  bsc#1225031).
- Update
  patches.suse/fs-9p-only-translate-RWX-permissions-for-plain-9P200.patch
  (git-fixes CVE-2024-36964 bsc#1225866).
- Update
  patches.suse/fs-jfs-Add-check-for-negative-db_l2nbperpage.patch
  (git-fixes CVE-2023-52810 bsc#1225557).
- Update
  patches.suse/fs-jfs-Add-validity-check-for-db_maxag-and-db_agpref.patch
  (git-fixes CVE-2023-52804 bsc#1225550).
- Update
  patches.suse/ftrace-Fix-possible-use-after-free-issue-in-ftrace_location.patch
  (git-fixes CVE-2024-38588 bsc#1226837).
- Update
  patches.suse/genirq-irqdesc-Prevent-use-after-free-in-irq_find_at.patch
  (git-fixes CVE-2024-38385 bsc#1227085).
- Update patches.suse/gfs2-ignore-negated-quota-changes.patch
  (git-fixes CVE-2023-52759 bsc#1225560).
- Update
  patches.suse/hid-cp2112-Fix-duplicate-workqueue-initialization.patch
  (git-fixes CVE-2023-52853 bsc#1224988).
- Update
  patches.suse/hwmon-axi-fan-control-Fix-possible-NULL-pointer-dere.patch
  (git-fixes CVE-2023-52863 bsc#1225586).
- Update
  patches.suse/i2c-acpi-Unbind-mux-adapters-before-delete.patch
  (git-fixes CVE-2024-39362 bsc#1226995).
- Update
  patches.suse/i2c-core-Run-atomic-i2c-xfer-when-preemptible.patch
  (git-fixes CVE-2023-52791 bsc#1225108).
- Update
  patches.suse/i3c-master-mipi-i3c-hci-Fix-a-kernel-panic-for-acces.patch
  (git-fixes CVE-2023-52763 bsc#1225570).
- Update
  patches.suse/i3c-mipi-i3c-hci-Fix-out-of-bounds-access-in-hci_dma.patch
  (git-fixes CVE-2023-52766).
- Update
  patches.suse/i915-perf-Fix-NULL-deref-bugs-with-drm_dbg-calls.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52788
  bsc#1225106).
- Update
  patches.suse/igb-Fix-string-truncation-warnings-in-igb_set_fw_ver.patch
  (git-fixes CVE-2024-36010 bsc#1225594).
- Update
  patches.suse/iommu-vt-d-Fix-WARN_ON-in-iommu-probe-path.patch
  (git-fixes CVE-2024-35957 bsc#1224673).
- Update
  patches.suse/iommufd-Fix-missing-update-of-domains_itree-after-splitting-iopt
  (jsc#PED-7779 jsc#PED-7780 CVE-2023-52801 bsc#1225006).
- Update
  patches.suse/ipvlan-add-ipvlan_route_v6_outbound-helper.patch
  (git-fixes CVE-2023-52796 bsc#1224930).
- Update
  patches.suse/jffs2-prevent-xattr-node-from-overflowing-the-eraseblock.patch
  (git-fixes CVE-2024-38599 bsc#1226848).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-dbFindLeaf.patch
  (git-fixes CVE-2023-52799 bsc#1225472).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-diAlloc.patch
  (git-fixes CVE-2023-52805 bsc#1225553).
- Update
  patches.suse/kunit-fortify-Fix-mismatched-kvalloc-vfree-usage.patch
  (git-fixes CVE-2024-38617 bsc#1226859).
- Update
  patches.suse/lib-generic-radix-tree.c-Don-t-overflow-in-peek.patch
  (git-fixes CVE-2021-47432 bsc#1225391).
- Update
  patches.suse/lib-test_hmm.c-handle-src_pfns-and-dst_pfns-allocati.patch
  (git-fixes CVE-2024-38543 bsc#1226594).
- Update
  patches.suse/locking-ww_mutex-test-Fix-potential-workqueue-corrup.patch
  (bsc#1219953 CVE-2023-52836 bsc#1225609).
- Update
  patches.suse/md-Don-t-ignore-suspended-array-in-md_check_recovery-1baa.patch
  (bsc#1219596 CVE-2024-26758).
- Update
  patches.suse/media-atomisp-ssh_css-Fix-a-null-pointer-dereference.patch
  (git-fixes CVE-2024-38547 bsc#1226632).
- Update
  patches.suse/media-bttv-fix-use-after-free-error-due-to-btv-timeo.patch
  (git-fixes CVE-2023-52847 bsc#1225588).
- Update
  patches.suse/media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch
  (git-fixes CVE-2023-52764 bsc#1225571).
- Update
  patches.suse/media-hantro-Check-whether-reset-op-is-defined-befor.patch
  (git-fixes CVE-2023-52850 bsc#1225014).
- Update
  patches.suse/media-i2c-et8ek8-Don-t-strip-remove-function-when-dr.patch
  (git-fixes CVE-2024-38611 bsc#1226760).
- Update
  patches.suse/media-imon-fix-access-to-invalid-resource-for-the-se.patch
  (git-fixes CVE-2023-52754 bsc#1225490).
- Update
  patches.suse/media-lgdt3306a-Add-a-check-against-null-pointer-def.patch
  (stable-fixes CVE-2022-48772 bsc#1226976).
- Update
  patches.suse/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch
  (git-fixes CVE-2024-38621 bsc#1226895).
- Update
  patches.suse/media-vidtv-mux-Add-check-and-kfree-for-kstrdup.patch
  (git-fixes CVE-2023-52841 bsc#1225592).
- Update patches.suse/media-vidtv-psi-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52844 bsc#1225590).
- Update
  patches.suse/mfd-qcom-spmi-pmic-Fix-revid-implementation.patch
  (git-fixes CVE-2023-52765 bsc#1225029).
- Update
  patches.suse/misc-microchip-pci1xxxx-fix-double-free-in-the-error.patch
  (git-fixes CVE-2024-36973 bsc#1226457).
- Update
  patches.suse/net-hns3-fix-out-of-bounds-access-may-occur-when-coa.patch
  (git-fixes CVE-2023-52807 bsc#1225097).
- Update
  patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch
  (git-fixes CVE-2024-36962 bsc#1225827).
- Update
  patches.suse/net-mlx5-Fix-peer-devlink-set-for-SF-representor-dev.patch
  (git-fixes CVE-2024-38595 bsc#1226741).
- Update
  patches.suse/net-mlx5e-Track-xmit-submission-to-PTP-WQ-after-popu.patch
  (jsc#PED-3311 CVE-2023-52782 bsc#1225103).
- Update
  patches.suse/net-mvneta-fix-calls-to-page_pool_get_stats.patch
  (git-fixes CVE-2023-52780 bsc#1224933).
- Update
  patches.suse/net-wangxun-fix-kernel-panic-due-to-null-pointer.patch
  (git-fixes CVE-2023-52783 bsc#1225104).
- Update
  patches.suse/netfilter-complete-validation-of-user-input.patch
  (git-fixes CVE-2024-35896 bsc#1224662 CVE-2024-35962
  bsc#1224583).
- Update
  patches.suse/nfc-nci-Fix-uninit-value-in-nci_rx_work.patch
  (git-fixes CVE-2024-38381 bsc#1226878).
- Update
  patches.suse/nilfs2-fix-nilfs_empty_dir-misjudgment-and-long-loop.patch
  (git-fixes CVE-2024-39469 bsc#1226992).
- Update
  patches.suse/nilfs2-fix-potential-hang-in-nilfs_detach_log_writer.patch
  (git-fixes CVE-2024-38582 bsc#1226658).
- Update
  patches.suse/nilfs2-fix-use-after-free-of-timer-for-log-writer-th.patch
  (git-fixes CVE-2024-38583 bsc#1226777).
- Update
  patches.suse/of-module-add-buffer-overflow-check-in-of_modalias.patch
  (git-fixes CVE-2024-38541 bsc#1226587).
- Update
  patches.suse/padata-Fix-refcnt-handling-in-padata_free_shell.patch
  (git-fixes CVE-2023-52854 bsc#1225584).
- Update
  patches.suse/perf-core-Bail-out-early-if-the-request-AUX-area-is-out-of-bound.patch
  (git-fixes CVE-2023-52835 bsc#1225602).
- Update
  patches.suse/platform-x86-wmi-Fix-opening-of-char-device.patch
  (git-fixes CVE-2023-52864 bsc#1225132).
- Update
  patches.suse/powerpc-pseries-iommu-LPAR-panics-during-boot-up-wit.patch
  (bsc#1222011 ltc#205900 CVE-2024-36926 bsc#1225829).
- Update patches.suse/pstore-platform-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52869 bsc#1225050).
- Update
  patches.suse/remoteproc-mediatek-Make-sure-IPI-buffer-fits-in-L2T.patch
  (git-fixes CVE-2024-36965 bsc#1226149).
- Update
  patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch
  (git-fixes CVE-2024-38601 bsc#1226876).
- Update
  patches.suse/s390-dasd-protect-device-queue-against-concurrent-access.patch
  (git-fixes bsc#1217481 CVE-2023-52774 bsc#1225572).
- Update
  patches.suse/scsi-hisi_sas-Set-debugfs_dir-pointer-to-NULL-after-removing-debugfs.patch
  (git-fixes CVE-2023-52808 bsc#1225555).
- Update
  patches.suse/scsi-ibmvfc-Remove-BUG_ON-in-the-case-of-an-empty-ev.patch
  (bsc#1209834 ltc#202097 CVE-2023-52811 bsc#1225559).
- Update
  patches.suse/scsi-libfc-Fix-potential-NULL-pointer-dereference-in-fc_lport_ptp_setup.patch
  (git-fixes CVE-2023-52809 bsc#1225556).
- Update
  patches.suse/scsi-lpfc-Move-NPIV-s-transport-unregistration-to-af.patch
  (bsc#1221777 CVE-2024-36952 bsc#1225898).
- Update
  patches.suse/scsi-lpfc-Release-hbalock-before-calling-lpfc_worker.patch
  (bsc#1221777 CVE-2024-36924 bsc#1225820).
- Update
  patches.suse/serial-max3100-Lock-port-lock-when-calling-uart_hand.patch
  (git-fixes CVE-2024-38634 bsc#1226868).
- Update
  patches.suse/serial-max3100-Update-uart_driver_registered-on-driv.patch
  (git-fixes CVE-2024-38633 bsc#1226867).
- Update
  patches.suse/soc-qcom-llcc-Handle-a-second-device-without-data-co.patch
  (git-fixes CVE-2023-52871 bsc#1225534).
- Update
  patches.suse/soundwire-cadence-fix-invalid-PDI-offset.patch
  (stable-fixes CVE-2024-38635 bsc#1226863).
- Update patches.suse/speakup-Fix-sizeof-vs-ARRAY_SIZE-bug.patch
  (git-fixes CVE-2024-38587 bsc#1226780).
- Update patches.suse/spi-Fix-null-dereference-on-suspend.patch
  (git-fixes CVE-2023-52749 bsc#1225476).
- Update
  patches.suse/thermal-core-prevent-potential-string-overflow.patch
  (git-fixes CVE-2023-52868 bsc#1225044).
- Update
  patches.suse/thermal-drivers-qcom-lmh-Check-for-SCM-availability-.patch
  (git-fixes CVE-2024-39466 bsc#1227089).
- Update
  patches.suse/thermal-drivers-tsens-Fix-null-pointer-dereference.patch
  (git-fixes CVE-2024-38571 bsc#1226737).
- Update
  patches.suse/thermal-intel-powerclamp-fix-mismatch-in-get-functio.patch
  (git-fixes CVE-2023-52794 bsc#1225028).
- Update
  patches.suse/tls-fix-NULL-deref-on-tls_sw_splice_eof-with-empty-r.patch
  (jsc#PED-6831 CVE-2023-52767 bsc#1224998).
- Update
  patches.suse/tpm_tis_spi-Account-for-SPI-header-when-allocating-T.patch
  (git-fixes CVE-2024-36477 bsc#1226840).
- Update
  patches.suse/tracing-Have-trace_event_file-have-ref-counters.patch
  (git-fixes CVE-2023-52879 bsc#1225101).
- Update
  patches.suse/tracing-trigger-Fix-to-return-error-if-failed-to-alloc-snapshot.patch
  (git-fixes CVE-2024-26920).
- Update
  patches.suse/tty-n_gsm-fix-race-condition-in-status-line-change-o.patch
  (git-fixes CVE-2023-52872 bsc#1225591).
- Update
  patches.suse/tty-n_gsm-require-CAP_NET_ADMIN-to-attach-N_GSM0710-.patch
  (bsc#1222619 CVE-2023-52880).
- Update
  patches.suse/tty-vcc-Add-check-for-kstrdup-in-vcc_probe.patch
  (git-fixes CVE-2023-52789 bsc#1225180).
- Update
  patches.suse/usb-config-fix-iteration-issue-in-usb_get_bos_descri.patch
  (git-fixes CVE-2023-52781 bsc#1225092).
- Update
  patches.suse/usb-dwc3-Wait-unconditionally-after-issuing-EndXfer-.patch
  (git-fixes CVE-2024-36977 bsc#1226513).
- Update
  patches.suse/usb-gadget-u_audio-Fix-race-condition-use-of-control.patch
  (git-fixes CVE-2024-38628 bsc#1226911).
- Update
  patches.suse/usb-storage-alauda-Check-whether-the-media-is-initia.patch
  (git-fixes CVE-2024-38619 bsc#1226861).
- Update
  patches.suse/usb-typec-tcpm-Fix-NULL-pointer-dereference-in-tcpm_.patch
  (git-fixes CVE-2023-52877 bsc#1224944).
- Update
  patches.suse/vhost-vdpa-fix-use-after-free-in-vhost_vdpa_probe.patch
  (jsc#PED-3311 CVE-2023-52795 bsc#1225085).
- Update
  patches.suse/virtio-blk-fix-implicit-overflow-on-virtio_max_dma_s.patch
  (git-fixes CVE-2023-52762 bsc#1225573).
- Update
  patches.suse/virtio-vsock-Fix-uninit-value-in-virtio_transport_re.patch
  (jsc#PED-5505 CVE-2023-52842 bsc#1225025).
- Update
  patches.suse/watchdog-cpu5wdt.c-Fix-use-after-free-bug-caused-by-.patch
  (git-fixes CVE-2024-38630 bsc#1226908).
- Update
  patches.suse/wifi-ar5523-enable-proper-endpoint-verification.patch
  (git-fixes CVE-2024-38565 bsc#1226747).
- Update
  patches.suse/wifi-ath11k-fix-dfs-radar-event-locking.patch
  (git-fixes CVE-2023-52798 bsc#1224947).
- Update
  patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch
  (git-fixes CVE-2023-52777 bsc#1224992).
- Update patches.suse/wifi-ath11k-fix-htt-pktlog-locking.patch
  (git-fixes CVE-2023-52800).
- Update
  patches.suse/wifi-ath12k-fix-dfs-radar-and-temperature-event-lock.patch
  (git-fixes CVE-2023-52776 bsc#1225090).
- Update
  patches.suse/wifi-ath12k-fix-htt-mlo-offset-event-locking.patch
  (git-fixes CVE-2023-52769 bsc#1225001).
- Update
  patches.suse/wifi-ath12k-fix-out-of-bound-access-of-qmi_invoke_ha.patch
  (git-fixes CVE-2024-38572 bsc#1226776).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-read-in-ath12k.patch
  (git-fixes CVE-2023-52827 bsc#1225078).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-write-in-ath12.patch
  (git-fixes CVE-2023-52829 bsc#1225081).
- Update
  patches.suse/wifi-brcmfmac-pcie-handle-randbuf-allocation-failure.patch
  (git-fixes CVE-2024-38575 bsc#1226612).
- Update
  patches.suse/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch
  (git-fixes CVE-2024-38567 bsc#1226769).
- Update
  patches.suse/wifi-carl9170-re-fix-fortified-memset-warning.patch
  (git-fixes CVE-2024-38616 bsc#1226852).
- Update
  patches.suse/wifi-mac80211-don-t-return-unset-power-in-ieee80211_.patch
  (git-fixes CVE-2023-52832 bsc#1225577).
- Update
  patches.suse/wifi-nl80211-Avoid-address-calculations-via-out-of-b.patch
  (git-fixes CVE-2024-38562 bsc#1226788).
- Update
  patches.suse/wifi-wilc1000-use-vmm_table-as-array-in-wilc-struct.patch
  (git-fixes CVE-2023-52768 bsc#1225004).
- Update
  patches.suse/x86-tdx-Zero-out-the-missing-RSI-in-TDX_HYPERCALL-macro.patch
  (jsc#PED-5824 CVE-2023-52874 bsc#1225049).
- commit 33efdc4</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835204">- tcp: Use refcount_inc_not_zero() in tcp_twsk_unique()
  (CVE-2024-36904 bsc#1225732).
- commit d578dcc</changelog>
  <changelog author="heming.zhao@suse.com" date="1719921600">- gfs2: Fix potential glock use-after-free on unmount (bsc#1226775
  CVE-2024-38570).
- gfs2: Rename sd_{ glock =&gt; kill }_wait (bsc#1226775
  CVE-2024-38570).
- commit f3adbca</changelog>
  <changelog author="tiwai@suse.de" date="1719921601">- Correct SCSI patch references (bsc#1225767 CVE-2024-36919 bsc#1226785 CVE-2024-38559)
- commit e8ea587</changelog>
  <changelog author="tiwai@suse.de" date="1719921602">- mtd: rawnand: rockchip: ensure NVDDR timings are rejected
  (git-fixes).
- mtd: rawnand: Bypass a couple of sanity checks during NAND
  identification (git-fixes).
- mtd: rawnand: Fix the nand_read_data_op() early check
  (git-fixes).
- mtd: rawnand: Ensure ECC configuration is propagated to upper
  layers (git-fixes).
- commit e545951</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1719921603">- kernel-doc: fix struct_group_tagged() parsing (git-fixes).
- commit e3a2a2e</changelog>
  <changelog author="fdmanana@suse.com" date="1719921604">- btrfs: fix crash on racing fsync and size-extending write into
  prealloc (bsc#1227101 CVE-2024-37354).
- commit 1d355af</changelog>
  <changelog author="vbabka@suse.cz" date="1719921605">- virt: acrn: stop using follow_pfn (CVE-2024-38610 bsc#1226758).
- commit c2ea51b</changelog>
  <changelog author="vbabka@suse.cz" date="1719921606">- drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
  (CVE-2024-38610 bsc#1226758).
- commit 7069ac2</changelog>
  <changelog author="rhopkins@suse.de" date="1719921607">- hsr: Prevent use after free in prp_create_tagged_frame()
  (CVE-2023-52846 bsc#1225098).
- commit cf63988</changelog>
  <changelog author="krisman@suse.de" date="1719921608">- io_uring: Fix io_cqring_wait() not restoring sigmask on
  get_timespec64() failure (git-fixes).
- commit e640a65</changelog>
  <changelog author="krisman@suse.de" date="1719921609">- io_uring: check for non-NULL file pointer in io_file_can_poll()
  (bsc#1226990 CVE-2024-39371).
- io_uring/io-wq: Use set_bit() and test_bit() at worker-&gt;flags
  (git-fixes).
- io_uring/sqpoll: work around a potential audit memory leak
  (git-fixes).
- commit 24603fc</changelog>
  <changelog author="krisman@suse.de" date="1719921610">- io_uring/rsrc: fix incorrect assignment of iter-&gt;nr_segs in
  io_import_fixed (git-fixes).
- io_uring/rsrc: don't lock while !TASK_RUNNING (git-fixes).
- io_uring/io-wq: avoid garbage value of 'match' in
  io_wq_enqueue() (git-fixes).
- commit 7d3e252</changelog>
</package>
<package pkgid="e26bcb2f6869bc205bc913968f82780be3723c83067fe2174a610ae71ef2f1d8" name="dtb-renesas" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.17.1"/>
  <changelog author="tiwai@suse.de" date="1722081600">- auxdisplay: ht16k33: Drop reference after LED registration
  (git-fixes).
- ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
  on unprepare (git-fixes).
- ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
- ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
  reachable (git-fixes).
- ASoC: sof: amd: fix for firmware reload failure in Vangogh
  platform (git-fixes).
- ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
- ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
  (git-fixes).
- ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
- ALSA: ump: Don't update FB name for static blocks (git-fixes).
- drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
- drm/i915/gt: Do not consider preemption during execlists_dequeue
  for gen8 (git-fixes).
- drm/i915/dp: Don't switch the LTTPR mode on an active link
  (git-fixes).
- commit d7e2deb</changelog>
  <changelog author="tiwai@suse.de" date="1722081601">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
</package>
<package pkgid="701d30cd6f88174760786d4b0150cd0a3b070648756a039933898b47786f315e" name="dtb-renesas" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.7.1"/>
  <changelog author="mkubecek@suse.cz" date="1717416000">- netfilter: nf_tables: release mutex after nft_gc_seq_end from
  abort path (CVE-2024-26925 bsc#1223390).
- commit 578a709</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717416001">- Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
  The L3 bsc#1225765 was created seperately since our customer requires
  PTF.
- Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
- Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
- Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
- Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
- commit 054635e</changelog>
  <changelog author="msuchanek@suse.de" date="1717416002">- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
- powerpc/uaccess: Fix build errors seen with GCC 13/14
  (bsc#1194869).
- commit 46b5d84</changelog>
  <changelog author="msuchanek@suse.de" date="1717416003">- blacklist.conf: PPC fsl_msi is not used
- commit ae6590d</changelog>
  <changelog author="msuchanek@suse.de" date="1717416004">- powerpc/pseries/lparcfg: drop error message from guest name
  lookup (bsc#1187716 ltc#193451 git-fixes).
- commit ceab637</changelog>
  <changelog author="mfranc@suse.cz" date="1717416005">- Update
  patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
  (git-fixes CVE-2024-36955).
- Update
  patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
  (git-fixes bsc#1225715 CVE-2024-36906).
- Update
  patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
  (git-fixes bsc#1225579 CVE-2024-36011).
- Update
  patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
  (git-fixes bsc#1225578 CVE-2024-36013).
- Update
  patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
  (git-fixes bsc#1225502 CVE-2024-36012).
- Update
  patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
  (git-fixes bsc#1225722 CVE-2024-36880).
- Update
  patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
  (git-fixes CVE-2024-36942).
- Update
  patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
  (git-fixes bsc#1225720 CVE-2024-36032).
- Update
  patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
  (git-fixes bsc#1223749 CVE-2024-26990).
- Update
  patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
  (git-fixes bsc#1223692 CVE-2024-26992).
- Update
  patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
  (stable-fixes CVE-2024-36944).
- Update
  patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
  (git-fixes bsc#1225734 CVE-2024-36896).
- Update
  patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
  (stable-fixes CVE-2024-36949).
- Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
  (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
- Update
  patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
  (git-fixes bsc#1225692 CVE-2023-52882).
- Update
  patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
  (git-fixes CVE-2024-26761).
- Update
  patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
  (stable-fixes bsc#1225735 CVE-2024-36897).
- Update
  patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
  (stable-fixes bsc#1225705 CVE-2024-36026).
- Update
  patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
  (stable-fixes CVE-2024-36951).
- Update
  patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
  (git-fixes bsc#1225593 CVE-2024-36014).
- Update
  patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
  (stable-fixes bsc#1225728 CVE-2024-36885).
- Update
  patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
  (git-fixes bsc#1225773 CVE-2024-36936).
- Update
  patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
  (stable-fixes CVE-2024-36950).
- Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
  (git-fixes bsc#1225736 CVE-2024-36898).
- Update
  patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
  (git-fixes bsc#1225698 CVE-2024-36020).
- Update
  patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
  (git-fixes bsc#1225710 CVE-2024-36891).
- Update
  patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
  (git-fixes bsc#1225714 CVE-2024-36890).
- Update
  patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
  (git-fixes bsc#1225708 CVE-2024-36029).
- Update
  patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
  (git-fixes bsc#1225699 CVE-2024-36021).
- Update
  patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
  (git-fixes CVE-2024-26943).
- Update
  patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
  (git-fixes bsc#1225694 CVE-2024-36018).
- Update
  patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
  (git-fixes CVE-2024-36940).
- Update
  patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
  (git-fixes CVE-2024-36959).
- Update
  patches.suse/ppdev-Add-an-error-check-in-register_device.patch
  (git-fixes bsc#1225640 CVE-2024-36015).
- Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
  CVE-2024-36947).
- Update
  patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
  (git-fixes bsc#1225695 CVE-2024-36019).
- Update
  patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
  (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
- Update
  patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
  (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
- Update
  patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
  (git-fixes bsc#1225704 CVE-2024-36025).
- Update
  patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
  (git-fixes CVE-2024-36930).
- Update
  patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
  (bsc#1224331 bsc#1224602 CVE-2024-35814).
- Update
  patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
  (git-fixes bsc#1225642 CVE-2024-36016).
- Update
  patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
  (git-fixes bsc#1225749 CVE-2024-36894).
- Update
  patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
  (git-fixes bsc#1225750 CVE-2024-36895).
- Update
  patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
  (git-fixes bsc#1225748 CVE-2024-36893).
- Update
  patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
  (stable-fixes bsc#1225769 CVE-2024-36921).
- Update
  patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
  (stable-fixes CVE-2024-36922).
- Update
  patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
  (git-fixes CVE-2024-36941).
- Update
  patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
  (git-fixes bsc#1224742 CVE-2024-35803).
- commit 539780f</changelog>
  <changelog author="dwagner@suse.de" date="1717416006">- nvmet: fix ns enable/disable possible hang (git-fixes).
- nvme-multipath: fix io accounting on failover (git-fixes).
- nvme: fix multipath batched completion accounting (git-fixes).
- commit ed3b392</changelog>
  <changelog author="dwagner@suse.de" date="1717416007">- scsi: lpfc: Copyright updates for 14.4.0.2 patches
  (bsc#1225842).
- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
  (bsc#1225842).
  Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
  (bsc#1225842).
- scsi: lpfc: Clear deferred RSCN processing flag when driver
  is unloading (bsc#1225842).
- scsi: lpfc: Update logging of protection type for T10 DIF I/O
  (bsc#1225842).
- scsi: lpfc: Change default logging level for unsolicited CT
  MIB commands (bsc#1225842).
- commit 5a56384</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416008">- smb: client: fix mount when dns_resolver key is not available
  (git-fixes, bsc#1225172).
- commit 28edb5c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416009">- cifs: fix leak of iface for primary channel (git-fixes,
  bsc#1225172).
- commit b7eb8e8</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416010">- Revert "cifs: reconnect work should have reference on server
  struct" (git-fixes, bsc#1225172).
- commit 3ca4c0c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416011">- smb: client: fix parsing of SMB3.1.1 POSIX create context
  (git-fixes, bsc#1225172).
- commit 5f27f69</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416012">- cifs: failure to add channel on iface should bump up weight
  (git-fixes, bsc#1225172).
- commit 007b237</changelog>
  <changelog author="tonyj@suse.de" date="1717416013">- perf/x86: Fix out of range data (git-fixes).
- perf/x86/intel/ds: Don't clear -&gt;pebs_data_cfg for the last
  PEBS event (git-fixes).
- perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
- commit 664d77f</changelog>
  <changelog author="dsterba@suse.com" date="1717588800">- blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
- Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
  Quoting bsc#1225945#c11:
  "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
  transaction for every subvol create")
  ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
  unwritten extent buffer after snapshotting a new subvolume") was never
  backported."
- commit d947258</changelog>
  <changelog author="tonyj@suse.de" date="1717588801">- perf pmu: Count sys and cpuid JSON events separately (git
  fixes).
- perf stat: Don't display metric header for non-leader uncore
  events (git-fixes).
- perf daemon: Fix file leak in daemon_session__control
  (git-fixes).
- perf symbols: Fix ownership of string in dso__load_vmlinux()
  (git-fixes).
- perf thread: Fixes to thread__new() related to initializing comm
  (git-fixes).
- perf report: Avoid SEGV in report__setup_sample_type()
  (git-fixes).
- perf ui browser: Don't save pointer to stack memory (git-fixes).
- perf bench internals inject-build-id: Fix trap divide when
  collecting just one DSO (git-fixes).
- perf intel-pt: Fix unassigned instruction op (discovered by
  MemorySanitizer) (git-fixes).
- perf test shell arm_coresight: Increase buffer size for
  Coresight basic tests (git-fixes).
- perf docs: Document bpf event modifier (git-fixes).
- perf bench uprobe: Remove lib64 from libc.so.6 binary path
  (git-fixes).
- perf record: Fix debug message placement for test consumption
  (git-fixes).
- perf tests: Apply attributes to all events in object code
  reading test (git-fixes).
- perf tests: Make "test data symbol" more robust on Neoverse N1
  (git-fixes).
- perf annotate: Fix annotation_calc_lines() to pass correct
  address to get_srcline() (git-fixes).
- perf stat: Do not fail on metrics on s390 z/VM systems
  (git-fixes).
- perf sched timehist: Fix -g/--call-graph option failure
  (git-fixes).
- perf annotate: Get rid of duplicate --group option item
  (git-fixes).
- perf probe: Add missing libgen.h header needed for using
  basename() (git-fixes).
- perf record: Delete session after stopping sideband thread
  (git-fixes).
- perf auxtrace: Fix multiple use of --itrace option (git-fixes).
- perf script: Show also errors for --insn-trace option
  (git-fixes).
- perf lock contention: Add a missing NULL check (git-fixes).
- perf vendor events amd: Fix Zen 4 cache latency events
  (git-fixes).
- libperf evlist: Avoid out-of-bounds access (git-fixes).
- perf pmu: Fix a potential memory leak in perf_pmu__lookup()
  (git-fixes).
- perf print-events: make is_event_supported() more robust
  (git-fixes).
- perf list: fix short description for some cache events
  (git-fixes).
- perf metric: Don't remove scale from counts (git-fixes).
- perf stat: Avoid metric-only segv (git-fixes).
- perf expr: Fix "has_event" function for metric style events
  (git-fixes).
- perf srcline: Add missed addr2line closes (git-fixes).
- perf thread_map: Free strlist on normal path in
  thread_map__new_by_tid_str() (git-fixes).
- perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
- perf jevents: Drop or simplify small integer values (git-fixes).
- perf evsel: Fix duplicate initialization of data-&gt;id in
  evsel__parse_sample() (git-fixes).
- perf pmu: Treat the msr pmu as software (git-fixes).
- perf record: Check conflict between '--timestamp-filename'
  option and pipe mode before recording (git-fixes).
- perf record: Fix possible incorrect free in
  record__switch_output() (git-fixes).
- perf vendor events amd: Add Zen 4 memory controller events
  (git-fixes).
- perf top: Uniform the event name for the hybrid machine
  (git-fixes).
- perf top: Use evsel's cpus to replace user_requested_cpus
  (git-fixes).
- commit a1f9340</changelog>
  <changelog author="tonyj@suse.de" date="1717675200">- perf ui browser: Avoid SEGV on title (git fixes).
- commit 1578c22</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675201">- inet: inet_defrag: prevent sk release while still in use
  (CVE-2024-26921 bsc#1223138).
- commit 2016faf</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675202">- net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
- commit 7bf5961</changelog>
  <changelog author="tiwai@suse.de" date="1718366400">- Temporarily drop KVM patch that caused a regression (bsc#1226158)
  Delete patches.suse/KVM-x86-pmu-Prioritize-VMX-interception-over-GP-on-R.patch
- commit 33f31da</changelog>
</package>
<package pkgid="ce4bab40e63bb8d86036a859ab1770eba07e598535bbc73db53e1fe39138844a" name="dtb-rockchip" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.14.1"/>
  <changelog author="tiwai@suse.de" date="1719662400">- gpiolib: cdev: Disallow reconfiguration without direction
  (uAPI v1) (git-fixes).
- gpio: davinci: Validate the obtained number of IRQs (git-fixes).
- commit 919ebd1</changelog>
  <changelog author="tiwai@suse.de" date="1719748800">- i2c: testunit: discard write requests while old command is
  running (git-fixes).
- i2c: testunit: don't erase registers after STOP (git-fixes).
- mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
  (git-fixes).
- mmc: sdhci: Do not invert write-protect twice (git-fixes).
- mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
  (git-fixes).
- mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
  (git-fixes).
- commit 448487d</changelog>
  <changelog author="tiwai@suse.de" date="1719748801">- crypto: iaa - Account for cpu-less numa nodes (bsc#1227190).
- commit cd600aa</changelog>
  <changelog author="tiwai@suse.de" date="1719748802">- crypto: deflate - Add aliases to deflate (bsc#1227190).
- commit 27ffd92</changelog>
  <changelog author="tiwai@suse.de" date="1719835200">- ata: ahci: Clean up sysfs file on error (git-fixes).
- ata: libata-core: Fix double free on error (git-fixes).
- ata,scsi: libata-core: Do not leak memory for ata_port struct
  members (git-fixes).
- ata: libata-core: Fix null pointer dereference on error
  (git-fixes).
- kbuild: Fix build target deb-pkg: ln: failed to create hard link
  (git-fixes).
- kbuild: doc: Update default INSTALL_MOD_DIR from extra to
  updates (git-fixes).
- kbuild: Install dtb files as 0644 in Makefile.dtbinst
  (git-fixes).
- counter: ti-eqep: enable clock at probe (git-fixes).
- iio: chemical: bme680: Fix sensor data read operation
  (git-fixes).
- iio: chemical: bme680: Fix overflows in compensate() functions
  (git-fixes).
- iio: chemical: bme680: Fix calibration data variable
  (git-fixes).
- iio: chemical: bme680: Fix pressure value output (git-fixes).
- iio: accel: fxls8962af: select IIO_BUFFER &amp; IIO_KFIFO_BUF
  (git-fixes).
- iio: adc: ad7266: Fix variable checking bug (git-fixes).
- iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
  (git-fixes).
- serial: bcm63xx-uart: fix tx after conversion to
  uart_port_tx_limited() (git-fixes).
- serial: core: introduce uart_port_tx_limited_flags()
  (git-fixes).
- Revert "serial: core: only stop transmit when HW fifo is empty"
  (git-fixes).
- tty: mcf: MCF54418 has 10 UARTS (git-fixes).
- usb: gadget: aspeed_udc: fix device address configuration
  (git-fixes).
- usb: dwc3: core: remove lock of otg mode during gadget
  suspend/resume to avoid deadlock (git-fixes).
- usb: typec: ucsi: glink: fix child node release in probe
  function (git-fixes).
- usb: musb: da8xx: fix a resource leak in probe() (git-fixes).
- usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  (git-fixes).
- usb: gadget: printer: fix races against disable (git-fixes).
- PCI/MSI: Fix UAF in msi_capability_init (git-fixes).
- commit a2ea5a9</changelog>
  <changelog author="ptesarik@suse.com" date="1719835201">- net: ena: Fix redundant device NUMA node override
  (jsc#PED-8688).
- commit 6ad6684</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835202">- tcp: do not accept ACK of bytes we never sent (CVE-2023-52881
  bsc#1225611).
- commit 16404a6</changelog>
  <changelog author="mhocko@suse.com" date="1719835203">- Update
  patches.suse/1352-drm-amdgpu-Fix-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52883
  bsc#1226630).
- Update
  patches.suse/9p-add-missing-locking-around-taking-dentry-fid-list.patch
  (git-fixes CVE-2024-39463 bsc#1227090).
- Update
  patches.suse/ALSA-Fix-deadlocks-with-kctl-removals-at-disconnecti.patch
  (stable-fixes CVE-2024-38600 bsc#1226864).
- Update
  patches.suse/ALSA-core-Fix-NULL-module-pointer-assignment-at-card.patch
  (git-fixes CVE-2024-38605 bsc#1226740).
- Update
  patches.suse/ALSA-hda-Fix-possible-null-ptr-deref-when-assigning-.patch
  (git-fixes CVE-2023-52806 bsc#1225554).
- Update
  patches.suse/ALSA-hda-cs_dsp_ctl-Use-private_free-for-control-cle.patch
  (git-fixes CVE-2024-38388 bsc#1226890).
- Update
  patches.suse/ALSA-timer-Set-lower-bound-of-start-tick-time.patch
  (stable-fixes git-fixes CVE-2024-38618 bsc#1226754).
- Update
  patches.suse/ASoC-kirkwood-Fix-potential-NULL-dereference.patch
  (git-fixes CVE-2024-38550 bsc#1226633).
- Update
  patches.suse/ASoC-mediatek-Assign-dummy-when-codec-not-specified-.patch
  (git-fixes CVE-2024-38551 bsc#1226761).
- Update
  patches.suse/Bluetooth-btusb-Add-date-evt_skb-is-NULL-check.patch
  (git-fixes CVE-2023-52833 bsc#1225595).
- Update
  patches.suse/Bluetooth-hci_core-Fix-possible-buffer-overflow.patch
  (git-fixes CVE-2024-26889).
- Update
  patches.suse/HID-uclogic-Fix-user-memory-access-bug-in-uclogic_pa.patch
  (git-fixes CVE-2023-52866 bsc#1225120).
- Update
  patches.suse/IB-mlx5-Fix-init-stage-error-handling-to-avoid-doubl.patch
  (jsc#PED-6864 CVE-2023-52851 bsc#1225587).
- Update
  patches.suse/Input-cyapa-add-missing-input-core-locking-to-suspen.patch
  (git-fixes CVE-2023-52884 bsc#1226764).
- Update
  patches.suse/Input-synaptics-rmi4-fix-use-after-free-in-rmi_unreg.patch
  (git-fixes CVE-2023-52840 bsc#1224928).
- Update
  patches.suse/KEYS-trusted-Do-not-use-WARN-when-encode-fails.patch
  (git-fixes CVE-2024-36975 bsc#1226520).
- Update
  patches.suse/KEYS-trusted-Fix-memory-leak-in-tpm2_key_encode.patch
  (git-fixes CVE-2024-36967 bsc#1226131).
- Update
  patches.suse/RDMA-cma-Fix-kmemleak-in-rdma_core-observed-during-b.patch
  (git-fixes CVE-2024-38539 bsc#1226608).
- Update patches.suse/RDMA-hns-Fix-UAF-for-cq-async-event.patch
  (git-fixes CVE-2024-38545 bsc#1226595).
- Update
  patches.suse/RDMA-hns-Fix-deadlock-on-SRQ-async-events.patch
  (git-fixes CVE-2024-38591 bsc#1226738).
- Update
  patches.suse/RDMA-hns-Modify-the-print-level-of-CQE-error.patch
  (git-fixes CVE-2024-38590 bsc#1226839).
- Update
  patches.suse/RDMA-rxe-Fix-seg-fault-in-rxe_comp_queue_pkt.patch
  (git-fixes CVE-2024-38544 bsc#1226597).
- Update
  patches.suse/SUNRPC-Fix-RPC-client-cleaned-up-the-freed-pipefs-de.patch
  (git-fixes CVE-2023-52803 bsc#1225008).
- Update patches.suse/af_unix-Clear-stale-u-oob_skb.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-35970 bsc#1224584).
- Update
  patches.suse/af_unix-Drop-oob_skb-ref-before-purging-queue-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26750 bsc#1222617).
- Update
  patches.suse/af_unix-Fix-task-hung-while-purging-oob_skb-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26780 bsc#1222588).
- Update
  patches.suse/af_unix-Update-unix_sk-sk-oob_skb-under-sk_receive_queue-lock.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-36972 bsc#1226163).
- Update
  patches.suse/arm64-Restrict-CPU_BIG_ENDIAN-to-GNU-as-or-LLVM-IAS-.patch
  (git-fixes CVE-2023-52750 bsc#1225485).
- Update
  patches.suse/atl1c-Work-around-the-DMA-RX-overflow-issue.patch
  (git-fixes CVE-2023-52834 bsc#1225599).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issue-of-net_device.patch
  (git-fixes CVE-2024-38554 bsc#1226742).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issues-of-ax25_dev.patch
  (git-fixes CVE-2024-38602 bsc#1226613).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-reorder-of-WRITE-lqueued.patch
  (bsc#1225605 CVE-2024-38384 bsc#1226938).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-resetting-io-stat.patch
  (bsc#1225605 CVE-2024-38663 bsc#1226939).
- Update
  patches.suse/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch
  (git-fixes CVE-2024-38540 bsc#1226582).
- Update
  patches.suse/bonding-stop-the-device-in-bond_setup_by_slave.patch
  (git-fixes CVE-2023-52784 bsc#1224946).
- Update
  patches.suse/can-dev-can_put_echo_skb-don-t-crash-kernel-if-can_p.patch
  (git-fixes CVE-2023-52878 bsc#1225000).
- Update
  patches.suse/clk-mediatek-clk-mt2701-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52875 bsc#1225096).
- Update
  patches.suse/clk-mediatek-clk-mt6765-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52870 bsc#1224937).
- Update
  patches.suse/clk-mediatek-clk-mt6779-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52873 bsc#1225589).
- Update
  patches.suse/clk-mediatek-clk-mt6797-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52865 bsc#1225086).
- Update
  patches.suse/clk-mediatek-clk-mt7629-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52858 bsc#1225566).
- Update
  patches.suse/clk-mediatek-clk-mt7629-eth-Add-check-for-mtk_alloc_.patch
  (git-fixes CVE-2023-52876 bsc#1225036).
- Update
  patches.suse/cppc_cpufreq-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38573 bsc#1226739).
- Update patches.suse/cpufreq-exit-callback-is-optional.patch
  (git-fixes CVE-2024-38615 bsc#1226592).
- Update patches.suse/crypto-bcm-Fix-pointer-arithmetic.patch
  (git-fixes CVE-2024-38579 bsc#1226637).
- Update
  patches.suse/crypto-pcrypt-Fix-hungtask-for-PADATA_RESET.patch
  (git-fixes CVE-2023-52813 bsc#1225527).
- Update patches.suse/cxl-mem-Fix-shutdown-order.patch (git-fixes
  CVE-2023-52849 bsc#1224949).
- Update
  patches.suse/cxl-region-Do-not-try-to-cleanup-after-cxl_region_se.patch
  (git-fixes CVE-2023-52792 bsc#1225477).
- Update patches.suse/cxl-region-Fix-cxlr_pmem-leaks.patch
  (git-fixes CVE-2024-38391 bsc#1226894).
- Update
  patches.suse/dma-buf-sw-sync-don-t-enable-IRQ-from-sync_print_obj.patch
  (git-fixes CVE-2024-38780 bsc#1226886).
- Update
  patches.suse/dma-mapping-benchmark-fix-node-id-validation.patch
  (git-fixes CVE-2024-34777 bsc#1226796).
- Update
  patches.suse/dma-mapping-benchmark-handle-NUMA_NO_NODE-correctly.patch
  (git-fixes CVE-2024-39277 bsc#1226909).
- Update
  patches.suse/dmaengine-idxd-Avoid-unnecessary-destruction-of-file.patch
  (git-fixes CVE-2024-38629 bsc#1226905).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Pola.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52819
  bsc#1225532).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-SMU7.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52818
  bsc#1225530).
- Update
  patches.suse/drm-amd-check-num-of-link-levels-when-update-pcie-pa.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52812
  bsc#1225564).
- Update
  patches.suse/drm-amd-display-Avoid-NULL-dereference-of-timing-gen.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52753
  bsc#1225478).
- Update
  patches.suse/drm-amd-display-Fix-division-by-zero-in-setup_dsc_co.patch
  (stable-fixes CVE-2024-36969 bsc#1226155).
- Update
  patches.suse/drm-amd-display-Fix-null-pointer-dereference-in-erro.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52862
  bsc#1225015).
- Update
  patches.suse/drm-amd-display-Fix-potential-index-out-of-bounds-in.patch
  (git-fixes CVE-2024-38552 bsc#1226767).
- Update
  patches.suse/drm-amd-display-fix-a-NULL-pointer-dereference-in-am.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52773
  bsc#1225041).
- Update
  patches.suse/drm-amd-display-fixed-integer-types-and-null-check-l.patch
  (git-fixes CVE-2024-26767).
- Update
  patches.suse/drm-amdgpu-Fix-a-null-pointer-access-when-the-smc_rr.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52817
  bsc#1225569).
- Update
  patches.suse/drm-amdgpu-Fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch
  (git-fixes CVE-2024-39291 bsc#1226934).
- Update
  patches.suse/drm-amdgpu-Fix-potential-null-pointer-derefernce.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52814
  bsc#1225565).
- Update
  patches.suse/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch
  (stable-fixes CVE-2024-39471 bsc#1227096).
- Update
  patches.suse/drm-amdgpu-mes-fix-use-after-free-issue.patch
  (stable-fixes CVE-2024-38581 bsc#1226657).
- Update
  patches.suse/drm-amdgpu-vkms-fix-a-possible-null-pointer-derefere.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52815
  bsc#1225568).
- Update
  patches.suse/drm-amdkfd-Fix-a-race-condition-of-vram-buffer-unref.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52825
  bsc#1225076).
- Update
  patches.suse/drm-amdkfd-Fix-shift-out-of-bounds-issue.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52816
  bsc#1225529).
- Update
  patches.suse/drm-bridge-cdns-mhdp8546-Fix-possible-null-pointer-d.patch
  (git-fixes CVE-2024-38548).
- Update
  patches.suse/drm-bridge-it66121-Fix-invalid-connector-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52861
  bsc#1224941).
- Update
  patches.suse/drm-bridge-lt8912b-Fix-crash-on-bridge-detach.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52856
  bsc#1224932).
- Update
  patches.suse/drm-mediatek-Add-0-size-check-to-mtk_drm_gem_obj.patch
  (git-fixes CVE-2024-38549 bsc#1226735).
- Update
  patches.suse/drm-mediatek-Fix-coverity-issue-with-unintentional-i.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52857
  bsc#1225581).
- Update
  patches.suse/drm-mediatek-Init-ddp_comp-with-devm_kcalloc.patch
  (git-fixes CVE-2024-38592 bsc#1226844).
- Update
  patches.suse/drm-msm-a6xx-Avoid-a-nullptr-dereference-when-speedb.patch
  (git-fixes CVE-2024-38390 bsc#1226891).
- Update
  patches.suse/drm-msm-dpu-Add-callback-function-pointer-check-befo.patch
  (git-fixes CVE-2024-38622 bsc#1226856).
- Update
  patches.suse/drm-panel-fix-a-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52821
  bsc#1225022).
- Update
  patches.suse/drm-panel-panel-tpo-tpg110-fix-a-possible-null-point.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52826
  bsc#1225077).
- Update patches.suse/drm-radeon-possible-buffer-overflow.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52867
  bsc#1225009).
- Update
  patches.suse/drm-vc4-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38546 bsc#1226593).
- Update
  patches.suse/drm-vmwgfx-Fix-invalid-reads-in-fence-signaled-event.patch
  (git-fixes CVE-2024-36960 bsc#1225872).
- Update
  patches.suse/drm-zynqmp_dpsub-Always-register-bridge.patch
  (git-fixes CVE-2024-38664 bsc#1226941).
- Update
  patches.suse/e1000e-change-usleep_range-to-udelay-in-PHY-mdic-acc.patch
  (CVE-2024-39296 bsc#1226989 CVE-2024-36887 bsc#1225731).
- Update
  patches.suse/ecryptfs-Fix-buffer-size-for-tag-66-packet.patch
  (git-fixes CVE-2024-38578 bsc#1226634).
- Update
  patches.suse/efi-libstub-only-free-priv.runtime_map-when-allocate.patch
  (git-fixes CVE-2024-33619 bsc#1226768).
- Update
  patches.suse/fbdev-imsttfb-fix-a-resource-leak-in-probe.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52838
  bsc#1225031).
- Update
  patches.suse/fs-9p-only-translate-RWX-permissions-for-plain-9P200.patch
  (git-fixes CVE-2024-36964 bsc#1225866).
- Update
  patches.suse/fs-jfs-Add-check-for-negative-db_l2nbperpage.patch
  (git-fixes CVE-2023-52810 bsc#1225557).
- Update
  patches.suse/fs-jfs-Add-validity-check-for-db_maxag-and-db_agpref.patch
  (git-fixes CVE-2023-52804 bsc#1225550).
- Update
  patches.suse/ftrace-Fix-possible-use-after-free-issue-in-ftrace_location.patch
  (git-fixes CVE-2024-38588 bsc#1226837).
- Update
  patches.suse/genirq-irqdesc-Prevent-use-after-free-in-irq_find_at.patch
  (git-fixes CVE-2024-38385 bsc#1227085).
- Update patches.suse/gfs2-ignore-negated-quota-changes.patch
  (git-fixes CVE-2023-52759 bsc#1225560).
- Update
  patches.suse/hid-cp2112-Fix-duplicate-workqueue-initialization.patch
  (git-fixes CVE-2023-52853 bsc#1224988).
- Update
  patches.suse/hwmon-axi-fan-control-Fix-possible-NULL-pointer-dere.patch
  (git-fixes CVE-2023-52863 bsc#1225586).
- Update
  patches.suse/i2c-acpi-Unbind-mux-adapters-before-delete.patch
  (git-fixes CVE-2024-39362 bsc#1226995).
- Update
  patches.suse/i2c-core-Run-atomic-i2c-xfer-when-preemptible.patch
  (git-fixes CVE-2023-52791 bsc#1225108).
- Update
  patches.suse/i3c-master-mipi-i3c-hci-Fix-a-kernel-panic-for-acces.patch
  (git-fixes CVE-2023-52763 bsc#1225570).
- Update
  patches.suse/i3c-mipi-i3c-hci-Fix-out-of-bounds-access-in-hci_dma.patch
  (git-fixes CVE-2023-52766).
- Update
  patches.suse/i915-perf-Fix-NULL-deref-bugs-with-drm_dbg-calls.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52788
  bsc#1225106).
- Update
  patches.suse/igb-Fix-string-truncation-warnings-in-igb_set_fw_ver.patch
  (git-fixes CVE-2024-36010 bsc#1225594).
- Update
  patches.suse/iommu-vt-d-Fix-WARN_ON-in-iommu-probe-path.patch
  (git-fixes CVE-2024-35957 bsc#1224673).
- Update
  patches.suse/iommufd-Fix-missing-update-of-domains_itree-after-splitting-iopt
  (jsc#PED-7779 jsc#PED-7780 CVE-2023-52801 bsc#1225006).
- Update
  patches.suse/ipvlan-add-ipvlan_route_v6_outbound-helper.patch
  (git-fixes CVE-2023-52796 bsc#1224930).
- Update
  patches.suse/jffs2-prevent-xattr-node-from-overflowing-the-eraseblock.patch
  (git-fixes CVE-2024-38599 bsc#1226848).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-dbFindLeaf.patch
  (git-fixes CVE-2023-52799 bsc#1225472).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-diAlloc.patch
  (git-fixes CVE-2023-52805 bsc#1225553).
- Update
  patches.suse/kunit-fortify-Fix-mismatched-kvalloc-vfree-usage.patch
  (git-fixes CVE-2024-38617 bsc#1226859).
- Update
  patches.suse/lib-generic-radix-tree.c-Don-t-overflow-in-peek.patch
  (git-fixes CVE-2021-47432 bsc#1225391).
- Update
  patches.suse/lib-test_hmm.c-handle-src_pfns-and-dst_pfns-allocati.patch
  (git-fixes CVE-2024-38543 bsc#1226594).
- Update
  patches.suse/locking-ww_mutex-test-Fix-potential-workqueue-corrup.patch
  (bsc#1219953 CVE-2023-52836 bsc#1225609).
- Update
  patches.suse/md-Don-t-ignore-suspended-array-in-md_check_recovery-1baa.patch
  (bsc#1219596 CVE-2024-26758).
- Update
  patches.suse/media-atomisp-ssh_css-Fix-a-null-pointer-dereference.patch
  (git-fixes CVE-2024-38547 bsc#1226632).
- Update
  patches.suse/media-bttv-fix-use-after-free-error-due-to-btv-timeo.patch
  (git-fixes CVE-2023-52847 bsc#1225588).
- Update
  patches.suse/media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch
  (git-fixes CVE-2023-52764 bsc#1225571).
- Update
  patches.suse/media-hantro-Check-whether-reset-op-is-defined-befor.patch
  (git-fixes CVE-2023-52850 bsc#1225014).
- Update
  patches.suse/media-i2c-et8ek8-Don-t-strip-remove-function-when-dr.patch
  (git-fixes CVE-2024-38611 bsc#1226760).
- Update
  patches.suse/media-imon-fix-access-to-invalid-resource-for-the-se.patch
  (git-fixes CVE-2023-52754 bsc#1225490).
- Update
  patches.suse/media-lgdt3306a-Add-a-check-against-null-pointer-def.patch
  (stable-fixes CVE-2022-48772 bsc#1226976).
- Update
  patches.suse/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch
  (git-fixes CVE-2024-38621 bsc#1226895).
- Update
  patches.suse/media-vidtv-mux-Add-check-and-kfree-for-kstrdup.patch
  (git-fixes CVE-2023-52841 bsc#1225592).
- Update patches.suse/media-vidtv-psi-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52844 bsc#1225590).
- Update
  patches.suse/mfd-qcom-spmi-pmic-Fix-revid-implementation.patch
  (git-fixes CVE-2023-52765 bsc#1225029).
- Update
  patches.suse/misc-microchip-pci1xxxx-fix-double-free-in-the-error.patch
  (git-fixes CVE-2024-36973 bsc#1226457).
- Update
  patches.suse/net-hns3-fix-out-of-bounds-access-may-occur-when-coa.patch
  (git-fixes CVE-2023-52807 bsc#1225097).
- Update
  patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch
  (git-fixes CVE-2024-36962 bsc#1225827).
- Update
  patches.suse/net-mlx5-Fix-peer-devlink-set-for-SF-representor-dev.patch
  (git-fixes CVE-2024-38595 bsc#1226741).
- Update
  patches.suse/net-mlx5e-Track-xmit-submission-to-PTP-WQ-after-popu.patch
  (jsc#PED-3311 CVE-2023-52782 bsc#1225103).
- Update
  patches.suse/net-mvneta-fix-calls-to-page_pool_get_stats.patch
  (git-fixes CVE-2023-52780 bsc#1224933).
- Update
  patches.suse/net-wangxun-fix-kernel-panic-due-to-null-pointer.patch
  (git-fixes CVE-2023-52783 bsc#1225104).
- Update
  patches.suse/netfilter-complete-validation-of-user-input.patch
  (git-fixes CVE-2024-35896 bsc#1224662 CVE-2024-35962
  bsc#1224583).
- Update
  patches.suse/nfc-nci-Fix-uninit-value-in-nci_rx_work.patch
  (git-fixes CVE-2024-38381 bsc#1226878).
- Update
  patches.suse/nilfs2-fix-nilfs_empty_dir-misjudgment-and-long-loop.patch
  (git-fixes CVE-2024-39469 bsc#1226992).
- Update
  patches.suse/nilfs2-fix-potential-hang-in-nilfs_detach_log_writer.patch
  (git-fixes CVE-2024-38582 bsc#1226658).
- Update
  patches.suse/nilfs2-fix-use-after-free-of-timer-for-log-writer-th.patch
  (git-fixes CVE-2024-38583 bsc#1226777).
- Update
  patches.suse/of-module-add-buffer-overflow-check-in-of_modalias.patch
  (git-fixes CVE-2024-38541 bsc#1226587).
- Update
  patches.suse/padata-Fix-refcnt-handling-in-padata_free_shell.patch
  (git-fixes CVE-2023-52854 bsc#1225584).
- Update
  patches.suse/perf-core-Bail-out-early-if-the-request-AUX-area-is-out-of-bound.patch
  (git-fixes CVE-2023-52835 bsc#1225602).
- Update
  patches.suse/platform-x86-wmi-Fix-opening-of-char-device.patch
  (git-fixes CVE-2023-52864 bsc#1225132).
- Update
  patches.suse/powerpc-pseries-iommu-LPAR-panics-during-boot-up-wit.patch
  (bsc#1222011 ltc#205900 CVE-2024-36926 bsc#1225829).
- Update patches.suse/pstore-platform-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52869 bsc#1225050).
- Update
  patches.suse/remoteproc-mediatek-Make-sure-IPI-buffer-fits-in-L2T.patch
  (git-fixes CVE-2024-36965 bsc#1226149).
- Update
  patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch
  (git-fixes CVE-2024-38601 bsc#1226876).
- Update
  patches.suse/s390-dasd-protect-device-queue-against-concurrent-access.patch
  (git-fixes bsc#1217481 CVE-2023-52774 bsc#1225572).
- Update
  patches.suse/scsi-hisi_sas-Set-debugfs_dir-pointer-to-NULL-after-removing-debugfs.patch
  (git-fixes CVE-2023-52808 bsc#1225555).
- Update
  patches.suse/scsi-ibmvfc-Remove-BUG_ON-in-the-case-of-an-empty-ev.patch
  (bsc#1209834 ltc#202097 CVE-2023-52811 bsc#1225559).
- Update
  patches.suse/scsi-libfc-Fix-potential-NULL-pointer-dereference-in-fc_lport_ptp_setup.patch
  (git-fixes CVE-2023-52809 bsc#1225556).
- Update
  patches.suse/scsi-lpfc-Move-NPIV-s-transport-unregistration-to-af.patch
  (bsc#1221777 CVE-2024-36952 bsc#1225898).
- Update
  patches.suse/scsi-lpfc-Release-hbalock-before-calling-lpfc_worker.patch
  (bsc#1221777 CVE-2024-36924 bsc#1225820).
- Update
  patches.suse/serial-max3100-Lock-port-lock-when-calling-uart_hand.patch
  (git-fixes CVE-2024-38634 bsc#1226868).
- Update
  patches.suse/serial-max3100-Update-uart_driver_registered-on-driv.patch
  (git-fixes CVE-2024-38633 bsc#1226867).
- Update
  patches.suse/soc-qcom-llcc-Handle-a-second-device-without-data-co.patch
  (git-fixes CVE-2023-52871 bsc#1225534).
- Update
  patches.suse/soundwire-cadence-fix-invalid-PDI-offset.patch
  (stable-fixes CVE-2024-38635 bsc#1226863).
- Update patches.suse/speakup-Fix-sizeof-vs-ARRAY_SIZE-bug.patch
  (git-fixes CVE-2024-38587 bsc#1226780).
- Update patches.suse/spi-Fix-null-dereference-on-suspend.patch
  (git-fixes CVE-2023-52749 bsc#1225476).
- Update
  patches.suse/thermal-core-prevent-potential-string-overflow.patch
  (git-fixes CVE-2023-52868 bsc#1225044).
- Update
  patches.suse/thermal-drivers-qcom-lmh-Check-for-SCM-availability-.patch
  (git-fixes CVE-2024-39466 bsc#1227089).
- Update
  patches.suse/thermal-drivers-tsens-Fix-null-pointer-dereference.patch
  (git-fixes CVE-2024-38571 bsc#1226737).
- Update
  patches.suse/thermal-intel-powerclamp-fix-mismatch-in-get-functio.patch
  (git-fixes CVE-2023-52794 bsc#1225028).
- Update
  patches.suse/tls-fix-NULL-deref-on-tls_sw_splice_eof-with-empty-r.patch
  (jsc#PED-6831 CVE-2023-52767 bsc#1224998).
- Update
  patches.suse/tpm_tis_spi-Account-for-SPI-header-when-allocating-T.patch
  (git-fixes CVE-2024-36477 bsc#1226840).
- Update
  patches.suse/tracing-Have-trace_event_file-have-ref-counters.patch
  (git-fixes CVE-2023-52879 bsc#1225101).
- Update
  patches.suse/tracing-trigger-Fix-to-return-error-if-failed-to-alloc-snapshot.patch
  (git-fixes CVE-2024-26920).
- Update
  patches.suse/tty-n_gsm-fix-race-condition-in-status-line-change-o.patch
  (git-fixes CVE-2023-52872 bsc#1225591).
- Update
  patches.suse/tty-n_gsm-require-CAP_NET_ADMIN-to-attach-N_GSM0710-.patch
  (bsc#1222619 CVE-2023-52880).
- Update
  patches.suse/tty-vcc-Add-check-for-kstrdup-in-vcc_probe.patch
  (git-fixes CVE-2023-52789 bsc#1225180).
- Update
  patches.suse/usb-config-fix-iteration-issue-in-usb_get_bos_descri.patch
  (git-fixes CVE-2023-52781 bsc#1225092).
- Update
  patches.suse/usb-dwc3-Wait-unconditionally-after-issuing-EndXfer-.patch
  (git-fixes CVE-2024-36977 bsc#1226513).
- Update
  patches.suse/usb-gadget-u_audio-Fix-race-condition-use-of-control.patch
  (git-fixes CVE-2024-38628 bsc#1226911).
- Update
  patches.suse/usb-storage-alauda-Check-whether-the-media-is-initia.patch
  (git-fixes CVE-2024-38619 bsc#1226861).
- Update
  patches.suse/usb-typec-tcpm-Fix-NULL-pointer-dereference-in-tcpm_.patch
  (git-fixes CVE-2023-52877 bsc#1224944).
- Update
  patches.suse/vhost-vdpa-fix-use-after-free-in-vhost_vdpa_probe.patch
  (jsc#PED-3311 CVE-2023-52795 bsc#1225085).
- Update
  patches.suse/virtio-blk-fix-implicit-overflow-on-virtio_max_dma_s.patch
  (git-fixes CVE-2023-52762 bsc#1225573).
- Update
  patches.suse/virtio-vsock-Fix-uninit-value-in-virtio_transport_re.patch
  (jsc#PED-5505 CVE-2023-52842 bsc#1225025).
- Update
  patches.suse/watchdog-cpu5wdt.c-Fix-use-after-free-bug-caused-by-.patch
  (git-fixes CVE-2024-38630 bsc#1226908).
- Update
  patches.suse/wifi-ar5523-enable-proper-endpoint-verification.patch
  (git-fixes CVE-2024-38565 bsc#1226747).
- Update
  patches.suse/wifi-ath11k-fix-dfs-radar-event-locking.patch
  (git-fixes CVE-2023-52798 bsc#1224947).
- Update
  patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch
  (git-fixes CVE-2023-52777 bsc#1224992).
- Update patches.suse/wifi-ath11k-fix-htt-pktlog-locking.patch
  (git-fixes CVE-2023-52800).
- Update
  patches.suse/wifi-ath12k-fix-dfs-radar-and-temperature-event-lock.patch
  (git-fixes CVE-2023-52776 bsc#1225090).
- Update
  patches.suse/wifi-ath12k-fix-htt-mlo-offset-event-locking.patch
  (git-fixes CVE-2023-52769 bsc#1225001).
- Update
  patches.suse/wifi-ath12k-fix-out-of-bound-access-of-qmi_invoke_ha.patch
  (git-fixes CVE-2024-38572 bsc#1226776).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-read-in-ath12k.patch
  (git-fixes CVE-2023-52827 bsc#1225078).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-write-in-ath12.patch
  (git-fixes CVE-2023-52829 bsc#1225081).
- Update
  patches.suse/wifi-brcmfmac-pcie-handle-randbuf-allocation-failure.patch
  (git-fixes CVE-2024-38575 bsc#1226612).
- Update
  patches.suse/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch
  (git-fixes CVE-2024-38567 bsc#1226769).
- Update
  patches.suse/wifi-carl9170-re-fix-fortified-memset-warning.patch
  (git-fixes CVE-2024-38616 bsc#1226852).
- Update
  patches.suse/wifi-mac80211-don-t-return-unset-power-in-ieee80211_.patch
  (git-fixes CVE-2023-52832 bsc#1225577).
- Update
  patches.suse/wifi-nl80211-Avoid-address-calculations-via-out-of-b.patch
  (git-fixes CVE-2024-38562 bsc#1226788).
- Update
  patches.suse/wifi-wilc1000-use-vmm_table-as-array-in-wilc-struct.patch
  (git-fixes CVE-2023-52768 bsc#1225004).
- Update
  patches.suse/x86-tdx-Zero-out-the-missing-RSI-in-TDX_HYPERCALL-macro.patch
  (jsc#PED-5824 CVE-2023-52874 bsc#1225049).
- commit 33efdc4</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835204">- tcp: Use refcount_inc_not_zero() in tcp_twsk_unique()
  (CVE-2024-36904 bsc#1225732).
- commit d578dcc</changelog>
  <changelog author="heming.zhao@suse.com" date="1719921600">- gfs2: Fix potential glock use-after-free on unmount (bsc#1226775
  CVE-2024-38570).
- gfs2: Rename sd_{ glock =&gt; kill }_wait (bsc#1226775
  CVE-2024-38570).
- commit f3adbca</changelog>
  <changelog author="tiwai@suse.de" date="1719921601">- Correct SCSI patch references (bsc#1225767 CVE-2024-36919 bsc#1226785 CVE-2024-38559)
- commit e8ea587</changelog>
  <changelog author="tiwai@suse.de" date="1719921602">- mtd: rawnand: rockchip: ensure NVDDR timings are rejected
  (git-fixes).
- mtd: rawnand: Bypass a couple of sanity checks during NAND
  identification (git-fixes).
- mtd: rawnand: Fix the nand_read_data_op() early check
  (git-fixes).
- mtd: rawnand: Ensure ECC configuration is propagated to upper
  layers (git-fixes).
- commit e545951</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1719921603">- kernel-doc: fix struct_group_tagged() parsing (git-fixes).
- commit e3a2a2e</changelog>
  <changelog author="fdmanana@suse.com" date="1719921604">- btrfs: fix crash on racing fsync and size-extending write into
  prealloc (bsc#1227101 CVE-2024-37354).
- commit 1d355af</changelog>
  <changelog author="vbabka@suse.cz" date="1719921605">- virt: acrn: stop using follow_pfn (CVE-2024-38610 bsc#1226758).
- commit c2ea51b</changelog>
  <changelog author="vbabka@suse.cz" date="1719921606">- drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
  (CVE-2024-38610 bsc#1226758).
- commit 7069ac2</changelog>
  <changelog author="rhopkins@suse.de" date="1719921607">- hsr: Prevent use after free in prp_create_tagged_frame()
  (CVE-2023-52846 bsc#1225098).
- commit cf63988</changelog>
  <changelog author="krisman@suse.de" date="1719921608">- io_uring: Fix io_cqring_wait() not restoring sigmask on
  get_timespec64() failure (git-fixes).
- commit e640a65</changelog>
  <changelog author="krisman@suse.de" date="1719921609">- io_uring: check for non-NULL file pointer in io_file_can_poll()
  (bsc#1226990 CVE-2024-39371).
- io_uring/io-wq: Use set_bit() and test_bit() at worker-&gt;flags
  (git-fixes).
- io_uring/sqpoll: work around a potential audit memory leak
  (git-fixes).
- commit 24603fc</changelog>
  <changelog author="krisman@suse.de" date="1719921610">- io_uring/rsrc: fix incorrect assignment of iter-&gt;nr_segs in
  io_import_fixed (git-fixes).
- io_uring/rsrc: don't lock while !TASK_RUNNING (git-fixes).
- io_uring/io-wq: avoid garbage value of 'match' in
  io_wq_enqueue() (git-fixes).
- commit 7d3e252</changelog>
</package>
<package pkgid="faf5d76f7fdb9cdcb640f864032e5f6bad8cd670572631e78f43b9ba1a4875be" name="dtb-rockchip" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.17.1"/>
  <changelog author="tiwai@suse.de" date="1722081600">- auxdisplay: ht16k33: Drop reference after LED registration
  (git-fixes).
- ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
  on unprepare (git-fixes).
- ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
- ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
  reachable (git-fixes).
- ASoC: sof: amd: fix for firmware reload failure in Vangogh
  platform (git-fixes).
- ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
- ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
  (git-fixes).
- ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
- ALSA: ump: Don't update FB name for static blocks (git-fixes).
- drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
- drm/i915/gt: Do not consider preemption during execlists_dequeue
  for gen8 (git-fixes).
- drm/i915/dp: Don't switch the LTTPR mode on an active link
  (git-fixes).
- commit d7e2deb</changelog>
  <changelog author="tiwai@suse.de" date="1722081601">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
</package>
<package pkgid="e86c1760540564eac3d3c269b44535ae64dc94b3ae3a50b5ba496514877ee48e" name="dtb-rockchip" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.7.1"/>
  <changelog author="mkubecek@suse.cz" date="1717416000">- netfilter: nf_tables: release mutex after nft_gc_seq_end from
  abort path (CVE-2024-26925 bsc#1223390).
- commit 578a709</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717416001">- Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
  The L3 bsc#1225765 was created seperately since our customer requires
  PTF.
- Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
- Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
- Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
- Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
- commit 054635e</changelog>
  <changelog author="msuchanek@suse.de" date="1717416002">- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
- powerpc/uaccess: Fix build errors seen with GCC 13/14
  (bsc#1194869).
- commit 46b5d84</changelog>
  <changelog author="msuchanek@suse.de" date="1717416003">- blacklist.conf: PPC fsl_msi is not used
- commit ae6590d</changelog>
  <changelog author="msuchanek@suse.de" date="1717416004">- powerpc/pseries/lparcfg: drop error message from guest name
  lookup (bsc#1187716 ltc#193451 git-fixes).
- commit ceab637</changelog>
  <changelog author="mfranc@suse.cz" date="1717416005">- Update
  patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
  (git-fixes CVE-2024-36955).
- Update
  patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
  (git-fixes bsc#1225715 CVE-2024-36906).
- Update
  patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
  (git-fixes bsc#1225579 CVE-2024-36011).
- Update
  patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
  (git-fixes bsc#1225578 CVE-2024-36013).
- Update
  patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
  (git-fixes bsc#1225502 CVE-2024-36012).
- Update
  patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
  (git-fixes bsc#1225722 CVE-2024-36880).
- Update
  patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
  (git-fixes CVE-2024-36942).
- Update
  patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
  (git-fixes bsc#1225720 CVE-2024-36032).
- Update
  patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
  (git-fixes bsc#1223749 CVE-2024-26990).
- Update
  patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
  (git-fixes bsc#1223692 CVE-2024-26992).
- Update
  patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
  (stable-fixes CVE-2024-36944).
- Update
  patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
  (git-fixes bsc#1225734 CVE-2024-36896).
- Update
  patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
  (stable-fixes CVE-2024-36949).
- Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
  (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
- Update
  patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
  (git-fixes bsc#1225692 CVE-2023-52882).
- Update
  patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
  (git-fixes CVE-2024-26761).
- Update
  patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
  (stable-fixes bsc#1225735 CVE-2024-36897).
- Update
  patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
  (stable-fixes bsc#1225705 CVE-2024-36026).
- Update
  patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
  (stable-fixes CVE-2024-36951).
- Update
  patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
  (git-fixes bsc#1225593 CVE-2024-36014).
- Update
  patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
  (stable-fixes bsc#1225728 CVE-2024-36885).
- Update
  patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
  (git-fixes bsc#1225773 CVE-2024-36936).
- Update
  patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
  (stable-fixes CVE-2024-36950).
- Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
  (git-fixes bsc#1225736 CVE-2024-36898).
- Update
  patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
  (git-fixes bsc#1225698 CVE-2024-36020).
- Update
  patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
  (git-fixes bsc#1225710 CVE-2024-36891).
- Update
  patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
  (git-fixes bsc#1225714 CVE-2024-36890).
- Update
  patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
  (git-fixes bsc#1225708 CVE-2024-36029).
- Update
  patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
  (git-fixes bsc#1225699 CVE-2024-36021).
- Update
  patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
  (git-fixes CVE-2024-26943).
- Update
  patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
  (git-fixes bsc#1225694 CVE-2024-36018).
- Update
  patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
  (git-fixes CVE-2024-36940).
- Update
  patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
  (git-fixes CVE-2024-36959).
- Update
  patches.suse/ppdev-Add-an-error-check-in-register_device.patch
  (git-fixes bsc#1225640 CVE-2024-36015).
- Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
  CVE-2024-36947).
- Update
  patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
  (git-fixes bsc#1225695 CVE-2024-36019).
- Update
  patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
  (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
- Update
  patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
  (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
- Update
  patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
  (git-fixes bsc#1225704 CVE-2024-36025).
- Update
  patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
  (git-fixes CVE-2024-36930).
- Update
  patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
  (bsc#1224331 bsc#1224602 CVE-2024-35814).
- Update
  patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
  (git-fixes bsc#1225642 CVE-2024-36016).
- Update
  patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
  (git-fixes bsc#1225749 CVE-2024-36894).
- Update
  patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
  (git-fixes bsc#1225750 CVE-2024-36895).
- Update
  patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
  (git-fixes bsc#1225748 CVE-2024-36893).
- Update
  patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
  (stable-fixes bsc#1225769 CVE-2024-36921).
- Update
  patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
  (stable-fixes CVE-2024-36922).
- Update
  patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
  (git-fixes CVE-2024-36941).
- Update
  patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
  (git-fixes bsc#1224742 CVE-2024-35803).
- commit 539780f</changelog>
  <changelog author="dwagner@suse.de" date="1717416006">- nvmet: fix ns enable/disable possible hang (git-fixes).
- nvme-multipath: fix io accounting on failover (git-fixes).
- nvme: fix multipath batched completion accounting (git-fixes).
- commit ed3b392</changelog>
  <changelog author="dwagner@suse.de" date="1717416007">- scsi: lpfc: Copyright updates for 14.4.0.2 patches
  (bsc#1225842).
- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
  (bsc#1225842).
  Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
  (bsc#1225842).
- scsi: lpfc: Clear deferred RSCN processing flag when driver
  is unloading (bsc#1225842).
- scsi: lpfc: Update logging of protection type for T10 DIF I/O
  (bsc#1225842).
- scsi: lpfc: Change default logging level for unsolicited CT
  MIB commands (bsc#1225842).
- commit 5a56384</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416008">- smb: client: fix mount when dns_resolver key is not available
  (git-fixes, bsc#1225172).
- commit 28edb5c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416009">- cifs: fix leak of iface for primary channel (git-fixes,
  bsc#1225172).
- commit b7eb8e8</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416010">- Revert "cifs: reconnect work should have reference on server
  struct" (git-fixes, bsc#1225172).
- commit 3ca4c0c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416011">- smb: client: fix parsing of SMB3.1.1 POSIX create context
  (git-fixes, bsc#1225172).
- commit 5f27f69</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416012">- cifs: failure to add channel on iface should bump up weight
  (git-fixes, bsc#1225172).
- commit 007b237</changelog>
  <changelog author="tonyj@suse.de" date="1717416013">- perf/x86: Fix out of range data (git-fixes).
- perf/x86/intel/ds: Don't clear -&gt;pebs_data_cfg for the last
  PEBS event (git-fixes).
- perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
- commit 664d77f</changelog>
  <changelog author="dsterba@suse.com" date="1717588800">- blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
- Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
  Quoting bsc#1225945#c11:
  "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
  transaction for every subvol create")
  ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
  unwritten extent buffer after snapshotting a new subvolume") was never
  backported."
- commit d947258</changelog>
  <changelog author="tonyj@suse.de" date="1717588801">- perf pmu: Count sys and cpuid JSON events separately (git
  fixes).
- perf stat: Don't display metric header for non-leader uncore
  events (git-fixes).
- perf daemon: Fix file leak in daemon_session__control
  (git-fixes).
- perf symbols: Fix ownership of string in dso__load_vmlinux()
  (git-fixes).
- perf thread: Fixes to thread__new() related to initializing comm
  (git-fixes).
- perf report: Avoid SEGV in report__setup_sample_type()
  (git-fixes).
- perf ui browser: Don't save pointer to stack memory (git-fixes).
- perf bench internals inject-build-id: Fix trap divide when
  collecting just one DSO (git-fixes).
- perf intel-pt: Fix unassigned instruction op (discovered by
  MemorySanitizer) (git-fixes).
- perf test shell arm_coresight: Increase buffer size for
  Coresight basic tests (git-fixes).
- perf docs: Document bpf event modifier (git-fixes).
- perf bench uprobe: Remove lib64 from libc.so.6 binary path
  (git-fixes).
- perf record: Fix debug message placement for test consumption
  (git-fixes).
- perf tests: Apply attributes to all events in object code
  reading test (git-fixes).
- perf tests: Make "test data symbol" more robust on Neoverse N1
  (git-fixes).
- perf annotate: Fix annotation_calc_lines() to pass correct
  address to get_srcline() (git-fixes).
- perf stat: Do not fail on metrics on s390 z/VM systems
  (git-fixes).
- perf sched timehist: Fix -g/--call-graph option failure
  (git-fixes).
- perf annotate: Get rid of duplicate --group option item
  (git-fixes).
- perf probe: Add missing libgen.h header needed for using
  basename() (git-fixes).
- perf record: Delete session after stopping sideband thread
  (git-fixes).
- perf auxtrace: Fix multiple use of --itrace option (git-fixes).
- perf script: Show also errors for --insn-trace option
  (git-fixes).
- perf lock contention: Add a missing NULL check (git-fixes).
- perf vendor events amd: Fix Zen 4 cache latency events
  (git-fixes).
- libperf evlist: Avoid out-of-bounds access (git-fixes).
- perf pmu: Fix a potential memory leak in perf_pmu__lookup()
  (git-fixes).
- perf print-events: make is_event_supported() more robust
  (git-fixes).
- perf list: fix short description for some cache events
  (git-fixes).
- perf metric: Don't remove scale from counts (git-fixes).
- perf stat: Avoid metric-only segv (git-fixes).
- perf expr: Fix "has_event" function for metric style events
  (git-fixes).
- perf srcline: Add missed addr2line closes (git-fixes).
- perf thread_map: Free strlist on normal path in
  thread_map__new_by_tid_str() (git-fixes).
- perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
- perf jevents: Drop or simplify small integer values (git-fixes).
- perf evsel: Fix duplicate initialization of data-&gt;id in
  evsel__parse_sample() (git-fixes).
- perf pmu: Treat the msr pmu as software (git-fixes).
- perf record: Check conflict between '--timestamp-filename'
  option and pipe mode before recording (git-fixes).
- perf record: Fix possible incorrect free in
  record__switch_output() (git-fixes).
- perf vendor events amd: Add Zen 4 memory controller events
  (git-fixes).
- perf top: Uniform the event name for the hybrid machine
  (git-fixes).
- perf top: Use evsel's cpus to replace user_requested_cpus
  (git-fixes).
- commit a1f9340</changelog>
  <changelog author="tonyj@suse.de" date="1717675200">- perf ui browser: Avoid SEGV on title (git fixes).
- commit 1578c22</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675201">- inet: inet_defrag: prevent sk release while still in use
  (CVE-2024-26921 bsc#1223138).
- commit 2016faf</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675202">- net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
- commit 7bf5961</changelog>
  <changelog author="tiwai@suse.de" date="1718366400">- Temporarily drop KVM patch that caused a regression (bsc#1226158)
  Delete patches.suse/KVM-x86-pmu-Prioritize-VMX-interception-over-GP-on-R.patch
- commit 33f31da</changelog>
</package>
<package pkgid="31d734628fe05b321c1f119f66be53d909b3e187c05f9ec859d8874e6b4c0da6" name="dtb-socionext" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.14.1"/>
  <changelog author="tiwai@suse.de" date="1719662400">- gpiolib: cdev: Disallow reconfiguration without direction
  (uAPI v1) (git-fixes).
- gpio: davinci: Validate the obtained number of IRQs (git-fixes).
- commit 919ebd1</changelog>
  <changelog author="tiwai@suse.de" date="1719748800">- i2c: testunit: discard write requests while old command is
  running (git-fixes).
- i2c: testunit: don't erase registers after STOP (git-fixes).
- mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
  (git-fixes).
- mmc: sdhci: Do not invert write-protect twice (git-fixes).
- mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
  (git-fixes).
- mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
  (git-fixes).
- commit 448487d</changelog>
  <changelog author="tiwai@suse.de" date="1719748801">- crypto: iaa - Account for cpu-less numa nodes (bsc#1227190).
- commit cd600aa</changelog>
  <changelog author="tiwai@suse.de" date="1719748802">- crypto: deflate - Add aliases to deflate (bsc#1227190).
- commit 27ffd92</changelog>
  <changelog author="tiwai@suse.de" date="1719835200">- ata: ahci: Clean up sysfs file on error (git-fixes).
- ata: libata-core: Fix double free on error (git-fixes).
- ata,scsi: libata-core: Do not leak memory for ata_port struct
  members (git-fixes).
- ata: libata-core: Fix null pointer dereference on error
  (git-fixes).
- kbuild: Fix build target deb-pkg: ln: failed to create hard link
  (git-fixes).
- kbuild: doc: Update default INSTALL_MOD_DIR from extra to
  updates (git-fixes).
- kbuild: Install dtb files as 0644 in Makefile.dtbinst
  (git-fixes).
- counter: ti-eqep: enable clock at probe (git-fixes).
- iio: chemical: bme680: Fix sensor data read operation
  (git-fixes).
- iio: chemical: bme680: Fix overflows in compensate() functions
  (git-fixes).
- iio: chemical: bme680: Fix calibration data variable
  (git-fixes).
- iio: chemical: bme680: Fix pressure value output (git-fixes).
- iio: accel: fxls8962af: select IIO_BUFFER &amp; IIO_KFIFO_BUF
  (git-fixes).
- iio: adc: ad7266: Fix variable checking bug (git-fixes).
- iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
  (git-fixes).
- serial: bcm63xx-uart: fix tx after conversion to
  uart_port_tx_limited() (git-fixes).
- serial: core: introduce uart_port_tx_limited_flags()
  (git-fixes).
- Revert "serial: core: only stop transmit when HW fifo is empty"
  (git-fixes).
- tty: mcf: MCF54418 has 10 UARTS (git-fixes).
- usb: gadget: aspeed_udc: fix device address configuration
  (git-fixes).
- usb: dwc3: core: remove lock of otg mode during gadget
  suspend/resume to avoid deadlock (git-fixes).
- usb: typec: ucsi: glink: fix child node release in probe
  function (git-fixes).
- usb: musb: da8xx: fix a resource leak in probe() (git-fixes).
- usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  (git-fixes).
- usb: gadget: printer: fix races against disable (git-fixes).
- PCI/MSI: Fix UAF in msi_capability_init (git-fixes).
- commit a2ea5a9</changelog>
  <changelog author="ptesarik@suse.com" date="1719835201">- net: ena: Fix redundant device NUMA node override
  (jsc#PED-8688).
- commit 6ad6684</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835202">- tcp: do not accept ACK of bytes we never sent (CVE-2023-52881
  bsc#1225611).
- commit 16404a6</changelog>
  <changelog author="mhocko@suse.com" date="1719835203">- Update
  patches.suse/1352-drm-amdgpu-Fix-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52883
  bsc#1226630).
- Update
  patches.suse/9p-add-missing-locking-around-taking-dentry-fid-list.patch
  (git-fixes CVE-2024-39463 bsc#1227090).
- Update
  patches.suse/ALSA-Fix-deadlocks-with-kctl-removals-at-disconnecti.patch
  (stable-fixes CVE-2024-38600 bsc#1226864).
- Update
  patches.suse/ALSA-core-Fix-NULL-module-pointer-assignment-at-card.patch
  (git-fixes CVE-2024-38605 bsc#1226740).
- Update
  patches.suse/ALSA-hda-Fix-possible-null-ptr-deref-when-assigning-.patch
  (git-fixes CVE-2023-52806 bsc#1225554).
- Update
  patches.suse/ALSA-hda-cs_dsp_ctl-Use-private_free-for-control-cle.patch
  (git-fixes CVE-2024-38388 bsc#1226890).
- Update
  patches.suse/ALSA-timer-Set-lower-bound-of-start-tick-time.patch
  (stable-fixes git-fixes CVE-2024-38618 bsc#1226754).
- Update
  patches.suse/ASoC-kirkwood-Fix-potential-NULL-dereference.patch
  (git-fixes CVE-2024-38550 bsc#1226633).
- Update
  patches.suse/ASoC-mediatek-Assign-dummy-when-codec-not-specified-.patch
  (git-fixes CVE-2024-38551 bsc#1226761).
- Update
  patches.suse/Bluetooth-btusb-Add-date-evt_skb-is-NULL-check.patch
  (git-fixes CVE-2023-52833 bsc#1225595).
- Update
  patches.suse/Bluetooth-hci_core-Fix-possible-buffer-overflow.patch
  (git-fixes CVE-2024-26889).
- Update
  patches.suse/HID-uclogic-Fix-user-memory-access-bug-in-uclogic_pa.patch
  (git-fixes CVE-2023-52866 bsc#1225120).
- Update
  patches.suse/IB-mlx5-Fix-init-stage-error-handling-to-avoid-doubl.patch
  (jsc#PED-6864 CVE-2023-52851 bsc#1225587).
- Update
  patches.suse/Input-cyapa-add-missing-input-core-locking-to-suspen.patch
  (git-fixes CVE-2023-52884 bsc#1226764).
- Update
  patches.suse/Input-synaptics-rmi4-fix-use-after-free-in-rmi_unreg.patch
  (git-fixes CVE-2023-52840 bsc#1224928).
- Update
  patches.suse/KEYS-trusted-Do-not-use-WARN-when-encode-fails.patch
  (git-fixes CVE-2024-36975 bsc#1226520).
- Update
  patches.suse/KEYS-trusted-Fix-memory-leak-in-tpm2_key_encode.patch
  (git-fixes CVE-2024-36967 bsc#1226131).
- Update
  patches.suse/RDMA-cma-Fix-kmemleak-in-rdma_core-observed-during-b.patch
  (git-fixes CVE-2024-38539 bsc#1226608).
- Update patches.suse/RDMA-hns-Fix-UAF-for-cq-async-event.patch
  (git-fixes CVE-2024-38545 bsc#1226595).
- Update
  patches.suse/RDMA-hns-Fix-deadlock-on-SRQ-async-events.patch
  (git-fixes CVE-2024-38591 bsc#1226738).
- Update
  patches.suse/RDMA-hns-Modify-the-print-level-of-CQE-error.patch
  (git-fixes CVE-2024-38590 bsc#1226839).
- Update
  patches.suse/RDMA-rxe-Fix-seg-fault-in-rxe_comp_queue_pkt.patch
  (git-fixes CVE-2024-38544 bsc#1226597).
- Update
  patches.suse/SUNRPC-Fix-RPC-client-cleaned-up-the-freed-pipefs-de.patch
  (git-fixes CVE-2023-52803 bsc#1225008).
- Update patches.suse/af_unix-Clear-stale-u-oob_skb.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-35970 bsc#1224584).
- Update
  patches.suse/af_unix-Drop-oob_skb-ref-before-purging-queue-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26750 bsc#1222617).
- Update
  patches.suse/af_unix-Fix-task-hung-while-purging-oob_skb-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26780 bsc#1222588).
- Update
  patches.suse/af_unix-Update-unix_sk-sk-oob_skb-under-sk_receive_queue-lock.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-36972 bsc#1226163).
- Update
  patches.suse/arm64-Restrict-CPU_BIG_ENDIAN-to-GNU-as-or-LLVM-IAS-.patch
  (git-fixes CVE-2023-52750 bsc#1225485).
- Update
  patches.suse/atl1c-Work-around-the-DMA-RX-overflow-issue.patch
  (git-fixes CVE-2023-52834 bsc#1225599).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issue-of-net_device.patch
  (git-fixes CVE-2024-38554 bsc#1226742).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issues-of-ax25_dev.patch
  (git-fixes CVE-2024-38602 bsc#1226613).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-reorder-of-WRITE-lqueued.patch
  (bsc#1225605 CVE-2024-38384 bsc#1226938).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-resetting-io-stat.patch
  (bsc#1225605 CVE-2024-38663 bsc#1226939).
- Update
  patches.suse/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch
  (git-fixes CVE-2024-38540 bsc#1226582).
- Update
  patches.suse/bonding-stop-the-device-in-bond_setup_by_slave.patch
  (git-fixes CVE-2023-52784 bsc#1224946).
- Update
  patches.suse/can-dev-can_put_echo_skb-don-t-crash-kernel-if-can_p.patch
  (git-fixes CVE-2023-52878 bsc#1225000).
- Update
  patches.suse/clk-mediatek-clk-mt2701-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52875 bsc#1225096).
- Update
  patches.suse/clk-mediatek-clk-mt6765-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52870 bsc#1224937).
- Update
  patches.suse/clk-mediatek-clk-mt6779-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52873 bsc#1225589).
- Update
  patches.suse/clk-mediatek-clk-mt6797-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52865 bsc#1225086).
- Update
  patches.suse/clk-mediatek-clk-mt7629-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52858 bsc#1225566).
- Update
  patches.suse/clk-mediatek-clk-mt7629-eth-Add-check-for-mtk_alloc_.patch
  (git-fixes CVE-2023-52876 bsc#1225036).
- Update
  patches.suse/cppc_cpufreq-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38573 bsc#1226739).
- Update patches.suse/cpufreq-exit-callback-is-optional.patch
  (git-fixes CVE-2024-38615 bsc#1226592).
- Update patches.suse/crypto-bcm-Fix-pointer-arithmetic.patch
  (git-fixes CVE-2024-38579 bsc#1226637).
- Update
  patches.suse/crypto-pcrypt-Fix-hungtask-for-PADATA_RESET.patch
  (git-fixes CVE-2023-52813 bsc#1225527).
- Update patches.suse/cxl-mem-Fix-shutdown-order.patch (git-fixes
  CVE-2023-52849 bsc#1224949).
- Update
  patches.suse/cxl-region-Do-not-try-to-cleanup-after-cxl_region_se.patch
  (git-fixes CVE-2023-52792 bsc#1225477).
- Update patches.suse/cxl-region-Fix-cxlr_pmem-leaks.patch
  (git-fixes CVE-2024-38391 bsc#1226894).
- Update
  patches.suse/dma-buf-sw-sync-don-t-enable-IRQ-from-sync_print_obj.patch
  (git-fixes CVE-2024-38780 bsc#1226886).
- Update
  patches.suse/dma-mapping-benchmark-fix-node-id-validation.patch
  (git-fixes CVE-2024-34777 bsc#1226796).
- Update
  patches.suse/dma-mapping-benchmark-handle-NUMA_NO_NODE-correctly.patch
  (git-fixes CVE-2024-39277 bsc#1226909).
- Update
  patches.suse/dmaengine-idxd-Avoid-unnecessary-destruction-of-file.patch
  (git-fixes CVE-2024-38629 bsc#1226905).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Pola.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52819
  bsc#1225532).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-SMU7.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52818
  bsc#1225530).
- Update
  patches.suse/drm-amd-check-num-of-link-levels-when-update-pcie-pa.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52812
  bsc#1225564).
- Update
  patches.suse/drm-amd-display-Avoid-NULL-dereference-of-timing-gen.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52753
  bsc#1225478).
- Update
  patches.suse/drm-amd-display-Fix-division-by-zero-in-setup_dsc_co.patch
  (stable-fixes CVE-2024-36969 bsc#1226155).
- Update
  patches.suse/drm-amd-display-Fix-null-pointer-dereference-in-erro.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52862
  bsc#1225015).
- Update
  patches.suse/drm-amd-display-Fix-potential-index-out-of-bounds-in.patch
  (git-fixes CVE-2024-38552 bsc#1226767).
- Update
  patches.suse/drm-amd-display-fix-a-NULL-pointer-dereference-in-am.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52773
  bsc#1225041).
- Update
  patches.suse/drm-amd-display-fixed-integer-types-and-null-check-l.patch
  (git-fixes CVE-2024-26767).
- Update
  patches.suse/drm-amdgpu-Fix-a-null-pointer-access-when-the-smc_rr.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52817
  bsc#1225569).
- Update
  patches.suse/drm-amdgpu-Fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch
  (git-fixes CVE-2024-39291 bsc#1226934).
- Update
  patches.suse/drm-amdgpu-Fix-potential-null-pointer-derefernce.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52814
  bsc#1225565).
- Update
  patches.suse/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch
  (stable-fixes CVE-2024-39471 bsc#1227096).
- Update
  patches.suse/drm-amdgpu-mes-fix-use-after-free-issue.patch
  (stable-fixes CVE-2024-38581 bsc#1226657).
- Update
  patches.suse/drm-amdgpu-vkms-fix-a-possible-null-pointer-derefere.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52815
  bsc#1225568).
- Update
  patches.suse/drm-amdkfd-Fix-a-race-condition-of-vram-buffer-unref.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52825
  bsc#1225076).
- Update
  patches.suse/drm-amdkfd-Fix-shift-out-of-bounds-issue.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52816
  bsc#1225529).
- Update
  patches.suse/drm-bridge-cdns-mhdp8546-Fix-possible-null-pointer-d.patch
  (git-fixes CVE-2024-38548).
- Update
  patches.suse/drm-bridge-it66121-Fix-invalid-connector-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52861
  bsc#1224941).
- Update
  patches.suse/drm-bridge-lt8912b-Fix-crash-on-bridge-detach.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52856
  bsc#1224932).
- Update
  patches.suse/drm-mediatek-Add-0-size-check-to-mtk_drm_gem_obj.patch
  (git-fixes CVE-2024-38549 bsc#1226735).
- Update
  patches.suse/drm-mediatek-Fix-coverity-issue-with-unintentional-i.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52857
  bsc#1225581).
- Update
  patches.suse/drm-mediatek-Init-ddp_comp-with-devm_kcalloc.patch
  (git-fixes CVE-2024-38592 bsc#1226844).
- Update
  patches.suse/drm-msm-a6xx-Avoid-a-nullptr-dereference-when-speedb.patch
  (git-fixes CVE-2024-38390 bsc#1226891).
- Update
  patches.suse/drm-msm-dpu-Add-callback-function-pointer-check-befo.patch
  (git-fixes CVE-2024-38622 bsc#1226856).
- Update
  patches.suse/drm-panel-fix-a-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52821
  bsc#1225022).
- Update
  patches.suse/drm-panel-panel-tpo-tpg110-fix-a-possible-null-point.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52826
  bsc#1225077).
- Update patches.suse/drm-radeon-possible-buffer-overflow.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52867
  bsc#1225009).
- Update
  patches.suse/drm-vc4-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38546 bsc#1226593).
- Update
  patches.suse/drm-vmwgfx-Fix-invalid-reads-in-fence-signaled-event.patch
  (git-fixes CVE-2024-36960 bsc#1225872).
- Update
  patches.suse/drm-zynqmp_dpsub-Always-register-bridge.patch
  (git-fixes CVE-2024-38664 bsc#1226941).
- Update
  patches.suse/e1000e-change-usleep_range-to-udelay-in-PHY-mdic-acc.patch
  (CVE-2024-39296 bsc#1226989 CVE-2024-36887 bsc#1225731).
- Update
  patches.suse/ecryptfs-Fix-buffer-size-for-tag-66-packet.patch
  (git-fixes CVE-2024-38578 bsc#1226634).
- Update
  patches.suse/efi-libstub-only-free-priv.runtime_map-when-allocate.patch
  (git-fixes CVE-2024-33619 bsc#1226768).
- Update
  patches.suse/fbdev-imsttfb-fix-a-resource-leak-in-probe.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52838
  bsc#1225031).
- Update
  patches.suse/fs-9p-only-translate-RWX-permissions-for-plain-9P200.patch
  (git-fixes CVE-2024-36964 bsc#1225866).
- Update
  patches.suse/fs-jfs-Add-check-for-negative-db_l2nbperpage.patch
  (git-fixes CVE-2023-52810 bsc#1225557).
- Update
  patches.suse/fs-jfs-Add-validity-check-for-db_maxag-and-db_agpref.patch
  (git-fixes CVE-2023-52804 bsc#1225550).
- Update
  patches.suse/ftrace-Fix-possible-use-after-free-issue-in-ftrace_location.patch
  (git-fixes CVE-2024-38588 bsc#1226837).
- Update
  patches.suse/genirq-irqdesc-Prevent-use-after-free-in-irq_find_at.patch
  (git-fixes CVE-2024-38385 bsc#1227085).
- Update patches.suse/gfs2-ignore-negated-quota-changes.patch
  (git-fixes CVE-2023-52759 bsc#1225560).
- Update
  patches.suse/hid-cp2112-Fix-duplicate-workqueue-initialization.patch
  (git-fixes CVE-2023-52853 bsc#1224988).
- Update
  patches.suse/hwmon-axi-fan-control-Fix-possible-NULL-pointer-dere.patch
  (git-fixes CVE-2023-52863 bsc#1225586).
- Update
  patches.suse/i2c-acpi-Unbind-mux-adapters-before-delete.patch
  (git-fixes CVE-2024-39362 bsc#1226995).
- Update
  patches.suse/i2c-core-Run-atomic-i2c-xfer-when-preemptible.patch
  (git-fixes CVE-2023-52791 bsc#1225108).
- Update
  patches.suse/i3c-master-mipi-i3c-hci-Fix-a-kernel-panic-for-acces.patch
  (git-fixes CVE-2023-52763 bsc#1225570).
- Update
  patches.suse/i3c-mipi-i3c-hci-Fix-out-of-bounds-access-in-hci_dma.patch
  (git-fixes CVE-2023-52766).
- Update
  patches.suse/i915-perf-Fix-NULL-deref-bugs-with-drm_dbg-calls.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52788
  bsc#1225106).
- Update
  patches.suse/igb-Fix-string-truncation-warnings-in-igb_set_fw_ver.patch
  (git-fixes CVE-2024-36010 bsc#1225594).
- Update
  patches.suse/iommu-vt-d-Fix-WARN_ON-in-iommu-probe-path.patch
  (git-fixes CVE-2024-35957 bsc#1224673).
- Update
  patches.suse/iommufd-Fix-missing-update-of-domains_itree-after-splitting-iopt
  (jsc#PED-7779 jsc#PED-7780 CVE-2023-52801 bsc#1225006).
- Update
  patches.suse/ipvlan-add-ipvlan_route_v6_outbound-helper.patch
  (git-fixes CVE-2023-52796 bsc#1224930).
- Update
  patches.suse/jffs2-prevent-xattr-node-from-overflowing-the-eraseblock.patch
  (git-fixes CVE-2024-38599 bsc#1226848).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-dbFindLeaf.patch
  (git-fixes CVE-2023-52799 bsc#1225472).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-diAlloc.patch
  (git-fixes CVE-2023-52805 bsc#1225553).
- Update
  patches.suse/kunit-fortify-Fix-mismatched-kvalloc-vfree-usage.patch
  (git-fixes CVE-2024-38617 bsc#1226859).
- Update
  patches.suse/lib-generic-radix-tree.c-Don-t-overflow-in-peek.patch
  (git-fixes CVE-2021-47432 bsc#1225391).
- Update
  patches.suse/lib-test_hmm.c-handle-src_pfns-and-dst_pfns-allocati.patch
  (git-fixes CVE-2024-38543 bsc#1226594).
- Update
  patches.suse/locking-ww_mutex-test-Fix-potential-workqueue-corrup.patch
  (bsc#1219953 CVE-2023-52836 bsc#1225609).
- Update
  patches.suse/md-Don-t-ignore-suspended-array-in-md_check_recovery-1baa.patch
  (bsc#1219596 CVE-2024-26758).
- Update
  patches.suse/media-atomisp-ssh_css-Fix-a-null-pointer-dereference.patch
  (git-fixes CVE-2024-38547 bsc#1226632).
- Update
  patches.suse/media-bttv-fix-use-after-free-error-due-to-btv-timeo.patch
  (git-fixes CVE-2023-52847 bsc#1225588).
- Update
  patches.suse/media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch
  (git-fixes CVE-2023-52764 bsc#1225571).
- Update
  patches.suse/media-hantro-Check-whether-reset-op-is-defined-befor.patch
  (git-fixes CVE-2023-52850 bsc#1225014).
- Update
  patches.suse/media-i2c-et8ek8-Don-t-strip-remove-function-when-dr.patch
  (git-fixes CVE-2024-38611 bsc#1226760).
- Update
  patches.suse/media-imon-fix-access-to-invalid-resource-for-the-se.patch
  (git-fixes CVE-2023-52754 bsc#1225490).
- Update
  patches.suse/media-lgdt3306a-Add-a-check-against-null-pointer-def.patch
  (stable-fixes CVE-2022-48772 bsc#1226976).
- Update
  patches.suse/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch
  (git-fixes CVE-2024-38621 bsc#1226895).
- Update
  patches.suse/media-vidtv-mux-Add-check-and-kfree-for-kstrdup.patch
  (git-fixes CVE-2023-52841 bsc#1225592).
- Update patches.suse/media-vidtv-psi-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52844 bsc#1225590).
- Update
  patches.suse/mfd-qcom-spmi-pmic-Fix-revid-implementation.patch
  (git-fixes CVE-2023-52765 bsc#1225029).
- Update
  patches.suse/misc-microchip-pci1xxxx-fix-double-free-in-the-error.patch
  (git-fixes CVE-2024-36973 bsc#1226457).
- Update
  patches.suse/net-hns3-fix-out-of-bounds-access-may-occur-when-coa.patch
  (git-fixes CVE-2023-52807 bsc#1225097).
- Update
  patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch
  (git-fixes CVE-2024-36962 bsc#1225827).
- Update
  patches.suse/net-mlx5-Fix-peer-devlink-set-for-SF-representor-dev.patch
  (git-fixes CVE-2024-38595 bsc#1226741).
- Update
  patches.suse/net-mlx5e-Track-xmit-submission-to-PTP-WQ-after-popu.patch
  (jsc#PED-3311 CVE-2023-52782 bsc#1225103).
- Update
  patches.suse/net-mvneta-fix-calls-to-page_pool_get_stats.patch
  (git-fixes CVE-2023-52780 bsc#1224933).
- Update
  patches.suse/net-wangxun-fix-kernel-panic-due-to-null-pointer.patch
  (git-fixes CVE-2023-52783 bsc#1225104).
- Update
  patches.suse/netfilter-complete-validation-of-user-input.patch
  (git-fixes CVE-2024-35896 bsc#1224662 CVE-2024-35962
  bsc#1224583).
- Update
  patches.suse/nfc-nci-Fix-uninit-value-in-nci_rx_work.patch
  (git-fixes CVE-2024-38381 bsc#1226878).
- Update
  patches.suse/nilfs2-fix-nilfs_empty_dir-misjudgment-and-long-loop.patch
  (git-fixes CVE-2024-39469 bsc#1226992).
- Update
  patches.suse/nilfs2-fix-potential-hang-in-nilfs_detach_log_writer.patch
  (git-fixes CVE-2024-38582 bsc#1226658).
- Update
  patches.suse/nilfs2-fix-use-after-free-of-timer-for-log-writer-th.patch
  (git-fixes CVE-2024-38583 bsc#1226777).
- Update
  patches.suse/of-module-add-buffer-overflow-check-in-of_modalias.patch
  (git-fixes CVE-2024-38541 bsc#1226587).
- Update
  patches.suse/padata-Fix-refcnt-handling-in-padata_free_shell.patch
  (git-fixes CVE-2023-52854 bsc#1225584).
- Update
  patches.suse/perf-core-Bail-out-early-if-the-request-AUX-area-is-out-of-bound.patch
  (git-fixes CVE-2023-52835 bsc#1225602).
- Update
  patches.suse/platform-x86-wmi-Fix-opening-of-char-device.patch
  (git-fixes CVE-2023-52864 bsc#1225132).
- Update
  patches.suse/powerpc-pseries-iommu-LPAR-panics-during-boot-up-wit.patch
  (bsc#1222011 ltc#205900 CVE-2024-36926 bsc#1225829).
- Update patches.suse/pstore-platform-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52869 bsc#1225050).
- Update
  patches.suse/remoteproc-mediatek-Make-sure-IPI-buffer-fits-in-L2T.patch
  (git-fixes CVE-2024-36965 bsc#1226149).
- Update
  patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch
  (git-fixes CVE-2024-38601 bsc#1226876).
- Update
  patches.suse/s390-dasd-protect-device-queue-against-concurrent-access.patch
  (git-fixes bsc#1217481 CVE-2023-52774 bsc#1225572).
- Update
  patches.suse/scsi-hisi_sas-Set-debugfs_dir-pointer-to-NULL-after-removing-debugfs.patch
  (git-fixes CVE-2023-52808 bsc#1225555).
- Update
  patches.suse/scsi-ibmvfc-Remove-BUG_ON-in-the-case-of-an-empty-ev.patch
  (bsc#1209834 ltc#202097 CVE-2023-52811 bsc#1225559).
- Update
  patches.suse/scsi-libfc-Fix-potential-NULL-pointer-dereference-in-fc_lport_ptp_setup.patch
  (git-fixes CVE-2023-52809 bsc#1225556).
- Update
  patches.suse/scsi-lpfc-Move-NPIV-s-transport-unregistration-to-af.patch
  (bsc#1221777 CVE-2024-36952 bsc#1225898).
- Update
  patches.suse/scsi-lpfc-Release-hbalock-before-calling-lpfc_worker.patch
  (bsc#1221777 CVE-2024-36924 bsc#1225820).
- Update
  patches.suse/serial-max3100-Lock-port-lock-when-calling-uart_hand.patch
  (git-fixes CVE-2024-38634 bsc#1226868).
- Update
  patches.suse/serial-max3100-Update-uart_driver_registered-on-driv.patch
  (git-fixes CVE-2024-38633 bsc#1226867).
- Update
  patches.suse/soc-qcom-llcc-Handle-a-second-device-without-data-co.patch
  (git-fixes CVE-2023-52871 bsc#1225534).
- Update
  patches.suse/soundwire-cadence-fix-invalid-PDI-offset.patch
  (stable-fixes CVE-2024-38635 bsc#1226863).
- Update patches.suse/speakup-Fix-sizeof-vs-ARRAY_SIZE-bug.patch
  (git-fixes CVE-2024-38587 bsc#1226780).
- Update patches.suse/spi-Fix-null-dereference-on-suspend.patch
  (git-fixes CVE-2023-52749 bsc#1225476).
- Update
  patches.suse/thermal-core-prevent-potential-string-overflow.patch
  (git-fixes CVE-2023-52868 bsc#1225044).
- Update
  patches.suse/thermal-drivers-qcom-lmh-Check-for-SCM-availability-.patch
  (git-fixes CVE-2024-39466 bsc#1227089).
- Update
  patches.suse/thermal-drivers-tsens-Fix-null-pointer-dereference.patch
  (git-fixes CVE-2024-38571 bsc#1226737).
- Update
  patches.suse/thermal-intel-powerclamp-fix-mismatch-in-get-functio.patch
  (git-fixes CVE-2023-52794 bsc#1225028).
- Update
  patches.suse/tls-fix-NULL-deref-on-tls_sw_splice_eof-with-empty-r.patch
  (jsc#PED-6831 CVE-2023-52767 bsc#1224998).
- Update
  patches.suse/tpm_tis_spi-Account-for-SPI-header-when-allocating-T.patch
  (git-fixes CVE-2024-36477 bsc#1226840).
- Update
  patches.suse/tracing-Have-trace_event_file-have-ref-counters.patch
  (git-fixes CVE-2023-52879 bsc#1225101).
- Update
  patches.suse/tracing-trigger-Fix-to-return-error-if-failed-to-alloc-snapshot.patch
  (git-fixes CVE-2024-26920).
- Update
  patches.suse/tty-n_gsm-fix-race-condition-in-status-line-change-o.patch
  (git-fixes CVE-2023-52872 bsc#1225591).
- Update
  patches.suse/tty-n_gsm-require-CAP_NET_ADMIN-to-attach-N_GSM0710-.patch
  (bsc#1222619 CVE-2023-52880).
- Update
  patches.suse/tty-vcc-Add-check-for-kstrdup-in-vcc_probe.patch
  (git-fixes CVE-2023-52789 bsc#1225180).
- Update
  patches.suse/usb-config-fix-iteration-issue-in-usb_get_bos_descri.patch
  (git-fixes CVE-2023-52781 bsc#1225092).
- Update
  patches.suse/usb-dwc3-Wait-unconditionally-after-issuing-EndXfer-.patch
  (git-fixes CVE-2024-36977 bsc#1226513).
- Update
  patches.suse/usb-gadget-u_audio-Fix-race-condition-use-of-control.patch
  (git-fixes CVE-2024-38628 bsc#1226911).
- Update
  patches.suse/usb-storage-alauda-Check-whether-the-media-is-initia.patch
  (git-fixes CVE-2024-38619 bsc#1226861).
- Update
  patches.suse/usb-typec-tcpm-Fix-NULL-pointer-dereference-in-tcpm_.patch
  (git-fixes CVE-2023-52877 bsc#1224944).
- Update
  patches.suse/vhost-vdpa-fix-use-after-free-in-vhost_vdpa_probe.patch
  (jsc#PED-3311 CVE-2023-52795 bsc#1225085).
- Update
  patches.suse/virtio-blk-fix-implicit-overflow-on-virtio_max_dma_s.patch
  (git-fixes CVE-2023-52762 bsc#1225573).
- Update
  patches.suse/virtio-vsock-Fix-uninit-value-in-virtio_transport_re.patch
  (jsc#PED-5505 CVE-2023-52842 bsc#1225025).
- Update
  patches.suse/watchdog-cpu5wdt.c-Fix-use-after-free-bug-caused-by-.patch
  (git-fixes CVE-2024-38630 bsc#1226908).
- Update
  patches.suse/wifi-ar5523-enable-proper-endpoint-verification.patch
  (git-fixes CVE-2024-38565 bsc#1226747).
- Update
  patches.suse/wifi-ath11k-fix-dfs-radar-event-locking.patch
  (git-fixes CVE-2023-52798 bsc#1224947).
- Update
  patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch
  (git-fixes CVE-2023-52777 bsc#1224992).
- Update patches.suse/wifi-ath11k-fix-htt-pktlog-locking.patch
  (git-fixes CVE-2023-52800).
- Update
  patches.suse/wifi-ath12k-fix-dfs-radar-and-temperature-event-lock.patch
  (git-fixes CVE-2023-52776 bsc#1225090).
- Update
  patches.suse/wifi-ath12k-fix-htt-mlo-offset-event-locking.patch
  (git-fixes CVE-2023-52769 bsc#1225001).
- Update
  patches.suse/wifi-ath12k-fix-out-of-bound-access-of-qmi_invoke_ha.patch
  (git-fixes CVE-2024-38572 bsc#1226776).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-read-in-ath12k.patch
  (git-fixes CVE-2023-52827 bsc#1225078).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-write-in-ath12.patch
  (git-fixes CVE-2023-52829 bsc#1225081).
- Update
  patches.suse/wifi-brcmfmac-pcie-handle-randbuf-allocation-failure.patch
  (git-fixes CVE-2024-38575 bsc#1226612).
- Update
  patches.suse/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch
  (git-fixes CVE-2024-38567 bsc#1226769).
- Update
  patches.suse/wifi-carl9170-re-fix-fortified-memset-warning.patch
  (git-fixes CVE-2024-38616 bsc#1226852).
- Update
  patches.suse/wifi-mac80211-don-t-return-unset-power-in-ieee80211_.patch
  (git-fixes CVE-2023-52832 bsc#1225577).
- Update
  patches.suse/wifi-nl80211-Avoid-address-calculations-via-out-of-b.patch
  (git-fixes CVE-2024-38562 bsc#1226788).
- Update
  patches.suse/wifi-wilc1000-use-vmm_table-as-array-in-wilc-struct.patch
  (git-fixes CVE-2023-52768 bsc#1225004).
- Update
  patches.suse/x86-tdx-Zero-out-the-missing-RSI-in-TDX_HYPERCALL-macro.patch
  (jsc#PED-5824 CVE-2023-52874 bsc#1225049).
- commit 33efdc4</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835204">- tcp: Use refcount_inc_not_zero() in tcp_twsk_unique()
  (CVE-2024-36904 bsc#1225732).
- commit d578dcc</changelog>
  <changelog author="heming.zhao@suse.com" date="1719921600">- gfs2: Fix potential glock use-after-free on unmount (bsc#1226775
  CVE-2024-38570).
- gfs2: Rename sd_{ glock =&gt; kill }_wait (bsc#1226775
  CVE-2024-38570).
- commit f3adbca</changelog>
  <changelog author="tiwai@suse.de" date="1719921601">- Correct SCSI patch references (bsc#1225767 CVE-2024-36919 bsc#1226785 CVE-2024-38559)
- commit e8ea587</changelog>
  <changelog author="tiwai@suse.de" date="1719921602">- mtd: rawnand: rockchip: ensure NVDDR timings are rejected
  (git-fixes).
- mtd: rawnand: Bypass a couple of sanity checks during NAND
  identification (git-fixes).
- mtd: rawnand: Fix the nand_read_data_op() early check
  (git-fixes).
- mtd: rawnand: Ensure ECC configuration is propagated to upper
  layers (git-fixes).
- commit e545951</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1719921603">- kernel-doc: fix struct_group_tagged() parsing (git-fixes).
- commit e3a2a2e</changelog>
  <changelog author="fdmanana@suse.com" date="1719921604">- btrfs: fix crash on racing fsync and size-extending write into
  prealloc (bsc#1227101 CVE-2024-37354).
- commit 1d355af</changelog>
  <changelog author="vbabka@suse.cz" date="1719921605">- virt: acrn: stop using follow_pfn (CVE-2024-38610 bsc#1226758).
- commit c2ea51b</changelog>
  <changelog author="vbabka@suse.cz" date="1719921606">- drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
  (CVE-2024-38610 bsc#1226758).
- commit 7069ac2</changelog>
  <changelog author="rhopkins@suse.de" date="1719921607">- hsr: Prevent use after free in prp_create_tagged_frame()
  (CVE-2023-52846 bsc#1225098).
- commit cf63988</changelog>
  <changelog author="krisman@suse.de" date="1719921608">- io_uring: Fix io_cqring_wait() not restoring sigmask on
  get_timespec64() failure (git-fixes).
- commit e640a65</changelog>
  <changelog author="krisman@suse.de" date="1719921609">- io_uring: check for non-NULL file pointer in io_file_can_poll()
  (bsc#1226990 CVE-2024-39371).
- io_uring/io-wq: Use set_bit() and test_bit() at worker-&gt;flags
  (git-fixes).
- io_uring/sqpoll: work around a potential audit memory leak
  (git-fixes).
- commit 24603fc</changelog>
  <changelog author="krisman@suse.de" date="1719921610">- io_uring/rsrc: fix incorrect assignment of iter-&gt;nr_segs in
  io_import_fixed (git-fixes).
- io_uring/rsrc: don't lock while !TASK_RUNNING (git-fixes).
- io_uring/io-wq: avoid garbage value of 'match' in
  io_wq_enqueue() (git-fixes).
- commit 7d3e252</changelog>
</package>
<package pkgid="70f15acf5ba7bcda21a31db6f7e9034e3a586648976913cfea8c8375705707c2" name="dtb-socionext" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.17.1"/>
  <changelog author="tiwai@suse.de" date="1722081600">- auxdisplay: ht16k33: Drop reference after LED registration
  (git-fixes).
- ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
  on unprepare (git-fixes).
- ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
- ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
  reachable (git-fixes).
- ASoC: sof: amd: fix for firmware reload failure in Vangogh
  platform (git-fixes).
- ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
- ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
  (git-fixes).
- ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
- ALSA: ump: Don't update FB name for static blocks (git-fixes).
- drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
- drm/i915/gt: Do not consider preemption during execlists_dequeue
  for gen8 (git-fixes).
- drm/i915/dp: Don't switch the LTTPR mode on an active link
  (git-fixes).
- commit d7e2deb</changelog>
  <changelog author="tiwai@suse.de" date="1722081601">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
</package>
<package pkgid="06f07bbcf37f16f97651746d4c60ddf469ed522cef5994d98a13a116b88b066e" name="dtb-socionext" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.7.1"/>
  <changelog author="mkubecek@suse.cz" date="1717416000">- netfilter: nf_tables: release mutex after nft_gc_seq_end from
  abort path (CVE-2024-26925 bsc#1223390).
- commit 578a709</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717416001">- Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
  The L3 bsc#1225765 was created seperately since our customer requires
  PTF.
- Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
- Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
- Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
- Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
- commit 054635e</changelog>
  <changelog author="msuchanek@suse.de" date="1717416002">- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
- powerpc/uaccess: Fix build errors seen with GCC 13/14
  (bsc#1194869).
- commit 46b5d84</changelog>
  <changelog author="msuchanek@suse.de" date="1717416003">- blacklist.conf: PPC fsl_msi is not used
- commit ae6590d</changelog>
  <changelog author="msuchanek@suse.de" date="1717416004">- powerpc/pseries/lparcfg: drop error message from guest name
  lookup (bsc#1187716 ltc#193451 git-fixes).
- commit ceab637</changelog>
  <changelog author="mfranc@suse.cz" date="1717416005">- Update
  patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
  (git-fixes CVE-2024-36955).
- Update
  patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
  (git-fixes bsc#1225715 CVE-2024-36906).
- Update
  patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
  (git-fixes bsc#1225579 CVE-2024-36011).
- Update
  patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
  (git-fixes bsc#1225578 CVE-2024-36013).
- Update
  patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
  (git-fixes bsc#1225502 CVE-2024-36012).
- Update
  patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
  (git-fixes bsc#1225722 CVE-2024-36880).
- Update
  patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
  (git-fixes CVE-2024-36942).
- Update
  patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
  (git-fixes bsc#1225720 CVE-2024-36032).
- Update
  patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
  (git-fixes bsc#1223749 CVE-2024-26990).
- Update
  patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
  (git-fixes bsc#1223692 CVE-2024-26992).
- Update
  patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
  (stable-fixes CVE-2024-36944).
- Update
  patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
  (git-fixes bsc#1225734 CVE-2024-36896).
- Update
  patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
  (stable-fixes CVE-2024-36949).
- Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
  (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
- Update
  patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
  (git-fixes bsc#1225692 CVE-2023-52882).
- Update
  patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
  (git-fixes CVE-2024-26761).
- Update
  patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
  (stable-fixes bsc#1225735 CVE-2024-36897).
- Update
  patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
  (stable-fixes bsc#1225705 CVE-2024-36026).
- Update
  patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
  (stable-fixes CVE-2024-36951).
- Update
  patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
  (git-fixes bsc#1225593 CVE-2024-36014).
- Update
  patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
  (stable-fixes bsc#1225728 CVE-2024-36885).
- Update
  patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
  (git-fixes bsc#1225773 CVE-2024-36936).
- Update
  patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
  (stable-fixes CVE-2024-36950).
- Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
  (git-fixes bsc#1225736 CVE-2024-36898).
- Update
  patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
  (git-fixes bsc#1225698 CVE-2024-36020).
- Update
  patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
  (git-fixes bsc#1225710 CVE-2024-36891).
- Update
  patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
  (git-fixes bsc#1225714 CVE-2024-36890).
- Update
  patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
  (git-fixes bsc#1225708 CVE-2024-36029).
- Update
  patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
  (git-fixes bsc#1225699 CVE-2024-36021).
- Update
  patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
  (git-fixes CVE-2024-26943).
- Update
  patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
  (git-fixes bsc#1225694 CVE-2024-36018).
- Update
  patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
  (git-fixes CVE-2024-36940).
- Update
  patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
  (git-fixes CVE-2024-36959).
- Update
  patches.suse/ppdev-Add-an-error-check-in-register_device.patch
  (git-fixes bsc#1225640 CVE-2024-36015).
- Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
  CVE-2024-36947).
- Update
  patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
  (git-fixes bsc#1225695 CVE-2024-36019).
- Update
  patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
  (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
- Update
  patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
  (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
- Update
  patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
  (git-fixes bsc#1225704 CVE-2024-36025).
- Update
  patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
  (git-fixes CVE-2024-36930).
- Update
  patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
  (bsc#1224331 bsc#1224602 CVE-2024-35814).
- Update
  patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
  (git-fixes bsc#1225642 CVE-2024-36016).
- Update
  patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
  (git-fixes bsc#1225749 CVE-2024-36894).
- Update
  patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
  (git-fixes bsc#1225750 CVE-2024-36895).
- Update
  patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
  (git-fixes bsc#1225748 CVE-2024-36893).
- Update
  patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
  (stable-fixes bsc#1225769 CVE-2024-36921).
- Update
  patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
  (stable-fixes CVE-2024-36922).
- Update
  patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
  (git-fixes CVE-2024-36941).
- Update
  patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
  (git-fixes bsc#1224742 CVE-2024-35803).
- commit 539780f</changelog>
  <changelog author="dwagner@suse.de" date="1717416006">- nvmet: fix ns enable/disable possible hang (git-fixes).
- nvme-multipath: fix io accounting on failover (git-fixes).
- nvme: fix multipath batched completion accounting (git-fixes).
- commit ed3b392</changelog>
  <changelog author="dwagner@suse.de" date="1717416007">- scsi: lpfc: Copyright updates for 14.4.0.2 patches
  (bsc#1225842).
- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
  (bsc#1225842).
  Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
  (bsc#1225842).
- scsi: lpfc: Clear deferred RSCN processing flag when driver
  is unloading (bsc#1225842).
- scsi: lpfc: Update logging of protection type for T10 DIF I/O
  (bsc#1225842).
- scsi: lpfc: Change default logging level for unsolicited CT
  MIB commands (bsc#1225842).
- commit 5a56384</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416008">- smb: client: fix mount when dns_resolver key is not available
  (git-fixes, bsc#1225172).
- commit 28edb5c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416009">- cifs: fix leak of iface for primary channel (git-fixes,
  bsc#1225172).
- commit b7eb8e8</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416010">- Revert "cifs: reconnect work should have reference on server
  struct" (git-fixes, bsc#1225172).
- commit 3ca4c0c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416011">- smb: client: fix parsing of SMB3.1.1 POSIX create context
  (git-fixes, bsc#1225172).
- commit 5f27f69</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416012">- cifs: failure to add channel on iface should bump up weight
  (git-fixes, bsc#1225172).
- commit 007b237</changelog>
  <changelog author="tonyj@suse.de" date="1717416013">- perf/x86: Fix out of range data (git-fixes).
- perf/x86/intel/ds: Don't clear -&gt;pebs_data_cfg for the last
  PEBS event (git-fixes).
- perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
- commit 664d77f</changelog>
  <changelog author="dsterba@suse.com" date="1717588800">- blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
- Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
  Quoting bsc#1225945#c11:
  "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
  transaction for every subvol create")
  ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
  unwritten extent buffer after snapshotting a new subvolume") was never
  backported."
- commit d947258</changelog>
  <changelog author="tonyj@suse.de" date="1717588801">- perf pmu: Count sys and cpuid JSON events separately (git
  fixes).
- perf stat: Don't display metric header for non-leader uncore
  events (git-fixes).
- perf daemon: Fix file leak in daemon_session__control
  (git-fixes).
- perf symbols: Fix ownership of string in dso__load_vmlinux()
  (git-fixes).
- perf thread: Fixes to thread__new() related to initializing comm
  (git-fixes).
- perf report: Avoid SEGV in report__setup_sample_type()
  (git-fixes).
- perf ui browser: Don't save pointer to stack memory (git-fixes).
- perf bench internals inject-build-id: Fix trap divide when
  collecting just one DSO (git-fixes).
- perf intel-pt: Fix unassigned instruction op (discovered by
  MemorySanitizer) (git-fixes).
- perf test shell arm_coresight: Increase buffer size for
  Coresight basic tests (git-fixes).
- perf docs: Document bpf event modifier (git-fixes).
- perf bench uprobe: Remove lib64 from libc.so.6 binary path
  (git-fixes).
- perf record: Fix debug message placement for test consumption
  (git-fixes).
- perf tests: Apply attributes to all events in object code
  reading test (git-fixes).
- perf tests: Make "test data symbol" more robust on Neoverse N1
  (git-fixes).
- perf annotate: Fix annotation_calc_lines() to pass correct
  address to get_srcline() (git-fixes).
- perf stat: Do not fail on metrics on s390 z/VM systems
  (git-fixes).
- perf sched timehist: Fix -g/--call-graph option failure
  (git-fixes).
- perf annotate: Get rid of duplicate --group option item
  (git-fixes).
- perf probe: Add missing libgen.h header needed for using
  basename() (git-fixes).
- perf record: Delete session after stopping sideband thread
  (git-fixes).
- perf auxtrace: Fix multiple use of --itrace option (git-fixes).
- perf script: Show also errors for --insn-trace option
  (git-fixes).
- perf lock contention: Add a missing NULL check (git-fixes).
- perf vendor events amd: Fix Zen 4 cache latency events
  (git-fixes).
- libperf evlist: Avoid out-of-bounds access (git-fixes).
- perf pmu: Fix a potential memory leak in perf_pmu__lookup()
  (git-fixes).
- perf print-events: make is_event_supported() more robust
  (git-fixes).
- perf list: fix short description for some cache events
  (git-fixes).
- perf metric: Don't remove scale from counts (git-fixes).
- perf stat: Avoid metric-only segv (git-fixes).
- perf expr: Fix "has_event" function for metric style events
  (git-fixes).
- perf srcline: Add missed addr2line closes (git-fixes).
- perf thread_map: Free strlist on normal path in
  thread_map__new_by_tid_str() (git-fixes).
- perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
- perf jevents: Drop or simplify small integer values (git-fixes).
- perf evsel: Fix duplicate initialization of data-&gt;id in
  evsel__parse_sample() (git-fixes).
- perf pmu: Treat the msr pmu as software (git-fixes).
- perf record: Check conflict between '--timestamp-filename'
  option and pipe mode before recording (git-fixes).
- perf record: Fix possible incorrect free in
  record__switch_output() (git-fixes).
- perf vendor events amd: Add Zen 4 memory controller events
  (git-fixes).
- perf top: Uniform the event name for the hybrid machine
  (git-fixes).
- perf top: Use evsel's cpus to replace user_requested_cpus
  (git-fixes).
- commit a1f9340</changelog>
  <changelog author="tonyj@suse.de" date="1717675200">- perf ui browser: Avoid SEGV on title (git fixes).
- commit 1578c22</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675201">- inet: inet_defrag: prevent sk release while still in use
  (CVE-2024-26921 bsc#1223138).
- commit 2016faf</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675202">- net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
- commit 7bf5961</changelog>
  <changelog author="tiwai@suse.de" date="1718366400">- Temporarily drop KVM patch that caused a regression (bsc#1226158)
  Delete patches.suse/KVM-x86-pmu-Prioritize-VMX-interception-over-GP-on-R.patch
- commit 33f31da</changelog>
</package>
<package pkgid="e8853312649d680dac90385b0778eb75790106544cbc891540d31bfc95862384" name="dtb-sprd" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.14.1"/>
  <changelog author="tiwai@suse.de" date="1719662400">- gpiolib: cdev: Disallow reconfiguration without direction
  (uAPI v1) (git-fixes).
- gpio: davinci: Validate the obtained number of IRQs (git-fixes).
- commit 919ebd1</changelog>
  <changelog author="tiwai@suse.de" date="1719748800">- i2c: testunit: discard write requests while old command is
  running (git-fixes).
- i2c: testunit: don't erase registers after STOP (git-fixes).
- mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
  (git-fixes).
- mmc: sdhci: Do not invert write-protect twice (git-fixes).
- mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
  (git-fixes).
- mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
  (git-fixes).
- commit 448487d</changelog>
  <changelog author="tiwai@suse.de" date="1719748801">- crypto: iaa - Account for cpu-less numa nodes (bsc#1227190).
- commit cd600aa</changelog>
  <changelog author="tiwai@suse.de" date="1719748802">- crypto: deflate - Add aliases to deflate (bsc#1227190).
- commit 27ffd92</changelog>
  <changelog author="tiwai@suse.de" date="1719835200">- ata: ahci: Clean up sysfs file on error (git-fixes).
- ata: libata-core: Fix double free on error (git-fixes).
- ata,scsi: libata-core: Do not leak memory for ata_port struct
  members (git-fixes).
- ata: libata-core: Fix null pointer dereference on error
  (git-fixes).
- kbuild: Fix build target deb-pkg: ln: failed to create hard link
  (git-fixes).
- kbuild: doc: Update default INSTALL_MOD_DIR from extra to
  updates (git-fixes).
- kbuild: Install dtb files as 0644 in Makefile.dtbinst
  (git-fixes).
- counter: ti-eqep: enable clock at probe (git-fixes).
- iio: chemical: bme680: Fix sensor data read operation
  (git-fixes).
- iio: chemical: bme680: Fix overflows in compensate() functions
  (git-fixes).
- iio: chemical: bme680: Fix calibration data variable
  (git-fixes).
- iio: chemical: bme680: Fix pressure value output (git-fixes).
- iio: accel: fxls8962af: select IIO_BUFFER &amp; IIO_KFIFO_BUF
  (git-fixes).
- iio: adc: ad7266: Fix variable checking bug (git-fixes).
- iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
  (git-fixes).
- serial: bcm63xx-uart: fix tx after conversion to
  uart_port_tx_limited() (git-fixes).
- serial: core: introduce uart_port_tx_limited_flags()
  (git-fixes).
- Revert "serial: core: only stop transmit when HW fifo is empty"
  (git-fixes).
- tty: mcf: MCF54418 has 10 UARTS (git-fixes).
- usb: gadget: aspeed_udc: fix device address configuration
  (git-fixes).
- usb: dwc3: core: remove lock of otg mode during gadget
  suspend/resume to avoid deadlock (git-fixes).
- usb: typec: ucsi: glink: fix child node release in probe
  function (git-fixes).
- usb: musb: da8xx: fix a resource leak in probe() (git-fixes).
- usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  (git-fixes).
- usb: gadget: printer: fix races against disable (git-fixes).
- PCI/MSI: Fix UAF in msi_capability_init (git-fixes).
- commit a2ea5a9</changelog>
  <changelog author="ptesarik@suse.com" date="1719835201">- net: ena: Fix redundant device NUMA node override
  (jsc#PED-8688).
- commit 6ad6684</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835202">- tcp: do not accept ACK of bytes we never sent (CVE-2023-52881
  bsc#1225611).
- commit 16404a6</changelog>
  <changelog author="mhocko@suse.com" date="1719835203">- Update
  patches.suse/1352-drm-amdgpu-Fix-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52883
  bsc#1226630).
- Update
  patches.suse/9p-add-missing-locking-around-taking-dentry-fid-list.patch
  (git-fixes CVE-2024-39463 bsc#1227090).
- Update
  patches.suse/ALSA-Fix-deadlocks-with-kctl-removals-at-disconnecti.patch
  (stable-fixes CVE-2024-38600 bsc#1226864).
- Update
  patches.suse/ALSA-core-Fix-NULL-module-pointer-assignment-at-card.patch
  (git-fixes CVE-2024-38605 bsc#1226740).
- Update
  patches.suse/ALSA-hda-Fix-possible-null-ptr-deref-when-assigning-.patch
  (git-fixes CVE-2023-52806 bsc#1225554).
- Update
  patches.suse/ALSA-hda-cs_dsp_ctl-Use-private_free-for-control-cle.patch
  (git-fixes CVE-2024-38388 bsc#1226890).
- Update
  patches.suse/ALSA-timer-Set-lower-bound-of-start-tick-time.patch
  (stable-fixes git-fixes CVE-2024-38618 bsc#1226754).
- Update
  patches.suse/ASoC-kirkwood-Fix-potential-NULL-dereference.patch
  (git-fixes CVE-2024-38550 bsc#1226633).
- Update
  patches.suse/ASoC-mediatek-Assign-dummy-when-codec-not-specified-.patch
  (git-fixes CVE-2024-38551 bsc#1226761).
- Update
  patches.suse/Bluetooth-btusb-Add-date-evt_skb-is-NULL-check.patch
  (git-fixes CVE-2023-52833 bsc#1225595).
- Update
  patches.suse/Bluetooth-hci_core-Fix-possible-buffer-overflow.patch
  (git-fixes CVE-2024-26889).
- Update
  patches.suse/HID-uclogic-Fix-user-memory-access-bug-in-uclogic_pa.patch
  (git-fixes CVE-2023-52866 bsc#1225120).
- Update
  patches.suse/IB-mlx5-Fix-init-stage-error-handling-to-avoid-doubl.patch
  (jsc#PED-6864 CVE-2023-52851 bsc#1225587).
- Update
  patches.suse/Input-cyapa-add-missing-input-core-locking-to-suspen.patch
  (git-fixes CVE-2023-52884 bsc#1226764).
- Update
  patches.suse/Input-synaptics-rmi4-fix-use-after-free-in-rmi_unreg.patch
  (git-fixes CVE-2023-52840 bsc#1224928).
- Update
  patches.suse/KEYS-trusted-Do-not-use-WARN-when-encode-fails.patch
  (git-fixes CVE-2024-36975 bsc#1226520).
- Update
  patches.suse/KEYS-trusted-Fix-memory-leak-in-tpm2_key_encode.patch
  (git-fixes CVE-2024-36967 bsc#1226131).
- Update
  patches.suse/RDMA-cma-Fix-kmemleak-in-rdma_core-observed-during-b.patch
  (git-fixes CVE-2024-38539 bsc#1226608).
- Update patches.suse/RDMA-hns-Fix-UAF-for-cq-async-event.patch
  (git-fixes CVE-2024-38545 bsc#1226595).
- Update
  patches.suse/RDMA-hns-Fix-deadlock-on-SRQ-async-events.patch
  (git-fixes CVE-2024-38591 bsc#1226738).
- Update
  patches.suse/RDMA-hns-Modify-the-print-level-of-CQE-error.patch
  (git-fixes CVE-2024-38590 bsc#1226839).
- Update
  patches.suse/RDMA-rxe-Fix-seg-fault-in-rxe_comp_queue_pkt.patch
  (git-fixes CVE-2024-38544 bsc#1226597).
- Update
  patches.suse/SUNRPC-Fix-RPC-client-cleaned-up-the-freed-pipefs-de.patch
  (git-fixes CVE-2023-52803 bsc#1225008).
- Update patches.suse/af_unix-Clear-stale-u-oob_skb.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-35970 bsc#1224584).
- Update
  patches.suse/af_unix-Drop-oob_skb-ref-before-purging-queue-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26750 bsc#1222617).
- Update
  patches.suse/af_unix-Fix-task-hung-while-purging-oob_skb-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26780 bsc#1222588).
- Update
  patches.suse/af_unix-Update-unix_sk-sk-oob_skb-under-sk_receive_queue-lock.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-36972 bsc#1226163).
- Update
  patches.suse/arm64-Restrict-CPU_BIG_ENDIAN-to-GNU-as-or-LLVM-IAS-.patch
  (git-fixes CVE-2023-52750 bsc#1225485).
- Update
  patches.suse/atl1c-Work-around-the-DMA-RX-overflow-issue.patch
  (git-fixes CVE-2023-52834 bsc#1225599).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issue-of-net_device.patch
  (git-fixes CVE-2024-38554 bsc#1226742).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issues-of-ax25_dev.patch
  (git-fixes CVE-2024-38602 bsc#1226613).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-reorder-of-WRITE-lqueued.patch
  (bsc#1225605 CVE-2024-38384 bsc#1226938).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-resetting-io-stat.patch
  (bsc#1225605 CVE-2024-38663 bsc#1226939).
- Update
  patches.suse/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch
  (git-fixes CVE-2024-38540 bsc#1226582).
- Update
  patches.suse/bonding-stop-the-device-in-bond_setup_by_slave.patch
  (git-fixes CVE-2023-52784 bsc#1224946).
- Update
  patches.suse/can-dev-can_put_echo_skb-don-t-crash-kernel-if-can_p.patch
  (git-fixes CVE-2023-52878 bsc#1225000).
- Update
  patches.suse/clk-mediatek-clk-mt2701-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52875 bsc#1225096).
- Update
  patches.suse/clk-mediatek-clk-mt6765-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52870 bsc#1224937).
- Update
  patches.suse/clk-mediatek-clk-mt6779-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52873 bsc#1225589).
- Update
  patches.suse/clk-mediatek-clk-mt6797-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52865 bsc#1225086).
- Update
  patches.suse/clk-mediatek-clk-mt7629-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52858 bsc#1225566).
- Update
  patches.suse/clk-mediatek-clk-mt7629-eth-Add-check-for-mtk_alloc_.patch
  (git-fixes CVE-2023-52876 bsc#1225036).
- Update
  patches.suse/cppc_cpufreq-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38573 bsc#1226739).
- Update patches.suse/cpufreq-exit-callback-is-optional.patch
  (git-fixes CVE-2024-38615 bsc#1226592).
- Update patches.suse/crypto-bcm-Fix-pointer-arithmetic.patch
  (git-fixes CVE-2024-38579 bsc#1226637).
- Update
  patches.suse/crypto-pcrypt-Fix-hungtask-for-PADATA_RESET.patch
  (git-fixes CVE-2023-52813 bsc#1225527).
- Update patches.suse/cxl-mem-Fix-shutdown-order.patch (git-fixes
  CVE-2023-52849 bsc#1224949).
- Update
  patches.suse/cxl-region-Do-not-try-to-cleanup-after-cxl_region_se.patch
  (git-fixes CVE-2023-52792 bsc#1225477).
- Update patches.suse/cxl-region-Fix-cxlr_pmem-leaks.patch
  (git-fixes CVE-2024-38391 bsc#1226894).
- Update
  patches.suse/dma-buf-sw-sync-don-t-enable-IRQ-from-sync_print_obj.patch
  (git-fixes CVE-2024-38780 bsc#1226886).
- Update
  patches.suse/dma-mapping-benchmark-fix-node-id-validation.patch
  (git-fixes CVE-2024-34777 bsc#1226796).
- Update
  patches.suse/dma-mapping-benchmark-handle-NUMA_NO_NODE-correctly.patch
  (git-fixes CVE-2024-39277 bsc#1226909).
- Update
  patches.suse/dmaengine-idxd-Avoid-unnecessary-destruction-of-file.patch
  (git-fixes CVE-2024-38629 bsc#1226905).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Pola.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52819
  bsc#1225532).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-SMU7.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52818
  bsc#1225530).
- Update
  patches.suse/drm-amd-check-num-of-link-levels-when-update-pcie-pa.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52812
  bsc#1225564).
- Update
  patches.suse/drm-amd-display-Avoid-NULL-dereference-of-timing-gen.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52753
  bsc#1225478).
- Update
  patches.suse/drm-amd-display-Fix-division-by-zero-in-setup_dsc_co.patch
  (stable-fixes CVE-2024-36969 bsc#1226155).
- Update
  patches.suse/drm-amd-display-Fix-null-pointer-dereference-in-erro.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52862
  bsc#1225015).
- Update
  patches.suse/drm-amd-display-Fix-potential-index-out-of-bounds-in.patch
  (git-fixes CVE-2024-38552 bsc#1226767).
- Update
  patches.suse/drm-amd-display-fix-a-NULL-pointer-dereference-in-am.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52773
  bsc#1225041).
- Update
  patches.suse/drm-amd-display-fixed-integer-types-and-null-check-l.patch
  (git-fixes CVE-2024-26767).
- Update
  patches.suse/drm-amdgpu-Fix-a-null-pointer-access-when-the-smc_rr.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52817
  bsc#1225569).
- Update
  patches.suse/drm-amdgpu-Fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch
  (git-fixes CVE-2024-39291 bsc#1226934).
- Update
  patches.suse/drm-amdgpu-Fix-potential-null-pointer-derefernce.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52814
  bsc#1225565).
- Update
  patches.suse/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch
  (stable-fixes CVE-2024-39471 bsc#1227096).
- Update
  patches.suse/drm-amdgpu-mes-fix-use-after-free-issue.patch
  (stable-fixes CVE-2024-38581 bsc#1226657).
- Update
  patches.suse/drm-amdgpu-vkms-fix-a-possible-null-pointer-derefere.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52815
  bsc#1225568).
- Update
  patches.suse/drm-amdkfd-Fix-a-race-condition-of-vram-buffer-unref.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52825
  bsc#1225076).
- Update
  patches.suse/drm-amdkfd-Fix-shift-out-of-bounds-issue.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52816
  bsc#1225529).
- Update
  patches.suse/drm-bridge-cdns-mhdp8546-Fix-possible-null-pointer-d.patch
  (git-fixes CVE-2024-38548).
- Update
  patches.suse/drm-bridge-it66121-Fix-invalid-connector-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52861
  bsc#1224941).
- Update
  patches.suse/drm-bridge-lt8912b-Fix-crash-on-bridge-detach.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52856
  bsc#1224932).
- Update
  patches.suse/drm-mediatek-Add-0-size-check-to-mtk_drm_gem_obj.patch
  (git-fixes CVE-2024-38549 bsc#1226735).
- Update
  patches.suse/drm-mediatek-Fix-coverity-issue-with-unintentional-i.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52857
  bsc#1225581).
- Update
  patches.suse/drm-mediatek-Init-ddp_comp-with-devm_kcalloc.patch
  (git-fixes CVE-2024-38592 bsc#1226844).
- Update
  patches.suse/drm-msm-a6xx-Avoid-a-nullptr-dereference-when-speedb.patch
  (git-fixes CVE-2024-38390 bsc#1226891).
- Update
  patches.suse/drm-msm-dpu-Add-callback-function-pointer-check-befo.patch
  (git-fixes CVE-2024-38622 bsc#1226856).
- Update
  patches.suse/drm-panel-fix-a-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52821
  bsc#1225022).
- Update
  patches.suse/drm-panel-panel-tpo-tpg110-fix-a-possible-null-point.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52826
  bsc#1225077).
- Update patches.suse/drm-radeon-possible-buffer-overflow.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52867
  bsc#1225009).
- Update
  patches.suse/drm-vc4-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38546 bsc#1226593).
- Update
  patches.suse/drm-vmwgfx-Fix-invalid-reads-in-fence-signaled-event.patch
  (git-fixes CVE-2024-36960 bsc#1225872).
- Update
  patches.suse/drm-zynqmp_dpsub-Always-register-bridge.patch
  (git-fixes CVE-2024-38664 bsc#1226941).
- Update
  patches.suse/e1000e-change-usleep_range-to-udelay-in-PHY-mdic-acc.patch
  (CVE-2024-39296 bsc#1226989 CVE-2024-36887 bsc#1225731).
- Update
  patches.suse/ecryptfs-Fix-buffer-size-for-tag-66-packet.patch
  (git-fixes CVE-2024-38578 bsc#1226634).
- Update
  patches.suse/efi-libstub-only-free-priv.runtime_map-when-allocate.patch
  (git-fixes CVE-2024-33619 bsc#1226768).
- Update
  patches.suse/fbdev-imsttfb-fix-a-resource-leak-in-probe.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52838
  bsc#1225031).
- Update
  patches.suse/fs-9p-only-translate-RWX-permissions-for-plain-9P200.patch
  (git-fixes CVE-2024-36964 bsc#1225866).
- Update
  patches.suse/fs-jfs-Add-check-for-negative-db_l2nbperpage.patch
  (git-fixes CVE-2023-52810 bsc#1225557).
- Update
  patches.suse/fs-jfs-Add-validity-check-for-db_maxag-and-db_agpref.patch
  (git-fixes CVE-2023-52804 bsc#1225550).
- Update
  patches.suse/ftrace-Fix-possible-use-after-free-issue-in-ftrace_location.patch
  (git-fixes CVE-2024-38588 bsc#1226837).
- Update
  patches.suse/genirq-irqdesc-Prevent-use-after-free-in-irq_find_at.patch
  (git-fixes CVE-2024-38385 bsc#1227085).
- Update patches.suse/gfs2-ignore-negated-quota-changes.patch
  (git-fixes CVE-2023-52759 bsc#1225560).
- Update
  patches.suse/hid-cp2112-Fix-duplicate-workqueue-initialization.patch
  (git-fixes CVE-2023-52853 bsc#1224988).
- Update
  patches.suse/hwmon-axi-fan-control-Fix-possible-NULL-pointer-dere.patch
  (git-fixes CVE-2023-52863 bsc#1225586).
- Update
  patches.suse/i2c-acpi-Unbind-mux-adapters-before-delete.patch
  (git-fixes CVE-2024-39362 bsc#1226995).
- Update
  patches.suse/i2c-core-Run-atomic-i2c-xfer-when-preemptible.patch
  (git-fixes CVE-2023-52791 bsc#1225108).
- Update
  patches.suse/i3c-master-mipi-i3c-hci-Fix-a-kernel-panic-for-acces.patch
  (git-fixes CVE-2023-52763 bsc#1225570).
- Update
  patches.suse/i3c-mipi-i3c-hci-Fix-out-of-bounds-access-in-hci_dma.patch
  (git-fixes CVE-2023-52766).
- Update
  patches.suse/i915-perf-Fix-NULL-deref-bugs-with-drm_dbg-calls.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52788
  bsc#1225106).
- Update
  patches.suse/igb-Fix-string-truncation-warnings-in-igb_set_fw_ver.patch
  (git-fixes CVE-2024-36010 bsc#1225594).
- Update
  patches.suse/iommu-vt-d-Fix-WARN_ON-in-iommu-probe-path.patch
  (git-fixes CVE-2024-35957 bsc#1224673).
- Update
  patches.suse/iommufd-Fix-missing-update-of-domains_itree-after-splitting-iopt
  (jsc#PED-7779 jsc#PED-7780 CVE-2023-52801 bsc#1225006).
- Update
  patches.suse/ipvlan-add-ipvlan_route_v6_outbound-helper.patch
  (git-fixes CVE-2023-52796 bsc#1224930).
- Update
  patches.suse/jffs2-prevent-xattr-node-from-overflowing-the-eraseblock.patch
  (git-fixes CVE-2024-38599 bsc#1226848).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-dbFindLeaf.patch
  (git-fixes CVE-2023-52799 bsc#1225472).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-diAlloc.patch
  (git-fixes CVE-2023-52805 bsc#1225553).
- Update
  patches.suse/kunit-fortify-Fix-mismatched-kvalloc-vfree-usage.patch
  (git-fixes CVE-2024-38617 bsc#1226859).
- Update
  patches.suse/lib-generic-radix-tree.c-Don-t-overflow-in-peek.patch
  (git-fixes CVE-2021-47432 bsc#1225391).
- Update
  patches.suse/lib-test_hmm.c-handle-src_pfns-and-dst_pfns-allocati.patch
  (git-fixes CVE-2024-38543 bsc#1226594).
- Update
  patches.suse/locking-ww_mutex-test-Fix-potential-workqueue-corrup.patch
  (bsc#1219953 CVE-2023-52836 bsc#1225609).
- Update
  patches.suse/md-Don-t-ignore-suspended-array-in-md_check_recovery-1baa.patch
  (bsc#1219596 CVE-2024-26758).
- Update
  patches.suse/media-atomisp-ssh_css-Fix-a-null-pointer-dereference.patch
  (git-fixes CVE-2024-38547 bsc#1226632).
- Update
  patches.suse/media-bttv-fix-use-after-free-error-due-to-btv-timeo.patch
  (git-fixes CVE-2023-52847 bsc#1225588).
- Update
  patches.suse/media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch
  (git-fixes CVE-2023-52764 bsc#1225571).
- Update
  patches.suse/media-hantro-Check-whether-reset-op-is-defined-befor.patch
  (git-fixes CVE-2023-52850 bsc#1225014).
- Update
  patches.suse/media-i2c-et8ek8-Don-t-strip-remove-function-when-dr.patch
  (git-fixes CVE-2024-38611 bsc#1226760).
- Update
  patches.suse/media-imon-fix-access-to-invalid-resource-for-the-se.patch
  (git-fixes CVE-2023-52754 bsc#1225490).
- Update
  patches.suse/media-lgdt3306a-Add-a-check-against-null-pointer-def.patch
  (stable-fixes CVE-2022-48772 bsc#1226976).
- Update
  patches.suse/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch
  (git-fixes CVE-2024-38621 bsc#1226895).
- Update
  patches.suse/media-vidtv-mux-Add-check-and-kfree-for-kstrdup.patch
  (git-fixes CVE-2023-52841 bsc#1225592).
- Update patches.suse/media-vidtv-psi-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52844 bsc#1225590).
- Update
  patches.suse/mfd-qcom-spmi-pmic-Fix-revid-implementation.patch
  (git-fixes CVE-2023-52765 bsc#1225029).
- Update
  patches.suse/misc-microchip-pci1xxxx-fix-double-free-in-the-error.patch
  (git-fixes CVE-2024-36973 bsc#1226457).
- Update
  patches.suse/net-hns3-fix-out-of-bounds-access-may-occur-when-coa.patch
  (git-fixes CVE-2023-52807 bsc#1225097).
- Update
  patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch
  (git-fixes CVE-2024-36962 bsc#1225827).
- Update
  patches.suse/net-mlx5-Fix-peer-devlink-set-for-SF-representor-dev.patch
  (git-fixes CVE-2024-38595 bsc#1226741).
- Update
  patches.suse/net-mlx5e-Track-xmit-submission-to-PTP-WQ-after-popu.patch
  (jsc#PED-3311 CVE-2023-52782 bsc#1225103).
- Update
  patches.suse/net-mvneta-fix-calls-to-page_pool_get_stats.patch
  (git-fixes CVE-2023-52780 bsc#1224933).
- Update
  patches.suse/net-wangxun-fix-kernel-panic-due-to-null-pointer.patch
  (git-fixes CVE-2023-52783 bsc#1225104).
- Update
  patches.suse/netfilter-complete-validation-of-user-input.patch
  (git-fixes CVE-2024-35896 bsc#1224662 CVE-2024-35962
  bsc#1224583).
- Update
  patches.suse/nfc-nci-Fix-uninit-value-in-nci_rx_work.patch
  (git-fixes CVE-2024-38381 bsc#1226878).
- Update
  patches.suse/nilfs2-fix-nilfs_empty_dir-misjudgment-and-long-loop.patch
  (git-fixes CVE-2024-39469 bsc#1226992).
- Update
  patches.suse/nilfs2-fix-potential-hang-in-nilfs_detach_log_writer.patch
  (git-fixes CVE-2024-38582 bsc#1226658).
- Update
  patches.suse/nilfs2-fix-use-after-free-of-timer-for-log-writer-th.patch
  (git-fixes CVE-2024-38583 bsc#1226777).
- Update
  patches.suse/of-module-add-buffer-overflow-check-in-of_modalias.patch
  (git-fixes CVE-2024-38541 bsc#1226587).
- Update
  patches.suse/padata-Fix-refcnt-handling-in-padata_free_shell.patch
  (git-fixes CVE-2023-52854 bsc#1225584).
- Update
  patches.suse/perf-core-Bail-out-early-if-the-request-AUX-area-is-out-of-bound.patch
  (git-fixes CVE-2023-52835 bsc#1225602).
- Update
  patches.suse/platform-x86-wmi-Fix-opening-of-char-device.patch
  (git-fixes CVE-2023-52864 bsc#1225132).
- Update
  patches.suse/powerpc-pseries-iommu-LPAR-panics-during-boot-up-wit.patch
  (bsc#1222011 ltc#205900 CVE-2024-36926 bsc#1225829).
- Update patches.suse/pstore-platform-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52869 bsc#1225050).
- Update
  patches.suse/remoteproc-mediatek-Make-sure-IPI-buffer-fits-in-L2T.patch
  (git-fixes CVE-2024-36965 bsc#1226149).
- Update
  patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch
  (git-fixes CVE-2024-38601 bsc#1226876).
- Update
  patches.suse/s390-dasd-protect-device-queue-against-concurrent-access.patch
  (git-fixes bsc#1217481 CVE-2023-52774 bsc#1225572).
- Update
  patches.suse/scsi-hisi_sas-Set-debugfs_dir-pointer-to-NULL-after-removing-debugfs.patch
  (git-fixes CVE-2023-52808 bsc#1225555).
- Update
  patches.suse/scsi-ibmvfc-Remove-BUG_ON-in-the-case-of-an-empty-ev.patch
  (bsc#1209834 ltc#202097 CVE-2023-52811 bsc#1225559).
- Update
  patches.suse/scsi-libfc-Fix-potential-NULL-pointer-dereference-in-fc_lport_ptp_setup.patch
  (git-fixes CVE-2023-52809 bsc#1225556).
- Update
  patches.suse/scsi-lpfc-Move-NPIV-s-transport-unregistration-to-af.patch
  (bsc#1221777 CVE-2024-36952 bsc#1225898).
- Update
  patches.suse/scsi-lpfc-Release-hbalock-before-calling-lpfc_worker.patch
  (bsc#1221777 CVE-2024-36924 bsc#1225820).
- Update
  patches.suse/serial-max3100-Lock-port-lock-when-calling-uart_hand.patch
  (git-fixes CVE-2024-38634 bsc#1226868).
- Update
  patches.suse/serial-max3100-Update-uart_driver_registered-on-driv.patch
  (git-fixes CVE-2024-38633 bsc#1226867).
- Update
  patches.suse/soc-qcom-llcc-Handle-a-second-device-without-data-co.patch
  (git-fixes CVE-2023-52871 bsc#1225534).
- Update
  patches.suse/soundwire-cadence-fix-invalid-PDI-offset.patch
  (stable-fixes CVE-2024-38635 bsc#1226863).
- Update patches.suse/speakup-Fix-sizeof-vs-ARRAY_SIZE-bug.patch
  (git-fixes CVE-2024-38587 bsc#1226780).
- Update patches.suse/spi-Fix-null-dereference-on-suspend.patch
  (git-fixes CVE-2023-52749 bsc#1225476).
- Update
  patches.suse/thermal-core-prevent-potential-string-overflow.patch
  (git-fixes CVE-2023-52868 bsc#1225044).
- Update
  patches.suse/thermal-drivers-qcom-lmh-Check-for-SCM-availability-.patch
  (git-fixes CVE-2024-39466 bsc#1227089).
- Update
  patches.suse/thermal-drivers-tsens-Fix-null-pointer-dereference.patch
  (git-fixes CVE-2024-38571 bsc#1226737).
- Update
  patches.suse/thermal-intel-powerclamp-fix-mismatch-in-get-functio.patch
  (git-fixes CVE-2023-52794 bsc#1225028).
- Update
  patches.suse/tls-fix-NULL-deref-on-tls_sw_splice_eof-with-empty-r.patch
  (jsc#PED-6831 CVE-2023-52767 bsc#1224998).
- Update
  patches.suse/tpm_tis_spi-Account-for-SPI-header-when-allocating-T.patch
  (git-fixes CVE-2024-36477 bsc#1226840).
- Update
  patches.suse/tracing-Have-trace_event_file-have-ref-counters.patch
  (git-fixes CVE-2023-52879 bsc#1225101).
- Update
  patches.suse/tracing-trigger-Fix-to-return-error-if-failed-to-alloc-snapshot.patch
  (git-fixes CVE-2024-26920).
- Update
  patches.suse/tty-n_gsm-fix-race-condition-in-status-line-change-o.patch
  (git-fixes CVE-2023-52872 bsc#1225591).
- Update
  patches.suse/tty-n_gsm-require-CAP_NET_ADMIN-to-attach-N_GSM0710-.patch
  (bsc#1222619 CVE-2023-52880).
- Update
  patches.suse/tty-vcc-Add-check-for-kstrdup-in-vcc_probe.patch
  (git-fixes CVE-2023-52789 bsc#1225180).
- Update
  patches.suse/usb-config-fix-iteration-issue-in-usb_get_bos_descri.patch
  (git-fixes CVE-2023-52781 bsc#1225092).
- Update
  patches.suse/usb-dwc3-Wait-unconditionally-after-issuing-EndXfer-.patch
  (git-fixes CVE-2024-36977 bsc#1226513).
- Update
  patches.suse/usb-gadget-u_audio-Fix-race-condition-use-of-control.patch
  (git-fixes CVE-2024-38628 bsc#1226911).
- Update
  patches.suse/usb-storage-alauda-Check-whether-the-media-is-initia.patch
  (git-fixes CVE-2024-38619 bsc#1226861).
- Update
  patches.suse/usb-typec-tcpm-Fix-NULL-pointer-dereference-in-tcpm_.patch
  (git-fixes CVE-2023-52877 bsc#1224944).
- Update
  patches.suse/vhost-vdpa-fix-use-after-free-in-vhost_vdpa_probe.patch
  (jsc#PED-3311 CVE-2023-52795 bsc#1225085).
- Update
  patches.suse/virtio-blk-fix-implicit-overflow-on-virtio_max_dma_s.patch
  (git-fixes CVE-2023-52762 bsc#1225573).
- Update
  patches.suse/virtio-vsock-Fix-uninit-value-in-virtio_transport_re.patch
  (jsc#PED-5505 CVE-2023-52842 bsc#1225025).
- Update
  patches.suse/watchdog-cpu5wdt.c-Fix-use-after-free-bug-caused-by-.patch
  (git-fixes CVE-2024-38630 bsc#1226908).
- Update
  patches.suse/wifi-ar5523-enable-proper-endpoint-verification.patch
  (git-fixes CVE-2024-38565 bsc#1226747).
- Update
  patches.suse/wifi-ath11k-fix-dfs-radar-event-locking.patch
  (git-fixes CVE-2023-52798 bsc#1224947).
- Update
  patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch
  (git-fixes CVE-2023-52777 bsc#1224992).
- Update patches.suse/wifi-ath11k-fix-htt-pktlog-locking.patch
  (git-fixes CVE-2023-52800).
- Update
  patches.suse/wifi-ath12k-fix-dfs-radar-and-temperature-event-lock.patch
  (git-fixes CVE-2023-52776 bsc#1225090).
- Update
  patches.suse/wifi-ath12k-fix-htt-mlo-offset-event-locking.patch
  (git-fixes CVE-2023-52769 bsc#1225001).
- Update
  patches.suse/wifi-ath12k-fix-out-of-bound-access-of-qmi_invoke_ha.patch
  (git-fixes CVE-2024-38572 bsc#1226776).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-read-in-ath12k.patch
  (git-fixes CVE-2023-52827 bsc#1225078).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-write-in-ath12.patch
  (git-fixes CVE-2023-52829 bsc#1225081).
- Update
  patches.suse/wifi-brcmfmac-pcie-handle-randbuf-allocation-failure.patch
  (git-fixes CVE-2024-38575 bsc#1226612).
- Update
  patches.suse/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch
  (git-fixes CVE-2024-38567 bsc#1226769).
- Update
  patches.suse/wifi-carl9170-re-fix-fortified-memset-warning.patch
  (git-fixes CVE-2024-38616 bsc#1226852).
- Update
  patches.suse/wifi-mac80211-don-t-return-unset-power-in-ieee80211_.patch
  (git-fixes CVE-2023-52832 bsc#1225577).
- Update
  patches.suse/wifi-nl80211-Avoid-address-calculations-via-out-of-b.patch
  (git-fixes CVE-2024-38562 bsc#1226788).
- Update
  patches.suse/wifi-wilc1000-use-vmm_table-as-array-in-wilc-struct.patch
  (git-fixes CVE-2023-52768 bsc#1225004).
- Update
  patches.suse/x86-tdx-Zero-out-the-missing-RSI-in-TDX_HYPERCALL-macro.patch
  (jsc#PED-5824 CVE-2023-52874 bsc#1225049).
- commit 33efdc4</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835204">- tcp: Use refcount_inc_not_zero() in tcp_twsk_unique()
  (CVE-2024-36904 bsc#1225732).
- commit d578dcc</changelog>
  <changelog author="heming.zhao@suse.com" date="1719921600">- gfs2: Fix potential glock use-after-free on unmount (bsc#1226775
  CVE-2024-38570).
- gfs2: Rename sd_{ glock =&gt; kill }_wait (bsc#1226775
  CVE-2024-38570).
- commit f3adbca</changelog>
  <changelog author="tiwai@suse.de" date="1719921601">- Correct SCSI patch references (bsc#1225767 CVE-2024-36919 bsc#1226785 CVE-2024-38559)
- commit e8ea587</changelog>
  <changelog author="tiwai@suse.de" date="1719921602">- mtd: rawnand: rockchip: ensure NVDDR timings are rejected
  (git-fixes).
- mtd: rawnand: Bypass a couple of sanity checks during NAND
  identification (git-fixes).
- mtd: rawnand: Fix the nand_read_data_op() early check
  (git-fixes).
- mtd: rawnand: Ensure ECC configuration is propagated to upper
  layers (git-fixes).
- commit e545951</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1719921603">- kernel-doc: fix struct_group_tagged() parsing (git-fixes).
- commit e3a2a2e</changelog>
  <changelog author="fdmanana@suse.com" date="1719921604">- btrfs: fix crash on racing fsync and size-extending write into
  prealloc (bsc#1227101 CVE-2024-37354).
- commit 1d355af</changelog>
  <changelog author="vbabka@suse.cz" date="1719921605">- virt: acrn: stop using follow_pfn (CVE-2024-38610 bsc#1226758).
- commit c2ea51b</changelog>
  <changelog author="vbabka@suse.cz" date="1719921606">- drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
  (CVE-2024-38610 bsc#1226758).
- commit 7069ac2</changelog>
  <changelog author="rhopkins@suse.de" date="1719921607">- hsr: Prevent use after free in prp_create_tagged_frame()
  (CVE-2023-52846 bsc#1225098).
- commit cf63988</changelog>
  <changelog author="krisman@suse.de" date="1719921608">- io_uring: Fix io_cqring_wait() not restoring sigmask on
  get_timespec64() failure (git-fixes).
- commit e640a65</changelog>
  <changelog author="krisman@suse.de" date="1719921609">- io_uring: check for non-NULL file pointer in io_file_can_poll()
  (bsc#1226990 CVE-2024-39371).
- io_uring/io-wq: Use set_bit() and test_bit() at worker-&gt;flags
  (git-fixes).
- io_uring/sqpoll: work around a potential audit memory leak
  (git-fixes).
- commit 24603fc</changelog>
  <changelog author="krisman@suse.de" date="1719921610">- io_uring/rsrc: fix incorrect assignment of iter-&gt;nr_segs in
  io_import_fixed (git-fixes).
- io_uring/rsrc: don't lock while !TASK_RUNNING (git-fixes).
- io_uring/io-wq: avoid garbage value of 'match' in
  io_wq_enqueue() (git-fixes).
- commit 7d3e252</changelog>
</package>
<package pkgid="99796d0ed164346c0772ec1e8b1ea4eaf36d549789a5ad74d07e214a83134df7" name="dtb-sprd" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.17.1"/>
  <changelog author="tiwai@suse.de" date="1722081600">- auxdisplay: ht16k33: Drop reference after LED registration
  (git-fixes).
- ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
  on unprepare (git-fixes).
- ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
- ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
  reachable (git-fixes).
- ASoC: sof: amd: fix for firmware reload failure in Vangogh
  platform (git-fixes).
- ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
- ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
  (git-fixes).
- ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
- ALSA: ump: Don't update FB name for static blocks (git-fixes).
- drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
- drm/i915/gt: Do not consider preemption during execlists_dequeue
  for gen8 (git-fixes).
- drm/i915/dp: Don't switch the LTTPR mode on an active link
  (git-fixes).
- commit d7e2deb</changelog>
  <changelog author="tiwai@suse.de" date="1722081601">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
</package>
<package pkgid="df24be0617d33ac73ccf367cf8d3740a74d6d94a15ae08acfc141a771a0732ab" name="dtb-sprd" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.7.1"/>
  <changelog author="mkubecek@suse.cz" date="1717416000">- netfilter: nf_tables: release mutex after nft_gc_seq_end from
  abort path (CVE-2024-26925 bsc#1223390).
- commit 578a709</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717416001">- Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
  The L3 bsc#1225765 was created seperately since our customer requires
  PTF.
- Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
- Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
- Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
- Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
- commit 054635e</changelog>
  <changelog author="msuchanek@suse.de" date="1717416002">- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
- powerpc/uaccess: Fix build errors seen with GCC 13/14
  (bsc#1194869).
- commit 46b5d84</changelog>
  <changelog author="msuchanek@suse.de" date="1717416003">- blacklist.conf: PPC fsl_msi is not used
- commit ae6590d</changelog>
  <changelog author="msuchanek@suse.de" date="1717416004">- powerpc/pseries/lparcfg: drop error message from guest name
  lookup (bsc#1187716 ltc#193451 git-fixes).
- commit ceab637</changelog>
  <changelog author="mfranc@suse.cz" date="1717416005">- Update
  patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
  (git-fixes CVE-2024-36955).
- Update
  patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
  (git-fixes bsc#1225715 CVE-2024-36906).
- Update
  patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
  (git-fixes bsc#1225579 CVE-2024-36011).
- Update
  patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
  (git-fixes bsc#1225578 CVE-2024-36013).
- Update
  patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
  (git-fixes bsc#1225502 CVE-2024-36012).
- Update
  patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
  (git-fixes bsc#1225722 CVE-2024-36880).
- Update
  patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
  (git-fixes CVE-2024-36942).
- Update
  patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
  (git-fixes bsc#1225720 CVE-2024-36032).
- Update
  patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
  (git-fixes bsc#1223749 CVE-2024-26990).
- Update
  patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
  (git-fixes bsc#1223692 CVE-2024-26992).
- Update
  patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
  (stable-fixes CVE-2024-36944).
- Update
  patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
  (git-fixes bsc#1225734 CVE-2024-36896).
- Update
  patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
  (stable-fixes CVE-2024-36949).
- Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
  (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
- Update
  patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
  (git-fixes bsc#1225692 CVE-2023-52882).
- Update
  patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
  (git-fixes CVE-2024-26761).
- Update
  patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
  (stable-fixes bsc#1225735 CVE-2024-36897).
- Update
  patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
  (stable-fixes bsc#1225705 CVE-2024-36026).
- Update
  patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
  (stable-fixes CVE-2024-36951).
- Update
  patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
  (git-fixes bsc#1225593 CVE-2024-36014).
- Update
  patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
  (stable-fixes bsc#1225728 CVE-2024-36885).
- Update
  patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
  (git-fixes bsc#1225773 CVE-2024-36936).
- Update
  patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
  (stable-fixes CVE-2024-36950).
- Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
  (git-fixes bsc#1225736 CVE-2024-36898).
- Update
  patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
  (git-fixes bsc#1225698 CVE-2024-36020).
- Update
  patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
  (git-fixes bsc#1225710 CVE-2024-36891).
- Update
  patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
  (git-fixes bsc#1225714 CVE-2024-36890).
- Update
  patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
  (git-fixes bsc#1225708 CVE-2024-36029).
- Update
  patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
  (git-fixes bsc#1225699 CVE-2024-36021).
- Update
  patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
  (git-fixes CVE-2024-26943).
- Update
  patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
  (git-fixes bsc#1225694 CVE-2024-36018).
- Update
  patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
  (git-fixes CVE-2024-36940).
- Update
  patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
  (git-fixes CVE-2024-36959).
- Update
  patches.suse/ppdev-Add-an-error-check-in-register_device.patch
  (git-fixes bsc#1225640 CVE-2024-36015).
- Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
  CVE-2024-36947).
- Update
  patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
  (git-fixes bsc#1225695 CVE-2024-36019).
- Update
  patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
  (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
- Update
  patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
  (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
- Update
  patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
  (git-fixes bsc#1225704 CVE-2024-36025).
- Update
  patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
  (git-fixes CVE-2024-36930).
- Update
  patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
  (bsc#1224331 bsc#1224602 CVE-2024-35814).
- Update
  patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
  (git-fixes bsc#1225642 CVE-2024-36016).
- Update
  patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
  (git-fixes bsc#1225749 CVE-2024-36894).
- Update
  patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
  (git-fixes bsc#1225750 CVE-2024-36895).
- Update
  patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
  (git-fixes bsc#1225748 CVE-2024-36893).
- Update
  patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
  (stable-fixes bsc#1225769 CVE-2024-36921).
- Update
  patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
  (stable-fixes CVE-2024-36922).
- Update
  patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
  (git-fixes CVE-2024-36941).
- Update
  patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
  (git-fixes bsc#1224742 CVE-2024-35803).
- commit 539780f</changelog>
  <changelog author="dwagner@suse.de" date="1717416006">- nvmet: fix ns enable/disable possible hang (git-fixes).
- nvme-multipath: fix io accounting on failover (git-fixes).
- nvme: fix multipath batched completion accounting (git-fixes).
- commit ed3b392</changelog>
  <changelog author="dwagner@suse.de" date="1717416007">- scsi: lpfc: Copyright updates for 14.4.0.2 patches
  (bsc#1225842).
- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
  (bsc#1225842).
  Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
  (bsc#1225842).
- scsi: lpfc: Clear deferred RSCN processing flag when driver
  is unloading (bsc#1225842).
- scsi: lpfc: Update logging of protection type for T10 DIF I/O
  (bsc#1225842).
- scsi: lpfc: Change default logging level for unsolicited CT
  MIB commands (bsc#1225842).
- commit 5a56384</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416008">- smb: client: fix mount when dns_resolver key is not available
  (git-fixes, bsc#1225172).
- commit 28edb5c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416009">- cifs: fix leak of iface for primary channel (git-fixes,
  bsc#1225172).
- commit b7eb8e8</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416010">- Revert "cifs: reconnect work should have reference on server
  struct" (git-fixes, bsc#1225172).
- commit 3ca4c0c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416011">- smb: client: fix parsing of SMB3.1.1 POSIX create context
  (git-fixes, bsc#1225172).
- commit 5f27f69</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416012">- cifs: failure to add channel on iface should bump up weight
  (git-fixes, bsc#1225172).
- commit 007b237</changelog>
  <changelog author="tonyj@suse.de" date="1717416013">- perf/x86: Fix out of range data (git-fixes).
- perf/x86/intel/ds: Don't clear -&gt;pebs_data_cfg for the last
  PEBS event (git-fixes).
- perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
- commit 664d77f</changelog>
  <changelog author="dsterba@suse.com" date="1717588800">- blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
- Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
  Quoting bsc#1225945#c11:
  "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
  transaction for every subvol create")
  ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
  unwritten extent buffer after snapshotting a new subvolume") was never
  backported."
- commit d947258</changelog>
  <changelog author="tonyj@suse.de" date="1717588801">- perf pmu: Count sys and cpuid JSON events separately (git
  fixes).
- perf stat: Don't display metric header for non-leader uncore
  events (git-fixes).
- perf daemon: Fix file leak in daemon_session__control
  (git-fixes).
- perf symbols: Fix ownership of string in dso__load_vmlinux()
  (git-fixes).
- perf thread: Fixes to thread__new() related to initializing comm
  (git-fixes).
- perf report: Avoid SEGV in report__setup_sample_type()
  (git-fixes).
- perf ui browser: Don't save pointer to stack memory (git-fixes).
- perf bench internals inject-build-id: Fix trap divide when
  collecting just one DSO (git-fixes).
- perf intel-pt: Fix unassigned instruction op (discovered by
  MemorySanitizer) (git-fixes).
- perf test shell arm_coresight: Increase buffer size for
  Coresight basic tests (git-fixes).
- perf docs: Document bpf event modifier (git-fixes).
- perf bench uprobe: Remove lib64 from libc.so.6 binary path
  (git-fixes).
- perf record: Fix debug message placement for test consumption
  (git-fixes).
- perf tests: Apply attributes to all events in object code
  reading test (git-fixes).
- perf tests: Make "test data symbol" more robust on Neoverse N1
  (git-fixes).
- perf annotate: Fix annotation_calc_lines() to pass correct
  address to get_srcline() (git-fixes).
- perf stat: Do not fail on metrics on s390 z/VM systems
  (git-fixes).
- perf sched timehist: Fix -g/--call-graph option failure
  (git-fixes).
- perf annotate: Get rid of duplicate --group option item
  (git-fixes).
- perf probe: Add missing libgen.h header needed for using
  basename() (git-fixes).
- perf record: Delete session after stopping sideband thread
  (git-fixes).
- perf auxtrace: Fix multiple use of --itrace option (git-fixes).
- perf script: Show also errors for --insn-trace option
  (git-fixes).
- perf lock contention: Add a missing NULL check (git-fixes).
- perf vendor events amd: Fix Zen 4 cache latency events
  (git-fixes).
- libperf evlist: Avoid out-of-bounds access (git-fixes).
- perf pmu: Fix a potential memory leak in perf_pmu__lookup()
  (git-fixes).
- perf print-events: make is_event_supported() more robust
  (git-fixes).
- perf list: fix short description for some cache events
  (git-fixes).
- perf metric: Don't remove scale from counts (git-fixes).
- perf stat: Avoid metric-only segv (git-fixes).
- perf expr: Fix "has_event" function for metric style events
  (git-fixes).
- perf srcline: Add missed addr2line closes (git-fixes).
- perf thread_map: Free strlist on normal path in
  thread_map__new_by_tid_str() (git-fixes).
- perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
- perf jevents: Drop or simplify small integer values (git-fixes).
- perf evsel: Fix duplicate initialization of data-&gt;id in
  evsel__parse_sample() (git-fixes).
- perf pmu: Treat the msr pmu as software (git-fixes).
- perf record: Check conflict between '--timestamp-filename'
  option and pipe mode before recording (git-fixes).
- perf record: Fix possible incorrect free in
  record__switch_output() (git-fixes).
- perf vendor events amd: Add Zen 4 memory controller events
  (git-fixes).
- perf top: Uniform the event name for the hybrid machine
  (git-fixes).
- perf top: Use evsel's cpus to replace user_requested_cpus
  (git-fixes).
- commit a1f9340</changelog>
  <changelog author="tonyj@suse.de" date="1717675200">- perf ui browser: Avoid SEGV on title (git fixes).
- commit 1578c22</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675201">- inet: inet_defrag: prevent sk release while still in use
  (CVE-2024-26921 bsc#1223138).
- commit 2016faf</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675202">- net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
- commit 7bf5961</changelog>
  <changelog author="tiwai@suse.de" date="1718366400">- Temporarily drop KVM patch that caused a regression (bsc#1226158)
  Delete patches.suse/KVM-x86-pmu-Prioritize-VMX-interception-over-GP-on-R.patch
- commit 33f31da</changelog>
</package>
<package pkgid="63bab2d3561b22ff8a0db4ad40a6b2eb4c4db5b72c3b440fbe95cc0e704437e9" name="dtb-xilinx" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.14.1"/>
  <changelog author="tiwai@suse.de" date="1719662400">- gpiolib: cdev: Disallow reconfiguration without direction
  (uAPI v1) (git-fixes).
- gpio: davinci: Validate the obtained number of IRQs (git-fixes).
- commit 919ebd1</changelog>
  <changelog author="tiwai@suse.de" date="1719748800">- i2c: testunit: discard write requests while old command is
  running (git-fixes).
- i2c: testunit: don't erase registers after STOP (git-fixes).
- mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
  (git-fixes).
- mmc: sdhci: Do not invert write-protect twice (git-fixes).
- mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
  (git-fixes).
- mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
  (git-fixes).
- commit 448487d</changelog>
  <changelog author="tiwai@suse.de" date="1719748801">- crypto: iaa - Account for cpu-less numa nodes (bsc#1227190).
- commit cd600aa</changelog>
  <changelog author="tiwai@suse.de" date="1719748802">- crypto: deflate - Add aliases to deflate (bsc#1227190).
- commit 27ffd92</changelog>
  <changelog author="tiwai@suse.de" date="1719835200">- ata: ahci: Clean up sysfs file on error (git-fixes).
- ata: libata-core: Fix double free on error (git-fixes).
- ata,scsi: libata-core: Do not leak memory for ata_port struct
  members (git-fixes).
- ata: libata-core: Fix null pointer dereference on error
  (git-fixes).
- kbuild: Fix build target deb-pkg: ln: failed to create hard link
  (git-fixes).
- kbuild: doc: Update default INSTALL_MOD_DIR from extra to
  updates (git-fixes).
- kbuild: Install dtb files as 0644 in Makefile.dtbinst
  (git-fixes).
- counter: ti-eqep: enable clock at probe (git-fixes).
- iio: chemical: bme680: Fix sensor data read operation
  (git-fixes).
- iio: chemical: bme680: Fix overflows in compensate() functions
  (git-fixes).
- iio: chemical: bme680: Fix calibration data variable
  (git-fixes).
- iio: chemical: bme680: Fix pressure value output (git-fixes).
- iio: accel: fxls8962af: select IIO_BUFFER &amp; IIO_KFIFO_BUF
  (git-fixes).
- iio: adc: ad7266: Fix variable checking bug (git-fixes).
- iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
  (git-fixes).
- serial: bcm63xx-uart: fix tx after conversion to
  uart_port_tx_limited() (git-fixes).
- serial: core: introduce uart_port_tx_limited_flags()
  (git-fixes).
- Revert "serial: core: only stop transmit when HW fifo is empty"
  (git-fixes).
- tty: mcf: MCF54418 has 10 UARTS (git-fixes).
- usb: gadget: aspeed_udc: fix device address configuration
  (git-fixes).
- usb: dwc3: core: remove lock of otg mode during gadget
  suspend/resume to avoid deadlock (git-fixes).
- usb: typec: ucsi: glink: fix child node release in probe
  function (git-fixes).
- usb: musb: da8xx: fix a resource leak in probe() (git-fixes).
- usb: atm: cxacru: fix endpoint checking in cxacru_bind()
  (git-fixes).
- usb: gadget: printer: fix races against disable (git-fixes).
- PCI/MSI: Fix UAF in msi_capability_init (git-fixes).
- commit a2ea5a9</changelog>
  <changelog author="ptesarik@suse.com" date="1719835201">- net: ena: Fix redundant device NUMA node override
  (jsc#PED-8688).
- commit 6ad6684</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835202">- tcp: do not accept ACK of bytes we never sent (CVE-2023-52881
  bsc#1225611).
- commit 16404a6</changelog>
  <changelog author="mhocko@suse.com" date="1719835203">- Update
  patches.suse/1352-drm-amdgpu-Fix-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52883
  bsc#1226630).
- Update
  patches.suse/9p-add-missing-locking-around-taking-dentry-fid-list.patch
  (git-fixes CVE-2024-39463 bsc#1227090).
- Update
  patches.suse/ALSA-Fix-deadlocks-with-kctl-removals-at-disconnecti.patch
  (stable-fixes CVE-2024-38600 bsc#1226864).
- Update
  patches.suse/ALSA-core-Fix-NULL-module-pointer-assignment-at-card.patch
  (git-fixes CVE-2024-38605 bsc#1226740).
- Update
  patches.suse/ALSA-hda-Fix-possible-null-ptr-deref-when-assigning-.patch
  (git-fixes CVE-2023-52806 bsc#1225554).
- Update
  patches.suse/ALSA-hda-cs_dsp_ctl-Use-private_free-for-control-cle.patch
  (git-fixes CVE-2024-38388 bsc#1226890).
- Update
  patches.suse/ALSA-timer-Set-lower-bound-of-start-tick-time.patch
  (stable-fixes git-fixes CVE-2024-38618 bsc#1226754).
- Update
  patches.suse/ASoC-kirkwood-Fix-potential-NULL-dereference.patch
  (git-fixes CVE-2024-38550 bsc#1226633).
- Update
  patches.suse/ASoC-mediatek-Assign-dummy-when-codec-not-specified-.patch
  (git-fixes CVE-2024-38551 bsc#1226761).
- Update
  patches.suse/Bluetooth-btusb-Add-date-evt_skb-is-NULL-check.patch
  (git-fixes CVE-2023-52833 bsc#1225595).
- Update
  patches.suse/Bluetooth-hci_core-Fix-possible-buffer-overflow.patch
  (git-fixes CVE-2024-26889).
- Update
  patches.suse/HID-uclogic-Fix-user-memory-access-bug-in-uclogic_pa.patch
  (git-fixes CVE-2023-52866 bsc#1225120).
- Update
  patches.suse/IB-mlx5-Fix-init-stage-error-handling-to-avoid-doubl.patch
  (jsc#PED-6864 CVE-2023-52851 bsc#1225587).
- Update
  patches.suse/Input-cyapa-add-missing-input-core-locking-to-suspen.patch
  (git-fixes CVE-2023-52884 bsc#1226764).
- Update
  patches.suse/Input-synaptics-rmi4-fix-use-after-free-in-rmi_unreg.patch
  (git-fixes CVE-2023-52840 bsc#1224928).
- Update
  patches.suse/KEYS-trusted-Do-not-use-WARN-when-encode-fails.patch
  (git-fixes CVE-2024-36975 bsc#1226520).
- Update
  patches.suse/KEYS-trusted-Fix-memory-leak-in-tpm2_key_encode.patch
  (git-fixes CVE-2024-36967 bsc#1226131).
- Update
  patches.suse/RDMA-cma-Fix-kmemleak-in-rdma_core-observed-during-b.patch
  (git-fixes CVE-2024-38539 bsc#1226608).
- Update patches.suse/RDMA-hns-Fix-UAF-for-cq-async-event.patch
  (git-fixes CVE-2024-38545 bsc#1226595).
- Update
  patches.suse/RDMA-hns-Fix-deadlock-on-SRQ-async-events.patch
  (git-fixes CVE-2024-38591 bsc#1226738).
- Update
  patches.suse/RDMA-hns-Modify-the-print-level-of-CQE-error.patch
  (git-fixes CVE-2024-38590 bsc#1226839).
- Update
  patches.suse/RDMA-rxe-Fix-seg-fault-in-rxe_comp_queue_pkt.patch
  (git-fixes CVE-2024-38544 bsc#1226597).
- Update
  patches.suse/SUNRPC-Fix-RPC-client-cleaned-up-the-freed-pipefs-de.patch
  (git-fixes CVE-2023-52803 bsc#1225008).
- Update patches.suse/af_unix-Clear-stale-u-oob_skb.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-35970 bsc#1224584).
- Update
  patches.suse/af_unix-Drop-oob_skb-ref-before-purging-queue-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26750 bsc#1222617).
- Update
  patches.suse/af_unix-Fix-task-hung-while-purging-oob_skb-in-GC.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-26780 bsc#1222588).
- Update
  patches.suse/af_unix-Update-unix_sk-sk-oob_skb-under-sk_receive_queue-lock.patch
  (CVE-2024-26676 bsc#1222380 CVE-2024-36972 bsc#1226163).
- Update
  patches.suse/arm64-Restrict-CPU_BIG_ENDIAN-to-GNU-as-or-LLVM-IAS-.patch
  (git-fixes CVE-2023-52750 bsc#1225485).
- Update
  patches.suse/atl1c-Work-around-the-DMA-RX-overflow-issue.patch
  (git-fixes CVE-2023-52834 bsc#1225599).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issue-of-net_device.patch
  (git-fixes CVE-2024-38554 bsc#1226742).
- Update
  patches.suse/ax25-Fix-reference-count-leak-issues-of-ax25_dev.patch
  (git-fixes CVE-2024-38602 bsc#1226613).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-reorder-of-WRITE-lqueued.patch
  (bsc#1225605 CVE-2024-38384 bsc#1226938).
- Update
  patches.suse/blk-cgroup-fix-list-corruption-from-resetting-io-stat.patch
  (bsc#1225605 CVE-2024-38663 bsc#1226939).
- Update
  patches.suse/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch
  (git-fixes CVE-2024-38540 bsc#1226582).
- Update
  patches.suse/bonding-stop-the-device-in-bond_setup_by_slave.patch
  (git-fixes CVE-2023-52784 bsc#1224946).
- Update
  patches.suse/can-dev-can_put_echo_skb-don-t-crash-kernel-if-can_p.patch
  (git-fixes CVE-2023-52878 bsc#1225000).
- Update
  patches.suse/clk-mediatek-clk-mt2701-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52875 bsc#1225096).
- Update
  patches.suse/clk-mediatek-clk-mt6765-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52870 bsc#1224937).
- Update
  patches.suse/clk-mediatek-clk-mt6779-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52873 bsc#1225589).
- Update
  patches.suse/clk-mediatek-clk-mt6797-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52865 bsc#1225086).
- Update
  patches.suse/clk-mediatek-clk-mt7629-Add-check-for-mtk_alloc_clk_.patch
  (git-fixes CVE-2023-52858 bsc#1225566).
- Update
  patches.suse/clk-mediatek-clk-mt7629-eth-Add-check-for-mtk_alloc_.patch
  (git-fixes CVE-2023-52876 bsc#1225036).
- Update
  patches.suse/cppc_cpufreq-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38573 bsc#1226739).
- Update patches.suse/cpufreq-exit-callback-is-optional.patch
  (git-fixes CVE-2024-38615 bsc#1226592).
- Update patches.suse/crypto-bcm-Fix-pointer-arithmetic.patch
  (git-fixes CVE-2024-38579 bsc#1226637).
- Update
  patches.suse/crypto-pcrypt-Fix-hungtask-for-PADATA_RESET.patch
  (git-fixes CVE-2023-52813 bsc#1225527).
- Update patches.suse/cxl-mem-Fix-shutdown-order.patch (git-fixes
  CVE-2023-52849 bsc#1224949).
- Update
  patches.suse/cxl-region-Do-not-try-to-cleanup-after-cxl_region_se.patch
  (git-fixes CVE-2023-52792 bsc#1225477).
- Update patches.suse/cxl-region-Fix-cxlr_pmem-leaks.patch
  (git-fixes CVE-2024-38391 bsc#1226894).
- Update
  patches.suse/dma-buf-sw-sync-don-t-enable-IRQ-from-sync_print_obj.patch
  (git-fixes CVE-2024-38780 bsc#1226886).
- Update
  patches.suse/dma-mapping-benchmark-fix-node-id-validation.patch
  (git-fixes CVE-2024-34777 bsc#1226796).
- Update
  patches.suse/dma-mapping-benchmark-handle-NUMA_NO_NODE-correctly.patch
  (git-fixes CVE-2024-39277 bsc#1226909).
- Update
  patches.suse/dmaengine-idxd-Avoid-unnecessary-destruction-of-file.patch
  (git-fixes CVE-2024-38629 bsc#1226905).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Pola.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52819
  bsc#1225532).
- Update
  patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-SMU7.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52818
  bsc#1225530).
- Update
  patches.suse/drm-amd-check-num-of-link-levels-when-update-pcie-pa.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52812
  bsc#1225564).
- Update
  patches.suse/drm-amd-display-Avoid-NULL-dereference-of-timing-gen.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52753
  bsc#1225478).
- Update
  patches.suse/drm-amd-display-Fix-division-by-zero-in-setup_dsc_co.patch
  (stable-fixes CVE-2024-36969 bsc#1226155).
- Update
  patches.suse/drm-amd-display-Fix-null-pointer-dereference-in-erro.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52862
  bsc#1225015).
- Update
  patches.suse/drm-amd-display-Fix-potential-index-out-of-bounds-in.patch
  (git-fixes CVE-2024-38552 bsc#1226767).
- Update
  patches.suse/drm-amd-display-fix-a-NULL-pointer-dereference-in-am.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52773
  bsc#1225041).
- Update
  patches.suse/drm-amd-display-fixed-integer-types-and-null-check-l.patch
  (git-fixes CVE-2024-26767).
- Update
  patches.suse/drm-amdgpu-Fix-a-null-pointer-access-when-the-smc_rr.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52817
  bsc#1225569).
- Update
  patches.suse/drm-amdgpu-Fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch
  (git-fixes CVE-2024-39291 bsc#1226934).
- Update
  patches.suse/drm-amdgpu-Fix-potential-null-pointer-derefernce.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52814
  bsc#1225565).
- Update
  patches.suse/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch
  (stable-fixes CVE-2024-39471 bsc#1227096).
- Update
  patches.suse/drm-amdgpu-mes-fix-use-after-free-issue.patch
  (stable-fixes CVE-2024-38581 bsc#1226657).
- Update
  patches.suse/drm-amdgpu-vkms-fix-a-possible-null-pointer-derefere.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52815
  bsc#1225568).
- Update
  patches.suse/drm-amdkfd-Fix-a-race-condition-of-vram-buffer-unref.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52825
  bsc#1225076).
- Update
  patches.suse/drm-amdkfd-Fix-shift-out-of-bounds-issue.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52816
  bsc#1225529).
- Update
  patches.suse/drm-bridge-cdns-mhdp8546-Fix-possible-null-pointer-d.patch
  (git-fixes CVE-2024-38548).
- Update
  patches.suse/drm-bridge-it66121-Fix-invalid-connector-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52861
  bsc#1224941).
- Update
  patches.suse/drm-bridge-lt8912b-Fix-crash-on-bridge-detach.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52856
  bsc#1224932).
- Update
  patches.suse/drm-mediatek-Add-0-size-check-to-mtk_drm_gem_obj.patch
  (git-fixes CVE-2024-38549 bsc#1226735).
- Update
  patches.suse/drm-mediatek-Fix-coverity-issue-with-unintentional-i.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52857
  bsc#1225581).
- Update
  patches.suse/drm-mediatek-Init-ddp_comp-with-devm_kcalloc.patch
  (git-fixes CVE-2024-38592 bsc#1226844).
- Update
  patches.suse/drm-msm-a6xx-Avoid-a-nullptr-dereference-when-speedb.patch
  (git-fixes CVE-2024-38390 bsc#1226891).
- Update
  patches.suse/drm-msm-dpu-Add-callback-function-pointer-check-befo.patch
  (git-fixes CVE-2024-38622 bsc#1226856).
- Update
  patches.suse/drm-panel-fix-a-possible-null-pointer-dereference.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52821
  bsc#1225022).
- Update
  patches.suse/drm-panel-panel-tpo-tpg110-fix-a-possible-null-point.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52826
  bsc#1225077).
- Update patches.suse/drm-radeon-possible-buffer-overflow.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52867
  bsc#1225009).
- Update
  patches.suse/drm-vc4-Fix-possible-null-pointer-dereference.patch
  (git-fixes CVE-2024-38546 bsc#1226593).
- Update
  patches.suse/drm-vmwgfx-Fix-invalid-reads-in-fence-signaled-event.patch
  (git-fixes CVE-2024-36960 bsc#1225872).
- Update
  patches.suse/drm-zynqmp_dpsub-Always-register-bridge.patch
  (git-fixes CVE-2024-38664 bsc#1226941).
- Update
  patches.suse/e1000e-change-usleep_range-to-udelay-in-PHY-mdic-acc.patch
  (CVE-2024-39296 bsc#1226989 CVE-2024-36887 bsc#1225731).
- Update
  patches.suse/ecryptfs-Fix-buffer-size-for-tag-66-packet.patch
  (git-fixes CVE-2024-38578 bsc#1226634).
- Update
  patches.suse/efi-libstub-only-free-priv.runtime_map-when-allocate.patch
  (git-fixes CVE-2024-33619 bsc#1226768).
- Update
  patches.suse/fbdev-imsttfb-fix-a-resource-leak-in-probe.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52838
  bsc#1225031).
- Update
  patches.suse/fs-9p-only-translate-RWX-permissions-for-plain-9P200.patch
  (git-fixes CVE-2024-36964 bsc#1225866).
- Update
  patches.suse/fs-jfs-Add-check-for-negative-db_l2nbperpage.patch
  (git-fixes CVE-2023-52810 bsc#1225557).
- Update
  patches.suse/fs-jfs-Add-validity-check-for-db_maxag-and-db_agpref.patch
  (git-fixes CVE-2023-52804 bsc#1225550).
- Update
  patches.suse/ftrace-Fix-possible-use-after-free-issue-in-ftrace_location.patch
  (git-fixes CVE-2024-38588 bsc#1226837).
- Update
  patches.suse/genirq-irqdesc-Prevent-use-after-free-in-irq_find_at.patch
  (git-fixes CVE-2024-38385 bsc#1227085).
- Update patches.suse/gfs2-ignore-negated-quota-changes.patch
  (git-fixes CVE-2023-52759 bsc#1225560).
- Update
  patches.suse/hid-cp2112-Fix-duplicate-workqueue-initialization.patch
  (git-fixes CVE-2023-52853 bsc#1224988).
- Update
  patches.suse/hwmon-axi-fan-control-Fix-possible-NULL-pointer-dere.patch
  (git-fixes CVE-2023-52863 bsc#1225586).
- Update
  patches.suse/i2c-acpi-Unbind-mux-adapters-before-delete.patch
  (git-fixes CVE-2024-39362 bsc#1226995).
- Update
  patches.suse/i2c-core-Run-atomic-i2c-xfer-when-preemptible.patch
  (git-fixes CVE-2023-52791 bsc#1225108).
- Update
  patches.suse/i3c-master-mipi-i3c-hci-Fix-a-kernel-panic-for-acces.patch
  (git-fixes CVE-2023-52763 bsc#1225570).
- Update
  patches.suse/i3c-mipi-i3c-hci-Fix-out-of-bounds-access-in-hci_dma.patch
  (git-fixes CVE-2023-52766).
- Update
  patches.suse/i915-perf-Fix-NULL-deref-bugs-with-drm_dbg-calls.patch
  (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
  jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
  jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52788
  bsc#1225106).
- Update
  patches.suse/igb-Fix-string-truncation-warnings-in-igb_set_fw_ver.patch
  (git-fixes CVE-2024-36010 bsc#1225594).
- Update
  patches.suse/iommu-vt-d-Fix-WARN_ON-in-iommu-probe-path.patch
  (git-fixes CVE-2024-35957 bsc#1224673).
- Update
  patches.suse/iommufd-Fix-missing-update-of-domains_itree-after-splitting-iopt
  (jsc#PED-7779 jsc#PED-7780 CVE-2023-52801 bsc#1225006).
- Update
  patches.suse/ipvlan-add-ipvlan_route_v6_outbound-helper.patch
  (git-fixes CVE-2023-52796 bsc#1224930).
- Update
  patches.suse/jffs2-prevent-xattr-node-from-overflowing-the-eraseblock.patch
  (git-fixes CVE-2024-38599 bsc#1226848).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-dbFindLeaf.patch
  (git-fixes CVE-2023-52799 bsc#1225472).
- Update
  patches.suse/jfs-fix-array-index-out-of-bounds-in-diAlloc.patch
  (git-fixes CVE-2023-52805 bsc#1225553).
- Update
  patches.suse/kunit-fortify-Fix-mismatched-kvalloc-vfree-usage.patch
  (git-fixes CVE-2024-38617 bsc#1226859).
- Update
  patches.suse/lib-generic-radix-tree.c-Don-t-overflow-in-peek.patch
  (git-fixes CVE-2021-47432 bsc#1225391).
- Update
  patches.suse/lib-test_hmm.c-handle-src_pfns-and-dst_pfns-allocati.patch
  (git-fixes CVE-2024-38543 bsc#1226594).
- Update
  patches.suse/locking-ww_mutex-test-Fix-potential-workqueue-corrup.patch
  (bsc#1219953 CVE-2023-52836 bsc#1225609).
- Update
  patches.suse/md-Don-t-ignore-suspended-array-in-md_check_recovery-1baa.patch
  (bsc#1219596 CVE-2024-26758).
- Update
  patches.suse/media-atomisp-ssh_css-Fix-a-null-pointer-dereference.patch
  (git-fixes CVE-2024-38547 bsc#1226632).
- Update
  patches.suse/media-bttv-fix-use-after-free-error-due-to-btv-timeo.patch
  (git-fixes CVE-2023-52847 bsc#1225588).
- Update
  patches.suse/media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch
  (git-fixes CVE-2023-52764 bsc#1225571).
- Update
  patches.suse/media-hantro-Check-whether-reset-op-is-defined-befor.patch
  (git-fixes CVE-2023-52850 bsc#1225014).
- Update
  patches.suse/media-i2c-et8ek8-Don-t-strip-remove-function-when-dr.patch
  (git-fixes CVE-2024-38611 bsc#1226760).
- Update
  patches.suse/media-imon-fix-access-to-invalid-resource-for-the-se.patch
  (git-fixes CVE-2023-52754 bsc#1225490).
- Update
  patches.suse/media-lgdt3306a-Add-a-check-against-null-pointer-def.patch
  (stable-fixes CVE-2022-48772 bsc#1226976).
- Update
  patches.suse/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch
  (git-fixes CVE-2024-38621 bsc#1226895).
- Update
  patches.suse/media-vidtv-mux-Add-check-and-kfree-for-kstrdup.patch
  (git-fixes CVE-2023-52841 bsc#1225592).
- Update patches.suse/media-vidtv-psi-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52844 bsc#1225590).
- Update
  patches.suse/mfd-qcom-spmi-pmic-Fix-revid-implementation.patch
  (git-fixes CVE-2023-52765 bsc#1225029).
- Update
  patches.suse/misc-microchip-pci1xxxx-fix-double-free-in-the-error.patch
  (git-fixes CVE-2024-36973 bsc#1226457).
- Update
  patches.suse/net-hns3-fix-out-of-bounds-access-may-occur-when-coa.patch
  (git-fixes CVE-2023-52807 bsc#1225097).
- Update
  patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch
  (git-fixes CVE-2024-36962 bsc#1225827).
- Update
  patches.suse/net-mlx5-Fix-peer-devlink-set-for-SF-representor-dev.patch
  (git-fixes CVE-2024-38595 bsc#1226741).
- Update
  patches.suse/net-mlx5e-Track-xmit-submission-to-PTP-WQ-after-popu.patch
  (jsc#PED-3311 CVE-2023-52782 bsc#1225103).
- Update
  patches.suse/net-mvneta-fix-calls-to-page_pool_get_stats.patch
  (git-fixes CVE-2023-52780 bsc#1224933).
- Update
  patches.suse/net-wangxun-fix-kernel-panic-due-to-null-pointer.patch
  (git-fixes CVE-2023-52783 bsc#1225104).
- Update
  patches.suse/netfilter-complete-validation-of-user-input.patch
  (git-fixes CVE-2024-35896 bsc#1224662 CVE-2024-35962
  bsc#1224583).
- Update
  patches.suse/nfc-nci-Fix-uninit-value-in-nci_rx_work.patch
  (git-fixes CVE-2024-38381 bsc#1226878).
- Update
  patches.suse/nilfs2-fix-nilfs_empty_dir-misjudgment-and-long-loop.patch
  (git-fixes CVE-2024-39469 bsc#1226992).
- Update
  patches.suse/nilfs2-fix-potential-hang-in-nilfs_detach_log_writer.patch
  (git-fixes CVE-2024-38582 bsc#1226658).
- Update
  patches.suse/nilfs2-fix-use-after-free-of-timer-for-log-writer-th.patch
  (git-fixes CVE-2024-38583 bsc#1226777).
- Update
  patches.suse/of-module-add-buffer-overflow-check-in-of_modalias.patch
  (git-fixes CVE-2024-38541 bsc#1226587).
- Update
  patches.suse/padata-Fix-refcnt-handling-in-padata_free_shell.patch
  (git-fixes CVE-2023-52854 bsc#1225584).
- Update
  patches.suse/perf-core-Bail-out-early-if-the-request-AUX-area-is-out-of-bound.patch
  (git-fixes CVE-2023-52835 bsc#1225602).
- Update
  patches.suse/platform-x86-wmi-Fix-opening-of-char-device.patch
  (git-fixes CVE-2023-52864 bsc#1225132).
- Update
  patches.suse/powerpc-pseries-iommu-LPAR-panics-during-boot-up-wit.patch
  (bsc#1222011 ltc#205900 CVE-2024-36926 bsc#1225829).
- Update patches.suse/pstore-platform-Add-check-for-kstrdup.patch
  (git-fixes CVE-2023-52869 bsc#1225050).
- Update
  patches.suse/remoteproc-mediatek-Make-sure-IPI-buffer-fits-in-L2T.patch
  (git-fixes CVE-2024-36965 bsc#1226149).
- Update
  patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch
  (git-fixes CVE-2024-38601 bsc#1226876).
- Update
  patches.suse/s390-dasd-protect-device-queue-against-concurrent-access.patch
  (git-fixes bsc#1217481 CVE-2023-52774 bsc#1225572).
- Update
  patches.suse/scsi-hisi_sas-Set-debugfs_dir-pointer-to-NULL-after-removing-debugfs.patch
  (git-fixes CVE-2023-52808 bsc#1225555).
- Update
  patches.suse/scsi-ibmvfc-Remove-BUG_ON-in-the-case-of-an-empty-ev.patch
  (bsc#1209834 ltc#202097 CVE-2023-52811 bsc#1225559).
- Update
  patches.suse/scsi-libfc-Fix-potential-NULL-pointer-dereference-in-fc_lport_ptp_setup.patch
  (git-fixes CVE-2023-52809 bsc#1225556).
- Update
  patches.suse/scsi-lpfc-Move-NPIV-s-transport-unregistration-to-af.patch
  (bsc#1221777 CVE-2024-36952 bsc#1225898).
- Update
  patches.suse/scsi-lpfc-Release-hbalock-before-calling-lpfc_worker.patch
  (bsc#1221777 CVE-2024-36924 bsc#1225820).
- Update
  patches.suse/serial-max3100-Lock-port-lock-when-calling-uart_hand.patch
  (git-fixes CVE-2024-38634 bsc#1226868).
- Update
  patches.suse/serial-max3100-Update-uart_driver_registered-on-driv.patch
  (git-fixes CVE-2024-38633 bsc#1226867).
- Update
  patches.suse/soc-qcom-llcc-Handle-a-second-device-without-data-co.patch
  (git-fixes CVE-2023-52871 bsc#1225534).
- Update
  patches.suse/soundwire-cadence-fix-invalid-PDI-offset.patch
  (stable-fixes CVE-2024-38635 bsc#1226863).
- Update patches.suse/speakup-Fix-sizeof-vs-ARRAY_SIZE-bug.patch
  (git-fixes CVE-2024-38587 bsc#1226780).
- Update patches.suse/spi-Fix-null-dereference-on-suspend.patch
  (git-fixes CVE-2023-52749 bsc#1225476).
- Update
  patches.suse/thermal-core-prevent-potential-string-overflow.patch
  (git-fixes CVE-2023-52868 bsc#1225044).
- Update
  patches.suse/thermal-drivers-qcom-lmh-Check-for-SCM-availability-.patch
  (git-fixes CVE-2024-39466 bsc#1227089).
- Update
  patches.suse/thermal-drivers-tsens-Fix-null-pointer-dereference.patch
  (git-fixes CVE-2024-38571 bsc#1226737).
- Update
  patches.suse/thermal-intel-powerclamp-fix-mismatch-in-get-functio.patch
  (git-fixes CVE-2023-52794 bsc#1225028).
- Update
  patches.suse/tls-fix-NULL-deref-on-tls_sw_splice_eof-with-empty-r.patch
  (jsc#PED-6831 CVE-2023-52767 bsc#1224998).
- Update
  patches.suse/tpm_tis_spi-Account-for-SPI-header-when-allocating-T.patch
  (git-fixes CVE-2024-36477 bsc#1226840).
- Update
  patches.suse/tracing-Have-trace_event_file-have-ref-counters.patch
  (git-fixes CVE-2023-52879 bsc#1225101).
- Update
  patches.suse/tracing-trigger-Fix-to-return-error-if-failed-to-alloc-snapshot.patch
  (git-fixes CVE-2024-26920).
- Update
  patches.suse/tty-n_gsm-fix-race-condition-in-status-line-change-o.patch
  (git-fixes CVE-2023-52872 bsc#1225591).
- Update
  patches.suse/tty-n_gsm-require-CAP_NET_ADMIN-to-attach-N_GSM0710-.patch
  (bsc#1222619 CVE-2023-52880).
- Update
  patches.suse/tty-vcc-Add-check-for-kstrdup-in-vcc_probe.patch
  (git-fixes CVE-2023-52789 bsc#1225180).
- Update
  patches.suse/usb-config-fix-iteration-issue-in-usb_get_bos_descri.patch
  (git-fixes CVE-2023-52781 bsc#1225092).
- Update
  patches.suse/usb-dwc3-Wait-unconditionally-after-issuing-EndXfer-.patch
  (git-fixes CVE-2024-36977 bsc#1226513).
- Update
  patches.suse/usb-gadget-u_audio-Fix-race-condition-use-of-control.patch
  (git-fixes CVE-2024-38628 bsc#1226911).
- Update
  patches.suse/usb-storage-alauda-Check-whether-the-media-is-initia.patch
  (git-fixes CVE-2024-38619 bsc#1226861).
- Update
  patches.suse/usb-typec-tcpm-Fix-NULL-pointer-dereference-in-tcpm_.patch
  (git-fixes CVE-2023-52877 bsc#1224944).
- Update
  patches.suse/vhost-vdpa-fix-use-after-free-in-vhost_vdpa_probe.patch
  (jsc#PED-3311 CVE-2023-52795 bsc#1225085).
- Update
  patches.suse/virtio-blk-fix-implicit-overflow-on-virtio_max_dma_s.patch
  (git-fixes CVE-2023-52762 bsc#1225573).
- Update
  patches.suse/virtio-vsock-Fix-uninit-value-in-virtio_transport_re.patch
  (jsc#PED-5505 CVE-2023-52842 bsc#1225025).
- Update
  patches.suse/watchdog-cpu5wdt.c-Fix-use-after-free-bug-caused-by-.patch
  (git-fixes CVE-2024-38630 bsc#1226908).
- Update
  patches.suse/wifi-ar5523-enable-proper-endpoint-verification.patch
  (git-fixes CVE-2024-38565 bsc#1226747).
- Update
  patches.suse/wifi-ath11k-fix-dfs-radar-event-locking.patch
  (git-fixes CVE-2023-52798 bsc#1224947).
- Update
  patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch
  (git-fixes CVE-2023-52777 bsc#1224992).
- Update patches.suse/wifi-ath11k-fix-htt-pktlog-locking.patch
  (git-fixes CVE-2023-52800).
- Update
  patches.suse/wifi-ath12k-fix-dfs-radar-and-temperature-event-lock.patch
  (git-fixes CVE-2023-52776 bsc#1225090).
- Update
  patches.suse/wifi-ath12k-fix-htt-mlo-offset-event-locking.patch
  (git-fixes CVE-2023-52769 bsc#1225001).
- Update
  patches.suse/wifi-ath12k-fix-out-of-bound-access-of-qmi_invoke_ha.patch
  (git-fixes CVE-2024-38572 bsc#1226776).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-read-in-ath12k.patch
  (git-fixes CVE-2023-52827 bsc#1225078).
- Update
  patches.suse/wifi-ath12k-fix-possible-out-of-bound-write-in-ath12.patch
  (git-fixes CVE-2023-52829 bsc#1225081).
- Update
  patches.suse/wifi-brcmfmac-pcie-handle-randbuf-allocation-failure.patch
  (git-fixes CVE-2024-38575 bsc#1226612).
- Update
  patches.suse/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch
  (git-fixes CVE-2024-38567 bsc#1226769).
- Update
  patches.suse/wifi-carl9170-re-fix-fortified-memset-warning.patch
  (git-fixes CVE-2024-38616 bsc#1226852).
- Update
  patches.suse/wifi-mac80211-don-t-return-unset-power-in-ieee80211_.patch
  (git-fixes CVE-2023-52832 bsc#1225577).
- Update
  patches.suse/wifi-nl80211-Avoid-address-calculations-via-out-of-b.patch
  (git-fixes CVE-2024-38562 bsc#1226788).
- Update
  patches.suse/wifi-wilc1000-use-vmm_table-as-array-in-wilc-struct.patch
  (git-fixes CVE-2023-52768 bsc#1225004).
- Update
  patches.suse/x86-tdx-Zero-out-the-missing-RSI-in-TDX_HYPERCALL-macro.patch
  (jsc#PED-5824 CVE-2023-52874 bsc#1225049).
- commit 33efdc4</changelog>
  <changelog author="mkubecek@suse.cz" date="1719835204">- tcp: Use refcount_inc_not_zero() in tcp_twsk_unique()
  (CVE-2024-36904 bsc#1225732).
- commit d578dcc</changelog>
  <changelog author="heming.zhao@suse.com" date="1719921600">- gfs2: Fix potential glock use-after-free on unmount (bsc#1226775
  CVE-2024-38570).
- gfs2: Rename sd_{ glock =&gt; kill }_wait (bsc#1226775
  CVE-2024-38570).
- commit f3adbca</changelog>
  <changelog author="tiwai@suse.de" date="1719921601">- Correct SCSI patch references (bsc#1225767 CVE-2024-36919 bsc#1226785 CVE-2024-38559)
- commit e8ea587</changelog>
  <changelog author="tiwai@suse.de" date="1719921602">- mtd: rawnand: rockchip: ensure NVDDR timings are rejected
  (git-fixes).
- mtd: rawnand: Bypass a couple of sanity checks during NAND
  identification (git-fixes).
- mtd: rawnand: Fix the nand_read_data_op() early check
  (git-fixes).
- mtd: rawnand: Ensure ECC configuration is propagated to upper
  layers (git-fixes).
- commit e545951</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1719921603">- kernel-doc: fix struct_group_tagged() parsing (git-fixes).
- commit e3a2a2e</changelog>
  <changelog author="fdmanana@suse.com" date="1719921604">- btrfs: fix crash on racing fsync and size-extending write into
  prealloc (bsc#1227101 CVE-2024-37354).
- commit 1d355af</changelog>
  <changelog author="vbabka@suse.cz" date="1719921605">- virt: acrn: stop using follow_pfn (CVE-2024-38610 bsc#1226758).
- commit c2ea51b</changelog>
  <changelog author="vbabka@suse.cz" date="1719921606">- drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
  (CVE-2024-38610 bsc#1226758).
- commit 7069ac2</changelog>
  <changelog author="rhopkins@suse.de" date="1719921607">- hsr: Prevent use after free in prp_create_tagged_frame()
  (CVE-2023-52846 bsc#1225098).
- commit cf63988</changelog>
  <changelog author="krisman@suse.de" date="1719921608">- io_uring: Fix io_cqring_wait() not restoring sigmask on
  get_timespec64() failure (git-fixes).
- commit e640a65</changelog>
  <changelog author="krisman@suse.de" date="1719921609">- io_uring: check for non-NULL file pointer in io_file_can_poll()
  (bsc#1226990 CVE-2024-39371).
- io_uring/io-wq: Use set_bit() and test_bit() at worker-&gt;flags
  (git-fixes).
- io_uring/sqpoll: work around a potential audit memory leak
  (git-fixes).
- commit 24603fc</changelog>
  <changelog author="krisman@suse.de" date="1719921610">- io_uring/rsrc: fix incorrect assignment of iter-&gt;nr_segs in
  io_import_fixed (git-fixes).
- io_uring/rsrc: don't lock while !TASK_RUNNING (git-fixes).
- io_uring/io-wq: avoid garbage value of 'match' in
  io_wq_enqueue() (git-fixes).
- commit 7d3e252</changelog>
</package>
<package pkgid="330c2ba7f6627e8dc351732454ddba228b7432273d8b9a421a2710b676654050" name="dtb-xilinx" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.17.1"/>
  <changelog author="tiwai@suse.de" date="1722081600">- auxdisplay: ht16k33: Drop reference after LED registration
  (git-fixes).
- ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
  on unprepare (git-fixes).
- ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
- ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
  reachable (git-fixes).
- ASoC: sof: amd: fix for firmware reload failure in Vangogh
  platform (git-fixes).
- ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
- ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
  (git-fixes).
- ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
- ALSA: ump: Don't update FB name for static blocks (git-fixes).
- drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
- drm/i915/gt: Do not consider preemption during execlists_dequeue
  for gen8 (git-fixes).
- drm/i915/dp: Don't switch the LTTPR mode on an active link
  (git-fixes).
- commit d7e2deb</changelog>
  <changelog author="tiwai@suse.de" date="1722081601">- ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
  (stable-fixes).
- ALSA: usb-audio: Move HD Webcam quirk to the right place
  (git-fixes).
- ALSA: usb-audio: Fix microphone sound on HD webcam
  (stable-fixes).
- commit 07826dc</changelog>
  <changelog author="tiwai@suse.de" date="1722168000">- spi: spidev: add correct compatible for Rohm BH2228FV
  (git-fixes).
- spi: microchip-core: ensure TX and RX FIFOs are empty at start
  of a transfer (git-fixes).
- spi: microchip-core: only disable SPI controller when register
  value change requires it (git-fixes).
- spi: microchip-core: defer asserting chip select until just
  before write to TX FIFO (git-fixes).
- spi: microchip-core: fix the issues in the isr (git-fixes).
- clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
  use (git-fixes).
- decompress_bunzip2: fix rare decompression failure (git-fixes).
- commit 536a80d</changelog>
  <changelog author="jslaby@suse.cz" date="1722254400">- Refresh
  patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
  Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
- commit 9280ac5</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254401">- tun: add missing verification for short frame (CVE-2024-41091
  bsc#1228327).
- tap: add missing verification for short frame (CVE-2024-41090
  bsc#1228328).
- net: ena: Add validation for completion descriptors consistency
  (CVE-2024-40999 bsc#1227913).
- commit 7fa5ae2</changelog>
  <changelog author="fdmanana@suse.com" date="1722254402">- btrfs: zoned: fix use-after-free due to race with dev replace
  (bsc#1227719 CVE-2024-39496).
- commit c878f86</changelog>
  <changelog author="ddiss@suse.de" date="1722254403">- ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
- commit f7cf8d6</changelog>
  <changelog author="lhenriques@suse.de" date="1722254404">- ceph: fix incorrect kmalloc size of pagevec mempool
  (bsc#1228417).
- commit 84977b0</changelog>
  <changelog author="tiwai@suse.de" date="1722254405">- Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
- commit 96de263</changelog>
  <changelog author="jack@suse.cz" date="1722254406">- ext4: fix uninitialized ratelimit_state-&gt;lock access in
  __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
- commit cefc508</changelog>
  <changelog author="jack@suse.cz" date="1722254407">- ext4: do not create EA inode under buffer lock (bsc#1227910
  CVE-2024-40972).
- commit 37fb4de</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1722254408">- supported.conf: mark vdpa modules supported (jsc#PED-8954)
- commit 483ffd4</changelog>
  <changelog author="jack@suse.cz" date="1722254409">- block: fix request.queuelist usage in flush (bsc#1227789
  CVE-2024-40925).
- commit 4903430</changelog>
  <changelog author="jack@suse.cz" date="1722254410">- ext4: fix mb_cache_entry's e_refcnt leak in
  ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
- commit d72f4d7</changelog>
  <changelog author="jack@suse.cz" date="1722254411">- ext4: fold quota accounting into
  ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
- commit 94f6f2b</changelog>
  <changelog author="ailiop@suse.com" date="1722254412">- jfs: don't walk off the end of ealist (bsc#1228403
  CVE-2024-41017).
- commit 4159bc5</changelog>
  <changelog author="ailiop@suse.com" date="1722254413">- xfs: don't walk off the end of a directory data block
  (bsc#1228405 CVE-2024-41013).
- commit 8a0b7eb</changelog>
  <changelog author="ailiop@suse.com" date="1722254414">- xfs: add bounds checking to xlog_recover_process_data
  (bsc#1228408 CVE-2024-41014).
- commit bb0300d</changelog>
  <changelog author="tiwai@suse.de" date="1722340800">- Move upstreamed ASoC patch into sorted section
- commit adae4df</changelog>
  <changelog author="tiwai@suse.de" date="1722340801">- HID: wacom: Modify pen IDs (git-fixes).
- commit 9c450d7</changelog>
</package>
<package pkgid="598c9a4b3e71946c35d3eda2e5bd8db1c69174876675430657d5b9a111eb3a83" name="dtb-xilinx" arch="aarch64">
  <version epoch="0" ver="6.4.0" rel="150600.23.7.1"/>
  <changelog author="mkubecek@suse.cz" date="1717416000">- netfilter: nf_tables: release mutex after nft_gc_seq_end from
  abort path (CVE-2024-26925 bsc#1223390).
- commit 578a709</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1717416001">- Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
  The L3 bsc#1225765 was created seperately since our customer requires
  PTF.
- Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
- Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
- Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
- Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
- commit 054635e</changelog>
  <changelog author="msuchanek@suse.de" date="1717416002">- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
- powerpc/uaccess: Fix build errors seen with GCC 13/14
  (bsc#1194869).
- commit 46b5d84</changelog>
  <changelog author="msuchanek@suse.de" date="1717416003">- blacklist.conf: PPC fsl_msi is not used
- commit ae6590d</changelog>
  <changelog author="msuchanek@suse.de" date="1717416004">- powerpc/pseries/lparcfg: drop error message from guest name
  lookup (bsc#1187716 ltc#193451 git-fixes).
- commit ceab637</changelog>
  <changelog author="mfranc@suse.cz" date="1717416005">- Update
  patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
  (git-fixes CVE-2024-36955).
- Update
  patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
  (git-fixes bsc#1225715 CVE-2024-36906).
- Update
  patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
  (git-fixes bsc#1225579 CVE-2024-36011).
- Update
  patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
  (git-fixes bsc#1225578 CVE-2024-36013).
- Update
  patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
  (git-fixes bsc#1225502 CVE-2024-36012).
- Update
  patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
  (git-fixes bsc#1225722 CVE-2024-36880).
- Update
  patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
  (git-fixes CVE-2024-36942).
- Update
  patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
  (git-fixes bsc#1225720 CVE-2024-36032).
- Update
  patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
  (git-fixes bsc#1223749 CVE-2024-26990).
- Update
  patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
  (git-fixes bsc#1223692 CVE-2024-26992).
- Update
  patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
  (stable-fixes CVE-2024-36944).
- Update
  patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
  (git-fixes bsc#1225734 CVE-2024-36896).
- Update
  patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
  (stable-fixes CVE-2024-36949).
- Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
  (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
- Update
  patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
  (git-fixes bsc#1225692 CVE-2023-52882).
- Update
  patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
  (git-fixes CVE-2024-26761).
- Update
  patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
  (stable-fixes bsc#1225735 CVE-2024-36897).
- Update
  patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
  (stable-fixes bsc#1225705 CVE-2024-36026).
- Update
  patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
  (stable-fixes CVE-2024-36951).
- Update
  patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
  (git-fixes bsc#1225593 CVE-2024-36014).
- Update
  patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
  (stable-fixes bsc#1225728 CVE-2024-36885).
- Update
  patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
  (git-fixes bsc#1225773 CVE-2024-36936).
- Update
  patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
  (stable-fixes CVE-2024-36950).
- Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
  (git-fixes bsc#1225736 CVE-2024-36898).
- Update
  patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
  (git-fixes bsc#1225698 CVE-2024-36020).
- Update
  patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
  (git-fixes bsc#1225710 CVE-2024-36891).
- Update
  patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
  (git-fixes bsc#1225714 CVE-2024-36890).
- Update
  patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
  (git-fixes bsc#1225708 CVE-2024-36029).
- Update
  patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
  (git-fixes bsc#1225699 CVE-2024-36021).
- Update
  patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
  (git-fixes CVE-2024-26943).
- Update
  patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
  (git-fixes bsc#1225694 CVE-2024-36018).
- Update
  patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
  (git-fixes CVE-2024-36940).
- Update
  patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
  (git-fixes CVE-2024-36959).
- Update
  patches.suse/ppdev-Add-an-error-check-in-register_device.patch
  (git-fixes bsc#1225640 CVE-2024-36015).
- Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
  CVE-2024-36947).
- Update
  patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
  (git-fixes bsc#1225695 CVE-2024-36019).
- Update
  patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
  (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
- Update
  patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
  (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
- Update
  patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
  (git-fixes bsc#1225704 CVE-2024-36025).
- Update
  patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
  (git-fixes CVE-2024-36930).
- Update
  patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
  (bsc#1224331 bsc#1224602 CVE-2024-35814).
- Update
  patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
  (git-fixes bsc#1225642 CVE-2024-36016).
- Update
  patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
  (git-fixes bsc#1225749 CVE-2024-36894).
- Update
  patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
  (git-fixes bsc#1225750 CVE-2024-36895).
- Update
  patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
  (git-fixes bsc#1225748 CVE-2024-36893).
- Update
  patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
  (stable-fixes bsc#1225769 CVE-2024-36921).
- Update
  patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
  (stable-fixes CVE-2024-36922).
- Update
  patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
  (git-fixes CVE-2024-36941).
- Update
  patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
  (git-fixes bsc#1224742 CVE-2024-35803).
- commit 539780f</changelog>
  <changelog author="dwagner@suse.de" date="1717416006">- nvmet: fix ns enable/disable possible hang (git-fixes).
- nvme-multipath: fix io accounting on failover (git-fixes).
- nvme: fix multipath batched completion accounting (git-fixes).
- commit ed3b392</changelog>
  <changelog author="dwagner@suse.de" date="1717416007">- scsi: lpfc: Copyright updates for 14.4.0.2 patches
  (bsc#1225842).
- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
  (bsc#1225842).
  Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
  (bsc#1225842).
- scsi: lpfc: Clear deferred RSCN processing flag when driver
  is unloading (bsc#1225842).
- scsi: lpfc: Update logging of protection type for T10 DIF I/O
  (bsc#1225842).
- scsi: lpfc: Change default logging level for unsolicited CT
  MIB commands (bsc#1225842).
- commit 5a56384</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416008">- smb: client: fix mount when dns_resolver key is not available
  (git-fixes, bsc#1225172).
- commit 28edb5c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416009">- cifs: fix leak of iface for primary channel (git-fixes,
  bsc#1225172).
- commit b7eb8e8</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416010">- Revert "cifs: reconnect work should have reference on server
  struct" (git-fixes, bsc#1225172).
- commit 3ca4c0c</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416011">- smb: client: fix parsing of SMB3.1.1 POSIX create context
  (git-fixes, bsc#1225172).
- commit 5f27f69</changelog>
  <changelog author="ematsumiya@suse.de" date="1717416012">- cifs: failure to add channel on iface should bump up weight
  (git-fixes, bsc#1225172).
- commit 007b237</changelog>
  <changelog author="tonyj@suse.de" date="1717416013">- perf/x86: Fix out of range data (git-fixes).
- perf/x86/intel/ds: Don't clear -&gt;pebs_data_cfg for the last
  PEBS event (git-fixes).
- perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
- commit 664d77f</changelog>
  <changelog author="dsterba@suse.com" date="1717588800">- blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
- Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
  Quoting bsc#1225945#c11:
  "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
  transaction for every subvol create")
  ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
  unwritten extent buffer after snapshotting a new subvolume") was never
  backported."
- commit d947258</changelog>
  <changelog author="tonyj@suse.de" date="1717588801">- perf pmu: Count sys and cpuid JSON events separately (git
  fixes).
- perf stat: Don't display metric header for non-leader uncore
  events (git-fixes).
- perf daemon: Fix file leak in daemon_session__control
  (git-fixes).
- perf symbols: Fix ownership of string in dso__load_vmlinux()
  (git-fixes).
- perf thread: Fixes to thread__new() related to initializing comm
  (git-fixes).
- perf report: Avoid SEGV in report__setup_sample_type()
  (git-fixes).
- perf ui browser: Don't save pointer to stack memory (git-fixes).
- perf bench internals inject-build-id: Fix trap divide when
  collecting just one DSO (git-fixes).
- perf intel-pt: Fix unassigned instruction op (discovered by
  MemorySanitizer) (git-fixes).
- perf test shell arm_coresight: Increase buffer size for
  Coresight basic tests (git-fixes).
- perf docs: Document bpf event modifier (git-fixes).
- perf bench uprobe: Remove lib64 from libc.so.6 binary path
  (git-fixes).
- perf record: Fix debug message placement for test consumption
  (git-fixes).
- perf tests: Apply attributes to all events in object code
  reading test (git-fixes).
- perf tests: Make "test data symbol" more robust on Neoverse N1
  (git-fixes).
- perf annotate: Fix annotation_calc_lines() to pass correct
  address to get_srcline() (git-fixes).
- perf stat: Do not fail on metrics on s390 z/VM systems
  (git-fixes).
- perf sched timehist: Fix -g/--call-graph option failure
  (git-fixes).
- perf annotate: Get rid of duplicate --group option item
  (git-fixes).
- perf probe: Add missing libgen.h header needed for using
  basename() (git-fixes).
- perf record: Delete session after stopping sideband thread
  (git-fixes).
- perf auxtrace: Fix multiple use of --itrace option (git-fixes).
- perf script: Show also errors for --insn-trace option
  (git-fixes).
- perf lock contention: Add a missing NULL check (git-fixes).
- perf vendor events amd: Fix Zen 4 cache latency events
  (git-fixes).
- libperf evlist: Avoid out-of-bounds access (git-fixes).
- perf pmu: Fix a potential memory leak in perf_pmu__lookup()
  (git-fixes).
- perf print-events: make is_event_supported() more robust
  (git-fixes).
- perf list: fix short description for some cache events
  (git-fixes).
- perf metric: Don't remove scale from counts (git-fixes).
- perf stat: Avoid metric-only segv (git-fixes).
- perf expr: Fix "has_event" function for metric style events
  (git-fixes).
- perf srcline: Add missed addr2line closes (git-fixes).
- perf thread_map: Free strlist on normal path in
  thread_map__new_by_tid_str() (git-fixes).
- perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
- perf jevents: Drop or simplify small integer values (git-fixes).
- perf evsel: Fix duplicate initialization of data-&gt;id in
  evsel__parse_sample() (git-fixes).
- perf pmu: Treat the msr pmu as software (git-fixes).
- perf record: Check conflict between '--timestamp-filename'
  option and pipe mode before recording (git-fixes).
- perf record: Fix possible incorrect free in
  record__switch_output() (git-fixes).
- perf vendor events amd: Add Zen 4 memory controller events
  (git-fixes).
- perf top: Uniform the event name for the hybrid machine
  (git-fixes).
- perf top: Use evsel's cpus to replace user_requested_cpus
  (git-fixes).
- commit a1f9340</changelog>
  <changelog author="tonyj@suse.de" date="1717675200">- perf ui browser: Avoid SEGV on title (git fixes).
- commit 1578c22</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675201">- inet: inet_defrag: prevent sk release while still in use
  (CVE-2024-26921 bsc#1223138).
- commit 2016faf</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1717675202">- net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
- commit 7bf5961</changelog>
  <changelog author="tiwai@suse.de" date="1718366400">- Temporarily drop KVM patch that caused a regression (bsc#1226158)
  Delete patches.suse/KVM-x86-pmu-Prioritize-VMX-interception-over-GP-on-R.patch
- commit 33f31da</changelog>
</package>
<package pkgid="ea49fa700bdff101708ebdf6e062485d4c1d864f1e069101b9498f22174f4972" name="dwz" arch="aarch64">
  <version epoch="0" ver="0.12" rel="150000.3.8.1"/>
  <changelog author="pth@suse.de" date="1340798400">- Initial package</changelog>
  <changelog author="jengelh@inai.de" date="1418212800">- Update to new upstream version 0.11
  * fix iterative hashing on big-endian targets
  * optimize DW_FORM_data[48] DW_AT_high_pc that GCC 4.8 produces
  * fix up handling of DIE equality if more than one DIE in the same
  CU compare equal
  * check DW_FORM_ref_addr properly during fi_multifile phase
  * when creating DW_AT_stmt_list, use DW_FORM_sec_offset for dwarf4
  and DW_FORM_data4 for dwarf[23] rather than vice versa
  * handle .gdb_index version 7 and 8</changelog>
  <changelog author="rguenther@suse.com" date="1480420800">- Update to new upstream version 0.12
  * Fix up alignment of non-allocated sections and section header table
  after sections which have changed size.</changelog>
  <changelog author="rguenther@suse.com" date="1487678400">- Add dwz-0.12-ignore-nobits.patch to ignore SHT_NOBITS sections
  that are placed out-of-order by objcopy when extracting debuginfo
  and place them at sh_offset zero.</changelog>
  <changelog author="rguenther@suse.com" date="1488888000">- Adjust dwz-0.12-ignore-nobits.patch to also handle non-monotonically
  increasing sh_offset as created by the kernel linker script.</changelog>
  <changelog author="tdevries@suse.com" date="1710936000">- Add dwz-0.12-clean-up-temporary-file-in-hardlink-mode.patch to
  cleanup left-over temporary file (swo#24275, bsc#1221634).
- Replace "%doc COPYING" with "%license COPYING".</changelog>
</package>
<package pkgid="476fe2e69bf1e5daf8579666da044d45bd225b8232bd67bbfa3a3e2438f3d5fa" name="dwz" arch="ppc64le">
  <version epoch="0" ver="0.12" rel="150000.3.8.1"/>
  <changelog author="pth@suse.de" date="1340798400">- Initial package</changelog>
  <changelog author="jengelh@inai.de" date="1418212800">- Update to new upstream version 0.11
  * fix iterative hashing on big-endian targets
  * optimize DW_FORM_data[48] DW_AT_high_pc that GCC 4.8 produces
  * fix up handling of DIE equality if more than one DIE in the same
  CU compare equal
  * check DW_FORM_ref_addr properly during fi_multifile phase
  * when creating DW_AT_stmt_list, use DW_FORM_sec_offset for dwarf4
  and DW_FORM_data4 for dwarf[23] rather than vice versa
  * handle .gdb_index version 7 and 8</changelog>
  <changelog author="rguenther@suse.com" date="1480420800">- Update to new upstream version 0.12
  * Fix up alignment of non-allocated sections and section header table
  after sections which have changed size.</changelog>
  <changelog author="rguenther@suse.com" date="1487678400">- Add dwz-0.12-ignore-nobits.patch to ignore SHT_NOBITS sections
  that are placed out-of-order by objcopy when extracting debuginfo
  and place them at sh_offset zero.</changelog>
  <changelog author="rguenther@suse.com" date="1488888000">- Adjust dwz-0.12-ignore-nobits.patch to also handle non-monotonically
  increasing sh_offset as created by the kernel linker script.</changelog>
  <changelog author="tdevries@suse.com" date="1710936000">- Add dwz-0.12-clean-up-temporary-file-in-hardlink-mode.patch to
  cleanup left-over temporary file (swo#24275, bsc#1221634).
- Replace "%doc COPYING" with "%license COPYING".</changelog>
</package>
<package pkgid="bb99970fc1aa0c6d40487fe7dbde2de0d53ba26bd64ea2cc9322db37923712ef" name="dwz" arch="s390x">
  <version epoch="0" ver="0.12" rel="150000.3.8.1"/>
  <changelog author="pth@suse.de" date="1340798400">- Initial package</changelog>
  <changelog author="jengelh@inai.de" date="1418212800">- Update to new upstream version 0.11
  * fix iterative hashing on big-endian targets
  * optimize DW_FORM_data[48] DW_AT_high_pc that GCC 4.8 produces
  * fix up handling of DIE equality if more than one DIE in the same
  CU compare equal
  * check DW_FORM_ref_addr properly during fi_multifile phase
  * when creating DW_AT_stmt_list, use DW_FORM_sec_offset for dwarf4
  and DW_FORM_data4 for dwarf[23] rather than vice versa
  * handle .gdb_index version 7 and 8</changelog>
  <changelog author="rguenther@suse.com" date="1480420800">- Update to new upstream version 0.12
  * Fix up alignment of non-allocated sections and section header table
  after sections which have changed size.</changelog>
  <changelog author="rguenther@suse.com" date="1487678400">- Add dwz-0.12-ignore-nobits.patch to ignore SHT_NOBITS sections
  that are placed out-of-order by objcopy when extracting debuginfo
  and place them at sh_offset zero.</changelog>
  <changelog author="rguenther@suse.com" date="1488888000">- Adjust dwz-0.12-ignore-nobits.patch to also handle non-monotonically
  increasing sh_offset as created by the kernel linker script.</changelog>
  <changelog author="tdevries@suse.com" date="1710936000">- Add dwz-0.12-clean-up-temporary-file-in-hardlink-mode.patch to
  cleanup left-over temporary file (swo#24275, bsc#1221634).
- Replace "%doc COPYING" with "%license COPYING".</changelog>
</package>
<package pkgid="8afb33f48e338af3e383fb73d8b251d109f782477c3ce5f16db223a3b2771c0c" name="dwz" arch="src">
  <version epoch="0" ver="0.12" rel="150000.3.8.1"/>
  <changelog author="pth@suse.de" date="1340798400">- Initial package</changelog>
  <changelog author="jengelh@inai.de" date="1418212800">- Update to new upstream version 0.11
  * fix iterative hashing on big-endian targets
  * optimize DW_FORM_data[48] DW_AT_high_pc that GCC 4.8 produces
  * fix up handling of DIE equality if more than one DIE in the same
  CU compare equal
  * check DW_FORM_ref_addr properly during fi_multifile phase
  * when creating DW_AT_stmt_list, use DW_FORM_sec_offset for dwarf4
  and DW_FORM_data4 for dwarf[23] rather than vice versa
  * handle .gdb_index version 7 and 8</changelog>
  <changelog author="rguenther@suse.com" date="1480420800">- Update to new upstream version 0.12
  * Fix up alignment of non-allocated sections and section header table
  after sections which have changed size.</changelog>
  <changelog author="rguenther@suse.com" date="1487678400">- Add dwz-0.12-ignore-nobits.patch to ignore SHT_NOBITS sections
  that are placed out-of-order by objcopy when extracting debuginfo
  and place them at sh_offset zero.</changelog>
  <changelog author="rguenther@suse.com" date="1488888000">- Adjust dwz-0.12-ignore-nobits.patch to also handle non-monotonically
  increasing sh_offset as created by the kernel linker script.</changelog>
  <changelog author="tdevries@suse.com" date="1710936000">- Add dwz-0.12-clean-up-temporary-file-in-hardlink-mode.patch to
  cleanup left-over temporary file (swo#24275, bsc#1221634).
- Replace "%doc COPYING" with "%license COPYING".</changelog>
</package>
<package pkgid="2275abd9d4af34208b5a4a2eaef22840a79f87f16c4d164d88046cad05e1876d" name="dwz" arch="x86_64">
  <version epoch="0" ver="0.12" rel="150000.3.8.1"/>
  <changelog author="pth@suse.de" date="1340798400">- Initial package</changelog>
  <changelog author="jengelh@inai.de" date="1418212800">- Update to new upstream version 0.11
  * fix iterative hashing on big-endian targets
  * optimize DW_FORM_data[48] DW_AT_high_pc that GCC 4.8 produces
  * fix up handling of DIE equality if more than one DIE in the same
  CU compare equal
  * check DW_FORM_ref_addr properly during fi_multifile phase
  * when creating DW_AT_stmt_list, use DW_FORM_sec_offset for dwarf4
  and DW_FORM_data4 for dwarf[23] rather than vice versa
  * handle .gdb_index version 7 and 8</changelog>
  <changelog author="rguenther@suse.com" date="1480420800">- Update to new upstream version 0.12
  * Fix up alignment of non-allocated sections and section header table
  after sections which have changed size.</changelog>
  <changelog author="rguenther@suse.com" date="1487678400">- Add dwz-0.12-ignore-nobits.patch to ignore SHT_NOBITS sections
  that are placed out-of-order by objcopy when extracting debuginfo
  and place them at sh_offset zero.</changelog>
  <changelog author="rguenther@suse.com" date="1488888000">- Adjust dwz-0.12-ignore-nobits.patch to also handle non-monotonically
  increasing sh_offset as created by the kernel linker script.</changelog>
  <changelog author="tdevries@suse.com" date="1710936000">- Add dwz-0.12-clean-up-temporary-file-in-hardlink-mode.patch to
  cleanup left-over temporary file (swo#24275, bsc#1221634).
- Replace "%doc COPYING" with "%license COPYING".</changelog>
</package>
<package pkgid="d64d02e0818ffe58c60adc53069aaee74335b368988fa1bd95f229a7e87e4211" name="e2fsprogs" arch="aarch64">
  <version epoch="0" ver="1.47.0" rel="150600.4.3.2"/>
  <changelog author="jack@suse.cz" date="1613649600">- Remove autoreconf (and resulting dependencies) from the spec file. The
  upstream configure script should be fine.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1615723200">- e2fsprogs 1.46.2:
  * tune2fs -c now takes "random" argument
  * Add support for the FS_NOCOMP_FL flag to chattr and lsattr
  * Fix warnings when resizing small file systems to a super-large
  * Fix the debugfs rdump and ls commands so they will work correctly
    for uid's and gid's =&gt; 65536
  * Fix the debugfs write and symlink commands so they support
    targets which contain a pathname
  * Fix Direct I/O support on block devices where the logical block
    size is greater 1k
  * Fix debugfs's logdump so it works on file systems whose block
    size is greater than 8k
  * Fix a crash when there is error while e2fsck is trying to open
    the file system, and e2fsck calls ext2fs_mmp_stop() before MMP
    has been initialized
  * Improved error checking in the fast commit replay code in e2fsck
  * Fix various compiler and Coverity warnings
  * Update the Spanish translation from the translation project</changelog>
  <changelog author="christophe@krop.fr" date="1622635200">- Fix the %doc files. RELEASE-NOTES is a symlink to
  doc/RelNotes/v%version.</changelog>
  <changelog author="jack@suse.cz" date="1627905600">- Update to 1.46.3:
  * Add -V and -VV options to filefrag
  * Fix fs corruption cause by resize2fs on filesystems with MMP blocks
  * Fast commit portability fixes
  * Fix direct IO support in Unix IO manager
  * Avoid calling EXT2_IOC_[GS]ETFLAGS for block devices
  * Fix mke2fs to not discard blocks beyond end of filesystem
  * Make e2fsck set filetype of '.' and '..' entries
  * Fix QCOW image generation in e2image for very large filesystems
  * Update translations</changelog>
  <changelog author="jsegitz@suse.com" date="1631620800">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_e2scrub@.service.patch
  * harden_e2scrub_all.service.patch
  * harden_e2scrub_fail@.service.patch
  * harden_e2scrub_reap.service.patch</changelog>
  <changelog author="jack@suse.cz" date="1631707200">- Update to 1.46.4:
  * Default to 256-byte inodes for all filesystems, not only larger ones
  * Bigalloc is considered supported now for small cluster sizes
  * E2fsck and e2image fixes for quota feature
  * Fix mke2fs creation of filesystem into non-existent file
- libss-add-newer-libreadline.so.8-to-dlopen-path.patch: libss: add newer
  libreadline.so.8 to dlopen path (bsc#1189453)</changelog>
  <changelog author="jack@suse.cz" date="1633003200">- quota-Add-support-to-version-0-quota-format.patch: quota: Add support to
    version 0 quota format (jsc#SLE-17360)
  quota-Fold-quota_read_all_dquots-into-quota_update_l.patch: quota: Fold
    quota_read_all_dquots() into quota_update_limits() (jsc#SLE-17360)
  quota-Rename-quota_update_limits-to-quota_read_all_d.patch: quota: Rename
    quota_update_limits() to quota_read_all_dquots() (jsc#SLE-17360)
  tune2fs-Fix-conversion-of-quota-files.patch: tune2fs: Fix conversion of quota
    files (jsc#SLE-17360)
  e2fsck-Do-not-trash-user-limits-when-processing-orph.patch: e2fsck: Do not
    trash user limits when processing orphan list (jsc#SLE-17360)
  debugfs-Fix-headers-for-quota-commands.patch: debugfs: Fix headers for quota
    commands (jsc#SLE-17360)
  quota-Drop-dead-code.patch: quota: Drop dead code (jsc#SLE-17360)
- add these not yet released fixes to e2fsprogs package so that SLE15-SP4 ships
  with them</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="jack@suse.cz" date="1643371200">- Update to 1.46.5:
  * better handling for resizing to fs sizes which would exceed inode limits
  * fix crash in e2fsck fastcommit handling
  * fix possibly lost quota limits when e2fsck corrects quota files
  * fix tune2fs to properly transfer quota limits when convertion quota files
  * add support for handling of version 0 quota files in tune2fs
  * teach libss to use libreadline.so.8
  * optimize resize2fs cpu usage for large filesystems
  * teach libuuid to use getrandom() or getentropy() if available
- libss-add-newer-libreadline.so.8-to-dlopen-path.patch: Remove, merged upstream
- quota-Add-support-to-version-0-quota-format.patch: Remove, merged upstream
- quota-Fold-quota_read_all_dquots-into-quota_update_l.patch: Remove, merged upstream
- quota-Rename-quota_update_limits-to-quota_read_all_d.patch: Remove, merged upstream
- tune2fs-Fix-conversion-of-quota-files.patch: Remove, merged upstream
- e2fsck-Do-not-trash-user-limits-when-processing-orph.patch: Remove, merged upstream
- debugfs-Fix-headers-for-quota-commands.patch: Remove, merged upstream
- quota-Drop-dead-code.patch: Remove, merged upstream</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- avoid empty preuninstall script</changelog>
  <changelog author="cgoll@suse.com" date="1663070400">- enabled fuse2fs build which enable to mount ext2/3/4 via FUSE</changelog>
  <changelog author="dimstar@opensuse.org" date="1663156800">- Spec file cleanup:
  + Drop remainders regarding -mini packages, which was not a thing
    since Jan 2014.
  + Split build of fuse2fs out into a sep build (_multibuild
    enabled).</changelog>
  <changelog author="dimstar@opensuse.org" date="1663243200">- Refresh e2fsprogs.keyring based on currently provided keys.</changelog>
  <changelog author="lnussel@suse.com" date="1672142400">- Replace transitional %usrmerged macro with regular version check (boo#1206798)</changelog>
  <changelog author="info@paolostivanin.com" date="1675857600">- Update to 1.47.0:
  * Add support for the orphan_file feature, which speeds up workloads
    that are deleting or truncating a large number files in parallel.
    This compat feature was first supported in the v5.15 Linux kernel.
  * The mke2fs program (via the mke2fs.conf file) now enables the
    metadata_csum_seed and orphan_file features by default.
    The metadata_csum_seed feature is an incompat feature which is
    first supported in the Linux kernel starting in the 4.4 kernel.
  * Mke2fs now supports the extended option "assume_storage_prezeroed"
    which causes mke2fs to skip zeroing the journal and inode tables
    and to mark the inode tables as zeroed.
  * Add support to tune2fs and e2label to set the label and UUID for
    a mounted file system using a ioctl, which is more reliable than
    modifying the superblock via writing to the block device.
    The kernel support for setting the label landed in v5.17, while
    the support for adding the UUID landed in v6.0. If the ioctls
    are not supported, tune2fs and e2label will fall back old
    strategy of directly modifying the superblock.
  * Allow tune2fs to disable the casefold feature after scanning all
    of the directories do not have the Casefold flag set.</changelog>
  <changelog author="jack@suse.cz" date="1696420800">- Update specfile to make sure regenerate_initrd_post macro is defined</changelog>
  <changelog author="jack@suse.cz" date="1698840000">- mke2fs-Drop-metadata_csum_seed-and-orphan_file-from-.patch: Update
  mke2fs.conf to create filesystems only with features supported
  by tools in SLE15-SP4/5 by default.</changelog>
  <changelog author="jack@suse.cz" date="1700654400">- libext2fs-add-sanity-check-to-extent-manipulation.patch: Merged upstream
  in 1.46.6
- References to old bugs fixed by updating to latest upstream version:
  CVE-2015-0247 CVE-2015-1572 CVE-2019-5094 CVE-2019-5188 CVE-2022-1304
  bsc#1009532 bsc#1038194 bsc#1128383 bsc#1145716 bsc#1152101 bsc#1154295
  bsc#1160571 bsc#1160979 bsc#1170964 bsc#1183791 bsc#1198446 bsc#915402
  bsc#918346 bsc#960273</changelog>
  <changelog author="jack@suse.cz" date="1705320000">- e2fsck-Suppress-orphan-file-is-clean-message-in-preen.patch: e2fsck: Suppress
  "orphan file is clean" message in preen mode (bsc#1218747)</changelog>
  <changelog author="jack@suse.cz" date="1717675200">- EA Inode handling fixes:
  - e2fsck-add-more-checks-for-ea-inode-consistency.patch: e2fsck: add more
    checks for ea inode consistency (bsc#1223596)
  - e2fsck-fix-golden-output-of-several-tests.patch: e2fsck: fix golden output
    of several tests (bsc#1223596)</changelog>
</package>
<package pkgid="d7717b3b2a683286b8eab5e389e1875b849d18dbe85bff66481f7c829068c2d1" name="e2fsprogs" arch="ppc64le">
  <version epoch="0" ver="1.47.0" rel="150600.4.3.2"/>
  <changelog author="jack@suse.cz" date="1613649600">- Remove autoreconf (and resulting dependencies) from the spec file. The
  upstream configure script should be fine.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1615723200">- e2fsprogs 1.46.2:
  * tune2fs -c now takes "random" argument
  * Add support for the FS_NOCOMP_FL flag to chattr and lsattr
  * Fix warnings when resizing small file systems to a super-large
  * Fix the debugfs rdump and ls commands so they will work correctly
    for uid's and gid's =&gt; 65536
  * Fix the debugfs write and symlink commands so they support
    targets which contain a pathname
  * Fix Direct I/O support on block devices where the logical block
    size is greater 1k
  * Fix debugfs's logdump so it works on file systems whose block
    size is greater than 8k
  * Fix a crash when there is error while e2fsck is trying to open
    the file system, and e2fsck calls ext2fs_mmp_stop() before MMP
    has been initialized
  * Improved error checking in the fast commit replay code in e2fsck
  * Fix various compiler and Coverity warnings
  * Update the Spanish translation from the translation project</changelog>
  <changelog author="christophe@krop.fr" date="1622635200">- Fix the %doc files. RELEASE-NOTES is a symlink to
  doc/RelNotes/v%version.</changelog>
  <changelog author="jack@suse.cz" date="1627905600">- Update to 1.46.3:
  * Add -V and -VV options to filefrag
  * Fix fs corruption cause by resize2fs on filesystems with MMP blocks
  * Fast commit portability fixes
  * Fix direct IO support in Unix IO manager
  * Avoid calling EXT2_IOC_[GS]ETFLAGS for block devices
  * Fix mke2fs to not discard blocks beyond end of filesystem
  * Make e2fsck set filetype of '.' and '..' entries
  * Fix QCOW image generation in e2image for very large filesystems
  * Update translations</changelog>
  <changelog author="jsegitz@suse.com" date="1631620800">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_e2scrub@.service.patch
  * harden_e2scrub_all.service.patch
  * harden_e2scrub_fail@.service.patch
  * harden_e2scrub_reap.service.patch</changelog>
  <changelog author="jack@suse.cz" date="1631707200">- Update to 1.46.4:
  * Default to 256-byte inodes for all filesystems, not only larger ones
  * Bigalloc is considered supported now for small cluster sizes
  * E2fsck and e2image fixes for quota feature
  * Fix mke2fs creation of filesystem into non-existent file
- libss-add-newer-libreadline.so.8-to-dlopen-path.patch: libss: add newer
  libreadline.so.8 to dlopen path (bsc#1189453)</changelog>
  <changelog author="jack@suse.cz" date="1633003200">- quota-Add-support-to-version-0-quota-format.patch: quota: Add support to
    version 0 quota format (jsc#SLE-17360)
  quota-Fold-quota_read_all_dquots-into-quota_update_l.patch: quota: Fold
    quota_read_all_dquots() into quota_update_limits() (jsc#SLE-17360)
  quota-Rename-quota_update_limits-to-quota_read_all_d.patch: quota: Rename
    quota_update_limits() to quota_read_all_dquots() (jsc#SLE-17360)
  tune2fs-Fix-conversion-of-quota-files.patch: tune2fs: Fix conversion of quota
    files (jsc#SLE-17360)
  e2fsck-Do-not-trash-user-limits-when-processing-orph.patch: e2fsck: Do not
    trash user limits when processing orphan list (jsc#SLE-17360)
  debugfs-Fix-headers-for-quota-commands.patch: debugfs: Fix headers for quota
    commands (jsc#SLE-17360)
  quota-Drop-dead-code.patch: quota: Drop dead code (jsc#SLE-17360)
- add these not yet released fixes to e2fsprogs package so that SLE15-SP4 ships
  with them</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="jack@suse.cz" date="1643371200">- Update to 1.46.5:
  * better handling for resizing to fs sizes which would exceed inode limits
  * fix crash in e2fsck fastcommit handling
  * fix possibly lost quota limits when e2fsck corrects quota files
  * fix tune2fs to properly transfer quota limits when convertion quota files
  * add support for handling of version 0 quota files in tune2fs
  * teach libss to use libreadline.so.8
  * optimize resize2fs cpu usage for large filesystems
  * teach libuuid to use getrandom() or getentropy() if available
- libss-add-newer-libreadline.so.8-to-dlopen-path.patch: Remove, merged upstream
- quota-Add-support-to-version-0-quota-format.patch: Remove, merged upstream
- quota-Fold-quota_read_all_dquots-into-quota_update_l.patch: Remove, merged upstream
- quota-Rename-quota_update_limits-to-quota_read_all_d.patch: Remove, merged upstream
- tune2fs-Fix-conversion-of-quota-files.patch: Remove, merged upstream
- e2fsck-Do-not-trash-user-limits-when-processing-orph.patch: Remove, merged upstream
- debugfs-Fix-headers-for-quota-commands.patch: Remove, merged upstream
- quota-Drop-dead-code.patch: Remove, merged upstream</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- avoid empty preuninstall script</changelog>
  <changelog author="cgoll@suse.com" date="1663070400">- enabled fuse2fs build which enable to mount ext2/3/4 via FUSE</changelog>
  <changelog author="dimstar@opensuse.org" date="1663156800">- Spec file cleanup:
  + Drop remainders regarding -mini packages, which was not a thing
    since Jan 2014.
  + Split build of fuse2fs out into a sep build (_multibuild
    enabled).</changelog>
  <changelog author="dimstar@opensuse.org" date="1663243200">- Refresh e2fsprogs.keyring based on currently provided keys.</changelog>
  <changelog author="lnussel@suse.com" date="1672142400">- Replace transitional %usrmerged macro with regular version check (boo#1206798)</changelog>
  <changelog author="info@paolostivanin.com" date="1675857600">- Update to 1.47.0:
  * Add support for the orphan_file feature, which speeds up workloads
    that are deleting or truncating a large number files in parallel.
    This compat feature was first supported in the v5.15 Linux kernel.
  * The mke2fs program (via the mke2fs.conf file) now enables the
    metadata_csum_seed and orphan_file features by default.
    The metadata_csum_seed feature is an incompat feature which is
    first supported in the Linux kernel starting in the 4.4 kernel.
  * Mke2fs now supports the extended option "assume_storage_prezeroed"
    which causes mke2fs to skip zeroing the journal and inode tables
    and to mark the inode tables as zeroed.
  * Add support to tune2fs and e2label to set the label and UUID for
    a mounted file system using a ioctl, which is more reliable than
    modifying the superblock via writing to the block device.
    The kernel support for setting the label landed in v5.17, while
    the support for adding the UUID landed in v6.0. If the ioctls
    are not supported, tune2fs and e2label will fall back old
    strategy of directly modifying the superblock.
  * Allow tune2fs to disable the casefold feature after scanning all
    of the directories do not have the Casefold flag set.</changelog>
  <changelog author="jack@suse.cz" date="1696420800">- Update specfile to make sure regenerate_initrd_post macro is defined</changelog>
  <changelog author="jack@suse.cz" date="1698840000">- mke2fs-Drop-metadata_csum_seed-and-orphan_file-from-.patch: Update
  mke2fs.conf to create filesystems only with features supported
  by tools in SLE15-SP4/5 by default.</changelog>
  <changelog author="jack@suse.cz" date="1700654400">- libext2fs-add-sanity-check-to-extent-manipulation.patch: Merged upstream
  in 1.46.6
- References to old bugs fixed by updating to latest upstream version:
  CVE-2015-0247 CVE-2015-1572 CVE-2019-5094 CVE-2019-5188 CVE-2022-1304
  bsc#1009532 bsc#1038194 bsc#1128383 bsc#1145716 bsc#1152101 bsc#1154295
  bsc#1160571 bsc#1160979 bsc#1170964 bsc#1183791 bsc#1198446 bsc#915402
  bsc#918346 bsc#960273</changelog>
  <changelog author="jack@suse.cz" date="1705320000">- e2fsck-Suppress-orphan-file-is-clean-message-in-preen.patch: e2fsck: Suppress
  "orphan file is clean" message in preen mode (bsc#1218747)</changelog>
  <changelog author="jack@suse.cz" date="1717675200">- EA Inode handling fixes:
  - e2fsck-add-more-checks-for-ea-inode-consistency.patch: e2fsck: add more
    checks for ea inode consistency (bsc#1223596)
  - e2fsck-fix-golden-output-of-several-tests.patch: e2fsck: fix golden output
    of several tests (bsc#1223596)</changelog>
</package>
<package pkgid="9fe69236ac5d40e75114c1b453f15e1ca237ff89e46d7e162766be0ebde88ff5" name="e2fsprogs" arch="s390x">
  <version epoch="0" ver="1.47.0" rel="150600.4.3.2"/>
  <changelog author="jack@suse.cz" date="1613649600">- Remove autoreconf (and resulting dependencies) from the spec file. The
  upstream configure script should be fine.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1615723200">- e2fsprogs 1.46.2:
  * tune2fs -c now takes "random" argument
  * Add support for the FS_NOCOMP_FL flag to chattr and lsattr
  * Fix warnings when resizing small file systems to a super-large
  * Fix the debugfs rdump and ls commands so they will work correctly
    for uid's and gid's =&gt; 65536
  * Fix the debugfs write and symlink commands so they support
    targets which contain a pathname
  * Fix Direct I/O support on block devices where the logical block
    size is greater 1k
  * Fix debugfs's logdump so it works on file systems whose block
    size is greater than 8k
  * Fix a crash when there is error while e2fsck is trying to open
    the file system, and e2fsck calls ext2fs_mmp_stop() before MMP
    has been initialized
  * Improved error checking in the fast commit replay code in e2fsck
  * Fix various compiler and Coverity warnings
  * Update the Spanish translation from the translation project</changelog>
  <changelog author="christophe@krop.fr" date="1622635200">- Fix the %doc files. RELEASE-NOTES is a symlink to
  doc/RelNotes/v%version.</changelog>
  <changelog author="jack@suse.cz" date="1627905600">- Update to 1.46.3:
  * Add -V and -VV options to filefrag
  * Fix fs corruption cause by resize2fs on filesystems with MMP blocks
  * Fast commit portability fixes
  * Fix direct IO support in Unix IO manager
  * Avoid calling EXT2_IOC_[GS]ETFLAGS for block devices
  * Fix mke2fs to not discard blocks beyond end of filesystem
  * Make e2fsck set filetype of '.' and '..' entries
  * Fix QCOW image generation in e2image for very large filesystems
  * Update translations</changelog>
  <changelog author="jsegitz@suse.com" date="1631620800">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_e2scrub@.service.patch
  * harden_e2scrub_all.service.patch
  * harden_e2scrub_fail@.service.patch
  * harden_e2scrub_reap.service.patch</changelog>
  <changelog author="jack@suse.cz" date="1631707200">- Update to 1.46.4:
  * Default to 256-byte inodes for all filesystems, not only larger ones
  * Bigalloc is considered supported now for small cluster sizes
  * E2fsck and e2image fixes for quota feature
  * Fix mke2fs creation of filesystem into non-existent file
- libss-add-newer-libreadline.so.8-to-dlopen-path.patch: libss: add newer
  libreadline.so.8 to dlopen path (bsc#1189453)</changelog>
  <changelog author="jack@suse.cz" date="1633003200">- quota-Add-support-to-version-0-quota-format.patch: quota: Add support to
    version 0 quota format (jsc#SLE-17360)
  quota-Fold-quota_read_all_dquots-into-quota_update_l.patch: quota: Fold
    quota_read_all_dquots() into quota_update_limits() (jsc#SLE-17360)
  quota-Rename-quota_update_limits-to-quota_read_all_d.patch: quota: Rename
    quota_update_limits() to quota_read_all_dquots() (jsc#SLE-17360)
  tune2fs-Fix-conversion-of-quota-files.patch: tune2fs: Fix conversion of quota
    files (jsc#SLE-17360)
  e2fsck-Do-not-trash-user-limits-when-processing-orph.patch: e2fsck: Do not
    trash user limits when processing orphan list (jsc#SLE-17360)
  debugfs-Fix-headers-for-quota-commands.patch: debugfs: Fix headers for quota
    commands (jsc#SLE-17360)
  quota-Drop-dead-code.patch: quota: Drop dead code (jsc#SLE-17360)
- add these not yet released fixes to e2fsprogs package so that SLE15-SP4 ships
  with them</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="jack@suse.cz" date="1643371200">- Update to 1.46.5:
  * better handling for resizing to fs sizes which would exceed inode limits
  * fix crash in e2fsck fastcommit handling
  * fix possibly lost quota limits when e2fsck corrects quota files
  * fix tune2fs to properly transfer quota limits when convertion quota files
  * add support for handling of version 0 quota files in tune2fs
  * teach libss to use libreadline.so.8
  * optimize resize2fs cpu usage for large filesystems
  * teach libuuid to use getrandom() or getentropy() if available
- libss-add-newer-libreadline.so.8-to-dlopen-path.patch: Remove, merged upstream
- quota-Add-support-to-version-0-quota-format.patch: Remove, merged upstream
- quota-Fold-quota_read_all_dquots-into-quota_update_l.patch: Remove, merged upstream
- quota-Rename-quota_update_limits-to-quota_read_all_d.patch: Remove, merged upstream
- tune2fs-Fix-conversion-of-quota-files.patch: Remove, merged upstream
- e2fsck-Do-not-trash-user-limits-when-processing-orph.patch: Remove, merged upstream
- debugfs-Fix-headers-for-quota-commands.patch: Remove, merged upstream
- quota-Drop-dead-code.patch: Remove, merged upstream</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- avoid empty preuninstall script</changelog>
  <changelog author="cgoll@suse.com" date="1663070400">- enabled fuse2fs build which enable to mount ext2/3/4 via FUSE</changelog>
  <changelog author="dimstar@opensuse.org" date="1663156800">- Spec file cleanup:
  + Drop remainders regarding -mini packages, which was not a thing
    since Jan 2014.
  + Split build of fuse2fs out into a sep build (_multibuild
    enabled).</changelog>
  <changelog author="dimstar@opensuse.org" date="1663243200">- Refresh e2fsprogs.keyring based on currently provided keys.</changelog>
  <changelog author="lnussel@suse.com" date="1672142400">- Replace transitional %usrmerged macro with regular version check (boo#1206798)</changelog>
  <changelog author="info@paolostivanin.com" date="1675857600">- Update to 1.47.0:
  * Add support for the orphan_file feature, which speeds up workloads
    that are deleting or truncating a large number files in parallel.
    This compat feature was first supported in the v5.15 Linux kernel.
  * The mke2fs program (via the mke2fs.conf file) now enables the
    metadata_csum_seed and orphan_file features by default.
    The metadata_csum_seed feature is an incompat feature which is
    first supported in the Linux kernel starting in the 4.4 kernel.
  * Mke2fs now supports the extended option "assume_storage_prezeroed"
    which causes mke2fs to skip zeroing the journal and inode tables
    and to mark the inode tables as zeroed.
  * Add support to tune2fs and e2label to set the label and UUID for
    a mounted file system using a ioctl, which is more reliable than
    modifying the superblock via writing to the block device.
    The kernel support for setting the label landed in v5.17, while
    the support for adding the UUID landed in v6.0. If the ioctls
    are not supported, tune2fs and e2label will fall back old
    strategy of directly modifying the superblock.
  * Allow tune2fs to disable the casefold feature after scanning all
    of the directories do not have the Casefold flag set.</changelog>
  <changelog author="jack@suse.cz" date="1696420800">- Update specfile to make sure regenerate_initrd_post macro is defined</changelog>
  <changelog author="jack@suse.cz" date="1698840000">- mke2fs-Drop-metadata_csum_seed-and-orphan_file-from-.patch: Update
  mke2fs.conf to create filesystems only with features supported
  by tools in SLE15-SP4/5 by default.</changelog>
  <changelog author="jack@suse.cz" date="1700654400">- libext2fs-add-sanity-check-to-extent-manipulation.patch: Merged upstream
  in 1.46.6
- References to old bugs fixed by updating to latest upstream version:
  CVE-2015-0247 CVE-2015-1572 CVE-2019-5094 CVE-2019-5188 CVE-2022-1304
  bsc#1009532 bsc#1038194 bsc#1128383 bsc#1145716 bsc#1152101 bsc#1154295
  bsc#1160571 bsc#1160979 bsc#1170964 bsc#1183791 bsc#1198446 bsc#915402
  bsc#918346 bsc#960273</changelog>
  <changelog author="jack@suse.cz" date="1705320000">- e2fsck-Suppress-orphan-file-is-clean-message-in-preen.patch: e2fsck: Suppress
  "orphan file is clean" message in preen mode (bsc#1218747)</changelog>
  <changelog author="jack@suse.cz" date="1717675200">- EA Inode handling fixes:
  - e2fsck-add-more-checks-for-ea-inode-consistency.patch: e2fsck: add more
    checks for ea inode consistency (bsc#1223596)
  - e2fsck-fix-golden-output-of-several-tests.patch: e2fsck: fix golden output
    of several tests (bsc#1223596)</changelog>
</package>
<package pkgid="c7593dd02b8cffa2fdc4f002472127347b972632fb3f9d5f2dbb75b3c32faa0d" name="e2fsprogs" arch="src">
  <version epoch="0" ver="1.47.0" rel="150600.4.3.2"/>
  <changelog author="jack@suse.cz" date="1613649600">- Remove autoreconf (and resulting dependencies) from the spec file. The
  upstream configure script should be fine.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1615723200">- e2fsprogs 1.46.2:
  * tune2fs -c now takes "random" argument
  * Add support for the FS_NOCOMP_FL flag to chattr and lsattr
  * Fix warnings when resizing small file systems to a super-large
  * Fix the debugfs rdump and ls commands so they will work correctly
    for uid's and gid's =&gt; 65536
  * Fix the debugfs write and symlink commands so they support
    targets which contain a pathname
  * Fix Direct I/O support on block devices where the logical block
    size is greater 1k
  * Fix debugfs's logdump so it works on file systems whose block
    size is greater than 8k
  * Fix a crash when there is error while e2fsck is trying to open
    the file system, and e2fsck calls ext2fs_mmp_stop() before MMP
    has been initialized
  * Improved error checking in the fast commit replay code in e2fsck
  * Fix various compiler and Coverity warnings
  * Update the Spanish translation from the translation project</changelog>
  <changelog author="christophe@krop.fr" date="1622635200">- Fix the %doc files. RELEASE-NOTES is a symlink to
  doc/RelNotes/v%version.</changelog>
  <changelog author="jack@suse.cz" date="1627905600">- Update to 1.46.3:
  * Add -V and -VV options to filefrag
  * Fix fs corruption cause by resize2fs on filesystems with MMP blocks
  * Fast commit portability fixes
  * Fix direct IO support in Unix IO manager
  * Avoid calling EXT2_IOC_[GS]ETFLAGS for block devices
  * Fix mke2fs to not discard blocks beyond end of filesystem
  * Make e2fsck set filetype of '.' and '..' entries
  * Fix QCOW image generation in e2image for very large filesystems
  * Update translations</changelog>
  <changelog author="jsegitz@suse.com" date="1631620800">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_e2scrub@.service.patch
  * harden_e2scrub_all.service.patch
  * harden_e2scrub_fail@.service.patch
  * harden_e2scrub_reap.service.patch</changelog>
  <changelog author="jack@suse.cz" date="1631707200">- Update to 1.46.4:
  * Default to 256-byte inodes for all filesystems, not only larger ones
  * Bigalloc is considered supported now for small cluster sizes
  * E2fsck and e2image fixes for quota feature
  * Fix mke2fs creation of filesystem into non-existent file
- libss-add-newer-libreadline.so.8-to-dlopen-path.patch: libss: add newer
  libreadline.so.8 to dlopen path (bsc#1189453)</changelog>
  <changelog author="jack@suse.cz" date="1633003200">- quota-Add-support-to-version-0-quota-format.patch: quota: Add support to
    version 0 quota format (jsc#SLE-17360)
  quota-Fold-quota_read_all_dquots-into-quota_update_l.patch: quota: Fold
    quota_read_all_dquots() into quota_update_limits() (jsc#SLE-17360)
  quota-Rename-quota_update_limits-to-quota_read_all_d.patch: quota: Rename
    quota_update_limits() to quota_read_all_dquots() (jsc#SLE-17360)
  tune2fs-Fix-conversion-of-quota-files.patch: tune2fs: Fix conversion of quota
    files (jsc#SLE-17360)
  e2fsck-Do-not-trash-user-limits-when-processing-orph.patch: e2fsck: Do not
    trash user limits when processing orphan list (jsc#SLE-17360)
  debugfs-Fix-headers-for-quota-commands.patch: debugfs: Fix headers for quota
    commands (jsc#SLE-17360)
  quota-Drop-dead-code.patch: quota: Drop dead code (jsc#SLE-17360)
- add these not yet released fixes to e2fsprogs package so that SLE15-SP4 ships
  with them</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="jack@suse.cz" date="1643371200">- Update to 1.46.5:
  * better handling for resizing to fs sizes which would exceed inode limits
  * fix crash in e2fsck fastcommit handling
  * fix possibly lost quota limits when e2fsck corrects quota files
  * fix tune2fs to properly transfer quota limits when convertion quota files
  * add support for handling of version 0 quota files in tune2fs
  * teach libss to use libreadline.so.8
  * optimize resize2fs cpu usage for large filesystems
  * teach libuuid to use getrandom() or getentropy() if available
- libss-add-newer-libreadline.so.8-to-dlopen-path.patch: Remove, merged upstream
- quota-Add-support-to-version-0-quota-format.patch: Remove, merged upstream
- quota-Fold-quota_read_all_dquots-into-quota_update_l.patch: Remove, merged upstream
- quota-Rename-quota_update_limits-to-quota_read_all_d.patch: Remove, merged upstream
- tune2fs-Fix-conversion-of-quota-files.patch: Remove, merged upstream
- e2fsck-Do-not-trash-user-limits-when-processing-orph.patch: Remove, merged upstream
- debugfs-Fix-headers-for-quota-commands.patch: Remove, merged upstream
- quota-Drop-dead-code.patch: Remove, merged upstream</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- avoid empty preuninstall script</changelog>
  <changelog author="cgoll@suse.com" date="1663070400">- enabled fuse2fs build which enable to mount ext2/3/4 via FUSE</changelog>
  <changelog author="dimstar@opensuse.org" date="1663156800">- Spec file cleanup:
  + Drop remainders regarding -mini packages, which was not a thing
    since Jan 2014.
  + Split build of fuse2fs out into a sep build (_multibuild
    enabled).</changelog>
  <changelog author="dimstar@opensuse.org" date="1663243200">- Refresh e2fsprogs.keyring based on currently provided keys.</changelog>
  <changelog author="lnussel@suse.com" date="1672142400">- Replace transitional %usrmerged macro with regular version check (boo#1206798)</changelog>
  <changelog author="info@paolostivanin.com" date="1675857600">- Update to 1.47.0:
  * Add support for the orphan_file feature, which speeds up workloads
    that are deleting or truncating a large number files in parallel.
    This compat feature was first supported in the v5.15 Linux kernel.
  * The mke2fs program (via the mke2fs.conf file) now enables the
    metadata_csum_seed and orphan_file features by default.
    The metadata_csum_seed feature is an incompat feature which is
    first supported in the Linux kernel starting in the 4.4 kernel.
  * Mke2fs now supports the extended option "assume_storage_prezeroed"
    which causes mke2fs to skip zeroing the journal and inode tables
    and to mark the inode tables as zeroed.
  * Add support to tune2fs and e2label to set the label and UUID for
    a mounted file system using a ioctl, which is more reliable than
    modifying the superblock via writing to the block device.
    The kernel support for setting the label landed in v5.17, while
    the support for adding the UUID landed in v6.0. If the ioctls
    are not supported, tune2fs and e2label will fall back old
    strategy of directly modifying the superblock.
  * Allow tune2fs to disable the casefold feature after scanning all
    of the directories do not have the Casefold flag set.</changelog>
  <changelog author="jack@suse.cz" date="1696420800">- Update specfile to make sure regenerate_initrd_post macro is defined</changelog>
  <changelog author="jack@suse.cz" date="1698840000">- mke2fs-Drop-metadata_csum_seed-and-orphan_file-from-.patch: Update
  mke2fs.conf to create filesystems only with features supported
  by tools in SLE15-SP4/5 by default.</changelog>
  <changelog author="jack@suse.cz" date="1700654400">- libext2fs-add-sanity-check-to-extent-manipulation.patch: Merged upstream
  in 1.46.6
- References to old bugs fixed by updating to latest upstream version:
  CVE-2015-0247 CVE-2015-1572 CVE-2019-5094 CVE-2019-5188 CVE-2022-1304
  bsc#1009532 bsc#1038194 bsc#1128383 bsc#1145716 bsc#1152101 bsc#1154295
  bsc#1160571 bsc#1160979 bsc#1170964 bsc#1183791 bsc#1198446 bsc#915402
  bsc#918346 bsc#960273</changelog>
  <changelog author="jack@suse.cz" date="1705320000">- e2fsck-Suppress-orphan-file-is-clean-message-in-preen.patch: e2fsck: Suppress
  "orphan file is clean" message in preen mode (bsc#1218747)</changelog>
  <changelog author="jack@suse.cz" date="1717675200">- EA Inode handling fixes:
  - e2fsck-add-more-checks-for-ea-inode-consistency.patch: e2fsck: add more
    checks for ea inode consistency (bsc#1223596)
  - e2fsck-fix-golden-output-of-several-tests.patch: e2fsck: fix golden output
    of several tests (bsc#1223596)</changelog>
</package>
<package pkgid="4ec4422569ad3a0a27100883c0acb8fd6b7e28122d3030aa8c0c632058ad4f44" name="e2fsprogs" arch="x86_64">
  <version epoch="0" ver="1.47.0" rel="150600.4.3.2"/>
  <changelog author="jack@suse.cz" date="1613649600">- Remove autoreconf (and resulting dependencies) from the spec file. The
  upstream configure script should be fine.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1615723200">- e2fsprogs 1.46.2:
  * tune2fs -c now takes "random" argument
  * Add support for the FS_NOCOMP_FL flag to chattr and lsattr
  * Fix warnings when resizing small file systems to a super-large
  * Fix the debugfs rdump and ls commands so they will work correctly
    for uid's and gid's =&gt; 65536
  * Fix the debugfs write and symlink commands so they support
    targets which contain a pathname
  * Fix Direct I/O support on block devices where the logical block
    size is greater 1k
  * Fix debugfs's logdump so it works on file systems whose block
    size is greater than 8k
  * Fix a crash when there is error while e2fsck is trying to open
    the file system, and e2fsck calls ext2fs_mmp_stop() before MMP
    has been initialized
  * Improved error checking in the fast commit replay code in e2fsck
  * Fix various compiler and Coverity warnings
  * Update the Spanish translation from the translation project</changelog>
  <changelog author="christophe@krop.fr" date="1622635200">- Fix the %doc files. RELEASE-NOTES is a symlink to
  doc/RelNotes/v%version.</changelog>
  <changelog author="jack@suse.cz" date="1627905600">- Update to 1.46.3:
  * Add -V and -VV options to filefrag
  * Fix fs corruption cause by resize2fs on filesystems with MMP blocks
  * Fast commit portability fixes
  * Fix direct IO support in Unix IO manager
  * Avoid calling EXT2_IOC_[GS]ETFLAGS for block devices
  * Fix mke2fs to not discard blocks beyond end of filesystem
  * Make e2fsck set filetype of '.' and '..' entries
  * Fix QCOW image generation in e2image for very large filesystems
  * Update translations</changelog>
  <changelog author="jsegitz@suse.com" date="1631620800">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_e2scrub@.service.patch
  * harden_e2scrub_all.service.patch
  * harden_e2scrub_fail@.service.patch
  * harden_e2scrub_reap.service.patch</changelog>
  <changelog author="jack@suse.cz" date="1631707200">- Update to 1.46.4:
  * Default to 256-byte inodes for all filesystems, not only larger ones
  * Bigalloc is considered supported now for small cluster sizes
  * E2fsck and e2image fixes for quota feature
  * Fix mke2fs creation of filesystem into non-existent file
- libss-add-newer-libreadline.so.8-to-dlopen-path.patch: libss: add newer
  libreadline.so.8 to dlopen path (bsc#1189453)</changelog>
  <changelog author="jack@suse.cz" date="1633003200">- quota-Add-support-to-version-0-quota-format.patch: quota: Add support to
    version 0 quota format (jsc#SLE-17360)
  quota-Fold-quota_read_all_dquots-into-quota_update_l.patch: quota: Fold
    quota_read_all_dquots() into quota_update_limits() (jsc#SLE-17360)
  quota-Rename-quota_update_limits-to-quota_read_all_d.patch: quota: Rename
    quota_update_limits() to quota_read_all_dquots() (jsc#SLE-17360)
  tune2fs-Fix-conversion-of-quota-files.patch: tune2fs: Fix conversion of quota
    files (jsc#SLE-17360)
  e2fsck-Do-not-trash-user-limits-when-processing-orph.patch: e2fsck: Do not
    trash user limits when processing orphan list (jsc#SLE-17360)
  debugfs-Fix-headers-for-quota-commands.patch: debugfs: Fix headers for quota
    commands (jsc#SLE-17360)
  quota-Drop-dead-code.patch: quota: Drop dead code (jsc#SLE-17360)
- add these not yet released fixes to e2fsprogs package so that SLE15-SP4 ships
  with them</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="jack@suse.cz" date="1643371200">- Update to 1.46.5:
  * better handling for resizing to fs sizes which would exceed inode limits
  * fix crash in e2fsck fastcommit handling
  * fix possibly lost quota limits when e2fsck corrects quota files
  * fix tune2fs to properly transfer quota limits when convertion quota files
  * add support for handling of version 0 quota files in tune2fs
  * teach libss to use libreadline.so.8
  * optimize resize2fs cpu usage for large filesystems
  * teach libuuid to use getrandom() or getentropy() if available
- libss-add-newer-libreadline.so.8-to-dlopen-path.patch: Remove, merged upstream
- quota-Add-support-to-version-0-quota-format.patch: Remove, merged upstream
- quota-Fold-quota_read_all_dquots-into-quota_update_l.patch: Remove, merged upstream
- quota-Rename-quota_update_limits-to-quota_read_all_d.patch: Remove, merged upstream
- tune2fs-Fix-conversion-of-quota-files.patch: Remove, merged upstream
- e2fsck-Do-not-trash-user-limits-when-processing-orph.patch: Remove, merged upstream
- debugfs-Fix-headers-for-quota-commands.patch: Remove, merged upstream
- quota-Drop-dead-code.patch: Remove, merged upstream</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- avoid empty preuninstall script</changelog>
  <changelog author="cgoll@suse.com" date="1663070400">- enabled fuse2fs build which enable to mount ext2/3/4 via FUSE</changelog>
  <changelog author="dimstar@opensuse.org" date="1663156800">- Spec file cleanup:
  + Drop remainders regarding -mini packages, which was not a thing
    since Jan 2014.
  + Split build of fuse2fs out into a sep build (_multibuild
    enabled).</changelog>
  <changelog author="dimstar@opensuse.org" date="1663243200">- Refresh e2fsprogs.keyring based on currently provided keys.</changelog>
  <changelog author="lnussel@suse.com" date="1672142400">- Replace transitional %usrmerged macro with regular version check (boo#1206798)</changelog>
  <changelog author="info@paolostivanin.com" date="1675857600">- Update to 1.47.0:
  * Add support for the orphan_file feature, which speeds up workloads
    that are deleting or truncating a large number files in parallel.
    This compat feature was first supported in the v5.15 Linux kernel.
  * The mke2fs program (via the mke2fs.conf file) now enables the
    metadata_csum_seed and orphan_file features by default.
    The metadata_csum_seed feature is an incompat feature which is
    first supported in the Linux kernel starting in the 4.4 kernel.
  * Mke2fs now supports the extended option "assume_storage_prezeroed"
    which causes mke2fs to skip zeroing the journal and inode tables
    and to mark the inode tables as zeroed.
  * Add support to tune2fs and e2label to set the label and UUID for
    a mounted file system using a ioctl, which is more reliable than
    modifying the superblock via writing to the block device.
    The kernel support for setting the label landed in v5.17, while
    the support for adding the UUID landed in v6.0. If the ioctls
    are not supported, tune2fs and e2label will fall back old
    strategy of directly modifying the superblock.
  * Allow tune2fs to disable the casefold feature after scanning all
    of the directories do not have the Casefold flag set.</changelog>
  <changelog author="jack@suse.cz" date="1696420800">- Update specfile to make sure regenerate_initrd_post macro is defined</changelog>
  <changelog author="jack@suse.cz" date="1698840000">- mke2fs-Drop-metadata_csum_seed-and-orphan_file-from-.patch: Update
  mke2fs.conf to create filesystems only with features supported
  by tools in SLE15-SP4/5 by default.</changelog>
  <changelog author="jack@suse.cz" date="1700654400">- libext2fs-add-sanity-check-to-extent-manipulation.patch: Merged upstream
  in 1.46.6
- References to old bugs fixed by updating to latest upstream version:
  CVE-2015-0247 CVE-2015-1572 CVE-2019-5094 CVE-2019-5188 CVE-2022-1304
  bsc#1009532 bsc#1038194 bsc#1128383 bsc#1145716 bsc#1152101 bsc#1154295
  bsc#1160571 bsc#1160979 bsc#1170964 bsc#1183791 bsc#1198446 bsc#915402
  bsc#918346 bsc#960273</changelog>
  <changelog author="jack@suse.cz" date="1705320000">- e2fsck-Suppress-orphan-file-is-clean-message-in-preen.patch: e2fsck: Suppress
  "orphan file is clean" message in preen mode (bsc#1218747)</changelog>
  <changelog author="jack@suse.cz" date="1717675200">- EA Inode handling fixes:
  - e2fsck-add-more-checks-for-ea-inode-consistency.patch: e2fsck: add more
    checks for ea inode consistency (bsc#1223596)
  - e2fsck-fix-golden-output-of-several-tests.patch: e2fsck: fix golden output
    of several tests (bsc#1223596)</changelog>
</package>
<package pkgid="a2a5564ab3e566f7e4ff12236e5633e42792f99dd6bb0d7d63ed6ad6ee6d9203" name="e2fsprogs-devel" arch="aarch64">
  <version epoch="0" ver="1.47.0" rel="150600.4.3.2"/>
  <changelog author="jack@suse.cz" date="1613649600">- Remove autoreconf (and resulting dependencies) from the spec file. The
  upstream configure script should be fine.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1615723200">- e2fsprogs 1.46.2:
  * tune2fs -c now takes "random" argument
  * Add support for the FS_NOCOMP_FL flag to chattr and lsattr
  * Fix warnings when resizing small file systems to a super-large
  * Fix the debugfs rdump and ls commands so they will work correctly
    for uid's and gid's =&gt; 65536
  * Fix the debugfs write and symlink commands so they support
    targets which contain a pathname
  * Fix Direct I/O support on block devices where the logical block
    size is greater 1k
  * Fix debugfs's logdump so it works on file systems whose block
    size is greater than 8k
  * Fix a crash when there is error while e2fsck is trying to open
    the file system, and e2fsck calls ext2fs_mmp_stop() before MMP
    has been initialized
  * Improved error checking in the fast commit replay code in e2fsck
  * Fix various compiler and Coverity warnings
  * Update the Spanish translation from the translation project</changelog>
  <changelog author="christophe@krop.fr" date="1622635200">- Fix the %doc files. RELEASE-NOTES is a symlink to
  doc/RelNotes/v%version.</changelog>
  <changelog author="jack@suse.cz" date="1627905600">- Update to 1.46.3:
  * Add -V and -VV options to filefrag
  * Fix fs corruption cause by resize2fs on filesystems with MMP blocks
  * Fast commit portability fixes
  * Fix direct IO support in Unix IO manager
  * Avoid calling EXT2_IOC_[GS]ETFLAGS for block devices
  * Fix mke2fs to not discard blocks beyond end of filesystem
  * Make e2fsck set filetype of '.' and '..' entries
  * Fix QCOW image generation in e2image for very large filesystems
  * Update translations</changelog>
  <changelog author="jsegitz@suse.com" date="1631620800">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_e2scrub@.service.patch
  * harden_e2scrub_all.service.patch
  * harden_e2scrub_fail@.service.patch
  * harden_e2scrub_reap.service.patch</changelog>
  <changelog author="jack@suse.cz" date="1631707200">- Update to 1.46.4:
  * Default to 256-byte inodes for all filesystems, not only larger ones
  * Bigalloc is considered supported now for small cluster sizes
  * E2fsck and e2image fixes for quota feature
  * Fix mke2fs creation of filesystem into non-existent file
- libss-add-newer-libreadline.so.8-to-dlopen-path.patch: libss: add newer
  libreadline.so.8 to dlopen path (bsc#1189453)</changelog>
  <changelog author="jack@suse.cz" date="1633003200">- quota-Add-support-to-version-0-quota-format.patch: quota: Add support to
    version 0 quota format (jsc#SLE-17360)
  quota-Fold-quota_read_all_dquots-into-quota_update_l.patch: quota: Fold
    quota_read_all_dquots() into quota_update_limits() (jsc#SLE-17360)
  quota-Rename-quota_update_limits-to-quota_read_all_d.patch: quota: Rename
    quota_update_limits() to quota_read_all_dquots() (jsc#SLE-17360)
  tune2fs-Fix-conversion-of-quota-files.patch: tune2fs: Fix conversion of quota
    files (jsc#SLE-17360)
  e2fsck-Do-not-trash-user-limits-when-processing-orph.patch: e2fsck: Do not
    trash user limits when processing orphan list (jsc#SLE-17360)
  debugfs-Fix-headers-for-quota-commands.patch: debugfs: Fix headers for quota
    commands (jsc#SLE-17360)
  quota-Drop-dead-code.patch: quota: Drop dead code (jsc#SLE-17360)
- add these not yet released fixes to e2fsprogs package so that SLE15-SP4 ships
  with them</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="jack@suse.cz" date="1643371200">- Update to 1.46.5:
  * better handling for resizing to fs sizes which would exceed inode limits
  * fix crash in e2fsck fastcommit handling
  * fix possibly lost quota limits when e2fsck corrects quota files
  * fix tune2fs to properly transfer quota limits when convertion quota files
  * add support for handling of version 0 quota files in tune2fs
  * teach libss to use libreadline.so.8
  * optimize resize2fs cpu usage for large filesystems
  * teach libuuid to use getrandom() or getentropy() if available
- libss-add-newer-libreadline.so.8-to-dlopen-path.patch: Remove, merged upstream
- quota-Add-support-to-version-0-quota-format.patch: Remove, merged upstream
- quota-Fold-quota_read_all_dquots-into-quota_update_l.patch: Remove, merged upstream
- quota-Rename-quota_update_limits-to-quota_read_all_d.patch: Remove, merged upstream
- tune2fs-Fix-conversion-of-quota-files.patch: Remove, merged upstream
- e2fsck-Do-not-trash-user-limits-when-processing-orph.patch: Remove, merged upstream
- debugfs-Fix-headers-for-quota-commands.patch: Remove, merged upstream
- quota-Drop-dead-code.patch: Remove, merged upstream</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- avoid empty preuninstall script</changelog>
  <changelog author="cgoll@suse.com" date="1663070400">- enabled fuse2fs build which enable to mount ext2/3/4 via FUSE</changelog>
  <changelog author="dimstar@opensuse.org" date="1663156800">- Spec file cleanup:
  + Drop remainders regarding -mini packages, which was not a thing
    since Jan 2014.
  + Split build of fuse2fs out into a sep build (_multibuild
    enabled).</changelog>
  <changelog author="dimstar@opensuse.org" date="1663243200">- Refresh e2fsprogs.keyring based on currently provided keys.</changelog>
  <changelog author="lnussel@suse.com" date="1672142400">- Replace transitional %usrmerged macro with regular version check (boo#1206798)</changelog>
  <changelog author="info@paolostivanin.com" date="1675857600">- Update to 1.47.0:
  * Add support for the orphan_file feature, which speeds up workloads
    that are deleting or truncating a large number files in parallel.
    This compat feature was first supported in the v5.15 Linux kernel.
  * The mke2fs program (via the mke2fs.conf file) now enables the
    metadata_csum_seed and orphan_file features by default.
    The metadata_csum_seed feature is an incompat feature which is
    first supported in the Linux kernel starting in the 4.4 kernel.
  * Mke2fs now supports the extended option "assume_storage_prezeroed"
    which causes mke2fs to skip zeroing the journal and inode tables
    and to mark the inode tables as zeroed.
  * Add support to tune2fs and e2label to set the label and UUID for
    a mounted file system using a ioctl, which is more reliable than
    modifying the superblock via writing to the block device.
    The kernel support for setting the label landed in v5.17, while
    the support for adding the UUID landed in v6.0. If the ioctls
    are not supported, tune2fs and e2label will fall back old
    strategy of directly modifying the superblock.
  * Allow tune2fs to disable the casefold feature after scanning all
    of the directories do not have the Casefold flag set.</changelog>
  <changelog author="jack@suse.cz" date="1696420800">- Update specfile to make sure regenerate_initrd_post macro is defined</changelog>
  <changelog author="jack@suse.cz" date="1698840000">- mke2fs-Drop-metadata_csum_seed-and-orphan_file-from-.patch: Update
  mke2fs.conf to create filesystems only with features supported
  by tools in SLE15-SP4/5 by default.</changelog>
  <changelog author="jack@suse.cz" date="1700654400">- libext2fs-add-sanity-check-to-extent-manipulation.patch: Merged upstream
  in 1.46.6
- References to old bugs fixed by updating to latest upstream version:
  CVE-2015-0247 CVE-2015-1572 CVE-2019-5094 CVE-2019-5188 CVE-2022-1304
  bsc#1009532 bsc#1038194 bsc#1128383 bsc#1145716 bsc#1152101 bsc#1154295
  bsc#1160571 bsc#1160979 bsc#1170964 bsc#1183791 bsc#1198446 bsc#915402
  bsc#918346 bsc#960273</changelog>
  <changelog author="jack@suse.cz" date="1705320000">- e2fsck-Suppress-orphan-file-is-clean-message-in-preen.patch: e2fsck: Suppress
  "orphan file is clean" message in preen mode (bsc#1218747)</changelog>
  <changelog author="jack@suse.cz" date="1717675200">- EA Inode handling fixes:
  - e2fsck-add-more-checks-for-ea-inode-consistency.patch: e2fsck: add more
    checks for ea inode consistency (bsc#1223596)
  - e2fsck-fix-golden-output-of-several-tests.patch: e2fsck: fix golden output
    of several tests (bsc#1223596)</changelog>
</package>
<package pkgid="fed34032649cd36b76b344e90d556f82813ff78e65a51b8e04509b650aeb723e" name="e2fsprogs-devel" arch="ppc64le">
  <version epoch="0" ver="1.47.0" rel="150600.4.3.2"/>
  <changelog author="jack@suse.cz" date="1613649600">- Remove autoreconf (and resulting dependencies) from the spec file. The
  upstream configure script should be fine.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1615723200">- e2fsprogs 1.46.2:
  * tune2fs -c now takes "random" argument
  * Add support for the FS_NOCOMP_FL flag to chattr and lsattr
  * Fix warnings when resizing small file systems to a super-large
  * Fix the debugfs rdump and ls commands so they will work correctly
    for uid's and gid's =&gt; 65536
  * Fix the debugfs write and symlink commands so they support
    targets which contain a pathname
  * Fix Direct I/O support on block devices where the logical block
    size is greater 1k
  * Fix debugfs's logdump so it works on file systems whose block
    size is greater than 8k
  * Fix a crash when there is error while e2fsck is trying to open
    the file system, and e2fsck calls ext2fs_mmp_stop() before MMP
    has been initialized
  * Improved error checking in the fast commit replay code in e2fsck
  * Fix various compiler and Coverity warnings
  * Update the Spanish translation from the translation project</changelog>
  <changelog author="christophe@krop.fr" date="1622635200">- Fix the %doc files. RELEASE-NOTES is a symlink to
  doc/RelNotes/v%version.</changelog>
  <changelog author="jack@suse.cz" date="1627905600">- Update to 1.46.3:
  * Add -V and -VV options to filefrag
  * Fix fs corruption cause by resize2fs on filesystems with MMP blocks
  * Fast commit portability fixes
  * Fix direct IO support in Unix IO manager
  * Avoid calling EXT2_IOC_[GS]ETFLAGS for block devices
  * Fix mke2fs to not discard blocks beyond end of filesystem
  * Make e2fsck set filetype of '.' and '..' entries
  * Fix QCOW image generation in e2image for very large filesystems
  * Update translations</changelog>
  <changelog author="jsegitz@suse.com" date="1631620800">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_e2scrub@.service.patch
  * harden_e2scrub_all.service.patch
  * harden_e2scrub_fail@.service.patch
  * harden_e2scrub_reap.service.patch</changelog>
  <changelog author="jack@suse.cz" date="1631707200">- Update to 1.46.4:
  * Default to 256-byte inodes for all filesystems, not only larger ones
  * Bigalloc is considered supported now for small cluster sizes
  * E2fsck and e2image fixes for quota feature
  * Fix mke2fs creation of filesystem into non-existent file
- libss-add-newer-libreadline.so.8-to-dlopen-path.patch: libss: add newer
  libreadline.so.8 to dlopen path (bsc#1189453)</changelog>
  <changelog author="jack@suse.cz" date="1633003200">- quota-Add-support-to-version-0-quota-format.patch: quota: Add support to
    version 0 quota format (jsc#SLE-17360)
  quota-Fold-quota_read_all_dquots-into-quota_update_l.patch: quota: Fold
    quota_read_all_dquots() into quota_update_limits() (jsc#SLE-17360)
  quota-Rename-quota_update_limits-to-quota_read_all_d.patch: quota: Rename
    quota_update_limits() to quota_read_all_dquots() (jsc#SLE-17360)
  tune2fs-Fix-conversion-of-quota-files.patch: tune2fs: Fix conversion of quota
    files (jsc#SLE-17360)
  e2fsck-Do-not-trash-user-limits-when-processing-orph.patch: e2fsck: Do not
    trash user limits when processing orphan list (jsc#SLE-17360)
  debugfs-Fix-headers-for-quota-commands.patch: debugfs: Fix headers for quota
    commands (jsc#SLE-17360)
  quota-Drop-dead-code.patch: quota: Drop dead code (jsc#SLE-17360)
- add these not yet released fixes to e2fsprogs package so that SLE15-SP4 ships
  with them</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="jack@suse.cz" date="1643371200">- Update to 1.46.5:
  * better handling for resizing to fs sizes which would exceed inode limits
  * fix crash in e2fsck fastcommit handling
  * fix possibly lost quota limits when e2fsck corrects quota files
  * fix tune2fs to properly transfer quota limits when convertion quota files
  * add support for handling of version 0 quota files in tune2fs
  * teach libss to use libreadline.so.8
  * optimize resize2fs cpu usage for large filesystems
  * teach libuuid to use getrandom() or getentropy() if available
- libss-add-newer-libreadline.so.8-to-dlopen-path.patch: Remove, merged upstream
- quota-Add-support-to-version-0-quota-format.patch: Remove, merged upstream
- quota-Fold-quota_read_all_dquots-into-quota_update_l.patch: Remove, merged upstream
- quota-Rename-quota_update_limits-to-quota_read_all_d.patch: Remove, merged upstream
- tune2fs-Fix-conversion-of-quota-files.patch: Remove, merged upstream
- e2fsck-Do-not-trash-user-limits-when-processing-orph.patch: Remove, merged upstream
- debugfs-Fix-headers-for-quota-commands.patch: Remove, merged upstream
- quota-Drop-dead-code.patch: Remove, merged upstream</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- avoid empty preuninstall script</changelog>
  <changelog author="cgoll@suse.com" date="1663070400">- enabled fuse2fs build which enable to mount ext2/3/4 via FUSE</changelog>
  <changelog author="dimstar@opensuse.org" date="1663156800">- Spec file cleanup:
  + Drop remainders regarding -mini packages, which was not a thing
    since Jan 2014.
  + Split build of fuse2fs out into a sep build (_multibuild
    enabled).</changelog>
  <changelog author="dimstar@opensuse.org" date="1663243200">- Refresh e2fsprogs.keyring based on currently provided keys.</changelog>
  <changelog author="lnussel@suse.com" date="1672142400">- Replace transitional %usrmerged macro with regular version check (boo#1206798)</changelog>
  <changelog author="info@paolostivanin.com" date="1675857600">- Update to 1.47.0:
  * Add support for the orphan_file feature, which speeds up workloads
    that are deleting or truncating a large number files in parallel.
    This compat feature was first supported in the v5.15 Linux kernel.
  * The mke2fs program (via the mke2fs.conf file) now enables the
    metadata_csum_seed and orphan_file features by default.
    The metadata_csum_seed feature is an incompat feature which is
    first supported in the Linux kernel starting in the 4.4 kernel.
  * Mke2fs now supports the extended option "assume_storage_prezeroed"
    which causes mke2fs to skip zeroing the journal and inode tables
    and to mark the inode tables as zeroed.
  * Add support to tune2fs and e2label to set the label and UUID for
    a mounted file system using a ioctl, which is more reliable than
    modifying the superblock via writing to the block device.
    The kernel support for setting the label landed in v5.17, while
    the support for adding the UUID landed in v6.0. If the ioctls
    are not supported, tune2fs and e2label will fall back old
    strategy of directly modifying the superblock.
  * Allow tune2fs to disable the casefold feature after scanning all
    of the directories do not have the Casefold flag set.</changelog>
  <changelog author="jack@suse.cz" date="1696420800">- Update specfile to make sure regenerate_initrd_post macro is defined</changelog>
  <changelog author="jack@suse.cz" date="1698840000">- mke2fs-Drop-metadata_csum_seed-and-orphan_file-from-.patch: Update
  mke2fs.conf to create filesystems only with features supported
  by tools in SLE15-SP4/5 by default.</changelog>
  <changelog author="jack@suse.cz" date="1700654400">- libext2fs-add-sanity-check-to-extent-manipulation.patch: Merged upstream
  in 1.46.6
- References to old bugs fixed by updating to latest upstream version:
  CVE-2015-0247 CVE-2015-1572 CVE-2019-5094 CVE-2019-5188 CVE-2022-1304
  bsc#1009532 bsc#1038194 bsc#1128383 bsc#1145716 bsc#1152101 bsc#1154295
  bsc#1160571 bsc#1160979 bsc#1170964 bsc#1183791 bsc#1198446 bsc#915402
  bsc#918346 bsc#960273</changelog>
  <changelog author="jack@suse.cz" date="1705320000">- e2fsck-Suppress-orphan-file-is-clean-message-in-preen.patch: e2fsck: Suppress
  "orphan file is clean" message in preen mode (bsc#1218747)</changelog>
  <changelog author="jack@suse.cz" date="1717675200">- EA Inode handling fixes:
  - e2fsck-add-more-checks-for-ea-inode-consistency.patch: e2fsck: add more
    checks for ea inode consistency (bsc#1223596)
  - e2fsck-fix-golden-output-of-several-tests.patch: e2fsck: fix golden output
    of several tests (bsc#1223596)</changelog>
</package>
<package pkgid="684c32214dc62b6abc8a5d2c26f6c07bc0554cd47a75a06ff80e79de1ffaeec5" name="e2fsprogs-devel" arch="s390x">
  <version epoch="0" ver="1.47.0" rel="150600.4.3.2"/>
  <changelog author="jack@suse.cz" date="1613649600">- Remove autoreconf (and resulting dependencies) from the spec file. The
  upstream configure script should be fine.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1615723200">- e2fsprogs 1.46.2:
  * tune2fs -c now takes "random" argument
  * Add support for the FS_NOCOMP_FL flag to chattr and lsattr
  * Fix warnings when resizing small file systems to a super-large
  * Fix the debugfs rdump and ls commands so they will work correctly
    for uid's and gid's =&gt; 65536
  * Fix the debugfs write and symlink commands so they support
    targets which contain a pathname
  * Fix Direct I/O support on block devices where the logical block
    size is greater 1k
  * Fix debugfs's logdump so it works on file systems whose block
    size is greater than 8k
  * Fix a crash when there is error while e2fsck is trying to open
    the file system, and e2fsck calls ext2fs_mmp_stop() before MMP
    has been initialized
  * Improved error checking in the fast commit replay code in e2fsck
  * Fix various compiler and Coverity warnings
  * Update the Spanish translation from the translation project</changelog>
  <changelog author="christophe@krop.fr" date="1622635200">- Fix the %doc files. RELEASE-NOTES is a symlink to
  doc/RelNotes/v%version.</changelog>
  <changelog author="jack@suse.cz" date="1627905600">- Update to 1.46.3:
  * Add -V and -VV options to filefrag
  * Fix fs corruption cause by resize2fs on filesystems with MMP blocks
  * Fast commit portability fixes
  * Fix direct IO support in Unix IO manager
  * Avoid calling EXT2_IOC_[GS]ETFLAGS for block devices
  * Fix mke2fs to not discard blocks beyond end of filesystem
  * Make e2fsck set filetype of '.' and '..' entries
  * Fix QCOW image generation in e2image for very large filesystems
  * Update translations</changelog>
  <changelog author="jsegitz@suse.com" date="1631620800">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_e2scrub@.service.patch
  * harden_e2scrub_all.service.patch
  * harden_e2scrub_fail@.service.patch
  * harden_e2scrub_reap.service.patch</changelog>
  <changelog author="jack@suse.cz" date="1631707200">- Update to 1.46.4:
  * Default to 256-byte inodes for all filesystems, not only larger ones
  * Bigalloc is considered supported now for small cluster sizes
  * E2fsck and e2image fixes for quota feature
  * Fix mke2fs creation of filesystem into non-existent file
- libss-add-newer-libreadline.so.8-to-dlopen-path.patch: libss: add newer
  libreadline.so.8 to dlopen path (bsc#1189453)</changelog>
  <changelog author="jack@suse.cz" date="1633003200">- quota-Add-support-to-version-0-quota-format.patch: quota: Add support to
    version 0 quota format (jsc#SLE-17360)
  quota-Fold-quota_read_all_dquots-into-quota_update_l.patch: quota: Fold
    quota_read_all_dquots() into quota_update_limits() (jsc#SLE-17360)
  quota-Rename-quota_update_limits-to-quota_read_all_d.patch: quota: Rename
    quota_update_limits() to quota_read_all_dquots() (jsc#SLE-17360)
  tune2fs-Fix-conversion-of-quota-files.patch: tune2fs: Fix conversion of quota
    files (jsc#SLE-17360)
  e2fsck-Do-not-trash-user-limits-when-processing-orph.patch: e2fsck: Do not
    trash user limits when processing orphan list (jsc#SLE-17360)
  debugfs-Fix-headers-for-quota-commands.patch: debugfs: Fix headers for quota
    commands (jsc#SLE-17360)
  quota-Drop-dead-code.patch: quota: Drop dead code (jsc#SLE-17360)
- add these not yet released fixes to e2fsprogs package so that SLE15-SP4 ships
  with them</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="jack@suse.cz" date="1643371200">- Update to 1.46.5:
  * better handling for resizing to fs sizes which would exceed inode limits
  * fix crash in e2fsck fastcommit handling
  * fix possibly lost quota limits when e2fsck corrects quota files
  * fix tune2fs to properly transfer quota limits when convertion quota files
  * add support for handling of version 0 quota files in tune2fs
  * teach libss to use libreadline.so.8
  * optimize resize2fs cpu usage for large filesystems
  * teach libuuid to use getrandom() or getentropy() if available
- libss-add-newer-libreadline.so.8-to-dlopen-path.patch: Remove, merged upstream
- quota-Add-support-to-version-0-quota-format.patch: Remove, merged upstream
- quota-Fold-quota_read_all_dquots-into-quota_update_l.patch: Remove, merged upstream
- quota-Rename-quota_update_limits-to-quota_read_all_d.patch: Remove, merged upstream
- tune2fs-Fix-conversion-of-quota-files.patch: Remove, merged upstream
- e2fsck-Do-not-trash-user-limits-when-processing-orph.patch: Remove, merged upstream
- debugfs-Fix-headers-for-quota-commands.patch: Remove, merged upstream
- quota-Drop-dead-code.patch: Remove, merged upstream</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- avoid empty preuninstall script</changelog>
  <changelog author="cgoll@suse.com" date="1663070400">- enabled fuse2fs build which enable to mount ext2/3/4 via FUSE</changelog>
  <changelog author="dimstar@opensuse.org" date="1663156800">- Spec file cleanup:
  + Drop remainders regarding -mini packages, which was not a thing
    since Jan 2014.
  + Split build of fuse2fs out into a sep build (_multibuild
    enabled).</changelog>
  <changelog author="dimstar@opensuse.org" date="1663243200">- Refresh e2fsprogs.keyring based on currently provided keys.</changelog>
  <changelog author="lnussel@suse.com" date="1672142400">- Replace transitional %usrmerged macro with regular version check (boo#1206798)</changelog>
  <changelog author="info@paolostivanin.com" date="1675857600">- Update to 1.47.0:
  * Add support for the orphan_file feature, which speeds up workloads
    that are deleting or truncating a large number files in parallel.
    This compat feature was first supported in the v5.15 Linux kernel.
  * The mke2fs program (via the mke2fs.conf file) now enables the
    metadata_csum_seed and orphan_file features by default.
    The metadata_csum_seed feature is an incompat feature which is
    first supported in the Linux kernel starting in the 4.4 kernel.
  * Mke2fs now supports the extended option "assume_storage_prezeroed"
    which causes mke2fs to skip zeroing the journal and inode tables
    and to mark the inode tables as zeroed.
  * Add support to tune2fs and e2label to set the label and UUID for
    a mounted file system using a ioctl, which is more reliable than
    modifying the superblock via writing to the block device.
    The kernel support for setting the label landed in v5.17, while
    the support for adding the UUID landed in v6.0. If the ioctls
    are not supported, tune2fs and e2label will fall back old
    strategy of directly modifying the superblock.
  * Allow tune2fs to disable the casefold feature after scanning all
    of the directories do not have the Casefold flag set.</changelog>
  <changelog author="jack@suse.cz" date="1696420800">- Update specfile to make sure regenerate_initrd_post macro is defined</changelog>
  <changelog author="jack@suse.cz" date="1698840000">- mke2fs-Drop-metadata_csum_seed-and-orphan_file-from-.patch: Update
  mke2fs.conf to create filesystems only with features supported
  by tools in SLE15-SP4/5 by default.</changelog>
  <changelog author="jack@suse.cz" date="1700654400">- libext2fs-add-sanity-check-to-extent-manipulation.patch: Merged upstream
  in 1.46.6
- References to old bugs fixed by updating to latest upstream version:
  CVE-2015-0247 CVE-2015-1572 CVE-2019-5094 CVE-2019-5188 CVE-2022-1304
  bsc#1009532 bsc#1038194 bsc#1128383 bsc#1145716 bsc#1152101 bsc#1154295
  bsc#1160571 bsc#1160979 bsc#1170964 bsc#1183791 bsc#1198446 bsc#915402
  bsc#918346 bsc#960273</changelog>
  <changelog author="jack@suse.cz" date="1705320000">- e2fsck-Suppress-orphan-file-is-clean-message-in-preen.patch: e2fsck: Suppress
  "orphan file is clean" message in preen mode (bsc#1218747)</changelog>
  <changelog author="jack@suse.cz" date="1717675200">- EA Inode handling fixes:
  - e2fsck-add-more-checks-for-ea-inode-consistency.patch: e2fsck: add more
    checks for ea inode consistency (bsc#1223596)
  - e2fsck-fix-golden-output-of-several-tests.patch: e2fsck: fix golden output
    of several tests (bsc#1223596)</changelog>
</package>
<package pkgid="b86fa014ebf9528a881eb5905af292c412737db37a63795ed7f9e9b708e2e141" name="e2fsprogs-devel" arch="x86_64">
  <version epoch="0" ver="1.47.0" rel="150600.4.3.2"/>
  <changelog author="jack@suse.cz" date="1613649600">- Remove autoreconf (and resulting dependencies) from the spec file. The
  upstream configure script should be fine.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1615723200">- e2fsprogs 1.46.2:
  * tune2fs -c now takes "random" argument
  * Add support for the FS_NOCOMP_FL flag to chattr and lsattr
  * Fix warnings when resizing small file systems to a super-large
  * Fix the debugfs rdump and ls commands so they will work correctly
    for uid's and gid's =&gt; 65536
  * Fix the debugfs write and symlink commands so they support
    targets which contain a pathname
  * Fix Direct I/O support on block devices where the logical block
    size is greater 1k
  * Fix debugfs's logdump so it works on file systems whose block
    size is greater than 8k
  * Fix a crash when there is error while e2fsck is trying to open
    the file system, and e2fsck calls ext2fs_mmp_stop() before MMP
    has been initialized
  * Improved error checking in the fast commit replay code in e2fsck
  * Fix various compiler and Coverity warnings
  * Update the Spanish translation from the translation project</changelog>
  <changelog author="christophe@krop.fr" date="1622635200">- Fix the %doc files. RELEASE-NOTES is a symlink to
  doc/RelNotes/v%version.</changelog>
  <changelog author="jack@suse.cz" date="1627905600">- Update to 1.46.3:
  * Add -V and -VV options to filefrag
  * Fix fs corruption cause by resize2fs on filesystems with MMP blocks
  * Fast commit portability fixes
  * Fix direct IO support in Unix IO manager
  * Avoid calling EXT2_IOC_[GS]ETFLAGS for block devices
  * Fix mke2fs to not discard blocks beyond end of filesystem
  * Make e2fsck set filetype of '.' and '..' entries
  * Fix QCOW image generation in e2image for very large filesystems
  * Update translations</changelog>
  <changelog author="jsegitz@suse.com" date="1631620800">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_e2scrub@.service.patch
  * harden_e2scrub_all.service.patch
  * harden_e2scrub_fail@.service.patch
  * harden_e2scrub_reap.service.patch</changelog>
  <changelog author="jack@suse.cz" date="1631707200">- Update to 1.46.4:
  * Default to 256-byte inodes for all filesystems, not only larger ones
  * Bigalloc is considered supported now for small cluster sizes
  * E2fsck and e2image fixes for quota feature
  * Fix mke2fs creation of filesystem into non-existent file
- libss-add-newer-libreadline.so.8-to-dlopen-path.patch: libss: add newer
  libreadline.so.8 to dlopen path (bsc#1189453)</changelog>
  <changelog author="jack@suse.cz" date="1633003200">- quota-Add-support-to-version-0-quota-format.patch: quota: Add support to
    version 0 quota format (jsc#SLE-17360)
  quota-Fold-quota_read_all_dquots-into-quota_update_l.patch: quota: Fold
    quota_read_all_dquots() into quota_update_limits() (jsc#SLE-17360)
  quota-Rename-quota_update_limits-to-quota_read_all_d.patch: quota: Rename
    quota_update_limits() to quota_read_all_dquots() (jsc#SLE-17360)
  tune2fs-Fix-conversion-of-quota-files.patch: tune2fs: Fix conversion of quota
    files (jsc#SLE-17360)
  e2fsck-Do-not-trash-user-limits-when-processing-orph.patch: e2fsck: Do not
    trash user limits when processing orphan list (jsc#SLE-17360)
  debugfs-Fix-headers-for-quota-commands.patch: debugfs: Fix headers for quota
    commands (jsc#SLE-17360)
  quota-Drop-dead-code.patch: quota: Drop dead code (jsc#SLE-17360)
- add these not yet released fixes to e2fsprogs package so that SLE15-SP4 ships
  with them</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="jack@suse.cz" date="1643371200">- Update to 1.46.5:
  * better handling for resizing to fs sizes which would exceed inode limits
  * fix crash in e2fsck fastcommit handling
  * fix possibly lost quota limits when e2fsck corrects quota files
  * fix tune2fs to properly transfer quota limits when convertion quota files
  * add support for handling of version 0 quota files in tune2fs
  * teach libss to use libreadline.so.8
  * optimize resize2fs cpu usage for large filesystems
  * teach libuuid to use getrandom() or getentropy() if available
- libss-add-newer-libreadline.so.8-to-dlopen-path.patch: Remove, merged upstream
- quota-Add-support-to-version-0-quota-format.patch: Remove, merged upstream
- quota-Fold-quota_read_all_dquots-into-quota_update_l.patch: Remove, merged upstream
- quota-Rename-quota_update_limits-to-quota_read_all_d.patch: Remove, merged upstream
- tune2fs-Fix-conversion-of-quota-files.patch: Remove, merged upstream
- e2fsck-Do-not-trash-user-limits-when-processing-orph.patch: Remove, merged upstream
- debugfs-Fix-headers-for-quota-commands.patch: Remove, merged upstream
- quota-Drop-dead-code.patch: Remove, merged upstream</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- avoid empty preuninstall script</changelog>
  <changelog author="cgoll@suse.com" date="1663070400">- enabled fuse2fs build which enable to mount ext2/3/4 via FUSE</changelog>
  <changelog author="dimstar@opensuse.org" date="1663156800">- Spec file cleanup:
  + Drop remainders regarding -mini packages, which was not a thing
    since Jan 2014.
  + Split build of fuse2fs out into a sep build (_multibuild
    enabled).</changelog>
  <changelog author="dimstar@opensuse.org" date="1663243200">- Refresh e2fsprogs.keyring based on currently provided keys.</changelog>
  <changelog author="lnussel@suse.com" date="1672142400">- Replace transitional %usrmerged macro with regular version check (boo#1206798)</changelog>
  <changelog author="info@paolostivanin.com" date="1675857600">- Update to 1.47.0:
  * Add support for the orphan_file feature, which speeds up workloads
    that are deleting or truncating a large number files in parallel.
    This compat feature was first supported in the v5.15 Linux kernel.
  * The mke2fs program (via the mke2fs.conf file) now enables the
    metadata_csum_seed and orphan_file features by default.
    The metadata_csum_seed feature is an incompat feature which is
    first supported in the Linux kernel starting in the 4.4 kernel.
  * Mke2fs now supports the extended option "assume_storage_prezeroed"
    which causes mke2fs to skip zeroing the journal and inode tables
    and to mark the inode tables as zeroed.
  * Add support to tune2fs and e2label to set the label and UUID for
    a mounted file system using a ioctl, which is more reliable than
    modifying the superblock via writing to the block device.
    The kernel support for setting the label landed in v5.17, while
    the support for adding the UUID landed in v6.0. If the ioctls
    are not supported, tune2fs and e2label will fall back old
    strategy of directly modifying the superblock.
  * Allow tune2fs to disable the casefold feature after scanning all
    of the directories do not have the Casefold flag set.</changelog>
  <changelog author="jack@suse.cz" date="1696420800">- Update specfile to make sure regenerate_initrd_post macro is defined</changelog>
  <changelog author="jack@suse.cz" date="1698840000">- mke2fs-Drop-metadata_csum_seed-and-orphan_file-from-.patch: Update
  mke2fs.conf to create filesystems only with features supported
  by tools in SLE15-SP4/5 by default.</changelog>
  <changelog author="jack@suse.cz" date="1700654400">- libext2fs-add-sanity-check-to-extent-manipulation.patch: Merged upstream
  in 1.46.6
- References to old bugs fixed by updating to latest upstream version:
  CVE-2015-0247 CVE-2015-1572 CVE-2019-5094 CVE-2019-5188 CVE-2022-1304
  bsc#1009532 bsc#1038194 bsc#1128383 bsc#1145716 bsc#1152101 bsc#1154295
  bsc#1160571 bsc#1160979 bsc#1170964 bsc#1183791 bsc#1198446 bsc#915402
  bsc#918346 bsc#960273</changelog>
  <changelog author="jack@suse.cz" date="1705320000">- e2fsck-Suppress-orphan-file-is-clean-message-in-preen.patch: e2fsck: Suppress
  "orphan file is clean" message in preen mode (bsc#1218747)</changelog>
  <changelog author="jack@suse.cz" date="1717675200">- EA Inode handling fixes:
  - e2fsck-add-more-checks-for-ea-inode-consistency.patch: e2fsck: add more
    checks for ea inode consistency (bsc#1223596)
  - e2fsck-fix-golden-output-of-several-tests.patch: e2fsck: fix golden output
    of several tests (bsc#1223596)</changelog>
</package>
<package pkgid="faf72521c9eab1862e087df86e2361b802a80541de77770a94b49a8171ebd991" name="e2fsprogs-scrub" arch="aarch64">
  <version epoch="0" ver="1.47.0" rel="150600.4.3.2"/>
  <changelog author="jack@suse.cz" date="1613649600">- Remove autoreconf (and resulting dependencies) from the spec file. The
  upstream configure script should be fine.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1615723200">- e2fsprogs 1.46.2:
  * tune2fs -c now takes "random" argument
  * Add support for the FS_NOCOMP_FL flag to chattr and lsattr
  * Fix warnings when resizing small file systems to a super-large
  * Fix the debugfs rdump and ls commands so they will work correctly
    for uid's and gid's =&gt; 65536
  * Fix the debugfs write and symlink commands so they support
    targets which contain a pathname
  * Fix Direct I/O support on block devices where the logical block
    size is greater 1k
  * Fix debugfs's logdump so it works on file systems whose block
    size is greater than 8k
  * Fix a crash when there is error while e2fsck is trying to open
    the file system, and e2fsck calls ext2fs_mmp_stop() before MMP
    has been initialized
  * Improved error checking in the fast commit replay code in e2fsck
  * Fix various compiler and Coverity warnings
  * Update the Spanish translation from the translation project</changelog>
  <changelog author="christophe@krop.fr" date="1622635200">- Fix the %doc files. RELEASE-NOTES is a symlink to
  doc/RelNotes/v%version.</changelog>
  <changelog author="jack@suse.cz" date="1627905600">- Update to 1.46.3:
  * Add -V and -VV options to filefrag
  * Fix fs corruption cause by resize2fs on filesystems with MMP blocks
  * Fast commit portability fixes
  * Fix direct IO support in Unix IO manager
  * Avoid calling EXT2_IOC_[GS]ETFLAGS for block devices
  * Fix mke2fs to not discard blocks beyond end of filesystem
  * Make e2fsck set filetype of '.' and '..' entries
  * Fix QCOW image generation in e2image for very large filesystems
  * Update translations</changelog>
  <changelog author="jsegitz@suse.com" date="1631620800">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_e2scrub@.service.patch
  * harden_e2scrub_all.service.patch
  * harden_e2scrub_fail@.service.patch
  * harden_e2scrub_reap.service.patch</changelog>
  <changelog author="jack@suse.cz" date="1631707200">- Update to 1.46.4:
  * Default to 256-byte inodes for all filesystems, not only larger ones
  * Bigalloc is considered supported now for small cluster sizes
  * E2fsck and e2image fixes for quota feature
  * Fix mke2fs creation of filesystem into non-existent file
- libss-add-newer-libreadline.so.8-to-dlopen-path.patch: libss: add newer
  libreadline.so.8 to dlopen path (bsc#1189453)</changelog>
  <changelog author="jack@suse.cz" date="1633003200">- quota-Add-support-to-version-0-quota-format.patch: quota: Add support to
    version 0 quota format (jsc#SLE-17360)
  quota-Fold-quota_read_all_dquots-into-quota_update_l.patch: quota: Fold
    quota_read_all_dquots() into quota_update_limits() (jsc#SLE-17360)
  quota-Rename-quota_update_limits-to-quota_read_all_d.patch: quota: Rename
    quota_update_limits() to quota_read_all_dquots() (jsc#SLE-17360)
  tune2fs-Fix-conversion-of-quota-files.patch: tune2fs: Fix conversion of quota
    files (jsc#SLE-17360)
  e2fsck-Do-not-trash-user-limits-when-processing-orph.patch: e2fsck: Do not
    trash user limits when processing orphan list (jsc#SLE-17360)
  debugfs-Fix-headers-for-quota-commands.patch: debugfs: Fix headers for quota
    commands (jsc#SLE-17360)
  quota-Drop-dead-code.patch: quota: Drop dead code (jsc#SLE-17360)
- add these not yet released fixes to e2fsprogs package so that SLE15-SP4 ships
  with them</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="jack@suse.cz" date="1643371200">- Update to 1.46.5:
  * better handling for resizing to fs sizes which would exceed inode limits
  * fix crash in e2fsck fastcommit handling
  * fix possibly lost quota limits when e2fsck corrects quota files
  * fix tune2fs to properly transfer quota limits when convertion quota files
  * add support for handling of version 0 quota files in tune2fs
  * teach libss to use libreadline.so.8
  * optimize resize2fs cpu usage for large filesystems
  * teach libuuid to use getrandom() or getentropy() if available
- libss-add-newer-libreadline.so.8-to-dlopen-path.patch: Remove, merged upstream
- quota-Add-support-to-version-0-quota-format.patch: Remove, merged upstream
- quota-Fold-quota_read_all_dquots-into-quota_update_l.patch: Remove, merged upstream
- quota-Rename-quota_update_limits-to-quota_read_all_d.patch: Remove, merged upstream
- tune2fs-Fix-conversion-of-quota-files.patch: Remove, merged upstream
- e2fsck-Do-not-trash-user-limits-when-processing-orph.patch: Remove, merged upstream
- debugfs-Fix-headers-for-quota-commands.patch: Remove, merged upstream
- quota-Drop-dead-code.patch: Remove, merged upstream</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- avoid empty preuninstall script</changelog>
  <changelog author="cgoll@suse.com" date="1663070400">- enabled fuse2fs build which enable to mount ext2/3/4 via FUSE</changelog>
  <changelog author="dimstar@opensuse.org" date="1663156800">- Spec file cleanup:
  + Drop remainders regarding -mini packages, which was not a thing
    since Jan 2014.
  + Split build of fuse2fs out into a sep build (_multibuild
    enabled).</changelog>
  <changelog author="dimstar@opensuse.org" date="1663243200">- Refresh e2fsprogs.keyring based on currently provided keys.</changelog>
  <changelog author="lnussel@suse.com" date="1672142400">- Replace transitional %usrmerged macro with regular version check (boo#1206798)</changelog>
  <changelog author="info@paolostivanin.com" date="1675857600">- Update to 1.47.0:
  * Add support for the orphan_file feature, which speeds up workloads
    that are deleting or truncating a large number files in parallel.
    This compat feature was first supported in the v5.15 Linux kernel.
  * The mke2fs program (via the mke2fs.conf file) now enables the
    metadata_csum_seed and orphan_file features by default.
    The metadata_csum_seed feature is an incompat feature which is
    first supported in the Linux kernel starting in the 4.4 kernel.
  * Mke2fs now supports the extended option "assume_storage_prezeroed"
    which causes mke2fs to skip zeroing the journal and inode tables
    and to mark the inode tables as zeroed.
  * Add support to tune2fs and e2label to set the label and UUID for
    a mounted file system using a ioctl, which is more reliable than
    modifying the superblock via writing to the block device.
    The kernel support for setting the label landed in v5.17, while
    the support for adding the UUID landed in v6.0. If the ioctls
    are not supported, tune2fs and e2label will fall back old
    strategy of directly modifying the superblock.
  * Allow tune2fs to disable the casefold feature after scanning all
    of the directories do not have the Casefold flag set.</changelog>
  <changelog author="jack@suse.cz" date="1696420800">- Update specfile to make sure regenerate_initrd_post macro is defined</changelog>
  <changelog author="jack@suse.cz" date="1698840000">- mke2fs-Drop-metadata_csum_seed-and-orphan_file-from-.patch: Update
  mke2fs.conf to create filesystems only with features supported
  by tools in SLE15-SP4/5 by default.</changelog>
  <changelog author="jack@suse.cz" date="1700654400">- libext2fs-add-sanity-check-to-extent-manipulation.patch: Merged upstream
  in 1.46.6
- References to old bugs fixed by updating to latest upstream version:
  CVE-2015-0247 CVE-2015-1572 CVE-2019-5094 CVE-2019-5188 CVE-2022-1304
  bsc#1009532 bsc#1038194 bsc#1128383 bsc#1145716 bsc#1152101 bsc#1154295
  bsc#1160571 bsc#1160979 bsc#1170964 bsc#1183791 bsc#1198446 bsc#915402
  bsc#918346 bsc#960273</changelog>
  <changelog author="jack@suse.cz" date="1705320000">- e2fsck-Suppress-orphan-file-is-clean-message-in-preen.patch: e2fsck: Suppress
  "orphan file is clean" message in preen mode (bsc#1218747)</changelog>
  <changelog author="jack@suse.cz" date="1717675200">- EA Inode handling fixes:
  - e2fsck-add-more-checks-for-ea-inode-consistency.patch: e2fsck: add more
    checks for ea inode consistency (bsc#1223596)
  - e2fsck-fix-golden-output-of-several-tests.patch: e2fsck: fix golden output
    of several tests (bsc#1223596)</changelog>
</package>
<package pkgid="7ca4af67778b23fdbb3d64430e19d0896fc38c66a4a14934aa9cdaea2f1d5cfd" name="e2fsprogs-scrub" arch="ppc64le">
  <version epoch="0" ver="1.47.0" rel="150600.4.3.2"/>
  <changelog author="jack@suse.cz" date="1613649600">- Remove autoreconf (and resulting dependencies) from the spec file. The
  upstream configure script should be fine.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1615723200">- e2fsprogs 1.46.2:
  * tune2fs -c now takes "random" argument
  * Add support for the FS_NOCOMP_FL flag to chattr and lsattr
  * Fix warnings when resizing small file systems to a super-large
  * Fix the debugfs rdump and ls commands so they will work correctly
    for uid's and gid's =&gt; 65536
  * Fix the debugfs write and symlink commands so they support
    targets which contain a pathname
  * Fix Direct I/O support on block devices where the logical block
    size is greater 1k
  * Fix debugfs's logdump so it works on file systems whose block
    size is greater than 8k
  * Fix a crash when there is error while e2fsck is trying to open
    the file system, and e2fsck calls ext2fs_mmp_stop() before MMP
    has been initialized
  * Improved error checking in the fast commit replay code in e2fsck
  * Fix various compiler and Coverity warnings
  * Update the Spanish translation from the translation project</changelog>
  <changelog author="christophe@krop.fr" date="1622635200">- Fix the %doc files. RELEASE-NOTES is a symlink to
  doc/RelNotes/v%version.</changelog>
  <changelog author="jack@suse.cz" date="1627905600">- Update to 1.46.3:
  * Add -V and -VV options to filefrag
  * Fix fs corruption cause by resize2fs on filesystems with MMP blocks
  * Fast commit portability fixes
  * Fix direct IO support in Unix IO manager
  * Avoid calling EXT2_IOC_[GS]ETFLAGS for block devices
  * Fix mke2fs to not discard blocks beyond end of filesystem
  * Make e2fsck set filetype of '.' and '..' entries
  * Fix QCOW image generation in e2image for very large filesystems
  * Update translations</changelog>
  <changelog author="jsegitz@suse.com" date="1631620800">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_e2scrub@.service.patch
  * harden_e2scrub_all.service.patch
  * harden_e2scrub_fail@.service.patch
  * harden_e2scrub_reap.service.patch</changelog>
  <changelog author="jack@suse.cz" date="1631707200">- Update to 1.46.4:
  * Default to 256-byte inodes for all filesystems, not only larger ones
  * Bigalloc is considered supported now for small cluster sizes
  * E2fsck and e2image fixes for quota feature
  * Fix mke2fs creation of filesystem into non-existent file
- libss-add-newer-libreadline.so.8-to-dlopen-path.patch: libss: add newer
  libreadline.so.8 to dlopen path (bsc#1189453)</changelog>
  <changelog author="jack@suse.cz" date="1633003200">- quota-Add-support-to-version-0-quota-format.patch: quota: Add support to
    version 0 quota format (jsc#SLE-17360)
  quota-Fold-quota_read_all_dquots-into-quota_update_l.patch: quota: Fold
    quota_read_all_dquots() into quota_update_limits() (jsc#SLE-17360)
  quota-Rename-quota_update_limits-to-quota_read_all_d.patch: quota: Rename
    quota_update_limits() to quota_read_all_dquots() (jsc#SLE-17360)
  tune2fs-Fix-conversion-of-quota-files.patch: tune2fs: Fix conversion of quota
    files (jsc#SLE-17360)
  e2fsck-Do-not-trash-user-limits-when-processing-orph.patch: e2fsck: Do not
    trash user limits when processing orphan list (jsc#SLE-17360)
  debugfs-Fix-headers-for-quota-commands.patch: debugfs: Fix headers for quota
    commands (jsc#SLE-17360)
  quota-Drop-dead-code.patch: quota: Drop dead code (jsc#SLE-17360)
- add these not yet released fixes to e2fsprogs package so that SLE15-SP4 ships
  with them</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="jack@suse.cz" date="1643371200">- Update to 1.46.5:
  * better handling for resizing to fs sizes which would exceed inode limits
  * fix crash in e2fsck fastcommit handling
  * fix possibly lost quota limits when e2fsck corrects quota files
  * fix tune2fs to properly transfer quota limits when convertion quota files
  * add support for handling of version 0 quota files in tune2fs
  * teach libss to use libreadline.so.8
  * optimize resize2fs cpu usage for large filesystems
  * teach libuuid to use getrandom() or getentropy() if available
- libss-add-newer-libreadline.so.8-to-dlopen-path.patch: Remove, merged upstream
- quota-Add-support-to-version-0-quota-format.patch: Remove, merged upstream
- quota-Fold-quota_read_all_dquots-into-quota_update_l.patch: Remove, merged upstream
- quota-Rename-quota_update_limits-to-quota_read_all_d.patch: Remove, merged upstream
- tune2fs-Fix-conversion-of-quota-files.patch: Remove, merged upstream
- e2fsck-Do-not-trash-user-limits-when-processing-orph.patch: Remove, merged upstream
- debugfs-Fix-headers-for-quota-commands.patch: Remove, merged upstream
- quota-Drop-dead-code.patch: Remove, merged upstream</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- avoid empty preuninstall script</changelog>
  <changelog author="cgoll@suse.com" date="1663070400">- enabled fuse2fs build which enable to mount ext2/3/4 via FUSE</changelog>
  <changelog author="dimstar@opensuse.org" date="1663156800">- Spec file cleanup:
  + Drop remainders regarding -mini packages, which was not a thing
    since Jan 2014.
  + Split build of fuse2fs out into a sep build (_multibuild
    enabled).</changelog>
  <changelog author="dimstar@opensuse.org" date="1663243200">- Refresh e2fsprogs.keyring based on currently provided keys.</changelog>
  <changelog author="lnussel@suse.com" date="1672142400">- Replace transitional %usrmerged macro with regular version check (boo#1206798)</changelog>
  <changelog author="info@paolostivanin.com" date="1675857600">- Update to 1.47.0:
  * Add support for the orphan_file feature, which speeds up workloads
    that are deleting or truncating a large number files in parallel.
    This compat feature was first supported in the v5.15 Linux kernel.
  * The mke2fs program (via the mke2fs.conf file) now enables the
    metadata_csum_seed and orphan_file features by default.
    The metadata_csum_seed feature is an incompat feature which is
    first supported in the Linux kernel starting in the 4.4 kernel.
  * Mke2fs now supports the extended option "assume_storage_prezeroed"
    which causes mke2fs to skip zeroing the journal and inode tables
    and to mark the inode tables as zeroed.
  * Add support to tune2fs and e2label to set the label and UUID for
    a mounted file system using a ioctl, which is more reliable than
    modifying the superblock via writing to the block device.
    The kernel support for setting the label landed in v5.17, while
    the support for adding the UUID landed in v6.0. If the ioctls
    are not supported, tune2fs and e2label will fall back old
    strategy of directly modifying the superblock.
  * Allow tune2fs to disable the casefold feature after scanning all
    of the directories do not have the Casefold flag set.</changelog>
  <changelog author="jack@suse.cz" date="1696420800">- Update specfile to make sure regenerate_initrd_post macro is defined</changelog>
  <changelog author="jack@suse.cz" date="1698840000">- mke2fs-Drop-metadata_csum_seed-and-orphan_file-from-.patch: Update
  mke2fs.conf to create filesystems only with features supported
  by tools in SLE15-SP4/5 by default.</changelog>
  <changelog author="jack@suse.cz" date="1700654400">- libext2fs-add-sanity-check-to-extent-manipulation.patch: Merged upstream
  in 1.46.6
- References to old bugs fixed by updating to latest upstream version:
  CVE-2015-0247 CVE-2015-1572 CVE-2019-5094 CVE-2019-5188 CVE-2022-1304
  bsc#1009532 bsc#1038194 bsc#1128383 bsc#1145716 bsc#1152101 bsc#1154295
  bsc#1160571 bsc#1160979 bsc#1170964 bsc#1183791 bsc#1198446 bsc#915402
  bsc#918346 bsc#960273</changelog>
  <changelog author="jack@suse.cz" date="1705320000">- e2fsck-Suppress-orphan-file-is-clean-message-in-preen.patch: e2fsck: Suppress
  "orphan file is clean" message in preen mode (bsc#1218747)</changelog>
  <changelog author="jack@suse.cz" date="1717675200">- EA Inode handling fixes:
  - e2fsck-add-more-checks-for-ea-inode-consistency.patch: e2fsck: add more
    checks for ea inode consistency (bsc#1223596)
  - e2fsck-fix-golden-output-of-several-tests.patch: e2fsck: fix golden output
    of several tests (bsc#1223596)</changelog>
</package>
<package pkgid="bf10e5606cb38c075a6a4a2b616e0fb894153e296e11742957c3a6744c172629" name="e2fsprogs-scrub" arch="s390x">
  <version epoch="0" ver="1.47.0" rel="150600.4.3.2"/>
  <changelog author="jack@suse.cz" date="1613649600">- Remove autoreconf (and resulting dependencies) from the spec file. The
  upstream configure script should be fine.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1615723200">- e2fsprogs 1.46.2:
  * tune2fs -c now takes "random" argument
  * Add support for the FS_NOCOMP_FL flag to chattr and lsattr
  * Fix warnings when resizing small file systems to a super-large
  * Fix the debugfs rdump and ls commands so they will work correctly
    for uid's and gid's =&gt; 65536
  * Fix the debugfs write and symlink commands so they support
    targets which contain a pathname
  * Fix Direct I/O support on block devices where the logical block
    size is greater 1k
  * Fix debugfs's logdump so it works on file systems whose block
    size is greater than 8k
  * Fix a crash when there is error while e2fsck is trying to open
    the file system, and e2fsck calls ext2fs_mmp_stop() before MMP
    has been initialized
  * Improved error checking in the fast commit replay code in e2fsck
  * Fix various compiler and Coverity warnings
  * Update the Spanish translation from the translation project</changelog>
  <changelog author="christophe@krop.fr" date="1622635200">- Fix the %doc files. RELEASE-NOTES is a symlink to
  doc/RelNotes/v%version.</changelog>
  <changelog author="jack@suse.cz" date="1627905600">- Update to 1.46.3:
  * Add -V and -VV options to filefrag
  * Fix fs corruption cause by resize2fs on filesystems with MMP blocks
  * Fast commit portability fixes
  * Fix direct IO support in Unix IO manager
  * Avoid calling EXT2_IOC_[GS]ETFLAGS for block devices
  * Fix mke2fs to not discard blocks beyond end of filesystem
  * Make e2fsck set filetype of '.' and '..' entries
  * Fix QCOW image generation in e2image for very large filesystems
  * Update translations</changelog>
  <changelog author="jsegitz@suse.com" date="1631620800">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_e2scrub@.service.patch
  * harden_e2scrub_all.service.patch
  * harden_e2scrub_fail@.service.patch
  * harden_e2scrub_reap.service.patch</changelog>
  <changelog author="jack@suse.cz" date="1631707200">- Update to 1.46.4:
  * Default to 256-byte inodes for all filesystems, not only larger ones
  * Bigalloc is considered supported now for small cluster sizes
  * E2fsck and e2image fixes for quota feature
  * Fix mke2fs creation of filesystem into non-existent file
- libss-add-newer-libreadline.so.8-to-dlopen-path.patch: libss: add newer
  libreadline.so.8 to dlopen path (bsc#1189453)</changelog>
  <changelog author="jack@suse.cz" date="1633003200">- quota-Add-support-to-version-0-quota-format.patch: quota: Add support to
    version 0 quota format (jsc#SLE-17360)
  quota-Fold-quota_read_all_dquots-into-quota_update_l.patch: quota: Fold
    quota_read_all_dquots() into quota_update_limits() (jsc#SLE-17360)
  quota-Rename-quota_update_limits-to-quota_read_all_d.patch: quota: Rename
    quota_update_limits() to quota_read_all_dquots() (jsc#SLE-17360)
  tune2fs-Fix-conversion-of-quota-files.patch: tune2fs: Fix conversion of quota
    files (jsc#SLE-17360)
  e2fsck-Do-not-trash-user-limits-when-processing-orph.patch: e2fsck: Do not
    trash user limits when processing orphan list (jsc#SLE-17360)
  debugfs-Fix-headers-for-quota-commands.patch: debugfs: Fix headers for quota
    commands (jsc#SLE-17360)
  quota-Drop-dead-code.patch: quota: Drop dead code (jsc#SLE-17360)
- add these not yet released fixes to e2fsprogs package so that SLE15-SP4 ships
  with them</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="jack@suse.cz" date="1643371200">- Update to 1.46.5:
  * better handling for resizing to fs sizes which would exceed inode limits
  * fix crash in e2fsck fastcommit handling
  * fix possibly lost quota limits when e2fsck corrects quota files
  * fix tune2fs to properly transfer quota limits when convertion quota files
  * add support for handling of version 0 quota files in tune2fs
  * teach libss to use libreadline.so.8
  * optimize resize2fs cpu usage for large filesystems
  * teach libuuid to use getrandom() or getentropy() if available
- libss-add-newer-libreadline.so.8-to-dlopen-path.patch: Remove, merged upstream
- quota-Add-support-to-version-0-quota-format.patch: Remove, merged upstream
- quota-Fold-quota_read_all_dquots-into-quota_update_l.patch: Remove, merged upstream
- quota-Rename-quota_update_limits-to-quota_read_all_d.patch: Remove, merged upstream
- tune2fs-Fix-conversion-of-quota-files.patch: Remove, merged upstream
- e2fsck-Do-not-trash-user-limits-when-processing-orph.patch: Remove, merged upstream
- debugfs-Fix-headers-for-quota-commands.patch: Remove, merged upstream
- quota-Drop-dead-code.patch: Remove, merged upstream</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- avoid empty preuninstall script</changelog>
  <changelog author="cgoll@suse.com" date="1663070400">- enabled fuse2fs build which enable to mount ext2/3/4 via FUSE</changelog>
  <changelog author="dimstar@opensuse.org" date="1663156800">- Spec file cleanup:
  + Drop remainders regarding -mini packages, which was not a thing
    since Jan 2014.
  + Split build of fuse2fs out into a sep build (_multibuild
    enabled).</changelog>
  <changelog author="dimstar@opensuse.org" date="1663243200">- Refresh e2fsprogs.keyring based on currently provided keys.</changelog>
  <changelog author="lnussel@suse.com" date="1672142400">- Replace transitional %usrmerged macro with regular version check (boo#1206798)</changelog>
  <changelog author="info@paolostivanin.com" date="1675857600">- Update to 1.47.0:
  * Add support for the orphan_file feature, which speeds up workloads
    that are deleting or truncating a large number files in parallel.
    This compat feature was first supported in the v5.15 Linux kernel.
  * The mke2fs program (via the mke2fs.conf file) now enables the
    metadata_csum_seed and orphan_file features by default.
    The metadata_csum_seed feature is an incompat feature which is
    first supported in the Linux kernel starting in the 4.4 kernel.
  * Mke2fs now supports the extended option "assume_storage_prezeroed"
    which causes mke2fs to skip zeroing the journal and inode tables
    and to mark the inode tables as zeroed.
  * Add support to tune2fs and e2label to set the label and UUID for
    a mounted file system using a ioctl, which is more reliable than
    modifying the superblock via writing to the block device.
    The kernel support for setting the label landed in v5.17, while
    the support for adding the UUID landed in v6.0. If the ioctls
    are not supported, tune2fs and e2label will fall back old
    strategy of directly modifying the superblock.
  * Allow tune2fs to disable the casefold feature after scanning all
    of the directories do not have the Casefold flag set.</changelog>
  <changelog author="jack@suse.cz" date="1696420800">- Update specfile to make sure regenerate_initrd_post macro is defined</changelog>
  <changelog author="jack@suse.cz" date="1698840000">- mke2fs-Drop-metadata_csum_seed-and-orphan_file-from-.patch: Update
  mke2fs.conf to create filesystems only with features supported
  by tools in SLE15-SP4/5 by default.</changelog>
  <changelog author="jack@suse.cz" date="1700654400">- libext2fs-add-sanity-check-to-extent-manipulation.patch: Merged upstream
  in 1.46.6
- References to old bugs fixed by updating to latest upstream version:
  CVE-2015-0247 CVE-2015-1572 CVE-2019-5094 CVE-2019-5188 CVE-2022-1304
  bsc#1009532 bsc#1038194 bsc#1128383 bsc#1145716 bsc#1152101 bsc#1154295
  bsc#1160571 bsc#1160979 bsc#1170964 bsc#1183791 bsc#1198446 bsc#915402
  bsc#918346 bsc#960273</changelog>
  <changelog author="jack@suse.cz" date="1705320000">- e2fsck-Suppress-orphan-file-is-clean-message-in-preen.patch: e2fsck: Suppress
  "orphan file is clean" message in preen mode (bsc#1218747)</changelog>
  <changelog author="jack@suse.cz" date="1717675200">- EA Inode handling fixes:
  - e2fsck-add-more-checks-for-ea-inode-consistency.patch: e2fsck: add more
    checks for ea inode consistency (bsc#1223596)
  - e2fsck-fix-golden-output-of-several-tests.patch: e2fsck: fix golden output
    of several tests (bsc#1223596)</changelog>
</package>
<package pkgid="9100aabc9fd1d3948b63f48cc7ab90bfa0648941a757b9d4c94b1d5155e957fb" name="e2fsprogs-scrub" arch="x86_64">
  <version epoch="0" ver="1.47.0" rel="150600.4.3.2"/>
  <changelog author="jack@suse.cz" date="1613649600">- Remove autoreconf (and resulting dependencies) from the spec file. The
  upstream configure script should be fine.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1615723200">- e2fsprogs 1.46.2:
  * tune2fs -c now takes "random" argument
  * Add support for the FS_NOCOMP_FL flag to chattr and lsattr
  * Fix warnings when resizing small file systems to a super-large
  * Fix the debugfs rdump and ls commands so they will work correctly
    for uid's and gid's =&gt; 65536
  * Fix the debugfs write and symlink commands so they support
    targets which contain a pathname
  * Fix Direct I/O support on block devices where the logical block
    size is greater 1k
  * Fix debugfs's logdump so it works on file systems whose block
    size is greater than 8k
  * Fix a crash when there is error while e2fsck is trying to open
    the file system, and e2fsck calls ext2fs_mmp_stop() before MMP
    has been initialized
  * Improved error checking in the fast commit replay code in e2fsck
  * Fix various compiler and Coverity warnings
  * Update the Spanish translation from the translation project</changelog>
  <changelog author="christophe@krop.fr" date="1622635200">- Fix the %doc files. RELEASE-NOTES is a symlink to
  doc/RelNotes/v%version.</changelog>
  <changelog author="jack@suse.cz" date="1627905600">- Update to 1.46.3:
  * Add -V and -VV options to filefrag
  * Fix fs corruption cause by resize2fs on filesystems with MMP blocks
  * Fast commit portability fixes
  * Fix direct IO support in Unix IO manager
  * Avoid calling EXT2_IOC_[GS]ETFLAGS for block devices
  * Fix mke2fs to not discard blocks beyond end of filesystem
  * Make e2fsck set filetype of '.' and '..' entries
  * Fix QCOW image generation in e2image for very large filesystems
  * Update translations</changelog>
  <changelog author="jsegitz@suse.com" date="1631620800">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_e2scrub@.service.patch
  * harden_e2scrub_all.service.patch
  * harden_e2scrub_fail@.service.patch
  * harden_e2scrub_reap.service.patch</changelog>
  <changelog author="jack@suse.cz" date="1631707200">- Update to 1.46.4:
  * Default to 256-byte inodes for all filesystems, not only larger ones
  * Bigalloc is considered supported now for small cluster sizes
  * E2fsck and e2image fixes for quota feature
  * Fix mke2fs creation of filesystem into non-existent file
- libss-add-newer-libreadline.so.8-to-dlopen-path.patch: libss: add newer
  libreadline.so.8 to dlopen path (bsc#1189453)</changelog>
  <changelog author="jack@suse.cz" date="1633003200">- quota-Add-support-to-version-0-quota-format.patch: quota: Add support to
    version 0 quota format (jsc#SLE-17360)
  quota-Fold-quota_read_all_dquots-into-quota_update_l.patch: quota: Fold
    quota_read_all_dquots() into quota_update_limits() (jsc#SLE-17360)
  quota-Rename-quota_update_limits-to-quota_read_all_d.patch: quota: Rename
    quota_update_limits() to quota_read_all_dquots() (jsc#SLE-17360)
  tune2fs-Fix-conversion-of-quota-files.patch: tune2fs: Fix conversion of quota
    files (jsc#SLE-17360)
  e2fsck-Do-not-trash-user-limits-when-processing-orph.patch: e2fsck: Do not
    trash user limits when processing orphan list (jsc#SLE-17360)
  debugfs-Fix-headers-for-quota-commands.patch: debugfs: Fix headers for quota
    commands (jsc#SLE-17360)
  quota-Drop-dead-code.patch: quota: Drop dead code (jsc#SLE-17360)
- add these not yet released fixes to e2fsprogs package so that SLE15-SP4 ships
  with them</changelog>
  <changelog author="jsegitz@suse.com" date="1634299200">- Drop ProtectClock hardening, can cause issues if other device acceess is needed</changelog>
  <changelog author="jack@suse.cz" date="1643371200">- Update to 1.46.5:
  * better handling for resizing to fs sizes which would exceed inode limits
  * fix crash in e2fsck fastcommit handling
  * fix possibly lost quota limits when e2fsck corrects quota files
  * fix tune2fs to properly transfer quota limits when convertion quota files
  * add support for handling of version 0 quota files in tune2fs
  * teach libss to use libreadline.so.8
  * optimize resize2fs cpu usage for large filesystems
  * teach libuuid to use getrandom() or getentropy() if available
- libss-add-newer-libreadline.so.8-to-dlopen-path.patch: Remove, merged upstream
- quota-Add-support-to-version-0-quota-format.patch: Remove, merged upstream
- quota-Fold-quota_read_all_dquots-into-quota_update_l.patch: Remove, merged upstream
- quota-Rename-quota_update_limits-to-quota_read_all_d.patch: Remove, merged upstream
- tune2fs-Fix-conversion-of-quota-files.patch: Remove, merged upstream
- e2fsck-Do-not-trash-user-limits-when-processing-orph.patch: Remove, merged upstream
- debugfs-Fix-headers-for-quota-commands.patch: Remove, merged upstream
- quota-Drop-dead-code.patch: Remove, merged upstream</changelog>
  <changelog author="dmueller@suse.com" date="1650369600">- avoid empty preuninstall script</changelog>
  <changelog author="cgoll@suse.com" date="1663070400">- enabled fuse2fs build which enable to mount ext2/3/4 via FUSE</changelog>
  <changelog author="dimstar@opensuse.org" date="1663156800">- Spec file cleanup:
  + Drop remainders regarding -mini packages, which was not a thing
    since Jan 2014.
  + Split build of fuse2fs out into a sep build (_multibuild
    enabled).</changelog>
  <changelog author="dimstar@opensuse.org" date="1663243200">- Refresh e2fsprogs.keyring based on currently provided keys.</changelog>
  <changelog author="lnussel@suse.com" date="1672142400">- Replace transitional %usrmerged macro with regular version check (boo#1206798)</changelog>
  <changelog author="info@paolostivanin.com" date="1675857600">- Update to 1.47.0:
  * Add support for the orphan_file feature, which speeds up workloads
    that are deleting or truncating a large number files in parallel.
    This compat feature was first supported in the v5.15 Linux kernel.
  * The mke2fs program (via the mke2fs.conf file) now enables the
    metadata_csum_seed and orphan_file features by default.
    The metadata_csum_seed feature is an incompat feature which is
    first supported in the Linux kernel starting in the 4.4 kernel.
  * Mke2fs now supports the extended option "assume_storage_prezeroed"
    which causes mke2fs to skip zeroing the journal and inode tables
    and to mark the inode tables as zeroed.
  * Add support to tune2fs and e2label to set the label and UUID for
    a mounted file system using a ioctl, which is more reliable than
    modifying the superblock via writing to the block device.
    The kernel support for setting the label landed in v5.17, while
    the support for adding the UUID landed in v6.0. If the ioctls
    are not supported, tune2fs and e2label will fall back old
    strategy of directly modifying the superblock.
  * Allow tune2fs to disable the casefold feature after scanning all
    of the directories do not have the Casefold flag set.</changelog>
  <changelog author="jack@suse.cz" date="1696420800">- Update specfile to make sure regenerate_initrd_post macro is defined</changelog>
  <changelog author="jack@suse.cz" date="1698840000">- mke2fs-Drop-metadata_csum_seed-and-orphan_file-from-.patch: Update
  mke2fs.conf to create filesystems only with features supported
  by tools in SLE15-SP4/5 by default.</changelog>
  <changelog author="jack@suse.cz" date="1700654400">- libext2fs-add-sanity-check-to-extent-manipulation.patch: Merged upstream
  in 1.46.6
- References to old bugs fixed by updating to latest upstream version:
  CVE-2015-0247 CVE-2015-1572 CVE-2019-5094 CVE-2019-5188 CVE-2022-1304
  bsc#1009532 bsc#1038194 bsc#1128383 bsc#1145716 bsc#1152101 bsc#1154295
  bsc#1160571 bsc#1160979 bsc#1170964 bsc#1183791 bsc#1198446 bsc#915402
  bsc#918346 bsc#960273</changelog>
  <changelog author="jack@suse.cz" date="1705320000">- e2fsck-Suppress-orphan-file-is-clean-message-in-preen.patch: e2fsck: Suppress
  "orphan file is clean" message in preen mode (bsc#1218747)</changelog>
  <changelog author="jack@suse.cz" date="1717675200">- EA Inode handling fixes:
  - e2fsck-add-more-checks-for-ea-inode-consistency.patch: e2fsck: add more
    checks for ea inode consistency (bsc#1223596)
  - e2fsck-fix-golden-output-of-several-tests.patch: e2fsck: fix golden output
    of several tests (bsc#1223596)</changelog>
</package>
<package pkgid="ab79aa77679d241f534873cb0628a0d8d10d0cb39291ebb52cffc06e3bd7b405" name="elixir115" arch="noarch">
  <version epoch="0" ver="1.15.7" rel="150300.7.5.1"/>
  <changelog author="dev@mail.smarquardt.space" date="1604491200">- Elixir 1.11.2
  * Bug fixes
    Elixir
    [Code] Do not crash when getting docs for missing `erts` appdir
    [Kernel] Raise meaningful error if `:erlang.is_record` is used in guards
    [Kernel] Prune tracers when fetching `__ENV__` inside functions
    Mix
    [mix] Fix regression where aliases could not call themselves recursively
    [mix compile] Do not discard tracers that are set programatically</changelog>
  <changelog author="dev@mail.smarquardt.space" date="1610366400">- Elixir 1.11.3
  * Enhancements
    Elixir
    [Macro] Add Macro.unique_var/2 and Macro.generate_unique_arguments/2
  * Bug fixes
    Elixir
    [Code] Do not raise when checking for operator ambiguity when :static_atoms_encoder is set in Code.string_to_quoted
    [Kernel] Emit undefined function warnings from with
    [Kernel] Do not fail type checking when literals are used in guards
    [Module] Do not warn for attributes used in @after_compile
    [Record] Make sure nested record names do not clobber each other
    ExUnit
    [ExUnit.Assertions] Do not crash if there are macros and module attributes on the left side of ++
    IEx
    [IEx.Helpers] Do not use Unicode chars if ANSI is disabled
    Mix
    [mix deps.compile] Fix compatibility with rebar v3.14
    [mix release] Do not use private ram_file:compress/1
    [mix xref] Do not crash when retrieving calls for modules in memory</changelog>
  <changelog author="dev@mail.smarquardt.space" date="1616155200">- Elixir 1.11.4
  * Enhancements
    Elixir
    [Kernel] Update formatting when printing warnings and errors from Erlang/OTP 24+
    [Kernel] Support float-16 on bitstrings
    Mix
    [mix local.rebar] This task will now install rebar3 version 3.14.4, compiled with Erlang/OTP 21</changelog>
  <changelog author="dev@mail.smarquardt.space" date="1623672000">- Elixir 1.12
  * Enhancements
    EEx
    [EEx.Engine] Add `c:EEx.Engine.handle_text/3` callback that receives text metadata
    [EEx.Engine] Emit warnings for unused "do" expression in EEx
    Elixir
    [Code] Add `Code.cursor_context/2` to return the context of a code snippet
    [Code] Do not add newlines around interpolation on code formatting.
    Note this means formatted code that has interpolation after the line length on Elixir v1.12 won't be considered as formatted on earlier Elixir versions
    [Code] Do not add brackets when keywords is used in the access syntax
    [Calendar] Support basic datetime format in `Calendar.ISO` parsing functions
    [Code] Improve evaluation performance on systems running on Erlang/OTP 24+
    [Date] Support steps via `Date.range/3`
    [DateTime] Add `offset` to `DateTime.to_iso8601/2` (now `to_iso8601/3`)
    [Enum] Add `Enum.count_until/2` and `Enum.count_until/3`
    [Enum] Add `Enum.product/1`
    [Enum] Add `Enum.zip_with/2`, `Enum.zip_with/3`, `Enum.zip_reduce/3`, and `Enum.zip_reduce/4`
    [Enum] Add support for functions as the second argument of `Enum.with_index/2`
    [Exception] Show `error_info` data for exceptions coming from Erlang
    [Float] Add `Float.pow/2`
    [Integer] Add `Integer.pow/2` and `Integer.extended_gcd/2`
    [IO] Add `IO.stream/0` and `IO.binstream/0` which default to STDIO with line orientation
    [List] Add default value for `List.first/1` and `List.last/1`
    [Kernel] Add `first..last//step` as support for stepped ranges
    [Kernel] Also warn for literal structs on `min/2` and `max/2`
    [Kernel] Add `Kernel.tap/2` and `Kernel.then/2`
    [Kernel] Do not add runtime dependencies to remotes in typespecs
    [Kernel] When there is an unused variable warning and there is a variable with the same name previously defined, suggest the user may have wanted to use the pin operator
    [Kernel] Improve error messages on invalid character right after a number
    [Kernel] Show removal and deprecated tips from Erlang/OTP
    [Macro] Add export dependencies on `Macro.struct!/2`
    [Macro] Support `:newline` to customize newlines escaping in `Macro.unescape_string/2`
    [Module] Raise on invalid `@dialyzer` attributes
    [Module] Add `Module.get_definition/2` and `Module.delete_definition/2`
    [Module] Allow `@on_load` to be a private function
    [Module] Validate `@dialyzer` related module attributes
    [Module] Add `Module.reserved_attributes/0` to list all reserved attributes by the language
    [Range] Add `Range.new/3` and `Range.size/1`
    [Regex] Add offset option to `Regex.scan/3` and `Regex.run/3`
    [Registry] Support `:compression` on `Registry` tables
    [Registry] Support `Registry.values/3` for reading values under a given key-pid pair
    [Stream] Add `Stream.zip_with/2` and `Stream.zip_with/3`
    [String] Add `:turkic` mode option to String case functions
    [String] Update to Unicode 13.0
    [System] Add `System.trap_signal/3` and `System.untrap_signal/2`
    [System] Add `System.shell/2` to invoke a command that is interpreted by the shell
    [Tuple] Add `Tuple.sum/1` and `Tuple.product/1`
    [URI] Support RFC3986 compliant encoding and decoding of queries via the `:rfc3986` option
    ExUnit
    [ExUnit] Intercept SIGQUIT (via Ctrl+\\) and show a list of all aborted tests as well as intermediate test results
    [ExUnit] Interpolate module attributes in match assertions diffs
    [ExUnit] Print how much time is spent on `async` vs `sync` tests
    [ExUnit] Improve error messages for doctests
    [ExUnit] Compile doctests faster (often by two times)
    [ExUnit] Add `ExUnit.async_run/0` and `ExUnit.await_run/1`
    IEx
    [IEx] Make IEx' parser configurable to allow special commands
    [IEx] Show function signature when pressing tab after the opening parens of a function
    [IEx] If an IEx expression starts with a binary operator, such as `|&gt;`, automatically pipe in the result of the last expression
    Mix
    [Mix] Add `Mix.install/2` for dynamically installing a list of dependencies
    [Mix] Support `:exit_code` option in `Mix.raise/2`
    [Mix] Discard `MIX_ENV` and `MIX_TARGET` values if they are empty strings
    [Mix] Print the time taken to execute a task with on `MIX_DEBUG=1`
    [mix compile.erlang] Compile multiple files in parallel
    [mix escript.build] Deep merge configuration and ensure argv is set when executing `config/runtime.exs`
    [mix release] Add `RELEASE_PROG` to releases with the name of the executable starting the release
    [mix release] Support `remote.vm.args` to customize how the connecting VM boots
    [mix test] Run all available tests if there are no pending `--failed` tests. This provides a better workflow as you no longer need to toggle the `--failed` flag between runs
  * Bug fixes
    Elixir
    [CLI] Ensure `-e ""` (with an empty string) parses correctly on Windows
    [Inspect] Do not override user supplied `:limit` option for derived implementations
    [Kernel] Allow heredoc inside a heredoc interpolation
    [Kernel] Preserve CRLF on heredocs
    [Kernel] Public functions without documentation now appear as an empty map on `Code.fetch_docs/1`,
    unless they start with underscore, where they remain as `:none`. This aligns Elixir's implementation with EEP48
    [Kernel] Do not crash when complex literals (binaries and maps) are used in guards
    [Kernel] Properly parse keywords (such as `end`) followed by the `::` operator
    [Kernel] Do not ignore unimplemented signatures from generated functions
    [Kernel] Improve error message when an expression follows a keyword list without brackets
    [Macro] `Macro.decompose_call/1` now also consider tuples with more than 2 elements to not be valid calls
    [Macro] Fix `Macro.to_string/1` double-escaping of escape characters in sigils
    [Macro] Fix `Macro.underscore/1` on digits preceded by capitals: "FOO10" now becomes "foo10" instead of "fo_o10"
    [Macro] Preserve underscores between digits on `Macro.underscore/1`
    [OptionParser] Properly parse when numbers follow-up aliases, for example, `-ab3` is now parsed as `-a -b 3`
    [Path] Fix `Path.relative_to/2` when referencing self
    [Path] Do not crash when a volume is given to `Path.absname/1`, such as "c:"
    [Task] Ensure `Task.async_stream/2` with `ordered: false` discard results as they are emitted, instead of needlessly accumulating inside the stream manager
    [Task] Raise if `:max_concurrency` is set to 0 on streaming operations
    [URI] Do not discard empty paths on `URI.merge/2`
    ExUnit
    [ExUnit.Case] Make `@tag tmp_dir` an absolute directory, avoiding inconsistencies if the test changes the current working directory
    [ExUnit.Diff] Fix cases where the diffing algorithm would fail to print a pattern correct
    IEx
    [IEx] Fix auto-completion inside remote shells
    Mix
    [mix app.config] Do not emit false positive warnings when configured dependencies that have `runtime: false` set
    [mix compile.elixir] Ensure that a manifest is generated even with no source code
    [mix compile.elixir] Make sure export dependencies trigger recompilation when the dependency is removed as well as when the whole file is removed
    [mix compile.elixir] Do not emit false positive warnings when a path dependency adds a module that is then used by the current application in the same `mix compile` cycle
    [mix test] Ensure protocols within the current project are consolidated when `--cover` is given
    [mix release] Improve compliance of release scripts with stripped down Linux installations
    [mix release] Preserve file mode when copying non-beam ebin files
    [mix xref] Ensure args are passed to the underlying `mix compile` call
  * Soft-deprecations (no warnings emitted)
    Elixir
    [Kernel] Using `first..last` to match on ranges is soft-deprecated and will warn on future Elixir versions. Use `first..last//step` instead
    [Kernel] Using `first..last` to create decreasing ranges is soft-deprecated and will warn on future versions. Use `first..last//-1` instead
  * Hard-deprecations
    EEx
    [EEx.Engine] `use EEx.Engine` is deprecated in favor of explicit delegation
    Elixir
    [Kernel] The binary operator `^^^` is deprecated. If you are using `Bitwise.^^^/2`, use `Bitwise.bxor/2` instead
    [Kernel] Deprecate `@foo()` in favor of `@foo`
    [System] Deprecate `System.stacktrace/0` (it was already deprecated outside of catch/rescue and now it is deprecated everywhere)
    Mix
    [mix compile] The `:xref` compiler is deprecated and it has no effect. Please remove it from your mix.exs file.
    Full release notes: https://github.com/elixir-lang/elixir/releases/tag/v1.12.0</changelog>
  <changelog author="dev@mail.smarquardt.space" date="1623672001">- Elixir 1.12.1
  * Bug fixes
    Elixir
    [Code] Make sure `Code.format_string!/2` formats multiline expression inside interpolation on the first run
    [Macro] Revert keeping of underscores between digits in camelize
    Mix
    [Mix] Make sure `Mix.install/2` expand paths for deps
    [mix deps.get] Silence false positives on `httpc` warnings
    [mix test] Do not run the whole suite when there are no --failed tests as it won't behave as expected inside umbrellas</changelog>
  <changelog author="dev@mail.smarquardt.space" date="1626091200">- Elixir 1.12.2
  * Bug fixes
    Elixir
    [Kernel] Ensure deprecated macros emit warnings
    Mix
    [mix deps] Ensure unconstrained rebar deps generate valid mix specifications
  * Enhancements
    Elixir
    [elixirc] Change the output of `--profile time` to make it easier to detect outliers
    [Application] Do not add compile time deps on args to `Application.compile_env/2` and `Application.compile_env!/2`
    [Enum] Optimize `Enum.into/3` and `Map.new/2`
    Mix
    [mix compile] Compile most recently changed files first
    [mix compile, mix run, mix test] Speed up the time taken to load dependencies. This should make the usage of Mix inside projects quite more responsive</changelog>
  <changelog author="dev@mail.smarquardt.space" date="1632830400">- Elixir 1.12.3
  * Bug fixes
    Elixir
    [Code] Make sure that bindings in the default context returned by `Code.eval_*` functions are not returned as tagged tuples
    [Kernel] Do not crash when handling ambiguity errors
    [Range] Still match on old range patterns throughout the stdlib
    IEx
    [IEx.Autocomplete] Do not error autocompletion with module attribute
    Mix
    [Mix] Rename inconsistent `:exit_code` option to `:exit_status` on `Mix.raise/2`</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1636113600">- Add 0001-Add-retries-to-tests-that-write-to-stderr-on-Windows.patch:
  fix build for Factory</changelog>
  <changelog author="dev@mail.smarquardt.space" date="1641470400">- Elixir 1.13.0
  * Enhancements
    EEx
    [EEx] Add `:parser_options` to EEx functions
    Elixir
    [Calendar] Add `c:Calendar.year_of_era/3` to support calendars where the beginning of a new era does not align with
    the beginning of a new year
    [CLI] Support `--short-version` on the CLI that does not boot the VM
    [Code] Add `Code.string_to_quoted_with_comments/2` and `Code.quoted_to_algebra/2`
    [Code] Add more `:token_metadata` to aliases and remote calls when parsing strings
    [Code] Add `Code.Fragment` module to provide best-effort information from code fragments.
    The module currently provides an updated `Code.Fragment.cursor_context/2` with operator support and
    `Code.Fragment.surround_context/2` which looks at a given position in a fragment and find its surrounding delimiters
    [Code] Allow custom sigil formatting on `Code.format_string!/2`
    [Code] Add `{:on_module, bytecode, :none}` trace to compilation tracers
    [Enum] Optimize `Enum.concat/1` for lists of lists
    [Enum] Add `Enum.slide/3`
    [Exception] Better format Elixir exceptions in Erlang
    [Inspect] Allow default inspect fun to be set globally with `Inspect.Opts.default_inspect_fun/1`
    [IO] Allow `:eof` to be given as limit to `IO.getn/2`
    [Kernel] Support the `:sigils` option in `import Mod, only: :sigils` and allow the sigil modifiers to be also digits
    [Kernel] Make `get_in` consistently abort and return `nil` when `nil` values are found (previously Elixir would raise
    an error in this case). This allows a user to use `get_in` as a safe navigation operator.
    [Kernel] Improve compilation times by reducing the amount of copies of the AST across compiler processes
    [Kernel] Raise if trying to define a module with a slash in its name
    [Kernel] Warn when `?\` is used and there is no need for a escape character
    [Kernel] Track structs in typespecs as export deps instead of compile-time deps
    [Kernel] Add power operator (`**/2`)
    [Keyword] Add `Keyword.validate/2`
    [Keyword] Implement `Keyword.filter/2` and `Keyword.map/2`
    [List] Add `List.keyfind!/3`
    [Macro] Add `Macro.prewalker/1` and `Macro.postwalker/1`
    [Macro.Env] Add the following reflection functions: `required?/2`, `lookup_import/2`, `fetch_alias/2`, and `fetch_macro_alias/2`
    [Map] Implement `Map.filter/2` and `Map.map/2`
    [Module] Support `:nillify_clauses` in `Module.get_definition/3`
    [Module] Add `Module.attributes_in/1` and `Module.overridables_in/1`
    [OptionParser] Add "did you mean?" suggestions to `OptionParser.ParseError` messages
    [Record] Add record reflection via `@__records__`
    [Task] Add `Task.completed/1`
    [Task] Add `Task.ignore/1` to keep a task running but ignoring all of its results
    [Task] Reduce the amount of copying `Task.async*` functions
    [URI] Add `URI.new/1` and `URI.new!/1`
    ExUnit
    [ExUnit] Show hint if comparing different but equivalent strings
    [ExUnit.CaptureIO] Add `with_io/3` to return result with captured io
    [ExUnit.CaptureLog] Add `with_log/2` to return result with captured logs
    IEx
    [IEx.Autocomplete] Add path autocompletion whenever when the cursor follows `"./` or `"/` or `"DRIVER:` where
    `DRIVER` is a single letter
    [IEx.Autocomplete] Add autocompletion for sigils, struct names, and struct fields
    [IEx.Helpers] Allow multiple modules to be given to `r/1`
    Logger
    [Logger] Add `Logger.put_application_level/2`
    [Logger] Print all log levels in accordance to Erlang/OTP. This also means `[warn]` is now shown as `[warning]`
    Mix
    [Mix] Add `MIX_INSTALL_FORCE` environment variable support
    [Mix] Support `:config` and `:system_env` in `Mix.install/2`
    [Mix] Add `Mix.installed?/0`
    [Mix.Shell] Add `:default` option to `Mix.Shell.yes?`
    [mix archive.install] Run `loadconfig` before building archive
    [mix compile] Move Elixir version check to before deps are compiled, in order to give feedback earlier
    [mix compile.elixir] Do not recompile files if their modification time change but their contents are still the same and the .beam files are still on disk
    [mix compile.elixir] Do not recompile all Elixir sources when Erlang modules change, only dependent ones
    [mix compile.elixir] Do not recompile Elixir files if `mix.exs` changes, instead recompile only files using `Mix.Project` or trigger a recompilation if a compiler option changes
    [mix compile.elixir] Only recompile needed files when a dependency is added, updated or removed
    [mix compile.elixir] Only recompile needed files when a dependency is configured
    [mix deps] Add `:subdir` option to git deps
    [mix escript.install] Run `loadconfig` before building escript
    [mix format] Support `:plugins` in `mix format` that can hook into custom extensions and sigils
    [mix format] Add `Mix.Tasks.Format.formatter_for_file/2`
    [mix local.rebar] No longer support `sub_dirs` in Rebar 2 to help migration towards Rebar 3
    [mix local.rebar] Support `--if-missing` option when installing Rebar
    [mix local.rebar] Set `REBAR_PROFILE=prod` when compiling Rebar dependencies
    [mix test] Support `--profile-require=time` to profile the time loading test files themselves
    [mix test] Allow filtering modules from coverage using regex
    [mix test] Allow the exit status of ExUnit to be configured and set the default to 2
    [mix test] Exit with a status of 3 when coverage falls below threshold
    [mix test] Write failed manifest when suite fails due to --warnings-as-errors
    [mix test] Ignore `MIX_TEST_PARTITION` when partitions set to 1
    [mix xref] Support multiple sinks and sources in `mix xref graph`
    [mix xref] Add `trace` subcommand to print compilation dependencies between files
    [mix xref] Add `--fail-above` option to `mix xref`
    [mix xref] Add `--label compile-connected` to `mix xref`
  * 2. Bug fixes
    EEx
    [EEx] Accept comments in EEx between do and the first clause
    [EEx] Accept EEx expressions where `-&gt;` is followed by newline
    Elixir
    [Application] Allow any expression as first argument of `compile_env`
    [Application] Warn if `Application.compile_env` or `Application.compile_env!` are called without a require
    [Code] Make sure `:static_atoms_encoder` in `Code.string_to_quoted/2` also applies to quoted keyword keys
    [Code] Ensure bindings with no context are returned as atoms instead of `{binding, nil}` in eval operations
    [Inspect] Fix a bug when inspecting a non-binary bitstring with colors
    [Kernel] Reject bidirectional formatting characters in strings and comments
    [Kernel] Support escaping of terminators in uppercase sigils heredocs for consistency
    [Kernel] Raise if `__CALLER__` or `__ENV__` or `__STACKTRACE__` are used in match
    [Kernel] Improve error message on invalid argument for `byte_size` from binary concat
    [Kernel] Raise when aliasing non-Elixir modules without `:as`
    [Kernel] Allow `unquote_splicing` inside `%{...}` without parens
    [Kernel] Ensure that waiting on a struct expansion inside a typespec is correctly tracked as waiting time in the compiler
    [Kernel] Correctly parse the atom `.` as a keyword list key
    [Kernel] Do not leak variables from the first generator in `with` and `for` special forms
    [Kernel] Fix column number on strings with NFD characters
    [Kernel] Fix a bug where a combination of dynamic line in `quote` with `unquote` of remote calls would emit invalid AST metadata
    [OptionParser] Validate switch types/modifiers early on to give more precise feedback
    [Protocol] Add `defdelegate` to the list of unallowed macros inside protocols as protocols do not allow function definitions
    [Protocol] Warn if `@callback`, `@macrocallback` and `@optional_callbacks` are defined inside protocol
    [Protocol] Ensure protocol metadata is deterministic on consolidation
    [Range] Always show step when range is descending
    [String] Update Unicode database to version 14.0
    [URI] Only percent decode if followed by hex digits (according to https://url.spec.whatwg.org/#percent-decode)
    [Version] Ensure proper precedence of `and`/`or` in version requirements
    ExUnit
    [ExUnit] Fix formatter and counters from `ExUnit.run/0` to consider all tests in a module whenever if a module's `setup_all` fails
    [ExUnit] Allow doctests newlines to be terminated by CRLF
    IEx
    [IEx] Fix the loss of `.iex.exs` context after a pry session
    [IEx] Stop evaluator before exiting IEx server to avoid evaluators leaking
    Logger
    [Logger] Raise clear error message for invalid `:compile_time_purge_matching` configuration
    [Logger] Fix a bug where Logger would not reset its discard counter under some scenarios
    Mix
    [mix compile.elixir] Track transitive runtime dependencies coming from local/path dependencies
    [mix compile.elixir] Recompile file if `@external_resource` is deleted
    [mix compile.elixir] Print number of compiling files on all compiler cycles. This will make the `Compiling N files (.ex)` show up multiple times if necessary
    [mix deps] Raise if local dep is unavailable while compiling
    [mix deps.unlock] Fix blank output when unlocking a dependency that is not locked
    [mix local.install] Do not respect `MIX_DEPS_PATH` for install commands
    [mix release] Improve release scripts by making sure shell errors cascade (this is done by avoiding exporting and defining variables in a single step)
    [mix release] Do not boot release if `RELEASE_COOKIE` is empty
    [mix release] Allow releases running as a daemon to be restarted
    [mix release] Raise proper error message when non-serializable values are in configs
    [mix test] Fix coverage engine to also tag `case`, `cond`, and `receive` branches where the right side is a literal
  * 3. Soft-deprecations (no warnings emitted)
    Elixir
    [Code] Environment options in `Code.eval_quoted/3` and `Code.eval_string/3`, such as `:aliases` and `:tracers`, have been deprecated in favor of passing an environment
    [IO] `:all` on `IO.getn` is deprecated in favor of `:eof`
    [URI] `URI.parse/1` is deprecated in favor of `URI.new/1` and `URI.new!/1`
    Mix
    [mix format] `Mix.Tasks.Format.formatter_opts_for_file/2` is deprecated in favor of `Mix.Tasks.Format.formatter_for_file/2`
  * 4. Hard-deprecations
    Elixir
    [Code] `Code.cursor_context/2` is deprecated, use `Code.Fragment.cursor_context/2` instead
    [Macro] `Macro.to_string/2` is deprecated, use `Macro.to_string/1` instead
    [System] `System.get_pid/0` is deprecated, use `System.pid/0` instead
    [Version] Using `!` or `!=` in version requirements is deprecated, use `~&gt;` or `&gt;=` instead
    Mix
    [mix escript.build] `:strip_beam` option is deprecated in favor of `:strip_beams`
    [Mix] `:exit_code` in `Mix.raise/2` has been deprecated in favor of `:exit_status`
    [Mix.Config] `Mix.Config` is deprecated in favor of `Config` module
  Full release notes: https://github.com/elixir-lang/elixir/releases/tag/v1.13.0
  - Drop 0001-Add-retries-to-tests-that-write-to-stderr-on-Windows.patch:
  upstreamed</changelog>
  <changelog author="dev@mail.smarquardt.space" date="1641470401">- Elixir 1.13.1
  * 1. Bug fixes
    Elixir
    [Code] Do not show code snippets in `SyntaxError` and `TokenMissingError` if line is empty
    [Exception] Do not fail blaming `ArgumentError` for improper lists on `apply/3`
    [Macro] Set a max `line_length` for `Macro.to_string/1`
    [Macro] Fix formatting of lists on module attributes for `Macro.to_string/1`
    [String] Fix incorrect codepoint byte counting in `slice` with negative positions in ranges
    [Task] Ensure async streams can be consumed from another process than the one that creates them
    [URI] Undeprecate `URI.parse/1` as `URI.new/1` is too strict in many common cases
    [URI] Make sure `URI.new/1` returns nil for empty paths
    IEx
    [IEx] Make sure the `--version` flag halts IEx
    Mix
    [Mix] Make protocol consolidation part of the `Mix.install/2` cache</changelog>
  <changelog author="fabrizio.sestito@suse.com" date="1642161600">- Elixir 1.13.2
  * 1. Enhancements
    Mix
    [mix format] Allow plugins to also format .ex and .exs files
    [mix release] Allow bypassing application mode validation in release spec
    [mix test] Print a message when the suite fails due to the coverage threshold
  * 2. Bug fixes
    Elixir
    [Code] Do not emit warnings on Code.Fragment.container_cursor_to_quoted/2
    [Kernel] Fix a crash when a for-comprehension with :uniq was used inside another comprehension with :uniq
    [Kernel] Ensure env.context_modules is properly set inside optimized defmodule
    [Keyword] Deprecate the recently added Keyword.map/2 as it is equivalent to Keyword.new/2
    [Map] Deprecate the recently added Map.map/2 as it is equivalent to Map.new/2
    [Protocol] Warn on zero arity callbacks inside protocols</changelog>
  <changelog author="fabrizio.sestito@suse.com" date="1645531200">- Elixir 1.13.3
  * 1. Enhancements
    Mix
    [mix format] Supply file and line to formatter plugins
    [mix format] Support embedded Elixir expressions inside formatter plugins
  * 2. Bug fixes
    Elixir
    [Code] Fix duplicate bindings causing errors during evaluation
    [Kernel] Make sure signatures stored in the Documentation chunk does not contain newlines
    [Kernel] Fix infinite loop when compiling guards with recursive map access
    [Macro] Fix error on Macro.to_string/1 when the plain alias Elixir is given
    [String] Fix error for certain codepoint combinations in String.split_at/2
    Mix
    [mix compile] Recompile project files when exports from dependencies change
    [mix test] Fix total coverage always showing in red even when above the threshold</changelog>
  <changelog author="fabrizio.sestito@suse.com" date="1649505600">- Elixir 1.13.4
  * 1. Enhancements
    Elixir
    [Code] Allow iodata to be returned in sigil formatting functions
    [Code] Pass opening delimiter information to sigil formatting functions
  * 2. Bug fixes
    Elixir
    [Kernel] Tweak type unification to fix infinite loop with recursive vars
    [Kernel] Add compile-time dependencies on require
    [Registry] Make Registry send work with named triplets
  * 3. Deprecations
    Mix
    [mix rebar] Deprecate Rebar 2 as it no longer works on Erlang/OTP 25</changelog>
  <changelog author="fabrizio.sestito@suse.com" date="1662552000">- Elixir 1.14
  * 1. Enhancements
    EEx
    [EEx] Support multi-line comments to EEx via &lt;%!-- --%&gt;
    [EEx] Add EEx.tokenize/2
    Elixir
    [Access] Add Access.slice/1
    [Application] Add Application.compile_env/4 and Application.compile_env!/3 to read the compile-time environment inside macros
    [Calendar] Support ISO8601 basic format parsing with DateTime.from_iso8601/2
    [Calendar] Add day/hour/minute on add/diff across different calendar modules
    [Code] Add :normalize_bitstring_modifiers to Code.format_string!/2
    [Code] Emit deprecation and type warnings for invalid options in on Code.compile_string/2 and Code.compile_quoted/2
    [Code] Warn if an outdated lexical tracker is given on eval
    [Code] Add Code.env_for_eval/1 and Code.eval_quoted_with_env/3
    [Code] Improve stacktraces from eval operations on Erlang/OTP 25+
    [Code.Fragment] Add support for __MODULE__ in several functions
    [Code.Fragment] Support surround and context suggestions across multiple lines
    [Enum] Allow slicing with steps in Enum.slice/2
    [File] Support dereference_symlinks: true in File.cp/3 and File.cp_r/3
    [Float] Do not show floats in scientific notation if below 1.0e16 and the fractional value is precisely zero
    [Float] Add Float.min_finite/0 and Float.max_finite/0
    [Inspect] Improve error reporting when there is a faulty implementation of the Inspect protocol
    [Inspect] Allow :optional when deriving the Inspect protocol for hiding fields that match their default value
    [Inspect] Inspect struct fields in the order they are declared in defstruct
    [Inspect] Use expression-based inspection for Date.Range, MapSet, and Version.Requirement
    [IO] Support Macro.Env and keywords as stacktrace definitions in IO.warn/2
    [IO] Add IO.ANSI.syntax_colors/0 and related configuration to be shared across IEx and dbg
    [Kernel] Add new dbg/0-2 macro
    [Kernel] Allow any guard expression as the size of a bitstring in a pattern match
    [Kernel] Allow composite types with pins as the map key in a pattern match
    [Kernel] Print escaped version of control chars when they show up as unexpected tokens
    [Kernel] Warn on confusable non-ASCII identifiers
    [Kernel] Add .. as a nullary operator that returns 0..-1//1
    [Kernel] Implement Unicode Technical Standard #39 recommendations. In particular, we warn for confusable scripts and restrict identifiers to single-scripts or highly restrictive mixed-scripts
    [Kernel] Automatically perform NFC conversion of identifiers
    [Kernel] Add binary_slice/2 and binary_slice/3
    [Kernel] Lazily expand module attributes to avoid compile-time deps
    [Kernel] Automatically cascade generated: true annotations on macro expansion
    [Keyword] Add Keyword.from_keys/2 and Keyword.replace_lazy/3
    [List] Add List.keysort/3 with support for a sorter function
    [Macro] Add Macro.classify_atom/1 and Macro.inspect_atom/2
    [Macro] Add Macro.expand_literal/2 and Macro.path/2
    [Macro.Env] Add Macro.Env.prune_compile_info/1
    [Map] Add Map.from_keys/2 and Map.replace_lazy/3
    [MapSet] Add MapSet.filter/2, MapSet.reject/2, and MapSet.symmetric_difference/2
    [Node] Add Node.spawn_monitor/2 and Node.spawn_monitor/4
    [Module] Support new @after_verify attribute for executing code whenever a module is verified
    [PartitionSupervisor] Add PartitionSupervisor that starts multiple isolated partitions of the same child for scalability
    [Path] Add Path.safe_relative/1 and Path.safe_relative_to/2
    [Registry] Add Registry.count_select/2
    [Stream] Add Stream.duplicate/2 and Stream.transform/5
    [String] Support empty lookup lists in String.replace/3, String.split/3, and String.splitter/3
    [String] Allow slicing with steps in String.slice/2
    [Task] Add :zip_input_on_exit option to Task.async_stream/3
    [Task] Store :mfa in the Task struct for reflection purposes
    [URI] Add URI.append_query/2
    [Version] Add Version.to_string/1
    [Version] Colorize Version.Requirement source in the Inspect protocol
    ExUnit
    [ExUnit] Add ExUnit.Callbacks.start_link_supervised!/2
    [ExUnit] Add ExUnit.run/1 to rerun test modules
    [ExUnit] Colorize summary in yellow with message when all tests are excluded
    [ExUnit] Display friendly error when test name is too long
    IEx
    [IEx] Evaluate --dot-iex line by line
    [IEx] Add line-by-line evaluation of IEx breakpoints
    [IEx.Autocomplete] Autocomplete bitstrings modifiers (after :: inside &lt;&lt;...&gt;&gt;)
    [IEx.Helpers] Allow an atom to be given to pid/1
    [IEx.Helpers] Support sigils in h/1
    Logger
    [Logger] Add Logger.put_process_level/2
    Mix
    [Mix] Add :config_path and :lockfile options to Mix.install/2
    [mix compile] Add --no-optional-deps to skip optional dependencies to test compilation works without optional dependencies
    [mix compile] Include column information on error diagnostics when possible
    [mix deps] Mix.Dep.Converger now tells which deps formed a cycle
    [mix do] Support --app option to restrict recursive tasks in umbrella projects
    [mix do] Allow using + as a task separator instead of comma
    [mix format] Support filename in mix format - when reading from stdin
    [mix format] Compile if mix format plugins are missing
    [mix new] Do not allow projects to be created with application names that conflict with multi-arg Erlang VM switches
    [mix profile] Return the return value of the profiled function
    [mix release] Make BEAM compression opt-in
    [mix release] Let :runtime_config_path accept false to skip the config/runtime.exs
    [mix test] Improve error message when suite fails due to coverage
    [mix test] Support :test_elixirc_options and default to not generating docs nor debug info chunk for tests
    [mix xref] Support --group flag in mix xref graph
  * 2. Bug fixes
    Elixir
    [Calendar] Handle widths with "0" in them in Calendar.strftime/3
    [CLI] Improve errors on incorrect --rpc-eval usage
    [CLI] Return proper exit code on Windows
    [Code] Do not emit warnings when formatting code
    [Enum] Allow slices to overflow on both starting and ending positions
    [Kernel] Do not allow restricted characters in identifiers according to UTS39
    [Kernel] Define __exception__ field as true when expanding exceptions in typespecs
    [Kernel] Warn if any of True, False, and Nil aliases are used
    [Kernel] Warn on underived @derive attributes
    [Kernel] Remove compile-time dependency from defimpl :for
    [Kernel] Track all arities on imported functions
    [Kernel] Fix equality in guards for dynamic ranges without steps
    [Module] Fix loop while unifying type variables
    [Protocol] Warn if a protocol has no definitions
    [Regex] Show list options when inspecting a Regex manually defined with Regex.compile/2
    [String] Allow slices to overflow on both starting and ending positions
    [System] Raise non-generic exception on missing env in System.fetch_env!/1 to mirror map operations
    ExUnit
    [ExUnit] Do not crash when diffing unknown bindings in guards
    [ExUnit] Properly print diffs when comparing improper lists with strings at the tail position
    [ExUnit] Add short hash to tmp_dir in ExUnit to avoid test name collision
    [ExUnit] Do not store logs in the CLI formatter (this reduces memory usage for suites with capture_log)
    [ExUnit] Run ExUnit.after_suite/1 callback even when no tests run
    [ExUnit] Fix scenario where setup with imported function from within describe failed to compile
    IEx
    [IEx] Disallow short-hand pipe after matches
    [IEx] Fix exports/1 in IEx for long function names
    Mix
    [mix compile.elixir] Fix --warnings-as-errors when used with --all-warnings
    [mix compile.elixir] Ensure semantic recompilation cascades to path dependencies
    [mix compile.elixir] Lock the compiler to avoid concurrent usage
    [mix format] Do not add new lines if the formatted file is empty
    [mix format] Properly compile dependencies on mix format
    [mix release] Only set RELEASE_MODE after env.{sh,bat} are executed
    [mix release] Allow application mode configuration to cascade to dependencies
    [mix xref] Do not emit already consolidated warnings during mix xref trace
    [Mix] Do not start apps with runtime: false on Mix.install/2
  * 3. Soft deprecations (no warnings emitted)
    Elixir
    [File] Passing a callback as third argument to File.cp/3 and File.cp_r/3 is deprecated.
    Instead pass the callback the :on_conflict key of a keyword list
    EEx
    [EEx] Using &lt;%# ... %&gt; for comments is deprecated. Please use &lt;% # ... %&gt; or the new multi-line comments with &lt;%!-- ... --%&gt;
    Logger
    [Logger] Deprecate Logger.enable/1 and Logger.disable/1 in favor of Logger.put_process_level/2
    Mix
    [mix cmd] The --app option in mix cmd CMD is deprecated in favor of the more efficient mix do --app app cmd CMD
  * 4. Hard deprecations
    Elixir
    [Application] Calling Application.get_env/3 and friends in the module body is now discouraged, use Application.compile_env/3 instead
    [Bitwise] use Bitwise is deprecated, use import Bitwise instead
    [Bitwise] ~~~ is deprecated in favor of bnot for clarity
    [Kernel.ParallelCompiler] Returning a list or two-element tuple from :each_cycle is deprecated, return a {:compile | :runtime, modules, warnings} tuple instead
    [Kernel] Deprecate the operator &lt;|&gt; to avoid ambiguity with upcoming extended numerical operators
    [String] Deprecate passing a binary compiled pattern to String.starts_with?/2
    Logger
    [Logger] Deprecate $levelpad on message formatting
    Mix
    [Mix] Mix.Tasks.Xref.calls/1 is deprecated in favor of compilation tracers
  * 5. Backwards incompatible changes
    Mix
    [mix local.rebar] Remove support for rebar2, which has not been updated in 5 years, and is no longer supported on recent Erlang/OTP versions</changelog>
  <changelog author="fabrizio.sestito@suse.com" date="1673352000">- Elixir 1.14.2
  * 1. Enhancements
    Elixir
    [Code] Add Code.eval_quoted_with_env/4 with support for the :prune_binding option
    ExUnit
    [ExUnit.Case] Allow test cases to not be registered on use
    [ExUnit.DocTest] Include :doctest and :doctest_line as meta tags
    [ExUnit.Formatter] Expose ExUnit.Formatter.format_assertion_diff/4
    Mix
    [Mix] Mix.install/2 accepts atoms as paths
  * 2. Bug fixes
    Elixir
    [Code.Formatter] Fix size*unit shortcut in bitstring
    [Kernel] Generate unique variables for macro expansion of defguard
    [Protocol] Expand :for in protocols with the appropriate env
    ExUnit
    [ExUnit] Do not run duplicate cases on ExUnit.run/1
    Mix
    [mix test] Ensure proper error message when there is no test directory
- Elixir 1.14.1
  * 1. Enhancements
    Elixir
    [Kernel] Perform partial expansion of literals in module attributes
    [Kernel] Do not add compile-time dependencies for literals as defaults in Application.compile_env/3 inside module attributes
    [Macro] Add Macro.expand_literals/2 and Macro.expand_literals/3
    [System] Add :close_stdin to System.shell/2
    Mix
    [mix test] Accept --all-warnings option
  * 2. Bug fixes
    Elixir
    [Kernel] Fix misleading warning when :uniq is given in for comprehensions and the result is unused
    [Kernel] Improve error message for when there is a conflicting struct and ignoring module conflict
    [Kernel] Do not delete @enforce_keys attribute after defstruct declaration
    [Kernel] Do not crash the checker on modules with missing :debug_info chunk
    [Macro] Fix error in Macro.to_string/2 when converting an AST with :erlang.binary_to_atom/2
    [String] Fix String.split/3 and String.next_grapheme/1 returning invalid results on invalid UTF-8 encoding
    [System] Do not close stdin by default in System.shell/2
    [URI] Do not return uri.port as :undefined in certain cases in URI.new/1
    ExUnit
    [ExUnit.DocTest] Do not crash when both :moduledoc and functions are specified in :only
    IEx
    [CLI] Fix invalid argument handling when --no-pry is given
    Mix
    [mix format] Do not cache inputs from .formatter.exs so they are properly re-evaluted on every call</changelog>
  <changelog author="pirateclip@protonmail.com" date="1675771200">- Drop git as a requires and switch buildrequires from git to git-core
  * Git is not needed to use Elixir, only to run some tests
  (which git-core can accomplish on its own without git)</changelog>
  <changelog author="dimstar@opensuse.org" date="1683201600">- Add _multibuild to define 2nd spec file as additional flavor.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1699704000">- Update to Elixir 1.15.7:
  * Fix build for Erlang 26
  * Changelog available at https://hexdocs.pm/elixir/1.15.7/changelog.html
- Add 0001-Use-PID-valid-for-32-bit-systems-closes-12741.patch:
  * Fix build for 32bit
- Add 0001-Use-PID-valid-for-32-bit-systems-followup-to-12741-1.patch:
  * Fix build for 32bit</changelog>
  <changelog author="sflees@suse.de" date="1699876800">- Switch from %patch0 to %autosetup</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1700568000">- Use pregenerated documentation</changelog>
</package>
<package pkgid="34456704a2c98cd8ffb4176dcb60152a5122bdf3eca571f381f0751981f38748" name="elixir115" arch="src">
  <version epoch="0" ver="1.15.7" rel="150300.7.5.1"/>
  <changelog author="dev@mail.smarquardt.space" date="1604491200">- Elixir 1.11.2
  * Bug fixes
    Elixir
    [Code] Do not crash when getting docs for missing `erts` appdir
    [Kernel] Raise meaningful error if `:erlang.is_record` is used in guards
    [Kernel] Prune tracers when fetching `__ENV__` inside functions
    Mix
    [mix] Fix regression where aliases could not call themselves recursively
    [mix compile] Do not discard tracers that are set programatically</changelog>
  <changelog author="dev@mail.smarquardt.space" date="1610366400">- Elixir 1.11.3
  * Enhancements
    Elixir
    [Macro] Add Macro.unique_var/2 and Macro.generate_unique_arguments/2
  * Bug fixes
    Elixir
    [Code] Do not raise when checking for operator ambiguity when :static_atoms_encoder is set in Code.string_to_quoted
    [Kernel] Emit undefined function warnings from with
    [Kernel] Do not fail type checking when literals are used in guards
    [Module] Do not warn for attributes used in @after_compile
    [Record] Make sure nested record names do not clobber each other
    ExUnit
    [ExUnit.Assertions] Do not crash if there are macros and module attributes on the left side of ++
    IEx
    [IEx.Helpers] Do not use Unicode chars if ANSI is disabled
    Mix
    [mix deps.compile] Fix compatibility with rebar v3.14
    [mix release] Do not use private ram_file:compress/1
    [mix xref] Do not crash when retrieving calls for modules in memory</changelog>
  <changelog author="dev@mail.smarquardt.space" date="1616155200">- Elixir 1.11.4
  * Enhancements
    Elixir
    [Kernel] Update formatting when printing warnings and errors from Erlang/OTP 24+
    [Kernel] Support float-16 on bitstrings
    Mix
    [mix local.rebar] This task will now install rebar3 version 3.14.4, compiled with Erlang/OTP 21</changelog>
  <changelog author="dev@mail.smarquardt.space" date="1623672000">- Elixir 1.12
  * Enhancements
    EEx
    [EEx.Engine] Add `c:EEx.Engine.handle_text/3` callback that receives text metadata
    [EEx.Engine] Emit warnings for unused "do" expression in EEx
    Elixir
    [Code] Add `Code.cursor_context/2` to return the context of a code snippet
    [Code] Do not add newlines around interpolation on code formatting.
    Note this means formatted code that has interpolation after the line length on Elixir v1.12 won't be considered as formatted on earlier Elixir versions
    [Code] Do not add brackets when keywords is used in the access syntax
    [Calendar] Support basic datetime format in `Calendar.ISO` parsing functions
    [Code] Improve evaluation performance on systems running on Erlang/OTP 24+
    [Date] Support steps via `Date.range/3`
    [DateTime] Add `offset` to `DateTime.to_iso8601/2` (now `to_iso8601/3`)
    [Enum] Add `Enum.count_until/2` and `Enum.count_until/3`
    [Enum] Add `Enum.product/1`
    [Enum] Add `Enum.zip_with/2`, `Enum.zip_with/3`, `Enum.zip_reduce/3`, and `Enum.zip_reduce/4`
    [Enum] Add support for functions as the second argument of `Enum.with_index/2`
    [Exception] Show `error_info` data for exceptions coming from Erlang
    [Float] Add `Float.pow/2`
    [Integer] Add `Integer.pow/2` and `Integer.extended_gcd/2`
    [IO] Add `IO.stream/0` and `IO.binstream/0` which default to STDIO with line orientation
    [List] Add default value for `List.first/1` and `List.last/1`
    [Kernel] Add `first..last//step` as support for stepped ranges
    [Kernel] Also warn for literal structs on `min/2` and `max/2`
    [Kernel] Add `Kernel.tap/2` and `Kernel.then/2`
    [Kernel] Do not add runtime dependencies to remotes in typespecs
    [Kernel] When there is an unused variable warning and there is a variable with the same name previously defined, suggest the user may have wanted to use the pin operator
    [Kernel] Improve error messages on invalid character right after a number
    [Kernel] Show removal and deprecated tips from Erlang/OTP
    [Macro] Add export dependencies on `Macro.struct!/2`
    [Macro] Support `:newline` to customize newlines escaping in `Macro.unescape_string/2`
    [Module] Raise on invalid `@dialyzer` attributes
    [Module] Add `Module.get_definition/2` and `Module.delete_definition/2`
    [Module] Allow `@on_load` to be a private function
    [Module] Validate `@dialyzer` related module attributes
    [Module] Add `Module.reserved_attributes/0` to list all reserved attributes by the language
    [Range] Add `Range.new/3` and `Range.size/1`
    [Regex] Add offset option to `Regex.scan/3` and `Regex.run/3`
    [Registry] Support `:compression` on `Registry` tables
    [Registry] Support `Registry.values/3` for reading values under a given key-pid pair
    [Stream] Add `Stream.zip_with/2` and `Stream.zip_with/3`
    [String] Add `:turkic` mode option to String case functions
    [String] Update to Unicode 13.0
    [System] Add `System.trap_signal/3` and `System.untrap_signal/2`
    [System] Add `System.shell/2` to invoke a command that is interpreted by the shell
    [Tuple] Add `Tuple.sum/1` and `Tuple.product/1`
    [URI] Support RFC3986 compliant encoding and decoding of queries via the `:rfc3986` option
    ExUnit
    [ExUnit] Intercept SIGQUIT (via Ctrl+\\) and show a list of all aborted tests as well as intermediate test results
    [ExUnit] Interpolate module attributes in match assertions diffs
    [ExUnit] Print how much time is spent on `async` vs `sync` tests
    [ExUnit] Improve error messages for doctests
    [ExUnit] Compile doctests faster (often by two times)
    [ExUnit] Add `ExUnit.async_run/0` and `ExUnit.await_run/1`
    IEx
    [IEx] Make IEx' parser configurable to allow special commands
    [IEx] Show function signature when pressing tab after the opening parens of a function
    [IEx] If an IEx expression starts with a binary operator, such as `|&gt;`, automatically pipe in the result of the last expression
    Mix
    [Mix] Add `Mix.install/2` for dynamically installing a list of dependencies
    [Mix] Support `:exit_code` option in `Mix.raise/2`
    [Mix] Discard `MIX_ENV` and `MIX_TARGET` values if they are empty strings
    [Mix] Print the time taken to execute a task with on `MIX_DEBUG=1`
    [mix compile.erlang] Compile multiple files in parallel
    [mix escript.build] Deep merge configuration and ensure argv is set when executing `config/runtime.exs`
    [mix release] Add `RELEASE_PROG` to releases with the name of the executable starting the release
    [mix release] Support `remote.vm.args` to customize how the connecting VM boots
    [mix test] Run all available tests if there are no pending `--failed` tests. This provides a better workflow as you no longer need to toggle the `--failed` flag between runs
  * Bug fixes
    Elixir
    [CLI] Ensure `-e ""` (with an empty string) parses correctly on Windows
    [Inspect] Do not override user supplied `:limit` option for derived implementations
    [Kernel] Allow heredoc inside a heredoc interpolation
    [Kernel] Preserve CRLF on heredocs
    [Kernel] Public functions without documentation now appear as an empty map on `Code.fetch_docs/1`,
    unless they start with underscore, where they remain as `:none`. This aligns Elixir's implementation with EEP48
    [Kernel] Do not crash when complex literals (binaries and maps) are used in guards
    [Kernel] Properly parse keywords (such as `end`) followed by the `::` operator
    [Kernel] Do not ignore unimplemented signatures from generated functions
    [Kernel] Improve error message when an expression follows a keyword list without brackets
    [Macro] `Macro.decompose_call/1` now also consider tuples with more than 2 elements to not be valid calls
    [Macro] Fix `Macro.to_string/1` double-escaping of escape characters in sigils
    [Macro] Fix `Macro.underscore/1` on digits preceded by capitals: "FOO10" now becomes "foo10" instead of "fo_o10"
    [Macro] Preserve underscores between digits on `Macro.underscore/1`
    [OptionParser] Properly parse when numbers follow-up aliases, for example, `-ab3` is now parsed as `-a -b 3`
    [Path] Fix `Path.relative_to/2` when referencing self
    [Path] Do not crash when a volume is given to `Path.absname/1`, such as "c:"
    [Task] Ensure `Task.async_stream/2` with `ordered: false` discard results as they are emitted, instead of needlessly accumulating inside the stream manager
    [Task] Raise if `:max_concurrency` is set to 0 on streaming operations
    [URI] Do not discard empty paths on `URI.merge/2`
    ExUnit
    [ExUnit.Case] Make `@tag tmp_dir` an absolute directory, avoiding inconsistencies if the test changes the current working directory
    [ExUnit.Diff] Fix cases where the diffing algorithm would fail to print a pattern correct
    IEx
    [IEx] Fix auto-completion inside remote shells
    Mix
    [mix app.config] Do not emit false positive warnings when configured dependencies that have `runtime: false` set
    [mix compile.elixir] Ensure that a manifest is generated even with no source code
    [mix compile.elixir] Make sure export dependencies trigger recompilation when the dependency is removed as well as when the whole file is removed
    [mix compile.elixir] Do not emit false positive warnings when a path dependency adds a module that is then used by the current application in the same `mix compile` cycle
    [mix test] Ensure protocols within the current project are consolidated when `--cover` is given
    [mix release] Improve compliance of release scripts with stripped down Linux installations
    [mix release] Preserve file mode when copying non-beam ebin files
    [mix xref] Ensure args are passed to the underlying `mix compile` call
  * Soft-deprecations (no warnings emitted)
    Elixir
    [Kernel] Using `first..last` to match on ranges is soft-deprecated and will warn on future Elixir versions. Use `first..last//step` instead
    [Kernel] Using `first..last` to create decreasing ranges is soft-deprecated and will warn on future versions. Use `first..last//-1` instead
  * Hard-deprecations
    EEx
    [EEx.Engine] `use EEx.Engine` is deprecated in favor of explicit delegation
    Elixir
    [Kernel] The binary operator `^^^` is deprecated. If you are using `Bitwise.^^^/2`, use `Bitwise.bxor/2` instead
    [Kernel] Deprecate `@foo()` in favor of `@foo`
    [System] Deprecate `System.stacktrace/0` (it was already deprecated outside of catch/rescue and now it is deprecated everywhere)
    Mix
    [mix compile] The `:xref` compiler is deprecated and it has no effect. Please remove it from your mix.exs file.
    Full release notes: https://github.com/elixir-lang/elixir/releases/tag/v1.12.0</changelog>
  <changelog author="dev@mail.smarquardt.space" date="1623672001">- Elixir 1.12.1
  * Bug fixes
    Elixir
    [Code] Make sure `Code.format_string!/2` formats multiline expression inside interpolation on the first run
    [Macro] Revert keeping of underscores between digits in camelize
    Mix
    [Mix] Make sure `Mix.install/2` expand paths for deps
    [mix deps.get] Silence false positives on `httpc` warnings
    [mix test] Do not run the whole suite when there are no --failed tests as it won't behave as expected inside umbrellas</changelog>
  <changelog author="dev@mail.smarquardt.space" date="1626091200">- Elixir 1.12.2
  * Bug fixes
    Elixir
    [Kernel] Ensure deprecated macros emit warnings
    Mix
    [mix deps] Ensure unconstrained rebar deps generate valid mix specifications
  * Enhancements
    Elixir
    [elixirc] Change the output of `--profile time` to make it easier to detect outliers
    [Application] Do not add compile time deps on args to `Application.compile_env/2` and `Application.compile_env!/2`
    [Enum] Optimize `Enum.into/3` and `Map.new/2`
    Mix
    [mix compile] Compile most recently changed files first
    [mix compile, mix run, mix test] Speed up the time taken to load dependencies. This should make the usage of Mix inside projects quite more responsive</changelog>
  <changelog author="dev@mail.smarquardt.space" date="1632830400">- Elixir 1.12.3
  * Bug fixes
    Elixir
    [Code] Make sure that bindings in the default context returned by `Code.eval_*` functions are not returned as tagged tuples
    [Kernel] Do not crash when handling ambiguity errors
    [Range] Still match on old range patterns throughout the stdlib
    IEx
    [IEx.Autocomplete] Do not error autocompletion with module attribute
    Mix
    [Mix] Rename inconsistent `:exit_code` option to `:exit_status` on `Mix.raise/2`</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1636113600">- Add 0001-Add-retries-to-tests-that-write-to-stderr-on-Windows.patch:
  fix build for Factory</changelog>
  <changelog author="dev@mail.smarquardt.space" date="1641470400">- Elixir 1.13.0
  * Enhancements
    EEx
    [EEx] Add `:parser_options` to EEx functions
    Elixir
    [Calendar] Add `c:Calendar.year_of_era/3` to support calendars where the beginning of a new era does not align with
    the beginning of a new year
    [CLI] Support `--short-version` on the CLI that does not boot the VM
    [Code] Add `Code.string_to_quoted_with_comments/2` and `Code.quoted_to_algebra/2`
    [Code] Add more `:token_metadata` to aliases and remote calls when parsing strings
    [Code] Add `Code.Fragment` module to provide best-effort information from code fragments.
    The module currently provides an updated `Code.Fragment.cursor_context/2` with operator support and
    `Code.Fragment.surround_context/2` which looks at a given position in a fragment and find its surrounding delimiters
    [Code] Allow custom sigil formatting on `Code.format_string!/2`
    [Code] Add `{:on_module, bytecode, :none}` trace to compilation tracers
    [Enum] Optimize `Enum.concat/1` for lists of lists
    [Enum] Add `Enum.slide/3`
    [Exception] Better format Elixir exceptions in Erlang
    [Inspect] Allow default inspect fun to be set globally with `Inspect.Opts.default_inspect_fun/1`
    [IO] Allow `:eof` to be given as limit to `IO.getn/2`
    [Kernel] Support the `:sigils` option in `import Mod, only: :sigils` and allow the sigil modifiers to be also digits
    [Kernel] Make `get_in` consistently abort and return `nil` when `nil` values are found (previously Elixir would raise
    an error in this case). This allows a user to use `get_in` as a safe navigation operator.
    [Kernel] Improve compilation times by reducing the amount of copies of the AST across compiler processes
    [Kernel] Raise if trying to define a module with a slash in its name
    [Kernel] Warn when `?\` is used and there is no need for a escape character
    [Kernel] Track structs in typespecs as export deps instead of compile-time deps
    [Kernel] Add power operator (`**/2`)
    [Keyword] Add `Keyword.validate/2`
    [Keyword] Implement `Keyword.filter/2` and `Keyword.map/2`
    [List] Add `List.keyfind!/3`
    [Macro] Add `Macro.prewalker/1` and `Macro.postwalker/1`
    [Macro.Env] Add the following reflection functions: `required?/2`, `lookup_import/2`, `fetch_alias/2`, and `fetch_macro_alias/2`
    [Map] Implement `Map.filter/2` and `Map.map/2`
    [Module] Support `:nillify_clauses` in `Module.get_definition/3`
    [Module] Add `Module.attributes_in/1` and `Module.overridables_in/1`
    [OptionParser] Add "did you mean?" suggestions to `OptionParser.ParseError` messages
    [Record] Add record reflection via `@__records__`
    [Task] Add `Task.completed/1`
    [Task] Add `Task.ignore/1` to keep a task running but ignoring all of its results
    [Task] Reduce the amount of copying `Task.async*` functions
    [URI] Add `URI.new/1` and `URI.new!/1`
    ExUnit
    [ExUnit] Show hint if comparing different but equivalent strings
    [ExUnit.CaptureIO] Add `with_io/3` to return result with captured io
    [ExUnit.CaptureLog] Add `with_log/2` to return result with captured logs
    IEx
    [IEx.Autocomplete] Add path autocompletion whenever when the cursor follows `"./` or `"/` or `"DRIVER:` where
    `DRIVER` is a single letter
    [IEx.Autocomplete] Add autocompletion for sigils, struct names, and struct fields
    [IEx.Helpers] Allow multiple modules to be given to `r/1`
    Logger
    [Logger] Add `Logger.put_application_level/2`
    [Logger] Print all log levels in accordance to Erlang/OTP. This also means `[warn]` is now shown as `[warning]`
    Mix
    [Mix] Add `MIX_INSTALL_FORCE` environment variable support
    [Mix] Support `:config` and `:system_env` in `Mix.install/2`
    [Mix] Add `Mix.installed?/0`
    [Mix.Shell] Add `:default` option to `Mix.Shell.yes?`
    [mix archive.install] Run `loadconfig` before building archive
    [mix compile] Move Elixir version check to before deps are compiled, in order to give feedback earlier
    [mix compile.elixir] Do not recompile files if their modification time change but their contents are still the same and the .beam files are still on disk
    [mix compile.elixir] Do not recompile all Elixir sources when Erlang modules change, only dependent ones
    [mix compile.elixir] Do not recompile Elixir files if `mix.exs` changes, instead recompile only files using `Mix.Project` or trigger a recompilation if a compiler option changes
    [mix compile.elixir] Only recompile needed files when a dependency is added, updated or removed
    [mix compile.elixir] Only recompile needed files when a dependency is configured
    [mix deps] Add `:subdir` option to git deps
    [mix escript.install] Run `loadconfig` before building escript
    [mix format] Support `:plugins` in `mix format` that can hook into custom extensions and sigils
    [mix format] Add `Mix.Tasks.Format.formatter_for_file/2`
    [mix local.rebar] No longer support `sub_dirs` in Rebar 2 to help migration towards Rebar 3
    [mix local.rebar] Support `--if-missing` option when installing Rebar
    [mix local.rebar] Set `REBAR_PROFILE=prod` when compiling Rebar dependencies
    [mix test] Support `--profile-require=time` to profile the time loading test files themselves
    [mix test] Allow filtering modules from coverage using regex
    [mix test] Allow the exit status of ExUnit to be configured and set the default to 2
    [mix test] Exit with a status of 3 when coverage falls below threshold
    [mix test] Write failed manifest when suite fails due to --warnings-as-errors
    [mix test] Ignore `MIX_TEST_PARTITION` when partitions set to 1
    [mix xref] Support multiple sinks and sources in `mix xref graph`
    [mix xref] Add `trace` subcommand to print compilation dependencies between files
    [mix xref] Add `--fail-above` option to `mix xref`
    [mix xref] Add `--label compile-connected` to `mix xref`
  * 2. Bug fixes
    EEx
    [EEx] Accept comments in EEx between do and the first clause
    [EEx] Accept EEx expressions where `-&gt;` is followed by newline
    Elixir
    [Application] Allow any expression as first argument of `compile_env`
    [Application] Warn if `Application.compile_env` or `Application.compile_env!` are called without a require
    [Code] Make sure `:static_atoms_encoder` in `Code.string_to_quoted/2` also applies to quoted keyword keys
    [Code] Ensure bindings with no context are returned as atoms instead of `{binding, nil}` in eval operations
    [Inspect] Fix a bug when inspecting a non-binary bitstring with colors
    [Kernel] Reject bidirectional formatting characters in strings and comments
    [Kernel] Support escaping of terminators in uppercase sigils heredocs for consistency
    [Kernel] Raise if `__CALLER__` or `__ENV__` or `__STACKTRACE__` are used in match
    [Kernel] Improve error message on invalid argument for `byte_size` from binary concat
    [Kernel] Raise when aliasing non-Elixir modules without `:as`
    [Kernel] Allow `unquote_splicing` inside `%{...}` without parens
    [Kernel] Ensure that waiting on a struct expansion inside a typespec is correctly tracked as waiting time in the compiler
    [Kernel] Correctly parse the atom `.` as a keyword list key
    [Kernel] Do not leak variables from the first generator in `with` and `for` special forms
    [Kernel] Fix column number on strings with NFD characters
    [Kernel] Fix a bug where a combination of dynamic line in `quote` with `unquote` of remote calls would emit invalid AST metadata
    [OptionParser] Validate switch types/modifiers early on to give more precise feedback
    [Protocol] Add `defdelegate` to the list of unallowed macros inside protocols as protocols do not allow function definitions
    [Protocol] Warn if `@callback`, `@macrocallback` and `@optional_callbacks` are defined inside protocol
    [Protocol] Ensure protocol metadata is deterministic on consolidation
    [Range] Always show step when range is descending
    [String] Update Unicode database to version 14.0
    [URI] Only percent decode if followed by hex digits (according to https://url.spec.whatwg.org/#percent-decode)
    [Version] Ensure proper precedence of `and`/`or` in version requirements
    ExUnit
    [ExUnit] Fix formatter and counters from `ExUnit.run/0` to consider all tests in a module whenever if a module's `setup_all` fails
    [ExUnit] Allow doctests newlines to be terminated by CRLF
    IEx
    [IEx] Fix the loss of `.iex.exs` context after a pry session
    [IEx] Stop evaluator before exiting IEx server to avoid evaluators leaking
    Logger
    [Logger] Raise clear error message for invalid `:compile_time_purge_matching` configuration
    [Logger] Fix a bug where Logger would not reset its discard counter under some scenarios
    Mix
    [mix compile.elixir] Track transitive runtime dependencies coming from local/path dependencies
    [mix compile.elixir] Recompile file if `@external_resource` is deleted
    [mix compile.elixir] Print number of compiling files on all compiler cycles. This will make the `Compiling N files (.ex)` show up multiple times if necessary
    [mix deps] Raise if local dep is unavailable while compiling
    [mix deps.unlock] Fix blank output when unlocking a dependency that is not locked
    [mix local.install] Do not respect `MIX_DEPS_PATH` for install commands
    [mix release] Improve release scripts by making sure shell errors cascade (this is done by avoiding exporting and defining variables in a single step)
    [mix release] Do not boot release if `RELEASE_COOKIE` is empty
    [mix release] Allow releases running as a daemon to be restarted
    [mix release] Raise proper error message when non-serializable values are in configs
    [mix test] Fix coverage engine to also tag `case`, `cond`, and `receive` branches where the right side is a literal
  * 3. Soft-deprecations (no warnings emitted)
    Elixir
    [Code] Environment options in `Code.eval_quoted/3` and `Code.eval_string/3`, such as `:aliases` and `:tracers`, have been deprecated in favor of passing an environment
    [IO] `:all` on `IO.getn` is deprecated in favor of `:eof`
    [URI] `URI.parse/1` is deprecated in favor of `URI.new/1` and `URI.new!/1`
    Mix
    [mix format] `Mix.Tasks.Format.formatter_opts_for_file/2` is deprecated in favor of `Mix.Tasks.Format.formatter_for_file/2`
  * 4. Hard-deprecations
    Elixir
    [Code] `Code.cursor_context/2` is deprecated, use `Code.Fragment.cursor_context/2` instead
    [Macro] `Macro.to_string/2` is deprecated, use `Macro.to_string/1` instead
    [System] `System.get_pid/0` is deprecated, use `System.pid/0` instead
    [Version] Using `!` or `!=` in version requirements is deprecated, use `~&gt;` or `&gt;=` instead
    Mix
    [mix escript.build] `:strip_beam` option is deprecated in favor of `:strip_beams`
    [Mix] `:exit_code` in `Mix.raise/2` has been deprecated in favor of `:exit_status`
    [Mix.Config] `Mix.Config` is deprecated in favor of `Config` module
  Full release notes: https://github.com/elixir-lang/elixir/releases/tag/v1.13.0
  - Drop 0001-Add-retries-to-tests-that-write-to-stderr-on-Windows.patch:
  upstreamed</changelog>
  <changelog author="dev@mail.smarquardt.space" date="1641470401">- Elixir 1.13.1
  * 1. Bug fixes
    Elixir
    [Code] Do not show code snippets in `SyntaxError` and `TokenMissingError` if line is empty
    [Exception] Do not fail blaming `ArgumentError` for improper lists on `apply/3`
    [Macro] Set a max `line_length` for `Macro.to_string/1`
    [Macro] Fix formatting of lists on module attributes for `Macro.to_string/1`
    [String] Fix incorrect codepoint byte counting in `slice` with negative positions in ranges
    [Task] Ensure async streams can be consumed from another process than the one that creates them
    [URI] Undeprecate `URI.parse/1` as `URI.new/1` is too strict in many common cases
    [URI] Make sure `URI.new/1` returns nil for empty paths
    IEx
    [IEx] Make sure the `--version` flag halts IEx
    Mix
    [Mix] Make protocol consolidation part of the `Mix.install/2` cache</changelog>
  <changelog author="fabrizio.sestito@suse.com" date="1642161600">- Elixir 1.13.2
  * 1. Enhancements
    Mix
    [mix format] Allow plugins to also format .ex and .exs files
    [mix release] Allow bypassing application mode validation in release spec
    [mix test] Print a message when the suite fails due to the coverage threshold
  * 2. Bug fixes
    Elixir
    [Code] Do not emit warnings on Code.Fragment.container_cursor_to_quoted/2
    [Kernel] Fix a crash when a for-comprehension with :uniq was used inside another comprehension with :uniq
    [Kernel] Ensure env.context_modules is properly set inside optimized defmodule
    [Keyword] Deprecate the recently added Keyword.map/2 as it is equivalent to Keyword.new/2
    [Map] Deprecate the recently added Map.map/2 as it is equivalent to Map.new/2
    [Protocol] Warn on zero arity callbacks inside protocols</changelog>
  <changelog author="fabrizio.sestito@suse.com" date="1645531200">- Elixir 1.13.3
  * 1. Enhancements
    Mix
    [mix format] Supply file and line to formatter plugins
    [mix format] Support embedded Elixir expressions inside formatter plugins
  * 2. Bug fixes
    Elixir
    [Code] Fix duplicate bindings causing errors during evaluation
    [Kernel] Make sure signatures stored in the Documentation chunk does not contain newlines
    [Kernel] Fix infinite loop when compiling guards with recursive map access
    [Macro] Fix error on Macro.to_string/1 when the plain alias Elixir is given
    [String] Fix error for certain codepoint combinations in String.split_at/2
    Mix
    [mix compile] Recompile project files when exports from dependencies change
    [mix test] Fix total coverage always showing in red even when above the threshold</changelog>
  <changelog author="fabrizio.sestito@suse.com" date="1649505600">- Elixir 1.13.4
  * 1. Enhancements
    Elixir
    [Code] Allow iodata to be returned in sigil formatting functions
    [Code] Pass opening delimiter information to sigil formatting functions
  * 2. Bug fixes
    Elixir
    [Kernel] Tweak type unification to fix infinite loop with recursive vars
    [Kernel] Add compile-time dependencies on require
    [Registry] Make Registry send work with named triplets
  * 3. Deprecations
    Mix
    [mix rebar] Deprecate Rebar 2 as it no longer works on Erlang/OTP 25</changelog>
  <changelog author="fabrizio.sestito@suse.com" date="1662552000">- Elixir 1.14
  * 1. Enhancements
    EEx
    [EEx] Support multi-line comments to EEx via &lt;%!-- --%&gt;
    [EEx] Add EEx.tokenize/2
    Elixir
    [Access] Add Access.slice/1
    [Application] Add Application.compile_env/4 and Application.compile_env!/3 to read the compile-time environment inside macros
    [Calendar] Support ISO8601 basic format parsing with DateTime.from_iso8601/2
    [Calendar] Add day/hour/minute on add/diff across different calendar modules
    [Code] Add :normalize_bitstring_modifiers to Code.format_string!/2
    [Code] Emit deprecation and type warnings for invalid options in on Code.compile_string/2 and Code.compile_quoted/2
    [Code] Warn if an outdated lexical tracker is given on eval
    [Code] Add Code.env_for_eval/1 and Code.eval_quoted_with_env/3
    [Code] Improve stacktraces from eval operations on Erlang/OTP 25+
    [Code.Fragment] Add support for __MODULE__ in several functions
    [Code.Fragment] Support surround and context suggestions across multiple lines
    [Enum] Allow slicing with steps in Enum.slice/2
    [File] Support dereference_symlinks: true in File.cp/3 and File.cp_r/3
    [Float] Do not show floats in scientific notation if below 1.0e16 and the fractional value is precisely zero
    [Float] Add Float.min_finite/0 and Float.max_finite/0
    [Inspect] Improve error reporting when there is a faulty implementation of the Inspect protocol
    [Inspect] Allow :optional when deriving the Inspect protocol for hiding fields that match their default value
    [Inspect] Inspect struct fields in the order they are declared in defstruct
    [Inspect] Use expression-based inspection for Date.Range, MapSet, and Version.Requirement
    [IO] Support Macro.Env and keywords as stacktrace definitions in IO.warn/2
    [IO] Add IO.ANSI.syntax_colors/0 and related configuration to be shared across IEx and dbg
    [Kernel] Add new dbg/0-2 macro
    [Kernel] Allow any guard expression as the size of a bitstring in a pattern match
    [Kernel] Allow composite types with pins as the map key in a pattern match
    [Kernel] Print escaped version of control chars when they show up as unexpected tokens
    [Kernel] Warn on confusable non-ASCII identifiers
    [Kernel] Add .. as a nullary operator that returns 0..-1//1
    [Kernel] Implement Unicode Technical Standard #39 recommendations. In particular, we warn for confusable scripts and restrict identifiers to single-scripts or highly restrictive mixed-scripts
    [Kernel] Automatically perform NFC conversion of identifiers
    [Kernel] Add binary_slice/2 and binary_slice/3
    [Kernel] Lazily expand module attributes to avoid compile-time deps
    [Kernel] Automatically cascade generated: true annotations on macro expansion
    [Keyword] Add Keyword.from_keys/2 and Keyword.replace_lazy/3
    [List] Add List.keysort/3 with support for a sorter function
    [Macro] Add Macro.classify_atom/1 and Macro.inspect_atom/2
    [Macro] Add Macro.expand_literal/2 and Macro.path/2
    [Macro.Env] Add Macro.Env.prune_compile_info/1
    [Map] Add Map.from_keys/2 and Map.replace_lazy/3
    [MapSet] Add MapSet.filter/2, MapSet.reject/2, and MapSet.symmetric_difference/2
    [Node] Add Node.spawn_monitor/2 and Node.spawn_monitor/4
    [Module] Support new @after_verify attribute for executing code whenever a module is verified
    [PartitionSupervisor] Add PartitionSupervisor that starts multiple isolated partitions of the same child for scalability
    [Path] Add Path.safe_relative/1 and Path.safe_relative_to/2
    [Registry] Add Registry.count_select/2
    [Stream] Add Stream.duplicate/2 and Stream.transform/5
    [String] Support empty lookup lists in String.replace/3, String.split/3, and String.splitter/3
    [String] Allow slicing with steps in String.slice/2
    [Task] Add :zip_input_on_exit option to Task.async_stream/3
    [Task] Store :mfa in the Task struct for reflection purposes
    [URI] Add URI.append_query/2
    [Version] Add Version.to_string/1
    [Version] Colorize Version.Requirement source in the Inspect protocol
    ExUnit
    [ExUnit] Add ExUnit.Callbacks.start_link_supervised!/2
    [ExUnit] Add ExUnit.run/1 to rerun test modules
    [ExUnit] Colorize summary in yellow with message when all tests are excluded
    [ExUnit] Display friendly error when test name is too long
    IEx
    [IEx] Evaluate --dot-iex line by line
    [IEx] Add line-by-line evaluation of IEx breakpoints
    [IEx.Autocomplete] Autocomplete bitstrings modifiers (after :: inside &lt;&lt;...&gt;&gt;)
    [IEx.Helpers] Allow an atom to be given to pid/1
    [IEx.Helpers] Support sigils in h/1
    Logger
    [Logger] Add Logger.put_process_level/2
    Mix
    [Mix] Add :config_path and :lockfile options to Mix.install/2
    [mix compile] Add --no-optional-deps to skip optional dependencies to test compilation works without optional dependencies
    [mix compile] Include column information on error diagnostics when possible
    [mix deps] Mix.Dep.Converger now tells which deps formed a cycle
    [mix do] Support --app option to restrict recursive tasks in umbrella projects
    [mix do] Allow using + as a task separator instead of comma
    [mix format] Support filename in mix format - when reading from stdin
    [mix format] Compile if mix format plugins are missing
    [mix new] Do not allow projects to be created with application names that conflict with multi-arg Erlang VM switches
    [mix profile] Return the return value of the profiled function
    [mix release] Make BEAM compression opt-in
    [mix release] Let :runtime_config_path accept false to skip the config/runtime.exs
    [mix test] Improve error message when suite fails due to coverage
    [mix test] Support :test_elixirc_options and default to not generating docs nor debug info chunk for tests
    [mix xref] Support --group flag in mix xref graph
  * 2. Bug fixes
    Elixir
    [Calendar] Handle widths with "0" in them in Calendar.strftime/3
    [CLI] Improve errors on incorrect --rpc-eval usage
    [CLI] Return proper exit code on Windows
    [Code] Do not emit warnings when formatting code
    [Enum] Allow slices to overflow on both starting and ending positions
    [Kernel] Do not allow restricted characters in identifiers according to UTS39
    [Kernel] Define __exception__ field as true when expanding exceptions in typespecs
    [Kernel] Warn if any of True, False, and Nil aliases are used
    [Kernel] Warn on underived @derive attributes
    [Kernel] Remove compile-time dependency from defimpl :for
    [Kernel] Track all arities on imported functions
    [Kernel] Fix equality in guards for dynamic ranges without steps
    [Module] Fix loop while unifying type variables
    [Protocol] Warn if a protocol has no definitions
    [Regex] Show list options when inspecting a Regex manually defined with Regex.compile/2
    [String] Allow slices to overflow on both starting and ending positions
    [System] Raise non-generic exception on missing env in System.fetch_env!/1 to mirror map operations
    ExUnit
    [ExUnit] Do not crash when diffing unknown bindings in guards
    [ExUnit] Properly print diffs when comparing improper lists with strings at the tail position
    [ExUnit] Add short hash to tmp_dir in ExUnit to avoid test name collision
    [ExUnit] Do not store logs in the CLI formatter (this reduces memory usage for suites with capture_log)
    [ExUnit] Run ExUnit.after_suite/1 callback even when no tests run
    [ExUnit] Fix scenario where setup with imported function from within describe failed to compile
    IEx
    [IEx] Disallow short-hand pipe after matches
    [IEx] Fix exports/1 in IEx for long function names
    Mix
    [mix compile.elixir] Fix --warnings-as-errors when used with --all-warnings
    [mix compile.elixir] Ensure semantic recompilation cascades to path dependencies
    [mix compile.elixir] Lock the compiler to avoid concurrent usage
    [mix format] Do not add new lines if the formatted file is empty
    [mix format] Properly compile dependencies on mix format
    [mix release] Only set RELEASE_MODE after env.{sh,bat} are executed
    [mix release] Allow application mode configuration to cascade to dependencies
    [mix xref] Do not emit already consolidated warnings during mix xref trace
    [Mix] Do not start apps with runtime: false on Mix.install/2
  * 3. Soft deprecations (no warnings emitted)
    Elixir
    [File] Passing a callback as third argument to File.cp/3 and File.cp_r/3 is deprecated.
    Instead pass the callback the :on_conflict key of a keyword list
    EEx
    [EEx] Using &lt;%# ... %&gt; for comments is deprecated. Please use &lt;% # ... %&gt; or the new multi-line comments with &lt;%!-- ... --%&gt;
    Logger
    [Logger] Deprecate Logger.enable/1 and Logger.disable/1 in favor of Logger.put_process_level/2
    Mix
    [mix cmd] The --app option in mix cmd CMD is deprecated in favor of the more efficient mix do --app app cmd CMD
  * 4. Hard deprecations
    Elixir
    [Application] Calling Application.get_env/3 and friends in the module body is now discouraged, use Application.compile_env/3 instead
    [Bitwise] use Bitwise is deprecated, use import Bitwise instead
    [Bitwise] ~~~ is deprecated in favor of bnot for clarity
    [Kernel.ParallelCompiler] Returning a list or two-element tuple from :each_cycle is deprecated, return a {:compile | :runtime, modules, warnings} tuple instead
    [Kernel] Deprecate the operator &lt;|&gt; to avoid ambiguity with upcoming extended numerical operators
    [String] Deprecate passing a binary compiled pattern to String.starts_with?/2
    Logger
    [Logger] Deprecate $levelpad on message formatting
    Mix
    [Mix] Mix.Tasks.Xref.calls/1 is deprecated in favor of compilation tracers
  * 5. Backwards incompatible changes
    Mix
    [mix local.rebar] Remove support for rebar2, which has not been updated in 5 years, and is no longer supported on recent Erlang/OTP versions</changelog>
  <changelog author="fabrizio.sestito@suse.com" date="1673352000">- Elixir 1.14.2
  * 1. Enhancements
    Elixir
    [Code] Add Code.eval_quoted_with_env/4 with support for the :prune_binding option
    ExUnit
    [ExUnit.Case] Allow test cases to not be registered on use
    [ExUnit.DocTest] Include :doctest and :doctest_line as meta tags
    [ExUnit.Formatter] Expose ExUnit.Formatter.format_assertion_diff/4
    Mix
    [Mix] Mix.install/2 accepts atoms as paths
  * 2. Bug fixes
    Elixir
    [Code.Formatter] Fix size*unit shortcut in bitstring
    [Kernel] Generate unique variables for macro expansion of defguard
    [Protocol] Expand :for in protocols with the appropriate env
    ExUnit
    [ExUnit] Do not run duplicate cases on ExUnit.run/1
    Mix
    [mix test] Ensure proper error message when there is no test directory
- Elixir 1.14.1
  * 1. Enhancements
    Elixir
    [Kernel] Perform partial expansion of literals in module attributes
    [Kernel] Do not add compile-time dependencies for literals as defaults in Application.compile_env/3 inside module attributes
    [Macro] Add Macro.expand_literals/2 and Macro.expand_literals/3
    [System] Add :close_stdin to System.shell/2
    Mix
    [mix test] Accept --all-warnings option
  * 2. Bug fixes
    Elixir
    [Kernel] Fix misleading warning when :uniq is given in for comprehensions and the result is unused
    [Kernel] Improve error message for when there is a conflicting struct and ignoring module conflict
    [Kernel] Do not delete @enforce_keys attribute after defstruct declaration
    [Kernel] Do not crash the checker on modules with missing :debug_info chunk
    [Macro] Fix error in Macro.to_string/2 when converting an AST with :erlang.binary_to_atom/2
    [String] Fix String.split/3 and String.next_grapheme/1 returning invalid results on invalid UTF-8 encoding
    [System] Do not close stdin by default in System.shell/2
    [URI] Do not return uri.port as :undefined in certain cases in URI.new/1
    ExUnit
    [ExUnit.DocTest] Do not crash when both :moduledoc and functions are specified in :only
    IEx
    [CLI] Fix invalid argument handling when --no-pry is given
    Mix
    [mix format] Do not cache inputs from .formatter.exs so they are properly re-evaluted on every call</changelog>
  <changelog author="pirateclip@protonmail.com" date="1675771200">- Drop git as a requires and switch buildrequires from git to git-core
  * Git is not needed to use Elixir, only to run some tests
  (which git-core can accomplish on its own without git)</changelog>
  <changelog author="dimstar@opensuse.org" date="1683201600">- Add _multibuild to define 2nd spec file as additional flavor.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1699704000">- Update to Elixir 1.15.7:
  * Fix build for Erlang 26
  * Changelog available at https://hexdocs.pm/elixir/1.15.7/changelog.html
- Add 0001-Use-PID-valid-for-32-bit-systems-closes-12741.patch:
  * Fix build for 32bit
- Add 0001-Use-PID-valid-for-32-bit-systems-followup-to-12741-1.patch:
  * Fix build for 32bit</changelog>
  <changelog author="sflees@suse.de" date="1699876800">- Switch from %patch0 to %autosetup</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1700568000">- Use pregenerated documentation</changelog>
</package>
<package pkgid="2dc5cf8933075204aa767b018b08fe49df2e44c30e7586eb7fd6414410fc0bde" name="elixir115-doc" arch="noarch">
  <version epoch="0" ver="1.15.7" rel="150300.7.5.1"/>
  <changelog author="dev@mail.smarquardt.space" date="1604491200">- Elixir 1.11.2
  * Bug fixes
    Elixir
    [Code] Do not crash when getting docs for missing `erts` appdir
    [Kernel] Raise meaningful error if `:erlang.is_record` is used in guards
    [Kernel] Prune tracers when fetching `__ENV__` inside functions
    Mix
    [mix] Fix regression where aliases could not call themselves recursively
    [mix compile] Do not discard tracers that are set programatically</changelog>
  <changelog author="dev@mail.smarquardt.space" date="1610366400">- Elixir 1.11.3
  * Enhancements
    Elixir
    [Macro] Add Macro.unique_var/2 and Macro.generate_unique_arguments/2
  * Bug fixes
    Elixir
    [Code] Do not raise when checking for operator ambiguity when :static_atoms_encoder is set in Code.string_to_quoted
    [Kernel] Emit undefined function warnings from with
    [Kernel] Do not fail type checking when literals are used in guards
    [Module] Do not warn for attributes used in @after_compile
    [Record] Make sure nested record names do not clobber each other
    ExUnit
    [ExUnit.Assertions] Do not crash if there are macros and module attributes on the left side of ++
    IEx
    [IEx.Helpers] Do not use Unicode chars if ANSI is disabled
    Mix
    [mix deps.compile] Fix compatibility with rebar v3.14
    [mix release] Do not use private ram_file:compress/1
    [mix xref] Do not crash when retrieving calls for modules in memory</changelog>
  <changelog author="dev@mail.smarquardt.space" date="1616155200">- Elixir 1.11.4
  * Enhancements
    Elixir
    [Kernel] Update formatting when printing warnings and errors from Erlang/OTP 24+
    [Kernel] Support float-16 on bitstrings
    Mix
    [mix local.rebar] This task will now install rebar3 version 3.14.4, compiled with Erlang/OTP 21</changelog>
  <changelog author="dev@mail.smarquardt.space" date="1623672000">- Elixir 1.12
  * Enhancements
    EEx
    [EEx.Engine] Add `c:EEx.Engine.handle_text/3` callback that receives text metadata
    [EEx.Engine] Emit warnings for unused "do" expression in EEx
    Elixir
    [Code] Add `Code.cursor_context/2` to return the context of a code snippet
    [Code] Do not add newlines around interpolation on code formatting.
    Note this means formatted code that has interpolation after the line length on Elixir v1.12 won't be considered as formatted on earlier Elixir versions
    [Code] Do not add brackets when keywords is used in the access syntax
    [Calendar] Support basic datetime format in `Calendar.ISO` parsing functions
    [Code] Improve evaluation performance on systems running on Erlang/OTP 24+
    [Date] Support steps via `Date.range/3`
    [DateTime] Add `offset` to `DateTime.to_iso8601/2` (now `to_iso8601/3`)
    [Enum] Add `Enum.count_until/2` and `Enum.count_until/3`
    [Enum] Add `Enum.product/1`
    [Enum] Add `Enum.zip_with/2`, `Enum.zip_with/3`, `Enum.zip_reduce/3`, and `Enum.zip_reduce/4`
    [Enum] Add support for functions as the second argument of `Enum.with_index/2`
    [Exception] Show `error_info` data for exceptions coming from Erlang
    [Float] Add `Float.pow/2`
    [Integer] Add `Integer.pow/2` and `Integer.extended_gcd/2`
    [IO] Add `IO.stream/0` and `IO.binstream/0` which default to STDIO with line orientation
    [List] Add default value for `List.first/1` and `List.last/1`
    [Kernel] Add `first..last//step` as support for stepped ranges
    [Kernel] Also warn for literal structs on `min/2` and `max/2`
    [Kernel] Add `Kernel.tap/2` and `Kernel.then/2`
    [Kernel] Do not add runtime dependencies to remotes in typespecs
    [Kernel] When there is an unused variable warning and there is a variable with the same name previously defined, suggest the user may have wanted to use the pin operator
    [Kernel] Improve error messages on invalid character right after a number
    [Kernel] Show removal and deprecated tips from Erlang/OTP
    [Macro] Add export dependencies on `Macro.struct!/2`
    [Macro] Support `:newline` to customize newlines escaping in `Macro.unescape_string/2`
    [Module] Raise on invalid `@dialyzer` attributes
    [Module] Add `Module.get_definition/2` and `Module.delete_definition/2`
    [Module] Allow `@on_load` to be a private function
    [Module] Validate `@dialyzer` related module attributes
    [Module] Add `Module.reserved_attributes/0` to list all reserved attributes by the language
    [Range] Add `Range.new/3` and `Range.size/1`
    [Regex] Add offset option to `Regex.scan/3` and `Regex.run/3`
    [Registry] Support `:compression` on `Registry` tables
    [Registry] Support `Registry.values/3` for reading values under a given key-pid pair
    [Stream] Add `Stream.zip_with/2` and `Stream.zip_with/3`
    [String] Add `:turkic` mode option to String case functions
    [String] Update to Unicode 13.0
    [System] Add `System.trap_signal/3` and `System.untrap_signal/2`
    [System] Add `System.shell/2` to invoke a command that is interpreted by the shell
    [Tuple] Add `Tuple.sum/1` and `Tuple.product/1`
    [URI] Support RFC3986 compliant encoding and decoding of queries via the `:rfc3986` option
    ExUnit
    [ExUnit] Intercept SIGQUIT (via Ctrl+\\) and show a list of all aborted tests as well as intermediate test results
    [ExUnit] Interpolate module attributes in match assertions diffs
    [ExUnit] Print how much time is spent on `async` vs `sync` tests
    [ExUnit] Improve error messages for doctests
    [ExUnit] Compile doctests faster (often by two times)
    [ExUnit] Add `ExUnit.async_run/0` and `ExUnit.await_run/1`
    IEx
    [IEx] Make IEx' parser configurable to allow special commands
    [IEx] Show function signature when pressing tab after the opening parens of a function
    [IEx] If an IEx expression starts with a binary operator, such as `|&gt;`, automatically pipe in the result of the last expression
    Mix
    [Mix] Add `Mix.install/2` for dynamically installing a list of dependencies
    [Mix] Support `:exit_code` option in `Mix.raise/2`
    [Mix] Discard `MIX_ENV` and `MIX_TARGET` values if they are empty strings
    [Mix] Print the time taken to execute a task with on `MIX_DEBUG=1`
    [mix compile.erlang] Compile multiple files in parallel
    [mix escript.build] Deep merge configuration and ensure argv is set when executing `config/runtime.exs`
    [mix release] Add `RELEASE_PROG` to releases with the name of the executable starting the release
    [mix release] Support `remote.vm.args` to customize how the connecting VM boots
    [mix test] Run all available tests if there are no pending `--failed` tests. This provides a better workflow as you no longer need to toggle the `--failed` flag between runs
  * Bug fixes
    Elixir
    [CLI] Ensure `-e ""` (with an empty string) parses correctly on Windows
    [Inspect] Do not override user supplied `:limit` option for derived implementations
    [Kernel] Allow heredoc inside a heredoc interpolation
    [Kernel] Preserve CRLF on heredocs
    [Kernel] Public functions without documentation now appear as an empty map on `Code.fetch_docs/1`,
    unless they start with underscore, where they remain as `:none`. This aligns Elixir's implementation with EEP48
    [Kernel] Do not crash when complex literals (binaries and maps) are used in guards
    [Kernel] Properly parse keywords (such as `end`) followed by the `::` operator
    [Kernel] Do not ignore unimplemented signatures from generated functions
    [Kernel] Improve error message when an expression follows a keyword list without brackets
    [Macro] `Macro.decompose_call/1` now also consider tuples with more than 2 elements to not be valid calls
    [Macro] Fix `Macro.to_string/1` double-escaping of escape characters in sigils
    [Macro] Fix `Macro.underscore/1` on digits preceded by capitals: "FOO10" now becomes "foo10" instead of "fo_o10"
    [Macro] Preserve underscores between digits on `Macro.underscore/1`
    [OptionParser] Properly parse when numbers follow-up aliases, for example, `-ab3` is now parsed as `-a -b 3`
    [Path] Fix `Path.relative_to/2` when referencing self
    [Path] Do not crash when a volume is given to `Path.absname/1`, such as "c:"
    [Task] Ensure `Task.async_stream/2` with `ordered: false` discard results as they are emitted, instead of needlessly accumulating inside the stream manager
    [Task] Raise if `:max_concurrency` is set to 0 on streaming operations
    [URI] Do not discard empty paths on `URI.merge/2`
    ExUnit
    [ExUnit.Case] Make `@tag tmp_dir` an absolute directory, avoiding inconsistencies if the test changes the current working directory
    [ExUnit.Diff] Fix cases where the diffing algorithm would fail to print a pattern correct
    IEx
    [IEx] Fix auto-completion inside remote shells
    Mix
    [mix app.config] Do not emit false positive warnings when configured dependencies that have `runtime: false` set
    [mix compile.elixir] Ensure that a manifest is generated even with no source code
    [mix compile.elixir] Make sure export dependencies trigger recompilation when the dependency is removed as well as when the whole file is removed
    [mix compile.elixir] Do not emit false positive warnings when a path dependency adds a module that is then used by the current application in the same `mix compile` cycle
    [mix test] Ensure protocols within the current project are consolidated when `--cover` is given
    [mix release] Improve compliance of release scripts with stripped down Linux installations
    [mix release] Preserve file mode when copying non-beam ebin files
    [mix xref] Ensure args are passed to the underlying `mix compile` call
  * Soft-deprecations (no warnings emitted)
    Elixir
    [Kernel] Using `first..last` to match on ranges is soft-deprecated and will warn on future Elixir versions. Use `first..last//step` instead
    [Kernel] Using `first..last` to create decreasing ranges is soft-deprecated and will warn on future versions. Use `first..last//-1` instead
  * Hard-deprecations
    EEx
    [EEx.Engine] `use EEx.Engine` is deprecated in favor of explicit delegation
    Elixir
    [Kernel] The binary operator `^^^` is deprecated. If you are using `Bitwise.^^^/2`, use `Bitwise.bxor/2` instead
    [Kernel] Deprecate `@foo()` in favor of `@foo`
    [System] Deprecate `System.stacktrace/0` (it was already deprecated outside of catch/rescue and now it is deprecated everywhere)
    Mix
    [mix compile] The `:xref` compiler is deprecated and it has no effect. Please remove it from your mix.exs file.
    Full release notes: https://github.com/elixir-lang/elixir/releases/tag/v1.12.0</changelog>
  <changelog author="dev@mail.smarquardt.space" date="1623672001">- Elixir 1.12.1
  * Bug fixes
    Elixir
    [Code] Make sure `Code.format_string!/2` formats multiline expression inside interpolation on the first run
    [Macro] Revert keeping of underscores between digits in camelize
    Mix
    [Mix] Make sure `Mix.install/2` expand paths for deps
    [mix deps.get] Silence false positives on `httpc` warnings
    [mix test] Do not run the whole suite when there are no --failed tests as it won't behave as expected inside umbrellas</changelog>
  <changelog author="dev@mail.smarquardt.space" date="1626091200">- Elixir 1.12.2
  * Bug fixes
    Elixir
    [Kernel] Ensure deprecated macros emit warnings
    Mix
    [mix deps] Ensure unconstrained rebar deps generate valid mix specifications
  * Enhancements
    Elixir
    [elixirc] Change the output of `--profile time` to make it easier to detect outliers
    [Application] Do not add compile time deps on args to `Application.compile_env/2` and `Application.compile_env!/2`
    [Enum] Optimize `Enum.into/3` and `Map.new/2`
    Mix
    [mix compile] Compile most recently changed files first
    [mix compile, mix run, mix test] Speed up the time taken to load dependencies. This should make the usage of Mix inside projects quite more responsive</changelog>
  <changelog author="dev@mail.smarquardt.space" date="1632830400">- Elixir 1.12.3
  * Bug fixes
    Elixir
    [Code] Make sure that bindings in the default context returned by `Code.eval_*` functions are not returned as tagged tuples
    [Kernel] Do not crash when handling ambiguity errors
    [Range] Still match on old range patterns throughout the stdlib
    IEx
    [IEx.Autocomplete] Do not error autocompletion with module attribute
    Mix
    [Mix] Rename inconsistent `:exit_code` option to `:exit_status` on `Mix.raise/2`</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1636113600">- Add 0001-Add-retries-to-tests-that-write-to-stderr-on-Windows.patch:
  fix build for Factory</changelog>
  <changelog author="dev@mail.smarquardt.space" date="1641470400">- Elixir 1.13.0
  * Enhancements
    EEx
    [EEx] Add `:parser_options` to EEx functions
    Elixir
    [Calendar] Add `c:Calendar.year_of_era/3` to support calendars where the beginning of a new era does not align with
    the beginning of a new year
    [CLI] Support `--short-version` on the CLI that does not boot the VM
    [Code] Add `Code.string_to_quoted_with_comments/2` and `Code.quoted_to_algebra/2`
    [Code] Add more `:token_metadata` to aliases and remote calls when parsing strings
    [Code] Add `Code.Fragment` module to provide best-effort information from code fragments.
    The module currently provides an updated `Code.Fragment.cursor_context/2` with operator support and
    `Code.Fragment.surround_context/2` which looks at a given position in a fragment and find its surrounding delimiters
    [Code] Allow custom sigil formatting on `Code.format_string!/2`
    [Code] Add `{:on_module, bytecode, :none}` trace to compilation tracers
    [Enum] Optimize `Enum.concat/1` for lists of lists
    [Enum] Add `Enum.slide/3`
    [Exception] Better format Elixir exceptions in Erlang
    [Inspect] Allow default inspect fun to be set globally with `Inspect.Opts.default_inspect_fun/1`
    [IO] Allow `:eof` to be given as limit to `IO.getn/2`
    [Kernel] Support the `:sigils` option in `import Mod, only: :sigils` and allow the sigil modifiers to be also digits
    [Kernel] Make `get_in` consistently abort and return `nil` when `nil` values are found (previously Elixir would raise
    an error in this case). This allows a user to use `get_in` as a safe navigation operator.
    [Kernel] Improve compilation times by reducing the amount of copies of the AST across compiler processes
    [Kernel] Raise if trying to define a module with a slash in its name
    [Kernel] Warn when `?\` is used and there is no need for a escape character
    [Kernel] Track structs in typespecs as export deps instead of compile-time deps
    [Kernel] Add power operator (`**/2`)
    [Keyword] Add `Keyword.validate/2`
    [Keyword] Implement `Keyword.filter/2` and `Keyword.map/2`
    [List] Add `List.keyfind!/3`
    [Macro] Add `Macro.prewalker/1` and `Macro.postwalker/1`
    [Macro.Env] Add the following reflection functions: `required?/2`, `lookup_import/2`, `fetch_alias/2`, and `fetch_macro_alias/2`
    [Map] Implement `Map.filter/2` and `Map.map/2`
    [Module] Support `:nillify_clauses` in `Module.get_definition/3`
    [Module] Add `Module.attributes_in/1` and `Module.overridables_in/1`
    [OptionParser] Add "did you mean?" suggestions to `OptionParser.ParseError` messages
    [Record] Add record reflection via `@__records__`
    [Task] Add `Task.completed/1`
    [Task] Add `Task.ignore/1` to keep a task running but ignoring all of its results
    [Task] Reduce the amount of copying `Task.async*` functions
    [URI] Add `URI.new/1` and `URI.new!/1`
    ExUnit
    [ExUnit] Show hint if comparing different but equivalent strings
    [ExUnit.CaptureIO] Add `with_io/3` to return result with captured io
    [ExUnit.CaptureLog] Add `with_log/2` to return result with captured logs
    IEx
    [IEx.Autocomplete] Add path autocompletion whenever when the cursor follows `"./` or `"/` or `"DRIVER:` where
    `DRIVER` is a single letter
    [IEx.Autocomplete] Add autocompletion for sigils, struct names, and struct fields
    [IEx.Helpers] Allow multiple modules to be given to `r/1`
    Logger
    [Logger] Add `Logger.put_application_level/2`
    [Logger] Print all log levels in accordance to Erlang/OTP. This also means `[warn]` is now shown as `[warning]`
    Mix
    [Mix] Add `MIX_INSTALL_FORCE` environment variable support
    [Mix] Support `:config` and `:system_env` in `Mix.install/2`
    [Mix] Add `Mix.installed?/0`
    [Mix.Shell] Add `:default` option to `Mix.Shell.yes?`
    [mix archive.install] Run `loadconfig` before building archive
    [mix compile] Move Elixir version check to before deps are compiled, in order to give feedback earlier
    [mix compile.elixir] Do not recompile files if their modification time change but their contents are still the same and the .beam files are still on disk
    [mix compile.elixir] Do not recompile all Elixir sources when Erlang modules change, only dependent ones
    [mix compile.elixir] Do not recompile Elixir files if `mix.exs` changes, instead recompile only files using `Mix.Project` or trigger a recompilation if a compiler option changes
    [mix compile.elixir] Only recompile needed files when a dependency is added, updated or removed
    [mix compile.elixir] Only recompile needed files when a dependency is configured
    [mix deps] Add `:subdir` option to git deps
    [mix escript.install] Run `loadconfig` before building escript
    [mix format] Support `:plugins` in `mix format` that can hook into custom extensions and sigils
    [mix format] Add `Mix.Tasks.Format.formatter_for_file/2`
    [mix local.rebar] No longer support `sub_dirs` in Rebar 2 to help migration towards Rebar 3
    [mix local.rebar] Support `--if-missing` option when installing Rebar
    [mix local.rebar] Set `REBAR_PROFILE=prod` when compiling Rebar dependencies
    [mix test] Support `--profile-require=time` to profile the time loading test files themselves
    [mix test] Allow filtering modules from coverage using regex
    [mix test] Allow the exit status of ExUnit to be configured and set the default to 2
    [mix test] Exit with a status of 3 when coverage falls below threshold
    [mix test] Write failed manifest when suite fails due to --warnings-as-errors
    [mix test] Ignore `MIX_TEST_PARTITION` when partitions set to 1
    [mix xref] Support multiple sinks and sources in `mix xref graph`
    [mix xref] Add `trace` subcommand to print compilation dependencies between files
    [mix xref] Add `--fail-above` option to `mix xref`
    [mix xref] Add `--label compile-connected` to `mix xref`
  * 2. Bug fixes
    EEx
    [EEx] Accept comments in EEx between do and the first clause
    [EEx] Accept EEx expressions where `-&gt;` is followed by newline
    Elixir
    [Application] Allow any expression as first argument of `compile_env`
    [Application] Warn if `Application.compile_env` or `Application.compile_env!` are called without a require
    [Code] Make sure `:static_atoms_encoder` in `Code.string_to_quoted/2` also applies to quoted keyword keys
    [Code] Ensure bindings with no context are returned as atoms instead of `{binding, nil}` in eval operations
    [Inspect] Fix a bug when inspecting a non-binary bitstring with colors
    [Kernel] Reject bidirectional formatting characters in strings and comments
    [Kernel] Support escaping of terminators in uppercase sigils heredocs for consistency
    [Kernel] Raise if `__CALLER__` or `__ENV__` or `__STACKTRACE__` are used in match
    [Kernel] Improve error message on invalid argument for `byte_size` from binary concat
    [Kernel] Raise when aliasing non-Elixir modules without `:as`
    [Kernel] Allow `unquote_splicing` inside `%{...}` without parens
    [Kernel] Ensure that waiting on a struct expansion inside a typespec is correctly tracked as waiting time in the compiler
    [Kernel] Correctly parse the atom `.` as a keyword list key
    [Kernel] Do not leak variables from the first generator in `with` and `for` special forms
    [Kernel] Fix column number on strings with NFD characters
    [Kernel] Fix a bug where a combination of dynamic line in `quote` with `unquote` of remote calls would emit invalid AST metadata
    [OptionParser] Validate switch types/modifiers early on to give more precise feedback
    [Protocol] Add `defdelegate` to the list of unallowed macros inside protocols as protocols do not allow function definitions
    [Protocol] Warn if `@callback`, `@macrocallback` and `@optional_callbacks` are defined inside protocol
    [Protocol] Ensure protocol metadata is deterministic on consolidation
    [Range] Always show step when range is descending
    [String] Update Unicode database to version 14.0
    [URI] Only percent decode if followed by hex digits (according to https://url.spec.whatwg.org/#percent-decode)
    [Version] Ensure proper precedence of `and`/`or` in version requirements
    ExUnit
    [ExUnit] Fix formatter and counters from `ExUnit.run/0` to consider all tests in a module whenever if a module's `setup_all` fails
    [ExUnit] Allow doctests newlines to be terminated by CRLF
    IEx
    [IEx] Fix the loss of `.iex.exs` context after a pry session
    [IEx] Stop evaluator before exiting IEx server to avoid evaluators leaking
    Logger
    [Logger] Raise clear error message for invalid `:compile_time_purge_matching` configuration
    [Logger] Fix a bug where Logger would not reset its discard counter under some scenarios
    Mix
    [mix compile.elixir] Track transitive runtime dependencies coming from local/path dependencies
    [mix compile.elixir] Recompile file if `@external_resource` is deleted
    [mix compile.elixir] Print number of compiling files on all compiler cycles. This will make the `Compiling N files (.ex)` show up multiple times if necessary
    [mix deps] Raise if local dep is unavailable while compiling
    [mix deps.unlock] Fix blank output when unlocking a dependency that is not locked
    [mix local.install] Do not respect `MIX_DEPS_PATH` for install commands
    [mix release] Improve release scripts by making sure shell errors cascade (this is done by avoiding exporting and defining variables in a single step)
    [mix release] Do not boot release if `RELEASE_COOKIE` is empty
    [mix release] Allow releases running as a daemon to be restarted
    [mix release] Raise proper error message when non-serializable values are in configs
    [mix test] Fix coverage engine to also tag `case`, `cond`, and `receive` branches where the right side is a literal
  * 3. Soft-deprecations (no warnings emitted)
    Elixir
    [Code] Environment options in `Code.eval_quoted/3` and `Code.eval_string/3`, such as `:aliases` and `:tracers`, have been deprecated in favor of passing an environment
    [IO] `:all` on `IO.getn` is deprecated in favor of `:eof`
    [URI] `URI.parse/1` is deprecated in favor of `URI.new/1` and `URI.new!/1`
    Mix
    [mix format] `Mix.Tasks.Format.formatter_opts_for_file/2` is deprecated in favor of `Mix.Tasks.Format.formatter_for_file/2`
  * 4. Hard-deprecations
    Elixir
    [Code] `Code.cursor_context/2` is deprecated, use `Code.Fragment.cursor_context/2` instead
    [Macro] `Macro.to_string/2` is deprecated, use `Macro.to_string/1` instead
    [System] `System.get_pid/0` is deprecated, use `System.pid/0` instead
    [Version] Using `!` or `!=` in version requirements is deprecated, use `~&gt;` or `&gt;=` instead
    Mix
    [mix escript.build] `:strip_beam` option is deprecated in favor of `:strip_beams`
    [Mix] `:exit_code` in `Mix.raise/2` has been deprecated in favor of `:exit_status`
    [Mix.Config] `Mix.Config` is deprecated in favor of `Config` module
  Full release notes: https://github.com/elixir-lang/elixir/releases/tag/v1.13.0
  - Drop 0001-Add-retries-to-tests-that-write-to-stderr-on-Windows.patch:
  upstreamed</changelog>
  <changelog author="dev@mail.smarquardt.space" date="1641470401">- Elixir 1.13.1
  * 1. Bug fixes
    Elixir
    [Code] Do not show code snippets in `SyntaxError` and `TokenMissingError` if line is empty
    [Exception] Do not fail blaming `ArgumentError` for improper lists on `apply/3`
    [Macro] Set a max `line_length` for `Macro.to_string/1`
    [Macro] Fix formatting of lists on module attributes for `Macro.to_string/1`
    [String] Fix incorrect codepoint byte counting in `slice` with negative positions in ranges
    [Task] Ensure async streams can be consumed from another process than the one that creates them
    [URI] Undeprecate `URI.parse/1` as `URI.new/1` is too strict in many common cases
    [URI] Make sure `URI.new/1` returns nil for empty paths
    IEx
    [IEx] Make sure the `--version` flag halts IEx
    Mix
    [Mix] Make protocol consolidation part of the `Mix.install/2` cache</changelog>
  <changelog author="fabrizio.sestito@suse.com" date="1642161600">- Elixir 1.13.2
  * 1. Enhancements
    Mix
    [mix format] Allow plugins to also format .ex and .exs files
    [mix release] Allow bypassing application mode validation in release spec
    [mix test] Print a message when the suite fails due to the coverage threshold
  * 2. Bug fixes
    Elixir
    [Code] Do not emit warnings on Code.Fragment.container_cursor_to_quoted/2
    [Kernel] Fix a crash when a for-comprehension with :uniq was used inside another comprehension with :uniq
    [Kernel] Ensure env.context_modules is properly set inside optimized defmodule
    [Keyword] Deprecate the recently added Keyword.map/2 as it is equivalent to Keyword.new/2
    [Map] Deprecate the recently added Map.map/2 as it is equivalent to Map.new/2
    [Protocol] Warn on zero arity callbacks inside protocols</changelog>
  <changelog author="fabrizio.sestito@suse.com" date="1645531200">- Elixir 1.13.3
  * 1. Enhancements
    Mix
    [mix format] Supply file and line to formatter plugins
    [mix format] Support embedded Elixir expressions inside formatter plugins
  * 2. Bug fixes
    Elixir
    [Code] Fix duplicate bindings causing errors during evaluation
    [Kernel] Make sure signatures stored in the Documentation chunk does not contain newlines
    [Kernel] Fix infinite loop when compiling guards with recursive map access
    [Macro] Fix error on Macro.to_string/1 when the plain alias Elixir is given
    [String] Fix error for certain codepoint combinations in String.split_at/2
    Mix
    [mix compile] Recompile project files when exports from dependencies change
    [mix test] Fix total coverage always showing in red even when above the threshold</changelog>
  <changelog author="fabrizio.sestito@suse.com" date="1649505600">- Elixir 1.13.4
  * 1. Enhancements
    Elixir
    [Code] Allow iodata to be returned in sigil formatting functions
    [Code] Pass opening delimiter information to sigil formatting functions
  * 2. Bug fixes
    Elixir
    [Kernel] Tweak type unification to fix infinite loop with recursive vars
    [Kernel] Add compile-time dependencies on require
    [Registry] Make Registry send work with named triplets
  * 3. Deprecations
    Mix
    [mix rebar] Deprecate Rebar 2 as it no longer works on Erlang/OTP 25</changelog>
  <changelog author="fabrizio.sestito@suse.com" date="1662552000">- Elixir 1.14
  * 1. Enhancements
    EEx
    [EEx] Support multi-line comments to EEx via &lt;%!-- --%&gt;
    [EEx] Add EEx.tokenize/2
    Elixir
    [Access] Add Access.slice/1
    [Application] Add Application.compile_env/4 and Application.compile_env!/3 to read the compile-time environment inside macros
    [Calendar] Support ISO8601 basic format parsing with DateTime.from_iso8601/2
    [Calendar] Add day/hour/minute on add/diff across different calendar modules
    [Code] Add :normalize_bitstring_modifiers to Code.format_string!/2
    [Code] Emit deprecation and type warnings for invalid options in on Code.compile_string/2 and Code.compile_quoted/2
    [Code] Warn if an outdated lexical tracker is given on eval
    [Code] Add Code.env_for_eval/1 and Code.eval_quoted_with_env/3
    [Code] Improve stacktraces from eval operations on Erlang/OTP 25+
    [Code.Fragment] Add support for __MODULE__ in several functions
    [Code.Fragment] Support surround and context suggestions across multiple lines
    [Enum] Allow slicing with steps in Enum.slice/2
    [File] Support dereference_symlinks: true in File.cp/3 and File.cp_r/3
    [Float] Do not show floats in scientific notation if below 1.0e16 and the fractional value is precisely zero
    [Float] Add Float.min_finite/0 and Float.max_finite/0
    [Inspect] Improve error reporting when there is a faulty implementation of the Inspect protocol
    [Inspect] Allow :optional when deriving the Inspect protocol for hiding fields that match their default value
    [Inspect] Inspect struct fields in the order they are declared in defstruct
    [Inspect] Use expression-based inspection for Date.Range, MapSet, and Version.Requirement
    [IO] Support Macro.Env and keywords as stacktrace definitions in IO.warn/2
    [IO] Add IO.ANSI.syntax_colors/0 and related configuration to be shared across IEx and dbg
    [Kernel] Add new dbg/0-2 macro
    [Kernel] Allow any guard expression as the size of a bitstring in a pattern match
    [Kernel] Allow composite types with pins as the map key in a pattern match
    [Kernel] Print escaped version of control chars when they show up as unexpected tokens
    [Kernel] Warn on confusable non-ASCII identifiers
    [Kernel] Add .. as a nullary operator that returns 0..-1//1
    [Kernel] Implement Unicode Technical Standard #39 recommendations. In particular, we warn for confusable scripts and restrict identifiers to single-scripts or highly restrictive mixed-scripts
    [Kernel] Automatically perform NFC conversion of identifiers
    [Kernel] Add binary_slice/2 and binary_slice/3
    [Kernel] Lazily expand module attributes to avoid compile-time deps
    [Kernel] Automatically cascade generated: true annotations on macro expansion
    [Keyword] Add Keyword.from_keys/2 and Keyword.replace_lazy/3
    [List] Add List.keysort/3 with support for a sorter function
    [Macro] Add Macro.classify_atom/1 and Macro.inspect_atom/2
    [Macro] Add Macro.expand_literal/2 and Macro.path/2
    [Macro.Env] Add Macro.Env.prune_compile_info/1
    [Map] Add Map.from_keys/2 and Map.replace_lazy/3
    [MapSet] Add MapSet.filter/2, MapSet.reject/2, and MapSet.symmetric_difference/2
    [Node] Add Node.spawn_monitor/2 and Node.spawn_monitor/4
    [Module] Support new @after_verify attribute for executing code whenever a module is verified
    [PartitionSupervisor] Add PartitionSupervisor that starts multiple isolated partitions of the same child for scalability
    [Path] Add Path.safe_relative/1 and Path.safe_relative_to/2
    [Registry] Add Registry.count_select/2
    [Stream] Add Stream.duplicate/2 and Stream.transform/5
    [String] Support empty lookup lists in String.replace/3, String.split/3, and String.splitter/3
    [String] Allow slicing with steps in String.slice/2
    [Task] Add :zip_input_on_exit option to Task.async_stream/3
    [Task] Store :mfa in the Task struct for reflection purposes
    [URI] Add URI.append_query/2
    [Version] Add Version.to_string/1
    [Version] Colorize Version.Requirement source in the Inspect protocol
    ExUnit
    [ExUnit] Add ExUnit.Callbacks.start_link_supervised!/2
    [ExUnit] Add ExUnit.run/1 to rerun test modules
    [ExUnit] Colorize summary in yellow with message when all tests are excluded
    [ExUnit] Display friendly error when test name is too long
    IEx
    [IEx] Evaluate --dot-iex line by line
    [IEx] Add line-by-line evaluation of IEx breakpoints
    [IEx.Autocomplete] Autocomplete bitstrings modifiers (after :: inside &lt;&lt;...&gt;&gt;)
    [IEx.Helpers] Allow an atom to be given to pid/1
    [IEx.Helpers] Support sigils in h/1
    Logger
    [Logger] Add Logger.put_process_level/2
    Mix
    [Mix] Add :config_path and :lockfile options to Mix.install/2
    [mix compile] Add --no-optional-deps to skip optional dependencies to test compilation works without optional dependencies
    [mix compile] Include column information on error diagnostics when possible
    [mix deps] Mix.Dep.Converger now tells which deps formed a cycle
    [mix do] Support --app option to restrict recursive tasks in umbrella projects
    [mix do] Allow using + as a task separator instead of comma
    [mix format] Support filename in mix format - when reading from stdin
    [mix format] Compile if mix format plugins are missing
    [mix new] Do not allow projects to be created with application names that conflict with multi-arg Erlang VM switches
    [mix profile] Return the return value of the profiled function
    [mix release] Make BEAM compression opt-in
    [mix release] Let :runtime_config_path accept false to skip the config/runtime.exs
    [mix test] Improve error message when suite fails due to coverage
    [mix test] Support :test_elixirc_options and default to not generating docs nor debug info chunk for tests
    [mix xref] Support --group flag in mix xref graph
  * 2. Bug fixes
    Elixir
    [Calendar] Handle widths with "0" in them in Calendar.strftime/3
    [CLI] Improve errors on incorrect --rpc-eval usage
    [CLI] Return proper exit code on Windows
    [Code] Do not emit warnings when formatting code
    [Enum] Allow slices to overflow on both starting and ending positions
    [Kernel] Do not allow restricted characters in identifiers according to UTS39
    [Kernel] Define __exception__ field as true when expanding exceptions in typespecs
    [Kernel] Warn if any of True, False, and Nil aliases are used
    [Kernel] Warn on underived @derive attributes
    [Kernel] Remove compile-time dependency from defimpl :for
    [Kernel] Track all arities on imported functions
    [Kernel] Fix equality in guards for dynamic ranges without steps
    [Module] Fix loop while unifying type variables
    [Protocol] Warn if a protocol has no definitions
    [Regex] Show list options when inspecting a Regex manually defined with Regex.compile/2
    [String] Allow slices to overflow on both starting and ending positions
    [System] Raise non-generic exception on missing env in System.fetch_env!/1 to mirror map operations
    ExUnit
    [ExUnit] Do not crash when diffing unknown bindings in guards
    [ExUnit] Properly print diffs when comparing improper lists with strings at the tail position
    [ExUnit] Add short hash to tmp_dir in ExUnit to avoid test name collision
    [ExUnit] Do not store logs in the CLI formatter (this reduces memory usage for suites with capture_log)
    [ExUnit] Run ExUnit.after_suite/1 callback even when no tests run
    [ExUnit] Fix scenario where setup with imported function from within describe failed to compile
    IEx
    [IEx] Disallow short-hand pipe after matches
    [IEx] Fix exports/1 in IEx for long function names
    Mix
    [mix compile.elixir] Fix --warnings-as-errors when used with --all-warnings
    [mix compile.elixir] Ensure semantic recompilation cascades to path dependencies
    [mix compile.elixir] Lock the compiler to avoid concurrent usage
    [mix format] Do not add new lines if the formatted file is empty
    [mix format] Properly compile dependencies on mix format
    [mix release] Only set RELEASE_MODE after env.{sh,bat} are executed
    [mix release] Allow application mode configuration to cascade to dependencies
    [mix xref] Do not emit already consolidated warnings during mix xref trace
    [Mix] Do not start apps with runtime: false on Mix.install/2
  * 3. Soft deprecations (no warnings emitted)
    Elixir
    [File] Passing a callback as third argument to File.cp/3 and File.cp_r/3 is deprecated.
    Instead pass the callback the :on_conflict key of a keyword list
    EEx
    [EEx] Using &lt;%# ... %&gt; for comments is deprecated. Please use &lt;% # ... %&gt; or the new multi-line comments with &lt;%!-- ... --%&gt;
    Logger
    [Logger] Deprecate Logger.enable/1 and Logger.disable/1 in favor of Logger.put_process_level/2
    Mix
    [mix cmd] The --app option in mix cmd CMD is deprecated in favor of the more efficient mix do --app app cmd CMD
  * 4. Hard deprecations
    Elixir
    [Application] Calling Application.get_env/3 and friends in the module body is now discouraged, use Application.compile_env/3 instead
    [Bitwise] use Bitwise is deprecated, use import Bitwise instead
    [Bitwise] ~~~ is deprecated in favor of bnot for clarity
    [Kernel.ParallelCompiler] Returning a list or two-element tuple from :each_cycle is deprecated, return a {:compile | :runtime, modules, warnings} tuple instead
    [Kernel] Deprecate the operator &lt;|&gt; to avoid ambiguity with upcoming extended numerical operators
    [String] Deprecate passing a binary compiled pattern to String.starts_with?/2
    Logger
    [Logger] Deprecate $levelpad on message formatting
    Mix
    [Mix] Mix.Tasks.Xref.calls/1 is deprecated in favor of compilation tracers
  * 5. Backwards incompatible changes
    Mix
    [mix local.rebar] Remove support for rebar2, which has not been updated in 5 years, and is no longer supported on recent Erlang/OTP versions</changelog>
  <changelog author="fabrizio.sestito@suse.com" date="1673352000">- Elixir 1.14.2
  * 1. Enhancements
    Elixir
    [Code] Add Code.eval_quoted_with_env/4 with support for the :prune_binding option
    ExUnit
    [ExUnit.Case] Allow test cases to not be registered on use
    [ExUnit.DocTest] Include :doctest and :doctest_line as meta tags
    [ExUnit.Formatter] Expose ExUnit.Formatter.format_assertion_diff/4
    Mix
    [Mix] Mix.install/2 accepts atoms as paths
  * 2. Bug fixes
    Elixir
    [Code.Formatter] Fix size*unit shortcut in bitstring
    [Kernel] Generate unique variables for macro expansion of defguard
    [Protocol] Expand :for in protocols with the appropriate env
    ExUnit
    [ExUnit] Do not run duplicate cases on ExUnit.run/1
    Mix
    [mix test] Ensure proper error message when there is no test directory
- Elixir 1.14.1
  * 1. Enhancements
    Elixir
    [Kernel] Perform partial expansion of literals in module attributes
    [Kernel] Do not add compile-time dependencies for literals as defaults in Application.compile_env/3 inside module attributes
    [Macro] Add Macro.expand_literals/2 and Macro.expand_literals/3
    [System] Add :close_stdin to System.shell/2
    Mix
    [mix test] Accept --all-warnings option
  * 2. Bug fixes
    Elixir
    [Kernel] Fix misleading warning when :uniq is given in for comprehensions and the result is unused
    [Kernel] Improve error message for when there is a conflicting struct and ignoring module conflict
    [Kernel] Do not delete @enforce_keys attribute after defstruct declaration
    [Kernel] Do not crash the checker on modules with missing :debug_info chunk
    [Macro] Fix error in Macro.to_string/2 when converting an AST with :erlang.binary_to_atom/2
    [String] Fix String.split/3 and String.next_grapheme/1 returning invalid results on invalid UTF-8 encoding
    [System] Do not close stdin by default in System.shell/2
    [URI] Do not return uri.port as :undefined in certain cases in URI.new/1
    ExUnit
    [ExUnit.DocTest] Do not crash when both :moduledoc and functions are specified in :only
    IEx
    [CLI] Fix invalid argument handling when --no-pry is given
    Mix
    [mix format] Do not cache inputs from .formatter.exs so they are properly re-evaluted on every call</changelog>
  <changelog author="pirateclip@protonmail.com" date="1675771200">- Drop git as a requires and switch buildrequires from git to git-core
  * Git is not needed to use Elixir, only to run some tests
  (which git-core can accomplish on its own without git)</changelog>
  <changelog author="dimstar@opensuse.org" date="1683201600">- Add _multibuild to define 2nd spec file as additional flavor.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1699704000">- Update to Elixir 1.15.7:
  * Fix build for Erlang 26
  * Changelog available at https://hexdocs.pm/elixir/1.15.7/changelog.html
- Add 0001-Use-PID-valid-for-32-bit-systems-closes-12741.patch:
  * Fix build for 32bit
- Add 0001-Use-PID-valid-for-32-bit-systems-followup-to-12741-1.patch:
  * Fix build for 32bit</changelog>
  <changelog author="sflees@suse.de" date="1699876800">- Switch from %patch0 to %autosetup</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1700568000">- Use pregenerated documentation</changelog>
</package>
<package pkgid="14ada42d68fca3b72718ca8c5b141f9eceb5cd29eaa8faea26049db28f941e41" name="emacs" arch="aarch64">
  <version epoch="0" ver="27.2" rel="150400.3.17.1"/>
  <changelog author="werner@suse.de" date="1622030400">- Disable workaround with XLIB_SKIP_ARGB_VISUALS set (boo#1186341)</changelog>
  <changelog author="duncan@mac-vicar.eu" date="1622462400">- For terminal 24bit support, fall back to xterm+direct
  (semicolon version) if requested by the COLORTERM environment variable.
  Upstream commit 50f489b5dc.
  Allows 24bit color on gnome-terminal out of the box.
  * emacs-27.2-COLORTERM-24bit.patch</changelog>
  <changelog author="werner@suse.de" date="1623412800">- Enable workaround with XLIB_SKIP_ARGB_VISUALS set (boo#1186341)</changelog>
  <changelog author="schwab@suse.de" date="1626868800">- sigsegv-stack.patch: Port alternate signal stack to upcoming glibc 2.34</changelog>
  <changelog author="werner@suse.de" date="1631102400">- Work for boo#1183497: make sure that if ibus is the input method
  that there exists a working gtk immodule for ibus as well as the
  ibus daemon is up and running</changelog>
  <changelog author="werner@suse.de" date="1631188800">- Add patch boo1178942-bedb3cb6.patch to avoid that emacs hang in
  isearch (boo#1178942)</changelog>
  <changelog author="werner@suse.de" date="1636977600">- Again disable workaround with XLIB_SKIP_ARGB_VISUALS set (boo#1191517)
- Correct quoting of anonymous function calls</changelog>
  <changelog author="werner@suse.de" date="1637323200">- Enable the NO_AT_BRIDGE code</changelog>
  <changelog author="werner@suse.de" date="1637323201">- Make dbus code in emacs shell script failsafe</changelog>
  <changelog author="werner@suse.de" date="1637323202">- Get rid of the old dbus shell code in the emacs shell script
  nowadays this should be not needed anymore</changelog>
  <changelog author="mliska@suse.cz" date="1637582400">- Use %make_build macro.</changelog>
  <changelog author="werner@suse.de" date="1642075200">- Skip patch boo1180353-6d8144a2.patch for emacs 25.3 as already
  part of emacs 27.2: Was fix for boo#1180353 that was a possible
  segmentation fault in case of stack overflow of etags</changelog>
  <changelog author="werner@suse.de" date="1669723200">- Add upstream commit as patch d48bb487.patch (bsc#1205822, CVE-2022-45939)
  * shell command injection via source code files when using ctags</changelog>
  <changelog author="werner@suse.de" date="1676980800">- Add upstream commit/patches
  * 01a4035c.patch
    Fix etags local command injection vulnerability (CVE-2022-48337, bsc#1208515)
  * CVE-2022-48338.patch
    Fix ruby-mode.el local command injection vulnerability (CVE-2022-48338, bsc#1208514)
  * CVE-2022-48339.patch
    Fix htmlfontify.el command injection vulnerability (CVE-2022-48339 bsc#1208512)</changelog>
  <changelog author="gcomes.obs@gmail.com" date="1703851200">- fix typo in %{ext_info} macro usage</changelog>
  <changelog author="werner@suse.de" date="1712232000">- Add patch CVE-2024-30203.patch
  * Fix bsc#1222053 -- Gnus treats inline MIME contents as trusted
- Add patch CVE-2024-30204.patch
  * Fix bsc#1222052 -- LaTeX preview is enabled by default for e-mail attachments
- Add patch CVE-2024-30205.patch
  * Fix bsc#1222050 -- Org mode considers contents of remote files to be trusted</changelog>
  <changelog author="werner@suse.de" date="1712318400">- Modify patch CVE-2024-30204.patch
  * Backport the variable definition untrusted-content in lisp/files.el</changelog>
  <changelog author="werner@suse.de" date="1712923200">- Modify patch CVE-2024-30205.patch (bsc#1222050)
  * Add backport of (org--should-fetch-remote-resource-p) to be
    sure that remote file locations will be checked by the user
  * Use this in (org-file-contents)</changelog>
  <changelog author="werner@suse.de" date="1713268800">- Again fix %{%ext_info} to %{ext_info}  (boo#1221769)</changelog>
  <changelog author="werner@suse.de" date="1719835200">- Add patch CVE-2024-39331.patch
  Fix boo#1226957 (CVE-2024-39331): evaluation of arbitrary unsafe
  Elisp code in Org mode</changelog>
</package>
<package pkgid="7026807004dcdc9f3f9a1865b36c9f6b2332b1c5c6871ba90388d4ac31d3c757" name="emacs" arch="ppc64le">
  <version epoch="0" ver="27.2" rel="150400.3.17.1"/>
  <changelog author="werner@suse.de" date="1622030400">- Disable workaround with XLIB_SKIP_ARGB_VISUALS set (boo#1186341)</changelog>
  <changelog author="duncan@mac-vicar.eu" date="1622462400">- For terminal 24bit support, fall back to xterm+direct
  (semicolon version) if requested by the COLORTERM environment variable.
  Upstream commit 50f489b5dc.
  Allows 24bit color on gnome-terminal out of the box.
  * emacs-27.2-COLORTERM-24bit.patch</changelog>
  <changelog author="werner@suse.de" date="1623412800">- Enable workaround with XLIB_SKIP_ARGB_VISUALS set (boo#1186341)</changelog>
  <changelog author="schwab@suse.de" date="1626868800">- sigsegv-stack.patch: Port alternate signal stack to upcoming glibc 2.34</changelog>
  <changelog author="werner@suse.de" date="1631102400">- Work for boo#1183497: make sure that if ibus is the input method
  that there exists a working gtk immodule for ibus as well as the
  ibus daemon is up and running</changelog>
  <changelog author="werner@suse.de" date="1631188800">- Add patch boo1178942-bedb3cb6.patch to avoid that emacs hang in
  isearch (boo#1178942)</changelog>
  <changelog author="werner@suse.de" date="1636977600">- Again disable workaround with XLIB_SKIP_ARGB_VISUALS set (boo#1191517)
- Correct quoting of anonymous function calls</changelog>
  <changelog author="werner@suse.de" date="1637323200">- Enable the NO_AT_BRIDGE code</changelog>
  <changelog author="werner@suse.de" date="1637323201">- Make dbus code in emacs shell script failsafe</changelog>
  <changelog author="werner@suse.de" date="1637323202">- Get rid of the old dbus shell code in the emacs shell script
  nowadays this should be not needed anymore</changelog>
  <changelog author="mliska@suse.cz" date="1637582400">- Use %make_build macro.</changelog>
  <changelog author="werner@suse.de" date="1642075200">- Skip patch boo1180353-6d8144a2.patch for emacs 25.3 as already
  part of emacs 27.2: Was fix for boo#1180353 that was a possible
  segmentation fault in case of stack overflow of etags</changelog>
  <changelog author="werner@suse.de" date="1669723200">- Add upstream commit as patch d48bb487.patch (bsc#1205822, CVE-2022-45939)
  * shell command injection via source code files when using ctags</changelog>
  <changelog author="werner@suse.de" date="1676980800">- Add upstream commit/patches
  * 01a4035c.patch
    Fix etags local command injection vulnerability (CVE-2022-48337, bsc#1208515)
  * CVE-2022-48338.patch
    Fix ruby-mode.el local command injection vulnerability (CVE-2022-48338, bsc#1208514)
  * CVE-2022-48339.patch
    Fix htmlfontify.el command injection vulnerability (CVE-2022-48339 bsc#1208512)</changelog>
  <changelog author="gcomes.obs@gmail.com" date="1703851200">- fix typo in %{ext_info} macro usage</changelog>
  <changelog author="werner@suse.de" date="1712232000">- Add patch CVE-2024-30203.patch
  * Fix bsc#1222053 -- Gnus treats inline MIME contents as trusted
- Add patch CVE-2024-30204.patch
  * Fix bsc#1222052 -- LaTeX preview is enabled by default for e-mail attachments
- Add patch CVE-2024-30205.patch
  * Fix bsc#1222050 -- Org mode considers contents of remote files to be trusted</changelog>
  <changelog author="werner@suse.de" date="1712318400">- Modify patch CVE-2024-30204.patch
  * Backport the variable definition untrusted-content in lisp/files.el</changelog>
  <changelog author="werner@suse.de" date="1712923200">- Modify patch CVE-2024-30205.patch (bsc#1222050)
  * Add backport of (org--should-fetch-remote-resource-p) to be
    sure that remote file locations will be checked by the user
  * Use this in (org-file-contents)</changelog>
  <changelog author="werner@suse.de" date="1713268800">- Again fix %{%ext_info} to %{ext_info}  (boo#1221769)</changelog>
  <changelog author="werner@suse.de" date="1719835200">- Add patch CVE-2024-39331.patch
  Fix boo#1226957 (CVE-2024-39331): evaluation of arbitrary unsafe
  Elisp code in Org mode</changelog>
</package>
<package pkgid="1f6c080716c5d35298df512b02f7e058ca1b6cb1d7dbef6f99fb2b0c4e05d731" name="emacs" arch="s390x">
  <version epoch="0" ver="27.2" rel="150400.3.17.1"/>
  <changelog author="werner@suse.de" date="1622030400">- Disable workaround with XLIB_SKIP_ARGB_VISUALS set (boo#1186341)</changelog>
  <changelog author="duncan@mac-vicar.eu" date="1622462400">- For terminal 24bit support, fall back to xterm+direct
  (semicolon version) if requested by the COLORTERM environment variable.
  Upstream commit 50f489b5dc.
  Allows 24bit color on gnome-terminal out of the box.
  * emacs-27.2-COLORTERM-24bit.patch</changelog>
  <changelog author="werner@suse.de" date="1623412800">- Enable workaround with XLIB_SKIP_ARGB_VISUALS set (boo#1186341)</changelog>
  <changelog author="schwab@suse.de" date="1626868800">- sigsegv-stack.patch: Port alternate signal stack to upcoming glibc 2.34</changelog>
  <changelog author="werner@suse.de" date="1631102400">- Work for boo#1183497: make sure that if ibus is the input method
  that there exists a working gtk immodule for ibus as well as the
  ibus daemon is up and running</changelog>
  <changelog author="werner@suse.de" date="1631188800">- Add patch boo1178942-bedb3cb6.patch to avoid that emacs hang in
  isearch (boo#1178942)</changelog>
  <changelog author="werner@suse.de" date="1636977600">- Again disable workaround with XLIB_SKIP_ARGB_VISUALS set (boo#1191517)
- Correct quoting of anonymous function calls</changelog>
  <changelog author="werner@suse.de" date="1637323200">- Enable the NO_AT_BRIDGE code</changelog>
  <changelog author="werner@suse.de" date="1637323201">- Make dbus code in emacs shell script failsafe</changelog>
  <changelog author="werner@suse.de" date="1637323202">- Get rid of the old dbus shell code in the emacs shell script
  nowadays this should be not needed anymore</changelog>
  <changelog author="mliska@suse.cz" date="1637582400">- Use %make_build macro.</changelog>
  <changelog author="werner@suse.de" date="1642075200">- Skip patch boo1180353-6d8144a2.patch for emacs 25.3 as already
  part of emacs 27.2: Was fix for boo#1180353 that was a possible
  segmentation fault in case of stack overflow of etags</changelog>
  <changelog author="werner@suse.de" date="1669723200">- Add upstream commit as patch d48bb487.patch (bsc#1205822, CVE-2022-45939)
  * shell command injection via source code files when using ctags</changelog>
  <changelog author="werner@suse.de" date="1676980800">- Add upstream commit/patches
  * 01a4035c.patch
    Fix etags local command injection vulnerability (CVE-2022-48337, bsc#1208515)
  * CVE-2022-48338.patch
    Fix ruby-mode.el local command injection vulnerability (CVE-2022-48338, bsc#1208514)
  * CVE-2022-48339.patch
    Fix htmlfontify.el command injection vulnerability (CVE-2022-48339 bsc#1208512)</changelog>
  <changelog author="gcomes.obs@gmail.com" date="1703851200">- fix typo in %{ext_info} macro usage</changelog>
  <changelog author="werner@suse.de" date="1712232000">- Add patch CVE-2024-30203.patch
  * Fix bsc#1222053 -- Gnus treats inline MIME contents as trusted
- Add patch CVE-2024-30204.patch
  * Fix bsc#1222052 -- LaTeX preview is enabled by default for e-mail attachments
- Add patch CVE-2024-30205.patch
  * Fix bsc#1222050 -- Org mode considers contents of remote files to be trusted</changelog>
  <changelog author="werner@suse.de" date="1712318400">- Modify patch CVE-2024-30204.patch
  * Backport the variable definition untrusted-content in lisp/files.el</changelog>
  <changelog author="werner@suse.de" date="1712923200">- Modify patch CVE-2024-30205.patch (bsc#1222050)
  * Add backport of (org--should-fetch-remote-resource-p) to be
    sure that remote file locations will be checked by the user
  * Use this in (org-file-contents)</changelog>
  <changelog author="werner@suse.de" date="1713268800">- Again fix %{%ext_info} to %{ext_info}  (boo#1221769)</changelog>
  <changelog author="werner@suse.de" date="1719835200">- Add patch CVE-2024-39331.patch
  Fix boo#1226957 (CVE-2024-39331): evaluation of arbitrary unsafe
  Elisp code in Org mode</changelog>
</package>
<package pkgid="1785f1811e0c9c6db6d23d898fa3a8eb18ba188c3b7006433df65f1199746014" name="emacs" arch="src">
  <version epoch="0" ver="27.2" rel="150400.3.17.1"/>
  <changelog author="werner@suse.de" date="1622030400">- Disable workaround with XLIB_SKIP_ARGB_VISUALS set (boo#1186341)</changelog>
  <changelog author="duncan@mac-vicar.eu" date="1622462400">- For terminal 24bit support, fall back to xterm+direct
  (semicolon version) if requested by the COLORTERM environment variable.
  Upstream commit 50f489b5dc.
  Allows 24bit color on gnome-terminal out of the box.
  * emacs-27.2-COLORTERM-24bit.patch</changelog>
  <changelog author="werner@suse.de" date="1623412800">- Enable workaround with XLIB_SKIP_ARGB_VISUALS set (boo#1186341)</changelog>
  <changelog author="schwab@suse.de" date="1626868800">- sigsegv-stack.patch: Port alternate signal stack to upcoming glibc 2.34</changelog>
  <changelog author="werner@suse.de" date="1631102400">- Work for boo#1183497: make sure that if ibus is the input method
  that there exists a working gtk immodule for ibus as well as the
  ibus daemon is up and running</changelog>
  <changelog author="werner@suse.de" date="1631188800">- Add patch boo1178942-bedb3cb6.patch to avoid that emacs hang in
  isearch (boo#1178942)</changelog>
  <changelog author="werner@suse.de" date="1636977600">- Again disable workaround with XLIB_SKIP_ARGB_VISUALS set (boo#1191517)
- Correct quoting of anonymous function calls</changelog>
  <changelog author="werner@suse.de" date="1637323200">- Enable the NO_AT_BRIDGE code</changelog>
  <changelog author="werner@suse.de" date="1637323201">- Make dbus code in emacs shell script failsafe</changelog>
  <changelog author="werner@suse.de" date="1637323202">- Get rid of the old dbus shell code in the emacs shell script
  nowadays this should be not needed anymore</changelog>
  <changelog author="mliska@suse.cz" date="1637582400">- Use %make_build macro.</changelog>
  <changelog author="werner@suse.de" date="1642075200">- Skip patch boo1180353-6d8144a2.patch for emacs 25.3 as already
  part of emacs 27.2: Was fix for boo#1180353 that was a possible
  segmentation fault in case of stack overflow of etags</changelog>
  <changelog author="werner@suse.de" date="1669723200">- Add upstream commit as patch d48bb487.patch (bsc#1205822, CVE-2022-45939)
  * shell command injection via source code files when using ctags</changelog>
  <changelog author="werner@suse.de" date="1676980800">- Add upstream commit/patches
  * 01a4035c.patch
    Fix etags local command injection vulnerability (CVE-2022-48337, bsc#1208515)
  * CVE-2022-48338.patch
    Fix ruby-mode.el local command injection vulnerability (CVE-2022-48338, bsc#1208514)
  * CVE-2022-48339.patch
    Fix htmlfontify.el command injection vulnerability (CVE-2022-48339 bsc#1208512)</changelog>
  <changelog author="gcomes.obs@gmail.com" date="1703851200">- fix typo in %{ext_info} macro usage</changelog>
  <changelog author="werner@suse.de" date="1712232000">- Add patch CVE-2024-30203.patch
  * Fix bsc#1222053 -- Gnus treats inline MIME contents as trusted
- Add patch CVE-2024-30204.patch
  * Fix bsc#1222052 -- LaTeX preview is enabled by default for e-mail attachments
- Add patch CVE-2024-30205.patch
  * Fix bsc#1222050 -- Org mode considers contents of remote files to be trusted</changelog>
  <changelog author="werner@suse.de" date="1712318400">- Modify patch CVE-2024-30204.patch
  * Backport the variable definition untrusted-content in lisp/files.el</changelog>
  <changelog author="werner@suse.de" date="1712923200">- Modify patch CVE-2024-30205.patch (bsc#1222050)
  * Add backport of (org--should-fetch-remote-resource-p) to be
    sure that remote file locations will be checked by the user
  * Use this in (org-file-contents)</changelog>
  <changelog author="werner@suse.de" date="1713268800">- Again fix %{%ext_info} to %{ext_info}  (boo#1221769)</changelog>
  <changelog author="werner@suse.de" date="1719835200">- Add patch CVE-2024-39331.patch
  Fix boo#1226957 (CVE-2024-39331): evaluation of arbitrary unsafe
  Elisp code in Org mode</changelog>
</package>
<package pkgid="c942f47c004562b1d4f0c9e16e4c97b3cf7910422c770ddd053108faacfc6419" name="emacs" arch="x86_64">
  <version epoch="0" ver="27.2" rel="150400.3.17.1"/>
  <changelog author="werner@suse.de" date="1622030400">- Disable workaround with XLIB_SKIP_ARGB_VISUALS set (boo#1186341)</changelog>
  <changelog author="duncan@mac-vicar.eu" date="1622462400">- For terminal 24bit support, fall back to xterm+direct
  (semicolon version) if requested by the COLORTERM environment variable.
  Upstream commit 50f489b5dc.
  Allows 24bit color on gnome-terminal out of the box.
  * emacs-27.2-COLORTERM-24bit.patch</changelog>
  <changelog author="werner@suse.de" date="1623412800">- Enable workaround with XLIB_SKIP_ARGB_VISUALS set (boo#1186341)</changelog>
  <changelog author="schwab@suse.de" date="1626868800">- sigsegv-stack.patch: Port alternate signal stack to upcoming glibc 2.34</changelog>
  <changelog author="werner@suse.de" date="1631102400">- Work for boo#1183497: make sure that if ibus is the input method
  that there exists a working gtk immodule for ibus as well as the
  ibus daemon is up and running</changelog>
  <changelog author="werner@suse.de" date="1631188800">- Add patch boo1178942-bedb3cb6.patch to avoid that emacs hang in
  isearch (boo#1178942)</changelog>
  <changelog author="werner@suse.de" date="1636977600">- Again disable workaround with XLIB_SKIP_ARGB_VISUALS set (boo#1191517)
- Correct quoting of anonymous function calls</changelog>
  <changelog author="werner@suse.de" date="1637323200">- Enable the NO_AT_BRIDGE code</changelog>
  <changelog author="werner@suse.de" date="1637323201">- Make dbus code in emacs shell script failsafe</changelog>
  <changelog author="werner@suse.de" date="1637323202">- Get rid of the old dbus shell code in the emacs shell script
  nowadays this should be not needed anymore</changelog>
  <changelog author="mliska@suse.cz" date="1637582400">- Use %make_build macro.</changelog>
  <changelog author="werner@suse.de" date="1642075200">- Skip patch boo1180353-6d8144a2.patch for emacs 25.3 as already
  part of emacs 27.2: Was fix for boo#1180353 that was a possible
  segmentation fault in case of stack overflow of etags</changelog>
  <changelog author="werner@suse.de" date="1669723200">- Add upstream commit as patch d48bb487.patch (bsc#1205822, CVE-2022-45939)
  * shell command injection via source code files when using ctags</changelog>
  <changelog author="werner@suse.de" date="1676980800">- Add upstream commit/patches
  * 01a4035c.patch
    Fix etags local command injection vulnerability (CVE-2022-48337, bsc#1208515)
  * CVE-2022-48338.patch
    Fix ruby-mode.el local command injection vulnerability (CVE-2022-48338, bsc#1208514)
  * CVE-2022-48339.patch
    Fix htmlfontify.el command injection vulnerability (CVE-2022-48339 bsc#1208512)</changelog>
  <changelog author="gcomes.obs@gmail.com" date="1703851200">- fix typo in %{ext_info} macro usage</changelog>
  <changelog author="werner@suse.de" date="1712232000">- Add patch CVE-2024-30203.patch
  * Fix bsc#1222053 -- Gnus treats inline MIME contents as trusted
- Add patch CVE-2024-30204.patch
  * Fix bsc#1222052 -- LaTeX preview is enabled by default for e-mail attachments
- Add patch CVE-2024-30205.patch
  * Fix bsc#1222050 -- Org mode considers contents of remote files to be trusted</changelog>
  <changelog author="werner@suse.de" date="1712318400">- Modify patch CVE-2024-30204.patch
  * Backport the variable definition untrusted-content in lisp/files.el</changelog>
  <changelog author="werner@suse.de" date="1712923200">- Modify patch CVE-2024-30205.patch (bsc#1222050)
  * Add backport of (org--should-fetch-remote-resource-p) to be
    sure that remote file locations will be checked by the user
  * Use this in (org-file-contents)</changelog>
  <changelog author="werner@suse.de" date="1713268800">- Again fix %{%ext_info} to %{ext_info}  (boo#1221769)</changelog>
  <changelog author="werner@suse.de" date="1719835200">- Add patch CVE-2024-39331.patch
  Fix boo#1226957 (CVE-2024-39331): evaluation of arbitrary unsafe
  Elisp code in Org mode</changelog>
</package>
<package pkgid="0bec8ba8f073bfa7cd42e73fc657b18b5d3f3a32f47c0f01387f36ef88d3727b" name="emacs-el" arch="noarch">
  <version epoch="0" ver="27.2" rel="150400.3.17.1"/>
  <changelog author="werner@suse.de" date="1622030400">- Disable workaround with XLIB_SKIP_ARGB_VISUALS set (boo#1186341)</changelog>
  <changelog author="duncan@mac-vicar.eu" date="1622462400">- For terminal 24bit support, fall back to xterm+direct
  (semicolon version) if requested by the COLORTERM environment variable.
  Upstream commit 50f489b5dc.
  Allows 24bit color on gnome-terminal out of the box.
  * emacs-27.2-COLORTERM-24bit.patch</changelog>
  <changelog author="werner@suse.de" date="1623412800">- Enable workaround with XLIB_SKIP_ARGB_VISUALS set (boo#1186341)</changelog>
  <changelog author="schwab@suse.de" date="1626868800">- sigsegv-stack.patch: Port alternate signal stack to upcoming glibc 2.34</changelog>
  <changelog author="werner@suse.de" date="1631102400">- Work for boo#1183497: make sure that if ibus is the input method
  that there exists a working gtk immodule for ibus as well as the
  ibus daemon is up and running</changelog>
  <changelog author="werner@suse.de" date="1631188800">- Add patch boo1178942-bedb3cb6.patch to avoid that emacs hang in
  isearch (boo#1178942)</changelog>
  <changelog author="werner@suse.de" date="1636977600">- Again disable workaround with XLIB_SKIP_ARGB_VISUALS set (boo#1191517)
- Correct quoting of anonymous function calls</changelog>
  <changelog author="werner@suse.de" date="1637323200">- Enable the NO_AT_BRIDGE code</changelog>
  <changelog author="werner@suse.de" date="1637323201">- Make dbus code in emacs shell script failsafe</changelog>
  <changelog author="werner@suse.de" date="1637323202">- Get rid of the old dbus shell code in the emacs shell script
  nowadays this should be not needed anymore</changelog>
  <changelog author="mliska@suse.cz" date="1637582400">- Use %make_build macro.</changelog>
  <changelog author="werner@suse.de" date="1642075200">- Skip patch boo1180353-6d8144a2.patch for emacs 25.3 as already
  part of emacs 27.2: Was fix for boo#1180353 that was a possible
  segmentation fault in case of stack overflow of etags</changelog>
  <changelog author="werner@suse.de" date="1669723200">- Add upstream commit as patch d48bb487.patch (bsc#1205822, CVE-2022-45939)
  * shell command injection via source code files when using ctags</changelog>
  <changelog author="werner@suse.de" date="1676980800">- Add upstream commit/patches
  * 01a4035c.patch
    Fix etags local command injection vulnerability (CVE-2022-48337, bsc#1208515)
  * CVE-2022-48338.patch
    Fix ruby-mode.el local command injection vulnerability (CVE-2022-48338, bsc#1208514)
  * CVE-2022-48339.patch
    Fix htmlfontify.el command injection vulnerability (CVE-2022-48339 bsc#1208512)</changelog>
  <changelog author="gcomes.obs@gmail.com" date="1703851200">- fix typo in %{ext_info} macro usage</changelog>
  <changelog author="werner@suse.de" date="1712232000">- Add patch CVE-2024-30203.patch
  * Fix bsc#1222053 -- Gnus treats inline MIME contents as trusted
- Add patch CVE-2024-30204.patch
  * Fix bsc#1222052 -- LaTeX preview is enabled by default for e-mail attachments
- Add patch CVE-2024-30205.patch
  * Fix bsc#1222050 -- Org mode considers contents of remote files to be trusted</changelog>
  <changelog author="werner@suse.de" date="1712318400">- Modify patch CVE-2024-30204.patch
  * Backport the variable definition untrusted-content in lisp/files.el</changelog>
  <changelog author="werner@suse.de" date="1712923200">- Modify patch CVE-2024-30205.patch (bsc#1222050)
  * Add backport of (org--should-fetch-remote-resource-p) to be
    sure that remote file locations will be checked by the user
  * Use this in (org-file-contents)</changelog>
  <changelog author="werner@suse.de" date="1713268800">- Again fix %{%ext_info} to %{ext_info}  (boo#1221769)</changelog>
  <changelog author="werner@suse.de" date="1719835200">- Add patch CVE-2024-39331.patch
  Fix boo#1226957 (CVE-2024-39331): evaluation of arbitrary unsafe
  Elisp code in Org mode</changelog>
</package>
<package pkgid="5db84db21aa7de5d52c2871711a02ff7e07df164d0ecb4cbd0fb868148af3746" name="emacs-info" arch="noarch">
  <version epoch="0" ver="27.2" rel="150400.3.17.1"/>
  <changelog author="werner@suse.de" date="1622030400">- Disable workaround with XLIB_SKIP_ARGB_VISUALS set (boo#1186341)</changelog>
  <changelog author="duncan@mac-vicar.eu" date="1622462400">- For terminal 24bit support, fall back to xterm+direct
  (semicolon version) if requested by the COLORTERM environment variable.
  Upstream commit 50f489b5dc.
  Allows 24bit color on gnome-terminal out of the box.
  * emacs-27.2-COLORTERM-24bit.patch</changelog>
  <changelog author="werner@suse.de" date="1623412800">- Enable workaround with XLIB_SKIP_ARGB_VISUALS set (boo#1186341)</changelog>
  <changelog author="schwab@suse.de" date="1626868800">- sigsegv-stack.patch: Port alternate signal stack to upcoming glibc 2.34</changelog>
  <changelog author="werner@suse.de" date="1631102400">- Work for boo#1183497: make sure that if ibus is the input method
  that there exists a working gtk immodule for ibus as well as the
  ibus daemon is up and running</changelog>
  <changelog author="werner@suse.de" date="1631188800">- Add patch boo1178942-bedb3cb6.patch to avoid that emacs hang in
  isearch (boo#1178942)</changelog>
  <changelog author="werner@suse.de" date="1636977600">- Again disable workaround with XLIB_SKIP_ARGB_VISUALS set (boo#1191517)
- Correct quoting of anonymous function calls</changelog>
  <changelog author="werner@suse.de" date="1637323200">- Enable the NO_AT_BRIDGE code</changelog>
  <changelog author="werner@suse.de" date="1637323201">- Make dbus code in emacs shell script failsafe</changelog>
  <changelog author="werner@suse.de" date="1637323202">- Get rid of the old dbus shell code in the emacs shell script
  nowadays this should be not needed anymore</changelog>
  <changelog author="mliska@suse.cz" date="1637582400">- Use %make_build macro.</changelog>
  <changelog author="werner@suse.de" date="1642075200">- Skip patch boo1180353-6d8144a2.patch for emacs 25.3 as already
  part of emacs 27.2: Was fix for boo#1180353 that was a possible
  segmentation fault in case of stack overflow of etags</changelog>
  <changelog author="werner@suse.de" date="1669723200">- Add upstream commit as patch d48bb487.patch (bsc#1205822, CVE-2022-45939)
  * shell command injection via source code files when using ctags</changelog>
  <changelog author="werner@suse.de" date="1676980800">- Add upstream commit/patches
  * 01a4035c.patch
    Fix etags local command injection vulnerability (CVE-2022-48337, bsc#1208515)
  * CVE-2022-48338.patch
    Fix ruby-mode.el local command injection vulnerability (CVE-2022-48338, bsc#1208514)
  * CVE-2022-48339.patch
    Fix htmlfontify.el command injection vulnerability (CVE-2022-48339 bsc#1208512)</changelog>
  <changelog author="gcomes.obs@gmail.com" date="1703851200">- fix typo in %{ext_info} macro usage</changelog>
  <changelog author="werner@suse.de" date="1712232000">- Add patch CVE-2024-30203.patch
  * Fix bsc#1222053 -- Gnus treats inline MIME contents as trusted
- Add patch CVE-2024-30204.patch
  * Fix bsc#1222052 -- LaTeX preview is enabled by default for e-mail attachments
- Add patch CVE-2024-30205.patch
  * Fix bsc#1222050 -- Org mode considers contents of remote files to be trusted</changelog>
  <changelog author="werner@suse.de" date="1712318400">- Modify patch CVE-2024-30204.patch
  * Backport the variable definition untrusted-content in lisp/files.el</changelog>
  <changelog author="werner@suse.de" date="1712923200">- Modify patch CVE-2024-30205.patch (bsc#1222050)
  * Add backport of (org--should-fetch-remote-resource-p) to be
    sure that remote file locations will be checked by the user
  * Use this in (org-file-contents)</changelog>
  <changelog author="werner@suse.de" date="1713268800">- Again fix %{%ext_info} to %{ext_info}  (boo#1221769)</changelog>
  <changelog author="werner@suse.de" date="1719835200">- Add patch CVE-2024-39331.patch
  Fix boo#1226957 (CVE-2024-39331): evaluation of arbitrary unsafe
  Elisp code in Org mode</changelog>
</package>
<package pkgid="05472fbcfa872e60a384518adc84fc199fc216ac1d4f1e86bfcd62f193f95558" name="emacs-nox" arch="aarch64">
  <version epoch="0" ver="27.2" rel="150400.3.17.1"/>
  <changelog author="werner@suse.de" date="1622030400">- Disable workaround with XLIB_SKIP_ARGB_VISUALS set (boo#1186341)</changelog>
  <changelog author="duncan@mac-vicar.eu" date="1622462400">- For terminal 24bit support, fall back to xterm+direct
  (semicolon version) if requested by the COLORTERM environment variable.
  Upstream commit 50f489b5dc.
  Allows 24bit color on gnome-terminal out of the box.
  * emacs-27.2-COLORTERM-24bit.patch</changelog>
  <changelog author="werner@suse.de" date="1623412800">- Enable workaround with XLIB_SKIP_ARGB_VISUALS set (boo#1186341)</changelog>
  <changelog author="schwab@suse.de" date="1626868800">- sigsegv-stack.patch: Port alternate signal stack to upcoming glibc 2.34</changelog>
  <changelog author="werner@suse.de" date="1631102400">- Work for boo#1183497: make sure that if ibus is the input method
  that there exists a working gtk immodule for ibus as well as the
  ibus daemon is up and running</changelog>
  <changelog author="werner@suse.de" date="1631188800">- Add patch boo1178942-bedb3cb6.patch to avoid that emacs hang in
  isearch (boo#1178942)</changelog>
  <changelog author="werner@suse.de" date="1636977600">- Again disable workaround with XLIB_SKIP_ARGB_VISUALS set (boo#1191517)
- Correct quoting of anonymous function calls</changelog>
  <changelog author="werner@suse.de" date="1637323200">- Enable the NO_AT_BRIDGE code</changelog>
  <changelog author="werner@suse.de" date="1637323201">- Make dbus code in emacs shell script failsafe</changelog>
  <changelog author="werner@suse.de" date="1637323202">- Get rid of the old dbus shell code in the emacs shell script
  nowadays this should be not needed anymore</changelog>
  <changelog author="mliska@suse.cz" date="1637582400">- Use %make_build macro.</changelog>
  <changelog author="werner@suse.de" date="1642075200">- Skip patch boo1180353-6d8144a2.patch for emacs 25.3 as already
  part of emacs 27.2: Was fix for boo#1180353 that was a possible
  segmentation fault in case of stack overflow of etags</changelog>
  <changelog author="werner@suse.de" date="1669723200">- Add upstream commit as patch d48bb487.patch (bsc#1205822, CVE-2022-45939)
  * shell command injection via source code files when using ctags</changelog>
  <changelog author="werner@suse.de" date="1676980800">- Add upstream commit/patches
  * 01a4035c.patch
    Fix etags local command injection vulnerability (CVE-2022-48337, bsc#1208515)
  * CVE-2022-48338.patch
    Fix ruby-mode.el local command injection vulnerability (CVE-2022-48338, bsc#1208514)
  * CVE-2022-48339.patch
    Fix htmlfontify.el command injection vulnerability (CVE-2022-48339 bsc#1208512)</changelog>
  <changelog author="gcomes.obs@gmail.com" date="1703851200">- fix typo in %{ext_info} macro usage</changelog>
  <changelog author="werner@suse.de" date="1712232000">- Add patch CVE-2024-30203.patch
  * Fix bsc#1222053 -- Gnus treats inline MIME contents as trusted
- Add patch CVE-2024-30204.patch
  * Fix bsc#1222052 -- LaTeX preview is enabled by default for e-mail attachments
- Add patch CVE-2024-30205.patch
  * Fix bsc#1222050 -- Org mode considers contents of remote files to be trusted</changelog>
  <changelog author="werner@suse.de" date="1712318400">- Modify patch CVE-2024-30204.patch
  * Backport the variable definition untrusted-content in lisp/files.el</changelog>
  <changelog author="werner@suse.de" date="1712923200">- Modify patch CVE-2024-30205.patch (bsc#1222050)
  * Add backport of (org--should-fetch-remote-resource-p) to be
    sure that remote file locations will be checked by the user
  * Use this in (org-file-contents)</changelog>
  <changelog author="werner@suse.de" date="1713268800">- Again fix %{%ext_info} to %{ext_info}  (boo#1221769)</changelog>
  <changelog author="werner@suse.de" date="1719835200">- Add patch CVE-2024-39331.patch
  Fix boo#1226957 (CVE-2024-39331): evaluation of arbitrary unsafe
  Elisp code in Org mode</changelog>
</package>
<package pkgid="330070c0a58713f65d427f5da1b53a724e2f35ccbbdd692c7ee78e2b03ed4f92" name="emacs-nox" arch="ppc64le">
  <version epoch="0" ver="27.2" rel="150400.3.17.1"/>
  <changelog author="werner@suse.de" date="1622030400">- Disable workaround with XLIB_SKIP_ARGB_VISUALS set (boo#1186341)</changelog>
  <changelog author="duncan@mac-vicar.eu" date="1622462400">- For terminal 24bit support, fall back to xterm+direct
  (semicolon version) if requested by the COLORTERM environment variable.
  Upstream commit 50f489b5dc.
  Allows 24bit color on gnome-terminal out of the box.
  * emacs-27.2-COLORTERM-24bit.patch</changelog>
  <changelog author="werner@suse.de" date="1623412800">- Enable workaround with XLIB_SKIP_ARGB_VISUALS set (boo#1186341)</changelog>
  <changelog author="schwab@suse.de" date="1626868800">- sigsegv-stack.patch: Port alternate signal stack to upcoming glibc 2.34</changelog>
  <changelog author="werner@suse.de" date="1631102400">- Work for boo#1183497: make sure that if ibus is the input method
  that there exists a working gtk immodule for ibus as well as the
  ibus daemon is up and running</changelog>
  <changelog author="werner@suse.de" date="1631188800">- Add patch boo1178942-bedb3cb6.patch to avoid that emacs hang in
  isearch (boo#1178942)</changelog>
  <changelog author="werner@suse.de" date="1636977600">- Again disable workaround with XLIB_SKIP_ARGB_VISUALS set (boo#1191517)
- Correct quoting of anonymous function calls</changelog>
  <changelog author="werner@suse.de" date="1637323200">- Enable the NO_AT_BRIDGE code</changelog>
  <changelog author="werner@suse.de" date="1637323201">- Make dbus code in emacs shell script failsafe</changelog>
  <changelog author="werner@suse.de" date="1637323202">- Get rid of the old dbus shell code in the emacs shell script
  nowadays this should be not needed anymore</changelog>
  <changelog author="mliska@suse.cz" date="1637582400">- Use %make_build macro.</changelog>
  <changelog author="werner@suse.de" date="1642075200">- Skip patch boo1180353-6d8144a2.patch for emacs 25.3 as already
  part of emacs 27.2: Was fix for boo#1180353 that was a possible
  segmentation fault in case of stack overflow of etags</changelog>
  <changelog author="werner@suse.de" date="1669723200">- Add upstream commit as patch d48bb487.patch (bsc#1205822, CVE-2022-45939)
  * shell command injection via source code files when using ctags</changelog>
  <changelog author="werner@suse.de" date="1676980800">- Add upstream commit/patches
  * 01a4035c.patch
    Fix etags local command injection vulnerability (CVE-2022-48337, bsc#1208515)
  * CVE-2022-48338.patch
    Fix ruby-mode.el local command injection vulnerability (CVE-2022-48338, bsc#1208514)
  * CVE-2022-48339.patch
    Fix htmlfontify.el command injection vulnerability (CVE-2022-48339 bsc#1208512)</changelog>
  <changelog author="gcomes.obs@gmail.com" date="1703851200">- fix typo in %{ext_info} macro usage</changelog>
  <changelog author="werner@suse.de" date="1712232000">- Add patch CVE-2024-30203.patch
  * Fix bsc#1222053 -- Gnus treats inline MIME contents as trusted
- Add patch CVE-2024-30204.patch
  * Fix bsc#1222052 -- LaTeX preview is enabled by default for e-mail attachments
- Add patch CVE-2024-30205.patch
  * Fix bsc#1222050 -- Org mode considers contents of remote files to be trusted</changelog>
  <changelog author="werner@suse.de" date="1712318400">- Modify patch CVE-2024-30204.patch
  * Backport the variable definition untrusted-content in lisp/files.el</changelog>
  <changelog author="werner@suse.de" date="1712923200">- Modify patch CVE-2024-30205.patch (bsc#1222050)
  * Add backport of (org--should-fetch-remote-resource-p) to be
    sure that remote file locations will be checked by the user
  * Use this in (org-file-contents)</changelog>
  <changelog author="werner@suse.de" date="1713268800">- Again fix %{%ext_info} to %{ext_info}  (boo#1221769)</changelog>
  <changelog author="werner@suse.de" date="1719835200">- Add patch CVE-2024-39331.patch
  Fix boo#1226957 (CVE-2024-39331): evaluation of arbitrary unsafe
  Elisp code in Org mode</changelog>
</package>
<package pkgid="44f4f2cfd17c389e066898cc6fda2037d65ffaf3925fa2e9e77b9b494b3dc32e" name="emacs-nox" arch="s390x">
  <version epoch="0" ver="27.2" rel="150400.3.17.1"/>
  <changelog author="werner@suse.de" date="1622030400">- Disable workaround with XLIB_SKIP_ARGB_VISUALS set (boo#1186341)</changelog>
  <changelog author="duncan@mac-vicar.eu" date="1622462400">- For terminal 24bit support, fall back to xterm+direct
  (semicolon version) if requested by the COLORTERM environment variable.
  Upstream commit 50f489b5dc.
  Allows 24bit color on gnome-terminal out of the box.
  * emacs-27.2-COLORTERM-24bit.patch</changelog>
  <changelog author="werner@suse.de" date="1623412800">- Enable workaround with XLIB_SKIP_ARGB_VISUALS set (boo#1186341)</changelog>
  <changelog author="schwab@suse.de" date="1626868800">- sigsegv-stack.patch: Port alternate signal stack to upcoming glibc 2.34</changelog>
  <changelog author="werner@suse.de" date="1631102400">- Work for boo#1183497: make sure that if ibus is the input method
  that there exists a working gtk immodule for ibus as well as the
  ibus daemon is up and running</changelog>
  <changelog author="werner@suse.de" date="1631188800">- Add patch boo1178942-bedb3cb6.patch to avoid that emacs hang in
  isearch (boo#1178942)</changelog>
  <changelog author="werner@suse.de" date="1636977600">- Again disable workaround with XLIB_SKIP_ARGB_VISUALS set (boo#1191517)
- Correct quoting of anonymous function calls</changelog>
  <changelog author="werner@suse.de" date="1637323200">- Enable the NO_AT_BRIDGE code</changelog>
  <changelog author="werner@suse.de" date="1637323201">- Make dbus code in emacs shell script failsafe</changelog>
  <changelog author="werner@suse.de" date="1637323202">- Get rid of the old dbus shell code in the emacs shell script
  nowadays this should be not needed anymore</changelog>
  <changelog author="mliska@suse.cz" date="1637582400">- Use %make_build macro.</changelog>
  <changelog author="werner@suse.de" date="1642075200">- Skip patch boo1180353-6d8144a2.patch for emacs 25.3 as already
  part of emacs 27.2: Was fix for boo#1180353 that was a possible
  segmentation fault in case of stack overflow of etags</changelog>
  <changelog author="werner@suse.de" date="1669723200">- Add upstream commit as patch d48bb487.patch (bsc#1205822, CVE-2022-45939)
  * shell command injection via source code files when using ctags</changelog>
  <changelog author="werner@suse.de" date="1676980800">- Add upstream commit/patches
  * 01a4035c.patch
    Fix etags local command injection vulnerability (CVE-2022-48337, bsc#1208515)
  * CVE-2022-48338.patch
    Fix ruby-mode.el local command injection vulnerability (CVE-2022-48338, bsc#1208514)
  * CVE-2022-48339.patch
    Fix htmlfontify.el command injection vulnerability (CVE-2022-48339 bsc#1208512)</changelog>
  <changelog author="gcomes.obs@gmail.com" date="1703851200">- fix typo in %{ext_info} macro usage</changelog>
  <changelog author="werner@suse.de" date="1712232000">- Add patch CVE-2024-30203.patch
  * Fix bsc#1222053 -- Gnus treats inline MIME contents as trusted
- Add patch CVE-2024-30204.patch
  * Fix bsc#1222052 -- LaTeX preview is enabled by default for e-mail attachments
- Add patch CVE-2024-30205.patch
  * Fix bsc#1222050 -- Org mode considers contents of remote files to be trusted</changelog>
  <changelog author="werner@suse.de" date="1712318400">- Modify patch CVE-2024-30204.patch
  * Backport the variable definition untrusted-content in lisp/files.el</changelog>
  <changelog author="werner@suse.de" date="1712923200">- Modify patch CVE-2024-30205.patch (bsc#1222050)
  * Add backport of (org--should-fetch-remote-resource-p) to be
    sure that remote file locations will be checked by the user
  * Use this in (org-file-contents)</changelog>
  <changelog author="werner@suse.de" date="1713268800">- Again fix %{%ext_info} to %{ext_info}  (boo#1221769)</changelog>
  <changelog author="werner@suse.de" date="1719835200">- Add patch CVE-2024-39331.patch
  Fix boo#1226957 (CVE-2024-39331): evaluation of arbitrary unsafe
  Elisp code in Org mode</changelog>
</package>
<package pkgid="396c1d5e6b2fa1895aafdb0f9c92dbb197894bcc34cea1ce23551516ea3e1eeb" name="emacs-nox" arch="x86_64">
  <version epoch="0" ver="27.2" rel="150400.3.17.1"/>
  <changelog author="werner@suse.de" date="1622030400">- Disable workaround with XLIB_SKIP_ARGB_VISUALS set (boo#1186341)</changelog>
  <changelog author="duncan@mac-vicar.eu" date="1622462400">- For terminal 24bit support, fall back to xterm+direct
  (semicolon version) if requested by the COLORTERM environment variable.
  Upstream commit 50f489b5dc.
  Allows 24bit color on gnome-terminal out of the box.
  * emacs-27.2-COLORTERM-24bit.patch</changelog>
  <changelog author="werner@suse.de" date="1623412800">- Enable workaround with XLIB_SKIP_ARGB_VISUALS set (boo#1186341)</changelog>
  <changelog author="schwab@suse.de" date="1626868800">- sigsegv-stack.patch: Port alternate signal stack to upcoming glibc 2.34</changelog>
  <changelog author="werner@suse.de" date="1631102400">- Work for boo#1183497: make sure that if ibus is the input method
  that there exists a working gtk immodule for ibus as well as the
  ibus daemon is up and running</changelog>
  <changelog author="werner@suse.de" date="1631188800">- Add patch boo1178942-bedb3cb6.patch to avoid that emacs hang in
  isearch (boo#1178942)</changelog>
  <changelog author="werner@suse.de" date="1636977600">- Again disable workaround with XLIB_SKIP_ARGB_VISUALS set (boo#1191517)
- Correct quoting of anonymous function calls</changelog>
  <changelog author="werner@suse.de" date="1637323200">- Enable the NO_AT_BRIDGE code</changelog>
  <changelog author="werner@suse.de" date="1637323201">- Make dbus code in emacs shell script failsafe</changelog>
  <changelog author="werner@suse.de" date="1637323202">- Get rid of the old dbus shell code in the emacs shell script
  nowadays this should be not needed anymore</changelog>
  <changelog author="mliska@suse.cz" date="1637582400">- Use %make_build macro.</changelog>
  <changelog author="werner@suse.de" date="1642075200">- Skip patch boo1180353-6d8144a2.patch for emacs 25.3 as already
  part of emacs 27.2: Was fix for boo#1180353 that was a possible
  segmentation fault in case of stack overflow of etags</changelog>
  <changelog author="werner@suse.de" date="1669723200">- Add upstream commit as patch d48bb487.patch (bsc#1205822, CVE-2022-45939)
  * shell command injection via source code files when using ctags</changelog>
  <changelog author="werner@suse.de" date="1676980800">- Add upstream commit/patches
  * 01a4035c.patch
    Fix etags local command injection vulnerability (CVE-2022-48337, bsc#1208515)
  * CVE-2022-48338.patch
    Fix ruby-mode.el local command injection vulnerability (CVE-2022-48338, bsc#1208514)
  * CVE-2022-48339.patch
    Fix htmlfontify.el command injection vulnerability (CVE-2022-48339 bsc#1208512)</changelog>
  <changelog author="gcomes.obs@gmail.com" date="1703851200">- fix typo in %{ext_info} macro usage</changelog>
  <changelog author="werner@suse.de" date="1712232000">- Add patch CVE-2024-30203.patch
  * Fix bsc#1222053 -- Gnus treats inline MIME contents as trusted
- Add patch CVE-2024-30204.patch
  * Fix bsc#1222052 -- LaTeX preview is enabled by default for e-mail attachments
- Add patch CVE-2024-30205.patch
  * Fix bsc#1222050 -- Org mode considers contents of remote files to be trusted</changelog>
  <changelog author="werner@suse.de" date="1712318400">- Modify patch CVE-2024-30204.patch
  * Backport the variable definition untrusted-content in lisp/files.el</changelog>
  <changelog author="werner@suse.de" date="1712923200">- Modify patch CVE-2024-30205.patch (bsc#1222050)
  * Add backport of (org--should-fetch-remote-resource-p) to be
    sure that remote file locations will be checked by the user
  * Use this in (org-file-contents)</changelog>
  <changelog author="werner@suse.de" date="1713268800">- Again fix %{%ext_info} to %{ext_info}  (boo#1221769)</changelog>
  <changelog author="werner@suse.de" date="1719835200">- Add patch CVE-2024-39331.patch
  Fix boo#1226957 (CVE-2024-39331): evaluation of arbitrary unsafe
  Elisp code in Org mode</changelog>
</package>
<package pkgid="4716aaf27776e8c2ce3057b4bca7ce2aafad21dbc1e517fa76b1abc07d2533f8" name="emacs-x11" arch="aarch64">
  <version epoch="0" ver="27.2" rel="150400.3.17.1"/>
  <changelog author="werner@suse.de" date="1622030400">- Disable workaround with XLIB_SKIP_ARGB_VISUALS set (boo#1186341)</changelog>
  <changelog author="duncan@mac-vicar.eu" date="1622462400">- For terminal 24bit support, fall back to xterm+direct
  (semicolon version) if requested by the COLORTERM environment variable.
  Upstream commit 50f489b5dc.
  Allows 24bit color on gnome-terminal out of the box.
  * emacs-27.2-COLORTERM-24bit.patch</changelog>
  <changelog author="werner@suse.de" date="1623412800">- Enable workaround with XLIB_SKIP_ARGB_VISUALS set (boo#1186341)</changelog>
  <changelog author="schwab@suse.de" date="1626868800">- sigsegv-stack.patch: Port alternate signal stack to upcoming glibc 2.34</changelog>
  <changelog author="werner@suse.de" date="1631102400">- Work for boo#1183497: make sure that if ibus is the input method
  that there exists a working gtk immodule for ibus as well as the
  ibus daemon is up and running</changelog>
  <changelog author="werner@suse.de" date="1631188800">- Add patch boo1178942-bedb3cb6.patch to avoid that emacs hang in
  isearch (boo#1178942)</changelog>
  <changelog author="werner@suse.de" date="1636977600">- Again disable workaround with XLIB_SKIP_ARGB_VISUALS set (boo#1191517)
- Correct quoting of anonymous function calls</changelog>
  <changelog author="werner@suse.de" date="1637323200">- Enable the NO_AT_BRIDGE code</changelog>
  <changelog author="werner@suse.de" date="1637323201">- Make dbus code in emacs shell script failsafe</changelog>
  <changelog author="werner@suse.de" date="1637323202">- Get rid of the old dbus shell code in the emacs shell script
  nowadays this should be not needed anymore</changelog>
  <changelog author="mliska@suse.cz" date="1637582400">- Use %make_build macro.</changelog>
  <changelog author="werner@suse.de" date="1642075200">- Skip patch boo1180353-6d8144a2.patch for emacs 25.3 as already
  part of emacs 27.2: Was fix for boo#1180353 that was a possible
  segmentation fault in case of stack overflow of etags</changelog>
  <changelog author="werner@suse.de" date="1669723200">- Add upstream commit as patch d48bb487.patch (bsc#1205822, CVE-2022-45939)
  * shell command injection via source code files when using ctags</changelog>
  <changelog author="werner@suse.de" date="1676980800">- Add upstream commit/patches
  * 01a4035c.patch
    Fix etags local command injection vulnerability (CVE-2022-48337, bsc#1208515)
  * CVE-2022-48338.patch
    Fix ruby-mode.el local command injection vulnerability (CVE-2022-48338, bsc#1208514)
  * CVE-2022-48339.patch
    Fix htmlfontify.el command injection vulnerability (CVE-2022-48339 bsc#1208512)</changelog>
  <changelog author="gcomes.obs@gmail.com" date="1703851200">- fix typo in %{ext_info} macro usage</changelog>
  <changelog author="werner@suse.de" date="1712232000">- Add patch CVE-2024-30203.patch
  * Fix bsc#1222053 -- Gnus treats inline MIME contents as trusted
- Add patch CVE-2024-30204.patch
  * Fix bsc#1222052 -- LaTeX preview is enabled by default for e-mail attachments
- Add patch CVE-2024-30205.patch
  * Fix bsc#1222050 -- Org mode considers contents of remote files to be trusted</changelog>
  <changelog author="werner@suse.de" date="1712318400">- Modify patch CVE-2024-30204.patch
  * Backport the variable definition untrusted-content in lisp/files.el</changelog>
  <changelog author="werner@suse.de" date="1712923200">- Modify patch CVE-2024-30205.patch (bsc#1222050)
  * Add backport of (org--should-fetch-remote-resource-p) to be
    sure that remote file locations will be checked by the user
  * Use this in (org-file-contents)</changelog>
  <changelog author="werner@suse.de" date="1713268800">- Again fix %{%ext_info} to %{ext_info}  (boo#1221769)</changelog>
  <changelog author="werner@suse.de" date="1719835200">- Add patch CVE-2024-39331.patch
  Fix boo#1226957 (CVE-2024-39331): evaluation of arbitrary unsafe
  Elisp code in Org mode</changelog>
</package>
<package pkgid="a36be5121b24f96fe687c120f754530c63ddaf83c19415c7fe32231fb0bb04da" name="emacs-x11" arch="ppc64le">
  <version epoch="0" ver="27.2" rel="150400.3.17.1"/>
  <changelog author="werner@suse.de" date="1622030400">- Disable workaround with XLIB_SKIP_ARGB_VISUALS set (boo#1186341)</changelog>
  <changelog author="duncan@mac-vicar.eu" date="1622462400">- For terminal 24bit support, fall back to xterm+direct
  (semicolon version) if requested by the COLORTERM environment variable.
  Upstream commit 50f489b5dc.
  Allows 24bit color on gnome-terminal out of the box.
  * emacs-27.2-COLORTERM-24bit.patch</changelog>
  <changelog author="werner@suse.de" date="1623412800">- Enable workaround with XLIB_SKIP_ARGB_VISUALS set (boo#1186341)</changelog>
  <changelog author="schwab@suse.de" date="1626868800">- sigsegv-stack.patch: Port alternate signal stack to upcoming glibc 2.34</changelog>
  <changelog author="werner@suse.de" date="1631102400">- Work for boo#1183497: make sure that if ibus is the input method
  that there exists a working gtk immodule for ibus as well as the
  ibus daemon is up and running</changelog>
  <changelog author="werner@suse.de" date="1631188800">- Add patch boo1178942-bedb3cb6.patch to avoid that emacs hang in
  isearch (boo#1178942)</changelog>
  <changelog author="werner@suse.de" date="1636977600">- Again disable workaround with XLIB_SKIP_ARGB_VISUALS set (boo#1191517)
- Correct quoting of anonymous function calls</changelog>
  <changelog author="werner@suse.de" date="1637323200">- Enable the NO_AT_BRIDGE code</changelog>
  <changelog author="werner@suse.de" date="1637323201">- Make dbus code in emacs shell script failsafe</changelog>
  <changelog author="werner@suse.de" date="1637323202">- Get rid of the old dbus shell code in the emacs shell script
  nowadays this should be not needed anymore</changelog>
  <changelog author="mliska@suse.cz" date="1637582400">- Use %make_build macro.</changelog>
  <changelog author="werner@suse.de" date="1642075200">- Skip patch boo1180353-6d8144a2.patch for emacs 25.3 as already
  part of emacs 27.2: Was fix for boo#1180353 that was a possible
  segmentation fault in case of stack overflow of etags</changelog>
  <changelog author="werner@suse.de" date="1669723200">- Add upstream commit as patch d48bb487.patch (bsc#1205822, CVE-2022-45939)
  * shell command injection via source code files when using ctags</changelog>
  <changelog author="werner@suse.de" date="1676980800">- Add upstream commit/patches
  * 01a4035c.patch
    Fix etags local command injection vulnerability (CVE-2022-48337, bsc#1208515)
  * CVE-2022-48338.patch
    Fix ruby-mode.el local command injection vulnerability (CVE-2022-48338, bsc#1208514)
  * CVE-2022-48339.patch
    Fix htmlfontify.el command injection vulnerability (CVE-2022-48339 bsc#1208512)</changelog>
  <changelog author="gcomes.obs@gmail.com" date="1703851200">- fix typo in %{ext_info} macro usage</changelog>
  <changelog author="werner@suse.de" date="1712232000">- Add patch CVE-2024-30203.patch
  * Fix bsc#1222053 -- Gnus treats inline MIME contents as trusted
- Add patch CVE-2024-30204.patch
  * Fix bsc#1222052 -- LaTeX preview is enabled by default for e-mail attachments
- Add patch CVE-2024-30205.patch
  * Fix bsc#1222050 -- Org mode considers contents of remote files to be trusted</changelog>
  <changelog author="werner@suse.de" date="1712318400">- Modify patch CVE-2024-30204.patch
  * Backport the variable definition untrusted-content in lisp/files.el</changelog>
  <changelog author="werner@suse.de" date="1712923200">- Modify patch CVE-2024-30205.patch (bsc#1222050)
  * Add backport of (org--should-fetch-remote-resource-p) to be
    sure that remote file locations will be checked by the user
  * Use this in (org-file-contents)</changelog>
  <changelog author="werner@suse.de" date="1713268800">- Again fix %{%ext_info} to %{ext_info}  (boo#1221769)</changelog>
  <changelog author="werner@suse.de" date="1719835200">- Add patch CVE-2024-39331.patch
  Fix boo#1226957 (CVE-2024-39331): evaluation of arbitrary unsafe
  Elisp code in Org mode</changelog>
</package>
<package pkgid="a7c1a460dbb7d102e6c410c642fd3ce38b5423e5afab3e6e117af31bbdbd4e9e" name="emacs-x11" arch="s390x">
  <version epoch="0" ver="27.2" rel="150400.3.17.1"/>
  <changelog author="werner@suse.de" date="1622030400">- Disable workaround with XLIB_SKIP_ARGB_VISUALS set (boo#1186341)</changelog>
  <changelog author="duncan@mac-vicar.eu" date="1622462400">- For terminal 24bit support, fall back to xterm+direct
  (semicolon version) if requested by the COLORTERM environment variable.
  Upstream commit 50f489b5dc.
  Allows 24bit color on gnome-terminal out of the box.
  * emacs-27.2-COLORTERM-24bit.patch</changelog>
  <changelog author="werner@suse.de" date="1623412800">- Enable workaround with XLIB_SKIP_ARGB_VISUALS set (boo#1186341)</changelog>
  <changelog author="schwab@suse.de" date="1626868800">- sigsegv-stack.patch: Port alternate signal stack to upcoming glibc 2.34</changelog>
  <changelog author="werner@suse.de" date="1631102400">- Work for boo#1183497: make sure that if ibus is the input method
  that there exists a working gtk immodule for ibus as well as the
  ibus daemon is up and running</changelog>
  <changelog author="werner@suse.de" date="1631188800">- Add patch boo1178942-bedb3cb6.patch to avoid that emacs hang in
  isearch (boo#1178942)</changelog>
  <changelog author="werner@suse.de" date="1636977600">- Again disable workaround with XLIB_SKIP_ARGB_VISUALS set (boo#1191517)
- Correct quoting of anonymous function calls</changelog>
  <changelog author="werner@suse.de" date="1637323200">- Enable the NO_AT_BRIDGE code</changelog>
  <changelog author="werner@suse.de" date="1637323201">- Make dbus code in emacs shell script failsafe</changelog>
  <changelog author="werner@suse.de" date="1637323202">- Get rid of the old dbus shell code in the emacs shell script
  nowadays this should be not needed anymore</changelog>
  <changelog author="mliska@suse.cz" date="1637582400">- Use %make_build macro.</changelog>
  <changelog author="werner@suse.de" date="1642075200">- Skip patch boo1180353-6d8144a2.patch for emacs 25.3 as already
  part of emacs 27.2: Was fix for boo#1180353 that was a possible
  segmentation fault in case of stack overflow of etags</changelog>
  <changelog author="werner@suse.de" date="1669723200">- Add upstream commit as patch d48bb487.patch (bsc#1205822, CVE-2022-45939)
  * shell command injection via source code files when using ctags</changelog>
  <changelog author="werner@suse.de" date="1676980800">- Add upstream commit/patches
  * 01a4035c.patch
    Fix etags local command injection vulnerability (CVE-2022-48337, bsc#1208515)
  * CVE-2022-48338.patch
    Fix ruby-mode.el local command injection vulnerability (CVE-2022-48338, bsc#1208514)
  * CVE-2022-48339.patch
    Fix htmlfontify.el command injection vulnerability (CVE-2022-48339 bsc#1208512)</changelog>
  <changelog author="gcomes.obs@gmail.com" date="1703851200">- fix typo in %{ext_info} macro usage</changelog>
  <changelog author="werner@suse.de" date="1712232000">- Add patch CVE-2024-30203.patch
  * Fix bsc#1222053 -- Gnus treats inline MIME contents as trusted
- Add patch CVE-2024-30204.patch
  * Fix bsc#1222052 -- LaTeX preview is enabled by default for e-mail attachments
- Add patch CVE-2024-30205.patch
  * Fix bsc#1222050 -- Org mode considers contents of remote files to be trusted</changelog>
  <changelog author="werner@suse.de" date="1712318400">- Modify patch CVE-2024-30204.patch
  * Backport the variable definition untrusted-content in lisp/files.el</changelog>
  <changelog author="werner@suse.de" date="1712923200">- Modify patch CVE-2024-30205.patch (bsc#1222050)
  * Add backport of (org--should-fetch-remote-resource-p) to be
    sure that remote file locations will be checked by the user
  * Use this in (org-file-contents)</changelog>
  <changelog author="werner@suse.de" date="1713268800">- Again fix %{%ext_info} to %{ext_info}  (boo#1221769)</changelog>
  <changelog author="werner@suse.de" date="1719835200">- Add patch CVE-2024-39331.patch
  Fix boo#1226957 (CVE-2024-39331): evaluation of arbitrary unsafe
  Elisp code in Org mode</changelog>
</package>
<package pkgid="a1e1b4721d8190431b1990d90fea62397677d1ccacd729308fe5e8e98bdbcc11" name="emacs-x11" arch="x86_64">
  <version epoch="0" ver="27.2" rel="150400.3.17.1"/>
  <changelog author="werner@suse.de" date="1622030400">- Disable workaround with XLIB_SKIP_ARGB_VISUALS set (boo#1186341)</changelog>
  <changelog author="duncan@mac-vicar.eu" date="1622462400">- For terminal 24bit support, fall back to xterm+direct
  (semicolon version) if requested by the COLORTERM environment variable.
  Upstream commit 50f489b5dc.
  Allows 24bit color on gnome-terminal out of the box.
  * emacs-27.2-COLORTERM-24bit.patch</changelog>
  <changelog author="werner@suse.de" date="1623412800">- Enable workaround with XLIB_SKIP_ARGB_VISUALS set (boo#1186341)</changelog>
  <changelog author="schwab@suse.de" date="1626868800">- sigsegv-stack.patch: Port alternate signal stack to upcoming glibc 2.34</changelog>
  <changelog author="werner@suse.de" date="1631102400">- Work for boo#1183497: make sure that if ibus is the input method
  that there exists a working gtk immodule for ibus as well as the
  ibus daemon is up and running</changelog>
  <changelog author="werner@suse.de" date="1631188800">- Add patch boo1178942-bedb3cb6.patch to avoid that emacs hang in
  isearch (boo#1178942)</changelog>
  <changelog author="werner@suse.de" date="1636977600">- Again disable workaround with XLIB_SKIP_ARGB_VISUALS set (boo#1191517)
- Correct quoting of anonymous function calls</changelog>
  <changelog author="werner@suse.de" date="1637323200">- Enable the NO_AT_BRIDGE code</changelog>
  <changelog author="werner@suse.de" date="1637323201">- Make dbus code in emacs shell script failsafe</changelog>
  <changelog author="werner@suse.de" date="1637323202">- Get rid of the old dbus shell code in the emacs shell script
  nowadays this should be not needed anymore</changelog>
  <changelog author="mliska@suse.cz" date="1637582400">- Use %make_build macro.</changelog>
  <changelog author="werner@suse.de" date="1642075200">- Skip patch boo1180353-6d8144a2.patch for emacs 25.3 as already
  part of emacs 27.2: Was fix for boo#1180353 that was a possible
  segmentation fault in case of stack overflow of etags</changelog>
  <changelog author="werner@suse.de" date="1669723200">- Add upstream commit as patch d48bb487.patch (bsc#1205822, CVE-2022-45939)
  * shell command injection via source code files when using ctags</changelog>
  <changelog author="werner@suse.de" date="1676980800">- Add upstream commit/patches
  * 01a4035c.patch
    Fix etags local command injection vulnerability (CVE-2022-48337, bsc#1208515)
  * CVE-2022-48338.patch
    Fix ruby-mode.el local command injection vulnerability (CVE-2022-48338, bsc#1208514)
  * CVE-2022-48339.patch
    Fix htmlfontify.el command injection vulnerability (CVE-2022-48339 bsc#1208512)</changelog>
  <changelog author="gcomes.obs@gmail.com" date="1703851200">- fix typo in %{ext_info} macro usage</changelog>
  <changelog author="werner@suse.de" date="1712232000">- Add patch CVE-2024-30203.patch
  * Fix bsc#1222053 -- Gnus treats inline MIME contents as trusted
- Add patch CVE-2024-30204.patch
  * Fix bsc#1222052 -- LaTeX preview is enabled by default for e-mail attachments
- Add patch CVE-2024-30205.patch
  * Fix bsc#1222050 -- Org mode considers contents of remote files to be trusted</changelog>
  <changelog author="werner@suse.de" date="1712318400">- Modify patch CVE-2024-30204.patch
  * Backport the variable definition untrusted-content in lisp/files.el</changelog>
  <changelog author="werner@suse.de" date="1712923200">- Modify patch CVE-2024-30205.patch (bsc#1222050)
  * Add backport of (org--should-fetch-remote-resource-p) to be
    sure that remote file locations will be checked by the user
  * Use this in (org-file-contents)</changelog>
  <changelog author="werner@suse.de" date="1713268800">- Again fix %{%ext_info} to %{ext_info}  (boo#1221769)</changelog>
  <changelog author="werner@suse.de" date="1719835200">- Add patch CVE-2024-39331.patch
  Fix boo#1226957 (CVE-2024-39331): evaluation of arbitrary unsafe
  Elisp code in Org mode</changelog>
</package>
<package pkgid="2d6cc87a5b674f9320a7c2b5cf4a5a3b73eb6a08e2c3b9870be5d82a6b2c6b0d" name="erlang-rabbitmq-client313" arch="aarch64">
  <version epoch="0" ver="3.13.1" rel="150600.13.5.3"/>
  <changelog author="qydwhotmail@gmail.com" date="1637323200">- Update to 3.9.9:
  * Core Server Bug Fixes
  - Fixed an issue where node monitor could produce a false network
    partition when one of the cluster members was restarted.
  - Message store resiliency improvements.
  - Reduced log noise in certain scenarios where a new queue leader
    is elected.
  - Queue leader rebalancing now logs less.
  * Prometheus Plugin Bug Fixes
  - TLS-enabled Prometheus endpoint listener port was not correctly
    stored internally.
  * Management Plugin Bug Fixes
  - Persistent message count is now displayed correctly on
    individual queue pages.
  - Restore compatibility with IE 11.
  * Consistent Hashing Exchange Plugin Bug Fixes
  - Corrected deletion of duplicate bindings between an exchange
    and a queue.
  * Enhancements
  - Core Server: cluster_formation.target_cluster_size_hint is a
    new configuration setting that can be used to specify expected
    initial cluster size.
  - Prometheus Plugin: Metric rendering efficiency improvements
    (mostly latency).
- Don't install the (now gone) OCF script.
- Refreshed patch:
  * harden_rabbitmq-server.service.patch</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1638446400">- Update to 3.9.11
  * Core Server Bug Fixes
  - When a TLS-enabled listener failed to stop, it logged all of
    its settings which could contain sensitive values.
  * Core Server Enhancements
  - Quorum queues now store commands for enqueued messages in a
    more compact format on disk (some derivative data has been dropped).
  - queue.declare-ok response to AMQP 0-9-1 clients operating on
    a stream could return a ready-for-delivery message count
    value that was out of sync with the stream leader replica.
  - Classic queues now deliver more efficiently on channels that
    had global QoS changed during consumer operation.
  * Prometheus Plugin Enhancements
  - New optional metrics provided by the GET /metrics/detailed
    endpoint. These metrics are cluster-wide, and therefore must
    not be aggregated.
  * Management Agent Plugin Enhancements
  - Disabling the plugin will stop metric collection performed
    periodically by queues, streams, connections, et cetera.
- Changes in 3.9.10:
  * Core Server Bug Fixes
  - Make stream coordinator more defensive to rapid declaration
    and deletion cycles.
  * Core Server Enhancements
  - Several inter-node communication listener settings are now
    exposed to rabbitmq.conf:
    + distribution.listener.port_range.min = 25675
    + distribution.listener.port_range.max = 25675
    + distribution.listener.interface = 192.168.0.1
  * OAuth 2 Plugin Bug Fixes
  - Signing keys specified in rabbitmq.conf were not translated
    correctly, resulting in exceptions during permission checks.
- Drop upstreamed patch
  * harden_rabbitmq-server.service.patch: https://github.com/rabbitmq/rabbitmq-server/pull/3770</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1641470400">- Update to 3.9.12
  * See https://github.com/rabbitmq/rabbitmq-server/blob/v3.9.x/release-notes/3.9.12.md
    for the full changelog.
  * Core Server Bug Fixes and Enhancements
  - (Fix) Authentication and authorization backend exceptions
    could potentially leak user-provided credentials to node log.
  - Unnamed parameters and policies in definition files will now
    be rejected as invalid.</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1642593600">- Update to 3.9.13
  * Core Server Bug Fixes and Enhancements
  - Disk space monitor now correctly parses output on (at least
    some) systems where non-ASCII characters are used in paths.
  - Stream leader election is now deterministic when cluster is
    undergoing a rolling upgrade.
  - Queue and binding definition import can be delayed until a
    moment when at least N nodes (e.g. three) have joined the
    cluster.
- Allow building with Elixir 1.13.x
  * Support-Elixir-1.13.patch
  * Elixir-1.13-OptionParser-no-longer-supports-atom-val.patch</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1645272000">- Add zsh BuildRequires to fix "directories not owned by a package"
  in zsh-completion.</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1648209600">- Update to 3.9.14
  * See https://github.com/rabbitmq/rabbitmq-server/blob/v3.9.x/release-notes/3.9.14.md
    for the full changelog.
  * Build time compatibility with Elixir 1.13 (gh#rabbitmq/rabbitmq-server#4019)
  - Drop Elixir-1.13-OptionParser-no-longer-supports-atom-val.patch
  - Drop Support-Elixir-1.13.patch
  * Adapt to a breaking Erlang 24.3 LDAP client change.</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1652011200">- Update to 3.10.0
  * See https://github.com/rabbitmq/rabbitmq-server/blob/v3.10.x/release-notes/3.10.0.md
    for the full changelog.
  * Potentially breaking changes
  - Messages delivered by a quorum queue and negatively acknowledged
    with a requeue will be added to the back of the queue until the
    queue has redelivery limit set. With a redelivery limit, requeueing
    will use the original position of the message if possible.
  - idle_since field now uses RFC 3339 format.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1652270400">- add upstream signing key and verify source signature</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1653134400">- Update to 3.10.2
  * Default log level used a four-character severity abbreviation
    instead of more common longer format, for example, warn instead
    of warning.
  * Fix CLI tools failed to run on Erlang 25</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1655553600">- Update to 3.10.5
  * Quorum queue could run into an exception when dead lettering a message
    under certain conditions.
- Changes from 3.10.4
  * Avoid seeding default user in old clusters that still use the deprecated
    management.load_definitions option.
  * Streams could run into an exception or fetch stale stream position
    data in some scenarios.
  * rabbitmqctl set_log_level did not have any effect on logging via
    amq.rabbitmq.log</changelog>
  <changelog author="dimstar@opensuse.org" date="1666785600">- Update to version 3.10.10:
  + Core Server
  * Partially reverts an unsafe inter-node communication
    optimization that could affect classic mirrored queue
    operation ordering.
  * Classic mirrored queue leader replica issued to much credit
    to follower replicas, resulting in an uneven load and
    memory footprint between them.
  * Intra-cluster communication link metric collector could run
    into an exception when peer connection has just been
    re-established, e.g. after a peer node restart.
  + MQTT Plugin
  * When a node was put into maintenance mode, it closed all MQTT
    client connections cluster-wide instead of just local client
    connections.
- For updates between 3.10.5 and 3.10.9, please see
  https://www.rabbitmq.com/changelog.html</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1667995200">- Update to 3.11.3
  + Core Server
  * Stream unsubscription leaked metric counters.
  * Stream could become unavailable in certain node or network
    failure scenarios.
  * It is now possible to pre-configure virtual host limits for
    groups of virtual hosts.
  * Quorum queue replicas no longer try to contact their unreachable
    peers for metrics.
  + CLI Tools
  * rabbitmq-diagnostics status now handles server responses where
    free disk space is not yet computed.
  * All enabled (explicitly or as a dependency) plugins are scanned.
  * rabbitmq-diagnostics memory_breakdown now returns results much
    faster in environments with a large number of quorum queues.</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1685966400">- Update to 3.12.0
  * Optimizations for both quorum and classic queues: improved throughput,
    lower throughput variability, lower latency, lower memory footprint
  * More mature and efficient implementation of (non-mirrored) classic
    queues v2 (CQv2)
  * Classic queue lazy and non-lazy modes no longer apply: classic
    queues v2 always behave very similarly
  * to the lazy mode in earlier release series: moving data to disk
    aggressively and only keeping a subset of data in memory
  * Significantly reduced MQTT and Web MQTT memory footprint per connection
  * OAuth 2, OIDC, IDP support
  * Even more configurability of the OAuth 2 plugin
- More bugfixes and enhancements:
  https://www.rabbitmq.com/changelog.html</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1689681600">- Improve erlang-rabbitmq-client Provides:
  The package provides two erlang applications: amqp_client and rabbit_common
  which are expected to be Required as erlang-%{appname}</changelog>
  <changelog author="dmueller@suse.com" date="1698580800">-  update to 3.12.7:
  * Stream replication connections configured to use exclusively
    TLSv1.3 failed.
  * On startup, stream replicas will handle one more potential
    case of segment file corruption after an unclean shutdown.
  * `default_policies.*.queue_pattern` definition in
    `rabbitmq.conf` was incorrectly parsed.
  * Avoid log noise when inter-node connections frequently fail
    and recover.
  * Optimized stream index scans. Longer scans could result in
    some replicas stopping with a timeout.
  * Classic queue storage version is now a supported key for
    operator policies.
  * Queue length limit overflow behavior now can be configured
    via operator policies.
  * Several `list_stream_*` commands (available via both
    `rabbitmq-diagnostics` and `rabbitmq-streams`) commands now
    can display replica node in addition to other fields.
  * `rabbitmqctl add_user` now can accept a pre-generated salted
    password instead of a plain text password, both as a
    positional argument and via standard input:
  * Message consumption with the "Nack message, requeue: true"
    option did not actually requeue deliveries.
  * HTTP API request body size is now limited to 10 MiB by
    default.
  * Two endpoints, one that accepts messages for publishing
    (note: publishing over the HTTP API is greatly discouraged)
  * and another for definition import,
  * will now reject larger transfers with a `400 Bad Request`
    response.
  * `DELETE /api/queues/{vhost}/{name}` now can delete exclusive
    queues.
  * Key supported by operator policies are now grouped by queue
    type in the UI.
  * Improved data safety for confirms in environments where the
    plugin uses classic queues.
  * Avoid an exception when a not fully established MQTT-over-
    WebSockets connection terminated.
  * Recovery of bindings of durable queues bound to a transient
    JMS topic exchange failed.
  * Recovery of bindings of durable queues bound to a transient
    `x-modulo-hash` exchange failed.
  * Recovery of bindings of durable queues bound to a transient
    recent history exchange failed.
  * `osiris` has been upgraded to `1.6.9`
  * Queue recovery on node restart in certain conditions could
    run into an exception
  * `file_handle_cache` operations are now safer when handling
    non-existent keys.
  * Fixed a potential resource leak in at-least-once dead
    lettering from quorum queues.
  * AMQP 1.0 clients that try to publish in a way that results in
    the message not being routed anywhere are now notified with
    a more sensible settlement status.
  * Prometheus scraping API endpoints now support optional
    authentication.
  * The plugin now filters out values that are `undefined` or
    `NaN`, simply excluding them from the API endpoint response.
    Previously, if a metric was not computed for any reason (e.g.
    free disk space monitor was disabled on the node),
    its value could end up being rendered as `undefined` or `NaN`,
    two values that Prometheus scrapers cannot handle (for
  * The plugin will now enforce maximum STOMP frame size. Frames
    larger than that size will be rejected. The default maximum
    size is 4 MiB. It can be increased or decreased:
  * ``` ini
  * # increase maximum supported STOMP frame size to 10 MiB
  * stomp.max_frame_size = 10485760
  * ```
  * To reduce it from the default 4 MiB to 2 MiB:
  * ``` ini
  * # 2 MiB
  * stomp.max_frame_size = 2097152
  * ```
  * Shovel will gracefully stop when its destination (target)
    does not exist.
  * Such shovels will then be periodically restarted to retry.
  * It is now possible to opt in to deactivate file handle cache
    use in the plugin:
  * ``` ini
  * web_mqtt.use_file_handle_cache = false
  * ```
  * It is now possible to opt in to deactivate file handle cache
    use in the plugin:
  * ``` ini
  * web_stomp.use_file_handle_cache = false
  * ```
  * `ra` was upgraded to `2.6.3`
  * Declaration of a classic queue could run into an exception.
  * Classic queues v1 (CQv1) that had a backlog of messages
    stored by 3.9 and earlier versions could run into an exception
    during queue index recovery after an upgrade to 3.10.x or any
    later series.
  * Nodes that had a large number of quorum queues could observe
    accumulation of Erlang processes under significant load.
  * Feature flag discovery on a newly added node could discover
    an incomplete inventory of feature flags.
  * Feature flag discovery operations will now be retried
    multiple times in case of network failures.
  * Nodes in clusters that had quorum queues and non-mirrored
    classic queues on stopped (or failed) nodes could run into an
    exception.
  * The same exception could affect `rabbitmqctl list_queues`.
  * Proxy Protocol v2 LOCAL packets were not supported.
  * When a quorum queue does not find its local replica data
    files on boot, it will now log a warning.
  * An attempt to clear limits of a non-existent virtual host
    failed with a 500 status code.
  * The "Queues" tab in the UI was renamed to "Queue and Streams"
    to better reflect its contents.
  * New HTTP API endpoints for quorum queue replica management,
    equivalent to the `rabbitmq-queues` commands that manage replicas.
  * ```
  * POST /api/queues/quorum/{vhost}/{name}/replicas/add
  * DELETE /api/queues/quorum/{vhost}/{name}/replicas/remove
  * POST /api/queues/quorum/replicas/on/{node}/grow
  * DELETE /api/queues/quorum/replicas/on/{node}/shrink
  * ```
  * Stream client connections that authenticated using x.509
    certificates failed.
  * Only set OAuth 2 client's CA certificate file setting when it
    is defined.
  * The plugin will now accept JWT tokens without a `scope`. Such
    tokens would only be useful when the plugin is used exclusively
    for authentication and not authorization.
  * `oauth2` is now an accepted alias for the OAuth 2
    authentication and authorization backend:
  * ```
  * auth_backends.1 = oauth2
  * ```
  * Previously the only option for OAuth 2 was using a full
    module name, `rabbit_auth_backend_oauth2`.
  * STOMP plugin log entries had an extra line feed character.
  * `ra` was upgraded to `2.6.2`</changelog>
  <changelog author="dmueller@suse.com" date="1702814400">- update to 3.12.10:
  * Avoids two Shovels being started after an upgrade from 3.12.6
    or older versions.
  * When a topic permission was deleted, an internal event of type
    permission.deleted was emitted in some cases, instead of
    topic.permission.deleted.
  * Shovels on 3.12.8 nodes failed during a rolling cluster upgrade
    due to internal identifier format changes.
  * Avoids an unnecessary warning in the logs.
  * avoids a potential exception in the autoheal partition handler.
  * raft.segment_max_entries is now validated to prevent the value
    from overflowing its 16-bit segment file field. Maximum
    supported value is now 65535.</changelog>
  <changelog author="dmueller@suse.com" date="1704542400">- update to 3.12.11:
  * Quorum queue declared when one of cluster nodes was down
    could trigger connection exceptions.
  * Avoids a rare exception that could stop TCP socket writes on
    a client connection.
  * `queue_deleted` and `queue_created` internal events now
    include queue type as a module name, and not an inconsistent
    (with the other queue and stream types) value `classic`.
  * Definition files that are virtual host-specific cannot be
    imported on boot. Such files will now be detected early and
    the import process will terminate after logging a more
    informative message.
  * Several AMQP 1.0 application properties are now more
    correctly converted to AMQP 0-9-1 headers by
    cross-protocol Shovels.
  * The priority property now populates an AMQP 1.0 header with
    the same name, per AMQP 1.0 spec.
  * Metric label values now escape certain non-ASCII characters.
  * Avoids an exception when an MQTT client that used a QoS 0
    subscription reconnects and its original connection node
    is down.
  * Avoids an exception when an MQTT client connection was force-
    closed via the HTTP API.
  * Certain CLI commands could not be run in a shell script loop,
    unless the script explicitly redirected standard input.
  * `rabbitmq-diagnostics cluster_status` now responds much
    quicker when a cluster node has gone down, were shut down,
    or otherwise has become unreachable by the rest of the cluster.
  * Reverted a change to `DELETE /api/queues/{vhost}/{name}` that
    allowed removal of exclusive queues and introduced
    unexpected side effects.
  * `DELETE /api/policies/{vhost}/{policy}` returned a 500
    response instead of a 404 one when target virtual host did
    not exist.
  * Avoid log noise when an HTTP API request is issued against a
    booting or very freshly booted node.
  * HTTP API endpoints that involves contacting multiple nodes
    now respond much quicker when a cluster node
    has gone down, were shut down, or otherwise has become
    unreachable by the rest of the cluster
  * Definition exported for just one virtual host cannot be
    imported at node boot time.
  * Now such files are detected early with a clear log message
    and immediate node boot process termination.
  * To obtain source code of the entire distribution, please
    download the archive named `rabbitmq-server-3.12.11.tar.xz`
    instead of the source tarball produced by GitHub.</changelog>
  <changelog author="dimstar@opensuse.org" date="1707220800">- Provide user/group for RPM 4.19 (boo#1219532).</changelog>
  <changelog author="sflees@suse.de" date="1713268800">- Update to 3.13.1
  * Highlights
    Khepri now can be used as an alternative schema data store in RabbitMQ, replacing Mnesia
    MQTTv5 support
    Support for consumer-side stream filtering
    A new common message container format used internally, based on the AMQP 1.0 message format
    Improved classic non-mirrored queue performance with message sizes larger than
    4 KiB (or a different customized CQ index embedding threshold)
    Classic queues storage implementation version 2 (CQv2) is now highly recommended for all new deployments.
    CQv2 meaningfully improves performance of non-mirrored classic queues for most workloads
  * Fixes bsc#1222591</changelog>
  <changelog author="simonf.lees@suse.com" date="1717156800">- Create a versioned package for SLES
-  The following bugfixes and CVE's were fixed upstream
  (bsc#1186203,CVE-2021-22116), (bsc#1187818, CVE-2021-32718),
  (bsc#1187819, CVE-2021-32719) (bsc#1199431),
  (bsc#1205267), (bsc#1216582, CVE-2022-31008)</changelog>
</package>
<package pkgid="7565c95f43ecab9d971a0ba2b1581285e02ad2eefbce6cde28a2a22f08316d39" name="erlang-rabbitmq-client313" arch="ppc64le">
  <version epoch="0" ver="3.13.1" rel="150600.13.5.3"/>
  <changelog author="qydwhotmail@gmail.com" date="1637323200">- Update to 3.9.9:
  * Core Server Bug Fixes
  - Fixed an issue where node monitor could produce a false network
    partition when one of the cluster members was restarted.
  - Message store resiliency improvements.
  - Reduced log noise in certain scenarios where a new queue leader
    is elected.
  - Queue leader rebalancing now logs less.
  * Prometheus Plugin Bug Fixes
  - TLS-enabled Prometheus endpoint listener port was not correctly
    stored internally.
  * Management Plugin Bug Fixes
  - Persistent message count is now displayed correctly on
    individual queue pages.
  - Restore compatibility with IE 11.
  * Consistent Hashing Exchange Plugin Bug Fixes
  - Corrected deletion of duplicate bindings between an exchange
    and a queue.
  * Enhancements
  - Core Server: cluster_formation.target_cluster_size_hint is a
    new configuration setting that can be used to specify expected
    initial cluster size.
  - Prometheus Plugin: Metric rendering efficiency improvements
    (mostly latency).
- Don't install the (now gone) OCF script.
- Refreshed patch:
  * harden_rabbitmq-server.service.patch</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1638446400">- Update to 3.9.11
  * Core Server Bug Fixes
  - When a TLS-enabled listener failed to stop, it logged all of
    its settings which could contain sensitive values.
  * Core Server Enhancements
  - Quorum queues now store commands for enqueued messages in a
    more compact format on disk (some derivative data has been dropped).
  - queue.declare-ok response to AMQP 0-9-1 clients operating on
    a stream could return a ready-for-delivery message count
    value that was out of sync with the stream leader replica.
  - Classic queues now deliver more efficiently on channels that
    had global QoS changed during consumer operation.
  * Prometheus Plugin Enhancements
  - New optional metrics provided by the GET /metrics/detailed
    endpoint. These metrics are cluster-wide, and therefore must
    not be aggregated.
  * Management Agent Plugin Enhancements
  - Disabling the plugin will stop metric collection performed
    periodically by queues, streams, connections, et cetera.
- Changes in 3.9.10:
  * Core Server Bug Fixes
  - Make stream coordinator more defensive to rapid declaration
    and deletion cycles.
  * Core Server Enhancements
  - Several inter-node communication listener settings are now
    exposed to rabbitmq.conf:
    + distribution.listener.port_range.min = 25675
    + distribution.listener.port_range.max = 25675
    + distribution.listener.interface = 192.168.0.1
  * OAuth 2 Plugin Bug Fixes
  - Signing keys specified in rabbitmq.conf were not translated
    correctly, resulting in exceptions during permission checks.
- Drop upstreamed patch
  * harden_rabbitmq-server.service.patch: https://github.com/rabbitmq/rabbitmq-server/pull/3770</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1641470400">- Update to 3.9.12
  * See https://github.com/rabbitmq/rabbitmq-server/blob/v3.9.x/release-notes/3.9.12.md
    for the full changelog.
  * Core Server Bug Fixes and Enhancements
  - (Fix) Authentication and authorization backend exceptions
    could potentially leak user-provided credentials to node log.
  - Unnamed parameters and policies in definition files will now
    be rejected as invalid.</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1642593600">- Update to 3.9.13
  * Core Server Bug Fixes and Enhancements
  - Disk space monitor now correctly parses output on (at least
    some) systems where non-ASCII characters are used in paths.
  - Stream leader election is now deterministic when cluster is
    undergoing a rolling upgrade.
  - Queue and binding definition import can be delayed until a
    moment when at least N nodes (e.g. three) have joined the
    cluster.
- Allow building with Elixir 1.13.x
  * Support-Elixir-1.13.patch
  * Elixir-1.13-OptionParser-no-longer-supports-atom-val.patch</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1645272000">- Add zsh BuildRequires to fix "directories not owned by a package"
  in zsh-completion.</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1648209600">- Update to 3.9.14
  * See https://github.com/rabbitmq/rabbitmq-server/blob/v3.9.x/release-notes/3.9.14.md
    for the full changelog.
  * Build time compatibility with Elixir 1.13 (gh#rabbitmq/rabbitmq-server#4019)
  - Drop Elixir-1.13-OptionParser-no-longer-supports-atom-val.patch
  - Drop Support-Elixir-1.13.patch
  * Adapt to a breaking Erlang 24.3 LDAP client change.</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1652011200">- Update to 3.10.0
  * See https://github.com/rabbitmq/rabbitmq-server/blob/v3.10.x/release-notes/3.10.0.md
    for the full changelog.
  * Potentially breaking changes
  - Messages delivered by a quorum queue and negatively acknowledged
    with a requeue will be added to the back of the queue until the
    queue has redelivery limit set. With a redelivery limit, requeueing
    will use the original position of the message if possible.
  - idle_since field now uses RFC 3339 format.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1652270400">- add upstream signing key and verify source signature</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1653134400">- Update to 3.10.2
  * Default log level used a four-character severity abbreviation
    instead of more common longer format, for example, warn instead
    of warning.
  * Fix CLI tools failed to run on Erlang 25</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1655553600">- Update to 3.10.5
  * Quorum queue could run into an exception when dead lettering a message
    under certain conditions.
- Changes from 3.10.4
  * Avoid seeding default user in old clusters that still use the deprecated
    management.load_definitions option.
  * Streams could run into an exception or fetch stale stream position
    data in some scenarios.
  * rabbitmqctl set_log_level did not have any effect on logging via
    amq.rabbitmq.log</changelog>
  <changelog author="dimstar@opensuse.org" date="1666785600">- Update to version 3.10.10:
  + Core Server
  * Partially reverts an unsafe inter-node communication
    optimization that could affect classic mirrored queue
    operation ordering.
  * Classic mirrored queue leader replica issued to much credit
    to follower replicas, resulting in an uneven load and
    memory footprint between them.
  * Intra-cluster communication link metric collector could run
    into an exception when peer connection has just been
    re-established, e.g. after a peer node restart.
  + MQTT Plugin
  * When a node was put into maintenance mode, it closed all MQTT
    client connections cluster-wide instead of just local client
    connections.
- For updates between 3.10.5 and 3.10.9, please see
  https://www.rabbitmq.com/changelog.html</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1667995200">- Update to 3.11.3
  + Core Server
  * Stream unsubscription leaked metric counters.
  * Stream could become unavailable in certain node or network
    failure scenarios.
  * It is now possible to pre-configure virtual host limits for
    groups of virtual hosts.
  * Quorum queue replicas no longer try to contact their unreachable
    peers for metrics.
  + CLI Tools
  * rabbitmq-diagnostics status now handles server responses where
    free disk space is not yet computed.
  * All enabled (explicitly or as a dependency) plugins are scanned.
  * rabbitmq-diagnostics memory_breakdown now returns results much
    faster in environments with a large number of quorum queues.</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1685966400">- Update to 3.12.0
  * Optimizations for both quorum and classic queues: improved throughput,
    lower throughput variability, lower latency, lower memory footprint
  * More mature and efficient implementation of (non-mirrored) classic
    queues v2 (CQv2)
  * Classic queue lazy and non-lazy modes no longer apply: classic
    queues v2 always behave very similarly
  * to the lazy mode in earlier release series: moving data to disk
    aggressively and only keeping a subset of data in memory
  * Significantly reduced MQTT and Web MQTT memory footprint per connection
  * OAuth 2, OIDC, IDP support
  * Even more configurability of the OAuth 2 plugin
- More bugfixes and enhancements:
  https://www.rabbitmq.com/changelog.html</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1689681600">- Improve erlang-rabbitmq-client Provides:
  The package provides two erlang applications: amqp_client and rabbit_common
  which are expected to be Required as erlang-%{appname}</changelog>
  <changelog author="dmueller@suse.com" date="1698580800">-  update to 3.12.7:
  * Stream replication connections configured to use exclusively
    TLSv1.3 failed.
  * On startup, stream replicas will handle one more potential
    case of segment file corruption after an unclean shutdown.
  * `default_policies.*.queue_pattern` definition in
    `rabbitmq.conf` was incorrectly parsed.
  * Avoid log noise when inter-node connections frequently fail
    and recover.
  * Optimized stream index scans. Longer scans could result in
    some replicas stopping with a timeout.
  * Classic queue storage version is now a supported key for
    operator policies.
  * Queue length limit overflow behavior now can be configured
    via operator policies.
  * Several `list_stream_*` commands (available via both
    `rabbitmq-diagnostics` and `rabbitmq-streams`) commands now
    can display replica node in addition to other fields.
  * `rabbitmqctl add_user` now can accept a pre-generated salted
    password instead of a plain text password, both as a
    positional argument and via standard input:
  * Message consumption with the "Nack message, requeue: true"
    option did not actually requeue deliveries.
  * HTTP API request body size is now limited to 10 MiB by
    default.
  * Two endpoints, one that accepts messages for publishing
    (note: publishing over the HTTP API is greatly discouraged)
  * and another for definition import,
  * will now reject larger transfers with a `400 Bad Request`
    response.
  * `DELETE /api/queues/{vhost}/{name}` now can delete exclusive
    queues.
  * Key supported by operator policies are now grouped by queue
    type in the UI.
  * Improved data safety for confirms in environments where the
    plugin uses classic queues.
  * Avoid an exception when a not fully established MQTT-over-
    WebSockets connection terminated.
  * Recovery of bindings of durable queues bound to a transient
    JMS topic exchange failed.
  * Recovery of bindings of durable queues bound to a transient
    `x-modulo-hash` exchange failed.
  * Recovery of bindings of durable queues bound to a transient
    recent history exchange failed.
  * `osiris` has been upgraded to `1.6.9`
  * Queue recovery on node restart in certain conditions could
    run into an exception
  * `file_handle_cache` operations are now safer when handling
    non-existent keys.
  * Fixed a potential resource leak in at-least-once dead
    lettering from quorum queues.
  * AMQP 1.0 clients that try to publish in a way that results in
    the message not being routed anywhere are now notified with
    a more sensible settlement status.
  * Prometheus scraping API endpoints now support optional
    authentication.
  * The plugin now filters out values that are `undefined` or
    `NaN`, simply excluding them from the API endpoint response.
    Previously, if a metric was not computed for any reason (e.g.
    free disk space monitor was disabled on the node),
    its value could end up being rendered as `undefined` or `NaN`,
    two values that Prometheus scrapers cannot handle (for
  * The plugin will now enforce maximum STOMP frame size. Frames
    larger than that size will be rejected. The default maximum
    size is 4 MiB. It can be increased or decreased:
  * ``` ini
  * # increase maximum supported STOMP frame size to 10 MiB
  * stomp.max_frame_size = 10485760
  * ```
  * To reduce it from the default 4 MiB to 2 MiB:
  * ``` ini
  * # 2 MiB
  * stomp.max_frame_size = 2097152
  * ```
  * Shovel will gracefully stop when its destination (target)
    does not exist.
  * Such shovels will then be periodically restarted to retry.
  * It is now possible to opt in to deactivate file handle cache
    use in the plugin:
  * ``` ini
  * web_mqtt.use_file_handle_cache = false
  * ```
  * It is now possible to opt in to deactivate file handle cache
    use in the plugin:
  * ``` ini
  * web_stomp.use_file_handle_cache = false
  * ```
  * `ra` was upgraded to `2.6.3`
  * Declaration of a classic queue could run into an exception.
  * Classic queues v1 (CQv1) that had a backlog of messages
    stored by 3.9 and earlier versions could run into an exception
    during queue index recovery after an upgrade to 3.10.x or any
    later series.
  * Nodes that had a large number of quorum queues could observe
    accumulation of Erlang processes under significant load.
  * Feature flag discovery on a newly added node could discover
    an incomplete inventory of feature flags.
  * Feature flag discovery operations will now be retried
    multiple times in case of network failures.
  * Nodes in clusters that had quorum queues and non-mirrored
    classic queues on stopped (or failed) nodes could run into an
    exception.
  * The same exception could affect `rabbitmqctl list_queues`.
  * Proxy Protocol v2 LOCAL packets were not supported.
  * When a quorum queue does not find its local replica data
    files on boot, it will now log a warning.
  * An attempt to clear limits of a non-existent virtual host
    failed with a 500 status code.
  * The "Queues" tab in the UI was renamed to "Queue and Streams"
    to better reflect its contents.
  * New HTTP API endpoints for quorum queue replica management,
    equivalent to the `rabbitmq-queues` commands that manage replicas.
  * ```
  * POST /api/queues/quorum/{vhost}/{name}/replicas/add
  * DELETE /api/queues/quorum/{vhost}/{name}/replicas/remove
  * POST /api/queues/quorum/replicas/on/{node}/grow
  * DELETE /api/queues/quorum/replicas/on/{node}/shrink
  * ```
  * Stream client connections that authenticated using x.509
    certificates failed.
  * Only set OAuth 2 client's CA certificate file setting when it
    is defined.
  * The plugin will now accept JWT tokens without a `scope`. Such
    tokens would only be useful when the plugin is used exclusively
    for authentication and not authorization.
  * `oauth2` is now an accepted alias for the OAuth 2
    authentication and authorization backend:
  * ```
  * auth_backends.1 = oauth2
  * ```
  * Previously the only option for OAuth 2 was using a full
    module name, `rabbit_auth_backend_oauth2`.
  * STOMP plugin log entries had an extra line feed character.
  * `ra` was upgraded to `2.6.2`</changelog>
  <changelog author="dmueller@suse.com" date="1702814400">- update to 3.12.10:
  * Avoids two Shovels being started after an upgrade from 3.12.6
    or older versions.
  * When a topic permission was deleted, an internal event of type
    permission.deleted was emitted in some cases, instead of
    topic.permission.deleted.
  * Shovels on 3.12.8 nodes failed during a rolling cluster upgrade
    due to internal identifier format changes.
  * Avoids an unnecessary warning in the logs.
  * avoids a potential exception in the autoheal partition handler.
  * raft.segment_max_entries is now validated to prevent the value
    from overflowing its 16-bit segment file field. Maximum
    supported value is now 65535.</changelog>
  <changelog author="dmueller@suse.com" date="1704542400">- update to 3.12.11:
  * Quorum queue declared when one of cluster nodes was down
    could trigger connection exceptions.
  * Avoids a rare exception that could stop TCP socket writes on
    a client connection.
  * `queue_deleted` and `queue_created` internal events now
    include queue type as a module name, and not an inconsistent
    (with the other queue and stream types) value `classic`.
  * Definition files that are virtual host-specific cannot be
    imported on boot. Such files will now be detected early and
    the import process will terminate after logging a more
    informative message.
  * Several AMQP 1.0 application properties are now more
    correctly converted to AMQP 0-9-1 headers by
    cross-protocol Shovels.
  * The priority property now populates an AMQP 1.0 header with
    the same name, per AMQP 1.0 spec.
  * Metric label values now escape certain non-ASCII characters.
  * Avoids an exception when an MQTT client that used a QoS 0
    subscription reconnects and its original connection node
    is down.
  * Avoids an exception when an MQTT client connection was force-
    closed via the HTTP API.
  * Certain CLI commands could not be run in a shell script loop,
    unless the script explicitly redirected standard input.
  * `rabbitmq-diagnostics cluster_status` now responds much
    quicker when a cluster node has gone down, were shut down,
    or otherwise has become unreachable by the rest of the cluster.
  * Reverted a change to `DELETE /api/queues/{vhost}/{name}` that
    allowed removal of exclusive queues and introduced
    unexpected side effects.
  * `DELETE /api/policies/{vhost}/{policy}` returned a 500
    response instead of a 404 one when target virtual host did
    not exist.
  * Avoid log noise when an HTTP API request is issued against a
    booting or very freshly booted node.
  * HTTP API endpoints that involves contacting multiple nodes
    now respond much quicker when a cluster node
    has gone down, were shut down, or otherwise has become
    unreachable by the rest of the cluster
  * Definition exported for just one virtual host cannot be
    imported at node boot time.
  * Now such files are detected early with a clear log message
    and immediate node boot process termination.
  * To obtain source code of the entire distribution, please
    download the archive named `rabbitmq-server-3.12.11.tar.xz`
    instead of the source tarball produced by GitHub.</changelog>
  <changelog author="dimstar@opensuse.org" date="1707220800">- Provide user/group for RPM 4.19 (boo#1219532).</changelog>
  <changelog author="sflees@suse.de" date="1713268800">- Update to 3.13.1
  * Highlights
    Khepri now can be used as an alternative schema data store in RabbitMQ, replacing Mnesia
    MQTTv5 support
    Support for consumer-side stream filtering
    A new common message container format used internally, based on the AMQP 1.0 message format
    Improved classic non-mirrored queue performance with message sizes larger than
    4 KiB (or a different customized CQ index embedding threshold)
    Classic queues storage implementation version 2 (CQv2) is now highly recommended for all new deployments.
    CQv2 meaningfully improves performance of non-mirrored classic queues for most workloads
  * Fixes bsc#1222591</changelog>
  <changelog author="simonf.lees@suse.com" date="1717156800">- Create a versioned package for SLES
-  The following bugfixes and CVE's were fixed upstream
  (bsc#1186203,CVE-2021-22116), (bsc#1187818, CVE-2021-32718),
  (bsc#1187819, CVE-2021-32719) (bsc#1199431),
  (bsc#1205267), (bsc#1216582, CVE-2022-31008)</changelog>
</package>
<package pkgid="ce2ea92512c098dec568bf086a7a55519de13a509fb6702b8b5222575c496ecd" name="erlang-rabbitmq-client313" arch="s390x">
  <version epoch="0" ver="3.13.1" rel="150600.13.5.3"/>
  <changelog author="qydwhotmail@gmail.com" date="1637323200">- Update to 3.9.9:
  * Core Server Bug Fixes
  - Fixed an issue where node monitor could produce a false network
    partition when one of the cluster members was restarted.
  - Message store resiliency improvements.
  - Reduced log noise in certain scenarios where a new queue leader
    is elected.
  - Queue leader rebalancing now logs less.
  * Prometheus Plugin Bug Fixes
  - TLS-enabled Prometheus endpoint listener port was not correctly
    stored internally.
  * Management Plugin Bug Fixes
  - Persistent message count is now displayed correctly on
    individual queue pages.
  - Restore compatibility with IE 11.
  * Consistent Hashing Exchange Plugin Bug Fixes
  - Corrected deletion of duplicate bindings between an exchange
    and a queue.
  * Enhancements
  - Core Server: cluster_formation.target_cluster_size_hint is a
    new configuration setting that can be used to specify expected
    initial cluster size.
  - Prometheus Plugin: Metric rendering efficiency improvements
    (mostly latency).
- Don't install the (now gone) OCF script.
- Refreshed patch:
  * harden_rabbitmq-server.service.patch</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1638446400">- Update to 3.9.11
  * Core Server Bug Fixes
  - When a TLS-enabled listener failed to stop, it logged all of
    its settings which could contain sensitive values.
  * Core Server Enhancements
  - Quorum queues now store commands for enqueued messages in a
    more compact format on disk (some derivative data has been dropped).
  - queue.declare-ok response to AMQP 0-9-1 clients operating on
    a stream could return a ready-for-delivery message count
    value that was out of sync with the stream leader replica.
  - Classic queues now deliver more efficiently on channels that
    had global QoS changed during consumer operation.
  * Prometheus Plugin Enhancements
  - New optional metrics provided by the GET /metrics/detailed
    endpoint. These metrics are cluster-wide, and therefore must
    not be aggregated.
  * Management Agent Plugin Enhancements
  - Disabling the plugin will stop metric collection performed
    periodically by queues, streams, connections, et cetera.
- Changes in 3.9.10:
  * Core Server Bug Fixes
  - Make stream coordinator more defensive to rapid declaration
    and deletion cycles.
  * Core Server Enhancements
  - Several inter-node communication listener settings are now
    exposed to rabbitmq.conf:
    + distribution.listener.port_range.min = 25675
    + distribution.listener.port_range.max = 25675
    + distribution.listener.interface = 192.168.0.1
  * OAuth 2 Plugin Bug Fixes
  - Signing keys specified in rabbitmq.conf were not translated
    correctly, resulting in exceptions during permission checks.
- Drop upstreamed patch
  * harden_rabbitmq-server.service.patch: https://github.com/rabbitmq/rabbitmq-server/pull/3770</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1641470400">- Update to 3.9.12
  * See https://github.com/rabbitmq/rabbitmq-server/blob/v3.9.x/release-notes/3.9.12.md
    for the full changelog.
  * Core Server Bug Fixes and Enhancements
  - (Fix) Authentication and authorization backend exceptions
    could potentially leak user-provided credentials to node log.
  - Unnamed parameters and policies in definition files will now
    be rejected as invalid.</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1642593600">- Update to 3.9.13
  * Core Server Bug Fixes and Enhancements
  - Disk space monitor now correctly parses output on (at least
    some) systems where non-ASCII characters are used in paths.
  - Stream leader election is now deterministic when cluster is
    undergoing a rolling upgrade.
  - Queue and binding definition import can be delayed until a
    moment when at least N nodes (e.g. three) have joined the
    cluster.
- Allow building with Elixir 1.13.x
  * Support-Elixir-1.13.patch
  * Elixir-1.13-OptionParser-no-longer-supports-atom-val.patch</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1645272000">- Add zsh BuildRequires to fix "directories not owned by a package"
  in zsh-completion.</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1648209600">- Update to 3.9.14
  * See https://github.com/rabbitmq/rabbitmq-server/blob/v3.9.x/release-notes/3.9.14.md
    for the full changelog.
  * Build time compatibility with Elixir 1.13 (gh#rabbitmq/rabbitmq-server#4019)
  - Drop Elixir-1.13-OptionParser-no-longer-supports-atom-val.patch
  - Drop Support-Elixir-1.13.patch
  * Adapt to a breaking Erlang 24.3 LDAP client change.</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1652011200">- Update to 3.10.0
  * See https://github.com/rabbitmq/rabbitmq-server/blob/v3.10.x/release-notes/3.10.0.md
    for the full changelog.
  * Potentially breaking changes
  - Messages delivered by a quorum queue and negatively acknowledged
    with a requeue will be added to the back of the queue until the
    queue has redelivery limit set. With a redelivery limit, requeueing
    will use the original position of the message if possible.
  - idle_since field now uses RFC 3339 format.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1652270400">- add upstream signing key and verify source signature</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1653134400">- Update to 3.10.2
  * Default log level used a four-character severity abbreviation
    instead of more common longer format, for example, warn instead
    of warning.
  * Fix CLI tools failed to run on Erlang 25</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1655553600">- Update to 3.10.5
  * Quorum queue could run into an exception when dead lettering a message
    under certain conditions.
- Changes from 3.10.4
  * Avoid seeding default user in old clusters that still use the deprecated
    management.load_definitions option.
  * Streams could run into an exception or fetch stale stream position
    data in some scenarios.
  * rabbitmqctl set_log_level did not have any effect on logging via
    amq.rabbitmq.log</changelog>
  <changelog author="dimstar@opensuse.org" date="1666785600">- Update to version 3.10.10:
  + Core Server
  * Partially reverts an unsafe inter-node communication
    optimization that could affect classic mirrored queue
    operation ordering.
  * Classic mirrored queue leader replica issued to much credit
    to follower replicas, resulting in an uneven load and
    memory footprint between them.
  * Intra-cluster communication link metric collector could run
    into an exception when peer connection has just been
    re-established, e.g. after a peer node restart.
  + MQTT Plugin
  * When a node was put into maintenance mode, it closed all MQTT
    client connections cluster-wide instead of just local client
    connections.
- For updates between 3.10.5 and 3.10.9, please see
  https://www.rabbitmq.com/changelog.html</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1667995200">- Update to 3.11.3
  + Core Server
  * Stream unsubscription leaked metric counters.
  * Stream could become unavailable in certain node or network
    failure scenarios.
  * It is now possible to pre-configure virtual host limits for
    groups of virtual hosts.
  * Quorum queue replicas no longer try to contact their unreachable
    peers for metrics.
  + CLI Tools
  * rabbitmq-diagnostics status now handles server responses where
    free disk space is not yet computed.
  * All enabled (explicitly or as a dependency) plugins are scanned.
  * rabbitmq-diagnostics memory_breakdown now returns results much
    faster in environments with a large number of quorum queues.</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1685966400">- Update to 3.12.0
  * Optimizations for both quorum and classic queues: improved throughput,
    lower throughput variability, lower latency, lower memory footprint
  * More mature and efficient implementation of (non-mirrored) classic
    queues v2 (CQv2)
  * Classic queue lazy and non-lazy modes no longer apply: classic
    queues v2 always behave very similarly
  * to the lazy mode in earlier release series: moving data to disk
    aggressively and only keeping a subset of data in memory
  * Significantly reduced MQTT and Web MQTT memory footprint per connection
  * OAuth 2, OIDC, IDP support
  * Even more configurability of the OAuth 2 plugin
- More bugfixes and enhancements:
  https://www.rabbitmq.com/changelog.html</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1689681600">- Improve erlang-rabbitmq-client Provides:
  The package provides two erlang applications: amqp_client and rabbit_common
  which are expected to be Required as erlang-%{appname}</changelog>
  <changelog author="dmueller@suse.com" date="1698580800">-  update to 3.12.7:
  * Stream replication connections configured to use exclusively
    TLSv1.3 failed.
  * On startup, stream replicas will handle one more potential
    case of segment file corruption after an unclean shutdown.
  * `default_policies.*.queue_pattern` definition in
    `rabbitmq.conf` was incorrectly parsed.
  * Avoid log noise when inter-node connections frequently fail
    and recover.
  * Optimized stream index scans. Longer scans could result in
    some replicas stopping with a timeout.
  * Classic queue storage version is now a supported key for
    operator policies.
  * Queue length limit overflow behavior now can be configured
    via operator policies.
  * Several `list_stream_*` commands (available via both
    `rabbitmq-diagnostics` and `rabbitmq-streams`) commands now
    can display replica node in addition to other fields.
  * `rabbitmqctl add_user` now can accept a pre-generated salted
    password instead of a plain text password, both as a
    positional argument and via standard input:
  * Message consumption with the "Nack message, requeue: true"
    option did not actually requeue deliveries.
  * HTTP API request body size is now limited to 10 MiB by
    default.
  * Two endpoints, one that accepts messages for publishing
    (note: publishing over the HTTP API is greatly discouraged)
  * and another for definition import,
  * will now reject larger transfers with a `400 Bad Request`
    response.
  * `DELETE /api/queues/{vhost}/{name}` now can delete exclusive
    queues.
  * Key supported by operator policies are now grouped by queue
    type in the UI.
  * Improved data safety for confirms in environments where the
    plugin uses classic queues.
  * Avoid an exception when a not fully established MQTT-over-
    WebSockets connection terminated.
  * Recovery of bindings of durable queues bound to a transient
    JMS topic exchange failed.
  * Recovery of bindings of durable queues bound to a transient
    `x-modulo-hash` exchange failed.
  * Recovery of bindings of durable queues bound to a transient
    recent history exchange failed.
  * `osiris` has been upgraded to `1.6.9`
  * Queue recovery on node restart in certain conditions could
    run into an exception
  * `file_handle_cache` operations are now safer when handling
    non-existent keys.
  * Fixed a potential resource leak in at-least-once dead
    lettering from quorum queues.
  * AMQP 1.0 clients that try to publish in a way that results in
    the message not being routed anywhere are now notified with
    a more sensible settlement status.
  * Prometheus scraping API endpoints now support optional
    authentication.
  * The plugin now filters out values that are `undefined` or
    `NaN`, simply excluding them from the API endpoint response.
    Previously, if a metric was not computed for any reason (e.g.
    free disk space monitor was disabled on the node),
    its value could end up being rendered as `undefined` or `NaN`,
    two values that Prometheus scrapers cannot handle (for
  * The plugin will now enforce maximum STOMP frame size. Frames
    larger than that size will be rejected. The default maximum
    size is 4 MiB. It can be increased or decreased:
  * ``` ini
  * # increase maximum supported STOMP frame size to 10 MiB
  * stomp.max_frame_size = 10485760
  * ```
  * To reduce it from the default 4 MiB to 2 MiB:
  * ``` ini
  * # 2 MiB
  * stomp.max_frame_size = 2097152
  * ```
  * Shovel will gracefully stop when its destination (target)
    does not exist.
  * Such shovels will then be periodically restarted to retry.
  * It is now possible to opt in to deactivate file handle cache
    use in the plugin:
  * ``` ini
  * web_mqtt.use_file_handle_cache = false
  * ```
  * It is now possible to opt in to deactivate file handle cache
    use in the plugin:
  * ``` ini
  * web_stomp.use_file_handle_cache = false
  * ```
  * `ra` was upgraded to `2.6.3`
  * Declaration of a classic queue could run into an exception.
  * Classic queues v1 (CQv1) that had a backlog of messages
    stored by 3.9 and earlier versions could run into an exception
    during queue index recovery after an upgrade to 3.10.x or any
    later series.
  * Nodes that had a large number of quorum queues could observe
    accumulation of Erlang processes under significant load.
  * Feature flag discovery on a newly added node could discover
    an incomplete inventory of feature flags.
  * Feature flag discovery operations will now be retried
    multiple times in case of network failures.
  * Nodes in clusters that had quorum queues and non-mirrored
    classic queues on stopped (or failed) nodes could run into an
    exception.
  * The same exception could affect `rabbitmqctl list_queues`.
  * Proxy Protocol v2 LOCAL packets were not supported.
  * When a quorum queue does not find its local replica data
    files on boot, it will now log a warning.
  * An attempt to clear limits of a non-existent virtual host
    failed with a 500 status code.
  * The "Queues" tab in the UI was renamed to "Queue and Streams"
    to better reflect its contents.
  * New HTTP API endpoints for quorum queue replica management,
    equivalent to the `rabbitmq-queues` commands that manage replicas.
  * ```
  * POST /api/queues/quorum/{vhost}/{name}/replicas/add
  * DELETE /api/queues/quorum/{vhost}/{name}/replicas/remove
  * POST /api/queues/quorum/replicas/on/{node}/grow
  * DELETE /api/queues/quorum/replicas/on/{node}/shrink
  * ```
  * Stream client connections that authenticated using x.509
    certificates failed.
  * Only set OAuth 2 client's CA certificate file setting when it
    is defined.
  * The plugin will now accept JWT tokens without a `scope`. Such
    tokens would only be useful when the plugin is used exclusively
    for authentication and not authorization.
  * `oauth2` is now an accepted alias for the OAuth 2
    authentication and authorization backend:
  * ```
  * auth_backends.1 = oauth2
  * ```
  * Previously the only option for OAuth 2 was using a full
    module name, `rabbit_auth_backend_oauth2`.
  * STOMP plugin log entries had an extra line feed character.
  * `ra` was upgraded to `2.6.2`</changelog>
  <changelog author="dmueller@suse.com" date="1702814400">- update to 3.12.10:
  * Avoids two Shovels being started after an upgrade from 3.12.6
    or older versions.
  * When a topic permission was deleted, an internal event of type
    permission.deleted was emitted in some cases, instead of
    topic.permission.deleted.
  * Shovels on 3.12.8 nodes failed during a rolling cluster upgrade
    due to internal identifier format changes.
  * Avoids an unnecessary warning in the logs.
  * avoids a potential exception in the autoheal partition handler.
  * raft.segment_max_entries is now validated to prevent the value
    from overflowing its 16-bit segment file field. Maximum
    supported value is now 65535.</changelog>
  <changelog author="dmueller@suse.com" date="1704542400">- update to 3.12.11:
  * Quorum queue declared when one of cluster nodes was down
    could trigger connection exceptions.
  * Avoids a rare exception that could stop TCP socket writes on
    a client connection.
  * `queue_deleted` and `queue_created` internal events now
    include queue type as a module name, and not an inconsistent
    (with the other queue and stream types) value `classic`.
  * Definition files that are virtual host-specific cannot be
    imported on boot. Such files will now be detected early and
    the import process will terminate after logging a more
    informative message.
  * Several AMQP 1.0 application properties are now more
    correctly converted to AMQP 0-9-1 headers by
    cross-protocol Shovels.
  * The priority property now populates an AMQP 1.0 header with
    the same name, per AMQP 1.0 spec.
  * Metric label values now escape certain non-ASCII characters.
  * Avoids an exception when an MQTT client that used a QoS 0
    subscription reconnects and its original connection node
    is down.
  * Avoids an exception when an MQTT client connection was force-
    closed via the HTTP API.
  * Certain CLI commands could not be run in a shell script loop,
    unless the script explicitly redirected standard input.
  * `rabbitmq-diagnostics cluster_status` now responds much
    quicker when a cluster node has gone down, were shut down,
    or otherwise has become unreachable by the rest of the cluster.
  * Reverted a change to `DELETE /api/queues/{vhost}/{name}` that
    allowed removal of exclusive queues and introduced
    unexpected side effects.
  * `DELETE /api/policies/{vhost}/{policy}` returned a 500
    response instead of a 404 one when target virtual host did
    not exist.
  * Avoid log noise when an HTTP API request is issued against a
    booting or very freshly booted node.
  * HTTP API endpoints that involves contacting multiple nodes
    now respond much quicker when a cluster node
    has gone down, were shut down, or otherwise has become
    unreachable by the rest of the cluster
  * Definition exported for just one virtual host cannot be
    imported at node boot time.
  * Now such files are detected early with a clear log message
    and immediate node boot process termination.
  * To obtain source code of the entire distribution, please
    download the archive named `rabbitmq-server-3.12.11.tar.xz`
    instead of the source tarball produced by GitHub.</changelog>
  <changelog author="dimstar@opensuse.org" date="1707220800">- Provide user/group for RPM 4.19 (boo#1219532).</changelog>
  <changelog author="sflees@suse.de" date="1713268800">- Update to 3.13.1
  * Highlights
    Khepri now can be used as an alternative schema data store in RabbitMQ, replacing Mnesia
    MQTTv5 support
    Support for consumer-side stream filtering
    A new common message container format used internally, based on the AMQP 1.0 message format
    Improved classic non-mirrored queue performance with message sizes larger than
    4 KiB (or a different customized CQ index embedding threshold)
    Classic queues storage implementation version 2 (CQv2) is now highly recommended for all new deployments.
    CQv2 meaningfully improves performance of non-mirrored classic queues for most workloads
  * Fixes bsc#1222591</changelog>
  <changelog author="simonf.lees@suse.com" date="1717156800">- Create a versioned package for SLES
-  The following bugfixes and CVE's were fixed upstream
  (bsc#1186203,CVE-2021-22116), (bsc#1187818, CVE-2021-32718),
  (bsc#1187819, CVE-2021-32719) (bsc#1199431),
  (bsc#1205267), (bsc#1216582, CVE-2022-31008)</changelog>
</package>
<package pkgid="703aa6f5cd6a645d425a16f97e19255f06172766f330677a1f8e1ea36e81e9ad" name="erlang-rabbitmq-client313" arch="x86_64">
  <version epoch="0" ver="3.13.1" rel="150600.13.5.3"/>
  <changelog author="qydwhotmail@gmail.com" date="1637323200">- Update to 3.9.9:
  * Core Server Bug Fixes
  - Fixed an issue where node monitor could produce a false network
    partition when one of the cluster members was restarted.
  - Message store resiliency improvements.
  - Reduced log noise in certain scenarios where a new queue leader
    is elected.
  - Queue leader rebalancing now logs less.
  * Prometheus Plugin Bug Fixes
  - TLS-enabled Prometheus endpoint listener port was not correctly
    stored internally.
  * Management Plugin Bug Fixes
  - Persistent message count is now displayed correctly on
    individual queue pages.
  - Restore compatibility with IE 11.
  * Consistent Hashing Exchange Plugin Bug Fixes
  - Corrected deletion of duplicate bindings between an exchange
    and a queue.
  * Enhancements
  - Core Server: cluster_formation.target_cluster_size_hint is a
    new configuration setting that can be used to specify expected
    initial cluster size.
  - Prometheus Plugin: Metric rendering efficiency improvements
    (mostly latency).
- Don't install the (now gone) OCF script.
- Refreshed patch:
  * harden_rabbitmq-server.service.patch</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1638446400">- Update to 3.9.11
  * Core Server Bug Fixes
  - When a TLS-enabled listener failed to stop, it logged all of
    its settings which could contain sensitive values.
  * Core Server Enhancements
  - Quorum queues now store commands for enqueued messages in a
    more compact format on disk (some derivative data has been dropped).
  - queue.declare-ok response to AMQP 0-9-1 clients operating on
    a stream could return a ready-for-delivery message count
    value that was out of sync with the stream leader replica.
  - Classic queues now deliver more efficiently on channels that
    had global QoS changed during consumer operation.
  * Prometheus Plugin Enhancements
  - New optional metrics provided by the GET /metrics/detailed
    endpoint. These metrics are cluster-wide, and therefore must
    not be aggregated.
  * Management Agent Plugin Enhancements
  - Disabling the plugin will stop metric collection performed
    periodically by queues, streams, connections, et cetera.
- Changes in 3.9.10:
  * Core Server Bug Fixes
  - Make stream coordinator more defensive to rapid declaration
    and deletion cycles.
  * Core Server Enhancements
  - Several inter-node communication listener settings are now
    exposed to rabbitmq.conf:
    + distribution.listener.port_range.min = 25675
    + distribution.listener.port_range.max = 25675
    + distribution.listener.interface = 192.168.0.1
  * OAuth 2 Plugin Bug Fixes
  - Signing keys specified in rabbitmq.conf were not translated
    correctly, resulting in exceptions during permission checks.
- Drop upstreamed patch
  * harden_rabbitmq-server.service.patch: https://github.com/rabbitmq/rabbitmq-server/pull/3770</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1641470400">- Update to 3.9.12
  * See https://github.com/rabbitmq/rabbitmq-server/blob/v3.9.x/release-notes/3.9.12.md
    for the full changelog.
  * Core Server Bug Fixes and Enhancements
  - (Fix) Authentication and authorization backend exceptions
    could potentially leak user-provided credentials to node log.
  - Unnamed parameters and policies in definition files will now
    be rejected as invalid.</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1642593600">- Update to 3.9.13
  * Core Server Bug Fixes and Enhancements
  - Disk space monitor now correctly parses output on (at least
    some) systems where non-ASCII characters are used in paths.
  - Stream leader election is now deterministic when cluster is
    undergoing a rolling upgrade.
  - Queue and binding definition import can be delayed until a
    moment when at least N nodes (e.g. three) have joined the
    cluster.
- Allow building with Elixir 1.13.x
  * Support-Elixir-1.13.patch
  * Elixir-1.13-OptionParser-no-longer-supports-atom-val.patch</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1645272000">- Add zsh BuildRequires to fix "directories not owned by a package"
  in zsh-completion.</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1648209600">- Update to 3.9.14
  * See https://github.com/rabbitmq/rabbitmq-server/blob/v3.9.x/release-notes/3.9.14.md
    for the full changelog.
  * Build time compatibility with Elixir 1.13 (gh#rabbitmq/rabbitmq-server#4019)
  - Drop Elixir-1.13-OptionParser-no-longer-supports-atom-val.patch
  - Drop Support-Elixir-1.13.patch
  * Adapt to a breaking Erlang 24.3 LDAP client change.</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1652011200">- Update to 3.10.0
  * See https://github.com/rabbitmq/rabbitmq-server/blob/v3.10.x/release-notes/3.10.0.md
    for the full changelog.
  * Potentially breaking changes
  - Messages delivered by a quorum queue and negatively acknowledged
    with a requeue will be added to the back of the queue until the
    queue has redelivery limit set. With a redelivery limit, requeueing
    will use the original position of the message if possible.
  - idle_since field now uses RFC 3339 format.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1652270400">- add upstream signing key and verify source signature</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1653134400">- Update to 3.10.2
  * Default log level used a four-character severity abbreviation
    instead of more common longer format, for example, warn instead
    of warning.
  * Fix CLI tools failed to run on Erlang 25</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1655553600">- Update to 3.10.5
  * Quorum queue could run into an exception when dead lettering a message
    under certain conditions.
- Changes from 3.10.4
  * Avoid seeding default user in old clusters that still use the deprecated
    management.load_definitions option.
  * Streams could run into an exception or fetch stale stream position
    data in some scenarios.
  * rabbitmqctl set_log_level did not have any effect on logging via
    amq.rabbitmq.log</changelog>
  <changelog author="dimstar@opensuse.org" date="1666785600">- Update to version 3.10.10:
  + Core Server
  * Partially reverts an unsafe inter-node communication
    optimization that could affect classic mirrored queue
    operation ordering.
  * Classic mirrored queue leader replica issued to much credit
    to follower replicas, resulting in an uneven load and
    memory footprint between them.
  * Intra-cluster communication link metric collector could run
    into an exception when peer connection has just been
    re-established, e.g. after a peer node restart.
  + MQTT Plugin
  * When a node was put into maintenance mode, it closed all MQTT
    client connections cluster-wide instead of just local client
    connections.
- For updates between 3.10.5 and 3.10.9, please see
  https://www.rabbitmq.com/changelog.html</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1667995200">- Update to 3.11.3
  + Core Server
  * Stream unsubscription leaked metric counters.
  * Stream could become unavailable in certain node or network
    failure scenarios.
  * It is now possible to pre-configure virtual host limits for
    groups of virtual hosts.
  * Quorum queue replicas no longer try to contact their unreachable
    peers for metrics.
  + CLI Tools
  * rabbitmq-diagnostics status now handles server responses where
    free disk space is not yet computed.
  * All enabled (explicitly or as a dependency) plugins are scanned.
  * rabbitmq-diagnostics memory_breakdown now returns results much
    faster in environments with a large number of quorum queues.</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1685966400">- Update to 3.12.0
  * Optimizations for both quorum and classic queues: improved throughput,
    lower throughput variability, lower latency, lower memory footprint
  * More mature and efficient implementation of (non-mirrored) classic
    queues v2 (CQv2)
  * Classic queue lazy and non-lazy modes no longer apply: classic
    queues v2 always behave very similarly
  * to the lazy mode in earlier release series: moving data to disk
    aggressively and only keeping a subset of data in memory
  * Significantly reduced MQTT and Web MQTT memory footprint per connection
  * OAuth 2, OIDC, IDP support
  * Even more configurability of the OAuth 2 plugin
- More bugfixes and enhancements:
  https://www.rabbitmq.com/changelog.html</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1689681600">- Improve erlang-rabbitmq-client Provides:
  The package provides two erlang applications: amqp_client and rabbit_common
  which are expected to be Required as erlang-%{appname}</changelog>
  <changelog author="dmueller@suse.com" date="1698580800">-  update to 3.12.7:
  * Stream replication connections configured to use exclusively
    TLSv1.3 failed.
  * On startup, stream replicas will handle one more potential
    case of segment file corruption after an unclean shutdown.
  * `default_policies.*.queue_pattern` definition in
    `rabbitmq.conf` was incorrectly parsed.
  * Avoid log noise when inter-node connections frequently fail
    and recover.
  * Optimized stream index scans. Longer scans could result in
    some replicas stopping with a timeout.
  * Classic queue storage version is now a supported key for
    operator policies.
  * Queue length limit overflow behavior now can be configured
    via operator policies.
  * Several `list_stream_*` commands (available via both
    `rabbitmq-diagnostics` and `rabbitmq-streams`) commands now
    can display replica node in addition to other fields.
  * `rabbitmqctl add_user` now can accept a pre-generated salted
    password instead of a plain text password, both as a
    positional argument and via standard input:
  * Message consumption with the "Nack message, requeue: true"
    option did not actually requeue deliveries.
  * HTTP API request body size is now limited to 10 MiB by
    default.
  * Two endpoints, one that accepts messages for publishing
    (note: publishing over the HTTP API is greatly discouraged)
  * and another for definition import,
  * will now reject larger transfers with a `400 Bad Request`
    response.
  * `DELETE /api/queues/{vhost}/{name}` now can delete exclusive
    queues.
  * Key supported by operator policies are now grouped by queue
    type in the UI.
  * Improved data safety for confirms in environments where the
    plugin uses classic queues.
  * Avoid an exception when a not fully established MQTT-over-
    WebSockets connection terminated.
  * Recovery of bindings of durable queues bound to a transient
    JMS topic exchange failed.
  * Recovery of bindings of durable queues bound to a transient
    `x-modulo-hash` exchange failed.
  * Recovery of bindings of durable queues bound to a transient
    recent history exchange failed.
  * `osiris` has been upgraded to `1.6.9`
  * Queue recovery on node restart in certain conditions could
    run into an exception
  * `file_handle_cache` operations are now safer when handling
    non-existent keys.
  * Fixed a potential resource leak in at-least-once dead
    lettering from quorum queues.
  * AMQP 1.0 clients that try to publish in a way that results in
    the message not being routed anywhere are now notified with
    a more sensible settlement status.
  * Prometheus scraping API endpoints now support optional
    authentication.
  * The plugin now filters out values that are `undefined` or
    `NaN`, simply excluding them from the API endpoint response.
    Previously, if a metric was not computed for any reason (e.g.
    free disk space monitor was disabled on the node),
    its value could end up being rendered as `undefined` or `NaN`,
    two values that Prometheus scrapers cannot handle (for
  * The plugin will now enforce maximum STOMP frame size. Frames
    larger than that size will be rejected. The default maximum
    size is 4 MiB. It can be increased or decreased:
  * ``` ini
  * # increase maximum supported STOMP frame size to 10 MiB
  * stomp.max_frame_size = 10485760
  * ```
  * To reduce it from the default 4 MiB to 2 MiB:
  * ``` ini
  * # 2 MiB
  * stomp.max_frame_size = 2097152
  * ```
  * Shovel will gracefully stop when its destination (target)
    does not exist.
  * Such shovels will then be periodically restarted to retry.
  * It is now possible to opt in to deactivate file handle cache
    use in the plugin:
  * ``` ini
  * web_mqtt.use_file_handle_cache = false
  * ```
  * It is now possible to opt in to deactivate file handle cache
    use in the plugin:
  * ``` ini
  * web_stomp.use_file_handle_cache = false
  * ```
  * `ra` was upgraded to `2.6.3`
  * Declaration of a classic queue could run into an exception.
  * Classic queues v1 (CQv1) that had a backlog of messages
    stored by 3.9 and earlier versions could run into an exception
    during queue index recovery after an upgrade to 3.10.x or any
    later series.
  * Nodes that had a large number of quorum queues could observe
    accumulation of Erlang processes under significant load.
  * Feature flag discovery on a newly added node could discover
    an incomplete inventory of feature flags.
  * Feature flag discovery operations will now be retried
    multiple times in case of network failures.
  * Nodes in clusters that had quorum queues and non-mirrored
    classic queues on stopped (or failed) nodes could run into an
    exception.
  * The same exception could affect `rabbitmqctl list_queues`.
  * Proxy Protocol v2 LOCAL packets were not supported.
  * When a quorum queue does not find its local replica data
    files on boot, it will now log a warning.
  * An attempt to clear limits of a non-existent virtual host
    failed with a 500 status code.
  * The "Queues" tab in the UI was renamed to "Queue and Streams"
    to better reflect its contents.
  * New HTTP API endpoints for quorum queue replica management,
    equivalent to the `rabbitmq-queues` commands that manage replicas.
  * ```
  * POST /api/queues/quorum/{vhost}/{name}/replicas/add
  * DELETE /api/queues/quorum/{vhost}/{name}/replicas/remove
  * POST /api/queues/quorum/replicas/on/{node}/grow
  * DELETE /api/queues/quorum/replicas/on/{node}/shrink
  * ```
  * Stream client connections that authenticated using x.509
    certificates failed.
  * Only set OAuth 2 client's CA certificate file setting when it
    is defined.
  * The plugin will now accept JWT tokens without a `scope`. Such
    tokens would only be useful when the plugin is used exclusively
    for authentication and not authorization.
  * `oauth2` is now an accepted alias for the OAuth 2
    authentication and authorization backend:
  * ```
  * auth_backends.1 = oauth2
  * ```
  * Previously the only option for OAuth 2 was using a full
    module name, `rabbit_auth_backend_oauth2`.
  * STOMP plugin log entries had an extra line feed character.
  * `ra` was upgraded to `2.6.2`</changelog>
  <changelog author="dmueller@suse.com" date="1702814400">- update to 3.12.10:
  * Avoids two Shovels being started after an upgrade from 3.12.6
    or older versions.
  * When a topic permission was deleted, an internal event of type
    permission.deleted was emitted in some cases, instead of
    topic.permission.deleted.
  * Shovels on 3.12.8 nodes failed during a rolling cluster upgrade
    due to internal identifier format changes.
  * Avoids an unnecessary warning in the logs.
  * avoids a potential exception in the autoheal partition handler.
  * raft.segment_max_entries is now validated to prevent the value
    from overflowing its 16-bit segment file field. Maximum
    supported value is now 65535.</changelog>
  <changelog author="dmueller@suse.com" date="1704542400">- update to 3.12.11:
  * Quorum queue declared when one of cluster nodes was down
    could trigger connection exceptions.
  * Avoids a rare exception that could stop TCP socket writes on
    a client connection.
  * `queue_deleted` and `queue_created` internal events now
    include queue type as a module name, and not an inconsistent
    (with the other queue and stream types) value `classic`.
  * Definition files that are virtual host-specific cannot be
    imported on boot. Such files will now be detected early and
    the import process will terminate after logging a more
    informative message.
  * Several AMQP 1.0 application properties are now more
    correctly converted to AMQP 0-9-1 headers by
    cross-protocol Shovels.
  * The priority property now populates an AMQP 1.0 header with
    the same name, per AMQP 1.0 spec.
  * Metric label values now escape certain non-ASCII characters.
  * Avoids an exception when an MQTT client that used a QoS 0
    subscription reconnects and its original connection node
    is down.
  * Avoids an exception when an MQTT client connection was force-
    closed via the HTTP API.
  * Certain CLI commands could not be run in a shell script loop,
    unless the script explicitly redirected standard input.
  * `rabbitmq-diagnostics cluster_status` now responds much
    quicker when a cluster node has gone down, were shut down,
    or otherwise has become unreachable by the rest of the cluster.
  * Reverted a change to `DELETE /api/queues/{vhost}/{name}` that
    allowed removal of exclusive queues and introduced
    unexpected side effects.
  * `DELETE /api/policies/{vhost}/{policy}` returned a 500
    response instead of a 404 one when target virtual host did
    not exist.
  * Avoid log noise when an HTTP API request is issued against a
    booting or very freshly booted node.
  * HTTP API endpoints that involves contacting multiple nodes
    now respond much quicker when a cluster node
    has gone down, were shut down, or otherwise has become
    unreachable by the rest of the cluster
  * Definition exported for just one virtual host cannot be
    imported at node boot time.
  * Now such files are detected early with a clear log message
    and immediate node boot process termination.
  * To obtain source code of the entire distribution, please
    download the archive named `rabbitmq-server-3.12.11.tar.xz`
    instead of the source tarball produced by GitHub.</changelog>
  <changelog author="dimstar@opensuse.org" date="1707220800">- Provide user/group for RPM 4.19 (boo#1219532).</changelog>
  <changelog author="sflees@suse.de" date="1713268800">- Update to 3.13.1
  * Highlights
    Khepri now can be used as an alternative schema data store in RabbitMQ, replacing Mnesia
    MQTTv5 support
    Support for consumer-side stream filtering
    A new common message container format used internally, based on the AMQP 1.0 message format
    Improved classic non-mirrored queue performance with message sizes larger than
    4 KiB (or a different customized CQ index embedding threshold)
    Classic queues storage implementation version 2 (CQv2) is now highly recommended for all new deployments.
    CQv2 meaningfully improves performance of non-mirrored classic queues for most workloads
  * Fixes bsc#1222591</changelog>
  <changelog author="simonf.lees@suse.com" date="1717156800">- Create a versioned package for SLES
-  The following bugfixes and CVE's were fixed upstream
  (bsc#1186203,CVE-2021-22116), (bsc#1187818, CVE-2021-32718),
  (bsc#1187819, CVE-2021-32719) (bsc#1199431),
  (bsc#1205267), (bsc#1216582, CVE-2022-31008)</changelog>
</package>
<package pkgid="81812d8bc966c0e0b937e30793d504de987c9feadb989930936cae57e97f5ed8" name="erlang26" arch="aarch64">
  <version epoch="0" ver="26.2.1" rel="150300.7.5.1"/>
  <changelog author="matwey.kornilov@gmail.com" date="1646568000">- Changes for 24.2.2:
  * inets: Avoid intermediate ungraceful shutdown of the HTTP
    server.
  * ssh: The ssh sever parallel_login option was missing in OTP-24</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1648382400">- Changes for 24.3.2:
  * erl_interface: Fix compile error regarding gethostbyaddr_r on
    Android. Error introduced in OTP 24.3.
  * kernel: Fix failed accepted connection setup after previous
    established connection from same node closed down silently.
  * kernel: Fixed a problem where typing Ctrl-R in the shell could
    hang if there were some problem with the history log file.
- Changes for 24.3.1:
  * dialyzer: There could be spurious warnings for unknown types
    when a type was a subtype of an existing type that was a
    subtype of an unknown type.
  * ssl: Client certification could fail for TLS-1.3 servers that
    did not include the certificat_authorties extension in its
    certificate request message.
- Changes for 24.3:
  * megaco: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.
  * megaco: Update the performance and debug chapters of the megaco
    user's guide. Also some updates to the meas tools.
  * compiler: The expression &lt;&lt;0/native-float&gt;&gt;=Bin would always
    fail to match, while &lt;&lt;0/float-native&gt;&gt;=Bin would match
    (provided that Bin contained the binary representation of 0.0)
  * compiler: The compiler will now compile huge functions with
    straight-line code faster.
  * erl_interface: Add --enable-ei-dynamic-lib configure option
    that will make erl_interface also release a dynamic library
    version of libei.
  * erl_interface: The ei API for decoding/encoding terms is not
    fully 64-bit compatible since terms that have a representation
    on the external term format larger than 2 GB cannot be handled.
  * sasl: Fix bug in systools:make_script/1 documentation.
  * inets: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.
  * inets: Documentation fix for inets:services_info/0, which now
    describes that Info might be a Reason term() in case when
    {error, Reason} is returned as service info.
  * crypto: The crypto app in OTP can since OTP-24.2 be compiled,
    linked and used with the new OpenSSL 3.0 cryptolib. The crypto
    app has 3.0 support has been improved, but is still *not
    recommended* for other usages than experiments and alpha
    testing. There are not yet any guaranties that it works, not
    even together with other OTP applications like for example SSL
    and SSH, although there are no known errors. Since the previous
    release, OTP-24.2, the following improvements have been done: -
    It has been tested during nearly every nightly test on the OTP
    lab - The hash algorithms md4 and ripemd160 have been enabled
    with OpenSSL 3.0. - The ciphers blowfish_cbc, blowfish_ecb,
    des_cbc, des_cfb, des_ecb, rc2_cbc and rc4 have been enabled
    with OpenSSL 3.0. Disabled or unsupported with OpenSSL 3.0 are
    still: - ENGINE support - FIPS mode - Other providers than the
    built-in ones - Compiling and linking with OpenSSL 3.0
    cryptolib in compatibility modes (for example to behave as
    1.1.1) and, the ciphers blowfish_cfb64 and blowfish_ofb64 are
    not supported and will not be either. Deprecated functions in
    the OpenSSL 3.0 cryptolib must not be disabled as OTP/crypto
    still uses some of the deprecated API functions. The gcc flag
  - Wno-deprecated-declarations is set to prevent deprecation
    warnings to be printed when compiling.
  * crypto: Crypto is adapted to LibreSSL 3.5.0 on OpenBSD.
  * crypto: New configure option ( --disable-otp-test-engine) to
    prohibit the build of the OTP test engine used in some test
    suites. The reason is that the test engine could be hard to
    compile on for instance LibreSSL 3.5.0. For that particular
    cryptolib version (or higher), this configure option is set
    automatically.
  * jinterface: Fix bug in OtpOutputStream.write_pid/4 and
    write_ref/3 causing faulty encodig. Bug exists since OTP 23.0.
  * wx: Removed the static_data option from wxImage creation
    functions, as it was broken and could lead to crashes. Now
    image data is always copied to wxWidgets as was the default
    behavior. Removed some non working wxGridEvent event types,
    which have there own events in newer wxWidgets versions, and
    added a couple of event types that where missing in wx.
  * asn1: Add support for the maps option in combination with the
    jer backend.
  * snmp: The compilation time is no longer recorded in BEAM files.
    There remained several undocumented functions that attempted to
    retrieve compilation times. Those have now been removed.
  * snmp: [agent] Remove expectation of socket being a port.
  * common_test: OTP internal test fix.
  * runtime_tools: Fixed bug in scheduler:utilization(Seconds) that
    would leave the scheduler_wall_time system flag incorrectly
    enabled.
  * runtime_tools: Add scheduler:get_sample/0 and get_sample_all/0.
    Also clarify scheduler module documentation about how it
    depends on system flag scheduler_wall_time.
  * erts: Fixed a bug in the x86 JIT that might cause floating
    point instructions to wrongly throw an exception.
  * erts: Preserve correct nodedown_reason if supervised
    distribution controller processes exit with {shutdown, Reason}.
  * erts: Handling of send_timeout for gen_tcp has been corrected
    so that the timeout is honored also when sending 0 bytes.
  * erts: By default global does not take any actions to restore a
    fully connected network when connections are lost due to
    network issues. This is problematic for all applications
    expecting a fully connected network to be provided, such as for
    example mnesia, but also for global itself. A network of
    overlapping partitions might cause the internal state of global
    to become inconsistent. Such an inconsistency can remain even
    after such partitions have been brought together to form a
    fully connected network again. The effect on other applications
    that expects that a fully connected network is maintained may
    vary, but they might misbehave in very subtle hard to detect
    ways during such a partitioning. In order to prevent such
    issues, we have introduced a prevent overlapping partitions fix
    which can be enabled using the prevent_overlapping_partitions
    kernel(6) parameter. When this fix has been enabled, global
    will actively disconnect from nodes that reports that they have
    lost connections to other nodes. This will cause fully
    connected partitions to form instead of leaving the network in
    a state with overlapping partitions. Note that this fix has to
    be enabled on all nodes in the network in order to work
    properly. Since this quite substantially changes the behavior,
    this fix is currently disabled by default. Since you might get
    hard to detect issues without this fix you are, however,
    strongly advised to enable this fix in order to avoid issues
    such as the ones described above. As of OTP 25 this fix will
    become enabled by default.
  * erts: Corrected the type specification of erlang:seq_trace/2.
  * erts: Fix memory leak when tracing on running on a process that
    only handle system tasks or non-message signals (for example
    process_info requests).
  * erts: Add support for using socket:sockaddr_in() and
    socket:sockaddr_in6() when using gen_sctp, gen_tcp and gen_udp.
    This will make it possible to use Link Local IPv6 addresses.
  * erts: Show on_load failure reasons in embedded mode.
  * erts: Compile date saved in the Erlang VM executable has been
    removed.
  * erts: Improve documentation for the dynamic node name feature.
  * ssh: Fix makefile dependency bugs.
  * ssh: Fixed faulty OpenSSH decoding of Ed25519/Ed448 keys in the
    OpenSSH format openssh_key_v1.
  * ssh: Correction of ssh_file typing, specially for the
    experimental openssh-key-v1 encoding.
  * ssh: Improper tag for private ED keys when encoding with
    ssh:encode/2. The tuple had ed_priv as first element, but
    should have had ed_pri. This is now corrected. *** POTENTIAL
    INCOMPATIBILITY ***
  * ssh: Add support for Ed25519/Ed448 SSH host keys in the RFC
    4716 format ("-----BEGIN EC PRIVATE KEY-----") generated by for
    example openssl or via Erlang functions (i.e.
    public_key:generate_key({namedCurve, ed25519})). Ed25519 SSH
    host keys generated by ssh-keygen was, and are still,
    supported.
  * kernel: Handling of send_timeout for gen_tcp has been corrected
    so that the timeout is honored also when sending 0 bytes.
  * kernel: By default global does not take any actions to restore
    a fully connected network when connections are lost due to
    network issues. This is problematic for all applications
    expecting a fully connected network to be provided, such as for
    example mnesia, but also for global itself. A network of
    overlapping partitions might cause the internal state of global
    to become inconsistent. Such an inconsistency can remain even
    after such partitions have been brought together to form a
    fully connected network again. The effect on other applications
    that expects that a fully connected network is maintained may
    vary, but they might misbehave in very subtle hard to detect
    ways during such a partitioning. In order to prevent such
    issues, we have introduced a prevent overlapping partitions fix
    which can be enabled using the prevent_overlapping_partitions
    kernel(6) parameter. When this fix has been enabled, global
    will actively disconnect from nodes that reports that they have
    lost connections to other nodes. This will cause fully
    connected partitions to form instead of leaving the network in
    a state with overlapping partitions. Note that this fix has to
    be enabled on all nodes in the network in order to work
    properly. Since this quite substantially changes the behavior,
    this fix is currently disabled by default. Since you might get
    hard to detect issues without this fix you are, however,
    strongly advised to enable this fix in order to avoid issues
    such as the ones described above. As of OTP 25 this fix will
    become enabled by default.
  * kernel: Fix bug where logger would crash when logging a report
    including improper lists.
  * kernel: Make erlang:set_cookie work for dynamic node names.
  * kernel: Add support for using socket:sockaddr_in() and
    socket:sockaddr_in6() when using gen_sctp, gen_tcp and gen_udp.
    This will make it possible to use Link Local IPv6 addresses.
  * kernel: A net_tickintensity kernel parameter has been
    introduced. It can be used to control the amount of ticks
    during a net_ticktime period. A new net_kernel:start/2 function
    has also been introduced in order to make it easier to add new
    options. The use of net_kernel:start/1 has been deprecated.
  * kernel: Improve documentation for the dynamic node name
    feature.
  * erl_docgen: Fix css for large tables and images on small
    screens
  * erl_docgen: Fix bug with codeinclude tag that caused it to not
    include the code if used in a correct, but unexpected way.
  * observer: Calculate the display width in etop, instead of hard-
    coding it to 89 characters.
  * debugger: Fix record index matching, it was broken and could
    never match.
  * ssl: Improved error handling.
  * ssl: Before this change, net_kernel used with TLS distribution
    might be leaking processes in case of connectivity issues.
  * ssl: Fix makefile dependency bugs.
  * ssl: Make sure the TLS sender process handles explicit calls to
    erlang:disconnect_node properly, avoiding potential hanging
    problems in net_kernel.
  * ssl: Add support for TLS-1.3 certificate_authorities extension.
    And process certificate_authorities field in pre-TLS-1.3
    certificate requests.
  * ssl: Support password fun for protected keyfiles in ssl:connect
    function.
  * ssl: Add in some cases earlier detection of possible DoS
    attacks by malicious clients sending unexpected TLS messages
    instead of the client hello. Note that such attacks are already
    mitigated by providing a timeout for the TLS handshake.
  * eldap: Fix eldap extensibleMatch dnAttributes option. According
    to the ldap ASN1 the dnAttributes should be a bool, instead it
    was generated as a string.
  * eldap: Implemented paged searches according to https://www.rfc-
    editor.org/rfc/rfc2696.txt
  * public_key: Support password fun for protected keyfiles in
    ssl:connect function.
  * stdlib: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.
  * mnesia: Reduce the number of locks taken during table copying,
    should reduce the startup time on large systems.
  * diameter: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1649246400">- Fix build for Factory. Currently, any Java version
  is fine for Erlang.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1653220800">- Version 25.0:
  - stdlib
  * New function filelib:ensure_path/1 will ensure that all
    directories for the given path exists
  * New functions groups_from_list/2 and groups_from_list/3 in
    the maps module
  * New functions uniq/1 uniq/2 in the lists module
  * New PRNG added to the rand module, for fast pseudo-random
    numers.
  - compiler, kernel, stdlib, syntax_tools:
  * Added support for selectable features as described in EEP-60.
    Features can be enabled/disabled during compilation with
    options (ordinary and +term) to erlc as well as with
    directives in the file. Similar options can be used to erl
    for enabling/disabling features allowed at runtime. The new
    maybe expression EEP-49 is fully supported as the feature
    maybe_expr.
  - erts &amp; JIT:
  * The JIT now works for 64-bit ARM processors.
  * The JIT now does type-based optimizations based on type
    information in the BEAM files.
  * Improved the JIT’s support for external tools like perf and
    gdb, allowing them to show line numbers and even the original
    Erlang source code when that can be found.
  - erts, stdlib, kernel:
  * Users can now configure ETS tables with the
    {write_concurrency, auto} option. This option forces tables
    to automatically change the number of locks that are used at
    run-time depending on how much concurrency is detected. The
    {decentralized_counters, true} option is enabled by default
    when {write_concurrency, auto} is active.
  * Benchmark results comparing this option with the other ETS
    optimization options are available here: benchmarks.
  * To enable more optimizations, BEAM files compiled with OTP 21
    and earlier cannot be loaded in OTP 25.
  * The signal queue of a process with the process flag
    message_queue_data=off_heap has been optimized to allow
    parallel reception of signals from multiple processes. This
    can improve performance when many processes are sending in
    parallel to one process. See benchmark.
  * The Erlang installation directory is now relocatable on the
    file system given that the paths in the installation’s
    RELEASES file are paths that are relative to the
    installations root directory.
  * A new option called short has been added to the functions
    erlang:float_to_list/2 and erlang:float_to_binary/2. This
    option creates the shortest correctly rounded string
    representation of the given float that can be converted back
    to the same float again.
  * Introduction of quote/1 and unquote/1 functions in the
    uri_string module - a replacement for the deprecated
    functions http_uri:encode and http_uri:decode.
  * The new module peer supersedes the slave module. The slave
    module is now deprecated and will be removed in OTP 27.
  * global will now by default prevent overlapping partitions due
    to network issues. This is done by actively disconnecting
    from nodes that reports that they have lost connections to
    other nodes. This will cause fully connected partitions to
    form instead of leaving the network in a state with
    overlapping partitions.
  * It is possible to turn off the new behavior by setting the
    the kernel configuration parameter
    prevent_overlapping_partitions to false. Doing this will
    retain the same behavior as in OTP 24 and earlier.
  * The format_status/2 callback for gen_server, gen_statem and
    gen_event has been deprecated in favor of the new
    format_status/1 callback.
  * The new callback adds the possibility to limit and change
    many more things than the just the state.
  * The timer module has been modernized and made more efficient,
    which makes the timer server less susceptible to being
    overloaded. The timer:sleep/1 function now accepts an
    arbitrarily large integer.
  - compiler:
  * The maybe ... end construction as proposed in EEP-49 has been
    implemented. It can simplify complex code where otherwise
    deeply nested cases would have to be used.
  * To enable maybe, give the option {enable_feature,maybe_expr}
    to the compiler. The exact option to use will change in a
    coming release candidate and then it will also be possible to
    use from inside the module being compiled.
  * When a record matching or record update fails, a {badrecord,
    ExpectedRecordTag} exception used to be raised. In this
    release, the exception has been changed to {badrecord,
    ActualValue}, where ActualValue is the value that was found
    instead of the expected record.
  * Add compile attribute -nifs() to empower compiler and loader
    with information about which functions may be overridden as
    NIFs by erlang:load_nif/2.
  * Improved and more detailed error messages when binary
    construction with the binary syntax fails. This applies both
    for error messages in the shell and for
    erl_error:format_exception/3,4.
  * Change format of feature options and directives for better
    consistency. Options to erlc and the -compile(..) directive
    now has the format {feature, feature-name, enable | disable}.
    The -feature(..) now has the format -feature(feature-name,
    enable | disable).
  - crypto:
  * Add crypto:hash_equals/2 which is a constant time comparision
    of hashvalues.
  - ssl:
  * Introducing a new (still experimental) option
    {certs_keys,[cert_key_conf()]}. With this a list of a
    certificates with their associated key may be used to
    authenticate the client or the server. The certificate key
    pair that is considered best and matches negotiated
    parameters for the connection will be selected.
  - public_key:
  * Functions for retrieving OS provided CA-certs added.
  - dialyzer:
  * Optimize operations in the erl_types module. Parallelize the
    Dialyzer pass remote.
  * Added the missing_return and extra_return options to raise
    warnings when specifications differ from inferred types.
    These are similar to, but not quite as verbose as overspecs
    and underspecs.
  * Dialyzer now better understands the types for min/2, max/2,
    and erlang:raise/3. Because of that, Dialyzer can potentially
    generate new warnings. In particular, functions that use
    erlang:raise/3 could now need a spec with a no_return()
    return type to avoid an unwanted warning.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1656849600">- Changes for 25.0.2:
  * ssl: Improved handling of unexpected messages during the
    handshake, taking the right action for unexpected messages.
  * erts: On computers with the ARM64 (AArch64) architecture (such
    as Apple Silicon Macs) a rem expression followed by a div
    expression with the same operands could evaluate to the wrong
    result if the result of the rem expression was unused.
- Changes for 25.0.1:
  * ssl: When a TLS-1.3 enabled client tried to talk to a TLS-1.2
    server that coalesces TLS-1.2 handshake message over one TLS
    record, the connection could fail due to some message being
    handled in the wrong state, this has been fixed.
  * ssl: Correctly handles supported protocol version change from
    default to something else by sni_fun supplied to
    ssl:handshake/[2,3] together with a TCP-socket (so called
    upgrade).
  * ssl: Also, TLS-1.3 should respond with a protocol version alert
    if previous versions, that are supported but not configured,
    are attempted.
  * kernel: The DNS resolver inet_res has been fixed to ignore
    trailing dot difference in the request domain between the sent
    request and the received response, when validating a response.
  * kernel: A bug in inet_res has been fixed where a missing
    internal {ok,_} wrapper caused inet_res:resolve/* to return a
    calculated host name instead of an `{ok,Msg} tuple, when
    resolving an IP address or a host name that is an IP address
    string.
  * kernel: The erlang:is_alive() BIF could return true before
    configured distribution service was available. This bug was
    introduced in OTP 25.0 ERTS version 13.0. The
    erlang:monitor_node() and erlang:monitor() BIFs could
    erroneously fail even though configured distribution service
    was available. This occurred if these BIFs were called after
    the distribution had been started using dynamic node name
    assignment but before the name had been assigned.
  * kernel: Added the missing mandatory address/0 callback in the
    gen_tcp_dist example.
  * erts: A spawn_reply signal from a remote node could be delayed
    and be delivered after other signals from the newly spawned
    process. When this bug triggered, the connection to the node
    where the process was spawned sometimes could be taken down due
    to the bug. The following error message would then be logged if
    this happened: Missing 'spawn_reply' signal from the node
    &lt;RemoteNode&gt; detected by &lt;Pid&gt; on the node &lt;LocalNode&gt;. The
    node &lt;RemoteNode&gt; probably suffers from the bug with ticket id
    OTP-17737. This bug only affected processes which had enabled
    off_heap message_queue_data and parallel reception of signals
    had been automatically enabled. This bug was introduced in OTP
    25.0, ERTS version 13.0.
  * erts: Fixed type spec of erlang:system_info(dist_ctrl).
  * erts: The zlib built in to the runtime system has been updated
    to version 1.2.12. (Note that on most platforms, the platform's
    own zlib is used.)
  * erts: The erlang:is_alive() BIF could return true before
    configured distribution service was available. This bug was
    introduced in OTP 25.0 ERTS version 13.0. The
    erlang:monitor_node() and erlang:monitor() BIFs could
    erroneously fail even though configured distribution service
    was available. This occurred if these BIFs were called after
    the distribution had been started using dynamic node name
    assignment but before the name had been assigned.
  * crypto: Note in the documentation that MODP (rfc3526) groups
    and OpenSSL 3.0 can give an error if a call to
    crypto:generate_key/2 specifies a key length, and that length
    is to small.
  * crypto: The cmac now uses only the 3.0 API
  * crypto: Documentation is now updated with which OpenSSL
    cryptolib versions that OTP currently is tested.
  * dialyzer: Fixed the documentation for the missing_return and
    extra_return options.
  * mnesia: Fixed add_table_copy which could leave a table lock if
    the receiving node went down during the operation.
  * ssh: Binaries can be limited in logs with the parameter
    max_log_item_len. The default value is 500 bytes.
  * stdlib: In the initial release of Erlang/OTP 25, the expression
    bound to the _ pseudo-field in a record initialization would
    always be evaluated once, even if all other fields in the
    record were explicitly initialized. That would break the use
    case of binding the expression error(...) to _ in order to get
    an exception if not all fields were initialized. The behavior
    of binding to _ has been reverted to the pre-OTP 25 behavior,
    that is, to not evaluate the expression if all fields have been
    bound to explicit values.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1660046400">- Changes for 25.0.3:
  * erts: Distributed exit signals could be lost under the
    following conditions:
  * erts: A race could cause process_info(Pid, message_queue_len)
    on other processes to return invalid results.
  * erts: Fixed reduction counting for handling process system
    tasks.
  * erts: Priority elevation of terminating processes did not work
    which could cause execution of such processes to be delayed.
  * erts: An unlink operation made by a process that terminated
    before the unlink operation completed, i.e., before it had
    received an unlink-ack signal from the linked process, caused
    an exit signal to erroneously be sent from the terminating
    process to the process being unlinked. This exit signal would
    most often be ignored by the receiver, but if the receiver of
    the exit signal concurrently set up a new link, it could
    receive the exit signal with the actual exit reason of the
    terminating process instead of a noproc exit reason. It is
    however very hard to detect that this has happened and has no
    obvious negative consequences, so it should be considered
    harmless. A distributed unlink-ack signal received by a
    terminating process was also not properly removed which could
    cause a minor memory leak.
  * ssl: The link to crypto:engine_load refered the function with
    wrong arity.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1661601600">- Changes for 25.0.4:
  * kernel: A call to net_kernel:setopts(new, Opts) at the same
    time as a connection was being set up could cause a deadlock
    between the net_kernel process and the process setting up the
    connection.
  * erts: The monitor/3 BIF did not apply options to the created
    monitor if the target process or port did not exist. That is,
    the corresponding down message would get a `DOWN` tag even if a
    custom tag had been set, and the returned reference was not an
    alias even if the alias option had been passed.
  * erts: The erlang:monotonic_time/1, erlang:system_time/1,
    erlang:time_offset/1, and os:system_time/1 BIFs erroneously
    failed when passed the argument native.</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1665662400">- Changes for 25.1.1:
  * dialyzer: Dialyzer could crash when analyzing Elixir code that
    used intricate macros.
  * dialyzer: The --input_list_file option has been added.
  * ssl: Fixes handling of symlinks in cacertfile option.
  * eunit: With this change, eunit exact_execution option works
    with application primitive.
  * stdlib: peer nodes failed to halt when the process supervising
    the control connection crashed. When an alternative control
    connection was used, this supervision process also quite
    frequently crashed when the peer node was stopped by the node
    that started it which caused the peer node to linger without
    ever halting.
  * asn1: For the per and uper ASN.1 encoding rules, encoding and
    decoding the SEQUENCE OF and SET OF constructs with 16384 items
    or more is now supported.
  * erts: Listen sockets created with the socket module, leaked
    (erlang-) monitors.
  * erts: Notifications about available distribution data sent to
    distribution controller processes could be lost. Distribution
    controller processes can be used when implementing an
    alternative distribution carrier. The default distribution over
    tcp was not effected and the bug was also not present on
    x86/x86_64 platforms.
  * kernel: Listen sockets created with the socket module, leaked
    (erlang-) monitors.
  * kernel: peer nodes failed to halt when the process supervising
    the control connection crashed. When an alternative control
    connection was used, this supervision process also quite
    frequently crashed when the peer node was stopped by the node
    that started it which caused the peer node to linger without
    ever halting.
- Changes for 25.1:
  * dialyzer: Two bugs have been fixed in Dialyzer's checking of
    behaviors: When a mandatory callback function is present but
    not exported, Dialyzer would not complain about a missing
    callback. When an optional callback function was not exported
    and had incompatible arguments and/or the return values were
    incompatible, Dialyzer would complain. This has been changed to
    suppress the warning, because the function might not be
    intended to be a callback function, for instance if a release
    added a new optional callback function (such as format_status/1
    for the gen_server behaviour added in OTP 25).
  * dialyzer: The no_extra_return and no_missing_return warnings
    can now be suppressed through -dialyzer directives in source
    code.
  * jinterface: Fix javadoc build error by adding option -encoding
    UTF-8.
  * diameter: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * crypto: Fix configure with --with-ssl and --disable-dynamic-
    ssl-lib on Windows.
  * crypto: Remove all references correctly in the garbage
    collection if an engine handle was not explicit unloaded.
  * crypto: Changed the behaviour of the engine load/unload
    functions The engine load/unload functions have got changed
    semantics to get a more consistent behaviour and work correct
    when variables are garbage collected. The load functions now
    don't register the methods for the engine to replace. That will
    now be handled with the new functions
    engine_register/engine_unregister if needed. Some functions are
    removed from the documentation and therefor the API, but they
    are left in the code for compatibility. *** POTENTIAL
    INCOMPATIBILITY ***
  * crypto: Fixed a naming bug for AES-CFB and Blowfish-CFB/OFB
    when linked with OpenSSL 3.0 cryptolib.
  * crypto: Sign/verify does now behave as in OTP-24 and earlier
    for eddsa.
  * crypto: Pass elliptic curve names from crypto.erl to crypto's
    nif.
  * crypto: The configure option --disable-deprecated-warnings is
    removed. It was used for some releases when the support for
    OpenSSL 3.0 was not completed. It is not needed in OTP 25.
  * crypto: Crypto is now considered to be usable with the OpenSSL
    3.0 cryptolib for production code. ENGINE and FIPS are not yet
    fully functional.
  * crypto: Do not exit if the legacy provider is missing in
    libcrypto 3.0.
  * ssl: Reject unexpected application data in all relevant places
    for all TLS versions. Also, handle TLS-1.3 middlebox
    compatibility with more care. This will make malicious
    connections fail early and further, mitigate possible DoS
    attacks, that would be caught by the handshake timeout. Thanks
    to Aina Toky Rasoamanana and Olivier Levillain from Télécom
    SudParis for alerting us of the issues in our implementation.
  * ssl: With this change, value of cacertfile option will be
    adjusted before loading certs from the file. Adjustments
    include converting relative paths to absolute and converting
    symlinks to actual file path. Thanks to Marcus Johansson
  * ssl: In TLS-1.3, if chain certs are missing (so server auth
    domain adherence can not be determined) send peer cert and hope
    the server is able to recreate a chain in its auth domain.
  * ssl: Make sure periodical refresh of CA certificate files
    repopulates cache properly.
  * ssl: Correct internal CRL cache functions to use internal
    format consistently.
  * ssl: Incorrect handling of client middlebox negotiation for
    TLS-1.3 could result in that a TLS-1.3 server would not use
    middlebox mode although the client was expecting it too and
    failing the negotiation with unexpected message.
  * ssl: If the "User" process, the process starting the TLS
    connection, gets killed in the middle of spawning the dynamic
    connection tree make sure we do not leave any processes behind.
  * ssl: A vulnerability has been discovered and corrected. It is
    registered as CVE-2022-37026 "Client Authentication Bypass".
    Corrections have been released on the supported tracks with
    patches 23.3.4.15, 24.3.4.2, and 25.0.2. The vulnerability
    might also exist in older OTP versions. We recommend that
    impacted users upgrade to one of these versions or later on the
    respective tracks. OTP 25.1 would be an even better choice.
    Impacted are those who are running an ssl/tls/dtls server using
    the ssl application either directly or indirectly via other
    applications. For example via inets (httpd), cowboy, etc. Note
    that the vulnerability only affects servers that request client
    certification, that is sets the option {verify, verify_peer}.
    (bsc#1205318)
  * eunit: With this change, Eunit can optionally not try to
    execute related module with "_tests" suffix. This might be used
    for avoiding duplicated executions when source and test modules
    are located in the same folder.
  * erl_docgen: Update DTD to allow XML tag em under pre.
  * inets: Add httpc:ssl_verify_host_options/1 to help setting
    default ssl options for the https client.
  * inets: This change fixes dialyzer warnings generated for
    inets/httpd examples (includes needed adjustment of spec for
    ssh_sftp module).
  * inets: Remove documentation of no longer supported callback.
  * stdlib: Fixed inconsistency bugs in global due to
    nodeup/nodedown messages not being delivered before/after
    traffic over connections. Also fixed various other
    inconsistency bugs and deadlocks in both global_group and
    global. As building blocks for these fixes, a new BIF
    erlang:nodes/2 has been introduced and
    net_kernel:monitor_nodes/2 has been extended. The -hidden and
  - connect_all command line arguments did not work if multiple
    instances were present on the command line which has been
    fixed. The new kernel parameter connect_all has also been
    introduced in order to replace the -connect_all command line
    argument.
  * stdlib: Fix the public_key:ssh* functions to be listed under
    the correct release in the Removed Functionality User's Guide.
  * stdlib: The type spec for format_status/1 in gen_statem,
    gen_server and gen_event has been corrected to state that the
    return value is of the same type as the argument (instead of
    the same value as the argument).
  * stdlib: If the timer server child spec was already present in
    kernel_sup but it was not started, the timer server would fail
    to start with an {error, already_present} error instead of
    restarting the server.
  * stdlib: When changing callback module in gen_statem the
    state_enter calls flag from the old module was used in for the
    first event in the new module, which could confuse the new
    module and cause malfunction. This bug has been corrected. With
    this change some sys debug message formats have been modified,
    which can be a problem for debug code relying on the format.
  * ** POTENTIAL INCOMPATIBILITY ***
  * stdlib: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * stdlib: The rfc339_to_system_time/1,2 functions now allows the
    minutes part to be omitted from the time zone.
  * stdlib: The receive statement in gen_event has been optimized
    to not use selective receive (which was never needed, and could
    cause severe performance degradation under heavy load).
  * stdlib: Add new API function erl_features:configurable/0
  * parsetools: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * public_key: Support more Linux distributions in cacerts_load/0.
  * public_key: Correct asn1 typenames available in type
    pki_asn1_type()
  * public_key: Sign/verify does now behave as in OTP-24 and
    earlier for eddsa.
  * snmp: Improved the get-bulk response max size calculation. Its
    now possible to configure 'empty pdu size', see appendix c for
    more info.
  * snmp: Fix various example dialyzer issues
  * ssh: Handling rare race condition at channel close.
  * ssh: New ssh option no_auth_needed to skip the ssh
    authentication. Use with caution!
  * ssh: This change fixes dialyzer warnings generated for
    inets/httpd examples (includes needed adjustment of spec for
    ssh_sftp module).
  * ssh: The new function ssh:daemon_replace_options/2 makes it
    possible to change the Options in a running SSH server.
    Established connections are not affected, only those created
    after the call to this new function.
  * ssh: Add a timeout as option max_initial_idle_time. It closes a
    connection that does not allocate a channel within the timeout
    time. For more information about timeouts, see the Timeouts
    section in the User's Guide Hardening chapter.
  * observer: Fixed units in gui.
  * xmerl: There is a new configure option, --enable-deterministic-
    build, which will apply the deterministic compiler option when
    building Erlang/OTP. The deterministic option has been improved
    to eliminate more sources of non-determinism in several
    applications.
  * asn1: There is a new configure option, --enable-deterministic-
    build, which will apply the deterministic compiler option when
    building Erlang/OTP. The deterministic option has been improved
    to eliminate more sources of non-determinism in several
    applications.
  * erts: Fixed inconsistency bugs in global due to nodeup/nodedown
    messages not being delivered before/after traffic over
    connections. Also fixed various other inconsistency bugs and
    deadlocks in both global_group and global. As building blocks
    for these fixes, a new BIF erlang:nodes/2 has been introduced
    and net_kernel:monitor_nodes/2 has been extended. The -hidden
    and -connect_all command line arguments did not work if
    multiple instances were present on the command line which has
    been fixed. The new kernel parameter connect_all has also been
    introduced in order to replace the -connect_all command line
    argument.
  * erts: Fixed IPv6 multicast_if and membership socket options.
  * erts: Accept funs (NEW_FUN_EXT) with incorrectly encoded size
    field. This is a workaround for a bug (OTP-18104) existing in
    OTP 23 and 24 that could cause incorrect size fields in certain
    cases. The emulator does not use the decoded size field, but
    erl_interface still does and is not helped by this workaround.
  * erts: Fixed issue with inet:getifaddrs hanging on pure IPv6
    Windows
  * erts: Fix faulty distribution encoding of terms with either The
    symptom could be failed decoding on the receiving side leading
    to aborted connection. Fix OTP-18093 is a workaround for theses
    bugs that makes the VM accepts such faulty encoded funs. The
    first encoding bug toward pending connection exists only in OTP
    23 and 24, but the second one exists also on OTP 25.
  * erts: Fixed emulator crash that could happen during crashdump
    generation of ETS tables with options ordered_set and
    {write_concurrency,true}.
  * erts: Retrieval of monotonic and system clock resolution on
    MacOS could cause a crash and/or erroneous results.
  * erts: Fix bug where the max allowed size of erl +hmax was lower
    than what was allowed by process_flag.
  * erts: On computers with ARM64 (AArch64) processors, the JIT
    could generate incorrect code when more than 4095 bits were
    skipped at the tail end of a binary match.
  * erts: In rare circumstances, an is_binary/1 guard test could
    succeed when given a large integer.
  * erts: Fix bug causing ets:info (and sometimes ets:whereis) to
    return 'undefined' for an existing table if a concurrent
    process were doing ets:insert with a long list on the same
    table.
  * erts: Fix writing and reading of more than 2 GB in a single
    read/write operation on macOS. Before this fix attempting to
    read/write more than 2GB would result in {error,einval}.
  * erts: Fix bug sometimes causing emulator crash at node shutdown
    when there are pending connections. Only seen when running duel
    distribution protocols, inet_drv and inet_tls_dist.
  * erts: Yield when adjusting large process message queues due to
    The message queue adjustment work will now be interleaved with
    all other types of work that processes have to do, even other
    message queue adjustment work.
  * erts: Add rudimentary debug feature (option) for the inet-
    driver based sockets, such as gen_tcp and gen_udp.
  * erts: Introduced the hidden and dist_listen options to
    net_kernel:start/2. Also documented the -dist_listen command
    line argument which was erroneously documented as a kernel
    parameter and not as a command line argument.
  * erts: New documentation chapter "Debugging NIFs and Port
    Drivers" under Interoperability Tutorial.
  * erts: Add new API function erl_features:configurable/0
  * kernel: Fixed inconsistency bugs in global due to
    nodeup/nodedown messages not being delivered before/after
    traffic over connections. Also fixed various other
    inconsistency bugs and deadlocks in both global_group and
    global. As building blocks for these fixes, a new BIF
    erlang:nodes/2 has been introduced and
    net_kernel:monitor_nodes/2 has been extended. The -hidden and
  - connect_all command line arguments did not work if multiple
    instances were present on the command line which has been
    fixed. The new kernel parameter connect_all has also been
    introduced in order to replace the -connect_all command line
    argument.
  * kernel: Fixed IPv6 multicast_if and membership socket options.
  * kernel: Fixed issue with inet:getifaddrs hanging on pure IPv6
    Windows
  * kernel: The type specifications for inet:getopts/2 and
    inet:setopts/2 have been corrected regarding SCTP options.
  * kernel: The type specifications for inet:parse_* have been
    tightened.
  * kernel: Fix gen_tcp:connect/3 spec to include the inet_backend
    option.
  * kernel: Fix bug where using a binary as the format when calling
    logger:log(Level, Format, Args) (or any other logging function)
    would cause a crash or incorrect logging.
  * kernel: Add rudimentary debug feature (option) for the inet-
    driver based sockets, such as gen_tcp and gen_udp.
  * kernel: Introduced the hidden and dist_listen options to
    net_kernel:start/2. Also documented the -dist_listen command
    line argument which was erroneously documented as a kernel
    parameter and not as a command line argument.
  * kernel: Scope and group monitoring have been introduced in pg.
    For more information see the documentation of
    pg:monitor_scope(), pg:monitor(), and pg:demonitor().
  * kernel: A new function global:disconnect/0 has been introduced
    with which one can cleanly disconnect a node from all other
    nodes in a cluster of global nodes.
  * compiler: The compiler will now forbid using the empty atom ''
    as module name. Also forbidden are modules names containing
    control characters, and module names containing only spaces and
    soft hyphens.
  * compiler: The bin_opt_info and recv_opt_info options would
    cause the compiler to crash when attempting to compile
    generated code without location information.
  * compiler: In rare circumstances involving floating point
    operations, the compiler could terminate with an internal
    consistency check failure.
  * compiler: In rare circumstances when doing arithmetic
    instructions on non-numbers, the compiler could crash.
  * compiler: In rare circumstances, complex boolean expressions in
    nested cases could cause the compiler to crash.
  * compiler: Expression similar to #{assoc:=V} = #key=&gt;self()}, V
    would return the empty map instead of raising an exception.
  * compiler: Eliminated a crash in the beam_ssa_bool pass of the
    compiler when compiling a complex guard expression.
  * compiler: In rare circumstances, the compiler could crash with
    an internal consistency check failure.
  * compiler: When compiling with the option inline_list_funcs, the
    compiler could produce a nonsensical warning.
  * compiler: When given the no_ssa_opt option, the compiler could
    terminate with an internal consistency failure diagnostic when
    compiling map matching.
  * compiler: Made warnings for existing atoms being keywords in
    experimental features more precise, by not warning about quoted
    atoms.
  * compiler: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * megaco: Fixed various dialyzer related issues in the examples
    and the application proper.
  * megaco: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * common_test: Fix cth_surefire to handle when a suite is not
    compiled with debug_info. This bug has been present since
    Erlang/OTP 25.0.
  * common_test: Common Test now preserves stack traces for throws.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1669291200">- Changes for 25.1.2:
  * mnesia: Don't fill the logs if mnesia can't connect to all
    nodes, due to partitioned network.
  * erts: Add abandon carrier free utilization limit (+Muacful)
    option to erts_alloc. This option allows the user to mark
    unused segments in a memory carrier as re-useable by the OS if
    needed. This functionality was a non-configurable default
    before Erlang/OTP 25, but removed due to performance issues.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1671364800">- Changes for 25.2:
  * erts: Fix perf/gdb JIT symbols to not contain CodeInfoPrologue
    for the JIT internal module erts_beamasm.
  * erts: Fixed minor memory leaks.
  * erts: Fix bugs in ets:insert and ets:insert_new when called
    with a list of tuples to insert while a concurrent process
    either deletes or renames the table. The table deletion could
    be done with ets:delete/1 or be caused by termination of the
    table owning process. Symptoms are either VM crash or strange
    incorrect behavior from the insert operation. The risk of
    triggering the bugs increases with the length of the list of
    tuple to insert. Bugs exist since OTP 23.0.
  * erts: Boost execution of scheduled thread progress jobs. This
    to prevent memory exhaustion in extremely rapid
    allocation/deallocation scenarios, such as repeated ETS table
    creations/deletions.
  * erts: Fix segv crash during crash dumping an ETS table doing
    ets:delete_all_objects.
  * erts: Spec for function net:if_names/0 incorrect
  * erts: Fix bug in binary_to_term decoding a binary term 2Gbyte
    or larger.
  * erts: Documentation of erlang:module_loaded/1 has been
    adjusted:
  * erts: Fix list_to_atom/1 for negative code points. Could either
    return with a positive code point or fail with an incorrect
    exception.
  * erts: Fix rare bug causing VM crash when sending to a pid of a
    spawning process returned from erlang:processes/0. Only seen
    when provoked by system process literal_area_collector,
    triggered by a module purge operation, on a VM started with
    +Meamin (no customized allocators).
  * erts: gen_udp:open/2 with option(s) add_membership or
    drop_membership would drop earlier options.
  * erts: The inet:setopts/2 {reuseaddr, true} option will now be
    ignored on Windows unless the socket is an UDP socket. For more
    information see the documentation of the reuseaddr option part
    of the documentation of inet:setopts/2. Prior to OTP 25 the
    {reuseaddr, true} option was ignored for all sockets on
    Windows, but as of OTP 25.0 this was changed so that it was not
    ignored for any sockets. *** POTENTIAL INCOMPATIBILITY ***
  * erts: Fix bug in binary_to_term decoding a list of length 1G or
    longer.
  * erts: Fix bug in binary_to_term (and distributed receive) when
    decoding a large map (&gt;32 keys) with unsorted small maps (&lt;=
    32) as keys of the large map. This was only a problem if the
    term was encoded by erl_interface, jinterface or otherwise, as
    the VM itself always encodes small maps with sorted keys. The
    "binary_to_term" would appear as successful but the created
    large map was internally inconsistent. The smaller key-maps
    could not be found with maps:get and friends. Other operations
    such as map compare and merge could probably also give
    incorrect results.
  * erts: Fix Windows bug in open_port({spawn, Command}, ..) when
    Command is found via the OS search PATH and that directory path
    contains white spaces. The port program would start but the
    command line arguments to it could be incorrect.
  * ftp: fix unexpected result ok when calling ftp:nlist repeatedly
  * inets: This change allows body requests to httpc:request/5 be
    an iolist()
  * inets: addition of type specs in httpc.erl
  * inets: httpc: Add support for HTTP 308 status code
  * dialyzer: Dialyzer would crash when attempting to analyze a bit
    syntax segment size having an literal non-integer size such as
    [].
  * dialyzer: Dialyzer could crash when trying to analyze a
    convoluted nested expression involving funs,
  * kernel: Fixed shutdown crash in gen_tcp socket backend, when
    the other end closed the socket.
  * kernel: erl_tar can now read gzip-compressed tar files that are
    padded. There is a new option compressed_one for file:open/2
    that will read a single member from a gzip file,
  * kernel: Fix os:cmd to not translate all exceptions thrown to
    badarg. For example emfile from erlang:open_port was translated
    to badarg. This bug has existed since Erlang/OTP 24.
  * kernel: Spec for function net:if_names/0 incorrect
  * kernel: Missing ctrl option name transation for TOS and TTL (on
    FreeBSD) when using gen_udp with the 'socket' inet_backend.
  * kernel: gen_udp:open/2 with option(s) add_membership or
    drop_membership would drop earlier options.
  * kernel: The inet:setopts/2 {reuseaddr, true} option will now be
    ignored on Windows unless the socket is an UDP socket. For more
    information see the documentation of the reuseaddr option part
    of the documentation of inet:setopts/2. Prior to OTP 25 the
    {reuseaddr, true} option was ignored for all sockets on
    Windows, but as of OTP 25.0 this was changed so that it was not
    ignored for any sockets. *** POTENTIAL INCOMPATIBILITY ***
  * kernel: The distribution socket option handling in
    inet_tcp_dist has been cleaned up to clarify which were
    mandatory and which just had default values.
  * kernel: Improve warning message format for gen_tcp_socket.
  * snmp: Explicitly close the socket(s) when terminating
    (default-) net-if process.
  * stdlib: erl_tar can now read gzip-compressed tar files that are
    padded. There is a new option compressed_one for file:open/2
    that will read a single member from a gzip file,
  * stdlib: A concurrent call to ets:rename could cause
    ets:delete_all_objects to fail halfway through with badarg.
  * stdlib: It is not allowed to call functions from guards. The
    compiler failed to reject a call in a guard when done by
    constructing a record with a default initialization expression
    that called a function.
  * stdlib: The compiler could crash when using a record with
    complex field initialization expression as a filter in a list
    comprehension.
  * stdlib: unicode:characters_to_binary() could build
    unnecessarily large call stack.
  * stdlib: Improve error message for ets:new/2 name clash. Say
    "name already exists" instead of less specific "invalid
    options".
  * mnesia: Fixed crash which could happen during startup if too
    many decisions where sent from remote nodes.
  * os_mon: The disk_space_check_interval configuration parameter
    of disksup can now be set to values smaller than a minute.
  * ssh: graceful shutdown of ssh_conection_handler when connection
    is closed by peer
  * common_test: Fix starting of peer nodes on old releases when
    the compile server was active and the current Erlang
    installation contained non-latin1 characters in its path.
  * public_key: Disregard LDAP URIs when HTTP URIs are expected.
  * ssl: With this change, tls_sender process is hibernated after
    sufficient inactivity.
  * ssl: Correct handling of legacy schemes so that ECDSA certs
    using sha1 may be used for some TLS-1.3 configurations.
  * ssl: With this change, tls_sender does not cause logger crash
    upon key update.
  * ssl: Enhance warning message
  * ssl: Provide server option to make certificate_authorities
    extension in the TLS-1.3 servers certificate request optional.
    This will allow clients to send incomplete chains that may be
    reconstructable and thereby verifiable by the server, but that
    would not adhere to the certificate_authorities extension.
  * ssl: If the verify_fun handles four arguments the DER cert will
    be supplied as one of the arguments.
  * megaco: A very minor improvement to the measurement tool.
  * observer: A WX event race could causes a crash in when handling
    socket or port info.
  * observer: Improve the nodes menu to include more nodes.
  * compiler: Line number in compiler messages would be truncated
    to 4 digits for line numbers greater than 9999.
  * compiler: In rare circumstance, matching a binary as part of a
    receive clause could cause the compiler to terminate because of
    an internal consistency check failure.
  * compiler: Compiling a function with complex bit syntax matching
    such as f(&lt;&lt;X:0, _:X&gt;&gt;, &lt;&lt;Y:0, _:Y&gt;&gt;) -&gt; ok. could crash the
    compiler.
  * compiler: It is not allowed to call functions from guards. The
    compiler failed to reject a call in a guard when done by
    constructing a record with a default initialization expression
    that called a function.
  * compiler: The compiler could crash when using a record with
    complex field initialization expression as a filter in a list
    comprehension.
  * wx: Added environment variable WX_MACOS_NON_GUI_APP to allow
    user to override OSXIsGUIApplication behavior.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1679745600">- Changes for 25.3:
  * reltool: Fixed a bug that would cause analysis to crash.
  * stdlib: Fixed a bug that would cause analysis to crash.
  * stdlib: Fixed a crash when formatting stack traces for error
    reports.
  * stdlib: Instead of crashing, the list_to_integer/1 and
    list_to_integer/2 BIFs now raise the system_limit exception for
    overlong lists that can't be converted to integers. Similarly,
    the string:to_integer/1 BIF now returns {error,system_limit}
    for overlong lists.
  * stdlib: Removal of non-necessary undefined types added to the
    state's supervisor record.
  * compiler: Fixed a bug that would cause the compiler to hang.
  * compiler: Fixed a crash when compiling code that contained
    maybe expressions.
  * compiler: Constructing a binary with an explicit size of all
    for a binary segment would crash the compiler.
  * compiler: The compiler would generate incorrect code for the
    following type of expression: Pattern = BoundVar1 = . . . =
    BoundVarN = Expression An exception should be raised if any of
    the bound variables have different values than Expression. The
    compiler would generate code that would cause the bound
    variables to be bound to the value of Expressionwhether the
    value matched or not.
  * xmerl: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * megaco: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * debugger: Fixed a bug that would cause analysis to crash.
  * erts: Fixed a bug on Windows where file:read_file_info/1 would
    fail for files with corrupt metadata.
  * erts: Fix process_info(_, binary) to again include "writable
    binaries" which were lost in OTP-25.0. Writable binaries are an
    optimization used when binaries are appended upon in a loop.
  * erts: Fix rare race when receiving fragmented messages on a
    terminating connection. Could potentially cause memory leaks as
    well as double free crashes. Bug exists since OTP 22.0.
  * erts: Fixed bug that could maybe cause problems when a file
    descriptor number is closed by a linked in driver and then
    opened (reused) and passed to enif_select by a NIF. No actual
    symptoms seen, only failed internal assertions in debug build.
  * erts: The runtime system could crash when tracing a process
    executing on a dirty scheduler.
  * erts: In the binary syntax, attempting to match out integers
    with size exceeding 2 GiB could crash the runtime system.
  * erts: Fixed edge case in floating-point negation where A = 0.0,
    B = -A did not produce B = -0.0 on x86_64 JIT.
  * erts: Fixed an issue in the JIT that could crash the emulator
    on some platforms.
  * erts: Added meta data to the windows installer.
  * erts: Fixed ETS insertion order into bag and duplicate_bag of
    tuples with identical keys when passed in a list to
    ets:insert/2. The insert order has been head-to-tail but was
    accidentally changed in OTP 23.0. For bag it was reverted
    (tail-to-head), while for duplicate_bag it was sometimes
    reverted depending on the length of the list and number of
    "reductions" left for the calling process. This fix changes the
    insert order of ets:insert/2 back to always be head-to-tail of
    the list argument.
  * erts: With the JIT for AArch64 (AMD64), calling bxor in with
    non-integer arguments in a guard would crash the runtime
    system.
  * erts: Fix bug regarding process flag max_heap_size. Could cause
    strange behavior when a process was killed due to exceeding the
    limit.
  * erts: Fixed binary comprehensions to be similar to other
    creation of binary data with respect to its contribution of
    triggering garbage collection.
  * erts: In rare circumstances, when a process exceeded its
    allowed heap size set by option max_heap_size, it would not be
    killed as it should be, but instead enter a kind of zombie
    state it would never get out of.
  * erts: Instead of crashing, the list_to_integer/1 and
    list_to_integer/2 BIFs now raise the system_limit exception for
    overlong lists that can't be converted to integers. Similarly,
    the string:to_integer/1 BIF now returns {error,system_limit}
    for overlong lists.
  * erts: Active process aliases of a process at its termination
    leaked memory.
  * erts: Support for fully asynchronous distributed signaling
    where send operations never block. This functionality is by
    default disabled and can be enabled per process. For more
    information see the documentation of process_flag(async_dist,
    Bool).
  * erts: Added the +JPperf no_fp option to explicitly disable
    Erlang frame pointers otherwise added when using the +JPperf
    map option.
  * erl_interface: Accept connection setup from OTP 23 and 24 nodes
    that are not using epmd.
  * erl_interface: The ei API for decoding/encoding terms is not
    fully 64-bit compatible since terms that have a representation
    on the external term format larger than 2 GB cannot be handled.
  * syntax_tools: erl_syntax_lib:annotate_bindings/1,2 will now
    properly annotate named functions and their arguments.
  * kernel: Fixed a bug on Windows where file:read_file_info/1
    would fail for files with corrupt metadata.
  * kernel: Accept connection setup from OTP 23 and 24 nodes that
    are not using epmd.
  * public_key: As different solutions of verifying certificate
    revocation exists move the decode of 'CRLDistributionPoints' so
    that it will only be decode. When it is actually used in the
    verification process. This would enable interoperability with
    systems that use certificates with an invalid empty
    CRLDistributionPoints extension that they want to ignore and
    make verification by other means.
  * public_key: public_key:pkix_path_validation validates
    certificates expiring after 2050
  * public_key: Do not leave exit message in message queue after
    calling cacerts_load() on MacOS.
  * public_key: Replace size/1 with either tuple_size/1 or
    byte_size/1 The size/1 BIF is not optimized by the JIT, and its
    use can result in worse types for Dialyzer. When one knows that
    the value being tested must be a tuple, tuple_size/1 should
    always be preferred. When one knows that the value being tested
    must be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * ssl: Fixed that new dtls connections from the same client ip
    port combination works. If there is a process waiting for
    accept the new connection will connect to that, otherwise it
    will try to re-connect to the old server connection.
  * ssl: When shutting down a node that uses SSL distribution
    (-proto_dist inet_tls), a confusing error message about an
    unexpected process exit was printed. This particular message is
    no longer generated.
  * ssl: fixes the type spec for ssl:format_error/1
  * ssl: Replace size/1 with either tuple_size/1 or byte_size/1 The
    size/1 BIF is not optimized by the JIT, and its use can result
    in worse types for Dialyzer. When one knows that the value
    being tested must be a tuple, tuple_size/1 should always be
    preferred. When one knows that the value being tested must be a
    binary, byte_size/1 should be preferred. However, byte_size/1
    also accepts a bitstring (rounding up size to a whole number of
    bytes), so one must make sure that the call to byte_size/ is
    preceded by a call to is_binary/1 to ensure that bitstrings are
    rejected. Note that the compiler removes redundant calls to
    is_binary/1, so if one is not sure whether previous code had
    made sure that the argument is a binary, it does not harm to
    add an is_binary/1 test immediately before the call to
    byte_size/1.
  * jinterface: Accept connection setup from OTP 23 and 24 nodes
    that are not using epmd.
  * os_mon: The port programs used by cpu_sup and memsup are now
    gracefully shut down when cpu_sup and memsup are shut down.
  * eunit: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * crypto: A user defined runtime library path configured using
  - -with-ssl-rpath=&lt;PATHS&gt; could fail to be enabled.
  * crypto: Ensure that configure fails if a user defined runtime
    library path has been passed by the user, but cannot set.
  * mnesia: Improved consistency for dirty writes when a table was
    added with add_table_copy/3. Fixed a problem with sticky write,
    which could lead to inconsistent data.
  * mnesia: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * common_test: Renamed undocumented macro CT_PEER/3 to
    CT_PEER_REL/3.
  * ssh: With this change, PKCS8 formatted private key file is
    properly decoded and SSH daemon with such key can be started.
  * ssh: Replace size/1 with either tuple_size/1 or byte_size/1 The
    size/1 BIF is not optimized by the JIT, and its use can result
    in worse types for Dialyzer. When one knows that the value
    being tested must be a tuple, tuple_size/1 should always be
    preferred. When one knows that the value being tested must be a
    binary, byte_size/1 should be preferred. However, byte_size/1
    also accepts a bitstring (rounding up size to a whole number of
    bytes), so one must make sure that the call to byte_size/ is
    preceded by a call to is_binary/1 to ensure that bitstrings are
    rejected. Note that the compiler removes redundant calls to
    is_binary/1, so if one is not sure whether previous code had
    made sure that the argument is a binary, it does not harm to
    add an is_binary/1 test immediately before the call to
    byte_size/1.
  * inets: With this change, handling of URI to a folder, with
    missing trailing / and a query component present is fixed.
  * inets: Adds more type information to the inets app, thus
    improving the errors that static analysis tools can detect. The
    addition of type information to records and the updates to
    function heads help static analysis tools to understand that
    some values in the records cannot be 'undefined', thus making
    static tools to type check correctly more modules in the inets
    app
  * inets: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * snmp: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * ftp: Replace size/1 with either tuple_size/1 or byte_size/1 The
    size/1 BIF is not optimized by the JIT, and its use can result
    in worse types for Dialyzer. When one knows that the value
    being tested must be a tuple, tuple_size/1 should always be
    preferred. When one knows that the value being tested must be a
    binary, byte_size/1 should be preferred. However, byte_size/1
    also accepts a bitstring (rounding up size to a whole number of
    bytes), so one must make sure that the call to byte_size/ is
    preceded by a call to is_binary/1 to ensure that bitstrings are
    rejected. Note that the compiler removes redundant calls to
    is_binary/1, so if one is not sure whether previous code had
    made sure that the argument is a binary, it does not harm to
    add an is_binary/1 test immediately before the call to
    byte_size/1.
  * dialyzer: Fixed a bug that would cause analysis to crash.
  * dialyzer: Replace size/1 with either tuple_size/1 or
    byte_size/1 The size/1 BIF is not optimized by the JIT, and its
    use can result in worse types for Dialyzer. When one knows that
    the value being tested must be a tuple, tuple_size/1 should
    always be preferred. When one knows that the value being tested
    must be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * tftp: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
- Changes for 25.2.3:
  * erts: Comparisons between small numbers and pids or ports would
    in some edge cases say that the number was greater than the pid
    or port, violating the term order.
  * erts: process_info(Pid, status) when Pid /= self() could return
    an erroneous result.
  * ssl: Maximize compatibility by ignoring change_cipher_spec
    during handshake even if middle_box_mode is not negotiated
    (mandated by client)
  * ssl: Move assert of middlebox message after an
    hello_retry_request to maximize interoperability. Does not
    changes semantics of the protocol only allows unexpected
    message delay from server.
  * ssh: With this change, ssh application does not crash when
    formatting some of info reports for unsuccessful connections.
  * ssh: With this change, ssh does not log extensively long
    messages.
  * inets: Ensure graceful shutdown
  * inets: Return type of the type specification for function
    httpc:cookie_header/{1,2,3} has been fixed from -spec
    cookie_header(url()) -&gt; [{ field(), value() }] | {error,
    Reason} to -spec cookie_header(url()) -&gt; { field(), value() } |
    {error, Reason}
- Changes for 25.2.2:
  * ftp: Fixes calls to ftp:nlist/2 returning {error, epath} when
    the file / folder exists
- Changes for 25.2.1:
  * compiler: Fixed a bug that could cause legal code to fail
    validation.
  * compiler: Eliminated a rare crash in the beam_types module.
  * erts: Fixed a bug in selective receive optimization that could
    crash 32-bit emulators.
  * erts: A race condition which was very rarely triggered could
    cause the signal queue of a process to become inconsistent
    causing the runtime system to crash.
  * kernel: The tcp connect option 'bind_to_device' could not be
    used with inet_backend = 'socket'. 'inet' requires value type
    binarry() and 'socket' requires value type 'string()'.
  * kernel: Minor issue processing options when calling
    gen_tcp:connect with a sockaddr() and inet_backend = socket.
  * common_test: Change timeout to infinity for gen_server calls in
    cth_log_redirect
  * inets: fixes a missing case of the type specification for
    httpd:info/2/3/4
  * snmp: Single threaded agent crash when vacm table not properly
    initiated.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1683460800">- Changes for 25.3.2:
  * compiler: Fixed type handling bugs that could cause an internal
    error in the compiler for correct code.
  * os_mon: Avoid error report from failing erlang:port_close at
    shutdown of cpu_sup and memsup. Bug exists since OTP 25.3
    (os_mon-2.8.1).
  * erts: If a runtime system which was starting the distribution
    already had existing pids, ports, or references referring to a
    node with the same nodename/creation pair that the runtime
    system was about to use, these already existing pids, ports, or
    references would not work as expected in various situations
    after the node had gone alive. This could only occur if the
    runtime system was communicated such pids, ports, or references
    prior to the distribution was started. That is, it was
    extremely unlikely to happen unless the distribution was
    started dynamically and was even then very unlikely to happen.
    The runtime system now checks for already existing pids, ports,
    and references with the same nodename/creation pair that it is
    about to use. If such are found another creation will be chosen
    in order to avoid these issues.
- Changes for 25.3.1:
  * snmp: Attempts to minimize the number of the error reports
    during a failed agent init.
  * compiler: When a map update such as #{}#{key:=value} that
    should fail with an exception was unused, the exception would
    be lost.
  * compiler: Fixed bug in the validator that made it reject valid
    code.
  * crypto: With this change, random errors are fixed for
    crypto:generate_key calls with OpenSSL 3.
  * erts: Fixed a bug in the loader that prevented certain modules
    compiled with no_ssa_opt from being loaded.
  * erts: Implementations of the call() driver callback that
    returned a faulty encoded result could cause a memory leak and
    could cause invalid data on the heap of the processes calling
    erlang:port_call/3.
  * erts: Fixed a memory corruption issue when upgrading code. The
    bug was introduced in OTP 25.3
  * erts: Fixed configure tests for a few ARM-specific
    instructions, which prevented the emulator from being built on
    some platforms.
  * erts: Aliases created in combination with a monitor using the
    {alias, explicit_unalias} option stopped working from remote
    nodes when a 'DOWN' signal had been received due to the monitor
    or if the monitor was removed using the erlang:demonitor() BIF.
    This bug was introduced in OTP 24.3.4.10 and OTP 25.3.
  * erts: In rare circumstances, bit syntax matching of an invalid
    code point for a utf32 would crash the runtime system.
  * erts: Building the runtime system failed when native atomic
    support was missing. Note that execution on such systems have
    only been rudimentary tested.
  * erl_interface: Fixed configure tests for a few ARM-specific
    instructions, which prevented the emulator from being built on
    some platforms.
  * eldap: Added a new function eldap:info/1 that returns the
    socket and the transport protocol for the eldap connection.
  * inets: Correct timing related pipelining/keepalive queue bug,
    that could result in unexpected "socket_remotly_closed" errors.
  * inets: With this change, upon remote socket closure current
    request is added to a retried queue (either pipeline or
    keep_alive, but not both).
  * ssl: With this change, ssl:connection_information/2 returns
    correct keylog data after TLS1.3 key update.
  * ssl: Client signature algorithm list input order is now honored
    again , it was accidently reversed by a previous fix.
  * stdlib: The type specs in the erl_parse module has been updated
    to include the maybe construct and the ! operator.
  * wx: Improve debug prints from the nifs. Some minor fixes for
    wxWidgets-3.2. Fixed OpenGL debug functions.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1687521600">- Changes for 25.3.2.2:
  * compiler: The compiler could be very slow when compiling guards
    with multiple guard tests separated with 'or' or ';'.
- Changes for 25.3.2.1:
  * xmerl: New options to xmerl_scan and xmerl_sax_parser so one
    can limit the behaviour of the parsers to avoid some XML
    security issues. xmerl_scan gets one new option:
    xmerl_sax_parser gets the following options: The old option
    skip_external_dtd is still valid and the same as
    {external_entities, none} and {fail_undeclared_ref, false} but
    just affects DTD's and not other external references.
  * erts: Fixed a crash during tracing on certain platforms that
    cannot use the machine stack for Erlang code (mainly OpenBSD
    and Linux with musl).
  * erts: Constructing a binary segment not aligned with a byte
    boundary, with a size not fitting in 31 bits, and with a value
    not fitting in a 64-bit word could crash the runtime system.
  * erts: Further robustify implementation of large maps (&gt; 32
    keys). Keys that happen to have same internal 32-bit hash
    values are now put in collision nodes which are traversed with
    linear search. This removes the demand for the internal hash
    function when salted to eventually produce different hashes for
    all possible pairs of unequal terms.
  * stdlib: Static supervisors are very idle processes after they
    have started so they will now be hibernated after start to
    improve resource management.
  * compiler: Fixed a bug where a failing bsl expression in a guard
    threw an exception instead of causing the guard to fail.
  * compiler: Complex guard expression using the or operator and
    guard BIFs that can fail could sometimes be miscompiled so that
    the guard would succeed even if a call to a guard BIF failed.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1687608000">- Version 26.0:
  * Leex has been extended with optional column number support.
  * The family of enumeration functions in module lists has been
    extended with enumerate/3 that allows a step value to be
    supplied.
  * Update Unicode to version 15.0.0.
  * proc_lib:start*/* has become synchronous when the started
    process fails. This requires that a failing process use a new
    function proc_lib:init_fail/2,3, or exits, to indicate failure. All
    OTP behaviours have been fixed to do this.
  * auto-complete of variables, record names, record fields names,
    map keys, function parameter types and filenames.
  * Open external editor in the shell to edit the current
    expression.
  * defining records (with types), functions, specs and types in
    the shell.
  * Creation and matching of binaries with segments of fixed sizes
    have been optimized.
  * Creation and matching of UTF-8 segments have been optimized.
  * Appending to binaries has been optimized.
  * The compiler and JIT now generate better code for creation of
    small maps where all keys are literals known at compile time.
  * Thanks to the optimizations above the performance of the base64
    module has been significantly improved. For example, on an
    x86_64 system with the JIT both encode and decode are almost
    three times faster than in Erlang/OTP 25.
  * Map comprehensions as suggested in EEP 58 has now been
    implemented.
  * Some map operations have been optimized by changing the
    internal sort order of atom keys. This changes the
    (undocumented) order of how atom keys in small maps are printed
    and returned by maps:to_list/1 and maps:next/1. The new order
    is unpredictable and may change between different invocations
    of the Erlang VM.
  * Introducing the new function maps:iterator/2 for creating an
    interator that return the map elements in a deterministic
    order. There are also new modifiers k and K for the format
    string in io:format() to support printing map elements ordered.
  * Added the new built-in type dynamic() introduced in EEP 61, PR
    introducing EEP 61 improving support for gradual type checkers.
  * Dialyzer has a new incremental mode that be invoked by giving
    the --incremental option when running Dialyzer. This new
    incremental mode is likely to become the default in a future
    release.
  * Multi time warp mode is now enabled by default. This assumes
    that all code executing on the system is time warp safe.
  * Support for UTF-8 atoms and strings in the NIF interface
    including new functions enif_make_new_atom,
    enif_make_new_atom_len and enif_get_string_length.
  * The BIFs min/2 and max/2 are now allowed to be used in guards
    and match specs.
  * Improved the selective receive optimization, which can now be
    enabled for references returned from other functions. This
    greatly improves the performance of gen_server:send_request/3,
    gen_server:wait_response/2, and similar functions.
  * It is no longer necessary to enable a feature in the runtime
    system in order to load modules that are using it. It is
    sufficient to enable the feature in the compiler when compiling
    it.
  * inet:setopts/2 has got 3 new options: reuseport, reuseport_lb
    and exclusiveaddruse.
  * Fix so that -fno-omit-frame-pointer is applied to all of the
    Erlang VM when using the JIT so that tools, such as perf, can
    crawl the process stacks.
  * In the lists module, the zip family of functions now takes
    options to allow handling lists of different lengths.
  * Added the zip:zip_get_crc32/2 function to retrieve the CRC32
    checksum from an opened ZIP archive. gen_server optimized by
    caching callback functions
  * The modules Erlang DNS resolver inet_res and helper modules
    have been updated for RFC6891; to handle OPT RR with DNSSEC OK
    (DO) bit.
  * Introduced application:get_supervisor/1.
  * Cache OTP boot code paths, to limit how many folders that are
    being accessed during a module lookup. Can be disabled with
  - cache_boot_path false.
  * Support for Kernel TLS (kTLS), has been added to the SSL
    application, for TLS distribution (-proto_dist inet_tls), the
    SSL option {ktls, true}.
  * Improved error checking and handling of ssl options.
  * Mitigate memory usage from large certificate chains by lowering
    the maximum handshake size. This should not effect the common
    cases, if needed it can be configured to a higher value.
  * For security reasons the SHA1 and DSA algorithms are no longer
    among the default values.
  * Add encoding and decoding of use_srtp hello extension to
    facilitate for DTLS users to implement SRTP functionality.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1687608001">- Changes for 26.0.1:
  * erts: Build of the socket nif failed on Solaris 11.
  * erts: Fixed two reduction-counting bugs relating to binaries.
  * erts: Constructing a binary segment not aligned with a byte
    boundary, with a size not fitting in 31 bits, and with a value
    not fitting in a 64-bit word could crash the runtime system.
  * erts: When a binary construction failed because of bad size for
    a segment, the error information was not always correct.
  * erts: Fixed a crash when calling a fun that was defined in a
    module that had been upgraded.
  * kernel: The POSIX error exdev was sometimes incorrectly
    described as "cross domain link" in some error messages.
  * kernel: Corrected the socket send function description (send
    with Timeout = nowait). The send function(s) could not return
    {ok, {RestData, SelectInfo}}
  * stdlib: The POSIX error exdev was sometimes incorrectly
    described as "cross domain link" in some error messages.
  * ssl: Make sure that selection of client certificates handle
    both TLS-1.3 and TLS-1.2 names correctly. Could cause valid
    client certificate to not be selected, and an empty client
    certificate message to be sent to server.
  * ssl: Improved ssl:format_error/1 to handle more error tuples.
  * ssl: Fixed hanging ssl:connect when ssl application is not
    started.
  * ssl: Correct handling of retransmission timers, current
    behavior could cause unwanted delays.
  * inets: Do not make the default ssl options by calling
    httpc:ssl_verify_host_options(true) if ssl options are supplied
    by the user.
  * xmerl: New options to xmerl_scan and xmerl_sax_parser so one
    can limit the behaviour of the parsers to avoid some XML
    security issues. xmerl_scan gets one new option:
    xmerl_sax_parser gets the following options: The old option
    skip_external_dtd is still valid and the same as
    {external_entities, none} and {fail_undeclared_ref, false} but
    just affects DTD's and not other external references.
  * compiler: Fixed a bug where a failing bsl expression in a guard
    threw an exception instead of causing the guard to fail.
  * compiler: Fixed a bug that would case the validator to reject
    legal code.
  * compiler: The compiler could re-order clauses matching binaries
    so that the incorrect clause would match. That could only
    happen for code that used the option {error_location,line} or
    for code without line or column number information (e.g.
    generated by a parse transform).
  * compiler: Complex guard expression using the or operator and
    guard BIFs that can fail could sometimes be miscompiled so that
    the guard would succeed even if a call to a guard BIF failed.
  * compiler: With optimizations disabled, a try/catch construct
    could return an incorrect value.
  * compiler: In rare circumstance, a combination of binary
    construction and binary_part/3 would cause the compiler to
    generate unsafe code that would crash the runtime system.
  * compiler: The compiler could be very slow when compiling guards
    with multiple guard tests separated with 'or' or ';'.
  * compiler: Complex guard expressions using 'or' and map updates
    could succeed even if the map update failed.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1698235200">- Changes for 26.1.2:
  * erts: If the external term format encoding of an argument list
    part of a distributed spawn operation was faulty, the newly
    spawned remote process could misbehave. The misbehavior
    included hanging or interpret an incoming message as an
    argument list to use. This was very unlikely to happen unless
    using an alternate implementation of the distribution protocol
    which made a faulty encoding of the argument list. The child
    process will now detect this error and terminate before
    executing the user specified code.
  * erts: Fix bugs where if the body of a matchspec would return a
    map with a variable ('$1', '$_' etc) as one of the keys or
    values and the variable was not an immidiate, the term would
    not be copied to the receiving processes heap. This would later
    corrupt the term in the table as the GC could place move
    markers in it, which in turn would cause the VM to crash. Bug
    has been present for since OTP 17.0.
  * xmerl: The xmerl version 1.3.32 was released in OTP 26.0.1, but
    the incorrect version number of 1.3.31.1 was used for it. This
    incorrect version number continued to appear in OTP 26.0.2, OTP
    26.1, and OTP 26.1.1. The actual xmerl code in these OTP
    versions however corresponds to xmerl version 1.3.32.
- Changes for 26.1.1:
  * wx: The wx application would fail to build on macOS with Xcode
    15.
  * compiler: The compiler could become extremely slow for modules
    containing huge functions.
  * stdlib: Garbage collect the shell process when reducing the
    amount of saved history and results.
- Changes for 26.1:
  * crypto: Fix VM crash caused by crypto being purged and reloaded
    (by init:restart for example) on OS with musl libc (such as
    Alpine linux).
  * crypto: Improved understanding of LibreSSL versions. Support
    chacha20 and chacha20_poly1305 for LibreSSL 3.7. Reflect
    removal of support for the DSS/DSA algorithm which was done in
    LibreSSL 2.6.1.
  * crypto: FIPS supported by crypto for OpenSSL 3.0.* and 3.1.*.
  * asn1: The ASN.1 compiler would ignore a constraint such as
    (SIZE (1..4), ...), causing incorrect behavior of the encoding
    and decoding function for the PER and UPER backends. Corrected
    to handle the constraint in the same way as (SIZE (1..4, ...)).
  * asn1: The JER backend has been internally refactored in a way
    that is compatible for applications that use the documented
    API. However, for a group of ASN.1 modules that depend on each
    other (for example, S1AP-PDU-Descriptions, S1AP-Contents, and
    so on), all modules in the group must be recompiled if on of
    the group members is recompiled.
  * observer: Closing the trace log window via the menu did not
    work.
  * erts: maps:put with existing key and identical value was not
    optimized as a no-op correctly if having the same 32-bit hash
    as another key in the map. In practice very rare and harmless.
  * erts: Fixed an issue with truncated crash slogans on failed
    emulator start.
  * erts: Fixed a bug where the emulator was unable to determine
    the current cgroup CPU quota.
  * erts: A process optimized for parallel signal delivery could
    under some circumstances lose wakeup information. That is, the
    processes was not woken up to take care of the signal, so the
    signal would not be taken care of until the process was woken
    by another signal. Only processes configured with
    message_queue_data set to off_heap utilize this optimization.
  * erts: Function socket:close/1 could cause a VM crash on
    Windows.
  * erts: Fixed a bug in the ARM JIT where it could accidentally
    add garbage trailing bits when creating bitstrings whose size
    wasn't an even multiple of 8 bits.
  * erts: Fix erlang:system_info/1 documentation to show correct
    types.
  * erts: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * erts: Fix compilation with GNU termcap.
  * erts: Delivery time of message signals to a process not
    executing any receive expressions could become very long,
    potentially infinite. For example, a process checking for
    messages using process_info(self(), message_queue_len) or
    process_info(self(), messages) and avoiding to execute a
    receive expression matching on messages could be very slow in
    detecting new messages. Note that you are still discouraged
    from using process_info() this way. A process that wants to
    check if there are messages available to handle should execute
    a receive expression matching on messages.
  * erts: On AArch64 (ARM64), when calculating both the quotient
    and remainder with a divisor begin a power two, the remainder
    could be incorrectly calculated.
  * erts: Fix bug causing "magic" references in a compressed ETS
    table to not keep the referred object alive. The symptom would
    be the referred object being garbage collected prematurely and
    the reference appearing stale, not referring to anything.
    Examples of such magically referred objects are atomics and NIF
    resources.
  * erts: Matching out short bitstrings with a fixed size not
    divisible by 8 could could lead to the runtime system
    terminating with an "Overrun heap and stack" error.
  * erts: A constant flow of incoming non-message signals could
    prevent a process needing to execute dirty from doing so.
  * erts: A BEAM file usually contains a chunk with the tag "Type"
    containing type information that can be used by the JIT. The
    beam_lib:strip/1 takes care to preserve that chunk, but a
    build/release tool that does customized stripping could
    accidentally remove the chunk. Loading a BEAM file without the
    "Type" chunk could cause incorrect behavior of the loaded code.
  * erts: gen_udp:recv/* for Unix Domain Socket in binary mode and
    passive mode has been fixed to not crash.
  * erts: The cleanup operation of not yet delivered signals to a
    terminated process yielded excessively.
  * erts: Fixed minor hashing issue with the local option of
    term_to_binary()/term_to_iovec().
  * erts: Update gen_tcp_socket and gen_udp_socket to handle
    'completion' (socket on Windows).
  * erts: Add support for Unix Domain Sockets (only for STREAM
    sockets) on Windows for 'socket'.
  * erts: In Erlang/OTP 27, by default escripts will be compiled
    before being executed. That means that the compiler application
    must be installed. It is possible to force the escript to be
    interpreted by adding the directive -mode(interpret). to the
    escript file. In Erlang/OTP 28, support for interpreting an
    escript will be removed.
  * erts: Add basic support for socket ioctl on Windows.
  * erts: Removed erts/etc/darwin/Info.plist, as it is no longer
    necessary after macos 10.12
  * erts: Add support for (Windows) socket option exclusiveaddruse.
  * erts: [socket] Add support for the 'nopush' option.
  * erts: Add support for socket option 'BSP STATE'.
  * erts: Add tcp socket options 'keepcnt', 'keepidle' and
    'keepintvl'.
  * erts: Add support for misc (Windows) socket options
    ('max_msg_size' and 'maxdg').
  * compiler: The compiler could run forever when compiling a call
    to is_record/3 with a huge positive tuple size. The call
    is_record(A, a, 0) would crash the compiler when used in a
    function body. When used in a guard the compiler would emit
    incorrect code that would accept {a&gt; as a record.
  * compiler: Fixed a bug that caused dialyzer to crash when
    analyzing bogus code that contained the literal atom undefined
    in segment sizes.
  * compiler: The compiler would crash when compiling some modules
    that contained a call to erlang:load_nif/2.
  * compiler: Fixed a bug that caused the compiler to crash on
    legal code.
  * compiler: The compiler could crash when attempting to compile a
    call to is_list/1 in a complex expression.
  * compiler: A complex guard expression using the or operator
    could succeed when it was supposed to fail.
  * compiler: Compiling nested try/catch and catch expression could
    result in an internal compiler error.
  * compiler: Using the bnot operator in a complex expression could
    cause the compiler to terminate with an internal consistency
    failure diagnostic.
  * compiler: Fixed a bug that caused the compiler to crash in a
    binary optimization pass.
  * compiler: The compiler could terminate with an internal error
    when attempting to compile a binary pattern that could not
    possibly match.
  * compiler: Fixed various performance issues related to the alias
    optimization pass.
  * erl_docgen: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * mnesia: Do not delete old backup file if the new backup fails.
  * megaco: Make megaco transports handle gen_tcp | gen_udp with
    socket backend on Windows (completion).
  * common_test: With this change, ct_hooks manual refers to CTH
    execution order section in user guide.
  * common_test: With this change, Config data from
    pre_end_per_testcase hook is delivered to post_end_per_testcase
    callback in case of testcase timetrap or linked process crash.
  * common_test: With this change, remaining references to not
    supported vts tool in ct_run are removed (mainly relates to
    docs and ct_run help message).
  * common_test: With this change, prompt search functionality in
    ct_telnet handles unicode input.
  * common_test: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * stdlib: The compiler could run forever when compiling a call to
    is_record/3 with a huge positive tuple size. The call
    is_record(A, a, 0) would crash the compiler when used in a
    function body. When used in a guard the compiler would emit
    incorrect code that would accept {a&gt; as a record.
  * stdlib: Fix bug in ets:tab2file that could make it fail if
    another Erlang process created the same file at the same time.
  * stdlib: An {else_clause,Value} exception will now be reported
    nicely in the shell.
  * stdlib: Correct return value for error case, so that it matches
    the documented and intended return value {error,
    {already_started, pid()} when local registered names are used.
  * stdlib: sys:get_state/1,2 and sys:replace_state/2,3 has been
    corrected to handle a state named error as a state name, not as
    a failed system callback. For the standard server behaviours
    this was an issue only for gen_statem (and gen_fsm) when the
    state name was error, and for gen_server if the complete state
    was {error,_}.
  * stdlib: Multiple problems were fixed in
    filelib:safe_relative_path/2. If its second argument was a path
    that contained symbolic links, an incorrect result patch could
    be returned. Also, paths were sometimes falsely considered
    unsafe.
  * stdlib: Fix deadlock when erl.exe is used as part of a pipe on
    Windows and trying to set the encoding of the standard_io
    device.
  * stdlib: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * stdlib: Fix h/2,3 to properly render multi-clause
    documentation.
  * stdlib: Timers created by timer:apply_after/4,
    apply_interval/4, and apply_repeatedly/4 would silently fail to
    do the apply if it was not possible to spawn a process when the
    timer expired. This has now been corrected, and if the spawn
    fails, the system will be taken down producing a crash dump.
  * stdlib: When an Erlang source file lacked a module definition,
    there would be a spurious "module name must not be empty"
    diagnostic for each spec in the file.
  * stdlib: The argument descriptions for option types in argparse
    have been made less ambiguous.
  * stdlib: Clarified the documentation of normal shutdown reason
    on gen_server:call/2,3
  * stdlib: Pattern matching and equivalence (=:=, =/=) comparisons
    on 0.0 will now raise a warning, as it will no longer be
    considered equivalent to -0.0 in OTP 27. If a match on 0.0
    specifically is desired (distinct from -0.0), the warning can
    be suppressed by writing +0.0 instead. The arithmetic
    comparison operators are unaffected, including arithmetic
    equality (==). *** POTENTIAL INCOMPATIBILITY ***
  * stdlib: The semantics of the gen_{server,statem,event}
    behaviour's synchronous start behaviour introduced in OTP-26.0
    with OTP-18471, has been clarified in the documentation.
  * stdlib: Added functionality to set a custom multiline prompt.
  * stdlib: A warning for (accidental use of) Triple-Quoted Strings
    has been implemented as per EEP 64. *** POTENTIAL
    INCOMPATIBILITY ***
  * stdlib: The keyboard shortcuts for the shell are now
    configurable.
  * kernel: Fixed an issue with truncated crash slogans on failed
    emulator start.
  * kernel: Fix shell:start_interactive function specification.
  * kernel: Fix code:get_doc/1 to return missing, when it can't
    find erts instead of crashing.
  * kernel: Function socket:close/1 could cause a VM crash on
    Windows.
  * kernel: Fix deadlock when erl.exe is used as part of a pipe on
    Windows and trying to set the encoding of the standard_io
    device.
  * kernel: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * kernel: Fix logger's overload protection mechanism to only
    fetch memory used by messages when needed.
  * kernel: Fixed a number of socket-related issues causing
    incompatibilities with gen_tcp and gen_udp respectively.
  * kernel: gen_tcp:connect with socket address and socket (inet-)
    backend fails because of missing callback function.
  * kernel: The DNS RR cache used by `inet_res` has been fixed to
    preserve insert order, which is beneficial when the DNS server
    returns RRs in some specific order for e.g load balancing
    purposes.
  * kernel: The options `reuseport`, `reuseport_lb` and
    `exclusiveaddruse` were accidentally not allowed for e.g
    `gen_udp:open/1,2`, which has now been corrected.
  * kernel: gen_udp:recv/* for Unix Domain Socket in binary mode
    and passive mode has been fixed to not crash.
  * kernel: Fixed issue where cursor would not be placed at the end
    of the expression when navigating shell history.
  * kernel: Update gen_tcp_socket and gen_udp_socket to handle
    'completion' (socket on Windows).
  * kernel: Add support for Unix Domain Sockets (only for STREAM
    sockets) on Windows for 'socket'.
  * kernel: Add basic support for socket ioctl on Windows.
  * kernel: The file:location/0 type is now exported.
  * kernel: Add support for (Windows) socket option
    exclusiveaddruse.
  * kernel: [socket] Add support for the 'nopush' option.
  * kernel: Add support for socket option 'BSP STATE'.
  * kernel: Add tcp socket options 'keepcnt', 'keepidle' and
    'keepintvl'.
  * kernel: Add support for misc (Windows) socket options
    ('max_msg_size' and 'maxdg').
  * kernel: The keyboard shortcuts for the shell are now
    configurable.
  * kernel: Optimized code_server to reduce repeated work when
    loading the same module concurrently.
  * debugger: The call int:no_break(Module) did not remove any
    breakpoints.
  * debugger: The maybe expression is now supported in the
    Debugger.
  * debugger: The maybe expression is now supported in the
    Debugger.
  * debugger: The call int:no_break(Module) did not remove any
    breakpoints.
  * ssl: Avoid function clause error in ssl:getopts/2 by handling
    that inet:getopts may return an empty list during some
    circumstances, such as the socket being in a closing state.
  * ssl: The API function `ssl:recv/3` has been tightened to
    disallow negative length, which has never been documented to
    work, but was passed through and caused strange errors.
  * ssl: When a client initiated renegotiation was rejected and the
    client socket was in active mode the expected error message to
    the controlling process was not sent.
  * ssl: Add some guidance for signature algorithms configuration
    in ssl applications users guide.
  * snmp: Make snmp handle gen_udp with socket backend on Windows
    (completion).
  * public_key: Country name comparison shall be case insensitive
  * public_key: Add check to disallow duplicate certs in a path
  * inets: With this change, re_write httpd works as expected and
    does not return error.
  * inets: Fixed a bug so httpd does not crash when stopped at the
    wrong time during TLS connection negotiation, or any other
    theoretically as slow connection setup.
  * inets: Enhance error handling and avoid that the HTTP client
    hangs on headers provided on the wrong format.
  * inets: With this change, error report generated by httpd during
    connection setup contains socket type information.
  * inets: Stop and restart of the httpd server in the Inets
    application has been refactored to a more synchronous and OTP
    supervisor friendly approach. This should increase stability
    and for example avoid a supervisor report from
    httpd_connection_sup about killed child process(es) in some
    cases when stopping or restarting httpd.
  * dialyzer: Fixed a bug that caused dialyzer to crash when
    analyzing bogus code that contained the literal atom undefined
    in segment sizes.
  * dialyzer: Dialyzer could crash when attempting to analyze a
    module that defined a type called product/.
- Changes for 26.0.2:
  * erts: Fix using the IME (Input Method Editor) to enter text in
    cmd.exe and powershell.exe on Windows.
  * erts: Multiple socket:accept calls issue. When making multiple
    accept calls, only the last call is active.
  * erts: Fix the shell to ignore terminal delay when the terminal
    capabilities report that they should be used.
  * erts: Fix "oldshell" to echo characters while typing on
    Windows.
  * erts: On Windows, a call to the function socket:close, when
    there are waiting active calls to read, write or accept
    functions, could hang.
  * erts: Fix issues when reading or configuring standard_io on
    Windows when erl.exe is started using -noshell flag.
  * erts: The following functions are now much faster when given a
    long list or binary:
  * erts: On AArch64 (ARM64), equality and non-equality tests with
    literal bitstrings could succeed when they should fail and vice
    versa.
  * compiler: Fixed a type handling bug that would cause an
    internal consistence failure for correct code.
  * compiler: Fixed a bug that could cause the stack trace of throw
    exceptions to be erroneously optimized out.
  * compiler: Complex guard expression using 'or' were not always
    fully evaluated, making guards that were supposed to fail
    succeed.
  * stdlib: Fix bug where when you entered Alt+Enter in the
    terminal, the cursor would move to the last line, instead of
    moving to the next line.
  * stdlib: Fix eof handling when reading from stdin when erlang is
    started using -noshell.
  * stdlib: Fixed problem where output would disappear if it was
    received after a prompt was written in the shell.
  * stdlib: The following functions are now much faster when given
    a long list or binary:
  * kernel: Fix bug where when you entered Alt+Enter in the
    terminal, the cursor would move to the last line, instead of
    moving to the next line.
  * kernel: Fix so that the shell does not crash on startup when
    termcap is not available.
  * kernel: Multiple socket:accept calls issue. When making
    multiple accept calls, only the last call is active.
  * kernel: Fix the shell to ignore terminal delay when the
    terminal capabilities report that they should be used.
  * kernel: Fix "oldshell" to echo characters while typing on
    Windows.
  * kernel: Fix eof handling when reading from stdin when erlang is
    started using -noshell.
  * kernel: On Windows, a call to the function socket:close, when
    there are waiting active calls to read, write or accept
    functions, could hang.
  * kernel: Fix issues when reading or configuring standard_io on
    Windows when erl.exe is started using -noshell flag.
  * kernel: gen_udp:connect with inet_backend = socket fails when
    the Address is a hostname (string or atom).
  * kernel: Fixed problem which would cause shell to crash if
    particular escape sequence was written to stdout.
  * kernel: Fixed problem where output would disappear if it was
    received after a prompt was written in the shell.
  * kernel: Fix a crash where the location of erts could not be
    found in rebar3 dev builds.
  * kernel: Introduce the KERNEL application parameter
    standard_io_encoding that can be used to set the default
    encoding for standard_io. This option needs to be set to latin1
    if the application wants to treat all input data as bytes
    rather than utf-8 encoded characters.
  * ssl: Added keylog information to all protocol versions in
    ssl:connection_information/2.
  * ssl: Add RFC-6083 considerations for DTLS to enable gen_sctp
    based callback for the transport.
  * ssh: Added multiline editing support to ssh clients connected
    through OTP ssh daemon.</changelog>
  <changelog author="sflees@suse.de" date="1704974400">- Changes for 26.2.1:
  * erts: Removed unnecessary PCRE source tar-ball.
  * ssh: With this change (being response to CVE-2023-48795),
    ssh can negotiate "strict KEX" OpenSSH extension with
    peers supporting it; also
    'chacha20-poly1305@openssh.com' algorithm becomes a
    less preferred cipher.
    If strict KEX availability cannot be ensured on both
    connection sides, affected encryption modes(CHACHA and
    CBC) can be disabled with standard ssh configuration.
    This will provide protection against vulnerability, but
    at a cost of affecting interoperability. See
    Configuring algorithms in SSH. (bsc#1218192, CVE-2023-48795)
- Changes for 26.2:
  * all: Replaced unintentional Erlang Public License 1.1
    headers in some files with the intended Apache License
    2.0 header.
  * otp: The removal of the deprecated slave module, originally
    planned for OTP 27, has been postponed to OTP 29.
  * asn1: Fix benign warning from gcc 11 about mismatching call
    to free().
  * crypto: Enable engine support for OpenSSL versions 3.
  * edoc: Emit &lt;code&gt; instead of &lt;tt&gt;.
- Disable test suite for now, it has many false positives and
  takes a very long time.</changelog>
  <changelog author="sflees@suse.de" date="1706011200">- This codestream wasn't affected by bsc#1207113</changelog>
  <changelog author="sflees@suse.de" date="1706011201">- Disable rpmlint tests on SLE-15 where they currently fail</changelog>
  <changelog author="sflees@suse.de" date="1715947200">- Create a versioned package for SLES</changelog>
</package>
<package pkgid="cb12417afc463435911f4e793048f6cdca8dd89c3001bd25ff01e9733a2b832d" name="erlang26" arch="ppc64le">
  <version epoch="0" ver="26.2.1" rel="150300.7.5.1"/>
  <changelog author="matwey.kornilov@gmail.com" date="1646568000">- Changes for 24.2.2:
  * inets: Avoid intermediate ungraceful shutdown of the HTTP
    server.
  * ssh: The ssh sever parallel_login option was missing in OTP-24</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1648382400">- Changes for 24.3.2:
  * erl_interface: Fix compile error regarding gethostbyaddr_r on
    Android. Error introduced in OTP 24.3.
  * kernel: Fix failed accepted connection setup after previous
    established connection from same node closed down silently.
  * kernel: Fixed a problem where typing Ctrl-R in the shell could
    hang if there were some problem with the history log file.
- Changes for 24.3.1:
  * dialyzer: There could be spurious warnings for unknown types
    when a type was a subtype of an existing type that was a
    subtype of an unknown type.
  * ssl: Client certification could fail for TLS-1.3 servers that
    did not include the certificat_authorties extension in its
    certificate request message.
- Changes for 24.3:
  * megaco: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.
  * megaco: Update the performance and debug chapters of the megaco
    user's guide. Also some updates to the meas tools.
  * compiler: The expression &lt;&lt;0/native-float&gt;&gt;=Bin would always
    fail to match, while &lt;&lt;0/float-native&gt;&gt;=Bin would match
    (provided that Bin contained the binary representation of 0.0)
  * compiler: The compiler will now compile huge functions with
    straight-line code faster.
  * erl_interface: Add --enable-ei-dynamic-lib configure option
    that will make erl_interface also release a dynamic library
    version of libei.
  * erl_interface: The ei API for decoding/encoding terms is not
    fully 64-bit compatible since terms that have a representation
    on the external term format larger than 2 GB cannot be handled.
  * sasl: Fix bug in systools:make_script/1 documentation.
  * inets: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.
  * inets: Documentation fix for inets:services_info/0, which now
    describes that Info might be a Reason term() in case when
    {error, Reason} is returned as service info.
  * crypto: The crypto app in OTP can since OTP-24.2 be compiled,
    linked and used with the new OpenSSL 3.0 cryptolib. The crypto
    app has 3.0 support has been improved, but is still *not
    recommended* for other usages than experiments and alpha
    testing. There are not yet any guaranties that it works, not
    even together with other OTP applications like for example SSL
    and SSH, although there are no known errors. Since the previous
    release, OTP-24.2, the following improvements have been done: -
    It has been tested during nearly every nightly test on the OTP
    lab - The hash algorithms md4 and ripemd160 have been enabled
    with OpenSSL 3.0. - The ciphers blowfish_cbc, blowfish_ecb,
    des_cbc, des_cfb, des_ecb, rc2_cbc and rc4 have been enabled
    with OpenSSL 3.0. Disabled or unsupported with OpenSSL 3.0 are
    still: - ENGINE support - FIPS mode - Other providers than the
    built-in ones - Compiling and linking with OpenSSL 3.0
    cryptolib in compatibility modes (for example to behave as
    1.1.1) and, the ciphers blowfish_cfb64 and blowfish_ofb64 are
    not supported and will not be either. Deprecated functions in
    the OpenSSL 3.0 cryptolib must not be disabled as OTP/crypto
    still uses some of the deprecated API functions. The gcc flag
  - Wno-deprecated-declarations is set to prevent deprecation
    warnings to be printed when compiling.
  * crypto: Crypto is adapted to LibreSSL 3.5.0 on OpenBSD.
  * crypto: New configure option ( --disable-otp-test-engine) to
    prohibit the build of the OTP test engine used in some test
    suites. The reason is that the test engine could be hard to
    compile on for instance LibreSSL 3.5.0. For that particular
    cryptolib version (or higher), this configure option is set
    automatically.
  * jinterface: Fix bug in OtpOutputStream.write_pid/4 and
    write_ref/3 causing faulty encodig. Bug exists since OTP 23.0.
  * wx: Removed the static_data option from wxImage creation
    functions, as it was broken and could lead to crashes. Now
    image data is always copied to wxWidgets as was the default
    behavior. Removed some non working wxGridEvent event types,
    which have there own events in newer wxWidgets versions, and
    added a couple of event types that where missing in wx.
  * asn1: Add support for the maps option in combination with the
    jer backend.
  * snmp: The compilation time is no longer recorded in BEAM files.
    There remained several undocumented functions that attempted to
    retrieve compilation times. Those have now been removed.
  * snmp: [agent] Remove expectation of socket being a port.
  * common_test: OTP internal test fix.
  * runtime_tools: Fixed bug in scheduler:utilization(Seconds) that
    would leave the scheduler_wall_time system flag incorrectly
    enabled.
  * runtime_tools: Add scheduler:get_sample/0 and get_sample_all/0.
    Also clarify scheduler module documentation about how it
    depends on system flag scheduler_wall_time.
  * erts: Fixed a bug in the x86 JIT that might cause floating
    point instructions to wrongly throw an exception.
  * erts: Preserve correct nodedown_reason if supervised
    distribution controller processes exit with {shutdown, Reason}.
  * erts: Handling of send_timeout for gen_tcp has been corrected
    so that the timeout is honored also when sending 0 bytes.
  * erts: By default global does not take any actions to restore a
    fully connected network when connections are lost due to
    network issues. This is problematic for all applications
    expecting a fully connected network to be provided, such as for
    example mnesia, but also for global itself. A network of
    overlapping partitions might cause the internal state of global
    to become inconsistent. Such an inconsistency can remain even
    after such partitions have been brought together to form a
    fully connected network again. The effect on other applications
    that expects that a fully connected network is maintained may
    vary, but they might misbehave in very subtle hard to detect
    ways during such a partitioning. In order to prevent such
    issues, we have introduced a prevent overlapping partitions fix
    which can be enabled using the prevent_overlapping_partitions
    kernel(6) parameter. When this fix has been enabled, global
    will actively disconnect from nodes that reports that they have
    lost connections to other nodes. This will cause fully
    connected partitions to form instead of leaving the network in
    a state with overlapping partitions. Note that this fix has to
    be enabled on all nodes in the network in order to work
    properly. Since this quite substantially changes the behavior,
    this fix is currently disabled by default. Since you might get
    hard to detect issues without this fix you are, however,
    strongly advised to enable this fix in order to avoid issues
    such as the ones described above. As of OTP 25 this fix will
    become enabled by default.
  * erts: Corrected the type specification of erlang:seq_trace/2.
  * erts: Fix memory leak when tracing on running on a process that
    only handle system tasks or non-message signals (for example
    process_info requests).
  * erts: Add support for using socket:sockaddr_in() and
    socket:sockaddr_in6() when using gen_sctp, gen_tcp and gen_udp.
    This will make it possible to use Link Local IPv6 addresses.
  * erts: Show on_load failure reasons in embedded mode.
  * erts: Compile date saved in the Erlang VM executable has been
    removed.
  * erts: Improve documentation for the dynamic node name feature.
  * ssh: Fix makefile dependency bugs.
  * ssh: Fixed faulty OpenSSH decoding of Ed25519/Ed448 keys in the
    OpenSSH format openssh_key_v1.
  * ssh: Correction of ssh_file typing, specially for the
    experimental openssh-key-v1 encoding.
  * ssh: Improper tag for private ED keys when encoding with
    ssh:encode/2. The tuple had ed_priv as first element, but
    should have had ed_pri. This is now corrected. *** POTENTIAL
    INCOMPATIBILITY ***
  * ssh: Add support for Ed25519/Ed448 SSH host keys in the RFC
    4716 format ("-----BEGIN EC PRIVATE KEY-----") generated by for
    example openssl or via Erlang functions (i.e.
    public_key:generate_key({namedCurve, ed25519})). Ed25519 SSH
    host keys generated by ssh-keygen was, and are still,
    supported.
  * kernel: Handling of send_timeout for gen_tcp has been corrected
    so that the timeout is honored also when sending 0 bytes.
  * kernel: By default global does not take any actions to restore
    a fully connected network when connections are lost due to
    network issues. This is problematic for all applications
    expecting a fully connected network to be provided, such as for
    example mnesia, but also for global itself. A network of
    overlapping partitions might cause the internal state of global
    to become inconsistent. Such an inconsistency can remain even
    after such partitions have been brought together to form a
    fully connected network again. The effect on other applications
    that expects that a fully connected network is maintained may
    vary, but they might misbehave in very subtle hard to detect
    ways during such a partitioning. In order to prevent such
    issues, we have introduced a prevent overlapping partitions fix
    which can be enabled using the prevent_overlapping_partitions
    kernel(6) parameter. When this fix has been enabled, global
    will actively disconnect from nodes that reports that they have
    lost connections to other nodes. This will cause fully
    connected partitions to form instead of leaving the network in
    a state with overlapping partitions. Note that this fix has to
    be enabled on all nodes in the network in order to work
    properly. Since this quite substantially changes the behavior,
    this fix is currently disabled by default. Since you might get
    hard to detect issues without this fix you are, however,
    strongly advised to enable this fix in order to avoid issues
    such as the ones described above. As of OTP 25 this fix will
    become enabled by default.
  * kernel: Fix bug where logger would crash when logging a report
    including improper lists.
  * kernel: Make erlang:set_cookie work for dynamic node names.
  * kernel: Add support for using socket:sockaddr_in() and
    socket:sockaddr_in6() when using gen_sctp, gen_tcp and gen_udp.
    This will make it possible to use Link Local IPv6 addresses.
  * kernel: A net_tickintensity kernel parameter has been
    introduced. It can be used to control the amount of ticks
    during a net_ticktime period. A new net_kernel:start/2 function
    has also been introduced in order to make it easier to add new
    options. The use of net_kernel:start/1 has been deprecated.
  * kernel: Improve documentation for the dynamic node name
    feature.
  * erl_docgen: Fix css for large tables and images on small
    screens
  * erl_docgen: Fix bug with codeinclude tag that caused it to not
    include the code if used in a correct, but unexpected way.
  * observer: Calculate the display width in etop, instead of hard-
    coding it to 89 characters.
  * debugger: Fix record index matching, it was broken and could
    never match.
  * ssl: Improved error handling.
  * ssl: Before this change, net_kernel used with TLS distribution
    might be leaking processes in case of connectivity issues.
  * ssl: Fix makefile dependency bugs.
  * ssl: Make sure the TLS sender process handles explicit calls to
    erlang:disconnect_node properly, avoiding potential hanging
    problems in net_kernel.
  * ssl: Add support for TLS-1.3 certificate_authorities extension.
    And process certificate_authorities field in pre-TLS-1.3
    certificate requests.
  * ssl: Support password fun for protected keyfiles in ssl:connect
    function.
  * ssl: Add in some cases earlier detection of possible DoS
    attacks by malicious clients sending unexpected TLS messages
    instead of the client hello. Note that such attacks are already
    mitigated by providing a timeout for the TLS handshake.
  * eldap: Fix eldap extensibleMatch dnAttributes option. According
    to the ldap ASN1 the dnAttributes should be a bool, instead it
    was generated as a string.
  * eldap: Implemented paged searches according to https://www.rfc-
    editor.org/rfc/rfc2696.txt
  * public_key: Support password fun for protected keyfiles in
    ssl:connect function.
  * stdlib: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.
  * mnesia: Reduce the number of locks taken during table copying,
    should reduce the startup time on large systems.
  * diameter: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1649246400">- Fix build for Factory. Currently, any Java version
  is fine for Erlang.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1653220800">- Version 25.0:
  - stdlib
  * New function filelib:ensure_path/1 will ensure that all
    directories for the given path exists
  * New functions groups_from_list/2 and groups_from_list/3 in
    the maps module
  * New functions uniq/1 uniq/2 in the lists module
  * New PRNG added to the rand module, for fast pseudo-random
    numers.
  - compiler, kernel, stdlib, syntax_tools:
  * Added support for selectable features as described in EEP-60.
    Features can be enabled/disabled during compilation with
    options (ordinary and +term) to erlc as well as with
    directives in the file. Similar options can be used to erl
    for enabling/disabling features allowed at runtime. The new
    maybe expression EEP-49 is fully supported as the feature
    maybe_expr.
  - erts &amp; JIT:
  * The JIT now works for 64-bit ARM processors.
  * The JIT now does type-based optimizations based on type
    information in the BEAM files.
  * Improved the JIT’s support for external tools like perf and
    gdb, allowing them to show line numbers and even the original
    Erlang source code when that can be found.
  - erts, stdlib, kernel:
  * Users can now configure ETS tables with the
    {write_concurrency, auto} option. This option forces tables
    to automatically change the number of locks that are used at
    run-time depending on how much concurrency is detected. The
    {decentralized_counters, true} option is enabled by default
    when {write_concurrency, auto} is active.
  * Benchmark results comparing this option with the other ETS
    optimization options are available here: benchmarks.
  * To enable more optimizations, BEAM files compiled with OTP 21
    and earlier cannot be loaded in OTP 25.
  * The signal queue of a process with the process flag
    message_queue_data=off_heap has been optimized to allow
    parallel reception of signals from multiple processes. This
    can improve performance when many processes are sending in
    parallel to one process. See benchmark.
  * The Erlang installation directory is now relocatable on the
    file system given that the paths in the installation’s
    RELEASES file are paths that are relative to the
    installations root directory.
  * A new option called short has been added to the functions
    erlang:float_to_list/2 and erlang:float_to_binary/2. This
    option creates the shortest correctly rounded string
    representation of the given float that can be converted back
    to the same float again.
  * Introduction of quote/1 and unquote/1 functions in the
    uri_string module - a replacement for the deprecated
    functions http_uri:encode and http_uri:decode.
  * The new module peer supersedes the slave module. The slave
    module is now deprecated and will be removed in OTP 27.
  * global will now by default prevent overlapping partitions due
    to network issues. This is done by actively disconnecting
    from nodes that reports that they have lost connections to
    other nodes. This will cause fully connected partitions to
    form instead of leaving the network in a state with
    overlapping partitions.
  * It is possible to turn off the new behavior by setting the
    the kernel configuration parameter
    prevent_overlapping_partitions to false. Doing this will
    retain the same behavior as in OTP 24 and earlier.
  * The format_status/2 callback for gen_server, gen_statem and
    gen_event has been deprecated in favor of the new
    format_status/1 callback.
  * The new callback adds the possibility to limit and change
    many more things than the just the state.
  * The timer module has been modernized and made more efficient,
    which makes the timer server less susceptible to being
    overloaded. The timer:sleep/1 function now accepts an
    arbitrarily large integer.
  - compiler:
  * The maybe ... end construction as proposed in EEP-49 has been
    implemented. It can simplify complex code where otherwise
    deeply nested cases would have to be used.
  * To enable maybe, give the option {enable_feature,maybe_expr}
    to the compiler. The exact option to use will change in a
    coming release candidate and then it will also be possible to
    use from inside the module being compiled.
  * When a record matching or record update fails, a {badrecord,
    ExpectedRecordTag} exception used to be raised. In this
    release, the exception has been changed to {badrecord,
    ActualValue}, where ActualValue is the value that was found
    instead of the expected record.
  * Add compile attribute -nifs() to empower compiler and loader
    with information about which functions may be overridden as
    NIFs by erlang:load_nif/2.
  * Improved and more detailed error messages when binary
    construction with the binary syntax fails. This applies both
    for error messages in the shell and for
    erl_error:format_exception/3,4.
  * Change format of feature options and directives for better
    consistency. Options to erlc and the -compile(..) directive
    now has the format {feature, feature-name, enable | disable}.
    The -feature(..) now has the format -feature(feature-name,
    enable | disable).
  - crypto:
  * Add crypto:hash_equals/2 which is a constant time comparision
    of hashvalues.
  - ssl:
  * Introducing a new (still experimental) option
    {certs_keys,[cert_key_conf()]}. With this a list of a
    certificates with their associated key may be used to
    authenticate the client or the server. The certificate key
    pair that is considered best and matches negotiated
    parameters for the connection will be selected.
  - public_key:
  * Functions for retrieving OS provided CA-certs added.
  - dialyzer:
  * Optimize operations in the erl_types module. Parallelize the
    Dialyzer pass remote.
  * Added the missing_return and extra_return options to raise
    warnings when specifications differ from inferred types.
    These are similar to, but not quite as verbose as overspecs
    and underspecs.
  * Dialyzer now better understands the types for min/2, max/2,
    and erlang:raise/3. Because of that, Dialyzer can potentially
    generate new warnings. In particular, functions that use
    erlang:raise/3 could now need a spec with a no_return()
    return type to avoid an unwanted warning.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1656849600">- Changes for 25.0.2:
  * ssl: Improved handling of unexpected messages during the
    handshake, taking the right action for unexpected messages.
  * erts: On computers with the ARM64 (AArch64) architecture (such
    as Apple Silicon Macs) a rem expression followed by a div
    expression with the same operands could evaluate to the wrong
    result if the result of the rem expression was unused.
- Changes for 25.0.1:
  * ssl: When a TLS-1.3 enabled client tried to talk to a TLS-1.2
    server that coalesces TLS-1.2 handshake message over one TLS
    record, the connection could fail due to some message being
    handled in the wrong state, this has been fixed.
  * ssl: Correctly handles supported protocol version change from
    default to something else by sni_fun supplied to
    ssl:handshake/[2,3] together with a TCP-socket (so called
    upgrade).
  * ssl: Also, TLS-1.3 should respond with a protocol version alert
    if previous versions, that are supported but not configured,
    are attempted.
  * kernel: The DNS resolver inet_res has been fixed to ignore
    trailing dot difference in the request domain between the sent
    request and the received response, when validating a response.
  * kernel: A bug in inet_res has been fixed where a missing
    internal {ok,_} wrapper caused inet_res:resolve/* to return a
    calculated host name instead of an `{ok,Msg} tuple, when
    resolving an IP address or a host name that is an IP address
    string.
  * kernel: The erlang:is_alive() BIF could return true before
    configured distribution service was available. This bug was
    introduced in OTP 25.0 ERTS version 13.0. The
    erlang:monitor_node() and erlang:monitor() BIFs could
    erroneously fail even though configured distribution service
    was available. This occurred if these BIFs were called after
    the distribution had been started using dynamic node name
    assignment but before the name had been assigned.
  * kernel: Added the missing mandatory address/0 callback in the
    gen_tcp_dist example.
  * erts: A spawn_reply signal from a remote node could be delayed
    and be delivered after other signals from the newly spawned
    process. When this bug triggered, the connection to the node
    where the process was spawned sometimes could be taken down due
    to the bug. The following error message would then be logged if
    this happened: Missing 'spawn_reply' signal from the node
    &lt;RemoteNode&gt; detected by &lt;Pid&gt; on the node &lt;LocalNode&gt;. The
    node &lt;RemoteNode&gt; probably suffers from the bug with ticket id
    OTP-17737. This bug only affected processes which had enabled
    off_heap message_queue_data and parallel reception of signals
    had been automatically enabled. This bug was introduced in OTP
    25.0, ERTS version 13.0.
  * erts: Fixed type spec of erlang:system_info(dist_ctrl).
  * erts: The zlib built in to the runtime system has been updated
    to version 1.2.12. (Note that on most platforms, the platform's
    own zlib is used.)
  * erts: The erlang:is_alive() BIF could return true before
    configured distribution service was available. This bug was
    introduced in OTP 25.0 ERTS version 13.0. The
    erlang:monitor_node() and erlang:monitor() BIFs could
    erroneously fail even though configured distribution service
    was available. This occurred if these BIFs were called after
    the distribution had been started using dynamic node name
    assignment but before the name had been assigned.
  * crypto: Note in the documentation that MODP (rfc3526) groups
    and OpenSSL 3.0 can give an error if a call to
    crypto:generate_key/2 specifies a key length, and that length
    is to small.
  * crypto: The cmac now uses only the 3.0 API
  * crypto: Documentation is now updated with which OpenSSL
    cryptolib versions that OTP currently is tested.
  * dialyzer: Fixed the documentation for the missing_return and
    extra_return options.
  * mnesia: Fixed add_table_copy which could leave a table lock if
    the receiving node went down during the operation.
  * ssh: Binaries can be limited in logs with the parameter
    max_log_item_len. The default value is 500 bytes.
  * stdlib: In the initial release of Erlang/OTP 25, the expression
    bound to the _ pseudo-field in a record initialization would
    always be evaluated once, even if all other fields in the
    record were explicitly initialized. That would break the use
    case of binding the expression error(...) to _ in order to get
    an exception if not all fields were initialized. The behavior
    of binding to _ has been reverted to the pre-OTP 25 behavior,
    that is, to not evaluate the expression if all fields have been
    bound to explicit values.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1660046400">- Changes for 25.0.3:
  * erts: Distributed exit signals could be lost under the
    following conditions:
  * erts: A race could cause process_info(Pid, message_queue_len)
    on other processes to return invalid results.
  * erts: Fixed reduction counting for handling process system
    tasks.
  * erts: Priority elevation of terminating processes did not work
    which could cause execution of such processes to be delayed.
  * erts: An unlink operation made by a process that terminated
    before the unlink operation completed, i.e., before it had
    received an unlink-ack signal from the linked process, caused
    an exit signal to erroneously be sent from the terminating
    process to the process being unlinked. This exit signal would
    most often be ignored by the receiver, but if the receiver of
    the exit signal concurrently set up a new link, it could
    receive the exit signal with the actual exit reason of the
    terminating process instead of a noproc exit reason. It is
    however very hard to detect that this has happened and has no
    obvious negative consequences, so it should be considered
    harmless. A distributed unlink-ack signal received by a
    terminating process was also not properly removed which could
    cause a minor memory leak.
  * ssl: The link to crypto:engine_load refered the function with
    wrong arity.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1661601600">- Changes for 25.0.4:
  * kernel: A call to net_kernel:setopts(new, Opts) at the same
    time as a connection was being set up could cause a deadlock
    between the net_kernel process and the process setting up the
    connection.
  * erts: The monitor/3 BIF did not apply options to the created
    monitor if the target process or port did not exist. That is,
    the corresponding down message would get a `DOWN` tag even if a
    custom tag had been set, and the returned reference was not an
    alias even if the alias option had been passed.
  * erts: The erlang:monotonic_time/1, erlang:system_time/1,
    erlang:time_offset/1, and os:system_time/1 BIFs erroneously
    failed when passed the argument native.</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1665662400">- Changes for 25.1.1:
  * dialyzer: Dialyzer could crash when analyzing Elixir code that
    used intricate macros.
  * dialyzer: The --input_list_file option has been added.
  * ssl: Fixes handling of symlinks in cacertfile option.
  * eunit: With this change, eunit exact_execution option works
    with application primitive.
  * stdlib: peer nodes failed to halt when the process supervising
    the control connection crashed. When an alternative control
    connection was used, this supervision process also quite
    frequently crashed when the peer node was stopped by the node
    that started it which caused the peer node to linger without
    ever halting.
  * asn1: For the per and uper ASN.1 encoding rules, encoding and
    decoding the SEQUENCE OF and SET OF constructs with 16384 items
    or more is now supported.
  * erts: Listen sockets created with the socket module, leaked
    (erlang-) monitors.
  * erts: Notifications about available distribution data sent to
    distribution controller processes could be lost. Distribution
    controller processes can be used when implementing an
    alternative distribution carrier. The default distribution over
    tcp was not effected and the bug was also not present on
    x86/x86_64 platforms.
  * kernel: Listen sockets created with the socket module, leaked
    (erlang-) monitors.
  * kernel: peer nodes failed to halt when the process supervising
    the control connection crashed. When an alternative control
    connection was used, this supervision process also quite
    frequently crashed when the peer node was stopped by the node
    that started it which caused the peer node to linger without
    ever halting.
- Changes for 25.1:
  * dialyzer: Two bugs have been fixed in Dialyzer's checking of
    behaviors: When a mandatory callback function is present but
    not exported, Dialyzer would not complain about a missing
    callback. When an optional callback function was not exported
    and had incompatible arguments and/or the return values were
    incompatible, Dialyzer would complain. This has been changed to
    suppress the warning, because the function might not be
    intended to be a callback function, for instance if a release
    added a new optional callback function (such as format_status/1
    for the gen_server behaviour added in OTP 25).
  * dialyzer: The no_extra_return and no_missing_return warnings
    can now be suppressed through -dialyzer directives in source
    code.
  * jinterface: Fix javadoc build error by adding option -encoding
    UTF-8.
  * diameter: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * crypto: Fix configure with --with-ssl and --disable-dynamic-
    ssl-lib on Windows.
  * crypto: Remove all references correctly in the garbage
    collection if an engine handle was not explicit unloaded.
  * crypto: Changed the behaviour of the engine load/unload
    functions The engine load/unload functions have got changed
    semantics to get a more consistent behaviour and work correct
    when variables are garbage collected. The load functions now
    don't register the methods for the engine to replace. That will
    now be handled with the new functions
    engine_register/engine_unregister if needed. Some functions are
    removed from the documentation and therefor the API, but they
    are left in the code for compatibility. *** POTENTIAL
    INCOMPATIBILITY ***
  * crypto: Fixed a naming bug for AES-CFB and Blowfish-CFB/OFB
    when linked with OpenSSL 3.0 cryptolib.
  * crypto: Sign/verify does now behave as in OTP-24 and earlier
    for eddsa.
  * crypto: Pass elliptic curve names from crypto.erl to crypto's
    nif.
  * crypto: The configure option --disable-deprecated-warnings is
    removed. It was used for some releases when the support for
    OpenSSL 3.0 was not completed. It is not needed in OTP 25.
  * crypto: Crypto is now considered to be usable with the OpenSSL
    3.0 cryptolib for production code. ENGINE and FIPS are not yet
    fully functional.
  * crypto: Do not exit if the legacy provider is missing in
    libcrypto 3.0.
  * ssl: Reject unexpected application data in all relevant places
    for all TLS versions. Also, handle TLS-1.3 middlebox
    compatibility with more care. This will make malicious
    connections fail early and further, mitigate possible DoS
    attacks, that would be caught by the handshake timeout. Thanks
    to Aina Toky Rasoamanana and Olivier Levillain from Télécom
    SudParis for alerting us of the issues in our implementation.
  * ssl: With this change, value of cacertfile option will be
    adjusted before loading certs from the file. Adjustments
    include converting relative paths to absolute and converting
    symlinks to actual file path. Thanks to Marcus Johansson
  * ssl: In TLS-1.3, if chain certs are missing (so server auth
    domain adherence can not be determined) send peer cert and hope
    the server is able to recreate a chain in its auth domain.
  * ssl: Make sure periodical refresh of CA certificate files
    repopulates cache properly.
  * ssl: Correct internal CRL cache functions to use internal
    format consistently.
  * ssl: Incorrect handling of client middlebox negotiation for
    TLS-1.3 could result in that a TLS-1.3 server would not use
    middlebox mode although the client was expecting it too and
    failing the negotiation with unexpected message.
  * ssl: If the "User" process, the process starting the TLS
    connection, gets killed in the middle of spawning the dynamic
    connection tree make sure we do not leave any processes behind.
  * ssl: A vulnerability has been discovered and corrected. It is
    registered as CVE-2022-37026 "Client Authentication Bypass".
    Corrections have been released on the supported tracks with
    patches 23.3.4.15, 24.3.4.2, and 25.0.2. The vulnerability
    might also exist in older OTP versions. We recommend that
    impacted users upgrade to one of these versions or later on the
    respective tracks. OTP 25.1 would be an even better choice.
    Impacted are those who are running an ssl/tls/dtls server using
    the ssl application either directly or indirectly via other
    applications. For example via inets (httpd), cowboy, etc. Note
    that the vulnerability only affects servers that request client
    certification, that is sets the option {verify, verify_peer}.
    (bsc#1205318)
  * eunit: With this change, Eunit can optionally not try to
    execute related module with "_tests" suffix. This might be used
    for avoiding duplicated executions when source and test modules
    are located in the same folder.
  * erl_docgen: Update DTD to allow XML tag em under pre.
  * inets: Add httpc:ssl_verify_host_options/1 to help setting
    default ssl options for the https client.
  * inets: This change fixes dialyzer warnings generated for
    inets/httpd examples (includes needed adjustment of spec for
    ssh_sftp module).
  * inets: Remove documentation of no longer supported callback.
  * stdlib: Fixed inconsistency bugs in global due to
    nodeup/nodedown messages not being delivered before/after
    traffic over connections. Also fixed various other
    inconsistency bugs and deadlocks in both global_group and
    global. As building blocks for these fixes, a new BIF
    erlang:nodes/2 has been introduced and
    net_kernel:monitor_nodes/2 has been extended. The -hidden and
  - connect_all command line arguments did not work if multiple
    instances were present on the command line which has been
    fixed. The new kernel parameter connect_all has also been
    introduced in order to replace the -connect_all command line
    argument.
  * stdlib: Fix the public_key:ssh* functions to be listed under
    the correct release in the Removed Functionality User's Guide.
  * stdlib: The type spec for format_status/1 in gen_statem,
    gen_server and gen_event has been corrected to state that the
    return value is of the same type as the argument (instead of
    the same value as the argument).
  * stdlib: If the timer server child spec was already present in
    kernel_sup but it was not started, the timer server would fail
    to start with an {error, already_present} error instead of
    restarting the server.
  * stdlib: When changing callback module in gen_statem the
    state_enter calls flag from the old module was used in for the
    first event in the new module, which could confuse the new
    module and cause malfunction. This bug has been corrected. With
    this change some sys debug message formats have been modified,
    which can be a problem for debug code relying on the format.
  * ** POTENTIAL INCOMPATIBILITY ***
  * stdlib: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * stdlib: The rfc339_to_system_time/1,2 functions now allows the
    minutes part to be omitted from the time zone.
  * stdlib: The receive statement in gen_event has been optimized
    to not use selective receive (which was never needed, and could
    cause severe performance degradation under heavy load).
  * stdlib: Add new API function erl_features:configurable/0
  * parsetools: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * public_key: Support more Linux distributions in cacerts_load/0.
  * public_key: Correct asn1 typenames available in type
    pki_asn1_type()
  * public_key: Sign/verify does now behave as in OTP-24 and
    earlier for eddsa.
  * snmp: Improved the get-bulk response max size calculation. Its
    now possible to configure 'empty pdu size', see appendix c for
    more info.
  * snmp: Fix various example dialyzer issues
  * ssh: Handling rare race condition at channel close.
  * ssh: New ssh option no_auth_needed to skip the ssh
    authentication. Use with caution!
  * ssh: This change fixes dialyzer warnings generated for
    inets/httpd examples (includes needed adjustment of spec for
    ssh_sftp module).
  * ssh: The new function ssh:daemon_replace_options/2 makes it
    possible to change the Options in a running SSH server.
    Established connections are not affected, only those created
    after the call to this new function.
  * ssh: Add a timeout as option max_initial_idle_time. It closes a
    connection that does not allocate a channel within the timeout
    time. For more information about timeouts, see the Timeouts
    section in the User's Guide Hardening chapter.
  * observer: Fixed units in gui.
  * xmerl: There is a new configure option, --enable-deterministic-
    build, which will apply the deterministic compiler option when
    building Erlang/OTP. The deterministic option has been improved
    to eliminate more sources of non-determinism in several
    applications.
  * asn1: There is a new configure option, --enable-deterministic-
    build, which will apply the deterministic compiler option when
    building Erlang/OTP. The deterministic option has been improved
    to eliminate more sources of non-determinism in several
    applications.
  * erts: Fixed inconsistency bugs in global due to nodeup/nodedown
    messages not being delivered before/after traffic over
    connections. Also fixed various other inconsistency bugs and
    deadlocks in both global_group and global. As building blocks
    for these fixes, a new BIF erlang:nodes/2 has been introduced
    and net_kernel:monitor_nodes/2 has been extended. The -hidden
    and -connect_all command line arguments did not work if
    multiple instances were present on the command line which has
    been fixed. The new kernel parameter connect_all has also been
    introduced in order to replace the -connect_all command line
    argument.
  * erts: Fixed IPv6 multicast_if and membership socket options.
  * erts: Accept funs (NEW_FUN_EXT) with incorrectly encoded size
    field. This is a workaround for a bug (OTP-18104) existing in
    OTP 23 and 24 that could cause incorrect size fields in certain
    cases. The emulator does not use the decoded size field, but
    erl_interface still does and is not helped by this workaround.
  * erts: Fixed issue with inet:getifaddrs hanging on pure IPv6
    Windows
  * erts: Fix faulty distribution encoding of terms with either The
    symptom could be failed decoding on the receiving side leading
    to aborted connection. Fix OTP-18093 is a workaround for theses
    bugs that makes the VM accepts such faulty encoded funs. The
    first encoding bug toward pending connection exists only in OTP
    23 and 24, but the second one exists also on OTP 25.
  * erts: Fixed emulator crash that could happen during crashdump
    generation of ETS tables with options ordered_set and
    {write_concurrency,true}.
  * erts: Retrieval of monotonic and system clock resolution on
    MacOS could cause a crash and/or erroneous results.
  * erts: Fix bug where the max allowed size of erl +hmax was lower
    than what was allowed by process_flag.
  * erts: On computers with ARM64 (AArch64) processors, the JIT
    could generate incorrect code when more than 4095 bits were
    skipped at the tail end of a binary match.
  * erts: In rare circumstances, an is_binary/1 guard test could
    succeed when given a large integer.
  * erts: Fix bug causing ets:info (and sometimes ets:whereis) to
    return 'undefined' for an existing table if a concurrent
    process were doing ets:insert with a long list on the same
    table.
  * erts: Fix writing and reading of more than 2 GB in a single
    read/write operation on macOS. Before this fix attempting to
    read/write more than 2GB would result in {error,einval}.
  * erts: Fix bug sometimes causing emulator crash at node shutdown
    when there are pending connections. Only seen when running duel
    distribution protocols, inet_drv and inet_tls_dist.
  * erts: Yield when adjusting large process message queues due to
    The message queue adjustment work will now be interleaved with
    all other types of work that processes have to do, even other
    message queue adjustment work.
  * erts: Add rudimentary debug feature (option) for the inet-
    driver based sockets, such as gen_tcp and gen_udp.
  * erts: Introduced the hidden and dist_listen options to
    net_kernel:start/2. Also documented the -dist_listen command
    line argument which was erroneously documented as a kernel
    parameter and not as a command line argument.
  * erts: New documentation chapter "Debugging NIFs and Port
    Drivers" under Interoperability Tutorial.
  * erts: Add new API function erl_features:configurable/0
  * kernel: Fixed inconsistency bugs in global due to
    nodeup/nodedown messages not being delivered before/after
    traffic over connections. Also fixed various other
    inconsistency bugs and deadlocks in both global_group and
    global. As building blocks for these fixes, a new BIF
    erlang:nodes/2 has been introduced and
    net_kernel:monitor_nodes/2 has been extended. The -hidden and
  - connect_all command line arguments did not work if multiple
    instances were present on the command line which has been
    fixed. The new kernel parameter connect_all has also been
    introduced in order to replace the -connect_all command line
    argument.
  * kernel: Fixed IPv6 multicast_if and membership socket options.
  * kernel: Fixed issue with inet:getifaddrs hanging on pure IPv6
    Windows
  * kernel: The type specifications for inet:getopts/2 and
    inet:setopts/2 have been corrected regarding SCTP options.
  * kernel: The type specifications for inet:parse_* have been
    tightened.
  * kernel: Fix gen_tcp:connect/3 spec to include the inet_backend
    option.
  * kernel: Fix bug where using a binary as the format when calling
    logger:log(Level, Format, Args) (or any other logging function)
    would cause a crash or incorrect logging.
  * kernel: Add rudimentary debug feature (option) for the inet-
    driver based sockets, such as gen_tcp and gen_udp.
  * kernel: Introduced the hidden and dist_listen options to
    net_kernel:start/2. Also documented the -dist_listen command
    line argument which was erroneously documented as a kernel
    parameter and not as a command line argument.
  * kernel: Scope and group monitoring have been introduced in pg.
    For more information see the documentation of
    pg:monitor_scope(), pg:monitor(), and pg:demonitor().
  * kernel: A new function global:disconnect/0 has been introduced
    with which one can cleanly disconnect a node from all other
    nodes in a cluster of global nodes.
  * compiler: The compiler will now forbid using the empty atom ''
    as module name. Also forbidden are modules names containing
    control characters, and module names containing only spaces and
    soft hyphens.
  * compiler: The bin_opt_info and recv_opt_info options would
    cause the compiler to crash when attempting to compile
    generated code without location information.
  * compiler: In rare circumstances involving floating point
    operations, the compiler could terminate with an internal
    consistency check failure.
  * compiler: In rare circumstances when doing arithmetic
    instructions on non-numbers, the compiler could crash.
  * compiler: In rare circumstances, complex boolean expressions in
    nested cases could cause the compiler to crash.
  * compiler: Expression similar to #{assoc:=V} = #key=&gt;self()}, V
    would return the empty map instead of raising an exception.
  * compiler: Eliminated a crash in the beam_ssa_bool pass of the
    compiler when compiling a complex guard expression.
  * compiler: In rare circumstances, the compiler could crash with
    an internal consistency check failure.
  * compiler: When compiling with the option inline_list_funcs, the
    compiler could produce a nonsensical warning.
  * compiler: When given the no_ssa_opt option, the compiler could
    terminate with an internal consistency failure diagnostic when
    compiling map matching.
  * compiler: Made warnings for existing atoms being keywords in
    experimental features more precise, by not warning about quoted
    atoms.
  * compiler: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * megaco: Fixed various dialyzer related issues in the examples
    and the application proper.
  * megaco: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * common_test: Fix cth_surefire to handle when a suite is not
    compiled with debug_info. This bug has been present since
    Erlang/OTP 25.0.
  * common_test: Common Test now preserves stack traces for throws.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1669291200">- Changes for 25.1.2:
  * mnesia: Don't fill the logs if mnesia can't connect to all
    nodes, due to partitioned network.
  * erts: Add abandon carrier free utilization limit (+Muacful)
    option to erts_alloc. This option allows the user to mark
    unused segments in a memory carrier as re-useable by the OS if
    needed. This functionality was a non-configurable default
    before Erlang/OTP 25, but removed due to performance issues.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1671364800">- Changes for 25.2:
  * erts: Fix perf/gdb JIT symbols to not contain CodeInfoPrologue
    for the JIT internal module erts_beamasm.
  * erts: Fixed minor memory leaks.
  * erts: Fix bugs in ets:insert and ets:insert_new when called
    with a list of tuples to insert while a concurrent process
    either deletes or renames the table. The table deletion could
    be done with ets:delete/1 or be caused by termination of the
    table owning process. Symptoms are either VM crash or strange
    incorrect behavior from the insert operation. The risk of
    triggering the bugs increases with the length of the list of
    tuple to insert. Bugs exist since OTP 23.0.
  * erts: Boost execution of scheduled thread progress jobs. This
    to prevent memory exhaustion in extremely rapid
    allocation/deallocation scenarios, such as repeated ETS table
    creations/deletions.
  * erts: Fix segv crash during crash dumping an ETS table doing
    ets:delete_all_objects.
  * erts: Spec for function net:if_names/0 incorrect
  * erts: Fix bug in binary_to_term decoding a binary term 2Gbyte
    or larger.
  * erts: Documentation of erlang:module_loaded/1 has been
    adjusted:
  * erts: Fix list_to_atom/1 for negative code points. Could either
    return with a positive code point or fail with an incorrect
    exception.
  * erts: Fix rare bug causing VM crash when sending to a pid of a
    spawning process returned from erlang:processes/0. Only seen
    when provoked by system process literal_area_collector,
    triggered by a module purge operation, on a VM started with
    +Meamin (no customized allocators).
  * erts: gen_udp:open/2 with option(s) add_membership or
    drop_membership would drop earlier options.
  * erts: The inet:setopts/2 {reuseaddr, true} option will now be
    ignored on Windows unless the socket is an UDP socket. For more
    information see the documentation of the reuseaddr option part
    of the documentation of inet:setopts/2. Prior to OTP 25 the
    {reuseaddr, true} option was ignored for all sockets on
    Windows, but as of OTP 25.0 this was changed so that it was not
    ignored for any sockets. *** POTENTIAL INCOMPATIBILITY ***
  * erts: Fix bug in binary_to_term decoding a list of length 1G or
    longer.
  * erts: Fix bug in binary_to_term (and distributed receive) when
    decoding a large map (&gt;32 keys) with unsorted small maps (&lt;=
    32) as keys of the large map. This was only a problem if the
    term was encoded by erl_interface, jinterface or otherwise, as
    the VM itself always encodes small maps with sorted keys. The
    "binary_to_term" would appear as successful but the created
    large map was internally inconsistent. The smaller key-maps
    could not be found with maps:get and friends. Other operations
    such as map compare and merge could probably also give
    incorrect results.
  * erts: Fix Windows bug in open_port({spawn, Command}, ..) when
    Command is found via the OS search PATH and that directory path
    contains white spaces. The port program would start but the
    command line arguments to it could be incorrect.
  * ftp: fix unexpected result ok when calling ftp:nlist repeatedly
  * inets: This change allows body requests to httpc:request/5 be
    an iolist()
  * inets: addition of type specs in httpc.erl
  * inets: httpc: Add support for HTTP 308 status code
  * dialyzer: Dialyzer would crash when attempting to analyze a bit
    syntax segment size having an literal non-integer size such as
    [].
  * dialyzer: Dialyzer could crash when trying to analyze a
    convoluted nested expression involving funs,
  * kernel: Fixed shutdown crash in gen_tcp socket backend, when
    the other end closed the socket.
  * kernel: erl_tar can now read gzip-compressed tar files that are
    padded. There is a new option compressed_one for file:open/2
    that will read a single member from a gzip file,
  * kernel: Fix os:cmd to not translate all exceptions thrown to
    badarg. For example emfile from erlang:open_port was translated
    to badarg. This bug has existed since Erlang/OTP 24.
  * kernel: Spec for function net:if_names/0 incorrect
  * kernel: Missing ctrl option name transation for TOS and TTL (on
    FreeBSD) when using gen_udp with the 'socket' inet_backend.
  * kernel: gen_udp:open/2 with option(s) add_membership or
    drop_membership would drop earlier options.
  * kernel: The inet:setopts/2 {reuseaddr, true} option will now be
    ignored on Windows unless the socket is an UDP socket. For more
    information see the documentation of the reuseaddr option part
    of the documentation of inet:setopts/2. Prior to OTP 25 the
    {reuseaddr, true} option was ignored for all sockets on
    Windows, but as of OTP 25.0 this was changed so that it was not
    ignored for any sockets. *** POTENTIAL INCOMPATIBILITY ***
  * kernel: The distribution socket option handling in
    inet_tcp_dist has been cleaned up to clarify which were
    mandatory and which just had default values.
  * kernel: Improve warning message format for gen_tcp_socket.
  * snmp: Explicitly close the socket(s) when terminating
    (default-) net-if process.
  * stdlib: erl_tar can now read gzip-compressed tar files that are
    padded. There is a new option compressed_one for file:open/2
    that will read a single member from a gzip file,
  * stdlib: A concurrent call to ets:rename could cause
    ets:delete_all_objects to fail halfway through with badarg.
  * stdlib: It is not allowed to call functions from guards. The
    compiler failed to reject a call in a guard when done by
    constructing a record with a default initialization expression
    that called a function.
  * stdlib: The compiler could crash when using a record with
    complex field initialization expression as a filter in a list
    comprehension.
  * stdlib: unicode:characters_to_binary() could build
    unnecessarily large call stack.
  * stdlib: Improve error message for ets:new/2 name clash. Say
    "name already exists" instead of less specific "invalid
    options".
  * mnesia: Fixed crash which could happen during startup if too
    many decisions where sent from remote nodes.
  * os_mon: The disk_space_check_interval configuration parameter
    of disksup can now be set to values smaller than a minute.
  * ssh: graceful shutdown of ssh_conection_handler when connection
    is closed by peer
  * common_test: Fix starting of peer nodes on old releases when
    the compile server was active and the current Erlang
    installation contained non-latin1 characters in its path.
  * public_key: Disregard LDAP URIs when HTTP URIs are expected.
  * ssl: With this change, tls_sender process is hibernated after
    sufficient inactivity.
  * ssl: Correct handling of legacy schemes so that ECDSA certs
    using sha1 may be used for some TLS-1.3 configurations.
  * ssl: With this change, tls_sender does not cause logger crash
    upon key update.
  * ssl: Enhance warning message
  * ssl: Provide server option to make certificate_authorities
    extension in the TLS-1.3 servers certificate request optional.
    This will allow clients to send incomplete chains that may be
    reconstructable and thereby verifiable by the server, but that
    would not adhere to the certificate_authorities extension.
  * ssl: If the verify_fun handles four arguments the DER cert will
    be supplied as one of the arguments.
  * megaco: A very minor improvement to the measurement tool.
  * observer: A WX event race could causes a crash in when handling
    socket or port info.
  * observer: Improve the nodes menu to include more nodes.
  * compiler: Line number in compiler messages would be truncated
    to 4 digits for line numbers greater than 9999.
  * compiler: In rare circumstance, matching a binary as part of a
    receive clause could cause the compiler to terminate because of
    an internal consistency check failure.
  * compiler: Compiling a function with complex bit syntax matching
    such as f(&lt;&lt;X:0, _:X&gt;&gt;, &lt;&lt;Y:0, _:Y&gt;&gt;) -&gt; ok. could crash the
    compiler.
  * compiler: It is not allowed to call functions from guards. The
    compiler failed to reject a call in a guard when done by
    constructing a record with a default initialization expression
    that called a function.
  * compiler: The compiler could crash when using a record with
    complex field initialization expression as a filter in a list
    comprehension.
  * wx: Added environment variable WX_MACOS_NON_GUI_APP to allow
    user to override OSXIsGUIApplication behavior.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1679745600">- Changes for 25.3:
  * reltool: Fixed a bug that would cause analysis to crash.
  * stdlib: Fixed a bug that would cause analysis to crash.
  * stdlib: Fixed a crash when formatting stack traces for error
    reports.
  * stdlib: Instead of crashing, the list_to_integer/1 and
    list_to_integer/2 BIFs now raise the system_limit exception for
    overlong lists that can't be converted to integers. Similarly,
    the string:to_integer/1 BIF now returns {error,system_limit}
    for overlong lists.
  * stdlib: Removal of non-necessary undefined types added to the
    state's supervisor record.
  * compiler: Fixed a bug that would cause the compiler to hang.
  * compiler: Fixed a crash when compiling code that contained
    maybe expressions.
  * compiler: Constructing a binary with an explicit size of all
    for a binary segment would crash the compiler.
  * compiler: The compiler would generate incorrect code for the
    following type of expression: Pattern = BoundVar1 = . . . =
    BoundVarN = Expression An exception should be raised if any of
    the bound variables have different values than Expression. The
    compiler would generate code that would cause the bound
    variables to be bound to the value of Expressionwhether the
    value matched or not.
  * xmerl: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * megaco: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * debugger: Fixed a bug that would cause analysis to crash.
  * erts: Fixed a bug on Windows where file:read_file_info/1 would
    fail for files with corrupt metadata.
  * erts: Fix process_info(_, binary) to again include "writable
    binaries" which were lost in OTP-25.0. Writable binaries are an
    optimization used when binaries are appended upon in a loop.
  * erts: Fix rare race when receiving fragmented messages on a
    terminating connection. Could potentially cause memory leaks as
    well as double free crashes. Bug exists since OTP 22.0.
  * erts: Fixed bug that could maybe cause problems when a file
    descriptor number is closed by a linked in driver and then
    opened (reused) and passed to enif_select by a NIF. No actual
    symptoms seen, only failed internal assertions in debug build.
  * erts: The runtime system could crash when tracing a process
    executing on a dirty scheduler.
  * erts: In the binary syntax, attempting to match out integers
    with size exceeding 2 GiB could crash the runtime system.
  * erts: Fixed edge case in floating-point negation where A = 0.0,
    B = -A did not produce B = -0.0 on x86_64 JIT.
  * erts: Fixed an issue in the JIT that could crash the emulator
    on some platforms.
  * erts: Added meta data to the windows installer.
  * erts: Fixed ETS insertion order into bag and duplicate_bag of
    tuples with identical keys when passed in a list to
    ets:insert/2. The insert order has been head-to-tail but was
    accidentally changed in OTP 23.0. For bag it was reverted
    (tail-to-head), while for duplicate_bag it was sometimes
    reverted depending on the length of the list and number of
    "reductions" left for the calling process. This fix changes the
    insert order of ets:insert/2 back to always be head-to-tail of
    the list argument.
  * erts: With the JIT for AArch64 (AMD64), calling bxor in with
    non-integer arguments in a guard would crash the runtime
    system.
  * erts: Fix bug regarding process flag max_heap_size. Could cause
    strange behavior when a process was killed due to exceeding the
    limit.
  * erts: Fixed binary comprehensions to be similar to other
    creation of binary data with respect to its contribution of
    triggering garbage collection.
  * erts: In rare circumstances, when a process exceeded its
    allowed heap size set by option max_heap_size, it would not be
    killed as it should be, but instead enter a kind of zombie
    state it would never get out of.
  * erts: Instead of crashing, the list_to_integer/1 and
    list_to_integer/2 BIFs now raise the system_limit exception for
    overlong lists that can't be converted to integers. Similarly,
    the string:to_integer/1 BIF now returns {error,system_limit}
    for overlong lists.
  * erts: Active process aliases of a process at its termination
    leaked memory.
  * erts: Support for fully asynchronous distributed signaling
    where send operations never block. This functionality is by
    default disabled and can be enabled per process. For more
    information see the documentation of process_flag(async_dist,
    Bool).
  * erts: Added the +JPperf no_fp option to explicitly disable
    Erlang frame pointers otherwise added when using the +JPperf
    map option.
  * erl_interface: Accept connection setup from OTP 23 and 24 nodes
    that are not using epmd.
  * erl_interface: The ei API for decoding/encoding terms is not
    fully 64-bit compatible since terms that have a representation
    on the external term format larger than 2 GB cannot be handled.
  * syntax_tools: erl_syntax_lib:annotate_bindings/1,2 will now
    properly annotate named functions and their arguments.
  * kernel: Fixed a bug on Windows where file:read_file_info/1
    would fail for files with corrupt metadata.
  * kernel: Accept connection setup from OTP 23 and 24 nodes that
    are not using epmd.
  * public_key: As different solutions of verifying certificate
    revocation exists move the decode of 'CRLDistributionPoints' so
    that it will only be decode. When it is actually used in the
    verification process. This would enable interoperability with
    systems that use certificates with an invalid empty
    CRLDistributionPoints extension that they want to ignore and
    make verification by other means.
  * public_key: public_key:pkix_path_validation validates
    certificates expiring after 2050
  * public_key: Do not leave exit message in message queue after
    calling cacerts_load() on MacOS.
  * public_key: Replace size/1 with either tuple_size/1 or
    byte_size/1 The size/1 BIF is not optimized by the JIT, and its
    use can result in worse types for Dialyzer. When one knows that
    the value being tested must be a tuple, tuple_size/1 should
    always be preferred. When one knows that the value being tested
    must be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * ssl: Fixed that new dtls connections from the same client ip
    port combination works. If there is a process waiting for
    accept the new connection will connect to that, otherwise it
    will try to re-connect to the old server connection.
  * ssl: When shutting down a node that uses SSL distribution
    (-proto_dist inet_tls), a confusing error message about an
    unexpected process exit was printed. This particular message is
    no longer generated.
  * ssl: fixes the type spec for ssl:format_error/1
  * ssl: Replace size/1 with either tuple_size/1 or byte_size/1 The
    size/1 BIF is not optimized by the JIT, and its use can result
    in worse types for Dialyzer. When one knows that the value
    being tested must be a tuple, tuple_size/1 should always be
    preferred. When one knows that the value being tested must be a
    binary, byte_size/1 should be preferred. However, byte_size/1
    also accepts a bitstring (rounding up size to a whole number of
    bytes), so one must make sure that the call to byte_size/ is
    preceded by a call to is_binary/1 to ensure that bitstrings are
    rejected. Note that the compiler removes redundant calls to
    is_binary/1, so if one is not sure whether previous code had
    made sure that the argument is a binary, it does not harm to
    add an is_binary/1 test immediately before the call to
    byte_size/1.
  * jinterface: Accept connection setup from OTP 23 and 24 nodes
    that are not using epmd.
  * os_mon: The port programs used by cpu_sup and memsup are now
    gracefully shut down when cpu_sup and memsup are shut down.
  * eunit: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * crypto: A user defined runtime library path configured using
  - -with-ssl-rpath=&lt;PATHS&gt; could fail to be enabled.
  * crypto: Ensure that configure fails if a user defined runtime
    library path has been passed by the user, but cannot set.
  * mnesia: Improved consistency for dirty writes when a table was
    added with add_table_copy/3. Fixed a problem with sticky write,
    which could lead to inconsistent data.
  * mnesia: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * common_test: Renamed undocumented macro CT_PEER/3 to
    CT_PEER_REL/3.
  * ssh: With this change, PKCS8 formatted private key file is
    properly decoded and SSH daemon with such key can be started.
  * ssh: Replace size/1 with either tuple_size/1 or byte_size/1 The
    size/1 BIF is not optimized by the JIT, and its use can result
    in worse types for Dialyzer. When one knows that the value
    being tested must be a tuple, tuple_size/1 should always be
    preferred. When one knows that the value being tested must be a
    binary, byte_size/1 should be preferred. However, byte_size/1
    also accepts a bitstring (rounding up size to a whole number of
    bytes), so one must make sure that the call to byte_size/ is
    preceded by a call to is_binary/1 to ensure that bitstrings are
    rejected. Note that the compiler removes redundant calls to
    is_binary/1, so if one is not sure whether previous code had
    made sure that the argument is a binary, it does not harm to
    add an is_binary/1 test immediately before the call to
    byte_size/1.
  * inets: With this change, handling of URI to a folder, with
    missing trailing / and a query component present is fixed.
  * inets: Adds more type information to the inets app, thus
    improving the errors that static analysis tools can detect. The
    addition of type information to records and the updates to
    function heads help static analysis tools to understand that
    some values in the records cannot be 'undefined', thus making
    static tools to type check correctly more modules in the inets
    app
  * inets: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * snmp: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * ftp: Replace size/1 with either tuple_size/1 or byte_size/1 The
    size/1 BIF is not optimized by the JIT, and its use can result
    in worse types for Dialyzer. When one knows that the value
    being tested must be a tuple, tuple_size/1 should always be
    preferred. When one knows that the value being tested must be a
    binary, byte_size/1 should be preferred. However, byte_size/1
    also accepts a bitstring (rounding up size to a whole number of
    bytes), so one must make sure that the call to byte_size/ is
    preceded by a call to is_binary/1 to ensure that bitstrings are
    rejected. Note that the compiler removes redundant calls to
    is_binary/1, so if one is not sure whether previous code had
    made sure that the argument is a binary, it does not harm to
    add an is_binary/1 test immediately before the call to
    byte_size/1.
  * dialyzer: Fixed a bug that would cause analysis to crash.
  * dialyzer: Replace size/1 with either tuple_size/1 or
    byte_size/1 The size/1 BIF is not optimized by the JIT, and its
    use can result in worse types for Dialyzer. When one knows that
    the value being tested must be a tuple, tuple_size/1 should
    always be preferred. When one knows that the value being tested
    must be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * tftp: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
- Changes for 25.2.3:
  * erts: Comparisons between small numbers and pids or ports would
    in some edge cases say that the number was greater than the pid
    or port, violating the term order.
  * erts: process_info(Pid, status) when Pid /= self() could return
    an erroneous result.
  * ssl: Maximize compatibility by ignoring change_cipher_spec
    during handshake even if middle_box_mode is not negotiated
    (mandated by client)
  * ssl: Move assert of middlebox message after an
    hello_retry_request to maximize interoperability. Does not
    changes semantics of the protocol only allows unexpected
    message delay from server.
  * ssh: With this change, ssh application does not crash when
    formatting some of info reports for unsuccessful connections.
  * ssh: With this change, ssh does not log extensively long
    messages.
  * inets: Ensure graceful shutdown
  * inets: Return type of the type specification for function
    httpc:cookie_header/{1,2,3} has been fixed from -spec
    cookie_header(url()) -&gt; [{ field(), value() }] | {error,
    Reason} to -spec cookie_header(url()) -&gt; { field(), value() } |
    {error, Reason}
- Changes for 25.2.2:
  * ftp: Fixes calls to ftp:nlist/2 returning {error, epath} when
    the file / folder exists
- Changes for 25.2.1:
  * compiler: Fixed a bug that could cause legal code to fail
    validation.
  * compiler: Eliminated a rare crash in the beam_types module.
  * erts: Fixed a bug in selective receive optimization that could
    crash 32-bit emulators.
  * erts: A race condition which was very rarely triggered could
    cause the signal queue of a process to become inconsistent
    causing the runtime system to crash.
  * kernel: The tcp connect option 'bind_to_device' could not be
    used with inet_backend = 'socket'. 'inet' requires value type
    binarry() and 'socket' requires value type 'string()'.
  * kernel: Minor issue processing options when calling
    gen_tcp:connect with a sockaddr() and inet_backend = socket.
  * common_test: Change timeout to infinity for gen_server calls in
    cth_log_redirect
  * inets: fixes a missing case of the type specification for
    httpd:info/2/3/4
  * snmp: Single threaded agent crash when vacm table not properly
    initiated.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1683460800">- Changes for 25.3.2:
  * compiler: Fixed type handling bugs that could cause an internal
    error in the compiler for correct code.
  * os_mon: Avoid error report from failing erlang:port_close at
    shutdown of cpu_sup and memsup. Bug exists since OTP 25.3
    (os_mon-2.8.1).
  * erts: If a runtime system which was starting the distribution
    already had existing pids, ports, or references referring to a
    node with the same nodename/creation pair that the runtime
    system was about to use, these already existing pids, ports, or
    references would not work as expected in various situations
    after the node had gone alive. This could only occur if the
    runtime system was communicated such pids, ports, or references
    prior to the distribution was started. That is, it was
    extremely unlikely to happen unless the distribution was
    started dynamically and was even then very unlikely to happen.
    The runtime system now checks for already existing pids, ports,
    and references with the same nodename/creation pair that it is
    about to use. If such are found another creation will be chosen
    in order to avoid these issues.
- Changes for 25.3.1:
  * snmp: Attempts to minimize the number of the error reports
    during a failed agent init.
  * compiler: When a map update such as #{}#{key:=value} that
    should fail with an exception was unused, the exception would
    be lost.
  * compiler: Fixed bug in the validator that made it reject valid
    code.
  * crypto: With this change, random errors are fixed for
    crypto:generate_key calls with OpenSSL 3.
  * erts: Fixed a bug in the loader that prevented certain modules
    compiled with no_ssa_opt from being loaded.
  * erts: Implementations of the call() driver callback that
    returned a faulty encoded result could cause a memory leak and
    could cause invalid data on the heap of the processes calling
    erlang:port_call/3.
  * erts: Fixed a memory corruption issue when upgrading code. The
    bug was introduced in OTP 25.3
  * erts: Fixed configure tests for a few ARM-specific
    instructions, which prevented the emulator from being built on
    some platforms.
  * erts: Aliases created in combination with a monitor using the
    {alias, explicit_unalias} option stopped working from remote
    nodes when a 'DOWN' signal had been received due to the monitor
    or if the monitor was removed using the erlang:demonitor() BIF.
    This bug was introduced in OTP 24.3.4.10 and OTP 25.3.
  * erts: In rare circumstances, bit syntax matching of an invalid
    code point for a utf32 would crash the runtime system.
  * erts: Building the runtime system failed when native atomic
    support was missing. Note that execution on such systems have
    only been rudimentary tested.
  * erl_interface: Fixed configure tests for a few ARM-specific
    instructions, which prevented the emulator from being built on
    some platforms.
  * eldap: Added a new function eldap:info/1 that returns the
    socket and the transport protocol for the eldap connection.
  * inets: Correct timing related pipelining/keepalive queue bug,
    that could result in unexpected "socket_remotly_closed" errors.
  * inets: With this change, upon remote socket closure current
    request is added to a retried queue (either pipeline or
    keep_alive, but not both).
  * ssl: With this change, ssl:connection_information/2 returns
    correct keylog data after TLS1.3 key update.
  * ssl: Client signature algorithm list input order is now honored
    again , it was accidently reversed by a previous fix.
  * stdlib: The type specs in the erl_parse module has been updated
    to include the maybe construct and the ! operator.
  * wx: Improve debug prints from the nifs. Some minor fixes for
    wxWidgets-3.2. Fixed OpenGL debug functions.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1687521600">- Changes for 25.3.2.2:
  * compiler: The compiler could be very slow when compiling guards
    with multiple guard tests separated with 'or' or ';'.
- Changes for 25.3.2.1:
  * xmerl: New options to xmerl_scan and xmerl_sax_parser so one
    can limit the behaviour of the parsers to avoid some XML
    security issues. xmerl_scan gets one new option:
    xmerl_sax_parser gets the following options: The old option
    skip_external_dtd is still valid and the same as
    {external_entities, none} and {fail_undeclared_ref, false} but
    just affects DTD's and not other external references.
  * erts: Fixed a crash during tracing on certain platforms that
    cannot use the machine stack for Erlang code (mainly OpenBSD
    and Linux with musl).
  * erts: Constructing a binary segment not aligned with a byte
    boundary, with a size not fitting in 31 bits, and with a value
    not fitting in a 64-bit word could crash the runtime system.
  * erts: Further robustify implementation of large maps (&gt; 32
    keys). Keys that happen to have same internal 32-bit hash
    values are now put in collision nodes which are traversed with
    linear search. This removes the demand for the internal hash
    function when salted to eventually produce different hashes for
    all possible pairs of unequal terms.
  * stdlib: Static supervisors are very idle processes after they
    have started so they will now be hibernated after start to
    improve resource management.
  * compiler: Fixed a bug where a failing bsl expression in a guard
    threw an exception instead of causing the guard to fail.
  * compiler: Complex guard expression using the or operator and
    guard BIFs that can fail could sometimes be miscompiled so that
    the guard would succeed even if a call to a guard BIF failed.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1687608000">- Version 26.0:
  * Leex has been extended with optional column number support.
  * The family of enumeration functions in module lists has been
    extended with enumerate/3 that allows a step value to be
    supplied.
  * Update Unicode to version 15.0.0.
  * proc_lib:start*/* has become synchronous when the started
    process fails. This requires that a failing process use a new
    function proc_lib:init_fail/2,3, or exits, to indicate failure. All
    OTP behaviours have been fixed to do this.
  * auto-complete of variables, record names, record fields names,
    map keys, function parameter types and filenames.
  * Open external editor in the shell to edit the current
    expression.
  * defining records (with types), functions, specs and types in
    the shell.
  * Creation and matching of binaries with segments of fixed sizes
    have been optimized.
  * Creation and matching of UTF-8 segments have been optimized.
  * Appending to binaries has been optimized.
  * The compiler and JIT now generate better code for creation of
    small maps where all keys are literals known at compile time.
  * Thanks to the optimizations above the performance of the base64
    module has been significantly improved. For example, on an
    x86_64 system with the JIT both encode and decode are almost
    three times faster than in Erlang/OTP 25.
  * Map comprehensions as suggested in EEP 58 has now been
    implemented.
  * Some map operations have been optimized by changing the
    internal sort order of atom keys. This changes the
    (undocumented) order of how atom keys in small maps are printed
    and returned by maps:to_list/1 and maps:next/1. The new order
    is unpredictable and may change between different invocations
    of the Erlang VM.
  * Introducing the new function maps:iterator/2 for creating an
    interator that return the map elements in a deterministic
    order. There are also new modifiers k and K for the format
    string in io:format() to support printing map elements ordered.
  * Added the new built-in type dynamic() introduced in EEP 61, PR
    introducing EEP 61 improving support for gradual type checkers.
  * Dialyzer has a new incremental mode that be invoked by giving
    the --incremental option when running Dialyzer. This new
    incremental mode is likely to become the default in a future
    release.
  * Multi time warp mode is now enabled by default. This assumes
    that all code executing on the system is time warp safe.
  * Support for UTF-8 atoms and strings in the NIF interface
    including new functions enif_make_new_atom,
    enif_make_new_atom_len and enif_get_string_length.
  * The BIFs min/2 and max/2 are now allowed to be used in guards
    and match specs.
  * Improved the selective receive optimization, which can now be
    enabled for references returned from other functions. This
    greatly improves the performance of gen_server:send_request/3,
    gen_server:wait_response/2, and similar functions.
  * It is no longer necessary to enable a feature in the runtime
    system in order to load modules that are using it. It is
    sufficient to enable the feature in the compiler when compiling
    it.
  * inet:setopts/2 has got 3 new options: reuseport, reuseport_lb
    and exclusiveaddruse.
  * Fix so that -fno-omit-frame-pointer is applied to all of the
    Erlang VM when using the JIT so that tools, such as perf, can
    crawl the process stacks.
  * In the lists module, the zip family of functions now takes
    options to allow handling lists of different lengths.
  * Added the zip:zip_get_crc32/2 function to retrieve the CRC32
    checksum from an opened ZIP archive. gen_server optimized by
    caching callback functions
  * The modules Erlang DNS resolver inet_res and helper modules
    have been updated for RFC6891; to handle OPT RR with DNSSEC OK
    (DO) bit.
  * Introduced application:get_supervisor/1.
  * Cache OTP boot code paths, to limit how many folders that are
    being accessed during a module lookup. Can be disabled with
  - cache_boot_path false.
  * Support for Kernel TLS (kTLS), has been added to the SSL
    application, for TLS distribution (-proto_dist inet_tls), the
    SSL option {ktls, true}.
  * Improved error checking and handling of ssl options.
  * Mitigate memory usage from large certificate chains by lowering
    the maximum handshake size. This should not effect the common
    cases, if needed it can be configured to a higher value.
  * For security reasons the SHA1 and DSA algorithms are no longer
    among the default values.
  * Add encoding and decoding of use_srtp hello extension to
    facilitate for DTLS users to implement SRTP functionality.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1687608001">- Changes for 26.0.1:
  * erts: Build of the socket nif failed on Solaris 11.
  * erts: Fixed two reduction-counting bugs relating to binaries.
  * erts: Constructing a binary segment not aligned with a byte
    boundary, with a size not fitting in 31 bits, and with a value
    not fitting in a 64-bit word could crash the runtime system.
  * erts: When a binary construction failed because of bad size for
    a segment, the error information was not always correct.
  * erts: Fixed a crash when calling a fun that was defined in a
    module that had been upgraded.
  * kernel: The POSIX error exdev was sometimes incorrectly
    described as "cross domain link" in some error messages.
  * kernel: Corrected the socket send function description (send
    with Timeout = nowait). The send function(s) could not return
    {ok, {RestData, SelectInfo}}
  * stdlib: The POSIX error exdev was sometimes incorrectly
    described as "cross domain link" in some error messages.
  * ssl: Make sure that selection of client certificates handle
    both TLS-1.3 and TLS-1.2 names correctly. Could cause valid
    client certificate to not be selected, and an empty client
    certificate message to be sent to server.
  * ssl: Improved ssl:format_error/1 to handle more error tuples.
  * ssl: Fixed hanging ssl:connect when ssl application is not
    started.
  * ssl: Correct handling of retransmission timers, current
    behavior could cause unwanted delays.
  * inets: Do not make the default ssl options by calling
    httpc:ssl_verify_host_options(true) if ssl options are supplied
    by the user.
  * xmerl: New options to xmerl_scan and xmerl_sax_parser so one
    can limit the behaviour of the parsers to avoid some XML
    security issues. xmerl_scan gets one new option:
    xmerl_sax_parser gets the following options: The old option
    skip_external_dtd is still valid and the same as
    {external_entities, none} and {fail_undeclared_ref, false} but
    just affects DTD's and not other external references.
  * compiler: Fixed a bug where a failing bsl expression in a guard
    threw an exception instead of causing the guard to fail.
  * compiler: Fixed a bug that would case the validator to reject
    legal code.
  * compiler: The compiler could re-order clauses matching binaries
    so that the incorrect clause would match. That could only
    happen for code that used the option {error_location,line} or
    for code without line or column number information (e.g.
    generated by a parse transform).
  * compiler: Complex guard expression using the or operator and
    guard BIFs that can fail could sometimes be miscompiled so that
    the guard would succeed even if a call to a guard BIF failed.
  * compiler: With optimizations disabled, a try/catch construct
    could return an incorrect value.
  * compiler: In rare circumstance, a combination of binary
    construction and binary_part/3 would cause the compiler to
    generate unsafe code that would crash the runtime system.
  * compiler: The compiler could be very slow when compiling guards
    with multiple guard tests separated with 'or' or ';'.
  * compiler: Complex guard expressions using 'or' and map updates
    could succeed even if the map update failed.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1698235200">- Changes for 26.1.2:
  * erts: If the external term format encoding of an argument list
    part of a distributed spawn operation was faulty, the newly
    spawned remote process could misbehave. The misbehavior
    included hanging or interpret an incoming message as an
    argument list to use. This was very unlikely to happen unless
    using an alternate implementation of the distribution protocol
    which made a faulty encoding of the argument list. The child
    process will now detect this error and terminate before
    executing the user specified code.
  * erts: Fix bugs where if the body of a matchspec would return a
    map with a variable ('$1', '$_' etc) as one of the keys or
    values and the variable was not an immidiate, the term would
    not be copied to the receiving processes heap. This would later
    corrupt the term in the table as the GC could place move
    markers in it, which in turn would cause the VM to crash. Bug
    has been present for since OTP 17.0.
  * xmerl: The xmerl version 1.3.32 was released in OTP 26.0.1, but
    the incorrect version number of 1.3.31.1 was used for it. This
    incorrect version number continued to appear in OTP 26.0.2, OTP
    26.1, and OTP 26.1.1. The actual xmerl code in these OTP
    versions however corresponds to xmerl version 1.3.32.
- Changes for 26.1.1:
  * wx: The wx application would fail to build on macOS with Xcode
    15.
  * compiler: The compiler could become extremely slow for modules
    containing huge functions.
  * stdlib: Garbage collect the shell process when reducing the
    amount of saved history and results.
- Changes for 26.1:
  * crypto: Fix VM crash caused by crypto being purged and reloaded
    (by init:restart for example) on OS with musl libc (such as
    Alpine linux).
  * crypto: Improved understanding of LibreSSL versions. Support
    chacha20 and chacha20_poly1305 for LibreSSL 3.7. Reflect
    removal of support for the DSS/DSA algorithm which was done in
    LibreSSL 2.6.1.
  * crypto: FIPS supported by crypto for OpenSSL 3.0.* and 3.1.*.
  * asn1: The ASN.1 compiler would ignore a constraint such as
    (SIZE (1..4), ...), causing incorrect behavior of the encoding
    and decoding function for the PER and UPER backends. Corrected
    to handle the constraint in the same way as (SIZE (1..4, ...)).
  * asn1: The JER backend has been internally refactored in a way
    that is compatible for applications that use the documented
    API. However, for a group of ASN.1 modules that depend on each
    other (for example, S1AP-PDU-Descriptions, S1AP-Contents, and
    so on), all modules in the group must be recompiled if on of
    the group members is recompiled.
  * observer: Closing the trace log window via the menu did not
    work.
  * erts: maps:put with existing key and identical value was not
    optimized as a no-op correctly if having the same 32-bit hash
    as another key in the map. In practice very rare and harmless.
  * erts: Fixed an issue with truncated crash slogans on failed
    emulator start.
  * erts: Fixed a bug where the emulator was unable to determine
    the current cgroup CPU quota.
  * erts: A process optimized for parallel signal delivery could
    under some circumstances lose wakeup information. That is, the
    processes was not woken up to take care of the signal, so the
    signal would not be taken care of until the process was woken
    by another signal. Only processes configured with
    message_queue_data set to off_heap utilize this optimization.
  * erts: Function socket:close/1 could cause a VM crash on
    Windows.
  * erts: Fixed a bug in the ARM JIT where it could accidentally
    add garbage trailing bits when creating bitstrings whose size
    wasn't an even multiple of 8 bits.
  * erts: Fix erlang:system_info/1 documentation to show correct
    types.
  * erts: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * erts: Fix compilation with GNU termcap.
  * erts: Delivery time of message signals to a process not
    executing any receive expressions could become very long,
    potentially infinite. For example, a process checking for
    messages using process_info(self(), message_queue_len) or
    process_info(self(), messages) and avoiding to execute a
    receive expression matching on messages could be very slow in
    detecting new messages. Note that you are still discouraged
    from using process_info() this way. A process that wants to
    check if there are messages available to handle should execute
    a receive expression matching on messages.
  * erts: On AArch64 (ARM64), when calculating both the quotient
    and remainder with a divisor begin a power two, the remainder
    could be incorrectly calculated.
  * erts: Fix bug causing "magic" references in a compressed ETS
    table to not keep the referred object alive. The symptom would
    be the referred object being garbage collected prematurely and
    the reference appearing stale, not referring to anything.
    Examples of such magically referred objects are atomics and NIF
    resources.
  * erts: Matching out short bitstrings with a fixed size not
    divisible by 8 could could lead to the runtime system
    terminating with an "Overrun heap and stack" error.
  * erts: A constant flow of incoming non-message signals could
    prevent a process needing to execute dirty from doing so.
  * erts: A BEAM file usually contains a chunk with the tag "Type"
    containing type information that can be used by the JIT. The
    beam_lib:strip/1 takes care to preserve that chunk, but a
    build/release tool that does customized stripping could
    accidentally remove the chunk. Loading a BEAM file without the
    "Type" chunk could cause incorrect behavior of the loaded code.
  * erts: gen_udp:recv/* for Unix Domain Socket in binary mode and
    passive mode has been fixed to not crash.
  * erts: The cleanup operation of not yet delivered signals to a
    terminated process yielded excessively.
  * erts: Fixed minor hashing issue with the local option of
    term_to_binary()/term_to_iovec().
  * erts: Update gen_tcp_socket and gen_udp_socket to handle
    'completion' (socket on Windows).
  * erts: Add support for Unix Domain Sockets (only for STREAM
    sockets) on Windows for 'socket'.
  * erts: In Erlang/OTP 27, by default escripts will be compiled
    before being executed. That means that the compiler application
    must be installed. It is possible to force the escript to be
    interpreted by adding the directive -mode(interpret). to the
    escript file. In Erlang/OTP 28, support for interpreting an
    escript will be removed.
  * erts: Add basic support for socket ioctl on Windows.
  * erts: Removed erts/etc/darwin/Info.plist, as it is no longer
    necessary after macos 10.12
  * erts: Add support for (Windows) socket option exclusiveaddruse.
  * erts: [socket] Add support for the 'nopush' option.
  * erts: Add support for socket option 'BSP STATE'.
  * erts: Add tcp socket options 'keepcnt', 'keepidle' and
    'keepintvl'.
  * erts: Add support for misc (Windows) socket options
    ('max_msg_size' and 'maxdg').
  * compiler: The compiler could run forever when compiling a call
    to is_record/3 with a huge positive tuple size. The call
    is_record(A, a, 0) would crash the compiler when used in a
    function body. When used in a guard the compiler would emit
    incorrect code that would accept {a&gt; as a record.
  * compiler: Fixed a bug that caused dialyzer to crash when
    analyzing bogus code that contained the literal atom undefined
    in segment sizes.
  * compiler: The compiler would crash when compiling some modules
    that contained a call to erlang:load_nif/2.
  * compiler: Fixed a bug that caused the compiler to crash on
    legal code.
  * compiler: The compiler could crash when attempting to compile a
    call to is_list/1 in a complex expression.
  * compiler: A complex guard expression using the or operator
    could succeed when it was supposed to fail.
  * compiler: Compiling nested try/catch and catch expression could
    result in an internal compiler error.
  * compiler: Using the bnot operator in a complex expression could
    cause the compiler to terminate with an internal consistency
    failure diagnostic.
  * compiler: Fixed a bug that caused the compiler to crash in a
    binary optimization pass.
  * compiler: The compiler could terminate with an internal error
    when attempting to compile a binary pattern that could not
    possibly match.
  * compiler: Fixed various performance issues related to the alias
    optimization pass.
  * erl_docgen: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * mnesia: Do not delete old backup file if the new backup fails.
  * megaco: Make megaco transports handle gen_tcp | gen_udp with
    socket backend on Windows (completion).
  * common_test: With this change, ct_hooks manual refers to CTH
    execution order section in user guide.
  * common_test: With this change, Config data from
    pre_end_per_testcase hook is delivered to post_end_per_testcase
    callback in case of testcase timetrap or linked process crash.
  * common_test: With this change, remaining references to not
    supported vts tool in ct_run are removed (mainly relates to
    docs and ct_run help message).
  * common_test: With this change, prompt search functionality in
    ct_telnet handles unicode input.
  * common_test: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * stdlib: The compiler could run forever when compiling a call to
    is_record/3 with a huge positive tuple size. The call
    is_record(A, a, 0) would crash the compiler when used in a
    function body. When used in a guard the compiler would emit
    incorrect code that would accept {a&gt; as a record.
  * stdlib: Fix bug in ets:tab2file that could make it fail if
    another Erlang process created the same file at the same time.
  * stdlib: An {else_clause,Value} exception will now be reported
    nicely in the shell.
  * stdlib: Correct return value for error case, so that it matches
    the documented and intended return value {error,
    {already_started, pid()} when local registered names are used.
  * stdlib: sys:get_state/1,2 and sys:replace_state/2,3 has been
    corrected to handle a state named error as a state name, not as
    a failed system callback. For the standard server behaviours
    this was an issue only for gen_statem (and gen_fsm) when the
    state name was error, and for gen_server if the complete state
    was {error,_}.
  * stdlib: Multiple problems were fixed in
    filelib:safe_relative_path/2. If its second argument was a path
    that contained symbolic links, an incorrect result patch could
    be returned. Also, paths were sometimes falsely considered
    unsafe.
  * stdlib: Fix deadlock when erl.exe is used as part of a pipe on
    Windows and trying to set the encoding of the standard_io
    device.
  * stdlib: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * stdlib: Fix h/2,3 to properly render multi-clause
    documentation.
  * stdlib: Timers created by timer:apply_after/4,
    apply_interval/4, and apply_repeatedly/4 would silently fail to
    do the apply if it was not possible to spawn a process when the
    timer expired. This has now been corrected, and if the spawn
    fails, the system will be taken down producing a crash dump.
  * stdlib: When an Erlang source file lacked a module definition,
    there would be a spurious "module name must not be empty"
    diagnostic for each spec in the file.
  * stdlib: The argument descriptions for option types in argparse
    have been made less ambiguous.
  * stdlib: Clarified the documentation of normal shutdown reason
    on gen_server:call/2,3
  * stdlib: Pattern matching and equivalence (=:=, =/=) comparisons
    on 0.0 will now raise a warning, as it will no longer be
    considered equivalent to -0.0 in OTP 27. If a match on 0.0
    specifically is desired (distinct from -0.0), the warning can
    be suppressed by writing +0.0 instead. The arithmetic
    comparison operators are unaffected, including arithmetic
    equality (==). *** POTENTIAL INCOMPATIBILITY ***
  * stdlib: The semantics of the gen_{server,statem,event}
    behaviour's synchronous start behaviour introduced in OTP-26.0
    with OTP-18471, has been clarified in the documentation.
  * stdlib: Added functionality to set a custom multiline prompt.
  * stdlib: A warning for (accidental use of) Triple-Quoted Strings
    has been implemented as per EEP 64. *** POTENTIAL
    INCOMPATIBILITY ***
  * stdlib: The keyboard shortcuts for the shell are now
    configurable.
  * kernel: Fixed an issue with truncated crash slogans on failed
    emulator start.
  * kernel: Fix shell:start_interactive function specification.
  * kernel: Fix code:get_doc/1 to return missing, when it can't
    find erts instead of crashing.
  * kernel: Function socket:close/1 could cause a VM crash on
    Windows.
  * kernel: Fix deadlock when erl.exe is used as part of a pipe on
    Windows and trying to set the encoding of the standard_io
    device.
  * kernel: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * kernel: Fix logger's overload protection mechanism to only
    fetch memory used by messages when needed.
  * kernel: Fixed a number of socket-related issues causing
    incompatibilities with gen_tcp and gen_udp respectively.
  * kernel: gen_tcp:connect with socket address and socket (inet-)
    backend fails because of missing callback function.
  * kernel: The DNS RR cache used by `inet_res` has been fixed to
    preserve insert order, which is beneficial when the DNS server
    returns RRs in some specific order for e.g load balancing
    purposes.
  * kernel: The options `reuseport`, `reuseport_lb` and
    `exclusiveaddruse` were accidentally not allowed for e.g
    `gen_udp:open/1,2`, which has now been corrected.
  * kernel: gen_udp:recv/* for Unix Domain Socket in binary mode
    and passive mode has been fixed to not crash.
  * kernel: Fixed issue where cursor would not be placed at the end
    of the expression when navigating shell history.
  * kernel: Update gen_tcp_socket and gen_udp_socket to handle
    'completion' (socket on Windows).
  * kernel: Add support for Unix Domain Sockets (only for STREAM
    sockets) on Windows for 'socket'.
  * kernel: Add basic support for socket ioctl on Windows.
  * kernel: The file:location/0 type is now exported.
  * kernel: Add support for (Windows) socket option
    exclusiveaddruse.
  * kernel: [socket] Add support for the 'nopush' option.
  * kernel: Add support for socket option 'BSP STATE'.
  * kernel: Add tcp socket options 'keepcnt', 'keepidle' and
    'keepintvl'.
  * kernel: Add support for misc (Windows) socket options
    ('max_msg_size' and 'maxdg').
  * kernel: The keyboard shortcuts for the shell are now
    configurable.
  * kernel: Optimized code_server to reduce repeated work when
    loading the same module concurrently.
  * debugger: The call int:no_break(Module) did not remove any
    breakpoints.
  * debugger: The maybe expression is now supported in the
    Debugger.
  * debugger: The maybe expression is now supported in the
    Debugger.
  * debugger: The call int:no_break(Module) did not remove any
    breakpoints.
  * ssl: Avoid function clause error in ssl:getopts/2 by handling
    that inet:getopts may return an empty list during some
    circumstances, such as the socket being in a closing state.
  * ssl: The API function `ssl:recv/3` has been tightened to
    disallow negative length, which has never been documented to
    work, but was passed through and caused strange errors.
  * ssl: When a client initiated renegotiation was rejected and the
    client socket was in active mode the expected error message to
    the controlling process was not sent.
  * ssl: Add some guidance for signature algorithms configuration
    in ssl applications users guide.
  * snmp: Make snmp handle gen_udp with socket backend on Windows
    (completion).
  * public_key: Country name comparison shall be case insensitive
  * public_key: Add check to disallow duplicate certs in a path
  * inets: With this change, re_write httpd works as expected and
    does not return error.
  * inets: Fixed a bug so httpd does not crash when stopped at the
    wrong time during TLS connection negotiation, or any other
    theoretically as slow connection setup.
  * inets: Enhance error handling and avoid that the HTTP client
    hangs on headers provided on the wrong format.
  * inets: With this change, error report generated by httpd during
    connection setup contains socket type information.
  * inets: Stop and restart of the httpd server in the Inets
    application has been refactored to a more synchronous and OTP
    supervisor friendly approach. This should increase stability
    and for example avoid a supervisor report from
    httpd_connection_sup about killed child process(es) in some
    cases when stopping or restarting httpd.
  * dialyzer: Fixed a bug that caused dialyzer to crash when
    analyzing bogus code that contained the literal atom undefined
    in segment sizes.
  * dialyzer: Dialyzer could crash when attempting to analyze a
    module that defined a type called product/.
- Changes for 26.0.2:
  * erts: Fix using the IME (Input Method Editor) to enter text in
    cmd.exe and powershell.exe on Windows.
  * erts: Multiple socket:accept calls issue. When making multiple
    accept calls, only the last call is active.
  * erts: Fix the shell to ignore terminal delay when the terminal
    capabilities report that they should be used.
  * erts: Fix "oldshell" to echo characters while typing on
    Windows.
  * erts: On Windows, a call to the function socket:close, when
    there are waiting active calls to read, write or accept
    functions, could hang.
  * erts: Fix issues when reading or configuring standard_io on
    Windows when erl.exe is started using -noshell flag.
  * erts: The following functions are now much faster when given a
    long list or binary:
  * erts: On AArch64 (ARM64), equality and non-equality tests with
    literal bitstrings could succeed when they should fail and vice
    versa.
  * compiler: Fixed a type handling bug that would cause an
    internal consistence failure for correct code.
  * compiler: Fixed a bug that could cause the stack trace of throw
    exceptions to be erroneously optimized out.
  * compiler: Complex guard expression using 'or' were not always
    fully evaluated, making guards that were supposed to fail
    succeed.
  * stdlib: Fix bug where when you entered Alt+Enter in the
    terminal, the cursor would move to the last line, instead of
    moving to the next line.
  * stdlib: Fix eof handling when reading from stdin when erlang is
    started using -noshell.
  * stdlib: Fixed problem where output would disappear if it was
    received after a prompt was written in the shell.
  * stdlib: The following functions are now much faster when given
    a long list or binary:
  * kernel: Fix bug where when you entered Alt+Enter in the
    terminal, the cursor would move to the last line, instead of
    moving to the next line.
  * kernel: Fix so that the shell does not crash on startup when
    termcap is not available.
  * kernel: Multiple socket:accept calls issue. When making
    multiple accept calls, only the last call is active.
  * kernel: Fix the shell to ignore terminal delay when the
    terminal capabilities report that they should be used.
  * kernel: Fix "oldshell" to echo characters while typing on
    Windows.
  * kernel: Fix eof handling when reading from stdin when erlang is
    started using -noshell.
  * kernel: On Windows, a call to the function socket:close, when
    there are waiting active calls to read, write or accept
    functions, could hang.
  * kernel: Fix issues when reading or configuring standard_io on
    Windows when erl.exe is started using -noshell flag.
  * kernel: gen_udp:connect with inet_backend = socket fails when
    the Address is a hostname (string or atom).
  * kernel: Fixed problem which would cause shell to crash if
    particular escape sequence was written to stdout.
  * kernel: Fixed problem where output would disappear if it was
    received after a prompt was written in the shell.
  * kernel: Fix a crash where the location of erts could not be
    found in rebar3 dev builds.
  * kernel: Introduce the KERNEL application parameter
    standard_io_encoding that can be used to set the default
    encoding for standard_io. This option needs to be set to latin1
    if the application wants to treat all input data as bytes
    rather than utf-8 encoded characters.
  * ssl: Added keylog information to all protocol versions in
    ssl:connection_information/2.
  * ssl: Add RFC-6083 considerations for DTLS to enable gen_sctp
    based callback for the transport.
  * ssh: Added multiline editing support to ssh clients connected
    through OTP ssh daemon.</changelog>
  <changelog author="sflees@suse.de" date="1704974400">- Changes for 26.2.1:
  * erts: Removed unnecessary PCRE source tar-ball.
  * ssh: With this change (being response to CVE-2023-48795),
    ssh can negotiate "strict KEX" OpenSSH extension with
    peers supporting it; also
    'chacha20-poly1305@openssh.com' algorithm becomes a
    less preferred cipher.
    If strict KEX availability cannot be ensured on both
    connection sides, affected encryption modes(CHACHA and
    CBC) can be disabled with standard ssh configuration.
    This will provide protection against vulnerability, but
    at a cost of affecting interoperability. See
    Configuring algorithms in SSH. (bsc#1218192, CVE-2023-48795)
- Changes for 26.2:
  * all: Replaced unintentional Erlang Public License 1.1
    headers in some files with the intended Apache License
    2.0 header.
  * otp: The removal of the deprecated slave module, originally
    planned for OTP 27, has been postponed to OTP 29.
  * asn1: Fix benign warning from gcc 11 about mismatching call
    to free().
  * crypto: Enable engine support for OpenSSL versions 3.
  * edoc: Emit &lt;code&gt; instead of &lt;tt&gt;.
- Disable test suite for now, it has many false positives and
  takes a very long time.</changelog>
  <changelog author="sflees@suse.de" date="1706011200">- This codestream wasn't affected by bsc#1207113</changelog>
  <changelog author="sflees@suse.de" date="1706011201">- Disable rpmlint tests on SLE-15 where they currently fail</changelog>
  <changelog author="sflees@suse.de" date="1715947200">- Create a versioned package for SLES</changelog>
</package>
<package pkgid="f24a561b7bb5147e526b5e82dff09da90e5219568724da1a2514caf11e453daa" name="erlang26" arch="s390x">
  <version epoch="0" ver="26.2.1" rel="150300.7.5.1"/>
  <changelog author="matwey.kornilov@gmail.com" date="1646568000">- Changes for 24.2.2:
  * inets: Avoid intermediate ungraceful shutdown of the HTTP
    server.
  * ssh: The ssh sever parallel_login option was missing in OTP-24</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1648382400">- Changes for 24.3.2:
  * erl_interface: Fix compile error regarding gethostbyaddr_r on
    Android. Error introduced in OTP 24.3.
  * kernel: Fix failed accepted connection setup after previous
    established connection from same node closed down silently.
  * kernel: Fixed a problem where typing Ctrl-R in the shell could
    hang if there were some problem with the history log file.
- Changes for 24.3.1:
  * dialyzer: There could be spurious warnings for unknown types
    when a type was a subtype of an existing type that was a
    subtype of an unknown type.
  * ssl: Client certification could fail for TLS-1.3 servers that
    did not include the certificat_authorties extension in its
    certificate request message.
- Changes for 24.3:
  * megaco: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.
  * megaco: Update the performance and debug chapters of the megaco
    user's guide. Also some updates to the meas tools.
  * compiler: The expression &lt;&lt;0/native-float&gt;&gt;=Bin would always
    fail to match, while &lt;&lt;0/float-native&gt;&gt;=Bin would match
    (provided that Bin contained the binary representation of 0.0)
  * compiler: The compiler will now compile huge functions with
    straight-line code faster.
  * erl_interface: Add --enable-ei-dynamic-lib configure option
    that will make erl_interface also release a dynamic library
    version of libei.
  * erl_interface: The ei API for decoding/encoding terms is not
    fully 64-bit compatible since terms that have a representation
    on the external term format larger than 2 GB cannot be handled.
  * sasl: Fix bug in systools:make_script/1 documentation.
  * inets: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.
  * inets: Documentation fix for inets:services_info/0, which now
    describes that Info might be a Reason term() in case when
    {error, Reason} is returned as service info.
  * crypto: The crypto app in OTP can since OTP-24.2 be compiled,
    linked and used with the new OpenSSL 3.0 cryptolib. The crypto
    app has 3.0 support has been improved, but is still *not
    recommended* for other usages than experiments and alpha
    testing. There are not yet any guaranties that it works, not
    even together with other OTP applications like for example SSL
    and SSH, although there are no known errors. Since the previous
    release, OTP-24.2, the following improvements have been done: -
    It has been tested during nearly every nightly test on the OTP
    lab - The hash algorithms md4 and ripemd160 have been enabled
    with OpenSSL 3.0. - The ciphers blowfish_cbc, blowfish_ecb,
    des_cbc, des_cfb, des_ecb, rc2_cbc and rc4 have been enabled
    with OpenSSL 3.0. Disabled or unsupported with OpenSSL 3.0 are
    still: - ENGINE support - FIPS mode - Other providers than the
    built-in ones - Compiling and linking with OpenSSL 3.0
    cryptolib in compatibility modes (for example to behave as
    1.1.1) and, the ciphers blowfish_cfb64 and blowfish_ofb64 are
    not supported and will not be either. Deprecated functions in
    the OpenSSL 3.0 cryptolib must not be disabled as OTP/crypto
    still uses some of the deprecated API functions. The gcc flag
  - Wno-deprecated-declarations is set to prevent deprecation
    warnings to be printed when compiling.
  * crypto: Crypto is adapted to LibreSSL 3.5.0 on OpenBSD.
  * crypto: New configure option ( --disable-otp-test-engine) to
    prohibit the build of the OTP test engine used in some test
    suites. The reason is that the test engine could be hard to
    compile on for instance LibreSSL 3.5.0. For that particular
    cryptolib version (or higher), this configure option is set
    automatically.
  * jinterface: Fix bug in OtpOutputStream.write_pid/4 and
    write_ref/3 causing faulty encodig. Bug exists since OTP 23.0.
  * wx: Removed the static_data option from wxImage creation
    functions, as it was broken and could lead to crashes. Now
    image data is always copied to wxWidgets as was the default
    behavior. Removed some non working wxGridEvent event types,
    which have there own events in newer wxWidgets versions, and
    added a couple of event types that where missing in wx.
  * asn1: Add support for the maps option in combination with the
    jer backend.
  * snmp: The compilation time is no longer recorded in BEAM files.
    There remained several undocumented functions that attempted to
    retrieve compilation times. Those have now been removed.
  * snmp: [agent] Remove expectation of socket being a port.
  * common_test: OTP internal test fix.
  * runtime_tools: Fixed bug in scheduler:utilization(Seconds) that
    would leave the scheduler_wall_time system flag incorrectly
    enabled.
  * runtime_tools: Add scheduler:get_sample/0 and get_sample_all/0.
    Also clarify scheduler module documentation about how it
    depends on system flag scheduler_wall_time.
  * erts: Fixed a bug in the x86 JIT that might cause floating
    point instructions to wrongly throw an exception.
  * erts: Preserve correct nodedown_reason if supervised
    distribution controller processes exit with {shutdown, Reason}.
  * erts: Handling of send_timeout for gen_tcp has been corrected
    so that the timeout is honored also when sending 0 bytes.
  * erts: By default global does not take any actions to restore a
    fully connected network when connections are lost due to
    network issues. This is problematic for all applications
    expecting a fully connected network to be provided, such as for
    example mnesia, but also for global itself. A network of
    overlapping partitions might cause the internal state of global
    to become inconsistent. Such an inconsistency can remain even
    after such partitions have been brought together to form a
    fully connected network again. The effect on other applications
    that expects that a fully connected network is maintained may
    vary, but they might misbehave in very subtle hard to detect
    ways during such a partitioning. In order to prevent such
    issues, we have introduced a prevent overlapping partitions fix
    which can be enabled using the prevent_overlapping_partitions
    kernel(6) parameter. When this fix has been enabled, global
    will actively disconnect from nodes that reports that they have
    lost connections to other nodes. This will cause fully
    connected partitions to form instead of leaving the network in
    a state with overlapping partitions. Note that this fix has to
    be enabled on all nodes in the network in order to work
    properly. Since this quite substantially changes the behavior,
    this fix is currently disabled by default. Since you might get
    hard to detect issues without this fix you are, however,
    strongly advised to enable this fix in order to avoid issues
    such as the ones described above. As of OTP 25 this fix will
    become enabled by default.
  * erts: Corrected the type specification of erlang:seq_trace/2.
  * erts: Fix memory leak when tracing on running on a process that
    only handle system tasks or non-message signals (for example
    process_info requests).
  * erts: Add support for using socket:sockaddr_in() and
    socket:sockaddr_in6() when using gen_sctp, gen_tcp and gen_udp.
    This will make it possible to use Link Local IPv6 addresses.
  * erts: Show on_load failure reasons in embedded mode.
  * erts: Compile date saved in the Erlang VM executable has been
    removed.
  * erts: Improve documentation for the dynamic node name feature.
  * ssh: Fix makefile dependency bugs.
  * ssh: Fixed faulty OpenSSH decoding of Ed25519/Ed448 keys in the
    OpenSSH format openssh_key_v1.
  * ssh: Correction of ssh_file typing, specially for the
    experimental openssh-key-v1 encoding.
  * ssh: Improper tag for private ED keys when encoding with
    ssh:encode/2. The tuple had ed_priv as first element, but
    should have had ed_pri. This is now corrected. *** POTENTIAL
    INCOMPATIBILITY ***
  * ssh: Add support for Ed25519/Ed448 SSH host keys in the RFC
    4716 format ("-----BEGIN EC PRIVATE KEY-----") generated by for
    example openssl or via Erlang functions (i.e.
    public_key:generate_key({namedCurve, ed25519})). Ed25519 SSH
    host keys generated by ssh-keygen was, and are still,
    supported.
  * kernel: Handling of send_timeout for gen_tcp has been corrected
    so that the timeout is honored also when sending 0 bytes.
  * kernel: By default global does not take any actions to restore
    a fully connected network when connections are lost due to
    network issues. This is problematic for all applications
    expecting a fully connected network to be provided, such as for
    example mnesia, but also for global itself. A network of
    overlapping partitions might cause the internal state of global
    to become inconsistent. Such an inconsistency can remain even
    after such partitions have been brought together to form a
    fully connected network again. The effect on other applications
    that expects that a fully connected network is maintained may
    vary, but they might misbehave in very subtle hard to detect
    ways during such a partitioning. In order to prevent such
    issues, we have introduced a prevent overlapping partitions fix
    which can be enabled using the prevent_overlapping_partitions
    kernel(6) parameter. When this fix has been enabled, global
    will actively disconnect from nodes that reports that they have
    lost connections to other nodes. This will cause fully
    connected partitions to form instead of leaving the network in
    a state with overlapping partitions. Note that this fix has to
    be enabled on all nodes in the network in order to work
    properly. Since this quite substantially changes the behavior,
    this fix is currently disabled by default. Since you might get
    hard to detect issues without this fix you are, however,
    strongly advised to enable this fix in order to avoid issues
    such as the ones described above. As of OTP 25 this fix will
    become enabled by default.
  * kernel: Fix bug where logger would crash when logging a report
    including improper lists.
  * kernel: Make erlang:set_cookie work for dynamic node names.
  * kernel: Add support for using socket:sockaddr_in() and
    socket:sockaddr_in6() when using gen_sctp, gen_tcp and gen_udp.
    This will make it possible to use Link Local IPv6 addresses.
  * kernel: A net_tickintensity kernel parameter has been
    introduced. It can be used to control the amount of ticks
    during a net_ticktime period. A new net_kernel:start/2 function
    has also been introduced in order to make it easier to add new
    options. The use of net_kernel:start/1 has been deprecated.
  * kernel: Improve documentation for the dynamic node name
    feature.
  * erl_docgen: Fix css for large tables and images on small
    screens
  * erl_docgen: Fix bug with codeinclude tag that caused it to not
    include the code if used in a correct, but unexpected way.
  * observer: Calculate the display width in etop, instead of hard-
    coding it to 89 characters.
  * debugger: Fix record index matching, it was broken and could
    never match.
  * ssl: Improved error handling.
  * ssl: Before this change, net_kernel used with TLS distribution
    might be leaking processes in case of connectivity issues.
  * ssl: Fix makefile dependency bugs.
  * ssl: Make sure the TLS sender process handles explicit calls to
    erlang:disconnect_node properly, avoiding potential hanging
    problems in net_kernel.
  * ssl: Add support for TLS-1.3 certificate_authorities extension.
    And process certificate_authorities field in pre-TLS-1.3
    certificate requests.
  * ssl: Support password fun for protected keyfiles in ssl:connect
    function.
  * ssl: Add in some cases earlier detection of possible DoS
    attacks by malicious clients sending unexpected TLS messages
    instead of the client hello. Note that such attacks are already
    mitigated by providing a timeout for the TLS handshake.
  * eldap: Fix eldap extensibleMatch dnAttributes option. According
    to the ldap ASN1 the dnAttributes should be a bool, instead it
    was generated as a string.
  * eldap: Implemented paged searches according to https://www.rfc-
    editor.org/rfc/rfc2696.txt
  * public_key: Support password fun for protected keyfiles in
    ssl:connect function.
  * stdlib: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.
  * mnesia: Reduce the number of locks taken during table copying,
    should reduce the startup time on large systems.
  * diameter: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1649246400">- Fix build for Factory. Currently, any Java version
  is fine for Erlang.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1653220800">- Version 25.0:
  - stdlib
  * New function filelib:ensure_path/1 will ensure that all
    directories for the given path exists
  * New functions groups_from_list/2 and groups_from_list/3 in
    the maps module
  * New functions uniq/1 uniq/2 in the lists module
  * New PRNG added to the rand module, for fast pseudo-random
    numers.
  - compiler, kernel, stdlib, syntax_tools:
  * Added support for selectable features as described in EEP-60.
    Features can be enabled/disabled during compilation with
    options (ordinary and +term) to erlc as well as with
    directives in the file. Similar options can be used to erl
    for enabling/disabling features allowed at runtime. The new
    maybe expression EEP-49 is fully supported as the feature
    maybe_expr.
  - erts &amp; JIT:
  * The JIT now works for 64-bit ARM processors.
  * The JIT now does type-based optimizations based on type
    information in the BEAM files.
  * Improved the JIT’s support for external tools like perf and
    gdb, allowing them to show line numbers and even the original
    Erlang source code when that can be found.
  - erts, stdlib, kernel:
  * Users can now configure ETS tables with the
    {write_concurrency, auto} option. This option forces tables
    to automatically change the number of locks that are used at
    run-time depending on how much concurrency is detected. The
    {decentralized_counters, true} option is enabled by default
    when {write_concurrency, auto} is active.
  * Benchmark results comparing this option with the other ETS
    optimization options are available here: benchmarks.
  * To enable more optimizations, BEAM files compiled with OTP 21
    and earlier cannot be loaded in OTP 25.
  * The signal queue of a process with the process flag
    message_queue_data=off_heap has been optimized to allow
    parallel reception of signals from multiple processes. This
    can improve performance when many processes are sending in
    parallel to one process. See benchmark.
  * The Erlang installation directory is now relocatable on the
    file system given that the paths in the installation’s
    RELEASES file are paths that are relative to the
    installations root directory.
  * A new option called short has been added to the functions
    erlang:float_to_list/2 and erlang:float_to_binary/2. This
    option creates the shortest correctly rounded string
    representation of the given float that can be converted back
    to the same float again.
  * Introduction of quote/1 and unquote/1 functions in the
    uri_string module - a replacement for the deprecated
    functions http_uri:encode and http_uri:decode.
  * The new module peer supersedes the slave module. The slave
    module is now deprecated and will be removed in OTP 27.
  * global will now by default prevent overlapping partitions due
    to network issues. This is done by actively disconnecting
    from nodes that reports that they have lost connections to
    other nodes. This will cause fully connected partitions to
    form instead of leaving the network in a state with
    overlapping partitions.
  * It is possible to turn off the new behavior by setting the
    the kernel configuration parameter
    prevent_overlapping_partitions to false. Doing this will
    retain the same behavior as in OTP 24 and earlier.
  * The format_status/2 callback for gen_server, gen_statem and
    gen_event has been deprecated in favor of the new
    format_status/1 callback.
  * The new callback adds the possibility to limit and change
    many more things than the just the state.
  * The timer module has been modernized and made more efficient,
    which makes the timer server less susceptible to being
    overloaded. The timer:sleep/1 function now accepts an
    arbitrarily large integer.
  - compiler:
  * The maybe ... end construction as proposed in EEP-49 has been
    implemented. It can simplify complex code where otherwise
    deeply nested cases would have to be used.
  * To enable maybe, give the option {enable_feature,maybe_expr}
    to the compiler. The exact option to use will change in a
    coming release candidate and then it will also be possible to
    use from inside the module being compiled.
  * When a record matching or record update fails, a {badrecord,
    ExpectedRecordTag} exception used to be raised. In this
    release, the exception has been changed to {badrecord,
    ActualValue}, where ActualValue is the value that was found
    instead of the expected record.
  * Add compile attribute -nifs() to empower compiler and loader
    with information about which functions may be overridden as
    NIFs by erlang:load_nif/2.
  * Improved and more detailed error messages when binary
    construction with the binary syntax fails. This applies both
    for error messages in the shell and for
    erl_error:format_exception/3,4.
  * Change format of feature options and directives for better
    consistency. Options to erlc and the -compile(..) directive
    now has the format {feature, feature-name, enable | disable}.
    The -feature(..) now has the format -feature(feature-name,
    enable | disable).
  - crypto:
  * Add crypto:hash_equals/2 which is a constant time comparision
    of hashvalues.
  - ssl:
  * Introducing a new (still experimental) option
    {certs_keys,[cert_key_conf()]}. With this a list of a
    certificates with their associated key may be used to
    authenticate the client or the server. The certificate key
    pair that is considered best and matches negotiated
    parameters for the connection will be selected.
  - public_key:
  * Functions for retrieving OS provided CA-certs added.
  - dialyzer:
  * Optimize operations in the erl_types module. Parallelize the
    Dialyzer pass remote.
  * Added the missing_return and extra_return options to raise
    warnings when specifications differ from inferred types.
    These are similar to, but not quite as verbose as overspecs
    and underspecs.
  * Dialyzer now better understands the types for min/2, max/2,
    and erlang:raise/3. Because of that, Dialyzer can potentially
    generate new warnings. In particular, functions that use
    erlang:raise/3 could now need a spec with a no_return()
    return type to avoid an unwanted warning.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1656849600">- Changes for 25.0.2:
  * ssl: Improved handling of unexpected messages during the
    handshake, taking the right action for unexpected messages.
  * erts: On computers with the ARM64 (AArch64) architecture (such
    as Apple Silicon Macs) a rem expression followed by a div
    expression with the same operands could evaluate to the wrong
    result if the result of the rem expression was unused.
- Changes for 25.0.1:
  * ssl: When a TLS-1.3 enabled client tried to talk to a TLS-1.2
    server that coalesces TLS-1.2 handshake message over one TLS
    record, the connection could fail due to some message being
    handled in the wrong state, this has been fixed.
  * ssl: Correctly handles supported protocol version change from
    default to something else by sni_fun supplied to
    ssl:handshake/[2,3] together with a TCP-socket (so called
    upgrade).
  * ssl: Also, TLS-1.3 should respond with a protocol version alert
    if previous versions, that are supported but not configured,
    are attempted.
  * kernel: The DNS resolver inet_res has been fixed to ignore
    trailing dot difference in the request domain between the sent
    request and the received response, when validating a response.
  * kernel: A bug in inet_res has been fixed where a missing
    internal {ok,_} wrapper caused inet_res:resolve/* to return a
    calculated host name instead of an `{ok,Msg} tuple, when
    resolving an IP address or a host name that is an IP address
    string.
  * kernel: The erlang:is_alive() BIF could return true before
    configured distribution service was available. This bug was
    introduced in OTP 25.0 ERTS version 13.0. The
    erlang:monitor_node() and erlang:monitor() BIFs could
    erroneously fail even though configured distribution service
    was available. This occurred if these BIFs were called after
    the distribution had been started using dynamic node name
    assignment but before the name had been assigned.
  * kernel: Added the missing mandatory address/0 callback in the
    gen_tcp_dist example.
  * erts: A spawn_reply signal from a remote node could be delayed
    and be delivered after other signals from the newly spawned
    process. When this bug triggered, the connection to the node
    where the process was spawned sometimes could be taken down due
    to the bug. The following error message would then be logged if
    this happened: Missing 'spawn_reply' signal from the node
    &lt;RemoteNode&gt; detected by &lt;Pid&gt; on the node &lt;LocalNode&gt;. The
    node &lt;RemoteNode&gt; probably suffers from the bug with ticket id
    OTP-17737. This bug only affected processes which had enabled
    off_heap message_queue_data and parallel reception of signals
    had been automatically enabled. This bug was introduced in OTP
    25.0, ERTS version 13.0.
  * erts: Fixed type spec of erlang:system_info(dist_ctrl).
  * erts: The zlib built in to the runtime system has been updated
    to version 1.2.12. (Note that on most platforms, the platform's
    own zlib is used.)
  * erts: The erlang:is_alive() BIF could return true before
    configured distribution service was available. This bug was
    introduced in OTP 25.0 ERTS version 13.0. The
    erlang:monitor_node() and erlang:monitor() BIFs could
    erroneously fail even though configured distribution service
    was available. This occurred if these BIFs were called after
    the distribution had been started using dynamic node name
    assignment but before the name had been assigned.
  * crypto: Note in the documentation that MODP (rfc3526) groups
    and OpenSSL 3.0 can give an error if a call to
    crypto:generate_key/2 specifies a key length, and that length
    is to small.
  * crypto: The cmac now uses only the 3.0 API
  * crypto: Documentation is now updated with which OpenSSL
    cryptolib versions that OTP currently is tested.
  * dialyzer: Fixed the documentation for the missing_return and
    extra_return options.
  * mnesia: Fixed add_table_copy which could leave a table lock if
    the receiving node went down during the operation.
  * ssh: Binaries can be limited in logs with the parameter
    max_log_item_len. The default value is 500 bytes.
  * stdlib: In the initial release of Erlang/OTP 25, the expression
    bound to the _ pseudo-field in a record initialization would
    always be evaluated once, even if all other fields in the
    record were explicitly initialized. That would break the use
    case of binding the expression error(...) to _ in order to get
    an exception if not all fields were initialized. The behavior
    of binding to _ has been reverted to the pre-OTP 25 behavior,
    that is, to not evaluate the expression if all fields have been
    bound to explicit values.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1660046400">- Changes for 25.0.3:
  * erts: Distributed exit signals could be lost under the
    following conditions:
  * erts: A race could cause process_info(Pid, message_queue_len)
    on other processes to return invalid results.
  * erts: Fixed reduction counting for handling process system
    tasks.
  * erts: Priority elevation of terminating processes did not work
    which could cause execution of such processes to be delayed.
  * erts: An unlink operation made by a process that terminated
    before the unlink operation completed, i.e., before it had
    received an unlink-ack signal from the linked process, caused
    an exit signal to erroneously be sent from the terminating
    process to the process being unlinked. This exit signal would
    most often be ignored by the receiver, but if the receiver of
    the exit signal concurrently set up a new link, it could
    receive the exit signal with the actual exit reason of the
    terminating process instead of a noproc exit reason. It is
    however very hard to detect that this has happened and has no
    obvious negative consequences, so it should be considered
    harmless. A distributed unlink-ack signal received by a
    terminating process was also not properly removed which could
    cause a minor memory leak.
  * ssl: The link to crypto:engine_load refered the function with
    wrong arity.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1661601600">- Changes for 25.0.4:
  * kernel: A call to net_kernel:setopts(new, Opts) at the same
    time as a connection was being set up could cause a deadlock
    between the net_kernel process and the process setting up the
    connection.
  * erts: The monitor/3 BIF did not apply options to the created
    monitor if the target process or port did not exist. That is,
    the corresponding down message would get a `DOWN` tag even if a
    custom tag had been set, and the returned reference was not an
    alias even if the alias option had been passed.
  * erts: The erlang:monotonic_time/1, erlang:system_time/1,
    erlang:time_offset/1, and os:system_time/1 BIFs erroneously
    failed when passed the argument native.</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1665662400">- Changes for 25.1.1:
  * dialyzer: Dialyzer could crash when analyzing Elixir code that
    used intricate macros.
  * dialyzer: The --input_list_file option has been added.
  * ssl: Fixes handling of symlinks in cacertfile option.
  * eunit: With this change, eunit exact_execution option works
    with application primitive.
  * stdlib: peer nodes failed to halt when the process supervising
    the control connection crashed. When an alternative control
    connection was used, this supervision process also quite
    frequently crashed when the peer node was stopped by the node
    that started it which caused the peer node to linger without
    ever halting.
  * asn1: For the per and uper ASN.1 encoding rules, encoding and
    decoding the SEQUENCE OF and SET OF constructs with 16384 items
    or more is now supported.
  * erts: Listen sockets created with the socket module, leaked
    (erlang-) monitors.
  * erts: Notifications about available distribution data sent to
    distribution controller processes could be lost. Distribution
    controller processes can be used when implementing an
    alternative distribution carrier. The default distribution over
    tcp was not effected and the bug was also not present on
    x86/x86_64 platforms.
  * kernel: Listen sockets created with the socket module, leaked
    (erlang-) monitors.
  * kernel: peer nodes failed to halt when the process supervising
    the control connection crashed. When an alternative control
    connection was used, this supervision process also quite
    frequently crashed when the peer node was stopped by the node
    that started it which caused the peer node to linger without
    ever halting.
- Changes for 25.1:
  * dialyzer: Two bugs have been fixed in Dialyzer's checking of
    behaviors: When a mandatory callback function is present but
    not exported, Dialyzer would not complain about a missing
    callback. When an optional callback function was not exported
    and had incompatible arguments and/or the return values were
    incompatible, Dialyzer would complain. This has been changed to
    suppress the warning, because the function might not be
    intended to be a callback function, for instance if a release
    added a new optional callback function (such as format_status/1
    for the gen_server behaviour added in OTP 25).
  * dialyzer: The no_extra_return and no_missing_return warnings
    can now be suppressed through -dialyzer directives in source
    code.
  * jinterface: Fix javadoc build error by adding option -encoding
    UTF-8.
  * diameter: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * crypto: Fix configure with --with-ssl and --disable-dynamic-
    ssl-lib on Windows.
  * crypto: Remove all references correctly in the garbage
    collection if an engine handle was not explicit unloaded.
  * crypto: Changed the behaviour of the engine load/unload
    functions The engine load/unload functions have got changed
    semantics to get a more consistent behaviour and work correct
    when variables are garbage collected. The load functions now
    don't register the methods for the engine to replace. That will
    now be handled with the new functions
    engine_register/engine_unregister if needed. Some functions are
    removed from the documentation and therefor the API, but they
    are left in the code for compatibility. *** POTENTIAL
    INCOMPATIBILITY ***
  * crypto: Fixed a naming bug for AES-CFB and Blowfish-CFB/OFB
    when linked with OpenSSL 3.0 cryptolib.
  * crypto: Sign/verify does now behave as in OTP-24 and earlier
    for eddsa.
  * crypto: Pass elliptic curve names from crypto.erl to crypto's
    nif.
  * crypto: The configure option --disable-deprecated-warnings is
    removed. It was used for some releases when the support for
    OpenSSL 3.0 was not completed. It is not needed in OTP 25.
  * crypto: Crypto is now considered to be usable with the OpenSSL
    3.0 cryptolib for production code. ENGINE and FIPS are not yet
    fully functional.
  * crypto: Do not exit if the legacy provider is missing in
    libcrypto 3.0.
  * ssl: Reject unexpected application data in all relevant places
    for all TLS versions. Also, handle TLS-1.3 middlebox
    compatibility with more care. This will make malicious
    connections fail early and further, mitigate possible DoS
    attacks, that would be caught by the handshake timeout. Thanks
    to Aina Toky Rasoamanana and Olivier Levillain from Télécom
    SudParis for alerting us of the issues in our implementation.
  * ssl: With this change, value of cacertfile option will be
    adjusted before loading certs from the file. Adjustments
    include converting relative paths to absolute and converting
    symlinks to actual file path. Thanks to Marcus Johansson
  * ssl: In TLS-1.3, if chain certs are missing (so server auth
    domain adherence can not be determined) send peer cert and hope
    the server is able to recreate a chain in its auth domain.
  * ssl: Make sure periodical refresh of CA certificate files
    repopulates cache properly.
  * ssl: Correct internal CRL cache functions to use internal
    format consistently.
  * ssl: Incorrect handling of client middlebox negotiation for
    TLS-1.3 could result in that a TLS-1.3 server would not use
    middlebox mode although the client was expecting it too and
    failing the negotiation with unexpected message.
  * ssl: If the "User" process, the process starting the TLS
    connection, gets killed in the middle of spawning the dynamic
    connection tree make sure we do not leave any processes behind.
  * ssl: A vulnerability has been discovered and corrected. It is
    registered as CVE-2022-37026 "Client Authentication Bypass".
    Corrections have been released on the supported tracks with
    patches 23.3.4.15, 24.3.4.2, and 25.0.2. The vulnerability
    might also exist in older OTP versions. We recommend that
    impacted users upgrade to one of these versions or later on the
    respective tracks. OTP 25.1 would be an even better choice.
    Impacted are those who are running an ssl/tls/dtls server using
    the ssl application either directly or indirectly via other
    applications. For example via inets (httpd), cowboy, etc. Note
    that the vulnerability only affects servers that request client
    certification, that is sets the option {verify, verify_peer}.
    (bsc#1205318)
  * eunit: With this change, Eunit can optionally not try to
    execute related module with "_tests" suffix. This might be used
    for avoiding duplicated executions when source and test modules
    are located in the same folder.
  * erl_docgen: Update DTD to allow XML tag em under pre.
  * inets: Add httpc:ssl_verify_host_options/1 to help setting
    default ssl options for the https client.
  * inets: This change fixes dialyzer warnings generated for
    inets/httpd examples (includes needed adjustment of spec for
    ssh_sftp module).
  * inets: Remove documentation of no longer supported callback.
  * stdlib: Fixed inconsistency bugs in global due to
    nodeup/nodedown messages not being delivered before/after
    traffic over connections. Also fixed various other
    inconsistency bugs and deadlocks in both global_group and
    global. As building blocks for these fixes, a new BIF
    erlang:nodes/2 has been introduced and
    net_kernel:monitor_nodes/2 has been extended. The -hidden and
  - connect_all command line arguments did not work if multiple
    instances were present on the command line which has been
    fixed. The new kernel parameter connect_all has also been
    introduced in order to replace the -connect_all command line
    argument.
  * stdlib: Fix the public_key:ssh* functions to be listed under
    the correct release in the Removed Functionality User's Guide.
  * stdlib: The type spec for format_status/1 in gen_statem,
    gen_server and gen_event has been corrected to state that the
    return value is of the same type as the argument (instead of
    the same value as the argument).
  * stdlib: If the timer server child spec was already present in
    kernel_sup but it was not started, the timer server would fail
    to start with an {error, already_present} error instead of
    restarting the server.
  * stdlib: When changing callback module in gen_statem the
    state_enter calls flag from the old module was used in for the
    first event in the new module, which could confuse the new
    module and cause malfunction. This bug has been corrected. With
    this change some sys debug message formats have been modified,
    which can be a problem for debug code relying on the format.
  * ** POTENTIAL INCOMPATIBILITY ***
  * stdlib: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * stdlib: The rfc339_to_system_time/1,2 functions now allows the
    minutes part to be omitted from the time zone.
  * stdlib: The receive statement in gen_event has been optimized
    to not use selective receive (which was never needed, and could
    cause severe performance degradation under heavy load).
  * stdlib: Add new API function erl_features:configurable/0
  * parsetools: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * public_key: Support more Linux distributions in cacerts_load/0.
  * public_key: Correct asn1 typenames available in type
    pki_asn1_type()
  * public_key: Sign/verify does now behave as in OTP-24 and
    earlier for eddsa.
  * snmp: Improved the get-bulk response max size calculation. Its
    now possible to configure 'empty pdu size', see appendix c for
    more info.
  * snmp: Fix various example dialyzer issues
  * ssh: Handling rare race condition at channel close.
  * ssh: New ssh option no_auth_needed to skip the ssh
    authentication. Use with caution!
  * ssh: This change fixes dialyzer warnings generated for
    inets/httpd examples (includes needed adjustment of spec for
    ssh_sftp module).
  * ssh: The new function ssh:daemon_replace_options/2 makes it
    possible to change the Options in a running SSH server.
    Established connections are not affected, only those created
    after the call to this new function.
  * ssh: Add a timeout as option max_initial_idle_time. It closes a
    connection that does not allocate a channel within the timeout
    time. For more information about timeouts, see the Timeouts
    section in the User's Guide Hardening chapter.
  * observer: Fixed units in gui.
  * xmerl: There is a new configure option, --enable-deterministic-
    build, which will apply the deterministic compiler option when
    building Erlang/OTP. The deterministic option has been improved
    to eliminate more sources of non-determinism in several
    applications.
  * asn1: There is a new configure option, --enable-deterministic-
    build, which will apply the deterministic compiler option when
    building Erlang/OTP. The deterministic option has been improved
    to eliminate more sources of non-determinism in several
    applications.
  * erts: Fixed inconsistency bugs in global due to nodeup/nodedown
    messages not being delivered before/after traffic over
    connections. Also fixed various other inconsistency bugs and
    deadlocks in both global_group and global. As building blocks
    for these fixes, a new BIF erlang:nodes/2 has been introduced
    and net_kernel:monitor_nodes/2 has been extended. The -hidden
    and -connect_all command line arguments did not work if
    multiple instances were present on the command line which has
    been fixed. The new kernel parameter connect_all has also been
    introduced in order to replace the -connect_all command line
    argument.
  * erts: Fixed IPv6 multicast_if and membership socket options.
  * erts: Accept funs (NEW_FUN_EXT) with incorrectly encoded size
    field. This is a workaround for a bug (OTP-18104) existing in
    OTP 23 and 24 that could cause incorrect size fields in certain
    cases. The emulator does not use the decoded size field, but
    erl_interface still does and is not helped by this workaround.
  * erts: Fixed issue with inet:getifaddrs hanging on pure IPv6
    Windows
  * erts: Fix faulty distribution encoding of terms with either The
    symptom could be failed decoding on the receiving side leading
    to aborted connection. Fix OTP-18093 is a workaround for theses
    bugs that makes the VM accepts such faulty encoded funs. The
    first encoding bug toward pending connection exists only in OTP
    23 and 24, but the second one exists also on OTP 25.
  * erts: Fixed emulator crash that could happen during crashdump
    generation of ETS tables with options ordered_set and
    {write_concurrency,true}.
  * erts: Retrieval of monotonic and system clock resolution on
    MacOS could cause a crash and/or erroneous results.
  * erts: Fix bug where the max allowed size of erl +hmax was lower
    than what was allowed by process_flag.
  * erts: On computers with ARM64 (AArch64) processors, the JIT
    could generate incorrect code when more than 4095 bits were
    skipped at the tail end of a binary match.
  * erts: In rare circumstances, an is_binary/1 guard test could
    succeed when given a large integer.
  * erts: Fix bug causing ets:info (and sometimes ets:whereis) to
    return 'undefined' for an existing table if a concurrent
    process were doing ets:insert with a long list on the same
    table.
  * erts: Fix writing and reading of more than 2 GB in a single
    read/write operation on macOS. Before this fix attempting to
    read/write more than 2GB would result in {error,einval}.
  * erts: Fix bug sometimes causing emulator crash at node shutdown
    when there are pending connections. Only seen when running duel
    distribution protocols, inet_drv and inet_tls_dist.
  * erts: Yield when adjusting large process message queues due to
    The message queue adjustment work will now be interleaved with
    all other types of work that processes have to do, even other
    message queue adjustment work.
  * erts: Add rudimentary debug feature (option) for the inet-
    driver based sockets, such as gen_tcp and gen_udp.
  * erts: Introduced the hidden and dist_listen options to
    net_kernel:start/2. Also documented the -dist_listen command
    line argument which was erroneously documented as a kernel
    parameter and not as a command line argument.
  * erts: New documentation chapter "Debugging NIFs and Port
    Drivers" under Interoperability Tutorial.
  * erts: Add new API function erl_features:configurable/0
  * kernel: Fixed inconsistency bugs in global due to
    nodeup/nodedown messages not being delivered before/after
    traffic over connections. Also fixed various other
    inconsistency bugs and deadlocks in both global_group and
    global. As building blocks for these fixes, a new BIF
    erlang:nodes/2 has been introduced and
    net_kernel:monitor_nodes/2 has been extended. The -hidden and
  - connect_all command line arguments did not work if multiple
    instances were present on the command line which has been
    fixed. The new kernel parameter connect_all has also been
    introduced in order to replace the -connect_all command line
    argument.
  * kernel: Fixed IPv6 multicast_if and membership socket options.
  * kernel: Fixed issue with inet:getifaddrs hanging on pure IPv6
    Windows
  * kernel: The type specifications for inet:getopts/2 and
    inet:setopts/2 have been corrected regarding SCTP options.
  * kernel: The type specifications for inet:parse_* have been
    tightened.
  * kernel: Fix gen_tcp:connect/3 spec to include the inet_backend
    option.
  * kernel: Fix bug where using a binary as the format when calling
    logger:log(Level, Format, Args) (or any other logging function)
    would cause a crash or incorrect logging.
  * kernel: Add rudimentary debug feature (option) for the inet-
    driver based sockets, such as gen_tcp and gen_udp.
  * kernel: Introduced the hidden and dist_listen options to
    net_kernel:start/2. Also documented the -dist_listen command
    line argument which was erroneously documented as a kernel
    parameter and not as a command line argument.
  * kernel: Scope and group monitoring have been introduced in pg.
    For more information see the documentation of
    pg:monitor_scope(), pg:monitor(), and pg:demonitor().
  * kernel: A new function global:disconnect/0 has been introduced
    with which one can cleanly disconnect a node from all other
    nodes in a cluster of global nodes.
  * compiler: The compiler will now forbid using the empty atom ''
    as module name. Also forbidden are modules names containing
    control characters, and module names containing only spaces and
    soft hyphens.
  * compiler: The bin_opt_info and recv_opt_info options would
    cause the compiler to crash when attempting to compile
    generated code without location information.
  * compiler: In rare circumstances involving floating point
    operations, the compiler could terminate with an internal
    consistency check failure.
  * compiler: In rare circumstances when doing arithmetic
    instructions on non-numbers, the compiler could crash.
  * compiler: In rare circumstances, complex boolean expressions in
    nested cases could cause the compiler to crash.
  * compiler: Expression similar to #{assoc:=V} = #key=&gt;self()}, V
    would return the empty map instead of raising an exception.
  * compiler: Eliminated a crash in the beam_ssa_bool pass of the
    compiler when compiling a complex guard expression.
  * compiler: In rare circumstances, the compiler could crash with
    an internal consistency check failure.
  * compiler: When compiling with the option inline_list_funcs, the
    compiler could produce a nonsensical warning.
  * compiler: When given the no_ssa_opt option, the compiler could
    terminate with an internal consistency failure diagnostic when
    compiling map matching.
  * compiler: Made warnings for existing atoms being keywords in
    experimental features more precise, by not warning about quoted
    atoms.
  * compiler: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * megaco: Fixed various dialyzer related issues in the examples
    and the application proper.
  * megaco: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * common_test: Fix cth_surefire to handle when a suite is not
    compiled with debug_info. This bug has been present since
    Erlang/OTP 25.0.
  * common_test: Common Test now preserves stack traces for throws.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1669291200">- Changes for 25.1.2:
  * mnesia: Don't fill the logs if mnesia can't connect to all
    nodes, due to partitioned network.
  * erts: Add abandon carrier free utilization limit (+Muacful)
    option to erts_alloc. This option allows the user to mark
    unused segments in a memory carrier as re-useable by the OS if
    needed. This functionality was a non-configurable default
    before Erlang/OTP 25, but removed due to performance issues.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1671364800">- Changes for 25.2:
  * erts: Fix perf/gdb JIT symbols to not contain CodeInfoPrologue
    for the JIT internal module erts_beamasm.
  * erts: Fixed minor memory leaks.
  * erts: Fix bugs in ets:insert and ets:insert_new when called
    with a list of tuples to insert while a concurrent process
    either deletes or renames the table. The table deletion could
    be done with ets:delete/1 or be caused by termination of the
    table owning process. Symptoms are either VM crash or strange
    incorrect behavior from the insert operation. The risk of
    triggering the bugs increases with the length of the list of
    tuple to insert. Bugs exist since OTP 23.0.
  * erts: Boost execution of scheduled thread progress jobs. This
    to prevent memory exhaustion in extremely rapid
    allocation/deallocation scenarios, such as repeated ETS table
    creations/deletions.
  * erts: Fix segv crash during crash dumping an ETS table doing
    ets:delete_all_objects.
  * erts: Spec for function net:if_names/0 incorrect
  * erts: Fix bug in binary_to_term decoding a binary term 2Gbyte
    or larger.
  * erts: Documentation of erlang:module_loaded/1 has been
    adjusted:
  * erts: Fix list_to_atom/1 for negative code points. Could either
    return with a positive code point or fail with an incorrect
    exception.
  * erts: Fix rare bug causing VM crash when sending to a pid of a
    spawning process returned from erlang:processes/0. Only seen
    when provoked by system process literal_area_collector,
    triggered by a module purge operation, on a VM started with
    +Meamin (no customized allocators).
  * erts: gen_udp:open/2 with option(s) add_membership or
    drop_membership would drop earlier options.
  * erts: The inet:setopts/2 {reuseaddr, true} option will now be
    ignored on Windows unless the socket is an UDP socket. For more
    information see the documentation of the reuseaddr option part
    of the documentation of inet:setopts/2. Prior to OTP 25 the
    {reuseaddr, true} option was ignored for all sockets on
    Windows, but as of OTP 25.0 this was changed so that it was not
    ignored for any sockets. *** POTENTIAL INCOMPATIBILITY ***
  * erts: Fix bug in binary_to_term decoding a list of length 1G or
    longer.
  * erts: Fix bug in binary_to_term (and distributed receive) when
    decoding a large map (&gt;32 keys) with unsorted small maps (&lt;=
    32) as keys of the large map. This was only a problem if the
    term was encoded by erl_interface, jinterface or otherwise, as
    the VM itself always encodes small maps with sorted keys. The
    "binary_to_term" would appear as successful but the created
    large map was internally inconsistent. The smaller key-maps
    could not be found with maps:get and friends. Other operations
    such as map compare and merge could probably also give
    incorrect results.
  * erts: Fix Windows bug in open_port({spawn, Command}, ..) when
    Command is found via the OS search PATH and that directory path
    contains white spaces. The port program would start but the
    command line arguments to it could be incorrect.
  * ftp: fix unexpected result ok when calling ftp:nlist repeatedly
  * inets: This change allows body requests to httpc:request/5 be
    an iolist()
  * inets: addition of type specs in httpc.erl
  * inets: httpc: Add support for HTTP 308 status code
  * dialyzer: Dialyzer would crash when attempting to analyze a bit
    syntax segment size having an literal non-integer size such as
    [].
  * dialyzer: Dialyzer could crash when trying to analyze a
    convoluted nested expression involving funs,
  * kernel: Fixed shutdown crash in gen_tcp socket backend, when
    the other end closed the socket.
  * kernel: erl_tar can now read gzip-compressed tar files that are
    padded. There is a new option compressed_one for file:open/2
    that will read a single member from a gzip file,
  * kernel: Fix os:cmd to not translate all exceptions thrown to
    badarg. For example emfile from erlang:open_port was translated
    to badarg. This bug has existed since Erlang/OTP 24.
  * kernel: Spec for function net:if_names/0 incorrect
  * kernel: Missing ctrl option name transation for TOS and TTL (on
    FreeBSD) when using gen_udp with the 'socket' inet_backend.
  * kernel: gen_udp:open/2 with option(s) add_membership or
    drop_membership would drop earlier options.
  * kernel: The inet:setopts/2 {reuseaddr, true} option will now be
    ignored on Windows unless the socket is an UDP socket. For more
    information see the documentation of the reuseaddr option part
    of the documentation of inet:setopts/2. Prior to OTP 25 the
    {reuseaddr, true} option was ignored for all sockets on
    Windows, but as of OTP 25.0 this was changed so that it was not
    ignored for any sockets. *** POTENTIAL INCOMPATIBILITY ***
  * kernel: The distribution socket option handling in
    inet_tcp_dist has been cleaned up to clarify which were
    mandatory and which just had default values.
  * kernel: Improve warning message format for gen_tcp_socket.
  * snmp: Explicitly close the socket(s) when terminating
    (default-) net-if process.
  * stdlib: erl_tar can now read gzip-compressed tar files that are
    padded. There is a new option compressed_one for file:open/2
    that will read a single member from a gzip file,
  * stdlib: A concurrent call to ets:rename could cause
    ets:delete_all_objects to fail halfway through with badarg.
  * stdlib: It is not allowed to call functions from guards. The
    compiler failed to reject a call in a guard when done by
    constructing a record with a default initialization expression
    that called a function.
  * stdlib: The compiler could crash when using a record with
    complex field initialization expression as a filter in a list
    comprehension.
  * stdlib: unicode:characters_to_binary() could build
    unnecessarily large call stack.
  * stdlib: Improve error message for ets:new/2 name clash. Say
    "name already exists" instead of less specific "invalid
    options".
  * mnesia: Fixed crash which could happen during startup if too
    many decisions where sent from remote nodes.
  * os_mon: The disk_space_check_interval configuration parameter
    of disksup can now be set to values smaller than a minute.
  * ssh: graceful shutdown of ssh_conection_handler when connection
    is closed by peer
  * common_test: Fix starting of peer nodes on old releases when
    the compile server was active and the current Erlang
    installation contained non-latin1 characters in its path.
  * public_key: Disregard LDAP URIs when HTTP URIs are expected.
  * ssl: With this change, tls_sender process is hibernated after
    sufficient inactivity.
  * ssl: Correct handling of legacy schemes so that ECDSA certs
    using sha1 may be used for some TLS-1.3 configurations.
  * ssl: With this change, tls_sender does not cause logger crash
    upon key update.
  * ssl: Enhance warning message
  * ssl: Provide server option to make certificate_authorities
    extension in the TLS-1.3 servers certificate request optional.
    This will allow clients to send incomplete chains that may be
    reconstructable and thereby verifiable by the server, but that
    would not adhere to the certificate_authorities extension.
  * ssl: If the verify_fun handles four arguments the DER cert will
    be supplied as one of the arguments.
  * megaco: A very minor improvement to the measurement tool.
  * observer: A WX event race could causes a crash in when handling
    socket or port info.
  * observer: Improve the nodes menu to include more nodes.
  * compiler: Line number in compiler messages would be truncated
    to 4 digits for line numbers greater than 9999.
  * compiler: In rare circumstance, matching a binary as part of a
    receive clause could cause the compiler to terminate because of
    an internal consistency check failure.
  * compiler: Compiling a function with complex bit syntax matching
    such as f(&lt;&lt;X:0, _:X&gt;&gt;, &lt;&lt;Y:0, _:Y&gt;&gt;) -&gt; ok. could crash the
    compiler.
  * compiler: It is not allowed to call functions from guards. The
    compiler failed to reject a call in a guard when done by
    constructing a record with a default initialization expression
    that called a function.
  * compiler: The compiler could crash when using a record with
    complex field initialization expression as a filter in a list
    comprehension.
  * wx: Added environment variable WX_MACOS_NON_GUI_APP to allow
    user to override OSXIsGUIApplication behavior.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1679745600">- Changes for 25.3:
  * reltool: Fixed a bug that would cause analysis to crash.
  * stdlib: Fixed a bug that would cause analysis to crash.
  * stdlib: Fixed a crash when formatting stack traces for error
    reports.
  * stdlib: Instead of crashing, the list_to_integer/1 and
    list_to_integer/2 BIFs now raise the system_limit exception for
    overlong lists that can't be converted to integers. Similarly,
    the string:to_integer/1 BIF now returns {error,system_limit}
    for overlong lists.
  * stdlib: Removal of non-necessary undefined types added to the
    state's supervisor record.
  * compiler: Fixed a bug that would cause the compiler to hang.
  * compiler: Fixed a crash when compiling code that contained
    maybe expressions.
  * compiler: Constructing a binary with an explicit size of all
    for a binary segment would crash the compiler.
  * compiler: The compiler would generate incorrect code for the
    following type of expression: Pattern = BoundVar1 = . . . =
    BoundVarN = Expression An exception should be raised if any of
    the bound variables have different values than Expression. The
    compiler would generate code that would cause the bound
    variables to be bound to the value of Expressionwhether the
    value matched or not.
  * xmerl: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * megaco: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * debugger: Fixed a bug that would cause analysis to crash.
  * erts: Fixed a bug on Windows where file:read_file_info/1 would
    fail for files with corrupt metadata.
  * erts: Fix process_info(_, binary) to again include "writable
    binaries" which were lost in OTP-25.0. Writable binaries are an
    optimization used when binaries are appended upon in a loop.
  * erts: Fix rare race when receiving fragmented messages on a
    terminating connection. Could potentially cause memory leaks as
    well as double free crashes. Bug exists since OTP 22.0.
  * erts: Fixed bug that could maybe cause problems when a file
    descriptor number is closed by a linked in driver and then
    opened (reused) and passed to enif_select by a NIF. No actual
    symptoms seen, only failed internal assertions in debug build.
  * erts: The runtime system could crash when tracing a process
    executing on a dirty scheduler.
  * erts: In the binary syntax, attempting to match out integers
    with size exceeding 2 GiB could crash the runtime system.
  * erts: Fixed edge case in floating-point negation where A = 0.0,
    B = -A did not produce B = -0.0 on x86_64 JIT.
  * erts: Fixed an issue in the JIT that could crash the emulator
    on some platforms.
  * erts: Added meta data to the windows installer.
  * erts: Fixed ETS insertion order into bag and duplicate_bag of
    tuples with identical keys when passed in a list to
    ets:insert/2. The insert order has been head-to-tail but was
    accidentally changed in OTP 23.0. For bag it was reverted
    (tail-to-head), while for duplicate_bag it was sometimes
    reverted depending on the length of the list and number of
    "reductions" left for the calling process. This fix changes the
    insert order of ets:insert/2 back to always be head-to-tail of
    the list argument.
  * erts: With the JIT for AArch64 (AMD64), calling bxor in with
    non-integer arguments in a guard would crash the runtime
    system.
  * erts: Fix bug regarding process flag max_heap_size. Could cause
    strange behavior when a process was killed due to exceeding the
    limit.
  * erts: Fixed binary comprehensions to be similar to other
    creation of binary data with respect to its contribution of
    triggering garbage collection.
  * erts: In rare circumstances, when a process exceeded its
    allowed heap size set by option max_heap_size, it would not be
    killed as it should be, but instead enter a kind of zombie
    state it would never get out of.
  * erts: Instead of crashing, the list_to_integer/1 and
    list_to_integer/2 BIFs now raise the system_limit exception for
    overlong lists that can't be converted to integers. Similarly,
    the string:to_integer/1 BIF now returns {error,system_limit}
    for overlong lists.
  * erts: Active process aliases of a process at its termination
    leaked memory.
  * erts: Support for fully asynchronous distributed signaling
    where send operations never block. This functionality is by
    default disabled and can be enabled per process. For more
    information see the documentation of process_flag(async_dist,
    Bool).
  * erts: Added the +JPperf no_fp option to explicitly disable
    Erlang frame pointers otherwise added when using the +JPperf
    map option.
  * erl_interface: Accept connection setup from OTP 23 and 24 nodes
    that are not using epmd.
  * erl_interface: The ei API for decoding/encoding terms is not
    fully 64-bit compatible since terms that have a representation
    on the external term format larger than 2 GB cannot be handled.
  * syntax_tools: erl_syntax_lib:annotate_bindings/1,2 will now
    properly annotate named functions and their arguments.
  * kernel: Fixed a bug on Windows where file:read_file_info/1
    would fail for files with corrupt metadata.
  * kernel: Accept connection setup from OTP 23 and 24 nodes that
    are not using epmd.
  * public_key: As different solutions of verifying certificate
    revocation exists move the decode of 'CRLDistributionPoints' so
    that it will only be decode. When it is actually used in the
    verification process. This would enable interoperability with
    systems that use certificates with an invalid empty
    CRLDistributionPoints extension that they want to ignore and
    make verification by other means.
  * public_key: public_key:pkix_path_validation validates
    certificates expiring after 2050
  * public_key: Do not leave exit message in message queue after
    calling cacerts_load() on MacOS.
  * public_key: Replace size/1 with either tuple_size/1 or
    byte_size/1 The size/1 BIF is not optimized by the JIT, and its
    use can result in worse types for Dialyzer. When one knows that
    the value being tested must be a tuple, tuple_size/1 should
    always be preferred. When one knows that the value being tested
    must be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * ssl: Fixed that new dtls connections from the same client ip
    port combination works. If there is a process waiting for
    accept the new connection will connect to that, otherwise it
    will try to re-connect to the old server connection.
  * ssl: When shutting down a node that uses SSL distribution
    (-proto_dist inet_tls), a confusing error message about an
    unexpected process exit was printed. This particular message is
    no longer generated.
  * ssl: fixes the type spec for ssl:format_error/1
  * ssl: Replace size/1 with either tuple_size/1 or byte_size/1 The
    size/1 BIF is not optimized by the JIT, and its use can result
    in worse types for Dialyzer. When one knows that the value
    being tested must be a tuple, tuple_size/1 should always be
    preferred. When one knows that the value being tested must be a
    binary, byte_size/1 should be preferred. However, byte_size/1
    also accepts a bitstring (rounding up size to a whole number of
    bytes), so one must make sure that the call to byte_size/ is
    preceded by a call to is_binary/1 to ensure that bitstrings are
    rejected. Note that the compiler removes redundant calls to
    is_binary/1, so if one is not sure whether previous code had
    made sure that the argument is a binary, it does not harm to
    add an is_binary/1 test immediately before the call to
    byte_size/1.
  * jinterface: Accept connection setup from OTP 23 and 24 nodes
    that are not using epmd.
  * os_mon: The port programs used by cpu_sup and memsup are now
    gracefully shut down when cpu_sup and memsup are shut down.
  * eunit: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * crypto: A user defined runtime library path configured using
  - -with-ssl-rpath=&lt;PATHS&gt; could fail to be enabled.
  * crypto: Ensure that configure fails if a user defined runtime
    library path has been passed by the user, but cannot set.
  * mnesia: Improved consistency for dirty writes when a table was
    added with add_table_copy/3. Fixed a problem with sticky write,
    which could lead to inconsistent data.
  * mnesia: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * common_test: Renamed undocumented macro CT_PEER/3 to
    CT_PEER_REL/3.
  * ssh: With this change, PKCS8 formatted private key file is
    properly decoded and SSH daemon with such key can be started.
  * ssh: Replace size/1 with either tuple_size/1 or byte_size/1 The
    size/1 BIF is not optimized by the JIT, and its use can result
    in worse types for Dialyzer. When one knows that the value
    being tested must be a tuple, tuple_size/1 should always be
    preferred. When one knows that the value being tested must be a
    binary, byte_size/1 should be preferred. However, byte_size/1
    also accepts a bitstring (rounding up size to a whole number of
    bytes), so one must make sure that the call to byte_size/ is
    preceded by a call to is_binary/1 to ensure that bitstrings are
    rejected. Note that the compiler removes redundant calls to
    is_binary/1, so if one is not sure whether previous code had
    made sure that the argument is a binary, it does not harm to
    add an is_binary/1 test immediately before the call to
    byte_size/1.
  * inets: With this change, handling of URI to a folder, with
    missing trailing / and a query component present is fixed.
  * inets: Adds more type information to the inets app, thus
    improving the errors that static analysis tools can detect. The
    addition of type information to records and the updates to
    function heads help static analysis tools to understand that
    some values in the records cannot be 'undefined', thus making
    static tools to type check correctly more modules in the inets
    app
  * inets: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * snmp: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * ftp: Replace size/1 with either tuple_size/1 or byte_size/1 The
    size/1 BIF is not optimized by the JIT, and its use can result
    in worse types for Dialyzer. When one knows that the value
    being tested must be a tuple, tuple_size/1 should always be
    preferred. When one knows that the value being tested must be a
    binary, byte_size/1 should be preferred. However, byte_size/1
    also accepts a bitstring (rounding up size to a whole number of
    bytes), so one must make sure that the call to byte_size/ is
    preceded by a call to is_binary/1 to ensure that bitstrings are
    rejected. Note that the compiler removes redundant calls to
    is_binary/1, so if one is not sure whether previous code had
    made sure that the argument is a binary, it does not harm to
    add an is_binary/1 test immediately before the call to
    byte_size/1.
  * dialyzer: Fixed a bug that would cause analysis to crash.
  * dialyzer: Replace size/1 with either tuple_size/1 or
    byte_size/1 The size/1 BIF is not optimized by the JIT, and its
    use can result in worse types for Dialyzer. When one knows that
    the value being tested must be a tuple, tuple_size/1 should
    always be preferred. When one knows that the value being tested
    must be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * tftp: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
- Changes for 25.2.3:
  * erts: Comparisons between small numbers and pids or ports would
    in some edge cases say that the number was greater than the pid
    or port, violating the term order.
  * erts: process_info(Pid, status) when Pid /= self() could return
    an erroneous result.
  * ssl: Maximize compatibility by ignoring change_cipher_spec
    during handshake even if middle_box_mode is not negotiated
    (mandated by client)
  * ssl: Move assert of middlebox message after an
    hello_retry_request to maximize interoperability. Does not
    changes semantics of the protocol only allows unexpected
    message delay from server.
  * ssh: With this change, ssh application does not crash when
    formatting some of info reports for unsuccessful connections.
  * ssh: With this change, ssh does not log extensively long
    messages.
  * inets: Ensure graceful shutdown
  * inets: Return type of the type specification for function
    httpc:cookie_header/{1,2,3} has been fixed from -spec
    cookie_header(url()) -&gt; [{ field(), value() }] | {error,
    Reason} to -spec cookie_header(url()) -&gt; { field(), value() } |
    {error, Reason}
- Changes for 25.2.2:
  * ftp: Fixes calls to ftp:nlist/2 returning {error, epath} when
    the file / folder exists
- Changes for 25.2.1:
  * compiler: Fixed a bug that could cause legal code to fail
    validation.
  * compiler: Eliminated a rare crash in the beam_types module.
  * erts: Fixed a bug in selective receive optimization that could
    crash 32-bit emulators.
  * erts: A race condition which was very rarely triggered could
    cause the signal queue of a process to become inconsistent
    causing the runtime system to crash.
  * kernel: The tcp connect option 'bind_to_device' could not be
    used with inet_backend = 'socket'. 'inet' requires value type
    binarry() and 'socket' requires value type 'string()'.
  * kernel: Minor issue processing options when calling
    gen_tcp:connect with a sockaddr() and inet_backend = socket.
  * common_test: Change timeout to infinity for gen_server calls in
    cth_log_redirect
  * inets: fixes a missing case of the type specification for
    httpd:info/2/3/4
  * snmp: Single threaded agent crash when vacm table not properly
    initiated.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1683460800">- Changes for 25.3.2:
  * compiler: Fixed type handling bugs that could cause an internal
    error in the compiler for correct code.
  * os_mon: Avoid error report from failing erlang:port_close at
    shutdown of cpu_sup and memsup. Bug exists since OTP 25.3
    (os_mon-2.8.1).
  * erts: If a runtime system which was starting the distribution
    already had existing pids, ports, or references referring to a
    node with the same nodename/creation pair that the runtime
    system was about to use, these already existing pids, ports, or
    references would not work as expected in various situations
    after the node had gone alive. This could only occur if the
    runtime system was communicated such pids, ports, or references
    prior to the distribution was started. That is, it was
    extremely unlikely to happen unless the distribution was
    started dynamically and was even then very unlikely to happen.
    The runtime system now checks for already existing pids, ports,
    and references with the same nodename/creation pair that it is
    about to use. If such are found another creation will be chosen
    in order to avoid these issues.
- Changes for 25.3.1:
  * snmp: Attempts to minimize the number of the error reports
    during a failed agent init.
  * compiler: When a map update such as #{}#{key:=value} that
    should fail with an exception was unused, the exception would
    be lost.
  * compiler: Fixed bug in the validator that made it reject valid
    code.
  * crypto: With this change, random errors are fixed for
    crypto:generate_key calls with OpenSSL 3.
  * erts: Fixed a bug in the loader that prevented certain modules
    compiled with no_ssa_opt from being loaded.
  * erts: Implementations of the call() driver callback that
    returned a faulty encoded result could cause a memory leak and
    could cause invalid data on the heap of the processes calling
    erlang:port_call/3.
  * erts: Fixed a memory corruption issue when upgrading code. The
    bug was introduced in OTP 25.3
  * erts: Fixed configure tests for a few ARM-specific
    instructions, which prevented the emulator from being built on
    some platforms.
  * erts: Aliases created in combination with a monitor using the
    {alias, explicit_unalias} option stopped working from remote
    nodes when a 'DOWN' signal had been received due to the monitor
    or if the monitor was removed using the erlang:demonitor() BIF.
    This bug was introduced in OTP 24.3.4.10 and OTP 25.3.
  * erts: In rare circumstances, bit syntax matching of an invalid
    code point for a utf32 would crash the runtime system.
  * erts: Building the runtime system failed when native atomic
    support was missing. Note that execution on such systems have
    only been rudimentary tested.
  * erl_interface: Fixed configure tests for a few ARM-specific
    instructions, which prevented the emulator from being built on
    some platforms.
  * eldap: Added a new function eldap:info/1 that returns the
    socket and the transport protocol for the eldap connection.
  * inets: Correct timing related pipelining/keepalive queue bug,
    that could result in unexpected "socket_remotly_closed" errors.
  * inets: With this change, upon remote socket closure current
    request is added to a retried queue (either pipeline or
    keep_alive, but not both).
  * ssl: With this change, ssl:connection_information/2 returns
    correct keylog data after TLS1.3 key update.
  * ssl: Client signature algorithm list input order is now honored
    again , it was accidently reversed by a previous fix.
  * stdlib: The type specs in the erl_parse module has been updated
    to include the maybe construct and the ! operator.
  * wx: Improve debug prints from the nifs. Some minor fixes for
    wxWidgets-3.2. Fixed OpenGL debug functions.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1687521600">- Changes for 25.3.2.2:
  * compiler: The compiler could be very slow when compiling guards
    with multiple guard tests separated with 'or' or ';'.
- Changes for 25.3.2.1:
  * xmerl: New options to xmerl_scan and xmerl_sax_parser so one
    can limit the behaviour of the parsers to avoid some XML
    security issues. xmerl_scan gets one new option:
    xmerl_sax_parser gets the following options: The old option
    skip_external_dtd is still valid and the same as
    {external_entities, none} and {fail_undeclared_ref, false} but
    just affects DTD's and not other external references.
  * erts: Fixed a crash during tracing on certain platforms that
    cannot use the machine stack for Erlang code (mainly OpenBSD
    and Linux with musl).
  * erts: Constructing a binary segment not aligned with a byte
    boundary, with a size not fitting in 31 bits, and with a value
    not fitting in a 64-bit word could crash the runtime system.
  * erts: Further robustify implementation of large maps (&gt; 32
    keys). Keys that happen to have same internal 32-bit hash
    values are now put in collision nodes which are traversed with
    linear search. This removes the demand for the internal hash
    function when salted to eventually produce different hashes for
    all possible pairs of unequal terms.
  * stdlib: Static supervisors are very idle processes after they
    have started so they will now be hibernated after start to
    improve resource management.
  * compiler: Fixed a bug where a failing bsl expression in a guard
    threw an exception instead of causing the guard to fail.
  * compiler: Complex guard expression using the or operator and
    guard BIFs that can fail could sometimes be miscompiled so that
    the guard would succeed even if a call to a guard BIF failed.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1687608000">- Version 26.0:
  * Leex has been extended with optional column number support.
  * The family of enumeration functions in module lists has been
    extended with enumerate/3 that allows a step value to be
    supplied.
  * Update Unicode to version 15.0.0.
  * proc_lib:start*/* has become synchronous when the started
    process fails. This requires that a failing process use a new
    function proc_lib:init_fail/2,3, or exits, to indicate failure. All
    OTP behaviours have been fixed to do this.
  * auto-complete of variables, record names, record fields names,
    map keys, function parameter types and filenames.
  * Open external editor in the shell to edit the current
    expression.
  * defining records (with types), functions, specs and types in
    the shell.
  * Creation and matching of binaries with segments of fixed sizes
    have been optimized.
  * Creation and matching of UTF-8 segments have been optimized.
  * Appending to binaries has been optimized.
  * The compiler and JIT now generate better code for creation of
    small maps where all keys are literals known at compile time.
  * Thanks to the optimizations above the performance of the base64
    module has been significantly improved. For example, on an
    x86_64 system with the JIT both encode and decode are almost
    three times faster than in Erlang/OTP 25.
  * Map comprehensions as suggested in EEP 58 has now been
    implemented.
  * Some map operations have been optimized by changing the
    internal sort order of atom keys. This changes the
    (undocumented) order of how atom keys in small maps are printed
    and returned by maps:to_list/1 and maps:next/1. The new order
    is unpredictable and may change between different invocations
    of the Erlang VM.
  * Introducing the new function maps:iterator/2 for creating an
    interator that return the map elements in a deterministic
    order. There are also new modifiers k and K for the format
    string in io:format() to support printing map elements ordered.
  * Added the new built-in type dynamic() introduced in EEP 61, PR
    introducing EEP 61 improving support for gradual type checkers.
  * Dialyzer has a new incremental mode that be invoked by giving
    the --incremental option when running Dialyzer. This new
    incremental mode is likely to become the default in a future
    release.
  * Multi time warp mode is now enabled by default. This assumes
    that all code executing on the system is time warp safe.
  * Support for UTF-8 atoms and strings in the NIF interface
    including new functions enif_make_new_atom,
    enif_make_new_atom_len and enif_get_string_length.
  * The BIFs min/2 and max/2 are now allowed to be used in guards
    and match specs.
  * Improved the selective receive optimization, which can now be
    enabled for references returned from other functions. This
    greatly improves the performance of gen_server:send_request/3,
    gen_server:wait_response/2, and similar functions.
  * It is no longer necessary to enable a feature in the runtime
    system in order to load modules that are using it. It is
    sufficient to enable the feature in the compiler when compiling
    it.
  * inet:setopts/2 has got 3 new options: reuseport, reuseport_lb
    and exclusiveaddruse.
  * Fix so that -fno-omit-frame-pointer is applied to all of the
    Erlang VM when using the JIT so that tools, such as perf, can
    crawl the process stacks.
  * In the lists module, the zip family of functions now takes
    options to allow handling lists of different lengths.
  * Added the zip:zip_get_crc32/2 function to retrieve the CRC32
    checksum from an opened ZIP archive. gen_server optimized by
    caching callback functions
  * The modules Erlang DNS resolver inet_res and helper modules
    have been updated for RFC6891; to handle OPT RR with DNSSEC OK
    (DO) bit.
  * Introduced application:get_supervisor/1.
  * Cache OTP boot code paths, to limit how many folders that are
    being accessed during a module lookup. Can be disabled with
  - cache_boot_path false.
  * Support for Kernel TLS (kTLS), has been added to the SSL
    application, for TLS distribution (-proto_dist inet_tls), the
    SSL option {ktls, true}.
  * Improved error checking and handling of ssl options.
  * Mitigate memory usage from large certificate chains by lowering
    the maximum handshake size. This should not effect the common
    cases, if needed it can be configured to a higher value.
  * For security reasons the SHA1 and DSA algorithms are no longer
    among the default values.
  * Add encoding and decoding of use_srtp hello extension to
    facilitate for DTLS users to implement SRTP functionality.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1687608001">- Changes for 26.0.1:
  * erts: Build of the socket nif failed on Solaris 11.
  * erts: Fixed two reduction-counting bugs relating to binaries.
  * erts: Constructing a binary segment not aligned with a byte
    boundary, with a size not fitting in 31 bits, and with a value
    not fitting in a 64-bit word could crash the runtime system.
  * erts: When a binary construction failed because of bad size for
    a segment, the error information was not always correct.
  * erts: Fixed a crash when calling a fun that was defined in a
    module that had been upgraded.
  * kernel: The POSIX error exdev was sometimes incorrectly
    described as "cross domain link" in some error messages.
  * kernel: Corrected the socket send function description (send
    with Timeout = nowait). The send function(s) could not return
    {ok, {RestData, SelectInfo}}
  * stdlib: The POSIX error exdev was sometimes incorrectly
    described as "cross domain link" in some error messages.
  * ssl: Make sure that selection of client certificates handle
    both TLS-1.3 and TLS-1.2 names correctly. Could cause valid
    client certificate to not be selected, and an empty client
    certificate message to be sent to server.
  * ssl: Improved ssl:format_error/1 to handle more error tuples.
  * ssl: Fixed hanging ssl:connect when ssl application is not
    started.
  * ssl: Correct handling of retransmission timers, current
    behavior could cause unwanted delays.
  * inets: Do not make the default ssl options by calling
    httpc:ssl_verify_host_options(true) if ssl options are supplied
    by the user.
  * xmerl: New options to xmerl_scan and xmerl_sax_parser so one
    can limit the behaviour of the parsers to avoid some XML
    security issues. xmerl_scan gets one new option:
    xmerl_sax_parser gets the following options: The old option
    skip_external_dtd is still valid and the same as
    {external_entities, none} and {fail_undeclared_ref, false} but
    just affects DTD's and not other external references.
  * compiler: Fixed a bug where a failing bsl expression in a guard
    threw an exception instead of causing the guard to fail.
  * compiler: Fixed a bug that would case the validator to reject
    legal code.
  * compiler: The compiler could re-order clauses matching binaries
    so that the incorrect clause would match. That could only
    happen for code that used the option {error_location,line} or
    for code without line or column number information (e.g.
    generated by a parse transform).
  * compiler: Complex guard expression using the or operator and
    guard BIFs that can fail could sometimes be miscompiled so that
    the guard would succeed even if a call to a guard BIF failed.
  * compiler: With optimizations disabled, a try/catch construct
    could return an incorrect value.
  * compiler: In rare circumstance, a combination of binary
    construction and binary_part/3 would cause the compiler to
    generate unsafe code that would crash the runtime system.
  * compiler: The compiler could be very slow when compiling guards
    with multiple guard tests separated with 'or' or ';'.
  * compiler: Complex guard expressions using 'or' and map updates
    could succeed even if the map update failed.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1698235200">- Changes for 26.1.2:
  * erts: If the external term format encoding of an argument list
    part of a distributed spawn operation was faulty, the newly
    spawned remote process could misbehave. The misbehavior
    included hanging or interpret an incoming message as an
    argument list to use. This was very unlikely to happen unless
    using an alternate implementation of the distribution protocol
    which made a faulty encoding of the argument list. The child
    process will now detect this error and terminate before
    executing the user specified code.
  * erts: Fix bugs where if the body of a matchspec would return a
    map with a variable ('$1', '$_' etc) as one of the keys or
    values and the variable was not an immidiate, the term would
    not be copied to the receiving processes heap. This would later
    corrupt the term in the table as the GC could place move
    markers in it, which in turn would cause the VM to crash. Bug
    has been present for since OTP 17.0.
  * xmerl: The xmerl version 1.3.32 was released in OTP 26.0.1, but
    the incorrect version number of 1.3.31.1 was used for it. This
    incorrect version number continued to appear in OTP 26.0.2, OTP
    26.1, and OTP 26.1.1. The actual xmerl code in these OTP
    versions however corresponds to xmerl version 1.3.32.
- Changes for 26.1.1:
  * wx: The wx application would fail to build on macOS with Xcode
    15.
  * compiler: The compiler could become extremely slow for modules
    containing huge functions.
  * stdlib: Garbage collect the shell process when reducing the
    amount of saved history and results.
- Changes for 26.1:
  * crypto: Fix VM crash caused by crypto being purged and reloaded
    (by init:restart for example) on OS with musl libc (such as
    Alpine linux).
  * crypto: Improved understanding of LibreSSL versions. Support
    chacha20 and chacha20_poly1305 for LibreSSL 3.7. Reflect
    removal of support for the DSS/DSA algorithm which was done in
    LibreSSL 2.6.1.
  * crypto: FIPS supported by crypto for OpenSSL 3.0.* and 3.1.*.
  * asn1: The ASN.1 compiler would ignore a constraint such as
    (SIZE (1..4), ...), causing incorrect behavior of the encoding
    and decoding function for the PER and UPER backends. Corrected
    to handle the constraint in the same way as (SIZE (1..4, ...)).
  * asn1: The JER backend has been internally refactored in a way
    that is compatible for applications that use the documented
    API. However, for a group of ASN.1 modules that depend on each
    other (for example, S1AP-PDU-Descriptions, S1AP-Contents, and
    so on), all modules in the group must be recompiled if on of
    the group members is recompiled.
  * observer: Closing the trace log window via the menu did not
    work.
  * erts: maps:put with existing key and identical value was not
    optimized as a no-op correctly if having the same 32-bit hash
    as another key in the map. In practice very rare and harmless.
  * erts: Fixed an issue with truncated crash slogans on failed
    emulator start.
  * erts: Fixed a bug where the emulator was unable to determine
    the current cgroup CPU quota.
  * erts: A process optimized for parallel signal delivery could
    under some circumstances lose wakeup information. That is, the
    processes was not woken up to take care of the signal, so the
    signal would not be taken care of until the process was woken
    by another signal. Only processes configured with
    message_queue_data set to off_heap utilize this optimization.
  * erts: Function socket:close/1 could cause a VM crash on
    Windows.
  * erts: Fixed a bug in the ARM JIT where it could accidentally
    add garbage trailing bits when creating bitstrings whose size
    wasn't an even multiple of 8 bits.
  * erts: Fix erlang:system_info/1 documentation to show correct
    types.
  * erts: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * erts: Fix compilation with GNU termcap.
  * erts: Delivery time of message signals to a process not
    executing any receive expressions could become very long,
    potentially infinite. For example, a process checking for
    messages using process_info(self(), message_queue_len) or
    process_info(self(), messages) and avoiding to execute a
    receive expression matching on messages could be very slow in
    detecting new messages. Note that you are still discouraged
    from using process_info() this way. A process that wants to
    check if there are messages available to handle should execute
    a receive expression matching on messages.
  * erts: On AArch64 (ARM64), when calculating both the quotient
    and remainder with a divisor begin a power two, the remainder
    could be incorrectly calculated.
  * erts: Fix bug causing "magic" references in a compressed ETS
    table to not keep the referred object alive. The symptom would
    be the referred object being garbage collected prematurely and
    the reference appearing stale, not referring to anything.
    Examples of such magically referred objects are atomics and NIF
    resources.
  * erts: Matching out short bitstrings with a fixed size not
    divisible by 8 could could lead to the runtime system
    terminating with an "Overrun heap and stack" error.
  * erts: A constant flow of incoming non-message signals could
    prevent a process needing to execute dirty from doing so.
  * erts: A BEAM file usually contains a chunk with the tag "Type"
    containing type information that can be used by the JIT. The
    beam_lib:strip/1 takes care to preserve that chunk, but a
    build/release tool that does customized stripping could
    accidentally remove the chunk. Loading a BEAM file without the
    "Type" chunk could cause incorrect behavior of the loaded code.
  * erts: gen_udp:recv/* for Unix Domain Socket in binary mode and
    passive mode has been fixed to not crash.
  * erts: The cleanup operation of not yet delivered signals to a
    terminated process yielded excessively.
  * erts: Fixed minor hashing issue with the local option of
    term_to_binary()/term_to_iovec().
  * erts: Update gen_tcp_socket and gen_udp_socket to handle
    'completion' (socket on Windows).
  * erts: Add support for Unix Domain Sockets (only for STREAM
    sockets) on Windows for 'socket'.
  * erts: In Erlang/OTP 27, by default escripts will be compiled
    before being executed. That means that the compiler application
    must be installed. It is possible to force the escript to be
    interpreted by adding the directive -mode(interpret). to the
    escript file. In Erlang/OTP 28, support for interpreting an
    escript will be removed.
  * erts: Add basic support for socket ioctl on Windows.
  * erts: Removed erts/etc/darwin/Info.plist, as it is no longer
    necessary after macos 10.12
  * erts: Add support for (Windows) socket option exclusiveaddruse.
  * erts: [socket] Add support for the 'nopush' option.
  * erts: Add support for socket option 'BSP STATE'.
  * erts: Add tcp socket options 'keepcnt', 'keepidle' and
    'keepintvl'.
  * erts: Add support for misc (Windows) socket options
    ('max_msg_size' and 'maxdg').
  * compiler: The compiler could run forever when compiling a call
    to is_record/3 with a huge positive tuple size. The call
    is_record(A, a, 0) would crash the compiler when used in a
    function body. When used in a guard the compiler would emit
    incorrect code that would accept {a&gt; as a record.
  * compiler: Fixed a bug that caused dialyzer to crash when
    analyzing bogus code that contained the literal atom undefined
    in segment sizes.
  * compiler: The compiler would crash when compiling some modules
    that contained a call to erlang:load_nif/2.
  * compiler: Fixed a bug that caused the compiler to crash on
    legal code.
  * compiler: The compiler could crash when attempting to compile a
    call to is_list/1 in a complex expression.
  * compiler: A complex guard expression using the or operator
    could succeed when it was supposed to fail.
  * compiler: Compiling nested try/catch and catch expression could
    result in an internal compiler error.
  * compiler: Using the bnot operator in a complex expression could
    cause the compiler to terminate with an internal consistency
    failure diagnostic.
  * compiler: Fixed a bug that caused the compiler to crash in a
    binary optimization pass.
  * compiler: The compiler could terminate with an internal error
    when attempting to compile a binary pattern that could not
    possibly match.
  * compiler: Fixed various performance issues related to the alias
    optimization pass.
  * erl_docgen: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * mnesia: Do not delete old backup file if the new backup fails.
  * megaco: Make megaco transports handle gen_tcp | gen_udp with
    socket backend on Windows (completion).
  * common_test: With this change, ct_hooks manual refers to CTH
    execution order section in user guide.
  * common_test: With this change, Config data from
    pre_end_per_testcase hook is delivered to post_end_per_testcase
    callback in case of testcase timetrap or linked process crash.
  * common_test: With this change, remaining references to not
    supported vts tool in ct_run are removed (mainly relates to
    docs and ct_run help message).
  * common_test: With this change, prompt search functionality in
    ct_telnet handles unicode input.
  * common_test: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * stdlib: The compiler could run forever when compiling a call to
    is_record/3 with a huge positive tuple size. The call
    is_record(A, a, 0) would crash the compiler when used in a
    function body. When used in a guard the compiler would emit
    incorrect code that would accept {a&gt; as a record.
  * stdlib: Fix bug in ets:tab2file that could make it fail if
    another Erlang process created the same file at the same time.
  * stdlib: An {else_clause,Value} exception will now be reported
    nicely in the shell.
  * stdlib: Correct return value for error case, so that it matches
    the documented and intended return value {error,
    {already_started, pid()} when local registered names are used.
  * stdlib: sys:get_state/1,2 and sys:replace_state/2,3 has been
    corrected to handle a state named error as a state name, not as
    a failed system callback. For the standard server behaviours
    this was an issue only for gen_statem (and gen_fsm) when the
    state name was error, and for gen_server if the complete state
    was {error,_}.
  * stdlib: Multiple problems were fixed in
    filelib:safe_relative_path/2. If its second argument was a path
    that contained symbolic links, an incorrect result patch could
    be returned. Also, paths were sometimes falsely considered
    unsafe.
  * stdlib: Fix deadlock when erl.exe is used as part of a pipe on
    Windows and trying to set the encoding of the standard_io
    device.
  * stdlib: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * stdlib: Fix h/2,3 to properly render multi-clause
    documentation.
  * stdlib: Timers created by timer:apply_after/4,
    apply_interval/4, and apply_repeatedly/4 would silently fail to
    do the apply if it was not possible to spawn a process when the
    timer expired. This has now been corrected, and if the spawn
    fails, the system will be taken down producing a crash dump.
  * stdlib: When an Erlang source file lacked a module definition,
    there would be a spurious "module name must not be empty"
    diagnostic for each spec in the file.
  * stdlib: The argument descriptions for option types in argparse
    have been made less ambiguous.
  * stdlib: Clarified the documentation of normal shutdown reason
    on gen_server:call/2,3
  * stdlib: Pattern matching and equivalence (=:=, =/=) comparisons
    on 0.0 will now raise a warning, as it will no longer be
    considered equivalent to -0.0 in OTP 27. If a match on 0.0
    specifically is desired (distinct from -0.0), the warning can
    be suppressed by writing +0.0 instead. The arithmetic
    comparison operators are unaffected, including arithmetic
    equality (==). *** POTENTIAL INCOMPATIBILITY ***
  * stdlib: The semantics of the gen_{server,statem,event}
    behaviour's synchronous start behaviour introduced in OTP-26.0
    with OTP-18471, has been clarified in the documentation.
  * stdlib: Added functionality to set a custom multiline prompt.
  * stdlib: A warning for (accidental use of) Triple-Quoted Strings
    has been implemented as per EEP 64. *** POTENTIAL
    INCOMPATIBILITY ***
  * stdlib: The keyboard shortcuts for the shell are now
    configurable.
  * kernel: Fixed an issue with truncated crash slogans on failed
    emulator start.
  * kernel: Fix shell:start_interactive function specification.
  * kernel: Fix code:get_doc/1 to return missing, when it can't
    find erts instead of crashing.
  * kernel: Function socket:close/1 could cause a VM crash on
    Windows.
  * kernel: Fix deadlock when erl.exe is used as part of a pipe on
    Windows and trying to set the encoding of the standard_io
    device.
  * kernel: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * kernel: Fix logger's overload protection mechanism to only
    fetch memory used by messages when needed.
  * kernel: Fixed a number of socket-related issues causing
    incompatibilities with gen_tcp and gen_udp respectively.
  * kernel: gen_tcp:connect with socket address and socket (inet-)
    backend fails because of missing callback function.
  * kernel: The DNS RR cache used by `inet_res` has been fixed to
    preserve insert order, which is beneficial when the DNS server
    returns RRs in some specific order for e.g load balancing
    purposes.
  * kernel: The options `reuseport`, `reuseport_lb` and
    `exclusiveaddruse` were accidentally not allowed for e.g
    `gen_udp:open/1,2`, which has now been corrected.
  * kernel: gen_udp:recv/* for Unix Domain Socket in binary mode
    and passive mode has been fixed to not crash.
  * kernel: Fixed issue where cursor would not be placed at the end
    of the expression when navigating shell history.
  * kernel: Update gen_tcp_socket and gen_udp_socket to handle
    'completion' (socket on Windows).
  * kernel: Add support for Unix Domain Sockets (only for STREAM
    sockets) on Windows for 'socket'.
  * kernel: Add basic support for socket ioctl on Windows.
  * kernel: The file:location/0 type is now exported.
  * kernel: Add support for (Windows) socket option
    exclusiveaddruse.
  * kernel: [socket] Add support for the 'nopush' option.
  * kernel: Add support for socket option 'BSP STATE'.
  * kernel: Add tcp socket options 'keepcnt', 'keepidle' and
    'keepintvl'.
  * kernel: Add support for misc (Windows) socket options
    ('max_msg_size' and 'maxdg').
  * kernel: The keyboard shortcuts for the shell are now
    configurable.
  * kernel: Optimized code_server to reduce repeated work when
    loading the same module concurrently.
  * debugger: The call int:no_break(Module) did not remove any
    breakpoints.
  * debugger: The maybe expression is now supported in the
    Debugger.
  * debugger: The maybe expression is now supported in the
    Debugger.
  * debugger: The call int:no_break(Module) did not remove any
    breakpoints.
  * ssl: Avoid function clause error in ssl:getopts/2 by handling
    that inet:getopts may return an empty list during some
    circumstances, such as the socket being in a closing state.
  * ssl: The API function `ssl:recv/3` has been tightened to
    disallow negative length, which has never been documented to
    work, but was passed through and caused strange errors.
  * ssl: When a client initiated renegotiation was rejected and the
    client socket was in active mode the expected error message to
    the controlling process was not sent.
  * ssl: Add some guidance for signature algorithms configuration
    in ssl applications users guide.
  * snmp: Make snmp handle gen_udp with socket backend on Windows
    (completion).
  * public_key: Country name comparison shall be case insensitive
  * public_key: Add check to disallow duplicate certs in a path
  * inets: With this change, re_write httpd works as expected and
    does not return error.
  * inets: Fixed a bug so httpd does not crash when stopped at the
    wrong time during TLS connection negotiation, or any other
    theoretically as slow connection setup.
  * inets: Enhance error handling and avoid that the HTTP client
    hangs on headers provided on the wrong format.
  * inets: With this change, error report generated by httpd during
    connection setup contains socket type information.
  * inets: Stop and restart of the httpd server in the Inets
    application has been refactored to a more synchronous and OTP
    supervisor friendly approach. This should increase stability
    and for example avoid a supervisor report from
    httpd_connection_sup about killed child process(es) in some
    cases when stopping or restarting httpd.
  * dialyzer: Fixed a bug that caused dialyzer to crash when
    analyzing bogus code that contained the literal atom undefined
    in segment sizes.
  * dialyzer: Dialyzer could crash when attempting to analyze a
    module that defined a type called product/.
- Changes for 26.0.2:
  * erts: Fix using the IME (Input Method Editor) to enter text in
    cmd.exe and powershell.exe on Windows.
  * erts: Multiple socket:accept calls issue. When making multiple
    accept calls, only the last call is active.
  * erts: Fix the shell to ignore terminal delay when the terminal
    capabilities report that they should be used.
  * erts: Fix "oldshell" to echo characters while typing on
    Windows.
  * erts: On Windows, a call to the function socket:close, when
    there are waiting active calls to read, write or accept
    functions, could hang.
  * erts: Fix issues when reading or configuring standard_io on
    Windows when erl.exe is started using -noshell flag.
  * erts: The following functions are now much faster when given a
    long list or binary:
  * erts: On AArch64 (ARM64), equality and non-equality tests with
    literal bitstrings could succeed when they should fail and vice
    versa.
  * compiler: Fixed a type handling bug that would cause an
    internal consistence failure for correct code.
  * compiler: Fixed a bug that could cause the stack trace of throw
    exceptions to be erroneously optimized out.
  * compiler: Complex guard expression using 'or' were not always
    fully evaluated, making guards that were supposed to fail
    succeed.
  * stdlib: Fix bug where when you entered Alt+Enter in the
    terminal, the cursor would move to the last line, instead of
    moving to the next line.
  * stdlib: Fix eof handling when reading from stdin when erlang is
    started using -noshell.
  * stdlib: Fixed problem where output would disappear if it was
    received after a prompt was written in the shell.
  * stdlib: The following functions are now much faster when given
    a long list or binary:
  * kernel: Fix bug where when you entered Alt+Enter in the
    terminal, the cursor would move to the last line, instead of
    moving to the next line.
  * kernel: Fix so that the shell does not crash on startup when
    termcap is not available.
  * kernel: Multiple socket:accept calls issue. When making
    multiple accept calls, only the last call is active.
  * kernel: Fix the shell to ignore terminal delay when the
    terminal capabilities report that they should be used.
  * kernel: Fix "oldshell" to echo characters while typing on
    Windows.
  * kernel: Fix eof handling when reading from stdin when erlang is
    started using -noshell.
  * kernel: On Windows, a call to the function socket:close, when
    there are waiting active calls to read, write or accept
    functions, could hang.
  * kernel: Fix issues when reading or configuring standard_io on
    Windows when erl.exe is started using -noshell flag.
  * kernel: gen_udp:connect with inet_backend = socket fails when
    the Address is a hostname (string or atom).
  * kernel: Fixed problem which would cause shell to crash if
    particular escape sequence was written to stdout.
  * kernel: Fixed problem where output would disappear if it was
    received after a prompt was written in the shell.
  * kernel: Fix a crash where the location of erts could not be
    found in rebar3 dev builds.
  * kernel: Introduce the KERNEL application parameter
    standard_io_encoding that can be used to set the default
    encoding for standard_io. This option needs to be set to latin1
    if the application wants to treat all input data as bytes
    rather than utf-8 encoded characters.
  * ssl: Added keylog information to all protocol versions in
    ssl:connection_information/2.
  * ssl: Add RFC-6083 considerations for DTLS to enable gen_sctp
    based callback for the transport.
  * ssh: Added multiline editing support to ssh clients connected
    through OTP ssh daemon.</changelog>
  <changelog author="sflees@suse.de" date="1704974400">- Changes for 26.2.1:
  * erts: Removed unnecessary PCRE source tar-ball.
  * ssh: With this change (being response to CVE-2023-48795),
    ssh can negotiate "strict KEX" OpenSSH extension with
    peers supporting it; also
    'chacha20-poly1305@openssh.com' algorithm becomes a
    less preferred cipher.
    If strict KEX availability cannot be ensured on both
    connection sides, affected encryption modes(CHACHA and
    CBC) can be disabled with standard ssh configuration.
    This will provide protection against vulnerability, but
    at a cost of affecting interoperability. See
    Configuring algorithms in SSH. (bsc#1218192, CVE-2023-48795)
- Changes for 26.2:
  * all: Replaced unintentional Erlang Public License 1.1
    headers in some files with the intended Apache License
    2.0 header.
  * otp: The removal of the deprecated slave module, originally
    planned for OTP 27, has been postponed to OTP 29.
  * asn1: Fix benign warning from gcc 11 about mismatching call
    to free().
  * crypto: Enable engine support for OpenSSL versions 3.
  * edoc: Emit &lt;code&gt; instead of &lt;tt&gt;.
- Disable test suite for now, it has many false positives and
  takes a very long time.</changelog>
  <changelog author="sflees@suse.de" date="1706011200">- This codestream wasn't affected by bsc#1207113</changelog>
  <changelog author="sflees@suse.de" date="1706011201">- Disable rpmlint tests on SLE-15 where they currently fail</changelog>
  <changelog author="sflees@suse.de" date="1715947200">- Create a versioned package for SLES</changelog>
</package>
<package pkgid="a906abab1fa4d865c40cce6a5f2864abc4d9c8cd0433a59c1102f084e9c84fd4" name="erlang26" arch="src">
  <version epoch="0" ver="26.2.1" rel="150300.7.5.1"/>
  <changelog author="matwey.kornilov@gmail.com" date="1646568000">- Changes for 24.2.2:
  * inets: Avoid intermediate ungraceful shutdown of the HTTP
    server.
  * ssh: The ssh sever parallel_login option was missing in OTP-24</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1648382400">- Changes for 24.3.2:
  * erl_interface: Fix compile error regarding gethostbyaddr_r on
    Android. Error introduced in OTP 24.3.
  * kernel: Fix failed accepted connection setup after previous
    established connection from same node closed down silently.
  * kernel: Fixed a problem where typing Ctrl-R in the shell could
    hang if there were some problem with the history log file.
- Changes for 24.3.1:
  * dialyzer: There could be spurious warnings for unknown types
    when a type was a subtype of an existing type that was a
    subtype of an unknown type.
  * ssl: Client certification could fail for TLS-1.3 servers that
    did not include the certificat_authorties extension in its
    certificate request message.
- Changes for 24.3:
  * megaco: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.
  * megaco: Update the performance and debug chapters of the megaco
    user's guide. Also some updates to the meas tools.
  * compiler: The expression &lt;&lt;0/native-float&gt;&gt;=Bin would always
    fail to match, while &lt;&lt;0/float-native&gt;&gt;=Bin would match
    (provided that Bin contained the binary representation of 0.0)
  * compiler: The compiler will now compile huge functions with
    straight-line code faster.
  * erl_interface: Add --enable-ei-dynamic-lib configure option
    that will make erl_interface also release a dynamic library
    version of libei.
  * erl_interface: The ei API for decoding/encoding terms is not
    fully 64-bit compatible since terms that have a representation
    on the external term format larger than 2 GB cannot be handled.
  * sasl: Fix bug in systools:make_script/1 documentation.
  * inets: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.
  * inets: Documentation fix for inets:services_info/0, which now
    describes that Info might be a Reason term() in case when
    {error, Reason} is returned as service info.
  * crypto: The crypto app in OTP can since OTP-24.2 be compiled,
    linked and used with the new OpenSSL 3.0 cryptolib. The crypto
    app has 3.0 support has been improved, but is still *not
    recommended* for other usages than experiments and alpha
    testing. There are not yet any guaranties that it works, not
    even together with other OTP applications like for example SSL
    and SSH, although there are no known errors. Since the previous
    release, OTP-24.2, the following improvements have been done: -
    It has been tested during nearly every nightly test on the OTP
    lab - The hash algorithms md4 and ripemd160 have been enabled
    with OpenSSL 3.0. - The ciphers blowfish_cbc, blowfish_ecb,
    des_cbc, des_cfb, des_ecb, rc2_cbc and rc4 have been enabled
    with OpenSSL 3.0. Disabled or unsupported with OpenSSL 3.0 are
    still: - ENGINE support - FIPS mode - Other providers than the
    built-in ones - Compiling and linking with OpenSSL 3.0
    cryptolib in compatibility modes (for example to behave as
    1.1.1) and, the ciphers blowfish_cfb64 and blowfish_ofb64 are
    not supported and will not be either. Deprecated functions in
    the OpenSSL 3.0 cryptolib must not be disabled as OTP/crypto
    still uses some of the deprecated API functions. The gcc flag
  - Wno-deprecated-declarations is set to prevent deprecation
    warnings to be printed when compiling.
  * crypto: Crypto is adapted to LibreSSL 3.5.0 on OpenBSD.
  * crypto: New configure option ( --disable-otp-test-engine) to
    prohibit the build of the OTP test engine used in some test
    suites. The reason is that the test engine could be hard to
    compile on for instance LibreSSL 3.5.0. For that particular
    cryptolib version (or higher), this configure option is set
    automatically.
  * jinterface: Fix bug in OtpOutputStream.write_pid/4 and
    write_ref/3 causing faulty encodig. Bug exists since OTP 23.0.
  * wx: Removed the static_data option from wxImage creation
    functions, as it was broken and could lead to crashes. Now
    image data is always copied to wxWidgets as was the default
    behavior. Removed some non working wxGridEvent event types,
    which have there own events in newer wxWidgets versions, and
    added a couple of event types that where missing in wx.
  * asn1: Add support for the maps option in combination with the
    jer backend.
  * snmp: The compilation time is no longer recorded in BEAM files.
    There remained several undocumented functions that attempted to
    retrieve compilation times. Those have now been removed.
  * snmp: [agent] Remove expectation of socket being a port.
  * common_test: OTP internal test fix.
  * runtime_tools: Fixed bug in scheduler:utilization(Seconds) that
    would leave the scheduler_wall_time system flag incorrectly
    enabled.
  * runtime_tools: Add scheduler:get_sample/0 and get_sample_all/0.
    Also clarify scheduler module documentation about how it
    depends on system flag scheduler_wall_time.
  * erts: Fixed a bug in the x86 JIT that might cause floating
    point instructions to wrongly throw an exception.
  * erts: Preserve correct nodedown_reason if supervised
    distribution controller processes exit with {shutdown, Reason}.
  * erts: Handling of send_timeout for gen_tcp has been corrected
    so that the timeout is honored also when sending 0 bytes.
  * erts: By default global does not take any actions to restore a
    fully connected network when connections are lost due to
    network issues. This is problematic for all applications
    expecting a fully connected network to be provided, such as for
    example mnesia, but also for global itself. A network of
    overlapping partitions might cause the internal state of global
    to become inconsistent. Such an inconsistency can remain even
    after such partitions have been brought together to form a
    fully connected network again. The effect on other applications
    that expects that a fully connected network is maintained may
    vary, but they might misbehave in very subtle hard to detect
    ways during such a partitioning. In order to prevent such
    issues, we have introduced a prevent overlapping partitions fix
    which can be enabled using the prevent_overlapping_partitions
    kernel(6) parameter. When this fix has been enabled, global
    will actively disconnect from nodes that reports that they have
    lost connections to other nodes. This will cause fully
    connected partitions to form instead of leaving the network in
    a state with overlapping partitions. Note that this fix has to
    be enabled on all nodes in the network in order to work
    properly. Since this quite substantially changes the behavior,
    this fix is currently disabled by default. Since you might get
    hard to detect issues without this fix you are, however,
    strongly advised to enable this fix in order to avoid issues
    such as the ones described above. As of OTP 25 this fix will
    become enabled by default.
  * erts: Corrected the type specification of erlang:seq_trace/2.
  * erts: Fix memory leak when tracing on running on a process that
    only handle system tasks or non-message signals (for example
    process_info requests).
  * erts: Add support for using socket:sockaddr_in() and
    socket:sockaddr_in6() when using gen_sctp, gen_tcp and gen_udp.
    This will make it possible to use Link Local IPv6 addresses.
  * erts: Show on_load failure reasons in embedded mode.
  * erts: Compile date saved in the Erlang VM executable has been
    removed.
  * erts: Improve documentation for the dynamic node name feature.
  * ssh: Fix makefile dependency bugs.
  * ssh: Fixed faulty OpenSSH decoding of Ed25519/Ed448 keys in the
    OpenSSH format openssh_key_v1.
  * ssh: Correction of ssh_file typing, specially for the
    experimental openssh-key-v1 encoding.
  * ssh: Improper tag for private ED keys when encoding with
    ssh:encode/2. The tuple had ed_priv as first element, but
    should have had ed_pri. This is now corrected. *** POTENTIAL
    INCOMPATIBILITY ***
  * ssh: Add support for Ed25519/Ed448 SSH host keys in the RFC
    4716 format ("-----BEGIN EC PRIVATE KEY-----") generated by for
    example openssl or via Erlang functions (i.e.
    public_key:generate_key({namedCurve, ed25519})). Ed25519 SSH
    host keys generated by ssh-keygen was, and are still,
    supported.
  * kernel: Handling of send_timeout for gen_tcp has been corrected
    so that the timeout is honored also when sending 0 bytes.
  * kernel: By default global does not take any actions to restore
    a fully connected network when connections are lost due to
    network issues. This is problematic for all applications
    expecting a fully connected network to be provided, such as for
    example mnesia, but also for global itself. A network of
    overlapping partitions might cause the internal state of global
    to become inconsistent. Such an inconsistency can remain even
    after such partitions have been brought together to form a
    fully connected network again. The effect on other applications
    that expects that a fully connected network is maintained may
    vary, but they might misbehave in very subtle hard to detect
    ways during such a partitioning. In order to prevent such
    issues, we have introduced a prevent overlapping partitions fix
    which can be enabled using the prevent_overlapping_partitions
    kernel(6) parameter. When this fix has been enabled, global
    will actively disconnect from nodes that reports that they have
    lost connections to other nodes. This will cause fully
    connected partitions to form instead of leaving the network in
    a state with overlapping partitions. Note that this fix has to
    be enabled on all nodes in the network in order to work
    properly. Since this quite substantially changes the behavior,
    this fix is currently disabled by default. Since you might get
    hard to detect issues without this fix you are, however,
    strongly advised to enable this fix in order to avoid issues
    such as the ones described above. As of OTP 25 this fix will
    become enabled by default.
  * kernel: Fix bug where logger would crash when logging a report
    including improper lists.
  * kernel: Make erlang:set_cookie work for dynamic node names.
  * kernel: Add support for using socket:sockaddr_in() and
    socket:sockaddr_in6() when using gen_sctp, gen_tcp and gen_udp.
    This will make it possible to use Link Local IPv6 addresses.
  * kernel: A net_tickintensity kernel parameter has been
    introduced. It can be used to control the amount of ticks
    during a net_ticktime period. A new net_kernel:start/2 function
    has also been introduced in order to make it easier to add new
    options. The use of net_kernel:start/1 has been deprecated.
  * kernel: Improve documentation for the dynamic node name
    feature.
  * erl_docgen: Fix css for large tables and images on small
    screens
  * erl_docgen: Fix bug with codeinclude tag that caused it to not
    include the code if used in a correct, but unexpected way.
  * observer: Calculate the display width in etop, instead of hard-
    coding it to 89 characters.
  * debugger: Fix record index matching, it was broken and could
    never match.
  * ssl: Improved error handling.
  * ssl: Before this change, net_kernel used with TLS distribution
    might be leaking processes in case of connectivity issues.
  * ssl: Fix makefile dependency bugs.
  * ssl: Make sure the TLS sender process handles explicit calls to
    erlang:disconnect_node properly, avoiding potential hanging
    problems in net_kernel.
  * ssl: Add support for TLS-1.3 certificate_authorities extension.
    And process certificate_authorities field in pre-TLS-1.3
    certificate requests.
  * ssl: Support password fun for protected keyfiles in ssl:connect
    function.
  * ssl: Add in some cases earlier detection of possible DoS
    attacks by malicious clients sending unexpected TLS messages
    instead of the client hello. Note that such attacks are already
    mitigated by providing a timeout for the TLS handshake.
  * eldap: Fix eldap extensibleMatch dnAttributes option. According
    to the ldap ASN1 the dnAttributes should be a bool, instead it
    was generated as a string.
  * eldap: Implemented paged searches according to https://www.rfc-
    editor.org/rfc/rfc2696.txt
  * public_key: Support password fun for protected keyfiles in
    ssl:connect function.
  * stdlib: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.
  * mnesia: Reduce the number of locks taken during table copying,
    should reduce the startup time on large systems.
  * diameter: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1649246400">- Fix build for Factory. Currently, any Java version
  is fine for Erlang.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1653220800">- Version 25.0:
  - stdlib
  * New function filelib:ensure_path/1 will ensure that all
    directories for the given path exists
  * New functions groups_from_list/2 and groups_from_list/3 in
    the maps module
  * New functions uniq/1 uniq/2 in the lists module
  * New PRNG added to the rand module, for fast pseudo-random
    numers.
  - compiler, kernel, stdlib, syntax_tools:
  * Added support for selectable features as described in EEP-60.
    Features can be enabled/disabled during compilation with
    options (ordinary and +term) to erlc as well as with
    directives in the file. Similar options can be used to erl
    for enabling/disabling features allowed at runtime. The new
    maybe expression EEP-49 is fully supported as the feature
    maybe_expr.
  - erts &amp; JIT:
  * The JIT now works for 64-bit ARM processors.
  * The JIT now does type-based optimizations based on type
    information in the BEAM files.
  * Improved the JIT’s support for external tools like perf and
    gdb, allowing them to show line numbers and even the original
    Erlang source code when that can be found.
  - erts, stdlib, kernel:
  * Users can now configure ETS tables with the
    {write_concurrency, auto} option. This option forces tables
    to automatically change the number of locks that are used at
    run-time depending on how much concurrency is detected. The
    {decentralized_counters, true} option is enabled by default
    when {write_concurrency, auto} is active.
  * Benchmark results comparing this option with the other ETS
    optimization options are available here: benchmarks.
  * To enable more optimizations, BEAM files compiled with OTP 21
    and earlier cannot be loaded in OTP 25.
  * The signal queue of a process with the process flag
    message_queue_data=off_heap has been optimized to allow
    parallel reception of signals from multiple processes. This
    can improve performance when many processes are sending in
    parallel to one process. See benchmark.
  * The Erlang installation directory is now relocatable on the
    file system given that the paths in the installation’s
    RELEASES file are paths that are relative to the
    installations root directory.
  * A new option called short has been added to the functions
    erlang:float_to_list/2 and erlang:float_to_binary/2. This
    option creates the shortest correctly rounded string
    representation of the given float that can be converted back
    to the same float again.
  * Introduction of quote/1 and unquote/1 functions in the
    uri_string module - a replacement for the deprecated
    functions http_uri:encode and http_uri:decode.
  * The new module peer supersedes the slave module. The slave
    module is now deprecated and will be removed in OTP 27.
  * global will now by default prevent overlapping partitions due
    to network issues. This is done by actively disconnecting
    from nodes that reports that they have lost connections to
    other nodes. This will cause fully connected partitions to
    form instead of leaving the network in a state with
    overlapping partitions.
  * It is possible to turn off the new behavior by setting the
    the kernel configuration parameter
    prevent_overlapping_partitions to false. Doing this will
    retain the same behavior as in OTP 24 and earlier.
  * The format_status/2 callback for gen_server, gen_statem and
    gen_event has been deprecated in favor of the new
    format_status/1 callback.
  * The new callback adds the possibility to limit and change
    many more things than the just the state.
  * The timer module has been modernized and made more efficient,
    which makes the timer server less susceptible to being
    overloaded. The timer:sleep/1 function now accepts an
    arbitrarily large integer.
  - compiler:
  * The maybe ... end construction as proposed in EEP-49 has been
    implemented. It can simplify complex code where otherwise
    deeply nested cases would have to be used.
  * To enable maybe, give the option {enable_feature,maybe_expr}
    to the compiler. The exact option to use will change in a
    coming release candidate and then it will also be possible to
    use from inside the module being compiled.
  * When a record matching or record update fails, a {badrecord,
    ExpectedRecordTag} exception used to be raised. In this
    release, the exception has been changed to {badrecord,
    ActualValue}, where ActualValue is the value that was found
    instead of the expected record.
  * Add compile attribute -nifs() to empower compiler and loader
    with information about which functions may be overridden as
    NIFs by erlang:load_nif/2.
  * Improved and more detailed error messages when binary
    construction with the binary syntax fails. This applies both
    for error messages in the shell and for
    erl_error:format_exception/3,4.
  * Change format of feature options and directives for better
    consistency. Options to erlc and the -compile(..) directive
    now has the format {feature, feature-name, enable | disable}.
    The -feature(..) now has the format -feature(feature-name,
    enable | disable).
  - crypto:
  * Add crypto:hash_equals/2 which is a constant time comparision
    of hashvalues.
  - ssl:
  * Introducing a new (still experimental) option
    {certs_keys,[cert_key_conf()]}. With this a list of a
    certificates with their associated key may be used to
    authenticate the client or the server. The certificate key
    pair that is considered best and matches negotiated
    parameters for the connection will be selected.
  - public_key:
  * Functions for retrieving OS provided CA-certs added.
  - dialyzer:
  * Optimize operations in the erl_types module. Parallelize the
    Dialyzer pass remote.
  * Added the missing_return and extra_return options to raise
    warnings when specifications differ from inferred types.
    These are similar to, but not quite as verbose as overspecs
    and underspecs.
  * Dialyzer now better understands the types for min/2, max/2,
    and erlang:raise/3. Because of that, Dialyzer can potentially
    generate new warnings. In particular, functions that use
    erlang:raise/3 could now need a spec with a no_return()
    return type to avoid an unwanted warning.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1656849600">- Changes for 25.0.2:
  * ssl: Improved handling of unexpected messages during the
    handshake, taking the right action for unexpected messages.
  * erts: On computers with the ARM64 (AArch64) architecture (such
    as Apple Silicon Macs) a rem expression followed by a div
    expression with the same operands could evaluate to the wrong
    result if the result of the rem expression was unused.
- Changes for 25.0.1:
  * ssl: When a TLS-1.3 enabled client tried to talk to a TLS-1.2
    server that coalesces TLS-1.2 handshake message over one TLS
    record, the connection could fail due to some message being
    handled in the wrong state, this has been fixed.
  * ssl: Correctly handles supported protocol version change from
    default to something else by sni_fun supplied to
    ssl:handshake/[2,3] together with a TCP-socket (so called
    upgrade).
  * ssl: Also, TLS-1.3 should respond with a protocol version alert
    if previous versions, that are supported but not configured,
    are attempted.
  * kernel: The DNS resolver inet_res has been fixed to ignore
    trailing dot difference in the request domain between the sent
    request and the received response, when validating a response.
  * kernel: A bug in inet_res has been fixed where a missing
    internal {ok,_} wrapper caused inet_res:resolve/* to return a
    calculated host name instead of an `{ok,Msg} tuple, when
    resolving an IP address or a host name that is an IP address
    string.
  * kernel: The erlang:is_alive() BIF could return true before
    configured distribution service was available. This bug was
    introduced in OTP 25.0 ERTS version 13.0. The
    erlang:monitor_node() and erlang:monitor() BIFs could
    erroneously fail even though configured distribution service
    was available. This occurred if these BIFs were called after
    the distribution had been started using dynamic node name
    assignment but before the name had been assigned.
  * kernel: Added the missing mandatory address/0 callback in the
    gen_tcp_dist example.
  * erts: A spawn_reply signal from a remote node could be delayed
    and be delivered after other signals from the newly spawned
    process. When this bug triggered, the connection to the node
    where the process was spawned sometimes could be taken down due
    to the bug. The following error message would then be logged if
    this happened: Missing 'spawn_reply' signal from the node
    &lt;RemoteNode&gt; detected by &lt;Pid&gt; on the node &lt;LocalNode&gt;. The
    node &lt;RemoteNode&gt; probably suffers from the bug with ticket id
    OTP-17737. This bug only affected processes which had enabled
    off_heap message_queue_data and parallel reception of signals
    had been automatically enabled. This bug was introduced in OTP
    25.0, ERTS version 13.0.
  * erts: Fixed type spec of erlang:system_info(dist_ctrl).
  * erts: The zlib built in to the runtime system has been updated
    to version 1.2.12. (Note that on most platforms, the platform's
    own zlib is used.)
  * erts: The erlang:is_alive() BIF could return true before
    configured distribution service was available. This bug was
    introduced in OTP 25.0 ERTS version 13.0. The
    erlang:monitor_node() and erlang:monitor() BIFs could
    erroneously fail even though configured distribution service
    was available. This occurred if these BIFs were called after
    the distribution had been started using dynamic node name
    assignment but before the name had been assigned.
  * crypto: Note in the documentation that MODP (rfc3526) groups
    and OpenSSL 3.0 can give an error if a call to
    crypto:generate_key/2 specifies a key length, and that length
    is to small.
  * crypto: The cmac now uses only the 3.0 API
  * crypto: Documentation is now updated with which OpenSSL
    cryptolib versions that OTP currently is tested.
  * dialyzer: Fixed the documentation for the missing_return and
    extra_return options.
  * mnesia: Fixed add_table_copy which could leave a table lock if
    the receiving node went down during the operation.
  * ssh: Binaries can be limited in logs with the parameter
    max_log_item_len. The default value is 500 bytes.
  * stdlib: In the initial release of Erlang/OTP 25, the expression
    bound to the _ pseudo-field in a record initialization would
    always be evaluated once, even if all other fields in the
    record were explicitly initialized. That would break the use
    case of binding the expression error(...) to _ in order to get
    an exception if not all fields were initialized. The behavior
    of binding to _ has been reverted to the pre-OTP 25 behavior,
    that is, to not evaluate the expression if all fields have been
    bound to explicit values.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1660046400">- Changes for 25.0.3:
  * erts: Distributed exit signals could be lost under the
    following conditions:
  * erts: A race could cause process_info(Pid, message_queue_len)
    on other processes to return invalid results.
  * erts: Fixed reduction counting for handling process system
    tasks.
  * erts: Priority elevation of terminating processes did not work
    which could cause execution of such processes to be delayed.
  * erts: An unlink operation made by a process that terminated
    before the unlink operation completed, i.e., before it had
    received an unlink-ack signal from the linked process, caused
    an exit signal to erroneously be sent from the terminating
    process to the process being unlinked. This exit signal would
    most often be ignored by the receiver, but if the receiver of
    the exit signal concurrently set up a new link, it could
    receive the exit signal with the actual exit reason of the
    terminating process instead of a noproc exit reason. It is
    however very hard to detect that this has happened and has no
    obvious negative consequences, so it should be considered
    harmless. A distributed unlink-ack signal received by a
    terminating process was also not properly removed which could
    cause a minor memory leak.
  * ssl: The link to crypto:engine_load refered the function with
    wrong arity.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1661601600">- Changes for 25.0.4:
  * kernel: A call to net_kernel:setopts(new, Opts) at the same
    time as a connection was being set up could cause a deadlock
    between the net_kernel process and the process setting up the
    connection.
  * erts: The monitor/3 BIF did not apply options to the created
    monitor if the target process or port did not exist. That is,
    the corresponding down message would get a `DOWN` tag even if a
    custom tag had been set, and the returned reference was not an
    alias even if the alias option had been passed.
  * erts: The erlang:monotonic_time/1, erlang:system_time/1,
    erlang:time_offset/1, and os:system_time/1 BIFs erroneously
    failed when passed the argument native.</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1665662400">- Changes for 25.1.1:
  * dialyzer: Dialyzer could crash when analyzing Elixir code that
    used intricate macros.
  * dialyzer: The --input_list_file option has been added.
  * ssl: Fixes handling of symlinks in cacertfile option.
  * eunit: With this change, eunit exact_execution option works
    with application primitive.
  * stdlib: peer nodes failed to halt when the process supervising
    the control connection crashed. When an alternative control
    connection was used, this supervision process also quite
    frequently crashed when the peer node was stopped by the node
    that started it which caused the peer node to linger without
    ever halting.
  * asn1: For the per and uper ASN.1 encoding rules, encoding and
    decoding the SEQUENCE OF and SET OF constructs with 16384 items
    or more is now supported.
  * erts: Listen sockets created with the socket module, leaked
    (erlang-) monitors.
  * erts: Notifications about available distribution data sent to
    distribution controller processes could be lost. Distribution
    controller processes can be used when implementing an
    alternative distribution carrier. The default distribution over
    tcp was not effected and the bug was also not present on
    x86/x86_64 platforms.
  * kernel: Listen sockets created with the socket module, leaked
    (erlang-) monitors.
  * kernel: peer nodes failed to halt when the process supervising
    the control connection crashed. When an alternative control
    connection was used, this supervision process also quite
    frequently crashed when the peer node was stopped by the node
    that started it which caused the peer node to linger without
    ever halting.
- Changes for 25.1:
  * dialyzer: Two bugs have been fixed in Dialyzer's checking of
    behaviors: When a mandatory callback function is present but
    not exported, Dialyzer would not complain about a missing
    callback. When an optional callback function was not exported
    and had incompatible arguments and/or the return values were
    incompatible, Dialyzer would complain. This has been changed to
    suppress the warning, because the function might not be
    intended to be a callback function, for instance if a release
    added a new optional callback function (such as format_status/1
    for the gen_server behaviour added in OTP 25).
  * dialyzer: The no_extra_return and no_missing_return warnings
    can now be suppressed through -dialyzer directives in source
    code.
  * jinterface: Fix javadoc build error by adding option -encoding
    UTF-8.
  * diameter: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * crypto: Fix configure with --with-ssl and --disable-dynamic-
    ssl-lib on Windows.
  * crypto: Remove all references correctly in the garbage
    collection if an engine handle was not explicit unloaded.
  * crypto: Changed the behaviour of the engine load/unload
    functions The engine load/unload functions have got changed
    semantics to get a more consistent behaviour and work correct
    when variables are garbage collected. The load functions now
    don't register the methods for the engine to replace. That will
    now be handled with the new functions
    engine_register/engine_unregister if needed. Some functions are
    removed from the documentation and therefor the API, but they
    are left in the code for compatibility. *** POTENTIAL
    INCOMPATIBILITY ***
  * crypto: Fixed a naming bug for AES-CFB and Blowfish-CFB/OFB
    when linked with OpenSSL 3.0 cryptolib.
  * crypto: Sign/verify does now behave as in OTP-24 and earlier
    for eddsa.
  * crypto: Pass elliptic curve names from crypto.erl to crypto's
    nif.
  * crypto: The configure option --disable-deprecated-warnings is
    removed. It was used for some releases when the support for
    OpenSSL 3.0 was not completed. It is not needed in OTP 25.
  * crypto: Crypto is now considered to be usable with the OpenSSL
    3.0 cryptolib for production code. ENGINE and FIPS are not yet
    fully functional.
  * crypto: Do not exit if the legacy provider is missing in
    libcrypto 3.0.
  * ssl: Reject unexpected application data in all relevant places
    for all TLS versions. Also, handle TLS-1.3 middlebox
    compatibility with more care. This will make malicious
    connections fail early and further, mitigate possible DoS
    attacks, that would be caught by the handshake timeout. Thanks
    to Aina Toky Rasoamanana and Olivier Levillain from Télécom
    SudParis for alerting us of the issues in our implementation.
  * ssl: With this change, value of cacertfile option will be
    adjusted before loading certs from the file. Adjustments
    include converting relative paths to absolute and converting
    symlinks to actual file path. Thanks to Marcus Johansson
  * ssl: In TLS-1.3, if chain certs are missing (so server auth
    domain adherence can not be determined) send peer cert and hope
    the server is able to recreate a chain in its auth domain.
  * ssl: Make sure periodical refresh of CA certificate files
    repopulates cache properly.
  * ssl: Correct internal CRL cache functions to use internal
    format consistently.
  * ssl: Incorrect handling of client middlebox negotiation for
    TLS-1.3 could result in that a TLS-1.3 server would not use
    middlebox mode although the client was expecting it too and
    failing the negotiation with unexpected message.
  * ssl: If the "User" process, the process starting the TLS
    connection, gets killed in the middle of spawning the dynamic
    connection tree make sure we do not leave any processes behind.
  * ssl: A vulnerability has been discovered and corrected. It is
    registered as CVE-2022-37026 "Client Authentication Bypass".
    Corrections have been released on the supported tracks with
    patches 23.3.4.15, 24.3.4.2, and 25.0.2. The vulnerability
    might also exist in older OTP versions. We recommend that
    impacted users upgrade to one of these versions or later on the
    respective tracks. OTP 25.1 would be an even better choice.
    Impacted are those who are running an ssl/tls/dtls server using
    the ssl application either directly or indirectly via other
    applications. For example via inets (httpd), cowboy, etc. Note
    that the vulnerability only affects servers that request client
    certification, that is sets the option {verify, verify_peer}.
    (bsc#1205318)
  * eunit: With this change, Eunit can optionally not try to
    execute related module with "_tests" suffix. This might be used
    for avoiding duplicated executions when source and test modules
    are located in the same folder.
  * erl_docgen: Update DTD to allow XML tag em under pre.
  * inets: Add httpc:ssl_verify_host_options/1 to help setting
    default ssl options for the https client.
  * inets: This change fixes dialyzer warnings generated for
    inets/httpd examples (includes needed adjustment of spec for
    ssh_sftp module).
  * inets: Remove documentation of no longer supported callback.
  * stdlib: Fixed inconsistency bugs in global due to
    nodeup/nodedown messages not being delivered before/after
    traffic over connections. Also fixed various other
    inconsistency bugs and deadlocks in both global_group and
    global. As building blocks for these fixes, a new BIF
    erlang:nodes/2 has been introduced and
    net_kernel:monitor_nodes/2 has been extended. The -hidden and
  - connect_all command line arguments did not work if multiple
    instances were present on the command line which has been
    fixed. The new kernel parameter connect_all has also been
    introduced in order to replace the -connect_all command line
    argument.
  * stdlib: Fix the public_key:ssh* functions to be listed under
    the correct release in the Removed Functionality User's Guide.
  * stdlib: The type spec for format_status/1 in gen_statem,
    gen_server and gen_event has been corrected to state that the
    return value is of the same type as the argument (instead of
    the same value as the argument).
  * stdlib: If the timer server child spec was already present in
    kernel_sup but it was not started, the timer server would fail
    to start with an {error, already_present} error instead of
    restarting the server.
  * stdlib: When changing callback module in gen_statem the
    state_enter calls flag from the old module was used in for the
    first event in the new module, which could confuse the new
    module and cause malfunction. This bug has been corrected. With
    this change some sys debug message formats have been modified,
    which can be a problem for debug code relying on the format.
  * ** POTENTIAL INCOMPATIBILITY ***
  * stdlib: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * stdlib: The rfc339_to_system_time/1,2 functions now allows the
    minutes part to be omitted from the time zone.
  * stdlib: The receive statement in gen_event has been optimized
    to not use selective receive (which was never needed, and could
    cause severe performance degradation under heavy load).
  * stdlib: Add new API function erl_features:configurable/0
  * parsetools: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * public_key: Support more Linux distributions in cacerts_load/0.
  * public_key: Correct asn1 typenames available in type
    pki_asn1_type()
  * public_key: Sign/verify does now behave as in OTP-24 and
    earlier for eddsa.
  * snmp: Improved the get-bulk response max size calculation. Its
    now possible to configure 'empty pdu size', see appendix c for
    more info.
  * snmp: Fix various example dialyzer issues
  * ssh: Handling rare race condition at channel close.
  * ssh: New ssh option no_auth_needed to skip the ssh
    authentication. Use with caution!
  * ssh: This change fixes dialyzer warnings generated for
    inets/httpd examples (includes needed adjustment of spec for
    ssh_sftp module).
  * ssh: The new function ssh:daemon_replace_options/2 makes it
    possible to change the Options in a running SSH server.
    Established connections are not affected, only those created
    after the call to this new function.
  * ssh: Add a timeout as option max_initial_idle_time. It closes a
    connection that does not allocate a channel within the timeout
    time. For more information about timeouts, see the Timeouts
    section in the User's Guide Hardening chapter.
  * observer: Fixed units in gui.
  * xmerl: There is a new configure option, --enable-deterministic-
    build, which will apply the deterministic compiler option when
    building Erlang/OTP. The deterministic option has been improved
    to eliminate more sources of non-determinism in several
    applications.
  * asn1: There is a new configure option, --enable-deterministic-
    build, which will apply the deterministic compiler option when
    building Erlang/OTP. The deterministic option has been improved
    to eliminate more sources of non-determinism in several
    applications.
  * erts: Fixed inconsistency bugs in global due to nodeup/nodedown
    messages not being delivered before/after traffic over
    connections. Also fixed various other inconsistency bugs and
    deadlocks in both global_group and global. As building blocks
    for these fixes, a new BIF erlang:nodes/2 has been introduced
    and net_kernel:monitor_nodes/2 has been extended. The -hidden
    and -connect_all command line arguments did not work if
    multiple instances were present on the command line which has
    been fixed. The new kernel parameter connect_all has also been
    introduced in order to replace the -connect_all command line
    argument.
  * erts: Fixed IPv6 multicast_if and membership socket options.
  * erts: Accept funs (NEW_FUN_EXT) with incorrectly encoded size
    field. This is a workaround for a bug (OTP-18104) existing in
    OTP 23 and 24 that could cause incorrect size fields in certain
    cases. The emulator does not use the decoded size field, but
    erl_interface still does and is not helped by this workaround.
  * erts: Fixed issue with inet:getifaddrs hanging on pure IPv6
    Windows
  * erts: Fix faulty distribution encoding of terms with either The
    symptom could be failed decoding on the receiving side leading
    to aborted connection. Fix OTP-18093 is a workaround for theses
    bugs that makes the VM accepts such faulty encoded funs. The
    first encoding bug toward pending connection exists only in OTP
    23 and 24, but the second one exists also on OTP 25.
  * erts: Fixed emulator crash that could happen during crashdump
    generation of ETS tables with options ordered_set and
    {write_concurrency,true}.
  * erts: Retrieval of monotonic and system clock resolution on
    MacOS could cause a crash and/or erroneous results.
  * erts: Fix bug where the max allowed size of erl +hmax was lower
    than what was allowed by process_flag.
  * erts: On computers with ARM64 (AArch64) processors, the JIT
    could generate incorrect code when more than 4095 bits were
    skipped at the tail end of a binary match.
  * erts: In rare circumstances, an is_binary/1 guard test could
    succeed when given a large integer.
  * erts: Fix bug causing ets:info (and sometimes ets:whereis) to
    return 'undefined' for an existing table if a concurrent
    process were doing ets:insert with a long list on the same
    table.
  * erts: Fix writing and reading of more than 2 GB in a single
    read/write operation on macOS. Before this fix attempting to
    read/write more than 2GB would result in {error,einval}.
  * erts: Fix bug sometimes causing emulator crash at node shutdown
    when there are pending connections. Only seen when running duel
    distribution protocols, inet_drv and inet_tls_dist.
  * erts: Yield when adjusting large process message queues due to
    The message queue adjustment work will now be interleaved with
    all other types of work that processes have to do, even other
    message queue adjustment work.
  * erts: Add rudimentary debug feature (option) for the inet-
    driver based sockets, such as gen_tcp and gen_udp.
  * erts: Introduced the hidden and dist_listen options to
    net_kernel:start/2. Also documented the -dist_listen command
    line argument which was erroneously documented as a kernel
    parameter and not as a command line argument.
  * erts: New documentation chapter "Debugging NIFs and Port
    Drivers" under Interoperability Tutorial.
  * erts: Add new API function erl_features:configurable/0
  * kernel: Fixed inconsistency bugs in global due to
    nodeup/nodedown messages not being delivered before/after
    traffic over connections. Also fixed various other
    inconsistency bugs and deadlocks in both global_group and
    global. As building blocks for these fixes, a new BIF
    erlang:nodes/2 has been introduced and
    net_kernel:monitor_nodes/2 has been extended. The -hidden and
  - connect_all command line arguments did not work if multiple
    instances were present on the command line which has been
    fixed. The new kernel parameter connect_all has also been
    introduced in order to replace the -connect_all command line
    argument.
  * kernel: Fixed IPv6 multicast_if and membership socket options.
  * kernel: Fixed issue with inet:getifaddrs hanging on pure IPv6
    Windows
  * kernel: The type specifications for inet:getopts/2 and
    inet:setopts/2 have been corrected regarding SCTP options.
  * kernel: The type specifications for inet:parse_* have been
    tightened.
  * kernel: Fix gen_tcp:connect/3 spec to include the inet_backend
    option.
  * kernel: Fix bug where using a binary as the format when calling
    logger:log(Level, Format, Args) (or any other logging function)
    would cause a crash or incorrect logging.
  * kernel: Add rudimentary debug feature (option) for the inet-
    driver based sockets, such as gen_tcp and gen_udp.
  * kernel: Introduced the hidden and dist_listen options to
    net_kernel:start/2. Also documented the -dist_listen command
    line argument which was erroneously documented as a kernel
    parameter and not as a command line argument.
  * kernel: Scope and group monitoring have been introduced in pg.
    For more information see the documentation of
    pg:monitor_scope(), pg:monitor(), and pg:demonitor().
  * kernel: A new function global:disconnect/0 has been introduced
    with which one can cleanly disconnect a node from all other
    nodes in a cluster of global nodes.
  * compiler: The compiler will now forbid using the empty atom ''
    as module name. Also forbidden are modules names containing
    control characters, and module names containing only spaces and
    soft hyphens.
  * compiler: The bin_opt_info and recv_opt_info options would
    cause the compiler to crash when attempting to compile
    generated code without location information.
  * compiler: In rare circumstances involving floating point
    operations, the compiler could terminate with an internal
    consistency check failure.
  * compiler: In rare circumstances when doing arithmetic
    instructions on non-numbers, the compiler could crash.
  * compiler: In rare circumstances, complex boolean expressions in
    nested cases could cause the compiler to crash.
  * compiler: Expression similar to #{assoc:=V} = #key=&gt;self()}, V
    would return the empty map instead of raising an exception.
  * compiler: Eliminated a crash in the beam_ssa_bool pass of the
    compiler when compiling a complex guard expression.
  * compiler: In rare circumstances, the compiler could crash with
    an internal consistency check failure.
  * compiler: When compiling with the option inline_list_funcs, the
    compiler could produce a nonsensical warning.
  * compiler: When given the no_ssa_opt option, the compiler could
    terminate with an internal consistency failure diagnostic when
    compiling map matching.
  * compiler: Made warnings for existing atoms being keywords in
    experimental features more precise, by not warning about quoted
    atoms.
  * compiler: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * megaco: Fixed various dialyzer related issues in the examples
    and the application proper.
  * megaco: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * common_test: Fix cth_surefire to handle when a suite is not
    compiled with debug_info. This bug has been present since
    Erlang/OTP 25.0.
  * common_test: Common Test now preserves stack traces for throws.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1669291200">- Changes for 25.1.2:
  * mnesia: Don't fill the logs if mnesia can't connect to all
    nodes, due to partitioned network.
  * erts: Add abandon carrier free utilization limit (+Muacful)
    option to erts_alloc. This option allows the user to mark
    unused segments in a memory carrier as re-useable by the OS if
    needed. This functionality was a non-configurable default
    before Erlang/OTP 25, but removed due to performance issues.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1671364800">- Changes for 25.2:
  * erts: Fix perf/gdb JIT symbols to not contain CodeInfoPrologue
    for the JIT internal module erts_beamasm.
  * erts: Fixed minor memory leaks.
  * erts: Fix bugs in ets:insert and ets:insert_new when called
    with a list of tuples to insert while a concurrent process
    either deletes or renames the table. The table deletion could
    be done with ets:delete/1 or be caused by termination of the
    table owning process. Symptoms are either VM crash or strange
    incorrect behavior from the insert operation. The risk of
    triggering the bugs increases with the length of the list of
    tuple to insert. Bugs exist since OTP 23.0.
  * erts: Boost execution of scheduled thread progress jobs. This
    to prevent memory exhaustion in extremely rapid
    allocation/deallocation scenarios, such as repeated ETS table
    creations/deletions.
  * erts: Fix segv crash during crash dumping an ETS table doing
    ets:delete_all_objects.
  * erts: Spec for function net:if_names/0 incorrect
  * erts: Fix bug in binary_to_term decoding a binary term 2Gbyte
    or larger.
  * erts: Documentation of erlang:module_loaded/1 has been
    adjusted:
  * erts: Fix list_to_atom/1 for negative code points. Could either
    return with a positive code point or fail with an incorrect
    exception.
  * erts: Fix rare bug causing VM crash when sending to a pid of a
    spawning process returned from erlang:processes/0. Only seen
    when provoked by system process literal_area_collector,
    triggered by a module purge operation, on a VM started with
    +Meamin (no customized allocators).
  * erts: gen_udp:open/2 with option(s) add_membership or
    drop_membership would drop earlier options.
  * erts: The inet:setopts/2 {reuseaddr, true} option will now be
    ignored on Windows unless the socket is an UDP socket. For more
    information see the documentation of the reuseaddr option part
    of the documentation of inet:setopts/2. Prior to OTP 25 the
    {reuseaddr, true} option was ignored for all sockets on
    Windows, but as of OTP 25.0 this was changed so that it was not
    ignored for any sockets. *** POTENTIAL INCOMPATIBILITY ***
  * erts: Fix bug in binary_to_term decoding a list of length 1G or
    longer.
  * erts: Fix bug in binary_to_term (and distributed receive) when
    decoding a large map (&gt;32 keys) with unsorted small maps (&lt;=
    32) as keys of the large map. This was only a problem if the
    term was encoded by erl_interface, jinterface or otherwise, as
    the VM itself always encodes small maps with sorted keys. The
    "binary_to_term" would appear as successful but the created
    large map was internally inconsistent. The smaller key-maps
    could not be found with maps:get and friends. Other operations
    such as map compare and merge could probably also give
    incorrect results.
  * erts: Fix Windows bug in open_port({spawn, Command}, ..) when
    Command is found via the OS search PATH and that directory path
    contains white spaces. The port program would start but the
    command line arguments to it could be incorrect.
  * ftp: fix unexpected result ok when calling ftp:nlist repeatedly
  * inets: This change allows body requests to httpc:request/5 be
    an iolist()
  * inets: addition of type specs in httpc.erl
  * inets: httpc: Add support for HTTP 308 status code
  * dialyzer: Dialyzer would crash when attempting to analyze a bit
    syntax segment size having an literal non-integer size such as
    [].
  * dialyzer: Dialyzer could crash when trying to analyze a
    convoluted nested expression involving funs,
  * kernel: Fixed shutdown crash in gen_tcp socket backend, when
    the other end closed the socket.
  * kernel: erl_tar can now read gzip-compressed tar files that are
    padded. There is a new option compressed_one for file:open/2
    that will read a single member from a gzip file,
  * kernel: Fix os:cmd to not translate all exceptions thrown to
    badarg. For example emfile from erlang:open_port was translated
    to badarg. This bug has existed since Erlang/OTP 24.
  * kernel: Spec for function net:if_names/0 incorrect
  * kernel: Missing ctrl option name transation for TOS and TTL (on
    FreeBSD) when using gen_udp with the 'socket' inet_backend.
  * kernel: gen_udp:open/2 with option(s) add_membership or
    drop_membership would drop earlier options.
  * kernel: The inet:setopts/2 {reuseaddr, true} option will now be
    ignored on Windows unless the socket is an UDP socket. For more
    information see the documentation of the reuseaddr option part
    of the documentation of inet:setopts/2. Prior to OTP 25 the
    {reuseaddr, true} option was ignored for all sockets on
    Windows, but as of OTP 25.0 this was changed so that it was not
    ignored for any sockets. *** POTENTIAL INCOMPATIBILITY ***
  * kernel: The distribution socket option handling in
    inet_tcp_dist has been cleaned up to clarify which were
    mandatory and which just had default values.
  * kernel: Improve warning message format for gen_tcp_socket.
  * snmp: Explicitly close the socket(s) when terminating
    (default-) net-if process.
  * stdlib: erl_tar can now read gzip-compressed tar files that are
    padded. There is a new option compressed_one for file:open/2
    that will read a single member from a gzip file,
  * stdlib: A concurrent call to ets:rename could cause
    ets:delete_all_objects to fail halfway through with badarg.
  * stdlib: It is not allowed to call functions from guards. The
    compiler failed to reject a call in a guard when done by
    constructing a record with a default initialization expression
    that called a function.
  * stdlib: The compiler could crash when using a record with
    complex field initialization expression as a filter in a list
    comprehension.
  * stdlib: unicode:characters_to_binary() could build
    unnecessarily large call stack.
  * stdlib: Improve error message for ets:new/2 name clash. Say
    "name already exists" instead of less specific "invalid
    options".
  * mnesia: Fixed crash which could happen during startup if too
    many decisions where sent from remote nodes.
  * os_mon: The disk_space_check_interval configuration parameter
    of disksup can now be set to values smaller than a minute.
  * ssh: graceful shutdown of ssh_conection_handler when connection
    is closed by peer
  * common_test: Fix starting of peer nodes on old releases when
    the compile server was active and the current Erlang
    installation contained non-latin1 characters in its path.
  * public_key: Disregard LDAP URIs when HTTP URIs are expected.
  * ssl: With this change, tls_sender process is hibernated after
    sufficient inactivity.
  * ssl: Correct handling of legacy schemes so that ECDSA certs
    using sha1 may be used for some TLS-1.3 configurations.
  * ssl: With this change, tls_sender does not cause logger crash
    upon key update.
  * ssl: Enhance warning message
  * ssl: Provide server option to make certificate_authorities
    extension in the TLS-1.3 servers certificate request optional.
    This will allow clients to send incomplete chains that may be
    reconstructable and thereby verifiable by the server, but that
    would not adhere to the certificate_authorities extension.
  * ssl: If the verify_fun handles four arguments the DER cert will
    be supplied as one of the arguments.
  * megaco: A very minor improvement to the measurement tool.
  * observer: A WX event race could causes a crash in when handling
    socket or port info.
  * observer: Improve the nodes menu to include more nodes.
  * compiler: Line number in compiler messages would be truncated
    to 4 digits for line numbers greater than 9999.
  * compiler: In rare circumstance, matching a binary as part of a
    receive clause could cause the compiler to terminate because of
    an internal consistency check failure.
  * compiler: Compiling a function with complex bit syntax matching
    such as f(&lt;&lt;X:0, _:X&gt;&gt;, &lt;&lt;Y:0, _:Y&gt;&gt;) -&gt; ok. could crash the
    compiler.
  * compiler: It is not allowed to call functions from guards. The
    compiler failed to reject a call in a guard when done by
    constructing a record with a default initialization expression
    that called a function.
  * compiler: The compiler could crash when using a record with
    complex field initialization expression as a filter in a list
    comprehension.
  * wx: Added environment variable WX_MACOS_NON_GUI_APP to allow
    user to override OSXIsGUIApplication behavior.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1679745600">- Changes for 25.3:
  * reltool: Fixed a bug that would cause analysis to crash.
  * stdlib: Fixed a bug that would cause analysis to crash.
  * stdlib: Fixed a crash when formatting stack traces for error
    reports.
  * stdlib: Instead of crashing, the list_to_integer/1 and
    list_to_integer/2 BIFs now raise the system_limit exception for
    overlong lists that can't be converted to integers. Similarly,
    the string:to_integer/1 BIF now returns {error,system_limit}
    for overlong lists.
  * stdlib: Removal of non-necessary undefined types added to the
    state's supervisor record.
  * compiler: Fixed a bug that would cause the compiler to hang.
  * compiler: Fixed a crash when compiling code that contained
    maybe expressions.
  * compiler: Constructing a binary with an explicit size of all
    for a binary segment would crash the compiler.
  * compiler: The compiler would generate incorrect code for the
    following type of expression: Pattern = BoundVar1 = . . . =
    BoundVarN = Expression An exception should be raised if any of
    the bound variables have different values than Expression. The
    compiler would generate code that would cause the bound
    variables to be bound to the value of Expressionwhether the
    value matched or not.
  * xmerl: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * megaco: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * debugger: Fixed a bug that would cause analysis to crash.
  * erts: Fixed a bug on Windows where file:read_file_info/1 would
    fail for files with corrupt metadata.
  * erts: Fix process_info(_, binary) to again include "writable
    binaries" which were lost in OTP-25.0. Writable binaries are an
    optimization used when binaries are appended upon in a loop.
  * erts: Fix rare race when receiving fragmented messages on a
    terminating connection. Could potentially cause memory leaks as
    well as double free crashes. Bug exists since OTP 22.0.
  * erts: Fixed bug that could maybe cause problems when a file
    descriptor number is closed by a linked in driver and then
    opened (reused) and passed to enif_select by a NIF. No actual
    symptoms seen, only failed internal assertions in debug build.
  * erts: The runtime system could crash when tracing a process
    executing on a dirty scheduler.
  * erts: In the binary syntax, attempting to match out integers
    with size exceeding 2 GiB could crash the runtime system.
  * erts: Fixed edge case in floating-point negation where A = 0.0,
    B = -A did not produce B = -0.0 on x86_64 JIT.
  * erts: Fixed an issue in the JIT that could crash the emulator
    on some platforms.
  * erts: Added meta data to the windows installer.
  * erts: Fixed ETS insertion order into bag and duplicate_bag of
    tuples with identical keys when passed in a list to
    ets:insert/2. The insert order has been head-to-tail but was
    accidentally changed in OTP 23.0. For bag it was reverted
    (tail-to-head), while for duplicate_bag it was sometimes
    reverted depending on the length of the list and number of
    "reductions" left for the calling process. This fix changes the
    insert order of ets:insert/2 back to always be head-to-tail of
    the list argument.
  * erts: With the JIT for AArch64 (AMD64), calling bxor in with
    non-integer arguments in a guard would crash the runtime
    system.
  * erts: Fix bug regarding process flag max_heap_size. Could cause
    strange behavior when a process was killed due to exceeding the
    limit.
  * erts: Fixed binary comprehensions to be similar to other
    creation of binary data with respect to its contribution of
    triggering garbage collection.
  * erts: In rare circumstances, when a process exceeded its
    allowed heap size set by option max_heap_size, it would not be
    killed as it should be, but instead enter a kind of zombie
    state it would never get out of.
  * erts: Instead of crashing, the list_to_integer/1 and
    list_to_integer/2 BIFs now raise the system_limit exception for
    overlong lists that can't be converted to integers. Similarly,
    the string:to_integer/1 BIF now returns {error,system_limit}
    for overlong lists.
  * erts: Active process aliases of a process at its termination
    leaked memory.
  * erts: Support for fully asynchronous distributed signaling
    where send operations never block. This functionality is by
    default disabled and can be enabled per process. For more
    information see the documentation of process_flag(async_dist,
    Bool).
  * erts: Added the +JPperf no_fp option to explicitly disable
    Erlang frame pointers otherwise added when using the +JPperf
    map option.
  * erl_interface: Accept connection setup from OTP 23 and 24 nodes
    that are not using epmd.
  * erl_interface: The ei API for decoding/encoding terms is not
    fully 64-bit compatible since terms that have a representation
    on the external term format larger than 2 GB cannot be handled.
  * syntax_tools: erl_syntax_lib:annotate_bindings/1,2 will now
    properly annotate named functions and their arguments.
  * kernel: Fixed a bug on Windows where file:read_file_info/1
    would fail for files with corrupt metadata.
  * kernel: Accept connection setup from OTP 23 and 24 nodes that
    are not using epmd.
  * public_key: As different solutions of verifying certificate
    revocation exists move the decode of 'CRLDistributionPoints' so
    that it will only be decode. When it is actually used in the
    verification process. This would enable interoperability with
    systems that use certificates with an invalid empty
    CRLDistributionPoints extension that they want to ignore and
    make verification by other means.
  * public_key: public_key:pkix_path_validation validates
    certificates expiring after 2050
  * public_key: Do not leave exit message in message queue after
    calling cacerts_load() on MacOS.
  * public_key: Replace size/1 with either tuple_size/1 or
    byte_size/1 The size/1 BIF is not optimized by the JIT, and its
    use can result in worse types for Dialyzer. When one knows that
    the value being tested must be a tuple, tuple_size/1 should
    always be preferred. When one knows that the value being tested
    must be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * ssl: Fixed that new dtls connections from the same client ip
    port combination works. If there is a process waiting for
    accept the new connection will connect to that, otherwise it
    will try to re-connect to the old server connection.
  * ssl: When shutting down a node that uses SSL distribution
    (-proto_dist inet_tls), a confusing error message about an
    unexpected process exit was printed. This particular message is
    no longer generated.
  * ssl: fixes the type spec for ssl:format_error/1
  * ssl: Replace size/1 with either tuple_size/1 or byte_size/1 The
    size/1 BIF is not optimized by the JIT, and its use can result
    in worse types for Dialyzer. When one knows that the value
    being tested must be a tuple, tuple_size/1 should always be
    preferred. When one knows that the value being tested must be a
    binary, byte_size/1 should be preferred. However, byte_size/1
    also accepts a bitstring (rounding up size to a whole number of
    bytes), so one must make sure that the call to byte_size/ is
    preceded by a call to is_binary/1 to ensure that bitstrings are
    rejected. Note that the compiler removes redundant calls to
    is_binary/1, so if one is not sure whether previous code had
    made sure that the argument is a binary, it does not harm to
    add an is_binary/1 test immediately before the call to
    byte_size/1.
  * jinterface: Accept connection setup from OTP 23 and 24 nodes
    that are not using epmd.
  * os_mon: The port programs used by cpu_sup and memsup are now
    gracefully shut down when cpu_sup and memsup are shut down.
  * eunit: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * crypto: A user defined runtime library path configured using
  - -with-ssl-rpath=&lt;PATHS&gt; could fail to be enabled.
  * crypto: Ensure that configure fails if a user defined runtime
    library path has been passed by the user, but cannot set.
  * mnesia: Improved consistency for dirty writes when a table was
    added with add_table_copy/3. Fixed a problem with sticky write,
    which could lead to inconsistent data.
  * mnesia: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * common_test: Renamed undocumented macro CT_PEER/3 to
    CT_PEER_REL/3.
  * ssh: With this change, PKCS8 formatted private key file is
    properly decoded and SSH daemon with such key can be started.
  * ssh: Replace size/1 with either tuple_size/1 or byte_size/1 The
    size/1 BIF is not optimized by the JIT, and its use can result
    in worse types for Dialyzer. When one knows that the value
    being tested must be a tuple, tuple_size/1 should always be
    preferred. When one knows that the value being tested must be a
    binary, byte_size/1 should be preferred. However, byte_size/1
    also accepts a bitstring (rounding up size to a whole number of
    bytes), so one must make sure that the call to byte_size/ is
    preceded by a call to is_binary/1 to ensure that bitstrings are
    rejected. Note that the compiler removes redundant calls to
    is_binary/1, so if one is not sure whether previous code had
    made sure that the argument is a binary, it does not harm to
    add an is_binary/1 test immediately before the call to
    byte_size/1.
  * inets: With this change, handling of URI to a folder, with
    missing trailing / and a query component present is fixed.
  * inets: Adds more type information to the inets app, thus
    improving the errors that static analysis tools can detect. The
    addition of type information to records and the updates to
    function heads help static analysis tools to understand that
    some values in the records cannot be 'undefined', thus making
    static tools to type check correctly more modules in the inets
    app
  * inets: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * snmp: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * ftp: Replace size/1 with either tuple_size/1 or byte_size/1 The
    size/1 BIF is not optimized by the JIT, and its use can result
    in worse types for Dialyzer. When one knows that the value
    being tested must be a tuple, tuple_size/1 should always be
    preferred. When one knows that the value being tested must be a
    binary, byte_size/1 should be preferred. However, byte_size/1
    also accepts a bitstring (rounding up size to a whole number of
    bytes), so one must make sure that the call to byte_size/ is
    preceded by a call to is_binary/1 to ensure that bitstrings are
    rejected. Note that the compiler removes redundant calls to
    is_binary/1, so if one is not sure whether previous code had
    made sure that the argument is a binary, it does not harm to
    add an is_binary/1 test immediately before the call to
    byte_size/1.
  * dialyzer: Fixed a bug that would cause analysis to crash.
  * dialyzer: Replace size/1 with either tuple_size/1 or
    byte_size/1 The size/1 BIF is not optimized by the JIT, and its
    use can result in worse types for Dialyzer. When one knows that
    the value being tested must be a tuple, tuple_size/1 should
    always be preferred. When one knows that the value being tested
    must be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * tftp: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
- Changes for 25.2.3:
  * erts: Comparisons between small numbers and pids or ports would
    in some edge cases say that the number was greater than the pid
    or port, violating the term order.
  * erts: process_info(Pid, status) when Pid /= self() could return
    an erroneous result.
  * ssl: Maximize compatibility by ignoring change_cipher_spec
    during handshake even if middle_box_mode is not negotiated
    (mandated by client)
  * ssl: Move assert of middlebox message after an
    hello_retry_request to maximize interoperability. Does not
    changes semantics of the protocol only allows unexpected
    message delay from server.
  * ssh: With this change, ssh application does not crash when
    formatting some of info reports for unsuccessful connections.
  * ssh: With this change, ssh does not log extensively long
    messages.
  * inets: Ensure graceful shutdown
  * inets: Return type of the type specification for function
    httpc:cookie_header/{1,2,3} has been fixed from -spec
    cookie_header(url()) -&gt; [{ field(), value() }] | {error,
    Reason} to -spec cookie_header(url()) -&gt; { field(), value() } |
    {error, Reason}
- Changes for 25.2.2:
  * ftp: Fixes calls to ftp:nlist/2 returning {error, epath} when
    the file / folder exists
- Changes for 25.2.1:
  * compiler: Fixed a bug that could cause legal code to fail
    validation.
  * compiler: Eliminated a rare crash in the beam_types module.
  * erts: Fixed a bug in selective receive optimization that could
    crash 32-bit emulators.
  * erts: A race condition which was very rarely triggered could
    cause the signal queue of a process to become inconsistent
    causing the runtime system to crash.
  * kernel: The tcp connect option 'bind_to_device' could not be
    used with inet_backend = 'socket'. 'inet' requires value type
    binarry() and 'socket' requires value type 'string()'.
  * kernel: Minor issue processing options when calling
    gen_tcp:connect with a sockaddr() and inet_backend = socket.
  * common_test: Change timeout to infinity for gen_server calls in
    cth_log_redirect
  * inets: fixes a missing case of the type specification for
    httpd:info/2/3/4
  * snmp: Single threaded agent crash when vacm table not properly
    initiated.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1683460800">- Changes for 25.3.2:
  * compiler: Fixed type handling bugs that could cause an internal
    error in the compiler for correct code.
  * os_mon: Avoid error report from failing erlang:port_close at
    shutdown of cpu_sup and memsup. Bug exists since OTP 25.3
    (os_mon-2.8.1).
  * erts: If a runtime system which was starting the distribution
    already had existing pids, ports, or references referring to a
    node with the same nodename/creation pair that the runtime
    system was about to use, these already existing pids, ports, or
    references would not work as expected in various situations
    after the node had gone alive. This could only occur if the
    runtime system was communicated such pids, ports, or references
    prior to the distribution was started. That is, it was
    extremely unlikely to happen unless the distribution was
    started dynamically and was even then very unlikely to happen.
    The runtime system now checks for already existing pids, ports,
    and references with the same nodename/creation pair that it is
    about to use. If such are found another creation will be chosen
    in order to avoid these issues.
- Changes for 25.3.1:
  * snmp: Attempts to minimize the number of the error reports
    during a failed agent init.
  * compiler: When a map update such as #{}#{key:=value} that
    should fail with an exception was unused, the exception would
    be lost.
  * compiler: Fixed bug in the validator that made it reject valid
    code.
  * crypto: With this change, random errors are fixed for
    crypto:generate_key calls with OpenSSL 3.
  * erts: Fixed a bug in the loader that prevented certain modules
    compiled with no_ssa_opt from being loaded.
  * erts: Implementations of the call() driver callback that
    returned a faulty encoded result could cause a memory leak and
    could cause invalid data on the heap of the processes calling
    erlang:port_call/3.
  * erts: Fixed a memory corruption issue when upgrading code. The
    bug was introduced in OTP 25.3
  * erts: Fixed configure tests for a few ARM-specific
    instructions, which prevented the emulator from being built on
    some platforms.
  * erts: Aliases created in combination with a monitor using the
    {alias, explicit_unalias} option stopped working from remote
    nodes when a 'DOWN' signal had been received due to the monitor
    or if the monitor was removed using the erlang:demonitor() BIF.
    This bug was introduced in OTP 24.3.4.10 and OTP 25.3.
  * erts: In rare circumstances, bit syntax matching of an invalid
    code point for a utf32 would crash the runtime system.
  * erts: Building the runtime system failed when native atomic
    support was missing. Note that execution on such systems have
    only been rudimentary tested.
  * erl_interface: Fixed configure tests for a few ARM-specific
    instructions, which prevented the emulator from being built on
    some platforms.
  * eldap: Added a new function eldap:info/1 that returns the
    socket and the transport protocol for the eldap connection.
  * inets: Correct timing related pipelining/keepalive queue bug,
    that could result in unexpected "socket_remotly_closed" errors.
  * inets: With this change, upon remote socket closure current
    request is added to a retried queue (either pipeline or
    keep_alive, but not both).
  * ssl: With this change, ssl:connection_information/2 returns
    correct keylog data after TLS1.3 key update.
  * ssl: Client signature algorithm list input order is now honored
    again , it was accidently reversed by a previous fix.
  * stdlib: The type specs in the erl_parse module has been updated
    to include the maybe construct and the ! operator.
  * wx: Improve debug prints from the nifs. Some minor fixes for
    wxWidgets-3.2. Fixed OpenGL debug functions.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1687521600">- Changes for 25.3.2.2:
  * compiler: The compiler could be very slow when compiling guards
    with multiple guard tests separated with 'or' or ';'.
- Changes for 25.3.2.1:
  * xmerl: New options to xmerl_scan and xmerl_sax_parser so one
    can limit the behaviour of the parsers to avoid some XML
    security issues. xmerl_scan gets one new option:
    xmerl_sax_parser gets the following options: The old option
    skip_external_dtd is still valid and the same as
    {external_entities, none} and {fail_undeclared_ref, false} but
    just affects DTD's and not other external references.
  * erts: Fixed a crash during tracing on certain platforms that
    cannot use the machine stack for Erlang code (mainly OpenBSD
    and Linux with musl).
  * erts: Constructing a binary segment not aligned with a byte
    boundary, with a size not fitting in 31 bits, and with a value
    not fitting in a 64-bit word could crash the runtime system.
  * erts: Further robustify implementation of large maps (&gt; 32
    keys). Keys that happen to have same internal 32-bit hash
    values are now put in collision nodes which are traversed with
    linear search. This removes the demand for the internal hash
    function when salted to eventually produce different hashes for
    all possible pairs of unequal terms.
  * stdlib: Static supervisors are very idle processes after they
    have started so they will now be hibernated after start to
    improve resource management.
  * compiler: Fixed a bug where a failing bsl expression in a guard
    threw an exception instead of causing the guard to fail.
  * compiler: Complex guard expression using the or operator and
    guard BIFs that can fail could sometimes be miscompiled so that
    the guard would succeed even if a call to a guard BIF failed.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1687608000">- Version 26.0:
  * Leex has been extended with optional column number support.
  * The family of enumeration functions in module lists has been
    extended with enumerate/3 that allows a step value to be
    supplied.
  * Update Unicode to version 15.0.0.
  * proc_lib:start*/* has become synchronous when the started
    process fails. This requires that a failing process use a new
    function proc_lib:init_fail/2,3, or exits, to indicate failure. All
    OTP behaviours have been fixed to do this.
  * auto-complete of variables, record names, record fields names,
    map keys, function parameter types and filenames.
  * Open external editor in the shell to edit the current
    expression.
  * defining records (with types), functions, specs and types in
    the shell.
  * Creation and matching of binaries with segments of fixed sizes
    have been optimized.
  * Creation and matching of UTF-8 segments have been optimized.
  * Appending to binaries has been optimized.
  * The compiler and JIT now generate better code for creation of
    small maps where all keys are literals known at compile time.
  * Thanks to the optimizations above the performance of the base64
    module has been significantly improved. For example, on an
    x86_64 system with the JIT both encode and decode are almost
    three times faster than in Erlang/OTP 25.
  * Map comprehensions as suggested in EEP 58 has now been
    implemented.
  * Some map operations have been optimized by changing the
    internal sort order of atom keys. This changes the
    (undocumented) order of how atom keys in small maps are printed
    and returned by maps:to_list/1 and maps:next/1. The new order
    is unpredictable and may change between different invocations
    of the Erlang VM.
  * Introducing the new function maps:iterator/2 for creating an
    interator that return the map elements in a deterministic
    order. There are also new modifiers k and K for the format
    string in io:format() to support printing map elements ordered.
  * Added the new built-in type dynamic() introduced in EEP 61, PR
    introducing EEP 61 improving support for gradual type checkers.
  * Dialyzer has a new incremental mode that be invoked by giving
    the --incremental option when running Dialyzer. This new
    incremental mode is likely to become the default in a future
    release.
  * Multi time warp mode is now enabled by default. This assumes
    that all code executing on the system is time warp safe.
  * Support for UTF-8 atoms and strings in the NIF interface
    including new functions enif_make_new_atom,
    enif_make_new_atom_len and enif_get_string_length.
  * The BIFs min/2 and max/2 are now allowed to be used in guards
    and match specs.
  * Improved the selective receive optimization, which can now be
    enabled for references returned from other functions. This
    greatly improves the performance of gen_server:send_request/3,
    gen_server:wait_response/2, and similar functions.
  * It is no longer necessary to enable a feature in the runtime
    system in order to load modules that are using it. It is
    sufficient to enable the feature in the compiler when compiling
    it.
  * inet:setopts/2 has got 3 new options: reuseport, reuseport_lb
    and exclusiveaddruse.
  * Fix so that -fno-omit-frame-pointer is applied to all of the
    Erlang VM when using the JIT so that tools, such as perf, can
    crawl the process stacks.
  * In the lists module, the zip family of functions now takes
    options to allow handling lists of different lengths.
  * Added the zip:zip_get_crc32/2 function to retrieve the CRC32
    checksum from an opened ZIP archive. gen_server optimized by
    caching callback functions
  * The modules Erlang DNS resolver inet_res and helper modules
    have been updated for RFC6891; to handle OPT RR with DNSSEC OK
    (DO) bit.
  * Introduced application:get_supervisor/1.
  * Cache OTP boot code paths, to limit how many folders that are
    being accessed during a module lookup. Can be disabled with
  - cache_boot_path false.
  * Support for Kernel TLS (kTLS), has been added to the SSL
    application, for TLS distribution (-proto_dist inet_tls), the
    SSL option {ktls, true}.
  * Improved error checking and handling of ssl options.
  * Mitigate memory usage from large certificate chains by lowering
    the maximum handshake size. This should not effect the common
    cases, if needed it can be configured to a higher value.
  * For security reasons the SHA1 and DSA algorithms are no longer
    among the default values.
  * Add encoding and decoding of use_srtp hello extension to
    facilitate for DTLS users to implement SRTP functionality.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1687608001">- Changes for 26.0.1:
  * erts: Build of the socket nif failed on Solaris 11.
  * erts: Fixed two reduction-counting bugs relating to binaries.
  * erts: Constructing a binary segment not aligned with a byte
    boundary, with a size not fitting in 31 bits, and with a value
    not fitting in a 64-bit word could crash the runtime system.
  * erts: When a binary construction failed because of bad size for
    a segment, the error information was not always correct.
  * erts: Fixed a crash when calling a fun that was defined in a
    module that had been upgraded.
  * kernel: The POSIX error exdev was sometimes incorrectly
    described as "cross domain link" in some error messages.
  * kernel: Corrected the socket send function description (send
    with Timeout = nowait). The send function(s) could not return
    {ok, {RestData, SelectInfo}}
  * stdlib: The POSIX error exdev was sometimes incorrectly
    described as "cross domain link" in some error messages.
  * ssl: Make sure that selection of client certificates handle
    both TLS-1.3 and TLS-1.2 names correctly. Could cause valid
    client certificate to not be selected, and an empty client
    certificate message to be sent to server.
  * ssl: Improved ssl:format_error/1 to handle more error tuples.
  * ssl: Fixed hanging ssl:connect when ssl application is not
    started.
  * ssl: Correct handling of retransmission timers, current
    behavior could cause unwanted delays.
  * inets: Do not make the default ssl options by calling
    httpc:ssl_verify_host_options(true) if ssl options are supplied
    by the user.
  * xmerl: New options to xmerl_scan and xmerl_sax_parser so one
    can limit the behaviour of the parsers to avoid some XML
    security issues. xmerl_scan gets one new option:
    xmerl_sax_parser gets the following options: The old option
    skip_external_dtd is still valid and the same as
    {external_entities, none} and {fail_undeclared_ref, false} but
    just affects DTD's and not other external references.
  * compiler: Fixed a bug where a failing bsl expression in a guard
    threw an exception instead of causing the guard to fail.
  * compiler: Fixed a bug that would case the validator to reject
    legal code.
  * compiler: The compiler could re-order clauses matching binaries
    so that the incorrect clause would match. That could only
    happen for code that used the option {error_location,line} or
    for code without line or column number information (e.g.
    generated by a parse transform).
  * compiler: Complex guard expression using the or operator and
    guard BIFs that can fail could sometimes be miscompiled so that
    the guard would succeed even if a call to a guard BIF failed.
  * compiler: With optimizations disabled, a try/catch construct
    could return an incorrect value.
  * compiler: In rare circumstance, a combination of binary
    construction and binary_part/3 would cause the compiler to
    generate unsafe code that would crash the runtime system.
  * compiler: The compiler could be very slow when compiling guards
    with multiple guard tests separated with 'or' or ';'.
  * compiler: Complex guard expressions using 'or' and map updates
    could succeed even if the map update failed.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1698235200">- Changes for 26.1.2:
  * erts: If the external term format encoding of an argument list
    part of a distributed spawn operation was faulty, the newly
    spawned remote process could misbehave. The misbehavior
    included hanging or interpret an incoming message as an
    argument list to use. This was very unlikely to happen unless
    using an alternate implementation of the distribution protocol
    which made a faulty encoding of the argument list. The child
    process will now detect this error and terminate before
    executing the user specified code.
  * erts: Fix bugs where if the body of a matchspec would return a
    map with a variable ('$1', '$_' etc) as one of the keys or
    values and the variable was not an immidiate, the term would
    not be copied to the receiving processes heap. This would later
    corrupt the term in the table as the GC could place move
    markers in it, which in turn would cause the VM to crash. Bug
    has been present for since OTP 17.0.
  * xmerl: The xmerl version 1.3.32 was released in OTP 26.0.1, but
    the incorrect version number of 1.3.31.1 was used for it. This
    incorrect version number continued to appear in OTP 26.0.2, OTP
    26.1, and OTP 26.1.1. The actual xmerl code in these OTP
    versions however corresponds to xmerl version 1.3.32.
- Changes for 26.1.1:
  * wx: The wx application would fail to build on macOS with Xcode
    15.
  * compiler: The compiler could become extremely slow for modules
    containing huge functions.
  * stdlib: Garbage collect the shell process when reducing the
    amount of saved history and results.
- Changes for 26.1:
  * crypto: Fix VM crash caused by crypto being purged and reloaded
    (by init:restart for example) on OS with musl libc (such as
    Alpine linux).
  * crypto: Improved understanding of LibreSSL versions. Support
    chacha20 and chacha20_poly1305 for LibreSSL 3.7. Reflect
    removal of support for the DSS/DSA algorithm which was done in
    LibreSSL 2.6.1.
  * crypto: FIPS supported by crypto for OpenSSL 3.0.* and 3.1.*.
  * asn1: The ASN.1 compiler would ignore a constraint such as
    (SIZE (1..4), ...), causing incorrect behavior of the encoding
    and decoding function for the PER and UPER backends. Corrected
    to handle the constraint in the same way as (SIZE (1..4, ...)).
  * asn1: The JER backend has been internally refactored in a way
    that is compatible for applications that use the documented
    API. However, for a group of ASN.1 modules that depend on each
    other (for example, S1AP-PDU-Descriptions, S1AP-Contents, and
    so on), all modules in the group must be recompiled if on of
    the group members is recompiled.
  * observer: Closing the trace log window via the menu did not
    work.
  * erts: maps:put with existing key and identical value was not
    optimized as a no-op correctly if having the same 32-bit hash
    as another key in the map. In practice very rare and harmless.
  * erts: Fixed an issue with truncated crash slogans on failed
    emulator start.
  * erts: Fixed a bug where the emulator was unable to determine
    the current cgroup CPU quota.
  * erts: A process optimized for parallel signal delivery could
    under some circumstances lose wakeup information. That is, the
    processes was not woken up to take care of the signal, so the
    signal would not be taken care of until the process was woken
    by another signal. Only processes configured with
    message_queue_data set to off_heap utilize this optimization.
  * erts: Function socket:close/1 could cause a VM crash on
    Windows.
  * erts: Fixed a bug in the ARM JIT where it could accidentally
    add garbage trailing bits when creating bitstrings whose size
    wasn't an even multiple of 8 bits.
  * erts: Fix erlang:system_info/1 documentation to show correct
    types.
  * erts: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * erts: Fix compilation with GNU termcap.
  * erts: Delivery time of message signals to a process not
    executing any receive expressions could become very long,
    potentially infinite. For example, a process checking for
    messages using process_info(self(), message_queue_len) or
    process_info(self(), messages) and avoiding to execute a
    receive expression matching on messages could be very slow in
    detecting new messages. Note that you are still discouraged
    from using process_info() this way. A process that wants to
    check if there are messages available to handle should execute
    a receive expression matching on messages.
  * erts: On AArch64 (ARM64), when calculating both the quotient
    and remainder with a divisor begin a power two, the remainder
    could be incorrectly calculated.
  * erts: Fix bug causing "magic" references in a compressed ETS
    table to not keep the referred object alive. The symptom would
    be the referred object being garbage collected prematurely and
    the reference appearing stale, not referring to anything.
    Examples of such magically referred objects are atomics and NIF
    resources.
  * erts: Matching out short bitstrings with a fixed size not
    divisible by 8 could could lead to the runtime system
    terminating with an "Overrun heap and stack" error.
  * erts: A constant flow of incoming non-message signals could
    prevent a process needing to execute dirty from doing so.
  * erts: A BEAM file usually contains a chunk with the tag "Type"
    containing type information that can be used by the JIT. The
    beam_lib:strip/1 takes care to preserve that chunk, but a
    build/release tool that does customized stripping could
    accidentally remove the chunk. Loading a BEAM file without the
    "Type" chunk could cause incorrect behavior of the loaded code.
  * erts: gen_udp:recv/* for Unix Domain Socket in binary mode and
    passive mode has been fixed to not crash.
  * erts: The cleanup operation of not yet delivered signals to a
    terminated process yielded excessively.
  * erts: Fixed minor hashing issue with the local option of
    term_to_binary()/term_to_iovec().
  * erts: Update gen_tcp_socket and gen_udp_socket to handle
    'completion' (socket on Windows).
  * erts: Add support for Unix Domain Sockets (only for STREAM
    sockets) on Windows for 'socket'.
  * erts: In Erlang/OTP 27, by default escripts will be compiled
    before being executed. That means that the compiler application
    must be installed. It is possible to force the escript to be
    interpreted by adding the directive -mode(interpret). to the
    escript file. In Erlang/OTP 28, support for interpreting an
    escript will be removed.
  * erts: Add basic support for socket ioctl on Windows.
  * erts: Removed erts/etc/darwin/Info.plist, as it is no longer
    necessary after macos 10.12
  * erts: Add support for (Windows) socket option exclusiveaddruse.
  * erts: [socket] Add support for the 'nopush' option.
  * erts: Add support for socket option 'BSP STATE'.
  * erts: Add tcp socket options 'keepcnt', 'keepidle' and
    'keepintvl'.
  * erts: Add support for misc (Windows) socket options
    ('max_msg_size' and 'maxdg').
  * compiler: The compiler could run forever when compiling a call
    to is_record/3 with a huge positive tuple size. The call
    is_record(A, a, 0) would crash the compiler when used in a
    function body. When used in a guard the compiler would emit
    incorrect code that would accept {a&gt; as a record.
  * compiler: Fixed a bug that caused dialyzer to crash when
    analyzing bogus code that contained the literal atom undefined
    in segment sizes.
  * compiler: The compiler would crash when compiling some modules
    that contained a call to erlang:load_nif/2.
  * compiler: Fixed a bug that caused the compiler to crash on
    legal code.
  * compiler: The compiler could crash when attempting to compile a
    call to is_list/1 in a complex expression.
  * compiler: A complex guard expression using the or operator
    could succeed when it was supposed to fail.
  * compiler: Compiling nested try/catch and catch expression could
    result in an internal compiler error.
  * compiler: Using the bnot operator in a complex expression could
    cause the compiler to terminate with an internal consistency
    failure diagnostic.
  * compiler: Fixed a bug that caused the compiler to crash in a
    binary optimization pass.
  * compiler: The compiler could terminate with an internal error
    when attempting to compile a binary pattern that could not
    possibly match.
  * compiler: Fixed various performance issues related to the alias
    optimization pass.
  * erl_docgen: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * mnesia: Do not delete old backup file if the new backup fails.
  * megaco: Make megaco transports handle gen_tcp | gen_udp with
    socket backend on Windows (completion).
  * common_test: With this change, ct_hooks manual refers to CTH
    execution order section in user guide.
  * common_test: With this change, Config data from
    pre_end_per_testcase hook is delivered to post_end_per_testcase
    callback in case of testcase timetrap or linked process crash.
  * common_test: With this change, remaining references to not
    supported vts tool in ct_run are removed (mainly relates to
    docs and ct_run help message).
  * common_test: With this change, prompt search functionality in
    ct_telnet handles unicode input.
  * common_test: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * stdlib: The compiler could run forever when compiling a call to
    is_record/3 with a huge positive tuple size. The call
    is_record(A, a, 0) would crash the compiler when used in a
    function body. When used in a guard the compiler would emit
    incorrect code that would accept {a&gt; as a record.
  * stdlib: Fix bug in ets:tab2file that could make it fail if
    another Erlang process created the same file at the same time.
  * stdlib: An {else_clause,Value} exception will now be reported
    nicely in the shell.
  * stdlib: Correct return value for error case, so that it matches
    the documented and intended return value {error,
    {already_started, pid()} when local registered names are used.
  * stdlib: sys:get_state/1,2 and sys:replace_state/2,3 has been
    corrected to handle a state named error as a state name, not as
    a failed system callback. For the standard server behaviours
    this was an issue only for gen_statem (and gen_fsm) when the
    state name was error, and for gen_server if the complete state
    was {error,_}.
  * stdlib: Multiple problems were fixed in
    filelib:safe_relative_path/2. If its second argument was a path
    that contained symbolic links, an incorrect result patch could
    be returned. Also, paths were sometimes falsely considered
    unsafe.
  * stdlib: Fix deadlock when erl.exe is used as part of a pipe on
    Windows and trying to set the encoding of the standard_io
    device.
  * stdlib: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * stdlib: Fix h/2,3 to properly render multi-clause
    documentation.
  * stdlib: Timers created by timer:apply_after/4,
    apply_interval/4, and apply_repeatedly/4 would silently fail to
    do the apply if it was not possible to spawn a process when the
    timer expired. This has now been corrected, and if the spawn
    fails, the system will be taken down producing a crash dump.
  * stdlib: When an Erlang source file lacked a module definition,
    there would be a spurious "module name must not be empty"
    diagnostic for each spec in the file.
  * stdlib: The argument descriptions for option types in argparse
    have been made less ambiguous.
  * stdlib: Clarified the documentation of normal shutdown reason
    on gen_server:call/2,3
  * stdlib: Pattern matching and equivalence (=:=, =/=) comparisons
    on 0.0 will now raise a warning, as it will no longer be
    considered equivalent to -0.0 in OTP 27. If a match on 0.0
    specifically is desired (distinct from -0.0), the warning can
    be suppressed by writing +0.0 instead. The arithmetic
    comparison operators are unaffected, including arithmetic
    equality (==). *** POTENTIAL INCOMPATIBILITY ***
  * stdlib: The semantics of the gen_{server,statem,event}
    behaviour's synchronous start behaviour introduced in OTP-26.0
    with OTP-18471, has been clarified in the documentation.
  * stdlib: Added functionality to set a custom multiline prompt.
  * stdlib: A warning for (accidental use of) Triple-Quoted Strings
    has been implemented as per EEP 64. *** POTENTIAL
    INCOMPATIBILITY ***
  * stdlib: The keyboard shortcuts for the shell are now
    configurable.
  * kernel: Fixed an issue with truncated crash slogans on failed
    emulator start.
  * kernel: Fix shell:start_interactive function specification.
  * kernel: Fix code:get_doc/1 to return missing, when it can't
    find erts instead of crashing.
  * kernel: Function socket:close/1 could cause a VM crash on
    Windows.
  * kernel: Fix deadlock when erl.exe is used as part of a pipe on
    Windows and trying to set the encoding of the standard_io
    device.
  * kernel: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * kernel: Fix logger's overload protection mechanism to only
    fetch memory used by messages when needed.
  * kernel: Fixed a number of socket-related issues causing
    incompatibilities with gen_tcp and gen_udp respectively.
  * kernel: gen_tcp:connect with socket address and socket (inet-)
    backend fails because of missing callback function.
  * kernel: The DNS RR cache used by `inet_res` has been fixed to
    preserve insert order, which is beneficial when the DNS server
    returns RRs in some specific order for e.g load balancing
    purposes.
  * kernel: The options `reuseport`, `reuseport_lb` and
    `exclusiveaddruse` were accidentally not allowed for e.g
    `gen_udp:open/1,2`, which has now been corrected.
  * kernel: gen_udp:recv/* for Unix Domain Socket in binary mode
    and passive mode has been fixed to not crash.
  * kernel: Fixed issue where cursor would not be placed at the end
    of the expression when navigating shell history.
  * kernel: Update gen_tcp_socket and gen_udp_socket to handle
    'completion' (socket on Windows).
  * kernel: Add support for Unix Domain Sockets (only for STREAM
    sockets) on Windows for 'socket'.
  * kernel: Add basic support for socket ioctl on Windows.
  * kernel: The file:location/0 type is now exported.
  * kernel: Add support for (Windows) socket option
    exclusiveaddruse.
  * kernel: [socket] Add support for the 'nopush' option.
  * kernel: Add support for socket option 'BSP STATE'.
  * kernel: Add tcp socket options 'keepcnt', 'keepidle' and
    'keepintvl'.
  * kernel: Add support for misc (Windows) socket options
    ('max_msg_size' and 'maxdg').
  * kernel: The keyboard shortcuts for the shell are now
    configurable.
  * kernel: Optimized code_server to reduce repeated work when
    loading the same module concurrently.
  * debugger: The call int:no_break(Module) did not remove any
    breakpoints.
  * debugger: The maybe expression is now supported in the
    Debugger.
  * debugger: The maybe expression is now supported in the
    Debugger.
  * debugger: The call int:no_break(Module) did not remove any
    breakpoints.
  * ssl: Avoid function clause error in ssl:getopts/2 by handling
    that inet:getopts may return an empty list during some
    circumstances, such as the socket being in a closing state.
  * ssl: The API function `ssl:recv/3` has been tightened to
    disallow negative length, which has never been documented to
    work, but was passed through and caused strange errors.
  * ssl: When a client initiated renegotiation was rejected and the
    client socket was in active mode the expected error message to
    the controlling process was not sent.
  * ssl: Add some guidance for signature algorithms configuration
    in ssl applications users guide.
  * snmp: Make snmp handle gen_udp with socket backend on Windows
    (completion).
  * public_key: Country name comparison shall be case insensitive
  * public_key: Add check to disallow duplicate certs in a path
  * inets: With this change, re_write httpd works as expected and
    does not return error.
  * inets: Fixed a bug so httpd does not crash when stopped at the
    wrong time during TLS connection negotiation, or any other
    theoretically as slow connection setup.
  * inets: Enhance error handling and avoid that the HTTP client
    hangs on headers provided on the wrong format.
  * inets: With this change, error report generated by httpd during
    connection setup contains socket type information.
  * inets: Stop and restart of the httpd server in the Inets
    application has been refactored to a more synchronous and OTP
    supervisor friendly approach. This should increase stability
    and for example avoid a supervisor report from
    httpd_connection_sup about killed child process(es) in some
    cases when stopping or restarting httpd.
  * dialyzer: Fixed a bug that caused dialyzer to crash when
    analyzing bogus code that contained the literal atom undefined
    in segment sizes.
  * dialyzer: Dialyzer could crash when attempting to analyze a
    module that defined a type called product/.
- Changes for 26.0.2:
  * erts: Fix using the IME (Input Method Editor) to enter text in
    cmd.exe and powershell.exe on Windows.
  * erts: Multiple socket:accept calls issue. When making multiple
    accept calls, only the last call is active.
  * erts: Fix the shell to ignore terminal delay when the terminal
    capabilities report that they should be used.
  * erts: Fix "oldshell" to echo characters while typing on
    Windows.
  * erts: On Windows, a call to the function socket:close, when
    there are waiting active calls to read, write or accept
    functions, could hang.
  * erts: Fix issues when reading or configuring standard_io on
    Windows when erl.exe is started using -noshell flag.
  * erts: The following functions are now much faster when given a
    long list or binary:
  * erts: On AArch64 (ARM64), equality and non-equality tests with
    literal bitstrings could succeed when they should fail and vice
    versa.
  * compiler: Fixed a type handling bug that would cause an
    internal consistence failure for correct code.
  * compiler: Fixed a bug that could cause the stack trace of throw
    exceptions to be erroneously optimized out.
  * compiler: Complex guard expression using 'or' were not always
    fully evaluated, making guards that were supposed to fail
    succeed.
  * stdlib: Fix bug where when you entered Alt+Enter in the
    terminal, the cursor would move to the last line, instead of
    moving to the next line.
  * stdlib: Fix eof handling when reading from stdin when erlang is
    started using -noshell.
  * stdlib: Fixed problem where output would disappear if it was
    received after a prompt was written in the shell.
  * stdlib: The following functions are now much faster when given
    a long list or binary:
  * kernel: Fix bug where when you entered Alt+Enter in the
    terminal, the cursor would move to the last line, instead of
    moving to the next line.
  * kernel: Fix so that the shell does not crash on startup when
    termcap is not available.
  * kernel: Multiple socket:accept calls issue. When making
    multiple accept calls, only the last call is active.
  * kernel: Fix the shell to ignore terminal delay when the
    terminal capabilities report that they should be used.
  * kernel: Fix "oldshell" to echo characters while typing on
    Windows.
  * kernel: Fix eof handling when reading from stdin when erlang is
    started using -noshell.
  * kernel: On Windows, a call to the function socket:close, when
    there are waiting active calls to read, write or accept
    functions, could hang.
  * kernel: Fix issues when reading or configuring standard_io on
    Windows when erl.exe is started using -noshell flag.
  * kernel: gen_udp:connect with inet_backend = socket fails when
    the Address is a hostname (string or atom).
  * kernel: Fixed problem which would cause shell to crash if
    particular escape sequence was written to stdout.
  * kernel: Fixed problem where output would disappear if it was
    received after a prompt was written in the shell.
  * kernel: Fix a crash where the location of erts could not be
    found in rebar3 dev builds.
  * kernel: Introduce the KERNEL application parameter
    standard_io_encoding that can be used to set the default
    encoding for standard_io. This option needs to be set to latin1
    if the application wants to treat all input data as bytes
    rather than utf-8 encoded characters.
  * ssl: Added keylog information to all protocol versions in
    ssl:connection_information/2.
  * ssl: Add RFC-6083 considerations for DTLS to enable gen_sctp
    based callback for the transport.
  * ssh: Added multiline editing support to ssh clients connected
    through OTP ssh daemon.</changelog>
  <changelog author="sflees@suse.de" date="1704974400">- Changes for 26.2.1:
  * erts: Removed unnecessary PCRE source tar-ball.
  * ssh: With this change (being response to CVE-2023-48795),
    ssh can negotiate "strict KEX" OpenSSH extension with
    peers supporting it; also
    'chacha20-poly1305@openssh.com' algorithm becomes a
    less preferred cipher.
    If strict KEX availability cannot be ensured on both
    connection sides, affected encryption modes(CHACHA and
    CBC) can be disabled with standard ssh configuration.
    This will provide protection against vulnerability, but
    at a cost of affecting interoperability. See
    Configuring algorithms in SSH. (bsc#1218192, CVE-2023-48795)
- Changes for 26.2:
  * all: Replaced unintentional Erlang Public License 1.1
    headers in some files with the intended Apache License
    2.0 header.
  * otp: The removal of the deprecated slave module, originally
    planned for OTP 27, has been postponed to OTP 29.
  * asn1: Fix benign warning from gcc 11 about mismatching call
    to free().
  * crypto: Enable engine support for OpenSSL versions 3.
  * edoc: Emit &lt;code&gt; instead of &lt;tt&gt;.
- Disable test suite for now, it has many false positives and
  takes a very long time.</changelog>
  <changelog author="sflees@suse.de" date="1706011200">- This codestream wasn't affected by bsc#1207113</changelog>
  <changelog author="sflees@suse.de" date="1706011201">- Disable rpmlint tests on SLE-15 where they currently fail</changelog>
  <changelog author="sflees@suse.de" date="1715947200">- Create a versioned package for SLES</changelog>
</package>
<package pkgid="69a18ccf9f16f0df11d7299c6fcc6934db0462031b43e76a26dfb4140a62e4c7" name="erlang26" arch="x86_64">
  <version epoch="0" ver="26.2.1" rel="150300.7.5.1"/>
  <changelog author="matwey.kornilov@gmail.com" date="1646568000">- Changes for 24.2.2:
  * inets: Avoid intermediate ungraceful shutdown of the HTTP
    server.
  * ssh: The ssh sever parallel_login option was missing in OTP-24</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1648382400">- Changes for 24.3.2:
  * erl_interface: Fix compile error regarding gethostbyaddr_r on
    Android. Error introduced in OTP 24.3.
  * kernel: Fix failed accepted connection setup after previous
    established connection from same node closed down silently.
  * kernel: Fixed a problem where typing Ctrl-R in the shell could
    hang if there were some problem with the history log file.
- Changes for 24.3.1:
  * dialyzer: There could be spurious warnings for unknown types
    when a type was a subtype of an existing type that was a
    subtype of an unknown type.
  * ssl: Client certification could fail for TLS-1.3 servers that
    did not include the certificat_authorties extension in its
    certificate request message.
- Changes for 24.3:
  * megaco: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.
  * megaco: Update the performance and debug chapters of the megaco
    user's guide. Also some updates to the meas tools.
  * compiler: The expression &lt;&lt;0/native-float&gt;&gt;=Bin would always
    fail to match, while &lt;&lt;0/float-native&gt;&gt;=Bin would match
    (provided that Bin contained the binary representation of 0.0)
  * compiler: The compiler will now compile huge functions with
    straight-line code faster.
  * erl_interface: Add --enable-ei-dynamic-lib configure option
    that will make erl_interface also release a dynamic library
    version of libei.
  * erl_interface: The ei API for decoding/encoding terms is not
    fully 64-bit compatible since terms that have a representation
    on the external term format larger than 2 GB cannot be handled.
  * sasl: Fix bug in systools:make_script/1 documentation.
  * inets: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.
  * inets: Documentation fix for inets:services_info/0, which now
    describes that Info might be a Reason term() in case when
    {error, Reason} is returned as service info.
  * crypto: The crypto app in OTP can since OTP-24.2 be compiled,
    linked and used with the new OpenSSL 3.0 cryptolib. The crypto
    app has 3.0 support has been improved, but is still *not
    recommended* for other usages than experiments and alpha
    testing. There are not yet any guaranties that it works, not
    even together with other OTP applications like for example SSL
    and SSH, although there are no known errors. Since the previous
    release, OTP-24.2, the following improvements have been done: -
    It has been tested during nearly every nightly test on the OTP
    lab - The hash algorithms md4 and ripemd160 have been enabled
    with OpenSSL 3.0. - The ciphers blowfish_cbc, blowfish_ecb,
    des_cbc, des_cfb, des_ecb, rc2_cbc and rc4 have been enabled
    with OpenSSL 3.0. Disabled or unsupported with OpenSSL 3.0 are
    still: - ENGINE support - FIPS mode - Other providers than the
    built-in ones - Compiling and linking with OpenSSL 3.0
    cryptolib in compatibility modes (for example to behave as
    1.1.1) and, the ciphers blowfish_cfb64 and blowfish_ofb64 are
    not supported and will not be either. Deprecated functions in
    the OpenSSL 3.0 cryptolib must not be disabled as OTP/crypto
    still uses some of the deprecated API functions. The gcc flag
  - Wno-deprecated-declarations is set to prevent deprecation
    warnings to be printed when compiling.
  * crypto: Crypto is adapted to LibreSSL 3.5.0 on OpenBSD.
  * crypto: New configure option ( --disable-otp-test-engine) to
    prohibit the build of the OTP test engine used in some test
    suites. The reason is that the test engine could be hard to
    compile on for instance LibreSSL 3.5.0. For that particular
    cryptolib version (or higher), this configure option is set
    automatically.
  * jinterface: Fix bug in OtpOutputStream.write_pid/4 and
    write_ref/3 causing faulty encodig. Bug exists since OTP 23.0.
  * wx: Removed the static_data option from wxImage creation
    functions, as it was broken and could lead to crashes. Now
    image data is always copied to wxWidgets as was the default
    behavior. Removed some non working wxGridEvent event types,
    which have there own events in newer wxWidgets versions, and
    added a couple of event types that where missing in wx.
  * asn1: Add support for the maps option in combination with the
    jer backend.
  * snmp: The compilation time is no longer recorded in BEAM files.
    There remained several undocumented functions that attempted to
    retrieve compilation times. Those have now been removed.
  * snmp: [agent] Remove expectation of socket being a port.
  * common_test: OTP internal test fix.
  * runtime_tools: Fixed bug in scheduler:utilization(Seconds) that
    would leave the scheduler_wall_time system flag incorrectly
    enabled.
  * runtime_tools: Add scheduler:get_sample/0 and get_sample_all/0.
    Also clarify scheduler module documentation about how it
    depends on system flag scheduler_wall_time.
  * erts: Fixed a bug in the x86 JIT that might cause floating
    point instructions to wrongly throw an exception.
  * erts: Preserve correct nodedown_reason if supervised
    distribution controller processes exit with {shutdown, Reason}.
  * erts: Handling of send_timeout for gen_tcp has been corrected
    so that the timeout is honored also when sending 0 bytes.
  * erts: By default global does not take any actions to restore a
    fully connected network when connections are lost due to
    network issues. This is problematic for all applications
    expecting a fully connected network to be provided, such as for
    example mnesia, but also for global itself. A network of
    overlapping partitions might cause the internal state of global
    to become inconsistent. Such an inconsistency can remain even
    after such partitions have been brought together to form a
    fully connected network again. The effect on other applications
    that expects that a fully connected network is maintained may
    vary, but they might misbehave in very subtle hard to detect
    ways during such a partitioning. In order to prevent such
    issues, we have introduced a prevent overlapping partitions fix
    which can be enabled using the prevent_overlapping_partitions
    kernel(6) parameter. When this fix has been enabled, global
    will actively disconnect from nodes that reports that they have
    lost connections to other nodes. This will cause fully
    connected partitions to form instead of leaving the network in
    a state with overlapping partitions. Note that this fix has to
    be enabled on all nodes in the network in order to work
    properly. Since this quite substantially changes the behavior,
    this fix is currently disabled by default. Since you might get
    hard to detect issues without this fix you are, however,
    strongly advised to enable this fix in order to avoid issues
    such as the ones described above. As of OTP 25 this fix will
    become enabled by default.
  * erts: Corrected the type specification of erlang:seq_trace/2.
  * erts: Fix memory leak when tracing on running on a process that
    only handle system tasks or non-message signals (for example
    process_info requests).
  * erts: Add support for using socket:sockaddr_in() and
    socket:sockaddr_in6() when using gen_sctp, gen_tcp and gen_udp.
    This will make it possible to use Link Local IPv6 addresses.
  * erts: Show on_load failure reasons in embedded mode.
  * erts: Compile date saved in the Erlang VM executable has been
    removed.
  * erts: Improve documentation for the dynamic node name feature.
  * ssh: Fix makefile dependency bugs.
  * ssh: Fixed faulty OpenSSH decoding of Ed25519/Ed448 keys in the
    OpenSSH format openssh_key_v1.
  * ssh: Correction of ssh_file typing, specially for the
    experimental openssh-key-v1 encoding.
  * ssh: Improper tag for private ED keys when encoding with
    ssh:encode/2. The tuple had ed_priv as first element, but
    should have had ed_pri. This is now corrected. *** POTENTIAL
    INCOMPATIBILITY ***
  * ssh: Add support for Ed25519/Ed448 SSH host keys in the RFC
    4716 format ("-----BEGIN EC PRIVATE KEY-----") generated by for
    example openssl or via Erlang functions (i.e.
    public_key:generate_key({namedCurve, ed25519})). Ed25519 SSH
    host keys generated by ssh-keygen was, and are still,
    supported.
  * kernel: Handling of send_timeout for gen_tcp has been corrected
    so that the timeout is honored also when sending 0 bytes.
  * kernel: By default global does not take any actions to restore
    a fully connected network when connections are lost due to
    network issues. This is problematic for all applications
    expecting a fully connected network to be provided, such as for
    example mnesia, but also for global itself. A network of
    overlapping partitions might cause the internal state of global
    to become inconsistent. Such an inconsistency can remain even
    after such partitions have been brought together to form a
    fully connected network again. The effect on other applications
    that expects that a fully connected network is maintained may
    vary, but they might misbehave in very subtle hard to detect
    ways during such a partitioning. In order to prevent such
    issues, we have introduced a prevent overlapping partitions fix
    which can be enabled using the prevent_overlapping_partitions
    kernel(6) parameter. When this fix has been enabled, global
    will actively disconnect from nodes that reports that they have
    lost connections to other nodes. This will cause fully
    connected partitions to form instead of leaving the network in
    a state with overlapping partitions. Note that this fix has to
    be enabled on all nodes in the network in order to work
    properly. Since this quite substantially changes the behavior,
    this fix is currently disabled by default. Since you might get
    hard to detect issues without this fix you are, however,
    strongly advised to enable this fix in order to avoid issues
    such as the ones described above. As of OTP 25 this fix will
    become enabled by default.
  * kernel: Fix bug where logger would crash when logging a report
    including improper lists.
  * kernel: Make erlang:set_cookie work for dynamic node names.
  * kernel: Add support for using socket:sockaddr_in() and
    socket:sockaddr_in6() when using gen_sctp, gen_tcp and gen_udp.
    This will make it possible to use Link Local IPv6 addresses.
  * kernel: A net_tickintensity kernel parameter has been
    introduced. It can be used to control the amount of ticks
    during a net_ticktime period. A new net_kernel:start/2 function
    has also been introduced in order to make it easier to add new
    options. The use of net_kernel:start/1 has been deprecated.
  * kernel: Improve documentation for the dynamic node name
    feature.
  * erl_docgen: Fix css for large tables and images on small
    screens
  * erl_docgen: Fix bug with codeinclude tag that caused it to not
    include the code if used in a correct, but unexpected way.
  * observer: Calculate the display width in etop, instead of hard-
    coding it to 89 characters.
  * debugger: Fix record index matching, it was broken and could
    never match.
  * ssl: Improved error handling.
  * ssl: Before this change, net_kernel used with TLS distribution
    might be leaking processes in case of connectivity issues.
  * ssl: Fix makefile dependency bugs.
  * ssl: Make sure the TLS sender process handles explicit calls to
    erlang:disconnect_node properly, avoiding potential hanging
    problems in net_kernel.
  * ssl: Add support for TLS-1.3 certificate_authorities extension.
    And process certificate_authorities field in pre-TLS-1.3
    certificate requests.
  * ssl: Support password fun for protected keyfiles in ssl:connect
    function.
  * ssl: Add in some cases earlier detection of possible DoS
    attacks by malicious clients sending unexpected TLS messages
    instead of the client hello. Note that such attacks are already
    mitigated by providing a timeout for the TLS handshake.
  * eldap: Fix eldap extensibleMatch dnAttributes option. According
    to the ldap ASN1 the dnAttributes should be a bool, instead it
    was generated as a string.
  * eldap: Implemented paged searches according to https://www.rfc-
    editor.org/rfc/rfc2696.txt
  * public_key: Support password fun for protected keyfiles in
    ssl:connect function.
  * stdlib: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.
  * mnesia: Reduce the number of locks taken during table copying,
    should reduce the startup time on large systems.
  * diameter: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1649246400">- Fix build for Factory. Currently, any Java version
  is fine for Erlang.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1653220800">- Version 25.0:
  - stdlib
  * New function filelib:ensure_path/1 will ensure that all
    directories for the given path exists
  * New functions groups_from_list/2 and groups_from_list/3 in
    the maps module
  * New functions uniq/1 uniq/2 in the lists module
  * New PRNG added to the rand module, for fast pseudo-random
    numers.
  - compiler, kernel, stdlib, syntax_tools:
  * Added support for selectable features as described in EEP-60.
    Features can be enabled/disabled during compilation with
    options (ordinary and +term) to erlc as well as with
    directives in the file. Similar options can be used to erl
    for enabling/disabling features allowed at runtime. The new
    maybe expression EEP-49 is fully supported as the feature
    maybe_expr.
  - erts &amp; JIT:
  * The JIT now works for 64-bit ARM processors.
  * The JIT now does type-based optimizations based on type
    information in the BEAM files.
  * Improved the JIT’s support for external tools like perf and
    gdb, allowing them to show line numbers and even the original
    Erlang source code when that can be found.
  - erts, stdlib, kernel:
  * Users can now configure ETS tables with the
    {write_concurrency, auto} option. This option forces tables
    to automatically change the number of locks that are used at
    run-time depending on how much concurrency is detected. The
    {decentralized_counters, true} option is enabled by default
    when {write_concurrency, auto} is active.
  * Benchmark results comparing this option with the other ETS
    optimization options are available here: benchmarks.
  * To enable more optimizations, BEAM files compiled with OTP 21
    and earlier cannot be loaded in OTP 25.
  * The signal queue of a process with the process flag
    message_queue_data=off_heap has been optimized to allow
    parallel reception of signals from multiple processes. This
    can improve performance when many processes are sending in
    parallel to one process. See benchmark.
  * The Erlang installation directory is now relocatable on the
    file system given that the paths in the installation’s
    RELEASES file are paths that are relative to the
    installations root directory.
  * A new option called short has been added to the functions
    erlang:float_to_list/2 and erlang:float_to_binary/2. This
    option creates the shortest correctly rounded string
    representation of the given float that can be converted back
    to the same float again.
  * Introduction of quote/1 and unquote/1 functions in the
    uri_string module - a replacement for the deprecated
    functions http_uri:encode and http_uri:decode.
  * The new module peer supersedes the slave module. The slave
    module is now deprecated and will be removed in OTP 27.
  * global will now by default prevent overlapping partitions due
    to network issues. This is done by actively disconnecting
    from nodes that reports that they have lost connections to
    other nodes. This will cause fully connected partitions to
    form instead of leaving the network in a state with
    overlapping partitions.
  * It is possible to turn off the new behavior by setting the
    the kernel configuration parameter
    prevent_overlapping_partitions to false. Doing this will
    retain the same behavior as in OTP 24 and earlier.
  * The format_status/2 callback for gen_server, gen_statem and
    gen_event has been deprecated in favor of the new
    format_status/1 callback.
  * The new callback adds the possibility to limit and change
    many more things than the just the state.
  * The timer module has been modernized and made more efficient,
    which makes the timer server less susceptible to being
    overloaded. The timer:sleep/1 function now accepts an
    arbitrarily large integer.
  - compiler:
  * The maybe ... end construction as proposed in EEP-49 has been
    implemented. It can simplify complex code where otherwise
    deeply nested cases would have to be used.
  * To enable maybe, give the option {enable_feature,maybe_expr}
    to the compiler. The exact option to use will change in a
    coming release candidate and then it will also be possible to
    use from inside the module being compiled.
  * When a record matching or record update fails, a {badrecord,
    ExpectedRecordTag} exception used to be raised. In this
    release, the exception has been changed to {badrecord,
    ActualValue}, where ActualValue is the value that was found
    instead of the expected record.
  * Add compile attribute -nifs() to empower compiler and loader
    with information about which functions may be overridden as
    NIFs by erlang:load_nif/2.
  * Improved and more detailed error messages when binary
    construction with the binary syntax fails. This applies both
    for error messages in the shell and for
    erl_error:format_exception/3,4.
  * Change format of feature options and directives for better
    consistency. Options to erlc and the -compile(..) directive
    now has the format {feature, feature-name, enable | disable}.
    The -feature(..) now has the format -feature(feature-name,
    enable | disable).
  - crypto:
  * Add crypto:hash_equals/2 which is a constant time comparision
    of hashvalues.
  - ssl:
  * Introducing a new (still experimental) option
    {certs_keys,[cert_key_conf()]}. With this a list of a
    certificates with their associated key may be used to
    authenticate the client or the server. The certificate key
    pair that is considered best and matches negotiated
    parameters for the connection will be selected.
  - public_key:
  * Functions for retrieving OS provided CA-certs added.
  - dialyzer:
  * Optimize operations in the erl_types module. Parallelize the
    Dialyzer pass remote.
  * Added the missing_return and extra_return options to raise
    warnings when specifications differ from inferred types.
    These are similar to, but not quite as verbose as overspecs
    and underspecs.
  * Dialyzer now better understands the types for min/2, max/2,
    and erlang:raise/3. Because of that, Dialyzer can potentially
    generate new warnings. In particular, functions that use
    erlang:raise/3 could now need a spec with a no_return()
    return type to avoid an unwanted warning.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1656849600">- Changes for 25.0.2:
  * ssl: Improved handling of unexpected messages during the
    handshake, taking the right action for unexpected messages.
  * erts: On computers with the ARM64 (AArch64) architecture (such
    as Apple Silicon Macs) a rem expression followed by a div
    expression with the same operands could evaluate to the wrong
    result if the result of the rem expression was unused.
- Changes for 25.0.1:
  * ssl: When a TLS-1.3 enabled client tried to talk to a TLS-1.2
    server that coalesces TLS-1.2 handshake message over one TLS
    record, the connection could fail due to some message being
    handled in the wrong state, this has been fixed.
  * ssl: Correctly handles supported protocol version change from
    default to something else by sni_fun supplied to
    ssl:handshake/[2,3] together with a TCP-socket (so called
    upgrade).
  * ssl: Also, TLS-1.3 should respond with a protocol version alert
    if previous versions, that are supported but not configured,
    are attempted.
  * kernel: The DNS resolver inet_res has been fixed to ignore
    trailing dot difference in the request domain between the sent
    request and the received response, when validating a response.
  * kernel: A bug in inet_res has been fixed where a missing
    internal {ok,_} wrapper caused inet_res:resolve/* to return a
    calculated host name instead of an `{ok,Msg} tuple, when
    resolving an IP address or a host name that is an IP address
    string.
  * kernel: The erlang:is_alive() BIF could return true before
    configured distribution service was available. This bug was
    introduced in OTP 25.0 ERTS version 13.0. The
    erlang:monitor_node() and erlang:monitor() BIFs could
    erroneously fail even though configured distribution service
    was available. This occurred if these BIFs were called after
    the distribution had been started using dynamic node name
    assignment but before the name had been assigned.
  * kernel: Added the missing mandatory address/0 callback in the
    gen_tcp_dist example.
  * erts: A spawn_reply signal from a remote node could be delayed
    and be delivered after other signals from the newly spawned
    process. When this bug triggered, the connection to the node
    where the process was spawned sometimes could be taken down due
    to the bug. The following error message would then be logged if
    this happened: Missing 'spawn_reply' signal from the node
    &lt;RemoteNode&gt; detected by &lt;Pid&gt; on the node &lt;LocalNode&gt;. The
    node &lt;RemoteNode&gt; probably suffers from the bug with ticket id
    OTP-17737. This bug only affected processes which had enabled
    off_heap message_queue_data and parallel reception of signals
    had been automatically enabled. This bug was introduced in OTP
    25.0, ERTS version 13.0.
  * erts: Fixed type spec of erlang:system_info(dist_ctrl).
  * erts: The zlib built in to the runtime system has been updated
    to version 1.2.12. (Note that on most platforms, the platform's
    own zlib is used.)
  * erts: The erlang:is_alive() BIF could return true before
    configured distribution service was available. This bug was
    introduced in OTP 25.0 ERTS version 13.0. The
    erlang:monitor_node() and erlang:monitor() BIFs could
    erroneously fail even though configured distribution service
    was available. This occurred if these BIFs were called after
    the distribution had been started using dynamic node name
    assignment but before the name had been assigned.
  * crypto: Note in the documentation that MODP (rfc3526) groups
    and OpenSSL 3.0 can give an error if a call to
    crypto:generate_key/2 specifies a key length, and that length
    is to small.
  * crypto: The cmac now uses only the 3.0 API
  * crypto: Documentation is now updated with which OpenSSL
    cryptolib versions that OTP currently is tested.
  * dialyzer: Fixed the documentation for the missing_return and
    extra_return options.
  * mnesia: Fixed add_table_copy which could leave a table lock if
    the receiving node went down during the operation.
  * ssh: Binaries can be limited in logs with the parameter
    max_log_item_len. The default value is 500 bytes.
  * stdlib: In the initial release of Erlang/OTP 25, the expression
    bound to the _ pseudo-field in a record initialization would
    always be evaluated once, even if all other fields in the
    record were explicitly initialized. That would break the use
    case of binding the expression error(...) to _ in order to get
    an exception if not all fields were initialized. The behavior
    of binding to _ has been reverted to the pre-OTP 25 behavior,
    that is, to not evaluate the expression if all fields have been
    bound to explicit values.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1660046400">- Changes for 25.0.3:
  * erts: Distributed exit signals could be lost under the
    following conditions:
  * erts: A race could cause process_info(Pid, message_queue_len)
    on other processes to return invalid results.
  * erts: Fixed reduction counting for handling process system
    tasks.
  * erts: Priority elevation of terminating processes did not work
    which could cause execution of such processes to be delayed.
  * erts: An unlink operation made by a process that terminated
    before the unlink operation completed, i.e., before it had
    received an unlink-ack signal from the linked process, caused
    an exit signal to erroneously be sent from the terminating
    process to the process being unlinked. This exit signal would
    most often be ignored by the receiver, but if the receiver of
    the exit signal concurrently set up a new link, it could
    receive the exit signal with the actual exit reason of the
    terminating process instead of a noproc exit reason. It is
    however very hard to detect that this has happened and has no
    obvious negative consequences, so it should be considered
    harmless. A distributed unlink-ack signal received by a
    terminating process was also not properly removed which could
    cause a minor memory leak.
  * ssl: The link to crypto:engine_load refered the function with
    wrong arity.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1661601600">- Changes for 25.0.4:
  * kernel: A call to net_kernel:setopts(new, Opts) at the same
    time as a connection was being set up could cause a deadlock
    between the net_kernel process and the process setting up the
    connection.
  * erts: The monitor/3 BIF did not apply options to the created
    monitor if the target process or port did not exist. That is,
    the corresponding down message would get a `DOWN` tag even if a
    custom tag had been set, and the returned reference was not an
    alias even if the alias option had been passed.
  * erts: The erlang:monotonic_time/1, erlang:system_time/1,
    erlang:time_offset/1, and os:system_time/1 BIFs erroneously
    failed when passed the argument native.</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1665662400">- Changes for 25.1.1:
  * dialyzer: Dialyzer could crash when analyzing Elixir code that
    used intricate macros.
  * dialyzer: The --input_list_file option has been added.
  * ssl: Fixes handling of symlinks in cacertfile option.
  * eunit: With this change, eunit exact_execution option works
    with application primitive.
  * stdlib: peer nodes failed to halt when the process supervising
    the control connection crashed. When an alternative control
    connection was used, this supervision process also quite
    frequently crashed when the peer node was stopped by the node
    that started it which caused the peer node to linger without
    ever halting.
  * asn1: For the per and uper ASN.1 encoding rules, encoding and
    decoding the SEQUENCE OF and SET OF constructs with 16384 items
    or more is now supported.
  * erts: Listen sockets created with the socket module, leaked
    (erlang-) monitors.
  * erts: Notifications about available distribution data sent to
    distribution controller processes could be lost. Distribution
    controller processes can be used when implementing an
    alternative distribution carrier. The default distribution over
    tcp was not effected and the bug was also not present on
    x86/x86_64 platforms.
  * kernel: Listen sockets created with the socket module, leaked
    (erlang-) monitors.
  * kernel: peer nodes failed to halt when the process supervising
    the control connection crashed. When an alternative control
    connection was used, this supervision process also quite
    frequently crashed when the peer node was stopped by the node
    that started it which caused the peer node to linger without
    ever halting.
- Changes for 25.1:
  * dialyzer: Two bugs have been fixed in Dialyzer's checking of
    behaviors: When a mandatory callback function is present but
    not exported, Dialyzer would not complain about a missing
    callback. When an optional callback function was not exported
    and had incompatible arguments and/or the return values were
    incompatible, Dialyzer would complain. This has been changed to
    suppress the warning, because the function might not be
    intended to be a callback function, for instance if a release
    added a new optional callback function (such as format_status/1
    for the gen_server behaviour added in OTP 25).
  * dialyzer: The no_extra_return and no_missing_return warnings
    can now be suppressed through -dialyzer directives in source
    code.
  * jinterface: Fix javadoc build error by adding option -encoding
    UTF-8.
  * diameter: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * crypto: Fix configure with --with-ssl and --disable-dynamic-
    ssl-lib on Windows.
  * crypto: Remove all references correctly in the garbage
    collection if an engine handle was not explicit unloaded.
  * crypto: Changed the behaviour of the engine load/unload
    functions The engine load/unload functions have got changed
    semantics to get a more consistent behaviour and work correct
    when variables are garbage collected. The load functions now
    don't register the methods for the engine to replace. That will
    now be handled with the new functions
    engine_register/engine_unregister if needed. Some functions are
    removed from the documentation and therefor the API, but they
    are left in the code for compatibility. *** POTENTIAL
    INCOMPATIBILITY ***
  * crypto: Fixed a naming bug for AES-CFB and Blowfish-CFB/OFB
    when linked with OpenSSL 3.0 cryptolib.
  * crypto: Sign/verify does now behave as in OTP-24 and earlier
    for eddsa.
  * crypto: Pass elliptic curve names from crypto.erl to crypto's
    nif.
  * crypto: The configure option --disable-deprecated-warnings is
    removed. It was used for some releases when the support for
    OpenSSL 3.0 was not completed. It is not needed in OTP 25.
  * crypto: Crypto is now considered to be usable with the OpenSSL
    3.0 cryptolib for production code. ENGINE and FIPS are not yet
    fully functional.
  * crypto: Do not exit if the legacy provider is missing in
    libcrypto 3.0.
  * ssl: Reject unexpected application data in all relevant places
    for all TLS versions. Also, handle TLS-1.3 middlebox
    compatibility with more care. This will make malicious
    connections fail early and further, mitigate possible DoS
    attacks, that would be caught by the handshake timeout. Thanks
    to Aina Toky Rasoamanana and Olivier Levillain from Télécom
    SudParis for alerting us of the issues in our implementation.
  * ssl: With this change, value of cacertfile option will be
    adjusted before loading certs from the file. Adjustments
    include converting relative paths to absolute and converting
    symlinks to actual file path. Thanks to Marcus Johansson
  * ssl: In TLS-1.3, if chain certs are missing (so server auth
    domain adherence can not be determined) send peer cert and hope
    the server is able to recreate a chain in its auth domain.
  * ssl: Make sure periodical refresh of CA certificate files
    repopulates cache properly.
  * ssl: Correct internal CRL cache functions to use internal
    format consistently.
  * ssl: Incorrect handling of client middlebox negotiation for
    TLS-1.3 could result in that a TLS-1.3 server would not use
    middlebox mode although the client was expecting it too and
    failing the negotiation with unexpected message.
  * ssl: If the "User" process, the process starting the TLS
    connection, gets killed in the middle of spawning the dynamic
    connection tree make sure we do not leave any processes behind.
  * ssl: A vulnerability has been discovered and corrected. It is
    registered as CVE-2022-37026 "Client Authentication Bypass".
    Corrections have been released on the supported tracks with
    patches 23.3.4.15, 24.3.4.2, and 25.0.2. The vulnerability
    might also exist in older OTP versions. We recommend that
    impacted users upgrade to one of these versions or later on the
    respective tracks. OTP 25.1 would be an even better choice.
    Impacted are those who are running an ssl/tls/dtls server using
    the ssl application either directly or indirectly via other
    applications. For example via inets (httpd), cowboy, etc. Note
    that the vulnerability only affects servers that request client
    certification, that is sets the option {verify, verify_peer}.
    (bsc#1205318)
  * eunit: With this change, Eunit can optionally not try to
    execute related module with "_tests" suffix. This might be used
    for avoiding duplicated executions when source and test modules
    are located in the same folder.
  * erl_docgen: Update DTD to allow XML tag em under pre.
  * inets: Add httpc:ssl_verify_host_options/1 to help setting
    default ssl options for the https client.
  * inets: This change fixes dialyzer warnings generated for
    inets/httpd examples (includes needed adjustment of spec for
    ssh_sftp module).
  * inets: Remove documentation of no longer supported callback.
  * stdlib: Fixed inconsistency bugs in global due to
    nodeup/nodedown messages not being delivered before/after
    traffic over connections. Also fixed various other
    inconsistency bugs and deadlocks in both global_group and
    global. As building blocks for these fixes, a new BIF
    erlang:nodes/2 has been introduced and
    net_kernel:monitor_nodes/2 has been extended. The -hidden and
  - connect_all command line arguments did not work if multiple
    instances were present on the command line which has been
    fixed. The new kernel parameter connect_all has also been
    introduced in order to replace the -connect_all command line
    argument.
  * stdlib: Fix the public_key:ssh* functions to be listed under
    the correct release in the Removed Functionality User's Guide.
  * stdlib: The type spec for format_status/1 in gen_statem,
    gen_server and gen_event has been corrected to state that the
    return value is of the same type as the argument (instead of
    the same value as the argument).
  * stdlib: If the timer server child spec was already present in
    kernel_sup but it was not started, the timer server would fail
    to start with an {error, already_present} error instead of
    restarting the server.
  * stdlib: When changing callback module in gen_statem the
    state_enter calls flag from the old module was used in for the
    first event in the new module, which could confuse the new
    module and cause malfunction. This bug has been corrected. With
    this change some sys debug message formats have been modified,
    which can be a problem for debug code relying on the format.
  * ** POTENTIAL INCOMPATIBILITY ***
  * stdlib: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * stdlib: The rfc339_to_system_time/1,2 functions now allows the
    minutes part to be omitted from the time zone.
  * stdlib: The receive statement in gen_event has been optimized
    to not use selective receive (which was never needed, and could
    cause severe performance degradation under heavy load).
  * stdlib: Add new API function erl_features:configurable/0
  * parsetools: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * public_key: Support more Linux distributions in cacerts_load/0.
  * public_key: Correct asn1 typenames available in type
    pki_asn1_type()
  * public_key: Sign/verify does now behave as in OTP-24 and
    earlier for eddsa.
  * snmp: Improved the get-bulk response max size calculation. Its
    now possible to configure 'empty pdu size', see appendix c for
    more info.
  * snmp: Fix various example dialyzer issues
  * ssh: Handling rare race condition at channel close.
  * ssh: New ssh option no_auth_needed to skip the ssh
    authentication. Use with caution!
  * ssh: This change fixes dialyzer warnings generated for
    inets/httpd examples (includes needed adjustment of spec for
    ssh_sftp module).
  * ssh: The new function ssh:daemon_replace_options/2 makes it
    possible to change the Options in a running SSH server.
    Established connections are not affected, only those created
    after the call to this new function.
  * ssh: Add a timeout as option max_initial_idle_time. It closes a
    connection that does not allocate a channel within the timeout
    time. For more information about timeouts, see the Timeouts
    section in the User's Guide Hardening chapter.
  * observer: Fixed units in gui.
  * xmerl: There is a new configure option, --enable-deterministic-
    build, which will apply the deterministic compiler option when
    building Erlang/OTP. The deterministic option has been improved
    to eliminate more sources of non-determinism in several
    applications.
  * asn1: There is a new configure option, --enable-deterministic-
    build, which will apply the deterministic compiler option when
    building Erlang/OTP. The deterministic option has been improved
    to eliminate more sources of non-determinism in several
    applications.
  * erts: Fixed inconsistency bugs in global due to nodeup/nodedown
    messages not being delivered before/after traffic over
    connections. Also fixed various other inconsistency bugs and
    deadlocks in both global_group and global. As building blocks
    for these fixes, a new BIF erlang:nodes/2 has been introduced
    and net_kernel:monitor_nodes/2 has been extended. The -hidden
    and -connect_all command line arguments did not work if
    multiple instances were present on the command line which has
    been fixed. The new kernel parameter connect_all has also been
    introduced in order to replace the -connect_all command line
    argument.
  * erts: Fixed IPv6 multicast_if and membership socket options.
  * erts: Accept funs (NEW_FUN_EXT) with incorrectly encoded size
    field. This is a workaround for a bug (OTP-18104) existing in
    OTP 23 and 24 that could cause incorrect size fields in certain
    cases. The emulator does not use the decoded size field, but
    erl_interface still does and is not helped by this workaround.
  * erts: Fixed issue with inet:getifaddrs hanging on pure IPv6
    Windows
  * erts: Fix faulty distribution encoding of terms with either The
    symptom could be failed decoding on the receiving side leading
    to aborted connection. Fix OTP-18093 is a workaround for theses
    bugs that makes the VM accepts such faulty encoded funs. The
    first encoding bug toward pending connection exists only in OTP
    23 and 24, but the second one exists also on OTP 25.
  * erts: Fixed emulator crash that could happen during crashdump
    generation of ETS tables with options ordered_set and
    {write_concurrency,true}.
  * erts: Retrieval of monotonic and system clock resolution on
    MacOS could cause a crash and/or erroneous results.
  * erts: Fix bug where the max allowed size of erl +hmax was lower
    than what was allowed by process_flag.
  * erts: On computers with ARM64 (AArch64) processors, the JIT
    could generate incorrect code when more than 4095 bits were
    skipped at the tail end of a binary match.
  * erts: In rare circumstances, an is_binary/1 guard test could
    succeed when given a large integer.
  * erts: Fix bug causing ets:info (and sometimes ets:whereis) to
    return 'undefined' for an existing table if a concurrent
    process were doing ets:insert with a long list on the same
    table.
  * erts: Fix writing and reading of more than 2 GB in a single
    read/write operation on macOS. Before this fix attempting to
    read/write more than 2GB would result in {error,einval}.
  * erts: Fix bug sometimes causing emulator crash at node shutdown
    when there are pending connections. Only seen when running duel
    distribution protocols, inet_drv and inet_tls_dist.
  * erts: Yield when adjusting large process message queues due to
    The message queue adjustment work will now be interleaved with
    all other types of work that processes have to do, even other
    message queue adjustment work.
  * erts: Add rudimentary debug feature (option) for the inet-
    driver based sockets, such as gen_tcp and gen_udp.
  * erts: Introduced the hidden and dist_listen options to
    net_kernel:start/2. Also documented the -dist_listen command
    line argument which was erroneously documented as a kernel
    parameter and not as a command line argument.
  * erts: New documentation chapter "Debugging NIFs and Port
    Drivers" under Interoperability Tutorial.
  * erts: Add new API function erl_features:configurable/0
  * kernel: Fixed inconsistency bugs in global due to
    nodeup/nodedown messages not being delivered before/after
    traffic over connections. Also fixed various other
    inconsistency bugs and deadlocks in both global_group and
    global. As building blocks for these fixes, a new BIF
    erlang:nodes/2 has been introduced and
    net_kernel:monitor_nodes/2 has been extended. The -hidden and
  - connect_all command line arguments did not work if multiple
    instances were present on the command line which has been
    fixed. The new kernel parameter connect_all has also been
    introduced in order to replace the -connect_all command line
    argument.
  * kernel: Fixed IPv6 multicast_if and membership socket options.
  * kernel: Fixed issue with inet:getifaddrs hanging on pure IPv6
    Windows
  * kernel: The type specifications for inet:getopts/2 and
    inet:setopts/2 have been corrected regarding SCTP options.
  * kernel: The type specifications for inet:parse_* have been
    tightened.
  * kernel: Fix gen_tcp:connect/3 spec to include the inet_backend
    option.
  * kernel: Fix bug where using a binary as the format when calling
    logger:log(Level, Format, Args) (or any other logging function)
    would cause a crash or incorrect logging.
  * kernel: Add rudimentary debug feature (option) for the inet-
    driver based sockets, such as gen_tcp and gen_udp.
  * kernel: Introduced the hidden and dist_listen options to
    net_kernel:start/2. Also documented the -dist_listen command
    line argument which was erroneously documented as a kernel
    parameter and not as a command line argument.
  * kernel: Scope and group monitoring have been introduced in pg.
    For more information see the documentation of
    pg:monitor_scope(), pg:monitor(), and pg:demonitor().
  * kernel: A new function global:disconnect/0 has been introduced
    with which one can cleanly disconnect a node from all other
    nodes in a cluster of global nodes.
  * compiler: The compiler will now forbid using the empty atom ''
    as module name. Also forbidden are modules names containing
    control characters, and module names containing only spaces and
    soft hyphens.
  * compiler: The bin_opt_info and recv_opt_info options would
    cause the compiler to crash when attempting to compile
    generated code without location information.
  * compiler: In rare circumstances involving floating point
    operations, the compiler could terminate with an internal
    consistency check failure.
  * compiler: In rare circumstances when doing arithmetic
    instructions on non-numbers, the compiler could crash.
  * compiler: In rare circumstances, complex boolean expressions in
    nested cases could cause the compiler to crash.
  * compiler: Expression similar to #{assoc:=V} = #key=&gt;self()}, V
    would return the empty map instead of raising an exception.
  * compiler: Eliminated a crash in the beam_ssa_bool pass of the
    compiler when compiling a complex guard expression.
  * compiler: In rare circumstances, the compiler could crash with
    an internal consistency check failure.
  * compiler: When compiling with the option inline_list_funcs, the
    compiler could produce a nonsensical warning.
  * compiler: When given the no_ssa_opt option, the compiler could
    terminate with an internal consistency failure diagnostic when
    compiling map matching.
  * compiler: Made warnings for existing atoms being keywords in
    experimental features more precise, by not warning about quoted
    atoms.
  * compiler: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * megaco: Fixed various dialyzer related issues in the examples
    and the application proper.
  * megaco: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * common_test: Fix cth_surefire to handle when a suite is not
    compiled with debug_info. This bug has been present since
    Erlang/OTP 25.0.
  * common_test: Common Test now preserves stack traces for throws.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1669291200">- Changes for 25.1.2:
  * mnesia: Don't fill the logs if mnesia can't connect to all
    nodes, due to partitioned network.
  * erts: Add abandon carrier free utilization limit (+Muacful)
    option to erts_alloc. This option allows the user to mark
    unused segments in a memory carrier as re-useable by the OS if
    needed. This functionality was a non-configurable default
    before Erlang/OTP 25, but removed due to performance issues.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1671364800">- Changes for 25.2:
  * erts: Fix perf/gdb JIT symbols to not contain CodeInfoPrologue
    for the JIT internal module erts_beamasm.
  * erts: Fixed minor memory leaks.
  * erts: Fix bugs in ets:insert and ets:insert_new when called
    with a list of tuples to insert while a concurrent process
    either deletes or renames the table. The table deletion could
    be done with ets:delete/1 or be caused by termination of the
    table owning process. Symptoms are either VM crash or strange
    incorrect behavior from the insert operation. The risk of
    triggering the bugs increases with the length of the list of
    tuple to insert. Bugs exist since OTP 23.0.
  * erts: Boost execution of scheduled thread progress jobs. This
    to prevent memory exhaustion in extremely rapid
    allocation/deallocation scenarios, such as repeated ETS table
    creations/deletions.
  * erts: Fix segv crash during crash dumping an ETS table doing
    ets:delete_all_objects.
  * erts: Spec for function net:if_names/0 incorrect
  * erts: Fix bug in binary_to_term decoding a binary term 2Gbyte
    or larger.
  * erts: Documentation of erlang:module_loaded/1 has been
    adjusted:
  * erts: Fix list_to_atom/1 for negative code points. Could either
    return with a positive code point or fail with an incorrect
    exception.
  * erts: Fix rare bug causing VM crash when sending to a pid of a
    spawning process returned from erlang:processes/0. Only seen
    when provoked by system process literal_area_collector,
    triggered by a module purge operation, on a VM started with
    +Meamin (no customized allocators).
  * erts: gen_udp:open/2 with option(s) add_membership or
    drop_membership would drop earlier options.
  * erts: The inet:setopts/2 {reuseaddr, true} option will now be
    ignored on Windows unless the socket is an UDP socket. For more
    information see the documentation of the reuseaddr option part
    of the documentation of inet:setopts/2. Prior to OTP 25 the
    {reuseaddr, true} option was ignored for all sockets on
    Windows, but as of OTP 25.0 this was changed so that it was not
    ignored for any sockets. *** POTENTIAL INCOMPATIBILITY ***
  * erts: Fix bug in binary_to_term decoding a list of length 1G or
    longer.
  * erts: Fix bug in binary_to_term (and distributed receive) when
    decoding a large map (&gt;32 keys) with unsorted small maps (&lt;=
    32) as keys of the large map. This was only a problem if the
    term was encoded by erl_interface, jinterface or otherwise, as
    the VM itself always encodes small maps with sorted keys. The
    "binary_to_term" would appear as successful but the created
    large map was internally inconsistent. The smaller key-maps
    could not be found with maps:get and friends. Other operations
    such as map compare and merge could probably also give
    incorrect results.
  * erts: Fix Windows bug in open_port({spawn, Command}, ..) when
    Command is found via the OS search PATH and that directory path
    contains white spaces. The port program would start but the
    command line arguments to it could be incorrect.
  * ftp: fix unexpected result ok when calling ftp:nlist repeatedly
  * inets: This change allows body requests to httpc:request/5 be
    an iolist()
  * inets: addition of type specs in httpc.erl
  * inets: httpc: Add support for HTTP 308 status code
  * dialyzer: Dialyzer would crash when attempting to analyze a bit
    syntax segment size having an literal non-integer size such as
    [].
  * dialyzer: Dialyzer could crash when trying to analyze a
    convoluted nested expression involving funs,
  * kernel: Fixed shutdown crash in gen_tcp socket backend, when
    the other end closed the socket.
  * kernel: erl_tar can now read gzip-compressed tar files that are
    padded. There is a new option compressed_one for file:open/2
    that will read a single member from a gzip file,
  * kernel: Fix os:cmd to not translate all exceptions thrown to
    badarg. For example emfile from erlang:open_port was translated
    to badarg. This bug has existed since Erlang/OTP 24.
  * kernel: Spec for function net:if_names/0 incorrect
  * kernel: Missing ctrl option name transation for TOS and TTL (on
    FreeBSD) when using gen_udp with the 'socket' inet_backend.
  * kernel: gen_udp:open/2 with option(s) add_membership or
    drop_membership would drop earlier options.
  * kernel: The inet:setopts/2 {reuseaddr, true} option will now be
    ignored on Windows unless the socket is an UDP socket. For more
    information see the documentation of the reuseaddr option part
    of the documentation of inet:setopts/2. Prior to OTP 25 the
    {reuseaddr, true} option was ignored for all sockets on
    Windows, but as of OTP 25.0 this was changed so that it was not
    ignored for any sockets. *** POTENTIAL INCOMPATIBILITY ***
  * kernel: The distribution socket option handling in
    inet_tcp_dist has been cleaned up to clarify which were
    mandatory and which just had default values.
  * kernel: Improve warning message format for gen_tcp_socket.
  * snmp: Explicitly close the socket(s) when terminating
    (default-) net-if process.
  * stdlib: erl_tar can now read gzip-compressed tar files that are
    padded. There is a new option compressed_one for file:open/2
    that will read a single member from a gzip file,
  * stdlib: A concurrent call to ets:rename could cause
    ets:delete_all_objects to fail halfway through with badarg.
  * stdlib: It is not allowed to call functions from guards. The
    compiler failed to reject a call in a guard when done by
    constructing a record with a default initialization expression
    that called a function.
  * stdlib: The compiler could crash when using a record with
    complex field initialization expression as a filter in a list
    comprehension.
  * stdlib: unicode:characters_to_binary() could build
    unnecessarily large call stack.
  * stdlib: Improve error message for ets:new/2 name clash. Say
    "name already exists" instead of less specific "invalid
    options".
  * mnesia: Fixed crash which could happen during startup if too
    many decisions where sent from remote nodes.
  * os_mon: The disk_space_check_interval configuration parameter
    of disksup can now be set to values smaller than a minute.
  * ssh: graceful shutdown of ssh_conection_handler when connection
    is closed by peer
  * common_test: Fix starting of peer nodes on old releases when
    the compile server was active and the current Erlang
    installation contained non-latin1 characters in its path.
  * public_key: Disregard LDAP URIs when HTTP URIs are expected.
  * ssl: With this change, tls_sender process is hibernated after
    sufficient inactivity.
  * ssl: Correct handling of legacy schemes so that ECDSA certs
    using sha1 may be used for some TLS-1.3 configurations.
  * ssl: With this change, tls_sender does not cause logger crash
    upon key update.
  * ssl: Enhance warning message
  * ssl: Provide server option to make certificate_authorities
    extension in the TLS-1.3 servers certificate request optional.
    This will allow clients to send incomplete chains that may be
    reconstructable and thereby verifiable by the server, but that
    would not adhere to the certificate_authorities extension.
  * ssl: If the verify_fun handles four arguments the DER cert will
    be supplied as one of the arguments.
  * megaco: A very minor improvement to the measurement tool.
  * observer: A WX event race could causes a crash in when handling
    socket or port info.
  * observer: Improve the nodes menu to include more nodes.
  * compiler: Line number in compiler messages would be truncated
    to 4 digits for line numbers greater than 9999.
  * compiler: In rare circumstance, matching a binary as part of a
    receive clause could cause the compiler to terminate because of
    an internal consistency check failure.
  * compiler: Compiling a function with complex bit syntax matching
    such as f(&lt;&lt;X:0, _:X&gt;&gt;, &lt;&lt;Y:0, _:Y&gt;&gt;) -&gt; ok. could crash the
    compiler.
  * compiler: It is not allowed to call functions from guards. The
    compiler failed to reject a call in a guard when done by
    constructing a record with a default initialization expression
    that called a function.
  * compiler: The compiler could crash when using a record with
    complex field initialization expression as a filter in a list
    comprehension.
  * wx: Added environment variable WX_MACOS_NON_GUI_APP to allow
    user to override OSXIsGUIApplication behavior.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1679745600">- Changes for 25.3:
  * reltool: Fixed a bug that would cause analysis to crash.
  * stdlib: Fixed a bug that would cause analysis to crash.
  * stdlib: Fixed a crash when formatting stack traces for error
    reports.
  * stdlib: Instead of crashing, the list_to_integer/1 and
    list_to_integer/2 BIFs now raise the system_limit exception for
    overlong lists that can't be converted to integers. Similarly,
    the string:to_integer/1 BIF now returns {error,system_limit}
    for overlong lists.
  * stdlib: Removal of non-necessary undefined types added to the
    state's supervisor record.
  * compiler: Fixed a bug that would cause the compiler to hang.
  * compiler: Fixed a crash when compiling code that contained
    maybe expressions.
  * compiler: Constructing a binary with an explicit size of all
    for a binary segment would crash the compiler.
  * compiler: The compiler would generate incorrect code for the
    following type of expression: Pattern = BoundVar1 = . . . =
    BoundVarN = Expression An exception should be raised if any of
    the bound variables have different values than Expression. The
    compiler would generate code that would cause the bound
    variables to be bound to the value of Expressionwhether the
    value matched or not.
  * xmerl: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * megaco: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * debugger: Fixed a bug that would cause analysis to crash.
  * erts: Fixed a bug on Windows where file:read_file_info/1 would
    fail for files with corrupt metadata.
  * erts: Fix process_info(_, binary) to again include "writable
    binaries" which were lost in OTP-25.0. Writable binaries are an
    optimization used when binaries are appended upon in a loop.
  * erts: Fix rare race when receiving fragmented messages on a
    terminating connection. Could potentially cause memory leaks as
    well as double free crashes. Bug exists since OTP 22.0.
  * erts: Fixed bug that could maybe cause problems when a file
    descriptor number is closed by a linked in driver and then
    opened (reused) and passed to enif_select by a NIF. No actual
    symptoms seen, only failed internal assertions in debug build.
  * erts: The runtime system could crash when tracing a process
    executing on a dirty scheduler.
  * erts: In the binary syntax, attempting to match out integers
    with size exceeding 2 GiB could crash the runtime system.
  * erts: Fixed edge case in floating-point negation where A = 0.0,
    B = -A did not produce B = -0.0 on x86_64 JIT.
  * erts: Fixed an issue in the JIT that could crash the emulator
    on some platforms.
  * erts: Added meta data to the windows installer.
  * erts: Fixed ETS insertion order into bag and duplicate_bag of
    tuples with identical keys when passed in a list to
    ets:insert/2. The insert order has been head-to-tail but was
    accidentally changed in OTP 23.0. For bag it was reverted
    (tail-to-head), while for duplicate_bag it was sometimes
    reverted depending on the length of the list and number of
    "reductions" left for the calling process. This fix changes the
    insert order of ets:insert/2 back to always be head-to-tail of
    the list argument.
  * erts: With the JIT for AArch64 (AMD64), calling bxor in with
    non-integer arguments in a guard would crash the runtime
    system.
  * erts: Fix bug regarding process flag max_heap_size. Could cause
    strange behavior when a process was killed due to exceeding the
    limit.
  * erts: Fixed binary comprehensions to be similar to other
    creation of binary data with respect to its contribution of
    triggering garbage collection.
  * erts: In rare circumstances, when a process exceeded its
    allowed heap size set by option max_heap_size, it would not be
    killed as it should be, but instead enter a kind of zombie
    state it would never get out of.
  * erts: Instead of crashing, the list_to_integer/1 and
    list_to_integer/2 BIFs now raise the system_limit exception for
    overlong lists that can't be converted to integers. Similarly,
    the string:to_integer/1 BIF now returns {error,system_limit}
    for overlong lists.
  * erts: Active process aliases of a process at its termination
    leaked memory.
  * erts: Support for fully asynchronous distributed signaling
    where send operations never block. This functionality is by
    default disabled and can be enabled per process. For more
    information see the documentation of process_flag(async_dist,
    Bool).
  * erts: Added the +JPperf no_fp option to explicitly disable
    Erlang frame pointers otherwise added when using the +JPperf
    map option.
  * erl_interface: Accept connection setup from OTP 23 and 24 nodes
    that are not using epmd.
  * erl_interface: The ei API for decoding/encoding terms is not
    fully 64-bit compatible since terms that have a representation
    on the external term format larger than 2 GB cannot be handled.
  * syntax_tools: erl_syntax_lib:annotate_bindings/1,2 will now
    properly annotate named functions and their arguments.
  * kernel: Fixed a bug on Windows where file:read_file_info/1
    would fail for files with corrupt metadata.
  * kernel: Accept connection setup from OTP 23 and 24 nodes that
    are not using epmd.
  * public_key: As different solutions of verifying certificate
    revocation exists move the decode of 'CRLDistributionPoints' so
    that it will only be decode. When it is actually used in the
    verification process. This would enable interoperability with
    systems that use certificates with an invalid empty
    CRLDistributionPoints extension that they want to ignore and
    make verification by other means.
  * public_key: public_key:pkix_path_validation validates
    certificates expiring after 2050
  * public_key: Do not leave exit message in message queue after
    calling cacerts_load() on MacOS.
  * public_key: Replace size/1 with either tuple_size/1 or
    byte_size/1 The size/1 BIF is not optimized by the JIT, and its
    use can result in worse types for Dialyzer. When one knows that
    the value being tested must be a tuple, tuple_size/1 should
    always be preferred. When one knows that the value being tested
    must be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * ssl: Fixed that new dtls connections from the same client ip
    port combination works. If there is a process waiting for
    accept the new connection will connect to that, otherwise it
    will try to re-connect to the old server connection.
  * ssl: When shutting down a node that uses SSL distribution
    (-proto_dist inet_tls), a confusing error message about an
    unexpected process exit was printed. This particular message is
    no longer generated.
  * ssl: fixes the type spec for ssl:format_error/1
  * ssl: Replace size/1 with either tuple_size/1 or byte_size/1 The
    size/1 BIF is not optimized by the JIT, and its use can result
    in worse types for Dialyzer. When one knows that the value
    being tested must be a tuple, tuple_size/1 should always be
    preferred. When one knows that the value being tested must be a
    binary, byte_size/1 should be preferred. However, byte_size/1
    also accepts a bitstring (rounding up size to a whole number of
    bytes), so one must make sure that the call to byte_size/ is
    preceded by a call to is_binary/1 to ensure that bitstrings are
    rejected. Note that the compiler removes redundant calls to
    is_binary/1, so if one is not sure whether previous code had
    made sure that the argument is a binary, it does not harm to
    add an is_binary/1 test immediately before the call to
    byte_size/1.
  * jinterface: Accept connection setup from OTP 23 and 24 nodes
    that are not using epmd.
  * os_mon: The port programs used by cpu_sup and memsup are now
    gracefully shut down when cpu_sup and memsup are shut down.
  * eunit: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * crypto: A user defined runtime library path configured using
  - -with-ssl-rpath=&lt;PATHS&gt; could fail to be enabled.
  * crypto: Ensure that configure fails if a user defined runtime
    library path has been passed by the user, but cannot set.
  * mnesia: Improved consistency for dirty writes when a table was
    added with add_table_copy/3. Fixed a problem with sticky write,
    which could lead to inconsistent data.
  * mnesia: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * common_test: Renamed undocumented macro CT_PEER/3 to
    CT_PEER_REL/3.
  * ssh: With this change, PKCS8 formatted private key file is
    properly decoded and SSH daemon with such key can be started.
  * ssh: Replace size/1 with either tuple_size/1 or byte_size/1 The
    size/1 BIF is not optimized by the JIT, and its use can result
    in worse types for Dialyzer. When one knows that the value
    being tested must be a tuple, tuple_size/1 should always be
    preferred. When one knows that the value being tested must be a
    binary, byte_size/1 should be preferred. However, byte_size/1
    also accepts a bitstring (rounding up size to a whole number of
    bytes), so one must make sure that the call to byte_size/ is
    preceded by a call to is_binary/1 to ensure that bitstrings are
    rejected. Note that the compiler removes redundant calls to
    is_binary/1, so if one is not sure whether previous code had
    made sure that the argument is a binary, it does not harm to
    add an is_binary/1 test immediately before the call to
    byte_size/1.
  * inets: With this change, handling of URI to a folder, with
    missing trailing / and a query component present is fixed.
  * inets: Adds more type information to the inets app, thus
    improving the errors that static analysis tools can detect. The
    addition of type information to records and the updates to
    function heads help static analysis tools to understand that
    some values in the records cannot be 'undefined', thus making
    static tools to type check correctly more modules in the inets
    app
  * inets: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * snmp: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * ftp: Replace size/1 with either tuple_size/1 or byte_size/1 The
    size/1 BIF is not optimized by the JIT, and its use can result
    in worse types for Dialyzer. When one knows that the value
    being tested must be a tuple, tuple_size/1 should always be
    preferred. When one knows that the value being tested must be a
    binary, byte_size/1 should be preferred. However, byte_size/1
    also accepts a bitstring (rounding up size to a whole number of
    bytes), so one must make sure that the call to byte_size/ is
    preceded by a call to is_binary/1 to ensure that bitstrings are
    rejected. Note that the compiler removes redundant calls to
    is_binary/1, so if one is not sure whether previous code had
    made sure that the argument is a binary, it does not harm to
    add an is_binary/1 test immediately before the call to
    byte_size/1.
  * dialyzer: Fixed a bug that would cause analysis to crash.
  * dialyzer: Replace size/1 with either tuple_size/1 or
    byte_size/1 The size/1 BIF is not optimized by the JIT, and its
    use can result in worse types for Dialyzer. When one knows that
    the value being tested must be a tuple, tuple_size/1 should
    always be preferred. When one knows that the value being tested
    must be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * tftp: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
- Changes for 25.2.3:
  * erts: Comparisons between small numbers and pids or ports would
    in some edge cases say that the number was greater than the pid
    or port, violating the term order.
  * erts: process_info(Pid, status) when Pid /= self() could return
    an erroneous result.
  * ssl: Maximize compatibility by ignoring change_cipher_spec
    during handshake even if middle_box_mode is not negotiated
    (mandated by client)
  * ssl: Move assert of middlebox message after an
    hello_retry_request to maximize interoperability. Does not
    changes semantics of the protocol only allows unexpected
    message delay from server.
  * ssh: With this change, ssh application does not crash when
    formatting some of info reports for unsuccessful connections.
  * ssh: With this change, ssh does not log extensively long
    messages.
  * inets: Ensure graceful shutdown
  * inets: Return type of the type specification for function
    httpc:cookie_header/{1,2,3} has been fixed from -spec
    cookie_header(url()) -&gt; [{ field(), value() }] | {error,
    Reason} to -spec cookie_header(url()) -&gt; { field(), value() } |
    {error, Reason}
- Changes for 25.2.2:
  * ftp: Fixes calls to ftp:nlist/2 returning {error, epath} when
    the file / folder exists
- Changes for 25.2.1:
  * compiler: Fixed a bug that could cause legal code to fail
    validation.
  * compiler: Eliminated a rare crash in the beam_types module.
  * erts: Fixed a bug in selective receive optimization that could
    crash 32-bit emulators.
  * erts: A race condition which was very rarely triggered could
    cause the signal queue of a process to become inconsistent
    causing the runtime system to crash.
  * kernel: The tcp connect option 'bind_to_device' could not be
    used with inet_backend = 'socket'. 'inet' requires value type
    binarry() and 'socket' requires value type 'string()'.
  * kernel: Minor issue processing options when calling
    gen_tcp:connect with a sockaddr() and inet_backend = socket.
  * common_test: Change timeout to infinity for gen_server calls in
    cth_log_redirect
  * inets: fixes a missing case of the type specification for
    httpd:info/2/3/4
  * snmp: Single threaded agent crash when vacm table not properly
    initiated.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1683460800">- Changes for 25.3.2:
  * compiler: Fixed type handling bugs that could cause an internal
    error in the compiler for correct code.
  * os_mon: Avoid error report from failing erlang:port_close at
    shutdown of cpu_sup and memsup. Bug exists since OTP 25.3
    (os_mon-2.8.1).
  * erts: If a runtime system which was starting the distribution
    already had existing pids, ports, or references referring to a
    node with the same nodename/creation pair that the runtime
    system was about to use, these already existing pids, ports, or
    references would not work as expected in various situations
    after the node had gone alive. This could only occur if the
    runtime system was communicated such pids, ports, or references
    prior to the distribution was started. That is, it was
    extremely unlikely to happen unless the distribution was
    started dynamically and was even then very unlikely to happen.
    The runtime system now checks for already existing pids, ports,
    and references with the same nodename/creation pair that it is
    about to use. If such are found another creation will be chosen
    in order to avoid these issues.
- Changes for 25.3.1:
  * snmp: Attempts to minimize the number of the error reports
    during a failed agent init.
  * compiler: When a map update such as #{}#{key:=value} that
    should fail with an exception was unused, the exception would
    be lost.
  * compiler: Fixed bug in the validator that made it reject valid
    code.
  * crypto: With this change, random errors are fixed for
    crypto:generate_key calls with OpenSSL 3.
  * erts: Fixed a bug in the loader that prevented certain modules
    compiled with no_ssa_opt from being loaded.
  * erts: Implementations of the call() driver callback that
    returned a faulty encoded result could cause a memory leak and
    could cause invalid data on the heap of the processes calling
    erlang:port_call/3.
  * erts: Fixed a memory corruption issue when upgrading code. The
    bug was introduced in OTP 25.3
  * erts: Fixed configure tests for a few ARM-specific
    instructions, which prevented the emulator from being built on
    some platforms.
  * erts: Aliases created in combination with a monitor using the
    {alias, explicit_unalias} option stopped working from remote
    nodes when a 'DOWN' signal had been received due to the monitor
    or if the monitor was removed using the erlang:demonitor() BIF.
    This bug was introduced in OTP 24.3.4.10 and OTP 25.3.
  * erts: In rare circumstances, bit syntax matching of an invalid
    code point for a utf32 would crash the runtime system.
  * erts: Building the runtime system failed when native atomic
    support was missing. Note that execution on such systems have
    only been rudimentary tested.
  * erl_interface: Fixed configure tests for a few ARM-specific
    instructions, which prevented the emulator from being built on
    some platforms.
  * eldap: Added a new function eldap:info/1 that returns the
    socket and the transport protocol for the eldap connection.
  * inets: Correct timing related pipelining/keepalive queue bug,
    that could result in unexpected "socket_remotly_closed" errors.
  * inets: With this change, upon remote socket closure current
    request is added to a retried queue (either pipeline or
    keep_alive, but not both).
  * ssl: With this change, ssl:connection_information/2 returns
    correct keylog data after TLS1.3 key update.
  * ssl: Client signature algorithm list input order is now honored
    again , it was accidently reversed by a previous fix.
  * stdlib: The type specs in the erl_parse module has been updated
    to include the maybe construct and the ! operator.
  * wx: Improve debug prints from the nifs. Some minor fixes for
    wxWidgets-3.2. Fixed OpenGL debug functions.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1687521600">- Changes for 25.3.2.2:
  * compiler: The compiler could be very slow when compiling guards
    with multiple guard tests separated with 'or' or ';'.
- Changes for 25.3.2.1:
  * xmerl: New options to xmerl_scan and xmerl_sax_parser so one
    can limit the behaviour of the parsers to avoid some XML
    security issues. xmerl_scan gets one new option:
    xmerl_sax_parser gets the following options: The old option
    skip_external_dtd is still valid and the same as
    {external_entities, none} and {fail_undeclared_ref, false} but
    just affects DTD's and not other external references.
  * erts: Fixed a crash during tracing on certain platforms that
    cannot use the machine stack for Erlang code (mainly OpenBSD
    and Linux with musl).
  * erts: Constructing a binary segment not aligned with a byte
    boundary, with a size not fitting in 31 bits, and with a value
    not fitting in a 64-bit word could crash the runtime system.
  * erts: Further robustify implementation of large maps (&gt; 32
    keys). Keys that happen to have same internal 32-bit hash
    values are now put in collision nodes which are traversed with
    linear search. This removes the demand for the internal hash
    function when salted to eventually produce different hashes for
    all possible pairs of unequal terms.
  * stdlib: Static supervisors are very idle processes after they
    have started so they will now be hibernated after start to
    improve resource management.
  * compiler: Fixed a bug where a failing bsl expression in a guard
    threw an exception instead of causing the guard to fail.
  * compiler: Complex guard expression using the or operator and
    guard BIFs that can fail could sometimes be miscompiled so that
    the guard would succeed even if a call to a guard BIF failed.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1687608000">- Version 26.0:
  * Leex has been extended with optional column number support.
  * The family of enumeration functions in module lists has been
    extended with enumerate/3 that allows a step value to be
    supplied.
  * Update Unicode to version 15.0.0.
  * proc_lib:start*/* has become synchronous when the started
    process fails. This requires that a failing process use a new
    function proc_lib:init_fail/2,3, or exits, to indicate failure. All
    OTP behaviours have been fixed to do this.
  * auto-complete of variables, record names, record fields names,
    map keys, function parameter types and filenames.
  * Open external editor in the shell to edit the current
    expression.
  * defining records (with types), functions, specs and types in
    the shell.
  * Creation and matching of binaries with segments of fixed sizes
    have been optimized.
  * Creation and matching of UTF-8 segments have been optimized.
  * Appending to binaries has been optimized.
  * The compiler and JIT now generate better code for creation of
    small maps where all keys are literals known at compile time.
  * Thanks to the optimizations above the performance of the base64
    module has been significantly improved. For example, on an
    x86_64 system with the JIT both encode and decode are almost
    three times faster than in Erlang/OTP 25.
  * Map comprehensions as suggested in EEP 58 has now been
    implemented.
  * Some map operations have been optimized by changing the
    internal sort order of atom keys. This changes the
    (undocumented) order of how atom keys in small maps are printed
    and returned by maps:to_list/1 and maps:next/1. The new order
    is unpredictable and may change between different invocations
    of the Erlang VM.
  * Introducing the new function maps:iterator/2 for creating an
    interator that return the map elements in a deterministic
    order. There are also new modifiers k and K for the format
    string in io:format() to support printing map elements ordered.
  * Added the new built-in type dynamic() introduced in EEP 61, PR
    introducing EEP 61 improving support for gradual type checkers.
  * Dialyzer has a new incremental mode that be invoked by giving
    the --incremental option when running Dialyzer. This new
    incremental mode is likely to become the default in a future
    release.
  * Multi time warp mode is now enabled by default. This assumes
    that all code executing on the system is time warp safe.
  * Support for UTF-8 atoms and strings in the NIF interface
    including new functions enif_make_new_atom,
    enif_make_new_atom_len and enif_get_string_length.
  * The BIFs min/2 and max/2 are now allowed to be used in guards
    and match specs.
  * Improved the selective receive optimization, which can now be
    enabled for references returned from other functions. This
    greatly improves the performance of gen_server:send_request/3,
    gen_server:wait_response/2, and similar functions.
  * It is no longer necessary to enable a feature in the runtime
    system in order to load modules that are using it. It is
    sufficient to enable the feature in the compiler when compiling
    it.
  * inet:setopts/2 has got 3 new options: reuseport, reuseport_lb
    and exclusiveaddruse.
  * Fix so that -fno-omit-frame-pointer is applied to all of the
    Erlang VM when using the JIT so that tools, such as perf, can
    crawl the process stacks.
  * In the lists module, the zip family of functions now takes
    options to allow handling lists of different lengths.
  * Added the zip:zip_get_crc32/2 function to retrieve the CRC32
    checksum from an opened ZIP archive. gen_server optimized by
    caching callback functions
  * The modules Erlang DNS resolver inet_res and helper modules
    have been updated for RFC6891; to handle OPT RR with DNSSEC OK
    (DO) bit.
  * Introduced application:get_supervisor/1.
  * Cache OTP boot code paths, to limit how many folders that are
    being accessed during a module lookup. Can be disabled with
  - cache_boot_path false.
  * Support for Kernel TLS (kTLS), has been added to the SSL
    application, for TLS distribution (-proto_dist inet_tls), the
    SSL option {ktls, true}.
  * Improved error checking and handling of ssl options.
  * Mitigate memory usage from large certificate chains by lowering
    the maximum handshake size. This should not effect the common
    cases, if needed it can be configured to a higher value.
  * For security reasons the SHA1 and DSA algorithms are no longer
    among the default values.
  * Add encoding and decoding of use_srtp hello extension to
    facilitate for DTLS users to implement SRTP functionality.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1687608001">- Changes for 26.0.1:
  * erts: Build of the socket nif failed on Solaris 11.
  * erts: Fixed two reduction-counting bugs relating to binaries.
  * erts: Constructing a binary segment not aligned with a byte
    boundary, with a size not fitting in 31 bits, and with a value
    not fitting in a 64-bit word could crash the runtime system.
  * erts: When a binary construction failed because of bad size for
    a segment, the error information was not always correct.
  * erts: Fixed a crash when calling a fun that was defined in a
    module that had been upgraded.
  * kernel: The POSIX error exdev was sometimes incorrectly
    described as "cross domain link" in some error messages.
  * kernel: Corrected the socket send function description (send
    with Timeout = nowait). The send function(s) could not return
    {ok, {RestData, SelectInfo}}
  * stdlib: The POSIX error exdev was sometimes incorrectly
    described as "cross domain link" in some error messages.
  * ssl: Make sure that selection of client certificates handle
    both TLS-1.3 and TLS-1.2 names correctly. Could cause valid
    client certificate to not be selected, and an empty client
    certificate message to be sent to server.
  * ssl: Improved ssl:format_error/1 to handle more error tuples.
  * ssl: Fixed hanging ssl:connect when ssl application is not
    started.
  * ssl: Correct handling of retransmission timers, current
    behavior could cause unwanted delays.
  * inets: Do not make the default ssl options by calling
    httpc:ssl_verify_host_options(true) if ssl options are supplied
    by the user.
  * xmerl: New options to xmerl_scan and xmerl_sax_parser so one
    can limit the behaviour of the parsers to avoid some XML
    security issues. xmerl_scan gets one new option:
    xmerl_sax_parser gets the following options: The old option
    skip_external_dtd is still valid and the same as
    {external_entities, none} and {fail_undeclared_ref, false} but
    just affects DTD's and not other external references.
  * compiler: Fixed a bug where a failing bsl expression in a guard
    threw an exception instead of causing the guard to fail.
  * compiler: Fixed a bug that would case the validator to reject
    legal code.
  * compiler: The compiler could re-order clauses matching binaries
    so that the incorrect clause would match. That could only
    happen for code that used the option {error_location,line} or
    for code without line or column number information (e.g.
    generated by a parse transform).
  * compiler: Complex guard expression using the or operator and
    guard BIFs that can fail could sometimes be miscompiled so that
    the guard would succeed even if a call to a guard BIF failed.
  * compiler: With optimizations disabled, a try/catch construct
    could return an incorrect value.
  * compiler: In rare circumstance, a combination of binary
    construction and binary_part/3 would cause the compiler to
    generate unsafe code that would crash the runtime system.
  * compiler: The compiler could be very slow when compiling guards
    with multiple guard tests separated with 'or' or ';'.
  * compiler: Complex guard expressions using 'or' and map updates
    could succeed even if the map update failed.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1698235200">- Changes for 26.1.2:
  * erts: If the external term format encoding of an argument list
    part of a distributed spawn operation was faulty, the newly
    spawned remote process could misbehave. The misbehavior
    included hanging or interpret an incoming message as an
    argument list to use. This was very unlikely to happen unless
    using an alternate implementation of the distribution protocol
    which made a faulty encoding of the argument list. The child
    process will now detect this error and terminate before
    executing the user specified code.
  * erts: Fix bugs where if the body of a matchspec would return a
    map with a variable ('$1', '$_' etc) as one of the keys or
    values and the variable was not an immidiate, the term would
    not be copied to the receiving processes heap. This would later
    corrupt the term in the table as the GC could place move
    markers in it, which in turn would cause the VM to crash. Bug
    has been present for since OTP 17.0.
  * xmerl: The xmerl version 1.3.32 was released in OTP 26.0.1, but
    the incorrect version number of 1.3.31.1 was used for it. This
    incorrect version number continued to appear in OTP 26.0.2, OTP
    26.1, and OTP 26.1.1. The actual xmerl code in these OTP
    versions however corresponds to xmerl version 1.3.32.
- Changes for 26.1.1:
  * wx: The wx application would fail to build on macOS with Xcode
    15.
  * compiler: The compiler could become extremely slow for modules
    containing huge functions.
  * stdlib: Garbage collect the shell process when reducing the
    amount of saved history and results.
- Changes for 26.1:
  * crypto: Fix VM crash caused by crypto being purged and reloaded
    (by init:restart for example) on OS with musl libc (such as
    Alpine linux).
  * crypto: Improved understanding of LibreSSL versions. Support
    chacha20 and chacha20_poly1305 for LibreSSL 3.7. Reflect
    removal of support for the DSS/DSA algorithm which was done in
    LibreSSL 2.6.1.
  * crypto: FIPS supported by crypto for OpenSSL 3.0.* and 3.1.*.
  * asn1: The ASN.1 compiler would ignore a constraint such as
    (SIZE (1..4), ...), causing incorrect behavior of the encoding
    and decoding function for the PER and UPER backends. Corrected
    to handle the constraint in the same way as (SIZE (1..4, ...)).
  * asn1: The JER backend has been internally refactored in a way
    that is compatible for applications that use the documented
    API. However, for a group of ASN.1 modules that depend on each
    other (for example, S1AP-PDU-Descriptions, S1AP-Contents, and
    so on), all modules in the group must be recompiled if on of
    the group members is recompiled.
  * observer: Closing the trace log window via the menu did not
    work.
  * erts: maps:put with existing key and identical value was not
    optimized as a no-op correctly if having the same 32-bit hash
    as another key in the map. In practice very rare and harmless.
  * erts: Fixed an issue with truncated crash slogans on failed
    emulator start.
  * erts: Fixed a bug where the emulator was unable to determine
    the current cgroup CPU quota.
  * erts: A process optimized for parallel signal delivery could
    under some circumstances lose wakeup information. That is, the
    processes was not woken up to take care of the signal, so the
    signal would not be taken care of until the process was woken
    by another signal. Only processes configured with
    message_queue_data set to off_heap utilize this optimization.
  * erts: Function socket:close/1 could cause a VM crash on
    Windows.
  * erts: Fixed a bug in the ARM JIT where it could accidentally
    add garbage trailing bits when creating bitstrings whose size
    wasn't an even multiple of 8 bits.
  * erts: Fix erlang:system_info/1 documentation to show correct
    types.
  * erts: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * erts: Fix compilation with GNU termcap.
  * erts: Delivery time of message signals to a process not
    executing any receive expressions could become very long,
    potentially infinite. For example, a process checking for
    messages using process_info(self(), message_queue_len) or
    process_info(self(), messages) and avoiding to execute a
    receive expression matching on messages could be very slow in
    detecting new messages. Note that you are still discouraged
    from using process_info() this way. A process that wants to
    check if there are messages available to handle should execute
    a receive expression matching on messages.
  * erts: On AArch64 (ARM64), when calculating both the quotient
    and remainder with a divisor begin a power two, the remainder
    could be incorrectly calculated.
  * erts: Fix bug causing "magic" references in a compressed ETS
    table to not keep the referred object alive. The symptom would
    be the referred object being garbage collected prematurely and
    the reference appearing stale, not referring to anything.
    Examples of such magically referred objects are atomics and NIF
    resources.
  * erts: Matching out short bitstrings with a fixed size not
    divisible by 8 could could lead to the runtime system
    terminating with an "Overrun heap and stack" error.
  * erts: A constant flow of incoming non-message signals could
    prevent a process needing to execute dirty from doing so.
  * erts: A BEAM file usually contains a chunk with the tag "Type"
    containing type information that can be used by the JIT. The
    beam_lib:strip/1 takes care to preserve that chunk, but a
    build/release tool that does customized stripping could
    accidentally remove the chunk. Loading a BEAM file without the
    "Type" chunk could cause incorrect behavior of the loaded code.
  * erts: gen_udp:recv/* for Unix Domain Socket in binary mode and
    passive mode has been fixed to not crash.
  * erts: The cleanup operation of not yet delivered signals to a
    terminated process yielded excessively.
  * erts: Fixed minor hashing issue with the local option of
    term_to_binary()/term_to_iovec().
  * erts: Update gen_tcp_socket and gen_udp_socket to handle
    'completion' (socket on Windows).
  * erts: Add support for Unix Domain Sockets (only for STREAM
    sockets) on Windows for 'socket'.
  * erts: In Erlang/OTP 27, by default escripts will be compiled
    before being executed. That means that the compiler application
    must be installed. It is possible to force the escript to be
    interpreted by adding the directive -mode(interpret). to the
    escript file. In Erlang/OTP 28, support for interpreting an
    escript will be removed.
  * erts: Add basic support for socket ioctl on Windows.
  * erts: Removed erts/etc/darwin/Info.plist, as it is no longer
    necessary after macos 10.12
  * erts: Add support for (Windows) socket option exclusiveaddruse.
  * erts: [socket] Add support for the 'nopush' option.
  * erts: Add support for socket option 'BSP STATE'.
  * erts: Add tcp socket options 'keepcnt', 'keepidle' and
    'keepintvl'.
  * erts: Add support for misc (Windows) socket options
    ('max_msg_size' and 'maxdg').
  * compiler: The compiler could run forever when compiling a call
    to is_record/3 with a huge positive tuple size. The call
    is_record(A, a, 0) would crash the compiler when used in a
    function body. When used in a guard the compiler would emit
    incorrect code that would accept {a&gt; as a record.
  * compiler: Fixed a bug that caused dialyzer to crash when
    analyzing bogus code that contained the literal atom undefined
    in segment sizes.
  * compiler: The compiler would crash when compiling some modules
    that contained a call to erlang:load_nif/2.
  * compiler: Fixed a bug that caused the compiler to crash on
    legal code.
  * compiler: The compiler could crash when attempting to compile a
    call to is_list/1 in a complex expression.
  * compiler: A complex guard expression using the or operator
    could succeed when it was supposed to fail.
  * compiler: Compiling nested try/catch and catch expression could
    result in an internal compiler error.
  * compiler: Using the bnot operator in a complex expression could
    cause the compiler to terminate with an internal consistency
    failure diagnostic.
  * compiler: Fixed a bug that caused the compiler to crash in a
    binary optimization pass.
  * compiler: The compiler could terminate with an internal error
    when attempting to compile a binary pattern that could not
    possibly match.
  * compiler: Fixed various performance issues related to the alias
    optimization pass.
  * erl_docgen: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * mnesia: Do not delete old backup file if the new backup fails.
  * megaco: Make megaco transports handle gen_tcp | gen_udp with
    socket backend on Windows (completion).
  * common_test: With this change, ct_hooks manual refers to CTH
    execution order section in user guide.
  * common_test: With this change, Config data from
    pre_end_per_testcase hook is delivered to post_end_per_testcase
    callback in case of testcase timetrap or linked process crash.
  * common_test: With this change, remaining references to not
    supported vts tool in ct_run are removed (mainly relates to
    docs and ct_run help message).
  * common_test: With this change, prompt search functionality in
    ct_telnet handles unicode input.
  * common_test: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * stdlib: The compiler could run forever when compiling a call to
    is_record/3 with a huge positive tuple size. The call
    is_record(A, a, 0) would crash the compiler when used in a
    function body. When used in a guard the compiler would emit
    incorrect code that would accept {a&gt; as a record.
  * stdlib: Fix bug in ets:tab2file that could make it fail if
    another Erlang process created the same file at the same time.
  * stdlib: An {else_clause,Value} exception will now be reported
    nicely in the shell.
  * stdlib: Correct return value for error case, so that it matches
    the documented and intended return value {error,
    {already_started, pid()} when local registered names are used.
  * stdlib: sys:get_state/1,2 and sys:replace_state/2,3 has been
    corrected to handle a state named error as a state name, not as
    a failed system callback. For the standard server behaviours
    this was an issue only for gen_statem (and gen_fsm) when the
    state name was error, and for gen_server if the complete state
    was {error,_}.
  * stdlib: Multiple problems were fixed in
    filelib:safe_relative_path/2. If its second argument was a path
    that contained symbolic links, an incorrect result patch could
    be returned. Also, paths were sometimes falsely considered
    unsafe.
  * stdlib: Fix deadlock when erl.exe is used as part of a pipe on
    Windows and trying to set the encoding of the standard_io
    device.
  * stdlib: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * stdlib: Fix h/2,3 to properly render multi-clause
    documentation.
  * stdlib: Timers created by timer:apply_after/4,
    apply_interval/4, and apply_repeatedly/4 would silently fail to
    do the apply if it was not possible to spawn a process when the
    timer expired. This has now been corrected, and if the spawn
    fails, the system will be taken down producing a crash dump.
  * stdlib: When an Erlang source file lacked a module definition,
    there would be a spurious "module name must not be empty"
    diagnostic for each spec in the file.
  * stdlib: The argument descriptions for option types in argparse
    have been made less ambiguous.
  * stdlib: Clarified the documentation of normal shutdown reason
    on gen_server:call/2,3
  * stdlib: Pattern matching and equivalence (=:=, =/=) comparisons
    on 0.0 will now raise a warning, as it will no longer be
    considered equivalent to -0.0 in OTP 27. If a match on 0.0
    specifically is desired (distinct from -0.0), the warning can
    be suppressed by writing +0.0 instead. The arithmetic
    comparison operators are unaffected, including arithmetic
    equality (==). *** POTENTIAL INCOMPATIBILITY ***
  * stdlib: The semantics of the gen_{server,statem,event}
    behaviour's synchronous start behaviour introduced in OTP-26.0
    with OTP-18471, has been clarified in the documentation.
  * stdlib: Added functionality to set a custom multiline prompt.
  * stdlib: A warning for (accidental use of) Triple-Quoted Strings
    has been implemented as per EEP 64. *** POTENTIAL
    INCOMPATIBILITY ***
  * stdlib: The keyboard shortcuts for the shell are now
    configurable.
  * kernel: Fixed an issue with truncated crash slogans on failed
    emulator start.
  * kernel: Fix shell:start_interactive function specification.
  * kernel: Fix code:get_doc/1 to return missing, when it can't
    find erts instead of crashing.
  * kernel: Function socket:close/1 could cause a VM crash on
    Windows.
  * kernel: Fix deadlock when erl.exe is used as part of a pipe on
    Windows and trying to set the encoding of the standard_io
    device.
  * kernel: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * kernel: Fix logger's overload protection mechanism to only
    fetch memory used by messages when needed.
  * kernel: Fixed a number of socket-related issues causing
    incompatibilities with gen_tcp and gen_udp respectively.
  * kernel: gen_tcp:connect with socket address and socket (inet-)
    backend fails because of missing callback function.
  * kernel: The DNS RR cache used by `inet_res` has been fixed to
    preserve insert order, which is beneficial when the DNS server
    returns RRs in some specific order for e.g load balancing
    purposes.
  * kernel: The options `reuseport`, `reuseport_lb` and
    `exclusiveaddruse` were accidentally not allowed for e.g
    `gen_udp:open/1,2`, which has now been corrected.
  * kernel: gen_udp:recv/* for Unix Domain Socket in binary mode
    and passive mode has been fixed to not crash.
  * kernel: Fixed issue where cursor would not be placed at the end
    of the expression when navigating shell history.
  * kernel: Update gen_tcp_socket and gen_udp_socket to handle
    'completion' (socket on Windows).
  * kernel: Add support for Unix Domain Sockets (only for STREAM
    sockets) on Windows for 'socket'.
  * kernel: Add basic support for socket ioctl on Windows.
  * kernel: The file:location/0 type is now exported.
  * kernel: Add support for (Windows) socket option
    exclusiveaddruse.
  * kernel: [socket] Add support for the 'nopush' option.
  * kernel: Add support for socket option 'BSP STATE'.
  * kernel: Add tcp socket options 'keepcnt', 'keepidle' and
    'keepintvl'.
  * kernel: Add support for misc (Windows) socket options
    ('max_msg_size' and 'maxdg').
  * kernel: The keyboard shortcuts for the shell are now
    configurable.
  * kernel: Optimized code_server to reduce repeated work when
    loading the same module concurrently.
  * debugger: The call int:no_break(Module) did not remove any
    breakpoints.
  * debugger: The maybe expression is now supported in the
    Debugger.
  * debugger: The maybe expression is now supported in the
    Debugger.
  * debugger: The call int:no_break(Module) did not remove any
    breakpoints.
  * ssl: Avoid function clause error in ssl:getopts/2 by handling
    that inet:getopts may return an empty list during some
    circumstances, such as the socket being in a closing state.
  * ssl: The API function `ssl:recv/3` has been tightened to
    disallow negative length, which has never been documented to
    work, but was passed through and caused strange errors.
  * ssl: When a client initiated renegotiation was rejected and the
    client socket was in active mode the expected error message to
    the controlling process was not sent.
  * ssl: Add some guidance for signature algorithms configuration
    in ssl applications users guide.
  * snmp: Make snmp handle gen_udp with socket backend on Windows
    (completion).
  * public_key: Country name comparison shall be case insensitive
  * public_key: Add check to disallow duplicate certs in a path
  * inets: With this change, re_write httpd works as expected and
    does not return error.
  * inets: Fixed a bug so httpd does not crash when stopped at the
    wrong time during TLS connection negotiation, or any other
    theoretically as slow connection setup.
  * inets: Enhance error handling and avoid that the HTTP client
    hangs on headers provided on the wrong format.
  * inets: With this change, error report generated by httpd during
    connection setup contains socket type information.
  * inets: Stop and restart of the httpd server in the Inets
    application has been refactored to a more synchronous and OTP
    supervisor friendly approach. This should increase stability
    and for example avoid a supervisor report from
    httpd_connection_sup about killed child process(es) in some
    cases when stopping or restarting httpd.
  * dialyzer: Fixed a bug that caused dialyzer to crash when
    analyzing bogus code that contained the literal atom undefined
    in segment sizes.
  * dialyzer: Dialyzer could crash when attempting to analyze a
    module that defined a type called product/.
- Changes for 26.0.2:
  * erts: Fix using the IME (Input Method Editor) to enter text in
    cmd.exe and powershell.exe on Windows.
  * erts: Multiple socket:accept calls issue. When making multiple
    accept calls, only the last call is active.
  * erts: Fix the shell to ignore terminal delay when the terminal
    capabilities report that they should be used.
  * erts: Fix "oldshell" to echo characters while typing on
    Windows.
  * erts: On Windows, a call to the function socket:close, when
    there are waiting active calls to read, write or accept
    functions, could hang.
  * erts: Fix issues when reading or configuring standard_io on
    Windows when erl.exe is started using -noshell flag.
  * erts: The following functions are now much faster when given a
    long list or binary:
  * erts: On AArch64 (ARM64), equality and non-equality tests with
    literal bitstrings could succeed when they should fail and vice
    versa.
  * compiler: Fixed a type handling bug that would cause an
    internal consistence failure for correct code.
  * compiler: Fixed a bug that could cause the stack trace of throw
    exceptions to be erroneously optimized out.
  * compiler: Complex guard expression using 'or' were not always
    fully evaluated, making guards that were supposed to fail
    succeed.
  * stdlib: Fix bug where when you entered Alt+Enter in the
    terminal, the cursor would move to the last line, instead of
    moving to the next line.
  * stdlib: Fix eof handling when reading from stdin when erlang is
    started using -noshell.
  * stdlib: Fixed problem where output would disappear if it was
    received after a prompt was written in the shell.
  * stdlib: The following functions are now much faster when given
    a long list or binary:
  * kernel: Fix bug where when you entered Alt+Enter in the
    terminal, the cursor would move to the last line, instead of
    moving to the next line.
  * kernel: Fix so that the shell does not crash on startup when
    termcap is not available.
  * kernel: Multiple socket:accept calls issue. When making
    multiple accept calls, only the last call is active.
  * kernel: Fix the shell to ignore terminal delay when the
    terminal capabilities report that they should be used.
  * kernel: Fix "oldshell" to echo characters while typing on
    Windows.
  * kernel: Fix eof handling when reading from stdin when erlang is
    started using -noshell.
  * kernel: On Windows, a call to the function socket:close, when
    there are waiting active calls to read, write or accept
    functions, could hang.
  * kernel: Fix issues when reading or configuring standard_io on
    Windows when erl.exe is started using -noshell flag.
  * kernel: gen_udp:connect with inet_backend = socket fails when
    the Address is a hostname (string or atom).
  * kernel: Fixed problem which would cause shell to crash if
    particular escape sequence was written to stdout.
  * kernel: Fixed problem where output would disappear if it was
    received after a prompt was written in the shell.
  * kernel: Fix a crash where the location of erts could not be
    found in rebar3 dev builds.
  * kernel: Introduce the KERNEL application parameter
    standard_io_encoding that can be used to set the default
    encoding for standard_io. This option needs to be set to latin1
    if the application wants to treat all input data as bytes
    rather than utf-8 encoded characters.
  * ssl: Added keylog information to all protocol versions in
    ssl:connection_information/2.
  * ssl: Add RFC-6083 considerations for DTLS to enable gen_sctp
    based callback for the transport.
  * ssh: Added multiline editing support to ssh clients connected
    through OTP ssh daemon.</changelog>
  <changelog author="sflees@suse.de" date="1704974400">- Changes for 26.2.1:
  * erts: Removed unnecessary PCRE source tar-ball.
  * ssh: With this change (being response to CVE-2023-48795),
    ssh can negotiate "strict KEX" OpenSSH extension with
    peers supporting it; also
    'chacha20-poly1305@openssh.com' algorithm becomes a
    less preferred cipher.
    If strict KEX availability cannot be ensured on both
    connection sides, affected encryption modes(CHACHA and
    CBC) can be disabled with standard ssh configuration.
    This will provide protection against vulnerability, but
    at a cost of affecting interoperability. See
    Configuring algorithms in SSH. (bsc#1218192, CVE-2023-48795)
- Changes for 26.2:
  * all: Replaced unintentional Erlang Public License 1.1
    headers in some files with the intended Apache License
    2.0 header.
  * otp: The removal of the deprecated slave module, originally
    planned for OTP 27, has been postponed to OTP 29.
  * asn1: Fix benign warning from gcc 11 about mismatching call
    to free().
  * crypto: Enable engine support for OpenSSL versions 3.
  * edoc: Emit &lt;code&gt; instead of &lt;tt&gt;.
- Disable test suite for now, it has many false positives and
  takes a very long time.</changelog>
  <changelog author="sflees@suse.de" date="1706011200">- This codestream wasn't affected by bsc#1207113</changelog>
  <changelog author="sflees@suse.de" date="1706011201">- Disable rpmlint tests on SLE-15 where they currently fail</changelog>
  <changelog author="sflees@suse.de" date="1715947200">- Create a versioned package for SLES</changelog>
</package>
<package pkgid="1b16add0edcadec67b35516f631beb29cc95982b9c3082573631b868fd9feeb5" name="erlang26-debugger" arch="aarch64">
  <version epoch="0" ver="26.2.1" rel="150300.7.5.1"/>
  <changelog author="matwey.kornilov@gmail.com" date="1646568000">- Changes for 24.2.2:
  * inets: Avoid intermediate ungraceful shutdown of the HTTP
    server.
  * ssh: The ssh sever parallel_login option was missing in OTP-24</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1648382400">- Changes for 24.3.2:
  * erl_interface: Fix compile error regarding gethostbyaddr_r on
    Android. Error introduced in OTP 24.3.
  * kernel: Fix failed accepted connection setup after previous
    established connection from same node closed down silently.
  * kernel: Fixed a problem where typing Ctrl-R in the shell could
    hang if there were some problem with the history log file.
- Changes for 24.3.1:
  * dialyzer: There could be spurious warnings for unknown types
    when a type was a subtype of an existing type that was a
    subtype of an unknown type.
  * ssl: Client certification could fail for TLS-1.3 servers that
    did not include the certificat_authorties extension in its
    certificate request message.
- Changes for 24.3:
  * megaco: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.
  * megaco: Update the performance and debug chapters of the megaco
    user's guide. Also some updates to the meas tools.
  * compiler: The expression &lt;&lt;0/native-float&gt;&gt;=Bin would always
    fail to match, while &lt;&lt;0/float-native&gt;&gt;=Bin would match
    (provided that Bin contained the binary representation of 0.0)
  * compiler: The compiler will now compile huge functions with
    straight-line code faster.
  * erl_interface: Add --enable-ei-dynamic-lib configure option
    that will make erl_interface also release a dynamic library
    version of libei.
  * erl_interface: The ei API for decoding/encoding terms is not
    fully 64-bit compatible since terms that have a representation
    on the external term format larger than 2 GB cannot be handled.
  * sasl: Fix bug in systools:make_script/1 documentation.
  * inets: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.
  * inets: Documentation fix for inets:services_info/0, which now
    describes that Info might be a Reason term() in case when
    {error, Reason} is returned as service info.
  * crypto: The crypto app in OTP can since OTP-24.2 be compiled,
    linked and used with the new OpenSSL 3.0 cryptolib. The crypto
    app has 3.0 support has been improved, but is still *not
    recommended* for other usages than experiments and alpha
    testing. There are not yet any guaranties that it works, not
    even together with other OTP applications like for example SSL
    and SSH, although there are no known errors. Since the previous
    release, OTP-24.2, the following improvements have been done: -
    It has been tested during nearly every nightly test on the OTP
    lab - The hash algorithms md4 and ripemd160 have been enabled
    with OpenSSL 3.0. - The ciphers blowfish_cbc, blowfish_ecb,
    des_cbc, des_cfb, des_ecb, rc2_cbc and rc4 have been enabled
    with OpenSSL 3.0. Disabled or unsupported with OpenSSL 3.0 are
    still: - ENGINE support - FIPS mode - Other providers than the
    built-in ones - Compiling and linking with OpenSSL 3.0
    cryptolib in compatibility modes (for example to behave as
    1.1.1) and, the ciphers blowfish_cfb64 and blowfish_ofb64 are
    not supported and will not be either. Deprecated functions in
    the OpenSSL 3.0 cryptolib must not be disabled as OTP/crypto
    still uses some of the deprecated API functions. The gcc flag
  - Wno-deprecated-declarations is set to prevent deprecation
    warnings to be printed when compiling.
  * crypto: Crypto is adapted to LibreSSL 3.5.0 on OpenBSD.
  * crypto: New configure option ( --disable-otp-test-engine) to
    prohibit the build of the OTP test engine used in some test
    suites. The reason is that the test engine could be hard to
    compile on for instance LibreSSL 3.5.0. For that particular
    cryptolib version (or higher), this configure option is set
    automatically.
  * jinterface: Fix bug in OtpOutputStream.write_pid/4 and
    write_ref/3 causing faulty encodig. Bug exists since OTP 23.0.
  * wx: Removed the static_data option from wxImage creation
    functions, as it was broken and could lead to crashes. Now
    image data is always copied to wxWidgets as was the default
    behavior. Removed some non working wxGridEvent event types,
    which have there own events in newer wxWidgets versions, and
    added a couple of event types that where missing in wx.
  * asn1: Add support for the maps option in combination with the
    jer backend.
  * snmp: The compilation time is no longer recorded in BEAM files.
    There remained several undocumented functions that attempted to
    retrieve compilation times. Those have now been removed.
  * snmp: [agent] Remove expectation of socket being a port.
  * common_test: OTP internal test fix.
  * runtime_tools: Fixed bug in scheduler:utilization(Seconds) that
    would leave the scheduler_wall_time system flag incorrectly
    enabled.
  * runtime_tools: Add scheduler:get_sample/0 and get_sample_all/0.
    Also clarify scheduler module documentation about how it
    depends on system flag scheduler_wall_time.
  * erts: Fixed a bug in the x86 JIT that might cause floating
    point instructions to wrongly throw an exception.
  * erts: Preserve correct nodedown_reason if supervised
    distribution controller processes exit with {shutdown, Reason}.
  * erts: Handling of send_timeout for gen_tcp has been corrected
    so that the timeout is honored also when sending 0 bytes.
  * erts: By default global does not take any actions to restore a
    fully connected network when connections are lost due to
    network issues. This is problematic for all applications
    expecting a fully connected network to be provided, such as for
    example mnesia, but also for global itself. A network of
    overlapping partitions might cause the internal state of global
    to become inconsistent. Such an inconsistency can remain even
    after such partitions have been brought together to form a
    fully connected network again. The effect on other applications
    that expects that a fully connected network is maintained may
    vary, but they might misbehave in very subtle hard to detect
    ways during such a partitioning. In order to prevent such
    issues, we have introduced a prevent overlapping partitions fix
    which can be enabled using the prevent_overlapping_partitions
    kernel(6) parameter. When this fix has been enabled, global
    will actively disconnect from nodes that reports that they have
    lost connections to other nodes. This will cause fully
    connected partitions to form instead of leaving the network in
    a state with overlapping partitions. Note that this fix has to
    be enabled on all nodes in the network in order to work
    properly. Since this quite substantially changes the behavior,
    this fix is currently disabled by default. Since you might get
    hard to detect issues without this fix you are, however,
    strongly advised to enable this fix in order to avoid issues
    such as the ones described above. As of OTP 25 this fix will
    become enabled by default.
  * erts: Corrected the type specification of erlang:seq_trace/2.
  * erts: Fix memory leak when tracing on running on a process that
    only handle system tasks or non-message signals (for example
    process_info requests).
  * erts: Add support for using socket:sockaddr_in() and
    socket:sockaddr_in6() when using gen_sctp, gen_tcp and gen_udp.
    This will make it possible to use Link Local IPv6 addresses.
  * erts: Show on_load failure reasons in embedded mode.
  * erts: Compile date saved in the Erlang VM executable has been
    removed.
  * erts: Improve documentation for the dynamic node name feature.
  * ssh: Fix makefile dependency bugs.
  * ssh: Fixed faulty OpenSSH decoding of Ed25519/Ed448 keys in the
    OpenSSH format openssh_key_v1.
  * ssh: Correction of ssh_file typing, specially for the
    experimental openssh-key-v1 encoding.
  * ssh: Improper tag for private ED keys when encoding with
    ssh:encode/2. The tuple had ed_priv as first element, but
    should have had ed_pri. This is now corrected. *** POTENTIAL
    INCOMPATIBILITY ***
  * ssh: Add support for Ed25519/Ed448 SSH host keys in the RFC
    4716 format ("-----BEGIN EC PRIVATE KEY-----") generated by for
    example openssl or via Erlang functions (i.e.
    public_key:generate_key({namedCurve, ed25519})). Ed25519 SSH
    host keys generated by ssh-keygen was, and are still,
    supported.
  * kernel: Handling of send_timeout for gen_tcp has been corrected
    so that the timeout is honored also when sending 0 bytes.
  * kernel: By default global does not take any actions to restore
    a fully connected network when connections are lost due to
    network issues. This is problematic for all applications
    expecting a fully connected network to be provided, such as for
    example mnesia, but also for global itself. A network of
    overlapping partitions might cause the internal state of global
    to become inconsistent. Such an inconsistency can remain even
    after such partitions have been brought together to form a
    fully connected network again. The effect on other applications
    that expects that a fully connected network is maintained may
    vary, but they might misbehave in very subtle hard to detect
    ways during such a partitioning. In order to prevent such
    issues, we have introduced a prevent overlapping partitions fix
    which can be enabled using the prevent_overlapping_partitions
    kernel(6) parameter. When this fix has been enabled, global
    will actively disconnect from nodes that reports that they have
    lost connections to other nodes. This will cause fully
    connected partitions to form instead of leaving the network in
    a state with overlapping partitions. Note that this fix has to
    be enabled on all nodes in the network in order to work
    properly. Since this quite substantially changes the behavior,
    this fix is currently disabled by default. Since you might get
    hard to detect issues without this fix you are, however,
    strongly advised to enable this fix in order to avoid issues
    such as the ones described above. As of OTP 25 this fix will
    become enabled by default.
  * kernel: Fix bug where logger would crash when logging a report
    including improper lists.
  * kernel: Make erlang:set_cookie work for dynamic node names.
  * kernel: Add support for using socket:sockaddr_in() and
    socket:sockaddr_in6() when using gen_sctp, gen_tcp and gen_udp.
    This will make it possible to use Link Local IPv6 addresses.
  * kernel: A net_tickintensity kernel parameter has been
    introduced. It can be used to control the amount of ticks
    during a net_ticktime period. A new net_kernel:start/2 function
    has also been introduced in order to make it easier to add new
    options. The use of net_kernel:start/1 has been deprecated.
  * kernel: Improve documentation for the dynamic node name
    feature.
  * erl_docgen: Fix css for large tables and images on small
    screens
  * erl_docgen: Fix bug with codeinclude tag that caused it to not
    include the code if used in a correct, but unexpected way.
  * observer: Calculate the display width in etop, instead of hard-
    coding it to 89 characters.
  * debugger: Fix record index matching, it was broken and could
    never match.
  * ssl: Improved error handling.
  * ssl: Before this change, net_kernel used with TLS distribution
    might be leaking processes in case of connectivity issues.
  * ssl: Fix makefile dependency bugs.
  * ssl: Make sure the TLS sender process handles explicit calls to
    erlang:disconnect_node properly, avoiding potential hanging
    problems in net_kernel.
  * ssl: Add support for TLS-1.3 certificate_authorities extension.
    And process certificate_authorities field in pre-TLS-1.3
    certificate requests.
  * ssl: Support password fun for protected keyfiles in ssl:connect
    function.
  * ssl: Add in some cases earlier detection of possible DoS
    attacks by malicious clients sending unexpected TLS messages
    instead of the client hello. Note that such attacks are already
    mitigated by providing a timeout for the TLS handshake.
  * eldap: Fix eldap extensibleMatch dnAttributes option. According
    to the ldap ASN1 the dnAttributes should be a bool, instead it
    was generated as a string.
  * eldap: Implemented paged searches according to https://www.rfc-
    editor.org/rfc/rfc2696.txt
  * public_key: Support password fun for protected keyfiles in
    ssl:connect function.
  * stdlib: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.
  * mnesia: Reduce the number of locks taken during table copying,
    should reduce the startup time on large systems.
  * diameter: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1649246400">- Fix build for Factory. Currently, any Java version
  is fine for Erlang.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1653220800">- Version 25.0:
  - stdlib
  * New function filelib:ensure_path/1 will ensure that all
    directories for the given path exists
  * New functions groups_from_list/2 and groups_from_list/3 in
    the maps module
  * New functions uniq/1 uniq/2 in the lists module
  * New PRNG added to the rand module, for fast pseudo-random
    numers.
  - compiler, kernel, stdlib, syntax_tools:
  * Added support for selectable features as described in EEP-60.
    Features can be enabled/disabled during compilation with
    options (ordinary and +term) to erlc as well as with
    directives in the file. Similar options can be used to erl
    for enabling/disabling features allowed at runtime. The new
    maybe expression EEP-49 is fully supported as the feature
    maybe_expr.
  - erts &amp; JIT:
  * The JIT now works for 64-bit ARM processors.
  * The JIT now does type-based optimizations based on type
    information in the BEAM files.
  * Improved the JIT’s support for external tools like perf and
    gdb, allowing them to show line numbers and even the original
    Erlang source code when that can be found.
  - erts, stdlib, kernel:
  * Users can now configure ETS tables with the
    {write_concurrency, auto} option. This option forces tables
    to automatically change the number of locks that are used at
    run-time depending on how much concurrency is detected. The
    {decentralized_counters, true} option is enabled by default
    when {write_concurrency, auto} is active.
  * Benchmark results comparing this option with the other ETS
    optimization options are available here: benchmarks.
  * To enable more optimizations, BEAM files compiled with OTP 21
    and earlier cannot be loaded in OTP 25.
  * The signal queue of a process with the process flag
    message_queue_data=off_heap has been optimized to allow
    parallel reception of signals from multiple processes. This
    can improve performance when many processes are sending in
    parallel to one process. See benchmark.
  * The Erlang installation directory is now relocatable on the
    file system given that the paths in the installation’s
    RELEASES file are paths that are relative to the
    installations root directory.
  * A new option called short has been added to the functions
    erlang:float_to_list/2 and erlang:float_to_binary/2. This
    option creates the shortest correctly rounded string
    representation of the given float that can be converted back
    to the same float again.
  * Introduction of quote/1 and unquote/1 functions in the
    uri_string module - a replacement for the deprecated
    functions http_uri:encode and http_uri:decode.
  * The new module peer supersedes the slave module. The slave
    module is now deprecated and will be removed in OTP 27.
  * global will now by default prevent overlapping partitions due
    to network issues. This is done by actively disconnecting
    from nodes that reports that they have lost connections to
    other nodes. This will cause fully connected partitions to
    form instead of leaving the network in a state with
    overlapping partitions.
  * It is possible to turn off the new behavior by setting the
    the kernel configuration parameter
    prevent_overlapping_partitions to false. Doing this will
    retain the same behavior as in OTP 24 and earlier.
  * The format_status/2 callback for gen_server, gen_statem and
    gen_event has been deprecated in favor of the new
    format_status/1 callback.
  * The new callback adds the possibility to limit and change
    many more things than the just the state.
  * The timer module has been modernized and made more efficient,
    which makes the timer server less susceptible to being
    overloaded. The timer:sleep/1 function now accepts an
    arbitrarily large integer.
  - compiler:
  * The maybe ... end construction as proposed in EEP-49 has been
    implemented. It can simplify complex code where otherwise
    deeply nested cases would have to be used.
  * To enable maybe, give the option {enable_feature,maybe_expr}
    to the compiler. The exact option to use will change in a
    coming release candidate and then it will also be possible to
    use from inside the module being compiled.
  * When a record matching or record update fails, a {badrecord,
    ExpectedRecordTag} exception used to be raised. In this
    release, the exception has been changed to {badrecord,
    ActualValue}, where ActualValue is the value that was found
    instead of the expected record.
  * Add compile attribute -nifs() to empower compiler and loader
    with information about which functions may be overridden as
    NIFs by erlang:load_nif/2.
  * Improved and more detailed error messages when binary
    construction with the binary syntax fails. This applies both
    for error messages in the shell and for
    erl_error:format_exception/3,4.
  * Change format of feature options and directives for better
    consistency. Options to erlc and the -compile(..) directive
    now has the format {feature, feature-name, enable | disable}.
    The -feature(..) now has the format -feature(feature-name,
    enable | disable).
  - crypto:
  * Add crypto:hash_equals/2 which is a constant time comparision
    of hashvalues.
  - ssl:
  * Introducing a new (still experimental) option
    {certs_keys,[cert_key_conf()]}. With this a list of a
    certificates with their associated key may be used to
    authenticate the client or the server. The certificate key
    pair that is considered best and matches negotiated
    parameters for the connection will be selected.
  - public_key:
  * Functions for retrieving OS provided CA-certs added.
  - dialyzer:
  * Optimize operations in the erl_types module. Parallelize the
    Dialyzer pass remote.
  * Added the missing_return and extra_return options to raise
    warnings when specifications differ from inferred types.
    These are similar to, but not quite as verbose as overspecs
    and underspecs.
  * Dialyzer now better understands the types for min/2, max/2,
    and erlang:raise/3. Because of that, Dialyzer can potentially
    generate new warnings. In particular, functions that use
    erlang:raise/3 could now need a spec with a no_return()
    return type to avoid an unwanted warning.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1656849600">- Changes for 25.0.2:
  * ssl: Improved handling of unexpected messages during the
    handshake, taking the right action for unexpected messages.
  * erts: On computers with the ARM64 (AArch64) architecture (such
    as Apple Silicon Macs) a rem expression followed by a div
    expression with the same operands could evaluate to the wrong
    result if the result of the rem expression was unused.
- Changes for 25.0.1:
  * ssl: When a TLS-1.3 enabled client tried to talk to a TLS-1.2
    server that coalesces TLS-1.2 handshake message over one TLS
    record, the connection could fail due to some message being
    handled in the wrong state, this has been fixed.
  * ssl: Correctly handles supported protocol version change from
    default to something else by sni_fun supplied to
    ssl:handshake/[2,3] together with a TCP-socket (so called
    upgrade).
  * ssl: Also, TLS-1.3 should respond with a protocol version alert
    if previous versions, that are supported but not configured,
    are attempted.
  * kernel: The DNS resolver inet_res has been fixed to ignore
    trailing dot difference in the request domain between the sent
    request and the received response, when validating a response.
  * kernel: A bug in inet_res has been fixed where a missing
    internal {ok,_} wrapper caused inet_res:resolve/* to return a
    calculated host name instead of an `{ok,Msg} tuple, when
    resolving an IP address or a host name that is an IP address
    string.
  * kernel: The erlang:is_alive() BIF could return true before
    configured distribution service was available. This bug was
    introduced in OTP 25.0 ERTS version 13.0. The
    erlang:monitor_node() and erlang:monitor() BIFs could
    erroneously fail even though configured distribution service
    was available. This occurred if these BIFs were called after
    the distribution had been started using dynamic node name
    assignment but before the name had been assigned.
  * kernel: Added the missing mandatory address/0 callback in the
    gen_tcp_dist example.
  * erts: A spawn_reply signal from a remote node could be delayed
    and be delivered after other signals from the newly spawned
    process. When this bug triggered, the connection to the node
    where the process was spawned sometimes could be taken down due
    to the bug. The following error message would then be logged if
    this happened: Missing 'spawn_reply' signal from the node
    &lt;RemoteNode&gt; detected by &lt;Pid&gt; on the node &lt;LocalNode&gt;. The
    node &lt;RemoteNode&gt; probably suffers from the bug with ticket id
    OTP-17737. This bug only affected processes which had enabled
    off_heap message_queue_data and parallel reception of signals
    had been automatically enabled. This bug was introduced in OTP
    25.0, ERTS version 13.0.
  * erts: Fixed type spec of erlang:system_info(dist_ctrl).
  * erts: The zlib built in to the runtime system has been updated
    to version 1.2.12. (Note that on most platforms, the platform's
    own zlib is used.)
  * erts: The erlang:is_alive() BIF could return true before
    configured distribution service was available. This bug was
    introduced in OTP 25.0 ERTS version 13.0. The
    erlang:monitor_node() and erlang:monitor() BIFs could
    erroneously fail even though configured distribution service
    was available. This occurred if these BIFs were called after
    the distribution had been started using dynamic node name
    assignment but before the name had been assigned.
  * crypto: Note in the documentation that MODP (rfc3526) groups
    and OpenSSL 3.0 can give an error if a call to
    crypto:generate_key/2 specifies a key length, and that length
    is to small.
  * crypto: The cmac now uses only the 3.0 API
  * crypto: Documentation is now updated with which OpenSSL
    cryptolib versions that OTP currently is tested.
  * dialyzer: Fixed the documentation for the missing_return and
    extra_return options.
  * mnesia: Fixed add_table_copy which could leave a table lock if
    the receiving node went down during the operation.
  * ssh: Binaries can be limited in logs with the parameter
    max_log_item_len. The default value is 500 bytes.
  * stdlib: In the initial release of Erlang/OTP 25, the expression
    bound to the _ pseudo-field in a record initialization would
    always be evaluated once, even if all other fields in the
    record were explicitly initialized. That would break the use
    case of binding the expression error(...) to _ in order to get
    an exception if not all fields were initialized. The behavior
    of binding to _ has been reverted to the pre-OTP 25 behavior,
    that is, to not evaluate the expression if all fields have been
    bound to explicit values.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1660046400">- Changes for 25.0.3:
  * erts: Distributed exit signals could be lost under the
    following conditions:
  * erts: A race could cause process_info(Pid, message_queue_len)
    on other processes to return invalid results.
  * erts: Fixed reduction counting for handling process system
    tasks.
  * erts: Priority elevation of terminating processes did not work
    which could cause execution of such processes to be delayed.
  * erts: An unlink operation made by a process that terminated
    before the unlink operation completed, i.e., before it had
    received an unlink-ack signal from the linked process, caused
    an exit signal to erroneously be sent from the terminating
    process to the process being unlinked. This exit signal would
    most often be ignored by the receiver, but if the receiver of
    the exit signal concurrently set up a new link, it could
    receive the exit signal with the actual exit reason of the
    terminating process instead of a noproc exit reason. It is
    however very hard to detect that this has happened and has no
    obvious negative consequences, so it should be considered
    harmless. A distributed unlink-ack signal received by a
    terminating process was also not properly removed which could
    cause a minor memory leak.
  * ssl: The link to crypto:engine_load refered the function with
    wrong arity.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1661601600">- Changes for 25.0.4:
  * kernel: A call to net_kernel:setopts(new, Opts) at the same
    time as a connection was being set up could cause a deadlock
    between the net_kernel process and the process setting up the
    connection.
  * erts: The monitor/3 BIF did not apply options to the created
    monitor if the target process or port did not exist. That is,
    the corresponding down message would get a `DOWN` tag even if a
    custom tag had been set, and the returned reference was not an
    alias even if the alias option had been passed.
  * erts: The erlang:monotonic_time/1, erlang:system_time/1,
    erlang:time_offset/1, and os:system_time/1 BIFs erroneously
    failed when passed the argument native.</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1665662400">- Changes for 25.1.1:
  * dialyzer: Dialyzer could crash when analyzing Elixir code that
    used intricate macros.
  * dialyzer: The --input_list_file option has been added.
  * ssl: Fixes handling of symlinks in cacertfile option.
  * eunit: With this change, eunit exact_execution option works
    with application primitive.
  * stdlib: peer nodes failed to halt when the process supervising
    the control connection crashed. When an alternative control
    connection was used, this supervision process also quite
    frequently crashed when the peer node was stopped by the node
    that started it which caused the peer node to linger without
    ever halting.
  * asn1: For the per and uper ASN.1 encoding rules, encoding and
    decoding the SEQUENCE OF and SET OF constructs with 16384 items
    or more is now supported.
  * erts: Listen sockets created with the socket module, leaked
    (erlang-) monitors.
  * erts: Notifications about available distribution data sent to
    distribution controller processes could be lost. Distribution
    controller processes can be used when implementing an
    alternative distribution carrier. The default distribution over
    tcp was not effected and the bug was also not present on
    x86/x86_64 platforms.
  * kernel: Listen sockets created with the socket module, leaked
    (erlang-) monitors.
  * kernel: peer nodes failed to halt when the process supervising
    the control connection crashed. When an alternative control
    connection was used, this supervision process also quite
    frequently crashed when the peer node was stopped by the node
    that started it which caused the peer node to linger without
    ever halting.
- Changes for 25.1:
  * dialyzer: Two bugs have been fixed in Dialyzer's checking of
    behaviors: When a mandatory callback function is present but
    not exported, Dialyzer would not complain about a missing
    callback. When an optional callback function was not exported
    and had incompatible arguments and/or the return values were
    incompatible, Dialyzer would complain. This has been changed to
    suppress the warning, because the function might not be
    intended to be a callback function, for instance if a release
    added a new optional callback function (such as format_status/1
    for the gen_server behaviour added in OTP 25).
  * dialyzer: The no_extra_return and no_missing_return warnings
    can now be suppressed through -dialyzer directives in source
    code.
  * jinterface: Fix javadoc build error by adding option -encoding
    UTF-8.
  * diameter: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * crypto: Fix configure with --with-ssl and --disable-dynamic-
    ssl-lib on Windows.
  * crypto: Remove all references correctly in the garbage
    collection if an engine handle was not explicit unloaded.
  * crypto: Changed the behaviour of the engine load/unload
    functions The engine load/unload functions have got changed
    semantics to get a more consistent behaviour and work correct
    when variables are garbage collected. The load functions now
    don't register the methods for the engine to replace. That will
    now be handled with the new functions
    engine_register/engine_unregister if needed. Some functions are
    removed from the documentation and therefor the API, but they
    are left in the code for compatibility. *** POTENTIAL
    INCOMPATIBILITY ***
  * crypto: Fixed a naming bug for AES-CFB and Blowfish-CFB/OFB
    when linked with OpenSSL 3.0 cryptolib.
  * crypto: Sign/verify does now behave as in OTP-24 and earlier
    for eddsa.
  * crypto: Pass elliptic curve names from crypto.erl to crypto's
    nif.
  * crypto: The configure option --disable-deprecated-warnings is
    removed. It was used for some releases when the support for
    OpenSSL 3.0 was not completed. It is not needed in OTP 25.
  * crypto: Crypto is now considered to be usable with the OpenSSL
    3.0 cryptolib for production code. ENGINE and FIPS are not yet
    fully functional.
  * crypto: Do not exit if the legacy provider is missing in
    libcrypto 3.0.
  * ssl: Reject unexpected application data in all relevant places
    for all TLS versions. Also, handle TLS-1.3 middlebox
    compatibility with more care. This will make malicious
    connections fail early and further, mitigate possible DoS
    attacks, that would be caught by the handshake timeout. Thanks
    to Aina Toky Rasoamanana and Olivier Levillain from Télécom
    SudParis for alerting us of the issues in our implementation.
  * ssl: With this change, value of cacertfile option will be
    adjusted before loading certs from the file. Adjustments
    include converting relative paths to absolute and converting
    symlinks to actual file path. Thanks to Marcus Johansson
  * ssl: In TLS-1.3, if chain certs are missing (so server auth
    domain adherence can not be determined) send peer cert and hope
    the server is able to recreate a chain in its auth domain.
  * ssl: Make sure periodical refresh of CA certificate files
    repopulates cache properly.
  * ssl: Correct internal CRL cache functions to use internal
    format consistently.
  * ssl: Incorrect handling of client middlebox negotiation for
    TLS-1.3 could result in that a TLS-1.3 server would not use
    middlebox mode although the client was expecting it too and
    failing the negotiation with unexpected message.
  * ssl: If the "User" process, the process starting the TLS
    connection, gets killed in the middle of spawning the dynamic
    connection tree make sure we do not leave any processes behind.
  * ssl: A vulnerability has been discovered and corrected. It is
    registered as CVE-2022-37026 "Client Authentication Bypass".
    Corrections have been released on the supported tracks with
    patches 23.3.4.15, 24.3.4.2, and 25.0.2. The vulnerability
    might also exist in older OTP versions. We recommend that
    impacted users upgrade to one of these versions or later on the
    respective tracks. OTP 25.1 would be an even better choice.
    Impacted are those who are running an ssl/tls/dtls server using
    the ssl application either directly or indirectly via other
    applications. For example via inets (httpd), cowboy, etc. Note
    that the vulnerability only affects servers that request client
    certification, that is sets the option {verify, verify_peer}.
    (bsc#1205318)
  * eunit: With this change, Eunit can optionally not try to
    execute related module with "_tests" suffix. This might be used
    for avoiding duplicated executions when source and test modules
    are located in the same folder.
  * erl_docgen: Update DTD to allow XML tag em under pre.
  * inets: Add httpc:ssl_verify_host_options/1 to help setting
    default ssl options for the https client.
  * inets: This change fixes dialyzer warnings generated for
    inets/httpd examples (includes needed adjustment of spec for
    ssh_sftp module).
  * inets: Remove documentation of no longer supported callback.
  * stdlib: Fixed inconsistency bugs in global due to
    nodeup/nodedown messages not being delivered before/after
    traffic over connections. Also fixed various other
    inconsistency bugs and deadlocks in both global_group and
    global. As building blocks for these fixes, a new BIF
    erlang:nodes/2 has been introduced and
    net_kernel:monitor_nodes/2 has been extended. The -hidden and
  - connect_all command line arguments did not work if multiple
    instances were present on the command line which has been
    fixed. The new kernel parameter connect_all has also been
    introduced in order to replace the -connect_all command line
    argument.
  * stdlib: Fix the public_key:ssh* functions to be listed under
    the correct release in the Removed Functionality User's Guide.
  * stdlib: The type spec for format_status/1 in gen_statem,
    gen_server and gen_event has been corrected to state that the
    return value is of the same type as the argument (instead of
    the same value as the argument).
  * stdlib: If the timer server child spec was already present in
    kernel_sup but it was not started, the timer server would fail
    to start with an {error, already_present} error instead of
    restarting the server.
  * stdlib: When changing callback module in gen_statem the
    state_enter calls flag from the old module was used in for the
    first event in the new module, which could confuse the new
    module and cause malfunction. This bug has been corrected. With
    this change some sys debug message formats have been modified,
    which can be a problem for debug code relying on the format.
  * ** POTENTIAL INCOMPATIBILITY ***
  * stdlib: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * stdlib: The rfc339_to_system_time/1,2 functions now allows the
    minutes part to be omitted from the time zone.
  * stdlib: The receive statement in gen_event has been optimized
    to not use selective receive (which was never needed, and could
    cause severe performance degradation under heavy load).
  * stdlib: Add new API function erl_features:configurable/0
  * parsetools: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * public_key: Support more Linux distributions in cacerts_load/0.
  * public_key: Correct asn1 typenames available in type
    pki_asn1_type()
  * public_key: Sign/verify does now behave as in OTP-24 and
    earlier for eddsa.
  * snmp: Improved the get-bulk response max size calculation. Its
    now possible to configure 'empty pdu size', see appendix c for
    more info.
  * snmp: Fix various example dialyzer issues
  * ssh: Handling rare race condition at channel close.
  * ssh: New ssh option no_auth_needed to skip the ssh
    authentication. Use with caution!
  * ssh: This change fixes dialyzer warnings generated for
    inets/httpd examples (includes needed adjustment of spec for
    ssh_sftp module).
  * ssh: The new function ssh:daemon_replace_options/2 makes it
    possible to change the Options in a running SSH server.
    Established connections are not affected, only those created
    after the call to this new function.
  * ssh: Add a timeout as option max_initial_idle_time. It closes a
    connection that does not allocate a channel within the timeout
    time. For more information about timeouts, see the Timeouts
    section in the User's Guide Hardening chapter.
  * observer: Fixed units in gui.
  * xmerl: There is a new configure option, --enable-deterministic-
    build, which will apply the deterministic compiler option when
    building Erlang/OTP. The deterministic option has been improved
    to eliminate more sources of non-determinism in several
    applications.
  * asn1: There is a new configure option, --enable-deterministic-
    build, which will apply the deterministic compiler option when
    building Erlang/OTP. The deterministic option has been improved
    to eliminate more sources of non-determinism in several
    applications.
  * erts: Fixed inconsistency bugs in global due to nodeup/nodedown
    messages not being delivered before/after traffic over
    connections. Also fixed various other inconsistency bugs and
    deadlocks in both global_group and global. As building blocks
    for these fixes, a new BIF erlang:nodes/2 has been introduced
    and net_kernel:monitor_nodes/2 has been extended. The -hidden
    and -connect_all command line arguments did not work if
    multiple instances were present on the command line which has
    been fixed. The new kernel parameter connect_all has also been
    introduced in order to replace the -connect_all command line
    argument.
  * erts: Fixed IPv6 multicast_if and membership socket options.
  * erts: Accept funs (NEW_FUN_EXT) with incorrectly encoded size
    field. This is a workaround for a bug (OTP-18104) existing in
    OTP 23 and 24 that could cause incorrect size fields in certain
    cases. The emulator does not use the decoded size field, but
    erl_interface still does and is not helped by this workaround.
  * erts: Fixed issue with inet:getifaddrs hanging on pure IPv6
    Windows
  * erts: Fix faulty distribution encoding of terms with either The
    symptom could be failed decoding on the receiving side leading
    to aborted connection. Fix OTP-18093 is a workaround for theses
    bugs that makes the VM accepts such faulty encoded funs. The
    first encoding bug toward pending connection exists only in OTP
    23 and 24, but the second one exists also on OTP 25.
  * erts: Fixed emulator crash that could happen during crashdump
    generation of ETS tables with options ordered_set and
    {write_concurrency,true}.
  * erts: Retrieval of monotonic and system clock resolution on
    MacOS could cause a crash and/or erroneous results.
  * erts: Fix bug where the max allowed size of erl +hmax was lower
    than what was allowed by process_flag.
  * erts: On computers with ARM64 (AArch64) processors, the JIT
    could generate incorrect code when more than 4095 bits were
    skipped at the tail end of a binary match.
  * erts: In rare circumstances, an is_binary/1 guard test could
    succeed when given a large integer.
  * erts: Fix bug causing ets:info (and sometimes ets:whereis) to
    return 'undefined' for an existing table if a concurrent
    process were doing ets:insert with a long list on the same
    table.
  * erts: Fix writing and reading of more than 2 GB in a single
    read/write operation on macOS. Before this fix attempting to
    read/write more than 2GB would result in {error,einval}.
  * erts: Fix bug sometimes causing emulator crash at node shutdown
    when there are pending connections. Only seen when running duel
    distribution protocols, inet_drv and inet_tls_dist.
  * erts: Yield when adjusting large process message queues due to
    The message queue adjustment work will now be interleaved with
    all other types of work that processes have to do, even other
    message queue adjustment work.
  * erts: Add rudimentary debug feature (option) for the inet-
    driver based sockets, such as gen_tcp and gen_udp.
  * erts: Introduced the hidden and dist_listen options to
    net_kernel:start/2. Also documented the -dist_listen command
    line argument which was erroneously documented as a kernel
    parameter and not as a command line argument.
  * erts: New documentation chapter "Debugging NIFs and Port
    Drivers" under Interoperability Tutorial.
  * erts: Add new API function erl_features:configurable/0
  * kernel: Fixed inconsistency bugs in global due to
    nodeup/nodedown messages not being delivered before/after
    traffic over connections. Also fixed various other
    inconsistency bugs and deadlocks in both global_group and
    global. As building blocks for these fixes, a new BIF
    erlang:nodes/2 has been introduced and
    net_kernel:monitor_nodes/2 has been extended. The -hidden and
  - connect_all command line arguments did not work if multiple
    instances were present on the command line which has been
    fixed. The new kernel parameter connect_all has also been
    introduced in order to replace the -connect_all command line
    argument.
  * kernel: Fixed IPv6 multicast_if and membership socket options.
  * kernel: Fixed issue with inet:getifaddrs hanging on pure IPv6
    Windows
  * kernel: The type specifications for inet:getopts/2 and
    inet:setopts/2 have been corrected regarding SCTP options.
  * kernel: The type specifications for inet:parse_* have been
    tightened.
  * kernel: Fix gen_tcp:connect/3 spec to include the inet_backend
    option.
  * kernel: Fix bug where using a binary as the format when calling
    logger:log(Level, Format, Args) (or any other logging function)
    would cause a crash or incorrect logging.
  * kernel: Add rudimentary debug feature (option) for the inet-
    driver based sockets, such as gen_tcp and gen_udp.
  * kernel: Introduced the hidden and dist_listen options to
    net_kernel:start/2. Also documented the -dist_listen command
    line argument which was erroneously documented as a kernel
    parameter and not as a command line argument.
  * kernel: Scope and group monitoring have been introduced in pg.
    For more information see the documentation of
    pg:monitor_scope(), pg:monitor(), and pg:demonitor().
  * kernel: A new function global:disconnect/0 has been introduced
    with which one can cleanly disconnect a node from all other
    nodes in a cluster of global nodes.
  * compiler: The compiler will now forbid using the empty atom ''
    as module name. Also forbidden are modules names containing
    control characters, and module names containing only spaces and
    soft hyphens.
  * compiler: The bin_opt_info and recv_opt_info options would
    cause the compiler to crash when attempting to compile
    generated code without location information.
  * compiler: In rare circumstances involving floating point
    operations, the compiler could terminate with an internal
    consistency check failure.
  * compiler: In rare circumstances when doing arithmetic
    instructions on non-numbers, the compiler could crash.
  * compiler: In rare circumstances, complex boolean expressions in
    nested cases could cause the compiler to crash.
  * compiler: Expression similar to #{assoc:=V} = #key=&gt;self()}, V
    would return the empty map instead of raising an exception.
  * compiler: Eliminated a crash in the beam_ssa_bool pass of the
    compiler when compiling a complex guard expression.
  * compiler: In rare circumstances, the compiler could crash with
    an internal consistency check failure.
  * compiler: When compiling with the option inline_list_funcs, the
    compiler could produce a nonsensical warning.
  * compiler: When given the no_ssa_opt option, the compiler could
    terminate with an internal consistency failure diagnostic when
    compiling map matching.
  * compiler: Made warnings for existing atoms being keywords in
    experimental features more precise, by not warning about quoted
    atoms.
  * compiler: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * megaco: Fixed various dialyzer related issues in the examples
    and the application proper.
  * megaco: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * common_test: Fix cth_surefire to handle when a suite is not
    compiled with debug_info. This bug has been present since
    Erlang/OTP 25.0.
  * common_test: Common Test now preserves stack traces for throws.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1669291200">- Changes for 25.1.2:
  * mnesia: Don't fill the logs if mnesia can't connect to all
    nodes, due to partitioned network.
  * erts: Add abandon carrier free utilization limit (+Muacful)
    option to erts_alloc. This option allows the user to mark
    unused segments in a memory carrier as re-useable by the OS if
    needed. This functionality was a non-configurable default
    before Erlang/OTP 25, but removed due to performance issues.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1671364800">- Changes for 25.2:
  * erts: Fix perf/gdb JIT symbols to not contain CodeInfoPrologue
    for the JIT internal module erts_beamasm.
  * erts: Fixed minor memory leaks.
  * erts: Fix bugs in ets:insert and ets:insert_new when called
    with a list of tuples to insert while a concurrent process
    either deletes or renames the table. The table deletion could
    be done with ets:delete/1 or be caused by termination of the
    table owning process. Symptoms are either VM crash or strange
    incorrect behavior from the insert operation. The risk of
    triggering the bugs increases with the length of the list of
    tuple to insert. Bugs exist since OTP 23.0.
  * erts: Boost execution of scheduled thread progress jobs. This
    to prevent memory exhaustion in extremely rapid
    allocation/deallocation scenarios, such as repeated ETS table
    creations/deletions.
  * erts: Fix segv crash during crash dumping an ETS table doing
    ets:delete_all_objects.
  * erts: Spec for function net:if_names/0 incorrect
  * erts: Fix bug in binary_to_term decoding a binary term 2Gbyte
    or larger.
  * erts: Documentation of erlang:module_loaded/1 has been
    adjusted:
  * erts: Fix list_to_atom/1 for negative code points. Could either
    return with a positive code point or fail with an incorrect
    exception.
  * erts: Fix rare bug causing VM crash when sending to a pid of a
    spawning process returned from erlang:processes/0. Only seen
    when provoked by system process literal_area_collector,
    triggered by a module purge operation, on a VM started with
    +Meamin (no customized allocators).
  * erts: gen_udp:open/2 with option(s) add_membership or
    drop_membership would drop earlier options.
  * erts: The inet:setopts/2 {reuseaddr, true} option will now be
    ignored on Windows unless the socket is an UDP socket. For more
    information see the documentation of the reuseaddr option part
    of the documentation of inet:setopts/2. Prior to OTP 25 the
    {reuseaddr, true} option was ignored for all sockets on
    Windows, but as of OTP 25.0 this was changed so that it was not
    ignored for any sockets. *** POTENTIAL INCOMPATIBILITY ***
  * erts: Fix bug in binary_to_term decoding a list of length 1G or
    longer.
  * erts: Fix bug in binary_to_term (and distributed receive) when
    decoding a large map (&gt;32 keys) with unsorted small maps (&lt;=
    32) as keys of the large map. This was only a problem if the
    term was encoded by erl_interface, jinterface or otherwise, as
    the VM itself always encodes small maps with sorted keys. The
    "binary_to_term" would appear as successful but the created
    large map was internally inconsistent. The smaller key-maps
    could not be found with maps:get and friends. Other operations
    such as map compare and merge could probably also give
    incorrect results.
  * erts: Fix Windows bug in open_port({spawn, Command}, ..) when
    Command is found via the OS search PATH and that directory path
    contains white spaces. The port program would start but the
    command line arguments to it could be incorrect.
  * ftp: fix unexpected result ok when calling ftp:nlist repeatedly
  * inets: This change allows body requests to httpc:request/5 be
    an iolist()
  * inets: addition of type specs in httpc.erl
  * inets: httpc: Add support for HTTP 308 status code
  * dialyzer: Dialyzer would crash when attempting to analyze a bit
    syntax segment size having an literal non-integer size such as
    [].
  * dialyzer: Dialyzer could crash when trying to analyze a
    convoluted nested expression involving funs,
  * kernel: Fixed shutdown crash in gen_tcp socket backend, when
    the other end closed the socket.
  * kernel: erl_tar can now read gzip-compressed tar files that are
    padded. There is a new option compressed_one for file:open/2
    that will read a single member from a gzip file,
  * kernel: Fix os:cmd to not translate all exceptions thrown to
    badarg. For example emfile from erlang:open_port was translated
    to badarg. This bug has existed since Erlang/OTP 24.
  * kernel: Spec for function net:if_names/0 incorrect
  * kernel: Missing ctrl option name transation for TOS and TTL (on
    FreeBSD) when using gen_udp with the 'socket' inet_backend.
  * kernel: gen_udp:open/2 with option(s) add_membership or
    drop_membership would drop earlier options.
  * kernel: The inet:setopts/2 {reuseaddr, true} option will now be
    ignored on Windows unless the socket is an UDP socket. For more
    information see the documentation of the reuseaddr option part
    of the documentation of inet:setopts/2. Prior to OTP 25 the
    {reuseaddr, true} option was ignored for all sockets on
    Windows, but as of OTP 25.0 this was changed so that it was not
    ignored for any sockets. *** POTENTIAL INCOMPATIBILITY ***
  * kernel: The distribution socket option handling in
    inet_tcp_dist has been cleaned up to clarify which were
    mandatory and which just had default values.
  * kernel: Improve warning message format for gen_tcp_socket.
  * snmp: Explicitly close the socket(s) when terminating
    (default-) net-if process.
  * stdlib: erl_tar can now read gzip-compressed tar files that are
    padded. There is a new option compressed_one for file:open/2
    that will read a single member from a gzip file,
  * stdlib: A concurrent call to ets:rename could cause
    ets:delete_all_objects to fail halfway through with badarg.
  * stdlib: It is not allowed to call functions from guards. The
    compiler failed to reject a call in a guard when done by
    constructing a record with a default initialization expression
    that called a function.
  * stdlib: The compiler could crash when using a record with
    complex field initialization expression as a filter in a list
    comprehension.
  * stdlib: unicode:characters_to_binary() could build
    unnecessarily large call stack.
  * stdlib: Improve error message for ets:new/2 name clash. Say
    "name already exists" instead of less specific "invalid
    options".
  * mnesia: Fixed crash which could happen during startup if too
    many decisions where sent from remote nodes.
  * os_mon: The disk_space_check_interval configuration parameter
    of disksup can now be set to values smaller than a minute.
  * ssh: graceful shutdown of ssh_conection_handler when connection
    is closed by peer
  * common_test: Fix starting of peer nodes on old releases when
    the compile server was active and the current Erlang
    installation contained non-latin1 characters in its path.
  * public_key: Disregard LDAP URIs when HTTP URIs are expected.
  * ssl: With this change, tls_sender process is hibernated after
    sufficient inactivity.
  * ssl: Correct handling of legacy schemes so that ECDSA certs
    using sha1 may be used for some TLS-1.3 configurations.
  * ssl: With this change, tls_sender does not cause logger crash
    upon key update.
  * ssl: Enhance warning message
  * ssl: Provide server option to make certificate_authorities
    extension in the TLS-1.3 servers certificate request optional.
    This will allow clients to send incomplete chains that may be
    reconstructable and thereby verifiable by the server, but that
    would not adhere to the certificate_authorities extension.
  * ssl: If the verify_fun handles four arguments the DER cert will
    be supplied as one of the arguments.
  * megaco: A very minor improvement to the measurement tool.
  * observer: A WX event race could causes a crash in when handling
    socket or port info.
  * observer: Improve the nodes menu to include more nodes.
  * compiler: Line number in compiler messages would be truncated
    to 4 digits for line numbers greater than 9999.
  * compiler: In rare circumstance, matching a binary as part of a
    receive clause could cause the compiler to terminate because of
    an internal consistency check failure.
  * compiler: Compiling a function with complex bit syntax matching
    such as f(&lt;&lt;X:0, _:X&gt;&gt;, &lt;&lt;Y:0, _:Y&gt;&gt;) -&gt; ok. could crash the
    compiler.
  * compiler: It is not allowed to call functions from guards. The
    compiler failed to reject a call in a guard when done by
    constructing a record with a default initialization expression
    that called a function.
  * compiler: The compiler could crash when using a record with
    complex field initialization expression as a filter in a list
    comprehension.
  * wx: Added environment variable WX_MACOS_NON_GUI_APP to allow
    user to override OSXIsGUIApplication behavior.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1679745600">- Changes for 25.3:
  * reltool: Fixed a bug that would cause analysis to crash.
  * stdlib: Fixed a bug that would cause analysis to crash.
  * stdlib: Fixed a crash when formatting stack traces for error
    reports.
  * stdlib: Instead of crashing, the list_to_integer/1 and
    list_to_integer/2 BIFs now raise the system_limit exception for
    overlong lists that can't be converted to integers. Similarly,
    the string:to_integer/1 BIF now returns {error,system_limit}
    for overlong lists.
  * stdlib: Removal of non-necessary undefined types added to the
    state's supervisor record.
  * compiler: Fixed a bug that would cause the compiler to hang.
  * compiler: Fixed a crash when compiling code that contained
    maybe expressions.
  * compiler: Constructing a binary with an explicit size of all
    for a binary segment would crash the compiler.
  * compiler: The compiler would generate incorrect code for the
    following type of expression: Pattern = BoundVar1 = . . . =
    BoundVarN = Expression An exception should be raised if any of
    the bound variables have different values than Expression. The
    compiler would generate code that would cause the bound
    variables to be bound to the value of Expressionwhether the
    value matched or not.
  * xmerl: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * megaco: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * debugger: Fixed a bug that would cause analysis to crash.
  * erts: Fixed a bug on Windows where file:read_file_info/1 would
    fail for files with corrupt metadata.
  * erts: Fix process_info(_, binary) to again include "writable
    binaries" which were lost in OTP-25.0. Writable binaries are an
    optimization used when binaries are appended upon in a loop.
  * erts: Fix rare race when receiving fragmented messages on a
    terminating connection. Could potentially cause memory leaks as
    well as double free crashes. Bug exists since OTP 22.0.
  * erts: Fixed bug that could maybe cause problems when a file
    descriptor number is closed by a linked in driver and then
    opened (reused) and passed to enif_select by a NIF. No actual
    symptoms seen, only failed internal assertions in debug build.
  * erts: The runtime system could crash when tracing a process
    executing on a dirty scheduler.
  * erts: In the binary syntax, attempting to match out integers
    with size exceeding 2 GiB could crash the runtime system.
  * erts: Fixed edge case in floating-point negation where A = 0.0,
    B = -A did not produce B = -0.0 on x86_64 JIT.
  * erts: Fixed an issue in the JIT that could crash the emulator
    on some platforms.
  * erts: Added meta data to the windows installer.
  * erts: Fixed ETS insertion order into bag and duplicate_bag of
    tuples with identical keys when passed in a list to
    ets:insert/2. The insert order has been head-to-tail but was
    accidentally changed in OTP 23.0. For bag it was reverted
    (tail-to-head), while for duplicate_bag it was sometimes
    reverted depending on the length of the list and number of
    "reductions" left for the calling process. This fix changes the
    insert order of ets:insert/2 back to always be head-to-tail of
    the list argument.
  * erts: With the JIT for AArch64 (AMD64), calling bxor in with
    non-integer arguments in a guard would crash the runtime
    system.
  * erts: Fix bug regarding process flag max_heap_size. Could cause
    strange behavior when a process was killed due to exceeding the
    limit.
  * erts: Fixed binary comprehensions to be similar to other
    creation of binary data with respect to its contribution of
    triggering garbage collection.
  * erts: In rare circumstances, when a process exceeded its
    allowed heap size set by option max_heap_size, it would not be
    killed as it should be, but instead enter a kind of zombie
    state it would never get out of.
  * erts: Instead of crashing, the list_to_integer/1 and
    list_to_integer/2 BIFs now raise the system_limit exception for
    overlong lists that can't be converted to integers. Similarly,
    the string:to_integer/1 BIF now returns {error,system_limit}
    for overlong lists.
  * erts: Active process aliases of a process at its termination
    leaked memory.
  * erts: Support for fully asynchronous distributed signaling
    where send operations never block. This functionality is by
    default disabled and can be enabled per process. For more
    information see the documentation of process_flag(async_dist,
    Bool).
  * erts: Added the +JPperf no_fp option to explicitly disable
    Erlang frame pointers otherwise added when using the +JPperf
    map option.
  * erl_interface: Accept connection setup from OTP 23 and 24 nodes
    that are not using epmd.
  * erl_interface: The ei API for decoding/encoding terms is not
    fully 64-bit compatible since terms that have a representation
    on the external term format larger than 2 GB cannot be handled.
  * syntax_tools: erl_syntax_lib:annotate_bindings/1,2 will now
    properly annotate named functions and their arguments.
  * kernel: Fixed a bug on Windows where file:read_file_info/1
    would fail for files with corrupt metadata.
  * kernel: Accept connection setup from OTP 23 and 24 nodes that
    are not using epmd.
  * public_key: As different solutions of verifying certificate
    revocation exists move the decode of 'CRLDistributionPoints' so
    that it will only be decode. When it is actually used in the
    verification process. This would enable interoperability with
    systems that use certificates with an invalid empty
    CRLDistributionPoints extension that they want to ignore and
    make verification by other means.
  * public_key: public_key:pkix_path_validation validates
    certificates expiring after 2050
  * public_key: Do not leave exit message in message queue after
    calling cacerts_load() on MacOS.
  * public_key: Replace size/1 with either tuple_size/1 or
    byte_size/1 The size/1 BIF is not optimized by the JIT, and its
    use can result in worse types for Dialyzer. When one knows that
    the value being tested must be a tuple, tuple_size/1 should
    always be preferred. When one knows that the value being tested
    must be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * ssl: Fixed that new dtls connections from the same client ip
    port combination works. If there is a process waiting for
    accept the new connection will connect to that, otherwise it
    will try to re-connect to the old server connection.
  * ssl: When shutting down a node that uses SSL distribution
    (-proto_dist inet_tls), a confusing error message about an
    unexpected process exit was printed. This particular message is
    no longer generated.
  * ssl: fixes the type spec for ssl:format_error/1
  * ssl: Replace size/1 with either tuple_size/1 or byte_size/1 The
    size/1 BIF is not optimized by the JIT, and its use can result
    in worse types for Dialyzer. When one knows that the value
    being tested must be a tuple, tuple_size/1 should always be
    preferred. When one knows that the value being tested must be a
    binary, byte_size/1 should be preferred. However, byte_size/1
    also accepts a bitstring (rounding up size to a whole number of
    bytes), so one must make sure that the call to byte_size/ is
    preceded by a call to is_binary/1 to ensure that bitstrings are
    rejected. Note that the compiler removes redundant calls to
    is_binary/1, so if one is not sure whether previous code had
    made sure that the argument is a binary, it does not harm to
    add an is_binary/1 test immediately before the call to
    byte_size/1.
  * jinterface: Accept connection setup from OTP 23 and 24 nodes
    that are not using epmd.
  * os_mon: The port programs used by cpu_sup and memsup are now
    gracefully shut down when cpu_sup and memsup are shut down.
  * eunit: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * crypto: A user defined runtime library path configured using
  - -with-ssl-rpath=&lt;PATHS&gt; could fail to be enabled.
  * crypto: Ensure that configure fails if a user defined runtime
    library path has been passed by the user, but cannot set.
  * mnesia: Improved consistency for dirty writes when a table was
    added with add_table_copy/3. Fixed a problem with sticky write,
    which could lead to inconsistent data.
  * mnesia: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * common_test: Renamed undocumented macro CT_PEER/3 to
    CT_PEER_REL/3.
  * ssh: With this change, PKCS8 formatted private key file is
    properly decoded and SSH daemon with such key can be started.
  * ssh: Replace size/1 with either tuple_size/1 or byte_size/1 The
    size/1 BIF is not optimized by the JIT, and its use can result
    in worse types for Dialyzer. When one knows that the value
    being tested must be a tuple, tuple_size/1 should always be
    preferred. When one knows that the value being tested must be a
    binary, byte_size/1 should be preferred. However, byte_size/1
    also accepts a bitstring (rounding up size to a whole number of
    bytes), so one must make sure that the call to byte_size/ is
    preceded by a call to is_binary/1 to ensure that bitstrings are
    rejected. Note that the compiler removes redundant calls to
    is_binary/1, so if one is not sure whether previous code had
    made sure that the argument is a binary, it does not harm to
    add an is_binary/1 test immediately before the call to
    byte_size/1.
  * inets: With this change, handling of URI to a folder, with
    missing trailing / and a query component present is fixed.
  * inets: Adds more type information to the inets app, thus
    improving the errors that static analysis tools can detect. The
    addition of type information to records and the updates to
    function heads help static analysis tools to understand that
    some values in the records cannot be 'undefined', thus making
    static tools to type check correctly more modules in the inets
    app
  * inets: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * snmp: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * ftp: Replace size/1 with either tuple_size/1 or byte_size/1 The
    size/1 BIF is not optimized by the JIT, and its use can result
    in worse types for Dialyzer. When one knows that the value
    being tested must be a tuple, tuple_size/1 should always be
    preferred. When one knows that the value being tested must be a
    binary, byte_size/1 should be preferred. However, byte_size/1
    also accepts a bitstring (rounding up size to a whole number of
    bytes), so one must make sure that the call to byte_size/ is
    preceded by a call to is_binary/1 to ensure that bitstrings are
    rejected. Note that the compiler removes redundant calls to
    is_binary/1, so if one is not sure whether previous code had
    made sure that the argument is a binary, it does not harm to
    add an is_binary/1 test immediately before the call to
    byte_size/1.
  * dialyzer: Fixed a bug that would cause analysis to crash.
  * dialyzer: Replace size/1 with either tuple_size/1 or
    byte_size/1 The size/1 BIF is not optimized by the JIT, and its
    use can result in worse types for Dialyzer. When one knows that
    the value being tested must be a tuple, tuple_size/1 should
    always be preferred. When one knows that the value being tested
    must be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * tftp: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
- Changes for 25.2.3:
  * erts: Comparisons between small numbers and pids or ports would
    in some edge cases say that the number was greater than the pid
    or port, violating the term order.
  * erts: process_info(Pid, status) when Pid /= self() could return
    an erroneous result.
  * ssl: Maximize compatibility by ignoring change_cipher_spec
    during handshake even if middle_box_mode is not negotiated
    (mandated by client)
  * ssl: Move assert of middlebox message after an
    hello_retry_request to maximize interoperability. Does not
    changes semantics of the protocol only allows unexpected
    message delay from server.
  * ssh: With this change, ssh application does not crash when
    formatting some of info reports for unsuccessful connections.
  * ssh: With this change, ssh does not log extensively long
    messages.
  * inets: Ensure graceful shutdown
  * inets: Return type of the type specification for function
    httpc:cookie_header/{1,2,3} has been fixed from -spec
    cookie_header(url()) -&gt; [{ field(), value() }] | {error,
    Reason} to -spec cookie_header(url()) -&gt; { field(), value() } |
    {error, Reason}
- Changes for 25.2.2:
  * ftp: Fixes calls to ftp:nlist/2 returning {error, epath} when
    the file / folder exists
- Changes for 25.2.1:
  * compiler: Fixed a bug that could cause legal code to fail
    validation.
  * compiler: Eliminated a rare crash in the beam_types module.
  * erts: Fixed a bug in selective receive optimization that could
    crash 32-bit emulators.
  * erts: A race condition which was very rarely triggered could
    cause the signal queue of a process to become inconsistent
    causing the runtime system to crash.
  * kernel: The tcp connect option 'bind_to_device' could not be
    used with inet_backend = 'socket'. 'inet' requires value type
    binarry() and 'socket' requires value type 'string()'.
  * kernel: Minor issue processing options when calling
    gen_tcp:connect with a sockaddr() and inet_backend = socket.
  * common_test: Change timeout to infinity for gen_server calls in
    cth_log_redirect
  * inets: fixes a missing case of the type specification for
    httpd:info/2/3/4
  * snmp: Single threaded agent crash when vacm table not properly
    initiated.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1683460800">- Changes for 25.3.2:
  * compiler: Fixed type handling bugs that could cause an internal
    error in the compiler for correct code.
  * os_mon: Avoid error report from failing erlang:port_close at
    shutdown of cpu_sup and memsup. Bug exists since OTP 25.3
    (os_mon-2.8.1).
  * erts: If a runtime system which was starting the distribution
    already had existing pids, ports, or references referring to a
    node with the same nodename/creation pair that the runtime
    system was about to use, these already existing pids, ports, or
    references would not work as expected in various situations
    after the node had gone alive. This could only occur if the
    runtime system was communicated such pids, ports, or references
    prior to the distribution was started. That is, it was
    extremely unlikely to happen unless the distribution was
    started dynamically and was even then very unlikely to happen.
    The runtime system now checks for already existing pids, ports,
    and references with the same nodename/creation pair that it is
    about to use. If such are found another creation will be chosen
    in order to avoid these issues.
- Changes for 25.3.1:
  * snmp: Attempts to minimize the number of the error reports
    during a failed agent init.
  * compiler: When a map update such as #{}#{key:=value} that
    should fail with an exception was unused, the exception would
    be lost.
  * compiler: Fixed bug in the validator that made it reject valid
    code.
  * crypto: With this change, random errors are fixed for
    crypto:generate_key calls with OpenSSL 3.
  * erts: Fixed a bug in the loader that prevented certain modules
    compiled with no_ssa_opt from being loaded.
  * erts: Implementations of the call() driver callback that
    returned a faulty encoded result could cause a memory leak and
    could cause invalid data on the heap of the processes calling
    erlang:port_call/3.
  * erts: Fixed a memory corruption issue when upgrading code. The
    bug was introduced in OTP 25.3
  * erts: Fixed configure tests for a few ARM-specific
    instructions, which prevented the emulator from being built on
    some platforms.
  * erts: Aliases created in combination with a monitor using the
    {alias, explicit_unalias} option stopped working from remote
    nodes when a 'DOWN' signal had been received due to the monitor
    or if the monitor was removed using the erlang:demonitor() BIF.
    This bug was introduced in OTP 24.3.4.10 and OTP 25.3.
  * erts: In rare circumstances, bit syntax matching of an invalid
    code point for a utf32 would crash the runtime system.
  * erts: Building the runtime system failed when native atomic
    support was missing. Note that execution on such systems have
    only been rudimentary tested.
  * erl_interface: Fixed configure tests for a few ARM-specific
    instructions, which prevented the emulator from being built on
    some platforms.
  * eldap: Added a new function eldap:info/1 that returns the
    socket and the transport protocol for the eldap connection.
  * inets: Correct timing related pipelining/keepalive queue bug,
    that could result in unexpected "socket_remotly_closed" errors.
  * inets: With this change, upon remote socket closure current
    request is added to a retried queue (either pipeline or
    keep_alive, but not both).
  * ssl: With this change, ssl:connection_information/2 returns
    correct keylog data after TLS1.3 key update.
  * ssl: Client signature algorithm list input order is now honored
    again , it was accidently reversed by a previous fix.
  * stdlib: The type specs in the erl_parse module has been updated
    to include the maybe construct and the ! operator.
  * wx: Improve debug prints from the nifs. Some minor fixes for
    wxWidgets-3.2. Fixed OpenGL debug functions.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1687521600">- Changes for 25.3.2.2:
  * compiler: The compiler could be very slow when compiling guards
    with multiple guard tests separated with 'or' or ';'.
- Changes for 25.3.2.1:
  * xmerl: New options to xmerl_scan and xmerl_sax_parser so one
    can limit the behaviour of the parsers to avoid some XML
    security issues. xmerl_scan gets one new option:
    xmerl_sax_parser gets the following options: The old option
    skip_external_dtd is still valid and the same as
    {external_entities, none} and {fail_undeclared_ref, false} but
    just affects DTD's and not other external references.
  * erts: Fixed a crash during tracing on certain platforms that
    cannot use the machine stack for Erlang code (mainly OpenBSD
    and Linux with musl).
  * erts: Constructing a binary segment not aligned with a byte
    boundary, with a size not fitting in 31 bits, and with a value
    not fitting in a 64-bit word could crash the runtime system.
  * erts: Further robustify implementation of large maps (&gt; 32
    keys). Keys that happen to have same internal 32-bit hash
    values are now put in collision nodes which are traversed with
    linear search. This removes the demand for the internal hash
    function when salted to eventually produce different hashes for
    all possible pairs of unequal terms.
  * stdlib: Static supervisors are very idle processes after they
    have started so they will now be hibernated after start to
    improve resource management.
  * compiler: Fixed a bug where a failing bsl expression in a guard
    threw an exception instead of causing the guard to fail.
  * compiler: Complex guard expression using the or operator and
    guard BIFs that can fail could sometimes be miscompiled so that
    the guard would succeed even if a call to a guard BIF failed.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1687608000">- Version 26.0:
  * Leex has been extended with optional column number support.
  * The family of enumeration functions in module lists has been
    extended with enumerate/3 that allows a step value to be
    supplied.
  * Update Unicode to version 15.0.0.
  * proc_lib:start*/* has become synchronous when the started
    process fails. This requires that a failing process use a new
    function proc_lib:init_fail/2,3, or exits, to indicate failure. All
    OTP behaviours have been fixed to do this.
  * auto-complete of variables, record names, record fields names,
    map keys, function parameter types and filenames.
  * Open external editor in the shell to edit the current
    expression.
  * defining records (with types), functions, specs and types in
    the shell.
  * Creation and matching of binaries with segments of fixed sizes
    have been optimized.
  * Creation and matching of UTF-8 segments have been optimized.
  * Appending to binaries has been optimized.
  * The compiler and JIT now generate better code for creation of
    small maps where all keys are literals known at compile time.
  * Thanks to the optimizations above the performance of the base64
    module has been significantly improved. For example, on an
    x86_64 system with the JIT both encode and decode are almost
    three times faster than in Erlang/OTP 25.
  * Map comprehensions as suggested in EEP 58 has now been
    implemented.
  * Some map operations have been optimized by changing the
    internal sort order of atom keys. This changes the
    (undocumented) order of how atom keys in small maps are printed
    and returned by maps:to_list/1 and maps:next/1. The new order
    is unpredictable and may change between different invocations
    of the Erlang VM.
  * Introducing the new function maps:iterator/2 for creating an
    interator that return the map elements in a deterministic
    order. There are also new modifiers k and K for the format
    string in io:format() to support printing map elements ordered.
  * Added the new built-in type dynamic() introduced in EEP 61, PR
    introducing EEP 61 improving support for gradual type checkers.
  * Dialyzer has a new incremental mode that be invoked by giving
    the --incremental option when running Dialyzer. This new
    incremental mode is likely to become the default in a future
    release.
  * Multi time warp mode is now enabled by default. This assumes
    that all code executing on the system is time warp safe.
  * Support for UTF-8 atoms and strings in the NIF interface
    including new functions enif_make_new_atom,
    enif_make_new_atom_len and enif_get_string_length.
  * The BIFs min/2 and max/2 are now allowed to be used in guards
    and match specs.
  * Improved the selective receive optimization, which can now be
    enabled for references returned from other functions. This
    greatly improves the performance of gen_server:send_request/3,
    gen_server:wait_response/2, and similar functions.
  * It is no longer necessary to enable a feature in the runtime
    system in order to load modules that are using it. It is
    sufficient to enable the feature in the compiler when compiling
    it.
  * inet:setopts/2 has got 3 new options: reuseport, reuseport_lb
    and exclusiveaddruse.
  * Fix so that -fno-omit-frame-pointer is applied to all of the
    Erlang VM when using the JIT so that tools, such as perf, can
    crawl the process stacks.
  * In the lists module, the zip family of functions now takes
    options to allow handling lists of different lengths.
  * Added the zip:zip_get_crc32/2 function to retrieve the CRC32
    checksum from an opened ZIP archive. gen_server optimized by
    caching callback functions
  * The modules Erlang DNS resolver inet_res and helper modules
    have been updated for RFC6891; to handle OPT RR with DNSSEC OK
    (DO) bit.
  * Introduced application:get_supervisor/1.
  * Cache OTP boot code paths, to limit how many folders that are
    being accessed during a module lookup. Can be disabled with
  - cache_boot_path false.
  * Support for Kernel TLS (kTLS), has been added to the SSL
    application, for TLS distribution (-proto_dist inet_tls), the
    SSL option {ktls, true}.
  * Improved error checking and handling of ssl options.
  * Mitigate memory usage from large certificate chains by lowering
    the maximum handshake size. This should not effect the common
    cases, if needed it can be configured to a higher value.
  * For security reasons the SHA1 and DSA algorithms are no longer
    among the default values.
  * Add encoding and decoding of use_srtp hello extension to
    facilitate for DTLS users to implement SRTP functionality.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1687608001">- Changes for 26.0.1:
  * erts: Build of the socket nif failed on Solaris 11.
  * erts: Fixed two reduction-counting bugs relating to binaries.
  * erts: Constructing a binary segment not aligned with a byte
    boundary, with a size not fitting in 31 bits, and with a value
    not fitting in a 64-bit word could crash the runtime system.
  * erts: When a binary construction failed because of bad size for
    a segment, the error information was not always correct.
  * erts: Fixed a crash when calling a fun that was defined in a
    module that had been upgraded.
  * kernel: The POSIX error exdev was sometimes incorrectly
    described as "cross domain link" in some error messages.
  * kernel: Corrected the socket send function description (send
    with Timeout = nowait). The send function(s) could not return
    {ok, {RestData, SelectInfo}}
  * stdlib: The POSIX error exdev was sometimes incorrectly
    described as "cross domain link" in some error messages.
  * ssl: Make sure that selection of client certificates handle
    both TLS-1.3 and TLS-1.2 names correctly. Could cause valid
    client certificate to not be selected, and an empty client
    certificate message to be sent to server.
  * ssl: Improved ssl:format_error/1 to handle more error tuples.
  * ssl: Fixed hanging ssl:connect when ssl application is not
    started.
  * ssl: Correct handling of retransmission timers, current
    behavior could cause unwanted delays.
  * inets: Do not make the default ssl options by calling
    httpc:ssl_verify_host_options(true) if ssl options are supplied
    by the user.
  * xmerl: New options to xmerl_scan and xmerl_sax_parser so one
    can limit the behaviour of the parsers to avoid some XML
    security issues. xmerl_scan gets one new option:
    xmerl_sax_parser gets the following options: The old option
    skip_external_dtd is still valid and the same as
    {external_entities, none} and {fail_undeclared_ref, false} but
    just affects DTD's and not other external references.
  * compiler: Fixed a bug where a failing bsl expression in a guard
    threw an exception instead of causing the guard to fail.
  * compiler: Fixed a bug that would case the validator to reject
    legal code.
  * compiler: The compiler could re-order clauses matching binaries
    so that the incorrect clause would match. That could only
    happen for code that used the option {error_location,line} or
    for code without line or column number information (e.g.
    generated by a parse transform).
  * compiler: Complex guard expression using the or operator and
    guard BIFs that can fail could sometimes be miscompiled so that
    the guard would succeed even if a call to a guard BIF failed.
  * compiler: With optimizations disabled, a try/catch construct
    could return an incorrect value.
  * compiler: In rare circumstance, a combination of binary
    construction and binary_part/3 would cause the compiler to
    generate unsafe code that would crash the runtime system.
  * compiler: The compiler could be very slow when compiling guards
    with multiple guard tests separated with 'or' or ';'.
  * compiler: Complex guard expressions using 'or' and map updates
    could succeed even if the map update failed.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1698235200">- Changes for 26.1.2:
  * erts: If the external term format encoding of an argument list
    part of a distributed spawn operation was faulty, the newly
    spawned remote process could misbehave. The misbehavior
    included hanging or interpret an incoming message as an
    argument list to use. This was very unlikely to happen unless
    using an alternate implementation of the distribution protocol
    which made a faulty encoding of the argument list. The child
    process will now detect this error and terminate before
    executing the user specified code.
  * erts: Fix bugs where if the body of a matchspec would return a
    map with a variable ('$1', '$_' etc) as one of the keys or
    values and the variable was not an immidiate, the term would
    not be copied to the receiving processes heap. This would later
    corrupt the term in the table as the GC could place move
    markers in it, which in turn would cause the VM to crash. Bug
    has been present for since OTP 17.0.
  * xmerl: The xmerl version 1.3.32 was released in OTP 26.0.1, but
    the incorrect version number of 1.3.31.1 was used for it. This
    incorrect version number continued to appear in OTP 26.0.2, OTP
    26.1, and OTP 26.1.1. The actual xmerl code in these OTP
    versions however corresponds to xmerl version 1.3.32.
- Changes for 26.1.1:
  * wx: The wx application would fail to build on macOS with Xcode
    15.
  * compiler: The compiler could become extremely slow for modules
    containing huge functions.
  * stdlib: Garbage collect the shell process when reducing the
    amount of saved history and results.
- Changes for 26.1:
  * crypto: Fix VM crash caused by crypto being purged and reloaded
    (by init:restart for example) on OS with musl libc (such as
    Alpine linux).
  * crypto: Improved understanding of LibreSSL versions. Support
    chacha20 and chacha20_poly1305 for LibreSSL 3.7. Reflect
    removal of support for the DSS/DSA algorithm which was done in
    LibreSSL 2.6.1.
  * crypto: FIPS supported by crypto for OpenSSL 3.0.* and 3.1.*.
  * asn1: The ASN.1 compiler would ignore a constraint such as
    (SIZE (1..4), ...), causing incorrect behavior of the encoding
    and decoding function for the PER and UPER backends. Corrected
    to handle the constraint in the same way as (SIZE (1..4, ...)).
  * asn1: The JER backend has been internally refactored in a way
    that is compatible for applications that use the documented
    API. However, for a group of ASN.1 modules that depend on each
    other (for example, S1AP-PDU-Descriptions, S1AP-Contents, and
    so on), all modules in the group must be recompiled if on of
    the group members is recompiled.
  * observer: Closing the trace log window via the menu did not
    work.
  * erts: maps:put with existing key and identical value was not
    optimized as a no-op correctly if having the same 32-bit hash
    as another key in the map. In practice very rare and harmless.
  * erts: Fixed an issue with truncated crash slogans on failed
    emulator start.
  * erts: Fixed a bug where the emulator was unable to determine
    the current cgroup CPU quota.
  * erts: A process optimized for parallel signal delivery could
    under some circumstances lose wakeup information. That is, the
    processes was not woken up to take care of the signal, so the
    signal would not be taken care of until the process was woken
    by another signal. Only processes configured with
    message_queue_data set to off_heap utilize this optimization.
  * erts: Function socket:close/1 could cause a VM crash on
    Windows.
  * erts: Fixed a bug in the ARM JIT where it could accidentally
    add garbage trailing bits when creating bitstrings whose size
    wasn't an even multiple of 8 bits.
  * erts: Fix erlang:system_info/1 documentation to show correct
    types.
  * erts: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * erts: Fix compilation with GNU termcap.
  * erts: Delivery time of message signals to a process not
    executing any receive expressions could become very long,
    potentially infinite. For example, a process checking for
    messages using process_info(self(), message_queue_len) or
    process_info(self(), messages) and avoiding to execute a
    receive expression matching on messages could be very slow in
    detecting new messages. Note that you are still discouraged
    from using process_info() this way. A process that wants to
    check if there are messages available to handle should execute
    a receive expression matching on messages.
  * erts: On AArch64 (ARM64), when calculating both the quotient
    and remainder with a divisor begin a power two, the remainder
    could be incorrectly calculated.
  * erts: Fix bug causing "magic" references in a compressed ETS
    table to not keep the referred object alive. The symptom would
    be the referred object being garbage collected prematurely and
    the reference appearing stale, not referring to anything.
    Examples of such magically referred objects are atomics and NIF
    resources.
  * erts: Matching out short bitstrings with a fixed size not
    divisible by 8 could could lead to the runtime system
    terminating with an "Overrun heap and stack" error.
  * erts: A constant flow of incoming non-message signals could
    prevent a process needing to execute dirty from doing so.
  * erts: A BEAM file usually contains a chunk with the tag "Type"
    containing type information that can be used by the JIT. The
    beam_lib:strip/1 takes care to preserve that chunk, but a
    build/release tool that does customized stripping could
    accidentally remove the chunk. Loading a BEAM file without the
    "Type" chunk could cause incorrect behavior of the loaded code.
  * erts: gen_udp:recv/* for Unix Domain Socket in binary mode and
    passive mode has been fixed to not crash.
  * erts: The cleanup operation of not yet delivered signals to a
    terminated process yielded excessively.
  * erts: Fixed minor hashing issue with the local option of
    term_to_binary()/term_to_iovec().
  * erts: Update gen_tcp_socket and gen_udp_socket to handle
    'completion' (socket on Windows).
  * erts: Add support for Unix Domain Sockets (only for STREAM
    sockets) on Windows for 'socket'.
  * erts: In Erlang/OTP 27, by default escripts will be compiled
    before being executed. That means that the compiler application
    must be installed. It is possible to force the escript to be
    interpreted by adding the directive -mode(interpret). to the
    escript file. In Erlang/OTP 28, support for interpreting an
    escript will be removed.
  * erts: Add basic support for socket ioctl on Windows.
  * erts: Removed erts/etc/darwin/Info.plist, as it is no longer
    necessary after macos 10.12
  * erts: Add support for (Windows) socket option exclusiveaddruse.
  * erts: [socket] Add support for the 'nopush' option.
  * erts: Add support for socket option 'BSP STATE'.
  * erts: Add tcp socket options 'keepcnt', 'keepidle' and
    'keepintvl'.
  * erts: Add support for misc (Windows) socket options
    ('max_msg_size' and 'maxdg').
  * compiler: The compiler could run forever when compiling a call
    to is_record/3 with a huge positive tuple size. The call
    is_record(A, a, 0) would crash the compiler when used in a
    function body. When used in a guard the compiler would emit
    incorrect code that would accept {a&gt; as a record.
  * compiler: Fixed a bug that caused dialyzer to crash when
    analyzing bogus code that contained the literal atom undefined
    in segment sizes.
  * compiler: The compiler would crash when compiling some modules
    that contained a call to erlang:load_nif/2.
  * compiler: Fixed a bug that caused the compiler to crash on
    legal code.
  * compiler: The compiler could crash when attempting to compile a
    call to is_list/1 in a complex expression.
  * compiler: A complex guard expression using the or operator
    could succeed when it was supposed to fail.
  * compiler: Compiling nested try/catch and catch expression could
    result in an internal compiler error.
  * compiler: Using the bnot operator in a complex expression could
    cause the compiler to terminate with an internal consistency
    failure diagnostic.
  * compiler: Fixed a bug that caused the compiler to crash in a
    binary optimization pass.
  * compiler: The compiler could terminate with an internal error
    when attempting to compile a binary pattern that could not
    possibly match.
  * compiler: Fixed various performance issues related to the alias
    optimization pass.
  * erl_docgen: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * mnesia: Do not delete old backup file if the new backup fails.
  * megaco: Make megaco transports handle gen_tcp | gen_udp with
    socket backend on Windows (completion).
  * common_test: With this change, ct_hooks manual refers to CTH
    execution order section in user guide.
  * common_test: With this change, Config data from
    pre_end_per_testcase hook is delivered to post_end_per_testcase
    callback in case of testcase timetrap or linked process crash.
  * common_test: With this change, remaining references to not
    supported vts tool in ct_run are removed (mainly relates to
    docs and ct_run help message).
  * common_test: With this change, prompt search functionality in
    ct_telnet handles unicode input.
  * common_test: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * stdlib: The compiler could run forever when compiling a call to
    is_record/3 with a huge positive tuple size. The call
    is_record(A, a, 0) would crash the compiler when used in a
    function body. When used in a guard the compiler would emit
    incorrect code that would accept {a&gt; as a record.
  * stdlib: Fix bug in ets:tab2file that could make it fail if
    another Erlang process created the same file at the same time.
  * stdlib: An {else_clause,Value} exception will now be reported
    nicely in the shell.
  * stdlib: Correct return value for error case, so that it matches
    the documented and intended return value {error,
    {already_started, pid()} when local registered names are used.
  * stdlib: sys:get_state/1,2 and sys:replace_state/2,3 has been
    corrected to handle a state named error as a state name, not as
    a failed system callback. For the standard server behaviours
    this was an issue only for gen_statem (and gen_fsm) when the
    state name was error, and for gen_server if the complete state
    was {error,_}.
  * stdlib: Multiple problems were fixed in
    filelib:safe_relative_path/2. If its second argument was a path
    that contained symbolic links, an incorrect result patch could
    be returned. Also, paths were sometimes falsely considered
    unsafe.
  * stdlib: Fix deadlock when erl.exe is used as part of a pipe on
    Windows and trying to set the encoding of the standard_io
    device.
  * stdlib: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * stdlib: Fix h/2,3 to properly render multi-clause
    documentation.
  * stdlib: Timers created by timer:apply_after/4,
    apply_interval/4, and apply_repeatedly/4 would silently fail to
    do the apply if it was not possible to spawn a process when the
    timer expired. This has now been corrected, and if the spawn
    fails, the system will be taken down producing a crash dump.
  * stdlib: When an Erlang source file lacked a module definition,
    there would be a spurious "module name must not be empty"
    diagnostic for each spec in the file.
  * stdlib: The argument descriptions for option types in argparse
    have been made less ambiguous.
  * stdlib: Clarified the documentation of normal shutdown reason
    on gen_server:call/2,3
  * stdlib: Pattern matching and equivalence (=:=, =/=) comparisons
    on 0.0 will now raise a warning, as it will no longer be
    considered equivalent to -0.0 in OTP 27. If a match on 0.0
    specifically is desired (distinct from -0.0), the warning can
    be suppressed by writing +0.0 instead. The arithmetic
    comparison operators are unaffected, including arithmetic
    equality (==). *** POTENTIAL INCOMPATIBILITY ***
  * stdlib: The semantics of the gen_{server,statem,event}
    behaviour's synchronous start behaviour introduced in OTP-26.0
    with OTP-18471, has been clarified in the documentation.
  * stdlib: Added functionality to set a custom multiline prompt.
  * stdlib: A warning for (accidental use of) Triple-Quoted Strings
    has been implemented as per EEP 64. *** POTENTIAL
    INCOMPATIBILITY ***
  * stdlib: The keyboard shortcuts for the shell are now
    configurable.
  * kernel: Fixed an issue with truncated crash slogans on failed
    emulator start.
  * kernel: Fix shell:start_interactive function specification.
  * kernel: Fix code:get_doc/1 to return missing, when it can't
    find erts instead of crashing.
  * kernel: Function socket:close/1 could cause a VM crash on
    Windows.
  * kernel: Fix deadlock when erl.exe is used as part of a pipe on
    Windows and trying to set the encoding of the standard_io
    device.
  * kernel: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * kernel: Fix logger's overload protection mechanism to only
    fetch memory used by messages when needed.
  * kernel: Fixed a number of socket-related issues causing
    incompatibilities with gen_tcp and gen_udp respectively.
  * kernel: gen_tcp:connect with socket address and socket (inet-)
    backend fails because of missing callback function.
  * kernel: The DNS RR cache used by `inet_res` has been fixed to
    preserve insert order, which is beneficial when the DNS server
    returns RRs in some specific order for e.g load balancing
    purposes.
  * kernel: The options `reuseport`, `reuseport_lb` and
    `exclusiveaddruse` were accidentally not allowed for e.g
    `gen_udp:open/1,2`, which has now been corrected.
  * kernel: gen_udp:recv/* for Unix Domain Socket in binary mode
    and passive mode has been fixed to not crash.
  * kernel: Fixed issue where cursor would not be placed at the end
    of the expression when navigating shell history.
  * kernel: Update gen_tcp_socket and gen_udp_socket to handle
    'completion' (socket on Windows).
  * kernel: Add support for Unix Domain Sockets (only for STREAM
    sockets) on Windows for 'socket'.
  * kernel: Add basic support for socket ioctl on Windows.
  * kernel: The file:location/0 type is now exported.
  * kernel: Add support for (Windows) socket option
    exclusiveaddruse.
  * kernel: [socket] Add support for the 'nopush' option.
  * kernel: Add support for socket option 'BSP STATE'.
  * kernel: Add tcp socket options 'keepcnt', 'keepidle' and
    'keepintvl'.
  * kernel: Add support for misc (Windows) socket options
    ('max_msg_size' and 'maxdg').
  * kernel: The keyboard shortcuts for the shell are now
    configurable.
  * kernel: Optimized code_server to reduce repeated work when
    loading the same module concurrently.
  * debugger: The call int:no_break(Module) did not remove any
    breakpoints.
  * debugger: The maybe expression is now supported in the
    Debugger.
  * debugger: The maybe expression is now supported in the
    Debugger.
  * debugger: The call int:no_break(Module) did not remove any
    breakpoints.
  * ssl: Avoid function clause error in ssl:getopts/2 by handling
    that inet:getopts may return an empty list during some
    circumstances, such as the socket being in a closing state.
  * ssl: The API function `ssl:recv/3` has been tightened to
    disallow negative length, which has never been documented to
    work, but was passed through and caused strange errors.
  * ssl: When a client initiated renegotiation was rejected and the
    client socket was in active mode the expected error message to
    the controlling process was not sent.
  * ssl: Add some guidance for signature algorithms configuration
    in ssl applications users guide.
  * snmp: Make snmp handle gen_udp with socket backend on Windows
    (completion).
  * public_key: Country name comparison shall be case insensitive
  * public_key: Add check to disallow duplicate certs in a path
  * inets: With this change, re_write httpd works as expected and
    does not return error.
  * inets: Fixed a bug so httpd does not crash when stopped at the
    wrong time during TLS connection negotiation, or any other
    theoretically as slow connection setup.
  * inets: Enhance error handling and avoid that the HTTP client
    hangs on headers provided on the wrong format.
  * inets: With this change, error report generated by httpd during
    connection setup contains socket type information.
  * inets: Stop and restart of the httpd server in the Inets
    application has been refactored to a more synchronous and OTP
    supervisor friendly approach. This should increase stability
    and for example avoid a supervisor report from
    httpd_connection_sup about killed child process(es) in some
    cases when stopping or restarting httpd.
  * dialyzer: Fixed a bug that caused dialyzer to crash when
    analyzing bogus code that contained the literal atom undefined
    in segment sizes.
  * dialyzer: Dialyzer could crash when attempting to analyze a
    module that defined a type called product/.
- Changes for 26.0.2:
  * erts: Fix using the IME (Input Method Editor) to enter text in
    cmd.exe and powershell.exe on Windows.
  * erts: Multiple socket:accept calls issue. When making multiple
    accept calls, only the last call is active.
  * erts: Fix the shell to ignore terminal delay when the terminal
    capabilities report that they should be used.
  * erts: Fix "oldshell" to echo characters while typing on
    Windows.
  * erts: On Windows, a call to the function socket:close, when
    there are waiting active calls to read, write or accept
    functions, could hang.
  * erts: Fix issues when reading or configuring standard_io on
    Windows when erl.exe is started using -noshell flag.
  * erts: The following functions are now much faster when given a
    long list or binary:
  * erts: On AArch64 (ARM64), equality and non-equality tests with
    literal bitstrings could succeed when they should fail and vice
    versa.
  * compiler: Fixed a type handling bug that would cause an
    internal consistence failure for correct code.
  * compiler: Fixed a bug that could cause the stack trace of throw
    exceptions to be erroneously optimized out.
  * compiler: Complex guard expression using 'or' were not always
    fully evaluated, making guards that were supposed to fail
    succeed.
  * stdlib: Fix bug where when you entered Alt+Enter in the
    terminal, the cursor would move to the last line, instead of
    moving to the next line.
  * stdlib: Fix eof handling when reading from stdin when erlang is
    started using -noshell.
  * stdlib: Fixed problem where output would disappear if it was
    received after a prompt was written in the shell.
  * stdlib: The following functions are now much faster when given
    a long list or binary:
  * kernel: Fix bug where when you entered Alt+Enter in the
    terminal, the cursor would move to the last line, instead of
    moving to the next line.
  * kernel: Fix so that the shell does not crash on startup when
    termcap is not available.
  * kernel: Multiple socket:accept calls issue. When making
    multiple accept calls, only the last call is active.
  * kernel: Fix the shell to ignore terminal delay when the
    terminal capabilities report that they should be used.
  * kernel: Fix "oldshell" to echo characters while typing on
    Windows.
  * kernel: Fix eof handling when reading from stdin when erlang is
    started using -noshell.
  * kernel: On Windows, a call to the function socket:close, when
    there are waiting active calls to read, write or accept
    functions, could hang.
  * kernel: Fix issues when reading or configuring standard_io on
    Windows when erl.exe is started using -noshell flag.
  * kernel: gen_udp:connect with inet_backend = socket fails when
    the Address is a hostname (string or atom).
  * kernel: Fixed problem which would cause shell to crash if
    particular escape sequence was written to stdout.
  * kernel: Fixed problem where output would disappear if it was
    received after a prompt was written in the shell.
  * kernel: Fix a crash where the location of erts could not be
    found in rebar3 dev builds.
  * kernel: Introduce the KERNEL application parameter
    standard_io_encoding that can be used to set the default
    encoding for standard_io. This option needs to be set to latin1
    if the application wants to treat all input data as bytes
    rather than utf-8 encoded characters.
  * ssl: Added keylog information to all protocol versions in
    ssl:connection_information/2.
  * ssl: Add RFC-6083 considerations for DTLS to enable gen_sctp
    based callback for the transport.
  * ssh: Added multiline editing support to ssh clients connected
    through OTP ssh daemon.</changelog>
  <changelog author="sflees@suse.de" date="1704974400">- Changes for 26.2.1:
  * erts: Removed unnecessary PCRE source tar-ball.
  * ssh: With this change (being response to CVE-2023-48795),
    ssh can negotiate "strict KEX" OpenSSH extension with
    peers supporting it; also
    'chacha20-poly1305@openssh.com' algorithm becomes a
    less preferred cipher.
    If strict KEX availability cannot be ensured on both
    connection sides, affected encryption modes(CHACHA and
    CBC) can be disabled with standard ssh configuration.
    This will provide protection against vulnerability, but
    at a cost of affecting interoperability. See
    Configuring algorithms in SSH. (bsc#1218192, CVE-2023-48795)
- Changes for 26.2:
  * all: Replaced unintentional Erlang Public License 1.1
    headers in some files with the intended Apache License
    2.0 header.
  * otp: The removal of the deprecated slave module, originally
    planned for OTP 27, has been postponed to OTP 29.
  * asn1: Fix benign warning from gcc 11 about mismatching call
    to free().
  * crypto: Enable engine support for OpenSSL versions 3.
  * edoc: Emit &lt;code&gt; instead of &lt;tt&gt;.
- Disable test suite for now, it has many false positives and
  takes a very long time.</changelog>
  <changelog author="sflees@suse.de" date="1706011200">- This codestream wasn't affected by bsc#1207113</changelog>
  <changelog author="sflees@suse.de" date="1706011201">- Disable rpmlint tests on SLE-15 where they currently fail</changelog>
  <changelog author="sflees@suse.de" date="1715947200">- Create a versioned package for SLES</changelog>
</package>
<package pkgid="8ca6431ed492fde5a7ee81760e2a1e53d4b69be744d7173c1024020a1214ac8b" name="erlang26-debugger" arch="ppc64le">
  <version epoch="0" ver="26.2.1" rel="150300.7.5.1"/>
  <changelog author="matwey.kornilov@gmail.com" date="1646568000">- Changes for 24.2.2:
  * inets: Avoid intermediate ungraceful shutdown of the HTTP
    server.
  * ssh: The ssh sever parallel_login option was missing in OTP-24</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1648382400">- Changes for 24.3.2:
  * erl_interface: Fix compile error regarding gethostbyaddr_r on
    Android. Error introduced in OTP 24.3.
  * kernel: Fix failed accepted connection setup after previous
    established connection from same node closed down silently.
  * kernel: Fixed a problem where typing Ctrl-R in the shell could
    hang if there were some problem with the history log file.
- Changes for 24.3.1:
  * dialyzer: There could be spurious warnings for unknown types
    when a type was a subtype of an existing type that was a
    subtype of an unknown type.
  * ssl: Client certification could fail for TLS-1.3 servers that
    did not include the certificat_authorties extension in its
    certificate request message.
- Changes for 24.3:
  * megaco: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.
  * megaco: Update the performance and debug chapters of the megaco
    user's guide. Also some updates to the meas tools.
  * compiler: The expression &lt;&lt;0/native-float&gt;&gt;=Bin would always
    fail to match, while &lt;&lt;0/float-native&gt;&gt;=Bin would match
    (provided that Bin contained the binary representation of 0.0)
  * compiler: The compiler will now compile huge functions with
    straight-line code faster.
  * erl_interface: Add --enable-ei-dynamic-lib configure option
    that will make erl_interface also release a dynamic library
    version of libei.
  * erl_interface: The ei API for decoding/encoding terms is not
    fully 64-bit compatible since terms that have a representation
    on the external term format larger than 2 GB cannot be handled.
  * sasl: Fix bug in systools:make_script/1 documentation.
  * inets: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.
  * inets: Documentation fix for inets:services_info/0, which now
    describes that Info might be a Reason term() in case when
    {error, Reason} is returned as service info.
  * crypto: The crypto app in OTP can since OTP-24.2 be compiled,
    linked and used with the new OpenSSL 3.0 cryptolib. The crypto
    app has 3.0 support has been improved, but is still *not
    recommended* for other usages than experiments and alpha
    testing. There are not yet any guaranties that it works, not
    even together with other OTP applications like for example SSL
    and SSH, although there are no known errors. Since the previous
    release, OTP-24.2, the following improvements have been done: -
    It has been tested during nearly every nightly test on the OTP
    lab - The hash algorithms md4 and ripemd160 have been enabled
    with OpenSSL 3.0. - The ciphers blowfish_cbc, blowfish_ecb,
    des_cbc, des_cfb, des_ecb, rc2_cbc and rc4 have been enabled
    with OpenSSL 3.0. Disabled or unsupported with OpenSSL 3.0 are
    still: - ENGINE support - FIPS mode - Other providers than the
    built-in ones - Compiling and linking with OpenSSL 3.0
    cryptolib in compatibility modes (for example to behave as
    1.1.1) and, the ciphers blowfish_cfb64 and blowfish_ofb64 are
    not supported and will not be either. Deprecated functions in
    the OpenSSL 3.0 cryptolib must not be disabled as OTP/crypto
    still uses some of the deprecated API functions. The gcc flag
  - Wno-deprecated-declarations is set to prevent deprecation
    warnings to be printed when compiling.
  * crypto: Crypto is adapted to LibreSSL 3.5.0 on OpenBSD.
  * crypto: New configure option ( --disable-otp-test-engine) to
    prohibit the build of the OTP test engine used in some test
    suites. The reason is that the test engine could be hard to
    compile on for instance LibreSSL 3.5.0. For that particular
    cryptolib version (or higher), this configure option is set
    automatically.
  * jinterface: Fix bug in OtpOutputStream.write_pid/4 and
    write_ref/3 causing faulty encodig. Bug exists since OTP 23.0.
  * wx: Removed the static_data option from wxImage creation
    functions, as it was broken and could lead to crashes. Now
    image data is always copied to wxWidgets as was the default
    behavior. Removed some non working wxGridEvent event types,
    which have there own events in newer wxWidgets versions, and
    added a couple of event types that where missing in wx.
  * asn1: Add support for the maps option in combination with the
    jer backend.
  * snmp: The compilation time is no longer recorded in BEAM files.
    There remained several undocumented functions that attempted to
    retrieve compilation times. Those have now been removed.
  * snmp: [agent] Remove expectation of socket being a port.
  * common_test: OTP internal test fix.
  * runtime_tools: Fixed bug in scheduler:utilization(Seconds) that
    would leave the scheduler_wall_time system flag incorrectly
    enabled.
  * runtime_tools: Add scheduler:get_sample/0 and get_sample_all/0.
    Also clarify scheduler module documentation about how it
    depends on system flag scheduler_wall_time.
  * erts: Fixed a bug in the x86 JIT that might cause floating
    point instructions to wrongly throw an exception.
  * erts: Preserve correct nodedown_reason if supervised
    distribution controller processes exit with {shutdown, Reason}.
  * erts: Handling of send_timeout for gen_tcp has been corrected
    so that the timeout is honored also when sending 0 bytes.
  * erts: By default global does not take any actions to restore a
    fully connected network when connections are lost due to
    network issues. This is problematic for all applications
    expecting a fully connected network to be provided, such as for
    example mnesia, but also for global itself. A network of
    overlapping partitions might cause the internal state of global
    to become inconsistent. Such an inconsistency can remain even
    after such partitions have been brought together to form a
    fully connected network again. The effect on other applications
    that expects that a fully connected network is maintained may
    vary, but they might misbehave in very subtle hard to detect
    ways during such a partitioning. In order to prevent such
    issues, we have introduced a prevent overlapping partitions fix
    which can be enabled using the prevent_overlapping_partitions
    kernel(6) parameter. When this fix has been enabled, global
    will actively disconnect from nodes that reports that they have
    lost connections to other nodes. This will cause fully
    connected partitions to form instead of leaving the network in
    a state with overlapping partitions. Note that this fix has to
    be enabled on all nodes in the network in order to work
    properly. Since this quite substantially changes the behavior,
    this fix is currently disabled by default. Since you might get
    hard to detect issues without this fix you are, however,
    strongly advised to enable this fix in order to avoid issues
    such as the ones described above. As of OTP 25 this fix will
    become enabled by default.
  * erts: Corrected the type specification of erlang:seq_trace/2.
  * erts: Fix memory leak when tracing on running on a process that
    only handle system tasks or non-message signals (for example
    process_info requests).
  * erts: Add support for using socket:sockaddr_in() and
    socket:sockaddr_in6() when using gen_sctp, gen_tcp and gen_udp.
    This will make it possible to use Link Local IPv6 addresses.
  * erts: Show on_load failure reasons in embedded mode.
  * erts: Compile date saved in the Erlang VM executable has been
    removed.
  * erts: Improve documentation for the dynamic node name feature.
  * ssh: Fix makefile dependency bugs.
  * ssh: Fixed faulty OpenSSH decoding of Ed25519/Ed448 keys in the
    OpenSSH format openssh_key_v1.
  * ssh: Correction of ssh_file typing, specially for the
    experimental openssh-key-v1 encoding.
  * ssh: Improper tag for private ED keys when encoding with
    ssh:encode/2. The tuple had ed_priv as first element, but
    should have had ed_pri. This is now corrected. *** POTENTIAL
    INCOMPATIBILITY ***
  * ssh: Add support for Ed25519/Ed448 SSH host keys in the RFC
    4716 format ("-----BEGIN EC PRIVATE KEY-----") generated by for
    example openssl or via Erlang functions (i.e.
    public_key:generate_key({namedCurve, ed25519})). Ed25519 SSH
    host keys generated by ssh-keygen was, and are still,
    supported.
  * kernel: Handling of send_timeout for gen_tcp has been corrected
    so that the timeout is honored also when sending 0 bytes.
  * kernel: By default global does not take any actions to restore
    a fully connected network when connections are lost due to
    network issues. This is problematic for all applications
    expecting a fully connected network to be provided, such as for
    example mnesia, but also for global itself. A network of
    overlapping partitions might cause the internal state of global
    to become inconsistent. Such an inconsistency can remain even
    after such partitions have been brought together to form a
    fully connected network again. The effect on other applications
    that expects that a fully connected network is maintained may
    vary, but they might misbehave in very subtle hard to detect
    ways during such a partitioning. In order to prevent such
    issues, we have introduced a prevent overlapping partitions fix
    which can be enabled using the prevent_overlapping_partitions
    kernel(6) parameter. When this fix has been enabled, global
    will actively disconnect from nodes that reports that they have
    lost connections to other nodes. This will cause fully
    connected partitions to form instead of leaving the network in
    a state with overlapping partitions. Note that this fix has to
    be enabled on all nodes in the network in order to work
    properly. Since this quite substantially changes the behavior,
    this fix is currently disabled by default. Since you might get
    hard to detect issues without this fix you are, however,
    strongly advised to enable this fix in order to avoid issues
    such as the ones described above. As of OTP 25 this fix will
    become enabled by default.
  * kernel: Fix bug where logger would crash when logging a report
    including improper lists.
  * kernel: Make erlang:set_cookie work for dynamic node names.
  * kernel: Add support for using socket:sockaddr_in() and
    socket:sockaddr_in6() when using gen_sctp, gen_tcp and gen_udp.
    This will make it possible to use Link Local IPv6 addresses.
  * kernel: A net_tickintensity kernel parameter has been
    introduced. It can be used to control the amount of ticks
    during a net_ticktime period. A new net_kernel:start/2 function
    has also been introduced in order to make it easier to add new
    options. The use of net_kernel:start/1 has been deprecated.
  * kernel: Improve documentation for the dynamic node name
    feature.
  * erl_docgen: Fix css for large tables and images on small
    screens
  * erl_docgen: Fix bug with codeinclude tag that caused it to not
    include the code if used in a correct, but unexpected way.
  * observer: Calculate the display width in etop, instead of hard-
    coding it to 89 characters.
  * debugger: Fix record index matching, it was broken and could
    never match.
  * ssl: Improved error handling.
  * ssl: Before this change, net_kernel used with TLS distribution
    might be leaking processes in case of connectivity issues.
  * ssl: Fix makefile dependency bugs.
  * ssl: Make sure the TLS sender process handles explicit calls to
    erlang:disconnect_node properly, avoiding potential hanging
    problems in net_kernel.
  * ssl: Add support for TLS-1.3 certificate_authorities extension.
    And process certificate_authorities field in pre-TLS-1.3
    certificate requests.
  * ssl: Support password fun for protected keyfiles in ssl:connect
    function.
  * ssl: Add in some cases earlier detection of possible DoS
    attacks by malicious clients sending unexpected TLS messages
    instead of the client hello. Note that such attacks are already
    mitigated by providing a timeout for the TLS handshake.
  * eldap: Fix eldap extensibleMatch dnAttributes option. According
    to the ldap ASN1 the dnAttributes should be a bool, instead it
    was generated as a string.
  * eldap: Implemented paged searches according to https://www.rfc-
    editor.org/rfc/rfc2696.txt
  * public_key: Support password fun for protected keyfiles in
    ssl:connect function.
  * stdlib: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.
  * mnesia: Reduce the number of locks taken during table copying,
    should reduce the startup time on large systems.
  * diameter: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1649246400">- Fix build for Factory. Currently, any Java version
  is fine for Erlang.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1653220800">- Version 25.0:
  - stdlib
  * New function filelib:ensure_path/1 will ensure that all
    directories for the given path exists
  * New functions groups_from_list/2 and groups_from_list/3 in
    the maps module
  * New functions uniq/1 uniq/2 in the lists module
  * New PRNG added to the rand module, for fast pseudo-random
    numers.
  - compiler, kernel, stdlib, syntax_tools:
  * Added support for selectable features as described in EEP-60.
    Features can be enabled/disabled during compilation with
    options (ordinary and +term) to erlc as well as with
    directives in the file. Similar options can be used to erl
    for enabling/disabling features allowed at runtime. The new
    maybe expression EEP-49 is fully supported as the feature
    maybe_expr.
  - erts &amp; JIT:
  * The JIT now works for 64-bit ARM processors.
  * The JIT now does type-based optimizations based on type
    information in the BEAM files.
  * Improved the JIT’s support for external tools like perf and
    gdb, allowing them to show line numbers and even the original
    Erlang source code when that can be found.
  - erts, stdlib, kernel:
  * Users can now configure ETS tables with the
    {write_concurrency, auto} option. This option forces tables
    to automatically change the number of locks that are used at
    run-time depending on how much concurrency is detected. The
    {decentralized_counters, true} option is enabled by default
    when {write_concurrency, auto} is active.
  * Benchmark results comparing this option with the other ETS
    optimization options are available here: benchmarks.
  * To enable more optimizations, BEAM files compiled with OTP 21
    and earlier cannot be loaded in OTP 25.
  * The signal queue of a process with the process flag
    message_queue_data=off_heap has been optimized to allow
    parallel reception of signals from multiple processes. This
    can improve performance when many processes are sending in
    parallel to one process. See benchmark.
  * The Erlang installation directory is now relocatable on the
    file system given that the paths in the installation’s
    RELEASES file are paths that are relative to the
    installations root directory.
  * A new option called short has been added to the functions
    erlang:float_to_list/2 and erlang:float_to_binary/2. This
    option creates the shortest correctly rounded string
    representation of the given float that can be converted back
    to the same float again.
  * Introduction of quote/1 and unquote/1 functions in the
    uri_string module - a replacement for the deprecated
    functions http_uri:encode and http_uri:decode.
  * The new module peer supersedes the slave module. The slave
    module is now deprecated and will be removed in OTP 27.
  * global will now by default prevent overlapping partitions due
    to network issues. This is done by actively disconnecting
    from nodes that reports that they have lost connections to
    other nodes. This will cause fully connected partitions to
    form instead of leaving the network in a state with
    overlapping partitions.
  * It is possible to turn off the new behavior by setting the
    the kernel configuration parameter
    prevent_overlapping_partitions to false. Doing this will
    retain the same behavior as in OTP 24 and earlier.
  * The format_status/2 callback for gen_server, gen_statem and
    gen_event has been deprecated in favor of the new
    format_status/1 callback.
  * The new callback adds the possibility to limit and change
    many more things than the just the state.
  * The timer module has been modernized and made more efficient,
    which makes the timer server less susceptible to being
    overloaded. The timer:sleep/1 function now accepts an
    arbitrarily large integer.
  - compiler:
  * The maybe ... end construction as proposed in EEP-49 has been
    implemented. It can simplify complex code where otherwise
    deeply nested cases would have to be used.
  * To enable maybe, give the option {enable_feature,maybe_expr}
    to the compiler. The exact option to use will change in a
    coming release candidate and then it will also be possible to
    use from inside the module being compiled.
  * When a record matching or record update fails, a {badrecord,
    ExpectedRecordTag} exception used to be raised. In this
    release, the exception has been changed to {badrecord,
    ActualValue}, where ActualValue is the value that was found
    instead of the expected record.
  * Add compile attribute -nifs() to empower compiler and loader
    with information about which functions may be overridden as
    NIFs by erlang:load_nif/2.
  * Improved and more detailed error messages when binary
    construction with the binary syntax fails. This applies both
    for error messages in the shell and for
    erl_error:format_exception/3,4.
  * Change format of feature options and directives for better
    consistency. Options to erlc and the -compile(..) directive
    now has the format {feature, feature-name, enable | disable}.
    The -feature(..) now has the format -feature(feature-name,
    enable | disable).
  - crypto:
  * Add crypto:hash_equals/2 which is a constant time comparision
    of hashvalues.
  - ssl:
  * Introducing a new (still experimental) option
    {certs_keys,[cert_key_conf()]}. With this a list of a
    certificates with their associated key may be used to
    authenticate the client or the server. The certificate key
    pair that is considered best and matches negotiated
    parameters for the connection will be selected.
  - public_key:
  * Functions for retrieving OS provided CA-certs added.
  - dialyzer:
  * Optimize operations in the erl_types module. Parallelize the
    Dialyzer pass remote.
  * Added the missing_return and extra_return options to raise
    warnings when specifications differ from inferred types.
    These are similar to, but not quite as verbose as overspecs
    and underspecs.
  * Dialyzer now better understands the types for min/2, max/2,
    and erlang:raise/3. Because of that, Dialyzer can potentially
    generate new warnings. In particular, functions that use
    erlang:raise/3 could now need a spec with a no_return()
    return type to avoid an unwanted warning.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1656849600">- Changes for 25.0.2:
  * ssl: Improved handling of unexpected messages during the
    handshake, taking the right action for unexpected messages.
  * erts: On computers with the ARM64 (AArch64) architecture (such
    as Apple Silicon Macs) a rem expression followed by a div
    expression with the same operands could evaluate to the wrong
    result if the result of the rem expression was unused.
- Changes for 25.0.1:
  * ssl: When a TLS-1.3 enabled client tried to talk to a TLS-1.2
    server that coalesces TLS-1.2 handshake message over one TLS
    record, the connection could fail due to some message being
    handled in the wrong state, this has been fixed.
  * ssl: Correctly handles supported protocol version change from
    default to something else by sni_fun supplied to
    ssl:handshake/[2,3] together with a TCP-socket (so called
    upgrade).
  * ssl: Also, TLS-1.3 should respond with a protocol version alert
    if previous versions, that are supported but not configured,
    are attempted.
  * kernel: The DNS resolver inet_res has been fixed to ignore
    trailing dot difference in the request domain between the sent
    request and the received response, when validating a response.
  * kernel: A bug in inet_res has been fixed where a missing
    internal {ok,_} wrapper caused inet_res:resolve/* to return a
    calculated host name instead of an `{ok,Msg} tuple, when
    resolving an IP address or a host name that is an IP address
    string.
  * kernel: The erlang:is_alive() BIF could return true before
    configured distribution service was available. This bug was
    introduced in OTP 25.0 ERTS version 13.0. The
    erlang:monitor_node() and erlang:monitor() BIFs could
    erroneously fail even though configured distribution service
    was available. This occurred if these BIFs were called after
    the distribution had been started using dynamic node name
    assignment but before the name had been assigned.
  * kernel: Added the missing mandatory address/0 callback in the
    gen_tcp_dist example.
  * erts: A spawn_reply signal from a remote node could be delayed
    and be delivered after other signals from the newly spawned
    process. When this bug triggered, the connection to the node
    where the process was spawned sometimes could be taken down due
    to the bug. The following error message would then be logged if
    this happened: Missing 'spawn_reply' signal from the node
    &lt;RemoteNode&gt; detected by &lt;Pid&gt; on the node &lt;LocalNode&gt;. The
    node &lt;RemoteNode&gt; probably suffers from the bug with ticket id
    OTP-17737. This bug only affected processes which had enabled
    off_heap message_queue_data and parallel reception of signals
    had been automatically enabled. This bug was introduced in OTP
    25.0, ERTS version 13.0.
  * erts: Fixed type spec of erlang:system_info(dist_ctrl).
  * erts: The zlib built in to the runtime system has been updated
    to version 1.2.12. (Note that on most platforms, the platform's
    own zlib is used.)
  * erts: The erlang:is_alive() BIF could return true before
    configured distribution service was available. This bug was
    introduced in OTP 25.0 ERTS version 13.0. The
    erlang:monitor_node() and erlang:monitor() BIFs could
    erroneously fail even though configured distribution service
    was available. This occurred if these BIFs were called after
    the distribution had been started using dynamic node name
    assignment but before the name had been assigned.
  * crypto: Note in the documentation that MODP (rfc3526) groups
    and OpenSSL 3.0 can give an error if a call to
    crypto:generate_key/2 specifies a key length, and that length
    is to small.
  * crypto: The cmac now uses only the 3.0 API
  * crypto: Documentation is now updated with which OpenSSL
    cryptolib versions that OTP currently is tested.
  * dialyzer: Fixed the documentation for the missing_return and
    extra_return options.
  * mnesia: Fixed add_table_copy which could leave a table lock if
    the receiving node went down during the operation.
  * ssh: Binaries can be limited in logs with the parameter
    max_log_item_len. The default value is 500 bytes.
  * stdlib: In the initial release of Erlang/OTP 25, the expression
    bound to the _ pseudo-field in a record initialization would
    always be evaluated once, even if all other fields in the
    record were explicitly initialized. That would break the use
    case of binding the expression error(...) to _ in order to get
    an exception if not all fields were initialized. The behavior
    of binding to _ has been reverted to the pre-OTP 25 behavior,
    that is, to not evaluate the expression if all fields have been
    bound to explicit values.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1660046400">- Changes for 25.0.3:
  * erts: Distributed exit signals could be lost under the
    following conditions:
  * erts: A race could cause process_info(Pid, message_queue_len)
    on other processes to return invalid results.
  * erts: Fixed reduction counting for handling process system
    tasks.
  * erts: Priority elevation of terminating processes did not work
    which could cause execution of such processes to be delayed.
  * erts: An unlink operation made by a process that terminated
    before the unlink operation completed, i.e., before it had
    received an unlink-ack signal from the linked process, caused
    an exit signal to erroneously be sent from the terminating
    process to the process being unlinked. This exit signal would
    most often be ignored by the receiver, but if the receiver of
    the exit signal concurrently set up a new link, it could
    receive the exit signal with the actual exit reason of the
    terminating process instead of a noproc exit reason. It is
    however very hard to detect that this has happened and has no
    obvious negative consequences, so it should be considered
    harmless. A distributed unlink-ack signal received by a
    terminating process was also not properly removed which could
    cause a minor memory leak.
  * ssl: The link to crypto:engine_load refered the function with
    wrong arity.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1661601600">- Changes for 25.0.4:
  * kernel: A call to net_kernel:setopts(new, Opts) at the same
    time as a connection was being set up could cause a deadlock
    between the net_kernel process and the process setting up the
    connection.
  * erts: The monitor/3 BIF did not apply options to the created
    monitor if the target process or port did not exist. That is,
    the corresponding down message would get a `DOWN` tag even if a
    custom tag had been set, and the returned reference was not an
    alias even if the alias option had been passed.
  * erts: The erlang:monotonic_time/1, erlang:system_time/1,
    erlang:time_offset/1, and os:system_time/1 BIFs erroneously
    failed when passed the argument native.</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1665662400">- Changes for 25.1.1:
  * dialyzer: Dialyzer could crash when analyzing Elixir code that
    used intricate macros.
  * dialyzer: The --input_list_file option has been added.
  * ssl: Fixes handling of symlinks in cacertfile option.
  * eunit: With this change, eunit exact_execution option works
    with application primitive.
  * stdlib: peer nodes failed to halt when the process supervising
    the control connection crashed. When an alternative control
    connection was used, this supervision process also quite
    frequently crashed when the peer node was stopped by the node
    that started it which caused the peer node to linger without
    ever halting.
  * asn1: For the per and uper ASN.1 encoding rules, encoding and
    decoding the SEQUENCE OF and SET OF constructs with 16384 items
    or more is now supported.
  * erts: Listen sockets created with the socket module, leaked
    (erlang-) monitors.
  * erts: Notifications about available distribution data sent to
    distribution controller processes could be lost. Distribution
    controller processes can be used when implementing an
    alternative distribution carrier. The default distribution over
    tcp was not effected and the bug was also not present on
    x86/x86_64 platforms.
  * kernel: Listen sockets created with the socket module, leaked
    (erlang-) monitors.
  * kernel: peer nodes failed to halt when the process supervising
    the control connection crashed. When an alternative control
    connection was used, this supervision process also quite
    frequently crashed when the peer node was stopped by the node
    that started it which caused the peer node to linger without
    ever halting.
- Changes for 25.1:
  * dialyzer: Two bugs have been fixed in Dialyzer's checking of
    behaviors: When a mandatory callback function is present but
    not exported, Dialyzer would not complain about a missing
    callback. When an optional callback function was not exported
    and had incompatible arguments and/or the return values were
    incompatible, Dialyzer would complain. This has been changed to
    suppress the warning, because the function might not be
    intended to be a callback function, for instance if a release
    added a new optional callback function (such as format_status/1
    for the gen_server behaviour added in OTP 25).
  * dialyzer: The no_extra_return and no_missing_return warnings
    can now be suppressed through -dialyzer directives in source
    code.
  * jinterface: Fix javadoc build error by adding option -encoding
    UTF-8.
  * diameter: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * crypto: Fix configure with --with-ssl and --disable-dynamic-
    ssl-lib on Windows.
  * crypto: Remove all references correctly in the garbage
    collection if an engine handle was not explicit unloaded.
  * crypto: Changed the behaviour of the engine load/unload
    functions The engine load/unload functions have got changed
    semantics to get a more consistent behaviour and work correct
    when variables are garbage collected. The load functions now
    don't register the methods for the engine to replace. That will
    now be handled with the new functions
    engine_register/engine_unregister if needed. Some functions are
    removed from the documentation and therefor the API, but they
    are left in the code for compatibility. *** POTENTIAL
    INCOMPATIBILITY ***
  * crypto: Fixed a naming bug for AES-CFB and Blowfish-CFB/OFB
    when linked with OpenSSL 3.0 cryptolib.
  * crypto: Sign/verify does now behave as in OTP-24 and earlier
    for eddsa.
  * crypto: Pass elliptic curve names from crypto.erl to crypto's
    nif.
  * crypto: The configure option --disable-deprecated-warnings is
    removed. It was used for some releases when the support for
    OpenSSL 3.0 was not completed. It is not needed in OTP 25.
  * crypto: Crypto is now considered to be usable with the OpenSSL
    3.0 cryptolib for production code. ENGINE and FIPS are not yet
    fully functional.
  * crypto: Do not exit if the legacy provider is missing in
    libcrypto 3.0.
  * ssl: Reject unexpected application data in all relevant places
    for all TLS versions. Also, handle TLS-1.3 middlebox
    compatibility with more care. This will make malicious
    connections fail early and further, mitigate possible DoS
    attacks, that would be caught by the handshake timeout. Thanks
    to Aina Toky Rasoamanana and Olivier Levillain from Télécom
    SudParis for alerting us of the issues in our implementation.
  * ssl: With this change, value of cacertfile option will be
    adjusted before loading certs from the file. Adjustments
    include converting relative paths to absolute and converting
    symlinks to actual file path. Thanks to Marcus Johansson
  * ssl: In TLS-1.3, if chain certs are missing (so server auth
    domain adherence can not be determined) send peer cert and hope
    the server is able to recreate a chain in its auth domain.
  * ssl: Make sure periodical refresh of CA certificate files
    repopulates cache properly.
  * ssl: Correct internal CRL cache functions to use internal
    format consistently.
  * ssl: Incorrect handling of client middlebox negotiation for
    TLS-1.3 could result in that a TLS-1.3 server would not use
    middlebox mode although the client was expecting it too and
    failing the negotiation with unexpected message.
  * ssl: If the "User" process, the process starting the TLS
    connection, gets killed in the middle of spawning the dynamic
    connection tree make sure we do not leave any processes behind.
  * ssl: A vulnerability has been discovered and corrected. It is
    registered as CVE-2022-37026 "Client Authentication Bypass".
    Corrections have been released on the supported tracks with
    patches 23.3.4.15, 24.3.4.2, and 25.0.2. The vulnerability
    might also exist in older OTP versions. We recommend that
    impacted users upgrade to one of these versions or later on the
    respective tracks. OTP 25.1 would be an even better choice.
    Impacted are those who are running an ssl/tls/dtls server using
    the ssl application either directly or indirectly via other
    applications. For example via inets (httpd), cowboy, etc. Note
    that the vulnerability only affects servers that request client
    certification, that is sets the option {verify, verify_peer}.
    (bsc#1205318)
  * eunit: With this change, Eunit can optionally not try to
    execute related module with "_tests" suffix. This might be used
    for avoiding duplicated executions when source and test modules
    are located in the same folder.
  * erl_docgen: Update DTD to allow XML tag em under pre.
  * inets: Add httpc:ssl_verify_host_options/1 to help setting
    default ssl options for the https client.
  * inets: This change fixes dialyzer warnings generated for
    inets/httpd examples (includes needed adjustment of spec for
    ssh_sftp module).
  * inets: Remove documentation of no longer supported callback.
  * stdlib: Fixed inconsistency bugs in global due to
    nodeup/nodedown messages not being delivered before/after
    traffic over connections. Also fixed various other
    inconsistency bugs and deadlocks in both global_group and
    global. As building blocks for these fixes, a new BIF
    erlang:nodes/2 has been introduced and
    net_kernel:monitor_nodes/2 has been extended. The -hidden and
  - connect_all command line arguments did not work if multiple
    instances were present on the command line which has been
    fixed. The new kernel parameter connect_all has also been
    introduced in order to replace the -connect_all command line
    argument.
  * stdlib: Fix the public_key:ssh* functions to be listed under
    the correct release in the Removed Functionality User's Guide.
  * stdlib: The type spec for format_status/1 in gen_statem,
    gen_server and gen_event has been corrected to state that the
    return value is of the same type as the argument (instead of
    the same value as the argument).
  * stdlib: If the timer server child spec was already present in
    kernel_sup but it was not started, the timer server would fail
    to start with an {error, already_present} error instead of
    restarting the server.
  * stdlib: When changing callback module in gen_statem the
    state_enter calls flag from the old module was used in for the
    first event in the new module, which could confuse the new
    module and cause malfunction. This bug has been corrected. With
    this change some sys debug message formats have been modified,
    which can be a problem for debug code relying on the format.
  * ** POTENTIAL INCOMPATIBILITY ***
  * stdlib: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * stdlib: The rfc339_to_system_time/1,2 functions now allows the
    minutes part to be omitted from the time zone.
  * stdlib: The receive statement in gen_event has been optimized
    to not use selective receive (which was never needed, and could
    cause severe performance degradation under heavy load).
  * stdlib: Add new API function erl_features:configurable/0
  * parsetools: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * public_key: Support more Linux distributions in cacerts_load/0.
  * public_key: Correct asn1 typenames available in type
    pki_asn1_type()
  * public_key: Sign/verify does now behave as in OTP-24 and
    earlier for eddsa.
  * snmp: Improved the get-bulk response max size calculation. Its
    now possible to configure 'empty pdu size', see appendix c for
    more info.
  * snmp: Fix various example dialyzer issues
  * ssh: Handling rare race condition at channel close.
  * ssh: New ssh option no_auth_needed to skip the ssh
    authentication. Use with caution!
  * ssh: This change fixes dialyzer warnings generated for
    inets/httpd examples (includes needed adjustment of spec for
    ssh_sftp module).
  * ssh: The new function ssh:daemon_replace_options/2 makes it
    possible to change the Options in a running SSH server.
    Established connections are not affected, only those created
    after the call to this new function.
  * ssh: Add a timeout as option max_initial_idle_time. It closes a
    connection that does not allocate a channel within the timeout
    time. For more information about timeouts, see the Timeouts
    section in the User's Guide Hardening chapter.
  * observer: Fixed units in gui.
  * xmerl: There is a new configure option, --enable-deterministic-
    build, which will apply the deterministic compiler option when
    building Erlang/OTP. The deterministic option has been improved
    to eliminate more sources of non-determinism in several
    applications.
  * asn1: There is a new configure option, --enable-deterministic-
    build, which will apply the deterministic compiler option when
    building Erlang/OTP. The deterministic option has been improved
    to eliminate more sources of non-determinism in several
    applications.
  * erts: Fixed inconsistency bugs in global due to nodeup/nodedown
    messages not being delivered before/after traffic over
    connections. Also fixed various other inconsistency bugs and
    deadlocks in both global_group and global. As building blocks
    for these fixes, a new BIF erlang:nodes/2 has been introduced
    and net_kernel:monitor_nodes/2 has been extended. The -hidden
    and -connect_all command line arguments did not work if
    multiple instances were present on the command line which has
    been fixed. The new kernel parameter connect_all has also been
    introduced in order to replace the -connect_all command line
    argument.
  * erts: Fixed IPv6 multicast_if and membership socket options.
  * erts: Accept funs (NEW_FUN_EXT) with incorrectly encoded size
    field. This is a workaround for a bug (OTP-18104) existing in
    OTP 23 and 24 that could cause incorrect size fields in certain
    cases. The emulator does not use the decoded size field, but
    erl_interface still does and is not helped by this workaround.
  * erts: Fixed issue with inet:getifaddrs hanging on pure IPv6
    Windows
  * erts: Fix faulty distribution encoding of terms with either The
    symptom could be failed decoding on the receiving side leading
    to aborted connection. Fix OTP-18093 is a workaround for theses
    bugs that makes the VM accepts such faulty encoded funs. The
    first encoding bug toward pending connection exists only in OTP
    23 and 24, but the second one exists also on OTP 25.
  * erts: Fixed emulator crash that could happen during crashdump
    generation of ETS tables with options ordered_set and
    {write_concurrency,true}.
  * erts: Retrieval of monotonic and system clock resolution on
    MacOS could cause a crash and/or erroneous results.
  * erts: Fix bug where the max allowed size of erl +hmax was lower
    than what was allowed by process_flag.
  * erts: On computers with ARM64 (AArch64) processors, the JIT
    could generate incorrect code when more than 4095 bits were
    skipped at the tail end of a binary match.
  * erts: In rare circumstances, an is_binary/1 guard test could
    succeed when given a large integer.
  * erts: Fix bug causing ets:info (and sometimes ets:whereis) to
    return 'undefined' for an existing table if a concurrent
    process were doing ets:insert with a long list on the same
    table.
  * erts: Fix writing and reading of more than 2 GB in a single
    read/write operation on macOS. Before this fix attempting to
    read/write more than 2GB would result in {error,einval}.
  * erts: Fix bug sometimes causing emulator crash at node shutdown
    when there are pending connections. Only seen when running duel
    distribution protocols, inet_drv and inet_tls_dist.
  * erts: Yield when adjusting large process message queues due to
    The message queue adjustment work will now be interleaved with
    all other types of work that processes have to do, even other
    message queue adjustment work.
  * erts: Add rudimentary debug feature (option) for the inet-
    driver based sockets, such as gen_tcp and gen_udp.
  * erts: Introduced the hidden and dist_listen options to
    net_kernel:start/2. Also documented the -dist_listen command
    line argument which was erroneously documented as a kernel
    parameter and not as a command line argument.
  * erts: New documentation chapter "Debugging NIFs and Port
    Drivers" under Interoperability Tutorial.
  * erts: Add new API function erl_features:configurable/0
  * kernel: Fixed inconsistency bugs in global due to
    nodeup/nodedown messages not being delivered before/after
    traffic over connections. Also fixed various other
    inconsistency bugs and deadlocks in both global_group and
    global. As building blocks for these fixes, a new BIF
    erlang:nodes/2 has been introduced and
    net_kernel:monitor_nodes/2 has been extended. The -hidden and
  - connect_all command line arguments did not work if multiple
    instances were present on the command line which has been
    fixed. The new kernel parameter connect_all has also been
    introduced in order to replace the -connect_all command line
    argument.
  * kernel: Fixed IPv6 multicast_if and membership socket options.
  * kernel: Fixed issue with inet:getifaddrs hanging on pure IPv6
    Windows
  * kernel: The type specifications for inet:getopts/2 and
    inet:setopts/2 have been corrected regarding SCTP options.
  * kernel: The type specifications for inet:parse_* have been
    tightened.
  * kernel: Fix gen_tcp:connect/3 spec to include the inet_backend
    option.
  * kernel: Fix bug where using a binary as the format when calling
    logger:log(Level, Format, Args) (or any other logging function)
    would cause a crash or incorrect logging.
  * kernel: Add rudimentary debug feature (option) for the inet-
    driver based sockets, such as gen_tcp and gen_udp.
  * kernel: Introduced the hidden and dist_listen options to
    net_kernel:start/2. Also documented the -dist_listen command
    line argument which was erroneously documented as a kernel
    parameter and not as a command line argument.
  * kernel: Scope and group monitoring have been introduced in pg.
    For more information see the documentation of
    pg:monitor_scope(), pg:monitor(), and pg:demonitor().
  * kernel: A new function global:disconnect/0 has been introduced
    with which one can cleanly disconnect a node from all other
    nodes in a cluster of global nodes.
  * compiler: The compiler will now forbid using the empty atom ''
    as module name. Also forbidden are modules names containing
    control characters, and module names containing only spaces and
    soft hyphens.
  * compiler: The bin_opt_info and recv_opt_info options would
    cause the compiler to crash when attempting to compile
    generated code without location information.
  * compiler: In rare circumstances involving floating point
    operations, the compiler could terminate with an internal
    consistency check failure.
  * compiler: In rare circumstances when doing arithmetic
    instructions on non-numbers, the compiler could crash.
  * compiler: In rare circumstances, complex boolean expressions in
    nested cases could cause the compiler to crash.
  * compiler: Expression similar to #{assoc:=V} = #key=&gt;self()}, V
    would return the empty map instead of raising an exception.
  * compiler: Eliminated a crash in the beam_ssa_bool pass of the
    compiler when compiling a complex guard expression.
  * compiler: In rare circumstances, the compiler could crash with
    an internal consistency check failure.
  * compiler: When compiling with the option inline_list_funcs, the
    compiler could produce a nonsensical warning.
  * compiler: When given the no_ssa_opt option, the compiler could
    terminate with an internal consistency failure diagnostic when
    compiling map matching.
  * compiler: Made warnings for existing atoms being keywords in
    experimental features more precise, by not warning about quoted
    atoms.
  * compiler: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * megaco: Fixed various dialyzer related issues in the examples
    and the application proper.
  * megaco: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * common_test: Fix cth_surefire to handle when a suite is not
    compiled with debug_info. This bug has been present since
    Erlang/OTP 25.0.
  * common_test: Common Test now preserves stack traces for throws.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1669291200">- Changes for 25.1.2:
  * mnesia: Don't fill the logs if mnesia can't connect to all
    nodes, due to partitioned network.
  * erts: Add abandon carrier free utilization limit (+Muacful)
    option to erts_alloc. This option allows the user to mark
    unused segments in a memory carrier as re-useable by the OS if
    needed. This functionality was a non-configurable default
    before Erlang/OTP 25, but removed due to performance issues.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1671364800">- Changes for 25.2:
  * erts: Fix perf/gdb JIT symbols to not contain CodeInfoPrologue
    for the JIT internal module erts_beamasm.
  * erts: Fixed minor memory leaks.
  * erts: Fix bugs in ets:insert and ets:insert_new when called
    with a list of tuples to insert while a concurrent process
    either deletes or renames the table. The table deletion could
    be done with ets:delete/1 or be caused by termination of the
    table owning process. Symptoms are either VM crash or strange
    incorrect behavior from the insert operation. The risk of
    triggering the bugs increases with the length of the list of
    tuple to insert. Bugs exist since OTP 23.0.
  * erts: Boost execution of scheduled thread progress jobs. This
    to prevent memory exhaustion in extremely rapid
    allocation/deallocation scenarios, such as repeated ETS table
    creations/deletions.
  * erts: Fix segv crash during crash dumping an ETS table doing
    ets:delete_all_objects.
  * erts: Spec for function net:if_names/0 incorrect
  * erts: Fix bug in binary_to_term decoding a binary term 2Gbyte
    or larger.
  * erts: Documentation of erlang:module_loaded/1 has been
    adjusted:
  * erts: Fix list_to_atom/1 for negative code points. Could either
    return with a positive code point or fail with an incorrect
    exception.
  * erts: Fix rare bug causing VM crash when sending to a pid of a
    spawning process returned from erlang:processes/0. Only seen
    when provoked by system process literal_area_collector,
    triggered by a module purge operation, on a VM started with
    +Meamin (no customized allocators).
  * erts: gen_udp:open/2 with option(s) add_membership or
    drop_membership would drop earlier options.
  * erts: The inet:setopts/2 {reuseaddr, true} option will now be
    ignored on Windows unless the socket is an UDP socket. For more
    information see the documentation of the reuseaddr option part
    of the documentation of inet:setopts/2. Prior to OTP 25 the
    {reuseaddr, true} option was ignored for all sockets on
    Windows, but as of OTP 25.0 this was changed so that it was not
    ignored for any sockets. *** POTENTIAL INCOMPATIBILITY ***
  * erts: Fix bug in binary_to_term decoding a list of length 1G or
    longer.
  * erts: Fix bug in binary_to_term (and distributed receive) when
    decoding a large map (&gt;32 keys) with unsorted small maps (&lt;=
    32) as keys of the large map. This was only a problem if the
    term was encoded by erl_interface, jinterface or otherwise, as
    the VM itself always encodes small maps with sorted keys. The
    "binary_to_term" would appear as successful but the created
    large map was internally inconsistent. The smaller key-maps
    could not be found with maps:get and friends. Other operations
    such as map compare and merge could probably also give
    incorrect results.
  * erts: Fix Windows bug in open_port({spawn, Command}, ..) when
    Command is found via the OS search PATH and that directory path
    contains white spaces. The port program would start but the
    command line arguments to it could be incorrect.
  * ftp: fix unexpected result ok when calling ftp:nlist repeatedly
  * inets: This change allows body requests to httpc:request/5 be
    an iolist()
  * inets: addition of type specs in httpc.erl
  * inets: httpc: Add support for HTTP 308 status code
  * dialyzer: Dialyzer would crash when attempting to analyze a bit
    syntax segment size having an literal non-integer size such as
    [].
  * dialyzer: Dialyzer could crash when trying to analyze a
    convoluted nested expression involving funs,
  * kernel: Fixed shutdown crash in gen_tcp socket backend, when
    the other end closed the socket.
  * kernel: erl_tar can now read gzip-compressed tar files that are
    padded. There is a new option compressed_one for file:open/2
    that will read a single member from a gzip file,
  * kernel: Fix os:cmd to not translate all exceptions thrown to
    badarg. For example emfile from erlang:open_port was translated
    to badarg. This bug has existed since Erlang/OTP 24.
  * kernel: Spec for function net:if_names/0 incorrect
  * kernel: Missing ctrl option name transation for TOS and TTL (on
    FreeBSD) when using gen_udp with the 'socket' inet_backend.
  * kernel: gen_udp:open/2 with option(s) add_membership or
    drop_membership would drop earlier options.
  * kernel: The inet:setopts/2 {reuseaddr, true} option will now be
    ignored on Windows unless the socket is an UDP socket. For more
    information see the documentation of the reuseaddr option part
    of the documentation of inet:setopts/2. Prior to OTP 25 the
    {reuseaddr, true} option was ignored for all sockets on
    Windows, but as of OTP 25.0 this was changed so that it was not
    ignored for any sockets. *** POTENTIAL INCOMPATIBILITY ***
  * kernel: The distribution socket option handling in
    inet_tcp_dist has been cleaned up to clarify which were
    mandatory and which just had default values.
  * kernel: Improve warning message format for gen_tcp_socket.
  * snmp: Explicitly close the socket(s) when terminating
    (default-) net-if process.
  * stdlib: erl_tar can now read gzip-compressed tar files that are
    padded. There is a new option compressed_one for file:open/2
    that will read a single member from a gzip file,
  * stdlib: A concurrent call to ets:rename could cause
    ets:delete_all_objects to fail halfway through with badarg.
  * stdlib: It is not allowed to call functions from guards. The
    compiler failed to reject a call in a guard when done by
    constructing a record with a default initialization expression
    that called a function.
  * stdlib: The compiler could crash when using a record with
    complex field initialization expression as a filter in a list
    comprehension.
  * stdlib: unicode:characters_to_binary() could build
    unnecessarily large call stack.
  * stdlib: Improve error message for ets:new/2 name clash. Say
    "name already exists" instead of less specific "invalid
    options".
  * mnesia: Fixed crash which could happen during startup if too
    many decisions where sent from remote nodes.
  * os_mon: The disk_space_check_interval configuration parameter
    of disksup can now be set to values smaller than a minute.
  * ssh: graceful shutdown of ssh_conection_handler when connection
    is closed by peer
  * common_test: Fix starting of peer nodes on old releases when
    the compile server was active and the current Erlang
    installation contained non-latin1 characters in its path.
  * public_key: Disregard LDAP URIs when HTTP URIs are expected.
  * ssl: With this change, tls_sender process is hibernated after
    sufficient inactivity.
  * ssl: Correct handling of legacy schemes so that ECDSA certs
    using sha1 may be used for some TLS-1.3 configurations.
  * ssl: With this change, tls_sender does not cause logger crash
    upon key update.
  * ssl: Enhance warning message
  * ssl: Provide server option to make certificate_authorities
    extension in the TLS-1.3 servers certificate request optional.
    This will allow clients to send incomplete chains that may be
    reconstructable and thereby verifiable by the server, but that
    would not adhere to the certificate_authorities extension.
  * ssl: If the verify_fun handles four arguments the DER cert will
    be supplied as one of the arguments.
  * megaco: A very minor improvement to the measurement tool.
  * observer: A WX event race could causes a crash in when handling
    socket or port info.
  * observer: Improve the nodes menu to include more nodes.
  * compiler: Line number in compiler messages would be truncated
    to 4 digits for line numbers greater than 9999.
  * compiler: In rare circumstance, matching a binary as part of a
    receive clause could cause the compiler to terminate because of
    an internal consistency check failure.
  * compiler: Compiling a function with complex bit syntax matching
    such as f(&lt;&lt;X:0, _:X&gt;&gt;, &lt;&lt;Y:0, _:Y&gt;&gt;) -&gt; ok. could crash the
    compiler.
  * compiler: It is not allowed to call functions from guards. The
    compiler failed to reject a call in a guard when done by
    constructing a record with a default initialization expression
    that called a function.
  * compiler: The compiler could crash when using a record with
    complex field initialization expression as a filter in a list
    comprehension.
  * wx: Added environment variable WX_MACOS_NON_GUI_APP to allow
    user to override OSXIsGUIApplication behavior.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1679745600">- Changes for 25.3:
  * reltool: Fixed a bug that would cause analysis to crash.
  * stdlib: Fixed a bug that would cause analysis to crash.
  * stdlib: Fixed a crash when formatting stack traces for error
    reports.
  * stdlib: Instead of crashing, the list_to_integer/1 and
    list_to_integer/2 BIFs now raise the system_limit exception for
    overlong lists that can't be converted to integers. Similarly,
    the string:to_integer/1 BIF now returns {error,system_limit}
    for overlong lists.
  * stdlib: Removal of non-necessary undefined types added to the
    state's supervisor record.
  * compiler: Fixed a bug that would cause the compiler to hang.
  * compiler: Fixed a crash when compiling code that contained
    maybe expressions.
  * compiler: Constructing a binary with an explicit size of all
    for a binary segment would crash the compiler.
  * compiler: The compiler would generate incorrect code for the
    following type of expression: Pattern = BoundVar1 = . . . =
    BoundVarN = Expression An exception should be raised if any of
    the bound variables have different values than Expression. The
    compiler would generate code that would cause the bound
    variables to be bound to the value of Expressionwhether the
    value matched or not.
  * xmerl: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * megaco: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * debugger: Fixed a bug that would cause analysis to crash.
  * erts: Fixed a bug on Windows where file:read_file_info/1 would
    fail for files with corrupt metadata.
  * erts: Fix process_info(_, binary) to again include "writable
    binaries" which were lost in OTP-25.0. Writable binaries are an
    optimization used when binaries are appended upon in a loop.
  * erts: Fix rare race when receiving fragmented messages on a
    terminating connection. Could potentially cause memory leaks as
    well as double free crashes. Bug exists since OTP 22.0.
  * erts: Fixed bug that could maybe cause problems when a file
    descriptor number is closed by a linked in driver and then
    opened (reused) and passed to enif_select by a NIF. No actual
    symptoms seen, only failed internal assertions in debug build.
  * erts: The runtime system could crash when tracing a process
    executing on a dirty scheduler.
  * erts: In the binary syntax, attempting to match out integers
    with size exceeding 2 GiB could crash the runtime system.
  * erts: Fixed edge case in floating-point negation where A = 0.0,
    B = -A did not produce B = -0.0 on x86_64 JIT.
  * erts: Fixed an issue in the JIT that could crash the emulator
    on some platforms.
  * erts: Added meta data to the windows installer.
  * erts: Fixed ETS insertion order into bag and duplicate_bag of
    tuples with identical keys when passed in a list to
    ets:insert/2. The insert order has been head-to-tail but was
    accidentally changed in OTP 23.0. For bag it was reverted
    (tail-to-head), while for duplicate_bag it was sometimes
    reverted depending on the length of the list and number of
    "reductions" left for the calling process. This fix changes the
    insert order of ets:insert/2 back to always be head-to-tail of
    the list argument.
  * erts: With the JIT for AArch64 (AMD64), calling bxor in with
    non-integer arguments in a guard would crash the runtime
    system.
  * erts: Fix bug regarding process flag max_heap_size. Could cause
    strange behavior when a process was killed due to exceeding the
    limit.
  * erts: Fixed binary comprehensions to be similar to other
    creation of binary data with respect to its contribution of
    triggering garbage collection.
  * erts: In rare circumstances, when a process exceeded its
    allowed heap size set by option max_heap_size, it would not be
    killed as it should be, but instead enter a kind of zombie
    state it would never get out of.
  * erts: Instead of crashing, the list_to_integer/1 and
    list_to_integer/2 BIFs now raise the system_limit exception for
    overlong lists that can't be converted to integers. Similarly,
    the string:to_integer/1 BIF now returns {error,system_limit}
    for overlong lists.
  * erts: Active process aliases of a process at its termination
    leaked memory.
  * erts: Support for fully asynchronous distributed signaling
    where send operations never block. This functionality is by
    default disabled and can be enabled per process. For more
    information see the documentation of process_flag(async_dist,
    Bool).
  * erts: Added the +JPperf no_fp option to explicitly disable
    Erlang frame pointers otherwise added when using the +JPperf
    map option.
  * erl_interface: Accept connection setup from OTP 23 and 24 nodes
    that are not using epmd.
  * erl_interface: The ei API for decoding/encoding terms is not
    fully 64-bit compatible since terms that have a representation
    on the external term format larger than 2 GB cannot be handled.
  * syntax_tools: erl_syntax_lib:annotate_bindings/1,2 will now
    properly annotate named functions and their arguments.
  * kernel: Fixed a bug on Windows where file:read_file_info/1
    would fail for files with corrupt metadata.
  * kernel: Accept connection setup from OTP 23 and 24 nodes that
    are not using epmd.
  * public_key: As different solutions of verifying certificate
    revocation exists move the decode of 'CRLDistributionPoints' so
    that it will only be decode. When it is actually used in the
    verification process. This would enable interoperability with
    systems that use certificates with an invalid empty
    CRLDistributionPoints extension that they want to ignore and
    make verification by other means.
  * public_key: public_key:pkix_path_validation validates
    certificates expiring after 2050
  * public_key: Do not leave exit message in message queue after
    calling cacerts_load() on MacOS.
  * public_key: Replace size/1 with either tuple_size/1 or
    byte_size/1 The size/1 BIF is not optimized by the JIT, and its
    use can result in worse types for Dialyzer. When one knows that
    the value being tested must be a tuple, tuple_size/1 should
    always be preferred. When one knows that the value being tested
    must be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * ssl: Fixed that new dtls connections from the same client ip
    port combination works. If there is a process waiting for
    accept the new connection will connect to that, otherwise it
    will try to re-connect to the old server connection.
  * ssl: When shutting down a node that uses SSL distribution
    (-proto_dist inet_tls), a confusing error message about an
    unexpected process exit was printed. This particular message is
    no longer generated.
  * ssl: fixes the type spec for ssl:format_error/1
  * ssl: Replace size/1 with either tuple_size/1 or byte_size/1 The
    size/1 BIF is not optimized by the JIT, and its use can result
    in worse types for Dialyzer. When one knows that the value
    being tested must be a tuple, tuple_size/1 should always be
    preferred. When one knows that the value being tested must be a
    binary, byte_size/1 should be preferred. However, byte_size/1
    also accepts a bitstring (rounding up size to a whole number of
    bytes), so one must make sure that the call to byte_size/ is
    preceded by a call to is_binary/1 to ensure that bitstrings are
    rejected. Note that the compiler removes redundant calls to
    is_binary/1, so if one is not sure whether previous code had
    made sure that the argument is a binary, it does not harm to
    add an is_binary/1 test immediately before the call to
    byte_size/1.
  * jinterface: Accept connection setup from OTP 23 and 24 nodes
    that are not using epmd.
  * os_mon: The port programs used by cpu_sup and memsup are now
    gracefully shut down when cpu_sup and memsup are shut down.
  * eunit: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * crypto: A user defined runtime library path configured using
  - -with-ssl-rpath=&lt;PATHS&gt; could fail to be enabled.
  * crypto: Ensure that configure fails if a user defined runtime
    library path has been passed by the user, but cannot set.
  * mnesia: Improved consistency for dirty writes when a table was
    added with add_table_copy/3. Fixed a problem with sticky write,
    which could lead to inconsistent data.
  * mnesia: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * common_test: Renamed undocumented macro CT_PEER/3 to
    CT_PEER_REL/3.
  * ssh: With this change, PKCS8 formatted private key file is
    properly decoded and SSH daemon with such key can be started.
  * ssh: Replace size/1 with either tuple_size/1 or byte_size/1 The
    size/1 BIF is not optimized by the JIT, and its use can result
    in worse types for Dialyzer. When one knows that the value
    being tested must be a tuple, tuple_size/1 should always be
    preferred. When one knows that the value being tested must be a
    binary, byte_size/1 should be preferred. However, byte_size/1
    also accepts a bitstring (rounding up size to a whole number of
    bytes), so one must make sure that the call to byte_size/ is
    preceded by a call to is_binary/1 to ensure that bitstrings are
    rejected. Note that the compiler removes redundant calls to
    is_binary/1, so if one is not sure whether previous code had
    made sure that the argument is a binary, it does not harm to
    add an is_binary/1 test immediately before the call to
    byte_size/1.
  * inets: With this change, handling of URI to a folder, with
    missing trailing / and a query component present is fixed.
  * inets: Adds more type information to the inets app, thus
    improving the errors that static analysis tools can detect. The
    addition of type information to records and the updates to
    function heads help static analysis tools to understand that
    some values in the records cannot be 'undefined', thus making
    static tools to type check correctly more modules in the inets
    app
  * inets: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * snmp: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * ftp: Replace size/1 with either tuple_size/1 or byte_size/1 The
    size/1 BIF is not optimized by the JIT, and its use can result
    in worse types for Dialyzer. When one knows that the value
    being tested must be a tuple, tuple_size/1 should always be
    preferred. When one knows that the value being tested must be a
    binary, byte_size/1 should be preferred. However, byte_size/1
    also accepts a bitstring (rounding up size to a whole number of
    bytes), so one must make sure that the call to byte_size/ is
    preceded by a call to is_binary/1 to ensure that bitstrings are
    rejected. Note that the compiler removes redundant calls to
    is_binary/1, so if one is not sure whether previous code had
    made sure that the argument is a binary, it does not harm to
    add an is_binary/1 test immediately before the call to
    byte_size/1.
  * dialyzer: Fixed a bug that would cause analysis to crash.
  * dialyzer: Replace size/1 with either tuple_size/1 or
    byte_size/1 The size/1 BIF is not optimized by the JIT, and its
    use can result in worse types for Dialyzer. When one knows that
    the value being tested must be a tuple, tuple_size/1 should
    always be preferred. When one knows that the value being tested
    must be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * tftp: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
- Changes for 25.2.3:
  * erts: Comparisons between small numbers and pids or ports would
    in some edge cases say that the number was greater than the pid
    or port, violating the term order.
  * erts: process_info(Pid, status) when Pid /= self() could return
    an erroneous result.
  * ssl: Maximize compatibility by ignoring change_cipher_spec
    during handshake even if middle_box_mode is not negotiated
    (mandated by client)
  * ssl: Move assert of middlebox message after an
    hello_retry_request to maximize interoperability. Does not
    changes semantics of the protocol only allows unexpected
    message delay from server.
  * ssh: With this change, ssh application does not crash when
    formatting some of info reports for unsuccessful connections.
  * ssh: With this change, ssh does not log extensively long
    messages.
  * inets: Ensure graceful shutdown
  * inets: Return type of the type specification for function
    httpc:cookie_header/{1,2,3} has been fixed from -spec
    cookie_header(url()) -&gt; [{ field(), value() }] | {error,
    Reason} to -spec cookie_header(url()) -&gt; { field(), value() } |
    {error, Reason}
- Changes for 25.2.2:
  * ftp: Fixes calls to ftp:nlist/2 returning {error, epath} when
    the file / folder exists
- Changes for 25.2.1:
  * compiler: Fixed a bug that could cause legal code to fail
    validation.
  * compiler: Eliminated a rare crash in the beam_types module.
  * erts: Fixed a bug in selective receive optimization that could
    crash 32-bit emulators.
  * erts: A race condition which was very rarely triggered could
    cause the signal queue of a process to become inconsistent
    causing the runtime system to crash.
  * kernel: The tcp connect option 'bind_to_device' could not be
    used with inet_backend = 'socket'. 'inet' requires value type
    binarry() and 'socket' requires value type 'string()'.
  * kernel: Minor issue processing options when calling
    gen_tcp:connect with a sockaddr() and inet_backend = socket.
  * common_test: Change timeout to infinity for gen_server calls in
    cth_log_redirect
  * inets: fixes a missing case of the type specification for
    httpd:info/2/3/4
  * snmp: Single threaded agent crash when vacm table not properly
    initiated.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1683460800">- Changes for 25.3.2:
  * compiler: Fixed type handling bugs that could cause an internal
    error in the compiler for correct code.
  * os_mon: Avoid error report from failing erlang:port_close at
    shutdown of cpu_sup and memsup. Bug exists since OTP 25.3
    (os_mon-2.8.1).
  * erts: If a runtime system which was starting the distribution
    already had existing pids, ports, or references referring to a
    node with the same nodename/creation pair that the runtime
    system was about to use, these already existing pids, ports, or
    references would not work as expected in various situations
    after the node had gone alive. This could only occur if the
    runtime system was communicated such pids, ports, or references
    prior to the distribution was started. That is, it was
    extremely unlikely to happen unless the distribution was
    started dynamically and was even then very unlikely to happen.
    The runtime system now checks for already existing pids, ports,
    and references with the same nodename/creation pair that it is
    about to use. If such are found another creation will be chosen
    in order to avoid these issues.
- Changes for 25.3.1:
  * snmp: Attempts to minimize the number of the error reports
    during a failed agent init.
  * compiler: When a map update such as #{}#{key:=value} that
    should fail with an exception was unused, the exception would
    be lost.
  * compiler: Fixed bug in the validator that made it reject valid
    code.
  * crypto: With this change, random errors are fixed for
    crypto:generate_key calls with OpenSSL 3.
  * erts: Fixed a bug in the loader that prevented certain modules
    compiled with no_ssa_opt from being loaded.
  * erts: Implementations of the call() driver callback that
    returned a faulty encoded result could cause a memory leak and
    could cause invalid data on the heap of the processes calling
    erlang:port_call/3.
  * erts: Fixed a memory corruption issue when upgrading code. The
    bug was introduced in OTP 25.3
  * erts: Fixed configure tests for a few ARM-specific
    instructions, which prevented the emulator from being built on
    some platforms.
  * erts: Aliases created in combination with a monitor using the
    {alias, explicit_unalias} option stopped working from remote
    nodes when a 'DOWN' signal had been received due to the monitor
    or if the monitor was removed using the erlang:demonitor() BIF.
    This bug was introduced in OTP 24.3.4.10 and OTP 25.3.
  * erts: In rare circumstances, bit syntax matching of an invalid
    code point for a utf32 would crash the runtime system.
  * erts: Building the runtime system failed when native atomic
    support was missing. Note that execution on such systems have
    only been rudimentary tested.
  * erl_interface: Fixed configure tests for a few ARM-specific
    instructions, which prevented the emulator from being built on
    some platforms.
  * eldap: Added a new function eldap:info/1 that returns the
    socket and the transport protocol for the eldap connection.
  * inets: Correct timing related pipelining/keepalive queue bug,
    that could result in unexpected "socket_remotly_closed" errors.
  * inets: With this change, upon remote socket closure current
    request is added to a retried queue (either pipeline or
    keep_alive, but not both).
  * ssl: With this change, ssl:connection_information/2 returns
    correct keylog data after TLS1.3 key update.
  * ssl: Client signature algorithm list input order is now honored
    again , it was accidently reversed by a previous fix.
  * stdlib: The type specs in the erl_parse module has been updated
    to include the maybe construct and the ! operator.
  * wx: Improve debug prints from the nifs. Some minor fixes for
    wxWidgets-3.2. Fixed OpenGL debug functions.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1687521600">- Changes for 25.3.2.2:
  * compiler: The compiler could be very slow when compiling guards
    with multiple guard tests separated with 'or' or ';'.
- Changes for 25.3.2.1:
  * xmerl: New options to xmerl_scan and xmerl_sax_parser so one
    can limit the behaviour of the parsers to avoid some XML
    security issues. xmerl_scan gets one new option:
    xmerl_sax_parser gets the following options: The old option
    skip_external_dtd is still valid and the same as
    {external_entities, none} and {fail_undeclared_ref, false} but
    just affects DTD's and not other external references.
  * erts: Fixed a crash during tracing on certain platforms that
    cannot use the machine stack for Erlang code (mainly OpenBSD
    and Linux with musl).
  * erts: Constructing a binary segment not aligned with a byte
    boundary, with a size not fitting in 31 bits, and with a value
    not fitting in a 64-bit word could crash the runtime system.
  * erts: Further robustify implementation of large maps (&gt; 32
    keys). Keys that happen to have same internal 32-bit hash
    values are now put in collision nodes which are traversed with
    linear search. This removes the demand for the internal hash
    function when salted to eventually produce different hashes for
    all possible pairs of unequal terms.
  * stdlib: Static supervisors are very idle processes after they
    have started so they will now be hibernated after start to
    improve resource management.
  * compiler: Fixed a bug where a failing bsl expression in a guard
    threw an exception instead of causing the guard to fail.
  * compiler: Complex guard expression using the or operator and
    guard BIFs that can fail could sometimes be miscompiled so that
    the guard would succeed even if a call to a guard BIF failed.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1687608000">- Version 26.0:
  * Leex has been extended with optional column number support.
  * The family of enumeration functions in module lists has been
    extended with enumerate/3 that allows a step value to be
    supplied.
  * Update Unicode to version 15.0.0.
  * proc_lib:start*/* has become synchronous when the started
    process fails. This requires that a failing process use a new
    function proc_lib:init_fail/2,3, or exits, to indicate failure. All
    OTP behaviours have been fixed to do this.
  * auto-complete of variables, record names, record fields names,
    map keys, function parameter types and filenames.
  * Open external editor in the shell to edit the current
    expression.
  * defining records (with types), functions, specs and types in
    the shell.
  * Creation and matching of binaries with segments of fixed sizes
    have been optimized.
  * Creation and matching of UTF-8 segments have been optimized.
  * Appending to binaries has been optimized.
  * The compiler and JIT now generate better code for creation of
    small maps where all keys are literals known at compile time.
  * Thanks to the optimizations above the performance of the base64
    module has been significantly improved. For example, on an
    x86_64 system with the JIT both encode and decode are almost
    three times faster than in Erlang/OTP 25.
  * Map comprehensions as suggested in EEP 58 has now been
    implemented.
  * Some map operations have been optimized by changing the
    internal sort order of atom keys. This changes the
    (undocumented) order of how atom keys in small maps are printed
    and returned by maps:to_list/1 and maps:next/1. The new order
    is unpredictable and may change between different invocations
    of the Erlang VM.
  * Introducing the new function maps:iterator/2 for creating an
    interator that return the map elements in a deterministic
    order. There are also new modifiers k and K for the format
    string in io:format() to support printing map elements ordered.
  * Added the new built-in type dynamic() introduced in EEP 61, PR
    introducing EEP 61 improving support for gradual type checkers.
  * Dialyzer has a new incremental mode that be invoked by giving
    the --incremental option when running Dialyzer. This new
    incremental mode is likely to become the default in a future
    release.
  * Multi time warp mode is now enabled by default. This assumes
    that all code executing on the system is time warp safe.
  * Support for UTF-8 atoms and strings in the NIF interface
    including new functions enif_make_new_atom,
    enif_make_new_atom_len and enif_get_string_length.
  * The BIFs min/2 and max/2 are now allowed to be used in guards
    and match specs.
  * Improved the selective receive optimization, which can now be
    enabled for references returned from other functions. This
    greatly improves the performance of gen_server:send_request/3,
    gen_server:wait_response/2, and similar functions.
  * It is no longer necessary to enable a feature in the runtime
    system in order to load modules that are using it. It is
    sufficient to enable the feature in the compiler when compiling
    it.
  * inet:setopts/2 has got 3 new options: reuseport, reuseport_lb
    and exclusiveaddruse.
  * Fix so that -fno-omit-frame-pointer is applied to all of the
    Erlang VM when using the JIT so that tools, such as perf, can
    crawl the process stacks.
  * In the lists module, the zip family of functions now takes
    options to allow handling lists of different lengths.
  * Added the zip:zip_get_crc32/2 function to retrieve the CRC32
    checksum from an opened ZIP archive. gen_server optimized by
    caching callback functions
  * The modules Erlang DNS resolver inet_res and helper modules
    have been updated for RFC6891; to handle OPT RR with DNSSEC OK
    (DO) bit.
  * Introduced application:get_supervisor/1.
  * Cache OTP boot code paths, to limit how many folders that are
    being accessed during a module lookup. Can be disabled with
  - cache_boot_path false.
  * Support for Kernel TLS (kTLS), has been added to the SSL
    application, for TLS distribution (-proto_dist inet_tls), the
    SSL option {ktls, true}.
  * Improved error checking and handling of ssl options.
  * Mitigate memory usage from large certificate chains by lowering
    the maximum handshake size. This should not effect the common
    cases, if needed it can be configured to a higher value.
  * For security reasons the SHA1 and DSA algorithms are no longer
    among the default values.
  * Add encoding and decoding of use_srtp hello extension to
    facilitate for DTLS users to implement SRTP functionality.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1687608001">- Changes for 26.0.1:
  * erts: Build of the socket nif failed on Solaris 11.
  * erts: Fixed two reduction-counting bugs relating to binaries.
  * erts: Constructing a binary segment not aligned with a byte
    boundary, with a size not fitting in 31 bits, and with a value
    not fitting in a 64-bit word could crash the runtime system.
  * erts: When a binary construction failed because of bad size for
    a segment, the error information was not always correct.
  * erts: Fixed a crash when calling a fun that was defined in a
    module that had been upgraded.
  * kernel: The POSIX error exdev was sometimes incorrectly
    described as "cross domain link" in some error messages.
  * kernel: Corrected the socket send function description (send
    with Timeout = nowait). The send function(s) could not return
    {ok, {RestData, SelectInfo}}
  * stdlib: The POSIX error exdev was sometimes incorrectly
    described as "cross domain link" in some error messages.
  * ssl: Make sure that selection of client certificates handle
    both TLS-1.3 and TLS-1.2 names correctly. Could cause valid
    client certificate to not be selected, and an empty client
    certificate message to be sent to server.
  * ssl: Improved ssl:format_error/1 to handle more error tuples.
  * ssl: Fixed hanging ssl:connect when ssl application is not
    started.
  * ssl: Correct handling of retransmission timers, current
    behavior could cause unwanted delays.
  * inets: Do not make the default ssl options by calling
    httpc:ssl_verify_host_options(true) if ssl options are supplied
    by the user.
  * xmerl: New options to xmerl_scan and xmerl_sax_parser so one
    can limit the behaviour of the parsers to avoid some XML
    security issues. xmerl_scan gets one new option:
    xmerl_sax_parser gets the following options: The old option
    skip_external_dtd is still valid and the same as
    {external_entities, none} and {fail_undeclared_ref, false} but
    just affects DTD's and not other external references.
  * compiler: Fixed a bug where a failing bsl expression in a guard
    threw an exception instead of causing the guard to fail.
  * compiler: Fixed a bug that would case the validator to reject
    legal code.
  * compiler: The compiler could re-order clauses matching binaries
    so that the incorrect clause would match. That could only
    happen for code that used the option {error_location,line} or
    for code without line or column number information (e.g.
    generated by a parse transform).
  * compiler: Complex guard expression using the or operator and
    guard BIFs that can fail could sometimes be miscompiled so that
    the guard would succeed even if a call to a guard BIF failed.
  * compiler: With optimizations disabled, a try/catch construct
    could return an incorrect value.
  * compiler: In rare circumstance, a combination of binary
    construction and binary_part/3 would cause the compiler to
    generate unsafe code that would crash the runtime system.
  * compiler: The compiler could be very slow when compiling guards
    with multiple guard tests separated with 'or' or ';'.
  * compiler: Complex guard expressions using 'or' and map updates
    could succeed even if the map update failed.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1698235200">- Changes for 26.1.2:
  * erts: If the external term format encoding of an argument list
    part of a distributed spawn operation was faulty, the newly
    spawned remote process could misbehave. The misbehavior
    included hanging or interpret an incoming message as an
    argument list to use. This was very unlikely to happen unless
    using an alternate implementation of the distribution protocol
    which made a faulty encoding of the argument list. The child
    process will now detect this error and terminate before
    executing the user specified code.
  * erts: Fix bugs where if the body of a matchspec would return a
    map with a variable ('$1', '$_' etc) as one of the keys or
    values and the variable was not an immidiate, the term would
    not be copied to the receiving processes heap. This would later
    corrupt the term in the table as the GC could place move
    markers in it, which in turn would cause the VM to crash. Bug
    has been present for since OTP 17.0.
  * xmerl: The xmerl version 1.3.32 was released in OTP 26.0.1, but
    the incorrect version number of 1.3.31.1 was used for it. This
    incorrect version number continued to appear in OTP 26.0.2, OTP
    26.1, and OTP 26.1.1. The actual xmerl code in these OTP
    versions however corresponds to xmerl version 1.3.32.
- Changes for 26.1.1:
  * wx: The wx application would fail to build on macOS with Xcode
    15.
  * compiler: The compiler could become extremely slow for modules
    containing huge functions.
  * stdlib: Garbage collect the shell process when reducing the
    amount of saved history and results.
- Changes for 26.1:
  * crypto: Fix VM crash caused by crypto being purged and reloaded
    (by init:restart for example) on OS with musl libc (such as
    Alpine linux).
  * crypto: Improved understanding of LibreSSL versions. Support
    chacha20 and chacha20_poly1305 for LibreSSL 3.7. Reflect
    removal of support for the DSS/DSA algorithm which was done in
    LibreSSL 2.6.1.
  * crypto: FIPS supported by crypto for OpenSSL 3.0.* and 3.1.*.
  * asn1: The ASN.1 compiler would ignore a constraint such as
    (SIZE (1..4), ...), causing incorrect behavior of the encoding
    and decoding function for the PER and UPER backends. Corrected
    to handle the constraint in the same way as (SIZE (1..4, ...)).
  * asn1: The JER backend has been internally refactored in a way
    that is compatible for applications that use the documented
    API. However, for a group of ASN.1 modules that depend on each
    other (for example, S1AP-PDU-Descriptions, S1AP-Contents, and
    so on), all modules in the group must be recompiled if on of
    the group members is recompiled.
  * observer: Closing the trace log window via the menu did not
    work.
  * erts: maps:put with existing key and identical value was not
    optimized as a no-op correctly if having the same 32-bit hash
    as another key in the map. In practice very rare and harmless.
  * erts: Fixed an issue with truncated crash slogans on failed
    emulator start.
  * erts: Fixed a bug where the emulator was unable to determine
    the current cgroup CPU quota.
  * erts: A process optimized for parallel signal delivery could
    under some circumstances lose wakeup information. That is, the
    processes was not woken up to take care of the signal, so the
    signal would not be taken care of until the process was woken
    by another signal. Only processes configured with
    message_queue_data set to off_heap utilize this optimization.
  * erts: Function socket:close/1 could cause a VM crash on
    Windows.
  * erts: Fixed a bug in the ARM JIT where it could accidentally
    add garbage trailing bits when creating bitstrings whose size
    wasn't an even multiple of 8 bits.
  * erts: Fix erlang:system_info/1 documentation to show correct
    types.
  * erts: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * erts: Fix compilation with GNU termcap.
  * erts: Delivery time of message signals to a process not
    executing any receive expressions could become very long,
    potentially infinite. For example, a process checking for
    messages using process_info(self(), message_queue_len) or
    process_info(self(), messages) and avoiding to execute a
    receive expression matching on messages could be very slow in
    detecting new messages. Note that you are still discouraged
    from using process_info() this way. A process that wants to
    check if there are messages available to handle should execute
    a receive expression matching on messages.
  * erts: On AArch64 (ARM64), when calculating both the quotient
    and remainder with a divisor begin a power two, the remainder
    could be incorrectly calculated.
  * erts: Fix bug causing "magic" references in a compressed ETS
    table to not keep the referred object alive. The symptom would
    be the referred object being garbage collected prematurely and
    the reference appearing stale, not referring to anything.
    Examples of such magically referred objects are atomics and NIF
    resources.
  * erts: Matching out short bitstrings with a fixed size not
    divisible by 8 could could lead to the runtime system
    terminating with an "Overrun heap and stack" error.
  * erts: A constant flow of incoming non-message signals could
    prevent a process needing to execute dirty from doing so.
  * erts: A BEAM file usually contains a chunk with the tag "Type"
    containing type information that can be used by the JIT. The
    beam_lib:strip/1 takes care to preserve that chunk, but a
    build/release tool that does customized stripping could
    accidentally remove the chunk. Loading a BEAM file without the
    "Type" chunk could cause incorrect behavior of the loaded code.
  * erts: gen_udp:recv/* for Unix Domain Socket in binary mode and
    passive mode has been fixed to not crash.
  * erts: The cleanup operation of not yet delivered signals to a
    terminated process yielded excessively.
  * erts: Fixed minor hashing issue with the local option of
    term_to_binary()/term_to_iovec().
  * erts: Update gen_tcp_socket and gen_udp_socket to handle
    'completion' (socket on Windows).
  * erts: Add support for Unix Domain Sockets (only for STREAM
    sockets) on Windows for 'socket'.
  * erts: In Erlang/OTP 27, by default escripts will be compiled
    before being executed. That means that the compiler application
    must be installed. It is possible to force the escript to be
    interpreted by adding the directive -mode(interpret). to the
    escript file. In Erlang/OTP 28, support for interpreting an
    escript will be removed.
  * erts: Add basic support for socket ioctl on Windows.
  * erts: Removed erts/etc/darwin/Info.plist, as it is no longer
    necessary after macos 10.12
  * erts: Add support for (Windows) socket option exclusiveaddruse.
  * erts: [socket] Add support for the 'nopush' option.
  * erts: Add support for socket option 'BSP STATE'.
  * erts: Add tcp socket options 'keepcnt', 'keepidle' and
    'keepintvl'.
  * erts: Add support for misc (Windows) socket options
    ('max_msg_size' and 'maxdg').
  * compiler: The compiler could run forever when compiling a call
    to is_record/3 with a huge positive tuple size. The call
    is_record(A, a, 0) would crash the compiler when used in a
    function body. When used in a guard the compiler would emit
    incorrect code that would accept {a&gt; as a record.
  * compiler: Fixed a bug that caused dialyzer to crash when
    analyzing bogus code that contained the literal atom undefined
    in segment sizes.
  * compiler: The compiler would crash when compiling some modules
    that contained a call to erlang:load_nif/2.
  * compiler: Fixed a bug that caused the compiler to crash on
    legal code.
  * compiler: The compiler could crash when attempting to compile a
    call to is_list/1 in a complex expression.
  * compiler: A complex guard expression using the or operator
    could succeed when it was supposed to fail.
  * compiler: Compiling nested try/catch and catch expression could
    result in an internal compiler error.
  * compiler: Using the bnot operator in a complex expression could
    cause the compiler to terminate with an internal consistency
    failure diagnostic.
  * compiler: Fixed a bug that caused the compiler to crash in a
    binary optimization pass.
  * compiler: The compiler could terminate with an internal error
    when attempting to compile a binary pattern that could not
    possibly match.
  * compiler: Fixed various performance issues related to the alias
    optimization pass.
  * erl_docgen: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * mnesia: Do not delete old backup file if the new backup fails.
  * megaco: Make megaco transports handle gen_tcp | gen_udp with
    socket backend on Windows (completion).
  * common_test: With this change, ct_hooks manual refers to CTH
    execution order section in user guide.
  * common_test: With this change, Config data from
    pre_end_per_testcase hook is delivered to post_end_per_testcase
    callback in case of testcase timetrap or linked process crash.
  * common_test: With this change, remaining references to not
    supported vts tool in ct_run are removed (mainly relates to
    docs and ct_run help message).
  * common_test: With this change, prompt search functionality in
    ct_telnet handles unicode input.
  * common_test: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * stdlib: The compiler could run forever when compiling a call to
    is_record/3 with a huge positive tuple size. The call
    is_record(A, a, 0) would crash the compiler when used in a
    function body. When used in a guard the compiler would emit
    incorrect code that would accept {a&gt; as a record.
  * stdlib: Fix bug in ets:tab2file that could make it fail if
    another Erlang process created the same file at the same time.
  * stdlib: An {else_clause,Value} exception will now be reported
    nicely in the shell.
  * stdlib: Correct return value for error case, so that it matches
    the documented and intended return value {error,
    {already_started, pid()} when local registered names are used.
  * stdlib: sys:get_state/1,2 and sys:replace_state/2,3 has been
    corrected to handle a state named error as a state name, not as
    a failed system callback. For the standard server behaviours
    this was an issue only for gen_statem (and gen_fsm) when the
    state name was error, and for gen_server if the complete state
    was {error,_}.
  * stdlib: Multiple problems were fixed in
    filelib:safe_relative_path/2. If its second argument was a path
    that contained symbolic links, an incorrect result patch could
    be returned. Also, paths were sometimes falsely considered
    unsafe.
  * stdlib: Fix deadlock when erl.exe is used as part of a pipe on
    Windows and trying to set the encoding of the standard_io
    device.
  * stdlib: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * stdlib: Fix h/2,3 to properly render multi-clause
    documentation.
  * stdlib: Timers created by timer:apply_after/4,
    apply_interval/4, and apply_repeatedly/4 would silently fail to
    do the apply if it was not possible to spawn a process when the
    timer expired. This has now been corrected, and if the spawn
    fails, the system will be taken down producing a crash dump.
  * stdlib: When an Erlang source file lacked a module definition,
    there would be a spurious "module name must not be empty"
    diagnostic for each spec in the file.
  * stdlib: The argument descriptions for option types in argparse
    have been made less ambiguous.
  * stdlib: Clarified the documentation of normal shutdown reason
    on gen_server:call/2,3
  * stdlib: Pattern matching and equivalence (=:=, =/=) comparisons
    on 0.0 will now raise a warning, as it will no longer be
    considered equivalent to -0.0 in OTP 27. If a match on 0.0
    specifically is desired (distinct from -0.0), the warning can
    be suppressed by writing +0.0 instead. The arithmetic
    comparison operators are unaffected, including arithmetic
    equality (==). *** POTENTIAL INCOMPATIBILITY ***
  * stdlib: The semantics of the gen_{server,statem,event}
    behaviour's synchronous start behaviour introduced in OTP-26.0
    with OTP-18471, has been clarified in the documentation.
  * stdlib: Added functionality to set a custom multiline prompt.
  * stdlib: A warning for (accidental use of) Triple-Quoted Strings
    has been implemented as per EEP 64. *** POTENTIAL
    INCOMPATIBILITY ***
  * stdlib: The keyboard shortcuts for the shell are now
    configurable.
  * kernel: Fixed an issue with truncated crash slogans on failed
    emulator start.
  * kernel: Fix shell:start_interactive function specification.
  * kernel: Fix code:get_doc/1 to return missing, when it can't
    find erts instead of crashing.
  * kernel: Function socket:close/1 could cause a VM crash on
    Windows.
  * kernel: Fix deadlock when erl.exe is used as part of a pipe on
    Windows and trying to set the encoding of the standard_io
    device.
  * kernel: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * kernel: Fix logger's overload protection mechanism to only
    fetch memory used by messages when needed.
  * kernel: Fixed a number of socket-related issues causing
    incompatibilities with gen_tcp and gen_udp respectively.
  * kernel: gen_tcp:connect with socket address and socket (inet-)
    backend fails because of missing callback function.
  * kernel: The DNS RR cache used by `inet_res` has been fixed to
    preserve insert order, which is beneficial when the DNS server
    returns RRs in some specific order for e.g load balancing
    purposes.
  * kernel: The options `reuseport`, `reuseport_lb` and
    `exclusiveaddruse` were accidentally not allowed for e.g
    `gen_udp:open/1,2`, which has now been corrected.
  * kernel: gen_udp:recv/* for Unix Domain Socket in binary mode
    and passive mode has been fixed to not crash.
  * kernel: Fixed issue where cursor would not be placed at the end
    of the expression when navigating shell history.
  * kernel: Update gen_tcp_socket and gen_udp_socket to handle
    'completion' (socket on Windows).
  * kernel: Add support for Unix Domain Sockets (only for STREAM
    sockets) on Windows for 'socket'.
  * kernel: Add basic support for socket ioctl on Windows.
  * kernel: The file:location/0 type is now exported.
  * kernel: Add support for (Windows) socket option
    exclusiveaddruse.
  * kernel: [socket] Add support for the 'nopush' option.
  * kernel: Add support for socket option 'BSP STATE'.
  * kernel: Add tcp socket options 'keepcnt', 'keepidle' and
    'keepintvl'.
  * kernel: Add support for misc (Windows) socket options
    ('max_msg_size' and 'maxdg').
  * kernel: The keyboard shortcuts for the shell are now
    configurable.
  * kernel: Optimized code_server to reduce repeated work when
    loading the same module concurrently.
  * debugger: The call int:no_break(Module) did not remove any
    breakpoints.
  * debugger: The maybe expression is now supported in the
    Debugger.
  * debugger: The maybe expression is now supported in the
    Debugger.
  * debugger: The call int:no_break(Module) did not remove any
    breakpoints.
  * ssl: Avoid function clause error in ssl:getopts/2 by handling
    that inet:getopts may return an empty list during some
    circumstances, such as the socket being in a closing state.
  * ssl: The API function `ssl:recv/3` has been tightened to
    disallow negative length, which has never been documented to
    work, but was passed through and caused strange errors.
  * ssl: When a client initiated renegotiation was rejected and the
    client socket was in active mode the expected error message to
    the controlling process was not sent.
  * ssl: Add some guidance for signature algorithms configuration
    in ssl applications users guide.
  * snmp: Make snmp handle gen_udp with socket backend on Windows
    (completion).
  * public_key: Country name comparison shall be case insensitive
  * public_key: Add check to disallow duplicate certs in a path
  * inets: With this change, re_write httpd works as expected and
    does not return error.
  * inets: Fixed a bug so httpd does not crash when stopped at the
    wrong time during TLS connection negotiation, or any other
    theoretically as slow connection setup.
  * inets: Enhance error handling and avoid that the HTTP client
    hangs on headers provided on the wrong format.
  * inets: With this change, error report generated by httpd during
    connection setup contains socket type information.
  * inets: Stop and restart of the httpd server in the Inets
    application has been refactored to a more synchronous and OTP
    supervisor friendly approach. This should increase stability
    and for example avoid a supervisor report from
    httpd_connection_sup about killed child process(es) in some
    cases when stopping or restarting httpd.
  * dialyzer: Fixed a bug that caused dialyzer to crash when
    analyzing bogus code that contained the literal atom undefined
    in segment sizes.
  * dialyzer: Dialyzer could crash when attempting to analyze a
    module that defined a type called product/.
- Changes for 26.0.2:
  * erts: Fix using the IME (Input Method Editor) to enter text in
    cmd.exe and powershell.exe on Windows.
  * erts: Multiple socket:accept calls issue. When making multiple
    accept calls, only the last call is active.
  * erts: Fix the shell to ignore terminal delay when the terminal
    capabilities report that they should be used.
  * erts: Fix "oldshell" to echo characters while typing on
    Windows.
  * erts: On Windows, a call to the function socket:close, when
    there are waiting active calls to read, write or accept
    functions, could hang.
  * erts: Fix issues when reading or configuring standard_io on
    Windows when erl.exe is started using -noshell flag.
  * erts: The following functions are now much faster when given a
    long list or binary:
  * erts: On AArch64 (ARM64), equality and non-equality tests with
    literal bitstrings could succeed when they should fail and vice
    versa.
  * compiler: Fixed a type handling bug that would cause an
    internal consistence failure for correct code.
  * compiler: Fixed a bug that could cause the stack trace of throw
    exceptions to be erroneously optimized out.
  * compiler: Complex guard expression using 'or' were not always
    fully evaluated, making guards that were supposed to fail
    succeed.
  * stdlib: Fix bug where when you entered Alt+Enter in the
    terminal, the cursor would move to the last line, instead of
    moving to the next line.
  * stdlib: Fix eof handling when reading from stdin when erlang is
    started using -noshell.
  * stdlib: Fixed problem where output would disappear if it was
    received after a prompt was written in the shell.
  * stdlib: The following functions are now much faster when given
    a long list or binary:
  * kernel: Fix bug where when you entered Alt+Enter in the
    terminal, the cursor would move to the last line, instead of
    moving to the next line.
  * kernel: Fix so that the shell does not crash on startup when
    termcap is not available.
  * kernel: Multiple socket:accept calls issue. When making
    multiple accept calls, only the last call is active.
  * kernel: Fix the shell to ignore terminal delay when the
    terminal capabilities report that they should be used.
  * kernel: Fix "oldshell" to echo characters while typing on
    Windows.
  * kernel: Fix eof handling when reading from stdin when erlang is
    started using -noshell.
  * kernel: On Windows, a call to the function socket:close, when
    there are waiting active calls to read, write or accept
    functions, could hang.
  * kernel: Fix issues when reading or configuring standard_io on
    Windows when erl.exe is started using -noshell flag.
  * kernel: gen_udp:connect with inet_backend = socket fails when
    the Address is a hostname (string or atom).
  * kernel: Fixed problem which would cause shell to crash if
    particular escape sequence was written to stdout.
  * kernel: Fixed problem where output would disappear if it was
    received after a prompt was written in the shell.
  * kernel: Fix a crash where the location of erts could not be
    found in rebar3 dev builds.
  * kernel: Introduce the KERNEL application parameter
    standard_io_encoding that can be used to set the default
    encoding for standard_io. This option needs to be set to latin1
    if the application wants to treat all input data as bytes
    rather than utf-8 encoded characters.
  * ssl: Added keylog information to all protocol versions in
    ssl:connection_information/2.
  * ssl: Add RFC-6083 considerations for DTLS to enable gen_sctp
    based callback for the transport.
  * ssh: Added multiline editing support to ssh clients connected
    through OTP ssh daemon.</changelog>
  <changelog author="sflees@suse.de" date="1704974400">- Changes for 26.2.1:
  * erts: Removed unnecessary PCRE source tar-ball.
  * ssh: With this change (being response to CVE-2023-48795),
    ssh can negotiate "strict KEX" OpenSSH extension with
    peers supporting it; also
    'chacha20-poly1305@openssh.com' algorithm becomes a
    less preferred cipher.
    If strict KEX availability cannot be ensured on both
    connection sides, affected encryption modes(CHACHA and
    CBC) can be disabled with standard ssh configuration.
    This will provide protection against vulnerability, but
    at a cost of affecting interoperability. See
    Configuring algorithms in SSH. (bsc#1218192, CVE-2023-48795)
- Changes for 26.2:
  * all: Replaced unintentional Erlang Public License 1.1
    headers in some files with the intended Apache License
    2.0 header.
  * otp: The removal of the deprecated slave module, originally
    planned for OTP 27, has been postponed to OTP 29.
  * asn1: Fix benign warning from gcc 11 about mismatching call
    to free().
  * crypto: Enable engine support for OpenSSL versions 3.
  * edoc: Emit &lt;code&gt; instead of &lt;tt&gt;.
- Disable test suite for now, it has many false positives and
  takes a very long time.</changelog>
  <changelog author="sflees@suse.de" date="1706011200">- This codestream wasn't affected by bsc#1207113</changelog>
  <changelog author="sflees@suse.de" date="1706011201">- Disable rpmlint tests on SLE-15 where they currently fail</changelog>
  <changelog author="sflees@suse.de" date="1715947200">- Create a versioned package for SLES</changelog>
</package>
<package pkgid="de293a9d2746a4ab73e08f2638af1f39308d8ad96d6e82a88eead61261165485" name="erlang26-debugger" arch="s390x">
  <version epoch="0" ver="26.2.1" rel="150300.7.5.1"/>
  <changelog author="matwey.kornilov@gmail.com" date="1646568000">- Changes for 24.2.2:
  * inets: Avoid intermediate ungraceful shutdown of the HTTP
    server.
  * ssh: The ssh sever parallel_login option was missing in OTP-24</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1648382400">- Changes for 24.3.2:
  * erl_interface: Fix compile error regarding gethostbyaddr_r on
    Android. Error introduced in OTP 24.3.
  * kernel: Fix failed accepted connection setup after previous
    established connection from same node closed down silently.
  * kernel: Fixed a problem where typing Ctrl-R in the shell could
    hang if there were some problem with the history log file.
- Changes for 24.3.1:
  * dialyzer: There could be spurious warnings for unknown types
    when a type was a subtype of an existing type that was a
    subtype of an unknown type.
  * ssl: Client certification could fail for TLS-1.3 servers that
    did not include the certificat_authorties extension in its
    certificate request message.
- Changes for 24.3:
  * megaco: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.
  * megaco: Update the performance and debug chapters of the megaco
    user's guide. Also some updates to the meas tools.
  * compiler: The expression &lt;&lt;0/native-float&gt;&gt;=Bin would always
    fail to match, while &lt;&lt;0/float-native&gt;&gt;=Bin would match
    (provided that Bin contained the binary representation of 0.0)
  * compiler: The compiler will now compile huge functions with
    straight-line code faster.
  * erl_interface: Add --enable-ei-dynamic-lib configure option
    that will make erl_interface also release a dynamic library
    version of libei.
  * erl_interface: The ei API for decoding/encoding terms is not
    fully 64-bit compatible since terms that have a representation
    on the external term format larger than 2 GB cannot be handled.
  * sasl: Fix bug in systools:make_script/1 documentation.
  * inets: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.
  * inets: Documentation fix for inets:services_info/0, which now
    describes that Info might be a Reason term() in case when
    {error, Reason} is returned as service info.
  * crypto: The crypto app in OTP can since OTP-24.2 be compiled,
    linked and used with the new OpenSSL 3.0 cryptolib. The crypto
    app has 3.0 support has been improved, but is still *not
    recommended* for other usages than experiments and alpha
    testing. There are not yet any guaranties that it works, not
    even together with other OTP applications like for example SSL
    and SSH, although there are no known errors. Since the previous
    release, OTP-24.2, the following improvements have been done: -
    It has been tested during nearly every nightly test on the OTP
    lab - The hash algorithms md4 and ripemd160 have been enabled
    with OpenSSL 3.0. - The ciphers blowfish_cbc, blowfish_ecb,
    des_cbc, des_cfb, des_ecb, rc2_cbc and rc4 have been enabled
    with OpenSSL 3.0. Disabled or unsupported with OpenSSL 3.0 are
    still: - ENGINE support - FIPS mode - Other providers than the
    built-in ones - Compiling and linking with OpenSSL 3.0
    cryptolib in compatibility modes (for example to behave as
    1.1.1) and, the ciphers blowfish_cfb64 and blowfish_ofb64 are
    not supported and will not be either. Deprecated functions in
    the OpenSSL 3.0 cryptolib must not be disabled as OTP/crypto
    still uses some of the deprecated API functions. The gcc flag
  - Wno-deprecated-declarations is set to prevent deprecation
    warnings to be printed when compiling.
  * crypto: Crypto is adapted to LibreSSL 3.5.0 on OpenBSD.
  * crypto: New configure option ( --disable-otp-test-engine) to
    prohibit the build of the OTP test engine used in some test
    suites. The reason is that the test engine could be hard to
    compile on for instance LibreSSL 3.5.0. For that particular
    cryptolib version (or higher), this configure option is set
    automatically.
  * jinterface: Fix bug in OtpOutputStream.write_pid/4 and
    write_ref/3 causing faulty encodig. Bug exists since OTP 23.0.
  * wx: Removed the static_data option from wxImage creation
    functions, as it was broken and could lead to crashes. Now
    image data is always copied to wxWidgets as was the default
    behavior. Removed some non working wxGridEvent event types,
    which have there own events in newer wxWidgets versions, and
    added a couple of event types that where missing in wx.
  * asn1: Add support for the maps option in combination with the
    jer backend.
  * snmp: The compilation time is no longer recorded in BEAM files.
    There remained several undocumented functions that attempted to
    retrieve compilation times. Those have now been removed.
  * snmp: [agent] Remove expectation of socket being a port.
  * common_test: OTP internal test fix.
  * runtime_tools: Fixed bug in scheduler:utilization(Seconds) that
    would leave the scheduler_wall_time system flag incorrectly
    enabled.
  * runtime_tools: Add scheduler:get_sample/0 and get_sample_all/0.
    Also clarify scheduler module documentation about how it
    depends on system flag scheduler_wall_time.
  * erts: Fixed a bug in the x86 JIT that might cause floating
    point instructions to wrongly throw an exception.
  * erts: Preserve correct nodedown_reason if supervised
    distribution controller processes exit with {shutdown, Reason}.
  * erts: Handling of send_timeout for gen_tcp has been corrected
    so that the timeout is honored also when sending 0 bytes.
  * erts: By default global does not take any actions to restore a
    fully connected network when connections are lost due to
    network issues. This is problematic for all applications
    expecting a fully connected network to be provided, such as for
    example mnesia, but also for global itself. A network of
    overlapping partitions might cause the internal state of global
    to become inconsistent. Such an inconsistency can remain even
    after such partitions have been brought together to form a
    fully connected network again. The effect on other applications
    that expects that a fully connected network is maintained may
    vary, but they might misbehave in very subtle hard to detect
    ways during such a partitioning. In order to prevent such
    issues, we have introduced a prevent overlapping partitions fix
    which can be enabled using the prevent_overlapping_partitions
    kernel(6) parameter. When this fix has been enabled, global
    will actively disconnect from nodes that reports that they have
    lost connections to other nodes. This will cause fully
    connected partitions to form instead of leaving the network in
    a state with overlapping partitions. Note that this fix has to
    be enabled on all nodes in the network in order to work
    properly. Since this quite substantially changes the behavior,
    this fix is currently disabled by default. Since you might get
    hard to detect issues without this fix you are, however,
    strongly advised to enable this fix in order to avoid issues
    such as the ones described above. As of OTP 25 this fix will
    become enabled by default.
  * erts: Corrected the type specification of erlang:seq_trace/2.
  * erts: Fix memory leak when tracing on running on a process that
    only handle system tasks or non-message signals (for example
    process_info requests).
  * erts: Add support for using socket:sockaddr_in() and
    socket:sockaddr_in6() when using gen_sctp, gen_tcp and gen_udp.
    This will make it possible to use Link Local IPv6 addresses.
  * erts: Show on_load failure reasons in embedded mode.
  * erts: Compile date saved in the Erlang VM executable has been
    removed.
  * erts: Improve documentation for the dynamic node name feature.
  * ssh: Fix makefile dependency bugs.
  * ssh: Fixed faulty OpenSSH decoding of Ed25519/Ed448 keys in the
    OpenSSH format openssh_key_v1.
  * ssh: Correction of ssh_file typing, specially for the
    experimental openssh-key-v1 encoding.
  * ssh: Improper tag for private ED keys when encoding with
    ssh:encode/2. The tuple had ed_priv as first element, but
    should have had ed_pri. This is now corrected. *** POTENTIAL
    INCOMPATIBILITY ***
  * ssh: Add support for Ed25519/Ed448 SSH host keys in the RFC
    4716 format ("-----BEGIN EC PRIVATE KEY-----") generated by for
    example openssl or via Erlang functions (i.e.
    public_key:generate_key({namedCurve, ed25519})). Ed25519 SSH
    host keys generated by ssh-keygen was, and are still,
    supported.
  * kernel: Handling of send_timeout for gen_tcp has been corrected
    so that the timeout is honored also when sending 0 bytes.
  * kernel: By default global does not take any actions to restore
    a fully connected network when connections are lost due to
    network issues. This is problematic for all applications
    expecting a fully connected network to be provided, such as for
    example mnesia, but also for global itself. A network of
    overlapping partitions might cause the internal state of global
    to become inconsistent. Such an inconsistency can remain even
    after such partitions have been brought together to form a
    fully connected network again. The effect on other applications
    that expects that a fully connected network is maintained may
    vary, but they might misbehave in very subtle hard to detect
    ways during such a partitioning. In order to prevent such
    issues, we have introduced a prevent overlapping partitions fix
    which can be enabled using the prevent_overlapping_partitions
    kernel(6) parameter. When this fix has been enabled, global
    will actively disconnect from nodes that reports that they have
    lost connections to other nodes. This will cause fully
    connected partitions to form instead of leaving the network in
    a state with overlapping partitions. Note that this fix has to
    be enabled on all nodes in the network in order to work
    properly. Since this quite substantially changes the behavior,
    this fix is currently disabled by default. Since you might get
    hard to detect issues without this fix you are, however,
    strongly advised to enable this fix in order to avoid issues
    such as the ones described above. As of OTP 25 this fix will
    become enabled by default.
  * kernel: Fix bug where logger would crash when logging a report
    including improper lists.
  * kernel: Make erlang:set_cookie work for dynamic node names.
  * kernel: Add support for using socket:sockaddr_in() and
    socket:sockaddr_in6() when using gen_sctp, gen_tcp and gen_udp.
    This will make it possible to use Link Local IPv6 addresses.
  * kernel: A net_tickintensity kernel parameter has been
    introduced. It can be used to control the amount of ticks
    during a net_ticktime period. A new net_kernel:start/2 function
    has also been introduced in order to make it easier to add new
    options. The use of net_kernel:start/1 has been deprecated.
  * kernel: Improve documentation for the dynamic node name
    feature.
  * erl_docgen: Fix css for large tables and images on small
    screens
  * erl_docgen: Fix bug with codeinclude tag that caused it to not
    include the code if used in a correct, but unexpected way.
  * observer: Calculate the display width in etop, instead of hard-
    coding it to 89 characters.
  * debugger: Fix record index matching, it was broken and could
    never match.
  * ssl: Improved error handling.
  * ssl: Before this change, net_kernel used with TLS distribution
    might be leaking processes in case of connectivity issues.
  * ssl: Fix makefile dependency bugs.
  * ssl: Make sure the TLS sender process handles explicit calls to
    erlang:disconnect_node properly, avoiding potential hanging
    problems in net_kernel.
  * ssl: Add support for TLS-1.3 certificate_authorities extension.
    And process certificate_authorities field in pre-TLS-1.3
    certificate requests.
  * ssl: Support password fun for protected keyfiles in ssl:connect
    function.
  * ssl: Add in some cases earlier detection of possible DoS
    attacks by malicious clients sending unexpected TLS messages
    instead of the client hello. Note that such attacks are already
    mitigated by providing a timeout for the TLS handshake.
  * eldap: Fix eldap extensibleMatch dnAttributes option. According
    to the ldap ASN1 the dnAttributes should be a bool, instead it
    was generated as a string.
  * eldap: Implemented paged searches according to https://www.rfc-
    editor.org/rfc/rfc2696.txt
  * public_key: Support password fun for protected keyfiles in
    ssl:connect function.
  * stdlib: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.
  * mnesia: Reduce the number of locks taken during table copying,
    should reduce the startup time on large systems.
  * diameter: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1649246400">- Fix build for Factory. Currently, any Java version
  is fine for Erlang.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1653220800">- Version 25.0:
  - stdlib
  * New function filelib:ensure_path/1 will ensure that all
    directories for the given path exists
  * New functions groups_from_list/2 and groups_from_list/3 in
    the maps module
  * New functions uniq/1 uniq/2 in the lists module
  * New PRNG added to the rand module, for fast pseudo-random
    numers.
  - compiler, kernel, stdlib, syntax_tools:
  * Added support for selectable features as described in EEP-60.
    Features can be enabled/disabled during compilation with
    options (ordinary and +term) to erlc as well as with
    directives in the file. Similar options can be used to erl
    for enabling/disabling features allowed at runtime. The new
    maybe expression EEP-49 is fully supported as the feature
    maybe_expr.
  - erts &amp; JIT:
  * The JIT now works for 64-bit ARM processors.
  * The JIT now does type-based optimizations based on type
    information in the BEAM files.
  * Improved the JIT’s support for external tools like perf and
    gdb, allowing them to show line numbers and even the original
    Erlang source code when that can be found.
  - erts, stdlib, kernel:
  * Users can now configure ETS tables with the
    {write_concurrency, auto} option. This option forces tables
    to automatically change the number of locks that are used at
    run-time depending on how much concurrency is detected. The
    {decentralized_counters, true} option is enabled by default
    when {write_concurrency, auto} is active.
  * Benchmark results comparing this option with the other ETS
    optimization options are available here: benchmarks.
  * To enable more optimizations, BEAM files compiled with OTP 21
    and earlier cannot be loaded in OTP 25.
  * The signal queue of a process with the process flag
    message_queue_data=off_heap has been optimized to allow
    parallel reception of signals from multiple processes. This
    can improve performance when many processes are sending in
    parallel to one process. See benchmark.
  * The Erlang installation directory is now relocatable on the
    file system given that the paths in the installation’s
    RELEASES file are paths that are relative to the
    installations root directory.
  * A new option called short has been added to the functions
    erlang:float_to_list/2 and erlang:float_to_binary/2. This
    option creates the shortest correctly rounded string
    representation of the given float that can be converted back
    to the same float again.
  * Introduction of quote/1 and unquote/1 functions in the
    uri_string module - a replacement for the deprecated
    functions http_uri:encode and http_uri:decode.
  * The new module peer supersedes the slave module. The slave
    module is now deprecated and will be removed in OTP 27.
  * global will now by default prevent overlapping partitions due
    to network issues. This is done by actively disconnecting
    from nodes that reports that they have lost connections to
    other nodes. This will cause fully connected partitions to
    form instead of leaving the network in a state with
    overlapping partitions.
  * It is possible to turn off the new behavior by setting the
    the kernel configuration parameter
    prevent_overlapping_partitions to false. Doing this will
    retain the same behavior as in OTP 24 and earlier.
  * The format_status/2 callback for gen_server, gen_statem and
    gen_event has been deprecated in favor of the new
    format_status/1 callback.
  * The new callback adds the possibility to limit and change
    many more things than the just the state.
  * The timer module has been modernized and made more efficient,
    which makes the timer server less susceptible to being
    overloaded. The timer:sleep/1 function now accepts an
    arbitrarily large integer.
  - compiler:
  * The maybe ... end construction as proposed in EEP-49 has been
    implemented. It can simplify complex code where otherwise
    deeply nested cases would have to be used.
  * To enable maybe, give the option {enable_feature,maybe_expr}
    to the compiler. The exact option to use will change in a
    coming release candidate and then it will also be possible to
    use from inside the module being compiled.
  * When a record matching or record update fails, a {badrecord,
    ExpectedRecordTag} exception used to be raised. In this
    release, the exception has been changed to {badrecord,
    ActualValue}, where ActualValue is the value that was found
    instead of the expected record.
  * Add compile attribute -nifs() to empower compiler and loader
    with information about which functions may be overridden as
    NIFs by erlang:load_nif/2.
  * Improved and more detailed error messages when binary
    construction with the binary syntax fails. This applies both
    for error messages in the shell and for
    erl_error:format_exception/3,4.
  * Change format of feature options and directives for better
    consistency. Options to erlc and the -compile(..) directive
    now has the format {feature, feature-name, enable | disable}.
    The -feature(..) now has the format -feature(feature-name,
    enable | disable).
  - crypto:
  * Add crypto:hash_equals/2 which is a constant time comparision
    of hashvalues.
  - ssl:
  * Introducing a new (still experimental) option
    {certs_keys,[cert_key_conf()]}. With this a list of a
    certificates with their associated key may be used to
    authenticate the client or the server. The certificate key
    pair that is considered best and matches negotiated
    parameters for the connection will be selected.
  - public_key:
  * Functions for retrieving OS provided CA-certs added.
  - dialyzer:
  * Optimize operations in the erl_types module. Parallelize the
    Dialyzer pass remote.
  * Added the missing_return and extra_return options to raise
    warnings when specifications differ from inferred types.
    These are similar to, but not quite as verbose as overspecs
    and underspecs.
  * Dialyzer now better understands the types for min/2, max/2,
    and erlang:raise/3. Because of that, Dialyzer can potentially
    generate new warnings. In particular, functions that use
    erlang:raise/3 could now need a spec with a no_return()
    return type to avoid an unwanted warning.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1656849600">- Changes for 25.0.2:
  * ssl: Improved handling of unexpected messages during the
    handshake, taking the right action for unexpected messages.
  * erts: On computers with the ARM64 (AArch64) architecture (such
    as Apple Silicon Macs) a rem expression followed by a div
    expression with the same operands could evaluate to the wrong
    result if the result of the rem expression was unused.
- Changes for 25.0.1:
  * ssl: When a TLS-1.3 enabled client tried to talk to a TLS-1.2
    server that coalesces TLS-1.2 handshake message over one TLS
    record, the connection could fail due to some message being
    handled in the wrong state, this has been fixed.
  * ssl: Correctly handles supported protocol version change from
    default to something else by sni_fun supplied to
    ssl:handshake/[2,3] together with a TCP-socket (so called
    upgrade).
  * ssl: Also, TLS-1.3 should respond with a protocol version alert
    if previous versions, that are supported but not configured,
    are attempted.
  * kernel: The DNS resolver inet_res has been fixed to ignore
    trailing dot difference in the request domain between the sent
    request and the received response, when validating a response.
  * kernel: A bug in inet_res has been fixed where a missing
    internal {ok,_} wrapper caused inet_res:resolve/* to return a
    calculated host name instead of an `{ok,Msg} tuple, when
    resolving an IP address or a host name that is an IP address
    string.
  * kernel: The erlang:is_alive() BIF could return true before
    configured distribution service was available. This bug was
    introduced in OTP 25.0 ERTS version 13.0. The
    erlang:monitor_node() and erlang:monitor() BIFs could
    erroneously fail even though configured distribution service
    was available. This occurred if these BIFs were called after
    the distribution had been started using dynamic node name
    assignment but before the name had been assigned.
  * kernel: Added the missing mandatory address/0 callback in the
    gen_tcp_dist example.
  * erts: A spawn_reply signal from a remote node could be delayed
    and be delivered after other signals from the newly spawned
    process. When this bug triggered, the connection to the node
    where the process was spawned sometimes could be taken down due
    to the bug. The following error message would then be logged if
    this happened: Missing 'spawn_reply' signal from the node
    &lt;RemoteNode&gt; detected by &lt;Pid&gt; on the node &lt;LocalNode&gt;. The
    node &lt;RemoteNode&gt; probably suffers from the bug with ticket id
    OTP-17737. This bug only affected processes which had enabled
    off_heap message_queue_data and parallel reception of signals
    had been automatically enabled. This bug was introduced in OTP
    25.0, ERTS version 13.0.
  * erts: Fixed type spec of erlang:system_info(dist_ctrl).
  * erts: The zlib built in to the runtime system has been updated
    to version 1.2.12. (Note that on most platforms, the platform's
    own zlib is used.)
  * erts: The erlang:is_alive() BIF could return true before
    configured distribution service was available. This bug was
    introduced in OTP 25.0 ERTS version 13.0. The
    erlang:monitor_node() and erlang:monitor() BIFs could
    erroneously fail even though configured distribution service
    was available. This occurred if these BIFs were called after
    the distribution had been started using dynamic node name
    assignment but before the name had been assigned.
  * crypto: Note in the documentation that MODP (rfc3526) groups
    and OpenSSL 3.0 can give an error if a call to
    crypto:generate_key/2 specifies a key length, and that length
    is to small.
  * crypto: The cmac now uses only the 3.0 API
  * crypto: Documentation is now updated with which OpenSSL
    cryptolib versions that OTP currently is tested.
  * dialyzer: Fixed the documentation for the missing_return and
    extra_return options.
  * mnesia: Fixed add_table_copy which could leave a table lock if
    the receiving node went down during the operation.
  * ssh: Binaries can be limited in logs with the parameter
    max_log_item_len. The default value is 500 bytes.
  * stdlib: In the initial release of Erlang/OTP 25, the expression
    bound to the _ pseudo-field in a record initialization would
    always be evaluated once, even if all other fields in the
    record were explicitly initialized. That would break the use
    case of binding the expression error(...) to _ in order to get
    an exception if not all fields were initialized. The behavior
    of binding to _ has been reverted to the pre-OTP 25 behavior,
    that is, to not evaluate the expression if all fields have been
    bound to explicit values.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1660046400">- Changes for 25.0.3:
  * erts: Distributed exit signals could be lost under the
    following conditions:
  * erts: A race could cause process_info(Pid, message_queue_len)
    on other processes to return invalid results.
  * erts: Fixed reduction counting for handling process system
    tasks.
  * erts: Priority elevation of terminating processes did not work
    which could cause execution of such processes to be delayed.
  * erts: An unlink operation made by a process that terminated
    before the unlink operation completed, i.e., before it had
    received an unlink-ack signal from the linked process, caused
    an exit signal to erroneously be sent from the terminating
    process to the process being unlinked. This exit signal would
    most often be ignored by the receiver, but if the receiver of
    the exit signal concurrently set up a new link, it could
    receive the exit signal with the actual exit reason of the
    terminating process instead of a noproc exit reason. It is
    however very hard to detect that this has happened and has no
    obvious negative consequences, so it should be considered
    harmless. A distributed unlink-ack signal received by a
    terminating process was also not properly removed which could
    cause a minor memory leak.
  * ssl: The link to crypto:engine_load refered the function with
    wrong arity.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1661601600">- Changes for 25.0.4:
  * kernel: A call to net_kernel:setopts(new, Opts) at the same
    time as a connection was being set up could cause a deadlock
    between the net_kernel process and the process setting up the
    connection.
  * erts: The monitor/3 BIF did not apply options to the created
    monitor if the target process or port did not exist. That is,
    the corresponding down message would get a `DOWN` tag even if a
    custom tag had been set, and the returned reference was not an
    alias even if the alias option had been passed.
  * erts: The erlang:monotonic_time/1, erlang:system_time/1,
    erlang:time_offset/1, and os:system_time/1 BIFs erroneously
    failed when passed the argument native.</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1665662400">- Changes for 25.1.1:
  * dialyzer: Dialyzer could crash when analyzing Elixir code that
    used intricate macros.
  * dialyzer: The --input_list_file option has been added.
  * ssl: Fixes handling of symlinks in cacertfile option.
  * eunit: With this change, eunit exact_execution option works
    with application primitive.
  * stdlib: peer nodes failed to halt when the process supervising
    the control connection crashed. When an alternative control
    connection was used, this supervision process also quite
    frequently crashed when the peer node was stopped by the node
    that started it which caused the peer node to linger without
    ever halting.
  * asn1: For the per and uper ASN.1 encoding rules, encoding and
    decoding the SEQUENCE OF and SET OF constructs with 16384 items
    or more is now supported.
  * erts: Listen sockets created with the socket module, leaked
    (erlang-) monitors.
  * erts: Notifications about available distribution data sent to
    distribution controller processes could be lost. Distribution
    controller processes can be used when implementing an
    alternative distribution carrier. The default distribution over
    tcp was not effected and the bug was also not present on
    x86/x86_64 platforms.
  * kernel: Listen sockets created with the socket module, leaked
    (erlang-) monitors.
  * kernel: peer nodes failed to halt when the process supervising
    the control connection crashed. When an alternative control
    connection was used, this supervision process also quite
    frequently crashed when the peer node was stopped by the node
    that started it which caused the peer node to linger without
    ever halting.
- Changes for 25.1:
  * dialyzer: Two bugs have been fixed in Dialyzer's checking of
    behaviors: When a mandatory callback function is present but
    not exported, Dialyzer would not complain about a missing
    callback. When an optional callback function was not exported
    and had incompatible arguments and/or the return values were
    incompatible, Dialyzer would complain. This has been changed to
    suppress the warning, because the function might not be
    intended to be a callback function, for instance if a release
    added a new optional callback function (such as format_status/1
    for the gen_server behaviour added in OTP 25).
  * dialyzer: The no_extra_return and no_missing_return warnings
    can now be suppressed through -dialyzer directives in source
    code.
  * jinterface: Fix javadoc build error by adding option -encoding
    UTF-8.
  * diameter: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * crypto: Fix configure with --with-ssl and --disable-dynamic-
    ssl-lib on Windows.
  * crypto: Remove all references correctly in the garbage
    collection if an engine handle was not explicit unloaded.
  * crypto: Changed the behaviour of the engine load/unload
    functions The engine load/unload functions have got changed
    semantics to get a more consistent behaviour and work correct
    when variables are garbage collected. The load functions now
    don't register the methods for the engine to replace. That will
    now be handled with the new functions
    engine_register/engine_unregister if needed. Some functions are
    removed from the documentation and therefor the API, but they
    are left in the code for compatibility. *** POTENTIAL
    INCOMPATIBILITY ***
  * crypto: Fixed a naming bug for AES-CFB and Blowfish-CFB/OFB
    when linked with OpenSSL 3.0 cryptolib.
  * crypto: Sign/verify does now behave as in OTP-24 and earlier
    for eddsa.
  * crypto: Pass elliptic curve names from crypto.erl to crypto's
    nif.
  * crypto: The configure option --disable-deprecated-warnings is
    removed. It was used for some releases when the support for
    OpenSSL 3.0 was not completed. It is not needed in OTP 25.
  * crypto: Crypto is now considered to be usable with the OpenSSL
    3.0 cryptolib for production code. ENGINE and FIPS are not yet
    fully functional.
  * crypto: Do not exit if the legacy provider is missing in
    libcrypto 3.0.
  * ssl: Reject unexpected application data in all relevant places
    for all TLS versions. Also, handle TLS-1.3 middlebox
    compatibility with more care. This will make malicious
    connections fail early and further, mitigate possible DoS
    attacks, that would be caught by the handshake timeout. Thanks
    to Aina Toky Rasoamanana and Olivier Levillain from Télécom
    SudParis for alerting us of the issues in our implementation.
  * ssl: With this change, value of cacertfile option will be
    adjusted before loading certs from the file. Adjustments
    include converting relative paths to absolute and converting
    symlinks to actual file path. Thanks to Marcus Johansson
  * ssl: In TLS-1.3, if chain certs are missing (so server auth
    domain adherence can not be determined) send peer cert and hope
    the server is able to recreate a chain in its auth domain.
  * ssl: Make sure periodical refresh of CA certificate files
    repopulates cache properly.
  * ssl: Correct internal CRL cache functions to use internal
    format consistently.
  * ssl: Incorrect handling of client middlebox negotiation for
    TLS-1.3 could result in that a TLS-1.3 server would not use
    middlebox mode although the client was expecting it too and
    failing the negotiation with unexpected message.
  * ssl: If the "User" process, the process starting the TLS
    connection, gets killed in the middle of spawning the dynamic
    connection tree make sure we do not leave any processes behind.
  * ssl: A vulnerability has been discovered and corrected. It is
    registered as CVE-2022-37026 "Client Authentication Bypass".
    Corrections have been released on the supported tracks with
    patches 23.3.4.15, 24.3.4.2, and 25.0.2. The vulnerability
    might also exist in older OTP versions. We recommend that
    impacted users upgrade to one of these versions or later on the
    respective tracks. OTP 25.1 would be an even better choice.
    Impacted are those who are running an ssl/tls/dtls server using
    the ssl application either directly or indirectly via other
    applications. For example via inets (httpd), cowboy, etc. Note
    that the vulnerability only affects servers that request client
    certification, that is sets the option {verify, verify_peer}.
    (bsc#1205318)
  * eunit: With this change, Eunit can optionally not try to
    execute related module with "_tests" suffix. This might be used
    for avoiding duplicated executions when source and test modules
    are located in the same folder.
  * erl_docgen: Update DTD to allow XML tag em under pre.
  * inets: Add httpc:ssl_verify_host_options/1 to help setting
    default ssl options for the https client.
  * inets: This change fixes dialyzer warnings generated for
    inets/httpd examples (includes needed adjustment of spec for
    ssh_sftp module).
  * inets: Remove documentation of no longer supported callback.
  * stdlib: Fixed inconsistency bugs in global due to
    nodeup/nodedown messages not being delivered before/after
    traffic over connections. Also fixed various other
    inconsistency bugs and deadlocks in both global_group and
    global. As building blocks for these fixes, a new BIF
    erlang:nodes/2 has been introduced and
    net_kernel:monitor_nodes/2 has been extended. The -hidden and
  - connect_all command line arguments did not work if multiple
    instances were present on the command line which has been
    fixed. The new kernel parameter connect_all has also been
    introduced in order to replace the -connect_all command line
    argument.
  * stdlib: Fix the public_key:ssh* functions to be listed under
    the correct release in the Removed Functionality User's Guide.
  * stdlib: The type spec for format_status/1 in gen_statem,
    gen_server and gen_event has been corrected to state that the
    return value is of the same type as the argument (instead of
    the same value as the argument).
  * stdlib: If the timer server child spec was already present in
    kernel_sup but it was not started, the timer server would fail
    to start with an {error, already_present} error instead of
    restarting the server.
  * stdlib: When changing callback module in gen_statem the
    state_enter calls flag from the old module was used in for the
    first event in the new module, which could confuse the new
    module and cause malfunction. This bug has been corrected. With
    this change some sys debug message formats have been modified,
    which can be a problem for debug code relying on the format.
  * ** POTENTIAL INCOMPATIBILITY ***
  * stdlib: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * stdlib: The rfc339_to_system_time/1,2 functions now allows the
    minutes part to be omitted from the time zone.
  * stdlib: The receive statement in gen_event has been optimized
    to not use selective receive (which was never needed, and could
    cause severe performance degradation under heavy load).
  * stdlib: Add new API function erl_features:configurable/0
  * parsetools: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * public_key: Support more Linux distributions in cacerts_load/0.
  * public_key: Correct asn1 typenames available in type
    pki_asn1_type()
  * public_key: Sign/verify does now behave as in OTP-24 and
    earlier for eddsa.
  * snmp: Improved the get-bulk response max size calculation. Its
    now possible to configure 'empty pdu size', see appendix c for
    more info.
  * snmp: Fix various example dialyzer issues
  * ssh: Handling rare race condition at channel close.
  * ssh: New ssh option no_auth_needed to skip the ssh
    authentication. Use with caution!
  * ssh: This change fixes dialyzer warnings generated for
    inets/httpd examples (includes needed adjustment of spec for
    ssh_sftp module).
  * ssh: The new function ssh:daemon_replace_options/2 makes it
    possible to change the Options in a running SSH server.
    Established connections are not affected, only those created
    after the call to this new function.
  * ssh: Add a timeout as option max_initial_idle_time. It closes a
    connection that does not allocate a channel within the timeout
    time. For more information about timeouts, see the Timeouts
    section in the User's Guide Hardening chapter.
  * observer: Fixed units in gui.
  * xmerl: There is a new configure option, --enable-deterministic-
    build, which will apply the deterministic compiler option when
    building Erlang/OTP. The deterministic option has been improved
    to eliminate more sources of non-determinism in several
    applications.
  * asn1: There is a new configure option, --enable-deterministic-
    build, which will apply the deterministic compiler option when
    building Erlang/OTP. The deterministic option has been improved
    to eliminate more sources of non-determinism in several
    applications.
  * erts: Fixed inconsistency bugs in global due to nodeup/nodedown
    messages not being delivered before/after traffic over
    connections. Also fixed various other inconsistency bugs and
    deadlocks in both global_group and global. As building blocks
    for these fixes, a new BIF erlang:nodes/2 has been introduced
    and net_kernel:monitor_nodes/2 has been extended. The -hidden
    and -connect_all command line arguments did not work if
    multiple instances were present on the command line which has
    been fixed. The new kernel parameter connect_all has also been
    introduced in order to replace the -connect_all command line
    argument.
  * erts: Fixed IPv6 multicast_if and membership socket options.
  * erts: Accept funs (NEW_FUN_EXT) with incorrectly encoded size
    field. This is a workaround for a bug (OTP-18104) existing in
    OTP 23 and 24 that could cause incorrect size fields in certain
    cases. The emulator does not use the decoded size field, but
    erl_interface still does and is not helped by this workaround.
  * erts: Fixed issue with inet:getifaddrs hanging on pure IPv6
    Windows
  * erts: Fix faulty distribution encoding of terms with either The
    symptom could be failed decoding on the receiving side leading
    to aborted connection. Fix OTP-18093 is a workaround for theses
    bugs that makes the VM accepts such faulty encoded funs. The
    first encoding bug toward pending connection exists only in OTP
    23 and 24, but the second one exists also on OTP 25.
  * erts: Fixed emulator crash that could happen during crashdump
    generation of ETS tables with options ordered_set and
    {write_concurrency,true}.
  * erts: Retrieval of monotonic and system clock resolution on
    MacOS could cause a crash and/or erroneous results.
  * erts: Fix bug where the max allowed size of erl +hmax was lower
    than what was allowed by process_flag.
  * erts: On computers with ARM64 (AArch64) processors, the JIT
    could generate incorrect code when more than 4095 bits were
    skipped at the tail end of a binary match.
  * erts: In rare circumstances, an is_binary/1 guard test could
    succeed when given a large integer.
  * erts: Fix bug causing ets:info (and sometimes ets:whereis) to
    return 'undefined' for an existing table if a concurrent
    process were doing ets:insert with a long list on the same
    table.
  * erts: Fix writing and reading of more than 2 GB in a single
    read/write operation on macOS. Before this fix attempting to
    read/write more than 2GB would result in {error,einval}.
  * erts: Fix bug sometimes causing emulator crash at node shutdown
    when there are pending connections. Only seen when running duel
    distribution protocols, inet_drv and inet_tls_dist.
  * erts: Yield when adjusting large process message queues due to
    The message queue adjustment work will now be interleaved with
    all other types of work that processes have to do, even other
    message queue adjustment work.
  * erts: Add rudimentary debug feature (option) for the inet-
    driver based sockets, such as gen_tcp and gen_udp.
  * erts: Introduced the hidden and dist_listen options to
    net_kernel:start/2. Also documented the -dist_listen command
    line argument which was erroneously documented as a kernel
    parameter and not as a command line argument.
  * erts: New documentation chapter "Debugging NIFs and Port
    Drivers" under Interoperability Tutorial.
  * erts: Add new API function erl_features:configurable/0
  * kernel: Fixed inconsistency bugs in global due to
    nodeup/nodedown messages not being delivered before/after
    traffic over connections. Also fixed various other
    inconsistency bugs and deadlocks in both global_group and
    global. As building blocks for these fixes, a new BIF
    erlang:nodes/2 has been introduced and
    net_kernel:monitor_nodes/2 has been extended. The -hidden and
  - connect_all command line arguments did not work if multiple
    instances were present on the command line which has been
    fixed. The new kernel parameter connect_all has also been
    introduced in order to replace the -connect_all command line
    argument.
  * kernel: Fixed IPv6 multicast_if and membership socket options.
  * kernel: Fixed issue with inet:getifaddrs hanging on pure IPv6
    Windows
  * kernel: The type specifications for inet:getopts/2 and
    inet:setopts/2 have been corrected regarding SCTP options.
  * kernel: The type specifications for inet:parse_* have been
    tightened.
  * kernel: Fix gen_tcp:connect/3 spec to include the inet_backend
    option.
  * kernel: Fix bug where using a binary as the format when calling
    logger:log(Level, Format, Args) (or any other logging function)
    would cause a crash or incorrect logging.
  * kernel: Add rudimentary debug feature (option) for the inet-
    driver based sockets, such as gen_tcp and gen_udp.
  * kernel: Introduced the hidden and dist_listen options to
    net_kernel:start/2. Also documented the -dist_listen command
    line argument which was erroneously documented as a kernel
    parameter and not as a command line argument.
  * kernel: Scope and group monitoring have been introduced in pg.
    For more information see the documentation of
    pg:monitor_scope(), pg:monitor(), and pg:demonitor().
  * kernel: A new function global:disconnect/0 has been introduced
    with which one can cleanly disconnect a node from all other
    nodes in a cluster of global nodes.
  * compiler: The compiler will now forbid using the empty atom ''
    as module name. Also forbidden are modules names containing
    control characters, and module names containing only spaces and
    soft hyphens.
  * compiler: The bin_opt_info and recv_opt_info options would
    cause the compiler to crash when attempting to compile
    generated code without location information.
  * compiler: In rare circumstances involving floating point
    operations, the compiler could terminate with an internal
    consistency check failure.
  * compiler: In rare circumstances when doing arithmetic
    instructions on non-numbers, the compiler could crash.
  * compiler: In rare circumstances, complex boolean expressions in
    nested cases could cause the compiler to crash.
  * compiler: Expression similar to #{assoc:=V} = #key=&gt;self()}, V
    would return the empty map instead of raising an exception.
  * compiler: Eliminated a crash in the beam_ssa_bool pass of the
    compiler when compiling a complex guard expression.
  * compiler: In rare circumstances, the compiler could crash with
    an internal consistency check failure.
  * compiler: When compiling with the option inline_list_funcs, the
    compiler could produce a nonsensical warning.
  * compiler: When given the no_ssa_opt option, the compiler could
    terminate with an internal consistency failure diagnostic when
    compiling map matching.
  * compiler: Made warnings for existing atoms being keywords in
    experimental features more precise, by not warning about quoted
    atoms.
  * compiler: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * megaco: Fixed various dialyzer related issues in the examples
    and the application proper.
  * megaco: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * common_test: Fix cth_surefire to handle when a suite is not
    compiled with debug_info. This bug has been present since
    Erlang/OTP 25.0.
  * common_test: Common Test now preserves stack traces for throws.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1669291200">- Changes for 25.1.2:
  * mnesia: Don't fill the logs if mnesia can't connect to all
    nodes, due to partitioned network.
  * erts: Add abandon carrier free utilization limit (+Muacful)
    option to erts_alloc. This option allows the user to mark
    unused segments in a memory carrier as re-useable by the OS if
    needed. This functionality was a non-configurable default
    before Erlang/OTP 25, but removed due to performance issues.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1671364800">- Changes for 25.2:
  * erts: Fix perf/gdb JIT symbols to not contain CodeInfoPrologue
    for the JIT internal module erts_beamasm.
  * erts: Fixed minor memory leaks.
  * erts: Fix bugs in ets:insert and ets:insert_new when called
    with a list of tuples to insert while a concurrent process
    either deletes or renames the table. The table deletion could
    be done with ets:delete/1 or be caused by termination of the
    table owning process. Symptoms are either VM crash or strange
    incorrect behavior from the insert operation. The risk of
    triggering the bugs increases with the length of the list of
    tuple to insert. Bugs exist since OTP 23.0.
  * erts: Boost execution of scheduled thread progress jobs. This
    to prevent memory exhaustion in extremely rapid
    allocation/deallocation scenarios, such as repeated ETS table
    creations/deletions.
  * erts: Fix segv crash during crash dumping an ETS table doing
    ets:delete_all_objects.
  * erts: Spec for function net:if_names/0 incorrect
  * erts: Fix bug in binary_to_term decoding a binary term 2Gbyte
    or larger.
  * erts: Documentation of erlang:module_loaded/1 has been
    adjusted:
  * erts: Fix list_to_atom/1 for negative code points. Could either
    return with a positive code point or fail with an incorrect
    exception.
  * erts: Fix rare bug causing VM crash when sending to a pid of a
    spawning process returned from erlang:processes/0. Only seen
    when provoked by system process literal_area_collector,
    triggered by a module purge operation, on a VM started with
    +Meamin (no customized allocators).
  * erts: gen_udp:open/2 with option(s) add_membership or
    drop_membership would drop earlier options.
  * erts: The inet:setopts/2 {reuseaddr, true} option will now be
    ignored on Windows unless the socket is an UDP socket. For more
    information see the documentation of the reuseaddr option part
    of the documentation of inet:setopts/2. Prior to OTP 25 the
    {reuseaddr, true} option was ignored for all sockets on
    Windows, but as of OTP 25.0 this was changed so that it was not
    ignored for any sockets. *** POTENTIAL INCOMPATIBILITY ***
  * erts: Fix bug in binary_to_term decoding a list of length 1G or
    longer.
  * erts: Fix bug in binary_to_term (and distributed receive) when
    decoding a large map (&gt;32 keys) with unsorted small maps (&lt;=
    32) as keys of the large map. This was only a problem if the
    term was encoded by erl_interface, jinterface or otherwise, as
    the VM itself always encodes small maps with sorted keys. The
    "binary_to_term" would appear as successful but the created
    large map was internally inconsistent. The smaller key-maps
    could not be found with maps:get and friends. Other operations
    such as map compare and merge could probably also give
    incorrect results.
  * erts: Fix Windows bug in open_port({spawn, Command}, ..) when
    Command is found via the OS search PATH and that directory path
    contains white spaces. The port program would start but the
    command line arguments to it could be incorrect.
  * ftp: fix unexpected result ok when calling ftp:nlist repeatedly
  * inets: This change allows body requests to httpc:request/5 be
    an iolist()
  * inets: addition of type specs in httpc.erl
  * inets: httpc: Add support for HTTP 308 status code
  * dialyzer: Dialyzer would crash when attempting to analyze a bit
    syntax segment size having an literal non-integer size such as
    [].
  * dialyzer: Dialyzer could crash when trying to analyze a
    convoluted nested expression involving funs,
  * kernel: Fixed shutdown crash in gen_tcp socket backend, when
    the other end closed the socket.
  * kernel: erl_tar can now read gzip-compressed tar files that are
    padded. There is a new option compressed_one for file:open/2
    that will read a single member from a gzip file,
  * kernel: Fix os:cmd to not translate all exceptions thrown to
    badarg. For example emfile from erlang:open_port was translated
    to badarg. This bug has existed since Erlang/OTP 24.
  * kernel: Spec for function net:if_names/0 incorrect
  * kernel: Missing ctrl option name transation for TOS and TTL (on
    FreeBSD) when using gen_udp with the 'socket' inet_backend.
  * kernel: gen_udp:open/2 with option(s) add_membership or
    drop_membership would drop earlier options.
  * kernel: The inet:setopts/2 {reuseaddr, true} option will now be
    ignored on Windows unless the socket is an UDP socket. For more
    information see the documentation of the reuseaddr option part
    of the documentation of inet:setopts/2. Prior to OTP 25 the
    {reuseaddr, true} option was ignored for all sockets on
    Windows, but as of OTP 25.0 this was changed so that it was not
    ignored for any sockets. *** POTENTIAL INCOMPATIBILITY ***
  * kernel: The distribution socket option handling in
    inet_tcp_dist has been cleaned up to clarify which were
    mandatory and which just had default values.
  * kernel: Improve warning message format for gen_tcp_socket.
  * snmp: Explicitly close the socket(s) when terminating
    (default-) net-if process.
  * stdlib: erl_tar can now read gzip-compressed tar files that are
    padded. There is a new option compressed_one for file:open/2
    that will read a single member from a gzip file,
  * stdlib: A concurrent call to ets:rename could cause
    ets:delete_all_objects to fail halfway through with badarg.
  * stdlib: It is not allowed to call functions from guards. The
    compiler failed to reject a call in a guard when done by
    constructing a record with a default initialization expression
    that called a function.
  * stdlib: The compiler could crash when using a record with
    complex field initialization expression as a filter in a list
    comprehension.
  * stdlib: unicode:characters_to_binary() could build
    unnecessarily large call stack.
  * stdlib: Improve error message for ets:new/2 name clash. Say
    "name already exists" instead of less specific "invalid
    options".
  * mnesia: Fixed crash which could happen during startup if too
    many decisions where sent from remote nodes.
  * os_mon: The disk_space_check_interval configuration parameter
    of disksup can now be set to values smaller than a minute.
  * ssh: graceful shutdown of ssh_conection_handler when connection
    is closed by peer
  * common_test: Fix starting of peer nodes on old releases when
    the compile server was active and the current Erlang
    installation contained non-latin1 characters in its path.
  * public_key: Disregard LDAP URIs when HTTP URIs are expected.
  * ssl: With this change, tls_sender process is hibernated after
    sufficient inactivity.
  * ssl: Correct handling of legacy schemes so that ECDSA certs
    using sha1 may be used for some TLS-1.3 configurations.
  * ssl: With this change, tls_sender does not cause logger crash
    upon key update.
  * ssl: Enhance warning message
  * ssl: Provide server option to make certificate_authorities
    extension in the TLS-1.3 servers certificate request optional.
    This will allow clients to send incomplete chains that may be
    reconstructable and thereby verifiable by the server, but that
    would not adhere to the certificate_authorities extension.
  * ssl: If the verify_fun handles four arguments the DER cert will
    be supplied as one of the arguments.
  * megaco: A very minor improvement to the measurement tool.
  * observer: A WX event race could causes a crash in when handling
    socket or port info.
  * observer: Improve the nodes menu to include more nodes.
  * compiler: Line number in compiler messages would be truncated
    to 4 digits for line numbers greater than 9999.
  * compiler: In rare circumstance, matching a binary as part of a
    receive clause could cause the compiler to terminate because of
    an internal consistency check failure.
  * compiler: Compiling a function with complex bit syntax matching
    such as f(&lt;&lt;X:0, _:X&gt;&gt;, &lt;&lt;Y:0, _:Y&gt;&gt;) -&gt; ok. could crash the
    compiler.
  * compiler: It is not allowed to call functions from guards. The
    compiler failed to reject a call in a guard when done by
    constructing a record with a default initialization expression
    that called a function.
  * compiler: The compiler could crash when using a record with
    complex field initialization expression as a filter in a list
    comprehension.
  * wx: Added environment variable WX_MACOS_NON_GUI_APP to allow
    user to override OSXIsGUIApplication behavior.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1679745600">- Changes for 25.3:
  * reltool: Fixed a bug that would cause analysis to crash.
  * stdlib: Fixed a bug that would cause analysis to crash.
  * stdlib: Fixed a crash when formatting stack traces for error
    reports.
  * stdlib: Instead of crashing, the list_to_integer/1 and
    list_to_integer/2 BIFs now raise the system_limit exception for
    overlong lists that can't be converted to integers. Similarly,
    the string:to_integer/1 BIF now returns {error,system_limit}
    for overlong lists.
  * stdlib: Removal of non-necessary undefined types added to the
    state's supervisor record.
  * compiler: Fixed a bug that would cause the compiler to hang.
  * compiler: Fixed a crash when compiling code that contained
    maybe expressions.
  * compiler: Constructing a binary with an explicit size of all
    for a binary segment would crash the compiler.
  * compiler: The compiler would generate incorrect code for the
    following type of expression: Pattern = BoundVar1 = . . . =
    BoundVarN = Expression An exception should be raised if any of
    the bound variables have different values than Expression. The
    compiler would generate code that would cause the bound
    variables to be bound to the value of Expressionwhether the
    value matched or not.
  * xmerl: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * megaco: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * debugger: Fixed a bug that would cause analysis to crash.
  * erts: Fixed a bug on Windows where file:read_file_info/1 would
    fail for files with corrupt metadata.
  * erts: Fix process_info(_, binary) to again include "writable
    binaries" which were lost in OTP-25.0. Writable binaries are an
    optimization used when binaries are appended upon in a loop.
  * erts: Fix rare race when receiving fragmented messages on a
    terminating connection. Could potentially cause memory leaks as
    well as double free crashes. Bug exists since OTP 22.0.
  * erts: Fixed bug that could maybe cause problems when a file
    descriptor number is closed by a linked in driver and then
    opened (reused) and passed to enif_select by a NIF. No actual
    symptoms seen, only failed internal assertions in debug build.
  * erts: The runtime system could crash when tracing a process
    executing on a dirty scheduler.
  * erts: In the binary syntax, attempting to match out integers
    with size exceeding 2 GiB could crash the runtime system.
  * erts: Fixed edge case in floating-point negation where A = 0.0,
    B = -A did not produce B = -0.0 on x86_64 JIT.
  * erts: Fixed an issue in the JIT that could crash the emulator
    on some platforms.
  * erts: Added meta data to the windows installer.
  * erts: Fixed ETS insertion order into bag and duplicate_bag of
    tuples with identical keys when passed in a list to
    ets:insert/2. The insert order has been head-to-tail but was
    accidentally changed in OTP 23.0. For bag it was reverted
    (tail-to-head), while for duplicate_bag it was sometimes
    reverted depending on the length of the list and number of
    "reductions" left for the calling process. This fix changes the
    insert order of ets:insert/2 back to always be head-to-tail of
    the list argument.
  * erts: With the JIT for AArch64 (AMD64), calling bxor in with
    non-integer arguments in a guard would crash the runtime
    system.
  * erts: Fix bug regarding process flag max_heap_size. Could cause
    strange behavior when a process was killed due to exceeding the
    limit.
  * erts: Fixed binary comprehensions to be similar to other
    creation of binary data with respect to its contribution of
    triggering garbage collection.
  * erts: In rare circumstances, when a process exceeded its
    allowed heap size set by option max_heap_size, it would not be
    killed as it should be, but instead enter a kind of zombie
    state it would never get out of.
  * erts: Instead of crashing, the list_to_integer/1 and
    list_to_integer/2 BIFs now raise the system_limit exception for
    overlong lists that can't be converted to integers. Similarly,
    the string:to_integer/1 BIF now returns {error,system_limit}
    for overlong lists.
  * erts: Active process aliases of a process at its termination
    leaked memory.
  * erts: Support for fully asynchronous distributed signaling
    where send operations never block. This functionality is by
    default disabled and can be enabled per process. For more
    information see the documentation of process_flag(async_dist,
    Bool).
  * erts: Added the +JPperf no_fp option to explicitly disable
    Erlang frame pointers otherwise added when using the +JPperf
    map option.
  * erl_interface: Accept connection setup from OTP 23 and 24 nodes
    that are not using epmd.
  * erl_interface: The ei API for decoding/encoding terms is not
    fully 64-bit compatible since terms that have a representation
    on the external term format larger than 2 GB cannot be handled.
  * syntax_tools: erl_syntax_lib:annotate_bindings/1,2 will now
    properly annotate named functions and their arguments.
  * kernel: Fixed a bug on Windows where file:read_file_info/1
    would fail for files with corrupt metadata.
  * kernel: Accept connection setup from OTP 23 and 24 nodes that
    are not using epmd.
  * public_key: As different solutions of verifying certificate
    revocation exists move the decode of 'CRLDistributionPoints' so
    that it will only be decode. When it is actually used in the
    verification process. This would enable interoperability with
    systems that use certificates with an invalid empty
    CRLDistributionPoints extension that they want to ignore and
    make verification by other means.
  * public_key: public_key:pkix_path_validation validates
    certificates expiring after 2050
  * public_key: Do not leave exit message in message queue after
    calling cacerts_load() on MacOS.
  * public_key: Replace size/1 with either tuple_size/1 or
    byte_size/1 The size/1 BIF is not optimized by the JIT, and its
    use can result in worse types for Dialyzer. When one knows that
    the value being tested must be a tuple, tuple_size/1 should
    always be preferred. When one knows that the value being tested
    must be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * ssl: Fixed that new dtls connections from the same client ip
    port combination works. If there is a process waiting for
    accept the new connection will connect to that, otherwise it
    will try to re-connect to the old server connection.
  * ssl: When shutting down a node that uses SSL distribution
    (-proto_dist inet_tls), a confusing error message about an
    unexpected process exit was printed. This particular message is
    no longer generated.
  * ssl: fixes the type spec for ssl:format_error/1
  * ssl: Replace size/1 with either tuple_size/1 or byte_size/1 The
    size/1 BIF is not optimized by the JIT, and its use can result
    in worse types for Dialyzer. When one knows that the value
    being tested must be a tuple, tuple_size/1 should always be
    preferred. When one knows that the value being tested must be a
    binary, byte_size/1 should be preferred. However, byte_size/1
    also accepts a bitstring (rounding up size to a whole number of
    bytes), so one must make sure that the call to byte_size/ is
    preceded by a call to is_binary/1 to ensure that bitstrings are
    rejected. Note that the compiler removes redundant calls to
    is_binary/1, so if one is not sure whether previous code had
    made sure that the argument is a binary, it does not harm to
    add an is_binary/1 test immediately before the call to
    byte_size/1.
  * jinterface: Accept connection setup from OTP 23 and 24 nodes
    that are not using epmd.
  * os_mon: The port programs used by cpu_sup and memsup are now
    gracefully shut down when cpu_sup and memsup are shut down.
  * eunit: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * crypto: A user defined runtime library path configured using
  - -with-ssl-rpath=&lt;PATHS&gt; could fail to be enabled.
  * crypto: Ensure that configure fails if a user defined runtime
    library path has been passed by the user, but cannot set.
  * mnesia: Improved consistency for dirty writes when a table was
    added with add_table_copy/3. Fixed a problem with sticky write,
    which could lead to inconsistent data.
  * mnesia: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * common_test: Renamed undocumented macro CT_PEER/3 to
    CT_PEER_REL/3.
  * ssh: With this change, PKCS8 formatted private key file is
    properly decoded and SSH daemon with such key can be started.
  * ssh: Replace size/1 with either tuple_size/1 or byte_size/1 The
    size/1 BIF is not optimized by the JIT, and its use can result
    in worse types for Dialyzer. When one knows that the value
    being tested must be a tuple, tuple_size/1 should always be
    preferred. When one knows that the value being tested must be a
    binary, byte_size/1 should be preferred. However, byte_size/1
    also accepts a bitstring (rounding up size to a whole number of
    bytes), so one must make sure that the call to byte_size/ is
    preceded by a call to is_binary/1 to ensure that bitstrings are
    rejected. Note that the compiler removes redundant calls to
    is_binary/1, so if one is not sure whether previous code had
    made sure that the argument is a binary, it does not harm to
    add an is_binary/1 test immediately before the call to
    byte_size/1.
  * inets: With this change, handling of URI to a folder, with
    missing trailing / and a query component present is fixed.
  * inets: Adds more type information to the inets app, thus
    improving the errors that static analysis tools can detect. The
    addition of type information to records and the updates to
    function heads help static analysis tools to understand that
    some values in the records cannot be 'undefined', thus making
    static tools to type check correctly more modules in the inets
    app
  * inets: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * snmp: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * ftp: Replace size/1 with either tuple_size/1 or byte_size/1 The
    size/1 BIF is not optimized by the JIT, and its use can result
    in worse types for Dialyzer. When one knows that the value
    being tested must be a tuple, tuple_size/1 should always be
    preferred. When one knows that the value being tested must be a
    binary, byte_size/1 should be preferred. However, byte_size/1
    also accepts a bitstring (rounding up size to a whole number of
    bytes), so one must make sure that the call to byte_size/ is
    preceded by a call to is_binary/1 to ensure that bitstrings are
    rejected. Note that the compiler removes redundant calls to
    is_binary/1, so if one is not sure whether previous code had
    made sure that the argument is a binary, it does not harm to
    add an is_binary/1 test immediately before the call to
    byte_size/1.
  * dialyzer: Fixed a bug that would cause analysis to crash.
  * dialyzer: Replace size/1 with either tuple_size/1 or
    byte_size/1 The size/1 BIF is not optimized by the JIT, and its
    use can result in worse types for Dialyzer. When one knows that
    the value being tested must be a tuple, tuple_size/1 should
    always be preferred. When one knows that the value being tested
    must be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * tftp: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
- Changes for 25.2.3:
  * erts: Comparisons between small numbers and pids or ports would
    in some edge cases say that the number was greater than the pid
    or port, violating the term order.
  * erts: process_info(Pid, status) when Pid /= self() could return
    an erroneous result.
  * ssl: Maximize compatibility by ignoring change_cipher_spec
    during handshake even if middle_box_mode is not negotiated
    (mandated by client)
  * ssl: Move assert of middlebox message after an
    hello_retry_request to maximize interoperability. Does not
    changes semantics of the protocol only allows unexpected
    message delay from server.
  * ssh: With this change, ssh application does not crash when
    formatting some of info reports for unsuccessful connections.
  * ssh: With this change, ssh does not log extensively long
    messages.
  * inets: Ensure graceful shutdown
  * inets: Return type of the type specification for function
    httpc:cookie_header/{1,2,3} has been fixed from -spec
    cookie_header(url()) -&gt; [{ field(), value() }] | {error,
    Reason} to -spec cookie_header(url()) -&gt; { field(), value() } |
    {error, Reason}
- Changes for 25.2.2:
  * ftp: Fixes calls to ftp:nlist/2 returning {error, epath} when
    the file / folder exists
- Changes for 25.2.1:
  * compiler: Fixed a bug that could cause legal code to fail
    validation.
  * compiler: Eliminated a rare crash in the beam_types module.
  * erts: Fixed a bug in selective receive optimization that could
    crash 32-bit emulators.
  * erts: A race condition which was very rarely triggered could
    cause the signal queue of a process to become inconsistent
    causing the runtime system to crash.
  * kernel: The tcp connect option 'bind_to_device' could not be
    used with inet_backend = 'socket'. 'inet' requires value type
    binarry() and 'socket' requires value type 'string()'.
  * kernel: Minor issue processing options when calling
    gen_tcp:connect with a sockaddr() and inet_backend = socket.
  * common_test: Change timeout to infinity for gen_server calls in
    cth_log_redirect
  * inets: fixes a missing case of the type specification for
    httpd:info/2/3/4
  * snmp: Single threaded agent crash when vacm table not properly
    initiated.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1683460800">- Changes for 25.3.2:
  * compiler: Fixed type handling bugs that could cause an internal
    error in the compiler for correct code.
  * os_mon: Avoid error report from failing erlang:port_close at
    shutdown of cpu_sup and memsup. Bug exists since OTP 25.3
    (os_mon-2.8.1).
  * erts: If a runtime system which was starting the distribution
    already had existing pids, ports, or references referring to a
    node with the same nodename/creation pair that the runtime
    system was about to use, these already existing pids, ports, or
    references would not work as expected in various situations
    after the node had gone alive. This could only occur if the
    runtime system was communicated such pids, ports, or references
    prior to the distribution was started. That is, it was
    extremely unlikely to happen unless the distribution was
    started dynamically and was even then very unlikely to happen.
    The runtime system now checks for already existing pids, ports,
    and references with the same nodename/creation pair that it is
    about to use. If such are found another creation will be chosen
    in order to avoid these issues.
- Changes for 25.3.1:
  * snmp: Attempts to minimize the number of the error reports
    during a failed agent init.
  * compiler: When a map update such as #{}#{key:=value} that
    should fail with an exception was unused, the exception would
    be lost.
  * compiler: Fixed bug in the validator that made it reject valid
    code.
  * crypto: With this change, random errors are fixed for
    crypto:generate_key calls with OpenSSL 3.
  * erts: Fixed a bug in the loader that prevented certain modules
    compiled with no_ssa_opt from being loaded.
  * erts: Implementations of the call() driver callback that
    returned a faulty encoded result could cause a memory leak and
    could cause invalid data on the heap of the processes calling
    erlang:port_call/3.
  * erts: Fixed a memory corruption issue when upgrading code. The
    bug was introduced in OTP 25.3
  * erts: Fixed configure tests for a few ARM-specific
    instructions, which prevented the emulator from being built on
    some platforms.
  * erts: Aliases created in combination with a monitor using the
    {alias, explicit_unalias} option stopped working from remote
    nodes when a 'DOWN' signal had been received due to the monitor
    or if the monitor was removed using the erlang:demonitor() BIF.
    This bug was introduced in OTP 24.3.4.10 and OTP 25.3.
  * erts: In rare circumstances, bit syntax matching of an invalid
    code point for a utf32 would crash the runtime system.
  * erts: Building the runtime system failed when native atomic
    support was missing. Note that execution on such systems have
    only been rudimentary tested.
  * erl_interface: Fixed configure tests for a few ARM-specific
    instructions, which prevented the emulator from being built on
    some platforms.
  * eldap: Added a new function eldap:info/1 that returns the
    socket and the transport protocol for the eldap connection.
  * inets: Correct timing related pipelining/keepalive queue bug,
    that could result in unexpected "socket_remotly_closed" errors.
  * inets: With this change, upon remote socket closure current
    request is added to a retried queue (either pipeline or
    keep_alive, but not both).
  * ssl: With this change, ssl:connection_information/2 returns
    correct keylog data after TLS1.3 key update.
  * ssl: Client signature algorithm list input order is now honored
    again , it was accidently reversed by a previous fix.
  * stdlib: The type specs in the erl_parse module has been updated
    to include the maybe construct and the ! operator.
  * wx: Improve debug prints from the nifs. Some minor fixes for
    wxWidgets-3.2. Fixed OpenGL debug functions.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1687521600">- Changes for 25.3.2.2:
  * compiler: The compiler could be very slow when compiling guards
    with multiple guard tests separated with 'or' or ';'.
- Changes for 25.3.2.1:
  * xmerl: New options to xmerl_scan and xmerl_sax_parser so one
    can limit the behaviour of the parsers to avoid some XML
    security issues. xmerl_scan gets one new option:
    xmerl_sax_parser gets the following options: The old option
    skip_external_dtd is still valid and the same as
    {external_entities, none} and {fail_undeclared_ref, false} but
    just affects DTD's and not other external references.
  * erts: Fixed a crash during tracing on certain platforms that
    cannot use the machine stack for Erlang code (mainly OpenBSD
    and Linux with musl).
  * erts: Constructing a binary segment not aligned with a byte
    boundary, with a size not fitting in 31 bits, and with a value
    not fitting in a 64-bit word could crash the runtime system.
  * erts: Further robustify implementation of large maps (&gt; 32
    keys). Keys that happen to have same internal 32-bit hash
    values are now put in collision nodes which are traversed with
    linear search. This removes the demand for the internal hash
    function when salted to eventually produce different hashes for
    all possible pairs of unequal terms.
  * stdlib: Static supervisors are very idle processes after they
    have started so they will now be hibernated after start to
    improve resource management.
  * compiler: Fixed a bug where a failing bsl expression in a guard
    threw an exception instead of causing the guard to fail.
  * compiler: Complex guard expression using the or operator and
    guard BIFs that can fail could sometimes be miscompiled so that
    the guard would succeed even if a call to a guard BIF failed.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1687608000">- Version 26.0:
  * Leex has been extended with optional column number support.
  * The family of enumeration functions in module lists has been
    extended with enumerate/3 that allows a step value to be
    supplied.
  * Update Unicode to version 15.0.0.
  * proc_lib:start*/* has become synchronous when the started
    process fails. This requires that a failing process use a new
    function proc_lib:init_fail/2,3, or exits, to indicate failure. All
    OTP behaviours have been fixed to do this.
  * auto-complete of variables, record names, record fields names,
    map keys, function parameter types and filenames.
  * Open external editor in the shell to edit the current
    expression.
  * defining records (with types), functions, specs and types in
    the shell.
  * Creation and matching of binaries with segments of fixed sizes
    have been optimized.
  * Creation and matching of UTF-8 segments have been optimized.
  * Appending to binaries has been optimized.
  * The compiler and JIT now generate better code for creation of
    small maps where all keys are literals known at compile time.
  * Thanks to the optimizations above the performance of the base64
    module has been significantly improved. For example, on an
    x86_64 system with the JIT both encode and decode are almost
    three times faster than in Erlang/OTP 25.
  * Map comprehensions as suggested in EEP 58 has now been
    implemented.
  * Some map operations have been optimized by changing the
    internal sort order of atom keys. This changes the
    (undocumented) order of how atom keys in small maps are printed
    and returned by maps:to_list/1 and maps:next/1. The new order
    is unpredictable and may change between different invocations
    of the Erlang VM.
  * Introducing the new function maps:iterator/2 for creating an
    interator that return the map elements in a deterministic
    order. There are also new modifiers k and K for the format
    string in io:format() to support printing map elements ordered.
  * Added the new built-in type dynamic() introduced in EEP 61, PR
    introducing EEP 61 improving support for gradual type checkers.
  * Dialyzer has a new incremental mode that be invoked by giving
    the --incremental option when running Dialyzer. This new
    incremental mode is likely to become the default in a future
    release.
  * Multi time warp mode is now enabled by default. This assumes
    that all code executing on the system is time warp safe.
  * Support for UTF-8 atoms and strings in the NIF interface
    including new functions enif_make_new_atom,
    enif_make_new_atom_len and enif_get_string_length.
  * The BIFs min/2 and max/2 are now allowed to be used in guards
    and match specs.
  * Improved the selective receive optimization, which can now be
    enabled for references returned from other functions. This
    greatly improves the performance of gen_server:send_request/3,
    gen_server:wait_response/2, and similar functions.
  * It is no longer necessary to enable a feature in the runtime
    system in order to load modules that are using it. It is
    sufficient to enable the feature in the compiler when compiling
    it.
  * inet:setopts/2 has got 3 new options: reuseport, reuseport_lb
    and exclusiveaddruse.
  * Fix so that -fno-omit-frame-pointer is applied to all of the
    Erlang VM when using the JIT so that tools, such as perf, can
    crawl the process stacks.
  * In the lists module, the zip family of functions now takes
    options to allow handling lists of different lengths.
  * Added the zip:zip_get_crc32/2 function to retrieve the CRC32
    checksum from an opened ZIP archive. gen_server optimized by
    caching callback functions
  * The modules Erlang DNS resolver inet_res and helper modules
    have been updated for RFC6891; to handle OPT RR with DNSSEC OK
    (DO) bit.
  * Introduced application:get_supervisor/1.
  * Cache OTP boot code paths, to limit how many folders that are
    being accessed during a module lookup. Can be disabled with
  - cache_boot_path false.
  * Support for Kernel TLS (kTLS), has been added to the SSL
    application, for TLS distribution (-proto_dist inet_tls), the
    SSL option {ktls, true}.
  * Improved error checking and handling of ssl options.
  * Mitigate memory usage from large certificate chains by lowering
    the maximum handshake size. This should not effect the common
    cases, if needed it can be configured to a higher value.
  * For security reasons the SHA1 and DSA algorithms are no longer
    among the default values.
  * Add encoding and decoding of use_srtp hello extension to
    facilitate for DTLS users to implement SRTP functionality.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1687608001">- Changes for 26.0.1:
  * erts: Build of the socket nif failed on Solaris 11.
  * erts: Fixed two reduction-counting bugs relating to binaries.
  * erts: Constructing a binary segment not aligned with a byte
    boundary, with a size not fitting in 31 bits, and with a value
    not fitting in a 64-bit word could crash the runtime system.
  * erts: When a binary construction failed because of bad size for
    a segment, the error information was not always correct.
  * erts: Fixed a crash when calling a fun that was defined in a
    module that had been upgraded.
  * kernel: The POSIX error exdev was sometimes incorrectly
    described as "cross domain link" in some error messages.
  * kernel: Corrected the socket send function description (send
    with Timeout = nowait). The send function(s) could not return
    {ok, {RestData, SelectInfo}}
  * stdlib: The POSIX error exdev was sometimes incorrectly
    described as "cross domain link" in some error messages.
  * ssl: Make sure that selection of client certificates handle
    both TLS-1.3 and TLS-1.2 names correctly. Could cause valid
    client certificate to not be selected, and an empty client
    certificate message to be sent to server.
  * ssl: Improved ssl:format_error/1 to handle more error tuples.
  * ssl: Fixed hanging ssl:connect when ssl application is not
    started.
  * ssl: Correct handling of retransmission timers, current
    behavior could cause unwanted delays.
  * inets: Do not make the default ssl options by calling
    httpc:ssl_verify_host_options(true) if ssl options are supplied
    by the user.
  * xmerl: New options to xmerl_scan and xmerl_sax_parser so one
    can limit the behaviour of the parsers to avoid some XML
    security issues. xmerl_scan gets one new option:
    xmerl_sax_parser gets the following options: The old option
    skip_external_dtd is still valid and the same as
    {external_entities, none} and {fail_undeclared_ref, false} but
    just affects DTD's and not other external references.
  * compiler: Fixed a bug where a failing bsl expression in a guard
    threw an exception instead of causing the guard to fail.
  * compiler: Fixed a bug that would case the validator to reject
    legal code.
  * compiler: The compiler could re-order clauses matching binaries
    so that the incorrect clause would match. That could only
    happen for code that used the option {error_location,line} or
    for code without line or column number information (e.g.
    generated by a parse transform).
  * compiler: Complex guard expression using the or operator and
    guard BIFs that can fail could sometimes be miscompiled so that
    the guard would succeed even if a call to a guard BIF failed.
  * compiler: With optimizations disabled, a try/catch construct
    could return an incorrect value.
  * compiler: In rare circumstance, a combination of binary
    construction and binary_part/3 would cause the compiler to
    generate unsafe code that would crash the runtime system.
  * compiler: The compiler could be very slow when compiling guards
    with multiple guard tests separated with 'or' or ';'.
  * compiler: Complex guard expressions using 'or' and map updates
    could succeed even if the map update failed.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1698235200">- Changes for 26.1.2:
  * erts: If the external term format encoding of an argument list
    part of a distributed spawn operation was faulty, the newly
    spawned remote process could misbehave. The misbehavior
    included hanging or interpret an incoming message as an
    argument list to use. This was very unlikely to happen unless
    using an alternate implementation of the distribution protocol
    which made a faulty encoding of the argument list. The child
    process will now detect this error and terminate before
    executing the user specified code.
  * erts: Fix bugs where if the body of a matchspec would return a
    map with a variable ('$1', '$_' etc) as one of the keys or
    values and the variable was not an immidiate, the term would
    not be copied to the receiving processes heap. This would later
    corrupt the term in the table as the GC could place move
    markers in it, which in turn would cause the VM to crash. Bug
    has been present for since OTP 17.0.
  * xmerl: The xmerl version 1.3.32 was released in OTP 26.0.1, but
    the incorrect version number of 1.3.31.1 was used for it. This
    incorrect version number continued to appear in OTP 26.0.2, OTP
    26.1, and OTP 26.1.1. The actual xmerl code in these OTP
    versions however corresponds to xmerl version 1.3.32.
- Changes for 26.1.1:
  * wx: The wx application would fail to build on macOS with Xcode
    15.
  * compiler: The compiler could become extremely slow for modules
    containing huge functions.
  * stdlib: Garbage collect the shell process when reducing the
    amount of saved history and results.
- Changes for 26.1:
  * crypto: Fix VM crash caused by crypto being purged and reloaded
    (by init:restart for example) on OS with musl libc (such as
    Alpine linux).
  * crypto: Improved understanding of LibreSSL versions. Support
    chacha20 and chacha20_poly1305 for LibreSSL 3.7. Reflect
    removal of support for the DSS/DSA algorithm which was done in
    LibreSSL 2.6.1.
  * crypto: FIPS supported by crypto for OpenSSL 3.0.* and 3.1.*.
  * asn1: The ASN.1 compiler would ignore a constraint such as
    (SIZE (1..4), ...), causing incorrect behavior of the encoding
    and decoding function for the PER and UPER backends. Corrected
    to handle the constraint in the same way as (SIZE (1..4, ...)).
  * asn1: The JER backend has been internally refactored in a way
    that is compatible for applications that use the documented
    API. However, for a group of ASN.1 modules that depend on each
    other (for example, S1AP-PDU-Descriptions, S1AP-Contents, and
    so on), all modules in the group must be recompiled if on of
    the group members is recompiled.
  * observer: Closing the trace log window via the menu did not
    work.
  * erts: maps:put with existing key and identical value was not
    optimized as a no-op correctly if having the same 32-bit hash
    as another key in the map. In practice very rare and harmless.
  * erts: Fixed an issue with truncated crash slogans on failed
    emulator start.
  * erts: Fixed a bug where the emulator was unable to determine
    the current cgroup CPU quota.
  * erts: A process optimized for parallel signal delivery could
    under some circumstances lose wakeup information. That is, the
    processes was not woken up to take care of the signal, so the
    signal would not be taken care of until the process was woken
    by another signal. Only processes configured with
    message_queue_data set to off_heap utilize this optimization.
  * erts: Function socket:close/1 could cause a VM crash on
    Windows.
  * erts: Fixed a bug in the ARM JIT where it could accidentally
    add garbage trailing bits when creating bitstrings whose size
    wasn't an even multiple of 8 bits.
  * erts: Fix erlang:system_info/1 documentation to show correct
    types.
  * erts: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * erts: Fix compilation with GNU termcap.
  * erts: Delivery time of message signals to a process not
    executing any receive expressions could become very long,
    potentially infinite. For example, a process checking for
    messages using process_info(self(), message_queue_len) or
    process_info(self(), messages) and avoiding to execute a
    receive expression matching on messages could be very slow in
    detecting new messages. Note that you are still discouraged
    from using process_info() this way. A process that wants to
    check if there are messages available to handle should execute
    a receive expression matching on messages.
  * erts: On AArch64 (ARM64), when calculating both the quotient
    and remainder with a divisor begin a power two, the remainder
    could be incorrectly calculated.
  * erts: Fix bug causing "magic" references in a compressed ETS
    table to not keep the referred object alive. The symptom would
    be the referred object being garbage collected prematurely and
    the reference appearing stale, not referring to anything.
    Examples of such magically referred objects are atomics and NIF
    resources.
  * erts: Matching out short bitstrings with a fixed size not
    divisible by 8 could could lead to the runtime system
    terminating with an "Overrun heap and stack" error.
  * erts: A constant flow of incoming non-message signals could
    prevent a process needing to execute dirty from doing so.
  * erts: A BEAM file usually contains a chunk with the tag "Type"
    containing type information that can be used by the JIT. The
    beam_lib:strip/1 takes care to preserve that chunk, but a
    build/release tool that does customized stripping could
    accidentally remove the chunk. Loading a BEAM file without the
    "Type" chunk could cause incorrect behavior of the loaded code.
  * erts: gen_udp:recv/* for Unix Domain Socket in binary mode and
    passive mode has been fixed to not crash.
  * erts: The cleanup operation of not yet delivered signals to a
    terminated process yielded excessively.
  * erts: Fixed minor hashing issue with the local option of
    term_to_binary()/term_to_iovec().
  * erts: Update gen_tcp_socket and gen_udp_socket to handle
    'completion' (socket on Windows).
  * erts: Add support for Unix Domain Sockets (only for STREAM
    sockets) on Windows for 'socket'.
  * erts: In Erlang/OTP 27, by default escripts will be compiled
    before being executed. That means that the compiler application
    must be installed. It is possible to force the escript to be
    interpreted by adding the directive -mode(interpret). to the
    escript file. In Erlang/OTP 28, support for interpreting an
    escript will be removed.
  * erts: Add basic support for socket ioctl on Windows.
  * erts: Removed erts/etc/darwin/Info.plist, as it is no longer
    necessary after macos 10.12
  * erts: Add support for (Windows) socket option exclusiveaddruse.
  * erts: [socket] Add support for the 'nopush' option.
  * erts: Add support for socket option 'BSP STATE'.
  * erts: Add tcp socket options 'keepcnt', 'keepidle' and
    'keepintvl'.
  * erts: Add support for misc (Windows) socket options
    ('max_msg_size' and 'maxdg').
  * compiler: The compiler could run forever when compiling a call
    to is_record/3 with a huge positive tuple size. The call
    is_record(A, a, 0) would crash the compiler when used in a
    function body. When used in a guard the compiler would emit
    incorrect code that would accept {a&gt; as a record.
  * compiler: Fixed a bug that caused dialyzer to crash when
    analyzing bogus code that contained the literal atom undefined
    in segment sizes.
  * compiler: The compiler would crash when compiling some modules
    that contained a call to erlang:load_nif/2.
  * compiler: Fixed a bug that caused the compiler to crash on
    legal code.
  * compiler: The compiler could crash when attempting to compile a
    call to is_list/1 in a complex expression.
  * compiler: A complex guard expression using the or operator
    could succeed when it was supposed to fail.
  * compiler: Compiling nested try/catch and catch expression could
    result in an internal compiler error.
  * compiler: Using the bnot operator in a complex expression could
    cause the compiler to terminate with an internal consistency
    failure diagnostic.
  * compiler: Fixed a bug that caused the compiler to crash in a
    binary optimization pass.
  * compiler: The compiler could terminate with an internal error
    when attempting to compile a binary pattern that could not
    possibly match.
  * compiler: Fixed various performance issues related to the alias
    optimization pass.
  * erl_docgen: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * mnesia: Do not delete old backup file if the new backup fails.
  * megaco: Make megaco transports handle gen_tcp | gen_udp with
    socket backend on Windows (completion).
  * common_test: With this change, ct_hooks manual refers to CTH
    execution order section in user guide.
  * common_test: With this change, Config data from
    pre_end_per_testcase hook is delivered to post_end_per_testcase
    callback in case of testcase timetrap or linked process crash.
  * common_test: With this change, remaining references to not
    supported vts tool in ct_run are removed (mainly relates to
    docs and ct_run help message).
  * common_test: With this change, prompt search functionality in
    ct_telnet handles unicode input.
  * common_test: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * stdlib: The compiler could run forever when compiling a call to
    is_record/3 with a huge positive tuple size. The call
    is_record(A, a, 0) would crash the compiler when used in a
    function body. When used in a guard the compiler would emit
    incorrect code that would accept {a&gt; as a record.
  * stdlib: Fix bug in ets:tab2file that could make it fail if
    another Erlang process created the same file at the same time.
  * stdlib: An {else_clause,Value} exception will now be reported
    nicely in the shell.
  * stdlib: Correct return value for error case, so that it matches
    the documented and intended return value {error,
    {already_started, pid()} when local registered names are used.
  * stdlib: sys:get_state/1,2 and sys:replace_state/2,3 has been
    corrected to handle a state named error as a state name, not as
    a failed system callback. For the standard server behaviours
    this was an issue only for gen_statem (and gen_fsm) when the
    state name was error, and for gen_server if the complete state
    was {error,_}.
  * stdlib: Multiple problems were fixed in
    filelib:safe_relative_path/2. If its second argument was a path
    that contained symbolic links, an incorrect result patch could
    be returned. Also, paths were sometimes falsely considered
    unsafe.
  * stdlib: Fix deadlock when erl.exe is used as part of a pipe on
    Windows and trying to set the encoding of the standard_io
    device.
  * stdlib: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * stdlib: Fix h/2,3 to properly render multi-clause
    documentation.
  * stdlib: Timers created by timer:apply_after/4,
    apply_interval/4, and apply_repeatedly/4 would silently fail to
    do the apply if it was not possible to spawn a process when the
    timer expired. This has now been corrected, and if the spawn
    fails, the system will be taken down producing a crash dump.
  * stdlib: When an Erlang source file lacked a module definition,
    there would be a spurious "module name must not be empty"
    diagnostic for each spec in the file.
  * stdlib: The argument descriptions for option types in argparse
    have been made less ambiguous.
  * stdlib: Clarified the documentation of normal shutdown reason
    on gen_server:call/2,3
  * stdlib: Pattern matching and equivalence (=:=, =/=) comparisons
    on 0.0 will now raise a warning, as it will no longer be
    considered equivalent to -0.0 in OTP 27. If a match on 0.0
    specifically is desired (distinct from -0.0), the warning can
    be suppressed by writing +0.0 instead. The arithmetic
    comparison operators are unaffected, including arithmetic
    equality (==). *** POTENTIAL INCOMPATIBILITY ***
  * stdlib: The semantics of the gen_{server,statem,event}
    behaviour's synchronous start behaviour introduced in OTP-26.0
    with OTP-18471, has been clarified in the documentation.
  * stdlib: Added functionality to set a custom multiline prompt.
  * stdlib: A warning for (accidental use of) Triple-Quoted Strings
    has been implemented as per EEP 64. *** POTENTIAL
    INCOMPATIBILITY ***
  * stdlib: The keyboard shortcuts for the shell are now
    configurable.
  * kernel: Fixed an issue with truncated crash slogans on failed
    emulator start.
  * kernel: Fix shell:start_interactive function specification.
  * kernel: Fix code:get_doc/1 to return missing, when it can't
    find erts instead of crashing.
  * kernel: Function socket:close/1 could cause a VM crash on
    Windows.
  * kernel: Fix deadlock when erl.exe is used as part of a pipe on
    Windows and trying to set the encoding of the standard_io
    device.
  * kernel: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * kernel: Fix logger's overload protection mechanism to only
    fetch memory used by messages when needed.
  * kernel: Fixed a number of socket-related issues causing
    incompatibilities with gen_tcp and gen_udp respectively.
  * kernel: gen_tcp:connect with socket address and socket (inet-)
    backend fails because of missing callback function.
  * kernel: The DNS RR cache used by `inet_res` has been fixed to
    preserve insert order, which is beneficial when the DNS server
    returns RRs in some specific order for e.g load balancing
    purposes.
  * kernel: The options `reuseport`, `reuseport_lb` and
    `exclusiveaddruse` were accidentally not allowed for e.g
    `gen_udp:open/1,2`, which has now been corrected.
  * kernel: gen_udp:recv/* for Unix Domain Socket in binary mode
    and passive mode has been fixed to not crash.
  * kernel: Fixed issue where cursor would not be placed at the end
    of the expression when navigating shell history.
  * kernel: Update gen_tcp_socket and gen_udp_socket to handle
    'completion' (socket on Windows).
  * kernel: Add support for Unix Domain Sockets (only for STREAM
    sockets) on Windows for 'socket'.
  * kernel: Add basic support for socket ioctl on Windows.
  * kernel: The file:location/0 type is now exported.
  * kernel: Add support for (Windows) socket option
    exclusiveaddruse.
  * kernel: [socket] Add support for the 'nopush' option.
  * kernel: Add support for socket option 'BSP STATE'.
  * kernel: Add tcp socket options 'keepcnt', 'keepidle' and
    'keepintvl'.
  * kernel: Add support for misc (Windows) socket options
    ('max_msg_size' and 'maxdg').
  * kernel: The keyboard shortcuts for the shell are now
    configurable.
  * kernel: Optimized code_server to reduce repeated work when
    loading the same module concurrently.
  * debugger: The call int:no_break(Module) did not remove any
    breakpoints.
  * debugger: The maybe expression is now supported in the
    Debugger.
  * debugger: The maybe expression is now supported in the
    Debugger.
  * debugger: The call int:no_break(Module) did not remove any
    breakpoints.
  * ssl: Avoid function clause error in ssl:getopts/2 by handling
    that inet:getopts may return an empty list during some
    circumstances, such as the socket being in a closing state.
  * ssl: The API function `ssl:recv/3` has been tightened to
    disallow negative length, which has never been documented to
    work, but was passed through and caused strange errors.
  * ssl: When a client initiated renegotiation was rejected and the
    client socket was in active mode the expected error message to
    the controlling process was not sent.
  * ssl: Add some guidance for signature algorithms configuration
    in ssl applications users guide.
  * snmp: Make snmp handle gen_udp with socket backend on Windows
    (completion).
  * public_key: Country name comparison shall be case insensitive
  * public_key: Add check to disallow duplicate certs in a path
  * inets: With this change, re_write httpd works as expected and
    does not return error.
  * inets: Fixed a bug so httpd does not crash when stopped at the
    wrong time during TLS connection negotiation, or any other
    theoretically as slow connection setup.
  * inets: Enhance error handling and avoid that the HTTP client
    hangs on headers provided on the wrong format.
  * inets: With this change, error report generated by httpd during
    connection setup contains socket type information.
  * inets: Stop and restart of the httpd server in the Inets
    application has been refactored to a more synchronous and OTP
    supervisor friendly approach. This should increase stability
    and for example avoid a supervisor report from
    httpd_connection_sup about killed child process(es) in some
    cases when stopping or restarting httpd.
  * dialyzer: Fixed a bug that caused dialyzer to crash when
    analyzing bogus code that contained the literal atom undefined
    in segment sizes.
  * dialyzer: Dialyzer could crash when attempting to analyze a
    module that defined a type called product/.
- Changes for 26.0.2:
  * erts: Fix using the IME (Input Method Editor) to enter text in
    cmd.exe and powershell.exe on Windows.
  * erts: Multiple socket:accept calls issue. When making multiple
    accept calls, only the last call is active.
  * erts: Fix the shell to ignore terminal delay when the terminal
    capabilities report that they should be used.
  * erts: Fix "oldshell" to echo characters while typing on
    Windows.
  * erts: On Windows, a call to the function socket:close, when
    there are waiting active calls to read, write or accept
    functions, could hang.
  * erts: Fix issues when reading or configuring standard_io on
    Windows when erl.exe is started using -noshell flag.
  * erts: The following functions are now much faster when given a
    long list or binary:
  * erts: On AArch64 (ARM64), equality and non-equality tests with
    literal bitstrings could succeed when they should fail and vice
    versa.
  * compiler: Fixed a type handling bug that would cause an
    internal consistence failure for correct code.
  * compiler: Fixed a bug that could cause the stack trace of throw
    exceptions to be erroneously optimized out.
  * compiler: Complex guard expression using 'or' were not always
    fully evaluated, making guards that were supposed to fail
    succeed.
  * stdlib: Fix bug where when you entered Alt+Enter in the
    terminal, the cursor would move to the last line, instead of
    moving to the next line.
  * stdlib: Fix eof handling when reading from stdin when erlang is
    started using -noshell.
  * stdlib: Fixed problem where output would disappear if it was
    received after a prompt was written in the shell.
  * stdlib: The following functions are now much faster when given
    a long list or binary:
  * kernel: Fix bug where when you entered Alt+Enter in the
    terminal, the cursor would move to the last line, instead of
    moving to the next line.
  * kernel: Fix so that the shell does not crash on startup when
    termcap is not available.
  * kernel: Multiple socket:accept calls issue. When making
    multiple accept calls, only the last call is active.
  * kernel: Fix the shell to ignore terminal delay when the
    terminal capabilities report that they should be used.
  * kernel: Fix "oldshell" to echo characters while typing on
    Windows.
  * kernel: Fix eof handling when reading from stdin when erlang is
    started using -noshell.
  * kernel: On Windows, a call to the function socket:close, when
    there are waiting active calls to read, write or accept
    functions, could hang.
  * kernel: Fix issues when reading or configuring standard_io on
    Windows when erl.exe is started using -noshell flag.
  * kernel: gen_udp:connect with inet_backend = socket fails when
    the Address is a hostname (string or atom).
  * kernel: Fixed problem which would cause shell to crash if
    particular escape sequence was written to stdout.
  * kernel: Fixed problem where output would disappear if it was
    received after a prompt was written in the shell.
  * kernel: Fix a crash where the location of erts could not be
    found in rebar3 dev builds.
  * kernel: Introduce the KERNEL application parameter
    standard_io_encoding that can be used to set the default
    encoding for standard_io. This option needs to be set to latin1
    if the application wants to treat all input data as bytes
    rather than utf-8 encoded characters.
  * ssl: Added keylog information to all protocol versions in
    ssl:connection_information/2.
  * ssl: Add RFC-6083 considerations for DTLS to enable gen_sctp
    based callback for the transport.
  * ssh: Added multiline editing support to ssh clients connected
    through OTP ssh daemon.</changelog>
  <changelog author="sflees@suse.de" date="1704974400">- Changes for 26.2.1:
  * erts: Removed unnecessary PCRE source tar-ball.
  * ssh: With this change (being response to CVE-2023-48795),
    ssh can negotiate "strict KEX" OpenSSH extension with
    peers supporting it; also
    'chacha20-poly1305@openssh.com' algorithm becomes a
    less preferred cipher.
    If strict KEX availability cannot be ensured on both
    connection sides, affected encryption modes(CHACHA and
    CBC) can be disabled with standard ssh configuration.
    This will provide protection against vulnerability, but
    at a cost of affecting interoperability. See
    Configuring algorithms in SSH. (bsc#1218192, CVE-2023-48795)
- Changes for 26.2:
  * all: Replaced unintentional Erlang Public License 1.1
    headers in some files with the intended Apache License
    2.0 header.
  * otp: The removal of the deprecated slave module, originally
    planned for OTP 27, has been postponed to OTP 29.
  * asn1: Fix benign warning from gcc 11 about mismatching call
    to free().
  * crypto: Enable engine support for OpenSSL versions 3.
  * edoc: Emit &lt;code&gt; instead of &lt;tt&gt;.
- Disable test suite for now, it has many false positives and
  takes a very long time.</changelog>
  <changelog author="sflees@suse.de" date="1706011200">- This codestream wasn't affected by bsc#1207113</changelog>
  <changelog author="sflees@suse.de" date="1706011201">- Disable rpmlint tests on SLE-15 where they currently fail</changelog>
  <changelog author="sflees@suse.de" date="1715947200">- Create a versioned package for SLES</changelog>
</package>
<package pkgid="f1787414014275522d331e8b28e30a9a91dbebdc5b8079d4732dbd205c50d19e" name="erlang26-debugger" arch="x86_64">
  <version epoch="0" ver="26.2.1" rel="150300.7.5.1"/>
  <changelog author="matwey.kornilov@gmail.com" date="1646568000">- Changes for 24.2.2:
  * inets: Avoid intermediate ungraceful shutdown of the HTTP
    server.
  * ssh: The ssh sever parallel_login option was missing in OTP-24</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1648382400">- Changes for 24.3.2:
  * erl_interface: Fix compile error regarding gethostbyaddr_r on
    Android. Error introduced in OTP 24.3.
  * kernel: Fix failed accepted connection setup after previous
    established connection from same node closed down silently.
  * kernel: Fixed a problem where typing Ctrl-R in the shell could
    hang if there were some problem with the history log file.
- Changes for 24.3.1:
  * dialyzer: There could be spurious warnings for unknown types
    when a type was a subtype of an existing type that was a
    subtype of an unknown type.
  * ssl: Client certification could fail for TLS-1.3 servers that
    did not include the certificat_authorties extension in its
    certificate request message.
- Changes for 24.3:
  * megaco: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.
  * megaco: Update the performance and debug chapters of the megaco
    user's guide. Also some updates to the meas tools.
  * compiler: The expression &lt;&lt;0/native-float&gt;&gt;=Bin would always
    fail to match, while &lt;&lt;0/float-native&gt;&gt;=Bin would match
    (provided that Bin contained the binary representation of 0.0)
  * compiler: The compiler will now compile huge functions with
    straight-line code faster.
  * erl_interface: Add --enable-ei-dynamic-lib configure option
    that will make erl_interface also release a dynamic library
    version of libei.
  * erl_interface: The ei API for decoding/encoding terms is not
    fully 64-bit compatible since terms that have a representation
    on the external term format larger than 2 GB cannot be handled.
  * sasl: Fix bug in systools:make_script/1 documentation.
  * inets: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.
  * inets: Documentation fix for inets:services_info/0, which now
    describes that Info might be a Reason term() in case when
    {error, Reason} is returned as service info.
  * crypto: The crypto app in OTP can since OTP-24.2 be compiled,
    linked and used with the new OpenSSL 3.0 cryptolib. The crypto
    app has 3.0 support has been improved, but is still *not
    recommended* for other usages than experiments and alpha
    testing. There are not yet any guaranties that it works, not
    even together with other OTP applications like for example SSL
    and SSH, although there are no known errors. Since the previous
    release, OTP-24.2, the following improvements have been done: -
    It has been tested during nearly every nightly test on the OTP
    lab - The hash algorithms md4 and ripemd160 have been enabled
    with OpenSSL 3.0. - The ciphers blowfish_cbc, blowfish_ecb,
    des_cbc, des_cfb, des_ecb, rc2_cbc and rc4 have been enabled
    with OpenSSL 3.0. Disabled or unsupported with OpenSSL 3.0 are
    still: - ENGINE support - FIPS mode - Other providers than the
    built-in ones - Compiling and linking with OpenSSL 3.0
    cryptolib in compatibility modes (for example to behave as
    1.1.1) and, the ciphers blowfish_cfb64 and blowfish_ofb64 are
    not supported and will not be either. Deprecated functions in
    the OpenSSL 3.0 cryptolib must not be disabled as OTP/crypto
    still uses some of the deprecated API functions. The gcc flag
  - Wno-deprecated-declarations is set to prevent deprecation
    warnings to be printed when compiling.
  * crypto: Crypto is adapted to LibreSSL 3.5.0 on OpenBSD.
  * crypto: New configure option ( --disable-otp-test-engine) to
    prohibit the build of the OTP test engine used in some test
    suites. The reason is that the test engine could be hard to
    compile on for instance LibreSSL 3.5.0. For that particular
    cryptolib version (or higher), this configure option is set
    automatically.
  * jinterface: Fix bug in OtpOutputStream.write_pid/4 and
    write_ref/3 causing faulty encodig. Bug exists since OTP 23.0.
  * wx: Removed the static_data option from wxImage creation
    functions, as it was broken and could lead to crashes. Now
    image data is always copied to wxWidgets as was the default
    behavior. Removed some non working wxGridEvent event types,
    which have there own events in newer wxWidgets versions, and
    added a couple of event types that where missing in wx.
  * asn1: Add support for the maps option in combination with the
    jer backend.
  * snmp: The compilation time is no longer recorded in BEAM files.
    There remained several undocumented functions that attempted to
    retrieve compilation times. Those have now been removed.
  * snmp: [agent] Remove expectation of socket being a port.
  * common_test: OTP internal test fix.
  * runtime_tools: Fixed bug in scheduler:utilization(Seconds) that
    would leave the scheduler_wall_time system flag incorrectly
    enabled.
  * runtime_tools: Add scheduler:get_sample/0 and get_sample_all/0.
    Also clarify scheduler module documentation about how it
    depends on system flag scheduler_wall_time.
  * erts: Fixed a bug in the x86 JIT that might cause floating
    point instructions to wrongly throw an exception.
  * erts: Preserve correct nodedown_reason if supervised
    distribution controller processes exit with {shutdown, Reason}.
  * erts: Handling of send_timeout for gen_tcp has been corrected
    so that the timeout is honored also when sending 0 bytes.
  * erts: By default global does not take any actions to restore a
    fully connected network when connections are lost due to
    network issues. This is problematic for all applications
    expecting a fully connected network to be provided, such as for
    example mnesia, but also for global itself. A network of
    overlapping partitions might cause the internal state of global
    to become inconsistent. Such an inconsistency can remain even
    after such partitions have been brought together to form a
    fully connected network again. The effect on other applications
    that expects that a fully connected network is maintained may
    vary, but they might misbehave in very subtle hard to detect
    ways during such a partitioning. In order to prevent such
    issues, we have introduced a prevent overlapping partitions fix
    which can be enabled using the prevent_overlapping_partitions
    kernel(6) parameter. When this fix has been enabled, global
    will actively disconnect from nodes that reports that they have
    lost connections to other nodes. This will cause fully
    connected partitions to form instead of leaving the network in
    a state with overlapping partitions. Note that this fix has to
    be enabled on all nodes in the network in order to work
    properly. Since this quite substantially changes the behavior,
    this fix is currently disabled by default. Since you might get
    hard to detect issues without this fix you are, however,
    strongly advised to enable this fix in order to avoid issues
    such as the ones described above. As of OTP 25 this fix will
    become enabled by default.
  * erts: Corrected the type specification of erlang:seq_trace/2.
  * erts: Fix memory leak when tracing on running on a process that
    only handle system tasks or non-message signals (for example
    process_info requests).
  * erts: Add support for using socket:sockaddr_in() and
    socket:sockaddr_in6() when using gen_sctp, gen_tcp and gen_udp.
    This will make it possible to use Link Local IPv6 addresses.
  * erts: Show on_load failure reasons in embedded mode.
  * erts: Compile date saved in the Erlang VM executable has been
    removed.
  * erts: Improve documentation for the dynamic node name feature.
  * ssh: Fix makefile dependency bugs.
  * ssh: Fixed faulty OpenSSH decoding of Ed25519/Ed448 keys in the
    OpenSSH format openssh_key_v1.
  * ssh: Correction of ssh_file typing, specially for the
    experimental openssh-key-v1 encoding.
  * ssh: Improper tag for private ED keys when encoding with
    ssh:encode/2. The tuple had ed_priv as first element, but
    should have had ed_pri. This is now corrected. *** POTENTIAL
    INCOMPATIBILITY ***
  * ssh: Add support for Ed25519/Ed448 SSH host keys in the RFC
    4716 format ("-----BEGIN EC PRIVATE KEY-----") generated by for
    example openssl or via Erlang functions (i.e.
    public_key:generate_key({namedCurve, ed25519})). Ed25519 SSH
    host keys generated by ssh-keygen was, and are still,
    supported.
  * kernel: Handling of send_timeout for gen_tcp has been corrected
    so that the timeout is honored also when sending 0 bytes.
  * kernel: By default global does not take any actions to restore
    a fully connected network when connections are lost due to
    network issues. This is problematic for all applications
    expecting a fully connected network to be provided, such as for
    example mnesia, but also for global itself. A network of
    overlapping partitions might cause the internal state of global
    to become inconsistent. Such an inconsistency can remain even
    after such partitions have been brought together to form a
    fully connected network again. The effect on other applications
    that expects that a fully connected network is maintained may
    vary, but they might misbehave in very subtle hard to detect
    ways during such a partitioning. In order to prevent such
    issues, we have introduced a prevent overlapping partitions fix
    which can be enabled using the prevent_overlapping_partitions
    kernel(6) parameter. When this fix has been enabled, global
    will actively disconnect from nodes that reports that they have
    lost connections to other nodes. This will cause fully
    connected partitions to form instead of leaving the network in
    a state with overlapping partitions. Note that this fix has to
    be enabled on all nodes in the network in order to work
    properly. Since this quite substantially changes the behavior,
    this fix is currently disabled by default. Since you might get
    hard to detect issues without this fix you are, however,
    strongly advised to enable this fix in order to avoid issues
    such as the ones described above. As of OTP 25 this fix will
    become enabled by default.
  * kernel: Fix bug where logger would crash when logging a report
    including improper lists.
  * kernel: Make erlang:set_cookie work for dynamic node names.
  * kernel: Add support for using socket:sockaddr_in() and
    socket:sockaddr_in6() when using gen_sctp, gen_tcp and gen_udp.
    This will make it possible to use Link Local IPv6 addresses.
  * kernel: A net_tickintensity kernel parameter has been
    introduced. It can be used to control the amount of ticks
    during a net_ticktime period. A new net_kernel:start/2 function
    has also been introduced in order to make it easier to add new
    options. The use of net_kernel:start/1 has been deprecated.
  * kernel: Improve documentation for the dynamic node name
    feature.
  * erl_docgen: Fix css for large tables and images on small
    screens
  * erl_docgen: Fix bug with codeinclude tag that caused it to not
    include the code if used in a correct, but unexpected way.
  * observer: Calculate the display width in etop, instead of hard-
    coding it to 89 characters.
  * debugger: Fix record index matching, it was broken and could
    never match.
  * ssl: Improved error handling.
  * ssl: Before this change, net_kernel used with TLS distribution
    might be leaking processes in case of connectivity issues.
  * ssl: Fix makefile dependency bugs.
  * ssl: Make sure the TLS sender process handles explicit calls to
    erlang:disconnect_node properly, avoiding potential hanging
    problems in net_kernel.
  * ssl: Add support for TLS-1.3 certificate_authorities extension.
    And process certificate_authorities field in pre-TLS-1.3
    certificate requests.
  * ssl: Support password fun for protected keyfiles in ssl:connect
    function.
  * ssl: Add in some cases earlier detection of possible DoS
    attacks by malicious clients sending unexpected TLS messages
    instead of the client hello. Note that such attacks are already
    mitigated by providing a timeout for the TLS handshake.
  * eldap: Fix eldap extensibleMatch dnAttributes option. According
    to the ldap ASN1 the dnAttributes should be a bool, instead it
    was generated as a string.
  * eldap: Implemented paged searches according to https://www.rfc-
    editor.org/rfc/rfc2696.txt
  * public_key: Support password fun for protected keyfiles in
    ssl:connect function.
  * stdlib: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.
  * mnesia: Reduce the number of locks taken during table copying,
    should reduce the startup time on large systems.
  * diameter: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1649246400">- Fix build for Factory. Currently, any Java version
  is fine for Erlang.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1653220800">- Version 25.0:
  - stdlib
  * New function filelib:ensure_path/1 will ensure that all
    directories for the given path exists
  * New functions groups_from_list/2 and groups_from_list/3 in
    the maps module
  * New functions uniq/1 uniq/2 in the lists module
  * New PRNG added to the rand module, for fast pseudo-random
    numers.
  - compiler, kernel, stdlib, syntax_tools:
  * Added support for selectable features as described in EEP-60.
    Features can be enabled/disabled during compilation with
    options (ordinary and +term) to erlc as well as with
    directives in the file. Similar options can be used to erl
    for enabling/disabling features allowed at runtime. The new
    maybe expression EEP-49 is fully supported as the feature
    maybe_expr.
  - erts &amp; JIT:
  * The JIT now works for 64-bit ARM processors.
  * The JIT now does type-based optimizations based on type
    information in the BEAM files.
  * Improved the JIT’s support for external tools like perf and
    gdb, allowing them to show line numbers and even the original
    Erlang source code when that can be found.
  - erts, stdlib, kernel:
  * Users can now configure ETS tables with the
    {write_concurrency, auto} option. This option forces tables
    to automatically change the number of locks that are used at
    run-time depending on how much concurrency is detected. The
    {decentralized_counters, true} option is enabled by default
    when {write_concurrency, auto} is active.
  * Benchmark results comparing this option with the other ETS
    optimization options are available here: benchmarks.
  * To enable more optimizations, BEAM files compiled with OTP 21
    and earlier cannot be loaded in OTP 25.
  * The signal queue of a process with the process flag
    message_queue_data=off_heap has been optimized to allow
    parallel reception of signals from multiple processes. This
    can improve performance when many processes are sending in
    parallel to one process. See benchmark.
  * The Erlang installation directory is now relocatable on the
    file system given that the paths in the installation’s
    RELEASES file are paths that are relative to the
    installations root directory.
  * A new option called short has been added to the functions
    erlang:float_to_list/2 and erlang:float_to_binary/2. This
    option creates the shortest correctly rounded string
    representation of the given float that can be converted back
    to the same float again.
  * Introduction of quote/1 and unquote/1 functions in the
    uri_string module - a replacement for the deprecated
    functions http_uri:encode and http_uri:decode.
  * The new module peer supersedes the slave module. The slave
    module is now deprecated and will be removed in OTP 27.
  * global will now by default prevent overlapping partitions due
    to network issues. This is done by actively disconnecting
    from nodes that reports that they have lost connections to
    other nodes. This will cause fully connected partitions to
    form instead of leaving the network in a state with
    overlapping partitions.
  * It is possible to turn off the new behavior by setting the
    the kernel configuration parameter
    prevent_overlapping_partitions to false. Doing this will
    retain the same behavior as in OTP 24 and earlier.
  * The format_status/2 callback for gen_server, gen_statem and
    gen_event has been deprecated in favor of the new
    format_status/1 callback.
  * The new callback adds the possibility to limit and change
    many more things than the just the state.
  * The timer module has been modernized and made more efficient,
    which makes the timer server less susceptible to being
    overloaded. The timer:sleep/1 function now accepts an
    arbitrarily large integer.
  - compiler:
  * The maybe ... end construction as proposed in EEP-49 has been
    implemented. It can simplify complex code where otherwise
    deeply nested cases would have to be used.
  * To enable maybe, give the option {enable_feature,maybe_expr}
    to the compiler. The exact option to use will change in a
    coming release candidate and then it will also be possible to
    use from inside the module being compiled.
  * When a record matching or record update fails, a {badrecord,
    ExpectedRecordTag} exception used to be raised. In this
    release, the exception has been changed to {badrecord,
    ActualValue}, where ActualValue is the value that was found
    instead of the expected record.
  * Add compile attribute -nifs() to empower compiler and loader
    with information about which functions may be overridden as
    NIFs by erlang:load_nif/2.
  * Improved and more detailed error messages when binary
    construction with the binary syntax fails. This applies both
    for error messages in the shell and for
    erl_error:format_exception/3,4.
  * Change format of feature options and directives for better
    consistency. Options to erlc and the -compile(..) directive
    now has the format {feature, feature-name, enable | disable}.
    The -feature(..) now has the format -feature(feature-name,
    enable | disable).
  - crypto:
  * Add crypto:hash_equals/2 which is a constant time comparision
    of hashvalues.
  - ssl:
  * Introducing a new (still experimental) option
    {certs_keys,[cert_key_conf()]}. With this a list of a
    certificates with their associated key may be used to
    authenticate the client or the server. The certificate key
    pair that is considered best and matches negotiated
    parameters for the connection will be selected.
  - public_key:
  * Functions for retrieving OS provided CA-certs added.
  - dialyzer:
  * Optimize operations in the erl_types module. Parallelize the
    Dialyzer pass remote.
  * Added the missing_return and extra_return options to raise
    warnings when specifications differ from inferred types.
    These are similar to, but not quite as verbose as overspecs
    and underspecs.
  * Dialyzer now better understands the types for min/2, max/2,
    and erlang:raise/3. Because of that, Dialyzer can potentially
    generate new warnings. In particular, functions that use
    erlang:raise/3 could now need a spec with a no_return()
    return type to avoid an unwanted warning.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1656849600">- Changes for 25.0.2:
  * ssl: Improved handling of unexpected messages during the
    handshake, taking the right action for unexpected messages.
  * erts: On computers with the ARM64 (AArch64) architecture (such
    as Apple Silicon Macs) a rem expression followed by a div
    expression with the same operands could evaluate to the wrong
    result if the result of the rem expression was unused.
- Changes for 25.0.1:
  * ssl: When a TLS-1.3 enabled client tried to talk to a TLS-1.2
    server that coalesces TLS-1.2 handshake message over one TLS
    record, the connection could fail due to some message being
    handled in the wrong state, this has been fixed.
  * ssl: Correctly handles supported protocol version change from
    default to something else by sni_fun supplied to
    ssl:handshake/[2,3] together with a TCP-socket (so called
    upgrade).
  * ssl: Also, TLS-1.3 should respond with a protocol version alert
    if previous versions, that are supported but not configured,
    are attempted.
  * kernel: The DNS resolver inet_res has been fixed to ignore
    trailing dot difference in the request domain between the sent
    request and the received response, when validating a response.
  * kernel: A bug in inet_res has been fixed where a missing
    internal {ok,_} wrapper caused inet_res:resolve/* to return a
    calculated host name instead of an `{ok,Msg} tuple, when
    resolving an IP address or a host name that is an IP address
    string.
  * kernel: The erlang:is_alive() BIF could return true before
    configured distribution service was available. This bug was
    introduced in OTP 25.0 ERTS version 13.0. The
    erlang:monitor_node() and erlang:monitor() BIFs could
    erroneously fail even though configured distribution service
    was available. This occurred if these BIFs were called after
    the distribution had been started using dynamic node name
    assignment but before the name had been assigned.
  * kernel: Added the missing mandatory address/0 callback in the
    gen_tcp_dist example.
  * erts: A spawn_reply signal from a remote node could be delayed
    and be delivered after other signals from the newly spawned
    process. When this bug triggered, the connection to the node
    where the process was spawned sometimes could be taken down due
    to the bug. The following error message would then be logged if
    this happened: Missing 'spawn_reply' signal from the node
    &lt;RemoteNode&gt; detected by &lt;Pid&gt; on the node &lt;LocalNode&gt;. The
    node &lt;RemoteNode&gt; probably suffers from the bug with ticket id
    OTP-17737. This bug only affected processes which had enabled
    off_heap message_queue_data and parallel reception of signals
    had been automatically enabled. This bug was introduced in OTP
    25.0, ERTS version 13.0.
  * erts: Fixed type spec of erlang:system_info(dist_ctrl).
  * erts: The zlib built in to the runtime system has been updated
    to version 1.2.12. (Note that on most platforms, the platform's
    own zlib is used.)
  * erts: The erlang:is_alive() BIF could return true before
    configured distribution service was available. This bug was
    introduced in OTP 25.0 ERTS version 13.0. The
    erlang:monitor_node() and erlang:monitor() BIFs could
    erroneously fail even though configured distribution service
    was available. This occurred if these BIFs were called after
    the distribution had been started using dynamic node name
    assignment but before the name had been assigned.
  * crypto: Note in the documentation that MODP (rfc3526) groups
    and OpenSSL 3.0 can give an error if a call to
    crypto:generate_key/2 specifies a key length, and that length
    is to small.
  * crypto: The cmac now uses only the 3.0 API
  * crypto: Documentation is now updated with which OpenSSL
    cryptolib versions that OTP currently is tested.
  * dialyzer: Fixed the documentation for the missing_return and
    extra_return options.
  * mnesia: Fixed add_table_copy which could leave a table lock if
    the receiving node went down during the operation.
  * ssh: Binaries can be limited in logs with the parameter
    max_log_item_len. The default value is 500 bytes.
  * stdlib: In the initial release of Erlang/OTP 25, the expression
    bound to the _ pseudo-field in a record initialization would
    always be evaluated once, even if all other fields in the
    record were explicitly initialized. That would break the use
    case of binding the expression error(...) to _ in order to get
    an exception if not all fields were initialized. The behavior
    of binding to _ has been reverted to the pre-OTP 25 behavior,
    that is, to not evaluate the expression if all fields have been
    bound to explicit values.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1660046400">- Changes for 25.0.3:
  * erts: Distributed exit signals could be lost under the
    following conditions:
  * erts: A race could cause process_info(Pid, message_queue_len)
    on other processes to return invalid results.
  * erts: Fixed reduction counting for handling process system
    tasks.
  * erts: Priority elevation of terminating processes did not work
    which could cause execution of such processes to be delayed.
  * erts: An unlink operation made by a process that terminated
    before the unlink operation completed, i.e., before it had
    received an unlink-ack signal from the linked process, caused
    an exit signal to erroneously be sent from the terminating
    process to the process being unlinked. This exit signal would
    most often be ignored by the receiver, but if the receiver of
    the exit signal concurrently set up a new link, it could
    receive the exit signal with the actual exit reason of the
    terminating process instead of a noproc exit reason. It is
    however very hard to detect that this has happened and has no
    obvious negative consequences, so it should be considered
    harmless. A distributed unlink-ack signal received by a
    terminating process was also not properly removed which could
    cause a minor memory leak.
  * ssl: The link to crypto:engine_load refered the function with
    wrong arity.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1661601600">- Changes for 25.0.4:
  * kernel: A call to net_kernel:setopts(new, Opts) at the same
    time as a connection was being set up could cause a deadlock
    between the net_kernel process and the process setting up the
    connection.
  * erts: The monitor/3 BIF did not apply options to the created
    monitor if the target process or port did not exist. That is,
    the corresponding down message would get a `DOWN` tag even if a
    custom tag had been set, and the returned reference was not an
    alias even if the alias option had been passed.
  * erts: The erlang:monotonic_time/1, erlang:system_time/1,
    erlang:time_offset/1, and os:system_time/1 BIFs erroneously
    failed when passed the argument native.</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1665662400">- Changes for 25.1.1:
  * dialyzer: Dialyzer could crash when analyzing Elixir code that
    used intricate macros.
  * dialyzer: The --input_list_file option has been added.
  * ssl: Fixes handling of symlinks in cacertfile option.
  * eunit: With this change, eunit exact_execution option works
    with application primitive.
  * stdlib: peer nodes failed to halt when the process supervising
    the control connection crashed. When an alternative control
    connection was used, this supervision process also quite
    frequently crashed when the peer node was stopped by the node
    that started it which caused the peer node to linger without
    ever halting.
  * asn1: For the per and uper ASN.1 encoding rules, encoding and
    decoding the SEQUENCE OF and SET OF constructs with 16384 items
    or more is now supported.
  * erts: Listen sockets created with the socket module, leaked
    (erlang-) monitors.
  * erts: Notifications about available distribution data sent to
    distribution controller processes could be lost. Distribution
    controller processes can be used when implementing an
    alternative distribution carrier. The default distribution over
    tcp was not effected and the bug was also not present on
    x86/x86_64 platforms.
  * kernel: Listen sockets created with the socket module, leaked
    (erlang-) monitors.
  * kernel: peer nodes failed to halt when the process supervising
    the control connection crashed. When an alternative control
    connection was used, this supervision process also quite
    frequently crashed when the peer node was stopped by the node
    that started it which caused the peer node to linger without
    ever halting.
- Changes for 25.1:
  * dialyzer: Two bugs have been fixed in Dialyzer's checking of
    behaviors: When a mandatory callback function is present but
    not exported, Dialyzer would not complain about a missing
    callback. When an optional callback function was not exported
    and had incompatible arguments and/or the return values were
    incompatible, Dialyzer would complain. This has been changed to
    suppress the warning, because the function might not be
    intended to be a callback function, for instance if a release
    added a new optional callback function (such as format_status/1
    for the gen_server behaviour added in OTP 25).
  * dialyzer: The no_extra_return and no_missing_return warnings
    can now be suppressed through -dialyzer directives in source
    code.
  * jinterface: Fix javadoc build error by adding option -encoding
    UTF-8.
  * diameter: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * crypto: Fix configure with --with-ssl and --disable-dynamic-
    ssl-lib on Windows.
  * crypto: Remove all references correctly in the garbage
    collection if an engine handle was not explicit unloaded.
  * crypto: Changed the behaviour of the engine load/unload
    functions The engine load/unload functions have got changed
    semantics to get a more consistent behaviour and work correct
    when variables are garbage collected. The load functions now
    don't register the methods for the engine to replace. That will
    now be handled with the new functions
    engine_register/engine_unregister if needed. Some functions are
    removed from the documentation and therefor the API, but they
    are left in the code for compatibility. *** POTENTIAL
    INCOMPATIBILITY ***
  * crypto: Fixed a naming bug for AES-CFB and Blowfish-CFB/OFB
    when linked with OpenSSL 3.0 cryptolib.
  * crypto: Sign/verify does now behave as in OTP-24 and earlier
    for eddsa.
  * crypto: Pass elliptic curve names from crypto.erl to crypto's
    nif.
  * crypto: The configure option --disable-deprecated-warnings is
    removed. It was used for some releases when the support for
    OpenSSL 3.0 was not completed. It is not needed in OTP 25.
  * crypto: Crypto is now considered to be usable with the OpenSSL
    3.0 cryptolib for production code. ENGINE and FIPS are not yet
    fully functional.
  * crypto: Do not exit if the legacy provider is missing in
    libcrypto 3.0.
  * ssl: Reject unexpected application data in all relevant places
    for all TLS versions. Also, handle TLS-1.3 middlebox
    compatibility with more care. This will make malicious
    connections fail early and further, mitigate possible DoS
    attacks, that would be caught by the handshake timeout. Thanks
    to Aina Toky Rasoamanana and Olivier Levillain from Télécom
    SudParis for alerting us of the issues in our implementation.
  * ssl: With this change, value of cacertfile option will be
    adjusted before loading certs from the file. Adjustments
    include converting relative paths to absolute and converting
    symlinks to actual file path. Thanks to Marcus Johansson
  * ssl: In TLS-1.3, if chain certs are missing (so server auth
    domain adherence can not be determined) send peer cert and hope
    the server is able to recreate a chain in its auth domain.
  * ssl: Make sure periodical refresh of CA certificate files
    repopulates cache properly.
  * ssl: Correct internal CRL cache functions to use internal
    format consistently.
  * ssl: Incorrect handling of client middlebox negotiation for
    TLS-1.3 could result in that a TLS-1.3 server would not use
    middlebox mode although the client was expecting it too and
    failing the negotiation with unexpected message.
  * ssl: If the "User" process, the process starting the TLS
    connection, gets killed in the middle of spawning the dynamic
    connection tree make sure we do not leave any processes behind.
  * ssl: A vulnerability has been discovered and corrected. It is
    registered as CVE-2022-37026 "Client Authentication Bypass".
    Corrections have been released on the supported tracks with
    patches 23.3.4.15, 24.3.4.2, and 25.0.2. The vulnerability
    might also exist in older OTP versions. We recommend that
    impacted users upgrade to one of these versions or later on the
    respective tracks. OTP 25.1 would be an even better choice.
    Impacted are those who are running an ssl/tls/dtls server using
    the ssl application either directly or indirectly via other
    applications. For example via inets (httpd), cowboy, etc. Note
    that the vulnerability only affects servers that request client
    certification, that is sets the option {verify, verify_peer}.
    (bsc#1205318)
  * eunit: With this change, Eunit can optionally not try to
    execute related module with "_tests" suffix. This might be used
    for avoiding duplicated executions when source and test modules
    are located in the same folder.
  * erl_docgen: Update DTD to allow XML tag em under pre.
  * inets: Add httpc:ssl_verify_host_options/1 to help setting
    default ssl options for the https client.
  * inets: This change fixes dialyzer warnings generated for
    inets/httpd examples (includes needed adjustment of spec for
    ssh_sftp module).
  * inets: Remove documentation of no longer supported callback.
  * stdlib: Fixed inconsistency bugs in global due to
    nodeup/nodedown messages not being delivered before/after
    traffic over connections. Also fixed various other
    inconsistency bugs and deadlocks in both global_group and
    global. As building blocks for these fixes, a new BIF
    erlang:nodes/2 has been introduced and
    net_kernel:monitor_nodes/2 has been extended. The -hidden and
  - connect_all command line arguments did not work if multiple
    instances were present on the command line which has been
    fixed. The new kernel parameter connect_all has also been
    introduced in order to replace the -connect_all command line
    argument.
  * stdlib: Fix the public_key:ssh* functions to be listed under
    the correct release in the Removed Functionality User's Guide.
  * stdlib: The type spec for format_status/1 in gen_statem,
    gen_server and gen_event has been corrected to state that the
    return value is of the same type as the argument (instead of
    the same value as the argument).
  * stdlib: If the timer server child spec was already present in
    kernel_sup but it was not started, the timer server would fail
    to start with an {error, already_present} error instead of
    restarting the server.
  * stdlib: When changing callback module in gen_statem the
    state_enter calls flag from the old module was used in for the
    first event in the new module, which could confuse the new
    module and cause malfunction. This bug has been corrected. With
    this change some sys debug message formats have been modified,
    which can be a problem for debug code relying on the format.
  * ** POTENTIAL INCOMPATIBILITY ***
  * stdlib: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * stdlib: The rfc339_to_system_time/1,2 functions now allows the
    minutes part to be omitted from the time zone.
  * stdlib: The receive statement in gen_event has been optimized
    to not use selective receive (which was never needed, and could
    cause severe performance degradation under heavy load).
  * stdlib: Add new API function erl_features:configurable/0
  * parsetools: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * public_key: Support more Linux distributions in cacerts_load/0.
  * public_key: Correct asn1 typenames available in type
    pki_asn1_type()
  * public_key: Sign/verify does now behave as in OTP-24 and
    earlier for eddsa.
  * snmp: Improved the get-bulk response max size calculation. Its
    now possible to configure 'empty pdu size', see appendix c for
    more info.
  * snmp: Fix various example dialyzer issues
  * ssh: Handling rare race condition at channel close.
  * ssh: New ssh option no_auth_needed to skip the ssh
    authentication. Use with caution!
  * ssh: This change fixes dialyzer warnings generated for
    inets/httpd examples (includes needed adjustment of spec for
    ssh_sftp module).
  * ssh: The new function ssh:daemon_replace_options/2 makes it
    possible to change the Options in a running SSH server.
    Established connections are not affected, only those created
    after the call to this new function.
  * ssh: Add a timeout as option max_initial_idle_time. It closes a
    connection that does not allocate a channel within the timeout
    time. For more information about timeouts, see the Timeouts
    section in the User's Guide Hardening chapter.
  * observer: Fixed units in gui.
  * xmerl: There is a new configure option, --enable-deterministic-
    build, which will apply the deterministic compiler option when
    building Erlang/OTP. The deterministic option has been improved
    to eliminate more sources of non-determinism in several
    applications.
  * asn1: There is a new configure option, --enable-deterministic-
    build, which will apply the deterministic compiler option when
    building Erlang/OTP. The deterministic option has been improved
    to eliminate more sources of non-determinism in several
    applications.
  * erts: Fixed inconsistency bugs in global due to nodeup/nodedown
    messages not being delivered before/after traffic over
    connections. Also fixed various other inconsistency bugs and
    deadlocks in both global_group and global. As building blocks
    for these fixes, a new BIF erlang:nodes/2 has been introduced
    and net_kernel:monitor_nodes/2 has been extended. The -hidden
    and -connect_all command line arguments did not work if
    multiple instances were present on the command line which has
    been fixed. The new kernel parameter connect_all has also been
    introduced in order to replace the -connect_all command line
    argument.
  * erts: Fixed IPv6 multicast_if and membership socket options.
  * erts: Accept funs (NEW_FUN_EXT) with incorrectly encoded size
    field. This is a workaround for a bug (OTP-18104) existing in
    OTP 23 and 24 that could cause incorrect size fields in certain
    cases. The emulator does not use the decoded size field, but
    erl_interface still does and is not helped by this workaround.
  * erts: Fixed issue with inet:getifaddrs hanging on pure IPv6
    Windows
  * erts: Fix faulty distribution encoding of terms with either The
    symptom could be failed decoding on the receiving side leading
    to aborted connection. Fix OTP-18093 is a workaround for theses
    bugs that makes the VM accepts such faulty encoded funs. The
    first encoding bug toward pending connection exists only in OTP
    23 and 24, but the second one exists also on OTP 25.
  * erts: Fixed emulator crash that could happen during crashdump
    generation of ETS tables with options ordered_set and
    {write_concurrency,true}.
  * erts: Retrieval of monotonic and system clock resolution on
    MacOS could cause a crash and/or erroneous results.
  * erts: Fix bug where the max allowed size of erl +hmax was lower
    than what was allowed by process_flag.
  * erts: On computers with ARM64 (AArch64) processors, the JIT
    could generate incorrect code when more than 4095 bits were
    skipped at the tail end of a binary match.
  * erts: In rare circumstances, an is_binary/1 guard test could
    succeed when given a large integer.
  * erts: Fix bug causing ets:info (and sometimes ets:whereis) to
    return 'undefined' for an existing table if a concurrent
    process were doing ets:insert with a long list on the same
    table.
  * erts: Fix writing and reading of more than 2 GB in a single
    read/write operation on macOS. Before this fix attempting to
    read/write more than 2GB would result in {error,einval}.
  * erts: Fix bug sometimes causing emulator crash at node shutdown
    when there are pending connections. Only seen when running duel
    distribution protocols, inet_drv and inet_tls_dist.
  * erts: Yield when adjusting large process message queues due to
    The message queue adjustment work will now be interleaved with
    all other types of work that processes have to do, even other
    message queue adjustment work.
  * erts: Add rudimentary debug feature (option) for the inet-
    driver based sockets, such as gen_tcp and gen_udp.
  * erts: Introduced the hidden and dist_listen options to
    net_kernel:start/2. Also documented the -dist_listen command
    line argument which was erroneously documented as a kernel
    parameter and not as a command line argument.
  * erts: New documentation chapter "Debugging NIFs and Port
    Drivers" under Interoperability Tutorial.
  * erts: Add new API function erl_features:configurable/0
  * kernel: Fixed inconsistency bugs in global due to
    nodeup/nodedown messages not being delivered before/after
    traffic over connections. Also fixed various other
    inconsistency bugs and deadlocks in both global_group and
    global. As building blocks for these fixes, a new BIF
    erlang:nodes/2 has been introduced and
    net_kernel:monitor_nodes/2 has been extended. The -hidden and
  - connect_all command line arguments did not work if multiple
    instances were present on the command line which has been
    fixed. The new kernel parameter connect_all has also been
    introduced in order to replace the -connect_all command line
    argument.
  * kernel: Fixed IPv6 multicast_if and membership socket options.
  * kernel: Fixed issue with inet:getifaddrs hanging on pure IPv6
    Windows
  * kernel: The type specifications for inet:getopts/2 and
    inet:setopts/2 have been corrected regarding SCTP options.
  * kernel: The type specifications for inet:parse_* have been
    tightened.
  * kernel: Fix gen_tcp:connect/3 spec to include the inet_backend
    option.
  * kernel: Fix bug where using a binary as the format when calling
    logger:log(Level, Format, Args) (or any other logging function)
    would cause a crash or incorrect logging.
  * kernel: Add rudimentary debug feature (option) for the inet-
    driver based sockets, such as gen_tcp and gen_udp.
  * kernel: Introduced the hidden and dist_listen options to
    net_kernel:start/2. Also documented the -dist_listen command
    line argument which was erroneously documented as a kernel
    parameter and not as a command line argument.
  * kernel: Scope and group monitoring have been introduced in pg.
    For more information see the documentation of
    pg:monitor_scope(), pg:monitor(), and pg:demonitor().
  * kernel: A new function global:disconnect/0 has been introduced
    with which one can cleanly disconnect a node from all other
    nodes in a cluster of global nodes.
  * compiler: The compiler will now forbid using the empty atom ''
    as module name. Also forbidden are modules names containing
    control characters, and module names containing only spaces and
    soft hyphens.
  * compiler: The bin_opt_info and recv_opt_info options would
    cause the compiler to crash when attempting to compile
    generated code without location information.
  * compiler: In rare circumstances involving floating point
    operations, the compiler could terminate with an internal
    consistency check failure.
  * compiler: In rare circumstances when doing arithmetic
    instructions on non-numbers, the compiler could crash.
  * compiler: In rare circumstances, complex boolean expressions in
    nested cases could cause the compiler to crash.
  * compiler: Expression similar to #{assoc:=V} = #key=&gt;self()}, V
    would return the empty map instead of raising an exception.
  * compiler: Eliminated a crash in the beam_ssa_bool pass of the
    compiler when compiling a complex guard expression.
  * compiler: In rare circumstances, the compiler could crash with
    an internal consistency check failure.
  * compiler: When compiling with the option inline_list_funcs, the
    compiler could produce a nonsensical warning.
  * compiler: When given the no_ssa_opt option, the compiler could
    terminate with an internal consistency failure diagnostic when
    compiling map matching.
  * compiler: Made warnings for existing atoms being keywords in
    experimental features more precise, by not warning about quoted
    atoms.
  * compiler: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * megaco: Fixed various dialyzer related issues in the examples
    and the application proper.
  * megaco: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * common_test: Fix cth_surefire to handle when a suite is not
    compiled with debug_info. This bug has been present since
    Erlang/OTP 25.0.
  * common_test: Common Test now preserves stack traces for throws.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1669291200">- Changes for 25.1.2:
  * mnesia: Don't fill the logs if mnesia can't connect to all
    nodes, due to partitioned network.
  * erts: Add abandon carrier free utilization limit (+Muacful)
    option to erts_alloc. This option allows the user to mark
    unused segments in a memory carrier as re-useable by the OS if
    needed. This functionality was a non-configurable default
    before Erlang/OTP 25, but removed due to performance issues.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1671364800">- Changes for 25.2:
  * erts: Fix perf/gdb JIT symbols to not contain CodeInfoPrologue
    for the JIT internal module erts_beamasm.
  * erts: Fixed minor memory leaks.
  * erts: Fix bugs in ets:insert and ets:insert_new when called
    with a list of tuples to insert while a concurrent process
    either deletes or renames the table. The table deletion could
    be done with ets:delete/1 or be caused by termination of the
    table owning process. Symptoms are either VM crash or strange
    incorrect behavior from the insert operation. The risk of
    triggering the bugs increases with the length of the list of
    tuple to insert. Bugs exist since OTP 23.0.
  * erts: Boost execution of scheduled thread progress jobs. This
    to prevent memory exhaustion in extremely rapid
    allocation/deallocation scenarios, such as repeated ETS table
    creations/deletions.
  * erts: Fix segv crash during crash dumping an ETS table doing
    ets:delete_all_objects.
  * erts: Spec for function net:if_names/0 incorrect
  * erts: Fix bug in binary_to_term decoding a binary term 2Gbyte
    or larger.
  * erts: Documentation of erlang:module_loaded/1 has been
    adjusted:
  * erts: Fix list_to_atom/1 for negative code points. Could either
    return with a positive code point or fail with an incorrect
    exception.
  * erts: Fix rare bug causing VM crash when sending to a pid of a
    spawning process returned from erlang:processes/0. Only seen
    when provoked by system process literal_area_collector,
    triggered by a module purge operation, on a VM started with
    +Meamin (no customized allocators).
  * erts: gen_udp:open/2 with option(s) add_membership or
    drop_membership would drop earlier options.
  * erts: The inet:setopts/2 {reuseaddr, true} option will now be
    ignored on Windows unless the socket is an UDP socket. For more
    information see the documentation of the reuseaddr option part
    of the documentation of inet:setopts/2. Prior to OTP 25 the
    {reuseaddr, true} option was ignored for all sockets on
    Windows, but as of OTP 25.0 this was changed so that it was not
    ignored for any sockets. *** POTENTIAL INCOMPATIBILITY ***
  * erts: Fix bug in binary_to_term decoding a list of length 1G or
    longer.
  * erts: Fix bug in binary_to_term (and distributed receive) when
    decoding a large map (&gt;32 keys) with unsorted small maps (&lt;=
    32) as keys of the large map. This was only a problem if the
    term was encoded by erl_interface, jinterface or otherwise, as
    the VM itself always encodes small maps with sorted keys. The
    "binary_to_term" would appear as successful but the created
    large map was internally inconsistent. The smaller key-maps
    could not be found with maps:get and friends. Other operations
    such as map compare and merge could probably also give
    incorrect results.
  * erts: Fix Windows bug in open_port({spawn, Command}, ..) when
    Command is found via the OS search PATH and that directory path
    contains white spaces. The port program would start but the
    command line arguments to it could be incorrect.
  * ftp: fix unexpected result ok when calling ftp:nlist repeatedly
  * inets: This change allows body requests to httpc:request/5 be
    an iolist()
  * inets: addition of type specs in httpc.erl
  * inets: httpc: Add support for HTTP 308 status code
  * dialyzer: Dialyzer would crash when attempting to analyze a bit
    syntax segment size having an literal non-integer size such as
    [].
  * dialyzer: Dialyzer could crash when trying to analyze a
    convoluted nested expression involving funs,
  * kernel: Fixed shutdown crash in gen_tcp socket backend, when
    the other end closed the socket.
  * kernel: erl_tar can now read gzip-compressed tar files that are
    padded. There is a new option compressed_one for file:open/2
    that will read a single member from a gzip file,
  * kernel: Fix os:cmd to not translate all exceptions thrown to
    badarg. For example emfile from erlang:open_port was translated
    to badarg. This bug has existed since Erlang/OTP 24.
  * kernel: Spec for function net:if_names/0 incorrect
  * kernel: Missing ctrl option name transation for TOS and TTL (on
    FreeBSD) when using gen_udp with the 'socket' inet_backend.
  * kernel: gen_udp:open/2 with option(s) add_membership or
    drop_membership would drop earlier options.
  * kernel: The inet:setopts/2 {reuseaddr, true} option will now be
    ignored on Windows unless the socket is an UDP socket. For more
    information see the documentation of the reuseaddr option part
    of the documentation of inet:setopts/2. Prior to OTP 25 the
    {reuseaddr, true} option was ignored for all sockets on
    Windows, but as of OTP 25.0 this was changed so that it was not
    ignored for any sockets. *** POTENTIAL INCOMPATIBILITY ***
  * kernel: The distribution socket option handling in
    inet_tcp_dist has been cleaned up to clarify which were
    mandatory and which just had default values.
  * kernel: Improve warning message format for gen_tcp_socket.
  * snmp: Explicitly close the socket(s) when terminating
    (default-) net-if process.
  * stdlib: erl_tar can now read gzip-compressed tar files that are
    padded. There is a new option compressed_one for file:open/2
    that will read a single member from a gzip file,
  * stdlib: A concurrent call to ets:rename could cause
    ets:delete_all_objects to fail halfway through with badarg.
  * stdlib: It is not allowed to call functions from guards. The
    compiler failed to reject a call in a guard when done by
    constructing a record with a default initialization expression
    that called a function.
  * stdlib: The compiler could crash when using a record with
    complex field initialization expression as a filter in a list
    comprehension.
  * stdlib: unicode:characters_to_binary() could build
    unnecessarily large call stack.
  * stdlib: Improve error message for ets:new/2 name clash. Say
    "name already exists" instead of less specific "invalid
    options".
  * mnesia: Fixed crash which could happen during startup if too
    many decisions where sent from remote nodes.
  * os_mon: The disk_space_check_interval configuration parameter
    of disksup can now be set to values smaller than a minute.
  * ssh: graceful shutdown of ssh_conection_handler when connection
    is closed by peer
  * common_test: Fix starting of peer nodes on old releases when
    the compile server was active and the current Erlang
    installation contained non-latin1 characters in its path.
  * public_key: Disregard LDAP URIs when HTTP URIs are expected.
  * ssl: With this change, tls_sender process is hibernated after
    sufficient inactivity.
  * ssl: Correct handling of legacy schemes so that ECDSA certs
    using sha1 may be used for some TLS-1.3 configurations.
  * ssl: With this change, tls_sender does not cause logger crash
    upon key update.
  * ssl: Enhance warning message
  * ssl: Provide server option to make certificate_authorities
    extension in the TLS-1.3 servers certificate request optional.
    This will allow clients to send incomplete chains that may be
    reconstructable and thereby verifiable by the server, but that
    would not adhere to the certificate_authorities extension.
  * ssl: If the verify_fun handles four arguments the DER cert will
    be supplied as one of the arguments.
  * megaco: A very minor improvement to the measurement tool.
  * observer: A WX event race could causes a crash in when handling
    socket or port info.
  * observer: Improve the nodes menu to include more nodes.
  * compiler: Line number in compiler messages would be truncated
    to 4 digits for line numbers greater than 9999.
  * compiler: In rare circumstance, matching a binary as part of a
    receive clause could cause the compiler to terminate because of
    an internal consistency check failure.
  * compiler: Compiling a function with complex bit syntax matching
    such as f(&lt;&lt;X:0, _:X&gt;&gt;, &lt;&lt;Y:0, _:Y&gt;&gt;) -&gt; ok. could crash the
    compiler.
  * compiler: It is not allowed to call functions from guards. The
    compiler failed to reject a call in a guard when done by
    constructing a record with a default initialization expression
    that called a function.
  * compiler: The compiler could crash when using a record with
    complex field initialization expression as a filter in a list
    comprehension.
  * wx: Added environment variable WX_MACOS_NON_GUI_APP to allow
    user to override OSXIsGUIApplication behavior.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1679745600">- Changes for 25.3:
  * reltool: Fixed a bug that would cause analysis to crash.
  * stdlib: Fixed a bug that would cause analysis to crash.
  * stdlib: Fixed a crash when formatting stack traces for error
    reports.
  * stdlib: Instead of crashing, the list_to_integer/1 and
    list_to_integer/2 BIFs now raise the system_limit exception for
    overlong lists that can't be converted to integers. Similarly,
    the string:to_integer/1 BIF now returns {error,system_limit}
    for overlong lists.
  * stdlib: Removal of non-necessary undefined types added to the
    state's supervisor record.
  * compiler: Fixed a bug that would cause the compiler to hang.
  * compiler: Fixed a crash when compiling code that contained
    maybe expressions.
  * compiler: Constructing a binary with an explicit size of all
    for a binary segment would crash the compiler.
  * compiler: The compiler would generate incorrect code for the
    following type of expression: Pattern = BoundVar1 = . . . =
    BoundVarN = Expression An exception should be raised if any of
    the bound variables have different values than Expression. The
    compiler would generate code that would cause the bound
    variables to be bound to the value of Expressionwhether the
    value matched or not.
  * xmerl: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * megaco: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * debugger: Fixed a bug that would cause analysis to crash.
  * erts: Fixed a bug on Windows where file:read_file_info/1 would
    fail for files with corrupt metadata.
  * erts: Fix process_info(_, binary) to again include "writable
    binaries" which were lost in OTP-25.0. Writable binaries are an
    optimization used when binaries are appended upon in a loop.
  * erts: Fix rare race when receiving fragmented messages on a
    terminating connection. Could potentially cause memory leaks as
    well as double free crashes. Bug exists since OTP 22.0.
  * erts: Fixed bug that could maybe cause problems when a file
    descriptor number is closed by a linked in driver and then
    opened (reused) and passed to enif_select by a NIF. No actual
    symptoms seen, only failed internal assertions in debug build.
  * erts: The runtime system could crash when tracing a process
    executing on a dirty scheduler.
  * erts: In the binary syntax, attempting to match out integers
    with size exceeding 2 GiB could crash the runtime system.
  * erts: Fixed edge case in floating-point negation where A = 0.0,
    B = -A did not produce B = -0.0 on x86_64 JIT.
  * erts: Fixed an issue in the JIT that could crash the emulator
    on some platforms.
  * erts: Added meta data to the windows installer.
  * erts: Fixed ETS insertion order into bag and duplicate_bag of
    tuples with identical keys when passed in a list to
    ets:insert/2. The insert order has been head-to-tail but was
    accidentally changed in OTP 23.0. For bag it was reverted
    (tail-to-head), while for duplicate_bag it was sometimes
    reverted depending on the length of the list and number of
    "reductions" left for the calling process. This fix changes the
    insert order of ets:insert/2 back to always be head-to-tail of
    the list argument.
  * erts: With the JIT for AArch64 (AMD64), calling bxor in with
    non-integer arguments in a guard would crash the runtime
    system.
  * erts: Fix bug regarding process flag max_heap_size. Could cause
    strange behavior when a process was killed due to exceeding the
    limit.
  * erts: Fixed binary comprehensions to be similar to other
    creation of binary data with respect to its contribution of
    triggering garbage collection.
  * erts: In rare circumstances, when a process exceeded its
    allowed heap size set by option max_heap_size, it would not be
    killed as it should be, but instead enter a kind of zombie
    state it would never get out of.
  * erts: Instead of crashing, the list_to_integer/1 and
    list_to_integer/2 BIFs now raise the system_limit exception for
    overlong lists that can't be converted to integers. Similarly,
    the string:to_integer/1 BIF now returns {error,system_limit}
    for overlong lists.
  * erts: Active process aliases of a process at its termination
    leaked memory.
  * erts: Support for fully asynchronous distributed signaling
    where send operations never block. This functionality is by
    default disabled and can be enabled per process. For more
    information see the documentation of process_flag(async_dist,
    Bool).
  * erts: Added the +JPperf no_fp option to explicitly disable
    Erlang frame pointers otherwise added when using the +JPperf
    map option.
  * erl_interface: Accept connection setup from OTP 23 and 24 nodes
    that are not using epmd.
  * erl_interface: The ei API for decoding/encoding terms is not
    fully 64-bit compatible since terms that have a representation
    on the external term format larger than 2 GB cannot be handled.
  * syntax_tools: erl_syntax_lib:annotate_bindings/1,2 will now
    properly annotate named functions and their arguments.
  * kernel: Fixed a bug on Windows where file:read_file_info/1
    would fail for files with corrupt metadata.
  * kernel: Accept connection setup from OTP 23 and 24 nodes that
    are not using epmd.
  * public_key: As different solutions of verifying certificate
    revocation exists move the decode of 'CRLDistributionPoints' so
    that it will only be decode. When it is actually used in the
    verification process. This would enable interoperability with
    systems that use certificates with an invalid empty
    CRLDistributionPoints extension that they want to ignore and
    make verification by other means.
  * public_key: public_key:pkix_path_validation validates
    certificates expiring after 2050
  * public_key: Do not leave exit message in message queue after
    calling cacerts_load() on MacOS.
  * public_key: Replace size/1 with either tuple_size/1 or
    byte_size/1 The size/1 BIF is not optimized by the JIT, and its
    use can result in worse types for Dialyzer. When one knows that
    the value being tested must be a tuple, tuple_size/1 should
    always be preferred. When one knows that the value being tested
    must be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * ssl: Fixed that new dtls connections from the same client ip
    port combination works. If there is a process waiting for
    accept the new connection will connect to that, otherwise it
    will try to re-connect to the old server connection.
  * ssl: When shutting down a node that uses SSL distribution
    (-proto_dist inet_tls), a confusing error message about an
    unexpected process exit was printed. This particular message is
    no longer generated.
  * ssl: fixes the type spec for ssl:format_error/1
  * ssl: Replace size/1 with either tuple_size/1 or byte_size/1 The
    size/1 BIF is not optimized by the JIT, and its use can result
    in worse types for Dialyzer. When one knows that the value
    being tested must be a tuple, tuple_size/1 should always be
    preferred. When one knows that the value being tested must be a
    binary, byte_size/1 should be preferred. However, byte_size/1
    also accepts a bitstring (rounding up size to a whole number of
    bytes), so one must make sure that the call to byte_size/ is
    preceded by a call to is_binary/1 to ensure that bitstrings are
    rejected. Note that the compiler removes redundant calls to
    is_binary/1, so if one is not sure whether previous code had
    made sure that the argument is a binary, it does not harm to
    add an is_binary/1 test immediately before the call to
    byte_size/1.
  * jinterface: Accept connection setup from OTP 23 and 24 nodes
    that are not using epmd.
  * os_mon: The port programs used by cpu_sup and memsup are now
    gracefully shut down when cpu_sup and memsup are shut down.
  * eunit: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * crypto: A user defined runtime library path configured using
  - -with-ssl-rpath=&lt;PATHS&gt; could fail to be enabled.
  * crypto: Ensure that configure fails if a user defined runtime
    library path has been passed by the user, but cannot set.
  * mnesia: Improved consistency for dirty writes when a table was
    added with add_table_copy/3. Fixed a problem with sticky write,
    which could lead to inconsistent data.
  * mnesia: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * common_test: Renamed undocumented macro CT_PEER/3 to
    CT_PEER_REL/3.
  * ssh: With this change, PKCS8 formatted private key file is
    properly decoded and SSH daemon with such key can be started.
  * ssh: Replace size/1 with either tuple_size/1 or byte_size/1 The
    size/1 BIF is not optimized by the JIT, and its use can result
    in worse types for Dialyzer. When one knows that the value
    being tested must be a tuple, tuple_size/1 should always be
    preferred. When one knows that the value being tested must be a
    binary, byte_size/1 should be preferred. However, byte_size/1
    also accepts a bitstring (rounding up size to a whole number of
    bytes), so one must make sure that the call to byte_size/ is
    preceded by a call to is_binary/1 to ensure that bitstrings are
    rejected. Note that the compiler removes redundant calls to
    is_binary/1, so if one is not sure whether previous code had
    made sure that the argument is a binary, it does not harm to
    add an is_binary/1 test immediately before the call to
    byte_size/1.
  * inets: With this change, handling of URI to a folder, with
    missing trailing / and a query component present is fixed.
  * inets: Adds more type information to the inets app, thus
    improving the errors that static analysis tools can detect. The
    addition of type information to records and the updates to
    function heads help static analysis tools to understand that
    some values in the records cannot be 'undefined', thus making
    static tools to type check correctly more modules in the inets
    app
  * inets: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * snmp: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * ftp: Replace size/1 with either tuple_size/1 or byte_size/1 The
    size/1 BIF is not optimized by the JIT, and its use can result
    in worse types for Dialyzer. When one knows that the value
    being tested must be a tuple, tuple_size/1 should always be
    preferred. When one knows that the value being tested must be a
    binary, byte_size/1 should be preferred. However, byte_size/1
    also accepts a bitstring (rounding up size to a whole number of
    bytes), so one must make sure that the call to byte_size/ is
    preceded by a call to is_binary/1 to ensure that bitstrings are
    rejected. Note that the compiler removes redundant calls to
    is_binary/1, so if one is not sure whether previous code had
    made sure that the argument is a binary, it does not harm to
    add an is_binary/1 test immediately before the call to
    byte_size/1.
  * dialyzer: Fixed a bug that would cause analysis to crash.
  * dialyzer: Replace size/1 with either tuple_size/1 or
    byte_size/1 The size/1 BIF is not optimized by the JIT, and its
    use can result in worse types for Dialyzer. When one knows that
    the value being tested must be a tuple, tuple_size/1 should
    always be preferred. When one knows that the value being tested
    must be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * tftp: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
- Changes for 25.2.3:
  * erts: Comparisons between small numbers and pids or ports would
    in some edge cases say that the number was greater than the pid
    or port, violating the term order.
  * erts: process_info(Pid, status) when Pid /= self() could return
    an erroneous result.
  * ssl: Maximize compatibility by ignoring change_cipher_spec
    during handshake even if middle_box_mode is not negotiated
    (mandated by client)
  * ssl: Move assert of middlebox message after an
    hello_retry_request to maximize interoperability. Does not
    changes semantics of the protocol only allows unexpected
    message delay from server.
  * ssh: With this change, ssh application does not crash when
    formatting some of info reports for unsuccessful connections.
  * ssh: With this change, ssh does not log extensively long
    messages.
  * inets: Ensure graceful shutdown
  * inets: Return type of the type specification for function
    httpc:cookie_header/{1,2,3} has been fixed from -spec
    cookie_header(url()) -&gt; [{ field(), value() }] | {error,
    Reason} to -spec cookie_header(url()) -&gt; { field(), value() } |
    {error, Reason}
- Changes for 25.2.2:
  * ftp: Fixes calls to ftp:nlist/2 returning {error, epath} when
    the file / folder exists
- Changes for 25.2.1:
  * compiler: Fixed a bug that could cause legal code to fail
    validation.
  * compiler: Eliminated a rare crash in the beam_types module.
  * erts: Fixed a bug in selective receive optimization that could
    crash 32-bit emulators.
  * erts: A race condition which was very rarely triggered could
    cause the signal queue of a process to become inconsistent
    causing the runtime system to crash.
  * kernel: The tcp connect option 'bind_to_device' could not be
    used with inet_backend = 'socket'. 'inet' requires value type
    binarry() and 'socket' requires value type 'string()'.
  * kernel: Minor issue processing options when calling
    gen_tcp:connect with a sockaddr() and inet_backend = socket.
  * common_test: Change timeout to infinity for gen_server calls in
    cth_log_redirect
  * inets: fixes a missing case of the type specification for
    httpd:info/2/3/4
  * snmp: Single threaded agent crash when vacm table not properly
    initiated.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1683460800">- Changes for 25.3.2:
  * compiler: Fixed type handling bugs that could cause an internal
    error in the compiler for correct code.
  * os_mon: Avoid error report from failing erlang:port_close at
    shutdown of cpu_sup and memsup. Bug exists since OTP 25.3
    (os_mon-2.8.1).
  * erts: If a runtime system which was starting the distribution
    already had existing pids, ports, or references referring to a
    node with the same nodename/creation pair that the runtime
    system was about to use, these already existing pids, ports, or
    references would not work as expected in various situations
    after the node had gone alive. This could only occur if the
    runtime system was communicated such pids, ports, or references
    prior to the distribution was started. That is, it was
    extremely unlikely to happen unless the distribution was
    started dynamically and was even then very unlikely to happen.
    The runtime system now checks for already existing pids, ports,
    and references with the same nodename/creation pair that it is
    about to use. If such are found another creation will be chosen
    in order to avoid these issues.
- Changes for 25.3.1:
  * snmp: Attempts to minimize the number of the error reports
    during a failed agent init.
  * compiler: When a map update such as #{}#{key:=value} that
    should fail with an exception was unused, the exception would
    be lost.
  * compiler: Fixed bug in the validator that made it reject valid
    code.
  * crypto: With this change, random errors are fixed for
    crypto:generate_key calls with OpenSSL 3.
  * erts: Fixed a bug in the loader that prevented certain modules
    compiled with no_ssa_opt from being loaded.
  * erts: Implementations of the call() driver callback that
    returned a faulty encoded result could cause a memory leak and
    could cause invalid data on the heap of the processes calling
    erlang:port_call/3.
  * erts: Fixed a memory corruption issue when upgrading code. The
    bug was introduced in OTP 25.3
  * erts: Fixed configure tests for a few ARM-specific
    instructions, which prevented the emulator from being built on
    some platforms.
  * erts: Aliases created in combination with a monitor using the
    {alias, explicit_unalias} option stopped working from remote
    nodes when a 'DOWN' signal had been received due to the monitor
    or if the monitor was removed using the erlang:demonitor() BIF.
    This bug was introduced in OTP 24.3.4.10 and OTP 25.3.
  * erts: In rare circumstances, bit syntax matching of an invalid
    code point for a utf32 would crash the runtime system.
  * erts: Building the runtime system failed when native atomic
    support was missing. Note that execution on such systems have
    only been rudimentary tested.
  * erl_interface: Fixed configure tests for a few ARM-specific
    instructions, which prevented the emulator from being built on
    some platforms.
  * eldap: Added a new function eldap:info/1 that returns the
    socket and the transport protocol for the eldap connection.
  * inets: Correct timing related pipelining/keepalive queue bug,
    that could result in unexpected "socket_remotly_closed" errors.
  * inets: With this change, upon remote socket closure current
    request is added to a retried queue (either pipeline or
    keep_alive, but not both).
  * ssl: With this change, ssl:connection_information/2 returns
    correct keylog data after TLS1.3 key update.
  * ssl: Client signature algorithm list input order is now honored
    again , it was accidently reversed by a previous fix.
  * stdlib: The type specs in the erl_parse module has been updated
    to include the maybe construct and the ! operator.
  * wx: Improve debug prints from the nifs. Some minor fixes for
    wxWidgets-3.2. Fixed OpenGL debug functions.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1687521600">- Changes for 25.3.2.2:
  * compiler: The compiler could be very slow when compiling guards
    with multiple guard tests separated with 'or' or ';'.
- Changes for 25.3.2.1:
  * xmerl: New options to xmerl_scan and xmerl_sax_parser so one
    can limit the behaviour of the parsers to avoid some XML
    security issues. xmerl_scan gets one new option:
    xmerl_sax_parser gets the following options: The old option
    skip_external_dtd is still valid and the same as
    {external_entities, none} and {fail_undeclared_ref, false} but
    just affects DTD's and not other external references.
  * erts: Fixed a crash during tracing on certain platforms that
    cannot use the machine stack for Erlang code (mainly OpenBSD
    and Linux with musl).
  * erts: Constructing a binary segment not aligned with a byte
    boundary, with a size not fitting in 31 bits, and with a value
    not fitting in a 64-bit word could crash the runtime system.
  * erts: Further robustify implementation of large maps (&gt; 32
    keys). Keys that happen to have same internal 32-bit hash
    values are now put in collision nodes which are traversed with
    linear search. This removes the demand for the internal hash
    function when salted to eventually produce different hashes for
    all possible pairs of unequal terms.
  * stdlib: Static supervisors are very idle processes after they
    have started so they will now be hibernated after start to
    improve resource management.
  * compiler: Fixed a bug where a failing bsl expression in a guard
    threw an exception instead of causing the guard to fail.
  * compiler: Complex guard expression using the or operator and
    guard BIFs that can fail could sometimes be miscompiled so that
    the guard would succeed even if a call to a guard BIF failed.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1687608000">- Version 26.0:
  * Leex has been extended with optional column number support.
  * The family of enumeration functions in module lists has been
    extended with enumerate/3 that allows a step value to be
    supplied.
  * Update Unicode to version 15.0.0.
  * proc_lib:start*/* has become synchronous when the started
    process fails. This requires that a failing process use a new
    function proc_lib:init_fail/2,3, or exits, to indicate failure. All
    OTP behaviours have been fixed to do this.
  * auto-complete of variables, record names, record fields names,
    map keys, function parameter types and filenames.
  * Open external editor in the shell to edit the current
    expression.
  * defining records (with types), functions, specs and types in
    the shell.
  * Creation and matching of binaries with segments of fixed sizes
    have been optimized.
  * Creation and matching of UTF-8 segments have been optimized.
  * Appending to binaries has been optimized.
  * The compiler and JIT now generate better code for creation of
    small maps where all keys are literals known at compile time.
  * Thanks to the optimizations above the performance of the base64
    module has been significantly improved. For example, on an
    x86_64 system with the JIT both encode and decode are almost
    three times faster than in Erlang/OTP 25.
  * Map comprehensions as suggested in EEP 58 has now been
    implemented.
  * Some map operations have been optimized by changing the
    internal sort order of atom keys. This changes the
    (undocumented) order of how atom keys in small maps are printed
    and returned by maps:to_list/1 and maps:next/1. The new order
    is unpredictable and may change between different invocations
    of the Erlang VM.
  * Introducing the new function maps:iterator/2 for creating an
    interator that return the map elements in a deterministic
    order. There are also new modifiers k and K for the format
    string in io:format() to support printing map elements ordered.
  * Added the new built-in type dynamic() introduced in EEP 61, PR
    introducing EEP 61 improving support for gradual type checkers.
  * Dialyzer has a new incremental mode that be invoked by giving
    the --incremental option when running Dialyzer. This new
    incremental mode is likely to become the default in a future
    release.
  * Multi time warp mode is now enabled by default. This assumes
    that all code executing on the system is time warp safe.
  * Support for UTF-8 atoms and strings in the NIF interface
    including new functions enif_make_new_atom,
    enif_make_new_atom_len and enif_get_string_length.
  * The BIFs min/2 and max/2 are now allowed to be used in guards
    and match specs.
  * Improved the selective receive optimization, which can now be
    enabled for references returned from other functions. This
    greatly improves the performance of gen_server:send_request/3,
    gen_server:wait_response/2, and similar functions.
  * It is no longer necessary to enable a feature in the runtime
    system in order to load modules that are using it. It is
    sufficient to enable the feature in the compiler when compiling
    it.
  * inet:setopts/2 has got 3 new options: reuseport, reuseport_lb
    and exclusiveaddruse.
  * Fix so that -fno-omit-frame-pointer is applied to all of the
    Erlang VM when using the JIT so that tools, such as perf, can
    crawl the process stacks.
  * In the lists module, the zip family of functions now takes
    options to allow handling lists of different lengths.
  * Added the zip:zip_get_crc32/2 function to retrieve the CRC32
    checksum from an opened ZIP archive. gen_server optimized by
    caching callback functions
  * The modules Erlang DNS resolver inet_res and helper modules
    have been updated for RFC6891; to handle OPT RR with DNSSEC OK
    (DO) bit.
  * Introduced application:get_supervisor/1.
  * Cache OTP boot code paths, to limit how many folders that are
    being accessed during a module lookup. Can be disabled with
  - cache_boot_path false.
  * Support for Kernel TLS (kTLS), has been added to the SSL
    application, for TLS distribution (-proto_dist inet_tls), the
    SSL option {ktls, true}.
  * Improved error checking and handling of ssl options.
  * Mitigate memory usage from large certificate chains by lowering
    the maximum handshake size. This should not effect the common
    cases, if needed it can be configured to a higher value.
  * For security reasons the SHA1 and DSA algorithms are no longer
    among the default values.
  * Add encoding and decoding of use_srtp hello extension to
    facilitate for DTLS users to implement SRTP functionality.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1687608001">- Changes for 26.0.1:
  * erts: Build of the socket nif failed on Solaris 11.
  * erts: Fixed two reduction-counting bugs relating to binaries.
  * erts: Constructing a binary segment not aligned with a byte
    boundary, with a size not fitting in 31 bits, and with a value
    not fitting in a 64-bit word could crash the runtime system.
  * erts: When a binary construction failed because of bad size for
    a segment, the error information was not always correct.
  * erts: Fixed a crash when calling a fun that was defined in a
    module that had been upgraded.
  * kernel: The POSIX error exdev was sometimes incorrectly
    described as "cross domain link" in some error messages.
  * kernel: Corrected the socket send function description (send
    with Timeout = nowait). The send function(s) could not return
    {ok, {RestData, SelectInfo}}
  * stdlib: The POSIX error exdev was sometimes incorrectly
    described as "cross domain link" in some error messages.
  * ssl: Make sure that selection of client certificates handle
    both TLS-1.3 and TLS-1.2 names correctly. Could cause valid
    client certificate to not be selected, and an empty client
    certificate message to be sent to server.
  * ssl: Improved ssl:format_error/1 to handle more error tuples.
  * ssl: Fixed hanging ssl:connect when ssl application is not
    started.
  * ssl: Correct handling of retransmission timers, current
    behavior could cause unwanted delays.
  * inets: Do not make the default ssl options by calling
    httpc:ssl_verify_host_options(true) if ssl options are supplied
    by the user.
  * xmerl: New options to xmerl_scan and xmerl_sax_parser so one
    can limit the behaviour of the parsers to avoid some XML
    security issues. xmerl_scan gets one new option:
    xmerl_sax_parser gets the following options: The old option
    skip_external_dtd is still valid and the same as
    {external_entities, none} and {fail_undeclared_ref, false} but
    just affects DTD's and not other external references.
  * compiler: Fixed a bug where a failing bsl expression in a guard
    threw an exception instead of causing the guard to fail.
  * compiler: Fixed a bug that would case the validator to reject
    legal code.
  * compiler: The compiler could re-order clauses matching binaries
    so that the incorrect clause would match. That could only
    happen for code that used the option {error_location,line} or
    for code without line or column number information (e.g.
    generated by a parse transform).
  * compiler: Complex guard expression using the or operator and
    guard BIFs that can fail could sometimes be miscompiled so that
    the guard would succeed even if a call to a guard BIF failed.
  * compiler: With optimizations disabled, a try/catch construct
    could return an incorrect value.
  * compiler: In rare circumstance, a combination of binary
    construction and binary_part/3 would cause the compiler to
    generate unsafe code that would crash the runtime system.
  * compiler: The compiler could be very slow when compiling guards
    with multiple guard tests separated with 'or' or ';'.
  * compiler: Complex guard expressions using 'or' and map updates
    could succeed even if the map update failed.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1698235200">- Changes for 26.1.2:
  * erts: If the external term format encoding of an argument list
    part of a distributed spawn operation was faulty, the newly
    spawned remote process could misbehave. The misbehavior
    included hanging or interpret an incoming message as an
    argument list to use. This was very unlikely to happen unless
    using an alternate implementation of the distribution protocol
    which made a faulty encoding of the argument list. The child
    process will now detect this error and terminate before
    executing the user specified code.
  * erts: Fix bugs where if the body of a matchspec would return a
    map with a variable ('$1', '$_' etc) as one of the keys or
    values and the variable was not an immidiate, the term would
    not be copied to the receiving processes heap. This would later
    corrupt the term in the table as the GC could place move
    markers in it, which in turn would cause the VM to crash. Bug
    has been present for since OTP 17.0.
  * xmerl: The xmerl version 1.3.32 was released in OTP 26.0.1, but
    the incorrect version number of 1.3.31.1 was used for it. This
    incorrect version number continued to appear in OTP 26.0.2, OTP
    26.1, and OTP 26.1.1. The actual xmerl code in these OTP
    versions however corresponds to xmerl version 1.3.32.
- Changes for 26.1.1:
  * wx: The wx application would fail to build on macOS with Xcode
    15.
  * compiler: The compiler could become extremely slow for modules
    containing huge functions.
  * stdlib: Garbage collect the shell process when reducing the
    amount of saved history and results.
- Changes for 26.1:
  * crypto: Fix VM crash caused by crypto being purged and reloaded
    (by init:restart for example) on OS with musl libc (such as
    Alpine linux).
  * crypto: Improved understanding of LibreSSL versions. Support
    chacha20 and chacha20_poly1305 for LibreSSL 3.7. Reflect
    removal of support for the DSS/DSA algorithm which was done in
    LibreSSL 2.6.1.
  * crypto: FIPS supported by crypto for OpenSSL 3.0.* and 3.1.*.
  * asn1: The ASN.1 compiler would ignore a constraint such as
    (SIZE (1..4), ...), causing incorrect behavior of the encoding
    and decoding function for the PER and UPER backends. Corrected
    to handle the constraint in the same way as (SIZE (1..4, ...)).
  * asn1: The JER backend has been internally refactored in a way
    that is compatible for applications that use the documented
    API. However, for a group of ASN.1 modules that depend on each
    other (for example, S1AP-PDU-Descriptions, S1AP-Contents, and
    so on), all modules in the group must be recompiled if on of
    the group members is recompiled.
  * observer: Closing the trace log window via the menu did not
    work.
  * erts: maps:put with existing key and identical value was not
    optimized as a no-op correctly if having the same 32-bit hash
    as another key in the map. In practice very rare and harmless.
  * erts: Fixed an issue with truncated crash slogans on failed
    emulator start.
  * erts: Fixed a bug where the emulator was unable to determine
    the current cgroup CPU quota.
  * erts: A process optimized for parallel signal delivery could
    under some circumstances lose wakeup information. That is, the
    processes was not woken up to take care of the signal, so the
    signal would not be taken care of until the process was woken
    by another signal. Only processes configured with
    message_queue_data set to off_heap utilize this optimization.
  * erts: Function socket:close/1 could cause a VM crash on
    Windows.
  * erts: Fixed a bug in the ARM JIT where it could accidentally
    add garbage trailing bits when creating bitstrings whose size
    wasn't an even multiple of 8 bits.
  * erts: Fix erlang:system_info/1 documentation to show correct
    types.
  * erts: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * erts: Fix compilation with GNU termcap.
  * erts: Delivery time of message signals to a process not
    executing any receive expressions could become very long,
    potentially infinite. For example, a process checking for
    messages using process_info(self(), message_queue_len) or
    process_info(self(), messages) and avoiding to execute a
    receive expression matching on messages could be very slow in
    detecting new messages. Note that you are still discouraged
    from using process_info() this way. A process that wants to
    check if there are messages available to handle should execute
    a receive expression matching on messages.
  * erts: On AArch64 (ARM64), when calculating both the quotient
    and remainder with a divisor begin a power two, the remainder
    could be incorrectly calculated.
  * erts: Fix bug causing "magic" references in a compressed ETS
    table to not keep the referred object alive. The symptom would
    be the referred object being garbage collected prematurely and
    the reference appearing stale, not referring to anything.
    Examples of such magically referred objects are atomics and NIF
    resources.
  * erts: Matching out short bitstrings with a fixed size not
    divisible by 8 could could lead to the runtime system
    terminating with an "Overrun heap and stack" error.
  * erts: A constant flow of incoming non-message signals could
    prevent a process needing to execute dirty from doing so.
  * erts: A BEAM file usually contains a chunk with the tag "Type"
    containing type information that can be used by the JIT. The
    beam_lib:strip/1 takes care to preserve that chunk, but a
    build/release tool that does customized stripping could
    accidentally remove the chunk. Loading a BEAM file without the
    "Type" chunk could cause incorrect behavior of the loaded code.
  * erts: gen_udp:recv/* for Unix Domain Socket in binary mode and
    passive mode has been fixed to not crash.
  * erts: The cleanup operation of not yet delivered signals to a
    terminated process yielded excessively.
  * erts: Fixed minor hashing issue with the local option of
    term_to_binary()/term_to_iovec().
  * erts: Update gen_tcp_socket and gen_udp_socket to handle
    'completion' (socket on Windows).
  * erts: Add support for Unix Domain Sockets (only for STREAM
    sockets) on Windows for 'socket'.
  * erts: In Erlang/OTP 27, by default escripts will be compiled
    before being executed. That means that the compiler application
    must be installed. It is possible to force the escript to be
    interpreted by adding the directive -mode(interpret). to the
    escript file. In Erlang/OTP 28, support for interpreting an
    escript will be removed.
  * erts: Add basic support for socket ioctl on Windows.
  * erts: Removed erts/etc/darwin/Info.plist, as it is no longer
    necessary after macos 10.12
  * erts: Add support for (Windows) socket option exclusiveaddruse.
  * erts: [socket] Add support for the 'nopush' option.
  * erts: Add support for socket option 'BSP STATE'.
  * erts: Add tcp socket options 'keepcnt', 'keepidle' and
    'keepintvl'.
  * erts: Add support for misc (Windows) socket options
    ('max_msg_size' and 'maxdg').
  * compiler: The compiler could run forever when compiling a call
    to is_record/3 with a huge positive tuple size. The call
    is_record(A, a, 0) would crash the compiler when used in a
    function body. When used in a guard the compiler would emit
    incorrect code that would accept {a&gt; as a record.
  * compiler: Fixed a bug that caused dialyzer to crash when
    analyzing bogus code that contained the literal atom undefined
    in segment sizes.
  * compiler: The compiler would crash when compiling some modules
    that contained a call to erlang:load_nif/2.
  * compiler: Fixed a bug that caused the compiler to crash on
    legal code.
  * compiler: The compiler could crash when attempting to compile a
    call to is_list/1 in a complex expression.
  * compiler: A complex guard expression using the or operator
    could succeed when it was supposed to fail.
  * compiler: Compiling nested try/catch and catch expression could
    result in an internal compiler error.
  * compiler: Using the bnot operator in a complex expression could
    cause the compiler to terminate with an internal consistency
    failure diagnostic.
  * compiler: Fixed a bug that caused the compiler to crash in a
    binary optimization pass.
  * compiler: The compiler could terminate with an internal error
    when attempting to compile a binary pattern that could not
    possibly match.
  * compiler: Fixed various performance issues related to the alias
    optimization pass.
  * erl_docgen: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * mnesia: Do not delete old backup file if the new backup fails.
  * megaco: Make megaco transports handle gen_tcp | gen_udp with
    socket backend on Windows (completion).
  * common_test: With this change, ct_hooks manual refers to CTH
    execution order section in user guide.
  * common_test: With this change, Config data from
    pre_end_per_testcase hook is delivered to post_end_per_testcase
    callback in case of testcase timetrap or linked process crash.
  * common_test: With this change, remaining references to not
    supported vts tool in ct_run are removed (mainly relates to
    docs and ct_run help message).
  * common_test: With this change, prompt search functionality in
    ct_telnet handles unicode input.
  * common_test: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * stdlib: The compiler could run forever when compiling a call to
    is_record/3 with a huge positive tuple size. The call
    is_record(A, a, 0) would crash the compiler when used in a
    function body. When used in a guard the compiler would emit
    incorrect code that would accept {a&gt; as a record.
  * stdlib: Fix bug in ets:tab2file that could make it fail if
    another Erlang process created the same file at the same time.
  * stdlib: An {else_clause,Value} exception will now be reported
    nicely in the shell.
  * stdlib: Correct return value for error case, so that it matches
    the documented and intended return value {error,
    {already_started, pid()} when local registered names are used.
  * stdlib: sys:get_state/1,2 and sys:replace_state/2,3 has been
    corrected to handle a state named error as a state name, not as
    a failed system callback. For the standard server behaviours
    this was an issue only for gen_statem (and gen_fsm) when the
    state name was error, and for gen_server if the complete state
    was {error,_}.
  * stdlib: Multiple problems were fixed in
    filelib:safe_relative_path/2. If its second argument was a path
    that contained symbolic links, an incorrect result patch could
    be returned. Also, paths were sometimes falsely considered
    unsafe.
  * stdlib: Fix deadlock when erl.exe is used as part of a pipe on
    Windows and trying to set the encoding of the standard_io
    device.
  * stdlib: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * stdlib: Fix h/2,3 to properly render multi-clause
    documentation.
  * stdlib: Timers created by timer:apply_after/4,
    apply_interval/4, and apply_repeatedly/4 would silently fail to
    do the apply if it was not possible to spawn a process when the
    timer expired. This has now been corrected, and if the spawn
    fails, the system will be taken down producing a crash dump.
  * stdlib: When an Erlang source file lacked a module definition,
    there would be a spurious "module name must not be empty"
    diagnostic for each spec in the file.
  * stdlib: The argument descriptions for option types in argparse
    have been made less ambiguous.
  * stdlib: Clarified the documentation of normal shutdown reason
    on gen_server:call/2,3
  * stdlib: Pattern matching and equivalence (=:=, =/=) comparisons
    on 0.0 will now raise a warning, as it will no longer be
    considered equivalent to -0.0 in OTP 27. If a match on 0.0
    specifically is desired (distinct from -0.0), the warning can
    be suppressed by writing +0.0 instead. The arithmetic
    comparison operators are unaffected, including arithmetic
    equality (==). *** POTENTIAL INCOMPATIBILITY ***
  * stdlib: The semantics of the gen_{server,statem,event}
    behaviour's synchronous start behaviour introduced in OTP-26.0
    with OTP-18471, has been clarified in the documentation.
  * stdlib: Added functionality to set a custom multiline prompt.
  * stdlib: A warning for (accidental use of) Triple-Quoted Strings
    has been implemented as per EEP 64. *** POTENTIAL
    INCOMPATIBILITY ***
  * stdlib: The keyboard shortcuts for the shell are now
    configurable.
  * kernel: Fixed an issue with truncated crash slogans on failed
    emulator start.
  * kernel: Fix shell:start_interactive function specification.
  * kernel: Fix code:get_doc/1 to return missing, when it can't
    find erts instead of crashing.
  * kernel: Function socket:close/1 could cause a VM crash on
    Windows.
  * kernel: Fix deadlock when erl.exe is used as part of a pipe on
    Windows and trying to set the encoding of the standard_io
    device.
  * kernel: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * kernel: Fix logger's overload protection mechanism to only
    fetch memory used by messages when needed.
  * kernel: Fixed a number of socket-related issues causing
    incompatibilities with gen_tcp and gen_udp respectively.
  * kernel: gen_tcp:connect with socket address and socket (inet-)
    backend fails because of missing callback function.
  * kernel: The DNS RR cache used by `inet_res` has been fixed to
    preserve insert order, which is beneficial when the DNS server
    returns RRs in some specific order for e.g load balancing
    purposes.
  * kernel: The options `reuseport`, `reuseport_lb` and
    `exclusiveaddruse` were accidentally not allowed for e.g
    `gen_udp:open/1,2`, which has now been corrected.
  * kernel: gen_udp:recv/* for Unix Domain Socket in binary mode
    and passive mode has been fixed to not crash.
  * kernel: Fixed issue where cursor would not be placed at the end
    of the expression when navigating shell history.
  * kernel: Update gen_tcp_socket and gen_udp_socket to handle
    'completion' (socket on Windows).
  * kernel: Add support for Unix Domain Sockets (only for STREAM
    sockets) on Windows for 'socket'.
  * kernel: Add basic support for socket ioctl on Windows.
  * kernel: The file:location/0 type is now exported.
  * kernel: Add support for (Windows) socket option
    exclusiveaddruse.
  * kernel: [socket] Add support for the 'nopush' option.
  * kernel: Add support for socket option 'BSP STATE'.
  * kernel: Add tcp socket options 'keepcnt', 'keepidle' and
    'keepintvl'.
  * kernel: Add support for misc (Windows) socket options
    ('max_msg_size' and 'maxdg').
  * kernel: The keyboard shortcuts for the shell are now
    configurable.
  * kernel: Optimized code_server to reduce repeated work when
    loading the same module concurrently.
  * debugger: The call int:no_break(Module) did not remove any
    breakpoints.
  * debugger: The maybe expression is now supported in the
    Debugger.
  * debugger: The maybe expression is now supported in the
    Debugger.
  * debugger: The call int:no_break(Module) did not remove any
    breakpoints.
  * ssl: Avoid function clause error in ssl:getopts/2 by handling
    that inet:getopts may return an empty list during some
    circumstances, such as the socket being in a closing state.
  * ssl: The API function `ssl:recv/3` has been tightened to
    disallow negative length, which has never been documented to
    work, but was passed through and caused strange errors.
  * ssl: When a client initiated renegotiation was rejected and the
    client socket was in active mode the expected error message to
    the controlling process was not sent.
  * ssl: Add some guidance for signature algorithms configuration
    in ssl applications users guide.
  * snmp: Make snmp handle gen_udp with socket backend on Windows
    (completion).
  * public_key: Country name comparison shall be case insensitive
  * public_key: Add check to disallow duplicate certs in a path
  * inets: With this change, re_write httpd works as expected and
    does not return error.
  * inets: Fixed a bug so httpd does not crash when stopped at the
    wrong time during TLS connection negotiation, or any other
    theoretically as slow connection setup.
  * inets: Enhance error handling and avoid that the HTTP client
    hangs on headers provided on the wrong format.
  * inets: With this change, error report generated by httpd during
    connection setup contains socket type information.
  * inets: Stop and restart of the httpd server in the Inets
    application has been refactored to a more synchronous and OTP
    supervisor friendly approach. This should increase stability
    and for example avoid a supervisor report from
    httpd_connection_sup about killed child process(es) in some
    cases when stopping or restarting httpd.
  * dialyzer: Fixed a bug that caused dialyzer to crash when
    analyzing bogus code that contained the literal atom undefined
    in segment sizes.
  * dialyzer: Dialyzer could crash when attempting to analyze a
    module that defined a type called product/.
- Changes for 26.0.2:
  * erts: Fix using the IME (Input Method Editor) to enter text in
    cmd.exe and powershell.exe on Windows.
  * erts: Multiple socket:accept calls issue. When making multiple
    accept calls, only the last call is active.
  * erts: Fix the shell to ignore terminal delay when the terminal
    capabilities report that they should be used.
  * erts: Fix "oldshell" to echo characters while typing on
    Windows.
  * erts: On Windows, a call to the function socket:close, when
    there are waiting active calls to read, write or accept
    functions, could hang.
  * erts: Fix issues when reading or configuring standard_io on
    Windows when erl.exe is started using -noshell flag.
  * erts: The following functions are now much faster when given a
    long list or binary:
  * erts: On AArch64 (ARM64), equality and non-equality tests with
    literal bitstrings could succeed when they should fail and vice
    versa.
  * compiler: Fixed a type handling bug that would cause an
    internal consistence failure for correct code.
  * compiler: Fixed a bug that could cause the stack trace of throw
    exceptions to be erroneously optimized out.
  * compiler: Complex guard expression using 'or' were not always
    fully evaluated, making guards that were supposed to fail
    succeed.
  * stdlib: Fix bug where when you entered Alt+Enter in the
    terminal, the cursor would move to the last line, instead of
    moving to the next line.
  * stdlib: Fix eof handling when reading from stdin when erlang is
    started using -noshell.
  * stdlib: Fixed problem where output would disappear if it was
    received after a prompt was written in the shell.
  * stdlib: The following functions are now much faster when given
    a long list or binary:
  * kernel: Fix bug where when you entered Alt+Enter in the
    terminal, the cursor would move to the last line, instead of
    moving to the next line.
  * kernel: Fix so that the shell does not crash on startup when
    termcap is not available.
  * kernel: Multiple socket:accept calls issue. When making
    multiple accept calls, only the last call is active.
  * kernel: Fix the shell to ignore terminal delay when the
    terminal capabilities report that they should be used.
  * kernel: Fix "oldshell" to echo characters while typing on
    Windows.
  * kernel: Fix eof handling when reading from stdin when erlang is
    started using -noshell.
  * kernel: On Windows, a call to the function socket:close, when
    there are waiting active calls to read, write or accept
    functions, could hang.
  * kernel: Fix issues when reading or configuring standard_io on
    Windows when erl.exe is started using -noshell flag.
  * kernel: gen_udp:connect with inet_backend = socket fails when
    the Address is a hostname (string or atom).
  * kernel: Fixed problem which would cause shell to crash if
    particular escape sequence was written to stdout.
  * kernel: Fixed problem where output would disappear if it was
    received after a prompt was written in the shell.
  * kernel: Fix a crash where the location of erts could not be
    found in rebar3 dev builds.
  * kernel: Introduce the KERNEL application parameter
    standard_io_encoding that can be used to set the default
    encoding for standard_io. This option needs to be set to latin1
    if the application wants to treat all input data as bytes
    rather than utf-8 encoded characters.
  * ssl: Added keylog information to all protocol versions in
    ssl:connection_information/2.
  * ssl: Add RFC-6083 considerations for DTLS to enable gen_sctp
    based callback for the transport.
  * ssh: Added multiline editing support to ssh clients connected
    through OTP ssh daemon.</changelog>
  <changelog author="sflees@suse.de" date="1704974400">- Changes for 26.2.1:
  * erts: Removed unnecessary PCRE source tar-ball.
  * ssh: With this change (being response to CVE-2023-48795),
    ssh can negotiate "strict KEX" OpenSSH extension with
    peers supporting it; also
    'chacha20-poly1305@openssh.com' algorithm becomes a
    less preferred cipher.
    If strict KEX availability cannot be ensured on both
    connection sides, affected encryption modes(CHACHA and
    CBC) can be disabled with standard ssh configuration.
    This will provide protection against vulnerability, but
    at a cost of affecting interoperability. See
    Configuring algorithms in SSH. (bsc#1218192, CVE-2023-48795)
- Changes for 26.2:
  * all: Replaced unintentional Erlang Public License 1.1
    headers in some files with the intended Apache License
    2.0 header.
  * otp: The removal of the deprecated slave module, originally
    planned for OTP 27, has been postponed to OTP 29.
  * asn1: Fix benign warning from gcc 11 about mismatching call
    to free().
  * crypto: Enable engine support for OpenSSL versions 3.
  * edoc: Emit &lt;code&gt; instead of &lt;tt&gt;.
- Disable test suite for now, it has many false positives and
  takes a very long time.</changelog>
  <changelog author="sflees@suse.de" date="1706011200">- This codestream wasn't affected by bsc#1207113</changelog>
  <changelog author="sflees@suse.de" date="1706011201">- Disable rpmlint tests on SLE-15 where they currently fail</changelog>
  <changelog author="sflees@suse.de" date="1715947200">- Create a versioned package for SLES</changelog>
</package>
<package pkgid="d0c5968d54220c01291836c6cfc82a03285de9063ab4ae3591988685f8006940" name="erlang26-debugger-src" arch="aarch64">
  <version epoch="0" ver="26.2.1" rel="150300.7.5.1"/>
  <changelog author="matwey.kornilov@gmail.com" date="1646568000">- Changes for 24.2.2:
  * inets: Avoid intermediate ungraceful shutdown of the HTTP
    server.
  * ssh: The ssh sever parallel_login option was missing in OTP-24</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1648382400">- Changes for 24.3.2:
  * erl_interface: Fix compile error regarding gethostbyaddr_r on
    Android. Error introduced in OTP 24.3.
  * kernel: Fix failed accepted connection setup after previous
    established connection from same node closed down silently.
  * kernel: Fixed a problem where typing Ctrl-R in the shell could
    hang if there were some problem with the history log file.
- Changes for 24.3.1:
  * dialyzer: There could be spurious warnings for unknown types
    when a type was a subtype of an existing type that was a
    subtype of an unknown type.
  * ssl: Client certification could fail for TLS-1.3 servers that
    did not include the certificat_authorties extension in its
    certificate request message.
- Changes for 24.3:
  * megaco: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.
  * megaco: Update the performance and debug chapters of the megaco
    user's guide. Also some updates to the meas tools.
  * compiler: The expression &lt;&lt;0/native-float&gt;&gt;=Bin would always
    fail to match, while &lt;&lt;0/float-native&gt;&gt;=Bin would match
    (provided that Bin contained the binary representation of 0.0)
  * compiler: The compiler will now compile huge functions with
    straight-line code faster.
  * erl_interface: Add --enable-ei-dynamic-lib configure option
    that will make erl_interface also release a dynamic library
    version of libei.
  * erl_interface: The ei API for decoding/encoding terms is not
    fully 64-bit compatible since terms that have a representation
    on the external term format larger than 2 GB cannot be handled.
  * sasl: Fix bug in systools:make_script/1 documentation.
  * inets: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.
  * inets: Documentation fix for inets:services_info/0, which now
    describes that Info might be a Reason term() in case when
    {error, Reason} is returned as service info.
  * crypto: The crypto app in OTP can since OTP-24.2 be compiled,
    linked and used with the new OpenSSL 3.0 cryptolib. The crypto
    app has 3.0 support has been improved, but is still *not
    recommended* for other usages than experiments and alpha
    testing. There are not yet any guaranties that it works, not
    even together with other OTP applications like for example SSL
    and SSH, although there are no known errors. Since the previous
    release, OTP-24.2, the following improvements have been done: -
    It has been tested during nearly every nightly test on the OTP
    lab - The hash algorithms md4 and ripemd160 have been enabled
    with OpenSSL 3.0. - The ciphers blowfish_cbc, blowfish_ecb,
    des_cbc, des_cfb, des_ecb, rc2_cbc and rc4 have been enabled
    with OpenSSL 3.0. Disabled or unsupported with OpenSSL 3.0 are
    still: - ENGINE support - FIPS mode - Other providers than the
    built-in ones - Compiling and linking with OpenSSL 3.0
    cryptolib in compatibility modes (for example to behave as
    1.1.1) and, the ciphers blowfish_cfb64 and blowfish_ofb64 are
    not supported and will not be either. Deprecated functions in
    the OpenSSL 3.0 cryptolib must not be disabled as OTP/crypto
    still uses some of the deprecated API functions. The gcc flag
  - Wno-deprecated-declarations is set to prevent deprecation
    warnings to be printed when compiling.
  * crypto: Crypto is adapted to LibreSSL 3.5.0 on OpenBSD.
  * crypto: New configure option ( --disable-otp-test-engine) to
    prohibit the build of the OTP test engine used in some test
    suites. The reason is that the test engine could be hard to
    compile on for instance LibreSSL 3.5.0. For that particular
    cryptolib version (or higher), this configure option is set
    automatically.
  * jinterface: Fix bug in OtpOutputStream.write_pid/4 and
    write_ref/3 causing faulty encodig. Bug exists since OTP 23.0.
  * wx: Removed the static_data option from wxImage creation
    functions, as it was broken and could lead to crashes. Now
    image data is always copied to wxWidgets as was the default
    behavior. Removed some non working wxGridEvent event types,
    which have there own events in newer wxWidgets versions, and
    added a couple of event types that where missing in wx.
  * asn1: Add support for the maps option in combination with the
    jer backend.
  * snmp: The compilation time is no longer recorded in BEAM files.
    There remained several undocumented functions that attempted to
    retrieve compilation times. Those have now been removed.
  * snmp: [agent] Remove expectation of socket being a port.
  * common_test: OTP internal test fix.
  * runtime_tools: Fixed bug in scheduler:utilization(Seconds) that
    would leave the scheduler_wall_time system flag incorrectly
    enabled.
  * runtime_tools: Add scheduler:get_sample/0 and get_sample_all/0.
    Also clarify scheduler module documentation about how it
    depends on system flag scheduler_wall_time.
  * erts: Fixed a bug in the x86 JIT that might cause floating
    point instructions to wrongly throw an exception.
  * erts: Preserve correct nodedown_reason if supervised
    distribution controller processes exit with {shutdown, Reason}.
  * erts: Handling of send_timeout for gen_tcp has been corrected
    so that the timeout is honored also when sending 0 bytes.
  * erts: By default global does not take any actions to restore a
    fully connected network when connections are lost due to
    network issues. This is problematic for all applications
    expecting a fully connected network to be provided, such as for
    example mnesia, but also for global itself. A network of
    overlapping partitions might cause the internal state of global
    to become inconsistent. Such an inconsistency can remain even
    after such partitions have been brought together to form a
    fully connected network again. The effect on other applications
    that expects that a fully connected network is maintained may
    vary, but they might misbehave in very subtle hard to detect
    ways during such a partitioning. In order to prevent such
    issues, we have introduced a prevent overlapping partitions fix
    which can be enabled using the prevent_overlapping_partitions
    kernel(6) parameter. When this fix has been enabled, global
    will actively disconnect from nodes that reports that they have
    lost connections to other nodes. This will cause fully
    connected partitions to form instead of leaving the network in
    a state with overlapping partitions. Note that this fix has to
    be enabled on all nodes in the network in order to work
    properly. Since this quite substantially changes the behavior,
    this fix is currently disabled by default. Since you might get
    hard to detect issues without this fix you are, however,
    strongly advised to enable this fix in order to avoid issues
    such as the ones described above. As of OTP 25 this fix will
    become enabled by default.
  * erts: Corrected the type specification of erlang:seq_trace/2.
  * erts: Fix memory leak when tracing on running on a process that
    only handle system tasks or non-message signals (for example
    process_info requests).
  * erts: Add support for using socket:sockaddr_in() and
    socket:sockaddr_in6() when using gen_sctp, gen_tcp and gen_udp.
    This will make it possible to use Link Local IPv6 addresses.
  * erts: Show on_load failure reasons in embedded mode.
  * erts: Compile date saved in the Erlang VM executable has been
    removed.
  * erts: Improve documentation for the dynamic node name feature.
  * ssh: Fix makefile dependency bugs.
  * ssh: Fixed faulty OpenSSH decoding of Ed25519/Ed448 keys in the
    OpenSSH format openssh_key_v1.
  * ssh: Correction of ssh_file typing, specially for the
    experimental openssh-key-v1 encoding.
  * ssh: Improper tag for private ED keys when encoding with
    ssh:encode/2. The tuple had ed_priv as first element, but
    should have had ed_pri. This is now corrected. *** POTENTIAL
    INCOMPATIBILITY ***
  * ssh: Add support for Ed25519/Ed448 SSH host keys in the RFC
    4716 format ("-----BEGIN EC PRIVATE KEY-----") generated by for
    example openssl or via Erlang functions (i.e.
    public_key:generate_key({namedCurve, ed25519})). Ed25519 SSH
    host keys generated by ssh-keygen was, and are still,
    supported.
  * kernel: Handling of send_timeout for gen_tcp has been corrected
    so that the timeout is honored also when sending 0 bytes.
  * kernel: By default global does not take any actions to restore
    a fully connected network when connections are lost due to
    network issues. This is problematic for all applications
    expecting a fully connected network to be provided, such as for
    example mnesia, but also for global itself. A network of
    overlapping partitions might cause the internal state of global
    to become inconsistent. Such an inconsistency can remain even
    after such partitions have been brought together to form a
    fully connected network again. The effect on other applications
    that expects that a fully connected network is maintained may
    vary, but they might misbehave in very subtle hard to detect
    ways during such a partitioning. In order to prevent such
    issues, we have introduced a prevent overlapping partitions fix
    which can be enabled using the prevent_overlapping_partitions
    kernel(6) parameter. When this fix has been enabled, global
    will actively disconnect from nodes that reports that they have
    lost connections to other nodes. This will cause fully
    connected partitions to form instead of leaving the network in
    a state with overlapping partitions. Note that this fix has to
    be enabled on all nodes in the network in order to work
    properly. Since this quite substantially changes the behavior,
    this fix is currently disabled by default. Since you might get
    hard to detect issues without this fix you are, however,
    strongly advised to enable this fix in order to avoid issues
    such as the ones described above. As of OTP 25 this fix will
    become enabled by default.
  * kernel: Fix bug where logger would crash when logging a report
    including improper lists.
  * kernel: Make erlang:set_cookie work for dynamic node names.
  * kernel: Add support for using socket:sockaddr_in() and
    socket:sockaddr_in6() when using gen_sctp, gen_tcp and gen_udp.
    This will make it possible to use Link Local IPv6 addresses.
  * kernel: A net_tickintensity kernel parameter has been
    introduced. It can be used to control the amount of ticks
    during a net_ticktime period. A new net_kernel:start/2 function
    has also been introduced in order to make it easier to add new
    options. The use of net_kernel:start/1 has been deprecated.
  * kernel: Improve documentation for the dynamic node name
    feature.
  * erl_docgen: Fix css for large tables and images on small
    screens
  * erl_docgen: Fix bug with codeinclude tag that caused it to not
    include the code if used in a correct, but unexpected way.
  * observer: Calculate the display width in etop, instead of hard-
    coding it to 89 characters.
  * debugger: Fix record index matching, it was broken and could
    never match.
  * ssl: Improved error handling.
  * ssl: Before this change, net_kernel used with TLS distribution
    might be leaking processes in case of connectivity issues.
  * ssl: Fix makefile dependency bugs.
  * ssl: Make sure the TLS sender process handles explicit calls to
    erlang:disconnect_node properly, avoiding potential hanging
    problems in net_kernel.
  * ssl: Add support for TLS-1.3 certificate_authorities extension.
    And process certificate_authorities field in pre-TLS-1.3
    certificate requests.
  * ssl: Support password fun for protected keyfiles in ssl:connect
    function.
  * ssl: Add in some cases earlier detection of possible DoS
    attacks by malicious clients sending unexpected TLS messages
    instead of the client hello. Note that such attacks are already
    mitigated by providing a timeout for the TLS handshake.
  * eldap: Fix eldap extensibleMatch dnAttributes option. According
    to the ldap ASN1 the dnAttributes should be a bool, instead it
    was generated as a string.
  * eldap: Implemented paged searches according to https://www.rfc-
    editor.org/rfc/rfc2696.txt
  * public_key: Support password fun for protected keyfiles in
    ssl:connect function.
  * stdlib: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.
  * mnesia: Reduce the number of locks taken during table copying,
    should reduce the startup time on large systems.
  * diameter: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1649246400">- Fix build for Factory. Currently, any Java version
  is fine for Erlang.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1653220800">- Version 25.0:
  - stdlib
  * New function filelib:ensure_path/1 will ensure that all
    directories for the given path exists
  * New functions groups_from_list/2 and groups_from_list/3 in
    the maps module
  * New functions uniq/1 uniq/2 in the lists module
  * New PRNG added to the rand module, for fast pseudo-random
    numers.
  - compiler, kernel, stdlib, syntax_tools:
  * Added support for selectable features as described in EEP-60.
    Features can be enabled/disabled during compilation with
    options (ordinary and +term) to erlc as well as with
    directives in the file. Similar options can be used to erl
    for enabling/disabling features allowed at runtime. The new
    maybe expression EEP-49 is fully supported as the feature
    maybe_expr.
  - erts &amp; JIT:
  * The JIT now works for 64-bit ARM processors.
  * The JIT now does type-based optimizations based on type
    information in the BEAM files.
  * Improved the JIT’s support for external tools like perf and
    gdb, allowing them to show line numbers and even the original
    Erlang source code when that can be found.
  - erts, stdlib, kernel:
  * Users can now configure ETS tables with the
    {write_concurrency, auto} option. This option forces tables
    to automatically change the number of locks that are used at
    run-time depending on how much concurrency is detected. The
    {decentralized_counters, true} option is enabled by default
    when {write_concurrency, auto} is active.
  * Benchmark results comparing this option with the other ETS
    optimization options are available here: benchmarks.
  * To enable more optimizations, BEAM files compiled with OTP 21
    and earlier cannot be loaded in OTP 25.
  * The signal queue of a process with the process flag
    message_queue_data=off_heap has been optimized to allow
    parallel reception of signals from multiple processes. This
    can improve performance when many processes are sending in
    parallel to one process. See benchmark.
  * The Erlang installation directory is now relocatable on the
    file system given that the paths in the installation’s
    RELEASES file are paths that are relative to the
    installations root directory.
  * A new option called short has been added to the functions
    erlang:float_to_list/2 and erlang:float_to_binary/2. This
    option creates the shortest correctly rounded string
    representation of the given float that can be converted back
    to the same float again.
  * Introduction of quote/1 and unquote/1 functions in the
    uri_string module - a replacement for the deprecated
    functions http_uri:encode and http_uri:decode.
  * The new module peer supersedes the slave module. The slave
    module is now deprecated and will be removed in OTP 27.
  * global will now by default prevent overlapping partitions due
    to network issues. This is done by actively disconnecting
    from nodes that reports that they have lost connections to
    other nodes. This will cause fully connected partitions to
    form instead of leaving the network in a state with
    overlapping partitions.
  * It is possible to turn off the new behavior by setting the
    the kernel configuration parameter
    prevent_overlapping_partitions to false. Doing this will
    retain the same behavior as in OTP 24 and earlier.
  * The format_status/2 callback for gen_server, gen_statem and
    gen_event has been deprecated in favor of the new
    format_status/1 callback.
  * The new callback adds the possibility to limit and change
    many more things than the just the state.
  * The timer module has been modernized and made more efficient,
    which makes the timer server less susceptible to being
    overloaded. The timer:sleep/1 function now accepts an
    arbitrarily large integer.
  - compiler:
  * The maybe ... end construction as proposed in EEP-49 has been
    implemented. It can simplify complex code where otherwise
    deeply nested cases would have to be used.
  * To enable maybe, give the option {enable_feature,maybe_expr}
    to the compiler. The exact option to use will change in a
    coming release candidate and then it will also be possible to
    use from inside the module being compiled.
  * When a record matching or record update fails, a {badrecord,
    ExpectedRecordTag} exception used to be raised. In this
    release, the exception has been changed to {badrecord,
    ActualValue}, where ActualValue is the value that was found
    instead of the expected record.
  * Add compile attribute -nifs() to empower compiler and loader
    with information about which functions may be overridden as
    NIFs by erlang:load_nif/2.
  * Improved and more detailed error messages when binary
    construction with the binary syntax fails. This applies both
    for error messages in the shell and for
    erl_error:format_exception/3,4.
  * Change format of feature options and directives for better
    consistency. Options to erlc and the -compile(..) directive
    now has the format {feature, feature-name, enable | disable}.
    The -feature(..) now has the format -feature(feature-name,
    enable | disable).
  - crypto:
  * Add crypto:hash_equals/2 which is a constant time comparision
    of hashvalues.
  - ssl:
  * Introducing a new (still experimental) option
    {certs_keys,[cert_key_conf()]}. With this a list of a
    certificates with their associated key may be used to
    authenticate the client or the server. The certificate key
    pair that is considered best and matches negotiated
    parameters for the connection will be selected.
  - public_key:
  * Functions for retrieving OS provided CA-certs added.
  - dialyzer:
  * Optimize operations in the erl_types module. Parallelize the
    Dialyzer pass remote.
  * Added the missing_return and extra_return options to raise
    warnings when specifications differ from inferred types.
    These are similar to, but not quite as verbose as overspecs
    and underspecs.
  * Dialyzer now better understands the types for min/2, max/2,
    and erlang:raise/3. Because of that, Dialyzer can potentially
    generate new warnings. In particular, functions that use
    erlang:raise/3 could now need a spec with a no_return()
    return type to avoid an unwanted warning.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1656849600">- Changes for 25.0.2:
  * ssl: Improved handling of unexpected messages during the
    handshake, taking the right action for unexpected messages.
  * erts: On computers with the ARM64 (AArch64) architecture (such
    as Apple Silicon Macs) a rem expression followed by a div
    expression with the same operands could evaluate to the wrong
    result if the result of the rem expression was unused.
- Changes for 25.0.1:
  * ssl: When a TLS-1.3 enabled client tried to talk to a TLS-1.2
    server that coalesces TLS-1.2 handshake message over one TLS
    record, the connection could fail due to some message being
    handled in the wrong state, this has been fixed.
  * ssl: Correctly handles supported protocol version change from
    default to something else by sni_fun supplied to
    ssl:handshake/[2,3] together with a TCP-socket (so called
    upgrade).
  * ssl: Also, TLS-1.3 should respond with a protocol version alert
    if previous versions, that are supported but not configured,
    are attempted.
  * kernel: The DNS resolver inet_res has been fixed to ignore
    trailing dot difference in the request domain between the sent
    request and the received response, when validating a response.
  * kernel: A bug in inet_res has been fixed where a missing
    internal {ok,_} wrapper caused inet_res:resolve/* to return a
    calculated host name instead of an `{ok,Msg} tuple, when
    resolving an IP address or a host name that is an IP address
    string.
  * kernel: The erlang:is_alive() BIF could return true before
    configured distribution service was available. This bug was
    introduced in OTP 25.0 ERTS version 13.0. The
    erlang:monitor_node() and erlang:monitor() BIFs could
    erroneously fail even though configured distribution service
    was available. This occurred if these BIFs were called after
    the distribution had been started using dynamic node name
    assignment but before the name had been assigned.
  * kernel: Added the missing mandatory address/0 callback in the
    gen_tcp_dist example.
  * erts: A spawn_reply signal from a remote node could be delayed
    and be delivered after other signals from the newly spawned
    process. When this bug triggered, the connection to the node
    where the process was spawned sometimes could be taken down due
    to the bug. The following error message would then be logged if
    this happened: Missing 'spawn_reply' signal from the node
    &lt;RemoteNode&gt; detected by &lt;Pid&gt; on the node &lt;LocalNode&gt;. The
    node &lt;RemoteNode&gt; probably suffers from the bug with ticket id
    OTP-17737. This bug only affected processes which had enabled
    off_heap message_queue_data and parallel reception of signals
    had been automatically enabled. This bug was introduced in OTP
    25.0, ERTS version 13.0.
  * erts: Fixed type spec of erlang:system_info(dist_ctrl).
  * erts: The zlib built in to the runtime system has been updated
    to version 1.2.12. (Note that on most platforms, the platform's
    own zlib is used.)
  * erts: The erlang:is_alive() BIF could return true before
    configured distribution service was available. This bug was
    introduced in OTP 25.0 ERTS version 13.0. The
    erlang:monitor_node() and erlang:monitor() BIFs could
    erroneously fail even though configured distribution service
    was available. This occurred if these BIFs were called after
    the distribution had been started using dynamic node name
    assignment but before the name had been assigned.
  * crypto: Note in the documentation that MODP (rfc3526) groups
    and OpenSSL 3.0 can give an error if a call to
    crypto:generate_key/2 specifies a key length, and that length
    is to small.
  * crypto: The cmac now uses only the 3.0 API
  * crypto: Documentation is now updated with which OpenSSL
    cryptolib versions that OTP currently is tested.
  * dialyzer: Fixed the documentation for the missing_return and
    extra_return options.
  * mnesia: Fixed add_table_copy which could leave a table lock if
    the receiving node went down during the operation.
  * ssh: Binaries can be limited in logs with the parameter
    max_log_item_len. The default value is 500 bytes.
  * stdlib: In the initial release of Erlang/OTP 25, the expression
    bound to the _ pseudo-field in a record initialization would
    always be evaluated once, even if all other fields in the
    record were explicitly initialized. That would break the use
    case of binding the expression error(...) to _ in order to get
    an exception if not all fields were initialized. The behavior
    of binding to _ has been reverted to the pre-OTP 25 behavior,
    that is, to not evaluate the expression if all fields have been
    bound to explicit values.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1660046400">- Changes for 25.0.3:
  * erts: Distributed exit signals could be lost under the
    following conditions:
  * erts: A race could cause process_info(Pid, message_queue_len)
    on other processes to return invalid results.
  * erts: Fixed reduction counting for handling process system
    tasks.
  * erts: Priority elevation of terminating processes did not work
    which could cause execution of such processes to be delayed.
  * erts: An unlink operation made by a process that terminated
    before the unlink operation completed, i.e., before it had
    received an unlink-ack signal from the linked process, caused
    an exit signal to erroneously be sent from the terminating
    process to the process being unlinked. This exit signal would
    most often be ignored by the receiver, but if the receiver of
    the exit signal concurrently set up a new link, it could
    receive the exit signal with the actual exit reason of the
    terminating process instead of a noproc exit reason. It is
    however very hard to detect that this has happened and has no
    obvious negative consequences, so it should be considered
    harmless. A distributed unlink-ack signal received by a
    terminating process was also not properly removed which could
    cause a minor memory leak.
  * ssl: The link to crypto:engine_load refered the function with
    wrong arity.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1661601600">- Changes for 25.0.4:
  * kernel: A call to net_kernel:setopts(new, Opts) at the same
    time as a connection was being set up could cause a deadlock
    between the net_kernel process and the process setting up the
    connection.
  * erts: The monitor/3 BIF did not apply options to the created
    monitor if the target process or port did not exist. That is,
    the corresponding down message would get a `DOWN` tag even if a
    custom tag had been set, and the returned reference was not an
    alias even if the alias option had been passed.
  * erts: The erlang:monotonic_time/1, erlang:system_time/1,
    erlang:time_offset/1, and os:system_time/1 BIFs erroneously
    failed when passed the argument native.</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1665662400">- Changes for 25.1.1:
  * dialyzer: Dialyzer could crash when analyzing Elixir code that
    used intricate macros.
  * dialyzer: The --input_list_file option has been added.
  * ssl: Fixes handling of symlinks in cacertfile option.
  * eunit: With this change, eunit exact_execution option works
    with application primitive.
  * stdlib: peer nodes failed to halt when the process supervising
    the control connection crashed. When an alternative control
    connection was used, this supervision process also quite
    frequently crashed when the peer node was stopped by the node
    that started it which caused the peer node to linger without
    ever halting.
  * asn1: For the per and uper ASN.1 encoding rules, encoding and
    decoding the SEQUENCE OF and SET OF constructs with 16384 items
    or more is now supported.
  * erts: Listen sockets created with the socket module, leaked
    (erlang-) monitors.
  * erts: Notifications about available distribution data sent to
    distribution controller processes could be lost. Distribution
    controller processes can be used when implementing an
    alternative distribution carrier. The default distribution over
    tcp was not effected and the bug was also not present on
    x86/x86_64 platforms.
  * kernel: Listen sockets created with the socket module, leaked
    (erlang-) monitors.
  * kernel: peer nodes failed to halt when the process supervising
    the control connection crashed. When an alternative control
    connection was used, this supervision process also quite
    frequently crashed when the peer node was stopped by the node
    that started it which caused the peer node to linger without
    ever halting.
- Changes for 25.1:
  * dialyzer: Two bugs have been fixed in Dialyzer's checking of
    behaviors: When a mandatory callback function is present but
    not exported, Dialyzer would not complain about a missing
    callback. When an optional callback function was not exported
    and had incompatible arguments and/or the return values were
    incompatible, Dialyzer would complain. This has been changed to
    suppress the warning, because the function might not be
    intended to be a callback function, for instance if a release
    added a new optional callback function (such as format_status/1
    for the gen_server behaviour added in OTP 25).
  * dialyzer: The no_extra_return and no_missing_return warnings
    can now be suppressed through -dialyzer directives in source
    code.
  * jinterface: Fix javadoc build error by adding option -encoding
    UTF-8.
  * diameter: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * crypto: Fix configure with --with-ssl and --disable-dynamic-
    ssl-lib on Windows.
  * crypto: Remove all references correctly in the garbage
    collection if an engine handle was not explicit unloaded.
  * crypto: Changed the behaviour of the engine load/unload
    functions The engine load/unload functions have got changed
    semantics to get a more consistent behaviour and work correct
    when variables are garbage collected. The load functions now
    don't register the methods for the engine to replace. That will
    now be handled with the new functions
    engine_register/engine_unregister if needed. Some functions are
    removed from the documentation and therefor the API, but they
    are left in the code for compatibility. *** POTENTIAL
    INCOMPATIBILITY ***
  * crypto: Fixed a naming bug for AES-CFB and Blowfish-CFB/OFB
    when linked with OpenSSL 3.0 cryptolib.
  * crypto: Sign/verify does now behave as in OTP-24 and earlier
    for eddsa.
  * crypto: Pass elliptic curve names from crypto.erl to crypto's
    nif.
  * crypto: The configure option --disable-deprecated-warnings is
    removed. It was used for some releases when the support for
    OpenSSL 3.0 was not completed. It is not needed in OTP 25.
  * crypto: Crypto is now considered to be usable with the OpenSSL
    3.0 cryptolib for production code. ENGINE and FIPS are not yet
    fully functional.
  * crypto: Do not exit if the legacy provider is missing in
    libcrypto 3.0.
  * ssl: Reject unexpected application data in all relevant places
    for all TLS versions. Also, handle TLS-1.3 middlebox
    compatibility with more care. This will make malicious
    connections fail early and further, mitigate possible DoS
    attacks, that would be caught by the handshake timeout. Thanks
    to Aina Toky Rasoamanana and Olivier Levillain from Télécom
    SudParis for alerting us of the issues in our implementation.
  * ssl: With this change, value of cacertfile option will be
    adjusted before loading certs from the file. Adjustments
    include converting relative paths to absolute and converting
    symlinks to actual file path. Thanks to Marcus Johansson
  * ssl: In TLS-1.3, if chain certs are missing (so server auth
    domain adherence can not be determined) send peer cert and hope
    the server is able to recreate a chain in its auth domain.
  * ssl: Make sure periodical refresh of CA certificate files
    repopulates cache properly.
  * ssl: Correct internal CRL cache functions to use internal
    format consistently.
  * ssl: Incorrect handling of client middlebox negotiation for
    TLS-1.3 could result in that a TLS-1.3 server would not use
    middlebox mode although the client was expecting it too and
    failing the negotiation with unexpected message.
  * ssl: If the "User" process, the process starting the TLS
    connection, gets killed in the middle of spawning the dynamic
    connection tree make sure we do not leave any processes behind.
  * ssl: A vulnerability has been discovered and corrected. It is
    registered as CVE-2022-37026 "Client Authentication Bypass".
    Corrections have been released on the supported tracks with
    patches 23.3.4.15, 24.3.4.2, and 25.0.2. The vulnerability
    might also exist in older OTP versions. We recommend that
    impacted users upgrade to one of these versions or later on the
    respective tracks. OTP 25.1 would be an even better choice.
    Impacted are those who are running an ssl/tls/dtls server using
    the ssl application either directly or indirectly via other
    applications. For example via inets (httpd), cowboy, etc. Note
    that the vulnerability only affects servers that request client
    certification, that is sets the option {verify, verify_peer}.
    (bsc#1205318)
  * eunit: With this change, Eunit can optionally not try to
    execute related module with "_tests" suffix. This might be used
    for avoiding duplicated executions when source and test modules
    are located in the same folder.
  * erl_docgen: Update DTD to allow XML tag em under pre.
  * inets: Add httpc:ssl_verify_host_options/1 to help setting
    default ssl options for the https client.
  * inets: This change fixes dialyzer warnings generated for
    inets/httpd examples (includes needed adjustment of spec for
    ssh_sftp module).
  * inets: Remove documentation of no longer supported callback.
  * stdlib: Fixed inconsistency bugs in global due to
    nodeup/nodedown messages not being delivered before/after
    traffic over connections. Also fixed various other
    inconsistency bugs and deadlocks in both global_group and
    global. As building blocks for these fixes, a new BIF
    erlang:nodes/2 has been introduced and
    net_kernel:monitor_nodes/2 has been extended. The -hidden and
  - connect_all command line arguments did not work if multiple
    instances were present on the command line which has been
    fixed. The new kernel parameter connect_all has also been
    introduced in order to replace the -connect_all command line
    argument.
  * stdlib: Fix the public_key:ssh* functions to be listed under
    the correct release in the Removed Functionality User's Guide.
  * stdlib: The type spec for format_status/1 in gen_statem,
    gen_server and gen_event has been corrected to state that the
    return value is of the same type as the argument (instead of
    the same value as the argument).
  * stdlib: If the timer server child spec was already present in
    kernel_sup but it was not started, the timer server would fail
    to start with an {error, already_present} error instead of
    restarting the server.
  * stdlib: When changing callback module in gen_statem the
    state_enter calls flag from the old module was used in for the
    first event in the new module, which could confuse the new
    module and cause malfunction. This bug has been corrected. With
    this change some sys debug message formats have been modified,
    which can be a problem for debug code relying on the format.
  * ** POTENTIAL INCOMPATIBILITY ***
  * stdlib: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * stdlib: The rfc339_to_system_time/1,2 functions now allows the
    minutes part to be omitted from the time zone.
  * stdlib: The receive statement in gen_event has been optimized
    to not use selective receive (which was never needed, and could
    cause severe performance degradation under heavy load).
  * stdlib: Add new API function erl_features:configurable/0
  * parsetools: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * public_key: Support more Linux distributions in cacerts_load/0.
  * public_key: Correct asn1 typenames available in type
    pki_asn1_type()
  * public_key: Sign/verify does now behave as in OTP-24 and
    earlier for eddsa.
  * snmp: Improved the get-bulk response max size calculation. Its
    now possible to configure 'empty pdu size', see appendix c for
    more info.
  * snmp: Fix various example dialyzer issues
  * ssh: Handling rare race condition at channel close.
  * ssh: New ssh option no_auth_needed to skip the ssh
    authentication. Use with caution!
  * ssh: This change fixes dialyzer warnings generated for
    inets/httpd examples (includes needed adjustment of spec for
    ssh_sftp module).
  * ssh: The new function ssh:daemon_replace_options/2 makes it
    possible to change the Options in a running SSH server.
    Established connections are not affected, only those created
    after the call to this new function.
  * ssh: Add a timeout as option max_initial_idle_time. It closes a
    connection that does not allocate a channel within the timeout
    time. For more information about timeouts, see the Timeouts
    section in the User's Guide Hardening chapter.
  * observer: Fixed units in gui.
  * xmerl: There is a new configure option, --enable-deterministic-
    build, which will apply the deterministic compiler option when
    building Erlang/OTP. The deterministic option has been improved
    to eliminate more sources of non-determinism in several
    applications.
  * asn1: There is a new configure option, --enable-deterministic-
    build, which will apply the deterministic compiler option when
    building Erlang/OTP. The deterministic option has been improved
    to eliminate more sources of non-determinism in several
    applications.
  * erts: Fixed inconsistency bugs in global due to nodeup/nodedown
    messages not being delivered before/after traffic over
    connections. Also fixed various other inconsistency bugs and
    deadlocks in both global_group and global. As building blocks
    for these fixes, a new BIF erlang:nodes/2 has been introduced
    and net_kernel:monitor_nodes/2 has been extended. The -hidden
    and -connect_all command line arguments did not work if
    multiple instances were present on the command line which has
    been fixed. The new kernel parameter connect_all has also been
    introduced in order to replace the -connect_all command line
    argument.
  * erts: Fixed IPv6 multicast_if and membership socket options.
  * erts: Accept funs (NEW_FUN_EXT) with incorrectly encoded size
    field. This is a workaround for a bug (OTP-18104) existing in
    OTP 23 and 24 that could cause incorrect size fields in certain
    cases. The emulator does not use the decoded size field, but
    erl_interface still does and is not helped by this workaround.
  * erts: Fixed issue with inet:getifaddrs hanging on pure IPv6
    Windows
  * erts: Fix faulty distribution encoding of terms with either The
    symptom could be failed decoding on the receiving side leading
    to aborted connection. Fix OTP-18093 is a workaround for theses
    bugs that makes the VM accepts such faulty encoded funs. The
    first encoding bug toward pending connection exists only in OTP
    23 and 24, but the second one exists also on OTP 25.
  * erts: Fixed emulator crash that could happen during crashdump
    generation of ETS tables with options ordered_set and
    {write_concurrency,true}.
  * erts: Retrieval of monotonic and system clock resolution on
    MacOS could cause a crash and/or erroneous results.
  * erts: Fix bug where the max allowed size of erl +hmax was lower
    than what was allowed by process_flag.
  * erts: On computers with ARM64 (AArch64) processors, the JIT
    could generate incorrect code when more than 4095 bits were
    skipped at the tail end of a binary match.
  * erts: In rare circumstances, an is_binary/1 guard test could
    succeed when given a large integer.
  * erts: Fix bug causing ets:info (and sometimes ets:whereis) to
    return 'undefined' for an existing table if a concurrent
    process were doing ets:insert with a long list on the same
    table.
  * erts: Fix writing and reading of more than 2 GB in a single
    read/write operation on macOS. Before this fix attempting to
    read/write more than 2GB would result in {error,einval}.
  * erts: Fix bug sometimes causing emulator crash at node shutdown
    when there are pending connections. Only seen when running duel
    distribution protocols, inet_drv and inet_tls_dist.
  * erts: Yield when adjusting large process message queues due to
    The message queue adjustment work will now be interleaved with
    all other types of work that processes have to do, even other
    message queue adjustment work.
  * erts: Add rudimentary debug feature (option) for the inet-
    driver based sockets, such as gen_tcp and gen_udp.
  * erts: Introduced the hidden and dist_listen options to
    net_kernel:start/2. Also documented the -dist_listen command
    line argument which was erroneously documented as a kernel
    parameter and not as a command line argument.
  * erts: New documentation chapter "Debugging NIFs and Port
    Drivers" under Interoperability Tutorial.
  * erts: Add new API function erl_features:configurable/0
  * kernel: Fixed inconsistency bugs in global due to
    nodeup/nodedown messages not being delivered before/after
    traffic over connections. Also fixed various other
    inconsistency bugs and deadlocks in both global_group and
    global. As building blocks for these fixes, a new BIF
    erlang:nodes/2 has been introduced and
    net_kernel:monitor_nodes/2 has been extended. The -hidden and
  - connect_all command line arguments did not work if multiple
    instances were present on the command line which has been
    fixed. The new kernel parameter connect_all has also been
    introduced in order to replace the -connect_all command line
    argument.
  * kernel: Fixed IPv6 multicast_if and membership socket options.
  * kernel: Fixed issue with inet:getifaddrs hanging on pure IPv6
    Windows
  * kernel: The type specifications for inet:getopts/2 and
    inet:setopts/2 have been corrected regarding SCTP options.
  * kernel: The type specifications for inet:parse_* have been
    tightened.
  * kernel: Fix gen_tcp:connect/3 spec to include the inet_backend
    option.
  * kernel: Fix bug where using a binary as the format when calling
    logger:log(Level, Format, Args) (or any other logging function)
    would cause a crash or incorrect logging.
  * kernel: Add rudimentary debug feature (option) for the inet-
    driver based sockets, such as gen_tcp and gen_udp.
  * kernel: Introduced the hidden and dist_listen options to
    net_kernel:start/2. Also documented the -dist_listen command
    line argument which was erroneously documented as a kernel
    parameter and not as a command line argument.
  * kernel: Scope and group monitoring have been introduced in pg.
    For more information see the documentation of
    pg:monitor_scope(), pg:monitor(), and pg:demonitor().
  * kernel: A new function global:disconnect/0 has been introduced
    with which one can cleanly disconnect a node from all other
    nodes in a cluster of global nodes.
  * compiler: The compiler will now forbid using the empty atom ''
    as module name. Also forbidden are modules names containing
    control characters, and module names containing only spaces and
    soft hyphens.
  * compiler: The bin_opt_info and recv_opt_info options would
    cause the compiler to crash when attempting to compile
    generated code without location information.
  * compiler: In rare circumstances involving floating point
    operations, the compiler could terminate with an internal
    consistency check failure.
  * compiler: In rare circumstances when doing arithmetic
    instructions on non-numbers, the compiler could crash.
  * compiler: In rare circumstances, complex boolean expressions in
    nested cases could cause the compiler to crash.
  * compiler: Expression similar to #{assoc:=V} = #key=&gt;self()}, V
    would return the empty map instead of raising an exception.
  * compiler: Eliminated a crash in the beam_ssa_bool pass of the
    compiler when compiling a complex guard expression.
  * compiler: In rare circumstances, the compiler could crash with
    an internal consistency check failure.
  * compiler: When compiling with the option inline_list_funcs, the
    compiler could produce a nonsensical warning.
  * compiler: When given the no_ssa_opt option, the compiler could
    terminate with an internal consistency failure diagnostic when
    compiling map matching.
  * compiler: Made warnings for existing atoms being keywords in
    experimental features more precise, by not warning about quoted
    atoms.
  * compiler: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * megaco: Fixed various dialyzer related issues in the examples
    and the application proper.
  * megaco: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * common_test: Fix cth_surefire to handle when a suite is not
    compiled with debug_info. This bug has been present since
    Erlang/OTP 25.0.
  * common_test: Common Test now preserves stack traces for throws.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1669291200">- Changes for 25.1.2:
  * mnesia: Don't fill the logs if mnesia can't connect to all
    nodes, due to partitioned network.
  * erts: Add abandon carrier free utilization limit (+Muacful)
    option to erts_alloc. This option allows the user to mark
    unused segments in a memory carrier as re-useable by the OS if
    needed. This functionality was a non-configurable default
    before Erlang/OTP 25, but removed due to performance issues.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1671364800">- Changes for 25.2:
  * erts: Fix perf/gdb JIT symbols to not contain CodeInfoPrologue
    for the JIT internal module erts_beamasm.
  * erts: Fixed minor memory leaks.
  * erts: Fix bugs in ets:insert and ets:insert_new when called
    with a list of tuples to insert while a concurrent process
    either deletes or renames the table. The table deletion could
    be done with ets:delete/1 or be caused by termination of the
    table owning process. Symptoms are either VM crash or strange
    incorrect behavior from the insert operation. The risk of
    triggering the bugs increases with the length of the list of
    tuple to insert. Bugs exist since OTP 23.0.
  * erts: Boost execution of scheduled thread progress jobs. This
    to prevent memory exhaustion in extremely rapid
    allocation/deallocation scenarios, such as repeated ETS table
    creations/deletions.
  * erts: Fix segv crash during crash dumping an ETS table doing
    ets:delete_all_objects.
  * erts: Spec for function net:if_names/0 incorrect
  * erts: Fix bug in binary_to_term decoding a binary term 2Gbyte
    or larger.
  * erts: Documentation of erlang:module_loaded/1 has been
    adjusted:
  * erts: Fix list_to_atom/1 for negative code points. Could either
    return with a positive code point or fail with an incorrect
    exception.
  * erts: Fix rare bug causing VM crash when sending to a pid of a
    spawning process returned from erlang:processes/0. Only seen
    when provoked by system process literal_area_collector,
    triggered by a module purge operation, on a VM started with
    +Meamin (no customized allocators).
  * erts: gen_udp:open/2 with option(s) add_membership or
    drop_membership would drop earlier options.
  * erts: The inet:setopts/2 {reuseaddr, true} option will now be
    ignored on Windows unless the socket is an UDP socket. For more
    information see the documentation of the reuseaddr option part
    of the documentation of inet:setopts/2. Prior to OTP 25 the
    {reuseaddr, true} option was ignored for all sockets on
    Windows, but as of OTP 25.0 this was changed so that it was not
    ignored for any sockets. *** POTENTIAL INCOMPATIBILITY ***
  * erts: Fix bug in binary_to_term decoding a list of length 1G or
    longer.
  * erts: Fix bug in binary_to_term (and distributed receive) when
    decoding a large map (&gt;32 keys) with unsorted small maps (&lt;=
    32) as keys of the large map. This was only a problem if the
    term was encoded by erl_interface, jinterface or otherwise, as
    the VM itself always encodes small maps with sorted keys. The
    "binary_to_term" would appear as successful but the created
    large map was internally inconsistent. The smaller key-maps
    could not be found with maps:get and friends. Other operations
    such as map compare and merge could probably also give
    incorrect results.
  * erts: Fix Windows bug in open_port({spawn, Command}, ..) when
    Command is found via the OS search PATH and that directory path
    contains white spaces. The port program would start but the
    command line arguments to it could be incorrect.
  * ftp: fix unexpected result ok when calling ftp:nlist repeatedly
  * inets: This change allows body requests to httpc:request/5 be
    an iolist()
  * inets: addition of type specs in httpc.erl
  * inets: httpc: Add support for HTTP 308 status code
  * dialyzer: Dialyzer would crash when attempting to analyze a bit
    syntax segment size having an literal non-integer size such as
    [].
  * dialyzer: Dialyzer could crash when trying to analyze a
    convoluted nested expression involving funs,
  * kernel: Fixed shutdown crash in gen_tcp socket backend, when
    the other end closed the socket.
  * kernel: erl_tar can now read gzip-compressed tar files that are
    padded. There is a new option compressed_one for file:open/2
    that will read a single member from a gzip file,
  * kernel: Fix os:cmd to not translate all exceptions thrown to
    badarg. For example emfile from erlang:open_port was translated
    to badarg. This bug has existed since Erlang/OTP 24.
  * kernel: Spec for function net:if_names/0 incorrect
  * kernel: Missing ctrl option name transation for TOS and TTL (on
    FreeBSD) when using gen_udp with the 'socket' inet_backend.
  * kernel: gen_udp:open/2 with option(s) add_membership or
    drop_membership would drop earlier options.
  * kernel: The inet:setopts/2 {reuseaddr, true} option will now be
    ignored on Windows unless the socket is an UDP socket. For more
    information see the documentation of the reuseaddr option part
    of the documentation of inet:setopts/2. Prior to OTP 25 the
    {reuseaddr, true} option was ignored for all sockets on
    Windows, but as of OTP 25.0 this was changed so that it was not
    ignored for any sockets. *** POTENTIAL INCOMPATIBILITY ***
  * kernel: The distribution socket option handling in
    inet_tcp_dist has been cleaned up to clarify which were
    mandatory and which just had default values.
  * kernel: Improve warning message format for gen_tcp_socket.
  * snmp: Explicitly close the socket(s) when terminating
    (default-) net-if process.
  * stdlib: erl_tar can now read gzip-compressed tar files that are
    padded. There is a new option compressed_one for file:open/2
    that will read a single member from a gzip file,
  * stdlib: A concurrent call to ets:rename could cause
    ets:delete_all_objects to fail halfway through with badarg.
  * stdlib: It is not allowed to call functions from guards. The
    compiler failed to reject a call in a guard when done by
    constructing a record with a default initialization expression
    that called a function.
  * stdlib: The compiler could crash when using a record with
    complex field initialization expression as a filter in a list
    comprehension.
  * stdlib: unicode:characters_to_binary() could build
    unnecessarily large call stack.
  * stdlib: Improve error message for ets:new/2 name clash. Say
    "name already exists" instead of less specific "invalid
    options".
  * mnesia: Fixed crash which could happen during startup if too
    many decisions where sent from remote nodes.
  * os_mon: The disk_space_check_interval configuration parameter
    of disksup can now be set to values smaller than a minute.
  * ssh: graceful shutdown of ssh_conection_handler when connection
    is closed by peer
  * common_test: Fix starting of peer nodes on old releases when
    the compile server was active and the current Erlang
    installation contained non-latin1 characters in its path.
  * public_key: Disregard LDAP URIs when HTTP URIs are expected.
  * ssl: With this change, tls_sender process is hibernated after
    sufficient inactivity.
  * ssl: Correct handling of legacy schemes so that ECDSA certs
    using sha1 may be used for some TLS-1.3 configurations.
  * ssl: With this change, tls_sender does not cause logger crash
    upon key update.
  * ssl: Enhance warning message
  * ssl: Provide server option to make certificate_authorities
    extension in the TLS-1.3 servers certificate request optional.
    This will allow clients to send incomplete chains that may be
    reconstructable and thereby verifiable by the server, but that
    would not adhere to the certificate_authorities extension.
  * ssl: If the verify_fun handles four arguments the DER cert will
    be supplied as one of the arguments.
  * megaco: A very minor improvement to the measurement tool.
  * observer: A WX event race could causes a crash in when handling
    socket or port info.
  * observer: Improve the nodes menu to include more nodes.
  * compiler: Line number in compiler messages would be truncated
    to 4 digits for line numbers greater than 9999.
  * compiler: In rare circumstance, matching a binary as part of a
    receive clause could cause the compiler to terminate because of
    an internal consistency check failure.
  * compiler: Compiling a function with complex bit syntax matching
    such as f(&lt;&lt;X:0, _:X&gt;&gt;, &lt;&lt;Y:0, _:Y&gt;&gt;) -&gt; ok. could crash the
    compiler.
  * compiler: It is not allowed to call functions from guards. The
    compiler failed to reject a call in a guard when done by
    constructing a record with a default initialization expression
    that called a function.
  * compiler: The compiler could crash when using a record with
    complex field initialization expression as a filter in a list
    comprehension.
  * wx: Added environment variable WX_MACOS_NON_GUI_APP to allow
    user to override OSXIsGUIApplication behavior.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1679745600">- Changes for 25.3:
  * reltool: Fixed a bug that would cause analysis to crash.
  * stdlib: Fixed a bug that would cause analysis to crash.
  * stdlib: Fixed a crash when formatting stack traces for error
    reports.
  * stdlib: Instead of crashing, the list_to_integer/1 and
    list_to_integer/2 BIFs now raise the system_limit exception for
    overlong lists that can't be converted to integers. Similarly,
    the string:to_integer/1 BIF now returns {error,system_limit}
    for overlong lists.
  * stdlib: Removal of non-necessary undefined types added to the
    state's supervisor record.
  * compiler: Fixed a bug that would cause the compiler to hang.
  * compiler: Fixed a crash when compiling code that contained
    maybe expressions.
  * compiler: Constructing a binary with an explicit size of all
    for a binary segment would crash the compiler.
  * compiler: The compiler would generate incorrect code for the
    following type of expression: Pattern = BoundVar1 = . . . =
    BoundVarN = Expression An exception should be raised if any of
    the bound variables have different values than Expression. The
    compiler would generate code that would cause the bound
    variables to be bound to the value of Expressionwhether the
    value matched or not.
  * xmerl: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * megaco: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * debugger: Fixed a bug that would cause analysis to crash.
  * erts: Fixed a bug on Windows where file:read_file_info/1 would
    fail for files with corrupt metadata.
  * erts: Fix process_info(_, binary) to again include "writable
    binaries" which were lost in OTP-25.0. Writable binaries are an
    optimization used when binaries are appended upon in a loop.
  * erts: Fix rare race when receiving fragmented messages on a
    terminating connection. Could potentially cause memory leaks as
    well as double free crashes. Bug exists since OTP 22.0.
  * erts: Fixed bug that could maybe cause problems when a file
    descriptor number is closed by a linked in driver and then
    opened (reused) and passed to enif_select by a NIF. No actual
    symptoms seen, only failed internal assertions in debug build.
  * erts: The runtime system could crash when tracing a process
    executing on a dirty scheduler.
  * erts: In the binary syntax, attempting to match out integers
    with size exceeding 2 GiB could crash the runtime system.
  * erts: Fixed edge case in floating-point negation where A = 0.0,
    B = -A did not produce B = -0.0 on x86_64 JIT.
  * erts: Fixed an issue in the JIT that could crash the emulator
    on some platforms.
  * erts: Added meta data to the windows installer.
  * erts: Fixed ETS insertion order into bag and duplicate_bag of
    tuples with identical keys when passed in a list to
    ets:insert/2. The insert order has been head-to-tail but was
    accidentally changed in OTP 23.0. For bag it was reverted
    (tail-to-head), while for duplicate_bag it was sometimes
    reverted depending on the length of the list and number of
    "reductions" left for the calling process. This fix changes the
    insert order of ets:insert/2 back to always be head-to-tail of
    the list argument.
  * erts: With the JIT for AArch64 (AMD64), calling bxor in with
    non-integer arguments in a guard would crash the runtime
    system.
  * erts: Fix bug regarding process flag max_heap_size. Could cause
    strange behavior when a process was killed due to exceeding the
    limit.
  * erts: Fixed binary comprehensions to be similar to other
    creation of binary data with respect to its contribution of
    triggering garbage collection.
  * erts: In rare circumstances, when a process exceeded its
    allowed heap size set by option max_heap_size, it would not be
    killed as it should be, but instead enter a kind of zombie
    state it would never get out of.
  * erts: Instead of crashing, the list_to_integer/1 and
    list_to_integer/2 BIFs now raise the system_limit exception for
    overlong lists that can't be converted to integers. Similarly,
    the string:to_integer/1 BIF now returns {error,system_limit}
    for overlong lists.
  * erts: Active process aliases of a process at its termination
    leaked memory.
  * erts: Support for fully asynchronous distributed signaling
    where send operations never block. This functionality is by
    default disabled and can be enabled per process. For more
    information see the documentation of process_flag(async_dist,
    Bool).
  * erts: Added the +JPperf no_fp option to explicitly disable
    Erlang frame pointers otherwise added when using the +JPperf
    map option.
  * erl_interface: Accept connection setup from OTP 23 and 24 nodes
    that are not using epmd.
  * erl_interface: The ei API for decoding/encoding terms is not
    fully 64-bit compatible since terms that have a representation
    on the external term format larger than 2 GB cannot be handled.
  * syntax_tools: erl_syntax_lib:annotate_bindings/1,2 will now
    properly annotate named functions and their arguments.
  * kernel: Fixed a bug on Windows where file:read_file_info/1
    would fail for files with corrupt metadata.
  * kernel: Accept connection setup from OTP 23 and 24 nodes that
    are not using epmd.
  * public_key: As different solutions of verifying certificate
    revocation exists move the decode of 'CRLDistributionPoints' so
    that it will only be decode. When it is actually used in the
    verification process. This would enable interoperability with
    systems that use certificates with an invalid empty
    CRLDistributionPoints extension that they want to ignore and
    make verification by other means.
  * public_key: public_key:pkix_path_validation validates
    certificates expiring after 2050
  * public_key: Do not leave exit message in message queue after
    calling cacerts_load() on MacOS.
  * public_key: Replace size/1 with either tuple_size/1 or
    byte_size/1 The size/1 BIF is not optimized by the JIT, and its
    use can result in worse types for Dialyzer. When one knows that
    the value being tested must be a tuple, tuple_size/1 should
    always be preferred. When one knows that the value being tested
    must be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * ssl: Fixed that new dtls connections from the same client ip
    port combination works. If there is a process waiting for
    accept the new connection will connect to that, otherwise it
    will try to re-connect to the old server connection.
  * ssl: When shutting down a node that uses SSL distribution
    (-proto_dist inet_tls), a confusing error message about an
    unexpected process exit was printed. This particular message is
    no longer generated.
  * ssl: fixes the type spec for ssl:format_error/1
  * ssl: Replace size/1 with either tuple_size/1 or byte_size/1 The
    size/1 BIF is not optimized by the JIT, and its use can result
    in worse types for Dialyzer. When one knows that the value
    being tested must be a tuple, tuple_size/1 should always be
    preferred. When one knows that the value being tested must be a
    binary, byte_size/1 should be preferred. However, byte_size/1
    also accepts a bitstring (rounding up size to a whole number of
    bytes), so one must make sure that the call to byte_size/ is
    preceded by a call to is_binary/1 to ensure that bitstrings are
    rejected. Note that the compiler removes redundant calls to
    is_binary/1, so if one is not sure whether previous code had
    made sure that the argument is a binary, it does not harm to
    add an is_binary/1 test immediately before the call to
    byte_size/1.
  * jinterface: Accept connection setup from OTP 23 and 24 nodes
    that are not using epmd.
  * os_mon: The port programs used by cpu_sup and memsup are now
    gracefully shut down when cpu_sup and memsup are shut down.
  * eunit: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * crypto: A user defined runtime library path configured using
  - -with-ssl-rpath=&lt;PATHS&gt; could fail to be enabled.
  * crypto: Ensure that configure fails if a user defined runtime
    library path has been passed by the user, but cannot set.
  * mnesia: Improved consistency for dirty writes when a table was
    added with add_table_copy/3. Fixed a problem with sticky write,
    which could lead to inconsistent data.
  * mnesia: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * common_test: Renamed undocumented macro CT_PEER/3 to
    CT_PEER_REL/3.
  * ssh: With this change, PKCS8 formatted private key file is
    properly decoded and SSH daemon with such key can be started.
  * ssh: Replace size/1 with either tuple_size/1 or byte_size/1 The
    size/1 BIF is not optimized by the JIT, and its use can result
    in worse types for Dialyzer. When one knows that the value
    being tested must be a tuple, tuple_size/1 should always be
    preferred. When one knows that the value being tested must be a
    binary, byte_size/1 should be preferred. However, byte_size/1
    also accepts a bitstring (rounding up size to a whole number of
    bytes), so one must make sure that the call to byte_size/ is
    preceded by a call to is_binary/1 to ensure that bitstrings are
    rejected. Note that the compiler removes redundant calls to
    is_binary/1, so if one is not sure whether previous code had
    made sure that the argument is a binary, it does not harm to
    add an is_binary/1 test immediately before the call to
    byte_size/1.
  * inets: With this change, handling of URI to a folder, with
    missing trailing / and a query component present is fixed.
  * inets: Adds more type information to the inets app, thus
    improving the errors that static analysis tools can detect. The
    addition of type information to records and the updates to
    function heads help static analysis tools to understand that
    some values in the records cannot be 'undefined', thus making
    static tools to type check correctly more modules in the inets
    app
  * inets: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * snmp: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * ftp: Replace size/1 with either tuple_size/1 or byte_size/1 The
    size/1 BIF is not optimized by the JIT, and its use can result
    in worse types for Dialyzer. When one knows that the value
    being tested must be a tuple, tuple_size/1 should always be
    preferred. When one knows that the value being tested must be a
    binary, byte_size/1 should be preferred. However, byte_size/1
    also accepts a bitstring (rounding up size to a whole number of
    bytes), so one must make sure that the call to byte_size/ is
    preceded by a call to is_binary/1 to ensure that bitstrings are
    rejected. Note that the compiler removes redundant calls to
    is_binary/1, so if one is not sure whether previous code had
    made sure that the argument is a binary, it does not harm to
    add an is_binary/1 test immediately before the call to
    byte_size/1.
  * dialyzer: Fixed a bug that would cause analysis to crash.
  * dialyzer: Replace size/1 with either tuple_size/1 or
    byte_size/1 The size/1 BIF is not optimized by the JIT, and its
    use can result in worse types for Dialyzer. When one knows that
    the value being tested must be a tuple, tuple_size/1 should
    always be preferred. When one knows that the value being tested
    must be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * tftp: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
- Changes for 25.2.3:
  * erts: Comparisons between small numbers and pids or ports would
    in some edge cases say that the number was greater than the pid
    or port, violating the term order.
  * erts: process_info(Pid, status) when Pid /= self() could return
    an erroneous result.
  * ssl: Maximize compatibility by ignoring change_cipher_spec
    during handshake even if middle_box_mode is not negotiated
    (mandated by client)
  * ssl: Move assert of middlebox message after an
    hello_retry_request to maximize interoperability. Does not
    changes semantics of the protocol only allows unexpected
    message delay from server.
  * ssh: With this change, ssh application does not crash when
    formatting some of info reports for unsuccessful connections.
  * ssh: With this change, ssh does not log extensively long
    messages.
  * inets: Ensure graceful shutdown
  * inets: Return type of the type specification for function
    httpc:cookie_header/{1,2,3} has been fixed from -spec
    cookie_header(url()) -&gt; [{ field(), value() }] | {error,
    Reason} to -spec cookie_header(url()) -&gt; { field(), value() } |
    {error, Reason}
- Changes for 25.2.2:
  * ftp: Fixes calls to ftp:nlist/2 returning {error, epath} when
    the file / folder exists
- Changes for 25.2.1:
  * compiler: Fixed a bug that could cause legal code to fail
    validation.
  * compiler: Eliminated a rare crash in the beam_types module.
  * erts: Fixed a bug in selective receive optimization that could
    crash 32-bit emulators.
  * erts: A race condition which was very rarely triggered could
    cause the signal queue of a process to become inconsistent
    causing the runtime system to crash.
  * kernel: The tcp connect option 'bind_to_device' could not be
    used with inet_backend = 'socket'. 'inet' requires value type
    binarry() and 'socket' requires value type 'string()'.
  * kernel: Minor issue processing options when calling
    gen_tcp:connect with a sockaddr() and inet_backend = socket.
  * common_test: Change timeout to infinity for gen_server calls in
    cth_log_redirect
  * inets: fixes a missing case of the type specification for
    httpd:info/2/3/4
  * snmp: Single threaded agent crash when vacm table not properly
    initiated.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1683460800">- Changes for 25.3.2:
  * compiler: Fixed type handling bugs that could cause an internal
    error in the compiler for correct code.
  * os_mon: Avoid error report from failing erlang:port_close at
    shutdown of cpu_sup and memsup. Bug exists since OTP 25.3
    (os_mon-2.8.1).
  * erts: If a runtime system which was starting the distribution
    already had existing pids, ports, or references referring to a
    node with the same nodename/creation pair that the runtime
    system was about to use, these already existing pids, ports, or
    references would not work as expected in various situations
    after the node had gone alive. This could only occur if the
    runtime system was communicated such pids, ports, or references
    prior to the distribution was started. That is, it was
    extremely unlikely to happen unless the distribution was
    started dynamically and was even then very unlikely to happen.
    The runtime system now checks for already existing pids, ports,
    and references with the same nodename/creation pair that it is
    about to use. If such are found another creation will be chosen
    in order to avoid these issues.
- Changes for 25.3.1:
  * snmp: Attempts to minimize the number of the error reports
    during a failed agent init.
  * compiler: When a map update such as #{}#{key:=value} that
    should fail with an exception was unused, the exception would
    be lost.
  * compiler: Fixed bug in the validator that made it reject valid
    code.
  * crypto: With this change, random errors are fixed for
    crypto:generate_key calls with OpenSSL 3.
  * erts: Fixed a bug in the loader that prevented certain modules
    compiled with no_ssa_opt from being loaded.
  * erts: Implementations of the call() driver callback that
    returned a faulty encoded result could cause a memory leak and
    could cause invalid data on the heap of the processes calling
    erlang:port_call/3.
  * erts: Fixed a memory corruption issue when upgrading code. The
    bug was introduced in OTP 25.3
  * erts: Fixed configure tests for a few ARM-specific
    instructions, which prevented the emulator from being built on
    some platforms.
  * erts: Aliases created in combination with a monitor using the
    {alias, explicit_unalias} option stopped working from remote
    nodes when a 'DOWN' signal had been received due to the monitor
    or if the monitor was removed using the erlang:demonitor() BIF.
    This bug was introduced in OTP 24.3.4.10 and OTP 25.3.
  * erts: In rare circumstances, bit syntax matching of an invalid
    code point for a utf32 would crash the runtime system.
  * erts: Building the runtime system failed when native atomic
    support was missing. Note that execution on such systems have
    only been rudimentary tested.
  * erl_interface: Fixed configure tests for a few ARM-specific
    instructions, which prevented the emulator from being built on
    some platforms.
  * eldap: Added a new function eldap:info/1 that returns the
    socket and the transport protocol for the eldap connection.
  * inets: Correct timing related pipelining/keepalive queue bug,
    that could result in unexpected "socket_remotly_closed" errors.
  * inets: With this change, upon remote socket closure current
    request is added to a retried queue (either pipeline or
    keep_alive, but not both).
  * ssl: With this change, ssl:connection_information/2 returns
    correct keylog data after TLS1.3 key update.
  * ssl: Client signature algorithm list input order is now honored
    again , it was accidently reversed by a previous fix.
  * stdlib: The type specs in the erl_parse module has been updated
    to include the maybe construct and the ! operator.
  * wx: Improve debug prints from the nifs. Some minor fixes for
    wxWidgets-3.2. Fixed OpenGL debug functions.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1687521600">- Changes for 25.3.2.2:
  * compiler: The compiler could be very slow when compiling guards
    with multiple guard tests separated with 'or' or ';'.
- Changes for 25.3.2.1:
  * xmerl: New options to xmerl_scan and xmerl_sax_parser so one
    can limit the behaviour of the parsers to avoid some XML
    security issues. xmerl_scan gets one new option:
    xmerl_sax_parser gets the following options: The old option
    skip_external_dtd is still valid and the same as
    {external_entities, none} and {fail_undeclared_ref, false} but
    just affects DTD's and not other external references.
  * erts: Fixed a crash during tracing on certain platforms that
    cannot use the machine stack for Erlang code (mainly OpenBSD
    and Linux with musl).
  * erts: Constructing a binary segment not aligned with a byte
    boundary, with a size not fitting in 31 bits, and with a value
    not fitting in a 64-bit word could crash the runtime system.
  * erts: Further robustify implementation of large maps (&gt; 32
    keys). Keys that happen to have same internal 32-bit hash
    values are now put in collision nodes which are traversed with
    linear search. This removes the demand for the internal hash
    function when salted to eventually produce different hashes for
    all possible pairs of unequal terms.
  * stdlib: Static supervisors are very idle processes after they
    have started so they will now be hibernated after start to
    improve resource management.
  * compiler: Fixed a bug where a failing bsl expression in a guard
    threw an exception instead of causing the guard to fail.
  * compiler: Complex guard expression using the or operator and
    guard BIFs that can fail could sometimes be miscompiled so that
    the guard would succeed even if a call to a guard BIF failed.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1687608000">- Version 26.0:
  * Leex has been extended with optional column number support.
  * The family of enumeration functions in module lists has been
    extended with enumerate/3 that allows a step value to be
    supplied.
  * Update Unicode to version 15.0.0.
  * proc_lib:start*/* has become synchronous when the started
    process fails. This requires that a failing process use a new
    function proc_lib:init_fail/2,3, or exits, to indicate failure. All
    OTP behaviours have been fixed to do this.
  * auto-complete of variables, record names, record fields names,
    map keys, function parameter types and filenames.
  * Open external editor in the shell to edit the current
    expression.
  * defining records (with types), functions, specs and types in
    the shell.
  * Creation and matching of binaries with segments of fixed sizes
    have been optimized.
  * Creation and matching of UTF-8 segments have been optimized.
  * Appending to binaries has been optimized.
  * The compiler and JIT now generate better code for creation of
    small maps where all keys are literals known at compile time.
  * Thanks to the optimizations above the performance of the base64
    module has been significantly improved. For example, on an
    x86_64 system with the JIT both encode and decode are almost
    three times faster than in Erlang/OTP 25.
  * Map comprehensions as suggested in EEP 58 has now been
    implemented.
  * Some map operations have been optimized by changing the
    internal sort order of atom keys. This changes the
    (undocumented) order of how atom keys in small maps are printed
    and returned by maps:to_list/1 and maps:next/1. The new order
    is unpredictable and may change between different invocations
    of the Erlang VM.
  * Introducing the new function maps:iterator/2 for creating an
    interator that return the map elements in a deterministic
    order. There are also new modifiers k and K for the format
    string in io:format() to support printing map elements ordered.
  * Added the new built-in type dynamic() introduced in EEP 61, PR
    introducing EEP 61 improving support for gradual type checkers.
  * Dialyzer has a new incremental mode that be invoked by giving
    the --incremental option when running Dialyzer. This new
    incremental mode is likely to become the default in a future
    release.
  * Multi time warp mode is now enabled by default. This assumes
    that all code executing on the system is time warp safe.
  * Support for UTF-8 atoms and strings in the NIF interface
    including new functions enif_make_new_atom,
    enif_make_new_atom_len and enif_get_string_length.
  * The BIFs min/2 and max/2 are now allowed to be used in guards
    and match specs.
  * Improved the selective receive optimization, which can now be
    enabled for references returned from other functions. This
    greatly improves the performance of gen_server:send_request/3,
    gen_server:wait_response/2, and similar functions.
  * It is no longer necessary to enable a feature in the runtime
    system in order to load modules that are using it. It is
    sufficient to enable the feature in the compiler when compiling
    it.
  * inet:setopts/2 has got 3 new options: reuseport, reuseport_lb
    and exclusiveaddruse.
  * Fix so that -fno-omit-frame-pointer is applied to all of the
    Erlang VM when using the JIT so that tools, such as perf, can
    crawl the process stacks.
  * In the lists module, the zip family of functions now takes
    options to allow handling lists of different lengths.
  * Added the zip:zip_get_crc32/2 function to retrieve the CRC32
    checksum from an opened ZIP archive. gen_server optimized by
    caching callback functions
  * The modules Erlang DNS resolver inet_res and helper modules
    have been updated for RFC6891; to handle OPT RR with DNSSEC OK
    (DO) bit.
  * Introduced application:get_supervisor/1.
  * Cache OTP boot code paths, to limit how many folders that are
    being accessed during a module lookup. Can be disabled with
  - cache_boot_path false.
  * Support for Kernel TLS (kTLS), has been added to the SSL
    application, for TLS distribution (-proto_dist inet_tls), the
    SSL option {ktls, true}.
  * Improved error checking and handling of ssl options.
  * Mitigate memory usage from large certificate chains by lowering
    the maximum handshake size. This should not effect the common
    cases, if needed it can be configured to a higher value.
  * For security reasons the SHA1 and DSA algorithms are no longer
    among the default values.
  * Add encoding and decoding of use_srtp hello extension to
    facilitate for DTLS users to implement SRTP functionality.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1687608001">- Changes for 26.0.1:
  * erts: Build of the socket nif failed on Solaris 11.
  * erts: Fixed two reduction-counting bugs relating to binaries.
  * erts: Constructing a binary segment not aligned with a byte
    boundary, with a size not fitting in 31 bits, and with a value
    not fitting in a 64-bit word could crash the runtime system.
  * erts: When a binary construction failed because of bad size for
    a segment, the error information was not always correct.
  * erts: Fixed a crash when calling a fun that was defined in a
    module that had been upgraded.
  * kernel: The POSIX error exdev was sometimes incorrectly
    described as "cross domain link" in some error messages.
  * kernel: Corrected the socket send function description (send
    with Timeout = nowait). The send function(s) could not return
    {ok, {RestData, SelectInfo}}
  * stdlib: The POSIX error exdev was sometimes incorrectly
    described as "cross domain link" in some error messages.
  * ssl: Make sure that selection of client certificates handle
    both TLS-1.3 and TLS-1.2 names correctly. Could cause valid
    client certificate to not be selected, and an empty client
    certificate message to be sent to server.
  * ssl: Improved ssl:format_error/1 to handle more error tuples.
  * ssl: Fixed hanging ssl:connect when ssl application is not
    started.
  * ssl: Correct handling of retransmission timers, current
    behavior could cause unwanted delays.
  * inets: Do not make the default ssl options by calling
    httpc:ssl_verify_host_options(true) if ssl options are supplied
    by the user.
  * xmerl: New options to xmerl_scan and xmerl_sax_parser so one
    can limit the behaviour of the parsers to avoid some XML
    security issues. xmerl_scan gets one new option:
    xmerl_sax_parser gets the following options: The old option
    skip_external_dtd is still valid and the same as
    {external_entities, none} and {fail_undeclared_ref, false} but
    just affects DTD's and not other external references.
  * compiler: Fixed a bug where a failing bsl expression in a guard
    threw an exception instead of causing the guard to fail.
  * compiler: Fixed a bug that would case the validator to reject
    legal code.
  * compiler: The compiler could re-order clauses matching binaries
    so that the incorrect clause would match. That could only
    happen for code that used the option {error_location,line} or
    for code without line or column number information (e.g.
    generated by a parse transform).
  * compiler: Complex guard expression using the or operator and
    guard BIFs that can fail could sometimes be miscompiled so that
    the guard would succeed even if a call to a guard BIF failed.
  * compiler: With optimizations disabled, a try/catch construct
    could return an incorrect value.
  * compiler: In rare circumstance, a combination of binary
    construction and binary_part/3 would cause the compiler to
    generate unsafe code that would crash the runtime system.
  * compiler: The compiler could be very slow when compiling guards
    with multiple guard tests separated with 'or' or ';'.
  * compiler: Complex guard expressions using 'or' and map updates
    could succeed even if the map update failed.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1698235200">- Changes for 26.1.2:
  * erts: If the external term format encoding of an argument list
    part of a distributed spawn operation was faulty, the newly
    spawned remote process could misbehave. The misbehavior
    included hanging or interpret an incoming message as an
    argument list to use. This was very unlikely to happen unless
    using an alternate implementation of the distribution protocol
    which made a faulty encoding of the argument list. The child
    process will now detect this error and terminate before
    executing the user specified code.
  * erts: Fix bugs where if the body of a matchspec would return a
    map with a variable ('$1', '$_' etc) as one of the keys or
    values and the variable was not an immidiate, the term would
    not be copied to the receiving processes heap. This would later
    corrupt the term in the table as the GC could place move
    markers in it, which in turn would cause the VM to crash. Bug
    has been present for since OTP 17.0.
  * xmerl: The xmerl version 1.3.32 was released in OTP 26.0.1, but
    the incorrect version number of 1.3.31.1 was used for it. This
    incorrect version number continued to appear in OTP 26.0.2, OTP
    26.1, and OTP 26.1.1. The actual xmerl code in these OTP
    versions however corresponds to xmerl version 1.3.32.
- Changes for 26.1.1:
  * wx: The wx application would fail to build on macOS with Xcode
    15.
  * compiler: The compiler could become extremely slow for modules
    containing huge functions.
  * stdlib: Garbage collect the shell process when reducing the
    amount of saved history and results.
- Changes for 26.1:
  * crypto: Fix VM crash caused by crypto being purged and reloaded
    (by init:restart for example) on OS with musl libc (such as
    Alpine linux).
  * crypto: Improved understanding of LibreSSL versions. Support
    chacha20 and chacha20_poly1305 for LibreSSL 3.7. Reflect
    removal of support for the DSS/DSA algorithm which was done in
    LibreSSL 2.6.1.
  * crypto: FIPS supported by crypto for OpenSSL 3.0.* and 3.1.*.
  * asn1: The ASN.1 compiler would ignore a constraint such as
    (SIZE (1..4), ...), causing incorrect behavior of the encoding
    and decoding function for the PER and UPER backends. Corrected
    to handle the constraint in the same way as (SIZE (1..4, ...)).
  * asn1: The JER backend has been internally refactored in a way
    that is compatible for applications that use the documented
    API. However, for a group of ASN.1 modules that depend on each
    other (for example, S1AP-PDU-Descriptions, S1AP-Contents, and
    so on), all modules in the group must be recompiled if on of
    the group members is recompiled.
  * observer: Closing the trace log window via the menu did not
    work.
  * erts: maps:put with existing key and identical value was not
    optimized as a no-op correctly if having the same 32-bit hash
    as another key in the map. In practice very rare and harmless.
  * erts: Fixed an issue with truncated crash slogans on failed
    emulator start.
  * erts: Fixed a bug where the emulator was unable to determine
    the current cgroup CPU quota.
  * erts: A process optimized for parallel signal delivery could
    under some circumstances lose wakeup information. That is, the
    processes was not woken up to take care of the signal, so the
    signal would not be taken care of until the process was woken
    by another signal. Only processes configured with
    message_queue_data set to off_heap utilize this optimization.
  * erts: Function socket:close/1 could cause a VM crash on
    Windows.
  * erts: Fixed a bug in the ARM JIT where it could accidentally
    add garbage trailing bits when creating bitstrings whose size
    wasn't an even multiple of 8 bits.
  * erts: Fix erlang:system_info/1 documentation to show correct
    types.
  * erts: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * erts: Fix compilation with GNU termcap.
  * erts: Delivery time of message signals to a process not
    executing any receive expressions could become very long,
    potentially infinite. For example, a process checking for
    messages using process_info(self(), message_queue_len) or
    process_info(self(), messages) and avoiding to execute a
    receive expression matching on messages could be very slow in
    detecting new messages. Note that you are still discouraged
    from using process_info() this way. A process that wants to
    check if there are messages available to handle should execute
    a receive expression matching on messages.
  * erts: On AArch64 (ARM64), when calculating both the quotient
    and remainder with a divisor begin a power two, the remainder
    could be incorrectly calculated.
  * erts: Fix bug causing "magic" references in a compressed ETS
    table to not keep the referred object alive. The symptom would
    be the referred object being garbage collected prematurely and
    the reference appearing stale, not referring to anything.
    Examples of such magically referred objects are atomics and NIF
    resources.
  * erts: Matching out short bitstrings with a fixed size not
    divisible by 8 could could lead to the runtime system
    terminating with an "Overrun heap and stack" error.
  * erts: A constant flow of incoming non-message signals could
    prevent a process needing to execute dirty from doing so.
  * erts: A BEAM file usually contains a chunk with the tag "Type"
    containing type information that can be used by the JIT. The
    beam_lib:strip/1 takes care to preserve that chunk, but a
    build/release tool that does customized stripping could
    accidentally remove the chunk. Loading a BEAM file without the
    "Type" chunk could cause incorrect behavior of the loaded code.
  * erts: gen_udp:recv/* for Unix Domain Socket in binary mode and
    passive mode has been fixed to not crash.
  * erts: The cleanup operation of not yet delivered signals to a
    terminated process yielded excessively.
  * erts: Fixed minor hashing issue with the local option of
    term_to_binary()/term_to_iovec().
  * erts: Update gen_tcp_socket and gen_udp_socket to handle
    'completion' (socket on Windows).
  * erts: Add support for Unix Domain Sockets (only for STREAM
    sockets) on Windows for 'socket'.
  * erts: In Erlang/OTP 27, by default escripts will be compiled
    before being executed. That means that the compiler application
    must be installed. It is possible to force the escript to be
    interpreted by adding the directive -mode(interpret). to the
    escript file. In Erlang/OTP 28, support for interpreting an
    escript will be removed.
  * erts: Add basic support for socket ioctl on Windows.
  * erts: Removed erts/etc/darwin/Info.plist, as it is no longer
    necessary after macos 10.12
  * erts: Add support for (Windows) socket option exclusiveaddruse.
  * erts: [socket] Add support for the 'nopush' option.
  * erts: Add support for socket option 'BSP STATE'.
  * erts: Add tcp socket options 'keepcnt', 'keepidle' and
    'keepintvl'.
  * erts: Add support for misc (Windows) socket options
    ('max_msg_size' and 'maxdg').
  * compiler: The compiler could run forever when compiling a call
    to is_record/3 with a huge positive tuple size. The call
    is_record(A, a, 0) would crash the compiler when used in a
    function body. When used in a guard the compiler would emit
    incorrect code that would accept {a&gt; as a record.
  * compiler: Fixed a bug that caused dialyzer to crash when
    analyzing bogus code that contained the literal atom undefined
    in segment sizes.
  * compiler: The compiler would crash when compiling some modules
    that contained a call to erlang:load_nif/2.
  * compiler: Fixed a bug that caused the compiler to crash on
    legal code.
  * compiler: The compiler could crash when attempting to compile a
    call to is_list/1 in a complex expression.
  * compiler: A complex guard expression using the or operator
    could succeed when it was supposed to fail.
  * compiler: Compiling nested try/catch and catch expression could
    result in an internal compiler error.
  * compiler: Using the bnot operator in a complex expression could
    cause the compiler to terminate with an internal consistency
    failure diagnostic.
  * compiler: Fixed a bug that caused the compiler to crash in a
    binary optimization pass.
  * compiler: The compiler could terminate with an internal error
    when attempting to compile a binary pattern that could not
    possibly match.
  * compiler: Fixed various performance issues related to the alias
    optimization pass.
  * erl_docgen: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * mnesia: Do not delete old backup file if the new backup fails.
  * megaco: Make megaco transports handle gen_tcp | gen_udp with
    socket backend on Windows (completion).
  * common_test: With this change, ct_hooks manual refers to CTH
    execution order section in user guide.
  * common_test: With this change, Config data from
    pre_end_per_testcase hook is delivered to post_end_per_testcase
    callback in case of testcase timetrap or linked process crash.
  * common_test: With this change, remaining references to not
    supported vts tool in ct_run are removed (mainly relates to
    docs and ct_run help message).
  * common_test: With this change, prompt search functionality in
    ct_telnet handles unicode input.
  * common_test: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * stdlib: The compiler could run forever when compiling a call to
    is_record/3 with a huge positive tuple size. The call
    is_record(A, a, 0) would crash the compiler when used in a
    function body. When used in a guard the compiler would emit
    incorrect code that would accept {a&gt; as a record.
  * stdlib: Fix bug in ets:tab2file that could make it fail if
    another Erlang process created the same file at the same time.
  * stdlib: An {else_clause,Value} exception will now be reported
    nicely in the shell.
  * stdlib: Correct return value for error case, so that it matches
    the documented and intended return value {error,
    {already_started, pid()} when local registered names are used.
  * stdlib: sys:get_state/1,2 and sys:replace_state/2,3 has been
    corrected to handle a state named error as a state name, not as
    a failed system callback. For the standard server behaviours
    this was an issue only for gen_statem (and gen_fsm) when the
    state name was error, and for gen_server if the complete state
    was {error,_}.
  * stdlib: Multiple problems were fixed in
    filelib:safe_relative_path/2. If its second argument was a path
    that contained symbolic links, an incorrect result patch could
    be returned. Also, paths were sometimes falsely considered
    unsafe.
  * stdlib: Fix deadlock when erl.exe is used as part of a pipe on
    Windows and trying to set the encoding of the standard_io
    device.
  * stdlib: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * stdlib: Fix h/2,3 to properly render multi-clause
    documentation.
  * stdlib: Timers created by timer:apply_after/4,
    apply_interval/4, and apply_repeatedly/4 would silently fail to
    do the apply if it was not possible to spawn a process when the
    timer expired. This has now been corrected, and if the spawn
    fails, the system will be taken down producing a crash dump.
  * stdlib: When an Erlang source file lacked a module definition,
    there would be a spurious "module name must not be empty"
    diagnostic for each spec in the file.
  * stdlib: The argument descriptions for option types in argparse
    have been made less ambiguous.
  * stdlib: Clarified the documentation of normal shutdown reason
    on gen_server:call/2,3
  * stdlib: Pattern matching and equivalence (=:=, =/=) comparisons
    on 0.0 will now raise a warning, as it will no longer be
    considered equivalent to -0.0 in OTP 27. If a match on 0.0
    specifically is desired (distinct from -0.0), the warning can
    be suppressed by writing +0.0 instead. The arithmetic
    comparison operators are unaffected, including arithmetic
    equality (==). *** POTENTIAL INCOMPATIBILITY ***
  * stdlib: The semantics of the gen_{server,statem,event}
    behaviour's synchronous start behaviour introduced in OTP-26.0
    with OTP-18471, has been clarified in the documentation.
  * stdlib: Added functionality to set a custom multiline prompt.
  * stdlib: A warning for (accidental use of) Triple-Quoted Strings
    has been implemented as per EEP 64. *** POTENTIAL
    INCOMPATIBILITY ***
  * stdlib: The keyboard shortcuts for the shell are now
    configurable.
  * kernel: Fixed an issue with truncated crash slogans on failed
    emulator start.
  * kernel: Fix shell:start_interactive function specification.
  * kernel: Fix code:get_doc/1 to return missing, when it can't
    find erts instead of crashing.
  * kernel: Function socket:close/1 could cause a VM crash on
    Windows.
  * kernel: Fix deadlock when erl.exe is used as part of a pipe on
    Windows and trying to set the encoding of the standard_io
    device.
  * kernel: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * kernel: Fix logger's overload protection mechanism to only
    fetch memory used by messages when needed.
  * kernel: Fixed a number of socket-related issues causing
    incompatibilities with gen_tcp and gen_udp respectively.
  * kernel: gen_tcp:connect with socket address and socket (inet-)
    backend fails because of missing callback function.
  * kernel: The DNS RR cache used by `inet_res` has been fixed to
    preserve insert order, which is beneficial when the DNS server
    returns RRs in some specific order for e.g load balancing
    purposes.
  * kernel: The options `reuseport`, `reuseport_lb` and
    `exclusiveaddruse` were accidentally not allowed for e.g
    `gen_udp:open/1,2`, which has now been corrected.
  * kernel: gen_udp:recv/* for Unix Domain Socket in binary mode
    and passive mode has been fixed to not crash.
  * kernel: Fixed issue where cursor would not be placed at the end
    of the expression when navigating shell history.
  * kernel: Update gen_tcp_socket and gen_udp_socket to handle
    'completion' (socket on Windows).
  * kernel: Add support for Unix Domain Sockets (only for STREAM
    sockets) on Windows for 'socket'.
  * kernel: Add basic support for socket ioctl on Windows.
  * kernel: The file:location/0 type is now exported.
  * kernel: Add support for (Windows) socket option
    exclusiveaddruse.
  * kernel: [socket] Add support for the 'nopush' option.
  * kernel: Add support for socket option 'BSP STATE'.
  * kernel: Add tcp socket options 'keepcnt', 'keepidle' and
    'keepintvl'.
  * kernel: Add support for misc (Windows) socket options
    ('max_msg_size' and 'maxdg').
  * kernel: The keyboard shortcuts for the shell are now
    configurable.
  * kernel: Optimized code_server to reduce repeated work when
    loading the same module concurrently.
  * debugger: The call int:no_break(Module) did not remove any
    breakpoints.
  * debugger: The maybe expression is now supported in the
    Debugger.
  * debugger: The maybe expression is now supported in the
    Debugger.
  * debugger: The call int:no_break(Module) did not remove any
    breakpoints.
  * ssl: Avoid function clause error in ssl:getopts/2 by handling
    that inet:getopts may return an empty list during some
    circumstances, such as the socket being in a closing state.
  * ssl: The API function `ssl:recv/3` has been tightened to
    disallow negative length, which has never been documented to
    work, but was passed through and caused strange errors.
  * ssl: When a client initiated renegotiation was rejected and the
    client socket was in active mode the expected error message to
    the controlling process was not sent.
  * ssl: Add some guidance for signature algorithms configuration
    in ssl applications users guide.
  * snmp: Make snmp handle gen_udp with socket backend on Windows
    (completion).
  * public_key: Country name comparison shall be case insensitive
  * public_key: Add check to disallow duplicate certs in a path
  * inets: With this change, re_write httpd works as expected and
    does not return error.
  * inets: Fixed a bug so httpd does not crash when stopped at the
    wrong time during TLS connection negotiation, or any other
    theoretically as slow connection setup.
  * inets: Enhance error handling and avoid that the HTTP client
    hangs on headers provided on the wrong format.
  * inets: With this change, error report generated by httpd during
    connection setup contains socket type information.
  * inets: Stop and restart of the httpd server in the Inets
    application has been refactored to a more synchronous and OTP
    supervisor friendly approach. This should increase stability
    and for example avoid a supervisor report from
    httpd_connection_sup about killed child process(es) in some
    cases when stopping or restarting httpd.
  * dialyzer: Fixed a bug that caused dialyzer to crash when
    analyzing bogus code that contained the literal atom undefined
    in segment sizes.
  * dialyzer: Dialyzer could crash when attempting to analyze a
    module that defined a type called product/.
- Changes for 26.0.2:
  * erts: Fix using the IME (Input Method Editor) to enter text in
    cmd.exe and powershell.exe on Windows.
  * erts: Multiple socket:accept calls issue. When making multiple
    accept calls, only the last call is active.
  * erts: Fix the shell to ignore terminal delay when the terminal
    capabilities report that they should be used.
  * erts: Fix "oldshell" to echo characters while typing on
    Windows.
  * erts: On Windows, a call to the function socket:close, when
    there are waiting active calls to read, write or accept
    functions, could hang.
  * erts: Fix issues when reading or configuring standard_io on
    Windows when erl.exe is started using -noshell flag.
  * erts: The following functions are now much faster when given a
    long list or binary:
  * erts: On AArch64 (ARM64), equality and non-equality tests with
    literal bitstrings could succeed when they should fail and vice
    versa.
  * compiler: Fixed a type handling bug that would cause an
    internal consistence failure for correct code.
  * compiler: Fixed a bug that could cause the stack trace of throw
    exceptions to be erroneously optimized out.
  * compiler: Complex guard expression using 'or' were not always
    fully evaluated, making guards that were supposed to fail
    succeed.
  * stdlib: Fix bug where when you entered Alt+Enter in the
    terminal, the cursor would move to the last line, instead of
    moving to the next line.
  * stdlib: Fix eof handling when reading from stdin when erlang is
    started using -noshell.
  * stdlib: Fixed problem where output would disappear if it was
    received after a prompt was written in the shell.
  * stdlib: The following functions are now much faster when given
    a long list or binary:
  * kernel: Fix bug where when you entered Alt+Enter in the
    terminal, the cursor would move to the last line, instead of
    moving to the next line.
  * kernel: Fix so that the shell does not crash on startup when
    termcap is not available.
  * kernel: Multiple socket:accept calls issue. When making
    multiple accept calls, only the last call is active.
  * kernel: Fix the shell to ignore terminal delay when the
    terminal capabilities report that they should be used.
  * kernel: Fix "oldshell" to echo characters while typing on
    Windows.
  * kernel: Fix eof handling when reading from stdin when erlang is
    started using -noshell.
  * kernel: On Windows, a call to the function socket:close, when
    there are waiting active calls to read, write or accept
    functions, could hang.
  * kernel: Fix issues when reading or configuring standard_io on
    Windows when erl.exe is started using -noshell flag.
  * kernel: gen_udp:connect with inet_backend = socket fails when
    the Address is a hostname (string or atom).
  * kernel: Fixed problem which would cause shell to crash if
    particular escape sequence was written to stdout.
  * kernel: Fixed problem where output would disappear if it was
    received after a prompt was written in the shell.
  * kernel: Fix a crash where the location of erts could not be
    found in rebar3 dev builds.
  * kernel: Introduce the KERNEL application parameter
    standard_io_encoding that can be used to set the default
    encoding for standard_io. This option needs to be set to latin1
    if the application wants to treat all input data as bytes
    rather than utf-8 encoded characters.
  * ssl: Added keylog information to all protocol versions in
    ssl:connection_information/2.
  * ssl: Add RFC-6083 considerations for DTLS to enable gen_sctp
    based callback for the transport.
  * ssh: Added multiline editing support to ssh clients connected
    through OTP ssh daemon.</changelog>
  <changelog author="sflees@suse.de" date="1704974400">- Changes for 26.2.1:
  * erts: Removed unnecessary PCRE source tar-ball.
  * ssh: With this change (being response to CVE-2023-48795),
    ssh can negotiate "strict KEX" OpenSSH extension with
    peers supporting it; also
    'chacha20-poly1305@openssh.com' algorithm becomes a
    less preferred cipher.
    If strict KEX availability cannot be ensured on both
    connection sides, affected encryption modes(CHACHA and
    CBC) can be disabled with standard ssh configuration.
    This will provide protection against vulnerability, but
    at a cost of affecting interoperability. See
    Configuring algorithms in SSH. (bsc#1218192, CVE-2023-48795)
- Changes for 26.2:
  * all: Replaced unintentional Erlang Public License 1.1
    headers in some files with the intended Apache License
    2.0 header.
  * otp: The removal of the deprecated slave module, originally
    planned for OTP 27, has been postponed to OTP 29.
  * asn1: Fix benign warning from gcc 11 about mismatching call
    to free().
  * crypto: Enable engine support for OpenSSL versions 3.
  * edoc: Emit &lt;code&gt; instead of &lt;tt&gt;.
- Disable test suite for now, it has many false positives and
  takes a very long time.</changelog>
  <changelog author="sflees@suse.de" date="1706011200">- This codestream wasn't affected by bsc#1207113</changelog>
  <changelog author="sflees@suse.de" date="1706011201">- Disable rpmlint tests on SLE-15 where they currently fail</changelog>
  <changelog author="sflees@suse.de" date="1715947200">- Create a versioned package for SLES</changelog>
</package>
<package pkgid="30df86393b22f51d344a21826ecf0192a1d5103e78fa36cf62a35a7d5b99e974" name="erlang26-debugger-src" arch="ppc64le">
  <version epoch="0" ver="26.2.1" rel="150300.7.5.1"/>
  <changelog author="matwey.kornilov@gmail.com" date="1646568000">- Changes for 24.2.2:
  * inets: Avoid intermediate ungraceful shutdown of the HTTP
    server.
  * ssh: The ssh sever parallel_login option was missing in OTP-24</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1648382400">- Changes for 24.3.2:
  * erl_interface: Fix compile error regarding gethostbyaddr_r on
    Android. Error introduced in OTP 24.3.
  * kernel: Fix failed accepted connection setup after previous
    established connection from same node closed down silently.
  * kernel: Fixed a problem where typing Ctrl-R in the shell could
    hang if there were some problem with the history log file.
- Changes for 24.3.1:
  * dialyzer: There could be spurious warnings for unknown types
    when a type was a subtype of an existing type that was a
    subtype of an unknown type.
  * ssl: Client certification could fail for TLS-1.3 servers that
    did not include the certificat_authorties extension in its
    certificate request message.
- Changes for 24.3:
  * megaco: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.
  * megaco: Update the performance and debug chapters of the megaco
    user's guide. Also some updates to the meas tools.
  * compiler: The expression &lt;&lt;0/native-float&gt;&gt;=Bin would always
    fail to match, while &lt;&lt;0/float-native&gt;&gt;=Bin would match
    (provided that Bin contained the binary representation of 0.0)
  * compiler: The compiler will now compile huge functions with
    straight-line code faster.
  * erl_interface: Add --enable-ei-dynamic-lib configure option
    that will make erl_interface also release a dynamic library
    version of libei.
  * erl_interface: The ei API for decoding/encoding terms is not
    fully 64-bit compatible since terms that have a representation
    on the external term format larger than 2 GB cannot be handled.
  * sasl: Fix bug in systools:make_script/1 documentation.
  * inets: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.
  * inets: Documentation fix for inets:services_info/0, which now
    describes that Info might be a Reason term() in case when
    {error, Reason} is returned as service info.
  * crypto: The crypto app in OTP can since OTP-24.2 be compiled,
    linked and used with the new OpenSSL 3.0 cryptolib. The crypto
    app has 3.0 support has been improved, but is still *not
    recommended* for other usages than experiments and alpha
    testing. There are not yet any guaranties that it works, not
    even together with other OTP applications like for example SSL
    and SSH, although there are no known errors. Since the previous
    release, OTP-24.2, the following improvements have been done: -
    It has been tested during nearly every nightly test on the OTP
    lab - The hash algorithms md4 and ripemd160 have been enabled
    with OpenSSL 3.0. - The ciphers blowfish_cbc, blowfish_ecb,
    des_cbc, des_cfb, des_ecb, rc2_cbc and rc4 have been enabled
    with OpenSSL 3.0. Disabled or unsupported with OpenSSL 3.0 are
    still: - ENGINE support - FIPS mode - Other providers than the
    built-in ones - Compiling and linking with OpenSSL 3.0
    cryptolib in compatibility modes (for example to behave as
    1.1.1) and, the ciphers blowfish_cfb64 and blowfish_ofb64 are
    not supported and will not be either. Deprecated functions in
    the OpenSSL 3.0 cryptolib must not be disabled as OTP/crypto
    still uses some of the deprecated API functions. The gcc flag
  - Wno-deprecated-declarations is set to prevent deprecation
    warnings to be printed when compiling.
  * crypto: Crypto is adapted to LibreSSL 3.5.0 on OpenBSD.
  * crypto: New configure option ( --disable-otp-test-engine) to
    prohibit the build of the OTP test engine used in some test
    suites. The reason is that the test engine could be hard to
    compile on for instance LibreSSL 3.5.0. For that particular
    cryptolib version (or higher), this configure option is set
    automatically.
  * jinterface: Fix bug in OtpOutputStream.write_pid/4 and
    write_ref/3 causing faulty encodig. Bug exists since OTP 23.0.
  * wx: Removed the static_data option from wxImage creation
    functions, as it was broken and could lead to crashes. Now
    image data is always copied to wxWidgets as was the default
    behavior. Removed some non working wxGridEvent event types,
    which have there own events in newer wxWidgets versions, and
    added a couple of event types that where missing in wx.
  * asn1: Add support for the maps option in combination with the
    jer backend.
  * snmp: The compilation time is no longer recorded in BEAM files.
    There remained several undocumented functions that attempted to
    retrieve compilation times. Those have now been removed.
  * snmp: [agent] Remove expectation of socket being a port.
  * common_test: OTP internal test fix.
  * runtime_tools: Fixed bug in scheduler:utilization(Seconds) that
    would leave the scheduler_wall_time system flag incorrectly
    enabled.
  * runtime_tools: Add scheduler:get_sample/0 and get_sample_all/0.
    Also clarify scheduler module documentation about how it
    depends on system flag scheduler_wall_time.
  * erts: Fixed a bug in the x86 JIT that might cause floating
    point instructions to wrongly throw an exception.
  * erts: Preserve correct nodedown_reason if supervised
    distribution controller processes exit with {shutdown, Reason}.
  * erts: Handling of send_timeout for gen_tcp has been corrected
    so that the timeout is honored also when sending 0 bytes.
  * erts: By default global does not take any actions to restore a
    fully connected network when connections are lost due to
    network issues. This is problematic for all applications
    expecting a fully connected network to be provided, such as for
    example mnesia, but also for global itself. A network of
    overlapping partitions might cause the internal state of global
    to become inconsistent. Such an inconsistency can remain even
    after such partitions have been brought together to form a
    fully connected network again. The effect on other applications
    that expects that a fully connected network is maintained may
    vary, but they might misbehave in very subtle hard to detect
    ways during such a partitioning. In order to prevent such
    issues, we have introduced a prevent overlapping partitions fix
    which can be enabled using the prevent_overlapping_partitions
    kernel(6) parameter. When this fix has been enabled, global
    will actively disconnect from nodes that reports that they have
    lost connections to other nodes. This will cause fully
    connected partitions to form instead of leaving the network in
    a state with overlapping partitions. Note that this fix has to
    be enabled on all nodes in the network in order to work
    properly. Since this quite substantially changes the behavior,
    this fix is currently disabled by default. Since you might get
    hard to detect issues without this fix you are, however,
    strongly advised to enable this fix in order to avoid issues
    such as the ones described above. As of OTP 25 this fix will
    become enabled by default.
  * erts: Corrected the type specification of erlang:seq_trace/2.
  * erts: Fix memory leak when tracing on running on a process that
    only handle system tasks or non-message signals (for example
    process_info requests).
  * erts: Add support for using socket:sockaddr_in() and
    socket:sockaddr_in6() when using gen_sctp, gen_tcp and gen_udp.
    This will make it possible to use Link Local IPv6 addresses.
  * erts: Show on_load failure reasons in embedded mode.
  * erts: Compile date saved in the Erlang VM executable has been
    removed.
  * erts: Improve documentation for the dynamic node name feature.
  * ssh: Fix makefile dependency bugs.
  * ssh: Fixed faulty OpenSSH decoding of Ed25519/Ed448 keys in the
    OpenSSH format openssh_key_v1.
  * ssh: Correction of ssh_file typing, specially for the
    experimental openssh-key-v1 encoding.
  * ssh: Improper tag for private ED keys when encoding with
    ssh:encode/2. The tuple had ed_priv as first element, but
    should have had ed_pri. This is now corrected. *** POTENTIAL
    INCOMPATIBILITY ***
  * ssh: Add support for Ed25519/Ed448 SSH host keys in the RFC
    4716 format ("-----BEGIN EC PRIVATE KEY-----") generated by for
    example openssl or via Erlang functions (i.e.
    public_key:generate_key({namedCurve, ed25519})). Ed25519 SSH
    host keys generated by ssh-keygen was, and are still,
    supported.
  * kernel: Handling of send_timeout for gen_tcp has been corrected
    so that the timeout is honored also when sending 0 bytes.
  * kernel: By default global does not take any actions to restore
    a fully connected network when connections are lost due to
    network issues. This is problematic for all applications
    expecting a fully connected network to be provided, such as for
    example mnesia, but also for global itself. A network of
    overlapping partitions might cause the internal state of global
    to become inconsistent. Such an inconsistency can remain even
    after such partitions have been brought together to form a
    fully connected network again. The effect on other applications
    that expects that a fully connected network is maintained may
    vary, but they might misbehave in very subtle hard to detect
    ways during such a partitioning. In order to prevent such
    issues, we have introduced a prevent overlapping partitions fix
    which can be enabled using the prevent_overlapping_partitions
    kernel(6) parameter. When this fix has been enabled, global
    will actively disconnect from nodes that reports that they have
    lost connections to other nodes. This will cause fully
    connected partitions to form instead of leaving the network in
    a state with overlapping partitions. Note that this fix has to
    be enabled on all nodes in the network in order to work
    properly. Since this quite substantially changes the behavior,
    this fix is currently disabled by default. Since you might get
    hard to detect issues without this fix you are, however,
    strongly advised to enable this fix in order to avoid issues
    such as the ones described above. As of OTP 25 this fix will
    become enabled by default.
  * kernel: Fix bug where logger would crash when logging a report
    including improper lists.
  * kernel: Make erlang:set_cookie work for dynamic node names.
  * kernel: Add support for using socket:sockaddr_in() and
    socket:sockaddr_in6() when using gen_sctp, gen_tcp and gen_udp.
    This will make it possible to use Link Local IPv6 addresses.
  * kernel: A net_tickintensity kernel parameter has been
    introduced. It can be used to control the amount of ticks
    during a net_ticktime period. A new net_kernel:start/2 function
    has also been introduced in order to make it easier to add new
    options. The use of net_kernel:start/1 has been deprecated.
  * kernel: Improve documentation for the dynamic node name
    feature.
  * erl_docgen: Fix css for large tables and images on small
    screens
  * erl_docgen: Fix bug with codeinclude tag that caused it to not
    include the code if used in a correct, but unexpected way.
  * observer: Calculate the display width in etop, instead of hard-
    coding it to 89 characters.
  * debugger: Fix record index matching, it was broken and could
    never match.
  * ssl: Improved error handling.
  * ssl: Before this change, net_kernel used with TLS distribution
    might be leaking processes in case of connectivity issues.
  * ssl: Fix makefile dependency bugs.
  * ssl: Make sure the TLS sender process handles explicit calls to
    erlang:disconnect_node properly, avoiding potential hanging
    problems in net_kernel.
  * ssl: Add support for TLS-1.3 certificate_authorities extension.
    And process certificate_authorities field in pre-TLS-1.3
    certificate requests.
  * ssl: Support password fun for protected keyfiles in ssl:connect
    function.
  * ssl: Add in some cases earlier detection of possible DoS
    attacks by malicious clients sending unexpected TLS messages
    instead of the client hello. Note that such attacks are already
    mitigated by providing a timeout for the TLS handshake.
  * eldap: Fix eldap extensibleMatch dnAttributes option. According
    to the ldap ASN1 the dnAttributes should be a bool, instead it
    was generated as a string.
  * eldap: Implemented paged searches according to https://www.rfc-
    editor.org/rfc/rfc2696.txt
  * public_key: Support password fun for protected keyfiles in
    ssl:connect function.
  * stdlib: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.
  * mnesia: Reduce the number of locks taken during table copying,
    should reduce the startup time on large systems.
  * diameter: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1649246400">- Fix build for Factory. Currently, any Java version
  is fine for Erlang.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1653220800">- Version 25.0:
  - stdlib
  * New function filelib:ensure_path/1 will ensure that all
    directories for the given path exists
  * New functions groups_from_list/2 and groups_from_list/3 in
    the maps module
  * New functions uniq/1 uniq/2 in the lists module
  * New PRNG added to the rand module, for fast pseudo-random
    numers.
  - compiler, kernel, stdlib, syntax_tools:
  * Added support for selectable features as described in EEP-60.
    Features can be enabled/disabled during compilation with
    options (ordinary and +term) to erlc as well as with
    directives in the file. Similar options can be used to erl
    for enabling/disabling features allowed at runtime. The new
    maybe expression EEP-49 is fully supported as the feature
    maybe_expr.
  - erts &amp; JIT:
  * The JIT now works for 64-bit ARM processors.
  * The JIT now does type-based optimizations based on type
    information in the BEAM files.
  * Improved the JIT’s support for external tools like perf and
    gdb, allowing them to show line numbers and even the original
    Erlang source code when that can be found.
  - erts, stdlib, kernel:
  * Users can now configure ETS tables with the
    {write_concurrency, auto} option. This option forces tables
    to automatically change the number of locks that are used at
    run-time depending on how much concurrency is detected. The
    {decentralized_counters, true} option is enabled by default
    when {write_concurrency, auto} is active.
  * Benchmark results comparing this option with the other ETS
    optimization options are available here: benchmarks.
  * To enable more optimizations, BEAM files compiled with OTP 21
    and earlier cannot be loaded in OTP 25.
  * The signal queue of a process with the process flag
    message_queue_data=off_heap has been optimized to allow
    parallel reception of signals from multiple processes. This
    can improve performance when many processes are sending in
    parallel to one process. See benchmark.
  * The Erlang installation directory is now relocatable on the
    file system given that the paths in the installation’s
    RELEASES file are paths that are relative to the
    installations root directory.
  * A new option called short has been added to the functions
    erlang:float_to_list/2 and erlang:float_to_binary/2. This
    option creates the shortest correctly rounded string
    representation of the given float that can be converted back
    to the same float again.
  * Introduction of quote/1 and unquote/1 functions in the
    uri_string module - a replacement for the deprecated
    functions http_uri:encode and http_uri:decode.
  * The new module peer supersedes the slave module. The slave
    module is now deprecated and will be removed in OTP 27.
  * global will now by default prevent overlapping partitions due
    to network issues. This is done by actively disconnecting
    from nodes that reports that they have lost connections to
    other nodes. This will cause fully connected partitions to
    form instead of leaving the network in a state with
    overlapping partitions.
  * It is possible to turn off the new behavior by setting the
    the kernel configuration parameter
    prevent_overlapping_partitions to false. Doing this will
    retain the same behavior as in OTP 24 and earlier.
  * The format_status/2 callback for gen_server, gen_statem and
    gen_event has been deprecated in favor of the new
    format_status/1 callback.
  * The new callback adds the possibility to limit and change
    many more things than the just the state.
  * The timer module has been modernized and made more efficient,
    which makes the timer server less susceptible to being
    overloaded. The timer:sleep/1 function now accepts an
    arbitrarily large integer.
  - compiler:
  * The maybe ... end construction as proposed in EEP-49 has been
    implemented. It can simplify complex code where otherwise
    deeply nested cases would have to be used.
  * To enable maybe, give the option {enable_feature,maybe_expr}
    to the compiler. The exact option to use will change in a
    coming release candidate and then it will also be possible to
    use from inside the module being compiled.
  * When a record matching or record update fails, a {badrecord,
    ExpectedRecordTag} exception used to be raised. In this
    release, the exception has been changed to {badrecord,
    ActualValue}, where ActualValue is the value that was found
    instead of the expected record.
  * Add compile attribute -nifs() to empower compiler and loader
    with information about which functions may be overridden as
    NIFs by erlang:load_nif/2.
  * Improved and more detailed error messages when binary
    construction with the binary syntax fails. This applies both
    for error messages in the shell and for
    erl_error:format_exception/3,4.
  * Change format of feature options and directives for better
    consistency. Options to erlc and the -compile(..) directive
    now has the format {feature, feature-name, enable | disable}.
    The -feature(..) now has the format -feature(feature-name,
    enable | disable).
  - crypto:
  * Add crypto:hash_equals/2 which is a constant time comparision
    of hashvalues.
  - ssl:
  * Introducing a new (still experimental) option
    {certs_keys,[cert_key_conf()]}. With this a list of a
    certificates with their associated key may be used to
    authenticate the client or the server. The certificate key
    pair that is considered best and matches negotiated
    parameters for the connection will be selected.
  - public_key:
  * Functions for retrieving OS provided CA-certs added.
  - dialyzer:
  * Optimize operations in the erl_types module. Parallelize the
    Dialyzer pass remote.
  * Added the missing_return and extra_return options to raise
    warnings when specifications differ from inferred types.
    These are similar to, but not quite as verbose as overspecs
    and underspecs.
  * Dialyzer now better understands the types for min/2, max/2,
    and erlang:raise/3. Because of that, Dialyzer can potentially
    generate new warnings. In particular, functions that use
    erlang:raise/3 could now need a spec with a no_return()
    return type to avoid an unwanted warning.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1656849600">- Changes for 25.0.2:
  * ssl: Improved handling of unexpected messages during the
    handshake, taking the right action for unexpected messages.
  * erts: On computers with the ARM64 (AArch64) architecture (such
    as Apple Silicon Macs) a rem expression followed by a div
    expression with the same operands could evaluate to the wrong
    result if the result of the rem expression was unused.
- Changes for 25.0.1:
  * ssl: When a TLS-1.3 enabled client tried to talk to a TLS-1.2
    server that coalesces TLS-1.2 handshake message over one TLS
    record, the connection could fail due to some message being
    handled in the wrong state, this has been fixed.
  * ssl: Correctly handles supported protocol version change from
    default to something else by sni_fun supplied to
    ssl:handshake/[2,3] together with a TCP-socket (so called
    upgrade).
  * ssl: Also, TLS-1.3 should respond with a protocol version alert
    if previous versions, that are supported but not configured,
    are attempted.
  * kernel: The DNS resolver inet_res has been fixed to ignore
    trailing dot difference in the request domain between the sent
    request and the received response, when validating a response.
  * kernel: A bug in inet_res has been fixed where a missing
    internal {ok,_} wrapper caused inet_res:resolve/* to return a
    calculated host name instead of an `{ok,Msg} tuple, when
    resolving an IP address or a host name that is an IP address
    string.
  * kernel: The erlang:is_alive() BIF could return true before
    configured distribution service was available. This bug was
    introduced in OTP 25.0 ERTS version 13.0. The
    erlang:monitor_node() and erlang:monitor() BIFs could
    erroneously fail even though configured distribution service
    was available. This occurred if these BIFs were called after
    the distribution had been started using dynamic node name
    assignment but before the name had been assigned.
  * kernel: Added the missing mandatory address/0 callback in the
    gen_tcp_dist example.
  * erts: A spawn_reply signal from a remote node could be delayed
    and be delivered after other signals from the newly spawned
    process. When this bug triggered, the connection to the node
    where the process was spawned sometimes could be taken down due
    to the bug. The following error message would then be logged if
    this happened: Missing 'spawn_reply' signal from the node
    &lt;RemoteNode&gt; detected by &lt;Pid&gt; on the node &lt;LocalNode&gt;. The
    node &lt;RemoteNode&gt; probably suffers from the bug with ticket id
    OTP-17737. This bug only affected processes which had enabled
    off_heap message_queue_data and parallel reception of signals
    had been automatically enabled. This bug was introduced in OTP
    25.0, ERTS version 13.0.
  * erts: Fixed type spec of erlang:system_info(dist_ctrl).
  * erts: The zlib built in to the runtime system has been updated
    to version 1.2.12. (Note that on most platforms, the platform's
    own zlib is used.)
  * erts: The erlang:is_alive() BIF could return true before
    configured distribution service was available. This bug was
    introduced in OTP 25.0 ERTS version 13.0. The
    erlang:monitor_node() and erlang:monitor() BIFs could
    erroneously fail even though configured distribution service
    was available. This occurred if these BIFs were called after
    the distribution had been started using dynamic node name
    assignment but before the name had been assigned.
  * crypto: Note in the documentation that MODP (rfc3526) groups
    and OpenSSL 3.0 can give an error if a call to
    crypto:generate_key/2 specifies a key length, and that length
    is to small.
  * crypto: The cmac now uses only the 3.0 API
  * crypto: Documentation is now updated with which OpenSSL
    cryptolib versions that OTP currently is tested.
  * dialyzer: Fixed the documentation for the missing_return and
    extra_return options.
  * mnesia: Fixed add_table_copy which could leave a table lock if
    the receiving node went down during the operation.
  * ssh: Binaries can be limited in logs with the parameter
    max_log_item_len. The default value is 500 bytes.
  * stdlib: In the initial release of Erlang/OTP 25, the expression
    bound to the _ pseudo-field in a record initialization would
    always be evaluated once, even if all other fields in the
    record were explicitly initialized. That would break the use
    case of binding the expression error(...) to _ in order to get
    an exception if not all fields were initialized. The behavior
    of binding to _ has been reverted to the pre-OTP 25 behavior,
    that is, to not evaluate the expression if all fields have been
    bound to explicit values.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1660046400">- Changes for 25.0.3:
  * erts: Distributed exit signals could be lost under the
    following conditions:
  * erts: A race could cause process_info(Pid, message_queue_len)
    on other processes to return invalid results.
  * erts: Fixed reduction counting for handling process system
    tasks.
  * erts: Priority elevation of terminating processes did not work
    which could cause execution of such processes to be delayed.
  * erts: An unlink operation made by a process that terminated
    before the unlink operation completed, i.e., before it had
    received an unlink-ack signal from the linked process, caused
    an exit signal to erroneously be sent from the terminating
    process to the process being unlinked. This exit signal would
    most often be ignored by the receiver, but if the receiver of
    the exit signal concurrently set up a new link, it could
    receive the exit signal with the actual exit reason of the
    terminating process instead of a noproc exit reason. It is
    however very hard to detect that this has happened and has no
    obvious negative consequences, so it should be considered
    harmless. A distributed unlink-ack signal received by a
    terminating process was also not properly removed which could
    cause a minor memory leak.
  * ssl: The link to crypto:engine_load refered the function with
    wrong arity.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1661601600">- Changes for 25.0.4:
  * kernel: A call to net_kernel:setopts(new, Opts) at the same
    time as a connection was being set up could cause a deadlock
    between the net_kernel process and the process setting up the
    connection.
  * erts: The monitor/3 BIF did not apply options to the created
    monitor if the target process or port did not exist. That is,
    the corresponding down message would get a `DOWN` tag even if a
    custom tag had been set, and the returned reference was not an
    alias even if the alias option had been passed.
  * erts: The erlang:monotonic_time/1, erlang:system_time/1,
    erlang:time_offset/1, and os:system_time/1 BIFs erroneously
    failed when passed the argument native.</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1665662400">- Changes for 25.1.1:
  * dialyzer: Dialyzer could crash when analyzing Elixir code that
    used intricate macros.
  * dialyzer: The --input_list_file option has been added.
  * ssl: Fixes handling of symlinks in cacertfile option.
  * eunit: With this change, eunit exact_execution option works
    with application primitive.
  * stdlib: peer nodes failed to halt when the process supervising
    the control connection crashed. When an alternative control
    connection was used, this supervision process also quite
    frequently crashed when the peer node was stopped by the node
    that started it which caused the peer node to linger without
    ever halting.
  * asn1: For the per and uper ASN.1 encoding rules, encoding and
    decoding the SEQUENCE OF and SET OF constructs with 16384 items
    or more is now supported.
  * erts: Listen sockets created with the socket module, leaked
    (erlang-) monitors.
  * erts: Notifications about available distribution data sent to
    distribution controller processes could be lost. Distribution
    controller processes can be used when implementing an
    alternative distribution carrier. The default distribution over
    tcp was not effected and the bug was also not present on
    x86/x86_64 platforms.
  * kernel: Listen sockets created with the socket module, leaked
    (erlang-) monitors.
  * kernel: peer nodes failed to halt when the process supervising
    the control connection crashed. When an alternative control
    connection was used, this supervision process also quite
    frequently crashed when the peer node was stopped by the node
    that started it which caused the peer node to linger without
    ever halting.
- Changes for 25.1:
  * dialyzer: Two bugs have been fixed in Dialyzer's checking of
    behaviors: When a mandatory callback function is present but
    not exported, Dialyzer would not complain about a missing
    callback. When an optional callback function was not exported
    and had incompatible arguments and/or the return values were
    incompatible, Dialyzer would complain. This has been changed to
    suppress the warning, because the function might not be
    intended to be a callback function, for instance if a release
    added a new optional callback function (such as format_status/1
    for the gen_server behaviour added in OTP 25).
  * dialyzer: The no_extra_return and no_missing_return warnings
    can now be suppressed through -dialyzer directives in source
    code.
  * jinterface: Fix javadoc build error by adding option -encoding
    UTF-8.
  * diameter: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * crypto: Fix configure with --with-ssl and --disable-dynamic-
    ssl-lib on Windows.
  * crypto: Remove all references correctly in the garbage
    collection if an engine handle was not explicit unloaded.
  * crypto: Changed the behaviour of the engine load/unload
    functions The engine load/unload functions have got changed
    semantics to get a more consistent behaviour and work correct
    when variables are garbage collected. The load functions now
    don't register the methods for the engine to replace. That will
    now be handled with the new functions
    engine_register/engine_unregister if needed. Some functions are
    removed from the documentation and therefor the API, but they
    are left in the code for compatibility. *** POTENTIAL
    INCOMPATIBILITY ***
  * crypto: Fixed a naming bug for AES-CFB and Blowfish-CFB/OFB
    when linked with OpenSSL 3.0 cryptolib.
  * crypto: Sign/verify does now behave as in OTP-24 and earlier
    for eddsa.
  * crypto: Pass elliptic curve names from crypto.erl to crypto's
    nif.
  * crypto: The configure option --disable-deprecated-warnings is
    removed. It was used for some releases when the support for
    OpenSSL 3.0 was not completed. It is not needed in OTP 25.
  * crypto: Crypto is now considered to be usable with the OpenSSL
    3.0 cryptolib for production code. ENGINE and FIPS are not yet
    fully functional.
  * crypto: Do not exit if the legacy provider is missing in
    libcrypto 3.0.
  * ssl: Reject unexpected application data in all relevant places
    for all TLS versions. Also, handle TLS-1.3 middlebox
    compatibility with more care. This will make malicious
    connections fail early and further, mitigate possible DoS
    attacks, that would be caught by the handshake timeout. Thanks
    to Aina Toky Rasoamanana and Olivier Levillain from Télécom
    SudParis for alerting us of the issues in our implementation.
  * ssl: With this change, value of cacertfile option will be
    adjusted before loading certs from the file. Adjustments
    include converting relative paths to absolute and converting
    symlinks to actual file path. Thanks to Marcus Johansson
  * ssl: In TLS-1.3, if chain certs are missing (so server auth
    domain adherence can not be determined) send peer cert and hope
    the server is able to recreate a chain in its auth domain.
  * ssl: Make sure periodical refresh of CA certificate files
    repopulates cache properly.
  * ssl: Correct internal CRL cache functions to use internal
    format consistently.
  * ssl: Incorrect handling of client middlebox negotiation for
    TLS-1.3 could result in that a TLS-1.3 server would not use
    middlebox mode although the client was expecting it too and
    failing the negotiation with unexpected message.
  * ssl: If the "User" process, the process starting the TLS
    connection, gets killed in the middle of spawning the dynamic
    connection tree make sure we do not leave any processes behind.
  * ssl: A vulnerability has been discovered and corrected. It is
    registered as CVE-2022-37026 "Client Authentication Bypass".
    Corrections have been released on the supported tracks with
    patches 23.3.4.15, 24.3.4.2, and 25.0.2. The vulnerability
    might also exist in older OTP versions. We recommend that
    impacted users upgrade to one of these versions or later on the
    respective tracks. OTP 25.1 would be an even better choice.
    Impacted are those who are running an ssl/tls/dtls server using
    the ssl application either directly or indirectly via other
    applications. For example via inets (httpd), cowboy, etc. Note
    that the vulnerability only affects servers that request client
    certification, that is sets the option {verify, verify_peer}.
    (bsc#1205318)
  * eunit: With this change, Eunit can optionally not try to
    execute related module with "_tests" suffix. This might be used
    for avoiding duplicated executions when source and test modules
    are located in the same folder.
  * erl_docgen: Update DTD to allow XML tag em under pre.
  * inets: Add httpc:ssl_verify_host_options/1 to help setting
    default ssl options for the https client.
  * inets: This change fixes dialyzer warnings generated for
    inets/httpd examples (includes needed adjustment of spec for
    ssh_sftp module).
  * inets: Remove documentation of no longer supported callback.
  * stdlib: Fixed inconsistency bugs in global due to
    nodeup/nodedown messages not being delivered before/after
    traffic over connections. Also fixed various other
    inconsistency bugs and deadlocks in both global_group and
    global. As building blocks for these fixes, a new BIF
    erlang:nodes/2 has been introduced and
    net_kernel:monitor_nodes/2 has been extended. The -hidden and
  - connect_all command line arguments did not work if multiple
    instances were present on the command line which has been
    fixed. The new kernel parameter connect_all has also been
    introduced in order to replace the -connect_all command line
    argument.
  * stdlib: Fix the public_key:ssh* functions to be listed under
    the correct release in the Removed Functionality User's Guide.
  * stdlib: The type spec for format_status/1 in gen_statem,
    gen_server and gen_event has been corrected to state that the
    return value is of the same type as the argument (instead of
    the same value as the argument).
  * stdlib: If the timer server child spec was already present in
    kernel_sup but it was not started, the timer server would fail
    to start with an {error, already_present} error instead of
    restarting the server.
  * stdlib: When changing callback module in gen_statem the
    state_enter calls flag from the old module was used in for the
    first event in the new module, which could confuse the new
    module and cause malfunction. This bug has been corrected. With
    this change some sys debug message formats have been modified,
    which can be a problem for debug code relying on the format.
  * ** POTENTIAL INCOMPATIBILITY ***
  * stdlib: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * stdlib: The rfc339_to_system_time/1,2 functions now allows the
    minutes part to be omitted from the time zone.
  * stdlib: The receive statement in gen_event has been optimized
    to not use selective receive (which was never needed, and could
    cause severe performance degradation under heavy load).
  * stdlib: Add new API function erl_features:configurable/0
  * parsetools: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * public_key: Support more Linux distributions in cacerts_load/0.
  * public_key: Correct asn1 typenames available in type
    pki_asn1_type()
  * public_key: Sign/verify does now behave as in OTP-24 and
    earlier for eddsa.
  * snmp: Improved the get-bulk response max size calculation. Its
    now possible to configure 'empty pdu size', see appendix c for
    more info.
  * snmp: Fix various example dialyzer issues
  * ssh: Handling rare race condition at channel close.
  * ssh: New ssh option no_auth_needed to skip the ssh
    authentication. Use with caution!
  * ssh: This change fixes dialyzer warnings generated for
    inets/httpd examples (includes needed adjustment of spec for
    ssh_sftp module).
  * ssh: The new function ssh:daemon_replace_options/2 makes it
    possible to change the Options in a running SSH server.
    Established connections are not affected, only those created
    after the call to this new function.
  * ssh: Add a timeout as option max_initial_idle_time. It closes a
    connection that does not allocate a channel within the timeout
    time. For more information about timeouts, see the Timeouts
    section in the User's Guide Hardening chapter.
  * observer: Fixed units in gui.
  * xmerl: There is a new configure option, --enable-deterministic-
    build, which will apply the deterministic compiler option when
    building Erlang/OTP. The deterministic option has been improved
    to eliminate more sources of non-determinism in several
    applications.
  * asn1: There is a new configure option, --enable-deterministic-
    build, which will apply the deterministic compiler option when
    building Erlang/OTP. The deterministic option has been improved
    to eliminate more sources of non-determinism in several
    applications.
  * erts: Fixed inconsistency bugs in global due to nodeup/nodedown
    messages not being delivered before/after traffic over
    connections. Also fixed various other inconsistency bugs and
    deadlocks in both global_group and global. As building blocks
    for these fixes, a new BIF erlang:nodes/2 has been introduced
    and net_kernel:monitor_nodes/2 has been extended. The -hidden
    and -connect_all command line arguments did not work if
    multiple instances were present on the command line which has
    been fixed. The new kernel parameter connect_all has also been
    introduced in order to replace the -connect_all command line
    argument.
  * erts: Fixed IPv6 multicast_if and membership socket options.
  * erts: Accept funs (NEW_FUN_EXT) with incorrectly encoded size
    field. This is a workaround for a bug (OTP-18104) existing in
    OTP 23 and 24 that could cause incorrect size fields in certain
    cases. The emulator does not use the decoded size field, but
    erl_interface still does and is not helped by this workaround.
  * erts: Fixed issue with inet:getifaddrs hanging on pure IPv6
    Windows
  * erts: Fix faulty distribution encoding of terms with either The
    symptom could be failed decoding on the receiving side leading
    to aborted connection. Fix OTP-18093 is a workaround for theses
    bugs that makes the VM accepts such faulty encoded funs. The
    first encoding bug toward pending connection exists only in OTP
    23 and 24, but the second one exists also on OTP 25.
  * erts: Fixed emulator crash that could happen during crashdump
    generation of ETS tables with options ordered_set and
    {write_concurrency,true}.
  * erts: Retrieval of monotonic and system clock resolution on
    MacOS could cause a crash and/or erroneous results.
  * erts: Fix bug where the max allowed size of erl +hmax was lower
    than what was allowed by process_flag.
  * erts: On computers with ARM64 (AArch64) processors, the JIT
    could generate incorrect code when more than 4095 bits were
    skipped at the tail end of a binary match.
  * erts: In rare circumstances, an is_binary/1 guard test could
    succeed when given a large integer.
  * erts: Fix bug causing ets:info (and sometimes ets:whereis) to
    return 'undefined' for an existing table if a concurrent
    process were doing ets:insert with a long list on the same
    table.
  * erts: Fix writing and reading of more than 2 GB in a single
    read/write operation on macOS. Before this fix attempting to
    read/write more than 2GB would result in {error,einval}.
  * erts: Fix bug sometimes causing emulator crash at node shutdown
    when there are pending connections. Only seen when running duel
    distribution protocols, inet_drv and inet_tls_dist.
  * erts: Yield when adjusting large process message queues due to
    The message queue adjustment work will now be interleaved with
    all other types of work that processes have to do, even other
    message queue adjustment work.
  * erts: Add rudimentary debug feature (option) for the inet-
    driver based sockets, such as gen_tcp and gen_udp.
  * erts: Introduced the hidden and dist_listen options to
    net_kernel:start/2. Also documented the -dist_listen command
    line argument which was erroneously documented as a kernel
    parameter and not as a command line argument.
  * erts: New documentation chapter "Debugging NIFs and Port
    Drivers" under Interoperability Tutorial.
  * erts: Add new API function erl_features:configurable/0
  * kernel: Fixed inconsistency bugs in global due to
    nodeup/nodedown messages not being delivered before/after
    traffic over connections. Also fixed various other
    inconsistency bugs and deadlocks in both global_group and
    global. As building blocks for these fixes, a new BIF
    erlang:nodes/2 has been introduced and
    net_kernel:monitor_nodes/2 has been extended. The -hidden and
  - connect_all command line arguments did not work if multiple
    instances were present on the command line which has been
    fixed. The new kernel parameter connect_all has also been
    introduced in order to replace the -connect_all command line
    argument.
  * kernel: Fixed IPv6 multicast_if and membership socket options.
  * kernel: Fixed issue with inet:getifaddrs hanging on pure IPv6
    Windows
  * kernel: The type specifications for inet:getopts/2 and
    inet:setopts/2 have been corrected regarding SCTP options.
  * kernel: The type specifications for inet:parse_* have been
    tightened.
  * kernel: Fix gen_tcp:connect/3 spec to include the inet_backend
    option.
  * kernel: Fix bug where using a binary as the format when calling
    logger:log(Level, Format, Args) (or any other logging function)
    would cause a crash or incorrect logging.
  * kernel: Add rudimentary debug feature (option) for the inet-
    driver based sockets, such as gen_tcp and gen_udp.
  * kernel: Introduced the hidden and dist_listen options to
    net_kernel:start/2. Also documented the -dist_listen command
    line argument which was erroneously documented as a kernel
    parameter and not as a command line argument.
  * kernel: Scope and group monitoring have been introduced in pg.
    For more information see the documentation of
    pg:monitor_scope(), pg:monitor(), and pg:demonitor().
  * kernel: A new function global:disconnect/0 has been introduced
    with which one can cleanly disconnect a node from all other
    nodes in a cluster of global nodes.
  * compiler: The compiler will now forbid using the empty atom ''
    as module name. Also forbidden are modules names containing
    control characters, and module names containing only spaces and
    soft hyphens.
  * compiler: The bin_opt_info and recv_opt_info options would
    cause the compiler to crash when attempting to compile
    generated code without location information.
  * compiler: In rare circumstances involving floating point
    operations, the compiler could terminate with an internal
    consistency check failure.
  * compiler: In rare circumstances when doing arithmetic
    instructions on non-numbers, the compiler could crash.
  * compiler: In rare circumstances, complex boolean expressions in
    nested cases could cause the compiler to crash.
  * compiler: Expression similar to #{assoc:=V} = #key=&gt;self()}, V
    would return the empty map instead of raising an exception.
  * compiler: Eliminated a crash in the beam_ssa_bool pass of the
    compiler when compiling a complex guard expression.
  * compiler: In rare circumstances, the compiler could crash with
    an internal consistency check failure.
  * compiler: When compiling with the option inline_list_funcs, the
    compiler could produce a nonsensical warning.
  * compiler: When given the no_ssa_opt option, the compiler could
    terminate with an internal consistency failure diagnostic when
    compiling map matching.
  * compiler: Made warnings for existing atoms being keywords in
    experimental features more precise, by not warning about quoted
    atoms.
  * compiler: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * megaco: Fixed various dialyzer related issues in the examples
    and the application proper.
  * megaco: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * common_test: Fix cth_surefire to handle when a suite is not
    compiled with debug_info. This bug has been present since
    Erlang/OTP 25.0.
  * common_test: Common Test now preserves stack traces for throws.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1669291200">- Changes for 25.1.2:
  * mnesia: Don't fill the logs if mnesia can't connect to all
    nodes, due to partitioned network.
  * erts: Add abandon carrier free utilization limit (+Muacful)
    option to erts_alloc. This option allows the user to mark
    unused segments in a memory carrier as re-useable by the OS if
    needed. This functionality was a non-configurable default
    before Erlang/OTP 25, but removed due to performance issues.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1671364800">- Changes for 25.2:
  * erts: Fix perf/gdb JIT symbols to not contain CodeInfoPrologue
    for the JIT internal module erts_beamasm.
  * erts: Fixed minor memory leaks.
  * erts: Fix bugs in ets:insert and ets:insert_new when called
    with a list of tuples to insert while a concurrent process
    either deletes or renames the table. The table deletion could
    be done with ets:delete/1 or be caused by termination of the
    table owning process. Symptoms are either VM crash or strange
    incorrect behavior from the insert operation. The risk of
    triggering the bugs increases with the length of the list of
    tuple to insert. Bugs exist since OTP 23.0.
  * erts: Boost execution of scheduled thread progress jobs. This
    to prevent memory exhaustion in extremely rapid
    allocation/deallocation scenarios, such as repeated ETS table
    creations/deletions.
  * erts: Fix segv crash during crash dumping an ETS table doing
    ets:delete_all_objects.
  * erts: Spec for function net:if_names/0 incorrect
  * erts: Fix bug in binary_to_term decoding a binary term 2Gbyte
    or larger.
  * erts: Documentation of erlang:module_loaded/1 has been
    adjusted:
  * erts: Fix list_to_atom/1 for negative code points. Could either
    return with a positive code point or fail with an incorrect
    exception.
  * erts: Fix rare bug causing VM crash when sending to a pid of a
    spawning process returned from erlang:processes/0. Only seen
    when provoked by system process literal_area_collector,
    triggered by a module purge operation, on a VM started with
    +Meamin (no customized allocators).
  * erts: gen_udp:open/2 with option(s) add_membership or
    drop_membership would drop earlier options.
  * erts: The inet:setopts/2 {reuseaddr, true} option will now be
    ignored on Windows unless the socket is an UDP socket. For more
    information see the documentation of the reuseaddr option part
    of the documentation of inet:setopts/2. Prior to OTP 25 the
    {reuseaddr, true} option was ignored for all sockets on
    Windows, but as of OTP 25.0 this was changed so that it was not
    ignored for any sockets. *** POTENTIAL INCOMPATIBILITY ***
  * erts: Fix bug in binary_to_term decoding a list of length 1G or
    longer.
  * erts: Fix bug in binary_to_term (and distributed receive) when
    decoding a large map (&gt;32 keys) with unsorted small maps (&lt;=
    32) as keys of the large map. This was only a problem if the
    term was encoded by erl_interface, jinterface or otherwise, as
    the VM itself always encodes small maps with sorted keys. The
    "binary_to_term" would appear as successful but the created
    large map was internally inconsistent. The smaller key-maps
    could not be found with maps:get and friends. Other operations
    such as map compare and merge could probably also give
    incorrect results.
  * erts: Fix Windows bug in open_port({spawn, Command}, ..) when
    Command is found via the OS search PATH and that directory path
    contains white spaces. The port program would start but the
    command line arguments to it could be incorrect.
  * ftp: fix unexpected result ok when calling ftp:nlist repeatedly
  * inets: This change allows body requests to httpc:request/5 be
    an iolist()
  * inets: addition of type specs in httpc.erl
  * inets: httpc: Add support for HTTP 308 status code
  * dialyzer: Dialyzer would crash when attempting to analyze a bit
    syntax segment size having an literal non-integer size such as
    [].
  * dialyzer: Dialyzer could crash when trying to analyze a
    convoluted nested expression involving funs,
  * kernel: Fixed shutdown crash in gen_tcp socket backend, when
    the other end closed the socket.
  * kernel: erl_tar can now read gzip-compressed tar files that are
    padded. There is a new option compressed_one for file:open/2
    that will read a single member from a gzip file,
  * kernel: Fix os:cmd to not translate all exceptions thrown to
    badarg. For example emfile from erlang:open_port was translated
    to badarg. This bug has existed since Erlang/OTP 24.
  * kernel: Spec for function net:if_names/0 incorrect
  * kernel: Missing ctrl option name transation for TOS and TTL (on
    FreeBSD) when using gen_udp with the 'socket' inet_backend.
  * kernel: gen_udp:open/2 with option(s) add_membership or
    drop_membership would drop earlier options.
  * kernel: The inet:setopts/2 {reuseaddr, true} option will now be
    ignored on Windows unless the socket is an UDP socket. For more
    information see the documentation of the reuseaddr option part
    of the documentation of inet:setopts/2. Prior to OTP 25 the
    {reuseaddr, true} option was ignored for all sockets on
    Windows, but as of OTP 25.0 this was changed so that it was not
    ignored for any sockets. *** POTENTIAL INCOMPATIBILITY ***
  * kernel: The distribution socket option handling in
    inet_tcp_dist has been cleaned up to clarify which were
    mandatory and which just had default values.
  * kernel: Improve warning message format for gen_tcp_socket.
  * snmp: Explicitly close the socket(s) when terminating
    (default-) net-if process.
  * stdlib: erl_tar can now read gzip-compressed tar files that are
    padded. There is a new option compressed_one for file:open/2
    that will read a single member from a gzip file,
  * stdlib: A concurrent call to ets:rename could cause
    ets:delete_all_objects to fail halfway through with badarg.
  * stdlib: It is not allowed to call functions from guards. The
    compiler failed to reject a call in a guard when done by
    constructing a record with a default initialization expression
    that called a function.
  * stdlib: The compiler could crash when using a record with
    complex field initialization expression as a filter in a list
    comprehension.
  * stdlib: unicode:characters_to_binary() could build
    unnecessarily large call stack.
  * stdlib: Improve error message for ets:new/2 name clash. Say
    "name already exists" instead of less specific "invalid
    options".
  * mnesia: Fixed crash which could happen during startup if too
    many decisions where sent from remote nodes.
  * os_mon: The disk_space_check_interval configuration parameter
    of disksup can now be set to values smaller than a minute.
  * ssh: graceful shutdown of ssh_conection_handler when connection
    is closed by peer
  * common_test: Fix starting of peer nodes on old releases when
    the compile server was active and the current Erlang
    installation contained non-latin1 characters in its path.
  * public_key: Disregard LDAP URIs when HTTP URIs are expected.
  * ssl: With this change, tls_sender process is hibernated after
    sufficient inactivity.
  * ssl: Correct handling of legacy schemes so that ECDSA certs
    using sha1 may be used for some TLS-1.3 configurations.
  * ssl: With this change, tls_sender does not cause logger crash
    upon key update.
  * ssl: Enhance warning message
  * ssl: Provide server option to make certificate_authorities
    extension in the TLS-1.3 servers certificate request optional.
    This will allow clients to send incomplete chains that may be
    reconstructable and thereby verifiable by the server, but that
    would not adhere to the certificate_authorities extension.
  * ssl: If the verify_fun handles four arguments the DER cert will
    be supplied as one of the arguments.
  * megaco: A very minor improvement to the measurement tool.
  * observer: A WX event race could causes a crash in when handling
    socket or port info.
  * observer: Improve the nodes menu to include more nodes.
  * compiler: Line number in compiler messages would be truncated
    to 4 digits for line numbers greater than 9999.
  * compiler: In rare circumstance, matching a binary as part of a
    receive clause could cause the compiler to terminate because of
    an internal consistency check failure.
  * compiler: Compiling a function with complex bit syntax matching
    such as f(&lt;&lt;X:0, _:X&gt;&gt;, &lt;&lt;Y:0, _:Y&gt;&gt;) -&gt; ok. could crash the
    compiler.
  * compiler: It is not allowed to call functions from guards. The
    compiler failed to reject a call in a guard when done by
    constructing a record with a default initialization expression
    that called a function.
  * compiler: The compiler could crash when using a record with
    complex field initialization expression as a filter in a list
    comprehension.
  * wx: Added environment variable WX_MACOS_NON_GUI_APP to allow
    user to override OSXIsGUIApplication behavior.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1679745600">- Changes for 25.3:
  * reltool: Fixed a bug that would cause analysis to crash.
  * stdlib: Fixed a bug that would cause analysis to crash.
  * stdlib: Fixed a crash when formatting stack traces for error
    reports.
  * stdlib: Instead of crashing, the list_to_integer/1 and
    list_to_integer/2 BIFs now raise the system_limit exception for
    overlong lists that can't be converted to integers. Similarly,
    the string:to_integer/1 BIF now returns {error,system_limit}
    for overlong lists.
  * stdlib: Removal of non-necessary undefined types added to the
    state's supervisor record.
  * compiler: Fixed a bug that would cause the compiler to hang.
  * compiler: Fixed a crash when compiling code that contained
    maybe expressions.
  * compiler: Constructing a binary with an explicit size of all
    for a binary segment would crash the compiler.
  * compiler: The compiler would generate incorrect code for the
    following type of expression: Pattern = BoundVar1 = . . . =
    BoundVarN = Expression An exception should be raised if any of
    the bound variables have different values than Expression. The
    compiler would generate code that would cause the bound
    variables to be bound to the value of Expressionwhether the
    value matched or not.
  * xmerl: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * megaco: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * debugger: Fixed a bug that would cause analysis to crash.
  * erts: Fixed a bug on Windows where file:read_file_info/1 would
    fail for files with corrupt metadata.
  * erts: Fix process_info(_, binary) to again include "writable
    binaries" which were lost in OTP-25.0. Writable binaries are an
    optimization used when binaries are appended upon in a loop.
  * erts: Fix rare race when receiving fragmented messages on a
    terminating connection. Could potentially cause memory leaks as
    well as double free crashes. Bug exists since OTP 22.0.
  * erts: Fixed bug that could maybe cause problems when a file
    descriptor number is closed by a linked in driver and then
    opened (reused) and passed to enif_select by a NIF. No actual
    symptoms seen, only failed internal assertions in debug build.
  * erts: The runtime system could crash when tracing a process
    executing on a dirty scheduler.
  * erts: In the binary syntax, attempting to match out integers
    with size exceeding 2 GiB could crash the runtime system.
  * erts: Fixed edge case in floating-point negation where A = 0.0,
    B = -A did not produce B = -0.0 on x86_64 JIT.
  * erts: Fixed an issue in the JIT that could crash the emulator
    on some platforms.
  * erts: Added meta data to the windows installer.
  * erts: Fixed ETS insertion order into bag and duplicate_bag of
    tuples with identical keys when passed in a list to
    ets:insert/2. The insert order has been head-to-tail but was
    accidentally changed in OTP 23.0. For bag it was reverted
    (tail-to-head), while for duplicate_bag it was sometimes
    reverted depending on the length of the list and number of
    "reductions" left for the calling process. This fix changes the
    insert order of ets:insert/2 back to always be head-to-tail of
    the list argument.
  * erts: With the JIT for AArch64 (AMD64), calling bxor in with
    non-integer arguments in a guard would crash the runtime
    system.
  * erts: Fix bug regarding process flag max_heap_size. Could cause
    strange behavior when a process was killed due to exceeding the
    limit.
  * erts: Fixed binary comprehensions to be similar to other
    creation of binary data with respect to its contribution of
    triggering garbage collection.
  * erts: In rare circumstances, when a process exceeded its
    allowed heap size set by option max_heap_size, it would not be
    killed as it should be, but instead enter a kind of zombie
    state it would never get out of.
  * erts: Instead of crashing, the list_to_integer/1 and
    list_to_integer/2 BIFs now raise the system_limit exception for
    overlong lists that can't be converted to integers. Similarly,
    the string:to_integer/1 BIF now returns {error,system_limit}
    for overlong lists.
  * erts: Active process aliases of a process at its termination
    leaked memory.
  * erts: Support for fully asynchronous distributed signaling
    where send operations never block. This functionality is by
    default disabled and can be enabled per process. For more
    information see the documentation of process_flag(async_dist,
    Bool).
  * erts: Added the +JPperf no_fp option to explicitly disable
    Erlang frame pointers otherwise added when using the +JPperf
    map option.
  * erl_interface: Accept connection setup from OTP 23 and 24 nodes
    that are not using epmd.
  * erl_interface: The ei API for decoding/encoding terms is not
    fully 64-bit compatible since terms that have a representation
    on the external term format larger than 2 GB cannot be handled.
  * syntax_tools: erl_syntax_lib:annotate_bindings/1,2 will now
    properly annotate named functions and their arguments.
  * kernel: Fixed a bug on Windows where file:read_file_info/1
    would fail for files with corrupt metadata.
  * kernel: Accept connection setup from OTP 23 and 24 nodes that
    are not using epmd.
  * public_key: As different solutions of verifying certificate
    revocation exists move the decode of 'CRLDistributionPoints' so
    that it will only be decode. When it is actually used in the
    verification process. This would enable interoperability with
    systems that use certificates with an invalid empty
    CRLDistributionPoints extension that they want to ignore and
    make verification by other means.
  * public_key: public_key:pkix_path_validation validates
    certificates expiring after 2050
  * public_key: Do not leave exit message in message queue after
    calling cacerts_load() on MacOS.
  * public_key: Replace size/1 with either tuple_size/1 or
    byte_size/1 The size/1 BIF is not optimized by the JIT, and its
    use can result in worse types for Dialyzer. When one knows that
    the value being tested must be a tuple, tuple_size/1 should
    always be preferred. When one knows that the value being tested
    must be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * ssl: Fixed that new dtls connections from the same client ip
    port combination works. If there is a process waiting for
    accept the new connection will connect to that, otherwise it
    will try to re-connect to the old server connection.
  * ssl: When shutting down a node that uses SSL distribution
    (-proto_dist inet_tls), a confusing error message about an
    unexpected process exit was printed. This particular message is
    no longer generated.
  * ssl: fixes the type spec for ssl:format_error/1
  * ssl: Replace size/1 with either tuple_size/1 or byte_size/1 The
    size/1 BIF is not optimized by the JIT, and its use can result
    in worse types for Dialyzer. When one knows that the value
    being tested must be a tuple, tuple_size/1 should always be
    preferred. When one knows that the value being tested must be a
    binary, byte_size/1 should be preferred. However, byte_size/1
    also accepts a bitstring (rounding up size to a whole number of
    bytes), so one must make sure that the call to byte_size/ is
    preceded by a call to is_binary/1 to ensure that bitstrings are
    rejected. Note that the compiler removes redundant calls to
    is_binary/1, so if one is not sure whether previous code had
    made sure that the argument is a binary, it does not harm to
    add an is_binary/1 test immediately before the call to
    byte_size/1.
  * jinterface: Accept connection setup from OTP 23 and 24 nodes
    that are not using epmd.
  * os_mon: The port programs used by cpu_sup and memsup are now
    gracefully shut down when cpu_sup and memsup are shut down.
  * eunit: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * crypto: A user defined runtime library path configured using
  - -with-ssl-rpath=&lt;PATHS&gt; could fail to be enabled.
  * crypto: Ensure that configure fails if a user defined runtime
    library path has been passed by the user, but cannot set.
  * mnesia: Improved consistency for dirty writes when a table was
    added with add_table_copy/3. Fixed a problem with sticky write,
    which could lead to inconsistent data.
  * mnesia: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * common_test: Renamed undocumented macro CT_PEER/3 to
    CT_PEER_REL/3.
  * ssh: With this change, PKCS8 formatted private key file is
    properly decoded and SSH daemon with such key can be started.
  * ssh: Replace size/1 with either tuple_size/1 or byte_size/1 The
    size/1 BIF is not optimized by the JIT, and its use can result
    in worse types for Dialyzer. When one knows that the value
    being tested must be a tuple, tuple_size/1 should always be
    preferred. When one knows that the value being tested must be a
    binary, byte_size/1 should be preferred. However, byte_size/1
    also accepts a bitstring (rounding up size to a whole number of
    bytes), so one must make sure that the call to byte_size/ is
    preceded by a call to is_binary/1 to ensure that bitstrings are
    rejected. Note that the compiler removes redundant calls to
    is_binary/1, so if one is not sure whether previous code had
    made sure that the argument is a binary, it does not harm to
    add an is_binary/1 test immediately before the call to
    byte_size/1.
  * inets: With this change, handling of URI to a folder, with
    missing trailing / and a query component present is fixed.
  * inets: Adds more type information to the inets app, thus
    improving the errors that static analysis tools can detect. The
    addition of type information to records and the updates to
    function heads help static analysis tools to understand that
    some values in the records cannot be 'undefined', thus making
    static tools to type check correctly more modules in the inets
    app
  * inets: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * snmp: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * ftp: Replace size/1 with either tuple_size/1 or byte_size/1 The
    size/1 BIF is not optimized by the JIT, and its use can result
    in worse types for Dialyzer. When one knows that the value
    being tested must be a tuple, tuple_size/1 should always be
    preferred. When one knows that the value being tested must be a
    binary, byte_size/1 should be preferred. However, byte_size/1
    also accepts a bitstring (rounding up size to a whole number of
    bytes), so one must make sure that the call to byte_size/ is
    preceded by a call to is_binary/1 to ensure that bitstrings are
    rejected. Note that the compiler removes redundant calls to
    is_binary/1, so if one is not sure whether previous code had
    made sure that the argument is a binary, it does not harm to
    add an is_binary/1 test immediately before the call to
    byte_size/1.
  * dialyzer: Fixed a bug that would cause analysis to crash.
  * dialyzer: Replace size/1 with either tuple_size/1 or
    byte_size/1 The size/1 BIF is not optimized by the JIT, and its
    use can result in worse types for Dialyzer. When one knows that
    the value being tested must be a tuple, tuple_size/1 should
    always be preferred. When one knows that the value being tested
    must be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * tftp: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
- Changes for 25.2.3:
  * erts: Comparisons between small numbers and pids or ports would
    in some edge cases say that the number was greater than the pid
    or port, violating the term order.
  * erts: process_info(Pid, status) when Pid /= self() could return
    an erroneous result.
  * ssl: Maximize compatibility by ignoring change_cipher_spec
    during handshake even if middle_box_mode is not negotiated
    (mandated by client)
  * ssl: Move assert of middlebox message after an
    hello_retry_request to maximize interoperability. Does not
    changes semantics of the protocol only allows unexpected
    message delay from server.
  * ssh: With this change, ssh application does not crash when
    formatting some of info reports for unsuccessful connections.
  * ssh: With this change, ssh does not log extensively long
    messages.
  * inets: Ensure graceful shutdown
  * inets: Return type of the type specification for function
    httpc:cookie_header/{1,2,3} has been fixed from -spec
    cookie_header(url()) -&gt; [{ field(), value() }] | {error,
    Reason} to -spec cookie_header(url()) -&gt; { field(), value() } |
    {error, Reason}
- Changes for 25.2.2:
  * ftp: Fixes calls to ftp:nlist/2 returning {error, epath} when
    the file / folder exists
- Changes for 25.2.1:
  * compiler: Fixed a bug that could cause legal code to fail
    validation.
  * compiler: Eliminated a rare crash in the beam_types module.
  * erts: Fixed a bug in selective receive optimization that could
    crash 32-bit emulators.
  * erts: A race condition which was very rarely triggered could
    cause the signal queue of a process to become inconsistent
    causing the runtime system to crash.
  * kernel: The tcp connect option 'bind_to_device' could not be
    used with inet_backend = 'socket'. 'inet' requires value type
    binarry() and 'socket' requires value type 'string()'.
  * kernel: Minor issue processing options when calling
    gen_tcp:connect with a sockaddr() and inet_backend = socket.
  * common_test: Change timeout to infinity for gen_server calls in
    cth_log_redirect
  * inets: fixes a missing case of the type specification for
    httpd:info/2/3/4
  * snmp: Single threaded agent crash when vacm table not properly
    initiated.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1683460800">- Changes for 25.3.2:
  * compiler: Fixed type handling bugs that could cause an internal
    error in the compiler for correct code.
  * os_mon: Avoid error report from failing erlang:port_close at
    shutdown of cpu_sup and memsup. Bug exists since OTP 25.3
    (os_mon-2.8.1).
  * erts: If a runtime system which was starting the distribution
    already had existing pids, ports, or references referring to a
    node with the same nodename/creation pair that the runtime
    system was about to use, these already existing pids, ports, or
    references would not work as expected in various situations
    after the node had gone alive. This could only occur if the
    runtime system was communicated such pids, ports, or references
    prior to the distribution was started. That is, it was
    extremely unlikely to happen unless the distribution was
    started dynamically and was even then very unlikely to happen.
    The runtime system now checks for already existing pids, ports,
    and references with the same nodename/creation pair that it is
    about to use. If such are found another creation will be chosen
    in order to avoid these issues.
- Changes for 25.3.1:
  * snmp: Attempts to minimize the number of the error reports
    during a failed agent init.
  * compiler: When a map update such as #{}#{key:=value} that
    should fail with an exception was unused, the exception would
    be lost.
  * compiler: Fixed bug in the validator that made it reject valid
    code.
  * crypto: With this change, random errors are fixed for
    crypto:generate_key calls with OpenSSL 3.
  * erts: Fixed a bug in the loader that prevented certain modules
    compiled with no_ssa_opt from being loaded.
  * erts: Implementations of the call() driver callback that
    returned a faulty encoded result could cause a memory leak and
    could cause invalid data on the heap of the processes calling
    erlang:port_call/3.
  * erts: Fixed a memory corruption issue when upgrading code. The
    bug was introduced in OTP 25.3
  * erts: Fixed configure tests for a few ARM-specific
    instructions, which prevented the emulator from being built on
    some platforms.
  * erts: Aliases created in combination with a monitor using the
    {alias, explicit_unalias} option stopped working from remote
    nodes when a 'DOWN' signal had been received due to the monitor
    or if the monitor was removed using the erlang:demonitor() BIF.
    This bug was introduced in OTP 24.3.4.10 and OTP 25.3.
  * erts: In rare circumstances, bit syntax matching of an invalid
    code point for a utf32 would crash the runtime system.
  * erts: Building the runtime system failed when native atomic
    support was missing. Note that execution on such systems have
    only been rudimentary tested.
  * erl_interface: Fixed configure tests for a few ARM-specific
    instructions, which prevented the emulator from being built on
    some platforms.
  * eldap: Added a new function eldap:info/1 that returns the
    socket and the transport protocol for the eldap connection.
  * inets: Correct timing related pipelining/keepalive queue bug,
    that could result in unexpected "socket_remotly_closed" errors.
  * inets: With this change, upon remote socket closure current
    request is added to a retried queue (either pipeline or
    keep_alive, but not both).
  * ssl: With this change, ssl:connection_information/2 returns
    correct keylog data after TLS1.3 key update.
  * ssl: Client signature algorithm list input order is now honored
    again , it was accidently reversed by a previous fix.
  * stdlib: The type specs in the erl_parse module has been updated
    to include the maybe construct and the ! operator.
  * wx: Improve debug prints from the nifs. Some minor fixes for
    wxWidgets-3.2. Fixed OpenGL debug functions.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1687521600">- Changes for 25.3.2.2:
  * compiler: The compiler could be very slow when compiling guards
    with multiple guard tests separated with 'or' or ';'.
- Changes for 25.3.2.1:
  * xmerl: New options to xmerl_scan and xmerl_sax_parser so one
    can limit the behaviour of the parsers to avoid some XML
    security issues. xmerl_scan gets one new option:
    xmerl_sax_parser gets the following options: The old option
    skip_external_dtd is still valid and the same as
    {external_entities, none} and {fail_undeclared_ref, false} but
    just affects DTD's and not other external references.
  * erts: Fixed a crash during tracing on certain platforms that
    cannot use the machine stack for Erlang code (mainly OpenBSD
    and Linux with musl).
  * erts: Constructing a binary segment not aligned with a byte
    boundary, with a size not fitting in 31 bits, and with a value
    not fitting in a 64-bit word could crash the runtime system.
  * erts: Further robustify implementation of large maps (&gt; 32
    keys). Keys that happen to have same internal 32-bit hash
    values are now put in collision nodes which are traversed with
    linear search. This removes the demand for the internal hash
    function when salted to eventually produce different hashes for
    all possible pairs of unequal terms.
  * stdlib: Static supervisors are very idle processes after they
    have started so they will now be hibernated after start to
    improve resource management.
  * compiler: Fixed a bug where a failing bsl expression in a guard
    threw an exception instead of causing the guard to fail.
  * compiler: Complex guard expression using the or operator and
    guard BIFs that can fail could sometimes be miscompiled so that
    the guard would succeed even if a call to a guard BIF failed.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1687608000">- Version 26.0:
  * Leex has been extended with optional column number support.
  * The family of enumeration functions in module lists has been
    extended with enumerate/3 that allows a step value to be
    supplied.
  * Update Unicode to version 15.0.0.
  * proc_lib:start*/* has become synchronous when the started
    process fails. This requires that a failing process use a new
    function proc_lib:init_fail/2,3, or exits, to indicate failure. All
    OTP behaviours have been fixed to do this.
  * auto-complete of variables, record names, record fields names,
    map keys, function parameter types and filenames.
  * Open external editor in the shell to edit the current
    expression.
  * defining records (with types), functions, specs and types in
    the shell.
  * Creation and matching of binaries with segments of fixed sizes
    have been optimized.
  * Creation and matching of UTF-8 segments have been optimized.
  * Appending to binaries has been optimized.
  * The compiler and JIT now generate better code for creation of
    small maps where all keys are literals known at compile time.
  * Thanks to the optimizations above the performance of the base64
    module has been significantly improved. For example, on an
    x86_64 system with the JIT both encode and decode are almost
    three times faster than in Erlang/OTP 25.
  * Map comprehensions as suggested in EEP 58 has now been
    implemented.
  * Some map operations have been optimized by changing the
    internal sort order of atom keys. This changes the
    (undocumented) order of how atom keys in small maps are printed
    and returned by maps:to_list/1 and maps:next/1. The new order
    is unpredictable and may change between different invocations
    of the Erlang VM.
  * Introducing the new function maps:iterator/2 for creating an
    interator that return the map elements in a deterministic
    order. There are also new modifiers k and K for the format
    string in io:format() to support printing map elements ordered.
  * Added the new built-in type dynamic() introduced in EEP 61, PR
    introducing EEP 61 improving support for gradual type checkers.
  * Dialyzer has a new incremental mode that be invoked by giving
    the --incremental option when running Dialyzer. This new
    incremental mode is likely to become the default in a future
    release.
  * Multi time warp mode is now enabled by default. This assumes
    that all code executing on the system is time warp safe.
  * Support for UTF-8 atoms and strings in the NIF interface
    including new functions enif_make_new_atom,
    enif_make_new_atom_len and enif_get_string_length.
  * The BIFs min/2 and max/2 are now allowed to be used in guards
    and match specs.
  * Improved the selective receive optimization, which can now be
    enabled for references returned from other functions. This
    greatly improves the performance of gen_server:send_request/3,
    gen_server:wait_response/2, and similar functions.
  * It is no longer necessary to enable a feature in the runtime
    system in order to load modules that are using it. It is
    sufficient to enable the feature in the compiler when compiling
    it.
  * inet:setopts/2 has got 3 new options: reuseport, reuseport_lb
    and exclusiveaddruse.
  * Fix so that -fno-omit-frame-pointer is applied to all of the
    Erlang VM when using the JIT so that tools, such as perf, can
    crawl the process stacks.
  * In the lists module, the zip family of functions now takes
    options to allow handling lists of different lengths.
  * Added the zip:zip_get_crc32/2 function to retrieve the CRC32
    checksum from an opened ZIP archive. gen_server optimized by
    caching callback functions
  * The modules Erlang DNS resolver inet_res and helper modules
    have been updated for RFC6891; to handle OPT RR with DNSSEC OK
    (DO) bit.
  * Introduced application:get_supervisor/1.
  * Cache OTP boot code paths, to limit how many folders that are
    being accessed during a module lookup. Can be disabled with
  - cache_boot_path false.
  * Support for Kernel TLS (kTLS), has been added to the SSL
    application, for TLS distribution (-proto_dist inet_tls), the
    SSL option {ktls, true}.
  * Improved error checking and handling of ssl options.
  * Mitigate memory usage from large certificate chains by lowering
    the maximum handshake size. This should not effect the common
    cases, if needed it can be configured to a higher value.
  * For security reasons the SHA1 and DSA algorithms are no longer
    among the default values.
  * Add encoding and decoding of use_srtp hello extension to
    facilitate for DTLS users to implement SRTP functionality.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1687608001">- Changes for 26.0.1:
  * erts: Build of the socket nif failed on Solaris 11.
  * erts: Fixed two reduction-counting bugs relating to binaries.
  * erts: Constructing a binary segment not aligned with a byte
    boundary, with a size not fitting in 31 bits, and with a value
    not fitting in a 64-bit word could crash the runtime system.
  * erts: When a binary construction failed because of bad size for
    a segment, the error information was not always correct.
  * erts: Fixed a crash when calling a fun that was defined in a
    module that had been upgraded.
  * kernel: The POSIX error exdev was sometimes incorrectly
    described as "cross domain link" in some error messages.
  * kernel: Corrected the socket send function description (send
    with Timeout = nowait). The send function(s) could not return
    {ok, {RestData, SelectInfo}}
  * stdlib: The POSIX error exdev was sometimes incorrectly
    described as "cross domain link" in some error messages.
  * ssl: Make sure that selection of client certificates handle
    both TLS-1.3 and TLS-1.2 names correctly. Could cause valid
    client certificate to not be selected, and an empty client
    certificate message to be sent to server.
  * ssl: Improved ssl:format_error/1 to handle more error tuples.
  * ssl: Fixed hanging ssl:connect when ssl application is not
    started.
  * ssl: Correct handling of retransmission timers, current
    behavior could cause unwanted delays.
  * inets: Do not make the default ssl options by calling
    httpc:ssl_verify_host_options(true) if ssl options are supplied
    by the user.
  * xmerl: New options to xmerl_scan and xmerl_sax_parser so one
    can limit the behaviour of the parsers to avoid some XML
    security issues. xmerl_scan gets one new option:
    xmerl_sax_parser gets the following options: The old option
    skip_external_dtd is still valid and the same as
    {external_entities, none} and {fail_undeclared_ref, false} but
    just affects DTD's and not other external references.
  * compiler: Fixed a bug where a failing bsl expression in a guard
    threw an exception instead of causing the guard to fail.
  * compiler: Fixed a bug that would case the validator to reject
    legal code.
  * compiler: The compiler could re-order clauses matching binaries
    so that the incorrect clause would match. That could only
    happen for code that used the option {error_location,line} or
    for code without line or column number information (e.g.
    generated by a parse transform).
  * compiler: Complex guard expression using the or operator and
    guard BIFs that can fail could sometimes be miscompiled so that
    the guard would succeed even if a call to a guard BIF failed.
  * compiler: With optimizations disabled, a try/catch construct
    could return an incorrect value.
  * compiler: In rare circumstance, a combination of binary
    construction and binary_part/3 would cause the compiler to
    generate unsafe code that would crash the runtime system.
  * compiler: The compiler could be very slow when compiling guards
    with multiple guard tests separated with 'or' or ';'.
  * compiler: Complex guard expressions using 'or' and map updates
    could succeed even if the map update failed.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1698235200">- Changes for 26.1.2:
  * erts: If the external term format encoding of an argument list
    part of a distributed spawn operation was faulty, the newly
    spawned remote process could misbehave. The misbehavior
    included hanging or interpret an incoming message as an
    argument list to use. This was very unlikely to happen unless
    using an alternate implementation of the distribution protocol
    which made a faulty encoding of the argument list. The child
    process will now detect this error and terminate before
    executing the user specified code.
  * erts: Fix bugs where if the body of a matchspec would return a
    map with a variable ('$1', '$_' etc) as one of the keys or
    values and the variable was not an immidiate, the term would
    not be copied to the receiving processes heap. This would later
    corrupt the term in the table as the GC could place move
    markers in it, which in turn would cause the VM to crash. Bug
    has been present for since OTP 17.0.
  * xmerl: The xmerl version 1.3.32 was released in OTP 26.0.1, but
    the incorrect version number of 1.3.31.1 was used for it. This
    incorrect version number continued to appear in OTP 26.0.2, OTP
    26.1, and OTP 26.1.1. The actual xmerl code in these OTP
    versions however corresponds to xmerl version 1.3.32.
- Changes for 26.1.1:
  * wx: The wx application would fail to build on macOS with Xcode
    15.
  * compiler: The compiler could become extremely slow for modules
    containing huge functions.
  * stdlib: Garbage collect the shell process when reducing the
    amount of saved history and results.
- Changes for 26.1:
  * crypto: Fix VM crash caused by crypto being purged and reloaded
    (by init:restart for example) on OS with musl libc (such as
    Alpine linux).
  * crypto: Improved understanding of LibreSSL versions. Support
    chacha20 and chacha20_poly1305 for LibreSSL 3.7. Reflect
    removal of support for the DSS/DSA algorithm which was done in
    LibreSSL 2.6.1.
  * crypto: FIPS supported by crypto for OpenSSL 3.0.* and 3.1.*.
  * asn1: The ASN.1 compiler would ignore a constraint such as
    (SIZE (1..4), ...), causing incorrect behavior of the encoding
    and decoding function for the PER and UPER backends. Corrected
    to handle the constraint in the same way as (SIZE (1..4, ...)).
  * asn1: The JER backend has been internally refactored in a way
    that is compatible for applications that use the documented
    API. However, for a group of ASN.1 modules that depend on each
    other (for example, S1AP-PDU-Descriptions, S1AP-Contents, and
    so on), all modules in the group must be recompiled if on of
    the group members is recompiled.
  * observer: Closing the trace log window via the menu did not
    work.
  * erts: maps:put with existing key and identical value was not
    optimized as a no-op correctly if having the same 32-bit hash
    as another key in the map. In practice very rare and harmless.
  * erts: Fixed an issue with truncated crash slogans on failed
    emulator start.
  * erts: Fixed a bug where the emulator was unable to determine
    the current cgroup CPU quota.
  * erts: A process optimized for parallel signal delivery could
    under some circumstances lose wakeup information. That is, the
    processes was not woken up to take care of the signal, so the
    signal would not be taken care of until the process was woken
    by another signal. Only processes configured with
    message_queue_data set to off_heap utilize this optimization.
  * erts: Function socket:close/1 could cause a VM crash on
    Windows.
  * erts: Fixed a bug in the ARM JIT where it could accidentally
    add garbage trailing bits when creating bitstrings whose size
    wasn't an even multiple of 8 bits.
  * erts: Fix erlang:system_info/1 documentation to show correct
    types.
  * erts: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * erts: Fix compilation with GNU termcap.
  * erts: Delivery time of message signals to a process not
    executing any receive expressions could become very long,
    potentially infinite. For example, a process checking for
    messages using process_info(self(), message_queue_len) or
    process_info(self(), messages) and avoiding to execute a
    receive expression matching on messages could be very slow in
    detecting new messages. Note that you are still discouraged
    from using process_info() this way. A process that wants to
    check if there are messages available to handle should execute
    a receive expression matching on messages.
  * erts: On AArch64 (ARM64), when calculating both the quotient
    and remainder with a divisor begin a power two, the remainder
    could be incorrectly calculated.
  * erts: Fix bug causing "magic" references in a compressed ETS
    table to not keep the referred object alive. The symptom would
    be the referred object being garbage collected prematurely and
    the reference appearing stale, not referring to anything.
    Examples of such magically referred objects are atomics and NIF
    resources.
  * erts: Matching out short bitstrings with a fixed size not
    divisible by 8 could could lead to the runtime system
    terminating with an "Overrun heap and stack" error.
  * erts: A constant flow of incoming non-message signals could
    prevent a process needing to execute dirty from doing so.
  * erts: A BEAM file usually contains a chunk with the tag "Type"
    containing type information that can be used by the JIT. The
    beam_lib:strip/1 takes care to preserve that chunk, but a
    build/release tool that does customized stripping could
    accidentally remove the chunk. Loading a BEAM file without the
    "Type" chunk could cause incorrect behavior of the loaded code.
  * erts: gen_udp:recv/* for Unix Domain Socket in binary mode and
    passive mode has been fixed to not crash.
  * erts: The cleanup operation of not yet delivered signals to a
    terminated process yielded excessively.
  * erts: Fixed minor hashing issue with the local option of
    term_to_binary()/term_to_iovec().
  * erts: Update gen_tcp_socket and gen_udp_socket to handle
    'completion' (socket on Windows).
  * erts: Add support for Unix Domain Sockets (only for STREAM
    sockets) on Windows for 'socket'.
  * erts: In Erlang/OTP 27, by default escripts will be compiled
    before being executed. That means that the compiler application
    must be installed. It is possible to force the escript to be
    interpreted by adding the directive -mode(interpret). to the
    escript file. In Erlang/OTP 28, support for interpreting an
    escript will be removed.
  * erts: Add basic support for socket ioctl on Windows.
  * erts: Removed erts/etc/darwin/Info.plist, as it is no longer
    necessary after macos 10.12
  * erts: Add support for (Windows) socket option exclusiveaddruse.
  * erts: [socket] Add support for the 'nopush' option.
  * erts: Add support for socket option 'BSP STATE'.
  * erts: Add tcp socket options 'keepcnt', 'keepidle' and
    'keepintvl'.
  * erts: Add support for misc (Windows) socket options
    ('max_msg_size' and 'maxdg').
  * compiler: The compiler could run forever when compiling a call
    to is_record/3 with a huge positive tuple size. The call
    is_record(A, a, 0) would crash the compiler when used in a
    function body. When used in a guard the compiler would emit
    incorrect code that would accept {a&gt; as a record.
  * compiler: Fixed a bug that caused dialyzer to crash when
    analyzing bogus code that contained the literal atom undefined
    in segment sizes.
  * compiler: The compiler would crash when compiling some modules
    that contained a call to erlang:load_nif/2.
  * compiler: Fixed a bug that caused the compiler to crash on
    legal code.
  * compiler: The compiler could crash when attempting to compile a
    call to is_list/1 in a complex expression.
  * compiler: A complex guard expression using the or operator
    could succeed when it was supposed to fail.
  * compiler: Compiling nested try/catch and catch expression could
    result in an internal compiler error.
  * compiler: Using the bnot operator in a complex expression could
    cause the compiler to terminate with an internal consistency
    failure diagnostic.
  * compiler: Fixed a bug that caused the compiler to crash in a
    binary optimization pass.
  * compiler: The compiler could terminate with an internal error
    when attempting to compile a binary pattern that could not
    possibly match.
  * compiler: Fixed various performance issues related to the alias
    optimization pass.
  * erl_docgen: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * mnesia: Do not delete old backup file if the new backup fails.
  * megaco: Make megaco transports handle gen_tcp | gen_udp with
    socket backend on Windows (completion).
  * common_test: With this change, ct_hooks manual refers to CTH
    execution order section in user guide.
  * common_test: With this change, Config data from
    pre_end_per_testcase hook is delivered to post_end_per_testcase
    callback in case of testcase timetrap or linked process crash.
  * common_test: With this change, remaining references to not
    supported vts tool in ct_run are removed (mainly relates to
    docs and ct_run help message).
  * common_test: With this change, prompt search functionality in
    ct_telnet handles unicode input.
  * common_test: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * stdlib: The compiler could run forever when compiling a call to
    is_record/3 with a huge positive tuple size. The call
    is_record(A, a, 0) would crash the compiler when used in a
    function body. When used in a guard the compiler would emit
    incorrect code that would accept {a&gt; as a record.
  * stdlib: Fix bug in ets:tab2file that could make it fail if
    another Erlang process created the same file at the same time.
  * stdlib: An {else_clause,Value} exception will now be reported
    nicely in the shell.
  * stdlib: Correct return value for error case, so that it matches
    the documented and intended return value {error,
    {already_started, pid()} when local registered names are used.
  * stdlib: sys:get_state/1,2 and sys:replace_state/2,3 has been
    corrected to handle a state named error as a state name, not as
    a failed system callback. For the standard server behaviours
    this was an issue only for gen_statem (and gen_fsm) when the
    state name was error, and for gen_server if the complete state
    was {error,_}.
  * stdlib: Multiple problems were fixed in
    filelib:safe_relative_path/2. If its second argument was a path
    that contained symbolic links, an incorrect result patch could
    be returned. Also, paths were sometimes falsely considered
    unsafe.
  * stdlib: Fix deadlock when erl.exe is used as part of a pipe on
    Windows and trying to set the encoding of the standard_io
    device.
  * stdlib: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * stdlib: Fix h/2,3 to properly render multi-clause
    documentation.
  * stdlib: Timers created by timer:apply_after/4,
    apply_interval/4, and apply_repeatedly/4 would silently fail to
    do the apply if it was not possible to spawn a process when the
    timer expired. This has now been corrected, and if the spawn
    fails, the system will be taken down producing a crash dump.
  * stdlib: When an Erlang source file lacked a module definition,
    there would be a spurious "module name must not be empty"
    diagnostic for each spec in the file.
  * stdlib: The argument descriptions for option types in argparse
    have been made less ambiguous.
  * stdlib: Clarified the documentation of normal shutdown reason
    on gen_server:call/2,3
  * stdlib: Pattern matching and equivalence (=:=, =/=) comparisons
    on 0.0 will now raise a warning, as it will no longer be
    considered equivalent to -0.0 in OTP 27. If a match on 0.0
    specifically is desired (distinct from -0.0), the warning can
    be suppressed by writing +0.0 instead. The arithmetic
    comparison operators are unaffected, including arithmetic
    equality (==). *** POTENTIAL INCOMPATIBILITY ***
  * stdlib: The semantics of the gen_{server,statem,event}
    behaviour's synchronous start behaviour introduced in OTP-26.0
    with OTP-18471, has been clarified in the documentation.
  * stdlib: Added functionality to set a custom multiline prompt.
  * stdlib: A warning for (accidental use of) Triple-Quoted Strings
    has been implemented as per EEP 64. *** POTENTIAL
    INCOMPATIBILITY ***
  * stdlib: The keyboard shortcuts for the shell are now
    configurable.
  * kernel: Fixed an issue with truncated crash slogans on failed
    emulator start.
  * kernel: Fix shell:start_interactive function specification.
  * kernel: Fix code:get_doc/1 to return missing, when it can't
    find erts instead of crashing.
  * kernel: Function socket:close/1 could cause a VM crash on
    Windows.
  * kernel: Fix deadlock when erl.exe is used as part of a pipe on
    Windows and trying to set the encoding of the standard_io
    device.
  * kernel: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * kernel: Fix logger's overload protection mechanism to only
    fetch memory used by messages when needed.
  * kernel: Fixed a number of socket-related issues causing
    incompatibilities with gen_tcp and gen_udp respectively.
  * kernel: gen_tcp:connect with socket address and socket (inet-)
    backend fails because of missing callback function.
  * kernel: The DNS RR cache used by `inet_res` has been fixed to
    preserve insert order, which is beneficial when the DNS server
    returns RRs in some specific order for e.g load balancing
    purposes.
  * kernel: The options `reuseport`, `reuseport_lb` and
    `exclusiveaddruse` were accidentally not allowed for e.g
    `gen_udp:open/1,2`, which has now been corrected.
  * kernel: gen_udp:recv/* for Unix Domain Socket in binary mode
    and passive mode has been fixed to not crash.
  * kernel: Fixed issue where cursor would not be placed at the end
    of the expression when navigating shell history.
  * kernel: Update gen_tcp_socket and gen_udp_socket to handle
    'completion' (socket on Windows).
  * kernel: Add support for Unix Domain Sockets (only for STREAM
    sockets) on Windows for 'socket'.
  * kernel: Add basic support for socket ioctl on Windows.
  * kernel: The file:location/0 type is now exported.
  * kernel: Add support for (Windows) socket option
    exclusiveaddruse.
  * kernel: [socket] Add support for the 'nopush' option.
  * kernel: Add support for socket option 'BSP STATE'.
  * kernel: Add tcp socket options 'keepcnt', 'keepidle' and
    'keepintvl'.
  * kernel: Add support for misc (Windows) socket options
    ('max_msg_size' and 'maxdg').
  * kernel: The keyboard shortcuts for the shell are now
    configurable.
  * kernel: Optimized code_server to reduce repeated work when
    loading the same module concurrently.
  * debugger: The call int:no_break(Module) did not remove any
    breakpoints.
  * debugger: The maybe expression is now supported in the
    Debugger.
  * debugger: The maybe expression is now supported in the
    Debugger.
  * debugger: The call int:no_break(Module) did not remove any
    breakpoints.
  * ssl: Avoid function clause error in ssl:getopts/2 by handling
    that inet:getopts may return an empty list during some
    circumstances, such as the socket being in a closing state.
  * ssl: The API function `ssl:recv/3` has been tightened to
    disallow negative length, which has never been documented to
    work, but was passed through and caused strange errors.
  * ssl: When a client initiated renegotiation was rejected and the
    client socket was in active mode the expected error message to
    the controlling process was not sent.
  * ssl: Add some guidance for signature algorithms configuration
    in ssl applications users guide.
  * snmp: Make snmp handle gen_udp with socket backend on Windows
    (completion).
  * public_key: Country name comparison shall be case insensitive
  * public_key: Add check to disallow duplicate certs in a path
  * inets: With this change, re_write httpd works as expected and
    does not return error.
  * inets: Fixed a bug so httpd does not crash when stopped at the
    wrong time during TLS connection negotiation, or any other
    theoretically as slow connection setup.
  * inets: Enhance error handling and avoid that the HTTP client
    hangs on headers provided on the wrong format.
  * inets: With this change, error report generated by httpd during
    connection setup contains socket type information.
  * inets: Stop and restart of the httpd server in the Inets
    application has been refactored to a more synchronous and OTP
    supervisor friendly approach. This should increase stability
    and for example avoid a supervisor report from
    httpd_connection_sup about killed child process(es) in some
    cases when stopping or restarting httpd.
  * dialyzer: Fixed a bug that caused dialyzer to crash when
    analyzing bogus code that contained the literal atom undefined
    in segment sizes.
  * dialyzer: Dialyzer could crash when attempting to analyze a
    module that defined a type called product/.
- Changes for 26.0.2:
  * erts: Fix using the IME (Input Method Editor) to enter text in
    cmd.exe and powershell.exe on Windows.
  * erts: Multiple socket:accept calls issue. When making multiple
    accept calls, only the last call is active.
  * erts: Fix the shell to ignore terminal delay when the terminal
    capabilities report that they should be used.
  * erts: Fix "oldshell" to echo characters while typing on
    Windows.
  * erts: On Windows, a call to the function socket:close, when
    there are waiting active calls to read, write or accept
    functions, could hang.
  * erts: Fix issues when reading or configuring standard_io on
    Windows when erl.exe is started using -noshell flag.
  * erts: The following functions are now much faster when given a
    long list or binary:
  * erts: On AArch64 (ARM64), equality and non-equality tests with
    literal bitstrings could succeed when they should fail and vice
    versa.
  * compiler: Fixed a type handling bug that would cause an
    internal consistence failure for correct code.
  * compiler: Fixed a bug that could cause the stack trace of throw
    exceptions to be erroneously optimized out.
  * compiler: Complex guard expression using 'or' were not always
    fully evaluated, making guards that were supposed to fail
    succeed.
  * stdlib: Fix bug where when you entered Alt+Enter in the
    terminal, the cursor would move to the last line, instead of
    moving to the next line.
  * stdlib: Fix eof handling when reading from stdin when erlang is
    started using -noshell.
  * stdlib: Fixed problem where output would disappear if it was
    received after a prompt was written in the shell.
  * stdlib: The following functions are now much faster when given
    a long list or binary:
  * kernel: Fix bug where when you entered Alt+Enter in the
    terminal, the cursor would move to the last line, instead of
    moving to the next line.
  * kernel: Fix so that the shell does not crash on startup when
    termcap is not available.
  * kernel: Multiple socket:accept calls issue. When making
    multiple accept calls, only the last call is active.
  * kernel: Fix the shell to ignore terminal delay when the
    terminal capabilities report that they should be used.
  * kernel: Fix "oldshell" to echo characters while typing on
    Windows.
  * kernel: Fix eof handling when reading from stdin when erlang is
    started using -noshell.
  * kernel: On Windows, a call to the function socket:close, when
    there are waiting active calls to read, write or accept
    functions, could hang.
  * kernel: Fix issues when reading or configuring standard_io on
    Windows when erl.exe is started using -noshell flag.
  * kernel: gen_udp:connect with inet_backend = socket fails when
    the Address is a hostname (string or atom).
  * kernel: Fixed problem which would cause shell to crash if
    particular escape sequence was written to stdout.
  * kernel: Fixed problem where output would disappear if it was
    received after a prompt was written in the shell.
  * kernel: Fix a crash where the location of erts could not be
    found in rebar3 dev builds.
  * kernel: Introduce the KERNEL application parameter
    standard_io_encoding that can be used to set the default
    encoding for standard_io. This option needs to be set to latin1
    if the application wants to treat all input data as bytes
    rather than utf-8 encoded characters.
  * ssl: Added keylog information to all protocol versions in
    ssl:connection_information/2.
  * ssl: Add RFC-6083 considerations for DTLS to enable gen_sctp
    based callback for the transport.
  * ssh: Added multiline editing support to ssh clients connected
    through OTP ssh daemon.</changelog>
  <changelog author="sflees@suse.de" date="1704974400">- Changes for 26.2.1:
  * erts: Removed unnecessary PCRE source tar-ball.
  * ssh: With this change (being response to CVE-2023-48795),
    ssh can negotiate "strict KEX" OpenSSH extension with
    peers supporting it; also
    'chacha20-poly1305@openssh.com' algorithm becomes a
    less preferred cipher.
    If strict KEX availability cannot be ensured on both
    connection sides, affected encryption modes(CHACHA and
    CBC) can be disabled with standard ssh configuration.
    This will provide protection against vulnerability, but
    at a cost of affecting interoperability. See
    Configuring algorithms in SSH. (bsc#1218192, CVE-2023-48795)
- Changes for 26.2:
  * all: Replaced unintentional Erlang Public License 1.1
    headers in some files with the intended Apache License
    2.0 header.
  * otp: The removal of the deprecated slave module, originally
    planned for OTP 27, has been postponed to OTP 29.
  * asn1: Fix benign warning from gcc 11 about mismatching call
    to free().
  * crypto: Enable engine support for OpenSSL versions 3.
  * edoc: Emit &lt;code&gt; instead of &lt;tt&gt;.
- Disable test suite for now, it has many false positives and
  takes a very long time.</changelog>
  <changelog author="sflees@suse.de" date="1706011200">- This codestream wasn't affected by bsc#1207113</changelog>
  <changelog author="sflees@suse.de" date="1706011201">- Disable rpmlint tests on SLE-15 where they currently fail</changelog>
  <changelog author="sflees@suse.de" date="1715947200">- Create a versioned package for SLES</changelog>
</package>
<package pkgid="edaddb118ad09e5404a1897bc4d25d7a6f2e42df3f8e82489ea19b91f7a8ef5e" name="erlang26-debugger-src" arch="s390x">
  <version epoch="0" ver="26.2.1" rel="150300.7.5.1"/>
  <changelog author="matwey.kornilov@gmail.com" date="1646568000">- Changes for 24.2.2:
  * inets: Avoid intermediate ungraceful shutdown of the HTTP
    server.
  * ssh: The ssh sever parallel_login option was missing in OTP-24</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1648382400">- Changes for 24.3.2:
  * erl_interface: Fix compile error regarding gethostbyaddr_r on
    Android. Error introduced in OTP 24.3.
  * kernel: Fix failed accepted connection setup after previous
    established connection from same node closed down silently.
  * kernel: Fixed a problem where typing Ctrl-R in the shell could
    hang if there were some problem with the history log file.
- Changes for 24.3.1:
  * dialyzer: There could be spurious warnings for unknown types
    when a type was a subtype of an existing type that was a
    subtype of an unknown type.
  * ssl: Client certification could fail for TLS-1.3 servers that
    did not include the certificat_authorties extension in its
    certificate request message.
- Changes for 24.3:
  * megaco: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.
  * megaco: Update the performance and debug chapters of the megaco
    user's guide. Also some updates to the meas tools.
  * compiler: The expression &lt;&lt;0/native-float&gt;&gt;=Bin would always
    fail to match, while &lt;&lt;0/float-native&gt;&gt;=Bin would match
    (provided that Bin contained the binary representation of 0.0)
  * compiler: The compiler will now compile huge functions with
    straight-line code faster.
  * erl_interface: Add --enable-ei-dynamic-lib configure option
    that will make erl_interface also release a dynamic library
    version of libei.
  * erl_interface: The ei API for decoding/encoding terms is not
    fully 64-bit compatible since terms that have a representation
    on the external term format larger than 2 GB cannot be handled.
  * sasl: Fix bug in systools:make_script/1 documentation.
  * inets: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.
  * inets: Documentation fix for inets:services_info/0, which now
    describes that Info might be a Reason term() in case when
    {error, Reason} is returned as service info.
  * crypto: The crypto app in OTP can since OTP-24.2 be compiled,
    linked and used with the new OpenSSL 3.0 cryptolib. The crypto
    app has 3.0 support has been improved, but is still *not
    recommended* for other usages than experiments and alpha
    testing. There are not yet any guaranties that it works, not
    even together with other OTP applications like for example SSL
    and SSH, although there are no known errors. Since the previous
    release, OTP-24.2, the following improvements have been done: -
    It has been tested during nearly every nightly test on the OTP
    lab - The hash algorithms md4 and ripemd160 have been enabled
    with OpenSSL 3.0. - The ciphers blowfish_cbc, blowfish_ecb,
    des_cbc, des_cfb, des_ecb, rc2_cbc and rc4 have been enabled
    with OpenSSL 3.0. Disabled or unsupported with OpenSSL 3.0 are
    still: - ENGINE support - FIPS mode - Other providers than the
    built-in ones - Compiling and linking with OpenSSL 3.0
    cryptolib in compatibility modes (for example to behave as
    1.1.1) and, the ciphers blowfish_cfb64 and blowfish_ofb64 are
    not supported and will not be either. Deprecated functions in
    the OpenSSL 3.0 cryptolib must not be disabled as OTP/crypto
    still uses some of the deprecated API functions. The gcc flag
  - Wno-deprecated-declarations is set to prevent deprecation
    warnings to be printed when compiling.
  * crypto: Crypto is adapted to LibreSSL 3.5.0 on OpenBSD.
  * crypto: New configure option ( --disable-otp-test-engine) to
    prohibit the build of the OTP test engine used in some test
    suites. The reason is that the test engine could be hard to
    compile on for instance LibreSSL 3.5.0. For that particular
    cryptolib version (or higher), this configure option is set
    automatically.
  * jinterface: Fix bug in OtpOutputStream.write_pid/4 and
    write_ref/3 causing faulty encodig. Bug exists since OTP 23.0.
  * wx: Removed the static_data option from wxImage creation
    functions, as it was broken and could lead to crashes. Now
    image data is always copied to wxWidgets as was the default
    behavior. Removed some non working wxGridEvent event types,
    which have there own events in newer wxWidgets versions, and
    added a couple of event types that where missing in wx.
  * asn1: Add support for the maps option in combination with the
    jer backend.
  * snmp: The compilation time is no longer recorded in BEAM files.
    There remained several undocumented functions that attempted to
    retrieve compilation times. Those have now been removed.
  * snmp: [agent] Remove expectation of socket being a port.
  * common_test: OTP internal test fix.
  * runtime_tools: Fixed bug in scheduler:utilization(Seconds) that
    would leave the scheduler_wall_time system flag incorrectly
    enabled.
  * runtime_tools: Add scheduler:get_sample/0 and get_sample_all/0.
    Also clarify scheduler module documentation about how it
    depends on system flag scheduler_wall_time.
  * erts: Fixed a bug in the x86 JIT that might cause floating
    point instructions to wrongly throw an exception.
  * erts: Preserve correct nodedown_reason if supervised
    distribution controller processes exit with {shutdown, Reason}.
  * erts: Handling of send_timeout for gen_tcp has been corrected
    so that the timeout is honored also when sending 0 bytes.
  * erts: By default global does not take any actions to restore a
    fully connected network when connections are lost due to
    network issues. This is problematic for all applications
    expecting a fully connected network to be provided, such as for
    example mnesia, but also for global itself. A network of
    overlapping partitions might cause the internal state of global
    to become inconsistent. Such an inconsistency can remain even
    after such partitions have been brought together to form a
    fully connected network again. The effect on other applications
    that expects that a fully connected network is maintained may
    vary, but they might misbehave in very subtle hard to detect
    ways during such a partitioning. In order to prevent such
    issues, we have introduced a prevent overlapping partitions fix
    which can be enabled using the prevent_overlapping_partitions
    kernel(6) parameter. When this fix has been enabled, global
    will actively disconnect from nodes that reports that they have
    lost connections to other nodes. This will cause fully
    connected partitions to form instead of leaving the network in
    a state with overlapping partitions. Note that this fix has to
    be enabled on all nodes in the network in order to work
    properly. Since this quite substantially changes the behavior,
    this fix is currently disabled by default. Since you might get
    hard to detect issues without this fix you are, however,
    strongly advised to enable this fix in order to avoid issues
    such as the ones described above. As of OTP 25 this fix will
    become enabled by default.
  * erts: Corrected the type specification of erlang:seq_trace/2.
  * erts: Fix memory leak when tracing on running on a process that
    only handle system tasks or non-message signals (for example
    process_info requests).
  * erts: Add support for using socket:sockaddr_in() and
    socket:sockaddr_in6() when using gen_sctp, gen_tcp and gen_udp.
    This will make it possible to use Link Local IPv6 addresses.
  * erts: Show on_load failure reasons in embedded mode.
  * erts: Compile date saved in the Erlang VM executable has been
    removed.
  * erts: Improve documentation for the dynamic node name feature.
  * ssh: Fix makefile dependency bugs.
  * ssh: Fixed faulty OpenSSH decoding of Ed25519/Ed448 keys in the
    OpenSSH format openssh_key_v1.
  * ssh: Correction of ssh_file typing, specially for the
    experimental openssh-key-v1 encoding.
  * ssh: Improper tag for private ED keys when encoding with
    ssh:encode/2. The tuple had ed_priv as first element, but
    should have had ed_pri. This is now corrected. *** POTENTIAL
    INCOMPATIBILITY ***
  * ssh: Add support for Ed25519/Ed448 SSH host keys in the RFC
    4716 format ("-----BEGIN EC PRIVATE KEY-----") generated by for
    example openssl or via Erlang functions (i.e.
    public_key:generate_key({namedCurve, ed25519})). Ed25519 SSH
    host keys generated by ssh-keygen was, and are still,
    supported.
  * kernel: Handling of send_timeout for gen_tcp has been corrected
    so that the timeout is honored also when sending 0 bytes.
  * kernel: By default global does not take any actions to restore
    a fully connected network when connections are lost due to
    network issues. This is problematic for all applications
    expecting a fully connected network to be provided, such as for
    example mnesia, but also for global itself. A network of
    overlapping partitions might cause the internal state of global
    to become inconsistent. Such an inconsistency can remain even
    after such partitions have been brought together to form a
    fully connected network again. The effect on other applications
    that expects that a fully connected network is maintained may
    vary, but they might misbehave in very subtle hard to detect
    ways during such a partitioning. In order to prevent such
    issues, we have introduced a prevent overlapping partitions fix
    which can be enabled using the prevent_overlapping_partitions
    kernel(6) parameter. When this fix has been enabled, global
    will actively disconnect from nodes that reports that they have
    lost connections to other nodes. This will cause fully
    connected partitions to form instead of leaving the network in
    a state with overlapping partitions. Note that this fix has to
    be enabled on all nodes in the network in order to work
    properly. Since this quite substantially changes the behavior,
    this fix is currently disabled by default. Since you might get
    hard to detect issues without this fix you are, however,
    strongly advised to enable this fix in order to avoid issues
    such as the ones described above. As of OTP 25 this fix will
    become enabled by default.
  * kernel: Fix bug where logger would crash when logging a report
    including improper lists.
  * kernel: Make erlang:set_cookie work for dynamic node names.
  * kernel: Add support for using socket:sockaddr_in() and
    socket:sockaddr_in6() when using gen_sctp, gen_tcp and gen_udp.
    This will make it possible to use Link Local IPv6 addresses.
  * kernel: A net_tickintensity kernel parameter has been
    introduced. It can be used to control the amount of ticks
    during a net_ticktime period. A new net_kernel:start/2 function
    has also been introduced in order to make it easier to add new
    options. The use of net_kernel:start/1 has been deprecated.
  * kernel: Improve documentation for the dynamic node name
    feature.
  * erl_docgen: Fix css for large tables and images on small
    screens
  * erl_docgen: Fix bug with codeinclude tag that caused it to not
    include the code if used in a correct, but unexpected way.
  * observer: Calculate the display width in etop, instead of hard-
    coding it to 89 characters.
  * debugger: Fix record index matching, it was broken and could
    never match.
  * ssl: Improved error handling.
  * ssl: Before this change, net_kernel used with TLS distribution
    might be leaking processes in case of connectivity issues.
  * ssl: Fix makefile dependency bugs.
  * ssl: Make sure the TLS sender process handles explicit calls to
    erlang:disconnect_node properly, avoiding potential hanging
    problems in net_kernel.
  * ssl: Add support for TLS-1.3 certificate_authorities extension.
    And process certificate_authorities field in pre-TLS-1.3
    certificate requests.
  * ssl: Support password fun for protected keyfiles in ssl:connect
    function.
  * ssl: Add in some cases earlier detection of possible DoS
    attacks by malicious clients sending unexpected TLS messages
    instead of the client hello. Note that such attacks are already
    mitigated by providing a timeout for the TLS handshake.
  * eldap: Fix eldap extensibleMatch dnAttributes option. According
    to the ldap ASN1 the dnAttributes should be a bool, instead it
    was generated as a string.
  * eldap: Implemented paged searches according to https://www.rfc-
    editor.org/rfc/rfc2696.txt
  * public_key: Support password fun for protected keyfiles in
    ssl:connect function.
  * stdlib: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.
  * mnesia: Reduce the number of locks taken during table copying,
    should reduce the startup time on large systems.
  * diameter: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1649246400">- Fix build for Factory. Currently, any Java version
  is fine for Erlang.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1653220800">- Version 25.0:
  - stdlib
  * New function filelib:ensure_path/1 will ensure that all
    directories for the given path exists
  * New functions groups_from_list/2 and groups_from_list/3 in
    the maps module
  * New functions uniq/1 uniq/2 in the lists module
  * New PRNG added to the rand module, for fast pseudo-random
    numers.
  - compiler, kernel, stdlib, syntax_tools:
  * Added support for selectable features as described in EEP-60.
    Features can be enabled/disabled during compilation with
    options (ordinary and +term) to erlc as well as with
    directives in the file. Similar options can be used to erl
    for enabling/disabling features allowed at runtime. The new
    maybe expression EEP-49 is fully supported as the feature
    maybe_expr.
  - erts &amp; JIT:
  * The JIT now works for 64-bit ARM processors.
  * The JIT now does type-based optimizations based on type
    information in the BEAM files.
  * Improved the JIT’s support for external tools like perf and
    gdb, allowing them to show line numbers and even the original
    Erlang source code when that can be found.
  - erts, stdlib, kernel:
  * Users can now configure ETS tables with the
    {write_concurrency, auto} option. This option forces tables
    to automatically change the number of locks that are used at
    run-time depending on how much concurrency is detected. The
    {decentralized_counters, true} option is enabled by default
    when {write_concurrency, auto} is active.
  * Benchmark results comparing this option with the other ETS
    optimization options are available here: benchmarks.
  * To enable more optimizations, BEAM files compiled with OTP 21
    and earlier cannot be loaded in OTP 25.
  * The signal queue of a process with the process flag
    message_queue_data=off_heap has been optimized to allow
    parallel reception of signals from multiple processes. This
    can improve performance when many processes are sending in
    parallel to one process. See benchmark.
  * The Erlang installation directory is now relocatable on the
    file system given that the paths in the installation’s
    RELEASES file are paths that are relative to the
    installations root directory.
  * A new option called short has been added to the functions
    erlang:float_to_list/2 and erlang:float_to_binary/2. This
    option creates the shortest correctly rounded string
    representation of the given float that can be converted back
    to the same float again.
  * Introduction of quote/1 and unquote/1 functions in the
    uri_string module - a replacement for the deprecated
    functions http_uri:encode and http_uri:decode.
  * The new module peer supersedes the slave module. The slave
    module is now deprecated and will be removed in OTP 27.
  * global will now by default prevent overlapping partitions due
    to network issues. This is done by actively disconnecting
    from nodes that reports that they have lost connections to
    other nodes. This will cause fully connected partitions to
    form instead of leaving the network in a state with
    overlapping partitions.
  * It is possible to turn off the new behavior by setting the
    the kernel configuration parameter
    prevent_overlapping_partitions to false. Doing this will
    retain the same behavior as in OTP 24 and earlier.
  * The format_status/2 callback for gen_server, gen_statem and
    gen_event has been deprecated in favor of the new
    format_status/1 callback.
  * The new callback adds the possibility to limit and change
    many more things than the just the state.
  * The timer module has been modernized and made more efficient,
    which makes the timer server less susceptible to being
    overloaded. The timer:sleep/1 function now accepts an
    arbitrarily large integer.
  - compiler:
  * The maybe ... end construction as proposed in EEP-49 has been
    implemented. It can simplify complex code where otherwise
    deeply nested cases would have to be used.
  * To enable maybe, give the option {enable_feature,maybe_expr}
    to the compiler. The exact option to use will change in a
    coming release candidate and then it will also be possible to
    use from inside the module being compiled.
  * When a record matching or record update fails, a {badrecord,
    ExpectedRecordTag} exception used to be raised. In this
    release, the exception has been changed to {badrecord,
    ActualValue}, where ActualValue is the value that was found
    instead of the expected record.
  * Add compile attribute -nifs() to empower compiler and loader
    with information about which functions may be overridden as
    NIFs by erlang:load_nif/2.
  * Improved and more detailed error messages when binary
    construction with the binary syntax fails. This applies both
    for error messages in the shell and for
    erl_error:format_exception/3,4.
  * Change format of feature options and directives for better
    consistency. Options to erlc and the -compile(..) directive
    now has the format {feature, feature-name, enable | disable}.
    The -feature(..) now has the format -feature(feature-name,
    enable | disable).
  - crypto:
  * Add crypto:hash_equals/2 which is a constant time comparision
    of hashvalues.
  - ssl:
  * Introducing a new (still experimental) option
    {certs_keys,[cert_key_conf()]}. With this a list of a
    certificates with their associated key may be used to
    authenticate the client or the server. The certificate key
    pair that is considered best and matches negotiated
    parameters for the connection will be selected.
  - public_key:
  * Functions for retrieving OS provided CA-certs added.
  - dialyzer:
  * Optimize operations in the erl_types module. Parallelize the
    Dialyzer pass remote.
  * Added the missing_return and extra_return options to raise
    warnings when specifications differ from inferred types.
    These are similar to, but not quite as verbose as overspecs
    and underspecs.
  * Dialyzer now better understands the types for min/2, max/2,
    and erlang:raise/3. Because of that, Dialyzer can potentially
    generate new warnings. In particular, functions that use
    erlang:raise/3 could now need a spec with a no_return()
    return type to avoid an unwanted warning.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1656849600">- Changes for 25.0.2:
  * ssl: Improved handling of unexpected messages during the
    handshake, taking the right action for unexpected messages.
  * erts: On computers with the ARM64 (AArch64) architecture (such
    as Apple Silicon Macs) a rem expression followed by a div
    expression with the same operands could evaluate to the wrong
    result if the result of the rem expression was unused.
- Changes for 25.0.1:
  * ssl: When a TLS-1.3 enabled client tried to talk to a TLS-1.2
    server that coalesces TLS-1.2 handshake message over one TLS
    record, the connection could fail due to some message being
    handled in the wrong state, this has been fixed.
  * ssl: Correctly handles supported protocol version change from
    default to something else by sni_fun supplied to
    ssl:handshake/[2,3] together with a TCP-socket (so called
    upgrade).
  * ssl: Also, TLS-1.3 should respond with a protocol version alert
    if previous versions, that are supported but not configured,
    are attempted.
  * kernel: The DNS resolver inet_res has been fixed to ignore
    trailing dot difference in the request domain between the sent
    request and the received response, when validating a response.
  * kernel: A bug in inet_res has been fixed where a missing
    internal {ok,_} wrapper caused inet_res:resolve/* to return a
    calculated host name instead of an `{ok,Msg} tuple, when
    resolving an IP address or a host name that is an IP address
    string.
  * kernel: The erlang:is_alive() BIF could return true before
    configured distribution service was available. This bug was
    introduced in OTP 25.0 ERTS version 13.0. The
    erlang:monitor_node() and erlang:monitor() BIFs could
    erroneously fail even though configured distribution service
    was available. This occurred if these BIFs were called after
    the distribution had been started using dynamic node name
    assignment but before the name had been assigned.
  * kernel: Added the missing mandatory address/0 callback in the
    gen_tcp_dist example.
  * erts: A spawn_reply signal from a remote node could be delayed
    and be delivered after other signals from the newly spawned
    process. When this bug triggered, the connection to the node
    where the process was spawned sometimes could be taken down due
    to the bug. The following error message would then be logged if
    this happened: Missing 'spawn_reply' signal from the node
    &lt;RemoteNode&gt; detected by &lt;Pid&gt; on the node &lt;LocalNode&gt;. The
    node &lt;RemoteNode&gt; probably suffers from the bug with ticket id
    OTP-17737. This bug only affected processes which had enabled
    off_heap message_queue_data and parallel reception of signals
    had been automatically enabled. This bug was introduced in OTP
    25.0, ERTS version 13.0.
  * erts: Fixed type spec of erlang:system_info(dist_ctrl).
  * erts: The zlib built in to the runtime system has been updated
    to version 1.2.12. (Note that on most platforms, the platform's
    own zlib is used.)
  * erts: The erlang:is_alive() BIF could return true before
    configured distribution service was available. This bug was
    introduced in OTP 25.0 ERTS version 13.0. The
    erlang:monitor_node() and erlang:monitor() BIFs could
    erroneously fail even though configured distribution service
    was available. This occurred if these BIFs were called after
    the distribution had been started using dynamic node name
    assignment but before the name had been assigned.
  * crypto: Note in the documentation that MODP (rfc3526) groups
    and OpenSSL 3.0 can give an error if a call to
    crypto:generate_key/2 specifies a key length, and that length
    is to small.
  * crypto: The cmac now uses only the 3.0 API
  * crypto: Documentation is now updated with which OpenSSL
    cryptolib versions that OTP currently is tested.
  * dialyzer: Fixed the documentation for the missing_return and
    extra_return options.
  * mnesia: Fixed add_table_copy which could leave a table lock if
    the receiving node went down during the operation.
  * ssh: Binaries can be limited in logs with the parameter
    max_log_item_len. The default value is 500 bytes.
  * stdlib: In the initial release of Erlang/OTP 25, the expression
    bound to the _ pseudo-field in a record initialization would
    always be evaluated once, even if all other fields in the
    record were explicitly initialized. That would break the use
    case of binding the expression error(...) to _ in order to get
    an exception if not all fields were initialized. The behavior
    of binding to _ has been reverted to the pre-OTP 25 behavior,
    that is, to not evaluate the expression if all fields have been
    bound to explicit values.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1660046400">- Changes for 25.0.3:
  * erts: Distributed exit signals could be lost under the
    following conditions:
  * erts: A race could cause process_info(Pid, message_queue_len)
    on other processes to return invalid results.
  * erts: Fixed reduction counting for handling process system
    tasks.
  * erts: Priority elevation of terminating processes did not work
    which could cause execution of such processes to be delayed.
  * erts: An unlink operation made by a process that terminated
    before the unlink operation completed, i.e., before it had
    received an unlink-ack signal from the linked process, caused
    an exit signal to erroneously be sent from the terminating
    process to the process being unlinked. This exit signal would
    most often be ignored by the receiver, but if the receiver of
    the exit signal concurrently set up a new link, it could
    receive the exit signal with the actual exit reason of the
    terminating process instead of a noproc exit reason. It is
    however very hard to detect that this has happened and has no
    obvious negative consequences, so it should be considered
    harmless. A distributed unlink-ack signal received by a
    terminating process was also not properly removed which could
    cause a minor memory leak.
  * ssl: The link to crypto:engine_load refered the function with
    wrong arity.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1661601600">- Changes for 25.0.4:
  * kernel: A call to net_kernel:setopts(new, Opts) at the same
    time as a connection was being set up could cause a deadlock
    between the net_kernel process and the process setting up the
    connection.
  * erts: The monitor/3 BIF did not apply options to the created
    monitor if the target process or port did not exist. That is,
    the corresponding down message would get a `DOWN` tag even if a
    custom tag had been set, and the returned reference was not an
    alias even if the alias option had been passed.
  * erts: The erlang:monotonic_time/1, erlang:system_time/1,
    erlang:time_offset/1, and os:system_time/1 BIFs erroneously
    failed when passed the argument native.</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1665662400">- Changes for 25.1.1:
  * dialyzer: Dialyzer could crash when analyzing Elixir code that
    used intricate macros.
  * dialyzer: The --input_list_file option has been added.
  * ssl: Fixes handling of symlinks in cacertfile option.
  * eunit: With this change, eunit exact_execution option works
    with application primitive.
  * stdlib: peer nodes failed to halt when the process supervising
    the control connection crashed. When an alternative control
    connection was used, this supervision process also quite
    frequently crashed when the peer node was stopped by the node
    that started it which caused the peer node to linger without
    ever halting.
  * asn1: For the per and uper ASN.1 encoding rules, encoding and
    decoding the SEQUENCE OF and SET OF constructs with 16384 items
    or more is now supported.
  * erts: Listen sockets created with the socket module, leaked
    (erlang-) monitors.
  * erts: Notifications about available distribution data sent to
    distribution controller processes could be lost. Distribution
    controller processes can be used when implementing an
    alternative distribution carrier. The default distribution over
    tcp was not effected and the bug was also not present on
    x86/x86_64 platforms.
  * kernel: Listen sockets created with the socket module, leaked
    (erlang-) monitors.
  * kernel: peer nodes failed to halt when the process supervising
    the control connection crashed. When an alternative control
    connection was used, this supervision process also quite
    frequently crashed when the peer node was stopped by the node
    that started it which caused the peer node to linger without
    ever halting.
- Changes for 25.1:
  * dialyzer: Two bugs have been fixed in Dialyzer's checking of
    behaviors: When a mandatory callback function is present but
    not exported, Dialyzer would not complain about a missing
    callback. When an optional callback function was not exported
    and had incompatible arguments and/or the return values were
    incompatible, Dialyzer would complain. This has been changed to
    suppress the warning, because the function might not be
    intended to be a callback function, for instance if a release
    added a new optional callback function (such as format_status/1
    for the gen_server behaviour added in OTP 25).
  * dialyzer: The no_extra_return and no_missing_return warnings
    can now be suppressed through -dialyzer directives in source
    code.
  * jinterface: Fix javadoc build error by adding option -encoding
    UTF-8.
  * diameter: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * crypto: Fix configure with --with-ssl and --disable-dynamic-
    ssl-lib on Windows.
  * crypto: Remove all references correctly in the garbage
    collection if an engine handle was not explicit unloaded.
  * crypto: Changed the behaviour of the engine load/unload
    functions The engine load/unload functions have got changed
    semantics to get a more consistent behaviour and work correct
    when variables are garbage collected. The load functions now
    don't register the methods for the engine to replace. That will
    now be handled with the new functions
    engine_register/engine_unregister if needed. Some functions are
    removed from the documentation and therefor the API, but they
    are left in the code for compatibility. *** POTENTIAL
    INCOMPATIBILITY ***
  * crypto: Fixed a naming bug for AES-CFB and Blowfish-CFB/OFB
    when linked with OpenSSL 3.0 cryptolib.
  * crypto: Sign/verify does now behave as in OTP-24 and earlier
    for eddsa.
  * crypto: Pass elliptic curve names from crypto.erl to crypto's
    nif.
  * crypto: The configure option --disable-deprecated-warnings is
    removed. It was used for some releases when the support for
    OpenSSL 3.0 was not completed. It is not needed in OTP 25.
  * crypto: Crypto is now considered to be usable with the OpenSSL
    3.0 cryptolib for production code. ENGINE and FIPS are not yet
    fully functional.
  * crypto: Do not exit if the legacy provider is missing in
    libcrypto 3.0.
  * ssl: Reject unexpected application data in all relevant places
    for all TLS versions. Also, handle TLS-1.3 middlebox
    compatibility with more care. This will make malicious
    connections fail early and further, mitigate possible DoS
    attacks, that would be caught by the handshake timeout. Thanks
    to Aina Toky Rasoamanana and Olivier Levillain from Télécom
    SudParis for alerting us of the issues in our implementation.
  * ssl: With this change, value of cacertfile option will be
    adjusted before loading certs from the file. Adjustments
    include converting relative paths to absolute and converting
    symlinks to actual file path. Thanks to Marcus Johansson
  * ssl: In TLS-1.3, if chain certs are missing (so server auth
    domain adherence can not be determined) send peer cert and hope
    the server is able to recreate a chain in its auth domain.
  * ssl: Make sure periodical refresh of CA certificate files
    repopulates cache properly.
  * ssl: Correct internal CRL cache functions to use internal
    format consistently.
  * ssl: Incorrect handling of client middlebox negotiation for
    TLS-1.3 could result in that a TLS-1.3 server would not use
    middlebox mode although the client was expecting it too and
    failing the negotiation with unexpected message.
  * ssl: If the "User" process, the process starting the TLS
    connection, gets killed in the middle of spawning the dynamic
    connection tree make sure we do not leave any processes behind.
  * ssl: A vulnerability has been discovered and corrected. It is
    registered as CVE-2022-37026 "Client Authentication Bypass".
    Corrections have been released on the supported tracks with
    patches 23.3.4.15, 24.3.4.2, and 25.0.2. The vulnerability
    might also exist in older OTP versions. We recommend that
    impacted users upgrade to one of these versions or later on the
    respective tracks. OTP 25.1 would be an even better choice.
    Impacted are those who are running an ssl/tls/dtls server using
    the ssl application either directly or indirectly via other
    applications. For example via inets (httpd), cowboy, etc. Note
    that the vulnerability only affects servers that request client
    certification, that is sets the option {verify, verify_peer}.
    (bsc#1205318)
  * eunit: With this change, Eunit can optionally not try to
    execute related module with "_tests" suffix. This might be used
    for avoiding duplicated executions when source and test modules
    are located in the same folder.
  * erl_docgen: Update DTD to allow XML tag em under pre.
  * inets: Add httpc:ssl_verify_host_options/1 to help setting
    default ssl options for the https client.
  * inets: This change fixes dialyzer warnings generated for
    inets/httpd examples (includes needed adjustment of spec for
    ssh_sftp module).
  * inets: Remove documentation of no longer supported callback.
  * stdlib: Fixed inconsistency bugs in global due to
    nodeup/nodedown messages not being delivered before/after
    traffic over connections. Also fixed various other
    inconsistency bugs and deadlocks in both global_group and
    global. As building blocks for these fixes, a new BIF
    erlang:nodes/2 has been introduced and
    net_kernel:monitor_nodes/2 has been extended. The -hidden and
  - connect_all command line arguments did not work if multiple
    instances were present on the command line which has been
    fixed. The new kernel parameter connect_all has also been
    introduced in order to replace the -connect_all command line
    argument.
  * stdlib: Fix the public_key:ssh* functions to be listed under
    the correct release in the Removed Functionality User's Guide.
  * stdlib: The type spec for format_status/1 in gen_statem,
    gen_server and gen_event has been corrected to state that the
    return value is of the same type as the argument (instead of
    the same value as the argument).
  * stdlib: If the timer server child spec was already present in
    kernel_sup but it was not started, the timer server would fail
    to start with an {error, already_present} error instead of
    restarting the server.
  * stdlib: When changing callback module in gen_statem the
    state_enter calls flag from the old module was used in for the
    first event in the new module, which could confuse the new
    module and cause malfunction. This bug has been corrected. With
    this change some sys debug message formats have been modified,
    which can be a problem for debug code relying on the format.
  * ** POTENTIAL INCOMPATIBILITY ***
  * stdlib: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * stdlib: The rfc339_to_system_time/1,2 functions now allows the
    minutes part to be omitted from the time zone.
  * stdlib: The receive statement in gen_event has been optimized
    to not use selective receive (which was never needed, and could
    cause severe performance degradation under heavy load).
  * stdlib: Add new API function erl_features:configurable/0
  * parsetools: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * public_key: Support more Linux distributions in cacerts_load/0.
  * public_key: Correct asn1 typenames available in type
    pki_asn1_type()
  * public_key: Sign/verify does now behave as in OTP-24 and
    earlier for eddsa.
  * snmp: Improved the get-bulk response max size calculation. Its
    now possible to configure 'empty pdu size', see appendix c for
    more info.
  * snmp: Fix various example dialyzer issues
  * ssh: Handling rare race condition at channel close.
  * ssh: New ssh option no_auth_needed to skip the ssh
    authentication. Use with caution!
  * ssh: This change fixes dialyzer warnings generated for
    inets/httpd examples (includes needed adjustment of spec for
    ssh_sftp module).
  * ssh: The new function ssh:daemon_replace_options/2 makes it
    possible to change the Options in a running SSH server.
    Established connections are not affected, only those created
    after the call to this new function.
  * ssh: Add a timeout as option max_initial_idle_time. It closes a
    connection that does not allocate a channel within the timeout
    time. For more information about timeouts, see the Timeouts
    section in the User's Guide Hardening chapter.
  * observer: Fixed units in gui.
  * xmerl: There is a new configure option, --enable-deterministic-
    build, which will apply the deterministic compiler option when
    building Erlang/OTP. The deterministic option has been improved
    to eliminate more sources of non-determinism in several
    applications.
  * asn1: There is a new configure option, --enable-deterministic-
    build, which will apply the deterministic compiler option when
    building Erlang/OTP. The deterministic option has been improved
    to eliminate more sources of non-determinism in several
    applications.
  * erts: Fixed inconsistency bugs in global due to nodeup/nodedown
    messages not being delivered before/after traffic over
    connections. Also fixed various other inconsistency bugs and
    deadlocks in both global_group and global. As building blocks
    for these fixes, a new BIF erlang:nodes/2 has been introduced
    and net_kernel:monitor_nodes/2 has been extended. The -hidden
    and -connect_all command line arguments did not work if
    multiple instances were present on the command line which has
    been fixed. The new kernel parameter connect_all has also been
    introduced in order to replace the -connect_all command line
    argument.
  * erts: Fixed IPv6 multicast_if and membership socket options.
  * erts: Accept funs (NEW_FUN_EXT) with incorrectly encoded size
    field. This is a workaround for a bug (OTP-18104) existing in
    OTP 23 and 24 that could cause incorrect size fields in certain
    cases. The emulator does not use the decoded size field, but
    erl_interface still does and is not helped by this workaround.
  * erts: Fixed issue with inet:getifaddrs hanging on pure IPv6
    Windows
  * erts: Fix faulty distribution encoding of terms with either The
    symptom could be failed decoding on the receiving side leading
    to aborted connection. Fix OTP-18093 is a workaround for theses
    bugs that makes the VM accepts such faulty encoded funs. The
    first encoding bug toward pending connection exists only in OTP
    23 and 24, but the second one exists also on OTP 25.
  * erts: Fixed emulator crash that could happen during crashdump
    generation of ETS tables with options ordered_set and
    {write_concurrency,true}.
  * erts: Retrieval of monotonic and system clock resolution on
    MacOS could cause a crash and/or erroneous results.
  * erts: Fix bug where the max allowed size of erl +hmax was lower
    than what was allowed by process_flag.
  * erts: On computers with ARM64 (AArch64) processors, the JIT
    could generate incorrect code when more than 4095 bits were
    skipped at the tail end of a binary match.
  * erts: In rare circumstances, an is_binary/1 guard test could
    succeed when given a large integer.
  * erts: Fix bug causing ets:info (and sometimes ets:whereis) to
    return 'undefined' for an existing table if a concurrent
    process were doing ets:insert with a long list on the same
    table.
  * erts: Fix writing and reading of more than 2 GB in a single
    read/write operation on macOS. Before this fix attempting to
    read/write more than 2GB would result in {error,einval}.
  * erts: Fix bug sometimes causing emulator crash at node shutdown
    when there are pending connections. Only seen when running duel
    distribution protocols, inet_drv and inet_tls_dist.
  * erts: Yield when adjusting large process message queues due to
    The message queue adjustment work will now be interleaved with
    all other types of work that processes have to do, even other
    message queue adjustment work.
  * erts: Add rudimentary debug feature (option) for the inet-
    driver based sockets, such as gen_tcp and gen_udp.
  * erts: Introduced the hidden and dist_listen options to
    net_kernel:start/2. Also documented the -dist_listen command
    line argument which was erroneously documented as a kernel
    parameter and not as a command line argument.
  * erts: New documentation chapter "Debugging NIFs and Port
    Drivers" under Interoperability Tutorial.
  * erts: Add new API function erl_features:configurable/0
  * kernel: Fixed inconsistency bugs in global due to
    nodeup/nodedown messages not being delivered before/after
    traffic over connections. Also fixed various other
    inconsistency bugs and deadlocks in both global_group and
    global. As building blocks for these fixes, a new BIF
    erlang:nodes/2 has been introduced and
    net_kernel:monitor_nodes/2 has been extended. The -hidden and
  - connect_all command line arguments did not work if multiple
    instances were present on the command line which has been
    fixed. The new kernel parameter connect_all has also been
    introduced in order to replace the -connect_all command line
    argument.
  * kernel: Fixed IPv6 multicast_if and membership socket options.
  * kernel: Fixed issue with inet:getifaddrs hanging on pure IPv6
    Windows
  * kernel: The type specifications for inet:getopts/2 and
    inet:setopts/2 have been corrected regarding SCTP options.
  * kernel: The type specifications for inet:parse_* have been
    tightened.
  * kernel: Fix gen_tcp:connect/3 spec to include the inet_backend
    option.
  * kernel: Fix bug where using a binary as the format when calling
    logger:log(Level, Format, Args) (or any other logging function)
    would cause a crash or incorrect logging.
  * kernel: Add rudimentary debug feature (option) for the inet-
    driver based sockets, such as gen_tcp and gen_udp.
  * kernel: Introduced the hidden and dist_listen options to
    net_kernel:start/2. Also documented the -dist_listen command
    line argument which was erroneously documented as a kernel
    parameter and not as a command line argument.
  * kernel: Scope and group monitoring have been introduced in pg.
    For more information see the documentation of
    pg:monitor_scope(), pg:monitor(), and pg:demonitor().
  * kernel: A new function global:disconnect/0 has been introduced
    with which one can cleanly disconnect a node from all other
    nodes in a cluster of global nodes.
  * compiler: The compiler will now forbid using the empty atom ''
    as module name. Also forbidden are modules names containing
    control characters, and module names containing only spaces and
    soft hyphens.
  * compiler: The bin_opt_info and recv_opt_info options would
    cause the compiler to crash when attempting to compile
    generated code without location information.
  * compiler: In rare circumstances involving floating point
    operations, the compiler could terminate with an internal
    consistency check failure.
  * compiler: In rare circumstances when doing arithmetic
    instructions on non-numbers, the compiler could crash.
  * compiler: In rare circumstances, complex boolean expressions in
    nested cases could cause the compiler to crash.
  * compiler: Expression similar to #{assoc:=V} = #key=&gt;self()}, V
    would return the empty map instead of raising an exception.
  * compiler: Eliminated a crash in the beam_ssa_bool pass of the
    compiler when compiling a complex guard expression.
  * compiler: In rare circumstances, the compiler could crash with
    an internal consistency check failure.
  * compiler: When compiling with the option inline_list_funcs, the
    compiler could produce a nonsensical warning.
  * compiler: When given the no_ssa_opt option, the compiler could
    terminate with an internal consistency failure diagnostic when
    compiling map matching.
  * compiler: Made warnings for existing atoms being keywords in
    experimental features more precise, by not warning about quoted
    atoms.
  * compiler: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * megaco: Fixed various dialyzer related issues in the examples
    and the application proper.
  * megaco: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * common_test: Fix cth_surefire to handle when a suite is not
    compiled with debug_info. This bug has been present since
    Erlang/OTP 25.0.
  * common_test: Common Test now preserves stack traces for throws.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1669291200">- Changes for 25.1.2:
  * mnesia: Don't fill the logs if mnesia can't connect to all
    nodes, due to partitioned network.
  * erts: Add abandon carrier free utilization limit (+Muacful)
    option to erts_alloc. This option allows the user to mark
    unused segments in a memory carrier as re-useable by the OS if
    needed. This functionality was a non-configurable default
    before Erlang/OTP 25, but removed due to performance issues.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1671364800">- Changes for 25.2:
  * erts: Fix perf/gdb JIT symbols to not contain CodeInfoPrologue
    for the JIT internal module erts_beamasm.
  * erts: Fixed minor memory leaks.
  * erts: Fix bugs in ets:insert and ets:insert_new when called
    with a list of tuples to insert while a concurrent process
    either deletes or renames the table. The table deletion could
    be done with ets:delete/1 or be caused by termination of the
    table owning process. Symptoms are either VM crash or strange
    incorrect behavior from the insert operation. The risk of
    triggering the bugs increases with the length of the list of
    tuple to insert. Bugs exist since OTP 23.0.
  * erts: Boost execution of scheduled thread progress jobs. This
    to prevent memory exhaustion in extremely rapid
    allocation/deallocation scenarios, such as repeated ETS table
    creations/deletions.
  * erts: Fix segv crash during crash dumping an ETS table doing
    ets:delete_all_objects.
  * erts: Spec for function net:if_names/0 incorrect
  * erts: Fix bug in binary_to_term decoding a binary term 2Gbyte
    or larger.
  * erts: Documentation of erlang:module_loaded/1 has been
    adjusted:
  * erts: Fix list_to_atom/1 for negative code points. Could either
    return with a positive code point or fail with an incorrect
    exception.
  * erts: Fix rare bug causing VM crash when sending to a pid of a
    spawning process returned from erlang:processes/0. Only seen
    when provoked by system process literal_area_collector,
    triggered by a module purge operation, on a VM started with
    +Meamin (no customized allocators).
  * erts: gen_udp:open/2 with option(s) add_membership or
    drop_membership would drop earlier options.
  * erts: The inet:setopts/2 {reuseaddr, true} option will now be
    ignored on Windows unless the socket is an UDP socket. For more
    information see the documentation of the reuseaddr option part
    of the documentation of inet:setopts/2. Prior to OTP 25 the
    {reuseaddr, true} option was ignored for all sockets on
    Windows, but as of OTP 25.0 this was changed so that it was not
    ignored for any sockets. *** POTENTIAL INCOMPATIBILITY ***
  * erts: Fix bug in binary_to_term decoding a list of length 1G or
    longer.
  * erts: Fix bug in binary_to_term (and distributed receive) when
    decoding a large map (&gt;32 keys) with unsorted small maps (&lt;=
    32) as keys of the large map. This was only a problem if the
    term was encoded by erl_interface, jinterface or otherwise, as
    the VM itself always encodes small maps with sorted keys. The
    "binary_to_term" would appear as successful but the created
    large map was internally inconsistent. The smaller key-maps
    could not be found with maps:get and friends. Other operations
    such as map compare and merge could probably also give
    incorrect results.
  * erts: Fix Windows bug in open_port({spawn, Command}, ..) when
    Command is found via the OS search PATH and that directory path
    contains white spaces. The port program would start but the
    command line arguments to it could be incorrect.
  * ftp: fix unexpected result ok when calling ftp:nlist repeatedly
  * inets: This change allows body requests to httpc:request/5 be
    an iolist()
  * inets: addition of type specs in httpc.erl
  * inets: httpc: Add support for HTTP 308 status code
  * dialyzer: Dialyzer would crash when attempting to analyze a bit
    syntax segment size having an literal non-integer size such as
    [].
  * dialyzer: Dialyzer could crash when trying to analyze a
    convoluted nested expression involving funs,
  * kernel: Fixed shutdown crash in gen_tcp socket backend, when
    the other end closed the socket.
  * kernel: erl_tar can now read gzip-compressed tar files that are
    padded. There is a new option compressed_one for file:open/2
    that will read a single member from a gzip file,
  * kernel: Fix os:cmd to not translate all exceptions thrown to
    badarg. For example emfile from erlang:open_port was translated
    to badarg. This bug has existed since Erlang/OTP 24.
  * kernel: Spec for function net:if_names/0 incorrect
  * kernel: Missing ctrl option name transation for TOS and TTL (on
    FreeBSD) when using gen_udp with the 'socket' inet_backend.
  * kernel: gen_udp:open/2 with option(s) add_membership or
    drop_membership would drop earlier options.
  * kernel: The inet:setopts/2 {reuseaddr, true} option will now be
    ignored on Windows unless the socket is an UDP socket. For more
    information see the documentation of the reuseaddr option part
    of the documentation of inet:setopts/2. Prior to OTP 25 the
    {reuseaddr, true} option was ignored for all sockets on
    Windows, but as of OTP 25.0 this was changed so that it was not
    ignored for any sockets. *** POTENTIAL INCOMPATIBILITY ***
  * kernel: The distribution socket option handling in
    inet_tcp_dist has been cleaned up to clarify which were
    mandatory and which just had default values.
  * kernel: Improve warning message format for gen_tcp_socket.
  * snmp: Explicitly close the socket(s) when terminating
    (default-) net-if process.
  * stdlib: erl_tar can now read gzip-compressed tar files that are
    padded. There is a new option compressed_one for file:open/2
    that will read a single member from a gzip file,
  * stdlib: A concurrent call to ets:rename could cause
    ets:delete_all_objects to fail halfway through with badarg.
  * stdlib: It is not allowed to call functions from guards. The
    compiler failed to reject a call in a guard when done by
    constructing a record with a default initialization expression
    that called a function.
  * stdlib: The compiler could crash when using a record with
    complex field initialization expression as a filter in a list
    comprehension.
  * stdlib: unicode:characters_to_binary() could build
    unnecessarily large call stack.
  * stdlib: Improve error message for ets:new/2 name clash. Say
    "name already exists" instead of less specific "invalid
    options".
  * mnesia: Fixed crash which could happen during startup if too
    many decisions where sent from remote nodes.
  * os_mon: The disk_space_check_interval configuration parameter
    of disksup can now be set to values smaller than a minute.
  * ssh: graceful shutdown of ssh_conection_handler when connection
    is closed by peer
  * common_test: Fix starting of peer nodes on old releases when
    the compile server was active and the current Erlang
    installation contained non-latin1 characters in its path.
  * public_key: Disregard LDAP URIs when HTTP URIs are expected.
  * ssl: With this change, tls_sender process is hibernated after
    sufficient inactivity.
  * ssl: Correct handling of legacy schemes so that ECDSA certs
    using sha1 may be used for some TLS-1.3 configurations.
  * ssl: With this change, tls_sender does not cause logger crash
    upon key update.
  * ssl: Enhance warning message
  * ssl: Provide server option to make certificate_authorities
    extension in the TLS-1.3 servers certificate request optional.
    This will allow clients to send incomplete chains that may be
    reconstructable and thereby verifiable by the server, but that
    would not adhere to the certificate_authorities extension.
  * ssl: If the verify_fun handles four arguments the DER cert will
    be supplied as one of the arguments.
  * megaco: A very minor improvement to the measurement tool.
  * observer: A WX event race could causes a crash in when handling
    socket or port info.
  * observer: Improve the nodes menu to include more nodes.
  * compiler: Line number in compiler messages would be truncated
    to 4 digits for line numbers greater than 9999.
  * compiler: In rare circumstance, matching a binary as part of a
    receive clause could cause the compiler to terminate because of
    an internal consistency check failure.
  * compiler: Compiling a function with complex bit syntax matching
    such as f(&lt;&lt;X:0, _:X&gt;&gt;, &lt;&lt;Y:0, _:Y&gt;&gt;) -&gt; ok. could crash the
    compiler.
  * compiler: It is not allowed to call functions from guards. The
    compiler failed to reject a call in a guard when done by
    constructing a record with a default initialization expression
    that called a function.
  * compiler: The compiler could crash when using a record with
    complex field initialization expression as a filter in a list
    comprehension.
  * wx: Added environment variable WX_MACOS_NON_GUI_APP to allow
    user to override OSXIsGUIApplication behavior.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1679745600">- Changes for 25.3:
  * reltool: Fixed a bug that would cause analysis to crash.
  * stdlib: Fixed a bug that would cause analysis to crash.
  * stdlib: Fixed a crash when formatting stack traces for error
    reports.
  * stdlib: Instead of crashing, the list_to_integer/1 and
    list_to_integer/2 BIFs now raise the system_limit exception for
    overlong lists that can't be converted to integers. Similarly,
    the string:to_integer/1 BIF now returns {error,system_limit}
    for overlong lists.
  * stdlib: Removal of non-necessary undefined types added to the
    state's supervisor record.
  * compiler: Fixed a bug that would cause the compiler to hang.
  * compiler: Fixed a crash when compiling code that contained
    maybe expressions.
  * compiler: Constructing a binary with an explicit size of all
    for a binary segment would crash the compiler.
  * compiler: The compiler would generate incorrect code for the
    following type of expression: Pattern = BoundVar1 = . . . =
    BoundVarN = Expression An exception should be raised if any of
    the bound variables have different values than Expression. The
    compiler would generate code that would cause the bound
    variables to be bound to the value of Expressionwhether the
    value matched or not.
  * xmerl: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * megaco: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * debugger: Fixed a bug that would cause analysis to crash.
  * erts: Fixed a bug on Windows where file:read_file_info/1 would
    fail for files with corrupt metadata.
  * erts: Fix process_info(_, binary) to again include "writable
    binaries" which were lost in OTP-25.0. Writable binaries are an
    optimization used when binaries are appended upon in a loop.
  * erts: Fix rare race when receiving fragmented messages on a
    terminating connection. Could potentially cause memory leaks as
    well as double free crashes. Bug exists since OTP 22.0.
  * erts: Fixed bug that could maybe cause problems when a file
    descriptor number is closed by a linked in driver and then
    opened (reused) and passed to enif_select by a NIF. No actual
    symptoms seen, only failed internal assertions in debug build.
  * erts: The runtime system could crash when tracing a process
    executing on a dirty scheduler.
  * erts: In the binary syntax, attempting to match out integers
    with size exceeding 2 GiB could crash the runtime system.
  * erts: Fixed edge case in floating-point negation where A = 0.0,
    B = -A did not produce B = -0.0 on x86_64 JIT.
  * erts: Fixed an issue in the JIT that could crash the emulator
    on some platforms.
  * erts: Added meta data to the windows installer.
  * erts: Fixed ETS insertion order into bag and duplicate_bag of
    tuples with identical keys when passed in a list to
    ets:insert/2. The insert order has been head-to-tail but was
    accidentally changed in OTP 23.0. For bag it was reverted
    (tail-to-head), while for duplicate_bag it was sometimes
    reverted depending on the length of the list and number of
    "reductions" left for the calling process. This fix changes the
    insert order of ets:insert/2 back to always be head-to-tail of
    the list argument.
  * erts: With the JIT for AArch64 (AMD64), calling bxor in with
    non-integer arguments in a guard would crash the runtime
    system.
  * erts: Fix bug regarding process flag max_heap_size. Could cause
    strange behavior when a process was killed due to exceeding the
    limit.
  * erts: Fixed binary comprehensions to be similar to other
    creation of binary data with respect to its contribution of
    triggering garbage collection.
  * erts: In rare circumstances, when a process exceeded its
    allowed heap size set by option max_heap_size, it would not be
    killed as it should be, but instead enter a kind of zombie
    state it would never get out of.
  * erts: Instead of crashing, the list_to_integer/1 and
    list_to_integer/2 BIFs now raise the system_limit exception for
    overlong lists that can't be converted to integers. Similarly,
    the string:to_integer/1 BIF now returns {error,system_limit}
    for overlong lists.
  * erts: Active process aliases of a process at its termination
    leaked memory.
  * erts: Support for fully asynchronous distributed signaling
    where send operations never block. This functionality is by
    default disabled and can be enabled per process. For more
    information see the documentation of process_flag(async_dist,
    Bool).
  * erts: Added the +JPperf no_fp option to explicitly disable
    Erlang frame pointers otherwise added when using the +JPperf
    map option.
  * erl_interface: Accept connection setup from OTP 23 and 24 nodes
    that are not using epmd.
  * erl_interface: The ei API for decoding/encoding terms is not
    fully 64-bit compatible since terms that have a representation
    on the external term format larger than 2 GB cannot be handled.
  * syntax_tools: erl_syntax_lib:annotate_bindings/1,2 will now
    properly annotate named functions and their arguments.
  * kernel: Fixed a bug on Windows where file:read_file_info/1
    would fail for files with corrupt metadata.
  * kernel: Accept connection setup from OTP 23 and 24 nodes that
    are not using epmd.
  * public_key: As different solutions of verifying certificate
    revocation exists move the decode of 'CRLDistributionPoints' so
    that it will only be decode. When it is actually used in the
    verification process. This would enable interoperability with
    systems that use certificates with an invalid empty
    CRLDistributionPoints extension that they want to ignore and
    make verification by other means.
  * public_key: public_key:pkix_path_validation validates
    certificates expiring after 2050
  * public_key: Do not leave exit message in message queue after
    calling cacerts_load() on MacOS.
  * public_key: Replace size/1 with either tuple_size/1 or
    byte_size/1 The size/1 BIF is not optimized by the JIT, and its
    use can result in worse types for Dialyzer. When one knows that
    the value being tested must be a tuple, tuple_size/1 should
    always be preferred. When one knows that the value being tested
    must be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * ssl: Fixed that new dtls connections from the same client ip
    port combination works. If there is a process waiting for
    accept the new connection will connect to that, otherwise it
    will try to re-connect to the old server connection.
  * ssl: When shutting down a node that uses SSL distribution
    (-proto_dist inet_tls), a confusing error message about an
    unexpected process exit was printed. This particular message is
    no longer generated.
  * ssl: fixes the type spec for ssl:format_error/1
  * ssl: Replace size/1 with either tuple_size/1 or byte_size/1 The
    size/1 BIF is not optimized by the JIT, and its use can result
    in worse types for Dialyzer. When one knows that the value
    being tested must be a tuple, tuple_size/1 should always be
    preferred. When one knows that the value being tested must be a
    binary, byte_size/1 should be preferred. However, byte_size/1
    also accepts a bitstring (rounding up size to a whole number of
    bytes), so one must make sure that the call to byte_size/ is
    preceded by a call to is_binary/1 to ensure that bitstrings are
    rejected. Note that the compiler removes redundant calls to
    is_binary/1, so if one is not sure whether previous code had
    made sure that the argument is a binary, it does not harm to
    add an is_binary/1 test immediately before the call to
    byte_size/1.
  * jinterface: Accept connection setup from OTP 23 and 24 nodes
    that are not using epmd.
  * os_mon: The port programs used by cpu_sup and memsup are now
    gracefully shut down when cpu_sup and memsup are shut down.
  * eunit: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * crypto: A user defined runtime library path configured using
  - -with-ssl-rpath=&lt;PATHS&gt; could fail to be enabled.
  * crypto: Ensure that configure fails if a user defined runtime
    library path has been passed by the user, but cannot set.
  * mnesia: Improved consistency for dirty writes when a table was
    added with add_table_copy/3. Fixed a problem with sticky write,
    which could lead to inconsistent data.
  * mnesia: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * common_test: Renamed undocumented macro CT_PEER/3 to
    CT_PEER_REL/3.
  * ssh: With this change, PKCS8 formatted private key file is
    properly decoded and SSH daemon with such key can be started.
  * ssh: Replace size/1 with either tuple_size/1 or byte_size/1 The
    size/1 BIF is not optimized by the JIT, and its use can result
    in worse types for Dialyzer. When one knows that the value
    being tested must be a tuple, tuple_size/1 should always be
    preferred. When one knows that the value being tested must be a
    binary, byte_size/1 should be preferred. However, byte_size/1
    also accepts a bitstring (rounding up size to a whole number of
    bytes), so one must make sure that the call to byte_size/ is
    preceded by a call to is_binary/1 to ensure that bitstrings are
    rejected. Note that the compiler removes redundant calls to
    is_binary/1, so if one is not sure whether previous code had
    made sure that the argument is a binary, it does not harm to
    add an is_binary/1 test immediately before the call to
    byte_size/1.
  * inets: With this change, handling of URI to a folder, with
    missing trailing / and a query component present is fixed.
  * inets: Adds more type information to the inets app, thus
    improving the errors that static analysis tools can detect. The
    addition of type information to records and the updates to
    function heads help static analysis tools to understand that
    some values in the records cannot be 'undefined', thus making
    static tools to type check correctly more modules in the inets
    app
  * inets: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * snmp: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * ftp: Replace size/1 with either tuple_size/1 or byte_size/1 The
    size/1 BIF is not optimized by the JIT, and its use can result
    in worse types for Dialyzer. When one knows that the value
    being tested must be a tuple, tuple_size/1 should always be
    preferred. When one knows that the value being tested must be a
    binary, byte_size/1 should be preferred. However, byte_size/1
    also accepts a bitstring (rounding up size to a whole number of
    bytes), so one must make sure that the call to byte_size/ is
    preceded by a call to is_binary/1 to ensure that bitstrings are
    rejected. Note that the compiler removes redundant calls to
    is_binary/1, so if one is not sure whether previous code had
    made sure that the argument is a binary, it does not harm to
    add an is_binary/1 test immediately before the call to
    byte_size/1.
  * dialyzer: Fixed a bug that would cause analysis to crash.
  * dialyzer: Replace size/1 with either tuple_size/1 or
    byte_size/1 The size/1 BIF is not optimized by the JIT, and its
    use can result in worse types for Dialyzer. When one knows that
    the value being tested must be a tuple, tuple_size/1 should
    always be preferred. When one knows that the value being tested
    must be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * tftp: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
- Changes for 25.2.3:
  * erts: Comparisons between small numbers and pids or ports would
    in some edge cases say that the number was greater than the pid
    or port, violating the term order.
  * erts: process_info(Pid, status) when Pid /= self() could return
    an erroneous result.
  * ssl: Maximize compatibility by ignoring change_cipher_spec
    during handshake even if middle_box_mode is not negotiated
    (mandated by client)
  * ssl: Move assert of middlebox message after an
    hello_retry_request to maximize interoperability. Does not
    changes semantics of the protocol only allows unexpected
    message delay from server.
  * ssh: With this change, ssh application does not crash when
    formatting some of info reports for unsuccessful connections.
  * ssh: With this change, ssh does not log extensively long
    messages.
  * inets: Ensure graceful shutdown
  * inets: Return type of the type specification for function
    httpc:cookie_header/{1,2,3} has been fixed from -spec
    cookie_header(url()) -&gt; [{ field(), value() }] | {error,
    Reason} to -spec cookie_header(url()) -&gt; { field(), value() } |
    {error, Reason}
- Changes for 25.2.2:
  * ftp: Fixes calls to ftp:nlist/2 returning {error, epath} when
    the file / folder exists
- Changes for 25.2.1:
  * compiler: Fixed a bug that could cause legal code to fail
    validation.
  * compiler: Eliminated a rare crash in the beam_types module.
  * erts: Fixed a bug in selective receive optimization that could
    crash 32-bit emulators.
  * erts: A race condition which was very rarely triggered could
    cause the signal queue of a process to become inconsistent
    causing the runtime system to crash.
  * kernel: The tcp connect option 'bind_to_device' could not be
    used with inet_backend = 'socket'. 'inet' requires value type
    binarry() and 'socket' requires value type 'string()'.
  * kernel: Minor issue processing options when calling
    gen_tcp:connect with a sockaddr() and inet_backend = socket.
  * common_test: Change timeout to infinity for gen_server calls in
    cth_log_redirect
  * inets: fixes a missing case of the type specification for
    httpd:info/2/3/4
  * snmp: Single threaded agent crash when vacm table not properly
    initiated.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1683460800">- Changes for 25.3.2:
  * compiler: Fixed type handling bugs that could cause an internal
    error in the compiler for correct code.
  * os_mon: Avoid error report from failing erlang:port_close at
    shutdown of cpu_sup and memsup. Bug exists since OTP 25.3
    (os_mon-2.8.1).
  * erts: If a runtime system which was starting the distribution
    already had existing pids, ports, or references referring to a
    node with the same nodename/creation pair that the runtime
    system was about to use, these already existing pids, ports, or
    references would not work as expected in various situations
    after the node had gone alive. This could only occur if the
    runtime system was communicated such pids, ports, or references
    prior to the distribution was started. That is, it was
    extremely unlikely to happen unless the distribution was
    started dynamically and was even then very unlikely to happen.
    The runtime system now checks for already existing pids, ports,
    and references with the same nodename/creation pair that it is
    about to use. If such are found another creation will be chosen
    in order to avoid these issues.
- Changes for 25.3.1:
  * snmp: Attempts to minimize the number of the error reports
    during a failed agent init.
  * compiler: When a map update such as #{}#{key:=value} that
    should fail with an exception was unused, the exception would
    be lost.
  * compiler: Fixed bug in the validator that made it reject valid
    code.
  * crypto: With this change, random errors are fixed for
    crypto:generate_key calls with OpenSSL 3.
  * erts: Fixed a bug in the loader that prevented certain modules
    compiled with no_ssa_opt from being loaded.
  * erts: Implementations of the call() driver callback that
    returned a faulty encoded result could cause a memory leak and
    could cause invalid data on the heap of the processes calling
    erlang:port_call/3.
  * erts: Fixed a memory corruption issue when upgrading code. The
    bug was introduced in OTP 25.3
  * erts: Fixed configure tests for a few ARM-specific
    instructions, which prevented the emulator from being built on
    some platforms.
  * erts: Aliases created in combination with a monitor using the
    {alias, explicit_unalias} option stopped working from remote
    nodes when a 'DOWN' signal had been received due to the monitor
    or if the monitor was removed using the erlang:demonitor() BIF.
    This bug was introduced in OTP 24.3.4.10 and OTP 25.3.
  * erts: In rare circumstances, bit syntax matching of an invalid
    code point for a utf32 would crash the runtime system.
  * erts: Building the runtime system failed when native atomic
    support was missing. Note that execution on such systems have
    only been rudimentary tested.
  * erl_interface: Fixed configure tests for a few ARM-specific
    instructions, which prevented the emulator from being built on
    some platforms.
  * eldap: Added a new function eldap:info/1 that returns the
    socket and the transport protocol for the eldap connection.
  * inets: Correct timing related pipelining/keepalive queue bug,
    that could result in unexpected "socket_remotly_closed" errors.
  * inets: With this change, upon remote socket closure current
    request is added to a retried queue (either pipeline or
    keep_alive, but not both).
  * ssl: With this change, ssl:connection_information/2 returns
    correct keylog data after TLS1.3 key update.
  * ssl: Client signature algorithm list input order is now honored
    again , it was accidently reversed by a previous fix.
  * stdlib: The type specs in the erl_parse module has been updated
    to include the maybe construct and the ! operator.
  * wx: Improve debug prints from the nifs. Some minor fixes for
    wxWidgets-3.2. Fixed OpenGL debug functions.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1687521600">- Changes for 25.3.2.2:
  * compiler: The compiler could be very slow when compiling guards
    with multiple guard tests separated with 'or' or ';'.
- Changes for 25.3.2.1:
  * xmerl: New options to xmerl_scan and xmerl_sax_parser so one
    can limit the behaviour of the parsers to avoid some XML
    security issues. xmerl_scan gets one new option:
    xmerl_sax_parser gets the following options: The old option
    skip_external_dtd is still valid and the same as
    {external_entities, none} and {fail_undeclared_ref, false} but
    just affects DTD's and not other external references.
  * erts: Fixed a crash during tracing on certain platforms that
    cannot use the machine stack for Erlang code (mainly OpenBSD
    and Linux with musl).
  * erts: Constructing a binary segment not aligned with a byte
    boundary, with a size not fitting in 31 bits, and with a value
    not fitting in a 64-bit word could crash the runtime system.
  * erts: Further robustify implementation of large maps (&gt; 32
    keys). Keys that happen to have same internal 32-bit hash
    values are now put in collision nodes which are traversed with
    linear search. This removes the demand for the internal hash
    function when salted to eventually produce different hashes for
    all possible pairs of unequal terms.
  * stdlib: Static supervisors are very idle processes after they
    have started so they will now be hibernated after start to
    improve resource management.
  * compiler: Fixed a bug where a failing bsl expression in a guard
    threw an exception instead of causing the guard to fail.
  * compiler: Complex guard expression using the or operator and
    guard BIFs that can fail could sometimes be miscompiled so that
    the guard would succeed even if a call to a guard BIF failed.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1687608000">- Version 26.0:
  * Leex has been extended with optional column number support.
  * The family of enumeration functions in module lists has been
    extended with enumerate/3 that allows a step value to be
    supplied.
  * Update Unicode to version 15.0.0.
  * proc_lib:start*/* has become synchronous when the started
    process fails. This requires that a failing process use a new
    function proc_lib:init_fail/2,3, or exits, to indicate failure. All
    OTP behaviours have been fixed to do this.
  * auto-complete of variables, record names, record fields names,
    map keys, function parameter types and filenames.
  * Open external editor in the shell to edit the current
    expression.
  * defining records (with types), functions, specs and types in
    the shell.
  * Creation and matching of binaries with segments of fixed sizes
    have been optimized.
  * Creation and matching of UTF-8 segments have been optimized.
  * Appending to binaries has been optimized.
  * The compiler and JIT now generate better code for creation of
    small maps where all keys are literals known at compile time.
  * Thanks to the optimizations above the performance of the base64
    module has been significantly improved. For example, on an
    x86_64 system with the JIT both encode and decode are almost
    three times faster than in Erlang/OTP 25.
  * Map comprehensions as suggested in EEP 58 has now been
    implemented.
  * Some map operations have been optimized by changing the
    internal sort order of atom keys. This changes the
    (undocumented) order of how atom keys in small maps are printed
    and returned by maps:to_list/1 and maps:next/1. The new order
    is unpredictable and may change between different invocations
    of the Erlang VM.
  * Introducing the new function maps:iterator/2 for creating an
    interator that return the map elements in a deterministic
    order. There are also new modifiers k and K for the format
    string in io:format() to support printing map elements ordered.
  * Added the new built-in type dynamic() introduced in EEP 61, PR
    introducing EEP 61 improving support for gradual type checkers.
  * Dialyzer has a new incremental mode that be invoked by giving
    the --incremental option when running Dialyzer. This new
    incremental mode is likely to become the default in a future
    release.
  * Multi time warp mode is now enabled by default. This assumes
    that all code executing on the system is time warp safe.
  * Support for UTF-8 atoms and strings in the NIF interface
    including new functions enif_make_new_atom,
    enif_make_new_atom_len and enif_get_string_length.
  * The BIFs min/2 and max/2 are now allowed to be used in guards
    and match specs.
  * Improved the selective receive optimization, which can now be
    enabled for references returned from other functions. This
    greatly improves the performance of gen_server:send_request/3,
    gen_server:wait_response/2, and similar functions.
  * It is no longer necessary to enable a feature in the runtime
    system in order to load modules that are using it. It is
    sufficient to enable the feature in the compiler when compiling
    it.
  * inet:setopts/2 has got 3 new options: reuseport, reuseport_lb
    and exclusiveaddruse.
  * Fix so that -fno-omit-frame-pointer is applied to all of the
    Erlang VM when using the JIT so that tools, such as perf, can
    crawl the process stacks.
  * In the lists module, the zip family of functions now takes
    options to allow handling lists of different lengths.
  * Added the zip:zip_get_crc32/2 function to retrieve the CRC32
    checksum from an opened ZIP archive. gen_server optimized by
    caching callback functions
  * The modules Erlang DNS resolver inet_res and helper modules
    have been updated for RFC6891; to handle OPT RR with DNSSEC OK
    (DO) bit.
  * Introduced application:get_supervisor/1.
  * Cache OTP boot code paths, to limit how many folders that are
    being accessed during a module lookup. Can be disabled with
  - cache_boot_path false.
  * Support for Kernel TLS (kTLS), has been added to the SSL
    application, for TLS distribution (-proto_dist inet_tls), the
    SSL option {ktls, true}.
  * Improved error checking and handling of ssl options.
  * Mitigate memory usage from large certificate chains by lowering
    the maximum handshake size. This should not effect the common
    cases, if needed it can be configured to a higher value.
  * For security reasons the SHA1 and DSA algorithms are no longer
    among the default values.
  * Add encoding and decoding of use_srtp hello extension to
    facilitate for DTLS users to implement SRTP functionality.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1687608001">- Changes for 26.0.1:
  * erts: Build of the socket nif failed on Solaris 11.
  * erts: Fixed two reduction-counting bugs relating to binaries.
  * erts: Constructing a binary segment not aligned with a byte
    boundary, with a size not fitting in 31 bits, and with a value
    not fitting in a 64-bit word could crash the runtime system.
  * erts: When a binary construction failed because of bad size for
    a segment, the error information was not always correct.
  * erts: Fixed a crash when calling a fun that was defined in a
    module that had been upgraded.
  * kernel: The POSIX error exdev was sometimes incorrectly
    described as "cross domain link" in some error messages.
  * kernel: Corrected the socket send function description (send
    with Timeout = nowait). The send function(s) could not return
    {ok, {RestData, SelectInfo}}
  * stdlib: The POSIX error exdev was sometimes incorrectly
    described as "cross domain link" in some error messages.
  * ssl: Make sure that selection of client certificates handle
    both TLS-1.3 and TLS-1.2 names correctly. Could cause valid
    client certificate to not be selected, and an empty client
    certificate message to be sent to server.
  * ssl: Improved ssl:format_error/1 to handle more error tuples.
  * ssl: Fixed hanging ssl:connect when ssl application is not
    started.
  * ssl: Correct handling of retransmission timers, current
    behavior could cause unwanted delays.
  * inets: Do not make the default ssl options by calling
    httpc:ssl_verify_host_options(true) if ssl options are supplied
    by the user.
  * xmerl: New options to xmerl_scan and xmerl_sax_parser so one
    can limit the behaviour of the parsers to avoid some XML
    security issues. xmerl_scan gets one new option:
    xmerl_sax_parser gets the following options: The old option
    skip_external_dtd is still valid and the same as
    {external_entities, none} and {fail_undeclared_ref, false} but
    just affects DTD's and not other external references.
  * compiler: Fixed a bug where a failing bsl expression in a guard
    threw an exception instead of causing the guard to fail.
  * compiler: Fixed a bug that would case the validator to reject
    legal code.
  * compiler: The compiler could re-order clauses matching binaries
    so that the incorrect clause would match. That could only
    happen for code that used the option {error_location,line} or
    for code without line or column number information (e.g.
    generated by a parse transform).
  * compiler: Complex guard expression using the or operator and
    guard BIFs that can fail could sometimes be miscompiled so that
    the guard would succeed even if a call to a guard BIF failed.
  * compiler: With optimizations disabled, a try/catch construct
    could return an incorrect value.
  * compiler: In rare circumstance, a combination of binary
    construction and binary_part/3 would cause the compiler to
    generate unsafe code that would crash the runtime system.
  * compiler: The compiler could be very slow when compiling guards
    with multiple guard tests separated with 'or' or ';'.
  * compiler: Complex guard expressions using 'or' and map updates
    could succeed even if the map update failed.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1698235200">- Changes for 26.1.2:
  * erts: If the external term format encoding of an argument list
    part of a distributed spawn operation was faulty, the newly
    spawned remote process could misbehave. The misbehavior
    included hanging or interpret an incoming message as an
    argument list to use. This was very unlikely to happen unless
    using an alternate implementation of the distribution protocol
    which made a faulty encoding of the argument list. The child
    process will now detect this error and terminate before
    executing the user specified code.
  * erts: Fix bugs where if the body of a matchspec would return a
    map with a variable ('$1', '$_' etc) as one of the keys or
    values and the variable was not an immidiate, the term would
    not be copied to the receiving processes heap. This would later
    corrupt the term in the table as the GC could place move
    markers in it, which in turn would cause the VM to crash. Bug
    has been present for since OTP 17.0.
  * xmerl: The xmerl version 1.3.32 was released in OTP 26.0.1, but
    the incorrect version number of 1.3.31.1 was used for it. This
    incorrect version number continued to appear in OTP 26.0.2, OTP
    26.1, and OTP 26.1.1. The actual xmerl code in these OTP
    versions however corresponds to xmerl version 1.3.32.
- Changes for 26.1.1:
  * wx: The wx application would fail to build on macOS with Xcode
    15.
  * compiler: The compiler could become extremely slow for modules
    containing huge functions.
  * stdlib: Garbage collect the shell process when reducing the
    amount of saved history and results.
- Changes for 26.1:
  * crypto: Fix VM crash caused by crypto being purged and reloaded
    (by init:restart for example) on OS with musl libc (such as
    Alpine linux).
  * crypto: Improved understanding of LibreSSL versions. Support
    chacha20 and chacha20_poly1305 for LibreSSL 3.7. Reflect
    removal of support for the DSS/DSA algorithm which was done in
    LibreSSL 2.6.1.
  * crypto: FIPS supported by crypto for OpenSSL 3.0.* and 3.1.*.
  * asn1: The ASN.1 compiler would ignore a constraint such as
    (SIZE (1..4), ...), causing incorrect behavior of the encoding
    and decoding function for the PER and UPER backends. Corrected
    to handle the constraint in the same way as (SIZE (1..4, ...)).
  * asn1: The JER backend has been internally refactored in a way
    that is compatible for applications that use the documented
    API. However, for a group of ASN.1 modules that depend on each
    other (for example, S1AP-PDU-Descriptions, S1AP-Contents, and
    so on), all modules in the group must be recompiled if on of
    the group members is recompiled.
  * observer: Closing the trace log window via the menu did not
    work.
  * erts: maps:put with existing key and identical value was not
    optimized as a no-op correctly if having the same 32-bit hash
    as another key in the map. In practice very rare and harmless.
  * erts: Fixed an issue with truncated crash slogans on failed
    emulator start.
  * erts: Fixed a bug where the emulator was unable to determine
    the current cgroup CPU quota.
  * erts: A process optimized for parallel signal delivery could
    under some circumstances lose wakeup information. That is, the
    processes was not woken up to take care of the signal, so the
    signal would not be taken care of until the process was woken
    by another signal. Only processes configured with
    message_queue_data set to off_heap utilize this optimization.
  * erts: Function socket:close/1 could cause a VM crash on
    Windows.
  * erts: Fixed a bug in the ARM JIT where it could accidentally
    add garbage trailing bits when creating bitstrings whose size
    wasn't an even multiple of 8 bits.
  * erts: Fix erlang:system_info/1 documentation to show correct
    types.
  * erts: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * erts: Fix compilation with GNU termcap.
  * erts: Delivery time of message signals to a process not
    executing any receive expressions could become very long,
    potentially infinite. For example, a process checking for
    messages using process_info(self(), message_queue_len) or
    process_info(self(), messages) and avoiding to execute a
    receive expression matching on messages could be very slow in
    detecting new messages. Note that you are still discouraged
    from using process_info() this way. A process that wants to
    check if there are messages available to handle should execute
    a receive expression matching on messages.
  * erts: On AArch64 (ARM64), when calculating both the quotient
    and remainder with a divisor begin a power two, the remainder
    could be incorrectly calculated.
  * erts: Fix bug causing "magic" references in a compressed ETS
    table to not keep the referred object alive. The symptom would
    be the referred object being garbage collected prematurely and
    the reference appearing stale, not referring to anything.
    Examples of such magically referred objects are atomics and NIF
    resources.
  * erts: Matching out short bitstrings with a fixed size not
    divisible by 8 could could lead to the runtime system
    terminating with an "Overrun heap and stack" error.
  * erts: A constant flow of incoming non-message signals could
    prevent a process needing to execute dirty from doing so.
  * erts: A BEAM file usually contains a chunk with the tag "Type"
    containing type information that can be used by the JIT. The
    beam_lib:strip/1 takes care to preserve that chunk, but a
    build/release tool that does customized stripping could
    accidentally remove the chunk. Loading a BEAM file without the
    "Type" chunk could cause incorrect behavior of the loaded code.
  * erts: gen_udp:recv/* for Unix Domain Socket in binary mode and
    passive mode has been fixed to not crash.
  * erts: The cleanup operation of not yet delivered signals to a
    terminated process yielded excessively.
  * erts: Fixed minor hashing issue with the local option of
    term_to_binary()/term_to_iovec().
  * erts: Update gen_tcp_socket and gen_udp_socket to handle
    'completion' (socket on Windows).
  * erts: Add support for Unix Domain Sockets (only for STREAM
    sockets) on Windows for 'socket'.
  * erts: In Erlang/OTP 27, by default escripts will be compiled
    before being executed. That means that the compiler application
    must be installed. It is possible to force the escript to be
    interpreted by adding the directive -mode(interpret). to the
    escript file. In Erlang/OTP 28, support for interpreting an
    escript will be removed.
  * erts: Add basic support for socket ioctl on Windows.
  * erts: Removed erts/etc/darwin/Info.plist, as it is no longer
    necessary after macos 10.12
  * erts: Add support for (Windows) socket option exclusiveaddruse.
  * erts: [socket] Add support for the 'nopush' option.
  * erts: Add support for socket option 'BSP STATE'.
  * erts: Add tcp socket options 'keepcnt', 'keepidle' and
    'keepintvl'.
  * erts: Add support for misc (Windows) socket options
    ('max_msg_size' and 'maxdg').
  * compiler: The compiler could run forever when compiling a call
    to is_record/3 with a huge positive tuple size. The call
    is_record(A, a, 0) would crash the compiler when used in a
    function body. When used in a guard the compiler would emit
    incorrect code that would accept {a&gt; as a record.
  * compiler: Fixed a bug that caused dialyzer to crash when
    analyzing bogus code that contained the literal atom undefined
    in segment sizes.
  * compiler: The compiler would crash when compiling some modules
    that contained a call to erlang:load_nif/2.
  * compiler: Fixed a bug that caused the compiler to crash on
    legal code.
  * compiler: The compiler could crash when attempting to compile a
    call to is_list/1 in a complex expression.
  * compiler: A complex guard expression using the or operator
    could succeed when it was supposed to fail.
  * compiler: Compiling nested try/catch and catch expression could
    result in an internal compiler error.
  * compiler: Using the bnot operator in a complex expression could
    cause the compiler to terminate with an internal consistency
    failure diagnostic.
  * compiler: Fixed a bug that caused the compiler to crash in a
    binary optimization pass.
  * compiler: The compiler could terminate with an internal error
    when attempting to compile a binary pattern that could not
    possibly match.
  * compiler: Fixed various performance issues related to the alias
    optimization pass.
  * erl_docgen: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * mnesia: Do not delete old backup file if the new backup fails.
  * megaco: Make megaco transports handle gen_tcp | gen_udp with
    socket backend on Windows (completion).
  * common_test: With this change, ct_hooks manual refers to CTH
    execution order section in user guide.
  * common_test: With this change, Config data from
    pre_end_per_testcase hook is delivered to post_end_per_testcase
    callback in case of testcase timetrap or linked process crash.
  * common_test: With this change, remaining references to not
    supported vts tool in ct_run are removed (mainly relates to
    docs and ct_run help message).
  * common_test: With this change, prompt search functionality in
    ct_telnet handles unicode input.
  * common_test: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * stdlib: The compiler could run forever when compiling a call to
    is_record/3 with a huge positive tuple size. The call
    is_record(A, a, 0) would crash the compiler when used in a
    function body. When used in a guard the compiler would emit
    incorrect code that would accept {a&gt; as a record.
  * stdlib: Fix bug in ets:tab2file that could make it fail if
    another Erlang process created the same file at the same time.
  * stdlib: An {else_clause,Value} exception will now be reported
    nicely in the shell.
  * stdlib: Correct return value for error case, so that it matches
    the documented and intended return value {error,
    {already_started, pid()} when local registered names are used.
  * stdlib: sys:get_state/1,2 and sys:replace_state/2,3 has been
    corrected to handle a state named error as a state name, not as
    a failed system callback. For the standard server behaviours
    this was an issue only for gen_statem (and gen_fsm) when the
    state name was error, and for gen_server if the complete state
    was {error,_}.
  * stdlib: Multiple problems were fixed in
    filelib:safe_relative_path/2. If its second argument was a path
    that contained symbolic links, an incorrect result patch could
    be returned. Also, paths were sometimes falsely considered
    unsafe.
  * stdlib: Fix deadlock when erl.exe is used as part of a pipe on
    Windows and trying to set the encoding of the standard_io
    device.
  * stdlib: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * stdlib: Fix h/2,3 to properly render multi-clause
    documentation.
  * stdlib: Timers created by timer:apply_after/4,
    apply_interval/4, and apply_repeatedly/4 would silently fail to
    do the apply if it was not possible to spawn a process when the
    timer expired. This has now been corrected, and if the spawn
    fails, the system will be taken down producing a crash dump.
  * stdlib: When an Erlang source file lacked a module definition,
    there would be a spurious "module name must not be empty"
    diagnostic for each spec in the file.
  * stdlib: The argument descriptions for option types in argparse
    have been made less ambiguous.
  * stdlib: Clarified the documentation of normal shutdown reason
    on gen_server:call/2,3
  * stdlib: Pattern matching and equivalence (=:=, =/=) comparisons
    on 0.0 will now raise a warning, as it will no longer be
    considered equivalent to -0.0 in OTP 27. If a match on 0.0
    specifically is desired (distinct from -0.0), the warning can
    be suppressed by writing +0.0 instead. The arithmetic
    comparison operators are unaffected, including arithmetic
    equality (==). *** POTENTIAL INCOMPATIBILITY ***
  * stdlib: The semantics of the gen_{server,statem,event}
    behaviour's synchronous start behaviour introduced in OTP-26.0
    with OTP-18471, has been clarified in the documentation.
  * stdlib: Added functionality to set a custom multiline prompt.
  * stdlib: A warning for (accidental use of) Triple-Quoted Strings
    has been implemented as per EEP 64. *** POTENTIAL
    INCOMPATIBILITY ***
  * stdlib: The keyboard shortcuts for the shell are now
    configurable.
  * kernel: Fixed an issue with truncated crash slogans on failed
    emulator start.
  * kernel: Fix shell:start_interactive function specification.
  * kernel: Fix code:get_doc/1 to return missing, when it can't
    find erts instead of crashing.
  * kernel: Function socket:close/1 could cause a VM crash on
    Windows.
  * kernel: Fix deadlock when erl.exe is used as part of a pipe on
    Windows and trying to set the encoding of the standard_io
    device.
  * kernel: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * kernel: Fix logger's overload protection mechanism to only
    fetch memory used by messages when needed.
  * kernel: Fixed a number of socket-related issues causing
    incompatibilities with gen_tcp and gen_udp respectively.
  * kernel: gen_tcp:connect with socket address and socket (inet-)
    backend fails because of missing callback function.
  * kernel: The DNS RR cache used by `inet_res` has been fixed to
    preserve insert order, which is beneficial when the DNS server
    returns RRs in some specific order for e.g load balancing
    purposes.
  * kernel: The options `reuseport`, `reuseport_lb` and
    `exclusiveaddruse` were accidentally not allowed for e.g
    `gen_udp:open/1,2`, which has now been corrected.
  * kernel: gen_udp:recv/* for Unix Domain Socket in binary mode
    and passive mode has been fixed to not crash.
  * kernel: Fixed issue where cursor would not be placed at the end
    of the expression when navigating shell history.
  * kernel: Update gen_tcp_socket and gen_udp_socket to handle
    'completion' (socket on Windows).
  * kernel: Add support for Unix Domain Sockets (only for STREAM
    sockets) on Windows for 'socket'.
  * kernel: Add basic support for socket ioctl on Windows.
  * kernel: The file:location/0 type is now exported.
  * kernel: Add support for (Windows) socket option
    exclusiveaddruse.
  * kernel: [socket] Add support for the 'nopush' option.
  * kernel: Add support for socket option 'BSP STATE'.
  * kernel: Add tcp socket options 'keepcnt', 'keepidle' and
    'keepintvl'.
  * kernel: Add support for misc (Windows) socket options
    ('max_msg_size' and 'maxdg').
  * kernel: The keyboard shortcuts for the shell are now
    configurable.
  * kernel: Optimized code_server to reduce repeated work when
    loading the same module concurrently.
  * debugger: The call int:no_break(Module) did not remove any
    breakpoints.
  * debugger: The maybe expression is now supported in the
    Debugger.
  * debugger: The maybe expression is now supported in the
    Debugger.
  * debugger: The call int:no_break(Module) did not remove any
    breakpoints.
  * ssl: Avoid function clause error in ssl:getopts/2 by handling
    that inet:getopts may return an empty list during some
    circumstances, such as the socket being in a closing state.
  * ssl: The API function `ssl:recv/3` has been tightened to
    disallow negative length, which has never been documented to
    work, but was passed through and caused strange errors.
  * ssl: When a client initiated renegotiation was rejected and the
    client socket was in active mode the expected error message to
    the controlling process was not sent.
  * ssl: Add some guidance for signature algorithms configuration
    in ssl applications users guide.
  * snmp: Make snmp handle gen_udp with socket backend on Windows
    (completion).
  * public_key: Country name comparison shall be case insensitive
  * public_key: Add check to disallow duplicate certs in a path
  * inets: With this change, re_write httpd works as expected and
    does not return error.
  * inets: Fixed a bug so httpd does not crash when stopped at the
    wrong time during TLS connection negotiation, or any other
    theoretically as slow connection setup.
  * inets: Enhance error handling and avoid that the HTTP client
    hangs on headers provided on the wrong format.
  * inets: With this change, error report generated by httpd during
    connection setup contains socket type information.
  * inets: Stop and restart of the httpd server in the Inets
    application has been refactored to a more synchronous and OTP
    supervisor friendly approach. This should increase stability
    and for example avoid a supervisor report from
    httpd_connection_sup about killed child process(es) in some
    cases when stopping or restarting httpd.
  * dialyzer: Fixed a bug that caused dialyzer to crash when
    analyzing bogus code that contained the literal atom undefined
    in segment sizes.
  * dialyzer: Dialyzer could crash when attempting to analyze a
    module that defined a type called product/.
- Changes for 26.0.2:
  * erts: Fix using the IME (Input Method Editor) to enter text in
    cmd.exe and powershell.exe on Windows.
  * erts: Multiple socket:accept calls issue. When making multiple
    accept calls, only the last call is active.
  * erts: Fix the shell to ignore terminal delay when the terminal
    capabilities report that they should be used.
  * erts: Fix "oldshell" to echo characters while typing on
    Windows.
  * erts: On Windows, a call to the function socket:close, when
    there are waiting active calls to read, write or accept
    functions, could hang.
  * erts: Fix issues when reading or configuring standard_io on
    Windows when erl.exe is started using -noshell flag.
  * erts: The following functions are now much faster when given a
    long list or binary:
  * erts: On AArch64 (ARM64), equality and non-equality tests with
    literal bitstrings could succeed when they should fail and vice
    versa.
  * compiler: Fixed a type handling bug that would cause an
    internal consistence failure for correct code.
  * compiler: Fixed a bug that could cause the stack trace of throw
    exceptions to be erroneously optimized out.
  * compiler: Complex guard expression using 'or' were not always
    fully evaluated, making guards that were supposed to fail
    succeed.
  * stdlib: Fix bug where when you entered Alt+Enter in the
    terminal, the cursor would move to the last line, instead of
    moving to the next line.
  * stdlib: Fix eof handling when reading from stdin when erlang is
    started using -noshell.
  * stdlib: Fixed problem where output would disappear if it was
    received after a prompt was written in the shell.
  * stdlib: The following functions are now much faster when given
    a long list or binary:
  * kernel: Fix bug where when you entered Alt+Enter in the
    terminal, the cursor would move to the last line, instead of
    moving to the next line.
  * kernel: Fix so that the shell does not crash on startup when
    termcap is not available.
  * kernel: Multiple socket:accept calls issue. When making
    multiple accept calls, only the last call is active.
  * kernel: Fix the shell to ignore terminal delay when the
    terminal capabilities report that they should be used.
  * kernel: Fix "oldshell" to echo characters while typing on
    Windows.
  * kernel: Fix eof handling when reading from stdin when erlang is
    started using -noshell.
  * kernel: On Windows, a call to the function socket:close, when
    there are waiting active calls to read, write or accept
    functions, could hang.
  * kernel: Fix issues when reading or configuring standard_io on
    Windows when erl.exe is started using -noshell flag.
  * kernel: gen_udp:connect with inet_backend = socket fails when
    the Address is a hostname (string or atom).
  * kernel: Fixed problem which would cause shell to crash if
    particular escape sequence was written to stdout.
  * kernel: Fixed problem where output would disappear if it was
    received after a prompt was written in the shell.
  * kernel: Fix a crash where the location of erts could not be
    found in rebar3 dev builds.
  * kernel: Introduce the KERNEL application parameter
    standard_io_encoding that can be used to set the default
    encoding for standard_io. This option needs to be set to latin1
    if the application wants to treat all input data as bytes
    rather than utf-8 encoded characters.
  * ssl: Added keylog information to all protocol versions in
    ssl:connection_information/2.
  * ssl: Add RFC-6083 considerations for DTLS to enable gen_sctp
    based callback for the transport.
  * ssh: Added multiline editing support to ssh clients connected
    through OTP ssh daemon.</changelog>
  <changelog author="sflees@suse.de" date="1704974400">- Changes for 26.2.1:
  * erts: Removed unnecessary PCRE source tar-ball.
  * ssh: With this change (being response to CVE-2023-48795),
    ssh can negotiate "strict KEX" OpenSSH extension with
    peers supporting it; also
    'chacha20-poly1305@openssh.com' algorithm becomes a
    less preferred cipher.
    If strict KEX availability cannot be ensured on both
    connection sides, affected encryption modes(CHACHA and
    CBC) can be disabled with standard ssh configuration.
    This will provide protection against vulnerability, but
    at a cost of affecting interoperability. See
    Configuring algorithms in SSH. (bsc#1218192, CVE-2023-48795)
- Changes for 26.2:
  * all: Replaced unintentional Erlang Public License 1.1
    headers in some files with the intended Apache License
    2.0 header.
  * otp: The removal of the deprecated slave module, originally
    planned for OTP 27, has been postponed to OTP 29.
  * asn1: Fix benign warning from gcc 11 about mismatching call
    to free().
  * crypto: Enable engine support for OpenSSL versions 3.
  * edoc: Emit &lt;code&gt; instead of &lt;tt&gt;.
- Disable test suite for now, it has many false positives and
  takes a very long time.</changelog>
  <changelog author="sflees@suse.de" date="1706011200">- This codestream wasn't affected by bsc#1207113</changelog>
  <changelog author="sflees@suse.de" date="1706011201">- Disable rpmlint tests on SLE-15 where they currently fail</changelog>
  <changelog author="sflees@suse.de" date="1715947200">- Create a versioned package for SLES</changelog>
</package>
<package pkgid="ea2cf4ac08f9431f7904f03f05a5ac68f07c8f6d29eec866bfcacfa224654e56" name="erlang26-debugger-src" arch="x86_64">
  <version epoch="0" ver="26.2.1" rel="150300.7.5.1"/>
  <changelog author="matwey.kornilov@gmail.com" date="1646568000">- Changes for 24.2.2:
  * inets: Avoid intermediate ungraceful shutdown of the HTTP
    server.
  * ssh: The ssh sever parallel_login option was missing in OTP-24</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1648382400">- Changes for 24.3.2:
  * erl_interface: Fix compile error regarding gethostbyaddr_r on
    Android. Error introduced in OTP 24.3.
  * kernel: Fix failed accepted connection setup after previous
    established connection from same node closed down silently.
  * kernel: Fixed a problem where typing Ctrl-R in the shell could
    hang if there were some problem with the history log file.
- Changes for 24.3.1:
  * dialyzer: There could be spurious warnings for unknown types
    when a type was a subtype of an existing type that was a
    subtype of an unknown type.
  * ssl: Client certification could fail for TLS-1.3 servers that
    did not include the certificat_authorties extension in its
    certificate request message.
- Changes for 24.3:
  * megaco: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.
  * megaco: Update the performance and debug chapters of the megaco
    user's guide. Also some updates to the meas tools.
  * compiler: The expression &lt;&lt;0/native-float&gt;&gt;=Bin would always
    fail to match, while &lt;&lt;0/float-native&gt;&gt;=Bin would match
    (provided that Bin contained the binary representation of 0.0)
  * compiler: The compiler will now compile huge functions with
    straight-line code faster.
  * erl_interface: Add --enable-ei-dynamic-lib configure option
    that will make erl_interface also release a dynamic library
    version of libei.
  * erl_interface: The ei API for decoding/encoding terms is not
    fully 64-bit compatible since terms that have a representation
    on the external term format larger than 2 GB cannot be handled.
  * sasl: Fix bug in systools:make_script/1 documentation.
  * inets: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.
  * inets: Documentation fix for inets:services_info/0, which now
    describes that Info might be a Reason term() in case when
    {error, Reason} is returned as service info.
  * crypto: The crypto app in OTP can since OTP-24.2 be compiled,
    linked and used with the new OpenSSL 3.0 cryptolib. The crypto
    app has 3.0 support has been improved, but is still *not
    recommended* for other usages than experiments and alpha
    testing. There are not yet any guaranties that it works, not
    even together with other OTP applications like for example SSL
    and SSH, although there are no known errors. Since the previous
    release, OTP-24.2, the following improvements have been done: -
    It has been tested during nearly every nightly test on the OTP
    lab - The hash algorithms md4 and ripemd160 have been enabled
    with OpenSSL 3.0. - The ciphers blowfish_cbc, blowfish_ecb,
    des_cbc, des_cfb, des_ecb, rc2_cbc and rc4 have been enabled
    with OpenSSL 3.0. Disabled or unsupported with OpenSSL 3.0 are
    still: - ENGINE support - FIPS mode - Other providers than the
    built-in ones - Compiling and linking with OpenSSL 3.0
    cryptolib in compatibility modes (for example to behave as
    1.1.1) and, the ciphers blowfish_cfb64 and blowfish_ofb64 are
    not supported and will not be either. Deprecated functions in
    the OpenSSL 3.0 cryptolib must not be disabled as OTP/crypto
    still uses some of the deprecated API functions. The gcc flag
  - Wno-deprecated-declarations is set to prevent deprecation
    warnings to be printed when compiling.
  * crypto: Crypto is adapted to LibreSSL 3.5.0 on OpenBSD.
  * crypto: New configure option ( --disable-otp-test-engine) to
    prohibit the build of the OTP test engine used in some test
    suites. The reason is that the test engine could be hard to
    compile on for instance LibreSSL 3.5.0. For that particular
    cryptolib version (or higher), this configure option is set
    automatically.
  * jinterface: Fix bug in OtpOutputStream.write_pid/4 and
    write_ref/3 causing faulty encodig. Bug exists since OTP 23.0.
  * wx: Removed the static_data option from wxImage creation
    functions, as it was broken and could lead to crashes. Now
    image data is always copied to wxWidgets as was the default
    behavior. Removed some non working wxGridEvent event types,
    which have there own events in newer wxWidgets versions, and
    added a couple of event types that where missing in wx.
  * asn1: Add support for the maps option in combination with the
    jer backend.
  * snmp: The compilation time is no longer recorded in BEAM files.
    There remained several undocumented functions that attempted to
    retrieve compilation times. Those have now been removed.
  * snmp: [agent] Remove expectation of socket being a port.
  * common_test: OTP internal test fix.
  * runtime_tools: Fixed bug in scheduler:utilization(Seconds) that
    would leave the scheduler_wall_time system flag incorrectly
    enabled.
  * runtime_tools: Add scheduler:get_sample/0 and get_sample_all/0.
    Also clarify scheduler module documentation about how it
    depends on system flag scheduler_wall_time.
  * erts: Fixed a bug in the x86 JIT that might cause floating
    point instructions to wrongly throw an exception.
  * erts: Preserve correct nodedown_reason if supervised
    distribution controller processes exit with {shutdown, Reason}.
  * erts: Handling of send_timeout for gen_tcp has been corrected
    so that the timeout is honored also when sending 0 bytes.
  * erts: By default global does not take any actions to restore a
    fully connected network when connections are lost due to
    network issues. This is problematic for all applications
    expecting a fully connected network to be provided, such as for
    example mnesia, but also for global itself. A network of
    overlapping partitions might cause the internal state of global
    to become inconsistent. Such an inconsistency can remain even
    after such partitions have been brought together to form a
    fully connected network again. The effect on other applications
    that expects that a fully connected network is maintained may
    vary, but they might misbehave in very subtle hard to detect
    ways during such a partitioning. In order to prevent such
    issues, we have introduced a prevent overlapping partitions fix
    which can be enabled using the prevent_overlapping_partitions
    kernel(6) parameter. When this fix has been enabled, global
    will actively disconnect from nodes that reports that they have
    lost connections to other nodes. This will cause fully
    connected partitions to form instead of leaving the network in
    a state with overlapping partitions. Note that this fix has to
    be enabled on all nodes in the network in order to work
    properly. Since this quite substantially changes the behavior,
    this fix is currently disabled by default. Since you might get
    hard to detect issues without this fix you are, however,
    strongly advised to enable this fix in order to avoid issues
    such as the ones described above. As of OTP 25 this fix will
    become enabled by default.
  * erts: Corrected the type specification of erlang:seq_trace/2.
  * erts: Fix memory leak when tracing on running on a process that
    only handle system tasks or non-message signals (for example
    process_info requests).
  * erts: Add support for using socket:sockaddr_in() and
    socket:sockaddr_in6() when using gen_sctp, gen_tcp and gen_udp.
    This will make it possible to use Link Local IPv6 addresses.
  * erts: Show on_load failure reasons in embedded mode.
  * erts: Compile date saved in the Erlang VM executable has been
    removed.
  * erts: Improve documentation for the dynamic node name feature.
  * ssh: Fix makefile dependency bugs.
  * ssh: Fixed faulty OpenSSH decoding of Ed25519/Ed448 keys in the
    OpenSSH format openssh_key_v1.
  * ssh: Correction of ssh_file typing, specially for the
    experimental openssh-key-v1 encoding.
  * ssh: Improper tag for private ED keys when encoding with
    ssh:encode/2. The tuple had ed_priv as first element, but
    should have had ed_pri. This is now corrected. *** POTENTIAL
    INCOMPATIBILITY ***
  * ssh: Add support for Ed25519/Ed448 SSH host keys in the RFC
    4716 format ("-----BEGIN EC PRIVATE KEY-----") generated by for
    example openssl or via Erlang functions (i.e.
    public_key:generate_key({namedCurve, ed25519})). Ed25519 SSH
    host keys generated by ssh-keygen was, and are still,
    supported.
  * kernel: Handling of send_timeout for gen_tcp has been corrected
    so that the timeout is honored also when sending 0 bytes.
  * kernel: By default global does not take any actions to restore
    a fully connected network when connections are lost due to
    network issues. This is problematic for all applications
    expecting a fully connected network to be provided, such as for
    example mnesia, but also for global itself. A network of
    overlapping partitions might cause the internal state of global
    to become inconsistent. Such an inconsistency can remain even
    after such partitions have been brought together to form a
    fully connected network again. The effect on other applications
    that expects that a fully connected network is maintained may
    vary, but they might misbehave in very subtle hard to detect
    ways during such a partitioning. In order to prevent such
    issues, we have introduced a prevent overlapping partitions fix
    which can be enabled using the prevent_overlapping_partitions
    kernel(6) parameter. When this fix has been enabled, global
    will actively disconnect from nodes that reports that they have
    lost connections to other nodes. This will cause fully
    connected partitions to form instead of leaving the network in
    a state with overlapping partitions. Note that this fix has to
    be enabled on all nodes in the network in order to work
    properly. Since this quite substantially changes the behavior,
    this fix is currently disabled by default. Since you might get
    hard to detect issues without this fix you are, however,
    strongly advised to enable this fix in order to avoid issues
    such as the ones described above. As of OTP 25 this fix will
    become enabled by default.
  * kernel: Fix bug where logger would crash when logging a report
    including improper lists.
  * kernel: Make erlang:set_cookie work for dynamic node names.
  * kernel: Add support for using socket:sockaddr_in() and
    socket:sockaddr_in6() when using gen_sctp, gen_tcp and gen_udp.
    This will make it possible to use Link Local IPv6 addresses.
  * kernel: A net_tickintensity kernel parameter has been
    introduced. It can be used to control the amount of ticks
    during a net_ticktime period. A new net_kernel:start/2 function
    has also been introduced in order to make it easier to add new
    options. The use of net_kernel:start/1 has been deprecated.
  * kernel: Improve documentation for the dynamic node name
    feature.
  * erl_docgen: Fix css for large tables and images on small
    screens
  * erl_docgen: Fix bug with codeinclude tag that caused it to not
    include the code if used in a correct, but unexpected way.
  * observer: Calculate the display width in etop, instead of hard-
    coding it to 89 characters.
  * debugger: Fix record index matching, it was broken and could
    never match.
  * ssl: Improved error handling.
  * ssl: Before this change, net_kernel used with TLS distribution
    might be leaking processes in case of connectivity issues.
  * ssl: Fix makefile dependency bugs.
  * ssl: Make sure the TLS sender process handles explicit calls to
    erlang:disconnect_node properly, avoiding potential hanging
    problems in net_kernel.
  * ssl: Add support for TLS-1.3 certificate_authorities extension.
    And process certificate_authorities field in pre-TLS-1.3
    certificate requests.
  * ssl: Support password fun for protected keyfiles in ssl:connect
    function.
  * ssl: Add in some cases earlier detection of possible DoS
    attacks by malicious clients sending unexpected TLS messages
    instead of the client hello. Note that such attacks are already
    mitigated by providing a timeout for the TLS handshake.
  * eldap: Fix eldap extensibleMatch dnAttributes option. According
    to the ldap ASN1 the dnAttributes should be a bool, instead it
    was generated as a string.
  * eldap: Implemented paged searches according to https://www.rfc-
    editor.org/rfc/rfc2696.txt
  * public_key: Support password fun for protected keyfiles in
    ssl:connect function.
  * stdlib: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.
  * mnesia: Reduce the number of locks taken during table copying,
    should reduce the startup time on large systems.
  * diameter: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1649246400">- Fix build for Factory. Currently, any Java version
  is fine for Erlang.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1653220800">- Version 25.0:
  - stdlib
  * New function filelib:ensure_path/1 will ensure that all
    directories for the given path exists
  * New functions groups_from_list/2 and groups_from_list/3 in
    the maps module
  * New functions uniq/1 uniq/2 in the lists module
  * New PRNG added to the rand module, for fast pseudo-random
    numers.
  - compiler, kernel, stdlib, syntax_tools:
  * Added support for selectable features as described in EEP-60.
    Features can be enabled/disabled during compilation with
    options (ordinary and +term) to erlc as well as with
    directives in the file. Similar options can be used to erl
    for enabling/disabling features allowed at runtime. The new
    maybe expression EEP-49 is fully supported as the feature
    maybe_expr.
  - erts &amp; JIT:
  * The JIT now works for 64-bit ARM processors.
  * The JIT now does type-based optimizations based on type
    information in the BEAM files.
  * Improved the JIT’s support for external tools like perf and
    gdb, allowing them to show line numbers and even the original
    Erlang source code when that can be found.
  - erts, stdlib, kernel:
  * Users can now configure ETS tables with the
    {write_concurrency, auto} option. This option forces tables
    to automatically change the number of locks that are used at
    run-time depending on how much concurrency is detected. The
    {decentralized_counters, true} option is enabled by default
    when {write_concurrency, auto} is active.
  * Benchmark results comparing this option with the other ETS
    optimization options are available here: benchmarks.
  * To enable more optimizations, BEAM files compiled with OTP 21
    and earlier cannot be loaded in OTP 25.
  * The signal queue of a process with the process flag
    message_queue_data=off_heap has been optimized to allow
    parallel reception of signals from multiple processes. This
    can improve performance when many processes are sending in
    parallel to one process. See benchmark.
  * The Erlang installation directory is now relocatable on the
    file system given that the paths in the installation’s
    RELEASES file are paths that are relative to the
    installations root directory.
  * A new option called short has been added to the functions
    erlang:float_to_list/2 and erlang:float_to_binary/2. This
    option creates the shortest correctly rounded string
    representation of the given float that can be converted back
    to the same float again.
  * Introduction of quote/1 and unquote/1 functions in the
    uri_string module - a replacement for the deprecated
    functions http_uri:encode and http_uri:decode.
  * The new module peer supersedes the slave module. The slave
    module is now deprecated and will be removed in OTP 27.
  * global will now by default prevent overlapping partitions due
    to network issues. This is done by actively disconnecting
    from nodes that reports that they have lost connections to
    other nodes. This will cause fully connected partitions to
    form instead of leaving the network in a state with
    overlapping partitions.
  * It is possible to turn off the new behavior by setting the
    the kernel configuration parameter
    prevent_overlapping_partitions to false. Doing this will
    retain the same behavior as in OTP 24 and earlier.
  * The format_status/2 callback for gen_server, gen_statem and
    gen_event has been deprecated in favor of the new
    format_status/1 callback.
  * The new callback adds the possibility to limit and change
    many more things than the just the state.
  * The timer module has been modernized and made more efficient,
    which makes the timer server less susceptible to being
    overloaded. The timer:sleep/1 function now accepts an
    arbitrarily large integer.
  - compiler:
  * The maybe ... end construction as proposed in EEP-49 has been
    implemented. It can simplify complex code where otherwise
    deeply nested cases would have to be used.
  * To enable maybe, give the option {enable_feature,maybe_expr}
    to the compiler. The exact option to use will change in a
    coming release candidate and then it will also be possible to
    use from inside the module being compiled.
  * When a record matching or record update fails, a {badrecord,
    ExpectedRecordTag} exception used to be raised. In this
    release, the exception has been changed to {badrecord,
    ActualValue}, where ActualValue is the value that was found
    instead of the expected record.
  * Add compile attribute -nifs() to empower compiler and loader
    with information about which functions may be overridden as
    NIFs by erlang:load_nif/2.
  * Improved and more detailed error messages when binary
    construction with the binary syntax fails. This applies both
    for error messages in the shell and for
    erl_error:format_exception/3,4.
  * Change format of feature options and directives for better
    consistency. Options to erlc and the -compile(..) directive
    now has the format {feature, feature-name, enable | disable}.
    The -feature(..) now has the format -feature(feature-name,
    enable | disable).
  - crypto:
  * Add crypto:hash_equals/2 which is a constant time comparision
    of hashvalues.
  - ssl:
  * Introducing a new (still experimental) option
    {certs_keys,[cert_key_conf()]}. With this a list of a
    certificates with their associated key may be used to
    authenticate the client or the server. The certificate key
    pair that is considered best and matches negotiated
    parameters for the connection will be selected.
  - public_key:
  * Functions for retrieving OS provided CA-certs added.
  - dialyzer:
  * Optimize operations in the erl_types module. Parallelize the
    Dialyzer pass remote.
  * Added the missing_return and extra_return options to raise
    warnings when specifications differ from inferred types.
    These are similar to, but not quite as verbose as overspecs
    and underspecs.
  * Dialyzer now better understands the types for min/2, max/2,
    and erlang:raise/3. Because of that, Dialyzer can potentially
    generate new warnings. In particular, functions that use
    erlang:raise/3 could now need a spec with a no_return()
    return type to avoid an unwanted warning.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1656849600">- Changes for 25.0.2:
  * ssl: Improved handling of unexpected messages during the
    handshake, taking the right action for unexpected messages.
  * erts: On computers with the ARM64 (AArch64) architecture (such
    as Apple Silicon Macs) a rem expression followed by a div
    expression with the same operands could evaluate to the wrong
    result if the result of the rem expression was unused.
- Changes for 25.0.1:
  * ssl: When a TLS-1.3 enabled client tried to talk to a TLS-1.2
    server that coalesces TLS-1.2 handshake message over one TLS
    record, the connection could fail due to some message being
    handled in the wrong state, this has been fixed.
  * ssl: Correctly handles supported protocol version change from
    default to something else by sni_fun supplied to
    ssl:handshake/[2,3] together with a TCP-socket (so called
    upgrade).
  * ssl: Also, TLS-1.3 should respond with a protocol version alert
    if previous versions, that are supported but not configured,
    are attempted.
  * kernel: The DNS resolver inet_res has been fixed to ignore
    trailing dot difference in the request domain between the sent
    request and the received response, when validating a response.
  * kernel: A bug in inet_res has been fixed where a missing
    internal {ok,_} wrapper caused inet_res:resolve/* to return a
    calculated host name instead of an `{ok,Msg} tuple, when
    resolving an IP address or a host name that is an IP address
    string.
  * kernel: The erlang:is_alive() BIF could return true before
    configured distribution service was available. This bug was
    introduced in OTP 25.0 ERTS version 13.0. The
    erlang:monitor_node() and erlang:monitor() BIFs could
    erroneously fail even though configured distribution service
    was available. This occurred if these BIFs were called after
    the distribution had been started using dynamic node name
    assignment but before the name had been assigned.
  * kernel: Added the missing mandatory address/0 callback in the
    gen_tcp_dist example.
  * erts: A spawn_reply signal from a remote node could be delayed
    and be delivered after other signals from the newly spawned
    process. When this bug triggered, the connection to the node
    where the process was spawned sometimes could be taken down due
    to the bug. The following error message would then be logged if
    this happened: Missing 'spawn_reply' signal from the node
    &lt;RemoteNode&gt; detected by &lt;Pid&gt; on the node &lt;LocalNode&gt;. The
    node &lt;RemoteNode&gt; probably suffers from the bug with ticket id
    OTP-17737. This bug only affected processes which had enabled
    off_heap message_queue_data and parallel reception of signals
    had been automatically enabled. This bug was introduced in OTP
    25.0, ERTS version 13.0.
  * erts: Fixed type spec of erlang:system_info(dist_ctrl).
  * erts: The zlib built in to the runtime system has been updated
    to version 1.2.12. (Note that on most platforms, the platform's
    own zlib is used.)
  * erts: The erlang:is_alive() BIF could return true before
    configured distribution service was available. This bug was
    introduced in OTP 25.0 ERTS version 13.0. The
    erlang:monitor_node() and erlang:monitor() BIFs could
    erroneously fail even though configured distribution service
    was available. This occurred if these BIFs were called after
    the distribution had been started using dynamic node name
    assignment but before the name had been assigned.
  * crypto: Note in the documentation that MODP (rfc3526) groups
    and OpenSSL 3.0 can give an error if a call to
    crypto:generate_key/2 specifies a key length, and that length
    is to small.
  * crypto: The cmac now uses only the 3.0 API
  * crypto: Documentation is now updated with which OpenSSL
    cryptolib versions that OTP currently is tested.
  * dialyzer: Fixed the documentation for the missing_return and
    extra_return options.
  * mnesia: Fixed add_table_copy which could leave a table lock if
    the receiving node went down during the operation.
  * ssh: Binaries can be limited in logs with the parameter
    max_log_item_len. The default value is 500 bytes.
  * stdlib: In the initial release of Erlang/OTP 25, the expression
    bound to the _ pseudo-field in a record initialization would
    always be evaluated once, even if all other fields in the
    record were explicitly initialized. That would break the use
    case of binding the expression error(...) to _ in order to get
    an exception if not all fields were initialized. The behavior
    of binding to _ has been reverted to the pre-OTP 25 behavior,
    that is, to not evaluate the expression if all fields have been
    bound to explicit values.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1660046400">- Changes for 25.0.3:
  * erts: Distributed exit signals could be lost under the
    following conditions:
  * erts: A race could cause process_info(Pid, message_queue_len)
    on other processes to return invalid results.
  * erts: Fixed reduction counting for handling process system
    tasks.
  * erts: Priority elevation of terminating processes did not work
    which could cause execution of such processes to be delayed.
  * erts: An unlink operation made by a process that terminated
    before the unlink operation completed, i.e., before it had
    received an unlink-ack signal from the linked process, caused
    an exit signal to erroneously be sent from the terminating
    process to the process being unlinked. This exit signal would
    most often be ignored by the receiver, but if the receiver of
    the exit signal concurrently set up a new link, it could
    receive the exit signal with the actual exit reason of the
    terminating process instead of a noproc exit reason. It is
    however very hard to detect that this has happened and has no
    obvious negative consequences, so it should be considered
    harmless. A distributed unlink-ack signal received by a
    terminating process was also not properly removed which could
    cause a minor memory leak.
  * ssl: The link to crypto:engine_load refered the function with
    wrong arity.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1661601600">- Changes for 25.0.4:
  * kernel: A call to net_kernel:setopts(new, Opts) at the same
    time as a connection was being set up could cause a deadlock
    between the net_kernel process and the process setting up the
    connection.
  * erts: The monitor/3 BIF did not apply options to the created
    monitor if the target process or port did not exist. That is,
    the corresponding down message would get a `DOWN` tag even if a
    custom tag had been set, and the returned reference was not an
    alias even if the alias option had been passed.
  * erts: The erlang:monotonic_time/1, erlang:system_time/1,
    erlang:time_offset/1, and os:system_time/1 BIFs erroneously
    failed when passed the argument native.</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1665662400">- Changes for 25.1.1:
  * dialyzer: Dialyzer could crash when analyzing Elixir code that
    used intricate macros.
  * dialyzer: The --input_list_file option has been added.
  * ssl: Fixes handling of symlinks in cacertfile option.
  * eunit: With this change, eunit exact_execution option works
    with application primitive.
  * stdlib: peer nodes failed to halt when the process supervising
    the control connection crashed. When an alternative control
    connection was used, this supervision process also quite
    frequently crashed when the peer node was stopped by the node
    that started it which caused the peer node to linger without
    ever halting.
  * asn1: For the per and uper ASN.1 encoding rules, encoding and
    decoding the SEQUENCE OF and SET OF constructs with 16384 items
    or more is now supported.
  * erts: Listen sockets created with the socket module, leaked
    (erlang-) monitors.
  * erts: Notifications about available distribution data sent to
    distribution controller processes could be lost. Distribution
    controller processes can be used when implementing an
    alternative distribution carrier. The default distribution over
    tcp was not effected and the bug was also not present on
    x86/x86_64 platforms.
  * kernel: Listen sockets created with the socket module, leaked
    (erlang-) monitors.
  * kernel: peer nodes failed to halt when the process supervising
    the control connection crashed. When an alternative control
    connection was used, this supervision process also quite
    frequently crashed when the peer node was stopped by the node
    that started it which caused the peer node to linger without
    ever halting.
- Changes for 25.1:
  * dialyzer: Two bugs have been fixed in Dialyzer's checking of
    behaviors: When a mandatory callback function is present but
    not exported, Dialyzer would not complain about a missing
    callback. When an optional callback function was not exported
    and had incompatible arguments and/or the return values were
    incompatible, Dialyzer would complain. This has been changed to
    suppress the warning, because the function might not be
    intended to be a callback function, for instance if a release
    added a new optional callback function (such as format_status/1
    for the gen_server behaviour added in OTP 25).
  * dialyzer: The no_extra_return and no_missing_return warnings
    can now be suppressed through -dialyzer directives in source
    code.
  * jinterface: Fix javadoc build error by adding option -encoding
    UTF-8.
  * diameter: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * crypto: Fix configure with --with-ssl and --disable-dynamic-
    ssl-lib on Windows.
  * crypto: Remove all references correctly in the garbage
    collection if an engine handle was not explicit unloaded.
  * crypto: Changed the behaviour of the engine load/unload
    functions The engine load/unload functions have got changed
    semantics to get a more consistent behaviour and work correct
    when variables are garbage collected. The load functions now
    don't register the methods for the engine to replace. That will
    now be handled with the new functions
    engine_register/engine_unregister if needed. Some functions are
    removed from the documentation and therefor the API, but they
    are left in the code for compatibility. *** POTENTIAL
    INCOMPATIBILITY ***
  * crypto: Fixed a naming bug for AES-CFB and Blowfish-CFB/OFB
    when linked with OpenSSL 3.0 cryptolib.
  * crypto: Sign/verify does now behave as in OTP-24 and earlier
    for eddsa.
  * crypto: Pass elliptic curve names from crypto.erl to crypto's
    nif.
  * crypto: The configure option --disable-deprecated-warnings is
    removed. It was used for some releases when the support for
    OpenSSL 3.0 was not completed. It is not needed in OTP 25.
  * crypto: Crypto is now considered to be usable with the OpenSSL
    3.0 cryptolib for production code. ENGINE and FIPS are not yet
    fully functional.
  * crypto: Do not exit if the legacy provider is missing in
    libcrypto 3.0.
  * ssl: Reject unexpected application data in all relevant places
    for all TLS versions. Also, handle TLS-1.3 middlebox
    compatibility with more care. This will make malicious
    connections fail early and further, mitigate possible DoS
    attacks, that would be caught by the handshake timeout. Thanks
    to Aina Toky Rasoamanana and Olivier Levillain from Télécom
    SudParis for alerting us of the issues in our implementation.
  * ssl: With this change, value of cacertfile option will be
    adjusted before loading certs from the file. Adjustments
    include converting relative paths to absolute and converting
    symlinks to actual file path. Thanks to Marcus Johansson
  * ssl: In TLS-1.3, if chain certs are missing (so server auth
    domain adherence can not be determined) send peer cert and hope
    the server is able to recreate a chain in its auth domain.
  * ssl: Make sure periodical refresh of CA certificate files
    repopulates cache properly.
  * ssl: Correct internal CRL cache functions to use internal
    format consistently.
  * ssl: Incorrect handling of client middlebox negotiation for
    TLS-1.3 could result in that a TLS-1.3 server would not use
    middlebox mode although the client was expecting it too and
    failing the negotiation with unexpected message.
  * ssl: If the "User" process, the process starting the TLS
    connection, gets killed in the middle of spawning the dynamic
    connection tree make sure we do not leave any processes behind.
  * ssl: A vulnerability has been discovered and corrected. It is
    registered as CVE-2022-37026 "Client Authentication Bypass".
    Corrections have been released on the supported tracks with
    patches 23.3.4.15, 24.3.4.2, and 25.0.2. The vulnerability
    might also exist in older OTP versions. We recommend that
    impacted users upgrade to one of these versions or later on the
    respective tracks. OTP 25.1 would be an even better choice.
    Impacted are those who are running an ssl/tls/dtls server using
    the ssl application either directly or indirectly via other
    applications. For example via inets (httpd), cowboy, etc. Note
    that the vulnerability only affects servers that request client
    certification, that is sets the option {verify, verify_peer}.
    (bsc#1205318)
  * eunit: With this change, Eunit can optionally not try to
    execute related module with "_tests" suffix. This might be used
    for avoiding duplicated executions when source and test modules
    are located in the same folder.
  * erl_docgen: Update DTD to allow XML tag em under pre.
  * inets: Add httpc:ssl_verify_host_options/1 to help setting
    default ssl options for the https client.
  * inets: This change fixes dialyzer warnings generated for
    inets/httpd examples (includes needed adjustment of spec for
    ssh_sftp module).
  * inets: Remove documentation of no longer supported callback.
  * stdlib: Fixed inconsistency bugs in global due to
    nodeup/nodedown messages not being delivered before/after
    traffic over connections. Also fixed various other
    inconsistency bugs and deadlocks in both global_group and
    global. As building blocks for these fixes, a new BIF
    erlang:nodes/2 has been introduced and
    net_kernel:monitor_nodes/2 has been extended. The -hidden and
  - connect_all command line arguments did not work if multiple
    instances were present on the command line which has been
    fixed. The new kernel parameter connect_all has also been
    introduced in order to replace the -connect_all command line
    argument.
  * stdlib: Fix the public_key:ssh* functions to be listed under
    the correct release in the Removed Functionality User's Guide.
  * stdlib: The type spec for format_status/1 in gen_statem,
    gen_server and gen_event has been corrected to state that the
    return value is of the same type as the argument (instead of
    the same value as the argument).
  * stdlib: If the timer server child spec was already present in
    kernel_sup but it was not started, the timer server would fail
    to start with an {error, already_present} error instead of
    restarting the server.
  * stdlib: When changing callback module in gen_statem the
    state_enter calls flag from the old module was used in for the
    first event in the new module, which could confuse the new
    module and cause malfunction. This bug has been corrected. With
    this change some sys debug message formats have been modified,
    which can be a problem for debug code relying on the format.
  * ** POTENTIAL INCOMPATIBILITY ***
  * stdlib: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * stdlib: The rfc339_to_system_time/1,2 functions now allows the
    minutes part to be omitted from the time zone.
  * stdlib: The receive statement in gen_event has been optimized
    to not use selective receive (which was never needed, and could
    cause severe performance degradation under heavy load).
  * stdlib: Add new API function erl_features:configurable/0
  * parsetools: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * public_key: Support more Linux distributions in cacerts_load/0.
  * public_key: Correct asn1 typenames available in type
    pki_asn1_type()
  * public_key: Sign/verify does now behave as in OTP-24 and
    earlier for eddsa.
  * snmp: Improved the get-bulk response max size calculation. Its
    now possible to configure 'empty pdu size', see appendix c for
    more info.
  * snmp: Fix various example dialyzer issues
  * ssh: Handling rare race condition at channel close.
  * ssh: New ssh option no_auth_needed to skip the ssh
    authentication. Use with caution!
  * ssh: This change fixes dialyzer warnings generated for
    inets/httpd examples (includes needed adjustment of spec for
    ssh_sftp module).
  * ssh: The new function ssh:daemon_replace_options/2 makes it
    possible to change the Options in a running SSH server.
    Established connections are not affected, only those created
    after the call to this new function.
  * ssh: Add a timeout as option max_initial_idle_time. It closes a
    connection that does not allocate a channel within the timeout
    time. For more information about timeouts, see the Timeouts
    section in the User's Guide Hardening chapter.
  * observer: Fixed units in gui.
  * xmerl: There is a new configure option, --enable-deterministic-
    build, which will apply the deterministic compiler option when
    building Erlang/OTP. The deterministic option has been improved
    to eliminate more sources of non-determinism in several
    applications.
  * asn1: There is a new configure option, --enable-deterministic-
    build, which will apply the deterministic compiler option when
    building Erlang/OTP. The deterministic option has been improved
    to eliminate more sources of non-determinism in several
    applications.
  * erts: Fixed inconsistency bugs in global due to nodeup/nodedown
    messages not being delivered before/after traffic over
    connections. Also fixed various other inconsistency bugs and
    deadlocks in both global_group and global. As building blocks
    for these fixes, a new BIF erlang:nodes/2 has been introduced
    and net_kernel:monitor_nodes/2 has been extended. The -hidden
    and -connect_all command line arguments did not work if
    multiple instances were present on the command line which has
    been fixed. The new kernel parameter connect_all has also been
    introduced in order to replace the -connect_all command line
    argument.
  * erts: Fixed IPv6 multicast_if and membership socket options.
  * erts: Accept funs (NEW_FUN_EXT) with incorrectly encoded size
    field. This is a workaround for a bug (OTP-18104) existing in
    OTP 23 and 24 that could cause incorrect size fields in certain
    cases. The emulator does not use the decoded size field, but
    erl_interface still does and is not helped by this workaround.
  * erts: Fixed issue with inet:getifaddrs hanging on pure IPv6
    Windows
  * erts: Fix faulty distribution encoding of terms with either The
    symptom could be failed decoding on the receiving side leading
    to aborted connection. Fix OTP-18093 is a workaround for theses
    bugs that makes the VM accepts such faulty encoded funs. The
    first encoding bug toward pending connection exists only in OTP
    23 and 24, but the second one exists also on OTP 25.
  * erts: Fixed emulator crash that could happen during crashdump
    generation of ETS tables with options ordered_set and
    {write_concurrency,true}.
  * erts: Retrieval of monotonic and system clock resolution on
    MacOS could cause a crash and/or erroneous results.
  * erts: Fix bug where the max allowed size of erl +hmax was lower
    than what was allowed by process_flag.
  * erts: On computers with ARM64 (AArch64) processors, the JIT
    could generate incorrect code when more than 4095 bits were
    skipped at the tail end of a binary match.
  * erts: In rare circumstances, an is_binary/1 guard test could
    succeed when given a large integer.
  * erts: Fix bug causing ets:info (and sometimes ets:whereis) to
    return 'undefined' for an existing table if a concurrent
    process were doing ets:insert with a long list on the same
    table.
  * erts: Fix writing and reading of more than 2 GB in a single
    read/write operation on macOS. Before this fix attempting to
    read/write more than 2GB would result in {error,einval}.
  * erts: Fix bug sometimes causing emulator crash at node shutdown
    when there are pending connections. Only seen when running duel
    distribution protocols, inet_drv and inet_tls_dist.
  * erts: Yield when adjusting large process message queues due to
    The message queue adjustment work will now be interleaved with
    all other types of work that processes have to do, even other
    message queue adjustment work.
  * erts: Add rudimentary debug feature (option) for the inet-
    driver based sockets, such as gen_tcp and gen_udp.
  * erts: Introduced the hidden and dist_listen options to
    net_kernel:start/2. Also documented the -dist_listen command
    line argument which was erroneously documented as a kernel
    parameter and not as a command line argument.
  * erts: New documentation chapter "Debugging NIFs and Port
    Drivers" under Interoperability Tutorial.
  * erts: Add new API function erl_features:configurable/0
  * kernel: Fixed inconsistency bugs in global due to
    nodeup/nodedown messages not being delivered before/after
    traffic over connections. Also fixed various other
    inconsistency bugs and deadlocks in both global_group and
    global. As building blocks for these fixes, a new BIF
    erlang:nodes/2 has been introduced and
    net_kernel:monitor_nodes/2 has been extended. The -hidden and
  - connect_all command line arguments did not work if multiple
    instances were present on the command line which has been
    fixed. The new kernel parameter connect_all has also been
    introduced in order to replace the -connect_all command line
    argument.
  * kernel: Fixed IPv6 multicast_if and membership socket options.
  * kernel: Fixed issue with inet:getifaddrs hanging on pure IPv6
    Windows
  * kernel: The type specifications for inet:getopts/2 and
    inet:setopts/2 have been corrected regarding SCTP options.
  * kernel: The type specifications for inet:parse_* have been
    tightened.
  * kernel: Fix gen_tcp:connect/3 spec to include the inet_backend
    option.
  * kernel: Fix bug where using a binary as the format when calling
    logger:log(Level, Format, Args) (or any other logging function)
    would cause a crash or incorrect logging.
  * kernel: Add rudimentary debug feature (option) for the inet-
    driver based sockets, such as gen_tcp and gen_udp.
  * kernel: Introduced the hidden and dist_listen options to
    net_kernel:start/2. Also documented the -dist_listen command
    line argument which was erroneously documented as a kernel
    parameter and not as a command line argument.
  * kernel: Scope and group monitoring have been introduced in pg.
    For more information see the documentation of
    pg:monitor_scope(), pg:monitor(), and pg:demonitor().
  * kernel: A new function global:disconnect/0 has been introduced
    with which one can cleanly disconnect a node from all other
    nodes in a cluster of global nodes.
  * compiler: The compiler will now forbid using the empty atom ''
    as module name. Also forbidden are modules names containing
    control characters, and module names containing only spaces and
    soft hyphens.
  * compiler: The bin_opt_info and recv_opt_info options would
    cause the compiler to crash when attempting to compile
    generated code without location information.
  * compiler: In rare circumstances involving floating point
    operations, the compiler could terminate with an internal
    consistency check failure.
  * compiler: In rare circumstances when doing arithmetic
    instructions on non-numbers, the compiler could crash.
  * compiler: In rare circumstances, complex boolean expressions in
    nested cases could cause the compiler to crash.
  * compiler: Expression similar to #{assoc:=V} = #key=&gt;self()}, V
    would return the empty map instead of raising an exception.
  * compiler: Eliminated a crash in the beam_ssa_bool pass of the
    compiler when compiling a complex guard expression.
  * compiler: In rare circumstances, the compiler could crash with
    an internal consistency check failure.
  * compiler: When compiling with the option inline_list_funcs, the
    compiler could produce a nonsensical warning.
  * compiler: When given the no_ssa_opt option, the compiler could
    terminate with an internal consistency failure diagnostic when
    compiling map matching.
  * compiler: Made warnings for existing atoms being keywords in
    experimental features more precise, by not warning about quoted
    atoms.
  * compiler: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * megaco: Fixed various dialyzer related issues in the examples
    and the application proper.
  * megaco: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * common_test: Fix cth_surefire to handle when a suite is not
    compiled with debug_info. This bug has been present since
    Erlang/OTP 25.0.
  * common_test: Common Test now preserves stack traces for throws.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1669291200">- Changes for 25.1.2:
  * mnesia: Don't fill the logs if mnesia can't connect to all
    nodes, due to partitioned network.
  * erts: Add abandon carrier free utilization limit (+Muacful)
    option to erts_alloc. This option allows the user to mark
    unused segments in a memory carrier as re-useable by the OS if
    needed. This functionality was a non-configurable default
    before Erlang/OTP 25, but removed due to performance issues.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1671364800">- Changes for 25.2:
  * erts: Fix perf/gdb JIT symbols to not contain CodeInfoPrologue
    for the JIT internal module erts_beamasm.
  * erts: Fixed minor memory leaks.
  * erts: Fix bugs in ets:insert and ets:insert_new when called
    with a list of tuples to insert while a concurrent process
    either deletes or renames the table. The table deletion could
    be done with ets:delete/1 or be caused by termination of the
    table owning process. Symptoms are either VM crash or strange
    incorrect behavior from the insert operation. The risk of
    triggering the bugs increases with the length of the list of
    tuple to insert. Bugs exist since OTP 23.0.
  * erts: Boost execution of scheduled thread progress jobs. This
    to prevent memory exhaustion in extremely rapid
    allocation/deallocation scenarios, such as repeated ETS table
    creations/deletions.
  * erts: Fix segv crash during crash dumping an ETS table doing
    ets:delete_all_objects.
  * erts: Spec for function net:if_names/0 incorrect
  * erts: Fix bug in binary_to_term decoding a binary term 2Gbyte
    or larger.
  * erts: Documentation of erlang:module_loaded/1 has been
    adjusted:
  * erts: Fix list_to_atom/1 for negative code points. Could either
    return with a positive code point or fail with an incorrect
    exception.
  * erts: Fix rare bug causing VM crash when sending to a pid of a
    spawning process returned from erlang:processes/0. Only seen
    when provoked by system process literal_area_collector,
    triggered by a module purge operation, on a VM started with
    +Meamin (no customized allocators).
  * erts: gen_udp:open/2 with option(s) add_membership or
    drop_membership would drop earlier options.
  * erts: The inet:setopts/2 {reuseaddr, true} option will now be
    ignored on Windows unless the socket is an UDP socket. For more
    information see the documentation of the reuseaddr option part
    of the documentation of inet:setopts/2. Prior to OTP 25 the
    {reuseaddr, true} option was ignored for all sockets on
    Windows, but as of OTP 25.0 this was changed so that it was not
    ignored for any sockets. *** POTENTIAL INCOMPATIBILITY ***
  * erts: Fix bug in binary_to_term decoding a list of length 1G or
    longer.
  * erts: Fix bug in binary_to_term (and distributed receive) when
    decoding a large map (&gt;32 keys) with unsorted small maps (&lt;=
    32) as keys of the large map. This was only a problem if the
    term was encoded by erl_interface, jinterface or otherwise, as
    the VM itself always encodes small maps with sorted keys. The
    "binary_to_term" would appear as successful but the created
    large map was internally inconsistent. The smaller key-maps
    could not be found with maps:get and friends. Other operations
    such as map compare and merge could probably also give
    incorrect results.
  * erts: Fix Windows bug in open_port({spawn, Command}, ..) when
    Command is found via the OS search PATH and that directory path
    contains white spaces. The port program would start but the
    command line arguments to it could be incorrect.
  * ftp: fix unexpected result ok when calling ftp:nlist repeatedly
  * inets: This change allows body requests to httpc:request/5 be
    an iolist()
  * inets: addition of type specs in httpc.erl
  * inets: httpc: Add support for HTTP 308 status code
  * dialyzer: Dialyzer would crash when attempting to analyze a bit
    syntax segment size having an literal non-integer size such as
    [].
  * dialyzer: Dialyzer could crash when trying to analyze a
    convoluted nested expression involving funs,
  * kernel: Fixed shutdown crash in gen_tcp socket backend, when
    the other end closed the socket.
  * kernel: erl_tar can now read gzip-compressed tar files that are
    padded. There is a new option compressed_one for file:open/2
    that will read a single member from a gzip file,
  * kernel: Fix os:cmd to not translate all exceptions thrown to
    badarg. For example emfile from erlang:open_port was translated
    to badarg. This bug has existed since Erlang/OTP 24.
  * kernel: Spec for function net:if_names/0 incorrect
  * kernel: Missing ctrl option name transation for TOS and TTL (on
    FreeBSD) when using gen_udp with the 'socket' inet_backend.
  * kernel: gen_udp:open/2 with option(s) add_membership or
    drop_membership would drop earlier options.
  * kernel: The inet:setopts/2 {reuseaddr, true} option will now be
    ignored on Windows unless the socket is an UDP socket. For more
    information see the documentation of the reuseaddr option part
    of the documentation of inet:setopts/2. Prior to OTP 25 the
    {reuseaddr, true} option was ignored for all sockets on
    Windows, but as of OTP 25.0 this was changed so that it was not
    ignored for any sockets. *** POTENTIAL INCOMPATIBILITY ***
  * kernel: The distribution socket option handling in
    inet_tcp_dist has been cleaned up to clarify which were
    mandatory and which just had default values.
  * kernel: Improve warning message format for gen_tcp_socket.
  * snmp: Explicitly close the socket(s) when terminating
    (default-) net-if process.
  * stdlib: erl_tar can now read gzip-compressed tar files that are
    padded. There is a new option compressed_one for file:open/2
    that will read a single member from a gzip file,
  * stdlib: A concurrent call to ets:rename could cause
    ets:delete_all_objects to fail halfway through with badarg.
  * stdlib: It is not allowed to call functions from guards. The
    compiler failed to reject a call in a guard when done by
    constructing a record with a default initialization expression
    that called a function.
  * stdlib: The compiler could crash when using a record with
    complex field initialization expression as a filter in a list
    comprehension.
  * stdlib: unicode:characters_to_binary() could build
    unnecessarily large call stack.
  * stdlib: Improve error message for ets:new/2 name clash. Say
    "name already exists" instead of less specific "invalid
    options".
  * mnesia: Fixed crash which could happen during startup if too
    many decisions where sent from remote nodes.
  * os_mon: The disk_space_check_interval configuration parameter
    of disksup can now be set to values smaller than a minute.
  * ssh: graceful shutdown of ssh_conection_handler when connection
    is closed by peer
  * common_test: Fix starting of peer nodes on old releases when
    the compile server was active and the current Erlang
    installation contained non-latin1 characters in its path.
  * public_key: Disregard LDAP URIs when HTTP URIs are expected.
  * ssl: With this change, tls_sender process is hibernated after
    sufficient inactivity.
  * ssl: Correct handling of legacy schemes so that ECDSA certs
    using sha1 may be used for some TLS-1.3 configurations.
  * ssl: With this change, tls_sender does not cause logger crash
    upon key update.
  * ssl: Enhance warning message
  * ssl: Provide server option to make certificate_authorities
    extension in the TLS-1.3 servers certificate request optional.
    This will allow clients to send incomplete chains that may be
    reconstructable and thereby verifiable by the server, but that
    would not adhere to the certificate_authorities extension.
  * ssl: If the verify_fun handles four arguments the DER cert will
    be supplied as one of the arguments.
  * megaco: A very minor improvement to the measurement tool.
  * observer: A WX event race could causes a crash in when handling
    socket or port info.
  * observer: Improve the nodes menu to include more nodes.
  * compiler: Line number in compiler messages would be truncated
    to 4 digits for line numbers greater than 9999.
  * compiler: In rare circumstance, matching a binary as part of a
    receive clause could cause the compiler to terminate because of
    an internal consistency check failure.
  * compiler: Compiling a function with complex bit syntax matching
    such as f(&lt;&lt;X:0, _:X&gt;&gt;, &lt;&lt;Y:0, _:Y&gt;&gt;) -&gt; ok. could crash the
    compiler.
  * compiler: It is not allowed to call functions from guards. The
    compiler failed to reject a call in a guard when done by
    constructing a record with a default initialization expression
    that called a function.
  * compiler: The compiler could crash when using a record with
    complex field initialization expression as a filter in a list
    comprehension.
  * wx: Added environment variable WX_MACOS_NON_GUI_APP to allow
    user to override OSXIsGUIApplication behavior.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1679745600">- Changes for 25.3:
  * reltool: Fixed a bug that would cause analysis to crash.
  * stdlib: Fixed a bug that would cause analysis to crash.
  * stdlib: Fixed a crash when formatting stack traces for error
    reports.
  * stdlib: Instead of crashing, the list_to_integer/1 and
    list_to_integer/2 BIFs now raise the system_limit exception for
    overlong lists that can't be converted to integers. Similarly,
    the string:to_integer/1 BIF now returns {error,system_limit}
    for overlong lists.
  * stdlib: Removal of non-necessary undefined types added to the
    state's supervisor record.
  * compiler: Fixed a bug that would cause the compiler to hang.
  * compiler: Fixed a crash when compiling code that contained
    maybe expressions.
  * compiler: Constructing a binary with an explicit size of all
    for a binary segment would crash the compiler.
  * compiler: The compiler would generate incorrect code for the
    following type of expression: Pattern = BoundVar1 = . . . =
    BoundVarN = Expression An exception should be raised if any of
    the bound variables have different values than Expression. The
    compiler would generate code that would cause the bound
    variables to be bound to the value of Expressionwhether the
    value matched or not.
  * xmerl: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * megaco: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * debugger: Fixed a bug that would cause analysis to crash.
  * erts: Fixed a bug on Windows where file:read_file_info/1 would
    fail for files with corrupt metadata.
  * erts: Fix process_info(_, binary) to again include "writable
    binaries" which were lost in OTP-25.0. Writable binaries are an
    optimization used when binaries are appended upon in a loop.
  * erts: Fix rare race when receiving fragmented messages on a
    terminating connection. Could potentially cause memory leaks as
    well as double free crashes. Bug exists since OTP 22.0.
  * erts: Fixed bug that could maybe cause problems when a file
    descriptor number is closed by a linked in driver and then
    opened (reused) and passed to enif_select by a NIF. No actual
    symptoms seen, only failed internal assertions in debug build.
  * erts: The runtime system could crash when tracing a process
    executing on a dirty scheduler.
  * erts: In the binary syntax, attempting to match out integers
    with size exceeding 2 GiB could crash the runtime system.
  * erts: Fixed edge case in floating-point negation where A = 0.0,
    B = -A did not produce B = -0.0 on x86_64 JIT.
  * erts: Fixed an issue in the JIT that could crash the emulator
    on some platforms.
  * erts: Added meta data to the windows installer.
  * erts: Fixed ETS insertion order into bag and duplicate_bag of
    tuples with identical keys when passed in a list to
    ets:insert/2. The insert order has been head-to-tail but was
    accidentally changed in OTP 23.0. For bag it was reverted
    (tail-to-head), while for duplicate_bag it was sometimes
    reverted depending on the length of the list and number of
    "reductions" left for the calling process. This fix changes the
    insert order of ets:insert/2 back to always be head-to-tail of
    the list argument.
  * erts: With the JIT for AArch64 (AMD64), calling bxor in with
    non-integer arguments in a guard would crash the runtime
    system.
  * erts: Fix bug regarding process flag max_heap_size. Could cause
    strange behavior when a process was killed due to exceeding the
    limit.
  * erts: Fixed binary comprehensions to be similar to other
    creation of binary data with respect to its contribution of
    triggering garbage collection.
  * erts: In rare circumstances, when a process exceeded its
    allowed heap size set by option max_heap_size, it would not be
    killed as it should be, but instead enter a kind of zombie
    state it would never get out of.
  * erts: Instead of crashing, the list_to_integer/1 and
    list_to_integer/2 BIFs now raise the system_limit exception for
    overlong lists that can't be converted to integers. Similarly,
    the string:to_integer/1 BIF now returns {error,system_limit}
    for overlong lists.
  * erts: Active process aliases of a process at its termination
    leaked memory.
  * erts: Support for fully asynchronous distributed signaling
    where send operations never block. This functionality is by
    default disabled and can be enabled per process. For more
    information see the documentation of process_flag(async_dist,
    Bool).
  * erts: Added the +JPperf no_fp option to explicitly disable
    Erlang frame pointers otherwise added when using the +JPperf
    map option.
  * erl_interface: Accept connection setup from OTP 23 and 24 nodes
    that are not using epmd.
  * erl_interface: The ei API for decoding/encoding terms is not
    fully 64-bit compatible since terms that have a representation
    on the external term format larger than 2 GB cannot be handled.
  * syntax_tools: erl_syntax_lib:annotate_bindings/1,2 will now
    properly annotate named functions and their arguments.
  * kernel: Fixed a bug on Windows where file:read_file_info/1
    would fail for files with corrupt metadata.
  * kernel: Accept connection setup from OTP 23 and 24 nodes that
    are not using epmd.
  * public_key: As different solutions of verifying certificate
    revocation exists move the decode of 'CRLDistributionPoints' so
    that it will only be decode. When it is actually used in the
    verification process. This would enable interoperability with
    systems that use certificates with an invalid empty
    CRLDistributionPoints extension that they want to ignore and
    make verification by other means.
  * public_key: public_key:pkix_path_validation validates
    certificates expiring after 2050
  * public_key: Do not leave exit message in message queue after
    calling cacerts_load() on MacOS.
  * public_key: Replace size/1 with either tuple_size/1 or
    byte_size/1 The size/1 BIF is not optimized by the JIT, and its
    use can result in worse types for Dialyzer. When one knows that
    the value being tested must be a tuple, tuple_size/1 should
    always be preferred. When one knows that the value being tested
    must be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * ssl: Fixed that new dtls connections from the same client ip
    port combination works. If there is a process waiting for
    accept the new connection will connect to that, otherwise it
    will try to re-connect to the old server connection.
  * ssl: When shutting down a node that uses SSL distribution
    (-proto_dist inet_tls), a confusing error message about an
    unexpected process exit was printed. This particular message is
    no longer generated.
  * ssl: fixes the type spec for ssl:format_error/1
  * ssl: Replace size/1 with either tuple_size/1 or byte_size/1 The
    size/1 BIF is not optimized by the JIT, and its use can result
    in worse types for Dialyzer. When one knows that the value
    being tested must be a tuple, tuple_size/1 should always be
    preferred. When one knows that the value being tested must be a
    binary, byte_size/1 should be preferred. However, byte_size/1
    also accepts a bitstring (rounding up size to a whole number of
    bytes), so one must make sure that the call to byte_size/ is
    preceded by a call to is_binary/1 to ensure that bitstrings are
    rejected. Note that the compiler removes redundant calls to
    is_binary/1, so if one is not sure whether previous code had
    made sure that the argument is a binary, it does not harm to
    add an is_binary/1 test immediately before the call to
    byte_size/1.
  * jinterface: Accept connection setup from OTP 23 and 24 nodes
    that are not using epmd.
  * os_mon: The port programs used by cpu_sup and memsup are now
    gracefully shut down when cpu_sup and memsup are shut down.
  * eunit: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * crypto: A user defined runtime library path configured using
  - -with-ssl-rpath=&lt;PATHS&gt; could fail to be enabled.
  * crypto: Ensure that configure fails if a user defined runtime
    library path has been passed by the user, but cannot set.
  * mnesia: Improved consistency for dirty writes when a table was
    added with add_table_copy/3. Fixed a problem with sticky write,
    which could lead to inconsistent data.
  * mnesia: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * common_test: Renamed undocumented macro CT_PEER/3 to
    CT_PEER_REL/3.
  * ssh: With this change, PKCS8 formatted private key file is
    properly decoded and SSH daemon with such key can be started.
  * ssh: Replace size/1 with either tuple_size/1 or byte_size/1 The
    size/1 BIF is not optimized by the JIT, and its use can result
    in worse types for Dialyzer. When one knows that the value
    being tested must be a tuple, tuple_size/1 should always be
    preferred. When one knows that the value being tested must be a
    binary, byte_size/1 should be preferred. However, byte_size/1
    also accepts a bitstring (rounding up size to a whole number of
    bytes), so one must make sure that the call to byte_size/ is
    preceded by a call to is_binary/1 to ensure that bitstrings are
    rejected. Note that the compiler removes redundant calls to
    is_binary/1, so if one is not sure whether previous code had
    made sure that the argument is a binary, it does not harm to
    add an is_binary/1 test immediately before the call to
    byte_size/1.
  * inets: With this change, handling of URI to a folder, with
    missing trailing / and a query component present is fixed.
  * inets: Adds more type information to the inets app, thus
    improving the errors that static analysis tools can detect. The
    addition of type information to records and the updates to
    function heads help static analysis tools to understand that
    some values in the records cannot be 'undefined', thus making
    static tools to type check correctly more modules in the inets
    app
  * inets: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * snmp: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * ftp: Replace size/1 with either tuple_size/1 or byte_size/1 The
    size/1 BIF is not optimized by the JIT, and its use can result
    in worse types for Dialyzer. When one knows that the value
    being tested must be a tuple, tuple_size/1 should always be
    preferred. When one knows that the value being tested must be a
    binary, byte_size/1 should be preferred. However, byte_size/1
    also accepts a bitstring (rounding up size to a whole number of
    bytes), so one must make sure that the call to byte_size/ is
    preceded by a call to is_binary/1 to ensure that bitstrings are
    rejected. Note that the compiler removes redundant calls to
    is_binary/1, so if one is not sure whether previous code had
    made sure that the argument is a binary, it does not harm to
    add an is_binary/1 test immediately before the call to
    byte_size/1.
  * dialyzer: Fixed a bug that would cause analysis to crash.
  * dialyzer: Replace size/1 with either tuple_size/1 or
    byte_size/1 The size/1 BIF is not optimized by the JIT, and its
    use can result in worse types for Dialyzer. When one knows that
    the value being tested must be a tuple, tuple_size/1 should
    always be preferred. When one knows that the value being tested
    must be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * tftp: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
- Changes for 25.2.3:
  * erts: Comparisons between small numbers and pids or ports would
    in some edge cases say that the number was greater than the pid
    or port, violating the term order.
  * erts: process_info(Pid, status) when Pid /= self() could return
    an erroneous result.
  * ssl: Maximize compatibility by ignoring change_cipher_spec
    during handshake even if middle_box_mode is not negotiated
    (mandated by client)
  * ssl: Move assert of middlebox message after an
    hello_retry_request to maximize interoperability. Does not
    changes semantics of the protocol only allows unexpected
    message delay from server.
  * ssh: With this change, ssh application does not crash when
    formatting some of info reports for unsuccessful connections.
  * ssh: With this change, ssh does not log extensively long
    messages.
  * inets: Ensure graceful shutdown
  * inets: Return type of the type specification for function
    httpc:cookie_header/{1,2,3} has been fixed from -spec
    cookie_header(url()) -&gt; [{ field(), value() }] | {error,
    Reason} to -spec cookie_header(url()) -&gt; { field(), value() } |
    {error, Reason}
- Changes for 25.2.2:
  * ftp: Fixes calls to ftp:nlist/2 returning {error, epath} when
    the file / folder exists
- Changes for 25.2.1:
  * compiler: Fixed a bug that could cause legal code to fail
    validation.
  * compiler: Eliminated a rare crash in the beam_types module.
  * erts: Fixed a bug in selective receive optimization that could
    crash 32-bit emulators.
  * erts: A race condition which was very rarely triggered could
    cause the signal queue of a process to become inconsistent
    causing the runtime system to crash.
  * kernel: The tcp connect option 'bind_to_device' could not be
    used with inet_backend = 'socket'. 'inet' requires value type
    binarry() and 'socket' requires value type 'string()'.
  * kernel: Minor issue processing options when calling
    gen_tcp:connect with a sockaddr() and inet_backend = socket.
  * common_test: Change timeout to infinity for gen_server calls in
    cth_log_redirect
  * inets: fixes a missing case of the type specification for
    httpd:info/2/3/4
  * snmp: Single threaded agent crash when vacm table not properly
    initiated.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1683460800">- Changes for 25.3.2:
  * compiler: Fixed type handling bugs that could cause an internal
    error in the compiler for correct code.
  * os_mon: Avoid error report from failing erlang:port_close at
    shutdown of cpu_sup and memsup. Bug exists since OTP 25.3
    (os_mon-2.8.1).
  * erts: If a runtime system which was starting the distribution
    already had existing pids, ports, or references referring to a
    node with the same nodename/creation pair that the runtime
    system was about to use, these already existing pids, ports, or
    references would not work as expected in various situations
    after the node had gone alive. This could only occur if the
    runtime system was communicated such pids, ports, or references
    prior to the distribution was started. That is, it was
    extremely unlikely to happen unless the distribution was
    started dynamically and was even then very unlikely to happen.
    The runtime system now checks for already existing pids, ports,
    and references with the same nodename/creation pair that it is
    about to use. If such are found another creation will be chosen
    in order to avoid these issues.
- Changes for 25.3.1:
  * snmp: Attempts to minimize the number of the error reports
    during a failed agent init.
  * compiler: When a map update such as #{}#{key:=value} that
    should fail with an exception was unused, the exception would
    be lost.
  * compiler: Fixed bug in the validator that made it reject valid
    code.
  * crypto: With this change, random errors are fixed for
    crypto:generate_key calls with OpenSSL 3.
  * erts: Fixed a bug in the loader that prevented certain modules
    compiled with no_ssa_opt from being loaded.
  * erts: Implementations of the call() driver callback that
    returned a faulty encoded result could cause a memory leak and
    could cause invalid data on the heap of the processes calling
    erlang:port_call/3.
  * erts: Fixed a memory corruption issue when upgrading code. The
    bug was introduced in OTP 25.3
  * erts: Fixed configure tests for a few ARM-specific
    instructions, which prevented the emulator from being built on
    some platforms.
  * erts: Aliases created in combination with a monitor using the
    {alias, explicit_unalias} option stopped working from remote
    nodes when a 'DOWN' signal had been received due to the monitor
    or if the monitor was removed using the erlang:demonitor() BIF.
    This bug was introduced in OTP 24.3.4.10 and OTP 25.3.
  * erts: In rare circumstances, bit syntax matching of an invalid
    code point for a utf32 would crash the runtime system.
  * erts: Building the runtime system failed when native atomic
    support was missing. Note that execution on such systems have
    only been rudimentary tested.
  * erl_interface: Fixed configure tests for a few ARM-specific
    instructions, which prevented the emulator from being built on
    some platforms.
  * eldap: Added a new function eldap:info/1 that returns the
    socket and the transport protocol for the eldap connection.
  * inets: Correct timing related pipelining/keepalive queue bug,
    that could result in unexpected "socket_remotly_closed" errors.
  * inets: With this change, upon remote socket closure current
    request is added to a retried queue (either pipeline or
    keep_alive, but not both).
  * ssl: With this change, ssl:connection_information/2 returns
    correct keylog data after TLS1.3 key update.
  * ssl: Client signature algorithm list input order is now honored
    again , it was accidently reversed by a previous fix.
  * stdlib: The type specs in the erl_parse module has been updated
    to include the maybe construct and the ! operator.
  * wx: Improve debug prints from the nifs. Some minor fixes for
    wxWidgets-3.2. Fixed OpenGL debug functions.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1687521600">- Changes for 25.3.2.2:
  * compiler: The compiler could be very slow when compiling guards
    with multiple guard tests separated with 'or' or ';'.
- Changes for 25.3.2.1:
  * xmerl: New options to xmerl_scan and xmerl_sax_parser so one
    can limit the behaviour of the parsers to avoid some XML
    security issues. xmerl_scan gets one new option:
    xmerl_sax_parser gets the following options: The old option
    skip_external_dtd is still valid and the same as
    {external_entities, none} and {fail_undeclared_ref, false} but
    just affects DTD's and not other external references.
  * erts: Fixed a crash during tracing on certain platforms that
    cannot use the machine stack for Erlang code (mainly OpenBSD
    and Linux with musl).
  * erts: Constructing a binary segment not aligned with a byte
    boundary, with a size not fitting in 31 bits, and with a value
    not fitting in a 64-bit word could crash the runtime system.
  * erts: Further robustify implementation of large maps (&gt; 32
    keys). Keys that happen to have same internal 32-bit hash
    values are now put in collision nodes which are traversed with
    linear search. This removes the demand for the internal hash
    function when salted to eventually produce different hashes for
    all possible pairs of unequal terms.
  * stdlib: Static supervisors are very idle processes after they
    have started so they will now be hibernated after start to
    improve resource management.
  * compiler: Fixed a bug where a failing bsl expression in a guard
    threw an exception instead of causing the guard to fail.
  * compiler: Complex guard expression using the or operator and
    guard BIFs that can fail could sometimes be miscompiled so that
    the guard would succeed even if a call to a guard BIF failed.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1687608000">- Version 26.0:
  * Leex has been extended with optional column number support.
  * The family of enumeration functions in module lists has been
    extended with enumerate/3 that allows a step value to be
    supplied.
  * Update Unicode to version 15.0.0.
  * proc_lib:start*/* has become synchronous when the started
    process fails. This requires that a failing process use a new
    function proc_lib:init_fail/2,3, or exits, to indicate failure. All
    OTP behaviours have been fixed to do this.
  * auto-complete of variables, record names, record fields names,
    map keys, function parameter types and filenames.
  * Open external editor in the shell to edit the current
    expression.
  * defining records (with types), functions, specs and types in
    the shell.
  * Creation and matching of binaries with segments of fixed sizes
    have been optimized.
  * Creation and matching of UTF-8 segments have been optimized.
  * Appending to binaries has been optimized.
  * The compiler and JIT now generate better code for creation of
    small maps where all keys are literals known at compile time.
  * Thanks to the optimizations above the performance of the base64
    module has been significantly improved. For example, on an
    x86_64 system with the JIT both encode and decode are almost
    three times faster than in Erlang/OTP 25.
  * Map comprehensions as suggested in EEP 58 has now been
    implemented.
  * Some map operations have been optimized by changing the
    internal sort order of atom keys. This changes the
    (undocumented) order of how atom keys in small maps are printed
    and returned by maps:to_list/1 and maps:next/1. The new order
    is unpredictable and may change between different invocations
    of the Erlang VM.
  * Introducing the new function maps:iterator/2 for creating an
    interator that return the map elements in a deterministic
    order. There are also new modifiers k and K for the format
    string in io:format() to support printing map elements ordered.
  * Added the new built-in type dynamic() introduced in EEP 61, PR
    introducing EEP 61 improving support for gradual type checkers.
  * Dialyzer has a new incremental mode that be invoked by giving
    the --incremental option when running Dialyzer. This new
    incremental mode is likely to become the default in a future
    release.
  * Multi time warp mode is now enabled by default. This assumes
    that all code executing on the system is time warp safe.
  * Support for UTF-8 atoms and strings in the NIF interface
    including new functions enif_make_new_atom,
    enif_make_new_atom_len and enif_get_string_length.
  * The BIFs min/2 and max/2 are now allowed to be used in guards
    and match specs.
  * Improved the selective receive optimization, which can now be
    enabled for references returned from other functions. This
    greatly improves the performance of gen_server:send_request/3,
    gen_server:wait_response/2, and similar functions.
  * It is no longer necessary to enable a feature in the runtime
    system in order to load modules that are using it. It is
    sufficient to enable the feature in the compiler when compiling
    it.
  * inet:setopts/2 has got 3 new options: reuseport, reuseport_lb
    and exclusiveaddruse.
  * Fix so that -fno-omit-frame-pointer is applied to all of the
    Erlang VM when using the JIT so that tools, such as perf, can
    crawl the process stacks.
  * In the lists module, the zip family of functions now takes
    options to allow handling lists of different lengths.
  * Added the zip:zip_get_crc32/2 function to retrieve the CRC32
    checksum from an opened ZIP archive. gen_server optimized by
    caching callback functions
  * The modules Erlang DNS resolver inet_res and helper modules
    have been updated for RFC6891; to handle OPT RR with DNSSEC OK
    (DO) bit.
  * Introduced application:get_supervisor/1.
  * Cache OTP boot code paths, to limit how many folders that are
    being accessed during a module lookup. Can be disabled with
  - cache_boot_path false.
  * Support for Kernel TLS (kTLS), has been added to the SSL
    application, for TLS distribution (-proto_dist inet_tls), the
    SSL option {ktls, true}.
  * Improved error checking and handling of ssl options.
  * Mitigate memory usage from large certificate chains by lowering
    the maximum handshake size. This should not effect the common
    cases, if needed it can be configured to a higher value.
  * For security reasons the SHA1 and DSA algorithms are no longer
    among the default values.
  * Add encoding and decoding of use_srtp hello extension to
    facilitate for DTLS users to implement SRTP functionality.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1687608001">- Changes for 26.0.1:
  * erts: Build of the socket nif failed on Solaris 11.
  * erts: Fixed two reduction-counting bugs relating to binaries.
  * erts: Constructing a binary segment not aligned with a byte
    boundary, with a size not fitting in 31 bits, and with a value
    not fitting in a 64-bit word could crash the runtime system.
  * erts: When a binary construction failed because of bad size for
    a segment, the error information was not always correct.
  * erts: Fixed a crash when calling a fun that was defined in a
    module that had been upgraded.
  * kernel: The POSIX error exdev was sometimes incorrectly
    described as "cross domain link" in some error messages.
  * kernel: Corrected the socket send function description (send
    with Timeout = nowait). The send function(s) could not return
    {ok, {RestData, SelectInfo}}
  * stdlib: The POSIX error exdev was sometimes incorrectly
    described as "cross domain link" in some error messages.
  * ssl: Make sure that selection of client certificates handle
    both TLS-1.3 and TLS-1.2 names correctly. Could cause valid
    client certificate to not be selected, and an empty client
    certificate message to be sent to server.
  * ssl: Improved ssl:format_error/1 to handle more error tuples.
  * ssl: Fixed hanging ssl:connect when ssl application is not
    started.
  * ssl: Correct handling of retransmission timers, current
    behavior could cause unwanted delays.
  * inets: Do not make the default ssl options by calling
    httpc:ssl_verify_host_options(true) if ssl options are supplied
    by the user.
  * xmerl: New options to xmerl_scan and xmerl_sax_parser so one
    can limit the behaviour of the parsers to avoid some XML
    security issues. xmerl_scan gets one new option:
    xmerl_sax_parser gets the following options: The old option
    skip_external_dtd is still valid and the same as
    {external_entities, none} and {fail_undeclared_ref, false} but
    just affects DTD's and not other external references.
  * compiler: Fixed a bug where a failing bsl expression in a guard
    threw an exception instead of causing the guard to fail.
  * compiler: Fixed a bug that would case the validator to reject
    legal code.
  * compiler: The compiler could re-order clauses matching binaries
    so that the incorrect clause would match. That could only
    happen for code that used the option {error_location,line} or
    for code without line or column number information (e.g.
    generated by a parse transform).
  * compiler: Complex guard expression using the or operator and
    guard BIFs that can fail could sometimes be miscompiled so that
    the guard would succeed even if a call to a guard BIF failed.
  * compiler: With optimizations disabled, a try/catch construct
    could return an incorrect value.
  * compiler: In rare circumstance, a combination of binary
    construction and binary_part/3 would cause the compiler to
    generate unsafe code that would crash the runtime system.
  * compiler: The compiler could be very slow when compiling guards
    with multiple guard tests separated with 'or' or ';'.
  * compiler: Complex guard expressions using 'or' and map updates
    could succeed even if the map update failed.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1698235200">- Changes for 26.1.2:
  * erts: If the external term format encoding of an argument list
    part of a distributed spawn operation was faulty, the newly
    spawned remote process could misbehave. The misbehavior
    included hanging or interpret an incoming message as an
    argument list to use. This was very unlikely to happen unless
    using an alternate implementation of the distribution protocol
    which made a faulty encoding of the argument list. The child
    process will now detect this error and terminate before
    executing the user specified code.
  * erts: Fix bugs where if the body of a matchspec would return a
    map with a variable ('$1', '$_' etc) as one of the keys or
    values and the variable was not an immidiate, the term would
    not be copied to the receiving processes heap. This would later
    corrupt the term in the table as the GC could place move
    markers in it, which in turn would cause the VM to crash. Bug
    has been present for since OTP 17.0.
  * xmerl: The xmerl version 1.3.32 was released in OTP 26.0.1, but
    the incorrect version number of 1.3.31.1 was used for it. This
    incorrect version number continued to appear in OTP 26.0.2, OTP
    26.1, and OTP 26.1.1. The actual xmerl code in these OTP
    versions however corresponds to xmerl version 1.3.32.
- Changes for 26.1.1:
  * wx: The wx application would fail to build on macOS with Xcode
    15.
  * compiler: The compiler could become extremely slow for modules
    containing huge functions.
  * stdlib: Garbage collect the shell process when reducing the
    amount of saved history and results.
- Changes for 26.1:
  * crypto: Fix VM crash caused by crypto being purged and reloaded
    (by init:restart for example) on OS with musl libc (such as
    Alpine linux).
  * crypto: Improved understanding of LibreSSL versions. Support
    chacha20 and chacha20_poly1305 for LibreSSL 3.7. Reflect
    removal of support for the DSS/DSA algorithm which was done in
    LibreSSL 2.6.1.
  * crypto: FIPS supported by crypto for OpenSSL 3.0.* and 3.1.*.
  * asn1: The ASN.1 compiler would ignore a constraint such as
    (SIZE (1..4), ...), causing incorrect behavior of the encoding
    and decoding function for the PER and UPER backends. Corrected
    to handle the constraint in the same way as (SIZE (1..4, ...)).
  * asn1: The JER backend has been internally refactored in a way
    that is compatible for applications that use the documented
    API. However, for a group of ASN.1 modules that depend on each
    other (for example, S1AP-PDU-Descriptions, S1AP-Contents, and
    so on), all modules in the group must be recompiled if on of
    the group members is recompiled.
  * observer: Closing the trace log window via the menu did not
    work.
  * erts: maps:put with existing key and identical value was not
    optimized as a no-op correctly if having the same 32-bit hash
    as another key in the map. In practice very rare and harmless.
  * erts: Fixed an issue with truncated crash slogans on failed
    emulator start.
  * erts: Fixed a bug where the emulator was unable to determine
    the current cgroup CPU quota.
  * erts: A process optimized for parallel signal delivery could
    under some circumstances lose wakeup information. That is, the
    processes was not woken up to take care of the signal, so the
    signal would not be taken care of until the process was woken
    by another signal. Only processes configured with
    message_queue_data set to off_heap utilize this optimization.
  * erts: Function socket:close/1 could cause a VM crash on
    Windows.
  * erts: Fixed a bug in the ARM JIT where it could accidentally
    add garbage trailing bits when creating bitstrings whose size
    wasn't an even multiple of 8 bits.
  * erts: Fix erlang:system_info/1 documentation to show correct
    types.
  * erts: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * erts: Fix compilation with GNU termcap.
  * erts: Delivery time of message signals to a process not
    executing any receive expressions could become very long,
    potentially infinite. For example, a process checking for
    messages using process_info(self(), message_queue_len) or
    process_info(self(), messages) and avoiding to execute a
    receive expression matching on messages could be very slow in
    detecting new messages. Note that you are still discouraged
    from using process_info() this way. A process that wants to
    check if there are messages available to handle should execute
    a receive expression matching on messages.
  * erts: On AArch64 (ARM64), when calculating both the quotient
    and remainder with a divisor begin a power two, the remainder
    could be incorrectly calculated.
  * erts: Fix bug causing "magic" references in a compressed ETS
    table to not keep the referred object alive. The symptom would
    be the referred object being garbage collected prematurely and
    the reference appearing stale, not referring to anything.
    Examples of such magically referred objects are atomics and NIF
    resources.
  * erts: Matching out short bitstrings with a fixed size not
    divisible by 8 could could lead to the runtime system
    terminating with an "Overrun heap and stack" error.
  * erts: A constant flow of incoming non-message signals could
    prevent a process needing to execute dirty from doing so.
  * erts: A BEAM file usually contains a chunk with the tag "Type"
    containing type information that can be used by the JIT. The
    beam_lib:strip/1 takes care to preserve that chunk, but a
    build/release tool that does customized stripping could
    accidentally remove the chunk. Loading a BEAM file without the
    "Type" chunk could cause incorrect behavior of the loaded code.
  * erts: gen_udp:recv/* for Unix Domain Socket in binary mode and
    passive mode has been fixed to not crash.
  * erts: The cleanup operation of not yet delivered signals to a
    terminated process yielded excessively.
  * erts: Fixed minor hashing issue with the local option of
    term_to_binary()/term_to_iovec().
  * erts: Update gen_tcp_socket and gen_udp_socket to handle
    'completion' (socket on Windows).
  * erts: Add support for Unix Domain Sockets (only for STREAM
    sockets) on Windows for 'socket'.
  * erts: In Erlang/OTP 27, by default escripts will be compiled
    before being executed. That means that the compiler application
    must be installed. It is possible to force the escript to be
    interpreted by adding the directive -mode(interpret). to the
    escript file. In Erlang/OTP 28, support for interpreting an
    escript will be removed.
  * erts: Add basic support for socket ioctl on Windows.
  * erts: Removed erts/etc/darwin/Info.plist, as it is no longer
    necessary after macos 10.12
  * erts: Add support for (Windows) socket option exclusiveaddruse.
  * erts: [socket] Add support for the 'nopush' option.
  * erts: Add support for socket option 'BSP STATE'.
  * erts: Add tcp socket options 'keepcnt', 'keepidle' and
    'keepintvl'.
  * erts: Add support for misc (Windows) socket options
    ('max_msg_size' and 'maxdg').
  * compiler: The compiler could run forever when compiling a call
    to is_record/3 with a huge positive tuple size. The call
    is_record(A, a, 0) would crash the compiler when used in a
    function body. When used in a guard the compiler would emit
    incorrect code that would accept {a&gt; as a record.
  * compiler: Fixed a bug that caused dialyzer to crash when
    analyzing bogus code that contained the literal atom undefined
    in segment sizes.
  * compiler: The compiler would crash when compiling some modules
    that contained a call to erlang:load_nif/2.
  * compiler: Fixed a bug that caused the compiler to crash on
    legal code.
  * compiler: The compiler could crash when attempting to compile a
    call to is_list/1 in a complex expression.
  * compiler: A complex guard expression using the or operator
    could succeed when it was supposed to fail.
  * compiler: Compiling nested try/catch and catch expression could
    result in an internal compiler error.
  * compiler: Using the bnot operator in a complex expression could
    cause the compiler to terminate with an internal consistency
    failure diagnostic.
  * compiler: Fixed a bug that caused the compiler to crash in a
    binary optimization pass.
  * compiler: The compiler could terminate with an internal error
    when attempting to compile a binary pattern that could not
    possibly match.
  * compiler: Fixed various performance issues related to the alias
    optimization pass.
  * erl_docgen: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * mnesia: Do not delete old backup file if the new backup fails.
  * megaco: Make megaco transports handle gen_tcp | gen_udp with
    socket backend on Windows (completion).
  * common_test: With this change, ct_hooks manual refers to CTH
    execution order section in user guide.
  * common_test: With this change, Config data from
    pre_end_per_testcase hook is delivered to post_end_per_testcase
    callback in case of testcase timetrap or linked process crash.
  * common_test: With this change, remaining references to not
    supported vts tool in ct_run are removed (mainly relates to
    docs and ct_run help message).
  * common_test: With this change, prompt search functionality in
    ct_telnet handles unicode input.
  * common_test: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * stdlib: The compiler could run forever when compiling a call to
    is_record/3 with a huge positive tuple size. The call
    is_record(A, a, 0) would crash the compiler when used in a
    function body. When used in a guard the compiler would emit
    incorrect code that would accept {a&gt; as a record.
  * stdlib: Fix bug in ets:tab2file that could make it fail if
    another Erlang process created the same file at the same time.
  * stdlib: An {else_clause,Value} exception will now be reported
    nicely in the shell.
  * stdlib: Correct return value for error case, so that it matches
    the documented and intended return value {error,
    {already_started, pid()} when local registered names are used.
  * stdlib: sys:get_state/1,2 and sys:replace_state/2,3 has been
    corrected to handle a state named error as a state name, not as
    a failed system callback. For the standard server behaviours
    this was an issue only for gen_statem (and gen_fsm) when the
    state name was error, and for gen_server if the complete state
    was {error,_}.
  * stdlib: Multiple problems were fixed in
    filelib:safe_relative_path/2. If its second argument was a path
    that contained symbolic links, an incorrect result patch could
    be returned. Also, paths were sometimes falsely considered
    unsafe.
  * stdlib: Fix deadlock when erl.exe is used as part of a pipe on
    Windows and trying to set the encoding of the standard_io
    device.
  * stdlib: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * stdlib: Fix h/2,3 to properly render multi-clause
    documentation.
  * stdlib: Timers created by timer:apply_after/4,
    apply_interval/4, and apply_repeatedly/4 would silently fail to
    do the apply if it was not possible to spawn a process when the
    timer expired. This has now been corrected, and if the spawn
    fails, the system will be taken down producing a crash dump.
  * stdlib: When an Erlang source file lacked a module definition,
    there would be a spurious "module name must not be empty"
    diagnostic for each spec in the file.
  * stdlib: The argument descriptions for option types in argparse
    have been made less ambiguous.
  * stdlib: Clarified the documentation of normal shutdown reason
    on gen_server:call/2,3
  * stdlib: Pattern matching and equivalence (=:=, =/=) comparisons
    on 0.0 will now raise a warning, as it will no longer be
    considered equivalent to -0.0 in OTP 27. If a match on 0.0
    specifically is desired (distinct from -0.0), the warning can
    be suppressed by writing +0.0 instead. The arithmetic
    comparison operators are unaffected, including arithmetic
    equality (==). *** POTENTIAL INCOMPATIBILITY ***
  * stdlib: The semantics of the gen_{server,statem,event}
    behaviour's synchronous start behaviour introduced in OTP-26.0
    with OTP-18471, has been clarified in the documentation.
  * stdlib: Added functionality to set a custom multiline prompt.
  * stdlib: A warning for (accidental use of) Triple-Quoted Strings
    has been implemented as per EEP 64. *** POTENTIAL
    INCOMPATIBILITY ***
  * stdlib: The keyboard shortcuts for the shell are now
    configurable.
  * kernel: Fixed an issue with truncated crash slogans on failed
    emulator start.
  * kernel: Fix shell:start_interactive function specification.
  * kernel: Fix code:get_doc/1 to return missing, when it can't
    find erts instead of crashing.
  * kernel: Function socket:close/1 could cause a VM crash on
    Windows.
  * kernel: Fix deadlock when erl.exe is used as part of a pipe on
    Windows and trying to set the encoding of the standard_io
    device.
  * kernel: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * kernel: Fix logger's overload protection mechanism to only
    fetch memory used by messages when needed.
  * kernel: Fixed a number of socket-related issues causing
    incompatibilities with gen_tcp and gen_udp respectively.
  * kernel: gen_tcp:connect with socket address and socket (inet-)
    backend fails because of missing callback function.
  * kernel: The DNS RR cache used by `inet_res` has been fixed to
    preserve insert order, which is beneficial when the DNS server
    returns RRs in some specific order for e.g load balancing
    purposes.
  * kernel: The options `reuseport`, `reuseport_lb` and
    `exclusiveaddruse` were accidentally not allowed for e.g
    `gen_udp:open/1,2`, which has now been corrected.
  * kernel: gen_udp:recv/* for Unix Domain Socket in binary mode
    and passive mode has been fixed to not crash.
  * kernel: Fixed issue where cursor would not be placed at the end
    of the expression when navigating shell history.
  * kernel: Update gen_tcp_socket and gen_udp_socket to handle
    'completion' (socket on Windows).
  * kernel: Add support for Unix Domain Sockets (only for STREAM
    sockets) on Windows for 'socket'.
  * kernel: Add basic support for socket ioctl on Windows.
  * kernel: The file:location/0 type is now exported.
  * kernel: Add support for (Windows) socket option
    exclusiveaddruse.
  * kernel: [socket] Add support for the 'nopush' option.
  * kernel: Add support for socket option 'BSP STATE'.
  * kernel: Add tcp socket options 'keepcnt', 'keepidle' and
    'keepintvl'.
  * kernel: Add support for misc (Windows) socket options
    ('max_msg_size' and 'maxdg').
  * kernel: The keyboard shortcuts for the shell are now
    configurable.
  * kernel: Optimized code_server to reduce repeated work when
    loading the same module concurrently.
  * debugger: The call int:no_break(Module) did not remove any
    breakpoints.
  * debugger: The maybe expression is now supported in the
    Debugger.
  * debugger: The maybe expression is now supported in the
    Debugger.
  * debugger: The call int:no_break(Module) did not remove any
    breakpoints.
  * ssl: Avoid function clause error in ssl:getopts/2 by handling
    that inet:getopts may return an empty list during some
    circumstances, such as the socket being in a closing state.
  * ssl: The API function `ssl:recv/3` has been tightened to
    disallow negative length, which has never been documented to
    work, but was passed through and caused strange errors.
  * ssl: When a client initiated renegotiation was rejected and the
    client socket was in active mode the expected error message to
    the controlling process was not sent.
  * ssl: Add some guidance for signature algorithms configuration
    in ssl applications users guide.
  * snmp: Make snmp handle gen_udp with socket backend on Windows
    (completion).
  * public_key: Country name comparison shall be case insensitive
  * public_key: Add check to disallow duplicate certs in a path
  * inets: With this change, re_write httpd works as expected and
    does not return error.
  * inets: Fixed a bug so httpd does not crash when stopped at the
    wrong time during TLS connection negotiation, or any other
    theoretically as slow connection setup.
  * inets: Enhance error handling and avoid that the HTTP client
    hangs on headers provided on the wrong format.
  * inets: With this change, error report generated by httpd during
    connection setup contains socket type information.
  * inets: Stop and restart of the httpd server in the Inets
    application has been refactored to a more synchronous and OTP
    supervisor friendly approach. This should increase stability
    and for example avoid a supervisor report from
    httpd_connection_sup about killed child process(es) in some
    cases when stopping or restarting httpd.
  * dialyzer: Fixed a bug that caused dialyzer to crash when
    analyzing bogus code that contained the literal atom undefined
    in segment sizes.
  * dialyzer: Dialyzer could crash when attempting to analyze a
    module that defined a type called product/.
- Changes for 26.0.2:
  * erts: Fix using the IME (Input Method Editor) to enter text in
    cmd.exe and powershell.exe on Windows.
  * erts: Multiple socket:accept calls issue. When making multiple
    accept calls, only the last call is active.
  * erts: Fix the shell to ignore terminal delay when the terminal
    capabilities report that they should be used.
  * erts: Fix "oldshell" to echo characters while typing on
    Windows.
  * erts: On Windows, a call to the function socket:close, when
    there are waiting active calls to read, write or accept
    functions, could hang.
  * erts: Fix issues when reading or configuring standard_io on
    Windows when erl.exe is started using -noshell flag.
  * erts: The following functions are now much faster when given a
    long list or binary:
  * erts: On AArch64 (ARM64), equality and non-equality tests with
    literal bitstrings could succeed when they should fail and vice
    versa.
  * compiler: Fixed a type handling bug that would cause an
    internal consistence failure for correct code.
  * compiler: Fixed a bug that could cause the stack trace of throw
    exceptions to be erroneously optimized out.
  * compiler: Complex guard expression using 'or' were not always
    fully evaluated, making guards that were supposed to fail
    succeed.
  * stdlib: Fix bug where when you entered Alt+Enter in the
    terminal, the cursor would move to the last line, instead of
    moving to the next line.
  * stdlib: Fix eof handling when reading from stdin when erlang is
    started using -noshell.
  * stdlib: Fixed problem where output would disappear if it was
    received after a prompt was written in the shell.
  * stdlib: The following functions are now much faster when given
    a long list or binary:
  * kernel: Fix bug where when you entered Alt+Enter in the
    terminal, the cursor would move to the last line, instead of
    moving to the next line.
  * kernel: Fix so that the shell does not crash on startup when
    termcap is not available.
  * kernel: Multiple socket:accept calls issue. When making
    multiple accept calls, only the last call is active.
  * kernel: Fix the shell to ignore terminal delay when the
    terminal capabilities report that they should be used.
  * kernel: Fix "oldshell" to echo characters while typing on
    Windows.
  * kernel: Fix eof handling when reading from stdin when erlang is
    started using -noshell.
  * kernel: On Windows, a call to the function socket:close, when
    there are waiting active calls to read, write or accept
    functions, could hang.
  * kernel: Fix issues when reading or configuring standard_io on
    Windows when erl.exe is started using -noshell flag.
  * kernel: gen_udp:connect with inet_backend = socket fails when
    the Address is a hostname (string or atom).
  * kernel: Fixed problem which would cause shell to crash if
    particular escape sequence was written to stdout.
  * kernel: Fixed problem where output would disappear if it was
    received after a prompt was written in the shell.
  * kernel: Fix a crash where the location of erts could not be
    found in rebar3 dev builds.
  * kernel: Introduce the KERNEL application parameter
    standard_io_encoding that can be used to set the default
    encoding for standard_io. This option needs to be set to latin1
    if the application wants to treat all input data as bytes
    rather than utf-8 encoded characters.
  * ssl: Added keylog information to all protocol versions in
    ssl:connection_information/2.
  * ssl: Add RFC-6083 considerations for DTLS to enable gen_sctp
    based callback for the transport.
  * ssh: Added multiline editing support to ssh clients connected
    through OTP ssh daemon.</changelog>
  <changelog author="sflees@suse.de" date="1704974400">- Changes for 26.2.1:
  * erts: Removed unnecessary PCRE source tar-ball.
  * ssh: With this change (being response to CVE-2023-48795),
    ssh can negotiate "strict KEX" OpenSSH extension with
    peers supporting it; also
    'chacha20-poly1305@openssh.com' algorithm becomes a
    less preferred cipher.
    If strict KEX availability cannot be ensured on both
    connection sides, affected encryption modes(CHACHA and
    CBC) can be disabled with standard ssh configuration.
    This will provide protection against vulnerability, but
    at a cost of affecting interoperability. See
    Configuring algorithms in SSH. (bsc#1218192, CVE-2023-48795)
- Changes for 26.2:
  * all: Replaced unintentional Erlang Public License 1.1
    headers in some files with the intended Apache License
    2.0 header.
  * otp: The removal of the deprecated slave module, originally
    planned for OTP 27, has been postponed to OTP 29.
  * asn1: Fix benign warning from gcc 11 about mismatching call
    to free().
  * crypto: Enable engine support for OpenSSL versions 3.
  * edoc: Emit &lt;code&gt; instead of &lt;tt&gt;.
- Disable test suite for now, it has many false positives and
  takes a very long time.</changelog>
  <changelog author="sflees@suse.de" date="1706011200">- This codestream wasn't affected by bsc#1207113</changelog>
  <changelog author="sflees@suse.de" date="1706011201">- Disable rpmlint tests on SLE-15 where they currently fail</changelog>
  <changelog author="sflees@suse.de" date="1715947200">- Create a versioned package for SLES</changelog>
</package>
<package pkgid="d1ed8dd6ee0386465fa44f3fc5e7a1eb5dfb76fdc1892ea3959eba525578997f" name="erlang26-dialyzer" arch="aarch64">
  <version epoch="0" ver="26.2.1" rel="150300.7.5.1"/>
  <changelog author="matwey.kornilov@gmail.com" date="1646568000">- Changes for 24.2.2:
  * inets: Avoid intermediate ungraceful shutdown of the HTTP
    server.
  * ssh: The ssh sever parallel_login option was missing in OTP-24</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1648382400">- Changes for 24.3.2:
  * erl_interface: Fix compile error regarding gethostbyaddr_r on
    Android. Error introduced in OTP 24.3.
  * kernel: Fix failed accepted connection setup after previous
    established connection from same node closed down silently.
  * kernel: Fixed a problem where typing Ctrl-R in the shell could
    hang if there were some problem with the history log file.
- Changes for 24.3.1:
  * dialyzer: There could be spurious warnings for unknown types
    when a type was a subtype of an existing type that was a
    subtype of an unknown type.
  * ssl: Client certification could fail for TLS-1.3 servers that
    did not include the certificat_authorties extension in its
    certificate request message.
- Changes for 24.3:
  * megaco: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.
  * megaco: Update the performance and debug chapters of the megaco
    user's guide. Also some updates to the meas tools.
  * compiler: The expression &lt;&lt;0/native-float&gt;&gt;=Bin would always
    fail to match, while &lt;&lt;0/float-native&gt;&gt;=Bin would match
    (provided that Bin contained the binary representation of 0.0)
  * compiler: The compiler will now compile huge functions with
    straight-line code faster.
  * erl_interface: Add --enable-ei-dynamic-lib configure option
    that will make erl_interface also release a dynamic library
    version of libei.
  * erl_interface: The ei API for decoding/encoding terms is not
    fully 64-bit compatible since terms that have a representation
    on the external term format larger than 2 GB cannot be handled.
  * sasl: Fix bug in systools:make_script/1 documentation.
  * inets: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.
  * inets: Documentation fix for inets:services_info/0, which now
    describes that Info might be a Reason term() in case when
    {error, Reason} is returned as service info.
  * crypto: The crypto app in OTP can since OTP-24.2 be compiled,
    linked and used with the new OpenSSL 3.0 cryptolib. The crypto
    app has 3.0 support has been improved, but is still *not
    recommended* for other usages than experiments and alpha
    testing. There are not yet any guaranties that it works, not
    even together with other OTP applications like for example SSL
    and SSH, although there are no known errors. Since the previous
    release, OTP-24.2, the following improvements have been done: -
    It has been tested during nearly every nightly test on the OTP
    lab - The hash algorithms md4 and ripemd160 have been enabled
    with OpenSSL 3.0. - The ciphers blowfish_cbc, blowfish_ecb,
    des_cbc, des_cfb, des_ecb, rc2_cbc and rc4 have been enabled
    with OpenSSL 3.0. Disabled or unsupported with OpenSSL 3.0 are
    still: - ENGINE support - FIPS mode - Other providers than the
    built-in ones - Compiling and linking with OpenSSL 3.0
    cryptolib in compatibility modes (for example to behave as
    1.1.1) and, the ciphers blowfish_cfb64 and blowfish_ofb64 are
    not supported and will not be either. Deprecated functions in
    the OpenSSL 3.0 cryptolib must not be disabled as OTP/crypto
    still uses some of the deprecated API functions. The gcc flag
  - Wno-deprecated-declarations is set to prevent deprecation
    warnings to be printed when compiling.
  * crypto: Crypto is adapted to LibreSSL 3.5.0 on OpenBSD.
  * crypto: New configure option ( --disable-otp-test-engine) to
    prohibit the build of the OTP test engine used in some test
    suites. The reason is that the test engine could be hard to
    compile on for instance LibreSSL 3.5.0. For that particular
    cryptolib version (or higher), this configure option is set
    automatically.
  * jinterface: Fix bug in OtpOutputStream.write_pid/4 and
    write_ref/3 causing faulty encodig. Bug exists since OTP 23.0.
  * wx: Removed the static_data option from wxImage creation
    functions, as it was broken and could lead to crashes. Now
    image data is always copied to wxWidgets as was the default
    behavior. Removed some non working wxGridEvent event types,
    which have there own events in newer wxWidgets versions, and
    added a couple of event types that where missing in wx.
  * asn1: Add support for the maps option in combination with the
    jer backend.
  * snmp: The compilation time is no longer recorded in BEAM files.
    There remained several undocumented functions that attempted to
    retrieve compilation times. Those have now been removed.
  * snmp: [agent] Remove expectation of socket being a port.
  * common_test: OTP internal test fix.
  * runtime_tools: Fixed bug in scheduler:utilization(Seconds) that
    would leave the scheduler_wall_time system flag incorrectly
    enabled.
  * runtime_tools: Add scheduler:get_sample/0 and get_sample_all/0.
    Also clarify scheduler module documentation about how it
    depends on system flag scheduler_wall_time.
  * erts: Fixed a bug in the x86 JIT that might cause floating
    point instructions to wrongly throw an exception.
  * erts: Preserve correct nodedown_reason if supervised
    distribution controller processes exit with {shutdown, Reason}.
  * erts: Handling of send_timeout for gen_tcp has been corrected
    so that the timeout is honored also when sending 0 bytes.
  * erts: By default global does not take any actions to restore a
    fully connected network when connections are lost due to
    network issues. This is problematic for all applications
    expecting a fully connected network to be provided, such as for
    example mnesia, but also for global itself. A network of
    overlapping partitions might cause the internal state of global
    to become inconsistent. Such an inconsistency can remain even
    after such partitions have been brought together to form a
    fully connected network again. The effect on other applications
    that expects that a fully connected network is maintained may
    vary, but they might misbehave in very subtle hard to detect
    ways during such a partitioning. In order to prevent such
    issues, we have introduced a prevent overlapping partitions fix
    which can be enabled using the prevent_overlapping_partitions
    kernel(6) parameter. When this fix has been enabled, global
    will actively disconnect from nodes that reports that they have
    lost connections to other nodes. This will cause fully
    connected partitions to form instead of leaving the network in
    a state with overlapping partitions. Note that this fix has to
    be enabled on all nodes in the network in order to work
    properly. Since this quite substantially changes the behavior,
    this fix is currently disabled by default. Since you might get
    hard to detect issues without this fix you are, however,
    strongly advised to enable this fix in order to avoid issues
    such as the ones described above. As of OTP 25 this fix will
    become enabled by default.
  * erts: Corrected the type specification of erlang:seq_trace/2.
  * erts: Fix memory leak when tracing on running on a process that
    only handle system tasks or non-message signals (for example
    process_info requests).
  * erts: Add support for using socket:sockaddr_in() and
    socket:sockaddr_in6() when using gen_sctp, gen_tcp and gen_udp.
    This will make it possible to use Link Local IPv6 addresses.
  * erts: Show on_load failure reasons in embedded mode.
  * erts: Compile date saved in the Erlang VM executable has been
    removed.
  * erts: Improve documentation for the dynamic node name feature.
  * ssh: Fix makefile dependency bugs.
  * ssh: Fixed faulty OpenSSH decoding of Ed25519/Ed448 keys in the
    OpenSSH format openssh_key_v1.
  * ssh: Correction of ssh_file typing, specially for the
    experimental openssh-key-v1 encoding.
  * ssh: Improper tag for private ED keys when encoding with
    ssh:encode/2. The tuple had ed_priv as first element, but
    should have had ed_pri. This is now corrected. *** POTENTIAL
    INCOMPATIBILITY ***
  * ssh: Add support for Ed25519/Ed448 SSH host keys in the RFC
    4716 format ("-----BEGIN EC PRIVATE KEY-----") generated by for
    example openssl or via Erlang functions (i.e.
    public_key:generate_key({namedCurve, ed25519})). Ed25519 SSH
    host keys generated by ssh-keygen was, and are still,
    supported.
  * kernel: Handling of send_timeout for gen_tcp has been corrected
    so that the timeout is honored also when sending 0 bytes.
  * kernel: By default global does not take any actions to restore
    a fully connected network when connections are lost due to
    network issues. This is problematic for all applications
    expecting a fully connected network to be provided, such as for
    example mnesia, but also for global itself. A network of
    overlapping partitions might cause the internal state of global
    to become inconsistent. Such an inconsistency can remain even
    after such partitions have been brought together to form a
    fully connected network again. The effect on other applications
    that expects that a fully connected network is maintained may
    vary, but they might misbehave in very subtle hard to detect
    ways during such a partitioning. In order to prevent such
    issues, we have introduced a prevent overlapping partitions fix
    which can be enabled using the prevent_overlapping_partitions
    kernel(6) parameter. When this fix has been enabled, global
    will actively disconnect from nodes that reports that they have
    lost connections to other nodes. This will cause fully
    connected partitions to form instead of leaving the network in
    a state with overlapping partitions. Note that this fix has to
    be enabled on all nodes in the network in order to work
    properly. Since this quite substantially changes the behavior,
    this fix is currently disabled by default. Since you might get
    hard to detect issues without this fix you are, however,
    strongly advised to enable this fix in order to avoid issues
    such as the ones described above. As of OTP 25 this fix will
    become enabled by default.
  * kernel: Fix bug where logger would crash when logging a report
    including improper lists.
  * kernel: Make erlang:set_cookie work for dynamic node names.
  * kernel: Add support for using socket:sockaddr_in() and
    socket:sockaddr_in6() when using gen_sctp, gen_tcp and gen_udp.
    This will make it possible to use Link Local IPv6 addresses.
  * kernel: A net_tickintensity kernel parameter has been
    introduced. It can be used to control the amount of ticks
    during a net_ticktime period. A new net_kernel:start/2 function
    has also been introduced in order to make it easier to add new
    options. The use of net_kernel:start/1 has been deprecated.
  * kernel: Improve documentation for the dynamic node name
    feature.
  * erl_docgen: Fix css for large tables and images on small
    screens
  * erl_docgen: Fix bug with codeinclude tag that caused it to not
    include the code if used in a correct, but unexpected way.
  * observer: Calculate the display width in etop, instead of hard-
    coding it to 89 characters.
  * debugger: Fix record index matching, it was broken and could
    never match.
  * ssl: Improved error handling.
  * ssl: Before this change, net_kernel used with TLS distribution
    might be leaking processes in case of connectivity issues.
  * ssl: Fix makefile dependency bugs.
  * ssl: Make sure the TLS sender process handles explicit calls to
    erlang:disconnect_node properly, avoiding potential hanging
    problems in net_kernel.
  * ssl: Add support for TLS-1.3 certificate_authorities extension.
    And process certificate_authorities field in pre-TLS-1.3
    certificate requests.
  * ssl: Support password fun for protected keyfiles in ssl:connect
    function.
  * ssl: Add in some cases earlier detection of possible DoS
    attacks by malicious clients sending unexpected TLS messages
    instead of the client hello. Note that such attacks are already
    mitigated by providing a timeout for the TLS handshake.
  * eldap: Fix eldap extensibleMatch dnAttributes option. According
    to the ldap ASN1 the dnAttributes should be a bool, instead it
    was generated as a string.
  * eldap: Implemented paged searches according to https://www.rfc-
    editor.org/rfc/rfc2696.txt
  * public_key: Support password fun for protected keyfiles in
    ssl:connect function.
  * stdlib: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.
  * mnesia: Reduce the number of locks taken during table copying,
    should reduce the startup time on large systems.
  * diameter: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1649246400">- Fix build for Factory. Currently, any Java version
  is fine for Erlang.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1653220800">- Version 25.0:
  - stdlib
  * New function filelib:ensure_path/1 will ensure that all
    directories for the given path exists
  * New functions groups_from_list/2 and groups_from_list/3 in
    the maps module
  * New functions uniq/1 uniq/2 in the lists module
  * New PRNG added to the rand module, for fast pseudo-random
    numers.
  - compiler, kernel, stdlib, syntax_tools:
  * Added support for selectable features as described in EEP-60.
    Features can be enabled/disabled during compilation with
    options (ordinary and +term) to erlc as well as with
    directives in the file. Similar options can be used to erl
    for enabling/disabling features allowed at runtime. The new
    maybe expression EEP-49 is fully supported as the feature
    maybe_expr.
  - erts &amp; JIT:
  * The JIT now works for 64-bit ARM processors.
  * The JIT now does type-based optimizations based on type
    information in the BEAM files.
  * Improved the JIT’s support for external tools like perf and
    gdb, allowing them to show line numbers and even the original
    Erlang source code when that can be found.
  - erts, stdlib, kernel:
  * Users can now configure ETS tables with the
    {write_concurrency, auto} option. This option forces tables
    to automatically change the number of locks that are used at
    run-time depending on how much concurrency is detected. The
    {decentralized_counters, true} option is enabled by default
    when {write_concurrency, auto} is active.
  * Benchmark results comparing this option with the other ETS
    optimization options are available here: benchmarks.
  * To enable more optimizations, BEAM files compiled with OTP 21
    and earlier cannot be loaded in OTP 25.
  * The signal queue of a process with the process flag
    message_queue_data=off_heap has been optimized to allow
    parallel reception of signals from multiple processes. This
    can improve performance when many processes are sending in
    parallel to one process. See benchmark.
  * The Erlang installation directory is now relocatable on the
    file system given that the paths in the installation’s
    RELEASES file are paths that are relative to the
    installations root directory.
  * A new option called short has been added to the functions
    erlang:float_to_list/2 and erlang:float_to_binary/2. This
    option creates the shortest correctly rounded string
    representation of the given float that can be converted back
    to the same float again.
  * Introduction of quote/1 and unquote/1 functions in the
    uri_string module - a replacement for the deprecated
    functions http_uri:encode and http_uri:decode.
  * The new module peer supersedes the slave module. The slave
    module is now deprecated and will be removed in OTP 27.
  * global will now by default prevent overlapping partitions due
    to network issues. This is done by actively disconnecting
    from nodes that reports that they have lost connections to
    other nodes. This will cause fully connected partitions to
    form instead of leaving the network in a state with
    overlapping partitions.
  * It is possible to turn off the new behavior by setting the
    the kernel configuration parameter
    prevent_overlapping_partitions to false. Doing this will
    retain the same behavior as in OTP 24 and earlier.
  * The format_status/2 callback for gen_server, gen_statem and
    gen_event has been deprecated in favor of the new
    format_status/1 callback.
  * The new callback adds the possibility to limit and change
    many more things than the just the state.
  * The timer module has been modernized and made more efficient,
    which makes the timer server less susceptible to being
    overloaded. The timer:sleep/1 function now accepts an
    arbitrarily large integer.
  - compiler:
  * The maybe ... end construction as proposed in EEP-49 has been
    implemented. It can simplify complex code where otherwise
    deeply nested cases would have to be used.
  * To enable maybe, give the option {enable_feature,maybe_expr}
    to the compiler. The exact option to use will change in a
    coming release candidate and then it will also be possible to
    use from inside the module being compiled.
  * When a record matching or record update fails, a {badrecord,
    ExpectedRecordTag} exception used to be raised. In this
    release, the exception has been changed to {badrecord,
    ActualValue}, where ActualValue is the value that was found
    instead of the expected record.
  * Add compile attribute -nifs() to empower compiler and loader
    with information about which functions may be overridden as
    NIFs by erlang:load_nif/2.
  * Improved and more detailed error messages when binary
    construction with the binary syntax fails. This applies both
    for error messages in the shell and for
    erl_error:format_exception/3,4.
  * Change format of feature options and directives for better
    consistency. Options to erlc and the -compile(..) directive
    now has the format {feature, feature-name, enable | disable}.
    The -feature(..) now has the format -feature(feature-name,
    enable | disable).
  - crypto:
  * Add crypto:hash_equals/2 which is a constant time comparision
    of hashvalues.
  - ssl:
  * Introducing a new (still experimental) option
    {certs_keys,[cert_key_conf()]}. With this a list of a
    certificates with their associated key may be used to
    authenticate the client or the server. The certificate key
    pair that is considered best and matches negotiated
    parameters for the connection will be selected.
  - public_key:
  * Functions for retrieving OS provided CA-certs added.
  - dialyzer:
  * Optimize operations in the erl_types module. Parallelize the
    Dialyzer pass remote.
  * Added the missing_return and extra_return options to raise
    warnings when specifications differ from inferred types.
    These are similar to, but not quite as verbose as overspecs
    and underspecs.
  * Dialyzer now better understands the types for min/2, max/2,
    and erlang:raise/3. Because of that, Dialyzer can potentially
    generate new warnings. In particular, functions that use
    erlang:raise/3 could now need a spec with a no_return()
    return type to avoid an unwanted warning.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1656849600">- Changes for 25.0.2:
  * ssl: Improved handling of unexpected messages during the
    handshake, taking the right action for unexpected messages.
  * erts: On computers with the ARM64 (AArch64) architecture (such
    as Apple Silicon Macs) a rem expression followed by a div
    expression with the same operands could evaluate to the wrong
    result if the result of the rem expression was unused.
- Changes for 25.0.1:
  * ssl: When a TLS-1.3 enabled client tried to talk to a TLS-1.2
    server that coalesces TLS-1.2 handshake message over one TLS
    record, the connection could fail due to some message being
    handled in the wrong state, this has been fixed.
  * ssl: Correctly handles supported protocol version change from
    default to something else by sni_fun supplied to
    ssl:handshake/[2,3] together with a TCP-socket (so called
    upgrade).
  * ssl: Also, TLS-1.3 should respond with a protocol version alert
    if previous versions, that are supported but not configured,
    are attempted.
  * kernel: The DNS resolver inet_res has been fixed to ignore
    trailing dot difference in the request domain between the sent
    request and the received response, when validating a response.
  * kernel: A bug in inet_res has been fixed where a missing
    internal {ok,_} wrapper caused inet_res:resolve/* to return a
    calculated host name instead of an `{ok,Msg} tuple, when
    resolving an IP address or a host name that is an IP address
    string.
  * kernel: The erlang:is_alive() BIF could return true before
    configured distribution service was available. This bug was
    introduced in OTP 25.0 ERTS version 13.0. The
    erlang:monitor_node() and erlang:monitor() BIFs could
    erroneously fail even though configured distribution service
    was available. This occurred if these BIFs were called after
    the distribution had been started using dynamic node name
    assignment but before the name had been assigned.
  * kernel: Added the missing mandatory address/0 callback in the
    gen_tcp_dist example.
  * erts: A spawn_reply signal from a remote node could be delayed
    and be delivered after other signals from the newly spawned
    process. When this bug triggered, the connection to the node
    where the process was spawned sometimes could be taken down due
    to the bug. The following error message would then be logged if
    this happened: Missing 'spawn_reply' signal from the node
    &lt;RemoteNode&gt; detected by &lt;Pid&gt; on the node &lt;LocalNode&gt;. The
    node &lt;RemoteNode&gt; probably suffers from the bug with ticket id
    OTP-17737. This bug only affected processes which had enabled
    off_heap message_queue_data and parallel reception of signals
    had been automatically enabled. This bug was introduced in OTP
    25.0, ERTS version 13.0.
  * erts: Fixed type spec of erlang:system_info(dist_ctrl).
  * erts: The zlib built in to the runtime system has been updated
    to version 1.2.12. (Note that on most platforms, the platform's
    own zlib is used.)
  * erts: The erlang:is_alive() BIF could return true before
    configured distribution service was available. This bug was
    introduced in OTP 25.0 ERTS version 13.0. The
    erlang:monitor_node() and erlang:monitor() BIFs could
    erroneously fail even though configured distribution service
    was available. This occurred if these BIFs were called after
    the distribution had been started using dynamic node name
    assignment but before the name had been assigned.
  * crypto: Note in the documentation that MODP (rfc3526) groups
    and OpenSSL 3.0 can give an error if a call to
    crypto:generate_key/2 specifies a key length, and that length
    is to small.
  * crypto: The cmac now uses only the 3.0 API
  * crypto: Documentation is now updated with which OpenSSL
    cryptolib versions that OTP currently is tested.
  * dialyzer: Fixed the documentation for the missing_return and
    extra_return options.
  * mnesia: Fixed add_table_copy which could leave a table lock if
    the receiving node went down during the operation.
  * ssh: Binaries can be limited in logs with the parameter
    max_log_item_len. The default value is 500 bytes.
  * stdlib: In the initial release of Erlang/OTP 25, the expression
    bound to the _ pseudo-field in a record initialization would
    always be evaluated once, even if all other fields in the
    record were explicitly initialized. That would break the use
    case of binding the expression error(...) to _ in order to get
    an exception if not all fields were initialized. The behavior
    of binding to _ has been reverted to the pre-OTP 25 behavior,
    that is, to not evaluate the expression if all fields have been
    bound to explicit values.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1660046400">- Changes for 25.0.3:
  * erts: Distributed exit signals could be lost under the
    following conditions:
  * erts: A race could cause process_info(Pid, message_queue_len)
    on other processes to return invalid results.
  * erts: Fixed reduction counting for handling process system
    tasks.
  * erts: Priority elevation of terminating processes did not work
    which could cause execution of such processes to be delayed.
  * erts: An unlink operation made by a process that terminated
    before the unlink operation completed, i.e., before it had
    received an unlink-ack signal from the linked process, caused
    an exit signal to erroneously be sent from the terminating
    process to the process being unlinked. This exit signal would
    most often be ignored by the receiver, but if the receiver of
    the exit signal concurrently set up a new link, it could
    receive the exit signal with the actual exit reason of the
    terminating process instead of a noproc exit reason. It is
    however very hard to detect that this has happened and has no
    obvious negative consequences, so it should be considered
    harmless. A distributed unlink-ack signal received by a
    terminating process was also not properly removed which could
    cause a minor memory leak.
  * ssl: The link to crypto:engine_load refered the function with
    wrong arity.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1661601600">- Changes for 25.0.4:
  * kernel: A call to net_kernel:setopts(new, Opts) at the same
    time as a connection was being set up could cause a deadlock
    between the net_kernel process and the process setting up the
    connection.
  * erts: The monitor/3 BIF did not apply options to the created
    monitor if the target process or port did not exist. That is,
    the corresponding down message would get a `DOWN` tag even if a
    custom tag had been set, and the returned reference was not an
    alias even if the alias option had been passed.
  * erts: The erlang:monotonic_time/1, erlang:system_time/1,
    erlang:time_offset/1, and os:system_time/1 BIFs erroneously
    failed when passed the argument native.</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1665662400">- Changes for 25.1.1:
  * dialyzer: Dialyzer could crash when analyzing Elixir code that
    used intricate macros.
  * dialyzer: The --input_list_file option has been added.
  * ssl: Fixes handling of symlinks in cacertfile option.
  * eunit: With this change, eunit exact_execution option works
    with application primitive.
  * stdlib: peer nodes failed to halt when the process supervising
    the control connection crashed. When an alternative control
    connection was used, this supervision process also quite
    frequently crashed when the peer node was stopped by the node
    that started it which caused the peer node to linger without
    ever halting.
  * asn1: For the per and uper ASN.1 encoding rules, encoding and
    decoding the SEQUENCE OF and SET OF constructs with 16384 items
    or more is now supported.
  * erts: Listen sockets created with the socket module, leaked
    (erlang-) monitors.
  * erts: Notifications about available distribution data sent to
    distribution controller processes could be lost. Distribution
    controller processes can be used when implementing an
    alternative distribution carrier. The default distribution over
    tcp was not effected and the bug was also not present on
    x86/x86_64 platforms.
  * kernel: Listen sockets created with the socket module, leaked
    (erlang-) monitors.
  * kernel: peer nodes failed to halt when the process supervising
    the control connection crashed. When an alternative control
    connection was used, this supervision process also quite
    frequently crashed when the peer node was stopped by the node
    that started it which caused the peer node to linger without
    ever halting.
- Changes for 25.1:
  * dialyzer: Two bugs have been fixed in Dialyzer's checking of
    behaviors: When a mandatory callback function is present but
    not exported, Dialyzer would not complain about a missing
    callback. When an optional callback function was not exported
    and had incompatible arguments and/or the return values were
    incompatible, Dialyzer would complain. This has been changed to
    suppress the warning, because the function might not be
    intended to be a callback function, for instance if a release
    added a new optional callback function (such as format_status/1
    for the gen_server behaviour added in OTP 25).
  * dialyzer: The no_extra_return and no_missing_return warnings
    can now be suppressed through -dialyzer directives in source
    code.
  * jinterface: Fix javadoc build error by adding option -encoding
    UTF-8.
  * diameter: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * crypto: Fix configure with --with-ssl and --disable-dynamic-
    ssl-lib on Windows.
  * crypto: Remove all references correctly in the garbage
    collection if an engine handle was not explicit unloaded.
  * crypto: Changed the behaviour of the engine load/unload
    functions The engine load/unload functions have got changed
    semantics to get a more consistent behaviour and work correct
    when variables are garbage collected. The load functions now
    don't register the methods for the engine to replace. That will
    now be handled with the new functions
    engine_register/engine_unregister if needed. Some functions are
    removed from the documentation and therefor the API, but they
    are left in the code for compatibility. *** POTENTIAL
    INCOMPATIBILITY ***
  * crypto: Fixed a naming bug for AES-CFB and Blowfish-CFB/OFB
    when linked with OpenSSL 3.0 cryptolib.
  * crypto: Sign/verify does now behave as in OTP-24 and earlier
    for eddsa.
  * crypto: Pass elliptic curve names from crypto.erl to crypto's
    nif.
  * crypto: The configure option --disable-deprecated-warnings is
    removed. It was used for some releases when the support for
    OpenSSL 3.0 was not completed. It is not needed in OTP 25.
  * crypto: Crypto is now considered to be usable with the OpenSSL
    3.0 cryptolib for production code. ENGINE and FIPS are not yet
    fully functional.
  * crypto: Do not exit if the legacy provider is missing in
    libcrypto 3.0.
  * ssl: Reject unexpected application data in all relevant places
    for all TLS versions. Also, handle TLS-1.3 middlebox
    compatibility with more care. This will make malicious
    connections fail early and further, mitigate possible DoS
    attacks, that would be caught by the handshake timeout. Thanks
    to Aina Toky Rasoamanana and Olivier Levillain from Télécom
    SudParis for alerting us of the issues in our implementation.
  * ssl: With this change, value of cacertfile option will be
    adjusted before loading certs from the file. Adjustments
    include converting relative paths to absolute and converting
    symlinks to actual file path. Thanks to Marcus Johansson
  * ssl: In TLS-1.3, if chain certs are missing (so server auth
    domain adherence can not be determined) send peer cert and hope
    the server is able to recreate a chain in its auth domain.
  * ssl: Make sure periodical refresh of CA certificate files
    repopulates cache properly.
  * ssl: Correct internal CRL cache functions to use internal
    format consistently.
  * ssl: Incorrect handling of client middlebox negotiation for
    TLS-1.3 could result in that a TLS-1.3 server would not use
    middlebox mode although the client was expecting it too and
    failing the negotiation with unexpected message.
  * ssl: If the "User" process, the process starting the TLS
    connection, gets killed in the middle of spawning the dynamic
    connection tree make sure we do not leave any processes behind.
  * ssl: A vulnerability has been discovered and corrected. It is
    registered as CVE-2022-37026 "Client Authentication Bypass".
    Corrections have been released on the supported tracks with
    patches 23.3.4.15, 24.3.4.2, and 25.0.2. The vulnerability
    might also exist in older OTP versions. We recommend that
    impacted users upgrade to one of these versions or later on the
    respective tracks. OTP 25.1 would be an even better choice.
    Impacted are those who are running an ssl/tls/dtls server using
    the ssl application either directly or indirectly via other
    applications. For example via inets (httpd), cowboy, etc. Note
    that the vulnerability only affects servers that request client
    certification, that is sets the option {verify, verify_peer}.
    (bsc#1205318)
  * eunit: With this change, Eunit can optionally not try to
    execute related module with "_tests" suffix. This might be used
    for avoiding duplicated executions when source and test modules
    are located in the same folder.
  * erl_docgen: Update DTD to allow XML tag em under pre.
  * inets: Add httpc:ssl_verify_host_options/1 to help setting
    default ssl options for the https client.
  * inets: This change fixes dialyzer warnings generated for
    inets/httpd examples (includes needed adjustment of spec for
    ssh_sftp module).
  * inets: Remove documentation of no longer supported callback.
  * stdlib: Fixed inconsistency bugs in global due to
    nodeup/nodedown messages not being delivered before/after
    traffic over connections. Also fixed various other
    inconsistency bugs and deadlocks in both global_group and
    global. As building blocks for these fixes, a new BIF
    erlang:nodes/2 has been introduced and
    net_kernel:monitor_nodes/2 has been extended. The -hidden and
  - connect_all command line arguments did not work if multiple
    instances were present on the command line which has been
    fixed. The new kernel parameter connect_all has also been
    introduced in order to replace the -connect_all command line
    argument.
  * stdlib: Fix the public_key:ssh* functions to be listed under
    the correct release in the Removed Functionality User's Guide.
  * stdlib: The type spec for format_status/1 in gen_statem,
    gen_server and gen_event has been corrected to state that the
    return value is of the same type as the argument (instead of
    the same value as the argument).
  * stdlib: If the timer server child spec was already present in
    kernel_sup but it was not started, the timer server would fail
    to start with an {error, already_present} error instead of
    restarting the server.
  * stdlib: When changing callback module in gen_statem the
    state_enter calls flag from the old module was used in for the
    first event in the new module, which could confuse the new
    module and cause malfunction. This bug has been corrected. With
    this change some sys debug message formats have been modified,
    which can be a problem for debug code relying on the format.
  * ** POTENTIAL INCOMPATIBILITY ***
  * stdlib: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * stdlib: The rfc339_to_system_time/1,2 functions now allows the
    minutes part to be omitted from the time zone.
  * stdlib: The receive statement in gen_event has been optimized
    to not use selective receive (which was never needed, and could
    cause severe performance degradation under heavy load).
  * stdlib: Add new API function erl_features:configurable/0
  * parsetools: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * public_key: Support more Linux distributions in cacerts_load/0.
  * public_key: Correct asn1 typenames available in type
    pki_asn1_type()
  * public_key: Sign/verify does now behave as in OTP-24 and
    earlier for eddsa.
  * snmp: Improved the get-bulk response max size calculation. Its
    now possible to configure 'empty pdu size', see appendix c for
    more info.
  * snmp: Fix various example dialyzer issues
  * ssh: Handling rare race condition at channel close.
  * ssh: New ssh option no_auth_needed to skip the ssh
    authentication. Use with caution!
  * ssh: This change fixes dialyzer warnings generated for
    inets/httpd examples (includes needed adjustment of spec for
    ssh_sftp module).
  * ssh: The new function ssh:daemon_replace_options/2 makes it
    possible to change the Options in a running SSH server.
    Established connections are not affected, only those created
    after the call to this new function.
  * ssh: Add a timeout as option max_initial_idle_time. It closes a
    connection that does not allocate a channel within the timeout
    time. For more information about timeouts, see the Timeouts
    section in the User's Guide Hardening chapter.
  * observer: Fixed units in gui.
  * xmerl: There is a new configure option, --enable-deterministic-
    build, which will apply the deterministic compiler option when
    building Erlang/OTP. The deterministic option has been improved
    to eliminate more sources of non-determinism in several
    applications.
  * asn1: There is a new configure option, --enable-deterministic-
    build, which will apply the deterministic compiler option when
    building Erlang/OTP. The deterministic option has been improved
    to eliminate more sources of non-determinism in several
    applications.
  * erts: Fixed inconsistency bugs in global due to nodeup/nodedown
    messages not being delivered before/after traffic over
    connections. Also fixed various other inconsistency bugs and
    deadlocks in both global_group and global. As building blocks
    for these fixes, a new BIF erlang:nodes/2 has been introduced
    and net_kernel:monitor_nodes/2 has been extended. The -hidden
    and -connect_all command line arguments did not work if
    multiple instances were present on the command line which has
    been fixed. The new kernel parameter connect_all has also been
    introduced in order to replace the -connect_all command line
    argument.
  * erts: Fixed IPv6 multicast_if and membership socket options.
  * erts: Accept funs (NEW_FUN_EXT) with incorrectly encoded size
    field. This is a workaround for a bug (OTP-18104) existing in
    OTP 23 and 24 that could cause incorrect size fields in certain
    cases. The emulator does not use the decoded size field, but
    erl_interface still does and is not helped by this workaround.
  * erts: Fixed issue with inet:getifaddrs hanging on pure IPv6
    Windows
  * erts: Fix faulty distribution encoding of terms with either The
    symptom could be failed decoding on the receiving side leading
    to aborted connection. Fix OTP-18093 is a workaround for theses
    bugs that makes the VM accepts such faulty encoded funs. The
    first encoding bug toward pending connection exists only in OTP
    23 and 24, but the second one exists also on OTP 25.
  * erts: Fixed emulator crash that could happen during crashdump
    generation of ETS tables with options ordered_set and
    {write_concurrency,true}.
  * erts: Retrieval of monotonic and system clock resolution on
    MacOS could cause a crash and/or erroneous results.
  * erts: Fix bug where the max allowed size of erl +hmax was lower
    than what was allowed by process_flag.
  * erts: On computers with ARM64 (AArch64) processors, the JIT
    could generate incorrect code when more than 4095 bits were
    skipped at the tail end of a binary match.
  * erts: In rare circumstances, an is_binary/1 guard test could
    succeed when given a large integer.
  * erts: Fix bug causing ets:info (and sometimes ets:whereis) to
    return 'undefined' for an existing table if a concurrent
    process were doing ets:insert with a long list on the same
    table.
  * erts: Fix writing and reading of more than 2 GB in a single
    read/write operation on macOS. Before this fix attempting to
    read/write more than 2GB would result in {error,einval}.
  * erts: Fix bug sometimes causing emulator crash at node shutdown
    when there are pending connections. Only seen when running duel
    distribution protocols, inet_drv and inet_tls_dist.
  * erts: Yield when adjusting large process message queues due to
    The message queue adjustment work will now be interleaved with
    all other types of work that processes have to do, even other
    message queue adjustment work.
  * erts: Add rudimentary debug feature (option) for the inet-
    driver based sockets, such as gen_tcp and gen_udp.
  * erts: Introduced the hidden and dist_listen options to
    net_kernel:start/2. Also documented the -dist_listen command
    line argument which was erroneously documented as a kernel
    parameter and not as a command line argument.
  * erts: New documentation chapter "Debugging NIFs and Port
    Drivers" under Interoperability Tutorial.
  * erts: Add new API function erl_features:configurable/0
  * kernel: Fixed inconsistency bugs in global due to
    nodeup/nodedown messages not being delivered before/after
    traffic over connections. Also fixed various other
    inconsistency bugs and deadlocks in both global_group and
    global. As building blocks for these fixes, a new BIF
    erlang:nodes/2 has been introduced and
    net_kernel:monitor_nodes/2 has been extended. The -hidden and
  - connect_all command line arguments did not work if multiple
    instances were present on the command line which has been
    fixed. The new kernel parameter connect_all has also been
    introduced in order to replace the -connect_all command line
    argument.
  * kernel: Fixed IPv6 multicast_if and membership socket options.
  * kernel: Fixed issue with inet:getifaddrs hanging on pure IPv6
    Windows
  * kernel: The type specifications for inet:getopts/2 and
    inet:setopts/2 have been corrected regarding SCTP options.
  * kernel: The type specifications for inet:parse_* have been
    tightened.
  * kernel: Fix gen_tcp:connect/3 spec to include the inet_backend
    option.
  * kernel: Fix bug where using a binary as the format when calling
    logger:log(Level, Format, Args) (or any other logging function)
    would cause a crash or incorrect logging.
  * kernel: Add rudimentary debug feature (option) for the inet-
    driver based sockets, such as gen_tcp and gen_udp.
  * kernel: Introduced the hidden and dist_listen options to
    net_kernel:start/2. Also documented the -dist_listen command
    line argument which was erroneously documented as a kernel
    parameter and not as a command line argument.
  * kernel: Scope and group monitoring have been introduced in pg.
    For more information see the documentation of
    pg:monitor_scope(), pg:monitor(), and pg:demonitor().
  * kernel: A new function global:disconnect/0 has been introduced
    with which one can cleanly disconnect a node from all other
    nodes in a cluster of global nodes.
  * compiler: The compiler will now forbid using the empty atom ''
    as module name. Also forbidden are modules names containing
    control characters, and module names containing only spaces and
    soft hyphens.
  * compiler: The bin_opt_info and recv_opt_info options would
    cause the compiler to crash when attempting to compile
    generated code without location information.
  * compiler: In rare circumstances involving floating point
    operations, the compiler could terminate with an internal
    consistency check failure.
  * compiler: In rare circumstances when doing arithmetic
    instructions on non-numbers, the compiler could crash.
  * compiler: In rare circumstances, complex boolean expressions in
    nested cases could cause the compiler to crash.
  * compiler: Expression similar to #{assoc:=V} = #key=&gt;self()}, V
    would return the empty map instead of raising an exception.
  * compiler: Eliminated a crash in the beam_ssa_bool pass of the
    compiler when compiling a complex guard expression.
  * compiler: In rare circumstances, the compiler could crash with
    an internal consistency check failure.
  * compiler: When compiling with the option inline_list_funcs, the
    compiler could produce a nonsensical warning.
  * compiler: When given the no_ssa_opt option, the compiler could
    terminate with an internal consistency failure diagnostic when
    compiling map matching.
  * compiler: Made warnings for existing atoms being keywords in
    experimental features more precise, by not warning about quoted
    atoms.
  * compiler: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * megaco: Fixed various dialyzer related issues in the examples
    and the application proper.
  * megaco: There is a new configure option, --enable-
    deterministic-build, which will apply the deterministic
    compiler option when building Erlang/OTP. The deterministic
    option has been improved to eliminate more sources of non-
    determinism in several applications.
  * common_test: Fix cth_surefire to handle when a suite is not
    compiled with debug_info. This bug has been present since
    Erlang/OTP 25.0.
  * common_test: Common Test now preserves stack traces for throws.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1669291200">- Changes for 25.1.2:
  * mnesia: Don't fill the logs if mnesia can't connect to all
    nodes, due to partitioned network.
  * erts: Add abandon carrier free utilization limit (+Muacful)
    option to erts_alloc. This option allows the user to mark
    unused segments in a memory carrier as re-useable by the OS if
    needed. This functionality was a non-configurable default
    before Erlang/OTP 25, but removed due to performance issues.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1671364800">- Changes for 25.2:
  * erts: Fix perf/gdb JIT symbols to not contain CodeInfoPrologue
    for the JIT internal module erts_beamasm.
  * erts: Fixed minor memory leaks.
  * erts: Fix bugs in ets:insert and ets:insert_new when called
    with a list of tuples to insert while a concurrent process
    either deletes or renames the table. The table deletion could
    be done with ets:delete/1 or be caused by termination of the
    table owning process. Symptoms are either VM crash or strange
    incorrect behavior from the insert operation. The risk of
    triggering the bugs increases with the length of the list of
    tuple to insert. Bugs exist since OTP 23.0.
  * erts: Boost execution of scheduled thread progress jobs. This
    to prevent memory exhaustion in extremely rapid
    allocation/deallocation scenarios, such as repeated ETS table
    creations/deletions.
  * erts: Fix segv crash during crash dumping an ETS table doing
    ets:delete_all_objects.
  * erts: Spec for function net:if_names/0 incorrect
  * erts: Fix bug in binary_to_term decoding a binary term 2Gbyte
    or larger.
  * erts: Documentation of erlang:module_loaded/1 has been
    adjusted:
  * erts: Fix list_to_atom/1 for negative code points. Could either
    return with a positive code point or fail with an incorrect
    exception.
  * erts: Fix rare bug causing VM crash when sending to a pid of a
    spawning process returned from erlang:processes/0. Only seen
    when provoked by system process literal_area_collector,
    triggered by a module purge operation, on a VM started with
    +Meamin (no customized allocators).
  * erts: gen_udp:open/2 with option(s) add_membership or
    drop_membership would drop earlier options.
  * erts: The inet:setopts/2 {reuseaddr, true} option will now be
    ignored on Windows unless the socket is an UDP socket. For more
    information see the documentation of the reuseaddr option part
    of the documentation of inet:setopts/2. Prior to OTP 25 the
    {reuseaddr, true} option was ignored for all sockets on
    Windows, but as of OTP 25.0 this was changed so that it was not
    ignored for any sockets. *** POTENTIAL INCOMPATIBILITY ***
  * erts: Fix bug in binary_to_term decoding a list of length 1G or
    longer.
  * erts: Fix bug in binary_to_term (and distributed receive) when
    decoding a large map (&gt;32 keys) with unsorted small maps (&lt;=
    32) as keys of the large map. This was only a problem if the
    term was encoded by erl_interface, jinterface or otherwise, as
    the VM itself always encodes small maps with sorted keys. The
    "binary_to_term" would appear as successful but the created
    large map was internally inconsistent. The smaller key-maps
    could not be found with maps:get and friends. Other operations
    such as map compare and merge could probably also give
    incorrect results.
  * erts: Fix Windows bug in open_port({spawn, Command}, ..) when
    Command is found via the OS search PATH and that directory path
    contains white spaces. The port program would start but the
    command line arguments to it could be incorrect.
  * ftp: fix unexpected result ok when calling ftp:nlist repeatedly
  * inets: This change allows body requests to httpc:request/5 be
    an iolist()
  * inets: addition of type specs in httpc.erl
  * inets: httpc: Add support for HTTP 308 status code
  * dialyzer: Dialyzer would crash when attempting to analyze a bit
    syntax segment size having an literal non-integer size such as
    [].
  * dialyzer: Dialyzer could crash when trying to analyze a
    convoluted nested expression involving funs,
  * kernel: Fixed shutdown crash in gen_tcp socket backend, when
    the other end closed the socket.
  * kernel: erl_tar can now read gzip-compressed tar files that are
    padded. There is a new option compressed_one for file:open/2
    that will read a single member from a gzip file,
  * kernel: Fix os:cmd to not translate all exceptions thrown to
    badarg. For example emfile from erlang:open_port was translated
    to badarg. This bug has existed since Erlang/OTP 24.
  * kernel: Spec for function net:if_names/0 incorrect
  * kernel: Missing ctrl option name transation for TOS and TTL (on
    FreeBSD) when using gen_udp with the 'socket' inet_backend.
  * kernel: gen_udp:open/2 with option(s) add_membership or
    drop_membership would drop earlier options.
  * kernel: The inet:setopts/2 {reuseaddr, true} option will now be
    ignored on Windows unless the socket is an UDP socket. For more
    information see the documentation of the reuseaddr option part
    of the documentation of inet:setopts/2. Prior to OTP 25 the
    {reuseaddr, true} option was ignored for all sockets on
    Windows, but as of OTP 25.0 this was changed so that it was not
    ignored for any sockets. *** POTENTIAL INCOMPATIBILITY ***
  * kernel: The distribution socket option handling in
    inet_tcp_dist has been cleaned up to clarify which were
    mandatory and which just had default values.
  * kernel: Improve warning message format for gen_tcp_socket.
  * snmp: Explicitly close the socket(s) when terminating
    (default-) net-if process.
  * stdlib: erl_tar can now read gzip-compressed tar files that are
    padded. There is a new option compressed_one for file:open/2
    that will read a single member from a gzip file,
  * stdlib: A concurrent call to ets:rename could cause
    ets:delete_all_objects to fail halfway through with badarg.
  * stdlib: It is not allowed to call functions from guards. The
    compiler failed to reject a call in a guard when done by
    constructing a record with a default initialization expression
    that called a function.
  * stdlib: The compiler could crash when using a record with
    complex field initialization expression as a filter in a list
    comprehension.
  * stdlib: unicode:characters_to_binary() could build
    unnecessarily large call stack.
  * stdlib: Improve error message for ets:new/2 name clash. Say
    "name already exists" instead of less specific "invalid
    options".
  * mnesia: Fixed crash which could happen during startup if too
    many decisions where sent from remote nodes.
  * os_mon: The disk_space_check_interval configuration parameter
    of disksup can now be set to values smaller than a minute.
  * ssh: graceful shutdown of ssh_conection_handler when connection
    is closed by peer
  * common_test: Fix starting of peer nodes on old releases when
    the compile server was active and the current Erlang
    installation contained non-latin1 characters in its path.
  * public_key: Disregard LDAP URIs when HTTP URIs are expected.
  * ssl: With this change, tls_sender process is hibernated after
    sufficient inactivity.
  * ssl: Correct handling of legacy schemes so that ECDSA certs
    using sha1 may be used for some TLS-1.3 configurations.
  * ssl: With this change, tls_sender does not cause logger crash
    upon key update.
  * ssl: Enhance warning message
  * ssl: Provide server option to make certificate_authorities
    extension in the TLS-1.3 servers certificate request optional.
    This will allow clients to send incomplete chains that may be
    reconstructable and thereby verifiable by the server, but that
    would not adhere to the certificate_authorities extension.
  * ssl: If the verify_fun handles four arguments the DER cert will
    be supplied as one of the arguments.
  * megaco: A very minor improvement to the measurement tool.
  * observer: A WX event race could causes a crash in when handling
    socket or port info.
  * observer: Improve the nodes menu to include more nodes.
  * compiler: Line number in compiler messages would be truncated
    to 4 digits for line numbers greater than 9999.
  * compiler: In rare circumstance, matching a binary as part of a
    receive clause could cause the compiler to terminate because of
    an internal consistency check failure.
  * compiler: Compiling a function with complex bit syntax matching
    such as f(&lt;&lt;X:0, _:X&gt;&gt;, &lt;&lt;Y:0, _:Y&gt;&gt;) -&gt; ok. could crash the
    compiler.
  * compiler: It is not allowed to call functions from guards. The
    compiler failed to reject a call in a guard when done by
    constructing a record with a default initialization expression
    that called a function.
  * compiler: The compiler could crash when using a record with
    complex field initialization expression as a filter in a list
    comprehension.
  * wx: Added environment variable WX_MACOS_NON_GUI_APP to allow
    user to override OSXIsGUIApplication behavior.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1679745600">- Changes for 25.3:
  * reltool: Fixed a bug that would cause analysis to crash.
  * stdlib: Fixed a bug that would cause analysis to crash.
  * stdlib: Fixed a crash when formatting stack traces for error
    reports.
  * stdlib: Instead of crashing, the list_to_integer/1 and
    list_to_integer/2 BIFs now raise the system_limit exception for
    overlong lists that can't be converted to integers. Similarly,
    the string:to_integer/1 BIF now returns {error,system_limit}
    for overlong lists.
  * stdlib: Removal of non-necessary undefined types added to the
    state's supervisor record.
  * compiler: Fixed a bug that would cause the compiler to hang.
  * compiler: Fixed a crash when compiling code that contained
    maybe expressions.
  * compiler: Constructing a binary with an explicit size of all
    for a binary segment would crash the compiler.
  * compiler: The compiler would generate incorrect code for the
    following type of expression: Pattern = BoundVar1 = . . . =
    BoundVarN = Expression An exception should be raised if any of
    the bound variables have different values than Expression. The
    compiler would generate code that would cause the bound
    variables to be bound to the value of Expressionwhether the
    value matched or not.
  * xmerl: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * megaco: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * debugger: Fixed a bug that would cause analysis to crash.
  * erts: Fixed a bug on Windows where file:read_file_info/1 would
    fail for files with corrupt metadata.
  * erts: Fix process_info(_, binary) to again include "writable
    binaries" which were lost in OTP-25.0. Writable binaries are an
    optimization used when binaries are appended upon in a loop.
  * erts: Fix rare race when receiving fragmented messages on a
    terminating connection. Could potentially cause memory leaks as
    well as double free crashes. Bug exists since OTP 22.0.
  * erts: Fixed bug that could maybe cause problems when a file
    descriptor number is closed by a linked in driver and then
    opened (reused) and passed to enif_select by a NIF. No actual
    symptoms seen, only failed internal assertions in debug build.
  * erts: The runtime system could crash when tracing a process
    executing on a dirty scheduler.
  * erts: In the binary syntax, attempting to match out integers
    with size exceeding 2 GiB could crash the runtime system.
  * erts: Fixed edge case in floating-point negation where A = 0.0,
    B = -A did not produce B = -0.0 on x86_64 JIT.
  * erts: Fixed an issue in the JIT that could crash the emulator
    on some platforms.
  * erts: Added meta data to the windows installer.
  * erts: Fixed ETS insertion order into bag and duplicate_bag of
    tuples with identical keys when passed in a list to
    ets:insert/2. The insert order has been head-to-tail but was
    accidentally changed in OTP 23.0. For bag it was reverted
    (tail-to-head), while for duplicate_bag it was sometimes
    reverted depending on the length of the list and number of
    "reductions" left for the calling process. This fix changes the
    insert order of ets:insert/2 back to always be head-to-tail of
    the list argument.
  * erts: With the JIT for AArch64 (AMD64), calling bxor in with
    non-integer arguments in a guard would crash the runtime
    system.
  * erts: Fix bug regarding process flag max_heap_size. Could cause
    strange behavior when a process was killed due to exceeding the
    limit.
  * erts: Fixed binary comprehensions to be similar to other
    creation of binary data with respect to its contribution of
    triggering garbage collection.
  * erts: In rare circumstances, when a process exceeded its
    allowed heap size set by option max_heap_size, it would not be
    killed as it should be, but instead enter a kind of zombie
    state it would never get out of.
  * erts: Instead of crashing, the list_to_integer/1 and
    list_to_integer/2 BIFs now raise the system_limit exception for
    overlong lists that can't be converted to integers. Similarly,
    the string:to_integer/1 BIF now returns {error,system_limit}
    for overlong lists.
  * erts: Active process aliases of a process at its termination
    leaked memory.
  * erts: Support for fully asynchronous distributed signaling
    where send operations never block. This functionality is by
    default disabled and can be enabled per process. For more
    information see the documentation of process_flag(async_dist,
    Bool).
  * erts: Added the +JPperf no_fp option to explicitly disable
    Erlang frame pointers otherwise added when using the +JPperf
    map option.
  * erl_interface: Accept connection setup from OTP 23 and 24 nodes
    that are not using epmd.
  * erl_interface: The ei API for decoding/encoding terms is not
    fully 64-bit compatible since terms that have a representation
    on the external term format larger than 2 GB cannot be handled.
  * syntax_tools: erl_syntax_lib:annotate_bindings/1,2 will now
    properly annotate named functions and their arguments.
  * kernel: Fixed a bug on Windows where file:read_file_info/1
    would fail for files with corrupt metadata.
  * kernel: Accept connection setup from OTP 23 and 24 nodes that
    are not using epmd.
  * public_key: As different solutions of verifying certificate
    revocation exists move the decode of 'CRLDistributionPoints' so
    that it will only be decode. When it is actually used in the
    verification process. This would enable interoperability with
    systems that use certificates with an invalid empty
    CRLDistributionPoints extension that they want to ignore and
    make verification by other means.
  * public_key: public_key:pkix_path_validation validates
    certificates expiring after 2050
  * public_key: Do not leave exit message in message queue after
    calling cacerts_load() on MacOS.
  * public_key: Replace size/1 with either tuple_size/1 or
    byte_size/1 The size/1 BIF is not optimized by the JIT, and its
    use can result in worse types for Dialyzer. When one knows that
    the value being tested must be a tuple, tuple_size/1 should
    always be preferred. When one knows that the value being tested
    must be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * ssl: Fixed that new dtls connections from the same client ip
    port combination works. If there is a process waiting for
    accept the new connection will connect to that, otherwise it
    will try to re-connect to the old server connection.
  * ssl: When shutting down a node that uses SSL distribution
    (-proto_dist inet_tls), a confusing error message about an
    unexpected process exit was printed. This particular message is
    no longer generated.
  * ssl: fixes the type spec for ssl:format_error/1
  * ssl: Replace size/1 with either tuple_size/1 or byte_size/1 The
    size/1 BIF is not optimized by the JIT, and its use can result
    in worse types for Dialyzer. When one knows that the value
    being tested must be a tuple, tuple_size/1 should always be
    preferred. When one knows that the value being tested must be a
    binary, byte_size/1 should be preferred. However, byte_size/1
    also accepts a bitstring (rounding up size to a whole number of
    bytes), so one must make sure that the call to byte_size/ is
    preceded by a call to is_binary/1 to ensure that bitstrings are
    rejected. Note that the compiler removes redundant calls to
    is_binary/1, so if one is not sure whether previous code had
    made sure that the argument is a binary, it does not harm to
    add an is_binary/1 test immediately before the call to
    byte_size/1.
  * jinterface: Accept connection setup from OTP 23 and 24 nodes
    that are not using epmd.
  * os_mon: The port programs used by cpu_sup and memsup are now
    gracefully shut down when cpu_sup and memsup are shut down.
  * eunit: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * crypto: A user defined runtime library path configured using
  - -with-ssl-rpath=&lt;PATHS&gt; could fail to be enabled.
  * crypto: Ensure that configure fails if a user defined runtime
    library path has been passed by the user, but cannot set.
  * mnesia: Improved consistency for dirty writes when a table was
    added with add_table_copy/3. Fixed a problem with sticky write,
    which could lead to inconsistent data.
  * mnesia: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * common_test: Renamed undocumented macro CT_PEER/3 to
    CT_PEER_REL/3.
  * ssh: With this change, PKCS8 formatted private key file is
    properly decoded and SSH daemon with such key can be started.
  * ssh: Replace size/1 with either tuple_size/1 or byte_size/1 The
    size/1 BIF is not optimized by the JIT, and its use can result
    in worse types for Dialyzer. When one knows that the value
    being tested must be a tuple, tuple_size/1 should always be
    preferred. When one knows that the value being tested must be a
    binary, byte_size/1 should be preferred. However, byte_size/1
    also accepts a bitstring (rounding up size to a whole number of
    bytes), so one must make sure that the call to byte_size/ is
    preceded by a call to is_binary/1 to ensure that bitstrings are
    rejected. Note that the compiler removes redundant calls to
    is_binary/1, so if one is not sure whether previous code had
    made sure that the argument is a binary, it does not harm to
    add an is_binary/1 test immediately before the call to
    byte_size/1.
  * inets: With this change, handling of URI to a folder, with
    missing trailing / and a query component present is fixed.
  * inets: Adds more type information to the inets app, thus
    improving the errors that static analysis tools can detect. The
    addition of type information to records and the updates to
    function heads help static analysis tools to understand that
    some values in the records cannot be 'undefined', thus making
    static tools to type check correctly more modules in the inets
    app
  * inets: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * snmp: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * ftp: Replace size/1 with either tuple_size/1 or byte_size/1 The
    size/1 BIF is not optimized by the JIT, and its use can result
    in worse types for Dialyzer. When one knows that the value
    being tested must be a tuple, tuple_size/1 should always be
    preferred. When one knows that the value being tested must be a
    binary, byte_size/1 should be preferred. However, byte_size/1
    also accepts a bitstring (rounding up size to a whole number of
    bytes), so one must make sure that the call to byte_size/ is
    preceded by a call to is_binary/1 to ensure that bitstrings are
    rejected. Note that the compiler removes redundant calls to
    is_binary/1, so if one is not sure whether previous code had
    made sure that the argument is a binary, it does not harm to
    add an is_binary/1 test immediately before the call to
    byte_size/1.
  * dialyzer: Fixed a bug that would cause analysis to crash.
  * dialyzer: Replace size/1 with either tuple_size/1 or
    byte_size/1 The size/1 BIF is not optimized by the JIT, and its
    use can result in worse types for Dialyzer. When one knows that
    the value being tested must be a tuple, tuple_size/1 should
    always be preferred. When one knows that the value being tested
    must be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
  * tftp: Replace size/1 with either tuple_size/1 or byte_size/1
    The size/1 BIF is not optimized by the JIT, and its use can
    result in worse types for Dialyzer. When one knows that the
    value being tested must be a tuple, tuple_size/1 should always
    be preferred. When one knows that the value being tested must
    be a binary, byte_size/1 should be preferred. However,
    byte_size/1 also accepts a bitstring (rounding up size to a
    whole number of bytes), so one must make sure that the call to
    byte_size/ is preceded by a call to is_binary/1 to ensure that
    bitstrings are rejected. Note that the compiler removes
    redundant calls to is_binary/1, so if one is not sure whether
    previous code had made sure that the argument is a binary, it
    does not harm to add an is_binary/1 test immediately before the
    call to byte_size/1.
- Changes for 25.2.3:
  * erts: Comparisons between small numbers and pids or ports would
    in some edge cases say that the number was greater than the pid
    or port, violating the term order.
  * erts: process_info(Pid, status) when Pid /= self() could return
    an erroneous result.
  * ssl: Maximize compatibility by ignoring change_cipher_spec
    during handshake even if middle_box_mode is not negotiated
    (mandated by client)
  * ssl: Move assert of middlebox message after an
    hello_retry_request to maximize interoperability. Does not
    changes semantics of the protocol only allows unexpected
    message delay from server.
  * ssh: With this change, ssh application does not crash when
    formatting some of info reports for unsuccessful connections.
  * ssh: With this change, ssh does not log extensively long
    messages.
  * inets: Ensure graceful shutdown
  * inets: Return type of the type specification for function
    httpc:cookie_header/{1,2,3} has been fixed from -spec
    cookie_header(url()) -&gt; [{ field(), value() }] | {error,
    Reason} to -spec cookie_header(url()) -&gt; { field(), value() } |
    {error, Reason}
- Changes for 25.2.2:
  * ftp: Fixes calls to ftp:nlist/2 returning {error, epath} when
    the file / folder exists
- Changes for 25.2.1:
  * compiler: Fixed a bug that could cause legal code to fail
    validation.
  * compiler: Eliminated a rare crash in the beam_types module.
  * erts: Fixed a bug in selective receive optimization that could
    crash 32-bit emulators.
  * erts: A race condition which was very rarely triggered could
    cause the signal queue of a process to become inconsistent
    causing the runtime system to crash.
  * kernel: The tcp connect option 'bind_to_device' could not be
    used with inet_backend = 'socket'. 'inet' requires value type
    binarry() and 'socket' requires value type 'string()'.
  * kernel: Minor issue processing options when calling
    gen_tcp:connect with a sockaddr() and inet_backend = socket.
  * common_test: Change timeout to infinity for gen_server calls in
    cth_log_redirect
  * inets: fixes a missing case of the type specification for
    httpd:info/2/3/4
  * snmp: Single threaded agent crash when vacm table not properly
    initiated.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1683460800">- Changes for 25.3.2:
  * compiler: Fixed type handling bugs that could cause an internal
    error in the compiler for correct code.
  * os_mon: Avoid error report from failing erlang:port_close at
    shutdown of cpu_sup and memsup. Bug exists since OTP 25.3
    (os_mon-2.8.1).
  * erts: If a runtime system which was starting the distribution
    already had existing pids, ports, or references referring to a
    node with the same nodename/creation pair that the runtime
    system was about to use, these already existing pids, ports, or
    references would not work as expected in various situations
    after the node had gone alive. This could only occur if the
    runtime system was communicated such pids, ports, or references
    prior to the distribution was started. That is, it was
    extremely unlikely to happen unless the distribution was
    started dynamically and was even then very unlikely to happen.
    The runtime system now checks for already existing pids, ports,
    and references with the same nodename/creation pair that it is
    about to use. If such are found another creation will be chosen
    in order to avoid these issues.
- Changes for 25.3.1:
  * snmp: Attempts to minimize the number of the error reports
    during a failed agent init.
  * compiler: When a map update such as #{}#{key:=value} that
    should fail with an exception was unused, the exception would
    be lost.
  * compiler: Fixed bug in the validator that made it reject valid
    code.
  * crypto: With this change, random errors are fixed for
    crypto:generate_key calls with OpenSSL 3.
  * erts: Fixed a bug in the loader that prevented certain modules
    compiled with no_ssa_opt from being loaded.
  * erts: Implementations of the call() driver callback that
    returned a faulty encoded result could cause a memory leak and
    could cause invalid data on the heap of the processes calling
    erlang:port_call/3.
  * erts: Fixed a memory corruption issue when upgrading code. The
    bug was introduced in OTP 25.3
  * erts: Fixed configure tests for a few ARM-specific
    instructions, which prevented the emulator from being built on
    some platforms.
  * erts: Aliases created in combination with a monitor using the
    {alias, explicit_unalias} option stopped working from remote
    nodes when a 'DOWN' signal had been received due to the monitor
    or if the monitor was removed using the erlang:demonitor() BIF.
    This bug was introduced in OTP 24.3.4.10 and OTP 25.3.
  * erts: In rare circumstances, bit syntax matching of an invalid
    code point for a utf32 would crash the runtime system.
  * erts: Building the runtime system failed when native atomic
    support was missing. Note that execution on such systems have
    only been rudimentary tested.
  * erl_interface: Fixed configure tests for a few ARM-specific
    instructions, which prevented the emulator from being built on
    some platforms.
  * eldap: Added a new function eldap:info/1 that returns the
    socket and the transport protocol for the eldap connection.
  * inets: Correct timing related pipelining/keepalive queue bug,
    that could result in unexpected "socket_remotly_closed" errors.
  * inets: With this change, upon remote socket closure current
    request is added to a retried queue (either pipeline or
    keep_alive, but not both).
  * ssl: With this change, ssl:connection_information/2 returns
    correct keylog data after TLS1.3 key update.
  * ssl: Client signature algorithm list input order is now honored
    again , it was accidently reversed by a previous fix.
  * stdlib: The type specs in the erl_parse module has been updated
    to include the maybe construct and the ! operator.
  * wx: Improve debug prints from the nifs. Some minor fixes for
    wxWidgets-3.2. Fixed OpenGL debug functions.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1687521600">- Changes for 25.3.2.2:
  * compiler: The compiler could be very slow when compiling guards
    with multiple guard tests separated with 'or' or ';'.
- Changes for 25.3.2.1:
  * xmerl: New options to xmerl_scan and xmerl_sax_parser so one
    can limit the behaviour of the parsers to avoid some XML
    security issues. xmerl_scan gets one new option:
    xmerl_sax_parser gets the following options: The old option
    skip_external_dtd is still valid and the same as
    {external_entities, none} and {fail_undeclared_ref, false} but
    just affects DTD's and not other external references.
  * erts: Fixed a crash during tracing on certain platforms that
    cannot use the machine stack for Erlang code (mainly OpenBSD
    and Linux with musl).
  * erts: Constructing a binary segment not aligned with a byte
    boundary, with a size not fitting in 31 bits, and with a value
    not fitting in a 64-bit word could crash the runtime system.
  * erts: Further robustify implementation of large maps (&gt; 32
    keys). Keys that happen to have same internal 32-bit hash
    values are now put in collision nodes which are traversed with
    linear search. This removes the demand for the internal hash
    function when salted to eventually produce different hashes for
    all possible pairs of unequal terms.
  * stdlib: Static supervisors are very idle processes after they
    have started so they will now be hibernated after start to
    improve resource management.
  * compiler: Fixed a bug where a failing bsl expression in a guard
    threw an exception instead of causing the guard to fail.
  * compiler: Complex guard expression using the or operator and
    guard BIFs that can fail could sometimes be miscompiled so that
    the guard would succeed even if a call to a guard BIF failed.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1687608000">- Version 26.0:
  * Leex has been extended with optional column number support.
  * The family of enumeration functions in module lists has been
    extended with enumerate/3 that allows a step value to be
    supplied.
  * Update Unicode to version 15.0.0.
  * proc_lib:start*/* has become synchronous when the started
    process fails. This requires that a failing process use a new
    function proc_lib:init_fail/2,3, or exits, to indicate failure. All
    OTP behaviours have been fixed to do this.
  * auto-complete of variables, record names, record fields names,
    map keys, function parameter types and filenames.
  * Open external editor in the shell to edit the current
    expression.
  * defining records (with types), functions, specs and types in
    the shell.
  * Creation and matching of binaries with segments of fixed sizes
    have been optimized.
  * Creation and matching of UTF-8 segments have been optimized.
  * Appending to binaries has been optimized.
  * The compiler and JIT now generate better code for creation of
    small maps where all keys are literals known at compile time.
  * Thanks to the optimizations above the performance of the base64
    module has been significantly improved. For example, on an
    x86_64 system with the JIT both encode and decode are almost
    three times faster than in Erlang/OTP 25.
  * Map comprehensions as suggested in EEP 58 has now been
    implemented.
  * Some map operations have been optimized by changing the
    internal sort order of atom keys. This changes the
    (undocumented) order of how atom keys in small maps are printed
    and returned by maps:to_list/1 and maps:next/1. The new order
    is unpredictable and may change between different invocations
    of the Erlang VM.
  * Introducing the new function maps:iterator/2 for creating an
    interator that return the map elements in a deterministic
    order. There are also new modifiers k and K for the format
    string in io:format() to support printing map elements ordered.
  * Added the new built-in type dynamic() introduced in EEP 61, PR
    introducing EEP 61 improving support for gradual type checkers.
  * Dialyzer has a new incremental mode that be invoked by giving
    the --incremental option when running Dialyzer. This new
    incremental mode is likely to become the default in a future
    release.
  * Multi time warp mode is now enabled by default. This assumes
    that all code executing on the system is time warp safe.
  * Support for UTF-8 atoms and strings in the NIF interface
    including new functions enif_make_new_atom,
    enif_make_new_atom_len and enif_get_string_length.
  * The BIFs min/2 and max/2 are now allowed to be used in guards
    and match specs.
  * Improved the selective receive optimization, which can now be
    enabled for references returned from other functions. This
    greatly improves the performance of gen_server:send_request/3,
    gen_server:wait_response/2, and similar functions.
  * It is no longer necessary to enable a feature in the runtime
    system in order to load modules that are using it. It is
    sufficient to enable the feature in the compiler when compiling
    it.
  * inet:setopts/2 has got 3 new options: reuseport, reuseport_lb
    and exclusiveaddruse.
  * Fix so that -fno-omit-frame-pointer is applied to all of the
    Erlang VM when using the JIT so that tools, such as perf, can
    crawl the process stacks.
  * In the lists module, the zip family of functions now takes
    options to allow handling lists of different lengths.
  * Added the zip:zip_get_crc32/2 function to retrieve the CRC32
    checksum from an opened ZIP archive. gen_server optimized by
    caching callback functions
  * The modules Erlang DNS resolver inet_res and helper modules
    have been updated for RFC6891; to handle OPT RR with DNSSEC OK
    (DO) bit.
  * Introduced application:get_supervisor/1.
  * Cache OTP boot code paths, to limit how many folders that are
    being accessed during a module lookup. Can be disabled with
  - cache_boot_path false.
  * Support for Kernel TLS (kTLS), has been added to the SSL
    application, for TLS distribution (-proto_dist inet_tls), the
    SSL option {ktls, true}.
  * Improved error checking and handling of ssl options.
  * Mitigate memory usage from large certificate chains by lowering
    the maximum handshake size. This should not effect the common
    cases, if needed it can be configured to a higher value.
  * For security reasons the SHA1 and DSA algorithms are no longer
    among the default values.
  * Add encoding and decoding of use_srtp hello extension to
    facilitate for DTLS users to implement SRTP functionality.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1687608001">- Changes for 26.0.1:
  * erts: Build of the socket nif failed on Solaris 11.
  * erts: Fixed two reduction-counting bugs relating to binaries.
  * erts: Constructing a binary segment not aligned with a byte
    boundary, with a size not fitting in 31 bits, and with a value
    not fitting in a 64-bit word could crash the runtime system.
  * erts: When a binary construction failed because of bad size for
    a segment, the error information was not always correct.
  * erts: Fixed a crash when calling a fun that was defined in a
    module that had been upgraded.
  * kernel: The POSIX error exdev was sometimes incorrectly
    described as "cross domain link" in some error messages.
  * kernel: Corrected the socket send function description (send
    with Timeout = nowait). The send function(s) could not return
    {ok, {RestData, SelectInfo}}
  * stdlib: The POSIX error exdev was sometimes incorrectly
    described as "cross domain link" in some error messages.
  * ssl: Make sure that selection of client certificates handle
    both TLS-1.3 and TLS-1.2 names correctly. Could cause valid
    client certificate to not be selected, and an empty client
    certificate message to be sent to server.
  * ssl: Improved ssl:format_error/1 to handle more error tuples.
  * ssl: Fixed hanging ssl:connect when ssl application is not
    started.
  * ssl: Correct handling of retransmission timers, current
    behavior could cause unwanted delays.
  * inets: Do not make the default ssl options by calling
    httpc:ssl_verify_host_options(true) if ssl options are supplied
    by the user.
  * xmerl: New options to xmerl_scan and xmerl_sax_parser so one
    can limit the behaviour of the parsers to avoid some XML
    security issues. xmerl_scan gets one new option:
    xmerl_sax_parser gets the following options: The old option
    skip_external_dtd is still valid and the same as
    {external_entities, none} and {fail_undeclared_ref, false} but
    just affects DTD's and not other external references.
  * compiler: Fixed a bug where a failing bsl expression in a guard
    threw an exception instead of causing the guard to fail.
  * compiler: Fixed a bug that would case the validator to reject
    legal code.
  * compiler: The compiler could re-order clauses matching binaries
    so that the incorrect clause would match. That could only
    happen for code that used the option {error_location,line} or
    for code without line or column number information (e.g.
    generated by a parse transform).
  * compiler: Complex guard expression using the or operator and
    guard BIFs that can fail could sometimes be miscompiled so that
    the guard would succeed even if a call to a guard BIF failed.
  * compiler: With optimizations disabled, a try/catch construct
    could return an incorrect value.
  * compiler: In rare circumstance, a combination of binary
    construction and binary_part/3 would cause the compiler to
    generate unsafe code that would crash the runtime system.
  * compiler: The compiler could be very slow when compiling guards
    with multiple guard tests separated with 'or' or ';'.
  * compiler: Complex guard expressions using 'or' and map updates
    could succeed even if the map update failed.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1698235200">- Changes for 26.1.2:
  * erts: If the external term format encoding of an argument list
    part of a distributed spawn operation was faulty, the newly
    spawned remote process could misbehave. The misbehavior
    included hanging or interpret an incoming message as an
    argument list to use. This was very unlikely to happen unless
    using an alternate implementation of the distribution protocol
    which made a faulty encoding of the argument list. The child
    process will now detect this error and terminate before
    executing the user specified code.
  * erts: Fix bugs where if the body of a matchspec would return a
    map with a variable ('$1', '$_' etc) as one of the keys or
    values and the variable was not an immidiate, the term would
    not be copied to the receiving processes heap. This would later
    corrupt the term in the table as the GC could place move
    markers in it, which in turn would cause the VM to crash. Bug
    has been present for since OTP 17.0.
  * xmerl: The xmerl version 1.3.32 was released in OTP 26.0.1, but
    the incorrect version number of 1.3.31.1 was used for it. This
    incorrect version number continued to appear in OTP 26.0.2, OTP
    26.1, and OTP 26.1.1. The actual xmerl code in these OTP
    versions however corresponds to xmerl version 1.3.32.
- Changes for 26.1.1:
  * wx: The wx application would fail to build on macOS with Xcode
    15.
  * compiler: The compiler could become extremely slow for modules
    containing huge functions.
  * stdlib: Garbage collect the shell process when reducing the
    amount of saved history and results.
- Changes for 26.1:
  * crypto: Fix VM crash caused by crypto being purged and reloaded
    (by init:restart for example) on OS with musl libc (such as
    Alpine linux).
  * crypto: Improved understanding of LibreSSL versions. Support
    chacha20 and chacha20_poly1305 for LibreSSL 3.7. Reflect
    removal of support for the DSS/DSA algorithm which was done in
    LibreSSL 2.6.1.
  * crypto: FIPS supported by crypto for OpenSSL 3.0.* and 3.1.*.
  * asn1: The ASN.1 compiler would ignore a constraint such as
    (SIZE (1..4), ...), causing incorrect behavior of the encoding
    and decoding function for the PER and UPER backends. Corrected
    to handle the constraint in the same way as (SIZE (1..4, ...)).
  * asn1: The JER backend has been internally refactored in a way
    that is compatible for applications that use the documented
    API. However, for a group of ASN.1 modules that depend on each
    other (for example, S1AP-PDU-Descriptions, S1AP-Contents, and
    so on), all modules in the group must be recompiled if on of
    the group members is recompiled.
  * observer: Closing the trace log window via the menu did not
    work.
  * erts: maps:put with existing key and identical value was not
    optimized as a no-op correctly if having the same 32-bit hash
    as another key in the map. In practice very rare and harmless.
  * erts: Fixed an issue with truncated crash slogans on failed
    emulator start.
  * erts: Fixed a bug where the emulator was unable to determine
    the current cgroup CPU quota.
  * erts: A process optimized for parallel signal delivery could
    under some circumstances lose wakeup information. That is, the
    processes was not woken up to take care of the signal, so the
    signal would not be taken care of until the process was woken
    by another signal. Only processes configured with
    message_queue_data set to off_heap utilize this optimization.
  * erts: Function socket:close/1 could cause a VM crash on
    Windows.
  * erts: Fixed a bug in the ARM JIT where it could accidentally
    add garbage trailing bits when creating bitstrings whose size
    wasn't an even multiple of 8 bits.
  * erts: Fix erlang:system_info/1 documentation to show correct
    types.
  * erts: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * erts: Fix compilation with GNU termcap.
  * erts: Delivery time of message signals to a process not
    executing any receive expressions could become very long,
    potentially infinite. For example, a process checking for
    messages using process_info(self(), message_queue_len) or
    process_info(self(), messages) and avoiding to execute a
    receive expression matching on messages could be very slow in
    detecting new messages. Note that you are still discouraged
    from using process_info() this way. A process that wants to
    check if there are messages available to handle should execute
    a receive expression matching on messages.
  * erts: On AArch64 (ARM64), when calculating both the quotient
    and remainder with a divisor begin a power two, the remainder
    could be incorrectly calculated.
  * erts: Fix bug causing "magic" references in a compressed ETS
    table to not keep the referred object alive. The symptom would
    be the referred object being garbage collected prematurely and
    the reference appearing stale, not referring to anything.
    Examples of such magically referred objects are atomics and NIF
    resources.
  * erts: Matching out short bitstrings with a fixed size not
    divisible by 8 could could lead to the runtime system
    terminating with an "Overrun heap and stack" error.
  * erts: A constant flow of incoming non-message signals could
    prevent a process needing to execute dirty from doing so.
  * erts: A BEAM file usually contains a chunk with the tag "Type"
    containing type information that can be used by the JIT. The
    beam_lib:strip/1 takes care to preserve that chunk, but a
    build/release tool that does customized stripping could
    accidentally remove the chunk. Loading a BEAM file without the
    "Type" chunk could cause incorrect behavior of the loaded code.
  * erts: gen_udp:recv/* for Unix Domain Socket in binary mode and
    passive mode has been fixed to not crash.
  * erts: The cleanup operation of not yet delivered signals to a
    terminated process yielded excessively.
  * erts: Fixed minor hashing issue with the local option of
    term_to_binary()/term_to_iovec().
  * erts: Update gen_tcp_socket and gen_udp_socket to handle
    'completion' (socket on Windows).
  * erts: Add support for Unix Domain Sockets (only for STREAM
    sockets) on Windows for 'socket'.
  * erts: In Erlang/OTP 27, by default escripts will be compiled
    before being executed. That means that the compiler application
    must be installed. It is possible to force the escript to be
    interpreted by adding the directive -mode(interpret). to the
    escript file. In Erlang/OTP 28, support for interpreting an
    escript will be removed.
  * erts: Add basic support for socket ioctl on Windows.
  * erts: Removed erts/etc/darwin/Info.plist, as it is no longer
    necessary after macos 10.12
  * erts: Add support for (Windows) socket option exclusiveaddruse.
  * erts: [socket] Add support for the 'nopush' option.
  * erts: Add support for socket option 'BSP STATE'.
  * erts: Add tcp socket options 'keepcnt', 'keepidle' and
    'keepintvl'.
  * erts: Add support for misc (Windows) socket options
    ('max_msg_size' and 'maxdg').
  * compiler: The compiler could run forever when compiling a call
    to is_record/3 with a huge positive tuple size. The call
    is_record(A, a, 0) would crash the compiler when used in a
    function body. When used in a guard the compiler would emit
    incorrect code that would accept {a&gt; as a record.
  * compiler: Fixed a bug that caused dialyzer to crash when
    analyzing bogus code that contained the literal atom undefined
    in segment sizes.
  * compiler: The compiler would crash when compiling some modules
    that contained a call to erlang:load_nif/2.
  * compiler: Fixed a bug that caused the compiler to crash on
    legal code.
  * compiler: The compiler could crash when attempting to compile a
    call to is_list/1 in a complex expression.
  * compiler: A complex guard expression using the or operator
    could succeed when it was supposed to fail.
  * compiler: Compiling nested try/catch and catch expression could
    result in an internal compiler error.
  * compiler: Using the bnot operator in a complex expression could
    cause the compiler to terminate with an internal consistency
    failure diagnostic.
  * compiler: Fixed a bug that caused the compiler to crash in a
    binary optimization pass.
  * compiler: The compiler could terminate with an internal error
    when attempting to compile a binary pattern that could not
    possibly match.
  * compiler: Fixed various performance issues related to the alias
    optimization pass.
  * erl_docgen: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * mnesia: Do not delete old backup file if the new backup fails.
  * megaco: Make megaco transports handle gen_tcp | gen_udp with
    socket backend on Windows (completion).
  * common_test: With this change, ct_hooks manual refers to CTH
    execution order section in user guide.
  * common_test: With this change, Config data from
    pre_end_per_testcase hook is delivered to post_end_per_testcase
    callback in case of testcase timetrap or linked process crash.
  * common_test: With this change, remaining references to not
    supported vts tool in ct_run are removed (mainly relates to
    docs and ct_run help message).
  * common_test: With this change, prompt search functionality in
    ct_telnet handles unicode input.
  * common_test: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * stdlib: The compiler could run forever when compiling a call to
    is_record/3 with a huge positive tuple size. The call
    is_record(A, a, 0) would crash the compiler when used in a
    function body. When used in a guard the compiler would emit
    incorrect code that would accept {a&gt; as a record.
  * stdlib: Fix bug in ets:tab2file that could make it fail if
    another Erlang process created the same file at the same time.
  * stdlib: An {else_clause,Value} exception will now be reported
    nicely in the shell.
  * stdlib: Correct return value for error case, so that it matches
    the documented and intended return value {error,
    {already_started, pid()} when local registered names are used.
  * stdlib: sys:get_state/1,2 and sys:replace_state/2,3 has been
    corrected to handle a state named error as a state name, not as
    a failed system callback. For the standard server behaviours
    this was an issue only for gen_statem (and gen_fsm) when the
    state name was error, and for gen_server if the complete state
    was {error,_}.
  * stdlib: Multiple problems were fixed in
    filelib:safe_relative_path/2. If its second argument was a path
    that contained symbolic links, an incorrect result patch could
    be returned. Also, paths were sometimes falsely considered
    unsafe.
  * stdlib: Fix deadlock when erl.exe is used as part of a pipe on
    Windows and trying to set the encoding of the standard_io
    device.
  * stdlib: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * stdlib: Fix h/2,3 to properly render multi-clause
    documentation.
  * stdlib: Timers created by timer:apply_after/4,
    apply_interval/4, and apply_repeatedly/4 would silently fail to
    do the apply if it was not possible to spawn a process when the
    timer expired. This has now been corrected, and if the spawn
    fails, the system will be taken down producing a crash dump.
  * stdlib: When an Erlang source file lacked a module definition,
    there would be a spurious "module name must not be empty"
    diagnostic for each spec in the file.
  * stdlib: The argument descriptions for option types in argparse
    have been made less ambiguous.
  * stdlib: Clarified the documentation of normal shutdown reason
    on gen_server:call/2,3
  * stdlib: Pattern matching and equivalence (=:=, =/=) comparisons
    on 0.0 will now raise a warning, as it will no longer be
    considered equivalent to -0.0 in OTP 27. If a match on 0.0
    specifically is desired (distinct from -0.0), the warning can
    be suppressed by writing +0.0 instead. The arithmetic
    comparison operators are unaffected, including arithmetic
    equality (==). *** POTENTIAL INCOMPATIBILITY ***
  * stdlib: The semantics of the gen_{server,statem,event}
    behaviour's synchronous start behaviour introduced in OTP-26.0
    with OTP-18471, has been clarified in the documentation.
  * stdlib: Added functionality to set a custom multiline prompt.
  * stdlib: A warning for (accidental use of) Triple-Quoted Strings
    has been implemented as per EEP 64. *** POTENTIAL
    INCOMPATIBILITY ***
  * stdlib: The keyboard shortcuts for the shell are now
    configurable.
  * kernel: Fixed an issue with truncated crash slogans on failed
    emulator start.
  * kernel: Fix shell:start_interactive function specification.
  * kernel: Fix code:get_doc/1 to return missing, when it can't
    find erts instead of crashing.
  * kernel: Function socket:close/1 could cause a VM crash on
    Windows.
  * kernel: Fix deadlock when erl.exe is used as part of a pipe on
    Windows and trying to set the encoding of the standard_io
    device.
  * kernel: Expanded the documentation about how to use the
    standard_io, standard_error and user I/O devices. Added the
    types io:standard_io/0, io:standard:error/0 and io:user/0.
  * kernel: Fix logger's overload protection mechanism to only
    fetch memory used by messages when needed.
  * kernel: Fixed a number of socket-related issues causing
    incompatibilities with gen_tcp and gen_udp respectively.
  * kernel: gen_tcp:connect with socket address and socket (inet-)
    backend fails because of missing callback function.
  * kernel: The DNS RR cache used by `inet_res` has been fixed to
    preserve insert order, which is beneficial when the DNS server
    returns RRs in some specific order for e.g load balancing
    purposes.
  * kernel: The options `reuseport`, `reuseport_lb` and
    `exclusiveaddruse` were accidentally not allowed for e.g
    `gen_udp:open/1,2`, which has now been corrected.
  * kernel: gen_udp:recv/* for Unix Domain Socket in binary mode
    and passive mode has been fixed to not crash.
  * kernel: Fixed issue where cursor would not be placed at the end
    of the expression when navigating shell history.
  * kernel: Update gen_tcp_socket and gen_udp_socket to handle
    'completion' (socket on Windows).
  * kernel: Add support for Unix Domain Sockets (only for STREAM
    sockets) on Windows for 'socket'.
  * kernel: Add basic support for socket ioctl on Windows.
  * kernel: The file:location/0 type is now exported.
  * kernel: Add support for (Windows) socket option
    exclusiveaddruse.
  * kernel: [socket] Add support for the 'nopush' option.
  * kernel: Add support for socket option 'BSP STATE'.
  * kernel: Add tcp socket options 'keepcnt', 'keepidle' and
    'keepintvl'.
  * kernel: Add support for misc (Windows) socket options
    ('max_msg_size' and 'maxdg').
  * kernel: The keyboard shortcuts for the shell are now
    configurable.
  * kernel: Optimized code_server to reduce repeated work when
    loading the same module concurrently.
  * debugger: The call int:no_break(Module) did not remove any
    breakpoints.
  * debugger: The maybe expression is now supported in the
    Debugger.
  * debugger: The maybe expression is now supported in the
    Debugger.
  * debugger: The call int:no_break(Module) did not remove any
    breakpoints.
  * ssl: Avoid function clause error in ssl:getopts/2 by handling
    that inet:getopts may return an empty list during some
    circumstances, such as the socket being in a closing state.
  * ssl: The API function `ssl:recv/3` has been tightened to
    disallow negative length, which has never been documented to
    work, but was passed through and caused strange errors.
  * ssl: When a client initiated renegotiation was rejected and the
    client socket was in active mode the expected error message to
    the controlling process was not sent.
  * ssl: Add some guidance for signature algorithms configuration
    in ssl applications users guide.
  * snmp: Make snmp handle gen_udp with socket backend on Windows
    (completion).
  * public_key: Country name comparison shall be case insensitive
  * public_key: Add check to disallow duplicate certs in a path
  * inets: With this change, re_write httpd works as expected and
    does not return error.
  * inets: Fixed a bug so httpd does not crash when stopped at the
    wrong time during TLS connection negotiation, or any other
    theoretically as slow connection setup.
  * inets: Enhance error handling and avoid that the HTTP client
    hangs on headers provided on the wrong format.
  * inets: With this change, error report generated by httpd during
    connection setup contains socket type information.
  * inets: Stop and restart of the httpd server in the Inets
    application has been refactored to a more synchronous and OTP
    supervisor friendly approach. This should increase stability
    and for example avoid a supervisor report from
    httpd_connection_sup about killed child process(es) in some
    cases when stopping or restarting httpd.
  * dialyzer: Fixed a bug that caused dialyzer to crash when
    analyzing bogus code that contained the literal atom undefined
    in segment sizes.
  * dialyzer: Dialyzer could crash when attempting to analyze a
    module that defined a type called product/.
- Changes for 26.0.2:
  * erts: Fix using the IME (Input Method Editor) to enter text in
    cmd.exe and powershell.exe on Windows.
  * erts: Multiple socket:accept calls issue. When making multiple
    accept calls, only the last call is active.
  * erts: Fix the shell to ignore terminal delay when the terminal
    capabilities report that they should be used.
  * erts: Fix "oldshell" to echo characters while typing on
    Windows.
  * erts: On Windows, a call to the function socket:close, when
    there are waiting active calls to read, write or accept
    functions, could hang.
  * erts: Fix issues when reading or configuring standard_io on
    Windows when erl.exe is started using -noshell flag.
  * erts: The following functions are now much faster when given a
    long list or binary:
  * erts: On AArch64 (ARM64), equality and non-equality tests with
    literal bitstrings could succeed when they should fail and vice
    versa.
  * compiler: Fixed a type handling bug that would cause an
    internal consistence failure for correct code.
  * compiler: Fixed a bug that could cause the stack trace of throw
    exceptions to be erroneously optimized out.
  * compiler: Complex guard expression using 'or' were not always
    fully evaluated, making guards that were supposed to fail
    succeed.
  * stdlib: Fix bug where when you entered Alt+Enter in the
    terminal, the cursor would move to the last line, instead of
    moving to the next line.
  * stdlib: Fix eof handling when reading from stdin when erlang is
    started using -noshell.
  * stdlib: Fixed problem where output would disappear if it was
    received after a prompt was written in the shell.
  * stdlib: The following functions are now much faster when given
    a long list or binary:
  * kernel: Fix bug where when you entered Alt+Enter in the
    terminal, the cursor would move to the last line, instead of
    moving to the next line.
  * kernel: Fix so that the shell does not crash on startup when
    termcap is not available.
  * kernel: Multiple socket:accept calls issue. When making
    multiple accept calls, only the last call is active.
  * kernel: Fix the shell to ignore terminal delay when the
    terminal capabilities report that they should be used.
  * kernel: Fix "oldshell" to echo characters while typing on
    Windows.
  * kernel: Fix eof handling when reading from stdin when erlang is
    started using -noshell.
  * kernel: On Windows, a call to the function socket:close, when
    there are waiting active calls to read, write or accept
    functions, could hang.
  * kernel: Fix issues when reading or configuring standard_io on
    Windows when erl.exe is started using -noshell flag.
  * kernel: gen_udp:connect with inet_backend = socket fails when
    the Address is a hostname (string or atom).
  * kernel: Fixed problem which would cause shell to crash if
    particular escape sequence was written to stdout.
  * kernel: Fixed problem where output would disappear if it was
    received after a prompt was written in the shell.
  * kernel: Fix a crash where the location of erts could not be
    found in rebar3 dev builds.
  * kernel: Introduce the KERNEL application parameter
    standard_io_encoding that can be used to set the default
    encoding for standard_io. This option needs to be set to latin1
    if the application wants to treat all input data as bytes
    rather than utf-8 encoded characters.
  * ssl: Added keylog information to all protocol versions in
    ssl:connection_information/2.
  * ssl: Add RFC-6083 considerations for DTLS to enable gen_sctp
    based callback for the transport.
  * ssh: Added multiline editing support to ssh clients connected
    through OTP ssh daemon.</changelog>
  <changelog author="sflees@suse.de" date="1704974400">- Changes for 26.2.1:
  * erts: Removed unnecessary PCRE source tar-ball.
  * ssh: With this change (being response to CVE-2023-48795),
    ssh can negotiate "strict KEX" OpenSSH extension with
    peers supporting it; also
    'chacha20-poly1305@openssh.com' algorithm becomes a
    less preferred cipher.
    If strict KEX availability cannot be ensured on both
    connection sides, affected encryption modes(CHACHA and
    CBC) can be disabled with standard ssh configuration.
    This will provide protection against vulnerability, but
    at a cost of affecting interoperability. See
    Configuring algorithms in SSH. (bsc#1218192, CVE-2023-48795)
- Changes for 26.2:
  * all: Replaced unintentional Erlang Public License 1.1
    headers in some files with the intended Apache License
    2.0 header.
  * otp: The removal of the deprecated slave module, originally
    planned for OTP 27, has been postponed to OTP 29.
  * asn1: Fix benign warning from gcc 11 about mismatching call
    to free().
  * crypto: Enable engine support for OpenSSL versions 3.
  * edoc: Emit &lt;code&gt; instead of &lt;tt&gt;.
- Disable test suite for now, it has many false positives and
  takes a very long time.</changelog>
  <changelog author="sflees@suse.de" date="1706011200">- This codestream wasn't affected by bsc#1207113</changelog>
  <changelog author="sflees@suse.de" date="1706011201">- Disable rpmlint tests on SLE-15 where they currently fail</changelog>
  <changelog author="sflees@suse.de" date="1715947200">- Create a versioned package for SLES</changelog>
</package>
<package pkgid="abe7cbc4c70c3edf4f5362e3209c731433665809a9490de80a4062a6441fe89f" name="erlang26-dialyzer" arch="ppc64le">
  <version epoch="0" ver="26.2.1" rel="150300.7.5.1"/>
  <changelog author="matwey.kornilov@gmail.com" date="1646568000">- Changes for 24.2.2:
  * inets: Avoid intermediate ungraceful shutdown of the HTTP
    server.
  * ssh: The ssh sever parallel_login option was missing in OTP-24</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1648382400">- Changes for 24.3.2:
  * erl_interface: Fix compile error regarding gethostbyaddr_r on
    Android. Error introduced in OTP 24.3.
  * kernel: Fix failed accepted connection setup after previous
    established connection from same node closed down silently.
  * kernel: Fixed a problem where typing Ctrl-R in the shell could
    hang if there were some problem with the history log file.
- Changes for 24.3.1:
  * dialyzer: There could be spurious warnings for unknown types
    when a type was a subtype of an existing type that was a
    subtype of an unknown type.
  * ssl: Client certification could fail for TLS-1.3 servers that
    did not include the certificat_authorties extension in its
    certificate request message.
- Changes for 24.3:
  * megaco: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.
  * megaco: Update the performance and debug chapters of the megaco
    user's guide. Also some updates to the meas tools.
  * compiler: The expression &lt;&lt;0/native-float&gt;&gt;=Bin would always
    fail to match, while &lt;&lt;0/float-native&gt;&gt;=Bin would match
    (provided that Bin contained the binary representation of 0.0)
  * compiler: The compiler will now compile huge functions with
    straight-line code faster.
  * erl_interface: Add --enable-ei-dynamic-lib configure option
    that will make erl_interface also release a dynamic library
    version of libei.
  * erl_interface: The ei API for decoding/encoding terms is not
    fully 64-bit compatible since terms that have a representation
    on the external term format larger than 2 GB cannot be handled.
  * sasl: Fix bug in systools:make_script/1 documentation.
  * inets: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.
  * inets: Documentation fix for inets:services_info/0, which now
    describes that Info might be a Reason term() in case when
    {error, Reason} is returned as service info.
  * crypto: The crypto app in OTP can since OTP-24.2 be compiled,
    linked and used with the new OpenSSL 3.0 cryptolib. The crypto
    app has 3.0 support has been improved, but is still *not
    recommended* for other usages than experiments and alpha
    testing. There are not yet any guaranties that it works, not
    even together with other OTP applications like for example SSL
    and SSH, although there are no known errors. Since the previous
    release, OTP-24.2, the following improvements have been done: -
    It has been tested during nearly every nightly test on the OTP
    lab - The hash algorithms md4 and ripemd160 have been enabled
    with OpenSSL 3.0. - The ciphers blowfish_cbc, blowfish_ecb,
    des_cbc, des_cfb, des_ecb, rc2_cbc and rc4 have been enabled
    with OpenSSL 3.0. Disabled or unsupported with OpenSSL 3.0 are
    still: - ENGINE support - FIPS mode - Other providers than the
    built-in ones - Compiling and linking with OpenSSL 3.0
    cryptolib in compatibility modes (for example to behave as
    1.1.1) and, the ciphers blowfish_cfb64 and blowfish_ofb64 are
    not supported and will not be either. Deprecated functions in
    the OpenSSL 3.0 cryptolib must not be disabled as OTP/crypto
    still uses some of the deprecated API functions. The gcc flag
  - Wno-deprecated-declarations is set to prevent deprecation
    warnings to be printed when compiling.
  * crypto: Crypto is adapted to LibreSSL 3.5.0 on OpenBSD.
  * crypto: New configure option ( --disable-otp-test-engine) to
    prohibit the build of the OTP test engine used in some test
    suites. The reason is that the test engine could be hard to
    compile on for instance LibreSSL 3.5.0. For that particular
    cryptolib version (or higher), this configure option is set
    automatically.
  * jinterface: Fix bug in OtpOutputStream.write_pid/4 and
    write_ref/3 causing faulty encodig. Bug exists since OTP 23.0.
  * wx: Removed the static_data option from wxImage creation
    functions, as it was broken and could lead to crashes. Now
    image data is always copied to wxWidgets as was the default
    behavior. Removed some non working wxGridEvent event types,
    which have there own events in newer wxWidgets versions, and
    added a couple of event types that where missing in wx.
  * asn1: Add support for the maps option in combination with the
    jer backend.
  * snmp: The compilation time is no longer recorded in BEAM files.
    There remained several undocumented functions that attempted to
    retrieve compilation times. Those have now been removed.
  * snmp: [agent] Remove expectation of socket being a port.
  * common_test: OTP internal test fix.
  * runtime_tools: Fixed bug in scheduler:utilization(Seconds) that
    would leave the scheduler_wall_time system flag incorrectly
    enabled.
  * runtime_tools: Add scheduler:get_sample/0 and get_sample_all/0.
    Also clarify scheduler module documentation about how it
    depends on system flag scheduler_wall_time.
  * erts: Fixed a bug in the x86 JIT that might cause floating
    point instructions to wrongly throw an exception.
  * erts: Preserve correct nodedown_reason if supervised
    distribution controller processes exit with {shutdown, Reason}.
  * erts: Handling of send_timeout for gen_tcp has been corrected
    so that the timeout is honored also when sending 0 bytes.
  * erts: By default global does not take any actions to restore a
    fully connected network when connections are lost due to
    network issues. This is problematic for all applications
    expecting a fully connected network to be provided, such as for
    example mnesia, but also for global itself. A network of
    overlapping partitions might cause the internal state of global
    to become inconsistent. Such an inconsistency can remain even
    after such partitions have been brought together to form a
    fully connected network again. The effect on other applications
    that expects that a fully connected network is maintained may
    vary, but they might misbehave in very subtle hard to detect
    ways during such a partitioning. In order to prevent such
    issues, we have introduced a prevent overlapping partitions fix
    which can be enabled using the prevent_overlapping_partitions
    kernel(6) parameter. When this fix has been enabled, global
    will actively disconnect from nodes that reports that they have
    lost connections to other nodes. This will cause fully
    connected partitions to form instead of leaving the network in
    a state with overlapping partitions. Note that this fix has to
    be enabled on all nodes in the network in order to work
    properly. Since this quite substantially changes the behavior,
    this fix is currently disabled by default. Since you might get
    hard to detect issues without this fix you are, however,
    strongly advised to enable this fix in order to avoid issues
    such as the ones described above. As of OTP 25 this fix will
    become enabled by default.
  * erts: Corrected the type specification of erlang:seq_trace/2.
  * erts: Fix memory leak when tracing on running on a process that
    only handle system tasks or non-message signals (for example
    process_info requests).
  * erts: Add support for using socket:sockaddr_in() and
    socket:sockaddr_in6() when using gen_sctp, gen_tcp and gen_udp.
    This will make it possible to use Link Local IPv6 addresses.
  * erts: Show on_load failure reasons in embedded mode.
  * erts: Compile date saved in the Erlang VM executable has been
    removed.
  * erts: Improve documentation for the dynamic node name feature.
  * ssh: Fix makefile dependency bugs.
  * ssh: Fixed faulty OpenSSH decoding of Ed25519/Ed448 keys in the
    OpenSSH format openssh_key_v1.
  * ssh: Correction of ssh_file typing, specially for the
    experimental openssh-key-v1 encoding.
  * ssh: Improper tag for private ED keys when encoding with
    ssh:encode/2. The tuple had ed_priv as first element, but
    should have had ed_pri. This is now corrected. *** POTENTIAL
    INCOMPATIBILITY ***
  * ssh: Add support for Ed25519/Ed448 SSH host keys in the RFC
    4716 format ("-----BEGIN EC PRIVATE KEY-----") generated by for
    example openssl or via Erlang functions (i.e.
    public_key:generate_key({namedCurve, ed25519})). Ed25519 SSH
    host keys generated by ssh-keygen was, and are still,
    supported.
  * kernel: Handling of send_timeout for gen_tcp has been corrected
    so that the timeout is honored also when sending 0 bytes.
  * kernel: By default global does not take any actions to restore
    a fully connected network when connections are lost due to
    network issues. This is problematic for all applications
    expecting a fully connected network to be provided, such as for
    example mnesia, but also for global itself. A network of
    overlapping partitions might cause the internal state of global
    to become inconsistent. Such an inconsistency can remain even
    after such partitions have been brought together to form a
    fully connected network again. The effect on other applications
    that expects that a fully connected network is maintained may
    vary, but they might misbehave in very subtle hard to detect
    ways during such a partitioning. In order to prevent such
    issues, we have introduced a prevent overlapping partitions fix
    which can be enabled using the prevent_overlapping_partitions
    kernel(6) parameter. When this fix has been enabled, global
    will actively disconnect from nodes that reports that they have
    lost connections to other nodes. This will cause fully
    connected partitions to form instead of leaving the network in
    a state with overlapping partitions. Note that this fix has to
    be enabled on all nodes in the network in order to work
    properly. Since this quite substantially changes the behavior,
    this fix is currently disabled by default. Since you might get
    hard to detect issues without this fix you are, however,
    strongly advised to enable this fix in order to avoid issues
    such as the ones described above. As of OTP 25 this fix will
    become enabled by default.
  * kernel: Fix bug where logger would crash when logging a report
    including improper lists.
  * kernel: Make erlang:set_cookie work for dynamic node names.
  * kernel: Add support for using socket:sockaddr_in() and
    socket:sockaddr_in6() when using gen_sctp, gen_tcp and gen_udp.
    This will make it possible to use Link Local IPv6 addresses.
  * kernel: A net_tickintensity kernel parameter has been
    introduced. It can be used to control the amount of ticks
    during a net_ticktime period. A new net_kernel:start/2 function
    has also been introduced in order to make it easier to add new
    options. The use of net_kernel:start/1 has been deprecated.
  * kernel: Improve documentation for the dynamic node name
    feature.
  * erl_docgen: Fix css for large tables and images on small
    screens
  * erl_docgen: Fix bug with codeinclude tag that caused it to not
    include the code if used in a correct, but unexpected way.
  * observer: Calculate the display width in etop, instead of hard-
    coding it to 89 characters.
  * debugger: Fix record index matching, it was broken and could
    never match.
  * ssl: Improved error handling.
  * ssl: Before this change, net_kernel used with TLS distribution
    might be leaking processes in case of connectivity issues.
  * ssl: Fix makefile dependency bugs.
  * ssl: Make sure the TLS sender process handles explicit calls to
    erlang:disconnect_node properly, avoiding potential hanging
    problems in net_kernel.
  * ssl: Add support for TLS-1.3 certificate_authorities extension.
    And process certificate_authorities field in pre-TLS-1.3
    certificate requests.
  * ssl: Support password fun for protected keyfiles in ssl:connect
    function.
  * ssl: Add in some cases earlier detection of possible DoS
    attacks by malicious clients sending unexpected TLS messages
    instead of the client hello. Note that such attacks are already
    mitigated by providing a timeout for the TLS handshake.
  * eldap: Fix eldap extensibleMatch dnAttributes option. According
    to the ldap ASN1 the dnAttributes should be a bool, instead it
    was generated as a string.
  * eldap: Implemented paged searches according to https://www.rfc-
    editor.org/rfc/rfc2696.txt
  * public_key: Support password fun for protected keyfiles in
    ssl:connect function.
  * stdlib: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.
  * mnesia: Reduce the number of locks taken during table copying,
    should reduce the startup time on large systems.
  * diameter: The compilation time is no longer recorded in BEAM
    files. There remained several undocumented functions that
    attempted to retrieve compilation times. Those have now been
    removed.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1649246400">- Fix build for Factory. Currently, any Java version
  is fine for Erlang.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1653220800">- Version 25.0:
  - stdlib
  * New function filelib:ensure_path/1 will ensure that all
    directories for the given path exists
  * New functions groups_from_list/2 and groups_from_list/3 in
    the maps module
  * New functions uniq/1 uniq/2 in the lists module
  * New PRNG added to the rand module, for fast pseudo-random
    numers.
  - compiler, kernel, stdlib, syntax_tools:
  * Added support for selectable features as described in EEP-60.
    Features can be enabled/disabled during compilation with
    options (ordinary and +term) to erlc as well as with
    directives in the file. Similar options can be used to erl
    for enabling/disabling features allowed at runtime. The new
    maybe expression EEP-49 is fully supported as the feature
    maybe_expr.
  - erts &amp; JIT:
  * The JIT now works for 64-bit ARM processors.
  * The JIT now does type-based optimizations based on type
    information in the BEAM files.
  * Improved the JIT’s support for external tools like perf and
    gdb, allowing them to show line numbers and even the original
    Erlang source code when that can be found.
  - erts, stdlib, kernel:
  * Users can now configure ETS tables with the
    {write_concurrency, auto} option. This option forces tables
    to automatically change the number of locks that are used at
    run-time depending on how much concurrency is detected. The
    {decentralized_counters, true} option is enabled by default
    when {write_concurrency, auto} is active.
  * Benchmark results comparing this option with the other ETS
    optimization options are available here: benchmarks.
  * To enable more optimizations, BEAM files compiled with OTP 21
    and earlier cannot be loaded in OTP 25.
  * The signal queue of a process with the process flag
    message_queue_data=off_heap has been optimized to allow
    parallel reception of signals from multiple processes. This
    can improve performance when many processes are sending in
    parallel to one process. See benchmark.
  * The Erlang installation directory is now relocatable on the
    file system given that the paths in the installation’s
    RELEASES file are paths that are relative to the
    installations root directory.
  * A new option called short has been added to the functions
    erlang:float_to_list/2 and erlang:float_to_binary/2. This
    option creates the shortest correctly rounded string
    representation of the given float that can be converted back
    to the same float again.
  * Introduction of quote/1 and unquote/1 functions in the
    uri_string module - a replacement for the deprecated
    functions http_uri:encode and http_uri:decode.
  * The new module peer supersedes the slave module. The slave
    module is now deprecated and will be removed in OTP 27.
  * global will now by default prevent overlapping partitions due
    to network issues. This is done by actively disconnecting
    from nodes that reports that they have lost connections to
    other nodes. This will cause fully connected partitions to
    form instead of leaving the network in a state with
    overlapping partitions.
  * It is possible to turn off the new behavior by setting the
    the kernel configuration parameter
    prevent_overlapping_partitions to false. Doing this will
    retain the same behavior as in OTP 24 and earlier.
  * The format_status/2 callback for gen_server, gen_statem and
    gen_event has been deprecated in favor of the new
    format_status/1 callback.
  * The new callback adds the possibility to limit and change
    many more things than the just the state.
  * The timer module has been modernized and made more efficient,
    which makes the timer server less susceptible to being
    overloaded. The timer:sleep/1 function now accepts an
    arbitrarily large integer.
  - compiler:
  * The maybe ... end construction as proposed in EEP-49 has been
    implemented. It can simplify complex code where otherwise
    deeply nested cases would have to be used.
  * To enable maybe, give the option {enable_feature,maybe_expr}
    to the compiler. The exact option to use will change in a
    coming release candidate and then it will also be possible to
    use from inside the module being compiled.
  * When a record matching or record update fails, a {badrecord,
    ExpectedRecordTag} exception used to be raised. In this
    release, the exception has been changed to {badrecord,
    ActualValue}, where ActualValue is the value that was found
    instead of the expected record.
  * Add compile attribute -nifs() to empower compiler and loader
    with information about which functions may be overridden as
    NIFs by erlang:load_nif/2.
  * Improved and more detailed error messages when binary
    construction with the binary syntax fails. This applies both
    for error messages in the shell and for
    erl_error:format_exception/3,4.
  * Change format of feature options and directives for better
    consistency. Options to erlc and the -compile(..) directive
    now has the format {feature, feature-name, enable | disable}.
    The -feature(..) now has the format -feature(feature-name,
    enable | disable).
  - crypto:
  * Add crypto:hash_equals/2 which is a constant time comparision
    of hashvalues.
  - ssl:
  * Introducing a new (still experimental) option
    {certs_keys,[cert_key_conf()]}. With this a list of a
    certificates with their associated key may be used to
    authenticate the client or the server. The certificate key
    pair that is considered best and matches negotiated
    parameters for the connection will be selected.
  - public_key:
  * Functions for retrieving OS provided CA-certs added.
  - dialyzer:
  * Optimize operations in the erl_types module. Parallelize the
    Dialyzer pass remote.
  * Added the missing_return and extra_return options to raise
    warnings when specifications differ from inferred types.
    These are similar to, but not quite as verbose as overspecs
    and underspecs.
  * Dialyzer now better understands the types for min/2, max/2,
    and erlang:raise/3. Because of that, Dialyzer can potentially
    generate new warnings. In particular, functions that use
    erlang:raise/3 could now need a spec with a no_return()
    return type to avoid an unwanted warning.</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1656849600">- Changes for 25.0.2:
  * ssl: Improved handling of unexpected messages during the
    handshake, taking the right action for unexpected messages.
  * erts: On computers with the ARM64 (AArch64) architecture (such
    as Apple Silicon Macs) a rem expression followed by a div
    expression with the same operands could evaluate to the wrong
    result if the result of the rem expression was unused.
- Changes for 25.0.1:
  * ssl: When a TLS-1.3 enabled client tried to talk to a TLS-1.2
    server that coalesces TLS-1.2 handshake message over one TLS
    record, the connection could fail due to some message being
    handled in the wrong state, this has been fixed.
  * ssl: Correctly handles supported protocol version change from
    default to something else by sni_fun supplied to
    ssl:handshake/[2,3] together with a TCP-socket (so called
    upgrade).
  * ssl: Also, TLS-1.3 should respond with a protocol version alert
    if previous versions, that are supported but not configured,
    are attempted.
  * kernel: The DNS resolver inet_res has been fixed to ignore
    trailing dot difference in the request domain between the sent
    request and the received response, when validating a response.
  * kernel: A bug in inet_res has been fixed where a missing
    internal {ok,_} wrapper caused inet_res:resolve/* to return a
    calculated host name instead of an `{ok,Msg} tuple, when
    resolving an IP address or a host name that is an IP address
    string.
  * kernel: The erlang:is_alive() BIF could return true before
    configured distribution service was available. This bug was
    introduced in OTP 25.0 ERTS version 13.0. The
    erlang:monitor_node() and erlang:monitor() BIFs could
    erroneously fail even though configured distribution service
    was available. This occurred if these BIFs were called after
    the distribution had been started using dynamic node name
    assignment but before the name had been assigned.
  * kernel: Added the missing mandatory address/0 callback in the
    gen_tcp_dist example.
  * erts: A spawn_reply signal from a remote node could be delayed
    and be delivered after other signals from the newly spawned
    process. When this bug triggered, the connection to the node
    where the process was spawned sometimes could be taken down due
    to the bug. The following error message would then be logged if
    this happened: Missing 'spawn_reply' signal from the node
    &lt;RemoteNode&gt; detected by &l
[file cut: first 33554432 bytes kept]
[document cut: first 32113238 of 33547121 characters kept]
